From 0e83a77a597d65cc63497d9869cba12dcaec5493 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Sun, 3 Mar 2024 15:54:06 +0000 Subject: [PATCH] Manpage update by job 1161097 --- tzpfms.pdf | Bin 81300 -> 65713 bytes tzpfms.ps | 916 +++++++++++------------------------- zfs-fido2-add-backup.8 | 125 ----- zfs-fido2-add-backup.8.html | 153 ------ zfs-fido2-change-key.8 | 186 -------- zfs-fido2-change-key.8.html | 206 -------- zfs-fido2-clear-key.8 | 113 ----- zfs-fido2-clear-key.8.html | 143 ------ zfs-fido2-load-key.8 | 98 ---- zfs-fido2-load-key.8.html | 117 ----- zfs-tpm-list.8 | 2 +- zfs-tpm-list.8.html | 2 +- zfs-tpm1x-change-key.8 | 2 +- zfs-tpm1x-change-key.8.html | 2 +- zfs-tpm1x-clear-key.8 | 2 +- zfs-tpm1x-clear-key.8.html | 2 +- zfs-tpm1x-load-key.8 | 2 +- zfs-tpm1x-load-key.8.html | 2 +- zfs-tpm2-change-key.8 | 2 +- zfs-tpm2-change-key.8.html | 2 +- zfs-tpm2-clear-key.8 | 2 +- zfs-tpm2-clear-key.8.html | 2 +- zfs-tpm2-load-key.8 | 2 +- zfs-tpm2-load-key.8.html | 2 +- 24 files changed, 292 insertions(+), 1793 deletions(-) delete mode 100644 zfs-fido2-add-backup.8 delete mode 100644 zfs-fido2-add-backup.8.html delete mode 100644 zfs-fido2-change-key.8 delete mode 100644 zfs-fido2-change-key.8.html delete mode 100644 zfs-fido2-clear-key.8 delete mode 100644 zfs-fido2-clear-key.8.html delete mode 100644 zfs-fido2-load-key.8 delete mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index a12d6da892e6351c2497f1cdd713e9d793d6b93a..c0a1f7ff81f56f5f0fe03a911391d65a2eba3df0 100644 GIT binary patch delta 44805 zcmZU)Q*@xgm%Sa^w$rg~+wM5&*d04>Y}>YNqhs4PJM8%T&HtO3o4Kl5XRW%bz1BYa zIaSH;5Dftk_3)s;^v_MF%`sHpQ!RNryOe@t=1knJ7X=$OGYiUf)QrmQIX@gQF;p8p zOAw5-N}qtqz5_sh79 z4@R{ekJe*Y-aDGv3#lNw0&jC|0XB=A0ncC^HLTdErbW*FX# z#$(0uJ$FDo?X-1Lri`AZz=wV&KfYf@jPJIK0skkR%3Tz9mGUs1K_r|8a+Zcpp}M-> zmpZv+gW5@uJNEm;$yHm{3$gjFIe9wDDowCd0fXeJ9RUR6{OkAEv!&%;zTcPCJk&~) z2<&r4)$XeSLQY%QH%n-&zLt4A4;DupgRf%R4>Tal+7}~DA~z_i4`KBlqm~j`D2psA zRakO{D86L))-m}Hz1J~mE<)%CF$?eWALV%0BA&!>tUo;Jy08P)tBMSt} zt4&~OZDgHr1LIW^LxWy6*+SaXxM5eF<)dlrq4MMWYVm`K6-jDTWCOvh8y4crdztR8 ziU>jK1xCLh8?_IWBhYSEt1zFiATG4u-J=|waUgY76;eDd#un{d zLyN_svknp2bf$$Lv2z~AJk%z48}^}TEe_xozdl*knP?G+3FYCg*WV~8__taBnFI-% zykynng@Jx;xn)!cWJ8Te8;W5z##x+#Abm0iTY#eCHJvz)pC$Pjf1rT7gOS9URI`pC zNGShs-T<3o3phXv@qE6v*A2JCKt#ZeBPSe2nk0XLFpw-2P7fix6PhEn}4IS~NGuN^F z8~p;c@WK6_8444>5=Z-1cPCEGSq7wCm_qi7U18uyL_`>HzWm|_%C3o3mz~4F^RU4% zWRl~V##h-H8>!8; zdRpiK!ml{YK1vFp`K%$gBjhiKU{gkz?*(pEB^4=AtDO`Z#=<}Cwx~q#yL0P2qq+!< ztNBJXFk($xL^*06HaoC)3ZQ|54Yqr~GRZi1uzS;7W`-O!r^uXF=A=B~ij6?IG{m?M z|7Klr^;>2Vjf8!-_&LkRm!jU4k8!& zo+>D)Z;`3q7!jB*4FDx{9+A+3QjTq}0=}Xi}fd8`-O*f-_prtmuwxwG1<|eAM=`hsel!#t(gmNj2#B55$A1HU z&UXg+u6>vcvv`|WbJmc>XjpBkwjQLAPg&B1sy~v+D;^?*F#*HCeBn~h;QJIO1uK#+ zN9kDQn|WNVp8=3o(_v0SL#1DzdRzl;H2AxnZ|ltVkaxJ&(C)K(f636yU`!G$`h$Iz z6H7}LtbnVEw3eMeSA+qBbkyO!Wv%9VZA@5Fw%YPat0D9Ef@omk<1R2PJ0LLyl&~%O zBRW0TZ9yvoM1U1E11>0`Q&Uv#03@$bkjsPA0)qn;?et+SpVTjLfsPS`AIK-Q5!d z7-OfR*1`aslJ}2Gj<5L9TIA?6Ope#@NH-ihUyHTFIJ7@28jXtjSB7x7Yh8rjy4L1%Xz4zUH03ei>h!S%x#;oMLsm zeK|Xd4#3Hi{BK=3O#xRr1NAK*|LCHdT!Gd-Zg;sPwx$&o^a<`co&iLZS&bOqKq@0WTINRe&ON*{V{mNvI!r4Xc z?85g@zMT`8q}&_4rb&us8G7oa=M2TaoLvF!4j>obeqdBqvD#ob=Ow6pzw*v7;vJZJ zd9xulBS*oWoW(a~PKIEUaaKqSJI1*x zhWePGR5UXQ*%QO=pQ-#vsKwW#y1Uc7GcZsYGka5K7bi1gJGlSs9DZ5Dags2T{MX9L z!p-$RHCE>TF7op;$(z|*xLA^~vLvAjQ2|=n%oqaO_jHYH+2k2M!qR#gmrK?bS1!_A z%Zw<6`TsfRbB zl6;sWD%Z8Zloys3p~gi+D_>wC2DK0t;JZ6L9aC$n;Npo};=ovC4EJlxVbpiM1(XR$ zCert-mI4+%PORl z>=QA--DPX!>#w*jyX?8GyJXl41C?Qq#kcCR;s*GEN^cx_>@l+Y$igbiB?c~GB!>RH z_MQCNSdPxktHdnM9Pc=$gFlziDlO6~xHf6!g@uk^FUU{%@V|4mflhIC4R%dx0;g#fd&N>b zg^6|O-`r7da$cbf^n%izf!eFf*YlQ38df12e-OcfWk^UTI_JYAe3EuY$K?w2FUV=Y zhy^dnh+UbU>^g3iY<$06tUg%}m38wGyeWo<6`z^djsanb&L}PC-y0ep|4X6UX!< z5pk&%JZrJ)71FiCu?SIx`oy8##-b4YCg{w~7nDNCy%101`lInhnxC$^N*)MHtRns1 zZF20xHEXDl$07KC^vTNd-&*8kVTL34Z_%={|6hS}{70Y^z_gBn^QI(P&!v`pM=R|S z7N`l-?)V7_&(cQL+KOzoIvPz2WFk2%3oJ8;rB3e+!*O5YcYB=$a}cuZPVsYNiWnML z`uVxv=bLMspIPo?hSYcSw}G7!znlC0C9GCobH|y*9$Aq?C_lXcUlR<9p>-*NL+t=YVMMp+sRaj@j=J`Py`hH05 zoo{v1&pdep3kf%>DyAiLF4L&xh`e?|rN!rvHx7aOGtkknh|wo-q2J()OSRe!vz%As zJ?Gw|&X5d$KUnSJ4#Jro(bx9>C2X8cTeYcxz%LG`1KefMvrIe=LYP}I|BN^?qH%e$J}Zol)lXVj!rFXs~0cx@VWIIr}*5o%ZD zJ!Ua;t9qD-e=crfm%)%gbpjY5mi*CWW6v$`SKHeLBukfKW)9IU*yFO<+ zrn&A_l%!PN4`x@N*Lv*QPk)f1nP)|nwRU(o^003U;^NC9TDQEX&j@Q4lD`4Rt_gk~y$vpDH9sSip%u%*i;B&k@a z72EP2Wg*hJHyU}Wv1wOVhUq7PA8TlH(ys~yr8l@j5sqlm&>ylU^D#zqx@9?Ix7S7l92|H4frSh zi&0)tb>9WRDWOoDB?s60r6={PWQZM7#(OZ&l*8CcK+SP$;)gRv?f_2!e#j4JelE<5 z->VZX^2Zbh8bMuAP!{@jrlALiiaE@f_QONty7WH@`zhJL1Q%RF!t3u-%^;IBG%mXT zZVOZQ!SBr|MFSR>Gq=_bmr%9_1!7_7yKFJfuP{mtA zvf8`y`k0X;hILf%>5jVgoY#TIaJDAC*#K45k2DUkz{=|cWM01sUJT zE*!3`qVAh$nZiE*-~N7)uIc1Qn(dP#xnu2zoPsB#2tqWwswJmVFVPKlC#tpHZ*hz;n8Gl00pfx1uSpWh*MlkOM1SJgjL(fcM4h*Cq~vs$I!deNV)2rH=R z`r*gM?kK;WaGBsNx*u8VC!hm?P9TNz$YIt|kpL>unvxYpE+j$07PqvcBDZ>bEbo$x zkr|^B6y&CpuWPSnekq0Z09B||Cr!_ygDJtstE0L+E46Y24%A4#3JS7M)P%;Y zS>Taa=EX%9(Wn$U)?%-F4f@U+YTBr(T3f!KLg>7#>qfj3`uAkV43 z>&*Qh(0jYSq)Mz}4XThx8U$9-LPb31x>9~stoj2XeUF&)RNE% zfa|6+cgtK2HKF;*s#e59-BAo16K3B%wCy_YB5Y#W+E7FMw;U{5TAQr1mk94b0v;Qo zCI0v@be1@|41$>=WnF%%C~9p=MJBr(z3MHctIF7m6t4iA|2!hm=iB;Bj6AF!lX`Df zwx1}N$MqWLU&P`0sSvz_C8=_I)%>k+px(RM8%_H-kA1lFV*xzj7`*Bka(*AjwLHkJ z9nv2*=XkU*@Y5igDkEO49A=a{s#zpxJroBbCzhaP5&n1gz=9pqD5@^sO8e~NSg@+U zVDm8vRz>V)<(9q1X{%vPu^ze3QVhx7QWXf2+WvX_6~2OVm|LbL$0?kM)=r@%P&isW z*F*vCBBh2j5dk5-@3DxfJvM0j+yzt0wpWn_b{irH-$=(v50CvF31Ibre~{I z{~$4S6b)0~v90Mfq=Bju8$5Ns@naR>?L{hZns3K<@V@-e{vv`x1G#`0>vMP%JM`*ggS; z32`xDAP|xnvm=KYze6ZeNAtLmR-OTFQ^d!eTah3C&wOi*!RDs9yY;t3;3j^}e1h_X zSZ-)sp4?u6$3d*+3jRhud88+AYu2B|X!AMi_Cl=a_RBKV+nuF}^k6(;|Ec(~T35b6 zP0>cGgd#V%w)|MHiXK)x09cf7n!J=c*_|_Lm1nv}Br<*NwZ_-Wv)4aUZ#b(8(B_FZ z+`4Q#YHM4;Mm5bCwOik>nO4l}5eJ2OwygK2d5cHz5s93Vz?jvNGRg+ooN+a8Q{Y;qozI`fDYQAJ%ASvw~nkMOLzY z;TJrAD*j@~d&~X;;K=YW95W9~Tj^F`7~Kj;TZuJ&FNe4r3{}i>*IU=Dti;QswB*P| ziuXT%t`Zb3>B168aUw&3TeH8MU^ZdtTceDV5;q=8P7hR+Vs^T&zTi~CUkG9_q={q{ zWbNLxRj)ausVW5Qjp@X#yT(L`@Qo|a53REohM^Ipb{LTW(&Egyed`Sm)8e;bTRlV! z35k4 zufTaM_2wkxd+eFYP91uI64bHnr3LLQkG1{ltknlD_~)L5bW00cHBO!$A6KvE?GNi= z9>wrzI59pzE{oo;lN<1Ts*75zs)|ZWE7N)ada?m`7Gl)UGyOwPk@Ap@b#Ps|5~(DA zvA7#9ZtF75N4tTu*bqsP^~{_54LRIR+mv^6=#e@}8_3VJn=WgHBcEpf1j2#Ms!jXQ zb-{1v(F2hKFDp~;CU({ujuu=~Srsg_XQAdCAWKYX_pFUYksm(?^sr-w%7V<3w|lm(9yRdA>(GYE z>u~{}N-qZ`h@>#Pj=FU!6a-IQnUk%L6v-s5M$-LVn*;u)SC3)ZYe&KABgI`g)9Q*j zN>n#+!GD`;RgoDlW6lqVuszMiq4Sl_WiFz|xBaUA zWcPoil|r8Xh=BWnRSfKtb8j@N$w+Z&B=Z0guyf6;3D$FBpR74TOpkKx;y)*1=AEy# zAuyf6?G!G;a4%g5Uu}jp?}WA#5Sw$nczQ{4hO=>yWX>4FN$MP6a9mRGxdZv!v!zJi z@+y+T{l#yN^cbsrH3gUxrqYGW%aD|)*i=goG^oZbs9qlKB^i*OVWzcMBTJ<6;eU4>r78kehrOUy{T9M2GL;UI+ z<~$R%Z8U5P6F>2La)z4c`aPKMlWh;+Cl+*r#271r&;hjX@)!psvLTh;4~8KA&mEQ?NjI~#!`(38KfQ~}u78t%?g(Of zc8IyE5n5BSx)^eptkEMlj>T6o)u?zIO8Q>%(~TrUrpJ#t$IdF(CLE&;aEVJ03|sEr%{U?W()Zl52J6yj%aVuR!V>>V`b?@$h{ia7&5-7soZ-yh|?rQK! zJp4?E3wi=V(5F=CIVvJK{gmmUG7AL~{jb+aVe)3l0j1&=%c&lxybnVsRi27i_cTJ59DF~|Oo z)rzqwzV$aX!-z2s-kHviyIJWXcSuvH@&~I`PQ7D|iXdUhcOT(N$WI~?ZPEq5d1VmJ zdfy&weWAHtUKVqeEw!JYn!ChD$8K|7;ZJlh=JYJk6P#M2Vs!iR5$cdF43){)MWJ%} z*av%ni!f~yD(^SOdSo-E>6j61F@&`fM9iIe=2 zU&5ns<2uE!pXf`)s9|t$ExkIVIh1xtp%MLjMg%?aSVkfHiEeO7(#TZNZmfIk8eM49 z*6N7NoonQ~wGLXV(crmg;t<7>97;t-ECaoxZwoVQf4Q}u0$e&JnWFF>6D)%60$srX zj*q0f)FSZwQ^f@?2SCVA`fK)|{y!$Em&4pd09-OOQ>q{}jZM93Pvz27ZFa%d zTkoMhrrd~B{N3EFy^z~HP40gft=$92)&vW8$1kr!REpWbp1H=%|5cP5gyu$)cZOEM z*r3yx#D3_g-uQv(MG%Y4B z{F;n6BH@`4asCiNL>@yv7rvJiup>HAYAo82$9(o(;6pSrl!;Vft%JkXgfRsaEZ@|F z>v62~o8)}0txw|{*A+z^TGQ9UTKO;|DGuIdlN0boy+~+jGhk~u81{d{-)wlCZ)*9)lb=F=ywAB_7?5;#`14b&o4OOf zAHH-?y&0c`pJn;^`z`lDF8@sbl~U$6(9-^qIsa_&fwrbkpo^s3C3(rXfFYNumh-n72T3=9^f+rLOrnw z*aFs1#V2P(z0wh%?WXae_=I2um89dm@cO6Gu|5-`eQKjEdd{n{;2-a|FUscoF=LN@ zd%A*GRzMSOU*C_&yv72rVzEya9b`=gv&qD(7Ez~CwXx|Q>5{eSKGe~tKmp!$D?KJ5P~;{Cr-5ZnKy z>TLf-)hPijU571BEJ?#tt-BgDBS-0r8;Jl{v^H0KK7&~Z=}UU7=HU#L>I4i~6ARVH z3Wun#l+QSC>d4Lxd!3_!v2gyhTc1y2s>}oeaPFZOo*2f#&4tP`bCA$C*i9#)S3p)LU z)wDvxgv2j3+o8Ei7?{ym-yP8gXqT(!yGFge0ni-AG&ZuTf~h3 zBL*OuT?fo&ZCF(bd>&DB>@9R)OSuk>1dDH2#StOykJht&7+Q(iES7@0ZO;`m5QY7w zey09sBZP8AR~6rKlrn)^(!JkeIp=E;)4C!W8MIb(qPnDyCY7uZ2re&!<9b?Mh}T_7 zUH}@f>bfmC4C0nH=gC|mkIJOFMCPA4y9}5cl4~G-AYDrg<#2Li1%u@5l9!3D?me3Y zSabV}FZmgMx;&kDxi(~C<_oY5?2I>co-1~2SImL)ChQ;!vpY-B3=7>qU-&%TpB#Ak z{ymY+L&*C_PP?vqX}bs$L1cTOD{7u)qG@{#)B!l&$T&!Eg)!jDn3;`(_+Y+AMS!4x z=evkQA(og`ey%TKHCe)FB`S^AROU7Ujp6=wTO#8mecKp!U(1b$lfx)?tTu{vp>$U^ zf)Qi$>s(rAyL0|;e)gG)T2Bn)Sq_jl23=~&l=v*w3(F52wm8>_|GdL-(dFU`7#sR6c}(n%LjhbbzSzJ zdt-~Twe8Cq{OBH^ILMMseXq>mDI!6)-@R0d=CQ{y#zN`=fx;x|ek~0&uX0PgjEv)! z(7uxjzVS3Q;;}+4nn!RAO~80}B12bJ3tA7F!`TzA=oC$kL0P^oIftgaLj+{`SfpU( zhemE5$__2`?z*nPl>|=@RF2jw%t>?qDEcOCFtK?Par&q}s#kv`6-&M3*N`Ttbd;{g z=;6QjAss-=czhm9tH{aO!#3NosuUq6`)Cr5nh9!pMlWB#lC^+vi*Tp%u|Ov&;#sp> z{^%w=9+WPdvg`JG1gk-jq5;Z(rv}Lv7b==+(wrQ0kcC!)hK3u3LWtN@Bspn-Nm1u8 zMeVjhuiy7UwouK}&k1?TKAraX4UIP=IJg%^$wVLLXu8B1o4bHcF@N^ZQJUOF&oeOqzW z()bk(z;l$-CG>{}>j2b$1HftwYvV;L_Ph(S{Go)|dFPNYf~}zjAbz^*O7TY%X%lIR z)|!v}?)j_!@k?6`X&-}`{eghvo|_FT00iMrYK6y7(Nk3YMI+9BUz1l;lyMX(@~5qc zUpwpduy0HL9sE-QQ+g0b$oj)#0=;L24|mbvOsvfx(Di6=qQ8JWGoF3Q^Bl_Y0bC|F zq;QNMMbovsvHzJ}EEMa)r&6k8f&F2#rs7ZYgxbXTP;aA~lA-%KsF_6rtAB~UtJT3R z@}wwSQ7p|?L3u3x#O3g)pL_?l9ijMJJknw^>JTm5M4Y8am83KL)b%x6*j2@bwo^aM z1wnn|4s@#kZig8N=dxU7*YNGsTR9f_0d`+s0ONS%wW7Hv%077`+GE=<&R|+|xMbWD zYJ92!0Nl9)N;C=~7Vn znZdXqNwjC2`lEh;0FQba>!7k8j^Fxec!RNI?wtCWn-&Ww<2Yv)b!4}U;)wk%sQt(0 zlUYM^^^}Qe#-Qlw#X?J{mREFoM}FuY@r9k8{l2suj`!$cAnd@}b z!G7bkB&^HVzFAaH&o|7V*$~{L6Z+5H=B=h$TCD0l_nBB{i@Yv}na+XEMsHmh_72Bn zUFef4GV^ZJQf|i;R@gd9Q*UN%(RKq+32lnlIsj0xYeI-|8>x}8E=+!$t&99#t16Ut zTMsrPF}?}@RipnxGrN!=;bDZ{Mr`60sRlKDB?LJvZug$+)fxgoqSkQRNp;?h#Vy%y zPU^ilh4nyrBNff0E`Sgf6kLl>!PndLphc|hf@XE255t(WdRd4QnPb^q=hk6=2Lj*F z;)3gWpa0jx|0iLy@UXD_ud#FgpTRgA&;OsWwbx@eC9y`jFX-SxLDfW>)Zw*G%{E%m z+-=*ub!6j<2_bA7DdrV0%^H^)KX@I$zh%E1?KK?Hw{t0Q*8IU6QoFLfZ#q(t!;K=t zzZO5T?5QAXsEB_oeMDvg3k+VZ*;BP*pF>U@4N?Ek#AAza7~0TJS8uUy?k^BOfpyg_WWd?G7m=kJ*vXAIlxPWrl?3*FV4xmRRupL8aCucWqW-F7HgwWBT~ zz6R^#QqO~>(igeyv6dVjsS1UZiJQWe-v^@hWX*46js$7u)_z>DTtQazm>WfXouN%V zCNy2PJ1#xJjL<(POoBHZ-goz{0YlNFDmM3eK)Sx#hOHS!7^v}B$rSy+=1TpR&4oC7 zl^+@2RI%W|ZOfIAj^;p86K zvooP}{k3NOPZqLZEH`Nld`y~~!YSA>fivgh{)o@tkGBJB&%e+2kGVVWFe>s4+*-2g zXFH})`A74d1{%G*Cr$#5;oj-*IX&P}E=x)e7oObVn}-4jWudGlu-}cE15zf*0ZG**WJHXHKohE$bsZC}?A}e=}y4aHI z;^{HHTu>zTcVxPPhf(Q0gLimjRMNXGEeyG4{LnOLF5DL#o=O_K1jZZnj!S~ug)GH& zBE+rOY&CNqWsC#jfS|iz96U|1VUPh&2Gf~)ng@2%_9ogGeNLY#}ja!6iFBMHHm zoZ=NMqoy@8mLV4Wg(wt-nUB_IaDtcY4K?#lnIoO%VxA+oh3XbW2`O@s3}qPuVQW^E zGL7Cv#{rWp)Pm#Y8TH zH%OL)s4smR1#c^wf(VRAJ*miDb07C*Q8qo1Y9uSEDdnJPZco?8S+B=vpQdPF1apRd ze!h-hS5H1Hl^Cm3+|Qrw&K|Fq%kBS^6#uT% zW)r#k!~{l-R7cVkyep?s0v=@w_i+~lx3&eb2X@NBZ`qo?(c%f^4y~>pRyn7N?<&oD z7hPSfJyhsU%O>{*ysl-xZ*O}Q6h8{2jq@U`ZuR#MSXCqD-{Z)o1tA)wjX>X{y#(4ob1FBwzQ5x}Mp%tf)3TengS*JRt zxul9*ax!;8l)yc)3by2?a9JIQ;Bj7gXZUGf|J{r#B_Nv-AOpQH>H;y^nq#0b2npQ^ zL@cC`%Yno^En0Fzd~OGGrMaOh!x~jl<1bkIfPOgch;AaOgt0Z_EjaW49uDvq`5@gw z;nHn6Br_3a0XduTdB%J=H7c%uDrYuxotSpx00>>Nxna*Jq z*m*W@ij@eNxr#UHWyVQ1nVVIOdmVxTcDdv5eB$Hz!ldx{|w65h>)NFn@C+gwJIX{_N5=b*} zrh6>c>q04$__oza=!nj*gK$PNt59h?`ES>zE^NF9Y?Tz$q(mh(&Iouc=w;86L?NPM*l+Lr6>%y#1Tts(iq3Dk@f$kP5D!i8-_%ixjq;3wF1~wYeiL zy_dVrGc^4?8&l0{?lCf|SH1g_eo)v2E^%lg$PO;Eqdv?ttLQ!l-m_3b1>v8k4;D)b zG5YJRqGL$528p~!1ab=&pr^|MnrbL$p;i7pcrX*ju}@tvQJYSDsmPdNG$JI2oe;QI zYYW`@a!|Gk_LH(4_cr;$ICJSjC?q`#^-Tl|D_zVlr2aFfPra;1CI-?_aHK|lUC_ds z;m!K&>ixb|JK-u#-~*$B<(DSNN+qOGoe^;?eD}-mda!nx!F)E04#E~dsSFEk`%k*j zUX@Z;&c>Nb#nxe~QHXFO+6x_}pCIP{hA#>h@!tgQEF{H^y7ZZ`#2PX2SZ$g zO@88-3Tw!UO}#MJ35Y3@m7iivCHWZCxdi`lXHcs^>%^$;U?GJ!*>BT%XXNN>s=TEBNsp^v`# z`*^)>d8Uf2-phq7I#FA*R1%eK93g z`ajnJjpBahI7&ZbU=UwT8n-duR0badWli(p5lbvD7}3mLT8kPf3Fcu|_t_}r1;tET z=vz=oydpb4@I(@TFG>rZV+CXO_Qm8oqS~O+j!-p>4eFMvycu)Xjylx>$_T7b)R*j* ze${gArh;4=?m{dLU)p+sE0sQIeiUjKf#whchsjfC>th2(HWpu2SR>kIwnn1cP5NEo zu~HFvkr%e|Z$V#XiDw%;IgJ+Rg1nMBg6B@Y>VaCql~5^w_amVxS7WfVDB#dqck9Fq z>dolrW$0mU(9vQa*)3&c`Qvru)u!3U)9=-K9)y+`((HQ=?%mdMV*k*vJP#I%7mL|x z4P^7mo$t)ivZYR*Zb~svNgm#Emo)1X{eEN-mibjtt&k{;WE7J+*f&94X*7uMZvnBZ z^=$YEQKsuDwITx*9r@P_WZ>i!4rT{Iv<1p}+rq9z4owJ-8FN{1}K{ z4s4l{)zeb@Tq*Fz+9_WbGIh%8Q(91(E0f>77dQn-B7Ih1!c=aZpe~^&zbd}9#1Soq z5|n>3AA}8*8?!AWyze1K?#18L5|(6rK$!O%e?XX=7(G+YH4Y@a(Nx*&wt6lmk@g}> z+dM5fln*3p8wtJ!>vWqjTv`<{j?%~0Yt-QFKWdg@BHHv2&K zJb#09&GK<})sX8Sp$s)S>=*vGp*<6tllR|k$i=?IzkSE4ANv;vho_WZzgv2lqi|_> zXv}0oD6}@C=!*b)h4JNmvbRxerh_UA!~1^^LcsHKUhXj9dp|uX-K`goJ?f{tIkMb_ z%|A{Pc1+^nit4M)v0QT@xTIvMSeuGnkx!H4q&Ejd#G(20?@1&uKaiL-OLy!vTR$&{ zZnbgr5>X`=1;^!0{v~0Vg~ZI4%*OJ{s}p>9H_gw-&;*94{_P!}M#t1SNludOQ<&>9 z{WIPk9kQQ1Jl0>{s{Gf&tEkAh=KWgbKJIp=0Au@Q>k9_f!d9nn)Wk(i2xq^Ddk z((~`6st(BO@pvPvM@VO7mhG;1AE<6Lr)IMVx!n7Vmer=vJZpUve>D{?K zaP3jCV9>`n9MoF9Sxd6}DGJHdzJ0RpyQ!YF*;*CWWtVTB8v`#0yVJZW`2O+wF{Nng zagbbUmAF=xhCCS*9+ot1GST}Msd_Pk=lsJe;T=Hn_1N6qZo2+Hcm*Ygz&5cSrrt4v z5Tvpw3K$~G)%njuUwHO52wW8`6Xt@;QYp;q^Z}#BKR<@gaFSL`BvNw>Vd z%VDZHER&wz90ZHbWG7U#uCNgWecC+!GJ}Esrx{t?kjOm`2os+MVq`O+c7@;B2J8ez z^hqx_LCOn!)}9Buko$M~RZiT!qalko=q$j;L}DOjj6Sopz;VX0r4htQGK^Cu!z*#h zbWuypC?k<-w^&}XQg}1oszbxtjCIH~zF%vwlY>)Robfc^M!Z2}ZAhCv!=ReyW?m#&gGOEVt8i)YN#-k=-kBvU#Wr4PvB zp>Vc1Z+?}_1aJ8*l2rtA_mb7Q{gPFLs8t>U-QPnZNGTe{pg)A%_0*b&PnDv^QDq)d znoBM^5y0188SO%el3-*CUuPKlrhgfUO&9O+Q}{_XeX6K(G+jsE8o1f>z*(kGFmlWK z_x4jQ=?_hOE7`dIMYrZkDq0?RX#n6}qZAv4`$QY^=p|#vHRTEu=vvlqdRe=@vB&yz zDxUP@h7ugba47KxB;GaR71F;RVl>H3p)$0*)}~8^JmwJr;bd}X;xb7-2dP1f_i4LV z5-VuEfg`!z9%{K~zEXHkXSL$T3g=`ZanJ`|(uo39%ESk@Sd#tIx|FV(;w!$cSl zDONqQA{uD?jO~v0Dv@+)K?P<_LF0`Do?2>sm;zOU=dQ9}oj}b4rEfJ_R5lKU=h-qH z&-o>s{jsiVu;@G0^pPb*Il!$PdLg^BEaji4WnJHx5D(;!*q>_0L)gOv`i;l+5vguK z&=SJ#Ma4%)iwzDZb3{QxYASnow_S1S$0kO7b$m^8^I58yL~>R1e*udJ8R?rt?e)xz z5L7(i{#zISUFLt~I!kHQXH-J%0Z^)Eg*0+<0L3;Kw{si=t@o^0@QUysHaj-0HRYBICcG zWym<^Bv{>iOK?bY+CWwu=*g?s32&yma*h(1*B`hmiE5iK!X*oH=i~Q7 zWPDfUtT%MXUB^C_pn|r-Pc~N8!OepWuEqeBs{vwu3J<9wI~J1r=a`q-4LZ$~V|_t)l-q z8B6syV!EZ$C8(?>W*-9Ahl?sDo62658f zYr7w!T|!6*vjn74)6Bn!^naBaYhK>`))nb9#seg6A0%lf6}}zJ(OQq6^xRga3N07e zY(ZEVT_xuIZ#Po4&*R6L>~zl7)MQ;^l``qsx&-x;OuDGtm%H8R^7-iWZZ%`0cB#dw z+);8x$*|lKQY`1}ci^4!pE6)ZMCd%S+fqvqN&@WT{}t;nYV6vWE|Qme)8__Rjqow# zngJzE+#+YV@0|f#%_M!xH5zq4=!rqc{FR_Q)UcX}4mPH+R^Ly&Z5KclTJe>!WNj0q zLd(Prm+<~Jz@GXa{h_9OY(p|;49lPq7wklNyQ64hSRPLZkTs?EUQL*m*>sJk(uRGs zc`$$Zw4meY&OeEdEn(xyha0#BiLb7vUAOoQ0E+D zmd*b)S0RBqW8j+o=LfEj17uH>e!|&E=AWmvl%ll;`3v>dqPW2+H&dCCGK(-z3b7I< z-w-ypK<5muk?M#7C5vAJ>8vd$ov|y+f!J&3W!#W%rdav>hx|{G*gu9JP0REdU-W^n zr#nfJX)T)}LRQ>?1Smc^j_3gR{%e_HQE3^zEa8czJtOhBGsQm`>4=MKqYd`(3-1Ca z065{(tFdNg;Cx6{m17ezYk}qig-{J^5M!6$N_-x%X#l1|zf|5Qf=qI>fO6^)QZdeK zOvP`wJIUGQB-R*pt#8}G#7FmQzb0T1G?R!2eD&g40i1o>?S@f302gkvlC}Gn__QK7 zz2_!`<2VTw1s@wOpUVKs+#RAtAS&;Z)Bh|>y9ph0&{lZQGC?|OzGQ346%)}<{JfC$VEwsBZhgci}p zNAg2jXa<0vM)_jOVzSIL3VF;TP_WZ1yNt3`y$_^=il74iHl}A&c~%>ZP5mB4un6t8 zWd@Q8{xbemg$))UA-oJza&N6USB0aHen!}wFq3i?N-$!lf%uL_aGAG72ch5+%`>wS z`lP0eD6wDFMS zi%f{nF9Ye+=Tw%9Is5ULc;0K?RgiC)56IXo-B?al&_ghb6FN2lxypJi_h%&?!wG(^ zf9*Z#&MeK5s$XA{IPT`c4I&%n$99?N)BJ(g&yF)%JkRMQ+3{9ZxUdI5V!!o77C1I! zjs!SZF&T;GAqlQ>M_=N9Fgv%99S)&mGHUdFgBntn8L$S^ggT&lcw->ks@t+9H~mFN zIcexfNesf%h)rYJ?LQj)IOj%^3Z#QXQkfR*BEdX6Anc14q~{)NT4CLpeOkHLq?Sg6 zJZWa#!C^~3v7g*AAc;+`anxf&vnlNAPz6lD)5l|lPH)icV*bpv!`_1&j(ue;)>4ie zQIVBR|20MZoFt&v;u2Odq#dJOn~e#V=X7b}n-m)BWQZJn$+2<BdQ6bR!4x>;`a3>h<>s*+y)H;Je#lsOqAMSgLgSR{|W z995T^YpF%UA&z@i9&+K_&Jdbq1m)h6?>Y!qr~;EhOM29ihE+kRzr5WDDukg7Fwy8}!SNY` zRseSF-?+6&U8S?^qC@d_{I@JviNG``?%Tw?(b3?J911E6dSZhsSP`g68zIGv^T}aT z1G5-0n+2H#NS5tk+?bZUAUB{RF7ASKBsY;>mx(GL{0A^sRX8%jw$2kgv^l4=Aw6vc zZUUa`)_dPq@CH;eqVo1#e+cY*ugL8+&QHd%!ro-aCMP6c5rpaJfDliSt2=+%hVV_U z#q7X&KewM?>3!mVYsPgvg$~SjyQI9gb|B1awoY14gp`m{rx@Ee8At$v$sm*K;D_m5 z$V)th{R5APkXf^NMa8d&&t0zEH!3e%uhg+h#fq46mv<^rhS9g>-c*-J@(>y{C_%^P z(CNCFY9#sTbprGE-=6RN!wE}CLgty8O&E#A^S-5mSr$*2wd1~_gIHvUC`38n(%q8M zVApT!D9Yjb<=eOWEfVs=VyA|Hb25PhsV2;^n&9E(=;^-^e!N3}IDXXsf6{k$w*SVw za&iG1L_``H{QN)xihJ!B!Y018H=nn%{`TN|)@rFmfkdTkyw~8fr{{17I%wg(!I6=4 z_Ul}AN6ky$KD3%o@;a+@<&3t~A-uko`nWD{;GkmJA%Bk((O7$XSb0VA+ zBM(e}+lx+0S_;ej`tfG~H;2Edc`ch$Oa!m*N}M8s990QN6PuoMiDH|=OW0a7^4&?d zzN!CK*-%1B9&DZ995y!vTPQ0!lN0vQ2b3?4%+A1|)6l?f2H7|Ahv`5QrYM%yQFQ86 z${7?@OM}AzKx4H|*4*Rn?)2gH!M$0#R?DFl>+In1;`WaX4=vN$P!Qtp6c8^Oxj!S_ zmZ)k;FIB0@XpoS$C=ie|%n;VJ+9)FD)N&G7<8c1C7^vf?w6%2ga^aJUrF4DKbe3tqW#emT6ZP^jzwdE-<(BJ*cMe4ZU#An6~w z4G;_;aFoZ+bpH;jK`A?XPu=on%wS;a$e?Coyj5D`P9%j;Pt1=X%d43029Y4&LqF<4 zFpy%!1ITo!4Se}#nA^#obTN4FO*^qMXxBDNNmb4c*JX*J>U$Bl{0g#t=%hWB??B@qDEpgF;ZQ_P}j$m5r-3N)vX!Nh#vZ^$6_M_agN2GxeLDHWEsTa&R6c9Ukc5wi*uU(zn!O*Zq3{W%+HtD1=o@PutaBgf)}0Bh7`5z*7idQJdB zh7Z*xh(4@b$b_^P##9vAm&|mkU_igJ(^Ybd?=JnuJC%8Kg}Mfhp%9Qh&Z6{n0j&Hn z&NX5R_!)px=2B=5=ft7+mpsxRKg0uP3<>ID#KjjNOvR!X8virvYkMFAP5#xxE;yy6 zJ7`_(5rZ27A~5DReYQ*&DcE*AsA2GW7067?A~YmkWA>#DUvVFY;BNOB!Yx?nowXr$ zkarvG++(Wkk90+aTs4-!DOKs#Nq~PAh)jAMJtn^+ld7?ijShor6n7gWDi>4~Bp6nP z`|{zkZM&bxvxR3zi%olUlN5D4exchgyv%wR4&@-YigCOou@!bI_U{D7+ZR@E&J8=d z1;*N%lBD0{>%0B>?x8K#>mYu?j|#`iC(ib`>2v;i_sz|-J8!4EZzf5QE&ygU{)*mdBmRJ*)Qe?Py9)t?2R}Vb6fd*^*k+n?_UarGvBmU9De;V`>}Qf11saUZg}_*&G0^?8`EVpIy5wA0cH6Bu%sSayZdO{byYK7$1@^ei zh(2BUgAWl!N;%Uw7RV7Ao1sZ03dJa?>@KqFtHY$Ry+&s(@5bNiUjbgpMA3yLN0z6E z@QW(@%xApS&?m>*d%bf`-5cHV%2K{NAnPw3(BwKeH-|| zvXJF57ACrMq*hd1x?|t;yZd0}X?h-%&MsCDhAf_QC$EXM7Vly$Hsu{kejXZZ0ny4Z zF)QS%a3kjSo%E?w^8tDctr8gIXtKy9p91W2K?gdxS~{R=;-N?y$*D|-E`OcNLi5PK z<-)G5!8h*doijBO$~)`12$%3VLn#P3T+n%;nCHj8sfIzviq-+d%>c!%cy)gIJ-+$Z< z1?g?k)Zj=4OZNSrX&3VxgDW)MUXtgbsFriMJpE`5> z-##~^Hd@{qsRztinjsVZ;t8tX0gC#5yvd<_q_8i-(;f{bdK$c^T*V!jGnIC{0K%AihG#S(WVDj5YvM3pUfC!~#9vtoH(LC9G$}E}!-+ zrxROnOWq)ZZ5l66^ z!qTIrI_g}lzvcQ4E6qdB#gy(dx@==}K$)h@g#nV@l@R^=G4AwKI2!f+D#DMF96Whr zUUczrYX~v7ar`~%-P--mZ~K#^!T5pos$1y00ai|>?NSWHRE9p2_R)B}$OW4SB7Qn* z*`9BN%Zp{qT^sTrh=31dOfhUAz6w4BD>o+xkXJX*!`<)Du1^m zhp`&dAc?jyn;{`vht*G~zHVxED8+-|v8?zPfQGE&HXp|7t*iF6liHd_cj+T7YG>V6 zwAx6j;x-J9-qmw%zxKhRf9S+t^GH)$*gnRV6YkuV`Zd zfWoe_wkFH_p9daYIKez9Qkj3b)x#P5GxYVD7_oyRMB$+Nnt*Lpry5lTm~9GgHb)OZ zhunlak4@O~LwC;y54X2AC0bC(Qyuk;oXONP?-8CU)Vq^3imlD~lYN3i{=m@7Ro3%& z@{a0Qsm)lPz%;J!Nd>XL<`w+fX%)RF087U>S{)+soghZbMGE17ZA~krp8Ctbr+z@5 zgc|5_<8Mf7Xh4~B2MKWb^`oP49lVh1#K^4DJPGD;iTW|PAJN#xrx`DUf^Rg~8eg#I z+VHk;FD#>B0+)UP2U0X+G|Bw$Lek>8`F3m&@({TBDn9XtpdiS)7oP2yC2%A^0Nkv& z&jOXLH!-R5-8KziwdAW&T23kcnb@m>wNRyKWxj_YxoeXaD8zW4h$+TmxVQ#>nPLw*wC?0)@7HQEoS`VRj}s#*!Q`c|zBFH$%+vW0e51KrSvhn< z#%m`OJfy0VJQT81;}O_2HzLb$04q(1ID_O;RA-)7w9&!juE5cZObW!sn&3Zae;BcfX`X6iV;9 z=sUJK2;9iOeDJJH4?$5ipqYdE4_{3Apm;cjG{v9$Ec2|Lf7WtZZ-=aR0tm)==NQO> z@v2Q!z_c6QK>|60vt)%3Y=m+tF+tXm+lv^(`pD6u6u^JHn%1&+WY1m{Xr4iq5e&}a z@ygNPbYLA+M7Zc=c}l+u5*)cBWK8*YW>qE-FRq(wAHrC~fH}9f70$DC_NuJ3Aru zb_X-$Ow15VWsW9Fw29I6r$%Lhn7aqJucQ{9W`Hm({6e5dsjFyRlZ5+c5mvk@ms2>= ze$vuu(>l@8C4>q)4hEb!-v!j29vL2DIfEm0yus}&yUq9 zaKDfYEG$=-ZRBrh1=rAc<%X1mH)WD;}e}KJblRYek4l zph$#9gV|d6B?MvH>gBf^iQOLu^MfMX0Lj<#1&rMQiW5NAsYEY%K=mMd${KcWF0O*~ zAMBr|O(#=ODydb(MkoLnuEA<5Jl#71p3A1gd8ITVNHUU(Iq|{^wQg+c`P@kH^JXm7 zPsp(__j+p2dcc~SDOwvaE#<16bZYN;-%F80?G zIDxwSipj-J4^6gN_-+sOQXJwoIjpD}-Zsf1vnL?5Qh-XrT5pYqh(GSf##ru_Bs2Jd zHOapXR%_W*N*>tHe`7K)^zm;{XUMwR!Eem4c)f$5qqi?+AV12+>mH*!PDnd@S>#Q< z5swuRvKFMkcO8<82IsGp=WfIeH*k&kW?GnI*2a%}d!cv>Cs7tP3@0ketRzyBE}5#Y zvSIj$JOj$mf^WvG(?p9U6`y2G4ciV8_aq&{ZlcO*~LIb1Ba6WD%93#5jhCu)_;&dAJM=6@S(BRHa%wl5;&EBvxoX@e@km$euAPouVLf=x18RQuI&Ng;sdZ{G4jILIBYm3DGMJiq>~oU;qwUAi!TG@= z0KELk%fUcCmuB*aW%^}jQOrSaD<4odp4u!r-{N1XWql;?p#dX=;&p$J27Z*Q^a-&>3y&|>s-+v3)(Cw+-%|ZcFW0A%@W=8^ zeu8UQA~AV}pgI46FHHBTo)xYtStvwNj#|bPCx-PP&_irEXH0iP$!MSMF%EA4U_^ce zzR0!DY|rpPF4k3!;bh8u57R3&B-C^(RtMpqxNkAtDrFSP zWVG_B0r>42(oRU_Ds{C)Rcl#Lyq&^w<{oGPAVXeSm6h>l81Sk_;ScL_w`!S~J^VpmYUGJ; z@RiDx8>Qj?4vuog2auNw?}?f-YTh`!DAp1b3Y7H}9cgF~7#V#JMrIBNh@@^|t&)u7 zMds#+EE(IeaIY!CsaS-Y6lc}j!p*svYc9E?i#nE#_*L5Wn!SyT$TG`iFUpTjKsr?Pxrj@H#d-1c}CH|nM-LUTR2TZVEHI-ESNoSdziDB;yik9*rG)}q^ zJl3vn7w$3_B5Z1~$W&_qpj+}7Bu;?V1#5Z!C>7gb=JsLe{8d6g8IiW3%O(8DwID#d zgN^jU|Jg`{fzU%(Dx4pBHk315)Vi_xSRX?2wx!LQ^GW~5Mi-QPgI>WGr~qND?`Uh_JFUz2ZuI32>;aE4qHeA~TQ|D`y6WL>S;>ZPfRES*LZ*X|Yx&Mp z#BnqU9{K6q`rVHoEl|36Sz8^mnM$>__mCOUnLas^|70@Lr}&n5&lY<`1`J{JC%ejm z4&wIUpLW?h4LDv=(xmWL6=PZ#ewC6;WdvR~yyZP7IP3&xl^^eRUFS@dW9Gdm`k&t>@_eInHP^`|TQf89z&=w$$5;v<=@li~h z=R9tC50%8lmrH7-sp7GF2;s_lvR#-57$>M6Q&5Q74VfFnPJ`g;3?h=h*cTZaEMROW z(*D0t+S7E!FZlFx-ZA|@;DZh8`2Y7(FOWb70fLR0jT1<(BMPbmd`}_)m^zcQlt_mb zRZ-Wzwu~B{05;gT5>2vxM28{{5{I)L-DY3;THb#1N+VYKNCV7Y42qqNy~3&}B|KC8 zDMl@N*H+@6HUtc%1;srLK}kutekN zexsavrh9sQo_5Iodx60Kh*O|zapt(8i4!Q%;!Ew^w^b2Jb)ZI?Va;Y<2_%oynb8~9 z%JCHeli$0{0vRz%<_}NxG000$xy2DGvPcc2xh+03ruE4BLpiLn`~*`X6QGAx!BjK# z>f$G_gZ4f8=yvEl1?7&0f*VdCN>6k#=x62d50CGsSeVlr&`tz@0h|$4M+0PC2Y{$j zzxyPgI(XH%NY?6~9hzoyT1hu4Tm=%y!z5@{-)WG<8fyjD@V#V#IIn_f_`BK+-`{-Q z{2JS|W8Q*0*}N9wwtxg-ex}OKArO&U7w^b6A5}JZz*Xa z@~Hg5=FFWil8)&yC7?u90$UUmR!=tmB~^RdAwsPa5zJjj36M$CiI(y#MlJEv$hq)Y z*U+2vy1fz}YO{l2!dtK(gvs|ufN5P6XJ$DYLcQ^yhVhBa^=+{XGgIK8UY@l?1x175 zO*=II9;+&4a{fRfB%+qe`ifPlAf^PEHI~!bK_gh@0?F(Y>1bc8fT*s}^%`xYcety7 zz+1a1S^Z(d4LC#?yXChNkDSxJ#&UcR=e9~T`k94MwG)LC-pkvqu&*On+$~?!SfP&Q zR%C=(|M7>XSQt9}g4-x?0N)x^Gg_Y-+gFtZoScFoXNTmYzqu(<$iEG~p+DvK%D00y<# z;fV&MWK#0?3kw}T@rQ1HF&d`XE?L8{K^lE1)VQ*P-%<~(y$Kt1+2n9#`e5U}c;XsQ^58Pp=#9?Y&^dN|&Yp;UJl-Vt(Q|=!gaheI7TO8RS~QUNoOJy4vkO*kS9^K)sJliuRZ}L8NgyLDe_}&;*ZM?qx_O+%r)TZ40rmp zYylKqfmsLzp27~@slsd~iat2%*aQCJ)w&bWqFAgL9NrVpqrO(LsQH|3jjx?qv9o7x z)X0&n4Xb%u^D3V)%<#Mr$8Z6o0U7cyZzmffx+UV{1b93@y(r_iPY#Q~_bEmVa!#&o zg}VdK!@E^SfA?&ace5(yD&kdW(*D9%IS06IS-S)X!$WBGJ7_41(0hM-$lhyN<2qI& zQE$SW1m(PK5m6rWV$eOVj^zxb1wY?$e$D??;Bq8J>t3CI-vT9>`lk{@&4};k-+UJk z25nhrEyt2e=Is6AB&8cyvtwT%!&eTFg!xYn;EMUL9KhgILYN|;x`4IF{EP6wVv%1xk}-g* zi+I9=%e^byOZ=xR4+1*`B)f;~tLIjx0v{FtleJMS=y}5Ec*$63liySc-}lJZ{CY=Xg2$I4f7TwP z`MS~xqSl--)*5!mpcFiNz#eC=Oe+K2Rg;xCoS@&w@cP!+jw(=ZNWe?ruE&bXP^me6 zVaKbSescXtY){w1w-WMcGve4xKx*rKEUJif>oD-0E%h4qtkb$=eiRE_yV8dV*K#{eoB>A4WqC2baJSgkqnenlLO zM}#2*WxML-A#g>JWTfD8c~*KgM>@M2lXj3pnMr zie_l`r^lXh<*}(5#K18ojMqCPSp#FM?mDtLoK9IlNzMvZrOZ=qsTNW!5kQ}+Vmf}%{2(4ZIs`gYo-Oj)DA$Npnzfz(%s z-g&>J)9d!`kvahOUot{s*%`(C`i0t2>%a!I|HzDwv1A$$Jv zpt}qs1GXW2rRMZwK9ecE~AY^QbU3t!%=A{MTaU5vR(yasM zP56sAh&Z|*PR({He#}TOJ6={hZH;wQ9pk$e9}h#%_)Wfk{txf{Ahd#z<^V*vt&b$pFuZSJ?R*50G?m@j`%jEMIKf8`2(69 zLEQFs|FUWF8))iKp8g}G(pKA+y`^{d3PPAJvSko=Rw78BkPu_(8d3~{aFRgX! zf#&{2crfqNHOI6+E$=*w7k~#itgUXz`seoSok$(4RX9L)yP!x2vh^D;bY%6t^fds+ zKZ&i399Gca;3eOv2{`Od-S!3Bf^Qx7>;IeZa1QZL9L@7Zcu2XW{USWHdjbC;JVZ2m z9Vl#fHy{X|E!{O1C{e!K)Hc~d1RnGK%G2mDpuAn=!7bq zpdcKRn1j8mxxK3k@xN5)|8?&x{Qj3jJ=?!+|KT|QzqbEKm;5i=fBR+o|MB}T6|(#lZi!qW_n8|9_j~ z|CeJ1V0a}G#DARp=k9DZDR8Zl^#7V*S4o3?wUS@M1-kDyT{6XaM_a z4}s-%R-nv4jQVOk=CAQE|D)>0!NI8y$0T8I>R@JVZ%NF_2K-Y`0QPmsYZn6wHV}Nx zwn+mcl(deTsElr7N&_Y+khTRLsN0ADtZiiiJ~Re`asoH%3Bfqo|5F7XQUB|4_^*G5 z>#H~DK$seQu&+IsFV{ex1`mvd?Vn$vloVvuWo3a0Z> zzeYYdFa(Sqv zST(vXUGu!{_pR3A`8C&B7eBgVp7(B-&9k?^jDPzqF1o^Af8~CChDZr0QRuO36Sd6j ztN^!QKmV=-J3SsfrKi(dEI}M1w$ROe(%@=1;`EV&$(sbrAZavO2)Ub?l=RWn_BEA< zfJZkwmnx0%J0Ryi9Zr85x%i4os+xI3!Gk+Sl%ndmF}d<6gi(~qBALLw+WT*J@yQBUhx+gFLl8BG*k zw&N`e7uI}p$d?$QZRP}P6oQ?6u1aY>o*`02mPuMo9`aSw;~EZK@3R>{kEVQ>grE98 zAmM|t8K(3KlIfEfO&JVtcI<*YqgTYLC^soLB7a7BM05?}nIP?mbjo?6xxg}+d;{z# zbV{9*ZBqG0JclsVNB#}CCgVhhhXM45YD+_))C`iEz}Kg($kLOvpsq)n4@|NZ=4;T>b@;Xf`Y;g#fzFe^hX3Vnh(Krw?#cK`v3}WB@`D@76a{)NN^j*<8 z(c9nPbh(`nWBb9zXOWX}z)okg#Ng1IY+idb<7LpXYC>HOM@x$jVGU4 zEiIOq5sx+RBV{ZyA}dlMvjo5aq3sZ!2+r<|k69;bvXIE=i*iXCF+%`peR2>yK=erMUu{to$*x_DCxgXSsWdMIhu zXbBU%eU|(@G$@*cq#b~Jml*VFd+3i6 z@Mn;XV4aTqk9JAI>8Pp5vNNybL;xv?S^fck6NDF&pIY`=X0#Gxv+Cuu33?eQmYn`F zh%e^U-g|&W>#L?XI4qHw87*n^FX5WxRZwp8;zvx`C?o_@rj_2{tA4^|qBYr?gS*lg zMlk(}h)Gmu$vp3UGHJl1qqimtZ!ljKqvkQ^jOk^PyI6{y+qay3Ivbdc@>82DyJkXg zD&d|su6CLhl6*6%=k&RXf;HN;lcRPUxg!q2^l+`GGvW5^O0GQef<7t9r*Ugn&0hI1-21r(-u`O@5ERyT12Oq`@se zxCu1ZGbv+)fL{2%lAp|u2XWgyV4x1Mby5NseG%9RmQ9#E#JJSX=5Vmy_{BFf{AuJ& zS{eZ+f^{kBx(|ToJQ$2KD>@r=6)JY~x!jpdN2uG~e1#-;9rwpwy_jhUx@PrUjVi)| z9YMIMVC&SLnp#1Dxca8t=i=1Rv5{{SI7IfG@&`o;6;1LwyrWQP!9~42{nHpQn!y?@ z9i4g}p^RWwV6jNTf*FwD#7CupBdHL$$(edBLp5N&T-yL^zL^U**2C{0gjQ|uxJ5fz z@RoB(PjI@03^z-J?t{woF&a&*YK%OaL}BGhmfXo$dD@KXT8a3s4Wt(wc#Qd3;wsr3 zQH5+fm0Kdv+|Y_{?}vWV+h(;!J1E6-KBW?7UXjn~Njh2)N=mKxn1TKEFmUHUx($t{ zd6u?#>m2}R?iE3shqHjU#P)tP&g`YtV?=DC?kPST6-E(hjvdKGr3v)@6rKA zw7Kop7P_Na!}Av?e(0@XfqVYe2erXdaR(5*#R$Ntl&sp6+_-(>7-yOFai88^3r2dJ zzZ(PFZOC^1QvxOkDu@Dt&a+CM!-m1CvoKMjG1wZedwTlPXoVjfTllJD%ySyPI+3kl z2$lOANc}7U`^E6w74-CC?lCqge~+bPi7g{T*e&aLhq(2^{p`e3lHSN_NRFe3vwaFF z9|wR;77N@&SX8B*qn+mhuT5qkGI!(sYeRYA(aF>9dJfg<(&F7VWYQN|=x`Va>HtNN z-`ea7_S_;;2`<16;Yh+!MU$LdQ(~J(9-8Dwo?N{!V?`oQ>NffO92*eE#=?k~+2l*3 zFLl`0%3~T!dRx;@F4waf7h>U(;>t!zH4l(b2vn*+u5PIRhR_IKB32x_Q8G19JX%r;CvOS0iDm^Df%=Q;c(C198-W& zPP*nzVutz6Vq=0VF~59<)D+(k>|MGFb50A1*u4`v$A=5tw20Pi1$#!{U^1#jo>P8I zWzbLqgLo5J8fmC|UF6)!oa*py1QaAmw<0a_U>tu(*Uqbyh|2^F5lUS>S-j}mhri;A z-9vfeYNn+v75Re8oOe5mee0!(>yH3eI8-NwZc$ZuyuVVqcuxcg$wG*Ue|l0>SrK4_fz$u1E=Jr`$?C z^;S%bl(#RI&m$sh9Oshdfa7oGk|~;+jQeFeg|$8QH&g~pHLY7&jNYG;tZ;*s#j0MS zHZk;AGvS5nKjC)B?rV~G<2ZD%g$u!KE?~Dh^aTzO5ret~r)X&nUB;IHI=<~OLW-YG z2c?qdn4d|>dex~Z)|aauH9dy9w}Sys9&x$p^`xY((l<_qyn) zazz?tSF;oM zw4}lBuxf+gAOWg^WsIEPxOOj~H~(qihVh(cgRNB3aBagTRbvX{>u6#KvBc#u)Own^CW0^Lq6*;UTXLJI4#d z!0-)%GWy%-7(EeKJ9S6yl(suZxSi7faJ89~%QJwwMm1C!!uU};O8y})SGeFea)Z7P ziv6&sS-M|aqy6p%=x!0V#ju&sMQ5HvtX}M*!r$$L?4W5f@{oKCoLO+SCXeXnIbS03 z{q-rmnEo5Abj}Yl`9#X1CAcCn&YnL6%h)YWl5r9&7a~A`@iD} zJ^FZAQDk)x9eHwIC3y|ew)6`p3S5_K`1tGvg@qf`@-we=4Wt7&=Nzk>e#5p z=u-S1m7S*90m#@i$ZakRG;iJa7) zu`5=ubehGA&zdr2Zi|7zFHOiEup5^Cn;UfZ0+$cn($34>qDC{h6r=lR1_~s+hWRgZ zcN;C;7=WKQf>K0M#dLLi=3ujis+U05tE&e*e>9D13&?guF(q@ z>38qT$Gs_439E!U=0yxGni{CL7h2m%ujM_ucYxpgfLMrs-_7?vJUk~NhLCg9t^n?8@m!!GTGHaQx(WDeC1EKD8b#cR3T5FDF#z>h!oFVb=fjzw?43o5=T{cX zIx*%elYEGskuKNwR==0Uik6YSp2gDRv|Hn+W6yPDnQT2=tOqD9y0-_FoFimso0_CQ z1c-41GZS*_g=sT$N2I{eG}*44=#QyrkrnpU6HBJY>9y|JG2%ygAHO|10WZjh&BuNv zEM8-jnChe=IyW}a#z)UHc6bVp>J5~TGP9|6|G8vQXa_Tba!u7iB^8e@pIHhq>G*oQ zb~le1?q9kN;{CeU-8=Q$faBA_F4K-PfHyh4JoRx5XD9ChQluHWE}?L>{DCnajF+Hs?&@&>MHcOvp4ujz5XXw zvrdwJ6|+62JfijA=BC|**|^wUHJoL*az(5=P`x2UZ2+-7)inro#xA3oE8TYvfR>eK z`oymqD_NV^iw(mA@Hb&2Nh>oW=^%J*1+uy z>`?pMn)58=W5;k%=J;7$zoi~?0H|;+n8#`gd+s^8ld7z&xVZALU>y;JMp)}#B=L6y zV*D6(K_Ty~%M(5wKcpF^s@?C^*G6P#*mkrvD~-n-=d_HvnH`mKm`=$-w}WUBkdKkc z$sE~z4?Y{dXhCS9ks>@hYaI8d$4oN{s*NHf9`&u0#aK4YA_fST^VgJF0MRbTD2=Xb zb?mP*JJPIMpR{eR4$>Okn2OcYy9}O#5^S9!TjWlVDh$-}tD%4PQc3tVr|R-C1>E_&(>qrpci~dV%PY#Ij@>ywTbI-FFy@sH z-4>o?`k@sH<8(Pt{~dWnKKq%2>e{N_6lCv6aXmWhJIJu_bq1WwBUoAE#gotW(v1D) z8fYLVC-%Lt7(5G1;S|rBE;h+@YQz0NY|&a6u%3e1?eT6rsB=2I05CLdxz9nt>b2a6 zjwJ+Vc-UQW4&*4{h9M{r*du$qg8TJRxGmw8=AYu`fpa;Wo@~A2ow+D^Vabk==MT@* zvG#6soAVCl8K{a+Y9_;Dkp2eIA$@dqzv40DSCR$ZUvEWUeoBB$futN0y7oO@t*URU zvaAq%60<8nPzU>x79jqSG)(dRGJlv!Liw=+44-Xo2oE<f0LsWW5F_K85c z(Rz?Wn%4T21^80LZ`#|b?#z1RE4euN8MXC3dYzBk5qkp($bfK5Zoepe(a_KhgFNAJY2V>wre07Jgb9BJywVY{Iv{%=kn!BCYJT6+Qhw3rVVk z;e0(xMcL(?P=t|9JpPXuvVfeOd(gc|HilT&jN}Zu)JRL(0B%FOg6y^N{(gBCHsl~9 zCv`n>`C*Z5aKO^Nk0|sLU-&dZ1w4l(W>FxycgNO;f}DGHu-Y30jTu|iwmMMJUQ=Ht z-Q0quY_ys7Mn3V9j7NZttn3&{spL~p*4Y(9r7enki{=*CPpi^gKdI$UK1avQaekrkAj$J^ z-|CIUXB`S|eB5~*I1fjSU7NuITNzBf5!?>>iWy!-1|4u64b1qtdCQSo>5C}4A=!?k zZ$8%6Sb#NcLxjfIdE=B&`DH?Oquhm|aC?lb*vI`!L>sYhTSd%e0U1+Mnqv^8urZDC zePK9fee+hJ8zZ(h0rPocV$U3iEke*m>OWh!vCRU{&*`nPyulTASSri(-i>wiTEat! zY>#})r>Yta4bmFHLQJib+zkzKqJ8!BUU7$qUjS|pAB)r99$K)WA|nV?zt25f&6I_K zeb>m}T?q-uX2B1Dzpho_&Y7(^2h+0l^ytid-q@UUjVhC3dd)h+So`bAp$Dz=#Ap8i zWAifux)%lUH}$*2konI^CYXtrBjyep-lXr+T)~~vKAZlw@s&@L2*8eQYAn^Eb~HkF zm1=;*obZk|Y4JmftjEFbq%MnVCtFqNz|7=_Z4Z)6LwtApgvk#kL_X>~E==55Hx55c z!hp-#xZZSpIct6lXQhsh5^ZWFVuoeCLSxXyjb&Xgf*EXDbWKIKC1F1_F4+lH!|*MDLy5o6_hFPTtkw7nd(6!MU_zCEWorXi+5^#*G!;3pDc0_S5({Kaesv zSHHL+$VBFh3%T=okbziJrbLYPCB1IvX;K4CofS?0jf&rVhSLp z26D!yD%+Bz{z?}-^=I{t_GsyhNmY>D-^d5~`ez_%2kJyUi^o+xj!(dd^c>-2^(c?? zyso#wNO(Q@Es@XgFU9_d+17K9{<+~!v>kScSDdKV`PE0VZLIgf zgWa#QC1zWO_^Oc3S}4Jx`AK_SaO1fBu?N-$G=(WfSiaUh3zrId02b z!N9H6Z+cvxJXDZjE5T%iDIz(gB84Fb+}&^2lW93TKsu~uds^9|VBI52ZuQk%A~dGk zmMx^7P97jnqza?!GgQdSV3`+1{7zBtW)i+D`D7~G!-evj7CCZpgl_4ctxEy$r8bFJ zPB|QHQe_&WSTf;82XRLzwZsSwt`Jdr_raRsIUf?QoguTr4LL%MapDXFPI+#8%$NX- z5~M+%oaZmDcz_z7iW8PRlDg2VRU`3}VU1}<_I9eOu6p{aYI1%*T;xprs!&M6KW~KI z^2bx2=@vv=$Uan;*aocEiH-pZm!%hesl600uHqibp0YMYy);Y}x(nv)r>>!3r7(Vh zNXHf#a2h%QQPzV`mu#@>6ePP*xX=lU()pa;}~{PkYBGbbaVLaX%CHBaxH{)0z~ z$F*Qjw+XTd>0n;1xRMR1qocIDGk7Jpa{5#DEAHU|oRgo8H}-pY|7SbQz?r6U0&h9w zlStuj8hu+Qr_9TtY=S!re15%=mu2P+wh4P)e25&`f_luWf9l z@}u6oSuay23G3GXQ`lDk#o07}1`C$p4k0)MU1OI;gA?2#IKiD@!54Q35+FFiA$V{J z5F}`V6Wrb1;mCV;-~W4)tGcJQwsyOwXS#pgGxb!>%&!X^Tng`x(ZmbSc%O0*u^^G8 zsl5wIwBpH$_<@Z;@~p~vKkBl2PV^!1>=gPOB{EZ4ozzf{r8=dZRmM#&L%+S@)PwN0 zJ+OlI2rx$Bj*a8r_T!Oc9ohH0Rzj-ldlF1v6}6N33Za8}qkGungJtv`7l?lfYP%#? z)JdxHGeF%w>t}S!NrCc^?Z?#!jTcQw{kr2ee0KS_Cqfoh zu!trVb|%upy8JFx?+bsDLK{^d|B3MSmPj#jgw5g%-EORs(3a-UqFelgyY3(f{tYx7 z)1bip(DxgNpEwIwd!Q%b0Nx6tL-6}WL1v=B z$3OKd=q_*(u4EF_{)FjEkq>CJf8J~O9@LWQJX5k-$T5Wu(UGxeAsVwOZZfML-wxXS z*?>OAQQN!u21^btI2%$|J1JtJ3y!TZo553K+SIXFktR2NC)rl$LroesROmV-1ky%T3k#2O;0N~AYRExZ?_#m@$K zIbkBsO-@NUp?z3als z$mZjt^Gyk$ivod#mYDw5F8cee_o;Z)Ldq}%hOHks3FVN(Vk|2bMSTZs_pEH2cl#!A zx<1gmZE3?^*t&_~h0S}$#0igm&26=p^BY3tU>$;(4=fR#qS|qXf(@VUo!gyBmND%d z;&9Bm-w0DkvEij8J|iXff15#)NL{yV{iLikKPv}K6)B|wbiM5(Jq83kqOf5uZNXqc zq zQDHf_u}#PQF8!(12sm=A!f#_r)e$Qbv7B3(Gw8d5uCND573AP|Dc(YMeY6+y_(lQk z++#E|RBibJ2EsupJ~IQ{YeScT4Zh)0oq9t|`eMb7k_<0@7`U}p3byPmeCg4!PvJY= z#8rG$pCTk#hMLbNIveoRUeL)0RYzGN8*jAzc5B6Shl`17ZnvTT+M{lxs&L4Z8DBlV z_9NepK#5^kRm7wQs()|yUZ{fJE>t%8gat8d>~|rgw|1Hz_jQ@?|Lh6J-7m8uamTT) zyhMhB;%rvb31zrsx#YOyxfHk*xs@VWolU;nQy*SNk_7y|UK{npp$ zs;U#?U+MdsC!|IJdZ-YvM5MH}rk^w&!AsQ~R=E%gREV+~nY-lHr=Nh6A_-I?dKV`N z;KP}F!N$;JO+EHQg`*a)FF0KLX-UGS{k8>;CXsmX-^eg%yF?-TjE19QvMAgW|Y!zim?qPbe8g zgh5hwF(G@bwQ2$snPMkEgRCRwy1t?zm`Ro^~r z6Q$Ibl_+EM21UKg#y$$y=@o{f~f;H{}r)u3o>RJWm$=-l$~Z zl21E`!lVz+S6>cf-4y1ITKC3O<|HUN7Oak9SyHcx4dkmUKUewjfp}GK3Wn4lH|(DSg3C89}WA0 zpTRzw*$?`_PM|x4Qy6^ac30@82b*AAVt82`_hp{ z4@qVEW(hsA)1iXf?DdE_KKF&@*?mJJvt{og{-Fe5c2_Z3_L6lyDxqYYY~0t1{is>) zvz=ex^QtyIN0`7}*1413jz2uV^R&MeT>cTM51dOv0Amrp9}MyW1f-E#$Wq~qP(sdZ zgwZgFfRKnhlAt_?l5M4$+rpucA)w33wH^W*L*i{o-NWtcq7|SdQ5W&&54Ni2Q4ukyA|zgWT|c%Q3sA<)5Zs;nAtfOa+M21aLmQ%f@2kR*-FQaNRZvD-9tF`6tsVtxf+Ut>*dxaHK+xdE6yNgpUtv||wOAXIYW z%5NUie@M;HV|CwbncqRUzHJZfApJ+?U8f}<5;_g@Xb*!9;G2Rpt=_s|es6IY;+VY`& zEsmocqnm+uCi7#2|4dbaYQV;{@z4m%}5^N4cH{?w1iY>w)s{%>#4bx|0AvL zGY`dH-)E{Al$%$*N6E>mZpFL>qR|$)hp1Em%p%eD=la3TF+sU?A|VrUCQd&RH)sIy z;~)E(+0X=7Q3O-V9^U&7%ymK&=qF07ZYRnjHN$jXTRnb{Zp4qpkoaSt-vy!Ea2^g1IjHj&xG%OI@EF*4-c*1O+v{m6>sXi_lx#>NG z=m|hx9bD9nF~1GcJIC@YXK%^{uvSZ^e!Z_wQ~Jy=bWkke4d=7C@@N?Y9Xl zwI>WV_-9t;S-jP$G^02OKl7MX?98bYocC5QoyqyKjHknoRzgbDSuA_Mth^nIYtYPE)~6;mKO<&Vkl1{Injreg3R;Qvz3MzKh`A?-%U! z7mZs##5CbMvvJP%5XYp`5z^B-~IF%va2cbc+)5Qmh=*^)5(Mk;m{^& z-tdL!2C4V)MEKXd#StXY#lfT-*0}4HZp)_%<9U5q+}{pOPx0Lu1*`Ce1NTnoQokbO zV7_n8eJ+aqd2_#~&}=g}`Wj;$tJ+uT+jnWYf-bR@1}Sqye^*$|p`)DMb|6y^?#hXC zu*!&kn(`8VXV2s`Scx^ISn4zT3s#m=B8192sqvs+ccll;1f*Rh?%G4V$oz4awvLQh zPf}#&eqJ}E$fq%nIgAhX3@}gOSM;H1HM(E%Aq0ox(iu@3()= z?^MWBc$#}4G|7uoXEA9POtr*u7oWTzjF+Q~{A{0!w{%6Oi($QS-1uh)weCO>+qD2wLokP&P0!(ue8x{aqOC10QiUI zl$;D{8y0C-q>ih+eB0!SmJ2bw)SXfh>>K(#yU?%Ow#OEbj|9Tjn@lZ;iH)TzItYN zwWKWUwK(5LGP;1v>hg5kK@jh!X!5$`Ar~}H9C%Ug2koGF(xoByA%$_qcic}qJ)_EX zxIVW#AxNKPAIi>zn~9bklv7uc&xT1~$<<0g7NWG4FCzKBqt&=iG!O#5+5!EY9?cw2 z0`_`WucB091)h#M2duJ<5WPs6bR#EU;q7k6@`N?6yGPONop>i@G>sSfIF;r%nZ;JpC`1Hj((}zCmL(3`6tU&a3;cA<_W^Ov zNVNPU!Y$Pv7^yez+?je9&SZ?LHF0>BRa!mw@JMQcADmK#_M~4qZv580nZhzdCNMIe zml`iH%#eJIETkqLEws8r)z1?CApiDI!dQkqiCh10uQ{ zsykFJWLl^%uGAq#EPg8miGe7fli>8xqZ2~e#q)}KMrsLlO3iNoGIZ02qKz-2n|i2{ zUZBx1=I<>&h1-vRW?#3x`n6bteXZ>P_UJIV>@2{m;0`<5>XmhKh+(MeuYllHd`U!j zOiJ^UTA-;8K+fOZTMHa+k61BVqrVu?!z|S5*crjIeuCZwDOa$&IeGVaTa%{k^?eM@ z{9YAJ7oM^qf#Y`5Pibb!GPGEs>RVK~+G+}iVExDU?Irt%lj0lHxEVl{xO+r0QafYT z_I#F#{xf*{8zhyTy^7v?pU&c|y9+VIK;)BK!1d7W%)aK3@!Sn6ee$n@RgJ=cgV}Z0 zMTxyhwc%?%9!;&OxVihO>gSAh5@yKek%?-ST=%H!zD+^{1EO;1D}(yGg(X}Z7L$i+ zmlGS0EEN@gzBP7_Vi`}gJa9EXL1M6jUy6a>aF3>Y~2`bHvbi zFKqtAiQfJ|7HTUONoG-Rb94BC?h`q>!D(Un5vwS@{tL~|oDz*wHs=&&qJ}-`S4gqgL z?bP|`7Ybs<$sP<0BVvVfc&fzoycDhnl$*J40awAFxzv;-k>5#u+oCrKXVdMg?ai{x zDpGODA~_TJIn)SqhZb|a;_os^KLQ3z4GYVbOY8gzp5e7e2_)4_P z_7LAUsz<4A8TPlvnwZ)5{rHk-OGui7s8}c+^kp=2o>i*0S;uxaN}s-jd7u&IOO+PJ z$HT%6FIt)SQ)4UzED7`<_xbu*xC_|Ca5lJ`*v({<*gLzcw}bW;^vb)`5$?~(hua@f zl%d&y+9L?4$7G1}kMkmo5s?L1QWyx?Aw$&@+3Ckk&$T&PZWN!?UY~SNiM+eCt;7Ng^`nsddX9Kx8ohChannLa+b9}_ z%as|-gZ1R`(H-_pmDk>L>1AcWiP|^*Q=!xC2|m=$jE!chlj?;#420InOD`O9?d`Gs z*DI;XS_6G;%~H`r&+^Y8`{LHydxKnz7t@WrF=2zAlfyGnzs_bCQy4F{bS3sVtkJz} z2VPA)UBtZeT`Hje6p0i z(qIij^Gqs781ysqDk7>{^_=hHasrm(@Fa^umC*_^PN8_HO$&011n)jIpOS4EX0SKG zZKl34CQ#d0aRr2kx3J?rJ#&E8x?c1M-JLJaCX)I!XjFxXbFIC6ab8QELCpF2W_L&3 zIjv>Xu_#0Kx^C>?4sM5zo;VgRXs#Ld{5=o0yZhLS#$}g$r=N8|W8Ta{Kt+rzOnP4IVy1>hnt@j_9Dz z=dAhW*Hc^K-7s@}8h^XAJ5j&US{0DfQ9jUCk z8bcp($-Z+IcVQ{;HnN&24G`EQRcVnc?6r`#kS~m&ligjUE*~^B@i435DI@u`6T7pt zEB>0|E;OFq6vD*@0^N{;`LYx`sk@CTKFw+S(;jQREksAm3QI2WiX_u**Y@rd%@9{G zz9j~RjWSjF3pigLtfr5|e9B$Qs;k_!tJ^4cUyzsj(Jl3ZSQ26rj~-tx>1;>QLF!Ex zDooSALS=909rYOecI?&DvC82tETHDgY<7Ysrsqfsrtsr9DVFP3_U-7^!2Ktkmb%Kt6%F4TQZxNtgjl& z)JO#8T+$+llpCE97mFRXP6=o-k0XBGUu+B?{!Hue?a$HifK~ZaZ=W`mMUxV#hbmAo zt(jyyb+|vSea7dtwJ?TUt*a=a)9X(l(4OC9;ySD^tVn9uAA5Ta?0fq38H&c-)KBI+ z+wS-e2vVXff*O!oOlpGwpG70t{PlWls%-3l^_LG}RYhTyv0I>uyp0RpoF$gXyW`CR z>?B%J6!FL6roc_?^)L=H{(Wek57HG>5ugz9TyS;pvO$JJl5%>=5;seJG+~fzs|bzQxbdYI+pR@IT~ z`|7*WH%%XfQ*wu+n|?J#$bRr4SWSBBw(BORT$RK)Ur&9!Ur1kKVqNq& z@$$?m4=M?%fvE4iOq&YkN7_-hqPgb_7MNYCtgKW79r9LZl{b}VYChS2hKG}5aZ(nAtR1Z@Jv#B=c7i#eQ}3rT#px&QEggE*p1XMyhxKSIaScWo?fxe(SY(S3>>MLp4-4|V0GQr@FteFd4;vQXFC%8XEE{Qp9&B1(ovnEZJ;Y(AiP8&&Jgt z>(?H96K*rtT6ucEHU<`+8%38ZOu9-Z%f^ekV$`=e6mBU%X1aBqR+otpg0>DPfRi)tYGq7E1dX5lEl6a zN%=k#KBej_4%ps9(L_r=OG%F{UL3?2EJ2N?-kn9B+S-EL0ZFvAKl+jcjN_iY`{cHT z0myOXU)sY?!Tclw-yK{o+Oud+G2Vvz%~I>L3~4+dJkzogtM^r}=OrOk&gK=hCmw7l zbk$-kmoYFmeu-W#Z8a^Vd1BX)d(2`oVoXpj_?D3zBxf8qG8`LM6nplHu@?~?7n=Xd zSW>|K30HXWMA60isbJX@(B&iZ8 z$)6>VH_Is9KhDCrl#Eln;rpNKLi8w5C_JwAM)BcNlg)}moct|ToYw72WGEm`shA?J z=9V1+hW__$9(6ZW6*CfqZ`03$i0T~NxGc99mSgyQQ@m4CDs5SQlzt%w)ipE)EZUQ( z$d8c?d(bg34J8$4w20r9U<)E^RcT4um-THV*}8NU%1qantvm7`Ga?ZR2;3Us+}nSh z@tALJxo&LnV2l_IjFDmxy(K^>$GyplV`7hph`eOrp1OhxpL_^u*X_VBB{yEQi}Q9g z6pyD=Sz>ClE&V0eU~v(Rwr9U=V(yOV5Cl>VHQu_x-RcVB#G-_GH`VHkypd4u-{O9; z1!I;^E{^I~JipCKCr_jL!mD@7d&|th3#A2e@(MBnm^eY)ubXLTAL}5Jh;o!{A5ZX>gc7!yz<#b!&U0vDINu-Milqn$lc&TQcfykSm4uVgB||JHl?3! zi$~Oo*Rz$-SLW+#n)le%YnCLuj3jhxfP`h=d3B5jgYnbo=C(c}(rp}#2NS%%i*0FY zTCxHS<0@e%-F&`mV3MCILt+qQemsU2tqvp-jkf_j;q=QPVfJFX&h4ZO3s316h+TIl z&P(xLlwq&m4Lv)GN(N+O@>v*8*jTpm2lzH|M1ACt^8O@j8>*%=>N~i0`Rn=5O9o@N zjidKwb{PF1^H_RW5#t7t5p}a3D0fbWM?Zcz7Cqx&0++_9ZOTr~_+{~@u^O~3F(B9} z*WYcXX`jHw0vl4xg$CHMKX5h4VjfHj#rPReGU;);=* zsb*8@3&pP%-AZ3LQ{XgWj6lYjSy0m}bzM1!E%6$?>iy=%>c-PQ**Oa*UIV*~qMojZ zf2$6Dzvs(lw_Q#q%;#CxPRxKzI&qISl^}*nO*YeJLK;!Lr~CmH4_$st{^X?oRSs+H zM)^!sf8oOZ)kdiy=ryLuz23W&guOz$xGF_Tr=SB?>r1LP+` zB03Cxp9D`$9Ube7jD0-M8)m;l%mmt&4S&{Ze|eWPc8ob-RfNLkY0*9`yP3D+uEWfC zp|)M!oUv*JD`Y*U9I<$}OmsQc&>O_+cr2kdi>B?^_u**qL@p&Q?(@*+mBv~|PaVpw zS2=c^C$A8NuPl4lYE7+wwxrq(*^Sx#uG8h)%oimF|^^D2fH?1j(4F z)yHe~##AAzA!u>Y-hH$tXR`BG57Wi2n-bKNo>ZOuo@e~6@(UH%4Ji=M@ogzB?mCM< zZ}wejEc)w%_=dAJ-D)*ct@qptUNN6&G#Kq3fxv!T4yN*m&>hl#(CxxTb6<;qm_d+nxe-#QZjPmc+mKC@#74!5p< z3V*h1e*M-`T`PxsWsvHvr`*ljiNwHoQ}YFt;Iu=j?pmg~k7kc=K0U3&qy^On^Zq!D z1Xo@GglK)AVe{ z83mz(@J0=(l}Xf;0^W{xM>4V|JaHBaw64lcU{$47D^NrgV>cdI1NIuR=s>{czJUjo+7 zb3 z%PNvT1{zMli)X@x*tYt??tXbeF7Sd_pRT=2FZDEYJ=}&_ z;i$)Q_FGchu}r*}sY-saG;g5K;H;m%?ZjL{&-XcEfk{G~kS;nm9ydGUce4b0e5R@A z8y1Glr2)vKkC(obC-X5Lhh;N!o4u6&8mDPIs0+%;7pPPL2*e|Y-GrO zb=1+D>)7NkadfMCjiVXLGszn_k~)(MZHNw)=UXf!)Sr6^5Nm235P9Wfah7FfX^Nef z+mv=CR+!Z2+R4xRu8e0^oa(Cd!q#s2{GI@XcqNnY7jvsr_G=A$Tz6XxP-_O?S9Bs{ ztdz|U^8iT@en=DMCjey-qEd3lst?LejkApGvhQy+$^@Y0rEdPptsA3_@yUG6wMQz}~=(IDkMn=;6!MkmG?R z0Kj1k1n?NYfxLmh0T5=c#33LOQ|&$&sTGNtn;QavY5@Su51$uUTyl2CVuns8EMmMM z00;tj;93Lz(;{)48wrL4O~ipBQN9H6@bEkw1^NBZ*wSGA^8*S2{HBulmkh)MgFa9@ z{96VCgAy&ENQ?*&1o~$uAUGWM0L;G>z}z6v14Y2UWgrOmpM!Bjc_4qvz(5}E2Qr9% z>2iah{}_sRkp9PdFc1QJ;1l>)LkJuK%d$72v2_!kNw7##2? z)Bre;=TA?7Kp^x_k3nz{_|JAA9suOOL-G&)56V1$#ux|z!v9Xphnet)cOV`h{Ljz< zA)w#nDgQzN$OHO)aOz(&5FCv7E4e^C;NPq#|7!T4%=2f5ARq|%7yR)5$86&HJEqi5mt2{|P@Bz|C#)m+%4Be_8n3Kp>ds z&yavY;J*?M{1DJTje&w-FhJrJKN97`x=A8{M570lfC0oF)aKIT61{TPHi{VL;Lc|=v*?yotp*L#uI9uRJz{Qj zlt7T+X!19=9o4VY&(W)#{#{90_la_6c_VZ04y9bdt(R=A6co6>?7(OiS@b5sr~lAl zZP6>;cEZYiVX_SokX{?NI2rTu>m^?yIAMxQYNXb|;&|g8XpGSq^8u&Ioi9V%Q<=8V(be}qXJ9DL zT$;y6Q%7Hm-=gL^p6?sD3)^9aO~V~Yctpr~H zuAf$obNHnPgvU0@hxaE=QIuSbuP`Zf`r%Jpx#vdH2y(ZZS7}e+JkDz+JG~C1saw?~ znaxaFwzFfY_!>I+Af7@-94J|@2o+p&$A@h>S!F(BvcYv(oOKFH`r&1i5^0^b;gL;N zHd9Bq;%P_0c$AyHw%jHR1*!3rH?qgy%r~3jsH@Nb7309M&|@}OU;#;RmKS>h)y$XQ z>#eoBAYMC&?^E^0;Koy+&qeSN-d4Lkh=c2Bj)H|l&1~)Q2@%s$*4I~mX{9Xsv`h`6 zg0R5se8jbU^ooi*)s#;?p8aTB@iwHAS6oOg*o!K<3^;y?(WP?Q2Cp;{7}49}qpdGC zSkfTSH;-K#CcQ7>5jIiSO#B?Y1*)2F#`c-B)kWoQx^z9fcVq+KVubZ-fG zfn5I_2^4Sd(uMMjgsVr_P8Bcj%CQ3<1U=&NG!mYkV2l{0)PZH5l-CGHfF%ZRAN}hM zwauR4VFQB5thmXNV^Uvj3SwXzZHk7`iG?j0gZHBkTg1hwNqJaaRUcv(G;KW8i&EB& z22nk@xhi)2kak_~JhnJMAcul+`{sV<(J+I-%#gJn z2laNq{0+NMQEC_IEx$1hIsn2fK}A^a4H`yNYS52iT&);0X?fYz*0ku$_F{6 zZ)sR`2Y)cbRC%nBqFgStB_gFWwj3Wy<o8NhtyHU^#okm!F|9kuH2L5T2HmzpW-w{SJ16o3@-V%N+%)fkQ@!b4 zd|QqM8L}F@Q`gj~-lpzR-Z>m!+3nA+Su0Njo&|7UgzN-K^Pa9|gG%GjLDD?9oUJg- z2vPx3d9Q>9RSZ{WM6ID}`mhI#rOP2!MOTS`r($|nbpLFr5WMP{qt_wtmAFk)DyU>Q*mcky6E$14Ac@15~0p zJo>ke;v};fz9WO0)^INYkZ%F_S2GAlx`uF@yut9)_2&!{I9TIgGx7~6M;UW6#qB?&Onc998dWF*(be%@9k*P$B7mNqY{RlA{Iv6x#w5 z6!@z)kwncZaY?U+_f$S+Nh*(N)kA%DY9AglJSo;OQ1FvgN%P(r$o?V0Ag7WCKe(S6 zd}3CHTTeBNtp_%^zUWRAm2={ud)LyEm37Lc+~oxdmi++=*OG^x*y)0Ul>8p3$6K@p zg*}CU!OU8YWW2_LUy&5e4vTs7&0aaoRUKd4WP`erwC3nkdCDAS6As;vs!G-Ir`8eW?sEM)?61gu+u`a_8wVuT$IE=KvN~M z6T``Ix4_9mf!XzzebYo!ssq*)<`@N)6;NAX@Tb!+7}1kTmJh+wF!(fse)YEH_s=ZJ0(ht`Y#2>&B%5=mplOgD?XH=sJ;leQ6}VZhoY9T%rV?<<_DDDaI)oLelFJ zq&8JSA7$0(AinY@Y{u4ppIRR>_L^Y-CC;T6_Uy9JdtE=*NOTomjX;mE<(M|)N2y~< zWdBf*7>vz{Py9xY+^0SJx>)J20|Cn2Z3$d6;Q0q1&JgYC>V?#aHeX?9Bx^FBN|KCR z^10a#H?>9=SI!l#(kXaXU3SAn57!LISqk`(M5UV=Lc@8$mN|$sw!;oy9rI2aGA~il zCo7iOvV5F?FBy~yj17aG-VzbXYaCY7v#%(qCtY$^$d>Bw7-V98C27QTs6uO8sKuK% zz1JF!TT1*C|! zDK?I4Rjxi)k+se-IB9HN+%@O0gIUHZAp25zL5h8Qh=nlk_(ES_dOLAitP;~c#)`9E zg~18xs7Tp;<1<=Rup@RemHZE}ALz90h8teuxyq!|Pa_{#icSSI_KW+qhexIxNrG@b zN7?{XY-n0>N{`TElUs}srm~FT5M5ZcM}pI#PCi#;^zuMP6bVokWj8yee#lQm;8Z@= zB7eE{KL5Hy74E07U%k7og(G#ZvuiOR!a=UrvwZ0g!WVDWme#VF4W{+Yt~IgXLYqGxoFEZf;g) zw?0c=TQ(9?CC=ZYWRof|&26PoRGQM08*4*cP~Jg z?+$oZ0>~;m5>nVYOd<-YE_|*d5XH)2hQAdMtyrmb;Q}f_@2~m{e{UkTA8C-IDj(N8 z8QzaO&dgCTo=r8DCdrxp-o4=+l$H$@JnL-kfQRBCHwz^Ag<~LLy*iio1~t=}{jIb* z_V#{M;fO@M8aYy^J2^?a0U|!ytbJ0#bGBd7JPLWLVJg9Ww^dt5tWud=bTH9ct?JG? zcwh6gBqlh890|a~lc*}0#;vuFf3#SQW(&cGr&C$WJ|N-$NpXa}6!3~fNWHlwA#E?- zbK1l+1KVjT^hk&vWb)=N#WPa4_SyB>ZfGTASH1G!6-&$?to!c#3wQ-j>!_ zL77DTVeaRL@^cyUE-t?%tf!=OsUJm%X*E$<aDR|?Y=_Ml6hMFq(S>X5=d`=6ciUEt)Pa7 zqPVxi8h(;N~s%}fyG;sMY$}N7`?^>MEAyarN1ct8o)?Q9`myYI=tQde7yK>aejTQ z>aSUwF*SZn8`p08PbhgLhk{WlkZI~Z8m|dFJ(luXTkG34VH^w>miZi{jhB+_?smMr z&)l46gIfBIJ{JUb@91y(`?z>@xB0p)Nl@c_>u%iyH~E26E-^eIh+lp%QooJ~7+)Eb zpX;|U;PxY@or!>lmx2Q4dEN_s7dbOj*U@#L#w(wL`NF={0$GEeU$IQ>lF7YI4mhb+g3i1k%tg+N)^VG zHRx}+bOqA3en>3&3!co*UE7`uEY3k{lT&(WXfD9h#y2PEP4x=762lDqA_eVZRbuno znpb#_hf0V>2FeZKSGXol6J7#t()ct;meS^^#xOc zZ&5WwQRj2EO1wV8oudW7mi%vu*s3+oTNC~jjnp*XOL8r$lK1Ol)D8@^fW)x^{`sE+MV|DDZ?pjcUgFP8kH8{KV;e8Gtr ztxwXxGNHMEZIB#js}Q(?>}(5lpdP=Gpt05-NqlgfNZkyes!t~WLvpk#?&r>EI zopw=n53Q2G+m`Eh!H?{#=aAKU?&GpsD`ecV_sE~4wbd$YC?k|aZQf@ys+5BwsZ~2` zm{k%X++q;I%#o031W#J!DBoG&VfM)-1A3A&|2&}pnw??L!U0?J2D1jU_>wAV5|jbr zk(5-8@c3b@Xc$Ou^vt$qpQ|=#*L?OnWMdq>54M%>qJ^QD3l4}75Juq2_N}P{{^>!a z5xCY7Jsk|lAb+?E^{OXk5W1m|ykEbp+}@7F4ep@@qU(chpYKMB~J*!-fz23ZBdSFQ^`sv|$*hy`{N!JwG( zw!+4=(IvxuaZQk)$wpYy<0$T4yrAR>CQ>XueS;8vtHhU9h_liSx81}XI)Vun~Pl|c&&-zNAIxcX95*4%r+vj8&Ybfi9tDH3*naHIfW0IviEtfoY z%OuiY@bgS+OD&*B=y9HlimxnpY^=X{7^ehG^=EIV!iey+;Ki!#61qox8}MNrlZMWK z!lM@T7H<=l;20__F|R|!lRXOr=uN3lvN?7Z*$s?)6o`nn0ByO3JM*cRfpnDffOIDXu~hB`vLogX5l3(2vpbh z>YuTyq&M@6few(VRBuAo%?vPdH=cm~#y<;0-um zE#bA*M1F}1nG>8GP?{jfTv5;d7PQ0Fe&50cu3rt~0ZXW|w=HeQmnc3L*wFy!p{dk{ zB*=d=tUs`^Q|K(i1gkSYAU{40DbRAbGoFB82H!b{4RdHwXIwg1k&RJwKcfE2e@vu{ z&>p?aa_xczS7YV6~M-w3s6Oe zUGO5JN*S~J4M_~d;@8*-Ma;oLIujghU6HE*512p zq+Jcl#~1E~&c(Dz;hIg^nZY?x1xP^)_>~HMRJB*boq2DIBXe?c5mg|~P!xGZ$oSP0 z#z*S#*7Kg3yRV2_Q6_;g_%BZF4Y#JAkKc24m&FrkUdPSSFz_0aDZh$l=6` zM^i59Rg{v_7!0 z^g2rLj8@=6W!ddKB)cN`GOO%#jzI2SQeo93cU=}c=C^!G0z#s*ki{JI>R^UBLXkA< z92r19rgyhqsz?YRNM~+qh!zA>Ab@I1Nj-){7ll5j2A=2VJ6Eo&tKPEQ)J}Q#@+M=> z5z$tuAZ>ZzH6$|Id?I-W&rS8vV6?84sTIZHz`huBm1D4ynxEbvSt6^zcG^f=`XRGV zAMB<%eTt0#dH=b6(=&(VUW0SvcbOW#zo7!9Eb`EHLM(I=$;fYw?E#dxlGYtP59$fiaCG_`dm86awb>T+7wQ zn5mOSXRi*B(>AaSFx9x8{UNzvWL2aHcRJ`H+x+wbbHt!sdi&-y^|D@I+nJaq_lt`V zK_~teTpuqZE4knA<`i}9esqB_wLy(%DYd4iI~kF+h-EA9+2nw+CVV$pv+(mM&i^A# zs_4Gn^|DrdVGrYOcnK+uixqxTCU$8{7}UMH!`lmRYBmxYI|n!W;XKdV+s^;@czF2g z(2{dKnf>ye%;xs~@jk7!*C2Oi+W-Ju{C#dOp0Su}nCvOb@YOsuF=#Kc&@y3QD3L}9 zT)ph`AiUi3`mJUitd%)&AIuxRO=`Gq%*UR_B3B|_5v~Uq(8#`}{Wgs)k|FX!&!Piy zXv8KL1 zaZ^9{pbhC@FYIUMX|B)+llxFNL=u!e*SF6!=P*Rytu=wQNz%CgxHcaYJWOVR$1UkO zZ&l|q2~$-Hj_i~4M8EK=e^eGOkAhEG{pJM38M(Husk*qO@fkt6rM12^W~M6+mIal{ z4M^Im(3;&Fl(9y^Pw(oL&+0SPDR!RE)jjKyY%xaL<=3um6ksw~g#})^JRUcoBE`|g z@Hn{CYbMvkG;@StU>r5{{^nkPk>K~r-)kS^DI8xSzdEcF0gsQHr0$tX<(3W;{1pbc z_gHKZxjWAU;J>I=rupZP-kQw4Q3(=cxaW7)gjPRbn<;C9vQNxhUxR6pzDKKei^qYSCDKw3 zifVnX;$BnbUaI`Plh?wCb#zRm<2Q;+hCAJ<5abr=0i>0DVGM>Old zOj_#Jhara1hs)!W(Wf;ugzJc2EnAu|g$$LpR{n80%7FLtm9(2#%Il4BA})95gS@j~ z>z9cPzlJg_lk<0Fi=VnrkdZmF% zw3S>{qC5P$H$;Ysbr<~Cvs z^ZuiBJ;1(O@X){qUuT!F#5hH=Hj8EC8w+LA#i?=6jkJ(M?~z%zxDAcQMc9cY$svm^ zt^_u&dw!hAl~C;4y1#}?c-ZQ_$KoKXMO>mQK4pKiPO$j(1 zJD(#BrAp>g4A^ayMZpXom_ngKKW@{Ppgk8%eQl?QOb8koFQt=hh>!yYgJ(0;r%S*3 zRy+G|I#xQUTuK9^nmuqwCuE9F!5g`yJUm^j@5lnE2+IgoecgGFCwc z?7*oU8ZMF3YKCO60{kkT1;oTLh3>K_hgn$6t~I!ZiEy-FC#Ewbixm#*^!NDPl(%lR z>K)?)$um16tZrK9IxH`O1xd{8whHGH`p)6gF8!jx)eF;ey$y=7U1TI5@(AIbibg|$ zMJ{sWX!h%1k{sBu$lOEuNN-bIE511=P@u||ksJc56{5JaE&)4y-asR$keYRFIzkw? zYcdeWaeC!QvY`aMxdwF6-BoWRdHwb~JSW+cK8^0?SDnh(kIC?|Y2-FGJWl zwXXehZi>Ko7?>n|dG@MaB`PYSS;XSF0dUp+6y`w5h?NrBiiy`1J>``9cCqedH6V+k zV#v81#yZ4Up2G-?(q*U^0znPjwdPOa$);&vnxFNhJT#&V(^t<{C+k9FrRVZO%eP(xSopur+8 z>3Wk4xYx9R$+gpemD@fy(_DNR9B3d5v(xjo6G5RC>|NLUVxJFj!&lJARs$VOKXgiSb} zWctsev=o>!5~U8)MhbX|Y@}HKDasuV@y?p8Dc+SW8WO~PlVxVJHw)p36tGK%bbUz_ z&`JlIthN_E-8BUk(?Sur z>fbb!jwog}D87wZz=f}4TZF?S#ZcmSbZH>ivr$NC8!~~*NTe*Zp(fwMeI73i+$2N%deJQY-3IJ>jb#nJsXm@CCEE}x1X$MqVJ8og zyI+%q_l2I!<~5XQL^Tg!LLk*$V)Yg$H?wn*Ubx1Yl74&f77K%9`m5QeC!ObO3ZwdO7!olB4J>^D2@(c^(D^7?=4_wGa_ zh`u{u4Z34PIVM9{y`*OlHlsnkMMd{2DQsBtSwHx&Z5k$qv9x9KJ|&#Akw1tLPy0`w zI1d_`&bx+C!+UzB$iH-;Wo4=+XFTG4e86$HiWdL7p#R68WMOCF{BJ@3w?E0o{C@>q z%g*7Sgob4Axh8!SSU%!$)T9R#wWE6>x&03*i*kXc84|5Tx@ZmwT5>Z9p3TyC_c6mW zpesY4ap&>@k`p<6a?9^HBg4Y{CGdYD8bBs+ur);Lk&J{!nVWQ+>nX*kk-Vl5fTWQX z>79|-M=5eR$4pweHPl#k#cS&J3&8H}(#vFGGVE%ezS*9db(kVL7V2di@c7=quim_> zpxLWvJ6YIr(8p3~YNB`hYbWw9Loc6Ddl-$X2r;_gIP@Ggjb6{Fj-@GG#}OR2t)(mF zUKZ9f0g;wJBA$!(PWD&SyU-=E>bn$CXr&`avqurm1 z3UcBNQ0pc*UV4cP3zC}^f!(vm9@RBrF);{>U>xmMq{;79|q+d^2FoO z?1}@{{-+fCVPAf}U)srZ(wJTLH_aE<-o^+<(&UU>j#vOx7 zu3#xFUCaAwr=D^N8N!k&Ht`I5MJs=<&z1A{ug4yR&t*41kke9QTcFJz?qSSl4P^WI z<0(Scm9T->znLzEpHb;uhx{;oc>~3auqbMWGUaY&tVP+---bATAwn|oDm-i~d4y6S z{a`+CQt|9yUR$H_NzY3lla^}x(`H)sl?Pp(^&6T+OWN0yuDc-Rvd=^8T$f^sP#7kyd_6s*1-#h=LGk6yYbY8 zZz@+p7z=jPR<;&Ne3-mqZ+5b>^>k3)p!Q3L0?@;tk1E@VIzXqCow^4K^vs_orWO-< zG<*cStfTl+CH9kx2Tej?Vo1gG%mpLDH6q(kfi zck8ZveEoZ7iX7v(F-U7j9M zU*=r>m&oRmEl{6DpQ7_mXB^&Gf?Gy7VF5mc6h&RH#3x3N7jqZ{weN}~)9|mW7a82Q zU|Ni3x8Y|$ul|jT%GbxJ5AubzLJcge6RxxqEQjMsr&X~9WG@3c_>uFp;mOLQ_u*IP zc27T-o?pFy0MMAe1Ao=9!Czl?Zt~%jJ*zBmin7JA0f04 z4@1Rq68(*#j5F{yfs*)@fBWf|2b5yKOd?g3KSqK>-+RwFwliftq)TANB2;eNntF^agi)I7L)fH=hvIk=px{f;X))(b;m@Vk zek|s)?hFc(1sRy6sS%H}+az!g&>Q)3+4|X}Vm--h75sq52`jaQ%qVMIVG@#&jD^fT z0VuASBO}&_Je9V4!=yl%&@H4E*F)|rwf?iMVun$+hO^cU6~n3k=3SywsBI{W=HQz> z==uKEUJwA0xc>@T#bcaj2S&Bbf)tH!iF)jB4W_1PR#Z~jZOcl)8uGM!^rO{Q|23~% zV9piX6j@(S{Ff~#pAvWvN00sfAT0g?@WK%$*&SLIYKS3K7t>>#C&B5uYp2eA{hsoa z*<|2~DLuvl>Aiw8do#+7^Fn($bb!iN{QjP0c zn5i()|GlGam)Dv@M_)g(f7&df^zfb19X7dexlgq8-=EnzrnF)j%d_Vr&i!&YGB0z-*wVun0Xn-IpTbGmy&cJypJ;ADo3^ypq z7UFXu`i&VcY#Jvm_fz3>1B{0-IyVHUi%#pR+7V3*ZE;U=A*@zwkB` z$em6?@!TnxAqwPT{pCgL&0Dq5mgiKT#qm5vNKp$p`1rlOQ*WxblOGV%sGY3^v^cQ` z@@qS1>Fbm-AhvXRZ|mP_%mQeMT0;@J8hBDv9VICxU;O&s*f>dzS6xM4L2pLGW71|v z7f@EQT$et2$z)bqfdD$p4XlIiOQh#%4;zE+WHUeM-vw`z?+&pyUZG|;qMJLx0eHL3 zQX)@O%KUm5GNcpppTRtj<~^R3C8B99gVF9!=XY-y?Fp5F&18l|9|x63e`L|z!`rrD zTjLfwq+xYZzyG4nz`}9Wo$WdAA(dW(5m@P)g=w5Fbxjub24b2dmEcD-2WOGk9$)uv za28)+8UOLzW*rM)eJ!vPTZ#t{s-C-H4o9q$p?F7J(^coP;DZzhZH406iaf}t)ULt> zDMA_XrsN6Oa32?KQl34^=M8m=cE=&W6Z;+5^o^}o$(9#Qa}GeQM&#-lk?_eU5oe)^ zT}oeQU=Uc+rTMLUGC#omzmO11#X2iVyE3zG+&s3U%l zwZu_ibVT$zMcdB{6rI~O8(l9ZhJl>A=rIzb)~4fh^S9o;+pPsa@!#99BI^0|%PkC; zgdyL5I5Nk}JUxDF5W?%O^0R$Amj8kKjhpoR`{I|@&D@bSdw2BFx5{a02TJM^YDK?a zMV8HYJVL#?9XH1g4nVn&8=t`^XOyVC@dhnkC`lYYQFR>I$$s_w;AJV2;+=8K&r-=h z*_*OpNIpHa9(*fRrtw|=6q?kC^VR})XqUckd#4ko>MQ=L>lmoexP$Y(WI9l~Bxh;GXb``ffN7p&eK!z9M1CcC>PD;$l@9yM-fYejR5T5`#0J^ZI^U^`be4E{u0Ht zOyTaD8tJX-X&pEf`|}1t(~u3?QuDa3fVNx+MM-ts6jMz*N9?k7{mRk=g zk3desMfi+lxn~aw4guUz-gel_Y|sTa-*Cg@Y0&G2?pnZ* z&5ktQtu%6#{ivxdr)3}d=JP?dKJ;TmL2B!2pjq%}|O~hALL4|_Dv)zH{$=h;P#LG~gG|Hnrj1-{g%2Zs!=+kxBI-2enSLz-h^E2Wu-l=f;6Y)^=amuDVoj_xpnn#WVOZgO&S8(lpn{ zr(7tTfHWqddLMIbhHV+g)_O%HN=?)8MP4O^Xrh=7#ZSqv6hM z4Q68}sBtH>jADq6AES~o4PJSMjIi%NSBd;w4#%{=u9y{9#FFZAMYgJ?`j0$z)^}aAFH0 zB=00&CbRWG!c;2u*tdw%u|O~|h?h}A&Ta#iOL96f3-m4NKgLBs^Q z>t1`Qh@4`z`69BjR#V~8HifN%V@B?}AEFwH+MrfVxgEJ|yGaj1OplZasJj{}%>_$u zU>|I?(7#(Q4j}Aoy%cA|PIX3z1`wPU)cNRHVNtXD(e-KLUt(eaH53`~nYk?*vZvtJvUWAf4AB>X_!^P|>!Wgn6u)|6o~ z*nu(}9w!{drF7FWpe<_mGz*5yd)BQLGxm^6pOF`Dwf?HiJ9Py~Ed)#^hqTqZ12zmBR%*X$=stq-^h@A68R{3#0=t)Y|`%B=bI@ukEsswj<3 zRh{fWDr@4KMHH=1m@2?TO{8uD>Kd&`qh@_5)z$m3!Y?Em4|))mM4gFQ@&cMeFf0-&=9Z#J4b5|)i9+VekCrl zJ=75%lz&sgDh!@;y<_X>H{H*5QrNlxWZI@WR0IWm0W=B*R8XF*&bKk_#e+HmtuGtP zrpmTYCJ=ON;l9WZrXQu)b`J?$?lPz0$m}NsKp7G|VIq45F>Ej=%X0_zs zklMc>Kjk%;{*6QI|DSwVS=pKYi$h%h!6CT+hX2^O|CfiRwf^_{li!J^e6gyTr5v^~ z)N>aNXX~YS5<#MFD*aVB2{Ss%fhc$$cEuB%-WSH-AKp;dMj%N#+H2KYcfodG3w|B% z4`+nFqL`FpsK9z}p{+@N=XfbhVsF7yEwz}?3>8*u&x>(SCOZ?_;rGLEPDD}mS;{|1 zD~vIMV;9+OboiV+G*ZbI( z#xnf0mU%HtTA?=QsPv3I51*#3R35RR^tVQKU4=pD>kJ3Ca(UXA-tcJTYDAHbkdtbY z-4Dv7kDI25{->oey`fJ*bH&Uk8HSG^mQxIS`}jDI-T(dmW3V7vxlx23Us%9ye&0F(p3+s&YV4no#R1)J3ojj)g zXGG6;0Z=irkIJ*lqpK{BdoBluFk$ZrCLo6HbOd(ECQd^l6Vn3S5}$i$mEx6PJ!Lp7 z&24~A?J(j*rF~}+=A)55s^e|%a`1x+CA@OKt^@w43IXEFrx@cU6lzet8*E!@3G|B8 zI1hE*^_3b*B{5H(3y#m9cu9mu^adgB=8rNmKir1D6o#@8Z-W&~ZAFyChM&G?9^jF4 zMK@RdONC9R@gpva=+%FSWWTAFGqdKBhJA53{~(bNp}!ZAA)OsQzsNpqsW4qy=>QY$ z^?;q)`pkqjv0I4mo8xIG2|r%MTqZ}nT$tip=&e53CQKlIP5lG~8@WjNnANwsF&>}HYJ7dN? z5D}r?kt382lge8wTbE@M;wxK(F8kB%XTd>6tBz4YVG|#0^AK2O+U2f8uj&m!_}NvL z=|F^Zj7CWX(CV945g%BvJd>q>CUUwVw9^JuhG=sT%XBa--9-n4uX>=52hgSLZ9FA8 z;>)2FV&4jvuxLiDE=K<4ifG)(Oeq=*O3_)Av=$2aO|3O;7UW&AF{gW6J!5fOB|iyRrwpJPXC|8jck&#%X*&P)t) zJ{xh|Z)6VOE=Q4Z_tI%E)2KKgR-AfuN929KL(y4v-Wv4w=s?iEDCuBMIYjm$ePtkq zER2n}KE@n5Ih@KDM2v8#vQ`lFz2vSjp)R^Dw8o zb2jJ2r2qM|Fx{#jFNYro181t!E(eqT_?E}IH2I&z;yCCqNxm%hQ|I2m)zfFLJ3Z)c zFt&93?8=6*1pMzCvA>ic*k?&-zttK;h>7X+*j=_wiC|Gf4qst*>IH5w$#*b3a0v@%E!(A7 z3`MXuO#YPLl6|m`n{PB>rqI$NQVyFjhOregvMw1HXG&oaFVz-Oj6RgNfcKLuh*4T_vT!1t_qqR=%(c$9Q*{&&3AW%VIXHRF_2)!)JBx2)*!IrrOkel%JtS> z;57dWjjkakl1bNWK639`&uub!ZQlS_c;Gk16OnYL^Aos*wS;G|LK#i2Qs40BveduS z-O6j06b|3KEG%^#M>-?kx=eJ9-iVaHZ@ZX5AyQGYWdSd?##+u-Jjzsj)O^K<5MnxC zAb`nK@|pLRYrXIAtY~K$P{!6U#oOL5#C#Bnm3Shsp09fzp?Z6FXac zWtRTN&IsTyy1n0=dy~SK#}=YEgfj~+er)Gf*%veX4Spmb@7USR(uL4--Rda{#>lax z%;NY;7&QQinTyK&0wnliQu)c2zdFHOz4HL+tS@h`&ui<7u&51>fQgakALnOSiwB0Q zO?0ZI$Nu;IcgJ_$QT|=NuZ=w2UQ01I%Y;_$-9T<>@APrnJuo#l*;-rLx{&3?hSxQd zv?afjnaaUNM0{V?>kwaE@3Tw}cICyvNq$AoE{0{ZDxUE16NC$TPGNVgFF;uVng15! z(5HQi$h7!#wUIA}@F8`0`3xUsLCU45N6<6Aq^$IhsBf$6@EE%>2siS$G5&0<5l@E> zA5g<@6x%asdD|Y0a3mxZaqm<`6);rTD9O|Rz`(uBb0@1U8r{&?iDSvsLQk_c$=Z-Zcc2**!cM!(a zed!Cf4KKQnh;+x5|NJ#0bPMfeIyv*rm<+AnZNRULK#Re3xJsL$Mhd1xm$)*Czy$I- z@NeIPrFrE~k_~rfbK#m%2L8=D-2Y`AX7=O|E)gJAP2u|nGjg`UC!MQUPJfi(2Z)_3>k@puq2usW|W4;>!tO`dqf z`cfm$VhrxY8B5Fza2^kheh6`N@gNe$fGYe?lo0qai*H{a_&)zc>lkN$c!9sh!tL+q z*U|!-+kEKXB3MgaSzUI?waGmy1nQt+1LO%tP{>5#LAQp4S3$(lcqr+Fkwe6+D=DJQ zRD-xU5FFUif=%P0@SXHme&p|=p@-!ck1pJn-XF*j_u?D+#Ue}&Mq~wTgmH|Lx$bKJ ztP*KZ$0Wh6ay5?rN#QwTGslosV(-Ij*y0D&=p>Yr2-Ii829A}GycBW1hS;k)0w5C| z<%jTzI;giS3!krM2ycxm`|fSxrd9*J;`+ z9yiB^gV9Ac573H>gTZplYIY}INmw`Px9sJO^3Ap9;fdy9=2pDsoH_nk86f{Wp4tOG z%_i?F*&I#gkyTJ?(Ef5qKg)S%P9q3PcZ7NEaBa<7F0N?Db}S=+g~$*SPrT2EOE~Lp zQk}__>z$MJgA)l>Hef$8O?T;dRI~~{{Af1dbqsGs`>Ln!=vm-!wSMl~gO?aN?+h#Q zyowvFMu3z=DH-(2Iv&p1cz87S(P#v`)^vN#_;7Fv(yPN4H+%*2$FTZ0`m5AC19JlM z=Ksn=t<9(NorQYSE`G>{$+;qElDwS^CETD~ZzZ;;(<$o3hkN_M=TxYvx2~&yk>sVT zYD%$Olfjlx^ZlIh`22u$faTcx*D+-OkJ-ox#=@LzBqfqu2M-6lqB=(humsy z+O}1R!O)=*LlD+|{P_Gw=6+wteHF z0?*yC-yI+S3+%g8-TO!577|kPme-{efPe>0*IZs>Dy+vQZeS%7_O4^lrRC*>-^Tmn z5X0E)ODlE9e-*Arn^=1%IYqCb(P&13rCph*!$sq;%PA6F(!MaY>;2EnR#cUyCh6M0 zic4Mf15lkh+qT8ozUicE$UyKbowrsJ9@0KjBA59)ZtK}*uNx3lv^FB4`&K?xRPOit z%*N+?mt)%n9ra)AJ)*j$*WHf4k;`Y?e)rycmf>Jo1X*<8y&Yq;k3xF7lBd6RBPxgr z%V`*+F_PB9uR9z~at>XOpy5vZY2p8Lc)v1o2wd6Xq;E|upw?#!%@S)EoGdgGw^YCM zcB*cJ{JAAL2}rYh&_PQc4TEA(1piJiuvij`*0aRNGX|gJxl=5Hk7qxiydp8*VcxUX z?nr~2%F3KD(cZbs!tbw}Y&7op#@0)z*-ikBg%MeM`RogFtXIQ;s+nnS`8LpM4oGWv z0*=R=2^R3#wRR3@pRpwZA{HIF`#DuH{}Z^C*`b|M!3SW&Whw z5-Di*uU3peo>3j0WR> z&7^<#fpMdKS*ZqM!YQVX5q4jsb@b+EKzMo6Bg`W8na-Jo>bf)@>Jn{}8Tav23nb(j zQ~a>77^$2x5GC$KHiL7qqG`EBF4`Ws@G|R{gFTR{cFis|a#4Ius;1zov7m|N-7t$C zY$sJ2tg0!`&4P35v^mi&b;bm(8n_n^9%5)?5$$mb z7b6!o!~>!MI-r=a`Saf`9qa2DZ<@l1NL4QGy3>E4-LjZ^*f)NjGguh5@1aEL{2m$v z|3U{LR;l_NER$YHAK-*rj$Yc@N*K5E$Al^?Uss4#D&^+I%ZYOld)}A?23S1`vlU*z zazCK3pGnqOY_R8+RnSd-G*f#(rfohWWcSl5(xs6;NVc7Ln5=+E;rF`noIOQLGCct< z*L|{x70HvvN<$SY;V)S`?;W`VivEVw4UJmYc#?9d1ow7$^qa-m=DKCUfXzrxE5ktA zOiYA;ROYOkrp{dl8Zd&ONZ=T5e44l0@pA4f*o4?FKqxEt}j~|qD&CJ>{^~TCc z+dG0lJ4p&8nB?KB|fl z$tdaEzCT2mU$Q#&RaQk6Si|eqlNl)M>WTXn19mA0*Xr2COC!Kp8^~%_u}LUhP_!mp zm5&b0!vZsmO-7KM@7#R2Q+8^s{yg|D(lu*)tJ}Cg(m2$6OUr!K1H<;TR;#o#fAwxR zJeNQ@8vx&Qf%vhp4`egl*a>}egCW( z(A+1YdC()3HcP#)NghsyO0*w;O^BEwe`B}vJW zzLiPiho3!Kf61lB=J)Y=%oSEd3$hVk)=^0JqpzV3(J+NvjHG$k8TQXSO|*(*JyPqg_g$mToJj{D{t> z9k|G6btGkMINxkLBz#}s_gTB9>U7~a7I(^;RiwG#QmV>>ub9=s(-Y?Hd!LhcsxvLsa1bzQ?;eX zplTKfMhi6Yhr_I!7&gr}lQOUD*+Y8xUiM5dE9&c6Ss83zo;N6$`>psnDW50cHoO@r zU5)R=0O+wm1pVqC9-!5{E8em~gMzt^it9J$cIY>5)80&_U120yX+guc_ONJnXq$2g zy`ya3(#dyFi-p8acdz0WG5N*4h}7brbfaEezUeSIM%V`&4h`l*jL(Bh3BX>JP1i6RmZ zrL$aiEG}BUsU!nOnSa+-pnF>CGO#8F8``9BZKl9qLcFO~aR;6i8J~wBV(KkXmArLM z#uka>LNL5U7v;t)qEJ4gl8Il*4mMR=9SG#g-=SQ9lrYOwIksrF60pUy>DQ~(!s`y zOoApYDUO5J5xh~XVx3ND{ZbRP$gA2TEvqh@v!` zTF8Nj!5Yu=tDs%Sneg2d!zN{%Jt_Yf=wHxVsdOPQ<1y9cTu2T*opNLRN5_mK6>?+{ zrlFi)$m>FyBmflYrgjwEY{E}eCVw1?^23nG5x^bRc}9^qS+QjiY$X)^$dnDy2EIid zhW9p#l!47BF%=70_C!`?OHuer^7AyGVFh~$>i8OO-xvE|ZbzII?W1x&cVl%i?Hu1B zvN>c)1meKM(t_1dHu>T%G7)8fg}Y~n+_-(9+^mbh)S6$}A0~?S95zcn8KeizUt{CQ z`0$y9sxH|hJjSCfxRhx;e3GMG0l9syYtNf%S^Po;a;y*Urh)+s6{kOO8sB%4Rf(hg zaB=qg<59$5wTY-bSX(9M0T;1Nqr{cFXZn=0*m?@!oWtU=|@WPTbQpHO$Lvsh# z`zm9A2}YTgG|XkjJpf}g&|;gd?HcVdftXWGgQR+|$lc1rrtUSr4_SR{;@uTb^z7Gw zV{Z=f++^VLApl1d_p0UTKUhqLR`WkBrfe3^6;P+~Xz)Nqy z`x$b%TDs!7vmy?cvR)Bgm~r7hNIHx6YbE^kAYX_!#)q>k_(}_CJkqkZ%cMG~a#9So zxU#zdiHe&!Py&PJenS93)Kl3+2dFyUBZ{9@y;$!mj%=SCXL$MxbYS;0vF!s7ujB1+ z(lZo{Cc%ohrHCpv;~DqepHrNvgShrAtA^I3>7Vgz@@q{-vKA!g>hv03w+vyR1=|eX zD0^j7(stLO(*5KN4KGT*`)$I$(FB9GFyg1PxH-}7GH$$gT3;SJ2V33juj7r|%0 zm2U}_YC1NxbA~yYpSe98zrQddA$VM$t(Ne>5px-jzILxV-BnwI+o`#_g1_`C%=cOP zjc10#^SWa^7CCgQQ8|E|t#j4U$>7SYpHDXA+v_RJ>NO7RH?9$_kngIWruuxhZ-1oO!8Z!|lj=&ipR#`R)I4`t&&yWf%iIAA?QMH@5o2s{QHe^!3Wsp8_tINO0olqAPeyiPgKwO?+`ET}xuRvwC6?%wIh1GAS;E1s=t+ityJ zYEgj)0<$^1s%k4MkL!^&Q?G8NOpUErby%#NMLd7-oB6_bkjRtz4FQD~tu3E)~FUwjHp55fvR(j@>_7vvs6j!XH zIT&A^xyV_;NZ}Ellj%hQ-ODD5kQvWJIU30es~?Zz`PiN#+}$2HgnkxVx6~r{x-3nS zXAzg=;-yQ_c$xdlY!t$meZ(c?#dC0F@L^=4@AsMDou^#VoC+QUD;F1Q(yhwBOh?Pk zWs3tX_oLDT!2y@udT9V`Vp|_`4cS>Ta`>UUSqrNg2cWn;%OPygLRj7eO~uSM|aC_4Y^`UPhtukcyYSImK<>BOyEVEx+Slu5iG zSmg9DqF~196e?XA%T9sys;$ii=+o3$*tdzb*Y|y~Q}T6m(q~_D?jE}u*N8dxcDgi8 zEa0w(b#0sYFFbbX#afa5g7~mPpWBA%N^W=#=vIk~@D@5S5i9rF_g*iGeV%*>vplcr zUHLj;f7-&f#SP^G18K#xLIxI{iV>Mv@uArHs>Awds!1BGkqCP&9GCL})%4(8Wv;*v zwZkrhg{m&k(z&u)lkO} znYmaniQ2$zpSFEz7Jc`CBB5-;47ngkVEA0%MlW9doU2iK(*#85Xq~GUkTO3S)kt2U zs^XD7KksIc3D{1J&>G6cooL3W5uq`isO48M%avfcOX7F!Mjt*XuLE?%UHdQmeo*es zA`ZO-d{t$XOlvAW zeW{f%Z%OBpV_ulCPCJVX^B~?U$NDlP3BR>i*@zVJ*}XSll7f2gEVOzF`yyxxs(hH3 ze$u0MlNQe{_y#2sxG@i2>atJbs!*sS*_L)@j26$a)JZ49)HuC+|4LZ&a;g+k6cEGv zdsLy0n3hX^$5 z74yOgxx}L*5IdCMS15%HjNAD~YfHuJvKhMsQHesnq`Hfk=o`B>|Dnm@hoxChgP6bz z#)z*4f3bRk4ZVLlFB1|;oKCmQ8wa|b$J4^#XJPYEbIY6E(=))YOmffbTg1W0IM9sx z(DenTrF^&{0L+eIRmxm?23%e!9}guaw*rr70-lX;CMLgl>10AjvW^!`kN&5=dWzIKB|0~4`Hqeesv=Yy8UMk%Vulhae<@-Q zxy_vQiOC5y-crB5fN;-s!TU85obl4?&BKTsBZR56*nC=ckvHmS)Ls+OZp>ZSM|%EY znubUc*eRgQ6`xOnwR4TtJ!$k<6&GF3*nAkXoJ%x?0F{sdmLjz{DHXYR8@+bQ5ZSRA zpfjMn_|INxn+6h#I>M8p1Fz-DqU|f6ud^H$X}?8G51zu|3+BPZ^kP&Z5#GsgQgxz& zDgOh$B~}Pk>)3nMU|(-}>N!Yn)kq{#1~(fDxEh|J!|)aO{xctg_Z-G$_i-U@z1rJ4 zH{xw7V>94MET4D)_0Pw~#2IMOx@qhRlC(Z7R^?`%b;7DTIG!`wkfYVI>pFNX8ts0< zD!NTybqK6v!;bpYJE==D?Y^F*n)r^X&BZ(xqKi zUbHOVxu@>oX_HM~uw};pE{Uu?|6@@hX8*s0$!GB+c z-qd0Ei@zEZv)+Ca9|$!vq@F-lnE8qf94x5+r{}mlvvC7?Cp+KeegARzrFb`w_r=za z1kW=>v{y5yzbP}JJulkX(AioURovg0IV2lFXz;4U_&4#v?)}#ou)lv1eEOw2X?)SV zi%Tvnot;OJ=Q$2xRUWo=fQ(H8LKJ%!cQ)cY-ryAaojGX8;K#uYIln26RJxA@klAj{ zZ?ehEY+(e+>4Vv#l#9-t@F9<)Sd{;T*!eUBNI|NY;ea(R!y%-rK9VN4J#Yuu=x~v7w*0R8c}Hl3&X}|VRx=|eg5=&1Zcu*ho6Ll6 zKxbqnw!^V^qlP)s&z$3dHL8;TomW7vy#|eHK3tm6Q^wnhj+(QjydN|y#B^1&u7Oxb zn1D_nFN*Jgbfz~#Gqq64$k}ALf7MqxoEq_e5^;9s{~63MbF(ogQ5uQ>HMg9PTT$uz zW;OR`vT0C*;p=2NXg2jX5_%SCGM!TF>}Vhp(s63J$kK+Tc(W!|cmHX2KTUBV2DZF= z6iOa{{sQU5D^tv~@0Ns66?;^C;pL`-*`(iPwEFnr)|UwG-Jo54EAnOBq@O;65sDDX zJfl_jenp9*aXpA{Z`$`Q%GNEX$V|7eF zD5JH$GpZ}9eLBt&!nmE!>T6pM!JiL?Db_Y5&D+>b(%K_g86PSHNSxN_J~U=`RCy^R z*e=Z=ej_lMBrw2CoZz%sBsuh4#Qb@;8MbPW1(p6VZ=frHe4uo#{CkZ7<=Upo@k&SS zeU|En44X>9*etGHO(+I*gXB#?IWL(aRTczvdLq;1Gq*Uq=ZdZfUX@j5X-ov@b@sd$ zlX(t_a&fshNJZQV@Ol1c4&o;|j}-Yf2Nz}ti2gk3zh374v-N>Dd%tp5@Aup3%*{K1 zUls(JV%?#s*{oJd^+lL0Zme=^hW=dcA@UIkv?@apPVKj(y`g@s;jaFUeeLdcdd>l5 z?62OZ9+w97MhQjPOWwxW*0Sn#`oFDj{?`IVT<1-kNJ3=*pbYZd6}TT}Q4k2&tFS|1 zf@ti|20xZ;k_yF?L~8HZWq+uQy1+Y|$zx0RwsD?554PAT>@j9|5=l&J4@!9KaBm{G zWiu}%jM#8E9?pq4l4~dU{Jq666SWC%-Bk))!O>~w)iKb|ihpAivHLIPEH!xK0-cDM z1L?=~;dBWn;ISKg2OS1Yn+w=TJUS+FY;-J0hEgNeh{7gr*zm#n>9L@>Pt*S3mi@708(HT|wxxJ3ZbNppay%3~}%w7BA&CS1O zKf@hi>jd$wV{uR!0{du^5I038EjOIF9~yecwC)7*iZTBUg~!0C&WskN&0}=tLfVSD zm=>+wfOvJ*qe8S~N^qUoC;38LAFw|{G9gnfnsM#`?bS1JYf~LSZb+c$lb|Q$XKqq?t;J;l<~+mCMQjx11f-5 zEYse~u;?2Gs8%nste45eDNA3|Jtf62m`30D2W8igE>D{XF~z;}wFvxUwr9DCL-6d7 z-;&*#8{R+M-|Ee9-y(P^i+aOC@S$pYQO7k_MaE%ZTHY+8FB8twX`}twf)14B!Z3>w zx@#r#hdy?zizZAiP}gtAW>q!PMug$dmlC~Dq9qBGEf0y)S|>KPB#29c!)F-V_6+L& z0(X&2Rq=-khJ+b1Whmy^h$(eKe=29C*%T|&3=3xh@q)a62 zwAW6Y=&zpW@V1v??x)^v?la*c$^ry3&!kq$G8$lt16Z>*)oJoHl!AxJ*wdd}_jCmC zj#-8mq$FP&)7QA7Nmki#o0AbkJ$bsMY&#oSG50`(+V9H+{6 zeL8W9NnvQGOw%-+j%hC*e_T_oQ{#vr@02bEOC(E zMK!he40^jeJ!3e49qn(%JE(x?NZe9KF3WsSeIjJiX`&at{qYCF8eMkAo7rPDSC6mp=@;#4!OHIEG zYI<=;WtZA~=N4Q}EAj9xfIU-h0G?R)t?z8h7(hQqddOg8{u5MF*o+k8ZP5$#0P%qz zugvpCh(*4!?_k3!(?_z^#W-1aNBFZ{Ca1a5^mkdndU;xJ*`C7zk?=5;f^GtS?pH#t zolnNq?mg425wZcwZLIxKP4xL<444$2hrxsxAz^_0E=~~BhDskR8VNFMc&j@jXH?(d z91v8{w4^L46M#$1%+2z@055CTdSGw)|#F?cFb_IEAWtgs%%8V+SJJzImTOoU|SGRrYO7=Yp z_;GsU`sR-|%=O!Nhb8M3Lp87H#P~3~&l#Bg*ZWGWO|_YeL&bJQXVULla=Y4{A&Esh z>b>KAus$yJBIG}JxIGqI+9kR&QF)xUSozz&xFh+}3)zVP_53=;CG$08HUDU%xSuPm z#pU>h{5H>}cZdn*$M{L$u9KU9-nB7s^r)QGt5#szp31I`C2}Z$=~$%{%U6%RcH8a( zx~)8Mx(7>gikG%Id7r~-_HSfa580+L7bNxCZ^l}xrT6wE64mcQx&&!bvQ7uT!d~t` z<6UhV21-&(?shTodanKigVxul%bTY|6K3ZaXi9^c`)U*WMDtty#N9g&3%5HUifNDN zodmQOS1kA<`BR;9chlEzpRSlTB42zb5gtPwkD1I}EL`R3jGO7Ix5KThsH>Bat*Rv- zD36~S4WJh?{}_UE1kmCzwkRG$f(K{*#t5JEkGLD<0YUk?vxA?Pio9e{;KJ3cVhwdD zOCov*6J_ZL>vt}G<0lpvN`flD4UVhhu^qrxv|dd0)gCvE;SzRYf6zFpImegZTksFD z@`?0kD4gn;*+K#oWxm5Hy?=bQ2j6X-hz(=R@Ss6-ZHfUN%bAcz(AX1r}6nqts z^rPXs%6+FWSPFw>?Ta=I5%p6_59NB&Xsa<5jS27c-%NyE+90KkMGU$L7q23A3Hc9Z z-)91M-gSGR=2Ex7AxHn{i~VBN2$jO#`HTJ`Hl*_a1XW_<=1Zo_2UAX?_BEoGeFm7> zhtbQ#FM|1e(pzAwwU=L8Rc;tYxWM$yC|lqA+o43wAqHGW5p^YT3CZj8rL%vFnBWx~ zhyy}e-kx6eKRLZ&^ySbKY^*{R=ru2LM z9~W`!?-g>dbpe2ODY~_2>339aWIWCop+J-YI88>t*0+LzGOaWr729u0ECvx#Naqnt1MwR754^KL+4`tnW~e=!Y^AOLsqBFIgX)nFO>yO;^+Siypws=O;J^93SpY#wy)xU zoEJH-w^;>`K5i6N+VP?%lL{J5?{5a(Il1)Q(p%_yApXI-!O~qFxUbGj8*1Hdu#d0z zDt_*sm0Ws+!d_|x7LsYIUySHOz^sFWfOXi8Wo1XDu31xdDLb9fwCgb7tPjqp!_3~F zV%-gVwEBvSb=+`UyV7aj@8?LU44Q-!GW}eRL>As#JD8Deg5iRyS68FYYUu?*@j@15 z^&*&^pR~AIcODK55dI|IM&VTLIRcpW^9Nk-`aa`4oEa4}c^74gO`6dvRSAm`t3~s~ z2ULn>=`Bm=*wZNwfXwuK3+^IXAP`^|f%9fgeMeD+&T zSkxY*<@ee?j6juMYiXbWacaok1~DRZigiJg3Mlt6%5E14_1&1e%D6gP{krC^<&E5` zswss_V)t_D>3xSCJ{6-y%*5htE-1$M{3l+5hLS5qK#hppv9vnBaa)yG+x;%uC>sKh zJ%mAFQUDxOrxo2dU!yn)#p1P`=%u(m8ouY}<=1C?aCz^F_-?;-D9s%QKM@A^`M{a0 z+AmW4Q3DS)^8>0de?jSx(t3w7OBwLfiOy==j4~<8?hWu{46KSSS#^U@b;Mee2+wlR zMRueaJtdybZlhsRe%bTpat_!+19@E_b_NF&KNZ~JYlw`IySBWrzEv*RDd0eJ^GzL@ zn(kKSMvGq^yYn+3A`1?q#6spKkOr%sy`u`SLBlMY%9PKvr$Qe5$>c($vf9N&N)j+r z_SCyNT$HCqw}Hacw*?MDE4E4BIP!bGj?-lMT<8;V4nHr;NYv)gENnB=k0BJ;SRF!( zw*wGzDwSrgY*~*Ozx`~UkQjBlUqpaIX;)*5!EGIN#YRzw&MA4XMFhEkqzrKkevcn1 z8)Ts%7<4G}P%X89KTFSv2xq#)Xf`!V%cOhnw41Xv$C41tkOYgXJd6l?w5j(FF+Kb! zT4j`(rw3sc44XC7EIB=d#@+xLVLp^6Eqgg@MmXI?2E^2)ffO}8c5PaJ4hnyXAZ6xA zJ^Xld6gp}Rf}roy|M`P_1$jDK9vlRh-x!_sg4U~mml47oWkf;$2CI+|-XQ)9mB{F! zq}c*CU6tfZhWP5}ygtInfy*}aS2#{|TCsWKf=}#TjxUFj9gK(Cy<$EMG&gQ*(y;EBt{ zT{3D-5}|BY!06Gzr%&n84f*8KV<^nFL(EoLbz;BSEUEEh`i8 zAVQ;g^DdJKX#?d-3qTAM`i&v~#2rL3%#Gsc3($m;3^K7s|(AZ4MQ1xI9+{6dM>=n7sR< z38|-hY0JM4-}zXwAez8s=5gC4EoTHQIBPBG&|L9HeA0!U)@uTHj1k>$>RI>}eGjWG zTbORC9@{4|+x&_HC9n~<57#kcdEtSLRdlsydj{Ek!c%K!nt}{ELgHop_=Fb5d9d>4 zeW+pWcu4Y;P|^4tLcAY4NZ$B5H#R$PO-pGQJK*o{{`KlGO+?t0IfoMLaKf=R@h~4G z6^7AeUWee6FHXSMJ1KY9HX)fh&bm>b3#^x!HVk7(BB$J7#&d5} z4yz0h@InM#+~j@PmUOolA@wl~xQwjiFki^l4iZ{3nkz}@Dy{M)C*g4`0$Ci*(Iok? z#VeHL5vGi7YztTAd2D>D4I?j>MjqIwLE~LG>p2Ob|ii8f3z_?y8-Znv{2zEfu-?Dy5y~%5jznl@31U zvL5-@x^ux>*#HnJwHC6m?A3;X;KC>)k^~|~LyA{Z6iK>>i@n#s0FNKgFPee|%uhB< z-))~rkGJdmeker_|B4N-3a{))JJ9vY%(gJ$O+BKdf4rk@ z(2d{H!b@7==$SiV!+rYP$m13NR&HE~wg8Y4^4+{EfXc`LHRC%;1gZQ*%)LOq()po7L16)5m9H0b+)G#Q1!0EPzye9mk zdb2cvwnSaKxBYMm$tYAI#CQYCBb1sf!3!EJE{k+Md7EQZz~x zKhx#h3!$1bd?wfw4ehSn6zt{7krmkz21Xm4!+{a0ZinT)Wa$fXBHcR|TC7x0EW1og z#f#Pkpf~*y`azPE(-f=jQmn}TCBC)8?Nf9<^BvvI94QO*$}XSXj@?_ zFON&H@8NY_cw58Pit&hF4t;h_^V7o@){!N^N$kxLBa64 z^|Kad@bxaWI!Zfm)U6RVMSc-`nM5Im-qpFnj63#>r%(V1q=VV|9aNyEvqb|P2*&3A zUQ9Fj7d=FkK~NQS!UWGu@BHV7^obd3Vx~wjoJh#Z6&JGyXk#W1C~k2lpsy~=Cyp~n z`+=>cn;8!)n0vJ;2gK6cewF_H!#el4q;G?Mnyd?u&MXD=lpD}#5wBH}Vh|^rq?^Fh za$kq8!|F*UJc_8JVzMLZg4=vMF{apXx*W38$xLs=>B z0*n`WuHSJ-N^ydoZ=v^h#E$motIf;47t@ib6tis_RnCV9o!0jYMt|`Nkua<0{%fHu zxRbAY=#?NEVCI zb@MKxL7zv@jDfgB3%K!*g-^_55eAw@(1wTpJxZ~%a6Tzpnp0NYSrJsL%4@r)YJ0-M z{U)6R&2N;{vc>S_-b1#K#_z=a9o{3vwg?o9VIAy`bgd0yU)6(7<0*KSdHqy$ktU`c zR_g*HtA3XC6&MUH^RGF6KI7Hs`gy0G1&oUP72YVdP1qly<7Ca{G)NDV))Ol!#0
    cGW>*0_i(HpHsK+zg z)=5p9GYJlHEYW698P+PnX_a)i&auSJYRe87r?alc+rgicL5*JCaBUh~dJ!^VTNClO z1sVCR8K-%%)vl%Y=Txe|nshnf3Rb=!&F@!LO?9U%$y9}RUE0FNuPBUIp13GhWuYUk zR^o&aQ@hg36)J`{2$jf2Dy$bOKn}#k4Yi&U)$HU{bY=S_T9mWXaA6mEr5B^eQ{@h@ zFfs{}YIaB&QkG4oc8X4gQixIj!f5BqpcbVN%LgJ140j7Og-~DtBFN{>V#{Uiy{h9! zQ&UgFlcB0xPtq>O_}unP`+lwx#)&KW+D3^6@$99=VjXqtQb4~dqcU>-Q4E7D zP9&);W$QS5AT)F7VVxT99ELJ>yO=tVP!bM7TKmo17iqz&A1T<446?xnu~C`&#fz zrc3Y%VUCWNa)!zzS5LK6S)=OKQL|ug9+9-gi!|k=^Y0of?9x3C1FwyRbn`7vYe2M( zx-!Q8R;#%NkJzV8R;txCH6-^KxqRlOex5^+st*idrPp0*5$}}Uokn!jp0o%hr-e*> zM2EH+8K61qB?!M+fZor^3Q`gHu-b^y%XS_%j9j@Q^V}oC!LIK;e262b>%V+xt)mqM z4Z&|}$O+*=f818ta(NPRf(~N+TRM{%PIG#mc{sg21YAOGG<)oln;)xAC=9 zBSKN03p&xJ2;~BJ6N+ud^_D|z06})ClBF|-Y-X0r_IK}} z!$e|Ah%P2xiHP6Jc!Vy33XgD+Np#EyZBF$8@8^r`t6(c%^zF)Bc=9^)*(vfADii_k za7Re}${k^fff5)%#`D#-h*ENNHXRyFXo$d!U>b)Eg>WG)oLFC^%gw+}G(+(UxX0$H z8GQ`VKk}0+`1fEoe{C&QQE0^&-Q;gV@WS?&!p6BP3iP?_VhRmHO!#1FU&AiKui6 zqJh3^uy5|A+|aF&C?UbYQ5tiobhSHcfcTNpZCbVk|<7!Wpv;8TEME);jAJ}`MS3S)%)Bn zY(9c{YLXjxu2jW=crcDPPQJw9B+<29UZivcKV>iY#0utdNg~S4vHl03Fdo0+KA1@! z8@(exp=CVFSW~e@zcu^40JrbL#pGqpV(QAyRo?RaEWsThG$!Fh~6NiQE@r<5oP>3H_luTyw&Qr9n`s}zfi&Kea z%4E{ipfN6dbp5Z@9))|lkEk&brl7NxB= zdz&Bpwm%+f5g5zM)iWwGSj;dfQe-#jv24G_s9UOGGE!Tu4q zyQeXoy-XjR0FjhU1Q2C>O*|NR66RCCFyBUCQNn7=d^80oh18Dw2Y_7kaObCc7tQra z@8$XILv=D3pWSn8c$xf?B;Veg{p=B$8=ehQAi9m4m)6qmIs3ccR`u8?0=MXmoUDhn z))O*=$Bm^BtRI~hGqV!9)iLJ^B2{*V|C#%r7hHNog39cr7PCcOdctG5Rs10Z^haZ0 zLVc5OA?mM>ePv*-W4EuH{^DBZpx^yCeY5;ErIDZ}fr+WmZvc%}fBU69?M^b=G4(4! z6N0dxKm^v~t8#78ei#f6J$dPc1ef~ROh7rLTb$SBT=l7;9tn-mOV-e>g33&1&J@i) zEhX)9`ZM2F$P24tcaCWkqk&jRHO4#ehz7iv&}5we(yF80MJM5kIG(Tx(i8 z+PK7~T=9mbDDTj)8MBzsi(Sx$cUebMqx8?1#Tu9|HEU~M5uw2PZ2g;t@axS&EqVIcs zS*$Ah;6<7aF(WET`Iu{i8W=WEt@LUD2x1hgA|&fM$6-P$+lnxS52_q7!g*iItF}YE zf8y33I3rsvJ4r@^DJMMClvVY2uX6i6eo6*&BAaP;>i<#QWqbg7g<8eCAp$!#CHaAo7iWD^P|>z%xplS^Hyg#E1#E?O$)DGSP)y#-Y*#xX_8!~Y6dOaYT16-`+&u2 zw2z}^6YJ2Eg5Jp7bcj~&b#wuGMt?3WPCK;g7ch5x$@T7T&%W;Ue4!fSNSvCk&j55zL}m{m-Cv<IRx7(%JWUlW?ho zvUER9y(!!yDkmRyxagj~>O#foknwtp8UY_HRrs@VorxCI;K08`uL82wp^afpd|P(? zE;TcU73Qz&&vG?9uny$$a<(06%=X!2-RDs};xA52&U?=dvgMtfZ+8C{Lw#D{-WUC< z5DiH>0rf))KS*cbxM>BeluItWP_}&=(&=8^*C`zy>{Zmi5s1Y$5%$DRcFh*Kf+5N9 z*N(sA3Zq|e<^b*)fIso~3V2ylZT*_!uP3vFEE}TOLC)q`7>unezTKV4;+h4eNv8VnQv5R2ay7V(6O$_;`oOjoJhfN551h zN3vK)J>s#@NVau!st>rr>|?9pb6Z1+FEv9B2ndlP29Jw7jl!}|;QHH}{DT^sugN=X z!rb-g;_D24_5=C;#@p{+LIB2o7ICbh*twg)OTgeH)1k%Jgm9#st6Z7@_dNISqwj@z1O7BS z#X2Zu{}dbEyBykLMOA;nLzT#X?!e-twJL=VESvFo_oojJU+68!^f6#2nrRZE?AS_x;g4%1j z9!M$Sk)n)ALoXY)l3?5w#TE|5Pj>ME`b@o=Hq$90J;ZOQU^pz}zt<5+H2GoxOesD44Xv5fgE1g8HzNr$67V zL($9oLAHfoQ#-=IfZ?QR^CWqTL-Z4a_d>O4gXZH@A;Ym*@b0X*%LLo_4*RX)97DpL zE%h=$JUOBl-!QIivgBk6l$n6#l*HR-eF3>Z6IlqfX*~B0iU<3b8+FbxoE+gv>=7{F zA?Vm{YG>-!Tt9B_XMVfet+--Y$0_~fl(-tkN^JFEmWzNc9Q+w0G|#}mm`bXD{AB)U z+rFVuu5X|(Pn{;+IuhD-4QIF13i=LplQmzkc(TpHQu5V)Zu2ipd0QEI8=-!gA}vp+7q+vDPT0A89J0 zU$>M((eI&Os&Z_PZ3J5n{QbbeHysI@D-QpGggPu4r&LgwrnZRpT#n(WCqVv({;?-K zVI5qj-Zn*4OC^PTg_fx*c=t5$kOhbbuRRMRc0!(vj(MKVD@~pZkO4|_BUXtg>S1-& zZpdg0g~B@KhXA@NDb0;LTjf(K!0`qW!N--$kO@+0u$GHSCn~a-v{gLV zDswZfOM=uSSea{npf)Gr)tJRG?CnF8ChxtMJw0FFn>2mSS$M`*UA{@MI+Sw$vys%@ zNy9Ej!mW_6B8XYvw=*P9DFJI!w@Bd7U`wEv{u1I^58PKrS5*g47m9>e{s;Kv_T~P! zK@2T!4#Msxbi;|^Ic)=pg1eUc=Mn*TaA{uKa|&NXqmq#6Fi9$YOvwiIU8&iE{u88n9vm(-?8kKYRma0Bl4EPEIU zy*$@VL;rm0Q6j_yBlef&JfgvmC(`6eYj-l~uuR zQQGgS;ED^HLE^3NqYPHx;sFkl_ImF+$-f%X*Mekx5s53Ggy(m--YH=K@|nkwDK5sc z0=52=9;411j!j$7TMYn87RVGMe1HO2m>_!Rk0Z`3JUfRYK?`wq4h2lO@X`D!5TS$o zk&tiCZL@{BvPW`^uyR3-V>=oZ@)6g%NBr*uH`Hv`;j4?wla#t$dWLb&U&6&=8;>=G zsF5$K?S63MC4NvA@Cz;=j$dLsr%yG6=^Hj}xJO+WPvudH$Se`_R-htVeg{NVg-mm+ zHAX74?YKkQ4sM&YD5tm$ytl)MYo>}s>hT!qv5f1JXgnm4XYJB6#js|-Ny<0e@BG>$@#~|!}Z^Jk-7hq zEcyS82)RL7{|WLc(b=?Lm%@^Ac*6)L6R8j*a58_i$?xNfobOPytu1zMZN~1`CXltI zNus2spD?byx1ZDc!+)NEi}Z0?e8yx;633IxE4=;m!$Yc<1R8yBEbn0Z?tMyhz0vST z#4`rx$M=V$r(@d|n7z;B$QcF-$|5Q#tOQb)&B8Z0?l9tjs@;scg{qS74lnUD?Ak+Y z_?OP7cn?iaZqZ3Kjp#SiyBl0L0R`OPubNjGcVQO3^b^dB=%)os&oQCti8R(&>JEG4 z(n2Jc#z!b`eJ*v<<$OR3=-k5iY=-R?LWO;(M#;stZ)(g#q}t!u4GCS`<_LF#{8TIv zvL~S%AxWnJRmnSj9yAU6f9iGyOB+s%mCoGgJgs`s%W|2!`%qche%=U|)KA#F!ev}d zqK*DQ3;GHsT>%|;-Mklii!t1FkWxO^X--|}4!4869rB}}kMeg&Qm*Vy?n+I4Lm_`G z9{7?aYj~Lqyz>?XT=`7>bDwf6ZH+@}+N6pEDdd}xeG*R@SG>tfZtXTwdop#(DeZ=FH~t}=>suJzGsWcN94w{j_O$HEo7m< zomM?{Kp}k3!l+0KlaeH(v8%%ICXKEE$fM0o*$s;`JxBPqE?bBloFrDf^N;|6Yco|N z??x0JiSsv^6Z|fkn>HD8ENFrb-X6NJFG?kXMGj7~X>r z=q)LV0g4#0R@C4|Bn;5^J zKnh<=WFd`BFNlB}ge`Yt1jto916!hAVZT1yUM2s76XXh>C=T8g$nfxG^qJy|yrMUK zTSqc_6|5cVjq`43CunII=Kn3!{WbD2j|0EmU; z*IiiY%g1F|S`MiW4os<&Sq@m(lTYgo2el3d(WsFv>N`fGcdn>{!hy{AveO0f>BGoY zf|7*7>Je#RpG!8a8W{OcsX?PO#*6Xgy?KILvY=}t<{Z_N{U`$1T22F3=LX$^vaBd)c3@|D?3O$Kc2E78fN4M3zP?DVCk zaCIrIb@@2*Ge@#$mfHAcB*rnOs6c@^X6H46{|y2MTphDp^#ai<_FE<#rrmIVKx}bM zK=?^9#vSaHT$V@*=z(Lq-?si-$BjQ@R0nNGM@S|(VF;Vz9B0xyqTYM1XKYW2;CX$Ze!A8mqM(vQM4})|r zf0(&T>fCx$Qh@s)cxPp*Y7yY6#UHYz*q}g=7S#o9JVOwGxfH3Qp}?29Qeg@SzlNZH zqpw;6Esv%i_BIwWl!T4n31UK;^((qEZ`c3|{58tLy?yVMg$#^Y z1q7|U^Ss%|)P#&P^eOV-K&3bPA6_H5T#w7o0w)mtS1z!z-q4>VIbz8@8C-s*W2u}r zMGf#_y(Qc?St94OBaE>IUT&2M_;9xXMQR4(x^mlzn}H70YYNs^6l$qdci4Wr8|Aeg zK9!`Z!6}jD^J;(-f~YUh%DlQ4o`U6-)Tb@t$c=Tv7=c?buGRWT6GA^EQ#eiPnYH>{ zp@W^OEUo7n86Cw(_wM{umyW*J2(8jfS{Eqwv67GPX9V)ybW=pzk45k?-L3&)5J#-b zyqvi+CbqIK?NYVe8l>n>mPC(aRWcLC@#K9dzsYAttOfv7%x08NA@_^q5JsrW%-~Y+ zcn``dGGSQfKb;_@Rm9HBFK9Bu5T;4L>5OWjf^>vOi2~;%6xwsH%c8_nND`buZfW}N+xQ_=A^MmE?R1>NV*AS^#eCWVdc;!GV+JF__k*jUo?6umIzyr z6VJzRIo`f+ZjS}?7}Af|n(;Vb1dZ0MAWo<9u64!kV<0#TPGWv>#zbH@@lsB-KZ&Qn zwA3%B8{&J?*#4uT)&zZ*hSXI#2>?g1Wqky3!Et@E%OHkB$b5`uALEN*gpyv@p{;yX zu1R5c7Z>fQnVJ}}7lT2%Yje0mOjiVaXv3OU0Cn-Uf5e3%4itnLO(RKW-n3-~`b>{c zul-8z0MR+Ge1Saa4`W&7_I8HI_%XRgbq|SvD2r(3ACL&!VnoXHd%CIJ3Lw)?fB@Hn zIn61C?071h(b$#I+t%e7tGTVO@7HPzRjDHB?s0yZ`vn8V1|U`Z=0M6&Ub2gHbfkCe@NwrnmBfU!f1|nAayhe0ptV1wCV{5o zsWl^Xa<0eeExJDzy`poYI9mQoI}h=~BFhXQ`wgzr$YB-Dn#Yvq67UlxV$sS+{6Zeu zG7O2mX6zcL4`Cu4k)@QYG(HgPp(UhdF)5#lCk??qr6T~RDy0Xw!U`ZE>)>*ebcCYpL z#7ytg`2D{e2lj7v|Cu)C{ttVTorQz_zYqQ=ulWD)9DrBklwc*=Kx;!%00-}928LoW zRn6oTKfS%$TjBEzd|u;hyXa8FRg!S_!|R+2UyChrWc0mA;y3Q~F9J=uU3n-^7=MI+ zVs-0(F>g)utkYLqG!7z*Dh&C>BRY9D^t7K9+S%1!e4cgk=X#T(c-10TyJL!4G)8A= z_L{}%hhh8n48Z?n$f3;A31G|LgIN`+!d5v1)g;S(N7=@AN1_i`Gc@#XG?uD>Ra{(Cg@` zn_v3GYN@w{AQ@h2d+Zu*owd zMY>lmY^S?c^&dY{*3TkUVX5r32hp_-%=W3+D_UiT2mBpJ9=J?^QzE;f3ol zL3k9aO2#H~4^FLXE#%?oPT2-dhY{Zu(PbbJO~SRFZddj_Gyya^5y3nxRIpvR(b9b- zsHNgwxo6PpX8LztzduAq+N`~FTguljQPtmY^6e+0j0#t7$mPNX$xkW$uYcz9q75$< zib>{4LadS;UFoWS6_g{4tmh7Sg;4aHn9^h5Miji0jAzt{lXo=T2D6RAI?ME?M{lac z|3jKAJ%{NA=?iF*Uw3b{+DT`pIKHj>g*kzj>mE==Js=8%@YySN=Cm5(fq1@BB%6t% zy^|!%(O?9YlR;KRTwVOA;Ngp~9R-EYZoQvG_?< zy}ZGasnIX7en3-$-7ll^qqB*Il#AD)v2-=EZpY~<%n^{JD7n($C~Q&)!((Su#2O3& z%3i8yln!PVA<$jfA5rOkvdQ2OSN>DWf<~U+m3bkJ+*&HY7{tJ>oViShQiuv%1ysV7 zP^_xyc=kNNNQ9*@X>07Tda3-G9ipIaC)&^CDDQ4z#~8!$8@ZqV-R^L8F=r4kcQ67X z&GGK}U(&`z2*?t0c;4S&-@l{{xM4(rYyd>v1W(uN{z2B{umksD^zih_`pxib>&gu` z_su%0QE&mKS5I*h|KUC=of)OgGWC?~gPDhUqD=IBSRUFJI1ZYI_|Iv+$h)h(Mj$n=8Xyu-re zT`>J2$G8*TX46!?o*wvrYK{C+lLd(1$x(R>PUal*e+5N33fQ50tgfOhmzpW+aoJdY z!SbVPk7+69?UR~ohKXvk^n~ti)}T_h3gFeZb;z3Z@enfgU9pn8z%z24>!uTeY`KXb z=7Yx0g@M*`EInq~Ni`RsVYDWzK01z=n?FC7-3GeRNTS=7{#G0)|A(yshbNCvYM$LIJ>V4=HM#wT;mzBY<>p=lS=)^5TrAbg^Xi%C!<$jrYql8JmiL zO(5FAZ51oF)N?>Uay-ZZUOa`<1;^Z(*lf_JETF_&k-~WoaedZy_z&r0k(rHu{Gtbq zwFm$77(&TC8J#N>(#+rr?Q-l#_;k>vKkXyGNE6NFT0i6;l zTWr1myZH1bvo$3bI4ENs3PWYKP?r;@*COeEn$hJ?vxd~2Lb)|yP@*bC8q@jKMgBv5 z^F5d(`rC#K6cfTT5GGa%l~cMqCl_{KtN5hSzLQLx?c|K;k^)9HT{#kuzBH_#p@be2>LEX z(beonpDTVRP{NpQER&E^>d8S%j0b$a!#7=Z{eJ?vX0?rA6GW{=M4wT=TmSQxEQR5U;S%>085EJ^54MNKW?XkvrENzS0J#QVM7*ef zjt-*qp;I;hIC&--G}wuE1*sM3?7Job#hqPDp*WDnSt%}enJ<;OkQcHyWmUd$3|iI& zBNfgWVa3B>-YeX^`mQZ14y|o(BeQsY0*R)AHZ7`H2N5MeLA@v@BRn)Agdi$wSqqWn z-Mcfby&tq3pYbsIwB$9dR#ygwhU(YM8^;wbc*<@KQ01R|+C>PHSGrj{LZf8i&qEx- z|K*9J7T{TRb&2;Y_u2gAqZ@GamiKaUmbc~C=JNzi!iK>E2idJ1vG`*8bE~;FQ6Fb^ z2xUd<&c1D2{xafMK#+)L*89vtX~;b@5iOZ8FlIDGDkSWcbn{%!iJH_$bkJosG)Wc0 zEzPP7(8F2OKt@m#S~YBkKt+tN6IOynAffbg*^rFJt{IGEA+*4Wn&uZF0konEVyCO+ zf?MbPu|>HwfUN#!Lu{$mPkHxgv&-N zNbrLusPC&fGk7%{sC`bMj5SHqg~%iQECTC)X&XMDv<>?ML&N`~ZEQ1hgz9$n=`*PfqcoA(s)C=7 z;SShk(j7s)z&dVNa|ZBbzFMbsfWq+C@FN}1h3R+Al850=ju#j|x%=uq52P*zb6uVo z?=+L@*3`E~h`FBwTXmEeSTT<(Jl3m=C*zwP!Pky^^*w}US-&C7`@Wq*m^hm}^UgZk z$UCJhwK^SYE|Y{AKfV|% zE`#r4a24Zl0jl_p3&#EjLo={+bdl6~`^ov5`E$Tcu8ZgQ|IE~LbN(ldJr6fKu+7>9 zlpDxkLk`4uf(K4o8&a|TjqOl{6B2@B7I(0BHM4hhAz}SX_4w!5r#J^=YdAJwpS3kL z+dttQ|2LHFulWB9$^-1TwxVYLJIw!IV%h$;Sa!C5vHvaO|8(J>8jJr^E<4v>Ebz$= z6O_9V*?h5ct0nD2{)KS;3*r73@|EOMrJKDg2`eY? zha*2U&%Zi8%Wq-<`JDyO{<#PKUguBuOO=fkj*S&q?<5Mw#tme3CI-eip@Olqe*TpL zW9R(bs6n#x!m;!Ig#de<5rG2E7=JN9LKh^6|Fi`?$D+E3Y^0F(!4U;qE&QNegP{}s;(yz^YHiut zhOkPb%54aj`ao1v<-iMxloU2Wq#+4}6aprJWriK*w*;Xhk#){&iz@%xuk7WPGMk0r z_6I$DAN$^mt(#7Oukd5=^qLRi%uCnjCt93GfsBXX2gXc9dIF$0^xTOx+~ntBD=sz? zyA9e6od-PID=EI(70w(6n8L3hS|p9e0|Z_++J#?tY2S`H1_B3l+9%6Qd(t{*^x(0& z8hM$71V5w61ibDWDCN^;kiO)-9gf+qBos%~t^RcQEvzbDxcl2g%oz9}F$7UYF`cXJ z(c&YcEqD8C=;H+d08HP1a0`o~w7aSuP)#XWc^t|ql{TIpTiClgliFCbkcL3EZ7 z|6~;Gpf+_l>Zx;lfQgrxp{cdJz{yLgGSGW_ez6fs=l-Y$dEGVGDbxeu_eVq*Ndba;xeYK&si1il0T(LMemHj48gx5s?XAvJtfsd z1rw8TgtZt5bR;!LB@3dWLT5&?iNyI$X-vqP5~RRen5rK@+U4kbbx1no_nFALOjZNPsfYYKnIR8s6;@^(b_ z96w$IB-oTl9+SQOX@9Vo!w)GWBOG|G$vnk4D$y7^%?$bpf_p( zajAU(GHU^JtQ%5De9~AvFSQH-Ba6pFp1c^b6&3q^1RQ(Hw;0@#d|=qw;`r_orCorK z27b4Aj2O+?7s)UH5o54)buu8ZLBb;{?9ZZy=pi>zOzQa>mAAw`jxPnO9C3!STtvK@p`(qQty(%H}DYJ8u|+OVeyW)Y;SxyA;i z2j&pIN4jy{kG?QK0cM_E9koM0f00%j4s%h%@Sn{;+pZN3<;2xWZOw>hm>;{N;&H7S00v-{g3XHBijxe3f2>`dh!EWiuz*`-7 z@O0O+=;H7v+7N|Gdx^W8rEd)b16p&PMg>-lhGfS`ze;k+fK}>;%7qz7SAcNrqoPv|B^U$t8nrQ)(NcA(;U zt2qiObibPU-DSYW?1N7+cM~WGo#XUBUN#!RF{h}PnbXXRU?t$1LB3=9OG5Wq*U@>m z9;R-RMuTQb6p1TGnD>K>y;xlW7UTcoJDMw$5SoX&i%I3i^2E#MuoP!NizIRFumLvly8XBeC zrXYJB5nTgZel;-~cAudp@8MDq6)Zy4E?z1qRj>rJoxorH`Qr{e4)7EJWP@$VEeUa+ zxe_oL>po5&@5uvto&{5%P z9S{qgcp|2RE#DlEN9FNnk(d>K1LN&6c_kLWb;+m$i%*Y&)ckIG(v+N$4-0+equ5u zeK{0&LBf<7UAnD(zj@jI3%k|wXUkE0`18a-GTS}#q(^}wEPF0}WN~71bwrYZ*N_swceU%as$Bv0!W@0v! zT1oV}bldVQ3hAl>(2jH1nkUZM|44Qi*)#1ZuegN8>eg`o5v*e0kC1Lc*^19L(S&W4 zF4j!Mzo~7xT+TpN^<6>@?nu{0(nPOP@VBG>gt_olYx2lWA{y0$%&05PAeXUWXemlAz7asl{fFt{^*VYTZ#7C(_zqbEr z(Y$CGf8VU5lOrb7rDDc)|2pa6N=!_ndEm$Qawh>7$eJEObo48%uJM`B+Uw+EDm`Es zlyyEE4SZ5`5_}R!_wuGiqx4DQ4EWGsBB2$gEQu}-2IgTWXV;5P0}VJMEv4e{6O=C* zwIMvs+;ZI_K$Cm%aP2FR0b!3HUxl4R84l{oZ#vWFe9_gFc^1zCUS}&rddh2qg9n2z z^b{FCg`G!VcP@O@lfMWpVwmACFB}QdSv$N^H8~Se{K~z+>&4}vJQj9q{)NSZ{6)TF zFw2^vz9}IWIRW1KcM1|zQ004qjo1OnyAn*PG5(1(8)vm$#MGEgHw+Ju87Kx>+jL@?#=BLc4-ZdRi>0 zYz43RHvEX8z2RwgSZ%ZUvj~oYyquVnCLBuG1YS+lx0#v6n>8P25cf6SUg6-wJSRJL zqv+TTWk5O2+-AWy7J+zQ$C!p>;yPCAdKEw%%L~oh=I`IA=vd=eu$+ZVnt!_Yn~b-~G4f=nQ?ncTvIj&CoPQ%LnQA)lSv>&ImOurff!g zJT~fJm!`tGMyAos>?*nqFIO1N1}_RqLq}`XcSkOLiKwb8j(~@bk|`3{-h~~tvkjRt z8UyLx1;Lr}v#euBXbQ%fa7H-nMtC@K^0d7_Z2}VyHy`LS0W~xm4kn&SrDG>|ND5dN z5@Fsrx=6K^ud1$Y&^kPUbET?Z{!R}@)ltyg@t`jLJktci; zDu@aBRs-=X7H^6-wtDGZdsA>_Qk=a&2$qRk+#HP>X5{tbsk%t`X!Aq#4eeV=pgm9f z1#=oy*)JG|VWuNh0~IDNDB5w>+#Y}>ye?@#IPKe;F_tO*@qqraHb$7@O#64=TvS3X z>#urv||O3?WQeY@I^9S${!ALW{2XDFT3UaPnY1!;M=^!7Lp(} zUpU^0dJ>(Ajq4p(U53;~z}G52u&NVkYh&aaU`{pBCB)==96)c3uN>%z&YUQ4xmEx% zG*i+FJVE#=^_6;hNI9&tqy+hf`c&zZ#s!yJgdnS)iN|EJkv_S?=wirEm=)?`OQmXe_nFJhn+^2Z1VMslapvn@9iQ!M_ z?JI%^wJb$sB4gxRE7VMX`{B?kQn%WgHEj(ioKEHTH&4av4pgQaJpBRWRkYMSq@!W` zJdxuSmsa6328~dRXm~Y1lreqDl8CmUSru>Z{*WACyQ$8o-cWgit1e9HRXUpF!PCJ@ zzO1}pWO>y$G52{?9)On2-luL1{z4zE1`>%jf=Cn0dYRB0^2)GM$YJ#6oi+bsJh{f4 zx1uk5Dow)*P>|t;F-0ugPfuQu(LRm;kVSI7COmm|@H)kI7Lp9WKTl5HV(gPS2cM2{ zVGs90?zmjIS-_saguf1vkr=Q(V9dpQlh`l7_DnII8#P;|hr)}JF~tYKzqF-kqwO~A zZH!rYf-Tg2rw@C|;Nu({wn{U@#b95ltKdmME!gPyo+9%DWdZM){0@gzM5!)g(-q2T zxJb5v-yLSq-bw&)p7B^$YKrzydGd1HLP2J18-nKLg-cP*OwEsiyp^j}+Tl2IJl+a! zq(=6Pc4DGG(_zq#W6-`pnsQBwd8%`yrP!m+RIPAAitQ;Kd5Q@MUzQ*9S5DpZ2_V{j zb5O~WtTzsIsxq>c*{vkBP6hn>Q30oS*Yw5 z8=N$~chgWawoy3jrz75hMk)@MAb^SUfUL5j=x78}-QMnni8LX*Md=xA6|lYNKwt`9 zYn$IkC)*l-m8LEuT#t53*c$-ERsSYO=77%%>IK&n6%uN-iz^7n>f*Y=4oxi@IxmH#M9J}|AG@%k~=+$Pbe+5xOw(L6ftC%^pW1UM^M{xP`& z#Y1%w=fKBS*X2Z7DhJ7>Q}YT1tN`uM=e-?T+42meOcYouwIx@S?PTHa^FthPhbscuOvP;hyr~T79c*zZo3z~LVqo`` zy++3p1~cBxr#mMyZlJ-$%@R5Ng7$zm{1CnE5}4wdZ0Co2*qNHByY8OC1D>1UK`Hk_ z=6&tHaGc)?Ci4uO#~H+o{F#e8;Hg=Ba|dD*pS5hM^+U_JM#P-;%z$mt-AK zIJ{j|VG=xz+5PF;Vz)@fywX|pjrMvy`U>&4vp*bA0bvX(y*XqQ`_Ncp|-q38#`5mv`k zF#XsS$N_Bcoa!Qc88Wf%QJVMXG!P#k9i_$~-%OCnz~?bzchKS@_J`{;40i|}eR~nf z=+qam3Vm|j({bQ8LR!}3qv*go_d>x$m9_~pTF&ZFC%!0g!_5KArV%|;vSpf!=d|lpEv4j=ttva2lylyRm@=b zUmQP!PveZ&3)Y9OdUJT*)sBV%1ba3yoj@@*LG34o&ta(M{VJz9ZQR);hIU?Bxq@2N z-cM)!eswA<4e!{Em}pJs4i3sn>Zc762c56MZH>*(Se_F6Z>Rh%@7saF>*@!iCIprP z{$nd6hB$r=CO=dWj{v z<8ptlgc+yF_zxRZYOJ89nv$%Z2c=Gd9U-%^L5*`;zOgDMQ|MR~G1mD7jSY)%i4ssI z)usuoYwnK-x-i|4iinPUu9h^trNj4!3E9VUI?ke0V-pj}7KK`K>Y$BL6PyGZL+0(1 zA*>9C@^|KfK3?B`AfUtp%2fF-x&*ZLL)ws7VsdUy*dJ#=&(pE>a7@vhB}^3AyF`od z;B3{xWlVm9yGuHN)b#aoy-Rr8e8Fy$8|*~ioT9enUZ5=?di!~(Up70Uq&4W4;L^LR z8DD;%{+Zo*wl0S4)tvTa@in_IyEoRk%3P!*#g&~d+U@YCUa)>Jz(J~f9#gtLq2WmW zc2%+&YZ5tP6rCm~O}~dfEtkg3g!w10N#{>HqSS;#XL=11B-6bidgIwHry3B(fNhDb z$r>n4(z>(^Jw(X9LT0mzDqFN;jPuy%G||n+{64t>3G=qI#9?Q&&SX}6q)4NP8&iyq z`rcDc`NEXjB@1m=KsU!}en3I_s%d4_pV}jkTM;)N%@7>9lNwd;x{h4i5`lm&eV^Dc zNOc#0%|5J%VR?)prPQ}%_dGs}Uc6omixM;h6-YVyBh&#SxE{yb`Hr_9*q3gJKiFh= zT_PkAGy2WZJxcpHU6iPD4);jSdrySc-Mr)?F>tii(xn^d0PGTB{k*};Q93NBQ`aAs zbSWf6#TC06PL_PnngI}(o!JvzWOh9)RdROVSju{8zNw-8Oa)9wQH^UWP1RUaQiMl{ z=5k-m&WGL%+;o0r_`XJIisj5{FLYvw)n2({RY*?ZwfXuY&d3P`YN}!G4ItZzW8H)g zfA61aVfVOj0^p?b>{7HNPgjkdcUsX4)?yFfpgqM4?|=Qwuexe;`n9pk$=14P_X%3> zyuU48fOyIkFYpav_~VbQ4{@8MuzU9-)$guezws}6rw-AQUkpiqR4%So|8Nl8K$7J# z+Z$mfN2Q*V-;S8y-r2sZKm;ec{n6K#bK)1Cr(b*A=?PHX<8ZbP>9ystMaeD;kAL{u zy+qvPrZkXf7ucrU#eNUv9xXm)-cvuXY|WA;%wh3-dJfqA4HuihM=EZeZat~XNzxII$RpKMns(?VT4u+)haV;SL= zGuz`b7}NMv>qZ>Ne7jEf1)+XB2{I55Hw&u|+2a5@0qQSult@)X&b)bIOxQn+gC1EU zBUS3%A{80$nx`3I?^umP2;N6OF2k*TMrxIz+v6VPC1(`M&U%Y@U*p$am;>c+GcM2j z>h_Xh64eY$n~Nt+=TG1zzx)aV6P)eDz^rU6`YqNiHoQ3{-lO(v2wdS5%*$>^DBB45 z!Oa6ufM*XDuG#KClHEJKd__K;PLKEB@3Rx!0I=via<9i3j?m{KUBDtJ$;Cxfrn+Xq z{oIE`0Koy7uED~^4$~SWZZPF}3V~Pp{oFDqOvQSee{y~41)>Oblv2~$o4t;$oX3Wt zp~|G~!db)qZZNO7?{~@mSbgg>xIaQao#O!r`y)&p2&&Y!X$k+aRdLW!(;we^^a$HG z4$_16yxTbwq(r6u(nQAwk=MrgnH{`*)BY#O7DTOCP24tmFF&8_jlVluQ?dP&{^-*+ zC^k~8;^9g`9l#*un;U&OO!r1qR(t(^a?g^n)q-%Zw&_7rf00{uZ~Q=a(FT?|>W9a^_{^gifTvo@#$tJpgW&#>1$a*3K(TyW$T}C zi1rb3UKOu?k%-iLU`NesZqW7o`_{p3KB_w1@qpb`$@jtPhSZhY7tZf`y~6#%3Iyoi z5j1KGT7R?P=s@udQ1aY|6YZ{kw8}&PvMUSUquvTW2ZX&W0mK43Ekzlx5;$D$sG*cX z1#50*Y<@UzGyBO*auqR)^#P(6RoO)4yZ3#@J@|`X&EV+-Jfpy4k=_-yXyGoP)iPYN zO0I76-l?N?&>489zd0uc0KE0j!i6mp*GDCIQoGX;*JYF6XR5pODCo8BOyceU*=xi` ze~|Sp2ZD2V9HlH*{o_$26dlb}@e7qaT_JO1@t`b30FoA?m+kg4;E!mC$jpH*vkEE( zV1Qem^Gz{jnb}iJ`XK*s>2E_$Jbz%fWUg0zyN=I&^dI4MN4GU|Kf{1T2Ah-5U1T>$ zCVaT`y8V;=mW9jh+cm!E(QqIF2x1q1``gi%tS9BRk-vo%v#IokO6k$;o}SAvh~I|T z$0!coNE!L}vVe2xjJt_g&*c=owaLsrL{Sy@a0{ z%Dj`BBnmj*Ks`{gT{?V5fAoWa5wUPS@LXn5>r)~1Ow2IAY}QWk=A#z^Y|&~$YYYX? zyg-QH0N$TfCzSG%$qNe0VRVugo8`!l-t?qT>_hbw=tb3*!b<%-Y9C^x zphYYuwzMDSQi@Ifg0Yts+l`c4^4m0t6i1p3GaYy1bDwM;%Fy_q3+9i|h^?y6>nU#B zw)}JpC$6nlZJ`sv5;F7vZzOPgyx#Ub7-4@5XXqExHWZ-)LkP~b%n?y$RZ@Hs2 zu})T{YsxCNC5sfpamrLmh!;xjZ#yb}+p<@YJssa1(GkoLMw*K?<>iom)_L@}71o@5 zzp=1C#Cn31EgFzub!r$|>|WLvz3ASp)&li2*_o|j(eX46;(lg&+Ey>)%9BdjjS_9qIo$xXC;;S`!6{f6}V zt#Hqs6`RP3#3c(J;K7o2S-`9V8slxE@}L#O0Ayg4&k0%(3Xvcvp0^4_vJ5@;wNtTC z`f|XES}YcRAK-Nx)Q!JfYL;GUBB9budtfRuI*u7h8Z3)Uv~9)XBIWz)xdeF$vXO}J zoQH(xSS!k`uDG*3#)IIzmN)QP+aB|>3ME9Q@j{v9i&}4QLrezh3^j?rb@p(A#Fym? z*?PW^>x(Rz(EEhW!ArwPJ*2n+f-M3q(^qoG0VgH+%KXJ{WXpVhPEc>_?iq z-cd`27--OGf+8tOE(TFbRM>pu0$N2BL@>MxI)rX=659l}!PzQA(BTNe92JCqB9Yon z2u0(r`k}PFePNxftcQDqu^63pkM6r==XN9Wv|itjhqn(Y30$NC2{Ke0Y^L>kPDeoa z!C}S#Pa=zd#AU81fjidwt4XPL0#ccCc=W6zILAhvzd-Mpj3YiGwzSwO&4e$G2N+0*SG_S1pZ;q%pw{hKjZ7si9BygFL#zHC;resXc4CfM|Qlb1(Wt)nMWPHw8=dvkUn$t{{R~4RydLo3aWUAaL zIUP@_TUxf_p#pVLW+DtvGPZPCO)5ELO(eE}OO?P(A+|(f5iUt+A|XkIWP)e_!3oEC z#3;9)6}*3Tuuk5V(Y`?N=mLGOWOqk{29mb15k9U7~x$|qgmw*53 zQ)h3yHfy1Gv8n0Mn6T7v?6cqP{9JA9X>1gwc@o6I%Ux-c=@EO} z&XqlMbVDEnkPcW?3a?nDn3vATZ9`yUjbu1k&R9@WKfWlGIk&v>(V@Pa-{*@^k~q=Xy3tZuH4Rxb1F{TTJ(Sb#|-7NIS9>lCP?#hR$V) z|I@K^cz)brg&I%&+Zrk88{0x;CL5lK&bR}kN^`&7w7#Hkn*8|L72Tr_Wk*5ShYEgQ z+JGujmLk_En!qt&rNRhdq_+!<9EbObGxZYJV51hv> zm$;|X!F_g7^D?HfA40JCrNGO)TSQ};J)?S%txAbWY`WA-0p$ddl0?y(v)SxqiMy<*I(P# zgI-esnX`r=o4T1aN=#HR&7mN=##dnF2Oa3U*2)@dxiC*ZHh;nmrP8Nh4&z3pJNxT( zE1(7m%srpoV4b|s9zURmp*{9GvB@P?Iu#u_WOqHb08iX#0PC_c^NA2#|6gHW9TnyC z{V%1`NP`lBgh*_%yQHLqbW68%cdR0v!h*1LBcQajAR$O2AuSSuq?C00miPC2KA$)8 zJ?A%naGrCYduQ(4duQg^VeV@-Zk;Vdw+gInh{M*U#(kXLnL&MT|8}H$*p0h^r#Xpw z1UW#;B}+8HnUGfZ8h1B7pYVJQd1Z5yS>Gqu+3NKfT~{%rZ7zr4GL1=hsP$T#u2#U^ zDc`Bu!TN&ilj)$yS)fo;qp0YTJ*l?mbYp^j?wGp&mTS?7dzNgfY?n!J3cPQ=E1e#=D!Zy?5+}Ed|DpwK6R&JI6{41 zvgZWwrnxI~|143liV@+Poy{ODt)D{Z>zp$?VoH30qn2WD?{4B7dbXL*wzjUN+6vW* zt-;!nqCYlhg=i#EEvv^ryWiO0bO^E2B|mmvkp6KaxZb)WxF<EZz}bAJ2TYTo zfwUW9HK)pZo5~}v!fs*l(=1mO$E;_5hOEJ4xCJc4$sAg!Mxs2X``A;9SZ=`*2n%lwt{c94anfqd&?B#;=T=lAi4+Tm7Xv=x33F#3)|1R zj-8cG5W?HjO4#0p%4B70IzIB2JV}3!jKRW?*&&G+Xw6+nNB9pkP#ZsZp4GdvcX0bT zhr&p)ZtBwo(oEgcpR;_&0l`YgM4w+-64*pC#j^H%2-HP$#f)$bri^l|XdE7j%OI&5 z1|u9-3E;dUXK%=edASRk*$VunM1%E}ws@V8ff`$};hdFsRC@TyO^3_l7+Uof#=L=w zTQ~9idd^SxJ|)Nk?T6ZX(^fdq3hMds)a(6ydhexC0rU75hc_I;29#vWybd8aptn=YExGn_yW0|)g|uN+-v6O$l1%zcq_m8 zjD9DG+o{|@GvpVqfWiX0mSP}SaT{OwIk=uGZ!e`fCbY{hN}C`BFM8Ku@2%^7Bi{kv zn^tVK%az8{QEQ_-%SW%EKQ$zI<<#P3SI`qyRzq%0im~pYezW-}e;jI%-u_5eR!9B& z88kdfd`!7kVL_UQLt(tc)uFJF04)3=n9=8#c#W96hU&<#Y`YTrR6!r5;!w|p7(`pZ zb77tpyv%`QZNF;VNdwfz-(rmrmXqWJQXG(5M2}SAUL;GCayj080IVgRr9iSfic(mq zbXX^h+)V^Il5B>}cBqFS>5Cvxq$cMeiyX&{C-`I5aNXB*Nr%O%Lfqdu1`03l2q&gA z3CMD`EJ4A)l3`IfbGq1UDOQcSIXz&mWG%NCieU`sL?kqb6 z&1LAXib+T%zZdkZ|Dw#{^RqblZtJ7zDCl_z%aQa%?BeEPdVF%EF#gH>BXJc#LvKru z$@d{}A~+8LT?zMWx2_H0K(ovJ3C`@M?Rt1&YS>*8^-5*-Pow&i)VG&o_iQ?Py|ndNjRcpuco_t%X?;(Ayk#uCwSoX>Pf&qXdnISy> zta5!zaf+0so<2nvy zV&$C19@b*kVw(0hO)%eVDl!OB7E1oFe7Z+pP2Ju$;$wj|FY@fwDY*rIKps`26u> zwJ%NvvP=%vLf(+WOr{KM%kSr>M#cLs6)q&TVoH6cfT8j89Qx-0{Wy~SH2DIE`?{1! z<&Skh3&ZJ_k>V~xjs){jwo#4*X|nGgZri%gn~Un8YRURx$`)c4=lwHu&-f#jXuy-V znCdE|lLywrgqZvwDW8MAm6(HjZGL_rab-%2w8AeUEd9<~!{eeNP17DP`4F`>$hdzR zL@_4F8+eOG&ZCoZ!?(@W(CRzZJo)etlH5bKZMFIlHo>@BeF61+1R%Ek6O)DWKAew3 zJ_4Pz6PWDmWo#El*_)-=c)RFapIKmzj6-{&JwQJQf%io{dJ*qP%Bw+PXUAn%MMTw% zI*)Qb@rMa^=_e^2ZRJ49d`?jgq?UibJ?g2Kx0ryeyM=oPFY${O**`c~j!>Z=NSQnP zT2C_~@|zZ_Sa@rH9Mp;Nu3h9e?{rxdxBzt7h_u4|H4lo6DYJ4AfLKAfUor+76>71K zDIxSrXukvQ-e)E_LK5N2z%M0}+o5B32Gs5(-tqZuzk7eEmcz`%88+ z;8D+0)nuCgi08}c=;JF@au>pM=5XLiKZyWSK~cGe#s!)3Qk zZrUYu1ytlz4iBl^3)jjWGlN+o$GQeJ-}o-OP8Q^ZLy8hsf?^x;?&ASJybZ&vD1g?9 zysOTtHY2s(Kw8~t!HUWzKst{1A=p`2aoEU9QSv+CyUx3LfaABdd{ikb4_A0*aG_gY zvdQBg^z$z!IdN^auJjoC@7{IZ)J*})GEr8btpWw>ncsvNorsYQ?9jyx+-?A7! zo7f&Lw+TJ#9ECm-jhF%2kTh?hFliS8d3h=D+e@TwZq!9tI^$2GXA|4Ae$eX3XfBrQ z5m9!sbE*{!DAwr5SqllOYt5!=p^9JU$f?J&$Mh3+qegQqqQ(+^r}RwKR4L{c>Hak2 zM(K=#hG?x=ei@QakWo=16Yjk{oq*x;c!`dX>VbC;5cqH@K#8+T7r#>Ra4`0N(hJ|@zWq}4s&KjSb| z+TRK%{gWu&!QPQ&#vg_&W>DKu_IPs0`&|VJcP_is#nDzqn}{hENtQ zg+LBH^6u_%loW2)yg4VM`LcI)i7=X(R6HYR13%-Whh>ODrD$JS%GkeL&wD38yon~k zCOyft#CwDdmSf>sR`k=;%}xbh^||zV`^%f?`!oRDULy1xplKhEP zwv*m0ZTT%6AN6}A$UI{lUk=`a6StKj0*gE93Yro?S#+Y~n^%9&yv8!- z(lT}LijohtROO^o`aA_CdLpLpEobnVL=;M*Y)$0kOvH6sjp<4W1TbGUlJ1KrrpMS- ze{v2)r;-^LgqZ{T=y@KPI4kas5oqK8)KdhiW@3-%e4TJ?L~bn2sMV-YaSibHbNBZS zJe0K6DX*yVcgZ{GrV{j>@k$xh<-Wt%J+I`meVcZB_oD&XSw*c!2SMWF5S}3x-I68^ z9UaZDu7?q;)a?ci9#!Se9#u8lRws5T9WU-|Q?)*!GSYL-jMr?=p?4Pt`X1sRZFxLg zMPfPV$=73&oluY#_`p5U!w^tj0LN2}9A@d-v1$mB-Nx1$hyFe}3(cv3MZzp({!&|o9*nYlvlg_Ng zf$4myBbkIJ;YwRdsj=~?aRP!oEFe>J3-!ICAEP$Z9q;sM8sPT#+PIAZ z(088R2FKx>Qv;2AO_qq+Q@t{_Ek%qh06j_QUT*dm=ufzyN^}hx(W_^{2+lzF;sRgM zrhki##cV)p$VM*u)BtLRk(+r#_lHcZV1lW_0n(XKXSM#tC;BLb1cuGhbq7X(^{0I- zrJKjZLLy{B7M`c4tv&Ov#O86hKk19HtWM2jDW>**jEI9Rnwg<@VcUX(+(UiR*^9O( zVyvVDRdv-xS(;kq=`qrFuaUdQ`;#u(69ISki0M8|bUbZjTyu;SLozA4hI>wZ-m^WC zx@ou4kR-!L{U%xN>3HrsiQuvQV0WaHiw0$=^ox*yMXloTfmPlnuKvX@wAn28RD5Rl zaPSX56>otW_t$*1!s5qx=FY#;9hW2nSn&mo#X1@2KM4h#Hwwoj@yPgR$=XLG=#8|L z<$J+z44gl3^%~!au|(S4?oP_)?B@Dr6cyp{!SiBu6Wi|T}(%YIUo5dp>wPJ-IAG_ff_e2ceLiOVz+$nh`e&W zQ6l?1i^y$h^MwAY`(T)d-^&dR)rY(#fN9qw{9lO7?f##vS54DDiATlXj{ za)mxo}H$G6f4x3?B$mC$042JmmVEkq968}4~Z71e57?j zu^5sP;|ZNlZtS2mHP9)??^(66S?#S~?S1C&Cs7Z)6SA=N0QvjCY~Q`qDzHGD=tFR( zS|&nRUF3J-OsbdzXS-CzJ@0~k6DuyQggw-6gPN1trBoVEk=0{&oBil20g)^#1r6mO zCOhrqhcof|AvWeAP1bcy2bI1X>;uAB&&OO9weORa5?EsHx9+f^V^ZvA>JEpQ47q&u52KF&!tto70Ax zss<+N3Gs6vJ+9(jsLjJCLj>x6q+Sn*UWR?k+VL9{w;3ba+$Vjb%8&M$h<~c>p09?Y zQQ<77T&CY~j0V*Tum0xpDx)%dZ)Z2Dp=Oo!yL@hhh7L*Ktg+))c*h@|Wf1Yrc0yN7 zMSZK_Q){b02xOOQ$Wx2Vnt(+mb;YZb_lQ32YyPxuc6{EMZ~j^YXQYv46W;?z#a7$W zFYR`>_}|c4%@Yo`M7vg>;SxXM8KQUQl)h)k(2V#fRta_B6NwpsW;i4u9@29rBetBe zS+w*PGbNEZ-YnYlKb>7aQ$I5-s0`wI%@af1i0i+FixX5o%Z7@fP~>2-;Uxa>g{FR@ zUo_lm@gUp5C-+?rGxk$*Bg_rjcOOj`XmpWtc#62wW^H_P9>HQ?wY1R7It49m<^C#P znXpmUIX=~UmtfUb-@T)%XHZ=Kwd%bu>6#eTyE|G$tR;U@-5wBcbjQmB2(iIZQqF6R&NKO8LbBMRQMSA3-Fs&X=~vv+1!k zLcg%~DP)Swcl?!F{7q5Oo9%+{j0@oAL1e zbaj#TkCwq+@x3cBF`$qA8r7lk)&YAwa5|%@NM4A`S+CcUY2=nE9i39Vq+*AsA@Pk7 zx5Dx~lxSIA6V{kY8^6siL4+HkDD$U_YQE`2pfYmqTY2!enOjF~-@t;ra}tM-?NJ?Z zW2rKq8=qyB4(ZrxepDGf)Gt-*=^TD=7lNp>3Mvx0hzq5${r<-=p1(uci1U+_TtkBT zB(G+=*-DQOtuyNZtLEb1QiivFmR7EMKSEwdHAvE znq-2bn;^T!V>DBWY4fPjdOWcBQUX_4@1~-TMUnX9Uj{9F9@d**7IS`w8LZ1%hDoy? zk?(xx+6;CJn|%uuVJ!&EXgvRgInuP_hdiOp3zzII7^pnYs>qn_@?Jw(%ytndGPc!D zzMCFCEi`8m3B60epEun1R038hE@9wwPF|0es*jhL<947VXD;nkHF2`FKuL(`F)>aT zhdN??Q;|7YA&Dirsr#9)eVxF8gTmZWPpiTF2f7|Pk#$j(iijxfD#1(l*OihxN4~o| zoLYnPI>ADOWKEkks!6EMdBry4$DA+IXcLYmi(-|Pb9j$iVH&SlW6x91)z(DV9U^i* zXRr!6L-Ncobjk$E>Y)S20VmXj`hAkT+d)N-L3`Hk@ZWAQ-wQsVj2KBB<;eqDEB>k5 zo8kju%sAM!6h4o|*vrwphrt3Zl1Szq>cAFm+FnMtNS+35p|r15p}6EnV_WfVD~I@! z51J30J3n#fpJ_|4h<$f*>|c8DW9jwkH%S6G=9T`$Q3_His9f3B@h}~B90%Re z554zGM?^zUQGS_-c5P&-`g`n2Jd0I9Z)o-gdgtVVXEBQ zbsvCiO@kJdzBg7(9KL3WzuHO1b6cO74oDasS5?QXAy8|gyN=~qgP9ppypQY=-zc7J z(UhS{Ob8j;?TYt#qV*D*OzODSWK4!T;RL0llBE?#)auG*ns0yDHhf@^9a!t{Cmk9I zL%zouC}J3up*3RgY+syf0bJnWyvN0Qi#Y>AQ5nmBHycYU+wR9Nsz@E>OETVMeQKmZIuJv-q0&-3epPwXHB00c3EnDPLDZ~*3y zg)t8Xc>%x!GBbghm;y~&gIuh=1{2wvQ=bDCBPq0WdJ|ZyE#w17N^KF3W$FhQY5} z1`GxKtsn#l2LJ6X01OER|7~gj9Da!}bF~pL6#lm`1PHlAthmC5k-gRtAcpUn(qR7o zQ3lih|MmpP55mOtl?pM!h`$>Kg5lTW2@JbV1Hvw^OS)Pg7=8(;^B>wj_6K5Id`&|L z^b$?yKa7_T5HRdok0C(BwfMl)cZn-=MHa~ae<=+|ULwd`VT6DH(EmgD+9&}5V3#w* zRar0sc#Q@EBK~$02mlBCkEN0SH9rUh2VVC(;+pv(AWT^Q)i6f(5;W(EG9U>2TEIad z0O*xAF6|G&aQ+{{R~a#UnEiq4fdm0w@#m!m5D-83UqkGYbSZnSBbdR?kNkHqTrxs1 z4*h!$fPi4Izg>b6z6A8SEdL2$Fa&XZn}qKp00M{~|&l{MXkH3?|SuD`2LIzZ=1<2Y|m7gut%54hBP9!Z-b686;-m za&47} zN>UO4l9m9##GzmbaX1tN5d(<>BoII_3?lOX=g_}I^m1{fG2.5 G(llo)-2.5 E 2.5(wa)-.25 -G(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F1(SYNOPSIS) -72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0(After)108 153.6 Q/F4 10 -/Courier@0 SF(zfs-fido2-change-key)7.564 E F0 5.064(\(8\) deri)B -.15 -(ve)-.25 G 7.563(st).15 G 5.063(he k)-7.563 F 5.363 -.15(ey f)-.1 H -5.063(or a dataset from a FIDO2 de).15 F(vice,)-.25 E F2 -(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15(xe)-.15 G -(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G -(umber of additional de)-2.5 E(vices.)-.25 E .273(First, the wrapping k) -108 182.4 R .574 -.15(ey i)-.1 H 2.774(se).15 G .274 -(xtracted as normally during)-2.924 F F4(zfs-fido2-load-key)2.774 E F0 -.274(\(8\), then a credential)B 1.604(is made as-if during)108 194.4 R -F4(zfs-fido2-change-key)4.104 E F0 1.604(\(8\) \(e)B 1.604 -(xcept the "primary" de)-.15 F 1.603(vice and all the ones)-.25 F .185 -(holding backups are e)108 206.4 R .185(xcluded from the search\); ho) --.15 F(we)-.25 E -.15(ve)-.25 G .985 -.4(r, t).15 H(he).4 E F4 -(hmac-secret)2.685 E F0 .185(is instead used as a sym-)2.685 F 1.555 -(metric AES-256-GCM \()108 218.4 R F4(EVP_CIPHER-AES)A F0 1.555 -(\(7ssl\)\) k)B 1.855 -.15(ey t)-.1 H 4.055(oe).15 G 1.555 -(ncrypt the wrapping k)-4.055 F 1.855 -.15(ey d)-.1 H 1.555 -(irectly with a).15 F(random IV)108 230.4 Q(.)-1.29 E(This turns the)108 -247.2 Q F4(xyz.nabijaczleweli:tzpfms.key)2.5 E F0 -.25(va)2.5 G -(riable into).25 E F3(salt)108 259.2 Q F2(:)A F3(credential-ID)A F2(:)A -F3(credential-public-key)A F0([)A F2(.)A F3(backup-salt)A F2(:)A F3 -(backup-credential-ID)108 271.2 Q F2(:)A F3 -(backup-credential-public-key)A F2(:)A F3(IV)A F2(:)A F3(encrypted-key)A -F0 1.666(]...)C F4(tzpfms.key)108 288 Q F0 2.238 -(is actually a dot-separated list of de)4.738 F 2.238(vice b)-.25 F -4.738(undles. The)-.2 F 2.239(\214rst one is as-described in)4.738 F F4 -(zfs-fido2-change-key)108 300 Q F0 5.181(\(8\). Subsequent)B 2.681 -(ones also include \(identically-encoded\) IVs and en-)5.181 F -(crypted blobs.)108 312 Q F4(zfs-fido2-load-key)108 328.8 Q F0 .081 -(\(8\) shops assertions around de)B .081(vices in a de)-.25 F .082 -(vice-major order \212 depending on)-.25 F(de)108 340.8 Q -(vice numbering, a backup may be loaded e)-.25 E -.15(ve)-.25 G 2.5(ni) -.15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.)-.25 E F1 -(ENVIR)72 357.6 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 -(TZPFMS_PASSPHRASE_HELPER)108 369.6 Q F0 .046(By def)133 381.6 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 393.6 -Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G -1.596(ill be run via)-4.096 F F4(/bin/)4.096 E F2 3.262(sh \255c)B F0 -(to)4.096 E(pro)133 405.6 Q(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 422.4 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 434.4 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 446.4 Q F0 -(Pre-formatted noun phrase with all the information belo)160 446.4 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 458.4 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 458.4 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 470.4 Q F0("ne)160 -470.4 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 482.4 Q F0("ag)160 482.4 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 499.2 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -511.2 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 528 R(En)87 540 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 552 Q F0 -(If set, enables lib\214do2 deb)173 552 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 568.8 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 580.8 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 592.8 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 609.6 R F0 -(The lib\214do2 documentation at https://de)108 621.6 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 638.4 R -F0 1.6 -.8(To a)108 650.4 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 662.4 Q F0(ThePhD)7.5 E F1<83> -128 674.4 Q F0(Embark Studios)7.5 E F1<83>128 686.4 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 698.4 Q F0(EvModder)7.5 E F1(REPOR)72 715.2 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 727.2 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 744 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 756 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 2 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 -SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) --2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) --2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 -124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF -(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 -2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 -(,)A F2(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) --.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 -(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.244 E F0 -.1(wa) -3.244 G 3.244(sp).1 G(re)-3.244 E .743(viously encrypted with)-.25 F F2 -(fzifdso)3.243 E F0 .743(and the)3.243 F F1(FIDO2)3.243 E F0 .743 -(back-end w)3.243 F .743(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 -(Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 -(ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.465(xt, a ne)-.15 F 2.965(wc)-.25 G .465 -(redential of type ES256 is generated on the de)-2.965 F .464 -(vice \(with relying party ID)-.25 F F5(fzifdso)2.964 E F0(and)2.964 E -.499(name equal to the dataset name\) with the)108 264 R F5(hmac-secret) -2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 -(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 276 Q -(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ -n, the credential is asserted with a 32-byte random salt, which hashes \ -it with de)108 292.8 R(vice-pri)-.25 E -.25(va)-.25 G .962(te data,).25 -F .137(and thus generates the wrapping k)108 304.8 R .438 -.15(ey \()-.1 -H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) -2.638 E F0 2.638(\)\). This)B .138(mimicks a)2.638 F -.8(We)108 316.8 S -(bAuthn login step.).8 E(The follo)108 333.6 Q -(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -345.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> -128 357.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 -(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 369.6 Q F0 -([)A F2(.)A F0 1.666(...)1.666 G 1.666(]...)-1.666 G F5(tzpfms.backend) -108 386.4 Q F0 2.708(identi\214es this dataset for w)5.208 F 2.707 -(ork with)-.1 F F1(FIDO2)5.207 E F0(-back-ended)A F2(tzpfms)5.207 E F0 -2.707(tools \(i.e.)5.207 F F2(fzifdso)108 398.4 Q F5 -(zfs-fido2-change-key)60.227 E F0(\(8\),)A F5(zfs-fido2-load-key)56.728 -E F0(\(8\),)A F5(zfs-fido2-add-backup)108 410.4 Q F0(\(8\), and)A F5 -(zfs-fido2-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 427.2 Q F0 -.486(is a colon-separated tuple of unpadded URL-safe base64 blobs; the \ -\214rst one is the ran-)2.986 F .217(dom salt; the second represents th\ -e ID of created credential, and the third \211 its public k)108 439.2 R --.15(ey)-.1 G 5.217(.T)-.5 G .217(here e)-5.217 F(xists)-.15 E -(no other user)108 451.2 Q -(-land tool for deciphering this; perhaps there should be.)-.2 E -(Finally)108 468 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 -G 9.506(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 -(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 480 Q -F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F -(to clean up the properties, or to issue a note for manual interv)108 -492 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 508.8 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.555 E F0 -6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 520.8 R .729 -(ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 532.8 Q F2(zfs-fido2-clear-key)5.147 E F3(dataset)8.647 E -F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F -10.312 E F5(keyformat=passphrase)108 544.8 Q F3(dataset)6 E F0 -(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-fido2-clear-key)108 561.6 Q F3(dataset)7.606 E F0 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 573.6 Q F1(OPTIONS)72 590.4 Q F2109.666 602.4 Q -F3(backup-file)6 E F0(Sa)203 602.4 Q .353 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 614.4 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 626.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 638.4 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F1(ENVIR)72 655.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 -E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q F0 .046(By def)133 679.2 R -.045(ault, passphrases are prompted for and read in on the standard out\ -put and input streams.)-.1 F(If)5.045 E F5(TZPFMS_PASSPHRASE_HELPER)133 -691.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw) --4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.096 E F2 3.262 -(sh \255c)B F0(to)4.096 E(pro)133 703.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 720 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 -(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E(fzifdso 0)72 817.889 Q -(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 2 3 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 124.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(FIDO2 back-end con\214guration)72 153.6 R(En)87 165.6 Q(vir)-.4 E -.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 177.6 Q F0 -(If set, enables lib\214do2 deb)173 177.6 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 194.4 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 206.4 R -.727(vice which supports the)-.25 F F1(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 218.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 235.2 R F0 -(The lib\214do2 documentation at https://de)108 247.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 264 R -F0 1.6 -.8(To a)108 276 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F2<83>128 288 Q F0(ThePhD)7.5 E F2<83>128 -300 Q F0(Embark Studios)7.5 E F2<83>128 312 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F2<83>128 324 Q F0(EvModder)7.5 E F2(REPOR)72 340.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 352.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 369.6 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 381.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(2)183.837 E 0 Cg EP -%%Page: 1 4 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 -F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.588 G -.25(ew)-3.587 G -1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G -(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 -108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(FIDO2)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 -201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 -(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) -14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 -213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-fido2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(ENVIR)72 247.2 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .045 -(By def)133 271.2 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.596(is set and nonempty)4.096 -F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 295.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 312 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 324 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 336 Q F0 -(Pre-formatted noun phrase with all the information belo)160 336 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 348 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 348 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 360 Q F0("ne)160 360 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F4($4)143 372 Q F0("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 388.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -400.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 417.6 R(En)87 429.6 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 441.6 Q F0 -(If set, enables lib\214do2 deb)173 441.6 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 458.4 Q .625 -(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 470.4 R -.726(vice which supports the)-.25 F F4(hmac-secret)3.227 E F0 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion is shopped around to e)108 482.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 499.2 R F0 -(The lib\214do2 documentation at https://de)108 511.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 528 R -F0 1.6 -.8(To a)108 540 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F1<83>128 552 Q F0(ThePhD)7.5 E F1<83>128 -564 Q F0(Embark Studios)7.5 E F1<83>128 576 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F1<83>128 588 Q F0(EvModder)7.5 E F1(REPOR)72 604.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 616.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 633.6 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 645.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 5 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) --.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F -(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 -/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G -(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.141(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.641 E F0 -.1 -(wa)3.641 G 3.641(se).1 G 1.141(ncrypted with)-3.641 F F2(tzpfms)3.641 E -F0(back)3.641 E(end)-.1 E F1(FIDO2)3.641 E F0 3.641(,a)C 1.142 -(sserts the preserv)-3.641 F 1.142(ed chal-)-.15 F(lenge, HMA)108 165.6 -Q(Cking the salt with the on-de)-.4 E -(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) -.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF -(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) -.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 -(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G -3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 223.2 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .045(By def) -133 264 R .045(ault, passphrases are prompted for and read in on the st\ -andard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.596(is set and nonempty)4.096 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 288 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 304.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 340.8 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 352.8 Q F0("ne)160 -352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 381.6 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666(SPECIAL THANKS) -72 410.4 R F0 1.6 -.8(To a)108 422.4 T(ll who support further de).8 E --.15(ve)-.25 G(lopment, in particular:).15 E F1<83>128 434.4 Q F0 -(ThePhD)7.5 E F1<83>128 446.4 Q F0(Embark Studios)7.5 E F1<83>128 458.4 -Q F0(Jasper Bekk)7.5 E(ers)-.1 E F1<83>128 470.4 Q F0(EvModder)7.5 E F1 -(REPOR)72 487.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 -499.2 Q(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 516 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 528 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 6 -%%BeginPageSetup -BP -%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([) -2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E -/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A -F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 +/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 @@ -683,28 +326,26 @@ listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R -18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 +(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666 -(zfs-fido2-add-backup \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 -(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) -108 583.2 Q F2 1.666(zfs-fido2-add-backup \255b)6 F F1(TPM2)6 E F4 72 -(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 -(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-fido2-add-backup \255ra)6 F F3(tarta-zoot)6 E F4 72 -(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 -(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 -(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 -(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) -108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 -(zfs-fido2-add-backup \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 +24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 +559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 +F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F +6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) +108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R +18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 +(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) +54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q +F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) -108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-18-g1f9fe81)72 817.889 -Q(December 4, 2022)86.363 E(1)183.842 E 0 Cg EP -%%Page: 2 7 +108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-21-g1165607)72 817.889 +Q(December 4, 2022)82.463 E(1)183.842 E 0 Cg EP +%%Page: 2 2 %%BeginPageSetup BP %%EndPageSetup @@ -719,9 +360,9 @@ BP E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q(December 4, 2022)86.363 E +-.25 E(tzpfms 0.3.4-21-g1165607)72 817.889 Q(December 4, 2022)82.463 E (2)183.842 E 0 Cg EP -%%Page: 1 8 +%%Page: 1 3 %%BeginPageSetup BP %%EndPageSetup @@ -730,193 +371,192 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 -E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.867 -.8(To n)108 153.6 -T 1.267(ormalise the).8 F F3(dataset)3.767 E F0(,)A F2 -(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.177 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 +(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T +5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 +E F0 5.266(will open its encryption root in its stead.)7.766 F F2 +(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E +(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) +-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 +(data will be silently cleared.)108 211.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 +(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q +.294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 -(\), and sealed)B .585(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 264 R .886 -.15(ey w)-.1 H .586 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q +(\), and sealed)B .586(on the TPM; the user is prompted for an optional\ + passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 333.6 Q F0 .292(identi\214es this dataset for w)2.792 F .291 -(ork with)-.1 F F1(TPM1.X)2.791 E F0(-back-ended)A F2(tzpfms)2.791 E F0 -.291(tools \(namely)2.791 F F5(zfs-tpm1x-change-key)108 345.6 Q F0 +108 321.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 +(ork with)-.1 F F1(TPM1.X)2.792 E F0(-back-ended)A F2(tzpfms)2.792 E F0 +.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 333.6 Q F0 (\(8\),)A F5(zfs-tpm1x-load-key)2.5 E F0(\(8\), and)A F5 -(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q F0 -1.412(is a colon-separated pair of he)3.912 F 1.412 -(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .868 -(\214rst one represents the RSA k)108 374.4 R 1.168 -.15(ey p)-.1 H .867 +(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 350.4 Q F0 +1.412(is a colon-separated pair of he)3.913 F 1.412 +(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 +(\214rst one represents the RSA k)108 362.4 R 1.167 -.15(ey p)-.1 H .868 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 386.4 Q 1.413(vided, or the SHA1 constant)-.15 F F5 -(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.914 E F0 3.914(;t)C 1.414 -(he sec-)-3.914 F .379 -(ond represents the sealed object containing the wrapping k)108 398.4 R +.15 F(pro)108 374.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 +(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 +(he sec-)-3.913 F .379 +(ond represents the sealed object containing the wrapping k)108 386.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.72(.T)C 1.72 -(here e)-6.72 F 1.721(xists no other user)-.15 F 1.721(-land tool for) --.2 F(decrypting this; perhaps there should be.)108 422.4 Q(Finally)108 -439.2 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506 -(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 -(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 451.2 -Q F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 398.4 Q F0 6.721(.T)C +1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 +(-land tool for)-.2 F(decrypting this; perhaps there should be.)108 +410.4 Q(Finally)108 427.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F +-.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F +17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 +(keyformat=raw)108 439.2 Q F3(dataset)6.107 E F0 .107 +(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 +(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 +(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -463.2 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 480 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.555 E F0 -6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 492 R .729 +451.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 468 +S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 +6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 +(command succeeds, all is well, b)108 480 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.147 E F3(dataset)8.647 E -F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F -10.312 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 +-.2 F(with)108 492 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E +F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F +10.313 E F5(keyformat=passphrase)108 504 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.606 E F0 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q -F3(backup-file)6 E F0(Sa)203 573.6 Q .353 -.15(ve a b)-.2 H .052 +F2(zfs-tpm1x-clear-key)108 520.8 Q F3(dataset)7.607 E F0 1.607 +(can be used to clear the properties and go back to using a)4.107 F +(passphrase.)108 532.8 Q F1(OPTIONS)72 549.6 Q F2109.666 561.6 Q +F3(backup-file)6 E F0(Sa)203 561.6 Q .352 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 585.6 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .639(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H +E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 +F .694(This back-up)203 573.6 R F4(must)3.194 E F0 .694 +(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 585.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 597.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 614.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .638(Bind the k)203 614.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 -3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .638 -(hange, the wrap-)-3.139 F .462(ping k)203 638.4 R .762 -.15(ey w)-.1 H -.462(ill not be able to be unsealed.).15 F .463 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) +3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 +(hange, the wrap-)-3.139 F .463(ping k)203 626.4 R .763 -.15(ey w)-.1 H +.463(ill not be able to be unsealed.).15 F .462 +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 638.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q -F0 .046(By def)133 691.2 R .045(ault, passphrases are prompted for and \ -read in on the standard output and input streams.)-.1 F(If)5.045 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.595(is set and nonempty)4.095 +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 655.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q +F0 .045(By def)133 679.2 R .045(ault, passphrases are prompted for and \ +read in on the standard output and input streams.)-.1 F(If)5.046 E F5 +(TZPFMS_PASSPHRASE_HELPER)133 691.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 715.2 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 703.2 Q (vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 732 R +(The standard output stream of the helper is tied to an anon)133 720 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-18-g1f9fe81)72 -817.889 Q(February 28, 2024)86.358 E(1)183.837 E 0 Cg EP -%%Page: 2 9 +133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 +(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E(tzpfms 0.3.4-21-g1165607)72 +817.889 Q(February 28, 2024)82.458 E(1)183.837 E 0 Cg EP +%%Page: 2 4 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 36.913(ZFS-TPM1X-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 34.412(anual ZFS-TPM1X-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q +-2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 136.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +-2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 124.8 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B +(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 -177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.73 E F0 .23 -(suite connects to a local)2.73 F F1(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F1(localhost:30003)2.729 E F0 2.729(\)b)C 2.729 -(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 F(the)2.729 E(en)108 201.6 -Q(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .11(The T)108 218.4 R(rouSerS) --.35 E F1(tcsd)2.61 E F0 .11(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E -F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 -E F1(/dev/tpm)2.611 E F0 2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1 -(py)108 230.4 S(ing one of the earlier ones with, for e).1 E +1.666(TPM1.X back-end con\214guration)72 153.6 R .625(TPM selection)87 +165.6 R F0(The)108 177.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 +.229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 189.6 Q +(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 206.4 R(rouSerS) +-.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +218.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 247.2 R F0(The T)108 259.2 Q +(See also)87 235.2 R F0(The T)108 247.2 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 -(The TPM 1.2 main speci\214cation inde)108 276 R 6.915(xa)-.15 G 6.915 +(The TPM 1.2 main speci\214cation inde)108 264 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 288 Q F2 1.666 -(SPECIAL THANKS)72 304.8 R F0 1.6 -.8(To a)108 316.8 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 276 Q F2 1.666 +(SPECIAL THANKS)72 292.8 R F0 1.6 -.8(To a)108 304.8 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 328.8 Q F0(ThePhD)7.5 E F2<83>128 340.8 Q F0 -(Embark Studios)7.5 E F2<83>128 352.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E -(https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E F2 1.666(SEE ALSO)72 439.2 R F0 -(PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E +.15 E F2<83>128 316.8 Q F0(ThePhD)7.5 E F2<83>128 328.8 Q F0 +(Embark Studios)7.5 E F2<83>128 340.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F2<83>128 352.8 Q F0(EvModder)7.5 E F2(REPOR)72 369.6 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 381.6 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 398.4 Q +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +(https://lists.sr)108 410.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E F2 1.666(SEE ALSO)72 427.2 R F0 +(PCR allocations: https://wiki.archlinux.or)108 439.2 Q(g/title/T)-.18 E (rusted_Platform_Module#Accessing_PCR_re)-.35 E(gisters)-.15 E -(and https://trustedcomputinggroup.or)108 463.2 Q +(and https://trustedcomputinggroup.or)108 451.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ -r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q -(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q -(February 28, 2024)86.358 E(2)183.837 E 0 Cg EP -%%Page: 1 10 +r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 463.2 Q +(able)-.8 E(1.)108 475.2 Q(tzpfms 0.3.4-21-g1165607)72 817.889 Q +(February 28, 2024)82.458 E(2)183.837 E 0 Cg EP +%%Page: 1 5 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 45.793(ZFS-TPM1X-CLEAR-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 43.292(anual ZFS-TPM1X-CLEAR-KEY\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.008 G -.25(ew)-3.008 G +(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(TPM1.X)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q +(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G +(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM1.X) +2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F -.25(va) +-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E +/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 +(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm1x-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1 1.666 (TPM1.X back-end con\214guration)72 247.2 R .625(TPM selection)87 259.2 -R F0(The)108 271.2 Q F2(tzpfms)2.729 E F0 .229 -(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 283.2 Q -(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 300 R(rouSerS) --.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -312 S(ing one of the earlier ones with, for e).1 E +R F0(The)108 271.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 300 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 312 S +(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 328.8 R F0(The T)108 340.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -931,11 +571,11 @@ F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F1<83>128 446.4 Q F0(EvModder)7.5 E F1(REPOR)72 463.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q(December 4, 2022)86.363 E(1) +E(tzpfms 0.3.4-21-g1165607)72 817.889 Q(December 4, 2022)82.463 E(1) 183.842 E 0 Cg EP -%%Page: 1 11 +%%Page: 1 6 %%BeginPageSetup BP %%EndPageSetup @@ -944,15 +584,15 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 -(wa)2.69 G 2.69(se).1 G .19(ncrypted with)-2.69 F F2(tzpfms)2.69 E F0 -(back)2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .191(will unseal the k)2.69 F -.491 -.15(ey a)-.1 H .191(nd load).15 F(it into)108 165.6 Q F3(dataset) -2.5 E F0(.)A .236 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .191 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1(wa)2.691 +G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E F0(back) +2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 F .49 +-.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset)2.5 E +F0(.)A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) -108 182.4 R .236(wnership, if not "well-kno)-.25 F .235(wn" \(all)-.25 F +108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) 108 194.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E (as set.)-.1 E(See)108 211.2 Q/F4 10/Courier@0 SF(zfs-tpm1x-change-key) @@ -960,14 +600,14 @@ Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 109.666 240 Q F0 3.208(Do a no-op/dry run, can be used e)131 240 R -.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) -8.208 E -.25(va)-.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 +8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 252 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 268.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 -280.8 Q F0 .046(By def)133 292.8 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.045 -E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.595(is set and nonempty) -4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F -F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q +280.8 Q F0 .045(By def)133 292.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.046 +E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.596(is set and nonempty) +4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 333.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -980,23 +620,23 @@ F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q 381.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F0("ag)160 393.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 410.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 410.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 422.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 439.2 R .625(TPM selection)87 451.2 -R F0(The)108 463.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 492 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 504 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 463.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 475.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 492 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +504 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 520.8 R F0(The T)108 532.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1011,11 +651,11 @@ F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 638.4 Q F0(EvModder)7.5 E F1(REPOR)72 655.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q(December 4, 2022)86.363 E(1) +E(tzpfms 0.3.4-21-g1165607)72 817.889 Q(December 4, 2022)82.463 E(1) 183.842 E 0 Cg EP -%%Page: 1 12 +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup @@ -1024,112 +664,112 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 -1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A -F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A -F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.32 -.8(To n)108 -165.6 T(ormalise).8 E F3(dataset)5.22 E F0(,)A F2(zfs-fido2-add-backup) -5.22 E F0 2.719(will open its encryption root in its stead.)5.22 F F2 -(zfs-fido2-add-backup)108 177.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E -F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.055 E F0 -.1 -(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555(viously encrypted with)-.25 F -F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .554 -(back-end w)3.054 F .554(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 -235.2 S 3.059(yw)-.05 G .559(ill be freed from the TPM.)-3.059 F .56 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 +(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) +A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) +A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.676 -.8(To n)108 165.6 +T(ormalise).8 E F3(dataset)2.576 E F0(,)A F2(zfs-tpm-list)2.576 E F0 +.076(will open its encryption root in its stead.)2.576 F F2 +(zfs-tpm-list)5.077 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 +E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G +(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 +(\(8\) for that.)A(First, a connection is made to the TPM, which)108 +194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 +(dataset)3.055 E F0 -.1(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555 +(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F +F1(TPM2)3.055 E F0 .554(back-end w)3.054 F .554(as used, the pre)-.1 F +(vious)-.25 E -.1(ke)108 223.2 S 3.059(yw)-.05 G .559 +(ill be freed from the TPM.)-3.059 F .56 (Otherwise, or in case of an error)5.56 F 3.06(,d)-.4 G .56 (ata required for manual interv)-3.06 F(en-)-.15 E -(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 -264 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 +252 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 (OPTIONS)2.794 E F0 .294(\), and sealed)B .588 -(to a persistent object on the TPM under the o)108 276 R .589 +(to a persistent object on the TPM under the o)108 264 R .589 (wner hierarch)-.25 F .589(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 288 Q 1.603 -.65(y, t)-.05 H .302 +F(wner)-.25 E(hierarch)108 276 Q 1.603 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 300 Q(The follo)108 316.8 Q +(the sealed object with.)108 288 Q(The follo)108 304.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 1.263 +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 1.263 (identi\214es this dataset for w)3.763 F 1.264(ork with)-.1 F F1(TPM2) 3.764 E F0(-back-ended)A F2(tzpfms)3.764 E F0 1.264(tools \(namely)3.764 -F F5(zfs-tpm2-change-key)108 381.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) +F F5(zfs-tpm2-change-key)108 369.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) 2.5 E F0(\(8\), and)A F5(zfs-tpm2-clear-key)2.5 E F0(\(8\)\).)A F5 -(tzpfms.key)108 398.4 Q F0 1.509(is an inte)4.009 F 1.509 +(tzpfms.key)108 386.4 Q F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 (wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 -410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +398.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 (tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B -.866(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +.866(be passed to)108 410.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) 3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) -C(r)-3.365 E F2109.666 434.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +C(r)-3.365 E F2109.666 422.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) -.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A -.448(If you ha)108 446.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F +.448(If you ha)108 434.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) -.25 G .447(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.005 +(will funxion seamlessly)108 446.4 Q(.)-.65 E(Finally)108 463.2 Q 12.005 (,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 -E F217.172 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.107 E F0 +E F217.172 E F5(keyformat=raw)108 475.2 Q F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 499.2 R .29(ention into the stan-)-.15 F(dard error stream.) -108 511.2 Q 2.625<418c>108 528 S .125(nal v)-2.625 F .125 + interv)108 487.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 499.2 Q 2.625<418c>108 516 S .125(nal v)-2.625 F .125 (eri\214cation should be made by running)-.15 F F2 1.79 (zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 (ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) -108 540 R .506(ut otherwise the dataset can be manually rolled back to \ -a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) +108 528 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 540 Q F3(dataset) 11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.204 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 +F13.204 E F5(keyformat=passphrase)108 552 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 +F2(zfs-tpm2-clear-key)108 568.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 -621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .353 -.15(ve a b)-.2 H .052 +F(ing a passphrase.)108 580.8 Q F1(OPTIONS)72 597.6 Q F2109.666 +609.6 Q F3(backup-file)6 E F0(Sa)203 609.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 633.6 R F4(must)3.193 E F0 .694 +F .693(This back-up)203 621.6 R F4(must)3.193 E F0 .694 (be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +(nt,).15 E(the k)203 633.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 645.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 662.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.425(Bind the k)203 686.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +-1.666 G 1.425(Bind the k)203 674.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C -1.424(ithin their corresponding)-3.924 F(hashing)203 698.4 Q F3 +1.424(ithin their corresponding)-3.924 F(hashing)203 686.4 Q F3 (algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.024(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 698.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G +A F3(algorithm)203 715.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) .15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") -203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +203 727.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A -F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 739.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 -(", and must be supported by the TPM.)A(tzpfms 0.3.4-18-g1f9fe81)72 -817.889 Q(February 28, 2024)86.358 E(1)183.837 E 0 Cg EP -%%Page: 2 13 +(", and must be supported by the TPM.)A(tzpfms 0.3.4-21-g1165607)72 +817.889 Q(February 28, 2024)82.458 E(1)183.837 E 0 Cg EP +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup @@ -1205,9 +845,9 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (and https://trustedcomputinggroup.or)108 657.6 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q -(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q -(February 28, 2024)86.358 E(2)183.837 E 0 Cg EP -%%Page: 1 14 +(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-21-g1165607)72 817.889 Q +(February 28, 2024)82.458 E(2)183.837 E 0 Cg EP +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup @@ -1217,8 +857,8 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 -E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 +(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with)-2.5 E F2 (tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM2)2.5 E F0(:)A 5 (1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641 @@ -1286,9 +926,9 @@ F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q(December 4, 2022)86.363 E +-.25 E(tzpfms 0.3.4-21-g1165607)72 817.889 Q(December 4, 2022)82.463 E (1)183.842 E 0 Cg EP -%%Page: 1 15 +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -1297,23 +937,23 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .864(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1 -(wa)3.364 G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E -F0(back)3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865 -(nseals the k)-3.365 F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F -(into)108 165.6 Q F3(dataset)2.5 E F0(.)A(The user is prompted for the \ -additional passphrase, set when creating the k)108 182.4 Q -.15(ey)-.1 G -2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 -10/Courier@0 SF(zfs-tpm2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2109.666 -228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 -G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i) --.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va) --.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s) -C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .864 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1(wa)3.364 +G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E F0(back) +3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865(nseals the k)-3.365 +F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F(into)108 165.6 Q F3 +(dataset)2.5 E F0(.)A(The user is prompted for the additional passphras\ +e, set when creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5 +(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF +(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 +(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 +(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 +G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) +.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 +(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 +4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F +(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 (By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ on the standard output and input streams.)-.1 F(If)5.046 E F4 (TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 @@ -1364,7 +1004,7 @@ F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q(December 4, 2022)86.363 E(1) +E(tzpfms 0.3.4-21-g1165607)72 817.889 Q(December 4, 2022)82.463 E(1) 183.842 E 0 Cg EP %%Trailer end diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 deleted file mode 100644 index 08a80cb..0000000 --- a/zfs-fido2-add-backup.8 +++ /dev/null @@ -1,125 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-ADD-BACKUP 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-add-backup -.Nd allow another FIDO2 device to unlock ZFS dataset -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After -.Xr zfs-fido2-change-key 8 -derives the key for a dataset from a FIDO2 device, -.Nm -may be executed to extend this to any number of additional devices. -.Pp -First, the wrapping key is extracted as normally during -.Xr zfs-fido2-load-key 8 , -then a credential is made as-if during -.Xr zfs-fido2-change-key 8 -(except the "primary" device and all the ones holding backups are excluded from the search); -however, the -.Ql hmac-secret -is instead used as a symmetric AES-256-GCM -.Pq Xr EVP_CIPHER-AES 7ssl -key to encrypt the wrapping key directly with a random IV. -.Pp -This turns the -.Li xyz.nabijaczleweli:tzpfms.key -variable into -.br -.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … -.Pp -.Li tzpfms.key -is actually a dot-separated list of device bundles. -The first one is as-described in -.Xr zfs-fido2-change-key 8 . -Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -.Pp -.Xr zfs-fido2-load-key 8 -shops assertions around devices in a device-major order \(em -depending on device numbering, a backup may be loaded even if the primary device is present. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html deleted file mode 100644 index e6d3444..0000000 --- a/zfs-fido2-add-backup.8.html +++ /dev/null @@ -1,153 +0,0 @@ - - - - - - - - ZFS-FIDO2-ADD-BACKUP(8) - - - - - - - - -
    ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
    -
    -
    -

    -

    zfs-fido2-add-backup — - allow another FIDO2 device to unlock ZFS dataset

    -
    -
    -

    - - - - - -
    zfs-fido2-add-backupdataset
    -
    -
    -

    -

    After - zfs-fido2-change-key(8) - derives the key for a dataset from a FIDO2 device, - zfs-fido2-add-backup may be executed to extend this - to any number of additional devices.

    -

    First, the wrapping key is extracted as normally during - zfs-fido2-load-key(8), - then a credential is made as-if during - zfs-fido2-change-key(8) - (except the "primary" device and all the ones holding backups are - excluded from the search); however, the - ‘hmac-secret’ is instead used as a - symmetric AES-256-GCM - (EVP_CIPHER-AES(7ssl)) - key to encrypt the wrapping key directly with a random IV.

    -

    This turns the - xyz.nabijaczleweli:tzpfms.key variable into -
    - salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…

    -

    tzpfms.key is actually a dot-separated - list of device bundles. The first one is as-described in - zfs-fido2-change-key(8). - Subsequent ones also include (identically-encoded) IVs and encrypted - blobs.

    -

    zfs-fido2-load-key(8) - shops assertions around devices in a device-major order — depending - on device numbering, a backup may be loaded even if the primary device is - present.

    -
    -
    -

    -
    -
    -
    By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

    The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

    -
    -
    -
    -
    Pre-formatted noun phrase with all the information below, for use as a - prompt
    -
    -
    Either the dataset name or the element of the TPM hierarchy being - prompted for
    -
    -
    "new" if this is for a new passphrase, otherwise blank
    -
    -
    "again" if it's the second prompt for that passphrase, - otherwise blank
    -
    -
    -

    If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

    -
    -
    -
    -
    -

    -
    -

    -
    -
    -
    If set, enables libfido2 debug logging to the standard error stream.
    -
    -
    -
    -

    -

    When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

    -
    -
    -

    -

    The libfido2 documentation at - https://developers.yubico.com/libfido2/.

    -
    -
    -
    -

    -

    To all who support further development, in particular:

    -
      -
    • ThePhD
      • -
    • Embark Studios
      • -
    • Jasper Bekkers
      • -
    • EvModder
      • -
    -
    -
    -

    -

    https://todo.sr.ht/~nabijaczleweli/fzifdso

    -

    ~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

    -
    -
    - - - - - -
    February 29, 2024fzifdso 0
    - - diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 deleted file mode 100644 index 6bd3f57..0000000 --- a/zfs-fido2-change-key.8 +++ /dev/null @@ -1,186 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CHANGE-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-change-key -.Nd change ZFS dataset key to one authenticated by a FIDO2 device -.Sh SYNOPSIS -.Nm -.Op Fl b Ar backup-file -.Ar dataset -. -.Sh DESCRIPTION -To normalise the -.Ar dataset , -.Nm -will open its encryption root in its stead. -.Nm -will -.Em never -create or destroy encryption roots; use -.Xr zfs-change-key 8 -for that. -.Pp -First, a connection is made to the FIDO2 device, which -.Em must -support the -.Ql hmac-secret -extension. -.Pp -If -.Ar dataset -was previously encrypted with -.Nm fzifdso -and the -.Sy FIDO2 -back-end was used, the metadata will be silently cleared. -Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. -.Pp -Next, a new credential of type ES256 is generated on the device (with relying party ID -.Li fzifdso -and name equal to the dataset name) -with the -.Ql hmac-secret -extension requested; the device PIN, if any, is prompted for here. -This mimicks a WebAuthn registration step. -.Pp -Then, the credential is asserted with a 32-byte random salt, -which hashes it with device-private data, and thus generates the wrapping key -.Pq which is optionally backed up Pq see Sx OPTIONS . -This mimicks a WebAuthn login step. -.Pp -The following properties are set on -.Ar dataset : -.Bl -bullet -compact -offset 4n -width "@" -.It -.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 -.It -.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … -.El -.Pp -.Li tzpfms.backend -identifies this dataset for work with -.Sy FIDO2 Ns -back-ended -.Nm tzpfms -tools -.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . -.Pp -.Li tzpfms.key -is a colon-separated tuple of unpadded URL-safe base64 blobs; -the first one is the random salt; -the second represents the ID of created credential, -and the third \(en its public key. -There exists no other user-land tool for deciphering this; perhaps there should be. -.\"" TODO: make an LD_PRELOADable for extracting the key maybe? -.Pp -Finally, the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset -is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. -.Pp -A final verification should be made by running -.Nm zfs-fido2-load-key Fl n Ar dataset . -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a passphrase with -.Nm zfs-fido2-clear-key Ar dataset -.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , -and you are hereby asked to report a bug, please. -.Pp -.Nm zfs-fido2-clear-key Ar dataset -can be used to clear the properties and go back to using a passphrase. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl b Ar backup-file" -.It Fl b Ar backup-file -Save a back-up of the key to -.Ar backup-file , -which must not exist beforehand. -This back-up -.Em must -be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running -.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html deleted file mode 100644 index 68ea232..0000000 --- a/zfs-fido2-change-key.8.html +++ /dev/null @@ -1,206 +0,0 @@ - - - - - - - - ZFS-FIDO2-CHANGE-KEY(8) - - - - - - - - -
    ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
    -
    -
    -

    -

    zfs-fido2-change-key — - change ZFS dataset key to one authenticated by a FIDO2 - device

    -
    -
    -

    - - - - - -
    zfs-fido2-change-key[-b backup-file] - dataset
    -
    -
    -

    -

    To normalise the dataset, - zfs-fido2-change-key will open its encryption root - in its stead. zfs-fido2-change-key will - - create or destroy encryption roots; use - zfs-change-key(8) - for that.

    -

    First, a connection is made to the FIDO2 device, which - must support the - ‘hmac-secret’ extension.

    -

    If dataset was previously encrypted with - fzifdso and the FIDO2 back-end was - used, the metadata will be silently cleared. Otherwise, or in case of an - error, data required for manual intervention will be written to the standard - error stream.

    -

    Next, a new credential of type ES256 is generated on the device - (with relying party ID fzifdso and name equal to the - dataset name) with the ‘hmac-secret’ - extension requested; the device PIN, if any, is prompted for here. This - mimicks a WebAuthn registration step.

    -

    Then, the credential is asserted with a 32-byte random salt, which - hashes it with device-private data, and thus generates the wrapping key - (which is optionally backed up (see - OPTIONS)). This mimicks a WebAuthn login - step.

    -

    The following properties are set on - dataset:

    - -

    tzpfms.backend identifies this dataset for - work with FIDO2-back-ended tzpfms - tools (i.e. fzifdso - zfs-fido2-change-key(8), - zfs-fido2-load-key(8), - zfs-fido2-add-backup(8), - and - zfs-fido2-clear-key(8)).

    -

    tzpfms.key is a colon-separated tuple of - unpadded URL-safe base64 blobs; the first one is the random salt; the second - represents the ID of created credential, and the third – its public - key. There exists no other user-land tool for deciphering this; perhaps - there should be.

    -

    Finally, the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=raw dataset is - performed with the new key. If an error occurred, best effort is made to - clean up the properties, or to issue a note for manual intervention into the - standard error stream.

    -

    A final verification should be made by running - zfs-fido2-load-key -n - dataset. If that command succeeds, all is well, but - otherwise the dataset can be manually rolled back to a passphrase with - zfs-fido2-clear-key dataset - (or, if that fails to work, zfs - change-key -o - keyformat=passphrase dataset), - and you are hereby asked to report a bug, please.

    -

    zfs-fido2-clear-key - dataset can be used to clear the properties and go - back to using a passphrase.

    -
    -
    -

    -
    -
    - backup-file
    -
    Save a back-up of the key to backup-file, which must - not exist beforehand. This back-up must be stored - securely, off-site. In case of a catastrophic event, the key can be loaded - by running -
    zfs - load-key dataset - < - backup-file
    -
    -
    -
    -
    -

    -
    -
    -
    By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

    The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

    -
    -
    -
    -
    Pre-formatted noun phrase with all the information below, for use as a - prompt
    -
    -
    Either the dataset name or the element of the TPM hierarchy being - prompted for
    -
    -
    "new" if this is for a new passphrase, otherwise blank
    -
    -
    "again" if it's the second prompt for that passphrase, - otherwise blank
    -
    -
    -

    If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

    -
    -
    -
    -
    -

    -
    -

    -
    -
    -
    If set, enables libfido2 debug logging to the standard error stream.
    -
    -
    -
    -

    -

    When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

    -
    -
    -

    -

    The libfido2 documentation at - https://developers.yubico.com/libfido2/.

    -
    -
    -
    -

    -

    To all who support further development, in particular:

    -
      -
    • ThePhD
      • -
    • Embark Studios
      • -
    • Jasper Bekkers
      • -
    • EvModder
      • -
    -
    -
    -

    -

    https://todo.sr.ht/~nabijaczleweli/fzifdso

    -

    ~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

    -
    -
    - - - - - -
    February 29, 2024fzifdso 0
    - - diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 deleted file mode 100644 index dd2a76c..0000000 --- a/zfs-fido2-clear-key.8 +++ /dev/null @@ -1,113 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CLEAR-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-clear-key -.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 : -.Bl -enum -compact -offset 2n -width 2n -.It -performs the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , -.It -removes the -.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key -properties from -.Ar dataset . -.El -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html deleted file mode 100644 index 46e553e..0000000 --- a/zfs-fido2-clear-key.8.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - - - - - ZFS-FIDO2-CLEAR-KEY(8) - - - - - - - - -
    ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
    -
    -
    -

    -

    zfs-fido2-clear-key — - rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 - metadata

    -
    -
    -

    - - - - - -
    zfs-fido2-clear-keydataset
    -
    -
    -

    -

    After verifying dataset was encrypted with - tzpfms backend - :

    -
      -
    1. performs the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=passphrase - dataset,
      2. -
    2. removes the - xyz.nabijaczleweli:tzpfms.{backend, - key} properties from - dataset.
      3. -
    -

    See - zfs-fido2-change-key(8) - for a detailed description.

    -
    -
    -

    -
    -
    -
    By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

    The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

    -
    -
    -
    -
    Pre-formatted noun phrase with all the information below, for use as a - prompt
    -
    -
    Either the dataset name or the element of the TPM hierarchy being - prompted for
    -
    -
    "new" if this is for a new passphrase, otherwise blank
    -
    -
    "again" if it's the second prompt for that passphrase, - otherwise blank
    -
    -
    -

    If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

    -
    -
    -
    -
    -

    -
    -

    -
    -
    -
    If set, enables libfido2 debug logging to the standard error stream.
    -
    -
    -
    -

    -

    When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

    -
    -
    -

    -

    The libfido2 documentation at - https://developers.yubico.com/libfido2/.

    -
    -
    -
    -

    -

    To all who support further development, in particular:

    -
      -
    • ThePhD
      • -
    • Embark Studios
      • -
    • Jasper Bekkers
      • -
    • EvModder
      • -
    -
    -
    -

    -

    https://todo.sr.ht/~nabijaczleweli/fzifdso

    -

    ~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

    -
    -
    - - - - - -
    February 28, 2024fzifdso 0
    - - diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 deleted file mode 100644 index 247ca04..0000000 --- a/zfs-fido2-load-key.8 +++ /dev/null @@ -1,98 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-LOAD-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-load-key -.Nd load FIDO2-encrypted ZFS dataset key -.Sh SYNOPSIS -.Nm -.Op Fl n -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 , -asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into -.Ar dataset . -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl n" -.It Fl n -Do a no-op/dry run, can be used even if the key is already loaded. -Equivalent to -.Nm zfs Cm load-key Ns 's -.Fl n -option. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html deleted file mode 100644 index ffc6446..0000000 --- a/zfs-fido2-load-key.8.html +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - - ZFS-FIDO2-LOAD-KEY(8) - - - - - - - - -
    ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
    -
    -
    -

    -

    zfs-fido2-load-key — - load FIDO2-encrypted ZFS dataset key

    -
    -
    -

    - - - - - -
    zfs-fido2-load-key[-n] dataset
    -
    -
    -

    -

    After verifying dataset was encrypted with - tzpfms backend - , - asserts the preserved challenge, HMACking the salt with the on-device - secret, and loads the resulting key into dataset.

    -

    See - zfs-fido2-change-key(8) - for a detailed description.

    -
    -
    -

    -
    -
    -
    Do a no-op/dry run, can be used even if the key is already loaded. - Equivalent to zfs - load-key's -n option.
    -
    -
    -
    -

    -
    -
    -
    By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

    The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

    -
    -
    -
    -
    Pre-formatted noun phrase with all the information below, for use as a - prompt
    -
    -
    Either the dataset name or the element of the TPM hierarchy being - prompted for
    -
    -
    "new" if this is for a new passphrase, otherwise blank
    -
    -
    "again" if it's the second prompt for that passphrase, - otherwise blank
    -
    -
    -

    If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

    -
    -
    -
    -
    -

    -

    To all who support further development, in particular:

    -
      -
    • ThePhD
      • -
    • Embark Studios
      • -
    • Jasper Bekkers
      • -
    • EvModder
      • -
    -
    -
    -

    -

    https://todo.sr.ht/~nabijaczleweli/fzifdso

    -

    ~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

    -
    -
    - - - - - -
    February 28, 2024fzifdso 0
    - - diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index 0c94139..c7cdc92 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM-LIST 8 -.Os tzpfms 0.3.4-18-g1f9fe81 +.Os tzpfms 0.3.4-21-g1165607 . .Sh NAME .Nm zfs-tpm-list diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index 17227f6..8818837 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -166,7 +166,7 @@ tarta-zoot/vm - available yes - +
    December 4, 2022tzpfms 0.3.4-18-g1f9fe81tzpfms 0.3.4-21-g1165607
    diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index ec6ed71..f5ade04 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CHANGE-KEY 8 -.Os tzpfms 0.3.4-18-g1f9fe81 +.Os tzpfms 0.3.4-21-g1165607 . .Sh NAME .Nm zfs-tpm1x-change-key diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index c89e18b..f03403a 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -219,7 +219,7 @@ - +
    February 28, 2024tzpfms 0.3.4-18-g1f9fe81tzpfms 0.3.4-21-g1165607
    diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index 497706a..f3ac94a 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CLEAR-KEY 8 -.Os tzpfms 0.3.4-18-g1f9fe81 +.Os tzpfms 0.3.4-21-g1165607 . .Sh NAME .Nm zfs-tpm1x-clear-key diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index 7629cbd..2d5d6c1 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -103,7 +103,7 @@ - +
    December 4, 2022tzpfms 0.3.4-18-g1f9fe81tzpfms 0.3.4-21-g1165607
    diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index 2063291..0c041f8 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-LOAD-KEY 8 -.Os tzpfms 0.3.4-18-g1f9fe81 +.Os tzpfms 0.3.4-21-g1165607 . .Sh NAME .Nm zfs-tpm1x-load-key diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index 0cb98b2..b382a8d 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -139,7 +139,7 @@ - +
    December 4, 2022tzpfms 0.3.4-18-g1f9fe81tzpfms 0.3.4-21-g1165607
    diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index 7608f94..3da748c 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CHANGE-KEY 8 -.Os tzpfms 0.3.4-18-g1f9fe81 +.Os tzpfms 0.3.4-21-g1165607 . .Sh NAME .Nm zfs-tpm2-change-key diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index bee42b5..9f5e01c 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -265,7 +265,7 @@ - +
    February 28, 2024tzpfms 0.3.4-18-g1f9fe81tzpfms 0.3.4-21-g1165607
    diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index bce1fa5..817baa5 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-CLEAR-KEY 8 -.Os tzpfms 0.3.4-18-g1f9fe81 +.Os tzpfms 0.3.4-21-g1165607 . .Sh NAME .Nm zfs-tpm2-clear-key diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index 08fd439..2bcb21e 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -154,7 +154,7 @@ - +
    December 4, 2022tzpfms 0.3.4-18-g1f9fe81tzpfms 0.3.4-21-g1165607
    diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index 2557b24..9d31204 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-LOAD-KEY 8 -.Os tzpfms 0.3.4-18-g1f9fe81 +.Os tzpfms 0.3.4-21-g1165607 . .Sh NAME .Nm zfs-tpm2-load-key diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index 7ecc602..5f5b015 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -138,7 +138,7 @@ - +
    December 4, 2022tzpfms 0.3.4-18-g1f9fe81tzpfms 0.3.4-21-g1165607