From 989e570afd680cb8713624cd89a0fdfd1327c21e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Fri, 1 Mar 2024 11:03:21 +0000 Subject: [PATCH] Manpage update by job 1160016 --- tzpfms.pdf | Bin 81303 -> 65607 bytes tzpfms.ps | 906 +++++++++++------------------------- zfs-fido2-add-backup.8 | 125 ----- zfs-fido2-add-backup.8.html | 153 ------ zfs-fido2-change-key.8 | 186 -------- zfs-fido2-change-key.8.html | 206 -------- zfs-fido2-clear-key.8 | 113 ----- zfs-fido2-clear-key.8.html | 143 ------ zfs-fido2-load-key.8 | 98 ---- zfs-fido2-load-key.8.html | 117 ----- zfs-tpm-list.8 | 2 +- zfs-tpm-list.8.html | 2 +- zfs-tpm1x-change-key.8 | 2 +- zfs-tpm1x-change-key.8.html | 2 +- zfs-tpm1x-clear-key.8 | 2 +- zfs-tpm1x-clear-key.8.html | 2 +- zfs-tpm1x-load-key.8 | 2 +- zfs-tpm1x-load-key.8.html | 2 +- zfs-tpm2-change-key.8 | 2 +- zfs-tpm2-change-key.8.html | 2 +- zfs-tpm2-clear-key.8 | 2 +- zfs-tpm2-clear-key.8.html | 2 +- zfs-tpm2-load-key.8 | 2 +- zfs-tpm2-load-key.8.html | 2 +- 24 files changed, 287 insertions(+), 1788 deletions(-) delete mode 100644 zfs-fido2-add-backup.8 delete mode 100644 zfs-fido2-add-backup.8.html delete mode 100644 zfs-fido2-change-key.8 delete mode 100644 zfs-fido2-change-key.8.html delete mode 100644 zfs-fido2-clear-key.8 delete mode 100644 zfs-fido2-clear-key.8.html delete mode 100644 zfs-fido2-load-key.8 delete mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index 838777b6793fc8c3ed0e6cfee304104b18b1cac1..4413ce339a430c651c33fa2c3751c5786301cf6d 100644 GIT binary patch delta 44681 zcmZU)V{o8Rx2+r7cG7Xjwv&!+t7F^A8{4)!Ham95wr$(V{q{L~-@3Q+RrS!jdk}{=q)%id4GWqcR%42*tUG(`rX_aoGxGEI~Y4s!F)R42(v

L zb-z@}Eb3K`g50s+$Br&qv!02~uFc5OQI>xOOBB$HAKMZ@FwDMwe?3`P?Bx4>SLcW|hJ7=K#_DO9{pH4DkE8dMPoqQwvaEbD(thOzMfD&o-(l2HAPZ)Z zM#YLWejW?0cOz&!?X6HPB1XS)-BhI#M=6nDwa|&MO{ryvH(ahymC1-}J~&=p2q?6a z$0L`EaaP1v{xFL6jyS=?c+-6{AHV0EUp-%UCqBB~+C~U)ku|{45V}QEvkp-AOgu10 zu(()HlHei$PA}#^7+H`chK1Jh#tM3SO2AAd?_LlNT(3MlTHXON$M|LLeJzNYX$Qvmws> z7zF8)DcBqo6|eEgar7j~&*%dM+#QT0?spZ-5W+7-O6N7O3D$r;v=GmyOFNx#3k*aA z+(^Qn80?)i%-WVexl&W{_nE?!LEKg1Yy5kk^#@kMQFHUYfHa|3$;nD;iJ7iP$ z`Rn9Q82?d3@Hw>F`0#>pxTcA7(3yb)-gKr~=9l3wP;(#L@2P<>u?sP@Z&i2V)SN|0 z7simCVpkaWAz@*9oG-t)zS2u#;jD$ zVZLX$l@(M!h+1qVSTW{av|6JQ!Ea8j@(gPu)GlTlRKSSUZ4hOsxmj(&-pT9PSz$YO zE0TjoGE?5Bq#gY)C9{j6S`Q>k^aWoQorl88%Hkvz(a^~jE zvR5(Tdz%X98!T}qHu77#-&CqdYeKlxb{)g`&xNCbdgEXZ?WvHF)s(4VJMJ&kszPx+ z3|s6lPHj`IQo$_DBUNN+}PU|KMzLLYX$Of}9(AEY<^$*RO!=-~|S6 z+zZ9#3!MNm$JP+#d>Lxx=2YG>`KLo3#z>Ehi`klyL;HqnlY!H7;ntCbpBnsrkWw(@ z)T{fn$%lI0GUY!xNuztDpd6@8$0`+H@$H4r^gNYNP~Rd`y)hy%UFs>I^N0lJ6mo33 z%-oIxaRy_+x=N;0u^oOLY zPNTQhxY;4U5FAC}=J?Q1tbfe;tVBR;wLHA^`8nU{=ezb`(of^9W6fAW7NcRcD%*Jc zfPBo7EL5gUCM&;>5W+MF%oi&048BWolCvb~aFmQyyqd+;&)w*0nZo=|Fz*faSxhYXGiM20l&3Xs{ktFx=%=L)?=EdI z(`{wMlCaT|Rag$0y%RtK6B~7bVcr6XDWHID)*I69x@-+v>Lap*rpE;(bZU&s?Steo z405@bn4`C+qM6*U;gtZ4#rWHX5RxmjG{bmO9$hNr{1XCp%spM($%OBL{4hz{jw7F6}4Rj5ays_;GtYMzbe~v zVMHzWEe3T!qmlW0o~bHzo>IU2-jL8XZEqgw!5G@*HRk%@6ube-bM~+J;Tq)V6HNBk z??^WsT3_L+O?Su>m!9uWo451B$FRzBA{zN+P#%22*mBPH{3n5`#~ShKNbkqz(X8?F zpKq^skBmnTM{@iv_`FS9w|*I499afa-yEW~+dVm3^7coMvJN^j>in*>`l=f~{?SEO zx%@5vu03-=ny`VxmH39n6Wn&q0jR(QPKdwU{`z1&P*BC%fit7E#DYsYpIrEp61kg9 z^e4P=Bc~gZNfORQJsf}IN=k|@MEpvn55n1mZ*0SNP`;fL7$w~6y(USDrs=!tBxel7 zzMNeFt+rfzyS`y*`6~UvoadmwyA?ME5%0jn^P4rXDH(u*JwA(I&GRBC2L^Kl#=_CF2zlr=vsQK4}+MDA% zupH1aQ#&pbXBQ_^BU?CAI}>|jD>x1kCX)YpS(v#v|7XU+^xs21K1NwnJ98Hc5*Fqp z6hTTrPGy}5B}f00)g6zIsTGmHK+Zbf-(=+F~vP2Mb){ zi`n(ocem%!I1nAu48 zaGH=GclR3}ergyhCuA$4b*#imZzG*nkV)l#Y+v)VAB$e*CVM$wheK}jX~%8#sm%%y zE(v`YbfbYF%?jN~T01~*SL*u&r9LlFj`~8ufS)0^H7Fiuv5eDylz7m66oAUOnTFf4 zvC;c=WR;oMeUu2?{afU-Bo^9WY%ILmn(PV1mRdeR%`OXrPBSc9oBE_++^XEOR5s7B zGFU_=n?#tLbD6N=`{ZB+omlSZe;)@@k2TD91`B@_lIl`@IbvO>J+Nir`^38--gn!# z7tNN{HsZNf<3qqC2?-@X7a>QP=xG@UCBue@+`Q@5&gNWNMQ1fd zStlEJ#F$T1UNUz0?%a3%&R`ViECmJoh(Fk@es`ipmI@`GIT7%Ea}n*S?>(l=2ik#J zcPdbC;BFmuxu@aE;GB@xAh)wq`XuadGr}{YQLK(U$uG11@JbB$=l737he*K;==uAU znr8npy;Vs(z4c|e`)PXHx~}ErJyt`UseUP+){`4fau<@UY2L=2(KR~$(N)nitMCy{ zzf8sQNHN`T6>@~g4|f7O9A?=&36A^r1KVr4lkY(1>0;}l3;QK7)x$HzRpM4G`R(V$ zjY$=!m-muAMt?s**G$Q9(l<^!)u90SoWzAPQS^D+f86oU`kD7@RA>A6(EHF=5jp4{ zVT0;~s_{&4`P0oIf1P1QV(xqF3Mui0H$88`(;q zxzuU886P|a&zW>BDmcE^yY}&3;Z0W!ZY!()`Zi#6y@{#wSX{dQ*ZVdN-~FPGgYQNK z6~1Hg(0N_AyB#m|XCU4UQ?9S-<0<2~ zAhJ4|=1)BIzIJubN=>!K7^}5*ynOy6zlFwypfjZbXdf1Q;`Y~ALOlGuvUN^EUm+?& zbS--$JU2#M^`0QTOW!T4YfqNQ(L&HAhRAlyV>UtBOp^la#)pUL>~Rw!7x#{Otbh21 zyq)k^9OsqKanNz%lwL~E)h|xB%zV;M@^8R^Lv>f)3#wIi9Rv{-R2^~D*^CV_ovQHY zaA8-TA#0Q`*Km8uXJ^kk`|sls8w)diySHMXX@VqSPEU?pI(#pN=#m2M-)S z{?m;7{snc-hJgqM1TH9+Zd)|n^!@;mpRe?rdsTKbr7tjW>_;d!toP%4f|eywt?F{^ z-o`$Bk5Kl{L^C=`7FnM?6$k^^$HZ-lSxx=ExkcDTq*OZ9)2p(L6J;rxGEbF3fBHTKlP+J;l=TMKKy%}1z6i8uns$!sxI zD$w<#BdZzCKF>&Vs|39crN+w|0CQ=4S)wpU|H@=ltHqQg6wx)Ts7^Niw@J6 zzin0A{k7UAR)vwIVi*5i-yl%CENxV4*`vSOlOu^vq_W%e_y|z4N9a)ddA(euy;i)i z8vt80*_AI#in$6X;AC{U=PHMo^B5Zwh!IN)EvXQ<+}PS#P#Jtbm&9K^<~l5ga3Ta6 zN$Uqq)G#hzW)s`}1b})j3on__f+evddzJUum*e3{l7$T%8>sq_Cd0jA!iDFQUY_a;CyiklJRIq(9C01nQ z7u~Tdw!C+c4QRT>iqp@{Rv1?ygBTF^xg=c{3C7X z$Eb;RhAeBRUXvbd!Elby?+TL9!fgT;w}L+Tr>=$f1p<*fY z$bz|!iPPk?Yd=RExQKLqyjY=jw}&T@%N5>RIOdw+s?vY|;2ED{c-ezS%^huIOQ@f% z@-ksfZXs>*{{m`UYXYu>k_)%QSS?91ik5QAb$+s!7a}JHv#~F_v&O{zpfiJsl3zUf zWvS=mqumP=AuhWn+mM7g*TV*lJA2AUjFWpeVG0s*sWkDG;?9ryD-*?bWvX$Abaxi{ zIO;|>_-^ll?l7v61Y(pSP?M4`zFc=Cdm{xn2_1dxd2KX?@9gq z{Hi}33HRmex?)G-$nKng!Oh15zssEe;WDbUyYkc#@l4BO>QPH3?_HFWrn4X4|IHRo?i77SVKGFkEWh$(AVvN{LJCB}rNkMdRwO*BJgl(ziOOz^o$ z#g9q2C^qO{dKh<~5%SYWhO$8tJ$}v3WGW(p;Z4_O<_7T~!kjH~e?qu2+eU=4-(WW7 z;F1A+)WRr0EJM&g8OWUH* zpNXS5oT-6?si3C+CD0ai9=6LoVLQeXUfu!I>a61H_U%m5io7wf&S9k9GV7!zL5UJ9=2!QKcVX-$d6hh8E^mirj_$ZZ#ux6=Xy zESK87w~t@k3}nx_Js~d&KWC{1#iM)P?_x;82a3%RfI^3rkyMO?#d`{xdqdPJb=xX# zlBW$1oNo7^+icxmv8E35yJw|6RxR}=nHg7+m3#FozWHC%La&O74smkQFw1`gKMxhT zR|=kHA1XG*nNfcFiWOetTxfqk$&CSqRdQp4O9AITs>1m-8;dF?DpJXXqLktN=fo}!nzN|rT>S^IxoPPhBpV@Pnmjh@?7AXagpMcyVY4y$Ea`J6Kc!SY z-wyZ;@=a45?&wGQQ-zV`eD^G;C0gh_oy3B z)kD>oWO4@wDczp*>6u<0BQq*{ln^XS=ZV>&NW7KW%#Bm{naOJ;UUecj+CQa24ko|wQHKu+g887U;Xj&quWazP2bM zpA)lMX&x)Po9moWtujv<)y%U~e@krK+#cU9K1zokgPl8Ja4~^jcBvdXU!Qk-laGQ7 z(>1k>KqpU!{>T3CkV0A%tWkI$yFQAzcv+5MUCf*p8zT3^iBVM1lhx1$mh6?L1xB*{ z2}5m1vg4$>tHrb8hgXyO9FWmn$t)sY2pPQzv!%EB#5!^H3b@e`mH5RE)o_j*uWPGh z36~_Rl^cGGE(5TpC7j|75)ot|;V&pv!ld2&NMfC0`m0awOL}O9g>`Yi1el5U_#J~5 zSI5U6oC5Xwq!{iwe&E%FW99KP-v$f3qak|6)nx zz#mOL=k>psIo)R(hI3QFXW=Lyex;0Zx)fQP9vaQb8JBB>h+_R{zatOO@-eTi4epD) zLE{St$+Iq9E+Pog{&M|&-f*t@pe0QwE$nH}J2euSvAa7D&MYl^PavA9d^GVxKZQPj zkI<7<8dOa7;F6ztW4aZ|Rz$9jLqASi258;8I!gpQG`71wZYTRcjc#jssk*ZY7n4-? znDl^jCN#q%PZaYUxom6wyBv$$EKV+=bCSvNV=M?8SI1s*Yqwby>uY^+!Da_Y!h`=A+(}kaWP>3y+ViJ zI1*pUSgqu3Antq4M>~`ZnI1pl96PO8lW>UE$0_!Upzj>0?YS;KdmB>OI=G zpaxHC*y42f#I0}_#zv)$Q+8nzzJ1S=GS;mBQe$z1#hn22jjJb{UB z{&nUAx>J)bxRLdzhSDuSL$%Wf?Q1v;adznyJ7KhMj>2 zF7=oliMmM~?Qv4cx13uRfaeGtugK2uUV%SJ1+DVYVV_}pVX(K3QRmx*ttU9s&BJV_w4tK; zslH8oaOgJE5&lREV@AgeJ;tFSB1*d}8=(r>Oka_VT@)&lkG;18xCqfSqVjxWtVT9r znv59I6hl}!u}9*dtz&Q$ayugjd+nl%@U4R-l+v;hB*u4FUYD%@jKYyOp7tD*Er>`F zBB0<8BQT;y7yc!$XA@*)+#J$>(#4kX@H76nNpAI_UEr1p_5*%ti>EOAEz??fkMBrM z4bR9gn}xXdWnotim}(8d>}gyN#Gly>eq))k7XFLo9G6YB#BHF?Z&dhrq+QrX{CzD)V@NtU1P7Y91Wg} zCI(R~&aO~o$lTXG{5ChmddsEp7~s+_&KQOFkYFBk6X*&Cuzw`oq!xkaAIr~i+5>`q zl3&v=dM}I;&-=NF0JwN)rbIz%8mqXQ<6M)g+|UCX1fwovgz%00gVR|lt0VDG0!c-+ z$gOWkd$>B_a|G^nf;u;SZYo~zPE^kySBud?ER|DTxyc1vceRW9kYX)T-l3^UYc98G zlFWZUTB{3?t_~LJj9*-as1UV%C5YV1t>zW>rW_GWk#dXnbj>$TVg zIsZ3#E1}4zuc1YmIs0nFhOyM9MF+Ic!sjc9bX?m6d%W-CKa6!EGRyP}+`MyEj+5zC zZ%cUux|~1Q{;8xYt?m+`19odbK=Hp-b zy)!?5a0Cbci|q3nNHAh`LVFJIgY84Tm3K?Nx`)pU2=&A!U=3J378{=u@k&R0vYo_- z;uVAyP>_uC!t0$x$NEf&_Nj?B?>eo*f`7Q%JS&~;#f&|0@N@;QD2FE8yu2HddW{8M zMPnb$+ejJL4bZPDUk7Z)OErIdt@JjAz7LNz&Yg1!C=Mw zqntlS3rTFmpaHN9cd%?&ghLOL9a zr6M*v?)>{UnsOXZMQs~={p9-Q&#XXGLu@e4Q(au{=|yMS4(zmv~)5ExsRE(Cq*6lXL(SGS4 z)4tJ@lRQ0yXwZXI+0bfHq*g7;`jg)o&x$@x%ZKK_(B7X$ec@ra$A)G( zbXC>~Q8}sxoCbAaOSgex>GRZ9$g0b4=(EJsx(KlB#JaIsgLtK+f{_Sa2igYiFlKB0 zcMMkOj_KHYDE$t9w_n=Ya6bN`7-G1g>YpKx^GdH*M(_1fA#el9?9c-Cw51Hl4@v0e z%GAfgxeti3u&^=nMErQYal+Ow+ZFKDQdw{5_xUn90*Jec7s@xwJ|rvi>OZV0q;puM z#pr3Yio%xgY^xwK-V??gFq?-)7Ame5Eu3vg%c9%UA8`EL6DP9B5uNV&{jrx)d5iQ{-gJ^<1F{q%F4wm zkjV_#C;3!$SMSKyQZVcjF)u-o*$K=)DBmONS>uc69hK{kiyipREFMR3Cnnd`QMUA$ zUQOlZQYm%{mfelt^T6|pViN-#e6aD+tMX;jT`+_uU*Zkw?Txv)W&`mqkNXmXCV7CN1_Iqds6}Zvol=B zB}Yc#dRw3;>^22BDay9+riHhp6S_;3XGYuXwtCkTiNtZI#WEfsdUHm1)LycrvIEpE z>&O`s)~bNbac4w6rJjPtS-uD3UCsp$)>#NytIUnyFYnFsw_H(+P20bTnDu4zq~9f~ zLj_glQ`936*WRBQ%wf-;I})DYz-$=-B^ zPokEWoo0Axy-Kajr2(rq!_`aiX}Q*`U?S0GP)n$o_+h3Qr_<)@w=0UEWd9{&Sf;kP z6MVjH&KR6+!9n90SGK3-F|&GWTGRr_&P$)>)d7Jlk7e0xe#VVkGCWx|3+HX-EPRs) z7zL2uZwbYcFhZklS)LJf9Eo!Rg+m&MyZ0XRM}5o{mZ03Vdj!}fR2%q)TFD*pXS#3a zElbRZ?hqBtj((!9_J(@QL680SAybGM9g4!*A>k@(T~0RMXBu(_*098%IVltqt?u%) zZzcY7$#JU}dXsRxLgboWX`1d8;y&PaOfBH6w0NA2(jSuuZ6n?q?&9>mwY4HkW|tGa zfOqCd5Ilf4W1$J+3Zll*)6DU>d2?!2c%F|sF$2o{u`4YTLX~S({8Sr@@ z1yL4d!`OOFMEVXpp@j6`U{%3^@c@j6maK=Am${>l%fInxaMF-bi$+?7qEUhvw$rUZ zQ&`Nl;M?d-SVq;A@FP}ej!aj;8%aI}5d(C>QAwO1 zCqA_Fz1W%oqajZ^vpjg$-gDFjmC-wDCmt!32vc&rsMx_S0TpH?8j5(3RfhBT-Gu^nzqJ_6=FAJoKeZw;wYyS1M1h?_I$N6Za zvh_YL2oihfEHN=_!PN0@bp58j8=?)%&9tRwX`tY$?*kiEopDwvJ9;_hmjty^Sm9BFw$BBi@IK z*Rz57&1;13mrbj)xmjtVS6|6z^<{O}1dPAREyo$VAXH$Zb-Z;JnUW9<6>nE3oh))gg$EoF~F*()adcQNmS z4|m39=v&yKmoc^q1`EbN0tsgAE6ORxZMu!aN$WQt>HTcd<<$;tkn6^1lO^i~LnW{1 z&~Z<<+reN8@H-c?FST&2NLe{;PJUmB`>S`^DR0t%x~TFQVnj?o4;#l+>bOByW^k?` z2ILEvp%y#^VfUp>Y$T0{D(BbBE&N`A*L0rf#rmA3NIxYrZ*|-+J4cPwx*$t~HXD94 z1?qt?+_<8pgSIcGjz3MSW7J6C{qZsxS~o^|9acR>*PDg1EYJGcP+N#1GO%`mM<1mg z8#2ZO!7A}?h~Ecr8S157Xcd^p~RSf14v6-x;-=O2IZFP{Mi0_ft&L*hFhGTX*`>&6&PVjluW5p8Td z#>>np$T99Co0Ea4*S+)g%B;i1tn+(sFGdnE=H?w;TBQQ$BwYVQiFFUP*SF;H$q~{k zqbv6(B)T~z!RgB5T@t%EUP_MVH|!j|NMFPhsP)2Wo}u7bH;uG|-!&~o@o%WbZH<7K z?@F!v*H8)*v zlX*1jUl%D$!oi~(k_KL$8xZ1?c0oX-Gj(U80LtNj{Y`Tb?y}O!yrG_fcK>YeiDHe) zwQF15VIFdh!eaw2Le&X*M))xKHC^#vb`geJ*W@!cwE>wH&BFn8WPewh8*Bub<{dFsRrV)Ih4O-Zsllm?sk?WgY1^0#tRt`x-h>u0XSPzscbU`=Mhrmj;xe;U zL4<<_-fNHO9;h5yjyRa>;dR)|8EQeN@JhhBEc8bDT=7a()AyRyj~j>n<|xMgk(vE! zdkM{T#ob&w;gU5HV`LV*y+DuQYc^PQ@bBHEQT7$yw#h|8A>Wp z(2fGlzag+oL*hA=1>!j2pAEP~>L(ip(``Blj#r>pAl-rei4da&FF=SuWe($l7;Et3 zOOF#kdek~4hgu^p7CKT9BteaV%xXA@2L6DL^`=)6Du;z|BVpUZdS}Uh61+(`6HImmw1_@dSNjm?5_r)Q zyA`}X#%Z*AVU`M2(bFn{GhCi!oiE>?Q@qWRLvZEyeB3>q-Mv=68ms=SQE<3;cRaqi zOUts?XY}i6)1|ZP?f|-UCxCamuQM}0Ua+cdPX4{u)b-rFeC4GQ3;wa31I4l^(5MCK z@pWe5f zqXKWp9B0HA<7`!(MFsz1Xi0-U;q!TzRa0`!)cD~b!c39XF98LyJV+H$zZp%cITjI- z;BX`H_zy-$d<6gfFtt51tJIzPcS1op242a1M*l`e__&1P@+%BP2NVT2zNQ{ndb=W! z98b0q9uhhJF%5wx)y{7X+6Ix3W5V%)6+a^*w1LCl{W15{;`nAWr`X0Zx*2I~@0~XW z3I+!w-@mOaUk=!5PB_bV+=1lOqfoAe9)aMuRiI)x>cc|%b`x>3`nC!9S=5|tc;-cR zSyAh$^`5l*N*S$}VRK0+<|wCAW=gIbhv#x3>YBNTIl5;DVVB@9M`YU`{-q1H}V1_Nbrm3(Tsm^I0Rg~`(>8u&VBs2D3O zDC65l%n7_qdCu(w1#fT*%+4t42+@Bua|KTGq{Ud0NJ^GQS==vt}e6%xPv;mWu8RS=ILqR)%h}_=BBx_|ngzMNUE0 zDFsLHR8~k_xHTs)Z6O~pAlg>z=A`&S1*&iicmODP)hPX3TO2kL5dpRZ*a;l9*G4oD zxYldn*=m}H=)ID1U4Bk5wyi+zXd$ufUM~FS73EmJlGu9XmONwA-FQ+Aopnm-h)I_K zNG{tCOZ4KJdSgYjnv#h0xX_5T2JGaxpUgNLlEWC3>~D^s2kp7}ObvtxYYG^Hx41dI zsz5_-U_6s9vg%>gnfhst)0s|nu4GnQ6Icxri9(Mk!?Ndn8u ztoe;%+L%dNs3nU?cc#p`F{VQyL!`3w4462B?%1!y9Sy1&OG8@ksO*%Y-q?@I0Z;m z@M&QhZ;X)UAN8f%H>Y|szF+)CIw;(VVlxmGh1R^1mRz_yhn!QIo9v67!-(X|H(wB` z-k3EWcrb#I-Vn4?Jv91JQ9lM*P3(Ag{AzobNnsc#c7!UTRyu2h+DBw=Yh|9{k>2Mb zg{P0-wfu59ip_r;%5^r3L88x{s}G27C~aTd^h_gWKt;0jbyL&fj zWqc?KK7~vf5yHlko?Xx*AG@-ZFqPpdM6DSxmrnNy9kJ4~`XTgy;rhxQND6$)OgW8Z z^;V z$Pd|rMDfJS0=jD}b$WPVtV`F-_{{~aSJlGYgnz45t2-!OE+{?l%3Sf=_suZ!Vwo+q z;tWJYP^N&Jz{P#VU(dS=F%EEfAv0&K40e?OA6{(vJ2{T<&^K}&c3cp$Kh;lsNfVXz zx~!2_J9F1Dex4Qur8vt?{SK|MVlJwJMEouCDa$ld@1L-bwQ^LqEgC0!E^4Z6fH`Lir)phv>Es0)Bp_GS|NEFq_Us(jam<4uK<71S9HA_plAm=%*f_u*so z{n*vxm2Q2-o$w!c!TmSUccGGR8btP}qQ2a1dtYKM>O&mAbXLAC+XMU{o$RQnrme^t z_CLBngK&cKW;ne1w_mB&|FRGgJI3U$AFg_#?oW9Q7LZ|cHpdLZ#&3qiems?y1oY*7 zgQ>LfTmJ8rp8LPIcNT6omZWpoDgz%Ykul(7yaNFs~D=kaon-Hmr5 zWpeS0{Rhz8Aw9ae_^hG&E&cCXo%e1yt5U%r^<`l4XpF9;*rYg_4>fV)0;p-AE67gD z+E;tnHt349*Y}y+WBfjkvj4i*`baYe0K$l6_`9tVfbW{-G368e9*$GCt0jxq=@+5roNk0n^bpl*q3+!HAQxF6b8txIqE8ni5R!a% zQ9O66R$BZ7&6=6A*drfA*UQ;0@mV%#!Nl39o?2+ei<2F8NKv&nfXW`={xV8q+5j>Y zR0T>rqSaL}U2O@$^r*@KzcY_Q8LNEp_0!2`q8hYXCUx=b(ummpth(Lev=9foyUlet z*G6<+tS)fXR-dm)uDQ#)!|U%hq}9>t-<`%CxsJ;yMuVy83$akDBiLh0t2}){24qqq zd5*ZB?`K)$QX5*o0dZ610|7DO?I&bpn|I*$!yh#;f|=bI!=4E&FDYua*AR7Ied?VN zY|=Kp(-WPV3SGN+p@NIjDxFJ&yul=C;&r}J!=T&eYwzf_bvybe{Snn2H^eYKeD#N% z3|?N3DXG{MTF1It{BIh?*tAjb_EldNESybGPO0(0)cyHk;QnuuR`Q;V_VVwp%|y3a zJY{5lrO683%P_qBKi2C33rFTio<8M zm*@>Qz`)495LFK z^k=yj70slg*34g-1lQ+_pBcMjl^XNR910Yj;k`XrtlzXZgTKkwg)Xcr2U z1Y;BUT7%HH&9g{s+ISCLp-1WRiK2?(bZrA`;A+MfF{*;7V(92AyqL zs*yNUpR1xiD|GPLcNK&pa=6Q5?|Q(Z zRHGDJ#O4+tag!)V{ARdUqm%z6;}Qi+l`cCPU!mbx96_E?hqqhx)Mj<~BY^3dX&sFi z3NS$NXimFZgUddBm68R_c-f9seSAgH*({W+BfP860y zXLZ(c9gpHckqdMnL#Ss8yu3#QWAxHNA8%C8&4|_4eCX;b~^KRal9{j_xfkK?>_TW46&ERDlCCBf?C1s33t zX0)>6K#yL%j(9SW6?3M+yu{%zepOk2QI$*hhxQD=NSMNr`@4maVt$Xhr{bG?MCX$Vg17gHTaL z%r=zzyWI7J8mVc7=NxoT<86+o>9QqEdqtJEnLj7vXPV;g)36eW`TE)DPrxATM$w;_ z(3sb9y+zv~{!luPBMUWrkppEcfFcx4Lr2XuO)Rq9s}_57HKIVpWXMxDI|7VNUIiP? zlV{1SNmLNYq--2BXED~;MUdR50J zkbjVQa6!%k&!{q zzq5ALK92ajkUT@9tg0Y8yQvLFo<3Q(Q#BNGSJu;IwqZ;E-rtN$$U?*TDydG?v20l@ zg-j4c;mlY-^_pkN$Xq{#>Y?LH;O%{!Xb=+VwT7^dki=fc&h{580)Rx-(KP(IdEJju zr(pB?6MX00_a@L3UT_kT5?w&*5B!!X9qNpf=Jl1R%Mv9Eavp?^h%Rj0%nXmu(>mY< z_c)J3^^1$eZH+Gj(VPn;RD2OQGsjlZ0`|^v8iO)5d zfPEm`(6%!1ZeejQB`6= zZuk1}pw-i2)JWQW^PSCfrqqZoL4#C_R)5~~$+C!;`3-LgWC26K+f zlhwcv^;Y$+%sL+k5^w?B9XYKDuW%h!oehFa;yNj4wpCkUE$aGTM7X(VzG~Kk!<5;e ziTFjyGuu4DZA4}zD6c0XCj;{vEvn`cP&5g%7orjzRJNSLxh51dji>o>6W078(e%<; ziP!5S)euMWia@5?jr14Z%>Xsd8xpp)ZD63)#4smzP_%1dHn1oCeo#Dy}q7m5I#s zgI8HP92F<)nso~mdd+|wf#IKZWQ`z)xW6}O_0v)2lYktzW*!&9rGYM<9=^q6+c5yd_(b^jStXG^_}!j zE~c*{XDC*BCg!PU2&d@@T8}UyH}pnQ?i4Zl1&~V*6H&`JLn|jA{!`_G^e8<(vm7N` zT0mkD1bPgQ?8Dk-P#L0c`9fG<(PZ*7|#lYD|VzFT&K`iWv_?3$+0%ZieMYF_0RV z6TIF;p~*1{dMWiIZ)rPU|VOBj&@otDP{NN%)NB@ujbJJ?=vWVC?LaD$d)qa%-bBLQ=jN z%z2y@%~i1-+)QK9_|!TeUUgEDVAo+v47+}y4aj|VsR!>*6Dh;4o|t-n(Y zkA8Ef#e!l1AobIuFa`S?2_u|Qi~0aPk?<7UD^s7ukQgT;WIEDmx6Iu^iMr)s19ea-aVA8SmR@&>$$e^Q4cBFd zPv>uBjE>Qecqr09SY#?x&M{FSBdo62XG|C4l&%6gf{FsKWkRqPeTG6xSb!~b~@@pv5=JGwm z%W|Y^fWWjIt$*?O*6mG;^^^bc`|70E7<+duD7vF*B{TAm4SeqyziqB_R$()#Tz88; zBRs8-&S`_^802AQ5@sr>1qgyyMK^GaDZ6eL{11I``JgZ~m$o75PIcF6i@GBm_p}^j z#e(!h@|c}ZdZ~M_zT3OS#vWys!oRTzyjJNe0Oi0BA2*pw&;V_-Ua;u$-+G6|1+4wm zK_zA|Z}o(pz0t&re5BkmBaXCeio$)RZN^Z+j3t1HI!6o6ztL!UU?+YqD~y;+73-}P zXg-JLg`o3Umgxw776L20ZZBvO5(*&-G}$25{y6s1unqccyp;?SC?nCU;kY2jX{}~= z08AkAlzqN>`^arEM-*4N?1{+wK{193*&ZIlmWWB^aj7j8RTEf!Ura|9Pqwm;Kk8nY z55Q=)2g@;DKwt>?jl!nbA$5|gOefo3NV%3Q6@ zAxl^;jGg!vuq`bhl+35e;5#Bs(2ZrT{y4Qkm;zI#MglRripvZt}C}RPgS! zpNL;c9H!XFW>7&STttuwa!Rgr)Rp~(8e~EiOPy%j+^4kyB-Rx4J3FoULz1q$U|1PH zDpeIMxUC@wgi|k&Ee{VbYg7LN@$-Wj5AiSC|E1tL*#Aqxv-5JZ0Bb}=>zRFhK>_P6 zS1s`=Jq~}myHvB+dnDE#C~gLJM7@3wB&_tX+#c9LV?BK=t?mCU<08~Z z)cgU9kP*o;z3&=#m5xt77r1Y>-dLifHxt}Lth!*376m>|>K%i`u0Tpzq9jj5<-;F7 zU%+%Q<>cy)fRu2vC!l|3vZe*z%K*SBVBR%fEzAjj4wIuWO;I<6UU5%Tsqe*AQ8Uzg zb_}gXvaWP5R#Zu`-}R_N`~EAO8SxzcH~u-=%`bsGj`D*~o=Q($6E~}zeCp^PF6{TY z;@8FJDPAMLwr9rvu>k@Nvc;N`CF z+QN*6-9}Z|^@q;4PZmuX)!S3sj7LFtc?JwCb%c=d+GPvi1TS1Bbqmy;6^S$qob?Dp1F>})7P%EW$tJauItGVsl*t37FQpa6r?mrUY!j9%lx=j(9{n{B&)ry9 zwZ68HRa0f?B^7WyE{Aeyg#>^<0E~CrR;)3+sXM}I(CJFnh~Xwo<6%oFw_jUyB&@bS zHQ4PlDDqCC_#}~?cpSH3YotrM+D@sIioyNNe!q>dxJ9_u3FIixdhty3Pgv9EjD4qN z%QofbsUFk=uQFG#C4g99C)#6_7Klc&q$Dh!;p?lE>!us=0PAnEZMMo#n6-twWxX=_j#K&43kCtP9Of|5joJ%lMP_DlNwV8~&gi8|Ef^M7Th&fiGf> zbfkowL*iKIBl_KCbY*VP?pp|$ytU^6je0k@I~MPpB-j}!p{XGtSkm?66cui9qv?ED z@wn+_tAW?4-Z#)|ujV}R-ImZ|n&0O~ht*mCU5b-8sa(FveNn91VhjE^a^~ zkT-acInJkF(zyPBs$!=y@o$;AXSm&p+o+v0*KHUyV9F+kcL-1G(aF~2tOm7YcwQuI zzLi&WTlbUozVh4WVJ#IinZcg0O=uL@Z4hAfdaR-X%2}_X@ge?$UgRNXPHRAzM=0Dy z>CKp2uY5a#tNDtGJ(y8F<{u^0i}Soa$Sl7fNKD|;U{<^U9$~(}IzfccOmn6xf72c; z!t4Smj;NxqSk=C!2;#1xdT}!c95K~|;Hto$Y~)xjw`;+5)1dI|<5pdE;!z;jnCe~g z9wHG$M4)^SxphEuaLbV4IF4F27v1H=t$ZkaxOopC;g0vam?$1$&qS&p z1E$nynstN$O8y0M(!b@1JmX7iSQ;;}_#_GJMFtQ9OoRMGiZ&Zx4}Vo{8+7w_8%T3+ z>a3AtjKnPR-KG{?8fH-sK&zT0NRi-ZFKgciFx|bgc{_Kl&X#0uZ$y{I%f>PWx1Yh; z&AWrVVO^%P>#&k9*8}^SIDmihGY-5Ky1|&AFRZ43PToe#cnPAD z5p2*Lz=cs4h#Ed6UqHn$!}}a5N5k3hspgEQHBRA0^dzt(ry~Lh&Z8n0W3ULUV=>@Y zusrL5uE79temp%!;-+uR*5$xALd2|5x?^FZ1BcgLpUbn>V?liH%pJIo$Wu<3#<4&S z*W3*GMXFec635{px4s%m7Sm&V-uPkCc8EL=pcBTDmYFg|sMxrPlHLfezGS(2}oR@`srG&2AH>Id^!ta@wrggeV9 z>?COF)d()fM?+)vVJ}xy!GSiLfGtK~f6YANWT=qt^^hrC=w?mpfD;uk*OCDm#k%sQFSGu$pG zHTRFNi4gqw!zLdi79s_ipjH(i`N%^}iGt~ru~j&|zZW7okkZiFv1?N?Ejg3|fDt50 zbmes)Jwwm)R578$bcCH;?_u@$#V=jf;g&#!C-Pg@D;r>-`~XNT2x{cQ*0}P45H5Nl z<-uQ`iP_XM3jb7w7s+m(RvZ#H!dH*Safd(B*GPvjN8%07=Yx$(7Uuw^>9oIjwVPpl zpj9!B>R;~fJV1V)j7zU+ksdDtYz^tWCO>cEZ3h>opcvl%oXtTnOzb~@Wj7S)m~PVh z;8?lBh?}re?n-4|P^X27e9A0dY?!&7rGH%<NjU~ zr$~T+64ICl6zo!c@<#h9rkz11x$MabRQgSN3_GtlMsK}s)d473Ad`#%_zGa5zM+C1 zH))EMP23Mz^|`pZ3SneBPFfZq#O_*Vb1c5PR_j@^CvuFibbYONWLT{wO=cMv^fB87w+FE)BB33WF&@owWvd?W{-J}GchkQr~# z({{zxdj19>)dZjvNcrRdYU!%bgbZSI&~r_D9>G?mI)*E9>CS`yx?o9mFa)42JNC5g zM7D~QU6D$*?Jbu7_MAbBehe$1Gfefd5S}iKf>&R|SYrBxBgBYl=~2ZPd12PKd~=VN z;-TpBqw+JVL|?c^g|^hC6oSE(Fx2ir?E7&$8qLEXMCDKyk%9@IBrpsYLfowkADsrR z`XG;JVUkQ9CxH2A%OYJ-W_9HOa`9)tZJI+Q9v^bvCxoc)su}QQk8qj2ghS9M<`WU{ ziOe#K;{YU5#RGbVBLF2-c>#qwo3ZO$SW*thwBckThkbdHYTe)%E3$hH^HfzDTY z^)OcHO^YMH=tlQ>qB_^wC5;NNTfz!Ty1%}wOcwqM43PrD+pkj|Cr0r>u+9g{AJ=b= zyE&VK%-9mXk!OG<=m#G!)>P=bpu;CIW-6K-ns6K>@&*BYPXzwpT)^RJ-`nY8pW#+l z?o-tAe0l4~=ELw$`VQjU!PbfalZHR9fqX#zb#T(=X?V54EFaJHll+S!o9bNB{aYyYJiK zqF>0wi+P0l57=I&fcyn;=~vwweeX!Fj=jQ?nRajLJa@Pq9=Cr%JA zigfx5k46}yU&iJJQx$elxELH%Zv(KU;!Lx`5VJ+`kInI8;1Lhu?o&hZ{9x4U%5|G8`G2*C4lP$L;GDcz5~Q~xj-=tu%l&#)LpOT^HDXLA;TTCz=8~I7coll)SL%e zba^j-$bcy3IVv%wK0}6cn73jP(li*w;-=_pO8l7^Rn{r8mu$AtF96SC7R$REz>ONg z0-HZmNlZajsnSFUMim%6Qz9sH58@A9`7E#rs~!^11t3U`{_}fr-E&Bu%7{}ZK>L^N zWI2y~_gK_LympW}tcH+FU)<#vaE^l50X1He8;wxiHJ1D9&bQZXkAH@20RT6Lm=SGf zhRKgs=l4P@wJrvO`SWPMMD*7@L>GntsK}#rA0msjS7BiU67~xZ3?lTBt4cWPW6eIq z*N9ua86Y)dwl=u4904|F!{iVJ8c+O&TA-jREWaxbAzzH3F6#rt2s|D-_deQpHIl-| z3R);lqCpyjXL`quIaI~Ja(D3U_Wd3@<4*GryAeQUK$haRkcnrbIm?sE_bE+6MvC(QKdp+ zsK#t1Ae{dtw1FCSzcCu@U{OHRN3C|+=G2M1YWX9W2GX7tcqZlVm(6fzgMn5CC4mB8 z;#e1cC`C(Q{b@~E6ar2LshaEeGyn9}^i$giKb2@me|r-r&h9SnPwzGyEiS8=k$XI2 zUBGy@y-}x5M`x!lgMD|Z5o3`=7 zk58y3i_?EI^ac=X(O;>`3=8t{l4Z_NtpQ)M2JAxH+I>+MggOJ$Tht0~frqG7DY!FU zXHizCoOGfFUxgfLpF)&AAkr+7$W(}hI8AYe1N28-gMy3@L1m^Q%;t5%?YF_iYc%K>$;C zNBwW*0%dB%wG6o{Lkg8@m_1m|@|C3GoAkmQRe#^oADPHKT_?*DC06uEP__e_umbvn zAth7c$!id02rOaam+eQ9Lz&M%613fBH6a%WPDm1M`lzcMGDQ*!=Xx14N}HhAo&+cP zRCE_4_%xh^%o;A(91fl}E(lRrKmfiJ*%HyZ?fak%+AG~0f(4?qnk?2LZ_x-lR&V2W zq_&$5=7$Bi{!;Iy3mAL;l&64@_o7l=`4VP0;s>u~3#wY+7 z?tw~bJl%Ui-m8YA`M4BeNOIE4If?vBbw3oE`RoV@f(9(LzmTJ$Pqj3jwSX-TS1L#j z^!~-;MfABXG`4z!K(FsCH>KOL+|w)bP}@4$#g!yHzD&8Qm!OR|;LpWkUFNU@L3syJwlw?ZJ;eE859n-1&r{!3`Csh|CJV6Q)XlB+eP=nRV%of$ z^YO?yl~cp%1RJMvPFz8f@&Suk+MQ+IefInhEb#61C?_!@%VTcU7u=~d^WJz*hj2J& z#zgiQij;g!koG4j9bI7&u$w<7p?^}!Fh0QYSWvVIu&Y>hC4Zkq!c`p)F?2!8?Nzy4 zP`;8jTTM6XlCQ6eT$VBK6o3;XkwaJ0F_SH(u$4teJ!dVuz>Vz8@d0Q=^u8Q$DCDY< z7k_z77KZo9c(7OroAB@3@I{bflE=$Nmiu?wz!Yr~{DhDrXFGJC%A!Nk3=|nM{~en| zyauYnW=wBn4v8_T;;)j!N||%E&?G0WI6UXBH`2>157;DxmlTv+^18&~Q9###5(p+XD!KgH%wjT2E9$z1JigGs$g1Sm;`3J8`bfaWLBU*_^JjOuN!t zBh=5eSuedm&9P&C2ZcRsQHW;C+MFl?H-Lb(O*P&Cw5A#t-@k^-r5>~{O?F(tDb7FT zJY@E|a&+voK7CZWH12~-;C-!qJ6|P%Q@8`L#|hh|y9xeuy9dae`L3lW&mYU(drj1L z{e7$DuDYJtUNzXz6icQ9Yt0-tEC=e63|2Dl$6GYh+OV5DNfj^j+i;kvDo>34aW~E|l|$ zjBtqlWDLS(KpN?03jble-bU_$6j?GB@-N z_hDBPAS@EM_l5`8vAOFHAFjtgMFV>8I|r|%pYx^j9WZQQ7sBD@DUE5M2j6k9hraul z<8xpZ4gp+xh}T5P86~okoRTnEBsHvzG`+ldQ+t3Ps<3isW2rg4TYUTq3-9Jll?#iF z$O-nNUs9%Eb$cX8u}SNf(YT`_Jw%*IHDMZ~OM@5wI4#arXtF$kB^{2%&|MDM<`A(g z-As#0YLwfb@~(OM;S-QE=2I_COlh1It{w0R6Tr-&hot+&KU#)~W5q~VQ_(*yhpM_+=mbw<;qpd zPs0nmBhK2J%-@i?f_u9bzqE|2p$1oN^*>sM=AJxSp#~D(scSX%JUujcyqDydUlm|P z?g}!TmB<^lej0UNzHIfSwJ+Kw1yvB~>N;J*o?Y|&zqPZIUHZKmi!x?DiAWC%K+lFW z4U1XV$D9~INZmEHSaTs8*llz|Db(rbDPo!>vMIbiaGM|w53f=*NKhhS_T$G; z0q`FihZ>}_{5-B(j8x~U6F>52sx^#k~ zsJ&T5Q6*LT95Zqb?f3rNP4*dVbrfBdbI%{P%gWSF3$(hXDhA@zhv)uFQFO~>|NXNR zv8^<_x6oipt&N_&w_@hqc%PQ+Lw;6#hd2nTTZ9h9A5XywpSFCLME&L9GvC5b-NX8g za(eeL0Nd(&qQDSx>8iOga4QK5a6bO2PptlXU}>+_hqaw@z()=?RxFMzS*3Ajzs+g= zBev~}Z~cdu=t3krf4z}$c+K8(A{IO(x(G}(%TqX?@4`%dz%=hTjIo;SbP9)9(~9h$ zxhRi&lFFK+80tbk3gyun#}YQ`Zq?Cel=2fLkz#6<+-mSnaw9+MY{3WkUhh-D3Z@Tl zkKZFlC{9)%v0E657^WVtTH!N4egPAGI2IfPFE^%LFKZ+|kj;E{)Os{>l? zC1Z#*4ADT+m2G>@e0;~gkO>MbwzHO* zJ1nPNXLCLi>z6boqJe-9il(9l;^%V%c4wZ1;Z#hIsmS8zc?dPp{uNYnt`E1@O_D^0 z0a1c)K#GZqLGq3{nE5U`W~9zbx~e0ASC1T1eXc-kM4M*QU=?Ag;B_0al$6K4V9##L z;LZVMp>=lgx+1*9^OO2;5LgI8h5NcnsZw&*r?>d*+*0{e-zdOhQEqYfNljt7BWx@I zp1XJe6V&wV#x#JG4>Bdf3zesYpipTA z#At>CvyS=jdw9&HfWUi8w&>$C>K+S~^$w0_Sr`j&rMRNB#d$5L%Um*cJt7pbMELvb|_x1H4x2hO= z1ROzXH?_lg-!Cjc!^f1$2qcR3@Z}2Dff=vw;`aOo#sPEG&$+@Ry#>!|L@1}=603Pt z8EuI#DGw5mD6DQUgw85q{X@`D5ae{H(LQSkZ|WYQ6c|`OwGI!6#oh$^(O^uWGTBCd zJ>AN!Vs-!p`z(1qlm@;oAKreQ62fJ{AdAmoMq7pkLI6&qXt+T{feeV6F}{vJhezql zQQP)R*iq@pUnu9R1M_jU{ZTV{50o$cosXoo$J9N##+dG6g>p(ivgA)zk_4z*-3)Xj zXuQN#X|ISfHC4I!K5;|K6269a@$%mXg@4MeO-=z-vlKn1P_`!Z9*sop=G%Wcn_*bm zl7qR*MDy~~=$}--Ja1@w{6e6ODw7_doY}(nKs#Rz!6w6bFP&5j5Z+N6ZCIJ%bVgJb zPDqc*?{hh&g4Y%%wY+%o^Ow(6h|tWx*GqO6=YQgwV7bD~V1guoa;84K&bJ0NC`2Uk zaySEs?i5IR=Pz}jN95x>1?G2`{e2);k$nr}lL6i8zUCQ1nH(CGn$FF6E9YJFM<4-M zFjc|ZWf_6r9t6(#iw)eYW{SnWD*rTa+XK6xobY?yh8aD4J1|YCmHxvgaTm$ssW6QT zJ@HdJ#Av2=ZQ7z9ccNSIV;J3$jOw?8{|FU*tlTk zu21gc*EIy&FL4a9p^-p{MEtd*yd$?ZLMs@!FVx}b3w2QB$HHX$2X&Y*K3Osm-V!j0 z!}mG%F~8ZBoZ$7N%$>FWxB9O(XNs|g9W*Qk{}1USv%>EQVf=^#?Im(`K= zV$=Y1C|XlE1Kf0I{64yz&vhbcfU?m>7HrZBRUz?hc975&ojnD?6CGKvFY_L-=Z0D& z>AcpYqDrVrDzC4brkhQ)5I`a?#3aLsx9fM;Wv%(LU70?51fQ@usieDwdZKH%gEbku zJR&|c(1C&|cW0Y2KL-znFD6GY3e^lTk z2Gd)UnOH{C{R}l_rXkie?GjeGrsH(pV20CH;>0;cg1V$e0v<#wIm--U1PAZY88d_T zI;ZS|gd(S{IP+`9VTRF(lI$0O;g+tb@sh|x*&ddc*~k3BLs}6r>-`6H05412$&POz zDtbi#fVv9VAvKZ_yIHfUz>p$daD&u|75op{A!hH3cHp8N%JJQ|AIqEJ*HjibsEjX4 zaU6yFL1uVH(&cse*VYaQZd6@!5^k5&l)7nXCj8hyEY4LAyp4#f&Ivf zXr7X!`gf=<+pVo;cV<-)M;;(2KgH!A;33f!Jx3)z;UD0^TOIa4z(dZlb2f-)+q5pB z;qo)i6BwWXT;d<#0UCD1zl{!)Rk)|6NFuZUJfj+p)&4uHiVGlcRu_#_*!MOP(s}km zGOao{7o5QZlfvfp5p0xZ^eBh=8<-@~FLoQ!0(?_V;?Nw527r2?o7=Z=?+Rzp^Wlm2 z{Xc0P76ccx0TSPhDwXpmO_ATD*A}MOZdrnM=h!>A+9Y5vroMOwDW0n@-eJpGphK!9 zziV|Da82y}_xRJ|ec0pr+VB%J9Dy=cOqLm3BF%U1VF#%?K_6%40A*S8v8%gB{w93a zKTt$#{gc_#03h<79LJGhL^Fi0OD-n<+2ippwk2C)s1k+Xnwy6qy9w#=*zB&c6igoN zNa%XdTk5AB+1WC%u$ckWF@hg0dGtEPH_T?3;}0=47ki$KEHcSv}sLFPE8TY3}(SR z!_|p><{I}vsk2T&nfbst`!Y;dNcg}rv(_UPIkBYW2n)JE!ms%eSGZe?0JyNVXq>r{ z*=d=>(jK>1h2GC0&I-ed<%j>-P|jd~^o1^WiH#>GFK;s=YJiSsb%<9UeTv0nB+lNXSr*~|E@Qx{mP%^7c5lxrnSQ_t$M&tP9W7ej$1*@@Lv1} zIS}e8l<^`;UITCw(@&A&(N{~ob(0})F};SET>lDgTul6*Ov>zDF_aq$4xa`1s|l~@qm zaIDR^qXIb>OS@tDTd}0FGJG-pt{3^=QrOn4n~I)Wu|V>r?A6L4k}-@WA$Z^8akl>tjK=fZMf%z_JPi zAWWSEr~xpm6blGeMFGae`A;4oZZRqlv5p-WUWEs|Yruq3R+Q6_lLI0))&ad5k?Us~ zeZauDxc#JK9K*6}U|83&_rwMq}M)1|Mw0>$JUHdo`C-*;32Y6kG1zbI( ztLN_sh5ql}4)+fNV+X8(p92g)=0P1G;7|yL^FMEykPr~n1mm9*0Nh{ivXIb!8P

AB6^1CysKlsuOC)aO}a$Q zw+h;;-PzsIFzLwIq`nqDCR^R427U{JsQ?V1dt`A29igyNXW>UNy zc7@df^G)~jg3Nv)g-SzHQctCS^T_()Xyv?68~pbj002xs{pA)GMPXVu?Pwl;y9mE` zi`-7Fp?C6_%R1qhY!25q`@Pun!%D z)qPp~^LV80Fo0gGsCrILOMctDQinf|1PdiB9B}|Y82(o1mdYt*MTUVwKcX3i+Z1(I ziGfNW9MBA_Yzn(8$w1i=aXG*rj9eS^P3i?rX~4NJZbi0uABVsn7b6uCCpGkHb2 zg7gXf2dw3u;2wxm{5Rzr7@=OOi}2L}0x^-90s4XOrs$}O3Y1*v^Wn?kl>@G(P`k=2 z=y-cDyCM)M)#w2b$tkim;r%>CFZ0HGsPyi?`T+$!vd^phtJ)Vb?cdw0dAl;y4}9uU zy_0{bch3pAf_@y+D^&|*GI%B3+w7K`sb>@+C}#36vOEqo2+pS&{XFDc{9&Zvk$!s= z&GxSIREzY4#22=^EN)1A#OKI7CBVXNcXVC9mA%Mw&g;NFovl6ca}4_~^VNv2YxiW& zvk#zp`t4+e@8{XYetl*Ax@C6yJ`1(!6tm0nL`?eo#|A*Gzo8bzIAp7H!iWCH#QfL% z4h>vC5t*P%RI*$i`hMNV38PM1b|`aT7uFbaV@vIdN}4tqfq%7QPU?k$E`eni~PuUmK zF)NnSNRUnAUoUV8v2$%B>^{yX5$G|BeZx*fdVP|qWOso@3b4QYB@(a*BY9+c_}u}A zJNE;?oJiz~qd+Z#pjb;$Y{`Yn47gF@1eCfNJR;o?0j+6m%b%9}KzYVQ`KlHW4eHD>gaq@s*Iu3SiPHgtgsRxIu6n0V*mCWh;!UK`%6E{Q2v^$fO>Pa} zlmpmvj5g3$aSVvHJF0DK3hHW#e!0K2HjQmK&7rPU;)&@&mLvstozP#!8H+5E<`Q;w zW@r$*_MmzeWbkBRq+%sDV$XD`sYjtat%$M~mXA#`FF&4pA_Bu(^r9sbZr1YHb$1Pr>UJPTM1=^Ym#1L9EbXV#S2gz&}WiivyIa;pXU?_%9<2kzb~ICcPWRKWqUD%OGpBj@Qlc zq43PeMHwfk4H9W)jPJJLxmGxpRwhLTjQ|cXVD_{#&8YaSen}Nc^V#>1wR8@BN#1ZW zzA{W|%YNkbM)3n?!nj zjfQ^OmJI77E`u{1Pfvh5ytm}eP7Kwn{pRlV+AKxNkjTuSz_}?au{gE;L&pt|#P|7< z`0p7h+q_4&HguSFy9)`2!X6xAV

Y&OX;K*95RGF=YWt1bQiasnh&A-LY&G-)qM$ z`jpV-cAA&YlkE*o|G@o$>5BE*b9Z`{4qps70>jgc8YvzNtVjkVZZZMwH0NiMT1V}e z7Cm(Lu1F4BRe}IyKq!Bb+`2wy}`s+CTg_!yw8dxvz*z*H4?+J?HYIb??4xh1+?*qclU<|TS$kxLQ_%C%PIy<*PZ|>o9l?;YVIw>3R5@om6;dy zb4}P5o$vI;yJRbA&{8M|&(K7cQ^xUi)hl*~O@SUSFn>i$AMHnT)tWgJ!qh4p2mPx! z3!&i>0_HqRHKv>uT9N-|lT-G&GHtO@Zd3fW@6j{lsWlJE6_xJi{X72KLv8ID$|^}3IL!%8-9UHx_V3O%Q3N%%}{Z`ln~)+qHp-LB4FDYeQWy2iDQq zZ3IC_lt^vSnv|WUuR)XB6A)kgd5W@$=nREy&%zeaS^%|h|1&XXC!#v;l_Dx83iY5_|X3Kp3iD zb_X5+Qr!I9FwYV{XGBlel_9SjG#M#sAqRg>RAdjjKk5rV_dRzg=L;pnCL|*NO|Qu% zokl|Yl%4jW{zf^ z4V_DGr1G`S^wJj(s#kslewar6Gk{TQ66*|b2(vGCN`!%hgkLMe6;)!QnJd;DBb9Z6 zrqvH%XG1-W(6L?R9$3-SA&%=YAWz{tZn2ruu4b6YD%wT1YD{U%Qm+6J;`pUXqQ#gr zw*M>t`>ekZ>Z-dMOm<##!Gd+gD4#Iip=$b+r|`)IQ+YM^!=uxZdTW}?Qf%IR;U8GQ zn=*|sr%n0GF~b2=XM@K5Oq0t;{;xetsE%$Iva|bc`faRKAA?vsfEs=M=$PpqYl{pG zsh;x$90?d)44Gan4(2_U7_f|^7$fB+CvRlMK4)@7Pt46aIx>KJ7h|D+z8pbL9P3jR zZ{h7iKL+#w+$^FMy$gx>4)6L1KOF(UWh&pE^0x=yweMAYO-?;7{EvnvN5GO3oyc!A zW=+fmI>^YUhdNJ@VM^*j!t)rSz=6hh$Iy7vTULc4<$F8({ln1fJw*8uF7sTp@BoP< znmD}>G|zM6U!EW!Dt*wJl0)-S9h)Msi>U?-_1;IaimdoB`qymWGlx*B4wWIvZOdVKZ#c6km!Yo3KUZq@qHuRm0Tv71g25jJ4vxRamTx!hji68L#R7-QiC zT@Xwh>a2GiXl8!0)`d5;K9~3$%-V(8;FL`XV;3-!5}{2j)mz5C9AN6*-}}wYh#eQ- zNUZgXjG%<6qJT<==Lk6Ld6ez#V+Yx8Du`Y(fEoBOu*P!@1BV z>xxP_iYA@(UQ zS11eGdU$D7GxMJrZ@+RX{EEQvSB&gYF;I>QEXyOQqgP^D|-8xE{Rn|aCnWxTAo)CAsc^LUl~?xOu$K| z9EQ^Ra7l?YH{cqWoGBCGQfi;b10{7qPlx;a;P`5oKFlz42#TJ=uNX-}sw)fGJb<}6 zf!#>(ECoMvj=U`LRLFFG%C+l9#|_PdcaT%4-6~QFNTfa3Tkw=b$XWLC0V@`7uSX^} z;@Q8Z{aR<$Y_Zl;*BtO@|Ca%JHYFL6DK-3$gaH}XMDgtM0#7ok(+n2sDzsd^_n*^S z@V{7%yorhxEcS;AoYpUm1%FCsLu2;Hapu8Fk+ANO^rs)!ojELo9U-Oh&6tYaX!SUj ztvzEV0Bwa<3RV$UJZh(qKK=k*#}cC@u|%t zcpr$2Jd5pV6Q4440=?~f@vl(1l=2oouslI3T`h~}UtK#wV{hywVFrt{@`P5(H{=-{ z0}y#u0UzgS6q;9mGJFkzD5SO}tCdY`-1r+b}_jRR}GZHTM z*g2}LVJ>@i02KS#6q1~6>oQs%rOX5~d^i72QZfmJ%O#yX$Ogjlwjekx^o3t_Kxy?0 zrU>b8_gIkO5Hh@UH$z{GLRB zJ##?zI=Vn;c#BFB{6v8CXLlCZ1`G-FOV6@9kaNbB*FY?LbLq4h2V;4hq;0@p@H^6@{S3JsM2lNTN zFh0wPzl*qJ^0X-!!_vcn3|lv^)R035+JBIEsuEck8VlkCKs#9!rneGNHLAX|B7T%? z2Qt|@^8WTb2?sGOS_oy)5&QjW&-I#RSBU9xhR!Hs5O}SKn2VA6U>0 z_Inx+T8Qs6)>SlSz%3C74UT}$3>p+XXv9UjWwl=V9ZxeQAHdmXDGOeoU;w^YNa{v< zF~=%ZfJPH&rQ@+oO)SQFlv{|u5&LYG49#Sd!r&Fb+OCTgchfKYr2>{=+4}m?kjNhV1s1%5tNy~#wIHrle5K7<|(3b;d!^f^pi5^bD zGNb^7m&Y(Xm2W-+T>ge^DboH{myTx(h?Og~w^QXB0ZC28okQTjR@`SjFSY%E)ln!a z4<@$T_lcM)s5dZ7Vfz!jPn)>JPCYCuL|XNMU}pZo2lw~P5)kLL0v9A9fmA+O`o?Xo zp%}1PX6)pevHe+6*#rBsG?1zEL)ASHpTmb`cGAc6+=5SHVLsV+iV@E4-4%QTK__nQ z+8y3TDGjQJ1yP>%!$GnzJIxR!<#8I-{ZN618#o2!mHYJTa*0ImI+KXZqfd3BIMQ{H z?;=kZuJE((7T_s&PMSnCGL+tEeBv2YaZEn5`t+k6NtOk;)%HMUhm5#Ro5M`Qf%l{Q zeQX_c(+D$^ojYx=h3>$f>qC)E-Cjhus8zOKpscjIaE~L0S$m)oJ5NP!KTnNFYd6_+ zQlmqNP1zo5(+5YQca*xyUg&}lup%Ds&fBpC4&mPt4S0M%mHrw)qWu~`TD#(lGTLxk zN}c-%rpcabF_+nNx_z0KwI@usG5=`Y3Z-+WI9|kbMuAq-bc+1O0savb=6S)vUBshZpvl4^&q$9;2@>;6E+E~%3s=!C4TnFbKT?#@G1JzhL& zm@=O+19Ze#Qq^9s!7N8R9HfjM&)8N3+rH$Q*Ni-vqIm5>{FZuVkKEV zZq+90&)u4EMEDGMA8wGDtgL{oXVx^B*y;v-6b|zf_pQWj5KlYfg!&>3ew>QwF}KJI zyR_Y5nRa$t9tz1%IM72N8Idl%C8ij}ItZ@@0r3CO_BR7?k%WVa{K#c~0^fVesW4h* z-@(A1>~4v?{mSc}$8ZDsZ&ppN&T?l!9V3YN7Ju&B8|_pD-41&|8;b%gFBC7%pi&9- z#Y4Iz9O!=9w!z_@(y2bI4dMu0G8y>>?{eaCs|f+1w?^Idt9>chJtn}Z|d z1#}zei*faWOqsCZK{}#j+h%!&*9j`PhXF@04n{;9-ig0MMD8IZRI)^Z6W+F5=B_^V zkR^Z+9Tlx@xlqvGW~59zM>inV>12y>;ZK=>wa&uACa^Zb#!R|#Do)cR`t%~N^UM$?2*`Qeh+BKB0tA*nyw+6t&lDUu28b(3B$dotEu7v#BAL7i z5Y9|8jcA)o4uyIK!?dSR>xZ>;Q&-#hu=2VfDzzdKI@G6FSWtQBHz&^~jLcpQ60a<= z5PysXwzsc#v-7ul=qelZ(`Uh-Bf-ckz{ORdx#8a1jUS$Z&Va8q=}Oqr7$O3!08!Ja z$F`nO$)R>#v#_Mn8B4*8U?-UVhS&Ochkb_KZ3n$0du&@n__c&i$mrK2!~xm84wTbp z)tvecXDz}K-5C&Xf|ed%kXM*xx(z?H&}ZHUHHZ=D&0{?AHX$M(y3yexnf$Tuo<8wX zO{0bKtkw_$GK>I6pS{JB^L5^Efkn00QPrR|aabd0x}Uz+j^%VI zae!$4eUD+}+?AR+p~~N5_(-%%M!Ymy6@&@CDEs(iJD#fO30N?nhO)Q?fcugAaZ=L5 zBS$6}Vvd*=zC{FmZR-Cj>?^~f?7qFFq(r(A>5eI8Xr#MCq>*lxA=5Wxa zMoNuF7IyBvj<^;5`Uyq}4q(e8Z~~`#&tAL7_1z35(ZZt*F8FSGR4v%|Dx<2JTxx-j z1QF#v=e)}H{6_T4I6qTs+iu(PqIgzSi`$!nIB0J^<(D#(iJM3AzDDBo)Gp}XM#aT& z8`0>k1E>%>_&zfw;3Mx9JYL+ZK7pAKE;mt%)&huN4Z(NmFQ|OSbFu1mLzq%+{-=|r zI5#Nie#@Via^Rcp^s*)q$A#$BmCM|g;J0sIIej??;=ojAh9s+J*{F3mTpRFbzZ|^L zJe>zMgo=%|g<;?v*tx0Bq*-BljoC-A5x59gRUtqFyWxIgNJ6wkCS%7<%ZbAXi*_k+ zJ$YzEm4)SoG@JbU^WwFoQR`CRN_6okLm1HtRCSdj0dC*sc*p85{k<}??fV0M)~hFx z_i3|x0y0C*x1Zh1aPW>23w(P576mQ96^>jmdhWGyz3sB~Yz_kZ03}18*;_Kf<@>X{ zBgzAV-f!ZlvCDBX73#UkQ>R1c30{78H*vcSiqcxex||Y?!^Y8(Z*uMkgWV(B2P!n@ z1hyws8{nLf_RqdUaYq2V6d9s2eG9Kid)e?Agi=4N_rQVH?IC1Na{EAYe4%EqM5btB zA$wVg4V|Eka|`WBUE9@0q0r5R)sfF0>oVvf(hE()rV#AF;QH|9z?ql*b!}H3g^d_$ zoiZ%E!YfWjz5OcgP{>zj%1g?UO1zs`8s+qNtO|l0*OfTJUTDnL&?OGT1 zU+Ga1btz_`U60{QnL0hv=*M}ncp%asqCt>=#~s-%-bi>X+>m+5*}+M&`uNb1P${Q3 zOB73{moQ~Ph!ga9MVOOm0=^i`Vqo{y;|(|;Rm)X!=sox*)-Gkw!!KUDMHcL0|t8u#TJJNQm^up-vRj z%as9$0wMvF9t_C*u$O$ZH^J5MfmPZ0vjSu2J&Lz#6A;n1D)8UwSOoGK8xjwKbL|B( z9|+;NrbQ^vt-!6wt;DU&t-`Iwtj*j4kMh=@|C{;ZGkCa+Pny6qgJab09FoN(M`x4v%oYo@#maewC-9L%j<*W-D@oWWI-#%FVD z+uzCOjM&87fZOu;XECYSkJDKbtSh}zN3i1V5blUuV^u#KeR-&jv2gbVoaA}481_Xc zi1aK9HL! zMP&z#yYKkODfqmI%8^p78MoXK+HvknBv9SW2abD&XDj4aeDKqeB9JCmQ^P{_=twl~ z4|xVlv~V2ugPlS52xl+^EFG@U&B>jE(}p%GmEj@MPeb0GEL={764O5=SA-M-8}3WT z8oi{|=$oYs$bOFG-)3({E(mxoHP0U!n^>&+jtGt<0JFP`$+A~$>rn}%5ekT}6^GID zJm-5qzU5VIdyg@JyKQr)eVxC1f8*_VBfR=O$`H7a1P8{!{XZDx1qsO^wUDLqJ!EUS zvf(D9AOb=n@+gAx97^`JY91@60*0V&8~1uV^wH6(fuJC)pHq(^HIx{5Qr2%ZOd&Ex z4fY`@J_G|nF$HUm47coi_66@%Dn$nd@g7_~ z7g2umnEpd*h5?)BcFW=(-2F{QSQjS&ewp=r{e95oFL^E{;#I7)L1s(h^W|3b4WQ3w zlqNwzC`a5^TlJVa*t7|f|$i(9Df;xG{?TntrH8KQZ#e<{&9;2 z5I>nXz|4*&#D*fATDCMvePpQ@mOwvMVskrH7Ns4o_sZt+dvp^)EQXKY4+Y)eYE51* zC2xS@5CXdulm-VVvdf4Wu9o({&>21=e9qMO*o7FIXDiNJCh0Orc`5dx= z`mJ8u(7g90I}4uADvWMc$RlImp#yD}SA>Ea;Cq&rh7~=yw&zY|_FUDejh)6<((!3bqCy*K6T_@N2M`H&IxrO?aZSPYz20vZ+wZk7p;R6JoeZ`!)(k5oUmjNJ5I zLi7Y6zaB2?)78?Vma8x25?H4t)3DxOuPJ@*2RbN@@P_LdA~`luJ9dF(yW=)t zt@ez;4*%T7GK;@Dm1g`YJisz`9XoR-<>`By7p~+2S*EiQCu^Z4S}fLmU)J7C#BmO) zd61omW;mqPYCpi*PAZcrE!}tbl6f@DM7?WqJQQs3jeiG%cP!-E=5cCK)sv<|` ztxxA((1EI$LS$Q?z$2`N?2Ko9WEqvJ8c<9ar^v={C+a)Wu75o%-Il^tUF;^f5BLH5 z`Gdw|0Ail-joCEkTc~r=&k_Tk@20y9wxPin;$cF8n*l~3Z9`$h**8|hi6IQ)gfjMm zm{hGQF9&}N$C6j(;IeNql1?@W`bw!zF)kQts)rR$7eXYR+~7*STJLyeb`rP3eh^ch zQ+@QK5=&(2qH%3T3wo=WNkctLNVKE^7m`iRJQaz-wH!te(m#W_89y(6l))ur02$TP z?|9+&m1QSw3-^=wk$VYeBSkze#<%bQcWHzd{|-@?6acJ68ur8 zxCb;})6(0Y#QuO|>PhHk9N#H%IMszdAcgp-1$zE`hU{*RJlXWgu_e6(>~c0GPdKto znm2kOzD4SLIu-FXZ+Q$!e0ezOh7EDO)?W+SM;OkGsA-E?{|MJ z?o}vJcw2hGwaJT9=P_xQ%ylGjm!G^Jj#s3NDsoK4Te%|B$FSYHZ%r`D4h*NieaD1$ zL`KJ#h)vS|x;Yeg3@z?VBpVnN<;QgU{w|#Mf@lmts%s>DQvgsey9bWVZ%TGB00P5u zO3p@fjSF=v(tHu04tdB&!wQ-4Co;nF!@XTQ4?SMPY2Nn~E)Fx7ISgm5a_L*pl|~1u zmKk(-9i?~43+mAEHxbnbmpEIrZ9EzoVI&!|v(1y2khb^{Q?tHd=fkQmdJ;R(U(f8R znUsaSf$)DMuMfDaE>E`~2JwH2A+JjwaYOTd%2$~CLHFGv>B@-bi1H-kTOOP)@91(p z?xGHthcr<3vBF%0g?QOfIdv8Je7M||VyzTpDOzXsB1-TZT8-ya10mq612E9#(cI}Y z;Gl2)Dq1~G2xr1IXq|nGh&5^2gPeSY$3{PUAOG6l?tXW%)bRG(Eqj}d9Aj`r<-iWD z8}TdaGd4s|uZqQ6$u7zm8XxpYD(!apG6;AsUiPh~3{B+FsK?qkQ zT0s)gmTE7I)EiHpOaly8GDeLW1fF%3PVYTm6g9zjE*WD-(yyF10h_)|;hCXR7@5yY zO_vzvNWMlDP!o?A*xaESW{G}KdUGu0sb8jBgc7!pZ>5g8Al;ITOkbAnAmA0G60mP$ z4)5U+q4?JR3stUWj3LX7Cs|m>X}9Y%rPh}KS9CiUYn;=n0+ZXp*v05dM*7$X#SJ3d zCLeqiCUR^@_gcCm45?u9d16`6aS(G#TL=PZ_9QatiV*rO@A>!6!`JF~-WYMDfUI4c zYFo4QH8Zntl#cyedrJZxZ{Q_g5u~^o4&OghKSS03Ra{{n(y(R1wjefkVYqrkM3+N# zhsupi3-!m9Ii`riZ>1nH5(jh<{CxE2j8I|uS4BM|wUid6b~}I!-Ta|@B5O=jFI5sN z8V%#;gJm2($H^j&P5Y}K%Qe{7x=vuPPP5Cde7p*t@ROZB1rMiKhN^)I2wugPk8rPP zIYCk@G>t*XuQ&I$LdUyfHq5r@tb+!a1v;I3V|cbt(7Pe!$__VYZ;N)dY1&@h$I>hw zRMB+fsTmVE?=}s|F-w=B#fenkqAJ!_Q#gefKECfLIXs@0+@i+K0HPr7;mJrHj9I&j zS?Y$*_&Q!AsqYtfsAUpL=Y1DNfeTDd_U?@a{p89sw=P#RL7 z+~N;e4DFmhv|MgwXmZxv>_}LZbBXmaa!rdY48DiO26&5u%9YHnxUWjx4EJEp7%$(8 zT0SwmwSj=Ap7F4AjAD|s*@~o>yxn;2>5--wVX%3;=p>DNg88sr46Gxq-N*u zYdnh5Tl!kfQzXm9x@+b<1w(}&L?u+o{rY_V*+9{zXC}6ay@H78Q&k%ItxWq4y;%giet&IWmUUL4 zx?2{>x!BN1Bg_+8%!NHdAAna^BMVQ$0Ld| zGzU;eBmwn=Jn`q#yhu}cRDPBW23%ppSmR7#_HonX_1e#+FRfa+OZ5rwu*33dhsA>> zE!{D^d@i83$0x+kbvavZRG!pcpY_a$y}h)r!~%;9ppg7{4u51GvvrDb(?UnvC?1Z> zof*Q5_2lu%9rjI?&%txKRW-nwX1m}|k)OL$0;pXXTg_Bw)k}96aGkRkK2OPYcP9>C zt)(XG4EDD*%fyU4`+N>Ll(gMF80KcYm~G^b4IlQN9-WK+aX!DC!g#TxFLlUii|%7T zC_9C-jCtq3l289B3MrIW2txut%(%^(ug76&;?Ph2@|G%HBqrlyd`6(tfDE>trlyY0 zOSX4t-bv+fqXA}q6?j#vf$KdYCujwMCtVn(hL)f46N-o0w4}I9@b**lPqH2342~u~ zyP0;z1Zq1Q?x0Y~77kpTb0=u6`$ezF-LK{OkE8(&FRQ{Oxi?<0{;H+UAm%E%+27N0 zO=}rzb-eW>?~GwfVTgs}?Y5((E7{U(bdOqTA1w#|aF zPBSG@8~Ob?= z&s;U_0ll>)z72DyKjUv#_NVH%TC0L`I?D&!DpGpRHa+gTo5wcG7I+Ut-qd#cJ-)kr zjO5a0$wdPZWXXqf?!`!mKDV|Ja-?xl_G7?_Zn?coR~pC_#b4f|&dymX_Vrht7JbHY&w5tO}C#f%8 zm?+J_8kM85Z}emEn+aK*iOSJ#ETHy_Y)Aa@+s`k~+6|&>+j<%6b1xZt6yBLKc9{iB z<^^}5b>)-6d%yIL${ou)!h&Bem9lWMiaUWdQVmmeQw>d%Ir}+!8G65e@9)z@A=8V0 zkLkC&%q7h$r3*wk*a=q{?%_I&7Fl}tL;5 z>?B%J6v@Yu=D=<2&2UaK!9!@CAJP?61)v=HTzGx>vO%6xnsRo=8aGR6JYkq@rn2-q zW_|f7`5HwF-D`aXOBpddEQaN9s|a2SICXTZWSzvOE{bzQxTR=D-_PSuI~ z`|7*W*G-9{DY>IDO+T6<6+ZY8tS8}k?0YDxRV6Vl)>EGz7SNZN*_m6p#PSw1l;T%c zyf}BsgGxhcAX_!S_D{pS zR@zD~_U0sVMhK#9SD|kW-@_)-_wB6hx#6}fG5so>g}pId4-MYsQdApfcAae+1y{yK z5d@~M2J2TQQ$1O&%*OGb6o=Y}g@wvSiTUrPpi-WmCtJ)4TLv!HCsv(FC?W|BHLkz2 zedQ%E<IVZ#^Voq|{X zx*$J&E^_NuS?loHJ(HJTm=7tpl9d6Yax`m{;EnWV+l&E05ZGp3Y_)@Kg+W!eVp>!t z(2r)FmSD=%y)!p6H5JuLBNU<ZEHpDge2ZN5OYZae(IUM|KzrX z0myk3SlY`$!Tcl=-xFLe-n;BbG1-ROZmm-!PZ|%1$h5A+>XYsBz9gi|*}kIo#)FN7 zty@jxG6v_yuh1)|t*3=HPwgA?Oju1vP6#W8+%l4b6ipFhqj8ABxN}*?K6nfw?6a(? zw2ZFDuI&x zSps>pyz2eqtf!aK59iK=2=g13|Eb^ka6^v*h4LX9Zd4xXi5%CYFvYngxMhDIJR|gO zMe(7(D~r_r_sAKFD7}Tj!GF}Sstv`6Zir%{4+D^ZCL@7 z0ij0KH8lAwy3?r0kCBagAKFzJORLQ35WgwG7Dm>o(vfy7>)%SUck3>YpRF(3bQU~i zL?RRtx;1%v@A!4jYq7cIy0OKJF>*XOR)#_RmH@7Xc%6k{;)sllx@6#)xq^zGeF*K) z@5C=9H(ho>_&OU)##5@VFtyp2{!nbNx`;tLa9lOB^u%;}2T}_&-MPWt>3+wBMG5n5 zsx=gQEu}WF!^64*V^&Hojvi3?b(@t=o<{YB-{6-2mYI_uN(A&4s`C zVVb@Juwl{Bo5>}y$C35^;`+q(Sx-LqU=;q^id!H~C{pTE6iOXZ5xQP{GrIspg|FOc zI8k&KU5I*5;Npjoh*6`PTr+P7WdsK-aLh*oK?oM z@XekNcLpNcl@{3-k7*WfW~-vFE!NdEA8=^ZtVsEoNa@!A3Cq6m>zNLR;HS|o>?Fd| z?VL@A6MVl(>}YFSvjL3}m9VoO0e^Nd$&mVp1O!o6y)~$j;{!N_GiJUUNpG57$H1)>) zhc_;NJRiDbF!k6vd2iu>F_4(Y(#Hm$G>VF>oA*Mwb2&cw{@uCo87C9CG*)w4VP-BM zOE8VisBMJ-&Oy2Pc6+fpx7y6rTVENQCT0%hG5h{pzQXv3CP=b3f50XL|II3<#I1%Hng*rrYrkMC{3fz}?H+6oK*rNu z^L)e`V7GD9pKFrs)gkW>{Mj9L%gICqyz4rM8IVb*?$KrvBv7fz=Gx3iBa08zKEUFk ztB=W_oYl+bu*Gea&qXH)g)LFTL-9HCW6%!2FEqHx>nRc$ggJ+QiKwO!ksOt&{*?nt zN>gbT%UR;8ZS~QiCm%IjW4a57QiY2ayqX!{aQ3CgZPt?F8DFOu^H_<9enG_k@}6)l zMCYj&ba|#JkI2N}RRv~0#g6qZyDLwU>&;cSiwWJ+4r5t^!(Q8cgE3TPcyJ=qTMR+W zWc7}hICQGKu+Kwu=e^9#ZCYm%YkyTy4}rcow}2FN1re*Sq4L#%PN^lA1IlPVO}vAAcI z^DP!*orjW(!m*WZFHjTdT4~yDDY56W^G(ALg4EN&!#mYfuKr;=uNX^Je965n<<2h7 z_IL_8e0;ek`>Ns_3QyGZ3_dq3G?jScCZx@0G!;G~r3k;+^H_#gSFE#_$3-$k9`YI( z5DZtG*en0qh?f7LR&7!D7DZg`rrdU9h7-M|VeIK>2RgP(i8oyCEh?Ep^%{*L3zb_K zZrzk!uZ_Z$Feht`O<409dj1_7y9hzuXZq4_gi`HAnUBi8ef?;V@(ho%DKzBrx~{B| z^b#-ZBWY~YvpH83xE|aWHMCa#qqYq2cDyHwkuBkgt3C2DN6s3aSK$>7bHh z122b&G=slO3)=kNrqbgc(N*j57Np`p!5FOxdTM+=u8l9a6anRt3Jh{|%&SeM7brXR zKgMSU4;M#=Lw5^|URs}GMY!@6wyry?n;T8%;4N>Abf3?o!!N`W#ss)l0^Q;EU%FGL z;$%WRs>KXTz`D7f*@fGU!nqGfeWFlHC#Nwi&D$$R{2|@y-4+(R)K9G{ei0v_tOb?) zT4_dB>&j$KLci#>)`mASt~5S5$ZYd&a+t~T5a=)SUwd~PjP*s|oP+kKw(fj+#(Ya? zie6^uH;lcngttYoY%TTxr_2Svy1Q*Aftv({oFCiJ>xnlLZ<~cih6v2)CfPPcdWRjC!QUwwP~`r!o!3OyiZlK^W1(3lr!yshFX%|Za~6Hh z_nk5G(;pgH<=PoVR{(oYYnlX)q1zREz6I^qD_#D`((v@GN!_=NzO9Q(rx93-@Vt}E zoK8GRR&;DC6w!^WLZwrn@f2V2T!aYw&H$La*ooODzr+f#8#MzGu4!K+3tns;`)KK1 zO&eYiUEgRni$_R>JG{#KEEKmAKCS$S(@r&|iEhJoVR>l`(UvP}BWtnfJYrQ~@3SsTJHKVKHrQ)1gw>d(;;8sx2&=Y)XUe zSCzN5eFwUuNn4(aXOh*HnU-Y_`*+;WA7AAVQemMtsmk~@ftMd#U)v>i8063NoQZKb5o$y$*soqQ|&O`X@105>Rc|gAtp>oV7Y+MaNz|&qN#OI zOxDHfJj=q`96K+!DeX$4AgR&4OOXF<8SlI#)m7<*y~FCSdjb^VwM@bv%&junuU!27YWGvWuwmBy7`%Ukf1ThhmnL8Z&SuFPGZ4I7O-62s0Id!CbWep+S@-l73mS1&i?(cxON=_$qnf-6!=e3Iy~>6qV(EN zSV)3+7|?$}3m!_(k8Fu*FDa1T6C*H6p45H-AmJk8fH?s`4Iq#o0Okh)KbC`#SpOnz zfRI|5OihhV!C+%EPJp>7j1venH|BgO+Xry+z6S7sO@I&>#01RD{ZSN*#8i6%MruN0 z2LpgWAOH*k>Hq-D4KWGoUe1G!-U~nMc--1DWFyP-4f*&yP{$_p<%=h;=5DW%= zK;-ySFbo9z+x>utIQfV7!T$f%nh*FdFMwctfCoT^KPTh^^8PL4A%>xU3jy(g!2hE0 z0(k!K6941>2WH;Cg#aNBvHzD~5FZ%u_mY5k|LwsC-rtZQe<%&)1wsG5T^{Cx^Zv`N zykN-RYxltXuYdyq|1IR9zbx!uLU-+(#JF2+tS?oMXr RSWpN62F7A!lvI|&`Y)h=hsgi{ delta 59474 zcmZU)Q+Osow{9DEY;|mQY}-!9wrzj0jgD=bUu@g9ZRh-J@4eQ=Syxq0UDegB@s65v z#2+H{1ELNN6p*61;j|%+THSe0TcT6W+(sVF7zBJVHH~UX(P&UJ>1Dv{jaT_mpk~J{%>QKn#-+Il~NJfGCVFiq2l16RffB6j_))u|d zZpW`Y6ed{{0@7+@7bl`$vtIM%g5oDRB!+A4&5t)80F7~*ynH+?`U=NA`01FgqrCjE zHs|Y@^qCBC(F+`}ll{LYOXQKE&I1Oh8*P{Yyv%;zN9W7Xc9bS9w6yhoFXS_tT;z|0Xa+Es+x^67Kp3P;k>cxmYg3E!_S?gmRA&07s^pXx>Z3P24Z& zm0#qfj>ZWMT{S@PIia58n~84f3U3B|uOYf&o46IzkIA{{6gb?9>FO&HMyJGe`GH_O z*K290=~mk^eC;8_=kaADdT#yfxb5oW%sv(-maIozruqBz!T*9 z-*A9vd#5&(M+96wx@L-Kd1sC-_yFh;hlhdS)Hr?k2!$3bL2c>BnY7t}Uu zy1O+9BBT5!Q;t!6wF!uxO_T{51`rEdJQ~-y7hA~Lu}N`AR#_Kf7c_M&#FIkWl^Rhs zsJSX;?2u+%=j064xYA!Qu?!gjfC(NJfMD4btT?*Zk1vCQarf?a@7^$t!AO_69t-t; z!1xQhP+npe={>(O71|%dG+s$i=N%eGSYp7JZul;2fAVSWLJmE%*xy1;gwh*1xp!$u zcn5DF-9&M;ki1+bq$NBV7*mc1rF6T62vJk1W-F>n#>AC9Eqm>C4CKH9AUD=)VlLA8 zo}HCe&e%`aZY$KvX|Og`kxyw4FibqUfkC(Jkm^mCa?c7GLmsAel9}XPu&Xvbh;GX; zAwyP!1GP;Y>#ggaWSzqB6kTt3O9mLH8%h_^6^dJ== zl@AJNP{nX{22^UwCXai7(KH#vs;DZ_zmyCg@@`)(75rD-vwyV6dc^KhRd^#=Jym_z zYS_tbQ4t|$HDX@%fZxRD^(+@l4I~kmoET%LdYXqZa@v(9-}4duvHP&AYUk|s$0E)MM@D_4hR`9_E(BxbMMh%LlYt${RRJ+71SS`0NKW3bTUeL@B{l9K_{kV zIQ5i6*g9YX>x*uLkvS*s+V?FjnVF{?ik+UIVA-Fba4mW02|(xHNJ$?7I^0ETP}q|Q z7>vy2NQP@ncom6Jtgx6jzw8u4T~zTzjW(z%NotNx6(`MLHsR2%EO2R;bkDd^g0&zw z^SoRh~T|k9N{p z=Y=h;)!tb(cG|5mEPj>XOO|*QPi4yBTmlkBkl03(wZHDDk;L?-Bj=v2)L)<)9!k22BymP6#8z z*#ajE0nDto?3*N*P#!R^FhMK zk`#Ds!R^;$Cc}1OKH-&5oB)8J)QyDv7_5hO@Yh;J+LG2Pyb)F~qy~@gs~ehfT_!;jE0eT2hv$La_R=DWz(ZVn4aAs zwGI?WwOf@H#OPXW{LG4mhM>s#F%d$qrMY-0_=rdtei&Q3%_ZDA9it!Bq#JzM_Ccwr zdBQd5I0O+K^$`?Zj0fV0$z-Heh<=|u3ku-Xz~;SBbbwLl@g_7lFm(c zIH}Y+IdZOW6i&fA>#`fhyE&$b&yvB9#424?5E{lk-Zk+}(rzL>F0 zmt|x5d`O{`V65qEb(RQ;-(sJ!q3UgSV9DqmhYt6(kYUpbD*UpcZf50an9b z2}n;aaM7v}F$buMR8lUfN95suNWk@$S2-pOQ!K>Ux@;H|i2Lb({n2G~0n#nNjdv_H z1jEDq8(~dJ;*eH(b5dLh-t(76g&qjjj4btU$9Y82bl=+jxTg|CASl%L@F`uqAl6$mFOIy zj*1lBHol^S`8#4ZQ^;1DcnPjjqWgl8OqX!g0*2)p72ixfjlnA=;ZfK%BR^Ze!3 zhy3dfWw?KWzV&X}<_=UnPAhP0@SOgp ziw6#cS_ZdT$=`HUPoUxwOc5yN@y7pRd z+prLuD6r3ukWMJUG}nzAQ-i8#LhUwO}@nZBgS6|>bDJ2~J{5m_DX&eqUz`nYsg|GUnJ}z~$0Z3MO+r0o`yg%Sx z@h7e9h)-teFbXfEyzssbM-(ZC8TwT~xMHc&i33my{CLx)`?(3tbAJYp!+!P zI5R`Rcrj61njmBNxqrt!C@mW-c+uM20T01NZsv>k4Z}dfdUGo832de{{i(D(_VRjC zVv9h$8a|S%J2^?c0fc|HS$QXi6HHT+xzQYW;*>`+owEPCp4K4oGT24HtQFPr*;x z3QJnwNR5h`GPfj&fBM<=O0E9O=d?~3OX{}^-~`B$x|RFoH+)oE^+CH+Z;xp{V`ubk zSkM2L!5P#0kGwCX)S8hyro%{_PYY)bKvO`Vr#V;O?`6EP=j;3PycX+uhr!Rwmb}*d z@_Dhzh(r6+?YKSv;EjJ-vue63RWp4n>K*QF5N3@;-~nyq#B#lBwzEiro^SV+(Xrjj zzcq0*321giywMPMEw{5#b1;WGV>dsIz5!PcHf{Kkuz7mkxkJ?pvmi=%7f8Sh0Pb~u zEFQ??wG%Y9Q|f!P+FiQVSMc)em>hN0?SwD%<^+83zDrfV=XUPUJ1IA2)5;}Y#7o(v zG;5M-J(sWqO|YTyJA_*079g&X3U6V<%ERqnl#t_v5i0MpwmCx$ONJtv>wF7i`x%zs0^4$H-`drmrvod99 z{G2kZ-S!(-a8C*Wqm(06*M2fw<9mK8<+ifYwQ0gQ7%D9DK1dxaCEnfbc>kEbInM^Q z@ELh22|Qr2t2G56mXvBwa|N!GfjCNRR?Og@->hz=+iuL>XN{_RljPd*^EU_yB-?BT&wWW zQYNjYt~vqx#KO$4&6Nbcs)x+oeE~qk`|OSA&*NdStyS zAZ_c1MB-WSq_%FFb{t@__7a=yl1qcL{vOsoIf3uWSICtZrr;OJXrHTMo4?jP+j9=( z&x>ku`4f1WzC7G_7vW?x@L9YjN^?!-N!)x1*glBc!D_c|njZx(gX`88Oz?k2)(}RX z&)O((dkX?b3btec^W-t3&F{z;?n7QnDoHw}&gWhkDV5uI87)3LLd>UPCc7gtuYNs) z*+uf&2Kfikz{vN;P~^@GnZrxb%r#V!mQ*OtTq&~^sV>PSbSJtb)_U|RP`Fe&o2gck zN=V5*#J@=Ku+{1s_56XS$I0FXv3MwkOBtr*Xs){DpHJBUe@yZIkV9m-y$97B_x4sq zXj{Fg9VAHhq=<&UB>7a@N&=&s;xSUB_*68$s^yHyfpWbg>qR*?2BY=#T14_EiVOWa znqA72LjWNX9vHEZUaWWwqvsG&ICliFK*{<+?ev0TMKPWjvd=Db*HN+sM_&{*N^>~j(Pcbk)1R_FiR=p{5HYyjpq5UU0I!7)v0qR{JbuM%e& z{P*9;_Q|YdhSh?=IGKBfG?{}U_~1G16~96%+Wj)%>1Zhn141zcyrvLrgcNUr=$w^f zqZb_J7B`m2)tp%6qhoz+k}{kG34%QILMsX(!L^?Do&y2-{@{;1hD6j6S1=B~<1o*9 zHvPjI=sY07)j;Hk<|v|8$y_iIiUZ$8K}w05(xT#GHxsFz){ z5d{Gt-Qndf7XDlwiJP0Kf9b1hQC{uB+h4Qy9*>YUE%8Vf#IIf+#*FJB6^Blqa5Wg6Fkg5nYe#Ww(3d!s3+tT&@NL23unlGyUNIwp`?Bnw4Ec>t7#D41^Kr4nsJzY1z zX6I@JIGisDGsFY_WwH8rapy-2HY+l>D7Habf$*K{%!}&4i#TkK-Go0NqPQ)$F=cQ` z_fT9D=xekQ+VnJnvlquNeu9YFW!Oz z&Zqmo15OqKG5NINWrjyWDV_5qJ@N+tRY|OU-Wfl}IYjccRVE*$o9Z?CeA7!Jd;EIG zB=QBpks(*IS?<63O7A)jaJdpCw0N7BBx)-ttMRLxH7%)#r9ngDrF#wMJXVWDk}UW+ z29>22&?EF%k45=6rh69VEH3&%UyU9>OTn%`UYTNj(VV?#(Sck;Hv%(`li)xFP z5mQh!C6zrNIRf;i#20c=vUrdtP6xY}4U6S0rTkdX9<|Wuf^z|zdk)BcVG2nc zjkDFcLV=eVO~>g-iz-YzSPVJ2miMZC@g`rgw?>ryx93B@T|=|rk|hMHOMCUd7-f>1 zxy1l`$P~(V0jp*@7?~Rj*wPUIMxZOT`i=;>YFSb9>Pmr-c$q4FPvMv94-lse;!N=k zDiI3jWv8KB{gAP|%}-KHzp>+9q6{%$+f&qG+DIc0HAqTXK$d#Xzk4yNE2Pts+fd%Q z!J?pGJW_R0SP`H+!+BQZul=l+gYQY22VE%PDMymKLqr)zE5>h52 zCsy1bvI(}oJAlnj%vCI^zrTyRFLP&l&b}G$FQkpB{9#QBIC=YOHx7|s!&LM1E3-b& zNwuI&)0jw*Irm!5I40ZDDX}g?Tb%a@baasr)gp&cVD3~mY_J3j9~4+326~NEU?@BS zz3@ubb>5$nzG$<_95xlXd$|E|ybeGiS0kSQ8f>>N{=^Wzvd}>px}vp@PHRaQz4Ebz z`@wS&O%k|f6IMoWc2qtR&;nkCLT_cw)i5XSyW)tPoLodDNK+JfZXr@$)%daDI^6ZV z7sjqDqE?iNQFy>NyXJ;#Q}^fmtnFp-IGShk2Fe3#7%!Gl$g95uRX=hV(c;mhvnm;4 zbwRZ;$39yInM7J~50&33pH;X+#%Lj|avqDziCp8(qK77TLhS9nEc-3=f+BkX1+VJe z$WpC4>2_QokJ9#IB8k%kn4?>9@-)f-T5)UDC9ZkBZ-_WaThNM2AvGh8U|BQz3 zLTTCcJUF`|=rXhHbQWLcL0oRtD0f{NJ9=I=IUXUwNx*y-dUYV(453Jpd6pDFHmY;K zUMf$3APLCWRue7=B1Zt#l#qA|jw%XyNeMX5&v&X^S5>}ax~ZM?>fuhpoF$~GQbO8t z$8AVpwEjYJ7o45!rp9PpD^n?o{SEtS$We~LOk#F=gJglM1Pip5wD3h{ojTY}b^H<< zyZ!jLebYUQz)U)S;J|t{hfMELp;kyq8N<(`Wy;G=y zKxyf;sm9tL;>0)Wp**$gNn?J?ggwonJKBjOMMs~?6!g%1Ckz2|e6HbQZO8zm*4nF+ z(FEvO_?xI*&lrm@7+4m`!<`PeOE*8i!W_|QmfpQPPQI=e*Z>n!WwJO35VYd%z;$uc zGn4v!Z%$Fy9!3@jQW{jamQreJx{?r?i!VItI-}CRzpz3N5ST=UgngKXHKe@ZnQxy z?1la8JoOc7K{9Wuh6wz!m-_bU<{Y}H`?V&pHgRe<<7=}4{=+0Dc$|{%^Hx<3qfljq zpom^^5A+Mq`X@!f@<{mP)nAUW1^}1VHDzblR2~B;*VNY6#*8%ifwI6-nSOB_B^uKQ zy)x!V_^Dl;@)=!*I(gvvY~71C@fLlQZGP?QMgbq^V4wyDpD+MG?%?|y?Rnj zbTeBp2F6iC&phY)s~E3m{$BeiSK-(a+0|j45O`ed1XcHR3a4Z!e^#hlH^6+0(9LPu zAMaJUGSx4KFU);#?8R_$lAqsr>@BhlO{}odIZ9$+7mLuL-RSbK|gj{kKs|-TDy3 z5c*JgToU?}nwnr8;hRNE^QC~k!q&=v97h@8<9sFcW`^Q=V~mi)&FLWTEXeA0Jl(gU z49n>JL(%-7_A_MVTH?gXF%06|pTCC*|SbCICAuj8*eT0g&NYXjK5!!CR zzH886|0fTyQ&4P-JV}$uBI2EiqUqw)u=_?*z`p0mv`f^QTJ0kA#De&c$p%LZ8^ny(*-CHWdg{tL(uLWep`*)i1 zg|P4kDH$vAhO#4Tt%mPMxE|~50bhBoR*cxfto@o z<2f4aF4DYUng>j-P_7TB>6_n<1E#(f=q?qEM#@d$XcH`8k3r|r4E5#Qr@Gb7I#0_? z3zbWuhg7o%?%;?_4&=X)S<1uJ#`>#RExbvb&HG|nIE#sAmO-Fjj4x#wc)$ucl|jQH zbX-jr50Zml#WjZ*KPJ~+7G^UIjo!5aS2Gff;s;_nK{8qXW}f;Rx10RlrBc0Pcp!de zYk<{716_yZiN7F@ncY_5bn*u{blRy~G_ZPMa;~#MKDvvH!Brf@8@u>j(;{vY{t~fNF&(2G+%6ht27!1r|~<&rXF4;&e^~{C1dH zITCLuL2s@BU37EN*+^Qy`wP!b`m9T>z4=|IG-^B%RyKv)#-ihq2E}ug_Ghhg|D2ON zAPxp5QCF6=sz-s6l5hsGIJO^Lxi6V9KsQA#4B#B1Bd0GGj?jR*fBWToy;WR7a>d~IUyBhY!;tubQvRY=AK}@(JL8Z#< z@e>npMJHS%njxjisY_rObuG6i8Wo~ZBMS)1fN|ylH!gX;SqH7P`9W9&K-@po?&QrHBK3>cvI$uit z(Nl-c?)2^le3Jl6S!3F)w(OqNi$B`{+a5z{eJ{$-XH4-ngbF_9HGrU_JMn$iMBziB z2cuaHMJi#L#g{&G~xdvV~0 zZXdDYhNm4lf9#X@*=)k%#TC=~2V;omLYx||9@fNwXkXM=z>2KyPyOD#kQm`#d#nLB zY$%5$D9hKhbb@9ysQ1XI9tF7#D;}#yZ7!v09-QgJKqW{OM?B#U5*7 z;waqrZ92^(hwM0Grk9*qpu*V+{aDBZ(U0;yn0j7Kv_C+MPZoiuSc+hM z5YTEPnjE48IAw=RAGKDt8O}!w;J7RUN{;;sMu}+U?Lp&q?K5Sa-+ryOh`n?9=4n&) zhG;Pno4jZm?b%8lveS>VGtI+_#qc|0U4Rj``lW}v#ypV+lUwB7R$98A7Rn3MZt0K@dI+H-v`rV{~+p0ovUUE zZ9dxo>NEc&YyIb69NtijQ%W#?0X~@oMOCN7J6eYua|i^r_lh_}|Hs9X6z*3L4Mwx; z(2K8U-^NAd+f(Ex*}__(8Wz?GN9qZd{qcn3s>lMeryec*@OkRcMCH-P(3?}chp%&Y zRu6y=(3rLZf7P(TTVHnMB^}NnZ!iJHM(dIeFuwf{FecD@()7y+sn`XsB|?^|7VpAH zIV&GR6qi)&5r=WB;hlfw|En$H`c_@KrGcV>%|{b{X2F+B&6HT%tomVVOv6>Cy=SY` zE7Fjo4NSq$KNO<}>2YbK-3d7j1`0DkH#_AP|6Pg9v*Qu>O}0>l7okO7?bwrUjIM$N zP$O}9O1?q!Q#sDk6ftR+zS&ge%jpOa?$T!0v>dj2sDLSAuS1um%yZ@=g!JNKC^<}^ zztfem2i(O|5WVqkKWDi^$@@v5br7$? zMRJn5Af>n3hl-u$rfW5h>lk5?KGVSflMh9h-?)~#C{*N@)aPh>DS-wuAn#7R-AL+9 z$3D?R-FAsJ^u#B5LPYIpf!rFCPcels3bVZko78boY|nh;Jn>pBX57iVxm21@#T-_^ zz))$B{t4ZiJ=btaU?4zsjF+m+%y78w#U2=w=UkuCKKR z1b|4?cLlBFKE|~Jqg-ZAg2uB%HTqM7scw=PnV5Rlvf{snJS7|TWVzLM%`Fp*$H7GN;!zlpvZ-X;qclf)gx-HZ`b80aoc~D){UGmyrO_7roZP+I(sV zw>dlS_m!r`=1KXtGq91FME~(OcFBio=iezoLZv?)*F5JqYw`$f~kvjPf?rsB^b&q)8mAH!Cv!k*z|r8UY<%Osb< zLLE`sPzH<3D?1FKzmt^%RP*%YppShCz2TKf=g-_|a-jX_rdNHpzWOmLxO-luXTvATtI=1&FBC&eQ@l*s=TbYk@O= z>J-u;wzPWg>OZJW{b>kWLl8L{xRR9}#3{sIeS6#`NxVy~~LeG?n zygC?CB;#{mL0nH}-5!-C!l^9-QEt!Y_wN|(@s<3|r22%P2bD*+(r9jBZQHP|u?roN zuv#g9v#8Rse!FPTbf0&VNUp)~t@O^oG)|SeBnf%}qMO7O;D^-*W{_B(-u7;OFTTRk z|Hrw_I26G8m}4ij6b~F!y>!7G4qGKbaSywsDbHrY2g(uH2*kD(xsy$*T!rzIhtT6r z%Hp%&JS|!$zqpsr>1!43jzNGY^x3oM8d|NAE-#wo9DrI5%hb~&;gL-s&Oj46m%dWN zATXs#@>+Fge1iLZBO#WGg8naag!qEm0&G zE#V)nqV1Oja^QB&M(3-MegL~RdbHSxmB|?G+?`j?c54Bk_~$OPh-z;Aati|{e$eMX z9GT;3mKHZU0O5IG`PIH1!~4kj&Pj6qckx@}X7mAr3Okwr5u zmq3qp$IY?5J)qp%l}GQ3JyKZKaDxUnggBO$usW9XWWV}j;Ib4+{@yV9U#a+Q_NFu# zl6QBlJI_j$NnEENxjGf%oE6_a+GP@}EeGq0(^wK5L^K(J<<)DNhsv7aQ2>SobOZ$Y zFQusQVG=A|q}%?K1z^+D0s?QKB@W3-++sv#)V70vIUtt;>Ry&!_6FKAPC4)Zx~?s_ z0wI?p1~}Fj*&#N>{1TD-=cZ~D6^Vb|{adf|vbYp4SUcV=CiUXI35z%Bx*!^6*&!fD zD^;>=E|in;ZmFd!ptc*!SQ^A37_Hg%ZDH!lh)W-lH%QUv41I$6C7?PN(Yp)y5H>%Z z`_U%`3XoqIW#Rg2#LKb4^0SP4yAlpZ+j)@P)pmc%nZ`;)zFZh}I=-@bJGSfAn6kH@ zzIwbymIW)2>OkofpP><Xd!-mkg9zU2hkQsIg0kHqz*Jus3UDEaCEn#MpC5&T{%-K0P z+*8%v+J7o?`wl_fkPX^W^RzC9wp<8BL3!L1T}?CTU25q;heOtacV&$T;EfB|&PfFe zhOcg|a=<`b`PE}O)p~aKco&!&=M%WCuOD4(5zpwl%_}6o7=l0>92xaqNwXClSAO_A z29SN?gMj!;jRy+Cx-H~WVBC#s#TRJnp>Afj4f|i zb1x^UxiEMPOD*{hEmF!RmH6bUIKQ2>-;#mP7e)Azh+SO!Qu*HIXm%f1ZZ)Vl3^@T8 z?me98ntdatm*Sxz%QR$ZK-{5f`WQk#2;hwLvc+CzfiAfDg%cJ>jb1l+-vWkgdZhMY zsg|qgOGRlhCH>etmk+A(sWa4%J)*e0erMi{y|1y|Oi+w`#tH-9I^lyiOdt>K$S!QE zN*+C~g&@~Y^m4*26`(9+q!>ykope8q35w@vG{4T6iIhWFD#8(!(Rf*eJ;H*q1EA{D zGx@{S7#FtLM08~tSjay#(-nZ8v@K&vv<&4ztvJ$6PY#N%NXa3HK2?XUrH<#8-hhh= z0{x4w9Q>`KeqG!goQCXfptizeb`0>u-0lP0S(oDF_Hghie+ECQxAG7{lIrsGeC*}c zC@fGB?CV0>#Y0zWc+|d7P)Zdw@!E6MA z8UmrE!8t1Vxe^4<9#WzXA zyv8s6u0S*bAX~}kjql)qYP%z-`8=U1uFF54Waev|ebu&$ff?xGq?d)317fYViMZG# zsZ3R!dTU>i%evwn>r#RpjVi1YgWiR$Wql;@s?YBok^i!oABqvf{f@-pJFx)~kad(T zliGSDW+)YT_QIba-Ac`*dw1ruuwZ%~hz0EcOAdvyv$2}1@7 zrTp*g)>>Fk=($jk`se)S1u%Uc@_1I1Z&jEGJQ^Yh{S{t18UO|cQ4@Sqv8WphHEpSm zkMk(er`nV<3CiJg8lgDI)l`aR6cZ|l0b;DvEDJ|}v-#F^>^&#lQ6@BJ%0Qd{5+H>t zIz1PnP!xn)XQ`#LNJEf}$(FF}9*VE4yT1V&JU?;mZs0w8;205P8Sy2nl; zJf~P?u88!k)kJWlO>V2;n4YuFSXfP76V$RPw9AHi`!mFEvLEGl^L_3lD#Z!V~$Brw>5;x_Th0BSDxE^q?- zcVZRhibdu_#?nRg696%<_t-9$m+!IegE(Viavkgea+fOc?GogJ0leG2+wyI1sN4Bd zTv@~>p!v4i6Jmlnm98n-h~W%p-qAjc^;+KylZW!1{ox)g)n4wU}T z7{Le*g{y`hO;NjtX%JlAi*~Jup}S1lw5({W)pupysS8L-A;4&2P*b(be?!i|Dt_Bt z7xp+rV`coa>asDC!}P-;#)yq}@YaP5VFP8eAM;m)`TaY!J;ZySbY}n%mhVmU_LHn6 zKqj+e1CVGm7x!aX8)9f4G3$Y>WPCp0K|f25+zTqVs$9eNwqkEOuE&V_eHifxH&F`SdNXRV2x3xF4H$Z z?FbzQnvvneqso90Mk9oLP!hs@9w7puPvAuKd3Yz=Zo8FOUxZ06?} zqISbz=cmykodmDPzx<$-s}-=nu`eZ}?MT!(VjGe%0PsVym_1gcon3p&%N%E_^=9YY zD5?+DN!xr@Ry8>QgI$TA5a~N#89s5XwRjsmp=m{m z{8OLO=Lg*Q%;0Epr+%KnNP@&&n%yFP^(gY{t7{Hl1bmJ9No`GGwt6+dJ8*!co75h2 z?BvTd1OCgd9q$8tTX{Lo`p-mbTI2I@Ve9Sn6iN%mX*L&)xl+d6skbA~cBG%NE_Q^#mVKh6GQLz?x138-)3X+(|qZzn~_gTKp%t_6Ovj ztQy1r#v#`KM?TEVtc?GILmdB&Lva7o`p3fge|Tt0p%3Gw7=2;&O zCcyXGOF9?8-BzzFeQF2y`-6pbBQ-^G=D0@z+mW&H52rvJ#W35JQN9S3m$GdvL zE|#NOezEy2)`sb9XHG2;GovH0faYo`A{(e=wqsc=h z6MD~AM_~Dm9qpJ#lp_*+jGv{<0Q> z#gPE>W>L*(u=+Yvlmf?^ebHoFaCdQC=Kg{>Yx5V+2DuO)N%9V*5FG><<4qaSmGYY4 zInvL{v&*BaO!o&4d;3s9?s0}_TCmgMq<1iCz~1G+C*|+3!UH1PQ08q2u%E7Tj8`$F z&_Zv>&bSKjbun;#%BJgkCHMvszd}2Rjhxy=As*oygn*k{MP!{oy4qscGD6%nviZsy zqiq*`T!PbVYfl^(Qu9gp6<#3Pu|z$gWBB@1WpjzOHx7ccg8{HfMC7hk1daj@jH-MA zVD>~su|C(di zPxiP8GR+)ph#dCea$>6md5#JvjUAoG50{~rfmY8}hA%6N_=GJ;77AQ*s>OTo<6&&c z2%pj?J=~B!55$k7XZR?g!|3eJ(uQRlV30Ru^R(r5y6w&%#BS*ur|ZAy#54(wZ;)0i zM%++g|G~&>%;1Iir?)Dd%?j4ScjY1TFEU6{B~%f)9x;kYDuzY+3V2@Fm^-7Pp7Cwm z7x?rm^LKU_Qp9Qm*?0am{~w;pgi}4(KB)_2_Nbshtvbk8KB(LlfTZdSzPz6v09uhu zNw}L#f1&Mdi`dkCf}F>Cvkd*;hA5d7T@438SDv@Wdh?ZwwM^MmsT+K9 zn!!?Ac#nNn45dlhfFk94SckicKy@MVnK{J78WslffA&QMnD<`^yJyR)V3ubFHZhO( zg)3~;Q;aB`oHou_YAm(o)K!Kt0M5V%U|?xAs_SuHWX(ndG&eaRXy2eC;>FfEyGeES z`MhG5&}IF8Yw%$lJO46EDtW(xD55D&7I>U^!poLM zK=lH0=!TJl{4Fsx6X+e3PTd# zI!61a+;g@Kr?0{(W;*v##Yim?OaKJAw@*kzr?ovb+mU$i9o85KVzI0z1`XhVPO^*k zhLuD(cg`t}q&|?o<#2c5K;peTX{uFd!oc(B6E2^WREABtY&Nk+6RT=Z6l2GePKb{F(@ zyxS#s;YX{L!`4EVw*)Im{>QF(^;Q`694kSzSe8mc`2;P1rW-;iK=uLpi1sLBUeN6z z9xs2hkfo*$3~oLHfOHfZCinHxZWnl^%--$#)M&T~yUVhONT1)nFGe^QDSds|*5V?@^-5IY#|HGH4hwsKf3@S63l8zsZqxzZzsXENABW=ESHv~@>pLbW zmToESnL$V?fG_C@2QX^9@=N?NGUF2<#uJ^wPr7^!1as-w`H5%$db)q#T2ev6D7^s5 zj=33GywF#S0~lWDCTOv}oFo0?NL~5+cyKh4J9Rcy>E*-mY|(Y`#rtK;-jnrX9IDst z%h#2?J$bRV+w!l<>s_t0tnCdXU1H1E+a_k`fg8mFz%X7hon4!wnw?|$5I0ia&k_kX$#DCaMz2fKp1FhXmSx@Fjekj(p~s6^IzYec%D|= zcl0x)uHZv4a0NTIr84S(Egtk=;ml^QG_Jd3dV}sAT&F1LASs-(MB+twVCxYfb&%o2 zu(E3YWYEs*l|xacI{q9P|2Q(n@=fBPz+eh5nC#vl9H+g#Sn&be0^Jbj6L(81qYb># z!5EwDHk<_c;I-!Eu!9@p!lFT{x@{6sV7%rS7OAefZ1`=u?7AfY-1u{1zB8T_)C4(^ zTPgc{sf9B1ZxD1<-E%Q_=zGYrgOZ6PQxpz~+ILd38Z$zX^xGNOZ5x~F0%pD`d41K*{V+WF@>eAXkCgv!0^KB4(scaiyO|GtRS3gbmb2OmyM2Tir&Mw^g7 zBMh0SCdYeS_{p1ZRww#;F@GY-?Or4Oz0!;F&c6%!spT-gcP$3|wt)?pAB{uX6&!@5 zbv_3Ok^JWO8e(ca;DLj+NQ6@OnZq`jX7>rZv+ruo(t9W1vU+DeI~rbTa#`g3-G@Ja zG_`M|ud31woCQ>B;3pmaT*COKXk<#I>?;L6^%SQ@cycC!c;|Hkc))bGmIcf)NF#w# za4ncCUVj ziENB*`8-`jKpW`?6EADp%A46oRkS5dah&4{m{mSWrM(f)JbVW{)A?e|V&O5Efv)HW zClEU3yU|sM)SJ#+%iVYfFjz#SVtE446$aCD`w$sq7ym!9&apkSu*o0hWJ<$bIkb10TNC`@h(r z!T#ane7A2cPaR*efcxbaaaYQ2#Cv0x+=PFn#A3~_6|YqUgr*Jfb155q9+V9<{kid2 z-_yAMrA%zXc9PrXmm|;%iI06WN0TqDl|jE{m~L%y?Tw|F&AJYgt!^`iB7yteYP!b- zJW7R6IePauK&$)B4C9U-&z}Is5rcMm&gR?5slT1n%Y+EtUyrKSZB7`GpL~iSrk^+e z7Rd#kOJI_Y&!0th9=nz#$QD@-CoS9n*S*zTep8RrFk__j-Z zV=nyHluQnh$Ped?JvVU$c@fcBwb|--M^-Zg%nD$G0I1adapGV>Iz~hNE^fna&!0ad z8XWBAP^GtxWa?VlOVv2l<6lJbPc1-ZKT=zlk#=h`fr++OhYx)Fir6+BF~J8s2diMX zO3UB?EPelKXhH2Xs*Bhow~6!aYOS?qIgN{BBKh+g{+NY7-N|OU#2oI9TFD9rT zxPg8ZfHd9{$HMZvxA7c^!Tw)j&Cwxl68u}L4BzCb&$K0g;=o=RAKNvCQJ_?g)z)ZX zQnmf6M2mjWefC06CN)s(sL+A%`f9`|;yo2%4TddCI#=;mEWQrv@Ty6KvmnOZ5VGny zZuN8_^U|q_1FUZ6N1-ag^X(AO_=@?08>~hhz*S$}sRoW(w}qCYPt|VKx`(v=Ju}=4k@s5xV6!8&Q^q2XEMF|C8tZj47YDZ&b{Ktf2l)(>WJ$kYxTbpORTW%Q7OPqHPCZ>{Apw-2LuI26HD zz*aZt7T?_--a+Q|!?)XtLJsP&DQlDst66P9JQEm82sc}b&W|OfyQ5bw7L%%o2MR6z z3HK@=(q6R{v_e)$tL4|%||UF6epFEV$c{LsLCJdSjsNGh`}p3S@f2&9F_Y=qCW%@1B7IS`a_yrZV9uGEp8FoSywl1WY2>-S)Pp!kdIwV z{ru6;;mii%k{(V{#k~J*TpsPzfZ9eOOIOkAK4?MpJELlyTP&EYvquo_^z^y%wbYJ+5jE#$t0BuwmD0lnuJ8 zMOd~oQA%q*5np2CO%@WnO;l4T{OPL?<#R!W9h(o|e3GZ&*iij>w%2Hg&UsWj{QjV^ zuXog%`RW6L(>Qt+Eq}+2|e9@S32) z6bE~tR)n{V1=nKGwks`;P=cI}a7fYQ#iQXh_<+IYIOCj@GuGV%cnsaA8N-4rF2X=_ zWdj3S37xmy*W<7ZEHqB&R*#k|wSdH6U2FdQhoQm#ps>YyQh zra(Yn5qXMgdvEoN=%~}%YEdtN4`QUKByo18#$>nDus0JJp6s^8^{5#|OJm8%Fc}{G z(tEzIQ4z`K0wpFm%tor%iJ#W@tPykWf(l1GzaB)xuErLOYQf z(l?+D3{x8I$(K|Yu-mAv=jG^me#_>H==qE8xaZm&CyD$FA3u)ASqSoweV4CL;g|FlX(NSz=t6Vmn<_(TAP@ z{OF$ZB!4YwogNYtp~D-$oM5ZCLVqqNk;oVK18 zqH;!;#biz;l1K$8GWEB^o4*Rb(9B8P|PZ8r`<0 zO6?jW$w~_b5J9N>U&nSS=a5^<_D>yr2YyJ3>~!}kuHoZfpn9GUb?T<#_(Hy?&Czs=HB;&?<>G&j zRo2uR-(%fUv&x(wY#lf)3sQeCSmuTUzsEvclK#<6XJl)ges z{EkSSiMDhplg#sL4k48#DUNsQyL^PbCpwh`^kh7NcXYJe~>x5e`cS&^KGkbsn!ryIOB}C(N72(>wQDJ{oXCT`y>{AXY99$tP{E7Y> zpiG94W6@|T=+q?Q9K%ElQ2w0NrOhFwB&MTJ;d;YXwxsi-wjMmLv zQVhbq^FiU?`+wg z(k;C$S*e!mO1T^Jgouq-B6Qv@tlGf_AP^lupi1I(y=jvxC~iV(*?BF~b566MdAg86 z@m(NLew=87kXT?PILVFPz*d|9i~t8MoU9a`;M8j54OWxVlf_Oz-6cHxoj~L~Y-`xa zhn>L2U-M*)D4Q8npBsx47PSa{V*|S+D!bG&o5>`tyb(50)?eGhdq*hyIObypXsec5 z0uR={Ks0QG3zL(Mz#8bKqbLC}88=WG?v_ZQA#sDkkNro#M1H{XH`xjWDkJ+SMd5NZ&u}LRE zPf&Fw*$T-gMJJoLF4{Y}q`aA2X!lY+)G8pAW(%h!=H~#Nc&65ZSG)B7C<3IGJmY&ze=C_)s zvc6|#=kw|rofb~T0`U874n{4gpNXsOf^FB{IZ2odo|?oGy^A0+(h0W-;ECCfi)vQp zU~cN{kViwy5&w~MGWj3-<0q%)4E&F_r@3aA4oU zxI9mKRR%V~6zAY8aoRuv$QLZ%dbks=wYcgX_Z&TwL>Vjo6$X-FV%yteRu3y*@Kr~k z8`r_xAb{&fSy$&(WT~u0B;g)Qb>QgBnTYwk3rk|-LkRw-IguIclbjlE9g^;1V z`Ds+U#)795km|qbE{x^*|&i`)h!zF2CjqAcUa=Hu+cP%t@^k z1tK@U_yk70Z^^w-f)% zn(a}n&tp_{ex6%{zC35Hjf6~4y(&bGhR#7>LO z@#O0I(&<05FXHXj(ZXPkzZl<%&q$eIq~EW(5+8|K zr%sf`k~eKhO^$}59;3x|a0_SmO`0o5ftn)&LuIsT+gUzjQw^s!ria@IoLLjantcbl zsbXNK>F2G?TtXiXob?jY#B+UU(MSu0ox_6kEqpf{z;OiL>oOd(mB>IB8m)zku*mM* zfg8l#z9a!+S7-6AvPaTnH(bZC;=`J)=K@~jaX`ecelQ>Q7Y_*!MN2*UF1?&j#P3hs z?M}J8|2u8}XG_J(#l`ub)fM}H>OKE0tw@4Vr3IvD**R};pyYm38U~DQ$(6@K0sB~9 zPml|c%j33ImP|g{?068Nq++R($@*(-*1oU{zGDFGi1DUvud=p?8@;S;S?1}#yNfZ2 zi}^MSCLKiQe_g&{FXa_JOFD`DZfQJHFBe$do|-g{6oCw>k1E2li(}>NV|JZ;W^45G z?gZ4gUdX;z`QCk9SLW~?pW`D?U5HG~XQwCKhHkE!e-2P$?VqDgf*iWX8v~WpHbyWv4{+mSOp(so z6_PyUVz?$LT`fLu5^@(cBZwVQn80D*4S*g}QcoL^Q3!JINf9@zLMzA0J~6G+07_iJ zF&QW8OD#8&jFox7o_R~aL`iXfR~#keG3&B$b;42~aukJ&jUFD^0@CH@%)75%Z3QS1 z%g0Ai`Ue3)P6Ms_65KXF74ABZj06Y&arFvd386!U>glIB1SRV|WZKk9%;YAnT}4W(Hn%8aipBpE;3(*@ECXJyPGKppJFG z^3Jh74^F~sDONTjg@3l_@gFb6-oPx0*A8^)7Y9`{iN`qVRJuxu>*#lb8V20Wf|fe( zlDH^T>PWVxofxCUb1Zbw$uQk-Zr2|Y6ulfP1s4$!xbHTn2xA{78;NuSooBT^(*AvV zqHYr3Y+g5g(=$DNuHr^Dub&M_hf?bV(rBTzwZi&^g7z{cB67F8H7s_J%C|w>XiWai(^Z^KUzHQ+XX-y|x&nm%K8ofXFZ5ZV1=M*Mv>)gkkUsFxj z2C0SFy9ZJUt9*+kN&ksQ-&G;f7O{I^F@7svF|i6Na5pEJhvusFHIslMW7rb`!dz2B z04;pa7p?Tg_m`^G6A8D~BIK#BoHXL6z#sg5+}V!G!_`8ds&8N-h6o5#UQI~1Eeuu) z>-nvl6{#rC!2C|-0>WRJNs2RGJ9dtYiMk_5deJ-_)m}z*JhCjRkruMNAJz_fKy+U| zd>(z}wC$!zNI%Ia!>gdXv9tV}k+aq7G3SKw5dtGsN{w&qnxFuKT`*NC|7sYbg08|d z9~#O9v~Z4YhKM8v-eQy%4lm67lT${FTvJb=)^ZMnW%b|*hiV5twEY7!hkj0>b zXy~{rj!*xCP#qi?&!sWXa!h`fLoRLFS{2%2+L_-?cIs)N9tR-R&!fVVQqsP)e|FY5 zVR~PZlvu>nxs$M&iB(4k8kGykEYr3l6SsDsE^d$d2khi)I3zda%s_0A`53X_ri$s$AV|m5R(5Bad zIiwN@-EV8`fCJDXw6JM^ggg)OSGmk5o%CFgG(>4UHy0m2VYIXXT}BNE1(O`Qv82p` zWF9uS)VhjaOmQfv{K~+nsK#B5UjPdgEh-%(a8TC*j%&)*`Y@l8=ZfTS88ER;@AZ zkz0W6=!n$b&He}uYvcxmJL<3CL|9m7{o{bhp;qO12PRcoIU3RSk zGUE}RHp50uDL+}UJu9P&wwpMr(7nElA0Ev1U?`m0dfHTO@=MO#?kY8VRNeB7p9s<{ z#UIw7psm6u&8E{NgwPd=cv@{|e?NhE!*1F*eXp!U=rjw3+V}U{Z6O3;(Fx__|3;5T zYy@1nucYeCBkrIzCbTkGL~dsO(1dS5t`1c_+6Qo0kPt(5u8K0Mxe36eLo;G9u@%~9-MG<2ne3)dcfy)d zEB(yOCRSerg|mPZn%sa&@VjG9+BL8Cb&|$BrQV!}F2#*TV2l#Sa<*C@(r9SMa&)gx z`vuhgfMi0Zawj1g;(#%8v#})68;SrlH=GVzkm-A;HFu}7X^?|pYh~JL*7esCy60&! z9aHS=XuuQFvHx(9r432(W{s3d>J?Dr%$1Uz=bf6C`WUIg`AkaLfYkGPBQ{_{%lQM zv44&EzP;b?Pk-&*pR_7GxGIo`;c28Eug9ru?r!}|@j@TVko(l=KNi&FF35+KR^fMDDIIb5-4n7w# zf8MNzE*oS)q(96W=n5e2DP1bxt}q~7+EzJS=%~F5AZ1S!I^Sgacn@&w4VM=a48Dmx}{c#4Q1yXNhv)KT&z4 z$TvB-FoJ>fXG#B+GIyV?_q^EqlskLA-;SrQ-fj40feXOn{gG0A5hjZpsoa>N zKb3okd_(}Q%20$+yOp#z)c<3+t-odeXL~a}XOA*AqUWjGxn8|NLQ(ddw_&=ata_FH zr{&G>QoxAow2>1*sLTc+gE(^m>Wfhn2n6yf{JStgG?u8|mnEB|LNO(g+G~2z4vb(lX4a&S7KU(lD4*w>e5kx3TrJ|aL~)r zPXv2f7_vpdjx#Qtjal$}Y2ba;b2C##o&)bIy~Rs#Lw!#3>YNpX;9z-bm=g(JydLa! z5*ya8&_!2hYD_-BZm~~PD)b+gpXQw2$A)*ADwr*>FT!VbBX-Z6Hp4PA4Ud1v=61eO z^<`=?Gl(HNr7AzO)Bbphx5%j%jBu8@ZGX7F{&PYU<^WwQh-V#(jm!|xOOph@E;4Sp z=E(g}-!r0hBal~&0mKP40z!3SG%sx)qcaoSTGYujZ|w@et+oCuL`$Xw(~*6Yk6H06 zk*A8y`A!cncQJ4;%`7TeI6 zRor~3rII0c2U8(qx#p@f99v+e@ddyM}ae(nN?U?wzk$;2*F(%}pGPYlrxj?8aRG{^9mkXNL0@&P!R;6B>*M zQPYDws2o#W4pR&%;XGt^?GDlRU>U! z81{4_(Gw|J5?|SJpE#{$Y;8k=xHKqiim`Rap!Nr_jbN&ZH&`$z%#bNVG0R3wsS`q^ zoRwxZas_$# z)3gJ~__4b%Fr$8>G&0NgMB^%RnjD>0NW|N^Q#%NhGDdlPbgEn^7at*&?{GJ=5iut& zP%LU$iQ<_tst#0?=bgxI4kSBFzwRSyal@h+)6_Gz{m zH_ef18$p>3>v+!2846LWx)y3wF)B=OHQi@3?hds$Q3eq4K~aU2O$wWZQ0Ey=4Fxoi zq)gOe&f?4AmK6}Ze?(jdX+bb|k(xj}2^Pnx@?D;hs6Qd++E|02PAUuAxFKnVxb6a! zKS&(hs&q0htoGY@Fk0EqSVSBT5m6_(20SgX5#L2MwRa49x;i{!H~{T!Z^m25HqVhb zr4C${`M~;wh@_K*FMPYB4+M+HTI%LCv(H+f6E>$_N$q8Jz+ZG0yw+1ymIDcgqT772boR2GU@hkw{6K^&= zv2GjR*_JUjeH`h*1CjYp5RIWzQjFI{FOdDjd%nCf&uhUJ`Nlp2^~+2j$yR5hWL@oH z&vu!d=1P;_W&W$>X+32-zxN1*ho}^E6Yz4s5_0XlGcLC8nWl{pJ+7`ng!#Xb==4v^ z;haxWu#k4ZW^=&d=0n$Pg^M|yjwc;WtwK&s zJAUEGJ6iilIFpNQAkh@mB;^mbulHmi7y!oLFaorkkvE;m>spb_O z8SiKJIsvkOye`CARhzh$V>TIh1B#S<`ByEXj-eUEb+&CLz{Gr|c%_CYZ<#7!Ca`@bx5xSE4aY~aWgzbE@ynm*{ zqWC8P9(b-4GfQD>@FiCo5{_6%p?c$wfpJyqc5b@w{Zq0D9WVD*o|Yl0D4P&dZ-(DZ zX=1!kWkg3f-@_^5D){a(aw)x3=rQHyLD#x@<-Zk-(%qLcC&os#5g6ux=nx!=)9C%W zy}Y~Iw4(J6`Xe-}=;$+O=NG$C$G-e5HC_+^%*(uw_Ac>Z2V6w@DnB%Tc{dPyTQ@vD z`bUr{iyul{SE|o^3y_Di*QUEN8GE|h+YAi4x_P=S9Ux86apV8sXcs`{5c@C2TWFhC znQBx^VmKl?|J3u-yq29k@!^SmSwk8#Ar0|}qJ6+H(+?fR`$UfUe+jIFRj);ZoJ-OG zHZ1fX99!3yNi|6?-rZxzSJ*WG}o5)=T2-$vlbHY}yx!VtDa5BWo$h_c}XOMAR# zp0Us3^aUVUF?htxP)w9vJBQ6#hsY8AM?l`u0z7R}36%uCcyT_HptUnO2J!4vw3$xH z1QLhz9Q5Co)Va*w83U_$K}0d?0PH}&=G>4AMlNqfl!iR>zKn_)2HNO^pjo#+|MxQ4xfG8H5DQ$eN3MHCKrgd{_{ye_p7oRug584>A zZx|Pt0IMJ0X`BGUlJ*!`=&?~r{%EP6l!I7BqfICp&@tCtCyht8abN_dtHygxic-qj zm_FJi6zO_>vU&pn1z+@t{jq<=WBG(eDNm1*F4-wx#!vf9$M%K05O(4RfGL~Ml!xo= zu)#{n@YH437zfftD6}FTNyioI>8&1@Y4ajZ#{m=U#M91o>>I&q7WqYRqp7QBBSld( zQk3x6%{0^S%g3=u!x1KAa}I4OUIp35+m*Xlr!dbI$DcEFV&*r)v|&#Mqr}tRJJ?7M z;R^yIp!56M>2Bod&BXBw@P6#W{B!X1Ira2u0j3H#4H{x~@8uKmtafP*YFBn|)G=z4 zx_mgEG)cmVkjZ5!1X|W00YKN#Df;^b#IzIg zV8ZT}B#9>#@-50q9WI9Qp`ZM<%9Uu1GM|cOPTcPkg9zk`XO#&G$hr7fEaZ+Gl4<0b z>aS#u?T)|Ob3m0?LM-@G@OMs>Lc;Hr8KGh&z|AcUy^*Thz|PtHW;#slIx}@I3kJ%dxltrD^a6akKg6)uzO|4EKdhWt9F=Gh?}Ef` z^&))E$*2u!q+7^Vw4%d?UER=RI{V2FHuVC>V=l4+_>bHHphWUQ(TVyKXHDWao3GHgk=RzQrD0VE`5j1OBg@M4C-d}(& z+)08^=n58F0O}NJkgyfRAkZ^9V13tpx)Fnr>~MN7BT%9dcyYimi1fAEX)P1tJy;9H z&oYb+Ppvd$S_S+tUfAQtNqIBwsyM#N%Ba4!Yi6B#S=E%nSxm!9w(+>#4v&h_B4#XR ziyxFKzTjxHPKqE~#)pyqj`!QK{0yk7tzwZg^bEPQr)ABY_HNLR2>xK0-C z#cl^MHe1Jf%%=)JK&1&-GiL{PE%1a%uL?0VKGEbau4|)hHhohwKD`Ge`6H{8oJrjb zS*h2j;i#!0Uo}LhJ>Wm!Bbx$uKRD?trF}CH9S+2ixBMZ48t11{ZzkIJX^#j*mnPjh ziZLkKyFIF01bWBG=j>x22wxMCgl$vxqD=}&F$dSvzR&=TWJP`}Up65n>3m4y!N*=1 zlVzn6+C|Y`v024gFcwn7cS$|(6(Z~8SBY@_sj3mXGukAlaj*Ym9)9IxXY6Tkl#Nq*{V`N4V8kqrt zv?q&V%UK-LCLC`f{bOp%xtGbNxyk z55ta5D>iSK^N!ug@!?RigA(z?QZoYlA&9FbJ}mid-}v_s*V%@iO*Bt zFE)SlcDphAzC}a_jK(oo(umA9L2yQIAY0T#HRBy3T8t_Gw!)I zsN`ZprQ&dN82>rqEF?%tdI9~Tr>bNg3hC3o48L%a1XMXNIbkzT>9@l>%oa{<<#*g9 zuVM)zF<~rkYpr@Ed{_p}7S;_oN3gB44NKWeI7YSPuPSzwEErL5X}cnYXB)8E#TaRE z*wlVa(l>YH|9Rg3gxBd2=zVvb1EJvoKfYyx{gAVg`G{c}+H$bsVKzFf172UdahpAu zwJ|)?NYCvlJ|&o4c?qf!N&o6ox<=!yREBcW3lLj9DfD8_J&r)k-W&n!^^&g5ZGljC zZ+GF`lo)Pu?rcY#6VPY+W~Mv|ZvRZb2`|b-cPGER5YgiaZMAWI$D$*q{mbt*E&wE* zI4sVGi`HZ0!NLAla8pmmCw{MrUWjyfL^eU+UaszWbvXjaZfPb%S0nlbl$9kle*g00 z5YDMf!;rR#?WjZ2e}${9KA#!xQNFC^0prCXJlpQ(%N_2~DV*t0(tU2 z%+~E9CwF8A#j1V2J{(uVe`(euIpVs{U1pkaM`!B((NML1kur?+z zkXmi__zF(*zi{|L?T3Rif8l-`+Sl&yUZ022miobm{-kc~#&K%q_0XM$Wj&=BOa=x* zhDa5vfN=sgs@P(*62Uk}s@8sdzG%8U@8A)8KWiC#zGf`<^76i(o~nKL5e;%W4D3%h zcMR{iqPS8;x6f^!<(sRn%|0T$P|W+M?rErtf}xq|PJ0R@nfZ-8>Z3FK;v1+G+t!=b z@hjzTXO|znuq3m|eBM>yAfY`qB*+(`lJu?~t}p@id1x?^^H#6X1U~PH^?T~mg(PvF zNGyLaKAWxw{Cbb}?t9j^#%^o)ViZ^#@F(t)Fy3cMHt6Gmx9Bw>Rh&+R`YX??6rTGx z_R!?U=+;J&9E;@{6@>-YF~dfkY==u7KOBofwtrCu{rRoa4wI=ryE6eKu}JCGLK9hz z#N_}WNRipB>h=5Biqf1h^h^z)9+A*qsR|8SvO#C4JlYsEsBJmk)ks*Yp`?ll9yKlc z{20FFVy?y6v1(tnB4y0vn+Xf~ZGZJ9xlzYO<2gOW!AP)Py1vP7x3%+|pS{sV>o()1 zbnSUKjj>xa4KbT5B9Sb1YT;t!i1^X5!P)_kp}8ZbY&L`AL{Z4+T>t*s@^jbM@Qs5b@io9{?$=sq1AJuLc(g-Sa92%NBFR&&O{ z_wD{ID(hs&m-o<(n?FIelnuwF*E%p~DSJdY6$>ey{i*nCP}V(;maJ2%L(*(Fy)Ig-pRL`>@8lHodd?X>9_?CZ>MW@uvtf z;+btoQD+P)h1Y1f&;_rKeqNf5u9F4G!{rn|Xy6Q!pp#l>NbE%Lca-(_zcV%V4{9af z{W1x+u5r{!JHy&=z0wz5`R+MS2@tJzP=0mYa{F>s0-vyGO_D8<+5+FOArIl_g13gxL|;H-gssUH0X*As-Xeg;$|{rD1kXZ9z6ltl1Z_=0Soq5fVT&9!XN3{|_kTHHu*&9==X?y{Kg$GPwmMh_%LPVSxNR%z4IR+aB1w8mKit&(E#Q0FTi3UB+ zdDU?ZJ%=NA*LfbE@GL}%-5b`WjvVXW*ks!4awA!UqV6?7qpr<2mZ&&71*|Z3KyM^) zAj7s~TFx0`&iwC(+9_y51TK-o;ID17+rY_CRF6EldHLbb*}DP%{2ofb)Lpl}drJJt zK?E-s%1Iy6qm6x_J#}1#zhVw-+z_t@^g82ds^(y}!`a^i^=YJsEXvhY#@j)o1RHR~A1nXNxy9G&os_P2%^A~4G zPt!~m954DS9b5;X@wE2?@OJhexHhh_IV<$XL!)_#@eB=g`qDf4FR%JQF^!z6t~m24 zgbF-B;fd;T(|sD&im@iq3g-Gnx-Auc_vm~#B}lec2rk?bDkA`;@DG?2?LM6OG0E=F zF8K>yf)^%y)7oSsLueGMqF2|K^0X~NH){@@7|N4}R3iaQuL#Os6#?Sip%vbL_FkVj zbz0va>1KdqLcW6<4_S2i_k3# zlJ0zX=ci^QBfa9WmjJ0bT^lS6|FPbQ#mXYrB@gWONdM)irp=iI13!{TyQ2(kmEgDx zI#laW()=5cDIccOR@LI<%)_cmp=7!i1|fd{owTNd{9{WhZ$t zt%CAql;YMR2jK!PT1M2$eHvN1@ipWq3`(^J1^Wwtd805oC9G0*SP)FARkB{1cCmuL zLKk9RM`yPli5TNE6dX8P3n&f0Pa!ne%l%Z#$)6`pXIcwOZ_$h1!t;*!ZI02I&8fEC zTqW?W#q5kD7xI<05)I<%^R042RXj^b5XEk>t)SQ&7wvH+JZ+u^@juXf;mqiOl6BA0 z@PR%6dF4IRe*Wv*hOs09%r;~9tB~aWaYOG{Cn27_lX2`v=gu3oQ7+sOB{IS7*S2?m zT?jx9o}$n!Sq8If!c(m{yI#UO1rdJhN2(;5epEOUrZ@AthCaOq1 z%FSRsuXgk9gP)x#>R>4E-HNxRZSUP`qV=hO!qd*I8Ynh7MMA1vwAF-pnEzyb79|Rx z^~h{V4Y@55<|Ok|qEBnMKx?Qtn+L_1FYu^Hfw*TXFl0@xxScjToP zPC{T7BF3>UsN~>dtC5(Wg~e7Yu2%!P`J`cIS*w6xY?x}E;IOkWDady?4VHy|qK{ec znCiLhGR?)Cubj8C-^jzeO#AQUa75UE1^#vRX07FyN`Ja)VhNn-7Q%-m>Ls>qRrvDt<{2w&z}jlc2=r;+G{v%NVx7lwAcopK(q|qoVTXg@*u`#Z4w% zd380Nb5+aoX3bU;wS_##J@?UOT*E8I6dLsi)>F^-L<)~5nvW4G()XmgGfHg!_Q~!( zQ>h@U3`|mlvs_s*6-u~Rn!=2SI$kb_wFW$13%&Jn{Tckw#*=T;Pf= zWJBZ7qc?&E_Du?>w91u<5>>-V3P8Hr3F}AH7OH`JtsfmTL>9bK9N8dv1~da$n2FFF z!+O)#wDE=`n9NR|8*yLJeK{SYO0n>6U708>X3aTu77?VTQOwx1cAf!K4SUY$^5pDg zcUsuviupl?H*!Qk*sPe;m_2c$UC;Aw#4AO#;IZYFJ=;>lUY>-r z;)LkgLanPL$Bh8OiVc0K;!rWK8W*lmx#CLQ#+uyZljoC28!h5jp zkuJjr6dP|20rhoxbuK7J9#|!0$O|jj;Dn7~7Z&46DOf?s7tPHg2soCtPmtP+SnjTj zMZ4{ltS(i8CZiIB-tyql5)4mNn|1m`Wp_!y=vPl!ozwsfF<3fNVbH=VD1GekOCObM zM`Gk7HwE^07OVSqhgU?) z**7JgSOMtKjB%;7_uhe8w{L!Fw`!nR33sh^g5ZFti|vcJ<{tJJ7N8KCW^ABBu4)dX zOfi$u4>-V^nIvh9Z2`8tyK7!)E{Oi$^ zwV6F4ea^9L1VXudeqUGGJ!k9kVbO|n&w2>g%u2siV!X7~x!IftO#WDZI6NdIpP#U! z#hLG5@t(7>CTQEl=2Gq?vy!NM!`7LGs;vsg8v~dP6CaqqkB}g{4wC%x9Jsq*a+Nl; zg?SkxZJp(4$n*cwa}AFH?yssa0zRl5mgu0i9#y^NwZIO1_d#Mjy(`ia?}tZb(UFl` zh;gV~&H`43Jtufr%+r?dZ4*=TzrI1(2r15VT2oGQFYC#SPI}o?x|%t-cjVvaJfm~b7^BSY1uhz8QYmg zNRwme5TGOGOY=XzLVl3j4s&HFzispN1;%8fDje`5_)_M{exrI@@l6gsQ5lIGMtq|x zxRHL->SlHKrVvrT4@TnY6fT`V)(ihlVKal)O)22Jsyb2uz4t0x6Q2f!ylC2?MFRka zqgi;`6$E0Ev>x5RWvDgU7Z*U3jh`w1iH(Qn&y!obvvGNs;Xra zEG~58+>tYaEly5}V(^iX7F*?{!NT%RHcZG=(MKG7i*ykgrJPhgxmP!&GHLzM zoP*O#EIg9EVb8Y3!KNCBKy4;~l;OZcgRC&}4PuJa5L4L@LfsWxfkhB&esNdJ^&Xrd z{=CkWLRLQ0*1(M!`6wB(AdTV30xIp9`6+70sIyP1?t9t$nUllURw-%VVeK^DUpX-J!W>{5Bc@q{i9hA3vQg zzg|5?i;1KCtEpeyhP^qxx|5Jc;+w-C`viYDD~&mJTn{mL}AOF$K*MRuUy+CM|^R0OdAcd5h;VmQ}}>NyHE+} z`z7ucx$pgx^XttKb|suAYsTYCJDM18TfivZg>PK^^na5xT$=)iSgkxe6Es| z4G|LmtU@i2)R-B7VF)4-IZpA=Tsa8wg}2I)CC2II-Ol0MXPMLTZzk>w!7=L zcHX!60DBlRUO|6Z=7-Wo+e=!@cscWqeLXTRZxifD!yi+{_%SUkTf~pQ!u|~OhzV3| zdr2P00;CU6JWva(;}KnA^~>rZ^(xqLrB(vV9T-2tzHG&2T#zv7FcD|F7czU-*;4O1 z$+G-N?O8!|)GpwKzC-y%F2&#i4QA1566lf3_Ygz`3mo+z0kd?_M2UP3&r%uJfh+nT zvB9-jrma1UoY-oxtfW|3=Il>sM0X}UfX0Sg_iznB_#pEJ_8}V*%F(4)9j!thpp>4J z$J#P2=D}(r+<^~d<%!s%DfU6r1HW8KHd^mBg=}JjXWJxbJn17QhBDK$I1@WV$M*M! zd&RMD01;wUBSf>BbnL9UN)DZUm3p;z8ihrh9`V(eI!C6E+A#d5q2;j%$TtDWDN(X- z^vebSNvFiprSRPnsTv#GY|y(za&7vD|6+CEH>>-Tp0Is0|S+IKWINm9k* zR=Mu8N^f-YDTX5!4v@qMG5z^ddkm_7_+tKe=+juF%-h?JtxBAPrwir2guY&S1@uV2 z&S@-CQq^v5H2!M5yt1qj_K;OIQ6-GAx+Vp*@& zT!{sF@I3bVj*J+5UGhT{26?WNAe=^CCtTyGXPg zJ{0`bP~k+(USc@t-NlL9b&@ImsQ1(noU<==M*XSuqHdbFHhiuiU()WCqp8rr?e;5dd{9v5UN=kF%4!88_#Q;Pj zYM{gOg&BMe+6;wEjH$nxqTtm@e9_V4eSym@O;+m|a)W-qsqTCVPgM_DL)Sn})ZGir zq*SSgNT;&r-C7EyNSRi>>;UQZZ-Y&M@wnkRl?T?R8Q7(zL#8vH8pN|xt%JS=2wvGSn7&XO)A1Pt*G2J=(<*v?h<2pdOhS& za}ti) z$WUYuOMm#;<^xZ(u{E`URmDOO)Kk(J%T!;T%1iRedeWiS*P|K^)UFvD@#UOEoP|nx zogm}|?XGM+>!wJk-%{WZaYJ^QE?q<$3*weL>(c{`Ie#%YW{;VjVov~zt=sVhs^vQt zu$(A=GAEWLqq=}SrDcn&qqD;S{vF;1K4v<-{~)PyhRb}NK;GnurtgS-UI=3z+|H~a*oB*9mYV`BS{u!Z8PmaD{mn~E!DB1qkwKG+0$lDMXW9-w|82M*@(F41uNIBKz5%Xo^*ax0?+FoCHN}y=`ZPu<{}ls{klq zfN`GjEMd2WYSlSn&!Mel7}jC|jAwQVZhv^rayq+w9@bjxH?&R_xuB>WTjz($B?@sL zhWi}PxMy_SXMJ0|sb_+jErvR1zcR4`QZ2WdT;S|wjoo(-DCG|d<4%D^#EA%O=k)2u zFg?T84fm)^Q~F#AVd-UJhze9<^K}NfR%&aDRqDKn~uODuV--Gh=xfTM>k42=ap$=L#{X1aK7-~Q% z=VTNjYM8F09NMjE98EGHZn_5_Ez54B;TXR15p0)Z8-v4@NcFRuS3rTWMJmkWrZN)51Im&B5Ec*h7P6Rr>? zaI$!^$?xZlTc;)!`kkTD##0l;b2nN~ zt3LFyT&A9WROa@dw?ZWilQwT~8P`*2W8cw&^ueSmpyO^@_CoJ4M!FAD%ICW*s0!WT zc96G2z7OzH{0>RVmD$N%scmR1mE@03bVgq$j+*He zW!O$k#dl zG*i7|yxQ@;e4BbgZaVL*iIv(y77W~J(^V^k?*%N53AZvTN-&tX%Aagf>llDM+1!@h zGCR|;hi~h!hSpWC>RUhM_^%YgpwqBItywc9!t7T% zN<(3+tlfVq1CnUnDOMth1J(d=3k=yYcB+_sXpP2CG?G~=Fql3EyX6u|i%`92{E)(k z&x44}$1tV4(L^*)+%Sl^oZU)Mu=n-55P)fK=^L?>+_{3Fo>KzY*bS$B6lh-YD=Plt z+VG-+c!VOAv)jOT5JT_;=z`lAzn?&IUrS^`^-V8`fLnwucM}B2RXhV*qCO$Ne%wAq z|ASNH3hpR&o)yUO@E_>2#g}^=9kS zDImr$1 z8riD0V>EW}iYg!!$b>I5Qy`ZQ1&Tz8vkU1_Z##7?UYX z+{g#K)6UfD!0&`KeL8X|1ZPsBuSC{kvsMYx+Hi#6x`SJ*nIx4S8RXw26oiMwPlsEe zH!JjKZc_cU-Jm3RPcS|?)lfU1b2wFAN$#E_%l{!hBpS6@K9%>Ku-F`o6)w{n1OZ1( zbN5uA$xBrlY+Rq{^vXuKHwl zuLq!1X;{&be#a)qUjtAS?(KW8EM{QL$s=gyUF6L@r6y#YqfdVc4pe-%|L!%K%lY)< zh5r;{;MxT?)*JfMiX--mC%wzhbS&kw=BPnltoMY6W=rIp4uo-*z^kn?ejlz@pm6PA zTz755u|B{(Ird_nb;APVpmT8T&J(o>+klIpBg z47sUZ2qSO{#{+1_Tv$}jCX557{pQQGB0PYjLEI+E4x%pw?;|Y(`At(8Rg7`2|PI; z3S+s8RUMEEW#*NnK@hv9?wBpMJ5c(0wKbh;woZS=2tZ75eT!S-?T<` zpHD1=#)twJBIG-AZpxy>Qb-bBCJkc-l9cW&jG9?> zG3-I)eCxAEE-56UIPJDa$oYm|I?C~hf0itodh?W$cnJVrrJg$?pa0YU(lslr2QPR?F3vwSj;%hnZ4t&JqgZWf>**WB7WR{W zwB0@}wrT^?H0x@KWqK5SZk_+=Sqa8_{dhDKdKkSYeBslr#==IQT?X}H(bSE($V`vc zH-+(kW*^wn5!H-B50&*h347)CW zQ|v1X^f~e=OI!ulaTGuo(^ApIY_VDW0oB7mIHC>^#A-}JjfkAeloJ8z0yn3lEm&fG zk(;v8stLk?;D*tnGcTaUNd~7_T3ZsJkrUBsjQ^V57~t#jGH2A2l#!1+Z|ldS(N8&U zI$Q2cZ~dsjw^q9=_T?CnLPVO~Z_;z}8O3+GV~(|01P)f3t*kl6j(%ZpS$FOsT$`TA zg82rJ;v*Gn%$$TAc!KYo?w-S$%w@)4b0*Fir#Y7fdk_&%u+#Bz33@|Iy(!|uR~8dT zUN&RYc(!?WWZ`aGnt~^atGL{(F*^74qWa`Ie5fVCi;azB2iN&CyiNR$x?Gg z!c8!10JtdvD~mRnkw3DqLnD<$I`&eDI8TvjAsk?Ft9KjaA z@&w|7@@w$+G~@%Kz~hm~{(0RRE67juR~6xs1iCZnl4qp!W&Ggf0;PtULI69Oqq zxO-e&<$lFLu>nXHzdMl9mzV4!9UUoQkaT`l5~sDpiXM`dfq zYRXtB!DfEaUS5K=l+=^?_`ZJxdP`W__W7Kee0coR-Y$G@-vyYq3(Wl@0Ko2-#mjA- z?Hk#zFta0kKlAC8HFodbQ0a)a_E_c?j@|}hw@mz9YMAEqHnwh?GqHFDy|*^F7st8q z0U!6y(@Bg-`?nf<}Z*rgn_Wf&4$?f4B&Kf+`;9{u=bp#uXOB>W*g*hegF#fw z>Na@h1`Qb7vABN+N@u!`_&J|p&O4_6A9#GdCjI}$3@o1?9Zam@xLE$p7Gq;(XZz1X zWUl|z6aVjr$Xpzs6fz1>Euf!hyhFYt=Uvz~cF^*y+S8tg>R_Gthp1YTwKqe*$`HS)7TIx{z8H zCl39u3dFEiyL~E4?xeRPmvLJ`G|KN_qGZYzZ8%*5fdLu)@Ga%_UFz*q%lYOWg*8@+ zsoRnHgfT|6Sd}AZaMMzrH^qekZJF^E=S(^xkPDO8zB^b?Zj5`DlP!9L$bx#Mts-S<2^& zq7|CyHnfWvL6v!Q-sjdH3p+Z|5CvwvL_Jr1X-NsL53pF}<3WAC*@17jw@VJ& z!&uOlw#zgVZ8-C7x;p@ZZT57~eq-6j+fZ7bxu{@&y6XA&>3Ve5{^zrnW1e6>qBt?b zFRsgu8CE*%PdSQUw~Qx0+YGSGNT{tef|O3tCt=-&X~Y>wNw}+ax;YC zkp%xwGtZC8S->Ny16NT#6zl`Aovq}(UDqxvaVV1idv&{u*^g4#;-IjGFO#+}r#F0b z$@Ie_1g?}a-ELU%0dimD!*BT4kz1?UGjI1k0;8OM!WgiZZ$_Z1z2oF>rC<&WS7S>J zhYNf;qwv4^nTwk=vYf9cl_vqQN^*3anP$f!OBmU}6#{sJQ1F}VY}2yC^L~jY((NQj z+Zpfu6fz;MEiY?OSgJ2iic!aR&s3p3S&n5{v{n2{XCptot4F1fwHeUuUq=6xFB2r- ztkMz2ZbAU|{-jSfdqZ9hYN+!76=oC4 z;4tlx2`1pT8A*5U>;fXwN}(xxRZwKZ%)A~`@PIOavvD0RVasw#tB%czXIB1KaaE4+qOuuwQlXWgw|6Z4RB$a}a|MKhVc0Kww?Gq0u7qkb413@(0K7|?` z&j-%e>ocE1joX)pPo2j3r%q$$%^hOZ$WkJ=j{5w&msg0ac17krtjklc ztQZ{L)6e6+ma(V>`X?5TUOf0kE2qjtXy#^3B7J2=e{hYl?qKFHK@vf=GZ3B^J7j{J zXJnwq<>vbM7k{k;_=5jL_M=Ei1N5o-nP&^;u&dRmIdc`R9``OD zfCOT})P`(VW(Qf{@t^RG*|j(T^UQDnuHjSXb}ka1Y7DhA9kF9O#2CgdO`6hvccN>t z!<|9&;~lu~ON3AxtTE6f5?#_ZoxCQ^&0RhVk7nqyKgCZge1Xg-)sMP=@jxglJ-BQ| zkPPy|H#3N_@#2e8tWUF){hI3RMzA?cp_E!tf_n1zS-BpVa)^3$wXo(GrT~D@D6i$| z^TA&=h5*%nt1*r%39)e@qdn8 zN)5{oI54mxzJzXq{>f-&VHfl~ZFKbG7xN*%sUp7bp|APXFNtX$Uy6cxdytl^Dkq3K zbH-RJ*b##|@EpLrnQL`RXa*IPXk)H z+lNm%1`LDTIcLo#gV?7WW1Wkv=C55!EXm%vjJkkv8-DPoSqd^OI#7CLazy6mw-ifR zHmdN%1vpgsN&O*r9pj%^&kZa4_hMVkM>Vw9P!F`tHvm}Ujq^i7uhNSLVsdSST}f6) zOZF&BkEQkF3^jiq!!-591Da2>l!pK+8R>-(l^qoL!JG!uBiW`SD38g8H7DX?JN7KpJML}}K z&IEYoYi3_g-~7KRWP8g8z?2qRfdDdnr(>DD8v@amGVno`;19fr7AZ(B(`^|tJoVK- zg&B%g;v!Nkhv_-g5!A<2!UZH>prd=E?n}|M@_U$HL}vE|L9g!eT6nu_FImnY|42he zpf$tOBcmmNx~bEe_=h+tMDm8O@bobawkTf~PedmOt) zim>EluhxD9c33{E-Cxlaa2N%KY>MQP^VgqkNw#3dhSI@4vzp;6Fpo=I>mQfz zVwWEq+qNHf7ekv|~~62x=`>8%w&c zt(hBr3kr#MROt(v2yPVzNCpi;FrN(UmUjEVmt%c;lO7hHQ=s`F3#&ETp{UgnY^}Ox=uX8sWI^)wbNm zb3?h#&m1WFX1A~JzTD9)w}EZ*M3Cj-{$f7Sk89b|d6)$g{|4?el&Yk~{9Ec*xv?ss zj>_W{X>urW?8QCV{suiAG`s;lrXu$EP2Ks{PVkiZ_QbOqt@17tX#kW8+5e4A^+FOe*%HAvHU#? z^{-2T7fx8fd22&3HV)t~TXeMl>g3-6**O1p4*amg1m$YNv{wWJ!UrMza{(vw-vL7X z6@;t60SmtW6NZZOFAVrUM){ArmgnzTDz3kpl>Z~r zKbeXD*_Mm#Z(B^RzYLcDvn^1~k&EzO!(;u|s967X#P+YqpSM=-NXp3Z57h;Z^Dn4T zf#dwwq;dXhcDVjE9r`4nQ|@N(O2WbcTyo??=l)lm&!zbHEU|C_0nUA3a3%&GI-!BG{B8et&H>I+K!0ZhST-IwwtxEkcWX9a zlrzR>Q&cSWzn%R*g96=M$bfjx_`nGlX&~_+0x;5XNWk$s1Wc9x zXN%9cSpO`;{}t=M?um=@Uw6U-RPts7<7NW}coY16%k|a+V`TxNyK;fD0+rnGfab2_ zP%6r*igIE=Hn%mP0{{VxgBghJZVArC$_fl{ulak(;DH0i&Hk?#?4L12fn^?qFkFA# ztBhSNfg>J_P?E};+B&jL&mNedz60B^$2*Boy#AeT1|@YNdw zN=a2tU0w!=>C*_5@KOxwwF&gX~QrL1EDUxucoL5n$XF3@|;)6x1GgAH@o8Wp56oh}H%2 zSBj!>{quGC9|5@k1^{qzaB~X^y0|)<8{5HoX6JZ%>8Y-CKE#pwIOy77;wkh~uKlpK zA*@obavR2_IuH?2KJY>!C5258ZcG9pg@8$5o@ImiEl%i2WSukDs=~MSEBi-lna$!z z$D=O3kA2_e)@>KSSLi8tX3Yn2_O<)-Ct8eKo{XE|JH~88Iv}Aq^umcH-1O&R8!k2y zn+@76tp_~o8!5i(HO@Q+nEbCG8YK0m0|Xvcn#EuDX~rk)gMmZZ9aCjyy=h&uy6{-t zO+1W(0xV?o{9X@@6mn^^NMG~b565j+5{e`0SARPE7E%!_-2H7TY65%|ABHF+pUKto zX!ViSlD+#i`~i3c0A?OOxP(Mda`8?5xJI7s;vPK|R+HK}taNW4k_jvL7LhKKAi7G3 ze=-PkQkgj%_0~H+!o*9@QrB5t;^d`N8R)*hyxIt+bA8l+yz@b0TVq2q7$h~QQRz|w z(wclne41c?bC@tSWP0YTN_8uCi=0vYKyiWf_^mJ)oDPukM7xD$`pqzy<(YLwiiOfU zO!=E|Fn(2@p8O3~(*zY&*p?IvT{n_qnA3!&A!k*jTkecJ6}>A0GX(#ds3A*B=8RMW z6--px5%$|)pd+aTDp?REB{~y|O(f253KK$>l!z||l$qF9EzpoqQWileb3&%D`Cf)=j8YIKpH?Oe?9y9oR#*$+HlJ_IB zm-vZVAaM_gPvWD=b+oCfUKv8)-HF_2TJ6_O!Iu5~38pH;KPH)DcU+}ueBWJTT%27O z_+q=!UM69-BZ)bNyd>Xa*4aE}*=ODqMPl+r#xVikQD5NC2kWxS__%n4+A14 ztWXR}9N(DznADbOYP7)o{_?QwR%d`QPo_DKdo6m6W|_^41$Q>r7N22y7~{466ey|g z^dw+rR13c#?dq!60N+zF4l@TwF}E!VS)9V2f-?mtI}+^3imWry3rTTZ3PFM$ByQE( z7MBX>C$r{9$GRnj#3zl#^HR;=H~RK;$ekA>x}t2qkAP!O@g9R)k`D|!Uz*rmrmzbT zRLAcTixH(h|0)p%AYurXs!0X}Hi~;hg&i+>h#Ybe#iU-WQF@E-qk)l~Y6bs~BcMCxlC7<6*`4$#at|#_6tqpsdVU|FuT54@j zdSMRXd!?Gz{pbn< z>0Zb6EFls|B1j?1?g5|sn0@eRrXB)$!3&&$r>iC-IHnY}G7IVjVXOpPbI3oK{u0pr*7daB zZHK9wq|u<6;zeRg5f%d=T{b?6M%o zxhnyqiO$o^As_T*j!ryfbhht2`3GVaa=Qm-bSW!}D_eXQ&-B<_3NafW84+p+J1r%y z<^eJPsV8De*pJ(jiKsljEE4l#V=$gx(>G#%T$hZ>&{}>@dHv}_{cOWL7V^#Yh84_R7SBc;~3bkK!}RP?O-Wu#0I9e>tc5 z2Bunb@oWr%yAxed6wo>N0lICW9sDlC27);$jPwBdAx5@Ee4Z9Xqfu(?I5y%d@Ke)i zsjK0*OA^M+=+bSihs~>w7a+Jv$l;^(>}rynTtQ>Z4ebPr)#v;l@X1yj+KI+LlhAOf zrlcehRYX9|lk{@WU@d2RBW@J`f+ya3f0LEli-Yw%yHX)$_i*|1CuYhQT4-l15!3|? zeg2e}H`jNwd@+~^53D@`Z#k7#R&$X2&gCM|@n+mc6j6459hrN>;Uhu}29j(A-p z6L4^8YT|XyONWzRuReHG(582G8B`}*RGzK7_dC#aIq~oT_w3pCeYRfkB|eHJdUXTO zOBO{x@b}F-yVzqwT`Fc>_ivIOuSG@GTL!;Zmpk#hK-TsOprc=7bx+KO*4-o*Q|bcC zpse#*so|5Nli-s;dVXwvYmz!moCO~qN+h(xlp)cO zqcVi2p8rt~SkmBHI$YByG9c{ru0TJl%HB@A=?AB#r+}D8QmfoYxyym9-&piDm5dT zRJMZGauUa{n^?FA%=%nr8_=aMu#bpX_{V>Xme$Z`ZOe*Bl`=d3 zBjiSPb~OsHCRxilKGpoVnuC9lmdelh`#mRBDepu5`3GGx-RQ6s}WX^Y;?ttv~FTu%*l^TwP1&SnsQAeC485dpHEa{ z<)1z#2R5f508)Fb|O@QcDeBpDWf_1Am~>DkWx; zXkst#N2n3v?!yMeDaynNZD6w@L{53^xUz`-Hcg+&!)mnOokiRp#7|W|=NaJgi3kMU+q|~;PJp_=h z3koxB99^c`%2n0WG-@86!nsm5{HUe_qwFkb>3mcZt4^~-4#m2VndQYuN}`MhN#qXS zgbHFrzEelk$Kpxx##Sr6?`RILOp3GT55Y2Zi<_rb#f-dpI#Ux4A8UDxzNL9D3AE?# zxMWI$D*FXPKf-vVVxY{(2}Lu(k_+gygx4Vr2&Z{}H^DN)KN-~fp@k8qFxye>n~O@w zX{{ePSlA^s)T8FNEM$PM{rF2GfgGYy-mUs8c(T!8BH}tVaZk7BM7%UoEZ7m!<7TIU zfoqkpr5L?hwUFP+WFQ0EjtCtt;=*JR^c>xs<`vG@1`c-Zbp%m59m=B2mJxt82{fF9 ztVy$Ejr6Si6eH@mb)#&{b5d%yvtCLDv^nwq=A#HeDp&@GTS)w3;|rjeYS0 zSaZkPlqhwq98PL`&`!Wgwwo5e!B>fRNq;!V*&XsH-t5*t$K3+2L+=aXTSx*_ zyy1AKYDu)pHm>)a^%;^I0s2*bU{$A7)+Wfez?>SQD~PE-aRA+M-g2NLI#VM5)mj0> z@N7vN@D$;vq(0Tmuu@o8NeS{T)tTZMwF@qlFhN!WBe&^P6RWe^NjHGtdc7Q0xn4;> zRd-aSYr*=2%g8fmU(L@xv{4#PrWieW_|y%uQnK$xi3A*X!l!t?aab*qpvn@9k^Z>! z?hQehN`^c#ksWmPP=m3*i#|96P586Pj3);6)klS>1f10 zPxxfTrA_FZUOf~e8Xlk;WkOf7EUaZ{Ud7Y5KP(H_Zmu_KFjU&$tPhiXlZqyJ^mOo& zD=RM;{nS|}=Dv){0nn1!`qfOpU+JP%K_byc5vhY&t`hn}-so2f*^S=4vlhNjB-dK- zRP<+0r>R>33NpMfriq0H=)M$Wbj;vCW|3U12~C|JyiK#7hX9iCFOrkD82Y6zz-MAy z*uuS#JFgaR7qKTX;cr5u#Rshq7;-V+#rF%aJyXo)$IO4wLE%M7o8bfCU)$5P&~_X5 zHpZB62fcsa&LtkTSJG1yk>E4UL-3pNJ4r^)<4nZY}!s^PGTDAc5FxM|&-IQpq8caf+s*J3qck456%IruiH(g#bqH1*`h~gap=6JqcSmi(OordxL{d*9kJ{Kz&?mx zhi?m4&jCd#Iq)Ea2h1=~i+n}jU)ty)jwI?88#tD!=#(?lvk8cZ(k~E^g8C=xv9<@s z^Fa54zQqa=@rgX%nX%}x&=>%4;XdImke7Q1q0-Trp_&&7* z#Z7q`=fKNa-|a+NDhtV}UHb+FtN`uQ@7N$Fqq+fA>BEVVFL{&ZjQ+57qkbo;fKgwH~%#ER0kj2T+ zaAdox!ZdgWv*#1rVz)}fywTLyq%PXc7gHTR!85S;Z6@L<7a)_4aZrGGF?|@ zrpFL2>uf3;Xv-IBqAQ>&b})Y@BS@iy^I2IvS<4>{w973|q^NFsEc%Xbgw;76 zOgDZFasb;mud)PRhD@w;l;-{U7zn_dj#6uoZ!W-S;PaHRJM`@`_Pgr~3|9y(T}Khg z*z{Mh3cW8nXA?kULK>Fjqv*hT_dX=z2c?H;73&ifd*{Qk9ytzM60*6GLIn+9W_!ESgLo zDVW5{%+}NO#drt&2ZET?EwWjkGx>jcku}`Hn>A|;8%N2 zKbef>5inY3J04F;Z4X2Dc=+Nz-@DUqxhn}faZfGq;n4j&FB=WDbYt-{gS_Gl%I2{9 zua2Kg&^VLzg7x9+z8vm9sz-nkf<2pTwb+m z@29igfEuNhx_9hGOtgk`Cp$$Y)$@k1gSLKfdsE8`mZv!1`x#&BpY6clb+v;rQv%CD z|M8Vk!<;+NEG&)vAjCFoNQ{xg`qBxXk zjadTAn)?%i4onZE0-__Yt0i?`>Bz%jLiWkLwzCN3_~c~rw?fT%HPEK0Ne%+_VT+Eb z5ElAFxqAx%A1~wY2q=K~G8Nv-Zhp=Ekai^In4H^Fwx?Opi*#&V95Xa$aZ?4hZjmB9 zI9t_lY17}}?h+0lwf%jZf5g3QzGAn_4t1e#PE*-(Ez%Saz5hJaE1Mft)Esh4aOvCC zh%bLg|E#h+S0BUrWt!F?RNN6H&_o4>>ydbfGO3G(0C+w zw<^(sHH928hEAQ6rq|1tmP>7J%Jh@RwCkrGQEI}WGo3mKlG)xcoylCcQ!NNXz_$3- zR4tSSX?o|BQl%RJbnFr#y}Y5TFFNWU@+_ZmX_`XGHh~~^|Ep}mv)?K?}RY*+Zwfp)a&dLe~YN%rF4IaYiK(4OOk_VqstovzxP={I#d*;*IvK11tX z47A7d6HmM11->JUd>q^Q5VuPRx%WI#{_gJcoA|1G<`6CM)sXai<PW{63^y*H!0G=v)?9SF9eYV`TDA{G<@sIjF z%f!uYii3%Ef$d7&Y!6WG(PGmUy$uUW*34-_%!XhJt}Vr^JTghS^bEQ>&#f>sdDne0 zzrlsog?8u0t^TC?u!JHL%Fh0@&w05YFy}@T#>T5P0HZ3xJsL50Aj4+A|Nff5?NQx* zDW=S<1Bh&In&*RM?}izBB4OZ?%fQSdAVUVfdkJ{G8iC(Wt2`OOeBhNs&+p^z1*^eS z9EZ3QfXqyocz%M1hTJ&Q>Q!Jn~@t8i`0+3lJQQlwOSZKh>~$ZO~LtkPY+Y5x;s>ytWC8@G+#$H(h>>+g=%Tx>tBH}-r3 zij5SjaJW)X4=@NZcB3nY>Dh?N>S)+c?p-#qS`_NjGCODz5UzfKl{UwjGB< zbc}xCQT7@Tj!1m~cGkY-2Hh5Cy{0R*anJLg^PF~pn z3~w~J$Hsl7vvuBFhpNnPsQvkPf@vAYoa z7=@u*NhAM0W^hjJ2{&Qu`JCbm;tE^vwce2M^PrX=Azjn7P4u!cx`s7bYQ027uiY;HwVDLh?qGZxv#RQ^eB;fCuiwlHtVK&^3ef>wrI7XwT1%c zULZtp0Pj!t2gSVPF9n6=FxtsWEwW#Z-gTu;?SujTTYmd%!O@zG=tVV_LW%?2svn}H zphe84wlp6Wk_yfK0nUzr zwtTdUr><>Q?V*#w;?e**ZzOPgyuOY-7$JWQXXsb6b`-$_LkNzw%<8I%O(G+@_uR4C zSSPE}H6>-+k|pwyI3-Fo7F_Z?-wZJF!H-cDmjbOdvR(UxKjIa#Ei^&Y)$g|(;E zx8Lj!v7RAiiU!45oEnFhdVc7MT=wkNXoC8g?#$IPYkQgmaYF%+?c@eukHY?}#IEqf zKzC0l@@LjYfL4&S2wVF84%IXMX*4xlF^&*t35km*(&->rJ z+y)GKt)wG6f&<=ub)uemXIQ2WstZ3s!+hmZ2xUcFH!2 zUk_MNi$%j90=({mdhmagnx|KqiYvF!9GD4@O<+cn2FoB5ZCi1>Ncz5cE<;{{Y$PJQ z8wDeP>Ib0avf?L!9@XIvMm?eD-H0TULkt78ty$A&=Y`#eWjRFcH7+wV}LeCcx+XU93xhh1^ zkqE*ZWrP7D;kr!-1(WWE;k3PdA?>WJ#|MP*80`*^p8Frp9Yz*ueZC)$?;n!lxJU)! zWT-aSjOz^?j)3rk!;C@hL}vept6UKRcdS2erlnd5NM+99(Q}UA>>Ks|{C(rnj`)b! zQle+nlSp_khatwU>aSoKZK$eYH^|_x*8$fLWu53B01qXM{VS{VG`lC> zF1xJ3t6D`14J4l)E;S8g$pkb4nU4m}CPlVJ_P-t{DCE#ts zBrBtd^LuMV9vhcauH_%8RCH==MuqE!TeGsn~I8Le2!S>vS}LR z6R}C)&FBA*3fv{$$+%1zFV%-7`pIw|*_qN*WvnG3E7gQZf~f6{t(nlVNxgv86v$C6hzegkuXhRS3-GV@t%B;F1I< z6OxokCW!_SoN$~+jdBNAzz61r>g8-1>x`=EjZpMgjpWmVLS+Q zcn^nHJHNL3`1bXmyZYj_SPH$1&CG_!g(OE}U;OSC=Idh5VxuT5k{~9IS*Fw9O}%-L zFXFB(ccn~cM(uICR`$@*4S^6qT3}Tvyh4>iUOEGp4beA_T9b{cYy7dtxR0-%ETW!) zY5=3kpkUg>dK?WGT3cF!uTmw&BV#m+)?W4bHgXs#m^5&>#NxYdL83A5R@$=OdU}xu zHsE;c56_W9uO7+8%U8_$Z9}<&(4{8Qnoiu=e=w1v_FX?hw<}|KMb0Y1RPME8n0#sJ zcd9M5X?fILD)#KbFMezk3M6fqh_2AKNC70T|0IYQcJ{Qrp;?P8;vupXQm9D+TbT zLxVO!s|Hg{K}Ap*{u>I z?Z{S8uBw3wI+r>AxO3<5;-u3GHJ<9XHByi<>tbXkE1s$LgadJ_fRMjf(kslvyq_asJD z7n8rY<0a-c@mw+7w*5EH{W^2*`C{AF>Yv zqMTDCjzjw7Q8v?@h!JfKhqkm@B<~WGXt~nhGm%@3ekei0qPt;UY_G9gB09ikWaru_ zL<$UWezUcBSPcD;qLz==O5egw%HX2u-MO?m|82~9*ktsLqTUx9{0>Mga`zP1W)sNH zB$=xbxGEc(q$dzkp+FZGEhiWGV;HVZZQzymNXYBB%`xIIHJ6-zB((E!Rxu{<~1Pt5^*pX$8^2nz* z%Qr6&&M)}_wgumAhI{v8kXHQsy<140CA5%Jo4-4N`!;Md9ckE+VLOm>xd&$NLG;N< zQIw60r4|3U(QjW5dP@al&KZVm>SR(YGE%~{go5apT!WP#bfWKCE2*#L!aRT9{0TRl zN|%B;f*Y0Y?62D+j~c{3|8jndb^1zk@`xUW_SEOZDw|m8RCM5w-Tl-GJawZ6tbg*G z6CpUyq2CWVuF9-!5F^hdR(+hR%{Y8vE*&vxCLzutHP(Q1?2iE1OtD^WVt^Gv_wD(} zE5m$vu+4LR=Zx&wpw~!7N8^H)xhxN@X?(6jyVvPPs{+JL!%g!I=r~|TdKA5A7hP2q zy>UY3wbh>5jhJg>be*)EcF%}@8)d!zmY8py?ZNy^ZZ%7dR80B*E9@(vqT1T`FQw8U zt%S5lOb00`A>G{|jdYJ9ox*@Hgfs{!EiH&3NC-$si-aI4B^|%v{@3^23w~?;_nI|p z)^ql|-`MXy=gdBPKj-!S3jd3!+hj~ESvT!zhV8mFvTn$(wxZ%Rejd(!>A%)pEyVn= zBGGe_vT`U&b56SF81SN{D{JpGS-F}S>7SFsBr0o^M(ppJJ2PxSdXA@&W_5mQ$?q#}4HOe1Cb)&_aC0{jbmlyN=MF6bZ$K z@&sd7tLYvvU6K~cagg1LCjV7BzoHtKwe=6nJb66Jp1Em?M)RRoum}%pc##H~>Zrke zZyi#Fxe6u;9J0MH=sZH9^HYKrMo}a~>3j!lEh6drctK}Wn}?Rp&{Cmbq%Zf;{Y_R8 z5j+YCRXHO0_{@gLKAI(-z2|MP0fskjn0Fv; zgnL=*;6PFiMbkJC<+4JA5D+_kK|w0OSJ=W?7$_qiYNWC$@E8@WwHY7DQ$?xP1EaDS zsz_k^U^qYO3sl~`Mi9_*cC!0ENgn7l*xsA5%!5(VEJ&nX>-#L26sYH6_$_#Bqh^4# ziGAL%*<$}%km>wkpPP?->ThV=lF_=yk|4VBxZ5QkRb_*Hk(ST_w8q1|_RPPMAN)>F z1uxW=(B_ucen(t(r;)Q6%Mgn@KMc5&v_v4~B z!v$Ek%bPLzmac)?36kaE@t9XT{n8nn#zF*-g(s7h zcE|lT(WAAtT@0NyQD&m^rVAyb07lugmiAolu890kNXuu$#9tpounGb*og76olG9Vo zl#Vim_jjQ_1YHlC4W7!F;ZoQg>=^ zw{Uml?&f5^QrysI+z#P;Tw$yo_ESJeX&zH|vp-aMi%|3txPc~rH?1Zvyel9^mne-O zcE@@5mHQo2|9<~#ww!fKRc2E$t0VkNhtHrtw4?Bpx8P1O4VHPK%vD?& zSVuZ@6UF5se$!U1!!Bv~Rx-$iY$IZ(Lo*D;SPX%pw0Q>D6u76o!SAw%>c6~{c3!A1 z!vB?Ptn`#pG&!wVNS>#45eoj93XjR1HNfRevu(=LdsaZ6JQc8Y(l?!%_e|Bd=$evq znlm2{BRx}!*s!gPP9}d$KM|-RaIXI>EPQOxrAFoJFY;cUR__n!-`~5sFl^U49-b1S z(#+80)^lDJgyCX;oe_}OA4}$<81%*&metQyg)!jNU|JI;|Gr|9do0sUo9w=k*#Et{ z70=cWY~PxeX0STBdK0NxlA)sMp3>iHJI?ba?cy^dATGa?VrmSQ|Lc@m<3QBG`f1qn zk!!R7{Enx~8iTJR58xQ~wxS!B3&YQXP-Z5$NNlR+NxkXO)j z&utI7%gi~6)jiV77B{yMuAAI+iaJWtZG*(Q>^q3ktPg5%rr{`5X-K$=o0HiS!Xok5 z8OKeddcyX_K%bxP*Ia( zv-NQUqRc`T*SOBlA$XzN2?i#)JI5-DgJS$l&n(rk=>iHpUj6Lgygnf>uKyL;=A%&^rXt=e z-y+?>^#&)b+N|$O@ZsK4=ey?4o$)evzuGTfO>a*$V0U4*G0-%0@9BSI13P~^SIT4U zeEzUm1G7@~Hz5*0ySyf0` zeZKD0X~8;`tNbK1kEyRZE-4+m7gWFRyxjSteu84R-QiRW^el|+PotxN`Vm1~=<61%8u8GPwy;kc;ixQbpYWi9BLKEDsCo+{*LptxDQ=O;7ZReoxfO!m&&?j?9V8kTBQoGJ9QM*QoaP5^kz~0EHm8p7?cb>w zlQ#)E=tR8SA97*-vU|<9y!-|!xp^7!Os=@A?pAz$+wV^Gy3zaxUl$vC$e(Ma96B+V zzYjcT0^mt!ijF-v@0}$;?Xo_2Dq*sRdXibwPow^6QDOcb#DSK2?$kHt$x9DWi06hu zTr%2ZdyFqj} z-(x8q7SeHepvbO#ZS?4l_TXyVhdC)+=v;yZ`=giK$wUtjA}xa4!tC6{R+xm)hS#sl z%ZpWsh=bW4d(EW8c~ICtkxF&ql^{4=VhtVU%HJDmf;q8y``$@;58Y63o3|Zq6*Ka- znWzp?tv&Z}*6%UqC(yZNJwJXBwnWqk6|1SS zpAaxvMa+Cw3~Y@FjT7)0n-nfJI*FM7__9=S-Rtno;GNdM!)>rODgP2l@co1M9wixD z9%AH2;jqKQF+JyUi3%PwFFOf432moq=Gc2SDt3dpKBLCw{aqBn*3hgOp*&4Zqx^K*v#R)!GV78 zgR(t(rj~Bv^6373jZcq__G?-)>{RNvJDtxcv{hfBIlxRb0#I7hgXWGTLRd2AUxYALRVYNQ%Ps9H-{ zpY=^M=)A(}$S?VigQ~TE%kQQp zOV^$#eHXntz`S=7a&uHzAox0+f>$T?x__I4iS0L>IjW&S6qT2J+e*znT%s|JhC;l1| zj8CJ|_O{!OnwYvJZ9er}@^^FGviCB2x~jp{1w7*1D4oDQC-g%fUkM?3PixN(0n#U} z^1tzLT%aP~QF4@fIuA3W3YzDu*#zpo@7GHRtezLNY|un1Fr0UVU>s5vj-};HT1wt?*IGehtcGO21!DJ9h@_xGgQM zZLGE@*@M)Z;>n4Mrvf>4rTvAEA_<7EMGK(L7bY;jQTOuCdh?7t`yS!gPcHAt6@B`A z5B(Ax-QOo&6z)OnAQUirQt{F-#z^(PVK?@9L|b8#mG_4k2~|3?-h|UQKo9A*`bnPOm4Yy->PKLfy&5qfsKHTx*nICnBt=Gn1}^E_t4-pc&5<*GJrq9?7+i8BO+| zG_=rAzd5(S@VhZDMsEZ(NN>yb(}ZfAf`%5Abo=SaIGhkhwN_o$Wi)_~a#6cmv^9b2 z`!ZmZVZ7Y4MtSF}uNKo@d;yL1;<~hhx`Kkbzpc6=Um2M=I!}_XY3C$ubktu^&~btD zT{0tCM*X9`Q*INLz0FAS-^sEaTpih#un2q!h6w2%iwp-S@AGiE&0}ziegyFB{Or^2{Vs-*amN^74NCa zm<3iC`fdkFHq#~9zf7?x^&RGf=UTg$7yt0~a8x5yeGt zE+lSNNT?Z+-&D?8R<7w=S^Bn)rhTGLx_k*Yv+IC}Suj&d{uj<+@+hfPHjwh5`G#?(&m>RlfC2F_i zGI~k^{SOEaH@)tzpm3ZG6&tYg+34=~i2v-ay3xvx2M2=D0G-3Re}<6 z!6c~u&&)Lf&H4fR;1TxkX=@!@RZSh*K+@CFH&hmDB5Py?CfA{M?a^GZT>6wGymfcN z!(}aSgCZ+Kl(JewL#>yIZ@epK=W&XNY<%4M;Muj94$7%{kUsizFXFL0XenR7;`6#w z`J^VVc)@{`QJ?6q#wGt5FET3Gl@2+Mgw``cRFORJi~KyTbVrAO0;8kwEpA`=b~C5B zk_`sSR%e#8#g0f`@`84$AknFcF!!Nyi5RKxeToCSYzrjTc~o5sJ}kqrWCrwN)@!;f z=fUmKc_}0I>ch@4nE*8=O!mfUl&`G2YwwEp@73Mp>Yro5?R7s760=h3J`G#`J_$a+ zM|rrs^7T}ZcIfS1BF`W^Z&3k|BR>=qks7|J{~*ktR)}4;8zQ%9ooo84c-|vw}lI*iw4PN#hlg!mK+h**1{oP6k+dnPf5$M@byf^B7TI$Jrt_gz#1e8JKZvjg7}9^f1N zESt07a4f-2PE=iAQ=F}>Q}HrR*6}$COZ70}raK;VYnPPa?Rdw-CgxR_cnKC|lzXK2 z zc3aJFW*3j};C;y^sA+H2PbVUAlz;Z@3&T-qDuA6(*i536iSfNi&{>mcTnfKjV79zd zRFdIvYk7eW;;;TQ4tJli?Km698>sG-9G-68uck54-q=+b#&zyiHpf0AvDRn;ogQ8f zE=MN`wU^2?2$Y)oUoT>|T26kY4yIP>H`kOfP+-?eK1=G{ta!a>sbQ?aC%_l0{julf!c?iKKK-O)1kuQEaxSzS&NN^$2~ye;I1)nh1jH3bvL zIQ9>_)Rl^k+%-9lb9bU?-?*aRJ(^d$m$yM^d%8fR{o%&<_jty$KO#HNQ0yB+bcK8= zB?*F0#~bS!3)=!7#L*YNtW&K!!)_FESz2eJWq%YFS6%;1`up5b^Zm($@b@>{C|o89 z+De3|f5hY~)frzq4REF`isTStN7d$9iBe8U0fPu=D(9xh4Mv?JN@73Ud#wD}vqF2m zOpdX152MQEMp0}KP96H`&E}Klc#;*r1+KH43^kNQk={fvpJE^$`7}&+WOR{n$Y(Ar zR+9Rj&iT!Su(UXD=v-=32epNv&=TQ zP?F?rXqHA6QdCpySMqeagfmaOOyzCg!aj3bUY(>}^e^Mu4nYxZ`)fTaB>$;KY}3w0RAZ#?m# zu4jP;nofB*QcDuxYU#^9odSo98D9#f4000lPyGv4qj;iCwVMSw zT$DdJlznPHJrbBa%TkAINSl}Glr2~!L5okSJXSx_vlADZc$guKhh zlZxDQ#bwhmT*#8n^+mDi&i!z8|46HEQdkwj`N_Csdsc@_&Ukl00MA za9n-d#`dtORnJXEbn~cUB$M%+_qLR#S4BJE2=nsOnSsK+R`!`#9%03fClj?nH zYdW18%^(hlXrD}zLwzG$t|QzK7r)jn{92JO4|+QMDTa&p1&OD1h(mRLsE{VJ$14E7 zG@m8Ezz=sf*}zyi+-3h;LgW2LxX;lYTCbdO$AYIan~N1icwG&9ZCHk{TQD%FBuXoH zc$<*^HSAGTk&hNH&u_*VRcnLU?+`_KAd9npxTzOdj0daEennM;ex1I4*!C4HEHEo| zaNh~tkuaJr_pwPoyKGR;LHnKB$bnIrMo;Gu$1Mo5-ZrFI>^vcy&f(i{lSEjDswvNV z8HL6q%?SbRmzK*te)O*F`|R2a1B;oyM%g-fntez`J@pW2uew&TneywqRu52q5qtKQ zCM~ItTC|^!l=P$cr*_UvQ>C=NaIw7 zMpVJ(c7~m^LZ*E7dTr}z7rUw7^<`eg+q37f*{IL!sVMP#cKu)m2T$&jvZB)3pD`04u^P7b z^dU3tL$vlM)!C6<%G1*|D&dd&@P4|MlC{$zo7V)Nyr_AUIl@H68iR+-@!!~I2f*=^ z4>vhxMtmI#P_sGsV*|Bqd6Oc!Nydd;y7W&4s!I*m;6N9?^G2W3=QV4gkAgc5*Osj& zZPY-%YP`*Ip|Q=79kWroN#%?=^hg5%SaLCmH==h#SM&UE>%qOE7T zh?JSz>Ly-K4V@HOv51A=B7)@)eSRnfuacB9etbsNfRSlPl$zyprlw*o>s2>@>|l+S z5;J6Bo+=4I){aHqu@wC~Lt8HB)dpwFV1T33+9(u2Q zNQP6APzkz%)u@}TlwgFnLVQU8+Ao8zR-l@Qyq?O zCVDI%5K42j?7Mcp=PNkXm0gzj_SmIwk>mT~jdOJ5SYcj@6mZn%Abu&(m|YuViSOSa^*?Uw`|YvWTvNh4$Gn%HXy)Q;qqOGWlTR;G-= zJtySXn-4bW$}wc-#7ymuC42m_hDpul^}MTc=0lwbqOuX`vdTkRP1SPkSKl2P-!jSf zulDtk4-QA5-r)5YGmXg6n=*N~FU+pkXv^L`hU<V;5(ESTp>TZwfE)X{ zOC+e|Y$-$v< z2t@v?-i3Z_0Yf2Iqk#1ncol;{;DA3cIO5O9fT4h^210;f@YU`Dz)}ALL?A#|LX?a0 zPh`MQ#8qJk5OR^rm+Ao!h(8U z_ywiQB?Gatpnp5^cl?1cAmERFf+sn2ynqpa|y!=U$EI+!ax8x;$MmM_dy643A|bl0s;Z98Vv&c#~9Q<;Rk^bz^lUv z+aU6)F%S?Kay37&vKLG?mkopOl?+?XT=z=Ba zqM-hp{aE1()}M>=4~9+jtDZn0;ET0^m+C>lfC~0uwQoVe=Po)e$%d8wb=?#n{vBAI3nTe~uCu2z*ru z_Id!kY9IvLb62|#4oAZNQx9EzPK~{ub)B;sOCzNuWnq#)5DWos1h|KA!$7ffAl?q;s;-mX^GL~tY+h9u(Tlu?l-`ahbMM|1!H diff --git a/tzpfms.ps b/tzpfms.ps index 467958e..48f35db 100644 --- a/tzpfms.ps +++ b/tzpfms.ps @@ -1,15 +1,15 @@ %!PS-Adobe-3.0 %%Creator: groff version 1.23.0 -%%CreationDate: Thu Feb 29 21:31:57 2024 +%%CreationDate: Fri Mar 1 11:03:21 2024 %%DocumentNeededResources: font Times-Roman %%+ font Times-Bold %%+ font Courier-Bold %%+ font Courier-Oblique %%+ font Courier -%%+ font Times-Italic %%+ font Symbol +%%+ font Times-Italic %%DocumentSuppliedResources: procset grops 1.23 0 -%%Pages: 15 +%%Pages: 10 %%PageOrder: Ascend %%DocumentMedia: Default 595 842 0 () () %%Orientation: Portrait @@ -237,8 +237,8 @@ setpacking %%IncludeResource: font Courier-Bold %%IncludeResource: font Courier-Oblique %%IncludeResource: font Courier -%%IncludeResource: font Times-Italic %%IncludeResource: font Symbol +%%IncludeResource: font Times-Italic grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72 def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef @@ -276,372 +276,15 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-ADD-B)72 48 Q -.4(AC)-.35 G 42.103 -(KUP\(8\) System).4 F(Manager')2.5 E 2.5(sM)-.55 G 39.602 -(anual ZFS-FIDO2-ADD-B)-2.5 F -.4(AC)-.35 G(KUP\(8\)).4 E/F1 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-add-backup)108 96 Q F0 2.5<8a61>2.5 G(llo)-2.5 E 2.5(wa)-.25 -G(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F1(SYNOPSIS) -72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0(After)108 153.6 Q/F4 10 -/Courier@0 SF(zfs-fido2-change-key)7.564 E F0 5.064(\(8\) deri)B -.15 -(ve)-.25 G 7.563(st).15 G 5.063(he k)-7.563 F 5.363 -.15(ey f)-.1 H -5.063(or a dataset from a FIDO2 de).15 F(vice,)-.25 E F2 -(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15(xe)-.15 G -(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G -(umber of additional de)-2.5 E(vices.)-.25 E .273(First, the wrapping k) -108 182.4 R .574 -.15(ey i)-.1 H 2.774(se).15 G .274 -(xtracted as normally during)-2.924 F F4(zfs-fido2-load-key)2.774 E F0 -.274(\(8\), then a credential)B 1.604(is made as-if during)108 194.4 R -F4(zfs-fido2-change-key)4.104 E F0 1.604(\(8\) \(e)B 1.604 -(xcept the "primary" de)-.15 F 1.603(vice and all the ones)-.25 F .185 -(holding backups are e)108 206.4 R .185(xcluded from the search\); ho) --.15 F(we)-.25 E -.15(ve)-.25 G .985 -.4(r, t).15 H(he).4 E F4 -(hmac-secret)2.685 E F0 .185(is instead used as a sym-)2.685 F 1.555 -(metric AES-256-GCM \()108 218.4 R F4(EVP_CIPHER-AES)A F0 1.555 -(\(7ssl\)\) k)B 1.855 -.15(ey t)-.1 H 4.055(oe).15 G 1.555 -(ncrypt the wrapping k)-4.055 F 1.855 -.15(ey d)-.1 H 1.555 -(irectly with a).15 F(random IV)108 230.4 Q(.)-1.29 E(This turns the)108 -247.2 Q F4(xyz.nabijaczleweli:tzpfms.key)2.5 E F0 -.25(va)2.5 G -(riable into).25 E F3(salt)108 259.2 Q F2(:)A F3(credential-ID)A F2(:)A -F3(credential-public-key)A F0([)A F2(.)A F3(backup-salt)A F2(:)A F3 -(backup-credential-ID)108 271.2 Q F2(:)A F3 -(backup-credential-public-key)A F2(:)A F3(IV)A F2(:)A F3(encrypted-key)A -F0 1.666(]...)C F4(tzpfms.key)108 288 Q F0 2.238 -(is actually a dot-separated list of de)4.738 F 2.238(vice b)-.25 F -4.738(undles. The)-.2 F 2.239(\214rst one is as-described in)4.738 F F4 -(zfs-fido2-change-key)108 300 Q F0 5.181(\(8\). Subsequent)B 2.681 -(ones also include \(identically-encoded\) IVs and en-)5.181 F -(crypted blobs.)108 312 Q F4(zfs-fido2-load-key)108 328.8 Q F0 .081 -(\(8\) shops assertions around de)B .081(vices in a de)-.25 F .082 -(vice-major order \212 depending on)-.25 F(de)108 340.8 Q -(vice numbering, a backup may be loaded e)-.25 E -.15(ve)-.25 G 2.5(ni) -.15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.)-.25 E F1 -(ENVIR)72 357.6 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 -(TZPFMS_PASSPHRASE_HELPER)108 369.6 Q F0 .046(By def)133 381.6 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 393.6 -Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G -1.596(ill be run via)-4.096 F F4(/bin/)4.096 E F2 3.262(sh \255c)B F0 -(to)4.096 E(pro)133 405.6 Q(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 422.4 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 434.4 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 446.4 Q F0 -(Pre-formatted noun phrase with all the information belo)160 446.4 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 458.4 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 458.4 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 470.4 Q F0("ne)160 -470.4 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 482.4 Q F0("ag)160 482.4 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 499.2 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -511.2 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 528 R(En)87 540 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 552 Q F0 -(If set, enables lib\214do2 deb)173 552 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 568.8 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 580.8 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 592.8 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 609.6 R F0 -(The lib\214do2 documentation at https://de)108 621.6 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 638.4 R -F0 1.6 -.8(To a)108 650.4 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 662.4 Q F0(ThePhD)7.5 E F1<83> -128 674.4 Q F0(Embark Studios)7.5 E F1<83>128 686.4 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 698.4 Q F0(EvModder)7.5 E F1(REPOR)72 715.2 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 727.2 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 744 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 756 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 2 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 -SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) --2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) --2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 -124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF -(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 -2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 -(,)A F2(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) --.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 -(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.244 E F0 -.1(wa) -3.244 G 3.244(sp).1 G(re)-3.244 E .743(viously encrypted with)-.25 F F2 -(fzifdso)3.243 E F0 .743(and the)3.243 F F1(FIDO2)3.243 E F0 .743 -(back-end w)3.243 F .743(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 -(Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 -(ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.465(xt, a ne)-.15 F 2.965(wc)-.25 G .465 -(redential of type ES256 is generated on the de)-2.965 F .464 -(vice \(with relying party ID)-.25 F F5(fzifdso)2.964 E F0(and)2.964 E -.499(name equal to the dataset name\) with the)108 264 R F5(hmac-secret) -2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 -(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 276 Q -(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ -n, the credential is asserted with a 32-byte random salt, which hashes \ -it with de)108 292.8 R(vice-pri)-.25 E -.25(va)-.25 G .962(te data,).25 -F .137(and thus generates the wrapping k)108 304.8 R .438 -.15(ey \()-.1 -H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) -2.638 E F0 2.638(\)\). This)B .138(mimicks a)2.638 F -.8(We)108 316.8 S -(bAuthn login step.).8 E(The follo)108 333.6 Q -(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -345.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> -128 357.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 -(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 369.6 Q F0 -([)A F2(.)A F0 1.666(...)1.666 G 1.666(]...)-1.666 G F5(tzpfms.backend) -108 386.4 Q F0 2.708(identi\214es this dataset for w)5.208 F 2.707 -(ork with)-.1 F F1(FIDO2)5.207 E F0(-back-ended)A F2(tzpfms)5.207 E F0 -2.707(tools \(i.e.)5.207 F F2(fzifdso)108 398.4 Q F5 -(zfs-fido2-change-key)60.227 E F0(\(8\),)A F5(zfs-fido2-load-key)56.728 -E F0(\(8\),)A F5(zfs-fido2-add-backup)108 410.4 Q F0(\(8\), and)A F5 -(zfs-fido2-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 427.2 Q F0 -.486(is a colon-separated tuple of unpadded URL-safe base64 blobs; the \ -\214rst one is the ran-)2.986 F .217(dom salt; the second represents th\ -e ID of created credential, and the third \211 its public k)108 439.2 R --.15(ey)-.1 G 5.217(.T)-.5 G .217(here e)-5.217 F(xists)-.15 E -(no other user)108 451.2 Q -(-land tool for deciphering this; perhaps there should be.)-.2 E -(Finally)108 468 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 -G 9.506(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 -(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 480 Q -F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F -(to clean up the properties, or to issue a note for manual interv)108 -492 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 508.8 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.555 E F0 -6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 520.8 R .729 -(ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 532.8 Q F2(zfs-fido2-clear-key)5.147 E F3(dataset)8.647 E -F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F -10.312 E F5(keyformat=passphrase)108 544.8 Q F3(dataset)6 E F0 -(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-fido2-clear-key)108 561.6 Q F3(dataset)7.606 E F0 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 573.6 Q F1(OPTIONS)72 590.4 Q F2109.666 602.4 Q -F3(backup-file)6 E F0(Sa)203 602.4 Q .353 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 614.4 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 626.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 638.4 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F1(ENVIR)72 655.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 -E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q F0 .046(By def)133 679.2 R -.045(ault, passphrases are prompted for and read in on the standard out\ -put and input streams.)-.1 F(If)5.045 E F5(TZPFMS_PASSPHRASE_HELPER)133 -691.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw) --4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.096 E F2 3.262 -(sh \255c)B F0(to)4.096 E(pro)133 703.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 720 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 -(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E(fzifdso 0)72 817.889 Q -(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 2 3 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 124.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(FIDO2 back-end con\214guration)72 153.6 R(En)87 165.6 Q(vir)-.4 E -.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 177.6 Q F0 -(If set, enables lib\214do2 deb)173 177.6 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 194.4 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 206.4 R -.727(vice which supports the)-.25 F F1(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 218.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 235.2 R F0 -(The lib\214do2 documentation at https://de)108 247.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 264 R -F0 1.6 -.8(To a)108 276 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F2<83>128 288 Q F0(ThePhD)7.5 E F2<83>128 -300 Q F0(Embark Studios)7.5 E F2<83>128 312 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F2<83>128 324 Q F0(EvModder)7.5 E F2(REPOR)72 340.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 352.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 369.6 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 381.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(2)183.837 E 0 Cg EP -%%Page: 1 4 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 -F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.588 G -.25(ew)-3.587 G -1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G -(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 -108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(FIDO2)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 -201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 -(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) -14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 -213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-fido2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(ENVIR)72 247.2 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .045 -(By def)133 271.2 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.596(is set and nonempty)4.096 -F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 295.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 312 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 324 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 336 Q F0 -(Pre-formatted noun phrase with all the information belo)160 336 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 348 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 348 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 360 Q F0("ne)160 360 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F4($4)143 372 Q F0("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 388.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -400.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 417.6 R(En)87 429.6 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 441.6 Q F0 -(If set, enables lib\214do2 deb)173 441.6 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 458.4 Q .625 -(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 470.4 R -.726(vice which supports the)-.25 F F4(hmac-secret)3.227 E F0 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion is shopped around to e)108 482.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 499.2 R F0 -(The lib\214do2 documentation at https://de)108 511.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 528 R -F0 1.6 -.8(To a)108 540 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F1<83>128 552 Q F0(ThePhD)7.5 E F1<83>128 -564 Q F0(Embark Studios)7.5 E F1<83>128 576 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F1<83>128 588 Q F0(EvModder)7.5 E F1(REPOR)72 604.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 616.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 633.6 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 645.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 5 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) --.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F -(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 -/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G -(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.141(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.641 E F0 -.1 -(wa)3.641 G 3.641(se).1 G 1.141(ncrypted with)-3.641 F F2(tzpfms)3.641 E -F0(back)3.641 E(end)-.1 E F1(FIDO2)3.641 E F0 3.641(,a)C 1.142 -(sserts the preserv)-3.641 F 1.142(ed chal-)-.15 F(lenge, HMA)108 165.6 -Q(Cking the salt with the on-de)-.4 E -(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) -.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF -(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) -.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 -(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G -3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 223.2 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .045(By def) -133 264 R .045(ault, passphrases are prompted for and read in on the st\ -andard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.596(is set and nonempty)4.096 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 288 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 304.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 340.8 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 352.8 Q F0("ne)160 -352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 381.6 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666(SPECIAL THANKS) -72 410.4 R F0 1.6 -.8(To a)108 422.4 T(ll who support further de).8 E --.15(ve)-.25 G(lopment, in particular:).15 E F1<83>128 434.4 Q F0 -(ThePhD)7.5 E F1<83>128 446.4 Q F0(Embark Studios)7.5 E F1<83>128 458.4 -Q F0(Jasper Bekk)7.5 E(ers)-.1 E F1<83>128 470.4 Q F0(EvModder)7.5 E F1 -(REPOR)72 487.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 -499.2 Q(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 516 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 528 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 6 -%%BeginPageSetup -BP -%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([) -2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E -/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A -F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 +/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 @@ -683,28 +326,26 @@ listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R -18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 +(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666 -(zfs-fido2-add-backup \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 -(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) -108 583.2 Q F2 1.666(zfs-fido2-add-backup \255b)6 F F1(TPM2)6 E F4 72 -(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 -(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-fido2-add-backup \255ra)6 F F3(tarta-zoot)6 E F4 72 -(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 -(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 -(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 -(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) -108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 -(zfs-fido2-add-backup \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 +24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 +559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 +F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F +6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) +108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R +18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 +(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) +54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q +F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) -108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-10-g6a143b6)72 817.889 +108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-13-g43bba23)72 817.889 Q(December 4, 2022)83.023 E(1)183.842 E 0 Cg EP -%%Page: 2 7 +%%Page: 2 2 %%BeginPageSetup BP %%EndPageSetup @@ -719,9 +360,9 @@ BP E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(December 4, 2022)83.023 E +-.25 E(tzpfms 0.3.4-13-g43bba23)72 817.889 Q(December 4, 2022)83.023 E (2)183.842 E 0 Cg EP -%%Page: 1 8 +%%Page: 1 3 %%BeginPageSetup BP %%EndPageSetup @@ -730,193 +371,192 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 -E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.867 -.8(To n)108 153.6 -T 1.267(ormalise the).8 F F3(dataset)3.767 E F0(,)A F2 -(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.177 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 +(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T +5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 +E F0 5.266(will open its encryption root in its stead.)7.766 F F2 +(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E +(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) +-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 +(data will be silently cleared.)108 211.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 +(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q +.294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 -(\), and sealed)B .585(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 264 R .886 -.15(ey w)-.1 H .586 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q +(\), and sealed)B .586(on the TPM; the user is prompted for an optional\ + passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 333.6 Q F0 .292(identi\214es this dataset for w)2.792 F .291 -(ork with)-.1 F F1(TPM1.X)2.791 E F0(-back-ended)A F2(tzpfms)2.791 E F0 -.291(tools \(namely)2.791 F F5(zfs-tpm1x-change-key)108 345.6 Q F0 +108 321.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 +(ork with)-.1 F F1(TPM1.X)2.792 E F0(-back-ended)A F2(tzpfms)2.792 E F0 +.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 333.6 Q F0 (\(8\),)A F5(zfs-tpm1x-load-key)2.5 E F0(\(8\), and)A F5 -(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q F0 -1.412(is a colon-separated pair of he)3.912 F 1.412 -(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .868 -(\214rst one represents the RSA k)108 374.4 R 1.168 -.15(ey p)-.1 H .867 +(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 350.4 Q F0 +1.412(is a colon-separated pair of he)3.913 F 1.412 +(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 +(\214rst one represents the RSA k)108 362.4 R 1.167 -.15(ey p)-.1 H .868 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 386.4 Q 1.413(vided, or the SHA1 constant)-.15 F F5 -(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.914 E F0 3.914(;t)C 1.414 -(he sec-)-3.914 F .379 -(ond represents the sealed object containing the wrapping k)108 398.4 R +.15 F(pro)108 374.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 +(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 +(he sec-)-3.913 F .379 +(ond represents the sealed object containing the wrapping k)108 386.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.72(.T)C 1.72 -(here e)-6.72 F 1.721(xists no other user)-.15 F 1.721(-land tool for) --.2 F(decrypting this; perhaps there should be.)108 422.4 Q(Finally)108 -439.2 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506 -(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 -(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 451.2 -Q F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 398.4 Q F0 6.721(.T)C +1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 +(-land tool for)-.2 F(decrypting this; perhaps there should be.)108 +410.4 Q(Finally)108 427.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F +-.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F +17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 +(keyformat=raw)108 439.2 Q F3(dataset)6.107 E F0 .107 +(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 +(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 +(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -463.2 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 480 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.555 E F0 -6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 492 R .729 +451.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 468 +S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 +6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 +(command succeeds, all is well, b)108 480 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.147 E F3(dataset)8.647 E -F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F -10.312 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 +-.2 F(with)108 492 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E +F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F +10.313 E F5(keyformat=passphrase)108 504 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.606 E F0 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q -F3(backup-file)6 E F0(Sa)203 573.6 Q .353 -.15(ve a b)-.2 H .052 +F2(zfs-tpm1x-clear-key)108 520.8 Q F3(dataset)7.607 E F0 1.607 +(can be used to clear the properties and go back to using a)4.107 F +(passphrase.)108 532.8 Q F1(OPTIONS)72 549.6 Q F2109.666 561.6 Q +F3(backup-file)6 E F0(Sa)203 561.6 Q .352 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 585.6 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .639(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H +E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 +F .694(This back-up)203 573.6 R F4(must)3.194 E F0 .694 +(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 585.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 597.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 614.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .638(Bind the k)203 614.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 -3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .638 -(hange, the wrap-)-3.139 F .462(ping k)203 638.4 R .762 -.15(ey w)-.1 H -.462(ill not be able to be unsealed.).15 F .463 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) +3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 +(hange, the wrap-)-3.139 F .463(ping k)203 626.4 R .763 -.15(ey w)-.1 H +.463(ill not be able to be unsealed.).15 F .462 +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 638.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q -F0 .046(By def)133 691.2 R .045(ault, passphrases are prompted for and \ -read in on the standard output and input streams.)-.1 F(If)5.045 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.595(is set and nonempty)4.095 +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 655.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q +F0 .045(By def)133 679.2 R .045(ault, passphrases are prompted for and \ +read in on the standard output and input streams.)-.1 F(If)5.046 E F5 +(TZPFMS_PASSPHRASE_HELPER)133 691.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 715.2 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 703.2 Q (vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 732 R +(The standard output stream of the helper is tied to an anon)133 720 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-10-g6a143b6)72 +133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 +(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E(tzpfms 0.3.4-13-g43bba23)72 817.889 Q(February 28, 2024)83.018 E(1)183.837 E 0 Cg EP -%%Page: 2 9 +%%Page: 2 4 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 36.913(ZFS-TPM1X-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 34.412(anual ZFS-TPM1X-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q +-2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 136.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +-2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 124.8 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B +(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 -177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.73 E F0 .23 -(suite connects to a local)2.73 F F1(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F1(localhost:30003)2.729 E F0 2.729(\)b)C 2.729 -(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 F(the)2.729 E(en)108 201.6 -Q(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .11(The T)108 218.4 R(rouSerS) --.35 E F1(tcsd)2.61 E F0 .11(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E -F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 -E F1(/dev/tpm)2.611 E F0 2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1 -(py)108 230.4 S(ing one of the earlier ones with, for e).1 E +1.666(TPM1.X back-end con\214guration)72 153.6 R .625(TPM selection)87 +165.6 R F0(The)108 177.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 +.229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 189.6 Q +(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 206.4 R(rouSerS) +-.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +218.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 247.2 R F0(The T)108 259.2 Q +(See also)87 235.2 R F0(The T)108 247.2 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 -(The TPM 1.2 main speci\214cation inde)108 276 R 6.915(xa)-.15 G 6.915 +(The TPM 1.2 main speci\214cation inde)108 264 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 288 Q F2 1.666 -(SPECIAL THANKS)72 304.8 R F0 1.6 -.8(To a)108 316.8 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 276 Q F2 1.666 +(SPECIAL THANKS)72 292.8 R F0 1.6 -.8(To a)108 304.8 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 328.8 Q F0(ThePhD)7.5 E F2<83>128 340.8 Q F0 -(Embark Studios)7.5 E F2<83>128 352.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E -(https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E F2 1.666(SEE ALSO)72 439.2 R F0 -(PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E +.15 E F2<83>128 316.8 Q F0(ThePhD)7.5 E F2<83>128 328.8 Q F0 +(Embark Studios)7.5 E F2<83>128 340.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F2<83>128 352.8 Q F0(EvModder)7.5 E F2(REPOR)72 369.6 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 381.6 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 398.4 Q +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +(https://lists.sr)108 410.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E F2 1.666(SEE ALSO)72 427.2 R F0 +(PCR allocations: https://wiki.archlinux.or)108 439.2 Q(g/title/T)-.18 E (rusted_Platform_Module#Accessing_PCR_re)-.35 E(gisters)-.15 E -(and https://trustedcomputinggroup.or)108 463.2 Q +(and https://trustedcomputinggroup.or)108 451.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ -r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q -(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q +r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 463.2 Q +(able)-.8 E(1.)108 475.2 Q(tzpfms 0.3.4-13-g43bba23)72 817.889 Q (February 28, 2024)83.018 E(2)183.837 E 0 Cg EP -%%Page: 1 10 +%%Page: 1 5 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 45.793(ZFS-TPM1X-CLEAR-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 43.292(anual ZFS-TPM1X-CLEAR-KEY\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.008 G -.25(ew)-3.008 G +(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(TPM1.X)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q +(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G +(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM1.X) +2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F -.25(va) +-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E +/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 +(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm1x-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1 1.666 (TPM1.X back-end con\214guration)72 247.2 R .625(TPM selection)87 259.2 -R F0(The)108 271.2 Q F2(tzpfms)2.729 E F0 .229 -(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 283.2 Q -(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 300 R(rouSerS) --.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -312 S(ing one of the earlier ones with, for e).1 E +R F0(The)108 271.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 300 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 312 S +(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 328.8 R F0(The T)108 340.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -931,11 +571,11 @@ F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F1<83>128 446.4 Q F0(EvModder)7.5 E F1(REPOR)72 463.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(December 4, 2022)83.023 E(1) +E(tzpfms 0.3.4-13-g43bba23)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP -%%Page: 1 11 +%%Page: 1 6 %%BeginPageSetup BP %%EndPageSetup @@ -944,15 +584,15 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 -(wa)2.69 G 2.69(se).1 G .19(ncrypted with)-2.69 F F2(tzpfms)2.69 E F0 -(back)2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .191(will unseal the k)2.69 F -.491 -.15(ey a)-.1 H .191(nd load).15 F(it into)108 165.6 Q F3(dataset) -2.5 E F0(.)A .236 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .191 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1(wa)2.691 +G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E F0(back) +2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 F .49 +-.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset)2.5 E +F0(.)A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) -108 182.4 R .236(wnership, if not "well-kno)-.25 F .235(wn" \(all)-.25 F +108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) 108 194.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E (as set.)-.1 E(See)108 211.2 Q/F4 10/Courier@0 SF(zfs-tpm1x-change-key) @@ -960,14 +600,14 @@ Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 109.666 240 Q F0 3.208(Do a no-op/dry run, can be used e)131 240 R -.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) -8.208 E -.25(va)-.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 +8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 252 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 268.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 -280.8 Q F0 .046(By def)133 292.8 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.045 -E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.595(is set and nonempty) -4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F -F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q +280.8 Q F0 .045(By def)133 292.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.046 +E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.596(is set and nonempty) +4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 333.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -980,23 +620,23 @@ F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q 381.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F0("ag)160 393.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 410.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 410.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 422.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 439.2 R .625(TPM selection)87 451.2 -R F0(The)108 463.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 492 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 504 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 463.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 475.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 492 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +504 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 520.8 R F0(The T)108 532.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1011,11 +651,11 @@ F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 638.4 Q F0(EvModder)7.5 E F1(REPOR)72 655.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(December 4, 2022)83.023 E(1) +E(tzpfms 0.3.4-13-g43bba23)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP -%%Page: 1 12 +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup @@ -1024,112 +664,112 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 -1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A -F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A -F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.32 -.8(To n)108 -165.6 T(ormalise).8 E F3(dataset)5.22 E F0(,)A F2(zfs-fido2-add-backup) -5.22 E F0 2.719(will open its encryption root in its stead.)5.22 F F2 -(zfs-fido2-add-backup)108 177.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E -F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.055 E F0 -.1 -(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555(viously encrypted with)-.25 F -F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .554 -(back-end w)3.054 F .554(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 -235.2 S 3.059(yw)-.05 G .559(ill be freed from the TPM.)-3.059 F .56 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 +(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) +A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) +A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.676 -.8(To n)108 165.6 +T(ormalise).8 E F3(dataset)2.576 E F0(,)A F2(zfs-tpm-list)2.576 E F0 +.076(will open its encryption root in its stead.)2.576 F F2 +(zfs-tpm-list)5.077 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 +E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G +(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 +(\(8\) for that.)A(First, a connection is made to the TPM, which)108 +194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 +(dataset)3.055 E F0 -.1(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555 +(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F +F1(TPM2)3.055 E F0 .554(back-end w)3.054 F .554(as used, the pre)-.1 F +(vious)-.25 E -.1(ke)108 223.2 S 3.059(yw)-.05 G .559 +(ill be freed from the TPM.)-3.059 F .56 (Otherwise, or in case of an error)5.56 F 3.06(,d)-.4 G .56 (ata required for manual interv)-3.06 F(en-)-.15 E -(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 -264 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 +252 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 (OPTIONS)2.794 E F0 .294(\), and sealed)B .588 -(to a persistent object on the TPM under the o)108 276 R .589 +(to a persistent object on the TPM under the o)108 264 R .589 (wner hierarch)-.25 F .589(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 288 Q 1.603 -.65(y, t)-.05 H .302 +F(wner)-.25 E(hierarch)108 276 Q 1.603 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 300 Q(The follo)108 316.8 Q +(the sealed object with.)108 288 Q(The follo)108 304.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 1.263 +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 1.263 (identi\214es this dataset for w)3.763 F 1.264(ork with)-.1 F F1(TPM2) 3.764 E F0(-back-ended)A F2(tzpfms)3.764 E F0 1.264(tools \(namely)3.764 -F F5(zfs-tpm2-change-key)108 381.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) +F F5(zfs-tpm2-change-key)108 369.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) 2.5 E F0(\(8\), and)A F5(zfs-tpm2-clear-key)2.5 E F0(\(8\)\).)A F5 -(tzpfms.key)108 398.4 Q F0 1.509(is an inte)4.009 F 1.509 +(tzpfms.key)108 386.4 Q F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 (wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 -410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +398.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 (tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B -.866(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +.866(be passed to)108 410.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) 3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) -C(r)-3.365 E F2109.666 434.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +C(r)-3.365 E F2109.666 422.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) -.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A -.448(If you ha)108 446.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F +.448(If you ha)108 434.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) -.25 G .447(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.005 +(will funxion seamlessly)108 446.4 Q(.)-.65 E(Finally)108 463.2 Q 12.005 (,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 -E F217.172 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.107 E F0 +E F217.172 E F5(keyformat=raw)108 475.2 Q F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 499.2 R .29(ention into the stan-)-.15 F(dard error stream.) -108 511.2 Q 2.625<418c>108 528 S .125(nal v)-2.625 F .125 + interv)108 487.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 499.2 Q 2.625<418c>108 516 S .125(nal v)-2.625 F .125 (eri\214cation should be made by running)-.15 F F2 1.79 (zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 (ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) -108 540 R .506(ut otherwise the dataset can be manually rolled back to \ -a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) +108 528 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 540 Q F3(dataset) 11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.204 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 +F13.204 E F5(keyformat=passphrase)108 552 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 +F2(zfs-tpm2-clear-key)108 568.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 -621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .353 -.15(ve a b)-.2 H .052 +F(ing a passphrase.)108 580.8 Q F1(OPTIONS)72 597.6 Q F2109.666 +609.6 Q F3(backup-file)6 E F0(Sa)203 609.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 633.6 R F4(must)3.193 E F0 .694 +F .693(This back-up)203 621.6 R F4(must)3.193 E F0 .694 (be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +(nt,).15 E(the k)203 633.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 645.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 662.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.425(Bind the k)203 686.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +-1.666 G 1.425(Bind the k)203 674.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C -1.424(ithin their corresponding)-3.924 F(hashing)203 698.4 Q F3 +1.424(ithin their corresponding)-3.924 F(hashing)203 686.4 Q F3 (algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.024(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 698.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G +A F3(algorithm)203 715.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) .15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") -203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +203 727.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A -F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 739.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 -(", and must be supported by the TPM.)A(tzpfms 0.3.4-10-g6a143b6)72 +(", and must be supported by the TPM.)A(tzpfms 0.3.4-13-g43bba23)72 817.889 Q(February 28, 2024)83.018 E(1)183.837 E 0 Cg EP -%%Page: 2 13 +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup @@ -1205,9 +845,9 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (and https://trustedcomputinggroup.or)108 657.6 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q -(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q +(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-13-g43bba23)72 817.889 Q (February 28, 2024)83.018 E(2)183.837 E 0 Cg EP -%%Page: 1 14 +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup @@ -1217,8 +857,8 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 -E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 +(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with)-2.5 E F2 (tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM2)2.5 E F0(:)A 5 (1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641 @@ -1286,9 +926,9 @@ F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(December 4, 2022)83.023 E +-.25 E(tzpfms 0.3.4-13-g43bba23)72 817.889 Q(December 4, 2022)83.023 E (1)183.842 E 0 Cg EP -%%Page: 1 15 +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -1297,23 +937,23 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .864(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1 -(wa)3.364 G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E -F0(back)3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865 -(nseals the k)-3.365 F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F -(into)108 165.6 Q F3(dataset)2.5 E F0(.)A(The user is prompted for the \ -additional passphrase, set when creating the k)108 182.4 Q -.15(ey)-.1 G -2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 -10/Courier@0 SF(zfs-tpm2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2109.666 -228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 -G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i) --.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va) --.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s) -C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .864 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1(wa)3.364 +G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E F0(back) +3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865(nseals the k)-3.365 +F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F(into)108 165.6 Q F3 +(dataset)2.5 E F0(.)A(The user is prompted for the additional passphras\ +e, set when creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5 +(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF +(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 +(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 +(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 +G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) +.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 +(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 +4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F +(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 (By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ on the standard output and input streams.)-.1 F(If)5.046 E F4 (TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 @@ -1364,7 +1004,7 @@ F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-10-g6a143b6)72 817.889 Q(December 4, 2022)83.023 E(1) +E(tzpfms 0.3.4-13-g43bba23)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP %%Trailer end diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 deleted file mode 100644 index 08a80cb..0000000 --- a/zfs-fido2-add-backup.8 +++ /dev/null @@ -1,125 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-ADD-BACKUP 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-add-backup -.Nd allow another FIDO2 device to unlock ZFS dataset -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After -.Xr zfs-fido2-change-key 8 -derives the key for a dataset from a FIDO2 device, -.Nm -may be executed to extend this to any number of additional devices. -.Pp -First, the wrapping key is extracted as normally during -.Xr zfs-fido2-load-key 8 , -then a credential is made as-if during -.Xr zfs-fido2-change-key 8 -(except the "primary" device and all the ones holding backups are excluded from the search); -however, the -.Ql hmac-secret -is instead used as a symmetric AES-256-GCM -.Pq Xr EVP_CIPHER-AES 7ssl -key to encrypt the wrapping key directly with a random IV. -.Pp -This turns the -.Li xyz.nabijaczleweli:tzpfms.key -variable into -.br -.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … -.Pp -.Li tzpfms.key -is actually a dot-separated list of device bundles. -The first one is as-described in -.Xr zfs-fido2-change-key 8 . -Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -.Pp -.Xr zfs-fido2-load-key 8 -shops assertions around devices in a device-major order \(em -depending on device numbering, a backup may be loaded even if the primary device is present. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html deleted file mode 100644 index e6d3444..0000000 --- a/zfs-fido2-add-backup.8.html +++ /dev/null @@ -1,153 +0,0 @@ - - - - - - - - ZFS-FIDO2-ADD-BACKUP(8) - - - - - - - - -
ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
-

-
-

-

zfs-fido2-add-backup — - allow another FIDO2 device to unlock ZFS dataset

-
-
-

- - - - - -
zfs-fido2-add-backupdataset
-
-
-

-

After - zfs-fido2-change-key(8) - derives the key for a dataset from a FIDO2 device, - zfs-fido2-add-backup may be executed to extend this - to any number of additional devices.

-

First, the wrapping key is extracted as normally during - zfs-fido2-load-key(8), - then a credential is made as-if during - zfs-fido2-change-key(8) - (except the "primary" device and all the ones holding backups are - excluded from the search); however, the - ‘hmac-secret’ is instead used as a - symmetric AES-256-GCM - (EVP_CIPHER-AES(7ssl)) - key to encrypt the wrapping key directly with a random IV.

-

This turns the - xyz.nabijaczleweli:tzpfms.key variable into -
- salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…

-

tzpfms.key is actually a dot-separated - list of device bundles. The first one is as-described in - zfs-fido2-change-key(8). - Subsequent ones also include (identically-encoded) IVs and encrypted - blobs.

-

zfs-fido2-load-key(8) - shops assertions around devices in a device-major order — depending - on device numbering, a backup may be loaded even if the primary device is - present.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 deleted file mode 100644 index 6bd3f57..0000000 --- a/zfs-fido2-change-key.8 +++ /dev/null @@ -1,186 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CHANGE-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-change-key -.Nd change ZFS dataset key to one authenticated by a FIDO2 device -.Sh SYNOPSIS -.Nm -.Op Fl b Ar backup-file -.Ar dataset -. -.Sh DESCRIPTION -To normalise the -.Ar dataset , -.Nm -will open its encryption root in its stead. -.Nm -will -.Em never -create or destroy encryption roots; use -.Xr zfs-change-key 8 -for that. -.Pp -First, a connection is made to the FIDO2 device, which -.Em must -support the -.Ql hmac-secret -extension. -.Pp -If -.Ar dataset -was previously encrypted with -.Nm fzifdso -and the -.Sy FIDO2 -back-end was used, the metadata will be silently cleared. -Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. -.Pp -Next, a new credential of type ES256 is generated on the device (with relying party ID -.Li fzifdso -and name equal to the dataset name) -with the -.Ql hmac-secret -extension requested; the device PIN, if any, is prompted for here. -This mimicks a WebAuthn registration step. -.Pp -Then, the credential is asserted with a 32-byte random salt, -which hashes it with device-private data, and thus generates the wrapping key -.Pq which is optionally backed up Pq see Sx OPTIONS . -This mimicks a WebAuthn login step. -.Pp -The following properties are set on -.Ar dataset : -.Bl -bullet -compact -offset 4n -width "@" -.It -.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 -.It -.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … -.El -.Pp -.Li tzpfms.backend -identifies this dataset for work with -.Sy FIDO2 Ns -back-ended -.Nm tzpfms -tools -.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . -.Pp -.Li tzpfms.key -is a colon-separated tuple of unpadded URL-safe base64 blobs; -the first one is the random salt; -the second represents the ID of created credential, -and the third \(en its public key. -There exists no other user-land tool for deciphering this; perhaps there should be. -.\"" TODO: make an LD_PRELOADable for extracting the key maybe? -.Pp -Finally, the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset -is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. -.Pp -A final verification should be made by running -.Nm zfs-fido2-load-key Fl n Ar dataset . -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a passphrase with -.Nm zfs-fido2-clear-key Ar dataset -.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , -and you are hereby asked to report a bug, please. -.Pp -.Nm zfs-fido2-clear-key Ar dataset -can be used to clear the properties and go back to using a passphrase. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl b Ar backup-file" -.It Fl b Ar backup-file -Save a back-up of the key to -.Ar backup-file , -which must not exist beforehand. -This back-up -.Em must -be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running -.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html deleted file mode 100644 index 68ea232..0000000 --- a/zfs-fido2-change-key.8.html +++ /dev/null @@ -1,206 +0,0 @@ - - - - - - - - ZFS-FIDO2-CHANGE-KEY(8) - - - - - - - - -
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
-
-
-

-

zfs-fido2-change-key — - change ZFS dataset key to one authenticated by a FIDO2 - device

-
-
-

- - - - - -
zfs-fido2-change-key[-b backup-file] - dataset
-
-
-

-

To normalise the dataset, - zfs-fido2-change-key will open its encryption root - in its stead. zfs-fido2-change-key will - - create or destroy encryption roots; use - zfs-change-key(8) - for that.

-

First, a connection is made to the FIDO2 device, which - must support the - ‘hmac-secret’ extension.

-

If dataset was previously encrypted with - fzifdso and the FIDO2 back-end was - used, the metadata will be silently cleared. Otherwise, or in case of an - error, data required for manual intervention will be written to the standard - error stream.

-

Next, a new credential of type ES256 is generated on the device - (with relying party ID fzifdso and name equal to the - dataset name) with the ‘hmac-secret’ - extension requested; the device PIN, if any, is prompted for here. This - mimicks a WebAuthn registration step.

-

Then, the credential is asserted with a 32-byte random salt, which - hashes it with device-private data, and thus generates the wrapping key - (which is optionally backed up (see - OPTIONS)). This mimicks a WebAuthn login - step.

-

The following properties are set on - dataset:

- -

tzpfms.backend identifies this dataset for - work with FIDO2-back-ended tzpfms - tools (i.e. fzifdso - zfs-fido2-change-key(8), - zfs-fido2-load-key(8), - zfs-fido2-add-backup(8), - and - zfs-fido2-clear-key(8)).

-

tzpfms.key is a colon-separated tuple of - unpadded URL-safe base64 blobs; the first one is the random salt; the second - represents the ID of created credential, and the third – its public - key. There exists no other user-land tool for deciphering this; perhaps - there should be.

-

Finally, the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=raw dataset is - performed with the new key. If an error occurred, best effort is made to - clean up the properties, or to issue a note for manual intervention into the - standard error stream.

-

A final verification should be made by running - zfs-fido2-load-key -n - dataset. If that command succeeds, all is well, but - otherwise the dataset can be manually rolled back to a passphrase with - zfs-fido2-clear-key dataset - (or, if that fails to work, zfs - change-key -o - keyformat=passphrase dataset), - and you are hereby asked to report a bug, please.

-

zfs-fido2-clear-key - dataset can be used to clear the properties and go - back to using a passphrase.

-
-
-

-
-
- backup-file
-
Save a back-up of the key to backup-file, which must - not exist beforehand. This back-up must be stored - securely, off-site. In case of a catastrophic event, the key can be loaded - by running -
zfs - load-key dataset - < - backup-file
-
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 deleted file mode 100644 index dd2a76c..0000000 --- a/zfs-fido2-clear-key.8 +++ /dev/null @@ -1,113 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CLEAR-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-clear-key -.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 : -.Bl -enum -compact -offset 2n -width 2n -.It -performs the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , -.It -removes the -.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key -properties from -.Ar dataset . -.El -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html deleted file mode 100644 index 46e553e..0000000 --- a/zfs-fido2-clear-key.8.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - - - - - ZFS-FIDO2-CLEAR-KEY(8) - - - - - - - - -
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
-
-
-

-

zfs-fido2-clear-key — - rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 - metadata

-
-
-

- - - - - -
zfs-fido2-clear-keydataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - :

-
    -
  1. performs the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=passphrase - dataset,
  2. -
  3. removes the - xyz.nabijaczleweli:tzpfms.{backend, - key} properties from - dataset.
  4. -
-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 deleted file mode 100644 index 247ca04..0000000 --- a/zfs-fido2-load-key.8 +++ /dev/null @@ -1,98 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-LOAD-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-load-key -.Nd load FIDO2-encrypted ZFS dataset key -.Sh SYNOPSIS -.Nm -.Op Fl n -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 , -asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into -.Ar dataset . -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl n" -.It Fl n -Do a no-op/dry run, can be used even if the key is already loaded. -Equivalent to -.Nm zfs Cm load-key Ns 's -.Fl n -option. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html deleted file mode 100644 index ffc6446..0000000 --- a/zfs-fido2-load-key.8.html +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - - ZFS-FIDO2-LOAD-KEY(8) - - - - - - - - -
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
-
-
-

-

zfs-fido2-load-key — - load FIDO2-encrypted ZFS dataset key

-
-
-

- - - - - -
zfs-fido2-load-key[-n] dataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - , - asserts the preserved challenge, HMACking the salt with the on-device - secret, and loads the resulting key into dataset.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
Do a no-op/dry run, can be used even if the key is already loaded. - Equivalent to zfs - load-key's -n option.
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index 5f217e6..b1e1c88 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM-LIST 8 -.Os tzpfms 0.3.4-10-g6a143b6 +.Os tzpfms 0.3.4-13-g43bba23 . .Sh NAME .Nm zfs-tpm-list diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index ce75227..f78a71c 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -166,7 +166,7 @@ tarta-zoot/vm - available yes - +
December 4, 2022tzpfms 0.3.4-10-g6a143b6tzpfms 0.3.4-13-g43bba23
diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index 38ca20b..97fb1b9 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CHANGE-KEY 8 -.Os tzpfms 0.3.4-10-g6a143b6 +.Os tzpfms 0.3.4-13-g43bba23 . .Sh NAME .Nm zfs-tpm1x-change-key diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index a09971a..6d01ab5 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -219,7 +219,7 @@ - +
February 28, 2024tzpfms 0.3.4-10-g6a143b6tzpfms 0.3.4-13-g43bba23
diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index 68c8153..dc77fbe 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CLEAR-KEY 8 -.Os tzpfms 0.3.4-10-g6a143b6 +.Os tzpfms 0.3.4-13-g43bba23 . .Sh NAME .Nm zfs-tpm1x-clear-key diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index 3dde7a9..c078e82 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -103,7 +103,7 @@ - +
December 4, 2022tzpfms 0.3.4-10-g6a143b6tzpfms 0.3.4-13-g43bba23
diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index 79c7a76..22d1928 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-LOAD-KEY 8 -.Os tzpfms 0.3.4-10-g6a143b6 +.Os tzpfms 0.3.4-13-g43bba23 . .Sh NAME .Nm zfs-tpm1x-load-key diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index 3054246..14364ab 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -139,7 +139,7 @@ - +
December 4, 2022tzpfms 0.3.4-10-g6a143b6tzpfms 0.3.4-13-g43bba23
diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index 3863fff..721b3f2 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CHANGE-KEY 8 -.Os tzpfms 0.3.4-10-g6a143b6 +.Os tzpfms 0.3.4-13-g43bba23 . .Sh NAME .Nm zfs-tpm2-change-key diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index 2f3a56f..0fd895d 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -265,7 +265,7 @@ - +
February 28, 2024tzpfms 0.3.4-10-g6a143b6tzpfms 0.3.4-13-g43bba23
diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index bd7a35d..a35938f 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-CLEAR-KEY 8 -.Os tzpfms 0.3.4-10-g6a143b6 +.Os tzpfms 0.3.4-13-g43bba23 . .Sh NAME .Nm zfs-tpm2-clear-key diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index ac8557b..582c93c 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -154,7 +154,7 @@ - +
December 4, 2022tzpfms 0.3.4-10-g6a143b6tzpfms 0.3.4-13-g43bba23
diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index ac22463..f672d76 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-LOAD-KEY 8 -.Os tzpfms 0.3.4-10-g6a143b6 +.Os tzpfms 0.3.4-13-g43bba23 . .Sh NAME .Nm zfs-tpm2-load-key diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index 8240d97..0452aa5 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -138,7 +138,7 @@ - +
December 4, 2022tzpfms 0.3.4-10-g6a143b6tzpfms 0.3.4-13-g43bba23