From 92867367ee787d5764fe55c1e5216d3a370b752f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Thu, 29 Feb 2024 01:10:31 +0000 Subject: [PATCH] Manpage update by job --- tzpfms.pdf | Bin 65712 -> 77232 bytes tzpfms.ps | 800 ++++++++++++++++++++++++------------ zfs-fido2-change-key.8 | 186 +++++++++ zfs-fido2-change-key.8.html | 205 +++++++++ zfs-fido2-clear-key.8 | 113 +++++ zfs-fido2-clear-key.8.html | 143 +++++++ zfs-fido2-load-key.8 | 98 +++++ zfs-fido2-load-key.8.html | 117 ++++++ 8 files changed, 1396 insertions(+), 266 deletions(-) create mode 100644 zfs-fido2-change-key.8 create mode 100644 zfs-fido2-change-key.8.html create mode 100644 zfs-fido2-clear-key.8 create mode 100644 zfs-fido2-clear-key.8.html create mode 100644 zfs-fido2-load-key.8 create mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index 0abe5ec7fde814304dcf58da21cc9a185b347662..a15e1b57975c9d4715c16055bfd2157f599baacc 100644 GIT binary patch delta 53221 zcmZVlQ*@wBxUGT4wr$(!IO*87(Xo^6@QZERwr!(hJ008R`S&?{?TfRns>XX=HOEu4 z=B)FFsM~<3g9inQwdE5xMo_!2YtzIk5K3TR0v%RwjqR#0>Ndsax5fz9WaV zRqymW4Gu@YX6#MgjC+2lGP_`TF(~*@ORsr*VL6V*dUF9nS=vIqX=}_(xxG&p4!uIX zZ&w3f8^ekYRR>c+Q!(=NEs3uVzjE+@1Hd?*Vmne?r}S)_d>U zIVL^jUc;ZD7aB8^qMgZEVD8Xq>ey~E0A1rqc37i8)f?fFuZw2MDThLM@GyRDK>|E>slj>vwy6 z&fZz#1D}0~xfTz+7wk>*@pADH==Jtl5~txs^aPxd!=lZLjxg!p9gAY{N3C^(n!SoE zTGxOQO9(N&kq{^(Mewh*e9wix^Be`qtH?S~NE_!^f#$0J&d z3;v$(*DzKjEU7Owh<-*z&7@3^fo#Bwj{g3f@ed^CQO0rQT3Fu7$aiOL$g~MX$)e7K zONEYiV?INw_uu_^lF2r-IljBGlmbxw`(9dMMkb(kYMtV*T! zy69x%Wo08m>>4RS)KN>IPNS1#282tVlL(i^d#=1K2rfV&Osm z*2*(?5WT<&94EG@rfrM%Ef}62fqyL`6;vTmLwx)97>lXap<2~6_*n|P{jvH(K5^Np zmC9E|3TJPpbM6*}(&Wz7TqeL{j}~L5b<(+6X-%ni`vqaG)#NiFMWDe?s4rL8 zo$J)LQ%z58H9G#_zYAf{}GRV85(6P$r<@?JULmFPJNYGK@EL!Zx8zHfK*!?K>c z$Hp^b9Je5Vt+9^f>u0jKK?EpYvuVT`CwUTbs`Mrh|Df?n&u5~zlKh4AGDW@Ht(&T+ zxn5REtfY&*)~xQ@el)F>Z@X^ui6vP%nQbh;f{Vt|k?Z9}LGeQrZeLS_dpCxQAh9kZ zeLHIr2Ikw=S90dfF;cMvH>yM!b@#i?7H-L^#twIMHzTD zObO6ER&j5^t7?%FOSj0D z;e8qbW7%J^GQTEWSNJj-_ML+H^kJ5sXK^sklo;KcE&WWJCk|cK4c%fVMWT}h{}a_S zrLgY=#(J4*iaU6#Mnc7cV;L zB>>bX2q&MsK#U++#3L2)=xd}Y!X5UGZH1n7ZEbQA{^f)+zsKKP9mD~YXw6MceulP! ze#LjUY(j~kYzU;^&4oE-l}7BXiiB4giz0oN#*EJ}DIJ$#YJT%LH!SQa@p%Cxr(X1k zN;QH6pbvLu>Sq()c5~Iu6I4WM&S@_kML@i$dca`d#r?*OSn!2-0^{{w~Uodd^mD0zkW) zS=KBcOApGTPoe-CK{)By$~E>3^j$0FxR?WZVPTZCf((b}tT4(}RiuPHWNQq3V#_ro zaML~X&?>uGU+83#8F6dGpn^YMbAyppv2n(QG$joAPY@Y`6{M)X9KWWx$qwE64_9!N zLJH>~?YGE1=tBdsfq8!X$6T=Ne4y1XW2<9iaz5N_V3K|9i%d>zE;z$z^>KWCr4#j9 zvY*_Z;16>NshqX7nfh-ljGtS=G3$#91;fPrR?wSwMn!u@a_z!(* zrPccN$(q0jq%9>5hb3>ir*hgsf8~sDv<6a@s}ck}P%obSDt`=VD9?jfh;&(l_oTx) zzoJt+N{Sy^^DxnFu4=JuQaLv@Y)V_)YWC`lqlGwx#=yVD_a$6TrLP<7y&~{S2NR|6 z!Y{5PpiRVo{!zX>&78WJ3~-Z^MFcIEkQ0>{iu(Hriby77{5u>v7%8B{3hTpJ2T)@B z=plXTWPWfaAe*eJA9l9RclIud=Zu&^;lA$mh~oWVQh$B$u;0s1l3hAq-C zid~1TDWtbO#^OlLS$f2Fda74jYoM<;wT9gACcKuW*EH?GG}G(h!HS=5Q79li*dx?% zBxKn8hx7gM&6}(9>+8td{r3DBo4JdQaG3(D=P!lC|Lc*u1|u+A{z`LN3eQIVarVm3Ficvy;JFibsKS``%<1sDr*# zoo<{qPc&wzYG7~Q-xRy!TxV4#Rv9W8Q@C(?P5#TD@&}+?ky>`E6&B3|y`>HEbEi+~ z_ShJhcxw>;!b|u?Ne$=7Ep5MmyU`=bKY4+Jl&>qlgi#@l>q59k9;~(aUM0xJ zoX&<^KU^4e$KKNBIyC%oas6^nyxf;@Wo~cg;_7T}YzOz>&cVbQj*Ena zGh<`@ze9e0W;t{FU#<|ABy4Pn`P>vhvWBk11{cPN!6SW`i7;hff%w^WDQ9$MvE4d@ zJFD$D%Pg8*dAxXP(tc5`*JbQBDdk#2VhcXnP?$K8?{O!=8T%cJNY2-(U}N%Oe(~cP z*^%y|j~TryTjPjk{g+8g-TE-ZFvf6sY$C>#hK6t*@vCJ^^M#P1;?~M>DRCL_ezuZ& zJwtW1F;2|w?!2FO8fg78k?zw_hHY~8uJkKK_X)CcEn)Kb2o`CMq45LaokG47@=R3d z?g1POA3e4S*+?Bt*@do>yGnG2U-z2WFun&mm4a0P#P3}4C@A+o@>?<6%-K!fOKhNR z`*{O>SY;f+U1mWa^Yfjs_9X&XK}3VUzrMHw!=y}=vlz~!JR41$ttkwB?IHi{`baVL42~PEv%)a8Tn+vK)%?wIX7jE+MTloI6Y1mij*yI}U5@f0sy>9m|7G)3 z5}KlNL1{IgzgqLW3Px~kZX{C;4|^FKHydOtJ3QBA@_0$^NsAMB;RFTj42`EKz$dO( zRUytdcnCsZ7o{Op&0h2sr~R~AXNMc2&k6r=4Z{)51!*(;_TIKdG1POlO^K=yb&@tz zkNVZ6-n6@f_b>yg>2^FXRXbLNpnCSK((D@=jbGgAum4a%(r0ksCWo)>x>qrg-FSgjc<&yMWLle8?qZip z5-7%h5l;fS6_TRkH0ma@UKF+aQ=P}Y z7!1m1j}u6~P-Itt#;_uQqsJ8d9`xscMWTZ*O+b%JpHMyQQRi4DB3hwH_ydFycGvI9 zzVZ5H0j1XN73437KnTa+3OOOHut1t+x2-Bt8XYAPWTE8PFF)^J^zn90jq>~`e-{d@ zmd}R&WD)xVvHWd~0LXR?gq%t+G1omCIuClK)9>jQW$%B4|HdB_n5k>04SU4c+xB)8 z_z=eP*L@ecA>P+hAWYup&`f_IBqO4G=!R`OTGq!~91t|84J0>uy}sDTX4Ik5*|d2J zf7+_DzV4L?fqf3YcYfp+-friDspw&qj(UwFKg(+XE>sS4O=}0mO5a}J&7UE(KBw6? z8@f3ExXPZ!%)UW~w}Qu9m|~}6_xjV?GxU7h=HWj;n(mN>bFzDd#Hf#~f~@c!gN1VB zkz-wre;4FlOZ>iGkT?LNKMi6rl1f`|vm6oXzhDrmzmSE*g>%dZ^6x%W=QZ%A#pWH_ zw_I-mjCQo2j0&}PytSD%&Qjs7enW-|+a0$jzwj(y7mG=%)V7XVUJqg%$qVV&{n2MY zMu%jkf;M1x`y36KgvRud>()ouFvjVV$1D10YT>!4fOA66^d-n?S9w`BcRl3@h~tgy zTA!_oR^w zEmlXSiDna_CNd^8Y0AX3-<8_pt{>$P8Ry&PE_M`k8|55^L zJxVY->;rS@JKX)mgg0aJWiRy5vxp1*K=mM$3rVzTGg=Q`byQ+~Zng?%44_fO@W$tB!8{Xl_X*2Y zng@r@@~klw%DCK+JdDY(2~0Mp1y#l`n`5%9KM;@7!XlRjsQ?78S31$8f8`O@rqSjr z=kDee%kOIZ;=gF&+*gB0UgC%OiMUOH z0&Rc1wz4o>nYrf8>jhN1zr_-@1WmP$ymstCb`Ybl?20!CQm$EiZjp@2N6Yt zti?zO{^gpeHXnuoKPb8>>V0gvjqNrYL!wa-iYampN{^?@p0VHW);DyZ-F4Nw?Hh6%$SjXrR2Bb3 z`w=R8w#3#iTOm~yuEm?5)#SMIi|VtbucVBgPfKwyy;Gkbz&0z!JC7s4FJL{e7w3_h z&6gxdc!0sBp4B^2c}Grys#IcyT&EF@ab||MtUGeW#8f&ICt^OQW~*<)&10jf{4gcd zG{DI9n81t+M^xwcWA!kDl`MC7p8Sa~OdSOx-9eJO*_Bwp%%8KA+i6^>Z7u2uy z#SgeNzwihdG8|poPh&5{UYDfapUUqrtsjI3Gmff@dOLyXE{isTg|0&J6)oXfCzk%K z0(PYisnQs={dCkFu?i`~JVJsNlQ2KV@?s7{t%0(G6bkfjI{H;QFm;%GLg6QLLixtW zLfe{^?;PzR*g8zl40Ud`Dk@5}WPRcByC`tqQwzzf;FF+MuodJc=UhtDQMi2j4GFg- zOLYV>`d!s6M@p**4Fb$ige_`Y5aOg&zyV`Ett!EmZE^NTO&;=1l0vHPgBJ%4s3=Yb zOj*+WDrm6iE>Z+dn>oTKmKy#}o1#gaH`hPUkLg1p`{+aT zD^-R6{KM?dLs|+3FhNo)Q?z~!GHY+KyXu-GE}aq3P?m)~^wCuDico$n$769wu6 ze5+5lwxH!kpH;N!=9K-W6a;OPiR6rl*OV{D`4M07Re=-k4oJPHZ<7DhA7Qy+)kpJ_ zea^&3r@3xpIstyh9r6g(Xa@bu7Gy&ayoa-=W`FR`ZvUkjCfXWa86Hpv2>Kgt%n=!j zX8pO<|FvDKtXs|hm`jHjje(u*l+kwQ9+K|U6rnfR;hEVp%d8KOMock7vr_3k32@1C zIEiwy+W@J?b1lqJj_>53AU(zKpP#j!tT50J@ZUht!?792t5%tHe4*2{=x&O2F|c?H zIt?deA?lA>YvRDXHoDIS`sRIoq$c2e;%E&9^l20D1;9d1ebu|lE%KmAvFx4+TXasi zm{HG=H?lns2VdkCkAmzPx~dXjq-#^5YoO>sNzr*z+*JlJ*ihF6#4$O=DzJ-UpEW!HrtWODJLz7L`g4FwiFj_m(q_W0XD70XE)Qw~ zD&V;e4I0egckuIvRZy#h6PSS?fk-<2n&*M|oaZx#JRf2R*nc-z&@xP#xcwwJBX5Fy z4WeuSA)=!isPK7pW($Yj6@cFWpthxk|ElgS7$^Vajk((@^8Iy3(lo}&jmN| za{=}cx{H`lMWc&ALDDF9N8^46Dxt;@RP%3ZZRoFYAU7xTN~5YxEbblk=;Vp2e1Z@Fv7`C9QAL1IqrNGRs5kX9u`eU3A4n#bvB z!qRgF0KREuGsxd^`6H<}Fq;Ctq*Qb}jqj+^jD$qLvajVyxHS?vW?88|lLEGjux;;5 z-gx%*rjuDzIf>trFn$zqvp4^>Tr_Rf*cK|10IcEzsL>IAN_b~l!K+RYHH=U>*)o9Z`36Ns`^oyhDe`}80X9w!p8rRYy#I?L z*;)P{MecK~8F<&%3THCHjTD%2HXJ0M{OLBl-uU+= z^SzHKtz6K&)`_v%g!SW|M>nO<-dj^~m)JSV&7#)o+PyUquqd6TuBWg1YtS1=cvh9Tv8~ zy6^jz756dbg$sxNnR9))JqBV*5C^PKOT}Lz)VWo!*k{xcakB8TmYUnD8*lT;58BL; z)E`YBuGhRGZp{)SroQ8YOsv@M6>!~Y<%2kpx=|tdlV7`?`nC zlbrhR!1i)(E%cAQ;x#FWuvF!o@U+70)p33D;aOt}4Ddr95du!$0soPIrf`r9^isn%zIN8AEtdepgG<{`?^iHh9TK99kcW zE}9jsq^%BH*q|Yn$TIfXuAq{q7Kf8$964Xq)hG@knU&VW_4g?7c=U93s^Ex$k9Oo% zZkSu94jWf?`eL7y8(@_3%GfPaymfIP87_KO!3%2!HGo^Jua%Vsfm|F%L=k6a2wBDq z)i1dSfdCm0kv$Xcv94;FTl0gH{#NJmOS(0v=(`5$#I+49n0b3ZuZg=EL^R2pJk12w6=j7%w$|2^3w4=-Au z8!Lw|?1fjEL=({SHF77>)g~mYEznSQj7jj(n|{eR?kp> zkVT=WRsj<FiFs>-f z;FeNAM3d1@1_*BG1tF}N%?NBMjkD6uG7j>3X7SK>P$ernya|RD|KfTmkBNp9NX+o! z_aUnipj)eO`;1MV#&sKv-bp-*peb$-!)qoV|i{K&sfG#qZ>#&G(8d~$T zp>zO~_VZ6N|M8I#ry2K2qcrhf{$*RcJ5Dg0L(NXj8EEZV9lQa##o$#E_UlW&(NFG} zoa^JgtPl(QQgy_%qjc$uCh#P~a6-B~4bmzkRf6op(PUf*nB@B{Sp90yl)z-I#Jks97(YMdvXAYrhF!c3lY!MI-i5=1leYwhsIt z;=OhQ6)5;ctIlyM^~Q)h%WALMTGkGabdeU9tg0c5cUgLMjL=5$IV0N*TLjUju2yZ? z+ynCcmp-8B@{LCXUpHr=k+dV_Hq=pU({%|cGAdvQB%kl)f&S(f2--XoX$EYU8DE;n z!>_JgHi;05%3;p+qb`d_Pn&LVn!5H(az$i;3&1z*h^?`u&l{8{!c35_?`zWUI@>|V z_fP#bL2vvbimnl(w+&H$!(VfF#^P1kju6+)4btfM)b!zL8K{Fau|LFc8iI&UXk+U0 zkt?nJnobR)^&!%PDXDN)Oa^PaU?-o;=Sr(vXeI3EbJZE&bTmH*g%8VC*_<@gnRngM z(*V4pXZ_Rw57OmkHX-`=sy+ENLA^q)DL7VsefdFmh}ODck-hXT-wAww!7?<5-5OCv zK~#RBaI4+5x$6~pnuk?b6ocu-j3CUzFkgWn$I3OAC6@?j2vxl8!o)BSOabEs!b=E;#1nX^+ zhQDVs2E!#m=nYO@Ic=-zql!}*8U(979S->;xY!R8S*W^(&{r)&-W@Y}&WluwGsmhx>t5ff?{1K6%fA0ZK$N8oJO#&5 zMLGGQk2s0~e>!jogGv%}=MbsTzoTr<48COt%$K9@ZvSP{SjEGPt!*wz0wZ}up_hGk zLSlvb!B< zl`1~(qLZbOk$rOjp{GH4o#Umj>b(U=wJhR7)703lIUmM78H>!S2doE>SWn;_iqtpA zqs_D4+^oRY>vK9U@Y~LyJAG;g|LdKdV#k}JJFLas$*|q5Fn9XCDe*^U zN+rR6U#m#A!dNeO>uQ2+ZN*Kz6EshH198&np8o)2^^7Gd&cwDV&zDXP53Uat{P(WY zu0L;@1-sZz8u?+GT^N`ZL|m0kKg-M7KFTF#O-lblUo$-=Ppvs{JM2tt|CL}Ntq~kh zCpi3zu)^Poek566yJJs3t`+IT%4W7t;uy{}w6Y>;3ZeLTj~vN0kb@{wH>3ACy<&3F z?QsLtIw7pOnO9_*D&McpAG=1A)t4_zI%yy1I^G`t)5#fVKKLi8YBr~A+49Xe+cFcF zlEw2R(hONBh{Rt>Ibnhk7R(rl677OXU0{pf#(tK7ishrn*Ey4DM|U7bHy2HJU@e8S zZ$Q?e;6@om^v_WK7qi1oS7xt=7dynfvad0qC&HalrUTzJkw_tADr~w_GQu={HCr;q zT~KDCT);0z1|RuZ67errJV)~o`4{n#&^S+%zQj6$c^53im)8>gO(YS5Wju$_PTByAA72C|q+LR<~fMVk7 z#F%}nIp!`U0in`Fl#=ZdB@1DqpJl6s7Di6IHX7&}*(H95&bl@K;6o-xt4EgxKE$?s zwA?kw=ejWh5|>GBv7jNFjo@#*5CrYM<0^9avOc;{@}vrayrp|eoU{X^vXLjDY%otF zG7iZzZ<=gU^-9dJQ|UVEcKy!W?@mo;YE~M#)0q;t`DE0>6gO~ghOFoc(lo)Oiw`h& z_tYV417vav2`Th{8OSi~NQpB72k+$l3)PhnXm?Bh8Q>2Ng)5xZQ!J=mJhm>_8tk>@ zv{lB@JOTHe0j1SwZbx|$H5=hDKPZVo`-hy6&bQ9E%&N1`=9RKUF6#GMgAQW31ee)c zSp-LaaoyJ`3Ye-tQVb2YTv~>R;t8F(D?5V->R+N?aMni%=(x-54%Soy#;}yXO5}~| zDOxP3{JHhq*#4@f{oY_0_n;_nS(Kw5C*Vx*2?3vIV!8M|7`$=%CS;`zRs?C`$oWH4 zJco?4qy?Wdm&P(j-VMoM5GEvqBFFq9XhH;^27K5K+jHN5L%YsK+s|O7LAZWtNCo5r zi8vVU<&`TOP@;lLcRNTJ3PCc*%L0#;h=1PF@~>V%3E41lRCvO+)4lQD z$WDw~H)jqctVr>pcci##QG#=Y6|Y!!mRuX}(K{ALWlj`W$87(Qf6BJy@lia%O8;?K zFkmQc` z`;u?viBql8l(fmIU~&_adJw-P^v%u&bvR?0ggXo+Wn)h3w~<~nssZTVM2eTG>)t+^ zr_IISVkL(O`zvfb@R2xsAs9s-6eP={MXz<}uw8biw}GEWyWPU)zVtddoGpxbOK?(@ z4EDvVH==N7*zrGsVmTT~m1A^&x*iA-f4O^@L;Ayvd13ecID-7mLiU-?_4eZB( z1-3w-tZyIG=}~Nv?zVzj#;E@9n4vIF=SW-{^~O3RH@fpvwcp7z!Z(dwKepoYUaQcn zOPluV(iuxNZ>jYI6*2TFDQ1LEkzC6#1*ZCMZJ)qUlF3P3SG0Pk#++!Xe-J}i1&%-l zcG!RG>njEU`Atq7d(|K#p*cJ6iA#)Llix-@(BW5HFK<|&*!rdPr$)i00*Q}!z?kU@ zw8TS1#s?tI7nLkXzI@dQ=Gw9I9mnN_2 zdi(t?yy_8X8M*ezhH1h+T#ajJJi+bI8l(zXY=vkO@v{e;fr2Ws4%i*9CE2OG{34;B z8qL|deaNfjCo6TKkSCss|9aaM%qWN%fPdYhiziKFN%usuTeNPJh`u7|#b?1SE1NX*GmuqR{j^R^-#0$FZ+ za|H)BdRKvQ!??21javAT^7pp$elhY`s(tBTpMY%D=2s2&uhl5JS@fz0L0}@bzGSNI z9J*=i3VZ4*z^HPdMLOK$*x6cF_W5rR?wD{LWTg$wd@)U&PYjN+u+*7uPjtEnCSl3_ zIP=Z1B1#DA>HkI?j{iX%R$k7;a(WRUSxsIuQy4>F>yF;y*fB=#2s{K=b16f|&SZgQ zORbZH1r83>|D=55>vkFi4PC#92+Q%P=l$xvZ4kUK48%6~Uv?4_RO@u0*qbU#R{~lV z%`Xn*OaBh1<$j1DjGzQkQhz$adsIiL#YAwxH-?`x(=+j2N?*+BGT`L*#_2qu{u^l+ zv>*z%M~09mI`y{N9?25|QkW76Jq(pL)X&|T)E3kv3@nk81a=_n$@Zyjc@ad=+oTvw}_%8^piEp>^4b+(;(0as_=cZMj}6$6msA%Rfwfg zUv8waU(38|946#T%{CMb&xic^y0UL##kbw7=UB?Oz$IBQbSkg$6856`kPK~USm9U+ zr!y%gpEoUPkT)82a#MlsN8OIZc+!Y93n~5F8ETAIwm*Dn@=NwcR3ug}LWv@umKWI% zZRv2$y$S!&^!weyUU^v$@Byz@ekws-#}#x0)uG*T1=n_#nmc6B;iL{CRJoTh(e-0O z`r}TIFEHaZ&ZPf+3jfDgk#I+{lXPO?z6SGm+)ig{Wca z7BG8yUP;|P`(XTD^LpGr?flm91hl^{JyY~&)(*us#<#p5&%zt1V5K} z-@|Y+`P5n&^j(JQ)~3|nSc=}P>oD2sHghZ#yxXl}cvv8yR``%({QcVc`+9~M*wOn@ zF@yUEmIi2_Xdbd3QQu$(5Wt3Hkf0Mx|*2w>|*Er<~cQ_hD58 zv!vHkm=hU}L>+<#66uGr$LkreH}!fp_5NF+rJ|JYhZdAJOMM4e;M!isr{RwRafKMe0ZY9 zyg`Q>`Mn0>CbQ#8t6T_56BB=jwGUnSB2?t%7Yb5}%wAb*ddt;HRCFZJFT2Te0GG}q zSp-f**%;f9{@w6)EzR?h6gsj6CWlgvUj1K`DPak5W30tSEyrbDlO3`T71xqq3ZD=4 zRfOoUaLGg-3O%%Gr(VpaAWetC>1vehziJFGw%J^owJU2|aP^kY94)ff9}|$n^9HL< zNcz=|8oG9kkR-+pO#EG-oa>^=X!PCL=b9(+SGj`%#|EJew07PlOJkL9A=X{ncVlbK z@Am?FhZYrl3NW=0TeHPXUFcC>G^Rtv-82}_jGui7ij0E<@Sb!~YBWKVPKgdXQFjig;ynLU_|uHZ zdE=6=@VnT1Qf->dh*7KO%yIQm1FKB)Ycta2A2okY_h`fvYE@(2Phq@TR5Xp9h60lY zE9-2zd}7$cKd96INTAb=2|JI$rQN6B6#nZ*e$k#(*_KtcvPQP8V8u@{#7XqTe|1QH z>cTKCMOgv&b$1aQsDm<)Ngn5j2AMGt(Jn$cY+|T$W9H(y!hzgrh@3JLOa@{3RbB|N38WNktCqHPZyrcGHVO@{^T>XK~yT& z>V%!HH&S}m3+J9l+@LYl3@y%ufl0#R5#D|JSyrh?B|fEJpo?5XV((CTbB{(KO;KyM zhE11WJ*2Y$Y1yADaF23L!qS)_Y$+;MCc+jCJMu&`*O5X+qhwkS-Wj8RiEb)8s*p5PA zgMyPKDVL9%n*Lg!qf54s?DprEEru-9ppI3s3)kkrLUM!om`bxif~cfJoW>lueuD4#CJ1yp-xy7*fA$;BXP{YcYi0a>s)ed?s$R#;mMS^Zne;%i5K~Db!=MO-K z3ue*+{)R64P{s+7sEnsARhuY;zMya&UPUohW-z^Qmsu0GX^6GA27RF|gOg&ZNeIr_wJph}Rm>#w_LoJerE=3KXlx3+w%puCMZyUBvHj2x3!Y zM1@)-{4;$&t)V#L`Zku6S7eN|)dPK$xzy^erNL(eMQ*BPInanINaH6Ss~(DH41U%w za3C1a;B@~15DbJB(E@bE7j+cUd>E^LNtX~jK<=UGQ7A7yN89?(XgHk?AC?a;ED9U| z_4QfL*MVh{c#Odo(u}_Hp+)7nawW;*98(+SE7&M+9jR7wDMh-AiKZh=$-57;xG&Oi z+OC&gPRO5@nSis+Dt$kqG`%X3FaIG$fwZnG)0iWV{o!Gy`NNr8LWwqB?(k$I!^|Mh zvCvTI>#0r8hse*;e^x0W;Tko(u_a)D=1-{E9k*rfcH&}VEF>!HOJNXk!+A75j0@aTm{VzE0Ulk6Uu1BGxj7cz9(X@@SIy({Vqtd6&2bif7^&O>Szez@ ze+W=Qz`<1Jys(!vDuuO-BrP8VR>GglZU4bZ`@8de*rE8c1Pfi5FIf(Ja?x0zF(5_jIY8`wleEk=UlS2 zk6xD$c%yxtB?`OQcHK-;NWQh|1&#FBi?Dac8utYxKL=T0@EQKd7A9T2m+<@u=8yCy z!jTjp&m~c~AeV~RP7V6CHalR-pSevs2Rfmeq{7$i7{&^gm0)Es?CHS`)P8U$s+Tvz zMT=`TZkRBk&9{<93&7aZ`JI%Kkq-1S7h+mRLv1lG^6|aa-MTl*?Jw&LWZOl&%b-Pq%Ed%JFddXBkg_crO@*ABL|vi*7J5MWV^)*vL=D6f zEd=AlM9nD~eLN_)OfvN8!-DNvGLkt;H)lyP5dYR2P2k^1{Id#iN#;j)$kF8j4Vx*c zvH0$it@5-f-qHUlz>unzbzcz|5PHG%H($7?wIwOl@?0u+V;_@n@JWQsyN6aeS_?+` z6RDDUUTs?E2#EtG647>v%znj_xD4AEHuB@fa|l#F8Y9bQ1lH%o;Dtsm!d_d$FNw)6 zwajL)NGorIPL}r9_VC>j%RY>Io3&L*EkOoppCcPKB7_2R(&0D*y$n>vU?vj=O2gd} z$#i7yFoZFdD9RD<@B&TtB$gcDvCuR$xcRgnO*LtHK9D})G7zoUhSTXv&8GH6pXkq$ z_2hk33ICaLfny`T^T<$5xPzWEBF~sC#*z@Ni;`Oandcl)xv4!6aq+27i9x5z)mdAsUp8pkJ zbVlMvE~_6!!Ct4XnQIyOT&*3{Je2i4GCH4DPZ_lE$`?T2ZnCjz!F^5KY!+;~ z{+*G9$`GhYEHSzYp`sk~nmn@l^3cr6?9WY|9{d0_w44YZxc??KsPUHjAvCYFlZcA3 zw__MD)cE-ACThB+h}$K9%t#j9>-~sfDo3kfbC&x2?rqH=Wp(HABVQ!k)h@3k&KeUp zX&Wb_O;=M#G?vJ3d`M-EK|HI zAuZ^lfA-??Z<8 zM9Bx${)f*$aPOP1T0vJz)0S*oT3^lr&ucb^G2Rc6QF*!U4f^ujIo1*~f%SHkd=dJ$ z;RFX7Zt*ISd@|REoxMGCmIuCq)^CYl1Mi=mt&_j$pEQeE=DJrs`S`m3xOhG-+|2{| z#LN=z!}Y^6wvW&ED-O)xPQIQV9$)*zr-ygMLQKF9!ylWZ5_E#ICa&&JeO&*AtUz5F zm5XDW93lp>ei3s-^{_hHYg-bj*`BD>_NLTNY51Hx&3;>VY0UMy?kv%j2D8em$|YS8 zUa^e)3`}$UqK+Le{EHkiZnU}6PwEUTy2Mec>r1Eof5FO#kTA&)J;=l4xq-wG79EftZC+&FKmqJdf+X~fL_uhz|G@0LKS)rFy8Cev2!WU zEn`NRrWy{s|bckLondtzj) zit)>SUI5ix%e9^5;Vv3)-b}gn@CU<8DX8o0^Gd2!GBOZz*qOYXin^gS-#quMd2fZiTo1TCzF*BV4ibaPy{^OaD9d=s3D?l+wz<~N&-%L>oQ7Yp9t}dH?wA=G0K}*L`r;rcQ+OB`$6n?`3*^}VU*j;CD zlQenR*s(4!eDjiEk(3B%6;3&dEBw5A!CfgRewKEXaBgcp(X13&-<_E@jS+(mZ;UO$ zaZF_A?q~H_c;;vh^y>mN{=Srds|on?d0DVqdqu4M-Pu^2!@DT}H<9>oU6Cd3f7Q;k zzERG8nT+W$cbV}9`@F!F)q(11OYj?dxXf2#85|CqTxZHUODMO%x5LE8AK_J+CM z20K)-1VtL8-xK`$zZOk0w@9 zty-bkkNm^|Jy01V`zYEJ5dGp1LSDKVYk@OqBN>g|3t>{g`OiPuD-)&~sAGt%JZxCR zUf>Q-+y0ZyW_x0Qa1K$Xd=Mls0v>Ra7oYyM)!2|ZLSl5Z&eaRZNsJ~1lD|+jKassZ zZm*FETh<3CVoI<^s_-f}2y}+SSTywu)hLfsMSZ<^>2C@e!0j*>Kr3D}a~*`aSqNh- z!=Y@6Sw%Ht@=}i)DbagGcuKHFrAIMUqz-3vMSr$@Q97X z2$p3$Fkpy=v;<$6w2xeo%OH-uS2=p{iELmU*Y}`+>r*eUAQN8YPH}PC+~A8XaA&_@ zPmdTWU;7E+>aG%=J|s25&K=ld2-#P3MXC-ltswbe3)t3~sj!n2qu3(Eh~2bk8S4G+ z=OkRxpY37rpavG|ya-XiP^7A74-m2*S6I?I(}45gYPQg)Om~F7tlLwi^Zj*S1rMKS zR6zoOl&Q2?T{M~);ajhxBb^Xu$MAW{JnUnoU4jiwA61RCfr9^c+^;n(=F|M*Ok#ax zT|+FrSmINpxX|$utQz*VDW5IFfEJcMnrj|MM}U4`&-ONO!7IOS9$!a?O!W^%mtUCP z@`sLCa2qy$X;bNGFcrx>VwBX}au^;|)kY!U;e7DdEoLoK4q`obidnx!!ges%9-aLp zh!QAUF_rBn4=Wbx72;?*EkI`yD5FPNaz^>YKNTx#XSxbL)@@`L8x4NWariRixS=4Z zU;uHfi~UC>(Yez`(0?Qt+oR=!zX1(S>`+H`Dl?Krw(s3;X33wx$rDYQ!oMG z9#H&)MAUMiYhz9~Z|Gc`7+2NUW(2=VkY9@zfs7r}F5jv(38QR>H|3N`E^{+TZ$Nd? zQwZN710(@;gfDILhmN2WOs+9Bf#pn*I6!u~Is=oopf9%y zQAZg94~+n|uOQEXXc)t<(Y#e$O?xoB`q^5qw8_atTnQZqDLxy?uV2#?Qee^7>^g&! z`+(+o9WJ(35h#j-xM>!Tsze?8expWbWpI=^_cUbHAYx-yCB77s}=M8{?+;fj&6tRH*|Yz z+S(B0v2^;EorZ{MisR&I7=Qvm3U95`x-6()20c$H^t(ORj(QR95qExE0^xU=$Nl>2 zDB}W7;SZZHmPp?}}iSwuY-zU>TS%^m}=?YdFVFC&j- z@{HO_WMv;QZG15MwiV-Bb|WTB%)6VjIIdz#@Lk&crFH%kIWw0MPMv58SR3?OTDrV*F7v@oH>LZMOo3+X)H% z+k+p%tN|q0vs+U{Xu1usXQ*!{E9|d6&If6fPlw+o4vX01P~B}&rBlZomq}}n%@PUM z!Ai#^qQ7>Mk-Il|Yq!ziLFa1!RYT%LY=U0D*af+n868G&Wrp0Nvhhk|Le;I)KOfcU z*t=E55EE?9cgqx4Ch{pPF5gs#Og0G<71M)^^R#Wq@_WS${FX~(Rlm0eUrU&bT8|`> zXLq|isYb_=ck|JX{~faT3qJ2A{l6_K9Nhm$uVLloU`@GG69Z^(xgNKnGWN}C@6Y7Y zp@zcO%XQFg8g3-@EYfAWr2TtXAd@n2>v$+KhGqD3Ce?S zI`J!%3!J*8A=D)vm0$RI8DKUUcbRS8F+KW{!F?Nbf8B_Enl>9|&R~QigtLyR#&Jc4 zpPB!KcFf0~{dXm<+nKrM{G14QeY-!L{XDoo`>pio8NFH|H8JG+;4~1GhW*Cyy*3cQ- z727_Y_yfYUUBKpZ+W;X@0EQ*OAuPk!)I-|VD^-;MDhxoH(d0Qa=6F;M6cKKhWs$e_hGTjBU3G{ zlmw|tTmd}KljI?Op!3O4ZgcTqg@G8(lUImy??2lf_;U8EcJ+R}p3Ypq*$K*nAXBY7 zH@8?gHDQk^>D`%f|1M;opO_+=$Tt1>{`5#Z4g=;P(l)#2-A?io?QL-n@$GCQI* zfhWjVbvw?tmEUCc`(x|$z41Nhpm1)N2PChWRuCXikNl_`2L}eT58V?jg~S^&{5?#Bh%v#3PhRJWupWnvgp!w#i%@Ztp;91?aZ!KM^0PmutHA$QK7~v;wj|Tg!rIgD z@Tpv$riVP(4|oEY&77Eq>7KuALxtku7WGyYepClADgddskpg2k1dALTtQkEyvIpi^ zs!xh?VW272LS85kp?K!`>WeJNZSXnoPyopXTLxDr1XL`D&|N3U6^ZRA$Q%4g{?jMT z)6H(;(gN{$Z_jq$nHvucBPtIXOAlU5f_%_Vh}cEqo#nsrJKCPVdB;f&1}~ANv(2T# zqppJNM;vSfndHrMSJN$7Wl!k~6eiEp`u!){3IWg} z23A%$rHka7G)Yy}EXR&LSH>C!b{7#g{);IAZ10S6J zZLLD?mbI=Zo*VZ}@2mG4BpIX$Qhc2mBi*B> zaxE;i34PAOB;OUEvmeg-F90(631Luj@R^c+-ZXP5PtWAz^MndKYzerO!io&_JSj## zBHP6taCLM#c-R2E)*ho}A1HH7f4fcH(_fej9m~yhupJMg1l0!lMOMtDqOA(en=+GG zOwL8qx~WlMg5yd*EMlzHMVBY&iey*rtfG*;QaQ$SB|?w@B2-}fJXaL>g{ zMb+fo&c}Lk295cfAb$Vd@dYlfyb(eN$h;&l(rcDeIswaWbMnJq?4DLwjIw)A{1Won zwRiSeE)8e3mjEs;ThC_#_8Q=A0~8oq5VhQyoDNdHF2p^;Fi5bsTdGZSR2<-lN9YNy z5gQc}^3qfXGlDJ7OWm}gX3xTq!%{tuf}er#-!NoSE}JpOcUOsz4qH?zH*dFOw`-bSB?WUL@jjzmBx3>CLo#7 zw zbS3ig7z5d|{~cL-@`ay7BQ`JImV{tLPf+WaPFrOn(|`gYZ&!l8v|*ykv>9>7KX)S2 zTx6`^G{Bp{gKBOia)Yz%T1(0W2PMK_@-c+DX4BDA|7~MNKB?2|-p0o|JRNNtYUb7W zt35-4AEtuj1n+AjO;U}}D_$Y3j|MZo(lYc$ub|Rd$t2TjHG67eTo;LH0fYhRM`;FQ zV23}TwOuF9;AkLPyM}==E5|{iF+I;XT|Djy2@rrocznQvB$Kf$9Q$YXdC2*iYd7%D zWf=Ct-*$)7-q+Yhg4Mc>z5X=Txt_T$9s8D9`4)FOSZ4&Pv_?wn+{hY+gtJsvYXg{x zd6^`+J+uw5Nrd~d^%X>hRt0Q|;vhgY&Z3O;iYdUm@KO|*v6=MEJ(1dTl?1&dO}6Q- z0sJ>=+n&Z(#yh`4-RP6MY!PHlM32YG^1j+W2H?n+EfoAh5mu$nM57;w(oqDfhrGt` z39e)H#2~rwdBx07Oq9I)ChWN<$k9TlK%a2}e*8!x(-eH;A$rY(HY(unA+cA{;y9rZ zWaxK?*@rcG8+Lax3-CtCA{6uw!oz?h0FcNP$OZ5PSCM|y4bzG0`vUJjuj>UVLj1=ccceH!$<4+KZ zH~|DWZ9+7H9_X245RX;A0iATc9Dt>mX2+FVzJ|Q|c?4HZBG`$uQ;kCUk?;`Z@AO}n zdf_)74Qt92ob1rF5VD*%(gD=6*=k%hkj$gu+vpm0A?87E7`IB(Iko-n?qouodD=kqxMx6N6(>&Yw z%iX0`%LOicdjVtRry8n1;MFOxLqhn11H>62qrliWx6hy7I1V`U1e*{bd_!pT<@>bL zHFB$c7CW+XdHFE%@v`>t8=(DgiK_5fgp4+~{do^_(zv*SbSkwoV;6it);O2L9;;|a zLFY3W1*W4P43deP7Ji!E8B8phR_wZW^&D@Mj0psIfXn}GO~88r@At=^ja^w+Byu6a zd_&$TB|($D@=|>^KawezmC;vA4TpH(6araxDYQj$ue()`JrzKs2h0FDple2Xp2bEZ zhZJ!%g~K`{@T6a|a9$6_cuI|+H#Z!$rbip70yH6|c2@Bpt=WJhq&7brhU#b$cL=)w zw#WwlAQ4or9>#{xduK?KiLr27L~8;|?T|sF#xLy+{{@|o^=GPH5u2c5fdV;=KJPew z+N)fi3s83LT8+X$kljE7agpEs;a z_&t->!(V{jVXqhAOh@9qG7D#mSBK35jUAZOxf3(!PEb6Gp%|p%_A9oN* z;03G}u?$$fq7e|y>$dvNs8eUZFG*hx)y@{5K~!tJfXdW$1Mt<9#U@yfk;GY9AoZwPqBO8P6MHhm5xZuMF>llD^YDY2rkDgl(kwm_@SXsZ@Z^ zD}x&+4ZYhvEpEr(k|ot%=r=R=QQo9oRX3+{lhCq}Z$9mCB%oooil2zz5d^3CS@gQb zMq6~Q0HPmGlburSJM5$#?R3&Z8E1=Q2V%MLK<_DtyDa$j0;- zQu*@W237nfh3$h_aZ=sA_2{p4TnJsTq)M6a1IKS?AvL@N=k1dMHG8l(E1woIGulIS zRWY3;@6H!lMa`h}hDpQcM2oXMhV-xqN@k6R!%g(!{5}LV@sXiusd$qj%9qp8)M69o zv5+R}2!Ku(ykW@+=~3hZmst~TY2dK7IyE3A&tI?9uW)C z(Ei;DRb%7j7md>?{MG`uTupVr2QOVtuM)886LFM!0{YMQo&#yC3H18jCVswUSqa2m zk9huLNyF_x(q)BEEvFW@^JB+vY$?t}{IHAoKgP?Qz3$rFVWH3aFxXCe77s#5ka?&eTnoKT-A+_zciiX{k)rt?)1(#lKs#YFp zjT8hT&qITiWfn0$`lw3-D5QXvl5`bw)Sw#SSs5#(${)R6F}5h`^B>c;Ii<4@ap^#2bV2rJe#nEe#QjHgZAb->8{B` zyRYk!SN#_MfWTL)1u!~3$kRI(_;&>xx%YUM;hi5ge5@wN4WOGFx1RGy^LEA;TABI1 zrRPNRYcD;uVws=)DmNJ1)v7SA2Eh{RXT`p(`KQsyx!Yq0edHSpJ7BaufX!~a+cH3h zb8ipk3ZWjyI|uzGp!+-YA+$0L$B*{*MnsP%sME#egOL7aFU^*&X5mxRM$pV)u6{R1 z8UY#l2s`d%zyW?)K|xwFz)W!fnrkpAa?}!YhohPK$zjVY};_NXB!e zi&~y>1z{;-`T=3~X7Gh#UFA{i%Xt)l&u*Ao4Y~`!`8f-$+EeNUkds}b*HqD0Z>CDR zS;2xCh6?t#b|FDL{dHvVDEiGdou|!~w52bS;uV2o>Hu7fk|wf3Mp`+W%}Dv~FZc$h z5s|q_$+E*I;bs575qD0W|4Mgp^8O2VQ2`A9@z>J=3XB)ZC@k6dgBIeQ=>vZ__-M;I z*q8ZCBxun7beQcYgT(`pT&fbd)}I7Oe!I+FOL>7S&dSsY)Y6whub{+l{k|RRINKdX zW`N_3J>R?gcJ;$-?5ZKIYkx~a{AT=pmB_7K&^vt*ne&upG_A{|V>D{2+LUvxnG6UM zNZ6S9WB2@z)(Gch`&& zrfi%(Bnp;Lvd_Sf+78eLd_H$! z*XQ@$Gk~in#5dJx$2+Gb@rG$ycwWNF4K_`am3+L9-0^VL~d`N{=F~rIzJ3XA2TJ8PV({n zY!?U5vkR1tX5etIKfJ?0w5K?O^a zak=gS4kBwd_TwuIaPJuorAA22dk|vGEqs`yXdhRawT*lI|0OzKz4nkg3>B1*lWAe0 zcbxIsnzLhR6wJZFn#*^zaynD;omjV(bv#75o0Z7~O7Q(i&OnDwF92f{9CtoCOy`DW z4~@GHI?WmUS}%ktU6y{EFPw$tj@kJuZ`R8Zc9_2J&}2%gI)SjI!?49W5R}&fQ3~sMIw+|rp60uxrZ7W@FWhl=P=mk6FUd(doxkPDG1Ev+64#VM_(OMS>+xz8)} zaSiec2zjLsT4++1YJh~&GQ0rl=kxrg&?i%;(8vcC%!^?Z7dC#Fv743g%dh*2rTD zT|h(0RD{#59U1b}aDJI4(fH7ExUj3^kM*ujUiX}oXp7Vt@}CRvJIVcH7{9+NK7F?o z<3qa%s&uclEP%9D!{emd{m~oVWGGV|!SsvD;b*ng(ZONEM+8rdhn9Rbd~h`@t@md{ zVj1Seyc~|Gf!n5W$sK)L2i--tLZWVae^)*w9X+E|CFXc=2ymDX4|>xk zk1YqqAGR&05>)E%YUR7HNb;NHD%aVIh&qj7N4m{cD+v>Aj+>(7n(#abr*Pww7wGYM z3G1e{9|tPv2Svl{cF#Juz8k&j)g(XSFOQj2xMayxVgWR)ZSxal$tOIymr-x);KvcA z7ruX6?6mb1KVawAfhpBA-|#RMxqxD_WNEH(iK@^m>9mxt;N@e>Vv^DpUqb2ASy3%? zYLQS4{p**fo7tmylT|WV24{uH5tD=`3+jH|q%4o-8>d`q-2-P&c=m}lATk`{iI z01{V0STs#-#URFfara7pvEPO#XUt5U^~|B){*H{f=X$M0&DUZk5=~;B{bKQQq~Kx0 zRqtrDz6cqsW)f!elDby?#fcVLkXcRjplDamPd&v9fS@ zmz^rWm=Ul!Ub4MhVEY%D7CLB>$h1-Q?$up5lhX6tuAlfBY(eG=lXI3=JzqhyVKf`K zuSPv@1e*`wOvAYACa{0u83DY}1349T0B(q5^?eJSD-~zDP&U&~#Ho&xSgb}0?CeKA zN8z?8(mpygcBV9Y=CWYfS=NIpXDSwW_drau#xLC0-97Nu>C&+Nvr1aXLN%C|Y$i{| zchBK2V0BcCO!7V}Tv^8qP7cc|88d6gEn#m3?pAFQUMU=gcMF|$iYlBS=m1*_KWlYjuf zOMbuVnTrb*oDG2_7saAY<%~v;XUx>hKbk@kb~8Ult5(RPCk7J@hV_Z1n5Kbc^rV^R zaPbK2N_WbZ?}mfQ$OIV1*+5|kfD$i!-V&>7Xg>M{;aAtz6s6dsSz^Dc2swY@;t+MV z2n_R{gWruFfb;jEXB&6R7kzad{Doua$Mkj_{0*$eyy8rjo{~09o}nG);ji8JH_j0k zPm;T3`DMZLze*Wp7$Zs4JOf3&OftmU%s+a)xKqzEvC0sL3v0MV<@#aLu_ z3MZ!bt-kkx11jv(_P+PL0jHw$9x5=o{7r(Cuj!P3Zli)J4#NsBtUBR zJ7v{tp|qUa`re0Fm+%t;V2+WLdWOa<-$1=wRjcOahknuCJR*6k4|p18=l2>r?9x3S z6ThvMY|9NUS5Tb2rYgq%R-2_7-{g4)7vsUadipUz28V31S3s{-#cBUdjqPoE5&x9K zZ8~!7o~#%(w^dA1RF2UhWAZBmSyd87(G~8b0!Dt!9%nTPIFv*hm-ZC9TOW6@MxZmpw9+RqZ}5McbJ95 z%DG{iJ|(`TCTJkD?BB7vO-gIcqvmW?mCYIj)-D*M5vE~lg)Wih$$_Iv-r39wX*tC6 zY+Jk~;_FrTu~$^mD=-~nOJ=m*kv;#8if)IY?7BoJc+Pf7jre*ZiuJ1!Jn(sBPNvxA zJUE%Am1IN`P^~Db9^_@WN_6r^q3vmok3rXKkARCFudphKy|B%otf|1(GhD#(<>XEEpB9TU7&yfBe{LRY~_g;u4;hS^x#_#-3X?xXV2durrcQ&Ozx>2L`Xly}9T;!_EzYy^$~!Va|J z%eBB0Tg(n8ml$&1ED9cLxh*Rsq20BcO35Yz-{aWM-*n@8EKq7+DX)TN z42s`K5f-;;Q%PrOJ*jadGY+$@yWi^Kt|O*AIeW?b7s3g(=LaLvE=z%@gm}l4)J%aF z6-rQQPHZato^+{^pKaIA%Z0QMk!3ey=TfttZfo}iX~@V6tgg7>D`}u7Hd+;Fk`X;2 zAOVyaeWg}+drHo+3?FX|AKG5d>&Zpql z0+BA^XK+9s92oJqeHzo-%l5+!5=&c008u5-!iR|;avguic(srwkGC)4RdiAS{Or7b zUQvS@?h?If)103OSXsdzM~FPFDk3D=`%|gg|0*HLU&<+tAU~gC(t` zjg)`QNedOiG-~#C)wf&26Hq)Q{yEMT{9}++6yLlL&q_8UfOZHGF#Yb5B=Fo@cSE4$ zwGwbT@kllJqB;5bPD`BvxDh;zMA8o1e&*ld`r6t!IGm7Ni=>1&L!0jwG|QiOZG*?ydMJPlesllA}kllPCWA6nRvKw0Q`rJB_$qt6s*Fj@j7*ylc+@mMuCxr_$pw_Lk5Xjb`pKCgScfnK?uOzG{I3BSv(Yi zY#=wSn_vm?VuHC{3fkMj)P!k6HHk3KpNW$G$9gd-HesvUB(4 zeS2H~^)heqXP^%xs1GDkof^PM5AC@g_a-hs$j3IGWL_7ou^INCmO~jdGdqQfPZ_NUhhr$b+U6^oiIH8`Lu$BH>uW^#Qo-G=O-jX`jJ?X# zw#mSxk?_$;e=UNMPZ%pVS6A>K(;+-W8`!%Snsw`y%#m(6>0)hcu-phnU6l>z5`eo* zE&=wBeH#X_vpHhxBS})Vlh3&eN|(3rgDP;L@&V#66X2s^KSsYV@t-;n6-pJ2lR*P> z4}l~|60x!Psn)Ut(TE7>%DbK>rhCq{f?xG^OQMpxt?B*!RWJ_%N-yWV9js)GJVI@T zvA`BcMVJp%$(^zeo(6*AwR4ss47Cto%dzR;?@%5^px6z8wDs6N3M}*NP#ICVBPYsq z2tf1=%_!XvF2);BDM1#&OX(TpSOLq4p9@NP(&~Y1{TKLi)y``ZBK!g?keXhUD*EqY zL$66kBNHg|1i4(Z+)d(AOa-P^Bov?TAdG`sBXdBuaR7kUIUAMW5zNz2d$YUOSGZ5F z=yn8cYyiuRL(Gahqgng*bc)K1F!iEe6TsUbXYKX0bolgs;>)VfgzfBXHTC*-{jp;v zM8mu}62iEp3gS~HC)gkCj7}vVus9_bJs83b6B3e&6T*Qhuq}2)BX5Z{2^WZqrJuT@ zX{7Bcn;TOw371YJ&ppbzTlZ>2$fQ45AP)F#b&G%8CL(_5+jh!P3@k_X}!2CT_( zI&|mT=eDX!L{QI=p`HSN!^n#q5}3|y1FKd@Cwri63w_Y*=G@mC9Uc`G5j-N@bsZi$ z|Dm<$0#{4EUHw=S;!n-uFqPi?1^{AJ-d;Ra$%}6&8Qla^^D;vSYO$t@q=_mWIHxBR zRq0^0#*dk6Wt^K2TDApKSUL`CMuXtH4Ae+tq)$T95za>ETHi(8jIc4 zCAl|~{dXD1ZoL}aR4L;k^LQaa&nXZKlAAQhTnF~J6c3O+#vg zbOPHGzln7cxgkX%(LCv?BtS)*xWR3rP>}`l7wA5xTGsgv8LC*(VkB9N>#r!56lITb=)B z>ydB){}*f*34<}oQQm7pz!mr6H4xaEP^)a zNy$E)NqsrQ(ib6rVVP~=!E>e{G!m>R$q}18wOsu;2!uud+K&`WknEzjLJ{+XEknl& zj<8YbL9Y~Xqrx9TH{wl==p zJp)4{#HRjPDL}|s06SB?k+E=+Zy)i@+Jm;*1Mf6zuipblwiDgoU(qWw4p-}Rq}Xn@ zgS^DcnLDsUx84OI*kYH7p9UT5YY?diflC&0SiSKNLP6#5_286*`qJ#rgPFdG6dZ|J4(rKcW`!_BVdtfXZTpPk?T2 z$xoh(xMm|z$paCkR@B*RHGWQBODNfoU~Nw1soqm(IKzT1O*+3Gxdyldv}S)>dj$Th zxO|;8@jB}IlhVO`mj+=c8GeH%k5tUzqldj|N%PNIYmW*U9kv*H0YHv#+4s>J)zs?8 zP%RSIJUN-V!008gqos*vwhC!`F23SPd!KTEPRX4o_<50#E4rkt|E@>m&@3YtNICSc zd4vane`ns|yyVG=q1-Tle)d=B0o8SydVxF|2;<0v=j07h zK#rZHI7NtvXa~z&V`0-hOoKYx+9~z1l>vyc;v663bI-x_gqY7w=AM`Zy72l%YB^hL z?=j^B+XcyVq;S12OM*5&TTASSV`hWMSAfr}=ADsr&et)Oa&6r=zqEin`n+#j2t2m3 zLPneZHkp-dl~p|T&Nu&(kP5`k8FdwsZuXkG6y3W}v4PPt ztT{V=@Uzc($P--#$Ywgtxr?(Mh7(XV{~}$>VEmnT_>L264U3}o1TAVe3=P1mIix#S zTFK-@rGqkH4ssm!o5rhdQu-@wtvWn~M&p7A{R_S>6TTEkq*h9A)MFP7%{ZU~kf}aQ zo3MUE$=z-vhOO|u9Nt2J zJ^kJ@+>(fS|GZBjg}qmevi^S(E^#%o^XsL)BZR-9MPG3Y{%Z*5`cDvzjfact{|@2* z0Z#wFAsmd0`+s8<%XD`Vwz#mQoX=>Z$V83@izU_iz%kZk4=I+Y@^!bao%ow!IJg{Z zk|;Hk$6T=dTD@X><@Q{VWs}~rWH+zOpvH%b#~&W@Zv7*_FnKdcq(3;m>z=KVHuFDy zrH(5qU#(lE=hCfHd`N_JoMxBJLcn4|q7GQZrarUA8pLq`dPH--3XGYqPM-AbgaPb5 znOl3xfX>#zEmXbS>g-$TDdXA7BhyKot0sd2UFRc)-TV70{}90zgS4!Z+fHQcNn!te0AROyWIS!9qJ%}zkKdUTC@k$sqPA3F9OY@lQGX6 z)rhImJ320!nq#VAB~fohX&Lqy*7g)T5>I1h&GkP4Fg%+Nd|1zMUyUDi*yb$Ihc@WM zk@pQF%FQ*GBPV7ksxqS7nK>4D;v8NsZ6|!W4cQkWYUULy5~8&%XK3TKYrM}R?tlCP zeR{gPv#ZhuLPMQ@#VXFoy9<-$k4#y($u&71CGu`mtaD$S=QAGe&9zRSJ*l`Thzr1yGu^UrDm04q4VyTkhhG*HU$F3Mua|Su~zsK{?w&-e>1}&s zE-B`E87KXXmqXQIRY2SZm9MSXVNehS!0pymB&h287z;~d3~_6QUqr5jp=`ma9k+Bw z6T*HG2gWRv9~+G3zw)rjxGL<^6IFmz3K_S9QZWv+_%Dz`5wfb8A~+O@gz4=U2m0~=-^W?#UWINqkndJNI?m|k*0BX;`y)N~ z)mLhzL3osp9LFM6f@%*&PX9zMN#~AuO)&ofnolMQD9&mQ9P~a7FI~K!nFwRs=SIn4 zK>o%3&3`MpJ%G9>)^uxlX4CWCw^476De z6jEdZX(M*u$U_d5g}_jxcEmpk+T6mr@Kmh{1J^)`S-{g%AiL{2U8z=pQ_c03c^4u$ z^F+v=4eZXHN+#i9V~}dNeZLQ?+1R>p_}6U`2N~pK>cZOB?fq=kiKE38l`#GQKwzmo znOkGtW7;(|X24pjKf{i_=vrIiUR!z%l0d}dS$7fCl$cZ6pOR8>J4dq`iEJS%NhhYm z$RMD71O07@QTUoJVD!JcO)ON`?o1Kld4-opiqhqi6+Sdq8Z`DbG|1qC_oJYePEJ8h zIp_MO84n}Yqx}grnblMk=_mkU(JYix>`2d399^!ALFlt^JtWJBcDZo|)PqLjzustS zHBqeA5i7N#WwVR<6DGwYZc@BWggA2gIY8}QGb~a}bABv~M^x48skVyu)k7Jo--U>Z z)J8>wV|1zJ2&eJOOu<-SaIApf{6I8hG`i-Sz!ygoxf!*`41^r#{uuz+OT*~;I33j! zN)}4vuyJGS;LjK9A&a73{$;Vo6S^k=9uIaUZ+O`P{Vds6W+0{S%3?xZMZbT*N9z+H z=2E6mxCj!^zTRuk#C_wh^QYJ;rjDuTR0O(60aeH);L>J@dT;moAdF@@f9Kfg#{#lB3~j-@1Lg5kg+bjCOBM}Dwm1#Q-~Ct2l(Y`=&Jvu zuga^7RHzy##~E(cpL{1gu}o%y)~{8KFMkBTuRKRndJ#Luy6GMnRw=LbfBbB#=!mti z`I&xt4;R$a1tCd4Jxzvj4X=NU8^Xd9Z#ERRF8QK_QmLGp@KHL6WnT_Qvnm0DQt zHrL;eNSM8hEUjLsUG#6zjyV=92r}18j%5e;IfWL*y8emUYH*&F0)rS~SK;Hzj~Ba} zJG{kE53~rkSgirqPAO&~MdwWSlpDn2Ky4%{iODAgZ2SXFr{lyaCz!%z;jx}pR540m zNL7c5zQb;rYA?uwRpA6HBpX0pt%$H(p01Ot;3YBrR{zp*8ApR)tGjn#_*6lPN(R+G z>goZGP+oFi znb>ygoX1Z@Ok%d3HOFKfO2abnZAApw=DKtRJl_L@m*2a&nak%&PaiU^KktA=+;#u> z)az!veKd0yV?alI>0#`gRKQiiIUm`zRx`_NsighM(2 zF`VuIjKr8FCcG#}7r3Q7UD5L5oBV{W4r3?=1P@GRQj^NRewko2J4awbY8eT`1~s*k zsz|R;kMqARsN1RxYi5;O9P(GFz+;@;7+Lf0?FCOlVmw)E8d$O7bM;~M>B#+>$?#-S zL^T9*&l%Jxs()%8CPIQ50} z|FZ@0^#3o$-Z{Fmt?3($ZQHhOtCNmx+s2Ma1uvaxfoYD`ctV3J&doA;5aia7#;YVu>{fGie+T+$ms2|z26Zc{}3}Y zjsd9yIGNDNN1S^Je~FONdnTw$XQwfVFIuRth`S18^d@Zz!^ogSX7n1^r(99qzSC?k z-Xg4rNwplnW%?OCuG|`A*A^Y9v+&uW1&;h&L6}Mv(CUd9LW8p(m_V0z!iM8F_WYhu zb0ZlK!^WV3?vwIXa(Q3D{43~1)?07s5E!Bv!2Sf}jOFrdn?VQzm-%#xZGu0H5mWfP z=s?wvN_`%?BcDiB-OJRNlNc<_YNMqcLT(t~Qw7v8D;+xAl4NWc#j(_3I;@2U7EL{1yCsE0k$<#mWgRgCMQx+XXBZP9o0u8xSd~O`nKP73cm@331F2 zz~K9!_LdH*3(yEb3U}1`>D@#Wr^WM&(c^mob{Pcv+E&|uH;tlD)h2d=TTjT(ywq6U zyh2e${}YiPqSQ@mnSU5SNFB9pGN*jiaouZy7dnwFlEgKI;1ZXJV%V=(Jm~5~K<{D$7;%z^CaltP1dWH@ z*L~m{*|>V#3psQ3^vhw{Fn@Rx6k6u*7n)DSu*Udw-5}Oth^D$YQsv+#SnuT4I_sp6 zDxgT4?CSDAS9IB{o`9#2GU!oGapDJs8v8EwqWn@_xZ@6sr$z$LI!C2pjV%|4*=4_X#{Gri1g-ABPF&6m+t1VPNBn;w(7rJP7Jd(ko{zmkD=H*BC)v$S9GbY{jzLZ=i7`@8 z6;R1w#iBND$Y<$yYqn1OkUi^e%VF65CKCCzEmAyTgEE*d4o8oOdi<91`u_Hn^7`f$ zi7`@wuHBaTgf>F3P?;^OciU8!3z*TzudUv_v6F3ptCbyxY|wR8Aet9&&y*a+3{z zPX5aMCJ<-Hx9S^F-EZ!oca4fPzYOBi>eftn@bM^Wc~iJ)jLUICbQ2zD1}K(1IIcv> zy+pEX-AXi`^l^!S*wPLeT0AaEdXp+xq8M*OI*Z~}nnvZ;*4SfUMkVMYL9G|7=BO@y zt=m+^MLl)!!Fk`}3zJ-Ir3lD*qgzr$u_BIYyXMs{*bwaiGn(5VZnW8 z)&2DHxM$|+=A9g<9E7CYl8oymGgOX`PF;jyLtdf`w;VaOeqKHzt;} z{45^|9yh@moMc1Ot`_o&jVj)235pwo4F;9YYz#7hMkRW5nv`yY1+a%ejW4)R;VvUyvIXiBQ}zENGYp zoY0$2X4nqHzwDxHT-b!BJ73JpJ&_gAGt-fZ=^})k_{xPBZ@}U~jTn9pTwtT9FYhbk zBL`6c5}wWztY*2C57-3m^EVJ9?@E}#tyFw4ml84T!+af{6|5}n8=~6jmw0(Q8;Q~u zw+5r+4?_lLI6ZqXt{_AZ?CIhHJezf6p-19+a6ucW9$(+4{jg`i?Agp> z#Ne#8pTWG_)|=Vhn6#JlhYwXdc#fRE%u16iOHQfK%w-C@0z^Gdk|aRfXl0=wK;k5? zNqR<9C@IP;^o#15m;Gw#@U2WeD1NK8G(2sdBkMJSu$eQxGGceD^!{AgAn85PLvd4t zN5Nmxsf%MNu95+Mq~&|EsxIQ3O%X=ZzCZGYW+Odngsg1GdL;cdHrz>NLM*CSIFc1N z8Mcgt{Hxf`4Un7G!0gpUa7e5u!GU}4&2yHEY$hBBqzjCM9iK85FPQyh0whaih>{*N z&w!!uZDzUncY?i7u;Tl{e;EMpv+7Eo&wqHA)Q3+Oq(zrx$lXaJvoCpV5s)kbc4VHa z$EnLCW(vEVH`HDsd})Fsn+v#mCAK)ABDreCVY`~<02JR%h1^>=wm8)9FMXtjYS@#v zmU~a?y;F=}Y>tryT@V=f5)f*3A3H1_vAlZfgsQKlXpqPgR^9sE8o6} zu)1t8Cv?Pvhsn=^Y#;t5Go`TO;(9jw-1Xsr+4@Dhg`2)%Xn1P{JNZB?My z8vtrWXmgQO5fB?`mcB)hV6qz}{XTs7Hkb4XGi%n&^i zgUP;8nZ}^2Nw+3apt$vy)tgg22Hq-?AHAk}sh1}>0~A}GD*B|{nJfey)5$1Z5=CiB zh{({?fxWSzQr%)fu>>sUQ`YOeD!5djK~%9h(MP3*QpbTcSqx}?0d!bqWA!88m*na}apY{sYy8uXX zHm3$4Qest;Bi}Aq;uQ+th%jVkOWmQfx%eM82a3`6=n-L)ui@Q;$>xoUI*HH+--}kA z4Im{4Kg#^9d4yGrQ)RGtPxl05=_jp32l11~hhJ1aI5uit80O9~G&RWaO&he{!_~$x zCMUHNh}xQC6T)Cn|8au}AXtQ0GHMu8*I50B=)M6h zb3o56jD59fVE$SoRM2g?LCeCO%s~fW8C7Z8a1rFl1UJ(hvOnFQb3qgJ<9P-1*nal* z;d$u~ENIyiTJiupl~1Xta<*RUT<>z7f5HI7s#(vvaGYqRZ?%@8o0o5amJq=E!9o`K z{0uDJhmu+`Ry2Me2d%$*=OOB5=MsE2?uF~k+h=_d`A}lRMlYs^9PqU1<2{p&h?^}{*@p2sCW`bi3mzzQ=U(=*UK4~x%7(vy*Z%qxg%gGphJNeH z*{J5FLX;#pUsr4&Q!s$Q8oMC#!4vzAjJw$b!2O72>HZ4ao5O6ccN= zR@GFG9y>Ce%hC%Jnl>PG_+29^@8d=&uX|F4#(JD0HS|a@dyq@alq9c<5>zs>NNlzJ z>~zccwZHU1?OaUlT%3tm{_6R6+y7z3lGI~mMalBln)$y;|H1!ix!vTFVKPiqWwDv zM+qh=#tS!T#!8ElOg!X8xP^*ZHLIezg&h2Ug+lpzn*U>jUy8%|7XkC%bNn9!|9{5%_iX=v z_e%Op9%(OhA_-ARWzlc6UsLF0Y3jr%@%5O9nK~OgSvt7bI}tH+B_VjcCS7}jCG~iM zCuMqmfsuRu1o^6psNje9*WubzGYQ2N4MIgiTt!p9fzI^}7?PcdiHMnrDap|v6@-iF zZ_2NOfxA8wC*#*MXXtE^)a%ZWMCd}A1m}U5r03Gu@ZjYR4DvNYvR(`zT+IJ;VgBkO z@)g>S+hFUn0}R5&@=r6%SF>otPrpTAV6G%#cl@tkeRr{>V}INvY)81Hj46DGf5w!= zTuuYbnWR%L1j_uCnU+(ombANtkpxw-jl%i&ZSnP5_@B24Ytl><8-SgIolQW%*~Q7! z&=$rcD_av36*JWa%<3utt^&q$6x#LsrUQ zPZe5_NOW^HMLO~G??SZ=)xVa#vd67oUvg`vetYvmQ`A-dscG5LV!$NxehRz#?Ec*T z0?jr|79ujhCn@G_0S8>EeDXyRGVV~q?Qb*7^xD1U0wz&zjZkT}#r)-><0Bjwz-~~L zw~XOjVgjG$lIw(i&JOi>wXbLqR${Z7@rc>QZMWH;o6n&hYtHC0IXb@$=G#;7KuFrI z<1jnYJQGuJ(K&g0IEXc#H(yW9mqjonASa-1u6)zM?Nr6V_zAe1Qh1>J_`J-cvKkse z?tV--$8Ub+=J~Bd&_wb}vz>*4!@zapi2Wvj0b01G&rW-z#jn|Iy&Y-hd+pEbkSL6G z`RD6Ga<>LE`%L3(E_c0KpT0mu8w#aGvhf%#xo;&K)Y?`shr+&6U6S95mlYSN6s&j- z#WfYT7GIMQ4`l&s%Bl$ID8f5f zZf&hhd3jZRn)c1;*Toi#ShAM%1$daL1m;Ac(E>)m)`qq#a#LY@)$kL4-Qk=CZ`1-Q z_PZCbuD(E{0EpXydzRNxxHzKj+_J}&Yt=A_fDpBRm_srsWH?5uwOoyKk~H~hcq@y^ z2r-VraODk}2EEOahLGBz)HPFA!yy~jo<%1_DQps)2$MV^h&_&30ORCvcmD$f0d|!X zL8LUG48QEOy!h}uBQ)*{MbA`lHet`<%K|Z%g0Q*L2R&6>ybdf_<6H_VqvgV z$NmmmE5w)UI^bFE>KTX;F>We~+ykX%p9rmliNB1!k~|0feVJeZseNjGzYM7onPK(RUV(+w^l0CY9(pprY2X@lW5*;Pggnt8j~7bU~2OdK<`hKNPO*w$BJ|e z;Yp?{q|FjFMCypfI4t8RC@k|vOLhH~$=5X~Udh_YCF};mOmB%~=hU4FOngf~1AE2B*T8 zOZ1fIo)dWHojp~bBUkpipQU1mdTQXm2fa-otiyd_ntYj!zN+%GI;8zU(;E(24UI@B zT`J2)3PK*m@-cVFc0e!W-A{qBE05NrZi50%{+-uHccsoW9X4iznFN_c8N|#1m@vLU z@D0thTrvO}f%H%JRC{r-W9BfzPv00LoNQ(=_=GW&U2;~%ikKy$0}T|JAmULoR>5YD zT+k*6riZpb)Wl8avvdG29CQ`- z6KN1_3*k>q{oj^+>sqU5|D0%%V_L`F+MYZx&9Zez7cV=Nz(=5RO6I^YRv7wGZm+`rD> zU(!86KHF5f$R&JjCpae;WP#5xy@AF)W!~GIEWxNfV>dZBv55|O;*S6gIu0;^S=H-O zS@1I*O_wASMU}SWgU0LC(4SiM;4W+^!lXSh)vpD3z62IDEBmz81KL4U>ryNu4=%Dg ztKb~tT|5gYjnwS~9JD~3pbT-)MHe3+khatU0zEE-zWa;5!;@JSY<&s|{&@!^5@m=n|g!qWy0EwFGX5DY%sVa}uPuu4IM8i@#eIyC$9ut*&lwG$&PE>?Qp zIbAAFx#Hz1R)cdz2-uMK;T24oOIXF$ky_Wg{!pWH>WuE*Sa4ky;uE9~xY ztUZzZ`O3USzbK&rO-L2N@&l#mf{eKti}Kgl3@a{ExML#W=qYaOu^CvcOvD`;rTNvk zSh-C-Np(RhQ%{-5o9S<6O=0b&z$uK@sibh0RJ|L&t@S03OBCvk z+GzE*XE8>}DuA<)thu}X$P6V<1M4~*n?Z1>L$h;B?K_&^%adX)vp^$g6@uFI zsXvkfYi*IM{}Ac@!-~wl3?5~0tKJuadGUQuzOF{a%&yZ5`!>vuWcYyrfd+IG9EpG& zq13!o%rF}Va3-5lD6I<@U4bD%bN|GRWWQXH#P}B`ApjFTsSkuA;bU>cAf(N2h~dRG zw0prss&+a@EE_;^Mt8eJ8-AS8r&BQF*RB9zH(#*8kc~<5GBQx64$1^EtkE@CNM5in zKT2;?$O|hQha{|L#%_E%kBu@nmLV(s>3klWPf<(uEJeY7Gnm(@eBbB8f@M&RNYMk# zG54Tl2_Vv8Lse(~^%yuqEXkhcKzq$A!uN~lW$fjkrZ7Kz200bm#5Mh+K$$Hk#QPfW z1et)-pQBJ;QMkwMH9UPoHHy3^0c~)crP76szJ3`>pJI+&H_GGN z5N-mIFKjcO#(?bZPU!@;FU$6dy5b-%8F$7o>$Nc-ECFok38)AZbD*Db3qsZ#1$&+z z)B_fIR%;rQb7MRC(~65$X>WFX|Bk$m70piW<}W-F-=s`4gHnd-_L zHlSN0h^otFpZ_rW^AQQLzh4E>^0g z7f{$_rhsb`)F%g)lH`E8g&ad!n~yEJHvk6*WS=*YCom~b&-ZhEHF-O=5-z3<;j>VR zLh`hv+yEY^(J`0znlvA#b&AFm8=}KD9w_>6 z_V45!#4^s`MJh0u!`Q%Z2Lh9>LsilzH@XiRyq275 zLlS!?5y8H>H{v*@=>vZb*`7VFNdis?5OcXvlRk5&f_G8A%4W>A%_!&?)cI38{n6;4 z$Q`PB`FIkWih+Bldc6tS{6c}E?mWbnU@I4%s8xdA?NGQbpx;>VV-e%x(bDFPC*FH` zASA0bcL1@7NlUR}`~*4f+vtJYX}<(_I+;OSTuedZyn61ufOP>|svNoIVgZCoCNlHQ z8kl(-uQ0sy-R5N2{V?u&Z(^c+M>)-8gTPx1=2pNz`jLx&_YTZx&@+FvDbEPra2?x( zAD5{>J7@ZsKLyWnhw-*826G!dcEB5R+Huh_?HjR8hhO6dmQS7hSiJ&g@4i&^Q-e_h ztijhKwl4#KbKr_Vk28AMvkS=j`SZ$kedsu;*;)fL>k@~OXRPBIUS}sCe(79_fqEVN zj$;XuAUd^C3bFLD__1`!{I~S4G!6V%k+s9=?&Z5|dHr#W<0bQPROHGd0_ZU|#flX$ z)v<7S2!eMdFH^qgkM7T6nlrH-0%;B1A{*%t>oo*T6;~D2alOS!zfFMe?bg)g)OqC4 zbDfhetzhq>we-`&walXU{tKgThSiFvwUSy;s@zsZ%#X#GdySy2tis%b$3MpchMt%k zeJ71tY(U)KE1dOZHHz@-)%x%fN4;epOt{R+QA?$2Y7$b|BMhH*)cCRztoW_a^uf>j z{7)gK9PiXs=hm1XKB zR20dA1xwGEX}l_IK_TD-u(7=KSM$;MR^}am=kCq4)HQ-bU02VC+)og*)cp+heI639 zF7I*Tn^Hb*-%ZfXx^offehT^^P9n`6pS_&qa(BirJECF1AAJBIpDbTD1XD`L4K6B! zzhLFg%o|&vA_dtz0#9s*eUTea@?Y>+K9|c0hex@W*fS}^UlWK5*Jto8c*0jx-}7^& zuQ~tRlc486*SD3!*V(=fv`9OA@(=GQ+9LWozH6>b?LvP9?3JPB!vlw-^TUZDM;P{5 zagSCWFCj+CzZn7$7_lZNrp70PxiN~sYpUp|%juB^M7mX0Ik_H1`KdB@^V&b9l|<$= z!%3IK%0U*df_^}Q=v^NS%_MQa=vXq z`jM5Binp2L@HoEIRXQze=ePNR1UwPg1s^>~T1sEn7f9`HlcW3lWAB&YO%1M&i-DGi zlF@4O&T2KlB>KM7}g3gR8?r-7pmp3NRx7f?`LFkyB)3FnScrjp9$7 zFftC3gf%u3axBK(6sO$#C5l6O?lyWsyNO;mjW^dSN}w{CvnUvgr2iyM1`)s% z5?PCoxTknW)Gf?ZgK5T42HDzLn`Xxn5QO?+99XZbLmVkyVRgE&yQ?^bg-M$G$dwb% zzED}hYE zKM$Y7d&+St#A>tXvGPGQF`N=7X)9?p4JAT)Xjkyn>CfzSA`SB2d z5$Hf^x1q=Uw(xgC!^y;VM5c+;(AYj}`-@}LPo|^DiCft3%-RVRQu3QA*^RQ%SD)6J z@)Toc&EhhiTBe?sj;iGv$}VpLN{-1ApU*B&A(Qd4{v<&p4Z-&zcY|thIRHrIULapc zs&vNTIKREw;$O5=l(<^j*0BW$i9g^{L}*g|=nFWG zEFU!OWzuCwwwW_K->r3xWfhh4tH73is#==f5a7P)4tYQaHA@#0x7D>_XHWr?kF%aT zuRGxuTj0ueJM$lI>&j|PWKJfYh&XCE>VR6A23(v<*+yDe*imf<@if|#f~?j8mW4hL z5xm=nOifMmzqY`vJcTud{SvT-@sJTpjAcQ8cjV`KhUSPTcLolw#p1E*jb#hEo=(_b z1yH9iawZK5ekDRxL`fC_esZ~)%Wy>+D?^v6jmlI;4YF_Q<97wF0(A5`&K91s8;)f# zd>bdn#@I<0HZoe;Yik=E*r)md0#0w;Xb2(0(gRKf?&fCsU>wp3dh5OwcLf^1*ZPJ_ zngd^a+TfP*&fqj{grx!+p_|IPx?A%XNCoKmsfAOQ8nrhPl_|-qqj>@Y4(Fzrk(tXC zzaWOQ4V1Tp?>^RHtFIw3lTvfasPm57S~lbH&ke440NM7xi2;rh(r$eKhQX4e;$kwj zqQ((fm4s5|T~tM#RZiY;sU3qsGVe9H(-pFX{m3(A>=!G*!wsV&V7{ zv{baHb>7(J`*!UWhdfcu|Uj1CtK1T*|2QQaXzFYEjjR9rpy+&3>~Uwe+2N$AcQUaMDE5^ zo72*5uL@oRQ&m>^E}?WZk-JOuZTrtoVQYdsoopoyH3L;SQm(}Xfa+Z6;++BUhh?SO zq|Whz$A*3)@q!o!H$6RfIm>ChN&y`A504x%x5a%zVX*so$Sc2gde&)sDX8^DEvdnS zs+TL+pD-1zoh)RMLuIAyrOz7259^fn1zIX8+Nrv!y29{=g#^KEPpClsRKBdXdHz+;%GSjk>$C5RDrzkRF9kLDb?O~D7dBlw zc)#Cx0qZp!1|~-ApTg|vDOa_5s`k{9cxgY<@zOFnzbSsglK&w&ND7bO`5(vlXaoZ= zuwBx1GjGr;Y1v z2l%sfw;^~53izq%UAz0fb@jew?+6v<2o^Swv4c&3p9N^0<>z>DfP3Z3&6qYci#9fM zY9SgRtVc$VL;gn83&xPX^PSsxSs_;L0?p%{J)I@PVaGx3@|Gdz`0(<5IuQKIE;dG1 z777twHnYiQZ2qtzaNg{ln`MHWiY=*MuQjnYhEC;Ka>lhoAwY*#mtXr+;~qge6} z*cH4ZEW9(~pYZGG`^d;gy*8`IAB0uU4ws$oZx2@lI%T?Otsc@ZO4&9UZ~W7@=vOl& z;cJ6>M(j5fyAnP^o#Gdy%Sg^p?t8ZVLFuv{D0cuT#yxx^LFU|R3JfHHL5e-y{fw~{7qE#ed!SOpN2!k$0 z5X2-FMtnCgb*bSL6e#E6(qeQsICTN(a&p87NU_1GTvA-fz=P*vM17PcC<{;sy8)z8 zf{1{xvhhYE+%d3t?r|L<-fICaQf^P7$0NML-NGEoSBf%cn7`6E768%i*q;aJYn7eq zu=@BJJ1m9mrXeYw|+$F-Hm@k+UedANB_vmx{mJ$>V^278!X z|136^_k4Rb(AsY_4|EOua-#L2=4+hLyp02%znOC$7fwe^n;mN%D=(PKDWq=+yieZ$ zU^SbO`Z1Q#=2>EN6iy|F1|5?mA>xn!f@i$-(^=wi{Rvn?)o>Nm#J~B5s}CP|7PDF2znDTfJ_+VP%rcM(Ki*Z6dEEXFIe1I)d&HwkXx`F^B(YBp^- zT~&EewqHecy&Il;D1t2HECjL@c|PGw<|oK~C9g^2!kw)2gK$T7fcp3xsdR#+uqH3i zZ_1X&aKkvzWTlsi&Oj&MT)iE@J?a6D{R^ElgtadM`j<{J{AlHAWRR_eDF4mfl-JR8T+U2z+8N04w~ad+kM9l>dWhg z^&hcMY$y-&bl$x_2vRkXoP`wg0I|Gr#WItVZ^t&{)(IlHh@PCvY2;|ycRCSlun4=GU zCujKaLYSo& zHyoAaGt1Qj{{ykroh^cb8OeoNp@VCZayEpJpOy~+nVXG<3>))^Gsm?tQ%3yU)79iz z0Y4_5Wu7SqZM%`h|=&u&d+Rayk+?U&c@y{U<8{UFSp zAL%0mn9aV?T=*6gfIP*fV4p6fJXA83*AI5_RBoKI6BNBjC)Qiy`&UKg%5;6h+R zwP4k6JN^oj0z*zhgo*|r^>7{Ia+W)bd_kw8I$YyEqljfu&3JvNyxmc)76_S6)@$yd zm}l}25y&~)r1ZYB2=pQ2O5>GW>qWndGp?wLb6TMJ4}%7?0C1{iPFlevFk%6%{VLif z%H!}3KSFDLTt1_$r;vGvcj^XcNAilJ?&1s??(pB@31we;kmLQg7Uvufen?~!xGW&` ziZ8}Diz(J;)`ZrRDcuC<)G5gpiZcZ)avmPC1L4Szv|9ZBsvGS>p8>ml5W^ug`kJ{1 zH(-VV{rd>+8DJ(SUy_swmTNetZFxe9$NTIss%;M(uZiW$o z_nU`+4uCm|_8+%!WJl6w9W~Iikde&uS4MVmx@xmxv8{o(tpUpbGS+i&_d(2$X~`qD z+q&T_Qw@c}Kjoucjz4C{+v0=0yRDy^uNuq#+&{eV?vQYip2FBhQb*NpimE4RG9{;mGqn8w&e>cR&_`Y5P2Yb z?gOw)X#`D-7i|hZ@C-Mo-rxKCg;6oa%%IuJ7*tL<=Pd-=!64UJoT5~F({=e}ldnm#-fZ0T*$&;S&?hqn}6npLApOJ$9_+0@rFf=?2yz&+l)0;_=A--R^To1snDf^ z(x1(5C>bCJMv^FZBs7x{VlNf5m%nTWqJEF-&Eqh`ZMarwRx}FtG=WpO%H@ z{-kjaL{_sEq&x^05ocKEqt@FVBgp9kX|EyCWQu79N*!O0n&K#{7-&E)m-q+@Bomxh zG3qiO+=5G0$m1M|{`mgvBr6i&0u8vuoD3@F4*4bWoeC^P{OFPIZP^W5wVJ)M!e__j zzAKMwJWCPiHlVGwm0%^#rmscH5}w0CPRIh}IkldED)19Y1&{M+{RU-`Z1|h&n6E$b zBA1>I%&~7MYTBA}6k`f48;cO7Y1(5%J}3CJC5|ck7=DEwH#*G%F$CjMdV&uvD~kpZ5}7MZ_Z6h}5xR$_xw!*Yv*G$C#jZr|Ljc9iIL?%gy;esp!t-hI9M~qflE!8}K-mYFn&27tC z(7C`b7?cp9)cn{vOMjGT?s{O{!|F6l2G4+lSt|d_+27MsEO*&H`S5k$>pt%JX(2fj zLLjS6(4^?2&O~cP3Hy|}`qZ{9Y}uizEi$65<}oS)@TkznpcQeNNaz8i?3EfsmD6-{ zN79)M6Aqirsc3Acju)|`bSkJ+6BYv3_+GO9QjI)3QYrWew8?$kYBUlV`bIQV)YWK$ z0kytSW{2hQIPo#ICT{YFTx40tA8O`i{H(35d@)qVaqT3xc9pNkg)wF!vG$ z5H4}#cRxKEqa$%5pWpy6p}Sm96j_}g&l~)&{XWX#ulVf>Zdul4s?s##^opwMy=FL$ z@9x!)2xS$xl@Xhhac<3Cy-9Sh>z}s7)}``&-#Wo=doM(9!gEFKDOa%TquUWOBTC@@ z$jT5L$E@Y16CcsY`)hC*m+nW?Psq*8l{+^K-6@h57zDJll_mp<-9nZYt$VM*#>(5X zoQgGJq>E6|MowLyDx0oE@G31R80aiZ8arKtC}qf?k*A=$++P@b zxiJS<5xTVJl~gp0(dt!tMy_$Vn}T%AICT2|Y@=kJAe;=<y7a5Y3pKa#}by$edK+C)|KZLKZZ2A|IR&hbJmk6cas~3{}U;Dd2CF!DTE5x-xxI93R`%#^t6OMj0A5J zAtNzFzeAXb^eb|jqwR#5f0HhM$P5T2L0Oa7?h~*hku}mu&BEn+m@%M9bsYi{6fK3| z=K9SN^)fUGZ$pDn6h`a*lVG801`pc(^7z9MHD`@A>Jvz4&-m(QV0q<&@2WE{TCkljU!!#v-yVBYiUV zJFo~v;9-PNk{I z=R{*6pLm)>k^~kI9N@sP+8DX+n24=@zW1~jz`nb18$jT1q(>RYrgi5dw7eKVJd62+ z_oc1?v7A5FdQh{Kz2EBChj>|qGvkxdFfihq3Gu*y(etMS-jM}?N5Kc+8Dn#cI=mIs zb%E|>E4ezr3G8;>qQ4EXb42M4)a=z)mseJZp(_*9L@}zR80TszDsCccw5%-gG7#zE z5yqoeXp7dyzTs_BG~ueqU^d$_)G1ZQjFVgg;zL_@$2#_LtyATZ(=Io?Fm?Lz$`&r=5)w_lIXqClPm@T zv@tIw+h7c04j=8;w_6lW7_GGLtRwF|4JNCEuzVHcPOMVf1Ig4W;>&4Y;}rl2o_&P` z1$aEQUOsUvsylnao`9?%;H{^JJ%NKTiWYz;1AAM0ceRnOl(75D&l=m-*xUYW4r0wy zRQ_6TDL$65_Rzo9z0l?LSWZE0wtP?l_UN7MFDjcgyyYYAcAY;CLmxkmcr0BqMlsaT zfMRC}>I@;>AvfQI@9X*G_-EP#!T#(_%Cy{e(cvUrqT;+L_dsOp|90bYyb?z46tj#r zj0~omaWTZBo%i$teZ+UE{7uGfOvzyH**>0 zgdo(`Y=M$2RumB!rFom_HLKt#b2RudY-PfHe&Jgl1(6<6bGrlMw3zETY){4Vr=KZc>Gj!||VlPSUmMJmX!r z5rrJ#XN85VEmJ;+lHz!I)$i7egefnDDO>VlupNoqd@C zh$lO4S0`7qVfmz2GnXH`CUXv9coT;!_F5H>P&2qWzMR%(k0)m;cXKE%DYV}H9fIS7-hSBL~pK$9; z7}hG2ijSYjuSN32F2y@^jhqU`i&)MfW+{sBY%XRcTEvN?2GJ>SY!Yh-x#F<9e!|B5 zSs?gl6LuDL@7!di?XKe7M4%>SW}~dLa%|GQRRvCPlIYACmn?>C6VE7J;xl@B8Z2)^ zh1AJ*0K1wfCpn#00M_vIvnkd`Lmcnk5C%j>Fy5kuGQ9mflot_LH< z&&*TWV0t^OHAOjpUZx!PG_X)Z2>mn)@USZ0gf@;CF1b&gou<>x z3u(U`nva^b&xadWbHV71pJ+htdw(k4PJq*_+-tzVmSI)tJ+ThFsg54X%9%OeUYSf# z^+BOYjY!0}u$5;hu(Y_Y{O(khP>jC5$JfI#O;lhjz~ijM95mPwO=Gi_g%k_!mT^&^Omz&quE* zhJ1!o7}oXW#u|)Ck>4luW+HCl)2sYCs+N6gd~cCz0Fmq^jRhV|k=i+qfRw>*Yj_=j z_E2;3T;a-c6sKLuW@qu#I2cXRbW`(7!5t5KIkH<^-{}tN z{+|hJ7ui2M4Na7S_J<_333^xK_zAx`;{KVp1#yMLp)&U1$VyU@8}y}mFzteYqm zlMgC|e4c<1dF>PT+8L}nclQEqxr`93rw4+4=^(W?RCkYEo8(l(l7UODmrSM2OQ=ay zAtRTWPb?~yr9Fz8?JWPCIME0d&V`+Q2HA+H2H2BT?aq+@p3V4k9`bC03b*r{v``TU z5qj*XE{y7N7hQoXR!(@DPt5y6ULucb3uq0d&|?-mt^slC0yIpFq%|&gy!%*AZI7Ed zHwDX*|G-HgNQWV-5A3!O6@|pu3Ki$axm9N7{&~R=6!%-)=Pu&XpCnz&h{PR&efuCJxT%vj9T^RO1B2|& z9QQ2m2>7PA{^aCzM3dzJ%d@@5G&QO6QRW9(NSV+uFd_J}+ECyl1hmD~8DQLeZQqj9 z8mZ2Qx{QyMnvO=GNq)+L{&V6G7l;Wc6QD~^!hu#BDrmCre1?sg(_d^@sP7^&Dx7v` z=nRa5ID4Lb*OTcy*~9RxW8#=$F!it++X@-cl7iT$u(Og_`k;h;AH>1B+JpZ#3PSjfc`>t0T`X6D^32I+iMa9aG!)&}e z30gj_iRTfd4c0}vY#{hN5k*|HC|biQ z!{Vl@_LUaD%@^Mrzx=%uBGYg$_%8IYzEPH5WQM*v!F#lkj~;Q60~PFN^$W!JKdYZ1 zz;D;cE%4v=DSKxVCaBnUv6o6{Q%*%s0Su)s2{NX^vEXo*J=3S5Ja(LP2Y?QdP1k0O zzMxX>*^`}-gPf9UKc*CJcTF6H=NmwM`a@hGD;@GR4$*oTCC)vKk@9EY)VJOc3ceF)gwn9!%R4BEMJ)Bt%?-59c%$$`pCzupkR zLf1E2)3K>`Nj4qX)9(01yDATZhNaW6RrB}4iX&cA7vvC%ph9G=jWe5K7wvfzx1!Cj zXYQnB)&kZvYY82g64XnMQ-WgObAY)=KLZB0`hbUsem=V(15+gx7+|a4KajGlW!w+1 zRVRbf0JM?nR{SAyUUqF@Z{Irp6V0@Qd0NMcBtio%LZkUR=e ziANU^9R+7VSIB$~MMl~*l3RkJNW?@VDyWDR`5+tf0VtrmfJmLY)wcIur}NjD?|kp? zJKrCB_jm6raV3|Y1sT-tf0lk7=31LqoZ~!Wux7NhH{QysWbgg4GY5N+&*bs%^rQYD z!#usi-9pde!gZgtTx+eHwYj-**20%_uUzpP3ft~U#ZH^I;YjzC%G;G)oecFFc;&q$Z$=guBn?Q%FSYIg2@W2&vgWhTPC?^Id0J}oc0 z-H^E=yena2jnjvfU2jDQHJ=*FQ(p^N@l~(S#F`~1OUI=Js5K4GI%<~9?DB{zc&I71 zo!(eA(o(Tv<-rf;A8D~kIegRj)3=bh8Z+6gF|{td=)#`JLyjH$bB)3!-Km7CCXbS< z_W7N+VzY&m^$}&C4VF&qyy)k#&ac%^=*`ybO0U3F%oG=|MPWaaUnL*=bC)t)+G>XF zd+f@#&S@&H>}xv_e7eNv?xrhQy6>|ZI!6jClZ%o{t)u%7mm3#HL~gE4Ee@YwJ&?Pn z;zZr)+8Hs{b)UNpc>QVjM6hjhaO$o~tDoR`AZN?aBxAjY>oMo1ZM$|9+#BJ~*T3p` z-Sv8N=a|kmr*rqJ0%{ZY26v`EdV{gmcR3`yS*<(yxX|X~y4cz+Lwg+Ze$0q(cfPPH zZanq+@%G3K)Z(Y{j_;R7RE_bin0j>Jn>*#b-8*l)g>601X>;fDcthIT`}YZHM~kL~ zbhxkF{ep|vGWQpa9t*OwkBxRO@7poC?4yR+??qjHxM^;6>lvpr(fl^S=5||aa*q8# zeHYa`+j($%Oph+5KcLB%4YvM$Lix3`*B*3E&05gs)SK5qyf(KuvL-;9#S>Lpg!AbA3s#TS2Y$y` zIkF}=oCO18VyJHno#4otux%D+tm!PG)qm1UtO*5Yai+UiOzY3z)J`QZH$8eX%X%#I zg}|4hb<2%v^S;E`Fn6t%1{zAM@dny8YrG*$Bs;Ra8Ab~eDW2D?O<+9Kx;(>N{rKOr+JbIDUGEGo@&}t zcLDJt7*2ACA!bPQ5*iIKlqMU13`kLcs& zP9v66WEGI-`w9;M2Sh}rOd*dI3OS%~n#gh%(V3J$fH=7<1^}9Rhs1A=4sno{*BFvl z#VBYLW0^ve5lnHEycvlRPF{CXcAfx4&B2-S4=IM1rxhafoO(hL;A<8ZHzYRv99c#B zA&am)5DX|md0jYK(Og8Bkw*u4#9BroI)eduwT{9;Rz#|b%baP*liZkS!hb{xB3@oQ zqELj@N`w)|iIYu2qaapXV+vzM1CxJ~Aj!=U^N)A{<&h9!MZ-}X4di^JI}|iBQp7iu zN*&~Aq_`zy&Is}b!GHmBVRGw$#B0%Mh&j142s1#QYNC&mmk#mfIU|^BLWC)K`VmWu zuxv>r7_cJ5SxO@VQ*MOhg_Dk59XBZA6MYbSP7$)OL1ZGPe zqfjAiBAP~eszy$K4RA30P&OjUx1OquPWWoQj{LQgSgzK-*)MR94 UWoQ%aSendJyE$`0qC)Nd0!;0c{Qv*} delta 42178 zcmZU)Q*@v~o3$O=9d&Hmwr#Ux+jwHzwr!)MPCB-28y)}eKi|xp%u&_4PiwEWYhSyn zVFRKe5TXGd6qwT5aNZb0^*hm&v$IPrOkv9Ux%nb*!)j(hzJ{7vwKeOH4JL|eqh|?% zo?hh}IMKfk$jyKR<4TLGB*}~;x53K2oLw)J``kjJ%AqC#S^YzD2ew_h9hvpjqWV{)HdtSoURO1HkvgWDd~5QNKNPOo;e>@H6Xb zLZ-yxVTUq?D?=MICtvc%L6*gb0($-8kIMotu0~(mIU-8~s`?{R5<(@e(;qs5FjN!_ zs@tAzN3cA%)H9h7tX_}%9F_&ylXs2CU-A>`NcIf8&>TeYzKC`-gnFAQ>v(49J`BcV zC33yDKm*N`b#j)po(BJieik3De`T!Sma75ZC#~{rG*`9KFs(rpoH}y0x=xXrn%5*;Vf z{COg@(TAYpyuV7hgc$S2bz7507_Cf%*+wVAHm#l$(R8&jT_G!>_2_hUDWKR^nSfj= z##xn6O>7+F6M2e*{-*bAG4a5;uy(QGL3n(#y@L?wDrbnTDRhUXZWE~Cm2_x%5~@Rs6b9D+(BXWcg3?CqM`aJPo6#&Pz%Pss`|aUb0nRXxwxR+l79VSicBZb$ z?9f$@h-^CD%7@rB2V)*)leY!?(7YNCaEVw_R0QNejYt`aVl>5DoPZ#GGKE-xqT)0kJN-RP_BZ}O0rvnSiZ`iY89@+N zqHtLUn`8~#M+^0OzOvViutY~h_!))YAB(k{j#1xMnkPM-@Q@`;5zJj9vCh8_d^R3h zH^%+wlN)BjQUdA6)jhbE(raIs4&DfKYpP6icn?AB^*2-3k+R4 zC4uqp3LAqgO67y`no%~1zH+m#>5n}3tE7pP%Y79ytY;jhEd>F;%e5zsXNCo{`3s3i zxH~gk@H{Sgar6fnqRNyWFuk6tU3I0uE-k?&7n8D)N4S+0p}qi_XO~+lAT;m(XjKB> z^wwF~g+=a;7-x4kBznoq8^2o*qvq^j@Y$tSutKZ5ZYhY(Qoq8$P{g@t-DtEE+gz!o zhwUT$ipS_DCj(ke8}m9t@7M*JGsFGPe^ysf5)-u9NwT8P|I==dP6EF@v(7iFk5s>$ zYf=Rx)UZXArQ&9_1A8X}8rfN4d-kf5jq?V3Hq51`Nl|l)&3UAcD-thR@s!F!jr(!0 z*A!O1r6wvXk#Mn|lc*9dS9!UD&VTagILpO9 zx&MB#{^adA_q6U`Jih3bsi!|8S#$n-XY(^BR2;!c6mFgm4aJ6d-gh+;V!Q3}-+;f% ztwDiXKL-5_&IabJHDn1IX1j{5Co$wxwp5V{MG9%H;&ROS_OpXw}cMbzyi z6{mDP_fu0V5YlQY+<9oI?CVpHbHJS%cc<%ZjmaMJ_NO(p$Bf<`37Q#x1Mxy#po9)IlAu{8J@b@2ud1wM$4M8cC7U zx<>!(!~-QAHvxoss91O?x2>=0t~?k~s{_knUCn_K6;h zp-Vw?egIC2 zS1_)Uv#a1)pysJgqBhFs>E&-`hs@#C>Pe;Y1u%l4gr<`+k{;q*6$X#Gxq z?zVyhaQr0as4J_%??!8&w&@!XQ+%Dr-}dLmD;J~%>u5EhsrmG0m(~ze&>|;92X}x0 zSU(h0iB8b$-+Ds9W!+CM+$qVtEhhR?-uSVzO{ru_m*Reoj`*^&;!6?#a+$*jHsM>l zh+UL#mqbQMk4En)qT(6)-Ug{zL$NOxH$b}+$iuZC7?n||F&NH$3GUddx;2b^2PR+M zYzWOrQLrXvaE;cgPlT~O`xOZb&)_%cUOCZE?-(wE9M9dabgpK{ilseOg!7F~)a3JQ z{t#v>hk6C2ZfnZF#xAw|bpH%!lYKAJmPVnIU4=4Zy3tdxvpLJlWLn2=Ga^M4??Q)E zYnnkNMTn5{n`mcdttc9B6?monc%^(*0L?YCH+6A!HZ!(^`_Indmo*#*5fjn>zp^lM zasJPYh3UVCe0+>@X7(1YmP9Pf$%%$!K&qOoW)2fJ|JFTi6Kf7>CLa-5U6q@4Yg{hU zS=l-yxUv#93O2vnhTwLHu|bz5Ki%%3|4aAIL6~F!D(I@f5HB@8!gY>h_+z<|CpkHn z^0X!9I=I_KO%N;$H4M3^2$(w0G3hQsg$4B22cDNT&mF@IsT=r6EPT<9UAe3#u*HiG z9l>J$kH&46%wX7~i~AH69VC@Yj!2>e4{SX$v;i`L7*0+jfDFcEy?P|tOfP^lD~&Vj zZ=q>C6c}vr1+)DtgwwQ-Hyb{{BiILVK5@6SGS%OD|NQe}SN@>z|8zz}!Pt z9F$EYo1t<_*1wUO*O?QFX5P-gZQI(`7P0V8DHyu^74$lACg4OSI#07QXuUZ$9E$F! zoq|z#9150YT9m)|Qo*{Z-M3OHt+Y2ddzfYF)X$2{j4j_W=LmQ;*YpH{weyd2gq%kz zNws^oeL{=5z7mVo!F^Hb6{d@>E`FTYE}B}UjSk@eCRj2tZO*rbh?7^poF4S`Qh_9r z+r4Ind*v6EowN&uspWA0HyuX&j-d_MZ>>YS6&%Fmb$&+((ZbfZI$~;r?gK{~(MaWp zGskT*?YE8WO62wc<0|n_W|?WT26PKQ3eT=qFd2Kr&B5bLsho;6k#+di9RoI zqs6^5^?+q?!JhPg6w1Q<-)iJwBH;dCiL(7)iL(EfM5lD*T{a}pdM`BPI@@RtF+okB zcK#j{aWAfCuP)2fsG(7}LMD;IGQ%=~SnBj$(;xLGeRtGbFa;yaY?nMYrHZ0~Wt^S) zf4;fJ`hy)^0|B5U%+biH$59x)AQ=)@b$->g^yfC`e!z4HE=y`k(otb zMG|&W121d)jx4WdALH73J;#Dvj0SmqukV|$?q3H}WSyB!)!|)<8)y6JKlVcFZvASS zwesZ*EX3U@s~H!6aGFLhMdo)1C@wsQzOnP)pMs8tM~*&$3p#=`EY@i^&Tw4*?LG4u zb%CV6`(Uw)-;ZE&`mwtAFLC{J%Bo!%1b$&S1K=u$o?+y65X9JwB~@e!e;$P=bg(I3 zvwMZMaLdQ=nD?S2^gcQ3RGd}xUfR*va(67)npTxmxtL8{<*{kf;keZIL8x1n^PIuR ztL|ka)LPiUDu*Gx7;Ui(SWoZ`G! zR+LnJ-=A4|UhTE(IH4dxGtZ7LZ|n4Q;%3_t_=$Vn-FM@4d}iBX#HJVDjf#LLGUWT# ze9`4MOi8kLJZGuScX_o2W`@_nCdP4R037yZ8uoVhx;1(}J!2J zVJy?^bsOMa*d-=i(VDeRq1Z^n;1C*i@FD&)3CofPXLi!WV1-Wykh2mOE98B~ShU4QM?j9)R>+#g9;SBF67 zDSAuvcHs}OiW7udIU*<)Z5Z1_6i%4P;)Ta--=CE)-xMM~m25x3t~6uUrM#GMipBm2 z`(3OB{_JOPeK8drNJI6S!1+RITb2lag1y2<=+VC6eTpY|m7R%k!9b133jCA$#UQ7k zvgZn5my#*Wkb>*|(v$pEI>ZJk?K7Bf%5H4Muj;fpPT_){H^3c;8%p8A$BA+7xH8@< zcSN?Y9^4%bWub3p8n%C+kjsQ&KRonTmre`+H#sYqz`Sc{M8kcW8Dz4$`gzaYmJn4x z{O+`33}A6FePiu#0cC6O7chL`R_779)_@Q1u{3=$xMMkY!TCw_n`c*@lot{{@P0Cp z$9X^)Nqw8GAOmyO4IHpo($S6j7Kd`cKxYT*4_-`IU_{sHus{VVuT&ST@TFdF!d$55 zGLBMX(h|h$0{??T^Jkl8=SCL&)$qOV_q;{teb5Pgr!r4psH($0i zh5iMKV3TQgs3S=kgo&>2y2&)RwwU>x`i5N4O7gX)z8g^{4$5RUY2IB^=kbD3h&VTF zgD55I$Ky;RO=X{(1dtUvSu=7_bMv;wIqV4YT!33%r(B-j>-xbFs?W4OX8}g2rs%6$V1Yc3E5_qrD@i zj}bLuSWgL`;iPNNaTR0?XKUh@15j2|q_c|#Rb3?_^Z4g#0B}6=@2}%uM^ah05pd;| z_1^?bWcCIB_V$W(O(#CmZJ(S-o$5Yh<-Hh$5n|X>EIAbW2(GcZP_6YG#XKt>3#xYk z=EDlPdoFC8xdmH4TK8Lx)IG|8f=fh6qeQ*3hD7ARLE7kgK=f86lUT9 z2fOPO=-R8AUr1s;Kou$0OVKgwV2Jbb=%_5sNG>0O1GN&b0s?H~wGnXxPAzJO#Y0&1 zsZI+XhKeB2N$%NAj@Gbr)!q#g_fghQ{M1{2p{07&X7 z#GNR`wMA04L)Aj*C0DQG7Yhe%y`mJkhfC65W(gs##MI5Q)vDD%V4H5aO)1X7q ztn>43f>FsImx z2R>?86pH-n^!zK|@gAqe!>$~}*XxG} zpzmgFQH4<18dN@sI2f$7m6CAQZMovIMvaSs(XfRlnr_Pd#h4j$)ZRjs8LrO4Ns^@9kHcK4)UqYM@mgptMIG&dB z6m8}nt+(dfN#3}~>|KZhQS`7fjVe}I+%DP^+vyibf!I*YVCQ4{P>i!7Vp?g~IKX+` zmA7fGikjH+WK}2Zspce#g#okY5!QZ{e;z)*WNoM}<|qq`mfkMo;w{WGkch*IZ;AVN z7&=>wR2sodfxNyTO$4?|=+| z%{>||3i>pNq0CHBt$-P&if$1OUJJv9$c@8mU4VD&8JM?Y97WaTUGA8991Bqi5NJ6f z!mNzjsM@qwKWQ_pEzu*@S&SvxU91K{Qr$c2xWtur33t!3WIuru*4!?#1d2v$W}As% zrASp)n+>j(E~(VIYfVqFf?@kkk)iTZRC00egwe(F<(F4OuO#BP<=Ae*9!)mHqqngg z(-cLsW=LIjXBk{7R_qPudCz|(2s?O~q~nQTj`COB{Jv1Ol^j;uIsm2V$-)6EVK)KK zLscz8RpcFcLvI(4chsG^08HBbw$04{6)IZsyoWp2zsXk#k44t_b3)GZF+N+x1q6$# zp{Sesjcrb?A`MiR+Tf`1{ykC#-d-ewrg*pg2Jb5l>_3~bmaIMJ< z2K=E}vD>m33ETL>_0*5+=@psaHpRSLd6fkT|I9a6>20oCdfFVtgEnw$=Mt61Mf1Yq z^JRAnJ@?}*mvPq%NTa-X+Oq#F#F)=ocNAg9bX=69-fS<9XN2Gg1xzN4)w%HoX^1pY zCKkKHwHL&BSN5{t0KkG=^TdVZ@y@JKn;hd6B7x~^pEa&tzPB7OH9HsNLFL?UX_;r{%6erAl$v)9M?o%qPc>buW4<+_MFcZ^uG+J!q1y@<#lR z_vEX~%+X;b&t<_J z>^mtK$K^3EnSeK?MdhOPRzE)TjH>incRI=L>u2Kh_svtOV#}4s>8+cEU)lwHr1Bw{ ztDA7Ta%DaeHVDk4>VpNyb5uvod*=lx*OvX;yM9{|60B&cV3+X7suctyDzc*W3!lK* zQ^^;7{#(u$07rs@?v!;<)<(PX!r)#=+(xM3cQM4(XsB$Kx7N05WhGV-ttm??T(bA6 zwSrf)s0&LV$$<<7Zq4>`jM0p#Z;kSon6T+cVrrnW45Q0!*T2^IFeP>qzS&DapP0n^ zsJngp?ilgp`q+Fs`h%yqpk@5~)%?84y=p-ukc}=2nP^ zffMBgWV7k~ySMgwq9^m5Gypf?BbU?xNjJJmn%60QhcUjx^bEtO0T5RJd) zu3)6B+F%ij9aR7M#S?OCuTSE&l{F(LE8)&&cQK>m$Gwx2DkIQ%|FyYQv3 zE-Rvj{wy#faV*+1>fXTP)i)V^V)E1B{-6p?Tgm?gj-Dc5?FsO8YauWa=nbiN9*9~c-eHR`=BMsASvqa%0Dv}nYF*a2+1n1 zcuyplt$s4~|8WL=@gAu!r#!5b;>o2j`^I!9lB0xN8~@`ZeFdQP=33%?b^h~~=F28al{oEG7@ahzG zQ^mI?XK^)TH(8}aa2iXfW~^2AF_iGT;G-Q$fy_u4bBUW#s!KdV8{iZZ#~Zi+>icgB z$q|ydB6-nAy?-AcSWL zBF^ja3qqezX5=ah=l&+o2$P<-Ku2Q~*Gbh*7jjWF?Ip<-`@OJwLqz2iMt^TIzw%_lfYIgRN(I{pXNnny&T#CZ zwrnAB3{1v%CY{2>G;_;#<$(GGEl8(`7sotHZpm9HZPT4}Hzm<1CRTRY1}fq?7Zazb zy95|CTCw~z3fUjNm@wl;e%Gn=05y9g*%>7x({Gcva$Ug)?LImKmvFc$!X7m?r2TQS z{I?KYRfeh1ABLTQ2QKY|9f_(%0_|x^*{_mY4uIzfnyAXj^jU>JO#`j*)n%V$`^RF% zP@K@_NJT$ljE!@uLvcGJRqO$23RUr7wZfryq+S^;B=PPmGy(ZZK%`AP??0ym!qMQ@ zi={6(+sDIfuDq$L^{KH#czEPK+a2*l3u8{l3_Z@FDI!X{Cl{#(*-BrPf>j(QTY$B{ z3%Cl=G^6r-qpwA^V3>{>(Ud?~JF`b&qivvb6mh#Chj{OyitufKC6?2&;Uy*XRo|3t zP)B1c{F?C^mn)1+6~ZIu563g6`XMZ?pl=&&{i`)}@U)jL^N~8?q(y%1u}k2N3HAei zd7Gyw=Pk=dc%ScBULD8SKZk|z_rJwGd0@Id6r;a+BM5hPFXV}FVr8W|mN{vHPvT2x z6z;E1$?NBj#S+wTIJnk69pYSaJEXA4-@Hb6y$P5`p?gX0aLH20lriosyKL&+Xj9f| zh)i9pq&syEnkzBjd1zt~B@*n4#YW5neWP#l)2w$~noohQT@sAZIFE@I!M8zfU;z6^ z@@-l%c)^LnJf{O7=r8p(^H2XDqvXp$UJ?K<5tb!cn3m2e;qElw;wC@x$Ogfv#~3Mm ztMKT2Ue4-7NR20@q#m{X4e0>a0DO+Yy-rf)Wz0_}2;Ph82mI7#v=mF@)KF=0#nM~r zr8**Ck5X`KY0;j~YndVqIEc~i1!QVNgnAN|Rv@ZG?O;#cV(0D@WCx+SkmOvTmC@H} z)hDnXI&0P`FuchEFGUUCrxkWpD!kf-r!hhjiV`u)L!a!6C|it(_+Y3y2zUZkHlANo za7M(vG9%9(A_+)iNoON=lLNO!#>zYBc{MuxJGDy?;}S)0)(fx@Nh25>$0 z<=-Z`U#n|VxW@Ixkq6dvb+A^xOh^iYH#wwuywNY>n%eYOnhu72qBhuqfR>JmTq_kr%4@!0RI{9{07d-Fg>Pyy%OaNe$Bve#0w-a{2Zhs3McR%BD%N7Bd5;j!104+2J1H~4#%5nLCM6Y;2)ne&KG(l-EF>tRO{xRr0<6> z-4h>%C!uE9?b{ARNrg>*gbRDRsGWrw!Yajn%Jl<$R$!PH79MNh z+KJf2w1{^G;^_gm-XbH6d-4jsMR zz^f{u@wcw-N2FilfLGDDCyP!J#*KIlDIrm{IymNbuqr2=r8PR?eqnNC++7Xb2*G~2 zrw~Y%mOyY0c?&RDv4H63o+Y7e`DLKj?J=hByDZ@ej!$rz0U;a?$9sEOe1w(T&_J7c zVXp3XxJ+vk4Tq2}$5Oe7?XCy^fvuK2$8&M#Cf^{LfyE0e(9#qag8keOpLcfIlfDZ( zV{U}wBsld_oFdBXIC;4BFc9`c2pL0`{YF$298l5GouIn25vGdu=O^4y!Gn%%b{eN* z#0V<{-Cg!tg}%wieCEN$UJsJkSlT-3^!5U)!`Cgno2=2KlupVA_Z11`JC@`MV#4FJ{M5@u^yhW=rS^!X2re zss7mrqFmBeC$t`>j{hv}*=x0&^|Od=TNa55UM)UWS=2|9Opy-)my^bJJE8TDRgdC&VutKZX*k^xrkE_3*JAU`##+t?|b{* z9n0h+l#dC>k z-%5sDdzl(>TcH-uA-IJlqQ5(n{7_O2UJIVZ-W96s5=n_gS-L7cgC@TP5M_9oC1K@; zMy?;q4=nU{ym)uKoO)D@0t!Ez-<3Z@#=$NQZmVO5}E5k_GU!Zwx3&gx*2RJn}N zJMGYG_x+Gpqr8}4y zr=9#MM&(t4fsnVxr-Z*vtF)cI4VmGEdzB+*e{P(OC9?igKC{;(*2-)YgqZ45XgOUnmz0~(wN@N3tMdyo7qm;CR*PexXx z2y}|#sXCsx|FjqLCA#ow|hHqbxR+G!`HX|)D5vZ-P9FMjN3c5(?n zDF{`TNU>IuABjD2Iy~y9+=6XIDmaQoSxiJ9phcL7F&C>4bw!-Gz2*qHDcjI=>4&=_ zsIA|EZWh9A156Q|mMd)PeqDOYN5T|f_YH+GPKVyh8oMHF6W1cWw!g*bO=}MpjeEn4 zPn3ZI0T`;#@QFN&(Cgxzr$2#BBpA;t@EJ(nF$+qy|2|1xA~%E)>ccVuQ4q*o3#&de z8RjJjc8$|08V2xisHQOYs~X_=te=M08A@l*sGhlK0L*gsGbRxyHp^)CI7b2PKQ^CC z>KZF2jEvI;#ZNC5nu2vaB2(LPL-&X;Y-~iA2WBC!2bs`#UYmiJcvV#?i0gP{4RV8v z*_ZrR2&eDw!ZE8n+urw0D(jwL0ivvQQ;FT@}W7e`E*R2Co2y2 z>nEk*-G25hB6@m$;RY>+;GSL3e{MH!G*r{$RPMP>MY~$%blJ^x_I1|#>cg?N*(d75 zo>Y*TcA6LSIxjK9*HD`Kvg(Sr8i6WkQ^Yo4fQ(H8LX^u$m4sz};^TBp*m1SGNX~sN z#Ei)JI^vk-D(SBn> z@5MR17s}_ijRmgbd8bF<)o)v~)mDQ@vCEqP`EA%=A+(QWQCE78C}|2H^^ z26=(<|26UdiP+5C%*@HL%)&sa_FCMA1m;N3IW1fmsH$+Y8ocI-*?JqAhi$u$j!Z%c zK7?%(*_=FvS<_&{f<2&1TouZ53ndrF8} zNJ9_kL*=Ru6e8u`qnpIYTa`}h?jqlwA;P?DYI}2Ha*lS< z5P$E3NSd$hr%$wNMn{i~u@l7fI!E_txT{}Cox1sN#ytA~Tyfy@$M?uyU5RaLueED` zvXKSixQJ`vW7FN`Pr#1wTsR*0Mttu+-uA7%?w;=-^S0q(l;!BTG-cFIw@sl64(B)w z)cbgjo%x$0d@|m1d%>e!7Zo4Qy|^Ma4v-?JdcVZW!+sfxmJYO?HY+e2w`?tuza~^q zQI+^ZSY6Wr%K7fqcKps*ACWp8+g$C^-kh<-sB{r{#LZ_86NFHKAbeBHu$%Jc8IM)kD!*K(P}`Ygv}1g{y;e#etR zdWCvb&MA19M(eD9VD-96T9AIZc%rP~<9h}myKWHzLgBNnP7^G#zIMXJ~x3A!0P0;HL%7QDB^qD z(%m7$sB~T-+uYL189kO3hMd#>XzJAG9t#dnrA^)Zf1C7;M)*v91XBxkO41x)9HKa2R74=W|~-i4y%Tm;PF^eNFGZgaeutexsRgjFUXi>XT05Ska;REyBFa@79!&BL&bVmy| zH9db*d?1d=daaBgr8FEC`JgcyQiz5(YaKl^k`WyRc0D`iHQaBzO}$@SCV%VwD+n7{ z*p~GZwq!(6DXgorQtV>8&iKjnD-!e#5&n}wb%+8U>R&O(#?RLh0@uN7B+Eh6m;Uv_ zw`C0h1O}wuH018tkNfgyo8Bl@qUE&I3ea@-r>mpv*CVt~Q#3HVSwnw+Kc}zDCtv0& z^c703=g$ro&)1734+qSC!(2v8O~!g)2J2zRaN5vts$MeS>Ag&nZ^wC~nN)3j9KBYu zGx-wUjl(Drhdh<*s2hSy+k(&&D|OycrgnFQ@WGxKJYtE5JL>yjhAnb})9{QkFfoOke-lw>bEg#H}yZw(MJ zs1lpY{FXjk=y{e>9i_(E&KcG~u_Sv19U%r`Q_4)len_%MG!#yWc*g$5Ub`HDY&Nwz zIcLtI)wS(%=YRmPpyb>36xAvK7xN+Kplwssf-WSot&sb-M4dH+c#fusaDM&hl$>E* zJYg0skB30nuW}q2O$??kdqb5~j&sOqP_=UOvPg>gHtZrwq#;iwotoH|(rQwPiM)9c zJddPm*wX8wB{d+D+hzHkUdz7Wy9HH}UnVn98hU=z6=Jk4*Fb#`61okDoKGc{1&MuH zu;haH+zR1LcSlu%HL9k#&|d}DrtBt!lyB9!l;qoaWujH0hZ75ul^l)Tdo=h$Ar06*^JeL}Dp_GXH z+Uv!2MCR5&IHH)8Db=3>w(8R6*WUv-OABjLqm!FvgdE4sv5^6hVhj=N(T%VxD&_|I zN0RyDCsMgkA`^L^fM&RAUoh;-$`wVV!mDROcJ0Sv`AwI?oh>nKt|&{NrS7v#4S%nu zG_%@!^vs$SpWn$8WOhM|>>3C%gG+3v4|7b)y3axP%;ZqPxMvxIB@%)R0eUMx&?VY} zh2JBCxC9D+WXJ#-swik-)d9UYFyqE?Pu(!l8_v9G$Qa?&!bAsM5I?O}=eY`Gp={;t zCuG>~Z3=|2XEOv*hiTap@lReTJ+h}e*0B# zM<_Rg4~!00T$ms$mJ&yIMaDDp-Y>oD!P;eo@Y*am2w4DS(#$j+TC}5m%4KdGP16?& zZNpZh5D`W+=Q@g7CiVys^lN28} zFH8+Tl}`XN^}J2YUz=kj1;+y!4y|ckjPK_rNQXt+k!*&-qR?9QvQmrpuV80XXU9g8 zR&e43vp=j0HLfiijo+9c$gc@GtDO5$mb8w7mgBizA3iv|rqCKBNgiMds}4>ZB8=jj zIa-_LHfM~w$Pnvew{1S251aEmMe&|Y;85!E6zc)v>k5aq@0}Cq!*9NR?ytRtUWEmJ z_y`2HI52rea50XPlCy36KCMosf-~Z}>T~^XHS7b_p)*ayjF;>$#-yr%=X#(?%-TkL5*n^Cn;-71-^33(PAi3NsDPee4xUZ zbw2TZ7cpu#;kFLHH2VX>{I~H3gvqhdGx==OK;j#9wareO*FrLJAF`Cq)1pJ!PCrWG zvHsFB#?q9Dkc&Gk7tn2Z-cUot%#4g?D~8%webn=o*tW0<_zmI&-92C5{nP-+iC{6lV-Mvf!h zp^mf@Ur*nZN!_0`a<`gFFi9%D<2ow$ae1vi~@| zRI;khEj(~c$g1MEda+!=hUz7b?_!R5C~GyLd@R_Ry1Vc=o|k@A03jM;ncf3Do=>~jvuf2 zqV7_@-+s=o3H8L9wgJQTZCM4v>Q0qg;QmKczERrS7rvs!7L^cd$tsb zknFdI;DI+2&!ViTu(nG{uLD<%`*4)$Vt9H1V35J9axvEx$n4s8~;! z4vmUTnLV1~_k>uwn9F`F2h5Ya5WoFv13Zm3zN1f|V^H*BDp89)gHiwG=*2)GMSEHw z^?Z}eZifBM<_vUBY9cY#7-3c(8b%EoPf}z#QJgXGd%b^+&OX`kXDw^V$R9gF!E2{$ zx#y&}^8HFvi`XQ0Z?7gARV&cbnTK|5emCV~>Uv<19}h}BSQvfi09v$Dc4c)|OnSGH z-0N{vkolFTs(7!$aSBRpHUbxqEh-?FvY>FAiwek-2{*YEnp5ss+~#6+v&efKorHf3 zThd=(GTDO$CN}6v+^DsCx;&gj@*zS0Jpt)CS7WD|cQ>tlE3~1cQf10|-*;5mX0#1D znETlLRCRU~7$5Z;0WKl=Zh8Vd5kuvwh4^!G-DReHB*~3(6on8v2yWM<*$viw79W*2P65S`$z>;!*J~x?*#aYX%Y!-N{ zqi}XH%~J`-=^7hTWh;4T9XOH$JgZGC_95m z*Dwigv9FK;4Pc|m?xIy;6?Hb<%A~Q62nfd$L+cmGa=A#2qC8KZg%X&-YmKZa4faq= zy$e-ByE-eC6w4fc(WK7En%kH%>ywYT@-ASO96-o$f#fp6-{tD<9M*&R0cgA~D)>hL zBxWUM{%M41Bs>d)e8OjeOVdwkS!z~3m~@5ugW*kbrrAmOS!EQrC4WOs573_wU6aj| zi37fR2(ArzR}dje=m!e?v=D4y_0VnuhXv z;=D^G0M}O38B@>%WB#YwI^X&rm5|xXoL6s9^B}1k^;Y%u1ED$AET=O*ahCwht6EID zE=_%8aS?WKtMnbvZFx3|aPwN8&vYm!3g;~El|zxNA%eYz!@jT|9w3opqF%&B3#uv( zw?_)Z0fQRqJ2yAH2wJ8`2LiPMEQ+((%jrZjKm|ji)t%hrm9d@{Hdat_4(M;(NaM$H zo1s&ByBU@11W@EcUC248Udm{5dP zP$qUrPtY_(BQNkz5X?|hVFTkY%Xl41;=%L7&eu;nSMYewEB6hCe_G}7*k?qTJ-mx> z0Me{>c0B0utM@Ta7P3=ssm@hf z2M}Lp^%cntZZqva`oB2Nmvaa*JsD&k0BG~az1*gW2XEqUB@J4;@@TAT4vq z7|8BTYo@e%ai)$i15#8{NV9HW3|e(7 z_ANnU9z4|sP!R{@GeZ}NS0mAkwt!EAS|TyVXBY%H%l$u!<}D!)kOYU>Hhq+S{MUa5 z`}|{<+$w|Yhy>vU2L?H`p|>`3IuBffvM=YWiKfrZ=j*NF7C-_=4T=Z?;yBCbj+F4U zIU2={Vfau?=)QDXALJ5CLuD(*4{jk3P6)%H@Wr<4gZ>4?4SNjqe_CMUDFE(P@$cO` zq0~nCtM{rs!DOiy6A#_FbVB=?Jd3>KY z0B^Xb1#C)jE*AH7zDz{NW@$s*Q)~+aA1SP%^hG+aS7qyK&5Gk-g2d;B{#UH4FE%DV zmk>Pmp$ISM*vv5P+U_BJNZ>Qf3cGO%w~~(Yvp-XMHEqRZO`A2kNPeaPa;#$+Lma%% zM%TPll;YcZL1Z*frO3s1-ZXRV=`}289lW#txK|f+OMB0|-C6HLftaT=_!b?lu_3xf zEZF_QAOXB~MvMwcXJDbHmClR`(KUFOa>=^%&44tUfSKRu4o{9&0IIg&+bK__-^uJ?R~x%c{GHmqpkh4b8S@C#+4?C{FM*56w^AW_Xk$ z2RsS4IAwN+C!~|WybR^_ROEE%Ki4TW3rQ%N#KuceNe)UoPT@RL^4aFIg7`@r{@@sT zne3#S4I&$%Z$2k*L%`EwqmHJ=EROxt9P36Rd1_uB{z)Q2YTqNq^eXJM**1DJ zMVLT-B&5msV%7!6x*EKJQF;D8`f8$fz4}n-vh>_YX3O>ZeZu-Cuku<~&^0J@nn&ylP4_ zoXWbdkr48;8(?F|Jr{I?f1IklKi?YQVy0zMxLf?OJv;!mD4ACiiCV^J9)#c2F;_%Bt-WSO zY7TBy%6tXFRk6IID)c=D`((KVMIN5wtNvXA8U~CPdTFaZ2Pya$2f-VFpv)F}5%ZNM znZ~3z$GnJec(32Ah>v@kXaFDQ6`ScM{Hj#fU=O&t>3?%z*%j z4y-|yJ6)(M(q_(NS>d($UO>+Y&mFf`f%itvwV~Xj36pt*<(gjye_fi77uA324l0js zh1&1{{*q?cE9ki1;PehCt8A>3Sp%h5_RZGWeL;DT{ix2}JU5$b{KkV53WVDW-d7T& zEgaZnUkjP=5f_~i`DE)-^e$t}YQ-5P04xrHY;ixU{xuUzVunICeGXdi=Tz*9G4ZU9 zo)vXufsl;xW;n_Zsa|IbwPs3?Ew$f^@px61EFZy++YGpn1Oo!1CkV#thT=3`MWD1V zDXP5B##UWqhC^u?jT-#^Kn*EL4_Jd~Kpj#({-Gz_{s9}{6Fh^dw z%r3BD#`?~IZy5$=mED0uWNvJ_u@X{v&{o50&764g=)9s9IF}#`j^Xf&Q2G943>0(o zF{_6lRSKTKGze-?4YiXc;q|qMZ$~5v%Rzztb;I%r5mgbe2`#)YshmEbB{J1Ikh+tv zJ6TQ%g(r6$@|`Gn4=v%PdrsgZp7q3!im(f*(}?H0|Jf&8&)DmybiF0yj@1cL*tsx{ zlkPc)KSUzV~<)veZ|{s_k- zGavcq{M22dM9~MW#JzX_?cGvSuOd_NXIvt$Ro1E^Ao#DJyHpiukfv!LSWIQA?qO*W z^GIz-x+%$?qTrD>S3@R10#+H+t%v&}70!0~ zQcnZ6`>sAI(0Zmp9!l_@ZI#>k1x-wBGPH;;2gEuM$3YUdQLml5nr;$hG-fRV7vwmz z&GZfv07Ra4_^H}4dRs~s%~2_RBJ}&96hn!0507q3$hi8r+>U~x8SK74wlkM2Pth+B zb+5t?U|83S<&?n3Hw?7BBXcqbwa*4OL>agzB_=VL9qG)Ax~O}WcemVeGu-?sWWj{m zUF(9irRbgEb)6{S#wDC_?)j$w7T+*X+z?#@K$eY|As4!Titx6$4smBFyJ__o1;u8g zvOewh{-7e9_DlYF7m(R^Ems{%3inIiTPgIb*vjYtM;BIy3nk`x7cN;o(vz~Hu$y7) zk`(Y?H65{r*?o|$PKSp}ig@UIm>nDux<;pJ0sjRaessw+gpXbQwK@5jZF5U zem@~zcvm-#e5%{?P%&06qv3F23+IlUf^KqhN`ylG9!ND+O5x~%4dO5S)xie+{zHBd z57Qz+L`Eqml}<{FElRZ%>0r89-GdD(@s|k>gFCZ*WsuPVfT)^~G-|fI3H&%G&0iMxVa{UHbIP=S#n{hJ4!mJN#O7;>M#r>Wl{J$%PEYRG#au zwFfbZ1VplT#6#=b$IoTxB2_YZ(Bw-DJ?stT6Q3MIW%eW zH6alF&MjBB+^vR4ilk4Y8IA>pV*4wXo{%6(T>TdCfK}Jz+#Wjh8+0ro5zI{I5#!SS zHdpF|6L)H|;6R%{E=HaCZ75Z+YDgEc#$1N(;(c-H+g=0-R_KVZ^ayoh9C6ZV8sux7 z=_(q%CE$LEUTJ&b9GLc_zN>ZPyR3_blTVciRS-=`cKZ6ZP_(-)Ir$enq+xu0%5kVHJKt2}M`P`I64W^?UWmlv4ql zrFw{ey0~Rk>SD@;gD40OB?2v!*yMFlF2LF5nIiNsEVGq>RlCO&SmU}P69!2g7FOFs zV6SJ8V1GvLkx!4R74kh0SZrJo=h_qn_disanw^;8DgsTZ5fu>3?>u{_`6Mf(g!uDK zCjn9UF!B8SA_bYhJ^r?yZyarBaf~=ND>5k(cn}2SRSz89BW>F-X1+1$sq*&h6wm$g zR+TKb+laLl7?N1woADMbcA!-8S<1K#%{G;~W`Lc4uginD8b2RBhd*x!fC?{n1KJ2@ z!zu2cO?11?&RZ#txW{fn|AhoO#q%BOM*s+|EO0F`mqC^J3_ET%cr!k(>q=8Bc^j+gPAIlxWfi#t0>HPlCmk~wr$737*JT7n4nYR!j)PFweLh66SU zpJ1QBUSJ}EcsO-RP&5a^6q8Omh&xB5JeaHmbNAoDc_MddLj4Z(ATO4Zjn;ci@f+D5 zF*m+79QTqC!2P1kBI8S zob6Ib{Wf%HGUs9UR~UlektNyWcn3Ixk(u+Wo;?-@apIv`-cL(s8Z z)=br|xV>M!P2G6dFS%h`$14$YN}LZ`CN%@N2GbwQKv~a4~2DHz}YV}gT6ssX3ZANA8xR)6#xBoVr%PS-iqOXBPxWRZv^a|GO4wafpg6>7iRR0XOhjU+0grf;ufVYyEP zTCbiXlGjL*`QP~sGx-Wt-7yp)Skr{H7GHtPnE)~_jg$5>!C5vFS*_l@Z4JjlsNlm6(pdPcFoNw(I`A{u-5b|qUoj9m zj9nx5<;X;*v^a?8ZT5GIz+&N3xZ(HX3%H823((7Y%uv+T7nuOR#8JQ}jb{&$#Wjv` z*lyF%TitPV)d&fXAZZ)gVZ@nyM1|2bZOr#McWWJ7Hdfw{CM^Mebc_}?Kpi~6$(c5! z{-7S8$#cH3;IeE{uc@)A_1$zI@cIq3YxwmLBR!}8E@3sC8gp6n;$HFV`2 zGOwi^S9?6;b$cTaP5Q{TdUX&#X|LF=U2~vH4HNa0Q@YeRdpk#ayVSSnnY??wRW(9q zZ5$796nD`5&`#d1PhSs~@A-QSR@zorhgy=#J!^9zUtfAoFAgmZ&lYy`j?6p3~Rg7<^jW>mpP7kV@E%eW^-~+ zf0(_%bIVz1i`FpeI`ED>Gat>M5f_~yXD>!TvuOZ^)ccRJ%GboGaGg59ns=|6b<4(i zj6d~4NoZyB2k8lZ(Wjd+Bve34C02O7Rtym}a+&@mDZkUCm}$&Co?i-Muye7+mPW{1 zPHNy?(GY)PHr9RdhM(*xZmUcA6jyT~GAhGZY)b{hYLAPge+afb?m(k@7(%cw$;Fd1 z=0P_Jw}udPAIIOP+N(Y2{B|%!8iEhXGmoqwMCW=e=N_-xb#7a`R#R4RPkc6ovY5uc z6gjf(tRD-vFfnzoeRKRt$%!NK|J1CpasC$;#=^zH2JDp;0ch(wewD0A82+V&5)V`g z)l3XlcUk)54Rsqe>#DrX4rQd$OPFng49HwBYJolg`p#6(X2A z+~~Q_nX4V`gW$d^{qSrObe(;=SYa&`5PuY`mJ#h9^nTjl*V>vU-2Bj9bJ8gnadc27;iL{R6$MS>7nb$BQB@NLp( zLbV%nNVO@Lzfmuz4uus>{PD+KwVulXSWrlT=tJ>ZGQL1$H$K_CvJD&mA=exueiUN$S3!Yk-oO?CG!F{gTE?KgCORQZM5k z?9w=T!Vy%Z*6w@3u(|QdOSp`>3A7On^k99k!o}d9cJy8h^y0P#w<>BU{{HC7oRBx+ zj(W#NglNtp&XVLzGqz7!)>|?^C4|Y(hWE_1ze%FTk)DNXXjGvpu1IA>R>Z$r7?Pek zHDY6?y#ZoA>i*Omn<_#7u|g*bms#B_U0ZtGb78)r3N_l1lRbF*$a?10I^;PmG1x;X;_7BYkB%Tc1LDQ zt%S@nAw%0ojuAiA7J`;szO}KWLXi-#D_CL|_hmkM_&P$V#34sJ*~om%?E=dy9rruqb%6 zcJ_(caI^-5NhB5r;?SAS1*VbAT|~mst^hSGWNt@DwBcN{IKhm+657ATy>YO_z}3z8 zyotVLLbPG?Os}R@OO+sB7R5uM+M|+XTi)4I{wN309O(0T9XS22@T&g@-q2reP?_wu zje%=pCD)6>?~`ET*aS#fk7f=UFnlr1eZz|*vYvdQyMk(e^{I)^#?)_*6kZ?aHUSvT zm#EZAPM}*0NC@HxNtfZ3TMiJA8wYJBaue1^$dNXq;XrJ>jPIJi@Q`T9YRY63IwX!; zp4B$V=&@Cddb% zHltuPAtB;=f@X0msuHUljZD55CWIHzYj+5F(iXO3i&07?n@Dp8CvY$u-yoVoMAJmB zaA;@_scW7)E@MUlLcl!c*5(bO_4t;SA-;jao9NhiCca+j97#r$SW%=+BLo0oT4-K| z9YAOoV273n$L=Sdi><M=6x;U19AxNes{^FQhblrNu4lttDUd1E!u)|{ubfROy~!%>RR-}dx6OG9 z>^^A`qjIE0__6V|z;SAgf>+K#VQhj^qc#eiIPW-%8qP+hP1JOsQ-@q6xFJrq>7}f3 zBn(O{p6^8*Rnr8=dC!#~q@uUsBcu_`W76?RNVa0IB~vIOXBG~@^fD`o-HVr2||*ST&Rc-T&i|sQ!V6u6*;qG zt9(L^|L~}z@~T^R_X1Fa*-=1MDtg8%`O1!tdVn4U^#_&)@NV&a31Ik{`sXx}*;B5G&-8}qNQUt4m)4lQ83s6z) zCbVWRAKF*5#?w^n7;jTfyY|o$Ejps!R~{zXeois>h$$hkvs$_QV3~ zMm^DKyGZ%VgKn;)IMBTTDoQvxfcUdqOtPgHkq~_anTfeTcj|Sg2BJJx0CWI>JdFjM z{5}LC+G8|AhwcGSIuuH@S+#Z}Zn&Ov#4pRj9J4kd%EueUM<|)5sD3y}L3$O9f^=C_ zZH*PfNBFf2Ed+2oW}P4sCZX^wZ6b>nmUv|}8_@4DyyS!?N+lr##LxisS)xw&Fug#f ziXBbF7r3MRzlcvq1;b8@CHWpa(hk-WV>IXz9SPV6odU&%ro()fG`)?7XY3;Y) zPfAoL%8k>uBeT{#CN_HCXSLy~InLK%$;&qri{YTJQfL82nJ$|pZc*vmwjPqAJaO%Gma^iXIUAH`?s7B09(r+(pI0$b@VT__7_CIzl zf^(*iztdPJ9qVY`x6`u8{|=e=gj$%pi5)q4Zkb+)L#CcjXU)@}hB7ch`^@tG&{5#wVZ*1-lHr;Im++WUjvn&+|(U~1f zvCZc%vr;^w(kN(%dGmQL0uZ|HbZm&_tYHvExvH7d9AwsmKu1xDyfK{(MWX}Sr#QR; zBeH7%Wrbs}@rK8`Qg;G-SsnW6tf6ok1rBN+%1+y7EyycI@{=p-Mf&z$=}^b9X2apb^+b1m@4LXnP&@rnB}2n`Qt zaVlvl%V3IUjkSQn>9n;H6~z?+uXaewod@7ifGG0vnv8OQ{DAiq3g3?|53A-FD_6V; zY8-`uU9^!5mme8*d}UHCb&|nwYz%5gCYYZk+YjT+>)`LQJ{synpis^1t01m8Zm;%$ zL_!yY?3YtqF~VUipyY39lJN_rs$^ylMB(6I+!zw-%B+&Bk*v}cx~3V{APN$cr7pSM4Edx$#S-Rb^4WzZGE;?0g%P72U) zfla*M=daR`u@>i@p`F}DU5WLrT&XZPb)&aLjmQk6vn*V<4~I7`d&wruo68F)`=D>n z5^nbVwB(hNg?V58_`b-P8%%ia`8=C=rT*D%JN<~mzMd=OsoJmlvv<$A>hM(=06 zHQ=C<#W-Z*14u-_x2)kASrhj>7jotq7@k72VRK&dA(n>4#pfCsIbFRj2LtCtA0?)+P=OZpBa#?7eM8&lQV2 zgI3iqIeuTOns0MW<+Ss#2Lq1KU}uiU1e3quC!Us%2hBY{Mv*eWI|qG8G)w@{YX@f8ctbGb_RB`%rt!QBxme7@S)6;R$Mo`OMbVHmqSx`dv9kC z*<0|)BL%fVZ8iY$*l+3vXdqdNcD-kQ?voRbqhwe{@%5B)NydWml|)8Z9`A&$dP4`_ zQwV~=BQZkk<}7n|m`=OT=KV&0Pf?W#2md8&E@>q4th8r!;Yu9I!1SEvS0pNdEeifo z_kH|J)%UJLm`Xb$gzFcDbh>u5q*pO&iNAX8rSETby(w?N-L=qAs~rR*-lD@GOhEtw zOv{oO6Z82H>TSRbjBjL~U$f;8GkJEZl{rgPP&62x^docKSQSZ=i$@YcVbwI2cdSZz zQANOL#f5x3H)xoO`D|HkKQ!d6nuEYx$A&zD4t}}4etWf&gk8&V* zj!Yhs06l?&4O7sX=5`_!UheC}jJDiYwWa&-Zpv@tJ zE7J!X_rntdkr2sN|7{s4GUOXXA2V|g?^M6k=VVj`(RfU03A*=_s+r3Qs(8mVUVLnI z3JfKMP@OwMZiq8ks)dsK{`q~wqrDfbSn3G+*MJBrUxc|GU;4ko2uh5a1;=*Ax~my0M>B;1Kr8afaJW&WgWP*|as zJl}Yeu!39hB|5)dLGDfcX``dnZqEk$D;-pK^+LaD*kSD%Fhvg*b46YdYm;zNb`<5G zOl__X_sej%Pt%sXD<~VG&`Zd%J57kyM8OwF4SOI!tXgL>S_F#)gWYHHb=1!)7PWxG zz2P0unH@WK?oNdq$x^?TzrCRR8N&q6191WuI2xEK_x9&>Ls+LoY@7g(JKmcjVdwOy z2>gJ2)FAit##X31=pwvZWptuvyS$r4Ax{CXLW8CaU-`mq+uAiy2p&SS-%(vbn9k?h zW6pl_I_HThiCQD(6e!1Cv#`>jH@(hDbu0%Uhz9&(*X6yStL##;GD~TkLPzm1D^%ICYdiQ5 z?wv8l=u}w-Q;sJ=;QMzj2?}@4Ca1n2dPnoaWXwQ`_i{JPy+HC)fWeu#5P9I2JaG}g z{EH7^wkW6`$sEAdK|JNg<=PYKCH_Ehh{&p0cTQB!#{qG(6!;tb>dK^Iu5Z?zNpI&x?i0(jXfAI%#yWY%I9NXR3(rckE|= zvnxKy?MGfP=K#`lQ|Sy*Yt9gB4LbxdCGpIHBc>4+-6L zK&TM**{+n6Bh{zHrZmq}FQlIGB9M@w6=Nd);zJrujC2o1a;MIr)0bv-)%O617wT4r z=>5sRr+Dw=HZKLG>Q6>ui;nyAc_U}7FqC~4f1hTk1#latsV^K+t7tnu1yV{&&4;Qi zYcW&7YR-%GE8wU11HnC1x)))fgT#$a;}5~8SKV29Lu z4WNP#nMObnh}h~5J*skPkkmDUg@)xJSybwZU4&8*R>!X^+rI!2E+g<*NN~`3TEsGy zV1UTHPx=un#O!P1)=HG$V)2j=NhsT|ZIDs8#C35|$c>h>SR8g<6hF484uPk|BAk$? z*bX2DNq|{3RWFJSz?Z|A6gJ+2r0Uzh!jC z(ER{8&^`K*0ozdCv#iU{=Z}JC0N~288Q}B$adk)(II6TqmHfaWRJ2AZ|9o|WHx>pe zkL0Yce*FgD2@#KjLd^y%%P+HI9~8oGR~qs#6U9b|aKO`#6i`)5VadSf1+p zuR@G8jA}t{;-QyggC8_W)(=?FO~rzb_lG`=wOZ!X=ErZL0jVOcs}onhpgKIX@V-sl zj7?d^`@l;y3#F2R#1m2cZ#wGzTEU zZJ*Anm0~-v;hbspjv9m8HEdtzj}$C*Yg9Awb_poc=XZ4Z5XdCK_2X1 zkVoG+_I}?ceEz?X$4m1V+M&dTok465IpAf}&v)h=8d#c00bpybZOz%%JAa2G@-%g) zB>74bh%+wzMp+~G zR4W`IyIoPl1z7uy7dx{1-umhRc)N)lM?C1%DLKpm!V~Dq700qzzGPzF^W1mxS2b+xf1^?tpBg=%jLhS z`>g-z%k}^1`;QdM|JCEsunYsUU z$-?@d%YS}-bv?X`W6Xqa7{`VdD;Q!?u==49W5MNeKAWv%ix`lkv{gl2O5?` z0+q@kfHV0GU|)$1lqv#XR_>SRS{3(~4|w2B0X#4=4-;ruiVw!Y{%>=11}c!hiWRs~ zir=tU>;c;FRJsca#=-GV<3AUMD$xd>ip4L}*AV_OaekQ$fH2tzz_&p{An;%Uiv6Et ziVDy;9jn3TFajEQJxKN6BP1MR00pWHkD#&tJCk3};eSmeI~UOD@N3P*%FQAm@Lz{P zcxC5!S!=0kc09$A_+INY!NpQoq4R3lS2t)>FQXDDCkjglD<63yk&wWW1(}h9CNV)u zr61!$I#+>Di&mrS&^9gD>Tb6bFRZ)Gx%$(daR2Rg-8%pC!tl~(aoP3by)EzSGek;2 zfkKC6o1|%GX9c(ei+@=Saeg{}&d8v%ScW)4Y^I(6q{dZu!s#OelQRjCMpAFE5cDuJ zDe0rF?Q1L#1&?lWDODWfb41R2KAQP7a`h9DP%-lo8^0)yPNT~sOk#dN9JNcEJs7=d zUAx{BoEI_OLpKrKSMiV>{!v6R^Uct+S<=eOX0os7^Bn*H%shQ^3JRn6at^;bL_Pn` z-nmXX$!sL|wjFO?ytL+>N4~-cYc(fWCl~1CbyH0D^$L|NvP{-&^pvZb8CQ4g`a72y ze?0BWDD>R-0SO<1O+T$ym_nDrU`lUzyK5Kh6}>82MX^P(5g8xh8PPR}XM(gV+$rmY z<_gPb@(r*n-zjeOiKy^rDl-S1imhPRfdkF8TEIh z`5=-BcO6hmxD}NMts`P{kS19229{%2Xp+nV6)c#-fP@0gHd4!kr7kXAq*KC zLa0A+7Udn5k~G3A2Zo|`(9Hy@kCe|z>vp7I&>x`j2ci_V5B=(w{u(x+RJdBWBlkzP z=|Pqmd{a!4YR`N?W8}v@W}4Dx7{K;|6VKD8quV}jV*oKIcSV+amA>WAKLt4RKdd`Jj@95)DCMty6v&A4?Be zUph>YUjo_mT4}NPtXQmhA1OnT(f1Lc>Z+?Z{F(#y0Db6#6ya~Mg8UD+>m!k_APgT4n zi9!9Gcr%ndXS9q7-abcni%m*c?4D-%dN{XFiI)=?zt8a|fNdT<+K}l&E(MAvE@21Y z+9L+N-Wl3d1jYy32>kl05oQax_EIap3Ndl0Pm=zrIH9~kZ`m5%gXGJSAG^t#@ znxL0~V#(^SfcRlf@Ba<7XnEHV1BWFtGovAGY7?qSSp(%VFMh(5i9$jkWnAqIx$Y-i zAzGKIIlM28VF1&gjF>`ok;wNs_$~#Qa`Mq&<_Y1gV$e9@m^Hmh_7F|AbN`lmKx+fD zQGRA~ZP!EyPASyW%GplcOj2Mb`I<3bQMgXCetO()BYUiDdGgB)#U3S}1MTgnW9v*` zV1=p(FMmhEJWBlpu2(6cKr&hmYElE??1zeLCCU?z5OZ8Sx!)Qdj;~z9@-vHdwMZ5 z;T zAcR(}e{qX;v*9i0k)Gjne$wAA6M76P(Z#4YvZyj}ZxQ_{SG43x!OGWSP}5ApcdIA8 zWXEGD$QD!1VUPOBx?8y|49x|t;Qsf>e`d$5)@T={c;2^E+{`=jH6vMDGeS|Z1s^l0 zzYYfO0!X`|-nhWrnqa*P;K;isX!UgA_YvPYh^BaPTqQV}Tcb}Q_@=j~Gj?e8 z#4(YX)lHNRFrdxvv^3Km*BV~DLGeLv5A#3pwLGd0o{2ev;4MV}MkQrbr)9?-lEyg7 ztWWy%_M0&>;sV_1S?@x33Z4@&K~O>D5wu^G^Bp$~)?9>$l8nLDaXm6JmPaf6;aJ1h zoMK+n@zscI1wtu3{(#iY5wKkj&tF5&EajbGlk)XgN|e|#(Eqq&8SfCYUVNCFd`{LI zSqsf|5_WM&CFNxYe3!ujHxUw1Zf9@jzQk*l9*E4__`#_by*O({B1h^z_4*nc z_=A<10WYi3k6K^ysIP_FG?w(PrkzZ-XDu$&!Zp>6m4b2sATA%ISa(ugU-u260lq}E zIBcV2hHgQx$e3oy=RwW1K)ad>ON)&BOhsr#hX(KWyj>#nzAEQC?5A+~V{ZAb$_#>B zI7^iid0-8zB@}#O(ELl8nuCj6o8m{_ck%%_hAkFyL)z4uVclHTZu5`=Wyt~U&xurh z>dSDrS0DCiKq&`p(-txP!d9^{LAI!W0exDkUnuq-ZG}09g?Q}#DXr7vC2o2|%Z|JQ zgI~yZ$|deIK1?OhFav`G6B%kLs0SV7ys6yk@NNVYBnkH-O|lT204KN3>(q#=L=0gH z9X%Pm=)1=kF@^4-d@)ti(&mZ+ffbJX-KDZ0 zDiK?Hy`5wh3AYF|bG2HsYDip-xF}Q9iY?8GK_N%k%y2^Jf=Y-dyFln9T<3zG@i?+Q zvA0(50DKqb>Xf~jPhx+e2sg;sujpY0DSJ*KMWoeV~A zyaWr}U}dq2w}?#)9oB64&)@NIyWbybl6m6TwXubMg4tZcZg=SOA0i?KcMD9@&=|Uo zF9Wpw+G7M2KAjIsB`z>OlT-An(^9Rk);w!^40Y}X1D`!*#Qa}94|N%VwUZ6kiZ-Up z>soT8P}s2KX12NFpkhJ=$_F$@1!!9YRvIaXDWI%GYFPNZ2#t`hGGz|2%FH)N*`Yq( zJ}JW1qkV!hAv$?kwakGcMs!VXeJi{C27rZX5z~e~1v_ibdm^t81}=b zdRy?2H-??#KYxJX8w6+ex6(3rA+U7njNB{kbdGR2XKZq|nv~1YgSti4R~f?iQ#na& zl9kI}@)@~9KLp2qI8ZM?tgqAPx&ykKg={fwCUwx6<`Juxx+wAYIw3o#8;v|Ao`Pl< z-K@zX`nfNbiTv6=rIs=#z)I)+AyZBzEt*3rlHwfrLa~h9%%tZ-v)P0s2V0(D z@2NM7KOA1h6MOXWvZKELg6PPX^)At~Lr_sQ>GDgY)#(d?rr!KZ$~&sD7zSvoVn{vZ z?AodSBQD{lRqhU1Z*s|xcU5p!833@g+N9JKVj+^MS98{3PY7|AXjkuTA>~!`0JKl`2h%U?2EgNj&rg`X&7IGtJwqtebFgWzKls7x&=h2{ zi_;K8vS{0=#ORPujLOVV?*gQ4>Sftq3$e_(YksHB_gfIgZIVQ0*gzd>(+6$;^z@1l zt27nG7%$`NhM2BXa=r^zF*UZhR_RfV&M8DysO2H$x85ub0@I_@dDt;ZvR-@*!2DW zXCCsMz$eZ#*SbnI;wxpqyrkP_fma9aQS$^_QA1Q4$v>&c;rkdka(Qw6(h^n`!UM|b zoHW|of<#8@z|a+|S31LN#cNHGI=@X%@1HK{0NDGHF~J48cZti3ZfWQ3VNs)zQi{;69e$~K~RiHu9&G#$Qn!#(=m_^R?yA2dZ0xHM@z`4*CqHaErTvy z7iF>EpJY5aIs@TWFO`h3l(gt+yF-xest|EG3te12B;Ewoopa`iqkvxN5HZyWiR}um zHvr@Z=^DLsmHO**^|U{&B5sxVi)jf%lez}#&l`>Hl=sR$?O%ZZ!hmRKK;NxyA0D1F z5q;=|Y1birPVf&rThn`SpYc4PAzJd%jG77fdnI8h2pW0ZsWQdSV`2d6tGGj*Ui{;^ zzs$Wws#jAEkY#erPdeoYJ2OMJ?@!%+HVay2#_w$A9_PIpe{BcOW6Kol;bJ{NY0-lN zsKh)W8|(BG-4Q^P3z(IdS0_Z1l{X>@hNi)K?M!zw?&>gB7AW4Ji`6p|v%(sl`k zs}>B5`65r}!fa3uw$Zhi|L${X3~8zY`~X@ljv%Fd6^qp{VB&8T&9yAzq@g;``k<~s zkGuGQpVsMrVl`sK*3V9Fs{zce-OCCo*#VkXUKx{ZHC8eajh6R2R zL8$*|c|j8Ui$IJY!zLi;lYMo{tL=|8%UHFiTYY2n{T$nlre?L_g#ChsK_{!DQWn!W zCHQU-O&szmG9`sQr|;2s!w)SOEi6))dv~4v;p~KQR$iq+n8dTLWvUpc-7sW24d$v@n-hM_FcjCl%nt8$$2$p)e#Js5%<$n3Sf>v3 zPailu?bsIMBPG%AS&=4Q8@cXkcnNs(vE={?0~2LGP=-o)&UQMNO5`qFaydB#*|f2H zmsjg@8g7RC@}aw*r&<1JKZS6*9I0ML-jUDab5Y$|)Ea{woXBrRhy4cW54_KTQ~3m| z>pXaJIo=wv-`s)>WMxHle-?vhgUO%aS<}WQn@(?d9EvVk3juzoVs?A}H6GMHn_C1J znl?Y=qG0t}ZbZitg3~|lt-1uU7jnT66!PzXf4YWi`}nyd?wuZx>h6hiHJp)Rz3Y>; zBynlUhL9fs&)u>9*XSwNV(pLQbl2NID1;g($f zQTQTZVH*bdY`-ak)M`NK@AjmA#U-D}x`_uG@^0lyQB4io4K4GnpUR#vwWnt#B%u*$ z=B%&k>2EG3s}P3s_9zzRlyg84MmBN>JYmQHa(5p<_aj;9W8E@SGHKHyEolO|4DAYY z*2nw%<&;^GgN>Zk^u*+bg?GRK%MZRH(9gW#GXxdz?3S2CL1aE1+aL0>9yuYZe;}yM zSfh5-fC>&8`qCNZ7R+U%O*FT1Nmt*w`B_Q+KK?Z9xoQ95yF zj|DrwPdYfI31gFtqD}9osu?d!%ygcU8AB0d6 za>^R#6C4kgxCr;F-dK9oCg;M(UC@T}bW-2587#Dw#?%|Z?U1XO@{OqgG= z9J!OajItY&=}7+OYi*4MSl2Q{Xoy`fP7RY=A!IYkTO0~^z{rk$I;cdn5&gDZ#8eiT zIX$g020;oN(~!{j1LwSN!3uO^#MUNoAzxJVl^wBJ5V}Y$zL^W#Ea>8b&Kk=HTz;3i zvP|!~oCu z7cX`_XzgcShesHj_)O?t6vPRtzm7xZ@l%X2lW)gN9X344x>B4Wol?GA0k#R1&r=A% zjvXp2m7#VtLJ#F?fcU)7t`=$WW2%hj;og)Evs))?Rq4R&)Q4>kl5~AScl)G?JtHD7 zRX!&sZmc`IKPF+|Rc%~v2EME{ABKx!$47}4l_D|yir!CS(4~zP9dCkJY#MY8SY@ta zXHDwoiW}KmEE;7Zed3nDZvqGfJA(sh%a@Px8|U<+tte|d0K{M+k>!e<2Y;FJZOW+R z>xOOj)XvuPDo#r%7-f>;+sP!K-M!n==nW2@wc$6{ue|<+ltLx#Au(uCB^t)972X>( z^6k#^_&6VsA}>$BxIWlKNmtcvIiSk|T^YMkeC^V9UE|*3C(;8FtF(3oZve8UzJ?bM zQBNVNa_LekAf^U#*0(ChlBDih2RtpldRJ?-bk?LQ*zP6rQLgS4NZNrqS;y>oU5Dcv zI3hJqI8{B$?XsZbV=xk4M|MZ#JKUzwA2HW*;n_bwJVzZHcTCi}6>^*B!=Jv(2Jwy) z^}ew7^nC~G@8IFy*Vz|y%|pCZ&OP*KT>c?imGgVe0Ir^ACwzw+O2o|>vdb6H>Zyk-?0^8vVSNbIj150Kn}cr*s1%j>G%lgxR&E(Ws8FK zfGn}yS968XkYQW4n07XGh&-7lgsx9tAt#MxUKBBrs@BaYbYJqx_;Vi@%6~@q*wqQT zxqI$cDu6ewQP^_Y@py|e%NWIy5jQ%RD?+h3MsRSIh{C52)(p?(h~+a>u>KW zYvNypLK6OYEBL2iJoS}!QKb3%hsrYRfc0;p6M+0x>7{>KFZr9Bn5UALj7?E5HDiU& zqB+}{TNqd=jDHZ)iA5%yI``bI@s@GF!x6~}_3ri9d8UEfwB8S(gU~TPT}fERG~t51 zr5l-xhu1B1Gy7y|PyNpFx2NkE+GmU3|EsX84y&s9)^rKdDcuHeiW8)CgEZ11ol+9Q zAteL^j)-(ir*w!&NGc72Qqqld-{W`h{oPOefyJp0-6yfc-3UY(lc zq7vjicjJb}vYjll{2H)CF?=3Q>%NRcl723pC*9gZ?7b#Yn;Whe5{KS(XzlwI-hk19 zHMn84gA`qnf9SWKv>NX^lU%%)MtB_W+`AK;(dL||#=s9Vw%u+9%eSWD;E7m102f>fBnJ0&Hx*Ax<7+4gX?Trsydm5thmqZ zuy1_MY4h|)K|{>pAvRP5EEH`J_UXEjpnXHc5`(U$^o13rIRI8kQEB{(w)i!787jG#Opnm6GF}~e5(Tea5yc(qL-Db>w zqj5)J=lsh9aa(&>RI}y-ZrZ*2{4Op3lVF-cN3DS1iI?rI(bDut$NBHv~^{ zF3I0qb-$1mS;f6=^&)iVkXU9Ej^M6lJFBjlAW3NAa{sf?NpP4imIVOJuS_xUQ< z!X$N%8mALHU?tP{!Rys^wyTOu671FJmnck_-mH;pNQNj;ORy-HAx4IaKoEn9%F)=Cu^}4Ns}rpI(IzHV_3684yUL=Lgc>4Yv~8MgLVNl zHYY{TqYG=~l03993M;@(ZH7Kq=_K|e;OMc+pw%fYH=<1B&%CPK!N5g)wQWeM7@vq| z$vT!7#&$T~g&OX$?`UR(_RkX-=r(rAku~7j0QwWy82D1Y(|Cy6M7qRHj`QIcQ}6aF zvDWRm_dU8UDZ+nHfQpDxTaq{m={Rkm(5pxf~G1O4YAscPKTwk=>6yRo@*=p=R z_pM*8E*!GrA=gQ$dn>#tT51+q9raBYC%CtJJ3`HP3#y!az>6Gy5_BSNynL9C(pwb9 z`|qV+R8z@4OhMFg$wMpz2(^6*Ks_$yMg^AcQwaXEl>VVI`tb$O`A4{x{@wK!j z#y@cMw@k>70*rAWVA*Iz2fZLgc8Z5ux%X7U8E_yP+H^j0>sem`2Su_tR2-h}vcPcB zOtGejWIf{tduqR0{odae*hx#0u0aM05QrE;$V%7X*4>z z?Lv``+yqj-t8tQxo^7&-ghuG(F2+shV4B&*#6%3@Xb1Sonci@D{I1!S@ zgnRyA{2;*~*v187cMUpUCoB$vDYRqNwjeJHw>z$9nW$tC{xtLUv<+SUFEiSQ9b?q{ zvJ;go%&~R499?2a-4zI2Nj#@lKdkj>r|5=xz3>SQ70|2i_W8w=!C#w(u)lQZ>p-}n zRtT4o4uXN%+!{`!>~<7Os*g2McS+YN*QM-;YLb%`y){O71$u*iy?f4U(i@X3QHspk zEKGXMvh;8u`=T&!)S)-7D))`LTfx#Oksb4r^gzCj28-sG*VIdr4I1xW(_5-W=Y))U zt@|k|`#p@#l~u1DwOJQkck6vip}tW79QBFJQ7))_9iT5uAxE#FL4@Po{?@E7j0yJE z+GQ{Rb^zU^oFWjmaX!PhqIU~T`?`#*QVWy29roRP5)MXcOQ}5)v4X418_+E<{ujvz0Ct!3Cv6^5<9# zgD5De=%Xnra_`(#6K|Eo@lBad51IyTSgw1(u)6Rxm3(1vC$94(Ct1ClN zWLiAjhXPf(fx(@|{8!U&*l55s0)Yt!z=z^KL_uM&OA*D6(5F>V3?1XW)Qjt8$`-QT zl9ICeB|Y7w`lR6x^mOJs+q&9V!oyjSciCxVv z*R(3R&sk~@N;J!H&na(e7HqvFw*Ws+4is+A-(_e1sG}SuQmV5RLPz|tYi=65I8?QN zkiJ~YMbmOuu}5Y#%i%r=_i1a88K$y%Q_}Od5JKWg1+kZP>!4AjWHBBVTnwY5U(J$q z`L!wbczRFD!QO*D$)m5PP+d{o&^Q8;j})xD5YlW5LD>Y#9C+H2#AIrKXGUIn4<-H^ zppYRc&gxjuD(#h9MYf0kojI_6Yo*rXm$D3KdtItCUrWkDj6BWS&>9@U;_Qf(mO!H zS!Hdyl2plVeL^rZZ#PV(kbJ8|kY}P`hq@-r&+p#eceoe&%oOl5A@k!CQ->%6C|URCK2Q-p+ch5tgIbiTvZ|U|F9*-oRCC#|{dX#Z z)+II%Gv5U+zCFI_>)IA!d)@J}+_bxb8dU9P2gPLI5<->gk~xhc-jSx&^jPqQ zbb%Rt=%XhP1>{HKm$qLW&8GbnxKyhfu`ReJ=teKc8rsv&kD1EWWJ%R$yC|-MCSiw@ ztls?)t2du{p5%TGcS|}fH5UBxWP{ToJoH2=LNs_K$P}b!B4#rE)OPS~7^f7aypsqa zF#r|Oj1eUZzaJrdT;pD81!>+LNq6unQn z&H5oN9ld`_+$5o)v_Zz+mFff6`tT3mhWs>weGZwhysWUso3mV6(@Vkb2NOz^Lu<6} zhEJqcY5n&nUVeBtKY}SWKbUlJ4|TrSZAYRu{;n@u@Y9~vA-NBiST)&j==K47>Ibab zgs)oiSfp+hukG{{TCau0o)fGP)dZ@4`mD%a&?UXth?KYK?~1J5b5k+i2<7e}T|Dpz z(;Nv-(^wGc?D;kgR=<~0B47OA?mgZzDx~H!`SBN%S7o~%6trEXJ_bWVSR$xXCpWHa z;uNKsujh>^s%bo9uH%C}13XjYm3`RyO+IJBNU`CBv~Oi{KR6&Fm7z@@OSUI$uQn!U zH!D>co+E91_2^4de-N_GS?SA=&J({HOi;NKUF?!dws1ygMBuP`{qc=yPH-g0X8O-`(_1B@umgp=PRv&{8++wq=Z=AugH`M~8Px(sI_5v9(Lfj(&HIB!0#9_cieN zXeVXgT1Ew8C>a4xYbw&620=nuvGn!HL!P+LZzGEGUK_larCk{E8B!bPdL~HH`8=k= zP@ovu?oP{;v#0$1rL|P~ZUu8S{f|h+GnG17$Xty6&y#48&$zWd6OELB56-|~cZ~1* z-vHaaOJ^~f@uDPS9wAHjN2u;5eet`~ZcVb!n@W&bTJ}J$AMAF7Y@h7pY74a_cIi*PdTst98Cwvux z^1x&hp^<2<@g+#T@Da>3Ch(x+(yB#~*;VWJTqB~HDZcQ_o4L?_;JXM~@#l`r44)v# zWGQ}7Cz9El- zwvhH#-Gbr_pFbVrDAtZ}W_t=Ii|M;=bnd6r`BRWetmP4n^4V4r3OJj&o1V$b?fGGQ zLd4pXLeC<^_e|K$<=P`K3&&aBmWS+x@T9bbp@5deQAuZ%(9iE!zI5!EYmz-Dh^GZ) zZ`jv3SS~GET1H~GZ{<1JQ0PAgo+64NCCC=!)`8{$j?r;RrBztts>Qt-$&nM2pSx7- zxr|ph0$6O&KvMZVhIsOi3^b-vfKG}-42%Ox<@w{v1})Kj3ij==JnbwXs}zj+E(lYZsY@8HL+M^H)V4xpLfi@tR8j>-N%}y>BwB%%mAWY}7R}8MB=$ zdt)|R(}W4pZjPzBxn0@Y5YSn2c7;5V9*8Es1e_0De&5j>dNOl?!;w5$u%ufUvioDj zYhHHyoA&UzFkDZ63N>>*Rl~yNENhKr6P>7SCvc6k64)$0Fd(IZzc^^JRah#(XZvkW z`*dOz!|svV*QZZ>VmL?KGG_`7$IG@3{65dnJKZsFxvT;3INr8J@1wRk7J@*UFfHFP zVg7YV{?+>H`jJzX<44YBH|>@7H$N5KWs+MO0XJwuyn=m&5 z-B%Je#Fm%#5by+(;Qa@~gfwjq;_0Q&mRWqf(^Os>uk6jbDpgiotJHPS#yZ*R!5DX# z?+f)d?M55UeW(#ER^Y$8Vd*x3gyC#Qzo}L{&OgdGRocOPMcU zR+x|gduev^ky|7+&Q8>h!UV4`Fu>MF)G>~~(Z|yHdk&3@hmTG>XnW4MqDu$q!$d#a zj=@ll>kMj-qF^3VqR!uchm3j>U63tLfK(nb(>hR|#%mrwUp$<9|4}DzuHns#TM_T- z2Bkt}Y`h43{Z62ld%vhz4ES0v9ue1_A9PPiK09@)A_9x|W7ABsATg|BSN91nTG`o} zq#{WLGQ;3R#CX51Ze3LSZL=u;)Bqf4e-b$qKirrQ#_7yhZDBm9nL}O?=pQ`vyG?Jf zF}Cw~F*R9#ps%e(K6Z#H{|K@pqaX7rTqo;BvO9bZ z_&WPpUwg_VXZx9#wxd_P9pnhAg1SDJ9M z9yB8yr#^ALVRp0^2nm;IeLzZbA1uaUF98HGlEN z)~1d}TI;A=QHJt){n+jm!WkbwaqOkI2g0pp$MBdh;z&oFs~UxLkJ6U-tbi>>m+p$Y z#*4kgIw4&bj)C+|@u=lx=AzC^%uQURdcp=pi1HyCIp!Dh`h;Jlz4=~0xQBt+7nDXF z)xnX^U;8Pjr>@k$@%#Q^!sWu&M8oRG>X6)yih;Jul4c zt4lmg_cj}TR)`3aw}5XmR$79^&R*1o)m<%slO(3~@-$s_VCBgQ<8DYX32B?2NuGX}wI`}$9jh4?=t@XQy>|u8tx(j>OIVHAs@ZWe|Yf8IHs>($1l zGfa3z7_c$VF9(-30Ag>iM=B3?^Y6rn&%KzGJCCl_>9LwX0StQX+{G0yW-c&=u*D(( zal#J?q;+&Fjnefw1M!xVq^=+I>ziSVNJXsxyFbiWB3pO-Gjh~d$bHXs&W(rdcq}bf zmYyip%7*5ivLUH7nmmvv^Bqp^Z*Z0HqP||AtPbyeP3s8k&o%UgRR`2;95$E7(o*R} zs4;LaTjscT_~6ws3HzkFX0SGdSu!Nr`CRMzqLz2>4(Ca`UZKONV{+A z)xW%6)m)XCH@}rg$s3Mso@|a%ejPxultkja<*lMooy0ZUz`Vax$WdzPXl3gj2QT3) zBd@7^c;x;LDhH{B=xjbrn+g-b+|;pWy%r7={jpG0RrLt8CsdPN(Oi+KN4&#Cc01R? zO%%D+RF>jhahjQaPd?SL2l(^#_ce=^*3)f%x?pvwTM8HN8;;-Adr6<+zqF{!3(0{) z6I|@_N=n}88BV($&2e>HZ7tl(7g(qpNalEavKF7GWCRAOB<|B3yL-@-y?Z<<6EmCe zDQggJtEcMjWJRNBilSQc5dGZvC1Nan%h3+$B;dds+xLjCs3*1)ebl{Tih9%3hMRqp z$im1lisH%Rfrf?gRG+)HmZRjvCE-pH5#b8al7X8kICu7slC7u3Y=UPS-c}z-t6++L zZCZNa@Yq*)!n@dSU>Iu0loA0JmGD38N9J5nS)Tlzus{zcP7;&{5r)ID-h zBz&Uk_=J9+Mf}pUs?OQmD-$jxhQQ3Ly30vWHJm+6@l14uvYR1Fos$1ItXvJurQq{q2NA zn#8^iIn_Q(VfC6bKG-(;j7K|RJ2~HVq|og#*c)xu1|MEkW(Qk(S4^po{jsMs;M+bq zTf~>GoIt*_;If_v3_Qe9pnO0)@pmzj1|M7;{V&rc~CbJxz8 zpOe9cB9?5&^0-3t5*9dA(w5S~TPC*51jlT@MU9E6gk5scgH)cNMuy{2Me#=pNUq*k zR7AeQ6FE^IV)jhOZRBp}azDIPg3UqKo{b!ZS{J_+K&j<+x+EW?_{dqsxi72CzAk3w zp+|vGxk!^p6TFqGQhO<~cR9MoU-f=%>0$h&kaLx!7yPBTZ-CsV?hI#fj5dLnEd6@( z%+1eH_5CsS+ghVKW7S*djUTWp1rnQ#97_rccaCuAh>;)!Hn})!yNi zV|;Ump6LyJi<0^^UiR%%x%a!9@@TOS040#lfbv2Hf(SlB#S91m0N->Bf0Oa2(`GyF!VgR84Lmn{v%Dl`3Hm1CT}zZ3&Q@Q6#|AqZx$B>0Y_KR z?@<45Ac9~3@FvxQFcA1AGw8`Fi2Msg)A~n*zXJq<|DqoZ0z+@61dLAT&0wJDx%jU% zxx1R#I#{}*1+}aKnzlZcNLKVy0S#wov{6%4p=}zn$J@` JO%{{rzW}X!Xu|*i diff --git a/tzpfms.ps b/tzpfms.ps index 9761651..35d1aa1 100644 --- a/tzpfms.ps +++ b/tzpfms.ps @@ -1,15 +1,15 @@ %!PS-Adobe-3.0 %%Creator: groff version 1.23.0 -%%CreationDate: Thu Feb 29 00:43:02 2024 +%%CreationDate: Thu Feb 29 01:10:25 2024 %%DocumentNeededResources: font Times-Roman %%+ font Times-Bold %%+ font Courier-Bold %%+ font Courier-Oblique +%%+ font Times-Italic %%+ font Courier %%+ font Symbol -%%+ font Times-Italic %%DocumentSuppliedResources: procset grops 1.23 0 -%%Pages: 10 +%%Pages: 14 %%PageOrder: Ascend %%DocumentMedia: Default 595 842 0 () () %%Orientation: Portrait @@ -236,9 +236,9 @@ setpacking %%IncludeResource: font Times-Bold %%IncludeResource: font Courier-Bold %%IncludeResource: font Courier-Oblique +%%IncludeResource: font Times-Italic %%IncludeResource: font Courier %%IncludeResource: font Symbol -%%IncludeResource: font Times-Italic grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72 def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef @@ -267,7 +267,7 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis /eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash /ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis]def -/Times-Italic@0 ENC0/Times-Italic RE/Courier@0 ENC0/Courier RE +/Courier@0 ENC0/Courier RE/Times-Italic@0 ENC0/Times-Italic RE /Courier-Oblique@0 ENC0/Courier-Oblique RE/Courier-Bold@0 ENC0 /Courier-Bold RE/Times-Bold@0 ENC0/Times-Bold RE/Times-Roman@0 ENC0 /Times-Roman RE @@ -276,15 +276,280 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron %%BeginPageSetup BP %%EndPageSetup +/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) +-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 +SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) +-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) +-2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-change-key)108 +124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF +(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 +2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 +(,)A F2(zfs-fido2-change-key)3.766 E F0 1.266 +(will open its encryption root in its stead.)3.766 F F2 +(zfs-fido2-change-key)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 +SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) +-.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF +(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A +(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) +-.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 +(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.244 E F0 -.1(wa) +3.244 G 3.244(sp).1 G(re)-3.244 E .743(viously encrypted with)-.25 F F2 +(fzifdso)3.243 E F0 .743(and the)3.243 F F1(FIDO2)3.243 E F0 .743 +(back-end w)3.243 F .743(as used, the meta-)-.1 F .926 +(data will be silently cleared.)108 223.2 R .926 +(Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 +(ata required for manual interv)-3.426 F(ention)-.15 E +(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q +.465(xt, a ne)-.15 F 2.965(wc)-.25 G .465 +(redential of type ES256 is generated on the de)-2.965 F .464 +(vice \(with relying party ID)-.25 F F5(fzifdso)2.964 E F0(and)2.964 E +.499(name equal to the dataset name\) with the)108 264 R F5(hmac-secret) +2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 +(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 276 Q +(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ +n, the credential is asserted with a 32-byte random salt, which hashes \ +it with de)108 292.8 R(vice-pri)-.25 E -.25(va)-.25 G .962(te data,).25 +F .137(and thus generates the wrapping k)108 304.8 R .438 -.15(ey \()-.1 +H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) +2.638 E F0 2.638(\)\). This)B .138(mimicks a)2.638 F -.8(We)108 316.8 S +(bAuthn login step.).8 E(The follo)108 333.6 Q +(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 +345.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> +128 357.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 +(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 369.6 Q F5 +(tzpfms.backend)108 386.4 Q F0 2.708(identi\214es this dataset for w) +5.208 F 2.707(ork with)-.1 F F1(FIDO2)5.207 E F0(-back-ended)A F2 +(tzpfms)5.207 E F0 2.707(tools \(i.e.)5.207 F F2(fzifdso)108 398.4 Q F5 +(zfs-fido2-change-key)36.505 E F0(\(8\),)A F5(zfs-fido2-load-key)33.005 +E F0 30.505(\(8\), and)B F5(zfs-fido2-clear-key)108 410.4 Q F0(\(8\)\).) +A F5(tzpfms.key)108 427.2 Q F0 .486(is a colon-separated tuple of unpad\ +ded URL-safe base64 blobs; the \214rst one is the ran-)2.986 F .217(dom\ + salt; the second represents the ID of created credential, and the thir\ +d \211 its public k)108 439.2 R -.15(ey)-.1 G 5.217(.T)-.5 G .217 +(here e)-5.217 F(xists)-.15 E(no other user)108 451.2 Q +(-land tool for deciphering this; perhaps there should be.)-.2 E +(Finally)108 468 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 +G 9.506(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 +(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 480 Q +F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) +-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 +G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F +(to clean up the properties, or to issue a note for manual interv)108 +492 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 508.8 +S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.555 E F0 +6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 +(command succeeds, all is well, b)108 520.8 R .729 +(ut otherwise the dataset can be manually rolled back to a passphrase) +-.2 F(with)108 532.8 Q F2(zfs-fido2-clear-key)5.147 E F3(dataset)8.647 E +F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F +10.312 E F5(keyformat=passphrase)108 544.8 Q F3(dataset)6 E F0 +(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E +F2(zfs-fido2-clear-key)108 561.6 Q F3(dataset)7.606 E F0 1.607 +(can be used to clear the properties and go back to using a)4.106 F +(passphrase.)108 573.6 Q F1(OPTIONS)72 590.4 Q F2109.666 602.4 Q +F3(backup-file)6 E F0(Sa)203 602.4 Q .353 -.15(ve a b)-.2 H .052 +(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 +E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 +F .693(This back-up)203 614.4 R F4(must)3.193 E F0 .694 +(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 626.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 638.4 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F1(ENVIR)72 655.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 +E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q F0 .046(By def)133 679.2 R +.045(ault, passphrases are prompted for and read in on the standard out\ +put and input streams.)-.1 F(If)5.045 E F5(TZPFMS_PASSPHRASE_HELPER)133 +691.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw) +-4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.096 E F2 3.262 +(sh \255c)B F0(to)4.096 E(pro)133 703.2 Q +(vide each passphrase, instead.)-.15 E .643 +(The standard output stream of the helper is tied to an anon)133 720 R +.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) +133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 +(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E(fzifdso 0)72 817.889 Q +(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP +%%Page: 2 2 +%%BeginPageSetup +BP +%%EndPageSetup +/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) +-2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q +(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) +-2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 124.8 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B +(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 +1.666(FIDO2 back-end con\214guration)72 153.6 R(En)87 165.6 Q(vir)-.4 E +.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 177.6 Q F0 +(If set, enables lib\214do2 deb)173 177.6 Q +(ug logging to the standard error stream.)-.2 E F2(De)87 194.4 Q .625 +(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 206.4 R +.727(vice which supports the)-.25 F F1(hmac-secret)3.226 E F0 -.15(ex) +3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F +(the assertion is shopped around to e)108 218.4 Q -.15(ve)-.25 G +(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 235.2 R F0 +(The lib\214do2 documentation at https://de)108 247.2 Q -.15(ve)-.25 G +(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 264 R +F0 1.6 -.8(To a)108 276 T(ll who support further de).8 E -.15(ve)-.25 G +(lopment, in particular:).15 E F2<83>128 288 Q F0(ThePhD)7.5 E F2<83>128 +300 Q F0(Embark Studios)7.5 E F2<83>128 312 Q F0(Jasper Bekk)7.5 E(ers) +-.1 E F2<83>128 324 Q F0(EvModder)7.5 E F2(REPOR)72 340.8 Q 1.666 +(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 352.8 Q +(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 +(\001nabijaczleweli/tzpfms@lists.sr.ht)108 369.6 Q F0 83.762(,a)C(rchi) +-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) +108 381.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 +817.889 Q(February 28, 2024)153.568 E(2)183.837 E 0 Cg EP +%%Page: 1 3 +%%BeginPageSetup +BP +%%EndPageSetup +/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 +F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF +(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.588 G -.25(ew)-3.587 G +1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G +(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 +108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-change-key)108 136.8 Q/F3 10 +/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 +(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G +2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E +F1(FIDO2)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F +-.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F +13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E +F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 +(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) +14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 +213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-fido2-change-key)2.5 E F0 +(\(8\) for a detailed description.)A F1(ENVIR)72 247.2 Q 1.666(ONMENT V) +-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .045 +(By def)133 271.2 R .045(ault, passphrases are prompted for and read in\ + on the standard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.596(is set and nonempty)4.096 +F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 295.2 Q +(vide each passphrase, instead.)-.15 E .643 +(The standard output stream of the helper is tied to an anon)133 312 R +.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) +133 324 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 336 Q F0 +(Pre-formatted noun phrase with all the information belo)160 336 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 348 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 348 Q +2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 360 Q F0("ne)160 360 Q +(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) +-2.5 E F4($4)143 372 Q F0("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 388.8 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +400.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 +G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 +(FIDO2 back-end con\214guration)72 417.6 R(En)87 429.6 Q(vir)-.4 E .625 +(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 441.6 Q F0 +(If set, enables lib\214do2 deb)173 441.6 Q +(ug logging to the standard error stream.)-.2 E F1(De)87 458.4 Q .625 +(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 470.4 R +.726(vice which supports the)-.25 F F4(hmac-secret)3.227 E F0 -.15(ex) +3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F +(the assertion is shopped around to e)108 482.4 Q -.15(ve)-.25 G +(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 499.2 R F0 +(The lib\214do2 documentation at https://de)108 511.2 Q -.15(ve)-.25 G +(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 528 R +F0 1.6 -.8(To a)108 540 T(ll who support further de).8 E -.15(ve)-.25 G +(lopment, in particular:).15 E F1<83>128 552 Q F0(ThePhD)7.5 E F1<83>128 +564 Q F0(Embark Studios)7.5 E F1<83>128 576 Q F0(Jasper Bekk)7.5 E(ers) +-.1 E F1<83>128 588 Q F0(EvModder)7.5 E F1(REPOR)72 604.8 Q 1.666 +(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 616.8 Q +(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 +(\001nabijaczleweli/tzpfms@lists.sr.ht)108 633.6 Q F0 83.763(,a)C(rchi) +-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) +108 645.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 +817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP +%%Page: 1 4 +%%BeginPageSetup +BP +%%EndPageSetup +/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) +-.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F +(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 +/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G +(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 +112.8 Q F2(zfs-fido2-change-key)108 124.8 Q F0([)2.5 E F21.666 E +F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 +Q F0 1.141(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.641 E F0 -.1 +(wa)3.641 G 3.641(se).1 G 1.141(ncrypted with)-3.641 F F2(tzpfms)3.641 E +F0(back)3.641 E(end)-.1 E F1(FIDO2)3.641 E F0 3.641(,a)C 1.142 +(sserts the preserv)-3.641 F 1.142(ed chal-)-.15 F(lenge, HMA)108 165.6 +Q(Cking the salt with the on-de)-.4 E +(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) +.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF +(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 +(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 +(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) +.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 +(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G +3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 223.2 Q F0 -.55('s)C F2 +4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F +(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .045(By def) +133 264 R .045(ault, passphrases are prompted for and read in on the st\ +andard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.596(is set and nonempty)4.096 F +4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 288 Q +(vide each passphrase, instead.)-.15 E .643 +(The standard output stream of the helper is tied to an anon)133 304.8 R +.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) +133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 +(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 340.8 Q +2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 352.8 Q F0("ne)160 +352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G +(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q +(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 381.6 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 +G(ther reason, the prompting is aborted.)-2.5 E F1 1.666(SPECIAL THANKS) +72 410.4 R F0 1.6 -.8(To a)108 422.4 T(ll who support further de).8 E +-.15(ve)-.25 G(lopment, in particular:).15 E F1<83>128 434.4 Q F0 +(ThePhD)7.5 E F1<83>128 446.4 Q F0(Embark Studios)7.5 E F1<83>128 458.4 +Q F0(Jasper Bekk)7.5 E(ers)-.1 E F1<83>128 470.4 Q F0(EvModder)7.5 E F1 +(REPOR)72 487.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 +499.2 Q(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 +(\001nabijaczleweli/tzpfms@lists.sr.ht)108 516 Q F0 83.762(,a)C(rchi) +-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) +108 528 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 +817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP +%%Page: 1 5 +%%BeginPageSetup +BP +%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 -1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 -/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-change-key)108 124.8 Q F0([) +2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E +/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A +F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 @@ -326,26 +591,28 @@ listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 -(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-fido2-change-key)6 E F4 72(NAME BACK-END)108 487.2 R +18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 -24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 -559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 -F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F -6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) -108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R -18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 -(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) -54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q -F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666 +(zfs-fido2-change-key \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 +(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) +108 583.2 Q F2 1.666(zfs-fido2-change-key \255b)6 F F1(TPM2)6 E F4 72 +(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 +(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-fido2-change-key \255ra)6 F F3(tarta-zoot)6 E F4 72 +(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 +(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 +(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 +(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) +108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 +(zfs-fido2-change-key \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) 108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(December 4, 2022)83.023 E(1)183.842 E 0 Cg EP -%%Page: 2 2 +%%Page: 2 6 %%BeginPageSetup BP %%EndPageSetup @@ -362,7 +629,7 @@ F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) -.25 E(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(December 4, 2022)83.023 E (2)183.842 E 0 Cg EP -%%Page: 1 3 +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup @@ -371,192 +638,193 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 -(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T -5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 -E F0 5.266(will open its encryption root in its stead.)7.766 F F2 -(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E -(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) --2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-fido2-change-key)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 +E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.867 -.8(To n)108 153.6 +T 1.267(ormalise the).8 F F3(dataset)3.767 E F0(,)A F2 +(zfs-fido2-change-key)3.766 E F0 1.266 +(will open its encryption root in its stead.)3.766 F F2 +(zfs-fido2-change-key)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 +SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) +-.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF +(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.177 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 211.2 R .926 +(data will be silently cleared.)108 223.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q -.294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 +(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q +.295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 -(\), and sealed)B .586(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q +(\), and sealed)B .585(on the TPM; the user is prompted for an optional\ + passphrase to protect the k)108 264 R .886 -.15(ey w)-.1 H .586 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 321.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 -(ork with)-.1 F F1(TPM1.X)2.792 E F0(-back-ended)A F2(tzpfms)2.792 E F0 -.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 333.6 Q F0 +108 333.6 Q F0 .292(identi\214es this dataset for w)2.792 F .291 +(ork with)-.1 F F1(TPM1.X)2.791 E F0(-back-ended)A F2(tzpfms)2.791 E F0 +.291(tools \(namely)2.791 F F5(zfs-tpm1x-change-key)108 345.6 Q F0 (\(8\),)A F5(zfs-tpm1x-load-key)2.5 E F0(\(8\), and)A F5 -(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 350.4 Q F0 -1.412(is a colon-separated pair of he)3.913 F 1.412 -(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 -(\214rst one represents the RSA k)108 362.4 R 1.167 -.15(ey p)-.1 H .868 +(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q F0 +1.412(is a colon-separated pair of he)3.912 F 1.412 +(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .868 +(\214rst one represents the RSA k)108 374.4 R 1.168 -.15(ey p)-.1 H .867 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 374.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 -(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 -(he sec-)-3.913 F .379 -(ond represents the sealed object containing the wrapping k)108 386.4 R +.15 F(pro)108 386.4 Q 1.413(vided, or the SHA1 constant)-.15 F F5 +(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.914 E F0 3.914(;t)C 1.414 +(he sec-)-3.914 F .379 +(ond represents the sealed object containing the wrapping k)108 398.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 398.4 Q F0 6.721(.T)C -1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 -(-land tool for)-.2 F(decrypting this; perhaps there should be.)108 -410.4 Q(Finally)108 427.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F --.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F -17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 -(keyformat=raw)108 439.2 Q F3(dataset)6.107 E F0 .107 -(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 -(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 -(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.72(.T)C 1.72 +(here e)-6.72 F 1.721(xists no other user)-.15 F 1.721(-land tool for) +-.2 F(decrypting this; perhaps there should be.)108 422.4 Q(Finally)108 +439.2 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506 +(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 +(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 451.2 +Q F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) +-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 +G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -451.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 468 -S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 -6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 -(command succeeds, all is well, b)108 480 R .729 +463.2 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 480 +S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.555 E F0 +6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 +(command succeeds, all is well, b)108 492 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 492 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E -F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F -10.313 E F5(keyformat=passphrase)108 504 Q F3(dataset)6 E F0 +-.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.147 E F3(dataset)8.647 E +F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F +10.312 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 520.8 Q F3(dataset)7.607 E F0 1.607 -(can be used to clear the properties and go back to using a)4.107 F -(passphrase.)108 532.8 Q F1(OPTIONS)72 549.6 Q F2109.666 561.6 Q -F3(backup-file)6 E F0(Sa)203 561.6 Q .352 -.15(ve a b)-.2 H .052 +F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.606 E F0 1.607 +(can be used to clear the properties and go back to using a)4.106 F +(passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q +F3(backup-file)6 E F0(Sa)203 573.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 573.6 R F4(must)3.194 E F0 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 585.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 597.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 614.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .638(Bind the k)203 614.4 R .939 -.15(ey t)-.1 H +E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 +F .693(This back-up)203 585.6 R F4(must)3.193 E F0 .694 +(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .639(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 -3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 -(hange, the wrap-)-3.139 F .463(ping k)203 626.4 R .763 -.15(ey w)-.1 H -.463(ill not be able to be unsealed.).15 F .462 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 638.4 Q F1(24) +3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .638 +(hange, the wrap-)-3.139 F .462(ping k)203 638.4 R .762 -.15(ey w)-.1 H +.462(ill not be able to be unsealed.).15 F .463 +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F1(ENVIR)72 655.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q -F0 .045(By def)133 679.2 R .045(ault, passphrases are prompted for and \ -read in on the standard output and input streams.)-.1 F(If)5.046 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 691.2 Q F0 1.596(is set and nonempty)4.096 +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q +F0 .046(By def)133 691.2 R .045(ault, passphrases are prompted for and \ +read in on the standard output and input streams.)-.1 F(If)5.045 E F5 +(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 703.2 Q +(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 715.2 Q (vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 720 R +(The standard output stream of the helper is tied to an anon)133 732 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 -(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E(tzpfms 0.3.4-10-g6a143b6)72 +133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(February 28, 2024)83.018 E(1)183.837 E 0 Cg EP -%%Page: 2 4 +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 36.913(ZFS-TPM1X-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 34.412(anual ZFS-TPM1X-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q +-2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 +(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 124.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +-2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 136.8 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B +(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(TPM1.X back-end con\214guration)72 153.6 R .625(TPM selection)87 -165.6 R F0(The)108 177.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 -.229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 189.6 Q -(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 206.4 R(rouSerS) --.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -218.4 S(ing one of the earlier ones with, for e).1 E +1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 +177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.73 E F0 .23 +(suite connects to a local)2.73 F F1(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F1(localhost:30003)2.729 E F0 2.729(\)b)C 2.729 +(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 F(the)2.729 E(en)108 201.6 +Q(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .11(The T)108 218.4 R(rouSerS) +-.35 E F1(tcsd)2.61 E F0 .11(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E +F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 +E F1(/dev/tpm)2.611 E F0 2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1 +(py)108 230.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 235.2 R F0(The T)108 247.2 Q +(See also)87 247.2 R F0(The T)108 259.2 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 -(The TPM 1.2 main speci\214cation inde)108 264 R 6.915(xa)-.15 G 6.915 +(The TPM 1.2 main speci\214cation inde)108 276 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 276 Q F2 1.666 -(SPECIAL THANKS)72 292.8 R F0 1.6 -.8(To a)108 304.8 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 288 Q F2 1.666 +(SPECIAL THANKS)72 304.8 R F0 1.6 -.8(To a)108 316.8 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 316.8 Q F0(ThePhD)7.5 E F2<83>128 328.8 Q F0 -(Embark Studios)7.5 E F2<83>128 340.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 352.8 Q F0(EvModder)7.5 E F2(REPOR)72 369.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 381.6 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 398.4 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E -(https://lists.sr)108 410.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E F2 1.666(SEE ALSO)72 427.2 R F0 -(PCR allocations: https://wiki.archlinux.or)108 439.2 Q(g/title/T)-.18 E +.15 E F2<83>128 328.8 Q F0(ThePhD)7.5 E F2<83>128 340.8 Q F0 +(Embark Studios)7.5 E F2<83>128 352.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +(https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E F2 1.666(SEE ALSO)72 439.2 R F0 +(PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E (rusted_Platform_Module#Accessing_PCR_re)-.35 E(gisters)-.15 E -(and https://trustedcomputinggroup.or)108 451.2 Q +(and https://trustedcomputinggroup.or)108 463.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ -r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 463.2 Q -(able)-.8 E(1.)108 475.2 Q(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q +r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q +(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q (February 28, 2024)83.018 E(2)183.837 E 0 Cg EP -%%Page: 1 5 +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 45.793(ZFS-TPM1X-CLEAR-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 43.292(anual ZFS-TPM1X-CLEAR-KEY\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G +(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.008 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q -(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G -(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM1.X) -2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F -.25(va) --.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E -/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 -(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-fido2-change-key)108 136.8 Q/F3 10 +/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 +(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G +2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E +F1(TPM1.X)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F +-.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F +13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E +F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm1x-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1 1.666 (TPM1.X back-end con\214guration)72 247.2 R .625(TPM selection)87 259.2 -R F0(The)108 271.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 300 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 312 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 271.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 283.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 300 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +312 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 328.8 R F0(The T)108 340.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -571,11 +839,11 @@ F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 446.4 Q F0(EvModder)7.5 E F1(REPOR)72 463.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP -%%Page: 1 6 +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -584,15 +852,15 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 -10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .191 -(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1(wa)2.691 -G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E F0(back) -2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 F .49 --.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset)2.5 E -F0(.)A .236 +112.8 Q F2(zfs-fido2-change-key)108 124.8 Q F0([)2.5 E F21.666 E +F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 +Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 +(wa)2.69 G 2.69(se).1 G .19(ncrypted with)-2.69 F F2(tzpfms)2.69 E F0 +(back)2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .191(will unseal the k)2.69 F +.491 -.15(ey a)-.1 H .191(nd load).15 F(it into)108 165.6 Q F3(dataset) +2.5 E F0(.)A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) -108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F +108 182.4 R .236(wnership, if not "well-kno)-.25 F .235(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) 108 194.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E (as set.)-.1 E(See)108 211.2 Q/F4 10/Courier@0 SF(zfs-tpm1x-change-key) @@ -600,14 +868,14 @@ F0(.)A .236 109.666 240 Q F0 3.208(Do a no-op/dry run, can be used e)131 240 R -.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) -8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 +8.208 E -.25(va)-.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 252 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 268.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 -280.8 Q F0 .045(By def)133 292.8 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.046 -E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.596(is set and nonempty) -4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F -F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q +280.8 Q F0 .046(By def)133 292.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.045 +E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.595(is set and nonempty) +4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 333.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -620,23 +888,23 @@ F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q 381.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F0("ag)160 393.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 410.4 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 410.4 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 +.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 422.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 439.2 R .625(TPM selection)87 451.2 -R F0(The)108 463.2 Q F2(tzpfms)2.729 E F0 .229 -(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 475.2 Q -(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 492 R(rouSerS) --.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -504 S(ing one of the earlier ones with, for e).1 E +R F0(The)108 463.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 492 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 504 S +(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 520.8 R F0(The T)108 532.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -651,11 +919,11 @@ F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F1<83>128 638.4 Q F0(EvModder)7.5 E F1(REPOR)72 655.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP -%%Page: 1 7 +%%Page: 1 11 %%BeginPageSetup BP %%EndPageSetup @@ -664,112 +932,112 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 -(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) -A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) -A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.676 -.8(To n)108 165.6 -T(ormalise).8 E F3(dataset)2.576 E F0(,)A F2(zfs-tpm-list)2.576 E F0 -.076(will open its encryption root in its stead.)2.576 F F2 -(zfs-tpm-list)5.077 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 -E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G -(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 -(\(8\) for that.)A(First, a connection is made to the TPM, which)108 -194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 -(dataset)3.055 E F0 -.1(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555 -(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F -F1(TPM2)3.055 E F0 .554(back-end w)3.054 F .554(as used, the pre)-.1 F -(vious)-.25 E -.1(ke)108 223.2 S 3.059(yw)-.05 G .559 -(ill be freed from the TPM.)-3.059 F .56 +(SYNOPSIS)72 112.8 Q F2(zfs-fido2-change-key)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 +1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A +F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A +F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.32 -.8(To n)108 +165.6 T(ormalise).8 E F3(dataset)5.22 E F0(,)A F2(zfs-fido2-change-key) +5.22 E F0 2.719(will open its encryption root in its stead.)5.22 F F2 +(zfs-fido2-change-key)108 177.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 +SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) +-.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF +(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E +F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.055 E F0 -.1 +(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555(viously encrypted with)-.25 F +F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .554 +(back-end w)3.054 F .554(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 +235.2 S 3.059(yw)-.05 G .559(ill be freed from the TPM.)-3.059 F .56 (Otherwise, or in case of an error)5.56 F 3.06(,d)-.4 G .56 (ata required for manual interv)-3.06 F(en-)-.15 E -(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 -252 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 +264 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 (OPTIONS)2.794 E F0 .294(\), and sealed)B .588 -(to a persistent object on the TPM under the o)108 264 R .589 +(to a persistent object on the TPM under the o)108 276 R .589 (wner hierarch)-.25 F .589(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 276 Q 1.603 -.65(y, t)-.05 H .302 +F(wner)-.25 E(hierarch)108 288 Q 1.603 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 288 Q(The follo)108 304.8 Q +(the sealed object with.)108 300 Q(The follo)108 316.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 1.263 +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 1.263 (identi\214es this dataset for w)3.763 F 1.264(ork with)-.1 F F1(TPM2) 3.764 E F0(-back-ended)A F2(tzpfms)3.764 E F0 1.264(tools \(namely)3.764 -F F5(zfs-tpm2-change-key)108 369.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) +F F5(zfs-tpm2-change-key)108 381.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) 2.5 E F0(\(8\), and)A F5(zfs-tpm2-clear-key)2.5 E F0(\(8\)\).)A F5 -(tzpfms.key)108 386.4 Q F0 1.509(is an inte)4.009 F 1.509 +(tzpfms.key)108 398.4 Q F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 (wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 -398.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 (tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B -.866(be passed to)108 410.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +.866(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) 3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) -C(r)-3.365 E F2109.666 422.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +C(r)-3.365 E F2109.666 434.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) -.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A -.448(If you ha)108 434.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F +.448(If you ha)108 446.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) -.25 G .447(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 446.4 Q(.)-.65 E(Finally)108 463.2 Q 12.005 +(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.005 (,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 -E F217.172 E F5(keyformat=raw)108 475.2 Q F3(dataset)6.107 E F0 +E F217.172 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 487.2 R .29(ention into the stan-)-.15 F(dard error stream.) -108 499.2 Q 2.625<418c>108 516 S .125(nal v)-2.625 F .125 + interv)108 499.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 511.2 Q 2.625<418c>108 528 S .125(nal v)-2.625 F .125 (eri\214cation should be made by running)-.15 F F2 1.79 (zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 (ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) -108 528 R .506(ut otherwise the dataset can be manually rolled back to \ -a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 540 Q F3(dataset) +108 540 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) 11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.204 E F5(keyformat=passphrase)108 552 Q F3(dataset)6 E F0 +F13.204 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm2-clear-key)108 568.8 Q F3(dataset)6.029 E F0 .029 +F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 580.8 Q F1(OPTIONS)72 597.6 Q F2109.666 -609.6 Q F3(backup-file)6 E F0(Sa)203 609.6 Q .353 -.15(ve a b)-.2 H .052 +F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 +621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 621.6 R F4(must)3.193 E F0 .694 +F .693(This back-up)203 633.6 R F4(must)3.193 E F0 .694 (be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 633.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 645.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 662.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.425(Bind the k)203 674.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +-1.666 G 1.425(Bind the k)203 686.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C -1.424(ithin their corresponding)-3.924 F(hashing)203 686.4 Q F3 +1.424(ithin their corresponding)-3.924 F(hashing)203 698.4 Q F3 (algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.024(ill not be able to be).15 F 2.5(unsealed. There)203 698.4 R(are)2.5 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 715.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G +A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) .15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") -203 727.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A -F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 739.2 Q F1(sha3-384)A F0 +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 (", and must be supported by the TPM.)A(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(February 28, 2024)83.018 E(1)183.837 E 0 Cg EP -%%Page: 2 8 +%%Page: 2 12 %%BeginPageSetup BP %%EndPageSetup @@ -847,7 +1115,7 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q (able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q (February 28, 2024)83.018 E(2)183.837 E 0 Cg EP -%%Page: 1 9 +%%Page: 1 13 %%BeginPageSetup BP %%EndPageSetup @@ -857,8 +1125,8 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 -(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-fido2-change-key)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 +E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with)-2.5 E F2 (tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM2)2.5 E F0(:)A 5 (1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641 @@ -928,7 +1196,7 @@ F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) -.25 E(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(December 4, 2022)83.023 E (1)183.842 E 0 Cg EP -%%Page: 1 10 +%%Page: 1 14 %%BeginPageSetup BP %%EndPageSetup @@ -937,23 +1205,23 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 -10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .864 -(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1(wa)3.364 -G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E F0(back) -3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865(nseals the k)-3.365 -F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F(into)108 165.6 Q F3 -(dataset)2.5 E F0(.)A(The user is prompted for the additional passphras\ -e, set when creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5 -(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF -(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 -G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) -.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 -(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 +112.8 Q F2(zfs-fido2-change-key)108 124.8 Q F0([)2.5 E F21.666 E +F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 +Q F0 .864(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1 +(wa)3.364 G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E +F0(back)3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865 +(nseals the k)-3.365 F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F +(into)108 165.6 Q F3(dataset)2.5 E F0(.)A(The user is prompted for the \ +additional passphrase, set when creating the k)108 182.4 Q -.15(ey)-.1 G +2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 +10/Courier@0 SF(zfs-tpm2-change-key)2.5 E F0 +(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2109.666 +228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 +G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i) +-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va) +-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s) +C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V) +-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 (By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ on the standard output and input streams.)-.1 F(If)5.046 E F4 (TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 new file mode 100644 index 0000000..44ffb17 --- /dev/null +++ b/zfs-fido2-change-key.8 @@ -0,0 +1,186 @@ +.\" SPDX-License-Identifier: MIT +. +.Dd February 28, 2024 +.ds doc-volume-operating-system +.Dt ZFS-FIDO2-CHANGE-KEY 8 +.Os fzifdso 0 +. +.Sh NAME +.Nm zfs-fido2-change-key +.Nd change ZFS dataset key to one authenticated by a FIDO2 device +.Sh SYNOPSIS +.Nm +.Op Fl b Ar backup-file +.Ar dataset +. +.Sh DESCRIPTION +To normalise the +.Ar dataset , +.Nm +will open its encryption root in its stead. +.Nm +will +.Em never +create or destroy encryption roots; use +.Xr zfs-change-key 8 +for that. +.Pp +First, a connection is made to the FIDO2 device, which +.Em must +support the +.Ql hmac-secret +extension. +.Pp +If +.Ar dataset +was previously encrypted with +.Nm fzifdso +and the +.Sy FIDO2 +back-end was used, the metadata will be silently cleared. +Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. +.Pp +Next, a new credential of type ES256 is generated on the device (with relying party ID +.Li fzifdso +and name equal to the dataset name) +with the +.Ql hmac-secret +extension requested; the device PIN, if any, is prompted for here. +This mimicks a WebAuthn registration step. +.Pp +Then, the credential is asserted with a 32-byte random salt, +which hashes it with device-private data, and thus generates the wrapping key +.Pq which is optionally backed up Pq see Sx OPTIONS . +This mimicks a WebAuthn login step. +.Pp +The following properties are set on +.Ar dataset : +.Bl -bullet -compact -offset 4n -width "@" +.It +.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 +.It +.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm \&:\:\& Ns Ar credential-ID Ns Cm \&:\:\& Ns Ar credential-public-key +.El +.Pp +.Li tzpfms.backend +identifies this dataset for work with +.Sy FIDO2 Ns -back-ended +.Nm tzpfms +tools +.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , and Xr zfs-fido2-clear-key 8 . +.Pp +.Li tzpfms.key +is a colon-separated tuple of unpadded URL-safe base64 blobs; +the first one is the random salt; +the second represents the ID of created credential, +and the third \(en its public key. +There exists no other user-land tool for deciphering this; perhaps there should be. +.\"" TODO: make an LD_PRELOADable for extracting the key maybe? +.Pp +Finally, the equivalent of +.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset +is performed with the new key. +If an error occurred, best effort is made to clean up the properties, +or to issue a note for manual intervention into the standard error stream. +.Pp +A final verification should be made by running +.Nm zfs-fido2-load-key Fl n Ar dataset . +If that command succeeds, all is well, +but otherwise the dataset can be manually rolled back to a passphrase with +.Nm zfs-fido2-clear-key Ar dataset +.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , +and you are hereby asked to report a bug, please. +.Pp +.Nm zfs-fido2-clear-key Ar dataset +can be used to clear the properties and go back to using a passphrase. +. +.Sh OPTIONS +.Bl -tag -compact -width ".Fl b Ar backup-file" +.It Fl b Ar backup-file +Save a back-up of the key to +.Ar backup-file , +which must not exist beforehand. +This back-up +.Em must +be stored securely, off-site. +In case of a catastrophic event, the key can be loaded by running +.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file +.El +. +.\" SPDX-License-Identifier: MIT +. +.Sh ENVIRONMENT VARIABLES +.Bl -tag -compact -width 4n +.It Ev TZPFMS_PASSPHRASE_HELPER +By default, passphrases are prompted for and read in on the standard output and input streams. +If +.Ev TZPFMS_PASSPHRASE_HELPER +is set and nonempty, it will be run via +.Pa /bin/ Ns Nm sh Fl c +to provide each passphrase, instead. +.Pp +The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. +The arguments are: +.Bl -tag -compact -offset 2n -width ".Li $1" +.It Li $1 +Pre-formatted noun phrase with all the information below, for use as a prompt +.\" Passphrase for tarta-zoot +.\" New passphrase for tarta-zoot (again) +.It Li $2 +Either the dataset name or the element of the TPM hierarchy being prompted for +.It Li $3 +.Qq new +if this is for a new passphrase, otherwise blank +.It Li $4 +.Qq again +if it's the second prompt for that passphrase, otherwise blank +.El +.Pp +If the helper doesn't exist +.Pq the shell exits with Sy 127 , +a diagnostic is issued and the normal prompt is used as fall-back. +If it fails for any other reason, the prompting is aborted. +. +. +.El +. +.\" SPDX-License-Identifier: MIT +. +.Sh FIDO2 back-end configuration +.Ss Environment variables +.Bl -tag -compact -width ".Ev FIDO_DEBUG" +.It Ev FIDO_DEBUG +If set, enables libfido2 debug logging to the standard error stream. +.El +. +.Ss Device selection +When creating, the first device which supports the +.Ql hmac-secret +extension is used. +When loading, the assertion is shopped around to every such device. +. +.Ss See also +The libfido2 documentation at +.Lk https:/\&/developers.yubico.com/libfido2/ . +. +.\" SPDX-License-Identifier: MIT +. +.Sh SPECIAL THANKS +To all who support further development, in particular: +.Bl -bullet -offset 4n -compact -width "@" +.It +ThePhD +.It +Embark Studios +.It +Jasper Bekkers +.It +EvModder +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso +.Pp +.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html new file mode 100644 index 0000000..773e801 --- /dev/null +++ b/zfs-fido2-change-key.8.html @@ -0,0 +1,205 @@ + + + + + + + + ZFS-FIDO2-CHANGE-KEY(8) + + + + + + + + +
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
+ + + + + + +
February 28, 2024fzifdso 0
+ + diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 new file mode 100644 index 0000000..dd2a76c --- /dev/null +++ b/zfs-fido2-clear-key.8 @@ -0,0 +1,113 @@ +.\" SPDX-License-Identifier: MIT +. +.Dd February 28, 2024 +.ds doc-volume-operating-system +.Dt ZFS-FIDO2-CLEAR-KEY 8 +.Os fzifdso 0 +. +.Sh NAME +.Nm zfs-fido2-clear-key +.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata +.Sh SYNOPSIS +.Nm +.Ar dataset +. +.Sh DESCRIPTION +After verifying +.Ar dataset +was encrypted with +.Nm tzpfms +backend +.Sy FIDO2 : +.Bl -enum -compact -offset 2n -width 2n +.It +performs the equivalent of +.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , +.It +removes the +.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key +properties from +.Ar dataset . +.El +.Pp +See +.Xr zfs-fido2-change-key 8 +for a detailed description. +. +.\" SPDX-License-Identifier: MIT +. +.Sh ENVIRONMENT VARIABLES +.Bl -tag -compact -width 4n +.It Ev TZPFMS_PASSPHRASE_HELPER +By default, passphrases are prompted for and read in on the standard output and input streams. +If +.Ev TZPFMS_PASSPHRASE_HELPER +is set and nonempty, it will be run via +.Pa /bin/ Ns Nm sh Fl c +to provide each passphrase, instead. +.Pp +The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. +The arguments are: +.Bl -tag -compact -offset 2n -width ".Li $1" +.It Li $1 +Pre-formatted noun phrase with all the information below, for use as a prompt +.\" Passphrase for tarta-zoot +.\" New passphrase for tarta-zoot (again) +.It Li $2 +Either the dataset name or the element of the TPM hierarchy being prompted for +.It Li $3 +.Qq new +if this is for a new passphrase, otherwise blank +.It Li $4 +.Qq again +if it's the second prompt for that passphrase, otherwise blank +.El +.Pp +If the helper doesn't exist +.Pq the shell exits with Sy 127 , +a diagnostic is issued and the normal prompt is used as fall-back. +If it fails for any other reason, the prompting is aborted. +. +. +.El +. +.\" SPDX-License-Identifier: MIT +. +.Sh FIDO2 back-end configuration +.Ss Environment variables +.Bl -tag -compact -width ".Ev FIDO_DEBUG" +.It Ev FIDO_DEBUG +If set, enables libfido2 debug logging to the standard error stream. +.El +. +.Ss Device selection +When creating, the first device which supports the +.Ql hmac-secret +extension is used. +When loading, the assertion is shopped around to every such device. +. +.Ss See also +The libfido2 documentation at +.Lk https:/\&/developers.yubico.com/libfido2/ . +. +.\" SPDX-License-Identifier: MIT +. +.Sh SPECIAL THANKS +To all who support further development, in particular: +.Bl -bullet -offset 4n -compact -width "@" +.It +ThePhD +.It +Embark Studios +.It +Jasper Bekkers +.It +EvModder +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso +.Pp +.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html new file mode 100644 index 0000000..46e553e --- /dev/null +++ b/zfs-fido2-clear-key.8.html @@ -0,0 +1,143 @@ + + + + + + + + ZFS-FIDO2-CLEAR-KEY(8) + + + + + + + + +
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
+
+
+

+

zfs-fido2-clear-key — + rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 + metadata

+
+
+

+ + + + + +
zfs-fido2-clear-keydataset
+
+
+

+

After verifying dataset was encrypted with + tzpfms backend + :

+
    +
  1. performs the equivalent of zfs + change-key -o + keylocation=prompt -o + keyformat=passphrase + dataset,
    2. +
  2. removes the + xyz.nabijaczleweli:tzpfms.{backend, + key} properties from + dataset.
    3. +
+

See + zfs-fido2-change-key(8) + for a detailed description.

+
+
+

+
+
+
By default, passphrases are prompted for and read in on the standard + output and input streams. If + TZPFMS_PASSPHRASE_HELPER is set and nonempty, it + will be run via /bin/sh + -c to provide each passphrase, instead. +

The standard output stream of the helper is tied to an + anonymous file and used in its entirety as the passphrase, except for a + trailing new-line, if any. The arguments are:

+
+
+
+
Pre-formatted noun phrase with all the information below, for use as a + prompt
+
+
Either the dataset name or the element of the TPM hierarchy being + prompted for
+
+
"new" if this is for a new passphrase, otherwise blank
+
+
"again" if it's the second prompt for that passphrase, + otherwise blank
+
+
+

If the helper doesn't exist (the shell exits with + ), a + diagnostic is issued and the normal prompt is used as fall-back. If it + fails for any other reason, the prompting is aborted.

+
+
+
+
+

+
+

+
+
+
If set, enables libfido2 debug logging to the standard error stream.
+
+
+
+

+

When creating, the first device which supports the + ‘hmac-secret’ extension is used. When + loading, the assertion is shopped around to every such device.

+
+
+

+

The libfido2 documentation at + https://developers.yubico.com/libfido2/.

+
+
+
+

+

To all who support further development, in particular:

+
    +
  • ThePhD
    • +
  • Embark Studios
    • +
  • Jasper Bekkers
    • +
  • EvModder
    • +
+
+
+

+

https://todo.sr.ht/~nabijaczleweli/fzifdso

+

~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

+
+
+ + + + + +
February 28, 2024fzifdso 0
+ + diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 new file mode 100644 index 0000000..247ca04 --- /dev/null +++ b/zfs-fido2-load-key.8 @@ -0,0 +1,98 @@ +.\" SPDX-License-Identifier: MIT +. +.Dd February 28, 2024 +.ds doc-volume-operating-system +.Dt ZFS-FIDO2-LOAD-KEY 8 +.Os fzifdso 0 +. +.Sh NAME +.Nm zfs-fido2-load-key +.Nd load FIDO2-encrypted ZFS dataset key +.Sh SYNOPSIS +.Nm +.Op Fl n +.Ar dataset +. +.Sh DESCRIPTION +After verifying +.Ar dataset +was encrypted with +.Nm tzpfms +backend +.Sy FIDO2 , +asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into +.Ar dataset . +.Pp +See +.Xr zfs-fido2-change-key 8 +for a detailed description. +. +.Sh OPTIONS +.Bl -tag -compact -width ".Fl n" +.It Fl n +Do a no-op/dry run, can be used even if the key is already loaded. +Equivalent to +.Nm zfs Cm load-key Ns 's +.Fl n +option. +.El +. +.\" SPDX-License-Identifier: MIT +. +.Sh ENVIRONMENT VARIABLES +.Bl -tag -compact -width 4n +.It Ev TZPFMS_PASSPHRASE_HELPER +By default, passphrases are prompted for and read in on the standard output and input streams. +If +.Ev TZPFMS_PASSPHRASE_HELPER +is set and nonempty, it will be run via +.Pa /bin/ Ns Nm sh Fl c +to provide each passphrase, instead. +.Pp +The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. +The arguments are: +.Bl -tag -compact -offset 2n -width ".Li $1" +.It Li $1 +Pre-formatted noun phrase with all the information below, for use as a prompt +.\" Passphrase for tarta-zoot +.\" New passphrase for tarta-zoot (again) +.It Li $2 +Either the dataset name or the element of the TPM hierarchy being prompted for +.It Li $3 +.Qq new +if this is for a new passphrase, otherwise blank +.It Li $4 +.Qq again +if it's the second prompt for that passphrase, otherwise blank +.El +.Pp +If the helper doesn't exist +.Pq the shell exits with Sy 127 , +a diagnostic is issued and the normal prompt is used as fall-back. +If it fails for any other reason, the prompting is aborted. +. +. +.El +. +. +.\" SPDX-License-Identifier: MIT +. +.Sh SPECIAL THANKS +To all who support further development, in particular: +.Bl -bullet -offset 4n -compact -width "@" +.It +ThePhD +.It +Embark Studios +.It +Jasper Bekkers +.It +EvModder +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso +.Pp +.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html new file mode 100644 index 0000000..ffc6446 --- /dev/null +++ b/zfs-fido2-load-key.8.html @@ -0,0 +1,117 @@ + + + + + + + + ZFS-FIDO2-LOAD-KEY(8) + + + + + + + + +
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
+
+
+

+

zfs-fido2-load-key — + load FIDO2-encrypted ZFS dataset key

+
+
+

+ + + + + +
zfs-fido2-load-key[-n] dataset
+
+
+

+

After verifying dataset was encrypted with + tzpfms backend + , + asserts the preserved challenge, HMACking the salt with the on-device + secret, and loads the resulting key into dataset.

+

See + zfs-fido2-change-key(8) + for a detailed description.

+
+
+

+
+
+
Do a no-op/dry run, can be used even if the key is already loaded. + Equivalent to zfs + load-key's -n option.
+
+
+
+

+
+
+
By default, passphrases are prompted for and read in on the standard + output and input streams. If + TZPFMS_PASSPHRASE_HELPER is set and nonempty, it + will be run via /bin/sh + -c to provide each passphrase, instead. +

The standard output stream of the helper is tied to an + anonymous file and used in its entirety as the passphrase, except for a + trailing new-line, if any. The arguments are:

+
+
+
+
Pre-formatted noun phrase with all the information below, for use as a + prompt
+
+
Either the dataset name or the element of the TPM hierarchy being + prompted for
+
+
"new" if this is for a new passphrase, otherwise blank
+
+
"again" if it's the second prompt for that passphrase, + otherwise blank
+
+
+

If the helper doesn't exist (the shell exits with + ), a + diagnostic is issued and the normal prompt is used as fall-back. If it + fails for any other reason, the prompting is aborted.

+
+
+
+
+

+

To all who support further development, in particular:

+
    +
  • ThePhD
    • +
  • Embark Studios
    • +
  • Jasper Bekkers
    • +
  • EvModder
    • +
+
+
+

+

https://todo.sr.ht/~nabijaczleweli/fzifdso

+

~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

+
+
+ + + + + +
February 28, 2024fzifdso 0
+ +
+
+

+

zfs-fido2-change-key — + change ZFS dataset key to one authenticated by a FIDO2 + device

+
+
+

+ + + + + +
zfs-fido2-change-key[-b backup-file] + dataset
+
+
+

+

To normalise the dataset, + zfs-fido2-change-key will open its encryption root + in its stead. zfs-fido2-change-key will + + create or destroy encryption roots; use + zfs-change-key(8) + for that.

+

First, a connection is made to the FIDO2 device, which + must support the + ‘hmac-secret’ extension.

+

If dataset was previously encrypted with + fzifdso and the FIDO2 back-end was + used, the metadata will be silently cleared. Otherwise, or in case of an + error, data required for manual intervention will be written to the standard + error stream.

+

Next, a new credential of type ES256 is generated on the device + (with relying party ID fzifdso and name equal to the + dataset name) with the ‘hmac-secret’ + extension requested; the device PIN, if any, is prompted for here. This + mimicks a WebAuthn registration step.

+

Then, the credential is asserted with a 32-byte random salt, which + hashes it with device-private data, and thus generates the wrapping key + (which is optionally backed up (see + OPTIONS)). This mimicks a WebAuthn login + step.

+

The following properties are set on + dataset:

+ +

tzpfms.backend identifies this dataset for + work with FIDO2-back-ended tzpfms + tools (i.e. fzifdso + zfs-fido2-change-key(8), + zfs-fido2-load-key(8), + and + zfs-fido2-clear-key(8)).

+

tzpfms.key is a colon-separated tuple of + unpadded URL-safe base64 blobs; the first one is the random salt; the second + represents the ID of created credential, and the third – its public + key. There exists no other user-land tool for deciphering this; perhaps + there should be.

+

Finally, the equivalent of zfs + change-key -o + keylocation=prompt -o + keyformat=raw dataset is + performed with the new key. If an error occurred, best effort is made to + clean up the properties, or to issue a note for manual intervention into the + standard error stream.

+

A final verification should be made by running + zfs-fido2-load-key -n + dataset. If that command succeeds, all is well, but + otherwise the dataset can be manually rolled back to a passphrase with + zfs-fido2-clear-key dataset + (or, if that fails to work, zfs + change-key -o + keyformat=passphrase dataset), + and you are hereby asked to report a bug, please.

+

zfs-fido2-clear-key + dataset can be used to clear the properties and go + back to using a passphrase.

+
+
+

+
+
+ backup-file
+
Save a back-up of the key to backup-file, which must + not exist beforehand. This back-up must be stored + securely, off-site. In case of a catastrophic event, the key can be loaded + by running +
zfs + load-key dataset + < + backup-file
+
+
+
+
+

+
+
+
By default, passphrases are prompted for and read in on the standard + output and input streams. If + TZPFMS_PASSPHRASE_HELPER is set and nonempty, it + will be run via /bin/sh + -c to provide each passphrase, instead. +

The standard output stream of the helper is tied to an + anonymous file and used in its entirety as the passphrase, except for a + trailing new-line, if any. The arguments are:

+
+
+
+
Pre-formatted noun phrase with all the information below, for use as a + prompt
+
+
Either the dataset name or the element of the TPM hierarchy being + prompted for
+
+
"new" if this is for a new passphrase, otherwise blank
+
+
"again" if it's the second prompt for that passphrase, + otherwise blank
+
+
+

If the helper doesn't exist (the shell exits with + ), a + diagnostic is issued and the normal prompt is used as fall-back. If it + fails for any other reason, the prompting is aborted.

+
+
+
+
+

+
+

+
+
+
If set, enables libfido2 debug logging to the standard error stream.
+
+
+
+

+

When creating, the first device which supports the + ‘hmac-secret’ extension is used. When + loading, the assertion is shopped around to every such device.

+
+
+

+

The libfido2 documentation at + https://developers.yubico.com/libfido2/.

+
+
+
+

+

To all who support further development, in particular:

+
    +
  • ThePhD
    • +
  • Embark Studios
    • +
  • Jasper Bekkers
    • +
  • EvModder
    • +
+
+
+

+

https://todo.sr.ht/~nabijaczleweli/fzifdso

+

~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

+
+