From 6affe9b5f289fa0c1e59b52bb1e5f829e1a79406 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Fri, 29 Mar 2024 11:47:34 +0000 Subject: [PATCH] Manpage update by job 1181906 --- tzpfms.pdf | Bin 82113 -> 65599 bytes tzpfms.ps | 916 +++++++++++------------------------- zfs-fido2-add-backup.8 | 123 ----- zfs-fido2-add-backup.8.html | 152 ------ zfs-fido2-change-key.8 | 188 -------- zfs-fido2-change-key.8.html | 207 -------- zfs-fido2-clear-key.8 | 121 ----- zfs-fido2-clear-key.8.html | 152 ------ zfs-fido2-load-key.8 | 116 ----- zfs-fido2-load-key.8.html | 143 ------ zfs-tpm-list.8 | 2 +- zfs-tpm-list.8.html | 2 +- zfs-tpm1x-change-key.8 | 2 +- zfs-tpm1x-change-key.8.html | 2 +- zfs-tpm1x-clear-key.8 | 2 +- zfs-tpm1x-clear-key.8.html | 2 +- zfs-tpm1x-load-key.8 | 2 +- zfs-tpm1x-load-key.8.html | 2 +- zfs-tpm2-change-key.8 | 2 +- zfs-tpm2-change-key.8.html | 2 +- zfs-tpm2-clear-key.8 | 2 +- zfs-tpm2-clear-key.8.html | 2 +- zfs-tpm2-load-key.8 | 2 +- zfs-tpm2-load-key.8.html | 2 +- 24 files changed, 276 insertions(+), 1870 deletions(-) delete mode 100644 zfs-fido2-add-backup.8 delete mode 100644 zfs-fido2-add-backup.8.html delete mode 100644 zfs-fido2-change-key.8 delete mode 100644 zfs-fido2-change-key.8.html delete mode 100644 zfs-fido2-clear-key.8 delete mode 100644 zfs-fido2-clear-key.8.html delete mode 100644 zfs-fido2-load-key.8 delete mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index 5e6297636898b84f2cdecbb8f7474eec7b68129f..cf1ac9a569e893413925bc9580587967f7870d69 100644 GIT binary patch delta 44957 zcmZVlV{o8NxGs#wwrx8T+qNgx#J2Oqp4hhSiJeSrV`AGr@A_)*{o|~vuIjG-+jrH) z?hl0Q4S=XO1qG&lZa8m@q52(b$=lhb6eP1`;%+`G*sz&dP_Ch7RBp}stcC+IptFf>$5 zYTKTzhp@aiv@;nHY+et0oR;}nleZ1XUkVc%NcK#8(3~XjzKC{o#Cn^m>jY*PK1{}A z#q!-ZKt0`*byB8`o~FQuekMP@f5mUVEms5nPkNP`XznWIA$o%-I1S`14V^-Db-gcj za?1v_qhJs0_wl2PwybAj^J{bRbd(j^5UB!2$zwYL2&TE$@2@9I%YXU)UsiKa%S|G% zPZ?D^uLcM?ZQITjymf{)7X9G$LYnw2lEdksZo)21hXz!h%cWd`kN{u z1gU2@Pht&d(SpD_bRDi|8YpelUQ~`CyBV#*e8Pgbus#pZa&V^p)D=}o@wnf%Xr~%l ztPUM@h{(UDTlf(>=3vajY;w0?@0(WR0B-Tiqa~g37J=VkJlysA>jecbD+Q2Akf6zn zR!!a*=$Dq8Muk8&)UdRn7-nOf#W4udCrgM0C@Nmlk<;IkB!A-%6mSnPk~q`qAHxU| z%2Y1vV3TZtduX9vPnY((5tbN;2)I#%y}z;lrD4{!mgLGz$KPj)PzCc;ORfv-0iO*A z)(x@fJ@P{=*vcTi_`3Ud()tY#i|nnq4lJ|g#c%d}HrIT4B3aEnqfElqe{jr0kXR;H z3Q@F|+Wc^G8?XhSv5b}{@i-uxd(K~{Xkh~WB7)DO)x}2?Ou#iyo`cQ~9`L2J)Um#d zet}x};(kvLhKpZ_qkXG;5U1uW0n)C_q5q2AVBm*EL>O_t{Nwt|E{Ro_T*ATgu)#27 zlH-~GuCO!7p;X)(uNh^L>8mvP{zA`nzf7D+zSvVW!+ye3-cl6wyI6bFd}3NKn?IL~ zgu6Av2hZhJkifW?C8@({nGJk%GU@a%9)0fgt>AFPT2 zyzW{nyRgWA!^T;i^$A`I3dZl&L#Ww1nEZAr1@O&Q^SXSh|B)TBhMc2aB@^Do+M(TU(Ur`CB!b&(nu zbB$_X#G1BMsbK#+UTD;X<9eC4IbfXsOt;B|{9qlcCQqZ_1YBtr{t6L+Uq%j+>QhvpE5INKL zQb9p|i%Rvuh{SYl04SmJh=k^qa%_7P=wvFoFpN~UcgeWf&dAh=mn*$oLFYetb)4nn z9^Lz%tv~tN&pfSr7mv<6W$PFZ$=00z-rC@1he{wgiNVeDqoLT4&ik%LLTtA_y!89K z+!*A$^dT0<72VYR8+dXhpuW=R*SQYDjD+(!yy0)|2P!lhmzcPY*aRwSKH z(y_`{bGTYR10k)Z!kq^POTRw#xcc2`@pn4j)>!NzZ*Z-lJ!bT7$mhF)X!oUG~nuwmVR&%{JW-KXNZF!}Y(78K7G%)eMt}v|IAioPJVO#Wv zb-FLxf|vV=04r!lTu?&irs&*$NM560*L$gXMh9xTsr_0$DHCylKf?&gmD)eUc~c%; zD-{9~0{>Zfxpk0>+-pd1u=v)Z>D(glq{1_XMasjGCKQosA(kkGd5ZXOxI zm^u`-=KJB4e5lSjzT!t~kz-CUIbOe`+;QmrM5?zuAWvL-zdvo?&JQ2Mt15`-6jwlb z@r7b5xH|Hm1gjrwC2OL59-seaO`Oxdz1}@CA3Yo?2(;q!HE-YgXMAyH8BTw5iq-A( z=4>lE07sAVj=FN10&esM>YKg+F-2Fo0<9z0UO6Dm*oUj}jZG)G9X|)5f)=?T+Ia#D zzxdH5C7HaRapf0J-?~{iCvq)doX3&%y1xl{bcw@4)2q zn+>rUISTf~48GA?)v*YUXRi`*!72O(!z&lY$t}})kmH&ArOxH-SdomUsz{#EvARO8 z%?NRpN~l**%C?rm>+hvzT=&m_R=M{=Z5b3jOI98>W0-*;^L{+MC|6pzUwPz`IQ4OF z@~IA{=E@rHr@nVuFZW8P5noGY_P<nibg`Zm(9W1SVP<))NU}~+Ox3aNfL<~A3@IJ0r ze~txXKVVqMKsGEq%Tj{-bM8;#zc3K$n!%{&ai_?ANE~uBSU^!B6O1C@N$5v?AxOdR z)&hluMsu?jy8n7H)RFeOi+pr0R5~Aai#Y|*n1(U4K`SOnIG3#l6N!MvR{(?DCgKsK z`B^$Jx&b(3qrV_wf*hrNT7EUi%ic&X+)28yCSS}2klVWoVCe{o7~?!WcyfNZ`tyU{ zP23)?tTyt;v}10v+j0{XfY(|4#iPg?Cle3W&~KNTK;u8=I7wAdYs1@Q(#@&D`eiMx z^rjdpe9%JrQfzP!yHNh`3j|1ZQ>zFSgct^6m#K<&)uy_fGXRDrmo7|c(7&|%>+p4} z#`LD{7W|lAsU7sTC@#Sx9)HlEU2T2PdnUO4#_f;v_H={|tGwJayxZ&6;8!?jP`k|a z$H6tXOfxq*+Fxt?gJ{&VhPkcZ%HPWmPAz~(MmONLM{IFhTWqnqxd({JXtAtxoW@F$ z>sxS~>2SfIPz46itP~+fAC$H$&8MmUS(FNb7WCCLW1VN7vTM0owDmhFt8?4yW8Bt! z8ErgqwP2UGe(u{vkXSz32rKryj2--q2q}qLI_Q;kG#tAz`Do0id4Av6=0DN;)wy zNu#n7-<0wjMOnT=gnM7GF#hT9$o#8)ZZCTDkG20bg+EyT&%|-Eu>8L%WdGk&$U(xA zL?%HEjG%VkYssJPZ7qTgAoN_m2#;6&Y@lR4&>V+7l@06^LtAF5hpN|6S=m&5qyLKY z5(vfx5tEIiPfJE_#qN_=dOlyN^Le3%_niiNEBk)-_CTxeOfpnze@l7%*129?J3Dxl zkQJ)7S9+MpE(t2}Ice~k$$0xgb{)4D$$ihZx*Hm~elm4huL1#oKbhWM3_ZgP za9;~yZYm`Sv&21(!V^2_)@@wBKs)#us(Z})P!mfYz{Lf)~Ak?q%I zDL{Y+oteIgaqbb`?V)Rbn3SuS_%)nYchMlVanm;=PBzJToVRiGF+9BJ`aZBGhTF~Y`eBLoCFs|HWMM1Fg zTa?n4y*HqOfF}cilXAS&^v_nKH#5DaJ7dyPhu5kHrSkTo+oCkXF`CZjuT>f?ARPl_J48bc}4Xltx6soH*3vQ=L# zZZ_9Zi0J2;2vYejxnPC@@|OP~Qca}N=5>~WV1ANfq-{M*^jjKx)y_ceRnJNCa~F%^ zSRv}NL8`(AKm5=B##ok33Wv>1IG5wGsopeO)MJ0ugz$eU26W^?%|**RJ}%$f8+`) z5inH_+A6GT>@Cw-vvDDJogh~OlP?|(xF5Aot@eFKzds(8RZGZ$gR5ponkq%kYfR=M z!Q)6!uxfAvjz*Vy6q*?VD-vvigVkhx=%`cBE%zIbIosxv7sFpSiXtlHH&W7wJm0bf zq0m^Mj+r`-!Q*L_%r>;2QRqj~kin1pPTWRt1tu4EQJ+24R|F*>9F&D)bfN7#P&x(K zwxBKXl&M7E()Ur`!JRYWfzKSBX^92=ViUcN|WYz?i~Vx zmtq4Osdv@*d`Ym_o?MpZipvW$i>+Bh3O->DgpM-8-0i-+#e&f~*O^eja@dQ-P5^la z5oBL7Yu06S>(&le2&XuDof`?`W5vFDqVgs$<%G%pqKYlx?Cfq&xYHZ#x(q$LNxOD9 zjQoZ{TKOwpiN&1*pFxKuF>usJROdDpOn*kgP&O7u(#P-$ySmE^Q+A`NXw$yi1Ji(1 zhElcb4gplya#d<=v9UY%oerZ)NN-A$WxsXX{vC3kV0Gk;``dt1pH?>vLSuuR*!2Ud z1_LqkX(9#qw2{iZ34trCsQY%cM&nZcxVf3Di^{r7Gx>C)cdEU!QScHJL5Mk^Vb7x8 zQGAa6gy3NE7WXWF$ges9SPxV(4y@QYOp4b=G%t2nDvN%cZ`q#XryU1Z925PO$pJU; zyN5U8HRxZx3Kc1wF^}3w(@Qh+$9w2dd?AzOfS3RfS$C=P^E;*P(!)Y-s%%6iAs2V} z^eeL;V%3CD_TV+B2)KmUW|DFLIAx&gNwa2(B#ue&<0ar3}ZKc4mDp>d!a+W2bMM`*V`U%eB=inYM9u0!^PE z&Ndl{<8iQMNLipxJw`v3JiTU+ao`6VFLFyn+3J}?+aEK~JsyS27U6KtiD^CG&j zpuxp3gZMn+Js zIZjZ-Bq)u-`n@NCv3{M-pu3&l?Ppez(_d4-l;^q^+A1zt2ky{B6l?WK3LET4h9=bl zdw80@q2h@X^Kv?aOiwx2=!HJr+UYIKBm0=`zbBmqmvZTi*(BXT17v$?qYTyCPg-hP z1+*d;E4c7|&0jq~C7BJVtTIb(wY&Hy?g-%00PMV@GUnGiKGdABGHpC6o!%q<%yB&c z71sz@(B1)Yv`P;Rj?|HfKS;1qI@Xp%JVz-)q0_+L`;AXDr7!P-O;|}kKJNMQ(wvG) z>fJb7ABo!-k5QU17NU(kJa!dxjP;4pB1QVHH2o+}AV#D8Fg1O5_~Y=_!(!q@UVL|A zVIhWDDHz7L6Csi15R|_K!BmI(R_zwxd48*Msv`~q2UDH%!A{YN7Wrv3YVweMKJ*?C z)+{k+(Go;xmHh`K0n&@}zE$>p` z107de)ZQN~5{oJ47RxIp#5@NMx4P~O6*Nnb=-ILKr|hHuNK2oGv7eB%SAZ1OM1{aW zclwwW;1zp!3$i0NZ2pEwn$Ts`24@|N{8P`h9&(ywh*O;T48a~g4o7SC#Rz^j* zV2;%(@ma7nd&Ln6Zq(COwi>CN7#_*LzIYUI*kK%65BOH8S)J2P?frxSe27Z`{a3B$ zrCcgCd17f>i{OQ^%mT~ug37*Q0`IQAU4ge{#X6P_Iu)(;yJG?S%aVt;IY$;3b*8*r zSXPAk7E^l5*EztKJSUu$96|aqVWLV$QhHIMwrQhYLH47A5XTZlCF)&{_rZG$1fvT#`fb;%`0S0U8$*8%lv!4YI= zNF6Kw4n!bFuK|v}Hu!5fT{V@C8Z*A&iT7F9(sIu!ZK`zZ9i*T7dY2)3o$hs1s`&no zE5ViorJmVA{M&c0Rw^m0J9hy2BH=&n3TD#mF$v2ZvgnI0VC|RS4ffH|(atv9%H@Fx zWV;jB2DZ&MZf%)$2>XRuk}Kc*uY75RUw}*mmKBv#rI@uw^y0 zbk_f8T#eKgp>`gk$2a^2^!c>T5Vtk2eE28L9K)-67J(QKj89WMRjLy8!l~tuyE#Y4 zJV~aQIR=+52V_}?=Bd5@j*0S2lK5a+*bd3WZ2vV9pC+L@mnx$FzeP=@HMat}QzFW& zqkG^LK66$KO3{W;)=qG@WFSjnSJQf2iNp2ZN{ww*`BK zJp<5_`+ia4EG76xAD!O|Ytfl`C9u?$3}w2Z>4DL?2hKBAb4FHz<&nHS!3Fr0%#D5e zEs-Ue(M`yBk~>7)9!%`W zbeyhjD~9u{=2e2OJ|_T&LDfmG>&_Bg*&L<|oqY0z!W9daL~y#}7hl}pqDkbizkpHp zXlY$(ZZJc|ne4zvcn|Zqn*{<{#8kbo%o|LMXkrgvEQMc$Jo;|ErwJQkMQG*Vc3LPO z&vXH_otMAAn&yoD9g;2AYMH&yjK3~l(<6q-I96%xm4)lc$o*Kig|&5!t$1ZvtUOk{ zK+>z((sx0~S=C#We7$Dz-HsmlAHaCApRMuQ!2bCS4k_`cjG6i_*tCX#CrRPjV69;D z1$ue-W-Wx9)t7e>J^q@CA&d1TSkoUq`;;ec;$`Q$I(oQe4$IsKR(c-2T(1`iM9YRU zO()PTL$wRAgY3&r4gsMTTlQu-DT<{|v@ndR?A(Kb^esYn>!V15mvsbIOF(p>3xnRA zXXW4AzB`oQWALBRBA8DTP9J^t2(V*#s(%C@xn>XHKiO(Eb!rvAf`Bi?hdTk`|1G=! z)6@T-`@_b~#rl7BH{1Vqf7t#C;CNW810VzN2TsAn-a^EWr1OINx zm*b;?y-aVW$@yAma@xD4{#aPcq- zvq<~G{4d#35xU&@>m)hr|8yR6R#yH=&r`^?v35tNj@;_O=8|4GD`I@HM%Rc+X_2CQy8QhxsJd3kz7cF=lyuF7+$J~5Bwj1#@v_kDLdLLug>g?Dc~o$UAp zxpDti;vekStYB^*qK`Lv3F=f~fch9TFdU(LKk!&DMR=Kli8wKb?N{|aL4Vf9y2=jc z1OZ~pHB0m*G8HK}HtR{U{?c*uq_0h!k<2e4v4&C33oObzx{e=!Ht*l777b`gClRFb&d!VY>s=Ddqcar`<9yKj9`;B+g2VqiPIblj!Cc@n_PS&Uar;adv z&-#-dt@6si^1*Z?|xUXeulO&_{OwZt(5!t`E)V z&Jwv-F5y%;LW>BE#Y!r_gjKE%%VQS5y^)Rith5T+5_J-=@J^=KnunhrJKQKrK6Nm` z%FR479r3pj8ru|a$SF-ly6c~ecCj6pTmD@i1yK1VWY2fkP*vDw6+o^)EI+8Mc9K(Z z5_pWcD8%@OW}OOtG4dCdXqH4VIQ1)x-U*}%@o|~Fw5uttDOmMk#Eg}0u2Kd@2cqlj zL{+<`E3+(V6U1pyG*tNz3FEj&!8$#$Tks`H z6tG_aEq~l6agwdx5^K*qGe|*VSL&vnY;^F)Zz9nrW;;U+H8#j|GjK%{$}C+i2=)=I z++lmZ4rgVhY!=ID#X9cL<#)kG-I09quqd<%nervr&ow)3u|cDx{B{Q{JQE?Daaku6 z2)qte?hka;6FZ~|&~@K!t`;mJGYIF6LjZhz>iP<#-#OPcJWQ1ve4!0``w8sw4CD91 za$>KBhm?~)VKJ|3C%QOn;@yAn?HpPSk_Pq{%{nU$c7nPaOAH^On;tzuvCr$0o=ud* z2^JfyeXP_O2W1JGQ1$X0MBMujO;m62Z8lQF4C5x+L0dT|# zC5-$-B@5$r^4{7~@v?Y;R)j1{JzG@CQ&{kkSxw}`di%-NXrSAb?h|F=Z!7T2P1};u zKb?;Si7Za1dV1AvdgJP>DD+jrYShZ+ec~-^VoEWt=l&yfyKew3GKzX_i+r*0XcP^u zxqFo)g^~lA9W>BhnBBXSYLP{H3V_Oy!Z!D-vvgat_3X~T0H<;}Kx%%~(N=?Ugo{Vz zkU1ZXY=|&&U}=?q9aPnnny14RV6NEFHb78?ZzAG8dQ{bwClD?}?IpIKFh4WiBO{sV zhzR%gU6MH8g-7ZtFFNcENKr;X87wXvqOiJfUz&Bd#coc65SXbx1DuM_(L=#u z>EO4g{HMTA`RX(&v#ahRd5FMXRRt z46U3M(8lbR(HxT8ISf}#YGzFa`dvPsM0Un5U;YbdbiCB1J*UmjfV{QvYIp*+$tdyd z1Xye~5(%GzMt_W$heC~%@i<>k=BL6`Ku<66h;9Vi*+y4&GA9$suJS&fW(bwVW0i~} zh9KjB@#u$Nqr0m?e)0JrQ0j52bzKwNR^20ozgDbG`*rtebIwP#_~R*TXJ^pb81%e! z>efP;UoX{a{5T^0k6c-(|0C(hc^nLS7|wtor-9V@Pei1ctjF7_7gA6o|th zoKNV08UNe_Tng1OwiFZh(EZ8*V^&H*+$abMGvL%PXjErd!Iqp%Zh=o13*E%Q#Lure zzjK-PxN&H?xX6yWm~_A#x&r0ArR&zs|D7Q{*3a}b3!jpM3}!wM4Tq`5Vbk0hWx7#d{i z^R7HPbWvP;J$v&nwH7~RJx+$b8@eJV!ynC!nbj~@F(?T}VRf#t`~!B0oBegTh5VZC zfaR662k7g=^ZO?J>&|=P9o}1A>>8xsseB%v_WjZUxW^>sIgHtIDp5Waf(}ZK0n4XB zqv;D2r%dc=M-l1ZaLA^jmw_{^azCrolYLb3l`1%A1cEXW>bqokrTDRixS`niiCVpD zrzHghangsnLywP)yu_@YlT`>pLrCKqfv15{h5b`+DIrfQ($G7igZ{36>G7*{goRQ? zPeqs?#7kMr9SUNTUW=WKd6F(PPqZgC$S_DT>Nh%(>n|}s3M9xmyibbfG42kP53Xf?A;#EABy`mUF+i?|f-L_sGlV%gdjU$my-5CDX*4|dl7&Lc+ z2y%#JX_RU`P~r`M1lwU1(Xd8h8JZTB-NqPw_xEOcmZz=)&XGuY##Sj|;f zgs~wq$6!9q5SKI@QY;S;29iU2!~cPDciU0hU0CwN3k^#D)pr|$=kN2oAu9O|iiG$( zYqn9w(oR6TOXNq8AU1dp5XKT{>A6Y>aQhCGv`_3rKA4i`{YuEw8QV48u$t|By3XJy zer9Et1`qg5SV;0v9{mSHxZrlNCGN)jotALf2Mc%-;Kyjk)`0Z#rXj8ik6WzWa>Li( zn#x+_DXQXwFvpaBP#yP&6#cRlNSbyI*@$G0aaG@3xA9@@gM&>5KrfFVZ$zoG)DK%k zm~z!f;>GsjutXL>yg3tjuQ+LMib3KT>FiNGjl*e_ zlcEV7)%0+ibVOSjxaH#=H!{y5Lx?-KF#(uvAlyClCeFHYor{r1Y zXfP|cblB)XIPP<`&dGy)H0$`);;^P|!iPj9$&MID{@uA6hGPySF(cyA!>_o*@PqH< zoyc#$(=T9lu@^)<3`(lNrMxua;-L6+J4=z7C?11q7lgS?P+rIN$8NDMbSb%d3fddH zwNJOQ1kygbul0JyVKF7cX{JiD_~t8#yBn#Ja#Kn?31yR>wk!|pA!D;&w5m!W-x_M{ zq$BjYQzC`YD1^3v9Ox;T3j0zSOl8wLSiDE*+%7P!JiwTrVp(osB_d_6a3AUD z?AwAL>EdaZ-2fc^Z}@+8O}U#kfyo9Az5YO}+sA3={Z@`LvSrD$wgCt5{#kP`D{PJ7 zO-f9pCu<~Sbu@gdRqfeT-6&s~@l^zRboB8yrO>JL)}D1tMLsmV)OI4_gEvr1^c2+l z?e11R&-RfM5-iiEXsFpSPPa+J1!FripxganOTcWm1Lr$BnK5DSnEuFg+_dl1+zC9T ztl{9tBa#)=n^<=5RvWYZh=2d}O~Os)YbkZgDHMe3h$A%clRjMlT89%Ami}?I$L_wg zzL~QBKHx#KGthyv{-jQP=!c?i0zvEB>SQbUlv@?=1HZgp+?$|nPJ;_=ADj3oEZBta z3(@EZYItkm^hz`^F!K$vMw)45X3z8g*Un)3zXF|=hlTV133TrN6^yg-{7*dtNYS=) z*l5KX`8+ce!2qX2MpcONzUUF+OQ!zov{m=KG5qx(dJ9lU zM5?OViov_qzc?G@-t!+j_L2wDlHDmiJG5q@x(dDfNiNluzf*4%temgyQ6&mhbFp=& z7mkUk3^-=zKiVICd@POY8ye07#9M9GN9Q}{#zBK1%Qg4f!mNlmI>Z*!ulUcMhf3Eu zFP{W8iV71R&WvWDNG7FPd}$TZ*Iu8h{oZcoyPEoBA%~K-C9|m>4+Uam0+V7%)f|H8* zFnk!XWJ@z{kA{NCxuOiqcaz<|b7v0OUc2Pad!JIOho&WMzy56Ycgl>9OmeUzTw?7m zu|8AdTeE`~)2D>jdMTpAoY*ls;sY#^`G}4mPX_lyA0=MUFlp>k9g+HfTnU@95mRB*3acdDNsV|=tG z*ri?D)Ags_z_6oOq=8rpFFPxB6}}3r~{tLmEyuWtMSyE%Teq&{su88B=Ez>Y}2D-RNF_8cNc}js`pgi z>|ZQv2NQ=w87Z>^CvhECb3L{0bZ1$Wng+G@J!0?8R!i34rJ75)F+^iCaSPd{61)zN|G) z%;!y(G6kGs-6{=cg(TXC}_>Q_!NcpC9@7OtdCGsAES%t6%oIcMUx_cNe$o9NHe`OqK?1A@>{si~Rpn+}7d$6xOl6ET$E8s&mi46>#6sR0!q zA-~-2^oF@&SYdxtPwXIvCM@@Xm`PvlJNgHm{wr1koaYLAX5YmF1Sv@g;|u5^ibtaN z1ch3A2D{UZ<|;u7Tg4(;SJCj*?pW@G1Ra1?-n$ysqOv4W5@`6 zn!i2)-d=2hRwS$8klECEo+5BO){Nm##rJ|ogM7S+%Hl6P;TvRBmypUSq#k1 zMA6ygx#k-Q6c}K5*X%3V)d_D{jYMyiQiedShGV8=4!^pcdSYAGrcH`1e1IstFZDmb zf%0g!8g1`&+DeO1SWK>Vp!O#+i)u4s&>55UwkY|mB|5)Zz#ly#hpY)755Zr)JMIWO z%fdIR(-12`=i$?+yej=Eo28=kNC|2YWWwb5tBN87+}Vk^ROr_iOmTWG>gs zve(>hu=pfT&wmW2EkNg`$_XORjEQd{Ux?I+S$VXZaNaUqn9)`92gxYdfR9$`p0PD` zsNOJmwBHdhKmFieJN1y=j50o7=x2owos(vv&|g!NONuc@@`X4`81UKw9T|fIl3B6WAoSmf*L3Xj%`Og`Xq>`T3WvY0N$hy4(Lpp6ESSmr2agg25rl zT+C1Mgw#Q?IcKYk0D63Yl4I7%+={27MVu?)=%e~C^+?8(Dl!~Odkoiag4R-395ij{ z5mmPptbm6oRMB)vzXQtsksqZ0Rh*7JT$HAekX3AXEv4G@of}WiTlt!7I$7Qf zgdkqjv84Emd+`%-sYF;3{F(9{KqDYwX#joL;o&%z#(st)HR>85`l0qf?J~$I{b?cV zv}v(vje5tG1bQmhVi<~@V79%AMC6=VOIlLqEHJmp3P!kyoU;H=L=|71AY%!G&&}=U zt@rwk=mv2UC?}Az%n#`TF&m*i|HjV4K($JYq?~dKZw+x83rjbyzzh#7v#nG@#lQu&eU@F8HKfCZ|04GGyOE?n zJIY44+I2b@Fk&gVm9sHzpsrzzOnO}LV0G!c;%7?0OR;y^k4&}1`QahVLW7m8it){Q z=}Q5>I+p0gr;nK}NYz7g(+-Q3f(-Z;ywa6VUIog~Wl~^q7{fVoO6>dssDx&O36N9? z|KsoisbRoqlv4J)#8e9(nm}#y@FkIzFwB0SF2Tk?MPt2%hM8OU$KBosqYmKW|33^~ zogb?76J*0mg~K10eXu~&q;Jd#zS(8eHHcDhY)9Puw6tZ71~|+i|$E0dOsJKQKQtdU#lU254TAGFKiEU-!E8 zDB!QfbRQuj&+2dobXYlk5YiJdSMeV|9(=Jh60zE+u3SHmhs6z^!jHV|o!LC-_#rlM z@z45xKU({i&}Z<&`Xm|k{4lDygX4PC6AX~P9oTTcWlq?}>@8W7LSdjZ3cM!p(q`xw z0gTB^Vq3O#o*Z6#sqnb*V?zdlc!c1(Sy2S$7rGvaBper;$mE%aVa$Y$Z6R3Qn0%s| zHhEQgG8+s=nxoWs`kQJOBpg3 zT{+GM>Fh>8z<`!W6YtoarAHUNm3t}kb}lS*CWE_}7#ao$k_3;-P8db?r1_lNU#p!P0< zx_KUhH<|2vI`^E2oEXBpmNahMx~s0uo+G`{4lm5TQle-SDy{Wq0fjgd@A!WbsMK#F zsp1mjOQnxj$_}fhx(nyV1Wt)Jr{~uE(qk^Du;r+wq3g$4%)q7~E=G08+zq6_%Y$2D zOx+y?U37XA%dT~Q+_@mZlP(bx@!3{4!p_9P0XzBzC8Ynn=y#86C#H&-NAyx)G664& z?vmKnL|`|uQUXl|Sq2VSZ1d@1Bw~`EQ$$z2rmb!pF_+HClzZaie@$FW8xLF0cm&Bs zYWG&UiSla4e*hVp>}Hk_aDQ3F#k}L08b~Wp6p~d+{6J?K_M=I&{c(Gyu#(QC=zhjy ze}55Yw*8>iphxIp(5)!}n^7NQf54;dX*J0%ksGb+pLv#6oSmA()kZBYQEP6d7bnxp zq|buw``N_GJ)3UASL6bX!u~3Mx4#Y%84-2XXtLL%K7b+dR86W>Sw5y8A=rJ{%innU zJ$w&N4uNfI9YSGX3L#*DT@+}Fs`NWMulI(X%lPgpr%Vr%QX(4%b5#5hT`HoS?v=vj z>t$~$t74ERiUuIeh z&hd5&H{g7mhADdd;AA0EFOxm$l(OWaVa@huXByu!f9P-^n3@$vD8z9OQ6o;Q_&Q?w7C7yiLI8~3 z@=GOmf{t-e$q4nixwXyH?JMOEXr|#}E`7tU(_rV7!^oT9t9Q+d{MU}{-x^aHmzAKe z%g^9Bb22$WD_-EvuX=tr_qd)DL@~AB$34Pn1HH8|*9~}!92oHfgcKqMxYsJZ;NQn; ziOeBT?A88hIK*RM_(sDajW6)`H3EaV-H6__QaBu_IqH!0{Rg{kl_TA^)=0+n3QKM9 ztI(`l6W-)03nC*;H2WoPD#_8Z^ss4*w#=PGhr(A-%iDg?zp~0FkvdZ@77Z_hOpDs( zgUMq@i14!Oz~>Ws2!02%k)lM&dwNf2a&)iDfXUjbKYxA|6y;OC30%!vhXH}^qeMxZ zvzc1Sw6V@>3N6s^mm)7?xx~{E96UVwHfQ!PUa9LpWk)Gj32Ao{+?fb;Eo%n>9mv0Yobs{eV#~6}}nM%SZn|1bFQ1Rpu z-A~ggH%BXU>$(u;?-P~E;_A|MfvJVO?^R%F7tA=%;ngVXPA*J;G$T z4b|yQ&qY0>W0_#m3l!WQi!XrA#T*&>4CFgtrCH2#+I4r3OyIy27fiA{%&S%$|kHQx@7!ia0hJzG_r`vWQ5gjND`rLxTn zTf3q5FW)>{BNNxmNrI|Y+;OO|6Mfv9xoxU(D?d94m8NXYfVF@hqo$uM)SKddBsg4{YW6gefufQ%=#Csd6QQhdNeUw3UB1&%m`L`LQvJwj5JC-4*x1||i-x|*!g zIF?#x+_H|+NbX`GC)liDRPfTwljdfu6qd|ix~k%cA~7uO8EHE<%?p0B(wnrT%S-!J zTu5L1q|%_vT9aZ`%os0kOu!*HPKc2;?0_q~3~@Q-8m`WZG?*S5NY}8Qbi=Pchh#2q z1C*>TY`hrr`S;Czv2FS>Ostz1n9{;)i@ZIlRqhXUT*9m29Eg>ob`B10qx(WLCNl0?bLe1e*QB;=J zBM7xigzkK^>LWp~A2Pe$C0;PC$&hEb7E1E?~@p5-_$^E;EiW$psmWCF0RwHNPA)?ShCAh9#BVxL+IP}H(SZIp$ zsiMtn#W9Z+J~IvcJ{@)hb{9cmhCnoY9WwmpS>=N}bghSK5d62ueXtH+2{J~)Cs-9j*fPd-5PHjGF%WpTOE=`>vg86)Mar6yA5l?xddg_RiAxZP+Ai33}&L>1%OH! z1(Z`G(d;2)|85g$Z6LCrr4i!Y;`T($N_5hIhS*cq8XVOOGP&MsTNANg}F2Zm62Di&Pe zA{Zk}P+|*Zcn?C-LThs}7rLjRQ~+)&nJv$EA6oJKEfUWSzRRQT>(lFpsw6N0hv(Sv zQpHATft{I}$pa2Id^?sPbbODf)!FS+&Nu%Ky_i?rdx&Os^y}xkYhwND^;#dbx8plg z(>$u#QKt%g6&~)7X@}bvC`Lp=xydtKzO(FLXkH-aNZkU2e_|Qk?@+0tYe0wOhi3oX zJ?5{xI41g+BeIrRu6iTL_qKBseDGi`^**rSrSJG>B}JsAGeKw*D2w0uyhP)OkLXOf zB}T1jSrxha%lVz4BpAzlC)oj(oS)8Us-W#X{Ps5#OH~_fRcPI=4W@B6GmX{v0mtPn zZuWOWQ4uVtnxQ=e@jekI-vL!36ZHJ0)o_9k^JZKn(7kP@*GYaTRQlrnw%EKM7*>5g zys(5#ijHzYXsBFuzmdY4zr4daX=!ki@cj2ami|I_ppp^Q_aEZfUcY)pT|aSVYS!3i zk|Ec5;JZ-<9{R~im1dc}g)!IEZ!XSrde3Uwp>q_R$o{CDL;^gH%mMRV(r>GK5=pB8 zr8^}6UVeSP4)FKZ&|7`5j27xic3?X`MpW$GvS*;4uMoY zO@@F;XGAWUdo2KXz5$l2gIEvw<8wB}JGkYF#)ENHK_~ zG^P}YKv9c!qCf0O=aMvrp|UBUr;@jv{$G06;g_F;H2_9fZ%5$*)Cs>x38we&T1}N6~p8!~o5)J84m|MYIC70wu2m1?#;;ygw*I5jT`mgxc zysEGG*DERj<>wt1NFO)9B7e3!6)vjwCDXI_v(BTIxk)g?UFlzbp=gFC{0}~|do7Jm zOyb$fC2OCnDB^D$3AzgL$_d2lJTPd6?wPj*1Y4jjkTl9w%3n8 zrF!J8goQ`swW}tbZx#}a*y`Fy&s^jOWa9;d^gSs?by45$Mv>|i`|AvQnFp!m{YdIq z>muHEQ7+dsi0~{%Xe4v_b?tKv(bc4l)#O<2{LI&L1a=n`s#q8=BiPqfNCh@LZJ7fU zbeUn0bOA3FAH72PtIz%GvIh%dkXULRPT8|QLlm|Q;XJq2Dtb_WGK8C98SmJiY{D3r z>&KKoRZv|FFDD|{1-J~tP0?D1ZF8L=KJVU(XjY-N1Pc&1Vk5&CCtzbv)4rX?4$UR7 zYh11U?y04%PgrwQ}x;o+gvoO#%Lg zhjPh~AOg#3rEGM80t??>!OwdmKP)7#{`q%Lg)B6t#gaA{cqtp*Pl}EF_qXAQrd_Dj zJBEq{tYy+VX^fWC82*MU5PU0+3$|G(MWGjgC_+eY$bqL8dr~qIx2~Yye zM%$=v)9WxW^%2#=oAQNPXQ%d1#xj|tnU)@tJQ?ds2# zsSpkG`fxDgh$e`4v7F$b$u5ds%3Bc-Gqxac2_`r=2`88%nPFYzl4iyn%L`Ii>Imv+ zq=M(0t88K<;0`W@h$kh!9vt6SLhI<&6DQ^G-<5tcrNHXh1sxCZWKB@368*9J=pevn zoM|rkikQxTPSC~5ZW}Ar*lNAlCDbp~?4lMp87@!13S4ekb=AisR&ium4(A=jdgZe2 z_A`S-Md&}4dgp~P<MB6=xYy1cIYvdB%}U(&>WzKht>eKdPuSzgfgI}VMwiuq z?LGVhNdw{(C;U?E0uEcQ+6x->m<~_IqE*|>lk(G&MJGwQQa-nYcy+L|F8RXCfK%$A z4mjQWxAE7i+&Rap%_6BJ^ZA9MxAqHyCXV$v7Y8$BQ2?mO`tY<)7C7LP53h7xS`%4w z=C=b>&1snEMzIL$Z#eoB!Br>M;YM9kA5%$zdr@;J-7U?kgUlOV!Z`BGWkB6#}r~8qEb()EoRo+)&0a$fSj#PbPf_^=m4Pc(01^ROu*k5$43%8%CG_kWP_3zfD4US;2k?o41J=)|p{XnzA$zE864@Pi}xxV3C}3jx3Q^e0d#< zM-~*H1=?0n1U}dhC@8#Qhr`1Jr9n@J&q9xZ7WbCU@|O!MW{Kx6y~x4n867RKtWJgz zC3>QA;#CA2(g0WR%*m6}_GD$njLtmq0%otKU2LJrAh27qgG!;yowEf&0atjseSO{5 zCBWZ1fOj-_3m*WR^D@QL@!Fs)Xw~^}GN@M*+S!mW& zF>H%)*_smll>7RF80@ImDvwpU?wwjC56x?J+UW;U2+6h3MlpZJOv~$q5A1vFgwk%Xl z{DPUX)TCJ<@y2YY1)mnatPT_@NySXhqliIarKXy_*$P}64#fNIv3uZ2?y3}PYM5Ib zvI-~=9X;OLKm4o7nh#51K-7xn4!q!0{g6Fq4ct`od%n4h0qr35Q`WruuY4JDmen^! zK$_#~Kofut>8MZbfgSNJ?A*pRttp!;(7mau-fE4-C_szqlw8Oy@Z!%F_`E>uykJvH z>S77_n9Vwijv9caBIn$uI9S7x%2k)1dsfL2aXLr8n-WHWzUN4J;%RN^$o6lp<|m2K z%0souPOQ_2^6@r{3R)Q|X1hECZp8efje&J)zCM7kM-+nsO%A!_laOOR5tCQBqBE4X zK66!&24-s4l?9E%@rwt)g5^LX+`5M`}TA zM7s7+3wdF7;m1yo4wBA%U(oOEh|Q8e4~ntgyq=T^p-|ge3jp&ugL`?5&y?jQc)F9p zd2`*5Z}!N3tIpBWZ_^EcViri3Iz#{!=s-}6zte4oVs#0(dro6MuI?`+$=*UOOAz7? zEwgzRe_iX$SlLrKL|D3DH<=sFa>a;e-E;msf(L50`|wqcln367ED^s@w#(e zLF$*AYMbd6DAiB-{ztwNyF^sxLzeU-&bDs*)~lpVYHb1ez<9m@lp-mxym|m#xf+*2 z%oU&5P~Zh*U5rEHOyLt zpeuoy;wX0Yb&Tcdc?cm!Oskd}#_>O9SIvp43^OEC=$(|&Z zCyQ5j=lk?`sU8w&^uy8Ix1FWGlcF1qM$-{*7)zg3&!=nm_H4+9&=XVXh6*Yoswk`k zQr2z44>+DM;uC;_^rwZ1u&&Owg6A)qzo@p4kH@QQ%aVQe_9S>1%I zzoo&DPUq3l$~o-wtgFYc*rW``5_|>y>u3TpOeYSXgzzoFC2GZVbfb7yfpQkZ&M!iR zBPgJ^Mu&+y^B}3V3A+&?dxv$LOJ6q)2b9uL$XHhVn%{=I0oXAt0Nq zP@{{FA0?ndAemC(zVEiBWYFG91j#&BJ1$nJ5+yMC5v8z__F_ z^L`IOBGE6MKwLM3b)x;@2N-ncp=#nH0d$%#(neI#Lz_jSqE{pm(Mp3Xhc*-ZB53L1 zyB)y25B|*Wsl!UDw_CZ4TGNEXwHC?r8+cZpWRQV$^Z;A#Oi0p_pcP{*uB3#>p%zG% zlGS9FA?Q`gMF3noqJ6Z3874nkL%?rZsmw$-OyA>!GSTP-i0*wCxZbl=aPHosYGMc8 zQ|Ijw(U7u?XG&sKWPYXIs&EQnjWbw6x>bPQVT4^M60R75HAr9XZG1aX?3)lFPfuHa zl9@TDE1l`bB$Ohmw;{NK-Rr{CL?vLTBQt7f|M=;TDXagB&)cyjA92!B2?o!qi=bkG z74@wJ`Gnmmn&nWqMzpFPF&#!K!Pz~yVODFuj)pw>V!pzr*qgCQy=J~j zMeq@Ca(?km<7(EaQgk8JBVROdHta{(tZE?_fbV;J3ThdJbu_3(FQJPm zmQjS+XL>O(!2rGDUS#&+=oep0X&lxd{LEdD9B5?rCzrqEzYw7@w zJ~AO{6~^;{Usg?E;TbbGWs65o^5mE+NX)Z(WeH9l#fLIm7YrS&F+FEY@iXMDl@yBF z%g_OiLp!_3BI7p{mI&cc{QYHg#Ol`^0z2J@GwR9Q;DmTjn}WGpoz4@QmE60en`SJv zPe{~oPgv#y*XD~;SvY_-Rmr#9>)iNTtkm=?tTbsTalxkz)?@nTroNWtR2_PlSR*;> z2*Nz90M6Lm`bi51U5WYy+eNcEM4L*XY9u~4+;}svy)Na0%a2(lur|1j{io!2S^k47 znM~Pgp0T9j$lvXDS?~?{?7F`yNY&hck!ADhl>{=S;AI4u9om3L?WfQ!&r=gDPb;EX z{Gj7;i@4{DEG-?ur#Dwf1SggkuAfr3u?|7_d{ni>#%yBWbszc+zkWG?uvlDKrWu6A zbYk=R_$C|$SWuR!ED38C4gM!!$DH=_F~zo}H)SHGnocc}K63DUsDdlQl}dk#1(|8r zPdeWp6^0_jlB@t6U{;A*+2SazkfH-^0n0og!n*S6bVGXyGyf^y5=SFOBLQVKEp5Pb6GQ-X-U~A#eal1@)Q@l~RTM_arUxf>wmZ z?u~D=N2a1XU2OqNGc{Hj*OJSGDnZRx#k~un8(A;lXyf&1I2HmOIf~HjFlejaf?Yl> zX6iioa^uR9WOM8cW-e-GIUJD7ZV*Ze_Y7j|Z=AB}35ZGNTiJ6BrlC}g8~$>;y)69F zNo`DBi7NtZ-}pY5zA4xU#d$9y*An?2ydix|Vokgbjk3avsqS{8Unrt<3eWfXqr#wsA%F zzu`dfRl(Aq8AM5ms3`aq=-@EBF|VqB^kvh~gRuf!bcWPWdaqR)G->k}+1}(QY_zL` zF(7zgw8<@kFcD5gV4JxL$Sr7L(ihpqiLg zjB~Uc@zF&^8Gq7Nv^&CEAIsJh%!wz|>5abE>->U`1_5OwRQGjY~7agGC%mD}doyEel8H?(alQ8VZAe~i;DB#Og*d4ph zgP?>xQkXS%O1_~!|DfA}@sPX{FWT5g$OxFfbUN(gGol@@$Lco4@xH`}VBd8>I}*}YIXY>j-*eC16!4vt`NcME#Va(WNg z_}VeV;ka9|iub_LLx}waOw@YK*Qd3*Y=^KhOiym!3Pm9}ciB0|W5EUd)rPe!2WGH! zXA{8VhlT_iDt**VZ^50TYP{tK9^4;;+{X1ud!}F<%=DZ(8=hSF(s~r|GgG;p)=lEy@-JX zYV2z>@aQ#OQDi)i(C@EcXEEE$34cJN@7*c?kC|@nt(}o0-zJoBk3=oN+lLJp0}VDM*nr5~b&jdQ?_l#@_b+cLH_ljF5Fo+3OUv0$ZBmd#;i48W@y z=bJ2c_`Nr|EB^133j(d9QS~s2hFc|tZtEL8P9M>u(Wn*K4~OBrJ#C}M8>>^DV1$9bsN`^WfyC)k>1pt3yj8i7X;ecdk0b^qahU<$0CDOe^sj8GgIDcbfJ|?d8ph za8GkVi+TfqhpT#Z-}cxAkGDqG!GOx50qe=_Pk*^`%GqETx;DXg_zd|!hr7_n>O@a3 zzd67vZ*z(^sUdN3!&baNZ|x^XBk$#PCZy%$OvN2-Rn7yaQpm3tp)z`(5}0;3BrlMhPHSrMlPh}@sLp`9f#Z!?MCI1jIALK&B^aSZ zB*=Rva98UVZ^1w_UrW6U;*A6qKK%CeZcjK{{Il-h)`1+awc_I5#Lv8xu?>0LzIYV0 zH&FQs*uU6_$~+o+S~?R9!A9~ZlmT^H`k5gx-YMa1P!@yX(am>!BMC>`z zO#Hpl!3~dwhH?N8VvdH#7?7L)PLZr_ii+q9fYB|OoF47Amr&!d?uT(AEoFdd`z3J7 zfGwSfuno!KHQo_z93}&F;0{I!HOZxKBXg29{Ix`bFOX-y8;&0Ms58r2a(_#r#t+rX z(3jv3PBMz$P+3_WeP2;g94?!3x!W3Kd=p&yaW5t1C!boLQs~uP84i*f7l{kIDr_PMU5F>Fh$s< z0xH*7;08!hlcFq$(3%N>V0mm!L!`O_q&3eg;i75iJJzQf-ek`Gy`|=hC|=n7aZyVT zPr^A4Gd_rpq;r3GedCJ^(vE>hdR;^&#ACIrUMB_LEUh`PbN0_M3g`*^l0wl?{X~KKVkF!3B;6az%dtE#0g{bxRN= z;gPFH1kfcY&W?+~4=E#7Db)A00{uc1XMjH6Utjpww1&^rWyzQ1sJ@f`%s%ILKtiz& z+LimQm#iKi5IZ1v(OUhC_^JVe>mchE7}Mzhg8^_cjKcD2l3}6a>}6h`7Tss zy5gC%z1(}c+9k&d`O7U0TN_%%lajABm|rs-w1satWPYD-{%1{W5(Bgxyv=4*22;|i z#070Yq=94gi(Z|+>1UY0rUY#&%bDm~bj)tq(Uc;iy|Zy9*fr$cGc- zB9(hF_!qV{xOrJ5RhZ}mC|DZKhB3+P#k1jA6oT2!i{pb2W3C$=4P#5i;MYmx)8#&v zDgn1#uHVyd6$9bu?aO=gp;8^7i~UAn8nTPyK@Ex`@^nvEjJUO@)1 zcqgk7vd{kTQGrxFWWZN-mB(A9fDflBmnPx> zoiB*jm=ltev<+^xGQ`;Cc-2Y;ubv6eV)mrrGKvPl=13QxkjPjJuFYm_=W4X%K;1Lx zf@?j=4KbR>ktc`y5t;YIl4%8z_h8diOZhq~I<5i(`tn2sqC=|IHLB4oUisI45xj3? zpzOwMxN7A)AI?UrAt+x$C2i%}Nwvs=Tx(;(2b8;I21a3UlqxS$44Xqkf`=gh&_Jfd zNhJcIKF0wvWj+}bRQR+1OoL*x4OFBn@NC;f6LwcTp`6l8TI*@!>?3Kw88;-D$C4V3 zEczW)S7vnAcuuRH4XMC7`3z5_VM`EYjGhI<9blEZm1_ zr99hW-vw%*c;RmSRCaKMIu~&ef4@UwMv_G%E_@~ad69eL^X38kh z0!JmtU($ld$brycVKvgfW-l~f{p6B2CngjWa+Sf-;FhAJ54xuB2}AAi1`*ta!{3PK zq16xTN*bH0Uq~JsF){{-ItK7A*Ht+L`fsI|eZIjTA%TrZ>Df~PGV770{<3_LOvds@ zy_;+4Y)X~@H`H|^~eEK|D%b^~eL8SSGCq*2f9JWG*)iEc&4S6|#_dAvLC-^HE;4m-IhRU6( zb1phi$HOpZ9vT3bfrnS&W{MRy8#=H^wkROlA`Tt) z9lH8+tlOpK)kIwB3+v+Y#OO`i1C=xqB=kGn3AZTsm$#hbMKmzMI6n1EZ=w*q7A6-S^5|^Ty2+58LKwpOGy&W0tUvI7|6tQ(!S4K5 z@x}Nm{=>||`5%-w8xIF3Fs{%Icvp%J#4JJuQ79cXEwOK+iH+-UEF_#P|2}}Hjn<$nK=r0-JeIFTe${@}b8;EL zF-tm{IhoryT9I(E1N*uNK))WfUL5GxObE&Y%x`9b5?7KFla^~-YQ_Ww+O)v~Q92-j z#BI>P>vm=!M@tYG7so%t{<-XQi39zc;Smk~`=!5L7Dqi37#HV1eSn%3sKDzkcHm$= z9zN@Tf|9;cHHewGSx7lKx-%;)%4x{S0cBeofONmm8&TT4z`(e;{w<&DANh?J9gCn} zkJ#Hq_;udyGX7e&aQ8hL=Rb}Zwg1k`$(_6f%F+0}=Lhuv|2lx+BSXOP5gQ=iCBk{4$+1EijO5!DSmeuhDE9Q(Xz6w+cUUQj%DK=JojH5SelR>4 z`QC@@xjc<`ed2xn9)QKrZwc0CT2Iv$E(JBr>=6?yfM?-vI5}y~+DOIHxW*rUtvps1 zJOF^9LN!LiS7<0t(yR#Nh>t-~Q$kc(1u8C7^@x@T#z75JJeP<% z%EdvG{@7dU5_C|A)HKmL7@|Jv)lfuMV45ThOomrTnv6Y#zO%wzc+epEw?~K$SWxuq z#_x5ttMOcsTsy9QyrrXU=IBpCl%)W}d7-9+zYmBb+&M}~onzjOyHj(ru|O#5nVhOz zKeO>`T1BU>yOjIt+LCs~OyTOq18E5ZVo}~Hro3z%k z*IVvOZk2B7yskPQ{+#`B{wp8OiByjy%=d?5!NhWJa>nv1Jz2=kYuTt#I4v8%_kOVU z8T>|DDB26w<(t-qwOm%3eo?E15h@_TcZ|iHEc|vnztW)>uR{i~?WeheADlyEsc`T{Jvz42rE*M>JoS!yYyUh4sTX;c1PK46v`Cfz8x{(P5Bv5oD|c9L zTSGU&51*@VTax8AD5V0aP?8ZF@S941@SQqi;oJZViNY^Fu>xkv9JEc!5^^^y{eBXN zL4Yf9T^9?z6Xfe8SdXzaxu=Y4fW()E8pU`REwVHk9^cUN-fh2_!(TH+ESBCl9n{!s+pq{AEW z3q}PV)_;zB6FbjnjVb@CyC+NKyL}J%tqh-w0I9%{_ArsiyWB%&SltHHPg(~HCByVz z$`g(6kPS~Qom#wsG27Cq*46}!l7fvDIZL;U46iAOPm`!j4MuGM2-w-G8*DK>>-PgE z6&UXcfXG6a&D`c5z5J}b#M{lbD_L1PzbuYmybrRU+-KwGn|~hw5^S5$B(7a21eK8t zn!^H@goviW91hk8pYm>&42POoGbKn&h$R&#(}On;1jE*b-4<2VYLRk2cTV3rZqwTu zzt~$?&|ea3_~a)bUAI`Cei31A78o35Jl|YvM?Vv1#&Bg8aAmo7XcmVSjm=F+<(epC zp;p0wTLd0yn0TRgY$gD)9O8lczV-bQSs!T@0*^4rj|2Wqbb96^*9fyH$;oY#unp-p zJ23M|ru2O+!U?n~e=p~T6cJmWNQQ5Y(Hep)b1@*}qJlMj54&a0-f}0xdzA zJqEW{-7{0+m!zb))-hE}d9T-fWoCK46@;>Y&oT%=0)*pkbsZVmTe@xZ8~9r*0(Bne zKn?4{xz5sz$vF#tEGx0ghaLGt+(D$nj<|gjh+;?Ad3aw`v(;ND%*;(nVmo;hmbf?U zk!q5S%FFyDa+3bU+K(I;QNM2)WP+@e3Rs|IA_}4nyq&CPRITCzk;KBk?|sx)b6mU_ zZf%hPlQ-rc9Q~F7fy6F_vOR5oT}~Yk3B|jsSFA;`5kd8(5G$iBhAz(NXk;6`3owdDNqZ(kvrr-yB@!=amAB2Mm4>(|SEf8>StjJ5S#bp#@I zp+lv8ZxGH1WKoI=Fo%lrNuEwA}>HCr90qfeIUNEdF`nTj_D9CsSWz4Z#Wj;4tTsp7J`XWBf1Vg|5S;_G&x zB;NKSKkYnaV?O3|seZ@S2Ro6-?u$_^uIGe4rDFq!azm4~aFx?VQwh}Y|Jk?WK6)DG zHiHbD6LUY@YG+K%3Tye^4HJsqs|BLuaN$^J0#e-ZP1~I}JO?Zj1AMZ`a#=77&@MF$ zd`Bu818X*tqeOIN9iUNw7BwuM1gHzn|L)YNf2yb|2PB@(uzAA9;n9 zO*Klh8xuOxM`bfQ>+mzFw<8OHtk-hX%Kcn+;DyIL+LQRjv`5^}sGPGqz~AY}GUm^3 z-BWC@>-HCai?A#U!-fV;ofA~VxU4cUL?AG1B~wgM>Gl}|U&j+K(c)*IkHUU%2|9>v zqgALos65Vu168<{OBb!q*>9Cg42vhmRWC$|STHjAcHMu+uQ+qh%$BuK{b~ZfB6o^P z>kAiYX0%Hlo{aaqG{vg_1vC_Cm(ObhX;qqvQ-;C#s8~slt(6Z+C~CIC7eWyt;}UW| zy>pfvI=62PI!$1gGIZi$2So~^Q%9;KTsoUsL^qK^XpTe1#RhD^w;cmR&qwJJbp+gs zUtPTSF-PNCU{cI6%iu*oi8V0rHe7G@Iw&=g*UQQtf3VL9drP7Y1DXWl;iDxbJ+y_{ zymv_3XjMwtK)OK>k5fIxLH|T*1*qlP^~tNK<5&$@tcd>5a_~LF)qmt=(m(EXsL`fV zmj%g=*O{jdHN?PC;gqRB--t`g2JLdMtW^)@ZEJ7uS4%G(TfzxF_lrTrIc+~4zi#wU zB?<<|(Dfmq{E#s=1vGGAgzn*ap2N2;uc)&+D;jHErt9TwvNvLCU^IK|lQt1Fx)sUg zP(%TT%_%_nDB7E~(!_0QpFR4yeg1mdIMc=U%3TK6SmHOF*>eFr9+p95`>|FET3JlxUd$KD`j@l<+~sa(b69w;g8~YImTUwp-j^B}_e3 zkICbxKAT0h1_&W1SoW&HLO zSX#Zd^XwE>6~hPK;<7&~{t!Dz=7`mmxmh$ZYqxGgl{ha*!xWIn?g%LOk#5)emCpl{ zA6?7d#>X~ADm|N4KN=4O@*#;*hjMw5i5u6)11HB!t%9pk!4X3o&BjZTRadd5V7rt9 zMn=T89{}nSO2H&cF~pD&8%8-4p9q9I^-7>&s-mrVar~5Q-7P@b$bb2n2@hZKVD^K0bMigccWd9fVQ=_dF?beQdQZv;v%kbhN zo4`-u6dk1t-aZfY<&14qXvtuGk*TbbZH3z~A5i*-_thh~;VsS8-q=Xj<(^#iG7YJi zjSuM_Gr`ClbKE1X2TT3D&1U~;IV))|YcfHj3{adNhB1lDKSfJwBIFjwe$1ZJif=S= z^_Z&SBhoK-Y!D0kpx}#&=l*J4lT(z&^0H(@v&z++P!GQyG6GtePlim22Rj)NQZ51 zIga7#;#x%pH)|&-6r!F#wH6-7oW*-c3m9x>XerX`YiJIB3drrswqBfoOI45vD51l; zIGI1yvyGmJ;IVFuxP+v{-3mXg|M&;K9PydnTuf*JlQj9kr=#g4+Nx;ttQw;i? zKR&|N4+~M+$@-1wD?-cz&n@y-SW@tN51IR$xx+h}2=vBd$ls*rTlj88c~Bp8o(WGX z@8Xfj12i--u|MhpeI~m`M4N|O#DHh`KzkOo&;3K2_R1IgBT12-hMx}^dviX^wW}KX zE#Kz!RyFlmxjnyO(HD$E7S~JuWV=M4n5bL_w?*dj9{N23XZFD!%!z;cv}csZU*r=d zc5UsD8Kt=B)76P0P_ReH6XtV-LEpaDhO|6G&az~C!@49iIjX$UT{1uUI0Z!C0&Qg|%mJux zL@r1y)-?z=&O%}uz~^MCqHoF31R$3nEiE;sv-}vjT9=>%Ef-pgw>})gk~lHdG5EFQ z(x&dPo6TZk@2A$Fkdr;6EC#WC~OEUxh zwvp0goH|8~VwG$sZlu{={vOSO9Wc|SwzIsWK_AP2nI;bR(dV+x$OkyQ{cF||fYF&4 zj*G30{9_MPU#Fa^M!I`E?=|U1z@pO#Q`L7NJiu)oh+&Dw8;Xwp4_`XrVYzu;UBYKV z_gdD22xkTY^$NNHPIPFReu=h2ON@%Um*mBe>tYBNg|oZgh>b?#aoM zU0G6Ej#=!d!;ws*;@fnjB<7Krtxgt_h!9|5q9wRucm*N)JI)Tj{*4Se;0$`TX_F<1 z-9B*h+8F=9-opS8i-N61i18#BWdn8eG)yyeV8$CJ)4ixeP~b4#6e2iK}W>o1}Y%g=ODPIRgFwqKQ9!Px}atD<0nuz!x^F z9@8s1&lHx;w2q=&>~{)!k1u(=8`Mar;!PpdaRxDIHRl0-47#wi`-8VNp;7)@l$;*@ z&&T5(yR;53Q7@;*0B9sf^>l1%o!P*T_?GkzA?j)vEpoFj&`lmdIg*m|MQC6Mp;Y-F(8 zY#%|gVKHFl7$4JzQf2P!OfFr7B1n~rO@!D)$cKnAET{7a9}nXCV)C|z*}I#BoQDlu zqX?divNEtFf6W>$PDk3}>?k)TPK?Zv&%Cp1B&raWmk@=d2i+c!Z-ycu*L7yb%zgsv|uOSR#-Yrp^`FX zsJl8v+{S$D;)@@Y5EJ?LX^vIHzKkzV#cPP0=l@T!x6*|9gf zE+jxCd&2hmqL?B#;s#9~I~EQCr)HOhL*R8KLSHhzY`FoZD>wZoRT>R938UstkqOh% z>V|#*-fZfG*)psuOR?uS%XXSO`8g`OZ`e8X+(Ar20#bdE)HRN-cd;IKC`I~6)ej(l zNvIsQgx*k-%O5bp#s#atXG_*z^VvP9e}n>P;?z2dWw+|R{+!XYL@WKO`>SsyiOHY% zP~plO0XjC0Bgv8R<8Pn1z;AI&?=RrqfO4%$hA3%S4PC2omtkW>*+fS0<1!-Sg}0ju ze#VT#IKvEHPk1H67=Lbvk!n=g1D(3uh}tRZ@;H0K>UW30$`LMSg+n)MHVqN3KdS-& zm9$TnzDjvmOGkKtFQ#W393lcsZdSY2?{j8qUDBj(E4ywZ#?EyYeZ|l{UP@gcKF!PE zQLx2p<&&$mZ!_2!Lm7G;9IAORX-$?_Ak6Xr0d|3RoZZ6YuA&n1Qu>yr)|QStj56q> zh71%pg?ddwdWB-mE+LOhu8zSsD0p%}+*n8w{%Lk=!IPZ)xx8L$!Nm6UC_6{0Z|Tt@ zr*pCp_WThsS}qD*T_sE{h6fIUu0u}mbp(?Zd=q<&_jvT}DM=g&X^K@-fh9-J4@hC3 zNk_@&O&%NpA4td%!BSmLN;C(Sj}==v^e+krn<`x-L8rR*ydPVT@U2QJZXx{u{CIJ$ z3nKHzy{6o@1Q(Y*RZbT~#pb0L#ro!i<#(1r{t?p#lsI2Ug|m>JS&HUpxVpQ`;ly-I0j10K{uduIF(|ZK^mmtigZhNcOwmgfHWd4-6$;}-MsPpd+WWge&1Se{<>@5z0W@T zbN1YI*SULtj$&Zxhn58yYqx@)pE50M%rTP(IpbKe!o`rMipZxt#8Ha9C&5Bi-C+>p zfUrfRo}e@c*U7t~F(7w|g(pQ%{u_#|49hY7n&^J~H$~GO%con}cpjIm7`t{p4+$B) zon);p>At8t%}oykhaVn4rhsT*>l}UDvSoNavRU*4rDXtuZGFiY5J;N4!M)-xh@x~U z4Dg&be$-n3MJ3`K_jPGasC2s}~}!PYBx!zEbDNa-!>|L9rgMv;>x=UYxcUcJ!Jqu9Dj? zh7st{Nk5ipS--tdig=1JTOvtMIqyyVPHR#_a|((1t%ODvaNl6ma!jy|dX@xfGDId| zZyWRpT)HoPkse$l4#wq7{P@-hjcPm-L_8ui8xB);>v-CQNlQ2H8y^9dNkIeZ?>VIB zyY&5r-VF=F7Q21=f|kum#$KQGjW~GhpvXA4f^la&slv3Sb5#&Al}{3RZOmM>Eaznq z3f`e$y$w1A;sW$w48_lxX_42ygacn{t=F|UaYmvreV7u*C)O3tu zX;b^DN59y!yRaKG?~l~8Uz8WKIqJ{femsTrvm8=Q10f%^_MuXDjrztHn5LC-;qyC3 z2k}eq1LK43ANUBoP!#SJ--EMnI?MT{rli`mz>{j(jU#sE^hi?Wz$TgOjcO2-UBKxk{+~Ud< zL6>U-07!fZ=?^2u)@T+ZyiXjpzZyvE<{)l0MMMlrZjU-q)5Z#;{u(U$74l@STil(; zUtSc8O#I`6NO10x5vsYzv^--7F?y6~71*qJXgL_%bJtmjI{sTd2|>JAHlR^o`yVYj z@|_QKe1W$2FRr>6Sop;-%@@`khB&1T?-5;2UjUWuS|F)x?446=Md=>0O!9MXsgPUu z=mYaC$DgM6S#3pY&^p6_czdys1=gal)GqSL1Cx3>=Niv5)J>bs_+-}R@`yYBx{Z$V z$4P;TVp(rm^vNIbz0}jfh`{nId@_BR(dFuf;&P<9GSHmU9bGO)6s>l28r^HevHh!D zfed)U!TiIn8Fz`|g!4Z77WWeQR`a&vK=Dk6)LGeTOC9DzNO9}?YqoD6F`C}Gced4^fly7)rI760b04OQswwN% zI=8v(G12e$(4SW6hy~dcGAQs1wx&(Mh>55hU+pkW;Pur#x=wzdiJuKWB`=$6$9kk- z5a}22sCv4cG2Z_HKOTLH@qd4xjpx~7Mu5hfZM}TV3r^%kkc{8o!oip0kmpd~P~=eJ zQ07qOP~%YN(1^$1Ud4m{^9}r8pG$dve=Y@}Fc7bhkc+Fcg^3-yM@FU&nzH&#V>{bv z`;7F|m?4t<^>Zk5G!IguINdvZFmpT(^vNr8_1sh|bAjO{u9Ff;Bm&xzS52l*Mi9<; z(@SKgh(nIzZ<`!;kB%R9Pt_tTD}AwOh8&;K^yde- zIz|cl!UEkx&<;s@Oo-QFR;a?&mek`YMEPdHH)>$LH zRhgS^j=Pchx%+ef$13s;2FD229*2G)J$qO4_Ti_9%G9ya=eFeF>biwZvku$-<50p_ z77LYezj8AeZ{Ib4FES5mtF7D8@l{&o>wv`oK~Yhwk$Ij4u;0jHk7wQ$rEZi_jbrRt zL5z^0t(*!zBe4xGG}gJWqEse<^bGe50h+2Sr;xi?TAF}rA>yfOn84kTkR}3D=I@uJ zCSY4Aea-VJwV1NC;kA&d%z-nSmTF814Ed)iRTc>qkTJ0gg*g{Vs^&B5*>IgIEXcxo10N#-_ToYiH5 z*flm;BV|i#pD(y`m`XUT;U)y6e-$F95F%S1^4tR?E1o;`yn3gSI3CbMzPv0P_k0I* zyk26Rj}@H-@p{<4cR&9W5Jev4O@BhS&=>jKjJMBXxDnK__{5&yy{Bi9&U1gkth+A@ zn)!O(-fOCU)V6L;?d0OCQFJl zQcTqx4WKtLDk`axRT;RXdR~oBV7jmLMRj6heTd75bj-uLBb&#^SW-uq9DDK&WPfMU zm?7AeFr<6O$Rt}^5!?1MbEuiL$IymRD<)AOP$>{O1Ii{xUv2|ST(tk(o@P)l7iS>9 z<5lQ3$hb@i-ag@W*UAE<>`Gwy)NWd?I&|}W>r;-B+=k*aiI~yY0k-h&*@HRNK{2a( z`e_%oazX#qV!SRfo?(A-@$fJ8QdNqvUp#DIijoNQBRp5?DgQ;M&1OHI^)@ne{THV} zjRn{2hV*`@S}&RxPUJU{Rhe%2qhOs`y*5P-ns(f70D@@4} z9?Eug*U5*rZ#UZ$MQRc09$`85%f3emSMGA`3bE_prBtPHoBdvY;$btdk!#Q97CYUZ z4YcN@0OOP%*Zic&O>NC%Jw0{bBTX0X(KD6;^9v8c+X_4bjqZmM%vBZ>l8~=2bd1p` z?)C^c5#o&u{XvmH+EfU=PcZkzp5Q|1q;PGjz})qDME1dwXD{}nG}RaH7{GTz1THlM zLp^7%cAnN68nraKh`TrzY1RT1sHPbwbz|QZ8e?Nb@&cMfqeS|!1$RK8Se;7>|+8fy`XM9D0vfZyFa=M)qqZi91ESaSlG;0$SXDb+4s>Bi%Atx6$ zZ5%|de)I{wRU=)a@0+nC&utvt9*I0HSyn~=8l~cy)zw&>RV$9bHp&m<5qc#{F*;vU zg{^baP~;6_VAL3i1B9BtqjZ#_VfOoSqnWTU7>qc+pVQ_EY zOIdD|c#M2!Y=%-PuTcU)`dZ!7MZ(42WJlpf(>wyEZ)sEo#*ds)R(6b7+>C>#Jqm;M zYyz~H+2vy_7OXi3?+Bls7}G2ae*fGPW*n;EtkY(Y4CFHCE*yp5iwC`%vhm@ycKk<#O?*{#g0EIBZ$kZ6ASm5X~<=T2?V4hC{A$%i9rNl4)e~`6ceT zjYS@~1xVm@WkMRm`$GJ(0Y*ly6=E~tCNbbn^qmn$uT)(#(UQ@W`N}Q|Eb-)6G}}JA zNn2QP{AC7b#@NG~_bTD)3eVmExZhj218&v(kGTT^=`y8_>kuXYLsX!oaT?crwCljd zj6RwZb9uc?H34lNv!a1T%lbUAKG?^T;r^D#1KvF1;=YiFjWly2f|;HOe>IndoS6Uk zFq9yx-bKMT>3Y|w6ynPn)7vU#9I2B2OEW00&GOj zdyf@9DDXdgsDqd(^<@Pv$!LHHdarrxKj_vwKg5dgeozrI4A*1_;}&#PhsFyEb& zGuxO@%`cc6?z442MHyKa}4AaKt{-WbP2*ffjDYvw3 z&LH8F!PcCRW3Te|JkF>s67#CbDOn;i2;6;e0VkWJVinLZf*b= zLT6g+h+yYCa-vt-bB}jzqqSwtwg>eNT}?&P#t2>y@UqIxjqk8eOHr)mN$sP2S$$dF zL2*itNqIpU9x_cZogzRbr)l%1mQRDC6dFB~A2VM5D>mpovs)qY+LVT)xX(J~!?Wkw zGJurkU78=#T#Qqr$D?P2J|#54Hu8XcRlrL#m}ae5%Ik?@RE2lgjN7E=Rz;|MbiK`T z_z?G^d~=ves;Z&-do6ADyRyyDHslZOZ2lZ^B8hn%k)g&|-iu<^R^}3R#@3eitd`ddexY(NSP*^T4goliLAzsZK?`kZxb5S?t z&r}f-<+}7X4<9YnpC#45>g5299F)+7<;dGqKo|Q?+`xHeLYdJ#OzsS*<&$q3M|(cn zv*ZDDjfmM*Ngt15EH-j~-Gg{wBcM3T>X-r4Sv9awZ+H_yq)|HsvoSZS3`_0!yAR9D zE2x=`vhw6*M~7wP;;Zxy$*e7vt3o-2<&=JeG9zDg96xS&;#!0t8Aj zhmjS;BRJ@VtTcjwZ`f7YzTsIpqz4+)`^v<=qHNl)NFVmdvgF|egOqC$RDBFbLQIBY z&d4>v$g?=|pz4-KkM5AvE(LAv!$M-mQIa^H_W94@Pnd;Y&ZN@1%i<0Ul-(eSVUe9N zfB6tEvSG%K}4obP2~8I8P+RgSU95D^Vwo<;JWx5ChNLW-wOKo^h_dg5>c?cxxLYm z?$4Sgqodz6Y0mcbDWm`ZmZ$W?FtA5oTN3tfuG& zOVd1?A5y;U1C*rIOR>3>7D9gS@7P#U=~A*y>F{?^Pc{1R+iwUs7Ka5tN_qj_-g0vM z6E{X3_lOVIyYf#eqiRL*e`IejW}g&$pD0fv=$sPYl)a9KNOSX5xu)j}+~sQ8dgknn z^`glNXfK~8t#g~ePI4c0oFn+T!~fD{V)MPFl=s^^T_D8;%DHlT8+w85A#~GVe*l|D zkr!Q*lwyxf}}(1U@Gv|Y20Q;W-vo2R&jxW$D1RFC04pWmV7 zOi_cxMBA%gWz^;VDa_ELJ^mL?#CF>qr$w(ti2+s_owIaE3l=HN=6VI>#RioU9&B-A z+d^aES#z@-D5v**k4!JNhW&)dI)wEbXFA<+maI!|dV6@73WKJ`7dg^G&NcvpVq^e? z#^${t!WX}eQZGR}e=LLcTJD31XUz(~pdd#UImKTub=aP{%y8%;x8pt~&)ctpnKD7v9kw>M61IEGW0eA*++xPPF%~4Ujojxw)m~*(cW|w1 zJGN7r(qrGLX!}U#^kL#gdH6`JrJj}?6Fz%vZee;nG8~wx>hrK7S3BWSr(C3? zsv|3*BcoywhOSQGM6!8%b=I><=6sr4D-L>xFG4DoBCE~m#bxjX{mDS3`@7J;zW zP%Z{EIX!x&sa~B@@@ENsl~A*_SQH}QY`O&*;C0iO4K7*DX@2xQ=3QC7?&s)!Ly@h9 z53eb!1G%soreIveFrtA76{udS>hrzE%jicJ^Xuu}E-Z z?RWky{7(kZo}RMF2wIE+Y6;L;Nf0u)Sg-|D@u~EaEwK%y2N!(|p&qGzC` zMWl}_iT`pecXEPWcr-%o1Te#9%4F(=$2{wIjvX1Ju`oM4bb&c4s&3q2L zRqr~P_^#J?iAAEMC^tyZ{7MjzAw!Rj4KkOoEVjzwfr+H*PQJ<8Xj8|ZyAST0zHJo< zBGZ5~Vtcy!DSxWKZLrA`>iE>n2BU{kD`t(Su-T22CE|`xQEeL$%@Gh1C6f8y&ds2~ zi1zET#RbP6ceto9mHyHV@yT*oK%T30lgr$yJgeeeWl>-m8D0sSEl2sDf&Kb;Lqp;55=evV7K{`>zI!%Q3no!v zi)QElM9aSULNkG{QsxGzNI034>U-^1h<+l~urZ7>W%q>9HRWm6R~P-1w)2%CQGGRk z*duacK7jI+8Y0GLJv_Sy9fzE*RHQQ8CC!@?MQvR7hYFI+7Op!oVv??UJ1b1nJV{pP zjHt1RdoC+8)E1;hRSHZy;iTf{)N-mV=55VydguL@sAgUl+mx>byX z6sja(AbNUGF3sB8NG;^dXkoec^1kIudT7( zf2XEEqXj;l;D`eqtbROZiLY0O*e2o%_02xkw&s=n=uB>~3vHj+F@ODY&D>#c;nxD} zE5d-1eP+&;OD}khDrDpm1(EoX2ZS$;sgp%0$l5?r0|`4Rv$I5vD4lA~q^EDw>8UGLkm3 zrsjH!J6`}Tw``s-D{ZsqI0#=ptFk-`lTy^N4U&jI(7tmm-1}0FTFCF<7<7-q$}RCGDE(s8u-WaT;4rWqv6ijvLThNrN4k8G$?^D*z!$5zyP;LexPtda4LU}* z;XNp5Vp3KI(G7oW!_D2lAGVO}#dMWk5MB{n&{qH)KbcT&ZMkNvH(Hv{V)|Mt$ymo& z=V%3gk|>045<})ujazCJbqDst1@L_tLwbX~l=6b*vyYvLTO*=->ye>>Gxo_Gm5v&c z#Jvd;O!1^+?B~OC`C6?b!KlP?7^bprpX^gVO}An6(H9lcTgr7mZ)ABKKD)uEGMO@p z^v)j;9{#@X3skr?21#dEwNUcV2$Rj^W6@of6p{l^sGPjxjbBEY|Gv?Q{j z06RX7tD@M%I(+IWF%@TsXDw1Zwcjop_oac*l45 zf{hPG4PxgLqUU5_2Sat*si=iS0CIx7tavdNv;z~cQjb-FrI3Mc?cx+cyZeKB}QL&Y;g8F@>xv~9#RkLwj($`GV zpb>;$-Os0QJ{E$TNwd700%X~_n2#m-^^5OnYuhk`OyX;~PY3w@Ss+BCYUAQuj|Fh( zI&^ywh_svnc_L^xLg8JgKi_l{)2(9Ct`d6uoVlpNVXDU1x*sP$j!xsuN8`6PnX$9! z6bSThV~b8GD8VVaM-uM_OVNktaL_}eUS@^xT;}T z?2^;&Vet%z;0P!(PoZ5q_WMZbG`p#4``b z^GV`J6wemBEQlj34pbAk6JZ-DBu`IUWD1z$wrdunlLW(7DS%L1){^(gha=0aZgTnx z1cqTQ;dK!W&xIu>q#G^@z^R$a?V<&%>`k4%y0jz{M&B9k-$khaBBeU>!>lfTwAk&M zlF+Fi&nG?CBcfjtuxLHte-F{c@`kO=w-phX8R~pM`|^C(W{>3!H1*Bxb)Tyl4OX{_ zjN##+?N7r=Bqbmyg~9!a09u+__xBTE?kmY@u&6%Wmt3JUOBa`xGV`}S7p+VETvmcz z8z!SodUfsv-%ilJzAi&#@v-inkl!iV_tJmCf2pz8(4PI{HFqiV3F)M@`v$?)x7MLx zW|tF5jU{9~moEv&Yo`k7nepZ0<=;Ox(fjC=?#dK6u%F5Rr7|`{n@yIsqa7Iz;||{( zM(hVl6^r#T((lK`v)^al49O13MV7^Z^@HUsG+GjMhhpm=YXH>P$nGh&Bn%D#n&Ac* z&GSOqvUBQl{YB=VYwO4$o(MrWE>2a{*jtPNeEIiPai}^+iLK|G1`QgPx-n2C-`HF# zEqVvJsH3mI(_i{+mS2|9(J~u1kC8d~DBNzIN`9Sg zYriBDT5zs1*vxtLR(sIDn3mdk&YCRY)o}ciBo978z@RY=Hnmq#gl-;XreOG3*yF8# zQR^sEToY}kz4)~9bDLP~)7qsDtI3{2i4~#PTDO--DKwo_U3a7yi}@wyVetYKb3tRf z4PDV{F*L**`*3Wpbg>yNm!R5U)$EQarg~drJ3h~b+R-|RHPMZV z;acef$hspvlW+J=rNBt$7KYtCV>kF({#uBQsquAK`*+lmduA44yyjxss(yUQ&*eFf zs{21B8>W-vkhX<}T-`KRer9Z6jZNg9zvYen_EBa>?4#pu4GoD0=3kr*FiA zY~i)_%<2>xCCW(Rtma=89b0)=g{A2HT|1DM_O}#K21GV&raBNR0tDV`exs$p!xtU4G4J?`1=k6}b{<;;lEPYPxI+05hw^S>xkmU<{JGS)B z$bM!yX|R8pP;d?(E3}WslgHD6(0vK-fZsCXV%yr}MU`ON!$!5wgP>$74ep6G;F+|N zxxeL5E95g_%dOKDmj7%bL(Kl`FnI$uZ25!=iD3Ai(x{}U>KIePj|!V0Gp7&o*HEtiut7^s!nfBgl< zN`bY9F8(<5_O-_l-7s;7(Q@$deL+aO%*7+9tnNnnthR$!(>Mz4mor{RCCe%Sfg(v=Aqw{PPfvsgMCbB<7hg2t zKSgjuz=QoJ|N2+wISll>l%i=A6M+{84+j40CitJ5iWCUugb1*vItT*oV0$G}{!F%>O*}xDp2$<89liPw5`hp|*o(qAY ziHsZJGXf$ve2_IB1j>Id5P1=}5n##uya=QsU>+V`I8DRvAC)~7`ac&i2rnnR_5BYS zn1`DiKHWcM+z|M%$-D@302s;zFBk^U+dn5Kn463H?*Tc%P}tv*a6-Ubf1?2A<@|jR%kSU+2?Wdy`%RAVhYW7} zJE#7XaRXpZI9tRYLNG7)ZxV$+WDp4Ff8d8Z=KWg_%*_q^dpu5VF!*l-IeEe0e*%Wb z|9@xA3;GWVVDA5B6x^8W@AU+M{_6yO!Yt%(JunX^^xsST5B_jtuD{_2ae=x1t@s-b zFfWAj?n~K{;{iN>uL+n3!u9vs!Hpq*LkI?ef0tYRu}olI zF7E&6@o@3{$1w^GS&;P&mcwv7g z@NfJf5HRoGC_td_h5yT#3j+I326OSk{$mS;XXf9Iq1>SVNw|OI8-x=I1O8TofWV-? zVTH%R^LNA$FyuFx%O5Dfwr*qFwr$%sDn`Y&lP{>CV%xUuRIG|^+o-tCTzl_zZsye(PyYkGy>D-Q zfe-^hkoDg|ffOBk#|g4$=&{PL9HOft>h zZ(6_K78Gr~)Zz8--vSR)?1MW$C2<>Wl^;C2g&M{_$8V?=zT`6d z_Bp);`FXqU?!wpZC3>bJW_}W{bHI$-`I~;cdD!&k0Q!E1$FIYouRa{_S3}L^;ud$Z z#_B7rPHT3~rrCW1mRLf@T<*avD#!#%8RkiA&qFV-X&3zD?f402wbes-JC<4^yiHkx zOhpWx*u(OEzbc}9*FalzaJZP0)3!*Nj)H`?kSZ*ly=9V@ROP;g?2ccO!$0sX+D5qK zd3&8b0CcY3Y=ltKY-#DO)JA=LH_y&AZ5#efqc6LcVGS0vmW$Hg6-SQXjZ#ZG6tH-? zi-vz?OW%q2obl#klf(*F82pXsJP^S17%j2h)|+Cu%`LgkDb#9YN)uvZP zIpbrq{mkCJ!QU>)SjVuO5QfKifpR^||mJUMpKlkAhLI52% z0d}pTwclm-MLokNic(0BeY?Pm#U?G@1iQSIFUK0Uq6Q}i_6)s6$q1Di8SXhhnj}G} zXw0Ifbq7J=%0i4YJx*0evinfx$z@Vk*_Y>Hryx<^gr#&*jz)%I^xsZ7?*AjlSNfmgFM_g)9ZPR{cu0yI)1w003SN^hv>LUb~O zVr)4&PtKr_z<$2Vfj+;ZwKiE*tuo^1q#_yU@e7)9EJiDupnvGZ=ySni-$2p}_o4`3_&Aby$BKoq%C z8wV1_#L*U8zr21#=vXC%+|iRAJ`NI1-vBtcjh2U~!1A0}ppHeOfP)GM?wH`$C$86q z*>(;nPd|_Is8{50X(Fgs18t(a#-*V#4y!{n=y!8)#yeEUC#!yw)+|D?ic7L;-4L{!L z#wUSsG#_D*@Ok)eQ8Ey;WKk(l=QDB&7(&E9DL5myZX{Yc-p01Tl z(NNQfYtmgdYg3$&1B0qJ?nyd?<6M>V0wr>UhKMH7Di;m}xshGx5HsHa9TQbeD>E6B zt*%yx6fu3FO30rVDg`=zyfag%&R5#Db^@z{#t4xE@;YBTMO7CO;LH?qX;)G=m-aqB zG_7An{(9S26jV-n!Kph-a|~bqx!$^j#_E3zBPn&9Q02YNzC0e?a`ijICQ7)=da`%M z@X0A@FQ#j{+wm3ANl4)DYnR&{CY_F?-dy0#0K6}X!}n)mIcs<_^hj6f7e$ZXBqx1X z5%UNv`lg(E5o}C}0B=9{I1 zxq&%S*w`=d%}kjYTeVhEva5y&)FJ_v0a@Nf+TEG)GPTtHWqY&S2{iAPGlWG{{HT9;)oCFbYRjN*ECIf`=M47=?fH>vDhlBh!mYpl%ClnhO zvxs|=u<-!YAu*Z@Q;3O+aJ>AVj;1-+DMZbsnc~wB^D?LMU`A^*+HK^`e1tPOcACD{ zcg++X+bRFhOiCx__?!ZJ2F=OhabXyD>pn@*(XLc$^uK3v3PF6Vao@Z$;Ez+{6biz!l}4KjxH z{ps!M=<(s{)y?Pg>)4O)>m%S}&&RI`*=&1>4yEJ#a>a{tEy0O}+evTFh8M0^H7D3~ z8-#T@(74`aCgtwlP^2V5K}})>ev|1SUQ9)0)kt z8U>=lUSk7^l%P3$=E}kKXau5}Hovi){XShH#5YjsR%e4gdphaT?wbf+SOYDb{bs#> z!r$Q#Knk~0sEu-%PWuwo2}3+YBKWpBXN5c-5mmMO9P&=1N&?a_$|rV_qN#67j)^c# z84{5b1j>_g9T(6;hNmquY=OfenoJyFCOp;OF0N^IfS zeE7k$Kf5ntu^j=$Cd{LnY@}VHyG{q^9(MOCpyrv@50`5*%s9qbD@Y*o_nIcdJrlWk z-sv7JOkx-&?*|w6^#$iQriQCF2vI1FF)y~vJqfX%YC^j z8_ygQ6?z~95Yp9}imsUmhQq@0&=NNmwiQ4>mmCiUOm=}KnDS~u3tZ^mdpRR73B=rg zfn^+O7o1S8^D_yongUYWfQ>p#Gg>m0Hn8i!f^+tfAn1%8LPufGkErS_z~0C>|A+_l zOTBz-Xj>&nT+~L|X+v>GG=RJ3(nK+Ky%mXXYNxbV?2gt zytqX6snL-jnP@vJ-=l}L+?Cl5x}cF0h;fx6JreYuv%%E#<#icyU4g8--u@6*AFtqE>JHv86We_KK2At>6yvl+PvR zxa(QNeDKvD?m(aGmr}|z2hx)u@khr{Yqn@2Fpaad)g_lA(^?LBgX-9Km2`a`c&y_$ z&0tU|uHiZ{|5m?RQb7=_S{RuSLPv@4CxSGHB|5$28?;w>(9X8Rr1@+|7~hTOYr@Y| zQdd~3mMM151U2q{eNjmM8Tc_QzVu3$F!Twg>YNA_a50YUAzA$V;|qTS8LWi2&YI8o z(X}zDt3h0fN;#<^4^LHN`5J=+;CZa*5%ST}{=1z-r3pj0&i*Qo=j9m6^qU`Rz~^Mw zz{jsGSGqv7Q-~L#q%N^Z-oJ2cSUl!J`>9}>{>YU#Uqplul$Ofo5ru&`<#g`(qhNKy zVOoL=8rL2_77VoKwP@9>p77h;p~COQCA6(X+g~Q0fxRKb&WiFxxt94JAR<>uOfVVW zQ5zOxuW{Rsq`C5h_?D#23G8|5vJA6BkQyw;Es6Ke&5tOm)MsK*&WtiOg$nm{%*|iK z45wT^zkG!Ml(kYhWB7Ri#&M+;)+`N%)2a&TcxUR~dIi6E@TT}L7uHr7A+#%kWhbJA^-)o?X z-=y3v@<@%?wfw3#kj5?$6@fQOUu~ zPK4m$iI$Vh<1VVl;#vzy$_L?}q{kU}reENrQIrH=zHx@8_{Y9}#0i`8w>(#fY(XpQ zw0@{{&%)Pxn|8>yE<5CT&saT#1)ny;Yq*hagkhg4zNfhMz|)vL$4y>mX~qhj=`ciy zrXfnBA*@}uGy~j(nHd{&*Fk^#kTUv@2K8SBiTyXCf!eI;o3;Y{uhbu}!hJ<19Oe#Y zu5K>oCiZau{2Wbf;J8RwNdEJ(vvIKgcgD*5e?tKQW(9KxOE)VLHkN-zYRpL%MkIi) zV$#M4YR^qwy51NDs0q}Lhu=57Dlc^Fl1ny^wZuut#6e01w0uw}+Vf0xwKw{=IB&ra zTt6qu4cRjicnFKqE~CDHtplTs6PM$;yyu&v>tEmhVD}k1JtemQjGmVlufs_j=|od2 z*l*^)O$YWDJ(H5BJ+VPOKgTQ|4u*llQA^L?O&4X%p%2q-Y1}}M%U8hDV3zE?#l*Fe zJGtk=D>L>lc!Rz7ZD^GG(4n3rc`dj`9b058h2i1`I&peoE8#xT;X#}o>X2~V8}_vjb7h{r%(Q! zfsuruZ=T_nzpL-3O~B`UX^aXRf{$efi0OCC3h(hqCW4BK;f8H26MMjjw#uM&+IAcz z?M@Uttqc^n%(qw&Y3}ry zRZTY;cJ#)|CZyL<1kOVSW3cn^7lz=YKjv4yAiI4HfQ_X;=HNge=9C*uCqN{T1g+B& zarJ9&WRv?EYphH}rx~cG$e)>ji>S+zGlwtpckcxy2nrgJU0?m#|1?i>RfAQz6oypM zXBNIL!O9VP%j+qQibTLl5r4fXJ8KE8SYeypvSt=@UmwEFKx3qwd!)HF6+blDNOP!` zLs7TJqz9@(X;PWCEmJ{(py4yK>YT*PT{BZ10;z(6+kb`h1OwQUNC-Fh=@37^H`@60 zb5cRG?wjFSH%+E0G48!s^xOAnC^8_9c`l#OmNRoAWpFf>o8))|6Z=N^GV|B1d=F4j z@unEJe&4(9x5fz@IsY!@`1&YA$!NNAq}p?nWQ&3$p+I*OyozYj$|8H%67M@UDc&QP z@d$cD^kBh0kp^%;?Kw4VzxnqXE*;UVo#pp>Q_^eYTp&8XCJ&F;V7~65_3r5Hw~#4I zn-&}-CrK|jB`*EgTZ+D-H-MNQJIZeRS!_SY8psmS-QSOwjS6pIfpUhqly0ZTE=d9p z`(aP1(_1@1NXTEuK+&Tj+Gyce-;q?eCZ5~U-yDG^C%FM-*|CVKvAaw2fg`E8dXcUa|3oX*l%9Q!#)0~1 zhq(UslM$Y(sH@p1i{U_*CASL50pie$LnSmKVl4J6t1uL6Z)FMWYd2P9VssP#O7{g$EH(UoO+?SZ)e9gtDz#4hfHLpp z%C2AuF{Rcv!h?oW=N>nxt95kK#lS<)#kanWa;hHdf8c1^=m-Ca??zdZk_NL(bXJ2C zI}7~O5b5P9I8i*tuatXbGU}}XO}r^{u8d01*B48eN5%9zoAXCHG>7}e^RTTMevbmP z1vyni` zKB}qio>Z0Oa?f!VB1auvsi;VJ;RmP*Y6MUmf&l&Kt}MVfzO?no7KO&hJ4X2RtoI9EETT7t%~hK2d_1&EX>CX=Ib+A@htvEkMFJFD+t zD&H?p8GQ5GCdralv^}A2iBYw7lIAV)1&6kILZoO@w^`_Q`f;1FQSwW^)vqr_x?{S}YWrrTYrRB8R#Bvf&vJNG zd+<|CBA?zs3x+4yiu(ol?QCd!U<`PL85S)GLs0Iv4mL16 zoHhNc_yXPwLp^Roy&(_Y9n9g6X_8SxnL4$0s=rEg&?47S*y^A1-xH#XP!zzU&OBF+ zqc7fKAXUB)CEEAd$Hk(RuVb7&8f|hQRAU((oZNnvMv@2DRA4>%C^gyWdZGzwJ}x0Y zVTo!GZOddiBm&K%M|s-nt$|C6MwSPkFl`0LC>N}8mnp6%Z(L74(W;Ds~{u7 za~Vub8<%Ibq~Nf~H46|&!Ur%fV`pdsho$4aTGc4Zr93O?=e~o{^;wCwnS<_ub(9?H zx~@8=JPTs@ev6|1+wFh7xTafpy@-a}xtbcKYnzCC`dzd=5f0-MUvon>+T5c#McoO} zUw!fE&#XM9oHgZK>*5$}&%~4Zx>4IlRj#25lBOexeI@35TjqBw4;&yxU%2?*F;VQD zd@=l+Aq9At>&YivO2lfrtkV@0nuNl|fry~pI9BlJqXq{V!9``E8RZk^V!Ecf(gf`; zx@DD}$XB_W(YSf{j48ex2|q1&Y#&7tolsPKFXO?R6SX)s8;~wqln)Oc0}LW?_{S z_nof))tO_#Za2%mLqqJIzD8cU%NYj5!Tisfjf^4j)pu=~`rXVC_i1fS4+6{_3a5^O z6J;52mLf~i0mPsc3~JqF8f~!>>q0VR%uI~X!WD@a4pIrt(RBbSUmxHFJAE?N;XyZU z8Vq#j!c_S%*Vn1;n`DHg?aQ)(Z>>F%vMhrBdfDIHY2b+Fcpe@Zw_%mjaqr8VFtV5*j6DQ`%@Ut)%E8 zTso6PREz5^Pd6@n`YLW4Bk>6LUPEoJP@8+BC4Qc=?ItbNyOIk<1fMpI<8|@yw`r;) zJBazLDnUvr-%Q_I%e1kK5%4rm63`46+x`sZa^BTz)iOw<{*X--|J%P=^v0wx;HV`e zS{ifmb_>|xjc#Q&fX+nFR>ZrxPAWU=J;Jm-bqjfHoETVW1hqD5GG1yBX^2ZoM$~4V zx7jS74hwN+vk*{bm6KhF9|w%&6V`{@^0Cmvc_%-*P29k8-FW>$r;g*hUS_U}0z*{B z3u{a*u0$251;3GpUlUhc(r#-gzMi|(h4yrCmj-GIcCZaYjyo^JG(t>P-iRFrNlN^8 z7K6I%R7BNQl;9&kmv9s-16MDQjS#!n)4HE2&q4dwIT}Lr!Zcw+hq%GY^p-dEeLTRd zsJD;CD3b5vvvfvRncVgYaHfY4cq~W1q78>E!ml@NP{i8sHPo7kqT1oFhP$|*5WI=t~l`h=r)&4zkL67l9lZRX)^mLBKb2~1sDC1IuV9_G4Zj_d_F zCLxUpLWsA>*fyi?B*8RNJTcc7VVr}u*+8K+v?&p)F-tao-XM%AcO$oK&-=|lN#|{N z6G=|HhSU@0p9A+*SnJFc+o{$1;fwf}Q%z^jHS>V4N!$lNI@&JV<7S{F!2MzCsU{NK zQ{C2`-ywf8Gz(js+x0nzPEtist4oo|v5vVfAi$lQFEeDD5^>NWjO*{+QWLhPFwoc8 z-R1jqb#=70G_zwU2)MiRgMGg-9fTK~J~7IhH7#!pJq9{qm~pg^>WM5vuOS6YjjFXd*7#`XCFy@qbm`w zpa{cC#Q95|K3$EmV8Guax6;NR1h`bIag6QJz3CFQ)3`70@dmwJG+(}bDZgXIrgBrp z^1d@u_>-#{zDvPp)?-4PR%C+UQ!-1IPrJd(zUaf}K!S?p&r7jCE{^0($IfDm-HjVO zYq(Eeu(bUg2nv?s{2+YMaK_`uXH^PfcZlV#%6Z#Sn;|oVAf$=5g+6fD4A3KUzSpNr zY*aQLAOB^rx|icBM)uL2Vb7{++~BWmKJM0==*jgoudW~|EeFHif*hS2Kz}`b3cHQh z{pF>LJfg&O!FlJbEZ$N(B+B-<%hB;LeE3zb-UMa*7k=ST1$sCehn|Yok)K|$-82_o zLy<6hG9-$cxe?9;#zLW=SJ^AurL#B3sbzlYW1slt!RVLL@1=j`+W!fx{}XJvS-Aci zY}q*f9c;OhOpGXi6m0{?4K9pf!%zAMQxWt2LfP{!Wm`OM`Hg0sebd!MlYGi`HS(xh znNdZfKkLLj@^X!oWyJUdB!Mr^GlGAzeM{mZj3XmnTmCLQMdUA?9z?8{m4Bwy&W-zV z^h8dDyt*vfmC~5f$O#ZoTlEsXV)zz>A9p1@oJ`vOIeI+<_>X&Eo?bVaGTwcjM{Ce` zV&|Sh=1m220UTB|<702983BA=?CyPfRpAzT9+3yP!{OB;*?9*QY>S`ikZ{o7#j+q* zF~g^%j+Ro>PO}=OU(YZR*9r9Tq~Lpjl}Hrv!J65`5U@<(Z11)w5#B^ZI9K1nbc_4^C;U@#Z&MinI6e8F5JgDmq1s z61#BD%@s#JMR7^SK_;jj$(+3Pbtg^-Qy?Yfj3d#u{WYq?D`4Z#893}Px%Fcm%xXcY z!58+7B;kd+Ee)iOG7cXrA4~D0rzqR+S})X?5HKtNX~M~6ZoVn3DtzcJa_x^xBHEp7HWR$##f53u4fK2dIoDS&HUzqb2$h?~2uf|E2?h@r>EcJj$pRLb_A~=FscB z7Ckm_1QnSfTTr>oR3OU9yj*@n`5Y7+I44srFXOw8KtBE1S@Qj+(NcCY1AEVy_-Es3#2nM&l^592G+b|G@w{ZD-O>`)&`=OQcmZ21tuL4- zZUN6)Rp%X8HaN4{2*NT;Z=9@*ZmYeu0z3^M?>Vr*AN@N^v6P>}UwMlMGTBrCmTD2X zV8on$pwj3d&~zeE3-fn~0L-kN)f#6&C8Ty^=Bhv@M6?kIz0nvRK}dLUM>LrIUO_WP zxQSK4Ms6sAmo^A%el~NJy*>ZW4saOzGZ1F&@64IBw zDZ}XrBY!q9>5gp7Vdm%AN;#|oS8&nX5jj=xPW2C32QPV}eEoRKv?`PL13iX?i*5DN z&`MN-Ek{LuQvm-16tu#GJ$#Z9INssby8Eve)QjHpX=D4(2* zHaXFf3Os7UoMl@E4N1|=CFGjihCiPOPSv87;P%BKFd-2}R}MNKS92c}v*#57=;47u z_E#Yk5c7HH_?b01J>u0C){&8M9wpjLGqm^h!nPzH4iC7* z_C-z(Pc7u3AsufrWRZB-vB;Le^H0Qy1>Bymwxk2GQqtIv za?TlfM0q8`0^EAcUjE^=Ph9lHZ#yTB+1mOUcRpm-*TyP5DlOkrKCv<9q=7r4fTWv8yfILEDrmC z1v3*8P%4N1$unihnH3ihveVbl8JzO(WkLJj8kCijh3Efoi+|Uk>@5GgExv8U{$qhi z8lKSOiGrvHt(rb4frEP3O+HiP-d)O!li@N)W345o7szB3OQmAJH#@@rmHTq8>Rjud z=GpFtvWqbDH27V?r%4>~zZQsNH-FRE@#P?HQeWb6o|kkksz5jH}!nEf6B@stCOEg;l_i|98=Mb&f!pSPUS zp_KHC>pEqr5~d<#^x^aL z?Bm>kBWcvjjwGOr<~n@PHQ4LDF^AfQs-fje3Sr|$4Nl$q!n}+RJx0p2$ z62E`sq)SrfcEiN&SM=12;RC+HQ01=46>qijYdU z3J)7gDx0@ofN~6KRg4#aMUWadOui`8X!AzZfa`LGieEv&nWEeuBqh8ZfGt0;>bvp2 z@RY#i*$23g*%DTYzr~57iEbJY;`hV;Y!ldlnN}QwjnOwS{i4a75uA2{R#-3^q}D-w z;A6Zeel~B|SSgys!GIWr>vc;%gCK1IuM1@)hydMtLiXKV3edZk69}yNi({o%eOj+z zKJ@Jrp~yi!5mO+6G+c$Fq0tJZWp6v}EH;gLTo+)iCg9SD!qWazi0##d?e(I?8aq@X zLjq4bQ+m(i6bnP-DC-{aT~$*(u@*IfBEfP^Mfclk#!#{1A8Q5~{X1Ac>?cS4`e-d5 zlBcHU5VWZmUKg^M@!;I8$-~RR8T#}q-Dl2d9-A|U&YOmF9#Y6J0mOD7=C^AF6JEN5 z@q3=-MqgyweNxG4)1_-#1C!8xo>XU(`N}^Hsx@kC9f_B^ z+>Nk*1iWJ^v&S47=xUCU4!6O~;=ZcdhVR@VMnrm@@X9_^G9j~K@s980%xfSsm^%Tw zw(_>+egfxwO)+_1`Ack)B6BHz*Vphw{wxcY|&+DYes1|QX&=cIPA^BPjrbXU@V`?;}cHK{HG$s zMu7??ae_8nE=Vd&K8)>m&A~W=W)tV~KjFH)iN`O(B3ZkNm@Wc&P_4^E*cU)UmJ-ZW zdPCnSm8*DvPg&8WMlN9l!K%5hVJO#_Fls9c3s8znGAP8zl(Y!#Ya zScV?l9krPt68flMoC=zQ1p@4#7j(L$4OJ8i7Dvm?V5segEcGrmHCPKw$r1eU#kbRO;GSNtnr~R0@}qi7uWUXvjz{gu+#$MYppK z?A3=$$?Yg~Kl#q^>^?Zs3BhLCGpR{$QR_&c_#!EDG~l|FIKZg}?{8^bVDzfic?eRo|AI!XjrZaH+^vyty^w)%{XajFR2cc)b-0Z$P12F+Iu zpo5(Ol|KbCtJ3P(>Lf}hoe$ta=B!Q1rEU+BAAKN(s*Ko4jZpxylHVdz9>=~sxt_-x zaan-v)PUSr*P_TY43PPdV@Icp-Le{DSX8nsXI%M~av%z!Giz|;clPF(Wv3VPouE$> zP5n6-3iB3c#=f+CEKH}R=6%#(SVXkV?$o44~pSQt6=fb#fxu^F$`KI@})pmB>A! z)eS%19VUWg8~|HrTXHchh0HQc9j^hStfUo{1|7gegcFCeP7f4G)`UJ+0q^V1Gs>2` zlzI5laNE5|MNgDh(W)ZLL*vXZfOf$EYpgZiwWd%4!b9JSb9c{%eysQ8-<9_FC?o*e z1adl(#Ym2vAh$euJTB>$A{vtaC^z~+<}^{qhQrCsqTVl&HJ+I_ZF%!&e!WP>nHaTi!)jPKqfITFWh`1A;Rxx15v zP<%?MXc?ooqesL&9eNaL_F);9qjm}n6yn&(VacB|6~`;^RPlA932{}b7(>fIdGT(K zHPZrtl+@cr@JR5PgA|Y7(HyAkJ3U|SJ>Rwm8g|Hi}5%{ z*~;u)uZixl{0*OH#WuslVCF}C@IMMoPi1a7Ac9hwipsbn+=D%f3RfjxsX?*jyJ$SV z_Yk8E{cYh9&5Vd~){gWD?lpRILmO^mG$$L(?Eh+P*g5`>!S!4>xUh2lm+Jc6_|R=e zf561=QYzby%I$OYR+o5`x%1&h{$Nog> zi1~5_`(y=J4Db{*_!7FqEv>iDP{JAPJt#afG0n-{5dIB#JBHqrSvgnZ_hRb(JTV@1 zUvju$W7_vM>_MT&U~g8Sa)>ZMle`LhQ)A#Y4eF;X5MTGzS0JFf`5EP(UDO~uRJ8h_ zSEZmgRCpEG<8*k*W%JoA7;cQmYSz{3cW~a^w>k(c#)#S9>oZI_z*-xXKtKzvnxfNj z`x&l0^U2HGoS0{?BY#+VSxThx+{)y!Mg5b;7d+uO)SakuBj>fV&TCmyra&-P?@ee(FLlt^S5+8gwOxZ z>zV^ZiDJoi=6FAwaQfDmK9+lrTj3GHYY$HQ+pa4GbC@Y8R!e&Kre6K-&Y$-!yq*0y zyURSG*{I?fL^>V3LWzc@R#2^}_*^twg)D|Y$0*YF#^Cc8E?>r#Vf4*nw=slhjf6?xRrXCOt6vt}L%9`nVY9$(hUbVm>Rpo$-v~)oE znQ{qBDux$Irdtq=#XOIWvBFuGsrxO&12g>Z*sUaJtY00x5naeWFIl+3CS~qTwHf*e zFZ1;)tdFlZ-xI;b68I0@+;5}a3*J!^zm#5+;XY>jeWuV>`;#KMjinOEL|M#XRvUmB zeCM&j$F?J6K|&DxZ>}o?av3kE=2Tr7J7$wkq~FuV{ZY1TQ?3^`CWAZ3a^&N5=&o?gm;kQnZfy4A2q9-Aa{qD`w_FqZF_-{mb>Iy7LFH zJK&e^f+wQ_kOi&=%4>V3=QIl0X~uwr>iUsGs+P3IRTO&i5TveibKL-gkOno@F34#m z0gxPp0KH#rh6YO$c7^Dvm7u7zyBm*UyERrl@k2GtApGoy=ymv;bV09IL2F`*)_Jn0 zCu%)8jJxi|>QKl5)ZFTH_r9}Fa>PMJbRDtj=t}OC@HM-EPI3|H^E-m@^9dlG{-~rY z5(4F(PA*6*dzeH-1g8z^#0k^&k$wbuZC(Uc6k^;{9z!;}1$sp7wx-Rwb}`iLN2JCC z$&ud4-}m;quLVatpsGFa^G9;T?$grIht1D`RBL0D!|VHnji`kt&xhd%3NBZtA>%X; zuh)y|i^<{etcBtISJsA!vjKnc^r{Mbj#lZ!l&At5Xx2DziG8!10D3- zIoKoLzDp4jp-xpF)|QyjK;GREf)7L|nkhcYYgkr)FJ9JR_7^H~FHy6u*#pCAKIJy@ZqQgEyZb(zJsj`oxYncHGubWXc%V8KP+RB4yd`qRWeHl1L`G?3 zOx#ffJ4t)?yaO#4eYQ zwh7r_mg(Z6!kyD$B!n(G&wOvHJVySgn^U#ySI4JXOv5kmAj5UB&U0EY{#cHBE+NS5 zLZc}zq$afIa%SHhWB1q~ZHD;uUW+5jjsk&(@(*a1Q37>Q9_x?8v1Vxf-MAi2vV({R zU^B@4!oue6A=~m3%TBsXW9y|SN%@^1?pf9b6a~l#WXi;fRxFXE3z`uSk)=0f)P+Tp z`|pL-Sq!3Vdrw486v>jC1~83>P_6a@f6AqsizWjXNlAh!qM#x354shiXneexqnN)ZgiJK(O+ITk?IiTuP%Lc#gSvLB^RK9qr;0a5UQ{!nhC1L zU7i?=YQsegKQ1e*RS=X6)4JLx_BDTBu*wTyqXRTUgo;0Oh<~403isfau3LuWgVETs z4&I98M&8>!L9PR{$x9lKbzmCrzE)f}H%Iy!NL`4An(^S8CAToH9z5xxl-a}evU~$K zoA#p>+0=Y?Jp-uEW@+p0YM_Y8SAW-T!3JQkqBbiu0xAOWtm(B?kdFq!6`_XPw{JYm z`2ogQcNAS)nt!M>%RYP6rXBzBK?+4w%Ic47IKY-}GldwN&0Ji8$ZVskrOUQkF>Q=u zs#>0n^4WANnxc#cmCj=(L%x@j={d|h8huhhq#QFHe^E^&z3X2{0zA`V$YCfuE5|?Nrc@$jp|aJ_uf_MKkZt zO9U2QMTy1zpp9L2Gkbq^wiFk&9Oe{3_fQq@V+%`|yT+iJ)Qv^+*F@dMxag@j5t!$4 zVMY7C&CO2XhXINnLx;gDqSH8YaDL>q4E8tp3;Y0(Hka4|t7u=#j@zN!@pJ4o7+wO` z<#^|yzv%n?%6SskkJ|ScAtuV#_!i&7I`KvPkN-N!akO+AAk1=j=@H;sBc*`+e(>tz z?fe9lGpHMzq*;#6ejvN0S;b{P5RzH1}-OCYB8uPtDk62SZMNl>_R2q;C*K;_$R z{rN?=W+pBr3eM4=DX`)X*S^T3>bH4nRW7kYZu;9)`9I9r*n0ArSD;!8(A6|h4uI*X zM5C=rA@kz!B~>U2uu_IEnke`p#F5z zawjVX{q6&WV+@k0tFuwPil&E#N4KU6;q=Ry+Wn4!8wUTK>1 z;|5s2UjJn90-pAUJsHzG_yh0k92?r4Gry1fl*^AyZ8n?&h?JvkQ=9k=d*hYsqmJi> zkm?nG)%zE8V#P7s1@;g0lTC-j8&4L^<4?9RNJ0w@^Dg|-An0jF)H|he2PX&w7M_bk zvL?5Kz{h@xh-O7XW4HZimZlx(wNy1jqXUe*zG+(Yj8Ab?*dPLVR69XNc;EB5d$5f@ zZDe1}6IW;~IIFy3&cmnas#Hd7sRC?J+*V-``@6!ytzDltrZ+sBxSLQFBIKpp<@SR! z8Dgg?ql6r|r#B2JX|GtAq{0XY!g5RC?w+3Ja0b*LJ_ZY;RGLH?2vn4N9$E-|9RcDG zTLSQBfrRttZ<|7`OT3yz>5k`5s`{-@jP0urPK?TXXcb)EM8u)T5IbP@?*dk5Kfe>3 z>8YUY&bILvGDrojuC_AD@99(0)^$Q%$M`J6MDf*TZ(*Nt9qf~$o=RcfV^Bmlq(=0r z3xbN1e^i}a9$jU5K5#oahKcx0Fay!_rz3Dnwy|20nOK$>Rs=jltCX*V>&e4mY3{%1 zH4YpKySsu3Z+d`mE2LZJpVd%(7(mq4$`O!Cpz z-Ck*+R1@+wx#9T(NR~u-#cmK|Z*Emk1mHIUq%l>5`5LWZ>nbB9H~bB}@&V7>EBe`* zY*lvMrjOVx;@5y7(*5Q-uFTp?T8_oxf`bGi#DP8}#&iyZf?|iXrJ{5hh3 zn=@0ogdSmjXs6RIQUUyk*-Xwj`7ouo&^rULP1qoT+J*^Ab_&soF>C1hF^Jp!$6~@YG7N-hNnaPH$7Aa22^9V{hx@lhjDe&oMO9-dlRO75K-a2 zkt5Vj)2cgbJJ)4Xk}EsJZimzDKSF~{)}5n5BBs7L7C+!v=$5+=y=yjv5N1|gr-KmF zF`J|mL2GVaMSbDG@=ccln<;dp@+Ff}6OznbhylM^ zQ_E-;#w#qv_@On49L4uQ*O_=X2#;SYC$5fP8CQ!&PGICeJn#m zSp|w+W$T5haZhkX0-Vu3h?%ZQ(b&*#6T{}(7|_PI!i}iP{N?g7m|Krl`#mwp^~ad= zVI%Vw-f|>4PanO`GOem3Qst?4Pei`@J*w`i%hsTeXD6c0MQJBX@*#>Z*()OnWKm3< z%`w)<$>CIi5K@F=wT+^f-z872DNXTRkqtI2^zMSX(10O6J+M<`UIzhsxekYw=3>Ez z#gLj>lx{tMpDTcii96M0pNqwCe8+23mSh}DFb+CQS|Eq>+_m@X>iILzg8_6Nj6Izo zr>b!*oTo%$Y8_E%&&xyo7Ujn1 z)q6DqE3?&@Hi)z|)=St4=BZ5s+Zjx@WZO`5DPdF_)u@nqMszhH_CfWg#F5=e{TQW? zX2qN62;yy zy{)(-|KJ$6*l5N|rlUim8a8JNV=rQ2TQVuhl*T4msw<)#eXM8&?@hVb8ORw;doN+z z+0<-qbu$@r({~Axg0fW25ZR0mu8!ax(!H<7@hF6J+_3rB%@_2VnbUQY+-MtZOmK_Z_^I&Fe(@WXSXJ4M6}-d-d$~aAC{yW4`;`DfnE8Bx5H?fU zcg{zSA1Q0iqa{-K49~Cdl#NspNzOB0Jm-`aDb})yIJleuwxDkW%0Mbs{A}@+MFyIK z2_RT>f4@2RAw#H$DMED&XAxTb*v_kVC}I2?@e)sRhErp%T z6i#+xl85p>$GDmX-(?E0D{oFNiYo>VactXFiTICH5N?=R#oe|3Kovz4fji7Y-;OO} zvy#u%CjMNaf6RvEGXmHJY1iUjA+Na7^0Heozc#tyF%AyXug>7jzIXO0 zP}?_6(q8Y_@64a@Xir}6PXq0W#D4_6tPbbQ1S;y4>s>3kc5J9{vJxPDf-$ci%3g46 z`7nG%Wje0{=B}AwTInwP_f58Wk_`_W=fcL0}l5-u@eX{)06C)3>p)a3(Y*G+qP}n zww-kB1S%5nfkuB>imLJr|Rsz*Sgluma=4vnhx!D(-;L4LlX-k zW(cUp`$i3c8@Gh~`NH#Y=DBB>GxY*}kAXed)vu$`+~Gxo3}-2QXK~ph(k8u3L%Av+N>mwuuu=+$`9er3?ns4g2uN0dDgOe0}C~_ zI=^@QI{$h@8D|{RG&CK0U^=gY)1L;q&fX=QjTWCh$KNEZ7hRyz_uf1RZKhOAkxckEn{13PrSf%%o4D+k zX+1e@c4MTXXiaVj-j{QfXzwJRy6JAq0Ec{9BC99C6ya7j3(6iP&Ctv;Gp$0~c9w-W zRMFm>Fpty6j!fEp@9cAXi#xTF%FN4(2SnhJd#g0u~`jDMn;qmV>cfYgA+Prx{2aE3%eHHga$yK(}c!Y z()zBUp?B3|+n43-N?h6PPxI4HzC0ikn&$IO&yuld|R%FHK_(JCShQ`-Yg zQLG|w5J7R&yU3<Y{KwS_NQxkVw$oz1RJz<|r5eI>5I<$mrW^-|gOanAiR6XRt$k z8|;mhZMi2PESRDGx8tTQ7vBzQ(vKGqs(C@i_W1yEy z9F12{L%lDrY0yrC=1;SF4M#PNwoe__mR0N)FKvo{;{I?$-o-J)-xt8m_xo|yRD|u` zRDq^LlstL2Z_~ZQ!*kfsPWN{*Z!HCEsDJ86Ap6g2)=fim-o{?~f3PzC^9QaQgRkSs z96&uh;+NX+po7cL7RPBF14V1u92SEgb#T9cz8psM*rk);??BV&HATR^9{}oGt$0fy zvpO;?n4fo8j)Y273jjg;iS$$dk88U>@qIq|?n2N#UrQE9A5=UPGc{LlXl$c-3?^gV z1c~3KRqvT<6EA|2Q56-?QPeiY#xww%>)(YffRAt7CAl@U-e}piRc}-! zqT3Itb<`5R*aPpas;@K-e!0*ozL?d@}6!!Yhp+7LQK zC}xq*1H$gFiYib0s(<)k!txxgx9R)A3IrB9HN2{{)SF^#Hgrz8%lzO~f$$1KM}wUk zPzwmnj5)OESU?Y@XUXHK~shA?LFcgBI;wJn^*}m4@7*Y4FUl)_V~h(fxu_$O?@;RA}iaW4?)q zzPq5Y*|QYMyOH@!JcBJ~jPqjii9^36)v^?h2w*cHC9Cc< z_nJ`C2WV1c6cfT+dm@hj1-spuEb$uLUVjD5*gkI-e zOBf-|*PrqB!H7OOywBZB1>`enx-6h)kcup9VSa+sI%r3HydIRd>fVY*Xi5b}fYo&e zd?I7LXs@K$)SmVt3}5usTF|CD>Dspewu6)*0!;m~{p&7TmEc8FFRl~ND7<@`VSMgi z-H7k5#U>oVYU=p^@=`0rrU>%;zD#|UzOfquc4)Gz-u@uvDFT5q%FDD=!R^MqMtxx& z@cD}Q5z38Znt3F@ z1tJ+zb2zWD&+zHmFIybIFJ_ax%bbg@1ik-ha&yx>JwaEbpz0JRJh;@(xLtlRKByrB zdaEIxV-FTJwmB?XnKx(pi`bCR>2qABv??L`fRMv+4uqo#|B+ z3N-K`hPA3ZD5e&35)2$I@H9NJGE{Fg=kO9OT2-{w$kZtdwba6Xc9&PU?k3^n`UO4d zVp>u2EsGbXU25;s=Jh}sQbxcTSn>6E0^kgUv{6!V<<}*&*8K1XHU&-qux1om(goeO zwkts8F%~OPQ%lgMs)Pxl3G6u@umMew&h&x4(s(sv71ULoQ1KJZEEyJ9-Bw*HB5}L} zqiVu15`El9HzKl%i2OlX$-rQM6l?zC0(T6_O^c%E&^8?$=<3 zG^g%XF1e%^$#|ktEv-`l6I6$SVrA>+w!L4%A!QG2@@95y)dU}KCACoW^?kNEwm@8B z)EDw>O)x6_HrE+!MFiq-%XxB*wJ^U*@0piJ;M^7}HoB>5qT&=`v58UHj#Fi??0!En zJxh|B=pTU&spfLOsjd->Tp4<;qAG)>4C}AWHXgI=FCbb@-N}Uj9-hywC)3J=p*r;; zm~|qBN}Z`mbs)EM_vX0Q4B;g~RUjBzo+OiXgpy3g^ObCG*UJh6VW%S1aV*KKTqBKS z1sf9M1y*xkTRXwaE9pzpB2+>g1Y<{oFe)lG#qk3`GQtJ{dADxW6mnoAIw zyft@H6CzDu6kJk(oL*Yp=Amp9>t%8HOsa4?N2&PDf?V~=fL{H>L#E$+*TJ$gpq}PD z)+CN*puOg%2PfH?^ty!pbrj4PY9u6C!fzJ3H7+QjySO!6>oKqwkRvWtUc`gMiM>Zg z1G+fn&AY4bPAapiY8;yFxqpD~Z zS-r9>{(~LUX@}7dyV0p7KQcNV`ZErX9pTbPGMRoz1a4dNYM~+280)x zP&X2R!z(o!dBW*4j>UfzU^_=yQjC%+xPFV2d26cJ7C^5;Ylvo|V^||ZX3`veqQ>Om zFQ)s)`G4C0NF_@{{EZ-3nwA))0`hUcN*6`&dUEgwj7YcjV3Ki>pX0h53K)8^!k^#G zA;>rps|Aw9!c><>g0-=LDCANFF)*)Qoq0e?8dM*K?U*?rVl41Y&|G<(x8zy-?=fWC zg7GBnw$l#9zmhiWXdo*kS!B)zKK>@0(AY9YpMhDJT@H6=T zjQ2~qwqW``QH2o(O%ks`WJLE;#&eJ@tMx_m+ie)-yU{m5!;T7f)v*`b;fM!JKQ@gN z0(NcsL(kK94q}4t+s%$mg;nc?>5^>wk|+HIekV$E^wnr(`0~u-1zn%aat-!p?ULX4 zp8N`cEjw&)UmmYeO;*`}W($)6R%02qBW=MM@7T=)%69v`=ZekV8x~$z=CWq|A5pjY z9Lg1AIRuX!L!_pluY98K0t=}YD)1Ev!| zFCLtC&^VPTiVYAjizsmy$F`IX>_nhgY?t*`B+n)8VafzownVm{fgm$t7=(-Y$LKb& zNGjn)?L>;JzG#`uuo667Wy06N242^~b8yS+Y^Ye6I z`{Ha+L(1cGV_R7DKn1(R`9Tl=W&SL>R(`F$>Ner+$UL`5rOfT`C-Ng-T5_;09Y`*o z`}JSIE&o5R^lE`v-qKGa9X3+>NW|66I8QlaS^^FTY;yXCIIv5%Hq-b90!RVSm-X(S zSC=9=sB{_Uuf*(zGcYBe*_qVIPnh>)^XIE6T~+}gi5wT%jy8_Inv&&%)i#f{iFjG? zten_cSI)wyr+ekbM)DL>Q@7Y1Ey$_23e%cp6T-$sULO26@CuA&7>bCY%8%$lAqsujadQNX`WrNQl91%fd+ua9?aF3~RDhLnP;7 zaM_oN4|n7Va{)cO%veY4@L|^`A@xXa3%Y+@z`9&NvLr4`;;G7yp8R|4ebcnMfxEtk z$R2cqkaJDb3AK`>nwe;iyJT|ppm>yTEsP2M+!>s0(EE9b8!U8V89NK;93Dcr-R;ru z)otjriHUF@WjAkHisCG@6r^XQ%svz!FQ;;DYF@v%J+0d{_&NM~dU*I6i&~mG7WCKq zaqZ1Uk^sm@t09n*F3%FINm%n|{>JlusvlAIX)(Ehr|_U>gPG)XZCTZyZMUf6Y4)M= z=hvYjMv`E z_@}5q+hxw*Q1SOU^i!g!kgl5xck{kBTaR`nEvp(z1OXdMis%L)+9K8b^%b=<_`-n+ zbcRA}zyMEv$TG+xWxHqNW+nw!tPW$Syq?>)(&ttvq$y0_&1wx33C>Gb_GIu!SyFeo zl6+s#>Hwtc-F3Kf%SoVSWoJwAsJdo>9GNz?vX9~ME{b5%M3L2~zX47cLW=*dT7@6Tzh8u&AhLc*A1XLttX$me zNm!~P04@FhSf_ISW1TYdpiq+x0lMS;Y>d#9UmC5kp=RCQ;3WtTAsC}}ugH42`im3r;_fF6XkhI1`99oC`5wA3OwS3mKbAm3!^Aua(H< zO+Nm%Jd3id`ktb_Xz{4G#@a&yT8phye8Xj@{g8z?0V@oyqcz?|UrCUqMoGq$kDUaF zj@Sk&RPYhynoALY$+$F8(K|PzY8QxXfPH>QM02-yF^^EFmw|WUI-DF>`C2I#Kq&07 zACy-|no^gg8RbrrG^)ca)N25#sNt9llJ}=lok|A6JZ6j!D<7etdweL46Y>-n z9;o|bsfTa_{|=TL9@_@e<>$PSzaoCKwm=?-=r%q{cfK6&DpTVvlyHqTsOE+ugy|CyFc%Y!(Jr$>4 z!aA>9g};jsbwCTzd)DHxfzARTM;7%W%DwgroaKtO#5pjpjto=Ux4Ky;TbX6_9NzOw z+)fuFh557H4BFC$s!UT4gmellbJB)R~;LQ`Jb1Vq{t z2M!BLKpgdcK1lY0^R+z07Q$=FT0aIm_?M5@M61A;8c5Sx#fa5eYB1pRVXU@fu;um| z!+cq6dSE?B-rvAZIdbzIerBZEql!eq4du4^6nQp9igK#y;UCkWNEa!hP)>5NV6m0+ zj#6TswY?d)Cv-+!F!+E==7mrS2@oeFH@wD>QaK>>^R6{8^mV# z^A`OBqk|61>Yi3H0T1-m?s0FaDw5T~FDA=9_ySpagA(5~?0ej8jOl0uN;`l)z^9{Q zMZhz6tRMeOE58%X$@>+Gy<)f_K*XMrL&{t_BiMrE4gpJYt{4EWRnSqKEke0CfLv4q zr=`ANC)Sdo2I|Y>I=*_j`G_ zZV+}BaoN#le})oLXzqEj&F+V*SMg`=&HnAQsLNP#q7RhRZ-mrvVk$hrKAX$o%6)5| z*^UxM_|Dr~`xtO2wM7X7iK2E?_y`!Ng1a*GGYj!8Kv$f$wjIxVYnbkjj>c3Yk)|c3 zmg!_=m@zgp_YDw8Vj_( zA&wM-q@Ma%an{C^M~7uk6nZJB)3;@GWH@TvR$?R%DF=wF<7Pwr`OLs!>Iu9f%HQ)o zgEIKFaq40>+QX(e{BJ|bgHZWO0`3Dql_z>%Un)*h1yOoL2H|3r z%zFi_8G(MMR3g~?G9{CKNp-LW6ICN>LkQPn@K(b-Skc5a*Ewm?)9Ly8!M`#1^fgpU zuI8yA(*sCq`INH}T7{f~WqKTSp>sTP1!}RLMBzi&W>0Ay6m#`uXU%R5aHwq~7%hUr zbyL+ymO;UccPw`TM-@rBzgRhPMl)axGM@dKGg~`T2u!R+{F{AKVz}MLbK~h2$I&Rg zSoo9oYN)&Wr~_~IYxtW#8Uv%=VFM2UF*0PHKn5tx%)W&bHLj^z`6#1p0s0ue-QoX0 zKG=@?wSfD*JVy7>)lazNFdNsL;xFlsc)oG5A%h_ucxi*cNV4(IKf~}h@lpRHVXQA$ z(R%km?~<(1bsYf#^|n#sQgZ4iVPIZc)D8+d20iHc19ixv81psIA9(=S$(uJ4@f>?b zXb6za8hhSQ15WOORAvlQZ5eoC;#XEKmCF|KNk_gvbdT{D0Anw3WZ znkJYq^gNQ{jYu!owp!7$ z0u|tgUj+?oc7}n_UZaB=P6VRYd{_hW;16j1KG{%V{n)P(`9pp8ptiw;Cu4PHu4)0U zcyatO7@iU74lIy76{Fk$ywOP`V0nPyugN+~PdicbJ}2V$36$iSu|+>W%7tRGHo)Lr z(D+yYq3GEFv;@^<-HTg77a3^EbBnN+Soc#_K(4(CiHr`G*}v1ZuW%*C);2T`Ys8P$ z%%E<8TmlP*=5)#dFFHaMb>3ceeP#Lf!I)f_s_{SO=IqS>N2+1wX5~&2GZg;EtLy$c zYDJeYIMuwP$LT+aU)~lE@a9ywFuQi+MlSaj7Bs-iKY zkrTwCHgnT`0SyUSJ$5_#e>(uK9USV;=WZ@J(=a`5;?nxMT@E~Cn+4cq@KUp0VI@GO z`4Fe=8be)XWP4E`Y#$*Yt&$kJv3%I1HxM&zza!5u(GW&MHZXg`v3umdHZR0b@>qYm9A9pEDezGtg7N$ zj#_51&GqgjsGinzibi$BoYLQ#dC}U!hM|v>_JCATMy@>+v=I%SDU~5Xer1k|4FkEy z&3iGWOd~O}njr~YsP+K(*`zc<|3)K-IIV(>4MOF^dLOx-VQlr%DZyjLhtGUIGyXG) ztZH6r15a~;zHIVUrB5|Y`|X_{HaPUX@XTkNpr7M|Xt3s?l_N!O`TKPE`+2x^b$I)j z_C*_TQSe;)oSIaHh$+hAaEY93sv6v+0ye*x+zDCmURH1+^JM|-C1JO(fdY@pqCmhw z^_&ag1rkbYy;uqvld3ghzjIw$ByAWi>c!zcofK_#i>OfywjhmcIb{V0{C6>5Vi()z7fMwbtT3H>&okeH>6hZn77IfDOy$7)7g;!+RXegf;h4+tfVg&kLmsVJ zI1{$qf?1}-10{La0a(Yd^`v^NJ*BC3iR2h0`(+_kDq+BU!SYh2B(&Vnz{~U45~bcl z*cZQ|Ao_te+IxpNPVT5eFhdJq`s%&CsGI`p?gBv0&jWc48xcLpKI3rI+4Of#_?ig1 zPY}=6Mmwe^pp^y_enVu!a>a=s!zgD=YgWLJ3^V{&!qgAdg=t@%B|3M(EaT2S8J4sL zEz9$|8XTZQ9Lo~F-3`P&E|xUe{bzc_>Xnu6;>B zZ;?--LCf=L&02(Z$@ObL_(nl|Dc=L(-%x^h0I<`~d}wRPez8Rw;;GR<%2A{%!ZYC8 z=BvdL)9x}Et)X+_#T6OW@r#Wvh$o~xRC}?haoR@dTjn~d7tGJG4xDAGtC~)m?ye+rmpRuYWvqgqng@(fvGJY z0w7PXf)%O+OD~|5KXb{xNR{$MWQRJB6fOa|5g4R2MU)Pd~3!fjq#09TA<@Lr1lwJ_U*quL+% zx?d0fl)!>P8_^eChKWppJ%v6QGER;eo_d&rLaQo=ldWA_0rNhFyn zNl9ki-ql-gqBaHyY!Lc~T&BCI1>vGX_}=2?<1kBY(=T{N}VTmLb@u zNG+)!z(Y^AfOJ~Xf+WD@cXFqt2H5dr^4G?W*mLrVIPqCUvBo+IXpj1QF{%G)ORKA6 z*vX$UWN`4;YYWNLPy9`eJF9Iav^F*c1v|=$$o0?-xz7E^jU0W0fV^IAa5?LW-vZ+4 z`A>;3uiYRz2M$BP-^`h#S=i(!_rKR)bb#-Jj;SHg zv^cApSZxFLzpw8;r;rFG31=yuzIrMknn@NrcmT4+jHy6g1Z)LZus%f>9|^aFv%X8N!L6@EeMno zc`A!5Z$_`w7`nljOwVtuCe`dgeR^mEkVWwxIA6c}$R8*Y4JSECZ^x>*XNS!xJsb5MW^U&Hn=!-wUt7ih3r}U|{zoiP0QBSjHQgh{tl|X;XAL}!M=}pwvzNW}ADSP8uLg;UROXHL4N?JM6yiH^E_3{8eJEip2YZCy zzdEzHkBna~qbCd_ekivSRxj5ND256DWMynjON~oob+JWGcyl)Se>t1i)iJIk0$w&f z9-kSTh)M$yKmV*xTPD9VXcJogdB^?SJnp-xK66meC@V$h-I~(N`$(vA*G-eo;0ymC zuXVgga^rC!y=dh6gPSR<=j<5xo-B!=3TptS>FlMbLXa3FXKzAKX3+o4{F}briZ}T% zAu3CY*Tx5-i0>uh8sZ_U>T%yB4&clg%afGWUf*sk2bjc$2Mt5ba_ZP0Ds9;Oj_qlS zqM5jobYkgd6`8`T47T_#^W2e@hiejlz{M0ZzW1L9juojagXi=Qjq;$M+ z|5G`Y6Vb%bJ`7UNm7lQH`mwswb-6NPbC8J}-Mw+7J#tMpb@fT+$9J`I1K1&+^$ByJ zg!E#I1uc`kxIKQ7?YT?(nO=bvh|wE6_g(l0F7+_dnJgcdvi?e~Vsv1rUB$eu9estn zVY(1c5IHYJXZK2^jF%URa#o1PAK2j6W;H+UC^diBm0`*9cxedD}eCPfjU zOekEW%<%h5^dVhm<4=ha1its!@S3&HmC$<#{tlBLfYn}l1$j-#0xw8X`e zD{4w`0iSN9ErAU0!=+O=Jv&}tC#J$?H3H^UfJnY-j$J8&%cwwx{RL}1J~+F`k_73A zkT3Ambw#yi`W)X)?zOIwMCJ(<{q`?4amQ6t$x9TilF>UE2-K*A5MbH%2M3RvEg-0y zxNk*X_QkCwX<HD zC3OcZn-xl5`o=jGs7gQ$V9ha|=K)g18$Zah2_@w$PMzj3XsfYKRRzzLF}nt)&h{d!f?GQc(p8a!9l;IO|N5o z*Rgu)`am}vjz042#0_?bDo+QFL4><3y0i`a08XS6IScKY401uR`v1ztj&7Z#TXT^B z(BD)4QY>Z-`}AumQcOPkhXt-K@C^QXejguSoL)Yz04_c*vmRF-PV3Ts)unNw_9J{j zr{AHs^#}-;*qJSOPq!qBF63g&wEd@3X3H=NYWEA3Tsei!1RHTJ)s~` zsRY*jt@Yky^P{mY-WWe}5O2`zsha@?p-0k#1^}v@XX}lf=6J3vL0v~h#;s&CLG6z0 zMf1ZSb(-gQv#eQ%rtUqL^cK1v1<*e=RK0aUi%dUhLT!o+jPUK>#K$QzlPgEKxJ;!+ zgBK6Uf3|&pdGOoZDGDXoqOqT<}o=DbD3KcF~ZOfq$tZvj# z&v(!o@S|X+tEHI;vGKst=XQ){9Z z9`Ktsp~kvr;tFZ2uiQ|_yxIrw+3HlssQpMYoe;4el@5OiCP1c4Sdv1NtheQ(!;-?? zHMeKxl-`dgM77!Nb5Sy$Pk=l{L_|<26YBj2I6);DroPboPMQv77aa%ju zx-yXUX8nJTdMkD5`{2L_14n&D1K?yt<=wz)+KkmmfpT^U5L(Cxxu>yVi1++o;RC9X ztlK8k`bDdLtPa2i#)isoO-F~5Iy!z_9 zGq3xgYASzp&@Vx7=GwgqR3kLJyh=sGam$?cTaiefdnT;X*|803&4e7 z*C3nUSY|@{DT(QMMn*}1!daOMz7EFW=7fRaso%KGe-atZ4!M2@AB5_$`6Qg+TAcw+ z>4Qh;02)ZJ$n6kpk}Z^ufN_;!Rh=P6eqRkCC8xj2)Yl@=Dl4ipSbdMX{c!d1)MF;fT~WT{iffeO@mdXXbwy=85JDq zY7+q%y?EC=AzKtitd-byGMEEL?4~xa^ z5NMC^$^XRF$i3W%ZgF^ux(@O&Hb$u$iKR%{f8dWk<)e@yG^Yw4B7K{KlxIV6>Wg;nCDj} zSu#&CFU;K{3>ozqnR)og@vghG64ZD_IXJkWebA|eNFEdRxbrZq8P(hv-*uYL0%O&H z{6kY^r8;+C1L}jZ-5S-GGU4|lo9G`PK>nF}t1SsoK7yskqv)ApdBNTMQ4Tn>+q2_B zfq|9yVoGPTyLmct=oaQ?bKUC2FWK}3W8Gu&2x0bO`j<$Q;Y222{(P;={)+?WAS}RD zW6qEN`zIp&%tKvW6D})E*u@4Gm|K*8JotN0{Pn8}9 za-LcyYQi+_a$RtL4gd^o#tZ*Hr)>Yt`(oi{WBRW>m4oH~jNblVInTlRp8$fSJ5Dgb z=4i|IT;18C?4%h>z(UL~S_7`u?6V$A-2{uIXf^71yV-scXdEE%rHblC+4s6L!ILcq zSI+sP=;KM6+GLDMVw|>LyZ@^Co|s!LG-r&3zWu+)FEl0|n!EZ=&$PHdx(@5NziI{i zGnNoJFKK(yoAm0tqlXI3I5(@vpuO+_O<9L4SB!?eFb)R3@Y))K9U*#3(me>+^e%#E!*qLu@b z@pzDQ)%{i`a(nO<22!Sj;^2@&H=Z7bKNfnq#4@#MIbt>yvFM*Hcqcl0t&bzwdH?Ln zLXcjd^6DOYrKfQ@VqnN@RS5zB-!oB~bB122fz)FX+N)I(U@JE0bd|@OLk4xNCrBCz z>ot^A&{Hf?(GRznLx*eKHois2CPgvbRu6Qz7`+`Wr-b%HMfFG-Oq<=FR#`SKtIckJ zzUO7RB;x_foh*w@%)GuQ1bsfo1Fq;pDi*~$!nCmYv5C?Fa|1ur-v#^tTOvcueed4m*CyU1X>!o}1u8$K#=KRX;e%>u97CJ-Efu`y)R;+s zr(`=b{809>x7R?q=VToKdSArQ@V+NQ1|-uhJ#o(#Lzz8W4V|~?TlAYty>-Cs_DfII ze*}v-)T-t;1(BR^obQ{M$Q2y*f@zvt{2A=h3y|*2?(XU9f5mb|cqY#5Ot}A?oB${h z0)VG=@+l)0^ zEhE4`B{5N=VD{Mn+9;mPF)s2ug_v2bcf2 zI(~F@a=T_FK^v(}kpeA5ttB#zF=hRPeS2@p#{}C&FDCQup9>jjm_1Tk3`-Gf_D8IH zHX==W*^p#363558WItMIxS=Uk*&a{uBS<976tOfr7R<5&TFsGy=ggIDhOTSyqRZnk zh#>25n7Hs6lUVSmi%_>`sV?`w+-Qv}-8Svyl|mnhT0PIfIwxr(%5Y^ zuG8%{B`8Td>X+A(esh%9YC3qZn4Di#7^5T%>b!3kP-uu+*RP;8>^wL6l|7&vXC_lL zA2BGEN|7)Dpe#Xh5KhrD8`g8A$1q!MexE-T$j)JO9Ie%CMv(p3H>>{gi-R6!mm z#Z@a@7JlxT9N6yHe^3#xqAJMXzHl--!>eBA%CC9(^!7Nt7h$qAKEyu3Y6WJkrql(h ziJTtw^WannpB9Nwe#Cf5uwPNcBH1dvtJ)x&=fjIc7W z=!ZxO+b!RCourir8RbwnoHHgIcBQO}QB#1_RU8}+Btg(l){$;6Ht|_^XRn;7wVXN7 zCEAoScVDY9tNO7yDOXoc9%~|v9lf#5t^;38=mp6MWhF+6l=JkSykPIykO7ggQ*+z? z=`G0zkoyZ<71|0%`i~PNam;6?B~!;nuFJPTvR(_njpq{1hPxv3>)Sf~g7QV#)QSuv zU&E)~O?3Au&I+P}`R)W%s<9$g&2U|Ecjh-zQM6;{n4V0aMv}4L5bA<3^fwY%tU@8$ zjmt1*QQ0Q*#sou2s!wixow&OPk6l_cEg&2KtRqNbnZndOTkFW5e#MN0ojJSmJHd|} z%AKOdt<57V2E)$TmM)DM1gVjyK zN+8ya8REl_c9jpKG4A*>Dve^;R|ZPt^LtSE{+iHG?|E_mxpDgWdBR+lN~byPj4<>E zV7gT)&Nab7rC$nCZ6?#3bf;VVKIy(6WD76iqfAHHcIqZWFI^ex|G24W$68-f|o z`Wqf{dmE@@fgrLc3J1AIkMhL#iyi*)LJp%S8kVt70*$>)V1%ilUx~8g0UxwK_CfLt zj|M!MQyDnE)0Vb}BHRUOV*GgOa=mr~FgY{Pq!C-&@BJ7kyyzKZCL+%KWvhtwBwzR? zw^3T5foX;f8pw7eef|NV?mU+rIhgHPldj=LTJ@6nWKw;8>2)SsjBZKnOaa-Cm%)uh zqr$fAU1`cIetH5l(>NZrjz6hOJK)9(gSQ;rB*R)jS353d&dh7Fa1heCGhyEYu;ZXQ zH3NgGGEy2qi4{2uilQ^IYWIO?+`c|W8SrkP-lHl>z!y6wMwQ12N%L-n_rUMXRCMYa zGE~mdm->ZUY;$6veJ4N9IWr2ow(QJ%p?Zd9gMLu66NAGh?(S}Mvn;aA-~O(kNyU_v zOi8M17I~wZCCMgKaYCt#m)ao=P(V8~h7%olTpfzV8{T2;*%P8XIH~LV$RfmZ5HXJZ zyfpkAS>(f}QP%Uudczg;_`UmAfL#lFG^0ouvzt~-D?fv2=lK*llqJFcZFm#KNu8@+ z;`VN$?&oBDc{hw};)}X*fd2`q#Ix%wUCPGqbPsjNTDp@rl1Qz((KeVvdnjic1K8ve$hP}{(@jb8f*-@!< zxueC=8JSIU)=LNo*zR-@Ae*Z>q|DkfBdwS1?Dw$ciZgYW0&x}&CBM-Ic zZWL=!Zb9GWdST#~#Isfo97UVV=ZFWZG|jkrX8mehB=3G;I5?HpjR5X2uruory^aLF_isD|iRx)?0B$||&D^lE2IWMgZscihRglL((E|{|G z5SMe#C}}}dfxPfg0Q1yZ`lWko?FmWIjzB4J{c%gcgIM~#elfUec*TN3lODlF>czfD z;mK6X34%2DP=Yrr-%7MFTK~0j@o$kiDl0KzUu#KF6!r|>EDa@&Xwy82cKBis$jQI> z-j`F4)#(tsp&hHRp*wNuN=2TDxSHqEY1)G4GmMIjM&kH)fTlTrF%)r8-efU{*a`7U zdGW^p51V3zCiL|`f*18>|F$`;Ra*s>T1@ZhTpPE6%CpLM!>cnL47%22JK#$_)h1w+-&haCWL_Jou#JO<$7ac8 z0Bz7j^8!g8C(Vk$0#3T&rc{oaK!f_>#8cYj=0u6A;Uonh-Ry<+BkBs(nE9WaQPY(< z*(Uwj!@Gsn1v9abBHM=yr?1fbH1%*AA913Sb1|O|nOIR$>9%KUFTH?`sON-?U#M?s z2K|DT8%>T~p8KbgYf2^4L`fI?@by-)Qr{A<8n2DXbdi6Gf{D2*kT6LWF;&C5Y+J*o zc(6Zm#s9K76cX4>N-#iVpvLV&P!!3INY!X~81O(KioOb)`tfS?M4NcT#LSD9v4;GP zvDT3j4%2CI0zifB*eU1-XQC=trDb^^*(4gTUx)cK>?!1wQH??H8puOqH*U=8EUhIp zjHE}SH*|%DFYY&?$&<5}-D_b_Dqg+m@^u>v?1%q$PK(JDypV=Spv#27%4haR!EGX=jIojjx_^4va@Y*eQ!Cn^bt zmaYIP#Q+v1D|GN7@%ZLpIsdN26I=VkTFbIn^22y{nf(_b1)nycXaOIi6>@*?p!4;^ zujbcS51deej2%P(6+#t!$fz;*kzb^5V^P9r3t&E*g7f7Op=-NWXEMN(Gkm)hhNq)W zr}LAKwggBqt7mB6dg%yw&LfHTkxF4}6i04vSZAB$Pcx@?jKl7ghNwS8P?0-DXcvEV zr%zhfi)~)IKxB71Ryj1=1MVdRnu2_v3-708OzLk0b-8mLzKa}-S7#F2NaHf(kGuNm zVL-UV@Xe6KxBB4y1G>Agp?T`fl7w-Ay;&d1i^~cz3j|nQX%KjH6$b8kX>p)b|82WD z)CH?>cm7zMGkPN~iCJ@UdMWO{S`8;?A;vO4MucEfroVPXIneelek-gr`=vV#ZCG7) z^|SUkMuVcTzn zUw4nF0uW8PdKGax31^=TZWxYieUgAgc_z9O7j@L|>gIOp*jaVMs#wa2+*_w|12EL* z&Tzd&7IbYVIcnWKZ@o91L%>wL>G#(Waby6V*(5#5=tjKMQ`&d>`~YFFiVy4femVR%|FL~(Ns1jCeHuc{QrO0)c?H*k>fwvF#o?G z7z}{+rt={ON{!!&X1;|gIt{r9SpOwo&8V_PcC>v>30c;fE=^<***`;Vd@}p2?M~~7 z=0n^j5Y*1qM2QNk`XNi8gh$cb`BHjbLMU|OaNfu68CT=H|I=gm_-^4x-dXrgwZxLH z;+IJaZpA+-2+a$4$Ui`1EWzG%5KAXVaug6}NI$c35SfX2Yq9$4^n~+~@CN>`e{`y% z`AFR1iXy2Eclw}neH%WurZLWq*L}xV5Pox{#PnD+m~c;iH%cDeePF-DF3Cl(eEn28 zADf(_agcyp^O`^pd2wuiak9~Y_qbUt-(FjWma)znhGlbsh-dVA3+C=v4JO!UjSpbO z*eFkFdMn?3@y)&f1eWSjm$KP_85(yA_(lI>HFbcHW~hrbkww%i0sj%^x)CIl3UP`> z5Y2eve$CY`GU67iN>q>JO;=#pYqrhmF{IU(lLDiaj+bdrRiywvZcueX*=_IeZ*4C@ zMr#y(7zyfDf@Nnesp>{95QTb(nk3+?JwCm^?z^u;JujdvA=p7U4jsxxHQ7 zD|I+wt)J=s$Q}~o<$H8v>2Dq3LEzxq_}zSbv_< zvO#7P=oGPc3<9ehG5J|?Dxch&J5rgn{&>#e*%cNZ$-cOt-i7go8t4EWRxyBa-+a9^ zKm0XJhRh^g)dX_Q{X(f}09#4LK=sw}cO8Otb!(ZtQo6&wMYOypW_KR-iq@ONrv+ANp|?|~7PINt`ToYeHM?$iW|#3K_@U6AZmkg? zJf5?185Hl0!?QO%;DdN0kmL43VpQZYpjrR<=r zF{oq=MRuGi&p7R@vU>}DXmR(ij@Ix?1A048l|p_a&E9kht#zvN-Cuz8RnxH!l`Yql zM>h_i$0!-WrbYmM9`=g1cU8b}{k8H;yHjF#A)^Adcl1!;r$PX~$n%OkrxOqU9d6UI z&HoSW#o+lX|g#xz_ z-4uWI_*?Mb_Uq0XhFbvOXZ}6`H*2cRi7Ea&veVG~F`C~fLmRVdUqGlp(W0NGLTREqF@gc*@(!$sJdtdxsbO~9+*Q(Bd&2Q zQT<6lwgxgH%a-4ymTXawsavw`Ig!3FiRH;3Dl3#$N4U|gsjy$qW z(&DS$h^T~|)w0}Y9NGEGS7O5);eZeEcartOMVSRe5lMmq5}iNCRBL&1!>Nq+1GMO0 zWe3QlGM)+Q8b=cuQI(O7kZ(!p0fk~x@yg`~rTRkObXtf0bWBBNouf{&h3jjrS?)6X z{NCo<)zBwO9f`T6Q^DoPT5?OS9M{QCD01&H2@S`%k z66=-IPwGyz_gpm}hCeiAg7B;rhiP8Nq{Bpl{YKdAS!Z3NYd6dCCADV>$w|Aw2lg7( zjzXHz6&AvR%OuD%m;W}H7#=j*pDgsmDH8~D4~4TRwH{yKRrC%2V!pb12WCu{Nl96$ zvdkrb$cX+}_y;;WN}az)IKVHd8$=M*B!9XljAm~UW*bO;Kp8{GtV)2e5`PIL60c~| z21i2#sRin@NRjS-xeUsn0RE-5?2N)u8U_p}O`BK6TLOxh7`!Jes~Th$VG$Y<*JbU& zMz@57T@bY=3;zZz^wtSLOMVZ7R(#ClG0acUD6Gs9IIT+Es?DVs04SD~N|hz_Os=S7 zZa#K&Q7P^B@Kmiphm zHFNiN_jD1O1>Q>rr2+id7;AewyeRMeg)*5A9f}WJ(oKC|9=zDk)vsjGs#bq5*K3F} z9?XTz6D_2#!@0cfPeAxs9*NLhl{~9|`Q!CqqyzKr4;B8kew*#sNJ1DQ@+a9``4M@F zYnVVKM0SFbOjlsfA9iFPVfdCJ7Z|z9hGGjy3x(NLQe{00F%keBcHmK$xXll+oZI~J z5LK~LCW1X7}KMsP%y?G!>H&DwX z&Tbf}NkS*hn=xyvIxtt}o?4d#soPUI>(I5#Dqh4U33d9)A*XBlPY|V^MrWNaz6w>n zi{ySk^a);%zZ{u4*yz(jEl0uVkfY~`nA`Kxw@NF}`&J7OK_^F*MJoLeV4n**)W*@$ z22~ReMbt=1t1VM|bmo>3k@00gV{gVXAE{U~wBSqM3pogoZ{0)4^j}$Cx-rUR=UTy&(gHIaI?*EZ+A7`=JnUQilWo|j*T~UHJuqY!<>QCo@q|rN0Y2Fm?>Zowq zJmO`}dA+VLOb=DGvGNrXIHZJuzCK|Q*q6bypP&iR%G0YokFRJYp7{3EW5l1C0Oe9Z zDV1<+tdcR9-9L-01#*iPBcJM7(*NYnRbhymq>KQ7@@hN0XA>>kT8?J5Y)?1To8Bl| z?EHPtHQ}9)ORRcPd@tyxB3!+Wqw+^Nl(KK`3B=WP+yzoZ4kn1V1OK&Qm}fEnv+ly9}+ zg{uHhK-8URs4ow$h4=n&?mU{r`7rcHa*uOA?;D#Qrl}OFjM0`D$D0(c{Z8JGqqO4h z2Fg5^xr6g3X}%ux;a^6MsxRqZw7}GqVO#nE{#VQ`+RQNj-bLqlLO59@cPR#@1+qW2&b4nW@nE4Mwb_c)A3& zZq^OE<%k<(KV1SDs zJFDk1fFCx7E>T;26hg%5w<++kr(7afw)1xJX!GjuBc}z+`2SYN|4qU8Ne2F(yyRT} zW(fa3zBsPGBI8wo=7uByZCi(3PE3j311)5U!0}Lt=;B;ZI6I5s`O+NzU+$f&l+l4E zKU;Vkie;VobBFv_9HQS--bcF0B~B9Mi8`eN#=fF^5go4iFut)lGmFGMT7T$Y&fqr* zygbE>Dyh88c*h%5Pg_I_`_`>we`?{7=#VG_#vz(7Z1Kk7%uT$2Ty3EqgO#dPI-6c! zw%)JHo6~@{)*mmhI=LrdmsC}G)8)IyWn7+#k?rIkm-P4|Wzb_vv4&|5}ArS2UyegH{-01X* zmcBJS);ES2rS+-Y1d{pH?5KK1CH>6>?s2Xteu3Uc)PtB4tReddTOt7L6PT&4ziHr$ zwE^E(@zB&;x_3g|rY`ii!q5oX;TM@xSn#FhdclnhC;|vLm>AFO5mh-ru|T;H$8lae zQ6uTTJNmhFcIm~D!qFT-y8tO6n|I0UiFWQg#eRRc;7wRqwr*BYrkiYsa6Y|{^W!k= z(bL=b&gk%caeQm6-{aR%={AOUHuB7lMh8#HQ_KBG_LBp}DD6Bfb6OZEdQ915@h6YAqJl#M5f+p@aQlw2C%INnd~5DGh2jcOVm6uR4e zfuz$=BCXI?OAHwM@2C-2Sr_#^>7kDfV++E zi})qYa6b?_K^JY9r&#a$RNO{?n&QS!{t;iAQ|QYSD1NeAqr|^YFg~f$RKJ|9Jyn^< za_c9~R|yRZomDAf1kidUq{5C;SjB*<_d#^%bZy)xafOlxRL7!W_(P6zCHQRuQYhT- zhjN;|DL;eXW)IAqJ@~YTIpKWM4hF@uRudzz zpNrz6LSGt(p#3r%9)13D;JiEi!oif4>Z$;l4c;B>tZ@~2sw;&jh=ORpC0_#F$DpJ^ zkdL{Th-jXzgkAHT!gT}PaE}NFU<7W3Q#-qj{2t0@V7g9(Ul(0>_P7t%Q4cq{(7NGF=AKyLw4*VCUJ^55DROu95tgTmkH$GF-{GQEX z;afx=1C^ChKdEp7Ee5E8CdYAhw&B#B;B=nP4$z+=3FUKv4W&$go&$rHy!hUqO(5l+ zm_hI)=C5+U1>*7Y)?Utci2RYg?Ki+lg7*W9vzB3;M%c@^l&D8;!d8FbVE-y?urUSWH6>79GQ!f>On^?M9;TeaY6r>z;N}4At zlnfrkYGnJWtS+2c4^p5!TpVDdwo3Db2N8bt8zbdD>4&*bx!G}I!}RI!l$W5f^B(D} zHmy15=?iSK`Zj>tSsR+roZ2YUSzj!NHuf|5NqpoEtMZGzmWb8_h2P7;L6xz)z`85b z&3gb`^|?KCF4D?@FLr`*%#b+U?rGNPlQfnHSf?yALC=}>uW77k*iQ?{r6x;a6+?dh zA>eu1iWk@L#Ome!SLehvDCuy{(Ea{BHJtncfXze5Aq(K<_4a%ax$yGM!C=Zzdg_p6 z=J}$kY@@A53}6|(xMQ-@PD{*m=p6ks2i2v%>PvrZE>oQcrk1=@p>pMndj|kj0M`|G z`$5>xqNV34@2!V|9+;VV-E1MjR9-wkBd7tUI9f*U7trH@8!12y|Gmr7fKwkUSKw%Dq2x;pO!RVrvpU; zu8N#`R)khYoKUMogj=o2O2E#LS;I68_Z8af3@0T{!os1w=$u!OJ!wN3HAFl`2}Oy8 zD5#beOE#=YngrDP5PkmlFsXuGJ!GlSBddXVM3C*H% zIPP%Q6VmT5D`*rn_vM3-_r{p3IgTChC;lJ#fZC(HF5Hox}vQH*!kW@ zWuD?_9JP_o69eFDkDr%Icjkv52S4?!XHV<$+n)c8*^?ILn%r05Wq-z zSa-vK><(lkH-%?n^=V=vn#=0`e(1h+!aX0CrJ++d{EvEJe%*tm_{vAiXRH)~hjJXE zIcy>PH^h_$3s@pO2+5t6W%jI*9?lCxa0>~VSxOmgQG~gBl1~5yOIAR#2-oAQkFQ+G z<&4Lx`yZQE#;5f^2QT4m-r=cJBmkM{XQf_%r61aoiKu7)W+asPbtPfhVf@!?PYrVA zRLMgm`#a3rRXn%A0~41SQ+5Vd-@C$Yr_#h)uJ?;q(P|V=Zb)dt0!*?{ZNgJuNDe@@lkkb^wx+RRnD>k2|kJ}_sM8r<1NikYP z^riuvS`~={bJgrKii+8Xx-FPO1q>4Ez3RKnltCUCOZjZ)F!0-^+fmb z@-*X6b9A0e4~TOkYi-N)%9f0)($Y;UM7Gry7-7nOHp`IL;|?5h`XsyaoQ6!3xul>z6`p9H}9VKwk;K{#THHP z@c5^%v;MN*j|mGLh@5KExpLB2owA=e??SJ5BaRPq07#k!R%aHfe z>61>{Y|Wy2lGND?Q@?mw5t#I}q|6gr%`9s1ktuoMtIUAAfa6w}N9WakcfiDoPBcV@ znJ>{uO*1Gv zcj=!{2|!E-KXbMhhoP^Zk5gk;TMuuyrQ=9}J-T(scUqxI}B+x@hEDMplE4m8~z*;vDrFf6Pu>{L!^+|R2VxR zPn6@)Tp!ZvZf1PvVvFDx^o3;OFNN0V_;tNA$bbW_6lL)N!st}`IkpBS8=4zj1#D2J zy<|v|OL`=oiT%Wg{>}g>C9gD8dJOZ1b5Thz?1y$$x`r?_3AMO}e(-UqLT*s$yimqr zbpk?h?-7tR3hstlPzY@Wca3%p6@!$N8|1!R4sC6a&NFfSOHPb6N6ESqL_F<;;-o^* zWB@-3BH@TDOpXjF%9j9n{6IO!0{iZBVk_XV=xs2;RU#@|AI(!meM+@LXDx8?OdChJCUyRbCN_= zN$^SONgh?hyc5H{iGw0ql*$Y9)MSkeG>(Np|Gj`jfXiZ0lSu-;R`!XD*?Q*hMRe;b zZ=7?efoQU%@?fbWi{ZszkfiZkI6k&;WP=tjkUk2v<@BHC#7d-g1GukvLnPSu?10jTykh(az`MML`stL=GjB6P7=mr@29T6ssjwb1AS{`^uemC z*Iob9dw_Wh;^j0eu^8{B&Nd`Co?J*zzFd2?RnaW%kdOMt%z8BCVsaw&eGxzA#JK|N zMiIioD=rj4LV=Ktg>^F?U_I)Y*74i#Gyl(#n|Cs_JdU=*=;c`XKDhHox?Oc_ zebl$?MG*)JflJ&5_MSR~&Yr*PIKyi{;in+DuPUMY6W@r;)&@)hkgd@WxS?Z<*2bFO zi6753mD0^egxYSaBkMqG7&*$Z$CWD8+90f&JMh(io zqQnpfVFdd&1J?}$D2J#^Nn@~X{ujn2R}<0F%zVzpx3Hh?AB;k z2Ci^D$htB*V`e$o`jcvRR z1ixM7+-pQ5QMuL(Xu-rpiJ5uo7k9%W$GU zv(*>T+*cFhD>-pH(2qium&S)=ewUS0N4uYV5iP+GP50>x`^GU>$8bklHgOtW4X_{8 z)!5<4PO;rb+gjVYAI}W!SOo|-^fh2BfRm`}c%bcm9;vKrIFwnIzp~adj(3cq7B(1M zf+|T%TZsm8q~cK+lPL^dNcSvdcIW%5NA}z8-N_fI2CMnzR*fa0uJ`A^iHqRp&B9KC zR?)z~4t-)=7$D%;Mg)WBB08P<0I5nC;j|*eyB!cX70aqT0TkdZQ7;WPI#1@)Q^KY_ zB*IW7pc>;xN)R>SBmxv5IZCH~C8JVbRKrAJ+BVNY6ZTn;F*D#itrqiQy@?+^vG4sR z)9;@Zp-u5FH3Jm)yvHm5Xp{YH0=uZz==}t_MEI&Zve1qcs8G7`e%cC3fM0_ZBM=cr zq^G#~G{bAy+#S@}ni4;9@IV&e(=Q0L(m;B!Gjv$pJ1YJ8y7Qc|8BLXuNAAQ$LY#y| z7QwTg_G6^`>5Om=QapHZ5_8Z1Dnoy7~Omwiowl5S0GbgSVjXX>Cst)ezcW} z=TKD2uN^wCjgsacY=>#u0!T#td1FnvsSQRYx`8q+L1Bn>YpDt4`%CaaDnAbL!?mC! z21k_UToa(2{3sUT)fg& zv}uVfne})XYGZT7UoZ9=13krj(~jC|k_3~<1sg@s$Tbx*wL}=Osat!1Vxm}FC;>tCP zxB>RM*bEm5s2lxmfLZn>M_DmWg~lqwNej33TGYs-PwwoW!K;dlM$ zJk{0=-zo)Q-q-^V>P9Z=pgP^rzr-`YCN}44sCEYT)&IoQ1x#3+{R`%@`w4UTt?`-W zsFrDZGhzSqw(1g#A-_;f88JSyPAR;UooG$emy+3)-e|85wB`4u`|R$hjbVjmdahtz zIp%Dyfk39}peHXVoq>DJDxAORb-jP}b0u}qcse?sNrk4S~ z+w<;nLcnO@?=o%ekNr1~Umk^$A`hy9`~gjMAa1)mk8GO!2C3GxRX^WEth%(;rX9ZD z`-Dop)OVyIV`*(BrJdLcd*Qo6e_WmK+{xlS@gaHxjfPM9bV?~|s%U!LjAjb6EFM}# z*DNo^Z&03-Pjq`M3Cwb*bhepK^i%6MzCO(0ivujbSPmpAe`VeY?=LrYDWme({W4xq zu={XM{o9O+8643?iMbT;JnEPL{ta zP;vgH;s3AR{*B!EA7wfIDhtX9WU)m<!p60modVfp|X_Kl?#*=sO*LdG|l z%s?!6D{wAWR$zd8&0n_+9@t>q?ElDM|CAvLEb}0M;bQvSoW?Fzz#$JtC}|C8DNXIh zCl3rzV4W8Pu*i@8@2j9!+UJV{@Fw{D&G8lka(QC|U%b(wl-1-kEk!04{=q*(9D(N6=T+_|x+;6l|JcKj^Q$yE_f!|pPpQ{s+9!wTFo@`^I)`Iz z=63DR8$EZ(6nW6Vw!9O3EJBRo9srfVi#*EDKg(&4xsj5k)~S{BEpLv6A|6G7qz|1j z-9(MYb~>K{$W5@}i9xAAX2+ea(J2s()z<0R)9kp-r(0;Mx+5AahHAlN*kLzx7Lfd# zNz#H3ayT4HYRVt&BM}`Ng#Zl)JEe|`ot2oy|6#DBQ6DTAjVx~P?IZ6^0I>S;%|D2E zjZ?zwTinA2>h3OjCx^Z6>q7`ZBp=Y7g6KB`tfL}N2i5)ZMxUR^OR$)psQ$p(k99JB zQUSM1e4S$LvtBdn71kQp_A~wIsFceogJ$oG%uj#COaCjR!xQSDo(WNXm}kziQkPPf z2tM&I)LR&=9fcn$=}K)V@BkQ(9flvlo>^Dqn5YJW7CQt#vX({ZNqu3cOjx$%>?l%^ zS0hRW-A!=ngO_Ex%+fFoKa|^B@WUJdYjOqD0Io%k(Z*(M+S#5 z6p$dIxQ7t21Yc1-4$A+?-9iQvm3D-M{t@O#Zh=A?L`jLpgmMbwfe$czH733eKoc0V zPx>hCT&r1=<1AJvoLb^1+JJRN{4L)tM^kQS?a-0%?$R*7H^L-ic+jnPce9LMMk7|+ z^$@k4VyosM|IOd+rm9k_H~oP3E%w;F<)P)Ldy6}7=QfTATiBEP>s1CK+v(ZTZ@KfV zvzg`1I)KGTno$_BiX%W@8rBl-5OzL*(>eIzn5&Hqv0eo0B|~ zZiQMFB?rT0NUp&6exavU@M-I$wA$_s?Z= zU;M-R)+cH)(OkfMvUwl`u|}yl6d55ZY@FW83;R2FIVxCHd!5EoKHAq=FIYFSGSO!w z@-X}+(STHvKl?5VzYTsr?y!>G_T~f2BN&E5e6qq(1$3$z7_ z*0Sb81w6Ba?Xa^JvM=_M!*g~qGZgU6dU^J9i1V|-LGVU%DNLu8(~3s)r18Vb%V$kw&K$_R;995KjIHx1hTv9W138-_xYM27>8{mM3#j&SEoUYuVu{SEzkkSg z+r1b;PzpA;(v68F`j&qu<~rGvSUF|all(37gSRqegkXDOQy7mMNpbagarOKAwf*~! zv22Nl5}b^O97d^%q`sh_z`ABWKQ$pzK|r`DpxsbnH76iC!@_?)G%oO^j4OYPl#hvh z%yKt1n2|uCumS->e-g-uc+29tBQ=c}DOWc=~h> zAR?fsFj zwE+4ACrp&G3t`4~2FKPNsCJ898tb^teG9r-%Q)wWu4MOuxKrq5^*pt|iIh{zx5y;v z>A#fRRP)=FRy|quVn`b@Q!w)>SM|sfko6NyFk(hg%YwW#WQ7|hK`>Z0Q9Jt z495)&+&meIHnhG`G7iltw~irMTxb>u=vSGNfGV0>>kjYqrY>>8R0tGz}q=2gon0;A1epu0hZL%Z1l?VcWTiME~i zIpa4ZW_&)je@!fUL_~Pr%usC0E|MIUnwkJ9(eCa0xxLV+f2lWC)Ku0^09tqjJ2+hr z<$X_k5LrmSOQp%#3U}AFw)=0Hs4X|xq{^BJOcDuXV@k6&<~faYZ4>#br;7@zVp*JU z%^nHR`hHrmO*Vq$+Z&g7J;y=}CwzW2@0@KQ)6yM5S%u>!wtwap%_tELD3U7olJCg# zA*{oa!Gv!6MTN3`deUPK07U~1iw<3NhQ2PVjl$fpzMxx854rBR&uY(fr908>ck0X4 z_-3U|ju%@C3}*a~4x*X#bJz=o;8mnzMXDIuw3tcwIm7t{LgI&`8Vcb|ITw{Ub{HjD zsHXF*sDaGVIsgTPPC#j{?PZ1kvhn^a3mj97GXtA(W9V8s6VtB^K#4I(R{+0L3@bWO z9g9tiGLvNbTk?g0%1=j7$}tOAj%r%f6V9Kb;QD=bj}DTQqyjAPx_)9YH7U2(Fl(Ga zYKI7h3eQK4aLrWKk7PQzviegrnqUsNV>HM$sblCYktjFPpWi|UKE|;4pINLY$PYL0QceK2+Ubm-X1xolM< z^dLAjk^0gkh^OF&6)tMgUV==VXgTGIBV`Y-C3 ztsdK-dC41HiggmntB+Jo?AF0iEpJU!;t1+(pt{;2P^$q~#-A zZ$))~0%Sq?MUM&5>xp%hsiw`FWxj8|@~2_U&=szW*31C2n*La~#aC9n`dwT-Bee#4 zk|dN?6*k%AgP_IPjf#4mm`TXxk>Id@lAf*sUL>`*&-n`=>y_)@@ATQAIcGw`C(R(F z8KaM+*z(i1V6#ms9N1e=LM@u~WI3#()PF~*GVm8d-Nf>T4d#5qOf6K(BUMv$sc*MTedr&e2_vssiOJqI+WZII2ULsQVLTeD$kAJW7~Q} z78R^axNd#v7{gB90n$=|Amm6Z5>}qJKSluAnPCXusF7UF#UstTv-JP$&^lsFj5F>=37$c=QEgJsHh zrzjI$Q9ev;ruN1-V7s?~=#tUyNVDl->(~XKpT-RUt1z6|d}=BZ$N5S=twbMF36QP< z`_UmQcOP0qrS;@V0Sz6|{Z`Z(+|0fsWPs34D}&DWUCKHpH{6$e&+<2ADB*ew;MJ*EkM2Qu^yq z*AQD#UOE09YHbkxYukdahLRXcB>k>~G0`8mtii9T__*BnO2(|EZcoTU`c+`R+s;_! z!A%Z$IWeH;MKSoavRGW&zfCxY(nd%JVY zCV`=Hj3h!TX~nn)vq!cz*)!6fR>2`>;3XLX(8t#TADEx#Z*rR0tc_BM{r$;( zv%#P&ibh{z#XYn{Pr{+oh@JF82>U%AOQpW$X!T(zqvOElKeT}5xLjy_eH8k!&-eX-nz8okU@QCeq=%n{OAtOp>^_H%+85top? zW-Hy21{grS?5`&Av+bzvqN0k5zN+%~k!)$9tetTnKd=SpF|S;mJ<4=+Ub-%N2@ADG zx#(^sLQOL*tLvFp9ci4=GHPdbRLUl+U=%hio0#)FL}Fkp61=;;WDA(Snhe$ZXY{W$ z-(_CS%rdAps#G|dtO5>D*_wy*nFFEOyCBO{XL3x;k@)Awo~+SJ>mLZ!&fnxs!!96G zEX?gjy>k;!>%<$?JEAM+lWkA?Os|Yp45#)}NIr$l$q!wz*f)Uut4G!)8&s5==hU3 zq^OR}30+~VHt#wQHO8Go__h0MNoA<&n)CZm0v^m*Lf0Td7Z*R<;C6y+(AX0jZTQ%R zVS>kR+VSd^pnx|wTkosDFC)kf?Q*7o=AUaWvf0qRyM{JaL{{JBV(HPeMdkgssLyc; zoUN4lVu>VX_KgpCrn^zvu(UKYGcN7bv8;qj3z+V8``S5P;s-DJ$b+zGnn}b7(~eUq zV~k~ZwaP|%f-mSM`RNIfMv^P1UB`ZaMlq{F->@p+z5@I(+blq0olB z^Yaa3J*N_iME6G2MvNPEDGKQ+1%~2t9l78jxB&ouJjlmFU3o%8GFcy5^|?nV=gTD_ z9={HrmHdnxnA4r&rC3(lIS*2qcQooKCHjvl((`PFjvdv;BG_b0-G(dqx$hg3_EOS- zr^lt4weMv8`qyjGQqTQf&#%|hRa9|uL8}r|+a>kpFHYeh@o|MK`L~1Dy*b?P9Q^Ph)FLU7oyHM|g`Lu520A zd?tN@6>2a!G~9US6B>96Vfe-cbNOI4ykue&STe=T6M{%gCCxaf0lqaWjwh2UKh&O`SeQIxfy`C!YzKBbXou3)Lr0 z8*e`c?nc&;g`ja~1|sbJqePxduxOT`KKPQ@bnwIKdST}7FetP9fU4|AR>hs#?k&W@ zt7(WX4;t-caifSzad+PauGwk#To3?Vkvr-sSw^dRfU&Yf+FhBSP|kYYyg}giT}X0l zx5<9YCs%@(xM=RocjX|fgj5W&c=6kjcCaR7e>8WYM!59QJ{_CS!vj#@_mJ+|2I=zo zHm(z0#O7UaFgDoT^nza_l=C!as>Af$n!)1N4~$(~FN+%*b}V&K#@AU^D^~xncdre>8S`-Qi_Y%=9Lj#(Kg zud7ES6~8NzJFTzVO_{lu6}FSY@&rn9L4zd^<0PWy?A6RKR6b52%_AS6zD%K0Ls{fV za8ZwP;!nZNz=DW2RmU&5AGjZ;q}<)J=YV|47d5~$iKH>sXr0s3TtC$B^&bfQnrGx> z7Cb+4kl8?gOMfYzqda(fEYCQ-M%;M3jf@p?``30D98|qx(OOg|5kV zcYYMv?BZsf+GJ*$o|68yTrL~izNcH6fyLYdYOGr< z`w~wd>XOh+O_eI-3;=r>6GlH0^4XXD5ZYqF_6Ae*j^avUZUL$7I26Qs5Bhc6nnuBC zOEl+5Q1Ygy+F7yFGo)IEXPoDTRF&zF_LCA$0es{K`?8pQQIoFPj(h1^vijh0%bXRR zdHOmAR2isu(9Lk^wwG9*^R^tDaZ!dIlB&Xr8vAX`_(BnZ9Kb96$0P^j@{=ZR$+n5z z2*-3q!x!vzp^^{L8zq|Py?$M;_SS@4!0pUJ4n6S}iJD&?c(2#EdEvJ0>s?nqcvN+; z4#_zAHt*5hqQ^Q?KiRg@B~tIjL53&0G&&*e7bUk!b$IXhpBv85vw4P&+RYcUNg5MF zR(QO9KsLmMUVw7M5cMR!?r?94CPBffFq!YkA9|-hYMe6U^(z`@pAK=+!8mpuk!@4= z))PS4Hm9sdS>Z#exut|`%>&|>R#lz^7(0;}<37oUtcjMZ-H||#diMc|E7%Xz@?Ywf zdU8k3kgG?3^gJA*6dB85QMdiei7~2@)l<>u(mW5hcL5z6YCFL0X0a_yY;Q=xEX+r|6cMY=)zDK;b@azQY621_Aw-$Y>0yor3dg zPa^%UGhe8+dU1MoHVY|kctY&sS+(D}#Pbntib4i5i-R=k#i=H&I60mpOd zNO!%%B6?Jdexlz1o-y8x=y;xl_JL5o45i1}XnJUu7aXD5{6AgDhycux`Pgb8*JqJz(G5fG!G z)#ZTJna+t1y;qGjMR}iRaCDLPRHa$7kG*PPOD6$6m~X_OX^TIpLELV8xw|26&x=ic zS^+($?*e+xEp`1im|CeEc&ooR`UA8kn^^x`xL|8)jmS6)Wg6!G_L)$17NH7BB)`G= zi1P>zAu)BKat!pkp2B<;Y`rqYqYS)NUJ(_Kw2a^tafq`K+{- z3@z#o1r2OP$pq~NW&tGIN196NZL(jC0(jZ6?nQ~XU=t0GL%ZMeQn;3*ldu%-cWnS1 zRZ+&#{=NgL6#MNROc;{m2)Ik1PQ=Z*r+CUe=wqFwx5*+5jQz%KlrQJg8*~`>P+M@ z_AS?fG2%z^{*`vj#|ODnh}}C?{eXpLL_VhTw`;EbuW|0Lf%`{AEj<%oQ6R5X8 zYw_EO$xV6n036ym((6=ix>52b~}WNt)0 z1N2d^`Qt>m9yd2|T;y zU^akYcZtPKS*|NcihxkApG61lM}=Tl)xh?~>2MStM-Z#E5m#n0k+P&GSq8T{qqITY zC6e=$F?g8bef7GW446z$c|EOZ#heIbD?7V6zg&GGE{uUzAx(^Mi%IyliP{9ve|b?i zPL{?NkoH`nChUX-yt8P~ODmM~qoJ^}h*A!JDSCP;4Lam=G{zqMQWhgo*v{ym0@SR% zYsuvIiZUJi)poAS3BcvBD7}yQZOSibBXT?6;VnB9diZ@V*Mzd{qbRd|V<%6=n+|{&9-Qt^No5e-fQ_HT< zt5u+YL~O}g`O^aTcuqsfuo~e)_`=HqgbfBq;!QE7N)-*=c=U6?O{p({8rlY~In24Z zRJA7=jU)D^2vcRgVknuTIV4krM@_Cmdx6!4vpG9ctR~-%8q0=pU-nB$n99R~;|YNc zgSo6s`TYWn4fv3X#e%e~c!nBgG6hEzs#;Nn2Mx_VVRLeEJZq^LdW16+OK>)H4r`{l z>!39A1M3C)YNW0e(=#8y0@fubXNt03Kez@u&vW9v=7MBeEGqof8r9_HZ53@pv+M0; zwnWS}OeRbM@x|2h^=fld`%W>w0%#pMsG3C0!xMya{W~HKMTzJCE9|SoqUzdyB}F8p zOF#t#$(dn-k&-T@OBy7k8wp`ccQ?}At#r2_-60{;B_XK98J_Qa@B4`7y3YD%_I2;O z*6&_x@0oS2`7OWq9k7H7W3~YSdQ-SvP2Kc-&v{fAidtSv=GcmgpZNUQsc18hQz;%qZ`0-QlCbf?kO&}--+Epe z#b(F{e^h!rXB*M|^}vpgE-v`JBY6bb2p?Vcn~yQr%=dlOmXvKXg>b~TM3%%lln*>j zrzIM@TN%6oGN}vj9R=^2SyI2(OX-heeZCFil?C?V@)5iL@xHY$lk-^_K+=Xc;NgOm3$l1i7y(h!J+Q^aa+FA6C);Qdn2hb>eDAuqY!vLMuchRcgp(# zJ;LeE`-}cfVSZw@${|y7hR1^xTMt2zlZot%1!B9@3=f~Pe4C{Gk*^t+9J&3`(Sv5v zmrJ;`7~t@h@P0yveLf-6AeS1sx1gjEC_QsH9@SZ0OuM-`I>G5N7yp2qTb0Z68!uIQ z+Br^UPmMc2ZqCn&plaz()h8;eTSCvZHKg9YP2v-$VQYMjzh96c(j;Z6fklql!6j9h z+IAbWg9HzBezEz*LRaJP`F^`uz0O3Mec#yTJux6n%f(~vMW@$hunEW~Ufrv2HP5-T z$0M>-KrxVOns!NNLC28aK4WZ^klg9&U}2Z$YUO0f2sSL-C}CXgHJvv)OTp1aes&+@ z6jSay*?h2N!t0zy>1`jyEkH!?joMez^Mo90IaWkls%~? zcKX0P4+uqe$o?gFNS>i&^JEE&h3KRf=?qbt9S%E<@#9s2Zak7~vx!%p{0v5^~ zg|c&G1-;XWS)vxc(kd^b3PMVjYT&&w8NDMvL4AeYF-Kp`%z+IstdTM2c2HlNwMd zczjfKheD!Fb5W;uir5~M9Y$EXm~HnYNhKi7;;g;fYd=ENVVm$%Jx0J= zXkDEleOOHBVH9~KX~lQveyh6f=V@m!x1JQU>d0NLG8dOEuflrZg=>Ce zC7w$8H#-$YRVORsB&hsHo;H#S8N?oMmp8FjqN|FaV-uQB4J`c;9WOEI(mg>8DeA0K z!Dk0$um}tghMIED^%L`~bWtR;hmI(g&vLyUusO|}NG2!v} zlR$im5GgUy90KPQ2^ra9tz9CZ!Xidj{_gkPc}(MXow8q3s&}!e+2odw?mR?R3QN?g6a=xPpf~BbC+mcT4|*#D6}t)e={zzz&G`;N0Q>n}0ggYc&CK`BE`B;|s{Zo8z^BY)NG_RA*%tJpJ*f@6 zVD}g{4?*nW^m~twX+ET!AL!piYh8Kx>z8@1Ei#Nu#DY1C(3AFpu==jkult<2x<@5A z9`A4njJ;xOTOX`=AA2%}j@vwcMUpPXU{q^x%O49m(5dPSzLZS18U`d^ZtQEm=-?@T zSCK7v0$0~B)r}Nt862*u$J?BkiOxS7LhXYWaK-x0xA0!%c;?MgbgE|cYK+XB@4=n| zXh(&x5o2Gysk6hSuR^Ss!=Z`yu9JV@1Fq^M3ll_Qd~$+;#ILluH~27@Cw&sc1%Y|k z-%^SR*T!@Jb9a!hV>#eix*Lt%E~aFIH8!P#GqalC{mAN$hgyg~ji{hh+Pn&s6lZ3I z*t?iuRM#P@TgmozDgo`vE9_z8W42ElQwePnQ06j{x)MP4AhG0Q|a4$i8M7Gg>7qP-6#5;>aI3qjc5P>z?uK`3!*goEXgv; zbko2OvS*`#ocPrNQ!p>0JEI7_eot5<>8VF$!U*#bhC7*Wi%`_p*L+lhZA#05&W!>O zeC~B@BAf`{DNUzijo+=H%km+4Lt-2@`VsRgRg{p$hK7;57Jrcpcw{3;Vye)!88c21 z54OSH3tH?{Zomc#KfnMDmhp$uTno-5P0bx8eSxCZ)7gQT`yIM3-eoMrC$;d&va~h( zQ`vlu?*<=mct%|?>Qw3m=Ms{Caru7!BPA^xL*BIj&C*&^?=cGv6@P-ju(_B?8Ahnw zT}Xxgirkfd0MD>Zz1rkD;ecw#>-K2;rO!_i46wzYpWo304319oR%$Ac0bg!kV&R$o z)+z!LXOM}Tqwhcxi8R#ySUTCG^?_osf7T_Y20e^*|>fK7#o%xLpdcFJ4H?<<+NI%VJJ zSPr=j?kgE^jPZ49kKrpC0AxPH^lO6Wrg}i*$ykepl>t#W_f_PB zMT?mSvy_T@_wCoCP7jSxB>&&8AcFUx3%g?xZtcWpT!58G!zrEcsq;b1lZ5l%W2BS= zGFBeGgC0)j=)q#oJsWyHk-4xNe>m-7+ORU*=y@qew|C|j8$!V@#~oGS=zh-n_0D2R z*Ad)ysJ`#s@~WZbuB2Z84WfBncW4Q7_$gQa2c1i-!6qa?)q1<0qBmD?PEAEgdAfGH zDr#s%Ul}N(?ReEkNhj2OaLYS!H&mPIxTA|!X&&C~{PUzO`B)~~e3Z)O8O55GWrDT4 z>-f4G-}?*2mN#scw~h5n*fi-8sft-_I}GpN8?Jr6Y6&D=rH<}<^JvVm%Ov(U`eFe_ z?Ju;>T>1GA;)uqDvC8(hO?pHFPRpCvCYPoWQ=8R5HnYT8kfu+UcG(=~!|-Zt@4=3O zBL*gBOp1)KyF9g}c4U1_Mh%8*ezWf|6y8Sf$V;n9*EGWI)mBn{K7mNvIh}q~q<+{K z&tW&UvaE-oRcP!jOXUVCHa*U_6SsS`)JsuWl%;p}W`PS9*@NNqJp)D*gk@C9G)Ed4 z8%fp&G$=5*)m?O6XztRekx3sJ#9)-XB~+S|XfN|u%jA4I1#C)B)pM#xS8jbUw2LoU zOt;LIpgdl?e*w*F;9Y;hR=cEX{H%zHKLWoCWABuR+|<7q21;Q(Y}VkVlGXjxSs2Ay zM9PG(NIBm?MQCj3PB$S_=IK~=#pu1}oF`BZU>jM_mXg_6x~jGj@AaaUcfkP{W2#{h zfVvEW3xbDFk_M6_%R9|YFbvJl6vYE%hhHfl7MI~~fX}k?uH5zCYaBO*`yB=5B1SQM z#a=t#a!WbmeVJT-=0|YIC@|$18ZsG6e)k5r24sgmi@zlA%Q-v*MpxQ{ z3@lfOC)(+V-K2Xog;~#qT^F&QMPkRle0FS+J08?lwP%1!nZA#XRh51AJ^X&Xvipbc zqT2TM6GY=dNnf{xsi)MqL^yXWu02kif0J%h=dBlX1mS z+SEhJL&uZ!3zB{BMOPd)%uQ*r=p@|UOh|0SLN1IdXKgU0@wf|d+D7`^j0PBq->FI@ zd|c}+dWI$S>Las%hB{n~iHl2#RE=D+XtssVj;umg_hsEqbnWh#@xhURM(yiJbB+4C zD!r3uSI)$_mf`w@NDn!Pzp#N(#*6~*D7OON`+VsVE5R8jg~F4aXYL)B=d*k{=qeeX zpkmKGY?_PFcBfq3ZMEM^B=Z3!}KW!-K+8GW!MvsR*3`kp5|_ey60W?w3^Seo)H zP6&C~=%;8(YQ1)5r%$AeCJS)D!BM7XvVGyjtOfZr7#1&v-A`=Dg7$6IrKa?0YCev5 zTBc=S8g}oav1s|iJ$WMqp+I5R^JK*e8kN`dRR(3w6L~ulzek$4;<8|lT{)5kmTS?! zauOa=fG`K}Hv7R}4Tq!T0PtIB6KZ@KhbmKO*goyU9|n5yNgevoV*mZ#;gaA7S_&Od zufp%tEDxU?5y{#=m^y+9cx`X`5W9#e=zAz69y`06OR*WyC!dxl)>`z%sC+r;IX{E? za#l*&xhNXAtO!w+5eP)vgo!#$N7Fw;uU_al6_|;l+wMQruGPhF23Ff6O{(`Z%kfxi z=ZUjLee<&_v%bHc3*}|D$}m%oREkoGQi;&?nLZ>|dD)T6x@aU*Q>OWOu58-E`#_Hz zIL9IM%@AC4$IR3v=S!*_=kIl?s-E^Vf32bts|Ke(Z_LH2m>O)Do-1{-tvogVZCNyV z>o8iA?e$eqr6f=1GBDFrhfMT&TFKEnudAb@tgOxGTPIvmTlA*W-<8S22jh9#36{x& zxaxZ`-MYUeB118qxiIZ(KWTqibRhmvCAYqi3N`&AY#zSm81J1ErJF3`rCL^A?Rvhv ze|2$o+28NE9uJpd;xc|lbn4h}su&;ZK|sJZ$Ej^8IM*fP(FVNeCggHOBI}AZ4kG(~ z_XdO4_m6u9)M((u-1ybWU}CQ&2~IAuoD7TAq$Tpb{q@&1U+B6rI#UXK3w&o>5*euq z4zu&)&bZaeb_HC*S{&=X5uwLn-KL=o@|V@p^A`KMKYQ*_a&ffnpG}3R%fIFF)4A75{sa!Auq6aLZn%~e?4dxGr*O@h43z!8&o%nnlm*h(e4f@bd? zQ!UEmhPf1!miD4yO-#oy(udz?6q(I`Vso0dUi}s@kAvpnW)!y< zdxfMV*5|VM>9%fs$ssG$Fh#3k+p-u~zE4g=(>PAe&0h!EAjzQ;zckTu5r6F?CGBUFd@yix-@z@RJHl$v# z3A~cRL)T+n_c^k!a!d#;kt{BeC!L6uZo}Q`Jj(c$hCYIJo2QL{nQV{c6Ne}{ZZ-=$ z%iyAEs&0fD@D4WuQlzfqqwCdxY(#&fqM#2})JXT5_oBtBM}i zeKPVnKg;LttY*Zytc}C)tKic(a*-=9@$8Cik*oH-z;Dr2rp_--Radt%vO5QglXuuX zG!4t=DSi^c=ABq})Z1M$AL@O6x0$n_rp5okDG~aPs-|NE|FaS8Q$G5_7?+>lM!CE1 zAYZbORip}iW*$o6A5G~Ye34JOrtI}{^9w}dD9*JPoDfVN#b%s0+d#pi(n(hw+0>odT zdj(bczDRHL^E2MOi_=ujz+x2`)L`2t;f)>IO*H=%q7nUhfX7w}vYx~F>hrEu`J6JV zVD6cS_8|X$!}{CBHw47uTiue3QEkBGodPNFh}2hd(eCcIQPh^aG|aA2o%&WQMSE0+ zZPxUcYu!Ptgt?s}Ui|YF{tjd1LZKo{gEGU%k5=)Fvx)mwUFgTd2s9}LjCa)OuY5W~ zvJ)oE700bZ(?ANei5Ytr!LH&Cb^}|^C)>yI)f>}3owXZhG3g1lz2k-_=RUw0rlU>1 ztCO^-#lWX^!jwB#Epi~dtRT4qx#Y;0K!{si_pvZTRjnd5T--7OIQsQt)?R(ai{==g>cdR;^G3RDn@AymUe+PVd9Lf& z;IBo}#HlJxWG>>UE$Usl7PLd5JBDdnz!K+ELMF>6)=9n45a)S-M5orl$mF-nM3`|jmRdin<6}!J zA%#>~G9Exd@m5^u_m=bhq|u~GjpmOta6M)zKa{h4pu+pM!a$N+_f|eyH$3_MqHfp$^0?Xa^+zNd5K+g)9bGaY}tEvOfOb(RoiivS}}B%zXkPN0t|a&6nX3kMNwRy zGYz#3c^&Q&;gor)weq!>8{ge+)^};i8D9H`SJ!!qF0K4(el`~s&`Q#A&t?v*qv$E= zx6qsywK~`r?$$&FL5#pthMFuRexi91uoo6t<;ud0=9E=nQCK^ht*ot6h3eNbN$S!c ziSm!_?-gnWkoxtO9K36e#M^RPeSDdjq5udLyqq0im+`bt7|^3db|5L7TNMJ#R(xBshh(+rKXVtFErzteXp4tLzrbU zyOXRHs>8I{#DUrkkObm-MP&u9Jlc}#!%1YBADOe@f9R#C zpBWSkGF?5*w06rb&U%3UoLKK2XqAR-K2N2OnAusti85n%(rz5>@s^3PR>nDG^&oqr zVspk^`Q@*3t>ReI&-I@U6}5DV>PMPrZl00}qSaY(J`_=Y6BCBKedPH=$O1?Gvw9kB6bD<0$tDV+>3H|u(S5#DTF`}~F&bs)w z#vKbPa-s#xbDGhn6guGMN4UX`$inn*_KLZ$W_;v<<;e=a$%WfLJ0`h#IhRGwo>@hA zM@=P5b~S2bl#RZ$P;F9}IMXgu>hBq2q=6#qOnnOluA%}cEWVuR#=yJf^;lZPq#I(D zXE{|<4LAGUDD4bKROaw(n<7GyIU;-<22VlFBxD6QEDorMT|eAG(myVyBK zZhl^!5!5HUu<%hXz;+O0!>*K|lLFbi!}Tuiy6o7?`qb5pw5nzNuW5x zPvXNbtb2Zrfs6TI0fs!Ew8qPgw(yoici=Z=PLSw8-cZ$LMrGP!pX+wC@nRpYEL}(K zZ1Mcqd4UnVKmZLcJZJ3la}h+9u!xTBC2@VCSbdDhGP^Y?@q@AfMFU$4<7g29Eqc27 zq5vDTNd?K@n*@<~*qU8jojbVJ%p^u8T51hOONsTsOvY7pGBUWVuM{iQLsLxp5-6q_ zORm9)h&2`<*jA?uZRV@9+q6hqT7FAE(Tt(`NVeM4E~wwJAcfPgvH!XAR(m{x2#=V{ zj$474Hfdoa@%>D+=@V<_Qx=##c}aqd<7s8TPG`n`(7q$$?G+bTQi!0A^fx1=DSQrR zPk1Qs0S0<4iQ6-w#}$d3XMRuHM1co~uF`ry-*k56#8OoGq}dMw1#sP9W<# z2i)IyDWIYyE3=MAxjnx2@k`|Im`A300|A-4iHE!ihbpp;)num?6-rm|YupY?}_C8F-a@?7j_lljER#Zm4LttijG&U6(!|7>aoNQLeNfLmKBvds>TzWGEVgwqpi#OxRNtm%_#m$p2i>owh!P85@E0p|21e5SXD62N-Ou&jCU; z4k))i0ttp2BVqbTX0B+wACIe8&)U&2U?>OsKk5JZB>IIwkts<1q7i~Z!AKNA#&vsO z^#J#u3my;%g39O*859cQM)4*5DFgE$kkL867y)iL7}dQ$Z^95r6hp!vG8hO6`b&=o z3_)$4`9lu@;en!fI{uJB5irQj1mHaIe{2Di=6|w>BET@zuaQ5D;V|f5#!xs4ksEq2 zBp7-V4JZ@>zv&MO0bMhJ{BMlw_^8GW=l+-Qe`E+K2(`)Qy8Smn7>pamUh=1m2k|#D zQ0{A9lRxz!;A=jUKV%>T0Oh`!;Wg4XWl&VHZyG}(+}Ksy#@7TZe;9*NwtppqGW{zE1ctmRL)l*Q!~DnJKlp>;$iD)k{9RMk z{73Qn0+sY%Jw}ZV=*`lh{9Th<{$UG7{J)Zh1IWLEKzMj=_6}u?xG6)G6UC$PXAmg# znp@+Bj2i^GIgU`a*C%VC8t`BEA>8o4vW7x=AU6X;xxv>|IM?kzr9;{N^(=tE;5;|= zQ2u!S4L>SA3RZ5E$D0me2+&OkAv}od&2oPPhC-3Bo8tq@4ZSAt`9lw7``7s3hVX!a zzZ}9qf6WLeHym^m1(fmM4q=FEQldWsLt)@+!l6H9+z9CZEeY@+2)R*Dy_;Ec^B_Tg z)e{B*-9!tDQoIQ@N_0&@^k-l&&keLt_(Ne36yApe3828Lb}*ZkoShJ?dzCJl!n z{+ga})HCH~(gEsX3?L`@I4luTWX9`HoBT|Lkd73blGK}C@;n23;&2pkF*;em>wCY`W2L`)b4 k5*6V4|7vJoGj-WJ=-W9s+Zh?-@}NLK;xaLb$%*6sAE2%&^Z)<= diff --git a/tzpfms.ps b/tzpfms.ps index a9f0e90..05918ec 100644 --- a/tzpfms.ps +++ b/tzpfms.ps @@ -1,15 +1,15 @@ %!PS-Adobe-3.0 %%Creator: groff version 1.23.0 -%%CreationDate: Fri Mar 29 11:45:22 2024 +%%CreationDate: Fri Mar 29 11:47:34 2024 %%DocumentNeededResources: font Times-Roman %%+ font Times-Bold %%+ font Courier-Bold %%+ font Courier-Oblique %%+ font Courier -%%+ font Times-Italic %%+ font Symbol +%%+ font Times-Italic %%DocumentSuppliedResources: procset grops 1.23 0 -%%Pages: 15 +%%Pages: 10 %%PageOrder: Ascend %%DocumentMedia: Default 595 842 0 () () %%Orientation: Portrait @@ -237,8 +237,8 @@ setpacking %%IncludeResource: font Courier-Bold %%IncludeResource: font Courier-Oblique %%IncludeResource: font Courier -%%IncludeResource: font Times-Italic %%IncludeResource: font Symbol +%%IncludeResource: font Times-Italic grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72 def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef @@ -276,398 +276,15 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-ADD-B)72 48 Q -.4(AC)-.35 G 42.103 -(KUP\(8\) System).4 F(Manager')2.5 E 2.5(sM)-.55 G 39.602 -(anual ZFS-FIDO2-ADD-B)-2.5 F -.4(AC)-.35 G(KUP\(8\)).4 E/F1 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-add-backup)108 96 Q F0 2.5<8a61>2.5 G(llo)-2.5 E 2.5(wa)-.25 -G(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F1(SYNOPSIS) -72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0(After)108 153.6 Q/F4 10 -/Courier@0 SF(zfs-fido2-change-key)7.564 E F0 5.064(\(8\) deri)B -.15 -(ve)-.25 G 7.563(st).15 G 5.063(he k)-7.563 F 5.363 -.15(ey f)-.1 H -5.063(or a dataset from a FIDO2 de).15 F(vice,)-.25 E F2 -(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15(xe)-.15 G -(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G -(umber of additional de)-2.5 E(vices.)-.25 E .273(First, the wrapping k) -108 182.4 R .574 -.15(ey i)-.1 H 2.774(se).15 G .274 -(xtracted as normally during)-2.924 F F4(zfs-fido2-load-key)2.774 E F0 -.274(\(8\), then a credential)B 1.604(is made as-if during)108 194.4 R -F4(zfs-fido2-change-key)4.104 E F0 1.604(\(8\) \(e)B 1.604 -(xcept the "primary" de)-.15 F 1.603(vice and all the ones)-.25 F .185 -(holding backups are e)108 206.4 R .185(xcluded from the search\); ho) --.15 F(we)-.25 E -.15(ve)-.25 G .985 -.4(r, t).15 H(he).4 E F4 -(hmac-secret)2.685 E F0 .185(is instead used as a sym-)2.685 F 1.555 -(metric AES-256-GCM \()108 218.4 R F4(EVP_CIPHER-AES)A F0 1.555 -(\(7ssl\)\) k)B 1.855 -.15(ey t)-.1 H 4.055(oe).15 G 1.555 -(ncrypt the wrapping k)-4.055 F 1.855 -.15(ey d)-.1 H 1.555 -(irectly with a).15 F(random IV)108 230.4 Q(.)-1.29 E 1.403 -(This turns the)108 247.2 R F4(xyz.nabijaczleweli:tzpfms.key)3.903 E F0 --.25(va)3.903 G 1.404(riable into a dot-separated list of de).25 F(vice) --.25 E -.2(bu)108 259.2 S(ndles:).2 E F3(salt)118 271.2 Q F2(:)A F3 -(credential-ID)A F2(:)A F3(credential-public-key)A F0([)A F2(.)A F3 -(backup-salt)A F2(:)A F3(backup-credential-ID)118 283.2 Q F2(:)A F3 -(backup-credential-public-key)A F2(:)A F3(IV)A F2(:)A F3(encrypted-key) -118 295.2 Q F0 1.666(]...)C .155(The \214rst one is as-described in)108 -307.2 R F4(zfs-fido2-change-key)2.655 E F0 2.655(\(8\). Subsequent)B -.155(ones also include \(identi-)2.655 F -(cally-encoded\) IVs and encrypted blobs.)108 319.2 Q F4 -(zfs-fido2-load-key)108 336 Q F0 .081(\(8\) shops assertions around de)B -.081(vices in a de)-.25 F .082(vice-major order \212 depending on)-.25 F -(de)108 348 Q(vice numbering, a backup may be loaded e)-.25 E -.15(ve) --.25 G 2.5(ni).15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.) --.25 E F1(ENVIR)72 364.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 -(TZPFMS_PASSPHRASE_HELPER)108 376.8 Q F0 .046(By def)133 388.8 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 400.8 -Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G -1.596(ill be run via)-4.096 F F4(/bin/)4.096 E F2 3.262(sh \255c)B F0 -(to)4.096 E(pro)133 412.8 Q(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 429.6 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 441.6 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 453.6 Q F0 -(Pre-formatted noun phrase with all the information belo)160 453.6 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 465.6 Q F0 -(Either the dataset name or the de)160 465.6 Q -(vice feature being prompted for)-.25 E F4($3)143 477.6 Q F0("ne)160 -477.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 489.6 Q F0("ag)160 489.6 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 506.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -518.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 535.2 R(En)87 547.2 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 559.2 Q F0 -(If set, enables lib\214do2 deb)173 559.2 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 576 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 588 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion yielding the k)108 600 Q .3 -.15(ey i)-.1 H 2.5(ss).15 G -(hopped around to e)-2.5 E -.15(ve)-.25 G(ry such de).15 E(vice.)-.25 E -F1 .625(See also)87 616.8 R F0 -(The lib\214do2 documentation at https://de)108 628.8 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 645.6 R -F0 1.6 -.8(To a)108 657.6 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 669.6 Q F0(ThePhD)7.5 E F1<83> -128 681.6 Q F0(Embark Studios)7.5 E F1<83>128 693.6 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 705.6 Q F0(EvModder)7.5 E F1(REPOR)72 722.4 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 734.4 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 751.2 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 763.2 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0.4.0) -72 817.889 Q(March 11, 2024)143.568 E(1)188.837 E 0 Cg EP -%%Page: 1 2 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 -SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) --2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) --2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 -124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF -(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 -2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 -(,)A F2(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) --.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 -(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.555 E F0 -.1(wa) -3.555 G 3.555(sp).1 G(re)-3.555 E 1.054(viously encrypted with)-.25 F F2 -(fzifdso)3.554 E F0 1.054(and the)3.554 F F1(FIDO2)3.554 E F0 1.054 -(back-end w)3.554 F 1.054(as used, pre)-.1 F(vious)-.25 E 1.272 -(credentials will be deleted from their de)108 223.2 R 1.272 -(vices \(as-if via)-.25 F F5(zfs-fido2-clear-key)3.773 E F0 1.273 -(\(8\)\), if a)B -.25(va)-.2 G(ilable.).25 E .594 -(Otherwise, or in case of an error)108 235.2 R 3.093(,d)-.4 G .593 -(ata required for manual interv)-3.093 F .593 -(ention will be written to the standard)-.15 F(error stream.)108 247.2 Q -(Ne)108 264 Q .464(xt, a ne)-.15 F 2.964(wc)-.25 G .464 -(redential of type ES256 is generated on the de)-2.964 F .465 -(vice \(with relying party ID)-.25 F F5(fzifdso)2.965 E F0(and)2.965 E -.499(name equal to the dataset name\) with the)108 276 R F5(hmac-secret) -2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 -(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 288 Q -(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ -n, the credential is asserted with a 32-byte random salt, which hashes \ -it with de)108 304.8 R(vice-pri)-.25 E -.25(va)-.25 G .963(te data,).25 -F .138(and thus generates the wrapping k)108 316.8 R .438 -.15(ey \()-.1 -H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) -2.637 E F0 2.637(\)\). This)B .137(mimicks a)2.637 F -.8(We)108 328.8 S -(bAuthn login step.).8 E(The follo)108 345.6 Q -(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -357.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> -128 369.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 -(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 381.6 Q F0 -([)A F2(.)A F0 1.666(...)1.666 G 1.666(]...)-1.666 G F5(tzpfms.backend) -108 398.4 Q F0 2.707(identi\214es this dataset for w)5.207 F 2.708 -(ork with)-.1 F F1(FIDO2)5.208 E F0(-back-ended)A F2(tzpfms)5.208 E F0 -2.708(tools \(i.e.)5.208 F F2(fzifdso)108 410.4 Q F5 -(zfs-fido2-change-key)60.228 E F0(\(8\),)A F5(zfs-fido2-load-key)56.727 -E F0(\(8\),)A F5(zfs-fido2-add-backup)108 422.4 Q F0(\(8\), and)A F5 -(zfs-fido2-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 439.2 Q F0 -.486(is a colon-separated tuple of unpadded URL-safe base64 blobs; the \ -\214rst one is the ran-)2.985 F .217(dom salt; the second represents th\ -e ID of created credential, and the third \211 its public k)108 451.2 R --.15(ey)-.1 G 5.217(.T)-.5 G .216(here e)-5.217 F(xists)-.15 E -(no other user)108 463.2 Q -(-land tool for deciphering this; perhaps there should be.)-.2 E -(Finally)108 480 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 -G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5 -(keylocation=prompt)15.506 E F217.172 E F5(keyformat=raw)108 492 Q -F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .106(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F -(to clean up the properties, or to issue a note for manual interv)108 -504 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 520.8 -S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.556 E F0 -6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 -(command succeeds, all is well, b)108 532.8 R .729 -(ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 544.8 Q F2(zfs-fido2-clear-key)5.146 E F3(dataset)8.646 E -F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F -10.313 E F5(keyformat=passphrase)108 556.8 Q F3(dataset)6 E F0 -(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-fido2-clear-key)108 573.6 Q F3(dataset)7.607 E F0 1.607 -(can be used to clear the properties and go back to using a)4.107 F -(passphrase.)108 585.6 Q F1(OPTIONS)72 602.4 Q F2109.666 614.4 Q -F3(backup-file)6 E F0(Sa)203 614.4 Q .352 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 626.4 R F4(must)3.194 E F0 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 638.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 650.4 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F1(ENVIR)72 667.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 -E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q F0 .045(By def)133 691.2 R -.045(ault, passphrases are prompted for and read in on the standard out\ -put and input streams.)-.1 F(If)5.046 E F5(TZPFMS_PASSPHRASE_HELPER)133 -703.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw) --4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.095 E F2 3.261 -(sh \255c)B F0(to)4.095 E(pro)133 715.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 732 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(fzifdso 0.4.0)72 817.889 Q -(March 4, 2024)146.068 E(1)191.337 E 0 Cg EP -%%Page: 2 3 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 -(Either the dataset name or the de)160 96 Q -(vice feature being prompted for)-.25 E F1($3)143 108 Q F0("ne)160 108 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(FIDO2 back-end con\214guration)72 165.6 R(En)87 177.6 Q(vir)-.4 E -.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 189.6 Q F0 -(If set, enables lib\214do2 deb)173 189.6 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 206.4 Q .625 -(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 218.4 R -.726(vice which supports the)-.25 F F1(hmac-secret)3.227 E F0 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion yielding the k)108 230.4 Q .3 -.15(ey i)-.1 H 2.5(ss).15 -G(hopped around to e)-2.5 E -.15(ve)-.25 G(ry such de).15 E(vice.)-.25 E -F2 .625(See also)87 247.2 R F0 -(The lib\214do2 documentation at https://de)108 259.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 276 R -F0 1.6 -.8(To a)108 288 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F2<83>128 300 Q F0(ThePhD)7.5 E F2<83>128 -312 Q F0(Embark Studios)7.5 E F2<83>128 324 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F2<83>128 336 Q F0(EvModder)7.5 E F2(REPOR)72 352.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 364.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 381.6 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 393.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0.4.0) -72 817.889 Q(March 4, 2024)146.068 E(2)191.337 E 0 Cg EP -%%Page: 1 4 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 -F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.587 G -.25(ew)-3.587 G -1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G -(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 -108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with the)-2.5 E F2(tzpfms)2.5 E F1(FIDO2)2.5 E F0 -(back)2.5 E(end:)-.1 E 5(1. performs)118 177.6 R 5.642(the equi)8.142 F --.25(va)-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.307 E/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. loads)118 -201.6 R .79(the primary and e)3.29 F -.15(ve)-.25 G .79 -(ry backup credential, and for each success, if the de).15 F .791 -(vice containing it)-.25 F(supports the)133 213.6 Q F4(credMgmt)2.5 E F0 -(feature and has a PIN set, tries to delete the credential from the de) -2.5 E(vice,)-.25 E 5(3. remo)118 225.6 R -.15(ve)-.15 G 10.689(st).15 G -(he)-10.689 E F4(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A -F0(,)A F4(key)14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3 -(dataset)133 237.6 Q F0(.)A -.15(Fo)108 254.4 S 5.859(re).15 G -.15(ve) --6.109 G 3.359(ry remo).15 F -.25(va)-.15 G 5.859(lf).25 G 3.359 -(ailure and missing de)-5.959 F 3.36 -(vice or PIN an instruction for manual remo)-.25 F -.25(va)-.15 G 5.86 -(lw).25 G(ith)-5.86 E F4(fido2-token)108 266.4 Q F0(\(1\) is issued.)A -(See)108 283.2 Q F4(zfs-fido2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(ENVIR)72 300 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 312 Q F0 .046 -(By def)133 324 R .045(ault, passphrases are prompted for and read in o\ -n the standard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 336 Q F0 1.595(is set and nonempty)4.095 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 348 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 364.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 376.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 388.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 388.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 400.8 Q F0 -(Either the dataset name or the de)160 400.8 Q -(vice feature being prompted for)-.25 E F4($3)143 412.8 Q F0("ne)160 -412.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 424.8 Q F0("ag)160 424.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 441.6 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -453.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 470.4 R(En)87 482.4 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 494.4 Q F0 -(If set, enables lib\214do2 deb)173 494.4 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 511.2 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 523.2 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion yielding the k)108 535.2 Q .3 -.15(ey i)-.1 H 2.5(ss).15 -G(hopped around to e)-2.5 E -.15(ve)-.25 G(ry such de).15 E(vice.)-.25 E -F1 .625(See also)87 552 R F0(The lib\214do2 documentation at https://de) -108 564 Q -.15(ve)-.25 G(lopers.yubico.com/lib\214do2/.).15 E F1 1.666 -(SPECIAL THANKS)72 580.8 R F0 1.6 -.8(To a)108 592.8 T -(ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F1<83>128 604.8 Q F0(ThePhD)7.5 E F1<83>128 616.8 Q F0 -(Embark Studios)7.5 E F1<83>128 628.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F1<83>128 640.8 Q F0(EvModder)7.5 E F1(REPOR)72 657.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 669.6 Q(.ht/\001nabijaczle)-.55 E -(weli/fzifdso)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 686.4 -Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 -E(https://lists.sr)108 698.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(fzifdso 0.4.0)72 817.889 Q(March 11, 2024)143.568 E(1)188.837 E 0 -Cg EP -%%Page: 1 5 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) --.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F -(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 -/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G -(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.789(After v)108 153.6 R(erifying)-.15 E F3(dataset)4.289 E F0 -.1 -(wa)4.289 G 4.289(se).1 G 1.789(ncrypted with the)-4.289 F F2(tzpfms) -4.289 E F1(FIDO2)4.289 E F0(back)4.289 E 1.788(end, asserts the preserv) --.1 F(ed)-.15 E(challenge, HMA)108 165.6 Q -(Cking the salt with the on-de)-.4 E -(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) -.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF -(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) -.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 -(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.208 E -.25(va)-.25 G -3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 223.2 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .046(By def) -133 264 R .045(ault, passphrases are prompted for and read in on the st\ -andard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.595(is set and nonempty)4.095 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 288 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 304.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 -(Either the dataset name or the de)160 340.8 Q -(vice feature being prompted for)-.25 E F4($3)143 352.8 Q F0("ne)160 -352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 381.6 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 410.4 R(En)87 422.4 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 434.4 Q F0 -(If set, enables lib\214do2 deb)173 434.4 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 451.2 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 463.2 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion yielding the k)108 475.2 Q .3 -.15(ey i)-.1 H 2.5(ss).15 -G(hopped around to e)-2.5 E -.15(ve)-.25 G(ry such de).15 E(vice.)-.25 E -F1 .625(See also)87 492 R F0(The lib\214do2 documentation at https://de) -108 504 Q -.15(ve)-.25 G(lopers.yubico.com/lib\214do2/.).15 E F1 1.666 -(SPECIAL THANKS)72 520.8 R F0 1.6 -.8(To a)108 532.8 T -(ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F1<83>128 544.8 Q F0(ThePhD)7.5 E F1<83>128 556.8 Q F0 -(Embark Studios)7.5 E F1<83>128 568.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F1<83>128 580.8 Q F0(EvModder)7.5 E F1(REPOR)72 597.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 609.6 Q(.ht/\001nabijaczle)-.55 E -(weli/fzifdso)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 626.4 -Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 -E(https://lists.sr)108 638.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(fzifdso 0.4.0)72 817.889 Q(March 11, 2024)143.568 E(1)188.837 E 0 -Cg EP -%%Page: 1 6 -%%BeginPageSetup -BP -%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([) -2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E -/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A -F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 +/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 @@ -709,28 +326,26 @@ listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R -18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 +(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666 -(zfs-fido2-add-backup \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 -(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) -108 583.2 Q F2 1.666(zfs-fido2-add-backup \255b)6 F F1(TPM2)6 E F4 72 -(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 -(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-fido2-add-backup \255ra)6 F F3(tarta-zoot)6 E F4 72 -(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 -(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 -(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 -(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) -108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 -(zfs-fido2-add-backup \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 +24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 +559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 +F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F +6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) +108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R +18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 +(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) +54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q +F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) -108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-34-g48bebe9)72 817.889 -Q(December 4, 2022)83.583 E(1)183.842 E 0 Cg EP -%%Page: 2 7 +108 775.2 R 6(available yes)54 F F0(tzpfms 0.4.0)72 817.889 Q +(December 4, 2022)139.123 E(1)183.842 E 0 Cg EP +%%Page: 2 2 %%BeginPageSetup BP %%EndPageSetup @@ -745,9 +360,9 @@ BP E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q(December 4, 2022)83.583 E -(2)183.842 E 0 Cg EP -%%Page: 1 8 +-.25 E(tzpfms 0.4.0)72 817.889 Q(December 4, 2022)139.123 E(2)183.842 E +0 Cg EP +%%Page: 1 3 %%BeginPageSetup BP %%EndPageSetup @@ -756,107 +371,104 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 -E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.867 -.8(To n)108 153.6 -T 1.267(ormalise the).8 F F3(dataset)3.767 E F0(,)A F2 -(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.177 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 +(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T +5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 +E F0 5.266(will open its encryption root in its stead.)7.766 F F2 +(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E +(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) +-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 +(data will be silently cleared.)108 211.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 +(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q +.294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 -(\), and sealed)B .585(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 264 R .886 -.15(ey w)-.1 H .586 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q +(\), and sealed)B .586(on the TPM; the user is prompted for an optional\ + passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 333.6 Q F0 2.207(identi\214es this dataset for w)4.708 F 2.207 -(ork with)-.1 F F1(TPM1.X)4.707 E F0(-back-ended)A F2(tzpfms)4.707 E F0 -(programs)4.707 E(\(namely)108 345.6 Q F5(zfs-tpm1x-change-key)37.248 E -F0(\(8\),)A F5(zfs-tpm1x-load-key)37.248 E F0 34.749(\(8\), and)B F5 -(zfs-tpm1x-clear-key)108 357.6 Q F0(\(8\)\).)A F5(tzpfms.key)108 374.4 Q -F0 1.412(is a colon-separated pair of he)3.913 F 1.412 -(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 -(\214rst one represents the RSA k)108 386.4 R 1.167 -.15(ey p)-.1 H .868 +108 321.6 Q F0 2.207(identi\214es this dataset for w)4.707 F 2.207 +(ork with)-.1 F F1(TPM1.X)4.707 E F0(-back-ended)A F2(tzpfms)4.708 E F0 +(programs)4.708 E(\(namely)108 333.6 Q F5(zfs-tpm1x-change-key)37.249 E +F0(\(8\),)A F5(zfs-tpm1x-load-key)37.248 E F0 34.748(\(8\), and)B F5 +(zfs-tpm1x-clear-key)108 345.6 Q F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q +F0 1.412(is a colon-separated pair of he)3.912 F 1.412 +(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .868 +(\214rst one represents the RSA k)108 374.4 R 1.168 -.15(ey p)-.1 H .867 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 398.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 -(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 -(he sec-)-3.913 F .379 -(ond represents the sealed object containing the wrapping k)108 410.4 R +.15 F(pro)108 386.4 Q 1.413(vided, or the SHA1 constant)-.15 F F5 +(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.914 E F0 3.914(;t)C 1.414 +(he sec-)-3.914 F .379 +(ond represents the sealed object containing the wrapping k)108 398.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 422.4 Q F0 6.721(.T)C -1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 -(-land tool for)-.2 F(decrypting this; perhaps there should be.)108 -434.4 Q(Finally)108 451.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F --.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F -17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 -(keyformat=raw)108 463.2 Q F3(dataset)6.107 E F0 .107 -(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 -(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 -(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.72(.T)C 1.72 +(here e)-6.72 F 1.721(xists no other user)-.15 F 1.721(-land tool for) +-.2 F(decrypting this; perhaps there should be.)108 422.4 Q(Finally)108 +439.2 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506 +(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 +(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 451.2 +Q F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) +-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 +G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -475.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 492 -S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 -6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 -(command succeeds, all is well, b)108 504 R .729 +463.2 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 480 +S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.555 E F0 +6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 +(command succeeds, all is well, b)108 492 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 516 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E -F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F -10.313 E F5(keyformat=passphrase)108 528 Q F3(dataset)6 E F0 +-.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.147 E F3(dataset)8.647 E +F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F +10.312 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 544.8 Q F3(dataset)7.607 E F0 1.607 -(can be used to clear the properties and go back to using a)4.107 F -(passphrase.)108 556.8 Q F1(OPTIONS)72 573.6 Q F2109.666 585.6 Q -F3(backup-file)6 E F0(Sa)203 585.6 Q .352 -.15(ve a b)-.2 H .052 +F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.606 E F0 1.607 +(can be used to clear the properties and go back to using a)4.106 F +(passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q +F3(backup-file)6 E F0(Sa)203 573.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 597.6 R F4(must)3.194 E F0 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 609.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 621.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 638.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .638(Bind the k)203 638.4 R .939 -.15(ey t)-.1 H +E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 +F .693(This back-up)203 585.6 R F4(must)3.193 E F0 .694 +(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .639(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 -3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 -(hange, the wrap-)-3.139 F .463(ping k)203 650.4 R .763 -.15(ey w)-.1 H -.463(ill not be able to be unsealed.).15 F .462 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 662.4 Q F1(24) +3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .638 +(hange, the wrap-)-3.139 F .462(ping k)203 638.4 R .762 -.15(ey w)-.1 H +.462(ill not be able to be unsealed.).15 F .463 +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F1(ENVIR)72 679.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 691.2 Q -F0 .045(By def)133 703.2 R .045(ault, passphrases are prompted for and \ -read in on the standard output and input streams.)-.1 F(If)5.046 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 715.2 Q F0 1.596(is set and nonempty)4.096 +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q +F0 .046(By def)133 691.2 R .045(ault, passphrases are prompted for and \ +read in on the standard output and input streams.)-.1 F(If)5.045 E F5 +(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 727.2 Q +(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 715.2 Q (vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 744 R +(The standard output stream of the helper is tied to an anon)133 732 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 756 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-34-g48bebe9)72 -817.889 Q(March 11, 2024)88.578 E(1)188.837 E 0 Cg EP -%%Page: 2 9 +133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.4.0)72 817.889 Q +(March 11, 2024)144.118 E(1)188.837 E 0 Cg EP +%%Page: 2 4 %%BeginPageSetup BP %%EndPageSetup @@ -869,23 +481,23 @@ BP (yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) -2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 136.8 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B (is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 -177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 -.229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 201.6 Q -(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 218.4 R(rouSerS) --.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -230.4 S(ing one of the earlier ones with, for e).1 E +177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.73 E F0 .23 +(suite connects to a local)2.73 F F1(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F1(localhost:30003)2.729 E F0 2.729(\)b)C 2.729 +(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 F(the)2.729 E(en)108 201.6 +Q(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .11(The T)108 218.4 R(rouSerS) +-.35 E F1(tcsd)2.61 E F0 .11(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E +F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 +E F1(/dev/tpm)2.611 E F0 2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1 +(py)108 230.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 (See also)87 247.2 R F0(The T)108 259.2 Q (rouSerS project page at https://sourcefor)-.35 E @@ -900,7 +512,7 @@ F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) -.25 E F2 1.666(SEE ALSO)72 439.2 R F0 (PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E @@ -908,42 +520,42 @@ F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (and https://trustedcomputinggroup.or)108 463.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q -(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q -(March 11, 2024)88.578 E(2)188.837 E 0 Cg EP -%%Page: 1 10 +(able)-.8 E(1.)108 487.2 Q(tzpfms 0.4.0)72 817.889 Q(March 11, 2024) +144.118 E(2)188.837 E 0 Cg EP +%%Page: 1 5 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 45.793(ZFS-TPM1X-CLEAR-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 43.292(anual ZFS-TPM1X-CLEAR-KEY\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G +(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.008 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with the)-2.5 E F2(tzpfms)2.5 E F1(TPM1.X)2.5 E F0 -(back)2.5 E(end:)-.1 E 5(1. performs)118 177.6 R 5.642(the equi)8.142 F --.25(va)-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.307 E/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q +(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G +(ncrypted with the)-2.5 E F2(tzpfms)2.5 E F1(TPM1.X)2.5 E F0(back)2.5 E +(end:)-.1 E 5(1. performs)118 177.6 R 5.641(the equi)8.141 F -.25(va) +-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F13.308 E +/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E F4 +(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm1x-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1 1.666 (TPM1.X back-end con\214guration)72 247.2 R .625(TPM selection)87 259.2 -R F0(The)108 271.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 300 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 312 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 271.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 283.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 300 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +312 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 328.8 R F0(The T)108 340.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -958,11 +570,10 @@ F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 446.4 Q F0(EvModder)7.5 E F1(REPOR)72 463.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q(March 11, 2024)88.578 E(1) -188.837 E 0 Cg EP -%%Page: 1 11 +E(tzpfms 0.4.0)72 817.889 Q(March 11, 2024)144.118 E(1)188.837 E 0 Cg EP +%%Page: 1 6 %%BeginPageSetup BP %%EndPageSetup @@ -971,15 +582,15 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.488(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.988 E F0 -.1 -(wa)3.988 G 3.988(se).1 G 1.487(ncrypted with the)-3.988 F F2(tzpfms) -3.987 E F1(TPM1.X)3.987 E F0(back)3.987 E 1.487(end, unseals the k)-.1 F -1.787 -.15(ey a)-.1 H(nd).15 E(load it into)108 165.6 Q F3(dataset)2.5 E -F0(.)A .236 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 1.487 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.987 E F0 -.1(wa)3.987 +G 3.987(se).1 G 1.487(ncrypted with the)-3.987 F F2(tzpfms)3.987 E F1 +(TPM1.X)3.987 E F0(back)3.987 E 1.488(end, unseals the k)-.1 F 1.788 +-.15(ey a)-.1 H(nd).15 E(load it into)108 165.6 Q F3(dataset)2.5 E F0(.) +A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) -108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F +108 182.4 R .236(wnership, if not "well-kno)-.25 F .235(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) 108 194.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E (as set.)-.1 E(See)108 211.2 Q/F4 10/Courier@0 SF(zfs-tpm1x-change-key) @@ -987,14 +598,14 @@ F0(.)A .236 109.666 240 Q F0 3.208(Do a no-op/dry run, can be used e)131 240 R -.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) -8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 +8.208 E -.25(va)-.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 252 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 268.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 -280.8 Q F0 .045(By def)133 292.8 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.046 -E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.596(is set and nonempty) -4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F -F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q +280.8 Q F0 .046(By def)133 292.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.045 +E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.595(is set and nonempty) +4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 333.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -1007,23 +618,23 @@ F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q 381.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F0("ag)160 393.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 410.4 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 410.4 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 +.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 422.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 439.2 R .625(TPM selection)87 451.2 -R F0(The)108 463.2 Q F2(tzpfms)2.729 E F0 .229 -(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 475.2 Q -(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 492 R(rouSerS) --.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -504 S(ing one of the earlier ones with, for e).1 E +R F0(The)108 463.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 492 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 504 S +(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 520.8 R F0(The T)108 532.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1038,11 +649,10 @@ F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F1<83>128 638.4 Q F0(EvModder)7.5 E F1(REPOR)72 655.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q(March 11, 2024)88.578 E(1) -188.837 E 0 Cg EP -%%Page: 1 12 +E(tzpfms 0.4.0)72 817.889 Q(March 11, 2024)144.118 E(1)188.837 E 0 Cg EP +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup @@ -1051,113 +661,113 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 -1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A -F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A -F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.319 -.8(To n)108 -165.6 T(ormalise).8 E F3(dataset)5.219 E F0(,)A F2(zfs-fido2-add-backup) -5.219 E F0 2.72(will open its encryption root in its stead.)5.219 F F2 -(zfs-fido2-add-backup)108 177.6 Q F0(will)14.655 E/F4 10/Times-Italic@0 -SF(ne)14.655 E(ver)-.15 E F0 12.154(create or destro)14.655 F 14.654(ye) --.1 G 12.154(ncryption roots; use)-14.654 F/F5 10/Courier@0 SF -(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E -F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.054 E F0 -.1 -(wa)3.054 G 3.054(sp).1 G(re)-3.054 E .554(viously encrypted with)-.25 F -F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .555 -(back-end w)3.055 F .555(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 -235.2 S 3.06(yw)-.05 G .56(ill be freed from the TPM.)-3.06 F .56 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 +(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) +A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) +A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.677 -.8(To n)108 165.6 +T(ormalise).8 E F3(dataset)2.577 E F0(,)A F2(zfs-tpm-list)2.577 E F0 +.076(will open its encryption root in its stead.)2.576 F F2 +(zfs-tpm-list)5.076 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 +E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G +(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 +(\(8\) for that.)A(First, a connection is made to the TPM, which)108 +194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 +(dataset)3.054 E F0 -.1(wa)3.054 G 3.054(sp).1 G(re)-3.054 E .554 +(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F +F1(TPM2)3.055 E F0 .555(back-end w)3.055 F .555(as used, the pre)-.1 F +(vious)-.25 E -.1(ke)108 223.2 S 3.06(yw)-.05 G .56 +(ill be freed from the TPM.)-3.06 F .56 (Otherwise, or in case of an error)5.56 F 3.059(,d)-.4 G .559 (ata required for manual interv)-3.059 F(en-)-.15 E -(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 -264 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 +252 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 (OPTIONS)2.794 E F0 .294(\), and sealed)B .589 -(to a persistent object on the TPM under the o)108 276 R .589 +(to a persistent object on the TPM under the o)108 264 R .589 (wner hierarch)-.25 F .588(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 288 Q 1.602 -.65(y, t)-.05 H .302 +F(wner)-.25 E(hierarch)108 276 Q 1.602 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 300 Q(The follo)108 316.8 Q +(the sealed object with.)108 288 Q(The follo)108 304.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 3.287 +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 3.287 (identi\214es this dataset for w)5.788 F 3.287(ork with)-.1 F F1(TPM2) 5.787 E F0(-back-ended)A F2(tzpfms)5.787 E F0(programs)5.787 E(\(namely) -108 381.6 Q F5(zfs-tpm2-change-key)41.248 E F0(\(8\),)A F5 +108 369.6 Q F5(zfs-tpm2-change-key)41.248 E F0(\(8\),)A F5 (zfs-tpm2-load-key)41.248 E F0 38.749(\(8\), and)B F5 -(zfs-tpm2-clear-key)108 393.6 Q F0(\(8\)\).)A F5(tzpfms.key)108 410.4 Q +(zfs-tpm2-clear-key)108 381.6 Q F0(\(8\)\).)A F5(tzpfms.key)108 398.4 Q F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 (wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 -422.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 (tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B -.866(be passed to)108 434.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +.866(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) 3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) -C(r)-3.365 E F2109.666 446.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +C(r)-3.365 E F2109.666 434.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) -.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A -.448(If you ha)108 458.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F +.448(If you ha)108 446.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) -.25 G .447(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 470.4 Q(.)-.65 E(Finally)108 487.2 Q 12.005 +(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.005 (,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 -E F217.172 E F5(keyformat=raw)108 499.2 Q F3(dataset)6.107 E F0 +E F217.172 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 511.2 R .29(ention into the stan-)-.15 F(dard error stream.) -108 523.2 Q 2.625<418c>108 540 S .125(nal v)-2.625 F .125 + interv)108 499.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 511.2 Q 2.625<418c>108 528 S .125(nal v)-2.625 F .125 (eri\214cation should be made by running)-.15 F F2 1.79 (zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 (ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) -108 552 R .506(ut otherwise the dataset can be manually rolled back to \ -a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 564 Q F3(dataset) +108 540 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) 11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.204 E F5(keyformat=passphrase)108 576 Q F3(dataset)6 E F0 +F13.204 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm2-clear-key)108 592.8 Q F3(dataset)6.029 E F0 .029 +F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 604.8 Q F1(OPTIONS)72 621.6 Q F2109.666 -633.6 Q F3(backup-file)6 E F0(Sa)203 633.6 Q .353 -.15(ve a b)-.2 H .052 +F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 +621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 645.6 R F4(must)3.193 E F0 .694 +F .693(This back-up)203 633.6 R F4(must)3.193 E F0 .694 (be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 657.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 669.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 686.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.425(Bind the k)203 698.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +-1.666 G 1.425(Bind the k)203 686.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C -1.424(ithin their corresponding)-3.924 F(hashing)203 710.4 Q F3 +1.424(ithin their corresponding)-3.924 F(hashing)203 698.4 Q F3 (algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.024(ill not be able to be).15 F 2.5(unsealed. There)203 722.4 R(are)2.5 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 739.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G +A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) .15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") -203 751.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A -F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 763.2 Q F1(sha3-384)A F0 +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 -(", and must be supported by the TPM.)A(tzpfms 0.3.4-34-g48bebe9)72 -817.889 Q(March 11, 2024)88.578 E(1)188.837 E 0 Cg EP -%%Page: 2 13 +(", and must be supported by the TPM.)A(tzpfms 0.4.0)72 817.889 Q +(March 11, 2024)144.118 E(1)188.837 E 0 Cg EP +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup @@ -1233,9 +843,9 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (and https://trustedcomputinggroup.or)108 657.6 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q -(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q -(March 11, 2024)88.578 E(2)188.837 E 0 Cg EP -%%Page: 1 14 +(able)-.8 E(1.)108 681.6 Q(tzpfms 0.4.0)72 817.889 Q(March 11, 2024) +144.118 E(2)188.837 E 0 Cg EP +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup @@ -1245,8 +855,8 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 -E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 +(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with the)-2.5 E F2 (tzpfms)2.5 E F1(TPM2)2.5 E F0(back)2.5 E(end:)-.1 E 5(1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641(lent of).25 F F2 @@ -1313,9 +923,9 @@ F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q(March 11, 2024)88.578 E(1) -188.837 E 0 Cg EP -%%Page: 1 15 +-.25 E(tzpfms 0.4.0)72 817.889 Q(March 11, 2024)144.118 E(1)188.837 E 0 +Cg EP +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -1324,28 +934,27 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .388(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.889 E F0 -.1 -(wa)2.889 G 2.889(se).1 G .389(ncrypted with the)-2.889 F F2(tzpfms) -2.889 E F1(TPM2)2.889 E F0(back)2.889 E .389(end, unseals the k)-.1 F -.689 -.15(ey a)-.1 H .389(nd loads).15 F(it into)108 165.6 Q F3(dataset) -2.5 E F0(.)A(The user is prompted for the additional passphrase, set wh\ -en creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G -(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF -(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 -G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) -.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 -(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 -(By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 -F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 304.8 Q +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .388 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.889 E F0 -.1(wa)2.889 +G 2.889(se).1 G .389(ncrypted with the)-2.889 F F2(tzpfms)2.889 E F1 +(TPM2)2.889 E F0(back)2.889 E .389(end, unseals the k)-.1 F .689 -.15 +(ey a)-.1 H .389(nd loads).15 F(it into)108 165.6 Q F3(dataset)2.5 E F0 +(.)A(The user is prompted for the additional passphrase, set when creat\ +ing the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 +E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF(zfs-tpm2-change-key) +2.5 E F0(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2 +109.666 228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R +-.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F +3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) +8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 +240 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q +1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 +268.8 Q F0 .045(By def)133 280.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.046 +E F4(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty) +4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 304.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 321.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -1391,8 +1000,7 @@ F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-34-g48bebe9)72 817.889 Q(March 11, 2024)88.578 E(1) -188.837 E 0 Cg EP +E(tzpfms 0.4.0)72 817.889 Q(March 11, 2024)144.118 E(1)188.837 E 0 Cg EP %%Trailer end %%EOF diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 deleted file mode 100644 index 0121b13..0000000 --- a/zfs-fido2-add-backup.8 +++ /dev/null @@ -1,123 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 11, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-ADD-BACKUP 8 -.Os fzifdso 0.4.0 -. -.Sh NAME -.Nm zfs-fido2-add-backup -.Nd allow another FIDO2 device to unlock ZFS dataset -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After -.Xr zfs-fido2-change-key 8 -derives the key for a dataset from a FIDO2 device, -.Nm -may be executed to extend this to any number of additional devices. -.Pp -First, the wrapping key is extracted as normally during -.Xr zfs-fido2-load-key 8 , -then a credential is made as-if during -.Xr zfs-fido2-change-key 8 -(except the "primary" device and all the ones holding backups are excluded from the search); -however, the -.Ql hmac-secret -is instead used as a symmetric AES-256-GCM -.Pq Xr EVP_CIPHER-AES 7ssl -key to encrypt the wrapping key directly with a random IV. -.Pp -This turns the -.Li xyz.nabijaczleweli:tzpfms.key -variable into a dot-separated list of device bundles: -.Bd -ragged -compact -offset 2n -.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … -.Ed -The first one is as-described in -.Xr zfs-fido2-change-key 8 . -Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -.Pp -.Xr zfs-fido2-load-key 8 -shops assertions around devices in a device-major order \(em -depending on device numbering, a backup may be loaded even if the primary device is present. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the device feature being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion yielding the key is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html deleted file mode 100644 index 48af0cd..0000000 --- a/zfs-fido2-add-backup.8.html +++ /dev/null @@ -1,152 +0,0 @@ - - - - - - - - ZFS-FIDO2-ADD-BACKUP(8) - - - - - - - - -
ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
-
-
-

-

zfs-fido2-add-backup — - allow another FIDO2 device to unlock ZFS dataset

-
-
-

- - - - - -
zfs-fido2-add-backupdataset
-
-
-

-

After - zfs-fido2-change-key(8) - derives the key for a dataset from a FIDO2 device, - zfs-fido2-add-backup may be executed to extend this - to any number of additional devices.

-

First, the wrapping key is extracted as normally during - zfs-fido2-load-key(8), - then a credential is made as-if during - zfs-fido2-change-key(8) - (except the "primary" device and all the ones holding backups are - excluded from the search); however, the - ‘hmac-secret’ is instead used as a - symmetric AES-256-GCM - (EVP_CIPHER-AES(7ssl)) - key to encrypt the wrapping key directly with a random IV.

-

This turns the - xyz.nabijaczleweli:tzpfms.key variable into a - dot-separated list of device bundles:

-
salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…
-The first one is as-described in - zfs-fido2-change-key(8). - Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -

zfs-fido2-load-key(8) - shops assertions around devices in a device-major order — depending - on device numbering, a backup may be loaded even if the primary device is - present.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the device feature being prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion yielding the key is shopped around to every such - device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 11, 2024fzifdso 0.4.0
- - diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 deleted file mode 100644 index 86dd81c..0000000 --- a/zfs-fido2-change-key.8 +++ /dev/null @@ -1,188 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 4, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CHANGE-KEY 8 -.Os fzifdso 0.4.0 -. -.Sh NAME -.Nm zfs-fido2-change-key -.Nd change ZFS dataset key to one authenticated by a FIDO2 device -.Sh SYNOPSIS -.Nm -.Op Fl b Ar backup-file -.Ar dataset -. -.Sh DESCRIPTION -To normalise the -.Ar dataset , -.Nm -will open its encryption root in its stead. -.Nm -will -.Em never -create or destroy encryption roots; use -.Xr zfs-change-key 8 -for that. -.Pp -First, a connection is made to the FIDO2 device, which -.Em must -support the -.Ql hmac-secret -extension. -.Pp -If -.Ar dataset -was previously encrypted with -.Nm fzifdso -and the -.Sy FIDO2 -back-end was used, previous credentials will be deleted from their devices (as-if via -.Xr zfs-fido2-clear-key 8 ) , -if available. -Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. -.Pp -Next, a new credential of type ES256 is generated on the device (with relying party ID -.Li fzifdso -and name equal to the dataset name) -with the -.Ql hmac-secret -extension requested; the device PIN, if any, is prompted for here. -This mimicks a WebAuthn registration step. -.Pp -Then, the credential is asserted with a 32-byte random salt, -which hashes it with device-private data, and thus generates the wrapping key -.Pq which is optionally backed up Pq see Sx OPTIONS . -This mimicks a WebAuthn login step. -.Pp -The following properties are set on -.Ar dataset : -.Bl -bullet -compact -offset 4n -width "@" -.It -.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 -.It -.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … -.El -.Pp -.Li tzpfms.backend -identifies this dataset for work with -.Sy FIDO2 Ns -back-ended -.Nm tzpfms -tools -.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . -.Pp -.Li tzpfms.key -is a colon-separated tuple of unpadded URL-safe base64 blobs; -the first one is the random salt; -the second represents the ID of created credential, -and the third \(en its public key. -There exists no other user-land tool for deciphering this; perhaps there should be. -.\"" TODO: make an LD_PRELOADable for extracting the key maybe? -.Pp -Finally, the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset -is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. -.Pp -A final verification should be made by running -.Nm zfs-fido2-load-key Fl n Ar dataset . -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a passphrase with -.Nm zfs-fido2-clear-key Ar dataset -.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , -and you are hereby asked to report a bug, please. -.Pp -.Nm zfs-fido2-clear-key Ar dataset -can be used to clear the properties and go back to using a passphrase. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl b Ar backup-file" -.It Fl b Ar backup-file -Save a back-up of the key to -.Ar backup-file , -which must not exist beforehand. -This back-up -.Em must -be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running -.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the device feature being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion yielding the key is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html deleted file mode 100644 index f2bde4b..0000000 --- a/zfs-fido2-change-key.8.html +++ /dev/null @@ -1,207 +0,0 @@ - - - - - - - - ZFS-FIDO2-CHANGE-KEY(8) - - - - - - - - -
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
-
-
-

-

zfs-fido2-change-key — - change ZFS dataset key to one authenticated by a FIDO2 - device

-
-
-

- - - - - -
zfs-fido2-change-key[-b backup-file] - dataset
-
-
-

-

To normalise the dataset, - zfs-fido2-change-key will open its encryption root - in its stead. zfs-fido2-change-key will - - create or destroy encryption roots; use - zfs-change-key(8) - for that.

-

First, a connection is made to the FIDO2 device, which - must support the - ‘hmac-secret’ extension.

-

If dataset was previously encrypted with - fzifdso and the FIDO2 back-end was - used, previous credentials will be deleted from their devices (as-if via - zfs-fido2-clear-key(8)), - if available. Otherwise, or in case of an error, data required for manual - intervention will be written to the standard error stream.

-

Next, a new credential of type ES256 is generated on the device - (with relying party ID fzifdso and name equal to the - dataset name) with the ‘hmac-secret’ - extension requested; the device PIN, if any, is prompted for here. This - mimicks a WebAuthn registration step.

-

Then, the credential is asserted with a 32-byte random salt, which - hashes it with device-private data, and thus generates the wrapping key - (which is optionally backed up (see - OPTIONS)). This mimicks a WebAuthn login - step.

-

The following properties are set on - dataset:

- -

tzpfms.backend identifies this dataset for - work with FIDO2-back-ended tzpfms - tools (i.e. fzifdso - zfs-fido2-change-key(8), - zfs-fido2-load-key(8), - zfs-fido2-add-backup(8), - and - zfs-fido2-clear-key(8)).

-

tzpfms.key is a colon-separated tuple of - unpadded URL-safe base64 blobs; the first one is the random salt; the second - represents the ID of created credential, and the third – its public - key. There exists no other user-land tool for deciphering this; perhaps - there should be.

-

Finally, the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=raw dataset is - performed with the new key. If an error occurred, best effort is made to - clean up the properties, or to issue a note for manual intervention into the - standard error stream.

-

A final verification should be made by running - zfs-fido2-load-key -n - dataset. If that command succeeds, all is well, but - otherwise the dataset can be manually rolled back to a passphrase with - zfs-fido2-clear-key dataset - (or, if that fails to work, zfs - change-key -o - keyformat=passphrase dataset), - and you are hereby asked to report a bug, please.

-

zfs-fido2-clear-key - dataset can be used to clear the properties and go - back to using a passphrase.

-
-
-

-
-
- backup-file
-
Save a back-up of the key to backup-file, which must - not exist beforehand. This back-up must be stored - securely, off-site. In case of a catastrophic event, the key can be loaded - by running -
zfs - load-key dataset - < - backup-file
-
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the device feature being prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion yielding the key is shopped around to every such - device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 4, 2024fzifdso 0.4.0
- - diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 deleted file mode 100644 index 2db26c4..0000000 --- a/zfs-fido2-clear-key.8 +++ /dev/null @@ -1,121 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 11, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CLEAR-KEY 8 -.Os fzifdso 0.4.0 -. -.Sh NAME -.Nm zfs-fido2-clear-key -.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with the -.Nm tzpfms -.Sy FIDO2 -backend: -.Bl -enum -compact -offset 2n -width 2n -.It -performs the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , -.It -loads the primary and every backup credential, and for each success, if the device containing it supports the -.Ql credMgmt \" or credentialMgmtPreview -feature and has a PIN set, tries to delete the credential from the device, -.It -removes the -.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key -properties from -.Ar dataset . -.El -.Pp -For every removal failure and missing device or PIN an instruction for manual removal with -.Xr fido2-token 1 -is issued. -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the device feature being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion yielding the key is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html deleted file mode 100644 index 939f9ca..0000000 --- a/zfs-fido2-clear-key.8.html +++ /dev/null @@ -1,152 +0,0 @@ - - - - - - - - ZFS-FIDO2-CLEAR-KEY(8) - - - - - - - - -
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
-
-
-

-

zfs-fido2-clear-key — - rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 - metadata

-
-
-

- - - - - -
zfs-fido2-clear-keydataset
-
-
-

-

After verifying dataset was encrypted with - the tzpfms - - backend:

-
    -
  1. performs the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=passphrase - dataset,
  2. -
  3. loads the primary and every backup credential, and for each success, if - the device containing it supports the - ‘credMgmt’ feature and has a PIN - set, tries to delete the credential from the device,
  4. -
  5. removes the - xyz.nabijaczleweli:tzpfms.{backend, - key} properties from - dataset.
  6. -
-

For every removal failure and missing device or PIN an instruction - for manual removal with - fido2-token(1) - is issued.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the device feature being prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion yielding the key is shopped around to every such - device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 11, 2024fzifdso 0.4.0
- - diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 deleted file mode 100644 index e2896df..0000000 --- a/zfs-fido2-load-key.8 +++ /dev/null @@ -1,116 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 11, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-LOAD-KEY 8 -.Os fzifdso 0.4.0 -. -.Sh NAME -.Nm zfs-fido2-load-key -.Nd load FIDO2-encrypted ZFS dataset key -.Sh SYNOPSIS -.Nm -.Op Fl n -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with the -.Nm tzpfms -.Sy FIDO2 -backend, -asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into -.Ar dataset . -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl n" -.It Fl n -Do a no-op/dry run, can be used even if the key is already loaded. -Equivalent to -.Nm zfs Cm load-key Ns 's -.Fl n -option. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the device feature being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion yielding the key is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html deleted file mode 100644 index 872519a..0000000 --- a/zfs-fido2-load-key.8.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - - - - - ZFS-FIDO2-LOAD-KEY(8) - - - - - - - - -
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
-
-
-

-

zfs-fido2-load-key — - load FIDO2-encrypted ZFS dataset key

-
-
-

- - - - - -
zfs-fido2-load-key[-n] dataset
-
-
-

-

After verifying dataset was encrypted with - the tzpfms - - backend, asserts the preserved challenge, HMACking the salt with the - on-device secret, and loads the resulting key into - dataset.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
Do a no-op/dry run, can be used even if the key is already loaded. - Equivalent to zfs - load-key's -n option.
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the device feature being prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion yielding the key is shopped around to every such - device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 11, 2024fzifdso 0.4.0
- - diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index 0abf447..e487f24 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM-LIST 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm-list diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index 31420c6..232e2e9 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -166,7 +166,7 @@ tarta-zoot/vm - available yes - +
December 4, 2022tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index 4f95a59..32fc2c4 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CHANGE-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm1x-change-key diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index 3e46fdc..5f78ac3 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -219,7 +219,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index e6c4ee3..525bf21 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CLEAR-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm1x-clear-key diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index b3eaf67..4e61e61 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -104,7 +104,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index f83cb82..3e7d296 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-LOAD-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm1x-load-key diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index a8292f2..f9d48bd 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -139,7 +139,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index 1a14366..63105a6 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CHANGE-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm2-change-key diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index c3b1a7a..3da2cc0 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -265,7 +265,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index 0291170..0d69791 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CLEAR-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm2-clear-key diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index a83606d..3d8cc7b 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -155,7 +155,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0
diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index 411fc5c..bbfe82d 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -3,7 +3,7 @@ .Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-LOAD-KEY 8 -.Os tzpfms 0.3.4-34-g48bebe9 +.Os tzpfms 0.4.0 . .Sh NAME .Nm zfs-tpm2-load-key diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index 9ff2923..585f94e 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -139,7 +139,7 @@ - +
March 11, 2024tzpfms 0.3.4-34-g48bebe9tzpfms 0.4.0