From 6ebb31a77d1d5f97b3c9317e506c26135160283e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Sun, 10 Mar 2024 02:34:25 +0000 Subject: [PATCH] Manpage update by job 1165380 --- tzpfms.pdf | Bin 81695 -> 65712 bytes tzpfms.ps | 977 +++++++++++------------------------- zfs-fido2-add-backup.8 | 125 ----- zfs-fido2-add-backup.8.html | 153 ------ zfs-fido2-change-key.8 | 188 ------- zfs-fido2-change-key.8.html | 207 -------- zfs-fido2-clear-key.8 | 121 ----- zfs-fido2-clear-key.8.html | 151 ------ zfs-fido2-load-key.8 | 98 ---- zfs-fido2-load-key.8.html | 117 ----- zfs-tpm-list.8 | 2 +- zfs-tpm-list.8.html | 2 +- zfs-tpm1x-change-key.8 | 2 +- zfs-tpm1x-change-key.8.html | 2 +- zfs-tpm1x-clear-key.8 | 2 +- zfs-tpm1x-clear-key.8.html | 2 +- zfs-tpm1x-load-key.8 | 2 +- zfs-tpm1x-load-key.8.html | 2 +- zfs-tpm2-change-key.8 | 2 +- zfs-tpm2-change-key.8.html | 2 +- zfs-tpm2-clear-key.8 | 2 +- zfs-tpm2-clear-key.8.html | 2 +- zfs-tpm2-load-key.8 | 2 +- zfs-tpm2-load-key.8.html | 2 +- 24 files changed, 316 insertions(+), 1849 deletions(-) delete mode 100644 zfs-fido2-add-backup.8 delete mode 100644 zfs-fido2-add-backup.8.html delete mode 100644 zfs-fido2-change-key.8 delete mode 100644 zfs-fido2-change-key.8.html delete mode 100644 zfs-fido2-clear-key.8 delete mode 100644 zfs-fido2-clear-key.8.html delete mode 100644 zfs-fido2-load-key.8 delete mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index 96beb00333fc7f3200f414f5bdb477052e64dfcc..02290565bf5babb7693dcafd8628ae684d292ae8 100644 GIT binary patch delta 45156 zcmZU)V{o8Rx2+r7wr$(C(Q(qTZM?B%Z^_2u9I!1w)BF3`bMzde0SjQD+k zn|(DYS892`LmkVLse_eUAdP;IZTX>uQNM(KS?JBv=w~-iVr58Ee?(43tip4Ot}6^f zL&c=N?bUV!%XdpVn+3t{{jkqvRhTpNuMzo6aZ(e>fr%fQiv->e(VmW2|F7BxfjNdR zlgU`ALhmimKsRlZk}a#RCHP^GEr1_T8Rx&{W+?DUuX-E9Q>`*gZx{`yiJYUUTdbj> z|D{20)u?_P;)(q}aeUdH^Gs}UV?myYvPv5&UBoDLVow0UH2?bj^<-tWTNv+JF@y!|@Z=h|_!HdP2!04}(L4^k7*!W{)Nalyc^dqd^VboC~3+Ir< z#EUh5o``JrA?Uj7uTd`}#=h~~)}#~1sFGl{F^F-@Xy!&XU2V=($V>fraK5?}Qf{kE zM6Q(Ju1c&XHHr0&I>p0y(|@v@yysqAzu5F7KEB!BK?rhFFv8Im`G=-y8>Ho(d}xVa zb-4*Ft&OY`ZeYAhVQ4bQrCQ3EnKbTbuzoa;-B*2_T`qnwvmr^3if$m7_rOAY`7YDn zRudseKf`$uYeI_^1=XYLazE2R>7e$bat7PaY8Mw07A1raczRWUGYzJ%szFL5#Mz;p zX=<}NcGV*yo6WQeAa>2eScKc=Z^7O-uO$FH5?9B|x)ZH}apAl?4F(%UMK7yGkSUO$ zsY}+)J{ag%R)39)fn2B&86$DbrUc6q5Ts9*P)kr$yyj!)@zaz5lMfVdPcV`M(;BuB z1W6St*A1{K_Mm;VFz=@;2fauu3`7LnXu|$D?A;8^`nF&BvNMVI*`ib-yfsoAg8RT{ z z)M_z`&T_jyPJSb{AT*Zo$`l?aWJ}-0>ohG);5Z`q0$P1yWYHvC%hUzv+|VI^CQCi* z%jg%Vr62D1%us~Hr3Biyh9_})-ZCKL#vHa=>J9@xA}Y#=^A(UVSbjyUw(J@KUVsgT zA)A`WJif}oB#%;gZ?bNjLuR1b>}Q6a?{SqpnR>aeW{&-Yr?RCa`p?WDF> z8X4jH2tN}r`za}amea=k&ai)+Ld{tb{^z*WRn(+JZT8aa7z-~t?J>#Vw`Vp5#`RH} zm-9{PV8mK>i1IYN?Dk;q6hI>5$R2ROw*5o-Z^SA_@IW+ng{ioipvSp=_*UHRKr-T!0(R;x2&~M|984 zA2_?baF)MVA+AmRR-3^mo7cIaOH97FmnyB7dO_sQ?O|$#@-%9#>HHH)Pe**r(Oy}X z^L1lKj!idaLuVJF?PE){+JXU)vM>}h>j(6yM+Uy~m9*SsvHh}8PBi8d)he&}j-uxV z-l{05Z_(+#7*UvRjQ}Nd0g>>6a-LnEBAsky4~DVY_8u7z`#G69@k*7q8|cC(pRS8S z!lTE)v&|=e$GMkH|I+bAw_H8r5!t%S_&;0R+%QQ5XK}a%0W=g_(gnY@D2VO0hnK+s z*IUCv_kK*qS-efGIUC4QG^}& zStefPdLCE%M-Zg-bcD;$P}$d~KKGypE&fi|+d7K_<3s7tC*-MH|M#ce+r`miM0F(*ozf~O zAHHyWC3jchlTgiLom6eK@8k1$&g2E{+w0vU^YO#6qF@_7f6Mm2fUGaB9HW_UF7f)E z{=97^N8tET!AVbEOVFL(P~)#(U~I{CzF^y*8}B@j7VM+7#HQv`+^!!(P{B*w5FNaM zhG6|rP^G%TbK~{I!Yg{8JowYn`CBZEr~C8G9RK=8Po1T-^bkP9PuOVQ^GVsm5?P?>VGnujK&MR zezPSuCr81aoW(a@uRamQ@#WhlIBi>7@ilI_1=r&rp^}S;5@F(#?v5jWs2an*vDFP*mS!LCG`xq<0g~AB-0IAa$loO%+4W z{&W6oE~F8XYpt=7Fw^CVxW1IzmqIRF9&HE^1}XK`Y1cgEW-QV?>8 zzIGtWP3nG(U`)>vQ$a*RlmcfTY;0nlSadAV&trFXwvpOW-O+_;(sr!g0OkAIM-%A0 z+b-e}NoAeR$O11PC+k$d3X)U-F*|38$3guGb6N)V8;T@*j8z9Tn1n!0k5Pvq1+Ayj z+N-1!hr*X*H}ay32p+MZkOhHJFh5Q>k61bI!^Q8FlZyeF+yTx3Z-pRXF33`+32IzQ zC)BE8A&gNseV4ahwB0Vd>uT_-=?ZXN4pu-si@MT)kuby$RzBw}n2UqEMi$ZGPSbse zDEtvfW&KWOkS^=nvPwMfy8Mn~_FI_##ohFRj!nDy!>vI6YaCyjTlO7fKOhU!{n_CQ zvqz>&Dq&YbP@n@seA(lg+54X%rt%`+q(-;4a4ZKqhx{Vz{lCl2zYr`&H*mlWlU}}2 zeh_+0cx1Fw-pi;?kKV$fox`o@0_N0v-&wp=N#BgkQmX?Bi2@j?>UM$n_xcwm{(V%-VKdpNyDbK!$mP->q+2X zN5c}$LO8R@!R+z3tR8u@F&mhk+woEygo~B+e?-dhzeURVACXc5x{9uwQfR#w+6tX* zbca}=rcgWM$0WQ<8#!w$ay1%gw5^cI%h&B+p)K7DFg+K%sfm3~&N`LnlzoG@4SW&m zRusHuG4rc?nTdZaZeo|ikY9{8T|PByole7zpO@7fW~V{gUQ>qPKPK^8Qug7O^Ee+; z*>qMD@AUKn9X{@yE{J}-chSw`7gGJ^e^H=U;8#m-z_}I4XV*U7oBS{Fp|dj?nwPsj zXF8|3?^KngRp0k#SD)5;?K@7W$j~fuV#?b(y_|VDwuEr;uetKrpUH4gdrbqTxZUqXcgux;;+tD?UHe%c#Wg%MnT?bb|OG1=Z7 zN!e6~Lgy>{NcDCR4zf!Ug;_fxC>L*4hf>8c}?VgCbug~fg zWPUO!D5>qa0XV-XlxE4n^?&M1|NJ$?0V(VIyTFXo#9C0@`R@dkD@OhxZxDVMm8$?Z z=DE}AM61FP#lB`pcMO!JfxTJy{(({+3#P;H(6}DM55fUTb}*p@x3I{DyL5BN6iv}m<;Bd6jpGHBo#D6<@XV{pCw8p`AJJoF_GtKz?c5a)mt=r%SCgC{ z5T^o1nUo3N?c^d(Cx591u3u86t3{2 z-DtvEtmiR_)?oP|Owa}X2Zip>Hr?jc-M&L9Mq!x*%8y?tZJQ$WharrGSjl59fSdoS zWy)A-FXuhpc9P}_0ta~UuSlv*lB!T_F*&riJ&5`%&r1t6`E|AYAW~&o4=M>qO`R^h zy~LM=vgK)vFHi*AEc-)UY3g7s3E_AXq4tdEGK#{WzGZ!r{e`~zsjws&+xYc#)<@ueSKOC{D-`Z{aPa0A?fmIIZf)mPvfR^iTzHSY9Zx&Sc`IE9Xfygj%04k;ui|ec z-|Wg>{Ab){A=q{e%3KkFHBQt$>cGNI>FdmZ(B0~RnaaL5!C;hH0>9O2gSPX5TqRf` zE%%QAb`EES^`wg=SFye5x&T342y_BzoCi+x&dMZE$+ond2y$Ub3igDhZB_ZznQzXHW1==Pe$cr^ zI048{3tT{0(#EnIfE}K%Zir-F{!jNczx$X{B&Xp|h0Z|7Rv`$;~Se zZv!9avL*gRCB7|+x*e((NtqjHJJH$Fy@{nK7~gB{=`x? zTWtBx@%Q4xL+)%p>R=_1JseQVS&g^;@T(REp|Ibk#4kQAj19u!Z4DK|CbNktJEQJZ^SYiy+{sT@9Cf)CDF8=#CH@kXG z!Dm7>)xhn=^`&(s^1vjt@Jm^sH5;9Tfb6;j0;}g&r_8;38ljY=04&LK ztVser^(ory9a?YAxwE24vH80Q7ozxKWjalqs-%647mo8!kV1)}*x#KG8AGuyMu_RZ z!Y8#qF27V4-;Esxf9qFx%#;@Frld!FI#R|V%06U#P6ni5X(uxJ_Wa;`q2e1l1N z?1WbMoai*u=>mz zeL1-SVqjiZYh3>jhv%ol@b;IaD;(4c|3)?dzBRsRI!6T@!(AT>;7Lc|)lZP~dpPbD zAs!u&fv|Z;qs76WhOyLHiRu+Fqckxsq9N-=* z(VDqt5?C2>wY6r$tK~}?jqX~rQ|u7fzEfnV{8Y6({C}bt5(SDYYhhPX3EK)BH{lPa zo02ixI8N!x;@Pw0uDf$gt`(~eMhpDsKNCeAJxwzR#IQyMD{clZRPCgPRkjX5>3Xv9 zz)Cqy!Shkoi&2&NN8T{nB@>+VW-m;EcK>a2i-fMBaSaqrGyk!_(`!hB)xT`ELPpZU5hQ6$cKVP1(yfUJDAbtrVJZ zIC6xybuEcos~UdnwP+=4ao*YjeC=H&GwU}oPlHpX-3gJ)gdsW?$UCJEe>O@11qH&6 z2`Eg6^9e)2uPdCbIZLeYBKhmDMiEO6TrexCfw!o(MgziW)P*DXD5PLjc!__gy% zDih-Q;RyxuyG366@m4GN8-?W2-h6F2e->jc=4?8Ov0^(e%298&mnJep@k9cr636P? z`Gd8@ny8aXJmA_3<9#Z7+3)~hQK5PALi%`T&bUp1`3jN9?6uDZU%$Y?;8dgWv^q$K zH__k%vAs zSyy=@;m7;+7g?CwC56oVR7>zn1A()%HXohNK0TK=f%!B&9CCF2BN6mZZ1t`y!!`r(-TQU-?_%Gou(UCQ42xe4d zWt(RKp|i)*FUEqm+%GtQ3=hLO`=G3ie)XBjqlmPPSj+!nh^Ns=)jWT_ZOz(Rq9R6H zo?Nta@AJnhLGh9vERi%9G8DKC$MZ2}GnRo3$~Y-;(~;ElU}YI*m;357P8IyQ5C&t0 zXjW0q&UJgunq!8VV$klGZo;~IT#P9HxXS#{I!AE?8bNxeF^LQy!IIy<-grMPaTD>k zmxwVbng2m=`}W-_^3m;~`F0eYucWYL;``O&yvg+_uI1Sh%aH%wY%`fjXn8ob%q&N@ z9cS|roYzW!PEw)Qfw}y|u@Cr#I<~d6pp)aZws)1Yde062)Vq*rWof6*#oO!W?(?+u zVKdCD6d4OA&Myz-Fa&h*0RE5lF^kpJF&P=<+V?vaB#DF z(;<9a=-YL4Uv%Hc+RV3^gRPdc71vBo6$|Z2xFt`e$`>%D@Ws&s3yee_z@ymD5mz35 zAERIVQreIg)4+HVnw2^h?-})I;PdXAia9a;`DC|=edg`wKO0~aN43TJkSr;p-sZ~N zvS-cHr(7i`sDajq$HA8MA6jpbF8L0PS`}hb&mcHL^H z+E7IUt{+h4jOP&vJA4%SDE)J6HDN`g#y(0{cTN?f@;t5l1 zll$>_rML!253II@TK7RumPuCJ-&JsCA~xr6cM+OhUh$qpG*|s- z7Jz;ReeoV;prAUelIq2yH222xPb^mjxi$g)Bx9A{v$v;AxLbRt_v7F6?@yC|^#DJ0 zUrzCIipD;R0g%apW_;|8VwtCyYioFyXO*AB%_DN*wm-5~BD=ttxcY`U&rD+%3){*p zK>VJXrS83c2j>51*9!!Qhg>5u#gP+$gRH_&!vZEABWKA;f&Lh86 zDh{E8=-w4D_DSTzs(kN_KmwmS0V}VR>)E>D9vJW+z9r>XPUN54LYUs2;_m8%Hk52` zMx3T=3<%C+iPg-ts=h{2{ucuDBdL&?iDRzuvnq8-M`(lG5|RXi7eIagO%WwR3QrV2 z#;DK0@qrZ$ct+DUx6>zXm77?6Cx(^Y?cHAU0~-kxq0^hu$hfCEdK({FDMLs zLYP7?G2xo>Bj=^;7sj*@ybv%{O znS2Tp+srH9l?&<{yeOLrNS4GtNpC4ys%$fybT=i_DJNBS*##*RxRj8lYPtp*Hd?dc z8i(!=Urd_wBERcadV-oiknN08P#Cl+TDz@chIJpEflE1F72}MW7}2Ajtc(|7sLQbw z1;B7J@xi5^a3ayPNTEGWtNK^+D!_9EPgdn-`L4mAri0e_>2b~h94~CvOeKkJPBe@o zCOCMfx>UEbG9{jnW>6LP)~j6lN1Bx(B2w>uB9oAxL?k+-3jy;gAY2Xpz1RlAbA5cQ z7OH>Me|&1~5FZ|S%ymaT(!*FVutHC8X^V-|?5}GA+9QQW4e%Qi^d@2%hwUYMz@^9_Q^$I+?Q&>#qfOgrAhL9=k?+(w zYOltE=c7qLluB_bml(4S_Km(R%&`CC(S8ha>yl!Q!Fx!u47m+<2jl!mxlJztFFa9N z;C2Lr17yB{*%yNsX6fgH{A2)JDm+`dC_RH+%ENh~#a(gafdhhBpE*kOR_Vdzyqw*c zn3h0BMKgN)8`2T30r(t)d!3@m&s>;E6uuKT2*lN4wvtHa)>3P6!`5H#r8%P9h*olH zY0+88Zjz$*PO(@@2uIN z!t|jCx)e8hpHbRXtMG0Yoxu!EEKb5I4|{YdrfxAN5rCoTAmR&L-F$jY#T$|I&Wbv_ zk0K(EBcF@hO$pi-nn3oq7G~r>R_$?Sdf%{-{g`L@W(t$YU?m!YdaeCiQD1`13%nDqnTx`J(?T}6cJC~ zjJ;7U245dw33#tX?Kirh62zbFO>0=t1&yu{${7oZWAjGuRYUXK)m4{u(JT|4DxAU5 z#q@5EM^0TZj_<89*}vKGxZczYOD8{t|M&uD+|P_idfNhpX*SJ0$=~;1dMCb2k0MWU z0s;e8dmtBorvFK+2pDSXP-V}*ns8vObm}kwUGwmT%3|F&cA;MH2lx*YJ&3IGzlCn! zxvMA14Qh8}y@K5?9_)Wr)%tFcF!Dl)&I1E?eIpE6?ldWjdcUL z&5xFoUxov7w4_|2p?{(WeTI@u*j><`g92a&QU573PBOrv9cCdK;I#ai~B)nLIt+-;qg&ktb6A3AxvgI85T6K-AI zjmW;nzlz5{T6U5#ZzgETh=^;{!Lb7EU{%h#%j*oH{i2k}_`6zqk;457kD-ukEkWR1 zik4uo5`i&KJVoO`@!%>V#rvEoHvr>X8&)7{-2(Q{eRr}|Hsgw|8LX7{(m4kMas4= zB7kP>EOUM>8RU-E?vBrII13?j!GP5=oTXZmgdt~YsrFFm81t3(nczzk-PP%!dpI~2 zDUfmFcfub*j5>&c`dI&-bBPUMk4=o-@`>pVBn$d98ZtPFJr4Oa&qdI};li0>OS9_U zVCN_730r-3Gz5Hk9M#k_pYfj@UEDY011F>R1>1V_zWBBA?&METZ$rVT#O$k(>=$k( z26w@ZVIN(e!Tv2uSPr2Ec%xfEZ)*Nz=ip&6s6}rfCqJ>8S7@1$1f*v>wN?p(vzi)u zqPisrj-`2mSqQkTKK1hu0|a1L;uS(q&WG;87q00_co1O3k<71xW^*>Is{}s}0gBGu zg-&c~_o0zci4E%nBE-GX2KEmlYcbo!GEk4Lxl%@=2q&5+nipGPluP>R#MZ;K3EW>j zd#zS;{+4lVD`L?hYbD2OO9p7tsfxki3bHuvCpE=*JyqmIph2tdTT;Uy9vO4qEWZ>` znbnra0<&kAEsV%D5kHWwB!}|203NJRkh~r8av|Vfa8mdgY;G$2d;vd-SitD%>S@ND6s2Y)Ug;#+`2Fy@JFm6OB$_0 zrS+N0-a?=?+S_VRW}0MZALHq7z4mf(9Oa4ELD4Ce>CQzkW@>qz%joKGEp!s#n5nGu z#xR-X1bJiBqmfEW%uzeH`oLjNaF6=W%8i>IH-FIZs5sXd8h0oYYo@?0Q3}o?O?=O_ zI8!uKS`M${&x)usSV_WE;L@uRv&^)}kmpGu_?y1_qVLQXTa3MZPtK64XMAEmM=t%n zDvP&-1l?ihLOGV#0mlRjsTTwalceXhEZCyjBl#jafk#s3Ryy?B+sv5P8nt8|!96?) zNn*T@1KV^fN-Is{VPwhdY<|Cz4`nj-{G)c9yY&}jN|Ggh+A6nMy^GHTjUfuz= z#hy*I1Toc5i*VFjNXt8R`RbLd6@*8WC!L=aIz>RJR-RnPogmQ^QVC#Q1(Z%ZyOIoLOmpFY2V4;(@-(2zM&<@v@r0XgQ zVn@t3K(*jui4lsVJv!zowmuWwL6x-YQVa0quf|C&|AUEj-YJ-7R$U_+41H^SOdM}o zqwn-<$ciZ1s~j=^bK_znl|9Y{$4V%*@pf|I$gKTs&0R+uP%;S5SwWvP5E-gV^DhXj z)~GH~ta8^ED9Q-ggT(@`vx>cOW| zYG8r=VYi_c$nb{R#Q4x?r=OCg|M6QZhZff00)0ojlSlMXNu;t=hP{&VNaB&(@xdVV z7Hlg@$w?yGax&%sEz(qiwM31iEAqtsHCM!4)t0WyAi@nnW8)U|ZxP%!OC-0|Duna0|$ zYJd~4c^uwg`Zae(^Tb1kRnB?FBIe9t6~h_t1PJN;vHfJx)LK1ZW}Y!Dd3?6i7OvwH zo8DF!xC;2^m?Fb{n_$bu&D{u^{jP*s(RxIsYCpzwPs=Th(r;q?7oGS-Yo#v(d&P%L_b(H45 z?7EVzMxYAX46$vHfJzOFHGL@zIV@rSp6}BZ20)_L^4Lpv-Hs(JIc!eqKf6TqLisk#@#zWg(o+BS z5P1@~)UB5wd-5Ehx`AN*omsn$n-q~Hsn>mSG19-g^9^bfUD)wI*3I@mHvQj8nw9te z_229~|EvFI=S?ArrUKUEH>I#fdd}(L!a>zVn>FCIPs}&k&^+zheRbs$O9>&C&18#n z$jqCTnm+g(!N29coEMkYvJ)FIE?M+C#yGD*LUZLpX>g>r$?8cFzio)mj;I{CBNv( z+4(yb=NY4p`s4l{*J4lg7M>M3hezEB|4Zq=bspQ1Vm0QE5`f8?^rYEu@+oTqZuoQV zH}rYpiUb{riqBn1Crb9`$e+wE9BolP2)>}U@wjWn!d(#T{)d-*4g~IkVyrR#hj#;) z9RfGZPb>$3^HR3JDzU|CDwiJah=~Y}3oSdmP_2#jRog>JP6nC#&7t$|7D-F$E|t{` za2L@_@kf*g(t7oFwvHkByhELB`KwriMpZuS8n2+jQQ0`NePv^Ed`t(4X&!_D$;m98 zF`(1Wx3%L(tp35^8a?-{jk$Jfe5m2c=(JUT!~qXLV$bwVqr|2*Iiib`GT zUi5FF?o7Wh*K{Uas3(&--^fUxk$KxNe|ymvlr*{$@Xw8oV zhJB*r0Lz;JGQ!8j9v>p4{ilwQhR)Ug(ji^6je2W>ETEJ>2@)BbgcBvB=v^-7_M1wRjZd758B3_=kE zStq~5Usb+Bur-Ms0Sff^3ToCNQJTUB0KasX+|JV}mC1N0L~1JQoh{KYF+#?5QytV68$3o)sR zGaqeF-~`XP8|oHKs3W>T*b;c>6Hi%0L$I1d^oFpon)%@W=ICEbZm-=b=rC9zIugLW`qR}z)cg6%0 znk+Rb3ew0UqZ9ox<#r9!@Zo5sRYy0XAwg^5=DkOLud%NVh)EUde*T1HE$am`-h$^0 zN#Mh}y2=F47CKBV1|lh;PPrK#x)l&}7;ttIHtZ}9Q+(!NyZH-YrT>20M4apCy|Q%h zJm?Btirr5ZFx5TMDFyw|(<+A2-&k(Xa6HbCe@KyqaS{PuUmr(an^*5gD%A7~cGsQ{ zX7-Ni|HII9J_6kPe(3l12pIuW0Kg0QbM_N~uH57h{qvi&pN&_crB`nuI*MOAIky`i z<3vjnIN}G*t!YN?iJAEABv-pDt@^9tZ}pa87Nt(ncePf7o1PxlE-G}FRkLR!UiWgq zx37aLN&p4YM#WoWoQ=ilXr@|f7{ogwkwCK+I)T-HmZhK|PLh6Hs7M2ZP|G8Y*iBkF z=TOjL2$FHv?5u1%3C=P)IbG}aT2p^cDG4XQt9j26-^g(vS5Vv}BS7>(QE(IM8i9p3 z2LhSNR2$I|u@fPA%4D+j+?K!^kR(Pm`~Y~FQ%VwtSR$hUQ{PP7%-u<1f)V{=Umq5fFYk@;mbq!1WVb}x*SuUnEsm;xO*lJx}H}XKqg|leM zpe6g9nbmT}ryp_>@u`4oze1Xpo#jmAEi-<1t!=Sdu4{Kdiv}>@m4q#948TK-DD2O< zwFonS&;VPTm<(^hGXeo}+vnQEm-Y~9!ygEc37kocQ2-e3;c2a_jxih+1duNF0{@W@ zUL4xmKC6gmF*`~dj)Dp6J`<8m6~7KLOug`MhUqnq1yD~%OPS%hd)*ia!Z z2yZ&)tiamte`1?z2r`<>$*qjIxIIYg?dm>^(1ku%Sr7?n9+d}Dw~5S z5RFSRL@*G9feH1@Cp7s=D}hmtco&9 z?FObkZUexH{dU4^&;}p;nQ8jT^n1VUZ~T$?h>0A^SO=4+6kZz#(rGfN-iW|!Prvr$JGB0W9CK}9ZWqPcv-ttXZyLuTkyb8+bgM?_PGq<8V zIIiFiH%&X_S2w!bp#Oan@oh zTqS_Cs7?KNd>x1-0i65V6}B65Bmb!&{U!b^GkU92kV$*kC|w~V5< zS0STxuXWxxZYSSw1>G^SBtQXlpYhM4Z6v^do^$p6{0jOiJnI+_ytvgbw(NkBfyb4I zEKY(XP4mh&c}6g6F(Fv_L|#<+tO{fP@fvn|(*!^MEc=#MJ(~M^R8Ak8ML3YHMlB)* zFg6Y9h$$7AE6m`!=2W7~uJviU+X>Sc_r|0;kP2u`?r_Pf%`3wo=2KRWR$-zam;v5N zT1U8&!Mw82XD33AY0li@IjKs6PdBdWN&hq%M%fmY*p8DLN~Y3mPW>)$X2+pkTH+^`CR4|BUki3He#|pcc+^L>~vwF^lvD(>u;{|M`cc1;4_^=xm_)s26dq<5gnu zO*3r&WJpm^sGQYz*$f2x1iN8-(dlNU7@4iCJk8IdPGy>=s=+p5o#nbhr zgI&E~#^qYtzRVngX_SV{L{sjBwPR&Z^p0~kC>ROp^jc*uSL;!Ttwh88X+eFz!>#mx zaMSRM;|tKp8#Dg6o?xl*DHr~Yg@3m^vW`6q|FQSey$oAjjYTbzVn0~lZf1c4D3%pt zda@ksC+>$~&i9}EUH|=bJ8ncA_U-ksH5u5Sn}i)vmyxqRf^5k!Lk2Y|x_!s+(pEER zyB<)MFM-?nBbQP@t^#E!_*%~o;{Y6v`7ZMunl|n(v{G@>N4sv^Uhm+-gn%{mcEpvH zfWiznfu{nMs&nIHT)bTw4i3%%;P4AY?(&%0a$4PY|#m2IzEb-N~$N{d6axghrM~H#hQVqOOlnSD{Qn)HHJ8YbP{an7~VTIyg>ZHT2_uO>StUZ#IKY4AqUH&Eb zWQC6>oqIH8cYoPtKk?|ksP#GhN1a_h0`j?+d%A75FF;7J8S|`wCn}jDetPkB>yBi9 z&ulT1t-de1cr2gOOhdvOI2L=jw*U5HOfChWH0T_oPYcW^ zZX7wHI_IwsJ8)ATWt`|m(f=raUG(YJ%QmNR zR=&lL`OFiw`9sbva49O&eX=hFyWo1`FA5~U(Ft`pXO_wiM-NMJJ5**g{QV<|K`uqF zlM(354ilScLFPrixn3R9pK!>^Bf|x`D@i|Tm|R9Fzy4^?E|!%ml|_#PefA+H%|oOx zyCq1%e^Fw$mZ5A24BRWhM=mDjgf6zaLHay$o7W@2u>L9L!7aHzsJeRNr5!J>wCz;U z)gW9?m6v_{WBieO=~y)~owOHC!zr|O>9;97K7qMdfRSmQo*mqSrqp@l=*JN0o(~?mjbcEDS$Y=|o zvPyAzzWu7$`Bmjr1QGR)t5KgB%|OE+TY04a>Iy$PR8iIl(wsA_J&KpZp%B<|@j}1?Aoke$xvVKyXb*-h%F}e4)QO|i=)zLzwNC$m$oTU!8iBQ$**ee*PJTmB zWQE`!9>fGRo_abul{3kHvn50d?u-^^DlOvIA~g{|;m?ScyHSHM2B>D!5?T|@=O+IW zji3R}x)k>cyW~HK3(hunMeIhDlL0)dL{&z}GF%jjz-ox{q(|j)s4yrc*IOyw#5XL1 z+KiAos;nu#nZhZFZ?#Jk5sf^lng9&CR{iJLUr3g@C0G?zl$Ik8z2#LRT!^lzg{9;{ zyB`Q{4cV6vp@}CJ26F}p_Y@~z78%A=>*=4NSiz$hWofo!miBN2qPyealYd-)ro;tg7k`@TUx!8uUuo}8xu#KsSy3|g7StO7Q$ zk#+#Sp$2-=_7u8d4D#^~?q1q^i3b){i*k14Bx4X#z>xF8o!wMCZ`-sq5PQ59gR}ZET0OgTII%g@UBOgeMLaRm-THUZ-Q8#i2;~K- zxKx$Ghcr@p25+W7GC+I@>0O{v1`_b3LxZr+G$3tjDv_An#jetBKkyUm=EY)LyK@GF zU%=hb%C0*-_7irb49*wH(PzDiz6b08^){K^5eDv%9Bsq@l>P{DQN>u{cUx%`BJ4%p zC{TAl>PYK##Tc~u#rmGP19dGvf_9r%Q^5+8S)a3+JQUx3hSwO@_falKuFPUY)7(SK z=A0Nh9|+Sx7};jJ!d@`zTAmb}uM4qOj-=|4r7b2PmVUeyoy~jMahQC&5)-)qPUVtz z^!8h+lju!$XX+MZI&N-1Pcd`?2(YD#LE;Y9!X>bf zTXCzkYdiiTB&yv8L$9hV>B5$_4><*iIcpeFX^d#5|F|_qj;TXZnda}T#G1yd;?V^; z5FpTKkO*Nnupo7Z@hJWeRc=oM;9=%d1i`|<@HYRY5Harg1$n<(M##R7h9IG08K9-!1XGItE;3@x4zzrPU@0#Gzjbp-9uWKul(g}C+*67}(a z1%9oNP4yIH23v-}7a=FGFRBp|;#Nq=Eg}=@6tw7gdnaRw%>D@xVyk_`VB=y|kn3~o zsR8|LUPJQR%X4oAXd2u6D|6WUA&NX1eh|rqpp2YZ^WlLKYW=W(W8QSRVU^C8;^2zT zyRI$tWTpSv`eVKWsoMpEKUFqu!r~$6Vm+RQZ0~eE0B>C73|@P$C2v>%O;O1DXYqa1 z50)~S*iNPpOo+sy;&AW9L~ngWi)a%df6Ny6K~AtTbL{UT_&gQ;K)^DHh*CD84PP9J@WAiHWK z_aDjEW$U#W0FQ_|x#h0zRb5?BS=P)}I30_)gRW+@c5KBuY6RttEi)7CVQ3+>#V86H z!(;g9R04W0*a3yS!b>dygNVP|8J=y>xf)i7YBR2a?(YA`)>**Tu{4R=%*+@wGutsU zGdpHxW;$l(V`gUNnAwh*V~m-ZIexx(|6Q$CPdd_QW@@UZr&~u=-St&vr^HdJPzG?q z?YRdOIl~G-vJZF$+WR5Su@`|!%8J(q6EnLg9WX4M5W~<77R&^8v;u_m66-`NNWIq% z4jH2go+-_&k-UOh0Guqu)VoLk)}|($I!uIBFWlpPdQA^RZTi=j(yeb_5k#X-_w?>ms3VqbFD0Hx+iij>V!D*RSeP=F^ zp}iWIc%^-uH}XW&_FzVa4W41*(Sg&)YhqtXge=86v~7PZ;Mn1CR8gjU-qC>CapoGf z9l zb?2Zo*+|8%*XHyMF03d%WdBANd<*3Mn~LC&e#Nm{uyIgyIKzvM5)hLaos4cEXsYjH z)tT^eEE6casA}LKHEiu9dR>SNk2J^78lioS)wxLrTR}q7o%)?XlvZV_Mtfr-v~?ab z&IU@Prln0Y3ZNYaIiG(W$t&Kq>jb>;ZSQMu+$wQJ8^2+ektVIIV}s)~N4_&3S4zPN zMy*O|5kX>~){jAMtY^8b)R)-TUCJOQl6HSxv7zm=94q+-$F&kSX7z3w5cT*vrH2Gx z44K*>1YTGLqmLVL?x}L=M1p$YuE6oSVR4IyDtits3>cJDP9M|~d1xO@Hmv(GNh*ne zk*)wO$q4a6L+s>N*bStwE@hL-8FpUkr<=B{j$5K z^1kM08mLmaN*1UPM)(qx2v7>aD^FNpbx!IlF-8;+AHCSV)9z;i$*n!Hdlu{Yeyi=x z^j&!}7{GJwoDeBKtF+CtCu<{nRQi;2*$_;jdhx(0)JL>#&MwQFXWwFsdT~0rQ+BYi z)9I&8?~U{|{1`A2lmk@K-((Xclx^Wk7phlnc7D6yIk}di=nqYMBD%IJ0&mQ0xWvHp zZK4GEC7r~F*TCQVC5}-==FqpeL~Tp_RmFf0U4UCeENGynNk3Q&UET7$ytHVT0krZ2 z%Ay7DbYeC z6c4tb(7)bIHnM;|xpXd;d-TsiIH?EUV4Z>l4nIQ5Ji6zXDEOA zkN+C-iQjJ>yop%zFIy+yA|hnW&~^3G5&?M9gJ!nzPO^CsRlA6Uc3zypa~BAsVm@Xa z#n11IN&dQeQbzkGOGt;cbyx(^i)Ci=5VvuW0aKYo1u?gZ$eO}AD&os#GiqQR8Y3DZ#Lvh*EmJY=%KuCSGO3J5N#8Yn>#RNEjCG5Fq!zK=&}Hpm=0iXn zGXo25n+pm-L68fnCOlXa-2~|G{RE>Z{j>!li{e4B@o;hh=|zPBCE9i_U!HpITcttZ zFE>gx$q<-p{yYVzBMQIzquNY zil&^5wbRon*Rm-AYcqAfU(FwKPc0m`@y@kxbbb3d*Fw-21}Seo%!OZa0j$r^VEFvOW5`(jani#D!aC5fuk&-hZ|_kF zlwdh3L6Li;o32BkdDy<8_J+}UbD?lM8Kp~}Hzpfi!u7uaKQ##@9$|+|_qY_S^E6qR z^D;%xLOAKng>6EJ3VR(FLdL#zH=nmM{`TN|R;p>mfkb8P-><>vPS4>Ew9&$SgCis9?AN*K zk6M<${ncza$?vMxku}^_gYf!R=HvQ%0|yn$7WqeP9w3=9JNBu_XOT`jnz3Ev4JR~_Qm1m8mJ(703f+1B*iQ(i1ZH;ZEl2?$xx$O08Ki7H1y%wJKRU0N z`oW7mLF((@-vgwn;fPzx+AV$=>PQxpdeTkFfWS{=-#m(C5$!?k+zZa_pUdVqi>$u3 zKBXEtA#G?T$AKONpyDAe>e-#HbI$o$z5U*?7uNd|u11_*=? zI?7>Zx&HuFr<9qyr*3^WV$ip7WKcCW+A6DcCz3>HAm&4m`L0ml29YS&OF!m8Fqmq| z1ITiy3w-@%kk`eYd@*$JO)IG>Xu$+i6jlv)ALFn22}Wj=k&>(rx4B!S0EL_>zLd(M zgl-Bj+8OansoTqHHe2}>Ane! ztRvnRU#DiahVJFxXSsly8T}D=Z%W&r2*^*rW$KY`@$-Y25x?j~8F^Ee5zlBAe?`Pi zDO%UvtTg-%;fO#Rm(3nrXtfq(NR*!#CcIzBy%&;ciYUm{p!5e#=P_x6L$s3-YfO^~ zWm_;8AjRe22G(MdpqynBG41yX`IHva5E`wl1W6!k;-o}P}jsnS-l1MiX}bhf>&^>k-(e=SAq{XW}jm>f#F!qGHhvO^DB~3h2&6lY8^94NfiX30fC@ z#NdX22#lGa&ynsX1=~&lH3(j>2APdnf`-Iv%DJ@WE$QbF*zGw(xCINnvogRA@@|Kn ze@wHn%TSQdQ)LO9R*`C(0{CZxNN2>+WAZsNsTdhrYcse;akoRFazRBwf?;L4|33U} z)8XgwV(!`5YTXgtEJ>Y!U*xt6FTLK4LpcPlY?L5DY>AzQJ(0+G`^xIgxnWDU$XHif znmj?izB{1j9@=WP4&oR5D1WSU;%twbG4HQ?-_kO-^M1PfZk!D10$@htyU23)zj?h) zTzuQJ)Mqe&o3hAiecYMav+StYj;7?)jIOZz6_U*m3hTpNo}ocCc~eye`>3NDoO%WO zK!bm|ci!K;{rQ0q*I?XlF+T_w4zpV%S*|oEOM8OoqXx&#n3wd7_4;Q}>Kv3ot96`& zzG6J-6f=EE*x^pd36K#RN^b#Cc#Ad;3-3CeQ;a6VQPNwS9kxU&T^p_U+qQ&0e*l78 zNu)(@3E0T2w_ZBF7#M5#3v|DHAsmT|E+tQf-DWEevtH(wo0S&q?#KE-p*=1$qEC0h z&_hJAV(tu%IdX*hpU`9y`4W^gb{CoT)e+LzKEt!t52J4lZvd|pqUa)$Ba2f+_$B3i z=CkiL&?m=QdwugxJsUl8N|L@iAnUK4(B#@UDg6Zk ze}p%PFU|Su*RxhdD?t=-VURnOXmI+Y|2?G~^{ct+^L>0U@nUhwS)70N_aApdL3&>@ z(La*L5<4Imuu-sIMjBnDOE^gNG?=|~lM3!h0+Nm0=a;({G8tM%&;@uQk^%b-tQ@~x zm`}-yq5-b^iIE?xy(Eq?vtNoQwd+zXj-ov*@7$ekK00vAB_c3*t(p||F;Hv(5^DTv zg|PLm-$4kMypRgvFHS`)n<5bZEcnhIUAO?tejq3ccuBdZQXj}V|ZBVEdi9XQvhC{EsuIix3D`DoqLEfCgMCj zxq^GcA8+(giwlOGKta|v{uk??Ns1-J)N3BO8Ve$$l1#&z(5hR?VS-)S@!InP-#-6D zZM42OQ4gB2v_K|4;|ZwU0gC(W-epn#rm`==(;f{adFp?pUd0`>?^t#}benz37{bx^ za{|&K5PT@zbLMO~IoAHn`b>wJTc*=uAjJ!3fcj1f$HETYI~9oY17}lo(2^l668o!E z(ohasWraJryuKtiRUvkKX_SuFsjCTx~NsX2OqY2O9hN?7lxZ2|3B$cGDR zST%hhTAO2Et6|blp~_1V@ygwUDlEY4Zp?$a%0Zo6t`+}ONfn#k%Kq|n5{^I(g@s3L zP1L#SKk3$G9`o;b_$Ns|a?bxp;C$-_gax ztsq3*#_{*4ckA}MzU@zu2IB{|7GBv=MSum%yZzOQ(KGOwvX935j$HT$LD)}QHOKRv z@b^+VbN7baUqrxPWIk)03Sf*19t0~lCkL=n1w7bh+_TtE)6x-$P?L@In!;@DeT2(vp!}4VU*NsmOH&`$AjO~m;@kIke zaS8pr;NUbSG(C~J5m9Y+wOdj?`{qqm=nl7yycIIt z|D9qtWH(NFJNI{W!+aNiEFSohG8Y!p#4UG}BZjhIbE9#rXNSbNyqe!6*BjcefFeM5 zd3&?Pef)t(H%>4Qie%O^w^}%Zf2N)u6C-wTga{l|e>1SX`c%DIAG2Nl-TLSu=#ZOm z=dl@kVfgOl;NkYxx>OSidAhTKku!yQ_9MbGm3nuIMxm_*f2v<#*dG{rxypL}LEc#t zEBPmuCorAsM{;58&joqE4q62-ie-{EMJ^?T)g2IoLw}w(P`%Ekia_)w)$6Od0lvW zxEGe;2!YE0zXK_n5t>B74?!t0odR1n2ssGc0%f0sLr@T8oeR$n%u+ZKJ8l3g?hAia z+f7WGT#t1lSRMIll%`Xve-`$tKpj*WTDk9GNZ#6%ISMhJCt|9RC@!wPUzRAvL1)m} zkVn3F`6o^>J~!_A2(3H0>BqHd3}+|`?c?OAaxi%rtS`-1*z4&+2)^O`t&A)>A>*|Z z3LaARNj?hMsnIBGx*L&2I4gjsKor(T6BiBd=ioRA5_{M-JYR8bcu`M0LXpUMQ|!Cj2sY81JzCA2`MShFMu_sq5(RhUvh&Cc-aP56Rj_HE}gcF${iM3L04i=Jb< z1OJWO>tCLgnPDiZMl>@}|B;Jn9~2MAkmiJQpWi%d=bv?)R@))#T?Byf@AC{~!FV;s z%3xZJA0UC8!Pzo`2-bpml$apv$Q{LuVg2N2QS#t+Zzgr@ojG$Cg&Jp&c;98| zZ#uCKDkEI9vpuEW1PG4Y5i+O!yRxg2h`Ft`Vhp#QmOwR|+7?#PKFV?6K{f|=js3lD z&Zk^is%>ZS5|23gno|LS2ED$Wo*sS;TDrZt2K1#@`ifh+ibvpRcIAEjac3u_-tJ%q zoJpCYY0S|?N!Bqs{?w>U5cBuo_EpqEGYk+0MPEVwQEJMX*CgTo*@TtvN);4Nw4bze zTC`5Ibcvxtjza+_&UXRzr$+{dSWcqnVm*l|+VxVst8J3Fh!hO~5RovoC?*I3nuB*16~G$CAM2JHP0J z8-U*;nr?Yu4l@FJe>SAX7b{XBu4T(yDv&GH!R*3vRIQ|xU1yc#D+l;h*yKF+^&Gc} zm0QvwLD>$e!}944hn6cuq^&_zA~1(fTy!2rjpQKHC2G3OsY5Oj91|y74^Y)Q5DF)j z%=aT^SF}R0KJrg}SJGJ&`>y6BVAOoh>ahQ$c8-X`4B`hM&l8K$`HDZG*IW_g;x87a zQD?RidJRF?wtSs%BeC6dFgqy54Ul-NSj5;3pf~|!pNjX92hAUpZDPlp zG@ndEDW_HcC!VZ^3Qy;bpXajqa6vI$5R#1KVqUE1LbV5*dLb`T?7Rg_^>e6tSnFN8yLC+T@Z1Rqtz;E|u+CfkA!5`0*a*wrf@Bsyur_5vf3=QH zx%7ekd;*hsv7c{)I#b5g7Jg%v#p?qE9lc{I6ZuglLFX9VaZ<|J%RGPjo%mNFA!}hO zeD@)_NN~YgMczi-NF&#%Zq4<4BT%^hy#X>9UF1DjSB6@Jl%W zE%@e_Rk}!tgu;`wu`Ft6;-%rN|A70*k}H}htpqU;Lle|z2}Q1x=Mg4Z!gTy1nO}pT z@?TGekWR1}ywS8z!#@pEiCq*_Byc1-pi*_67LkKccHNEy`iTC+&W9S~fm-{h#pIa% zD_2Y{>M?yNXO`PXNYdiYn94Bt6MzUZ(UD>P*!_+hjB$IVpXv}j1br^8cq z!OmQ(4s0tA$Iwcb`Ssv=52%H?>$uUCr?%;(IAj#7jf@#ai(qQzU!PNaf7|Vr56%ykzyTFcUJm+l zc{Ec;EHke=OQH_CTLpmnVP}7qTV2A0Bh{AS?Wo9~D;#0l*zxG+u@tT)+{)#PW%ljJ zMUuhp&VRSaxT`U-zX26$#?U|&Uot~3(;g4ih7&Byct?4;eg-(4i&7*AYmRQ zksA4>#72w|inskC8u&4;vM0n^O+4OM%hn!TT0`{x0t>aT?881)gm%Ag3KCtzl8DJO z1!^4FTj=;7eTl%=Wx? z)DB~K%PWztICc4S=#!{<+FELBfQvaUKK4 z)J?#)Yv$?JUBp+oBplRs7}Q_d!36u&P)R17bd}p08}!YhXeu2-<761ZW9|BO=c9dzkt{WLZ*X|Yq_p8#Bnrn9=Vyk zhTXq*tx!66*;}1+S&DUa_mG*%RsH?2?LKF^^(jJo3}Yw=6Ac5;dkB=u zDdlqQ0k{U3A2aVo(Z_$A%=gtoHnBE&MX@}aPMuA`LtBJ6O8Qfyf{$X-GVgKw{ZLU% z?00Fc6jcItFCkocZ;lJ|AmcT#`@y&8Fb-$65024%8NLDSjaLZBD`7}U_=^c!1Y0$_ z+^=k+sdwOOs#T!WKmDJ0IAEL(JOmpv8z(SF=b!cU9}Zvm%1F=r-rd*W&h@ zS30rc-*mvj#gORPuQym_#l#n?&BC;aU+0`j$f;G4U!H)NaxyakmF3SI?q1&}$26|A zMS!0Rzg|yP2*%qaP&RFqJc1<}N9P;m^b6h7+slkY&hrHZL!3Nat24(9O&ouzCU08T zzKybAngcb`ENc$)N+5Zp_N?x>X0ER=nB3lFHpr-93SW4dkA8ll@-2>Fv3Xh`&27n< z5v@n|Cgq6o?T1I9nZ%-x6W8mXQE4=9PC$Hb zS{V^qR;Iy}#bj4N7wb&Z9H;&%M-F@l%cLdu_0E#-&BMj;)a~x;>3#Mec;wN7y1<{- z;<4Y<_0d4G6m9!XecdJ}9>&PA4C5QADW%i3qa{5{P)q&Pb1!_>)pe)5Zm)!f+ifA3@D}ZdU<&*ZVA__%m|4z-QE&Wb zV0s`i4~{FRBQbGXltJ?w}E@ za)D%Z33qm^RYKHM>UfPc(L3B#Lg204l&;!Ya~~r7y5+MKi=5ZF#&UcR`kWZNWO{MX797)lDEI!}b$Fjulv8x_yp)7yr7M;};;;-v{dC`kIMgpYV0I-*fr zkH?MXhUFv@j@bAV<@q3zQO~0I}W5SLZU$L z>&>pl9A3ZlsF7HpYzM&G&yA;7r;tcpB;fRIaK_;)F0&_tNg{L?>YD~Ezw2i&Sy?X^F!jP)QG5o6=+c+q@X>u7b@vBTDJ4`KHEk%m1G5ndJ%t>4(uCNI6?|~ium}CcYIG)}MX*>g zIJ_rc#(XVfQ42WTn%=syW9QD?sF5RC8&~tU7L-3@nBl)e9K!{S1!T&-zMpIe>y(O( z6X5a0dr>BApBw^;!S^Y~^m9+HZG?IP&%=9E#wL2VDtcHI@)YnYHE4h0E1$b=S-AuV z!9!>cIH)TK(|dn=$k}UM<2qI)QESHh0#0sQg_VZ97<7(nVmSk8!OwS`-wJ*fx*Unp zy4Mukw?avzZB}8Z8uG?J7r1~hXvsipI+k8CZ>JjZQ8NIn$!bncBj%h}Hi5NNSxV!S zI*JEbA<7orTR{hKZ%i?UC(1IIa^DjK$jG=QDBZYP9Qy+qzC46v%zr!tSImDs1pQNS zA&P*SLe^q4U(k0J^Mabu%t2fo#1kG|?p>ii;=d^N5m~isPKnC-I3TVT0v|yyF3c*H zUPdJV|6grjxW7o?NK8zH!Nw8ooR#msZz8ZmK(c$tym@YA$@5}ivNnkZy-XS&FB=K| z;WJUh_dW78yWSC>dY8ptzd`s%fNF6?Q!PIH8a6oHCTzm2?l%& zu5XQOsRDI}`Mvn>dM&986k9SDcf2a-r`C@EqI*J?h>Nw~ylvYM3WQ$mw<4N@3Ku}x zgA&@P)E`1N?GY-4y|=35el=11{k&3*39#S2y2Q2l)qqe z_7kFLU|@&U`}CoL4wy$l5s26u4&1AAX_3@}ghu2cSydWJoP|;mR>rTYIyi1^xDCN$ zA;CfC=@83Rf&e1(-sy*IU(`wSpWjgc-^G$)A(9aG`Yn(#xWqMaQOJ$9(^wo1UKC&U zs7`^$#bTV`$JkDqXpt*5ey6-PkxY$&jM!7Id^T167&ykn@dk%vD`0H(U1tu5(F?zMQNWneE_L!ft5ESO zmHgA?HQujKPDup#gd{Pz!St7Doo$t7wmV@q8>486#i@$E#|FiqZ`VTk zvk$Xa-rbCOihzn#pMO)>NW-WW4!G6S+A(KRvhpLOYPyu+@+4r2sr{`ufbAK{s1I zY3p+UUfy_*c>hQVKdSKY1vEQ?xb5vevuW_@YiLuR{*%C_y{yBrjf#Y^ zwnrSmw6u=0K;Df1d3~{aFQs|wf#y!xA7j?9V}@yeTG4fuzz^@Rwz?(bpVzy0B6+M@ z=>XZ|f+8-!Hej^ance@|-v}80B(^kkSV4n>mw2Zp;IKV)+ZSjLzIEJhs3k1PdWSIY zGdhR($I9lJZR}6IrLD5r>hJ;rNqUeYTFkxi(odcg#fJ2&#ygDVIO9R5PAFjZ5gzp< zHr-HeV|d+Gle+179z z{|%9Ut-Esr*9%-gxq*s>WS~62{Q@g|R@N^hMFmbk0FFu2!QR!(-qnTp-!cFya6tPi zEZ}8<0Tt^%#QFb~`6q+Szt_GR{I`z4zxt@y{y+Nu&HeVjW!c#NX`71epBe=JM=#s| z)yu~9k1UX&1QV3IiM2!#45(a5MfeX$qXNgu_FsqpI%E5>D5;u1Qk|J zI95(zUbQe78|y!h0LNJoW0}tq5KL#ZtuPUjn4wP#+1hO|;f-(d18f$-y!;6(%iuKZgv0{8xO01 zz<;V&cxLB#T4||jc0R_D_+06u;_I0grBRE>rx)=YX8|bU5>A=;A9Pp`w(^Uc7cRnpSada}Rx^9=w1%shT_2@0e5aE-j! zM?I})Z(k)HXEsxK*^IX?URd$YBVS^Kwwn>GQ3!PLx+5g8xh5z#$_XNGZbv0T>x|eOq79O~hUMH5nj|+z1q-6oC!s{MiPSP?ZHP-3>5{M| zE=6025E@9FMR|jzB8~9OfuU?4ay5qPC*^b0x*07P@&jnRLzKbxqhHqRtzr{Og{y@- z@chj-+0QbCZ;44#?Va~;j{JLvnWp(oKDle$tL1oUPMQ%2Mb*o)%KUPgY^SQD?{mPh zWMd%zko`E_>^zDaccT!e@V%_y_nrUcC)pCRnq z&1VDN-V4C_rSFRNiSGUer_1f6D4QJ{uX%3f0Xv=bGLr*6fNUq02*N)|$TFQ356X7- z3FfXemZM{49Fdheiu96%-z6tap>WWoG3QuM+dLqQDd?{TEpc~o#gLMQ5-mYMonw9| zA8Rjpe>zODZvy%BYFUZ+tXQmBKPh9eAz869nFRn22yKh-L~wRzbj&(gn~g+9Uz|tM zgyA}0pYz?Rx}z9zmdeJY6<(RTWR+y%ex``xx<2%lDIv{Lah^H&Rp9x3*3@%!(~kHjyd`pY*NA!w=|2FgSkB_yqtjeJT5!PE4B^G(rae^p$nP#(Vvec@iyOx3dwXPydzqOE|P zjw=<5`sJr>UxwJC5=+xm&c@81P_wPZfh9@H-W}_7G;be&YxElh4v{^l+(B_-WwV_2_c186 z;NrfoH8~6zjbL?_&MsY#P)0CIuvjD^flNqn;-j*_(KHC$lq}uW;aV_Xu5Ex7@9c#e z>){U&Ld*6K+~S>Vc#Cno0Ps zjieVGc#H+vV#+xjQAKP!Ra?T)+|UYcABTQ3+opAfJ18adK4s#jUXd>u$=aF`ii&Oc zn1KTgFmUHUx()T_1(x;%s~rGm-W5T+hcmyo`1XD@<+H;I!SUQGefogV>=fULIZK`} zw*C3}7=+mVe0hYaZu%BaY6BiEVa?GZ5L3{DQ+QlxP|Vr(ZRLsp)+M7dl##$Ey(68e zQ>!f8p=-|1)YnL93%-i_*+E!kCbn>*lo=3I3H2<&( znes&zJRAXnIzUkrw6(Z`y|fBff%CINIFfKw)1;)-mfGZ#hbH@xr_?OYT9U|-x=p>j z#0G@1u`uFgHT%-&NgnpM@tDMt-qv=I%l59ug_ygfy0TGHEda#j0~H&NYZ@EAAvD34 zik5_Kl+MsE=oTB%E_vUpnG|T(P-AJ4Q=F;@{nnwyTc5X0gx*u-dV~EGu6W3;*io55 zkPBz6cBBZXWwU^SPYj%YE?2X6miwvrH;;^BP>%5rD}@1FYVF96T(%yw-~wgILG90p zR6UxDaJUz5j%h#{Ctb@QVupo3B}N3L{O=@D() z^7f3r!DLiRJg0n^N}!?o`U%D|G*VFaI>>obxi#TE2q;JrZpE79!8rbou3cBD5toS= z!jw9?GI-Iq56@x>J;V88swQQvl?4L7Iq!Cs`q#^n)*k_`aHviUJt8Xbc+ZkLcuxcj0lG?Kl!5=1I@F~xs?%ns8MZM>6`id~6;x1e-ccRK$G=p6@ele( z{ldtr2}CZD(T}o0EV`csN*aaTqJt=&-(I$H%q9c@t)u0`GTj758#J4ng@q(!Sii7P zIf`jjjydNoiN41#U2nz2NP7EX`8*=B#&IrN3_4CQmrm2vX5Rm%lV96oe@A7&RMotd z!RU*ZV1*m1DpBzgv5uj~nhh^nkB8eKyRS|D9><}LEmQ<%eF3}GsmFhSh#1r(FilHq z;4;1p(Dve-xg834@{kepd+|8k(k zS0CQ9BrFUvwTe_psZgL%ay3n*0{c$FL9w%)xFRg2+XG$(i;G4yXzQ4DG0zcZ%Cxqufpzn_TV26>rkqHcw+2@x#o6Ui^sZT7JO3#O6vkOTM zwLQV!(QKCdwSOK@?A61|jv}jv=**Y(D%G_`P*FAR_D!VI=?{jc+58~o9n)A01^ldL zOg-W1-fnysmvGgpaD!|#zTn5ZEI6(52iRC{QvDEOC6a1XbJF2R2zHX>v@G#;oi7}o zNyNbOoCWXL>d?3EQ15Fap$@be0=J4h zJR`)aOhhrp%lUdBrW=%;Zi7@zjI6X%u2Fq2c-eUkN;JVKS`)`NsHZ%`T3PG#&HTP2 zEcBWWLKYFZEWM&wiMR`42{MKQr7=$t`XG+=T^@yZw0JPt2p({5CAJ}+0i4+#e^)m) zeaPPDA>RnR<2-V$s#PPtb|_eue)OB;HGsR)EG1Uc$ z?ELp9=mXn`tZJd+?!Srw@j>OUc%6%sfBufrL~#z`n^Z@0q|QG6bZJHMva?w@0Z``7M+1izkj_b$D5;P_0i%Z%eJ;9XWXUu_)2*~z<*6ls>O zTQFR;VDOg@@^miD2G!6{`Zlxme&^=kmTEv4&~kAUDNRnyzm^db|4;E;+agXHs?)4D z>MHcOvp4ujgWe}ri*~YJHM2dY9HP~8OY?5xTwLs~D$Z}X3I(h?P~BlfEda4S)inro z<}RbDE8PzcfTpEq#^ldhOBw6fiw%PV@OL3Y2}@H$sUUbQd9wZ-%!JpSzv5B^nEBz? z;Py9zkF^uqtmUyxdIF5QIg`?o>+VgDWW5;k%=7c$1zvW&t0H{zMn8#`=d)_&@lZuRtn3&Rt zKs^zJdRW^tlGq0VF@6lYfS`Bw>$5NMW9xHIDn!W2RYol_p^lkA}9X5-jT$VSR+l zg=@-efJnDvlzR8I8unKalys}MCoSu%gY+ghrV_P`ZvB^_L>s5bR@oDzN`2LW8tC{w zDsjJ-G#y^1VEpa!X5NAmrO(?D$aGrF71N)N_%S0;+;=kDyjPuXB(!>!3uQ1P2iss> zI?zSlaCq9WZAOPmqGVZ-#-1CwZfbZ5c=NFp07`vhWnWOnDtN9Adgm(SZd?jEIR)9Y zUw6(gRu!~7jQJJAw?!veerQEPINc7^&!cb1XYskHu5D_~LH3Rm*JC5TLk#;~XTYg^ zf|a%Jcyc*j8nNG81NCKPMSm2PfMAQiJU)zuv`^<2 z0R|?m_qixoeHI(hv4r3Z54$VQfgFY0Fa(ACdt{GSa6kVRZHs%Q`=`2j;9QPmq*(2E zXDvxwSg<4H`@{2eu6-EZ=6-;A2CCqbno9HNXS_pnN*$fuuXxP*m1ctvG+5GCoDv{Y zASuO!uKh?*t?u8dDlY<`!t4$Z(8j)`1&IAk9-;VgSunyRuJqUmhR-%XjE5Vj&23%e zQnR5X>aDEH3l|v5cdX{|i17@4JaH;x3&-Es=uZ+S1B~cOQ@u9`oYJsW+Uetr|2>A* z+4NL2eP+bjF&RiV)&O!y)7G%E2w#TyO=~;NomrQBB@d?{v#!BMx9f2`Vs9`J84zy4 z?H7eF5*oUppU=Kd6{uDV%5b|YRUempEbA&BV8Ht)SBiRS#CCX@Z|y|(n7Jc8D zSHt*2Vj0OOOYbpCh$iqo$|l@?Z}fBY`6f@;!CX+&ZY6~v^S~-?1}sP10nk9yIYK|u z;1>&ac9*n&LL1618AX>qKwUdto|x%0C-V!XOya3H`|OIL$_B-~RbvY*-m)yuPxALC zucKquIG^Bnki>boZ_UQii#7!}KJJ1xoQI?OuJur%jWnk2C~l`*R6U^l65p$>Y_v9Z^T)|yZK7age5~`l2 z5P+TA)L1IR9cYB^$~6G-d7&LG(vpW%8IObADIFHqF1G5j!P%+5HoZvFjR`#+lg4&T zh`iMKT$s4AZXAA?gaMazaeW#1vQ~T;&WfFXOSPyKi5Y(D78!vqZT!~pBACUdMc05; z<}Pv4q{;QYQi^6K&xF>o%WP(^n@3|d@;hH+zw z_X>@Cv;8za&IhE-%hM}q3^G>wq3XKq-))YrjNL50dSSDsac5qHbdSU)t)0Q^kF2Su z;rX4Yw-8miY$+8GQwurkQ=MZ$(r~2%o)%xTqcv7GYg`><`yBZo*YE-)?L?hyVDY$W z!0`zfm6|7wjxY+m;#bh8d4Z?z}@|J1DU471Ej-hj;Ey! z3f4Wc#8!XpB|=k%P5ENl>C^%8WSS7V9z&&^G?rO$#6+rE50lVc=_gas9xjyMjPQ|* zBXn!eTzx8lH?3LNV%p*84^@^CiUkvHbP#uhVrz`x&^KJ@6rg(hVQ!fvqpS0b92+edeY4x3nqpc$ z?AuM&m;0d`9B21>lZ-V#DCx(`F2tk=_+6GQS8{t|J zhIjQ2VFH^{uf2DYwqhL@l1q-$&@N-``ws&$I_&clN!hvdEe~42Qf;Y7&-hK>(`X*F z#tpgXA!c|_9OL;`z+HL#IyI%CV!$o&);3LQ`8iKYP0BTH$FcyofNXDCrtm8bR>?wd zbEQrurd1l91+S7=8e(``S#d^+PSNt6vJDDd?}nWz@%sW?p?}3cN+Pr85zIs z_nRre9C*;qNW;NC3nkaAS!5%x+cLwq7CyyC*L{gdv1qeBbHv@4L)@~y(9yN%@f2CS z=z{kJ8$KgEVVe5;;6!Wg+{hmoFnF(;+z;cf>zDYS5--l7uMnd$RWyi<4DpS#baMcD;SFK0 z(K&{ESQcc!4|?`fzl!<_3+6^FK@otLz7qAsMrX-E)A!)EOqaQ`^&++z6o{^@WgGs4 zZE1^n?c{Fo{?8_q3AXzF?YHRi$RRn9hWcp{OFeLGo%tNLI{mh;<(dqM*?Y;3B3}xk z@R1_71u40$urZ^!AYGKM?ioDDX=?vSj%@@_LyfjoR0B;3NH#kN)*wIL5SF(KOohoT zJ;bqEI2=8yI^rVYxt%_{r5|;&zhhdkLqXyUup zN+i)f{hS{T>srVga#ok9xRV7CcFv{M-c!ljIDhz(a}LdH<3Fr&+fNkktZtVyIX zPAz&Aqr%AncsrxPF3rs3BkcsDj*5h8=;sH1G2+r$Y0hNS?yA16GaYqAfAyt6{*muR zy;9R`ybD+9EDLz2rrvT(W?h)N=IJF0o=a;{&oMAV0KGLpfKC@K!-2z}R9^mK;**_X zWzfU0(`L_=v$5@GxXWz`psOOTrM8&C&OXYAoe!zl6hbOoFjPB#a1!D%o8?4yETYC9 z*#2e3F7NJL&}?InPshrZgRo5tEtBmBy2L5ZL#Ep{rC6|25?>OL1iZ^2Or&U7wRv7qUXY!OtOlRb1iIbzm6-qn z;7Dy5%G*#GVX2-`*Th`S-zmz;zG23M`6bQq3@#Yr&Xdm$Ory#jX>=DO!bnh#U_VVKqo%@l>d_$Ywoa>FQLU% zu~$@4tz?pm8eCB&xVb~u<01Wp^%yv6qRM}3M$HL56SkUHojdHehN5@?Nfl({cP-sP zaDzJteRijaeCau!8K%B^#RbAdEWI!XJnBGKflYo9Qr-F^^af(3PLi~*e;B%VRtvTr zEPd(IbV%Vl-^NmcYfKT6tUxMY5uFcw;UMVji=?Zfn1emudB3w}w#PwFzOdgkc2iY1WnXlR4fcEP8a!&V6Ah+T57f8W9|rh>$R*H_5GDmx znrxkpps@3w;Oln?K6iiz?*OE|p2y=`IVuilHhLsdZ!a7P3G@SzCh2MUVaK*Iwooz% zAC<7-YD(@@d)*l5ee?Xbm+g2KYX7vi`kU?m&nbgVXa?YF2q|Q#a43bEUXDtr3n@h0 z4h<_h)ODWxt1u~N2OWso(f@V_t;C;8x)Y(U6?R{A(Dk_Z5?`Fhhj7`NsIlj1QGMsA zZM5=0cA~8DTSSc>TZd>YXK7T&7p}8gU$+O;Q#3=|f<1zQIJ6piJx&-h*z3}GtnY0G zx_F%8Hqkath! zoWOCn9d8*q@7Gbe63TVs7CQnvPW_*8m3Iq);~wETa)ni&e6=NTB}r6N(2?9bKN}5% zyyW_9?lA1jbq3wTn?dEXu)jeuBXJ5!`?&$DRt%BE40(UDa6J`DK!Zsl4=DyVJ(iC( zdrGR%v`Xj`pN|yY=WIqU@Odn?&L0{Xo3Hwe@Q)+_b9zdNb5?8`k?gu3>XXZ`(&6OC?EshMx4q+2gQT2 z=NONIaPja-qHrs7$ynBEIV~NFXajq!-5Rk`Mn`J~0|U{|r=CIT$WXB*tlq1cK%@+t z>_QN|aR&oG7OgqZ-m~oC^jqu)EwV&;3UB53%S>pEAYMfpw7(e}b#^SiQ5h*CoU8aM z?nK+z{mD+vB04e#Nrce*py$VqQz0U3!kn}FFtjXGLPsl=qHk*wV=Fkk;~eLs?4te* zpAM_XQaH5Rv%-v%@CaT8p5Hfs{Fi7=rHHYkZL%D5$Fr_@VZMtIH(dQNhE5rylpcg? zY6<_4?bNc&4tPmp^Hg@ZQH%~PJ=7M<&uCu(7`NzCTkg5_)b0TKESV!^(oR$u!JcYf zT;<&}nop@2`ph2NZHs#_w|AXk-E6ox6;|_&kAc^hvg`^3tLSM%3>E|z%k3x|K<@&? z7JhyxYwS{3LwbPH=fSh=y3$EEjWZodIpZxeC#=KTfv&X+F}k}_d|l;^HnnF*FWNqJ zZp5)wqJDUAVgBsf$5GKvEFtd$ixQ7zH8_}Rt{cmTy#^O16E|f0CT6=3dHMDEiSd?-+?ZkU`|5!=*t;YfNxngGlI-(vSD6MeaH`dQSpcwO`(wow0LTY zzbG~=86AiNRXc&f-TLegvk6p$U_uVR_%q;ZArEx_5UzWEnXaIB)sduKll=s1J4SNG z67C`*656G_8o#8`UNL5AHY!`{VwfRya!6OFcSs_2s-6MvR>SRP|!nTsT(PvDc-N8lKPy^{U-S_+P+DcUvUBKgZS_5+EZzwTL@MJx$Y z7#t?4P;*coWxHd6l$aMEwqE941oo41rq^u4_=y z6l>#?A>w3uU&`4r>ww6`PeZ7tfM!q(>Wg+bO4vB2zeUVCM&?Wk<_GK7E+l-}CbJPIYoTQtj8^?$*4|CTvJI)Y z6Q2lY*r(NNEh_p=DiSL!J@)hwyEn~51-Chz49+U}l#5=^Du{$f(^e)Co*6*fU-b{Y zpshAH+)S#XHorn$ShgC)mrlkg_Lz#7D zHsj5Sq*zu7EGG)X1ssakXU^kvpxC|N2SCLrRF7;lq>7OWatexy{WJ{wGcDz#)^qqe zZR=DnMxHBlY{zV~k9Dnl)|!*$xoJ$CD)^l@JoeSvHC~5V!n{?=A~{X`?%{?tBnaG% z=^P8%P$d(HG_3u3gym0LqgiihI)$1hL}R)s;_>^5#?G|c%a`Tb5?IQMJ-CnlzqrnS zQMwO8%o4scnB;yBbxJxf)93tQvP)|d8gwNZCJ?acZwS&d5Hy&5XF2>igjN(!%8nn6 zyj@9i=+|%zNp&t3%N8BcWDCEKgz^;Kf`PhfSn+f*L>%Vms^Fs$%q_L^c`NJ}0oet4 zqA$6~XZmhRmsaG!_v)FH6tj5vOG+>S>Ez5)p^sP=!*O^tFS%TeUX{XSunXuzM%DE? zU;BP#+)3NQ$`Uf!o+&P=>FzGZ8+D3x zK>0N-{o8X`%r7)uF`bO#2L)EghS0CmBihl7PV)M@LG*oCYiBMY zs$&6ZDl7cmebcjGW#*JpsS;KuX2x=SnCg3}$>3iP-Z(WsWpw8gQOpMMyRmnVxVaY)5pxgpj=wb^=XPcY002&cIZrbj*^ zrsnyKLHO-$Ybe$ja_pH<4lpXpm;V04LpaqH{uqEr$58UF2%uW=2ppT=6z`-31cc?5 zosH-i73)-``NU-%a*~XO6*J&WWP}xld%1KS!rb3de&{V;9A>DnAI@H7*E6Rsj}B0- z(C_p-O7E8C*QVxe!EX#Ib29JPfEyX1BOJ4}$(I$AH2?LnZhgbnn@LajBxZ1+k-;?4R<(vUpjitL5SQ=IonCwP%)WyE7dagy#m=ZkKy=t^CV z5?H4*(aW4;xw!~)(Tbx=iW-vnaG4wVdI`uPOIFKQwBP0%J`aCk}1`ql@|J9GK!?&u~UZ}A|fb3oC zS{u{#HB-}Y#LoRZI}2QGFW@y#38WO(3fn(ZJwwvFEUhvNY1%SoUJx0(GFUyrr_LpR zK;l54g8E@e9h1i5w38AViUPWE&*9+C@Z^>+s~YJjBs9phz5$3)%$`oeWct|BN1nul zOi5R8u>69@VX}mE)9&WiavjF4jw9H!%k;Xt5W9*q{A8zJ&fPJFwq~#jf?WmslIS@t z!%t+1tTqI>eD`Q0aJ)Na&0vGVG^CGKq}{bQhHdj4r3X@}Xn%M1zGPR6vg6HT4CUfM z4P_6uiV?2UZp%*@2FVKKSfSc`B>DPUQpXU3XOEp_hsV?6TNGFsK*YF5STcMkUH0x` zwyMEPp3b-Ms(S}j{f)ler8f_-E3u)d=l6iyk^8wrtr3%jJ0zOqUxn+MMS(~2n{LYz z2h-}Kw|v}M+B0zrk2AHe=+Kw?Msw)MUiz+j7M=?ZzaHxbAKGkCc{WmjhjZk{o`;Au~?rHK7`kTj#j zn~$P&m%i3=mPoTR?V37G!MKnPq7rIkE(Y7b>A@XyinacxO%8omX+?i-$U_JEbOQI?xYz-!7By%*7)yjQYt=3@^+uJO2{+i1Z8LvR9yeK}N zE5hiiot{56#!A2n*WlTJpRc8dfNczWlZUDOTn?dwi-$%h=wL~|vPT2v@seb;6OOb3 z*&fsxiAymdOHgo{4~sO3D$JHbg~^Q=sh!EqK5Lo0T{~a;(yo!W)R+*A5td&+EE*(k z;fCtzeFeQgJ|TFe!`61E^t}G|tanD_{k2^+I#_5Bk?_|m7@XP1ty9#yHfpM7(Qqt| z%n)w$=g&?aFz#x+4_?WvssPT^zww_7o$pTZA$4bLwUVFJF2Np9wa;FAW0L6XP8_~j zOHI}u8t7=1`Z)5k-~w_eZnJwZ%t3cG+sqpiKI}C;Iv4%xVtzS=?rKL*;*iY-#oKO3 zdg{e8+JoOpAx%~kd?zul>@*p|9-qJ$bs&$Be}Ii~z?$DGXh8b!}}; z=3r#6q)M3KAOnn7sis}u zDY5!cIGAUOOC2Kx9YJ1VZsHog2^Ew_fQ_e#W_c}dfbTWIX;@gLB9 zcbC~Exg~UfhzC32a>KpshtWby!M`MLqv|yJ%%Dsh@&o+`oA6W;rjS%@oBR7G)Ul&YaZHGP?Im(+jp0^se`lD71rly43kY%4m{(QXJ8a@7**5x;ttLw>C<6FCX-cs?A2wx*ik(7SJ zG{?Ei<5~SnKJT5S34~fbB@x~J09=92f)-P^Q3GKmBBR0B`%B=!ix)2uH5X=nGCbJz z!s0&>;b-I4fz)GCn*{hQn~4{1H)B)fVux(Ld%-SgvTTxMvols$*$U$c!^AVyd9G1iD0ACE{9u2aFfDFU}i6sLzpG-al?W|qz|+@-YTIJH%; zFP!tCl8`!x#@_3+nGk;XJq>HhN4^k&`IYMGY9-JyZ*6vEOJ%0k^TU_en7PJI0&$d!sZ`rO;OeKjZR5?h>jQS;0A*1O>ANqDm-!8DVmBxe#`SrDIo!~A2dli& z(tIu5S*MF7x~_-)73KntmHMG%nm1S5v3at3V32&`DdDBF3t@Twn_uG5i}ByGhPf@Z z6rAnM2xSc8@V8wAzBl~{n@HccwSw7k*f4$^P+}|Y``Aqwj4zX-+&r`EWZlfaGBz5A zYw~8Oab+^qgUQl#9Orpys9jiCsC1Nw-(Ct5+37{H`K+Ktz+&U)nlmwZc!8hI>%lf} zJo%>FOT2e4t|P!QUoh%vpmc0(bXA}{8vX2W{`71y)|S(|=BdQVbb}dY903^jRQ2T* z$>}Shd)MlE`?qeH+`NK3@Ojltw5Zji*`v7cBsV)|^l<~h*7G8(ozyF|%F@QyXY7sZ?2q8~j$#1)+<;Q2)nAehVv-f=eyHAMxfd&x@<%tt{P=W{i??29jXrdfq9MT+094c{Z55fpg zK-^pzX)Fa!~_YqTXDDh9Ta>|A?_WM>;IHl6rS>EQ7M z1n!M7A058Vc`mlL-8Q#*(nXF3#YoYL!tQZZ;@)P*(X&QIMqSf#&fGwS&pw5A>UH6i zlb9^q$N4xJiN}+vuF!YbmH(1&vb_3;eBiKZYT<$A7z|PgGugSr+UW^qMW=T>rUokl#%3i!Yi< zFn}4In#NQni6xe}?~*->y+Bts4|Xv6){=uSRv=O$D+;jzz63=#zLkX!qQq0_IQ&_7 z7Da$!kMHW2p~LKft9FZ!Sjz|G1{x_b?*f+b2-U{-N+-dok){22@^_e!l(Xs>MxNP= z;jRD#+wu~-(lPbY%^YQvwZ(?I)&o|Jx)lj;V+p-FAYR3HUR{&n5S%pX1=!B#bXzBr z;RK)WVmn$|R?I-7xN5GmUOqn-FyT+t5itk?KQ?Wfb{9OM=DR@d2%6Q5%5b@IX79(C|@J|nE3dD1W{vSHp6@xl4{&tK1(9+c+FB_iPl6zt1q}o`F ztSiF;>>-Pv;2jGdoSQpGo}B5`h1bVhs;QK5AQCzxrf);J#@`!Z%zFi!H4X(RqEF{d z60umMxS{4{s@qokL2+tDchZ+G6xogGA`vj>melpj-PSI-R(Or2`@gv}yK@gtchB<> zY=B+IkoDT=JRUkB%nngntDW@Nf1M#AfD?mC5kLPQ2E3a4_$pm z^8Bn(I+r6rUUMD%NX7R^VzwGeGg zPw4VYOFq7_{+lYaClOz(T^1M4B$vCJ9%o}}%uXX|{lh++ef=>Ql48(j`uC{(XvwOb zYp1a3A(FFT5nbAWEWvX#C#S|@6JM{(rupv>bAgUkqo4IUU*6|VoT3d`7bCKGS$2-f zZRhWK=rZtKsqfadW~^It6)~TZjaj~5#lN0t>JMgiI+akLN7iu~_;j*-CZCcPS29wv z)?82LrAxLWoomkyJCiPww(8%gH?#TKmTEs@KVkpFuD3{`Ko=wBVMHwBW7=)MOuuYo zaV$tTSk_d%FqWa~{fLQQjQIH(hM#)vB9mf8bQ~j>)3bq_dZef*lP#Kh|wA8(2V37DtBR z4ziYh`Cz6mPI{Ocm`oqT_~WF(mh4(PZG^XxOPope_S&YLBU8!$jk}IR`&=MTdQ8~t zg*_{9w0$!x;^n@@?K>+C?Oe{aVe)rg@^>3&5<`hi-IxLuCI|kQ@2xg+>>F<22MzDklDqhY?YyBYSMnk8vXD8uI@{wc zX7%=ApX{%RZz?`f(bX?#T4*Wr!b(V+&uA%zBO(pI+Jm_-*H*2wRK`ZqMjmqO>*Eer zo!BW}ZbZv|QmHj>c#kNma#v|HGQ)<_)-;AW+KGbUT;>Ind5=UaSGz_j&q(eXhSe}- z+h;9zBgn>7XC2nMhEn*z%p!!_P(V}u9Z%w0NhVyy_pgciDKD|fT0%pvZyPF_iLSB3 z5{Y73Ue3W>5OrZbNTKzziCR*?`|;i=I_8AuE@DA8HF*ilY82{)N=Ra?CPNAiP28+P zlC*x#ZOHR`n+nf*g;%Y{+u%zB_&;h)&`{v;uy1_9BK5C~l%tiQW>{@0ze3z;{53u^ zbhtP=9J*U%sA+YI9^t}M+`jIlYGyc{i@m%t(sKcuN4XMB7~^AK32=kied$S^ij@j+ zuN5&U1MB2@

i=3+5##<_beC9398d)$ecUaDM94?zS=7re?J(`9^$#G8I+xYNQ!j zt}7Bd3S81?tPO8u+^A*QOKo#+vYJYB;_5B)-g)Op|R)4sTL8iBqD%RkA??ZOsk zLct(M6yC@#RyYM3P4Se@MF_F%41!5Y9T}_(%PaxAQ8OUHx^IibL5uBUi56b9Pe*7+ zH#VEjV&jox4X<*)48^L3O)J8&*(#@W6W~%tA@XEdZ(`9{NjFH>hWKIJdjRvH;QWllOWl=oX1i1p^At3S`FB|zfjUhNiBD~x-ZH*PF-E)UxDF-(DPxd_i-;Wa?4rF}?5+S&3V z+uX_wBR{Vt?MAF9soAZYpZ9$Q_q;gyP5G6b{p#f-E+WBNCf+ZGcBz~O&v>AJNFe3 zVJVcL?D4UFKlKYUTEnlQM>w3@1TUF1K1*;8WA>On|MhBW>VBf<;=>`r>hX_OoeRVD z$^1`OA|;@chun}>=}S1yeowRUT5~5BjY&f%WpSU{$wHt_dv~x%fDg1$CAYz{jd8EX zpxvyAZ^-$*YpInEZX>gIx1;*xa@WR(cli2GI$@^qq=lJ%+L``e(mU(q(pwHJCb8vP zuckbX3Kx_E0)-PgLgel2o}UW!icII!Yoo)5!Q(!iT=cIU?@-|Hr4{u|&*Ay8aiRZ+ zBmCdG3n=KHFH6YbO$p$k^*A7SN(2-TFBrlL;!Na*z;pcPgB=9EogM<><^&s?7_$MP zMqoA|(9DPp@N}^OO+X+cE>0+vlgEUCBT*L&PhaoB3EvKn3<5)*JPC2ZzxFH zf^h%I3;+z|`ZE&{&yxn;|2h00e^B6mb@C7PWXtoXEr1IKpz@Jn<8UIB;5D0|+ zoe1c+cF4bi0dWH${~gRf{686U|2O#C0tf-}{8`>0o+ldqatQoun1B!v@Xthm+@RkA z75@%~2MqhGxIo$OhEhiWN{BxK%xj^7QnR$9RIbnZ+Pqh9k!r#FF!Q6ii2^a*1 z{*65q$REK#L0tb`)Xt7ZmNur2Ps%Wq9IBQcrU;bK#4JI0N_|l<7f=|$B?{)|fk1!& z9*`JN^l6YpM0rHSL^vTLg8cu#E%bit@HjaeIXb&Jnwp_QAwVu}bUHe5MG5r(2W@HW ARsaA1 delta 60360 zcmZU)W0NjWmu;CiY1_7K+qP}{B%icx+qP}vq;1>I?6>N6-R_9`w0Eo@u-BL)=B^L; zllSwd9tIeYqP6L~DUMvzeL+*ITfy8;7R?yc^=f7o)taK&sBYTblF+J4$cc&+02CBO z`r)>#{FCxMcAY!0Cr<4?S>Y^eXztaikjKCMmZO=B1oO)Z7|SAw+QR$x8$PNley7=q zUwte}vLOJZ*TpVPMZaag703m}Pjg6&);U<5Y(4^-;|J z*}8zRm?qh%WB`QGW1mHyAIR_-5kSHk2lQo`V_Q&`A-rAiX zrvu36rDk(z^CiIhGUym*yTcyH!F4QG&cdN~uI}WNfMGf7=Vzd-N*Z-Wsuo^OkZ*1w z{6;ovRmq)V+PeYAeyqJ@2TZ{;HaHLDO&L`R6t~pyN-=GdTM_|;;A838)&~$ep0}WfbKA-j^-c(AvyX1C9Y)@#BHycJ zJnFqyjezyjrXc&lH$yI!6DJhzNd+jlYn@)M6yp@_&=Mj&pasB?swGIqgHUmC=dK|;I#aDVV-fB&hoV2_-BscY8hI|ksF~0ssyTf zR6qeQfvGp7R97~A+6RoM%fMGhRg0=nFnr3pf45fhU-!<_YLoVf-KVMYMzVUU`L5Tp zli4A|gUxHkyy^GG6 znl!d|O??jSS#EXwKvF`E};=pL{I~BN-f#`6%qS1CNmP!?kJRYw<<4gCrQ^t8wAqq>htEh+0#ik{LHPN8RVNcE znZ>SXRdHS_#x03u(XDzZ&(G|`f=8xAItL3=nH4l1odG!}VstV}`LII=nL(#!<=71r zBbd4%LmNx(1d+L?9y$-Ltyx)T9E#nZz#utaz%Z@(s0m#zSO`g<0lM79>)@EvaA=Io z6$nP_Ot_VaQLNDDw-EM^)nZaO4BYu^B86T(NfUu+p@=*}4Vvc^jim6OIWe_|LzdOg-5s8MpMf z{|+`ed-w%>zlAUk;fLril-fY=zgDZ-Fq-Bx%9_@fKQ9;8pB_KY!>Z1o5y!h}Z1TgF z*X!=B8$I_8?e|)-SDjU3qAyT~pV9Lh^f2bTDFNFpU@2ry?SsAG{>u5>z>Y^5$OdR% zm}oMItIMsmM>JBQzZ&Xy7ve&zp|&qNOpd)9GRys;J9*zDHp~?HsrHunYhg8!gDWs} z6NFR)UwS06!gU#q{_cj{FJlwK4Z`!atxA0Eko$xxKK342G#uoFCcr6TISFB;*xR6_ zA%MA!)&tW7Q;I|8RmNyJrKH2qTC~V5%kpel*r2d)OQ8VjW2vRo)0|C=x?3N9#?*D|S!4#JY-q zZ_3Re?1`16l0Ny~1)Rx|BAgc#G6b=kuYj4W=gh{jct?_XcQUF*sTH&1BB;K-5%o?a zF!ejtRru&S9lWf{#>Sw?e-k1EUds#d;II*qQ2bDK_FKz1^}5EtYDu?vvK_-xQU3_m zA>-ggur)#$HP*=0)48w^X_a1W|5z?UlVx~8{l#P~8I|4EEaXP}^CeO!xVLg^b;OZ1ac*Q1&;aF}jIS`|rk-#OsFN0}O6!w!> zj}74}Zb4^kAM~sCBVw-e4_skgd1B737=G3daEwM(~xn2h~8r{nqPf{f&bDZbq8-N|BFT>izsBymWqzB?kX+ z-8a9Zg!wyTwo*v%2z`NPY&YF-5-yacoKg+Fp~<@BP*^V?*PoslZpHD!cpRzykuf2u zMaexvPK@u-f*Hy)MuK&qRiE+BhP!xN5m74w=#j*LnH1gZ6b8V);Q?o|F%|_YZI1;v zoyst&g1!yzIu?$Uea@~WSjDk*w!av$kNGmu)D?CMjO+c;I7MS_AZA_FZ90%OnY7W? z2yKqtFVlt#^Oh=-gjFB#T{srN?9QUI@O8P5%_~)$Wbv>NSjBfpw+_o%4 zrV8x;#z>}=pjzrDO{joXwZQrHG?rU^+?*S6v2OR%@*OZ8in$oAq&%L9BV4dgvyx7- zlX{+7biEk8Ei@K6PRj_!zrN3p=bA=C4Kc58Xke>VG$y5PHv!2C?|YX(j1Pz0tNtWa zo$<*moyOrs6qnvN;qW3AP$Lk91glo6-Pi!7z|VI*y5HOIoo6b<$g1b{zjU7`o#*CA zXs@Q~%TuHbzYiZchh^o%g|FIMyPzRBh%J2azF}wx81K#%eSs}BX1`TdCthC9N^BAE z*Q3XB^{1z4w}9}kc5CnCu-u)uG>;;#8mKBzpB?44QL7XN7j1NuHmmycPVV=DEU`&; z0Y^O0utbU~h6!t}6O&e}u^a)|uyhJ*=_dr-yJSbmD?ZN%xRl#_BI1sceWxuPGmzcp zB9Hi}AqFqbG8{v>8}B{uoyIm2R^@9CZjpq7p?VePR{&p8O>Vnf)qPp56}WNa9peBm zxUb8&S4qV^egiqVOT!pkbepl#5~sx8KGVM7-5q8B%L+&OmNmD)2gTRBK-Y({x0$`E zi>tGlksb7ZZVtxQ(Cmbag#UH2Ftf7$&y0!d{~hx3GRT_QTew;hGBXk~CKYlJ14^{z zk~T+?dT#5|b;ePFjlg%^eKd8d{-RiwTrs<^Cr*JS4w2C!=L0)ZU1X{#f6#oydGZBe z`8bkoN}UtJ{4p=>GU)T$J~YTUbv{|hd$~Qn88mst=+k$6PHq9vd0bt-k0foT<4><* ze3;D|4;(CcBqh&yU;ul3k6Sz*0!EI;EIekLF3T7~9%tIpH~>A)KYq_cSyB(?lQ;5i zBp!?J3>bqjdi$T67QLP6-Q$s0`sx7XzILK428OTUXV1)5h9!nGia5W$H^%$+A7BTv z1jR1%5u(jTg&VnDo?IHs2#Pi*a>lX_YePl$`pO%xMkp^VNBW!aPaO1t4|XJt1r3n%68*J51KNs(QkD zy}qpmOSdNDE|-Q^!`mQNb8!ymswin7K52 zLfx5Kc=hq0=|eoj@l)A5U>96p)`vrWKXP1diQhwDtJ}xT!k<&-7 zrk)Bt{$OI}*Xbw%$0THV9I>mdVz5R0!F1a)*||!{}Eo-pjR%3!dLW} zhHZ#4vButUd59pv<1&%P-z-VZTR_NF*kre?o5noU2XW9+8Ytu*t8Gum4^K5x9x3OL z)~(a)04tIiRi^DoR*=G~dd;mlB{6W+%vA@0DI#L^U&B8GAngc61sZ&`2wpxLt-bo$ z$RU^xOtGw*rc&kU_TS9=?Rr$@XyL{^R!*tP8Q9=6SR2cYa@+$6yu-a2cE zNhhp6_iy^GFhfT#OvD}DpCrlXj8~79dTx_!5HUq%sgDEK;EY-srH)$Sy~n3SdiXM) zfN$|1%~>V^X{_M;j!ioszPZBcs-6@B7HTyE+Fg#0nC| z1&7H=5{r(B%fb80(bqJ3fBuahXSYQZ+buBpGlqBf_hV-x!RVPIo}(?N+v>205yC)y z*^z1W)=uK#@zl|h_9zN9nmg2YB-O2pX?JQg|mikgnq&6ho~o$xiuqrU0W zc4RGJaZJUjE%88drG=YbL{>lvZ-E(i&7*2;@6)`X32Uz3Bq~L|kxSJi=HH_+!N1!7 z+-OG7!H`!~RhE=2ZLd_3h%HV86R9o2<(6Dt@8<)n&wE{tCo zO;(r#Mi+v85bzmm1=Kx*u9$ojIRxd^Ym%ez@bk3`sIg?4`}30y#1xO^v8o@hxQ3Im zf25B8aB%H+2o>7_%EHUzwKI#KP=_-LH#Yk5yp18VX}*R}6rwO6)Lb@X+}$V!!`rX) z(HoVm!PpakX<9%PjB&d?!s};RO8&%C4(wF|uBjMq*7>V4QM&xNjj3W$Uqs*5qhZEl zi>ElzzWYV)UxVmBfZOHOf@~?U4nSG7EpXH%`ur!C8)n}VQF5?!{0Iz6trEY$&3f6h zD;R@}DKreQA)r+_CiLoR9bC0hu~BkytZt$ltH=8vS(`TdK_hTn$!b#4AXo6uYcOL0 z^AW0oy_^N7awj;I((m*Jy*0pzw`ES1Q3<-b!U_M7(0tApeBqDGpa(f0chtfj5Fxk0 zrV9)#CSzkQAStx;rY7TQUhYDgI1B!1K;m$g&9=(vJg<>gaqMMvFWlBbF7Z#GU8+1p zHPt;3DG^@nJIw#dQ9+R}DiT->1~x(hgck?FLOi)Ch|v0-8S2w4#;UdMqPT}$1BF#e ziA24-!##mIkO$pRMa!ibv3v0?lnyDCAk(g+qeZ*{A|;E7rO6$)jp9b?uF1 z`en!hZ)dHOEVzW)6Y7@flxn9aKO)~iEF1kjBo-O8be}@lta+`q;B#G<#-7IWf1iilwyENXQE&b}pnQuk zrT-LP!u&;5iQ80Z$b)eMv41sAGH57Mq0mV6RjdwJVm}UDdo7=x6j}lYkUnYsW6yE$ z#$NI#&*vvYHkp4~Dq8(H!Q7|RAOVD^uAqRD*v(Ulabg+sZX_S4CL7#LHo^akOUO@H zCLcoHHd+Y^M>g+Kn6dn5U{|M<;>4i~Q_d!3640^NF|U$9Z<_z>%7iKn|BU-nkP+^& z0wSz|#kp2ea8%@y1rUJ;;GkW_&QbY~NW}kbRVFPL_o$>%3dA{^4U(H2aY|dvJ&H7Ru-C)J)+NO`-#weMZTPDSs zQ1`z(u`b%~W!ZJ83O~@)$VhZKK?2#Ey{=nJ>Jwa>Xh_!YWsbVdXsEg4qUDe}b`+c{ zNP;pJSr84t1+1b{Xs=Le2$xtD5-Xr(qJ|W%ipH=KiK>kOHo)_B0bC$w&xTr@D27c# z{%-7OieE+ti>5QFv_$#3A-j0I|H@VQj5~DkDXorv{7bSic^O> zcP0rc71vvwZC-lyRopd3V&m<!neANu`SX_HPw^(8~@usPhYz z#+-ft?yRxLwlf=m=fbHf;$2;)6r6OPAlsh1`Q0~9^~_ZRS{v2qu2k_=Ma0CyYqKue zte4J4_}Q`cecf8EK$Blb>8CZ=u+4|GuJ7#BtxOFjPf>z$svd zHl`L=B8gCe-patNi^wf&v^5mpEL>?rc-XrEBx(wFG4z8@IxmG)gN#-`2<(RlOMG{i z0=jG!g_Kw2VZwozG36@#*DetZ;JP=`x?jjHfcrOC8-jE~)u2L#IY7#ERqwH1oN9@n=R=AhqTU zyBKdZvWCZI~GEbaOwaLY@DHO-$@MU+t{^Ne2f^3|8(SDac|Us&y^Gf# z{Hu*HDo=mOcJHJh(o#Dt#Qe0!+VMDY^i!|W1a9~Xvv{NkF_Mi*Lr&$uL&Mi@yn{Ls z3qC1F&d>-=1ZghY&-7P5+qttd$FXH{`Rjn-?a?4wXcqZ@W!nD=tN$m|axnhiP|M8r zze6p1Qa%SMAVovZVUrzoME{#6+*r`8zfkO=OTh-aO=h!M>%e#|(I}s6LzyJ1R&q?v z;B|wbM@Bi(jKYqiSWq#c`*q9Zro)t<2m$5jJnzM$72ng6?Sqy0gvJ_RX5-3CAje?x zZPbgqKJ#Y;b)+IL33X<*$lp-lVZn#P`NzlexR;j);H$8W(Z>&XwLa<1_;xxZXBh2GF8-a0pHLngPp)Nr?ru#s^3Z z&zB-y#&FXIhGvQ#AzRzz$F1&71Cctw4rf#O*C@`c;6i=IX!y+7gbe@t^6+ztjZEaI zo`?(}UW#KPZA7}o@Lu!U_B%G~u`U3S>mLCH^eY7m)#2Cwa_-rjO3jS14(DQg&fY*# zvo$IczdKAWc2zOx4XI1QZYWYa44FfGEgP5ndnX9QyHfbgDMPasXX07oJ$ z5wS|x+(b0LKHsfy7Aq?|Plhapj@H6z3d>bt&4QSf-?&-EjV0H=+jBy_CBAYxUP;fs zAP>{Ah-hiUWVs)i{uxr~L7TU115EOAa?OmQ4gk=BqLm^>Sh)+9K(yis~yzbI_Cc=TmZIPkRujf}sLscRHMR)$Hma^%>D8n`= zXllm?HuRK}@5Zuxm!H?rYQ`=9{!kfVCP91ovvD2BfnrO7xz;vNS@vr&?@e*B)ks6a zOHusvZgnv))>i#pS!jjGJ^+$M13bxvm|$yN^G#Xi@dC8^+^`tLIzA+U@Bn znS&*6&VU!Eco{@BTf})m!5_vR7|$?cmVhI0CC}GRy`2W=R193WNt#5d z-fLfUl|O^vcNxhV5pN(<4>;=u2puc8BlfUzvnJHSl_EH(;)tUgH!aj!1NPvjTj;-l zXrS`=1Ld8AbpMoiVh+6a-{odQ{Mc#C|Lqn8gg4bOA)4F;<6=ryxo|*onF4^ zGKX-EXVjvIxRy3J;T@dfb6_+y`4{MHhdE;mdXZ--DvV^*`k z^`nmqO7`rW=WWRu0lsTa?}Wv1RvcA$JkX%+5<#p!=k^%oae}<07DVamsKI( z7YD~U_JB_>KR=US&fnu2w4R)Vkp}xC_tvlPU>^SCT9`4~MU+cr)B}0-xh3f531%)Q zl8Z)8dx3HWr-=bDa2%4bb1;VDg0bb2!nLSup9||P`=F4&gX?lz+{P{fg-Gc}T>+h^ z7u|hhprD82nw(=HO*o?)fST+DMn}#DEDZu5&D9rf85w(u4%8H1hPd{j5}dGdrrPg?--&3m_pP6WG%zt%% z7`yrRSkHtxSb+{%0kd#(m#}={z&L~-e)D)rQ~bj4M|DskYNX3ftK-SIjpi%?(-4(^ z@CsaA$$Q049&})wvPW2BJrT7UC3W&(4QmyKa&xFhlbW*KuRCJB{+#3BocW~CMbN%(Vxkg%oasbB@>gyNE$)T#F*vqEfLb;MYy$}{n}`%N=I2JG(V#ob3-iG zj9gX2p_LHYN1_Wp&#W2zipgzCFHz^9Zgc+l2mc8M1Tta3Klka1Xazv|K4~b zbMCuk0Z2%@?SsislfVxH?-V#qx)33rOxE1_?(p{=S@m%^gKR`cWT0{iJ&|6h^OSp9hy4D;jMZ{;&Yr3 zJ>38B?fRFe-xd;TDRC_G4-l8VbuCL@CX~R+11@dPVc~M?UGlB(qTqXbt=z!=x$vH` z>SJ(jpJyRA+TnKR%PH$Y>}bOtnX3;0p7l$)^9Lj~$EkP}y`BRd@=wLDjpDPno;d03 zk#KEe-a262OrS zTO3`!Mf?-cUl^uYsCH=1-~ORnl7&&vfF(JOK=S@m|B2VZmSVJr5>Y|OQD?HQpIcfCA8m$0pCgjGg!PkHr3)z3g)Q{#;+ zV_9dB)h0FdY&o?k6Uj+Xy66kIcan^7`s$y8i9PYf#TZUW1_xptB3_nsN5S0?K>w@i zMeP>Ez3KwKuy~3Ew~B$t5-8sxU0-iYszR_51cGWB^n>_`VoE}oVus39x}w4#e;8-1 z58~JA!`7|UBa_;y#oknE3FfoCHCdWO+`ojucgYFoHG{)i{T9VQqQcC5=_}_;`#!KK zG>F_Rp?n#Q+J};dM}JM0x%AlN$!>5J%LTZi5_5pM_n-{5x_M&!X-QbnFL0J?FNS7hR2 z$CkBK?T?42uM~SmwP=bhI0-_St$8U6u13%LH!THIZUw7~>1soq6-}RF) zl+KlX89HgTSIbApRHoD#E2glFwoBBoZNz^Anyllq$iQ5tK)2KwBi~E%;0=)<)GsNo zQamHuvRM-aRTz{1sy*5N^ZtT5G5zH{Zy{neO8WI?l%-{H26efM*1m+Up8`*c@>KwEZzNi(jN$4iY(mM!R(cRBUNS)c*23lc98Me zrHYF4_>^A8E7{^%1~}TxL}gUv!eKV2NN--lq|( zgGk5(G%OZ;X#%rNn?m8K;`ywZT9@O?_9g8MhlMRf*b-fUm0;fuvUzKf^`Wrh#(ZJ|0DFlPXXB1W<&mszwA0P!mkZKc zxPQS>@CoRG!b?Yau0k039mAFPJAnLndkdtXeWyG7#w>4}W4Bh+O#yv|e`fN7;kK{E z50Q<%2jk%fU%DMk$vfHf_dgwjG_%Y}Yv2kH<3=6 zV4PG7(_`TC$Xm#{Y#-w{UD%KQ5Sio46&Ad@QU4g$1YQz;S8%N zB%539C+GgZfe1!LE<89lrYB5!*&h?r=w+5Z03O>9D)wV~DReF|rb>w4e5UqOI7`qS zGlXChy%IReZL%Zf&7I4%?%kmAMf&^0(e2$S!1RpD;D3QP%m26-W=^*M3*Ia&|I5X& zu>NPH%ph)M>uTmqm{iSy2}se@b2wy2AL;#X22a31B1!znE}L=X&1p^=#_@(}&L}jb zhFVcYgUIOQa7r zn(;>v<3hmFA)wqI)chV^oyO^ZI7On5sYljmOAi7;L}x7Tpw+zvS?X6%ph{SFWY(jy zB${mpzDV;yFM)!D6$78o8m0eH%^RxXV_3jMhN6N$ginbQ<9h<_htbL1HP_4b!$g#A zf_$f4anLn@g$M(rH`2DmTU-ph(-Cb~CGU}f)AAR14WzkU)(ndgBA>Bob~E7e@Kq!Owem1fBtLPX>ABuSYqNpLs5GMj>ws%a$|$$&UV zEA(66-apKH+jXOfgH(ADB2PO2a~g4ci71Q(uO0iD& z-h>I;i%$SzgcK9DrTx}x+O8>YWC^M;wmd7{7h$1=50_BX_`luWgOU`%t#GAFtULm@ z*4fX{bMArp9l2W^c0KKAu-Az@kStdr-wv&yzu*HI9|=>JL(_WscPtP&@K}pI0jDX2 zUWgWF-^(Ma9pDknw_OtD5j*wAB}?b?faR3`wAuk`qD2v}s?~-8nryKw53P4qE$S@K<+g@Y{tls7RIiO=EK6q9^rHgixq5vLBEH_HK ziO(j;JxOJqmDDaDNX^8UAzGY)$0GCWaW{b9Au2>ejOmM&!5X?Lh@2Cz>YLS?z>q1V zvXxL_u8S{`uxw*G>=R?RbiN6hl>tE;!a&DDIm$Ze-#YCwohJ)_dS!Iq5FL#A@d@5 z`xw^7ee1Rzw&LHYzeQU$JJx^|WzZodQb94WUejsm!LaTLrJl5|o+X(`>F*V3%}zVF z6-`voQ#)>k)k8)tXm;80JlLe*{yqS0qgE_4isS+@8!siPnjVyY-8*pctnmmCCrwOY zuU$6U-oQMO%E?4f5mV?;aHEk+(r6)VO0Cf0S;gLemK7|;Fgxk(S8w_3STnqr+DNHF z8_v_1_0kIRbm6e`s-%dHbvfR&9jRh2)w#C_ef(ZkjLI+zB{*z3?o%Z(i!9(9NG(oe z8!{Ep^O(wzynu?ZY@>G+L+QaND`;#6tQx=Pf#$QCV&%p96uarQTL?%KF4OD6cP#ct zhq|E8*TF+_fcsMkyf)+p;kFmapFKy@kd!kt1rDp<(h99jgex_;#`AU;0qqE9u@Q^m z0S=j2#J)J%6N^a)5hmlfq5z=MqXvd_D7}yxEq|@w1#zwkSluRMnoqIreX{*djsBbA zT9U;v7zWg;OAV&R7C$;{wZQ{HU-1?-NedDOY@gzGYOY5sD7vyZ?|M6grQKzp(~*OO z4E`SGDzX#pHD+D3$Jc*_&;Jemh2yv%h%+%&I0IMI5dPSWPw@=n1oBCsPqDE%Ns;2D7@Xoh(?eqq;mBn{_IA# zTh=o*X)$J#+N0k5Pv%F3Zzqjj5BphU;*)Vo3~{#+ zPEvv=*=&+v=$ou@_~SvCsa1h@nHF4d z3?aU?!l;zl6&fix0apL;*_p6SdJ;{BN=xfpnrQT;Ic>44r|%;;^@_17K+l~fCE-DE zN^P~H9k|&wY6aMApTJsrs;^M$+PwyX)4s)l;}*#AWMO-F<_M=qV_3oiyUcM$U2gX8 zg+p~QcsP0fdjoA4jJLIyM-sTEl3z2!;V^ca`1`(N>phnx(H#HTUA`&s{gd+w>X2f) z6Fw$E2)xy{i8S)dfU2P3mK$a6>UX7IX>aj}!(t!Gi4T~|oSM44UBLNf9d*Sl`Mv)> zc#ZybkRCxv(Ku)R$E3xb2xf8p!PHPn$<9ncA=6hn&$~`};L>st1ZR|5pLiw?w>&)VwUZIG`lV1#b?deS{GQ#WnjN*ujwb zD%jS`1n`mV)X_w?i194%>D3iqobxp2 zyhxIio2qz~-{SCwf0fG2B@#p*EK-G=jF5OzZ#w=DAw3f)SZWUbZ$kPn^7*d{CNncD z$N#8F77jw>|14|LiPC{bHyy=MDg5UFA5=hL+-2S4%V;P{Ea_AO`L+L_;j zQ{afo(s!iG)1r^F6UH6H<8m=yw347AB9}U5fhT`}0Pn8Q2HH#Wq_*;=%9(U~3(C@V&XX(f-%te#D1W z6l|CItfU+JP1k<*=t!rqe^AS=m4F*^61odw_sMIy9$|AUriF;Bt+ZDzsud0EL_5}C z7vYj(Uabzc1@nB3gzl+F?M>NaH~S_ty%0luBqNz>W)*uzvwX_f91LK~>FMtB;_35p z;ra8g>}#+c5Nchm)MRd{X0GKaP8cJCfz#F8E|FEaRbMHk6*CFaKwSHhMIIth)o6P` zFt;=JJ9~XsjMw_0D8wVOw`)V!&%lbATa7l)9|`Y>p+5Z&{eAooetbO%$EI_TVtmk2 z&<@sgXIrSx-exLFxh(Jl2}wq4sjHg%NLe*#=VOi_!1!h@I{iKq{dM}Q|D_0Z(B7lD z#Fa{+kSG_e!*8i*V5Lq3iadfiyu2*i3l-(2seLH;mlG~>jXMq6^mcX@827^-axQ@P zY&dfaOJwdnYz z!A$Faw&4U$X}2t4lAr*3%{8!658r!Y)nYU~3;Pq;AHu86RZiY)b=-Bn7&{>z*mj$m zf;z7okvbM-`9-!DaO1JId@)JTL+2T4b=J-+k;iDhMO03IE%TLf%KV3K!Ylg#;9v#p zy;Ro_O=vOo0<-mpzEG+s+N?i0{Q@s>>OyJffLm6->9tt1^EkU_t?owd&=p-s>11I{ zT6mC)endoTEFbM3qe}3f`uoL5V4?=>uaQSKg-dMC3m;7O^vWy#axtz%D2GpHsty@< zE4pr&N4R+Vx!eM@_G?#nwQ;Ch9 zfX8g3^H3D)k-4}x`PAAy2?^{&>0*KC*r{gr!{~*J`f1wMDuGwuOuj87Cjtt8J*)&I0;@SHhLG! zznjD~R)dKyODz<+JiI$$#>^1^SuF~&9nKOXiD;IYD8s-RWr4r>|k%<^ioeQcON+6($0BFBJ z^KJG{y!7mw{-D|JnZ(7(n3l(X4hhU#s+QD_M)-Kr#I`N(;WM=C#GP*b=)+W08DW-g zfbWUoht+_PGp-_5o6m%$;ML8$X{ntvZx-pPJy>*uc%Dy$6y#ZI$3EEhyE5uKSl}ct6^U!TT39O~6HQK6b)AZw)7)h6Smt+V$j{xu5cD%9HO0 z-IcOO)SyQLay&B_8Ox15xoG)t@MC0NH2;+oHc8S^; z`xsD!kTl}9bkW16Y(tp{0{BZUHb<+J8YkcNpVjA}ZI^Yfk>-t@Usg~wFG-jkIeZ7V zeF%{3@mE*4jElAogQolwID ztUzQ5x$TI2x$)2*0jzE9tXBvW9z-XB=C&x%>Q;S%e*;UgYzfy#e(7U=kXQv^Y@ff4 z?v^xup*7!Wf6AW}e_h$XpC3-HpHgs^bV{XSP%5ICt`YNn+5C zI(^=oxO#k-U(V(60rnK@d1ZYwCuxs>>G>&+x-yT&P0vjnAF>H6iOf)SI5vWT$8v*) zv43Zvc6b3V)%Y;T&ghx>QEbt;l0N+YCBT1C9&8Eyo5&II9S(P+;QjVeZXRcE+P&v7 zGS|v{hs6k<6TbHL1kMZjLomK%)JAnmq2T(#WZ&-pm4*LCe-*4A`1?Yp_b4N`792mbFfm*#DY!bpY3mhpNT^m&Q zT`?#wEgrAp9JaV^t?m`XQ{>#M1$;wul^H+Q7!NjJBIVb`7y8~G?Hb6XY5HLrv28PS zu7eGznsviS(r=eVtO07#%T4LqB+kYH9(P)!spDlga?Rm%bq3~?42rb z{)I34-?+p1e{qMABPobO2#}&Gqmj*s%D??U)5wxdlEF(zT3hL6-NNF|U7Tf&0jZ>j ziHOPPwkfa^Y?K`qwK7DU?ep68+EvF35)Ik^f-_s}%GmCLkN0mka9>i|u`qjqw;AJN zMGFfBQ5jJ>H26=Y>$E~Ymf{@z*E`q4lI?}uEQuT3NDEBiu3edo24I^96(XG3{Egae zk5zxzqm%0l2^A=XQOGJV2 zTA*2`x#_Xtwd=9#l>%_$F9!I|SyGS_R)hDF{GKV~3YFhL6;<6TFt&-tG4f-x=oM1M zws5bHC1myF1i&-y=Aiwq*SI4mpJ;iuPZI$T|M{V`#p_?LQ|h_gn*{)4IA~=j<6J;M zpdV1=sQHx9>(&@qY?fBpz8X0#Fmm2xHDMu`>z%0qew3@bvj;RSzaL|9o-4(cAK8ov z%oc9P=NiF8AtcrsuDH2*vtqlcX&1CQ1pyf$ONKYvKN%tI{y$`$V|Q3#x30s+wvEQN zZ99$C*v5)&+l_5ojoG-d?KC{udz|;|Gsgb9{=l5iyzlE;`%jLyDnHX+q$2ymW;(_s zH)VZwYgpO!h;C1s74X}J*I7Qb_HCClu}7M{x1mEtI&8}ORte5NzX^1VK1yh85EzcFaHq=7a zN=>y2Y1>$sI9xe!O_G+$^ z*F&di{_7O0_9Q_OiAzAvw}uF!0L!VsZEC`|$LPNprp_L!pAkn#+V1F@V&!QAh@9a| z685pLF(O*&zea{20e%m^Y0szfZGF_&!1g9V{b!GbwhOxn!M4iIuCA0zUQa=;nLgh@ zzxm3KmebZC@C&ydo-c?gcIc017H5OmRfmZ~v-vnw%{BjpujkBKe-D>9x~`yxdT(B{ zh`ol)pC)zseap(hN@0HOhVOf1G}gB*H;Zr=qXT7s;3C{>T|t1wk`v>J~ZX1RITSD*=-yz1Rk zoZ@6KvZ}J8aTX$c=H;vG=xAFwGb2p__PHN89-xgJA7RFgMoS8*RX_14C)9m=t>Hj= zYARAOUMw8cdLAiXJ4mDBjR4T)?GmoYZ+K@%1I7?Gz|bIre%e?s&hFVAliS}3ugAOF zydq+c2w$v>i6SL#PxXnel&XqV9S+;-hOC92f?X(~0iXR1Sv+PGFF#CN{Ft0spW(+C z7%fxB!FH?&QZR^U}|-zMr%|4$JoLU90I@1(-eeQ{xNYgyk9k@Q~Og;XGKeA7kv$<3Ld$ST7Zk; zVr3SLDJ!{VatIQMtSO%Y_IB{Pj{_oiH^!_YjrR5^Vb7GE)M!tLWi?p52MSF-(>);- zPyJu4rJmIdy!*g9Byn%f0BcNdhge7XS4a0oz;iA3dI74zJ9fy#=YhUGna6CyKS{5np`yp{y z$4}il1*qeakls75YWm?%(wJ7*NZf!e;qb9lELi%DR%ri)#R?*|o@BjhS(cP@Qc)W0 zDk8*pP_!{@6Z@PiH*rtiIh0u)QuyjvAiTpipFDC7(=e5-rE6~E(K|nQwTaVQe}K1P zdOe{~s0n>}A5SdhT0}~^h}h|R&2O|OTVg!+4IbW8qMnt+tI}#|7$R&ao1?nM{2Iw{ zWz2_cnTLlt*;vt#%XBT}yY-spsi6O#%x4SDAhI#T` zJs=rSV_ry00|imkPV45Zu~CP*bh#>Q$8p(-S{px&3Zw5C3PQ|wUQ|W9`eTX@Bl2L2 zA%|kJt(+svuAdsbrCwmVH_25O7z-s4UV0pZBIwl@3h5qt^=bZeD%9i}FxMXVH&aaK z2tJJTMAXgF%i#B0lZX@bh^A*T`3PmGPbz8N=5GJ U&G%ySadIm#HZSZqA9?C3{ zYG)-pARbSrKFDAqb-c>EyS%29?<$V}Nyy|B-=Xr%0AyhY*4OsQ#Fs-AcoR74Ko=q3 z^DS{kSYb!mq4Lk~7QIZj3)!yhn=bG91|EoChHiF`gOTG5zEme}G8H@a#+ngIkFrhnG%1?& z+bBgl1YU$TN@cV0!3h(E+YD22UPv6oQ4=x<1G)jMQpdz%X%|#_g?YN5ii0h&(bb#p z20mm1d)r*{fm+rY0Q)SCj4leU5U`}PEaXlsqikQ8D;htUK&!b-e<~Jy9E2{Ed3xHJ zJ0gjOxezQ~YIRr0#vs7QU?>)!zr&GXddN@=l*8f9o$wK1=iW}5gM?fNPkxMb)`XLa zhf~^6tr{m>A7>?rdyo!n-#>F5M41Re{APILl4>I=?k5cgeiA5^Z!2=I=pwFv5MSF` zmB&#x`&0go7cQ7zn+_`sfSZU^hqWL#Rf{x~Wn|u$&7+;^#H0Av?~$y}BZI>8FMwL} ziiBO=y9`W;_)h8a>NY151LLjJs#jZdm*!B2wKSPPTJxT@2N6-F^lISnf~iyt*Ht+P z^_C1AUuD}IFtqscd%PMPy)%XKT?EN)f_a$nh?6>KfeS_2$gO0nI;W)HD6&T|pNCme z23=2;=p2xL>-~f4*no$%_!&{E;Vc>~O5UB?7s$y*YuQ_KH&`5AO0u8JeC~Jvp|`86 zUzn!OZ$~ZHbdEe$VifMXglYy;QD%#Rgr)!wn(UDcD08KKIAtsUt(Xw(-jN;f9zCO>_FaW` zSR$_it6J!m;i^Oh9nt|#WQ8B~m(r$sKJ&XWl>Nj3?OpHbO1HY z%GH5Om-OJT{e*U-Dg@jqjv?w}m;JUZeg8d#RJ(87u`6r!BYHKGl*wTC1@ur6V=fyS zOKz1st?yP82e@;Eb`YSY`j8IkFb1P$TUMC>uM3()CATJY$1SEf8ozl=E~K;&Zo)t= zl2xs_WWky(g=jDK)YGs7({*w3>1H_6F4Koi10|sir`P@XTo>M4oE{c^6=9dl;V@m{ z2|o)I;stA%*Tp48cM-!k?t3>ux9`NJjvGNQh+TwKZg%iX`~(#Pl^G;LI;_mw8B7!a z?oE|u)fYGP2HlF#CE)sB+)yadOL9qLZ|!5nRxxgH_E?rXEAiA*lK&wz7nc~MvbaF- z}@% zOv9}36M3Uj>`cR+=Y%Noac;7>7buom91hYxQ#7c(w~&*{Nat}#h@*jCOzBRKWW(!D zqak*KCxFiq>Gh7t%u6m$(Wt87G9Og!+Z{dYu@uh7S9)3@9({;Wnz&U z)elU*_(7|c2hD^}yAsB<3v7#exAL`d66lRY_WiALdzwi8!iLJT`P9So*m&j~#QH`y zed2~B8Bgg_bgEyUpeFCsR1j+_pgsB>itj$XOL35Gq4;^gHnsE6Uqp;i+mZG3RxH#o zP07B2fCWvyCHQx9)?^x8zJMt7W_|dj)fUSRD4oRlDKWd^_REs*0ZD88M7j6#mVUJ6 zprySD;gaInhiw@b;}6|YdOxEtUYBNHsHHD7)iRD+=-qg6`(dD3k@c~yJp})-OHw~* z1X9&c16PIY?@SBafis0w-E?gR5+XVW{|N?GEHpVq7`BtMzv&MNgua`UPUTGZ7vCfWdUkTsuRbdwTqyM=Z6{ZCw{O2B2wD{!s z1*2^3Q-@2Mff9}&x$l)K10Sz7XyY#S(WY^zvLMJeBw9gYKHk{j&mf*=YX+sAAQk@$@Ku zykTGIJ17ufIJPdsf^~?*xmK7;5A!LEc9b<$N~U2McV|T5{-RH6VH?8`p;e#!PLUC1 zu&9LTeF_?+__T=5LR3x>UFw?B@w8$nmj>T9#!1El;wz!pAjH-BT8--r_G*xM0vRKb zo@F@9pUj{N&FVEYO)S?ni;>|yu`G-^v@g!-9Is^`8C(h$B*tDH~kO>~lHK`aPaSA1f-q zl5rPuuCLzGs1ey*nVT~UlZYFg?@~*w?@b~&$o**IpQQ4I_ zw$uyQRUMnha>R+;?)ki0N)QmKE{AZfyO`@W1YUT)s|fZBtWmOZ4lqRQxdpVT#o<5r z_l=B^90r^j#VPsH(Bh^R)#g?|GS-G~{q3hz4krUK>|zR*OCX?$05&!5@q*8!E%w+{cF1fp9QNWe`qWx;nO zsV}AW_e78cIF7%`T>5RKhH@H;jmUyR7>k1R?bK_OaEplRh#i<~FT`BU%VyrPr3=;v_UY`Lzn$N_CP5=m;atRa zWH9D;S&lr4e>Y7f)^nW$$-~~45T;g(J19!6D;IUxcnUZnT!Gq5s(75EKlB7vV6r*Z zJJ@8{Za4nc?-Le1nJWhu5fi%aG^YrEKOE{uya6k7{Hs!jy}Uv-i|e>-7kA)1RiImU zD3|=D{~P=v)C_NE*4YqR(tjk~_&uNrQq&R#F;GZUlje&yhV7mrVHL_@d@cF2TNEfH z(fO5@|Jx)a)}BtXn^OYesq+QAw`~REYj{vfj24x(J~TE7hX1+6pT)b;;>%f9A)(7t zwg+nTWq|!gwaQ9^nV>?z5@i(g1B6KDVR&leY=Re_VN98JL_pYA)$qVa*+L@9X81q~ z^xI?i+DafrG}V7{k-K%&^kiHevK4d1{y1Y^3UP~u*k!upGIf;CK&Aoa-Rog0!k6|@ zi{eBq=E;O|{j%6jn)yeEW3O`RAJ=w=H&lPznVgYSPKdzW4Q2;&iV@ap<<#rh4cWWs zGO@B`*S(v)KRP*A`d;(J6>!ehixuulyFEd(m;b8|7O`dIkTR3b2r?(VM#Pq!E{4=9 zXfMtdp_(6Nrl^M3a$N;%Ji0T~zV%hwow?YAd4lLK?H#{a5B|g~X zu4wGl5$VJcyHNy!LAO0-=wmk4C{@8j6jfvxuZ2;IT0@?- z#Vb0p0W>a+X-H zg|#Y;cSDACly(n3n$wBUD6H*s;@sq8I{OpBT60+XX=1Tf> z#BO`)BHW9Zx&9&b>NIpIE?fc*f-XRk+=&sRoUTH&wxtmmSO!2AN7&)F-jO&Xjjgux8FY&&X;!ObHp2Vh0>3X@?QIzb%_PB$@rJ?=PT{$N3r+4 zaii9z*h|=yn-QWaIx{*2VJuqHD&rf-ATWDqx$|}lT&!*WFqqHVNUNQhvD+Y;2K>&3 z?9+bw+9a5nn4Gja)Kx$F$D6iLq${A75bDil;|!$z|b zcqTN5vCg@@?Ss3|w)WkmNVkNm%qo^0G82wAfgXGq_%pM#x;+{OlC&b>Q6pGoM}1Ml z5?K@vFzu`SA$)GL{h@w!0>w!Wk#-rxb&5wwNzS3*eg6|eP$FmNQwC2bivywlNSwp= zhAmjMUa{ZcHDFsvH>8T9)^(bCFOpNFAZ!}fwptuLEJE?(S6e4}EOj0PRC*%y1O`ldYp&T?QZ4cke5{V-72t_W1q) z!%{L~&lc3nkR$>q1oXgPF|trxVWU@LE;E|AW>g%n@g=)&+W7%j-s6iFsk$~fTRga< zW`Rk;A@yYARTIC#4uyM>5UeWrpkS#)p>i^JN0}e_;S6WzLygto+N+BrD5aS0w9|h2 zi*DVwuECK1CAyXF^gwBf8s1NMN+(YTMx@W(iC~p!)NGF+Wb!FnxY@##I`$5_>#E@% z1|say-il6Zpfo`Epr`(Z(u$`zrDz^3H&;D2XL1+iW9e_*=V3c{Q;*Q$W`e<63AMd+ zgw|BLCuT(|QWJb&6nGPAYbodq{p1tPF(M!C$vlQ!Tr_^9hX2O3cw2*FMka>$b%H{Y zLDoukGmb?~4~^P9LK=;0+jsxRo9jn6ltg{2Iw-;ylk<(E`E&C8-^#7@f@8d0wHE_i^nyDk`B4DbO9S)@j-`Im*YPKS8ey*RmZ5}5T@;WgNO&i6@CUt2M@Zg%aL+|bEQDuJ z6m##(9FNI3tP-mW|LKs7!YPZGgS8g4HBUB9z56C`e5uBU;C1G}-iVG0oFm{{`(9K? zwV5bW$vY^GcF6hk6ml?ivyOWTy+{@u$h!;>q#?&8xe-Z_}qv1=PoM}9EJXliqHSTU@d!tz|S zG6pMA@!GTa*Z>_o;BNr0+Mvld#}GG}rKuCEB{irF*fA3raVg^&_e)5I5FJ;n%oH%R znE058h2RI=&>Y2}fEVI?bbTi8+_aK7KTbTT@d-J)-XDD~OeWb9UdvZl?MOa2l-E8| z*wFn-B1jc$c_*amw;+s7bRh_b`T1;5$eJ;(+m4k~)9*5{KvJxET&0PlZW03-`e;xK z*Bmt7O^go~2gLPHw=rVBfCjIzzrYe=NdWdIC+mXiNV3^)>XL{ z{ruwPPR+Yc;J)!``pNx=Kz=iisprz$*3(x;!ksKph_$<8Bn`u-o$2ZPmP1X*SV@QG zbOV2?E~AI^FFN5#Wxq7{Ab(|>o(d0e7}`oH^h?@F&SnG7UiHICF`Dy z%O!x2?4}uaNmJDNhI%MZ{b%h#;6R(B0h-Zv_rYXR&T%|HBS;anUYQZxKybaVHz-^= zyM>J3<6_jS^}?*idtgvM$TyARl7Fge2=4tC9;@I`?ww4rF#u(AtB6b%P5;14_Q>q~ z)B4Fryz!ap?G>$8tqAOY59|MUN|?Es|6d)H{XeCN|7nA=bN_c6^p}>d{kjC^NYAMz zd>~i>tTP*y{z957ZnNXpD3_&QTN4*fB8y;VR~t*fIB?y<{BK6aJd~4px@DLY6gAwL z`@cu|9U+Pw${dghEL;TVKkUB;XBsHqDRzi6rX{V)mjPNely1!8B%(%>j_5@PZo6-{ zQv-VXUlSbI;IuEDa8Dv02|zkaT^%Y-f5HD^WRBiaUfe? z-I|><#!Trej$Ysf1$0W#2#pl>+O(AnP8G#~d;xQmg2y1N{*=j$q%mKW{CfFClNC5E z=gB_I_c@C66EX`<$Gx&Mlt}G!vNS03(IroyJ`BK#EBdqF{=w8)(6l;EjR-yvFPou# z?Wo>q)%uHQqfn0JNf;mMFM^0Hj9uX2TdBvItTBGDYP=i5=RRzP#%K;|#v_(lgp5_e ztmq!v!vzfd-5(uqZXE83ehOUwVbIvghT$1a`&ulls03?1t{bZq3kv5XI_ImTd!ydQ zN?srg`wYK>fM9=z3sEX-QE=bG;%;Zz9M4|hnQJ$=sfX=yjXj5vtuVc@fVK88s@9&N zCJoEJR^jSoGeB#2vC!q0SO}qfB#0`ZEx6`Er3u3_SyWqC`_?LNomAK-TYqj?P#gbc zycY7YflDm)BfB|ne3ZaDI-10~o?Z)5`x+1}aw-{rHI4e<*t+(I%)LLaZ1|$O$eAOC z1cfdfpQQ1mcH-(=KyXL2rA6ZK`Y|81^Iu^!(w|@+V^LriX7u^cOA^t2*bwQhczm70 z_{#IIc!sr=kC$>8BznAuo37xR5)2T)YH)Jo$elbH_4uQwU%#}uohe2)S;l3?}O$C zjeoym4(M<|R8f1N+{!8N2{A37Z49D@eG*=yAdfZt&FXSQE^c&NnB%*^^{TA)tL&=8 z;6&EUop;fw=2k^yBae-=TCA`Mhl3WFc`dH%8x{5#Kt|vPHTFO0!ep`dm+XnlvZ0+a z!jQ$L^+)*NPXZVLTODcMtAdI(T%GoLL;6lSf~Q0{rG=mFD`>2@(?vV$Cb<*6&Lh4P zq~)Kr>B6Ffe7Q1mMq>7ivIUy0leTSUd~hmE1dkQV5@w zm@21GlLDJWwsm8w;WWIWn@`k|bgnxLG5zf-YCmTyCP$!*!p8$F3hj7BN74 zXHXrqgZuVeQP0 z4o$w;mRT&0F!UzBNej$Gv1kYR-W~1lk2P^23jgXt8>z}0$m>y0I9pzM zg6UZ+shOKT6ezH7H(?H<8#YU^QPH5oAo;v^s}_@aK?wt=QEnaazcunDoWn(qv73oO zQ^Gmg%Mxie;ng6(+1$tPJ+`tok)TB^+@zTDu;Is16g$fm?Fr9kzznY)G+hs*{ zX|brx@_>NtH29UwjkFZ2{biv5rhI0ASjg*_kp*{gwY$-!C`iuM z^6PkfoF@$qb+G@x3qlZWl6ki|CD5m8FEWWKLKIQg?<#630UB{&d6_l8QA|5CaSOFn5$Vn}0>~*O zRj`9D7>VFgBC}=Xi=CICnO7YMq~oLlx)`?mLK9Q`T#&ft@S_p}-K;+LyWtiHANJ=f z$&c0R4#J)E=f6@=&@gL|sjtjq{uRlg=>U9%fuxZY1{aaH#O z>dsbz6#AWTi8jP7TBBPW(n_=P5CCLOb@AW`I`W>8d*Zu2Y*BwsNwB*E0oxRNcHyi< zx!$`mN9BZX3M{>J6H|2CQ59sW$W$i6gIqsKbJ?kCz=cuV3;%Y2P{CON{k@m2KyRtW zrp&N#C@hsQN@ePRnszTt8boheVI>j`?A#sr_T7w}%S|O0Au#?J;2Uk5mv| z6>J+2z{_-ce#Sbr2n>jYjK=5a<9OXf^upJo*RzmZ zHcB$)2nlOsK)w`pv#sEB3`pwXfAFK?UC_tRpG{TX=)aV{9Ge8wsoD`|Rux-3E;9po?5|;Rmv`>czzfPt@`-NG5x!W$ z4DJrosou2VyWy%J9C8kOHiD#xQGYnmx1!J~Dap$qPU=9>fljw%yIZt$(6Ae{=!~G% zQlW`&lBcCrHNNYI@`|C)0>srzs=XP0pCV$J?&`XlYMgPPQ>zrv`|yuHFgvX?Z_=Uu zF26D<~30GfCN6^WMKsN|MzOo{h#VHH#^gR zNG}eS|NHTOR(p=5JWeV=K52s^vHPjk@TbLqdZT;fG zcMQlUO+kIf2WzH})-}l9-u9O_GYP>Bo0@xLLQ~Q)*x$FLZL4~~F!P?uH_p+@VZir} zrpxoD8oKvmxwhwZukm^-@BQR~6zGQ6&v_|Wqqp~KLscGtNEQA2Vs&G?n*5~xl;Jgy zxNYuA;Y{hN91Ztkf1)gg#HBw;RzozD{Y#}xe&SHcE@-r+WO*ZDV-*;tN(t|d1cV$^)cQEFUQS3 zUZUShO1FG=UGt-x|NOzq8qo+td&4WxSOeYCG#LOm1yT>y_weYk@N6riC>0kRcd~T7 zKYnxY8MjM)^;L&W)|1y?TPnlCa!Sonn>>mDm+KOqn|{tvG9y3Nv>uhCd#->)IX}&P$x_vkp`t!iD* z-_(>>Lh@B&ue@v`vJ#SCZV^>F%TvZ1XTN(y3X#Lc0yw~N{@QSh`_S$@a}|~21+Z%jTAJ^(-%Ssi?5pZ<94+*9 zvT1;$>U42&zL7m+yU-6yhq_!@n@I;mD2v9u8QJIs_PEmc8rjQlxQIvx`RBOCA#gqR zr!_=1K`dI$@~YLzq^?BguIl2`z06zmS4wy_6uf<&c>bS1f;3IhqRNByCrVpYO1EwEb>Ia_&&(%#B-(O&)x5Q%0!Fy!uVdT3|(MjXGt_HOSRTw^2D z(rswD(GceH9C;?8VzBLC3X>yAAxhJzXup#Yj3Bv3DdI5A6hWJNG;%lg4AEElXwrcY zIM>{AdQljGG>Hg=*4Cw;Vj)c++#XB*{U;t7$vaZtbB^7FwULhOJ77!JTrQ>|Fmywu z6B&9&^EOdDT;(Gmu(kTzg*#!!Da$%)mVQey(78O4Pkvi^Si4Y=pv&fGmm^gPta-Un zLaQubTd|DP;uKx#R{a;r6a$B*qmBm9s1BiE2eSq!P^RFI-tb8#_k(J2P)ZB-xtg{9 zq1jUu8dOLl!dUtQ)z_vMR7Dvh!&57q6@Ew>?>FCP&@L!cN1vUUf;t|R{V%rCQwu&iK$=B?-wWWwg+N@-}*cIYiQG;&|k7B3#tZoM+priXt zfFa75HuNrD#S&$Jkc%=nn{lpY+hQra1Aecug8Z zMRJ+y|D@PSWLeSFGbqYr6P^A04q}>BhL4}=x>Vk~Mq#CnZsz1TG#40#dvxaSQd}!! zu_Ff^Op2D9`|TlA|AGcg#zqZzeE%pY%BS!XxGc054)hx%OyZc$#7h1i8@Vdq45fM@ z{5+ORG#&1O!mnp-XAkW|XG{0n5ynk&+`V{{@T7z|QlytKmu6{l(1~}-E0&>b><-6H z;watoHked8=Cw4{AFj^Ef0caz9B+PLf^r=9Kw*z~Kskklv$s=kWBUdu*|cj8@=(bS zCz~X}$R#+1eQ_VzHF4qYAnXj?9h5tQi_39@NCEHpe1v7@jJRDmvG|kh{(y9FdSvTb z)$)LayN^Qw(zi@T#u3$MitIB=zjwXGY5{&lRbs=E&wLxzmUs_lX@n`yy%0<4qUeK) za9rc30&>udNt^Gxa>X5{OV&fi?{K%i9w0w6n4yj0D#Ei>gAzKH@8OFt{wjE6n5l3F z@_S}WM?}A1-tn=iRp`9NCI+94bi`eE(qTx<&$g@+rqq3RUwU)_%u9=fLf((DEqMf4 z0t%nso8yqazgeQJ%dEE?yadw8O8gkix2mR63q*TC)m*PQXNZ_AJ?++SXhgGMR=vo^ z!nP;`8Ks^sxdWqE5KphrERxDLE-Cw=O|wy$0JTvx?TR5~uSgQS>!{&mzA>zxRW^nt zN!P(!(DStP<=fH)7F}6jhy9?l>Ph1W9*Aocy-4!Fn*NG{tZiOZV(dN|d-o};71?mu z7A6E;JIy}s)huZS(b##~F$`f}b{rX~9&}fBUBq{lf0dtI3t-3E%juuX!l1i5GF+@8 zAK3D*7iAa0rM!w{F{l*=?jpXcZ2tBqMI%ze&9R8P!=iZrxZ(=pU+xM>pdha_^~drl z9D`Q2-iG6_I4hV+-!AOmtC$o=63O9^;DMuVL+l}gBR87#Y|~}PBiMc?7mSh44@0o- z8UhJ{n-;OABgE!8F`t{PUM`J?WoCuxx;3jiQ;v<8y+yaC4>5|vMK&E7H|eR#ly;=E zc7uf6xQ-!!L-X_A9rvT$!qcvtK~0t9ZaZmBjUir!Hvjj&4p!@5il-(kD+YzFQB;;_qh9MrS=)<*fniR6 zr++Qht?HBGVf9u*=WQ5DlVWVrkg0(G?Gi-ypX8zkvimmf!%97~GB6af^}#RV--O$B z)O~CFznZ3Zy4vCmM8eE0SSRXw^9hOCGDqpI4GUNRQ2xEAe^C|ZlQ+GAuusOpH zsZJL`$vf#?#QNovLQ3eP?5!Xl7bD<6y2r`Y-WL%nYQi!gokX!<(Nh=Mv@EE^5hDMM z7RnL@8BoBUE+wfRPJ z!sRrsWduby>PcRtKK{dYAylU6c}ZR1%y#7t$WYU2tTVlKtN)%x`b)rIo@vGDN4_WB zBz4^Vv`bkzvtp+XK}W32u3kumfo*CaLltR#U&J?7sik7!egDhfZ6b0b7-Ge^xT$5| zH&^!q8;mo-*`{qtx&@Iz*p3?+CtD2DNfmb?9rH92C^*YuAF!2Xf5_bRz%^FRjH!_l z0``;-@Mo0<*UoH@!r{nAip&b(KarVMyDEV>VeEUP3!~1GxeQ!}AYIq65>R^9%}#{L z=unlA0%z@hd4Wk!o9mvNfp{{=NZBVw7w>I7=rt7om`IccWDGZ^&J`{uA>rf*6hg~@ z(@;#)vdxovl5Ny7H92z?o*$UJkTy_;fO&H$IH)i>{_#pHG(pb#_b6v)0_%c9e{7~Z zMiJC?iDz2(54(woYSc{nMYgf#j@ zKPY+rF53?uN_qgbbbZ*hdlHnHyF*56^+0!I*JXp!i0!wgk+}KaS<`ytufIQ915K)2 zhhL_cLpjP&`J$V<+FB(n6h(T#+z>@Ec#_~A`?lVXj^ zC?m~h@T>&}SZV9YlhY}y~Hj zwHT~7lgLGdxgkM_^7TnED~}?ouJVB9Y#+9j=N;U zBMWj&LIi<&kEwto8?F#y7Wk<<;(l4vMx1Fl6B;X)mJ#mHB#>9?y;x>go?|XAfSBp) zNM79CfM-wqJ*j-;6g2$%y#Bk?N|y)3-AQ89P!z@>d*b0uZ#L+$i8S{=8h4;dN|eseQh(R^(v(w%Gcf`y(scsp+@|K!dmc%EcfAOrL3Y&6euFs^36 zwqC=pmh839dPvVJ*e=Vj@67b1euYZwd=w>)sG;sb$1Q_jBSuqz5^Pf}_|V8Qb5c`T zBQ%^&Q9TKKEXeF;2S%F~AY!;^&nL6TLR_|lPLZ%<)9gE)U;G>EAf;g8T+xCsnaaj| zci5QnMZQhaUbUp)<%N=_o|2W!rJqKL81KjA5;ty#{>-cZ?lUR~Zjy62$qNye_%Z7R z7c+t22qxj6S$sEl42=5q_A2-u=LXU^V5YJ5+7EMnox8yU*b|o;y9?Z5gsLJ8Tp@sy z{G+V3;A7*aFrFJ@*ZmXnfYkJ$W>cVfBG@l-ci5c0;PYqW2017OS(VZCw~&@xix$GF z^hmmqYT@o&tu)0SLZHT#exFKCGw58ByF`1xU9X4kOe0%nLfMDH$sfwbekk1t3#0j( z5(?5lU!7IV06T93>UxSLoV3x6Qju!IB^J854``58db+v*;hv?f{##V z*C_Iy1*)8dLo$2?Xto2t;Y^$_%j6XgX2gAwn`Ah-vN<%E{D)-Hd6|*rUKW>+a=}gq zFv2D(ZSAG=hd;vYDXspZzf%?ZuBZxDL=?VP$Oc%%0?5K7g;}N9-?)-*UqXpNguWcN z;vO^04e^#;@Xjw4w6vI8YVMl_=L!L1wcseAw4mZFX>_^{At*C;H6Li7A5b_-NPYk7 z2Eg$j^&J}%^Z(oc{$r>9|84-Fod1>YCFM&Z0wrpa!O&m!DVNAfayv9#i}H)+$C%I( z!w7cq1_-m^_ceRYf3*MNT0x)_3v+tpMl@2LEcxwsq%(zTj3zuRoc-$7=_-9(U0)r} z0@~j%-bV3gyKssQipu`^b-j3s5g@5*AwF`Do%v>u>gxNJ|20IaPDFuYCR1LdL%uqo zmFywDHabRrAE5ZE#@pf^g>i}It?T#+bdwfG^pzwV?m~^3_pEI%$ko&loR9N&D3S1u zY>Y$^%}>Jx4o-J_an>nPoBOSFy*JG|0^-TJxKvHr%n`bSD2QK%;Ojnuio(to7Ulc~ znn$yk%ShPavgi$4gH7}BaS?0!fB+MWFTtbzoUe1J znD({E`3oXDsH8mf8w$lH^9z?#7soo~Bv)8+z9@r7_RSQrLe>kS8{drS=q@r$t-|0h z&=PVhc(h4!35DA7`l<7rVL6aszdrhmh9n}SKE z87k5ei6oLGU-)2@gU}D~(G%NDMJUrT{P#qoQ|lT`-uv&|F;S4|o&o*ddS#?$B*S+5 zx#%a&kfW@W46&rRT1Y3MWQ0_mNyduK$E-KsD#u)Y^(0-pVH{QW03F{7eY~Pyu9X~1 z5j{s66Ezd%&d_BF7>L`iYsW@s1MtH-{_OQ|LEkg)(OmT9RY=V15QE6;+`OO+i*yR5 zfSccuaCqWPhXuDn7-%|XO6yGgOCLxbdZ;c!P&D;-uPbFia58ZWL9K5n-U^vRla8Prq&P4xXQf$*m+KV$8b9r3_cMw`Wy z^o8cw2t;pCuVqE)y_9vNYNjGXJHBis=a}@>mKs_4oeY>`nvBTA5*dJ0t4%a)w`kMv z)Nd)99g2c`A3qY>ogC4Y>mk$$uefRMS+{L7$W+OR*=HFJ0QDafow;B9?3ArD&~>qq zdXzP|UcM#a0K|n~Tqn;2<3WxjiY0?bIio>)#tAqXfpwZcqIMYqMW)3>Ds}L6b50#@Avp^taTZw;JvjGybCFrP zVBE^iZM57k(AoTiJ{mX2dzD$d(Z#PI4KvZ6Z#W5ULUUSmGIlhQTe17Ju#h1t zD>|L(W4L6uRxc3PCH6vT7n}uaX*~Y?c`U=AqO#t`G7qv_if_z{9_MIf=nI74av8Cs~2s#P+MODs;TC=mxN zR0?xc)@XZ`?=@DbOPwtlc%m%#)Az>Blhn!L`qT;|#O8XLCuVu?wHd`bV?CWF18B+p znG4nGmABR8F@?`KLCkl3RstsDP`pt@`m0!6>b4N!Tls(u$M&DdbM5O|zETIV;k!+C z{$iNG+JkUfLWitczl=JN;Vdd&KL_aPw+=ot2{cPSD^DhxBJewFwhTdQW*p0escls; zRxWgoUJd+1My|ANCB>~IKMV2g>yf?Z(`yrs-_yr#MZGE0aYGKnTsu^aEKS#mw|8OI zcydV3?7je9oMCe~e{w5OsLaq+bTIpZI?Yacab0Xo1PqSV1$P=l#j;BaPvzC*P#1oy z7$%x~wYx6rbK~|9NI|pq9h=05xy9}z_$)G&VuQZebKo2tlErkCa zjRfg=h-xz(8S#^~ab{}VmiXo(2RdLY=x8^gC3S(`U2Woc?dWThh}39S z(ow-=wAZIn6vIZ>#(OuDF0e4hwQ%^^{&4o?7)`Wc4SRH7s2ed|@EK%g0iNq_nDnd; z8CSql;*g6Z^$r8JS3bes+a6n`Wm`sG&h%!%!iRa%GGXxz4!Wk2g6L6^7^B_>pwG^r zQ3PA>whl^4IF81S)6S!Kp+)`{RM)^M805EQe}UJu*Pos@Z}tHFjUsdZ<>Ii%i7g|&twB*F_`1h80p`Xb zIu`z1p`D?D7n4R7?8vk9YnOKWA6hqI-O7;uKam}mHAz5b=#I$ z?snvG)O#N)?JdOfjg}^Zzc@Y;x_;z*<53Kl`f?2U!*y4Ow+6s)ac{EhQoZ@S*#H2T zGb6#)BT|A6kPZY1wL+CCuHpMUY|kL-4JRLRSFj2r^U<)Frwi0HDom5PQAA|!S_QjC zbsAsiQVx36?B;f6KB4128Q6V1b_k|68JM8`%ft#Oblhv0a+IcP&c1VD{rH{w`9)w3 zactDr4QD<&T;J&1x`+IQ8oeX6uofXeP+Ij9>5O*HB5q#oaCMY2+qMs=-KRQ>Mdj3p z*x#;cw&goR?* zX9ar;RD^{JCHX?>&7}#S8LAip>%r2bE(&}smMy|HQb=z+@kQGJJ;MAO5ojaoQIe)&}x?7>m zM2x#MJ0oTCUJHh#Y;TMGOv}T(q!3t_U8S1~AHaV8*~+w~xPSB)z~V>xygR2J#C6ER zzI>0ovakvY3xT9nv(OEW2aFh?YA5q<=fgU0_m(?LcihK@e_4A%_SE$H0O?ZGhuAD`g(B1Z`vN9eBBZYb=M#p42 z*oZ^JrSev=d`d?SDh2RWakZY_HL7xi!U^FCEK=|zs2oTW(l^+mXG;GhP72}A%q5ep zmNoL#e|iZyqR=}Fm&Dq(Y#~2?%W9eeMX%2DwCd@4@7J}3ySIPI7D6t8pRIwNjY{DN z>=nHVWtLj9Jw9L+=pX&YN$}Q4@jhVH;b6Oy^w38I63`(*!3(&|2|zMCxmKSilN>4D zjGMUz8|~o?;6?h>BI^2BLqTdMM&00r@oE2OeiaAq)K5+J-X`CG+Uyb$m>2|?+;Ns* z71D79LmRzL7`1dx2cKn6_ku;fpuy<~v&1+0-dJ35BJUXKP#K&shZ_=1ow(~MZdbC% zNL%HQU6B*Q>2H93by9J7salrbOPxCBxEDAXAMhW^>_#`dV~tEPtXtT3hsq`w`owoQ?NPpFehigJqQm^9IZDJQZKOWA|* zFs!F;)9n68q+AC9#%u9@Idl$62$^v*7K1LyP)6oc?5zfjkPE3F!4lFgcYIHpf#qYw z`6X-$^Bx*8f9J%0oAg;d+F!7qxM6X3sA$G{xZ6&G)z*s1wzB;OW_FS-vmSj%KCtHV z=bOj3Bk=E!{@3V60O=u>;<2_`HvXnuFG|1PL}v#kb3$gIDWx0lj%F-P&KFkZ^NvN#p98zCCBs&2gbCCtdG>t ziKmXb14oDb7*x-1>f6R63zj|HL3GhW)EW3b_EjGGIp?p5i)!Scz%+BokIFn3QJbP1);*>4Cj@XWr1SQ*eMfS5`VU=uUPTHd&bvE#)T5b_$i^ zo@I*zWS4jVON~Gfp!C~?X3xvFg=>5v&x%_MFCu1@_uu%~8+vvZI4(?P1_KT?TaaL> zo>tlw30Q<)$_s0X01*T6Os!n}x=tXS;rc)TPZOrq{BxPlP=)6m(Y{(n>$+8z{pBIh z_DYc6RI1cw5WS)-bgO%~ulu-GSo!A1x@7`0tj`pfa2^uh6FW-xO63fq z1)u!s^3vT_=zj2~i{Y*o=MFmr(+*?aj*ha_63^*JM!4RaX=7__y*1|s!6Ah>ThRXm z2>ns1G?pZk*wWHFnRto*ME=(^GH$C3a-Gv(bt|DYTD5zNjlG^_&&^U@ZbzMf8+Vb$ zJ1bMwiWFm%`3;osfxrN7OZ^f*_Xrj>y2?I}c*8A`^*)1gr-J|j{tD{QYoAZadn3RD z?Y=*kkRb&9iS%?<{L?dAH#YTBUKBw6w3$=&HzaI?M-;Vp+vc4cRhS)R_@L6mv{iuI z=;(daepH`uQvlb4-*7J1>NlO2fS|;8dQUg|iJ5ir0?!<6Yq)AyS-s0CovDLZK zuG2{hk`ajQE+y}K=5IjZ>i+m4L02Igsx8H)%=uq3rSuBN(=WqqDn`HWcf|q4Pz)jE zXu2l^(Td>Z1T~(WMCuD{9%}^=I?Ke#!jTX`vIP?&Dr$)RLvRPYT&8r|&f$?x< zC|DSc#zN?aLu6x?_H9j6anAdG;$E3{RYiCDL~_=f^RtcHrx^`^tUc$+3+!I`&r!A^ z&;&R*oa%K>w@&#-f7(jtq*eq;kd_Zm#6@PStL@ze$8uVKPT%Z}6pQv-mT(@ly{jMu zc}fu*i_6pTvyC8{97=CIWa+@r89Sd5JtYPStiV#cAv@0+rycV6CT^VkP7JZ>mXObb zfMBuo$@gE!*EXR5FyQ*u_x0Cw#Y_-?SMR zDRZkpy?M0sV$X9jVhl`S0`B4XZU4kY7fk`SvF%u$NCFUvu3DnrNGqpB4)fGrs87E9v8t{AE5 z64SbMTV_!Gnxz3Oi~Ug7U$fMGWTZP z1X`OI9I6)qyE*zZxm+Z4Tk&?^syDVq z!?=y;?&>gk95F&h>X#4~(|A^^hh3P%7wTL4WomnwchVw4dhOqm2*B?mD@Ch;Mz>u? z91^|&l;ES@s&@X~Q>+kV=46q%t+c0tUXlc%2sG%oUs-M|-(^+yB3x>+zv4^IhM8~L zol=Hw*JnPyKuwnR0IDY~DzbDnx4y@RA@UYN)muc6O?m52^>*#=?r;1YYzO%tcL)mS zG)oihy5U=tKj@8^s#pQBu}?6Ac4UkffX$wfSe4N-G}uuhY^3G=RA-^FGqb0&(JSI0=Zi{ zgW#adM{d+z%OY22@<2cQ)g{QJT~q^J#6g1g)gxy@P@3ccvcntJO_r_y*uDwCZ{Qmk zXrLi`%Pjl#)bN&nGeKiLZ|)nfpdJ7%P$(TDEiJS%RD#F23}v0+tG;?og0eL z@;&W5gbSyvrT4UcZuP#+dWv}`z^K#q+-EY?vNOc4i%e*N zr+;n6&!iGq^!|W2K=c0CF@PM@{>KFZk33wR$2@|#c4?IYo#OIBvRH1mHglAjB-`&m z=PPC$1vyF8j(HO>1M*4C7r2r21i~1|GZfzE)O~+P68a6zRoHr9?!ay4>gHnp+5X?2 z!oNyu*_he6|2_Dxj_&`vozDfl`a}u%sMYxZv>E<4pbbNE`}c0U(w%SCmaHqw467E= z!AVwnarAA;1WSJaZJz!B+IS_2)8IBqfRQIsU+Z_@_#a$y?S2mCe=>b9eaVdY*0^OM zE+Db5)Gk%G*f?ZQPF&5!)|HVTSxEhvTXDum$Ti^EWv|w8Q}tmA(DC%Vq$B-xn!n90 zXDS${F|y#!dSAcWqsQR=aWiUb`p5BllL?a+dfu;PQ=jIWv~)kZW9)0hAyC~iHYmPC zau)b6E!U}3Mu{MEtwL12EZP*)KlhTbtxQt*hmk8*hFB%K-2~+K;$zkZxsRWT`q*I; zCq(at?)IE&6KLdq0lxn#@%!3JG3X}?8!wtbmag2qJy7brHjvvcF~s&DlFhJHJ?bOK zKdbj%=d~%N)CS!_vX?*)PS_tuzzEa+S6FJ|_a6anp#y+Mkp|AB?`G3^Lsk`n>V*Vy=JO>J*m$&+5lO0yF28tU5o{QlsTrU zn7k>=$<9Csw&|08hxG+pA0ugb=AweV$&OEE1nQOqWA&fPi}J`H3gLr z6oI@wdoDAV!eV&H#jZ(@z%_P;) zMjUrP)DaJaEhMV)UeN?LCE@srbxKJe-z;b4q~Z~UDII4DYVT?J zvMM!+M6Gx24O4q1pf}kg3=l{3NpykEQ!)XP-O|QowS|zU>4;A~}9^hhXq1P`@nK)fCOphBT-a%|6_Y(5XE8%g&J=q^(EohJn&PS7Oxyg zxhB}SACWkSq-eGRpIM-2o3Dr#j?xXh({W|U&t8BwtktxXCFrjr>T{<*R5p@;zEqn)7jPTcW2S|B_#siiyPKh?RH1?d2Ij+*nWqTp?#@CLk4JBV$TsJ47HQTj0BH# z)2FsyB<3>+cQaZBH_v&VvKAi@#A9L$k`&%l(IIICoY2%w zy`B`WntKFz($huVuA5pTQ2z9xa2+NBz0#YUFqM3D67Z^PR_Nud`F#2gj#+d*o&icj z1sn)li^7+xld>$(*Ef;Gyj0k^($D}dr&25erwJ62d4e;tnw68-AFEg|#pzb)vK19~ z`rR@(?%zfPv}V`EgT=QG1c#pdpW9t)vd^K4lA%LB1d>T~B~p^nIp2 z>4J{9+Bc>rLz20mNYPOocak7Uq%#+l8{Q2a21rQu2Ze{H0A}CA?Xbye1$HF_s4Jw1 zqyyLc&OXoYmQciogV}SIXn1Ex%J4lO+w8jgvl(g1r$b%BIY=JTMFm$)Gdg2|*)A{_ z{(Tb>6*&+tn8@_^ZNFvso;(1xQ^iQra^}{X-Su%H-4iweS&N#}C~#&dza@(?F>;Xd zkC46jDl08dJxs00iXX)0qF~v-p^0i0HB8g~NU<>YE{WVAG_d-ysu<^%Vk4 zXJK_|No@8ygwZ{5XE2%evpTYl@lXuCyJ!mGX>MQ$F5t0x%w%z*+GT>#UQqwQ=;yPtxQpO6EKha3)4hx6;VwRCq zPZq=5pE01$1>0x6q&s_sVvd+8rfYV+)Bjw44Nm4jdq|C`M*ELT(Os!G7qtS;rL1l2 zP9gRJiYa@EEUk+SnDY+@;UsPu(MA18aI0SpPlVdw0;v}*-XQD1CA#&Yq7;=fIkEWp zRDg=Mv9;rsoR~sDbfYOfAKvWp8?dG;dK^4>OFqK<+ z)_=$+koF>uCB_Es3$4M~DUp8x8uLCY8r8iXjxlE>Zo{mGxSbQKdE z|6xFH$x_Dnl{wys-K{4vWS?Z#4;&B4YF#Ta{|=juyomfxc)Fe(B0mW=D={EiV;o)t z_lrqcZ9JU{KndT_>cy0^cYk{Ji!*Z>1YVM?ZXQ+EP_Db$AwBC=Yv9o=n>=TmC~SKU z6I5kfz6uc(W=3V%oGpa+(U84!b}lmy*=?=>8SeE}nN$Y4pmVPiG4`KmpFQiEpVxq&s~x+RP<}!W~U8tEMeAs~Ra(P%?f% z*p4uBOTAo-hrO?rAtRQ8d$k(r8tMwh@TBKAu=GNM4CF5o@Otcp4#QK;3I1pZGtgiZ z8HECefX>>YgbIhdYgY6d>_(JI(dh}7*@s|5z9)WpnA_KR7P1Of(4xKiVeQpLDXZ&7 zjKQDO3!mXV2j5OMg5=v9wwyRbh65^a$4aD;nx8HO$=`Uq9SKL|uTt z_uJVx2rUt~Yb#>dg_~97)rKAyfei&zY_^9mfNx{~lpV=FzB#$y&JS3~o?mw%)d62{ z4=LuJxK1tgQCow^(EoM&ZsLgj0Mr*~vHJErb_GWVoAmvr?cWN22aD7T3 zWVb7tL^pHXfcPMRZCCT@7GzTv;whruM`cYmahRJ+$>|-tu7z>to`8MWh-Hj}CDP!z#-NEzr6pgI@Y;`$99^~gcn+<=ABe7umS3qr)`qimk? zJk5;$bAgbj>2X8`Pn`tq{X-z-Z!ndF*)};7td|U4@v{#7>38rCL)^3q-|hd|#^?H1 z)jTUV*T2(h{=*Dc_jWR80#4iLeWcaU*?t1zIl}|TZHx$6|D@xn!U+n(F^M@keDHO1 zC1Lqfrt@bE=!Agrhl+~zPmtihs966<{5$rsn7{B%+`wKNYbv%s9>IUp{)^+kJOnn@ ze`x>Bsb3XLJ6EQv8>szl{R^b2cZ-A6k6Q zKf3rY+P{@Ys&K$KAN&u^=u&b1X)^HNG=DOa{x5z!e`Rz1sapCk+P_hg|D^qB68Iq- zlk49+{`V}ofC^4rg#QR+{by~g|9oTnhx5l-7dVkJa{Qxt&VQ83`H#Lh|4}E`KiAHH zl7%Lah z*_9X==Zp%*#`1AU@`o6VjpKg~*&x|?;MjQnkOI415P^QK7=LJi1g=OB|Kb63bR`3p zxtana`w{*nj_|Lx|0V7(k3ZV_56Ogob^ZUL!2jThkM>u~{}0DHV4fnU5)fQjDte~*)VF@T=_R3E=#e~bx(adQBb0to(mTzcyQ?|m?!l-1-k zJrUJjmZ~{2ExdjFP$D{Yk&hhfrS6gbok0 zQhc>5oF5oq@;`%VkTe?i5qMZ>=00LLpO4x5g9dckCd$mZ(>td1;ITRzc^Cx+Sjg!4 zz3&?+A*|q=L%K+Y=qMpxVGwAiGIKoa zu6KHXNsykVuCuzp$xE#=)O&k=u@%hV`dtI^#s`gUgAK`GnEX|pN{RBaUkv?OURjrllea+IAIVIIZ1rwEag0<`q zaw4@rB@3pcL}x;=jl%gwVM54~8u`hPk`rYv@@NpWKWPRH8kUMI(JKsw>~Rpmgt8An z+UewXbwE1kueeTLCL;nocWQBB;!Q-NK{C2|^&T1HF@wKjEGZ5sc{?O~P8h2N5_ggK zCOw#3#h9w;mm&1r9?K1<*D8Lb!S3yiF;yA8n|v9$f$!b7uSjQJPxxJ zMa(haE%_F^#^yQAKJ}_35}PkFiuoOY`V4>8Uzc6R$HgP${iK1WP=-O;? zTt}v{!2>m~g3V0<0K6IT}HC>w(NHi!uX*hpkFh zw+d5zfh*dvk73EFqcj4KRT~I{gyF=#m5aaY)z}`VjZt?K%sfa{bFD2(H_QQiw^ZYr zKV4yOq{ydE~h~gUcg{aO|!RK9Ae27bh)|+QB-?3)DpYvYI@fT$N{9rK z2~vr&yTE7OKe}z=-176rB2mrUgz;0>Dz*`)-@pRX+Xyft6 zTM-3Idx$$-q;8FZ0$XyONBEbG2W3V{4J0_F!7BB`WWx=mD!|wQ#FVrX3z)rR5Z@XK zHN^y}p|Aw(#q80Ji@(XgqkjRnBvS%i6+haX8rMyZxoWd2O2cJkXh+5KQF9WM?|L=& zzsrP;-2LQRAJjdyKylgavV@g#ov!I?8#!AFBhkVBjkbv&Bsi*a6IY`?ejRE~4 zUL>X*Y0(EV`eJM{H>k?w9Qr#grP?7>9Z)lWspM>mwM05*u z{n_+^?{bEkvWrVjR4@-!H-9OwRKXm=dIEoSbmRd%4)o#&WP@$WE(mg*xe+j$=sr#z z@IhbX=q6CcWc&Rf|BaZ1-0I00Q_70s#+J~*GdVJoO3cPbMughNPD_cawNK1{;)R$R zzIbyy7M;hJMPgq38H}gf^p%(&*EO>;td^fs-eB^;AloR9g?!g(!m^hUZFalm8{I*j z(djeXD@=Dh!2i(MVNEJ>F3J#+y)r2=!6mxkckwA@m`O-@`1vG9fSmJ>uS~V(;@KDi zx5s**D4;X&eRNww+xQ(uUkPTUFfsz^2N>Dr@Ohe*jEAYQe|?n{7Q>E>S!84~l3YsizI5O8 zDhmCmB%&E(x3fr^armC%IJ|4tUS4qti`Av!@jXPvp${R$l%fTnb-W4NIzzOXh;KvN zYO$Q2tg2dE4en6aR>D-TQs9@9{BtJx)CQI{T+j(SIF9K0d({$tj@9Nu)6D%VoE(=8I(;vD>Zy_ zOfq~jNY~#koTPS{uh#$|e^g@}IdEcs;n>6vsmD%|EfYkrn0I2fmn2pda7Q zaF}r-?35%PH{DLE=Y!!6yQ$^h39FFo8v;PEio6eJ^bqmCU!ZR-Kbyj2Lv({U=}I|5 zBZg29n9GfY`T5Y=sUWhb>GHI&xX0i)zGo#;#xzUDS^XZ*h}5oNm6{SwE?dHDzKuAf zZ)7; zqSb_`pPz0^vw4F!bcltEz--QBwmJX?0(*#vh3^5Iw6sRPtDDw5YLwaezeBIprkA4u ztCF>xqZ3UJ%Q^Vx>1q6&zut1vl=FUTJT20t(A_M*jh#*E@Zj*hDwVP_J41_3e zs?=ZbQzy%SpE_>nWHrVLmW`p(yYfgiQqBU{-M5X) zN6C<_F}TF^QkrqAnwhsVi(meX3Yx4O&E{RZjXsqJ_P%7pYE& zy9XN>uOt&Mw2sY&5H;bs?ZzVZ%QRyu539jpXBu&fSIq!5B&uvqb38iYXrHda zu}Y@V%;YAr1ut6|!wN3~N=-{+-Fx>*>Jm{^R}29U9p#H~P+KQ<^!65H>PRf4M<)bF z>PlJrw%{a;4dJv<_>Is|)Wm69U-~#E9&SF+bsTDNCIU?C3#E>|>;WlYO;DI={qQ2q zPOhq^ra|lA1kR1}>tZz>7-f4wbNhq3SarG;av0XR%rq}Xax!HCND_C%22?O3@~sA< z0TxfH54L*gU0YK~Wpca&e<+rzd;AY-HO#2%$5VCTh>_-pm>Zh6k{}1}whN|osIs3h z^h1n?s)j0zoKQ4lEVxaNr-FI#9f_UV+qnoabSl?4;$@; zCm2yjZ5m{opOVwEUG!UOO2Vdm2s%EovMnHtv*{uEMQoywpw+~~YVL{e!tg8!Ad9NCv<`PH&Sx@@9W~Kk5{C8F-r&-$W9i;*G#NQBS5- zv30xStk0BO4>YLq2dg@vvN1uv0p`>YT|!K}#{=|6dCP%L=uAocm#YO3gVQA~z!QWO zNrMkW66NrYk`m+_s#B#?YFAt;VS=o$jNGOZjjS&2$DIU#tF>}im3n1^G`(Tfj#-;y zE@Q9YJ#~MFum)*3nPT*m!4r4LO39vUWfE}QG2h}J4TI`Y1XWg8jPysPx337oR5IjI zNeoeMEl|^aZ3lzPNL^~HHZ-*ya5|M+pS={a+ff;B@bvqUm(kL8kq(C(@`R6asadxwqA7;@E5umHIOK@VMOW>mdnJR&{z7ULU!XfpRC#MV=1*3JQcm!lj$1P zfDf26j7eglKDti@nQc?}4_PGVt3nfJ`>&I%XQ3$o{PUEQO@?0SbMUEHSGEXmp-pO!(_iY4LuWeTH1jH}Sm!Y_C+aA0y_AbWnKF(q{Mo_?OmnZM2<+-StsxFR;1# zYP#^JOkR%BA?tK=Tnx6Q`U>tu)PnUspGh)*P-gJmW1_4_vD1m$dw7$XnSurET^@r{m3#Mk-{l7-vSh zGaY*EczW#%q)E5r*r$3Y8uDGLFRB&JNO9ez!%wlH5sPx80m^9`zJWwrZ;mQi5?@Wi zoU4p&q<88{FcakIIV%&4?dXbmc_#UsFolc(A8DNiy@Uid(Orp~Idhd=q5~6V_wE{M zCbseieYC{e&`8A*;sh}9o{&}6OS0y$s$IE}s**9zd&3g$lt`=T)|TL z&5$eau@}Nw)Yv1#0kMnsn9U71@1RTrFj)E4HZNPlNz1S;i0If~G4EQYy#TM|=^Wq# z#is3>P;zhhjYsZxS<1dy&9wLT(dJh1M%8v;<&x&%ao?xQ&(46elEv>6+fdw;7x9j~ zto5DFq@}WuoI16yP{0b%c72}9;kB1nlvK(k{A3Aq7bj4|nvf&`$hhp`HD=RdKta-k zI4fAdG%qdYXqshrg%`wJ&<_@T^CNX zn;~RgL9;jmm{BXaxcy$5#W#0Qr+kO+g{NY_uBhoNzSunw5ae6YHTRIL0Sbq94d^goGH>bFhgDUu0mOBwRbJ3=2D$Mj4!e#A^ zWqmFALXC6mH{2d~5^p0y0o)4fD+f7!7?NGj|3oFXFztJ;QK?($cjRk&H|#f>r2$ z(mfpmekP=0NjZ!Os`n@qNK#pi)2X!gZkjuo`D_O(B*??V_>H&ZYg>DJ1x*_-mS+I* zIG@@n!f{MJU%)HGI3V}v7HKDljUme#Y_==X*Ql`}V#S6tbqiKVnK?)gLgrG;EZU zrxVxVjMWAr!&fySUk+e9b}{ej$_ zg@CX3=kEw834k(H-iuCtt-a7zB<9$hn-jLjY0&cwY&{$^G#7DG1-4F+B0M-dwFqg` zU*H}Rjv%$YJ)H02KDLV3t+E3h=o^z%c3g8b1w?Nv2l{0*!%A8M?uo8FJDLgQ_Zi+O zu`~6ttgjX{FY~Y2z1cl+E>#x7C8=&~v@z}nD|#XNApl3o@>xu&uZazZa<|J8%~%u2 zkt68TIqCY{eCfH==B7+5Jf#~9~v&*>r?kNLf_{o)p_XGudYXdNjm_()O4kvC=-?O%INIphjc zZx<}J-2h$er}=>e<;!N3RY!G)Ah*Kq+?t^{vM05wKK1Rnb|w6Qo%+6U;gIUC0NXuS zVWaX`BMQmSDIR&emOXeq7?vey2r7`Wbcd+@#&F$Ex3leU-LNlR;z!tIc%8x|k<cLi%|Fmm{=TP^WI+t!Pt8h>9zA zG@Pw?pEUy^E<3WvJIU<3nX6>&!LgL})cn%I`WOos52G7bmzrv@CM5|E5iMjD&Cdtl z4Bd5pX8OHGYl`Ol(4OnS60N)Pz^ag##B25QL!6cs4ANA?-0erU7sI-V7^?1@{Kn>a z;S9h@1=0HwDSb5ciz{Uz)w8s zh8OgPF!cM#&X>4VLdc`*k@8n(kN=pW-l=1ZgrX7Y_saR@n(vMR>qs)(=DWj8pHQiO z$ZbW=Zf$SfRUm>B-G1-w%{lRp$kVSo?(hPr?y|esg!b5R+o5EaMI<~JbS)4!xhwT2 z*$1^Mce33>dBliKT6BM%RkmSH7h*O7Q*di8X62Dd&ZTG2(|!5|GnIGM6Z;EXSVL%M zX4LvU&6gz%nNW6m#UbbUuFsqsQ5YMq))0)U2={Qv+>s2M{qFlqBDZIC=Y^OGvu+fi zwebfZEPE%+$Rh~@ms}=h9swCL`0aDx%jFRKUV7#65avCv9D05acQ;rKrqU?HtpIe+ zbYISLk5r%TJO3WoJD_Jg*6>FHAvlx0#pcz4f~(FiC2L zX3fPDX0s>o5{f^=!31VHFfc0{i++iAi4JW{igl~K8UdF$1oE=m5X#mAzjJW|B(NhR?cI^&`@R6cIBvL zdpDd_*z><+d#t&29@rbEo67M7gdYh}1%WEHZdk$p-mKVfukB0dIedie9Ruk`d*11o z4pyR6e`%s+g~)5=2<37p-*8v~*@UPwuZ`bA@8RQhy9w|>Ybth_)E{}e2E|5-Q#e>E zs0SE^es-rThv{06&T9L*m(smpVm&9+qiwd|)K}!5-ILJYRkV&}0r?vX;3I6~S&os* zTg`H%9qDusJVEt(3VZj7+2+o08AY|d=J<5u3!p2XcEO;mAQg{%fGfMO8LY`ObZ>NjLtyfjK-azgIMP9MZe|CJo#Lv|6TXR>{?E-aA!{ z4mv&e)MuBZK!A__S%i>P(%OhPcUo5l;+jm#`*cmG9yy)X2k!YDAbXYA_y}3wsy`%m z+ey-DIUoT=T*1j)6~9o)%MCI|1`o*A!sr>=|&$I7!fna1NUVXl|Cg>_xLnD%tqZLPd<7fzz(f8tky{2%o~IV4&VdW zbyvzu`BYF?4x^JY-z@v-@J&zZ#9kN>u<5_I8WN+$h+b4(;RG5OHZbfDaP5171(tE{sqBh70tISu2X*z7Yh+>X+)Ou?-?)y0_es+Bj$H(p6;@ zyOMeGp?GCVCBzG*wzq8+|1FuTsP6X9PUr~c2*b_AnsTy8EA^h;?uE4{)i;(72OqsR zWQzL5S)3aN=erj5MJ~E_YP3N8O}A%inRUEOg1MoP0rqnJFNfjpOL0p)vCy4kO8j4H zBS9-jnuTow9zq8(LVc%~o51;|CE<^KXk~SUG3#w<8@mz8)rp})@_z(eKi>rQdoN`m zJAngUf3~BZ`ea&V^yN*QB9r}?x_aw0s3)u`$POS1vdvAhdf^ZpC;g1{`nhn|g9V$& znZz{<9^lEGcUi!s0~+gNs`8)}Ob?`Ikjn|46ATq6D4w+rLb3`w_On;9RZ`q%K`j=I zxDWKc4er8UEH%%lG!<8Arr9?W9vQ=oA`Ov2Cfc&*c9ryd^;&?u1X)i)c+Nw@bE*?z zQdijC8s$cCSH;-^zj^j>g2bEU2HA2xm+OZt zk=XNu&dx*4KsBha4uUNVE!|sk#||ec@XDlUKfGx%`$Ir)^X?gmQBZB(swKK=TyK)l zF3%yGmdUg;=Cd*G%3J>qc1N6ADgSuhHJZpP@i%;{c;IC@-~WWMfh-lYA9*196~f>w zA215J6`H`Gn>aw2$}Kdmzo`ZP5hmvO6JZ8$aPsi{XP{UIT3vmqUGUQ+&xjR$EHvm8 zL6IZ{C%p&-Dr~+<0gVC*A{br;Ekf5P61zm!fte~q(4k1e92JB8k zdqO%{Sr7LJqp><|o?Ul~E^WpZ={`h?Ak(Vl%FN>p(Ib0;we zL|*2K5O`p{znYe6CnA-(M8wQEfwQmI2k`fdN;}~rVoQmhQjaT>>uw*au}t~Ll|9`a zv7Pp}44p5x@7;{Tx-#rf=GD`9^!IY1pMrn-<^Y?;9QKNWiG$Y7z|KrRYi)Z-sWS*M za#?=~%Vb|TU{Wri<8DsC#IwRfwk+;Ks^Ip!AK1Q49h(r$+^Q?u| zV(wTQFwzQACVVi(s3&OD=x(2=SMM7sbr>8LQ%wnY9W%+wY~=j@Ei#Xd%Q@HTT`CQo z+JSxG*5f{$%eyRhDQ~inrb|hwPdo~IVA&6sY^{#QB5)>bX7R6fK!#gTt2Qud>$@Ya6BC~_TZpYFtI=T@M z0!Rz2Duq|5Qpn3-;IbvMUMP^f zZX&uw+bji;yn0U*F>3E>c}24kS-^Gw>RTvB_Jb3vES#;hEczjrHkXIk{2*A38K>6SQhDrBqY|wSmv>w6GJ7 z%>Spbua2s!>-LsZx>J#o5Q)=4DJdb{(kWRd?#EEVj$SPge8Z23<#& zLdy6RYhl@w#L0574syXY)M$YLVS8geCMzxS7#g=tr#DqXVx1>>q_! zS-pYqNv5g48I$pg(h>44kb4v!A}bs8qZPkIwds^=Mb$=~PR-|G)3$8X2lH*_rfo_g zLKLc!uRA$TaHwWhe)QpOM_zaSyDX^HA*+e18BuQ9FK)OkZb5W}=@*m{$LJODow8gz zxa(q5MFO%sOT1<27jsc*j16^8d+GJW^&jY;2OfT-Ri`+Op+C*a8KcxUm~EJ4ZwNju zWuwTIDi}sE<6yl5AL-3J-;puf4%M)%&W5?=&NuHXR;J=Er06#RXxPg(pAn;;C1LxI zAp+VaUFa+`M!dXJW^XGmiJl_M}S{-N9_R4fLySF9Qd>Yg=l|gbDN2J+RyRT1G%3<%8?N;n!d_(n0 zwNqp-P^hR-eCm`wt+eHIVT8A}PcpyfS~TFEA)PGUV-%PKADC{)jwP!yiz$6LT;qug zxkt>vm_cDhHEh|Xl5t0Jy$KbevT{8Cy&t!$g8%-rvKZG%vQI-Hs`KLAr+~P|&WwZe zc=?L^NYAV+1|dn^WCBme?3rO>qDw55WW9TLnd#XI-q>jwj+Z%%gL0wVdTa`Wl;>xIt!y7K>2N49Ix(+v;D8J z(m>n6)}GW=&O|xYycp_@zFxjqZ}eGpKYhoxDhG(_Sr>E~j1O^r3>J?2oZO|8{y-y^ zbvIp>`Jz9acG>5m%FP!+t^7yON*Cv<3(rqH;4fMVSpF7x=67Enwnt=k=-L@F4lz2@ zFGx=|6+Ri+P``s|9u4v!Ep<0pvQ zPE9%~B{VzCwNIiXEh+PM>@%cUa~q9F1CAj*ZA)%+7vd?!s8OlJwJoQ7L-K@X@xgSD zwU2=BAIGE{I|r&J2v>*4!`|=pi>I>b@#8oMOvcOYkH6ZE9<8$Ir0b{*F%()bSS%U^ z&`Tyawr0C^2IYQ3n!F_-`0+G|i4T}=Ya^5zpOR!Kcakn}xDR#5>3qsk5R~unD>a8; zX-N1nfi3_?A2lX5x-W}0mqk~dvTDcY%k8Kt#$0u;k)u6(KP&yc?ACMoT|aJzGClQx z6<&V1g~V!#et-ELJfRohTB_XrOPy3FY`JPLe_ITk^F z>PLe?yhN3O@L?Yeyg|4@+Z&vE%0sWp(C=(}V!Bj*UnHWUUkEZhZUWB*xqaeg@+ECq zsd6RpQ5k!WF-%ZKob5|-NNyHBT!DR=BuT<$fA;~fnrMas#cuzY!a}LtGIscGJjkAS zD`=)&H2_6l2!W#1IR{u|IHujeUowYkzNd-XEmjm@|IXHvdqXA^pWMJN&DpdB1+OH* z!?NeJG1-zW>T|T-=8?otdF`C_O{eF)RrDypm9tB>U16Q-`?dFjM`Ut>OCR;~0d?gcNR4C0G z+Pf{MIc`Lq+=e&=rOXKidSK~W=aec(Le^$)0^W__QUkEt->j+(eh5B-C$hE_+%Z`k ze(Qr`zFqW(%gRN->qLAgmX)Y(P#{MFdCW;tM%6XHJLoJiZ!28=LM!vJk-0$ikvDjM46LU!hxDvvna9CHu~<%9_;l zPA4F!=GC~FV?c7`ILc#>| z$=Y(6nA>ddr=niP4l$^_+y6sgPvJ{_Uml9Bq};EhCRcOnJa3cSQF;=Z!_ZfOK2V+f zp5ODn%Tl|x=TWj8pNlfx4_XgLKyL_*`kbPO(?$YEFqn1t=UGCT-DaR@# zSpr{P$sZRI8duP2BC7(uea_=fq@@U1@qTO=>H1BSs9c(b@jWDZZiDJsD5xw;Sx<-0 zFVjnVTT$}IZ>7|Ie$D-3xgo3Ym+M)mB8>w{26~Lq9CIG-J zcl`CZ67rAp-D6$_47YZ8kkIQARSSg1?OT3e8FK!-lo+O|rc~fH;6_XASo`a&=|n8h zMv(Lj8PVvS5nT`1j3@fj8)zd;T8oP95F(-d!ci-K9XgX#~nRkRv%oC zXr33tgw98)u)av+h{u155Nzb*5MbpXFini|ul?|$w6stWpTL*J;pI$1gbS(FYq2C- zE)ksLWhVb&_S}P^dYCPXn+J2kSLl|E(}Kltld!Iv`9y`EEVoXwX9>16TO$gAeY>^< z21cFj{JuOtYU+N3vH6HTH;Tq7)VF)h1NkupxhmzE-y zBI>rdM(B4oa#rp6KHa*8!+jLa#X)SG9yT{YWgGxABB6GSJcNCw{A|^ug9aWh_44OD z%el%t`Mg*quB08aSi$74NfJJtts1X(^LdPq7|`ZdP?i^Ol~VNWUp#rD^36d{n$gZu z&;xRm!I+L|{`2C@pyS4K0(0|Xz3Y)E3lu5Xf~ zyP-`GWlyGh{hh)KT_*lHQVz|9Rv%qIB+fV0@I{RihC_*o;& zlCKh4nu@-Zd7O_qP#WHSw$abrJw*7WUCmtEd5K;(N&msZu!joHqNK1jT}vf!~TJb^=Gq`c=r{$zJ`o-D4iC<}fiaGdJCxWc5+5k0ik_obrCKFYYOD z5{yHD8_J8iT%1V!gL;&E(UYU=+V=v(YI5~Js^DAiqv$knXn&u0L7)qPHNV%~Sy`G+ zn6Bazoi6kr4=wrirf$tMB8oJIJyGWofNr8)<(aUm1A-kCts_objr;r8JaX#n?7w@S zjXi85x%~X#QK|`e2vYDM_e0M6jC!d;9)3f{0))(@+?|4L0yJJI4VFZ^ycuv6v@Fw0 zC;0n*-fN7L`-%XCV8+XDncZrm^ztJxsM>w8kMAEA!>SF%Mr0Ph^_jm@*$6HrQfd-$ z!1$K#`>62YhU$ikvvjiJrfk)__RPGs+V-=P>0MFP&bWNaj@pwGg!GOPu1##G&!_D2 zp+Tj4!5TTECUA2!7W#mCoaeIhM1FQKq%d~XFS0I|83*|JeGty4d}xjEhsw-K6B5f! zlm%H6Mpza;%6_aD$qN0q$#aFu5o8@l~1i#+B*A8awf zforRIwOikN?^dXRn;e$(S$PdfKBCtD6k8_yPW0^tKEB+}vcuoh1?%7wW=Ht+A)!Gx4pNv$R@L>Wjtugp?iZoGL~9 z@>RM~mVyGR8Z#*x(M9jFWmF^CBl-xsqDQjL!bamgCv}Wflqu#H>HgH^glUa{25Bu= zR`kioNvWt&vG?Abjl=O^xw&f6d5=ieZ{nq&cC!ppC>0(kN*H>V>3Hn=h&Ir~TBRiz7kdn| z!L!YrOACLwx!5S-DZh~1Xnlj5$V>yk?jcN!0~(jWIr|4Lv1o=e9>ebTXF2H1(3aiC zdZl`g7?o>?<;lUDf9kSYh;K%wDyJ?6lunGdk9$k0OXC+Y$Ist@$gMABDk)X<_*DG4 znyQRsQkN&cSV!3Sqxm!*qp)0Yn6;6NjFG5TvmspxK0o@cM%;BVn(+x{#h+~SVVFtx z7lfF6d+B)|7&*%CjpA$K{nC*KDraC0YkeQLuSabzO{-KXQE~P2_Hp<1^gk50)++l{ z;q8=r*hMAaIqjZ2qRmZqziVFM)y^H-oxLx5r01WiU$*1NKMCL&WYI2eP}9;<|L%Mg zvPRviXZNzA%<*MK)sDrfO>+BdvK^}Cr&I`P z=*>>i;3mX>H&C%+!GYlD_$EaR7<%qnGMcv;AHC%X-Yi0n_-9Ape`l`|fPZGML2v}@ z-?P^m7K*AG)ZRqr#UIIyHv~6`^Ym{+En7p`!`Yvc5pq>C2L?(SWBLSt@{`MG^7l7e zCAjmYl$FyqD7em{>FHbCuy(Sk1<>>8-X4U5G-x@O*SL4nwscaJ>v7(Zm~NlY@498r znU}=ml56c!52Bh-7kCBI!0*xv)Z*>!o>BBR0(Ut)q+1Pb=Zm)JOq%Q%FP7Saxk&O_ z#e9UO$^x8+N=3rNX8U9Z_E{DQ&2q>)7u^|$!-=(Nh0QiJ883ZXLvs>FtdxiC!qNds z42hXr=OG@F&W=56ZhzMI<11Fid|Rtmj$$$rs=p1J{5kVQ9bvoJzxQyJ5x4H?S|&-w zyKGbd5M~D}Y%8Qh#-v2?3-GXjj7`l{_X}r7tf<>R=+e|7Z11&j8~7xWJ-Y*r!ZW1? z8ul115wWMZr|*~x8<+vQ6B2v4*jTe*YGgGLr`ffOMh$&9e`YVV>`-DtU3hOLqfyZZpkuLl?kxFWZ+eO-^UZr}TUYiGnYhm?ZAOcLWBw2YV&67OhW3SV{0JYAOpe z)iuh}A|!3lM|PbYOgL$d``q0pqWe7F{;dA~x_zVwic#J<*ln_H-}+Pn*JiaYL5hz$ zE=lIuSk4Bqz=`cZSEz)O8fBp5>j0lcjiRysHQolUzQu2}SuFRIUd`-d;T?S~+6L7h ztiRF-iW%jZyZBCbQk(=}#S<_T>0qG$D(G`jFBFl$BjuebZ5tA+Gu%{~=Z?75fAPTC zeQY%Z1&>RzxXHo(h3dQoa=z zw$pg_J83ZK)ANSPB05s^+Q_%D9ouCemP}OiRJeJ$!_`-cT=G0Za?5l^2yJuCLU$xh zWBV$Y!SI(}Z#HdA!f%z}*-L7&5t2Q&yUW!`a*V1NV^xyTw~1hF-lzN|Yr|2QWi!tl zO8wC>`pb(2rAIkicoyf2`0CAfX1`+T&HW1QxInRP4bkLtClp2Ty&12ouFG%ndKy8S zpH{6{eSzK>WWT)0K+XChAflq?t@!NxNyC%LsKBojEu{97I4wo|l)u7q<*M~?&%Nx( z3W6V?_*tv6O@+v&#DG3HRG;Rj$F)aogNnkNA34Z7xR$9elt|GRA0#TWJCPP@2U7Zf z`?&qOA(C+I)gt>vR;m(8q(Ez;hg;Sgi)0!mIWoFLKjc0i5H3pjNaK=XF(5g@4LYAx z-%e?)r&Wg6y=G;#)>FII^W57@tQJTXu(16A_50A|z_rA}H(!+Svwwz422w~>_;>tt ziijO&tHh^!9{GJn7F-&!`_aGks!pqyQfS=JFFbP# zs3ZU%i@dt zuA&~O)x)QQ_^Mtc?hgpx1pUa|^%@Yh8YSF1Ac<3kCB7Pud8X-_rxH!0#92nUOuuU% z4yqPf`_1KEN~QnN#%4lI#Uk@}+1xM<9SYx3ZP%-S%sVktFXV^yxVDIr>URFu=4So? z$R5|An+B;RK8sSys(T0TF@5UyyeaLhnA~&Ey!8;yPy_V_z6bX5&DJH~T5WE_;%F`A z2?m$ z&WCI!%xB~VuK|m9A5G<}b&_+q3A@r}ZvJo_#$aDFH`B>H11)antdy;eTd8WDoauas zwdk$w+Ev!kE2{lo@zIkcE>+-Nec>$>4Sn#@MvbhcQMZNx8=X9DBe1^yL8;BJFU5Vm zHt`R0E&Ci*-ioT6m08bC@B}o}PT~);2H-pMcrxbHVG`!(IR;`r$E<4&m|Az;rjKqI zl?`Uln|Iq4Q+*j0%SbdaL_PWor)7>x@%14^V|Pg}ekhUFx0d?zsnJvdub|dRRI=1h zywz&Ft;dgXTLnJIa_2zLhrflfbHx$5n)z8*?G+OE`_=3 zd6$2@Ul;RTbi3MnJIpcPsq}_ISwSvGogQ<>;oHV^bP6%z^6hT=M7M@r3d(Y$AD8Af zV2moYz^wN0LtK!B8NZyA^Nh!R6;X3P%KU#!-#%{n0T$q$6FYih8{Hl?nj+O!|2(r~ zP|I5Vi_*xEZiz~F$Iyej5M+&oU!m}2R3MG@&p-Mxuy#cQ&aVvHT+ulvJw3A7f&fKhO zI`3pPcy)VK9K#7*eelv2RVUXT(^Re6)@toEGYA4dUp#5+@w=+U9h5HqC z;)Z3y8h;F@Du$W3_Y(KozBtyS%351P&T+y8C3vcSyPUmlY@(s2Zn*6EB_bWf9IQ;d zB!DBbl+oqd?O-_S{$VQQ@gvKAFrBq4M^Q;Zan(xL1W34&sK^->FIahPR?vX9Etj=f13SKYv%b;s3%HjT^seI%%#1@=)Sxkn#_2fb1EL z(oD*y&PR{b;($e$V!48Pw&bXbG&SiC2{zx*QeQ~FG&$9lBcOeenl{g^^u;D1*VL` zfp_s?xkJ6r#Ng$kVtNi2g-}@sdx+)T)Z5>hEW*>pn9`_pkT$kqiz8p*~{u7cz`U z(HbzgwJy#z0WNW{K4N3MFMrh=gh7t@2T0;yZ^*!_H{^1eenC=l#6QRr|GEeI=U&f@ zDHR5y9Q20?^EQwlgy09lqqPqC{&O91_>~<1g(2X^Mi3q#3~9&%1ezK00MLyG2?N87 zfhI7Ru^EtqFWT#Xy*&BoD+Ue_gg|RCIAQqTE1wfM8VI5G9hG&l%y1=8^s4FU%suNweEfc`NQh35Q^^$-{wcwHEVMxD6PF${pXZZs4D2j1WV zBW@Z4gd+aMchx_-fuWG=3IT91=z0_&PyiB*4sq4~Ycv9MGcsTV^140<5DvPYE&v<_ zhM=)Y{!$1)AdqPEioa+OF!E}>(cd&6;tJQ~FB$-W1YS1~2t+_`I06CuKV#7T|JM@` z0C>G)wD8qARDX2>gaEGwz+W^71bDN^K)@?BmcRIb5D?(s`u>SO5C-`_6e4dHCOU@y z7QWI90fBGS2M}E}*ZF{ObQrD~1A&0h>$R>EK@iCGP@_|KV_1QJz#Dw%K?S&}4~o2Q z3|jUI0tekt{|!F~{C`=9uB00V!ok#yK4Wb z1rQW;V>p2jpc@@SAkdqm1Pr)>Jo;N70(1p9^cM{b0z=UL|4l?IylFKU{bPBJ4=sG7 zxWG_!2(R%$Ah0W#pT9bWfWg53O$q8h9;1c9H#$L}t+_4?fy1vy3j&5*!4Lh_2^ayn znq>Kl20@qq-y;Vde+UEty^$vb^hOAwKy;?ADTE?HpzFrK(2iU$I2Zzoyq*#`I-fw) zHHGN%xKZio7~C8sFxVAR(%;^}VSwufLJ&7o2S=bEI{zz+LO;2j9Stq4O&!sQOH6z! z79OTd=#uACwzEUyG+luqG4V;;n%Oa-CD1TZeA41f+JbOVaS=(l2n>Lp-U1^bl28c= vn7E_}0we(tLx@NKh5!E?x>rbEPR^8uj?Qk5re^qXBpe3BXJeC4ki`EVrc>~D diff --git a/tzpfms.ps b/tzpfms.ps index d61962d..26b6f2e 100644 --- a/tzpfms.ps +++ b/tzpfms.ps @@ -1,15 +1,15 @@ %!PS-Adobe-3.0 %%Creator: groff version 1.23.0 -%%CreationDate: Sun Mar 10 01:28:16 2024 +%%CreationDate: Sun Mar 10 02:34:25 2024 %%DocumentNeededResources: font Times-Roman %%+ font Times-Bold %%+ font Courier-Bold %%+ font Courier-Oblique %%+ font Courier -%%+ font Times-Italic %%+ font Symbol +%%+ font Times-Italic %%DocumentSuppliedResources: procset grops 1.23 0 -%%Pages: 15 +%%Pages: 10 %%PageOrder: Ascend %%DocumentMedia: Default 595 842 0 () () %%Orientation: Portrait @@ -237,8 +237,8 @@ setpacking %%IncludeResource: font Courier-Bold %%IncludeResource: font Courier-Oblique %%IncludeResource: font Courier -%%IncludeResource: font Times-Italic %%IncludeResource: font Symbol +%%IncludeResource: font Times-Italic grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72 def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef @@ -276,389 +276,20 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-ADD-B)72 48 Q -.4(AC)-.35 G 42.103 -(KUP\(8\) System).4 F(Manager')2.5 E 2.5(sM)-.55 G 39.602 -(anual ZFS-FIDO2-ADD-B)-2.5 F -.4(AC)-.35 G(KUP\(8\)).4 E/F1 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-add-backup)108 96 Q F0 2.5<8a61>2.5 G(llo)-2.5 E 2.5(wa)-.25 -G(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F1(SYNOPSIS) -72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0(After)108 153.6 Q/F4 10 -/Courier@0 SF(zfs-fido2-change-key)7.564 E F0 5.064(\(8\) deri)B -.15 -(ve)-.25 G 7.563(st).15 G 5.063(he k)-7.563 F 5.363 -.15(ey f)-.1 H -5.063(or a dataset from a FIDO2 de).15 F(vice,)-.25 E F2 -(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15(xe)-.15 G -(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G -(umber of additional de)-2.5 E(vices.)-.25 E .273(First, the wrapping k) -108 182.4 R .574 -.15(ey i)-.1 H 2.774(se).15 G .274 -(xtracted as normally during)-2.924 F F4(zfs-fido2-load-key)2.774 E F0 -.274(\(8\), then a credential)B 1.604(is made as-if during)108 194.4 R -F4(zfs-fido2-change-key)4.104 E F0 1.604(\(8\) \(e)B 1.604 -(xcept the "primary" de)-.15 F 1.603(vice and all the ones)-.25 F .185 -(holding backups are e)108 206.4 R .185(xcluded from the search\); ho) --.15 F(we)-.25 E -.15(ve)-.25 G .985 -.4(r, t).15 H(he).4 E F4 -(hmac-secret)2.685 E F0 .185(is instead used as a sym-)2.685 F 1.555 -(metric AES-256-GCM \()108 218.4 R F4(EVP_CIPHER-AES)A F0 1.555 -(\(7ssl\)\) k)B 1.855 -.15(ey t)-.1 H 4.055(oe).15 G 1.555 -(ncrypt the wrapping k)-4.055 F 1.855 -.15(ey d)-.1 H 1.555 -(irectly with a).15 F(random IV)108 230.4 Q(.)-1.29 E(This turns the)108 -247.2 Q F4(xyz.nabijaczleweli:tzpfms.key)2.5 E F0 -.25(va)2.5 G -(riable into).25 E F3(salt)108 259.2 Q F2(:)A F3(credential-ID)A F2(:)A -F3(credential-public-key)A F0([)A F2(.)A F3(backup-salt)A F2(:)A F3 -(backup-credential-ID)108 271.2 Q F2(:)A F3 -(backup-credential-public-key)A F2(:)A F3(IV)A F2(:)A F3(encrypted-key)A -F0 1.666(]...)C F4(tzpfms.key)108 288 Q F0 2.238 -(is actually a dot-separated list of de)4.738 F 2.238(vice b)-.25 F -4.738(undles. The)-.2 F 2.239(\214rst one is as-described in)4.738 F F4 -(zfs-fido2-change-key)108 300 Q F0 5.181(\(8\). Subsequent)B 2.681 -(ones also include \(identically-encoded\) IVs and en-)5.181 F -(crypted blobs.)108 312 Q F4(zfs-fido2-load-key)108 328.8 Q F0 .081 -(\(8\) shops assertions around de)B .081(vices in a de)-.25 F .082 -(vice-major order \212 depending on)-.25 F(de)108 340.8 Q -(vice numbering, a backup may be loaded e)-.25 E -.15(ve)-.25 G 2.5(ni) -.15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.)-.25 E F1 -(ENVIR)72 357.6 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 -(TZPFMS_PASSPHRASE_HELPER)108 369.6 Q F0 .046(By def)133 381.6 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 393.6 -Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G -1.596(ill be run via)-4.096 F F4(/bin/)4.096 E F2 3.262(sh \255c)B F0 -(to)4.096 E(pro)133 405.6 Q(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 422.4 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 434.4 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 446.4 Q F0 -(Pre-formatted noun phrase with all the information belo)160 446.4 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 458.4 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 458.4 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 470.4 Q F0("ne)160 -470.4 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 482.4 Q F0("ag)160 482.4 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 499.2 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -511.2 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 528 R(En)87 540 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 552 Q F0 -(If set, enables lib\214do2 deb)173 552 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 568.8 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 580.8 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 592.8 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 609.6 R F0 -(The lib\214do2 documentation at https://de)108 621.6 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 638.4 R -F0 1.6 -.8(To a)108 650.4 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 662.4 Q F0(ThePhD)7.5 E F1<83> -128 674.4 Q F0(Embark Studios)7.5 E F1<83>128 686.4 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 698.4 Q F0(EvModder)7.5 E F1(REPOR)72 715.2 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 727.2 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 744 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 756 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 2 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 -SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) --2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) --2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 -124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF -(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 -2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 -(,)A F2(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) --.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 -(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.555 E F0 -.1(wa) -3.555 G 3.555(sp).1 G(re)-3.555 E 1.054(viously encrypted with)-.25 F F2 -(fzifdso)3.554 E F0 1.054(and the)3.554 F F1(FIDO2)3.554 E F0 1.054 -(back-end w)3.554 F 1.054(as used, pre)-.1 F(vious)-.25 E 1.272 -(credentials will be deleted from their de)108 223.2 R 1.272 -(vices \(as-if via)-.25 F F5(zfs-fido2-clear-key)3.773 E F0 1.273 -(\(8\)\), if a)B -.25(va)-.2 G(ilable.).25 E .594 -(Otherwise, or in case of an error)108 235.2 R 3.093(,d)-.4 G .593 -(ata required for manual interv)-3.093 F .593 -(ention will be written to the standard)-.15 F(error stream.)108 247.2 Q -(Ne)108 264 Q .464(xt, a ne)-.15 F 2.964(wc)-.25 G .464 -(redential of type ES256 is generated on the de)-2.964 F .465 -(vice \(with relying party ID)-.25 F F5(fzifdso)2.965 E F0(and)2.965 E -.499(name equal to the dataset name\) with the)108 276 R F5(hmac-secret) -2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 -(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 288 Q -(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ -n, the credential is asserted with a 32-byte random salt, which hashes \ -it with de)108 304.8 R(vice-pri)-.25 E -.25(va)-.25 G .963(te data,).25 -F .138(and thus generates the wrapping k)108 316.8 R .438 -.15(ey \()-.1 -H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) -2.637 E F0 2.637(\)\). This)B .137(mimicks a)2.637 F -.8(We)108 328.8 S -(bAuthn login step.).8 E(The follo)108 345.6 Q -(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -357.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> -128 369.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 -(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 381.6 Q F0 -([)A F2(.)A F0 1.666(...)1.666 G 1.666(]...)-1.666 G F5(tzpfms.backend) -108 398.4 Q F0 2.707(identi\214es this dataset for w)5.207 F 2.708 -(ork with)-.1 F F1(FIDO2)5.208 E F0(-back-ended)A F2(tzpfms)5.208 E F0 -2.708(tools \(i.e.)5.208 F F2(fzifdso)108 410.4 Q F5 -(zfs-fido2-change-key)60.228 E F0(\(8\),)A F5(zfs-fido2-load-key)56.727 -E F0(\(8\),)A F5(zfs-fido2-add-backup)108 422.4 Q F0(\(8\), and)A F5 -(zfs-fido2-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 439.2 Q F0 -.486(is a colon-separated tuple of unpadded URL-safe base64 blobs; the \ -\214rst one is the ran-)2.985 F .217(dom salt; the second represents th\ -e ID of created credential, and the third \211 its public k)108 451.2 R --.15(ey)-.1 G 5.217(.T)-.5 G .216(here e)-5.217 F(xists)-.15 E -(no other user)108 463.2 Q -(-land tool for deciphering this; perhaps there should be.)-.2 E -(Finally)108 480 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 -G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5 -(keylocation=prompt)15.506 E F217.172 E F5(keyformat=raw)108 492 Q -F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .106(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F -(to clean up the properties, or to issue a note for manual interv)108 -504 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 520.8 -S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.556 E F0 -6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 -(command succeeds, all is well, b)108 532.8 R .729 -(ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 544.8 Q F2(zfs-fido2-clear-key)5.146 E F3(dataset)8.646 E -F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F -10.313 E F5(keyformat=passphrase)108 556.8 Q F3(dataset)6 E F0 -(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-fido2-clear-key)108 573.6 Q F3(dataset)7.607 E F0 1.607 -(can be used to clear the properties and go back to using a)4.107 F -(passphrase.)108 585.6 Q F1(OPTIONS)72 602.4 Q F2109.666 614.4 Q -F3(backup-file)6 E F0(Sa)203 614.4 Q .352 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 626.4 R F4(must)3.194 E F0 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 638.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 650.4 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F1(ENVIR)72 667.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 -E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q F0 .045(By def)133 691.2 R -.045(ault, passphrases are prompted for and read in on the standard out\ -put and input streams.)-.1 F(If)5.046 E F5(TZPFMS_PASSPHRASE_HELPER)133 -703.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw) --4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.095 E F2 3.261 -(sh \255c)B F0(to)4.095 E(pro)133 715.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 732 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(fzifdso 0)72 817.889 Q -(March 4, 2024)161.068 E(1)191.337 E 0 Cg EP -%%Page: 2 3 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(FIDO2 back-end con\214guration)72 165.6 R(En)87 177.6 Q(vir)-.4 E -.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 189.6 Q F0 -(If set, enables lib\214do2 deb)173 189.6 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 206.4 Q .625 -(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 218.4 R -.726(vice which supports the)-.25 F F1(hmac-secret)3.227 E F0 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion is shopped around to e)108 230.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 247.2 R F0 -(The lib\214do2 documentation at https://de)108 259.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 276 R -F0 1.6 -.8(To a)108 288 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F2<83>128 300 Q F0(ThePhD)7.5 E F2<83>128 -312 Q F0(Embark Studios)7.5 E F2<83>128 324 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F2<83>128 336 Q F0(EvModder)7.5 E F2(REPOR)72 352.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 364.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 381.6 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 393.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(March 4, 2024)161.068 E(2)191.337 E 0 Cg EP -%%Page: 1 4 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 -F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.587 G -.25(ew)-3.587 G -1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G -(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 -108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(FIDO2)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F --.25(va)-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.307 E/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. loads)118 -201.6 R .79(the primary and e)3.29 F -.15(ve)-.25 G .79 -(ry backup credential, and for each success, if the de).15 F .791 -(vice containing it)-.25 F(supports the)133 213.6 Q F4(credMgmt)2.5 E F0 -(feature and has a PIN set, tries to delete the credential from the de) -2.5 E(vice,)-.25 E 5(3. remo)118 225.6 R -.15(ve)-.15 G 10.689(st).15 G -(he)-10.689 E F4(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A -F0(,)A F4(key)14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3 -(dataset)133 237.6 Q F0(.)A -.15(Fo)108 254.4 S 5.859(re).15 G -.15(ve) --6.109 G 3.359(ry remo).15 F -.25(va)-.15 G 5.859(lf).25 G 3.359 -(ailure and missing de)-5.959 F 3.36 -(vice or PIN an instruction for manual remo)-.25 F -.25(va)-.15 G 5.86 -(lw).25 G(ith)-5.86 E F4(fido2-token)108 266.4 Q F0(\(1\) is issued.)A -(See)108 283.2 Q F4(zfs-fido2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(ENVIR)72 300 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 312 Q F0 .046 -(By def)133 324 R .045(ault, passphrases are prompted for and read in o\ -n the standard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 336 Q F0 1.595(is set and nonempty)4.095 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 348 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 364.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 376.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 388.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 388.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 400.8 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 400.8 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 412.8 Q F0("ne)160 -412.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 424.8 Q F0("ag)160 424.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 441.6 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -453.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 470.4 R(En)87 482.4 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 494.4 Q F0 -(If set, enables lib\214do2 deb)173 494.4 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 511.2 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 523.2 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 535.2 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 552 R F0 -(The lib\214do2 documentation at https://de)108 564 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 580.8 R -F0 1.6 -.8(To a)108 592.8 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 604.8 Q F0(ThePhD)7.5 E F1<83> -128 616.8 Q F0(Embark Studios)7.5 E F1<83>128 628.8 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 640.8 Q F0(EvModder)7.5 E F1(REPOR)72 657.6 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 669.6 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 686.4 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 698.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(March 4, 2024)161.068 E(1)191.337 E 0 Cg EP -%%Page: 1 5 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) --.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F -(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 -/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G -(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.142(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.642 E F0 -.1 -(wa)3.642 G 3.641(se).1 G 1.141(ncrypted with)-3.641 F F2(tzpfms)3.641 E -F0(back)3.641 E(end)-.1 E F1(FIDO2)3.641 E F0 3.641(,a)C 1.141 -(sserts the preserv)-3.641 F 1.141(ed chal-)-.15 F(lenge, HMA)108 165.6 -Q(Cking the salt with the on-de)-.4 E -(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) -.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF -(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) -.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 -(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.208 E -.25(va)-.25 G -3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 223.2 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .046(By def) -133 264 R .045(ault, passphrases are prompted for and read in on the st\ -andard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.595(is set and nonempty)4.095 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 288 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 304.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 340.8 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 352.8 Q F0("ne)160 -352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 381.6 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666(SPECIAL THANKS) -72 410.4 R F0 1.6 -.8(To a)108 422.4 T(ll who support further de).8 E --.15(ve)-.25 G(lopment, in particular:).15 E F1<83>128 434.4 Q F0 -(ThePhD)7.5 E F1<83>128 446.4 Q F0(Embark Studios)7.5 E F1<83>128 458.4 -Q F0(Jasper Bekk)7.5 E(ers)-.1 E F1<83>128 470.4 Q F0(EvModder)7.5 E F1 -(REPOR)72 487.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 -499.2 Q(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 516 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 528 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 6 -%%BeginPageSetup -BP -%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([) -2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E -/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A -F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 +/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 -177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.978 E F0 +177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 .478(back-end \(e.g.)2.978 F F1(TPM2)2.978 E F0(for)2.978 E F4 -(zfs-tpm2-change-key)2.978 E F0 .478(\(8\) or)B F1(TPM1.X)2.979 E F0 +(zfs-tpm2-change-key)2.978 E F0 .478(\(8\) or)B F1(TPM1.X)2.978 E F0 (for)187 201.6 Q F4(zfs-tpm1x-change-key)2.5 E F0(\(8\)\), or ")A F1(-)A F0 2.5("i)C 2.5(fn)-2.5 G(one is con\214gured)-2.5 E F4(keystatus)128 213.6 Q F1 -2.1 -.25(av a)187 213.6 T(ilable).25 E F0(or)2.5 E F1(una) @@ -669,18 +300,18 @@ F0 2.5("i)C 2.5(fn)-2.5 G(one is con\214gured)-2.5 E F4(keystatus)128 2.5 E F1(no)2.5 E F0(otherwise)2.5 E 8.743(Incoherent datasets require \ immediate operator attention, with either the appropriate)108 254.4 R F2 (zfs-tpm)108 266.4 Q/F5 10/Symbol SF(*)A F2(-clear-key)A F0 1.778 -(program or)4.278 F F2 1.778(zfs change-key)4.278 F F0(and)4.278 E F2 +(program or)4.277 F F2 1.778(zfs change-key)4.278 F F0(and)4.278 E F2 1.778(zfs inherit)4.278 F F0 4.278<8a69>4.278 G 4.278(ft)-4.278 G 1.778 -(he k)-4.278 F 2.077 -.15(ey b)-.1 H(e-).15 E .565(comes unloaded, the) -108 278.4 R 3.065(yw)-.15 G .566(ill require restoration from back-up.) --3.065 F(Ho)5.566 E(we)-.25 E -.15(ve)-.25 G 1.366 -.4(r, t).15 H .566 -(his should ne).4 F -.15(ve)-.25 G 3.066(ro).15 G(ccur)-3.066 E 3.066 -(,u)-.4 G(nless)-3.066 E +(he k)-4.278 F 2.078 -.15(ey b)-.1 H(e-).15 E .566(comes unloaded, the) +108 278.4 R 3.066(yw)-.15 G .566(ill require restoration from back-up.) +-3.066 F(Ho)5.566 E(we)-.25 E -.15(ve)-.25 G 1.366 -.4(r, t).15 H .566 +(his should ne).4 F -.15(ve)-.25 G 3.065(ro).15 G(ccur)-3.065 E 3.065 +(,u)-.4 G(nless)-3.065 E (something went horribly wrong with the dataset properties.)108 290.4 Q .965(If no datasets are speci\214ed, all matching encryption roots are \ -listed \212 by def)108 307.2 R .965(ault, those managed by)-.1 F F2 +listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 (tzpfms)108 319.2 Q F0(.)A F1(OPTIONS)72 336 Q F2109.666 348 Q F0 -1.582(Scripting mode \212 remo)185 348 R 1.882 -.15(ve h)-.15 H 1.583 +1.583(Scripting mode \212 remo)185 348 R 1.883 -.15(ve h)-.15 H 1.583 (eaders and separate \214elds by a single tab instead of).15 F (columnating them with spaces.)185 360 Q F2109.666 376.8 Q F0 (Recurse into all descendants of speci\214ed datasets.)185 376.8 Q F2 @@ -695,28 +326,26 @@ listed \212 by def)108 307.2 R .965(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R -18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 +(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666 -(zfs-fido2-add-backup \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 -(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) -108 583.2 Q F2 1.666(zfs-fido2-add-backup \255b)6 F F1(TPM2)6 E F4 72 -(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 -(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-fido2-add-backup \255ra)6 F F3(tarta-zoot)6 E F4 72 -(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 -(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 -(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 -(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) -108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 -(zfs-fido2-add-backup \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 +24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 +559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 +F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F +6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) +108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R +18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 +(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) +54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q +F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) -108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-29-g1d39364)72 817.889 -Q(December 4, 2022)82.463 E(1)183.842 E 0 Cg EP -%%Page: 2 7 +108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-32-g56ada0e)72 817.889 +Q(December 4, 2022)84.143 E(1)183.842 E 0 Cg EP +%%Page: 2 2 %%BeginPageSetup BP %%EndPageSetup @@ -729,11 +358,11 @@ BP (EvModder)7.5 E F1(REPOR)72 160.8 Q 1.666(TING B)-.4 F(UGS)-.1 E F0 (https://todo.sr)108 172.8 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms)-.25 E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-29-g1d39364)72 817.889 Q(December 4, 2022)82.463 E +-.25 E(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q(December 4, 2022)84.143 E (2)183.842 E 0 Cg EP -%%Page: 1 8 +%%Page: 1 3 %%BeginPageSetup BP %%EndPageSetup @@ -742,161 +371,159 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 -E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.866 -.8(To n)108 153.6 -T 1.266(ormalise the).8 F F3(dataset)3.766 E F0(,)A F2 -(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.655 E/F4 10/Times-Italic@0 -SF(ne)14.655 E(ver)-.15 E F0 12.154(create or destro)14.655 F 14.654(ye) --.1 G 12.154(ncryption roots; use)-14.654 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.176 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 +(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T +5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 +E F0 5.266(will open its encryption root in its stead.)7.766 F F2 +(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E +(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) +-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 +(data will be silently cleared.)108 211.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q +(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 (\), and sealed)B .586(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 264 R .885 -.15(ey w)-.1 H .585 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q + passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 333.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 +108 321.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 (ork with)-.1 F F1(TPM1.X)2.792 E F0(-back-ended)A F2(tzpfms)2.792 E F0 -.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 345.6 Q F0 +.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 333.6 Q F0 (\(8\),)A F5(zfs-tpm1x-load-key)2.5 E F0(\(8\), and)A F5 -(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q F0 +(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 350.4 Q F0 1.412(is a colon-separated pair of he)3.913 F 1.412 (xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 -(\214rst one represents the RSA k)108 374.4 R 1.167 -.15(ey p)-.1 H .868 +(\214rst one represents the RSA k)108 362.4 R 1.167 -.15(ey p)-.1 H .868 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 386.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 +.15 F(pro)108 374.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 (CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 (he sec-)-3.913 F .379 -(ond represents the sealed object containing the wrapping k)108 398.4 R +(ond represents the sealed object containing the wrapping k)108 386.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.721(.T)C +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 398.4 Q F0 6.721(.T)C 1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 (-land tool for)-.2 F(decrypting this; perhaps there should be.)108 -422.4 Q(Finally)108 439.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F +410.4 Q(Finally)108 427.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F 17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 -(keyformat=raw)108 451.2 Q F3(dataset)6.107 E F0 .107 +(keyformat=raw)108 439.2 Q F3(dataset)6.107 E F0 .107 (is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 (.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -463.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 480 +451.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 468 S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) -.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 -(command succeeds, all is well, b)108 492 R .729 +(command succeeds, all is well, b)108 480 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E +-.2 F(with)108 492 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F 2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F -10.313 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 +10.313 E F5(keyformat=passphrase)108 504 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.607 E F0 1.607 +F2(zfs-tpm1x-clear-key)108 520.8 Q F3(dataset)7.607 E F0 1.607 (can be used to clear the properties and go back to using a)4.107 F -(passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q -F3(backup-file)6 E F0(Sa)203 573.6 Q .352 -.15(ve a b)-.2 H .052 +(passphrase.)108 532.8 Q F1(OPTIONS)72 549.6 Q F2109.666 561.6 Q +F3(backup-file)6 E F0(Sa)203 561.6 Q .352 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 585.6 R F4(must)3.194 E F0 .694 +F .694(This back-up)203 573.6 R F4(must)3.194 E F0 .694 (be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .638(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H +(nt,).15 E(the k)203 585.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 597.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 614.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .638(Bind the k)203 614.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 -(hange, the wrap-)-3.139 F .463(ping k)203 638.4 R .763 -.15(ey w)-.1 H +(hange, the wrap-)-3.139 F .463(ping k)203 626.4 R .763 -.15(ey w)-.1 H .463(ill not be able to be unsealed.).15 F .462 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 638.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q -F0 .045(By def)133 691.2 R .045(ault, passphrases are prompted for and \ +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 655.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q +F0 .045(By def)133 679.2 R .045(ault, passphrases are prompted for and \ read in on the standard output and input streams.)-.1 F(If)5.046 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.596(is set and nonempty)4.096 +(TZPFMS_PASSPHRASE_HELPER)133 691.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 715.2 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 703.2 Q (vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 732 R +(The standard output stream of the helper is tied to an anon)133 720 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-29-g1d39364)72 -817.889 Q(February 28, 2024)82.458 E(1)183.837 E 0 Cg EP -%%Page: 2 9 +133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 +(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E(tzpfms 0.3.4-32-g56ada0e)72 +817.889 Q(February 28, 2024)84.138 E(1)183.837 E 0 Cg EP +%%Page: 2 4 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 36.913(ZFS-TPM1X-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 34.412(anual ZFS-TPM1X-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q +-2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G +-2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G (he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 +(If the helper doesn')133 124.8 R 2.678(te)-.18 G .178 (xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF (127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 -177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 +1.666(TPM1.X back-end con\214guration)72 153.6 R .625(TPM selection)87 +165.6 R F0(The)108 177.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 .229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 (\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 201.6 Q +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 189.6 Q (vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 218.4 R(rouSerS) +(to specify a remote TCS hostname.)2.5 E .111(The T)108 206.4 R(rouSerS) -.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -230.4 S(ing one of the earlier ones with, for e).1 E +218.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 247.2 R F0(The T)108 259.2 Q +(See also)87 235.2 R F0(The T)108 247.2 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 -(The TPM 1.2 main speci\214cation inde)108 276 R 6.915(xa)-.15 G 6.915 +(The TPM 1.2 main speci\214cation inde)108 264 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 288 Q F2 1.666 -(SPECIAL THANKS)72 304.8 R F0 1.6 -.8(To a)108 316.8 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 276 Q F2 1.666 +(SPECIAL THANKS)72 292.8 R F0 1.6 -.8(To a)108 304.8 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 328.8 Q F0(ThePhD)7.5 E F2<83>128 340.8 Q F0 -(Embark Studios)7.5 E F2<83>128 352.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q +.15 E F2<83>128 316.8 Q F0(ThePhD)7.5 E F2<83>128 328.8 Q F0 +(Embark Studios)7.5 E F2<83>128 340.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F2<83>128 352.8 Q F0(EvModder)7.5 E F2(REPOR)72 369.6 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 381.6 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 398.4 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E -(https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E F2 1.666(SEE ALSO)72 439.2 R F0 -(PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E +(https://lists.sr)108 410.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E F2 1.666(SEE ALSO)72 427.2 R F0 +(PCR allocations: https://wiki.archlinux.or)108 439.2 Q(g/title/T)-.18 E (rusted_Platform_Module#Accessing_PCR_re)-.35 E(gisters)-.15 E -(and https://trustedcomputinggroup.or)108 463.2 Q +(and https://trustedcomputinggroup.or)108 451.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ -r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q -(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-29-g1d39364)72 817.889 Q -(February 28, 2024)82.458 E(2)183.837 E 0 Cg EP -%%Page: 1 10 +r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 463.2 Q +(able)-.8 E(1.)108 475.2 Q(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q +(February 28, 2024)84.138 E(2)183.837 E 0 Cg EP +%%Page: 1 5 %%BeginPageSetup BP %%EndPageSetup @@ -906,14 +533,14 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(TPM1.X)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F --.25(va)-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.307 E/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q +(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G +(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM1.X) +2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F -.25(va) +-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E +/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 +(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 @@ -946,9 +573,9 @@ F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-29-g1d39364)72 817.889 Q(December 4, 2022)82.463 E(1) +E(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q(December 4, 2022)84.143 E(1) 183.842 E 0 Cg EP -%%Page: 1 11 +%%Page: 1 6 %%BeginPageSetup BP %%EndPageSetup @@ -957,13 +584,13 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .191(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1 -(wa)2.691 G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E -F0(back)2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 -F .49 -.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset) -2.5 E F0(.)A .236 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .191 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1(wa)2.691 +G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E F0(back) +2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 F .49 +-.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset)2.5 E +F0(.)A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) 108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) @@ -1026,9 +653,9 @@ F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-29-g1d39364)72 817.889 Q(December 4, 2022)82.463 E(1) +E(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q(December 4, 2022)84.143 E(1) 183.842 E 0 Cg EP -%%Page: 1 12 +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup @@ -1037,132 +664,132 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 -1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A -F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A -F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.319 -.8(To n)108 -165.6 T(ormalise).8 E F3(dataset)5.219 E F0(,)A F2(zfs-fido2-add-backup) -5.219 E F0 2.72(will open its encryption root in its stead.)5.219 F F2 -(zfs-fido2-add-backup)108 177.6 Q F0(will)14.655 E/F4 10/Times-Italic@0 -SF(ne)14.655 E(ver)-.15 E F0 12.154(create or destro)14.655 F 14.654(ye) --.1 G 12.154(ncryption roots; use)-14.654 F/F5 10/Courier@0 SF -(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E -F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.054 E F0 -.1 -(wa)3.054 G 3.054(sp).1 G(re)-3.054 E .554(viously encrypted with)-.25 F -F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .555 -(back-end w)3.055 F .555(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 -235.2 S 3.06(yw)-.05 G .56(ill be freed from the TPM.)-3.06 F .56 -(Otherwise, or in case of an error)5.56 F 3.059(,d)-.4 G .559 -(ata required for manual interv)-3.059 F(en-)-.15 E -(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 -264 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 +(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) +A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) +A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.676 -.8(To n)108 165.6 +T(ormalise).8 E F3(dataset)2.576 E F0(,)A F2(zfs-tpm-list)2.576 E F0 +.076(will open its encryption root in its stead.)2.576 F F2 +(zfs-tpm-list)5.077 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 +E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G +(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 +(\(8\) for that.)A(First, a connection is made to the TPM, which)108 +194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 +(dataset)3.055 E F0 -.1(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555 +(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F +F1(TPM2)3.055 E F0 .554(back-end w)3.054 F .554(as used, the pre)-.1 F +(vious)-.25 E -.1(ke)108 223.2 S 3.059(yw)-.05 G .559 +(ill be freed from the TPM.)-3.059 F .56 +(Otherwise, or in case of an error)5.56 F 3.06(,d)-.4 G .56 +(ata required for manual interv)-3.06 F(en-)-.15 E +(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 +252 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 -(OPTIONS)2.794 E F0 .294(\), and sealed)B .589 -(to a persistent object on the TPM under the o)108 276 R .589 -(wner hierarch)-.25 F .588(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 288 Q 1.602 -.65(y, t)-.05 H .302 +(OPTIONS)2.794 E F0 .294(\), and sealed)B .588 +(to a persistent object on the TPM under the o)108 264 R .589 +(wner hierarch)-.25 F .589(y; if there is a passphrase set on the o)-.05 +F(wner)-.25 E(hierarch)108 276 Q 1.603 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 300 Q(The follo)108 316.8 Q +(the sealed object with.)108 288 Q(The follo)108 304.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 1.264 -(identi\214es this dataset for w)3.764 F 1.263(ork with)-.1 F F1(TPM2) -3.763 E F0(-back-ended)A F2(tzpfms)3.763 E F0 1.263(tools \(namely)3.763 -F F5(zfs-tpm2-change-key)108 381.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 1.263 +(identi\214es this dataset for w)3.763 F 1.264(ork with)-.1 F F1(TPM2) +3.764 E F0(-back-ended)A F2(tzpfms)3.764 E F0 1.264(tools \(namely)3.764 +F F5(zfs-tpm2-change-key)108 369.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) 2.5 E F0(\(8\), and)A F5(zfs-tpm2-clear-key)2.5 E F0(\(8\)\).)A F5 -(tzpfms.key)108 398.4 Q F0 1.508(is an inte)4.008 F 1.509 +(tzpfms.key)108 386.4 Q F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 -(wed by a semicolon and)-.25 F .823(PCR list as speci\214ed with)108 -410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 -(tpm-tools)3.322 E F0 .822(-toolchain-compatible; if needed, it can)B -.865(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +(wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 +398.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +(tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B +.866(be passed to)108 410.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) -3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.366("o) -C(r)-3.366 E F2109.666 434.4 Q F0(")6.728 E F5(pcr:${tzpfms.key)A -F2(#)A F6(*)A F5(;})A F0 .728(", as the case may be, or equi)B -.25(va) --.25 G .727(lent, for back-up \(see).25 F F1(OPTIONS)3.227 E F0(\).)A -.447(If you ha)108 446.4 R .747 -.15(ve a s)-.2 H .447(ealed k).15 F +3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) +C(r)-3.365 E F2109.666 422.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) +-.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A +.448(If you ha)108 434.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) --.25 G .448(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.006 -(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506(lent of).25 F F2 -9.505(zfs change-key)12.005 F17.171 E F5(keylocation=prompt)15.505 -E F217.171 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.106 E F0 -.106(is performed with the ne)2.606 F 2.606(wk)-.25 G -.15(ey)-2.706 G -5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .107 -(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F .289(to clean\ +-.25 G .447(lent tool and set both of these properties, it).25 F +(will funxion seamlessly)108 446.4 Q(.)-.65 E(Finally)108 463.2 Q 12.005 +(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 +9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 +E F217.172 E F5(keyformat=raw)108 475.2 Q F3(dataset)6.107 E F0 +.107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G +5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 +(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 499.2 R .289(ention into the stan-)-.15 F -(dard error stream.)108 511.2 Q 2.624<418c>108 528 S .124(nal v)-2.624 F -.124(eri\214cation should be made by running)-.15 F F2 1.791 -(zfs-tpm2-load-key \255n)2.625 F F3(dataset)6.125 E F0 5.125(.I)C 2.625 -(ft)-5.125 G .125(hat com-)-2.625 F .507(mand succeeds, all is well, b) -108 540 R .506(ut otherwise the dataset can be manually rolled back to \ -a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) -11.538 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) + interv)108 487.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 499.2 Q 2.625<418c>108 516 S .125(nal v)-2.625 F .125 +(eri\214cation should be made by running)-.15 F F2 1.79 +(zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 +(ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) +108 528 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 540 Q F3(dataset) +11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.205 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 +F13.204 E F5(keyformat=passphrase)108 552 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 +F2(zfs-tpm2-clear-key)108 568.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 -621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .352 -.15(ve a b)-.2 H .052 +F(ing a passphrase.)108 580.8 Q F1(OPTIONS)72 597.6 Q F2109.666 +609.6 Q F3(backup-file)6 E F0(Sa)203 609.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 633.6 R F4(must)3.194 E F0 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 +F .693(This back-up)203 621.6 R F4(must)3.193 E F0 .694 +(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 633.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 645.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 662.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.424(Bind the k)203 686.4 R 1.724 -.15(ey t)-.1 H 3.924(os).15 -G 1.424(pace- or comma-separated)-3.924 F F3(PCR)3.925 E F0 3.925(sw)C -1.425(ithin their corresponding)-3.925 F(hashing)203 698.4 Q F3 -(algorithm)2.524 E F0 2.524<8a69>2.524 G 2.523(ft)-2.524 G(he)-2.523 E +-1.666 G 1.425(Bind the k)203 674.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C +1.424(ithin their corresponding)-3.924 F(hashing)203 686.4 Q F3 +(algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.023(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 698.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.468 F 5.468(yo)-.15 G +A F3(algorithm)203 715.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) -.15 E F0 2.968(", ")B F1(sha256)A F0 2.969(", ")B F1(sha384)A F0(",)A(") -203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +.15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") +203 727.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A -F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 739.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 -(", and must be supported by the TPM.)A(tzpfms 0.3.4-29-g1d39364)72 -817.889 Q(February 28, 2024)82.458 E(1)183.837 E 0 Cg EP -%%Page: 2 13 +(", and must be supported by the TPM.)A(tzpfms 0.3.4-32-g56ada0e)72 +817.889 Q(February 28, 2024)84.138 E(1)183.837 E 0 Cg EP +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 44.133(ZFS-TPM2-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 41.632(anual ZFS-TPM2-CHANGE-KEY\(8\))-2.5 F/F1 10/Courier-Bold@0 SF109.666 84 Q F0 -.4(Wi)203 84 S(th).4 E -F14.588 E F0 2.922(,a)C .422(lso prompt for a passphrase.)-2.922 F -.422(This is skipped by def)5.422 F .423(ault because the)-.1 F .675 +F14.589 E F0 2.923(,a)C .422(lso prompt for a passphrase.)-2.923 F +.422(This is skipped by def)5.422 F .422(ault because the)-.1 F .675 (passphrase is)203 96 R/F2 10/Times-Italic@0 SF(OR)3.175 E F0 .675 (ed with the PCR polic)B 3.175(y\212t)-.15 G .675(he wrapping k)-3.175 F .975 -.15(ey c)-.1 H .675(an be unsealed).15 F F2(either)203 108 Q F0 -1.389(passphraseless with the right PCRs)3.889 F F2(or)3.89 E F0 1.39 +1.39(passphraseless with the right PCRs)3.89 F F2(or)3.89 E F0 1.389 (with the passphrase, and this is)3.89 F(usually not the intent.)203 120 Q/F3 10/Times-Bold@0 SF(ENVIR)72 136.8 Q 1.666(ONMENT V)-.3 F(ARIABLES) --1.35 E/F4 10/Courier@0 SF(TZPFMS_PASSPHRASE_HELPER)108 148.8 Q F0 .046 +-1.35 E/F4 10/Courier@0 SF(TZPFMS_PASSPHRASE_HELPER)108 148.8 Q F0 .045 (By def)133 160.8 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 172.8 Q F0 1.595(is set and nonempty)4.095 + on the standard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 172.8 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F1 3.262(sh \255c)B F0(to)4.096 E(pro)133 184.8 Q +(/bin/)4.095 E F1 3.261(sh \255c)B F0(to)4.095 E(pro)133 184.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 201.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -1175,10 +802,10 @@ F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 249.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 261.6 Q F0("ag)160 261.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 278.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F3(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 278.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F3(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 290.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F3 1.666 (TPM2 back-end con\214guration)72 307.2 R(En)87 319.2 Q(vir)-.4 E .625 @@ -1187,13 +814,13 @@ Q 2.5(yo)-.15 G(f:)-2.5 E F3(NONE)2.5 E F0(,)A F3(ERR)2.5 E(OR)-.3 E F0 (,)A F3 -1.2(WA)2.5 G(RNING)1.2 E F0(,)A F3(INFO)2.5 E F0(,)A F3(DEB)2.5 E(UG)-.1 E F0(,)A F3(TRA)2.5 E(CE)-.55 E F0 5(.D)C(ef)-5 E(ault:)-.1 E F3 -1.2(WA)2.5 G(RNING)1.2 E F0(.)A F3 .625(TPM selection)87 348 R F0 -.622(The library)108 360 R F1(libtss2-tcti-default.so)3.122 E F0 .622 -(can be link)3.122 F .621(ed to an)-.1 F 3.121(yo)-.15 G 3.121(ft)-3.121 -G(he)-3.121 E F4(libtss2-tcti-)3.121 E/F5 10/Symbol SF(*)A F4(.so)A F0 -(li-)3.121 E .78(braries to select the def)108 372 R .78 -(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.281 E F0 3.281(,t)C(hen)-3.281 E -F4(/dev/tpm0)3.281 E F0 3.281(,t)C(hen)-3.281 E F4(localhost:2321)3.281 -E F0(will be tried, in order \(see)108 384 Q F4(ESYS_CONTEXT)2.5 E F0 +.621(The library)108 360 R F1(libtss2-tcti-default.so)3.121 E F0 .621 +(can be link)3.121 F .621(ed to an)-.1 F 3.122(yo)-.15 G 3.122(ft)-3.122 +G(he)-3.122 E F4(libtss2-tcti-)3.122 E/F5 10/Symbol SF(*)A F4(.so)A F0 +(li-)3.122 E .781(braries to select the def)108 372 R .781 +(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4 +(/dev/tpm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4(localhost:2321)3.28 E F0 +(will be tried, in order \(see)108 384 Q F4(ESYS_CONTEXT)2.5 E F0 (\(3\)\).)A F3 .625(See also)87 400.8 R F0 2.247 (The tpm2-tss git repository at https://github)108 412.8 R (.com/tpm2-softw)-.4 E 2.247(are/tpm2-tss and the documentation at)-.1 F @@ -1210,7 +837,7 @@ E F0(will be tried, in order \(see)108 384 Q F4(ESYS_CONTEXT)2.5 E F0 F3<83>128 542.4 Q F0(EvModder)7.5 E F3(REPOR)72 559.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 571.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 588 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 600 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (PCR allocations: https://wiki.archlinux.or)108 645.6 Q(g/title/T)-.18 E @@ -1218,9 +845,9 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (and https://trustedcomputinggroup.or)108 657.6 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q -(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-29-g1d39364)72 817.889 Q -(February 28, 2024)82.458 E(2)183.837 E 0 Cg EP -%%Page: 1 14 +(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q +(February 28, 2024)84.138 E(2)183.837 E 0 Cg EP +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup @@ -1230,13 +857,13 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 -E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 +(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with)-2.5 E F2 (tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM2)2.5 E F0(:)A 5 -(1. performs)118 165.6 R 5.642(the equi)8.142 F -.25(va)-.25 G 5.642 -(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E/F4 10 -/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 +(1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641 +(lent of).25 F F2 5.642(zfs change-key)8.142 F13.308 E/F4 10 +/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E F4 (keyformat=passphrase)133 177.6 Q F3(dataset)6 E F0(,)A 5(2. frees)118 189.6 R(the sealed k)2.5 E .3 -.15(ey p)-.1 H(re).15 E (viously used to encrypt)-.25 E F3(dataset)2.5 E F0(,)A 5(3. remo)118 @@ -1245,12 +872,12 @@ E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm2-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1(ENVIR)72 247.2 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .046 +-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .045 (By def)133 271.2 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.595(is set and nonempty)4.095 + on the standard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 295.2 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 295.2 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 312 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -1262,10 +889,10 @@ F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 360 Q F0("ne)160 360 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) -2.5 E F4($4)143 372 Q F0("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 388.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 388.8 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 400.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM2 back-end con\214guration)72 417.6 R(En)87 429.6 Q(vir)-.4 E .625 @@ -1274,13 +901,13 @@ Q 2.5(yo)-.15 G(f:)-2.5 E F1(NONE)2.5 E F0(,)A F1(ERR)2.5 E(OR)-.3 E F0 (,)A F1 -1.2(WA)2.5 G(RNING)1.2 E F0(,)A F1(INFO)2.5 E F0(,)A F1(DEB)2.5 E(UG)-.1 E F0(,)A F1(TRA)2.5 E(CE)-.55 E F0 5(.D)C(ef)-5 E(ault:)-.1 E F1 -1.2(WA)2.5 G(RNING)1.2 E F0(.)A F1 .625(TPM selection)87 458.4 R F0 -.622(The library)108 470.4 R F2(libtss2-tcti-default.so)3.122 E F0 .622 -(can be link)3.122 F .621(ed to an)-.1 F 3.121(yo)-.15 G 3.121(ft)-3.121 -G(he)-3.121 E F4(libtss2-tcti-)3.121 E/F5 10/Symbol SF(*)A F4(.so)A F0 -(li-)3.121 E .78(braries to select the def)108 482.4 R .78 -(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.281 E F0 3.281(,t)C(hen)-3.281 E -F4(/dev/tpm0)3.281 E F0 3.281(,t)C(hen)-3.281 E F4(localhost:2321)3.281 -E F0(will be tried, in order \(see)108 494.4 Q F4(ESYS_CONTEXT)2.5 E F0 +.621(The library)108 470.4 R F2(libtss2-tcti-default.so)3.121 E F0 .621 +(can be link)3.121 F .621(ed to an)-.1 F 3.122(yo)-.15 G 3.122(ft)-3.122 +G(he)-3.122 E F4(libtss2-tcti-)3.122 E/F5 10/Symbol SF(*)A F4(.so)A F0 +(li-)3.122 E .781(braries to select the def)108 482.4 R .781 +(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4 +(/dev/tpm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4(localhost:2321)3.28 E F0 +(will be tried, in order \(see)108 494.4 Q F4(ESYS_CONTEXT)2.5 E F0 (\(3\)\).)A F1 .625(See also)87 511.2 R F0 2.247 (The tpm2-tss git repository at https://github)108 523.2 R (.com/tpm2-softw)-.4 E 2.247(are/tpm2-tss and the documentation at)-.1 F @@ -1297,11 +924,11 @@ E F0(will be tried, in order \(see)108 494.4 Q F4(ESYS_CONTEXT)2.5 E F0 F1<83>128 652.8 Q F0(EvModder)7.5 E F1(REPOR)72 669.6 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-29-g1d39364)72 817.889 Q(December 4, 2022)82.463 E +-.25 E(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q(December 4, 2022)84.143 E (1)183.842 E 0 Cg EP -%%Page: 1 15 +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -1310,28 +937,28 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .865(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.365 E F0 -.1 -(wa)3.365 G 3.365(se).1 G .865(ncrypted with)-3.365 F F2(tzpfms)3.365 E -F0(back)3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .864 -(nseals the k)-3.365 F 1.164 -.15(ey a)-.1 H .864(nd loads it).15 F -(into)108 165.6 Q F3(dataset)2.5 E F0(.)A(The user is prompted for the \ -additional passphrase, set when creating the k)108 182.4 Q -.15(ey)-.1 G -2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 -10/Courier@0 SF(zfs-tpm2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2109.666 -228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 -G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i) --.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.208 E -.25(va) --.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 240 Q F0 -.55('s) -C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .046 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .864 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1(wa)3.364 +G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E F0(back) +3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865(nseals the k)-3.365 +F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F(into)108 165.6 Q F3 +(dataset)2.5 E F0(.)A(The user is prompted for the additional passphras\ +e, set when creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5 +(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF +(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 +(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 +(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 +G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) +.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 +(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 +4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F +(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 (By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.595(is set and nonempty)4.095 + on the standard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 304.8 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 304.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 321.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -1344,23 +971,23 @@ F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 369.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 381.6 Q F0("ag)160 381.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 398.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 398.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 410.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 427.2 R .625(TPM selection)87 439.2 -R F0(The)108 451.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 463.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 480 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 492 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 451.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 463.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 480 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +492 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 508.8 R F0(The T)108 520.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1375,9 +1002,9 @@ F(the)2.729 E(en)108 463.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 626.4 Q F0(EvModder)7.5 E F1(REPOR)72 643.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-29-g1d39364)72 817.889 Q(December 4, 2022)82.463 E(1) +E(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q(December 4, 2022)84.143 E(1) 183.842 E 0 Cg EP %%Trailer end diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 deleted file mode 100644 index 08a80cb..0000000 --- a/zfs-fido2-add-backup.8 +++ /dev/null @@ -1,125 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-ADD-BACKUP 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-add-backup -.Nd allow another FIDO2 device to unlock ZFS dataset -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After -.Xr zfs-fido2-change-key 8 -derives the key for a dataset from a FIDO2 device, -.Nm -may be executed to extend this to any number of additional devices. -.Pp -First, the wrapping key is extracted as normally during -.Xr zfs-fido2-load-key 8 , -then a credential is made as-if during -.Xr zfs-fido2-change-key 8 -(except the "primary" device and all the ones holding backups are excluded from the search); -however, the -.Ql hmac-secret -is instead used as a symmetric AES-256-GCM -.Pq Xr EVP_CIPHER-AES 7ssl -key to encrypt the wrapping key directly with a random IV. -.Pp -This turns the -.Li xyz.nabijaczleweli:tzpfms.key -variable into -.br -.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … -.Pp -.Li tzpfms.key -is actually a dot-separated list of device bundles. -The first one is as-described in -.Xr zfs-fido2-change-key 8 . -Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -.Pp -.Xr zfs-fido2-load-key 8 -shops assertions around devices in a device-major order \(em -depending on device numbering, a backup may be loaded even if the primary device is present. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html deleted file mode 100644 index e6d3444..0000000 --- a/zfs-fido2-add-backup.8.html +++ /dev/null @@ -1,153 +0,0 @@ - - - - - - - - ZFS-FIDO2-ADD-BACKUP(8) - - - - - - - - -
ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
-

-
-

-

zfs-fido2-add-backup — - allow another FIDO2 device to unlock ZFS dataset

-
-
-

- - - - - -
zfs-fido2-add-backupdataset
-
-
-

-

After - zfs-fido2-change-key(8) - derives the key for a dataset from a FIDO2 device, - zfs-fido2-add-backup may be executed to extend this - to any number of additional devices.

-

First, the wrapping key is extracted as normally during - zfs-fido2-load-key(8), - then a credential is made as-if during - zfs-fido2-change-key(8) - (except the "primary" device and all the ones holding backups are - excluded from the search); however, the - ‘hmac-secret’ is instead used as a - symmetric AES-256-GCM - (EVP_CIPHER-AES(7ssl)) - key to encrypt the wrapping key directly with a random IV.

-

This turns the - xyz.nabijaczleweli:tzpfms.key variable into -
- salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…

-

tzpfms.key is actually a dot-separated - list of device bundles. The first one is as-described in - zfs-fido2-change-key(8). - Subsequent ones also include (identically-encoded) IVs and encrypted - blobs.

-

zfs-fido2-load-key(8) - shops assertions around devices in a device-major order — depending - on device numbering, a backup may be loaded even if the primary device is - present.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 deleted file mode 100644 index 8238eba..0000000 --- a/zfs-fido2-change-key.8 +++ /dev/null @@ -1,188 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 4, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CHANGE-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-change-key -.Nd change ZFS dataset key to one authenticated by a FIDO2 device -.Sh SYNOPSIS -.Nm -.Op Fl b Ar backup-file -.Ar dataset -. -.Sh DESCRIPTION -To normalise the -.Ar dataset , -.Nm -will open its encryption root in its stead. -.Nm -will -.Em never -create or destroy encryption roots; use -.Xr zfs-change-key 8 -for that. -.Pp -First, a connection is made to the FIDO2 device, which -.Em must -support the -.Ql hmac-secret -extension. -.Pp -If -.Ar dataset -was previously encrypted with -.Nm fzifdso -and the -.Sy FIDO2 -back-end was used, previous credentials will be deleted from their devices (as-if via -.Xr zfs-fido2-clear-key 8 ) , -if available. -Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. -.Pp -Next, a new credential of type ES256 is generated on the device (with relying party ID -.Li fzifdso -and name equal to the dataset name) -with the -.Ql hmac-secret -extension requested; the device PIN, if any, is prompted for here. -This mimicks a WebAuthn registration step. -.Pp -Then, the credential is asserted with a 32-byte random salt, -which hashes it with device-private data, and thus generates the wrapping key -.Pq which is optionally backed up Pq see Sx OPTIONS . -This mimicks a WebAuthn login step. -.Pp -The following properties are set on -.Ar dataset : -.Bl -bullet -compact -offset 4n -width "@" -.It -.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 -.It -.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … -.El -.Pp -.Li tzpfms.backend -identifies this dataset for work with -.Sy FIDO2 Ns -back-ended -.Nm tzpfms -tools -.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . -.Pp -.Li tzpfms.key -is a colon-separated tuple of unpadded URL-safe base64 blobs; -the first one is the random salt; -the second represents the ID of created credential, -and the third \(en its public key. -There exists no other user-land tool for deciphering this; perhaps there should be. -.\"" TODO: make an LD_PRELOADable for extracting the key maybe? -.Pp -Finally, the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset -is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. -.Pp -A final verification should be made by running -.Nm zfs-fido2-load-key Fl n Ar dataset . -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a passphrase with -.Nm zfs-fido2-clear-key Ar dataset -.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , -and you are hereby asked to report a bug, please. -.Pp -.Nm zfs-fido2-clear-key Ar dataset -can be used to clear the properties and go back to using a passphrase. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl b Ar backup-file" -.It Fl b Ar backup-file -Save a back-up of the key to -.Ar backup-file , -which must not exist beforehand. -This back-up -.Em must -be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running -.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html deleted file mode 100644 index 8cd7f1a..0000000 --- a/zfs-fido2-change-key.8.html +++ /dev/null @@ -1,207 +0,0 @@ - - - - - - - - ZFS-FIDO2-CHANGE-KEY(8) - - - - - - - - -
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
-
-
-

-

zfs-fido2-change-key — - change ZFS dataset key to one authenticated by a FIDO2 - device

-
-
-

- - - - - -
zfs-fido2-change-key[-b backup-file] - dataset
-
-
-

-

To normalise the dataset, - zfs-fido2-change-key will open its encryption root - in its stead. zfs-fido2-change-key will - - create or destroy encryption roots; use - zfs-change-key(8) - for that.

-

First, a connection is made to the FIDO2 device, which - must support the - ‘hmac-secret’ extension.

-

If dataset was previously encrypted with - fzifdso and the FIDO2 back-end was - used, previous credentials will be deleted from their devices (as-if via - zfs-fido2-clear-key(8)), - if available. Otherwise, or in case of an error, data required for manual - intervention will be written to the standard error stream.

-

Next, a new credential of type ES256 is generated on the device - (with relying party ID fzifdso and name equal to the - dataset name) with the ‘hmac-secret’ - extension requested; the device PIN, if any, is prompted for here. This - mimicks a WebAuthn registration step.

-

Then, the credential is asserted with a 32-byte random salt, which - hashes it with device-private data, and thus generates the wrapping key - (which is optionally backed up (see - OPTIONS)). This mimicks a WebAuthn login - step.

-

The following properties are set on - dataset:

- -

tzpfms.backend identifies this dataset for - work with FIDO2-back-ended tzpfms - tools (i.e. fzifdso - zfs-fido2-change-key(8), - zfs-fido2-load-key(8), - zfs-fido2-add-backup(8), - and - zfs-fido2-clear-key(8)).

-

tzpfms.key is a colon-separated tuple of - unpadded URL-safe base64 blobs; the first one is the random salt; the second - represents the ID of created credential, and the third – its public - key. There exists no other user-land tool for deciphering this; perhaps - there should be.

-

Finally, the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=raw dataset is - performed with the new key. If an error occurred, best effort is made to - clean up the properties, or to issue a note for manual intervention into the - standard error stream.

-

A final verification should be made by running - zfs-fido2-load-key -n - dataset. If that command succeeds, all is well, but - otherwise the dataset can be manually rolled back to a passphrase with - zfs-fido2-clear-key dataset - (or, if that fails to work, zfs - change-key -o - keyformat=passphrase dataset), - and you are hereby asked to report a bug, please.

-

zfs-fido2-clear-key - dataset can be used to clear the properties and go - back to using a passphrase.

-
-
-

-
-
- backup-file
-
Save a back-up of the key to backup-file, which must - not exist beforehand. This back-up must be stored - securely, off-site. In case of a catastrophic event, the key can be loaded - by running -
zfs - load-key dataset - < - backup-file
-
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 4, 2024fzifdso 0
- - diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 deleted file mode 100644 index f7ab9d5..0000000 --- a/zfs-fido2-clear-key.8 +++ /dev/null @@ -1,121 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 4, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CLEAR-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-clear-key -.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 : -.Bl -enum -compact -offset 2n -width 2n -.It -performs the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , -.It -loads the primary and every backup credential, and for each success, if the device containing it supports the -.Ql credMgmt \" or credentialMgmtPreview -feature and has a PIN set, tries to delete the credential from the device, -.It -removes the -.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key -properties from -.Ar dataset . -.El -.Pp -For every removal failure and missing device or PIN an instruction for manual removal with -.Xr fido2-token 1 -is issued. -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html deleted file mode 100644 index 97e05e7..0000000 --- a/zfs-fido2-clear-key.8.html +++ /dev/null @@ -1,151 +0,0 @@ - - - - - - - - ZFS-FIDO2-CLEAR-KEY(8) - - - - - - - - -
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
-
-
-

-

zfs-fido2-clear-key — - rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 - metadata

-
-
-

- - - - - -
zfs-fido2-clear-keydataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - :

-
    -
  1. performs the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=passphrase - dataset,
    2. -
  2. loads the primary and every backup credential, and for each success, if - the device containing it supports the - ‘credMgmt’ feature and has a PIN - set, tries to delete the credential from the device,
    3. -
  3. removes the - xyz.nabijaczleweli:tzpfms.{backend, - key} properties from - dataset.
    4. -
-

For every removal failure and missing device or PIN an instruction - for manual removal with - fido2-token(1) - is issued.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 4, 2024fzifdso 0
- - diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 deleted file mode 100644 index 247ca04..0000000 --- a/zfs-fido2-load-key.8 +++ /dev/null @@ -1,98 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-LOAD-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-load-key -.Nd load FIDO2-encrypted ZFS dataset key -.Sh SYNOPSIS -.Nm -.Op Fl n -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 , -asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into -.Ar dataset . -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl n" -.It Fl n -Do a no-op/dry run, can be used even if the key is already loaded. -Equivalent to -.Nm zfs Cm load-key Ns 's -.Fl n -option. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html deleted file mode 100644 index ffc6446..0000000 --- a/zfs-fido2-load-key.8.html +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - - ZFS-FIDO2-LOAD-KEY(8) - - - - - - - - -
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
-
-
-

-

zfs-fido2-load-key — - load FIDO2-encrypted ZFS dataset key

-
-
-

- - - - - -
zfs-fido2-load-key[-n] dataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - , - asserts the preserved challenge, HMACking the salt with the on-device - secret, and loads the resulting key into dataset.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
Do a no-op/dry run, can be used even if the key is already loaded. - Equivalent to zfs - load-key's -n option.
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index 0bb010c..cfadb9c 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM-LIST 8 -.Os tzpfms 0.3.4-29-g1d39364 +.Os tzpfms 0.3.4-32-g56ada0e . .Sh NAME .Nm zfs-tpm-list diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index b1e3fe8..9f0b982 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -166,7 +166,7 @@ tarta-zoot/vm - available yes - +
December 4, 2022tzpfms 0.3.4-29-g1d39364tzpfms 0.3.4-32-g56ada0e
diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index 40cdd7e..53bfc41 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CHANGE-KEY 8 -.Os tzpfms 0.3.4-29-g1d39364 +.Os tzpfms 0.3.4-32-g56ada0e . .Sh NAME .Nm zfs-tpm1x-change-key diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index 2711289..09f2ec1 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -219,7 +219,7 @@ - +
February 28, 2024tzpfms 0.3.4-29-g1d39364tzpfms 0.3.4-32-g56ada0e
diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index db9540a..98b9adf 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CLEAR-KEY 8 -.Os tzpfms 0.3.4-29-g1d39364 +.Os tzpfms 0.3.4-32-g56ada0e . .Sh NAME .Nm zfs-tpm1x-clear-key diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index 1e06f0d..51bcfac 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -103,7 +103,7 @@ - +
December 4, 2022tzpfms 0.3.4-29-g1d39364tzpfms 0.3.4-32-g56ada0e
diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index 409db04..0dadc6a 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-LOAD-KEY 8 -.Os tzpfms 0.3.4-29-g1d39364 +.Os tzpfms 0.3.4-32-g56ada0e . .Sh NAME .Nm zfs-tpm1x-load-key diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index fb1740c..d45f9f8 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -139,7 +139,7 @@ - +
December 4, 2022tzpfms 0.3.4-29-g1d39364tzpfms 0.3.4-32-g56ada0e
diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index d6956b6..c4aa80b 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CHANGE-KEY 8 -.Os tzpfms 0.3.4-29-g1d39364 +.Os tzpfms 0.3.4-32-g56ada0e . .Sh NAME .Nm zfs-tpm2-change-key diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index a9254fb..c2bb207 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -265,7 +265,7 @@ - +
February 28, 2024tzpfms 0.3.4-29-g1d39364tzpfms 0.3.4-32-g56ada0e
diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index 7ff5798..f708e1f 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-CLEAR-KEY 8 -.Os tzpfms 0.3.4-29-g1d39364 +.Os tzpfms 0.3.4-32-g56ada0e . .Sh NAME .Nm zfs-tpm2-clear-key diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index 17d2e0d..4abe3fc 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -154,7 +154,7 @@ - +
December 4, 2022tzpfms 0.3.4-29-g1d39364tzpfms 0.3.4-32-g56ada0e
diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index 428a8cb..cad6441 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-LOAD-KEY 8 -.Os tzpfms 0.3.4-29-g1d39364 +.Os tzpfms 0.3.4-32-g56ada0e . .Sh NAME .Nm zfs-tpm2-load-key diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index 32e3e95..683ed9c 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -138,7 +138,7 @@ - +
December 4, 2022tzpfms 0.3.4-29-g1d39364tzpfms 0.3.4-32-g56ada0e