From 12eec3a5cc080e6c2e63a03376e39c6c1a9e4d30 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Tue, 5 Mar 2024 18:29:52 +0000 Subject: [PATCH] Manpage update by job 1162369 --- tzpfms.pdf | Bin 65598 -> 81694 bytes tzpfms.ps | 951 +++++++++++++++++++++++++----------- zfs-fido2-add-backup.8 | 125 +++++ zfs-fido2-add-backup.8.html | 153 ++++++ zfs-fido2-change-key.8 | 188 +++++++ zfs-fido2-change-key.8.html | 207 ++++++++ zfs-fido2-clear-key.8 | 121 +++++ zfs-fido2-clear-key.8.html | 151 ++++++ zfs-fido2-load-key.8 | 98 ++++ zfs-fido2-load-key.8.html | 117 +++++ 10 files changed, 1822 insertions(+), 289 deletions(-) create mode 100644 zfs-fido2-add-backup.8 create mode 100644 zfs-fido2-add-backup.8.html create mode 100644 zfs-fido2-change-key.8 create mode 100644 zfs-fido2-change-key.8.html create mode 100644 zfs-fido2-clear-key.8 create mode 100644 zfs-fido2-clear-key.8.html create mode 100644 zfs-fido2-load-key.8 create mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index 50fbe7db6858302895e598bf96ed6d9566a98d33..8ebe3fc70641f74acfda44d94b126628d9e398c6 100644 GIT binary patch delta 60252 zcmZU)W0NjWmu;CiY1_8#leTT!)=55T+qP}nwr$(aeyjS{?T)BVd&l|#dyP3_?jFBC zIX{2uV1NP1nww6WV#w897c?b0<;-nlQH+6|ucoGvEy)@UY9?LH@hv)poTy0tK!K5@ zAFjJfKgr*t*E#)rV$^OEdot-bll<|CjncIz)M4~xG1NiSYHy6f0qK4_bZ z4RrcUhS;b@j<=}+h^Z1eMDPp$L8?X@X24%&-=E`)6-YY@lNK79`u^8+G=-Tfv)D+= z$QzM+Q`e*fex^(=zGI@_koD^NX{8wZ zEFC~-bfZjYfBY0#$@TaugM6nC?!>iQZX^{SXS-RI<^HUQLi5yrz)XrjG?|Ev=Op`bPl zn^o@v1s^Ih%JMu>8qc@~Jpm<<@xLb3b9^#UO|r{GQ--d6sbQ%mPa*!i=7zR1#QOb5MasK!Y(WQsk2(Gs2ux4VhmDeJK{HOusD;8o6N0vn{(6G%u%^3P z1Hm)OZ87B-)mNJU>Dfe@prCbPV2VZI824ccIy*Kg49h6#{@DXg9S`;(mvW_oR}E~g ziXK0r-q1NcM>ekX(@Q8rgae?1hWf)3@W?;(8TH>N`R{V|PG6wvvAgc1@T^r0KM4?UQAp1+hu%`En_P!p!`LQLvg9v0fg z9ZWY-7%LkVvqDsodl|3VK<9X7_fdN2ltk*6K~6Ep@pO6wvu$-87%ZF&^hk!C^! zs|M}VHgT-Cu6veo3dL1$z1uTwTrM{dhohGRrK!A^m1S<#Q^9N&D2iFKp-XwDsuwnA)N=1I z&CZHNe(!x^*k6if426z~_Ik6RGcL7Mr@)=Fh*OF&BIry%<^byDN}{)&N_P%s?KYJ5 z8r8RVO}r27SZ=j_LF=Mte@CG66GWTPz~0bt83mMaYJL@@v>Bi0BB%>X??Udb6qAL0 zHtm@sl#_Irl?mbUNLLz=19rw~2s><5L^Q}2i>m6@E};>Ug;)H8CyMhw~u4Q zvgwo&flX>SmjPfOez?~&aL3yEFk9S#u$1)|bfQ=o;~+CK4M@l7bCQO$%?t%S!rlSV z*>6QAY7A2MUU2m(%qR~siBt|skJRYwWlpB>C1c27v{@4WhR#S)0#byxLHKxoRVETB znMJQ?Rd8O)$1I3t&@Fo?&(G{agN7%CI|d3;nB~?%EG6Et#2T912|?z#!RQz%VU&sPUc7SO|%q{yN-6>)@DEaA=Io z>NI_a)TX{eB zPf;VZ&VawB*n2kGVaNv(qtjUKxT0;`p(UxgGqv;RbJm8N#vJ2N@Sp!Yn7Xr2(r@W; z7Y;T#yZQKiz6CK3;Roq26k9>>zg8<-F&bypOB>ghKQ9;8pB_KYLo3gp5y!e{tn)&b z*K6;s8a(z5?Dkr)SDjR%qb^W~p3(E_bus3;C;{8eV98{TZ38{veoA@Vzz#?0$ogns zm}t@otII7lM>LWlzv^mt7h-~|AvQ1COb$I8(#w4zJGtM(*31-nDRvflYoXN<11m6e zr4R!BL0P6)_@8~t%q9o}9O8n1 z+b{?9=tR=ZuEYI0uqBH!`XQ$raP%La5%oVYLn< zFtt0CRrsh{ZM@8ihK9h1g>hj5&*k|zaMBI}uT~121 zE{>dQZ22?LuDa}oi5`v_qVpusW6?@i6}W~Azil%hCrtZYoI1wcR77rqqHksl(-oN* zUT+d`MJQ`JTb*SBqW2h#rdMwv;D0oUT|wJQ3sH!Kf8{0M)4&U@u)&vZKLA!E-|+~~ zE-+E5;n9c43Y3yAsmEktw8Wr#D{CB+hRGIUY~41D@k9gk5VX3CE}e9XFcTfi4MDIl zDWj~(i5yZY?@kJtp^+ zhZ0PRfKR=fwz&gkuaiqLR#8l?%`ZmGW1e&rb-C?4<9c5dPT{C4h-qh4t2ShH25poT zLaRg9%alQR@-Qz2NVJPF|GmqgF%__iCODt2`f`i6t5X9m*6n_3o;{|05f`JSr28{*xHI-?X5vX! zV)s+Cjwhp+x%wi|Lv6(l{Cln0<nzQqk>R!lI4OI#1y`$7RVwud~tc8x!YFT&Q!Tp|}DLTQ< z?|=synm|#>Fm9!JV%%amn#~UznnqzI^@M#p@9cmwbCqMBHAy@3@6y3bNZ& z=pGk2$l%FYien&q1UHJfW9SzLaPUr$c%Tt5mI)oP@;#3{bF&$KUacSqUxvci$JWyQ_^LGks@-}zzWWol>Q z?BZl<9;eVYh%&e^cGh^cVKf}L&8DvcD%v~%9nHdQg6NU9j09vw% zn+cmuJ# z9mqB%&k14vn3Z(u_xf%h>ZhMNoy_OH+#cTy7{6ll>Nz|oH3R6}uP)z*6F1ZFr&cjO zOlOSx50=~$lcwDDAZ6PvK6B&xuW5o-sEko%)wtDq zU28R#PIdZS4$WV6FZ~>i#Z3&gp!jEFO}Ec=<+5o#dFb&5;l_B;M21GOnze%==8~*& zH79DJ)yD;shd74gr_%Rb0JxrvH;3GQ#F*?7pF96nm$$3C561&mmiJAKO|ujF`opzh z?XK^Xe62VPm|ccgPW{DU!S^~xZbsR;YyG?$JVtE6OLVSSZirvtY5J{p@1?tE-o38A z2(MSJ-nNgk*SD4L_d`jv0yC_qc{`AiFo^4!WT&K%c5ow`JOT95MA? z5Hz(E7;u$mwkXilJ0o@zSqE&m`njDi;2k}A<`U1n&9rN$*`5kEnVB(eq?!F9tA}1i zJsEQR!Nkm`-ChXFNerpG`}hlq`_&gckjKknTMfWK*BP_3!xeJK384OqFOmqM*&KE~ zus^cJaf3cqDxlc}s3Ogqoq!Ij&6F~QDfMyf0mk+BACcTx3-5bgAiS&@)8e36^`YwsvfVnh7z-W zB#-}aaP7AX7TE$y!^+~cGK!v1htdl+Hu~_qj3BdUzJ^ZZBQYOToj0W2Tqy>^+OG7_ z8ZY5E|HM)D?^Rp_s2Fb6`6@F|I(@l~sA5oGMBdh;V8&vK zCOOf*`-Jab1L;42+vHROZ78q~Kv}fRaa6^7{U(;{XWkP~vaz&%3G_=W6TZMrd)Twe z83TocX7+CpZ;S@AUdT)xZh2rH&Pm@j5y}@e4?3-skf^@JFW51DuaLs-X{vklSEW z`TFJ)F)`+l6q>q|6LB;zcfpOE`3vfhIGm+3Ewb9rYvh$2dzoGHw>6MUeB)@B$`6r^ zwGTv!gjf6abAPgxQRE5>`4@wL4UxhCMS-voPp78O(hD!v;f*LQtGj-ig6^rDiCR6%gKQxqDtz38pHQ4 z{9mIbg*!;yjOJr~bCo6Emz$>@x(3l7=@#$aWbyXtUW=XE)y|D#1xZ9T{TF~01J*cz>K4w^`QaaUx;4eGXEd4y|#Y%kevqojFsw1htY-B_cej9E90jM z$KA0V;?F^&Oa_8^n1L%!JK=fomkd!|*zK^6LO!C=r?I@>=ONc^s#s#wn|}`|-@;63 zKSh@?|4@}r0g>)Kh#Es{EJOk3-g8%Vs77m%vE@Pnrwt+4f%8 zOMc{ed}PSRb5Bc!t3M~0`;_V=fMAss6i^b|IZ9DZETg|0NyjNk`Zp7e@C&i=dGX8S zgUH*4D}iCiX5I4B79aKOYLt?kICP;(S)@$-+IHGzmE!1)bN^hJP^I9XaewmD!`xRu zgw(M(*NXFx3Y{|n!tgi%w5ym|D!*azxPL85q-A366*Tk4Ak@7Uf~}^&`ylPbM_SHn z_Q@~2s9qY86u(_QH%seU1vg8`SRHFAky_RX2xrEEZ3)n*-#Dt9iczL+P07j*a6ZaQ z&#!aRWKx!7^DRqbP~8*H${YHvUzIs}3h=7-gtirEpRF0j7H*h;WF7vZ2m1t}Pm-lj z4LwrO5a-ix=;W}qHc5wTa%2&i%R>QPn{o7j(I*vFV%*D$0u!=lw52pvWw{BeJrwgw z8-brP7yWV5o>6I)$uO866H4<;n_65!Fk5B(7Mdr}jA-&%Co*7(8DVg*2{m9um+$YY z^C>}L`@x)!e2f;rOWX!tI4Pps>OVk3<_0lh*z~`%Q1UjMF_2Z8v|-$6MH4fN#8_kM zzIR8~MVq}$+jbS92byYW@lHobAUo67bt?%yf@@=SiMqXv5!Y#TRX1F;Y*L5z{8M=e zP{u-YqJB94Ra6SC6-srXV#@+zd9)1F;DS|=XjUQ-)zJ+Ac%BY`3*_wCK$8>2pmEU8 zl^spt%kW^)WIBbGC{HJN7w_*vnF_B_yAFOu#0VG+E2d1%Ga{D+g*7%@b0Oun+8pG1 zY#~zHJSCDfS`qK~lU!&yIyV2Qt54jLW=gbo)upX=ddubTqG9f2$Tlq=nFBBHcDjzQ z0LZ^<2fllNFi$7cv>yTvFJ-O&m~5j2zqoB_7C@t=J3^9?*GD@`!<7=c=n&IY(S8Bi z4{CcQOC9^A9uuM2q6~|lc`4$_A6%J^36eVvUygDQF>-HpSmhr#eW)0qakU=LNjttlWG=atGQ&cQI?Smf zQ9!Y%&irii(zCbxt|0;&Z~r~m>Kdu3CrTvzjCn6{xz3q{FD&4!aU8polc!Zx8Np7- zb4?CRRQ`7Q!BV1?aSWHUX%d%mxX3y@fZcIVyG2bmmEub>MfkUGtMG$frr%zTPp~BV z^y3a-g+02RQ4c&DMpYi?;yfwusQm=l`rO6mwt1>+rsChyph|b8g0CVhDjHUkdC_XM zbT-V#mc@ummRUx8DSYBPl809pYR%0^1MQLY&Q%;xoxh8r7kJWfDWno;xcWh0H%M6Qv%BQq zX`>*hv?>P^2E2?ZTj95MiJ%YHwUOHOLUsY%x4~K;s2!pT6+FZNQmVbOrQ_)aVnMNU zJVu)I5SOVrx<>D^pN}~`1j}hY`V*x$WEOg}WrZlzild^`gdf=kb3NS2@eCW9ge3s* zn~EEw_ZdA7V{|!eDwQa7d#eo5fw@MrjqcWfB1!5wV&R~fGiZ@vDEpVpdKg^6JBO+) zAMH^gR#AUe>95HZr>}!IYSW~rtuGR1ir;D)+G_50(G^eMsa70PBJF0XHD=F}pKTb} z5YGp9hk#)<>Pi?uDaILna~Z-mXq^Qpu!JzeM>1f{;>jI^G~#IBknH}v?Jw@Q3vDFK zZc`C^MtePUU4ydBShb#7s~f(IdplEgbYD01{h7pi^roijv_5G96#Ke9Za-H?fVwMN zyYkrOO$KLTsB<{KWK)YO@Tzsn(%aWE^!oa`a&Tt^?vTL^+J&(H-Y+*|xbp*gJGwf( zp0BTux0h#k^>_iUt~?;dw?>07Ler=ExpPKk4Z$a%rk4VTOEF7NOE!!@(<=Na)o0j6 zc-z{tYWNwvLBQP!7*G0IIm;Qh-$6A*a4A>YdhUfAKR=^WLh1*e<=qGH%A1`D*!hL1 z76Ohx$~0+8bou>0ZaEcJK0tsgrE2?_Zmru+K^v8aqHYi1yCu_=ySK7?CJb^Hd329^ z6Pec>)zCdsZj)|9g49AoSkK});ykKNE|w)vZaYFGbRRC#gK=SaM`{*E1B@=LfH}Pb zn*8OR7e8Q-WXDJT%ldOpZ*GecAe$p}S4FnF_L_8wAy__DlKUoYufU zErby{`b)NZM|t7qnjt~vr#;s8$Kj)&I^{-igI}1%BL#@zEKC}5DtjIp-ZrBh)bSYb z30ZQ6252HkGnqc7e_66l9Ua*Y%@fOC2Lx}A`cZ;2$p0(S{#RE0e={uy+?Kjy`hxNW`!i)q=`wB!aI_0ggTctOfG!Kl{5)AXmHk3#rYa~Wx^(hURQHRT86H%vE3;hiEALhL|oPNALj(h&{_{amcF?#s`uU02L>EDirq#VXBt_*1U zv8M#$OE65&K4C1g;xk;8>k%CC)6nqqe{tTSUL-SGaE{vb9-ct_1H;9yK(3^Str{9U zC#j#Nw?4j}5`t{u=p~J^fPhwGWkPbpx92giHeqw1eCHk9sWRA77+!0h+rG!9-B$S^vVFs#eTsk}!CL&fU(P-2Q_1O3)}b7X&zT!2YPJR? z;x`CIe*}#m>z|Im6s0RN%Y}k9+mNJ@PkJLItz~iv3n4eMxy~{TpU*rVfy$sONATUD zaW!L@MDD68xCJF%yZ{&_8HnsEPX{V;#SFJ7koyGlf*EZP+58FvXxpCHO;)k^v{rTUIZGieOwOmHP--RTJ%3_kzFaaB+>ZTs>k#iZjtlp+eN36+%Egg z$^odx2ZphKkSuhX=`;}7;Gr}~uCLq}@L59Z4F=OupNEzVVdheRt89p{8R7Uyr;Gns zM7}H_c!|1!zxEGy_Z6 zoCYsS_SBDTGLQ9yfRd9)B!~{Oq#2id^`2mF7Ll^l`xJ}x!1br zEPDpQ?=+M#B;G)#?swAl7d%#KL+obdW{t0bD?zYV!4X3@YMigJ+Jgs7HPe3q(Lm+x zZ^rL!-H#&a@l5mHfgD*(2o0`)qCpYzrdeiNsN*uKD&bCujuSm_5#DA>nP_jXz8Hms zYf(1G&z3BHL3$tc7al_FWlQzZCcpW1QnL87)aSH#lpsvO#Ab4!7W+B3kop7GeCvkN;OUP0RCdq`tT~#t*v@x?ql`>w?=U2YgR+zz6SM6YIo>qQ;s z7w_3R&DoGM`m6yQ-wBIiEjcRjc%VVs!~gh@$=$Fp=oxuRvfkmh9D=Yxf?lyiGIt zdr~^JR@F`MO*=O5ujf5@59%KT_93XxW~J@KUJ4NJDHP@$L_c*pxo5FhP+U;PsbWl;cJkh#PP1f_gMjeo%gW&Ii-Thv zJHV%>udneh=kIYfT6cE*aJ}7;Tg%sX5D(vR4a_L*BFd!_>Vcfv>=N|zI5U?c$wdRF z9e){v<9I(9I1WkZIT%Ax{^)XX!CGXN_l4D#U10FPfpys}ZX;*@0;Dv}^L zP|(9M4bIWvMx2q2YCzUJqXTC>mO6pA#_9{Vw6q;XJ8H5ILu}h%u`lX{G|!VpneP(B zZ!2>NRja0eF?idBsK?o~;gYdjXJ1)hX~1goTK+64T6CGI@Xh988aJIw`6+k(`cX^f zQM?JsA<$wU2Rd5kkJ7VfWHZ@ChZ?veMjjKaO|hR)dmU0c zeMDHS5TCtCn`CqNkB}iKY`m8Km(%l!r(=CuUTsf02*bjXUigu3uXV2*+yQRl#5w(+ zJaTvDF;IZR_2m1(W@hB&@o*;1x9QuN5rj`q^UP{=)!1OvdrDQqGZW2?*{{wIV;A2Z z>zNP-E6^e93;=HS5|%d%7>Dq~cMeZ+l1~W!s1_<%m2}y0bu0~2cl+!gmx~hL5=)iPB!&OVq=!ub$g8GpK~0XGw)>jsD$jQ71QGD zJL58fE?1<7`eN6{c#)n>bCQ%cB3IqOk-)RLFsjIdF@QCOlO}7Cj=VBOh{Zo}rZM~k z8xcneIAbCu)|V)2K+?6_?%fX9;*{N5LTb20L&KYydh(_&OM8@Hxf}yX=DIBEA&sLL#nYstVhOY(AkoNV;lZ{*FLhIG zMLe|BV?bMuLm8273-1{4oj1_mtL49>l4QzZLgWw1uDG1yMH1{qI~3tnm&ys%P&?@r zjhv{s=+ER#ri;QU5(!D7Bn=>EqRg`R76@tZ!rWTVzO6KsB_k{p8lO=OIl&fd$J=fo z_)m2)z}8e5K4i)3IEpBOH4HV7dp=Sb)QJwFPyn^lhWH8p9p#1)8AdtBTy8mBDgrsQ za2s${a)ZONwj>oN?U+9B7!Q&n|4ZPP4XQ2I#Z*wj5PPRrq(8VZA<@?lpN9}yVX7~k z5`0GwgpXJ4HP9}w(2ueM-_}k!;<8>t4#vrEi7L2P!axQ81Pbci11qQBe{Z~yIrm*N zNdTl>c0pvQiQtC;ck-OZorn-m#%peTvUuDPfp|fIGj~#8>r?HfD9;4OQG@;*Vc~M>ob#;iBH?>_EM37Cod2G&>S1th zpJyUB*y48O$tvkW>}bIrnW+r|p7lz&^ZF$;#;AA{Jf8#X^G?OC4db%5o;d03kZ^$e zgwiMS!AcwCDr`dQ=F2xA>xW^Z()GW+9Sf4w<7^suV zFt0Hr8MQW=2Ol%+AxrkhEX=iYt!cqzH{DzT=g_TdgjGf}4>`32mCt~`CPo{XMlw#q ztBtB^S+c5;#u5{tbWs;@?(he=+%Wx4Qj5oJaWf$7aQu!{h~B(p|>N_ zF*G1>eB-4&!h~8)941%0!2q12a0~GR?-JuqYx;*Zdd&&}L zf_c*FH4nv;E46E+4ABZ*HAU5~gv@1>M3zmtQfnx{?Lj~0!9S2Rk5VTkxUD?`#2vcW z7yVxjQsBHGci1a3K(KcdQWsG}HugQS!d~`#zd`TLjK~8uqzXK#=m4Wi&xnM__AM*R znjd!$A4&G~Dv@Lxa1w-28?zD?T=nktZ(0hbhC!jnu|2}Re{SHN@;KhsKI<;N z(sWX)uNIGxDNHHVmQ11Pt(T~w+lUMO8mwb8$iQ4CK)2Kw!{1AC;Pnw7)Gx`el03uP zGMVG~l^7EXRUYjBd4EA2nf`H}HxscMrv1VejOjuZaN7c_#IWPcM`=6pafmy1CQWg5_S-|l!XZ~gmLrln!5_`P$#T9XvI9)4L;&W z24>igl33#Q_svb)MujS)S%09zu+{I*$kpqcAJkA@l1qEG=K-vcc6155AAoUest_G# zfk#>4RonfzBlH-Dd32K%4Ex#BPcK{pkhe$jAVjzS?xZBZ4lsgBmS3Q%)Uba?7%nuYM^PnLYp)`(6vTwj zcXekKZ1nZw0^BdUqfnj23IrFaC}+|xm6Oh@5eTmOS7=Tfq$x-?_Xd`~-M|9}kh3jN zG*l3Rcht^H&aBTXDD^BUV?TY_5ua_V7IcIxq++gl1_F$;EDCx=1COAZuYcFZK*Xi} z>lgFCG=SNrOrY>o@VwVdtjh3ZdJ}gBvmv!&CF7>mNZIdtF9-_0?$6K!u=WLC5#N8# z*TH1rn#!YTt!zZ-u+FAl1W!H~KdCA1=7D|Y;8MjEw(!_XkUSxpAx1fUF#{u5Q{b0FX(QU)^6+57Rp;?1h3popj2~=58*fCM^wpWftDCB9y$(D*$(zU#bmE(JRU1_dorDRMU(JE2rNxumdySZ!v^Oe7KUtgNK6)o(G|7@T5_HuD8-# zbig5v?Hba6o?`71ekH87ap7|(-Wqg%#X22)G|vi9)Rr!75g!*1UiQpQ#sgoE<@`nj3w}n8A70u zUJ)GSHpzkV=FWLa=Wf90BJKU*==SauU~)#K|G&7K<$pvBGbh{smaWQowWJvrW!31dN+8?r`5BK~xgU4eaktBR%l}@|-&2CB@!tsJ>N-r>=*1Dr_84u$CP7f+LG(i-=X_*PqnuPl>P3Tb$t0Ci>D1VnDT`a z<3hmFA)wqIRR11coyO{YI7Xn4szp?5Neuu&M5Qn9pw+$wTIiKipo&|xXVjsxB$#do zyh!mvFM)!D76G5n7^eME$sMfZWthiAhN6N$ginqX<$VI}gVD~}HPg-V#YB{8gnXx6 zvDeXug$PXpG|)E3nP2q3(-Cb~Chd`e)AHqe_NTgD)<$-f_-a0G0Z_#$xG5S*{bHwb zeyR0inCE~8=*NP{D^#7gB;zX`6lcingGFL>B}kbqNN_j4G8zLFt7s({$$&UV%Jo{_ z-apKG+H|6b16BSaM4Yw*X4PXqvo*Izg)IqYw=D_*h~}EOYZ*U^(YsgpUmM*c9S}%z znuu#d?)w>RKD4A{Y4dAPC)YOj+tH>{Q?NW3(cr-o(pIb4oQlUqO8Lo z8Y&1R60`%fd9z66Pq`}?6NsVTZV)wUOm7klB!9#md*x|D9#FE#ifDQRBw43=ZbF6Z z#Kxlmf(r55Qoifet=E({G6ambg;ImhJ&t>+EOf z+4sPF4&2T5yB@YQ*z3gYNEWM*Z-&4K|@1BE4e?s`))2%ul5X zS^VjFH4fOiM*8TxOu0_Zf`Mj#%A4r&gy%49iV0p*>scsm@+z)Dr3lG`3xzPd#W6eV zLz}xC!QeQav1m37b!mTVyb+&O*FesR;3H8ek6F=9tB7pc3+UM8B!#SC_yU~jLh}(o z+#V=R>`RGu-Jr9MF`LVx>w8Ol28zgn$Q?I&|TdL?w9<*vb<=gU;8VamFG zwzKtT`P9}8mA$5STC-K@r$lV%aN>K>*k1G}2N1$~Dkl$%{!dA@d@5+bGt? zeap5jw!**2e}!AsJ63=dCD1`dQUOu09+N4lfzYmT#qQM3?j`96sqYmjjSgGa6%AC- zQ(JC^)k8*2Xm**gT-d~*zFt~DgJujfio`rI+h0mjRb42*+IQfh8KYq!PMYX~9@{Lm zz5Y2O<&*KiLZ*se&P=RS98jt1`SPTT+D_s&g-4`nbKyXyqXmN^saR+@}g+7MX7VkZP>(He?E* z`!R(fX&x0}*;@A~n$n$7M!?7vSS4=H9nE_++0v8sDQ44iw*ZhTRI1yF?@;824s}7F zr;UeX5BH}6cx})X!gVi#FKd>jJ~4Z65*${qxdmE_2v>4ojpywy9NGcSd?NuB2?O8MV<ue zMR+I5bJVJEkGJm%pYI#`3(GI4fhNq2xb_WQ4EZsgGI%1MY}^Up8_XVT@vm`%^A!Zz z=H_(o@Egbrvm&^n%9?c+Xtch<93ib6_HE{~3dVli{62DT*ZH_r2 zu*qH_G&^&_q^+Fms!CM|9<1oK=VNQYj#?k?pKQw?VV1ZilpMXoHsPF`C%^g6@FSy;rh(eGopmOmb{_H}xUDh=* zZZ=|*+@s$7Pv%F3ZzGLbqd= z*=&_C3i@{REHUc~;8$^_i9}lfvwsyJI~KjTk{YjcS=s~8gpPs3{b_NuI0ZSk@Ccq` z_Dr2KRkUrOeWpVqS^N)q7JuJuX-Wc{rX}>fp>nE=_fAyX|8XbG&@9KhObyCEh7j9Y zVN}fM42cjJ2djJd?1E;sr0z@a+p zKb$=OyMZgp?wNJL$2^$qB z1m0@hL>m5OK$TZ_&51N~@x9Wkurq(eVX+J0#GeIZOio_j&f|Quj<{eJ|K5KeJV_Aj z$Sps@BfAJuxnEyCI%}S?*=3evt1hFV*&n^@Q~T}MHe>bS}`xJZ>8BnNpGor1kUKM@-XMlZ?lVRZFG33?gDi zggNE|E5NFLg3sz%dOJB{+(A4p7x6|Z3Me3QsbS`O@cHxq-4%S?9(n_u?wXx^T}ONPux0kL z47i(HwAA9H1aCE;g}Unhvc^)#S#WVibbvm?0Zbn;FzG|s z?es;~8hnVG=8dFTT=EikS!^TkDlyy@A+|~NEQ0fPUA*)6UK-T*KpH5M=1RVXhw(dosmPAt-wVuQP#R1W)+G*^oytH@)eEq?mNqJhX8a~W)99$Qrp z*vD1*Uy6|ehNGl^u6xj+(;Ii~cDu55r^Oii>GAfdWu=T3NSRVuf9kfIN>xdr6frSK z1Z&Vld+0##kDnEB1eHI3zJ)Z)#`{{(ko9xkm7<&78GZn4E&UHZHy1Zr3*BxxqhK9rN9%3F zos-R~)WEi2p0AP6J#?wPC>w2O-lV7Iqlu5CB~nZ+W6o%nPZ^tn0BqUaU7emhy`IiI ze-=u=2HF52R#l3PW)`YunjT_=(ZU!wolR}xnH5`g6_T3K6Cm}(H7}Xu!TgmCHWvi5 zJF~wt*LOvDEe{HUJi>ds)^vRgte81fXmflK@D3PiQw!+tV}J1D>PR>?odOl&0+#}J zu%11om(z9&>JM$xmdKY{%ryxLsl{F|kQyUrVJE64-eW?h|M z>v+HocP7{$AY%IT+Rwo*o!_wY@4W#7bSn5E)7C6;a3J*oQ z`fL&rK)^rdiR2B$?Ng3&1m<6td_50nC=Ea~yB6?Fgc4%W#UYp0J}!Y1|Le#`?`-jJ zlbFVGAi;U5nIeZr$WWpRvXXY=HUy8-9 z74vL%cmbz2A4}MF!{7KS?Jk5l9q7Gce&?S-Hvd)%QQj4qu)*ZHfQo@Q0;({8_6s!6 zdhf(j*RJson$4bZY^=0NS={F!|D1(Nam`4$w+Bs3>+&8xL-S7T>E@3fOnIdtX2}Nl zo(O(uH3&K5Dq@w{bZ9bO?VPKo>N)dfp|0wKc^8Ps`FL=Cu7y@?q*X6Cfr#zhDL-vg zB^vca&kEP=5)OK4t_QOMq?sHbQ=<%5UgUsw*IpxlFaH>y%*GXbWo_*lu45WIN5*to z0A%+NnUmO@QdRJ}Z)y7PM_Uni-@Jw~xCqY2PMF87!8p{A0F`B%u3QuMQ(kph(*1y& zV%D%K^oW19M>->8nUMzw4W{V?rm?Z* zb^YJ$!nWZS)0j3SR#kR!nD4*^CN~is;m)yCafnpf;>Xx(jrm3tF0Q{2PMAceh_#Wo zK1DD|18#FCJ#6wel(7JSuf%+Fq*AeA;$81qZ5G;QS^FAk&d}*)1x4eMgxP_^XJFf# z0Lc!2b%o2QaO*H|(l5RP%XLgVctrgBK@VsU!?Y0N0Ffi^@A>%o8T3Ie^SXce>U~of zVEMp{_-ug46gbJPk3C}B1U{zI5wYLXVJOJg5iVIgMp$w3H9sCeA7{oIcKNb9{2YW8 zfGjS%9iAsU7Shd+wXK!;3W36d=*ZvH8VOp}qDQdMzZAn3e|_YeHtGwBl@G@D`P<-T zLE{@z{hj)!>`CF*h5h^a;pF;R#SN{t7U(?scC@_owrI4s+)_LKLjto2?&#&gEW)?L z`@NB?+h_UZTn-;#N3ot;+B!29u3uzm_Bmh`Jb z{FlLZwz;#wxZ<_W%p>-o&v*CzcI}s+KFBR+*yPWF(Yqn2k^IrMepT-k zgTm6{@hZ+?v+LICUVa=!_PwhAH#AqN(POpIKs_c>UTs`~&;8M^zHF+7FQy^eHbcic zSig#CJ2{l}^rv5YRKnX7>^4x&z!`R<_c--Y4v7(pgaj^kzBLkPq)XZiMQ`71t_mRn z{r{#N&i_k0jO>X49D<1tQ0#ymXMzQizAzx0o_!e_h(Mmxd7>5Q5R&S?a2K)1G0dat zMkjK@0zzb1M_`lVvs^+G0Y09))6=!Y#&Qm>*kiV%Rr)Z1dv}G7$E^Y`;Y8ZWM5VI?$coZZPr;9SEAt<8kQCby{AR>JEf7+5Ml2AKGtX+V49oPh3Y=+3lA-xAm8HE5VYGyCF5|Kg6|Q{S?pt`3olm_6m_#l_^E{A*?_vkl5rCPd{12 zyHOc?)^p(j%eYN+qP}< zja{*=if!ArZL^Y8ywiR4xBH+^*B`j&n)e*ziEi$WN3Cr=bZiU*DS~Wtld{Xi;JGZh zMc7-`RBJFBrq<-yEq@>kPaJ$e;gq{k6W5&T}5xL9@h5Hb~YH zM1%3k$#g{TlkDS>@SrBFvU=!WTz#kdr=nwC=a>M5E~x{5Kju9`*!nQ`&!Zjy0PM2H z4xS_+fep&e#F(TfAq1G#mUH=O>boyB@_nH!Y$Q?kJQ}zpXDqMfY;FFOt0Gf1i%kn6 zA7VKRJM*U2`pCT29tqso1ON$;a!FmA(S(zVAX~cj`hRv57-ZZ!oh%A$_iAjCzBSu+>HWK$7b>wj+Z?ppbLaqE$o@x>gnitTPYI9Q439cmfP!34B%PYrpd}d3 zR5u3J+Vcbj1WtZgzZwFt0u1K@_vuN$9;5%lkve-QEF(`(wLDNYM9b3#;5j0e#T{bb ze+z4-{}~wq2k?3N&v?C*@987I2emf|=>PLvY`eCf6lkmL?CMIn;qemSobB@q@?WU@ zYPo0)2EBIg;r`)~Vux0|vN#&dZaYjIo6RR6YVP>1{k`g=IVP;~^<)q3-qg&owT zSDMu5R;#GBd?>KC%HpvZ=4MI+4|=%jf;N!E*(2FWs3)r~f%K&`bmir+JBFFD#1YE=yq?}j!UWqD2v5h!k8FJz+PWsp?P z$r~RBQU$vWnFh}sD}56qFo^@K^htNviDq+4ZOmOvoRZD+p*_*Ii(~*15}tn zC)=$#flE4x!=*^plPNB{RkMyiz~Cgr-}D9=$!HmFQilApV*v}*vp~@wLkX4^6YxE= z+P%BHvjVr)mD+m)QxOcdQJsn=wm$LJJwcybNy{!6;MP|;AQVrOhmu8%{dqzd-eIXz zCl7H}659LdT}?OqP5iqRItn{*S14j^9Rr$fs}(X}ajAkpwI^AxT8260idcjivx)%z z6BuO-)5Ia?)?LhtXC7%zn;5n_77)>4mroisk8YUC+R`<@_3V=$vfjjDu0O!jFteFZ zDAohQXaf!dUQ3#-QxpsUWJfvrP2`n=q=2QU^!B((fI27%YBFBsZA^zPgI?OdqAIbg0e@H$&e>jXNC z@Iuhd+)M92u0gPnL1JB(_LOu%6l8f_abO=f$La#X#lji5AA37V&ccH0{GxR?LZYKJ@hMa zfm>rk+NTJ}?-sd9w-4Q`?3*d?`2`w;m?P@TQKqL=>vo`@!>jHVWK?<7R&q7=G{lt< zFwpRHIZvE^z^NYDqSkB`4{X+xlJySZA7$i)`(ZT5v6M^BEe$?hTGlT#s;th?TK@1v z68&1VqgX3R%cO-S2H^3pE3U|ktFrnh#USy@&&N7Z9YGLu*stsq@MU0H0&~{!AOqn@ zXw_OS-I~zXPyx}|RaUOPn{eXBFL+T6?FvH=O_VT^qT;z=GCQzH3iV+DEit=;|6!q+ z7_uj>)Qpa7ZXk1Il}!oZ7gPm?A+_|VM~4H{q@?TZ@5F0l{ZmvoFfx}s+5fy3f0lh2VRD{2mV?jrMjKTMJFhq(@K^fjA7&qc|zRwTo7; zhvR{3BUdt;7@Rbbf5t~lNm9bLbtGVmoC zINalu3(~Yv2e8dyN$VhC3j&t4R|P!?rIj2Cb4B8(5@G0p&2*^XI$-n7I#A=0Ks>LQ`L3oi!1}ViDxF z6zj$bcV}5iVxGhUdw>6N9!Hx9fQ{3Ca7wlj6!#NH04(to%l8zx)^y-EzXd3mcAoP)m=nFL`b_+`+_)FX{>r{9tVpfN{NngnXa6U!SoJv^b6C} z`0OcVo30SYN{k}>mXXb%D$4AT5K!b{fs;M60ZN={U(VS|JC*YdON!tldTBFq{3uLP zn*rpwArfdDu1W=nLJpp*U*-N~+SSi)a$p{GLI)4xR`LQvY>TRya_{! zC#nz9)>Nqb+8Gs6jRVBf`pOugzJTIImLkmUz4_X_>#ecmxkr*?p3{FQ$bGkA9af0z zfOSn&s|Xc>f)1%bXOhCN`Wq=zJ>Lby%SRam(VAPWZiYzs(z0j>6M7)oGg<&8_1f*R zYnRmEpQD6!qbfM;Y4#z?GuNZGEd78(xK#UJT(N5#^&@&U66DDse+%d!BF9{})R)~W zxm!Q2$&Rt-3+=&xOZCAW)1eGT&33Ib0X(iK;+0$)kR1=`Vkms(zjMK*1hEqaauKX+ z%_Ryp?8roVF{fXK9U1S6lP|U-5Dpl>Y#Ye&Z8^OEPRw`V%*W|r&{g4gxtAf#l>A1y>T|51G2o zzDDd4_bw4?9@N7}C*Sb!(DQM$-{)+($tPZ1?9@3OhehMjA0(PK*S@#ne=2)d> zlD96=}x02 zbce-*%@XeQiOl4xWA6wKXF)?v{4qnkn@#^t+eNFT)cjK@M=Z@v+qla>U)lR9t7?WZm& z8Q9dyj_k57UOm1gymGLn(=Dz(`y({?8hF6bXM*x=$_y#OO;sj*9DLQ0^|sgdL=a8- z+E2pY+PY^Iih;gJr(iEvQ>+*`p}S_xP1^{qOXi{f3x{bw^hOlR7v1ddy{%m(aeKn#HCpaXFLGxiTJegwsGL;jYReBRJp%QCjSsX<=MPy;d-px^Nyl@Bip`l zLlO)Zv?H5HJa{f@Sh;|Ts+#uUpd8lu~#>nl6dU|UXs_3R9 zzkoo3r#=z_x;bhxjc(q6O2rR@fvcpVWgW z>ZgO}1F)yNy@spA(y&FH$HG6ni%#}b7p1p5E`4B^!Ji1CVkh&b=B6E9bkuKJSC!=g z_r}EI*4=)~2=V~VHRlJ{SqsCFansrzNhL)&b9&e7A5)56L~iuuQ^&^e-sk`yeyk(j z?5|p2i%>aAirUBDzHE5j2DL`8*TGYi?r z3Kpfc3}1fkzD`ch4)L;_2hIIm_623b@wfmE{wN zwsS}wE@=joum{UhRVojBz1N^jxH`m`#v#i9A>I>d28;UoU`G4{@-o{nDD5N_6*Ibx z_BG}o@-c>}oO!$~^yMcr-)-@$&mHCPxO!POUC0q+&;n~x<46<1$rW3CFYZ_nAxkI| zB1z&Zp0+gCatDwUaF^XoENIvUp-s8Xv;GiL;_HCz@o9O3W}&~-Ofk?|gQXQO&thj= z4wZg`{DFpJo6^h}CkPxHg{gE<-$E#-S<|H?>Q-@&Mr0mu`otD?zv&}2>ytmpGNKKZ z6w!SyfP)oYmQa}q%E@9%-BLPU)(mCSVB5wxNVtLg#1$F@Ia}YWv0Xsk4KmNce~YJQ z84mL%)2l$Tcn{4G%61_-w6#XUn$fGXU^F9Gj%BNO>D@lQAckMLxiHGEI%^@}s%+bRZZIFS$N5e*j|e$V2zQHq|)Xr+~hZ zF`|>eOQSeNKWZB6)S}wl>Su=9h~1rja-|3oAj8f;{(Xj_sxtD4tk?cY%B<=k|0+m0*< zqlY4s*ldmTK`ay5h(PQdViXQp1yZze0lKM6gR7pTOg+X{+)YBHcrxN;- zsypWbM1ZsS`^@EWBUPk}Fid!6Bmxgm+ovtxiALjH;ZRl~`dlD*5ZpQ7x_90^fX$^? z|LM|b?9UP9Irs!>gDl~{u(Egr&yU;d7rdr)V~VIE^x<;sQdV5ep%6wjoqT1oqhuj( z4=$RUygE>8v;^SN7qx6#0S?CU;Ra!n>7z*|PKFWJA=CBXXeOwGwn<7-{kvk?1@^$V z!iPT63V(uDyw^3g)>f$i5;+1{z<{L6S$Fwa;3?XY09`xf206@9lqtG!mY6<_&;wG- zTy%C#O&$x;{O>=)P!TC4-He2eOtsgdZsujPAK6j`n*&F*_AbA!?%$Ij;V7`KV>>b! z^1G}?p2et4QwjCl=7I7skHm#2RpX9}QtQe^9JgKq&+*qFwv#HJ=jl$o0Bca$?3*2| z(yR|#JM~BSMK9(`Aw`7v9{bHHLR2S1{qXl7WllTFb(pJb6m!^4tM+lnF4F}%btkgP zKOVn9UBPBpL$l6?u#)~$sYa^6CU6leDEJ^j5e@2afH-vbG!ctn4#RuN%0W?(pm^s` z_5HeyPpCDMWIwM6#9ikH@Y%Byh_B&BDluA8()?22#v6WhkH3s}r@@uAszN}OBX18< z@5=xgN4CyNgPNp(!w_K*^#=$NFFM*h} zXV-n2eLg$8RQlcV#uaeP)r%G$NV&g2vX#HqhX~s-uuGarWdxfO-@#)_%oKxb7PJ>< z3sWo%Gm%xpYPzihY(2X(R6%{YopT&kTdQp*fE0j<3w@jYv%#WquiBevu9=S!WVG;d z)K|y6ls@Snj1l!6{qw_CVH}vafV^wcddwc*??F$$V|K#;{2dr>$sah3%!<6w$z3s+ z>myQ$Ble?kc!TbTkYKf?KZ9-TkYAxAp^#ZW&-ZE7O#c^PSwegaL;L<;c2n3#23{rZ z)R?Ex^kNlzVqr0l#ln>sl!}TX4X5-5td)J|r3lZgN81)T6nJ05sS0YAz z`K#oJ71+fxndb^vBNXjU@{d5n^JHe$CFQ{ybab_dH9^dW{=aIbf%3+-*^UYG?heoI zH_(lNzaN7oWU8+6(%nfd@3Pi{s}Pevl;@}mt>Y2E6{y*&0-6_oo2|KJAlbv0jU~Gw zz`mvxf20T!&rL;NT^bo9-m%OH4n;Vr@oo9Y8BCvHz-Z=U)^zPmJ}|Kc;XD0?YAJbuLX8 zzz+rJ@QCvd@%%pI`715}$M`##{%+JG>ygCn&#u#)NJmRYOQM;!vC{0mn5Yjr|JZRJ zbju`v{Sn6<)wNEKMUH1K-Dbbhf!>Pcr{(&t3nn-CP+0t&CX%KDBa`jL-vja=5VF{tNglO*m9?CF50vO328nNa}t*UHn1A!?~AP( zq26VgD>}!@@z*>93hMz7td3An`^yzD;|L&(YtPC6-*mfgZ@Y4=&pSDyOH@y<3R_G7 zJQ?fXhVqBRKgR7njK(E}dI1P%&L*n10WCF?3|zgTyUQ^yGBl?v9~MGe{C%YQe>`BC zm|{aH-Rr~k%dUJ;_n;Wi4Y8Ftrag+1#TXrBPq)E!pqIW`n@BI;2qnPltxRu4Zk)uE z+VQ-AyGVvtbb2ar)CGvK=@9FNvNlN>ozco^D@1Br8UX{V0AQzzw6g!xps+FhPlLk5 z#mbUIY9Iti(a`yU)zHNaPBreTvHK3l)^$ zqIdw~k@5=uzcxEvwcB$D4mz;3n_$ih9DH(8c6pz_mS6(nIs4zzINDk4aP_BR>~{C8 zAtLn({RZ!WdxAQlRb;hpGn9u>9Kr?RGuU?3VyNMf3fF(yI!R+G^S~g|6Deu340z|j`4ZeMUShb%~6YWQFW!O927}d@@xy6&qk9%>`WFcgcsZs0!sX6VdoG;Ai z{C?s4`EYXJ?Q(xIksZVDBKHQBI@;A`@MZJ(x#l zloS$LPcl(8ISz6n)QbRTUBL?hO(6o2lX)=8^vnliIJXdHtP0a!T^va+$@r+1W*H!| z`?qxiigbtIL8{XesVRE+DB&fYG#xM^b>%?-twgPAcM2w*Pu{}C8m`!Jc-&oA4f8Y* z>45T4bWsDL4#W#Ny%Rf?Uk8L8 zTx84y+qC`B#>TgsqLAdkEyHN0wzv;Xe)Yr;>aO^p<)#}4u6fFo+I||n1hN-4ulX{B zE6Z(FHb0bc=bj8hk|WxBp9#Q%Z4$;cBOLVtW=@DCPw}eGh(3+NJpYAB9AtzXR{ckQ z(G5zs0KAtP&?_*O`b}5ImjG;pzQ$9A6e@XLKqN2jlg!Q+{5BIQ@%Y6xA0@sRkwI3> zbtHW@ChfRRs3x@1ArXyL7C8@XBVcEqY@GV|i~sCKl@-qW(vhtZ6&Y{^hil_^T_K+1 z9fCMZ={02TDie{i**e)twiv-9LDC%NjURhpL}1BA8^j$zowduIOM6n<;--SSfrOS1(Nno)!Bh=YT7wRhB_b zZ@2Dur(So-Ke0jHU~B+uv!s!zFkRC>!9aF~RmmdNhi*nWK@mc1JWB{@VYpyJ5ZjI? z5-jn!DtH^B)kb5_FHdU!mMW}pM`_GVvA|^BnV4Zhpx}Bna(st$aW`2HO4+mFl8y|;P7vXLaW$TAlnmzlufxklhx?<`Kc^?Bv6nNruMD#S2 z3$BGgCP`(x$9EQI0(yE0h9jyEt4qtQtAA4faV}ws1H38Qcyr?9JU7G#2k%V&S`_CK zKttbFwn1;Z)oup=&2#%aw3E{lp7*>z+&&zE_Mm`&Yi@^Yb0UQi!9umkrnH(?C{8;p z2us(Ue02}ziVRC1$nLz)NreusxyaP3aYwBCXb*tuL7dGHM^@Nmm@!0zos5{Idnzs$ z4@{z)dcrkLLGu^#i5%t1#uNXs7JCCEgWbWC$&{?qM1DrF0&u+&1E_((W?^q|gi>}3 z37_ZnsCVnNS&h%YpnkBQXGi->!X3E9`ND6%Im}rvGUfVSQ1(}f2&9qJw;ZJRbgrgm zpB^!-50tM@sEv=J-~TtP|DzmX;$r&$$DM5dxqRiWRQyhJy=RyNE z2&4eog%v}8G0hFT+36?AW#~3G#F)q>etySQ#}d$v-FDIc8+b7f<6xR;872lsj&R}n z?<9Z3N0LRF2V?@0u0!&ljy^*&4U`@g8pIgVlGf$Q0Gc)A?o47tB1ThAs71%_2Okg9 z1A6-Z72p64htf%pB*KwEgv-?Pq0;m>+#lfO^dsf{^W&6s=#j}&~QVuBr^7i#wNbhUoS>{8Q;PqA{v!c=HJR(_@3 z+&)H!>gKehghpK5LSRkYy)jyy58tQfA7~u2eIyvAR$WV*S);hzhaoZibEf77*BDUc za^~(DAAZP5Xs7&5Il_~L(96E*`Pe^-L{a?o$7!|Z+_wN}I2$g`>t`$F zt#AuJL|uaZhlY&iucb0r`hz7-8?_EzqcLAYgirc=PWR7E%s&N`D=*H7%|rNsAi?iK z7t#7!ro{l==kwBZ#*Lec2EVZ-b5ww`K#;FTYFS+8atnSt%$F#gy#roOqZMqVq0rG7 zan4uAhdrWX*<`vqxmMTjnPBEqJXWG0@_=yK+4-I_GSq^NF(k}jphx#$3yv`ofkk8d{K7^2z&tHFF7EH zh*jk5^;MwQD)C;8X5r3?txVghiHWw3wpaXXQN3Gsv@O>#S2}$520>|FAXh~$Gk$VK zjG2OXweE3u3rd}WLe;Z%p_BG^#Wgb0Si^A^*V71I4zKx{9;@t6%1Y%GkHy-*f5bd^ zmW)ao8Uoq`tVETi3YxIkX=VZM#dUq7LY@PNaD2eV0q0%l%ogj(Uf9fAS}7y+S*)5X zLdPpqq}-N7Gh9e|9yYQqpp^#QI|yt=CKNlmCQ6Asp6caS2lMWo{&wM>3!y zLTzMazrOpeJZtodN#_B!N56tF7k6a*ge)22LxuJ97IR&#wwPE9hmb`e{kZ;i%EEQh zVeZAf*;yPtde0$u^5o-4Y<=5?KXk09^TW}@%cUW7&V5{rM&ooxsSvKDrj!Avxj$Vm zAAeX!`m;g-!=Et-^tN*XUd?+j)uJv@aNqs6xVk=$-?Ao$9aaIS(Zf%dS&zdXt*eh5 zKV&zO;b+e|(roM2^8;i`1GCtr(oKY4&CD-aWfG-vl^&G7aqjoN&N5oq(j{nrRJEvy z?v3jdtwgjpKy%Qa&5Z`2ILRTdF}k>o;J(lv*> zy^Q9}J;9+jBUS(*XWWo>Jog1-8GUSbd^52c2PdT|rS;$R$b?t_7?FvMrRkeSV|H>I#o(skWp)W0 zcRGT?48Tq%A+HZIo0}u&jZz}V6Qmv_k2%+V)S!@*glzzjuhik>i?Ctd(>A)7IV=~e zLOVra|1jKe&jzdqWfD{@jOT)H z;CTJ@cBO#T6xaU1YQ+xcC}csCPgZPrAppnzG;}9q8CYFP8k`kd56~Bc^^n2&i@!&ys=y_5kgF zHcnu9ZuB^dg7NY4C_LfYjKxN^co1i_Zi4VwAus$G!-H$`(Cty)4{rnSRXN6d&F0J! zrlIw$Dzo7uflJ20^BQoSWFcL_1wH;ZxR>x_PZb~cEGV$Zy-4MK1!VBc69U~7yQf-;!#{Agi)|2{* z{3Sz%jwE<0=}TuCzv3^wg9gUj87&2r5CNkUt{^Jo*3iNOj%alnp#8?_CZB=>2Q6E% z$11}{(uiYi^g`m;Ev)coiNHF;ep=7|K*!jS2^H^A}7%vKn1XpXxT9L`Huf_L?d7jJ8eDpq5K_6H_YvA$3ID#}^veSnT^LLp8Zax$P;e44Imwg}68AlISu2+weR!S}rc11WH| zmq@XZx4&HjXazg_oCSViDW-%Hod6^-*J8?CL{lQ)bz^a~z?OJ1AFEfG5iClbV10&R z+RHqc$JOWNfKxY-k()of16`9{UFwQhLx~a2pqdqFJet-R{V;=&U*d4o+6~66tDJ={ zC9*%f{Ij}BK(46by+Rb1om@3V>qfP*HngY-EEx3?!&b#_+5CMTv=q9CVgYYV;1R8u z3bjNxWezRhyQdIG-@LtCU+0V6@{9i95wNVWAaV?#qU@)n<2!ggn(d7F=R`G?7kc03 zn1@J%=NfS7FIisnH??#S3B;i zEg>X0``o^@A>$SiRjGf_kxfMv^waW4C>MHujBv{dzMz zdKrA28*sANS8z`me)_nKe&n!xefzk07XvLjLrwk+rnzb?pbC!z6!?>4o@w@t8G+h1 z?q27Q7A*HLSN~Wz`I+eQ{laZ?6~-tODEf|gf7tk)-Gq#q2cA$vp=uchUgI2{Q|z7oZSn{A9xTsQj8|ehIEU_ ztIMjrZfCin9M;cq!hkJ{ThRxkx8!r3o>N@Y+-dB6#tXd}!%xF?0T;v^wrn^FVWa*C zf?q{p(~=T5!5ox9A_JZ7$+itB>A>OlC@~qq>!pG+5E2)qRW*K_Cvpm5|M&^3msNT* z{J(`oGdTZx7ZWA zUuq34Ee6yY<py`n1F~ z1f^Q(*+y9;_T#V!;w%(_aD=aJ>wON!D;fvF)gg~ZhM>o@1%-#v@v0`XZ@!P zTm%Ma*~eO>LGdund#7>)@b5X08VG7G41=u?tX$JW?!1Ev+Go4!_N_4~Kioc^vQ{02EDz9|sN z1qzSOG1sIFE~g0~6#3;sVb|~bVEIua*UWIDT#5au1I?&eKip&a;>V7!q2mHsId-su zl3dp?MO^gp-g)n2tIyUm@BHJ(*Jt%g{SC9bwehIXvX4X~NvCBAer6tlYllq5VU7+h) zK%n9Jd-xHQ7FsEW3pvpf4*f508zvk`w5aV-*Y^a1Mq@vYLVMyp?Sc3(lSwyhl!>Vq zJvr6iaEsa=|JRS<>Brk%9GA}YyfHErVb8MUUaR1d3VPzyr~z}&*2)$)2EJqC2Y{Cp zN23BUZxIf_hw#*E{CBhfSwY~e@0LuR?&iCuL#t3{nw%nnA7Pf7#|8pheu>Q{QQ6aM z8QgNF*LygzJQfB3qhtsw)|6-)=S; z`V|2{Pm-28hgO>z)mW z6JFND84X0q@h-X#mP${kikCLW<9zVq3DZS@M6EW((~J$~nEulS%I5uN^;mILNtpOx z4LHo~*fc4u*yQ<0dyM2K$FGtk#^n+l5Aw1#X4ysCd%mx$*uF{|Y0|zv=oz>TIYqX> zs}6MvlJ>f#^(1B-)m58T9;|xT=OxBSNht2u!vb=35v#gI)O!10>)k4^QH*lZDB2AG zs1&M1NZ5f4L5d{l*h9};l8HSaTAZX}g1wFk9h;PUihQHe$+)PCZ=l-b$yrsfhp}HN zlx~Wj#m;qD?K1immS|+GEE0V3usOjg*buJE{stT`_zYk!=A)(7hD^y2PL$2dx1it8DtZt2zXI25%|}K{ll6N!T^R zhdUp&cYUwnh`F_ri%YVr;Pe}_=9GzZ!%HX`T*`xZvGSARO&K_|#tFZj;ci=I0 zB`!`@oAvVE4Kiyr)Z_buh$3(VwwYDnb4i21nSl&MNHKC=KDZ0G?hPprX__O6X5-&k9u*gvx8yORkRm21@fbtQ?b*ag-=hwwpX{5c<9bVDnW-1luub zhAc{(WS-x_kP>PWTOT*>PQjyqEcec3_yem*;#kITRZsUavcI=6!=q=;u6#~#!{He- z82CJgkkk;q-`8ly_Q=Pji?dbbHx~pI%dsK~w~_y5#e zs^;gLWhOMN`OddhX^FTu{^3O)M_?8iW1ZE@h^-^G!xO;vbUjSzjcE%L zTGm#ugq1&&(X}&M)f6xg?czP#_99a8h?R-x^lSDx*c0pzYu(=y`G0sNJ9gTySHB8ViI>Yig0k zdLynh^VA{UfC=BQB<}e)ZGc<(c8N)0 zp=sCb#f)=9E@jT64Jb@>w8o|*>nt|Enb-<{+NzbDmC!Q=WK{y*c;LR58hKk)F)GUA zy`1GT#I33`NAyDBMPCw@9)JH;KcnLOO;SaDi`$#?)JV#$QP|oSW20uSidOe~swy|x zaJ#*Ef#QkD_KIPClPsx83c36GQO?mCpF{LkLo|mwz_c|qmaCIt1Z>3SXvXu)9+O3WS}vHOF~Ge=+6(4P(D zcx0QJCAZV6zp;nuxe7+Iv))n}Rk4}YVe)8$_)2~nCnXXwVqJAqB3KHSlCeKo!|m7y;g4IUIBRS+6)4mByQxii z<2?HU$kA44>9D%=Y%BhZmCeRkVcK%h&+#IeCrfyraxX2Vm+Do+>q(H^%NJfuPAkv- zcqP#}=M8_AXR=0s%<*AqM2xouMW~7lBD4MB$SEtukolSa~zYnr~L((;Aqus93@3O3%0B)6b^aA< zkI)4p!~;^N#3YPfH~?>sfdlc2GQ!C^L_#~iqW~Ps+QZuxvJH$nB`G5rK5bYYcoR4s zK(*>fNEi_WiuaCQP~^g6B4t!#LbrsA2x`t>(Pi;Q5M*d3?aVc11MwgogVszv_sGBz z)83~f+_>vC%XIp8rUiG-^md58#1orIG=yo}CSKWFe=hEjP)hT_wX>}z4Vpl z(|1xU@%LtN4EZZ{)z}nHCT%J)4Z7NIfIIXkZ^cVP&~UlYqUFcOCC!r9P}2M*NKMep zsnkQSps>YJqhyyS%o)V4X3Lao619L_vt^rPx5T%5q@(Jh)b!Q-G-8cv1QycyX2syA zTV439_xOjXun$|e+AA1F@M>gSL0hL)%#yVmQc2N0BRe7MWozTgq@(-ph9=)%0JoPV zNJh!9ue7AyCTn^IM_qKO-cd|IyOLzh2u|v`{{;uw&63xIu?|3gx*Q962i{O+-*SCB zITfw`IBmYok~Agr(DMq`jM81wWGHi%yRiPstOY^0X(yo%Oj*AqZ8kKP=80QwGhSE0 z9t$jJ$1PLbp#uW;tRe0~J|D~+5T)hPs?0GcphV(JkwA@n-hzMowtyNzk1K3`xI6?W z=OJEEtzdGCwP-uhz@W<-G`>y@un;glCyRRIw2#DE#lYv{_K>m0SiR1!p?0HvcBrBY zNZHcAifhPsSz8S@?RQZNKhp;Yr!_L;tC)06gP4*O{7QC8SHzhCSAw<#G|?UMcxdP% z%hg$kNEA-WiVCJ@&o1&=t2Ru@HSv zfGXA?+n0v7OPUK}H#!#sTB-gd)jM5sTgw;WawM^LURS2TMurCeyRN89d#@BtZEen9bKB8?kpz%wD zx8RTZb|M(wZ(k}mo;Tr-I#*F)QoEhn&W%*8;U%(^mF9R+-N=TypBA0YD*P60Lh!ke zU{h)`aHF~d&>|93in>0k&H;rh>+d3h0a>ORih1TuimDqo!$yOAtKdMxyfZq@8f8Q%4Z1wwkC%Vi zwYy4B);HIOv)W%jKT2^(+OUd_L2K8Hy57u0=`d6Pn()u;B!_;i1*t zb#eoBT7A3G8mXQ_dxL$%7oj3`7Aoyl$;(PnJx$I3e7(gaQ39o?`iCA9tbCkdb=RFhu|%I4S^ltQ8+9*qsev-j)Ixlxn)*wo)cNdEmuf(i|BT;BuOZF#hh2;>)S@4TWFMxEs~-G2-ed7J$#73KnU4f?*r7bh^V2fo56m? znyI2nwTO63VXl>hT zW@7sZk=1jHlZ28x~C#D?gfjY|o za@v*K_9&=kIG*H{BIc1`1CBT$WW7~fhLnDSTKZC;QtI_p1J;X*qYAbld0w3H{L>8n zoM{$zD7Y>0K)T+!OZ#Y(OH(y777V-7X>jhkcDtd2&PFLSw-=|w zmoJk~#x1(^JNnb9k58Mgox{G0hE34`aGltV_n#*o0{I;|=6IsP?R7qr^m93*q*wM} ztyPKPkTn`CLB|EX$QK7_JTX&nl2_G~G@PXpBYQo;We{}Dr+x|k+e?9d_T_&CN zH!~S6b+^#{!z85=7~U{5=Z6e;;3#s1A~ERXon^WRjJ1*KZDn#nRdeF=my7@R^aws!yU&UL?DwcnS4WPCzROm&4OF z8{+YyiE4QGLpARapA3vTG;=jFfHIUi{Ai$;7e@r5f%XCuA-wD4Ol87!BT&HXHz}F~ zP-d~|GH6trbD%WD-xCqr2KMYYCL5?8>LOCKrqp_-P`b!NED4m{2%y%wQdT(EQ>l(3 zbi>#SSqSD?1k7sgnn$O#`vPe)PUIAmd-A68`bvbo_Mtu)t1g3@hMyb+^#2Qky;yLF zwO3+B0pS!)5mZbSnPrz#LU#Kq3~6 z2^8zFibw7cZHUSQPuOpl8aM*z$8|f}A}b^VsH5Rwk1w$9TE-ISk>jx~^XizX5B(In z6w6Lp+6A`U?W14hAW$g)n-rN6@IJYmvnxjLR^he3E#&+(d+c!YA{Q(@d&)_EUPbM7 zrYl~%c)O@SD_y!pm8<1;Nr*QAIq#M$y0Sl`2yBGrMt>i9EzFy@ui7dWPc~gxEcV{< zfX~Fcj_j#94JTXyBGj8brJVtGM$Uw%`$E&B1x3 zQ9RDuSd8~UDB+hn&8y}t*Y14~`%D~E?c8rLE(n|Q01p>l0&p%!OxCjnIyTrk0`3jg zf-l1Gnj4)VjlLc%5ebPb(hW1N+C@ep^?K9-E&A|ZIcXty~@U4UIl zy97sc=w!xBknEV{0Mnb4J%f_XOlLxY7-1BuiG55lk$*g)(<`ZZs{lRp5%$>DWqd~p zz#;<(5$UJvqUD%afdMf8u(wahfXpeSC>7H$-9|UY5tv{J_dCZ4nG{*`+})_GB+?11 zE!)^n*4N;{;ZV+~|2S{nj6yl8o{zDN1HUk%p_j<}xGH6c0$K^L!w8)O{~ufL0A1O# z?GMMct&VNmw%xI9?bzO7$F^-d>7-*P-LcJ1(qGOw_uhBk`+sAsvDV&e&ze;=tM*zo zYvQ*edUWaY?jo~t#kiB5+f;Q_ptJl1eLQZ7_a>~^-YA=r9K`%9Dg!%gEW3)azA3kv9i`Cv5<*T6^(3ZUO|7Pev+~gFnG)D1x8f$kb1SLq zs+%5N8Y=L0CHAMXfA4Zr$r=ZB&LVbH*3s#Si-(Vol%+F+#4(%jB z*&a&VuoJB@!*!@r;V7HHZ-$Pxo=)gxOm5XiAqdm%?&~P|)M>8shSkWwdz6Q{Pey!= z-U#=ogx;7hJke%mg*Hq#8M#~umv#Uff(flak~~2*;GC0L+?{W2FVOwM{Pubguz=W= zr#VuG=hZ3oMF z*3HcG4?Bb!eiDEGf~?WxAVCFU>~N1vQQ{lDKoQD#w4C(-L&BMUAXcJRvWn z6(GkP@=9s#OoJm9eAbM_^U~8W63wOr$SFnbeSV@3^w@VzfV(xmW*@$;=YX|o&4GN4 zmSOOniV!f(i-efY5?Xf9w0K{V;!bMekOF%H*^1V$RBaBV(hrZalkHbkW^mC%)&u&H zHo$y(5@;FyGL;vTNJ@~Bof+XiWS@v_NI1I&0LNRJ-$U2SPfpsaxyDK^neTsYpH@aa zQL%>xK%$;b&uvtG`B1b6K2Ax(alv}Zf$-7onSFsh3fc@5#WV#0vjtM)!H zBMR6*4`m%BQV(ttW{P?D8jZy{b; zE44)JOg2B;rw(?FY&UixrV{sMILK|!d_l*35wpXadLfwEW?+K$FB2;u)poC8%u$-H zx%kcnrSd2BtB=3};zXpc8_wcwxV};Iric6`8odLxu+|bWWJMB)Rkdtoih`DDSClf# zt`Df)7eKAWvT~~XyCZ8x zgY3-t(t3|H%4?en?k-n*mBT#M*6_ZS{%%`cZQBPUIX{17w$kG7CG$;l?sn(-mSlXy z+{(vIu)1;J0%e2slw52u;iu|Ul*;6nXA%PCKu3u*W|R5;&6nw~sBvQ!yI#!C5u>&q zddqX(D2SAix{J73}5Xeot5--ddpp;J04=g|K4~( z_SE$H#L-gIh52BeU78ulP)&Rb8K17vIr&9Pd2POU(}T{UBs5 zIMIRzK*4=Y7;Wdx+kO32ZOy%*?2#9u~5Jn31L5z;cbhrtJhD+tWVD+4i98}5|pyFyhyKhwG2!#{E6Ii6+M^HJGCZun$ zL(i1{MVu7EpP5T0TP!GCrIIik=z3zx*&wrnXsf5&Q;0!6RR^StWi_Tbm8g}b+Z z$qqs;fuF5`osCN280-zb3T2jBvOPXv9q1qZ&PnjzMDa0X)#YHjm-IA11rpFDLBV?s z$O%9)JG)h1B$FH~-j18Q1sm_<4B$oj(kANqTth)>Cq~`qh4JO^XMPn2?#xe3_Wowy zfZFU55ttYRm)uE~U=`9y1w$LXZWy(6P6wY=PxpdlzM$dR2(!d@`u=w#<_ z#5UhE5KpJ#^klIsAE~VOKMRnE*#M`Fkpg<+Emjxm8D3OOa=Bh&^ZXf-(s^WHOCKR6 zWZ(s~zbdvVbCmo@Ymmpgv+}q1@5hf#nrD#Z1j8x_ITT4R_%SvHlwtIW{1(2%@vgp5 zGj+Xv`sK+a+%^+2#yd|-petIAM_P3EJ!G`f$BYb&Sn1eI+tcZLlTbCN-T=d_jOEj@ ztQE)fD+k83sjNC|?5UTox+6!2!x&W0R`p%uu_ens?jXA85$X(lANwi~{hZ6U#AUTb zRLL+en#98|{UQTk3hfyDk}~192oGT&V<%bP%!G; ziU1J<@l35;{CdtHo#6&RUI0_3)%**YuTX`T zUD3W;Mw_}-mV@OX(Dq7@-c+j8W)S_NEOhG!xNnEJR#^Gwr@CbVbF8lvm~b8v-xI&c z7=Vhb$k3dk|4QWyq6MG+>GHd`qtN~6T^GY$EzTWw1f~(9R{e|3Qah>SVxT7-2bwPjKt%TNS-R?a$ z_I92mCSeLf}cod6HC`{6=Dh7j}@((`%oFRyI9*wia|QR;y67EaYakgyRRQPkcY z+YfG3VRn?^!%9!HRsnM3kFkl=hGAvK0(y zKWFqxfElcM0xQl}V0SFMHK=Th!3+sQiSQ2AGU@A@wGaWVW|8Gpe_@u4=qvM9b{nU- z=%y)uP5M-amfRwf98Bjz1|6=K)RTpADD!hLlt5iMPSQW$Sg6!7<0WSz7CcsN#b6V5H2g0`=z6(u=*!$%rv9g$a1z@7UHA)rv+BlMOnx_>Ca| z=l@dog}W9Ln+RxFGmZu-s4%jwE`h8*A7ztgb3<98_H9#amM`uvW$28>6sKEF3$w*` z6|e$@%P26SA(+;bjD~P&%QymZUVDN!sus~$PbX9;btD-_lZ05cWR6nAeO(TUQyDtZ z8C9*Y1#H7$w^$J$b;U?cmzdS9+cAS0)GQ5PSssMCZOBshk&*6dTmRufNUR&ZBT~Kg zzMQ-}35&M581%zuxERq5O`yG*!J&G2ACRLzm&+A1vWE~p=yGK>ZN=Rwe21tZ-<69` z%e{$JYZt2pvNr={6Z8l^`dC8WcUS2Q@$gi{C9F`&8n|EULY(ipSVdsu2*g!d0?`_s zGq|iiJ;At;7GxuHdKtRinmVgmddsW&DH0@;#}~7ua7n2&YHD>Li`eoy$c~7!2@rV` zR6sCg4HHCbhAfrzk``_b>(z}Wt4ro(`kG(ZSsw-qZjXY&fB+Kv2Pe|>o z%1^E8%$_*$vK?>#y?SeBJdE3j?x7Bo#}OlBtbPS?IgMw%dentEe5t;DP^Pw@c`q#@ zq~HEMi2(c|vQo4fXmsCW#3A8}0ti0ouj=IQKgS9|W=*Y|CQyo z_FY!xAi||4y8&NvKFoaE?wm4ow?6avH`H`#AE0{Lq9RLIbLV?}7$R>WRJ}z6*^IaT zOn=Ye{^8co;ZBe+#*J|J`9Ub0^DIrY+s4)?f6zNIRj~qMW1nCK?Z_A}Hh?`Nu_~iw zXt1M1*jU@gxz18kcV=IAw^xX!k&(WCmz_nG(_*FWuON3`<^IZd=cLEJPax5>cs`P1 zF_l0lu`IEQVqJQu^suCEX$Rj~QzMF}I=F@I#I@4sMi7ML2hxLsm-cV@)FBQ~uUF5M zQ~JeM!!wslUJNf=?sxA3OaS7!M!{hj!%sJ_wq>sF29k^WGT+F}P|3^*ucfc$gGduTxZvH##`hV*V*Pl?ppCLG(pfjWY z0i9t;?)=_sSGw0~ZOOW}%CK$`9h_vP7f0WbOtA77=*-Jspfg@c;xxF;5@6(s)VKP* zcm7A$T>D>x`Cm*wN`GfYv^MQnhzm#@Ds@WLEjNwWlM`2SvGru+M;20l0d&2*uINZN%<^}*<;(=*G({FXSRd;5dh{85Ja0$s%>FptY&K!iLeKlP zYUTw@I{&~HRIHuWf?eCGp_AnLzQWltIV)AAzr@I3o*k;cL9X6M2eT<~#nTrYzrq2#eV>YU? z9+tY!Zg@iYh~kHYzql<#;|WwkPz3V!@hL369A>9)M9I+i6Cvj6k`DyPXvDWVMoiN}hx<1{KcWjq@czq;k!dT>QqCj#z&ItUSP{=#8jqbpmj*{P zl}cHAJ9^;K#LfO0S5q`Y8`7X!G#kNe#Z~7sU{}-4&H|vp#L~+1?Z}*&ds2Mr4$K4?MOkwff&ibJ z<^V&r#(uAed4Y}<9XJa``K=K;k;!xvBAjL}YRZC8dEl20EnYd0a!s&FKO%7uNzrTtKC?j44qp*19Hl#Wr_;)ipZx%B zSgTnnOVD3M)R#_k+9jX)z1c$Lkgv1NX4t_&3E*+?clxo@v*a$cW&Fj@)k+F)nm?c0E1iz&i`oDbu){7V zL;F&P#thK1#J&?s7-}bvISC%=<}V$;NX%t)Qo*LRoBoHvCKlC@o&XJkTMlu9%h!B#Vv9rKFnzu+`Z;` z%36G)1W$-9Nm6)IMTevna6(fz_j^*jX&w;ZNzWGbx^8QYLHW~%!gZMl^hoTgAn z76~rMYSzwTf2?EuE>5>Xm#wIH(C?MOac>o=Wty1lAO?+FAI4k~9*9`z-Pp+)08YkuF?R?s&I!7$70p zpA?>60+@Y|cf+Qu71)&!pl*;Nl8#&-y9YeKTS5^V4reb|qTyX2DZ}^SNnPt6&S#`4 zpO5qi=OB4V7Zuzz&*@AAX1l;#`43D*ROCRoU?S5$cKngyd+`9&&J-if%9&el_twXS z^iJ6XWG!pXqQIG<{E;li#K=L)KSB29tE{v<_b|00D}EANh=OHrMHAI3YMiD0kz!$n zbP(-^H84l;#HL9{zegq%>njA9&BE%@lGyHd2%~od=I&7Nl&hHX6ZU_4AdA5k{2&h( zDbpjL4|@*?AoT_GXFE<+THj$*gmOs*ChwDZd(cc()mILrA|xSj?79yYWWdWxrKVr$ z#dXWZq)Zelf1#1o9Tg7w#VjMKo-BrUIA=he3wFqQO?UAI#T+qLOxNQ2p#Qb}7M#q1 z_Lv$|jrJdvqPJ3SA!-erOIh34okHw4D5mT+va~KTV8K5egp;^!OcynwbGUvzJP~S( z3#4AOc#EtHm+0Pyic(a{!-WlJaN>D z*{+;60HVTxT{pK43aXf1hnd{ci@{?)fwbS^SW^7OMnOwYIFG@`WbcKcy^tiI5mj&Q z8nlc7p+Sg}EP34B-(UPmOV=^M@t=nDRxD+V-yi{lM{%tTwe0^B=J3 z$cxAyglFr?A@V;RJQD+=H74OjaKD+9)yC7Q0F>|zt$v$w_8-p9e{*IogTPCY)y<>I z8p(B6JEmv7X%9S^XOrjb5QXi`VS=iR%U24h|Q*-MJ7j z05}6HHWHjK4k*BxHSz5g!npMjtq^8lJ%+_Bk-lW~s_MHawNT(5WUs+$W5J2Ai*%=N zL7ThAPq7F3QEQg2-_28ZmXAz@v!%`GGxS3aIaP)-9TN#7@hWP1xqh9 z$Uy!k0k6ki=rB6dlHiYqFb54rkx?jc4Ct;cN~mynxMfAZ!)`*U6rG)NnSTm4FrZJMAQZNd%s^yg3uCyyS5{SUAb9R-fZb{5!g^b#b$d51Ng>< zK-rP(<6Dvk?fig+?D=(9QeE%`kC0;SiJR0?q~p$r41*234^t=XSCIV^{sbRlb!9urLhlY8eMb-Ax-Db$b>I5l-*fH|9nIJtW%>DqZGVECmX6$LReSmAnP-+$ z9YrL$M>%(OdzUe>_z@^NGB0bb0E`N>PVFO4oIb&Jw5o2BYRzuR&lQ4SD#2}2HQFnV zZo$N(vA0`d04Z;Re^Sech3iuSA$wiXBzl?ShQx;nYfTP~Ou!i%Jy0$njqMjuZeXvC zH6`m`J~ygxf`V{NVvY`O<_>PIBrJbLVz(7FH9jem_H3m5RlnFOflLJ8ck zMSxOeWr1U50oFQ;fU*Ad3o$Up85N9;<=;eLY#jgk$Og&A1INbm7b&pY1rhk>jPVyO z5YH6};@>=g_O4{W5?50&PUe3z0Di(RpsM~|^e-VX{ZEC2e~b99dG)Cr{{Kb%o&;c@m;696V4f!d3>VXkS6R z&G`>C=U>!K)d7p3pB)SeB>X(*1sVfwo#BCSLC0uZf6s`|f9=0Umx~LCGsxb=9UKn* z@6HZKjeu$bBcp9V9f0T2tl-uT=0JiNJs?}9C>qz_v*W*tbN^Kwz{SDMEhzXe_1-Hx z$IDw^ZKd-up48V-&lVF;p`UVn*~XTzN~6ks7?IWg^`XYJ$zq>zN_uebS8d6&mlAGzKFBGyFZT@F>ZM> zZi4R^vymBq#Nx0^XO;-lwWBs%Y$P^Yv^!c)c-A*ke6<^#9~fZrKZ9wIG@1?(cvxu` zJ`FlwPuT~9hIBfn%FKGxyJq#^vAUah7zG7b$msdK9~&v;(r1wr^WKlf?N$Ez&Zs)MpyM0U{tl(Qfx=M!VDj{BD5a^^bb3E>?cY10H zE11Fcrv~Jm4;tGB879W2u?hQTbatZPy%l-^;=Uxb4RtMc^ZZ?IY>sHnnrq*&;BQ53_RCNvE> zt0LWU=j3VVU6Gif_%}oiS=ut^q?)K;qS8*VmV-e~q!y@T!IYHfOenTdIKL=N2w74i zzZg<-qAWz741*3P&7ncVQjsNkg~5 zgM$gCDx(jRZ)5jdrRjX%-C|u`+~)b>y3t-IVRoX3IflF?-(xq}JZITw-jqaQ^F_un z0pC$y;V%a3vdj3mc!b=4c6A>#PL8Zl3`(5bnk`T2$TT%tV19pnTyn27#P~s`^#k`t z^ajl;n->f2e6B4a)AT6Td*eAsQp5RKz|6Q7eqP$mO}_!Yr(zst4vu1OM-s9)l|2<_ z3Ql$;#EBJIccK@P;-(aW1Up#Vy0tAn4bV?!!;g-2M+%8g8i(htmdS5y`FzBk7c07= z;&6a~<3RBqi(8Tp48K^M*ju8o4;0kE?-7d?rM^&<2nP@`ghCDJ)^@<7Cl9d zxQJrYF4rl2#1C-%$Wdj9GnHjCV=a0h=i)3f`*2QZwgk;fjfe!C3masfxj&yafIF46 zQ2r{0S^;B*9z@-uVTIvEq*^20SzPhG2RxQq1~3scjx}nGj2Y*ESx~0%7*fL{No${ z6bG?V6L+HAeRvy)&5Bc-E4vnAXsUt0X0A$_Qqo>C%NJ#94QG4Ii+fjtmX^B=HaBhF zSk6dgeAxFNT5rSy`JHN#d;&d*n<(8IxLzeh0?7oaMA<#yb041>HE|w!0m3vTb>Eq) z=a7#f6@|oVZ#u77E$f$`uE7Z7ib_6>A{;K?dc)0)TnmzThNalj8HLH%&rbM{VF&@w zh|vYcH=f6s&K3lK`(I%9v}E9Ij@)><8(FmR_>=93f~9@L-7Zr1MnQpXxz1z!tH#4J z=>oYG*G`eCx+hEf$^0Cr+Z+NmYXelm#G#zIXoL24*00edlfwA12N`49AO;Fe@c zpzGo%+cT58$uTz_Rz+#JtPGu~cs^=Qg7Q6Y=Kc?vu(1c=(@Z@C@`9H*1JBn@#&Arj z>SY$x^TJq(xaN=_m;n;d{WkTqK5a*7Tck0d-^7c=lp`$$K*oPt1Fje33hyTsYBx+Z zK@0G&>xoYv`7z%)0+HA^Z!qSaF2f2Ii+T!|scp0EsbX-VgIFpxElw%MeitzxOvsnb zgJBFse3NwvF;uDUk{l{Y0g^X1NxDx%_C6!J1-kxh{)BM3Kuy`lB_}FagsNM-mRG7^ z4q-imzd1Sa0G;+#ML?^=0Ed7ObuVYJDrHm2`?lxTxzMQ$wU>AP(Mg|xo5DJvV9OYi+{osZ@<6E%I(L) zdYxaZ60>`{etg7E`9TZqjwOM*f}#I7nyLh zhQ;d9@c160;xK@aVM@`4&pO$RZJi<7Ld3VFZM9rZPgYeet_F9kYb#-@S1ItzNq^Ep z=%y`YbT8`_o8$-<@fa;9#ypI-8}}i$rjZYo9=@S zbUjWye82;H_CueYH++e&Qi*=uz{{dV(K7yld1n`UY?y1stlPnD^3#o|s7A}+_v&(I zepkraUIBFU8?5e$*|56XlwwLfU>TH6J}WhRa!fLOGDy$zmSvOFS<)={@K6$=HKq)S zE)E9fQ5Q$|Z=FVJa0VI*g^?F1KQbyKcy)RkYf zW-a+5t1I)&UIjcZ)`)Zzw}yvLhKh9LnQKBWV{f}xe(EWTf{ULn;L8ig0<<=cZrJf4@TCS$#Ey$%g0!anhA?ghmXZ9x|7k2=nuywNpW4QPbsVV{wnc zas0?iq>O2ijI;VPnGva7!74Q)nq0Pm*K!|mOyAM?GB={O)goqJC@&`~Dya#F5tRKpB9lTDP+5{RxtAaKqO7F6Mr+&16t>Qbp?tQ9r-jmuB+@ap({W7lGMa$m{^R z3E9)5h_#z(stklEZ?4o|@>3_vfS);S>}EB_3YLwj7?RdY zs*62c{-z${*iTcgWvq8qGIcB#(xV%KBXzB;b60R0#)fcKDEv-nBx>rsV<3GJ z6Aw2Z=sF2CJQo2b_Ki}@jxg&c-;DKpE9k(^AK0FuNVu>}>(hVvIb`q0rFQkfj@z#ocb>K^}t zS`9Pm_W4|0IAW~jDdvvmy(GwiyW@%}9jfdn4E+e>v8tg8BPSHi1WPWU*9u;jG%$kZ z{oMr14F7ac{}Z}BTw%7O+AkNCkkiH>Xt1zLYN$uue@Vy?U+3wkW+FL6qr7{yB6y1N zU=rd6HSuT0wuuC3q&To+q^GS;LqoSJVJk6u^=cvimB}Cmwp|fAT*UdwBIr4~Ijw6P z#Rd*`oecz0I$g@5Z!IGL8xm+Z30ae7$r|Zd`6))!ahpcjmY3wTY#05unv$>?AA+tg ztZYjNlWclOei7R!Bxp79u$l+rhp^^OwW-k>SSjD&RczfJIO{VdHvxWJy@t$h?ZD?_gLK zu+v;`++d`<$ypyR`6d-Z^5o^{Emu}vFuJ_zmz4WDCI>)EVe3~n0sl=GqXrU%Hi}3c z!g8J17y3rOQpj%n?vpkDeIljSf~TTCdpcdi8t{o^hA~YnG(h*IAhTlz|0#>)a$RWZ z;_z*n^&%9If`6Hkvdz#heF;7j>&h14jof*?aJPUxi3xujDlI-}bI6d3`7VA?fbErP z_G8R^nGOmsTG|XB0ROu^T^nt$aes5%+6!!! z!vmM9`YkO#8uDJYPHC6@*y(gTq=^dIE5@0T?m~xNJDy(q3TfIcIrgRAiH3Zi>YHkX zGg4e{>F7&rXvDJIcz|-+mTw@@&by;ZmPCU|m~)k}jr3k!31)&kJ!fTtu^nA8FV8fe z6Q&Tr_|wPJpr4SyCb}naJ7=M?M|5b)?9p9A&BRvzXn>Y@7aFNJLYx35-V?IQn!K|K zOm%0c4<^c#>>j0esEyz5suO`RWW9a<0G(`m;!TRGjBq2yJ#l{!5MT4_3o<)=R&ak< zP0Va(OvF|%?<>V)V1N^rLm=26qTj=Jg{v2UqSPFC5W+)d7^nrlqVKP5^bp4q^-2vK zOH_0!-!ifZh=?*S5s`xXC+o3x2FCM1_k%6tgoyY=p6>H11)-0RG;dloz1oxR;5jk1 zR_T3kyP{)S4=+zuHS9{t`3uA~g8WU)%@r(_-wnC)p8Fx3MU6c&91weWPubjniw?>F z8iTdgjz!rTPFjXtK}5&FibdBl?In06Pv-z1C^l{1gpx;g3JN0?4M>l@I zp`=o-;3rFk z0b6Oft$=rxVZFm`c4gDn$6O5T{<622IKmKyhxrVbB!*2inD{v&=bzA?&_;hm?z{P? zxu-h#;GTA;C+lx}rtyH6rg%`weUNzuJy%Zi+aY9LLGw66m{DuFxPxAr#di--=X}Q> zh38_wZm8)izS%ty5ae6Ywe*nyHVQ{}swzxFW-xm`bzAIKiP$%q8r!sagAgOQvehmy zzPsv}yK~&>VHNx=%e@Gkg=o_a6=r%2;j+%AvVpdIp(eTlnqo)ucQS%hN?32EuIE0m ztdjNo(IETW@+6Atrl+Fs_{LbB(;;-@Hz0?weLqwe;meSTb&u11KDU7YycsC9hWX|K zjE26?nR`Q)S8?CnUSYUGY3VwONXDiW!7B8>=$=mizY@~0q#VZt)q4~QB&n>&=~UW# zH!mE`eYJxX66E1wY~?L!=;-XMpy}Yn@(duJH>mn6o|!5EY9dGe8Oyd+>L*3 zfscUh=Xu?1sHGcAkQw9^XHYSRJ^1Yu5t-?WN0b z=#EuU*pif0f~i6QUeCRVD)f>{bSGp_ZiExSdrdSqg{ZI#Oik{>k&=|Jpm`W*oUkWi+|d)3Xabr9N)#2lM* zcgFTS3woJ>t%qZV<|1yYz}78Nga>D*79nl=3*1A(5u~=ikMl#^$5s)$U3RDoeQTP^ zj%$IYfarbgNWW}uR7q>dJ<+vqPcxzXF~b`rcCJ2__059j_u^Z2e|BG-OO=IiNvazg zZH)WTnqG)LAjDC!d>&J(A+hmT?tWFG1#1d9atxh1CtbgnFFlvq+>~jJ$FytBo+vHx z$c0XW1j%fFn9gLb+qo8mA#g{0d#V;nle9iPQx6fczmUoNs>%-S6yq}PHC<%uIlo_a zP~4*ZB5A}0tt*8EA1TT>^3DvSv!U;tL#{COe#ufB;MT)_o*!6HzG_xkby9Z>axd)8 ztr?0VdseIJQ{S0uSHd6It?wHb4yo=6uswhkHY$%bqLBQW;*rN|*@xGMVOfHPpaLmN zcZ@n{4A<*)Ki~P@3;VlA`~;f}uUnWTa#p`3rdR0zr<(#**6|UkW&efHribT?a4Z~6 zja2C-03EwTNI!4rdW;qe>fG(S6>TaBQE|ndhO-s#t7ag?byxOeH<^7ebCs+;IF_=W znqOMj0Am5;adgxAN^=d?v?Sp%qJ^xY`Q`Atp}Wq{Oux5iP0^em+6!G+qIEYOSQQe} zc@bt!$oG0B4*u?mhAjmjmqy{KV64ctP(7BY#fpe2Lp7ggknlDSvhM`A;b7 zojb-zC>oJ|uUuTM`R*vNi6p~qzCX(J1(oWD+)m{D&hE}b1tK`n{rCR(5VH}O zf?G>5E00WaE@RR(4WYfcaqEvXUzRXrLfP3hhn&}k0dsCdVQjow zLoli$+~W~*M>1^ohwr}=xjn19uf$ZCbpcWBO+WZx*}GxJo=F(EWdkN? z`Kc6TDUhm&TzK+C8L_{c1V6JxMX5BnM=3Bow9GKTKCqaC5`2vPxsI^$9j#M_?udVu zlbDq+yXY(8c}rOT%@ibepLu=RU%#IMlcZ*7)>1rWHh%^$q4+Z#Okl1H1GBQJ=$B}Z z=*ZTzSg+cf5pab=ATPTEp=>koI~Rak9-b{ksCH-ISZ4qH`VIMfCLpx<6#6TqzZ z%(W43G)k9?bOno`BpV-DndX)Sw{`%B0D=QDQ;UU*9j-M*+-S!A5(=;M>$UZV5GBif z{@LxdH;4k%acXT_U-kyJavm#&hAN}BD@QHchvB@!f&VqzbIrZ;(7`C(Ob);^{6vT< z2vn(k%L@L_cEw?5?Lb1`@iT1y1V}I1>t5Gvuo9*E?`B$7h`e@=P%ek^Er&IbZHPMa z+V~yxK0aQzy8sWg=3<9w{jrx@P;8_)g`<^%dVpc*S9iK{n4Zn(td53*l-?y1>jj}c zZL`DXfg<x5FMjmcvQRxgd@`)ft|H)xxu&dAKQm}`Kao&r-Sx4 zCDlVUjcF_Qzd5S)`h*6A*$|M86k& zE(rUW1Bv-}TZ=N^#Bn%1P{Sw$3)bDuS^aU|XAe>sWh-JA8v;eHsC%gCV)QPLfuu0SPFd(XHmH_=QSdZjd=LcukbEL@MkncWTqh3Ie8UBFu*DyJm?$b+O z{bzXHu^r9a`9fdep_Y_OSDCHRNncLAo`4kpWubD14h=;;YIXo3LEPf60DHQUjpW?+ zFYn>StSWtBl6us8=a-#ZViBe5ixT-abIUq=~E*0 zPR`Q9Y}HNk@-nq%k5AnksoU|&UQXb z{McZ#q6kY^Td;VBMr>1k-AHxkvg4y&ICE>WZV#Ib5tjzg`5=Ki;PrLv!w3anxIq6l zYex}0G=kt*|5jZ!u|;G|_ntde8|Q3Yx~{BZSF%Vx60c0Dgm|UY@xH6#zaw)K)!X^i z2_3;4VYH=KQ%)9Xt=_ZOy|DJI`p(kf2rf5){#kp~Kv1eId<{Mhn#6ba$?n zS;xyHm>UX!Y%e$X`#Ah#C2oZ$7P@;viT_(|BxnUmi?B_=Q|K^8sPF7*GdSO@B>brl zt*ovvX1y(KQ!hffIx%!e{*Qp$*So+$@0AQ>Cvd>q&rZ~HpG>QafxM}6WU?PKH}BmB z^@KGA*#SgBwz)}Gzc~aaNxve!eJ$MgV8JGGCUMOIzV$)9s|AagM09oOU*MXO~qAOXb#PU$0jhN zNJC_hiFT~HT_yeAyp|xZK{k^RUh|Ofoa#iF)D?Dj#<>w(*7FA6>N;Y7uR;luY5bNGB`n=@DT(R;R132iC`%X{mN1QkhFc%$yTA`(}Lr zf8V&Y6Fwrgl;}D2q%yhg?y(xnjDK9&%l!%4`C!|~_DEOkWz&)1(PGwr9`k)FuzpUwxS{h zpCittY?=o7RBRG>`}v@#z+L2>jQ=L%t@gM`KN+DbJ5!pbg0<*kgLEKVlYgi}SMjn) zd-}zO!(4_(6`q=EGL*Gsy4*P>15c?(N~Yqe0(DV(G8|7Lu5?*VG9`3fIIe(GmB3s+ zu0(thE?ICgFrd|+;C?%xrjENOC0Z)&G9}M_t@`Tr`D6GQ`9Q z%XG%OsSgkGW&DlRo|Ng#r~_`-%04=}5fB1M3#=-ISEy3R%V6NLC9>qGHQB7X!5@2y z|D))|BI*^S4lu3^4xvq|$I*19wWBpulqxA68KYUS@vhIemBUEIq=CaF7T3Lts&ktkx++0*uhW+SqM>)zm7 zC`a~#6RRwot@DAbv((JkALqRAis2%gA@!cOfT4lNR;LCsI8PR$$0-(^FA^i&N}*Oh zY0Aq^SRc23k2#L&r-m16H5!*S0|{NB7r*$C9W3G_H(K3j#V?2+l-Q-P{*ds@UC5^T zbg!ITDS!_h8ng*oHJDN=DuUY3S9e<2DMx1c5%05-Lg2?y&gGaESB}AEzZ``7-u4&E znO*}I_ezZPV>>~)ss<|PT;_z6&fTNS(@tyD1gc*)NWouO|G&b%I;^Uu>swOkPDMII z;v}3yN=is~H%K=E0!NWf>FyFxT3R}!k&qS%X^@hR?{Giw_uh~2UDr4NoO7+c)~w&G ziM{vincs{CCxfU>w0i70l|HxX4Co4aCCK({@3Eg~G1q4WTq`|nNoZ5XPm$y4CKlL0 zOcWa8b~QJmGE%}%q4B#^`m?13Hu-Yblb*e##SPp(o({js=4ppxsfi%(w+XV|qv@~_ zO^l4^b&`?wguIkfyiY$WwS)z`r{H&Q?`<=|Yfd~_$6!kP#NM@3?qLx__D@hPDb--U zF-*}9ifyNlT|ephKYBmvW{?ryWF#9!g0SxVxo7D292K#>|6_DD_x@3wY9?_t$7dKl zr?ZA<{n*?$i*Bb5_>$ebY$#nI%lQRC%x`KX%a!(^dWo3iE zcVL&Qww|-EsoJVjsrf!>-Ib00Xt7J*x=SjEi$GL!_oc)OjMn{>pLlZLiOYlUAp>H4 z)OxyRUX+9Ki#uk!doUGl#uaJgDROyyk1YEh=BC(eF~2P53Rii?)k1VSZBv8uK}I8f z<40=kpyRKU>Lll})aTi`lcWZQKbwBCG=-d(F_Yv;6^_B^G0@(FPxR-t_hig>!!)dF zb9mhI7TXRLtJ5%-QVm)G6fEW2FYpmBlF9a*`1L4eP6G3#`hu~kvweR zH>aJ{KNdWOlvm;0*s>m^C#Xhz1q&jBPl?^c?Ej1E_&a-|0auvE;U}cRLyd^RD z+VP_))a$`-2eK!<=-U|T(=ksW#|W8Zu_hQT!tzn$!FK04=eNLj)~A{E12Wxh9-T>b z6(gEvGH`a2$aMQ!kImU?IrRPV{i=PGuZRJuE|Q!j5)~DaiXQ3nYCASpTHeksBu_K@ zvLVMj;Y`^9E&mMo$ZSh?GDVeMOzGqC24{TeBYYa#OcHCdF{@sc%m$I_PDbm(fUqibA4cnI5mXr2%{NU-iK69StS;8^IxX9(rBiAi*tkx#-puZ0XDjz zLKS?)37u!|8hA2`saBOI0&*D`RPKKn%wsP2UfX~OD1Ed_GAZiS z0Pv?`Dz9|swRQcr^sunwiv7$<;T$fwH>-f^X`o10wyE`6)`Bzfhu5Hdd^_9jXF z0MZrmGYP1P6|l(Y+1)?9_mWj^tXL=Y#S%fL&c&~J?la#2g)`jFcNW;zVYE?xf@bCd9|_?AJ%wE^M}(i+Zd3?c zC6Q7e53$K;c{EL%?$U%OP<|H^!@KY5;;AEF56Ra&O6x+sBt6qw^lW@f{Q;^)49JtP%ssK>D*2^u zfJq18Xy=-!q1^SuX$)&U{Dg1zC+g_J&tUhRTXj=QDfZ~=pG8Yrk>>9?WJ)vUH5(HK zop8(%JO-eWS4A)HKu8&QHe>fNtPh-~S z!*JxENsv37dc7MnQDfOd)m9nvb!1SF zceo~Y3P!|%{ow}}dPA=vFHB43+SN*<+3?MA&ehX*&|hleTrw)L((6f6mX;%~P4ZE0 zLEiKE=YQ;L5S~5=7e)s?`V0zA1#a40%V2-?laXL9yy_s{F<%s{5njX2w-}A2$KKUp z-{IMH*r+LK5{1SrB{VWP!-udzzFkK#d=Zm1fU;KyN+Lhn?Onfws5wBr{KUV^N z%0^I5*1Nbr;v%tVCsg}VD@)keg1>fV*DmxdPO}{n>2Pc#NVYwq!kmI4Q>h~2By5at zjl~m!#z;L$Ykz&H(5Iu>u@r`oeQ#f5LumG(2M}EMddhjc*K7ypq`98}UGDe{y4+Ou z=n4@!Gr3R~IV|{?&jgd@`Wk{3upg~skaKXZpl@0p)bq+wuaYmJ^W)0Zr2BR_?j`J? zCr59-EV{>cN=p({UY%iJCa}=($9=(kM~i@pVQZU{W9uuS!I0;`M$zxkaWt#*HD>OPn%b$MO$?YrTl>H7RXj_p)r^}R>hKN!IF zKd$9+>AK&)Xi`bqDb}~vBY!>gsAHUfj>k89$8~yPyD5N-d>uX1u=?T9cm4x~FO7rw z2B0lm}a^uW_ngsk}p z8%4Q&6~(KRW}y85iCNepdl3dI&sNsg<@V3=*4b5*{Qg@h?T}CN@KkQpI^xx4HlkSL zNRoycWg^#tlVdf42KA}UX@W((h~QyPIk)?JqnEiSvHC@@G+qfNYjHAW;}ho){G4cu zOWPLfFADkujodaG!Rg1N4v)VbVtSU9J-{O{F2$M85q8qti^^;N)2&=Pk@x)jN_`)} zd$q(-Po3mAw)y610242}?QGOCBjl)tXXEIozTkdrQ6dWOGA zcNK)V?dU`%;B0mpY<@~C(Q!1)B)L{GQ+*Ji&z@LtTHq1;I&iF`+mnD=53iO#EdJ2y zBg3f6=ar;zO*N%L?_qaJe5d+f7p-SvLAC;f7x2htpUjv>z;*)OpMfA-A;Nk@T(=+r z8uIZ&tU@1+^qbJtT<*# z(E;@zKbDmhDPrUJF*v@OPmFXWw0Kv^Un9YGMkl5XFqeu|1c zsZw7+z8DIK>S&=gcRGS`v&x1hCGPtrJ9!w{29x$@sW(0-y3(WLTOefBTH=?~&*-c^6Dp4;F{6ziGw zBdNl#15abp!C^y#;)Ox3I5vFV3m4_-y5V|?&vbi{A0FBZ8qM6>=0y}KjQXQ5BLRJQ z`^xj-HAgsm2udf6&N`0|Z#d=DSy+DeznFZ|NpSs{>1moNcob5|l=m_BLuR8?5htG! zZ6Qo%M(#o3E>03ciULidOWqu~4qBBNpc44~IR6dG*<(e3LI~~k*Q`FZ32OOq9;n)5 zu}>eKl4zI^?0vUm+69>5J*wn zx_?wd9z6!|^M_!JiUMez(8ubmYEuHMZG|*(UE@5j;2d2h z=M|HGHYHCI!ojMr@dJZ__SD{ZxpmNG_c-*aaOfP+8ozlr2D$BmFE1|z_F#p;)s?&` zOKb9Z#C$?W)=x?;DfQ)&LtN5s7B-b)KKUBGXe$AJRgL*njhN#1IWnqIERlmay)olC z=HU|wUNgETD#|2_%T#|Fa>KR8K_irw3~L6&Q-oyXh`2{@FQ$00c!;;EN_+H%(GdLt-S*dlt>u9-FOtR+k7S(GiGdjIOjy)w81Hb1hjp!HgbfL5Z%A$tR0BELtJCl5iVi85v_y ztu`a7QfxltQ;oRWat!S=)T%!@$HFtokCz1L{068wnT(y}4<@iRv3}{w1C=vT$F#mp zIW!`+SLRe|l*rhJxCS`}`-h&0+h~ppc)j<4a_``a zKH+6W?W->AglB=ABMdqvO=?fc;WLN~}e^zC0&l{>wvs@bzVw@vAKL$pWM_MFU6 z*C{hry*Y>4O%&*Lf_1w4>d6KI#a>so9=YWyrnLq3?+z+PG+rP$hPhP{g$FrzEg93; zijCa()Y&RR1p8-i;J>riuo#Lq+^S*;axQOYn>>jmq82Tm=y?6kQ#xf%Z8uc5m;IX87Wb9c88JYw75|jElSl%SHpo1!t zYLejny5^6;8A<)Z*&f)HTY}BPDI$BM#1vrkypXd>Y=%clujdcZuufWvcR`Iuo3Ay3V<$KluD(&7l_UcgvG|Qdx@o9e1bnX= z1tSwVrF^oa?Ly;p$6CwsJz)2Su9#drCif#PY#$(c6SLWR*}ofxhq)t{TRX(SRBp$cB-Map`hLSc_d{)daYvZ6>?XQ!|FB-IpfQ~$f~+`;y)M9nx4%> z2epv26FSUbv={S{{tC~NtJTN6^tLA|3}ND9MAYP%2@=hU0evyZDi-IabSCVAizC{e zI?6k`m8&n6N>P^_B`LBv6Bg+Nkp_JIwELzh3U}l6GRswVni4{!P;0uML)Hh4V2(#} zd}4)q)MGI)LX`BW#x==uU`nJrbTPTHi_}D4s~oFu!`gbIzkZ`%+s9k19!M0pw9EAS z7-4$kR%+>2Ad34rAX6n1E~qN>J7F$W#Gb7~qT-Qf!Jx4vyGGn$%y0dg^V*eE3U{H6 zGdJs_h$=pzEK4~xMSogb&EzL@v3h~lW`Rvsbxp^WUfV2j@MiinH(vQDgFNtrhITSf zkrnrJicWqkL5{`rR;q5eKJ)w+&V{990D_yr+xo4&jH|KX7?x~Gx%g{JFTW-nf1GTVT^(b+XPvLIr<^0yPHd8o3}~9+UqmXQ_S`~| zL(mNSIQSE4wq*FO6Dos-?sBGhjwgaabMcpxODDOuK|!TI`+Lqvyhe1NU34`6`g!J< zND_Hg25UCF&tEC(rv`;XESHb7?O*49%%MYlL2QUTvi#xG*#fm5Vpew{H_EK-?@nVV zEE^W)x>*;X<=x!1^7SceRjsoN-H&mW1NFW8%DVc+_1~&Kc@e~?@xN~@x<^5c2szoR zleIGL(=cSFlBaA2Ha0Sq+5Y-cGB{wH@FdS_&`IT;sLDmT&B8QiU{n1J_6TDjwhN~h zZEgc9Zmzyl5UMt6Lr383rrR!cOw)vH2#x-t`@Wd!tME8lyy;Q$iC-A)3uKCKj!ByP zN(ZpR@U*_RH(t(8q~Ul6cg&A0&SA>Q^~=Rs(kDU+b=~VB-_(#E>id{3wGZ~FlYX-qO+~T->`uD<7PMpc zO{l08V#VdV+zs&Vjky+<=fwz@N!izG0IVx zgIJy}MMJh037LjC)oCvEbkp^|*OX3-$BgRB!z&q{dRZE|s)KM@EoFc4SGBD|^JVuB z&7LD(2On9R8Z;-rY*v3iUOa^0oLg6z`YA_xXmRpkb2LMjujXJ&OFumwp7xofq-jun z-7F}~zhO2_B{Y9`Kh4TsCPO-FyQcNBhtcr${dIAa0IcYY=?)a%2KUEp@TH~^YO8Hw zxi8|m9f9P|gbTrk5!~(umX<A;@tMZOy3!zk>qaw8i}6k-y2~^_?rD>cSja}79Ik24oe{{1(=X`Jq0Yu#+dLJ8!l#NH$o5YYrVFq)v4kxyHU8L!6xi>}162lwyDYnc~`K3mgo<$h(g z^L07rcd-7Jv_-Ha<0UF z_A47Z+L*_P3F*>4o-Gb?K>4mDb-s=tg^Q`v$=$JqZO=+#W}&OmVD>Yq9x;`5U6l$C zE$u16NcYi^kh%K!5HXrsgZ4hoTnK+tlQO(Xpw4OCCgbOV7wvcxnmU7gm8DZipKDeC*WS!jXTeDY-84!_i@Ih3V(YgX@@($%5QOG2nzp`f~>f zNF~2wWqa3?bl$UQ=)PXiqctrdHC=hxRb0x=v6bo{QRlG?mIeJm+1p9`=hw80y6<6E zcx!qrd@b(T-oFv?f|_-ofy_jrIu*9pytM)<7@{G3*~ciT`>$ z2L3}LFgYkdNDTXjfa1Tdf&RIsJ#R*a0;_B}WJE=W^Fcu|t4E;!{GmB+VKRdOKs@Hg za84i?Y{Ur!nj3K<85IDWKr^6`nK{G^2r>m%qMU4?puv%*JEye&{1Tq=>cQaHH=6%R zbUaWfk`%<8?msdJ7|BaO_s=CdyZ@2#!g&Bl;)|Q~zcL7z=Z3!FZy68*0mbB=F(JTE z5R!r8?~73I4W-6kGAICY!xHkB48qF;L#~7QOU4U=+)$_dC4=w+;I{$rz(D^1MIbf* zMaqMGW4UF_gCwB1`VsE!|s9sLSg@|0z`Vgn<0`Ub`=#FC$6bQdtVq{$ZJHMOwLqM>b8G*l?fS@4Y?UI0yz3EQthaeSi*&>5*!`kzA zelXCT!3qolgAsqBL7G4yQ26Zz2LS_bxN-i<5NUj;ae<*=;9Y<`usbp^82CR`g81Lo zk2D6~aRP(fK@EZM-f$WH1qK3!KyOzG7zVjnCHS`<5ZNdGk|E=dY;MpyC5A!ogb)e@ zK>juc0FX@!bQ=s0vLLq`91je7r!63dBM<=b7aAlO1F1m+CIi|`5w{C_p{ZaA%+U5uPu+?~wKv3cQ0gxJi?5(<*o{|AhOwxIw3 delta 44980 zcmZUaV{j%=x20p-b~?6g+g8W6@y51o+crA3ZL^cSNyqa|&Al^Ib$^{x`|nv*d#`8h zlm89T9|+M14+@yo-geoZK=nV@lDD@{D@tX~#@%^Uuw^s1q})W!s@`1)zyT9Owbi!* z!N{og3z{A{0?5yUgy73as3yx!A-BWIzh2%gSNJ|aqROKt0kQ{1+(Z|4Po_hwjZ~hr zGK&k&Q)2X#zL|{_t}ss~a-~a$WPcylIPR@qC*)w9qpJUwY z+iBTS%cp&+Snf<6tlR=A^y6&HPeqJ|74(}zZ|){PyG0T!L+XZ8ax!9N?hABXAsFgk zjB0yc?WeH34>a>x5NzJhN1RrLIWvEokiQkCHIN(_`Jg#T;QbKoX^HiBRJRDsF?<8;|%A<6K(Qq2bIU2gf>gxL6 z>f}~UYG)yy*dJ48Hyt^z#1{7!M zqAg$N!rT1_x-Lf>RI7-w@7xcy>BKQABv|eAqU>`TxslDc+jEt2lG@MCw>N@H?Ny1$ zRpMOLi8Z7qvA$6kco^^cFP76!T+5r++n&T{_j~&YL2mL!I9kGg(KKv>G`*8gED@}3 zwgD>}W1ECq7;lmo8uYTMmeOV>P5bIBpDhzl)t{F)%b!fFNK)e>TL|X8un^zAt8@=F zL@>K+p|^OsWySQa31bPgRP>Xf9pk%DUhJ4 zE7mPO80fcFJI2L;T&OW=BQeb81j};}q%Y=BOHfq2mNVzcin*TGlZH z3FTj|TVOM6K}Tp|-Y>TfdXZKbhzPjRgadKd2N{?R?Pd8gbBRycBELd-Y9+S>jsRax zCpJy-=>77e%-G5x1NeH!kJ1KB&nxWhxQ@&V7NzeFe75&|1tK}E{o{%}NKs~!G0`AygY&{)Q6Gk6@3t^L<;votV)lZfC;Xbp*xMbmJtGuNOCBPV>B%ndC6 z#=k)={cwNgMk2&-#L<4#J&DuvRsqs(OkoG5?lACUA|ebp-vJ3j6}QBytF95?1=wI1 zGO3A7lk4n^awt_#CY#1NWCkiNerD+T9=FNUsW(Te=GZTI%Dak!{x_RI%@@XH^QCLa zD7e4o_~7~63KAGkvLschyqS$3SJ+<;!IrED|0~>@YARBqc6%u{jHQ1%9Wlw^50^Ft#tl&# zH;c_`V8ohsh;r0CZ1!Lu6o4iUHrU?7>J*dw;ofZvnK^RQyb=punX}5I8#V&v@-UMD z{JTxX^&gpOG!h2pkebCV+DD8kmbTr>H*t|CyK2`5EJ&SV z#goAX(_qit>5$QNztX`DJpWOv3nvUP?s34lbj@|hgtD?s)RJdVa01+@mk$WM*rR*z z|G?Shg){G9g}62kSZxQNZ{OvHt}y!I-YB=-=mn8GcZ8`H%2BJfrSnZGzMS$hMSEr4 zEY?q)IyT>%ja*)fbWE(!XbA*B%D_-iZywX7o*MYdRnc&f#SX|oIZ>NW)hNH=JBnNx zc&nhGzDK9~VnkuOH32B03y6f4l=AHQ6=-FudNGVu_YTRp*{;ach}WvU-9VSVcy(Rm z6M!CruQp$NomXBq11o3OJ+ci9r(~NhlYeb-bHgMMoWl zoTcNH?-p^jw1Xh6XCqujM#{gx^tpySXz=&D-#3{ZARlmTpgrgH|B|7Z!3Zj9DPrAXd?197;QNp$v zjOq5>c7&`A5do~B8E`=fU0P!Dhah>4L)@OEmKYqVXlIY>`J{e}3v`Vkq*m)_NARWr z-KrG=lY$N`z1_RXMV@r1bd{{fP1y7l8;+E^p$e$GWu^0jmIyDD>3p(7jyG>0Nob`+ zFY22Da*~dfb=?IKmZ0L`q1<=BYr6Ac#H^34M)g2rkpTh&uT(X9FX=x+??`C7_76Y? zFvf00t)(G2CEs7y9N&rK^~kXom>h3E(H=N-{vx%zo{$%A13zDO@7Jfmh?*)QTE%rx zUVNeWDz5Ir7r|O!y<}aqFYt9TXZo7v{p}IRboP9vAkdD_*ShyNAnThm$7t?{Q> zA9;ZCJHH90_5X642{bw)*6oHy@qriRzDa;eE?=& z-))J_$x*PU=kbjEF08F8(rJ2RmJP-0I#gOq9rYsfrXBpQ|h6 z+x{WWQ3>-7PTSK`c#B(Y#r60KY?u2e){#M>m)qdXa@_MC#>x$|EO+#MptCD2lFld= zR)6979SVwC<@m;F0j0s7IY$Ku6Z(Nb@dHCKcQA8xb1^ruhx^aX@wW{eCkZpj|2|n+ zxViqj#>)I(MSgxJd2<>0~K2U?Mhn?b?^J4x5+Hf#T)^eVCT zDgkuisJ>VYqONxn!6OzFG9xeus6sd_F_R4tl07w!DH?a2R1v@f9%4VAWzN9pUj^l?G zh>((~#7ejSj^T75`KPnNk~sufcCYlMIZX@= zEc5a*;OpHzA;3I;I!o%O^~ca&iQmKX@fucZp!vn9hJjBnmwzDkGGgpDDj=&xyOA5X zOJN>!8%5kj^9tBJa$!UZW-`q0fBV>Z^Y}iVrRd6Pu8HVQ+P*x>KtBwt zfAFtu(JqiTw3P6ms$p6|=Q4{~jVkCAR9b!sd*={%yZ{}Kh#Cii3ps%^uGH%^&2!#N z_FejpyFxPj{baRIIErL;M&CI6m$Y>;Yu%v&0>3<($qlH0o@e556vEtzBUfUMco~N$ zcC@Y7w10!PbT7d4T=J$O_Bp@oQd&^*S>4y%^>8ZOol}!iyA&|ryR>UHX4g;XK}8@C z9r1f_x$gEKr6M~#TeQ;Pzq#E6GbiX|7w7zIcmn9pGV1H}b8qqjz9_&~nOVtVi}|6A z!I8xzW3JI2_81ae+b1R8(wVo-qS(s7;1L^j@+1B;4bN5pXK^uLQXiIlV#}0GN>Q;? zE4AZ2$w8#^Y&P~*W7Davjxb08Kh@CTq+b^b$!u=p+gd~A_wb+padj&HdKN?79PB1a z3Iq5Y;&pLKC<_pYr@S_2fA{{Aa-#9yg{s`9YJL!@5{<_%aYqfEZoI?9 ze@o@7vl!o?2)0@FC%RHp!B`juZad72n=4r_Y46B|ZDik@8V8Z(5}?fHGZsCy^`5Vo zMTm=|wusVl{=6=_El$-xl;QU+hCAjXPf21;m%lKy#5w)FjGu(I1t5eLq>9!=klekyq zb79Q^faRo8{*fC8Z*keqpU&gKc2POYJw3;T=giyjqKllT%5{(?V*sT53p4gM{$AqU zuKb_>oVyGJ>w!VJD|_H=U*pp_{TOWn6rkCigqH5ph@Tr2A*E35$~vic+iW@D zkN3aN8eVMafWF5)p&;$lRIdvQ-CRfOv6d1P(F~5ExO%Hk<^a*9W9;kYC1l}{YDtDF zV#(`(53KTiqz8oSM=@kcMfpgi2xZCBrC4WoJe4z$K6heT$)8c^tmOFrnM+%7^9sb< z!pFI3jXzh8Z;zttfU1MiPpM=*Jv^nMdXsN1#tlJ;I8H(hW;z>+d7_R_;pT@wx0J~i zU43*MUVeVgogY9Qssdz>29$Et;B7va)xjVX4%pP%76SNC${N{Jl<=g_Celi-HANMw zFM?0Rvahash{mPRv6e$6Dr}m2nHdH78I3~|Bxks?%zn|80<4i(3zv1)*!T~tWPNlR2A^tzi!jo$UW_co~~k^huD z+xWI%2uO3QH%cq4;#Y&5Oz@|EeArd|mVo@}-*H?^?2P7Fn4vM3TEhH_tq2KOx$JJ# zS)Qj!3bkJ;4DDS2iNNT@ox}};yU5|#do`U%VFYxpFa&D-0VfBO8gMrk8$Qd;uGx_H znNo>05t3)a4Rz!^r6p(i*R~dUY!X`dt;FA!jZQ*9cGn7l)mzpj{p6lTC@H}YOY$0P zl0Zjwfj0k$)>nJwtYA`X{vphXD0WhnP93KrVISj#P<$kIxa&D%B-X_UF}*B& ziVJYpoxfwDhMLq0w5}KNQg;@^#)LWa4DYxtxQduswK38Vcanoe%jl4G^%3D6O2T6! zw8Ebph0YNtmq9RBq--cm7e%d4tIB4VqgTDBbXS>pmEsj(3tU7b`g-4-i<5`dXHxIa z$qf(%^Sa&O{EIlcI1`34v5-cYOe)R|pihrsqUBg zh}pw&N>>ugo+o!bSYULmTz4>9;=B5tDB|d8nn56nH7-zjKX|QTCpD_Pdkjk3n~eun z%3%tgkE<s>C<;j?p2J;G{QyZ3^h{-!r%PSEOXk`w`*N@UBoTG7(i9zy-O)&-7v) z9~dI0j-p}aKe02rfizT8W{aoJH+iZ8cz=}&p5@!~AAYPncKB+}UbXRBl8w=q{PtypMSqnknr`h+HKM(YZ$6FMa;ARSJ-oC+wVp z!i2b*G872Qj@y&NOxzc(?4**z}Z<)T9I@@0`ZkK1eMI$kzzFK{rpP;a`Z3DV(7 zG}^iDIO*tE!$vjB8n@p(teaKLW-ku9HU7QawF3G?%16ssWlvA4 zcy9_9VL!;hIB(AQCad@aReGcdY3VYG(em=e_*reX;%C`VyBOY zAt{;fS#R&*!zmKz_T2I?j?P~G>-dq#k&m^RZwotX9Y-6knXC#H+KW(Yo^rJ>z?8xlM-MD85_u4h;wVQifw5oOL;BcpBNZVQsk?nUH_saQ;tgmc zm5sQ5fNCE{C5V&=`>uvfDij27J(;te&os#tt!C20ecL1cmN&0a+FNJA+7rcnIkVcT z1xi#ptmYmH*M}IqsozQh#t#?y*`jBpZJ~c#>s65%uj4L{h_Jma#Gwn7E@iG_CU*mB z{^SmRXOu%;{)&S8g;feTBOf$+g4-)xMc`h$5x&`uYCZ_yk)rxjy@R+8|riQ5ZcV1?{u2+c63tk?_4N*&FTO1>@5EUiC8)Q z%b>IIurdF)YiIkPl!)#BP@*eUGyq6I1(Sk4WzMdbR$FS;?G_=T_%NDj^a)xa=Dn@a zQ;9EVV(}ap9f$uV}6^a$N%YdB!@OXJ2o*P>{+!~~ z6!jx!13)G-n(>)8ie;WcuC3u?o>hJh7q{@W+tJuYiOdp1;`%%0A``V;ENmMSKk-Lu zmYVnGBbYzXt`86(7IKHg7)MS34zdnE3kxvu7`seP5(vsXh|#~52st25bsj5It~`Mb zqWzG^I3ke^tM+{|0ttNS0$6#a+|AdI_QHT``<7JPI+1_v31WJ8iMgv0+EB8(8F83y z&?7icB-Sw1srVX6`d{}~h?u#f9Qn;h|Fvfib z&yKCA!84loxSYOltKCH7yD+Tu9v%-{o>@tt2%X-I#wI=0;8S?`0ZfQX`T|1G=Tw<_ zDk6Di-HM;@Ltc)B__%Xb6*A|15WPmf~(!2XZbnz1CY-HDoE%mfGT zLig9hymW~tq#0D@ll3~M{;5V)h_K{`pYSx~7ZHgL=~BR=G6-j*e;>Ai&_X{ii-pRL zn)a9GKJm$^$3jmekPgOzo&|b}Q%h8g?od8T9kPv~Iu*MlT&@uN=)g^wwgr{<2V*n3 z71M0On6?xGVB^9Ojf1w0!CB1XiX7^5h$_mz4VF|v$4-!(*k5yBzD*N@qxgH?drH12 zDovPxQXqoBgc@B$Leao3#O8Nf*ziRkd)6~e;(4pW=5x2;UuM`(__aOW;@tOaTahFF zGX)JilYm@S;=z9_hYE8YVVDCg+rjt?hoL~G>Gky*Kpac*G{5Ax@HpJ0Zt2?>`bsHk z1RPvjzbjAq)58AAaIwEuT2Kj!yqt<#X zcs`mqM5!c)Qi(CkQ2+S*(j41gZY^MtTel=r4Bm5+WynLYI~d1j%0qeyc;UI?5|<-D zC_wrfF#pfsACuJUaeguYTrxacswh2!P13`8snuO!?3o>cNuMc7V~bq*++d!xfQMG)Y_`E zl;1i_9(Ww9(1{nS;v^$XL7 zBIriU=wnXtK(*4lLu3v!G_g1dt0D~OP)yZoOu`RC-ATk7xW4`JmWnqf;hhzA`4mM& z9!I_qd5{vcCpuMbBHC2IeDPD{M>IB)jZ|f$i^JA}F;ld9*9fl9u{LO$_r0+>i*M2Z zD2Y0@p|6Lv_G3m;9KO#bC*X^DmC({*z}9j!>KC)c5dvtthek8WSbH=(6eu8Gyc>I? zS`58C!xHe^iP&#-LnVm4+MCugqYD__B2+LG636C^KdFS~xvQzH>Y`aDI#oJ@ql@Z2 zoQ++$V4OW!WwQOS;c>pJ6_!qa3H|W}TyniKAnEP#7pB>?^d|p2ee0e3G6IEPWcm3A ztqwu1|IGfCQsy_*()pFW_-4Y6vDT$S59nTmFH{okxwi}T`Z&gap6W$pksB6#_~5FU zCO4?tm+=aAyMDGWtF9ex&VmX8()VgT38nev01hr457hp2fbH`{lNES|j7;>E)yG=)UDjg3KR@nXRV)r-#-BKOyMtF(K@;xYK90$} z#lMNg11-DAn6?u%rG>@R>)}`c9bnbYx~rS?A_F3n$oL1EdXYi{^1x6?*47|!P6bOa zSnUr<}8Gve(_?C&ijaX&fyWwsciW znKJqH{9E9S%I^yshR3w(e?WA$|Ay%Q32oT_Z$JM3DLTymiEY^aH%6yO+0#V?pcy+$ zU)@OrxubQs#hAbyHUAoU8eew1CiaM#1c4`&16t70MoPo?eNqPCGF0Zu6#pI` z0~-~)OeBCeoM2-6Z=e~zP9_Ix!+nI&{x5f^Sd-L{(NmDIkzQCWWrN!s^=b6FXwk-LFC}m6#%S<@tU9lxEU|X_8Wk+hbF6e)+v_zoMRnd{?0Z_yeXD=I`tA~1rjs%mfwY(+76F0Hxb_X$_jsU;|L-BpfayUW8_-{0LzIy8s8>55?u8fR(MZnR>mo2l;y5ml5>e5Q^S!m(nV8iVldaYWWo_ zaLNLWap$ZAcOp}F-+pOC5Ji;uQ^lE~(v)yK#B5kcsV?RvT37T2+&*EtQ587a+*1**AuWKqvnSle;s3B@gNLuB~98`T$G{ppK#C`la_Re z`a>UpSwR?_1dq@P8cq~3#2Bo0yN;YlGJzhMj#R7VcjulLZ9r2kO@tF1PPTV^D*s%p z1PMq;lQ}I>`hxf93VSA^(?E+KYou9ZNs`ZGe`39`Ycm_YwU zG4LT4oaxHy4cV9yBXo3d+GSX7iBB#$gv}6OL4ZOdFPUTDPM~n+RVvegMK4!L4-sp* zBJaicgwRg&ugXC)Gexp7w2n&+t$U5Czrn>h_$n_@RVK+|NqQ>k&ar;RAoT%kH%ik< zJlb+P<`^x~RJ=*COxO)|{`!$8$fkr--EAAm8n?3T5WG_iv)2Sg%c??Mqku8P-8&Hw z707Q#ElSXp--g+VVzX&jnE@xiBD(fV5q-@T$Abt6eH9X@>eYGUt(htKzH3K7O{Z!C z=nK3w{=R1OL=1!F? z#yqGC zs6fcx1i(pSx83@_Z(@C8ipL(Y6J8FJ3oZ57Gr8VQ6TaZx3@y)Yh7Y6XQnsUe7qZj? zWhs6GpzR(NQOILA-}6wtGj&>&r{9gXdaiD^zqayyb@)?~CSYq&L z&z-3k`x z$m~34)Y))0(Cb?4sn*K9CTj=Oo$|kt+Nt;0qhQsExr+K8ZcIqO43)}U=61kZaeSsK z7E&f|iB$d=iaC(AxRW^%q*>Vbb;WW6S<7Q#9P@pFHuId+a^2~?0)!c(e@U7KZ#jPK z9oPVj#Ez@jKI#K94b-;m%rPQBO(x1_=>N4=8?as5`~ zzoBG78m5u%2?uzD$=4h!M#+D~G>cQVDPPq8je3892=}(F>&uPJJv~4}96SP%ve-Pz znC{Sui5Z*VAd2mCiRsn!(72Yqa1Ypteenfw$Ad4OJtBK|C$(?B)ouRCK^BbXCar^y z%kWS*2RkKj<$OLI^ZWbxeq`hQ_vP_9e-9o;MV^6MOIH12&kU;YWRcTQqo4Q8MW8v- zH}fN}4?M%v*7%6JD?^~iG{I`)<*--mMiz16j>+UM$TVl;Db!h;E^&LGx zrNE=cUcd$WGfKB}kGn(0hbxX0l|GVywB^!qniwi5)Fsy1GC6GXg1^#Xj}(o}3e0OF z2JF_Hq3~rzGL{(!BC`XZzej{XW$6RoxPk8RPCkp&fc1=m=q(f4|7<2$zevB@C6xfn zc#G{1tbTWCE7EUQFO*F}La#t%w_RcYiJ_d6g%LRSBc6Y~O_+y97ssY{TAH)F^B3H0 za`&D+ZRaJzB^tk7s5osG_(h@1l%G7c>6}P(_1;MjTWUihJ*JNvip1fbOi$=2D!q5; z9*>MlX0Mf{5!YM*ng-34=dvTPthq;EvRVJMEVNU|N?bQe+?vf!Gyhq}Bq#w8@(_xH zrwKL+GUUx*Hup&L#BSEvLK|nmY28>GG8IP-$!ldSA^4hCx`t)kvSH3L!h*jPgQ76^ z+5Q4f@S3}&X3;HkqT5=^a{{+i+lDA1MJ|%1EMq8a!>UrD(ZB3GWLgX}gyU#DqbG)H zq-+owLgZlNgqg^Ht`Nv=A*=}Cm0*%(7EO2P$}wL>)$sKWUlK3Y11~~|LS>2IhL~y& z*vUx{L;~tuQb27HmkOV$2~lttujo_>LI&a~eqvo2r4o{7da2l!?Q6rPWfbg448=3s zY?c$HmPNoKA2;Pd3e)msZ((FbF=3#9k(ALUZ~`!3rp%A@nvHIHdRPaj(A`!oo=tc?s{ud0 z4k{=C6i8c@?@e(w4j1E@WO6iv0U^-ywW|=&TdT+=phMmiYrKFJl?V}c=bNzF)$;Bk z5mGUgk`I2|tow29(prVx8_tXt79W|2$3dHTpO9~9sXh(}gGJIoO%QRYQrnw?)_#2G zCDt-s<)($MdA1<&WCulEVMY-%sw~6-NQ!4P6fVgGrh%qD`&_{scJ+FB7p~%s&Akej zz(BCzl!uN~wQ2x9)>H0r`;M3;eP~pB5znAxy$ys!u9m1sLBsg0yit7uaW);Vr(pT- z3OrdYOy+I}Bh?MgE66!e^$Lvgs9#I%IK@;*BVNk7wQ;RwHRO`h`Aeb%p2;<^Wp~A^ z>VPO7*R>A@ZHLC6R#Yhg*{mQL=%sNti1GG3Lycib=ypKVQX07&NE~q4iW}l4oL0XuySb?#+RF(@Ia|mQMk5ypr#iAu%B5dv^(YT)(C)IRe zUNzxu1PZXvoq*?;n8+6)g@M2Nok%JcAB!lK?aDHV2a|5Z-?Jfvotb1lP#SA$>qaH zOci_sTi|N^z;LRn)|HToZeNHwbe>BTc3g}0cg1zMqpf^bdoHsy1H7Bl&Fda9vTE0T z2UC7g*axq0Xd=iCud<^)Ei$X^UuF)MN(wOs>aU|?NVbQFd_)Cv3l^bg z$^taiP|(6_0{ie_rcC02JuorbE_~_8m=QE0B*)zlxYip>+=X&bb_x#DvK)`Lg~B)s znL;QeeM^lk1WRi@%&(+@bLYT*))P}hX(%{S=^19tU6|C+r>l@{=!@!`sA zQ)Hzw(wOe31Qx!>)en7G`|MCY+hs>#OF+2{3vH)1-FUxBxjSd`+_hr+sP#BRq%rN4 zu9CK?141MN+)|}&X$CWA4N%3A3yOD?(w6=qs^vdHK*d_JlnX!~LoCMJVx=oSh zomG>`J2M339Wht6%K*x%_G$210{7d~C#Ux;TB8)%6HHO{@kL{#aY74cTZ{b8ym2=L zVnf`X?dQu$OTL#F0niiDd0We-3@}!#}|DeYo7GxEufepbBsE2sfC#Nn)A(+Tpjq*0B9Buu)tB$j)OsbGi~0* zd{-HM4wf}5ghwp1x?)5#e{C;mrX*N|SwCc>lou2;Yol*NA@Pas{=^eW0(?_i@|-G| zuy-z}J`mN1ly`-zVQf*i)fCKGxOX+E7EwlFg`>XawhgLQ>a-N)({LAKY53DN3f!m+ zK=Y$ey9u<089Gj%yV{%@GP1Gwv%(tFwz4%7-EY(H3s01b$cwzPRsIP2GfTYK;>l^W zK^GO2EfBnP^VJU36Rw3z0eC-?TJkl9yGw$OZS;1|%%R?mPhLl!7KWWI50O36##TSy z#@=jO{k#L-Y!*Ric_Gbz4&XlQtfmf+jVcRZp?I;FT{b|rZ#?-foUPg#HcFGxkd?&ujyA2wI_k{(T)i%W6G&61e>uid_wEn~~MmQu|sf^2OS#+!Qi% z$r(^uQd+2x-+vT12arVjt-(a7+`B+sLr;HK{b-3JT8<CZO71;0O%Da zR}abF$FZ4?YAlT&|2+u-URDe8M*;qiv(wVO`ia=%0m|EBs~y<hB#!Q={yH41 zbytEbN>+;X>DX0;G$}6n3xKEuG{39m(}o{4vu~zs??Iugo5e6 zBrNlgn1zzLSUv>}f=?f2g@qWJfDx*H2gm2JaSbk#(`1Jf7Wz#8Om@dd9Hx&?4OVxm z|F!WdDzY^Z(j8EdKUb9P*A*_^reA%!r=ub1D;JIR{X45^02K6jy^}Q} zWU?~L_Evoi)izsDvss2+AAH5i>QHE&cW@maui!0opOowN@7*7{_o-Mi7+@R^YpvgH zq}XeVLNayko^ASXtLJRD*F^N#7h2@U!3)CfwQdW3e7=3oD4Ka4rIuSKZ&YL;PlrTC zq|BO5^}k1}Ud`dT{<2Q`0HFALZSU{4-2NQBfs#XDo7#+0?-@e~QdyP+jgaN*{%4~X zp1s55@k*mGx3pF|Q^Q$)h1of@u=ylq=IuBIyFdu=esguXZWKqua7OjW12N73U-zjY zhgUE_iAm-ewQEl|!GcMhk^W4ydn1U89DCO*m(px}`tSLWpV1zR67Vm14XEtMS-M*l zz9Oci-f|P)Qv_vox#dC9_J(UC(pEh5r$*qDMoV-bIq!O-B#oGf8P8hT z^C$BrFX7SIh{YFl9>B*$Vkl;UKDV;Oalx^p5yD9_ic=xOD{;uTv@hO zd^g#yOT*fVb<8w*SZ}zOhf`mg1sw7q-XgLwqRpM-(p5(I7@zj&sR@6#D3Po~qi*gRA zl)yZ^=5+7A=9D06Rfa(i_K^ruipDS)j3D;_+Y9ii($qL=EW*n3$wjAv_&Td&-6&C# zjLqO1jKbdyuA{N(61}vAfwGx1CDr4Zx&}6Yy8|zrRr(}jkDPz++G;6(XcF7WCJnB7 zHP_P73c$;Q0G@S9@e#N{+OTII8GEi7cbH)Jib1pM`rWMqR_&QY(z82Ca1^7Fz($Di6c2^!@XC7I9u@MqX9R?^>5-}H6!|=)CNW;%Zoec}$Yv8qYNG?xYTshD z@PY1n)vqWMYcQ1e%OZ>&$5 zq+1&*VBQQg(L?~)R`16YtQxv-ll$fZY7s1buhFKmbu7HdmhF7WFX0-9bz6r;->qhV zEFsDPZtd6)*_&e}|1vA<{?3GWB!9vVte*^Hj}RC%nKVG8x&uK=ig*+iA0IC@Jf6-I z1qrLG?%&^a$7!6H8u!=rH_I<%sbvz$S26evSU$?i+#cy{WM+h*;sFojLL0eA$OvE5 z+sZH7Aq6KA?SO+*DHH>GBm(eyn8B|Oo7QFpYdO^jj2AwoNi71ibAvBgP~dQFz>RI- z9>D1F2Opu{LFwTpgL{WR7m3;wMMGC7U4e`4ZjcG!0B4L;O4Yl3H`1{|Iqzi7J@R1Npq>*9fA1% z+fbR(=sw?pKJd+XwUtYh<;5ub1Z|N6XqSLvItwG*>4h6+S46jxXK!mvy)U8w&4!%~ zX-yo52locT{cifkee~}HUuix@hA0Rr!T?Fj{aBZ8vh7(%|8q8x9%#&TPo+mtT}#Y9 zmTp?5aZ!n3mE^uAFxv23=5DpEfZWzt)o$a;&!Way^rzWVA)(x~1ovYA;jjn<;K@7c zvBYWL#!Eh(CTPz|j#6V!!VZ~^BdhPAzM6+lQ-0N_zmS41RxuH?+{uj!X_ZUCNbzV^ zJFDG?H+zZ|n5vpe)*V*7Mnlpk5Dt$Ko$|<9LfhX=p(+lo?dBS4vsYu^XUC;Hwg`rE z{mAR3u}i;9D>FdA1dV+DH-&p*Mn?x*zbvlAEQ{{>fb z9S7GQ^hy5-0l#fV=;rEr7QYPZ&@9&w%w3ZsGf>W>2o6Ey8|4GSyO-IVD&}mqIf@lV z`XC(J^v`xxkxe2Ui?N6{VFWw20C0!zhT`3Wa0Jeawhsw-Xkg~fy;&jxymkyAstpP@ zomL$0&CCgg&PV-XvT5#Bd zcPRvB!HkK}dF6Jbmm!n|IVAoo)n(M!w>4WPFZZR-53wHOW5_oLl(le+T;P6m2ko?y z46N2^H2k6`2Av30g7Q+sY9Tt>n!#HCIP|GAT&bjNW%WX;x<2J&{TW_Sug2g8WH$p2Rd}sr+P{ za{_NcNNHyfdvCK9Fb!wBT~W>hFNfkY9&{ST4x^HrZ;^t!;2gJV@vpT83Dgw>*Ze;p zXZ;)@`(g}|F2=I|05{S~Hk#zG)Z0rEhG#s?WXdWmBfKfZ%9#Aa*gS$=v$)1;ql%O) ze-CA{ww-myudN1SZ(LSzLwcBD74jeR1EaBjjXs-I7%;vX03v`7k|MKOwj+eBxI;-$ zd~zJILGXjOGNq!@GJHA0Q!59?;t3aue=sr;mp8_n9N?Ee1kM29gupiw&FtXCu$&s_ z7Gl;S%_j<>I@S=zo`AK)0%EfuOoc(If-eM_)K~%K^b@2~ocXvaC%6a6`PCHGICZTb zyW!+#&)a|&z%Xbw5fAwK)r$f+`>e+uqk0f7+;%lJ;vJ`W}su~tL;KqI)y-KK+(bBg4dT@8LxQA8Bq{qsGr7`8D? z>lNvJVrD0Y>r$$Cop;nu9s_ z_c7t3*R(4?&pZ#1{<~yzB}Gmb;b)BCi807^=3ALBE7=%M;9K2W?`d~NN%oJrjb-tZ zZZ6z_Z^L}pPP2XLHhBH)IHN@ioDLEl@1+Hc`|u;S+fU#8$A(Oi0Eer_Bau9$ft9Z4 z%X|+%FU+KegXowH8@%74h7_d+eu1e&9a25KGZ1dqZd;L?w9!#c8Q4>jfbcY6)0lVr zjs`x?yO5>;=^&AmW<$0I)7Ibwe1190=FyV5)S_HilgQFb`kRuXG+NTSL#OhZ@^i)74L>UnkTl-waruM0zRh?Jt z{yJ)sG1x~z;-RRB-;4_#l>qPj;H9)%d6o{Ga@M%S_*{q~0MW$aMo1>G9Q#N*0fDwG zCD}L@%vs1W-Y^kPLVIr#Z_iIuvmOTDJqg|WoF!ftKQVoQ_n%Vr=8!uUCrH8P!Z`L0 z3tk_2oGnMfP(pd*x=Q4%(@Z)PBwR!1>o z8nOc1fR31$OR|xi1bS^IsyuKTV2-j-c$ihKJ9uzYc1e9&>MGnMJlCD)fw#ads6<%B z-G|-~m`< zEqB2~)4i@Ap4+<+rq$c0EvJGCNGa2d?Y|jF0Rl-NQybt%X~asuf^g@Jj# zCiTsl4_Dw9KWh&Y$`jUxhJBr%^L~4eh@%9{QVs~;C);u!1kJ(r4z@Ln%$W;@+f6H8a=$g% z^boFHY11H-c!V7)-sh6H%+X+F&Pf+N58|XV6Si6#$rkMzW_=bF2e_|jE1OX>)tl(& z>8a;}913e4g_2R@W}h{Sv)o$SIEBeT046%PXS9NBi4_N3Rg4V>YP}gsfpA;(%%w6R z<=`2A-R`%sC99uu?i|c z4v^R#lw_I`K=zxMHapBgKK#&R!d7HT!dytI&1P!=H=D1p39z2UDJqQDcP&N{Mvkh0 zqmE6_xlFM`;UV-(J^aH#yRNbSPSHSIK^AO--~u)$8Cx(jGJ_NL(F>F}=9{&?ey4%H z^(?Y?xQ)p`Bc=$J#&KlIb@DkBRdc=FfZAHEw5i+u{n^9YgKLv!jfPzf*7@P%<=vJg z4=vOBPypgYG62MbMrLcI+Z8O>`Ts_wq>*1MOJTXuVVGApcXVq%4Xei8~~R*n*Ja0to%1_oHo0+RSH$T zt#?lO<8Qufh%a-4i=_QycYXq)1NO4m8Lm2@YLwD*f2f<^jTrQ;>={&yjkZgwU5S4n z)RFKZNPm~lbAgDL?V%raBN#}w;K{J7@qZ;U$mwKHyc|3v(oARwSTMm9g;m8p!1!x+ zijf{+qzI7l;x=;$7od>+i7%kqnFzc>hg@^Ux|2ZGO9gZ9YG?` z?N($hy(?+Vvo007eFNfVUwmK!BV&*Eh0v**uA_VS_F62Urbm9n{P{`S7oVGY$J8y= zqjMK1BE+pL;(j z{U@RzSDoT-H0{TPO%BlxMyyc{CX^k)Y=9(}oeNl#Nt{xKRoJx8E96s3KwWU8k|HF5 z%rE<&)W9Ba*CQTfaj-K`LSuCZarcu`RJf(h=JU{vX`8=YzntF9-XQKrjYf8#*1lT{ zT;2eh9xKa`2RND**!1xbGq_w5$A`CCk5sIkr|uJ;@#3#CSKGIq_8|~)~ z+l)qz^&JANL7PQbS0nQ!9tasaR2whyuzD#K)Lsx(USL~1+o^;B{l-pL!7aA8Jb`y6 z_2>+B10F@eFL{zl>Fu<-Wt3yc-F4+?#i||P5a8vvglsJ z^X3mDqPjPaB;v>d(qr>8MEE781LpJZRnVs=n)|);4&9sGvWh>vcR@A)uN~0jS~%p; z7IsXfQa=(@xQyxxuPjvgIToZL%c9JTwdu$#sJOJpi1fPqU}b4~9u&?m*A9owUUH^x zNHmu2qs@NH+7-th>2CwkN-;6ZWh!yQ<_{e7s8jNE8Ct|K$kC*ci$D3<=K~J4a5c0* zRm6gk)RIz|j+~wyOM`O(+A3h`??oQ4TQ3ex=upHypB+Ef_9g59w?@Haqr3@ z(9t5ba@KC54aG6)9V|HkMqJj64w>OUOK~Tl#I$YrGF5XO@>tD{-f1vO64{&~9#RnU z%OmihnqiFnco5p(yGPFm0x5k3{B=U>#FyrL^=nxxA{8MDxG=~84n^vmzUY6?C`Wv% zu6w;7A51)0oU#_@pM8DDT~LtTmrV4JrLe>f3Hq(%ZI_Wo7U|*+lidwwuUsSpyAy!l zM*rlNI_EPPT7=R0c_4lR_8I)LC%QD7k`YC_=_5gYtn`pL!OVOqoYbmGHb0JZv$%J4 zxcz9yEtLqv;QiGAP|(Lfu>we_@~h^<);fO&Azbo6%7?!^6R~IrL;StqJ$roV1a#eA z8O9(FSqk7eUZNCA6Ghsql@Hh(!jS`!Zo&8VC3b;#fx}omyRqy{@pjq1bH~SUv(Q^o z%1i=yd^SDmDc-^EQgrMiN}GuDbY~0h4}HARM=UNFb^rwdtS$U6mTd_NMI_YgZrSP! zA|pSThBTm6wv|EzJGEl9=KG00e@ARKzc)}1n6flM#y{f;sNMq#`)uB2Q2r*fFTv9u z4<@+le@PtCV0p~3dS>E zs`8d6`mM8(X~$0XDI?ZP9j#u|1S3DB~AbF6gNIjc8UAQv)`` zuGkDc?`Q8N+-gYAh;<(AdC-RwYDgu$KU#}@Z?jgyJc{%|{po+rWt-31WLZ!d?<{m56O~%QD?lZD<^Y?%vO{o(DB)u~s zy3Psi%ycLk^`A8ao8oLdS)=dhp}!zRUB>bEsrPCQI*AUZ$O7@_%1W;F%3i|&zvb}JapfLxj8&;U@&(Flt&K}t-Ub+MPMeB&3blk02Q059x5#ek zZ3kp2B>~*@vprI_^>h8QEkt$l@ z9~LhYxGsFMxPf}f=WOQ;3NPvy3QOo0d533F!Kv}o<=BaKhu?k(klYxbpnUW?)&3~` z4lIGr&Q-{y-)<(9J%j>!sCF2sFb$Gw8nGD=vUOO*I`nl@vqQ-r299OMy{ZAE?RR)F z*6y4&ZyZ$C)w)X_X;C|Cw3)+j3+R0w2tefxTkH!OEQsTm5nz-YRu*Xmm zY^*nqc5jy$ms9nb%s}-LHUvK%&i*A;G3?e$Ha&o7$yP- z)z=7Ytvpk!)W>XAobK;J)ijidE%>~%Z!MS*3p1c7k1*{vKz<8<63w@HwodHCAs3v1~vup08U2n~m1-wfjfZ(}k*(4fb=!`;oNPE)rh+kn3K zT3=yXSK$~O&8D=sFXsG|%+nRjfHNUoG=({mIKeVX+m{-Z31a>axNQZs&@e8 zR)ngO#tmtxZzf^+yJ8uI1MMd*ohGdVEnR%Dko}g3#i4g0dA?;ETJJ% z@h2AIROBg2i*!GZw#bFCS~>1l(t*X5s?yE8ZH>Tc8jn0-p`!4RV2lo>48bg3$qAT6 zboM0>9D78)=o;6ogJ@FNT*nvfPy_Hg#Gl)4m_v+!p0>K=*g^#=#Pv++D|vFo8kjv; zj*8W!lADa8TqQrBGOMh|-tLnYu~G{df)kQN%YLeAJ3`_3qWM0=%(7-E)<^!S?~2-sV&7FA1dJLlSnUp;R4))w zm_d91OQ?G-}MhgkFOXb}U{eTu80A>`V^}as4FT$` {3uQV znP=j?S<&DQc*$s4fpS;yHoZeDX;}4iAl1nfNXbwm&$;EVEfr)jTbegy&8{Xn#}y z2x~mm9>TUHIkSv)>K(9zqM z(vcsfXTyfe&9F>B(+Jv~r7 zg%T+X>xUEMrB)Lt$(Bu2*Vr(;gkMSlXo0t5zfwhtB;=o@jAc-R7efwR9mz>c= zX(dR27#g5nODM7(JdZGm5LLbwA*mzN6JWy*LH<_HUf7!uQqn^+Qb7r`F1SKr)jw%mfJRO~>33g=vYRCTNW*=N`Q!+gg*vxYcO`f>V$};Zm z%8`NOj7nZ>8sPAGXcmw)ef*8qG~rlV+qGf`4HTz^1nYh^12L@lpk zb3U3hLqSjDS2;r~DeM>M$Dxc>9w5x4C{iW26km@KMDcboNCQ90Rq}*bt%1iIZPDC~ zOKXUJkY}#?f8@|v`iFT;RG z6$)QSm#andnSmfW+|AI$^CW9H(I0&E7o> zUA&3&D}V3DXD-!ag3b49G`V?>pWe(4lqG=|*4az#ecLBktzf+P>Z6*H#U6 z$xJeM{|ktIAY?iWx{>WnK^#XD=aHSssoVQ&(+s7Jm$}_Bm!VKo^9M3LGQ%rd;-5-p z<_zB)@5OANSf3$;{&Y`Kz)s8-{L?yXw;snMLXr&rx_nII(x*a#sg%Iu_Ip{+DGocq zdBxuk>#hr?JFfz?#}J0R5YZ6uoCkl&tYR+bZh*6&*$MN01br;gWUjX+vWcb1D~iSW zbn-iFcAx4g_*^%RxCWgOQgEyt~z)DFl#f}XzK1jr=S?6Le@~M^=iS@Ir=e9d>ODXx zO7{y*`Sn11F0tt4!1eljL<-H56A;^zQbLTDk!~<$KH2Hl$vV^U#haXQWWfiqOj>Z? z>@IoVK3on>-R-@e{mJ|dk35oB?J_y>FiMVP7+X&zn_wg; zS3zuu<@!e0sylS>Er}oiJRBp?dd@s+hxxSoY~FixV~V;|IN*c4xww(o4Nzgj=ExmC zl7{Iv&96XQ3|klwQul5A%faFh#j8}M$ce8oOPdN_il{s@%P&AnDsYj+d(aJxJ zFCIt*g;i2m->@p=L=^yYMgSR&T{MCcRlgd_t;a8wg@z1!hC)>KWVI_}3VFF~MY+{PtaS>uz z=k7ZFR)6M8oqJOa1dJTw_e+UFwW|le;ev__nexL%<3hNnu$X`iU{H%5ovJ}fBqr%x znrZonJ#_Pl(lE_+NgIR=(&#~<#*`jT{CHsPjo+lpB8My00~`0o69bVD$yD1g_Y)cN z@@I&exreu}U+S|rtOP(b9#ffv?iElsb6Y?a?U=-hkF8FDp(GKi@r20^aV1K&Q1RS9 zy=}U-_ktBET$uob0;H~s_(@NQ}==z8~Zwg+?PIz(}ahrv!|Rh8F%t8aX$N@vxbXC7=M$@m_?^8C z%-Ata8+4~JNd)gf5y^vTniA^&b-bTC+-u3WAKE*5xO_4GyK(-Kk@0c~Q!Bh3!Dpbf zo^^i*lT@$FagKg;<1?3yC|M}niB%Fb;16Z`sHC4?u9`UCcoVmRTmEG{zgB zPV{V-b+gLn$m5l()3)I&T{v(5a`F>`htTM^Qc0cR&{z7Hs`py1+1pZP#mY!RyfQEQZnz_4mgB+V~R37Rg%V({T?Uq?HjiQ zr3+V+eV;$WSA~#>`A>!5jQMYcpnoPVMB!JJ&su2u#gwp^|?8uMcP@;GXb2t)dc0_B6= zfZX3|mIti{7}c4U%=3f@>k0&vW3X8VaS=2yutRFS`cMIf%p;%(#O!s4u9exeNNNE> z!*YE-+8)OtNeqCG?aL?(kT&#x>_36#PkDprUGP~xyJ_zp zsl|T&Mo1z(%UH`NDFn5sRu=YxI?O?FMxcNE-i@*^fd$U-M1@mDfqJ)qU86~YJtbfG z0*Cj#*HK3}KiPmOE-Jwq$uodL@qm;k4@;z-RQW!DVweENHJNbEPNxJRA%hgGO>jY{t6>IQEt7*r0)K~L@a6}}T976*wM z=4aF8XTS<%Bj806{RNO_%$LVO#(se8-9dMd6?6vKG%AEmD;>Y6ccTul`e7=^-4C+@ z+QO3R9Wq+~AFibM6-^kof&(Ot1|g7F3if)3+ald+wMaapd5eR|tf6>)r7SK%3~nIx zWmmw?=nyrpjSDrVj;0VRgqjxJ9E>G-~-f1ncOe1b2igyRb;={v{X@7sdU{TC{E zZXQEBl-RV^kM8+uQ{VFTnmLDVw0P3e=K#FC@gDR3mK1(e=Hv5gvf^qc*+vyKV~se zeFl6nC92TayZ>jBZ3)Nm-#Wvu&*+Or9uK2Rf!1XtKbE0S0Y0GcO3rz=%KOyFZ}+0bpGr8 z-fA-7&nmM22?pj>NrHWS5nU}8C>PML9S`VJI|`+utfitP3zVr_hhrw;VE)e?$X0Iw z$_&h|uL8<7;DB-ht7{0sIN5+C&GNv72Gp-BdeOiLC8?z%BBk9x(ufHPRBS^5ZZ|;# zdz-Mop5p)kP5xk+7KG_TU@}vzIvU$6o3}K2te9qo(9hLMNlwKuK%cVeW{89Z8`~n z6BY14x*$g|D~y-(eW5V>UFK%1Q$(N8osVwwOps&r2QjP zDc%DO!!-LC1ua1cO;R0=B#1_+pKpdF4Be&Iqtr!YL;CWMtLJvIyw!sE%tKY~@t?P8 zkDB}ajveTXrYF3sW8beER%C64SgmFy&DHK)UpQbw*Q6kJXf->9xj}0(Q)*K8QNHj~ zg|&ExIe-QtwI535g7$b4zQMfTyw|FxFYz>pFtW+EN8{EQS)-;Uh0(|ShqbP@h`WX6 zeCHCKMpYViBIottC|}9W;LU8RhuyBAazKIcetw`y0#e8iXbP(73{AIeD|-va#k!!+ zHvj-I^Z3anD2&3mVcgj=@_G?=?-H?{R!isLHlKaaMf0W{dx;InQ$i?6BH+OMtQaO^ zk!sbd6XaF+L$z_G{Q>^BJ76C=607I3#Orvp{?MOJy|`vxT3u$_v`ULNmIMnWGz@VN zKM4L-;Fi)Mbybp{TsOQ0hRYarSDv1dFAUHEt6&VfD^5?*8Gbp)8-!dJs44M`CO_!d zAG<15N#cr17rr$}Ym8i%;-0elqmuLy-3r!xkADxuAx=}_21cNd@*-?)kU&Iec93rH zr!hLJoGb+=`a;-BSk<7jG1RWYDmvaC%&rgwN)5U{L`teu?bq6S@$-V=9x9z{!T_MK zSL$hvcTM9$vg2n*4NrHb%7J%%nrBLaO3%E2Gw8=LoqP>n7QIK(z2$C&iArWMf?O8w z67$1wBmY9Wf!86&l9hq1TgL5C6ziMTV;#~X()ZBa6;XZSqwn@i(|pWqHb>VDzjKzj z&w1?FW^yz}y~eTcvR(|nckiC;x%UH^D?3Y?$X{>@!mtPcu2KOh#wC zeQW|m1{&*741<4nO?uN=O)m5!GE>715RvgaMW#sSqwm*$oG@s$=Y%i?bYqP(HMQ2Q zDyD0Y5%|^E=cZlgX%m=7K`RSLqL_PF{z9eC9cD8m#a6BboiFugiyi}25Ag!TKa9aR z;~8m81{s;nkHqPNeYaSZ$l_5`+k`u5;85}krcRx|0Dd(_&Z4>Z%f1|qMK+oLN|o@z zcK@{zPksA$E1)Ft%eWaX#Y^hhc-(^dGy-JHFyR?4K4!jsl+D}mBpf|ju7AXVNT**s zjqEOy|;h>Fd!DKt~5l*orzxq+aYfj9#&M5u&K9+Yp{vFhNDNU(OF|%TUcLPoZ$N0);zxHFps)k zg(so|S(+5oeL{B?Ybdltnn&2(m8nYX+>7d7n8}@uk%pDnggx7>tP+XxxGKz2R53oq zwDNH7jwC4Byqo-F`J)yv_O`0b5M5AYVW`eki`NrUWYCc3&oeIGpw1u;#(umZK1;Oz zd4rE3@;l;s_Pjqz^J+Ay$byj!{Lz{pRe1qO7DXuA11(V8L)_|XaAV-_=k{aG#J1UR zFk)2L#sf-X!VQv^QeGw$XtF9tUgmWVRvMHjJEnWFk!9pN2 zc+H=_&6e1yK07d9%*3~7!YYR-o$iXKCNI#e`)S}YGia*Hv%&pnE?yr zp(&)L&`XA6^&cb|yJvW!xq-&-eJusQ;zfq20kJ@fju8<^2mc^BF7a2Wft#mo=DiHp zM}D5}o$_p)_^<{nu7Ir1*scp=Lk)HcyXzI@mTL2YNmlY@(NIF5|l@H)Lb)cTZPk?a% zqLJkSkFCI8?Vg}Gwsx2M9+WGWaow3f!TJ-)xFFbK_;P6*QLmDBfl18Wx25q<)>=yioU;|0mLH=5$(2%0>XtI?U@B}BLae2X2zo`)l!CO*kJw<3=`Jh6)@ zscK=?f=8CbMXs$4(J!Qdg%Pi!(V9a~=BSs8dmoYP&cB^ov}YhB$m~amGc+aDf|Oj~ zOx+2fs->PNw)Wmkq$q8(K!IsVH_wQ5$?;BCv|Fl*8ZDJ#=nPG0C3ON{TcvV$#2D!I z4D%^m_Fy}fr`*CW8>(DsKjc@cDawx08VS%tE>(sgD)}DpoZ#L<>b2M z+x^OJh*twM>UBTwrZsoUH>xGAGXhLS&|v-S6xF!I6qpmaYJJ{K?HIrn6+wiB0)qmC z(tGcy=Cz)YUV&7Ab7OrFJJ!+JZ8$+^q)=V)x`d6Ik6yFOBM@KoX_}&$=nREy&&(Ro zRtU9t@0D>5&B!HQS>7xa-Wd8)5V`~=W%fJvf`#}Q8XL1PUSSbZ>y?4sGd6+`qlK_a z2SUpIrX$4ebq4Nr`gds$Jfpu;e)Vi|YW?$ipfg7rq$tl=AuR{PH%MxscG4*v!$&5V z-p%^~<3<=lpAO%13hdoWJwd1esU3I#NJ-06;{tQsya63;cczR&;8cXLnKb-4QL!!P z{+JK^{Lj4MTr2{8Y(k=M$#iO*l8(-JfgyiU^hj1X2)i7cE6i%u;*=5zaKwWcHhRMlqDO~(jIrd!;?@%dY+FkJE zg0Z3o`_F^JvPxUJ({fDyebGBC;8lTIki)X#`I!Cys;g1;ezw`^qab0=9ICU&iR|pY zhi)4y&08cEO{(KK2}c437fq&9hl6>KB?2sGFTqHC&dncPwauLx z)e&*|6&2ynwTrPhuuy>@EsFJ532*WBLN^-p0Nfz-cVgk^0$- z@7(_)x-P8}8}_cM#_qrDKr57t#-xV1NDCS9_@~}oXoP}li10j`C}6PZ%|0ZK^p-`o zSmEBrcKil+!d1EzDmmi8@v%7|s3MFu@%JM6n-QO?-GkqH{|Kb}3DdzQOZI zN)GmAFKINk1t-}I+Y(L~KuWBNh1qz#*YYS?YANTRKaM{wv3(y=0LOYKOhir1SUvI} zI`#%NHr40ZgnAQAGNZZ-4tZnH837F8qtg#aA8w^)>_B4a#CwyO+1XQY*kgsZa~e`k z(*`>sH~rOv;;Ce)xJ6wib;WJz0Q#rirh8f{c`-d*+DfgOQ^5)YU@5x}W>|QxQ|>vv zJmL<6q-?R)*Em_wH&!-pkK*sN+9r6T4X``h;qVs?H`f=pyuRR6)Y|+V96AeEIX!3T z5kW7Emy!f_QoGtLV8mF|vAzvyaQd-P)OX4aR#6Mzo~{xX9WCsr+}Odj9=?3H!y^4u zItx_~>0-=S5&82KaLLq44~R#-#IkhCu9SR>3kfZ4AK%7Cu={I|EqMSg6+$af0p-ZN zI~qctm?E#;diR4o7>dX_n9(DQ6y2DLS{m8iuOpVoK1!u(3Wpzid(&Ll<-bT7_;RN z9&QO{iaYgpJCDmFObkCi5Mw-ypc{gbU4`YY6V1d|>Q~VXjrS!!JCjC{1~^4?{P+dT zlvqeJbIor8iw&RzDI!3m7OxAG?J;@WU-+2eZ?>FWp_`R6tQNc$l@q8pu#jy(8R0;ZvEW0^1U#r` zUX4ysFUd-_{q=Pi3*?I`gtssz$k3ehvghPt0C3r)sW!8R#zK%+8vi~@ol{UnN}ntv zffr!pFj!eo6e62=-dG)xYl_E7p%{Tu|8Po;FxBH6oSH2c;*{^0%m*cPLeGHv{A2&3 zpD{u|dkBi2%PSW_LaHqV*)oW^Hi_Lt@FW30dyc#!^jO4re#*J)OUnh#hGWmo=Z(ZWK0Wt7t#SZb(qCMU4xcx@O(eL1^>iq;z^XNWVSt&<@oj7RQO&t7ZSbq4QBzY3<>KV zNq6R9!;#%g&>r#!z6oQA3ylu@$}jimNkDs%g{(#R6}R#!q_-bH+rAZ`n2EkB^sVos zDem>}9HwL@MlRJ2q3s;7dD?0RuQZ%Ni;Z-Ta1!8LyI$M1iXg@LZe`7n-Im9*iUC1y zrRC74#(nU<6wXu!{m0+Q9vtJQCiVDABWRkq>Rc1R6;p#=PEU;@A{9;w+}OU36OC0ra;2*{@RZQo>X8!2ATMY^^+w zcWwO$jjgGVgb6Ix!W~+^K%aYP96;n=4SZOjmTg({qHjWOkWFh(Q7)g{%=hjam1`B- zD0C)PE1_9g_Al8P=<_!@gi;^iPZiMJ?lmLBA!_krO9CqlQ8jS{W$I?;1R$p@9d2Z* zbFV;dhocNr6&H>l@T|Qj{!Ajko;@IY8CxXOzeObpdL%%4-<<=t0|Nu9kM6K$A* zY$wDwy|Y6F<{-xXnwq-0bH9z`&jrfQn%Gv`*)X>RI^`fNd^Yl6tCHcIb*= zeb>o?t2qHbB@qK(C24b3Rc&cCRTVRkw+Fe1a7-QQAw=g=&=;vlaK_O+)L|ekS>*eq z)O7O1U<0O5CLLogp|*^u2ppLiF}VL;SZZx)qe(Bk^@UrYD}eDy0fDFnk<;{`$PdD^ zW+wi!0!cS$!5c#ACpz4|YCO_3mYzeIhbt=eOf&VZY(n+#%B!`wzjvoKIc?iwop1e+ zDX|ZMk$;AOSt|-z7{Sf(>EC4bCv@#YgJNTh*K_X&Z$DWa-tF?Boq{Sj2_zAw?Hk6- zv!^S$He&Q_&;a|Z-4gx`Jg|4FNh0YKLzuEg7#hWDGIFgJ6h+~{Zyi9!$EU>QWq4lg z@~eQ7#(|mNCOUr!xm)E-efh=$BrZZb88#8yaEG|@(*oczu6AgL)WXD9;%Hmb*nFc^ z^QJQK>hbDnCrFD*n4*s3)|=8ITsUd?ALi%jTj~YyjR5%O{RnJn<-BIS0%bttEE;ZP z!f`eH#Sj8t|NdMs%kOL|6zE~(%)_!!c=_}r(*>rpz!gnobD@sc`V2g4K#X*mt&I}r zC`eiw?mPlJw%k6;d71SGtd?wXMG&#gzIXU^VS}E2D(idDK272>8`X%E0BQ9Hf{E$J zceu|pb3m-eDqNtL7*fSl*(=vCRXP7J=F7o3bNg>;RWI!G@?e&{m6B@!KD#&b+?2QR zx!HHI#f21~X$Cl(H)rro1g+ThYgc$n`E;mWW<(j94?FRqoOFGZ)Q1^V*F#xqF5onj zN8V$?*K*XmXjT+3~C@-o`gTw+t{t*tpW?TWJq$IX~oBRcwW{i`%3I_{z&_ ziuTxZnKTBgu=5qA_w$vB)OS;ir&K!ySQTucw!Cq~`o^fLZ3Qj}0jr{Mt~{N;!6E!w zqW}+Yr$4?HkZ8UZkk+rhM;dIpET_$X1X1VAx0*_BIov)kNZAr*Sekyc{SNtRi9TM! zbVPwxR&$8ZWC#BU40XTZH5Hflr%cJwDy#P+Q&iD&?{n=k!&FLX3Qn`Z*WtQ3%5(ig z$tJE9&+mY&p_UF1!0yRMRXSceYMeHmH34)+n^V?ZufwcF*&U>g9nV@<23bGnnbwZ} zG0K~QG1E$eM%IdA=-nqj4Zun=fB0ROs5^ga#2)TF(sQ^;X0*BrwvkoaXk@J&_)#>% zOWeO2yGcCbh!f(2F!XUMqQlfGBk0tAhh^N=V}2+gGigT$fn-3s{F<1m7h@;576`z9 zrx|Dg;35eI7W;ma^a8&1R#0NJ&b@(wJ=)w7dHPn=KaJ!158SL7U7h94g4%}@eP8n0 zw>8+Q4!j+4gEkZfm|w_UoI#}#>WT(;i`mh7S+~RCozg0aE9X-)Na?nh8;651WWV%8 z$^XRp(+xw&)bF$UD$$R3MK%vd$OGun(-qwbqxiMVjPSL zH@*@7goxNfh_7Of04Ka{z06yC>?Ml_Av!8v|LsIhcbl0y;~3S5RIimI!ihg^1lBeO z3mebU1RFi&!XYoO-2bn$oO^Cpzm>a|7@e(mvDM(c?_lpm1$vKhPnS`7%O`14X* z?KfL^VDB#~FP2ogV6k|52Z?0#%11am#W<>ADn9)G3VX}AteUQETuMr$ySw2mPB=;F z?ht9D8!73NZjg{pDe009X(XjVI;6Wqnm^vp`@YY8d42fLr~Nx-)~q$h?Aago%p5Dk zJqWEOg;_7Ov7Ncn&Kn4G#!_m+qICF@Vs6g#Uaui}Jg$HIsF(W341oH6FrcMnt{p7U z^j=3xFtMtG`n*9(Y;C@J%_zU5sCH; z_%FWeU ziWGpE`?3qF4&BV62|~K;&1amBbHC-ASBh;_^jcAe)*+<(>UpeMj22V-i{_no7(`4Q zshLr#JZ@t~;2m<3rLn5K80L?(k4?7YtB4v#NA#{O`7i}{+j84ZOuYC7$wb7;5z`_! z4`;7V?Ur+XjbT=WcQTFR67WngFDGp|OxZx1_QirYsbbboQPjg@MV zn-!Bs-sdNQ-wvRV$nosyQ3m$dEt>`z;(8{p@J05}4Sak>X+WoE} z^W+4}&$hVW`&rQqVBeeU+B#CHWf)OHwELp-Pd4g1(Jxc{OdXy3oog%NxwY+X?~dZ3 z14ZOtDov*Ep2_#bzDs{WhMg|PsW*I5~w*$Y_c;P4eQ9x?de>Q6}s1?eIy&6i-1*a z0%&+Y!fz5mh?c-)^0aj=Wh}v>OA6dX8Wve=VYwyECja5GY-4r8x&pW!Q#Qd6POuJD z{mGF8x9@a(VD*>&UX#=L{kQVKn-@`!nF|L3GNWzxpWQ35a86Q+eftAe1TDbTj$FL- z+#6MTyOo=H9C-EtN`^iQ_auUAj~5Ro`tpT!#N>cpM6K;PXKo5G6a?S7G5*kJg_r$pLvJCOjTmyHGH*n+SGGfkgv|Hmy~;RgB#i+Lf|eE zyn2LHGj~0Y=m312RdLw5dX;+KyD99y-mfC+QpP~L84G(#0e7M?g!O9WNTgXr11|}O zJE~8-1^-mIIp>(Oo0I70^J7PRrTl?hQ4E;@{PblZPSEppVNRxL_)0K~f!%wLci)xSO)joM03s9X`rr6J~0+KSMLvH{}a;{io=U z-J{)(KUu;r7dPk_(GyQX!)s;-^n3>chJ~PuL*8A%%cd~E&I=TM!&6Xn{FH(w==-@5 zUUjTkDS}SUTB#Ec3g^;bR05(*@Cz#B$en`FdV4uVUM)#XI-7V!S-+UXLA(G|K|E@a z7DM<$>&aB{;Ls|tk(=y9i1^2`PBhc&^Lz)bkM2}Oi~l3!pxZR|2{F(r4BBM>B*ZLQ$({AV-! zzcxT&|JeZLfr3E)y#e|LRYPNT<}3Yh+pNqKzyKKnmWr0M)eexO!+WKX&!!kgh73{D zB=MBq`!ou;D3L-Ypm%eT0zMsx7j6kp(>CBZRX%I?`SOzcI5Sn$e0b1n-|$g~i+DJr zW~iav;W*F_L?MNaj5s5#)@uj0;eQsXd_H&*tKpmcLK6mL2!Ood&!?FQa zBgmnvMI-5SObWCjJ;++=x^w@6xjc8)RFF0yD&SZ)hDUw4Nz(_e?Whj<1D zb89#Dd!8|8bJb_UZ0>D`dSK28+vrGi%i*66ic>#QZ@wDIy(=!5vK@@8$xl*sF4~;Ju%_CS82PNF zMy>w+BjKi4lUm_NQZuFKyr3!fJs&v*pI6cOQmXY+mU}{b&Vwm~z(Jgq5a;Wsn(D!G{ z*Rx@S^e;&jAtk`($BM}oFKIRUHYo#=U*kphdD~IT0-mdFOUK407C(K*1;>+sd3|Lh zdF!@K$oSF;3JG7Uk7Jg2E)RZuE3Do1o@4^|*%r+CI)C^6#@GE$_~-X%L*Q~M92gJx z|7cVgBqWE>PLct8+Np(e<(W)?@bC#pqw%Wp$=NsRc&wa?8G`z3+?#MvCnjo#gMu)A z%|3_JlcV8CS-;mXg~%8++lM0g;0*`G7H>E*+_N9x4q6@tudqjZiSFbD$W3dHBV9!q zcD$LKaB(WRQ5!EOTCDsk>CDj7`_W#*GA1exS&Yc%sPFrpa}g4J+JdL|IIKKON>@9B zYG7vub0;LC^A~Qc{EET6fG&sUY6P^`tJ0i@=mbFyLC`Od;)i%`m6(Z>U77-0=kuOK zQGv^GcRYh|=59IT^ghHII;nur-Hh^_P6TNaiwrJ>3CvDyeY94q6!fnE%v+4v9gqA5 zIu8KTC%F?)_j2OlR$4DLJqBI>mgiC; z{E3k{!fZ)+xz>TY1@!rh)G8;~W_A=IHYDMU%GDXF6HC4DB>LHMoBP?yXzd8SH#W~d zpqdC`FeHCJh6}o>wR*jl#40f=oft|0)i{H}y#`zl3rVy@U?Oh+#0%gn5l@VOP~Lk% zxt`#6HBn?eGlPU1d&UYTQXXPrQaWY)T0dmbsaZa~Zc??Xb(AR=)t; z{S5b~5Yf3%*bX3G$|o6a+8MA7EBsKtx9mw-ZFILz3Xh5n8}78c!57>DKeD_wtnSCQ zy>zOy=c>zS=`p^Mmahn;(;O3Rm1bI1I8ZM-jKnnod#Cvew0=IJqw3I7 zh!QN_l!ra_5sRI~LP*dw?;5!rPWq?-U67i)vZn z$c8=86kM$IIU=9%vz}pPGwiL8Mo2SR1L+s197AH4qejrzLa&44(6Bo2XjmZFxh6bP ziTHVZnVX_NGW^`K3$h0AQImlDdf3Q2(*Zlg56)G&uD;}}V4e0H!zO>d)~v-JsGxZK zJ1)wEw73-QxMh~z?)#*Th6@He+)EqFT>iQY8u--90L!>d%$)i3mmh3ixsnRxnl411 zZG@F;u~-j&*?2b{&pD#zL2@RV?U31^y`t;?X=G9n$W2HoTzZTOoeE zpd=O%!%&qdlUF37$ zzJ-I|^S}Ka43!g0gR<$#Z6{g~%dr0>w3;r85OOTpod1=e3&rXGHUug`rG4b2CsU46 zQczM>9;9bJoNuj|uvsL~ZQrDIHTGI(BD;r_`&<@2aU%t#60O6vuXafFz3`?Pc_r7-ozw zY5nBbo>dNZxtNv5AKxV|oVXI-A@)6=jr>};Hi;myT=2?7Q3Obw`kiKb^fYd-{k0u`Xn}*;WC!P zeG&Di&WZ;6!At|#8yBvj>XU()YU_f%19J;tRkrjpnNki`HkJwkxcYmUnUEh36(_EE z#C_$Sy5szaf(h65&WyP)(&d*&Z=2JVGMT5HX2u3anCEe;hmdqyJZ}Wx!V`&^a~0A{ z^bo=7;1<_St1H?M`#)9=s+GvR;g(+7q-7aP=(MZmI+ECHFFuSVDw0Q+I%eRk-;n5| z+3q}cBpKxeM$q4fFrl1~(7{qLiMrmlg<(&k#9xTy0i&b+nC?G3M9^LlOah2?jim32 z0qT{Hz{#a;$!-QfV0eD{#kj6@Io{f()5>49K7RpOVTl|Qv z-`ukEVbvEsiyIzlV)oQb&BfeG@P8(+54f(Y%Ca8=@qdaXZA=??L-BqID=GM>8?r*Y zKJGcLJj3{&2dmdRrb>^y6yEJZOqqA8uo!6}UU^bQRZF@QA$OzLAO%^C(fN55E%*(k z-gCAYAMn)y80hkB@q7+&G`M*aqaH7WHSHR-$v#QInmXq}O1jQtqn~$(d+TraxW7_i zc>nF5z0*dHF}S*Bc#qbN@Qw8aTSEVUip6`$Uh-HPAJiEN?JoJX4mfd46jv(sZVAge zr+vD_&)qBBEc6dS39bmVf<&V2bzW#0cb+^s257D%j2iU`IM%f~1COw1D!lJpGRBU? zUpemrwtbl*a>8cOa;PgzR~Z(GzD5^Q5l$7`JRlq9ihfjjcPiznU#VM)6uw+!rH;NV z-JXU>Uzz0~;1#42a0s_C@8=OA`_}avS+0JPA=iy3O<2cizxO=7!50r(bhiLwiqq;T zgOr1@i_wjY^r;V$8$`HMKKLeFA6}?mAnX4wt2Pg9 z-Z5cY7Mr{>{CPq^mrwD4%#BD3^~aVuC5y-HAR{so2lV3odiLxBUt#TcbrU0%loq*m z7k~uS{3#nHYi#QPMJg)_4ddsdH7uCpOex2<{mqZHddyp0C$LwK*>!IbPBl-&+1{Xn zhf^Fw?Qk^&ryBkx*=tTtkk|@EV+8X1-J`A0>Hee*vn?v?hyi-BPS3$4j_nK7K1h|a z!`;RE(tT~3&Nq*7G%H87G<`T~#(2*At)p_x(v>LjB6au3iVbySPN9a+AG^zsPv<0e zsIaqvNC}VdG=y%(-2IhYbwf&6_ge(@gQM!fCcoaYn+N!n#7Ojud%*4Z{o=9qxasm8 zGJV>QqRrREK_^Sw?rTyC&#YCHN8g!x#xP7e=PVcfnyEOv@cFh(YES;Q?Y<7cZ1>X2 z4f6b8ItT_gq}(Dmq&mCD9km$UyR`pg*TK;0thwEt^i$3y&d10#GpZ!`kvA^DTO3rS zWOl=SQ{iTK!0U|m`h%$D3$uG02zZu~hn-^rov71RB&+=W7PY5GredVQ_UVd~e09~M zVnYvcti6>sFU2txJO5zINwnVT*E*h3SuWOnGv`@2FY-}zQmx$Y&zGMK6m9zF<7(Nf znJ9v5VupM;w>gD;g>^GlVp)|X%F?_T7$zl(mvJ-*>G{drPsn!*-T`hxOSv^wr4irD zbnVfbMY8J;H4Nrj=a#6uJ*@^RoxcyIP+kYPp|kfD6qo!CxZ3_GblTHvV9jE+!2|1Ru-9H-RX1rQx;g5?L^PZbnjQMf7 zw3g0zwWlw2%xR12V?QE0i?xRS;J;o(|0xJp!s!ege3RY zE7so)RM~`FrFVx1TCSPxQ_dyX3b&2ZCl4?ORMh0@ND)_;)CzM?lq)nPxiH5LeaIbXNdKM~1!h+=dwox!7@F6p4 zv2pD58NyINCSg<${b#QFu7H7ta^L2~^IwVg>xZ*VI~}z_`8`!5oz?067uy~WeQlH5 zmCJlbBJUdd{GLDDKSyxswB(|J2*O#4I1geaM5(Q9gdAyHl>Hd6V%qPovy?`*O}8md zf=aQlJGJd@)d|Otm0QA}aVxxcm2_h%@-?wptOyd?C01`&EFQFyvr;OKqEk3rqpBJ+ zHuJKm=c^?8bP#{Aekl2d>>)gn!yLlR4g%c~g9UPxd#U>KkO{BBwnYr1Bl4+E(ED$fyj>i+Yqi!OthhRy-T zrh;q6euWTI#$K~v$->}XlwNod$-tMP3As~wN8aGqs}(Gqtl~~!jSRyK-3&w1G|nN8 z0fvF^--iY@kx29sKcM^VuW?E9N$CQSj`kuH#`?LAV?MnM*VX!2It>2Lw^GF)IfiwNkp#t~wt@X$m(Aeq$G+Kls@u3; zw_3Lb6V}XTX4{*l^7T@|`PZ~?0<{)b_|;mEy-N~`{PU>M$E%%*)6vWx|KWT+FWy?e zy8U0Rm9fMGTH(rMOj~AoEQ_Ex76>-1H`^aca*gt|Ysnz>IHimDJB569pC z1`c6iQ6jxwo*!j?uYQR5j=(#`XSsvRRGFS)WVx%*Uj>r(&P*C z*4Vj9Q%Pea^EDOU(VMEyNjJ#a>E7xqSjvduU@)vjSVi)Y!AaqnlMEW?`NI~DMde?M z>l&M6v?8qM_G-`EKh!-`ylqVpO)r>;ZT-<2rSQ=YZ!;Cko0OVjVdMt6xD z)JT(tf}lJ;XriNaL0MU$w%&sC@@SG(~A^7>$qV)8lBZx>gh zio!QPBx6<*yFQKaS!pY|*qal{86^iY5nP{~NWe3FGt#s^li|r~Wj2NTqAbilJUmP`TFn0-9hv<6GRh|v}H5I_KlaotVgNO{^fNfSndmE13i?HlasL;R6uW#8zGpLE5Xrve%CUa zJdxPn-yd%(1S)7?d6K zzQ(7>-@T#o#^D_g-?W-8U<@uuT&Gve+{_GXn>{qlq7NzvfdBi)nFw8+ zTY_7bTZLOK;pc-WA{3CYP)?SR(#8e{@q+(x*G9`jL*0T1?%z6E6jhgxosjFnYCVlB zFwZ|fuilv(KpqfgR98<^#G*TgjQAYUcmNd*-B?;>QHStdIi@h8POXl#W986Js=ZrZ zvHU_)<+iinIU@qTkkGx!%SXqri(V^j?YAxMUW`#w!ErJS;_!PswS>312}~SOQPI~7 zJo7hD(Tk5^-TFPa6{MzX4hg=_#*&HT>g!CM_7y)Ao2{;5QH~scnpt|HJB5JM!cF(? zu=n~xxG>0heOnt0#okJ(4e#-=?(s4!rIp1DtNgyt%_7aD_`+{+&wtO%$q%Ika`6i@ z0+_f!Ja5`)oMheJCg=4xCIX2LvoNKQjsyWBQ&r5-&n=juJhD$sgpJHWLn&{DZTqrQdyoOn zDGe!2!-D3*U;NNbLjY_Tbo6F&sqFD21HZXGaeda4FMuCSytU#Mh!={I`V@`Sh){~E zm)OQG08xQeIgO==E}#lg9SB_gFmhZta?@!Qk!byZ(nv2O;q#e&DpI}ay~+~QHy?z(O z7fJs!EW%OZ(6yVGVHJyhmC*fg_ICviYbECP!#L$xOd22$UBJqC*3P;^Fv!1^GbV*o z#`lw`eYmFHl>gY)^$+UNYX(z~owE-X4rs$Eg)Hzvwi%=7sKzBPqz9MNv+v)XODH*+ zz!h^1uHO2}m^87ANYB|ntmnPq94Ktv($>?a zC?A{MQNS{HR&Odn(UW5b_K_z}^G}8hFE0K>w$iFruyXrze9Qm_5>{pS93V1hm6EYwY&px8eCrKbvkt}wa z5l59BseR;4g#LU^`r@KVHlHnir)n`KNhln?N)?97Q51`E{C&CEO=1n^^uTS3`%74n66F;Re$~K(s1cwD`^ZFo&}*J$9Rx6wlNq*`&vM zWXvl9_ScX28=*Qcy`XFJt%U?825+j-pCopz_t{-}QeE$E`dm!tUUnPH8XOPU9vV!- zk(Gl}nBJoaqNk~MZ=A#DMo2G0#Pk@3J_-LacXn2vfEn-U~;Z>#PJh26pfPd#RVE6x47w(LzC-eR_M@=2@rKMAguw7!7pTsWv!o5iJRMwwr4nuJ4`!#x9=}j`mBeU z{xB|)9h-SOC^sk{RT2-<3z0X|Y)aG_jH^Y|gwtZ9yic(uWpW7AiqOYwoEO%Xo70&4 zR%qH)^MwNJfe?)2{H}r)dz&SYKkuO;9`(&hV)Nyeex0Vd&IcZ4pSVvnuNfWWqv0nb zFHZGZ&4-pT(j-yfc*7iJUp|-{NRl0A1f?;>v3x&kv?IUP$sFfz;+15TzrD7t;LcGA zc;lh#*s&M{%ZdwMxOCtEPIPR4iljWWynSb_rIXLIF-GyuTk&q|LTY5Dwe5;Rc)_Vc ze=En*PkX@sGd-=-oE61K%i#pHBzHK!kbZp{bZWn>5W_UuM9~0I#NE%ouz8d{anm3{l5?1_pRz)o1p~zqexKKdRMPG`>d?SG%jS9iQh!ZEv1@Inj-Z=~C_umwS&) zqENR%qsT(x7LMIGYd2t{a3jpgT5l8Hwt-soz{W0u*Z7&f;v2qHS82|(%5Ptj4bmxb z$XmlguWuVGTZpf5!jp;PS}7Odu1I=tU*xa``DASw;Qds8G$UKm3s;F?+uDL8HVrDx zA{Ar_4$~1O$7Vhb5ord0mv)q;gKeef{h~jur`i$90tI8Wrs=70VO(2Zu*m|dq7)e9 z=$L=DR$L+NHT{^HA30u`7z^7kHhOJ+juGh!E9uyDRyQ}Ad&)|+HQsj#UqZbSPns0q zS`T!G+kffHn2nbS^{5jwEC=frc;=Ptwg?v_Dd&qqEuEYuF*NUQ7;#5+>-O7O>@q%e zsQ5*Ggt8Xb@M~onS#2tlI0^lx*V-7{%D&O~^M!0Jh78NS6 zc$g6R`SdK)np-ZLl{T}XT`SJS%k1Sgnf#vg z09eq8gy#b4qHl;X^UEI^xmDWPr8fY3PivYakJ0;ed)Tt}+x1?5IHGh`?u_pH7T=DQ z)$>S<6?oxUPJR!LBr7T=1(N7iZi&)4(0CSBwiqeGzBddeEpuYFDJr)D>_^XogzLLj zNP<^7CX+3_>u4j2W13pb7I5$>u*ZJ#QHEjHz~_{oaoVY-_Y&gKL?gj+y{S&<0lat0 zp63iJZ#>I#*C6Qds!xw0vJKW!0+Uni_?5FAX~(R5HekKfmD+hOpD1Cj{<%z!KiF?;YJSr z59SV;yf?2Mu|4h4KpoivUr`B6G17NGt^lM#xM8j6p8#<3kQ(U&n;|F%)ysVh3B<5F z8}~te*E>GCc;dRnrxcM^B1x*Au?>eAU)azae~dgn!@W)Nmdg~d0_U;hP8tYa|IElZ zO!iuNI7a+=`n^r}(r9z0@Z*(ODd_AWKeSEu_cNYBFY~E73ukt%86#&^N#DAeBA{(Y zZ-`i+FSJQ5ztO6l<)F{7!@OBw#O1wPnYAun6Pr)3ljh7?&(?=`1O`tkUS^48ML7dH zIRRg?y6Y9PT8}Jea1`6FW<5`emQ@3TM3Xv0747X`oQw2}&E++`!9WN{z=Hz+c^e%H z{ByLTf#n5)APye%Ke7e?d+q`X`cGvE1%eqN0<-}Kgg}po4CMzylX)Qsp#OQYgCKM; z@Pa|+V4k?;GdI30Kn7u|2JwF@Lw!|c==%e zVgUx^`+FonAn?x;`G;c=4D?4j4<-I2nPQ>cTdLudf`Ao5b$60!ywRqIpKrw{yim6 zwofbh&p_b+MLz`m4{H8YgJ3+6zv+L{x&ZzQgMgv`3WgW_ulEQ9gZ>d<`BVO9+W+tm z27~zi0sg^wc=`Tj;mHTj-_rzn`c(WqVxFfp_BZ`Jyg<<30fGTMJn(;kPqh9$$6z3s z_wNydpBVf%1_S*a3>5VA+5F!TyEqwJ*_t^$Nx9H)t6O=RA<{sTbA%CS3;+_md{9Z= zrxc+um?Q)Sk%Wj!hy$efB%pjxUs_(Uu;Bl13;jP@InFM|PA=|FX66`B2mlJfU}Th3 Imcsb|0M1jzg8%>k diff --git a/tzpfms.ps b/tzpfms.ps index e9411f8..2dbfd15 100644 --- a/tzpfms.ps +++ b/tzpfms.ps @@ -1,15 +1,15 @@ %!PS-Adobe-3.0 %%Creator: groff version 1.23.0 -%%CreationDate: Tue Mar 5 18:26:36 2024 +%%CreationDate: Tue Mar 5 18:29:52 2024 %%DocumentNeededResources: font Times-Roman %%+ font Times-Bold %%+ font Courier-Bold %%+ font Courier-Oblique %%+ font Courier -%%+ font Symbol %%+ font Times-Italic +%%+ font Symbol %%DocumentSuppliedResources: procset grops 1.23 0 -%%Pages: 10 +%%Pages: 15 %%PageOrder: Ascend %%DocumentMedia: Default 595 842 0 () () %%Orientation: Portrait @@ -237,8 +237,8 @@ setpacking %%IncludeResource: font Courier-Bold %%IncludeResource: font Courier-Oblique %%IncludeResource: font Courier -%%IncludeResource: font Symbol %%IncludeResource: font Times-Italic +%%IncludeResource: font Symbol grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72 def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef @@ -276,20 +276,389 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron %%BeginPageSetup BP %%EndPageSetup +/F0 10/Times-Roman@0 SF(ZFS-FIDO2-ADD-B)72 48 Q -.4(AC)-.35 G 42.103 +(KUP\(8\) System).4 F(Manager')2.5 E 2.5(sM)-.55 G 39.602 +(anual ZFS-FIDO2-ADD-B)-2.5 F -.4(AC)-.35 G(KUP\(8\)).4 E/F1 10 +/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF +(zfs-fido2-add-backup)108 96 Q F0 2.5<8a61>2.5 G(llo)-2.5 E 2.5(wa)-.25 +G(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F1(SYNOPSIS) +72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0(After)108 153.6 Q/F4 10 +/Courier@0 SF(zfs-fido2-change-key)7.564 E F0 5.064(\(8\) deri)B -.15 +(ve)-.25 G 7.563(st).15 G 5.063(he k)-7.563 F 5.363 -.15(ey f)-.1 H +5.063(or a dataset from a FIDO2 de).15 F(vice,)-.25 E F2 +(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15(xe)-.15 G +(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G +(umber of additional de)-2.5 E(vices.)-.25 E .273(First, the wrapping k) +108 182.4 R .574 -.15(ey i)-.1 H 2.774(se).15 G .274 +(xtracted as normally during)-2.924 F F4(zfs-fido2-load-key)2.774 E F0 +.274(\(8\), then a credential)B 1.604(is made as-if during)108 194.4 R +F4(zfs-fido2-change-key)4.104 E F0 1.604(\(8\) \(e)B 1.604 +(xcept the "primary" de)-.15 F 1.603(vice and all the ones)-.25 F .185 +(holding backups are e)108 206.4 R .185(xcluded from the search\); ho) +-.15 F(we)-.25 E -.15(ve)-.25 G .985 -.4(r, t).15 H(he).4 E F4 +(hmac-secret)2.685 E F0 .185(is instead used as a sym-)2.685 F 1.555 +(metric AES-256-GCM \()108 218.4 R F4(EVP_CIPHER-AES)A F0 1.555 +(\(7ssl\)\) k)B 1.855 -.15(ey t)-.1 H 4.055(oe).15 G 1.555 +(ncrypt the wrapping k)-4.055 F 1.855 -.15(ey d)-.1 H 1.555 +(irectly with a).15 F(random IV)108 230.4 Q(.)-1.29 E(This turns the)108 +247.2 Q F4(xyz.nabijaczleweli:tzpfms.key)2.5 E F0 -.25(va)2.5 G +(riable into).25 E F3(salt)108 259.2 Q F2(:)A F3(credential-ID)A F2(:)A +F3(credential-public-key)A F0([)A F2(.)A F3(backup-salt)A F2(:)A F3 +(backup-credential-ID)108 271.2 Q F2(:)A F3 +(backup-credential-public-key)A F2(:)A F3(IV)A F2(:)A F3(encrypted-key)A +F0 1.666(]...)C F4(tzpfms.key)108 288 Q F0 2.238 +(is actually a dot-separated list of de)4.738 F 2.238(vice b)-.25 F +4.738(undles. The)-.2 F 2.239(\214rst one is as-described in)4.738 F F4 +(zfs-fido2-change-key)108 300 Q F0 5.181(\(8\). Subsequent)B 2.681 +(ones also include \(identically-encoded\) IVs and en-)5.181 F +(crypted blobs.)108 312 Q F4(zfs-fido2-load-key)108 328.8 Q F0 .081 +(\(8\) shops assertions around de)B .081(vices in a de)-.25 F .082 +(vice-major order \212 depending on)-.25 F(de)108 340.8 Q +(vice numbering, a backup may be loaded e)-.25 E -.15(ve)-.25 G 2.5(ni) +.15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.)-.25 E F1 +(ENVIR)72 357.6 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 +(TZPFMS_PASSPHRASE_HELPER)108 369.6 Q F0 .046(By def)133 381.6 R .045(a\ +ult, passphrases are prompted for and read in on the standard output an\ +d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 393.6 +Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G +1.596(ill be run via)-4.096 F F4(/bin/)4.096 E F2 3.262(sh \255c)B F0 +(to)4.096 E(pro)133 405.6 Q(vide each passphrase, instead.)-.15 E .643 +(The standard output stream of the helper is tied to an anon)133 422.4 R +.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) +133 434.4 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 446.4 Q F0 +(Pre-formatted noun phrase with all the information belo)160 446.4 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 458.4 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 458.4 Q +2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 470.4 Q F0("ne)160 +470.4 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G +(assphrase, otherwise blank)-2.5 E F4($4)143 482.4 Q F0("ag)160 482.4 Q +(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 499.2 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 +.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +511.2 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 +G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 +(FIDO2 back-end con\214guration)72 528 R(En)87 540 Q(vir)-.4 E .625 +(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 552 Q F0 +(If set, enables lib\214do2 deb)173 552 Q +(ug logging to the standard error stream.)-.2 E F1(De)87 568.8 Q .625 +(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 580.8 R +.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) +3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F +(the assertion is shopped around to e)108 592.8 Q -.15(ve)-.25 G +(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 609.6 R F0 +(The lib\214do2 documentation at https://de)108 621.6 Q -.15(ve)-.25 G +(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 638.4 R +F0 1.6 -.8(To a)108 650.4 T(ll who support further de).8 E -.15(ve)-.25 +G(lopment, in particular:).15 E F1<83>128 662.4 Q F0(ThePhD)7.5 E F1<83> +128 674.4 Q F0(Embark Studios)7.5 E F1<83>128 686.4 Q F0(Jasper Bekk)7.5 +E(ers)-.1 E F1<83>128 698.4 Q F0(EvModder)7.5 E F1(REPOR)72 715.2 Q +1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 727.2 Q +(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 +(\001nabijaczleweli/tzpfms@lists.sr.ht)108 744 Q F0 83.762(,a)C(rchi) +-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) +108 756 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 +817.889 Q(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP +%%Page: 1 2 +%%BeginPageSetup +BP +%%EndPageSetup +/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) +-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 +SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) +-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) +-2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 +124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF +(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 +2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 +(,)A F2(zfs-fido2-add-backup)3.766 E F0 1.266 +(will open its encryption root in its stead.)3.766 F F2 +(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 +SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) +-.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF +(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A +(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) +-.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 +(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.555 E F0 -.1(wa) +3.555 G 3.555(sp).1 G(re)-3.555 E 1.054(viously encrypted with)-.25 F F2 +(fzifdso)3.554 E F0 1.054(and the)3.554 F F1(FIDO2)3.554 E F0 1.054 +(back-end w)3.554 F 1.054(as used, pre)-.1 F(vious)-.25 E 1.272 +(credentials will be deleted from their de)108 223.2 R 1.272 +(vices \(as-if via)-.25 F F5(zfs-fido2-clear-key)3.773 E F0 1.273 +(\(8\)\), if a)B -.25(va)-.2 G(ilable.).25 E .594 +(Otherwise, or in case of an error)108 235.2 R 3.093(,d)-.4 G .593 +(ata required for manual interv)-3.093 F .593 +(ention will be written to the standard)-.15 F(error stream.)108 247.2 Q +(Ne)108 264 Q .464(xt, a ne)-.15 F 2.964(wc)-.25 G .464 +(redential of type ES256 is generated on the de)-2.964 F .465 +(vice \(with relying party ID)-.25 F F5(fzifdso)2.965 E F0(and)2.965 E +.499(name equal to the dataset name\) with the)108 276 R F5(hmac-secret) +2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 +(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 288 Q +(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ +n, the credential is asserted with a 32-byte random salt, which hashes \ +it with de)108 304.8 R(vice-pri)-.25 E -.25(va)-.25 G .963(te data,).25 +F .138(and thus generates the wrapping k)108 316.8 R .438 -.15(ey \()-.1 +H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) +2.637 E F0 2.637(\)\). This)B .137(mimicks a)2.637 F -.8(We)108 328.8 S +(bAuthn login step.).8 E(The follo)108 345.6 Q +(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 +357.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> +128 369.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 +(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 381.6 Q F0 +([)A F2(.)A F0 1.666(...)1.666 G 1.666(]...)-1.666 G F5(tzpfms.backend) +108 398.4 Q F0 2.707(identi\214es this dataset for w)5.207 F 2.708 +(ork with)-.1 F F1(FIDO2)5.208 E F0(-back-ended)A F2(tzpfms)5.208 E F0 +2.708(tools \(i.e.)5.208 F F2(fzifdso)108 410.4 Q F5 +(zfs-fido2-change-key)60.228 E F0(\(8\),)A F5(zfs-fido2-load-key)56.727 +E F0(\(8\),)A F5(zfs-fido2-add-backup)108 422.4 Q F0(\(8\), and)A F5 +(zfs-fido2-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 439.2 Q F0 +.486(is a colon-separated tuple of unpadded URL-safe base64 blobs; the \ +\214rst one is the ran-)2.985 F .217(dom salt; the second represents th\ +e ID of created credential, and the third \211 its public k)108 451.2 R +-.15(ey)-.1 G 5.217(.T)-.5 G .216(here e)-5.217 F(xists)-.15 E +(no other user)108 463.2 Q +(-land tool for deciphering this; perhaps there should be.)-.2 E +(Finally)108 480 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 +G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5 +(keylocation=prompt)15.506 E F217.172 E F5(keyformat=raw)108 492 Q +F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk) +-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 +G .106(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F +(to clean up the properties, or to issue a note for manual interv)108 +504 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 520.8 +S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.556 E F0 +6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 +(command succeeds, all is well, b)108 532.8 R .729 +(ut otherwise the dataset can be manually rolled back to a passphrase) +-.2 F(with)108 544.8 Q F2(zfs-fido2-clear-key)5.146 E F3(dataset)8.646 E +F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F +10.313 E F5(keyformat=passphrase)108 556.8 Q F3(dataset)6 E F0 +(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E +F2(zfs-fido2-clear-key)108 573.6 Q F3(dataset)7.607 E F0 1.607 +(can be used to clear the properties and go back to using a)4.107 F +(passphrase.)108 585.6 Q F1(OPTIONS)72 602.4 Q F2109.666 614.4 Q +F3(backup-file)6 E F0(Sa)203 614.4 Q .352 -.15(ve a b)-.2 H .052 +(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 +E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 +F .694(This back-up)203 626.4 R F4(must)3.194 E F0 .694 +(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 638.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 650.4 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F1(ENVIR)72 667.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 +E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q F0 .045(By def)133 691.2 R +.045(ault, passphrases are prompted for and read in on the standard out\ +put and input streams.)-.1 F(If)5.046 E F5(TZPFMS_PASSPHRASE_HELPER)133 +703.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw) +-4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.095 E F2 3.261 +(sh \255c)B F0(to)4.095 E(pro)133 715.2 Q +(vide each passphrase, instead.)-.15 E .643 +(The standard output stream of the helper is tied to an anon)133 732 R +.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) +133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(fzifdso 0)72 817.889 Q +(March 4, 2024)161.068 E(1)191.337 E 0 Cg EP +%%Page: 2 3 +%%BeginPageSetup +BP +%%EndPageSetup +/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) +-2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 +(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q +(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) +-2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B +(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 +1.666(FIDO2 back-end con\214guration)72 165.6 R(En)87 177.6 Q(vir)-.4 E +.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 189.6 Q F0 +(If set, enables lib\214do2 deb)173 189.6 Q +(ug logging to the standard error stream.)-.2 E F2(De)87 206.4 Q .625 +(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 218.4 R +.726(vice which supports the)-.25 F F1(hmac-secret)3.227 E F0 -.15(ex) +3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F +(the assertion is shopped around to e)108 230.4 Q -.15(ve)-.25 G +(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 247.2 R F0 +(The lib\214do2 documentation at https://de)108 259.2 Q -.15(ve)-.25 G +(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 276 R +F0 1.6 -.8(To a)108 288 T(ll who support further de).8 E -.15(ve)-.25 G +(lopment, in particular:).15 E F2<83>128 300 Q F0(ThePhD)7.5 E F2<83>128 +312 Q F0(Embark Studios)7.5 E F2<83>128 324 Q F0(Jasper Bekk)7.5 E(ers) +-.1 E F2<83>128 336 Q F0(EvModder)7.5 E F2(REPOR)72 352.8 Q 1.666 +(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 364.8 Q +(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 +(\001nabijaczleweli/tzpfms@lists.sr.ht)108 381.6 Q F0 83.763(,a)C(rchi) +-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) +108 393.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 +817.889 Q(March 4, 2024)161.068 E(2)191.337 E 0 Cg EP +%%Page: 1 4 +%%BeginPageSetup +BP +%%EndPageSetup +/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 +F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF +(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.587 G -.25(ew)-3.587 G +1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G +(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 +108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 +/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 +(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G +2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E +F1(FIDO2)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F +-.25(va)-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F +13.307 E/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E +F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. loads)118 +201.6 R .79(the primary and e)3.29 F -.15(ve)-.25 G .79 +(ry backup credential, and for each success, if the de).15 F .791 +(vice containing it)-.25 F(supports the)133 213.6 Q F4(credMgmt)2.5 E F0 +(feature and has a PIN set, tries to delete the credential from the de) +2.5 E(vice,)-.25 E 5(3. remo)118 225.6 R -.15(ve)-.15 G 10.689(st).15 G +(he)-10.689 E F4(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A +F0(,)A F4(key)14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3 +(dataset)133 237.6 Q F0(.)A -.15(Fo)108 254.4 S 5.859(re).15 G -.15(ve) +-6.109 G 3.359(ry remo).15 F -.25(va)-.15 G 5.859(lf).25 G 3.359 +(ailure and missing de)-5.959 F 3.36 +(vice or PIN an instruction for manual remo)-.25 F -.25(va)-.15 G 5.86 +(lw).25 G(ith)-5.86 E F4(fido2-token)108 266.4 Q F0(\(1\) is issued.)A +(See)108 283.2 Q F4(zfs-fido2-change-key)2.5 E F0 +(\(8\) for a detailed description.)A F1(ENVIR)72 300 Q 1.666(ONMENT V) +-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 312 Q F0 .046 +(By def)133 324 R .045(ault, passphrases are prompted for and read in o\ +n the standard output and input streams.)-.1 F(If)5.045 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 336 Q F0 1.595(is set and nonempty)4.095 F +4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 +(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 348 Q +(vide each passphrase, instead.)-.15 E .643 +(The standard output stream of the helper is tied to an anon)133 364.8 R +.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) +133 376.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 388.8 Q F0 +(Pre-formatted noun phrase with all the information belo)160 388.8 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 400.8 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 400.8 Q +2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 412.8 Q F0("ne)160 +412.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G +(assphrase, otherwise blank)-2.5 E F4($4)143 424.8 Q F0("ag)160 424.8 Q +(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 441.6 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 +.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +453.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 +G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 +(FIDO2 back-end con\214guration)72 470.4 R(En)87 482.4 Q(vir)-.4 E .625 +(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 494.4 Q F0 +(If set, enables lib\214do2 deb)173 494.4 Q +(ug logging to the standard error stream.)-.2 E F1(De)87 511.2 Q .625 +(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 523.2 R +.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) +3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F +(the assertion is shopped around to e)108 535.2 Q -.15(ve)-.25 G +(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 552 R F0 +(The lib\214do2 documentation at https://de)108 564 Q -.15(ve)-.25 G +(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 580.8 R +F0 1.6 -.8(To a)108 592.8 T(ll who support further de).8 E -.15(ve)-.25 +G(lopment, in particular:).15 E F1<83>128 604.8 Q F0(ThePhD)7.5 E F1<83> +128 616.8 Q F0(Embark Studios)7.5 E F1<83>128 628.8 Q F0(Jasper Bekk)7.5 +E(ers)-.1 E F1<83>128 640.8 Q F0(EvModder)7.5 E F1(REPOR)72 657.6 Q +1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 669.6 Q +(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 +(\001nabijaczleweli/tzpfms@lists.sr.ht)108 686.4 Q F0 83.762(,a)C(rchi) +-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) +108 698.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 +817.889 Q(March 4, 2024)161.068 E(1)191.337 E 0 Cg EP +%%Page: 1 5 +%%BeginPageSetup +BP +%%EndPageSetup +/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) +-.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F +(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 +/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G +(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 +112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E +F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 +Q F0 1.142(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.642 E F0 -.1 +(wa)3.642 G 3.641(se).1 G 1.141(ncrypted with)-3.641 F F2(tzpfms)3.641 E +F0(back)3.641 E(end)-.1 E F1(FIDO2)3.641 E F0 3.641(,a)C 1.141 +(sserts the preserv)-3.641 F 1.141(ed chal-)-.15 F(lenge, HMA)108 165.6 +Q(Cking the salt with the on-de)-.4 E +(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) +.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF +(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 +(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 +(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) +.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 +(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.208 E -.25(va)-.25 G +3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 223.2 Q F0 -.55('s)C F2 +4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F +(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .046(By def) +133 264 R .045(ault, passphrases are prompted for and read in on the st\ +andard output and input streams.)-.1 F(If)5.045 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.595(is set and nonempty)4.095 F +4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 +(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 288 Q +(vide each passphrase, instead.)-.15 E .643 +(The standard output stream of the helper is tied to an anon)133 304.8 R +.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) +133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 +(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 340.8 Q +2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 352.8 Q F0("ne)160 +352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G +(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q +(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 381.6 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 +.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 +G(ther reason, the prompting is aborted.)-2.5 E F1 1.666(SPECIAL THANKS) +72 410.4 R F0 1.6 -.8(To a)108 422.4 T(ll who support further de).8 E +-.15(ve)-.25 G(lopment, in particular:).15 E F1<83>128 434.4 Q F0 +(ThePhD)7.5 E F1<83>128 446.4 Q F0(Embark Studios)7.5 E F1<83>128 458.4 +Q F0(Jasper Bekk)7.5 E(ers)-.1 E F1<83>128 470.4 Q F0(EvModder)7.5 E F1 +(REPOR)72 487.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 +499.2 Q(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 +(\001nabijaczleweli/tzpfms@lists.sr.ht)108 516 Q F0 83.763(,a)C(rchi) +-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) +108 528 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 +817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP +%%Page: 1 6 +%%BeginPageSetup +BP +%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 -1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 -/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([) +2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E +/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A +F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 -177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 +177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.978 E F0 .478(back-end \(e.g.)2.978 F F1(TPM2)2.978 E F0(for)2.978 E F4 -(zfs-tpm2-change-key)2.978 E F0 .478(\(8\) or)B F1(TPM1.X)2.978 E F0 +(zfs-tpm2-change-key)2.978 E F0 .478(\(8\) or)B F1(TPM1.X)2.979 E F0 (for)187 201.6 Q F4(zfs-tpm1x-change-key)2.5 E F0(\(8\)\), or ")A F1(-)A F0 2.5("i)C 2.5(fn)-2.5 G(one is con\214gured)-2.5 E F4(keystatus)128 213.6 Q F1 -2.1 -.25(av a)187 213.6 T(ilable).25 E F0(or)2.5 E F1(una) @@ -300,18 +669,18 @@ F0 2.5("i)C 2.5(fn)-2.5 G(one is con\214gured)-2.5 E F4(keystatus)128 2.5 E F1(no)2.5 E F0(otherwise)2.5 E 8.743(Incoherent datasets require \ immediate operator attention, with either the appropriate)108 254.4 R F2 (zfs-tpm)108 266.4 Q/F5 10/Symbol SF(*)A F2(-clear-key)A F0 1.778 -(program or)4.277 F F2 1.778(zfs change-key)4.278 F F0(and)4.278 E F2 +(program or)4.278 F F2 1.778(zfs change-key)4.278 F F0(and)4.278 E F2 1.778(zfs inherit)4.278 F F0 4.278<8a69>4.278 G 4.278(ft)-4.278 G 1.778 -(he k)-4.278 F 2.078 -.15(ey b)-.1 H(e-).15 E .566(comes unloaded, the) -108 278.4 R 3.066(yw)-.15 G .566(ill require restoration from back-up.) --3.066 F(Ho)5.566 E(we)-.25 E -.15(ve)-.25 G 1.366 -.4(r, t).15 H .566 -(his should ne).4 F -.15(ve)-.25 G 3.065(ro).15 G(ccur)-3.065 E 3.065 -(,u)-.4 G(nless)-3.065 E +(he k)-4.278 F 2.077 -.15(ey b)-.1 H(e-).15 E .565(comes unloaded, the) +108 278.4 R 3.065(yw)-.15 G .566(ill require restoration from back-up.) +-3.065 F(Ho)5.566 E(we)-.25 E -.15(ve)-.25 G 1.366 -.4(r, t).15 H .566 +(his should ne).4 F -.15(ve)-.25 G 3.066(ro).15 G(ccur)-3.066 E 3.066 +(,u)-.4 G(nless)-3.066 E (something went horribly wrong with the dataset properties.)108 290.4 Q .965(If no datasets are speci\214ed, all matching encryption roots are \ -listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 +listed \212 by def)108 307.2 R .965(ault, those managed by)-.1 F F2 (tzpfms)108 319.2 Q F0(.)A F1(OPTIONS)72 336 Q F2109.666 348 Q F0 -1.583(Scripting mode \212 remo)185 348 R 1.883 -.15(ve h)-.15 H 1.583 +1.582(Scripting mode \212 remo)185 348 R 1.882 -.15(ve h)-.15 H 1.583 (eaders and separate \214elds by a single tab instead of).15 F (columnating them with spaces.)185 360 Q F2109.666 376.8 Q F0 (Recurse into all descendants of speci\214ed datasets.)185 376.8 Q F2 @@ -326,26 +695,28 @@ listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 -(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R +18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 -24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 -559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 -F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F -6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) -108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R -18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 -(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) -54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q -F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666 +(zfs-fido2-add-backup \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 +(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) +108 583.2 Q F2 1.666(zfs-fido2-add-backup \255b)6 F F1(TPM2)6 E F4 72 +(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 +(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-fido2-add-backup \255ra)6 F F3(tarta-zoot)6 E F4 72 +(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 +(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 +(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 +(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) +108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 +(zfs-fido2-add-backup \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) 108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q(December 4, 2022)84.703 E(1)183.842 E 0 Cg EP -%%Page: 2 2 +%%Page: 2 7 %%BeginPageSetup BP %%EndPageSetup @@ -358,11 +729,11 @@ BP (EvModder)7.5 E F1(REPOR)72 160.8 Q 1.666(TING B)-.4 F(UGS)-.1 E F0 (https://todo.sr)108 172.8 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms)-.25 E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) -.25 E(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q(December 4, 2022)84.703 E (2)183.842 E 0 Cg EP -%%Page: 1 3 +%%Page: 1 8 %%BeginPageSetup BP %%EndPageSetup @@ -371,159 +742,161 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 -(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T -5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 -E F0 5.266(will open its encryption root in its stead.)7.766 F F2 -(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E -(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) --2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 +E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.866 -.8(To n)108 153.6 +T 1.266(ormalise the).8 F F3(dataset)3.766 E F0(,)A F2 +(zfs-fido2-add-backup)3.766 E F0 1.266 +(will open its encryption root in its stead.)3.766 F F2 +(zfs-fido2-add-backup)108 165.6 Q F0(will)14.655 E/F4 10/Times-Italic@0 +SF(ne)14.655 E(ver)-.15 E F0 12.154(create or destro)14.655 F 14.654(ye) +-.1 G 12.154(ncryption roots; use)-14.654 F/F5 10/Courier@0 SF +(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 211.2 R .926 +(data will be silently cleared.)108 223.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q +(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 (\), and sealed)B .586(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q + passphrase to protect the k)108 264 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 321.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 +108 333.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 (ork with)-.1 F F1(TPM1.X)2.792 E F0(-back-ended)A F2(tzpfms)2.792 E F0 -.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 333.6 Q F0 +.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 345.6 Q F0 (\(8\),)A F5(zfs-tpm1x-load-key)2.5 E F0(\(8\), and)A F5 -(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 350.4 Q F0 +(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q F0 1.412(is a colon-separated pair of he)3.913 F 1.412 (xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 -(\214rst one represents the RSA k)108 362.4 R 1.167 -.15(ey p)-.1 H .868 +(\214rst one represents the RSA k)108 374.4 R 1.167 -.15(ey p)-.1 H .868 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 374.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 +.15 F(pro)108 386.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 (CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 (he sec-)-3.913 F .379 -(ond represents the sealed object containing the wrapping k)108 386.4 R +(ond represents the sealed object containing the wrapping k)108 398.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 398.4 Q F0 6.721(.T)C +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.721(.T)C 1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 (-land tool for)-.2 F(decrypting this; perhaps there should be.)108 -410.4 Q(Finally)108 427.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F +422.4 Q(Finally)108 439.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F 17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 -(keyformat=raw)108 439.2 Q F3(dataset)6.107 E F0 .107 +(keyformat=raw)108 451.2 Q F3(dataset)6.107 E F0 .107 (is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 (.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -451.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 468 +463.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 480 S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) -.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 -(command succeeds, all is well, b)108 480 R .729 +(command succeeds, all is well, b)108 492 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 492 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E +-.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F 2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F -10.313 E F5(keyformat=passphrase)108 504 Q F3(dataset)6 E F0 +10.313 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 520.8 Q F3(dataset)7.607 E F0 1.607 +F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.607 E F0 1.607 (can be used to clear the properties and go back to using a)4.107 F -(passphrase.)108 532.8 Q F1(OPTIONS)72 549.6 Q F2109.666 561.6 Q -F3(backup-file)6 E F0(Sa)203 561.6 Q .352 -.15(ve a b)-.2 H .052 +(passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q +F3(backup-file)6 E F0(Sa)203 573.6 Q .352 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 573.6 R F4(must)3.194 E F0 .694 +F .694(This back-up)203 585.6 R F4(must)3.194 E F0 .694 (be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 585.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 597.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 614.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .638(Bind the k)203 614.4 R .939 -.15(ey t)-.1 H +(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .638(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 -(hange, the wrap-)-3.139 F .463(ping k)203 626.4 R .763 -.15(ey w)-.1 H +(hange, the wrap-)-3.139 F .463(ping k)203 638.4 R .763 -.15(ey w)-.1 H .463(ill not be able to be unsealed.).15 F .462 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 638.4 Q F1(24) +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F1(ENVIR)72 655.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q -F0 .045(By def)133 679.2 R .045(ault, passphrases are prompted for and \ +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q +F0 .045(By def)133 691.2 R .045(ault, passphrases are prompted for and \ read in on the standard output and input streams.)-.1 F(If)5.046 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 691.2 Q F0 1.596(is set and nonempty)4.096 +(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 703.2 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 715.2 Q (vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 720 R +(The standard output stream of the helper is tied to an anon)133 732 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 -(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E(tzpfms 0.3.4-28-g7e4ea2c)72 +133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q(February 28, 2024)84.698 E(1)183.837 E 0 Cg EP -%%Page: 2 4 +%%Page: 2 9 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 36.913(ZFS-TPM1X-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 34.412(anual ZFS-TPM1X-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q +-2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 +(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G +-2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G (he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 124.8 R 2.678(te)-.18 G .178 +(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 (xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF (127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(TPM1.X back-end con\214guration)72 153.6 R .625(TPM selection)87 -165.6 R F0(The)108 177.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 +1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 +177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 .229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 (\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 189.6 Q +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 201.6 Q (vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 206.4 R(rouSerS) +(to specify a remote TCS hostname.)2.5 E .111(The T)108 218.4 R(rouSerS) -.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -218.4 S(ing one of the earlier ones with, for e).1 E +230.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 235.2 R F0(The T)108 247.2 Q +(See also)87 247.2 R F0(The T)108 259.2 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 -(The TPM 1.2 main speci\214cation inde)108 264 R 6.915(xa)-.15 G 6.915 +(The TPM 1.2 main speci\214cation inde)108 276 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 276 Q F2 1.666 -(SPECIAL THANKS)72 292.8 R F0 1.6 -.8(To a)108 304.8 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 288 Q F2 1.666 +(SPECIAL THANKS)72 304.8 R F0 1.6 -.8(To a)108 316.8 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 316.8 Q F0(ThePhD)7.5 E F2<83>128 328.8 Q F0 -(Embark Studios)7.5 E F2<83>128 340.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 352.8 Q F0(EvModder)7.5 E F2(REPOR)72 369.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 381.6 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 398.4 Q +.15 E F2<83>128 328.8 Q F0(ThePhD)7.5 E F2<83>128 340.8 Q F0 +(Embark Studios)7.5 E F2<83>128 352.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E -(https://lists.sr)108 410.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E F2 1.666(SEE ALSO)72 427.2 R F0 -(PCR allocations: https://wiki.archlinux.or)108 439.2 Q(g/title/T)-.18 E +(https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E F2 1.666(SEE ALSO)72 439.2 R F0 +(PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E (rusted_Platform_Module#Accessing_PCR_re)-.35 E(gisters)-.15 E -(and https://trustedcomputinggroup.or)108 451.2 Q +(and https://trustedcomputinggroup.or)108 463.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ -r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 463.2 Q -(able)-.8 E(1.)108 475.2 Q(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q +r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q +(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q (February 28, 2024)84.698 E(2)183.837 E 0 Cg EP -%%Page: 1 5 +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -533,14 +906,14 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q -(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G -(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM1.X) -2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F -.25(va) --.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E -/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 -(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 +/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 +(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G +2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E +F1(TPM1.X)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F +-.25(va)-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F +13.307 E/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E +F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 @@ -575,7 +948,7 @@ F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q(December 4, 2022)84.703 E(1) 183.842 E 0 Cg EP -%%Page: 1 6 +%%Page: 1 11 %%BeginPageSetup BP %%EndPageSetup @@ -584,13 +957,13 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 -10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .191 -(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1(wa)2.691 -G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E F0(back) -2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 F .49 --.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset)2.5 E -F0(.)A .236 +112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E +F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 +Q F0 .191(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1 +(wa)2.691 G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E +F0(back)2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 +F .49 -.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset) +2.5 E F0(.)A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) 108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) @@ -655,7 +1028,7 @@ F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q(December 4, 2022)84.703 E(1) 183.842 E 0 Cg EP -%%Page: 1 7 +%%Page: 1 12 %%BeginPageSetup BP %%EndPageSetup @@ -664,132 +1037,132 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 -(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) -A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) -A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.676 -.8(To n)108 165.6 -T(ormalise).8 E F3(dataset)2.576 E F0(,)A F2(zfs-tpm-list)2.576 E F0 -.076(will open its encryption root in its stead.)2.576 F F2 -(zfs-tpm-list)5.077 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 -E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G -(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 -(\(8\) for that.)A(First, a connection is made to the TPM, which)108 -194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 -(dataset)3.055 E F0 -.1(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555 -(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F -F1(TPM2)3.055 E F0 .554(back-end w)3.054 F .554(as used, the pre)-.1 F -(vious)-.25 E -.1(ke)108 223.2 S 3.059(yw)-.05 G .559 -(ill be freed from the TPM.)-3.059 F .56 -(Otherwise, or in case of an error)5.56 F 3.06(,d)-.4 G .56 -(ata required for manual interv)-3.06 F(en-)-.15 E -(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 -252 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 +1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A +F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A +F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.319 -.8(To n)108 +165.6 T(ormalise).8 E F3(dataset)5.219 E F0(,)A F2(zfs-fido2-add-backup) +5.219 E F0 2.72(will open its encryption root in its stead.)5.219 F F2 +(zfs-fido2-add-backup)108 177.6 Q F0(will)14.655 E/F4 10/Times-Italic@0 +SF(ne)14.655 E(ver)-.15 E F0 12.154(create or destro)14.655 F 14.654(ye) +-.1 G 12.154(ncryption roots; use)-14.654 F/F5 10/Courier@0 SF +(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E +F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.054 E F0 -.1 +(wa)3.054 G 3.054(sp).1 G(re)-3.054 E .554(viously encrypted with)-.25 F +F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .555 +(back-end w)3.055 F .555(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 +235.2 S 3.06(yw)-.05 G .56(ill be freed from the TPM.)-3.06 F .56 +(Otherwise, or in case of an error)5.56 F 3.059(,d)-.4 G .559 +(ata required for manual interv)-3.059 F(en-)-.15 E +(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 +264 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 -(OPTIONS)2.794 E F0 .294(\), and sealed)B .588 -(to a persistent object on the TPM under the o)108 264 R .589 -(wner hierarch)-.25 F .589(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 276 Q 1.603 -.65(y, t)-.05 H .302 +(OPTIONS)2.794 E F0 .294(\), and sealed)B .589 +(to a persistent object on the TPM under the o)108 276 R .589 +(wner hierarch)-.25 F .588(y; if there is a passphrase set on the o)-.05 +F(wner)-.25 E(hierarch)108 288 Q 1.602 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 288 Q(The follo)108 304.8 Q +(the sealed object with.)108 300 Q(The follo)108 316.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 1.263 -(identi\214es this dataset for w)3.763 F 1.264(ork with)-.1 F F1(TPM2) -3.764 E F0(-back-ended)A F2(tzpfms)3.764 E F0 1.264(tools \(namely)3.764 -F F5(zfs-tpm2-change-key)108 369.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 1.264 +(identi\214es this dataset for w)3.764 F 1.263(ork with)-.1 F F1(TPM2) +3.763 E F0(-back-ended)A F2(tzpfms)3.763 E F0 1.263(tools \(namely)3.763 +F F5(zfs-tpm2-change-key)108 381.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) 2.5 E F0(\(8\), and)A F5(zfs-tpm2-clear-key)2.5 E F0(\(8\)\).)A F5 -(tzpfms.key)108 386.4 Q F0 1.509(is an inte)4.009 F 1.509 +(tzpfms.key)108 398.4 Q F0 1.508(is an inte)4.008 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 -(wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 -398.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 -(tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B -.866(be passed to)108 410.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +(wed by a semicolon and)-.25 F .823(PCR list as speci\214ed with)108 +410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +(tpm-tools)3.322 E F0 .822(-toolchain-compatible; if needed, it can)B +.865(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) -3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) -C(r)-3.365 E F2109.666 422.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A -F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) --.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A -.448(If you ha)108 434.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F +3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.366("o) +C(r)-3.366 E F2109.666 434.4 Q F0(")6.728 E F5(pcr:${tzpfms.key)A +F2(#)A F6(*)A F5(;})A F0 .728(", as the case may be, or equi)B -.25(va) +-.25 G .727(lent, for back-up \(see).25 F F1(OPTIONS)3.227 E F0(\).)A +.447(If you ha)108 446.4 R .747 -.15(ve a s)-.2 H .447(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) --.25 G .447(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 446.4 Q(.)-.65 E(Finally)108 463.2 Q 12.005 -(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 -9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 -E F217.172 E F5(keyformat=raw)108 475.2 Q F3(dataset)6.107 E F0 -.107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G -5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 -(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ +-.25 G .448(lent tool and set both of these properties, it).25 F +(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.006 +(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506(lent of).25 F F2 +9.505(zfs change-key)12.005 F17.171 E F5(keylocation=prompt)15.505 +E F217.171 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.106 E F0 +.106(is performed with the ne)2.606 F 2.606(wk)-.25 G -.15(ey)-2.706 G +5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .107 +(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 487.2 R .29(ention into the stan-)-.15 F(dard error stream.) -108 499.2 Q 2.625<418c>108 516 S .125(nal v)-2.625 F .125 -(eri\214cation should be made by running)-.15 F F2 1.79 -(zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 -(ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) -108 528 R .506(ut otherwise the dataset can be manually rolled back to \ -a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 540 Q F3(dataset) -11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) + interv)108 499.2 R .289(ention into the stan-)-.15 F +(dard error stream.)108 511.2 Q 2.624<418c>108 528 S .124(nal v)-2.624 F +.124(eri\214cation should be made by running)-.15 F F2 1.791 +(zfs-tpm2-load-key \255n)2.625 F F3(dataset)6.125 E F0 5.125(.I)C 2.625 +(ft)-5.125 G .125(hat com-)-2.625 F .507(mand succeeds, all is well, b) +108 540 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) +11.538 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.204 E F5(keyformat=passphrase)108 552 Q F3(dataset)6 E F0 +F13.205 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm2-clear-key)108 568.8 Q F3(dataset)6.029 E F0 .029 +F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 580.8 Q F1(OPTIONS)72 597.6 Q F2109.666 -609.6 Q F3(backup-file)6 E F0(Sa)203 609.6 Q .353 -.15(ve a b)-.2 H .052 +F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 +621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .352 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 621.6 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 633.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 645.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 662.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 +F .694(This back-up)203 633.6 R F4(must)3.194 E F0 .694 +(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.425(Bind the k)203 674.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 -G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C -1.424(ithin their corresponding)-3.924 F(hashing)203 686.4 Q F3 -(algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E +-1.666 G 1.424(Bind the k)203 686.4 R 1.724 -.15(ey t)-.1 H 3.924(os).15 +G 1.424(pace- or comma-separated)-3.924 F F3(PCR)3.925 E F0 3.925(sw)C +1.425(ithin their corresponding)-3.925 F(hashing)203 698.4 Q F3 +(algorithm)2.524 E F0 2.524<8a69>2.524 G 2.523(ft)-2.524 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.024(ill not be able to be).15 F 2.5(unsealed. There)203 698.4 R(are)2.5 +.023(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 715.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G +A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.468 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) -.15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") -203 727.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +.15 E F0 2.968(", ")B F1(sha256)A F0 2.969(", ")B F1(sha384)A F0(",)A(") +203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A -F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 739.2 Q F1(sha3-384)A F0 +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 (", and must be supported by the TPM.)A(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q(February 28, 2024)84.698 E(1)183.837 E 0 Cg EP -%%Page: 2 8 +%%Page: 2 13 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 44.133(ZFS-TPM2-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 41.632(anual ZFS-TPM2-CHANGE-KEY\(8\))-2.5 F/F1 10/Courier-Bold@0 SF109.666 84 Q F0 -.4(Wi)203 84 S(th).4 E -F14.589 E F0 2.923(,a)C .422(lso prompt for a passphrase.)-2.923 F -.422(This is skipped by def)5.422 F .422(ault because the)-.1 F .675 +F14.588 E F0 2.922(,a)C .422(lso prompt for a passphrase.)-2.922 F +.422(This is skipped by def)5.422 F .423(ault because the)-.1 F .675 (passphrase is)203 96 R/F2 10/Times-Italic@0 SF(OR)3.175 E F0 .675 (ed with the PCR polic)B 3.175(y\212t)-.15 G .675(he wrapping k)-3.175 F .975 -.15(ey c)-.1 H .675(an be unsealed).15 F F2(either)203 108 Q F0 -1.39(passphraseless with the right PCRs)3.89 F F2(or)3.89 E F0 1.389 +1.389(passphraseless with the right PCRs)3.889 F F2(or)3.89 E F0 1.39 (with the passphrase, and this is)3.89 F(usually not the intent.)203 120 Q/F3 10/Times-Bold@0 SF(ENVIR)72 136.8 Q 1.666(ONMENT V)-.3 F(ARIABLES) --1.35 E/F4 10/Courier@0 SF(TZPFMS_PASSPHRASE_HELPER)108 148.8 Q F0 .045 +-1.35 E/F4 10/Courier@0 SF(TZPFMS_PASSPHRASE_HELPER)108 148.8 Q F0 .046 (By def)133 160.8 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 172.8 Q F0 1.596(is set and nonempty)4.096 + on the standard output and input streams.)-.1 F(If)5.045 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 172.8 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F1 3.261(sh \255c)B F0(to)4.095 E(pro)133 184.8 Q +(/bin/)4.096 E F1 3.262(sh \255c)B F0(to)4.096 E(pro)133 184.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 201.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -802,10 +1175,10 @@ F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 249.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 261.6 Q F0("ag)160 261.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 278.4 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F3(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 278.4 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F F3(127)2.677 E F0 +.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 290.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F3 1.666 (TPM2 back-end con\214guration)72 307.2 R(En)87 319.2 Q(vir)-.4 E .625 @@ -814,13 +1187,13 @@ Q 2.5(yo)-.15 G(f:)-2.5 E F3(NONE)2.5 E F0(,)A F3(ERR)2.5 E(OR)-.3 E F0 (,)A F3 -1.2(WA)2.5 G(RNING)1.2 E F0(,)A F3(INFO)2.5 E F0(,)A F3(DEB)2.5 E(UG)-.1 E F0(,)A F3(TRA)2.5 E(CE)-.55 E F0 5(.D)C(ef)-5 E(ault:)-.1 E F3 -1.2(WA)2.5 G(RNING)1.2 E F0(.)A F3 .625(TPM selection)87 348 R F0 -.621(The library)108 360 R F1(libtss2-tcti-default.so)3.121 E F0 .621 -(can be link)3.121 F .621(ed to an)-.1 F 3.122(yo)-.15 G 3.122(ft)-3.122 -G(he)-3.122 E F4(libtss2-tcti-)3.122 E/F5 10/Symbol SF(*)A F4(.so)A F0 -(li-)3.122 E .781(braries to select the def)108 372 R .781 -(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4 -(/dev/tpm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4(localhost:2321)3.28 E F0 -(will be tried, in order \(see)108 384 Q F4(ESYS_CONTEXT)2.5 E F0 +.622(The library)108 360 R F1(libtss2-tcti-default.so)3.122 E F0 .622 +(can be link)3.122 F .621(ed to an)-.1 F 3.121(yo)-.15 G 3.121(ft)-3.121 +G(he)-3.121 E F4(libtss2-tcti-)3.121 E/F5 10/Symbol SF(*)A F4(.so)A F0 +(li-)3.121 E .78(braries to select the def)108 372 R .78 +(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.281 E F0 3.281(,t)C(hen)-3.281 E +F4(/dev/tpm0)3.281 E F0 3.281(,t)C(hen)-3.281 E F4(localhost:2321)3.281 +E F0(will be tried, in order \(see)108 384 Q F4(ESYS_CONTEXT)2.5 E F0 (\(3\)\).)A F3 .625(See also)87 400.8 R F0 2.247 (The tpm2-tss git repository at https://github)108 412.8 R (.com/tpm2-softw)-.4 E 2.247(are/tpm2-tss and the documentation at)-.1 F @@ -837,7 +1210,7 @@ G(he)-3.122 E F4(libtss2-tcti-)3.122 E/F5 10/Symbol SF(*)A F4(.so)A F0 F3<83>128 542.4 Q F0(EvModder)7.5 E F3(REPOR)72 559.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 571.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 588 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 600 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (PCR allocations: https://wiki.archlinux.or)108 645.6 Q(g/title/T)-.18 E @@ -847,7 +1220,7 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q (able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q (February 28, 2024)84.698 E(2)183.837 E 0 Cg EP -%%Page: 1 9 +%%Page: 1 14 %%BeginPageSetup BP %%EndPageSetup @@ -857,13 +1230,13 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 -(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 +E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with)-2.5 E F2 (tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM2)2.5 E F0(:)A 5 -(1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641 -(lent of).25 F F2 5.642(zfs change-key)8.142 F13.308 E/F4 10 -/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E F4 +(1. performs)118 165.6 R 5.642(the equi)8.142 F -.25(va)-.25 G 5.642 +(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E/F4 10 +/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 (keyformat=passphrase)133 177.6 Q F3(dataset)6 E F0(,)A 5(2. frees)118 189.6 R(the sealed k)2.5 E .3 -.15(ey p)-.1 H(re).15 E (viously used to encrypt)-.25 E F3(dataset)2.5 E F0(,)A 5(3. remo)118 @@ -872,12 +1245,12 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm2-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1(ENVIR)72 247.2 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .045 +-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .046 (By def)133 271.2 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.596(is set and nonempty)4.096 + on the standard output and input streams.)-.1 F(If)5.045 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 295.2 Q +(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 295.2 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 312 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -889,10 +1262,10 @@ F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 360 Q F0("ne)160 360 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) -2.5 E F4($4)143 372 Q F0("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 388.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 388.8 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 +.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 400.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM2 back-end con\214guration)72 417.6 R(En)87 429.6 Q(vir)-.4 E .625 @@ -901,13 +1274,13 @@ Q 2.5(yo)-.15 G(f:)-2.5 E F1(NONE)2.5 E F0(,)A F1(ERR)2.5 E(OR)-.3 E F0 (,)A F1 -1.2(WA)2.5 G(RNING)1.2 E F0(,)A F1(INFO)2.5 E F0(,)A F1(DEB)2.5 E(UG)-.1 E F0(,)A F1(TRA)2.5 E(CE)-.55 E F0 5(.D)C(ef)-5 E(ault:)-.1 E F1 -1.2(WA)2.5 G(RNING)1.2 E F0(.)A F1 .625(TPM selection)87 458.4 R F0 -.621(The library)108 470.4 R F2(libtss2-tcti-default.so)3.121 E F0 .621 -(can be link)3.121 F .621(ed to an)-.1 F 3.122(yo)-.15 G 3.122(ft)-3.122 -G(he)-3.122 E F4(libtss2-tcti-)3.122 E/F5 10/Symbol SF(*)A F4(.so)A F0 -(li-)3.122 E .781(braries to select the def)108 482.4 R .781 -(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4 -(/dev/tpm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4(localhost:2321)3.28 E F0 -(will be tried, in order \(see)108 494.4 Q F4(ESYS_CONTEXT)2.5 E F0 +.622(The library)108 470.4 R F2(libtss2-tcti-default.so)3.122 E F0 .622 +(can be link)3.122 F .621(ed to an)-.1 F 3.121(yo)-.15 G 3.121(ft)-3.121 +G(he)-3.121 E F4(libtss2-tcti-)3.121 E/F5 10/Symbol SF(*)A F4(.so)A F0 +(li-)3.121 E .78(braries to select the def)108 482.4 R .78 +(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.281 E F0 3.281(,t)C(hen)-3.281 E +F4(/dev/tpm0)3.281 E F0 3.281(,t)C(hen)-3.281 E F4(localhost:2321)3.281 +E F0(will be tried, in order \(see)108 494.4 Q F4(ESYS_CONTEXT)2.5 E F0 (\(3\)\).)A F1 .625(See also)87 511.2 R F0 2.247 (The tpm2-tss git repository at https://github)108 523.2 R (.com/tpm2-softw)-.4 E 2.247(are/tpm2-tss and the documentation at)-.1 F @@ -924,11 +1297,11 @@ G(he)-3.122 E F4(libtss2-tcti-)3.122 E/F5 10/Symbol SF(*)A F4(.so)A F0 F1<83>128 652.8 Q F0(EvModder)7.5 E F1(REPOR)72 669.6 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) -.25 E(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q(December 4, 2022)84.703 E (1)183.842 E 0 Cg EP -%%Page: 1 10 +%%Page: 1 15 %%BeginPageSetup BP %%EndPageSetup @@ -937,28 +1310,28 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 -10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .864 -(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1(wa)3.364 -G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E F0(back) -3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865(nseals the k)-3.365 -F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F(into)108 165.6 Q F3 -(dataset)2.5 E F0(.)A(The user is prompted for the additional passphras\ -e, set when creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5 -(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF -(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 -G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) -.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 -(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 +112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E +F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 +Q F0 .865(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.365 E F0 -.1 +(wa)3.365 G 3.365(se).1 G .865(ncrypted with)-3.365 F F2(tzpfms)3.365 E +F0(back)3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .864 +(nseals the k)-3.365 F 1.164 -.15(ey a)-.1 H .864(nd loads it).15 F +(into)108 165.6 Q F3(dataset)2.5 E F0(.)A(The user is prompted for the \ +additional passphrase, set when creating the k)108 182.4 Q -.15(ey)-.1 G +2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 +10/Courier@0 SF(zfs-tpm2-change-key)2.5 E F0 +(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2109.666 +228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 +G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i) +-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.208 E -.25(va) +-.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 240 Q F0 -.55('s) +C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V) +-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .046 (By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 + on the standard output and input streams.)-.1 F(If)5.045 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 304.8 Q +(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 304.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 321.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -971,23 +1344,23 @@ F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 369.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 381.6 Q F0("ag)160 381.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 398.4 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 398.4 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 +.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 410.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 427.2 R .625(TPM selection)87 439.2 -R F0(The)108 451.2 Q F2(tzpfms)2.729 E F0 .229 -(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 463.2 Q -(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 480 R(rouSerS) --.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -492 S(ing one of the earlier ones with, for e).1 E +R F0(The)108 451.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 463.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 480 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 492 S +(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 508.8 R F0(The T)108 520.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1002,7 +1375,7 @@ F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F1<83>128 626.4 Q F0(EvModder)7.5 E F1(REPOR)72 643.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(tzpfms 0.3.4-28-g7e4ea2c)72 817.889 Q(December 4, 2022)84.703 E(1) 183.842 E 0 Cg EP diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 new file mode 100644 index 0000000..08a80cb --- /dev/null +++ b/zfs-fido2-add-backup.8 @@ -0,0 +1,125 @@ +.\" SPDX-License-Identifier: MIT +. +.Dd February 29, 2024 +.ds doc-volume-operating-system +.Dt ZFS-FIDO2-ADD-BACKUP 8 +.Os fzifdso 0 +. +.Sh NAME +.Nm zfs-fido2-add-backup +.Nd allow another FIDO2 device to unlock ZFS dataset +.Sh SYNOPSIS +.Nm +.Ar dataset +. +.Sh DESCRIPTION +After +.Xr zfs-fido2-change-key 8 +derives the key for a dataset from a FIDO2 device, +.Nm +may be executed to extend this to any number of additional devices. +.Pp +First, the wrapping key is extracted as normally during +.Xr zfs-fido2-load-key 8 , +then a credential is made as-if during +.Xr zfs-fido2-change-key 8 +(except the "primary" device and all the ones holding backups are excluded from the search); +however, the +.Ql hmac-secret +is instead used as a symmetric AES-256-GCM +.Pq Xr EVP_CIPHER-AES 7ssl +key to encrypt the wrapping key directly with a random IV. +.Pp +This turns the +.Li xyz.nabijaczleweli:tzpfms.key +variable into +.br +.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … +.Pp +.Li tzpfms.key +is actually a dot-separated list of device bundles. +The first one is as-described in +.Xr zfs-fido2-change-key 8 . +Subsequent ones also include (identically-encoded) IVs and encrypted blobs. +.Pp +.Xr zfs-fido2-load-key 8 +shops assertions around devices in a device-major order \(em +depending on device numbering, a backup may be loaded even if the primary device is present. +. +.\" SPDX-License-Identifier: MIT +. +.Sh ENVIRONMENT VARIABLES +.Bl -tag -compact -width 4n +.It Ev TZPFMS_PASSPHRASE_HELPER +By default, passphrases are prompted for and read in on the standard output and input streams. +If +.Ev TZPFMS_PASSPHRASE_HELPER +is set and nonempty, it will be run via +.Pa /bin/ Ns Nm sh Fl c +to provide each passphrase, instead. +.Pp +The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. +The arguments are: +.Bl -tag -compact -offset 2n -width ".Li $1" +.It Li $1 +Pre-formatted noun phrase with all the information below, for use as a prompt +.\" Passphrase for tarta-zoot +.\" New passphrase for tarta-zoot (again) +.It Li $2 +Either the dataset name or the element of the TPM hierarchy being prompted for +.It Li $3 +.Qq new +if this is for a new passphrase, otherwise blank +.It Li $4 +.Qq again +if it's the second prompt for that passphrase, otherwise blank +.El +.Pp +If the helper doesn't exist +.Pq the shell exits with Sy 127 , +a diagnostic is issued and the normal prompt is used as fall-back. +If it fails for any other reason, the prompting is aborted. +. +. +.El +. +.\" SPDX-License-Identifier: MIT +. +.Sh FIDO2 back-end configuration +.Ss Environment variables +.Bl -tag -compact -width ".Ev FIDO_DEBUG" +.It Ev FIDO_DEBUG +If set, enables libfido2 debug logging to the standard error stream. +.El +. +.Ss Device selection +When creating, the first device which supports the +.Ql hmac-secret +extension is used. +When loading, the assertion is shopped around to every such device. +. +.Ss See also +The libfido2 documentation at +.Lk https:/\&/developers.yubico.com/libfido2/ . +. +.\" SPDX-License-Identifier: MIT +. +.Sh SPECIAL THANKS +To all who support further development, in particular: +.Bl -bullet -offset 4n -compact -width "@" +.It +ThePhD +.It +Embark Studios +.It +Jasper Bekkers +.It +EvModder +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso +.Pp +.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html new file mode 100644 index 0000000..e6d3444 --- /dev/null +++ b/zfs-fido2-add-backup.8.html @@ -0,0 +1,153 @@ + + + + + + + + ZFS-FIDO2-ADD-BACKUP(8) + + + + + + + + +
ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
+
+
+

+

zfs-fido2-add-backup — + allow another FIDO2 device to unlock ZFS dataset

+
+
+

+ + + + + +
zfs-fido2-add-backupdataset
+
+
+

+

After + zfs-fido2-change-key(8) + derives the key for a dataset from a FIDO2 device, + zfs-fido2-add-backup may be executed to extend this + to any number of additional devices.

+

First, the wrapping key is extracted as normally during + zfs-fido2-load-key(8), + then a credential is made as-if during + zfs-fido2-change-key(8) + (except the "primary" device and all the ones holding backups are + excluded from the search); however, the + ‘hmac-secret’ is instead used as a + symmetric AES-256-GCM + (EVP_CIPHER-AES(7ssl)) + key to encrypt the wrapping key directly with a random IV.

+

This turns the + xyz.nabijaczleweli:tzpfms.key variable into +
+ salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…

+

tzpfms.key is actually a dot-separated + list of device bundles. The first one is as-described in + zfs-fido2-change-key(8). + Subsequent ones also include (identically-encoded) IVs and encrypted + blobs.

+

zfs-fido2-load-key(8) + shops assertions around devices in a device-major order — depending + on device numbering, a backup may be loaded even if the primary device is + present.

+
+
+

+
+
+
By default, passphrases are prompted for and read in on the standard + output and input streams. If + TZPFMS_PASSPHRASE_HELPER is set and nonempty, it + will be run via /bin/sh + -c to provide each passphrase, instead. +

The standard output stream of the helper is tied to an + anonymous file and used in its entirety as the passphrase, except for a + trailing new-line, if any. The arguments are:

+
+
+
+
Pre-formatted noun phrase with all the information below, for use as a + prompt
+
+
Either the dataset name or the element of the TPM hierarchy being + prompted for
+
+
"new" if this is for a new passphrase, otherwise blank
+
+
"again" if it's the second prompt for that passphrase, + otherwise blank
+
+
+

If the helper doesn't exist (the shell exits with + ), a + diagnostic is issued and the normal prompt is used as fall-back. If it + fails for any other reason, the prompting is aborted.

+
+
+
+
+

+
+

+
+
+
If set, enables libfido2 debug logging to the standard error stream.
+
+
+
+

+

When creating, the first device which supports the + ‘hmac-secret’ extension is used. When + loading, the assertion is shopped around to every such device.

+
+
+

+

The libfido2 documentation at + https://developers.yubico.com/libfido2/.

+
+
+
+

+

To all who support further development, in particular:

+
    +
  • ThePhD
    • +
  • Embark Studios
    • +
  • Jasper Bekkers
    • +
  • EvModder
    • +
+
+
+

+

https://todo.sr.ht/~nabijaczleweli/fzifdso

+

~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

+
+
+ + + + + +
February 29, 2024fzifdso 0
+ + diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 new file mode 100644 index 0000000..8238eba --- /dev/null +++ b/zfs-fido2-change-key.8 @@ -0,0 +1,188 @@ +.\" SPDX-License-Identifier: MIT +. +.Dd March 4, 2024 +.ds doc-volume-operating-system +.Dt ZFS-FIDO2-CHANGE-KEY 8 +.Os fzifdso 0 +. +.Sh NAME +.Nm zfs-fido2-change-key +.Nd change ZFS dataset key to one authenticated by a FIDO2 device +.Sh SYNOPSIS +.Nm +.Op Fl b Ar backup-file +.Ar dataset +. +.Sh DESCRIPTION +To normalise the +.Ar dataset , +.Nm +will open its encryption root in its stead. +.Nm +will +.Em never +create or destroy encryption roots; use +.Xr zfs-change-key 8 +for that. +.Pp +First, a connection is made to the FIDO2 device, which +.Em must +support the +.Ql hmac-secret +extension. +.Pp +If +.Ar dataset +was previously encrypted with +.Nm fzifdso +and the +.Sy FIDO2 +back-end was used, previous credentials will be deleted from their devices (as-if via +.Xr zfs-fido2-clear-key 8 ) , +if available. +Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. +.Pp +Next, a new credential of type ES256 is generated on the device (with relying party ID +.Li fzifdso +and name equal to the dataset name) +with the +.Ql hmac-secret +extension requested; the device PIN, if any, is prompted for here. +This mimicks a WebAuthn registration step. +.Pp +Then, the credential is asserted with a 32-byte random salt, +which hashes it with device-private data, and thus generates the wrapping key +.Pq which is optionally backed up Pq see Sx OPTIONS . +This mimicks a WebAuthn login step. +.Pp +The following properties are set on +.Ar dataset : +.Bl -bullet -compact -offset 4n -width "@" +.It +.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 +.It +.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … +.El +.Pp +.Li tzpfms.backend +identifies this dataset for work with +.Sy FIDO2 Ns -back-ended +.Nm tzpfms +tools +.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . +.Pp +.Li tzpfms.key +is a colon-separated tuple of unpadded URL-safe base64 blobs; +the first one is the random salt; +the second represents the ID of created credential, +and the third \(en its public key. +There exists no other user-land tool for deciphering this; perhaps there should be. +.\"" TODO: make an LD_PRELOADable for extracting the key maybe? +.Pp +Finally, the equivalent of +.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset +is performed with the new key. +If an error occurred, best effort is made to clean up the properties, +or to issue a note for manual intervention into the standard error stream. +.Pp +A final verification should be made by running +.Nm zfs-fido2-load-key Fl n Ar dataset . +If that command succeeds, all is well, +but otherwise the dataset can be manually rolled back to a passphrase with +.Nm zfs-fido2-clear-key Ar dataset +.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , +and you are hereby asked to report a bug, please. +.Pp +.Nm zfs-fido2-clear-key Ar dataset +can be used to clear the properties and go back to using a passphrase. +. +.Sh OPTIONS +.Bl -tag -compact -width ".Fl b Ar backup-file" +.It Fl b Ar backup-file +Save a back-up of the key to +.Ar backup-file , +which must not exist beforehand. +This back-up +.Em must +be stored securely, off-site. +In case of a catastrophic event, the key can be loaded by running +.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file +.El +. +.\" SPDX-License-Identifier: MIT +. +.Sh ENVIRONMENT VARIABLES +.Bl -tag -compact -width 4n +.It Ev TZPFMS_PASSPHRASE_HELPER +By default, passphrases are prompted for and read in on the standard output and input streams. +If +.Ev TZPFMS_PASSPHRASE_HELPER +is set and nonempty, it will be run via +.Pa /bin/ Ns Nm sh Fl c +to provide each passphrase, instead. +.Pp +The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. +The arguments are: +.Bl -tag -compact -offset 2n -width ".Li $1" +.It Li $1 +Pre-formatted noun phrase with all the information below, for use as a prompt +.\" Passphrase for tarta-zoot +.\" New passphrase for tarta-zoot (again) +.It Li $2 +Either the dataset name or the element of the TPM hierarchy being prompted for +.It Li $3 +.Qq new +if this is for a new passphrase, otherwise blank +.It Li $4 +.Qq again +if it's the second prompt for that passphrase, otherwise blank +.El +.Pp +If the helper doesn't exist +.Pq the shell exits with Sy 127 , +a diagnostic is issued and the normal prompt is used as fall-back. +If it fails for any other reason, the prompting is aborted. +. +. +.El +. +.\" SPDX-License-Identifier: MIT +. +.Sh FIDO2 back-end configuration +.Ss Environment variables +.Bl -tag -compact -width ".Ev FIDO_DEBUG" +.It Ev FIDO_DEBUG +If set, enables libfido2 debug logging to the standard error stream. +.El +. +.Ss Device selection +When creating, the first device which supports the +.Ql hmac-secret +extension is used. +When loading, the assertion is shopped around to every such device. +. +.Ss See also +The libfido2 documentation at +.Lk https:/\&/developers.yubico.com/libfido2/ . +. +.\" SPDX-License-Identifier: MIT +. +.Sh SPECIAL THANKS +To all who support further development, in particular: +.Bl -bullet -offset 4n -compact -width "@" +.It +ThePhD +.It +Embark Studios +.It +Jasper Bekkers +.It +EvModder +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso +.Pp +.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html new file mode 100644 index 0000000..8cd7f1a --- /dev/null +++ b/zfs-fido2-change-key.8.html @@ -0,0 +1,207 @@ + + + + + + + + ZFS-FIDO2-CHANGE-KEY(8) + + + + + + + + +
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
+
+
+

+

zfs-fido2-change-key — + change ZFS dataset key to one authenticated by a FIDO2 + device

+
+
+

+ + + + + +
zfs-fido2-change-key[-b backup-file] + dataset
+
+
+

+

To normalise the dataset, + zfs-fido2-change-key will open its encryption root + in its stead. zfs-fido2-change-key will + + create or destroy encryption roots; use + zfs-change-key(8) + for that.

+

First, a connection is made to the FIDO2 device, which + must support the + ‘hmac-secret’ extension.

+

If dataset was previously encrypted with + fzifdso and the FIDO2 back-end was + used, previous credentials will be deleted from their devices (as-if via + zfs-fido2-clear-key(8)), + if available. Otherwise, or in case of an error, data required for manual + intervention will be written to the standard error stream.

+

Next, a new credential of type ES256 is generated on the device + (with relying party ID fzifdso and name equal to the + dataset name) with the ‘hmac-secret’ + extension requested; the device PIN, if any, is prompted for here. This + mimicks a WebAuthn registration step.

+

Then, the credential is asserted with a 32-byte random salt, which + hashes it with device-private data, and thus generates the wrapping key + (which is optionally backed up (see + OPTIONS)). This mimicks a WebAuthn login + step.

+

The following properties are set on + dataset:

+ +

tzpfms.backend identifies this dataset for + work with FIDO2-back-ended tzpfms + tools (i.e. fzifdso + zfs-fido2-change-key(8), + zfs-fido2-load-key(8), + zfs-fido2-add-backup(8), + and + zfs-fido2-clear-key(8)).

+

tzpfms.key is a colon-separated tuple of + unpadded URL-safe base64 blobs; the first one is the random salt; the second + represents the ID of created credential, and the third – its public + key. There exists no other user-land tool for deciphering this; perhaps + there should be.

+

Finally, the equivalent of zfs + change-key -o + keylocation=prompt -o + keyformat=raw dataset is + performed with the new key. If an error occurred, best effort is made to + clean up the properties, or to issue a note for manual intervention into the + standard error stream.

+

A final verification should be made by running + zfs-fido2-load-key -n + dataset. If that command succeeds, all is well, but + otherwise the dataset can be manually rolled back to a passphrase with + zfs-fido2-clear-key dataset + (or, if that fails to work, zfs + change-key -o + keyformat=passphrase dataset), + and you are hereby asked to report a bug, please.

+

zfs-fido2-clear-key + dataset can be used to clear the properties and go + back to using a passphrase.

+
+
+

+
+
+ backup-file
+
Save a back-up of the key to backup-file, which must + not exist beforehand. This back-up must be stored + securely, off-site. In case of a catastrophic event, the key can be loaded + by running +
zfs + load-key dataset + < + backup-file
+
+
+
+
+

+
+
+
By default, passphrases are prompted for and read in on the standard + output and input streams. If + TZPFMS_PASSPHRASE_HELPER is set and nonempty, it + will be run via /bin/sh + -c to provide each passphrase, instead. +

The standard output stream of the helper is tied to an + anonymous file and used in its entirety as the passphrase, except for a + trailing new-line, if any. The arguments are:

+
+
+
+
Pre-formatted noun phrase with all the information below, for use as a + prompt
+
+
Either the dataset name or the element of the TPM hierarchy being + prompted for
+
+
"new" if this is for a new passphrase, otherwise blank
+
+
"again" if it's the second prompt for that passphrase, + otherwise blank
+
+
+

If the helper doesn't exist (the shell exits with + ), a + diagnostic is issued and the normal prompt is used as fall-back. If it + fails for any other reason, the prompting is aborted.

+
+
+
+
+

+
+

+
+
+
If set, enables libfido2 debug logging to the standard error stream.
+
+
+
+

+

When creating, the first device which supports the + ‘hmac-secret’ extension is used. When + loading, the assertion is shopped around to every such device.

+
+
+

+

The libfido2 documentation at + https://developers.yubico.com/libfido2/.

+
+
+
+

+

To all who support further development, in particular:

+
    +
  • ThePhD
    • +
  • Embark Studios
    • +
  • Jasper Bekkers
    • +
  • EvModder
    • +
+
+
+

+

https://todo.sr.ht/~nabijaczleweli/fzifdso

+

~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

+
+
+ + + + + +
March 4, 2024fzifdso 0
+ + diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 new file mode 100644 index 0000000..f7ab9d5 --- /dev/null +++ b/zfs-fido2-clear-key.8 @@ -0,0 +1,121 @@ +.\" SPDX-License-Identifier: MIT +. +.Dd March 4, 2024 +.ds doc-volume-operating-system +.Dt ZFS-FIDO2-CLEAR-KEY 8 +.Os fzifdso 0 +. +.Sh NAME +.Nm zfs-fido2-clear-key +.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata +.Sh SYNOPSIS +.Nm +.Ar dataset +. +.Sh DESCRIPTION +After verifying +.Ar dataset +was encrypted with +.Nm tzpfms +backend +.Sy FIDO2 : +.Bl -enum -compact -offset 2n -width 2n +.It +performs the equivalent of +.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , +.It +loads the primary and every backup credential, and for each success, if the device containing it supports the +.Ql credMgmt \" or credentialMgmtPreview +feature and has a PIN set, tries to delete the credential from the device, +.It +removes the +.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key +properties from +.Ar dataset . +.El +.Pp +For every removal failure and missing device or PIN an instruction for manual removal with +.Xr fido2-token 1 +is issued. +.Pp +See +.Xr zfs-fido2-change-key 8 +for a detailed description. +. +.\" SPDX-License-Identifier: MIT +. +.Sh ENVIRONMENT VARIABLES +.Bl -tag -compact -width 4n +.It Ev TZPFMS_PASSPHRASE_HELPER +By default, passphrases are prompted for and read in on the standard output and input streams. +If +.Ev TZPFMS_PASSPHRASE_HELPER +is set and nonempty, it will be run via +.Pa /bin/ Ns Nm sh Fl c +to provide each passphrase, instead. +.Pp +The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. +The arguments are: +.Bl -tag -compact -offset 2n -width ".Li $1" +.It Li $1 +Pre-formatted noun phrase with all the information below, for use as a prompt +.\" Passphrase for tarta-zoot +.\" New passphrase for tarta-zoot (again) +.It Li $2 +Either the dataset name or the element of the TPM hierarchy being prompted for +.It Li $3 +.Qq new +if this is for a new passphrase, otherwise blank +.It Li $4 +.Qq again +if it's the second prompt for that passphrase, otherwise blank +.El +.Pp +If the helper doesn't exist +.Pq the shell exits with Sy 127 , +a diagnostic is issued and the normal prompt is used as fall-back. +If it fails for any other reason, the prompting is aborted. +. +. +.El +. +.\" SPDX-License-Identifier: MIT +. +.Sh FIDO2 back-end configuration +.Ss Environment variables +.Bl -tag -compact -width ".Ev FIDO_DEBUG" +.It Ev FIDO_DEBUG +If set, enables libfido2 debug logging to the standard error stream. +.El +. +.Ss Device selection +When creating, the first device which supports the +.Ql hmac-secret +extension is used. +When loading, the assertion is shopped around to every such device. +. +.Ss See also +The libfido2 documentation at +.Lk https:/\&/developers.yubico.com/libfido2/ . +. +.\" SPDX-License-Identifier: MIT +. +.Sh SPECIAL THANKS +To all who support further development, in particular: +.Bl -bullet -offset 4n -compact -width "@" +.It +ThePhD +.It +Embark Studios +.It +Jasper Bekkers +.It +EvModder +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso +.Pp +.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html new file mode 100644 index 0000000..97e05e7 --- /dev/null +++ b/zfs-fido2-clear-key.8.html @@ -0,0 +1,151 @@ + + + + + + + + ZFS-FIDO2-CLEAR-KEY(8) + + + + + + + + +
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
+
+
+

+

zfs-fido2-clear-key — + rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 + metadata

+
+
+

+ + + + + +
zfs-fido2-clear-keydataset
+
+
+

+

After verifying dataset was encrypted with + tzpfms backend + :

+
    +
  1. performs the equivalent of zfs + change-key -o + keylocation=prompt -o + keyformat=passphrase + dataset,
    2. +
  2. loads the primary and every backup credential, and for each success, if + the device containing it supports the + ‘credMgmt’ feature and has a PIN + set, tries to delete the credential from the device,
    3. +
  3. removes the + xyz.nabijaczleweli:tzpfms.{backend, + key} properties from + dataset.
    4. +
+

For every removal failure and missing device or PIN an instruction + for manual removal with + fido2-token(1) + is issued.

+

See + zfs-fido2-change-key(8) + for a detailed description.

+
+
+

+
+
+
By default, passphrases are prompted for and read in on the standard + output and input streams. If + TZPFMS_PASSPHRASE_HELPER is set and nonempty, it + will be run via /bin/sh + -c to provide each passphrase, instead. +

The standard output stream of the helper is tied to an + anonymous file and used in its entirety as the passphrase, except for a + trailing new-line, if any. The arguments are:

+
+
+
+
Pre-formatted noun phrase with all the information below, for use as a + prompt
+
+
Either the dataset name or the element of the TPM hierarchy being + prompted for
+
+
"new" if this is for a new passphrase, otherwise blank
+
+
"again" if it's the second prompt for that passphrase, + otherwise blank
+
+
+

If the helper doesn't exist (the shell exits with + ), a + diagnostic is issued and the normal prompt is used as fall-back. If it + fails for any other reason, the prompting is aborted.

+
+
+
+
+

+
+

+
+
+
If set, enables libfido2 debug logging to the standard error stream.
+
+
+
+

+

When creating, the first device which supports the + ‘hmac-secret’ extension is used. When + loading, the assertion is shopped around to every such device.

+
+
+

+

The libfido2 documentation at + https://developers.yubico.com/libfido2/.

+
+
+
+

+

To all who support further development, in particular:

+
    +
  • ThePhD
    • +
  • Embark Studios
    • +
  • Jasper Bekkers
    • +
  • EvModder
    • +
+
+
+

+

https://todo.sr.ht/~nabijaczleweli/fzifdso

+

~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

+
+
+ + + + + +
March 4, 2024fzifdso 0
+ + diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 new file mode 100644 index 0000000..247ca04 --- /dev/null +++ b/zfs-fido2-load-key.8 @@ -0,0 +1,98 @@ +.\" SPDX-License-Identifier: MIT +. +.Dd February 28, 2024 +.ds doc-volume-operating-system +.Dt ZFS-FIDO2-LOAD-KEY 8 +.Os fzifdso 0 +. +.Sh NAME +.Nm zfs-fido2-load-key +.Nd load FIDO2-encrypted ZFS dataset key +.Sh SYNOPSIS +.Nm +.Op Fl n +.Ar dataset +. +.Sh DESCRIPTION +After verifying +.Ar dataset +was encrypted with +.Nm tzpfms +backend +.Sy FIDO2 , +asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into +.Ar dataset . +.Pp +See +.Xr zfs-fido2-change-key 8 +for a detailed description. +. +.Sh OPTIONS +.Bl -tag -compact -width ".Fl n" +.It Fl n +Do a no-op/dry run, can be used even if the key is already loaded. +Equivalent to +.Nm zfs Cm load-key Ns 's +.Fl n +option. +.El +. +.\" SPDX-License-Identifier: MIT +. +.Sh ENVIRONMENT VARIABLES +.Bl -tag -compact -width 4n +.It Ev TZPFMS_PASSPHRASE_HELPER +By default, passphrases are prompted for and read in on the standard output and input streams. +If +.Ev TZPFMS_PASSPHRASE_HELPER +is set and nonempty, it will be run via +.Pa /bin/ Ns Nm sh Fl c +to provide each passphrase, instead. +.Pp +The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. +The arguments are: +.Bl -tag -compact -offset 2n -width ".Li $1" +.It Li $1 +Pre-formatted noun phrase with all the information below, for use as a prompt +.\" Passphrase for tarta-zoot +.\" New passphrase for tarta-zoot (again) +.It Li $2 +Either the dataset name or the element of the TPM hierarchy being prompted for +.It Li $3 +.Qq new +if this is for a new passphrase, otherwise blank +.It Li $4 +.Qq again +if it's the second prompt for that passphrase, otherwise blank +.El +.Pp +If the helper doesn't exist +.Pq the shell exits with Sy 127 , +a diagnostic is issued and the normal prompt is used as fall-back. +If it fails for any other reason, the prompting is aborted. +. +. +.El +. +. +.\" SPDX-License-Identifier: MIT +. +.Sh SPECIAL THANKS +To all who support further development, in particular: +.Bl -bullet -offset 4n -compact -width "@" +.It +ThePhD +.It +Embark Studios +.It +Jasper Bekkers +.It +EvModder +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso +.Pp +.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html new file mode 100644 index 0000000..ffc6446 --- /dev/null +++ b/zfs-fido2-load-key.8.html @@ -0,0 +1,117 @@ + + + + + + + + ZFS-FIDO2-LOAD-KEY(8) + + + + + + + + +
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
+
+
+

+

zfs-fido2-load-key — + load FIDO2-encrypted ZFS dataset key

+
+
+

+ + + + + +
zfs-fido2-load-key[-n] dataset
+
+
+

+

After verifying dataset was encrypted with + tzpfms backend + , + asserts the preserved challenge, HMACking the salt with the on-device + secret, and loads the resulting key into dataset.

+

See + zfs-fido2-change-key(8) + for a detailed description.

+
+
+

+
+
+
Do a no-op/dry run, can be used even if the key is already loaded. + Equivalent to zfs + load-key's -n option.
+
+
+
+

+
+
+
By default, passphrases are prompted for and read in on the standard + output and input streams. If + TZPFMS_PASSPHRASE_HELPER is set and nonempty, it + will be run via /bin/sh + -c to provide each passphrase, instead. +

The standard output stream of the helper is tied to an + anonymous file and used in its entirety as the passphrase, except for a + trailing new-line, if any. The arguments are:

+
+
+
+
Pre-formatted noun phrase with all the information below, for use as a + prompt
+
+
Either the dataset name or the element of the TPM hierarchy being + prompted for
+
+
"new" if this is for a new passphrase, otherwise blank
+
+
"again" if it's the second prompt for that passphrase, + otherwise blank
+
+
+

If the helper doesn't exist (the shell exits with + ), a + diagnostic is issued and the normal prompt is used as fall-back. If it + fails for any other reason, the prompting is aborted.

+
+
+
+
+

+

To all who support further development, in particular:

+
    +
  • ThePhD
    • +
  • Embark Studios
    • +
  • Jasper Bekkers
    • +
  • EvModder
    • +
+
+
+

+

https://todo.sr.ht/~nabijaczleweli/fzifdso

+

~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

+
+
+ + + + + +
February 28, 2024fzifdso 0
+ +