From e8510dfdb80bd01b9f7c3b5846639037a4535276 Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Mon, 16 Dec 2024 20:52:58 +0000 Subject: [PATCH 01/16] ab#66269 --- .../Imperva.curl | 45 --- Fortigate/FortigateStore.cs | 370 ++++++++++-------- Fortigate/Management.cs | 9 +- docsource/content.md | 49 +++ docsource/fortigate.md | 1 + readme-src/readme-pam-support.md | 4 - 6 files changed, 269 insertions(+), 209 deletions(-) delete mode 100644 Certificate Store Type CURL Script/Imperva.curl create mode 100644 docsource/content.md create mode 100644 docsource/fortigate.md delete mode 100644 readme-src/readme-pam-support.md diff --git a/Certificate Store Type CURL Script/Imperva.curl b/Certificate Store Type CURL Script/Imperva.curl deleted file mode 100644 index c269023..0000000 --- a/Certificate Store Type CURL Script/Imperva.curl +++ /dev/null @@ -1,45 +0,0 @@ -###CURL script to create Fortigate certificate store type - -###Replacement Variables - Manually replace these before running### -# {URL} - Base URL for your Keyfactor deployment -# {UserName} - User name with access to run Keyfactor APIs -# {UserPassword} - Password for the UserName above - -curl -X POST {URL}/keyfactorapi/certificatestoretypes -H "Content-Type: application/json" -H "x-keyfactor-requested-with: APIClient" -u {UserName}:{UserPassword} -d '{ - "Name": "Fortigate", - "ShortName": "Fortigate", - "Capability": "Fortigate", - "ServerRequired": false, - "BlueprintAllowed": true, - "CustomAliasAllowed": "Required", - "PowerShell": false, - "PrivateKeyAllowed": "Required", - "SupportedOperations": { - "Add": true, - "Create": false, - "Discovery": false, - "Enrollment": false, - "Remove": true - }, - "PasswordOptions": { - "Style": "Default", - "EntrySupported": false, - "StoreRequired": true - }, - "Properties": [], - "EntryParameters": [] -}' -Footer -© 2022 GitHub, Inc. -Footer navigation -Terms -Privacy -Security -Status -Docs -Contact GitHub -Pricing -API -Training -Blog -About diff --git a/Fortigate/FortigateStore.cs b/Fortigate/FortigateStore.cs index be5baae..d33363d 100644 --- a/Fortigate/FortigateStore.cs +++ b/Fortigate/FortigateStore.cs @@ -33,6 +33,7 @@ using Microsoft.Extensions.Logging; using Keyfactor.Orchestrators.Common.Enums; using System.Reflection.Metadata; +using System.Linq.Expressions; namespace Keyfactor.Extensions.Orchestrator.Fortigate { @@ -80,16 +81,26 @@ public FortigateStore(string fortigateHost, string accessToken) public void Delete(string alias) { - logger = LogHandler.GetClassLogger(this.GetType()); - - var result = DeleteResource(delete_certificate_api + alias); + logger.MethodEntry(LogLevel.Debug); - logger.MethodExit(LogLevel.Debug); + try + { + DeleteResource(delete_certificate_api + alias); + } + catch (Exception ex) + { + logger.LogError(FortigateException.FlattenExceptionMessages(ex, $"Error deleting certificate {alias}: ")); + throw; + } + finally + { + logger.MethodExit(LogLevel.Debug); + } } public bool Exists(string alias) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); try { @@ -106,12 +117,11 @@ public bool Exists(string alias) { logger.MethodExit(LogLevel.Debug); } - } public void UpdateUsage(string alias, string path, string name, string attribute) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); var attributeValue = new Dictionary(); attributeValue.Add("q_origin_key", alias); @@ -122,99 +132,130 @@ public void UpdateUsage(string alias, string path, string name, string attribute var parameters = new Dictionary(); parameters.Add("vdom", "root"); - var result = PutAsJson(endpoint, main, parameters); - logger.LogDebug(result); - logger.MethodExit(LogLevel.Debug); + try + { + PutAsJson(endpoint, main, parameters); + } + catch (Exception ex) + { + logger.LogError(FortigateException.FlattenExceptionMessages(ex, $"Error updating usage for {alias}: ")); + throw; + } + finally + { + logger.MethodExit(LogLevel.Debug); + } } public Usage Usage(string alias) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); var parameters = new Dictionary(); parameters.Add("vdom", "root"); parameters.Add("scope", "global"); parameters.Add("mkey", alias); parameters.Add("qtypes", "[160]"); - var result = GetResource(cert_usage_api, parameters); - var response = JsonConvert.DeserializeObject>(result); - logger.MethodExit(LogLevel.Debug); - return response.results; + try + { + var result = GetResource(cert_usage_api, parameters); + var response = JsonConvert.DeserializeObject>(result); + return response.results; + } + catch (Exception ex) + { + logger.LogError(FortigateException.FlattenExceptionMessages(ex, $"Error checking usage for {alias}: ")); + throw; + } + finally + { + logger.MethodExit(LogLevel.Debug); + } } public void Insert(string alias, string cert, string privateKey, bool overwrite, string password = null) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); - if (overwrite) + try { - var tmpAlias = alias + "_kftmp"; - var existing = Exists(alias); - var tmpExisting = Exists(tmpAlias); - - //if there is an existing record - if (existing) + if (overwrite) { - //check to see if it's in use - var existingUsage = Usage(alias); + var tmpAlias = alias + "_kftmp"; + var existing = Exists(alias); + var tmpExisting = Exists(tmpAlias); - //if it's currently in use - if (existingUsage.currently_using.Length > 0) + //if there is an existing record + if (existing) { - //if we don't have a tmp create a temp - if (!tmpExisting) - { - //create tmp - Insert(tmpAlias, cert, privateKey); - - tmpExisting = true; - } + //check to see if it's in use + var existingUsage = Usage(alias); - foreach (var existingUsing in existingUsage.currently_using) + //if it's currently in use + if (existingUsage.currently_using.Length > 0) { - UpdateUsage(tmpAlias, existingUsing.path, existingUsing.name, existingUsing.attribute); + //if we don't have a tmp create a temp + if (!tmpExisting) + { + //create tmp + Insert(tmpAlias, cert, privateKey); + + tmpExisting = true; + } + + foreach (var existingUsing in existingUsage.currently_using) + { + UpdateUsage(tmpAlias, existingUsing.path, existingUsing.name, existingUsing.attribute); + } } - } - logger.LogDebug("Deleting alias:" + alias); - Delete(alias); - } + logger.LogDebug("Deleting alias:" + alias); + Delete(alias); + } - logger.LogDebug("Inserting alias:" + alias); - Insert(alias, cert, privateKey, password); + logger.LogDebug("Inserting alias:" + alias); + Insert(alias, cert, privateKey, password); - //if we have an existing temp record - if (tmpExisting) - { - //check to see if it has any binds - var tmpUsage = Usage(tmpAlias); - if (tmpUsage.currently_using.Length > 0) + //if we have an existing temp record + if (tmpExisting) { - //transfer binds back to original - foreach (var tmpUsing in tmpUsage.currently_using) + //check to see if it has any binds + var tmpUsage = Usage(tmpAlias); + if (tmpUsage.currently_using.Length > 0) { - UpdateUsage(alias, tmpUsing.path, tmpUsing.name, tmpUsing.attribute); + //transfer binds back to original + foreach (var tmpUsing in tmpUsage.currently_using) + { + UpdateUsage(alias, tmpUsing.path, tmpUsing.name, tmpUsing.attribute); + } } + logger.LogDebug("Deleting alias:" + tmpExisting); + Delete(tmpAlias); } - logger.LogDebug("Deleting alias:" + tmpExisting); - Delete(tmpAlias); + } + else + { + //no overwrite so we just try to insert + logger.LogDebug("Inserting certificate with alias: " + alias); + Insert(alias, cert, privateKey, password); } } - else + catch (Exception ex) { - //no overwrite so we just try to insert - logger.LogDebug("Inserting certificate with alias: " + alias); - Insert(alias, cert, privateKey, password); + logger.LogError(FortigateException.FlattenExceptionMessages(ex, $"Error inserting/replacing certificate {alias}: ")); + throw; + } + finally + { + logger.MethodExit(LogLevel.Debug); } - - logger.MethodExit(LogLevel.Debug); } private void Insert(string alias, string cert, string privateKey, string password = null) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); var cert_resource = new cmdb_certificate_resource() { @@ -226,108 +267,126 @@ private void Insert(string alias, string cert, string privateKey, string passwor type = "regular" }; - logger.LogDebug(alias); - logger.LogDebug("key_file_content:" + privateKey); - logger.LogDebug("file_content:" + cert); - - Insert(cert_resource); - - logger.MethodExit(LogLevel.Debug); - } - - private void Insert(cmdb_certificate_resource cert) - { - logger = LogHandler.GetClassLogger(this.GetType()); - var parameters = new Dictionary(); parameters.Add("vdom", "root"); - var result = PostAsJson(import_certificate_api, cert, parameters); - logger.LogDebug(result); - - logger.MethodExit(LogLevel.Debug); + try + { + PostAsJson(import_certificate_api, cert_resource, parameters); + } + catch (Exception ex) + { + logger.LogError(FortigateException.FlattenExceptionMessages(ex, $"Error inserting certificate {alias}: ")); + throw; + } + finally + { + logger.MethodExit(LogLevel.Debug); + } } public List List() { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); List items = new List(); - var result = GetResource(available_certificates); - var response = JsonConvert.DeserializeObject>(result); + try + { + var result = GetResource(available_certificates); + var response = JsonConvert.DeserializeObject>(result); - foreach( var cert in response.results) - { - if (cert.type == "local-cer") + foreach( var cert in response.results) { - var certFile = DownloadFileAsString(cert.name, cert.type); - - var item = new CurrentInventoryItem() + if (cert.type == "local-cer") { - Alias = cert.name, - Certificates = new string[] { certFile }, - ItemStatus = OrchestratorInventoryItemStatus.Unknown, - PrivateKeyEntry = true, - UseChainLevel = false - }; - - items.Add(item); - } - } + var certFile = DownloadFileAsString(cert.name, cert.type); - logger.MethodExit(LogLevel.Debug); + var item = new CurrentInventoryItem() + { + Alias = cert.name, + Certificates = new string[] { certFile }, + ItemStatus = OrchestratorInventoryItemStatus.Unknown, + PrivateKeyEntry = true, + UseChainLevel = false + }; + + items.Add(item); + } + } - return items; + return items; + } + catch (Exception ex) + { + logger.LogError(FortigateException.FlattenExceptionMessages(ex, "Error retrieving certificate list: ")); + throw; + } + finally + { + logger.MethodExit(LogLevel.Debug); + } } private string DownloadFileAsString(string mkey, string type) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); var parameters = new Dictionary(); parameters.Add("mkey", mkey); parameters.Add("type", type); - var response = client.GetAsync(GetUrl(download_certificate, parameters)).GetAwaiter().GetResult(); - var content = response.Content.ReadAsStringAsync().GetAwaiter().GetResult(); - if (!response.IsSuccessStatusCode) - throw new Exception($"Error retrieving certificate {mkey}: {content}"); + try + { + var response = client.GetAsync(GetUrl(download_certificate, parameters)).GetAwaiter().GetResult(); + var content = response.Content.ReadAsStringAsync().GetAwaiter().GetResult(); + if (!response.IsSuccessStatusCode) + throw new Exception($"Error retrieving certificate {mkey}: {content}"); - logger.MethodExit(LogLevel.Debug); - return content; + return content; + } + catch (Exception ex) + { + logger.LogError(FortigateException.FlattenExceptionMessages(ex, $"Error retrieving downloading file {mkey}: ")); + throw; + } + finally + { + logger.MethodExit(LogLevel.Debug); + } } private String PostAsJson(string endpoint, cmdb_certificate_resource obj, Dictionary additionalParams = null) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); string content = ""; + var url = GetUrl(endpoint, additionalParams); + var stringContent = new StringContent(JsonConvert.SerializeObject(obj), Encoding.UTF8, "application/json"); + stringContent.Headers.ContentType = new MediaTypeHeaderValue("application/json"); + try { - var url = GetUrl(endpoint, additionalParams); - logger.LogDebug("postAsJson to url:" + url); - var stringContent = new StringContent(JsonConvert.SerializeObject(obj), Encoding.UTF8, "application/json"); - stringContent.Headers.ContentType = new MediaTypeHeaderValue("application/json"); HttpResponseMessage responseMessage = client.PostAsync(url, stringContent).GetAwaiter().GetResult(); - logger.LogDebug("response message received"); content = responseMessage.Content.ReadAsStringAsync().GetAwaiter().GetResult(); - logger.LogDebug("Ensuring status code.."); if (!responseMessage.IsSuccessStatusCode) throw new Exception($"Error adding certificate {obj.certname}: {content}"); - logger.MethodExit(LogLevel.Debug); return responseMessage.StatusCode.ToString(); } - catch (HttpRequestException e) + catch (HttpRequestException ex) + { + logger.LogError(FortigateException.FlattenExceptionMessages(ex, "Error performing POST: ")); + throw; + } + finally { - logger.LogError("Error performing post resource: " + e.Message); - throw e; + logger.MethodExit(LogLevel.Debug); } } - private String DeleteResource(string endpoint, Dictionary additionalParams = null) + private void DeleteResource(string endpoint, Dictionary additionalParams = null) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); try { @@ -335,53 +394,54 @@ private String DeleteResource(string endpoint, Dictionary additi string content = responseMessage.Content.ReadAsStringAsync().GetAwaiter().GetResult(); if (!responseMessage.IsSuccessStatusCode) throw new Exception($"Error removing certificate: {content}"); - - logger.MethodExit(LogLevel.Debug); - return responseMessage.StatusCode.ToString(); } - catch (HttpRequestException e) + catch (HttpRequestException ex) + { + logger.LogError(FortigateException.FlattenExceptionMessages(ex, "Error performing DELETE: ")); + throw; + } + finally { - logger.LogError("Error performing deleting resource: " + e.Message); - throw e; + logger.MethodExit(LogLevel.Debug); } } - private String PutAsJson(string endpoint, Object obj, Dictionary additionalParams = null) + private void PutAsJson(string endpoint, Object obj, Dictionary additionalParams = null) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); + + var stringContent = new StringContent(JsonConvert.SerializeObject(obj), Encoding.UTF8, "application/json"); + stringContent.Headers.ContentType = new MediaTypeHeaderValue("application/json"); try { - var stringContent = new StringContent(JsonConvert.SerializeObject(obj), Encoding.UTF8, "application/json"); - stringContent.Headers.ContentType = new MediaTypeHeaderValue("application/json"); - HttpResponseMessage responseMessage = client.PutAsync(GetUrl(endpoint, additionalParams), stringContent).GetAwaiter().GetResult(); string content = responseMessage.Content.ReadAsStringAsync().GetAwaiter().GetResult(); if (!responseMessage.IsSuccessStatusCode) throw new Exception(content); - - logger.MethodExit(LogLevel.Debug); - return responseMessage.StatusCode.ToString(); } - catch (HttpRequestException e) + catch (HttpRequestException ex) + { + logger.LogError(FortigateException.FlattenExceptionMessages(ex, "Error performing PUT: ")); + throw; + } + finally { - logger.LogError("Error performing put resource: " + e.Message); - throw e; + logger.MethodExit(LogLevel.Debug); } } private String GetUrl(string endpoint, Dictionary additionalParams = null) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); + logger.MethodExit(LogLevel.Debug); return AddQueryParams("https://" + FortigateHost + endpoint, additionalParams); - - logger.MethodExit(LogLevel.Debug); } private String AddQueryParams(string endpoint, Dictionary additionalParams = null) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); var parameters = new Dictionary(); parameters.Add("access_token", AccessToken); @@ -393,36 +453,28 @@ private String AddQueryParams(string endpoint, Dictionary additi } } - try - { - var queryString = endpoint + "?" + string.Join("&", parameters.Select(kvp => $"{HttpUtility.UrlEncode(kvp.Key)}={HttpUtility.UrlEncode(kvp.Value)}")); - - logger.LogDebug("QueryString:" + queryString); + var queryString = endpoint + "?" + string.Join("&", parameters.Select(kvp => $"{HttpUtility.UrlEncode(kvp.Key)}={HttpUtility.UrlEncode(kvp.Value)}")); + logger.MethodExit(LogLevel.Debug); - logger.MethodExit(LogLevel.Debug); - return queryString; - } - catch (Exception e) - { - logger.LogDebug("Exception occured while creating query string", e); - throw e; - } + return queryString; } private string GetResource(string endpoint, Dictionary additionalParams = null) { - logger = LogHandler.GetClassLogger(this.GetType()); + logger.MethodEntry(LogLevel.Debug); try { - logger.MethodExit(LogLevel.Debug); - return client.GetStringAsync(GetUrl(endpoint, additionalParams)).GetAwaiter().GetResult(); } - catch(HttpRequestException e) + catch(HttpRequestException ex) { - logger.LogError("Error performing get resource: " + e.Message); - throw e; + logger.LogError(FortigateException.FlattenExceptionMessages(ex, $"Error performing get resource: ")); + throw; + } + finally + { + logger.MethodExit(LogLevel.Debug); } } } diff --git a/Fortigate/Management.cs b/Fortigate/Management.cs index 2044d9e..7ebd5ff 100644 --- a/Fortigate/Management.cs +++ b/Fortigate/Management.cs @@ -32,6 +32,8 @@ public class Management : IManagementJobExtension { public IPAMSecretResolver _resolver; public string ExtensionName => string.Empty; + + ILogger logger; public Management(IPAMSecretResolver resolver) { @@ -41,7 +43,8 @@ public Management(IPAMSecretResolver resolver) //Job Entry Point public JobResult ProcessJob(ManagementJobConfiguration config) { - ILogger logger = LogHandler.GetClassLogger(this.GetType()); + logger = LogHandler.GetClassLogger(this.GetType()); + logger.LogDebug($"Begin {config.Capability} for job id {config.JobId}..."); logger.LogDebug($"Client Machine: {config.CertificateStoreDetails.ClientMachine}"); @@ -81,6 +84,8 @@ public JobResult ProcessJob(ManagementJobConfiguration config) private (byte[], byte[]) GetPemFromPFX(byte[] pfxBytes, char[] pfxPassword) { + logger.MethodEntry(LogLevel.Debug); + Pkcs12StoreBuilder storeBuilder = new Pkcs12StoreBuilder(); Pkcs12Store p = storeBuilder.Build(); p.Load(new MemoryStream(pfxBytes), pfxPassword); @@ -108,6 +113,8 @@ public JobResult ProcessJob(ManagementJobConfiguration config) Func pemify = null; pemify = (ss => ss.Length <= 64 ? ss : ss.Substring(0, 64) + "\n" + pemify(ss.Substring(64))); String certPem = certStart + pemify(Convert.ToBase64String(p.GetCertificate(alias).Certificate.GetEncoded())) + certEnd; + + logger.MethodExit(LogLevel.Debug); return (Encoding.ASCII.GetBytes(certPem), Encoding.ASCII.GetBytes(privateKeyString)); } } diff --git a/docsource/content.md b/docsource/content.md new file mode 100644 index 0000000..dc15197 --- /dev/null +++ b/docsource/content.md @@ -0,0 +1,49 @@ +## Overview + +The F5 Orchestrator supports three different types of certificates stores with the capabilities for each below: + +- CA Bundles + - Discovery + - Inventory* + - Management (Add and Remove) +- Web Server Device Certificates + - Inventory* + - Management (Add, but replacement/renewal of existing certificate only) +- SSL Certificates + - Discovery + - Inventory* + - Management (Add and Remove) + +*Special note on private keys: One of the pieces of information that Keyfactor collects during an Inventory job is whether or not the certificate stored in F5 has a private key. The private key is NEVER actually retrieved by Keyfactor, but Keyfactor does track whether one exists. F5 does not provide an API to determine this, so by convention, all CA Bundle certificates are deemed to not have private keys, while Web Server and SSL certificates are deemed to have them. Any Management jobs adding (new or renewal) a certificate will renew without the private key for CA Bundle stores and with the private key for Web Server or SSL stores. + + +## Requirements + +An administrator account must be set up in F5 to be used with this orchestrator extension. This F5 user id is what must be used as credentials when setting up a Keyfactor Command certificate store pointing to the F5 device intending to be managed. + + +## Discovery + +For SSL Certificate (F5-SL-REST) and CA Bundle (F5-CA-REST) store types, discovery jobs can be scheduled to find F5 partitions that can be configured as Keyfactor Command certificate stores. + +First, in Keyfactor Command navigate to Certificate Locations =\> Certificate Stores. Select the Discover tab and then the Schedule button. Complete the dialog and click Done to schedule. +![](images/image14.png) + +- **Category** - Required. The F5 store type you wish to find stores for. + +- **Orchestrator** - Select the orchestrator you wish to use to manage this store + +- **Client Machine & Credentials** - Required. The server name or IP Address and login credentials for the F5 device. The credentials for server login can be any of: + + - UserId/Password + - PAM provider information to pass the UserId/Password or UserId/SSH private key credentials + + When entering the credentials, UseSSL ***must*** be selected. + +- **When** - Required. The date and time when you would like this to execute. + +- **Directories to search** - Required but not used. This field is not used in the search to Discover certificate stores, but ***is*** a required field in this dialog, so just enter any value. It will not be used. + +- **Directories to ignore/Extensions/File name patterns to match/Follow SymLinks/Include PKCS12 Files** - Not used. Leave blank. + +Once the Discovery job has completed, a list of F5 certificate store locations should show in the Certificate Stores Discovery tab in Keyfactor Command. Right click on a store and select Approve to bring up a dialog that will ask for the remaining necessary certificate store parameters described in Step 2a. Complete those and click Save, and the Certificate Store should now show up in the list of stores in the Certificate Stores tab. diff --git a/docsource/fortigate.md b/docsource/fortigate.md new file mode 100644 index 0000000..ed37e8e --- /dev/null +++ b/docsource/fortigate.md @@ -0,0 +1 @@ +## Overview diff --git a/readme-src/readme-pam-support.md b/readme-src/readme-pam-support.md deleted file mode 100644 index 630cab4..0000000 --- a/readme-src/readme-pam-support.md +++ /dev/null @@ -1,4 +0,0 @@ -|Name|Description| -|----|-----------| -|StorePassword|The Fortigate API Access Token used to execute Fortigate API requests| - From 6b528eff94daabf9d5443bc39bee06536c60469f Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Tue, 17 Dec 2024 16:22:08 +0000 Subject: [PATCH 02/16] ab#66269 --- .../workflows/keyfactor-starter-workflow.yml | 56 ++++++------------- Fortigate/Fortigate.csproj | 17 +++--- Fortigate/FortigateResponse.cs | 18 ------ integration-manifest.json | 40 ++++++------- 4 files changed, 40 insertions(+), 91 deletions(-) delete mode 100644 Fortigate/FortigateResponse.cs diff --git a/.github/workflows/keyfactor-starter-workflow.yml b/.github/workflows/keyfactor-starter-workflow.yml index 6e26a91..a4649f2 100644 --- a/.github/workflows/keyfactor-starter-workflow.yml +++ b/.github/workflows/keyfactor-starter-workflow.yml @@ -1,42 +1,20 @@ -name: Starter Workflow -on: [workflow_dispatch, push, pull_request] +name: Keyfactor Bootstrap Workflow -jobs: - call-create-github-release-workflow: - uses: Keyfactor/actions/.github/workflows/github-release.yml@main - - get-manifest-properties: - runs-on: windows-latest - outputs: - update_catalog: ${{ steps.read-json.outputs.prop }} - steps: - - uses: actions/checkout@v3 - - name: Read json - id: read-json - shell: pwsh - run: | - $json = Get-Content integration-manifest.json | ConvertFrom-Json - echo "::set-output name=prop::$(echo $json.update_catalog)" - - call-dotnet-build-and-release-workflow: - needs: [call-create-github-release-workflow] - uses: Keyfactor/actions/.github/workflows/dotnet-build-and-release.yml@main - with: - release_version: ${{ needs.call-create-github-release-workflow.outputs.release_version }} - release_url: ${{ needs.call-create-github-release-workflow.outputs.release_url }} - release_dir: Fortigate/bin/Release - secrets: - token: ${{ secrets.PRIVATE_PACKAGE_ACCESS }} +on: + workflow_dispatch: + pull_request: + types: [opened, closed, synchronize, edited, reopened] + push: + create: + branches: + - 'release-*.*' - call-generate-readme-workflow: - if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' - uses: Keyfactor/actions/.github/workflows/generate-readme.yml@main +jobs: + call-starter-workflow: + uses: keyfactor/actions/.github/workflows/starter.yml@3.1.2 secrets: - token: ${{ secrets.APPROVE_README_PUSH }} - - call-update-catalog-workflow: - needs: get-manifest-properties - if: needs.get-manifest-properties.outputs.update_catalog == 'True' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') - uses: Keyfactor/actions/.github/workflows/update-catalog.yml@main - secrets: - token: ${{ secrets.SDK_SYNC_PAT }} + token: ${{ secrets.V2BUILDTOKEN}} + APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}} + gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }} + gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }} + scan_token: ${{ secrets.SAST_TOKEN }} diff --git a/Fortigate/Fortigate.csproj b/Fortigate/Fortigate.csproj index 9a9e58f..2d7f9a1 100644 --- a/Fortigate/Fortigate.csproj +++ b/Fortigate/Fortigate.csproj @@ -1,23 +1,20 @@ - false - netcoreapp3.1 + true + net6.0;net8.0 true + disable - - - - + + + Always + - - - - diff --git a/Fortigate/FortigateResponse.cs b/Fortigate/FortigateResponse.cs deleted file mode 100644 index 7648d43..0000000 --- a/Fortigate/FortigateResponse.cs +++ /dev/null @@ -1,18 +0,0 @@ - - -namespace Keyfactor.Extensions.Orchestrator.GCP.Api -{ - public class FortigateResponse - { - "http_method":"GET", - "results":[] -"vdom":"root", - "path":"system", - "name":"available-certificates", - "action":"", - "status":"success", - "serial":"FGVM02TM21009640", - "version":"v7.0.0", - "build":66 - } -} \ No newline at end of file diff --git a/integration-manifest.json b/integration-manifest.json index 7a58675..6fb53eb 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -7,28 +7,15 @@ "link_github": false, "support_level": "community", "update_catalog": false, + "release_project": "Fortigate/Fortigate.csproj", + "release_dir": "Fortigate/bin/Release", "about": { "orchestrator": { "UOFramework": "10.1", "pam_support": true, - "win": { - "supportsCreateStore": false, - "supportsDiscovery": false, - "supportsManagementAdd": true, - "supportsManagementRemove": true, - "supportsReenrollment": false, - "supportsInventory": true - }, - "linux": { - "supportsCreateStore": false, - "supportsDiscovery": false, - "supportsManagementAdd": true, - "supportsManagementRemove": true, - "supportsReenrollment": false, - "supportsInventory": true - }, - "store_types": { - "Fortigate": { + "keyfactor_platform_version": "10.4", + "store_types": [ + { "Name": "Fortigate", "ShortName": "Fortigate", "Capability": "Fortigate", @@ -47,12 +34,17 @@ "PasswordOptions": { "Style": "Default", "EntrySupported": false, - "StoreRequired": true - }, - "Properties": [], - "EntryParameters": [] - } - } + "StoreRequired": true, + "StorePassword": { + "Description": "Enter the Fortigate API Token here", + "IsPAMEligible": true + }, + "Properties": [], + "EntryParameters": [], + "ClientMachineDescription": "The IP address or DNS of the Fortigate server", + "StorePathDescription": "This is not used in this integration, but is a required field in the UI. Just enter any value here" + } + ] } } } \ No newline at end of file From 97df3852e35a2274236918413a6471617935beb5 Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Wed, 18 Dec 2024 13:34:52 +0000 Subject: [PATCH 03/16] ab#66269 --- .../workflows/keyfactor-starter-workflow.yml | 2 +- readme_source.md | 69 ------------------- 2 files changed, 1 insertion(+), 70 deletions(-) delete mode 100644 readme_source.md diff --git a/.github/workflows/keyfactor-starter-workflow.yml b/.github/workflows/keyfactor-starter-workflow.yml index a4649f2..61ea7a0 100644 --- a/.github/workflows/keyfactor-starter-workflow.yml +++ b/.github/workflows/keyfactor-starter-workflow.yml @@ -1,4 +1,4 @@ -name: Keyfactor Bootstrap Workflow +name: Keyfactor Bootstrap Workflow on: workflow_dispatch: diff --git a/readme_source.md b/readme_source.md deleted file mode 100644 index fcd07dc..0000000 --- a/readme_source.md +++ /dev/null @@ -1,69 +0,0 @@ -## Use Cases Supported and Limitations - -The Fortigate Orchestrator Extension supports the following use cases: -1. Inventory of local user and factory cerificates -2. Ability to add new local certificates -3. Ability to renew **unbound** local user certificates -4. Ability to delete **unbound** local user certificates - -The Fortigate Orchestrator Extension DOES NOT support the following use cases: -1. The renewal or removal of certificates enrolled through the internal Fortigate CA -2. The renewal or removal of factory certificates -3. The renewal or removal of ANY certificate bound to a Fortigate object -4. Certificate enrollment using the internal Fortigate CA (Keyfactor's "reenrollment" or "on device key generation" use case) - -## Fortigate Version Supported - -The Fortigate Orchestrator Extension was tested using Fortigate, version 7.2.4 - -## Fortigate Orchestrator Extension Versioning - -The version number of a the Fortigate Orchestrator Extension can be verified by right clicking on the Fortigate.dll file in the Extensions/Fortigate installation folder, selecting Properties, and then clicking on the Details tab. - -## Fortigate Orchestrator Extension Installation - -1. Create the Fortigate certificate store type. This can be done either: a) using the Keyfactor Command UI to manually set up the certificate store type (please refer to the Keyfactor Command Reference Guide for more information on how to do this), or b) by using the Keyfactor Command API to automate the creation of the store type. Please see the provided CURL script [here](Certificate%20Store%20Type%20CURL%20Script/Fortigate.curl). A detailed description of how the Fortigate certificate store type should be configured can be found in the Fortigate Certificate Store Type section below. -2. Stop the Keyfactor Orchestrator Service on the server hosting the Keyfactor Orchestrator. -3. In the Keyfactor Orchestrator installation folder (by convention usually C:\Program Files\Keyfactor\Keyfactor Orchestrator), find the "extensions" folder. Underneath that, create a new folder. The name doesn't matter, but something descriptive like "Fortigate" would probably be best. -4. Download the latest version of the Fortigate Orchestrator from [GitHub](https://github.com/Keyfactor/fortigate-orchestrator). -5. Copy the contents of the download installation zip file to the folder created in step 1. -6. Start the Keyfactor Orchestrator Service on the server hosting the Keyfactor Orchestrator. - -## Fortigate Setup - -The Fortigate Orchestrator Extension requires an API token be created in the Fortigate environment being managed. Please review the following [instructions](https://docs.fortinet.com/document/forticonverter/7.0.1/online-help/866905/connect-fortigate-device-via-api-token) for creating an API token to be used in this integration. - -## Certificate Store Type Settings - -Below are the values you need to enter if you choose to manually create the Fortigate certificate store type in the Keyfactor Command UI (related to Step 1 of Fortigate Orchestrator Extension Installation above). - -*Basic Tab:* -- **Name** – Required. The display name you wish to use for the new certificate store type. Suggested value - Fortigate -- **ShortName** - Required. Suggested value - Fortigate. If you choose to use a different value, you will need to modify the manifest.json file accordingly. -- **Custom Capability** - Unchecked -- **Supported Job Types** - Inventory, Add, and Remove should all be checked. -- **Needs Server** - Unchecked -- **Blueprint Allowed** - Checked if you wish to make use of blueprinting. Please refer to the Keyfactor Command Reference Guide for more details on this feature. -- **Uses PoserShell** - Unchecked -- **Requires Store Password** - Checked. -- **Supports Entry Password** - Unchecked. - -*Advanced Tab:* -- **Store Path Type** - Freeform -- **Supports Custom Alias** - Required -- **Private Key Handling** - Required -- **PFX Password Style** - Default - -*Custom Fields Tab:* -None - -*Entry Parameters:* -None - -## Certificate Store Setup - -Please refer to the Keyfactor Command Reference Guide for information on creating certificate stores in Keyfactor Command. However, there are a few fields that are important to highlight here: -- Category - Select "Fortigate" or whatever ShortName you chose for the store type. -- Client Machine - The IP address or DNS for your Fortigate server. -- Store Path - This is not used in this integration, but is a required field in the UI. Just enter any value here. -- Password - Click the button here and enter the Fortigate API Token you previously set up (See Fortigate Setup earlier in this README). From 8ee251495d37c867759726ddffac7587d9e57346 Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Wed, 18 Dec 2024 13:44:29 +0000 Subject: [PATCH 04/16] ab#66269 --- integration-manifest.json | 1 + 1 file changed, 1 insertion(+) diff --git a/integration-manifest.json b/integration-manifest.json index 6fb53eb..f23c986 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -44,6 +44,7 @@ "ClientMachineDescription": "The IP address or DNS of the Fortigate server", "StorePathDescription": "This is not used in this integration, but is a required field in the UI. Just enter any value here" } + } ] } } From b40acfbe1dc03ecfdf41256694c9f56af7bad8f2 Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Wed, 18 Dec 2024 13:45:28 +0000 Subject: [PATCH 05/16] Update generated docs --- README.md | 337 +++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 235 insertions(+), 102 deletions(-) diff --git a/README.md b/README.md index 1f824ba..f420e1f 100644 --- a/README.md +++ b/README.md @@ -1,165 +1,298 @@ -# Fortigate +

+ Fortigate Universal Orchestrator Extension +

-This integration is used to inventory and manage certificates in Fortigate. +

+ +Integration Status: production +Release +Issues +GitHub Downloads (all assets, all releases) +

-#### Integration status: Production - Ready for use in production environments. +

+ + + Support + + · + + Installation + + · + + License + + · + + Related Integrations + +

-## About the Keyfactor Universal Orchestrator Extension +## Overview -This repository contains a Universal Orchestrator Extension which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” — collections of certificates and roots of trust that are found within and used by various applications. +The F5 Orchestrator supports three different types of certificates stores with the capabilities for each below: -The Universal Orchestrator is part of the Keyfactor software distribution and is available via the Keyfactor customer portal. For general instructions on installing Extensions, see the “Keyfactor Command Orchestrator Installation and Configuration Guide” section of the Keyfactor documentation. For configuration details of this specific Extension see below in this readme. +- CA Bundles + - Discovery + - Inventory* + - Management (Add and Remove) +- Web Server Device Certificates + - Inventory* + - Management (Add, but replacement/renewal of existing certificate only) +- SSL Certificates + - Discovery + - Inventory* + - Management (Add and Remove) -The Universal Orchestrator is the successor to the Windows Orchestrator. This Orchestrator Extension plugin only works with the Universal Orchestrator and does not work with the Windows Orchestrator. +*Special note on private keys: One of the pieces of information that Keyfactor collects during an Inventory job is whether or not the certificate stored in F5 has a private key. The private key is NEVER actually retrieved by Keyfactor, but Keyfactor does track whether one exists. F5 does not provide an API to determine this, so by convention, all CA Bundle certificates are deemed to not have private keys, while Web Server and SSL certificates are deemed to have them. Any Management jobs adding (new or renewal) a certificate will renew without the private key for CA Bundle stores and with the private key for Web Server or SSL stores. -## Support for Fortigate +## Compatibility -Fortigate is open source and community supported, meaning that there is **no SLA** applicable for these tools. +This integration is compatible with Keyfactor Universal Orchestrator version 10.1 and later. -###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab. +## Support +The Fortigate Universal Orchestrator extension is open source and community supported, meaning that there is **no SLA** applicable. + +> To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab. +## Requirements & Prerequisites +Before installing the Fortigate Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. ---- +An administrator account must be set up in F5 to be used with this orchestrator extension. This F5 user id is what must be used as credentials when setting up a Keyfactor Command certificate store pointing to the F5 device intending to be managed. +## Create the Fortigate Certificate Store Type -## Keyfactor Version Supported +To use the Fortigate Universal Orchestrator extension, you **must** create the Fortigate Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance. -The minimum version of the Keyfactor Universal Orchestrator Framework needed to run this version of the extension is 10.1 -## Platform Specific Notes -The Keyfactor Universal Orchestrator may be installed on either Windows or Linux based platforms. The certificate operations supported by a capability may vary based what platform the capability is installed on. The table below indicates what capabilities are supported based on which platform the encompassing Universal Orchestrator is running. -| Operation | Win | Linux | -|-----|-----|------| -|Supports Management Add|✓ |✓ | -|Supports Management Remove|✓ |✓ | -|Supports Create Store| | | -|Supports Discovery| | | -|Supports Renrollment| | | -|Supports Inventory|✓ |✓ | +* **Create Fortigate using kfutil**: + ```shell + # Fortigate + kfutil store-types create Fortigate + ``` -## PAM Integration +* **Create Fortigate manually in the Command UI**: +
Create Fortigate manually in the Command UI -This orchestrator extension has the ability to connect to a variety of supported PAM providers to allow for the retrieval of various client hosted secrets right from the orchestrator server itself. This eliminates the need to set up the PAM integration on Keyfactor Command which may be in an environment that the client does not want to have access to their PAM provider. + Create a store type called `Fortigate` with the attributes in the tables below: -The secrets that this orchestrator extension supports for use with a PAM Provider are: + #### Basic Tab + | Attribute | Value | Description | + | --------- | ----- | ----- | + | Name | Fortigate | Display name for the store type (may be customized) | + | Short Name | Fortigate | Short display name for the store type | + | Capability | Fortigate | Store type name orchestrator will register with. Check the box to allow entry of value | + | Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add | + | Supports Remove | ✅ Checked | Check the box. Indicates that the Store Type supports Management Remove | + | Supports Discovery | ✅ Checked | Check the box. Indicates that the Store Type supports Discovery | + | Supports Reenrollment | 🔲 Unchecked | Indicates that the Store Type supports Reenrollment | + | Supports Create | 🔲 Unchecked | Indicates that the Store Type supports store creation | + | Needs Server | 🔲 Unchecked | Determines if a target server name is required when creating store | + | Blueprint Allowed | ✅ Checked | Determines if store type may be included in an Orchestrator blueprint | + | Uses PowerShell | 🔲 Unchecked | Determines if underlying implementation is PowerShell | + | Requires Store Password | ✅ Checked | Enables users to optionally specify a store password when defining a Certificate Store. | + | Supports Entry Password | 🔲 Unchecked | Determines if an individual entry within a store can have a password. | -|Name|Description| -|----|-----------| -|StorePassword|The Fortigate API Access Token used to execute Fortigate API requests| - + The Basic tab should look like this: + + ![Fortigate Basic Tab](docsource/images/Fortigate-basic-store-type-dialog.png) + + #### Advanced Tab + | Attribute | Value | Description | + | --------- | ----- | ----- | + | Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. | + | Private Key Handling | Required | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. | + | PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) | + + The Advanced tab should look like this: + + ![Fortigate Advanced Tab](docsource/images/Fortigate-advanced-store-type-dialog.png) + + #### Custom Fields Tab + Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: + + | Name | Display Name | Description | Type | Default Value/Options | Required | + | ---- | ------------ | ---- | --------------------- | -------- | ----------- | + + The Custom Fields tab should look like this: + + ![Fortigate Custom Fields Tab](docsource/images/Fortigate-custom-fields-store-type-dialog.png) + + + +
+ +## Installation + +1. **Download the latest Fortigate Universal Orchestrator extension from GitHub.** + + Navigate to the [Fortigate Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/fortigate-orchestrator/releases/latest). Refer to the compatibility matrix below to determine whether the `net6.0` or `net8.0` asset should be downloaded. Then, click the corresponding asset to download the zip archive. + | Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `fortigate-orchestrator` .NET version to download | + | --------- | ----------- | ----------- | ----------- | + | Older than `11.0.0` | | | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` | + | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` | + | `11.6` _and_ newer | `net8.0` | | `net8.0` | + + Unzip the archive containing extension assemblies to a known location. + + > **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net6.0`. + +2. **Locate the Universal Orchestrator extensions directory.** + + * **Default on Windows** - `C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions` + * **Default on Linux** - `/opt/keyfactor/orchestrator/extensions` + +3. **Create a new directory for the Fortigate Universal Orchestrator extension inside the extensions directory.** + + Create a new directory called `fortigate-orchestrator`. + > The directory name does not need to match any names used elsewhere; it just has to be unique within the extensions directory. -It is not necessary to use a PAM Provider for all of the secrets available above. If a PAM Provider should not be used, simply enter in the actual value to be used, as normal. +4. **Copy the contents of the downloaded and unzipped assemblies from __step 2__ to the `fortigate-orchestrator` directory.** -If a PAM Provider will be used for one of the fields above, start by referencing the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam). The GitHub repo for the PAM Provider to be used contains important information such as the format of the `json` needed. What follows is an example but does not reflect the `json` values for all PAM Providers as they have different "instance" and "initialization" parameter names and values. +5. **Restart the Universal Orchestrator service.** -### Example PAM Provider Setup + Refer to [Starting/Restarting the Universal Orchestrator service](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/StarttheService.htm). -To use a PAM Provider to resolve a field, in this example the __Server Password__ will be resolved by the `Hashicorp-Vault` provider, first install the PAM Provider extension from the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) on the Universal Orchestrator. -Next, complete configuration of the PAM Provider on the UO by editing the `manifest.json` of the __PAM Provider__ (e.g. located at extensions/Hashicorp-Vault/manifest.json). The "initialization" parameters need to be entered here: +6. **(optional) PAM Integration** -~~~ json - "Keyfactor:PAMProviders:Hashicorp-Vault:InitializationInfo": { - "Host": "http://127.0.0.1:8200", - "Path": "v1/secret/data", - "Token": "xxxxxx" - } -~~~ + The Fortigate Universal Orchestrator extension is compatible with all supported Keyfactor PAM extensions to resolve PAM-eligible secrets. PAM extensions running on Universal Orchestrators enable secure retrieval of secrets from a connected PAM provider. -After these values are entered, the Orchestrator needs to be restarted to pick up the configuration. Now the PAM Provider can be used on other Orchestrator Extensions. + To configure a PAM provider, [reference the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) to select an extension, and follow the associated instructions to install it on the Universal Orchestrator (remote). -### Use the PAM Provider -With the PAM Provider configured as an extenion on the UO, a `json` object can be passed instead of an actual value to resolve the field with a PAM Provider. Consult the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) for the specific format of the `json` object. -To have the __Server Password__ field resolved by the `Hashicorp-Vault` provider, the corresponding `json` object from the `Hashicorp-Vault` extension needs to be copied and filed in with the correct information: +> The above installation steps can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions). -~~~ json -{"Secret":"my-kv-secret","Key":"myServerPassword"} -~~~ -This text would be entered in as the value for the __Server Password__, instead of entering in the actual password. The Orchestrator will attempt to use the PAM Provider to retrieve the __Server Password__. If PAM should not be used, just directly enter in the value for the field. +## Defining Certificate Stores +* **Manually with the Command UI** ---- +
Create Certificate Stores manually in the UI + 1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.** -## Use Cases Supported and Limitations + Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_. -The Fortigate Orchestrator Extension supports the following use cases: -1. Inventory of local user and factory cerificates -2. Ability to add new local certificates -3. Ability to renew **unbound** local user certificates -4. Ability to delete **unbound** local user certificates + 2. **Add a Certificate Store.** -The Fortigate Orchestrator Extension DOES NOT support the following use cases: -1. The renewal or removal of certificates enrolled through the internal Fortigate CA -2. The renewal or removal of factory certificates -3. The renewal or removal of ANY certificate bound to a Fortigate object -4. Certificate enrollment using the internal Fortigate CA (Keyfactor's "reenrollment" or "on device key generation" use case) + Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form. + | Attribute | Description | + | --------- | ----------- | + | Category | Select "Fortigate" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | | + | Store Path | | + | Orchestrator | Select an approved orchestrator capable of managing `Fortigate` certificates. Specifically, one with the `Fortigate` capability. | + | Store Password | Enter the Fortigate API Token here | -## Fortigate Version Supported + -The Fortigate Orchestrator Extension was tested using Fortigate, version 7.2.4 +
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator -## Fortigate Orchestrator Extension Versioning + If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_. + | Attribute | Description | + | --------- | ----------- | + | Store Password | Enter the Fortigate API Token here | -The version number of a the Fortigate Orchestrator Extension can be verified by right clicking on the Fortigate.dll file in the Extensions/Fortigate installation folder, selecting Properties, and then clicking on the Details tab. + Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side. -## Fortigate Orchestrator Extension Installation + > Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself. +
+ -1. Create the Fortigate certificate store type. This can be done either: a) using the Keyfactor Command UI to manually set up the certificate store type (please refer to the Keyfactor Command Reference Guide for more information on how to do this), or b) by using the Keyfactor Command API to automate the creation of the store type. Please see the provided CURL script [here](Certificate%20Store%20Type%20CURL%20Script/Fortigate.curl). A detailed description of how the Fortigate certificate store type should be configured can be found in the Fortigate Certificate Store Type section below. -2. Stop the Keyfactor Orchestrator Service on the server hosting the Keyfactor Orchestrator. -3. In the Keyfactor Orchestrator installation folder (by convention usually C:\Program Files\Keyfactor\Keyfactor Orchestrator), find the "extensions" folder. Underneath that, create a new folder. The name doesn't matter, but something descriptive like "Fortigate" would probably be best. -4. Download the latest version of the Fortigate Orchestrator from [GitHub](https://github.com/Keyfactor/fortigate-orchestrator). -5. Copy the contents of the download installation zip file to the folder created in step 1. -6. Start the Keyfactor Orchestrator Service on the server hosting the Keyfactor Orchestrator. +
+ +* **Using kfutil** + +
Create Certificate Stores with kfutil + + 1. **Generate a CSV template for the Fortigate certificate store** + + ```shell + kfutil stores import generate-template --store-type-name Fortigate --outpath Fortigate.csv + ``` + 2. **Populate the generated CSV file** + + Open the CSV file, and reference the table below to populate parameters for each **Attribute**. + | Attribute | Description | + | --------- | ----------- | + | Category | Select "Fortigate" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | | + | Store Path | | + | Orchestrator | Select an approved orchestrator capable of managing `Fortigate` certificates. Specifically, one with the `Fortigate` capability. | + | Store Password | Enter the Fortigate API Token here | + + + +
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator + + If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_. + | Attribute | Description | + | --------- | ----------- | + | Store Password | Enter the Fortigate API Token here | + + > Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself. +
+ + + 3. **Import the CSV file to create the certificate stores** + + ```shell + kfutil stores import csv --store-type-name Fortigate --file Fortigate.csv + ``` +
+ +> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). + + +## Discovering Certificate Stores with the Discovery Job +For SSL Certificate (F5-SL-REST) and CA Bundle (F5-CA-REST) store types, discovery jobs can be scheduled to find F5 partitions that can be configured as Keyfactor Command certificate stores. + +First, in Keyfactor Command navigate to Certificate Locations =\> Certificate Stores. Select the Discover tab and then the Schedule button. Complete the dialog and click Done to schedule. +![](images/image14.png) + +- **Category** - Required. The F5 store type you wish to find stores for. + +- **Orchestrator** - Select the orchestrator you wish to use to manage this store + +- **Client Machine & Credentials** - Required. The server name or IP Address and login credentials for the F5 device. The credentials for server login can be any of: + + - UserId/Password + - PAM provider information to pass the UserId/Password or UserId/SSH private key credentials + + When entering the credentials, UseSSL ***must*** be selected. + +- **When** - Required. The date and time when you would like this to execute. -## Fortigate Setup +- **Directories to search** - Required but not used. This field is not used in the search to Discover certificate stores, but ***is*** a required field in this dialog, so just enter any value. It will not be used. -The Fortigate Orchestrator Extension requires an API token be created in the Fortigate environment being managed. Please review the following [instructions](https://docs.fortinet.com/document/forticonverter/7.0.1/online-help/866905/connect-fortigate-device-via-api-token) for creating an API token to be used in this integration. +- **Directories to ignore/Extensions/File name patterns to match/Follow SymLinks/Include PKCS12 Files** - Not used. Leave blank. -## Certificate Store Type Settings +Once the Discovery job has completed, a list of F5 certificate store locations should show in the Certificate Stores Discovery tab in Keyfactor Command. Right click on a store and select Approve to bring up a dialog that will ask for the remaining necessary certificate store parameters described in Step 2a. Complete those and click Save, and the Certificate Store should now show up in the list of stores in the Certificate Stores tab. -Below are the values you need to enter if you choose to manually create the Fortigate certificate store type in the Keyfactor Command UI (related to Step 1 of Fortigate Orchestrator Extension Installation above). -*Basic Tab:* -- **Name** – Required. The display name you wish to use for the new certificate store type. Suggested value - Fortigate -- **ShortName** - Required. Suggested value - Fortigate. If you choose to use a different value, you will need to modify the manifest.json file accordingly. -- **Custom Capability** - Unchecked -- **Supported Job Types** - Inventory, Add, and Remove should all be checked. -- **Needs Server** - Unchecked -- **Blueprint Allowed** - Checked if you wish to make use of blueprinting. Please refer to the Keyfactor Command Reference Guide for more details on this feature. -- **Uses PoserShell** - Unchecked -- **Requires Store Password** - Checked. -- **Supports Entry Password** - Unchecked. -*Advanced Tab:* -- **Store Path Type** - Freeform -- **Supports Custom Alias** - Required -- **Private Key Handling** - Required -- **PFX Password Style** - Default -*Custom Fields Tab:* -None -*Entry Parameters:* -None +## License -## Certificate Store Setup +Apache License 2.0, see [LICENSE](LICENSE). -Please refer to the Keyfactor Command Reference Guide for information on creating certificate stores in Keyfactor Command. However, there are a few fields that are important to highlight here: -- Category - Select "Fortigate" or whatever ShortName you chose for the store type. -- Client Machine - The IP address or DNS for your Fortigate server. -- Store Path - This is not used in this integration, but is a required field in the UI. Just enter any value here. -- Password - Click the button here and enter the Fortigate API Token you previously set up (See Fortigate Setup earlier in this README). +## Related Integrations +See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator). \ No newline at end of file From 7199d0d060e45fdf1041bd0484d3bc191d546f21 Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Wed, 18 Dec 2024 15:44:37 +0000 Subject: [PATCH 06/16] ab#66269 --- docsource/content.md | 52 ++++++++++---------------------------------- 1 file changed, 11 insertions(+), 41 deletions(-) diff --git a/docsource/content.md b/docsource/content.md index dc15197..d4342a4 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -1,49 +1,19 @@ ## Overview -The F5 Orchestrator supports three different types of certificates stores with the capabilities for each below: +The Fortigate Orchestrator Extension supports the following use cases: +1. Inventory of local user and factory cerificates +2. Ability to add new local certificates +3. Ability to renew **unbound** local user certificates +4. Ability to delete **unbound** local user certificates -- CA Bundles - - Discovery - - Inventory* - - Management (Add and Remove) -- Web Server Device Certificates - - Inventory* - - Management (Add, but replacement/renewal of existing certificate only) -- SSL Certificates - - Discovery - - Inventory* - - Management (Add and Remove) - -*Special note on private keys: One of the pieces of information that Keyfactor collects during an Inventory job is whether or not the certificate stored in F5 has a private key. The private key is NEVER actually retrieved by Keyfactor, but Keyfactor does track whether one exists. F5 does not provide an API to determine this, so by convention, all CA Bundle certificates are deemed to not have private keys, while Web Server and SSL certificates are deemed to have them. Any Management jobs adding (new or renewal) a certificate will renew without the private key for CA Bundle stores and with the private key for Web Server or SSL stores. +The Fortigate Orchestrator Extension DOES NOT support the following use cases: +1. The renewal or removal of certificates enrolled through the internal Fortigate CA +2. The renewal or removal of factory certificates +3. The renewal or removal of ANY certificate bound to a Fortigate object +4. Certificate enrollment using the internal Fortigate CA (Keyfactor's "reenrollment" or "on device key generation" use case) ## Requirements -An administrator account must be set up in F5 to be used with this orchestrator extension. This F5 user id is what must be used as credentials when setting up a Keyfactor Command certificate store pointing to the F5 device intending to be managed. - - -## Discovery - -For SSL Certificate (F5-SL-REST) and CA Bundle (F5-CA-REST) store types, discovery jobs can be scheduled to find F5 partitions that can be configured as Keyfactor Command certificate stores. - -First, in Keyfactor Command navigate to Certificate Locations =\> Certificate Stores. Select the Discover tab and then the Schedule button. Complete the dialog and click Done to schedule. -![](images/image14.png) - -- **Category** - Required. The F5 store type you wish to find stores for. - -- **Orchestrator** - Select the orchestrator you wish to use to manage this store - -- **Client Machine & Credentials** - Required. The server name or IP Address and login credentials for the F5 device. The credentials for server login can be any of: - - - UserId/Password - - PAM provider information to pass the UserId/Password or UserId/SSH private key credentials - - When entering the credentials, UseSSL ***must*** be selected. - -- **When** - Required. The date and time when you would like this to execute. - -- **Directories to search** - Required but not used. This field is not used in the search to Discover certificate stores, but ***is*** a required field in this dialog, so just enter any value. It will not be used. - -- **Directories to ignore/Extensions/File name patterns to match/Follow SymLinks/Include PKCS12 Files** - Not used. Leave blank. +The Fortigate Orchestrator Extension requires an API token be created in the Fortigate environment being managed. Please review the following [instructions](https://docs.fortinet.com/document/forticonverter/7.0.1/online-help/866905/connect-fortigate-device-via-api-token) for creating an API token to be used in this integration. -Once the Discovery job has completed, a list of F5 certificate store locations should show in the Certificate Stores Discovery tab in Keyfactor Command. Right click on a store and select Approve to bring up a dialog that will ask for the remaining necessary certificate store parameters described in Step 2a. Complete those and click Save, and the Certificate Store should now show up in the list of stores in the Certificate Stores tab. From 88e3fcf11a044dcffb738cd74217bac12138f2ba Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Wed, 18 Dec 2024 15:59:14 +0000 Subject: [PATCH 07/16] Update generated docs --- README.md | 52 +++++++++++----------------------------------------- 1 file changed, 11 insertions(+), 41 deletions(-) diff --git a/README.md b/README.md index f420e1f..5665fe2 100644 --- a/README.md +++ b/README.md @@ -31,21 +31,17 @@ ## Overview -The F5 Orchestrator supports three different types of certificates stores with the capabilities for each below: +The Fortigate Orchestrator Extension supports the following use cases: +1. Inventory of local user and factory cerificates +2. Ability to add new local certificates +3. Ability to renew **unbound** local user certificates +4. Ability to delete **unbound** local user certificates -- CA Bundles - - Discovery - - Inventory* - - Management (Add and Remove) -- Web Server Device Certificates - - Inventory* - - Management (Add, but replacement/renewal of existing certificate only) -- SSL Certificates - - Discovery - - Inventory* - - Management (Add and Remove) - -*Special note on private keys: One of the pieces of information that Keyfactor collects during an Inventory job is whether or not the certificate stored in F5 has a private key. The private key is NEVER actually retrieved by Keyfactor, but Keyfactor does track whether one exists. F5 does not provide an API to determine this, so by convention, all CA Bundle certificates are deemed to not have private keys, while Web Server and SSL certificates are deemed to have them. Any Management jobs adding (new or renewal) a certificate will renew without the private key for CA Bundle stores and with the private key for Web Server or SSL stores. +The Fortigate Orchestrator Extension DOES NOT support the following use cases: +1. The renewal or removal of certificates enrolled through the internal Fortigate CA +2. The renewal or removal of factory certificates +3. The renewal or removal of ANY certificate bound to a Fortigate object +4. Certificate enrollment using the internal Fortigate CA (Keyfactor's "reenrollment" or "on device key generation" use case) @@ -63,7 +59,7 @@ The Fortigate Universal Orchestrator extension is open source and community supp Before installing the Fortigate Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command. -An administrator account must be set up in F5 to be used with this orchestrator extension. This F5 user id is what must be used as credentials when setting up a Keyfactor Command certificate store pointing to the F5 device intending to be managed. +The Fortigate Orchestrator Extension requires an API token be created in the Fortigate environment being managed. Please review the following [instructions](https://docs.fortinet.com/document/forticonverter/7.0.1/online-help/866905/connect-fortigate-device-via-api-token) for creating an API token to be used in this integration. ## Create the Fortigate Certificate Store Type @@ -260,32 +256,6 @@ To use the Fortigate Universal Orchestrator extension, you **must** create the F > The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). -## Discovering Certificate Stores with the Discovery Job -For SSL Certificate (F5-SL-REST) and CA Bundle (F5-CA-REST) store types, discovery jobs can be scheduled to find F5 partitions that can be configured as Keyfactor Command certificate stores. - -First, in Keyfactor Command navigate to Certificate Locations =\> Certificate Stores. Select the Discover tab and then the Schedule button. Complete the dialog and click Done to schedule. -![](images/image14.png) - -- **Category** - Required. The F5 store type you wish to find stores for. - -- **Orchestrator** - Select the orchestrator you wish to use to manage this store - -- **Client Machine & Credentials** - Required. The server name or IP Address and login credentials for the F5 device. The credentials for server login can be any of: - - - UserId/Password - - PAM provider information to pass the UserId/Password or UserId/SSH private key credentials - - When entering the credentials, UseSSL ***must*** be selected. - -- **When** - Required. The date and time when you would like this to execute. - -- **Directories to search** - Required but not used. This field is not used in the search to Discover certificate stores, but ***is*** a required field in this dialog, so just enter any value. It will not be used. - -- **Directories to ignore/Extensions/File name patterns to match/Follow SymLinks/Include PKCS12 Files** - Not used. Leave blank. - -Once the Discovery job has completed, a list of F5 certificate store locations should show in the Certificate Stores Discovery tab in Keyfactor Command. Right click on a store and select Approve to bring up a dialog that will ask for the remaining necessary certificate store parameters described in Step 2a. Complete those and click Save, and the Certificate Store should now show up in the list of stores in the Certificate Stores tab. - - From 970fc13af4e31cc65528ff42e1634f2b30c0398c Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Wed, 18 Dec 2024 18:22:41 +0000 Subject: [PATCH 08/16] ab#66269 --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e577aae..d3c2a50 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,2 +1,6 @@ +v1.1.1 +- Logging improvements +- Upgraded README to use doctool + v1.0.0 - Initial Version From 53499dfe8f9d43297e69aff0b932331f7061f28a Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Wed, 18 Dec 2024 18:23:42 +0000 Subject: [PATCH 09/16] ab#66269 --- Fortigate/Api/Certificate.cs | 67 ---------------------- Fortigate/Api/Ext.cs | 22 ------- Fortigate/Api/FortigateResponse.cs | 29 ---------- Fortigate/Api/Issuer.cs | 26 --------- Fortigate/Api/Subject.cs | 26 --------- Fortigate/Api/Usage.cs | 47 --------------- Fortigate/Api/cmdb_certificate_resource.cs | 33 ----------- 7 files changed, 250 deletions(-) delete mode 100644 Fortigate/Api/Certificate.cs delete mode 100644 Fortigate/Api/Ext.cs delete mode 100644 Fortigate/Api/FortigateResponse.cs delete mode 100644 Fortigate/Api/Issuer.cs delete mode 100644 Fortigate/Api/Subject.cs delete mode 100644 Fortigate/Api/Usage.cs delete mode 100644 Fortigate/Api/cmdb_certificate_resource.cs diff --git a/Fortigate/Api/Certificate.cs b/Fortigate/Api/Certificate.cs deleted file mode 100644 index 3f1113f..0000000 --- a/Fortigate/Api/Certificate.cs +++ /dev/null @@ -1,67 +0,0 @@ -//Copyright 2023 Keyfactor -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - -using Newtonsoft.Json; -using Newtonsoft.Json.Converters; - -namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api -{ - public class Certificate - { - public string name { get; set; } - public string source { get; set; } - public string comments { get; set; } - public bool exists { get; set; } - public string range { get; set; } - public bool is_ssl_server_cert { get; set; } - public bool is_ssl_client_cert { get; set; } - public bool is_proxy_ssl_cert { get; set; } - public bool is_general_allowable_cert { get; set; } - public bool is_default_local { get; set; } - public bool is_built_in { get; set; } - public bool is_wifi_cert { get; set; } - public bool is_deep_inspection_cert { get; set; } - public bool has_valid_cert_key { get; set; } - public string key_type { get; set; } - public int key_size { get; set; } - public bool is_local_ca_cert { get; set; } - public string type { get; set; } - public string status { get; set; } - public long valid_from { get; set; } - public string valid_from_raw { get; set; } - public long valid_to { get; set; } - public string valid_to_raw { get; set; } - public string signature_algorithm { get; set; } - public Subject subject { get; set; } - public string subject_raw { get; set; } - public Issuer issuer { get; set; } - public string issuer_raw { get; set; } - public string fingerprint { get; set; } - public int version { get; set; } - public bool is_ca { get; set; } - public string serial_number { get; set; } - public Ext[] ext { get; set; } - public string q_path { get; set; } - public string q_name { get; set; } - public int q_ref { get; set; } - public bool q_static { get; set; } - public int q_type { get; set; } - } - - [JsonConverter(typeof(StringEnumConverter))] - public enum KeyType - { - RSA, DSA, ECDSA - } -} - diff --git a/Fortigate/Api/Ext.cs b/Fortigate/Api/Ext.cs deleted file mode 100644 index f81f9b9..0000000 --- a/Fortigate/Api/Ext.cs +++ /dev/null @@ -1,22 +0,0 @@ -//Copyright 2023 Keyfactor -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - -namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api -{ - public class Ext - { - public string name { get; set; } - public string data { get; set; } - public bool critical { get; set; } - } -} \ No newline at end of file diff --git a/Fortigate/Api/FortigateResponse.cs b/Fortigate/Api/FortigateResponse.cs deleted file mode 100644 index fcc2fdf..0000000 --- a/Fortigate/Api/FortigateResponse.cs +++ /dev/null @@ -1,29 +0,0 @@ -//Copyright 2023 Keyfactor -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - -namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api -{ - public class FortigateResponse - { - public string http_method { get; set; } - public ResultType results { get; set; } - public string vdom { get; set; } - public string path { get; set; } - public string name { get; set; } - public string action { get; set; } - public string status { get; set; } - public string serial { get; set; } - public string version { get; set; } - public int build { get; set; } - } -} \ No newline at end of file diff --git a/Fortigate/Api/Issuer.cs b/Fortigate/Api/Issuer.cs deleted file mode 100644 index 39f197a..0000000 --- a/Fortigate/Api/Issuer.cs +++ /dev/null @@ -1,26 +0,0 @@ -//Copyright 2023 Keyfactor -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - -namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api -{ - public class Issuer - { - public string C { get; set; } - public string ST { get; set; } - public string L { get; set; } - public string O { get; set; } - public string OU { get; set; } - public string CN { get; set; } - public string emailAddress { get; set; } - } -} \ No newline at end of file diff --git a/Fortigate/Api/Subject.cs b/Fortigate/Api/Subject.cs deleted file mode 100644 index 6b03d68..0000000 --- a/Fortigate/Api/Subject.cs +++ /dev/null @@ -1,26 +0,0 @@ -//Copyright 2023 Keyfactor -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - -namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api -{ - public class Subject - { - public string C { get; set; } - public string ST { get; set; } - public string L { get; set; } - public string O { get; set; } - public string OU { get; set; } - public string CN { get; set; } - public string emailAddress { get; set; } - } -} \ No newline at end of file diff --git a/Fortigate/Api/Usage.cs b/Fortigate/Api/Usage.cs deleted file mode 100644 index f5a6199..0000000 --- a/Fortigate/Api/Usage.cs +++ /dev/null @@ -1,47 +0,0 @@ -//Copyright 2023 Keyfactor -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - -using System.Text.Json.Serialization; - -namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api -{ - public class Usage - { - public CanUse[] can_use { get; set; } - - public CurrentlyUsing[] currently_using { get; set; } - - public int[] q_types { get; set; } - - public class CanUse - { - public string name { get; set; } - public string path { get; set; } - public string range { get; set; } - } - - public class CurrentlyUsing - { - public string attribute { get; set; } - public string name { get; set; } - public string path { get; set; } - public string range { get; set; } - public int reference_count { get; set; } - public bool static_ { get; set; } - [JsonPropertyName("static")] - public string table_type { get; set; } - public string vdom { get; set; } - } - //[attribute, mkey, name, path, range, reference_count,static,table_type,vdom] - } -} diff --git a/Fortigate/Api/cmdb_certificate_resource.cs b/Fortigate/Api/cmdb_certificate_resource.cs deleted file mode 100644 index 2fb07c3..0000000 --- a/Fortigate/Api/cmdb_certificate_resource.cs +++ /dev/null @@ -1,33 +0,0 @@ -//Copyright 2023 Keyfactor -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - -namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api -{ - public class cmdb_certificate_resource - { - public string type { get; set; } - - public string certname { get; set; } - - //< pass phrase used to encrypt key> - //public string password { get; set; } - - // - public string key_file_content { get; set; } - - // - public string file_content { get; set; } - - public string scope { get; set; } - } -} From c6ea73653d99e314c11273e1a09afa13f15660b3 Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Wed, 18 Dec 2024 18:31:24 +0000 Subject: [PATCH 10/16] ab#66269 --- Fortigate/Api/Certificate.cs | 67 ++++++++++++++++++++++ Fortigate/Api/Ext.cs | 22 +++++++ Fortigate/Api/FortigateResponse.cs | 29 ++++++++++ Fortigate/Api/Issuer.cs | 26 +++++++++ Fortigate/Api/Subject.cs | 26 +++++++++ Fortigate/Api/Usage.cs | 47 +++++++++++++++ Fortigate/Api/cmdb_certificate_resource.cs | 33 +++++++++++ 7 files changed, 250 insertions(+) create mode 100644 Fortigate/Api/Certificate.cs create mode 100644 Fortigate/Api/Ext.cs create mode 100644 Fortigate/Api/FortigateResponse.cs create mode 100644 Fortigate/Api/Issuer.cs create mode 100644 Fortigate/Api/Subject.cs create mode 100644 Fortigate/Api/Usage.cs create mode 100644 Fortigate/Api/cmdb_certificate_resource.cs diff --git a/Fortigate/Api/Certificate.cs b/Fortigate/Api/Certificate.cs new file mode 100644 index 0000000..3f1113f --- /dev/null +++ b/Fortigate/Api/Certificate.cs @@ -0,0 +1,67 @@ +//Copyright 2023 Keyfactor +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + +using Newtonsoft.Json; +using Newtonsoft.Json.Converters; + +namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api +{ + public class Certificate + { + public string name { get; set; } + public string source { get; set; } + public string comments { get; set; } + public bool exists { get; set; } + public string range { get; set; } + public bool is_ssl_server_cert { get; set; } + public bool is_ssl_client_cert { get; set; } + public bool is_proxy_ssl_cert { get; set; } + public bool is_general_allowable_cert { get; set; } + public bool is_default_local { get; set; } + public bool is_built_in { get; set; } + public bool is_wifi_cert { get; set; } + public bool is_deep_inspection_cert { get; set; } + public bool has_valid_cert_key { get; set; } + public string key_type { get; set; } + public int key_size { get; set; } + public bool is_local_ca_cert { get; set; } + public string type { get; set; } + public string status { get; set; } + public long valid_from { get; set; } + public string valid_from_raw { get; set; } + public long valid_to { get; set; } + public string valid_to_raw { get; set; } + public string signature_algorithm { get; set; } + public Subject subject { get; set; } + public string subject_raw { get; set; } + public Issuer issuer { get; set; } + public string issuer_raw { get; set; } + public string fingerprint { get; set; } + public int version { get; set; } + public bool is_ca { get; set; } + public string serial_number { get; set; } + public Ext[] ext { get; set; } + public string q_path { get; set; } + public string q_name { get; set; } + public int q_ref { get; set; } + public bool q_static { get; set; } + public int q_type { get; set; } + } + + [JsonConverter(typeof(StringEnumConverter))] + public enum KeyType + { + RSA, DSA, ECDSA + } +} + diff --git a/Fortigate/Api/Ext.cs b/Fortigate/Api/Ext.cs new file mode 100644 index 0000000..f81f9b9 --- /dev/null +++ b/Fortigate/Api/Ext.cs @@ -0,0 +1,22 @@ +//Copyright 2023 Keyfactor +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + +namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api +{ + public class Ext + { + public string name { get; set; } + public string data { get; set; } + public bool critical { get; set; } + } +} \ No newline at end of file diff --git a/Fortigate/Api/FortigateResponse.cs b/Fortigate/Api/FortigateResponse.cs new file mode 100644 index 0000000..fcc2fdf --- /dev/null +++ b/Fortigate/Api/FortigateResponse.cs @@ -0,0 +1,29 @@ +//Copyright 2023 Keyfactor +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + +namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api +{ + public class FortigateResponse + { + public string http_method { get; set; } + public ResultType results { get; set; } + public string vdom { get; set; } + public string path { get; set; } + public string name { get; set; } + public string action { get; set; } + public string status { get; set; } + public string serial { get; set; } + public string version { get; set; } + public int build { get; set; } + } +} \ No newline at end of file diff --git a/Fortigate/Api/Issuer.cs b/Fortigate/Api/Issuer.cs new file mode 100644 index 0000000..d34bebc --- /dev/null +++ b/Fortigate/Api/Issuer.cs @@ -0,0 +1,26 @@ +//Copyright 2023 Keyfactor +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + +namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api +{ + public class Issuer + { + public string C { get; set; } + public string ST { get; set; } + public string L { get; set; } + public string O { get; set; } + public string OU { get; set; } + public string CN { get; set; } + public string emailAddress { get; set; } + } +} diff --git a/Fortigate/Api/Subject.cs b/Fortigate/Api/Subject.cs new file mode 100644 index 0000000..6b03d68 --- /dev/null +++ b/Fortigate/Api/Subject.cs @@ -0,0 +1,26 @@ +//Copyright 2023 Keyfactor +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + +namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api +{ + public class Subject + { + public string C { get; set; } + public string ST { get; set; } + public string L { get; set; } + public string O { get; set; } + public string OU { get; set; } + public string CN { get; set; } + public string emailAddress { get; set; } + } +} \ No newline at end of file diff --git a/Fortigate/Api/Usage.cs b/Fortigate/Api/Usage.cs new file mode 100644 index 0000000..f5a6199 --- /dev/null +++ b/Fortigate/Api/Usage.cs @@ -0,0 +1,47 @@ +//Copyright 2023 Keyfactor +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + +using System.Text.Json.Serialization; + +namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api +{ + public class Usage + { + public CanUse[] can_use { get; set; } + + public CurrentlyUsing[] currently_using { get; set; } + + public int[] q_types { get; set; } + + public class CanUse + { + public string name { get; set; } + public string path { get; set; } + public string range { get; set; } + } + + public class CurrentlyUsing + { + public string attribute { get; set; } + public string name { get; set; } + public string path { get; set; } + public string range { get; set; } + public int reference_count { get; set; } + public bool static_ { get; set; } + [JsonPropertyName("static")] + public string table_type { get; set; } + public string vdom { get; set; } + } + //[attribute, mkey, name, path, range, reference_count,static,table_type,vdom] + } +} diff --git a/Fortigate/Api/cmdb_certificate_resource.cs b/Fortigate/Api/cmdb_certificate_resource.cs new file mode 100644 index 0000000..2fb07c3 --- /dev/null +++ b/Fortigate/Api/cmdb_certificate_resource.cs @@ -0,0 +1,33 @@ +//Copyright 2023 Keyfactor +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + +namespace Keyfactor.Extensions.Orchestrator.Fortigate.Api +{ + public class cmdb_certificate_resource + { + public string type { get; set; } + + public string certname { get; set; } + + //< pass phrase used to encrypt key> + //public string password { get; set; } + + // + public string key_file_content { get; set; } + + // + public string file_content { get; set; } + + public string scope { get; set; } + } +} From 6edfa5ac11b164ad93647220a781d5cd21f6719a Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Wed, 18 Dec 2024 18:52:39 +0000 Subject: [PATCH 11/16] ab#66269 --- integration-manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-manifest.json b/integration-manifest.json index f23c986..fcb94e4 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -27,7 +27,7 @@ "SupportedOperations": { "Add": true, "Create": false, - "Discovery": true, + "Discovery": false, "Enrollment": false, "Remove": true }, From b3ef8e27311524408dcd24bd9c81146524cc41dc Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Wed, 18 Dec 2024 18:53:35 +0000 Subject: [PATCH 12/16] Update generated docs --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5665fe2..98e94e4 100644 --- a/README.md +++ b/README.md @@ -88,7 +88,7 @@ To use the Fortigate Universal Orchestrator extension, you **must** create the F | Capability | Fortigate | Store type name orchestrator will register with. Check the box to allow entry of value | | Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add | | Supports Remove | ✅ Checked | Check the box. Indicates that the Store Type supports Management Remove | - | Supports Discovery | ✅ Checked | Check the box. Indicates that the Store Type supports Discovery | + | Supports Discovery | 🔲 Unchecked | Indicates that the Store Type supports Discovery | | Supports Reenrollment | 🔲 Unchecked | Indicates that the Store Type supports Reenrollment | | Supports Create | 🔲 Unchecked | Indicates that the Store Type supports store creation | | Needs Server | 🔲 Unchecked | Determines if a target server name is required when creating store | From d11ecdcb83c741442cf6658dc834040758acdae5 Mon Sep 17 00:00:00 2001 From: Lee Fine Date: Thu, 19 Dec 2024 15:27:12 +0000 Subject: [PATCH 13/16] ab#66269 --- CHANGELOG.md | 1 + Fortigate/FortigateStore.cs | 9 ++++----- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d3c2a50..ad1ae31 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,5 @@ v1.1.1 +- Modified Fortigate authentication to use Authorization Bearer Token header rather than query string - Logging improvements - Upgraded README to use doctool diff --git a/Fortigate/FortigateStore.cs b/Fortigate/FortigateStore.cs index d33363d..5a97b2b 100644 --- a/Fortigate/FortigateStore.cs +++ b/Fortigate/FortigateStore.cs @@ -41,7 +41,6 @@ public class FortigateStore { private ILogger logger { get; set; } private string FortigateHost { get; set; } - private string AccessToken { get; set; } private static readonly string available_certificates = "/api/v2/monitor/system/available-certificates"; @@ -60,12 +59,12 @@ public class FortigateStore private static readonly string cert_usage_api = "/api/v2/monitor/system/object/usage"; - static readonly HttpClientHandler handler = new HttpClientHandler() + private readonly HttpClientHandler handler = new HttpClientHandler() { ClientCertificateOptions = ClientCertificateOption.Manual, ServerCertificateCustomValidationCallback = (httpRequestMessage, cert, certChain, policyErrors) => { return true; } }; - static readonly HttpClient client = new HttpClient(handler); + private readonly HttpClient client; public FortigateStore(string fortigateHost, string accessToken) { @@ -73,8 +72,9 @@ public FortigateStore(string fortigateHost, string accessToken) logger.MethodEntry(LogLevel.Debug); + client = new HttpClient(handler); FortigateHost = fortigateHost; - AccessToken = accessToken; + client.DefaultRequestHeaders.Add("Authorization", $"Bearer {accessToken}"); logger.MethodExit(LogLevel.Debug); } @@ -444,7 +444,6 @@ private String AddQueryParams(string endpoint, Dictionary additi logger.MethodEntry(LogLevel.Debug); var parameters = new Dictionary(); - parameters.Add("access_token", AccessToken); if (additionalParams != null) { foreach (var additionalParam in additionalParams) From a0773bda343693120e749709cdcbc43b684dc1e1 Mon Sep 17 00:00:00 2001 From: Hayden Roszell Date: Mon, 13 Jan 2025 12:41:32 -0700 Subject: [PATCH 14/16] chore(docs): Regenerate screenshots Signed-off-by: Hayden Roszell --- .../Fortigate-advanced-store-type-dialog.png | Bin 0 -> 41691 bytes .../Fortigate-basic-store-type-dialog.png | Bin 0 -> 51650 bytes ...tigate-custom-fields-store-type-dialog.png | Bin 0 -> 28294 bytes integration-manifest.json | 96 +++++++++--------- 4 files changed, 48 insertions(+), 48 deletions(-) create mode 100644 docsource/images/Fortigate-advanced-store-type-dialog.png create mode 100644 docsource/images/Fortigate-basic-store-type-dialog.png create mode 100644 docsource/images/Fortigate-custom-fields-store-type-dialog.png diff --git a/docsource/images/Fortigate-advanced-store-type-dialog.png b/docsource/images/Fortigate-advanced-store-type-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..2b71e8ce6f47e0b32fe97f5ac26c1e77f438c5f8 GIT binary patch literal 41691 zcmc$`bx@XV+XsjRDxfGJ0s>;tCEchJam9Ha@r&caTT)yA{XX7(BqStsA;AyQNJuvW;r|79k>L|ROm`V1 zq~}ONAKrbmkKUNHv&NFWZr(lC?RVO~@e3*5!~Z}nNeC0;_M?|0d>9x+PB*Y68@_to zq>zpL{psfu;Ut{Zd+8X0g2dHk5z|Bt1&?J~en}F#O%Jm*&1vj`993aRUz<>xfo@^z7o|m-2Gll-^zoMq>pcJG*uF)b#bcCh?gQBBfP)VX;d_IeM}vwg0SD>wFjJdeGzKBO46xcI7moJ)#XguMB5j06Z21otQu@p?31}?AE+s;m{#n>BY3!$DwuXIa<=ft#Ox&g1Nj|8zW^@WIvPU z&%GuF69o@abl1)m+Bt&k7fIqeCjP|7gk{KH@%ZvH*c+pCbX*^o$U+oVYiVeFNlz!o z^F#iF@yg63u!`wzC_NKXV_jVW|9Xyvh_*$1D1(5OcYrAJOv}_=>BkJ)`ig`1J}>Ig z=bRj#L{ZthyksC!mm_(5Gl@iJx6`wh!RFv`-8E}KO4*SziH#Ch>I1&QgL%oT37fw? zXX%40tUJvPy4*ECl8HQj*}lw7suJ%`ukUrxnKu-c+rP@@!WubDLPLxB{KlS@@5qiStHj}DG&K*w z3!c=K*a0DkLHnM;bQ#YG20cw39Uc44p(m|AH(mpd@K7LQt?J+DZNw;hG(d4(CocXV6smn^v6z9C% zh0a&v+|CvRX0C@%W6l`U4?}YY8mMZ{?NJz({C=yJ{@O{EPB*tGt?z8VA;CjRMb&{s zM$u!wYJKyxoX>e@^0p&a-(yTn>^EV*^m``oodk@Gjj6Y(KFbFskS*vg?~g}n6>ZAJ z5#IW0l)9ZjgchN|1=FfmMKJ8zl5?f z_ZJHT<4;EfL;Lr}zUS%E=@e)`Lk^=D`TgD}iD#0oUD)_<_>=9Q^;SPB+8)9nWvLWi zmW8Z~esSPHBsk|x@-5j3u`;~Ka&mrk5cN%VYHQUqc z=iT&SSy8ORuk-R*2)X?m_$K~zPorbnoYGo~<@;A{+|1gfdQ+MSW3o_;?mPe54GH%7-4O@mr~XQJ;AOo$7fd8 zZwITi+1i$-TC}qlZ4-X4PQ*UMbDWTh5$zmQ7?;akRm+ucX{TwZYs;E=Qxi0AW~$-i z86Xp}sO~3pDQeRTW7NK}@Do~*Q zD$VFby2peTSgv^I*`)mA=hub$jAF{eT2oo*&qncEXDnJ-%SJ-iN}{p&A69E_fb(H;*GVlz-M~(6!w@{N-6S-{MA?MHKP))rjJ~|n4&$M4BfgFg*h_P zF3C+y67n!5r?IZ@$4}f#RtLIBGwzA51_PJ7=Z9$b@(qxv!iyvB6f!edC=ro}Z}K*j z-=4DH6F?3y>;8`8^r&L@HmdrxW?Fp`cigR=(e9w#?DaMjnc=w=SGtzZ4>-q%36|@;Yd!DSZ{Ts79T6u^@`jGz? z9eon!Br;>FZ1b7N&rI^6-SxG4XHJt_g*g6o?cEWw>hAHws}5GZ3eLAw{MfIU;-M0i z(Eb|5l<%<;q@%4pzT35Rq|=7Agj1+7`mV-)U0&^K<`Mg$X$NT`bHdr0C zfJSR5&-bq2qX~*&+B+}kQQyn3{5@1tEGT&*i_<+Nxa8Rnj2lX=c-e3X#S)*m>L|G~ zHnP{1#LRa7jBBG>Z`ty)%#KL5EWEF{FZOiWr7E#wy*7*0c!firHf=4GJe$9Jao_t@ zL(<+z;ba=-jMQS-JWu^w1GnmOnc*OeAmQrg4QaO^p2a&X%?GhqL2n zb;HL^hBqe+aGForTdAD)!z@|MgNJn1Jb7_U5R@#oB}C>tTco#S%n1EoBcvkcC3-PjC|4HJ)pP zV6UP#B$w!16Uil}w%E6%V{akzdEe3a>Pg3x_T7MFW@?Ux6dh0dtL%3_94n&Yv8x7} z`D2e+-5#Xu$pdqHf|SDmZtqob+hgETG4{BzXzW*ZOb?2m~|~( zwLNBTJH}Wmf%$eST1W^72Ij{ln^d`71n=I?|8k4e*v;9lG z6K$`aemlMTdwDJC6Nl9sNNTRvkIwvz{bH(_hI5m4n^R;i%FOK|Y*wrtyPo-K9Lj6h z58Esy9}~u_4ts=$hhx~Rvg6lswB)E?RhXzU@hLsdO}X`&n&HV%lWLAwMP%0+ZGDe{ zO@})6dx&|uQbxYaUWO>|M znS%B~2GYdO)RYe`^p{`5gEY?59wn&VdU(L@UhChqGgw(WyP@l=Wb!qloP231g>ygd z1}A3*bq?Xt!txW#HAysIo{_HI%dqk@dkR0LlQ%|JWXJ&~-LQ*26(Y}r)HXd6ebL2p zY!|ejN^IaujA+PPw&c7Kq0rM z)08G%>Yn(})TzSlvWXMgJ>HlYRM}Iad<(BMO-rB6+O{yWLLB$C4LcM);($`U4J)pl zL%YN>$$IY{vKm)6d>*O^u}j@4>$S-w6&HTaLGM^zrJ3bzkEm2$KmY3(bIaoS_$j}U z!*=y(&ZlDYPi)Yxf2YNilL!b9Ezo_qPTjcVQVTU#tHfx1$c%_z;0s zUy_6d692-r$UtoXyCJdEKCaB&r9SHQ$S~@0e5!G`9^s1CVjJ=G2qpbgPTN zZ+T8#9?gyj2Pb5r(Pc}YQ!8$}EAL*+&W=UhSl3tNPUmpOY+B;Nvk*lASKCJdM<0I1 zDK{j^pZA%(wR)yvoM%;#V3T@Qb@7+Z@j>||IyQTD>_zl1*Bd2Aq5SBRiGcB}7(I4) zXy^?sp&S`%uYA)tOi2+-MTRoY0^2n+x0 zO%}N(;k+Kgh%BPGM^y44)Ouqw+^nSLZS5nIygd5)`eARyeStT-AvGswm6~vp!b+|f zN0#_)FS%E0LZloFL=09koX*cIj&1)8_1<^VGpcfq*@gA!P!TiMe(Y3o(fD(B)8V9- zd4x?7ca5lL#J4$iUEEanhCuxb@|Mi9%A22)i`nW)ZFNs`F-~S*XHf9^9j5v&}+vXJJfGUTD{co=|G{xM=a|KcOF}J758UgF%Py_CB$`I zBOI$vwmzwyeqtqXWUfn%MI|vDBp|xx(9z9FQH*kAG*J$FsqyHQdOMwHdnd)r$dw?{ z*zw)Ev8(OSD>>Dh5hudxW3~ofiJ8>4{&LnUqv5T&TxfsF=XaA*7bSlxH+<>YpAhX@ z+Qo5tJTNhAex*3B*yAK90?o4xzEbfMD_^&}LM8s5R^GN%m$Q+xIc6?EES)-tX~Fzu z{+y;CqUk2S6MoJ2jTmG7{^A=*0>}Kn914>{lE~C~58OW>joBC}EVV!U(@}@Tfs#p| ztCO;9xhi@S{hN#a)KKk&7@C~i(#V*6V#o(~jVdlbe!YR@xvvwNG_k@b+a-!Yq0yZ{ zF+2o>rBmYFsg|T4^SR^ISBaaJjEqfBa-@nFFga?{ybiQ~9mA}OKXVpvWoB4>Pu$ej z1K$>_x~_BJ*^o_i+=*S0?`QFZt2-MG2)>E_=JpW`a4>ol>Np1P9yN;`K?9C z%}PT`P2C)3w76f^Oax;2C1c-MjTrHGjRsL@v$6|}ZTY#`J1783(rXWRfav20_^74Vs_v;JQt`8D0+V#OO@OB?q}cBcFv<_H zHT+V69v4+F_6ktF%flOd>ub_2r#3pAfw|!BsoW(d6qV0a%VvBVs#cO?d=fWWs3()F zR?VSS+Dj}gg_YBgWNvLHqFJ9d*1sH|I?|1nCb`aL`O}|!m@2f+9)kP{QsVrm{S8G( z8%FqjRG-X?Iob}&rJdNjk8_h4w5IMN`+&p=9 zqN8pAW5G{DM@zi@!Iv@zc4?I?o$I506^~V!5zsKrPR}UQlG6LZVkIZ<( zMCqVj?!dM)@T10qW8+#VS$cMM^SigwR?ib?IcRV0SxJJ-p%_h6z>;&4jw) z>5w6UTbbA|22)7vPeX2FK=D=L#`-)@;BONi5!&AC5?HhJL+|#9lX~LJJ@3{r&D1 zXk2Xxe7=&IgCSF_Rz^Pu42wl$AXw1x2J|QS-SAU@9BG>g{W&oo#XP_r%cv9a5R&hY zV6nP2>!z|W;mzuNIjN7ef%<2A-M{~L`a>K1GW?o941Jbm&RdQVIwKrP{b}w*D7>_J z>tQlF$l7vP?hW6q6KF|fGpDw={ePgXcAR3$pIFSA`uH;ba48Xp$lrm^b@%)dEv}{{ z0(z6$wKF3E{aJ|cATc}Rh*x_M7Huh9Z~y(n#18P3FIl>GF8=cx`tIKJwo$d(jbv@y z3_MrwOffP2o&ir=F1*JTTd%U&hf-yxNj!!!I*L@TCS1OR60B)$D?EM$p&t|&s!YuT^~-ZxMA zQ4-9hroFB2qD~Fx(ZVD+V|<~_&+|3%95*y5PNpHA3uiR{>J_jI4|U#*EOGRxQv|jG zzVIRDYzxg{W1FLC{)K6tuEkSt`9256B-AchG_QxR=RJnbc5_LJ)9?8ypY+0S3^`X5 zk)666L!k<-j3Rozrt;#RMY{b7EACW~!>Iel^(B?wgXTBR(gG?I8+k>{sRrW}8>5aM zakX5ZD^p({e!U_*qTosON<4qDW45BW`NRo?$zzE^-Og|(qbEyCOR`tN8gJhs<#{!?v~^zWae~|N)Syo- zpM^wao$K(_dr?jG#ow0) z_*2M;DABOUOaE( z5SjIZv(8TC`9^6WG~$%*9XWuPiLm@ulBit-zNGLu0!cgyVwcK|M^VIecsAwYeL3FE zpkYW$BDU@sqt!?~2ATljvq5xso3(-TVjDc{7ljOatax&JcdjLm_v~t>+B)8gnV%y; zvo*JuxZR6`>5!)PGB);<4q!V0zW83FaxGq)MC>J<%~~ZcGKS|bbE(>NmVO?*F1_6A zy58zQkD71*+_?LI-8XAK>>YL(4o*+>1=rLo&(9fj|6;4P+R}F}w;+k)`4|9#k^V4K zi}`5Z)M(^x_ih*u|A^>ACuLC{vq7H&TB^Y9 zMoRmgmN^)dfIpkHlMhT6SLZ);|NTpK^@(G;3%zk{=<5;J*PYC5{%H-9yrP1c{?Vv= z=bKa-wK3ET+Y7@)uk!-!lEXwhsl`?=1w}wjR6J}Xtbap($rma8t*Jz7qmT=25+fr+ zCUr_IywLeY`_lDaSQH)CKvHcv9)9t&=G_cUx8bGTT3H*9uKYauMA=j%sO*AXLW}Wg zetEe`X6ev@D$tFaLgOBUt(wjO3_A$mN2D09NV?f)N*SJ~9@Rli%5Lm+Al$T5WuE`m zJs=uIj#~TS`W$50>({cz##M9M>JI(O*`PZBdjGwGy|Iy|^&TVL~fvyRRzF8=^pJ{oZf=uWn5BP+_GL4Z_7LGp)h6qlN7mx4k> zU|^`PTw;B1W64$z8eriV z(!F`}_wT3&`;9GVA~ZAuzhXnb3Cq%(Tl2BJ1tZ{*-6^u%(9+3iT+@dW8Fb;0~KiF@6JCL|-Y)`9G8DH1HW zoOeyIAiq+VoAND_oqaoj#9m2--{h-2b|RF)DGJSpCyWL3dkFg4+5Q(p7)as1E}?uv zP-{2!P2sbmGq{TlQ~AxBEbxqyGFM-bOi-0~QmWZRw+BmMxx<<*EMsdJ>AAJsWMrLb0x%8q2@ zlHHeD#ys6wEFNK3*p2IMn!%q@N)cV{Hda!MVlbK_%QETk_7+V@d;2Y<_>RqbrMx4W zk8hDmfXK^5ei9|W2Y?+}Bv39cCJ9?=Y9Xb!YRgVCu@;u`aRA&O%K@ZWujTj?wtdkw z@X(WG(X93nNtw6^jn3mQchUNg zq!J23d!}2!7xF^+kr0f=TXb@{=~0s|A-d`3_H&u*^zbFLp#*mD^>&dgEef^vHm<_c z#O|7|OF(-J@&7)vV%)wkOxOf`ygG6BRs|4447>Md|Js0FhLoF_icT+IB0hcZbO)4`kkulPWP7+ zhu6`&O-xK2R^mPN$4gB7LZhOiMb*>@Z``=Sl&zWFvwo;j;~cR*oZFwJ$iN9w8&zCn zr0|Cix5c8E8%IY^2?zJO$bH_cs5~PlCoj_Py-7)#=~OaBz+r1X*Km)Xo_=K{|0S2x zQN!TiVQf|{^D{Qf@0aJtVNR3H&7QmS&6tlKeev`}5f>LPRUOKZ&Aj{I0SPN>S>0-U ze7u5^QeUB7H{Nh1$<=8MEtBJc{>A0xwjvkUUW(&dJq9`*5N>GV=7X>e7 zb845f1C8MvRei=tigwc1uiv;`IZI1RZ%LsW@#hX(U0pcHWhuOKb-m(J)RUHej5vDc z&lkkmH#UsboOk&mnN8Ztt(FaoHnf`k-{^LPD`glA*45X8dFVgOC3)uM?~nZ3Y`Vtz zbTMpDX{aw*gbf}hx!>*bQ2sqH?;PW}>3?PcjFP9Ap!d0~CbBP!n-E5Q|9)GyJGL{< z?W(mkh;+2Zg@f1gfzF@LHx`zbhT7P-Lbq$LV__$!w++Fw{L5wLefy-_?W+DKF)vcj zsx=xBceFby&Jfw{n&T;_W2%k`{{*rR0s@6r%i>73+f!oGH7@PN{7-OjfRmHitzi(k~{s+8Vm58}H&4R+h{F0KUv9XE{#u#w{ST~=9nVFf->FEX$rv(KC zd3kw%y1E{O2+QhDU0gU@T3Ny2%o$xw$z=D5iHRGU5j*`(QW68n-QAt@XhbVZvCt!c z`)tKO3<9bxp4Zbbv!Zlyd%OGWaGf&xsF}!ZW^vJ`d(AR;;;e?HX_A$h=VIqueB*V4 zH)fI1uzydFB)=b?Z035pSZ{AH__CA#E`ZB6X1ZLa!9W_2%O_+8vu9`PxdvlJAzb5Ht=2VWwLf)!ZtiPlCZz<=CF7enZ&s|?yJET8y&kh`}fOhkvE)+qgu)D`-Ga+W(^A|ip4Ai z(mm}X1*}^Ams==k?TQ83_heGV7n8%(>ZYb*;cH7scL-DyRvH2SXXS||mk0e4=wX#M z>;(JE-K2DMu%eCM?_svIw4|AHSF3fyI`8i9*TXL_$2$2#9@QUsdEF%u4gU<=^6uR` z=bgVOSU5P-QUpdp{E6`}c9Er2>@!vE1a7VUL9YPJfe5=dFOB4D9c)cT4Q9&sC-9-B zh(^?Hj25<2SzTXU7MV@Q*45RG=hT{vmy}gjS^>r#cfI=l{re7-fW4FXfc*)pZrRL> zDu?~2%*Ib4Lg3jRV`DdlztPGoE!7*z(@085!E1xWoiy*V*%%3gJ48}*+GKh{tJYDV z)2`p2;x}8ERIrCVh)r>Qf%V>t!$SSNwt~V_qv0H#!?nSVNG4y{n;nS3TNpSv&11zz ziWS!65H!|n1Ktqy3H__At{1HRsS=feN~{Y}Zo zujc0FUa%jF5zc1TGY}vtzEJs_OmY#{v|yj##d!t;tHO zjgdDcCgc42`ecZZ$;I6 zG!zsW9buLl8pL|tv3JrAE>?%K@gX1T;ehR$bAJ#p^58!C{hzfmbaV24{D{@feNHu5 zX{UF*HTkyn^r#U>y$5Ecj<%-*{QS^2$BOGaJN;BEZD&_j6c%5v;hKILO~=@rkdzn znttH2va>_mfrIhAe0*Ne(&k1A{9Y2CJ}%{kCI@XYn#(B^3hiDO$F}*wiWFi|19+|! zX7gLy+qJf*sJJR{8)>Xg1z0l{;K$vn~f4t`FH2636p-R%N9p z{#I_ynPG988?-FW{SF4il0(Hq?TDEmXoW`UuhO>npR z(=}YMj5>P@t!M=7!Nj~CJDn`kpENb4bxwWOlm?eUE_zDI!$YL0H6P-1PZE#WIL&%% zLUDDXyiik5FBKAn5}utU817pJb~9yTtXRa`-(L>tH3|a4aGP>p4 z)yJ{)rW34uQdl}uRSrHeF)`8~KUzzaib-MdCH5lXKn@}=^8+6rxl*>=>3jfBFd>&C z84j)5#{s zSm{MvV{bXmjpC(%|3^(t&9;HkygbR%)zr9Pc{K;Va)`n3(f3Wpii9HQb$ot>hT0AvuS2B?8Om0kE>QvO5Rxnsh8G*hZXbTs__7U{;o)6`r!u=)_Zarm&4pCnOjhhnM02Ajm;yy^kB0nlL zBR>0#Kn?cm*`;m9-}n=ykaRjDnLHe9*kk6_*E1m)YA244R(cafW8hlv-@gwAph4l2 zK$fjsD(CT#C?}f3E~oF(uJmHxMI8Y?#n)dPVjbmN?(?kkxX*E1pIyl2K}6auWM3JWH8|Lx{^2 zJjNA`szmyDhwc=91h5|6&duS^+Q3H)*VGGCJK@BZ#Zq$(U_62 zprBxcj;!oeoK5!H1dX}d4GX{Y94XOHwGa(!xL zweM7I0E3VDcH3%SzkVg7pqN`5%v4ZRgc&|W;f3A|^>7w|4B&nZ?qVfBZ=u%NH04qn zs3P+_v-OB->2~dUcCh*_Dhj{ZpCHlg`l{+|Ewk$S>KswTp`Fl&g$x?nl-EM90}#y0 z%KAx9PcPim(9lOb^(8U!mu{ZxXHbEGmKqjE*0`Kop6=<;GcX8=iY5Vi^>C1-kd3Gb zwo?wHQH6f{(T}E9?)c)%uPuzrvqQ>#B?DB8bmh|PIJ?y8oI6yktRp*wWG;xy>$JTh zA-PEh=?Co|0L7p7c3+75kn$om3RnQOYR3?V&W?_bonrvjbPNoM4*S5WPj>#<}&t0vq>5N;q;e3%(x_=J~cyMKyMzaum7gg9vZ^7 zY$_YGS2{EpzOR0l*tEH$9rxkkNnkT^Jc<`w^mTP0GI?5M^wlAI+1@?qgB6cBA zfKUV2kMTrVAfh@L+2e-@y8{ksZEc0%35n2!z4Y}(?dCdu2DSAyGxN}nLbW54tE(%7 zQeaS!){3%2uFY!So!@npGL#kHRRh;zd60kvQ4Oc=LY@v}D<6xq{ME0isTmm^&DZV3 zL)4Rpd{XxNoh2-w5wW{HMmB`IH zPHDem3?jgZwKXFw@;r=#j1oCJa{^*9b-#X&{*3kK;rg)ELdzp?OF8VewBhlP^oy0$>}T(EMYDYa z7#_oJQ`gnC73;TsPiOi#IbaPfbH7_l<`FDOtlO1ClRtsTyLUGbEQw$+KchQtj7&X5 zfXF2nT1^4qbSUZ&ptI1DN!i$NPn>w5Sj7(-nkiq!Wt^YFJoTWB`uhdwkm$Ew@tiIM zS+5WIL3KrNDH7}Nr1|r2h4152M8x;&{YKxaD*Z*1^`&o)YNokOR{ZzJPLvsZ>!7oY&8{t zmsRn)v`lHuwg{1Iadha}a(;RT0_cj1Kgg}x6HcDIXIi?Qd3KTRw}%~rnXDt=ht~)J z_(4$cuAH14A_HdY?(oK-pgsKqQThe?6hwHX$*Eh$76R>k45MIXR@*(UwF_IxpnU!M z4lKH{v2mMNdsi2KV(-k{oaOi;a8@V+_7X}emX?-4(*Crzrcbz?_#~L`FNr~*Sy)-s z4-5o@5ES(DCxW7>si|Q-c>+v9GtJ1kYZsFN7qa04T#WL9K6m4ychy>3 zTRV7_@b{o0y!TMo-o74dHlOX|;{zq+@A!D7Xxy+5906a$Gf}dLrS=B~2Y*jZU3Qry z)RMI}zFLL50r28+a&m%a$B_mlmAOrx4|Jf*Gn|wuI+Lr$QmfUhy+$Fx6KAA3$ef=E+8^V`npOO!u<)RyS|37|50u;h>j&o)?KI*b* z*%NuZ=}%3UIbRX4Q5e2`zhJWAHELd)xs&_qAK~+4S}qX-7soESWNr7YFr#-;PSEvb zPE&1P?d1eQ6DG7~x@@eAbZjf>Zn-2|Z4&b_l!=S@od z=He%J_1oyvC>|=R@42d<+iQW%+VhD=bJJ~oZTBffPF1kp572!mF`Z0+i+wh{fmS;m z^3U5H_A@OQJaDn^82=w%5BZ;pqrbw!NdH^^O_u)8izrPNmPKLzc^Bos5BNX7i}F9c zn66{#lPafn1I?GFA6cn?2a>vY6jvx`KKbXt?G&?1Kai+a3tc0dPnsVCwqH)6wyO~ z@<1WcIyn31B^|?zA>|hgeft?U=@s31a@tAD^6V~K6Xl?G#eygcsH#I=-K7zMO1!<} zf$OKsq+0GTRU5TlEJc~In$I8w1_mNXF<|r0-k7A8(Ei4|oOb8i6N|`2bc8 zvsq|p{99TCU%Y&Y5S5^z&~tXTwN=b-B4Y4+nzxdfHzxt1)`!uR`|7n8^T;3!S6!X0 zBSgB-@VI~)y~DzA@ccaBj8ZBpDwH-kIZ&Iw0tUrjV*qf>Y&y{bO)xW>mVqG%#Hi_B z_EfPb-IGf7TGt;?oUbm=r+W*)d4McwzvW<8!k>8KZRQ}JT47<~{ONKWDHm4^U^2qb zKoi|TEk^$gV0Ec0rX3{KmEl|>0ITW5+J?nSvCex!AUK7y+fYDeqs;Wg^8!2Qfpv{_ zSi;RwDVN@49~&L*Ew|DGihKJHtcv~B>GJAWG387CAD=)EK>F_Pp8x6ZO=%e!hrL!( zkXLU1hNT4wi4GbVs1Wr4^ZdpH0Gq>d7l1HDpPQ>(>JPvkx8(GA+D#8=zxC!=2xuHX zV`ELpqJo0zFHZN-&y5E&WI;AeT>IBziQ6*tnkYP^wKZc?UCP&6S1*m}hNcK|3_|-x zfDg!3!!qm5wY4@Vhd1nJ-Ek1A1Y8&*$^t4O_vL|1&Dk2Irj}L&Xho8b%Yaj#?6uQ6 z0GeKzC}#i&I#)cbrZv~#Z46itz+^NC*qE3y)u98K^0@`T$Zp=c1?8Gby(U^Jkv|`y zJi-ccUtd_kNey}v?j#BXH1+ld!WCzimr>pVC4BJUf%DO*9vUHMI4FXFQBlg9E=HP~ z?*To+Ihm{ER8%_l7Tcl6GaK)NlI#HYeFD_FrL%Jp{y}~#g*9bAj}9uqDX3{6t`L=( z&)&3J?#i|$Kt#aq^{^`b9LlGo2JA&One>m(+D|S@_92wQKt(_Rh_82074kmaKmc#p zj@x(c+~|SH8)yrxc3aOt)zEJA!5+v}Cn76H;{;Rz$Q6JK(oA9iH+@GX;C@1fg+~=O z>&OV6vND*7Gdnwb8yQ(nAr-`;rvd^3Kr?_BHo#t_#yZ|FR_X+x-wK@8+s7vXZZiuu z8;H=^@wNnDA_N)%jmkskaAPzmU#t1%%;sh%@Gfs(Uj)}1oUBGH6p`!67f3LmzX)P< z1L%lne8;$1tr$pzNVGL4F9NuZo&s3L!oo5?J1_tk{28zy5^eRtW38qi8cQ7!(2nIQ z2@&ada=o16(J~+5yJfFdtRx2d+v-#`2ao~d>6#djzxqIg<=vqSiH`me5)wlE_9i?W zygt4$MnWRM3V>9FfZ<3`qwb-hHFR|Rn3zxj z0pTmSJYcIJ$Qh&)1uc5!pke(qjJoh|MASOi+xKKEv$%qhqT3bS3h9CSM)P)PXsCzC zDG7-i3-kHO$;`@13+NJgB_+t8AU_sE@xh7!!GAkV{NHDqg=gYO9$qhZy{wq+%XN3Z z1Nk@uIZwjQUZLW3aD1E!gbb?H?D{(DA3*iwfPotulk034jfT)bcz{bQZaOl7K2)dS z0Mefr=%@&z0E#dq9nc%e&BdVxkP{-9P4Ix#&jT^3+HJxQ2^A9&dC93y zn>TOn?C)!h7U(Q2Ec}d$Y6pRO=jbTsV9y*l@9E*N`aM+C#Imw*ux9|ANG&x5ty!9z zBhejt|8NeHA2-2!3?2M|`f=rv@GpqN-P6eTEo z_b4eTl}e1gYioIc3OgST%6n+|Ah}=zCPVK9P=*(LS#xk=- zAWZ;ku7?DLn(sY(2!)|PQQ#r4aZq)aq2_|x!(FxC#X+T370xncUr+Z+GLhd8p+CdE zV?VevP^c#{<-9Kj)ad2?`}fguCml~qD-bpu6x|3qjhoPI>RVgyF)%RH7r@6piHR>k zTBM)YuuA<1a?3K1PXwz&h(|#ALn*f*bHGnQ$}1?)gf0i5`c@t|HB%1D1cYuE7Fk(Y z;Bb{~nj;|DcMPPAkrDgG=~~llYP!`mvDl4ETxt$vjFE=QI{G&_n5XOJR6H9I{_-(C zv@Bt5&}x7GM$*$;w!E>u)ETu%BMfUc?2;pKpR^(l5G>ms7WnuBA+UZyqJOB`K0%K$SeSJmTiP>0K!V(e^glRAT zanOT(d~1cluG}pB;5cY88<57fF=ZJUE+T{-y2_DY6T)L>Px%iApfJtPB0KoV!Wl{r zBN>yElW7hVTHpqkX)MMK7}{i`v;+rZJs{%lfX>pLnOmb|K$)SG-PGBc-M2V0Hl}H0 zq?~E;{K#2$|32#L|9UleK0G4wzd_j>CRvgHdQ-UR|K?3$B|l_*b?oBb zCI56ez|Qfz=(+>?uK$goGo?hd#W1t}L7pemuc-f5UQGUop*0!8L{L5CaVcgjs|$sH{AGu3F7;1X>$n{XYLo z>~fXYQKu}_+6AJDI-Z*P)Mno6tP*35OCzP>>#kBSs^V%2t`XZZ^tg;O2cpPqHr0`* zQEzTx0c#&I6p0^wexw> z9T>ZMz_%{g@o~rYV{dv5o`e&&j2zakz7x}BmUTaC}tD=zNA*JEXB?X<w5xxM$W=QlY^-2ul1-`9fTuJfo%ecGAeI|>ltSI zgIVxtAWaHkoPdQmJZ9;Ks5X##nP^H#m?WZ~KuKCyTnurj&bT}Pcf=f^jZ*qDzFE~@ zC~KC4No zM$1oPkYFZDCbEl^r~!|p0K!DWrT-3afljaM8RU1l?Is>H)i;I?Z?g#n;CT~D1|1n@ z!YY|y=Y;ud>MrgDMLhh^EP$9&(O3boRHl@|j&JCc-yj^*hEvH@#W65Jrvy&YYesrYmMhQyyZVqf3)49_c@t5)_g4BS`mo z_EL^k`I{HN?Zq(O(W+q3OiUA9mA$NgA^$FWs=Ilf`@ps9G}?-Ld5W-xBW`hN5hPj3 zm-AGcsTHP2Wk|rnTRJ+l!F8|(v9t^?Qsmq0;fV3|X;(Ik1Aty5RqN^!$zmoxSz(ju z@X8;-2(HhDYZag~9#2?31c0@WT{@)+;yj3r(~?mDf->^Er9ON}N*T2OdL}P?uk$j7 zO_w5m$0xgvJ(LsQvpX1L;!ni4REh^sTWOy9@t?Q1wt9mmjgXHRV3UtF$6?INTT6%UqHK5b6kB5QjSNfwkBW+xC;jD77T=- zX@;=x5%>&njHIOG9}uBV#;33NL2%{uK+^z8=Ex@xbaf0tv%Kt1izk0Ce06aqH&$@WD{V_1(KpPeHSX zq+96bOWOQ{lnQzUCPkI)xU|PU+kI*vp2569K`o71l^{%)fMB|SzyUDqg7BX^Iz(Yb zxDeD4@aZ4G7_ghVKv#=Q#zV`>SiukKMobrg92z38_7_}-VRg3{r>$~NP&gl9VKspD zTnES(+`IcgOe)x$81w`sB=mOY8o}^{jK&2EMWND`8ir(O!AsWxr5d3RBZNE9JPo^p zQd9Mc;eG|}vxV3dr^@L$D_=&o1>Iw?_4^@)?Ln0Xs9z&;Z(##)` zFwxV|3HNNA|?6y?SpYHGNZA>p$ZdLe7 zfJ+Tptv84X6t&ARcu?HhxFWqzOwTgi6p->*i8-rc^*Ilzs~|0L?(ez5Hn8Ksg51dM z%X_2W^E{Ht$m8#)PvE97noUK6<7u_GAcO#BAg9wsh=R`8TV|nEbA9E6*lD035cLi9 z^|xT?1vF^{R}&N$*M;g0@^4?YlU;?~b{9y>oAXb(oms((I68)>X@toDU}F|AR)Yzi z4~%;O%Sziht7%i93bl++r3cp|oAI|CvqUn2db?ii3IGWI6U}C|v%8yaJp~ANwA73U z?yebnAUps&hz(;CYT1(9~B%2Vd0c`8hF3dF4wr!Vtc?p`(GBYyUt)lDoDGK6m1h} z(!EuS%ggh#vlcSLaYF+ZH#qlNUS2HHx)DErKI363YVjQ;c)85t4(4xv-)d;YyTl?P zd|%UPD6K)k!3{tl?%uy&U{*S6tdk>8ZL?`p*45Poc{e@{veb=WT#?mf4aU&R?&6AR zt4EIl$0X+|1Kn2V>#F?ZE;wVt4^Uq6YmK^n@Z%>X5y0QIwVLx&pqzJ=cXdyza6H<8 zwR!-lf@rn~cQb1G!sE}Mw?K!;$jRg3L-78;!T$C@gQPzX8-l+H(+DXC_l2YG{7yk( z1U(?V0;XXa5%@sX4pbNriMCTAQgy znVBR3ncxsWygv(S{g|VMVCE5`+Io6gg`*UzE>>Vg{QmvBqmwxqF>nVEK8#kKgoY+Z zg$NwN25ov+a8yXM6;SQquh!_urQCp7vZw6UWNOtW#F`ZyIDAqVTgjntTx%F@d z=KF#WRpkDCg;G-j2txG;?8UzARTxeIhx-L7sVB4q*>fkF7cZpo4V_>2O^iLiM3Q&nuSv9VMtWk1Pf zQbx?eSAgipaM(2s9>lagJ-`?A9yhlQon|8kXNnOIg4|bVf|B zoUJ5=3^_rT;&R&4!Py=h??O?xf|(9rpa|mzG(v=#4t*-K&mjtQq}=KwJaEux&;h(0 zL^dkhsKB|RSuJipeE9GjofO*9QU4^kETE9&_RS1{lml zufD^iSQxq4NFFgLetOVVAv84TBkaL&IqfuamC1?gO%#}4UTzklt=6u!Epa;DLg1yg z<~xV0{hlCj(%bKRg7DWL%EE>6LLt9Bw$1Pd#-!eXOP_Pjh4bi9I(6}pFVlE{LPYh} z8tu?+7W0%z)vk-5YVR#|@0m3yIl$spj}LWdIYHNKY-|KSA(#@t$KU?`{fg@}HLx-v zB&YUJJ`iy^27{`AiH*$%Bo!?A1<(hyb#)62`bl7>LB)ttB&1Ur-j~xYjDSd;G#@Wr zE9=l@fEAT>HPtOFhrcJX*G9>CGV{%Pdy1fN^ha*4S@QX~F*DRyFZl1`8X~yuy7BSx z`0YLzYXJ|hZ0n^Lh0{+5n}13?OQxJ#e#$^2C%*5zFROjVZCX3hz5B-2Xtuf=yey?R zPep>l!UQxmUjQ?)x3~Wp7bgLd8)RKgJa!95V~n#(GI0SIW2H9FAd-1lN?(2OnMenF zixi4Fg-Z1kNb5E*KgRd#2Vayb&Num)9b>=@rR$Jsx7n4qmzP&dcjWsd_}7b7lvox5HoEuj*fpLf%}1-$ZK zv8D;GT(x6s?-9=rf`OijYRrw7TU(|{Nh#9W#g_7)-fkW$;`?1$bAKz;6SH@47~@h$XbFgd;5%TJ9M$D`yv}&lA&AZ!&_= z#59@p&w{r!H~SV9F%;h}*D3h#X2z{H1-d|D5>$-<`~A;!Wz+{|(~_DN)#n z5J4F=e*M(1Ny(rRz9|jEk<0uiWLh?Li=WJIZpzMYF5zGeIC~u&?k6WDmHp?puyMj9 zb7Rf?O4l{5(@!xRV80iZ76+{h5sy6gd!mXnlF3AAeiJN+$cKSlUE<$8ib%Q>p8vb_ z3yOPXEJf(z;>G>0*%L97X;Qpf73(w|x>hEPw1_jvmKihm7pvn_%1uyGoUtXgzW&25Kd+!0}6_^VUy>!6aTg~h#c2YLDDMhtJ?Q+o)0=10fx z$@{`XPM+FY9$c^Uf3)|WQBiK&wrIIbOB69-Km-FOP)rDtmx?H;pyXUikPJ%BuuPyN zK>-l~C1(UACljJXK?@`&$w_i3!tK+w&w2aayZ7Daoc7LZ@5gOzuib1ERDCtSImhUu z_ddp#wk=+suZi4+Zye!OZcs=VS!y~KZtO4|++-CfVwk%WDnCrWD|q4ulgRu2*j$yZ z^WSlh{-eiO%a~_&O6S3cq=k@g5o65$ElqLjtGws^-%3x!c@B|X7vWE{ahs#3icLD2 z`__uucx*O?U#|Pxh6{t;eJKcG~uQ+2zH`e+Crk+qZ9tL+j0(Hp~iXzlfqgyp$mw(dbLSAAS<1$SpbPn6x$VdUVf}6Q72a7q?3T4)x?z0 zeEWO96&GCakw?4kxzvx)DY9q%C-vI@t|Hys#$=Ch6qw18yQ+cG0jeN zai(&vpSl>AuC)#qldXKRU_;RO^BBahu`7elHfr8MfoWji6r9n<XUE(QF31?=I(OpH3e6;`FxDX^&Ac`4D ze@OWZ-XDOZ43`Cm{&xBmaxNAM=WgFdSYH*yw7#(STA<>)uCujG!@!7?xyj7J#8-K! zHHg2T*v%K|g^TZNYXgYTwQ19`Kfv6fYhfvHoYv$(9Wh*;bxoSIhxS1vHaIma-~%B@ z4+PmVq*e+ll>6|gz`<1V;`E)8i6%I%zzjfcY6b7n4ssiWRzs<|nVC)dgZ){kR-yH1 z!A?Y~(8H=3aGg}*J1-$Prx#p$;FNlf#mk6@yV!Psiv!M!KORfl45Sp3yF5KrxL6JY z>);rCSR5eoKR;yV>S-wy% zK_SjwLY<-LMnh0E02l?}B^bDE4EFpDtgLI^q*aQPvM){-Gtdiw2?^FkS-D3B|E4b0qZGt)7a}+^0@q zM$}eVE6>5MLKrv@(K;r1*){34GR+BSARz(?U`5~yW#Vc=3xU6Gi0yrtD2eYs#iU7q zH0fxO@a02|799P^;)15HG@L^6o-mNX`~$4(3VLRPsi`TJdxZne)DE=yxL!rhAX6i%p$tHNo4M64AP5J71|nKBcFWc^DV>8?tq%RA52_`usv}D(rqB% z^j3whB&8gJ1?N=rdSWNVVM4L#h1Qh?Fsap8O?nDc+2f|oLZo=s*5&|5p(B+>_H^Tc zXxV5PV+7^+log8whkWK+LbS_P`-$Gn8{c9mAo6`Qr%-9BB76Mf$B*w67CPU%o}87n zHLcF5P$E)5Qc{wL>2UUC<>V;X7cMrp6c?{#V)AC_hi!AcqM{;^5dAPr6D;q%WQ$@z zozX}50>i>~!&e@NaEv{QEu2<%3WXQvj_6;j9T^d_uSFBMYt^gCK{4I}#R*eg(c|rz zG=@hq5OpiaQOC9szjkdWsP5fRmtk=vRdVA{8`k>Mkt>P!FJxO1`m?>GR;7rF9_*<003)ZH3iU0(_Y8b7)X^LeWFXJ5hHE_*pRuBfREd=Vk-k9f7sd2z~l zrfJxz80mu_9gd6>p=k6pGaF?bR8>b@BIZ%3`2KYZb-JM`=%Aw@b&*CC!(S!eXz4W` z7L&_vLf{@jZS5l&w?DbC3)a{oM9-PgPSq+$KSG{E1Bg=>J$B58aLQJ; zqqKH)-N(_eZnE5hY`gT0_VE!wE3(O34O-{Wi$;vUpspbbKS0?^=pVRAD`4TdX>J~$ zn((?DOmiEuC%mq`Xj!G;6upEuo!H#rOr#JIm>j>)+U;OX+W{uRK=}|!9sv&V7{b$W z+fi+>m1|vGT~`vuA8ODW8s;1Y3yfepQV7iokya1B77*R-;EHifU}W}0l7LpU;*AmS z38%Sf$zqe^fuxZThfo($i4fd?XQ>7>POz5SM4f~X7P$DPHoM>Z{#^-@+GqGjiD$lW zaelaz)==myN+HMoJ(H+5vL#rkuV7KZev-=qddeG`BYQ9T{bA(?YZw_LL6CWDJ$9QI zx$$Ra@MlpH6u8iOF`0vm^7PU^3c5Rq`}*ze<%H8AkrvH>^2)?&1Dhn6z4ph_BG&;8 zF9jaIhg7%ZCg^nJF6BI%V^CF=T>I?17e<*8(g+5`25|vqmUq{VKH>L*hZA2ks@ahpHXJBojdUwA)RKu8$lP#mpFMYv=E#HxZ93iC$mO{c;@h`PiTW7*`279 z@SOdY^|xgyKD^3j#hpK)g{0l;5C?#*%dmGs`g;=1k9bLC!!#f;`3Vbe_y$*uS*7?}p*T-=4EZ>TghBY1_ zkzeUm?Iv}@9VQXCDm`>fGlPypcuW?Yba5e4BP<ju`7G^YWy6wFVm zx=vbKT7n=|P*%thuo~nHgq=7$JG<7{87NZ-5CFUs!S>*G6{8w~brlj-S_UmYt`zj@0v0Z(9~7 z`9i=W+Ku;|HZX|GAFvzSgBVuG1}4b_-Xh!(^T`2aBi`*`WI*?|c6Sq3_`mb4r%;dt zI-*zN|KV4?L>y=3ls9kPN>m17Do#}J_4S=@cR%v`>ecZU4zNtVgdK)-6rl~^C_)iF z@Pecyr{WZnzb@JDu*L&#%RBDLgRt=N9S2;!rwad5w8no>z@BUy%+ zrOnL3;P?nCw>qnpTmoKsu$Bim^%*eP2?z}fq*~z(;%e-Mwg(512Wg*eahxJNaI3-5 zq>6t#q1h>2xNnEizT28o%(e$jdoD14vDx+PTC-v)?ji9&ii(P=WSXeop#HDyCpFUu zU*S@SP~cx8mIGN{(6m?Dz9ULWL75^-I8=$enXVv^59`pwjE$*~w1B<$i7Pqp9lC}{ zGZ1BmfWnT0lbLqxF4u?I*PrEX*56jP_8$;1S84L z^X{M<6$B<1o$fwLGpEh80Cxhd`*W+K3(U>Y9wBN5Ew9i%GDAZahiBYS&OrG10llHG zk4$Voc<9g%$nW`oJD+#H#>&QKU`d;NE3g?L2$NadTRnBg;(wuuw6fSn;?qRC*(1nC zTD(Cc6BCIF%CXf2N!Cl<@H@aHSvj0=Dd;&<{osWH3>-L}A_rRD*47qY$LL0py1F{@ zkFuwd@9WbW;sht_VQ9JI?Jb?Xup^NDSLTtB5WZYcWM-(a`yxL-KLIohrEv^$PX65Zx);q*pQ` z{NL!(HBaUJ2qk(UuXAqj-@E{WS%&EOEUV&wTV*w)E z)AoW*zo6Hg5kIDn85lO_)fsPp1HBmSOJr~X2}y`$C~HZ`Moo+gqdvpfzTu;F^w&9g zlLl`EjfQJF?R&(Z(FM&-T~3HTlf3Zx!1ZQvt|M!CMspttwl9X0RpXVBk$!BN(%8Jt z76lxXvP#I&oQY#_bymm9?uRI8()P)T&A?y*I|cU?C%1iIt~Bf2b$kTx5LZ|5dXqVe zx{no)i=LVpEt?joN{{^Wqvi8y=p=I^OP031Wbj2upvklBHdWO;8dMGuRbiV8h0SsN zYE3d#8Wd{aAie{jQDS5NC!alQJ&7`orspRO8pw`-5@@+}xJO64_CzgX)*u}s^clam zgXO(vR^7}}a4y<6=PbM3?ii zV<}}BzP=ksZG2i&Gi+X7mdhX6(Ur~44T{>S*Hi#A&v9pAK0#-SY2L^RS0?rwFd93c za&nj(DF*mBVLST6U`H{+Cosg47jUJ5CuvT(6SMbXyZh5=HydX;5@9bz-src3r}a zAiGS{>0e=(Jg!9m1L}yqf`UQV*lhL#$2`RM5afC7D11h{q_72m&C0-Ss3y+11cesD z4??=;0bx*OQeMCtc_~yR7z`rO$NHx`s>3lpe81}=WS^_z;cb(NVs>_R8(=L; z%zINf9x1k;w*NvnaY1&v$`4gq^x$XlSiVm7X>r z3L#BuHS9gHNOk?_Q3p*%M(M$$d;``?&_*Ac7qREy%GO4LPEbnu&AmwT2r}F-A*5g( zX#*$J2?z_n$Oh6HfDXy0Cv?|h59r_xBBG;PQfCAKGtmV-Nl`ArXaczZU%~Q2XQd>l z=lX*;B6SM6kpR*X*zk|{T@C}30V@gYeE>!m;8%j6(YQ-s3Yl_&^fWLCx|b9HFuo{d z7zNHhD|_|oD4@&-T#POFJywBxj)(u*>H^FP* zi&aHk-cGs)FeYP=j)^q{HPh*^VgWh>tA(RR8EDGQyu=QYFcSBPfM1{$1Wer{bhI20 zPKAeO6Ywyb)AV(FW$2XPLP_T%nVUd>Eow}ASjA6)oFE4k6H+j>A?_sm&9Sj==xc=> zt%ZJ1o;=Cs#*a7PtpT)uXJSHt5e7$h{pi-8<)P3=C9G%t402V5YElsi^+_ZT*t6vU76k`^op> z4T`4)Y3f_5prK_^qkuzsiZ@pGC3~FSM2)-ZA(vSN~ zIsW*|!J@al)gxZDsFuafM&K6p(TUH2doA>?It{Vgv@WShQZI!tf49yE!=S#4bUhT2 zji*VX(1~nW{-XMeMqpflC@xxlaxb*c1`}1c0kl$}do@X+3AHKcv`~Z0CK$?*rM>Hn zx-e^obPwRz$*DNQAM=JLn>aEua`*my|AWJDT@bU`^hgJVRm9=DMh!d#Xnr9b#JoY} z%?kR;XaWX{PWTf9m@g0}SZqBi$}2)qxFZRWuGPt}JqTc=D-@*hSnD08`hNeU-60~5 z&oG;%A(?)Nk-xTCnf0HPB4!>~pclAspzud{dw=DFR^OJ_d=D_%K5$^TEx36oieBXJAgs5} z2Jn)Tvft%n`{-Yh(UAIa7NcR~hnJ%9lN?S^}Ev~(xz;J?{MnW-aAqBb;r|iZtKBqYwh%@iO)2vm?-_=VPD)iW15A^#03s{Q7 z45$M$z~mRm5pQUZPS{Txp^2Xf%set>)n4?cIHox;aIu+(8(utnukwL|<^;0_Tl?)~U7EGH^z&0b7%ozc{lqEy zb^RXkpC7lIet{%|^PpcdAX-Uv#E_+@;Ar7EegXE}FUg1+A6Kw29xY1xs6h9iT+eXc zhxm|LV!T-N3|S==b7u$-^yS48l%&D$+!`x|N+h)Jz9^AF$k?-%}$lCdLiFgrb5~(8VC;!3@Y)!nRVWEyvr|CuuNc z+f5jdX74(q&UZ0&MoBkCD8zUN5~(y@IS}BEoC>Y6*Yj?Eb^S>TnwM`b)va&pEMw~3 z%c1N4Q#`>hz%}bjuJOdj$reufC1c+0q+d5)(Hm{)zXz3nL{rP3@z$f=ot^x1-(zqt zw{WWw3{&{j^@F?Hr{H0)>7r*c038T~Xd3hY3pFz{1K992*V@!oVW)GVf%$^u*&pT4 zH41{cyXur!sUP0T?zPDl^ijMPuJ!7K7JJSD!;kV=oT`$$uzL7VZwqpYl?0=c`5r>M zhxk0ti*V#gw9F>?G3((M8X|ebIJaH!gOS)N*Y#(bJgTz>;bnM5C46-(Du@4e^T@x@ zymtX>|INL!bxXMW-;66C^>_~aWpU~F7Z#TR|GThJUjp%U!}*@8YZ{;rScg&?nu)ZK za=sh!y3#?}k`{us!+bYe{~){sF<);5eTb%vc1F)O6-?5ArTJy!By4a#&T}2?e6-2* zDCy7&L?B{~#e_Qw?ind%S^9qoNh;uC{GU9bkYP-y2;Kr_5Ems_wF8QogjFA?+Xz>I zD;>ZBrrnaZd3+=VJCC$Ffk!z3T6sIm`*hCLFTtbm(T1G4f?KLZmk`4@=2RKJCZ)BH z%tzI_Kn&ZUB&wvhJ1=xQlNn_D9zOuBPpCX}E6kKq7f{^&1~`uSX^&w~qbM$|BaQ#? zXAxH!!eJX|Y~lta2p*%MFp`hNC+Jezs87Hj5uObdqco@?@WtWs@d|!kkZ+nh@OOFh zlMP6ZOMp(U6ImEV6T#m=W$l;=bSa28@lrni;A*mlFo8d=T^wMu@f+-qKZ^nAlO8X^ zL;pj}zxoX#lP!29V5o3FM9?R(YPsOFo+DX+R#B*{0kfu@ZomwJ7la;JXME@_V3M9w z*ttJyJN-2_28M)4AuAE#AJYaRVY~vl1%>%6R1h%lZ+=;d3F5}LSqV74H0gf!>(@LW zipqh)2z~+Y(m`0Rws-d?=T*}Uif}XknWZ}RrV+s1-2AXJ`E^LT6h-OxBsQX^N0ZrR z0qdbMU{F2G+(SuB+Q5jQ4q>@?DU;BZq^5`n4z$avc3EOQ?QM})Q6zMPF3#y zG}Dxt5)s9i$`C#hj<#vkydfY}~Mc7{?L%JL@MVCL$qW>1cp?&j^5Q{tViqD|&Y! zp{rlo_c;HMkPs`==ikb}9fOEhLnHruI7+iXD%&AvZ0gd+_I^==jTCGDv z6~oSp^!^OOp#GLQZ7~U&ct;#NCfgAMBNRV?A2PMj1%(#69p1re@EwBpJ-UD(wY+$< zdyx}MKE@m^TeeJ2X%XJnH=ucmtP7w|h6`e$APwLa+vit*?MHw2PBP-};K2tlZK7@F zDMN!X5Np2O1ZUb|5fL^QfRTODAxQ4#Kc}X;F|H)pf?LviKj=)DI@hc?8)=!`U7ukR zwS(NeiJWlu5i)EPl`nDY6K?<{6v`at_04th6~07?2*RaYqXkM1lphGRFidjn-06Z` zhKc|nSvW>EdM#@4q*q7q0V>$sKxX8SFF>4+s2R&a_6#%twMwCG#@FnI2BV1s zMxZL><8?cBl%ttLzD?_1(gc#o;*o>LXd^XNIC%VK}+0f_~y~o_^}|T z+YNaUA5V-WhqryUg?o|n-NKRoIF{F*Q zJjb&#(@&Z<4_JA>zm7YNCXphijhABKcqVCPSv=bAVQ;);X_^1B;4c#PLv3wlS#JyW z!C0~Af)Cm%6B(laKIcadW{6+^B3{5k40Fqne zg2-o=`uW;Db8zph(b%Z`7y|~m*4zW7+F0^DIeGZn4p0O?g8426Ibtqr4C^Q~uS%=EqgH};;|Jg)hIZ8z z#V+Y2$c(BL=Vd$EikTkcB6j=D)Fq2Go1k9LwEz7i8B_R|R!nrW%Ca5KTAuiqTchp2 z$kPA9{djhCHN)TD;TX60mcLQB9#wi-C!7Rf-Nl@hKMV{w;qk>ugH!J`x~4`ZCkvY1 z=XU5Xa0d9uetLIVpY=k{r5&bQxVtysat_MzVE?jdQ6MSP-UeSoR8=ZkDzYBg)v95| zO)#VY{TQi7!8X{xb0?e;V#tWte%LhkK|nQUj5PJ~IQ!9!T9)5P68Y?L{*HdthdWl~ zc{95X2gr7h2F|~g=<+Z)*Wxu{I&~C=JSR*o{I3zPZE22MrpFt`@&vh`gr=^ZnbhOe zO-ov*)Z)3gY9u@*lxxrC`A@BEp1loKi&jjENPD{BJYvlmA0V5c?J4m%WeM??Cr}GR zfNhUApv@OHFV*Z?WF%IW^N4Ujp$9VaA@7jU6F4snQ=s&Skky$Hin+b`JprEk+i#_f ztt7Ku;r!^uP$DQ{m?i9u$pTm9J}TXep3XE$A3nlDRV3QG8SAHVDKSu8WM5cI4R>PWv zU3>Q~cOk4?funu#+A#k^^-n(HE@wYg{g6PDP;xI>@jC3?2923kj_l<{Wm}z?OiiS? zWK9rYSFhfKv^YI&L*h8X)+t0WPw(`9$9&O22Hgsd!@wt!^Fh5JnWlKay9|E7E zQWwV8R_VPiL@o2FvQig38rs=5ZrcVz%Rw_)6kT`(EkKNiF`aS^{jBuL;yKcTG3-!GFN1-2dky|IR_vAn)*P{-kZv)I5aST^Z(&5hHxD#s}WO~ zpJNp2EuqD^F=D`grI8HfBa~fhUpHpEvDwoBAUd%-h+hh`qFeh6hH!&yF!yQ(Nh5Bc zAHXgTq9^H8#5ykk#kKr&Aoadm!)B=3!mED&Jw~Ak9Wx-?I1j1*T_4^j*a1&D&ho@7 zB({6T@u5J14vm2dQTQi-b!(-#br^FP8tJ7Afpzy&WW={^K= zN(QasIntWLi)g@`be>a0>qn7hN&vE|HR+c`()|fy!3<;Ez-F#eVv_od3wR%ih)b9W=zEis$X!4X+VAeJBD0^JF5f^NM`xWTdMwHCfwjT!3KS4r>rak# zwd}j-HzB3lW!};xVq>3!Mvn6GBJJa7!LI=2gBGMNw38-}p72C>5f%h~EMgyonK9d8 z=J?Htv4Tn8+sKZOLqol3273<=_DRMdQz0giUMkG*izz99$bjvSnifzVl%LPc7I9GbH9?!fYyr3&$j$HuwuNhEKp0H8;O# ze&QT9AIc2eWwgo`-0p1!jE3oUp@UZ<| z_uOdcI;(#~qozU2un&ey4S<`>*#^Y{1%~trf|4a8brAgs5cAXUwi6C8cb`U5vj0se zKB4yYpDSHu%YUepP?y3za1{*CCr~NMg-*h#0|{J|cZ$MkCev`CZ^JOS5x>^<^E(}2 z5xfwb_KB&d8i-beF7DG z9|pzuJBKXkfyN7BMS%)A9LN4i-HjBbfq4JL!$*!V@$qFclwzO>85p9OaxFy(e9#Td zRA#=^^zE#*NRbb!*EAR`4MB{w+w^?`~RgCF1p@$3LSJn z4G`0_QOH0aBg&6oO$&-jOyp7yxQu}cgd9iGvJ*gWGjR?tHeS$rAW%$Lq zAO#O@sk~ERdz**uFV;5C7uTxsEwDR>1gDkX(BdiLP%}Sv_NtgHk3q?CQG*#j_cIUr zcdx%(%O}S5Lsv9u&Wme9z^z1S8PCYn>La1+(&r@4W&|ddSJWk&i#SgY{ZOMzqZA3E`l4)MTQFj>}@pXbMG*frfrG zm_r|WdeQ)mr5U#!k9ao$5iAmwLP<;EsO;lzSm8Yos$*dql@ze9w*kw;oD}No8wNS? zz@9y4k-uO~Z4ho|TD!Iea#Sqhc?kw0?r{U6w19EF3C5{7#pDoh34>0UJ!K-`G?#_^ z8IItLE>T0Ek{mR+#0dpFRC60P1r}FHyWvTUBNDz%CbjSbCPDM=hnr->l~`Fy+tMX{hbm=sUKf#Tl6Zzug7h?GWqP&*yZP^u3`d$0$Sp^=7ZL5 z=e-2o?&_sW9^jq7WsMxUWmmkzy63_EkS`!#Xefsnyp2MWQyqn2B(=i`sc*<8%a<+7 zTHJ?a=A*J6*67ci4Y8kO%i)M0);J}=?hGsLPIRD~6p)?1mFB*7kikFWFj zkt0W>H@lyM&nw|(FnlM_n+~8uyUZTS!RXY~)Tv)&?gcQVcwCTI-LkmWGY-z&0T+?N zK;@6RotGHOt->E43@DY~Cl2|pbY6txAQ#s~Y;*3k@`tB_rBENKy&CRqN<8yLsAO}+bp8IajA<==yH_@Hz8VfwtWdDps=)ki=kvN#&d&Vgq`RSsAuiW24)tP zIEcF2cKn$qqh27K{Qk&m%ix{zE9e1&zcx{YkmwwS^1vNOx?*e$QZl1=3~44#$zr38;K}>@4p8 zGmP`j%X89ih2hx%0Jo3KF;`$Wb0N2%@xmgGV`$ixiUi3vD z6>;0@1CV2f1kr`vi`o}FXa+QJt_&)u-6CzudTg(JmN>rM2#w;6TPR5c!TIVDN5hqox2<&qzr6Vg($&; zaVzL(hzE1jY0`p0`ZvY4GFsZI8-tJf<1=B_}7th#w2Xhan0hP;~)d z;ggVW4WW*69yoB**#ssbvXaFaNCwPXwqQ)a0YscjaA(OcG+@s^ANCd3R#AC|VN$O_ z&gTQXvPCO(mj^||Oq)x^7V?e2FpTpkmA)ZCo&-rJDJ|XoLLr55$jr41w2m`4u?K?r8+D0Ke(;0&o+<7g|L-}ina*fKhI_>h7DQ^HuEJ!?KqTj z^(k7e90x^3sW6{MnH0?2n6d&E1@?~yh~+$X>?)jzwIHdV1P9NnE5#OG4cknUqJD_y~N6B}C+Mi<7yMUd0!ueynqH33SUM0ZlYhlj_v z!&A zeDJ`BgApVAK^yyXK(w%bcIs9bV#*N-2rkuNuS?5fL28qg2jq{(QW;{N2@4*lfOpyx zPveBY0tcxdDl85AjhUI59Kcu%4Z!|>X)lOU>IzJ_m@=4*VIX3@n>K6+Lo=CqKH}fe zRP^3l-0lPIBJpQF=;kN6bC866GBYz#jK#xuc?C#)=m1?BnS=%)F6__Gx)$~Y31Dyr zfC{)u8%eiOKU|$OOtU64@DGZJXpkF}j)QcME3v}cO$gKx>X^?r~&$3J&MV zB4Vi&IAq_xb4Pghz+C?kwA3_RoehOIzO%nywQcH_2v!wzRvf+&u*hT7>1tgoo&%Tm zgUKde3-dr@P?p-~QSBJ@otz559`2RElmUiSt75B3pq3N{w-hk7#|g|m*{4{_%aAG_ zdV7a(7law~l>B}< z@c22r4Prp39L5}-G-*_V_c%4jqBjgXsvplQ_@Zi>ABiiy=$m6T7>5&nfR9fRr3X3t zWJ1YM76fj;M~`;qHYH(KPU-iJ;oj-PFAM)<5Y7$uXgcHpf=F;op>Ys6nXQ&uX9P?r z@8FO(V3kYenWQ9Qr8zk`#H6BSAyoyCk3*~?yI6jK8v!N4AS>nL2Vg%Q$61T==lrr{ ztWbn`v{kXkHp~z_h5Vl(*?^}k`GkdspM>`sUUxNsK|lwd8QAX=;JwyE_`(X%2;|Gl z6FLl?8HT)Susq*#EDfh(CxI7YvFRBY8U2bhuWD;YAWX?AoQr5J$JILtVW zqZSqvcRZ+=f~)TU&>{-h8Zcxf`GOc|po$?bwTN3$WOHD^KRWjs$VE%Y;3!W3P4?g! zMZO&HK=#8*gJn2uK9yrJl=BsLH5O9_Nh*fO_7aXCPDgLt{q8hyXy0hB^*j35iq8dL zOmI+n6!>bJLq`rAxB{?^89>7R-CbQJ#l_Jj(a#sh(%=(uRM#cXbRa;-d zc)5Q4#Qa}i9rewH!NDQ@)nQZaue)PpmpE<<~>YF>?M_p@NJ9b{+@ThXXUO&LAHN!0Lkj;)6$ytlhel z;!^tFC%jl2ZnI{$#++oOpn?Nc?bi!tdvyb3*82B|WnA2Kdhs z_n}sGFIWSg;YcQf#VM_<99EnvgsUze&k7^Eo;0}5Oiyq1Tm-z57ZbaS^PdjxvI)-? zOI1mfUvM~c<~Gj0>h(V)Wo&G+5CzlGfsPR-(Pea)aceL#>NSWJiSB|s0A+FD3dPM2 zPN;TaDe9Z+3PHwZ_dzXt!xNhp>UTogWY@0W1A+T2h zj0YCq7mt{Z!&&x(Pz^j&n6n53sE_zYa^I~#Bz;RKN^LM)If_i9tl{QDL5U`fS=t0C z9x(?hnBV-P)(na_9&jy|Jzq|f=Ld;Qw=NY1tqP692V9TGN149NvZa81fpLd-7mBpY zeZ6*M$Eh|sO!{xM9IecG-F-g#Ouw!E)OFqLej9uH(%M=@>>?VeRuROIJ|%pggoGp^ zOaYL=Ja-*Y$dBXl)1#+B_f&%&Aa(2xA)70}wFCl^JcryT;R|nHI{K`p3IJ%+F?+>( z9vv$(zT@aa?*(@$AL5L_9+#IC8X5{4Z*PhbN>e1`Dugr`BljcmAk62ZodN~2Mx+)M zh41|}+rlvB$q>38pxl8IObFe;WL%t_k`PF%u?3nMScL6f1EoX(dg=o>kGc)sM6yg zugixlhQijwncM(r7A>5%hZ=INlTC65GZ;i=tG<5)@I^*Q?dBg zl|$798>LR>=8W#*iPNfT=83KlC=pee2?f?dc}0Q?82vab-YodtCw_jBU?K*a^HuQy zqZ1SIfTcR=Dl}a7-u?UgW1~aJSEXMSl)q{>uhW|m*9Qlayv7ue3TA(q1kU@1RP$ZU zwKA5d_Skmf$@Aw4swUaz$aE_qzyY#vNr{R`OIQ};*8ia;%Jq*g1#2e zh=KjH+d+XqYjk@K? zbbDv!rL0`B!T^Exp_f+;%DX7Q$;uA5&Y6lrg>OWmwZ^eZQloA5aqb^VtP6T5U)&P5 ze<=O)jj=TnLFHi*^F|Cm)Agjzq_E|F&21dS7L0xI;tvu?K(hP!`$wTOlL}lShwq5x zCxc8Z2kYg39U7A!R9CS;T{#%&BrLTaokhfy;8)rybNck3h!L`F4!B<)x5u6tCRIWB z8IA8BY|NI09qdvU{sU>oUHc$5J{Dk5f@GUtLt~L zGC=MG_saK*??leiiOD!Ww``@-xP@~N3G#cHW;w$G(;K_RywsFmY`c@k{DZnsRRRVi=e zS1~dlRTl<;kYGIy3v{VTCgHv8&_H2XezG0H!lK8O2?5ZD z<8;TN$ncFIWg+XSS7oOp3(t}Th@GS+*bWD23XgSVQxjGtc1QBo+Uc73i`d_+$+=Qud%RL#-f(daZ2d|y88zB ze9~e1C)IJQorJ^#pia+^AwfZ0FuTmm&MF9aqt2-_%HR~X-$+?nDcP?HKp%0vJMAHc25+kTif^?vUq%I$1DVv;xU%;f0 zDRRBCF<%WZPwUj*W0-$H{jAS@fBF|Y97xq}W z-uZR4{J*}j_?*GFoxjK^ufKzA|KRKXXPB;kz>R&L;Sc!xk2R=e;Q0UGWB;pM-9PvS z|M#u_vxMjWUBv%5IsE_6wJK9+LN2Fl`S_{l+-ys*D=21KoN@P+!;ba|#i?sgcf{%Q z1bA1bZPEB?OqlGsw^?!a6xs)w&-TWGixPvT^J9Crmv*+72Cqz~cesyX*|Od6TJ+g9D>=KPFs_j{nHj zSLv)M*CVSk@-Ejb+sXE>{nhIa!p?+NySQ}=i_kURDfX@7k#a4Z|Ex9BBXXp_$&;G1 zn6Fi;F_EhuwR^jCjqxsNJ-Os9mOK+rIC`^-TjX3{++s^EoU}jZ`;C6Tch;`9&Hbe1 zFChSrBQyM(r90d6^~cgahw^1bYND6-dj;2A&g3;u{@Q-u(9-h4BZk!vC%%_8`$kwU zPG8wuBqcn%7$%%CRU4cCBvkRmkIczWrJ7aIpIiEBR%~oa4r!C7R?o;s#Jmy<*VK@4 z()crj)kZv2_sBP{2U@QWj~GUB3|c2=YL&9pIV1?!9=d2RD%!3wWEQfz{K1`o&rTV0 zdpsn9towUi7h_YtYK`l6ISgJ1N^}!c;anKulb0EIlJ+6?{9?0gsCJoo;pQavPPUfL zyX1zjIT+fMYNmV&p~k=h6f9&V&eWXp$D&$RQ+~yFUCk$c3uy|6FUUlH@=vYLlam>c zE6JFD*k}FNUf7g9zP_bKZ86Oxz&;Rf|C_xJU0&&mgG9HY&*6Si+3TlMZXDVXXUAx8 z(f3(8L)9~;{jp=g=$B2TPWrG-t47SO8I17cva&M@Z%TX_XK(3p8=fVrg(69KoZ^*%3p_|dGmOY;&mQf*b6lB+udf=bQhD3llVKf1pAy|&HN zTwz^ZA!|NSqN=rNJ*|4az&rW!ps8V!rIVLbCnUCkn*3XaZ zn#e1>GrQ)&mj+XZq=7P_DY}RVuW+tWjBiVQ_=l6Bb`F!@MotKr3smm8P?{z@Vp#qx zt9gF5a!`$%XjNCl8(-CKq759(AMw_{ml2bEum8OM_@e0L`PRFFon|@XvtfgrhYr*P z2o~15xaM9E*rL4OTStF-qcDfW{CTS?J}R5MiC0tpVB>R#!G#}>=;_1m?A-IqO0T}h z6!!Y!QI3TA*xcbliPLYF7_cZ%`5LR`ObcfMiv?gwseUp~wmG!FE&oCeVCmZRBvGvmY?foF!7G#a)^DQfR*XX_@vm#gYOk>jiy=`Ha-&` zq0){;N?P{RtBpk))x;dEVzZ9ORpUnQ8UN_&iD6nOXHVQSyXlZ~z7ZSGr@eOie4b@m zFQPcZq`yjq$;0#8#B z-+5{S6g#0t);cxz;HTjlcTD{=z2(arc;w!Hd^^kEkhI;@II3Qe_N`i3b>iLQ#p>14 z3l}TB?9a|*FQ09Ay;Y+6BlAH{&O=qVExiv2o{*+GI(*ThV;?%q=QSmlNU>8TcbFI^ zwXR4XAAcY3ckB3hUkklOiKdobe#hwwjlJ{snGTNm%!QgUA1`}XW%V9=NadH?@ARp< zo83wAhJE;A^Tj3U20d?v*qch(9^|T~?KhDdRi(y9d_Q>J>7_={VgXy8d4c3ZC~>}; z(GT4v8?n=U<-S8EPa#`(KxKAL!MpNxR+|bVt7R^}g8a23GNX$Qi7`%m2Jc6`ON|OU2CvUf z|5!cbtgGAATX92Ly-`B`G@~>7VHHuyu@K2Gt*W~HWxYbQY|cOC&s$a*Tc_82F)^n( z%WX-|iG5JqJuAHFFQW9iR(8WoGPP3evNc%8K7#G&hRFNv-^ce;_SNyRrl$MtGrh2zQ) z@k>Kj8TZU|bZjw13csQgS*Y~>KlTCtqI%J=wbhNcUxPQD4*pas7|-H#@`qpWSX%Yh z6LI!J_;FTQWV9|Q^z*0F4L_TWMu)2HmyU{$h!Ddw0#uu{u*z?AVlWmi)y_87=}vrS e$6(^((z}}mCnb7sG~@3n66d7ElFnSa{XYQ7xQWF8 literal 0 HcmV?d00001 diff --git a/docsource/images/Fortigate-basic-store-type-dialog.png b/docsource/images/Fortigate-basic-store-type-dialog.png new file mode 100644 index 0000000000000000000000000000000000000000..d0b386377e217aba43728b778342242c4fc3add2 GIT binary patch literal 51650 zcmbrm1yq$`7cO`ZrKC|nIus-nPzh-P0RbgN1f)y4yE_B~q@)ByLApV@5eZSck(Nd} zXMg_xoi%IjtXX&Fp0#ud=bZO@W5@G6d%uP#Jd?u1p};|*PZ-TAZ-!jWsZsAi8lQ@duVqb29@W5xmY)VqeN zJ{lQlx1I3cb6oZRef>B{R$5xr)bx+X_sLoplHo#at7s1jo+o#ZF?JPN+uC&7La)D- z$x0CM5_b3SFuN0zj$?r5%7RmIn zs?=Vu6|d}{*^<)sP2!`Lg^Tb~-E%l_{>scQ8-?$`s-?SswB*EU_TUoB@cm+k9>vqI zv+wq8?qAi%O{4Pv5%Q|PB8C|^{3AheEM83N`!M-MtB!BzFIJzQ=U*q`(zA6U|90-u zAtNEt(=jqa9vB#?z#5DCfEVp_AU#D*mwSVPqIqPbO7XURZ0s+q#1}Tz7VuLxz&S0%u31n2s z>^ApVuG0352Ffp;`Ocf&AQXGxqOlogD?~ymEZ{xuB^drQBb2F7JAY`VIY**)d(DX- zjTqG>b8V!4<8mtP?iI%~YhuH;P@~r*L`40Wy}y2u{9Wn`%E`&uFRpRBX?FE36B83+ zW$I-n{n;M8Ur$(>OR<;<&MKW2Gz}OE+CMh+d_S)j3h7zz&3Df`vLuj~g=L ztmJ&HhAL#Hzbq5lwbc=4V!u8~>>-Z+-ktVk<<+fUe=^}jLN01~iR*$Ky)%=zS-Y-D z*F^aRPjVgFEGSYP?p^x2Ykp;O=ovxn)2H92Mscj}cwJ&O9L#c|zucQ5-FR{_8v6E! zV?w>o?L6~tG!!wmj-~D;@l2`Jzv2=SkxaC-wB2bU+RW^#m`_3^l+3*I%qBhxQ(R{l zWW^)?Z8^7_?wrz*8PS@lVI?xc*SYFm04~^uWAfk#!uZq+Z^iUkIy@^&}gj8XG@;Qvtc~P7p$e$q02vd zT#%=dS(Z&@WJ}WdX7zwrRWykXZRI;MdCIYxLWLU;dl&I(NB^K0o5O4ar_Zm;uOxgM9A$RuE zzt0VGPo>2w2 z#0^T>?1@pJbh-y<$T`0#*WG=1mHsVNT7*c2L`!Zt$){fG%V|8l<$Y({c-ZLUF|5TfOs8#4Nr>5K|?CYfoJ{);adp05Y#`!Ddr|v(ITiU&P zM@cnh776@YS5b{iB7NR&SKZiC&PehsdWz}HeR=HBL{(kU&IO%sNS#-G#5;u$pVi% zzq9&g=9c%mNg0_3&-k396bgB;>8+XX&_-eYww|vfPY#p2jCzwq`erJf`bV{ttVQQ@ z)i2v8k)OA=lh@U%+%IVgnin7CVwnt3)RyYqoA6lMS|VevO&h{7eMVh)*Mq7Fee8G4l?Kr)75&q{LN-SePt7$bu~A!F4vq8i z#~&^_BZ};P=6_a77n`WQwsy{i<8?}ohgzQaPKGY!B-S~zZ@pjS@_IHBep9V0`IV_26@({25&`J2-|-?W;aBmNl++qR8iH71ErfE$H)M%5&@+=Yc@M z$?Ijpj(4kxYUjO$+)UOgm4^E#nVkF8sh!oz!5kNxycTa8#)k?cGi%F;3u^^3v`*xn zb~cATt|7ePd4tE1l$?)aEAY*7fWFlA(vykp^gX_=eeex=vl&t6%B@oOa& zk@j(r`=2ukG&Qx!Y|=6Mi~fwoW!I<@r=-bUSMwqk7)opXzKP%AzfxCTH!~=lTKei_ zv+->lio)}pQjC?`+e(9Mmui5tU#f6UQj95YeSzPH9}GjngGDtrm1ysUY^42?-fdEaI|-$XS2U`F-h*<;6K<6@C&>CjJi71 zCzF509eYx)tGUlC5*?-WYKIRaa`jSm)(y+gi#it(e@CiL-}VX*nBwVW#B9yIAhNd5 z4ZEm4;PVwb)zQ)M_Rp={{{B^(>U8h7$M_eO?6;ox2}Gawy(v!gj5oV)xj5SqOQeuH zfHf|N*MxpXf1k@=CZ|2IbM^4FN4wZ!-NyNtudzHJrPt2m>=mc3D~CPSPGI%K<;>5! zjoTi@hridSw@y!+uu^_pw`EgKI9>l)m>xwh#(bH+$e7Lia1C|$@n@Y!BhF=}n-~xm z=Z&rpni$)7K6JF;4~fAn(A%o&bv9M?axS;^mAqrk#fq(c=N!EPpY*K^p3cqt{&Gga zWK%e8Kd@ivZW@G?MB^ljB>E4^9?WzXuT~wY@Qm5-Hu@G}lXF#5!dX(kay`=fv+Ad7 zVT@1d_AvBn*Y^0LaxiYgn}@U!?VaBy=_|PcBpKhjbED@@Plw;hjZA;;#(UZRZvi)< z%uQmLMDs{a6IN0K`cd_*!?kej?a9xWT%M8~kb`k71YAws@GYq44=j~EpC|P`X40Ei zp5#2rs<%FH6g3PWHkQAsGZ;O2=y^n6X1*CZgLck6c7Oj!XP0u6h-M1k+PcDY;K&LK zCPqW~0|V2mF4!(A#ALi*`J^L3J*%l)wvy0co`R`vfRbh^;&vxnzpxYX0CQVH^$MGS z0fkUmQ01t0|_Ku!v4k42}sZXzp$%_o-8F9uUJoN5`&J z=cmt>XKR(rn(1m&Sznuzc|6FzF_L{v&a;|8QXV@nCJC>5zTISS3Qu_nx4Gc_^FmhIbYiaN0OKLpCq^VYgyrys}9#5p^xnCw!zTwq@}jm0o*dp>uGo&D*q`d6te z6-FjjZ03FKCjT4s%To>Ej<^}=QP+H$@;O%mrjR3JBeVRIH#<^MiW!%e=v%Dp)?DaE zIZ?YdGuDj1|4bEy(!ji0RZ--Z5@Q%n!wz#dU%NB2W`tf{&H`}V+P>V^?5aj*{!=r5 zF8a&Sg~oKh4`i3QTWL8O1c=X5a+`w!VzFIuO~MMj+^+a_U^I^mU_IO5Q6uC*>#OI% z+L+qsL+eOKjktpH~#o}F+KYOuH-#&zUr4P{ew89L!XMuxc$Ov?j%o`>)ecC zI8w*J-~1XJCGXVoW83HLc!KHp=C7eEF89&3ubyk2j)j%sX`3*_qCZ*{`d z{+0Ucbb=V-Ev*)L1##c5cHlHmnwX8}k@noxRZC?(cYgfM&_@c|B62ALH-^wSYHx&=5MN<9XiKm9AorQNlr*x@Ot#~LTLTZodp{qQpEG}_6(sMmjA6Q_ zzZxdxqb7>%);JooxD~JvEbNGf`jKyCmhket@^gb7hqmC!7@ht40;ZYURoJrrI&F<^ zXZ_nKx_vpE9otYvt&GO)Exvgp(%GDsXFtCB)$E@cGx4^2N2PGu7-2;Ob<7&s4xy(V z$xBFtzZhm;`)Xvt8-NiY4HV!|_BEf~F2C<_nXi?`i}m=oS>X>aiL0ZbG9om^A6Y)< z2+5EOY5l%}@`hx=ukDG_F)+ufj?L-Szv6PMiXsN10mW;-{O6TEv0qLOE@|A}@~tS* znyFN!oS{`E8`b%X@Rlg5c%PLEPJ{@5YwK_|zJkcba;W z3qC2CzP0B@U&(R7!hL<^q#@iZ24c({-SD#!A_||0H9hlJcGvm{UPg?PG&DtQKBK!e z8^L36HN48$yUHzXzgP7(>+N9|i+ksP&K#^u#eOf?zq>Yg`hD3F_L%>&%UsK5YRi6h zCFjYRqP2An&IHTwz3ub7{KM^4#@lzZYiMGX{3wSv5T-PFQXYta4o7iD7In<3Onm~Y zR_)q=iM8Kf@Vux$rNm_Qj=c$gco9DP+cIp%$HL*9oJ4HK$d(krs0~qQTV|V|{&ocA zB<8h$jaCvzKP-0=Kk%`zK9R)Vu?vlgfAyxyF2{PiETDUY(8+RPl}g#u5e?uO(^nUF@j4IVRqx%qw}0&iR-KGw)=Kyw+qgbdu?VcCd8GwF=!!s* zLz%x)j>Hq)hngBA&0RxzT6I3x7h-R7m-)|Bt=z?Toa&YH%M zqyAD$S92`tEm@3XQg}Dap>u=c34$@S@>4i1O*u5fp0-qQci3zVhaGw- zU-LaaOjkY_tNG1s8qQ-dCZI9IKiZ~gdC5&mRx?so%H?&Nkl#)V{{;lh%YkLB1>vf} z!miYC3;~eI$mDOmz@v95r!`+&)jFH8G+J!8wk~Nczgqc0;kKgc7f~SO(FF!NL(7Gm zM-v&o_kihW?j#2<_uKzn?BPc@*fU)H8h7!s%9_5mww9vSs!seP;ia4>FN67&t}}RP zx?B?}5L7ol0uaz&UrKfp1B3G|h3Lzip@LW^5hZb!k4osbuYHl6JnrorAr!WFg+duK zl5pB<4xc=0&oSD1QG=#)OesDy-B#L*Vz0dCVd4}KC4F zmF+oS1v7r7<@^Wn7n>&)IkjaaLt4hMO5r;@GSYZ>blkNEN3Lp1(~Y8+Xhn?eX@5{K zHy7$0#!Sx4>-i~5{q8R?yL$QZ(SVx^eYhmLVHO4OBV4>J&IezPH6K=~%^tb@1D0SzhkqRHHfajT=mRg zEYMx960LF_Ynp1q8NCtE*~1D50hv*J4AAkllsi#z$$oGgSo9S3uhm$&MOX1RmU-`? zh`cnLH}d-v?&XT)t(gW=z^p#wYd>;%eajc~P~1rGV+yfKT_J{0Iwz8a_!l$c4=TlQD^mTVD|3&aS3W~Fd!3~9{BmX3FlXhtE8;H`KpdmJmRm}y1wfBszkQ~Z*Ad}cybTG#Kd>K}jDJH% z6?sfz1Eo%vjf}f^g{zq(DQABVv=V;dMdgNDTIa|0LnfE$zWjOnU`JNd)WlnLeS&ac zm|#|;FWoLO4vS{Ka6O;3lcgyw=x(O+L0nN;0S+-l_Rc<*e(YU<8Vd{D%#A7yk{}mS zgk!)ji2c629JCN{n~Ar&kXS`I;oca2E+AQStTn<*Qu;$*beuo_P!Y^eXV}HRXWVB4 zeOza(w#j6&NnAtzW$`6u0_~=HizOX>&<_>=p}C; z^1{?mm7){kCYbxY=esUM+KTyQ2+v~YueLly>9X}@ALJ_~f5^SRoYY|MZRc_&(V~d; zenmMlQa-cf8S68EP!q9U=bxa=%V}gvF!HcdSC2`&rr?hCVI}!#?IIslO8)HNal?15 z*z0VB4i9LiJbU*xikTTQf&pc&j76|yp1o}2UIopvX|3CQS2BmQw;;>&Xi z&G08Jz~AjR7Q%SYXdLbqnJ<}ybR1W?GjPVG zjXT?E2a$2?S1udNYuwa)HoW5D=CCqHF33dqY4M)@+M-|1Uku%r z5BSY6baUbAnoK2gXH_I-1P1^@!f4dIi?OVBE--Vj-IZzWbL!z<9Kzqiue+ z$XDU+am~n9zp839gRby0Gr_BTt_np6Qmx(Oq;X7q9)}c~Lh>H~?&+tkW6Ntx32uvF zkv3Fap{+f>|BR+KG*$dmSC3V^Yfo#83mxs?S7hU=0RP0AE$U`WpisH*=OtZ zs&DhDQu2t?4TyaR>cyq{b;FkOzH}DGGH)%TUZyhPcE>FQViYU;%`PnYBcJBCzuvLm zs@t`8p1^O+IX_f>U_t_dX=Z);k6*t^zwPI|2xjl%c&s8ZNOr34VcP3nmlRce4Q}P5fB#|q`CW36{CG#E?K%|>CLshsz+M_h zXi0&~aO$WSr`X~p{;)8)`M9uYz4$PRd3&XndZc{&fun_B{v-`Q7omLj8XhI))yn~8 z?SKDb&eas5J1?}FTHL@SW8*vJUYoJ(wd7gmWkBV|Z#2CpXwfy&ePijN(UO^kjuDRU zACki*tWiY*n=aN$8*iT~FxRuaWih9|bW1rggdRh13L99&$mxRa`oo-h#;4`8F@Bs! zZS`ZiSO=!cTPQF0t;td~+6r1lse+Y>DC05TCUV|AtEE+%LMP?ai<&{>6)Mo`?D6+~ zf(p?=WZ71`;3>+}H_w41-lZ9$sqy5?xlD!WO`kMcxD+1r-_vmcgQm((Hq}_dZ{~yH_gNzD?7(lupDMPuVi{4JV>t$f4I< zHJ7{d>nm@KoQK(Y3eAm;DAkI^tzDaemv5^}!~$xQ^`vh;zbZA%gT?@$nYUotCnpgX zh;&iOeJKdZFoU-syN=bHDp~{2s9n>`erKvS`rgbqhpj8Nv+quh1Faa=yy105ZkDUp z4P!wOE-K*?4~u)opZ)>HZ_QnSba9@``-2MjHq=3~Z@*9tPpio#lX;obzW$Et+G0G2 zx)|VmV+suZqK{yqB=;3nGf)cLp9WjT(JCT#Tq6ykiq~0{7_?h9@#Xs|F*ZUy9ZP-u z!W_aw1P)9|6db}D=MQnO&Br#2nxdRI+^U?%{=6d+`@mUw%`gi`t@9~;WllBzXW^xW zdXV1~R1|O+6Y0&V=gas1fPPCDA90|4hE1ya$$9lJ^UQ{Rq4K9=o}^Dk_t+2ZFLiet zN`H+*gERbO)Na!Mv$)qz0d(U1a4LgI7Ld9F2NZBHjoF-?1q7q@y+VSQXKSKtNfrzZ zj{~F`OtoNBMk+S=RL`er6VA?W%O#L1>6@=i((i;9VL!DUrea{o_^J{l?Z{0i_p|RqezHS;6==(jk2aGVp zu}<(!*UO_1JGt~{3CX4L2!9MxLV#G+#BLfJx^#bv90#~Nd;XsGj})lX(ep9=DS5NwgO7uh1#V`(o&{WB+c@0A?@1w zdQv`KxWn=8YbpW9y!JUuOH1eDmCr=9v;@q|%p)Ts6O{!$NxY17bSN}5v~o)V0)n8B z5bWc<)!}7FUP(1I@&^=8!#kLtC1Y7xZ5o+Lxw`W6Sd4ueW;l2?Z zOmn?wj3hBFEmB_i=yG~`Iu;&Y+mCed{@fQF_J0Pj-S*dfWU@>Z>J}Cj)EYd6gwGH4 zuaOEJ+4RHG@SiPDz$}Q(97m+&E1KZuqJs=ZEf3c>B(s$1h*r$ji&q zF*nasma?(ox`uNF`O(1OvcA6l8(I-9je2!MsIKGS(8YYydHs4cJN21I3cmvm)bBgq zu_(hLWZ2cqvfFJG&amk@EyfZ9|MOZMmGtx&Y;A369PbAQm(d(2NVBoAIlH)|my{3#)(0C`t8?X^ zw|$tLoctqSgO`fW8YPoO+}75nR^xbQVq#)uX2#oQuAQEThcq@eme2i=({W=WBs3IC zm=vw8tvb8Q{bS#KX+3s{c6N5&uU8G_YXrfTGeFk>401RZDPmv2%*3R({39K53KlMI zD=Y#H1=8rM2mOu+XpQ(0m&9X1p<19B z@-2qB<>yc0I@i6Qqp9)nK`XyLw|x7C{p{JZ1b&Av6$d=9l`VmIei95mK|z>~n^XC} z0?{$?k#XR`>1+{)r)t0?64^@T#T^&33Hp^+>r{yyMAW z?u-6neW~@$@9`W`Iy!XhckXc6FDqzPS)+|tT6KhR)CX%+TBgIud|u~*C><~}SlB>n zCX8&hdbF5i#p$+he!3)b;ggkhYpmQXsMNSmZ?-vL>|h$ zt!Kqj_#>$W0xc)Mre|dQu0PovD`%skrnWghJ#zJ^AIf{__c_%Shof#+sjkZlVh_2H zYgzBoVhD4pH!Mdok|um@&D`Qh$Zg+b+D^!ISJd5I5H%CdJJtASFt^zA%=Iz`hG`JS z!1MZwic94U7a_qE?0}&j#8dKG2G6zxg*^@<4XJZG2nF{FixfFmtE#C9vly>HtjY!) zpUZ5Bz1V76*k-o*O0oIqJuZVz!l<`z>F{ZV*#mKJFzjzkvOySSRLxVP=dqe%4-E}% zg-vdA+pJ>_4GU|7<9lpklC4%@o){bvLF#s}aUB*D9UKxuL=paJYTaVlEG8y~5fvOx z$%{kppTMc>yFA^{;OJ&(n6>ryFNt^{E>Zm5SHw|KQ4F_lOQQ%~TwL_}Gae&9Xw+w9 zh;=U57Te58MkOTNcHLiNd6vva54P0`c5!>&wpt-aMGT8xOiavQ^DbG#=}uU1SQyD% zdpHR_Jw3cJU|POBTKXCJ!)Len1|sJ5Ov!NKhKuu>&aN(E+iFermn9MgMn<9cjeD^~ zL`1gNE2m+a($dm|s8&j=TKWR*hP$3;doSqYzdsfg74_3%^zb-8T59g^->zSP=OUX? z-jF8ZrG+9C!y=-lzJm$|0}Rc}V=uOxqi>M#=>Soyd;L?VUTZud-WUR*WC*k(? z_V4c;4cAbur$>JS2*q$|g*Ch1bITeS8iph!kaK}kM8(Gszx|cYi_(Kb=Z<*D!66UP z5(||f8-MrrNU=TxE33@m;bHK>lw0ADo!xvV5t=AO`_Qc|>td%(Ei}>j#YNKtUZZaE z?FqZSL6Z(}L5Hp{gQmr1!*|g{&Bw}ew9+_G|E7VBjlFj+xG`Dt0Ce0urH6=(~?N>^bGfLIHel7XLJ9iq#lWI-1tWCxN3oSsqf z+e`0mPHV4C)oDyr+ev9?r7M_-8)#{zj#SxXf_mZ8+1EF`p^>BV=Q>@0iF2@KwQUxP zPDVz?pHOUVx_9uL6qbkU z>grzd=K1mBqV{B?hQH&33M*Kv;djz?yFt@(YbPhNjtJ^pn_5tI24BYzipeGMJf&o) zv0wT3h`;q_cTxUnY1-lX&*bC=0z07v(BcRzMjk8$hu$;X$ipnyUwu`9?M6KJ)6=9+%ENVC7j^ju|7?R1Y$G^SnECygt>a#T zbh$bn{bfK9oF2#a?nevpRURii8JU?#0IWSfUR5hG!1nd?i;9cG2$ArGEUPzF>*9QI zb}+lP_6C7*U`qUZY_T#E^&XVqkNo85lt`wZNX_){$J=(W#->hwH`nCRe!YXWbmm$8W%q;dK z0mvMDZEV-;yE&Lk)|)0Wo&CKK!fg|5TSS&@JlKzZYcNq2%rxJSL%aSBnB%G-4_HEq zY^)P)12m>R8$IdS#lymC3?X5*_l#qInW4-iBt(tcnvan;?F$JDy9#+N%kFiZIsl*J zgU!Of2@uEkr;~WC0;8gc`0bZb0GZu)zA=~gCU`2u-O*5;OYrdUC?DVSoE|bZa@||C zf<}O9yCozb_)BIsIZb;6efU5JPCIxs0jX;?Mqc>eFWFucAgQ18!GpZvrSIL{awk?E zB9Vag`7a12&xFD2+K@=RGzKtbb+~ZYrEfA{cwy5rS9sHlA>)MWUbN6DSCnlvRegPZ zXJ@CVmKIHKia<~Ytrr#eNIOTvsqe4P@@DZ?TwGj_OiXU$(+CCwPhenT!T@LB*Khr( z#A0r4{x&fYJ3y>|t;6njE4F5XC-rCfwDv|HbS~=|QCw>NYp5cK+_3*20Egecd$%33 z-k-dsg?R0Dm>qP;hIDpHg9C!f{Q4Ku?%F8H$^LqaahgY`}p}Y7ZS}6T%8IBhQzHOyw8DHe zLx>q3Kqxko;xv_`SpT9>3-YC0%3is}I4OYp`#{XL+sL$a09WzZ&Ug9=`WyWPBVc&= z@W$-ytXjG0buEv*LAN*pAU457jGXR=)@2ssswY+TX@%|XG#7XI_{br}=Ghbw&Y%;lYRz-M3$AQ)J%MvY4VGLhG6g~24-eV)>xcruL~gtMn*Ig;Ne!7L=j*#s3{={ z<7GT$aY;!t;K!|AflZx_iE4zxA)f(bKyaLP!~XiXK9~eDYggB=y>HgVgYaho*GmE+ zs;#RdA|ymrYvQ9gd3f64dv9UY&COzR37lxKc#tD5tFT@Nie3bONiI#eZZu*Pv@3uf z?4%r8Z@~1h=-)<1`?iIVt=2B(;!*P80@Z1O6b;$YW~LGC6et7=6)O|)Ld)d}I0C@+ zN7mMy^R_PGGy|9{TwFxO#l`$0doNX&HkUr}z{?pz4wuW0!Mpf){nNv3Jk!ko9=Ij^ zgs_?ltLX@Un%Bt4^uI;l>g?{myfri9;lPB&=>*HjrL;2_m zH`3MWNZu)^(CnYDxch3Hg|V-gi{09!N$kO=e&2Xxhs}U_w{S&pWEJUg3Q0YKW^31 z*@<;_yeAHwP?=gB9^upiq?iOW5}KM+mo8nJfy@A>qz@_Q@K0_b3Z?w{S=;(}rLMld zAE1C`_MHvLLMZ}H%@Y$;a10|2ULsRo7al0lgN@1A#Wn8n!WD8xyrzEq*r$+-6S0!{^vy1ReU-1d@HPfn_HzF+02_5S@^ zuXcaT%mJUdYTB%Db4hl3r@W5&%lBtsr+_igAv0qrD=Vw1tN#Z5VvHv!Fi`K}{LI?g zTGZTp&ExyUWZl$-gajV_lV{I}rlxxALY}27&%Q2a(V)G&ID?%PR%qfReH@5*5I=8zCo%4pN&9m~w+lLs&sW-MV#4T22l! zj!$K!Q(gPZ$@TVd6~WG7NvQ4Ixq}Cg$u*LryQ|B$y80m;I%V1BA9_@I9TNmeaEkty zcBSgzk+ybr5dHc;obg-_5c4@bb>|Zh7#?Br2jAt_eD%ug>>dY%Y^9t$qKQFM?w!AX z9X32Om2%!jMWKgm-)pUB=;agu{kW3bU4)Jgc({c&`7}k!Co(3Ch zDzxP(Neu$Pe=nhmJZJSx zUP48iSIIKt!-s4a@p+LRKl~_(0cVI&fJ7P*xePMk+_+VP$H-H-Pm!id%|LtHO2LrP z4vD52k#h7}vEcr}Z(ZJ?;AQQ(G&`ZN;B3;0iVA)w7SI6~n^ON*ZdfqXahp2sFZvrk z9gL7tk~MU4_FMg@VxGOq6q~RAxQ_h(=Vi>w{~<3bWr`VGrQG~v+L8Ih!kdy;iPn(~ zxw-LPQ-8B-IGZr>y;r89fY-p4&hOTY3yUq57@$Hb#<*qEmlUpcO0J(OF45Wel>gk( z<@F0*j?&dL#Ze}i3!21baJ~G1RpJ?e^XHtgNB`7YI?dnzZkPPuE`|JW2&MmzS5i0t z_y1QXrVWv3{?7%JVEwE2{GmX(<=@wHZ+tQZM6zGO zJp-bC^r3m7s2jX?TptI=`Kta3`V*F)Q%$(gh^yCyze%coTIYt`k}<`2Iz@8SCQ!pE zVt(r3MuCjRF*O<>@0p;wx_?KbLKF)P#mUY6I9E0Q$Cu}92?+@g9Ae4~wCZqxHA`nH z0STgokNFoCZlaIVA`cdM9&;eExD*S`Pc538Wwt+^o2GRpJJ$ZP0QQc`(#L4LBYGKs>-#z4V>R>DDM#j`qk&DU`ET+ zYqa+T#((@Eyl>Pk3h51CGuiqaz}*C1D;l8moQ`X1Kn{sfpl>(PL?|abkz&Hd6@mv6sVr*!^A1e6ZZ!=I zT!Z*h<*-Wn^VcsfkdoIOAw2%JA?FPc-nl@`wO<{=gH#3R=?co^!F&D#=J@a1 z-8fZDV}I{N|1UGQ)BeK@1nJNi)SVL1Nm{DHnCX8|w(s6)Vv0wfq7fi2Jc`4fs* zH*4(F!4c$2sUUpntx@ANG!z^rm*d*Vi7*F1*QTZ>Bqk!rZAimPce>sKl8n_Z*FUQy z;XZ18-&^;mq2Tvf*VI>st8jx00d^2wx4ZB6i2~08h=TG4u0#)8fFQL;kI*0)fwq?W z>XQ^x3}RuAA3wg$!r~JfdmXY$`5cWEJYo)Z*6iIW#?VBrkMw733~tM9zeYlf)eY}vT9JkWw!e_l`?_vCAI zMA+x(?X%fxX#F#bK3iN^c*GRb1ju!1`_Ib>NZDf@kQ{aO^e!nY|8gDHe)%#4q$_^r z8Sp@&Gs+3+>X4n1l1~ItgZL1a;6@TeIg3@L!kRJU1O1r`K0*I7(ebo0HNyp$Qyx8H zT2h$*z4@0_o8kN4Vw%2zN$Y>ZFV};2_x|6jX&RXuDRmEZUn-aT{mVc7zw#Hk{~Z0d z99PHvg}I~{I}Um4JaL5N|9Y$N|91j0iz7^gV#M3Ggis`rU)qN1lm6(vDX%0XfTVqT zDfUq^6Agt>mny*cc5DACk~AMACj~ULl|RWfK{gKuCutcNP%+j3QjUoExi1Qv!Ha<` zwdqF+1%em`5*yByD_1~cx|Ztv8@sByS{IOUQE6#Q&1U^oD6=6IlF6?QeAY84)J*xX zR*N?p`uo3I|CY-A-a&5uZ=VPO7!A92eQkRM==A!>yDKA=R)HUII#iUKk0Mt+ouQ_rsHz$Wym7svgT@UP>UJjm8CT?fs_x17GXz3Br|BXVf$)&<;59KAU0Ea) zV$uO8Tie@9NJ|G#IRK+0gS`gPTO<&l8i$gS5-NTQ_RSKrvS&nrb2Us+Ny)cMX2Eaj77X0q5GrSM zxjNtqd;Yx1>tTHD&Xe>id1p})t-Nb>Mu_44@VCBLyN$i&l411JRqZlEZkYQey>fpZzP zgh_srwlkqqAn|2qPY)dPIYEXivJ+o}@Ym0xQeyqO^VTpcBAE!HpzO81jcqbrZ=w9+ z-)`>>r2B~!XjWs;x1#4Xd=ob?{qywj*p=6z965`R%-Y&kA3uE(diym=P=b^+wz0dr zEGPFCGPqD;Qes9?_Oj2wGW-`^uJ^l#b!=j~*I(~6)$I2}`uiSF*a>i43^v!8x^>B_*y$_lcd)?CNvX!WDL z6cI0)7X_OA=fbYLCV&yL6)o7=*jgZ|r1zUpJcmm2d8ODa}2Hp+>+u%ZmFFeAJuppL-0vK=67oCQK+ zMku1*0@c@fDaFb82wEr5kNYUga8$lloa-|)Tjx-sKEEMRgW?ry)cdy|Dpy+rkC$jH&E&rfL z6NN;IRO7CK1_e><)8zT@Fpkh$vT-I}n?JL{M(W%uZ?mzHpju%EKTeWfzkUm4;>B_I zE-7fqq`(RFAXFpe7$_uwPI4Iql}Q$V!ru^)$zb#NJGel5+rEGs|L$@J=N;QG_JwX@ z5lhIhgod&%C=K-d>Z*sz$ zLuw?&62WgD>qRFTlyq+r5ZGm5--}Kxt4)iPq8U#9D>S{iMAeg0Y1ey@Y*l~s$zKY( zZX{Z5Lc5G^+3ct!FKo?bk_Kt@PL&!HKpE;z5j#}2y#Yn3$CtnU)jmc;cl$OLM`2Qf z%rQ z$Np&25aOY>0(K_B>@wx1gD9vFrJD|ZK@G|Ng3@k>4(GL+!rb_e(D@LSd~^nNBc(zu zA;8O+jR04VpaCLuEf=2kz~qNFp#AG=TFIPj$cQy;e_wZ|rl#(0OeWh(I_BX639ZfkhoA@Fg2V;rdTwRq z2}rh(#p^9~R)1z)h4LcP&6^*8EG&a?u2gFD6!cGQ0)o#_%O7%p;wv$1mrA~REGCV! zHxx>mz81*DvX+?+h61X9tR^1A^z?AMgZ2jSj_Yiyt-pT7AfmL99SapU%pj_P_cQcD zXaG8s&2OO<4Om9dHCrw@mrmjF6+fE9(k zg8xM!xHDyj<2r+E3*i6W-)&(J9oNXgiFu(Ky|7WUd3Uu039^=Km9K*Bot%szau~h> z92DGX@%>%w^ZnA&$ME+2W?Ro-{;v4Pnwlgd&Mo>O2Al>U7n{Y`%L+*x$N%jxxEJeKiI}1uV`jfZwe4e({!bregd_rovU|5j zVzMUlVaVW-W#_dgVrBzHveQ{K3@Iro+1iEpm;}@;>jlUpJ|<+~(=1M59L&rcq@Azd z6R5FWpksahrL)NoCmI<%g4AJ)6R8Z{&W@gJFB-RF$W_5_{`M^-IL%QZSCw3NO6&0G zXv{G1Ewa9pZgU=eP6M3>@A+ulqTMJb^oLQ{j-DgV3m;@I!>B92wv&b8y_??pj3(>% z(IYe1-~;gshEOU<7Fi#ws2IPsW;S{j&JDdE{sE&)fzQB3h*&6H^~3)yM~+_U-)?*& z1WAa2fk!#`8uEc87Ku>g{hn(K$e^u8I8n&kdiMjQk++Kz#XkNoeVvMi0Vz$j>DlZS zAp%^mBnOt7zf^?glEk5iq_h zaU7aeZ(slV6zi-B&yNy_%4Ng|iHI-)y6p}vF$1|TA|b&cO;&bCJBGkUWDOC0H99fz z30z{pVQ(0_0BkG^pcwn=Rkqk|WYHT2_}EdSqoXM3kD8gEmw@1d}?6rFR+B_Ev*?+Yo+sS_nkIe;ze>o*hEl3U(uNnmfX?pboWIf3h(L&p~h0 z;oLf2EhPJruHE1X4Ns{cZd~HvD7>_)r>~#LZAJ>1_!b?VcNC-4&srBd*qM=PJLcD~ zUqb~wM%d$+keC>0h!YRMxt_ph!@zAiKnGg{@uCDu4JgSs14#E;(HsfMIrb;`Jr7POvxAG zVhOAf^8Zy)85tZXm()T_4lX&TH>fj#G(xUW3EE;XbKa<4x~*L=2;iHe4C)?sxHN(Z zP#fEUCIJNBqUk)KI0EMByk0)62G^A!z1LQ2{Wu^R0VlBBeZ3{odFfYt<% zC4Hfcrz8}JScTX1PkHPe{?cS*WYCV&_vLx+@<0v=s6OeyqLYQ(NWEufbkr-%Lz0px zVHGn_E=K_s2|z=~P^fctfXUIg9&GdgRL?(yzv6%VPymGm>f9aB7bGv=$6#jd;9v+X zV@P2gq^9)7ufUoiUN;?X&v8+N-@JKKZJ66?Dj6cIn7H`%&Q1nk35aq(i*&^yNu!{P zfDy`w&{0Q3Nhupn!417nFLG$a5mRiy;eEl|(c4>~R?GkmJ~|-is1$0YKnu||)44Ux zqMMLhR?~z81v$xaD+N6j6bK=J|E@cjVq{`!|LP6|>+R#rb|1HD>}z29(XD%DOI-2hs8IFEWG?mp|`%mLlx;&BVSt zu`?ISl-UaDzCGjDdEZU48%zZw8S#X}Dxg;of?sEf*k&&&tp9%whWORY_e4a}-n@~+ zy>TO<=V1gn5=7@CW;Zqh(+WB2>xBbSt1UPj38IRbpV`cc5!29Y93CIfC^mmXkO_m* z+orcoNB&pm=NAc8a)=@Bl$|6vUX22ff4YAnEasd0^UDJIK7}MQV7BX!4J`g?z7h)k!c z1LNaA3wZqUlA|HH59F!aa)tu&zj?X{jV_BbD<}^SHhRuBE1x@M^XsV@P+r)#=Wr@VO zqobo+f23f{`DZgl_oGnI&F~4jGKczldn@B~p$S12L}L(HFlU-DX+J`{?5!_%xVdAs z>RfeslB}xl!i=K?0>s4)0NBB^SZycYbDJTZpGKvLfHV6mt+Y}2)cmc`9Pk<_24KI> zPhyzNr|YSq+Ak<1bVJDX!QH!efw!T(O-lNXU>fkQ?3blXNGr&+=gA#VdeA_2^96Vt z^Y*PMK%*NEZEv!$upnxmH{d2N=Pez?`%O(*p>jD74GIH=+G)^hvb<9R`+%srjg^h!g z0iQxa-<&`6^`MYuWXPf7&?*XTzKHuFHF|FV>d+4&4^(Akw3HdaZogYYoZZ|=C@645 zp;32hZ?8><^GB79zLJs>Qj)cCaL58?b(5J{VCOA@3{SaJ1YO3I-d9+TYngy&mY_%* ze=jW=pTV95Kynzrq=pEcW+x!us-a|!j6NAca*hMw|MHDwro$OT2zFq#6?=Bh&Q-`; zq?!FDXzZY;7Z;2J$NE2rdlPW1+rC@)qCurnsU)H_nhTMPl_o@}3>k`qgbWEb~~#C}XC~bLJ`Y^sTe|zTbTu`+1-5{l2~T@$Tn1?&G=d;=2CBIjrAW>$lDo zu?~XU*1jTG72X&VVkG4PRk77IU)#maEt#@4p&o#h>y?}MY>^_iYU;TPtl1^lRF%H$ zCTvOjk(0U!FOOJrl$uSCD7c>B)f=u)aE7+IRb?v^6Rjl5#i$Y>Rvja{4VyPVgt6}2 zoCGYx6jY#zJn*ylO_V_}4uZQCa~qz<<7Q@jjEpC<*MMq%GCgf&$W5uJsJIZV?gQ3+ zGAxmdLDE<7ng7QQE)Gs;VmJvHN%KYz;HQ7Qw>80uG8nB>>+Am-0T3)wtb#@&Vr< zuYk^sO*{v-75C?qwBpR!vq8t5*3^`3b#=mXr{A{iad>zS_aG@$&Zx4V733_AsM0&g z_)OPPzB4h}f4MoogM-6K9@fJ*HoLgEz~ub^-e!LABN$AV-hO}9>}hUvcR6S>wj)PU z>MY3YXk5LhxGP?OKryhFuYop9r<(30z=Ao1eK(#*hAdx6W(`hffF4$^XI81v#cw@s ztdX|YJ|`(TQ#tepwi~-=#;Zm+7y0=y^YQV?{IlGCesRoLE?Q%jXJSKdPmk;8^S>`& zA&YFD>DotYu}lw=HM(fcJ*wBTVgFGM6&JG|9O-tG%h-Z#;lX_lcXtDHbA^6NCwri~ zHoTGr`T`p_U#Q?&Xy|%&_}TWF{gZj@Pfz)~lZwGqAh@E)#UtFn%0w*v+12D)7QyuF z)e1Cp^b8CpF}ujOcgo8Jil6xLdAC5iL}PS^=d2;!(m>wVsy+KO^O~C0Nl0h`v<(On zR<6kZ0QT<(yOt#gJAb&yVP2~-Sz@`~cJOLc`VBK>l>?8SKIIhgHcFa$LAKL7n;j)2 zuxYmU_dkGH`9#6(A|^v@?juv4qa>gDn*~=6dRj1&D|TdGPwSqVno6o|Isc;-XeLOz z-TMWVgKLF;M(E>_}yI>mzBLj~*TAop?fr(w)SdV17J^O8W^gq6HyZq9jr7_3om zbEXL7iv%9S`uM%rfR^tR6nuq8L)@33NVZ`&hH|qXTQrD1k2i0Mfwrx&Hd$k*ivZ3? zp@#5CU;O2=@^E=p&{(RJr>Ax=Eet!VqW=eSNY8hnmJqyJc=&u!!&U+(Q%^)`q`!in zWdxQW>JgMq6$yIss0Sf4uchGaVW;MUdld_|)(6KxGEUYD(=+ba@m*}HQD@x?$5+0- zGV1Dn6WH1I!8dvrmRz@uyH63Xs?G0T_uy~h%^0DE9wUK$JPZJ79=0qp#182c#6n!g z6%J=FiBkYH!0wD;G>zg)#?TLgeVz$Y(^CYAriL^@HC1m!W32d zm7>0dl~vx@m&i4wzD+vXLDi5V2loeBR^A2wTbbtN6kH|&*>-qxVfuEPGO zUl+RzmlzH%0o%4>vatq~YT9SLU0oKrHios)P#TtF`7YEKP+P{EBe6J22WJ?meIcgr z;p2M=yAQUfFDPvpG3PMAe?+QQ*=XqiQ5{P8ojD}DM+yWpgs*L&M`^jTZ30`K$p(n}U_`w1^vnbP z!(^8a5-cq(MOCUMVQXbYQ7*mJ{5Zk9BE99^Nm|(SH1%hyZO}o0?STTD#_T#hW35bC z<2V%pAOJ+3Za@44U_))$H3g)JoRN`9zdCrbw<4GZ0Cqnn8>T^ds0@Se9NARa*E>Hv zgZc@6Ge+Rt)3UN_Z*`3gWiKt5h%fwB0+2j==1eR4YE-zkVzHuA_qjcWRl*cLi-R}o z4yIWS-e_vBulK>z;@V0}Cptobska9tF?to^Zucr~KYZhwn3CQ{sDDqj92dNB!Ef-h zShyZPeHsG$Djfdz{zs8|;aB_}aHze#y`7z%WV{2HJ@EGSo_I;>Xntur59Y^)ybc1QriTd^D zD>)4f>E&ZUjo+>lK;!gNE1e4@4qglFkIFX^A^Tqy*iQS*NYM9dX(>;v9ad2A`21#_ zXW-Ri*UGZHC)17M3x;R<4I9pPs=$&1B67l&HL@23*B(cwA_pCJ;iGpU^4;SwC<$mhOVcHp! ze9lxo$^;*EvpK`(PP28-t62=%jqK5U!t~bZ((>~Aap7;@zU5<-z?3a7FYgzZCi;Fz zNbzsk&cP1?yumF`KGK~aHF2Df^WQb7G3%WlK1IMs?WK7h0meIb?_QRmI_wAh!M4h1mUmbhZ{yDQtfp%P7=u*Q`se*j}pi5D)@jS?3l?svl@nOp;b@dF5*)06_Y}Z<> zoW*Ht@hsf=+BybL&UTep_Rb}(cZXUvJu~|^X3<4QEW?9cxjgnQHM=TrmR9K45m5KM zYiP(gxkp=MV55Y=S4J-1DcZvIc^+DM>jFyU_6JaB~NG4^L`A! zCY84m+-s_^bw;_-*26b0zB{g)&DL;X{py_=x<-?WHh#4M^G|Oot!M02UAvcWJzWJFS!RHvnOak1GqG552p zdsj5Ky|xy1)p6YHXS~=$nUPFCYL{~BOhoNVFE1xIH~FAI@bis|j-b9eirjbClo3N4 z+P2sgo}CJI$H;$)R+x7VYf3N;N8YA{C!!KV(tmoEzxv;o8-@~ngL+pH#a#~~5 zLjjYVCa9JLj2r7_>+5G~#(rb}go`-LVS&>mk8o%a(8pYE$ecSDid7E!#N}v$_4730 zH)UpJV{piLmWveD=~^Z8-ldurgek8S4TUS`J2fMOziFN|3)0fo@90}hV@0!8o3!_{f? z1X}7Aw1uaxd^V8xU`I^GqjEp5k_s2$@x77ACKjif*+vKg6y+$8Q5wV)SQ407?qWk!RVYa zGmCF>^C0`L0<*)u%BEZ|16msXzIy9{M!O$r^Ed836*GG-!_N4ruP!Irf;?u4?4|FU zP0HU=NuZ?ydU+?jCgi&*ctQ_A35^smnNZGyXd!l)jEv}v)p`gYUrs|)g&m1{!B=)) zn0#RA%e^v@dVIdP0*n+Y{U7f)f_3S_V}%gcJ}~eN21Fk|-8CRu+oO`3Ni#4EK8Mid zgk6_N2NX!|SKuzY*_h%EW}zm!@XykAU_G7t`6FjEZC8#>hzIhIWd>NrT!qgY59U)& zd|jOi<*4O=zD5n8o}uksKqJGu8SW5WsLPX#F89ZS2UA_LLqi}y_oJ8?UNm5W%<*tn z_)Xsx{O%o0{K+-c8+PnChs|mW5rslzkL;1Mnc3`M_^o-_kj?A7A%yxaSkv&u|Y%!;2PZ^Fa( zqg9rm(QRv2!T@NEcCQGn>@17Pi9l3arlalo$Em8Y)b0VFU3nL=BSVfcg6__B`Gk*WQvx zeD;kuwBMCpWp7V(hSK)KVDp#Xx+g|yW0x3{`o)g+5ZMEj8>xsTzij1DlX z-xa540K!pl9f&oCvO-WAxDkj>R^SGr`ZaBO_X^&ulf?5}y>8v!g9pq1haCLZd#U zp#aml`uWJ~k@na8#)Ug(6HJdHsxZ^_gw)8AKj@Yo|624lJ+uv*oI_UDwzWQg3Cd@D z4sPQ^CvKulOES6`d3)TxUgP-d(~2Kf=)Y4>eHX~4q=>&;8>Qgi5x2kO?`_jmbaGG7 z;Tv_K!`N+)iijv=YwlRja#XSA57B+(!jI3njSa0VetrX0OGZ1`s5q3@zf%l-!YulJ zCjkI=9=(6yjGbZAv148Xf(1K9{faoe9uUT;J$wgt>qlvA-(*B^5WMq^A9?78_v``CMrT zzixlszcErh)}!hW!xMF_1UX%s^)@fUA0;Ogj*yGh)&o!FZMW%jfR^@5YyYuE3;Alc z20u~D0O2K7=X`4UY^#Nxj0~jJRRq%8Lno(-cwHG(fYRxm*-zo$fLbGGWi`F7VPUL< z7fUR<)?IxktBe`Lr}PJW$T%{3=#qWvc$yJm6%)$DWl*qyfguh`(S_eten(8-eUjnX0?N1z%Q}Yw ztBB>m6|5{mM#&camq-B@DP9&RQ3l#qEiwtq6|gluihs=DX)Hb{0NpH9v9`n!sO#RK z6%ptny2HHf5!Kj-^q~lwrjjO*kMkqBbWeAPygJQlznSvjGwBjJQT;(^IGrmbG}IJZ zNjy)mRIxX2860El)P-s1u{Q9*pav&KNeUl6c;@4bj9g@@O#!EnP;J_`vNAUYExU~- zCMIw-Ga{n|-%&Gx`lube3hMSPc0}<-vzGnr?;sSn#G#c?uO2x;fh^GqH9j1Fhz-pd zI7+QnqsakG1CglV+Tw!|9LRPXJ`~j{Me5Y4F--8PGz&vbtF{&3v?A@%@|A#M5xD_p zK}?|uay#5N$+t6%FZ5r8pC)Oj9}Nf^t#w;ZA3sh_>hoQ@f^x=^n{8atpAe5S8%jt1 zQ$~KGCZp4!6H*LM`Q)j>-8?+cmk>DtC#MS@_ZxJND(Z=2Ph0#lu$?VAS~%xb^&IUy zVq06o8ZJW21%tq6(RV@9ZuBI2d{0PAKe4a}>c%}nmM=*gz?R?#zu#TdN?_GaqhokD zYmNt`^&!$u2yd!FTupdL2x+T?zN`wOZE3bPn{)!uZsj@nPIES^kVj05^WT*M2tG)s>IpH!_fB-S#|;&^&BcCTR|+Oeq;-#hhsO zI3Ij!-AerB{S~wr7jG@*=)|Wfpmr$u{d*AqiE4KRyEsaCfArB&NTUED05QeiU;MZg z978xJHvC!jY4+&$jhh@)%a5`csEZ?F+`%h36!H0y6M(h`QQ1c@s=fmElJSQclkihu zm0m!9qAEv=Ao}zTn*t%$JtOo4KtjuJD>S*bc6XnGD2Ga38{k)vl@?RRlsWxTQA^dL zZAn8~O3DaC_)+}h?(hE{K|^@%M*%&!9u8-cAFiYqct0>2gRNW(bLl}Q}+=? zEnt&7fr)k<=1t7h%O}27&oM8fre4#;pyG*q5eD!_{XS(9hJPX4P@vrWW@ke~qv{V^ za=5E)EVN3zIQ6Ph@brlj@5RiL^3#4t{#9@?h`Zv0pU5d|w;eVPR)G+fYZ z$IFBSd}Qs==7S!WmwtZVPz1>UkAUZ!KUXU;lCuoUB}qL6jeP`eK&XyEm?dx~Y*tOc zMv4v*LhL?$x)uyeA^yQk%7Il20yMHF4(Es?m+59h(le-&9*}?uTZ$?EWWW})F;Xi# z0AWq&#)rXL6dW$EWZaFzKC;Bc9$W#BjC7FBRaZicAyH%uXpS^$Z#^=Xg8T;3>O?LH z{x}IVV#1nBlhQVd?vf5TFW6wt#En8XehjhF!i@-yo|%dg^s3l94@LEoD1v^xhshu8bA@Us7!xo= zBBh9Hvp$|Szypx~R+TKo>_D!_#hXO<%olxut@`E(6UwSwTOo=-5a+J(RRe*EA74>A zf=(q5KxY)xrg!e}etP!#%1&P1;V``w<6~oIQ2c|hTrp(wDfH5V&v#MBLvIvn@@BFg z|1K19Awu!qSvhPBt*8mfqb8XRs99l-USnh%+<~sx(!38S1!i zETU~NR;Bg(BCYZC(7^tc;#O6Z)###Dy0(pqs2_au8YNX#ue65EQ-`0!z;NNih2FG&S0%%I2W&uABImjj8q;nSKl2e*WC}95zRzzmX%o(xq2_y9^7ySD*Xar`XZg_wH}8 z?cYJiy*4`E6PSFx(GQFNwM){n)@!^Ql-bNCb2J4{>+!r;uNk4;AJ_d?=0|A(k;{ZM zbeK2hZQ-svrvCdR2uSJBvUxk&Ad3f9X5|vU=C4&L_9{uOA!yj0&%95CjlV@L_pPHv zh^lXz)tpW1g)htoad!{x_H9W%%|9M>_(!VH!&uu7o^qerwEyUay4SU?aZQO?F&L!_ zvK=hSzECDLJ8c~+F}8e;O$Vj+faDa+m}h(rUB6Dh>C#3M)-pxf7nIUcIjcFVP51+y z>y{A{oNPu;oE*5^DHq;Cye$7}*6fb0ukRjEZ74ZEzq-ksU0KP?7@-;-A6!gtnv#)Wcj;Tp=d2xZ*L1r!*N5pA+RU5ZVtQE`o^WgO zlBUf^ks%hF_xBqa9qO$fbAO!jaQLdyIs2h{*|v$#9x7wp-yCeY?H`FtRrlRnAFbF~ z+V#R@w`=|v6A9Mb!ZLcdemg1~8*7ziodG)vzm|O8&nx7nHt}GG!n?=0_9HR6%o2W* zgR>V$b3c~b2;EUm`+eh7<;?9zmi}MsJ-+%Kc~x}U)tTc=vC(kh@Fd^dQdYQidfJ5# z?ONA-3+IyaUYfLhry8%%YTIyGdFgXczgFmtbt}$pJbkN3NI}hPWtc4g(y!aY>l!qe zc2e<#UO)0qbfYuBUQhgDLyJ#(+r>U-XU*iMM5;}#zvF1HZI8b-HDYlgf=ySuTG{HFk(v2eB-N&!U0-xd3&T02o*a36V#wtiUsvnx@0_c~%*Ipa!%OHL*T2~E zVVb^qY)IS99lQcWS()%wZ3GE*VCOOa_1erf#g3ic{1T5`>C)Vm#)RErlD-l&Ma8?i zW^OKgTz=t`m}J&O&E-$VO>YoZ#+1YaMj!cr9A+B$sINuk5(9aMc=m;K-2QI9JJ>OWOC35r<>N=UTuOf;VXx+W<#*{h6rXCHrQ!>@ zzQT77ay2H~eQX-U9@`jeq&m;y()i7-Wl*e(ceUN49vVyrazM zVL$^NF~MzseqMbLoq&&Uo-XbL(GQ)IqMVh166-5I8jBkn^l?4#1i-!g*dIU)oxr^i z5tL{__+G5FPNaz$9N|9M*OD+Cmq{#%;$~L>Ie=??fU4p=OebU;v$8sZKeU4k3|7$@ zJz`Kp{s_WK;p-`I&XNru7A?<_U&SpI&01~=?XG7i;=c3CBF?U~G#0zWLA8n8>ZhCa zFQI0SleYmYnYy|kT`;N6ia~YD zL&M^0e!cZD(opR1+t?Dv5JVXZE*jw^-%!x~f=ET&q16|sBulhBa?7NeFUD|q-7le1 zE|o4|IeVa*vKl_&dSqST$Fz}=bM4x-5oq_7pA3}XkShQ*C2TGm9s`g7(XW6(3A(Zd zP@AdEUOWk@3xzRpEdewqKnHvyXjBYQlQ@Nd$H{v^o$TT5U5KlFubFuiPf-UD12y0y zG)27p3yYmXOA7isLLdR-w27Z;Xxou7KwalDsk)dov~+rh=C<1WS?ig`9idxyV!xgS z+ho=5vY#{*2@4C)19{d=km8O=?J$Cc+!=1pD=46T;pLUTw9vA22ns0lIXQ54GO^BV z$)ydo4>0bN<@PmXa;N>E-lLw%&Aw~bJzN9nRo)1*D~99Df98!h}fw;my#x#`S;IzfnA=g5^CM6_lrL*VG?LBhjHIiGF5hpKR0ukon zwnTxBY+R$oO3N{u*+?Z6>?6Uj;or?u|>9-X*S-#D23V;EnKuL_2h1Jz_XG;;(BtROvNb!cHC zA)2+d-Y783G2$o=OAB{UUK!Lz?|_y|%=3F2j=68ruNYzxpSL`7FMN~wx)8u)E10nRATor=rQ>i(P1t_h6cJ0 zjICRw2EM}QcaueMv1h0CAY%~`)e8NTi#rxfgpdtIl%KP*ve)pqZ}(Q_r!~XEKpNQO zZry4tq}6DsMce~R#%wkPQ~0Eu6j>gLk^n}=4m`Q&Os7Xp$#%1zG(n;vm=*u(VwSi) z^lDZe><)y$3}mWh%=UdGs~q}`;JE}hiWa?(IgSa+jL%NtoyvTYU<>X2`RCd$YAqH& z3bi#(ZGlNY)@oFn#c|#gGWeSLB?ovtCq#m-<~~A-)w{X{O|gnwUI_{OQ17rHkaP;@ z_-Fzn2eg-8`Ox3n zTkG0f<)-c1rLn+lgR2Gxox+wDl-e6m{=p8|g9@fC$eHB}{tzTcb1W~qkRTMmC|V;< z3@|XHAhd$0%CNFz7a0YjD~yzscptqrQNCi97Z<;XW&g0)P7PjQ1tAW%U)Rs6&2|GL=CcKrlQ8 z4l=brIvvKCHVb*p$DW6s8>4I|-1m&`_Za!jFLx7W{rbK6Z|k6E z-*wQvaS!?knn6^rScAYI0mx)h((jXPMgM>fxCk_twsl!_1@*uhM6Q&KT2$`pQ>-W0 zCdXQHCmuK2d6xe?wt{8jooZetI=I)!pU|*IE4PorwN89Jn2GPOh-9E`B?BcoJe|v6 zO~4=`Dl}N8O7lY#r_Un!z%?!tSV#E;ijnc}Zz+vHu4XCK(VXZM-V-ldYB6xp^TmVR3 z91cA>urwicuct+W^N7HUaIG6MfkAZjQO{u(g&qp4D{J{pf$d*QN)jAKT|ARat{dgQ zc0ZTx&05ef?5NjhZa(&!&qnxi?YzRT)Gx|2G*;uc+zK)dB??6wpKN?}wW!;-{_^PL z#M>55x)w$Iy$d_QLm+(V8H^hJD@!FxzJA>W`W&4pm$xhBHUHgr(YV`znq#IS{)GMM zb$3d@M4KqtB1?&yYSV$Sl4&(Wc<6zLC+&}T%f5!54JSfBbiK|T%a7+-CM1;HzbG`< zlfc9FyuGjcOA4bsqfoGkPmMxl3)xms5D)gQfzNr(i?QUl&hlROU|gvJ#)8`@#8v}d z1#fS?Y?s}C6-UdJR^ol8E-lWv+J9AtWuR-Y<8!Lg*KPa>MPovt$HjmeQ?vGcA&gku)8mwThvwrzG zc*0Lk^8$S_FX}{^}t`Pc}9fp`rFC+%-Pxb?^;>z??M^g zp+5y78(Y#02IJqdj35{(<-c_seeFLjfQ_5}Cp+x7YK3K?d-Y;(HuExzY>>~&SJcl; z@Ss23e<^HzT;c*$?bRw7(V?v&Wx1Uu`BjV`tbWu-5dJ1)J_L zblJLi8;M@;rzfMQCdNZ@JI?9PsqCgv-p59f!{V0&Mdqi)i$*`u00Vxf?TH);S@+8< z8bZ|%ZeXx=-z!qkI@B9$$Emn)pWF1S4rluJ8rgjo4X+c-XS$qo?M6FReHn^q&*_sY zt|3Ln#CkRYec=D6LG{;bes_iJ!1l)8&98=- zZL5-&-XDFkkgjdeJQ=X*na`_Nj{uxOe4u+Ij|JsQ#YAE7cvkv%ki@L!P2p%+M|uJP0IX&3A6qFcul%FyQZY}?G5P|u=976UUW%F zpf~vHlPn;Iy#?F}31LJ24PnJcfGf2Hw%W6IUP9QL7hHLY{qjSy-n_cnrN#MQXS%cR z^YE00>}4`G@Pi4h9JQNTvhg|81J*FJBECG*!X9o#Fhwb$Stkd2wT~Z_%b#w(Woeq# zHT)F5*Yer93j7jwpTc{~XpAFbDu3fEA*fPGCL1@Mk&{cBdp&FHaoP0pxk%zHAf!Fy zDzvirqo4f+7;H4-${0O`RPOGf^n1aO&G9e*FfxZp1obGmNu`gMxF6B6A}4k&1r2iW zy`((-xS5>^BX%t#-$RhHM7)LsXWiwcTs*(j!F}=@Q>>7EvP%>iA(G`EKXr4{gQI}t z)Do`-wqx`f=RlqMj$}sSG1OX`WkCA`qfVh_Y9z~+E%~VIh@JzF=6)o-rI@kLBlD7U zVUVYa=v8W>k5B?^hlF7_KX>WUR`i#~CpF+X)DL77tphG3BtGdk0Qdc?Dx6Nseqsv+ z`cgZ-kwWaUXb-P|t9KF9+e?4{b#PzOL}u@g$(rQ|mtT^wy~DytPw?Zm^rxf!d@(OWp^pe(f`z`S|N&vsafdIZmaL;(W=?2h`sG;{~9j1I>H_=_QsLcrUO9?LB;WBGFN~ zJ@9nUd2(_qLh(rOR%=D@>5~C5ZmbfdjTR5)AWYtaCw-(twUPdam}oqx0zi&bn+c8= z{C(Nz`yjq?KnE(2qwwtSz@m%e173$Wi}K!SfseE>Ki>%@@CGz}!X4a;U{i#J(Hw|x z1mq;33QejNhyjI0M$#9okW28L#I*yQS%B&m zlrc4N?bJ0i=xA$?6=d;`4oROmBN?h_+F!#>P6BxL?40{x`l;Zncp1dw1k_3b2>{tJ z4|ekNd!W)Q4>?N@Z-{<#hA`+KYO}sC$SWW%TJU0$i_iryL_r@9MHvBA_yw*{eyMZD zh^0l|1q5Ytq=aV8bTh%rRRGb9@+49Z#nx^#TM!0BJ^<5^4h;b_vx2*x_ zUhPl0aHQ7=k|1CxW{EXNxfay?l z?V*xcfiok3zfYr3A;}Dgz@InMrQrb3^*N3Z{5l%Dte5Ch|(+ zDaYPWS62>aHlo$uUry$Ma~pA673heC6~~q9PBhpnZEfx2pzp}rMG%`-%RVX7O#Wln zfIV>$t+4P~i}T`mG^gXo;L=5A?pzNd+j1}}^Pngat?%N83%fWtK9t)b`u0Op78(aX z8FS08dXn4#<2W&v;br_RL*mQoRjb~@+m3lPj#6?H6O-%lpaZv-kIa-!OiUa)e0Z<0 zun)%Q4UwNYIg)6ljyk98H~TI;{4_pz)%x|_Sentt#%MdIYQ$^7!lmU!xlKqW;9*IO628}u9`{ngM)a0-P1vg%898J0x%N$dDma+dshwWzxN z89Im7BJc+OPLyZs(3vkT{|0ItcH@V^!MjnZtEj4u{;JrG*SU(0u2wwGrlVjT=Fc-6 zZ9?`4Y>2S1n~t;|!+VTSj$uI}9z-`dXfYpxAiPqJR(pemAjK7#)amJSGOX#-bCsd2 zRzBh#)=)LO!D^ACLk`T_p<{pp6APc%*4HPE?79P&lekbKR#yFpF{{|cu*7`5OICl{!D7-_;>5QliDBB80k6*Hh0>(B zS=#hwfTp9l>*TZo1NJ&9L;POXS?FTKP{4U9QZnd#IVADz0{WC3EMDK?|N69hFM966 zvGo5e+oiWTAIG`i^dJg3Q3sEcIQ0^Dv!wlCK#U#^Tp_HEoE)#?K>P5=?=%yu=DN05 z8!8tIRleec0X$YKx}y7mO^jclj}LlmzLCV{4B&n2d03(h-*l>HMX_aV1@kE`U|{ecjI=LvQ`IODE9R9d%I(LG!?o_Z>{!a-Bz^ioE9jW>8M?WITL6!BU~eafiv+ z$WV6H+a_N=#mrr~GHo-|#o1?f?#!7SWH#;&_GVpu4!vrJ4_~y^GCOPSkb?)(( z&PDBW5i8t}uTo&fjs{3@3#=6K#_u~h<@@ryMDD*{=Sp`oy{HZCQQ9|e%93W$G>ebR zUmRaGx|P$*md$CyyA&*eo!m6|6QP~E@lm^Q=7QcPDIAu86F23aso zT8>3;W+dGG*DVu$vVMe`$VP z9yuw;z$IB)T9V}u>0@lxz+g!Jcmg!xG9XVL_PYan#r=1D8r`g;=cuSpS$)1LYYofN z%tH-dxh-!nd}2XA5=t4#q7)KD4ckFMSy@bos|Fj|cFFky_xiEEkt&kdDu6=4n!f?9 zcMF@B_Mk1PN1o5kbOCgYJ1$K*##mDRJdgYf?Ypt}Dx6&TBK5{kW%k=?Ojl3|5a9sE zFkEWN+_tw72K5$Z6{0?P%lCbDQNg2r+7hWLf1VjFE8&0<(T#43@@_YgZ&M` zQb|@z&^mDlPeJ&tET~H2j>CG(GiHTWTnduXe>hynDG;d4Emean5Lzz}YYW1gftiUx z9T*(k7Y@#HMZVJFbO+rVA(K+*LWw2l$6=Om@B?z@2TKIi{X0JPpnyOp>JtQISAyq( zcWJdG+RXuey8+O#mXBdyH$!j^&ipwJMNHU!RsctyVZ+xkF)2g(JckJk zu9w1!3U|~2z+K6rC9|`$fDPj#Z6_$$lk1VAgTObg%Slhs`u`YRq6plkCPv6y{01?$ zkzRUCBy^!OC#s!;lLEV5H$=;8K<6Yd0e_!8vLs8!))H5Y#hyy@q5``>^qy^G$$nQf zXclh3jpIO4P!vI3Ec3VyzKTNhkGpp%9Lmvab09q-dPa}*L>};x1}{$aUL#!)TTM60 zwj)Q5AT#4M%5S)PsgZ2%0zVCrKn8OU0ZI0tBcr-I9pU(hW-i7YI0isZ{B(}uK+Q9WhqyvOlab=|SGp5U}iN1?a$)qtt4+#i_ z;B8Q5UIq3H49G$SrjTRwNM{}p%MV~KsGSGlb42^znjAp)Y0T4meifA%p}>Nv$2#jDnrPlghp0jkmgg7JFQ;6-e7UoBwqk;)xtF|i-)6(c&B*ErqBFdTut zYc||0Cb0cGt=m~(21HySdqxs!AR0Y&AsnIEQ;I1Bjz~Ae*!7DbbFS5KX^s`h#=dQl zwwTu&r~bX*H)CR8ppk^lYb-=aKw!C9SUm%`+CwB3AksIlxjBHW4q5iL{v|uHBR#%T zdl>)=(-f5{5lAqi)&hzc?F_y2F|pU|^b-1&)2Ug{TUQ9&1e81kzwC3htRgTFDR+ih z$hjcM_J4LN7hy_%D`_@=@09n7TnLy-s?n)GCo)aiA0MDhfWaGW?~5K-Y#VP6j?VUdKHQEf1WsM zM^U@!7qD~bpBBb>I_TLZt;)|%d6=Z8{QmtLgI*ht250X0qT?HgEPu~n^etvo$rJFbXwDI0vl>s6@#B!w9Q2*JRmk-2+&wh z-`gJu!CWWm6tQp;S(-Rs!QCiucx_{1BKZ_seeM`bcA~>3QZ<2`31zv2s_a)k1M_7J z+q+nM`H?zU2lFfzksoFst75`xF2{KVZ&vX$cUpf>Wx|=cY z!p;$n3B&av)+o%WvSfAU)Iu@X4#-Lh)(S|RG>nESuD*+H5r{h!qZca#upsd?hJ}UY z7oYgE>a4X%HaUI0q5dLo+z#WZ)m_Q-LZj32ZM@873;A!Z8yRMgFc|LanGgbV6NXC2 zdT7G-5_SVj&RYx%Eny!cvfD%R(v|x6#;9wpW~P^v}?r? zk%8LtExczl&kqZge_uBppv4p2*?A4v7m6SD8Z#6>XdnBIVg%ynqa##lYuDvqnF9Q9?!`94-Dq9Q}NFq{gV9$sPX?RQ2W;(^6>oeL)o@|T8~D} z>w+qoR=cFwfA-mQdnGxB?i{RwXI-_#xzTybqcL>*gW7(OzMg0n*=cMzCR8F0I zXtkwM%WHiv{nFy5z&&22V(t|mq<&9KJn_1urRDbUb$D9O#vSLd%AieAGN24wZ82Kz zZZ~TwfJ>E!p);;h98eNQkq+>ipihgiq2Rb#GnZGVGeiRNB=(9OrWaet{?MIDztOr< zlvPqqIq^zU^QcPS!KiLDjo_mb9pPFAx>|N?Y06CWm`-@2>UL-b! zJ|Jcab`_q9qY4)Sr*GPGN9#3wgw_j}e*7lhgaeHt<5vi?{la`xGxXJU-rc-V0rNmc z0YIS-Q3^;V6(pH2&#P%Bgq~h+yXKfR-FZ1n%g@~Of(k`7@ze_cNq=|u&%`^kZk;Yp zZy}r-3^*QMUZGJkp`S}jpM!kNIM@WV_qFK2^y2xu;3KiLo`iV@Q}$kj4nZ2`%@=DQ>GwJkF-Kh6B z5S)oaTw2nQbWRR^z?zA9&n#}Il0F3b6|yafbU@;^v{ar}umq?PM7!-kogk|00=`cd z{2{ynu3)gu(GNg9E^zQ5*aRFn`wa`pH!S;FDlAZJ(K1Qw^T5g2>7>$mu+;#5k~UV< z$|U9kat}_b@W2@~JM|vwVO=D-9sm;AUxYZCJzL}!kG0Moq|{gs>y7@nyJ_`KbN0<^ z$njkK{KRDPvo}<4W_nux^Z_dH;6>Pu?tbZi3jQ1f3o=TmaSKF}ZR(yG9|Oetsjv#E zLnP;f#1opDUIpz*dCDxj=`P49oG#`wd<3j5m|9S{z`?m-@ieUlvKJUzG9Zm30H>0r2TmI=&;cy}#mhs;{)*F@cESKgMtXbueP?HaA`59t z*rbk;y&S* zR+=5Hfxn~*o*{r#<##P{2X=7(tiJlG_Vmv#N(=qot&-GeBq68Gj>F|nj|=&5GI$iQy{;mKEZhko@cCP;BQAZ!QFqnd7Cogq0OUu< z$8k8d%z-O7%Vboo}D@Y zDnJ;~x__))s8)X-okNN=anPHNb)Lo0M>I<}rURmMHlm=T44(M~?ZyXF@A6?zwncGp zi==agWVsJFpIX216tNl{__CrNZTl&DGpk@M>6G##yYoy!oGCr z5=hl;;NEc;&ZmM&aS8^490-jwRN!ABr^o>E;{rZSr6AC$9p^i{yI1s2e>lm$?a=qb z@;g^Mu6UvQ?P-0l?Lg?12I4%BP9u-{J1#l7r!EextFt&T)srvcvWp`$-l@jC*6BAAuW-PHK=G8K3-bK$@!6boOr?@$LOG_{PE$U zE99NA*3Zk3??Vm`1kXuM?1Gew;%>ayg8D5oa1n{R!|AxfwZK)5iBu#x3RF2XyNuY( zjV7fcGn)7RcB#Tl_#9p^K>6xu+u7gjI7h2!^#~wx#nKYpA!v3uK9uTLO%xMYXgH^~ z&i+=xW{0ez!x$ghAb9bbNWwvnO!)Z&`aeIh6LuTrFb1SQR<+G)0T5AoNrofLA3(+7 zD0U#p(K9lh#esd6wiLw0de0Q+UA~$3$&c3CqIquosU%K%#;&Hd__Y8)_y(^XL_}=j zCqfmwWR%P8)lOFX+~3B?Xb_(KL`G{VzcvNA|81yk2&~0~G?bvjSwqcPt^2QUS#vVr zXjDv$TSNpqB3fYu-c;mc$*UB$7Vm*H2Ej#Wz`F;c3@nt@H6mCuh&2*hJ){j(G5xpw z+5-!5&|9eDS8y|9YsJaChEk+sY%GV|pPsV79?U1wzJr0mU_E4QYiqtRYw?^_q7)zp z>p>Wv`^;E?kcnm%l^YhqyP^yR1qB6Y^;bf(Pit4d)G=(@f$}tI$wKdbdlsJwiGOOm z`)XPkFR4K>6iUWJl)Y55&uTY2*o+NP(lq(3kKL9*oTwOF#!OW zkZV)kEcB8S4k7GvNMO8bv|?B=ljnljGvCSb^9Q?#=U*Y8$1WF+cn32Ql3G}>5 z2;bn!h`W|HlX{DZ1ikKOs-njR(ce@mgvvH2srf&T|5if7wf)&Ck$e(p;3=(}WnTE@ z3tO4k3&+Ko{gUn$E6q-Em^5ds?)>5L{{4GxF-axQ`$P3>v3Y`!0Zjz4U>kIgTx>j$ z7~GO{>;nFs{)0x0QeuB2or*Z`1dIMxa7_;|hAGe#+QDWL(>??&lJt({=pia*{0hbf zc&XzyHa1xiM@J_)pDjv**g&}nA80Xbi&(*6S|`I2D%crW*-n&Epm^K6x}30JK*i+v z-MH)s<~!I4vOVGp`fit9F}7d7W(~)7CdGfe0Bq2W;ldz|V@4ZhIV{>$d4b6;WPSO` zG}=vG?}>gtPM^2u_D86sst5JHW8K?*cIg9#p;ymU1^_5*2INdah&~u4D{(9#4rx(M zy2*$IpZH&)yPzxWDi9z6utJgQBnmYrVDnf(>ABy8u6a(f#2oM7xi9p56 zU11hBgZ*gg%b2Kq#D&UC+dD?#tA%$*|IY%|&7gblt>%2Z_=DQ!s_WAi)*f2Q7VrF^ zlFFPMBhfiI;T#gKyUDbdYAD!W^Jok-V}qq8=&azAyiA_p5=xP1>V>q9^9WB7-EHMm z%~-Tr9Hz$-fOYU7IaO5&MRM&YaUaADf>&Q|sSe_qxXeMBC}lg?8~sF>WgIkhVCxI5 zSrETx5W(kze&iSY?IiUQrgXs=SYpWGk~@3a`KOxC-UazJibatmv*9?J8;Nhw2Su_$ zNH7{{{v%J7pTFvP`{Qi4%Dxzq(h?XLIB7}dHdgwGOHtbiV+6x8e2j0gm?5}q-FAVu zVDMH1*dmw~W(0Z?gol+ACwhDVJ8Z#GhG9ak3w+E@q@D00b)1HVrnR~+FG2Ii{;i?! zCr@PvhmN@(elZ@>YZlWarEYV+Rc9K*@P~oA*V$$<{pQKcTD7f-Y6!onu-sk-ivk29 z0WCeXIzgzX@NI2AvTk915(WzEuo_pTfOgau`>-$5(z+`5z0YshHG7q9yui5Q%h$^x z;afyk+*HaGT~=V3XMe%DR+9yM7)VoE(L1{w{mI6JB_tnSTzo9fs7_QmAHxR5DYXC0 zF@f#tu;h6n6;&*=J(FQX6@&y9DF&4(xF^u2X%`pPncomDF!vFB1qRp}Q8y49IIFYx zj;qww9!+qASm$Fd$U}HLpd8&OGqLw%wM);IYCMEkaW&8AMy*KpM34oeWg|C<*3;hP z!6a3z8^7V5)I~(LVwueRLo`@@C)|SP0iXm>L!)7?gnKyr-(33t_k7)2%|f~4xrdt| z6+yOH5gnsY_(n4@IcSNYG-kIgAzD_AzVWi!klM80)4b3mUVpsj$EO&@D{nx_#a~~P zzowToz!hO z)xI&s^Z{BM4mmE`LI3!I>E1qgp1-1cDcaER1bQ1m#FJ^$wv zrVH9&cy9?KvKRJ=Q3Tw@Tw5fTaK#iX0xG3s}0z?VGcP5Qt@7)&)iHxKR&k}T*C>+>KvMBHcNUQpeuB%djl5sA1pm4~W2}q;_2>nKMHRvPR zON$~H4Mc@Nrlo#%2_lo?LCOG{pGM#`X)Y4EGX$ZBCREV{Xk{Kp^xu#Wh@ zl%V=EL@!xK$?LJM&ngOPVi=p>u|8{BaV`yO4GC)o)j;@Zc;ZL_2XD3k~ zBB7c9Q9!-9V3>b3XNr(!eAH0HOon}k3br*jj1SN!$VFI3j*Q;~ryOEOAhLDiox`BT zVC9Dnn9l_Tk05xF`^UPI^s(!BHw z-WX`L!FDra7%VJzaqt>^>(W>w5pHl8#VN@lX~fBgSf0UQkgRip?x6~izC3i_EQBsP z68(B~YE11ko0#*>Z&N-20W58!oKF%L@B-svV|SuS87EIiMRDVa27{F*3LK;~L>rvK zSRm~W92{#5pB}(d^#-8pXlmw^g8a{JeYCA3aaNJb(A$~I`o|GAilk;#OihrJx;eM(V+A0QBK z8AS8SIGxiJ0EGO9tLg9hZB+G=&c`eLH1`HV92f-}P%s;dR!e=n`0m6IU8e%j8!3oj4E2%#4lKld>Os}NU%Gq6+aX80(os;cCM^()v=*4N`S z3cx;+$p$CoI9kZu0|GGW%n|C@L4-`OXZY!=RC7Jz4}esJ(=PRJAS6O=f-Zd&#w`;^ zEd}jgS0NHw7uVxWkVE7(1aUU z(_vjfwuJlsOv1D`pEH>da|gD`si-*Af+JPt`EkUCc5h`UIVY+L1AEX0$NVwx*kL`^ zxf*pSxCe6FIeaDLt&zY2s9bB{gU$h#!0Lg+T=FoLiIo$NBk#+X`>5O6hlk5BAN0{< zMu9%niQWJh*iQJi0OTbG-!J6op{+kw4pFdR=wO|JB!Kz91!VEXf&E2)jrL3Mf*kHsF`t{wWytF80c!v8 zUS~nknwYkM2uU|Av5gL{3dFjC4F+@36LUBC0!Q4ZPuBo-U%z>y2v0D2O=YoOKp_OK zg&}P{(b6>1ZnvTN4SOZ6q{y1Sf%#h63LMSkBWxZvnRTqlN6pg0g8NejOvqT5NjB=T zaukt+XFA4Vf^`iF+C}(b$dpCa6*favKPV_RN$@;^iZ)=z$Hkcj)UsIM@j+Z(>FDSP z1MV2ta9!Mq@L?M;CS;*Q@*v5k2iQM`HetLxfSv%79E0jL2=|bXP%@rLP(^!F=$$#s zYf1hZ6Pp^^U<7gyF{O7~+PwH>6o}NICdo1=TSbW(zy`b)F!6YljJ$jgRxtPyyDo!I zc2@;WHzXi8&isCFc+fE93Gsr( zn9K|8?Rb%a)T{#=32sXtPF(5U-ZYBghUY~jaZD~?pN@e6uIzMf%!c_B|Ka_5#U!=J z9r(AdX7cKP*8p~XgoDY^^6ka5UVrq|9Gsj4Rc?7!cO zwldU9;kYcHNVY`jgzHpMF^(nC)RK3**Wrgo6fp;p85$v;CcPYn($I^dyB;1moNqv9 z_#^T9ND5tSET8SNy_=6eX5jSN$;W>pS3mjUg^w5A*VJ^c2#brpahAXE=e*?@-9Edt z=bt>+zNA-T?3z(9*sQQ>m-I=~pC|4XF)6IQqw#r?K46=V=g*0(4aYZMj`$?&UE17s z>>Af%`1Q>`L-mwRtz)T0l?R$HvkMC|VgeiwvZ^|{@wn&P_9SP@;0M{ZFTK8>`t+A7 zXT+?>mSanYu&-&u3X|Xq#no)V7hQh!FIC?avwvBfDN<1<6j$vqX-BEAOkFRN{G7{y zrJ@4LjZAvv1rD50auuE{aA#gQ3iDksPwR*Uugw|_aXk%t?}8#cc&jz%crr0%V;jc4 zk#$=*RBUs5zVyQ9H{tS%j17kCa?>MQZ~wA*+e$H;nXEW^t_=oWs#~C%Naz-@zVKhi zOPEeXKka3aydkjt|Ecau!>Qc+^^&dH+HG4I(z|0<8c>v|9m%HDmW@bDk+sSY zk$K9>kX=fKXh}s>+LdfI^Cw4CeDAk)dfIIC8sDe1ao@dH+zb91=IVMu@Kh4>ap61hcv6T(7z9eNCL+}k z;LDQ2!YgnOC4m=Ho!Cu6#J|?oWDE&WDhlu(E1?N@i2yjrsU@gfkhxbu*+&*rVGj!S ze2`(DRh3dZb_75`G7fq5Ktoam;EU&(nGJW908t^M1q1}tG&YvBv_udahg}Y)RdGXb z=0<5;jQdWM9&qafwj=`f5L5_HAzA^bfJwEDUyB1=g0ij`^S4C+s-Th~J!Ho;P~cs= zb``Q%>!AuKVAlEbTOt1b42BTBL?;Rb5J#vriEso21d*6w(PU;Wc`X#SIGVMnKhXKV zM%wu1zKX)<393CLuGJ`)A&WQ#asko{0>$_X%RrO<4uz%#@Jcdh?bKJ}4N?|UP=&Ci z0@b3HMC}#v5&H5-8l)QqqYZd?zQWsp7={P0J)4AAL36~tpQ{(97Nt=2;3BJNYX?E3 zhQY1Z_^RtbXd)M@C0Dfe`VS-lN*>i$jM0tvySUb|J5!@tH(n1me8B{=f@2YBu^=G@ zVQGRHb|i3OEZ&epe-!%z?j;cYK*07~@DVSEz?wOwX*zcwY?xTIo5aBy8JDh2{71KuPl0Qk+@_I5GY1bWVo9mS^RvB^muvK*9~ zn;Vr1k+-0N{76eGDJ~wL=%=4hhl&(cQ*c;V{DuvB2_FgAh8zlQW5Fhl0etb$O^a{e z?u!zj_dylV$MfiN$ZQsp;Q@1J!TJW6TVk95t5@@z#x6? zT}7NY=o9N++M5v9cCzFMP7!!1Vy=(QZdpMATnh*fhHKuGY5fmE)&bf=_nV4Ed-&)? zQ-!S7gD;ADj2ko>MtoDVvdB|`SOhKmd(_~df>(p!L|e`w3>+l%a6|`1#dmpXh^qrn z1y)l*)CD)HHxOc>3X=uE48kVcV{R`6@u(9o&l)lQXR0%P{6lZRPb1+F)`8w4Ypcmz zGKPK#3HFQj91o6aa%5&8*hjR;JB)JfAQ0L?0SdvWQCCij$el0s&8X72yfRE=EY~`+ z|DC(ES|arv9s*cXJ_gYW9J&^uj0>BkhH{M@a1=V{i042#vB3k_5fhmQ22~7YE{_&R z9CD(&=Jo22s5AV_*?rZU+Kvz`EVb z&{Lpqg%<7$o^RIpY7yD*q@<*(;PV2oAF90Kw{O2gxQbkAzjjF5s^;kFl_;vx*mzV{7TshJt3;E=C|D6RDxSx`KLsftsn0s-4=C|=C{!;bf_S+Hn zXFtqMaX2Q#v=R4$+eg(Kga!}|P;<~OpnN24DMX);;^MKDcJj*BPk49o6b&6L5<8LM zt-)j-?muR^&Unv36h|-yz=X90US1Fp$1bZ=nkx*(oC)$9&)pR@caJ7f$$%BU0&hz% z3@YKzYXW$}9lKa?=IatdI=Rz?cKK ziY&Y$=owiwi$q0&G#UNCkr_jsK@L89``Z_P@gvLvbncakHAwR8P#Y}!DJX&^dp;CjU6NHR?Ydp=x4NOZ^w9h^N2K$hO^K0rTkBf`2tY4V8#iczEXlv_gNpi5^DSKa?VnEgy(*My+8i7W9)XGnw67k$!{32navPtN^BN zzy}whg+>ec6w)c=ESyU0uBh54Wsf-)a15l$hvEb`|8c2vPJQzkBytP6aN*3G+4w0k z0jogRsAaIf|3Y*5pJeYd(r}ths{$BI|CUD1Qxt|W(c@rwtQl8*4lMfGjjGF{w{yS0#L9-l*OA}%>A}vDhW_ggegN3I9>Pq23IU_5&k+&dilzK0tp;MNH9W*oK;;17{iGNyOz1xf%QghJNZVup{1YjC)`;aC3! zV(R5sy6JZ=)}WK!HdhUN#7=fR*uV z3u5YyOi>vfhpj&lU_Qu&;^+kj@hC7p=X_}}{F<=g!2vf}ByZ_7&G+({Og~UTk`fAC zsfn-bp&{bh1E7?3`NJbKOG`f}(2%WPmzBlWEC^6NQ3I7m{b#E#9P6%D5IKLfoA&DF z%ZbN@35PKEI3Sl?Ez0YF^SPLa{#kvsF;b(G6Fu%+xgPqjlWe1 zj-o%7K=FCAD-@t8gQ3vV~5Rq>xy3Gpy)<@Cp(_SVSB!RHY9i0>SVy$byKIh_+nJKNb zZ2kqMvWS_$VdE5^i{;mGt%tVSNgD0N^R3wUHHDqeACU}DHO_?v={vS zAwgfcD3rqPK;Q2ulqYjpAKYjZhX`vGZ)YeV5^`-XQ?s$NLpkQ=(Z=bUS8QBEd4q%-`{d84#X9Fa%{`K$6GD!S-K}fe<}4g(ehnj! zo+SSDBBTF7d`|q}YFbHR^S;wfReBj08e0^$HHSSbu1p?RNG`H&l)``dUTPU+n?$5V z#?v-$c4Z{BHdfmUy_7SXP#mcJ8swL4|HN2zo5fh7=J+Mg*_G3N4q5nr-{M0FTJK_K zYqcOhGw~{Y!&tbNdxsS(U7=)lwsZ2bT->0BAAAjUc0M|3+;X7X!%>epFwI4$pBmIV?`0jDA@;p+A1dn{_*zo)@nC*Hfzc?jkMgqb6=IBf z2kR5fe9J2&C+jt)k1?sa`D(-El7X`)5*r!Xxj)6O(GQbt9KPFnzV6oh6oDq=0Qu!D za`DuW5mm|Z)?)!)C$}WaCbcW8;VM+p_ZWyJHAS;U<`O#((h3Y0e^l-kQ;1S(YCp|+ z_-s$q{;lV3AJdLp5-ARtcCq~6n-wazpQgy$)7R-$saKu9L2jWx)IpybUv3nwvvx&a zNN38a&GJgMEV_~E;bjzxjJFC`TGK_zof7(L*@iPWc;$0P&g4brG%0Moa4c8rXT|tv z$369%bFR+Mv+*()=8nz@?1@WoK69l=yY|qj*|>R6_WE7Fs&b1B$HNn#dxzcWAjO{-!!s@J<4!h&ySiM8ygbqFBROB&E%>zeg1?z$K&D+%&NoG#i+H6uBJui(~Uus4fpoDNlHs*G)PNJ)>dgdBt4&g)ZVzb`r*;z zN;ev<#HxE+qfh5tw$t~K`<~i7)%c9F!8*gH+niP+XX~6nV>rge+@dA7c+51o!!$*F zVMyMf%`Q;kNc!_5gQ@2WMsHa*q>Qks6iNqE08i71Pe%Ck8-ty#^Xbcf%sa%1O|J6@ zI$SnvUKe8f&{6xS``L2Ta8l_ zc&fjhs1$-BP$egCR6v+m7YDU%EHY~DoSvw{8#GcWh59rj63_rD%4 zXB>8`S6H3tFx_os7j!SftVq->x8MZ2mhk*b_nF&Dq}&{GV`M~PirOC?pSqh;eR^c< zraiCCx~B_@Ua37tZoM+xQ<6ySVHx2``gRGzIZ@ZAA8d9t3l%RjIvriknQ$3lE4I^!_d70hSY56WfFY9G4s#dnuZ&~?l>HyQuGU#yn+)a^n$= zCVPhONL6YNqrFu}qT>3XOx?b|>>I)w3Y_y1!oAy0**NH3Gjb#j{i(Y|0@9SVTj$Jz7AoSA7xh}zTv4bA>_T<)Atuc>hZ>@h- z{O6t32KUpR8<=ojM8Q02PKmJ@0f-@E7F#b2lt!dWLP8Lc?iQrGTUuJATco6=ySux)q`PbHpa1ur*_qvM z_uHL!MrP#6JI=Yzb*^(BLgeKn(U6IeArJ_fw3N641oA8z{QNtj0u&(-N{F<$ zh>}an{-U!Q?(`DE@e#h0sf;ckgA^7nCKkzM#EY&ZFC4KqA>7;&I5OYwk_bOo8PuAE z33k!a(Wz#ApD`4HMWN&pk6wb^DQ#iV9KJ))Uwg0pmi^?)l{`(-X=orNan`meCDA@m zRo*5N4;NRon~;I=Go?SKC?eH{NL(EL%9)Feot=-A5v;z323eYT!_P=LG$=RN5eXy7*g?Z)+ z3B_j?y*gYZVUCZE_MI$H6)RFPe7wIozPhrWc1ypGlM2@eJ^gN`^g~H3Ys$&VF{y*l zuR$Z^+jp}soOMIRLt>qTem^Aw#zcvJ_u-A0JuS`4fYDYco0&0iSFJ5SCwz~We&9w#Lw^os64TTX(pA^E)%ZO|aj1jKLBQOzntC}TL zLf4zMy0%fSU?A{ehrZj(q!E38h-d26GF8*9Fo~WnNMarN0t&A z6wSmmt0achP`Y}DZal#JNt1u+uf}9GT{pjoo&S4s#mxf#&mrzJ2urH8#3!$J$#IiO zkQp1g_HWCB44p|=-mO0goOa=)ATL?+I^tp_*}bP!I#OzoDu1tQ(p3_Z6>CYgUk*pE z-uKcLUnpixtu2HktDU#WSv=hnzCTo+ik;rI*)$+-(z+ypv^0BjOOY`}#pw7yG0lW3 zA3b~x7=b9B)@ijP$Y);9O zC8(j$K%A^T#9HMkBG&pL%-j2d2|oOC?>Mex?f(7#^*zs$CMOz|*j^h&WVc^YBdh|w z3{Rc97!%hs$V)u4g{CAFFl0uj2LI@f7x3xBVz&p+TyFT=+xl>gx4JA*R*E_Z#VTbZ z#N5|Lob%`dgWw#l`Mw>htmF=wL_6kUK4}OMiFMz#FLfeU+P$#jkim4l=JQ%`!EdH$ z_$HL8V{>Ke^4D=!$|)l5T5pkKByZ1ZkfSRKGv-_D(=Cx$o7-At=eoYBB|K#11j1o& zh!{>@aux(#u-^9e=fDBSP(m+6zIU&45>qC-S&d;HAV+J2qvvxUt&QayH4YmN(`GHp zTdT>u_%PHDyzf0yYDDY8Si)W5?1iagUVdRfv>GB#xv*7y^&c2HouZDir_S}6C0Nwt z85HYBckBgE(hDo~yIF^K&blT%HEL8GH{=To*()f-Iz5vN%w|T&3Gc(Gu&b>Iew%U1 zPyK!>ym}5RDg>6eo%Mu5losEvRXJSRbJ!CNdRGUynGv$G*+)%okC>TBQ?~W zDQNq5Yu#rSrMo37$S^DOy@i4QD^_$^NMmTeN`aV@8J67s$ChEupOhskZAJCC`sKF< zGqBzcSB`6a+c^Y=o%iXKTwJ2p?uOBrse#Olkt>^USy(sojvK~5Ado30As^0A4Ct|w z)B8~=xq;505|1Eh*2{Jo>+p^;T^7T|J1i|S<47G0$o0|FR!e08naaQuk_wlxT7w%M zK^-LHW%IM`k94a8nIu{*6l`?}ISo9J=MvX#3uA;~?6{k%D+^`GJg4>o-&vk`nOe%N z(L2jaFoI;bH5d9ByMMpC!}MednXmGzXE8YD5oXd6#F5jsfJ_J?L*3!hldN5Ej?MfK z6E%4wvIR2|-!K1<3L5ac7gt6v8NatK&AvaXr@=;H|58B#srW4iV85SP^8AR~c58Z1 zDp>A0L>7a>KU4n^k@#`wb)+`>WwRc&1^2?ZxZfz2mQ{~1Dl)3-FAsh3xbbdYJ;3{@Kk`!7qwJdC%Y?>& z3n#8L67NjCATeZRO8eXP5@}#`%ya#{jAqhU1;1n@b)I`eCiDkF1PCJW0$Eo2VK|kc zd+X@nZDy4XFr^)}aJXJKGBQeECx59fLOYI7Op?TB%aq*b$cOOpR!)R$KM|@tolue3 zP5)y3&6z&UQZdB>i}OhK*tqnECH1}4NRoO<-5-4SDshAE?d}U9;hH__t9>o*^exSt zH)doCR$DaOjfBHZ?6}$jq)ClDLWJC<->k2)JU1X;G`3PUN|N;+ac#PVt@PY9(#S7rCUqs-JD*X z0u9&RkITPQia7Wy5lQ0SQQoRy7g`Roug*5TY@%;pIv9nnkj&Ij%f>ds8zNd)fw#L~ zLJqy;poV`mun?h25ZT((+eqd3=M7H}TUV4<0mMA+aJ$X0@qwRJ?`a4n;mR9_{j4%m zi_xVKY~lJNnLr25+xbXuO+;7^VDX}V33WSCKZqEcQ5Ejfy7|`qk`J8e;fMOqiu^~y zkX^a;ju|G}F5?|$Rz*zX%a`^LpK4)OWW(Gm-;Oq1=W-bvgC{(X>cbyPd=(mG#ogKK z-6hnk3zP6q8jrZ5fi8Z-+cX!K+V_8Gi0LtO%*%?+vf*!dKSOpkj5~4y7mJyDUbRP( z&}2@2DZ34_K_xywh%Un|9#%SApclSw0BfL@ueJxp;p51Ur@0@HGZn=d;t3NYbY0M+FZ*TVpz`$PC z^LBe{^q_)z+}|3UEZx5h#_5Aj4(b$-_cy~tvhIl|Oy&yw*bM9_K{Siv)2Q0Jt`4Y7 zg?*5`XzBHvj>1fZ2M=AKFa*KW*=mF8a)33-}IC)6?t6vmqVQ zM_%-Df-pNqUW><(BxlP27UR-Cq!!Ub2xC!z4D zN=TV{jU#jNo@b%L)Ww=y*kGIeS>WnUJbY_wCvgrodxKl8-sM+zL|p+DYcjh;?07kP zF%Z@FoxAnEBnUHE4pNqJiKL69xwvu>n#Uy_Z$k5!HSrsZO*2S?B1t*UGe z%~1FeWFS7_6Qo1hmil{oqZx3a!`rQML!=QbQ&DP(Ei+26?j|xk&Xv9$eZNEq4a2Bt zvLVsUi!Cd*Ucm2TRtb~{ga(+y*=>HXR^8uz3`@mFEepXS)ha4;xsYwRA0h-40`PlS z5_c3-;>{rT@vl+o+VJWDq!QFrq*{e~M;1u-j5umD32nWT@aQa4Y}iOqwz-g8nqvLa z&<8dz2{vG5S`UIAsmJ@t?ef~0Z!I>+UYZemYr#OmKDg4wtlwm z;@Ku~Z@58xf7|{}DVFikrKxm>FZ;#zxq|T1_T;kjZM8jja1}=)Hs@K>^BaAg9ZkGq&WTJat4lr)# zD62AH5;!72MyzWvWSJi=b}&E`VQuDs_e5}S?;9e;X2d}yTn*)w>3R;qUN4tdQGk0_ ziM<`MC~lgG%G$vBOz5$A;c8fkx+|}@ksZX+6n-ZhUZQsxjoZRh{!y3azX_Za8>{$5 zlSO~2WQm=IYjvc55b0rK1(3SMB8op{3``Xc5-ezsfS2u9MEky$*i`xk;uDp*lKPt_vbjxKtPPNg0u3i#rIIEDK2Pi?ROoLw?$5oU%=8#*a7e3 z!Rm&YpGcPH#Us>q>9Y_|KIId#^Fo#yway=}+1T+o2~`y+H`?ptQK0Eyed3Fktofqq zws=-_M(z2bXyOJ`hnul`mWr;XoJ^JjQ6ND8%abv#08;R%Zguo?r@AKfc=oSc*c zQq0k8FG~G>YJ}9QXD>J~l5j|+GTH8&lgYZBkX!6CXQ&i>($4p>S0z!KOQ`zIS*nux z^```!JAJ>()o;tNXsH&obcHBI_{#U=yCNx*W}MR+m22t3oSG^sEI}%Zyw<9trjAju z)02w3UuO49#rd=s4-P(V9f){2X^)Wb3nGG`v;&%BsqFwakLM57{87&&j$p#MJNGL1Sd8X)HQvn4cFG!{ z^1Gw_S{MlWnNu~Jv7p|)3_x;)DlPbW2;0^~kxkE^b%3_3#)&=a5bJxjWXoLf&M3yA zi5XqsMC&u>;w_PUB{7{W@$f?YooeLcsd3GuR8RKB!~?!AKrTIm1P-+oZutH1-#F6T$rD3I?D%my^w6_ z+(zEO?sZ$=e3eYI%QjujthUba-kxEWcK3oD{kB4{D7A+h()GYdFH7a1jJs*xlUhvF zbledm9&T)uT1sm~91biujKAplS$IkeXg?zs#C433?(gcV)#%@a{~lE_3D-ag5QX!N z!tgD$wQ+wV}-WDNLWVTMck5s&R|0&yjTxQI74H(6;!y>NN41$wlvO)Cl&@+G82UZm8|Wk_a_Oxu11GoM^U z_k?${Rt|<pgSfAe-JVR`dtVpfmdKD`SJ`Cnk!R zO)gB;;YCyh@)?vRs9>H^YDuC7rq8xnxN71R(Lplnk9y&{QF0BmvoZFDh6Xn8N00x= zVi~;=99Ia^K&ZMo+ivggFVNoOx;9h$q3bJSviq#7FZHSA?<S}m6JU;As?CnVU*+Cs9yzJU!g}3V>s#`RrMp%bek9 zx%VaEuxwM1U@}cK2qZ+Se){7BKG$y-Yck2a?lq+W9&?YNwTcOpnJD7=)LqpFp`KZd zBvU{XaL%HW)lq>caF|jUJxRU$7fq`b(tzO1u}^Szz3jt%)MmaJ-w=``qX6y0qi)u`&bO zUS%e;m6%LQ-HhID|MQd9{iD*qovALjn=pvP6J%zU_@muc)Vn<&29o$;SC7KQMlues zUH5qRXYKF-OHI+TkpH9-j*@G|?NSxpy$&cHsy&LK7M~}=khTG3L6qTKf9Bt@Me^YW zAy|s$GKBP|2VpH9SCY*2dp!$kQIM!!dV7-7ZBeVuCQ@ajOJ*_a2#{l_aBZ=166}Q+ z@dA-3EIj-?(AI4?`|)^3c{;f!pRd+2el4I{f|9<7aBnHH<>;=&VE>#Fh!-}II$^2g z{+|@x+Gms|_I)m%!8992Hv0nXL?m19P9=FRaof^9UpD%n1|YDL)yq#6KP)h)1c#yD z9MfI^DLTlirM3V~;v?GEjyc?CFcdU&@YL)qDBw8djRtwnAi2NQ5_%p}No%KKHJ0NB zolcT4HX#229luZTErALj895c$#-d&4FvEw29R25%xIbJkBXbpO-KbV*txqzr#M>e0u1LO)qy4sB?K=3)A6SXR|sxPK5Hrf%oM3 zL}@U*u$tECaA@XdqC@cwta#S3)w_aS*4Ow30~11}jukCaA0w&Rxe8i&VjdsrsqP!g z5Q)~>7pp2t**ineB-#eF!b*gM!aVs6O06YPxj#A!(+?n03|!D!$vx~gcwr`6=mC`zq*P)a z$Gbnvu8l8_u1yAvi^D)hJtj=fUz45{$|)g>+_HryS$a@z2zE4U*@mLV^*#I6jvirh zaGBE%3^cy^e|zfIXY(vNbSc9B<;1` zm`MfW8K1na&y(ZJ>@Scy(rUA=B+`yM4cR>}pLZ7|J}gFeKY0}q@ks*hEklIdW{>5a zl^gqQ$O}P`AirK*Y+9g~u`9w8WUda=a*QzsLL7-ZqEZ?B$I# zFT|fyU8s-auD@`umr!YZ{v2%ZM_L^T34D8J>$;sYulE7OpI<2J@xg}#yc#G>ylU3cIYf zdYk$TR0R?ezKu?fH}x83D45xBm&3lhV#xSpPKAj~=~&^PTz_8XaTyPd4E+OrzM?GL zOrX+6UZhcr?CzY>-W7?i|Je5`fk^0AYkBrnP|u436Q>?cdr0)+~+I%=%b1pPuQ!k>fbq^oHk9=h*8fii*zt+g;U zD5Yrlf$Co*m1aIHD1+En+VQohX%Sd8Bp#GX1s0sKgff#?~pv5*gL7e}T z4>gJ&6MG^^h!X$R`2^Vim-Ru>|EWTwD5`>vj>vx(EhW11Ui?@6vS(o-<-bdqr2l_P znE!)Al%V=Uw22p+stpINmPU1B2lN;#{ZMsq!UMlzijvFxzZX>hH%HSZ+1LgxqUMg< zHYX=1XL&z8{++M3u8-4HQwvT?B6e|csi^)&wzWT79vmLtiNe|dQB|Eb?(Z{tZLwH~ zXWjh31!5k>C$xF`SFeyxPEK4lV^zs#`OMACFbN2Pe*D1w>%ez?d)qcVjG>T^D?ok} zJ(*Pm!o7l`VsvaQTvx)<8*_8>^Zi*IS6A24(o&!Da{Kc6U-B<)cE(=J%+I$^PZM}F zJudqbhr>%tO9T8kzPJdGzwY_yJmk0S*{EJ_+`72<5IspFEKE`Fe6;07fCzhhdD%5n zX881an+)h&Eaa{-8*81RSXfxT{{FDEw6rT{!@`nMQix3tm-9}{&a;0$N4^=T@MjO4 z*7YU>HNnm}W=#zyU3K-47cy~gGvx)o&N+s4bch#fRv$(em1JZ<(mhU*BqB&d8r`p` zSy<3n8_%)3!ifA55(vLk&T%ovvj-L!e6K3{?_L1alC@;(CJ``2glUa*xm+;|3#PWV zHa7h>*v520_e)AvRt)GPsi~z| zPFGxYpJ?LyHB-33n}-F?WP>JXxVZ_S;|AnEIx5PCMlwRL@5d`d6cjN>N5`PTb^V*$ zy^=Dwi`}7Ocq)GzzHHMqKMbLkjouiTiOK=lR6e}DsUmY#M6D(d*8&!)$iB`{g6Qwx zzsBphA(3!fb^Q6ygLbB#MU+#plnTXBu2Ner9E1 zVPZmLWcu;rm6es@vK5eIWMl}5h0)+XC2Sdx@}%(C9T0SfQ}6Fk;#1FK@Iw2L}f!O!p2Rwi~Iwg@)R$wgsRU^;a)@p^%V( zI`U?JJQgVT$8+ zxsOC18PwA9R$M~DZgaXwGiYT+Pfblt@BaFv#_fUuLP<^ijNkciqwmFw7y4k1D<>|; zCnv4B>0WbR%m>^578k>`vzW{@s=-7IdDIo1Lu>ZUkHnHz^4BU>=?g8I%fcTAh0Sb1_oqc zFagcY!p?hBU0v`paZIh>U&v&P@08lCitf)>V*rN>W7n#4KmsO)`kI5|ld^Ka!F+Xl zXD1x+Otaonj>qCYPC+9=^$$EFKXF@_kut~Zn zJ~)Ptj}Jfq0a)6cx6hn(kqQkP8>aC6@pFlAVmPp!L>$JH{QM+$mj~@6)(yT54Fa(6 z@N0dsjKQIy?O-F0*CU0g!7cXNL!D#UG8b_~cz6L`51_VIRn>VhP0`M%T3oSvKUZZ* zqT{j(*Ko6yT*T09Hpw9Ha6ay~J;*UE@EipN1^U}d7M86(3SK+d*49?A9fUkKl;2}w zU?9*{-x^FVv)`73ML@9cZq7dqpTzre`}9#1(KIG3jOp?vj2;R;lb-wKzCLv5nxI=D zMvB$~bijnMca4pWseSqKGBhMaKR-WzKb(6>4?D!)^bIjS0YNvUv_GD;{O3>VDqwt< zld8JxU4)uV9=z^gxrq$Jz}iJh(_(X3FA2n@qzwH0`4jr6{+=GTykg5mZeYi#kh{bB zBOp2srtrpulk$E~E>_4-sIKM)h(KCzyAB^35n)V4MTH7sWMnk#k7G6jzi8cn_8Gcp zsTt>G&*}X~{jf4Bu|T#E@iwoUO#&y-#>3@#>%e8ygV{xBs8JLb5E%GpWJDgHf?^mO z2WR%jE5#WQQ@Xx=`<5V1tq+AnMkXdB5LX7~=aW4jE~de(fguw?s*HNET-|%0l0MYe4_qyLTVrpdW&~6>|0x3pAAGKnYmi_9=2MjX^msm9Re0T^HKPr}(dC9#kpT z>cz&!o*B)OoCVgauAwp4F60r${&4pAnEvO_YZXn+en_d1=WS_T-b;KEl70aJftl0I z{#g*xWFVXn6SN*NI`Ny!L@GdiwhMz<&+*|BhyX9cO0VoZ@!eRl4kBEP0dH zoh=i8-e*>+fscjN3MmB>souSR*3xu;DifEKG`D+p0`6jBVE6_DHBd4h8z1ckm+0B~ z`EoLTC$=uaYHb7zawA}K`z^lDWvQb}_ohqACnl6G*FstU^v2Ma&&L0L<1M*bLN}*aS^vwm6ZsQd1f(wg^K7*;6Kur_`)(>&!uf)^%9KS)m zjZDZR0csKXlV&-iUlLRbKGVyk=#?~_A~U{xsRsh4#m-o^#dNXuf^%L@PGFICeH^n+ zLjpKa24K4UbAKE=FeN1hy!l3VZp|7SDn?dT6XNi|cjDruy!KnA-@juw@=XOvLD0Ma z-RZKkv#YU`l94e4$ZnGRF?}mSMp_!leLK}zO-tOdDvH&z!Q z5CBEPFm~uBL5=nUzx`I&lJlp6$=4Vd7*$>mZeWdTYim&0*x3$dxyzhE=+$|{i1BZfdGrl#HT2Q@zd~8!?(1{G5 z1wdARb#>LP->mrF&(ZP_3a;$p62@Gi;WB!ucKq&xNu0qUAtJJ}sPEsuKRzG-Xt+C( zuZ4iX!NFm%P=nPSLDnA1+Ju;K$aPd>yMDa<^hm&{Qs^U2-TF&9#s)Aa`2Lb+<%NZE zLktu{R489cU^k5V@x#BSh9@C8`8fmxGq{YyRj&~7uR4uxwr7jW_EUp{XdEU(9aWa| z5D4@ZP3uNDMa6OBtB;L$?mHUl>b6fq0|Wlz)FSCZp2QRUoSb+>L`0yebIru+tSlNRkHW>p zee<$F{$*5rJVL%wpJkRBQ($~N0RW9!6Kl9+dnBN zJnJI7D)+dtJFI^O0VXE(;X@|~ku{F9v$OgSw-+y8z8u+O%94L6FE0=I`0?YR`|$P| z6(%BN;^N-xYSB4UA%ErQC{j9xZWWLfW~ZecsjKv>3t?d3+d0cmjg?hZR<^Decge%s zhJdhLpZ2q6j_(`~axYWT(!zqc@?ognV)nJiNhiVeR8;EFTsq*&p!*Ca| zn-J*S+Y=0O^Nu_QOx`Wo`$?UCP3k+^z_KKHc`M|MCoFD+2IWh z4bKne2?$uUzP!d2lm$(hP!1(0ht8tYfLN(f#NAj?QK8)UJ3Krb3m-o)hW_IkSmPS6 z2R@Y&okcyJXen3_25|`p?1y&&MF05lqouEJH`+1kH7934Xei3%(Q+ifNFyU7N*bEy zV6+KBo^?9iM49r4Wolu&ySoyRSdrag0BOpALm3$x8_ZRhCJ4H7fynkGm5%47mgfEF z3T|Hk;b8{Qi8JIz_)duyuZ(1czR( z1JIJ1vh$>QVP>fA-q6@s25j+1e0&zbU6Mm15Eemh*76OHQ64x7sKEdVgFiYt3h@EK zmjshSNSqLOzF=Q-$i!AyBhP zNlDQ&HV%Xi7jS;iwxmExMrOOx0+W!K*g7{y3}R#ppztJ2%b-;?o>jLCa5_B;3si1y z?w7dVRM4Kr$e|f52#J7qPwTC0gG^5k#Aaxw09gUSALLMhwY9w9sU)ZuZR;n;fCEEQ z5bMSZ{3};`;IcsUXJ=;zls+ Bp85&~|Hph=-rQ9lQ_;2?_e>Uka~4I$CPGF2Ta) z>f*8jQ0Dr$9Yf#9$RC>I@bJ`V-}PhC(a}NGl4C&4^+5=VdY{e4$@xxCk5WKTkR4R^ zz%vd1j%3dK`HaHE%)Gj`_Vr?K+P)t%L>%g5;?!9FqEsN(g#u>U1~NFHs^PeDNelvbe5h*4rvzI>Ud z?6`yY56%GrV;Jj+&$3)-4LIZh9&j%p*RRji)YV%%IyzSP07|XvACeTQgf1*-)zsAylga}3 zE&Ak*Qe9>;jEsV!Z(*_UBtFlOd}&0TBv(H*kD<`ZXp72Po68 zUWw@FkZWmcg9NubmKnTDr62%2=h{Q4ufHEWM9;(oAyYmWxa-8k1c=@`M>DUx!gd7t=e2IS2v4Cq@rI6r5djbHPdB%?5IVUN z=p?B~2LM;BU0>?Brvl>M>Rw6n;XVVFXwR~SXYl@c1Scq2lfO zK%Haf+pG)%CqG$OSYTpdjm}O|`bW{DSN^ZQ6#2guHZO+gQrCheIDuk1Cc)~~I6bQj zK886Z%)pf9>pVI4{CE7HXbL$%jZRFQB~y;f8Uq;pZYN+^`DGeVzv;i}- z(R$NdH+Z1Wbh_^exsQ>7zaH6JX0~qtdQFz>&GJ(NJs6=#ZlDySOsG@Qy=^xEV#c@` ze?76cOnX2Kxcpam;T!Lxv$QwEGaayWU29NjX@h;F7;`rFqn_lXpMd_YPZK}%69io% zv=h+w3I6*(Cvg8ieUhW^ZY(EN1CN3d8u1$i`dUO+SfHPM^>eRweN0M9x(w)fuZ|}> zI51z12-Ti3PlJ{Fe$R0VM|OiXfrXfu#9y*}{f}BN3I_*wkhDD4_cbl#KVS0%{@2$$ z|C^IJAYa=qp<`sk;Y&paFqEntD=Eqn4?0w{G`X*g`;}EyMRLbQUV6N4!Ukd#kQukO zz8m+CdO^ocd}X9Xbfl=QjV9cjwsMx9A~BQ9jibqwrI4?0X^BQ2d4*_p?(&k6(Yy@x zfB;P8m+eQn@3&%}GW{{)S)&zd61n4opG1)I=C`JPWIjOW`sUmy`_;cmk5T$Y(nX}Cydf=}DBD1B z^#*w}45YNQqAhrp=49eWK5)s@Kg?vSQ$@5J+uI_P*Jpb#V&9Jzs6q@3hCmyIZ}+w@ zC{6>VZ)r(L%X+2F{mO=07{kk}(dJ~$72=~&1ilFIdrRs6ma=6evz`BQeNvW6zRm8r zG$9Gea|oaU7M2Gq2b*X#(TI@qs>ZbVTyCw!1xy@!bQqY%+9T1%oGmQmfSObf6i9{= z0~K}%z!g1nbChLrFE_`00_?F!H*FkIDICBnShRvo?cBcnjY8j3jQ-((qmVBMBsfi` zg7KZGq@=GE6-qVr?k(N9-G(t(FU6gFfT*fB@wW_c=scZZSRVqNYXm?UOd)S2+=!=& zH2waJDTI*-!$2?>xM3;0uCX8)g@w5MRo0z#PsLsCp>aZU;eYkg(w07;Gfr^-q5#wd z3V2#d{?|2X=V&_!AsfSx&lVP8Ac(@`@y`wnz5w6p?9t@AYl76s)^X~~o1USewoVxW zwl5=kR>2v!mfYfsXFPnoFc84IN9vs^q-Y&sJ{2kKOa_2jS^pbiH0t4$XY$;yyDQCA zF-b|E`DU>2ppz2LSp+ZC*a~h9dEyw9)pR-@JZ*Xta(NhqQYjQnt~Hyht~#AEpYQHO z>e8UMOitn*d6%L}NJzk2EVheOm(RcA;CK$O&bsLa9~;LyqoHAE^^-uIJJ8(Y^{0zd zf8K>3$ZT+Vvqdq~+&3nc86uV%F;`oNnUAs_O3E@N;H&Z z?XVIqOEGnIBCl|sk<2|)Mzau$+;y-|3pH%OU<`YrGI<<#od;5GEMhiOQ&RK|4gD5U z_9b#b7ufkBnLmGT^=MYmQTy*pF(CEAn3Gig>gKc*S7zs?z- zeMPowL;#X(xl$tRFXX7y~^F=?N&e7y@?sXw|}$%<5^e0}=n z^63u&K7O29*{MCa!Q=WUl1;CL64FweCpD0G2JiHA%<*_~S};?wBeSu&$)#2mB%^X_0mY|02((i-^xHT8kdRl?-L12;a2&=$eh2eadR+r1P+)+RR#o|igdjmy z!nv14b#z$1ThXV{jrT#Zo`SZe06}S*k5m;Vtd29r%3zS_t z%teH&oj3(T7>+*SjHZ^_K0|=K_3B?)$gr&QC2km6M`3aK1 zXr9)MMcGx zqbHX)a`M3zS%+ylGiT#X@adWw8msXS%`lLyCLs)a-Sp{=*YN1boxXlS6dGjwq3OCG zuWv3a9OhP9#gbE}TSv=UEoaiMD$j+A!^Elm13p+($=c5^O;p5P5w9mIaU1>VlQ?=S=e29fbk}^vZZU&+jQ~px<_h)W7c#;wdGqrc|5fx((l<8` z^?tfDEL<+dr>4OInePY)7LO;9vs#H%VnOSR0Z(ng(OK;7m*#{NTv#Xs_b7|??%=b) z=V6>6dEMx-u8Hv=(Jj2S_A?c9yI#|^W^I|P)P2hm55B;ZaJeQ0{8f13z>@jD+Gpk| zhfJumut*oG{R+-)wCkNJTkX-jor`9-fP^|TJ1h8;Sdd(!e6T_n;PXNWFcj<%SnBA! z)(T*WjZ`y0g2hF4EpPt=stIJ5i;;a8gz!rj+2sL9AuqreMJ>1m~sk`g)j9w+>OR{%8+HN5T&fz=b& zU!u+UDXCEM4unHQQ>jmycN+mxpu&nu##gxc^&?@l6e>Oa_E2$`VbCR%E{;V-kNoYe zPyGO;hN5$lFLCAn>qG89^XUT%a}smhcw9#%?SH3xX!I-%7Y{#IFp8@vDYq}_%pJZL zU@{Abmk4jjN`ej&DD=s?Bj5^t{lsL)N0gRiyUi}gb0immCDwoIaOx~N{QoHt_&+yp z+z%>GD>;Ln30J0(+P6}v5qt!I)}3;zYHN>!{9vQ(?e;S&N4{MxkR|*ZFsj56tcQ;l zi=@T=yF=&9w}_y4UE{d(%-o#h&^}usq@#o6?>If7hu3_$%X#g~8GatXeI)C5J)2Po zhCnKu;r#^TmQH|&NBwGt?*8Gqp2^j9Q}K6)CVwR4u)qJ^3*g@$)yqJVYHVs6AmsU# z!ZsXnhqS1Xu0ld#?88DsA|lZ0{Qb}UfPEzI{zy#p)s&Wo#;pzm+n7zO<)#4lD`Y5B zK|y(_?gthH^q{tZ0aBpBTH6s}tP?vn?@bp|GYg`P=MGyqxEZXWfhZ|LSKyym%bSv_ z4dT#S@bx)Y$=Tc_qm6^z*Q_kXe?D zXrPV<78ID*HwBN5Zes!uZ>4$-4+svBB3oO5vY878VxH z`*s|jmX}hyHI)h6D4xiNcu8S@NW&n!#ioZPg)w=Di|{O0e4@|8V|VT#r#j85y=cDi z1J^>Gc6qXKoM}GVk1Z|JpQcGGJ{kFxD;)xn2B2bI&0 z2M2TJo|kjxN8<_gM~{ji{jnQh@8+tvI^8g_yIS<_!;&Pe9le{wzROd+-4pZvFq|f+ zDQj(J)@ND0^u1Z=Tu)=VY6xAs-Wc?LB(klR37nlP5_wMXlA!%nt-H+?mR|O}{k+m5 zqF!mH?B(8W{pV`Q(|$^Q+u|_j%vn;rDKN8}G&w7R{Ci+v;6Ms52ZrFeUROjTzoVn2 z-Hd+FcFS{&zN&evc#v1WP_J$qPUWXB(x`kN&oW;*9jn9;j-qqFB*F0@*VFAWcJ`ReG7R?Xn)@J(_+7vfEaIsI`J6DhVoRyU~e8foiO)ki|6^&jTLD1?jO?F-!>U(@zx`0hoB7JD~>x(O!` zOycp#l(2>;#Or9FAxf4st@-r{XjDe5%1{_{JYL~Cg8pPkV0#(?kr|c9ZEQK0&Y9 zPIqTXzl|S$qp1So`*)+kInEoHt z?)zmX#zQHI{VaE0Lpm1BMV;5XCUyNvsO^v-%-34W&qEf2$BM`8t?mT4R<=Qg&5>-mOdz36)D zXbQywNn>at`RY0io3G7vdwpQ;wi;<9=%mSAH&z#1)~)SV1D;Y2s+TjbD+O)GIvjxZ ziaoi<$;Gu*%>R@yl*(ta(VP1QWwaebn0i>4TQE}SRw{yT_iv#_C11Su<-0OO^BHug)i$-n;l=c)=RpUvl?=ATp_7kA1i6Jb| z^tuUn#a3c&`jFS%(K59}!SCOvX-h}F!C3Srk6&+UR|A(Vj?0!Fa_h%Tt`<4m&S!~) zJjAyK)8qM%?hVUb`JDEDfUX$EMz@2c5FCo(zT4X{a!;qr1;gPmk|%j620`b$o30ZJ z%1#YejWqUS(nlYF+ZNX!ZZoGzF3sv#YZrRCYHL+_s7r+L@aCqvxy@Bt$3vZdAWg8p zu8n^v=MV>qb9==Pu5RalqdA6nI3&p&9YBvx!2RQu^DpP4E2EP5tPSA3gT?iiUV{go zA!JT}lb&DdI-5bw!Z_XYwlZNm<2eGIbh+mc4MyZg;BD~e#3`oZIa}F8teZ84L7V&K z%jw$Ai=56&7v08pwI5C-bmn8|J`8~3*RsLwSGcqCI(^5>ooQ=7$=7!md+D@^?1mDb z=K`yEL0{8A6jk>xW#xkNzoQ&M6i(uwA1@4V7muuZ_Ib-WjC$CKIL#bDyI$;GNj+D& zF8UZP6r9k7*Md_Vr+9a!8r=_T9;yn}%jqzLuHUA)-tMH>v`G^Q-tM0tF7ihToZ5_@ zUCPl@>wbP%eMC!LAFHygr`?mQ@X7{Vg~p&sMSXE3s`2VD8Aa%}jMQPIrSIbI$op*s zxt;9o#a{CvqLJf=G>_8|{C?rX8hz*{f>L7Y|Iyx;Mm3pc>tb_S+Ji{j9HCT%7NeGe zP=bKSkgi5WWU`8a7#U*8JVrqXLqe>g)UI+sKx7CIZ3P;cWHwB}i8%xr3}Hx60tkcv z2@pc2yFc!__x!l$o^{SywN{-U=g<3+wIJX3z3<-pefG1T{Q-NjvWWgOD1Dqr@S2-F zC%=R;c!!po^ZB&9`pOGA{Wb5k{;sw|_aXAlQ0k5R>Js`oM`AT`L$&(ys~>@~Hb-_I zibUp=nVJDkCTVRplO!HDag6FZQdEfNl1!JTq&`(~j)z={HtO2O9X}t|U_SmjIeO{U zZU5or!~P%m*lat}NZ9=pLZJ&*$L*xz?RMRhUrHCqf9bV}9#2gz0_THBbdu8Gwl1PB zy1>4jrN+2!i1i;lu}|sVqNbO1yFJB;ncrO1-n}!vWB+Z$9Kx?B(u*5n7cN<$X@KD} zo<6D=eB#&6=LCsujOo=|@ znoZ(t3pS6bfVR7tN55V_56k16RujfbN*32HbQk^99EEFo645&tR1^rji(?v`CA=j} zo{|Q!*E#3JakYIXzOuiy-G!bckDl&!h*AnOrG}yfx^l~IQ~%&KP9uKD$%)p|2yeaA*1dDfHm!tY(| z^%D8-$C5_N*kq+@)Yywj#LIztg}MP|x~#ak^S<@M!vLqux{C^irP3H4HMl|0XKv_O z-tm0H!|_A2-$*pGxxa-ZwXsR^22-J4o76i`9p4CF8YNW_S%i_0#cna3>=@a&`banF zZ3E$Z2umTs!5t|TO$MNHIaeP!Zn`EwHxu*yL?&aU`iYEgrF2ds)cr%AdJc-^EgI1F z%Qg#gO%NwB&r&fQtVNx1IoYQs;oT{^;+X{EPvFp8%zRDEO+qpT9KAP>QhP5D>#5fhJJW!nTq9deE{g45Yg``D$2ez)~9AzAEl=m!UIYOGtR0;9A% zalc>Q`qQ?Qg6N{&y*5E)c~bDlZol|ikkVRGOyUS|42)9Mj z_!I;m(}V7AOsH{2DM{jhvGv>Ex_hN-xt=V37X=yyv*@FR?BZc&T^V1Tc1RKbi2H? zhN&_>q-<1O=zC&6=WDlr975`NiFg|bwR(DXn+X+~#24=zUI6HP!lvW!iOOGgTXtV$ z(UOaXMb0!9*Xb{?oEWiA*x_`^yIdw4~n zv6WeDQ{1)4mme*$)v+#c(AU2sd15g5m2vJ5Y8uWlC3DC*{|qQ_iY#5-HescsvR%W; z&)qLzWP=c)p`k&kxqEMRlt2w12&6bCP0s>HRhTH=heSpj2`_!NuX2*&YllZy)EnD@ zbAe^2gJn&(?ZuyiFJGDGa$zSv%r9u|uvvPH!~hT%pUOKGdmi*jX7NHZY*X+zckrS^ zd$}9}$Z*Yv%;N)vX2lg1OkO9G#||nAUy`-1&g?hAwKTEgi4{ac(07n*&Sm-Q^ zPDaot>ewS%CEk6puQm(;d9`7zzz?O_yU|JB0TKY=;1&T8h2giS9N6=D*ZUKztC9ke zHU_9X$xObJy}f-PBPScqUTh#UJ8$y7bqjkZoi#Fznz!3B)+ZXM4XfwBoOIo7z2+9b z#y*0rymBUzCMh%mU0Cu=Xv>JIrtF~jZnHID@XjZ<^&V}J3NqQ%fpVWb?!q}r#cT)J6e;s?vfABL1vR* z%yca#Rwrco#CF=|&dWYKWMcA@58Ssg zb#ZaQ&pCY0-T)K2B(o$o$6R~&%P!hVzf)SNv~IE^-K|*mRW-!1G?($i{5mh{-7l_1 zC6U_~;+J00QCRV*_{Btr$gA0VM>(vap#UyP-2EoyE)zo4L9F;^mLb~Hrvg;sAwHuG z!qk-@J5j}6qOO|m)eC~%))x0%?(L52d)&41^!9cJlN=kmHu_GZf8j8}f1jK^X(Cbget`FR!3EMH>72?5g zbBV%YMv|%(d)*>v29^ZwCgAl??NJDH=8@~ef^v@^r7MO^qF0A79&JQ^-=xLtpBb>& z6fXhInjoL;?W*y!SSHwWk39z^A7`+UP{E=`s|s2cU+KR1;Xo)}C&k9@NgNRzhLPk? zD=&A69lO@9ZTJovIKWk8&?#aFaTrUB3dm2I!(&H>L9G;9p?e6YO#g$!K3kNVo#Zs6 z#Pxyb6*)L<2&=^>Uf=zRj^^P1a4TAG}NjPw3M)J2_kX>qZWA zhESmu!b|pt4UmzTg?;FO?73O^iE0`U1(uxw!jppX@)$^PDIjN{y_*ENF&6PvpV-+{ zNUcjRRvJ_XG0%$y)}D5u!H`RX_xVeNQ|!dWmSc85UY^e~hcuHgzjh0+1a)g6SjRi& z)$m{+Z{+~$>Dha(kloKfntP7hBCWZIDKiY$!1HQf6ia_votvK*z12!bj^CBp>coSx zM@HB*aL59Ol>7|bU|jQp+{vW*;p{+BK@igyu&S{k=0g$i#@H%c+ zY>tO~TgUzWHoum|sgPXs1zFvR6Qz;Yl0LyfB7{qP%W8;$;7ZUozLW*dRRE;tv9)gi zxAs1B)Ea<8m|ru{n~f&>2GAdbkAz9zJLq@9CO0~wZw?F(XX)UG$Dt+W3P7qHSTJ*G zXM+oSdXU8m`t-IP`Gv2Ox6UBpLK-oOF{lH=n(0E#r-`QPUM@rr6j@RTAZ^XI#79mY zukdNKVA@$9M6#AdjwqkdgL{69$MuUFgms(`bMTV^3Xy^d5*tt#RFWDnGmp12| zoKR%8LWbkN(U6+4x@zzzl^dqD=Czx%x%m(>MbLewq zo;nS~yI*T)^?C+@24Waznt{oi>vgetbI=&r1Z8baAD?8ni(m?eW2#sd( zpME}U3ffkqOEtmjDSIw=|0%Uq+tR<|!OHBwVXB-TWEr=4D5M^62m}bhfQw{7E21PO zlTC}B(Iv~4cU#AXr}5zR5zPI!b<-dnw}ix!0og(Z%1S8{nO*zz7BzqWOFiP!tB}yp z^Jy|+CcTHyBFY0eeJm*V+Syw>_T>Q3GY0m$?-07qu>7TgbfF#xa>57EOj|;-K8D3& z6~Wqr4&6Bo7>@(g^|yzQvVhLE1cFqppH5b8*SE8Qel(Xfgdo%Lx&96E*IQJ#^1^V^ zO9(OlZWo3JttO>oiY&kToj@X`qp~d`Ef(9+%!kg~yF+YmIkzx)x zXFV_>epKHLVo6Ars-U-R3Q)Ln+St`M8b}hL7dP<(YTh6UG`JFuxFu8Eyhx(Wmp4X1 ze-e_FQ&zGBkimHa_bw4pmAUQuWSd4oLzr>H=f7)<^2iDa9B)ntuE_;KEe+Q0=za>y z&35%WV;V0FkO!&$ z*HHig4&Ii{tM_QhF&qMcxC^dzMLLOhKkR!`r<)&UwmP0=0(7pPW7;;YL(g0&7C_LPgEpc}WUasiTuMC4 zqQEr+K^qQ0%;oIeFH&*J4Hji3&X+`oG)j)DHqtK3fwx zeu^-5%^@vjMlBN7H{(DGQXax5i74CmTJX&?-$N;dDCx%aN@l23AboUW2ERefRtW6; zLC3Zfed-LAY=^jR8V}Ujy$*K5)LdZZV41tNsOciPf)ldmX(*sM&jXPogg9ghEyA;h z$YHXdv|KyPS>Enex0k_Bdr}?rvOUXk@RyV#w9*W!9T5kOA+yeb*0~~Z^omAVw+Y<_ zS{9H571>NA6ghq%HOdhOP7n+7!0U4%8=+17sBTJJUvk-F-AXwK4-0v#M>%ae=Q=E{ z=>qgMGa>iM1{&}yP?s|xN@gYRI2HV~+iI~%)DJ~0#0_Vm$kHMmUkn5dyw&it8_)~srRwDldhsZ*{Bvo!NgK10QLf?~F8nempAEkzG*&@r&Djx)V^U_zo>kzByj5XzBa75;ObXokrIFS$S*MO+c`jttQr z9Fmq#GpST~J(;<5cw-guklNbXj4!vwRdbx*xKI>CZKI11Eb9uk4*$+~v14pLWa#D5t@PW=cjLe%ue_!99kq@Fb z`ict(ET4X=FaHPf`*%$~sHiO6`rH36@A%hTq_ng`2mZIg!{V~yU7K@pu{JVm!SFA? z)qus~Og5j^%iVBuc6Z-=`pu{Q6%(ER)K~qVtY|X}@~2otAfWYEgs*3`O|VD*b#K3K zjQ9`WW6sb{E4f6ce(jGcDx3`DlM5I^_|C;SFoVn8fBdiQVo7|pdX_?VhvKK}by{3* z-Bi}Drn2O^T6q8Tnt;|ly{BEf(uLBnnVQz;G2UOr&z<9y<3*d-yz2UEBKlu3IryKi z`nA%m|7I&0TDPX6a)UAX<_$fwT|kZv)ATDDS$r`reClNqZV_?0{Z3tfFvqU#Sc8AH ziTml_wKh5re9&w4{I)iAe$AS1YxQ|)oLg1d$+C_ObQaYL$t>iEA#7yErk|v)Wp6^AKeG9jYY80@`qA1ty z7&~T`k6KXhi>e9!V}Ext^?!RqCVa&VfS+@G1jMyZ_55qi`Da9rrn>bTEz}5-)3+8B zH@A;2h$Nl$WB`Lo`8M&bp)j-XdS=kd6K-(qC|b6bx}6{QO`)B6344WXGes6kxi;Ps zv2DFePl#HQxqSlZkOP0kgm(FDLAIiYkLm>VNjLH*)!pd4wPaLhr!?t^mf}>5lkEyZ zEd&?F__!Ev2#>@s3FuQVB9$fw)MO5UHfXe(9;e8ZnJ*Qjm0QR3%z15l-oV1VXqN&YTqG@!t=^C0?e_b$Q z$CV9MSj6dbH^_d%3MDDlyo{Y=7!5{Y9^*&NYlkwrH)ipc zc;+`-RJ<7d?+l}7?xh6stkh-{Y;LD!q~hX^eRYJXjSn&AR-gZ7E4*VUV7MvgQ;I`9 zGBg#UK2)c;CC>eak%Rq^RJ4C6MbU|@|Q+A^`%jy`48rjk&KyX0Y#tb!m=CY z*Hz;#W!)5InydF~NCsTAgbX+N^QidMD2_2ivcA_db}Iwh=S324GJBjI!4%MV7#*HI zPLZ|Iq$GIf?4bxni}E8Sn6l0{Vz=JUDZ1JIKK=}1($~Gp%*k|AP||vb&GOQUkxx@q z6~EvPhWB1Azs&p4J+h#Td}D84Amsz2mo)Z(>q{cL>c(6?70I=07SH9AG-va?$dU`y z@eK=OM{x3GHBm;24>gFIi_P}MU?`}HM1AX3ey&25Q0ASmI=it||NWy?u{g$1<#M`F zZoN^aLdu}6aPhrEIu#8u;;L1h^! z$gUcC&Jb8OS@(TLrVcF1ebfBgR(>xT+C}cg>hJ3h$2#b8O%~}_&nc!<(XP^k5tJkH zn2Fnmt;C$=xLYZDW8sQbaVjctfpy?;o>j1u-5}$2>N%Ci*;1`@e4ri08E&VLZb53>=La9rQHbD_vhNJF)aP+ba3}(WyK7v_sKB#;$2LQeMy9 zQ|t3I@!HQc5h10pyxc-Z$s6-tDM+P#b~+Hf>@gGA7Oie7;1qcoE$Y+1GFYe&OQ+jz z{54<%g7{nFygR*f+|sQB9J3f#c?vBT=tpy|agh+@m{uFMr@HX_h^eZigftM|e4O=4 zK9H*N7c)&|{CT|=a#YLJS+?YpGB+KCZMYg>N8otCru267-!v3G#gDz`TO+c8Ysv`dIfhk{vxjfACQ7KwV6WxI|ru zqbehMtz=%H-tjHDi3V_KG5nV_52*N7XcXvZo+_ete)a`aK$W11|ieo9y&U$lCr zrr(G$-Y0sG>iqp1I+wqBGKy@s-2A`gx-ttDmCK^_rKQEGN-1@`w3}Z!x&vEv6)@_> z7Hno?0iQ4&DS2O}V?nWaF?mKpr&`%5muTr0@m5e0#h$=pPc6Jym}knimR+nnT6W2! zz-9D<7vHXYy=_7A-cm4JT4@!rA;QwG+=K;g4NLsUrggeglh)sQZc!U;{-1*H4ppByw7GoOVZIN*|4_k@^?j+S|T(b-6) zUsP3TJ>;d-3Cq>`FER9$o}i54j`*plOzgYDu9^yg3Qf(Wnm9*z`%hynycVK$bS&2@ zx;ps%r|bL|KFP`Rv literal 0 HcmV?d00001 diff --git a/integration-manifest.json b/integration-manifest.json index fcb94e4..2b7e1bd 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -1,51 +1,51 @@ { - "$schema": "https://keyfactor.github.io/integration-manifest-schema.json", - "integration_type": "orchestrator", - "name": "Fortigate", - "status": "production", - "description": "This integration is used to inventory and manage certificates in Fortigate.", - "link_github": false, - "support_level": "community", - "update_catalog": false, - "release_project": "Fortigate/Fortigate.csproj", - "release_dir": "Fortigate/bin/Release", - "about": { - "orchestrator": { - "UOFramework": "10.1", - "pam_support": true, - "keyfactor_platform_version": "10.4", - "store_types": [ - { - "Name": "Fortigate", - "ShortName": "Fortigate", - "Capability": "Fortigate", - "ServerRequired": false, - "BlueprintAllowed": true, - "CustomAliasAllowed": "Required", - "PowerShell": false, - "PrivateKeyAllowed": "Required", - "SupportedOperations": { - "Add": true, - "Create": false, - "Discovery": false, - "Enrollment": false, - "Remove": true - }, - "PasswordOptions": { - "Style": "Default", - "EntrySupported": false, - "StoreRequired": true, - "StorePassword": { - "Description": "Enter the Fortigate API Token here", - "IsPAMEligible": true - }, - "Properties": [], - "EntryParameters": [], - "ClientMachineDescription": "The IP address or DNS of the Fortigate server", - "StorePathDescription": "This is not used in this integration, but is a required field in the UI. Just enter any value here" - } + "$schema": "https://keyfactor.github.io/v2/integration-manifest-schema.json", + "integration_type": "orchestrator", + "name": "Fortigate", + "status": "production", + "description": "This integration is used to inventory and manage certificates in Fortigate.", + "link_github": false, + "support_level": "community", + "update_catalog": false, + "release_project": "Fortigate/Fortigate.csproj", + "release_dir": "Fortigate/bin/Release", + "about": { + "orchestrator": { + "UOFramework": "10.1", + "pam_support": true, + "keyfactor_platform_version": "10.4", + "store_types": [ + { + "Name": "Fortigate", + "ShortName": "Fortigate", + "Capability": "Fortigate", + "ServerRequired": false, + "BlueprintAllowed": true, + "CustomAliasAllowed": "Required", + "PowerShell": false, + "PrivateKeyAllowed": "Required", + "SupportedOperations": { + "Add": true, + "Create": false, + "Discovery": false, + "Enrollment": false, + "Remove": true + }, + "Properties": [], + "EntryParameters": [], + "PasswordOptions": { + "Style": "Default", + "EntrySupported": false, + "StoreRequired": true, + "StorePassword": { + "Description": "Enter the Fortigate API Token here", + "IsPAMEligible": true + } + }, + "ClientMachineDescription": "The IP address or DNS of the Fortigate server", + "StorePathDescription": "This is not used in this integration, but is a required field in the UI. Just enter any value here" + } + ] } - ] } - } -} \ No newline at end of file +} From 662e1d97eaa397c05a7baafe48b70afc5e7e68ff Mon Sep 17 00:00:00 2001 From: Keyfactor Date: Mon, 13 Jan 2025 19:43:00 +0000 Subject: [PATCH 15/16] Update generated docs --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 98e94e4..b9a2dc7 100644 --- a/README.md +++ b/README.md @@ -190,8 +190,8 @@ To use the Fortigate Universal Orchestrator extension, you **must** create the F | --------- | ----------- | | Category | Select "Fortigate" or the customized certificate store name from the previous step. | | Container | Optional container to associate certificate store with. | - | Client Machine | | - | Store Path | | + | Client Machine | The IP address or DNS of the Fortigate server | + | Store Path | This is not used in this integration, but is a required field in the UI. Just enter any value here | | Orchestrator | Select an approved orchestrator capable of managing `Fortigate` certificates. Specifically, one with the `Fortigate` capability. | | Store Password | Enter the Fortigate API Token here | @@ -228,8 +228,8 @@ To use the Fortigate Universal Orchestrator extension, you **must** create the F | --------- | ----------- | | Category | Select "Fortigate" or the customized certificate store name from the previous step. | | Container | Optional container to associate certificate store with. | - | Client Machine | | - | Store Path | | + | Client Machine | The IP address or DNS of the Fortigate server | + | Store Path | This is not used in this integration, but is a required field in the UI. Just enter any value here | | Orchestrator | Select an approved orchestrator capable of managing `Fortigate` certificates. Specifically, one with the `Fortigate` capability. | | Store Password | Enter the Fortigate API Token here | From f05f9ded671e37091c81f33042fa2bd5a4122eba Mon Sep 17 00:00:00 2001 From: Mikey Henderson <4452096+fiddlermikey@users.noreply.github.com> Date: Mon, 13 Jan 2025 14:52:00 -0800 Subject: [PATCH 16/16] Update CHANGELOG.md Fix version --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ad1ae31..ec665df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -v1.1.1 +v1.1.0 - Modified Fortigate authentication to use Authorization Bearer Token header rather than query string - Logging improvements - Upgraded README to use doctool