From 882d11cfd8d0068bdfb1fabe08df68dd97396812 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Sun, 3 Mar 2024 18:00:54 +0000 Subject: [PATCH] Manpage update by job 1161142 --- tzpfms.pdf | Bin 81309 -> 65719 bytes tzpfms.ps | 906 +++++++++++------------------------- zfs-fido2-add-backup.8 | 125 ----- zfs-fido2-add-backup.8.html | 153 ------ zfs-fido2-change-key.8 | 186 -------- zfs-fido2-change-key.8.html | 206 -------- zfs-fido2-clear-key.8 | 113 ----- zfs-fido2-clear-key.8.html | 143 ------ zfs-fido2-load-key.8 | 98 ---- zfs-fido2-load-key.8.html | 117 ----- zfs-tpm-list.8 | 2 +- zfs-tpm-list.8.html | 2 +- zfs-tpm1x-change-key.8 | 2 +- zfs-tpm1x-change-key.8.html | 2 +- zfs-tpm1x-clear-key.8 | 2 +- zfs-tpm1x-clear-key.8.html | 2 +- zfs-tpm1x-load-key.8 | 2 +- zfs-tpm1x-load-key.8.html | 2 +- zfs-tpm2-change-key.8 | 2 +- zfs-tpm2-change-key.8.html | 2 +- zfs-tpm2-clear-key.8 | 2 +- zfs-tpm2-clear-key.8.html | 2 +- zfs-tpm2-load-key.8 | 2 +- zfs-tpm2-load-key.8.html | 2 +- 24 files changed, 287 insertions(+), 1788 deletions(-) delete mode 100644 zfs-fido2-add-backup.8 delete mode 100644 zfs-fido2-add-backup.8.html delete mode 100644 zfs-fido2-change-key.8 delete mode 100644 zfs-fido2-change-key.8.html delete mode 100644 zfs-fido2-clear-key.8 delete mode 100644 zfs-fido2-clear-key.8.html delete mode 100644 zfs-fido2-load-key.8 delete mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index 122eda16cce616ec9c197804bf2d9c9983b98a7e..ba9316d848b218e797f4ade94a999764016f49b2 100644 GIT binary patch delta 44181 zcmZU)V{qU>)Ak$Nwz;uw+qP}PV1uF>Ay|LUkXziNREtr(3~Xj{)i4gi1oKsHwi2- z{1{Ef%jEm+fW{v)wy8NX`kDeC208rrfz|N=JMM=3pL8mBvD~%Fzvv8O;53kPHFQhV z)%CyB$*r5zPC~t~-zQJ5I&xo#EpIK!vryJ(!=#ECBu^a(AQ%^3zrUWXt@n!pzibwu zR$D}1pR;TCUJViQJ0ibXA`%R=EIWCyI1(8G6f>#NfLz-Ej7*7w(AWWlwR?Llc9aju%AT2hlZzvweOj5qyftEmUBrH#uiFXEHi-93b0cX=ZmE#bdt8g{{&J}F05 z2-a6y!1DU&2H_^gt0aa7y=Ytr#*D z5;Seuro|Tn{n~olxCF?98kIH@!)#8pIt4-cWDc_eMa645ahW(v4K(>c0rvtUNi?ft z9Yv5(rgGZ^n`R3>KnwSIzIN1$vc^C}z>Ogsh{xW~#B69UFOZo{ddLx>3gxMj+!Qzf zKAVngn-b9b<$p0_D}xN+>mA-p8#FyGv$x|qG0$6;y*cvP-SQQR2eQ0=4qT{hl3(6u%Nj`&RcN&d6T@q}`dq_scwB;73J77;wG<6Nf6ViB(tJBEbu> z!7yafl9(pe*cs(esvk@?jC08hR9gJa(F;7UQ>N0c4pc3$pYfD;6a@pWHl8$}8J8>; zFD0Yl{#xLJ7jP>`U_8i@RHyZV>G#&`YbZ~+wT6~mPRm6f<5yRO`vVl--5%+H@S^9V zO&NgKS8wAG5xqZZlH1dm?4zJy@^1SJHE$1--yyw<4O+u}M^Sv9_7w((D#1(;iWdhKJ1o?41H=;$VaA{Zo@_QZU@RWhpaDj+$R;$t!bGm3+lUpj;7d zGJt=xp}6)fGlfRNz#Lk;(DmaUqnf2{r|MN))wT@2NyX=5UZxoD z?5l$61tE`Xi+KOzF*;oOm#1YvFh$0GH$jDGBx7W8XtGi#ZO*c zSNX&z&%qblPrl9zZ`*<8lgl3228Ls@4cCdkcDQ-r5(qA0aEttCD0ZZa{_D{YyX}wv zh63I042wJlFd63Xwy@@HA4JRdr_D?(ZwY;9)wNsQ$`!OZ^TeEGc^(d8M`Rg?m9XF!2d@7?xd-_+m=f zHiJ>!zUz+A)gdCl2ATmEl+d*$wqOX7*ErPuL28k~iTcOPVLhLesklJbC_-9|j&>w( z`jdN&LQrz>zLk$hH@V1z4z;e5&6o+Bo?^p+Qa4l~O}DIcLGU8snKGSkPUzvr6(q?I zDbcg~roi0fLuFkLL4-x9cz7s}ov+&N0vIuyL+f99pmE56z`zT2t=@CS_s|;>+K$8B z69X7yx1!eK5S)@9)g{MQ(pWum+!-dv>vxPN4qbpq-HsRJnft)^r~TXI@l#}NHPH{n zHBerBp@eF#?xJVGx~F={pD}(_m$YxM_fJeGk0%NO?f87HyMF_-zc_P^X1_Vb z8ukYAcNLw0lP7s+JvmJQ4?08jZU3OS(whQ-_TRTY`5>*>$LmSWEoZph+9OaQ%Ulqh zJVAzF15i+9x*_uu4a7pLdY|0*Gg1XR%nWCIiR0(n(y3Bzr30Lui4_&4SE7NHvPV(u zB6ki^`zYUT$xKpSO};ZErE?5@jneZ*;$LnafKC@sfbTdoCaYLy_$&V;h`NH#B_j-Q3RK{CXq|o?O zU7^74H*u~?xKBv>u9m`U{7NgX=Vws6+66u^wGf!j7`bHG}IaF?ToWqSlW=pEYzzx1s2;m-PMdPRFP zU3q&I?zkzxn4)yT*!^X|*1gdL&|3)#_K|e7^Yh)64p}CGV*X4p;LTlZplR@wz6j_B z8oa1M{eb%|*tLP?8>34?KE3?jUiq`gm7Qpx>=yAxiqycIrj;9U;CJ9}No=0g*)?b@y z-ahj%En8HZDt_9wnP^OG`i<^Ox*hH6R6nL7P$zty}6Pi2*doqm5a?YyprIQj3? zP~m%KM%}jbd%Fp8ZwllQGyBs-j0+j5;C~-JbrO#ZvanxO4*csE68Hb1>PW1hIXW^_ zK&V_1JVj;>pc9MVL>{lyPOV|ruHEi>CdrOfJhJ?vb}1okuF*cPLt8{n`DGuQc4b(7 zVUVCrCp!Q5Z}?PaypVO-5ichC5~>)DF~?{~Jt8m8FW1yzscGF&r%j8JZZo3V)j;TK z3yh|rw#Fj-757(~)5k=6!G1Io_-o-%_A?u@#1+^j047|kvLbfmB35pVwfqV@HvJ0XOq;EP+8#~W1 z27HgZ0MW#{RO^HlhS0E6%Nzc+*!P{^Egkiq@4XC;9h2IWV0Zq!%ok5P5CypRG?T+) zcNE=(r;<3Y{4T#-rq3BP<{4d5Q@uK4U7*y1od9k;i(G<19`16rp^l7H#1=amhgfAh=8b4^bj?u#kjf`2#;5i-;Ry(8hN~iPvbdzK-&dPBDuVlYTXE>?;U1ET*kv z_T|0AUq}T`S&a-KUp1=Rp$Ic(0ZSPku({&y_7O5qU9ae4d%)XO@z_mZ2QMj)rrIN` z3BwkZ#hb8>SVQvjWV1`VpqU#^vcllQFY)T8H&Aev_CH^|utfR>iHM)hIHY56`#Hq-=1U&-tyr~t83rc%M^~q|IYuk7@c&C zHoU$)X#UY3?TEPd55d8)DVf(V@E6);x;Ic*+}(SOp-4uyLM2rhMjUPVOR z!3)ptl6%<;iQcXJNB4}5gGj`wp@k4^Gi!O7E44zDGzfX@BPDu8!^9TQPLyRYF6bb&HG~^^S9?vEU_3 z=IW&BS#&TZ_ySwY>I;>Cx(O-W`1=4~>oh%7A*iv^a?@xeBX{-R4toIt-~`f}4z-JR z7>#w8LxN1UH7hS=?pB2)Ppgo;;K<=g(#MvX|0b=Nh94-Bhv4H&v2PQG;KyY|olC1X zVPJb2$UV0b{DbQtuxXbc0)FCwv@YoT`grh~*d|y~!js$a-eQ3OYRE@AU|lKPtchx$ zF{A)%wkFjQf)lobmgt!a^?cS3>E<)8$T$P*>hr%S9PZ4_>-dCo#RLZEN{)zph@GS= z7E>dMm3c>O6EU7}tON;TnlSyk5e>746f&u2^tuJ*I#3!@K$K$3l3V|WNLb}PyMnnr zdo9rhLitY^hN1z$F5j+*52d_{Ye61Q`lPDO>Oxaiq2?@c4_X-EFh3?>$LxJ0eZ zM@1K#xDbn3v;;MkGxf?m{E=x!MAE%`96F+s-wjvT#1EqdI5tocPo@&bZ*Q^hlJ|Zb z*BFTV7Hvf^yTH+yG9wKyV3~&HfcjXBBw&#g7Z9!C{Ng~Co zn=MLby!h&#nl^dKNei?g44=PJm;&krZXMc=pbu4iJ^FMah$!&rw96`P5IsQP%!wvH z1NzsRN4Q4#ZCF}Ur7qdHN@ z$7?*|NEYD8hFJdsYmja!7&X{zy}Oyk#7%KV!<1TJh2nQ3am5D0FxQrCek#t#uJx~T zW>MvD>H@tPcvPh1M_n-Z-39%!&;HrORI-AIB)`?h%5-#hnSJkQ!_}wGV&;WrF_Nta zQY3e|G|H-ydI^3-ZWajT0~g6Z`X^H^lCKR?Q>uU%<0gOO{%|ahCQM8jP;D$J6GK$*y}g&ao+k=i?pJY)BI<8Cg*(1x3A5 z!Hxk*@lUg*)T-`(rX;JUnYdBgf{ky=XoQL?k-TRSdLUWMI$zrAjeAq)6zHySn15I% zP0i-5+esxwD#^!o9>EBln%ud@U4E^`bKJPGu@++#Asg^Wi(4MF*L(8qbP=xFm2*a6 zd62_!Km7f==~*e|VjJl}{ap80FlC0)$9RZ3c^D_)Zk;2zXzR(G zPN={+n&0|dFAqu@bxC~VyYtQKL}gKbaSwuPu*?9lnfVoBHJoPstHrQMaLnN^`ZgzU z_qOa{g*f^R}$k7ll=nUE_H`@yalzQ z;OfJl_w~s)bRuvoXy&u+*5RWwXN$;hL-m_CrG^@z9Qj|rYmxxFy1!c~+TkxHZzF!+ zjp(0v@ z?#!xeaJy1IZ+wN`-R!#oi|g)+{)iMdY&H zoNc+km*OnveLG9AGsV&1Og$Q>CRl@r~*qvUiwD?DxV4!oJyB->KXQ>nE%M1XLMR=dl%IvWvhoHoR z{%8*gMxa6ycW)gI&77TeYe)lLUYk24Y6q&g<*xVogwOM5;v=Y__+AeJXobD0Zt54U zH^js&b8a#`otb3&6Mv*nzi*$)DK;|%c+1Y~=HT2&S)%o$>KU)texzZSJqyaeA0)IF|!pxlI7)4I~FDsFgg9 zC*7`Yw+C2wX745ft%9ExgYdL?xI$h zX)3P++tUG_^?k{RU(;k~mWB3O3!{|g zkemA|C6TB1%k#|rbJ#B8jVZWfjyNwUW9|9&(NeLi1w|qtu7~lrno)Tl1 zYHMSOnUoqbzW=$rE{(d1;+Q(eV}~W9+FBvom$niqh#?91t{+tO>9TY{rt)FoK_26G zPhB!v=(lJPZVF%w5dBPlG^)6@jY~?k1~uaf@zUz}L}>B*DkO}JtR^;Zx}0fVZ(m)u zOro{W__6*y?*WKrpT{R(sT{z7kO@NAB}F+Uf}=7eYqfvodt`=H(Oj7&D@{jwD{UKl zJm0s|7%4{cI6D~GpZuK>cn=WBcBh_~LjrYJnK_=1uv&N&tgfF{mZ9*SA6G}RVaw6U z*dZ1_L#pX%Mqtl1hV(OFM=XTR(eQk+?cvgLK~MjHi7qnFKO}4nOGt-*Zt4oG1?o2%t|bpp*+YJh z>?{lSRA*8{o>QDqI!nuXi9qz)1xLFN zL5K>xc+2YKOm{v{xq961{W}Ff!&#gP{x7(5{{O82R*wInbT%F~_Wwn9w*U45*jWBA zx|eGkxNUV}=J#J{886O;T|}XP1XeOB=u_tIcx$z#WnXU+B8m^AnZ+ET6=B}m89kKx zfhLvwqR72=zltVA>*Vfy*>7wjo|diV zvvCg=@MPZy1d4^;ATh?16M%!P!Oy?~CZ40`DaiuCS^Kg2*Ak)o#Az<0<;qn@0Cez= zcX^Bh64~$?zXv0bpyw`Y@6?;Q`d_^;;M#trmDkSXpSyyXK3!rSYJ|3wtnNk}X6y6_ zF5^kHOg~lpj3fgt`RPW}AhVLj-4f=M>ywYshPcEf2!<|!hJo8+N`zGIXg-WF-@%hZ zYZ~y(=3Or5Puv=J(S$AxYrVUB;7`jVD+v^#^PAD=gqIq8Di1#s;-bEQ5cDZ^R=$cz z{vc&mgv_E91{#xuZn{pUu$xNTDcs6H;#NHP)%jKr`>!Ti-U=0axbIa>ccvJ;i$V?2 z3_>}vKC*oA!KL+E5*n8XhI_NcwI?%1%x*V#8rUW{bF2sq#uG2~RV&F8U^=lYV;hy)g<3gLVZQ_chG$p5t?HNvG=)oG}w4I`q@kiDC>jS?1zE7!F2W zxQtT{B$`%9w5J)BfNCCj0G=~sswOYnZyo+D1GLUxk7J(wAFB;xX;Qm04a2Aj4&IqA z)!m$QsTZU)mKQD`=%C?&J zr{*5<(Xr=zPt+3~j3qq_^dzU2s2JTJ`Dk^>Hinus?9vFiBJ6{Gz+L!93o7q7#zssl zrun$>k1_~bSB@AQv@HzI5*|0?FyB9@qWoK6$(3~M1Sv`VwYL>pw6QpfrgJ`%^2O2V z!UU88kpw0*=pqt|2KJ%0rfuQFXMOD1kF-grtqL2D-GYCaVL#wkcX>UKo3T|#WbR%k->Y}hT8jfO zKof^3ljKk;HD(#=AA4JzW&6vm^%U&hEy)y%_n2%IdKcmW25@|&-er`67o93DaybD) zfzn@d{|x>yNxd8vqyXTO5jj%D8JTR7o-T{69txw6><~=)Owl5DijS@rm257=v;@-1 z8Zo=ykWO%oz~?yJ>om=O1Z_4+=w8eq2v>*6T0DbGQ?=C{TYsaE=9qFbM$x&oRcEoF zb%s3XFixirko_4Z+?%wr22msC0DI;UzwlR4ZWx*yN!|@w1!I#=V+#ABt8SAD)0ZOn zO3dheR&igo%BMqQ7BeiVBpItR{K>I|y49G3ABLurh&O0$>-jYeZ&bo3JNo<~nut7} zd_HPFHF#Havcg2PsgU{XyV##-bR-9<+Ey2btp#HmC|eNZij zULRozcy2@-HoKt`#aX^|5jII$X8H$MG^2Z)j!ty=TR91A+tdg9oT)@#q_3lna z&s;HplLzZ8wr@5(&NsE9vZ+s@-+t#@FAPX}yZlAzwk^FW-w$7Ur+$o2!q2k&{Dani zKrVmJ{FPGXH`LOh%2{|dVaHhQ(xC^s7vPJOM0;-S!@S=Q@gFC95n1Gh1@GRuYNyBz ze(uS5hqzxpI+WMc4L4^)1wYaEYCQ<0`{x3{{<+h>+V2jqJ)Rh{La)$~@t(YvC#$J1 z!@+r4QqHij-!VhJBgrOgu4pg8fv`iUe-%B`ZXV!sf+Kve3D|-+PQ|BYMSZgnpB-lK zq4cP=Uy1~C(koP9jNYpS6McdqY8WnL42 zSFwaAt1dF8twc>}VKMc3IF=5u8W-J_4SJCQ5lUqIeNDY6p#k})Fi6(cU~om8Q0ZALuq&rU5)Q20x?qbplhF-!KD;6$_7FIxAJadd#TJd z3${;N=?m8A8}dHfO!U8eb+-TY)mgZ?{*OB2{a^c@?Z2IMw*TX-QvzCBj@y!G5{9RA zZwwS9&yV3+3}AKkbkS&XtG2&`(0!V$lLgpXxhZyzq=}$?Cb!52n!h_&>~}FoVLwQ` z*9|h&Dit*VaR@c>$AM?3UL%xN1AqPb6RqX1=$Erm-=<#JN94 zCVk`)VE)a;gyPO;nXFp)xEiXii9L5vdjz3_GoTo zlwfRE4cPG?BGMg$Co)wmtrAc+xKI)Yikw*}mi?W1EK%+9Vm?S%AM@-2c1W{q;HPq{ z6n>c)Mv1|U{0Tffy|BMK6b({Ym+-C^qIaTkXkd*2FJwMa2386F^;YL~Z!ak+=E)T2 z`S~n!aZ^#SEBZZJg9t(W{PSJI*h=MaVKy7e=-=^6NNK43!4wERs|8w zFMVW33 zpFQ;~usHK~VjC8s-hkSt-sFD6qWq;D?@0APfF6V zbJhlxCLsHPDkR5Uptw5pAb-50`BJ+IJ7Jq~=o|Ceqv6sIso10AkF4ge62;h$Tvg2X z<^rBl67=5NC+gn>L}6KwVoX6Ih*4Dow8a~f`DhgfAiYL>`TK>`@EO5xgVP z69FvAuvIpZ8=>qt#zwW>l4;u*EuvQFnd%w zy{I-K${(NaYhXJtebv=@m|9V3d0a>#&<*W?7#%msG2?jD-ST}&5||XWWrW1h7I%at zyv3W2xhXthwc^74&^T*W=QxL54LbNYv}t>SC(C_Nxm1Mh&ovFUq^^bI0Y@pebvT5q zFc7|kU{02-QMahdhCPSLGLOhC4#D>81z+xG+9evd>ZO13cfUYY#5ZE2Kr*PwiHDam zB^$0+WCSIraASd1~X3zRg6tPD2H#1o=7NF~2 zBz&1kSEe#KYM4V+B#07^)Cvw+93jFCx_Z5eidZUz8JVtLtHaXCR}f=FZ%0OwM-X9| zQLIa7^;;ArXlR`^8CmX(-_-VE4ytoaM-W$>b?}e0fER0_7pHv)(eeOga3@DmwycLT!s}M1Lwn!Pk+c^C}ysE;u5CAle%@q%w ze8x--7v-ifetQ~G4A-?y*}N&=4a2Goj;yM(8u>h`x;5r2{R_lpXwdRI=Z#o)u7Jm$ z4Q}Ne>cuZ#(50a`7rZmf0iz>9*sa9<6%-bfkm4|cn$1ER@}Dc9M3yoL_|wG^i}s}T zXqST{l1g>gsxqkwmWiciE&yIC5;;a>XuI|y%xS7c?<%sIg-5{G{lOK7E&zBw9oA4T zU(K-7?>Wy2gAWTDN@j5t_zWhG5suFm)5B|&&WM0cVaWGQ>@H0Q^$!pqMg2VdNlhpF zGoBiRdl^R(@E;H3%}-SDUVs|$yX)AHzv&g0Y4B<&;1})pzV!#Ffn@>Rl}HMPnt_1t z)i)7g8w_94+gk_O{R!2X+`|U(zs@=o(dum9sgNfpA8#`X554X#J#+DzQL(kR^RXwj z$Vy%VY#+}(E6e4j>HPQaNsd43e_oK$I+xqev5mmrUL0$U_}V~ao$C6|>9@y@*hlFY zDXc9#uM0haH-l{%188`3VWd|rw5Yh}7J-jfB;02jDx*E_!>mcng2mcqnL@`ptj#dU z_QUTimKEF<^V7R(!rfI4b1QT0`wb+f7?tPJNQocHx9xq?ZA@P4c8!F9Igr)u)jlqZ)lxcfg;QQmhk@tY!)6C=Kl|{ zx&P~LoQ>!I1#F#-ge^&|(cTL>xCl@+krs7$ty7E5b~G>h4nJMlq%uMX`(}y-1x$

n7wC-86CFBeA*7xbM13Y_&I@TQEOJinW+bmS=Gn5eI%k6cG;h@aHNRLdVRIlv-= zZ+qT!z1Zi7D@Ri-EgUYKSwbleLkIfl+AY@2{RQGDuo3X-+3ha`YfA91(J@=WKc;$a z;hx!L)~K`LWT4lr#7nJ}dsWu{Np~{fN@}~_bC-fuC-x%xYq&8n<2+0%Yl+(tYuV|M zxRw+3cTg; zzIR|97>OHGvAfp?vJBKV?JY1OK~2WXr|JK-))=&HEhajuP-Xj3CxG8V6_-PBiMV~K z@n2E0APv(>_e21m;qtYIiqZ1#vCZO?ZOUi$f1}@?AtHS2e)i?X*{(TM(a{2@p+-ONiK{?! zlwa0+ejj+O`?Au*g%5Ys)*({#Oy8G8WrV4bSou)mcBY{SmF(xy#)l& z9t(DD!BF(PEE&g)1CiB%&)*|LptAUmZ`?q4ek{e>O zIdD5SQ4r}#=bQp+lekRyL`{f-yJT6XS`ab_Pw@lm!YGZ9Jj+|fu6$1$Ha)X&TVg1I z*>*O>dBv_24jty`}woe z&HMFo#mfn6z$l*yON*%in8SY9GnzFrnrV;N&T~7~d9~HXWy2YyruV*Fj z+s{!2C6EGXv+AuW-q!JKEQ?Hzb}%p$daiB-0(x@=xfFEBhhmi%SXPM?@o>2cuUo0; z9ugrHQz?Dt$IZSS<1VXH*tz1&Y+>=0iM$`QP4ErnFF{jQ(9Dt;FL_^_{Ok^5p>T}2w%w<=vmv`kVS>M>L zbPWmu3rW4}NK>l;@Ub594%@fItmwm{+lzSyCF^Y=B=WRGMG70nX5@|P6Nz)^c)bKG zOe^tZwJ@2x9gS4iIWHh*LDefUDx#?t+i^;$kw(0gb?f3=%WKIcrwSHD3A|EjVasny zR@8xL9=FwZ25ra2?^aYP0om+e8R*3^cZjj}d_#?4Na%JTdNG|`4kZ3*$(kGDb0>@| z(-T!0*0`1if6>+-^uuLWbPGu(lC2eQ(T(5vS8$NX2kABnmtNZ;nVB#P$l0v_Gv>po zaarSA3E>a(X3VMuf)W&7Nd{?Q$`S>}nlf1~aLgf)nS54(-Dk^|1c~t3t0d!oW}Gy$ z`8n0Z*AXaSk2?|1KPibXQVI{x7Q8Ba088pl=d_sx5d!v{y~%AIQ4H^S(so$Q&5p_~MITSj?aADlK$?Lw%X_6!4@#LNprb)TS9Dko!gUA?A+RDAtR%%SsGs<7==ytgB+!yRMox6*T-tr_UkoMG|v9wWPM z&2KQ3iozjenL`snc6fyy^hJA?aIeY#~@&?O}c)4VpcD>SsMNGn9scBQ*}}ffm+`YBgY29}KA7jZ$d=9~v93 zx->&pDkqKYj!tCZyI*?(Zv}* z8!D+a^{axyvSx}4Y;^)5iu?XVskiqwNOYF>cPax9gSZBp`ou98){qsOeqnCJRXGJH zGzzw{Ot;6$icW^IoZ2#cnBFhUkd8`rquGr_#Gthu<)oMIU%}34&QFY`Y~Un_=Fx47 zHE*n&Ox~CwC~t_lYFr0URNtm}Bj;L(SueR?Oer-%&kaDcc%UVYl6E`{;;UKn z4(6N6@MDOqc@aEfx%CAjn#D_dX)`6k0?gVUHcELxG4nS1HWU)ynC=fek!0YD(u(I; z!GyhYDeaD^KD44MLJeb+rmePc*3zS^LA97N8Y=?zC9iEzwMwU@xPX?s1WO~}N29=% z$^bM!3XQu!Yq+7))Tx{8u^}THO8_gZ@sC!vW}@3I`aR+C3K4mc7q+Tz!2o87XFEJO zjW+1w!t!~7=Wf2bp?bpA2q}Q~Be|tOW4OCC_|R5w`@{n3&G_hL87cYEu}KZizDg|JY(Sj?{LAX`^nd}l7!Z4L5t(~5;k z^6=Jsq`9Z)_oGX&%&&@SB}9=VW0*8y0mQ#?1v_)E)at}8NQa;m`upGK!K19!gBO82)ll3@NZYimzLwhOYOx>IZq0bzDx{7gCDJe2%KTWh!1?z5Ci+K()4_q6O(u{VH{d}6S&in%gl zChX=33&s;FkjdgjSP?d+FTWG@UbLH!O@_IpC!FdPF(}XJVZ#EEL&O%D<90eVF|a=e zfGUa!sQh6IVs*%8Z%4p&DYfHn|BgNNcs*|DQ!Es10_jBkbV|{<0u}uN9Hqw9EUKcVo)OKoa z#6Bq|CRXl4V#CyE#~?p5|Iv&>V;Ex4av-zjVC0=E)LI%jj0fl)Ub^Hkr``Q^;~}E3 z?2?A4LVXaueOR#yEJVOa8wPCuK@j_YZq4AYkJWS{e%wi25W2wpKks58-hKPOpfDG55I!?0csavOmDz~_VW*g;m~ z$w8XG6*tf=lR3rHd6@N~FD>GeWNo|yeYnJKcEXn_xwfyq1F>sQlKE}!Dsk{e20dm< z?Zq}^+Cx{Ib2nQRo7?RM0^1JY91r&TcQSVsJI@=ZbEj6GWFzPgVGrzWN=(EV(5T4N zxnpSoPZ}u{H+3wfth9hDaS5{1dyilHrxCx9ahS2Gd_2x5e%#>ckv%)J_OH(Lhvyby zH+-rFL&(XAFf7`(9|_TTR0$~2^cxgzU;mCqPv;5+dwk!Xw9I5424# z-=|L5Fv&f?ZrU-Avf$DVEnE{FJqzO?CB1eP7MqKX|2_WUXLJCt%KxRTJ}EnKmhDtW zEQ=|rw_GLk6hm2`Z+eonz2e%6w8@6V+o(`brr&OJpWrHKPZ+o#W>~_~>FZO_nzm+m zAmVfc4NCv#BaN#@uebYcN}MP(^vDgw(6a^)!-lU}^>e-rJ&o2n<^8}}eV55SIv+mz|?71D9zA~ z?WW$cEgzrPjT@kd?D6&SGVNrYs6%dlpMO?BbGq={b4uXUFUBGQc?tQK2E)+qjwp1sx)tb1z*uRkIRmF4AO$fS#MfC9=T3=| zY-$eQU=;CYa2bP5m*lN2{3KgFU0O4irE6dd-0XYftgxpWd*=Ro(^gCUO(3n8e8T8q zNM|P(JqHRb4fd>3kB!9nri=Ram9^ua@InlAs~IDMQIV zRq}3NGpe!~WW2H9O;@WQTZC5B+H=;w3xrLi?4@Rt=Gvv`OeclqoIm{tgke*ULEF8u znIG?^pFW`i(&hwD5oIgoCO6A*B0E^ z7VZv=9)Iv2>J5}0PA0T>_+x>nO;I##Wy0-g!NVOgaqZf2iE&-K5*g>51gn>C84d}U z*U3!;J$dy#;mz?<&Q}8Sm4v^NsI&VbT(+`xJAOYzmQmYT-qV~S=DaB4e4>W>LZ1c| zJ`Q5-rupaIPn;F*=iauD{5+XL_U^RIO^VPuee#3bY{uiR8Xdpkm(n**5`*q!wI?$A zzp;T5#o<+fJ;jf=ttvY=U-N@5ni*ms%V86Xz;GI#uhR!J%w}56TAsbFG3~aP0yGD9 zCbTta3=Z7q3C^_X3->;t6MVV(5E-H{v={>PT$QV%5l5WZrF}rbzlt| z_u#EQgo-#MpB=tTx*m;Yyz>btGLVYTJ;PwYSzr8CvTO}|fW$h=wdsK-AyD)LY!ctM_9AGF z3)k<}pax%5?m{f!g=P_{&;@16*>)}HQRii}Z*N51SE*Q$i6Qkw^lt?zw^_6Q*%C=rrM z%`lr18JJd>XkOkp>xm2iCU}ze50XEo_J!=JtP)_ZZ|V@ z&XdlW9CTBfD$~vg3fXlmJp;O_#ypj7YJ6@rg}pR8cYhLK52!>b-jKwJkzsizr(4fE z?!vPcJ!Qj;iqLuIb!3zylm|N|{VUUD)Y!8#Um~yYqb~@x8RcUD3M|T7xJAxz-@Aji zTS*31erhyO(G!D?2Pr{$t6{Ye9c)fxt-YW4*)M`BwBsvd$=WANMO2C#E#v)dg0%`d z`b|Um*nwoi7@18gF4&FocE{equriSxENjm0x0XC3v*nRQtpodL&wEDxpsPe`7Q0w+ zw8c4&H!q~LGl;zlY_v|n*=Ki1N3+AIr? zJAD-?U$w$Np;S9vG*w^7adZl;V=RGww_qhChE{HdoL1fiPCMyp_9G9hcfswc^(gt` zqEJCQ<*R-NaMI)!ULv>J*WKy2398tb-3kA}EM}so5u+7XwE-JR>6A;tNP84kW@R~s zLPifCF-9MU-U4<=amx9zN`zG;_~xz*vj&%O)f+c$ta;W0#YStIik~s%OA4Y5;T~@+TWD#Kf>}!I z)>q1jw&~iJbeQ$Crr0QCgz(WXT-w`_1sbpCE)cG!m?qEAYMwnDi{in4nja#`Q%Au@h?=nK+<2WrFf)& zR9bpZdw*+=jt!n}f;K?d&u0@_QIev-HFFm7B<9}ndRTs-@!aZ$*?FN7bN-ceYKp|W zUZWt!4GZP!zezP~ok{GG=Ij4w{rWwSg1M^`m@X#JyYgnCHcwh{9L{l5`t4X@F5h_% z#yK_Sq>PZxo=0VDp&ZzG>g4Y~64;QOa9p3o4h&@nfgCLxmgT*^ks@!(t%d6=)??s^ z3m`s4sMlqBK`^~F?xQT3PNhlgnRWP;l5k*@txblR$y-$Pa76lrvukz_yUa*e#XsKw zvMfxE!nzoOZk175{DI8|ao9LqH$7>FB0NM=wEV>rps#={75t&~^`2$cm0x-gOV<;D6`0ZhlI)((U z2Sq}T{has2RkFd+Ho4bEdWD0gU+3pe``{|s=gU57ud=c~m6HVNL8Qe!X$+9Xf}*qj zo+3B5f9VboIL!k#kjS03H8C3Hz4S-kJs^H;Q%_haPkX)SN$a|%JSO=ilv(S~9i#I~ zq)P#1IRI^7*~H)Lt2P^t_`}!LDerOi-g;1UXS1Ko$aa75ePRPvxT;u%zeyE%SpG7` z(|XUDF?@_g9$_Y#p@Le3Ab3`E2gjIp=yfH0*ASNvi9mDh7^d!4cPq1OIKc79&PP@( z&e|uB-TI)Hy7m6G{kGKHr_56F8JEawo%LHe_#NQqF7p#KNc&qqSWJ~8*SNCmw{T-< z)e)3CEB>osT;WPhv6_U0Z8h`EfKYY!egqhOmCtmG?Md4YTuKSZ*>}s{ZdIMen!^UU ztCX}9CvpZFv+_R!p`6Kd@p@vo=D?+3&|+Mh6yg5_U^+OOR~4gSatm z1t9=WXI$Jl*+||zgB~+=0k{J&Pfa8$(yq=6JghmltRW-)H{2u~_l?h=^{V7bCnaF83@zW=w@;w)v7gUM!|QiXK_EL`vg~n> zcK|b?lHcH`FY)!0#)(G#oe;6hn_jZw62FV530b*Z5Q>DA@aW=NHXQ6!=y^uz<7n9< z{}~S=X?8#bCOar8*nJxY4}A&M!qiqC2n)6Dq>i6HQ^E70Evh(lsBx&Yae0=bu{*!? zuR%)Fz$y4Z5+*M-DGl)fU{!SQK<_6AhSewD|D)eI*#BF?1t z9lK&?U|+)fM$X?69NlIi%{-8Jq-`x4d~W9qZeJHo+6;VP5ZFqn^ZQZX4*9cc%}qsB z>nA0PGs7=|_yxiaJI5Fq__%n7l|nuTQFJhXh^nUz6B0wj5hvdyOIUI~AES5r)f9;m zup@zgWNwv}N8(rXf^$WLjXokoBfun~Cp66>Etu@@IelWJsZtc7$-0f$6qJ>Sthd9) z0B#Roar0UZm#Aq+(B_z2f-G4NM>VsKW3_yr{7v9|b<*o@(~eEpQbAB$E(_SY!I^yC z0k&}VM3yB4ba$ZPN(vV<^WPa}tt06AL6^EAg4l%BrRTH#&gX{ysG@UzXMiSB_57;g zdzaUHK)cao>cr4`)#~@20DeGgI`Vk5N4?2}2Zo4Ir5dvH)_UleTHalQT4CK5VsJhQ zWjKi zLp^32UzJjR1KrkS3cXG0cfi%B=vm{w9*rH(gl89&z{)TM(YjV3VIJ<1s!vtmVBNXu zRGUjuWFhkj#>U8YpFedUQNhbeX{!q#;T3-4qI7tLd@*pJ$UjbLz?8^RNgq^`Nrf3g3PK(8aF2LUxaq;o#WwE5d zo}Srr2AGW&dAk0IyeiZkF*-% z`#i#rQXBXr|3E1`DAnj41r*yP&bL2B*xt$fu9l|q#K1xvWrNf zQiKJhe2>T2fAZvqQ<)rp(P8Mw4S-8$yb#tkjwUjpsUTYu-vY=O3jLMiRmu-q42A!A zI7VM8W}$PhQ>RNKb=I`aESo+w4Xg||mI^V%w zm6Mts!A*hn*1PV2m(Mt290&@T!p1-MA;kU?1p-%qTW{4TZ zq6o>F{SBWZl&bvNA-LWk;VA&()QF8s_iOeUDZ-Y%^LvQMFNh4BllsCDpaqKzTcj!_ z8zq9mj0VcE9#L*q&ky{c;UcfF?A^uc_nD_=QlC;GwD(gK99!;vWcRmqD6;-kxhi5|>H z091rd{WkltsiX)*)ExPI`4MHxUASN+M0SF*tRKApr76inAeO!KAxf%-h3pjEWM+P= zWd0Y43K!F20h{xVS`3BcJ5*AIEeT&XmQxzA&7hbW$Q{w6g)cV&ftD+;|LLQKRcaS; ztZ@Dek_skLBlNzwZCUc59&Ne1UI4Z%OC%*_VIpd$ugBp4UuxRRo$Mu~dPjSMJ8%YC zU)ia`R$PIxlW3`A!@sUljEZC5-6E{O{T2Yw+mF~Wsd&zKDGNKX{hscYvmD{(R$YI1 z%wlY0Om#%w;~eIXVZUM9aB{uNLwiOS~)&}y+G@?x}v6nW;_Yua4xxOO81zyibcg+ zz)P|~$Qx3c*YeOT@Y_5w`Asf7B38^9$D^ZQbyoUxLr0;%4xcNHXWE?YE@mHu?3{~8 zly0_7CF7Rn17l2m9F{NeMP8|}@&_IOss(Wn#1+Tw*)Va57fSKX526+6TXap)M$?vs z7Iq@Susw~;wp^|K8`aK|V(hEbX3+88>BtW=EWV18>y5kgEE0mjs*$E?Aj6+zb(mV- zc3oe-QllV-*8SID7bh{i$*@cU(b5P>3p7_Kad89CNjsbjhHJTy+bNIvE)EJn0S>~A z^GKFes8N4CwZ-&zR$>0UZt<$t#^}qmDG^SQ;y_Ma z1(Qy70k&4bXWJeXFVQ2&c99Up+9&jK2 z^xJVYul=3%oesCOW+nU)I3k+?>i1hVR(9adrNF_5s(`+kq8w(Lin>#$%S(deBHM`iJCj&C&v8_s*XsdH5S^f0rrY{WiF;>e$Yqt+M zSuQgVmi6ATRoi2QGDfE(&}i;fA$|_`5Gk1QNdY5pA;jG)@zH6} zYWE6>7N^MMaad_NJ&nxk1F!3k*`fDjO}Y+RB@uI=RRO{IJ!kc@e%EoQxEh(cwNjtq z!k^Ie^f=l;VpTi{HXbf6prEQKphR~gZk-ED%IT0cl1yapSD~a@FF3|;*&T`ns$AXm zb4UJ07#=Q%szgf7q!AY^-)7I~9=S~yWLZ@JyKI)>BuIu1hIc^EZO-LvFBvrY-e}&- z=F-Qc=z62^Oymp3(r5L<(dvyo8}c6X#8ifnf{KVL3M+w>b-VB_jt7i5U}87p{&pg) zyDLEc{LrZs+x7MJSh-cpi(f2ST{r68`gsD^T|fah#4z=g{ghGpSqnpX3H_{K|0E_X zJ&~poJK1TUTv~|a%IpZ`z0b8yx||PK2A!L)oXxP=La4A01@zYFG*xFFB-JrxHzs87 zw2pV_@1fyGjzJ2k8&q;Cr)-N zccr?1zDqC`4}3|L8;g13hUbSfhN^H=gITOsht#;DhW{k@E818fps2gNt;y;xe&4ej zCxjP8I_rr?BZ4s?)6kHa2|FZG3=XQl3D{PBqFHT(*{1krdw3swz(ctG(1g7(bo;!2 ze{*A7sttua-C57Xl|nQ79_f`zvol4j)Y^Qg{Wq33D4knB zxiGeULD9d1PRW}RuzZB0-6@*T1!A&NtQY~<(y~VCt-p9W@dxrI)<9R75+SXj0cFpe zB*7Kd4-dz6@j|bXqO!~KC0WKL>&M_6qOna+GG7LT-e|Ek`GW>)BibUou}p>uTz?5V zk)fHQNfqb|%Sh-I*t0_@K;Rar`X(HJf*|Xidv#!z!jU=vc-U~C1*=-GW6~6QY#YF8 zDOP`IyQBtWVXq3+LY1MF`yGVltxZ{?kl=YCrkaZ5;u`s9iBs-(2A>Xk=1Z1;;uPca z;I0qTc~F?YU#Z7%g`v3qWOc}b5flG$-JbZ&DJyjFPm;Qc)_ z1V!C|W&s*7d_L`q;^`dPlyK&|!n=0%S<7X!6}sL9AQ!q{sCHxP!YbN(ISxF?#;+Z-0PpLwDL2+?`&qoi zL(aY?K&r5DuV1H^r+>YUL2s@xL+PcF@}`0EAvl^td0&6r=`op)2beKeQl@wsOEhtk zZH!(34JtFl{2jPs6^+OYBZP4gkEHGo4OQ(c(uja;!pb+53Q8BcPda)XIu|4CimOyZv5e;K&J#zM9Nn!K9KkG#pgWn*UZ+c=5 z0hoH*>r>;4m8lWevgIz6C{$`;c3?THey5aOWtHTs2KranTcSS(7b$zmh&5{j^8 z{W9TBYQN!Rv0scEDD_&gh_Mq$c?`%tk?f-g{5i;xx`y4ChpQ;FfgS&?>3AASHLaS& z1O))YJ@}IvPw!Tc_oC@wK{;I*lAQE>UZUt+y$73SAumeetQkw~6LKuvqn^gA9QpGaocCIrQS>Elv_7~*i+x5q%Z3HrYBak25P&ly$eG$VX#~( ziNPORSQqEbT};ThCTc|m{ym1Y%M(_46ZxDXp{kCumimJFd~ZFG3#ccclv3hy-(;7K z?|$zn%_(7<%Z94yW1Av6cML)&4X7fl_0hbK-0(Ou#qzKsoy8BTNtrNOtz}m&z2`Wa zz+_qM7x+VyDd%Pn|7Vuf`yB)wy<;g8`9Us0?+D#_Qs%q2W&ZRV$ygyFTVX1E_W^}i zNWoe~-k-SP2JR8REK3W_+Jtc*ZxkPqWUAtZ;Up#5-$_(t%ilCs*)e=Yp8@4)A=hIz z>0%{PN{_N;@~B~n7bdd-zdVMQ+|b17q)31m+MvEmC<>jt4=~A6=Hutdf?5QX5J52$ z421N;P2dgYeOdu&m?|9NpkhJ8$$^#X>vV{mg!1bSq|k>9?+(5+822=~ht1!PI0#ue zYfz6E!nm^B-$RoYw@1~6zyXhR7%YnIj_Q1plb2|!Nbo}z`41bZqG{2P{*MPIn!=sA zHXYbDp3Y&F4rS9LAuYU@&=kqLY^>v69-LW7Zm1M>7Qrr``si~{h z8SLONyFRaKU@1;Yj|&J&Z>w&@fT-hFX(>dLV=U@z$_`(mlMxLJ3FK76stgw8RT2BC zxRls{5lZ>GH%JRV%3bz|Sfh={A8XyxgG*W8q^5CI_ODLn1)o;GqempmIrlU-c8TwsNYeBC* z+~d1l3Np31G+Mf9Ky)6~Wv=m5>OwE`D>Nk3OeeNFR#kU1~3kI|3nc8@Aj~6nVdUtU??;3!Z%`a$*wR-$DIiI z;f4>Os1Vr|vtZJ?c6w2&B`6Xs?=3#m)Fd!5(GNjpi2#VEZDOsGj^sz><%%ww+OzVk zDZ!~)Mwpdk*W1C(yIW{2d!UOsmyh^Y+4Y&fjf}{#$mcB1K6!kfbU;DEgs}TQ3XG|p zfNj&xGpId}uW(J+ujw$ZyKsOB@&8FJop9V$Zf|DXH;baJasZ8!VFHh}Y=K;?qqKt%| zBGM58&~ss25n?ut%}0h1Qa3GaHe8Q}4u86#6dDW)zq{WuQi}q8m{QDLNfzl{7?asv6sj^1(BZ$}^@;y?>*$&ZRh&m_{?1wiw zmwr}nxjf0J(15kxF^`>u`@Q$j3MbiD>eZyQiLo=TKIYV_D5FW4K3No4JSp?`9Gzaj z#=11_v_Ao^f`&a=PuU&6`b#Fmb?^YyxG}PdxK63kBYN3gsu~M%BE5+8 zGKc-e$94bvx#>}LqOe8xeuKPl+tr=Js?)5YA+tSf2(!JU94q%CZCvi)ztNp@uS~II zo2=e%-8}w@8H;agJydJZ3EJB{RBJ!ee7@`w=)rIo$bMd&#(w_3E{$DnJ$!;?kG~2E zE^PrOHF&y-(kW>$eFtplb#(fKjb?&uvR;eZJFq~OvoafZLAp1`Uh$YJh=7u$f$|6$ zn?%OfYW5T94SmB*WZgzw$ff9V{IKEVgI&kwpVCOuUIv{z(;e}^2pfostpMvWvYd~O zH%An?ZFT0m7+DzhZ`Uxj0{LCF_=xh@ji0nK%~b zKHd~Ay;dSQqp?Ek?36m{oMUcxl6`>?T}Y+6bIC=E^$C3bqsp_3C6fXrw(6U6PHw;F zHQOMhA2|D{s>W*QTIocq8q|n}Z8AA^bwLo%cm6R=@EpXLcoT6okjPT*LOI_{@Bq9p zR3maQ>?bfu?}OY8fTNA}>nGtVHD7l9!Ibj9qy%T&Ia2L+%oq_95$V#KTXZvbSaDcoEzqra2dPrr)hzfC;0e=ek*N`J zkMuAvtRTL6J?<$uEK#-$N%hbn_5mWe>1EoKII77W?O7#Di5jmvF%&MM7n(0>WXi|$ z@Ya2Z#zK`5M2OC{=4iC}9g8aPj zD8vv2{i1?2kZF8mk;9G$f#rAQJwjv~+2&K5m+TA20^rF)?eXuRr~r%ZG%t~S zy&gQ$pZ~T&30(9T!uT+vrPkNlE&?dG-*imxTFL;b?N)vP?lD25N8G@Q=yCBKMQC z6^Eq*{h6xLsJJMT_Cd82!-BLwAPidjr=$-!?=j?d;9mpkU`vYX0{}}oljueueslUh zFBTgHr}yMe;`1yX_^{%M<)bbue$mRY$_2ZHc{gb6fU9LrE;Ja^ckw*vQv(f`7@yGWt_*K&!*U*V$adMXTiU0 z3-EnUCDW(7k@ycwIU}qsZfMLy0iau4LQ>R|LGaGY<~1px z7z#dh3$Q^`Kw54ZD1R=0QGXPuHJ@tU?8K#n+@c_IEC_@ha^{8pK3d+!Nm5#R$gt$$ zB5bT(el0QX0Bk}ot84ZAc!KJXj7d2%5%aMEIODch4;nZbcNUM`^48wlWwYqD|ujafH0S=)aDT=D+m+6wSQYOnx6E72!ADW}4>0caFBA{| zvkF;Oh;w`ob*zZL6+Sycb`+UffWD086YhL=AP+I7LFjnBQ?hJMT(xUw4yVfrD=1m| zXa|(_@HfZMIr+Qf{OLa+`9?4!E}=}IU3z%7W23B^?;bwF`=HQ-l-1vS3Q2;?vp`CM z5sN9E{ain z^fe7nLTS5FSYVuw)J=Nus5cAPwK^o&_exZ&aCm%u-}S``Q;nHnq+qi`a!qhC+Gmu? z!|EL)HT`jd(XN$Xwe|x@tLn!ge-gtT#^0_VaK`rMg2_O<+PV`sVDT+t{welI9Us9( zNK=}yE0V{UIrCdacM=&004RX&Fb)sciSVCfoqs-l^xOh2HXT3jF5WjLgh3L8c1ERr za7h|AsAV4>uJFdfK@lU`YAQY7A&n%Y5uh<38rJRrxZ1o;fHyhx=L|D}3QjVPJ>+YT zwB4N06UY<=QEWOn(Ua+2sa`uN3q_s=%o=bm^LL zK7HUpVk_kONB13mLX>(J7Ls&jGt@!~VLnpB*MH5Qk;J&}$)P&(#NQu}Luea}7xdON zd{JI(z@|*&H%t*d0OvG#L}pLoc7j#K9?(JGiWpl`r+!0=*AnMOV8!uAdo@%sI35@q zXZMnRrAcUSGV6(imF1t+if#)MX5QTWiuDyIgva5v4|I6wB)sEkSktb=EG=81u7q@J z)s7dZWozRDrP?H=+~I-Xtq~zTyKVDfCHg~%{Gy5-0f=|X0wAb5?oAymJsCbkTu!w< zy4;IkO$kknzcBX#to*T8Xhx03BcKzou>N&A4F4FJU{kc<!Wdu4Uwp{e;Ql;L>jAG^^&+ zEZ|7!)Hv$+w=+ShNG*d^)iwU72UAMnPeLTaClxD7y#O+@13k=BIT(8)@XQ5ym{Hu5 zwe0m%5*G=Iy+tI*kB~_pO7!+_XpVL(h{-*5wyd!HW7^jAHP4>xH~4@Lc##I|kpIn{ z|Dn$R@h*R@r}F}J^IbuCfK&P8puE8Ad|N8EuPzETI3Xc8W^pG+Hw#BMSCW52#Q#0_ zh4pX3IQze)|Ja@X@6vxlO#WBtmjSx)|BL!>9NGUYWoQ4l^q&~>{|oisXq5j|$_->K z3IOG4tSeFm1J0CF6aHh~P=jOprw8Qg@LwbL{~ED#1JNr;;SEW?p2*$Njf9m2XjZ`w z_SGb^m5&eXsKA2YhGYE#tYQRXV*{F0v7oX24SXV&;EUzR0 zl2%It;j0jVofZ5*qbfwm{}kc>2a5^y|A+D4KlfKj{HKl)NK!2W_H}{!T6AD{4FxDS z@UsmM_*OFtC9bKcuB-_huU!L{*13VQ014}V0w?Qnz_{3fUnYxx4tY&VXmISj%r5Ru zZWiBdtgPMOSlM}ib`4BWGP>$wvU-hq4Va+7nN}3wRwFb}xC#5~I}Y%pF$j!{sP;KYGv9RxtRN_b%903nd2a{`r<`=9^iYf}C91mbK& z=<0<2&l64!3;~k|ZGaF%KY&R?La3boPOSe?4cs2$0N5PY1?xAfFKvT}cpYJK z{Q*D_Mm6;|n*3d#zKWjCduAx}SZ1!#ZwjFf!xDyAs*^I4`#PBkn+59B1&LmYuEnt2 z0e%q{ZIJV4)40L>czU$FIDM-xzpcGWyGDgYGREN&``S|&fdk*+?3J4~NvyZ>}je6Y9K0YDjqdj@?ThPUK z_mT2US-?eP?=ZpbCjV)X^m70-E=W|Vf0~r3pvH9j;&gdt^J;onk(klouBX-GxZYyI zU%Ohts3fsEHK0$g(Su2Jk{SseKhhIM+Kl{~$tCo+1OrKS$d-76r_Q;}8&H}19RIX6u zYp!j1=co*bXy;$1LwPUg@w$oV_Edl;C9l4}Lp`>VdPDmD6W2T0q=$*Ii_pp0K9auk z?RR?lNE8_Q9W&#X^Cw-yK;VWat(-Qq{y8B@*Ak9H*~$ zNucH60SQGe$CA32{7~=MRR2bW-G{yGoROIlXO9L+HTcS!CX?dHJd;ReACwkIvZUe3 z2R$3e^z+FS@lA73p{L_sfSdvvO|69|nX+I*Vv5Uz+F_dJ>caRuOAG68XAi4>J-{Xk zm;7axe;6;Oyh={I8BfKwonByxdYOB?dH80!1MUkkQ|^}2NuzVYv>ie0DMD-C58XFU7$JYelMUIE)6Brz9_+K8RaTU$%0q4{<>w}7Ws(G z(K=Mbfg$rmLaU2fJqGeUb`q=)5`90Fd`ws<(!hifxd-}jGr*RqD`hB;s{^cwo!ruH z6gQ|cF*YI7;#U0lh~WZIS1D4kAr;T7mgzv-fSBQxR9jAZmEYA}@^j1&DjU3er)Ku$ zYOVa&JLS9N{QrlM0!B%~#*R46 zPez81RK)v97pBZ+TUfOGRbhtE<=L0A&3u#_t+&X(Sfvu*BWjsMT~Ur3J=ZG&D{CN3 z%>g(5SG4c(J^08FpO`RSPN9M)_OMdLk!LH(r9nFRqY1PWM}*0J;?X8CT@t!*a8G?2 z+3Upwc?#z?+0rqqv^gMQu7um}&8Ok_26ZA%lsn#}U0j%2VY6vPdhHW(^{ z&yLca9iHKNqk|PDEGlB(WRpMb6)d?x5jylFizpIInY$$WTD6%!MJC`n#2&L2E25v6 zAd2~OE~CAdYe;%JXMb%c3Uc0wXK{r8pvf@44vXNf_SR(Xz7q6i6&iyGLq3VXg zr7GWwZF(VDF^~o@6(^hQmg6H#-=cN7Bv)y&;WaJxxPCGiyGDn9ncP)n^hJRV}*uQ8ES<#O!ARDMLK=PB&lxLzF}V}%BC-x%X~~h!S;K=^z=7dQKO|&0P`92z%)=)Li$uWN2gV5A@{jOn z$x;^n%*JcDOKb6wIkv%3j627F%^^3fQP-T!{RXSfe`~>ix&$LGhSh0KWlv3t7+}}q z^8B#$;M6C7{hk;NrN}@$1z@ z=mPHNM(`-0vlPAV`0+jx1c^UE?__bQ^21D5GH~6iE3sL;(-B9~X_km=4rb)d=Z$gE0L*ym(QO_(B7IE;>0f^#$tw3ScICoQ>gX25Q4 z$1FvSMpXX7*ieE;JISG)&q>c#;O9i_=__pg3z+m_o1D&tU5MQ?GW=fuLWj6pQM!PA z^8H5R2Uw7*S~(quB>PhK?!g@YYN^_wZPW2mlu$X)&A)6*u7?Dt-KZ|st171GVhU(bv7g)Ju~ zLx9W(j+j9Ba%K+7`CqYKq&#VVouVj3vY1p@K0?`iR}}2EK}x?h`OWTgIA{~mx&W#ZDY`n+=qU3RaoFR}p?wgh1iA}ZzF zQpAxQ8zR*A9a#%AH90VqKy&}3{t+*Z6=>HP{OCC`x3~8-hcv=4PmkWa2=qQ}5G8=q zxot@Sb4jO>iWg;cE)+iI`(!fJvcJNH!Eo#=QSq2xvk@gv1Cs!c7=yC59?95Z<-P68 zH@7H*73a5;=eWubOHnydKez9;0$b2BwoY)Shs=woYrZwuEg8Cin7#>e`vryH)?}^w zqi~$a)<@9Ha}T`sf(aeO(b z;t{KQ^G%X(4wn9W2%gB_P7JmxWta_pY7Q6>0b*4{i?NepkXOZtF<^;w6&ggC#8mLm zcNMd#3t~?Q-P9%1W{S%`3p814e$%_AzE-jhKl95X8gs|hj9FSS4HypM7XSc*=L%H$ zp80>1YjRpv+ zN;xL(56SX`R*(bQX!dAPBI0CB9KHJ{RBxGbq-N2%N2cuH4llkEA;Y|I!2CU(p;W3K z^7p`k(ceg$;qhMgkKYjxec%E0C4`fJEyT6mH&Vuu3VDfu8U`HcQ;L0Z`N&i{*Qy1` zAIp15)*{kFBa%5sNW`Io_t4Ja38dGoH#b5v^=+}-_&pKa3uVsdX+3d{J=-2>5qfKo|uhRZTwqs znMD=95nyU(L*W{w-0vSc&mHo(WQcpVnN=uIg1Q;_xYVL_sOKANGFSX?;&=QGao2Ee zgyd2>SXueqRWg-I{~HRR@|L5$Ph^El(=Deq))|waaJE5QwqoRc7rmsP1mdtxy!P_` z@5Rl>DOeU+>siB~V<(o1(eJgOh*`Mm>1{giU>Ei<#kYMkI(b@ zEjNN7&EJrQ6O&VY!z4mXe}=%%#q7MVAWHnRoj_MZ*I3guA=x$naVrL?z0;9e=*^V+ zTKV1*0|Oe0&zH9mEq-12gEv7Gl3$HFpu9Mq<{?z$hV)a$&uFp*xzIWJyWQ)Q?T-!5 zROUhBJIcZ=4JNw^UXwE6L4!$kMt59yTY?el3eES!mV}#;TJq&k?mcKSK?+#J=%s4o zNor^daNbGdi)8MA)NpVvp-Xv0!`DOIPsbA-y^H$pJj{G zy49ahZL-bjq^qFY124wq1xX3$3x0)*3q^FH@__b$mpQ!yOt%ZjMRTLTxT~fc9p2rS z;8ff5X{*hUf6J1$JO&|N2w`&Wa@GT%SM4i^uByY{e}1+kG^-tMAt@nvyM0_+4^HJj zCh5D`_$cB}g{pT%NJ=U<4xcLzvbYjbixg9SJ9i#VEvB-vPR=;~HB?Td$|9|st!iK3 zkuf)0G;s9MuxOTN9HTyqPL>zbGFqh z>A+=yN*|+7t1f$DjF}?Du2ZM#2S%PrvNUX#`s?1{^5+OS5(u?(m(Y%!nzRq_1q!hi z2(W3zyk}M1b{HAo2%_f6+#~i|WF9B7&rjUy*OPhQz1Eb;#>y{qrfuD_k$-h}Ce)C` z`iYBu&2=EWro;H#$UcYy|AVt5H#&RH-X6{`mGfuY9tDBh)4}4(Z*ZSqt8Jh+&)S3V zX;oqo%FE4+plYkN9#kA?UPGT$d{2Tg zh0Tvc%UKYP~W8 zeU<&~Pu{aFqJ4D6mnk#myu_fLNDW9K5w( z(3{(i(&G^dibyBo^T*wj&D3##sPs1*^dk`NI1i^8u|EX4RZLvS$sn$-b`FmErLsT4 z&+{jK>#Q4C*+XKBbXTgaNfh0&>O0E6sP9XP0M@h7yv$E&2X)UiHuW>C&H#MWli|Y7 zwad*9oXe2|@(`u@V8qTz9&reK9}t{t3vi21 zzLf4AwFOP^U*ZEE@)F>ro0vES-B!<3XoR>~K7yM>| zguJF<+yT-9El7JlcmJ_*YMZ)Sz8F0!ZS(wz`CDU%ixSCxz$=!aiN{y@qyee4@RXn} zmEhLW$oUlRd*@b6|L%kUx)Q_>h>^mOWcfv`_~;cPg8Bfyo9!!xEP%4JcsWbbYs11V z!#N0cQl?1u@vSsdrgFHYY{D}fi~SKD9aA1zYgb-gUK?K( z*_X39GT-9G9?}sqwVc-zIB#sZ%3zW0Qc9V?)ws*P$5x*M7TGx1-lXX2A|m1#xdFRH zj}!$1C(j4^r@z$53Shnew59PmX8YNddo-sad+l2!KXJcGDk;3X8e3-|`lxBakq%qmisC?&$ofgtZH_!7y_&E0bX*&~QvC z{O?Um(Xr>)j)tph!`SmR9mW_rTZBhSG|Eazz>5PH7cp$$GDAwQ)9*FHFOnI^mSle+ zw>tO8WR*1=810pK!H=NP#Ohm?cKaC^_~H&v`f!4Mo&YT3JM`c}BqWe3Vxl@cZ8T(q z1myrOUdfL^bq;+*UYe3Qinel2(A+jp&Rtp0lk-zeQRP-nFWKuDYah>0ZIBH_t$$B3 zG;*d-!NoZkO5J)fF#x%bnSIp&q{ay=vGzo_*@;`uG{#maT)y}{kaod1GbGJ?#ziyi zrDSG7Isid*DMyXkaX&(rE_!&}%8U;y0wF_h>S+QF`Eh|F)2!QET?$yoAHR@-j)t-( z%-L>CQ6AR;+Ge2Gh5g(n5BWYqG3ALq$7CsM*nA-JI}OkAVl$((Kw*3vTv83hN(UG*3LvH71LQqjZlygcc;7L#bNbhcXAYpwJG^zqSJ2G)Sj(p&V%seV1gW_qA z9bHHD{(v)@ckFv#yW+3>x#v`VQ=5&WCce`NWe>sN#Jo0v3=4J$Uz{JWwguVZcT-{u`~hX8<9bP(*0}wTw^N>ufh23eUo; zzu$w?J&vDCXV>cqZ_w22GwH=if1i+Z29dym|5wVx<%Reh_2ZL?s4?FQlZX5Jq*6_f zf_Cu)y?2r);^G2kVMCjas#&$UfW9wfG+Q@13*;1xfHV;XzShqmg=zi?E5=>>9)Pc- zz$HRFjmk#w?2M9UPXK^v6j1mc1VA5!FrN@@njkiZf!jq$nqr9ocerlbFPOXOBTED! z+NRR`+ekTaoz3ID$5X90YUz)(YR{8(y&pa@7%HVPvdF!x!O0=D5(rT9i;I$mO~pENe0WPPMZ?f9U|m9uVxds+Zq9 zF{N4>CI!_71;d|SW{_3hOI=$75ae|wRB8uzxU5T;vZV4<=!~CB8eKlQC;lzYn%8C4 zFPL+-nPK>+bIPh_7n2#n{RLuZ7&1aDk`IA5b-%$K8wZXReIpJ2fJV_Fb>rGR=_$opgVuPld4C!sV=nj*wS2ovFLZ_&Bzw^mHyoA+NnD? z-Wn0Yyc1Q>U*_M0*4U48&*3KzJ<7ed@3?(YAU%XvHzBCKu5*|diVfy}t-h3}`+DUA zmOc1o&@(N5A(A8^0{n09K{i-DUBOK4sh1a6{D=7IEv=%y-kM*1CxB*+IxX8l#g!vG zxpfVd+3GKI^XQ~qcv+?HCti3&#A@uM-i6>@sK%xGr~!x0x57G6Uy1D z=9=Gas+k+(O(B(^exj4k47?hg+=m6AKcXc~0P7|$bMNHfB1Vq}S{>BdEx3cu%)eP1Pe-Mm(^h%1E zs1v<-p2dGY{{D;weLI5fgq+$L?(3VYqG36JTq>kZwFW=#T~^6dX%~?A28z(JVeT%5 z_+>eCCCopd3gZrJpXhMfK99-!q;_DuNcIdGGAAK={FOeB4gk#3aK^(qUv)S?Jtol{ z*KTC{7E9*YO8vCc(G>14%=Ot@X>>I+cVyliv@DTk~Ud)AM4jxd+gv&hmtieFf%3;pm2HbiYN;^@i!N zeL)-Lv?x%pZ3&ROEh+c$T_p!rNb%cyFAG&zcWH}Zt61~#U=|L?E;`CJ($iWR&l9TZ z#&}@IdZ@m%6O!t99=R0Yb`t_sein8j@EI8r{4ftB;rKs=eRWjSU-Q3&QYzhu zbjKFEEGgYBh&0lTgwjhl2&^C=B_&B^p>cj7Z0eP>F}vhPuOQ zK=O65l4rwD6JJp?+K`5%^K5ebNGyD9=#I2Nzysb*OcY!u2iCD}Uzct0XM38+j3iz{ zrX@^7TN<$%0#V*N&gp&$Ocgprct7IMd64Q@>?`YRve8%l*sSE^P5*h*NvF7&x;IU_ zyfvOtK2tOk`f=MF;-Db=GHK8H?J-R?&IR(4j*^f~Jm8zc`0y;h_Ka882~LpDa?005 zME^4pmrMqxg%Y6O*zubDkixUMbwMv0Wdb5X&WGQ`++Xbr@uiK~T-%WRe7Ngiq{!IS zB7!R2NwVr`uVK8`u3#v>IB@-;#bqQpDkn@sWiz3-m(I@?TC{tm zs=o*wI`!aHX2_GtuW%Vep2e)~jN^Yt8Atd+RiKRzn-%C8Cf&or24&(OBPfbXw|isF zI69}zT0MKsbk;=TP#ZK-r}iIlkI=}-t9SeqIAzAiVTD+xp;&$e$t6z>C!{!N-OKg9 z5i_7|SlX-X3+W0BwHGm0_t2wCqt7ZMyZt)O{Nw4cUOkI|WA+uc3o3Q+MLpNq2_K_+ zy38^!_;@I@JzQJph?R+-NicQ#Qz~fr<>>od^nJuVi1Kj+^4m}T{~Y}yF_+j-c#zQRletN4eEI=6%9BJVqJQHg3A`(w7pe1Alb=>Y>%F}W~)3L+RJ3H@@lSAK;zMwcP+HGD}!4pmd5n+;4pN+{M zYAqW9JueQS|M()vCD1J(fLpV=)9rvcm8&utZgp+l(*}1$u41hq zta*IWnN)3u=`0DB6-uGEU^{LwT_r%MhHLBU~$xRd^GW>^KHaunJ zJ)cEnN~%;2n{NniICjSqsBGo{huuOm$G8V0C&#u?j^91L@wUDe`uROVA2^$U0LCDE-Wz253(BH2k|n_zp@ayo45L910U;52 z1VKqACHqnZkA*`ngMWvWOAQ{z;9z;Lzd!cz*aJuG;0kn1hBGG2?094K56p)YeR*?phngSqltpKE{udo70=**XD4W4~4e7 z7n|~s?4ih_2zdKZjf<6+h#EQAB+9cjKWK{;;XfI0AZ9D zj3Q-Zmc%7Lh|{d8i&<|GkM$LRbBR5+=9*bW=L%r@B)g|V(Ta&6-crj#mRvocf1i}9 z$L6-)IJbpxdEFY)&Pjk@Y&lbN>wkVK$E8U86Fa$&*_`-fp$TIJ==m9~UO)iK5i=iB zo#Lk)-+Po^SupCNailFJZ?tCWh`U?S)3$UX&UjToq@&W@`24}%qsI5GD@e`~%y&1= zZ1LV*+{H~~k_ujk2#FXD{hhJ8%Ast;E3irEaUrSjOvANo`Xh5Kzk6DpC+^DKK2M%w zQm$WgA0#F|cP-${5sR|O+DE7IXBLgJKh+Ovhz`uE77ZR#Fmd|+VT}e5I~w21%zj^x z4NWMicz%?6&s--Yj()7r>Uyj=LNiq7rPYIX7)Aov3?IJlA_U&3*1Nxuc$8<5KiGo= zl{tdJ?Rs1{Q*pE;U=nVh*dyRGVK;2wAlS8lY+JzVvT%yF(Qe|U4MTY&Nmo%(Nv#4t zjd2;Qr!1dd)TmhK;FzMfa?6yZG)tkksvQBYeunr^32Pn6ulkbCWRmsPtaVujXTK}l zn00$nYH+nkjtGwm?rk=|AQV^u-?F^WFYUy&K5;0v<*G=kYcsr%k}DFrSy-uPlyjOl zQSTS2mtvZi-%`uj4#PJBdnEes*MHulqi)iW4;LuZ*!CxT_^e}o3N1fCvA3VR__@8B z$)0SN#M&Ja$s?xoMqfh|`B!xb9`O*Yhov$?VO1NT;k&bv2dKP4_u6`uOmJ7;8=#G* zbbUP9=jahV`C$NkA^0L78uL*T0SyZTH{FOwGL|rdH+flPJjwe_YF0`YAx0dKPX`x$ zZNztt^v1Cy-PwzB9<0@vreEWuQ=c+Djsc1xyyAL-OpK1#jGkp#Z@rFNsybq@!9TGw zPv@&hqCpHl_BD@Q#z~v}`1qaGGiP%CbmOV8gS(y~8Z4IGUzT2v#Blbhx{@7;q}nA{ zY0fG6j4F{S&fj))k-64RMg%t6AM{QsdKHPCPbrFqMlzHnkR0hlo1S*}Jz^*`GgwV1 zr87IjoL#USB$7$QDd1rq%h@Ha2=eq~+n?rjS-nJn-}1dW4S>puCPLYCWLIO&NTu0- z5?hSqgbLc{El(aJwV`;OcXfMt7__&X^b|_rit>s|O5OC#+mrQ0gI3c-+KtP!&W7%b zjGX(NQ@523{8leUi!zg0c~ps7FW`1%TIC+QpG5ddRYWst1zbZ7%E?iAYf`vpwV=wz z5E(?%!!U~qbm#0sP)+KRO<~j&&eaB(P<20_l5YxDC z%*L7Df*li%3-x%u8*egL2M3&qg$Vks`Wk>V^@a4OUR(6X2Qi2dO4|xxQ8g*Q=o{~k zCNImxWnW_?9jzDel2jREoYhxX3(1?vgGeA8-Y9x$1oBF6#IJ>n6H}g0eek9djc017 zac;Qp|5iPXhI)#SXkHm1D3h3WC>(`r-j5`te*$}B__W|&Dwm)hWKdnV^_llqmW|{! z+)rYAE`^+R6tTFN-$H#|q>%1>8$|6Adx4pB=|e&FTxk+gFI-*4`63Q+cWAyQr?fmo zM2}SBsITK~zuF{KdfbTlSMIIvEdJ$NRzM(TAq z7WOrJVF*QRp+Dh@4SBiLY57QLG`lCAr)A&t7~hRis2p!FVCRS~=_~4EtalArPsMQZ z*LS;e&DMjWE-_cJD|}R1zRA+%bciq2BBafGJ3=e>9ToI81DLvSmyVo+)Q0?$RTl-? zyC$ZctNI%X}xya6laj(7fOE}$aH^?j1C@;L(=l9 zAsBb)e$0_@1~4MRo9X)9O(^Xd(GY-C+d%3n7ob*r3mlqRm1t!E_=RK^9t~(4=4qEE zdm%sV@{kXPt`;u>rem5rE5l46zQi@tasO%C#79Z zK#PvAo~S0E(9x`U<=(&mBgv4Bb+(+il-YPx zF5tYPB*nHL#P=zRygG5<&3%u@@Vu<|+JSSVivw;0N~4T#c^gvwqhR7pbSBei~>MF@PmU+FehO9=RC2lR8gH+?t(*y&!rh*XOa zd^FF#F{YSN>0AWW2Kw1jeqH5bGtcLq<{VGn!VXdmNB5TtapR<4e?9MBQ|7b zm$KPgiFV2;8c&Q-D$N$Tg(d`PWH?vC)Ac--MNZp~;y>5V@Kdnf`6HcCXaz__8Y|o} zldjx&?&`*!$rztkBJnKCwYqNM5!3|Vxugy4NxyPl`L22~g{B3MVWvGTGM;CcCixnX zOHDkSYjuOJpDyxV@%6r>n{KgoK3d3Zj)fZ5tW;wnDt&Q^9lyK3vhOy+%CwV5nBrT@ zDY|Us5JUPKo3xbA{3Z$#12I55!STI&M}+bVr=>NF)RG#Mnk@h_4AZ;*i>y)gT~rCI_h}eE?<_om z+mGgRtlD0TFI3`OYCC}4+f2^ebMQ)eLJu~&%YuXkQO8P>G_+1@}eK8~rVqBj$^DBIXZGuB{;8 zu_rw29D`US&DO#xg>P4$y16DRgz2sB&pF7ImfR{-wUI{IT4=(kcB$F@9oo<<)r}ieDKv57w13MnqF-&#M zu)8r*&&;vw%b!47NYW5U#X{+zFQ=LLr0jXKbxdcS?C~?0`+dUC(nYzkv9K`1vnD2i zq-aY)O9K4|JwDzRZh|(^T(xc{cGDRo_Rek^t)QKGy^;FaJ zBXY!_53>>B#t}K`(wGSO0mJ7<@>37$M=zI-=f5;*WX;#a1>%HcSM`epNSM1|x_h2M zulEm#pK5b9UMWAUx;*Nf6n%ScTZRo5?nNURe~P$g8nt$adDTcqTPGHZ%bga)i~aDy z!41w;x#!MP*`KO_BlQ-6W8ve?F@E&+)U^hxql$UN4W`!7GtbB5+M6T0FPD-MwfcIR z8>FKKo_s!m>`GW~?(}mro=w&9MTho#Obkv(j-Sjdd}KV^(3RZfw8rqX?UNaMw19Qv zvzSBwDFP*!SP)YjKg6)v65eSyKeFpBcYaNkA{>?aAvV>|p;sD5M_pY@>jhijeUF3^ zgh4Mef={`;NzeHfnd!fX#FNSkQN5p&dJM%wub)>~Ab9(!;h1d0FqNYoZZp}!7)Nbm z#qA#~(a3@O=)?h9<#N^~d~>=m^MTa2_CHHRq#E8 z`$y+W7HUS~tPhzVmWYgLp>RP?crE?HQdSTDyX3g(>i+$EC_TQ(#Nlo9pSdbqe7mX& zy=tcqk7KVFx5sMMn#%n%+e-SHOFwoVt-9WHGz_g4&+_gFzpm==esFXB0L7`zxd1`4TXiwv$0Z8gW0mQeDVBZuz&) z5^q>?yo{`-i~I%GN!1z^a=R^LEfjOZ>EyQ;s7v|{P29~Yd5cLtZN+RYZcDtRxCx2n zFokflgFsiLVE%NacIr-}(oeJ6ezb>LuMxQzGa^!pe4>eTn^oOgdDFzDjIW7-p~Fn& zeuB;yd&?<9(Vwyw)2qw2?W)%b+~yUfzjsQ1CzgWP#A3vjNIBb4w2^wzg^1AfE>YPV zdPP0}zaEi!G*UL$feqArmSK-SeEs>^QHx$=RdW|(P1ZSMr+lC>W4lR!M0P;?{dPnS zS=X1ILD_vddsx7W`63ohRxt!uixW1`ygPI3Sw;8K$_#i&EVb zEe4+lD+yw^9KBkGXaZv4tH92$vnGhfU9Z#(l~sKAON~ptK}%*6lhtKoxk|}^%yU`< zk!qbY;%uSK)+z43+=K8Rw`XgE`#+M~e0no=++pS36`RNP#Zjb08X-y)Oe-cCPHk=v zs-EzBZp@FMR_H2=>U8@N2)2H%H*p!%7f~iP?2WlT1@=68^aSn2?BoyT8{1Aq?0Zt8 zbb?BddUR5)AiqT&+1%x7Op<&|pY@mbq2+m@WicC|((JV}-ONRnh?~RpJ)8tuQZ$JN z5~jd)oYhcHGJ#!awl~TJR2iTY{#0nW|GZX?Q;KqG(h@gaaX7A@Y_hEAJ627}A^8$T zBi$=qd2?w|JZy%AP>V2L3IsVKd5GcpVP>zHeNN%m+=}WNX^l|JiH-6Dmv}nVB3yd(Msx1EuUTCbnWmZ8!wx-UM z zWDSr+>&}ATYQKk!q-@(*B5b*>S)zKBIrF-r+V5J#%YIa;o7{A?suNfo8blHpzwE17 z98Gd#wJ;gRe^?M~8xj&M6Cvue^%0%&@FdY}O32)At|q?xNL&F$@JHQpp!G|4{xR2l z&&`wbFtF?woGN-KBPSJ*meu3f4nGVE@dZjW<9s?7BZY7acvK*+MiNETy2 zR_r3ZLh^EQaKqTPAo-a#B$|~C_*!6rWvZ{)lede6QS1eE`P{-Ry zRI0ul+PxA{;iY)jY2`R(oX@UI)P*-p*xg&Ir8Ct|_+B%2*wbFk1?qYaWOZ+()z0%_ zjgj*0%i6DKrQ9Ftbgc^;bf~Pa>%6AYp$5jU9^Jlv6#smyC{ulxMT#nplKe>=d4rtF z?Su5k=TgX*SN#9)f>7cWJsR}xMp@I9^4(=6{A*>T(e*P_C;+KdK!GH!XG4HsVCX;p zTh?%Wu4YDp@Tvci6JC*ti%fTAwH(3cpX8gIRBKN6rSuIpsHmjLVbPvIM}2^5*oA?K zWhkXQtwsF05Jw1At6WRUzPM*C!S+o@uG~~j@v5W1AtMT*py0L9<6HZ$)9!N(jhA(e z?u_BX0nyS7Vu))3RphI5Bojw?c*Hpa&*TME95xMb#9n#CuP$HI6ZIP+j zwrE_T*5WMc{*L`m6LU8#hd_{Oi1Ef1?nXx-7d9o#tG-HK^p&J)?*xTu^_Tn z`SdzHg*=(+3!mOK-!(HQACwlz#V5oFVB!MtylkMMMF@#JAxcj{65vyQIXIV+YP#Je zeApTuth6VWl<+<&hL4$(4rF9v`ur#_ZN!SCy+D_g66Rw_0ut$EVTvd3^9O__D4Sv( znlXjDrtTXF8JL24;$QY!ccdn?p#vP_tKw^V1x$s$cw-p{0@$$W=uKo3*kj1LPPsmD zeb$l7LhKB_vf$>A5e%376oFQal8>Pi+rZ8bQHGZ|^v8=#VF*%h@t=(w*iY@e(W(~~ zuYY&HnqFGm^E3N!m|D$S<%7Va@Ph6ug{#Mqk4I(EEbyt5{x&~Uo1%Q%f+6*S)eIGk zrMc?Lh8+%#%0)>}BT3y#AYt)0J{{x!ApB&yS;R(sijAXjf1KAh@eNH)OE#b(vJ7_A z$?wAsCi$T@APzwlz+-6CYC|D;@!Fp^jQ(eEsJ-~Mb1Nys{3H5#Vwdf)(;__9Vw}~R zfhPx%iGU0&ehb4f8_OmEf1i5J$aqd^uTLVjA?iBAKK(1_<4=E_GZ?$B9lSHM!|aXE zWWI zM<+XVQ1l4r%S&YKNriXGm>Mz8iM9qp+9Zp7ck6R68^me?1p3$FZUNG9pMIiS29`5VZoA%6NCraE$5cF~se0gW8Cqc2B`_fh0zG>PYo)R50bz;W>9Bf+s6!v7>{PMM> zhE^ueQa{ye4~46hBgwwe`i3(qp(%$V-IX+RZ_O^B&-Ano6BbnO&3loUaV`ixLEXwk z=(-&!pDp-6N$4J=;RKE>x5*vzNq#GlcK*>gf^mmmb(EovuX6y;rR;tA2|n zrg~LkJuu0M(O5h5c(4@%$EnZ*A^R4cOuk}?MuCOuO$cuFm`#_J{DlxFYo%34!xBc$ z4I8^KLG@?)qHlzfE%|BpiobpRp!e|!9%X%S(D`L`aUJP7UdRX1==vwq2xl}Mgco{n zmD~qSY2fv6X9Oc#+(T#a0PFIsIJW21>N(2j;vB|(iuSd<9KuozK2DAIXSP-qA9RZR zv>a|kDex1B(iowq#)osQe8HvgEeV%rkfme(SzmO9wox-aJlVH9H`pJ%nQQRE@(?@B z8J^d)?5JjHFp-J3urknbf|$WL6N?+-=UVi0LD+ujNE(Zg4sxv!)h`5VXSrqMt=9=< z#VKWqK+PQ-hOpJIFBtKEXjg1Dve+bjYEt$Ndke^yop+VPM23ezcY*KHqjhJfJM!uTv^}?Cffc=uSOf98NpN@&|MWI8?DPIXvL&}{Dl2VrRnzgln878u;&oj2WgpYcoM7_I8TqIb3 z`?J{NR!}mR4j*x7;TkuWytQgqCgd?_4SRWq&`&n@ob9yS!_u}D!``Sl+sQ4#V$DRu zyp#Pq?&l9LGYP4%G3r&Mz3V}aAroE+3Xg8=JvEi*#Qm{KBD2fi&Ej<#l+bwznZD3u zPT=6*_L$^EdpGRa^Z4fT@e#R)`Wv44VQn_m1F4z#oxKx;6bZ#SS%Hxu$HhTgca~$l zpX9;y^UKGYA-ofO$f2a^ENE?1h$8<&E}{PHGk|z~Q=h1elf_B8nWZUCc2<4zg?Mg4 zolCm_-`ir|840S3qBC2&pQpD3Xv9ltgyYOj(ityb*yFm{VuG4d`M+Wi8DoE3e?JG1 z0^tYOV|@Z3C0(GLroRHhEQI4!+@h+slfJNF zRgd@G-ow9)^N>yEw*Y6bqz~x{oc~Np+Wz1^ce9K7bN_pT_KCsrX!iRv(R|RsO=eJo z%;`OzZg!%mS1m==XKWM!JOb#y5EcHn&;knj*F#oH z6cb_;Xw^Fa3Jod-FCPHF#{>CL2}0ri?}sfAN)tUV3<3nfOn5ngKtssgi>Vd0eO>_IZiWUPlqdgrJI8|p(}lvZfARl&&_H>3z&tdjH2U=Y6sjqQJEPzc}`{K0QD5HAdNw~F6sFfbVM!4ZnWfB->YfIpwY;jp_q|G!Cq zc|gAq8GfgMAir+=|3>41@ zK-izgfZ%{%-AjIx1;L=da5sLV-O0lLlm);LK=_}o2Ek##KPLp=A?5u^yHgDRiw1*1 z|MVaL1_J)+EdU(&Z@#K`OZa&0c$pzvCL;j52 zo$z0Y2?ByZe;Wva{pp!I$^T3CKRJW=hx;MmU%-gJSq*~o{I$jIkYE1ZpJDp7jz5iog6_7&|0;HJFto5XaljT3py5`ta5F)rfqr-@ zh(elvCgpwro{{XY~O??0W delta 58919 zcmZUaQ*dBG*RJDl2EQFENn6Mf$%{>URko%;7v*ITmyd@R172d9hBwv@(Aw6wLoPiYv6 zQ|G3!kyMeFKW`!;~T!m~fLnh%4#N5JUJaQG9MNc(#2vAL2k`e@&Gq?o~h`&Ns zDr+Z|W9%|@fY9iA+0fqj3GzP|qf3km?LK&87p^&x)B;?srWKlF-ydc*5*=RpQdBLf z5=^Eh&0E>9l)UxrybzBe!}b&`mjv@Kxne^$94ykGFj?U`%ud<`#C>qniU~E2TX0Fo z%Nwb}oN+ZHVBAVgUYc&=1_D&LOY7NUuVx#KzpE-y17)MYq2NOnn14QTV1@@<9Ocxf z&&!Ras{n2*i1%aVTL0Rkzt>sd0q#btEr^}-aJHP8UDb5;;SnL@LdNH3Z*jRa`lM79 zqMQ)_^laFrY~+%XE9Hb&Ew1fwOVK8zf=5hH4%o9Yx)eCxAA@tnlrqaFU-dBr~{FA^0^^cr5kx1unK*3e>=xnhNw_uZw2;~;TAC62l!K{ah zhqzD3Gq2E59gPbbx}u-peOx`;Cj;HY1>O|;R^!K-O~OWWA12qlW57@|ri+h6D7_N* z`5VHo*&Yi+P1h>FdqiE{dE9H$z~ZtnqkCzU1Ug0zrS!{@I)?%{B?=$gqtN;|S`!23ZDINc3|CdU}UhAFgQnZ{++LJ?qzz*~pE zJfSw((%h^-5SirHnX`>*D~&<)tRs!lFxs)O#iMY4^KvV*{wnv=ODI7`05HKr{ShoWgA_;R`|xE@Fm7I5Z{6yqFqr5w zR%4)E_n5w67syL&BfaL;r$GBbn8Yaw>AXV2h)DGN&=1{&?oK?+p2?wS6#1E}iBftY zC-p20ifrNarx`1b6p)w71UH2xwMUoYK`C8tAVO4?tJ(ZeC1d8!nv%WrJZ$I00+8!# zH8JPueNIk_%ct$8sy7v?;VMd0m1aH?icBr+gd60Ds#Zz>--Zp9G4#PDA?h26|AgSL{Rjg2{?b?VN`xmq1 z1{pxgK+5kF(4dOoY7D5-{f6Cn#u$&x@PFK$hyUDQdIaN z*gRByR;oD2ZBP**XEdUp_1Zs)PitAv7V1dCF-t*GRbEO;GS+LU;nwn%#4Xq{r9D&B z3mVg_c{Z7+r^O>bw%@Sq&cxCOLPx~9y;(7t=9?;iBb=~GP>C}k=}g{b1GVyhqBk6i zH+QFPSCzNx)i<_`z4vTcue5!^Yoe#WhG6pPRlpE2>6gnr^yeJM(7Gd;{i&=eG3 zhg_d4C5!s3*|9|YOwwWbNraF~wpfQ6usKRg)MlgdLxX&-u%c%93>GO_bkRR}tjJF( zlHIL$;~+*ni~c7vsBsn70s#5yhj%fBaG$%WajZyl>3!(Nm3)-!0BDKBp9StT&iK7YPpAl3@x=cy;fnzeXfZw7U zU;_MKDq{&$EMn($D!7lOBjzNsm=;}BC&#v-L4)I>ZGHK_SrpXo9D%G~V)Qafx$ynF z>48TkB{;Q|gV;J?{j2k?gb~?CZrZm^O&J--oQfSDpkP_=pm0sO=<)4N-;omE{B?K= zSD>&b5HOfnN|6j#nDNRIBH3UuufEwThB&L@{V-aiDkrHrI98l6g;|F~w=~D4UC=$@ zK?%}=T+jWqyN?>8a{~BGaJH?r!%%l6hbO9;` z0kz*xL)FK4$HtIJSXyYR+NYHY`BGQAJ{1>U3bB6FX14EIm09Qs+06MEv|^#m{cUTW zyBt~>(YFXkKT1U1`>snWD^i_S=jUp`^Ef;@P%AQ1)uhDl3cW-0)7#c9gO-zm=oe_R zSXO)}8O{bcSuilY+O%sNZ%nzzvcwc6rf8 zWm^ZNBL5PuK*u78;;08RsV`HgrE-5qrc-*dhA^LlB~SB&amQvV8j{`6<&q{r5L}Su zCwLk{ItHqJhmjD$zsj?PO)j{`x$F_Il4fGxzuy&y<7wxGd&b0z;hJyE+mT=#lOiO% zEI?{f=J!xk4EN(HuEVBn?DnYiAY-ox^qzk|_rRWBGyr7fWm^?3&fMdt*xnSwF#(=_@qQnmIbJ@KIMU=TXb)#e#8pa= zl1V%@+2W#7>)_13z)?5`@2JVD8|&hnB0fn1KM*T-Q9-CX_1iE7am2RU!mVN2NGFg<3;rAwmQi8Ffx6xT3Bz}p(YIyP%0d=QM>Pl|LPl}df+D2J$ z)GEUMN4`d%1QZT*E6bC)X=Kz= z_+j4T@APr)gCQ0{%~rT@>)*Vh=?{TqOXmF_9!wEV+kSarTbwsTAWC|R+XN?UC)J%? zEKDvv<~-J{#KsC7e}_rOm0%ic#(q(Qs%Sz9=&CO?dAm5);eEf_Ny)XtwkzajvXF9n zAPINEIm$>p%uMXOZ`AQ*@-kDO<2))R9C`mZIhd{=3NgUGxTJ-z_^Cc7b+ra0DZFf- zfiT_f@htg~mbb+vv9=k76;PgeU4|iwmck5v%O_m2Q0c${lmgyfbm_mY!ZshMkt50< zR@~{|4%<#lQ81p2)fUFd7{6{`arcT#2J)Y@*0;ceagiJO<9tFfkg#4HOS=OaX-&S$ zEe<_BAC%a`5if=gh|h&BI?!7QLh zDhnv1h-;=^J}4ij5znI18-iL23a8p(gs5gCrFkxi?H%SFq3dg^p2tPb)OAZ9!B@)n z7s2*dBQFzMV<%@v6GI!=e_wV+marT|Oho^)va+zT{b!Gv`~Pq9@iEGp*qS+;6R|K6 zF(n2{kO6XuYeOiVSJkPaW$=HXp#$xfZwzg!cjXEfOjByd^;-W0Ae}xEP#lny{3>qp zqVD{!)Fsx`-r*`0HDw-262G*Q%cW}lr}rtHP}Y=BXW*!vHDx2`!*}SQy5fy?tJV(F zY}(f7)v#9JC!-Ul7oEHhrPPX%8>anmtalSvHlQge*xi_;@B1`X-~I9Vep-$7xW(w} zX+vIZcK$fuV8p5Y?t0joxA!8js97;pk)oNl5%~)DG61teB6x>3d}OiOInz-n!N9-$ z%;eDO>DQbvlGtu~K)hBLdnvcIR<$>aI&J%R3VjW(7HrD!Eq?v@v}22^2WIXE;Y|Pm zAJD$j@ixCFkJn02-%6?P-fVmBQd`EyyJdXPS+f;3*OTr4#`h{!`I^(Q#o(x1pG7N| za26+Jo!qENs`dDXHE^6AO~5|*jOr>9&Fb4*Uj!42Z$+7}pc8ECN|q|@Z~WD0sx^{n zty-gTwDDAD3hnSTES{QDxWfPVP|Ra#scYSUu{T&y;pX-S+x6 zb#b-X;_b2^M)mz$XY)F^(Xa2NVuND>c%^$owX2wh7l2;r zscsWJPA_uGi7p9nRmOVvz8Ce5rxb)GVC*<8Ye(W62w^6%ntJ#P}PP-Zs z&Qh)L)>I;`rmi{;`@qT~pv|2KzO0AL({%Q!w5!Os-LCQ#E5&q&*CkOe zi>M-uIGwRp;PDb_AI{&91^$vpk2Jm_pScZsE~q5x6g!=IrYDzg-lR8qZwa#;iy3bZ z%RKvb4`da}Ya8V4MYTt~)`uW>q|5A||HxQDC22~5;>wXSU6SgQTtIiEPh_h_uK_z;E6bDhN(zwc8D1^SzA_l8WzZs$ zKT@3Q+tTb*rW^!>NqAwzf_t#yFpM69f55pRfCWg_4rr(47b%MIMw7jFqPvWc%{dUE z^@!`4$2I1&_LH@g0sI$`?JdD}RHIj7)Rvk<@%PSS$?JZUwTWaOC;^B;tp?TfA_RC% z{1^xPYi2H9Mk!lzbt&MhP&W#s%tR@-1QCDp{Ld1^_{G5#{m4eGDX{|}NO=IuT2X}_ z`&*S*i=dyshc}OAB-1VD1joqS(xu7l6~PBiX)gp6QqXP}fro>IObiIcWbmp2uwhcX zaiUW;&b1zJm}}e^A{R4amAAIl(Fw{h5+n%nkTb1Fgm{-)+FMQpWwsXx5`30Mc!qZen4Nr4hI}3Hs+gy5^;o&U}4UJFjsFnNt$?^nn8ErJ*di?ozSn zH1pCsXyy2x)|`Lye`Q@f1ufTd9hTf!Amfz0h5sI|u2f=08KNL;@jRJQrsx+=uGm_^ ztPl(05`_?A3WrR=f7B>N`N<3qvr8uK*Oicd{fMI84un7p`EAVVP3ukLi7TauQTY7` zr=YBd#|vRW!$5kaW3o2+ShhmDXXnM%NXrmDbDa24?fDRg%&;5q`$ZKu z<<=$*>)pssenB)ICVU#XdEH92Ks(Y{q8L5ws{(L9(bK zhWPO26mZ_%e(!Oy5{SvC4lOd?6H4ivChC#j0aSlt>~c>8Fis(oE-f?oDP2`B(f>9) zC2+*8woM?P5gZtDCz=Fu`xEJAE?|LWrvYFIs66*E!@}hX-q)FmO_E z05qvKc^WYXMp0skdh8<}?U*4zuS=q=G#L_rfo+{*fn$ol#4>zg8w1P#GlWTb`+ZCVJCN_1V@n3N2VbpgOl! z{*G2Axtg8#w}VWkd=<28q=%8YGKVc51~39#sMWVb$yG}V8<&^zg~dx$8M+HTRKMDB zN+3=YU!W48aGtj6O4aw7N?Uv-#q{gjZY4?({Wm>+*iRX00|-w??rkB|#|Q-h+yR94mS}fZyrz zA0BIU8G-RWg)#i}CDp8N0b87{cTJq&x|J|)umnmwo02xX@jqt#+v)%vG^OgG zIN5LdwR=`Ja_uFUU^S+DWQWH=`5Jb&hGP&+;9IA#A$Cow3=4Zp(oyoR2UK5thlJV) zt&xk&mrhu4RTj<*zPe_^QlnB}Kxq4_5}^{*wpgnJ5neo}OdG*)VA8w0086Gn)hP!jAqbhW4iT+0~AFaQF9}b0SxWsTObB_ zj+S94+_!t;{aMv{eMtPE%_6g3SLEs80b=>=+l5_>y!~mgT{{I5g855A24v_9SKd0T zB%Sq2N9S$_PDM3I;2MqDn7}zu`AI@pN%>Uc zMu%!}S9713IxmQtQN~B$flm(2HJ662_rEhX=S5>^9*t`#cWj}2SVqCmeiBrD$e~2@ z2NO=JWQdjdmA^Q5+0)4+Qj5B&e2@7p!|c;X3SgCUS)GsM>bK_IHF@G=u6JcQuA%1? zIr1s^RBwhCs@+I8V*@DHxvuqOe-+NFjFw&gr3!0{PvwkryEDT43t&L7Kq6kSLiRD8 z;O6EABI}GV)(t!IZ;ino<7;>&Z3R<9)6e2TC~@Fh_Lo}VA%v`=Nf-7RdUj5e)cV&K zUq%R=(D0urExMcrWt9bIu(oobxj-I7c1agsR*9)(0euz7><*#!fo zp}mRPDo{b7v~XNkW9ticA;bqXGmcVylcD>fq*$Y)o`{l zWNfF_+NqJz1oX`PjMXlue~Hf-SQN^`9rwFQH$FbY9MEeP-@H0ZJg??kx5uZ*WO5Q9 zXvN-u>*A(mB=-7T9iy(?4bKrI*QszXBv(~+CL*#FGH>KQ8SODtg>EOR7knJV_`at| z6yDW3pI58S?O@yvE+D0FvcRuPMK5d!fx33Kd3rcB0tSL3r{E^P9A|mDTlu~Y2L~_q z%{f*R+0Nfct#0lf?oyh&^>Vg0^#H)h*X!o&35&6c(UzhFPsLpwgXSy)Egc4i0%;iE z*~2y$!oxMU*J9evQjr7a-n8!9xSI3YZ1iz7ayjA!!K$Agwe)MsU*qUPDMAnQ3|bJU z=7lXPfWldBSa433fGnoG6tau~q4AJ{Uxbo+)@k>-Se~^=nmrJ*e@3S*fBjnzOY++z z7u8c2+JF}J+-_E``VzGenHN=EIDW}fZR=EHHhtvnN&{GnIJN7qOVfUV{X}MXoIhQs z&8nP6A<7DY;XUH+=w}|a4~jyi5%5XN-yC8L0O#fvWha*uUIQqXl;-F9^i=u&l7M2F zK5=U$8k0M{5|#+~$!(p|XElq!`*L zZab%1^~9>EM)n{KjDx!Fzg(-&VtgKXJFO$!1)~dO7yC8B;IT2|R9#caT#_LInIW!S zfY}D2tK*a(-m`Lfif=Z_jnT|2r2u}KYhHU*aOFL=iJ~Sb+t}3QC71@uTcmR5kLY1# zYZvZg>l<_NQp1wxJ1#RHO(Fncv_1h1vL%D8`6S9_i!|HB6+U#Pv%(T~VIsPfH6t{s zF#JJ>?o3oICpBd%Ep&NTN#y0bwhqs(xRJvn()$ZzB>2$J|H`ue6H@k-%52@FF z8a36d4nho~50=IzqED)+3Dpq3m^U?^3+gLuEd6sFCBWP1Qp(jd#pT*4A*ZY3UhYYt zCMf$nuqh@uNc+#96xfcZfGKxpv4?5y9Jga4=l7*ajp6Ra7M> znsUwxku5&$D?ObJL zY`pf=6iVrjQD8R_X8BXRU~&a=y*Le@0=AqmwbkuzQbA~>JQNPrL4tM|^zMyNA5Oih z8?9`AX<2BYawznWs&>Hb9gxY}1+HWka&fh>ekxXqtP^MPJ((2DVB(pk6X+M=OIZZ$ zu>r?2XgGup%W2|)a`4NzW)NeC?R>m+m_&JMnaJS?U;^`%og8SCV$3mC%ty6 zRBjpWiJ#aQV0F?!*I;?z&xvDZwUjv?(X|gAcjy-OFP|Bo>a3BEY$GFik%b9umDTI> z&vTL?N3vZ85@*APgy-zbhI<<0Sn$p`fC3fP3}g^c%@9THHF4OXvwCU)1yn3ElVL(Q z9pnDr?I)KG#OwZ`H&%hpyE^NvC9dB5gy$fA)TP#5|Ey6O`86I|GKt*6s^gvt#e0!T zx6-kD%0=!U3j>p&E6Y~Vtw2dhIE`2o(+95Ho5bWV9=7y{rflqGNk=j1u2r;iQ3c2# zFB@`hRR<=5yj{Sr>limZ1M*e{ilR(6v@TVI4Gv!$7DgxTYf8#dR7h1l)Ww zd>xs0JQe$)rwpFl=-u}FBmxVWquOjX93Is3Uz>nUx1qGYC*}Jirg#fN89&PkAmrdi ze49C5a97~YWLia$LRfVVCJ0j5AzEv8bTvH_?tx>NF7C4vYc|(Us=J(ZeAGU>@z#LS z+9S>zR0P+ z7@7Q96!50oORTu&VM{I$^Wb$d6F+};!Mys$6znk$-k?2y;t1&tu$C3)#IW(WLL> zkz>Ds@vL(Y6}-E9lI(LET1L8ZV%h`l`#T(0vq;f@7xe$wNoF=?j{hy_|7|B(nf_lv z*RZksH=iNieX33u0hWh&7%}b!MP=_=KxX?(!mO0PVTxEIo;H$QjE2lajC;NK&2>co z1n5Z9W!O5uhvYyG9pCUdOiME}efIyK0SzD>*xMK&aZ5x(qsU1(%yE}sP)l5q^Fvb0 z2=`2j@1YRhpJ5^?-x#Pbx!^H&$po;wJ9N?+8TC6FC$BaqrtKyO4+Xnf``muk@u@a0 z%c*zETaOns?e#F18yo4|WNwAurs?DnXbz%L79vLG9|oVorqJma)G#-sYT1M1v@~@j z9evA=XVi^elM@P~oUqLwLY{jR!2yGxyE))rI@;i80ErTbwvU0U#~n(qB?o(1SrSgFNYhz@m_Gaz>T}mr@V%M2q~cM8$kLfIkn7rWsVkMSyS-JXf?-Rq zoHI}YOWXXe(xIzVOp4&o1nZA9TX_p#&X1+jx6g+zxsOE`ACTi>Lu;VL7Vdt;YXxNU z>HRTG+L@q^$hVO;ijP6zO^a+lb#V>FgrG2Diz4ZEYNSa~-`9#Lb}mdj{vtGFByosB zE_H7DI;Hns{{JJfEl6><#QnAw32AIpBSGk z98Iwp!D`RH+4@IPuo7_00hcynrEEQvhvv_DUeYc(`Yi}0yqT{XjmM?egzfLenyld;&uS;I*8M#`YAeypuYE>;YN?+M!+jELnoJ=_I*B9{I$yQetUH=EJq zxo=7rf*5l)R2J4|3A~s*qOUg6(zUcuo}ji1`~1*@pbtu$@mfH;gpH~j3iQ-<17nks zEE*mHZpJ}uu>#xC*}XaeFgBoMeBy)=<{XygvDyH{PC1nxB9o$n-?>FyUIb1+iE12G z<+*g0KfHXM7$Zm7uT2sUrT*On+ijK?6XV#vjdznBexzERRc~YDl|nUm71n0#kiz|;^yF!NKjOD{&+>{@L&#tp!Qr4r|W+?dyv9? z3#7qlbQyf|@#tMUD}Q;2cqf}%DNw`0I^s+@!m>LYcUTskL-x?4g&#Ui85}P^cpH3i zY<2f>>dNc}_<{P=E%=MNHNM)C15fENMtOsAD0W)sG~n0uKVXb!@Sy3F5mvDcSV@2^ zQ7zhrk#bVrhba0}wnH4sqlS0-k@vg0ko!}0;hF}D1~v~(BtVVC?IHOBEkNZkLsQ7CUHoEQkte4kOt?*(Rn@fL?5+Z)h`kD3lKht|4)DHJS1x@#Roy zJ`{0Uwg-ergY=D4SN({wS;u$v(;517+W6g|WI4`c5qOWw0V}bA%ph%8W)zf`h=t5H z2FS0NA|uuYJr=im!X!Z$(at3o)k5wnH2?dpBKl$0x|8NLCH)FNrftGws7)x0#=xr` z=-J-pZV&*GsP_U|$!(N-3r4xbj0BB$fokNd3RB%UBO)Q?rfJD<1$k07^1))G_mW4( zKl=i1g0!bA_R|`aR{^|>y~}pD9~N&9cxDd~?+h*p*2j>jiR!Y>72|N;wo&D}d`o&v zZ_snblpJA(^j!KreKpMW{h8)`;0*UElIvwdrMCeg`w-PaOYkhvDbMaW+Cg^>q!P!u zAYExf7X>TMIYP+7yz}6Js64yJCWIi0U1?dB+MEk4nKmV`K>=3jU^3`r50{Am=#5%w zVrx7$gj=8a>-&+a#_mD+vm>CMg+%}UJNBP9)sCN&LWD|mZI`^K4Kr4DMy^b@Zt2Nx zbF3AU)ZOEeW%9pBI`!~_a4L{RVz_@lDEIwH3(NG+H=2w)g*+ks34aJ%t_pjClbKpC zJ0+7;0tzTdZ#;I8Lg$Hec>!(gAOUbHD8BxU(;~|z{7Y@(z6982xVh{i; zoIG++N+z?ElNTHKX~G|@_w(>$C&qYi10NM4*m5Q#tPX;(WK~=uFzx$e@ex*8c&J`} zmLRVa;a}`}2DI8gmEd@W{kUzq85ql5eV@~nBU13{1y@P5f+=xCFp_H8y*t}`9Koo1 z_>W%pHo;fXXR$WD9p4)g`+=BY3Ui^A=%LLT)+b?UYkZU4UyRybi7+Gx=zq2LF&6VF zu#V^NbMp{VS%_)f129VxtU~>*i=m`~n*3i4Vyk0Hn+APjHC06rk`RKh4NMpyIxb-e z2j-ydqHiHOK)5B-C|5l9#jHEOrT@u-5(PzHFT-XZunxoX%Ht@B&;U3<%a{W5ZO=UQ z`Ew={P~5ljrwIKySu#CnJb5bST5=s~GuWRd2*|4;`yYO`w(CrExAOs_YSq)#fCdM4 zUtV?lG+m8C8pMWH_f72^wTT}MVRJAdXB~Hvvb{Kk__I&XD=PuQ8GvG&yxrVjZd5-in>1L(3nP}o8`8WS{{LL=<$|Kn1N@RU2&<}UJ zQ9}5UQjt#wLyBZ<_9Kw{!L-Z0{EtXVQ-7rE;rm|s!L>A+YiP?R zY;(+9n%+^= z)%W>lScZSjZQ4E`*4qp_zNx5xui~i_W`D>s5sGKXIaPTk13o~Gz*;b-rO=IRLggY< zfIOH1cS07Q73X2zD(T6sbXH%haC;O2JigbCRoBpRnRId9IC~G&Vo0Wz0SS+69B~?& z$f@|58U}$mRg%xLEBzhZ_Y(=R_y_2J!6fT{>;MZpJNtiNl9lzp>;UUOIr~3$;2%ux zai9+QJX8}!fYB1tX%%ih&5^fnR;_hB8|nLVXro7o4O<$I($3y^c5gQ414UmqA%#@4 ztLGaSFmVIk|2Q(+!!$K^q#wfLw)~@YGn((7>y?Y-^ymDi#?{P$C0l3Y!ME~BNjnOv zKUDHQnT6(!xZHx>+HF^dc6LCimkY1n2SCtZGTmN}6lKib< z)bC>P>#TKYFeI<8YB%1c3gg%gUvhOS#92%JTeR~;HXBa1CCAZ3IEW}R0*j01RCkpX z!vlW|bLemg^lwU$V?!iZx=7c3$#d-u4|5270TwtUOR@9e8Ihazex*PT1=Ou9gX|Tw zMXYkb9&}AhP#HoFXLS2$eMFnsAj?yD4&7D72r81mU$;-aj`N~oyddp3*XWe9*9I)U z#LN6Bm_>X4Y^@Z@lGzY0rkjPPPXFpItY6X~_CaWkHZOCN7e?Irhz6~@E{#b$yQz!&OJrHFe5p2+4)JLkQEJ4WMquhk89(&|5RqSqA3G7NgC#@0_`2gl zsF;@U)7JOP6^vt`5y?%oV(tXqAc~opi`%RTooexe*aBE!ClP?%JKuUMsLel}A6^os z)|nzW=1E)~6GPn$y;?lQnlgZ|joBNx9lvwY8O?~~SBJ(&VmrXul`T1Z3+MtNY z*K(STsMyl|@6kZkkv9VFbK9X&fJPdzW*E-59xikdz1u>$jJlg%nC@uG_dg@O3RKOi zL{U7tG-B+zLz+9;iH!w8qgZN5H)s)3)+xkC7e#rkY<(7t{5~im=R_Rh+ULr*)(11Y z?WL9jibIg&aA96U87^5@VtUE$8nVoT76!y^swVfr3bT;B==ydg7*x1<@juJGJ6)7Xvvcx*{c~5c*^d zww5}cYg!#HDhTv9`cm+hvf5Q~GjJNRoBrxD_nA@Pfu+?OwxcH5)AereUH$}qL~rRX zoFv8h;qlPZwO&N9EXdFPeu(k%5GzH!{vcOpeFo^az;+ect?cS4r+-y4f7ng@VyMt2tc-!(Hq;s0o8UxQ1gC3Q(TpQJj%$^HvOn>6$3NS!$~U% zDFtFIH;K5}C8Is-S4Zc4q%(E;=Xg?Sv2>BLPJmL=q22mAs zRW`3112tu#j*oLM(W}~!JORq-cpR=cz}--cW)vMFgaPtPr%@J;;cES*;m~VVx~)Wb z)`XEZ@5x^Z^~cm~utH%VZjFVO&O8l45+-~6qN7Wn`GSmA)SNAyg(!@W2LEr`QUxGu zxF0c&_OjbnA}qT|Wwwy?q}f<#xJ7Ow|B!*J=9h??ye6ncLrz-`>vqDuAmal?9O|~3 zQe*zYE7&`0HT2)6vponKYY+M9kYlYO!af9tIaOXd7Fbm9pv&#K>Yf}>Ny+vgbBgPP z3j?UxoST4g?C%K`m`mmvcj*gfl@9=7ZqK1@3?Kh}%^Pw0_{1vM9ppAu!pk|x8zXp^ zTbISl&S00*ySTEbwSVJvr3b_~OA38Mk`dzx&R+++P_|2bQ%qjk?{U8ncYLTcUf2et zh}5MR^|qk&2S*8paVT6g^k@oO-Aw}Fa-X!TMGf6#Qm15pG+Ta_=N>zQBo_ci;{%$i zoqlU_29|M~Zo06C!5T|r?-l3u5u7G(_R&V{v;)`9>wTEt!p&}9sqG+MbEP}{ z+hO@%eq6tk{qdK{Xj=mkjAmoMEUJSI&BABgk(GX(_Pdi%c4zYcRwcbHU`$mq!3H7 z(G;vOO4Ma~|4unT$AYG(JMyYBVuaENBk%nQU{)4nDg>`H2BGyTv7C+3UxW}59ulzv zIiZX`FnTogbqH3wVzl+uXp&BZ*ArO0Q_9iu-(B0464iDfsvouqPVWbNk<4cf6=`Qy zUUDJaLPnY^p#sga$)q?;ebHfTDD{bp7#OZ`D z58Ea$g9kLN2+`l_lllU{mG?A`CQr)y35+C2?78VR;zze4pT4^0(3$_oh_BSfBxbW` z9lSj!NSbl=A?H?}Oe63=cI|K%@M-4bJn1|6QPmumiwj$8r>9VyKSr}Y|BE|$%#C_8 z;$%zuG45+TdS64ZSNcr>s~~X3`Ifb<*LXL_L2ly=kZPG|QxXvH2GGdqQ9-#g+FwVo=l5#x zH9oD(8_HWg7(vjng?hr@8GjXH+uX--x=I~~BC{Rg10_iC1o3QXM6iLFbmWfWG5Gma z>6PMNLDgR%zh%`J{~L$c{y+J!u&^=xFAj132Z!MPcl3{y>;Ll5q{jb!{N!__E?cB* zVlIPi2=&xK&Cz`RBLP2NJDKhxl$Z$}Wlsb=7rX2cPUjQj>z5}KwgE_jmgY+3#%-Vt z*ql$>+x-cFw+JT12r97JU0`jL*FIVd6W^WxSWP7=I7Nxo-1ThOmCnY9w*PZKlmk(O zZJOd5X{mnJn-gIEe0fUa2Hb4)I@2b%aC_fa+1AwAr>73P6-o|_EZ6LP2^6BNe%JHr zb;T*vL>|r#AlAtB)%fJKVaC$k`1SPmkW2=~8H^YF#T{>^6Zbg%smzcW{hw8gOBtH31>un!)gv{kf84EGE*`}r2+KaHB?PIM<>`yEfM~~(U!kH z&aWKKPAvToOQ~m*ge59d_Hy^=)6hwpa>XGl3SUcP=Vcg#p7v013#Z4m$u+ln&UzHt zFd2y!>D_>Ix|m7w$bT)3$u(Va>I)_Y@en+`knAGZn}>&4?B1Vu@BR6aiuJ;Dc!~<0 zca3;nb^zhK6(0B_U;OE##=1b$0=H^Gs@>^>l1|eDearHlJ-xyXYAJ^Y0b%eV#1@#% z8=v_}_%A|ZZAH}WnP%R6I&uHyNcp$XwOCHNS><94XhK6ym)q6J}Ykt>9lt7}DMKDaes2@FL+o;nMd>aqy2H6LB~ zT)-{+f_A1dQ;Aip{yipx@Wpq4c( z5pHQ3bc~mjcAL>XB{n7-XxBgnJwN@03Sd*slB-p8iWVvj9jY$V<|*vtZuF;7R-tv; ztsz4$h_GPy&;d%DQTdI9wbP;z(S8my)+Yp#+`!(FKc|zc zLXx-$(BW37s_D;nV6Oxf`?RBzkhd2mtOP@TQ)y0_26>aO&+Z&mO`G3T%1Z!NDf}o$ zSqLaA4kf9`%R#Zqt=utGZt*UNfD@WK5u+7xDog53LYQnzUFx_d*dZm!FAh)L+0`iJ zsj+^JCj<7owe&um#RyWaZd%PnY9%|wvSW|Vu-u=wC|b*o8~vVcZ3voYf7+Om_L03v zUg(J+3!-B!4>5<1_9yZL5X0;$EagPJ&$+6Ms0wciEU~D+ZO{D_=+(oe1-1%Isv$tn zS79+z98GyJ>3;t%NVVw2&F1@#@qMD*CL5FP@P^y6IPu@a;wb1Kah^2xWBX3u#p6eg zD;?-xFxFJOtn#{%IJ}>0(U}SmY}3Rv->MBEL`Ai_Y|dLIgt4d~2QM%^_p+Nc?Qt~y z^wjHwYBq+H!QKf7{b5UPmVn`QDB-HbL5^spsc&g6g9$%E5yf!U!DGcWk8RIqlq|yX zZMeB8Un8CA-McQPVI()|Qu+}WM!N9Zz}(cSVA=vm7OZLu&VT4vMb^pwJ|Vam6M3h2 zm1oOrqr8ulO>|t@Q;!Q$^h4$E67iUAZjMX0>@V1lGyn-yHm!&$>;`Ty$+j@ua0m*f z&08gy^@Xw4jIK*>NZ;8;P1hPQlW1rVDF#g#LRbqJSQZS6(j~Bn7OD%#hwn?9z`K&q zwtBOMQ{IYLw$@b}nw$+soOK)n#i7iU(uCII0xH6|2efW0uwC;Z?ba;cw{!X3r)Rb7 z#MYXJo46aaU`m4qD}h~HHCW+~zPT1u7!%23?=hvx-$Yb#7MKM_^rs%yTS z=DO$F8@Y|*LZR#D1;zHGNGC)a=kd;wYvHnYEoW0Ggh~q5%-}_qSc`e`2kG(;>MwW@ zf{dqg_%P`TUbCLkyoebqu8k3bCpg~u$1KERh|+GkqFKk(h%sjMgaIXZFnQfWP`ctV zq9^k&Op@Q&7y!I^m$$1^PZIdj=mHeGP$q%-_syIN+amg}zz2M?wyo_9Z3rFbjjqB# zjBIm?4EE2sVLgzjnTYgHK#VsknU8ewvmMOYGZ&D|`1JJnxU?(_iCA;<8ykB1b$Ws| zzo)<4K&xDQ=zG_DdwA;^;oIT;QqSG#u@H5&NMPaG3FH)aPadY+0TVOh&DF)ta~U42 zxE)go8?syJ$?U9zM0X|KcCnSUUW;U47ar^!WEXU7qF7eTKjPkhgK$F6$ZfCm_$kUE z^W9+Vd$n#58W(*m*Yjo*+$Rq%p5VdENjMdD3Ao4pDJi}d@ottL9APsA;X)oY#G8&b z;BM361*-TAqPzOdZ(0Kp4g@8Fjux(39a6069vEgxu9WZwu2#OXp1+2pXS@-~oFR6N zUL3$1yl!lep*FATCEVYz-WWgNP#@gi9(r5k2%q@f&G%=G`ATaPYMjbAwk#>IGvXmV z128V`il4Eqc+kCsCEG51XD=C`n`q8clTzK1q~eGo&RJP&bX)X#PH}FmM`iXiNiCI# z$Y9QUdgqA}5a(X@v7YZJ-#1Wv|C@EV{+D%_*b+lIh3oHNSiqpkH}T1Xim9Cv>EVfq z4TRaV{_7yyfAkOs6L+GqgfK9vCFisznb3KruJZhM9}2Vpc57qp+o+tKSFw#1`OuGP zNqjV9&4d{WP!5pv-_=eT*ZL=4T#V(4khx?Y?Y|gt1(qrN%PJ;P81+qWI5D3yA@7U7 zygGSdmN!Q2D0O_sUb`20U7L73JmUX;D_=wVU@|K;upoHVoKkB~WV!*I2AzOI9`;V!zqC97&Cd(Z-@4N)2cm1E8{Q9R;m}6q_k_?h_IF1mx! zhsILB?;>ocCb{O?LiBn~o6$z6v3-HS?REv-{Tv>p{JSi@+Y8X_b~VkorNdL@&p52t zO3&GN9Wgo7PQ6Ho==E{`^RmSeGvb|30qocN)xZ8=p2q@&M0I3z)2&nrrPS9pqx$1} zfsOmN83~GM#@$g9H{i0foX!8s{W#PRIn@qpDqz%^|B{l)J_63IbKp9D+F7Bo z(kQETc4)Yj4C4E937__1c)QGKj~B|FB;tb!`U}3VR~eAPd*GN`eDyM%1=HIdB32(6 z;3mPprb_ckntV@L02KOmiuu?sF%1GFv&=U}@)Ij;m&KcO3vM&#y3(mZVn&4agjbit zN04r*2rDtISW>wPKVtB;&<2-{!kq*$Zw63)p5j(af6@EY!YB)aBHJw?5zkfPNdr7xqVE?kF4Q-SUFlDoEVQP5(MR70R)gTtshLHkSQJ5 z=zfc_is-@lpQKCf-x|xIt{?hwa47sKfUR!OEuOnQ+=Gnkhi}&vxop&9BbG=@7USCd zI7Tq$U{2O#tsgTAHwVw0UyRB^?kF^PC!DK1NPAW0&~ll<5eIUv!KIAX;aRtqG?u$3 zLfO|+Zz<(jqJ3I*-b;IR7uB>1wV&;nCx7MLdAwrLGf6be1jGGUbxBC8dQ3!z0LBZ8 zTo_oRGkQDizFRaySD{v=F)e1#*cCaio&-PWvHA#V*SC87$C$eR3DOL zGE10!tg(yGPJjNyj_kQpCCReV0`jnmsGdI>I-FP`oYTUHE1CAc4a%Y%8&KQGrD@As z-3Cl4?b18f(6dN03o^^#!DJoe>P79L*@Mz(5e~5Mxi8nAs*)Q@g+ax0l%Zscwkx?@ z&vxV67E4y1aBV?w|7cnti9u5NN1(m=b#g4wx;eSwzQgoQrCw-sFU1Axr28rOQv zH@%@0yjR);uhDvWpfgAbU#INiNMqk$H2_h z8~by>N#5MMDB92oC?}t^A4QMD6q;U+eEY}$sO5imbBtdte<^Lv{MDs4h==5JLqWGMMCxb0T#lMiG}M;#^^)MxFTLjb8s(9^FHoX`LMMc&Kfc2E?D6M zF=50Qwh00;XA^^V)sUN0P)+ruFEkUVAbtGXz%V7zo_t9D0CpQywLKj?&Tm;=5IwAE zPrg0~&*R0U^EH(s^%jUM&M6WtOqgXKT-Tn!gLZQpzc%319QH(Kk zK6E#Q`PYwgH?g0k?1ksYlR^pPIm6B8F|uKqabx~?yjfy(duA6|qzs$g-P2AyFiyWA z-dXs*XD|Se0CN`Z8N~(#$yU>a<$dV!z>jX(PqNqI7HPqO;ac2r%kft7D|F{FVhIdE zd`rb{2O;7Q=nLMWq300|%=mnK)w&{S1*q)d#t_V;0p(N~b!P>?*0S$5$$><#6i2_= zPdtfZ&;e;>*+&y5;|B!ODRb#ze^*LNvGj5vkU3nj0HmiRAnuk}!%YZjDm*8;fZzC# z|9E0QmB($-<|S$*j8$Z8pBa~ZAL>7CO%)$;indQ3JO{o= z^1o^Cm0ZHczsTkhn!kHiD!Q+pNF9Oc?q+{#VG{y(tddVJ$H83!KHHbND52&U;r>FvZqHK|fAmnr$PvvD=RyuE z&Wuuop?*Lm6ugk_X|grl{+cOqlW_LCM=M^G1JL0bMgf%?XQmrI1%*Kse+s%9&8>k?#yXk3d0j2%^{l>4XciDYA;{kja< zMH9ym&QxBjEGt(ivMR11pT@Rof|R^MOZW~?nTaxUE)~!9Z4M@pCN7F|?7Mt~y(c^s z2lS*rfp>JY*}0V`_mOj`kl&|Uk27E^32U7xj!uDEA)q_t%`FWefnB9xp#mui{c`4( z3i#4(Uy#dSO!wISr3ww_d|aWHeL=W@_0bVtLd&MN9pi{oFLOzF-ZOiE0>ayEQ7J&} zcopu_y-{v^Ri`W6F6dnbDHv2PEcl6T2T&wM$Tn>>;&*Hka*Af80VsaXs zpq(13I3%Nv1?85BhdzIrGT(?tGDQ8!S&|RLx${Qh-5ZX7Q6ebG{Ok@nzFMGUHXInkBS9yfwi@I-gh1Xf?3Q7l7YyvoUHxeGOf#7OcAV z&WS^%a8<;X=$!eHkxn=b0Z&Z69F((C2Xj+rhg@nJ4tS63lS%)ehH^i+=9P9rAz_ww zG=qg2AHRQ0gG-92P4ef=Kc+#OD~7%trH0v2;_IikHG_!BmBWu@5pP$syp|wqRMfC- zjF>82o|)hk*6D!;n0vc?V=NiQ{=l|{VR@e9suXO5G1lHk?6iRxkjG!P^>8OxYkJi? z?lF2Mjxttc9SV|eXw}6AXu93fqC(|Tz$^IWUA)5XU}kXIfB-VWP0kX9J7m-|w~ zWpzv9_p871A71qpKrnqVY?5`x%t@^|IU*KEwF_nQ8{==(cy7nW#N&(fZA1(2Bii^x z@kizU$1iu7kIgrYplgL`bLK6LZ%5vjHLIf-@5jifyj<4?9a;7qOEIaydYek_2%Wod z+(R{&c%?{gshgwD-kv%0Ltj42_r&kNA77oV6K*um>cxz6fbLaKZtiY(C(q}F`}uqV z1~J#6`k@)?r-l3H%d-?oxrNci zg}+dkJxBa{OG(+vghc7LvvGspW%?vT_k~Ce$y0JXKN_z(O+B#H+6E`q`q?Ct3J}z zQ$(w>n&m+@Qgdu$e7FtAo;8%O-nXZnDgt(#e%{K+A@F9yUN0s|IM;y|jxd$mIm}Pn z!gI9*9Ean+F2gaI3;pdvqcL?B6xy9TaD}+r7th(<&fewuQ#;TO$rOD}nA@GgK9z5d zpEimi)2HqfYZmn4JiPRGVrlGWccvG3mqMoEe=pnrg%2zo9PIxk62JdzZTw#sK_av= z&Hrg;IBl?@+?|NNNknxep;B4p7^yefiD* zjsdhI!kxOk%F-gL|FX7amaFsbCc-Ex;?vB3a1fREb@_s|lw0sD?k!^1(s-nr$G5sY zHE9q55)v@lZxGZnl74Uy#%1o6q1oHL1z6p9BKunEdHsHpzfpURtpsdo>`md?;9F6} zJY1Dxk>H!gfV#GfO?Dh|?nIs!`v&kfMVrZm;bDtj`M)di5}yMHM-t^9`yUvlGG8U1 zz|YL8`&52R(403jt+K+|LjhTjtl)o(O@;G~_PGnP&2ClL#J%pI2T093j# zPLsw#_ccQf1@lW&)eTrir#vH0WcN;+C0FQAFF1d`X?TJE6b7Elj)(*(6|?mAjL46 zS|qO!m2rsfpEp;CcuipjC}IYY`zkTY*l@J_E;bb{0>M(FRKbte%sD&!29S%?MWAvo zl^k!rw))JGrR`!FtN>sNB+_(fN#4^*HZ&= zQ9EUV&+5S3QW%$A=A=5sz9x_jMgl?>8i~FCMW|0!?t)eUjx<(f zzgEa#R?E>_*0@%yKZ2(Rdb4DN5Uz-=Sw@3?!axcujCEQ6_9Ujl8tKtTSD6VmiOy{Y zFtvk3r)T7}n-gt+ zHg*`#-KJO}gp({yVI}n4lAKN}5sr8KS#&rMX- zO3LU-O+gx_CZdJvp;jcpG2F1=sZyjm)s9KQRSln3nqHD?R!d87^^UHs?b9jujNUE+ zEvMyVy0&@Ym#S;e;2FfMEa7wtl#`wL27Fpp5*%Q}9q@bn2GU&*ruH{2G z=qc;|(}2yI46ls#>!Bv*oI_Ik{f z-!n?@NxCW@Aja9Jz@AW0l)ht)!9BVERGk1zQO|q`r<|8R1q+Ut1)Ms*C^;Ujcnd4_ zm_DL?-A}7uasHpA&^i<-26>1pc^yi_y`keZL!h|~9zDB7SPO#M<`wK(U;ny4LIjd( z;(f_c6H^u)wmC)sxnS0zy1TDEZsJ*}J4wF)L)FF}fUQAbYT5n>aUSTWG&zfW+;vvS zP_Owk&x8Ds%F+yc5iS54AiV$7m^kwlX2@=+#!c!%hFfL{C=sQugkU=)4cVJ5JFA1# zCR6JZuBKS_)r3ZkF^sLQTU{^058BJ4TmH4@+`us-mptX^a`*iN*%UnWHX$wnbUPk^6_|m7Wa%tB3@h(OX$bH@N67Lo2`Z>e% zEX;jR6ZJKFJ?NZjm;OWLarhEfQ(aSS9FNvkb9{?Z5Q@n+dZg#rBh7#Jiug;z)6b*E z1x2&N8Z&eZsZs1ieB?X6ze6+7h7md%{V!5TYX}Q5^Zdl8KyTP?p1P>Jm*k8F1j=z1 zKv8DHCFh%W5-oISI=ZVA`b=SlH;l)yKX+_Y*#!5gq*=3i_5v|8mjX7G zKYrk8DA^N|PNsFG*7JzF_=QUC#z8ZKJvTbeFJx53)X)Med*zk3;DJT27l_k1BbN8UOSw$dYeQcm=44`;& z^f4He(d_i&Oqz&RtOs82pzbl=$M993n5Lr{tA48$^7#PDbWh);n;n)R9jpt~c@#1^ zF@k5=8v+RtTeW%Ek~2|+!(H%j)2Dqq|H0BqaPdJ>6w}9SeTkZ9jLB}t>69Xph@giJ#>C0WoJgxD1W?zpJ8VH0 z)jd(arNi#q4=du+0V{J`k<6~@t}z24y~6;fb1-dMme7hYy0M-s?LmK|`HJmE6ZNrS z%PhDJw2AL}x!-h}>GqE0k%=n>bnKiN?B#Fme+4w@DZbF~=3!wDM8e3#rqT1Ml93hO_7%jfG^bq`fU}=MFf2F(YI!KDRrJ!Sk0I|fWv#tXpHU|~& z0(@;2L~YIlLz21r|Moyak)_2zN>}5kCtHvu0CH6Q<)o2 zOP(n}7;<$x$C{!#IVRVj@&vIit(ls$<;Te@++bCve9#I+zuJ9V+I>CTTsqr5os3+? zaygzKt8cO+t5HyR=_Gfd((U9u+W&mpJbbPCNI0yT+2Q)h0hW^Rdv+k-C&j^m!Jz(b zi;#ri3L1VGbC^)eH=|&APA~aFXy*CfSdAZ=xwfuy^}4afOn^~9!yAbwX}VFs{tEOY zfLS#5KtPiVf#G5wi#57rfz_X#57AeFZLcm0CzoJs&Vsjx0-VcQGQ_z9CMlNw5|?4j z4BrlV$)L#W14y4cgN2e{R5v*NQAVL!mj{JYorO`pB3nHG7L9zV0CW2Xgu21G~WYR<02YO22g z2#!#xw;u!b$7#rWFt3%4|8UD9?-ab$IiL%#sHf`(NlRe+0drbELj>}4mF2Q08F%gu z*e9-PfbGHWsbA*79ODA14_j#5_&PY^? zxV2R0VB`CT>swtB_FEb!MPW}!5FA8x4|15=GVv%BRP&o@)Oq}=24$2lYrr1rB|M!3 zmb=bQAOgW_V+{Ft@lF3Tp+kV1^)O#?Ct2&)nkfdP+5q84yNeP!ju+*N`JA$H95Q#eKF500ejlhQ=cvu z-Vtlhy{OPjaoP&EL{Pp8m_~xexu#^5{bKz@E^+us@T;_qsRcbjoIxUxhzjdc_ z5FlZ|aCvsLSgIH)Czj!S)3+E@p(KziW>b68Flta0ATP^3k<}bPmg1@QM11VM8`^tQi|qR!%w*EKnKe*x|cxiBnQ6#DI3@X?oQ0CE!+B=m)NW(0=l z)gh70^H-Tp+8}_FT4D-ezoPzM5874_Y}%GAxIKnErqamaPa^#jR7{{j0G2q%4efy- z;FS7eVM7i5Eh7{AsYew>ApmHvLo=$F~HU{EBJ{H0J|9mi{%p z-Ogq+q8x$S!=`yqTgMwhx4F8o`()_yZR}2UDZNhhj^t{n^UZ35lB(LC7=2*hBW;&@ zWo^ja{9|>W+hbPyIYg)?;Ks2hBc^bxg&)(S5W5bZJipG+ynC<8K)Dw4W$t5OAb#ZC zHR<{RdP-nmHOQ#i;GJr&Azsqm3Gr%!)lMisEl?h~UXcM*uXm?_KOjsotA!Yg=fjA1 zQF20}aH&y`SnNlwciXnk=Xp<`gdt~q5 z82~V2MzK+1o+UOB6DRZkK()XBOUVD9^6xk2|Ia~e*lrAC40$Z6!v%ok!#J^G>Mo=n zuv#9lxq8z!o8w>(rQu3OQ7Ms8(TrbsaF5nL63paa>54T4Hc9w_?Q1`qTs5!c@FVx5 zAwQLVv9HNNX~}x7*XJyG7( z{b=hP7ka=!sH5~lJjCigRPklnN8%k7-y(@8=zZ&h zBU>_;bPGaQ6+Yw*dLT-N;VF+nj>bnP5AXC5Ml_a6ayMe%X9 zNyJy+`{2fUPlDFYWb4NLrliSmOv1;|=K{M0WAriPVz1}p37d?;=M#XB0DvGMHIunF z)dCY}M)Rq<1iGrWFJWmWCqKJ6Jdmu1cWm2Gx1GV2Tk=>N`(ryG?g}0yy~QaFX9*Kk zdL~{?E3^oSuH~6Qrk`BB_h|#hkCc4sEa8=;| zlQJP`z->qw=PGZ=hJnLxlzu zO0{lI&7X%=_&9{1DCTiT*Px9d`-F0U@v->woW}AYENPCBh8*h`=Z%*5O4y5(H(G|E z0UdMPbyB-$83cr5x~RQZCo3ecjp?9WLXoW3C#g2zlk-H4*dF_pKbB3Xm2mYa{2@K% zN&jh|>Daz-6TnLN05E0|7;$l&9X6ON=$$(68el^@3xt%%A!)h%dU~tJVcfik)w0I~ zJMpk_8T&>spGAJ*-)QRU*+`Zbju0j|b~Vb-`|@@uRC9m{-kd{Qic>=N_HyCu)hft! z!S-VhnV7MopVsS1XApbZdj}ioA$UPx0Cav|JKl{vy%{=u0p5?jnSKtQKBt~OO~I4_ zr-6ekZoNE09#ziGf$fTJjavF`5|) zypOZm=XF-gpi#!M(Rm$>Qf!3KmPQ~85YDNU2R2S7H`Ada*BL2$nJ`eg&5c4CAs67& z{lR)gwygz>c%fxXqNs$6xEI7Ws~2H&j{0p#Bi#a4!sQ*7zg6`Nr?Z}XVN))!-RC08 zfoo(A0L9`L>drwEHJ!TZ^Wcyz1&Zh@NkG^KrE1<#?>z{1YH6Z_gPp{*0uMAb`Q`BkqN?rJv)e_I3Rf|+Z#J8(3 zoeO|epx7{LhEuO;6a)Zgczpr7a3=9Xpv#%90H{+Wfr91`13=H{fc0Is=|&6!(!=S! z^Z>C&;Kjdsfh4b0j%yhZ??DPj(I!d|J4R;<9WCVfL*jqJolk(KWq_$C29awg{sA zd-T{2_%J>#J06EZp~LiwH!UD%m=UF(BN#J*rp;ddJS=x%L4GS+HY6eLd`RTN!&(`WW}y_=MbTWbT*Y265KzH$PC4&n11iGILi!7T zE{u^2^Uq%k)tkL7o1Q_JW#mbW|F=weHYQ%jvf=cig|{(T=hv4pJ~U571PS(hZT~rP zO!!T#RxhnUE70KQFD`&8Mn)uozA+$BbFwg|jM*V|!r>;uFSNGjYmE=1DFZYkeuo@W&<{?Zrm3# zf&N2rQwhiWUA~>KuKn1_fI#uJ# zl(}@&BUO|@B84Wl>9mZ3*^u6hbFK+0zSvM9Khzw`dyY5@2~wPvPxt7dES`%(^3*__ zyl|2TRPlFm!g8L%cZYk3HH^yK_qa(`$qYnn!a&x_LitMYuoRj#v>R}aU{z-on!Fc( zjB3VPS>zy|Kcd>wc0~fu`qz9HW2D7?Q}Z=Z$Ham6=Xw7VUaN<%_uXL*gqjQd_?8j& zL&jX{Bbsq=%if%eN&m18czx~0b@pJ^QtwPHEvKjG6n}Q*C9qm3?W<4W8jZa|5z0~9 zUu5;9z>_KGI2sNLh%szFg7u+_n9eGIduW_~2=RLzY%9Gjr*I;oF z*Q&eua))zt3VS+)B)?978WGeLMnudrqjkFw3c*V)=!}e85KG|~zkeEED*v#iWp5%G3}&gN-wOd`QKRR1YvRpLn8e4R<#|K}o5@_3W`MwoKH_0sr)iRy>Wc{D`jE(s} zpyz*h9yXT$JJ(-n$tG^HC3L^k>YJPWRc(~b0O}R6^0{?C)VZp$sa{N7OEC=42|h1T z6-|*$89xf=yt4TV5dCq`0|65#s37A!Zi<1&L(>664gYk1W9}yiwUkADAxs_LMJ(yZLVSs(#Gj%G)Y|PsgR3wk53luN6L@`=(@>r=Sc-Y2!dvORTj#UqE=rD0?jzkkr-r8=bs(F8m zaWKRKPByI{_Ummbu6#C@1_q{;S)@n6_1x_;Z1lXp=DC~P4+kZaNFA(mbO9RpLIf0< zkbqQ=Cs{Pn=PDvIlO!{GHU6$Ee*T85pP>g(S};tbm>^Q!KyY3}dNI%u;+$WcH@)`* zOV+o;$~93M_$-C{Y4y4gWY7&=yNPJ;3ytb}z24vZ$8Rq?(d~4{6pmv_Vujc2HnSR2 z9=Imq!2Y5eR~0r}((kyH>%@ zR9OW?AHqykw{^tdc_mgGL}gDiW$;T}_s@tP3Hf!O*bze#0Y~u=$8eHp_ z7_+S+X@j&=m^a3)-cAoUEFTAOlKCqjtXNZqD3CC{|k_X5Z!^q=uog#+75SNS_RGNgsp`2JD4rzv23C2jEhH|(9hwz!8! zB2yKbiRCA0@r0q;z!atj;R3Xn5H%9~=sB$w>;vATYYIfE6aIC;NA%%Oc%T2dK1YRf6v>RyRkD4Ba2|lY+Y6i=_chZ&nWIX3)SK^;)vKUts#)|H49G=187iw)@F6qh z3zJfpl@%e(6}K%7=DIK6v4={q0-moSceg|ic4wDr9rxM+~_wojqCIY-XsvYT}ORf>1a6U>@ zgK!E5PK>-BLh7mSedcF$G?2eJ!23P^BH(RMv&AIV1Gtv<|Yrv))Bs7!S9~&ex!)n4@X9aR19uyCO}0;GnmM4@uwRfSnGK==n2np0?%VDL z*yIk#(4us3M;{6aex?|l?2DZH?IB&B(Hd0%!5&0J0Xh~cqFYW&Dd4ih&F+#&osI5n zMmFgduz+s&ENcf9P4+|>_>lyw9YtvKc!y<@!CL!b7l8SOO{~_c3U@nib~+V}qS4w2 zgzN%z;+hunj}-y_y#AK5#K`X5b~RFQ~s&)U?vweU!^ z7_Qhz7Da&rjuxW$AtRfT^Ce39RxqWM0;EVUv}U=0$7eKpN;I=06ERh7lW^&OT+`eZ z^io%9C%|*bR&i(y1np$6EPxC<;DY&I^=>vC5m>{mH^R=W{)*J1R@UdW0IhD9p#h(4x{Ow0(vM9X%tEb4cKT=-Fsh9XS z0pLl(0^vixcm7(QcYsBDRFWkkjbbIqB5A3DdsFq4-FZO5W?RCf{rcxg=5JG1%*1qt zCQ7we2p!>pmMR+fYl}^Kat!l#v#d1ha}pWn2$^igxlXQKfU*}9euc+PN+I`z&5c@A z6CZjH2cRjS)Wb?MsfYD6WDv1pN$R;hN;K#yv((bXt_wWwx%u3hrKNdgTyLYpniLFu;6Dus+}_3(ET25n|;WK^8Q_l*_5 ziDV-S0#27*SDW!@c!EwE9*KziIect80fi^{kYq~Q?FNU2fRFPTww3?+H^ye!Rx~-C z`SdtBDix{#cd!HGZkhH#DL{ZE0@L~8kH|toGOHFf1|*n&dLXr3x?HG$23CwW!uh&? z2a29(Im~0z#FP%2@SW`V67D^S)sMBQ0OkI_vutA{M?~U$T=ohqZyNgJ0SDE73hfqs z%|$U#9h7r4W3hB2vDCv{Qu?|gR=9P$X39ZYb;TURp1t^!E`0$h3m`3Uc)GV==r>yX z(gjGyusQO=A<1j1P9MM7dZT@(JMyXcsz&i7P~thSY_++!#FyBQ+SIjb1Ep3hLdb5B zkoK*{jt1U!Z6L4q^2F#1?R)8&&$yA#+TakO(`O((guB_M?9&0Vgc z;~+Rq8;UB;{n6E}q$ub=y84aQpW33zl2aBuY9aTD9N#HXc4_k5`}LbgiN`bCs89mK zlcM9nHzdrp-Ay{9Plr`L{zykO3A;@}jsbgozrLjd{3t8K}m5E0L67mkoB z8P!%(2L^`bWLtA>78J|s?rxyrcU;q0%V;#A6!14^>+w4Q0o z*Cbx;R;Q4P!Cz6U)>Y_^vm9R4{Nn|~ZMBeC;4`Y(`G3Bkh1uR$t*G@`9W4a*LasnK zV{_rk%xiZxWdRP7O?}K5tb`pAv&n+#+4AGO^eSTQ*~+p#a2Y6 zb9gWtfsFPJTV7xF%dN+{5P1s4Y@h;YBTEoMiDkGCd;np-wK<6kEpxF%9MmG)PM_uk zqB~opP95}TM?Dwk6Av{h;2buuk%5JhGm@MeGxigQgpTOnX?@|%9XwSQc8}O!JvPfm zz9Cupt|fnUu+_c-Cv-lr6od$*b!Ffd!LZ+CT|i;XN_N_HKD))Fg+o!CI#OgjONRop z#xjgnEdT+0wA5F$x#lAKeC~_66uAG0HrRKqM(11}M_3!wkL0@CN`!hQLigY3wEEgE zt;x1h*!O6kF`6NHd<28Ao}ZK}iuS@mQ7I@3&LmkC52gZ(0UaYePiATl4D`t8c^^{- zZWQIFThk`!x5(Sg_XBFsB7DPDJn7l{`Du#@ZAAaa zG`d;PT^S}fDLyFFntZCQLtJgywbOdB_korer&q0*+9Is~amInn|T&%h6p+o3M>Ww!<& z?;!N%3L?Q@JnxCl91n{3u^*JsGsSY~kpvHlLOY4~<(_8O&oV(3htNdMu7NVeQ|(AQ zGK)D>p7P%Bb)_-NsDIB=wTLjGkQa?QGyo_-5Xonrw*)|Gg=oL2x=y0Pm#8&EPW?^~ z?uOX!Yq(XmsCM_ccKeRW2q}>zRcO-!Ld@9Je}Vx&urJFnKL2a|XZsITWo2Y!{;xgD z_Mbra|HXQ2|EFcE#LyTbo&^lx5*i5}1oJ)kIZA%tgdm?UVHgAAk8x zjTwXp38%2*uB*FgUB>@bZ$8T_sM3_xB?rT{H%7CBtOSoU}2xakhk+5p!wh8#_4BDHROqeL*ZK0u8x2cipmwE_X ztV#AVVllJ;Qz;CJ$7=xA(!QF?H^tz~k;*;=h2RO?Swmy1p~+pPfLY7{qizI)uge>rxi(WOSV{`kwx_usXAf@{6FOUc!i#pWbF=|xpvu2%VXh` zQza-Sc;9ieLk4&zvsyqZWKxJ9s9FLSw7S@KwT1_W1qFBy__pl_2h0IV^A0f8B%5WA zl>y!qjMft=jqiYG?6RA?r*diGH8tJq912bbFkUsLB!Of>xjnm-nEY}LjOOT2VYSp# z<-aB^{-h>0gR0>`I1c@lkZ396;M91tp@_(%8}@u+UB#CbPzNIR>f^QKItcrQEGVk9vr6<^2I2)(2;=pR}@Ce%X3h7daIvc*6ms) z>WLz{dArd(-0tIZ3~+WLKVc2%!y+s+*#!*J51?pPxB`r!bizeatJn7M;E0sjhSdEU z=ylh6fgVqPpr7zh;SSNt#4@~qC@vvk=j#QAHvZHoI-SiRRm!@g5XczjCvJVScoH4b zJp5U{V^M&H$VU!-zQUAEr*GTUCdN)C8-;C)JYy`btByl%^}wY?Xl=Batk1ubN6d_f z1*`S;qGAQM+kuuq{nGClqiy-}mGC587gJ)Qkzey(nL%e;v+^KrM{b8t(O;tc16vyH zlF^KE#ib5UT{pN*tm_L7I!1^B0APWRVcmO5&{@C}t6Vc;C8`SVUh5fm0p`0-Dv0PV zRaI7QpKszFvkhqpjhYAvqDV>YlFpDH`B!+&qfJ32F0ex2*^01RJ z7Jirpq&g0pA_ZPKFO>Xk!ov5mOeR*lrtkrsjAT_@B999b_@^RIF34Bl;RJlre@ACv z?km7`oqPjkpSTd*V*3(va2Ga_cfw#7d?9y~3S{8(L8qX-5CxNVa8hhQrC)ajip+=G zrC&;kf5?XLGa3gen19p+Z8l{$F(^_Tu-?E%70@i)5+pdb)8@4$cQFwwA4*T=zmX~U z!9pD~!7~VY{yEjkC?`gfuq;i$j4ElPiU2?%pj1pEO@_ERp`wwt?h2btj9@1?2=8wg z=oehF)%+(_zN=?^TD6~{)5@m zv14tnEL%?}x;#!YhAyb{9L8qB73dw~Dw8pPerc1L(d3ik!pf?0;B9H>ZHN%|(ilMM zzRrH|x&L%TQvNbB*Ok$mlrduvbGJ8jVBS%_8%eIF-dJx`8I(0u41MCPVD#^|@Vm-V z=;!s>K($@zr*iD;gUkLVq|YxngnGjPv-yDtKPZ$!@gl`JY3eh0FBNDGqTGa6jQ8yU zflFYz)tG4_+Vb&)4D__$f_9Mt4(R~+;3|Evf(MjxXjtdz>;e=i`0C!ItdJ#U$(&H$ z*k&aRg?=D}Bn6{CPerscD+mke>kq)R;C|XZ@8tuQWDAlD1#7RaWqvLRq4A1X8nf#u z7_u7y7OOY#WI6I^J`vu-j9vm&=k!T%7SzG+Md`}x(`;xKU=V+5uMijDdvgJ5Z}}V= zmcAw57Wo|+xa2yePegclR+k=Jlc_7I(C=XkxVx)>7eCU-zs87HSKubjgq*SviDXX@ zh3EC@YSa=(ro^SqhM-r6!<27@6RlwW7Duh07VUhUT^dtAjaVy+EZ$0{(nQ;(K`Q+kpX9kMtgIWEvNa{cj z*ka_;UGux%joGXW@R9&Zh(MmryJM_;b^A-n^hWK;nQ60|+4HN*{SOls1$ZPXw|Udt z4obr1@2E1bG9gs`vo=VsiU(W~%=P8qMN=H#`y32EKD*q^sE;1D5<;d+jLG&gHt2C& zMI2<}l^@5U8+C2M6BU5%LCv?+7d@Pv;NmnS z-Fxo2JUHE?fr~d5-Ob(^Hk>ck)oZlaNgMf|42DHzDyWF(?9!#C*}FOEe@}?jzIhMP zE=4${sh**ymAIAe$2xJZ;TLy;1PJI&ebqX`?z0B-P*#r^GoC_ zHR$YFhMkl|chrD+0^8AN&T)gOC$io>1&Bx$fL0{tod>9=u0i3`iPl8TH|%=?SrzLV zsmiCm2>Nlt5bdJ%M_IA&>)4HG7pS-<6z$kws!Va8MTvS+RYI?o;cLu2o*zo5vVpNO zlZ4Ct|LA%P=(u`hTiDFZOffSvGseu!%#3Yz%+O|LW@culIF32ym>oN2_?>(+^XA_7 zzqNYx={}N5Qc2xMTiR8X8r8)24NKyV=7;TrH{x_xX-A93yM$WprEz)ka)%liRwvRB zrw?W0O#uX)Kc`4lLmjkg`Yd4I7-~Q%=VTNjYM8F09NN8U98J=wn%y%QMJQ@@^)>_i z7df-R&3a+@Y)H9~h?3#mDtWKh*lz?{g*nY4z);>h_(3v`=>NSI{I?|)D>vtVC|+Fu z!;nF$}hGSnI znUKVc&;pTwZr)64?t@Vek7_jRFX~@l;jbVy_m)UQSjJZV`~bFqfDYDg-yAC*UuIrR ztOJDJf393PQdzlI+VtjC19*y3LugFvr+5X~w!*dB4-QlxA^5Bab6AMk&>&`lPinl( zBB3D+ZW#)RxUoE7QY^#2lgckpea3Rk!YVZh`Oa#!!CbLtN?gsHK^L#B=Qg%#WVmAs zezZGaCnJ4BO95DQWr&h@=B0mVubA#!Rb`X)*2=tmtT>Wma)Ll`xO-8osByvT^DBL2 zeQ0P3HOlH&{uM;w&oCtF6}4NBL}yTRKl54qVt;_R7AYr8UG@Q%LIBt=P^NEcCgF+q z6>74`A*Q~va*w=UL|A`&d;3CTXTioU-?P+Y|`t~ z+udzoXuz;6dpYnC*L$S&kfJjWWo*a1k%!`Y>vfsH_mWlnr3E3~VL-b5x`RD``0EZj zOhA{!NEcv7*B`-5*_+mesK`|1QgXqCzuz!RC?z6Mw^#6G6ou4Ib-c+d`O~3MT@^>- z%nyy_p=RFz#+;H|WTv0vJZPp6MZsxV-D<7eprx&hYG;FaCdxf~U*3JBp>`~ZET$K! zHX`iB!Q@~1+p?f(=4_H3N5^4FKCvGosf2=1i!J~dr(5;XJ{2QE^M2|(n&FJQON!KV z*Vsv6k00cnXmX5Z-NycXtOkbBPyepkm4N^zE>H%^VMk4dzOs#_q%u;ApuP*8??D{m z22W+bt~MI?V22YBwNSdRH=5hQZIx)&5>)4v4wfJ8XY8Bq2C;N45s#sF_Lzx)Z$SMR z%DW0^Tv!9Vrzb5#8ZWX_& z<}EoW@mh$Yx+f9n4nb@iA+Z=}YdCh+81ZLfXRIxXzR-oSWMc2k?5f})vD3(+rTe*s z0L~R|)D&vCD>jGwt&sMRPsJho^IcmDKJNg4y9_wh*`2xJa^eXg&$3m{6g0|B&l`}93 zxv$gj^top*aM=xCygHI8M4aXuaRzEnC&6p69FL+oo|IX!KsrN4Mt=R;{hsw`qxYQz zzza5J9b{b%=nZ)E_(70+#@ABzdl7 zpz(N}iERiV_ouahp%egIrBp8?{D0iw=X%f} z>>qMh`Slb!D4QW%0{Z0C;J>Z6)pVRl= z#vA3H-&`Ko%(Uk>Xtim%)lUc*|Bg>$1o9-#4~xUm8X=&?*Z`>Ym5x@SHC_z9g~c6E zzE3+%%BtLsnw)R}iT$NoNrM5F8u~6%iUkS;X;s0`y@NWzb z6nP=tKxqrII-d3%-dM^|6f%AzhzV_mM{gOQ8x)Z0c#0|Wt7}epVUh-LHp_Y8rY_W$ zvC-sbSk(${3KU)=GP15yr9(r3=XGvo--HS{T*Y3yufPWHeFMY$jidzM2Pbu~-}sSjR8EUp^*)#aSmlWeb&0@~qa@DnjS@ zmeBq^>#B%B1l4ZhCAm=m7iwNi;h$DL@TVf`0wy0&DE;xZ0OmHl%;vyF>CSn!sv0+1 zzX7b24<|-fLiHxsKKERgw~jceQnF3SPMiP3z(i^HnATaqv>B?*vR6V#UjW%`N7114EAf9gD0NQ0p90|iy_ zXUPgBgBP0huUs)Q6elb`p#TfbA1JxOew{rTaSfYaDT z@6)`ttU2fDGb{z5VldG%3HrjE+9 z^QVE?>i}kDYZfmt^4g&v4vJySlsMhq$X64=MTvy|IM~vmv~^gIUcJxd9~j79k0Gme zp3@#$b{kJYYHy0jetX-;lb=zz*xj)F+Y)*;$PkzOP`s>8 zDsvhbxx0x-Rg8oxMPj^a4OT*ShRj&UQ8+DV?=#$#ILPxY7pbLIJuC8_g5jIULPbHc4<-~>%-*MrdWy0cAuNIH|FTaR|J4$uZ!aZ3xeb?QYC!_q@~)Wr`_;s z^H{>U(d%DNtRlqMk>CW+?*hVlkR^Opjz`H0iTmuh@~J&pL|>=lW|~#RsP`(eS0-`R zCTf%gvJ)6YjC3Ar0(5$O16s7^-g}9N_O1E1@yg%igf6;;|m?`f5i_xcuJ zFkIH_fBB1oEYII`h=#rYHwt>Pr!O_~!Z)aON}4h{#+?d^YSslnR0!{hst*+HbGesk zDl8B!8}eRNG9ohr>PL3Kr;X?y!v;srT@s zJ+Q{ibzk>kSOw^9f$7-H?BpEDkD!v2tHF=$U$~YIOGyy{BSuQ0x?6gmZb8O~Qh2IP zA8)3jxvXBFOs-!mamyt!zi)O7`O+#2SHI#W-t~ns=cmT;+;@{VSE_I_=0VTAB5t5D*!VezXGxMo?9IhVkA5vwvQ!gKWUyMBH|BASr zx%V`FB&s<9h-L48#qI-``eAFBhW&1pHmbH)dyN**CQ+@{`~(zyp& z?A_)5gMpe3M>C*mw;m!it61dLRt>)(3dRdD>JTxrThTUR*hva)5Yl52f>b}HYgpJe*Slw506X)jZIenferuJF6LtS z7h8;tnVs$5d&pe>b`<@8_K>+a{=f#Hqahn01E0qv+deuBahN26?dVs|rJv<5BJXq( z#g}71)A_L2>BKW^qGIA3)p}vt)WjJl8ggn?q|SfLG&^#*`}~@m(zw!={apq0d$U3@ zo~O~}(jLjbutekN5K+!P(%nBl&N=2hoMSM=*^jlEa9q>G36yH^rCF!cdIN6sx(m34 zr|brepp(dbM0{xsymujCnPZ<_!3aXsce9(<$|&$~DdMihDm@$IQJM6SRU7usI2YnN zd!?8a!1f!J0-W6ivrkPYlUB9(v6(E|LXQ<`29%GL_t9vv{q$NK+SXOts+TtWcciAc z=o)j8ZsPd?*Y0 zH20W(M;rdOlZ>}M2Wz;05(xc8-C0;081G@de!+=I;2JKTL&VuFsyzf)LUQ^o&TW-s6rZhD zOBst3AuQA@v#-rk(koruRB4W;UTlQP^0vu?DFvN)&TSL~Y#jun$L>;Md?+@-%0AVC zq|_k&3^jQANWWhEH4|U5i8kG8onYiQ84k^)cN!MOFy)c`3I-o47C+-Q%IC(4V;!su zOL+{?GDJIe3ltK7(P%R)f@(fOVwolfj`CNBo~(lzRF3Bp1as@K3-c$JVMTAYFHYi! z&VrL^pmDxJ={F-D8v#C z10uF5!SMoE6sBBq!fFA@2mP+N+e##x+56Mmm+(u!z`&CMq#f}?ps z0=nB%nkAhUU2zh3&}t0~^=Io+kEJqD@}GWO-KCvo}*RE6t zWrCn2?v#}aI+KzYJ+7GTUDPhSHhY0`QL-;zJ?h=oY0->Wz+0KWcWK3LvR=Mt>O$ab z%88KhJW`Ud9%u8%9;AmP{xNE2o=`RrL=8Eq_7D9MRsP6PKR z5(d`KaX+hA)B;NPrsu-U*oD*I)X0(Sjhp$~P0H^v%5pO9T}g@iM=ybrOOWkvSsz+}_pu!!9G{ zl2_rUK6ngcr{+jmzX#E^*wM})`i~vBSv5kajl~$~5($N3OnpKYowZGYpT3PqC02zq zYTYt8?kmp>AGqLM6h0NSL~XDb`X?J}uxT+s)pN-Sn_#sxr#!n7YMxrCq*j#1Nan#% z%?4Eo)~KqQ!`k`-8^qvRRXra5vC9ykO8t*rMnxqdHZEiosPO&a64M{MjE*F1$s5g| zsh=2lye1@K5Tu1W3KRyinkP6@!}9|V4XlYTp_`z;&q`R>2R}|59k2WVFdy-oD&qSc z`ITJ%keKH2qsU*d2Wh#ga)PLnU~I959Wkf_&l#FUvSz1NfX``x87~OD+Dfzj&D;tU zuH6ml&V4j&X46+p$yk<&metX5o3q~&w$ip~J3n*46%9hz>^;y%lqdr$hcsTxQTvMS z(Zx~@_2V_4l_gTGMlU-V;BRo#y6EbHBU6JiP;7_Sy5v07Ivy_o{Dv&CUeMM!th-vJ zHc1ug+?MA#oKd+BKrv&9!Jp_469J$VEKnC7mbWdj6}&{b>3_A?G?TXI*#yspAcaMz zRW>bAN2|?`49#J#JjPAx$@epheC#dRGPfDtFids98j*Hqwi0p%q?1#*sR+}Sl92yF z2i7ne9&z9}f>tJz=UPJQf6>7@o>{S(+|NL2+~in(brT~Op2pCPFkBnaZz-QIWs4w}(?|Gj|8 z!g)S(#SLsi0CuUmlLg%~;_);+gA`;M%mFw1Wc7^H%H!*76!+J35Y%a}bujiN7OuhL z5h&RNO9v1ort~9k`INwR)5aFF-HgfrzMj0rFTrspvn)c&D9Ve9fqJ5n2w47@RSJ;x z!oJ40A(>PDU^_pBPSrk)uT59sUlNgaFs-n)h{#F60hygi!!IyN^ky&<>rmMkGIYn?oLgZtgw!AY{8--!e3Is#**jbiRbjw+5lg_ z5W?c92@vGbBi`-#v2AyDOmQb*T&4lj$8qJRD4_ARik((I=07 zz3Yx62_8HXXZNXc3z5qkmWYKw31!@7>D_xRdH!wWlf=Gd(slddm-z&t;&pwR3vx3i zD=(x@C6%cB3)b`HHVZY4(4iKmmiE|zebY}<^?>EzkYk$lCpn0c8VwM$PG%U)or&z8+mk;;eJNMh~vO#C7YwZo%?a1#o9B3^`6-LIF_UE}aYdGdyu zF$OSo4&j}x85?`i4-)g8Y7eFGfpOQ?kEl0l-wtr&gj=o;I$IhmdZdiZyqrega9KS* zy_`IUL8dr*U zSljzSzg{Jvdz+v}BPK@2ER zoan`Tm<>uBk%x~^zI3Vnz0wFsCE?Xw#cvHA3`P}#lS0h$5$MqMR3eJwUui3{Q_b#2 z;Eu^Ll6R07g4S`cr>Sjxx~s|L;=$dG2*jx>3(5_67Z;yysVt`(6~C#s`ph6gVp)&u zGOsUI7uyu0u$dnDPUC8D9piWjs=)n*3&!?ynS#a2N1l-EK8K0wJvi?j3?mVb=ReEq z|16~c9f_Wm`(pv!YvT&a1#ECc2TItYfN}%JY^*6+|8O`|-~xd8uti7vBl3SF{uKnq#_}f>>Yt*(3ui3gf{h^<8wc=* z9Xi^7D*2Z{HqJkl1K;g2LAjbR9TdU9IJo}Y0pn!;(>|y_rr|1ZK-9UvQm8op;DP_u z$iHSL|J@Ewjz1DWIe{#;=;(i0DE}js=T9mX*B|4Q|0U_~DaC*1X`p-AEefAr1&;F%x>14S{6}Y;|0sv+A8qK9d}!R= z!HtB41GwzOhtBqX$$)q+ z_`nHQX<+=|pBnf{|Bk}Hi~L9O|6iN9e|e|HLui}RnJ@BmeO z7@@fTDhvqfjswQc2F&--17l?YqPuZ{vI0Q?ctCTvaVQmKRYf^5Ae;Ld&>nyS#P_fO z=VE0A27A@xcMU`d~mQ zsmiI#%K))`8-X(ZsK9!6h^7r+FEA+Xzmw^o>N)>Z-_#oL6%>m5?>zbEHrL-)od*(r z^b0=d7aG^!wEr_7xVV6cgX~RW!Qs&V?(baW2=HwS2ACOT3hDs7k4gYmSBj!>{hdkw zRgn8nK>!yAH@BdmtDB3tu|1quc8-^~p6a*GyEsx`M_pS?JcWMBwG|uN4-ZgP?!&lL zhaw`%hu%n}q_7FXjY%M+5HJbMb8IlX;)G5_HaYXHDtv1{vR7KmY?nql?sf5f9r`Y} zZn^+|LJuJ`Yrcqc&)pxdXfbYiGH!xdjJYrAfP~_(3ul%H)9*)ZxY$T+wrDrBp75+M zr1+}WI13nH@;`!Ukkp$F5qMZ>mVW$BGd^J-3>wnzm?|^tP3xM|g~#e{;$ajNU?HRD z_r7bSkV~6G`keQAG;a4Tq4-Pv>UYOoAr-O0y^OjOzl)^ae& ziPQp>ESQoKoe9M@5@(mfgpeiW%O?X$PL!oDKZijF6X(&OVX4Rxyux6}9)=N2C;#62Xw ziT5Vg(Wa_;We9z@Cvu}{wVyWyTMiB;n5qolOftuAxk}UcX5C_3UECJ=V!P3vCSkTC zi8+S6C0}FK**xdiXI>OVV)8}CF#)rvPw?l1b=hTnTs%VVKf1aP8Yf4-Q4C7_{AIQ> zsV&pgXn{HVbobT0&H!V9OmhMETJ##tDw`Jz?rgp-KEw1V#(VuCNK)PTLBPzY7JgCM z%}uWXzNcawW*&}Wep?c9F3s2{YYk!MTr5z!&W(~ zSDC54z!mMp$DriQQ5u2Assn^U!eHvq%EjOHdg6f7#;~^;W*MZarPdau7v>1QSE^~< zpRO=a9%hkE4YgA*f0;%L??j8=k7Yo^NPe`pg=c8D zrP9rrzx0foj}8kbP^hw@{1*TC+CSMrtklGvD0d&;24bV)#OBhjg&3M@Ah4OMlBSfj z*Ua)!$y(jn9`pRxRllX>CY{Yqi#LYzixNKU>w@MB@j!m3swAI4Pr?RD_d2du36Ve& zK?+fJ5BU6>i)$6m9WOwbrlf9`>4O@14Eb3|toFL|lGU<)<^BqcFt(_~#w?Y?C9^l& z+|ackk!M(nEsar_jQ#W{|1k_9-~lnJ!06iZ7}ME;0C2ktc1ueJ-sZ@Sr?Z|#8;3vH zjwo2#N8Ifqb!!+D*p}-&#=mMbEHh53FTp7dR;d>z8*U&~0R~_vrlg(virG&F(b`z3 zAtp!-g(YAwW{-AK+$#Tuo(XPArU<$w{&Q<)QYR_;y2Gj{6_=Hv6BW-#)k#pk=f&Lr zcLr?C0r)gi4}rYk1~F zwmnrePE-&}rG~``#n^KZ^TC9C*&-OmP(-GzONfDTb(iE&NivYUu}RW>8nX8R(Jj#R zM>B(A&pB%HJ}x;?!7^0c@|C<|1#<}NDg5=%pB})IKraA)HrSTzS3!<*Hv&czorjqt zKIqFFop{RVY`+Eacf>5@c2CaeQdSf9P3~Vm3Z9BGe9cT1s5aLt_3@FT|Aa zm79}^s64(b67ynXFrHr17h--~*Nn=rT7FJ>{pln9Y{NVj@_nZ%%YH_*#htcRx}!S7 zvnRM0m|nm~7#3%Tb*V2)kp__Lm5B-QE>Vr|#b=aZCL!VB7t4Ee^jBHEzJS~bwqtw`OY{XaKr>4_VSHp3aB#fES zrQ2F}n^zrAKyZ`LqkHMO)g(E&g2tF%v=c1WANoJ!ldU+i7ma@;q2W?ZNl7BA_yV;+ z(#t)A^)=fEaijPLJn`1+i>%y!9IV&bl?pMtr|a8W%#=Mk*3B@KNl%9_FOtGy*fG&7j7)}--x9sA+_$`n zLc0M~G!yK07K!r?vmb1PeY4K;iYr*G9(9k|5M_q}gmhDiHhk8}W^C(p(H0`UO)aaH za(c3=YH?M#V;x%wQ{75|T_?Rs3!&?_76|W)yWo>N1N`04s=~kJp2#lXZG(tJ8$?BU&Ru=x`D@Ki=q|$1M|)< z_Lwl&iaED~UrG1ZqN3_8gR|A;⁢BwY>u9=+{`?6LVp8zmkh7b%AA2Hu6bd7cP<~`ohVax2D<8O3 zgKPO{O`phsu-Bir!rrkA2ld-7tyxRH$m+L6X0HMs7i&a1ieCnY_XeNo$TPkRxs1K+ zT>7ace->QEFvnk6Iu@X{aeSd{b|E7Fk$Z{Phs#ZIBIMrk1B)B^vs~v;rs)*=$=y7M z87IPCNy16YW{CwWs*aH0SH!+_wl?gBL3_p`u6IRDNHs*FNl+llp{1^ z2=$P;+(ek453QXtB8#dHPaBJSG>+q2Rsv;oi)5_T`(*kTtqNAD8PTM&Z+I=Y5y$i$ zjgRvqs+%oh_J#6tvZ9h2a46xEc(qZ+b92i#YrZZZ9&0>(LLorX){&+v9n8sw{dKQ}oWk4MBGxh7{?k*}i)&v$TMJ8qg3fIg!(pN+tiB5F(7f=SEismm_wf=ZXIJjZ!eHU{-*=91Rd8wkc z_{blhZcDRygE+K_g^R#!&Ska%UHSqCh=_%60b8`RhQ4cC);y||+4=9Gzf|W|qdq(a z)^d(dHQ%r1;9sPr@^kLK=AG*t#dls8xE zef3i#ONXC1Y3yb-!U~p+t{9TmO{|MKS;hY&L|*DbF1@7O`E^^qD-YMu)vQ#O*=+RONG?5guVUvlDXj7nNjctqFtCNc4F^MS6DP{Z>PU}Bk++V-+X0Md0qVWy4a%TznL zs+yWc&7)H|H_C>UYC15=&VrWCdo{7@G%MsVtP7brUW}w9%6O1O?ubpOU`FIybwqtE zo)jN!wbI`m%^{UZaSr^USf=iA3)HHZk-r|!)Py6(TJEE7XkJT#9Jo6!nbM%je!$R= zFdnNIC^K?G(M+)90(!0Bbw~pvXkK4Uu*~pJ2K837Fv1n)I;#D0Q3*M1^n(TqyQGGC z)cn5+8Q^Q*|IkPvhiH^{ul@|4Y&4jNxK2&n)9p18FO3unc8qkt*=beJ2fOwk}*6SAUiF@p+BIk*e%?N#nINy>_QF@ZM1r`uI7xag0%m z8`g5s9#jm_PQbTpcP)N{&l2&H0dSCWJLC_%*{yFsy9J(yUKho;kOZiBBk)eul4zA} z-F|b{XGm@Y>R0)LRh?4Vm>}N(b83jLAg12p0J`J6EDZ+P2 zeX5yZrSPtj6671IGsQD%S6nJ#f~*EcZqunIRu}h^ZUDjcdO56ey^?;a?x;%FqRk1H zkyr46n!iI>qcogMF?#awsXJt)WZy3(5^&rJ-{OVFVYNttDl05T`k$q@F9^a^GUSno z43V#GP;&zvN5iW~J*sOqG_@RX+LhbJUJBWrsEjvwdV|QTXsP>1$0H7T!YAKc+l0>P z)x$8N;Q^{qCUhlVg|!ULt9bejhGhZU&GkkNhDsZp_2H5)Qqd&$UXI>!W#t8_)FXS&Oq1$+Z?d75&-MY3kO1 zf(&nrX=0%Px=#fe9W(g%StJ*0LR065FVn2&p@3xki{#`jhJNV_@R=A_wg_+J&a0)H zCG1H|_+O#Y;)6Da47r%E;s*uTUMXe^W9BP#Pojv*47P9e72FA^1selC(`5dj%;23<)o@rv6l&78-C-Pt%VZn)J>do& zZ2$t7InQ;)=4emlM{lPs6l8|>VQ3y6xD=Jl)ch#OTiH6r9rk0VldX^@DrB!{XGXen zZF;RZdaX;OX}6@9$9g9k@_njIl?rF1*xu67$C%KF6}j;MrPNK|K%(teN98Pu29q%7 zDkB@|y}A<2czJrx%6KC?x?*0QX+9@RA%M|q!K!{gA%RU)Pr_EtQe}_m(3IJoySl20 zt^CmdE%6RCQgMVh0Zg1HWR*2}XA_vp_I4jkq$$}gO7Bn`zujdg0%OQp`{DsQ+1A91 z6jd4FdbE4O{vaT(X7>{^JA77fe^^cQTxWE|W-sp(#a&>46P80D*gMhl@J-?BIiM&d z2Ofm*kQoMQiLYq(sf`}uSfXCBf#WL`opNS+HUSY)`UN6VaQ|dI*7m@79_W6sWvmbp zpUC}fUZo)P@sY-Li-uQw;tf0}rsgWW4{ldfbnD^8iHf>iNjZOkxO$MkiMhFgrP8Yb zSKdQEgtMrTN4f)I5AO+^8*te{2|%O&y|rUmwuY0IVMh?raj;_9wM^?PyrSnv3=JqY zE#LT(JA+mpx%aZZm zSil@FE#`Qvb?HZR15sx^P{yig&Q3;;D&!7an$Oa*3aZpME@2fkHWZBcG*|}>%`<|q zi6qH)M6gdk-iDq`#R@M{qcr9bYYC3m)8ik)z?j66aFfA(b*03VEpruYLG<&#tu4;4 zSe=8Ei2zF_w`7a5oh<`=X8~frafJb!skp6xSLI>d!!33t)7HCO4D9~0m*`l+5Qg82 z=`M*38)z_b^F+=+pgo}t-$ib_`KP(3I{4u3ccv%nfAvh`0WVDPpp^O`^YnWzoffx3 z$h?9UafUD>zvto(dTA8j{DwN?JANxX6WhI}rmx7fyC)#Xx1ww5BLS=zj%-&|n1;+? z_IzMl>{f}G7n&N|)J6ReL%6clE-=2E>gby@-05Lu{4C482%M!T({*KLdJN&R&Ze?~ zwtS%`x&oSFNAp)Qf)q+vZ>Fw?KCrBkwfxZ_``q$Git48OqFH<+tj_5Wy76m}L)g9r zm1X!cWMZA;G@p-cAOLSVO07Y@xd5Yq??cAkkmY6UtlJX|S12uAM-j=`^k=XNy-zx4 z6F_4^8kXea=%9L!LV-l(wOH*+d++9@qj_UHSRp|k9>!MQl7^1X&I+0iUM$Z5;z>T$ zGlY}qdcJ@ch)F>1&s(IuAU1{+x6G8JDm7_+HQ`JqhQge+Nr0$WG?_k92#K|sotN8_ z@ecS3f|qcFzh@j0VFf&kC022;xKG6PfP$Q7UWn?e_=Fi7+>tu)vjeBUOvcv{Fj^OT z9xqC5PeYG*_~Jgl+f&QjZwWhb4=wN!(EU758x6H|WAQSByy6VX=CB9PP7$H;aVF~p z>%-T5Ioxlm$AA%necPBWpeU<=)+7DLGF0PkmBWH2?tBVED=)2FUbSlfyNlj{8l|N#$~ufaVXOovjmnkj|T)D zm>x(4L?>Q1E9$<|k-MXW?2`p;7ZJ+w$;o8PLd^v=(59$K4g&RIi;k&K7WyN(-xdPC z-o~>CD1i7f72eBke$9i>b|mJQoSRd&hdI!TbZlK5Gc*@*Qw6qeks>@eJJkqj(_L^6 z2}h9H{yxq(aUa{y*zK}IUFe(BRCZiTGzCPj-;eal=0_DZhujlf`}Q>A%kR>?QDWxn zV_07-Xr7l}vir09VqK~%giBJ~*l45OkG|`M=mA0;CCe8vr5X|%kL7MxC0ekikiU$f zQ|F}V_41|VQk$DHedjUl`fg8@nsDSor%r-owm(c~GT-f73&Ie%Ext8X3#CC?pO&GE z2-#oAWPVv?hjxN-5&M)TviXqTFFPo1(SDvd;)2$d%z}>;Y4qjB45PE5?~FsPFy;2E zr53=ghy5%+u%LX^tg`B7-7(0musgR#D30uDt%^^5XRcide_*$sZ)`ZEnk&He09M$r zJjReh(m2^8kJqvfuMfkr1PwtMQkL!*b=GfpyrHWxS}dqDw^=LN6cVE1iam8_ zE8ZuKK!~fZ?8$C2`(EZMS$l9SC0$j&)UW}@0>$vY*W_hF=Zb zwSQ#zy+mn<<}7F}bzzCtU3*|vNKE6k`}rZx$qEK(sABF9BHN2$-9(I34@|eRd0qmX zaZUz6tmy>mum^F_9^-`$^gq0zuG*gIH+4JP*%a+PLhD`(w8!%kPrKm- zy&{af|FrWZZkG`9=y{;r?e6oR_^f;87%lPHkaV_kd9`NNQD6f}hTD99l<5;H)q>pi zm&NU!?cWuM;6%5x{rx$o{thd4VaSBCbKf0uo_-IQb0Z34VYC09eNN!^tnR)PQ)boyM7B3A z@WHZo!;C$UFmTCbVCE5!A%ovO1wLPmz#pVlo{V7L@yem+_i^`v)nF=)L);2L=gbY{ ztoBI_=)CbSBIS7Z<@jdVg$H%NnjygLlahXCy+)Z4?B0Q;N~{>qh_IU5o{+|v!KYj| zVn^oPbG|DG^WRC3hPc03TD{K(OwjUEeU_y_sv>gX$rEM7o;3-6V2O-WZg7uOVEElK z!vOo6#UzyAZS4Ij!p3*BP6@gr?mY~4XKN%)b)xfN! zc*<<)yojlfwh0Jl6mTZmBY z_Q0{s{@K+F^4Uy!e854!y}$;5S@(f!J zEL`kx%^~7OGw#Pwc*WhP)&(I-mfQT(Usv8B3Q)%>wQYUb>)1+ptQhJlj9RW7wQO$& ziwXz+S8NY8x6VTcqjWPl0MGEBLR3MZitU?L@b6m{hn=+p@qNb+u>BJty=YH+U30;T zlxok-w5$+$?Hr+84&|E;-$Aw@>db57w$c0ec-?LSJkXkp9j5ih9)E#iBgHBleJiL3 z7=#+T)0M;YY(!;sG#n)Nel@XP66(`3J8T{(a?kFIAM7dGz_NgR2VnUK+jy2^X}=iTQV0i!xrsaX39t!zcs`*4)im{c&FB z4w4yVD`J)#0!1#XvWd#~?)pu7@t5_@;c5B3qQGO3-sHDv;4Yz6GhDMuu5a_+sG_ye z>A7c&T@nKUK6>X7LRN|EW8&PYJ?V(+GRbdqHQl=8beg|S;{d<2*NBaNBI{WVhUD%z zNm{K2#G{BSIGL;97b<$WLFUNdL0Jj|BrM0SIvk|IAJ7nynSxyB<&_P<0Jq#1o1#k6 z^JkcJ!2uCc#>39sKVi3|f35m;pIrFrJ;3XXZENH%7WxVgwIpA-%508K`f}>_1SI>f z2$ef@sDIX_W(Ob=#4hg!*wdA)C*`((dJQjTRqhLu)TQ1#yO5?AyA5@SQ5d?BGz#cr z2IthCa2K{&$SKYsuCN1N>kW-K4{lir?V6@-qL+=)HLS@}>m@3BjyN-vej_zaPns33j+eS{14VbqBR-Oi)yTd6bHCf-$hA5iysS2nArcKtG$cqX-@vLU62QR##1I5*g9G=8o0II$M{nDJk2P zER&DKDN!mSUMhCH?kM|j%UnnHb{adOBbXzMwiIi~$s&EP_w02qtUay1v2-}XdW4iI z8Wd-7ZX90jSA>h~3P2iySw{&DD zaKOutPSi7>46F2kys0x}vW1!J*KYlK!kU8Y0HPq<+(fHq4#7!MW26`3!hH`GY$9h8 z*DL_MCv)Ca0h2apjE|}Ey=E{yke)#beTu)+oiwlK7Gf5~rlI7xvQrqA}HTNaB80=iqjpO6>@RhO;WqN*l!rwQ%y z9I|PdOuM6vjc~ue4(?%h#j2L_Pv-qX6L}$S#kY$4!y)+BN$VF+^1Gy_` zKbRn<6~f>wA3pal2PA=ZQE0%EEi52%;@V9^*Z4CuB;RN9pI^iad2gwo@W2R+hxCXC+A5Y ztwr>cL>CqFyp7gk=|l@K)(%o8d^E$TD`?o{Zl9oA@B2mSI5;f2niB9bVUm^6#5vpg zC6A5EIoIkxF-KlnXck-nfBz94Trf5j|x0B)nq7Z z$#l7Mayp)3kCaTseFf^W^kg`mL~QAbs$_ELns96ZrwW0&d~AvMGF+12WI~cM$t2Mr zf-{cGs8Q|!3;4kNP`#WTgF}J9@g*SrU>eawFl*ccxdq4PgfPp~C!7a?4)5;hYUjsx zAK!ugV^?3i7E7T|v6KcFSKJNXq7mKJ@kQ%_KGB|`b zu^vammDY~d;ImXo@yHm>l8twLzO5Wa3g!n5msotyJy$e0E!_J#T0Z}iJSxbJO!vYhGFcX6-8NISL@l&fl> zg3e`*|Jk{7baB#YjT%q2Yl9SQ%(@hr$%<#HJ>kfp+%lj$qbJ~(CO2_@P5Yot(OD4w zu8iNGHmHJ>rNB9c#(x6%R$+uN+Sd*C35VyABlQZ`V51J%u2kWD)n^i;s*5SW$LSJt zn|MAM50yRP9JwF?T$dX4+v3-f5lqa9C@TdeXwoI=Jy>oK#ZZvzpgv?@21GgMNF2xX z$>VIMc@ZPp8V+q~wMgD&DA97I!ABzZ8vQVWge4Edyx3l2xkPk;?a0oxQK%Fc;QZIt z(or$=U5Z*hS}T1EHz|XwrcdYc=7Qyz%dpAl3q`#jHux=&SmgF0uFW=xok=oRBWP7N zEJ;rwv_gR{E?Q15a%C8TA@2<%{&AUVa6*pu8tPPRql!rGxaQg=0;&X@af91Zm6WW49X;#CYoqn+Lz%HF8wdJ6Os>564;Qb_Ow zwg-c4ooiW(s~An2_99NNlHI{urPds%y==n)W^Brab9p3yd?rNrDtE-lx;w5-{#XBi z>>X&8!?MCH9>~?e7Sl#5fA%S|_*c60ndP~!q~xOh^$;*{GhoM7HOeEy)SoTAK{!9< z3)mG{{u=H*h(Y@1AK=qM@+hH&oZ39=2=3Rg&2+3`PloMC&gBu5y${hRCq+>%t;k3T(-H=vV{#2ve%Oh=XQQOPmJ9PZyZIe%IF&91a|Aak z-6cS`M;Ei(z)o+F}wSr6?p1S4Oo|vUQC4GJcoWg z;`htyaD(y`wIWHZHjxrqVR1l>31BhL&A5h1pZ z`JFSeV}sr!86Ay_TIRAmw5IX7j_uy38?6cuzZ!lu{{kHc%t()-7ww^|s-ibe$UL_? zP`eXzjf{Ty_@&)9qTfbYufHMYTW7m7Ka*R{QX>^puD(BENR1{yA|%d7x5ZqxnN-b( zkvts$#H$`Z?k>zhO*Zoq$u}f>tfMwAMXT+KPdziI_D$s9y{3I`CgSlcEF=_=)X#$V zb1B+hHbr~~SIsgYz)wrXqu3m=vvaG{QfU1=7_Jo~v~!Nbk1Y-yIC(mlOtl3c<)_5W z6n5E@+yM#iv>6SbN*9sqtWPp>pcDI301QhARVyGCF_x%;J4^Myxw{~xo^DHuD=X>c` z^pLx{=F(9aQK0-Me&(O;Ce$5%*Rj(rT$dgSI&|l{r96W zn*jUvqF7*t#tr*u)J_JA7Hs(LC!ewD`D-gGh2<*UZ23LpeBGCWZKkK-aK$Htkq}Eb z+Zf`+Pg5C5^k$^s;W!u1ue z7@Yy3>Q{+T)J>?$Q=Dj~OASecgL-@4eEz?}z5=R>u5DXV>5x_gX^}V`q@;v2(w)-X zaTMtk4oHKvfYQ<_NC<)w(jtf;(%tYK{QviT9^qT-n|0Q#S@+!c-q*hOwP)r`TpOsk zfsg0cdv>zZnjj0bAMEH$U*bwuP|uI2S?T}8pWv_UruQvyY_0k;Nh9kIy=K#W`~agL zhy5;IvMIaJm__|nw?%$*#qmeSJXEFSJg7t909x(lT65-G!3%EER>BFkBCx#WvELb! z)ur!X%rwO0%J4&WvaRUB$cn}dY)drAo4m|3spKr>iC(a22l>#4U*bjz=eH*CZ1hPJ zzc?Id;EFy#Tz6^HODm<_yj%YuPTHC(f79`mENfni33ImC;gdZS_x`YCi(Z8 zOMx+E(tF9lOz+=s0bkyZ$+q--u9+ZS8Xk{&y*(hA&Tb%p=Oj3psIW8cvwqeSACnEa#FpQZWm}ze(oSvALVytkKDY(A_^}_3U z$Wjoidr7wT|9ga{rOmuPfjgfb}4z>%4*Q9Suxf<)NdyLc-Nr@pE{^XDh~Zbh*7i+ zJR9a&!N(j(-u|n`oh(3Y>^0UfQ8{T&;LUwXi|FAh-18J^GH%CPY`|KQnVTpMN70*B zDxKB|!?zMaj-+d0Go9)oD25^k6s5uSnMICs+7sNAHB|Q{L(*Zsst|WQ$3Wp3g>YhO zvw$pD+X58)D+L~vGpmcuo@&*YtNlEmEOE+j^Q3<|Gxxc&cOkxlL#hK07Xuw*lE|=? zlx8Mx)Bqu<+<$K1EF^Sn(6L(S>pEGVW}D}G^zQebo@5sM&PS&Ns8nM#nZ=w(IYFq% zwKF_on`7}D6utKNg$$&!U@|x*kj7BKx4($^KGSsL2CH{C=6|nN`SaBSt9M2v>CE=d zo`fo9q^L;RXLPsPk8?dqdU%ZSh|2CJ85w|Oubon<9SGZ6JPUa-f=>g$?R>VRHuxs| z0G`a+UUhAU8U2YpULBAu(p#)ZvhC#txDdZs+SvmE`xvfE0sX2R*+9%ps zq9&GtwUZn65l0DH?T{G9eOqDb)j>7(R4lnlH8E#V6H*%jSU3(V!x)pp`HoVru2#p7 zNR<2whZ%+s8@TAdIH9^r9tJ@nTF;< zvkkkRvleUGWb`a6tGqlb-Q-T&3;QRj^l8_0md%qpds|xT_>cK<4vhA(wRg^*CyWH) zk@)PF7quUep`MXZ-^wjkq_jJCofE~V_E95eFy?E5Dmb_MMV53jt zGjO|Ogp3&$kiF(MF}vCvOiiCOfG=G)SS#}bd z%h+EPlaNMvJ4mPhyv*T)PMrKl>%*xi=vfHMq4ap{{Mvj*d`hG+!SUREaTP#AUt6!q zw?S|sI1dS33is@=t_|T#=8)SBe)W;A=ia%g;m4Aw=PEP1jp`56c4pc`)I)k{69uRp z5+ABd#&e=prASs1qSeUkJ#2M!nLkBo5La)NCa3sQ`hy!O-M-YH$$Qjyy0rzwKhC5_ zS30*#E3gVnm%+pJ!Xe&d0`HLFIx_66{RLZh2y@sG?SEwIF zg37a14fObfvix*6l%>C}tEBG;Xzd&-4B13`EN7#NHTR?$8L&okEqQqsqZzU9+a4xb zz7!MQ$tmaed|~_~_aNS&2$2q#VzZH?W;Z!-2`9~ovpltHwP{i^AZz5e)eOtnA9B3& zWe4B8tn3B}nMoYqq!L{x zqgOZ2)y&mz1RHQC6&x0L#ruQ|cXWA^G3b-j3P!%%v3|ocyr%5M8by%p%#8lK~_#8^W?bT`ZsUN%8HZ;i2_-iJZ6$& z+{kU7N~G9xi{TwEG6xTHT!6c+w}PJqb;xo3GX6t;DdwMUIi&DE+XUy!H~nlF>Qx3 zv2reB4{I@NF%5fs6U;RmC9CdSzkWmW{tgQ7Y%k%Z0WJ?w^-BPDOj7+AWdz4e<;jwF z7cD$m#^c)@%ci>xVXoVGr@d>eS|YXn*5uG+otZ5mZCbST8e&{vW1w%S^qS>4lH7U7CdpC zsjfmgWnd*th{+F<`XSg`i8;8>=I1+7SElqxD}o}T(rox1_t49q@9dof z-5eF<3%pJ%=g~#A>f3H>X!Q+ij&f)aMd=~i{=5171K zsUZvt$$tAheL5yMLK5MN!0wWX&CpSb0X2$53ZHfR?Yo1uoMvVgmgZZNtO2Txv1Eir zQ~qo_lD>jR;dn&&k$kB0`HAFR)cw4(zFd9x{wG*AlS_Lth25X-qcgyf1O1YPp>9OB z0)De6HcUi#v@0^pb3;&P3Jh5pAOAobf)?dA)wh ztDwQbvEKJ+?A`~m^LK3b)6Kv`kV3Y+H@UB0HOdt63K%mLBIG6&ZWL}1C8K0$ailsG zEr3g)MY&J(LhE<(pJE-|Q3fc5Go5#5^*$bDP#l3lAK#I9`}$r9tkzg!L~g#j-|~gp zN_ZKGN}HGyR(EFL{i1s->ML%pvZ>0e@-;6yv+{q}cb*(gZ;7k-yey#Vsy{kH$Zne8 z+a>e_ROD0+4XWG@*UTL?gIl6Tdp>Kt^j&nFD98zi6eTPL#Wv*K#RI;39fns?0Id^w zQ=L_9MrOT=vZ83iipnNLIgWioa%zv@EQUJc zn2mJKxKYYc(Byi~-E1u{1`nxZW2v4_z!i5*$r>9l1u=1X>n zsk%70)QSZZYxLu+g#^_#XVNs$#V>N?)MGhf`iVZGM{+EpMiYG}^-R@NZ_drr?>6K{ zX^(&g>8x0O8B&guQ`4XlZa+I2hZDdkSE@>T^grXG998ZWZcbo(XZVfMkC(YuD{g=F ze$2QRn@?@AuqtV*DkrDvYo#jBQ%Wj|&K2ir+&)Pi9rfksx0`2gN@O5SuY0n0%4w*y zw-HXZn<(AM(V1li3&RyNsBI{FFfr);rUH#Sn_cSSXe*;d%oK|vPp5xcb>oIIBd3!> zAg3PX$B*G?DcqhpbFMq)i{8~G!pY2J;+Z+C1ewRZEQ2>yiuRPHjQz{?yte|xn`skl zGLlS7yocH0ITo&EML#{=>{JL;pGdECJi|}EOAEm5BTjw^G%ba54SYVwp&fc93cEFs z?W8wDSAHGGNBuS_D$f|lmy@sH*lnqZ(1Jo;K|=y4o1EzQ@;Q}0ZBWdtfIu@Mud$4| zv`pQ*qU2pIbvfCjK5s#Zo`~sN%V`285rvW{TN61s6LIbL#`L9x0+_2BN%wg)(*x|P z-5ksmiYa$~2r~zMV&G*naaPx-z9JVBekIKv{&kgE)T_>k8?^sn>Xk-x0?*ePb+FYItddWgzyfs=$14; z*4Ebe;(8GAo2J9S!K13&*`umv)9TnRweu;(CiVM=)JA&Fui`aYav0pjfxZU>hZ`RE zextA)^yKR?_p{LgZHWJTUgg=wiUS9N(HU*Zm=FHeF>4L9$a^sg#D(CX>OXg`5$G51 zF%KSL|GsUlX{D^LN#jp)TJo0CbVX=|G~e(#)Vd>*Bbq~pf|$GZZfK~qDRw}3MUcX) zw%}lkC88TmWvpEGVc`uC0e5RjP?aL#71@4 zAu1D~!kC=3b{gR=?dsh3+jDn$C$Z|+SYSu(uY>qkNwwX>X1gbW2e>FV$JgHOa+0=v z9~a5e3C>%T0K_@rN*hXPvGHkf0)o6OAX9S-^_`;cBQ`XhZ}e#!5cap*d5i**DIVPb z#}Sy*0FC=h7DzbKyfQZ}MT{%}y-CS^JRDDxTX8{^$u-HyK0S*&;LPMcT;OxMjIXh= zn7hu8Wh3W(Y5+AuYk8=_yMrcHaKSX;0O?mzr?vjY$NFf61k6kVD-L%6)~$P3O87@4 zLL%fs7M>?3?|bK-i_PKiwCano{GOc7QcUY>iim^Ho0%nV!#4##^9+8H&YrhD7GotN ztg5Rn%F@s*&xnz>dx6?M+M96E8V|U&Lqh*hfQ)Vi8m9(#>MTcGhYd%4{>?Cix7OfFQYbFPS#TfQz~?ttBdK$G4Dz~Pw3hxf3skwW}wEy#}lpbtJp2yJ0h=KZ-m%B z&mwYD+B~7Z>Mj`W;rDFS&Mf*`DS@N37CSM8sKYJp7P7;tF%+wcoS|I|>-!z53VA!u z>TJ8YyOA_+ozYECeyH5fT_dnMohQ_If8%>Aj=}8D@UAly>)H@)0Z&qK9RIWNhT4XL zcE5))bOjl;%C%>h4}}~TR~czopM=Cz)jgN|K6ljoU@|VW^=3P{<0M{tu>jT2s62&Q z1N>7z2a3XQHUU;tO^&%R#gqgv0FSz2ZhBmI)IO{@`u%+;MJM-ijUS~l3?+NX${a4_ zMY^F>!QF2+o;Jr4|Mr>ZILl5~L5US=PxSG~`{R&J!=y(>7Z`@T=0c*ysqSl@-<%Ig zjq!xer8IU@nHp%96ZHPJvH9Is|GQ7e-%p|*ND=a5gKd2uWwz&DY86-@PW&$TmD($$ zu)4^4;&hsr16PMs#cl6`eiJKh&4eBFxd9 zDfg!1^+RmTLz=DYn)fSxS2+@pEqBx1;fk?_dEik^ofKG+HUC7aZhkyjj^)HknqHIv z`%Dw>?2i-xil4>L=9z<>o2n_S1#0SZmf&0LU+nMV?x*-z;HS<(RZQn`@Ys=|_e#^WDpx#z2)X;rw& zsTLWw9HT+C!oSzKy~?N!-`d$tJXW*HS}&g+rlluzMm^s0E2QvG&N7JjYCEngrlP)4 z(E9$pKnP@;d(cyp+?tR@C2h&8i|>#j{Y(CoZgza$sc-&r1XrYyMl(N~qvCtp((Vqs z>#&z}R&zw3+oD~oPjN}^^A0jNb4lMeWNbk;iB&=!_(fs{pqUN{$a@T2DaZ|HY!*$u z`B#!T-Y6EWxu4FiA82$83o3)SU+~6|G~)Vi;Nk?;&#}&>!z(A?-vcX zn%~cM@X39X!;Jli(&#B*{?`4eg2z3SoSq`?bXlukorkeFep_1TWu1WLH*$ZKFOA!% zYagBHy-Be8RR3{HRnMTf{!7(cU$U3!f-f42uF*1}!VgyJ%iDh)Q50nHZuO{fXB;ORfBL|7J^X=_kTS67BBx#?z_MbRxg7 zj>%LR)Hi~qT7orEQTz_UH}X8W(9_}WC=TwI#O@YBwpDq-0_u0%UITC?dCYkEe!99y z`$x-QFZtdQ7$4Bbeu3_M{MrF~EO08bxkz4!+gY#Al4LQ<6)i3MqI5@at#UU6MPyO zW=p+3bk3~%tQzy57c#x|vov$n`;qe6szH(-wQV9ZW!HDiAEJE1_H4`yTT-61XuKFH z9zgLVJclMB7b8m-P%De zQ#Nb0rtP$c)yU`ik|b6zL0slU2Ub9X=biV+AI*ad)~lilO_I4CAv7-Jvtc{Y{GKPo z5=wWf8YGR&MKpJfr>cgTdA5_cKQuXG9x|gkB2Mw5g`{|E*4<8?wzSdG&@`X-{S=c8 zyBn@bx*&)rw(#nsd#{u6sMnjR2+{l217Lbvch2I{!jhU_Q4=7MYL-^IpqY*#8k>`< ztnePi>FH{vP^W&JU(O|@9kj^i75=9$tDj_!Fj6u{;UKep*Y;Tfa2&XqOpfn9nlOXic7Dj;ta?q-?b z=w`^a@hI)2V)`6JV`ip1XP>14D9*%CryDc3MNV2u; zJ9oA64)C_ zr7iMUPf>o6m~MG^q550waXgDvL0@S0YVy|cIn$ip3&a`8FMSSyR?lp|b<|5?t-5zW z_U6wPmA==OOdP&si9g@Uz;jy}p9)AA8BV~1Vw9&fZ>LbFL7_p*%1P#1!*bVRbW;*dsNxlH5rciV<{jIsmE{rzNv!(phm zI0HqDBQkVGjGi6yvu%KLoVPf*Sg$JsK80aXBK}B6{Oj@<_(xGdWk86W67fgB;$Qnf zfA$T{m{VgRDv`U)*weA=2<$>)~k2ncX7SJPiMAna}A4X_zSoU1`fg;RZy2uW3XI3 zfj}|G+sl41(3Jxh1P;1-#Drh%IyfA8AvyIYTM2AfR9J`vBo?y)2#kaxq~RE2.5 G(llo)-2.5 E 2.5(wa)-.25 -G(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F1(SYNOPSIS) -72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0(After)108 153.6 Q/F4 10 -/Courier@0 SF(zfs-fido2-change-key)7.564 E F0 5.064(\(8\) deri)B -.15 -(ve)-.25 G 7.563(st).15 G 5.063(he k)-7.563 F 5.363 -.15(ey f)-.1 H -5.063(or a dataset from a FIDO2 de).15 F(vice,)-.25 E F2 -(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15(xe)-.15 G -(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G -(umber of additional de)-2.5 E(vices.)-.25 E .273(First, the wrapping k) -108 182.4 R .574 -.15(ey i)-.1 H 2.774(se).15 G .274 -(xtracted as normally during)-2.924 F F4(zfs-fido2-load-key)2.774 E F0 -.274(\(8\), then a credential)B 1.604(is made as-if during)108 194.4 R -F4(zfs-fido2-change-key)4.104 E F0 1.604(\(8\) \(e)B 1.604 -(xcept the "primary" de)-.15 F 1.603(vice and all the ones)-.25 F .185 -(holding backups are e)108 206.4 R .185(xcluded from the search\); ho) --.15 F(we)-.25 E -.15(ve)-.25 G .985 -.4(r, t).15 H(he).4 E F4 -(hmac-secret)2.685 E F0 .185(is instead used as a sym-)2.685 F 1.555 -(metric AES-256-GCM \()108 218.4 R F4(EVP_CIPHER-AES)A F0 1.555 -(\(7ssl\)\) k)B 1.855 -.15(ey t)-.1 H 4.055(oe).15 G 1.555 -(ncrypt the wrapping k)-4.055 F 1.855 -.15(ey d)-.1 H 1.555 -(irectly with a).15 F(random IV)108 230.4 Q(.)-1.29 E(This turns the)108 -247.2 Q F4(xyz.nabijaczleweli:tzpfms.key)2.5 E F0 -.25(va)2.5 G -(riable into).25 E F3(salt)108 259.2 Q F2(:)A F3(credential-ID)A F2(:)A -F3(credential-public-key)A F0([)A F2(.)A F3(backup-salt)A F2(:)A F3 -(backup-credential-ID)108 271.2 Q F2(:)A F3 -(backup-credential-public-key)A F2(:)A F3(IV)A F2(:)A F3(encrypted-key)A -F0 1.666(]...)C F4(tzpfms.key)108 288 Q F0 2.238 -(is actually a dot-separated list of de)4.738 F 2.238(vice b)-.25 F -4.738(undles. The)-.2 F 2.239(\214rst one is as-described in)4.738 F F4 -(zfs-fido2-change-key)108 300 Q F0 5.181(\(8\). Subsequent)B 2.681 -(ones also include \(identically-encoded\) IVs and en-)5.181 F -(crypted blobs.)108 312 Q F4(zfs-fido2-load-key)108 328.8 Q F0 .081 -(\(8\) shops assertions around de)B .081(vices in a de)-.25 F .082 -(vice-major order \212 depending on)-.25 F(de)108 340.8 Q -(vice numbering, a backup may be loaded e)-.25 E -.15(ve)-.25 G 2.5(ni) -.15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.)-.25 E F1 -(ENVIR)72 357.6 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 -(TZPFMS_PASSPHRASE_HELPER)108 369.6 Q F0 .046(By def)133 381.6 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 393.6 -Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G -1.596(ill be run via)-4.096 F F4(/bin/)4.096 E F2 3.262(sh \255c)B F0 -(to)4.096 E(pro)133 405.6 Q(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 422.4 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 434.4 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 446.4 Q F0 -(Pre-formatted noun phrase with all the information belo)160 446.4 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 458.4 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 458.4 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 470.4 Q F0("ne)160 -470.4 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 482.4 Q F0("ag)160 482.4 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 499.2 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -511.2 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 528 R(En)87 540 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 552 Q F0 -(If set, enables lib\214do2 deb)173 552 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 568.8 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 580.8 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 592.8 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 609.6 R F0 -(The lib\214do2 documentation at https://de)108 621.6 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 638.4 R -F0 1.6 -.8(To a)108 650.4 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 662.4 Q F0(ThePhD)7.5 E F1<83> -128 674.4 Q F0(Embark Studios)7.5 E F1<83>128 686.4 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 698.4 Q F0(EvModder)7.5 E F1(REPOR)72 715.2 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 727.2 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 744 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 756 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 2 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 -SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) --2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) --2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 -124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF -(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 -2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 -(,)A F2(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) --.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 -(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.244 E F0 -.1(wa) -3.244 G 3.244(sp).1 G(re)-3.244 E .743(viously encrypted with)-.25 F F2 -(fzifdso)3.243 E F0 .743(and the)3.243 F F1(FIDO2)3.243 E F0 .743 -(back-end w)3.243 F .743(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 -(Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 -(ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.465(xt, a ne)-.15 F 2.965(wc)-.25 G .465 -(redential of type ES256 is generated on the de)-2.965 F .464 -(vice \(with relying party ID)-.25 F F5(fzifdso)2.964 E F0(and)2.964 E -.499(name equal to the dataset name\) with the)108 264 R F5(hmac-secret) -2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 -(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 276 Q -(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ -n, the credential is asserted with a 32-byte random salt, which hashes \ -it with de)108 292.8 R(vice-pri)-.25 E -.25(va)-.25 G .962(te data,).25 -F .137(and thus generates the wrapping k)108 304.8 R .438 -.15(ey \()-.1 -H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) -2.638 E F0 2.638(\)\). This)B .138(mimicks a)2.638 F -.8(We)108 316.8 S -(bAuthn login step.).8 E(The follo)108 333.6 Q -(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -345.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> -128 357.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 -(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 369.6 Q F0 -([)A F2(.)A F0 1.666(...)1.666 G 1.666(]...)-1.666 G F5(tzpfms.backend) -108 386.4 Q F0 2.708(identi\214es this dataset for w)5.208 F 2.707 -(ork with)-.1 F F1(FIDO2)5.207 E F0(-back-ended)A F2(tzpfms)5.207 E F0 -2.707(tools \(i.e.)5.207 F F2(fzifdso)108 398.4 Q F5 -(zfs-fido2-change-key)60.227 E F0(\(8\),)A F5(zfs-fido2-load-key)56.728 -E F0(\(8\),)A F5(zfs-fido2-add-backup)108 410.4 Q F0(\(8\), and)A F5 -(zfs-fido2-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 427.2 Q F0 -.486(is a colon-separated tuple of unpadded URL-safe base64 blobs; the \ -\214rst one is the ran-)2.986 F .217(dom salt; the second represents th\ -e ID of created credential, and the third \211 its public k)108 439.2 R --.15(ey)-.1 G 5.217(.T)-.5 G .217(here e)-5.217 F(xists)-.15 E -(no other user)108 451.2 Q -(-land tool for deciphering this; perhaps there should be.)-.2 E -(Finally)108 468 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 -G 9.506(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 -(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 480 Q -F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F -(to clean up the properties, or to issue a note for manual interv)108 -492 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 508.8 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.555 E F0 -6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 520.8 R .729 -(ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 532.8 Q F2(zfs-fido2-clear-key)5.147 E F3(dataset)8.647 E -F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F -10.312 E F5(keyformat=passphrase)108 544.8 Q F3(dataset)6 E F0 -(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-fido2-clear-key)108 561.6 Q F3(dataset)7.606 E F0 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 573.6 Q F1(OPTIONS)72 590.4 Q F2109.666 602.4 Q -F3(backup-file)6 E F0(Sa)203 602.4 Q .353 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 614.4 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 626.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 638.4 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F1(ENVIR)72 655.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 -E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q F0 .046(By def)133 679.2 R -.045(ault, passphrases are prompted for and read in on the standard out\ -put and input streams.)-.1 F(If)5.045 E F5(TZPFMS_PASSPHRASE_HELPER)133 -691.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw) --4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.096 E F2 3.262 -(sh \255c)B F0(to)4.096 E(pro)133 703.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 720 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 -(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E(fzifdso 0)72 817.889 Q -(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 2 3 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 124.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(FIDO2 back-end con\214guration)72 153.6 R(En)87 165.6 Q(vir)-.4 E -.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 177.6 Q F0 -(If set, enables lib\214do2 deb)173 177.6 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 194.4 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 206.4 R -.727(vice which supports the)-.25 F F1(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 218.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 235.2 R F0 -(The lib\214do2 documentation at https://de)108 247.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 264 R -F0 1.6 -.8(To a)108 276 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F2<83>128 288 Q F0(ThePhD)7.5 E F2<83>128 -300 Q F0(Embark Studios)7.5 E F2<83>128 312 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F2<83>128 324 Q F0(EvModder)7.5 E F2(REPOR)72 340.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 352.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 369.6 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 381.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(2)183.837 E 0 Cg EP -%%Page: 1 4 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 -F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.588 G -.25(ew)-3.587 G -1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G -(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 -108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(FIDO2)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 -201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 -(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) -14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 -213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-fido2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(ENVIR)72 247.2 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .045 -(By def)133 271.2 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.596(is set and nonempty)4.096 -F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 295.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 312 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 324 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 336 Q F0 -(Pre-formatted noun phrase with all the information belo)160 336 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 348 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 348 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 360 Q F0("ne)160 360 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F4($4)143 372 Q F0("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 388.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -400.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 417.6 R(En)87 429.6 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 441.6 Q F0 -(If set, enables lib\214do2 deb)173 441.6 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 458.4 Q .625 -(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 470.4 R -.726(vice which supports the)-.25 F F4(hmac-secret)3.227 E F0 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion is shopped around to e)108 482.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 499.2 R F0 -(The lib\214do2 documentation at https://de)108 511.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 528 R -F0 1.6 -.8(To a)108 540 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F1<83>128 552 Q F0(ThePhD)7.5 E F1<83>128 -564 Q F0(Embark Studios)7.5 E F1<83>128 576 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F1<83>128 588 Q F0(EvModder)7.5 E F1(REPOR)72 604.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 616.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 633.6 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 645.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 5 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) --.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F -(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 -/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G -(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.141(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.641 E F0 -.1 -(wa)3.641 G 3.641(se).1 G 1.141(ncrypted with)-3.641 F F2(tzpfms)3.641 E -F0(back)3.641 E(end)-.1 E F1(FIDO2)3.641 E F0 3.641(,a)C 1.142 -(sserts the preserv)-3.641 F 1.142(ed chal-)-.15 F(lenge, HMA)108 165.6 -Q(Cking the salt with the on-de)-.4 E -(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) -.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF -(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) -.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 -(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G -3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 223.2 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .045(By def) -133 264 R .045(ault, passphrases are prompted for and read in on the st\ -andard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.596(is set and nonempty)4.096 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 288 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 304.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 340.8 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 352.8 Q F0("ne)160 -352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 381.6 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666(SPECIAL THANKS) -72 410.4 R F0 1.6 -.8(To a)108 422.4 T(ll who support further de).8 E --.15(ve)-.25 G(lopment, in particular:).15 E F1<83>128 434.4 Q F0 -(ThePhD)7.5 E F1<83>128 446.4 Q F0(Embark Studios)7.5 E F1<83>128 458.4 -Q F0(Jasper Bekk)7.5 E(ers)-.1 E F1<83>128 470.4 Q F0(EvModder)7.5 E F1 -(REPOR)72 487.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 -499.2 Q(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 516 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 528 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 6 -%%BeginPageSetup -BP -%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([) -2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E -/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A -F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 +/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 @@ -683,28 +326,26 @@ listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R -18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 +(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666 -(zfs-fido2-add-backup \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 -(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) -108 583.2 Q F2 1.666(zfs-fido2-add-backup \255b)6 F F1(TPM2)6 E F4 72 -(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 -(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-fido2-add-backup \255ra)6 F F3(tarta-zoot)6 E F4 72 -(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 -(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 -(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 -(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) -108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 -(zfs-fido2-add-backup \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 +24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 +559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 +F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F +6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) +108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R +18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 +(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) +54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q +F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) -108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-21-g2118cc3)72 817.889 +108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E(1)183.842 E 0 Cg EP -%%Page: 2 7 +%%Page: 2 2 %%BeginPageSetup BP %%EndPageSetup @@ -719,9 +360,9 @@ BP E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-21-g2118cc3)72 817.889 Q(December 4, 2022)83.583 E +-.25 E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E (2)183.842 E 0 Cg EP -%%Page: 1 8 +%%Page: 1 3 %%BeginPageSetup BP %%EndPageSetup @@ -730,193 +371,192 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 -E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.867 -.8(To n)108 153.6 -T 1.267(ormalise the).8 F F3(dataset)3.767 E F0(,)A F2 -(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.177 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 +(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T +5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 +E F0 5.266(will open its encryption root in its stead.)7.766 F F2 +(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E +(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) +-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 +(data will be silently cleared.)108 211.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 +(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q +.294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 -(\), and sealed)B .585(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 264 R .886 -.15(ey w)-.1 H .586 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q +(\), and sealed)B .586(on the TPM; the user is prompted for an optional\ + passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 333.6 Q F0 .292(identi\214es this dataset for w)2.792 F .291 -(ork with)-.1 F F1(TPM1.X)2.791 E F0(-back-ended)A F2(tzpfms)2.791 E F0 -.291(tools \(namely)2.791 F F5(zfs-tpm1x-change-key)108 345.6 Q F0 +108 321.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 +(ork with)-.1 F F1(TPM1.X)2.792 E F0(-back-ended)A F2(tzpfms)2.792 E F0 +.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 333.6 Q F0 (\(8\),)A F5(zfs-tpm1x-load-key)2.5 E F0(\(8\), and)A F5 -(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q F0 -1.412(is a colon-separated pair of he)3.912 F 1.412 -(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .868 -(\214rst one represents the RSA k)108 374.4 R 1.168 -.15(ey p)-.1 H .867 +(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 350.4 Q F0 +1.412(is a colon-separated pair of he)3.913 F 1.412 +(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 +(\214rst one represents the RSA k)108 362.4 R 1.167 -.15(ey p)-.1 H .868 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 386.4 Q 1.413(vided, or the SHA1 constant)-.15 F F5 -(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.914 E F0 3.914(;t)C 1.414 -(he sec-)-3.914 F .379 -(ond represents the sealed object containing the wrapping k)108 398.4 R +.15 F(pro)108 374.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 +(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 +(he sec-)-3.913 F .379 +(ond represents the sealed object containing the wrapping k)108 386.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.72(.T)C 1.72 -(here e)-6.72 F 1.721(xists no other user)-.15 F 1.721(-land tool for) --.2 F(decrypting this; perhaps there should be.)108 422.4 Q(Finally)108 -439.2 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506 -(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 -(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 451.2 -Q F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 398.4 Q F0 6.721(.T)C +1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 +(-land tool for)-.2 F(decrypting this; perhaps there should be.)108 +410.4 Q(Finally)108 427.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F +-.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F +17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 +(keyformat=raw)108 439.2 Q F3(dataset)6.107 E F0 .107 +(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 +(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 +(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -463.2 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 480 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.555 E F0 -6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 492 R .729 +451.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 468 +S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 +6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 +(command succeeds, all is well, b)108 480 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.147 E F3(dataset)8.647 E -F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F -10.312 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 +-.2 F(with)108 492 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E +F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F +10.313 E F5(keyformat=passphrase)108 504 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.606 E F0 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q -F3(backup-file)6 E F0(Sa)203 573.6 Q .353 -.15(ve a b)-.2 H .052 +F2(zfs-tpm1x-clear-key)108 520.8 Q F3(dataset)7.607 E F0 1.607 +(can be used to clear the properties and go back to using a)4.107 F +(passphrase.)108 532.8 Q F1(OPTIONS)72 549.6 Q F2109.666 561.6 Q +F3(backup-file)6 E F0(Sa)203 561.6 Q .352 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 585.6 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .639(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H +E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 +F .694(This back-up)203 573.6 R F4(must)3.194 E F0 .694 +(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 585.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 597.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 614.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .638(Bind the k)203 614.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 -3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .638 -(hange, the wrap-)-3.139 F .462(ping k)203 638.4 R .762 -.15(ey w)-.1 H -.462(ill not be able to be unsealed.).15 F .463 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) +3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 +(hange, the wrap-)-3.139 F .463(ping k)203 626.4 R .763 -.15(ey w)-.1 H +.463(ill not be able to be unsealed.).15 F .462 +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 638.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q -F0 .046(By def)133 691.2 R .045(ault, passphrases are prompted for and \ -read in on the standard output and input streams.)-.1 F(If)5.045 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.595(is set and nonempty)4.095 +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 655.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q +F0 .045(By def)133 679.2 R .045(ault, passphrases are prompted for and \ +read in on the standard output and input streams.)-.1 F(If)5.046 E F5 +(TZPFMS_PASSPHRASE_HELPER)133 691.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 715.2 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 703.2 Q (vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 732 R +(The standard output stream of the helper is tied to an anon)133 720 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-21-g2118cc3)72 +133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 +(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(February 28, 2024)83.578 E(1)183.837 E 0 Cg EP -%%Page: 2 9 +%%Page: 2 4 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 36.913(ZFS-TPM1X-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 34.412(anual ZFS-TPM1X-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q +-2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 136.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +-2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 124.8 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B +(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 -177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.73 E F0 .23 -(suite connects to a local)2.73 F F1(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F1(localhost:30003)2.729 E F0 2.729(\)b)C 2.729 -(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 F(the)2.729 E(en)108 201.6 -Q(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .11(The T)108 218.4 R(rouSerS) --.35 E F1(tcsd)2.61 E F0 .11(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E -F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 -E F1(/dev/tpm)2.611 E F0 2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1 -(py)108 230.4 S(ing one of the earlier ones with, for e).1 E +1.666(TPM1.X back-end con\214guration)72 153.6 R .625(TPM selection)87 +165.6 R F0(The)108 177.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 +.229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 189.6 Q +(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 206.4 R(rouSerS) +-.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +218.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 247.2 R F0(The T)108 259.2 Q +(See also)87 235.2 R F0(The T)108 247.2 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 -(The TPM 1.2 main speci\214cation inde)108 276 R 6.915(xa)-.15 G 6.915 +(The TPM 1.2 main speci\214cation inde)108 264 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 288 Q F2 1.666 -(SPECIAL THANKS)72 304.8 R F0 1.6 -.8(To a)108 316.8 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 276 Q F2 1.666 +(SPECIAL THANKS)72 292.8 R F0 1.6 -.8(To a)108 304.8 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 328.8 Q F0(ThePhD)7.5 E F2<83>128 340.8 Q F0 -(Embark Studios)7.5 E F2<83>128 352.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E -(https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E F2 1.666(SEE ALSO)72 439.2 R F0 -(PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E +.15 E F2<83>128 316.8 Q F0(ThePhD)7.5 E F2<83>128 328.8 Q F0 +(Embark Studios)7.5 E F2<83>128 340.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F2<83>128 352.8 Q F0(EvModder)7.5 E F2(REPOR)72 369.6 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 381.6 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 398.4 Q +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +(https://lists.sr)108 410.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E F2 1.666(SEE ALSO)72 427.2 R F0 +(PCR allocations: https://wiki.archlinux.or)108 439.2 Q(g/title/T)-.18 E (rusted_Platform_Module#Accessing_PCR_re)-.35 E(gisters)-.15 E -(and https://trustedcomputinggroup.or)108 463.2 Q +(and https://trustedcomputinggroup.or)108 451.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ -r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q -(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-21-g2118cc3)72 817.889 Q +r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 463.2 Q +(able)-.8 E(1.)108 475.2 Q(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q (February 28, 2024)83.578 E(2)183.837 E 0 Cg EP -%%Page: 1 10 +%%Page: 1 5 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 45.793(ZFS-TPM1X-CLEAR-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 43.292(anual ZFS-TPM1X-CLEAR-KEY\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.008 G -.25(ew)-3.008 G +(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(TPM1.X)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q +(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G +(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM1.X) +2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F -.25(va) +-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E +/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 +(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm1x-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1 1.666 (TPM1.X back-end con\214guration)72 247.2 R .625(TPM selection)87 259.2 -R F0(The)108 271.2 Q F2(tzpfms)2.729 E F0 .229 -(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 283.2 Q -(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 300 R(rouSerS) --.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -312 S(ing one of the earlier ones with, for e).1 E +R F0(The)108 271.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 300 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 312 S +(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 328.8 R F0(The T)108 340.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -931,11 +571,11 @@ F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F1<83>128 446.4 Q F0(EvModder)7.5 E F1(REPOR)72 463.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-21-g2118cc3)72 817.889 Q(December 4, 2022)83.583 E(1) +E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E(1) 183.842 E 0 Cg EP -%%Page: 1 11 +%%Page: 1 6 %%BeginPageSetup BP %%EndPageSetup @@ -944,15 +584,15 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 -(wa)2.69 G 2.69(se).1 G .19(ncrypted with)-2.69 F F2(tzpfms)2.69 E F0 -(back)2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .191(will unseal the k)2.69 F -.491 -.15(ey a)-.1 H .191(nd load).15 F(it into)108 165.6 Q F3(dataset) -2.5 E F0(.)A .236 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .191 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1(wa)2.691 +G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E F0(back) +2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 F .49 +-.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset)2.5 E +F0(.)A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) -108 182.4 R .236(wnership, if not "well-kno)-.25 F .235(wn" \(all)-.25 F +108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) 108 194.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E (as set.)-.1 E(See)108 211.2 Q/F4 10/Courier@0 SF(zfs-tpm1x-change-key) @@ -960,14 +600,14 @@ Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 109.666 240 Q F0 3.208(Do a no-op/dry run, can be used e)131 240 R -.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) -8.208 E -.25(va)-.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 +8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 252 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 268.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 -280.8 Q F0 .046(By def)133 292.8 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.045 -E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.595(is set and nonempty) -4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F -F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q +280.8 Q F0 .045(By def)133 292.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.046 +E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.596(is set and nonempty) +4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 333.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -980,23 +620,23 @@ F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q 381.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F0("ag)160 393.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 410.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 410.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 422.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 439.2 R .625(TPM selection)87 451.2 -R F0(The)108 463.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 492 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 504 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 463.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 475.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 492 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +504 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 520.8 R F0(The T)108 532.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1011,11 +651,11 @@ F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 638.4 Q F0(EvModder)7.5 E F1(REPOR)72 655.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-21-g2118cc3)72 817.889 Q(December 4, 2022)83.583 E(1) +E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E(1) 183.842 E 0 Cg EP -%%Page: 1 12 +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup @@ -1024,112 +664,112 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 -1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A -F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A -F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.32 -.8(To n)108 -165.6 T(ormalise).8 E F3(dataset)5.22 E F0(,)A F2(zfs-fido2-add-backup) -5.22 E F0 2.719(will open its encryption root in its stead.)5.22 F F2 -(zfs-fido2-add-backup)108 177.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E -F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.055 E F0 -.1 -(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555(viously encrypted with)-.25 F -F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .554 -(back-end w)3.054 F .554(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 -235.2 S 3.059(yw)-.05 G .559(ill be freed from the TPM.)-3.059 F .56 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 +(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) +A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) +A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.676 -.8(To n)108 165.6 +T(ormalise).8 E F3(dataset)2.576 E F0(,)A F2(zfs-tpm-list)2.576 E F0 +.076(will open its encryption root in its stead.)2.576 F F2 +(zfs-tpm-list)5.077 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 +E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G +(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 +(\(8\) for that.)A(First, a connection is made to the TPM, which)108 +194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 +(dataset)3.055 E F0 -.1(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555 +(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F +F1(TPM2)3.055 E F0 .554(back-end w)3.054 F .554(as used, the pre)-.1 F +(vious)-.25 E -.1(ke)108 223.2 S 3.059(yw)-.05 G .559 +(ill be freed from the TPM.)-3.059 F .56 (Otherwise, or in case of an error)5.56 F 3.06(,d)-.4 G .56 (ata required for manual interv)-3.06 F(en-)-.15 E -(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 -264 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 +252 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 (OPTIONS)2.794 E F0 .294(\), and sealed)B .588 -(to a persistent object on the TPM under the o)108 276 R .589 +(to a persistent object on the TPM under the o)108 264 R .589 (wner hierarch)-.25 F .589(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 288 Q 1.603 -.65(y, t)-.05 H .302 +F(wner)-.25 E(hierarch)108 276 Q 1.603 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 300 Q(The follo)108 316.8 Q +(the sealed object with.)108 288 Q(The follo)108 304.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 1.263 +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 1.263 (identi\214es this dataset for w)3.763 F 1.264(ork with)-.1 F F1(TPM2) 3.764 E F0(-back-ended)A F2(tzpfms)3.764 E F0 1.264(tools \(namely)3.764 -F F5(zfs-tpm2-change-key)108 381.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) +F F5(zfs-tpm2-change-key)108 369.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) 2.5 E F0(\(8\), and)A F5(zfs-tpm2-clear-key)2.5 E F0(\(8\)\).)A F5 -(tzpfms.key)108 398.4 Q F0 1.509(is an inte)4.009 F 1.509 +(tzpfms.key)108 386.4 Q F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 (wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 -410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +398.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 (tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B -.866(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +.866(be passed to)108 410.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) 3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) -C(r)-3.365 E F2109.666 434.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +C(r)-3.365 E F2109.666 422.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) -.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A -.448(If you ha)108 446.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F +.448(If you ha)108 434.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) -.25 G .447(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.005 +(will funxion seamlessly)108 446.4 Q(.)-.65 E(Finally)108 463.2 Q 12.005 (,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 -E F217.172 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.107 E F0 +E F217.172 E F5(keyformat=raw)108 475.2 Q F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 499.2 R .29(ention into the stan-)-.15 F(dard error stream.) -108 511.2 Q 2.625<418c>108 528 S .125(nal v)-2.625 F .125 + interv)108 487.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 499.2 Q 2.625<418c>108 516 S .125(nal v)-2.625 F .125 (eri\214cation should be made by running)-.15 F F2 1.79 (zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 (ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) -108 540 R .506(ut otherwise the dataset can be manually rolled back to \ -a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) +108 528 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 540 Q F3(dataset) 11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.204 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 +F13.204 E F5(keyformat=passphrase)108 552 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 +F2(zfs-tpm2-clear-key)108 568.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 -621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .353 -.15(ve a b)-.2 H .052 +F(ing a passphrase.)108 580.8 Q F1(OPTIONS)72 597.6 Q F2109.666 +609.6 Q F3(backup-file)6 E F0(Sa)203 609.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 633.6 R F4(must)3.193 E F0 .694 +F .693(This back-up)203 621.6 R F4(must)3.193 E F0 .694 (be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +(nt,).15 E(the k)203 633.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 645.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 662.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.425(Bind the k)203 686.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +-1.666 G 1.425(Bind the k)203 674.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C -1.424(ithin their corresponding)-3.924 F(hashing)203 698.4 Q F3 +1.424(ithin their corresponding)-3.924 F(hashing)203 686.4 Q F3 (algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.024(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 698.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G +A F3(algorithm)203 715.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) .15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") -203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +203 727.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A -F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 739.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 -(", and must be supported by the TPM.)A(tzpfms 0.3.4-21-g2118cc3)72 +(", and must be supported by the TPM.)A(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(February 28, 2024)83.578 E(1)183.837 E 0 Cg EP -%%Page: 2 13 +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup @@ -1205,9 +845,9 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (and https://trustedcomputinggroup.or)108 657.6 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q -(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-21-g2118cc3)72 817.889 Q +(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q (February 28, 2024)83.578 E(2)183.837 E 0 Cg EP -%%Page: 1 14 +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup @@ -1217,8 +857,8 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 -E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 +(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with)-2.5 E F2 (tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM2)2.5 E F0(:)A 5 (1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641 @@ -1286,9 +926,9 @@ F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-21-g2118cc3)72 817.889 Q(December 4, 2022)83.583 E +-.25 E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E (1)183.842 E 0 Cg EP -%%Page: 1 15 +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -1297,23 +937,23 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .864(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1 -(wa)3.364 G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E -F0(back)3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865 -(nseals the k)-3.365 F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F -(into)108 165.6 Q F3(dataset)2.5 E F0(.)A(The user is prompted for the \ -additional passphrase, set when creating the k)108 182.4 Q -.15(ey)-.1 G -2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 -10/Courier@0 SF(zfs-tpm2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2109.666 -228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 -G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i) --.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va) --.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s) -C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .864 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1(wa)3.364 +G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E F0(back) +3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865(nseals the k)-3.365 +F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F(into)108 165.6 Q F3 +(dataset)2.5 E F0(.)A(The user is prompted for the additional passphras\ +e, set when creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5 +(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF +(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 +(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 +(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 +G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) +.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 +(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 +4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F +(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 (By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ on the standard output and input streams.)-.1 F(If)5.046 E F4 (TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 @@ -1364,7 +1004,7 @@ F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-21-g2118cc3)72 817.889 Q(December 4, 2022)83.583 E(1) +E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E(1) 183.842 E 0 Cg EP %%Trailer end diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 deleted file mode 100644 index 08a80cb..0000000 --- a/zfs-fido2-add-backup.8 +++ /dev/null @@ -1,125 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-ADD-BACKUP 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-add-backup -.Nd allow another FIDO2 device to unlock ZFS dataset -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After -.Xr zfs-fido2-change-key 8 -derives the key for a dataset from a FIDO2 device, -.Nm -may be executed to extend this to any number of additional devices. -.Pp -First, the wrapping key is extracted as normally during -.Xr zfs-fido2-load-key 8 , -then a credential is made as-if during -.Xr zfs-fido2-change-key 8 -(except the "primary" device and all the ones holding backups are excluded from the search); -however, the -.Ql hmac-secret -is instead used as a symmetric AES-256-GCM -.Pq Xr EVP_CIPHER-AES 7ssl -key to encrypt the wrapping key directly with a random IV. -.Pp -This turns the -.Li xyz.nabijaczleweli:tzpfms.key -variable into -.br -.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … -.Pp -.Li tzpfms.key -is actually a dot-separated list of device bundles. -The first one is as-described in -.Xr zfs-fido2-change-key 8 . -Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -.Pp -.Xr zfs-fido2-load-key 8 -shops assertions around devices in a device-major order \(em -depending on device numbering, a backup may be loaded even if the primary device is present. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html deleted file mode 100644 index e6d3444..0000000 --- a/zfs-fido2-add-backup.8.html +++ /dev/null @@ -1,153 +0,0 @@ - - - - - - - - ZFS-FIDO2-ADD-BACKUP(8) - - - - - - - - -
ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
-

-
-

-

zfs-fido2-add-backup — - allow another FIDO2 device to unlock ZFS dataset

-
-
-

- - - - - -
zfs-fido2-add-backupdataset
-
-
-

-

After - zfs-fido2-change-key(8) - derives the key for a dataset from a FIDO2 device, - zfs-fido2-add-backup may be executed to extend this - to any number of additional devices.

-

First, the wrapping key is extracted as normally during - zfs-fido2-load-key(8), - then a credential is made as-if during - zfs-fido2-change-key(8) - (except the "primary" device and all the ones holding backups are - excluded from the search); however, the - ‘hmac-secret’ is instead used as a - symmetric AES-256-GCM - (EVP_CIPHER-AES(7ssl)) - key to encrypt the wrapping key directly with a random IV.

-

This turns the - xyz.nabijaczleweli:tzpfms.key variable into -
- salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…

-

tzpfms.key is actually a dot-separated - list of device bundles. The first one is as-described in - zfs-fido2-change-key(8). - Subsequent ones also include (identically-encoded) IVs and encrypted - blobs.

-

zfs-fido2-load-key(8) - shops assertions around devices in a device-major order — depending - on device numbering, a backup may be loaded even if the primary device is - present.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 deleted file mode 100644 index 6bd3f57..0000000 --- a/zfs-fido2-change-key.8 +++ /dev/null @@ -1,186 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CHANGE-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-change-key -.Nd change ZFS dataset key to one authenticated by a FIDO2 device -.Sh SYNOPSIS -.Nm -.Op Fl b Ar backup-file -.Ar dataset -. -.Sh DESCRIPTION -To normalise the -.Ar dataset , -.Nm -will open its encryption root in its stead. -.Nm -will -.Em never -create or destroy encryption roots; use -.Xr zfs-change-key 8 -for that. -.Pp -First, a connection is made to the FIDO2 device, which -.Em must -support the -.Ql hmac-secret -extension. -.Pp -If -.Ar dataset -was previously encrypted with -.Nm fzifdso -and the -.Sy FIDO2 -back-end was used, the metadata will be silently cleared. -Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. -.Pp -Next, a new credential of type ES256 is generated on the device (with relying party ID -.Li fzifdso -and name equal to the dataset name) -with the -.Ql hmac-secret -extension requested; the device PIN, if any, is prompted for here. -This mimicks a WebAuthn registration step. -.Pp -Then, the credential is asserted with a 32-byte random salt, -which hashes it with device-private data, and thus generates the wrapping key -.Pq which is optionally backed up Pq see Sx OPTIONS . -This mimicks a WebAuthn login step. -.Pp -The following properties are set on -.Ar dataset : -.Bl -bullet -compact -offset 4n -width "@" -.It -.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 -.It -.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … -.El -.Pp -.Li tzpfms.backend -identifies this dataset for work with -.Sy FIDO2 Ns -back-ended -.Nm tzpfms -tools -.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . -.Pp -.Li tzpfms.key -is a colon-separated tuple of unpadded URL-safe base64 blobs; -the first one is the random salt; -the second represents the ID of created credential, -and the third \(en its public key. -There exists no other user-land tool for deciphering this; perhaps there should be. -.\"" TODO: make an LD_PRELOADable for extracting the key maybe? -.Pp -Finally, the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset -is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. -.Pp -A final verification should be made by running -.Nm zfs-fido2-load-key Fl n Ar dataset . -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a passphrase with -.Nm zfs-fido2-clear-key Ar dataset -.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , -and you are hereby asked to report a bug, please. -.Pp -.Nm zfs-fido2-clear-key Ar dataset -can be used to clear the properties and go back to using a passphrase. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl b Ar backup-file" -.It Fl b Ar backup-file -Save a back-up of the key to -.Ar backup-file , -which must not exist beforehand. -This back-up -.Em must -be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running -.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html deleted file mode 100644 index 68ea232..0000000 --- a/zfs-fido2-change-key.8.html +++ /dev/null @@ -1,206 +0,0 @@ - - - - - - - - ZFS-FIDO2-CHANGE-KEY(8) - - - - - - - - -
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
-
-
-

-

zfs-fido2-change-key — - change ZFS dataset key to one authenticated by a FIDO2 - device

-
-
-

- - - - - -
zfs-fido2-change-key[-b backup-file] - dataset
-
-
-

-

To normalise the dataset, - zfs-fido2-change-key will open its encryption root - in its stead. zfs-fido2-change-key will - - create or destroy encryption roots; use - zfs-change-key(8) - for that.

-

First, a connection is made to the FIDO2 device, which - must support the - ‘hmac-secret’ extension.

-

If dataset was previously encrypted with - fzifdso and the FIDO2 back-end was - used, the metadata will be silently cleared. Otherwise, or in case of an - error, data required for manual intervention will be written to the standard - error stream.

-

Next, a new credential of type ES256 is generated on the device - (with relying party ID fzifdso and name equal to the - dataset name) with the ‘hmac-secret’ - extension requested; the device PIN, if any, is prompted for here. This - mimicks a WebAuthn registration step.

-

Then, the credential is asserted with a 32-byte random salt, which - hashes it with device-private data, and thus generates the wrapping key - (which is optionally backed up (see - OPTIONS)). This mimicks a WebAuthn login - step.

-

The following properties are set on - dataset:

- -

tzpfms.backend identifies this dataset for - work with FIDO2-back-ended tzpfms - tools (i.e. fzifdso - zfs-fido2-change-key(8), - zfs-fido2-load-key(8), - zfs-fido2-add-backup(8), - and - zfs-fido2-clear-key(8)).

-

tzpfms.key is a colon-separated tuple of - unpadded URL-safe base64 blobs; the first one is the random salt; the second - represents the ID of created credential, and the third – its public - key. There exists no other user-land tool for deciphering this; perhaps - there should be.

-

Finally, the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=raw dataset is - performed with the new key. If an error occurred, best effort is made to - clean up the properties, or to issue a note for manual intervention into the - standard error stream.

-

A final verification should be made by running - zfs-fido2-load-key -n - dataset. If that command succeeds, all is well, but - otherwise the dataset can be manually rolled back to a passphrase with - zfs-fido2-clear-key dataset - (or, if that fails to work, zfs - change-key -o - keyformat=passphrase dataset), - and you are hereby asked to report a bug, please.

-

zfs-fido2-clear-key - dataset can be used to clear the properties and go - back to using a passphrase.

-
-
-

-
-
- backup-file
-
Save a back-up of the key to backup-file, which must - not exist beforehand. This back-up must be stored - securely, off-site. In case of a catastrophic event, the key can be loaded - by running -
zfs - load-key dataset - < - backup-file
-
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 deleted file mode 100644 index dd2a76c..0000000 --- a/zfs-fido2-clear-key.8 +++ /dev/null @@ -1,113 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CLEAR-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-clear-key -.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 : -.Bl -enum -compact -offset 2n -width 2n -.It -performs the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , -.It -removes the -.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key -properties from -.Ar dataset . -.El -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html deleted file mode 100644 index 46e553e..0000000 --- a/zfs-fido2-clear-key.8.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - - - - - ZFS-FIDO2-CLEAR-KEY(8) - - - - - - - - -
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
-
-
-

-

zfs-fido2-clear-key — - rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 - metadata

-
-
-

- - - - - -
zfs-fido2-clear-keydataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - :

-
    -
  1. performs the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=passphrase - dataset,
  2. -
  3. removes the - xyz.nabijaczleweli:tzpfms.{backend, - key} properties from - dataset.
  4. -
-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 deleted file mode 100644 index 247ca04..0000000 --- a/zfs-fido2-load-key.8 +++ /dev/null @@ -1,98 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-LOAD-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-load-key -.Nd load FIDO2-encrypted ZFS dataset key -.Sh SYNOPSIS -.Nm -.Op Fl n -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 , -asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into -.Ar dataset . -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl n" -.It Fl n -Do a no-op/dry run, can be used even if the key is already loaded. -Equivalent to -.Nm zfs Cm load-key Ns 's -.Fl n -option. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html deleted file mode 100644 index ffc6446..0000000 --- a/zfs-fido2-load-key.8.html +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - - ZFS-FIDO2-LOAD-KEY(8) - - - - - - - - -
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
-
-
-

-

zfs-fido2-load-key — - load FIDO2-encrypted ZFS dataset key

-
-
-

- - - - - -
zfs-fido2-load-key[-n] dataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - , - asserts the preserved challenge, HMACking the salt with the on-device - secret, and loads the resulting key into dataset.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
Do a no-op/dry run, can be used even if the key is already loaded. - Equivalent to zfs - load-key's -n option.
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index 5ca65c5..5afcc41 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM-LIST 8 -.Os tzpfms 0.3.4-21-g2118cc3 +.Os tzpfms 0.3.4-22-g7c0393e . .Sh NAME .Nm zfs-tpm-list diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index 7b865b9..e6e0a85 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -166,7 +166,7 @@ tarta-zoot/vm - available yes - +
December 4, 2022tzpfms 0.3.4-21-g2118cc3tzpfms 0.3.4-22-g7c0393e
diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index 51b9615..cbdc272 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CHANGE-KEY 8 -.Os tzpfms 0.3.4-21-g2118cc3 +.Os tzpfms 0.3.4-22-g7c0393e . .Sh NAME .Nm zfs-tpm1x-change-key diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index 0afd3f9..b7d7382 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -219,7 +219,7 @@ - +
February 28, 2024tzpfms 0.3.4-21-g2118cc3tzpfms 0.3.4-22-g7c0393e
diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index f798b78..7a6d437 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CLEAR-KEY 8 -.Os tzpfms 0.3.4-21-g2118cc3 +.Os tzpfms 0.3.4-22-g7c0393e . .Sh NAME .Nm zfs-tpm1x-clear-key diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index b44a70f..712e75a 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -103,7 +103,7 @@ - +
December 4, 2022tzpfms 0.3.4-21-g2118cc3tzpfms 0.3.4-22-g7c0393e
diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index e0684c2..187662d 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-LOAD-KEY 8 -.Os tzpfms 0.3.4-21-g2118cc3 +.Os tzpfms 0.3.4-22-g7c0393e . .Sh NAME .Nm zfs-tpm1x-load-key diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index d29ef3e..f7dba44 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -139,7 +139,7 @@ - +
December 4, 2022tzpfms 0.3.4-21-g2118cc3tzpfms 0.3.4-22-g7c0393e
diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index 86a1335..a350b23 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CHANGE-KEY 8 -.Os tzpfms 0.3.4-21-g2118cc3 +.Os tzpfms 0.3.4-22-g7c0393e . .Sh NAME .Nm zfs-tpm2-change-key diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index 8dc3a90..70254ab 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -265,7 +265,7 @@ - +
February 28, 2024tzpfms 0.3.4-21-g2118cc3tzpfms 0.3.4-22-g7c0393e
diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index 9d0a4f4..da1dceb 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-CLEAR-KEY 8 -.Os tzpfms 0.3.4-21-g2118cc3 +.Os tzpfms 0.3.4-22-g7c0393e . .Sh NAME .Nm zfs-tpm2-clear-key diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index 8f94406..5fc7340 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -154,7 +154,7 @@ - +
December 4, 2022tzpfms 0.3.4-21-g2118cc3tzpfms 0.3.4-22-g7c0393e
diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index 8132a0b..90cbd4b 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-LOAD-KEY 8 -.Os tzpfms 0.3.4-21-g2118cc3 +.Os tzpfms 0.3.4-22-g7c0393e . .Sh NAME .Nm zfs-tpm2-load-key diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index 6099899..479a0cb 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -138,7 +138,7 @@ - +
December 4, 2022tzpfms 0.3.4-21-g2118cc3tzpfms 0.3.4-22-g7c0393e