From 9aa68cde42ce577ed26f29eaad3b59cf4bd63dc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Mon, 11 Mar 2024 12:11:34 +0000 Subject: [PATCH] Manpage update by job 1166272 --- tzpfms.pdf | Bin 81690 -> 65637 bytes tzpfms.ps | 1023 +++++++++++------------------------ zfs-fido2-add-backup.8 | 125 ----- zfs-fido2-add-backup.8.html | 153 ------ zfs-fido2-change-key.8 | 188 ------- zfs-fido2-change-key.8.html | 207 ------- zfs-fido2-clear-key.8 | 121 ----- zfs-fido2-clear-key.8.html | 151 ------ zfs-fido2-load-key.8 | 98 ---- zfs-fido2-load-key.8.html | 117 ---- zfs-tpm-list.8 | 2 +- zfs-tpm-list.8.html | 2 +- zfs-tpm1x-change-key.8 | 6 +- zfs-tpm1x-change-key.8.html | 6 +- zfs-tpm1x-clear-key.8 | 2 +- zfs-tpm1x-clear-key.8.html | 2 +- zfs-tpm1x-load-key.8 | 2 +- zfs-tpm1x-load-key.8.html | 2 +- zfs-tpm2-change-key.8 | 6 +- zfs-tpm2-change-key.8.html | 6 +- zfs-tpm2-clear-key.8 | 2 +- zfs-tpm2-clear-key.8.html | 2 +- zfs-tpm2-load-key.8 | 2 +- zfs-tpm2-load-key.8.html | 2 +- 24 files changed, 347 insertions(+), 1880 deletions(-) delete mode 100644 zfs-fido2-add-backup.8 delete mode 100644 zfs-fido2-add-backup.8.html delete mode 100644 zfs-fido2-change-key.8 delete mode 100644 zfs-fido2-change-key.8.html delete mode 100644 zfs-fido2-clear-key.8 delete mode 100644 zfs-fido2-clear-key.8.html delete mode 100644 zfs-fido2-load-key.8 delete mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index a11afb952d256ede2e2a8aa4dee12afe87f68703..4ac1688bd9bdc52848fecdff833a68c83903119b 100644 GIT binary patch delta 45108 zcmZU(Q;;r9w6xi_ZQHhOW4CSZHs7{)+qP}nwr$&-@1HpT%*DB?in^_g$dym7j32OL zf3P}OV8HaB&A*#t$iAnVa&~sf`AJL}*jumiHmqhARZ^Mwq;Ky769=3IF$uxZ?BB_UMeIz!bKgrcHgP~Gup zIfmxBqn=F%WA%JG;IPcgoVu?^{E?qjN3dt$h2$WD^?|peA=KSc*}yYH^JXv_E0XKJ z1Juz>TPJ2n>uT_S>1FWY`j!9l-FDIE`=(XCi{h$O8lu&Ygi%M#RM#$0Q`7xXBekqo zJqdEh{G2$sYR!BlG`}?`O+#9x4wlTPmpHY<17nzf|NVKfwA{<{`>~pbSZNf7eo3#~ zeb%G;ia^V2`EuRY;{k0c2YHqNR%G1V#12tv;aDkRu9al0?ObG=857 zZT7%v|2fHUiY2K(_|roF2qfRlWM z@gP)(6v+>$Mb+kfrGn5x?nPz~w42o|$ivT%4efLHCW07k}XJaHO7OY}4PLIQOMA&NDrVi|@LSE6v< z0GVP9I6w*Ue7UyQ3AaRphr^D<@BN3lmx^B7Qk)|_6Ze=QOcBIgC9%PO0QjyyvaXLo z?U5T|!c+q4#nm}{kkYGvT4HO#c3_$_FZ!_OwYlZZ70ztx8D$W%ZpShYMqrv+EkM#* zZuP~=smJ7p#4uc$!eIw*>bZQMriSt#hX-9isf`QIpM+_ex&)pZJmO7bs%3r~{QN=qWe)n4;#mT_;Q?T^*>HVZPufZ7T@)UadcCyf7@9EnG@Oz}%bR zg643^i=#ct5S1r&f#`Ns?5Qh_J2wRtT~5hH9OIUkh4=u-JUU#H0YVFIPgX?$obDPc zyU>WeVWZ5>x_D1{d81G3A>^!GbUwS}GFC`+mu&^HIqG*PD2f>8KermK#5UJzsi6mO z#)c%a@S z$WuoOcw{w23do-O8#Gy`K55{*b=oSzaO|X6dBd}A#KvJp0{i{H77}QuQY@smDxn4(mSq$@P(eIG7|Df zWQsRh1iDK-fE+THKyX1Z+qOrZM!LKU%}`}$pM;C`f<%>YrNYw%c;TBz`>$N=vs>S* z^*3+Zg@<+T(#d6~OfCH}$@<^%dmHSm5OFvsQJ4ij6eJts1)sGDu$`8tw|+n8JN-P@ zUUd3doK1{5Yw#izj8+v}4`T4=OsN7DiX_tV#|R;GfI(oMP>E;oL-JpFE22&(sTif3 zd2G!;0pM2CVSfh)OMbp}Is4tHad$gD)|u?V@35^Q-Dh?0Nl?t7OyVv2f_;_~N{Sb( z09WOy%{wDk_yGg7RN+0PE#|tdj2M!(T5^i3A@dIcC?I0vE>O%nK>zZ|p_}!FwY#rd zgI4+p09KIn*ueOI8>4di!FddWTplGC=p86&rVnd)C5^@S+lS$jDzyHD@gzUHRLJ|s z2kcpRx^|EXKWb5GD_V^jvFa$)9w>G|UM+aNYi??8t!6qYH0x_*+J9J+pzDFpt;b8XC{AJN^tp1TJxcwQ>9FgY-f` z6ln*}jn@(iuIPMo;Z95DY%|fH@y3pwZ%HLeIv4hGw8fT`6kdt=mC782vkBkXh3_H# zI>$3gy4QP66BW+Vch^bH8HoKjy8^V@0Xew#{i8ApRr*8OuR(456?X;^pMa^?4;w-= zQY6gDSzN>Q%2Q!1k6uN>{Bzh%x_3^rvwMciK*tNWYwhc~u|jDN72#aNQ#JV`u>iYp0?g7#6bsG;7!5ME~B5r%O0L_#ka{UxbUq z;~3tUjs?1$keDzT)&a=a#5|$!n7@zP-t25WrG=`)UxG=Sv06Q(-y1LWcEH0)1Zm$~O)hCzG#kHMa%F$UaWy%mKY9m<(=VZUGEBIR-fas8ONe zk&fAKqgq`$3yZe)cft$kQ=dKOF%pG6GuBJZ_DDo>Ai&Byu>y1nnFj*W1~SJggwOm#BeZxA)DD7q^#=SC7}&ob3zo5%ku7P) zCDr^BO%~k(+BTSZLCR2{SmxW9M6yZCJ+CaINGv|}@(TN=$}dqN=HePju0w%>xQ#B8 zbDz~&18YI{@&Bbz7Uus^BL_1+)Bh(?w*M{BM8p3SI;}15yfuQ{{irE-ez3g+G62_e z{U$U~`KO+o`AA~|`dlWUQxs)|p$?)>TX}U$<%9Mo){{R78%R_pf;Ke?u?4eFPVx0} zwbuKM7S?A5m3=>dbNNDP3L93``nxH z4xIk}i{v);AcE_Wb!|T+V&iQ3yiOSm_Hil=&{hOF%gA*rh`yzmD8v-|G73xRpi{ef z`v&RYYoO-7;7v&=af;opIH%~f45$vf-V^H7%Zn*m$tSIspGU90TI>A5(ydOvkEaDO z@HP;rvu|QlK&D)Yb>+XZsGiGIPiWTL9)qu>UD=j};JhG3oS6_2oOU`GnqB&v3h;ge zynH<@7a!uhE!;=8(r+sCnr+2NtiWo{yvFCAN*mh#T$cdwa3C|%w$Lu!!@Avd?2i+3 z6cT=hb8D~aB{%Q-X2nRRI8JjnPrinSms~!F*!i9YnV_Z?LmCZP^kP4u;j%;qeLfm* zKTU=#NDfcp8)*n)UakTTAQ)of<$cfq?YAkZj12nOwffz@i=s4{87xCcxn$*mV-@Df z%`(A$aV1_lMW(+p+gC6{+9-irhp@S)$bbo@Mk_MB)qf)7wrsur<#^oba2(_lB_{3L z4PK128gBH7%N?F;?&L~4ORl3b->l)~Yi~0xIeX=V5c{`5tk@HY?ZqMH8(wHNv~Z@3S$MxEBYz&oAiJBS6tP{n;Qyj z*K5{*D4O>(zY zA4LV3gC{=bKJt-gG7X*?=QtOl0j+tI6b@MQ(d;W2#eM87)OTrH7Ro#4d<6Gm-AOeC z5`Fr%&I`wtXAKN0fuF4?=Y2}PobKVkX=L37qCHai)o`dv2Q6jhb++c2%(>X$hfbiI zfvGq5dhD;7mlpfJlYd`;XC;+l(xaOuN2*E%j$3rbLV?o=V2~ooToxPE3sGQ#6oe9=z(me#;Wrh zB$KUKeKIb7Hkh^&-2DBaoW-Ky2IqyK|4Qha#jZbT2LX6r5_9HtRLk}*XE28tYON~~ z{d4)DT7uFR5BVg(_;5+t_U~Ued;HzrAeR-$xh?AT<6*=PG~x==I7KEmc3e7bri6e| zZxQYL7!bW#aRZqcC<$+a8_cRMGjy5F#=X?g9h zi!}2J<#OBh5;yfUsQi>*Tsj+6-}e#LkVn6N?IuLHVAecxH&r*) z%n#?OL*WfTBE=3i3D3MwnU~io`H&VGd{=2BJO#eA%d1zB^%SEjh;#s}PJzcM$U2*Z z-R_iyEGa-(bf+qg_zZKBnGCekSu%I)VHD|w3uoAwqdu%)Pl)GU3_O>c$uF?F^6!%y zm6$vXW9BdOYhiz$QM;XXdt0d}%xk(g&9v_TtQY^QFEnV^=Wy&e)xy1P` zowNfV$V8!Q0@8NRJp9(vo{)5<=}t>cmj=jc1;$@WuM3$sOE6!rT_k#!A7!m5sE3Y*Va&uyJ52ne}H+Jbm2;jed6< zpX(n$W}(x#i3#^@FQip$k~Yk-u?WW6izFrpOS%TdB3oFho`J%d6XQx6opetb=jfFl z&HDL0)HBuGxC;h5$4-rZvIOipZna&a-5Q85V0rxPxL=@^)=8O{Wt zO?j_+&;9yQ=~PP?3JRh!?~R$P872J3aMbuI>vHJRKeS1F-l91W-zuveC?4FC8qx*$V{Ck_v`rd4|~W4~kV-2f*M;y{PPAcQx!9LR-@bqJxM0UTUzQ9=Zua z@&N97tpL{|Y3yLfR;qxAxr~_F-rN}=Q6W*XpVmzX8D}ACT5bbW+7?7gG+4H(>%@Nz zqG77~aH7kp<5j(DO*tpB46O=$H{GI-Nruq7oH38D0CfTReyZ_UKqR)yw1iLRA?uuQ zvsuE$BhD`x02^H>Kw3K0&wuiyFymN@y} zunfvP7{SBJz_bS6PaPu`s#2PvsT`FrwK}08pT)jniI~tqL-viDor^to78>jKZA>Yd zA|^$A?7x0ac_cg+>%@8q%jOPn+I?0r36OUzlRIKvPs(L03T;{djn9N!!J|14Dy*lU z^8Ysl2kTEo4A+4#-tSkrrA+apZXN1sqDIa%hn=BaToWW`adkD8%d-mA z_<%W#sAnEj1D;2@EET{Yfv(9NFZUL&?Mk&+OTp^n@-fhM+<0K+NV=m~K)J>Bpnoyw zlGwYdG~|mTZq7v};oK+A9cv{ND;FRdCYNung9V)<#vi<=?Z!K$H(@7R%3pDNfER2Y z!tBzh_EAHwzE`; zWkqp__WI(G#Gr?(B@c4ty+2B<09YS)M0XB1<;V*imXK?0o94rkXTe3vk~E8L-w= zt(kPCW)u6OZ`4%LdeXis1^ws~c1usyn~i^4w5zYtC$rXdBJeBFaGdf?^i0S{}lrI8* z++}0bg8CiIyUu*>&ya-4;HgP0)4K>Fm%R_DRSAqBLV^Rdt@t|NvvuoXXlsIgR?<{b zXeiO+@?Usfg)A)(oKmMtwm*UTDR1}bqBdyWM-_p7lUKIqo**$@gm#BGmh3~1B2$ZkdisSKe5%4+xS|!@b15`n~;|? z+CyB{JaS>*RP%K2YMFSV+)&<)aTFlXLyI2)r8jZk#IcetSzAitDcVvgZH-^30RRci4K1|t&)f_ z{OGpJho}ACC;=hstAGA?2aT&*8KVO4 z`e%Tfo7ert)79v4v8bSa^i`xuRPOr4?J1*y!O!8>)5F8pXVl{4v0#tEk4KM7n`pF} zPu}p^)m4C95e*heer9aGvBU=Fuu)VaB96o^0hc=i8zK#dOY5q^!kT%dfQ$DTfL*`x ztk-3CnWl6e-I+!%=}P{F2}3+6&GCmfb{tSRg%~<+m^E5bTapt*SAHQg@DIN@pm zM-o0=CnWs=6)lp`!y7~98!m^sU*}=W3SS;lF}RZ&!pl9A4{7J==clSMtM`Cl%ehu+ z?>+0M!`t|bW;}sWQgdVBayIff)@@;JU2Q8?5gH?h5yzkSZnpfJAAC{yQ7KoaQ3QC{ z)g^5=TIy$QxYf6R{eVG8_#@XeO3 zNmi0bUHyI z6Bl1cE8|&`130=&90Aw!Nj~%`Yov*4Y31qUq)rscJLZx8#lv(*R<%`e)z0fAW|1UUn==1Xwb{9Lf- zJUSX2T;u8$z!E}-3f0q3a|BB8>+q=uN$QRzfL)3(#SqC9F9M}}htfR* zS0+3ym6LKYp*8`jIu4(;(#cUwN9%xhnVYO^lUKppXL{jTT!Nf~6OBxn| zG$v8H2KlpYrzJXQn3&h*fPrHyh&3VOgan4up~Cfrs&ZzBP!7D|v%}epL0|^u@ z12BDi1JwUF$0aOOg$s1C6>{eVB< zgt{5TCG$C!A8T(mZ+?);CG+wzxx|wr79a#aqMbqp%JuBCrMdiV=?J9|QG{}?u!6fF z|0|=4z=`?(o3%k-rz_1n(%8?I-_%vhlHMEb>+4^=Vpu9lnTZ_TXo@71h_;E0fnZ4-I?~Axxka?{TK`X5TV_Xx?ZoJFhWYF zR(fQs{8vPEJ(JGnt~{^=u>=#7(DJx$*a_wsO|??K6goJN81*0vvRuHS=CX-kg%D67VfYpZX)@ zi=-5Z?-I=I@NwpBtkGR1_5O7%XV>RNG8eZO{`P%k`bbo=7KLAlpU{EApw=w7NRsRd ziu*UC&(U(pWev0jhITK01=XgvsvTOgepKU+t(^+ufaM&9O|&DA)|N%-gn4&|$Lk0G z#=yzfcL}+gi-Mf*qSbBs62QL>k(6;LM(`jN9FH4c$StEH5IgK9LpydL$=!$jGcyC& z7a$njie$0W>ZwI-rziuxQH;)J;l{j*HoLPr~FxR_JE!rge5$BZ~*U| z7HBx)#QNjq|DNM|;Mrn}88(j8C~+z|`jb7_LEXoZ7CaJZ2sNlPh>eWDF!?3ao3>Y{ zDemDtKJy0xe;B-F5KGqSNgcLs-Ssyufc_+h)*zo^YSIVXfLZe5kS%z$ONUk58X^Uw|qbuu`*V zh4|KBtmEC&NPO(=RamM3XK4b3?Cih?VgBPU#JfX7bZfB*0O;#jOAGp_kMV%(=g{D` zh(g16+g5a$mj9_?j83Dr!DI@9X=kS45YkyaKFzw_b8o)7%8I<20-z7w0CU{abnE2( zOP3n!XLy-|P0mIHF&~Hmhx=EydD59ZQGmr&@^~}w2WIJ)wTbNVgQy_757nDcIi(~< zu$6R<#-p{KK~vovxfu2cX*6?_EfTGmPI6Pv&f+(uRuE`PEE)fQxjXCsCG5=HtX%(} zyZ>*(&ieln_F_$Wha(OY@tSX1k0`J|w((1)n7}Knho;%l{4t%N|Fy;#O+#)rRVi#} zn>jhdIWHJTwMT*_RFMhVGo}rH-VAlfDkGouyJ>nP1t`W=1;1}?Tkqz-555Ck43vLq zH}f$shaV_b2v;&g*5#Dsl(Sf}iY&Wzz=%Tub01dwfUmFT2^|B21j6pr+SytAuG<-a z*Cm;QUK3A~%+=O&C-}3d95yKHrO&?ZL*y>(yIE_XXwwV^U4L|uRd0Uxl5CGYkt5T6 zgccN53H5c>gY~TJ6ZPsx+o?$fJ)OhC4+#N0YL*ZdK@^XmrbS^c5QrQq?tZ)epB=Vac;vBPn556`HOW;z6Dw)758$6OU=^(6*$>8>W@$WsN+^)F0bg z`kWC*Cq=EBr9D3EG+;E>$Uhef-m zYSU-x4iR=$U3QxcBrsMM0_l*dlX&+ul6nwvfR8m>H~Iz3J;HefsvFn-d8*JQanTc( zGm3UlI=Na2uJaX5LA~yFeZ4AkpgPMO?^-(T<%E#r& z%&5!f;Y`{_R=<NAUhm?iL*5HeylT8 zK<*Oo9)UzqghuonP!1@BLh`t1p;$}~Omnsw&C)x8%y=J5r;c&g zPhTfBGP+Qbdpo#TpE2o3=>!VlUZqGGK)x62sXR>DoQsR;5hz!11AXmH2)!Nh*&{@0e&*9NH^BiX&0HFg@yY0ZSAZ%tUNXPN=21 zSbvcnEN3pzK(lw})@<~bp&m4zc#y5hLWx!;eqG)qD+x|Z8xanNMiNuv0sA=;GA2Mm z2~@F@F=;MeeXmixBGl%Rgx*3+zS$ZMPD6|L5Dgw;(l$Yo>QSzV-s{p4z}|@Uo<pNDZsix&}gzz+_SvfdXp{ddV+d_7yW^Q!je`SDnZ1f6$OlpWc@gewVXKD zqlWcu2u4b@MyM0Va{dfLh~tel#gkFC)faYcbis$wP~)a8M5u=crM)#&iZJXHG zDsL<&fq0o)+uNi2U76Vrh--u23)r}w{{1iE64fVt;WDu-@I_{c z@|&4DP)@$=xK!K=71a^KKmE-ZED|q8mG5vhv=(tC&r>X{S#{RJVAAL>ZOJrK;OR%H zAyEEK<0gEop&o{|ZUq5KAYm+uPeRq((M@lpIz;b4?cNK=n=QeLeMcG%*3u{zazSR? z{7?m1mb8N!`xrO_c$Sjyz^O+-QT2`tp<}jq%b*HBLd$+~;mRW457KuM=9P z!pJp=v`{FZuGm<*0Ygg;1o@+Q^j~=>r$4+e%i)!k{oVI#_rEdR;EH&z5|ncxY{MeVC2y;?TB7A&pLt(A5yo@ouD8q+l z*{32iUxe^XoTsY}_8so#{-2)qEF!wPzCrpfmB?NDq&9D14jQ8j{MEZwY{4#O zFav`d?i+Yht`HIUreU(|&UVW7u<96D|-W zAI6ytQ-3k_kj?s#!_9}T*)kJtI1Nuanp%aNns(ySlXtB4iEuUtTVJB-Uz4Lh*op3o z*>&@3&Q}CfNqAZA%dIIdu_gbzv&gf9@~38lIAdz!x_p^my{`O}aimD-K-wXd#N_qR z`*mkXXID>AFQCm~MP%L~g9s*0 zW$E5qtZ>WRPVsYjR4Ka2=F{HM$}a|M6?Xnf6}%yzM;M@%Y7YfCnZ>J(>XE7*Gs=jQ zTCeAIu25cNqGFw7H=q1v`I{0X%LWt$ig#`nWl+1L&&Ys5y6VC7GBMrQ!Cc8BDN_4- zxNX@R1~}v*(qs6gQQ%x);O%YQ^!V%_MW!rr&VOF0I@im~GMTX@)St%O-O<%$WZcou z-eL6sCXR&X(EL|5*R23YWHnY()v(M=yFwb(7S{edM}YpgSmi~4Q1H_f#8i%GoQ)Of z3!a3r{&$Rf*wo)A_ds;TRs#5$G}*MV=DkVB4saP?8Snbdd#XX^zKE637dRF#&hzd2 z9)vDNHJtVWfgS#DCTQY>ABWgWE$lY#n0o`WIe5T^<1bhrQD4@bU*f8Lf+QJ4D(DsS z$KD=^c!lMY6W;?fVwZrsm+(qnmF0x8*B}3Lq(0QXr-<{dp^rNv7GAG6Akwl4L7}CT zJ-~bqgpVovhwd``hWfFFg{iv6#_sTRtR>}zS8MrR32Ra0U0po5^$@;4WU}gss0_9< zLP*txd<(DWIt;p5P!7InPN%zgxpO}$1oc@#ACL)8*D&kT4zlOYh;S`8^dO~Ha)Y1X zw?w+?lUoGabVd~&5q)e%s+tPhL|>S+2_PUg=q{LDdxGV8-!+YAvSdm%?OS+0TEW4qnzm+FqZ@95HskB3V_>7 zJrG&^Jf%}h8(+DZaYl&*#-(yTnS|T;8Y!&LVkFl4dww*Zhc%9`50BDM6C9CMj_JN&My9tJrGkaGJt`32NQ^h7L1twzIP89H8jmTNz;%5>Z4}cw z3M`xQQSeo3_3t+VmFVBwutyU)NC0KFE(ZJsY&HU)+@U|h7!x`OeRzm+E@9{GK=)7C zqnof}&Z>s<)vbRIp40Dm3A;<@gOik#W$%`~++$@fqx}+%LVg@?MgfirO`t<9!>Ok1 zQ=aHHcPn&=NU5&wR7UKz^3y{;>p0gWm zc!B5}=W%kADoGWaT;s;Xd10>s3x^ruyOX75t3s+gt}21nw*dpzH&sT**181$rJ_bn z^Ez$6dq%F6|D(=X=c032=Ja2*ao_Ly^KbhI8B!(xcTOH=BW}nK(@c;f#xx_iiCkPu zipk&*R0tn3<3woZL!jAm20&V$P@&*lXB}P-$XG`U|%6JAM)lwxbyQxZmmkQiS>uUnuKECkS)Lrjch?lbBG`%-(v(pFvyCWLzac&O;_p;3MfsZm>3FU;XkEer z#lJGKfv)buRok}2&`aV$VGR)uz&o)n^VV=cY=Ms5Oj{_X2||(<&*N?bsf1UHRYSzL zt1({)fmEQ_v1momtp6zp1kUjO26W+1ne%tcBx_|_5@5lJ09dh3YHHsOA$py2n%{_s z-4SNd*fQYrFn+M``Ynt#hZ631d5iY*Sm<3+Xo$k#2D~$)4(x3yLv+PKqkNC~ ztxEqW{!5=i*2<@!&Nyvx%IivF$LDl=h07BPJu#Rp3NBy;wnZ?$jgiNPbOW zDlsY}c5za90Z>ED72t1yHj|_WGj&LQx2;M|w#~s7?99e8i3av9{{vB&RQGH>e=i#o zMieM5l=(j(vZIh1R+9PYQ<{V=tQ(e< z1Z2%e|CUys?}L0e0Ur3VlOL!~mtvbl2M+Pui&XL-!qDzr$Ndr*t~M$q>ypN8qXf+) zOk2YWpc(?rg5*KDdRRit?Ud4$hovSl)m+KHkG!E~xsJVL(7%l5jBeT84oHfTi#Ql} zDU414J%#xk>BrBD*UY-bG3GqN1FBF#m{-EBe7vA`^JPlI&FCr7lkBdHCdN{#7ot*< zi=s!+`nv&W8wBams^&Gz9?vV#)w#8NY?A&9LdJ}Pzq z*f)N^h0db`dp^Njnw>;xHgWPf1+4Z$`hu1P2gh+~EEyjrJf)J4?=@v(Xd();b z{u+?0j3bl7klt|HM8K|3ZNNWQ1&~^6Etei_3=%v;o`D9aOwD0@bd?v*M#Ot*#ZR0+ zN&~4IotUwoqxRlr8{-V2u?aeFP?WO*7arG@G&hyM5Irn{Wen=OhOw_T4^G?xq#h$0 zbJQ2w3g-@KbhcjNA#jY?9HUHhxNhja=4%?-asb{=KM?c=xdz{DmcZ!QAkH3XA-)uB z#orQG2liZS*;q_}*MP3C+bjicH^(k>;sYj`VRX4UKbc|G94VmUBfV@1*RuH2yX$WUqsgABl;7a zym1%^dG@+^fYHd$NfvoC_6|X)YRTx#_h+5Q@cn(mufY1Qwhw~tB?Hi@P{@qj9)m3X za~g`+pdGTbTAsQTtB6bM3IZXu$AL`qms*i6b3(BPXq*&#!=6(-)0}C5_CAxfaZK}$ z_KU-_0S0>(yrhUxe-um}nmEv@(a2Q!Qw#Dp|(=x^L#1N+*9y`PIu+7dtbk>8ZfJw#5; z+#ZJWu*~OV{i(nNNVDXT0vLdOi>4MvBOAPZjOIQ7@J!L+`OF^M^YzNu^WKU%59oS( z+*In)19MRLCTfk!yshy_7{!|;c5p@a)4RR!UiU4?8S->&?2-}BYN)`$d@@)p3?^Xe zqCzPlG^Jxuso|)05A#ChYhmvuAZMn8&h4og2@>POtoO%J)-Lnyc?S$!Ckpq=V8I*A z1t}V^a`a4S>0&@5l8h_|60Z8PUA6LQ3oLbdV|S;Pj$2W*n1K5&i2U}rbfP<%xyvpE zB;oNW)m4Obq>A48@qw$dfM;TnL^PitQ)5wl9w2!dRj;+!3)(l$WnP=kA=*)D3U|VW zLSpxYe+@)BLH-VL?XN&PaS%EpHGf)XIYqvEs`u3pMvzwrj*QAU|M%RwRF|R zja`1;?R~OvKygyHmM34se4Fe!9tw)1jCJ2`RtUTs;AM^bVeMNypVv5^PkOF1_Khyf z(=84IXS+D3TWWiJ_yrr$&vUu{EwV{ZEnb!$6CXG=c*><~?gECLY-e$tG={}*M4ry= zevjkrei?HJv54ESR7pwhaY)ZR9hq^sFz%Pe-rr#rolz-ncRVN5nQ2kX)$mZ474e7< zDvlDT-VdWV4SM|EFHVkIccZE4PbmL#2Op*stNfI}yDqKkI$E)wzF9!&B@BFn>4P2UF+WjnxBET>$sJE&jIOlwBQFy z{6-rq)fzjPXrMV+@qfIHC}$KiGdkn$G!^R)z~W*#i4awrZi5_QghvM-tG@}mMY(eV zGR6+Mqy!}Q%qTB~A?z@#Oa)!8!OUSWPHT9wik#sxfdHOdg6_Y3Tz@E!4||MXK(gKS zg|k8jOtTnDY|hyEmV#J_0;5Nzc|uNWGinHHf_VP4bY|<)&}Rs&t? z5zfGAj-&_dUH7;0M;g#n&A7`b1%DTsb#AYUI=99bYCvC9rcpir^-U2XpG<&-7IU@F zLBsZeECj^L#vLa(DY7~h0L>p9i#0O^` z29g_XtFl$sBvZa}VGXm&(j1s*=kUxfr6|L6XaL9p9iFZ13 ztwAh5Ph2ZVRAuqg+Rf%8@VtNL6EBFg*Db@Xz){B>NbHZA?J z#>B%VH^U)tYTC>1f9D~>KcAfE;z9+<9}6x$6>coiE9ipOB-T5srwy29 zn!8yuS%A=fjAR*BX6P(`G0f+OB3yqQ#Ezh#EVYr}h8LVw!IeF41M4I`=3TIlbx}nU z&)P|Q37fn=!W*(eA!edp;Q6ejM`dvbC1Wtix>Xh&>6jk6}aWD`Pv*miyMWZkM#TxyJ z)eK3OP9jtg9O?Y1d9Ts`X^WR^w-Q(+B2)zd^5HkPY02ompyLFT1kJ0raz z4FY>S!gWu3%MW((s1{KjZcWxgi;I)HJ{FECQMNzegZ3#*P@dt@h@bP&`!D%wUa~7| z2TD;e80>_0deL%H&T3o6qX2sI?@z@Rf#;)747>;O98!`j7C7v>JBTK+po;RR*c=vA z%8zom(L=ZoEf#UhI^td3r90BBKirT%QLKiw!n4MKnJCS7f+CZmn{zJK6z1E(g&I+c zp>CCTc%W-GRrm7Dv(z)N&78z3%Edf}3OZ3Iyck=j8@BVZ5|OE@3INLBvRq)R;Fwxy zN|)IFwy)mpVs-kqFjz8H#*hkLX=140H^n*EEtJ`O*CSWq_E$%mY8JOet?(+%j;yp7 zQDH6H9>AG8_L9CZ*&@{3dFhB4(NqFk&vETH$* z+2ZTl!8u6XNt+ADrN1+46l6O1{$>Z#+KlA;F1?lfK!&SM;`VOc;rC)}X?KK+`ir=J z`DESJG}Ekw`j!vBFj~3R(&Q~6gPai%pYcgv{$3_&EBl-Y0L$SYA<7`!`gnbnAoX5#Bwm+ zuc>Jq;ia-^mAL!1BPd)Gdz78>>jp4X*TGA1GyD)iXI}|((PUxM^F-iWpYRhy_Rj`0 zBGB(!?P#SW0~p~ui0^~E+LL^1W`(_ZO2tnJGa}f?r%K<+g`C{|1ba2>%Bj zIcPKT%CTA7G~Cy&g%;&d9YoQi|D@IYKWx2obS2%lH5}XSIO*87opfy5cE=~SPdawT zwr$(!*tR=wp67S(JMMSiZ;Vr?PVKSQtg2J{kG)o{IoGe*LQ*UDA+w;IpZdBi`(kD< zH)KqxqeuBh~ zVfw(a<$DP4bqTWp=ru7lFd6&71A7p}e>KZaixO8LND4r^T?pw#ROhQgdL187Fahl? z6F;m`JOkpsB*)#5{rzm>UGS%7h<>OhlC)!r_bFgpPT*(0pKt+-&9$LGGMF!R0t? zO$|b7w4O%+#CEP`wq3GOX3jEjK2R-^_1CQ%ylVCA7qLikbFAE$%a6n_x-X>{$3}0; zjiyR%(u*a=8Dv?~lyb)mk16^o4{y!gAl`*Yuq3w|&%JwEfPs#rbq4W&{vml<`>`IP zt6-18m7o3M^&K}NJsD{5np@)j?wbQKNC zNKmx7xF9grR}5gI^4UQ{m6da}c{1)8X{k5JzehXpz%MRfo?pf#PLbDvWDg%gB& z*4QWlifd7QBB`~2^E64kw_RAqYQ>yzeqZ}jy~lEY&c6?F9nzUlkXvz9^E0R&u__!( zb0`oBAf}NJOgz&a$P-2M>eC-vLqYUB(S^HP+L?k^{f#=TH2BmhjJj99IdwP|hl(i+ zIbIhg@`upwtHj;2!F29jt*a}~bzo_bN~@H{Ks7|)#VIp>xIZuD%w0i!Xn%FUZy`eWf9oZ*{Iv0km!ylroM zw1prF8J&AOR`chm(@*uZcVv?rL%6cr0}`9091WaaF@9T@>Lz{?nR)K!eVc?!A3@`K zZ)yrMTYUPm2n!InFLG|+a7RU3t%#q0atrfBBe?Z`P|h+n29~uG3g9-eVY^PWpJHd@x!%3bGzny z;l19eG@KkogQJtt=3T#Mw%wTvEd;g=^W9mf-yu_?V&=ZJ_dm)jPqt-^)9lbv(%z&# z@~zWcS!8?hQeqi&gome=7{4F*FNh+v156;b^;fy=)Q(Bw3F{%fKr(3$5v4sHHQ%c(mX6Sg6oXf2wgeX@>LHO5 z--bQh3Ha`GwQ^(Xx8a%j82Qk4AwCkHR1)|fx~eV_Qo%PsOh;K$ zXuz<93x+vm)}w<32^w?de?|tGU~$4Kv~p$C?9{&TL4~zNO;LMh_nk*$awl*ExdVIt zE{2;zqSA7`dwAM?eFXrmpnU@XkwtOAS-H7@w4x%w96uzaB2~#?m}~wVd8c0kcDBHF zKN5hn`7U$7;H7bnMUJ?iI2OeS8Xz68_c0=}K3n~r6cCjT*yZ;xBX=K!)Ie!cro_59H4n6aD>;Vs`8z z8FevlBa#jyD+5cB9VfdEg!V~~z$^+OaFW2L3AR|5-y4jxI)dyKKGN^RTcN~Q*I(hX z^3g8o5wXtErfkq+j?f+_LE^(@OYSA2>2GId(a)`;c{GdR5Dy_$mB>tKr`bh_lLIX0 zr9xEIt`*|<8u;ZTlmD36{4TR%E=y;tC2uJfRw40|E*2>>&ue(-Q_q)^g#cNHL7bxH z`}Dn!Mo|MVsB9Tb>2k}ZS9~gy<$HIVdd_-}*xEh$x9wr(%AdPJ4P5OKW(kG0D~2Y! zPi5uq8F@9PELseNY0*E3#F{48rT5-{FZh${j;68|xTNs*bHNKm=`wDnJ z*mv1F?pnVw=>CE)cXihgWYjmHTaH?FZuRiy*O^*&IJ&~R6ZV{Cz_R780vn-KJ0(E^ z4_m2QpzN%0#89gcM!_f;Kq&x}8Y_X-{w7V)+Gc-eDMM4mKfP5PC%0no+hwQQbfF_L zf#!G&uNu3XWTN}{s16a&1kuSWu0IW>DF>U9ZB4}H2LB`)6p*Y6sSB+KTXyJiF_E3C zH3?ZkwEZn0p9qRdRLmQ2Il3P(uGQ){MLyf`5rRNk~sfe#appF0WJ*%Po4?*J=CMWXQBB zfXvLUfL+o*ros5(dt?j1IY0*ben%9djw2J9*@n8kDxVE~<5xX%$oGi7Z<6SK-@!I| z(jwzX=tiv;z$}%rPJ|9$P=BjQS_&ZX&Z(3_NakD9bp>;M1({p&(x*tR>7{h z)(Ulb1%P};yo&gAg~qo`=xF zSYTMiF&JgTb_%2mM5d}lZoHv~F^Ozzhmh6tIHNj8&?S_M^WS=qnUWufjo{K@F6J+h z-pIT`eaHrcvUKQGM#@q9D90z-sk(-x+?Xr{1F%CWT@(A%q+Y06;8x11dpiKb43<{7 z)-C*4(*dFY5tNZs>=&^U%y0hw2+z2in3(?NB?444sb_8)>(q#OHwo99rt#QRnQ`l) zzBi@@v0|O&ZFSSESOkDvGXFuGQW9IoJ4cEhz;|s ze%kr97M%UmaFBOcUX=Tp`~(B(Y|<$2Lt&MXQVa_V5K`4FK!q7PSUm8_jSB3F&d#)V zXSY6DUN)gIO+16yscI8hZ_xAa5`UwREpcUUMv(m`IQ6==cIxQo>*>cm66ni<#&?zB zAXKKX=$K=UToiJBW#Jf(2`vC5REH3Y$Kf}QiPTq?c3Al>(*ygGRQPk|i4fWt z*|OKk4arD)lAGOz$tLg*R)DcSLP&)nME)IGIV`;ERA)Y#3}R(>QfBBPi*#3<@0NWb zU2Y!~m!e3F+$OM&Nw2+WY9SWUkQ!wFWL|*)V6Sd1*l5Yo^^L|bYv0IJ6$-1VsZe~r z)({uTOEiKAMLdTzhkAk#rMwNETr^#VM8N7Wsi_`O95FV^%?NqEZ9~KR$K*5{ z7rm+iu)pA}0kq(^Nesbw*vsu3i!jkm8o2J!6=6K4Q_@9lXJ-Kift37w=xE|=kkZ2n zK$e!hfF*6js!}F5YXdivzt!glN~*fwcuw+Jefjv}yI}czkdNMUbEq$G7lB}!cfXKy zuDa?mL#-*XOntFio?fW4+dGz0yc89G>fh!WDOzTT-MPDHeO}yBdu?i< z5vT1T7riOVee?ksX%+{eFwIO03Zqu0U-SXBPvB$j-#TE)=_v@f4j6L}K9ruH4rUly z5XE0Fh-M^{sH)!=4aOZ@sexE0Vn(8!;!{VJf(#fq(fjS7AOm1^N+-do>Z4<-`CLlL=H;`!fY91+|>c_fvfhtN1_ zbT=|Vi}1s>{TV5F*hFbCjeS~*0U`c2HE*qb{CxcD{nQ8-;I(%B#yL*% zgNF-cODADH8IXXHs$rsmCT+Q`$NwQoxLMdOcH^L>(wXZVOZTJr!QsGsIt+36xblkr zO#?~=1$x~OjR}8cd|5dBWV5p&=ZYkrli5!5xGH-l2qranDd{ItYzq!U!~naI?c zeG+Oq0M9LJE-qTdsAJDt^hAv{jYeF6LpLtl?;v+yQp{nyOS|hWIiase~$zhca@)1_%@11l2)W6+_->fXm75L=s0xV?AAn z!jHk#ESspZ=hRyE_YSB-z4uOP?3CuoU{KnOc=n*bpK zO2mU?+V2*Rx2}&qA?7WyDS%PRxDYH{9L&H{Wf6O=P5X5TED47Xj382>QW1P7^Jkmf z9-fG~HaXks0{7-d>|RZLXKbWpWE{y-fX- z=q83n-yg|2+O8@)K2v9kx2sb%#}u&{Q_<{d8W zW*lvJ3N26%OtKU@_O@|9Y`ZySzB}AD@>cLvFAw={aALOfcJ^{rZCyTZ z3@-ShQZrU{*(q0qBZiV-!!3&hUsQrK`XW)}WS0obwk4xA1K=X<-Q?kdc*qcGV3tAv zY0+q$sJhA_Ib~c)j0Ezx;hL55;v~&d1>6RQU(B7Cuy(sEIssU59Fr8VD`OBA9 z=VU074pY)2YD?5;I3@dA<@H_h)V3mlT4cbO_=7z0%{a+7!)(Y@=Hblip7n6C)L^A! z4rJwoMXIf6P;_Al%LRf0PmrFVCEjeikWvvTyjWQYKfri~9p4@~usXe>ht{g=&@Iuz z0Mo3C@pQHnf+mN1XV|^|8$>view5jYqD1Jj0j8q#VAVd)4ZkJosUYMDmi$mtX(R#c zD$_g0Z#nAVNd7yg1=3L~a0A$Eu-s6#9jH{-j=5Q}ICvlY;81Wp9;(4$uN5aSbAGay zJQ;;!ML_Q#x7c8b%NFNw@EDS3bVB9j{@EGHP$lZemmWX=YS59O8PB0ETX8gj252HV z(zWj(nHJYg=q6M>OV`GC&mSk?Q_sG)tOfw7L8XGxRt7G*nyM=lOL$Y$@Zv6JV``-2a6mF)~}!ck*SgSy~m z2f(Y|$J?b=_m59~i{{jpA1lC@)gW4`p%4t3x2ibm_yyKyRmvJkuaC}8>WupIIZvbm zLuwwmr7|CczZrv1LOS#op)|j0M-=IUOK@Q@PyI)t>|eFT8r5A@byE0%?QqcfgF{p! z_UX?|odLvJ^cRXU{es`=s#2$@Rx-&JV1RQCEB8fh5XwwUFJVjE1-7&n`QXlYtp_Eo za*~M}JjL%wKsNCwuwP*a{A50+0&E$%c3?~A0;A@896QHh2r356`PN~6I&p19`yp7M zjTE?8%I6Y#e_bz$>CqJxW>moqdvMxt4X(UKGeppY4sJEW48U*MO}Bnx4pwz_Gy>EW z3KS?2*D_@;p3|c+f%uZ}nL4<`H&$*A@Bw2h@5;V-JRKT$iIr9D}zqza~~( zuz;U_P1J$`+*y{mDgwsb@&3G z8EM)50#8`}Jg92y60bfopzIX3{bHt{?tEG#mlI5nHYKPo&PB;=lI?sPlWC!sZ-XXX z``#9QV}{w&7a1MBZ9X0OQ6@qA7~OF~%GuLAcglxxG#`&8KNi08kxV40cFih#L$0Wf zlhP;SKrO2xVa&@7#Y-rO!nAH^PG5Q@k%E-NP<53R!&~^J1TE+WFlv=1QYaz+WM%yW zH6-EEaK^9CerVA(QHX|u7>J<(>dlTa@yh)OlO$m}c9A5ghF=B|5M9ofK_l1zUT4~) z?w6CI$Yug65-^nHZ>{_lwy+cYShpjAKH__G^QOXlpwc>WGdbqVU}CRAJ*F$<$awe& zPF&a-VI2fVromtW$hF$*@R;>osVK$351QpZZpI30jFbDmy}q6qx%1DvGS>awhErRY z%Tj>0a}hw0q8c_cPP$oqSoA4~A`T!xmkncVMnCtdO;w}@@-4UNv+3p8tq~@5v8Klk z{p1_!>VBwl_wkoHo7z3SwZ?#?c&S{!#>+o{>kUI4RtYxI!9m(8zPSkgOzSeS9 zUCnH*8aKA2dQ>5eM76FNyABTMp5uyMj~Bx}E}^w4XHu!2s&H-$&;AzX)u#b1tu zkCU!eH;n)(E;6<&%g0uoJF&>I2BkbuN#79N;*A*~oC!Qj!|6+GD=X3KZ{j$%JE5w& zt&RT`EhMW8Ski?9TOpv*QGzW@o;A>x@3+P*Anp&?Zd%3CVBl-7dlOZ0W! zO@iFdm=A;Eq>agvVAC;(#jJt7U12T5k6P8wr9c?EunWn=+X2p3K>-;^$gfkij5PCr5mTi~E8^fzhW_KsW8>T%T zhj1B?M7rMid;;;rOuEeN%uvLJ z@a>@a-Rb3V@L|#V@6+OSZqN41l<`ks`{?gkPPj%0Yw?g1G^V7WUEgSU6PBK@((6d& zJ??E}fL&ffa{fqp!PJjbQtO8DvwWVM$?eh0TnKX51KAm4hpa1$(+`@hh11iuFsYyW z26fW8&CmJzaUK?<6tq|2eqRpT4NqYI_ar9+0%KrZ+`J5 z1mI8ibMYha!B7Sjd5D__ z4d8k#n9%w&VW6wuAyMwYP}QZw0lrv5+RppaLxB=5yixG`+}{*rtc5uzXjfM%I21ig z7ph+zQG?s0Oo`2dcJ-deHhX{B4b!pF?8>O%!-eYv3Oe|RG|(~3W)KBF3AdEf)^D>~ zRy*;#fA~FhzWmKjxtggH7?9TgIC*lYbO3mge=$FHvuqWUsmh(a{)S^BJKW+}TDkt+ zmT+M1Ze7B*WU#;T)Ru!MAmVqh&$Qali0S_H;x?DY4!iZFb=G-4a*8c?-lZmupzA2N z$Z>nB#Qlm__6N@@UW!Z>94n?npXw*;x<{^JXjbr=f^m_)A^C7Xkh-n?nR%N7O$X%l zN7L5vK`{m08i7Zb#+;bs4tCP#(KeEmz)q0|=@c>$4_Oyp?Ym77g@;$k=_SY$Gx~XB z%=qvg8HVZ|t3Ps(@qMYa)`}kbGt}xwHm+=er*BY$v7U(ewW748YKvX)8f1N7`u&B^ z`K%fKe@flhfpOX}5UfnB9KZ~1VL+jlj>A^~Fw}Lbfe;Cjhjkdv+Hdn{mL*}gF_hA{ zkYA~SVd6~oB_I(}P(fAw)-+;p0@z^XOf=54iwZ#;AP!?ay3M-svA8AlOeI$Mn+lk} z7!W-heS=j}NO+;#%ug8~J?BV7PA-qomsJ!~N@BvNv~11d>h`I3OyNvf0QkD_>vd%W zW4uiOf26FEg)>Lt{1-Fj?Pb~_>-pk~nIcEqi!Ut2TR%5J=@v(@z&s^@`nK@Qh~{VJCdH7_@)Jyv zw7)J^8DrJdn~Sfk7645r>gaaxJQ?MVnw$%cKT=m@F)*%t$nK}kS2A&W1KJ7ynIpX7 zsQ-KC0U)y2_ddzH23|Qff~7L9UEOp}Bk3lYGhZBehy=}2hZ;$=zFJ@n&r=47^Cpmr zx2s97^X}v3`?bu9eh(Ci)^(2RuzH|5lUVR};(YxxERE*H0f_5PDJDY8NH>_YnCS5D zV41F;<wTp0MP)-dXgydAJyyyxo00z0dpuk35`L9nfkm9z&?6j|P&VVB2%* z<2Et=FhYi97*|Irn`k5`S59Pz<^D#{qC2?%{TF^9cmzg}?W{%CHq%Mh>738V`Xp6} zaNq}7Q&9uaPe8dHt20-^a2n>%DSic_BG`h!(Aw`~U+TcO?ZQ-A;XzzA6w;|$QIZ~o zs71bN*%#jHYPyr2w^u@gEw&JhxC{0JFnN9mFwKi%Ow4D4s5gGoFy0Y4K1~*(rgH35 z%d-}!plC2WsfT7dG0Kw0=MN-;!YU~&Z&>AWq6&anBft-h9W?w^PLPZa;r6z*GKk7D zZO@T;TRvN{h&kI^KFZASB(fD?c;zUR{L^l1$@U(t zSji($m;l*myVxR+ZwRq0v$q}oE2jCmF4FxT=Gd+6d5rDmM%lrab$pw@#zjV(DCmwaI9N!XyxB7-Z@ z0~_ozJqtHTkLf-tN=hX98p?;?*67~;uk+pH!ESTL-Qe!w!^Mm7 z-}SSXjEt8Hm>S`&NInClwXC~am|u0u>}TkQ*S@pah*AZ@9azP|{Q*#Bk4pOaWvWSY z4cGC@-^#uO?YGLvJ*hvfwKd!9*kEf?L3IEt=Xw=G_Nz~TNqVs8OY*!J>-gi6!${vG zYBM#s8iSo)4IA>#fJ}sZ43y4BpRd8N;2CU_o*V>tg2|8&{c_md4_?IN);d|d80Pm1{MlS4oO z_&)iFe)h?=jZjy>d03b7$awcwX%~xpjy!IeI!)`BXs7Fzm5aX+JcLG{gPOcBofqLl z)?U*Z=dlWjY6IpZD93G+u;PFxz4mcs3`YPB`1y|WTV89v%aJIJdu85z6O=^CW;w=J z`X}x=&jo~DQwCbYvFMU%JK2bjiXLG7z4GKVeAano6Iex=p*TjNt#FVLtYp!-6?g#m z#u#mQq9lVU%M&l~{X3Tgg&Sw1V{ZWcSCEi|`A?AGiurGlpnobZMDAai&r)FK1NzQv zo>w`X-v3P-@r3&u*RD_x@n01C@QkW8rv#;391vFvfseo!7bay(PoqMB-)J+~w^0%} z5))HlurWkCXQexyO$0UwNVcCcZysA2a=ciWEcK#+FB68xOGbi!_)HY=e2#p~u6M*I zxP8d;X6->5ugjevs?8W;tY8QAi@~${?Q!NxG}6Ic)mezc@cX`dF$$ZtA0J5#13ReJqYo8$ zz%&esK*Uyi;9ikUgQONHG$aSfqFh_(ER>9}GImwo#(rzVWe6Sv2@X0(i&&x@2oRa` zN)I_wP&$Aoic-xrbZTlTHZ2q_8kv; z$tYUbgD5hl9(l^9_;+aIT8|FYt9`h82^OM45)5XVxaR|i^9wRSLIR`l>Dp+PGGq(` z9{Y}=`BUB?dggtXPOsa#hHJ2&zY`G4%rMmONeMwMsFjAlpboKDX=O-I5#z!aGB6$UpEAEqU=V6Jok*Gfy!N`d4 zl51+bg_Hn>X|NmoCOQPCsz+^xdb81_#2y!4xz^|&Yo<%&F6hwXSaBHm`)z*zNb0%t zSweRR-t&_M-K8Jyw+ZGw&A9k{`kVIzxO8X&cs>2SJRtHPQQW0Ux@Qq8Sf!MEy1d36 z4FQ!ya?(?~dWG+Rh{Hjmf-!Bp_zYZzYyiASp}zpqjQR4|N!j+1ecEaFvw}|{8%Kn& zX=D->^sdzbHj-v?TzxRhpv}ywKA|IZbd4y)UXewwXu{vh*+J5%5rTN7VXwBiEYodP z3dJ*;HrW}?>xBo-!1dmd{Q0tv5$a%Uc9u)I1M zaufii$=;r65nqfF7?r&2gaZ$UdLL+#j8It6O@+L_Z}+_ztJTcOO%H^@e#s&(E8~|n zQ0?xTxP;@^!&6@B@E5TVv9xwhjkd|YOh~Ugo|Zc;^);03W4q>m9|m9W8hm{H9zOa& zXape50Elo~Co`(W*!FBVrc;P=cZA#1Bne={g`fY!1Jb$_w*TbgXNQ!K0Dy$ zjrWN6kCgDEG9RCRgCmIB-tIH2I-kC}7RBl8ixFE(bxYQk?%5k0(N7aMN|LXYzc_$# zaUErztO4)y`eOH9O5^q?nma{rv{|pV8K(VdX~$VSKfJ@*>XwXOPWRr4$qQAMNpXW4q@J7bPi!+ zZSu-JQ`eh(OH*#M)#eEVl5`=5Hv+tHQ%{~0#0K=s$J&f#IpRPkPsm~R5gzr1Hr!-A zl4lK1MI;MTxvRx!nx6bAJ`n=aTu&2m*!YW(l-{ONfPmg<0H_oncH#fK&i-$L_*bg^ z{}ROihti9xr=uC8BJe6t8?4=(Hf5AMIRa{tqo^*^|*|FkOjU%0IQ8<&;y zpKAbO7h-~P)zcR$fB|L8C<*@I(I~@x6$Ade`_B>Ue~!K!;>$?j^@zW2%+21Fn3)N< zRmKa(!3EUI#{-sDVnJ}iF>@wX(Sx!8jVg(O?-i(MEdPU0ugt;$$HD=;t`Y`i{W9SD z`p&MD1cp~20?R6Sf$J5BkpFFg_uo)J#7ZQH|8o1!AW*5C6lhpU`hP95Dy6`_U@2=j zK{wM%33N)vOvk&H8>_>cBcPqK*l;tP$pn{T_rBl*Oh;bevPwp=)p0H+nYF; zTG?9=bFczuTk*lZb^-MUU(fWoo&icqOGQLlyB@y*6BJm}3=i~efd#fU;{N+vqZJY8 z-53DI!S;_IC_!3*cZl3D*+e>$Cra>JxkjHC>RIle=s=z83I~$;D6mD!5}5D zvSS>Lo%5fk^flA|YgVyyrd-2=vekEWhC=`MzaTR>2t*yS0tO7x0qcgefM7=gXzc$^ zyZ_e&m3y;h!4=YU-jrPY_67MVRMz|P?l880!%B5QEMs3MVr36nj z472Pb6tqMkG%0m7;$Ui_KE7$4(bPqx-ih&+5Cq z_HF2l#wXm%BfqZ?R#Z)fSdC@{_2tfNZv{z5F1PM5ItjXmZM_49%a}Hjb9g3$?+YZvX&b z`tg%fP#A?_-MFK9`1L&e&Mk5)t%la==Un!FC-s|h+yyoycQJt=v49iPvtsxU%T${d zonY?*N!5nswg>n>9)LaQD6H;_V(+7ox`O~(^`h!I8TB7qW|dmJal}|CVd01ac){>D z0yh*+sVh=+WV#W}Fr3DyJMwfCeBpp*SOsI)9dSDHj);o^-eBa~AWey9H2DGNzPJ_X z3SxIu+K9~o8e`nSqlxp+JL{ctlP|p@1i38UMW%UzpBXoY(JXITkF`jTNIYRX%cA;3hdhpqQ+!OUc86E>e{vSN&bS>| zr*kw$yvML_vtA5%x^|9tJ^BDjCz{7AJl?10d-av|>lQf~drXwZQ;aUl6EPWY9~%IX z{)So4p z`2N+7xoPKm+V~dH(8>Z*C>Ea9R;YBjL#&1**vd7ab0q<+F{7aBq27Rmhfx?;TqBK% zU?cOn;dp&89?KPpEN(Tm4Y=cab|vo+s?@o2VBy>044Oxu?91V3RHKDes)R4Lht+xl z)y?0{z~Ut3D{{CLZ|P^_F-xYCNRUm##AmpK*txb5Rv+i%2=o}azF{Xqoj&n2(%Zly zS=dB>u>>rFNG_=!UU$I3_T2z5HxjwxFi>4DDAqz4TYRB16K+&60i|vRmry%|Pkma$ z!rNjG_=7&_M^y`mDtLWslM6@}9QIw8YiV0wru}SDh0lY?*d; z(IygTg`rm+pDIn=dEToE0} zl3&4H$F!GmhC+)Zc?4aZnW{vtJ*XZ9nOxZzX;?{(*fU+qDp4qpE5gi$h$7ZY)9+jGlXlO*LWBr zeJ*f$vtM2-mC zd16UHMB1i_1pX1C=4-&A7#UYR$PGuPD}ZrW6e6E-d^`jErt;hhc`IGGKw+)CDx; zddYAs0RzONcl1xx*U)%9uO;A@yvPvMAeLw`u_6NL;2*?C#Q_S{aC0~r;eg%9fzQx+hP zuanA?HqEQm9m_&yT03suCyzF_-Mn;`Vy}1d4)+ez73;a{?(`%Xz8G)_hN~7eQalz| zkpf8CWB}T!&CmR59kpYi<9ZpKyuW4*q$KRL0VM@V$8Wgw1ze@}*RlHxF!Vz-FrVYH z{ti&P!!L@f+2Oha<;-PRbH!J%{X{bU9b!3jvABh(SHU~aDCXhU+;E?@+JH0mgF4Q* zP-$M0bxX;az=GFn2r^>zTja!k1B@0%I2gbwq%?V?C@Etb36T=;ynS~ziRw+cUE5dQ zIkPbMx=fYvg5=i|L;i6HO_s~q;EMkeDqIe}$p+!b&7M!4@XI#0JdZ3Qsgv2!yZnqJw(#mfHp4C?*7nVbIDLwXbQ@CX}O^3+G9Xv za~)w^&7HYOVcN!T1;$0)JR_Dx=UZLTF6l}tv{drJQ#7IF)Nwp*m5QBVW8lwcm`~x- z2m8@HzfH{v+)hTD$R^-o|@8o^141ZY2x5$$1dvx@GN)A#{w=X@gpr2=oKK8-g`zg zuk?)ceoF_sHq-^PVI7{{MBsNs3Dp*@N!Y3R>NUAN0`WwjrpTKJPfWlho%4Ph_8!xq7$&Hu!mGZQ^SV`CO1C@er~z0$LJ#YOUAG!sqGuy_DL9l`V!Ia>p7}*7IY4sk;<1k;|pJ0sNNqV@WWIpe*@?xCb3Qd2QYggCxjSS zNO-kU98o1kYI!2fF%sFwXzKj{RuQ7c5v+jPeNL9w=o@c?ce#Gn7|j z-#<7lskElMEXC&E6~4m)UKOYW*{#c;kLdQHIvZ5)W|~|+ekbl)Ky`Gxke=Rk({5p< z`RK*k0hDR$N5_nJnOmf&NOYVh;E2KCVn}sraWL<&M1W;%#Tcp2x%ne2_PLWIIwEdX z(UAe1I~WW7^W_LKqF8^Ga2HD-` z*JM=U!rxWZ*aDWEXoQl{7}YQrXdojW@9R8-hRG=h3C>~&0|y%497E$tZkT0@6z=To z_YOj@b`gJ+aG2$xg$IcJqKeZALGw5>O!NQ&QS5_O6CawF=-3p3T};!XtM@vTmVgA8MguXh&l1zO@^TF@kcaGH%R62{MXsDnT#g{`Pv1} zbe#tuR&DycbhZ#0Vn`M(XOSdr@*m?;lQf6YWvoBg0Im7vX5XsT4-?-h2x2##A|kB8 z%)U+j-OA(i3>U-855gD=$M1q*U{hhf?Laf}leQ|nruMnOV`J1P)Bq=MN*FtbnG_3c zVygaQ=*tGC(rwyrWtJn2KtgO6curITcN(pbG0N zTYnwkwRqj2?2pLe|H8)(eYfZ64BM!fX0hb8q)49=q@wmrLQvdZEgF!eZJn*G#?pztKk#=H8fIpN{3Lvv+mNE`M5HF^!@02N@QEYil4G)SI zpY5uMPcAKmDqS0CzT1~*E;}vC-p) z@8#~PlXU*Ht$w_s=z5@?eJ|)zA6_?qiV4Ugw?&NnoP}jWTHvnFXy_MH+_UwM&a!ZE z$pH7T(VK`IbK!5U+@?9F)HatW3mQ7O=~XlHe=}bbb1VFc!0=WK?6_VMsQh%}=DzVm zzeJ8q*G27nRT%uBntVsNfx@FSO9i$j%1kn{)rSYR?iF(vlCd#AeYLJbAK1LF+qfK= zq*|1fYW?fyG#bPgT>x)sjGv)7;qA!5Ne|$(OH*xP3yXswt1$j^m^!PVij+Q4N(?W+ zz;3WSuP8)1{=B|2EZ3NTlR`cWrT*cP8fm7-F)%q(Cd47%K9LVf;)0$5_j&L5qMtEL zH*)}rp35s2NlcEc95&aCXA6<43~@&49a~Td2`0R0>F< z-rrsD5J$*e_VfWO7HzLbCNkjKyP_UwrE4}{>#1uFc(DJZgPu)IL1ah^e;3mu<(Md* zU0&cyL3NtJLS2QHsrPz6xdH#gYUECmt6;J}kY%@eZY+2&oehoI{f;vaR*Hmmhon3G zu_)A_wru4QGXZETw3M}sxa3kkf%NeQXgjt56f@CRgueHFG{(RF zoyC;O#K@(*Ca|9cHci=VQ3 z-7z)j|I`c~{pC z(O4UMi5bD-EIpv*f9rD%jsXZgs(=skRI<&h-gJ$~^|EPgDavIN8~HxHBXTWb>jkbv zYQ@ycO992({e4~O<@5y0J$8=DYnaO(9RRt07TI6Uwsn~;4-zK)nZBE!ljIBn;WEEY z@1+A_xmyq%7W%?3JD}A2`BMdSw|dM;aR{5eS$}~QgsPf2gEDq8aR88077x}l)wz}- zw<1u6D2ocl_PJNzlT3f%W6$i9zKkvq=-;3c2S4H?z3Iy%JuNx%HdJt1MNSEJ(LK|^$q!P z0-&AD3o}{?DH@gDm=QlpwgMS!9l4V|j>AFpixxtev_z7FygqM_d zJjjw&-IB}EpsB`W38uzr=C-fY7DfY#ZV82QDiJrS#k!J)r~xXMWkZZ1N=@xxw5)5R zxC9~JxU5a0=r#;Rt&L>y-~wOxjupLk@SmZN$B&~O5H9sJn(-wImBa)lXx^)P%xRj+ z91SxltW9etSKkyCv-hftjhK|iEI!D(lYFsJ^sWD%YT>8a%L zfqG1#Oj?Fq0_`87B5C+yM+v3J8SNh#Y47h5is;)zb+V zW1{nyfU8B$%#Uw0P~tqSgMI_C_1hp9URoeL#^pB6pjx>2ay(5-8mnK7YTjff zZXIqN%{WP6F=O;m{90pLq#Fk{|HIrIU2~lPo)G}gq7Q*Jt&G>aN1zmloJGxrOfaT~ zw-Ac&7togrX3fK@LXI9z#xx`gg_}<|JoVdb2Dq$=Y$4SCT9<)q3y75|wYO8^7y(I3 z`!|pUUzcyhok1#7a3VEkIKBfnZ|x!2|bs zY5|DzT!9M`6GJMWEPds)Qk4tXEHiX+&D{E1QrQFhyfly{Z=>WMh{xu`G&|{Id}hug zwlJUKJ4Fv?_vQ+|fuI$)cI6IlEuRk6!-V*Q`olrIFehCfCG}w%)%`%0iW4{m<(c=G zc(FvRbCpF%`m;}IqBzoZkmo#K8?Nwg-wnV+=8WVQ;mA-%qv5efP{q;rnbk*|b|h&g z;Ged8QafbCb?RJ3DmGl3^0%?|uO>5?p{$(gb1gLc_8cE_EGqUw+C{C>{d{Gm)rGrk zxr`bEmDu@;GJE;Tgz7sf#*?ZY0xSylP@6tDV!fl3RrUhs1b`LMcz5oOKj0AlEzy97 zw-d>)1QPXE0%`4%C(2;MZ7FT;BbX{@uEk7h)9L1UUfP}@!`kel^-m~`JK519rZWn( zvYJz*CL8!iP?*OxubH@f07XiUR%x9-siKOWN3VOQIi^xdV@R4Eo(|{rVV?Uv1*^DL z0>2ZohFUs60J}RMRq1H)uwlw<#stt2V?j}SwFa{s?XaIZdNgBO5p4UMXI3+EZFKGft>4!r;e=hz?`R4?&l!6{^wPR*WyTR8^w}@n(ekD^ z_gydqjD5ZjMYUTa-z&HQHOo^>s@lZ=#6 z$H>~}HLtTpq2ynU5Szx)(c^%1=usoi+zKNn&f}ti`}bcSjzd_juPc=?=PoYgUjJeb z5rpSlEyT=USHS&C&#$T~e8=+F9sI-;#S@DrEv9x(QJx!J3s8=YaQ444mFNq03q)&4 zVbTq0Y-g&p^#a12uoRoHDD6L`n3=tB)on-~kLw>l?4|xT1E9Ve^lxdIYX|c;xoRuv zb+ct*?mb77lgEfD!*eD*vmM&lK^Q}tuh$m0Vb;fjTfiemQ@3o~o+by|ejZ1smCBe2 zBTiZ*N}j>|X;d^^sRozQx8r>ZkV0?zCqd-L2%-wcl+N7H`i$z7{lh z{gAm3VxDfrk1BMZd&l&|0O9y&EcG%a79YOB#x$MWmiL-2^-NWrnbNrCF_BhmHSM9{ zf?rWAWeD6hAt$lUxKMj0IcCnm!RBcLQP90JO7KiYL6@^C_%NVvM!7jDH&=5pf*)q) z!zQ3IbUlkE0O_(bn{hnK{gQ81DY{wFYe^kahmh{0>%L+>T1@RHl6TgjA3kxYYD%g6 zu!R|pcfdiG#-jXem@mREHrbZ9B61iV(W|y3W(w}I>9UoWc>WWTiHMaWs!47Z##Wu$ zE$j5!Ia}#&lOyDZw^-1)$SKaWqzCcyfX==ro{e~4?zh1dHxESUeqyHU%hkfy%f=5p zPmcq>>_Z_D=}*MIROE~WZmFl&tLI`CJZOtq(r=uim16<6-2h|rl`kjO4$qAO8 zY;wZ)vZ5NmKG)f`b)=F@FrtJgw*{vktkkz6k4$zllipW1z z8c*Lok@GPWqo;a@`ei~)6uSk5-pZdMK^xb5z8rk)wT8oseLcuOAHwM(Le^0X5va%e zD)k8&cCrws);NkT+39ySQ-O7hl;yknaU~zVDN>#JUWdU||eeL+^0*J+< zGCwL&_nnnWo87q?_xq>Aw;E@Qpyp7~$<8n|tV3Iu$6tsn(LE>aB3SX>@mtm=fQI+N zeJ2qFX$g!cPg++~#uCiCB*9Ijp%Jy_7MoJ6axoWW>njsh6~MLVvI&MTf;Fhh5B4Ou zU8lo6i=Wijnw-wBzmx`EKZ|_G{JzgGJ=%8n(XA2-=QyR@ z0=8#xZt~MR_q4ld=q)6(7DaAU;t8+zjF(pHx{f~*^wFO6lyqxua6wx@2-rb_SC6o0 zq8XH-!Aw`jtiAl`+t6#KO{N&yLlHuwE`73O5U@<0av6MfQoc z;GYOJ=Nxf#a}fP_dgOqwm_Lv!f+0PCpS~o>0eZS7#PMPpz8u7?Z|my*7F>j^=`69C z>_b?hX7~i6HM-z|tK7K#;tatK?xG|(ClE^bc^u*(ku$tKcU7tb!VL|A^kXKjGk_im3{R~CV-~<#EKP9gL`g&%FR~;)_ zilCjdTI$G+!m&6QnSdxA^o$BQV!I%u-cDA5M^gfm&N^N}#y2`~5YHb~0FPR@#Q=Wa zdOTG;IJ5$6r}!9rfbX+Au^uAqkWf1ju>6pLV-H&Ds5)Mak)-JY(nsl9x&= zFnOE|0YBl@2J`|+RJqi+ z)VVYg3^!MBx&L12{>PGNg31;T90dC3a_DPRb@kbq&-BA>v(i%lePjq&GD_A)%U_lb z@1=S^t3oIlGDKB_#6xQL!zkdqL=u^R-sPPnFjO!{s3j~-OP~Ej>9pPZ({rw)%v2Gx z;X%(mg9mL+;^B;%p@w$*qX1tJg(NyM;*5}Lv#rxH^yerXeDxO5=N5499e}*w_i%C} zPs;_(#fU`i?|(u{3XLItMRrzk)VZUABb){zKqG3roRvS*-Y^DwUq8F)=Q#NewZ8^= zbmBOZ|Cd zx)JN!?uy}uJrB#21QIYGqE&0+raqsD?CuHMXqBPdWI5wENSb}N4$;`}WY8S3T)uCA z-Wk$Je-+{u>=6{irPbK)amtjM)%xczcpsM<}@S>bIczE(?M z!QRE+6|=&qd;AFIt~$xgHRyj@=*4U>7@a0k{$U?pocf-6p71f6L$VW|8YPGNL2{%NWR14penkq)+1x~r`ddtdtzl_S4RH>h`*cIG$8ce}c z*((B0d4%W57gfLa)t1DQB2`tzKz8p=F&YY?8sZl-tMMz6_9>*E91Ta(%2nM2B5l}g7lP!CHyjvSyzano$F`3UcTPLgi-(Cx)ip_jc+Q(UEb;qD0<@eP4H-ijbzw z;oQAPq2-~HI$9Z21KTs0+ri0-V0LQhp|x73 zpnnEn-eAmbyXQC1xdUE&kUdr*>qaBohpQDNRNX$Mf1i=9&+4($zPt~2d)pn>%Ylbm zX|>q&5P0=Vj#H8F2S(-ylLg_$Y6t2j(EB4&tAGHMJ$@yuF)KhhW%xX|zHG)#^IS(t z-gw*03HzvSsAv5`obmRt8<9$9yZX~(toHZan+Y6MXfgNBtSP<&T$LRpk_tXi67YC- zgTvXD`pH808?b5k&vIhn#kM=yTr3OifG67h7oN(4ew6BHG?qz&MVzHJ5 zC&(0mOro(4zYId!;(`krMMGy5Oy7M?-lhR0&ZG=8v7rdEA_-+wuFOy!Tj+)*(a)A! z-_2G=X@%>)wtgCeYAk@kko@&Xzy+?_>iJ3ntHiK$VkiMr;{*ox>T}+IPogCP6LI+^ zo&#SBdtms7@Z1T=_5{7Hi6rZp86;faHIg@$bQcws)Gp)G{3e4=&HUk2lZvG-rWtZK zmrPAorxbFx+Bx9%N0=Xlu=ct9mOt@gKFM&?_JB=jVNCh%k_TnA;q4k}WGp;%xYObq zUtkmb!2HUfx*yx-!m-khvo52h$LLy0u0rU3b+fKr?%j&1#+XQ})Qc7QeYK*42wY>Z zSDGJx>&Ig{st!&0NP%+AgFupJFZ))$Bb5dz4v&#msynEe9?K3$Y=5v}!+NZ5@;5?| zf76ocl>$M3RxKkG(Xb1e5-o*4MdTHF(le}NioN;X5NRfBApQJ=eMt0T)DZeg@KsP8 z8de7$4KoBg*O*%}5kHSNb3^1?hObL@LDm31Y7&r77aMtd+JBq)-l;0r*@t`utlget z(B!Avnzir^6%>zu%SoA#7MG$Gx5T{DeV4S}aL!u;yyIYw07Nlrzw?K2y+mX-Wwlt>g;9{L7I+?(g4 zg4-QVhrcWORES-DR}>A8W~fRfIyZoJP!En^G1QnFZlzY!nO~wUty)bG$fRMGaWl;p z9TC=rczd&+EbzK*-GE);d~bdQL1jhLpsc#GTZ!hx(riBnEvJjZ1szH@=6@#WKymuN z41r2eX&*S~$&?}$*Lod&5aFv<5zT8Ba1S@EB}L?I%HmqmhANvtWICR~BP>U4jlO%!Fe=tI zBN;Q!l1$xAH+5&;{GzPbk;GP6?!$ZV|Hkw48;$!g#4PCxlS%%UP^Z+N<@(%TP4*aU zLW3^F!UO}h{0%``20{kk-&&5PgfNKVOWO&cQ*OBM_QAQ&9==*Jku)RBdIdW zxMZNA7FIG>0+DcZfh+oG2J=eqrfi3OBP73|NcN==O?lBvU_}`& zD3g|RCLD`xF_wT&|Hx=>L|yhIn^RC9GNGZ@{nGa{^KRxg_6M{`d}Y;l!obHnGpyY{cin)ky@g)v?rD)`Xk& zek&}cnZlu5?yeKFpST{3LbW&(L5Jsb8J`iKqsO!rP>W%f?i>vio9~3g-k@z^)cL7& zeUYUr>JwjYmbQQo_l4J=I4S7w1-%%+UO#sZQJW0NR9zG39hmzLR$)yqlP+avVP&o$ zfUCJm&jf$FuQ+zbBkn8r&>81L6iB$Tb7IVWmM*t6defY)n8`HlI5Rdd!ZeRtJ%ps) z;&IIn7n(@SoU4#pq=yJp2emkFSYFb`?0s9_uT~`Uvhaj!k(OmFqSLOJX-imF_gM32B=j&04Eo>B)S;@0b%*&=i@p?B|6oaJ_#R=xJf6%N|Y3A3LUVn{XZ6YnXw&hv5;O&sJDGQGJ{ccp zB$~9fDU=hJGXEA^zp-iS&7voA8aF)D#N?ronv1!a;P*sM4{%jim1Q>u;``nVx=NR;wENxTf>7Rx{6d7eSmkjQRW0daxa_q; zgCt}nTKmUkl)x91dXL#=e86XWV8FX43ukkH!@-T~Xtj7jtZC=K4Yo-Fmee_SQqnbU zYrVV!+#5gJhrQ(rgS#(xY@OD!j6u~k!@IODgs-j6SrhsPl+9fwddXvHydV3&Yjw%3 zb`VFyBRNy4cS@MoIPB8Jf9zc1W}(LfCO9L|3J{63*Lk94+b0-4e~ zLlS_d&mvQ=@u6P|slWCdy-~yQLW?H`S1V0k2@Ckg_)T zBioAFIkMibvTC!C=51rvCDF-CgCEBPbomtb$XtlDP(N(x6S8>R4l*J`F+eZg&nHjL z@#R;4RW~tGNota7bpc3F&6K2LSYlfTC{kHaXc#{pu42I)W=h$&?5@A9)??o2ID$QU zOs{&2aH_e(Pj?69-5ui?YKN;KIMtt$;huA{0>qXm>LZX}Zy#&~PxdCQnQTy5M)c8( zwR`p_acrKU_CczY>~GIqOZT*BI$uA;(JUX<()8h|8sRzZwT{X%NmZi63)kHtD>T%R zIffWKedsPfI+>H$rozq!A|*V)(-68DbN7~W)eIZpstS@92A#xaahisXk5*1Ke19)8hvZx5zR2^l(SUybEe|p-22NC zsU7*7w!1n2lkIa$7s%87=|GqPC47_Ifa>%Pchr1z_rmUjZ3jcElg3te(hu2pao&c` znUN(y4?J=HUSgmsMbm4p>k1cxeI6&YS1}?M&rI*EA>dg`ZZ`G_bfQih;jD7kO==JK zOoa&jt&?R(x$3G1g@zvDSUXEC9*QF>Hon1@<0##g&vo3TGMp@XrcSdw$ne9cq*~cu zA1^-YD_Hl>$JMe`zn}=Ji5~Li*y0fM5z@(6j%862FH7@eV3-syUcyl)q~{}ZJ0{;L zcni1=Ddo~okwSEp?%Jg{jbPIoY8cG5$}LfI$tAiF9UX7s@qm_b;u7}^hVUKF$_FF` zE)Qpj>p?0WCbElNG8-67x#5Oi*ZIqJDi7gbw(F)S?ih}Cr(2oWkNo*lY0HV)f+?8E z9S!8P@+oW7J8k0oTV#Je@_?e?f0V8$PE6#9FuLq`A&?PgC1{0b@N~$}*V04KHjcB| z!_ZsiCOIS8QN_-9c_zPI5t;K2rtI7r>FOrx3%7f)UrQR0p}WB0zZX+ z?#=Qe_hxUmQJmMU+@ry@&tG~!C)L@TK6<^Lk)}N|)Y&E-J5KrW0&*l_vv)Yg#d!I> zg)c6A%xi99A^O|J;%YkM<*uIO5r++`x7~=$EY>Rez2909{f8)oP(nd8aojMYPAgcy z{mS%_uiVugMV4@Ec5-5Nfa9<S8jnfAg!_a0#x>mn^>;sImz;OK%VMHJvltr<_W%6NkMCjjsHn-)5yH+er@ABE zUmRf%#T!DOz&+EQ>zSz-2@8_*lh+AMXrVAc z4p=k&>UzNte@tf5LgU!U6NDlEOv1<>`j4FTUH$_N5%Jl1~0$m8xpY$kfxkp0|?d!+!k!+JVGtviq<^b~6YU8whku4Cc>O>ZR&8uKuv3 z6F_^W{k9ktz9=HK#wVIax7RSZU$Q`0&G?oO7(Vr)HbBt%`gkL2GVVjcT5e;_fqmn4 zna7Hv^w)mruY^(%+eFmFDk*1svL0d|x-b!%;dKfJBcJG};J4EU=ec! zt7jNw=wuj}q;U+f4=@aT{W>(LfkdL47=!M+x5_ESE2#rSI@}GHAM58liWXi8{w8%3 zRj)Z~F$kj^*@8QG*xp?&;jkt_vL4L~?lI5GN_zd~@ z5t~o%!)r^zYvOl7)rH%adiiV2QTJy%$C#E+yVWXS)HEM)$LqT93FEr7?s^F22UrYD9)5Qv7&;7v~>qoA&hLJS-*Oxo- z1#)^|kV5hq(XV&TL=}avzez+dCw6@p2bl^qw{ zhB6?+DwKAi>2ul?z6H`yRfiOnJ7`e z{d8pVvx_wI??M&<%S|b@=i&+of}<@P!8Wfw`Dfirz4tDzBEYhrFdOKhj2s+{)t~}; z{oHVYtXy&S*0bA|+2ollgLzh5LEc$-&96(+Giu>GmzoCqH*Pt+d_pjUf*KYEw3>@vc6r^C1FgX#QP!fM3!#D_!O$hraV1sndT2|R!!G7pNg>^&p(o5$ezDj`>ffn9&f@+P8@WIWfIv+*0`tqOg-}vln zMBR8Jggt$wy85&2g`aeCMNkiGtx~mmB{U94TOX=VX-?N3+%$his!nd<(6cFT)1|Pv zYw`J>3pF%(gZ1zhD@A?3B46W(S&AZwoRl(&v`tRs;c4#kE2;l{f!?`e{=W(z!UXpF z=SWZ}EJ5&I`LX&a`d&F<<^Clu^snlpe-!RO6MzpqaPYs1Z#3Q2)y#?DeyyWLk#+gl z3AyepR@1or^L+F3YMr_M<$mEn(!t! z;RSnSWYiS{_xv?fnfoEYRhKCKM~qHiQshj+PIc6pc-)5@ZUm4DskW|3x6eB#r;N+Z3rxc5i4sR*?u zSLM^-jL5RVTZP-_ko5DKIA+-Qi?N;nMB9o|yRu1*vaLK7)b-`Y`nE%M&H6P-Z(~Wl zdLVw~7d~B+u@Kx$x~1I|c$Te`$yk!l7x7&!Eh|=_Q9=#Rc|X4&8<=QRZCo6JD1gJz zuHAz`^y+OOZv_31&~OLw1LtmHh7~OO6+*Xz*tSzD_P zfk3}jj_4E)X`c@wc3~R2Q+{KQgsjw~R}3cZ+ov(+_GrT?h0KGj@EOCX$i_uar2BU# zr(eH1l~8iL09V9m?8whA_~!~_vKn@-F~Hf$w_JCY>k8^joxSvwFlk~Jke;%|tmVDt z7$|Jr)Y8?WC?A{Mmd7%4Qfn$f(UoNb_K_z}^Gya1FD(2-nVIj`MbO7zsjZTAAQnC% zdC`t~MX*24TtNNZ7#<2x!k8dren*SiQK+yuK!A^%*L=&B2eIrL+*->V`K;rD9nCS*V)o_#=> zPZCF_B3bA(C5|jRRDI8r2>tPt^x1inOg?M;cGW_3l3>^h6+9G|y(kvt=<8Cmi=3_k zfqs}%_@{_EGGU1c>AGK!tf!gEZKC-roDCh`+VrFo2J0{G{i9UiBE_%ghuNKc=&{>0 zCAp_I$R^#_BBEasu)TV~Uk}lK?g?F;Z!IJ+)_+}%K18-_wa4bno$7ph-S^Iz?s>P7 zjQ-Jp&4Kk~ z>U1Wlv52DMH1z&-^;{u6Gof_6biJj4(My+nS0>+{^IQgAEMqme*F+15S&L;+kSZ`ocayGh7d| zab8GEc20fnOQA_u%_j=5J3@DU1zP$U2c+}U&iOmnNQ4!ggOXRw(0Y+hhrY$3kF2}>r9Yo%OpMuO|YeUL*N!R+?E5BH=`IZf%SY`x~mm>PIz1oQTCKXBGe;Io^{Rw}qvK+x%_HNCD_ z8{v*=Xk-Zg!a+jB$CJ}cD=yh=7TU~)j-MxDhBrhzCJ4cp@!5PmBL1ar&%1bybu2j& zFS3`~r1N{y{b7N};vU~o7kq+^n4W)A&#ltRF1-fWd05dTxsTqh*};~y-mLZdAxgos za%Xg0TYNf}SI#0Zmf?k`Igga{5-g~g6i6bQxh0BcK%-e$*+PUc+wL%!w9Jvox~SX| zuopEC5~}Z7CJ9>Zm`t|ts-q1rj&5o({f>iAfj#zvmogN)20o|sgu_-Py_XP=CJG6b z>qT`;58$~~@;GBye(h0~yZXrG@&W!3EYn~m$?yEJQ;Q_%YeS{(8b8cX;GyfY&r2N_ zJxCWl=fzab!6z0{K^8&-y6!&xjGsAM5w=W9rvp}tU8$XCa*5(*Y9GsF`GS1M7X1zE zW|xu%zAO<6&fz}~?W1$&b+;#UUBo-&H_Q07ZE3_*A=vuxqtfd^P_mc~_skORp0u2~ zzhz$|Qen&&`@nerZbe*f|3 zIjNV13-`*D4y)>^)MCov@r4u-oa~CE%-D$i`m|@Tz^OGr^7Kyq=DAiF?;KykWX3`P zv^h3Rk$<%q-(cw_K)khML{#RT)-x7k*!2mFUngBsSCD`Hu|53j;k8LHxDR*!`~z3Wh-* z85aH}1M%_#9)0<@j0X&bBp>r2Fu*|&=;I$I|2hhO+7(-J|Ex_tltv_00Z*;EqnC;|Ez|A z{y+i5^VqibHzkjQVZWmV1Oora1rQ7b{XOm=UI6buL;N@Xj~Bon2?vCLfPV~zfx*9r z1jGvh{b39Q^oP+vUeF(T1cE`}z(3;23+DMfc0gY6UrZ_gh8hUs{sVp(H{f@uLA>0+ z-$Mcdf_VNTd%XGlzl#?H0sjk{zqEm1$#3})@Zr4Bzo;?(tsepb{Gp!*{7345V9-Bu z77PZ1e)k*9&HIOs5HJ+>SG4|hl|o=Vf82PuAG;g>9xd+2y!+iiFn}BOhYSdU{2o;> z5CZ&%!=S%i2ZJ7aF#U!C_|d)J5r=}HFi5hm5CS;@G&w^Efkt0K5+*9a%_9a91M`SN zc>$7OZU9(Rlv`2+CIJx_7Z(!v|DK`u7jcf$J0r(;ZjPpA7*Gfh0LEZslu(ky_#f#3 BKPCVG delta 60376 zcmZU)W0NjWmu;E0ZQJHa+qP}%B%icx+qP}nK55(Rx9WD??uh!dcdQ?<*O(*bKK2L8 z`~jj=qttX?(3a{}u(Xp$GX-_Mnwdqlrf4>*n|8M(wCWOZp&1-=+s4r%UCLAT9!isGDqA0DoBgevU6zq3kJ5TWM(<23|AJ6=$!^#Ron6tR~kBNUnH)sYRwg+uLJ-N`8-<4V@g&p=s~G}??*ErOgN-`qm@ zjcnAKk~`(JcLT2dSbNDXxPoVFa308;GMW@9Ua8@gV%ipuBq9jm$MUnS4;Dz`5TJhn zt1eXXK*%F>vZ#gVHE0J|xxkF|J9np>(%p3BX5`|3;iA9XM+R?6|Hf^ zyyhQJ$e|LG9PbmA$*f246Hp@gOSD`wDXh@&yafZi+jgF)cS1m$eRO;6Fv>q_iv3!q zquzVf2sl4&O7b59Gn7&}aU$WKRDgoJ*6HPHF>cW=9TD;adH^h$TB1ci6%X;CpjSb$ zvj!>`6jb#P!Pk^Vu5T8anH!ur)PttzmR;gb%peBWvUA{Q8-|;&L>Rpi_thu7$wI%C zk(PU{{}X~9?=tS4c~Dtpxbc&;Y9bvYhf?Ovcq2o9Ao4!8qyD~^x4*)pCBPHtCUrDG zw4+-G;%@|O1DaNfXhnCf9q177G3Q@H!I?>h@G%N)7^W#%^)PrCBG8VpUoVJVwhRv& zAOt4)ZRT9#h8j~KecLEgRP-)PEb(YulYT5A7pG>$5m{wDuzldPi4ac;X*X&FwV;;j zn295rP2JOT6q71{{ls!4cmM`ySOC0LPq5%m|47%pza40w6MgGFa79!*unJk!lfKqR*Ao*x(KB=QgZ*wi0~fX zP==}EcoBJpOh{{Za#u_R9)!}}4gy$hmAaj%8W}Tp&aCW>*GU&ACIG3aK?`G<-uL{x ztZL3-wr*FUPEM1pxte@NXNYm?$sGi$eUDUs%8X}T$OQZ-y_?K5|B^$k`B8LNh8YRG z2DD4Z)TzOy{#n*J3{TPRZr`kpI~>;n@K}uG1Wx^#u4;oq?a)cwGPIf_H^Kl^2~_o{ zfC^CpTW?6Eu59}B4=|oCgHRn+EviDv_$lxH-CD_i-8)aGP1YxNpQidJlFd`iccYer z+ztf+d|or=O~31h_@aUJa;1?Z0;2*bUG=@ZJZrmw8g{EtN!*GZL)t4%qo^gbj%Sy7 zZcaSvd;b&D;ZiJfIBZ<3&xaL*X}Pr~75T_t%daL6HS|2m_I|@^fDAtS){)U0aB&dR0`>QCe!}L5KNmEpI7kYQ4lp^B0 z<-iiDlB~<3LIj^rw%UjixH~~h)M=+Gs!6_7TwT9@34@p-vKkOFS>mr0#qKe%a~vz4 zL$87aY+B2;0s#N;$Ge_|Kh`mT-R22`qiVRI7sJM!0GX9-L_W@#mol1bVJz$w@d=E{ zc`G(mXOzD8hHpq^L4A--qIOh%q`}}QcQ!*P9Y+DD%a;5*d`5;Em@2XZ!q4}sI+;kt zB6dZmiu+PAZb>4GVbx1@er6vQJTfKHIarv=qM-5U49GDNqnA<2hZ{P`3_3L{$7!G( z!O{g8+FW)gjLbdt(0OQW&B{9CRP6Qy2FdvXhHcG9OXzaJMojt)(B&!KfWVrDM`vQG zKs4H5#;Z(>VuQiBg|t@;bydR?HQu7CBB?z-Q=B%3-iAf9w#21f(L3is4%P&ujo5A+L6Km%QD^1Irty{pDw=vo>;hca*`26e1+>?!(am#?W zc(BFQ!!O|bErfZ9FvM`7)CPM0wN}-J*)*q7*0izmdAYRl^!RxmR(1Z2G~P{XlOMLS zQFm|M==smke!mrG%~>@j`T}kE86&?z4|Beo3b4}xoXAUt2&s>J6G^^Zu!$KE50mXm_W1UN-3Cn1asX9tul z1TeSRdSIGhN_oh##uP25lyn$+ocYB_@Vq=v)JYGh5=LY=D9;j)0Q+Z^)eLEfOH%lE z2lk)=BN?U};~B4F>J-ogOx;AtkIr^v4|k(otRrco`X|B~n$!^7(RvH%io;Vcv94nA zO}QC_Be9Z9(kI`$fGastgzJJ*hA?*P6)bJRkRk{a6-(r&AE&6`LT2Yq_)RK!Sco3ZMAC0K(V$EAws7wkcAUeaJ_#zbl4g26#2$#U7?PTfdYz)#5GcieO2?RZ5hSNxCrGSs@-!TVr#&X!ht!LUxL*gMU{${~6Ta}IF z^C5*$g0`Wz(_JAXevid$e)SOs{!5$G9lWEw7>z{qM?n%H9iqq@2V(j517JP+oq+i4 z3LC8!5p#&5NG0W(c1#{lM*^z9y3RRelwv8)-eb#@Ks?9*NvFr;+C{$vJK4F?7z_uS zI>wfg#3`-%?yR^L{Lfz+1!^c*E3(YL1LqBX)Qlmh8Op8l`avXucnLAQeVUd1MwzqU zRcNDY999yG2WP`M^l*-$8jy3PxFo^0JIqXwe{!j(C%Kz2BT|K7A8p0aphWKkaa^qE zzV#g?%-qz5|f(1n* zO5qW5VtkJt%vhc=608HG`iy@z+{NpPgjNy2fGh^gtmtN^FaZ9I063G4u_#z=dn~x= zREA9z^lfn0v2dj7b9ODkE{?6U{l$!Z%$JF#sjypM+USqQEgEwJG3%;s(}AkVq>Hvj zY;){>nKrCQ8R4S@iE%X%xOe@#9#!f!xh!o;j!{T~eKzdsD`<*UE|U*8#(RcMAKx_+ zY8BjOgA2P2=^aCV0!XoDJ`(k0igelcF9_e`ydMQp(qG*tIA=Sr>)~Qya_hI`v1KJT zRp3}0Bb`!$ZmFL%p$1mfg5cNFSZVcfb8f`LzWtY$?||h{%*|va&4`4p|QkyT1Ghj^?iOk*EAYxh;@BK3sGKKnIdESefYpVEGr)_eAV9G0}a7NYT=9b4MRu7e0Q$s3v8h^`>nD%@$!0BVvj($ z9zB+;KRr#m1%!XKTYD#m?*g7TBR_$Xk(zZS=FC+^1K&hiA{0{ zIO2nbB~n%~PFQQ5n6z4r^s$W&4Op#6yRn zn9Ujw94vbzCC_+Z0(*RqTRa|)0FK5iJZ76N%NRo*XWG&@0X@z?e$PW$QV-^nH}YdOOp*$0M)w)d9+V?ZjD(j98RLW=c6<{VBMVb=Ck{FxBYu68kSxU1f z)SYRB*B%#5AL1F0pUU3%01*1JKAiIZBFE*H`8@=-yM5d|d^sPmvwd!AZCji%HXg2x z>h}Dm73w5l!R<4}a~m!W3%@rw^D@iN-5M6u5isKlUt;pa^FsZDPBU(G`Yt`Z^6&Kw zMESh)^mlw+yuYpez8^|s6j|WBEINRUP0%YmCn6c}DlSJFb}@|X00z`mdaW}y6G&*ZXnGc0?{N$t(NfX z!GELMoHrQbWrAAGfNHY*xk;Gtx-4lk*fL+YUSPa{fKjQ<^@#rGMWX8(jLMZzgo-}X zuuV~Bw%9vv4-sSpJZ7@^n`Nna3rM*No9vbi)0l_)AWk|e1BKjUwVmns;i*QdBjp^j zx(x;$U`2AH%Cud{3NkoVueo)nBu37fx#}QrMI`M0YlLSgfE|&jK!cAK;mc>EwO2no z1tjxeSBSfQgACgKk7Pm<*H#%sq)J-10VNLZq>G{=GK@J6jnQb#TE-s4juJ$xBY zz_$dC=B$%x05*t!j!nBCzP225y3)# z*^z7Y)=uK%^VZRk^(YE8nmg2YB-L$*qGZh@Kh%%f^-@6)_sh-$9iBq~L|QA*V$=HH{SAimnc zZZsq4VJWIAtJ&JSmo=~+z?tkh(rb7e7b1HrKA!R>8w8oFj_Sg?NfeBOa#BS-7sfA) zCM(QG0Sm!Chy+Zv0_vVYSIj<&oPzS|HOW!<1o_$pG}toD{rO1;Vv5J|*wv3$+`~!P zKT^kFoZSC9go^C|W#Q%V+L^^qXu}zWo16Xk-o{Ybv|qy~3Q<@OYA%~H?rxNW;q6!Y z7>&x-;2a6Sv@M_t#(3Qx;q@~uC1CMX1N)WN0BXjY4gRW3)Gj|BW9nG67tyzkXxQ=C z;wdil?|zZ{*C2)u;C6YnAX`f815j3N3tTmcKL5#;hS~Q-)EsObKSG02tHdt|vtEwu z3Z@`qN(}=XNEj8)3B9^n2Ul%09MoJ~tD7jt>hbt@|u)1s8xdV8m!oP zK!mDbFIT~-+zD=_^gDw=Zw+wbZJASLRD!OqaKa)oy3hH7FT#--%plj}u3Fdw64Va( zbb*1zWNfSj6s4Bl)MPyE%UwtlSHYqN6fRfUY^$8k^EyQp=YCfA!fh?oGXDhnrOHE8 zQ{4lx64BK^hk39Z6;%16B7vn~U?b#kKyeTp5x(h3f%?Bm9jY#OY%8noW)4E06TcaWiPS-@scT~2e%X6S;S8~_B5XV`#kKnLmfwgcJucE^;?8F z{ipa6_Ai=B+?Gm19;_RP{i|`3K|`4erADf+Vs*eW$8qTTYx(S?&@u!W;7MzdBgerT zXW5@3pPwAXWd3QnXzk|&>mQW{DIi336%~}!Zk|ev3)}e5X7X`rvcb({6T)I#LVm&u z#SqGl(P~gQig}O1jO9lIhdPxM7cPC6ayA*WfR4S6d6fi4)BImoW;AJpXS|<+jBt-t z5Md2$uJw|Fqav3qfCvIE0R1X%LV8FFbW@`cvrap<1OXO&HZwy&yOeMJN{2O_&l^v||T6H9k2K#HzF@qO?B$^#pX~%j;MkKY8wuWJWuYngGx~D6nu`1+^**Xa zm95}UxvRm1S?`#P>Qp#vuPK#9mTeuL5V)NRK`ZSOXl4w>oHIGF8|qDSYPdSr|n-?l{PrZTbjajFPFjWm238 zP5-+S+mh{mmR*Oc@B?j)j6|0c6p+2y>xQ+YKH;^AhGhMI=BV3@hMGGbdJdUmN5QFr zBq&pn1@QoUz#1B*_9~TzaEVnRi2`~iT1erVXbc;%sM^>j03u%(zzuTtY^cSBYS=X7 z@5X_y_+@mkWIB^dN1U%4vWNd?v0RnUxI>qqGIA6gmJLg`_8Ey=lF|kTzNLt2M|~b@ zBd!R!eSr$u2ECYX;z>TN0s}|j)Xg`3St~Whr~1-PC!_UpWXULRDs+bqpWKm;Zzn_7 zPY~qqwIlyMK!mpodd43SmyfD0U|g zK)2{Vu5#lpD)?;Fk?b5|86Z!!j}*1PHlq5MhapTH(6rWo@2r#1C_10gMwMwPP806j znIx!GTyJrZd&J5~J8#%3%UJ$5h3zn;l5ZYO zMIpwsQoOR^tSUf@JKjJSf6TU7U&lZ+-i)BlEUeAK{h~X8p-a6av{c63OncmcwIIhR zs4;;b{tgk-dd!U|kV>2@=H@b#eaI#oP-q2dOn_|2l+Bwr1ZB+G$SKwHc{@s=H#(q=Jzv&{pdqO-DPvq3@Gt)d)#@hi3Igf zv2o+I&z}m(!qnh&dC8#>Q{+?cl4EeFW9;+ubK~U64B91!AF>bS_`P3g!t@XT^mTT3 zc|TuYAMdQp?dkIY+}wCUOm2;bV1;K+4f5uV%Ns*ZK+P@%50_(?pO$Tzer8k!Qftm| zit%@JQyefJQ5LC9h5^)NO z&@2U=epG1FmFWuxeBE;^t$l$2SIRXGu|3+iT|&0155+y6z<0}Lt9NhZ_sp0St_m2Q z_olM1xoTniWIU!lMucfaMsQvw^CbDyTimS6UOe_h$QZudWCs%>2u?JtOoo`<*n#u< z2ebt%yD$F0ASq6d0+$WvTs}OOr9iev7;Z}JcOA7ElEZNPYA8FX14qpOT158G`jpA7 z%EptEUpmVNX^vt-rDAqZk@@VTo1GA3Zl|-5X>F$v4sKD_p|5FyLj!v zzuJhS@(h>k_f85TEw#f!EKmDv9gibNKlLh25Qe|7OGk>3BiUHA6x0s9w0!NxyJ!=! z5R-BgjEykFQ0B7z%zv}xoI5*n99t$=z77cA9u1;}W>NlEr2Vg~`hPMlC)5AUv@GoZ zJJWI`0h5sdQZ)1&wm8s6^uKAtjRnp63&k$F6l`$XWVV{M4vg0mjq=Gil}V#&CCB6p zUN;GQWRw%lDD60l1r-yzU$yzG$Z>K{tP7_x* zMs$O?Q$mSlSmtNnaMn4AS?;QhNKS(jW0d%MyoI+E+X29}cQer`^@c~l9 z^QFj_F+2=`p_yVwDAqRlacle2Kx7VZ!`amSHHtH(RshKgh;atqm*&ApY z_C{rrH%O%bM9m+YpU$9E%SJ2Ks1vBqc|{ROWhWFO+O=>){Ss+^8)8AqGrt zvrqUYTp;gINSGDU)2@|tYkB)0cjqvlVH;F* zwc`UD2CB(-V_Ck-&ubVp$DQ@-}X($9K z%AeltE|#U*s=uoXt&rIVK(gq7C%F(49IdN9%x-b);?+$p>OKy`csz0Se5+WyeLW>} z@Wibdh~gA4gQ#YUI4@{~!`K7k85T@)!67woC!{4^P!yx&`P!+s(*T`{feSZDlPJ}D z?TfDRXApueBUvMoO%$2|XT1QSW94?F9yT7fgj)DgL3+JDH@_|_)&SOq+*Z$0#A(>LY>6IkH)e0AmoNIv zA>88`wJ2il<;~j?f0tGOS-`qq{ct)0{c*qQE_$I2XY)3P`95As`e4aYUv95X5rr)X zBTl=Y;J2+#!^wt{FW5!YYumek1ZmF{h_WtP*_g!y;@r$C?CN$QZOe=d@$c)q%_)1* z$0qN;wl=1Ie8p>_q;E(xk5iI4PnTqYNJx?n)iRg5IPTY6>_Q7 zGWgHk#RXFdY#D0LF5*qCLdrOJ>I_z{HvzN?B&PKTs_g6o=~S<(`xTkd{?%VK`80z` zGlUneOm>W`tprvs%a2N^@QciO_RpkA+*t$wJZqz z=;MNteLLrQTM8zC@4C}FQE{9VXB9p#3~0MV5S!1qY?v2bYtn1i^1AYM`2r$<)8DM} z*Z-WcG?nitMo9kv*y?T#Iyoc|8blS?M?L~kjB7bKV@9HHV6N|p#Lek{uY~{6oXl)o zEdQf9S^isdBK}8y{(qj6mFfTN1Wh}KZ4MOiz7Gu~u>echD2$3%An;i$j+(9Yd(Sq$ z=GlUMY27;On&yP&U0a0L^IrT1jSoVHP_$?BvJMjPL!RT22!6IjpU4}lop)CKlQqKXK~oj+|VXz;>=q13O-@ZbL3Nip@`?ps*vxC zgJWEKz^9j=pUE%R?{N)!Pfo%}gZ+_v>(_TMFaL2Z>=@k=>ZLN;fxPs4 z?!GZl(8F;}uCb6N+|f-yP4)tlBUb~q2BDAU+6#}2j6G!sT8b}YT>DUoAKHZs?~`V^ z-!kNH8%rs5o0gynMEix9=h=+WvWa|Ge|b<@;9AOh!5kTSOu3oJ&DK&n54~%}DNn=3 zQES#wf+^`C&{97q271?z^0Qb}3;9K-I)oEuJ~Q!|9d%W5I0-ob258Y|y{3&_X@E#) z14<`jR7AXpfTLN5bZZ1m*a#FZLEGTV`T4}lsUbbTt~UdOadBBc;>fShrq3Pz0556s zoB=GK!h>ZT6ySJ0^?tCG6?J($l12M%_I73r>D${fyB1SDJ{0|)THW}}OnYPgtNX*$ z&A-ofCd|nObjSvng`c~G;|mAICHnB2$5)!-7e+X$gAP$6TX9+&PsVFBXAPK!tOUa^ zaCN2V6+3y*fpy9rVT<)d(rT2{$%8YjRT#?6p&3nT%67l*i1h+H$HhJKNnwai%&A^A zE4jWiDJSf9Lw;x|acfEt?cK5HN3(+e66I-3utjyeF0+h96tu@&nos8EJl{)J#3 zCrGpvb)tkfAy#I4iM9bGU%T(!?Sd~&+pj04MOZdAzL{&JZ0WIfL`-ZP;Te z5q#*e34Iaa&!!pHJc?C1O+G4-L_Y!&i%Jn0Y7g?( zFw;@OM^6JBx92*R6YI6|jRW8L0R6dI`9mf}t`aUx@u1>{$0boL$x*yZ8Bu+yl2`-1 zn^D=sg@%XmOu=lnB$6tbm@G!x2y!OIB1d3}n2sRAqy6mHMq5=n%1WvE8Qqv0V!3|2 z;|@abR38g$L!IeMp0a_fgep|aSPQl9E1gM`pL?#?fV&l4Gh9~?A$Ck;MPmO$9{+~zQ)&Rz;@ z%8K;o2To5Ho#lAQDIMIdA}Ds=q{K$g9 z9gJ_!zdZf6kVs33bA^9^r0lJ0Mfx(K1Wq1sX?qR_pIh&eZ+#bq(A#U}2EOR>=ZsAs zlWXTZ3#HKxuRC8(Sr2ko8}7(leF*TZU&@m|AgMV{&8z739O#gLDt>JgpS}IWMQ@Lc z3*0Z9FupI@2v&kbR850<5I<2&NeENSP`OH1Q~>jbb;kZ6 zd96Nd-CjE~sjXV-O{I}wIon^CrQPs{t7w7N#WrNn5H>Tcz1sH78`oQEY^d;$*1Uz; ziOj&%gv9krkoF80ZZmb9TI&ITbB)0-CJeqyPB^a{9M%8fuensJ}Jd(>lGyF z)Wf+L_;Qqn-~+kCS(OEXyQ7r8h#t0e=#3NccHsXFes^I)8LTB!U3QFRk`!`3RNDoLXbW9G1~`i59klv^b#2Ha?32%xwyEOM^M`y(|yW5cxs#lJY9W zJF+92HBnH7Ik{Nv$?>1}7u1RQFV}esF`H5PFI?fc9&{m(9k6OF2kt_&=5z3l`_T{* zl7#OkNC)Z#rhgRj^^)?c*k>tf@I?XeC_WZZC$VdJxG-ZlkHDUVo5(Ir;+ms&?34Y_ zBSBP9ro$Mi72ZJq{ES_6m#A!``fXgMr0CE!8E3j8_LB-x_&WkErJX7}vHM z$!QLFj157p!=EQopJ{|wFGbO4fFtAd!YvSGXEYyDZ0FBzY9ibq6R1?h1)6Ft$9JTW zk5lZwhJwuopGd4oKgICNMlN!%ViCmUJFqAHf$-(X!hbqgy)y7*%8UX}xCl57GCq6M zQE?uh(ku8S+q^3PN1K_bjH+CCtmYKyt!o5)aDMAQlfvi$kRjl``0fp;Y82`n)r3|; zSO^7f9&AEQe%{=G`y~%l>a#e(kYZJpEV|_ivN?4^p|yZYtr^2~MX8p)po+H}1mHjl z_C?CZN+O8Px&^7(jRi&J-enb>r!RYwvmLd<&d|j)taUFykV&>>VXs)w5p>J-@A^21 zgiJugQo)xdF#EJAG`=dn&$_8~Ie~0n((X_Wly;m{{ERvo$6enAVd2;P8M+|$KcQEo z_n-3(a5?zqiWoX;TTy!Kv*{P1lMkj(8p^u`VBdN8GzrCRe2!9NFUS_iF)m;E9%>KX zBQBEg+>o2zTcOF zFLo_IfZy|BVGA*iL>FK+*mskB-dbd1D6F_KpM(&=Q6k0FxT{flB&!?kbo2S;g8UZl zUvLzB0=l5^(ovqP5Jqvwc;)>Lpg7*y1}SLY?asb2%iH1Hs}*%qz?k8mnfze9?Q8Kv zV&~|=eE1=dZUojz99vi*~lop^(KwZ>2ZmIB)7_yCCQCBKE7uc9@S#y4Q3!a%THYtWzc! zC)L9I82CK$7IH4z$Mj7f_M<;U?)Y+rji7GSKZZSlpF~g=^r~0R`E4T8I58RxV#G4Z z?pFKB^>1+?f=Q7ZAKs1m2}@q~$HX*xg|!cW&;Emk^O#-=lS_i765=+>_~NU=Q6E(H)wp3{{C=udv^*jJ)<`GU*OI9KQ4xai~awCH!JJ^axtuI z{~0MWid)&bnmH3C!IS;R^lR!l9CBcc^!_)4CtxCzCVpg>&A9%_X-*o(^@eTEC^V$w zQ74rlh=?6~>~x6wru~ldmWo8FF?DZ~^e4j*%k{qHKGi=#g<%p3__*+^ZA}8=ljWBS z|3PyTP}g}f=jQH{TZWu^9;Tz9DxjLcl4ot+mhU#$rT_9sa{xG$|Nb-Y{PIPSNFQu8 z-P01_cQ#20ouPN(WQT8>-@CT);wsrbakKNQn~Tdjjo;)yds6*UR?9LXvHQ zdZ$};&^3UA3`PX2~5wMC0@%$yh8&@ixCQn}U?8=_HxRfw)F1 z^jqKFKg@gEb)!jwRR17Go^}A{G~zyUw06cstO)0JECEGG7Fu}gnLkP~dshTsn?0kQ zkjU~{NbAEM|1#Nq>Bz{_7uKOqu5Isku8(~@JzadgW|0sE1QA6RThQRW7SSgila->x z*hW4yRS`)g=?3ZY=a4I&@>Ve?k;1;+A#2r{-y|7H!6cme6lg;qP_xO4Y5M}D*rt1L z!i4R`Cjc=*iU~W?ej7Dy*HkyMgjJZ^o|W!Pa4^D$%cyGn-)`?gNs16wc+w?S9)a5% z9A_9g_rUy)JS`4;o_4f28zddbmTORNhgL9O2!TwGM5!yGX}$cr7D$}tIk7J5$Q-&0n7EZ>#q1D-Lfo1n z3&3dnJ{Q5X5uK%@=%{c|kdU5A%&{FjQRQZx$El}_=u9t<2(5mBcfbpMKS~(~200h7 zURHnJ(-0J;b=?YCkgSE3rIkAR5*4(gba-28XJx0Msug=9c+h4Z4mr4VNQD@-8i!ZUTY-2jy6H~Wzz6rUN0bv{BK*vHk>IT{0I_)x@CkuZDWeney?xEf1%QWf{ zs`>%;vyEqkw6;yv{;Lml1-24Z2#4A_^EH{LBnHs+5y!WY>;Ggl#HJBRGC#C^IzXTr z$Nn+nqlZS+-U(*Z$k+Gvi1EwT=SJB3mAmLt`75qrAou4C@=?R;HPC+Pi)jlH%MwKU z8209U>y90c;@_yhMcXyI)__%I&>Wtm9n?^S8dPCK_% zO*GI`J08ZhLnbX44%zWMxTN6zJ^)>#RxAsuBci`e#;}IY(+L*## zyKMCRfq7z;lZl`r=Fp+wMkAM`(L%bETA{%ww4zk;?-tyV8W&|&_ky3>= z+@~??}tTAauZ zR4Sn7F_kfS0S$4*M(-$w%7aN((AW%EHGba%-DfSu%8TtOcFSw85RfKZrq@N_SnQ7h zeZi2ggOBV04^|1hKI8`Jwjar#JxAM+lruC10jJ;63ZqSoCpEav`*s%r;|OoD8H?!w z0hL+Au{7Efi$xC^CgZrO0HD^R0furYy^tC$f34pGajpqi+aY3}PqFTOvi(kt{+r=i zlEpa~2Gpuc1Fps%KRRr+$qUI)@fI~n2NDNtpW=3Eu16;*y1F#)dOL)z-DRKCk%No^ z@gC+XvK#F+W?i(;*MCL8{|)nn?H}Ao8}3e0_l6;k@|ZytGMPX=0dV#U;Rvz(+qB8` z3Ibz$bGm={4djhg8B$qo!!`#r)=+7InBD{THv3t6C=t(edlyp}x(#IWZ|e?tf3g}!oG=wi?gE7yxqc#MwBX~cJ(Cr?8dNL z(K9t^F=m(Ar`h^X=0`(lCyQRF#>)Q9sEK`&nYmNQl6L!c>qRG+d=$uOvjlMLeE%x;EeFUdoG1mkbc+#XKJP1!| ztah~nx4K5H09)-7*vn7#6-r%u*Ff;vx47^;0y&<`bJ;go5N%lP1zInHP+&Hlac zXf6g1C(nOxU<`xtxA*f%1J_mZYi2kd#%>dT-*;`j=dvW4<3GF0w*!otS+ zKWdVdlL+PiO#gpslIy?K^Lua# z98p>Rj&yli@^N;;yn}pPDdvk-5>!OuR>vyv;!#=2beu#Vljkr z*c*thH~Nw^FBr?Py5=YCvD!u5RbhH4LGF<0TZZKCx%w3Bzcgy>gEUel&zF9UjNp&% zs0G&aw?VToBSQiRG+H)nompir#fSE~s2%@F(OxZ;uAz*VwfY;Bhy|f+&S$chdu~@h z;2c*Md?`f<8jX>GUH78HWHjyB?{(+s&4@D%FyQ~Ak&`xFBx6ov`>Ee)E>k0eR>Hz0 z6{!k<1KYmui6;k>9`4-kHpXhHzM={8KSB`1%VEh5Fw+=k`-dx;hFZQ?}@nIJQ z+hsm0>BfH3x1T*a(kuKssO8W~zzaDE-2<`v{A0NhVRI{{g@mWAv|lc&6%FS^H`ZVm z;gVurtq#5o`+SXz;i*UCP1R&K`zABJ5JPe#BbjPu6?;aza>~>k3}Dac>F)C4?elWs z1zRlp8f*uIT30JInOmxvYk7(j#fV_yb~U$4WL0k0S4wHcOoB9!)V^d~He@rvy4+0gehvSH;`qtEk4A~<5IPcLG;kAo4!*OPK?IR`1m2Q3Hf zVo!Irh5GDorJ|P00zZ(FX0(>Ns=1GpRfBdu<_H3eZ`PyJ?=vx8r@#7NiqHn_J(^2g zsTB%|bJ08emWu{f>qMX_B1po^%d)-DP;Z*rhk}2(;3L<0(qK$)XJ>)&KJ2090{)y0 zXO3Zu%)N))>%ml@3f=r2twf3-en@i6qwzNzP}DAJr{mvqpiPag4loa*XHtbnth z>KdX6Bc@(pw(-yxO8rEa1(wq<@Diskly(ldW%HX}k2O1wvwPO+ZsZAF)rFEy7RI7O z0J-Q#LbAs8(f%>2g!rkyUy1}KZov5(d1P0(#NoQ|!Qx1-yy7nx<4%Nj_;jZ3ka4%7 z?}mMZkGG%8EkJL-c6C=9XPRgz5=Z}RmjhPFJf)Me8bYF!-UMRUWOGE5e89WzKVJkq zW*eP{qFRs4#l6X=*6vG4;2cU93q;3GHFF$BFI?15`=(E$@eX3GHjrBO)mhe-m#0A* zJ$>hj%~St`+fKc75BbyXLbO%X&VrYKW93DHVWx|t5-tqWM=P9X$bire2Q*l-Awbiu zJ)1@b5(D&2(G z7bOU*0ij@8L#j5P2}{ARn|ISvJ7?J{(o=h|=mzmTp9m?)v(%1@vhIT*6t%lM6`+f* zLZ_MRUFE)A#>FVh^JGzkGM5KrX_n(Dh#t`GIcNs*7aS9i+qyxluCG7Cch2DC%9_mx zg6tilaFJM0sR>>8FVFn>XfKB7U(hsx5XJr24fnh?oPZt{q_%3;lW*pE%C9L;z8`c~ z${taJ84bws%wS?FH}>SF8!p);YGdqU zKp8^Xh}Y7^0GF}@Z6XNZFSXbjtx{^7eAj(JO^V3 zqDaW?MC8kjhxQ0y?`UVeLZb2_ISDkkMS)hg>Ju&wEXT4ZTp#(RkNH7i7l5;W{x-T> z()xwge5ZkxKPmpYa(q8OoLoPvx}(?C0iDO(j#ZT17LWB+Sm`8uNMbd^AH6)7NBVX8 zyf<<8_^!O1%M$?XDL3-U`eshj9s$$yQ=D~W9!p!ETev>t6IK$Lq3ZDLgaeP|1`T72 zXP|cY0WZ}Auqe(LnfX!d(Rh+R{Qf1te^DQ7iTs-=kO&+O_o5K|_ET;iXK&iQ=P@(a z%Y28$2%i(a_V)$O3;9DZzhu-#bxNV(`@v-puK(78Pb~mAuDuQd`97WsH%{TjlYezd z{xJH@wR9DlRKC`md&V8~`|Z8ouKx-!1iR;sn1US`zZ-#Cy&h~4!8HpUDI8rJRQFvm zDlRV_ui+lHxNWcP7sONM+^YqA!*G`wKh_uzHeey=*Ton5-XHB5$fareVHvUSFm`T$ z52%`TFzLx=yyhyPS~sz>x)v;PGj)#A88pIloQAK1p`e7xpJ@;Gli-&=PB7j*QYx7v zlKgMn;rhS0!^D}C$|(d$QJqrWVnWNY|3=>=o--6f6d+R%NmRBJUeeq_>tt%}hv4OC z1yyPNzL$;^A)wP9h4pm3>3H2vBLEf$Gkk=%(B{V4=8i*XXfxzmgvpk)V2hg$>2^~e z1rtRR4J2mpug3dE4Tc-Hfc*Kw^LFNVrZ{cr4*l8$zrU^3NTCJX;zxptVlVk*a64ww zCGxHiXo7(YmLeR6BNIae*;^CY0u@H!C7}~R4HCC3B#y994`ii>a%M&eHA;ZSw#QyJ z%-=!749zbdZoDnM--C@aj-?rx3_UO%Q0!9}&D=xb|4k*giMLG_3x}Z9TQ4+&&V9sj zohq%^BG_iw;@1Gsk1y}%uFHl99lrG*=m|(TfFawBw0n4*z8yd=Xz&ifFIrJ?(6|g$M473Tn(1tBmnEAh>8H<@M!{!3&$Ca+pWrTwGoYq;QKajgXB0e@kFcAv?a@9M6B6F%E(lC=aj z2s>j^xP)+0JuEnY9l7U1Bi|Rw!bTEh&!dq`a>nvX&eo=+LKT^+MQmCS`2fpV*qJxA z&PV38?oi;`CICo)luPQ$j3%5^1liKH&;PTtz#!ws>3C6KyH8`2BySu4(|dTiuKIn| zdQv`BVs;kg&B)88*x;BJiS`c&!}OZ759+Y~C}=A$E|&lxN56ftY4ro*Wn}Vz<6Eoxih!PM1DVHtUHqUC|AAzG0(2+t9*Ebb8Z9xJSwUNSli z&gbbr;{|xB*waUT59(+Z(EsPT*nVX{DbQZk)!m(P&EqA&Iot0S z%l(5e#SO1`WpOl`-E^8bwwO;q)ZX%4`FYK54D@n}q3Q^ztM%oz2s@}tuQaRCtyWWO z`A}eOmB(-K(7<(*4n>+Us7>m9{5!r{AE}Ctv;pi*7HHTZgwMGJU;VTss-^vklB&7#GF*E*&{-_56D%;rlkkx%R1u2wgwEtgxHW&sMNi z$YbQa4eEcHUVJqj@a)EaF~;N^jd*>un0*MFQxKb&F8WjH$+^}fGDR9B1UYGFMlk4r zjsakpG034a=1;{dHbVdh4Rv5dn!0{4 zO+U4k{!LJ4z1!^{e5QB!*=OvY2fb}B&vKt}Zmpb9u1zKq8)|*Uo~wXGnO^@}s|nba z(;Z(NhJoX=eVGOm%|9hZYsZP{twkRSk4CT&l`~GG!svNDf6H zk}>6#$J`6q^mT;i>Oq@Rpw`+O!|$E8mmKR2wWag1}4dw23^vKyU&Y6KKycy(N(EYFD{0>uyRg-lew43Ww?dE?_is$jPx z)8Lt7rEg*cCUJn3J?V}((QIz1jk}A9Q?hy9_sEtH=~1sTr<6u$fC@9{WV^K_a!Ds~ zxD?5HGR0@NY1Z=x7#xTAn_fdB87;$2%8*}lE?}X07AX2-D8bTVe$TA->;jf|R^ZmU zQ~R!ADucl`YEsd})+gS2Cg_u^XxRk=-1@5qg%XJJP_l@zKaUB+J1uqUL;D`Q zYv@M4iDTQKqp$;ag(Ak+F`((T+8_fKmnsQVdz1BQWSCPfiAAU}s|nygfl&+bI`hz@;Gnu!TXb$vaaq+*SD8L*hNw5S_tW$&H%#|r1kA?(wX9; z6~Sw!hnG{_y*?0U)d=}kDvi+(4o_4dihX&pjP7TT=+jt{!$WvPbO4FKTJu60Y6!5R z4jOkC^{sm3FFd#zK%c5$Ub=_%Rw5X$9`W&*U_6qha`vFSO z)&~BWz9cuD@h~ExWx(?|1YV!MU}(?qyKl?4bD;+3pt;uI>ufQt6X*!S3qcQaAHDw{ z4FV426YAcjsbCQ6)0QSn?bnH^jth5E37mYCha|FBT}9kM5`)Pjy| zZXk1Ml}!oZ7gP;~A+_|NM~4H{tfcGh@5F0lZH?5($P6fbum@&*63it_pot`V;8d%# zyr)RAGGmr|aG!T43&HmQiTx8q8tv^ez83mBlO91y1mYk>kK(uh*DhMY9*zgDom|Om zVrbGt{yxK0j0YSGe$0df%z$(n0bEQl{+edg1#6cR%ZQB z$V$)8OK&KekpGuG!}OTG7*GL&J%7eafSG$gWeya2B{cOl-c=hxEEYj-OR;X8czc?a zB<4vxxcB&v^C;Rx0PGL_2d88^LGb`_ge9J0#U4O`YfT4!^NaA-&blI=vL%50Pl8av z!p2N^VIa(8lp3@Jsi|s|p$r4lp-djlY!?pM>wssnKDRUy_iG@f#tjjhnol{1BH@GL z_04@w6dKw`mvx_($UgP4AWK;?o|MKTOD{aUa@oz`@fBm4D7KqYF!DVKD6aCJxuM06 z+XL`!aPr9*#(Nbkvkl^D#w|wds0k_TiBey6||$#fZRMIL-RU8;RV`m1jR z+o=%;W9d7xOx;B!M1-^_wLgf1mBy;C_Fgyu3hu&CI{w0C$xVrZY3`;g^OFkwisBOC<|II#hW;+c&vIaZB2#x zS39Fps%emTT3;C>)E7{^$Wny4y*FQ%ceOR1Joi9y#B=fw1-btwtkVi{eO(jPDgvNF zP|ztA=uA@h)o?9ks^`0ac<~^EAXbo@O7WJas*6&(aS#fJ?Ri#TB=<(J-o4D?y$N@>oCz5jpOWM5UIpONfb6_S7enDQkIe;_62wj%%tf%SGnXjXup<-c z!<>E@ab&zLPCnm`K-g#evTY>Cx8?ADoS5&%nUB}QpsU93c0C@UEj;66hJe3f3HQFb zChIAp|Hbv_F5pf@XzH{T{085RPvLG4yUd4IIarlJB&f~8w3oq1hJ9D9Q4RQ^hCU$M z;JW$U{zDCg5xgarHucp#SMC;Lhh&dud9V;pza#}5LvnJ8f-8yfhfG~%UmOIv3c9${5F$9PqENG? z?u(w8^RU`*8cRV;FF~}&pIO>iNs6G530TPME!X06(vt9`&RcSTzo|<~1~zrFqr0q& zmk)1=uN6lul6mO=!eLqtyb;CnMK=ffZt57BCCBuGlCN}WH1i-C zacS1V8Ta=@eA;*c?HqV|qfz}k)$T8o$v@CgMK-TmxE?F_yrXFU=(cbCumr<7ZHjiy z`wPU>gQ_xoZ6&1VfMfB)w@(=sq8$VuH^{bD9_pL0F>(i@p5B^;D!M7jFCdWMsgJ~f z9*){fqw6;y`M#_#|FpVdnL)*~cz;DEH|zl!(u1T8z8{Ieqy+#99Tm4<4@Nh_T@5B2~QL>r<$rj4h-3Y!GwlX?(E!*uX`0QPi` z*GRQk8n&qOc=(5R(ea+@qV#s>g%9j9_!B`?++_aL+_b}sj{0@ms*Vx&|MAcG?j|kzW(FN)5HZ+>S0JWYk*CALrsB~O+xc|<^OwZca#Sx}`c}gnC8fcl zp1uc_Nmh;Z?sfjZWy_l4?*%`NqEOucbjDT^Pan6y%uG{)gi_-9$5wm@s3C{Sk%`CGvXhRm)V9vSr@6On9)tNuQC6yk1<5m z%)>>YFF%?2ZmVBI?ih#1<;$|^LXIGV7Fe?yN16yuuGr#xap!^vSz@^mNfKA_w57S0 zJAkBsyZm}$LBlo(ZOUz)^#`gFU*G;SEpGs55qhL%ih<4=Dyw{X7CYT?sPY@)4>TO# zlxD^_M&Q^eOr?YR7D746nl2+zw~Bu-BJ+6DC$_MQrH|BXNd6?th&EVKME5xd4pw+s zLS-hXAd4w;OX+-BGn7q(Z6D_#;Rf;(S7;REYzTdqAz$D^xm}(*q8i|JYS;E`;C;jRdS%$j z7WMx>!yHzQ{~qSBaB?swA*%=jH1%9I+tG4*&ovAeWeem<(tL-V;Qc6S02wYroOP_2m{#??ncRn-a{Y6PHIYrv*qE#Tg0rvhT9>dk%#WX^$ zRtDaQV}HDF>1(M}@JoIV*-2G>q@lVj%`kU@xKRyy32*Jeqh1|ISryxO&?Z2yD4PJB zddh+rMIv#vynPWM{53~}hE}&fR8Bkv#fWQ4%zyoB?Y!evwfGg#8wza|q{|C@`MzcW zYIx$+zq%5wJCzX*1%-R@2vP#AMUCVuqB;)2`}Okt4zE4T2vt-s=0rV41@{ZxiAru6 zy<8EBt0ZAZZ}j1v;xa%x)V2TYrzYQ>g_AYEV_lV8d^^I-#xY_ycHRz-W_&6tpQI$! zk7^%JVh?;Pd}vtp zp?A`SXvfrp+e>zK`pcWe+S8&*3s=LQh4P0+ci2%>vVi&>pERd-(#g&gvRm}y*9k;6 z8vdTYF3)-enaC>k&BJJvHz}^7$Js*(-=c)|}`%!GBtAg|4bYm!zu%LAm*rJFO@)60EKj&0#C8+Q*N$ zOc&_XBkQ8S3hxf-3bw!+9(5H4l@6RpHDQG|zlvBfhV5PbURJD9Sswr82QD56U zDauQGaWAQ@S9Buw)Hxn4yfh;7f%{dx#=+M)lJI(;+t^5+|?5ANI7mE)4~mBX;O z&hwDQ3yY~S7G*4UI}V3C>`IgfQeT0g$`^ne`7ZibFepmb^^3tXCGfK}&dWKN**@%419mUx?Xnc{d0U=U{;cpY;cuqUh zRNJUkN59ke70}Aa_g!xVg_fJ7d;>7O;!nb!dm6Y0nd-j7g~8>*6ST{01dA8(kSnQS zM8Y$ehApGb&$_4yzoQ%!-%ds=`8^CyifgSq5He@l?akJK8@d{8n9lOeg2mpcl3#o= zBv9&e#_>`U$D_YpB)3g!Mf830xw`VATN!v6+uj#GKM1lSmvs=I@7YfKTNI$0^zdm& zS?$)M{q0(UE|~XkyGueqxcmDK&$}q^EnUnXrfbm+) z<39f!12HF|yo1CY5nmCOWjerRlnF1Lk4&2x`pl4ht&Pb6^Kxt4Co=*5X)8EOg7zN? zmRDs=(M~ga6`J>_(ZizY-aUnLdvCk)O+o0H`)j2}uZnk`@e_SoiPytAB$TCO&Ps+R zHn19J?DGW%;s_v&E6=I`-*kZ8x3^sd*5|Dp z(FLlf7quNGyp83lnTk2M!lARD(Xgyo7ZAb3MXXW-@J1(fujxLzzXr<;9nGJb*V&+M zzW}Lj*=ux56I>{!OGAtv#r0Rp0Tg}Oe%3+z%o}m4Xyd)~nJ&=Q!>Vs9OR1G7AyM!K zJo6jAJc{gy4!GQ+Fd?Fgnl&}JI(#G;3`ouW89Qw5C{^^u0*%defxj1hcA{xXNpuF- zU`$-BOi3~ZKi!Ll&JX8?E^ct5aa)7kzn`$QEf&Zf`D3l)(Vs=Nyr4yI9=@Yok%S&; zV9|Q4aESg&`5MEIDzvZQ&^sI$kKj$a@jc-Qzd;&6Mf$9J&$`9{+h*8duzaUE|0?!* zG;Y$|7JUn!b~l1oL1jWE!;eF0UT63K8UoB6TmAjG2V8Az>;44xR$ATcto;_j48Z?l z*dfi*&o+6Df#U`}1}xnRKYiU4=Hz$UhyFOjCIhEnmh0bw9D2KuK%jp0xti_LNt( z%uz)N0LDY*75sngcDiaeXAm58U}@LEoaZ?BfB~15284P3&Llx?P|nO!y^^0O4_?f<0$jMAku$RUe9ou z@p&#w5W|2tWR}K80AJ!4JQz}E5b2wjivd-{1D@P>3H9JUP&Qyjw%Iw+#ewwZNXkSw z_MXiGt=j`cxBLyheSa{wpIax|k08siZ@MX}gLiU^Czl`h{JPmf$Rbmt*aK2?+E+PW zn9=$D-1qbTc;DOQ?sy_QhTlonb){`)T^%YCKaJHfWU6hfyW8N)=HYYAZ`^TB!vQw{ zK);-f-@6O(HY@=L3^wN?sjq=~ z8jN&6`6xQCg-{3Lg`D0AqY+DSPSH48ZK-~4$>b`^$I#z>%)@l)p&X^f&IEzA7Hog( z46Cj3_?;D{K#BK-R^WrLr75pHY{@HAn`pj6@U%z&3{< zji{OIZXAc49u~cQf-n}}e(3Salj~1AoJ4uAG9=6!oAZmk<$LP#b?shiQKjh~K+4w% zVFwo(Gr=}(f4H&n?WQOsIe5b`mZ>f7Lz7=K@q@`L-fOw(#)E5~Fr{{!L@$Bth0SZe z4CBgjTb0ibXWY6c!;s{Nw%ug{uwa{oam@(FynvY#Bgs>|YBHivqA<^XVG;)!A&1qJ z$S=A<=@x+ZQ3Lt}##6uP>iH6ZjnLP4%8^1PuL_9d#eI_5`GVhOA|)QaxaOn87b7yr zin$J@PsgPl*9p~xRyrl3vC1Rop=|{0%#)2%AAa$lUaPXgd0#lPHK8H{F5z%({H`j+ zbG$QSN;tj?Iu(n7Vi3-y-{}T*kXIPaiQoZkCloJ#o#KyCPfEI=eHUzQl zd?LXTkFSQeAzE!R_Wbgs_HV7m3U`#o%oGbu=ADTdAp{C;P$S3JnDZK5V$FuT?bqhV z5@jB|ljQR#%=Tcf4gqd4tc7<$V8I}ImBIL<7(d&2%FBDuA5TXI=mSv~7Lo+%t|sp$ z?P+4=Yd1y39_ZQfrVn>Upg&vd=$Zw#qa?)MbG3OQ*UH_8gi%XAOrvI3W(eTtGM zo_+0qaU+sfY(i0_rfSs1mg1WKoKES8R@N`%nTLuSzqR#p;sbGtp)^;67R9(LtjI+v zr?(antGh^u3)IE|>;&?t4w?LN3U!xWo<6f)R)xrb9yfs!lQf?7xCW;W)poG zgd9*5MyTA#J0n)R2V!WZ4TU?-&u4u>)QEN4bE=}4`ILqRB*mG>SD85JB+-+gjs>@J z9zdQXnRV|XsF?ZreckV0vTb}ET%L!!NtCZ2SZVhD%?yWqP@MRMDb1 z9|Icux3UfTI;?gx_^+Qk=AoUOp76Zq{o($?5oiwy__yVDy0-kLFd|r}G1-(>(+b7u zfCXXczLl@(#axkL=?B@J_c^ZA!8I3|dNuBhb06ykP~D5O8REzan~X4qh_I6plk`l* z=i-4$^iWT@rYUItLOzzGT-kWyKhk1vgk-SWe=?bpb(+Y}2vz`YP+|Zz5ZEm23yx6A zZYAOKyc+XvyE3cw8646N_S3Z7ekVM{qA)%S`Z+mV^dnU-Zvy1Lpo~KrO8hN``OV?& zu5ulq(Z53g0FX7|qQInHYiuGWE~fv#0?PJ3ixU640m{bpvjIv5(A06*6h|NZd1J!{ zffPWyuwv*hrnzCaIQ@jS4Bf_t7!$d~&l6j9JQ3~4Z5RE&uo&|&4yKvb5n^EE2p6vZ z3hf7cBw3_+KqesRDkT5u@G~USKzGBsmm^(p+*FBNl@{OWlmeP3_e$d|~WJxt3H<$f=sNf?N6YL1RQ2RGeSL=u0E;FtC6su4yOoirSiLz@O^szLCY~aMuSo6)U~vkHHs^I7=DL;&eUGx8Uw0b zPTgG-!VfqJ?UcVMM|rXk`q(!;9|p#dD2ks-oK|bkd<&39vf*;P*bIFAT%3Bke`ZnM z3ODe>)TQVpG-Nc7mdar1_m(*A)H--g#(a$tKI!i{J)qI9{}fOzy*MK_58wxb1iuSi zL>uau76Wvj&&tvnH?Gec{l=HfQ31*VLB1ZT^S$L{s0AD2NSMJu5AMMh9OER&J$=B> zoz^!qw93UcW7)$b1P}SM*;)xy$!L|hWZ~fH&r41qY4lVz!E3nqqV5t9_yEFRazGFf ztH{~wt3Ywp;(Zz|!d;bHnYPsv6YZVtulQG@dN=H7TdrZQbolIzg3`P|u8Le{{N#!l zGX)81J%8LSD0K=7RZrK2jyv8J*T_iY4F9mWo<#6+c+JoBT4jGyRw=J|EY>}ih-)!qJO>fs_<)TA&brZ=E!LC0u$i~CQby^sST$FK zj#j8hxh)OF_+RjpY+&lOE*sPTro(xOPmo*q>%0TU`8Z#7u&hTI)9F0pI)huSY|IoE z5h+rqj5|xpQC}2KxO3Bc%Ayis9>B$T*--AI%)mI!4PBwsg0!A=Lje%SV8^A(PSv2q zQA>2L&8^%-mwP!yA}Qy30u`eUBML-tLCmxS@TVmR!r!V*kwL!^lod@?1V}jxm$WMQ z!2_`6KhV$flJQ8=J(X-qb~T|=(sH)M2I3g4*Gut}OTwWL4jQt!1gZHlHI26Q z|BYn$*?WdG+qU(551G=)EOw!E9pP6y^NUuQMCp%8FG~L(?)Uz#a$4B3C1`(CwWx`n zjjI%`-)L`umY|Z&jYgn&&N;EHp6KPZn&Bb!ZeOymM3$YppC#5N+^<#Qu;;Vm*$i&9d^mUUlyEwy{ zBEIIdlEWOqpYpb_d>U@BHRyoxfUwxlq!o_~LG4mi7;1FxcrEHg)IZ0?;HKc^c8MFe zI)cIsz)mJ1ulF*Wo1IahwvppcY=?EsLk)RE-#uo2#qcDk22EElUn zJ4^Wb#0qR7B#RW)xswYgmc_J-gYe^tnH+@3t%|S(HSn0)O${PDoF|Zzy+MWrRwbo1 zbdkqXBTNM8=$~I>T-}B(*HyG54&1j1J?a=2`U!GGr>1- zynzP0GQetz>p)l3kfaC8pbQfefSba(woE2Ly&=;pefn8a}4|W50 z#)Z$hFW67`g=imeR<6k`;0DU*$V`9Zw{2;I!X!5$(9@^ORx0p)K&0(Q4G57h$@P#rFwr3D4-0owm; zoWSzj=y4VW6B6W6c*3_Ci;e2=AWmuB1mUqlUidLahSubvJEFYr-v-~SbBy^~%$X%j zLmOCCX2VAVmyCnwHQ>6;fWQ|#-nGfeP;=l6iy%X}D=H~2-CL4Zb`TEf;p}R3vy=Ux z0YOccrT2ua+C(88-F9nnzd<*J8Hnxl1xyK(Z)77^9o6kq6o8u8p5FctHE(|flSlhE zNBYn|c4bk*NFdqOb!O#S9i>IODXmb;B>eI2f#9_gULZ&99K9EkYR@D$=Eo+tp43<5 zFC8{?B*9ZjUpm$Jm2lx5G&t_gXepqC2pFSq1yT894J|zAh*qxwI$)e`@+mmD-?|ld zq%vY8jX2&;FC>oL$_jt_8(3$=Ppd-Q9}X1~6#D@Jq*w#nJym4G8{?QCZ0^;srw;Zt zz3g|OFl74fHE_ZavlRv$n&WOIhx5{<;B5or`P& zj3b`~B{3eFer2M;Az3OXuKJ-fiOy+*379y2ymJL*B^?LUI68=x8u@w)C|}=E7_yBF z@m_@vE2*{eru0Rn6aq#OaqLl4D8z|FP6iZP9zVoE5{F+c)yEvDQ>G$ry~Hx5S&Y>5~1p=N~{!J^Cw)@KB! zquhh}kNVskaOx&9a?6KzplhhK z%mbvMGYz=(m#i-au@sT_RRJwx0hSnw8u5^@4Qz;Y0J8)Vt#pKBJT{i&9SaJMhWATxIaa& zSJS_!5x0=e4>IoOHl?;FSg+WYTR_K^o2lhN+amZZ-2fwiLF*yd6|8RFzw$LWGtek= z`SC*;Qa7_S;@@o2?h22W3dst+u#|uE`!R|=+hEJ6wLlc)k7CMUp53F^zj?I3(86Lh2JuzY>{IDZ!dEk8v~{tTwM zY$~7%j|UX^lVhH0_KzEZ+BWT8<&PCC_cGV~2t4_j=<@x-ZF3dIDHJIB4|(Jwy>WwZ zHS!UEsCWGs2#pEr9)t{zJq@3%YwiU_r4Q-4otW7AMV}Zrq8Vxr3KxT z;b;g{5(Yw%gFdd$c;vt=qqGrwn;<0kB`WLnN#|Yv?_c}sYtrG7<+jt3S8PLch^qks z-!9Ich2;-Ch#Vi z=VjHkew)W~3Ss~F32T;B`ZD~#g+((x)O0jdIpTq**U2CcVV`wpwps`xR1vw{0-t%O zax|C|H+=+?)I7raW!c@Vz%qXnY?&@6lYjd5W&yw^KkG*SryyhdFU8b<;4UsU#{Yr4 z*qQ&kHT&P2Jv+;Pv0Ya`cKt2(-#ssNf|eG8YE5$KKz%h&0|$u~EnTfG$_C~-QBdw^ zRaxq2TI5>PX%xrJZBXB6pJRSdh(M8*sjNI@ZnmfSr^M-!hhvjzP+#N1^qP|2qu&}` zRSDY$pPpn(b+#W4Ehc?^9d93I;sRT?wU5RF%zqk*_q_(}-2oa-Q(~wMSqIDeeZ5|2 zTiyTEe;IsVXzYI8Y2Dt;em#08_USijl=+vtPi7I+nx;EO9woH(YWwQ2ANei&mFC`t zY**J7W=j-Oj)H%-JyI4!fG`{v%pn*LEJ{|&O&%-Subb#BUI>koN&WjUW5Op*keYER zM-r{rIO(d};s-FH(mEIYW%0g!l_46{DB07(mPUuHK>z4I3pVOY8aOYoy{_7`bIZ&& zH|9y)r=WXuplQ>Yfa%gHhc7;y3ta2Oo#@40+q^>+{xdZ)j7YRvS|@Ltei z+4)&KFYK_QT1~J~tKHOUG$b-&DC%cyQAK;86$o0!s{z>8|2*ruG3fUGnrMQRF?|2_Shf1yJ;~h6y^>JGd7_3Ec>PSFy&(Ov zZSi%FmjN8vE=%RA zzt-%Y2UHr4iD84~oaWVOLP{aDvxlUiU$>Xbs|9wzoD4=5d`QBVje_Z)OK z)#uEIkyCbI9$n5lFDYfZqF)U3XXek5B^ItG2!O+G$`Gf!GE&xCtr#DvTq_@fi>uU@ z_e!Iuxu!}jx3W(~Q0vZCJk1(_xE#gk4kS}d59SH<}#(XR<4YSM!Ux7$3Z3~VS7k@%%ovj}l!*_Q{ zPe8Zncg;p=g}QWNr$v{uUPA$!+Fm9e!TEBqg>a$;FFR5T&!awP0k?PuU9N|;BB2*% z^~QED?s=D83EFQWXh(jf^VehA2E*@LVSup`Q8tAPECYGs{JG{rC8PjVS^{2$VSI@3 zjda1Dn62Le6@n=*@M}V8D|yl4?($W^Zmuj)kv2YXg#Ivk2v^uTtiTONm%lx(sYyEN zAe4eQNE3P1EE9<^bO(t1)M!$u;tVp%pJX^8aIUcuNDMOt;FezX+^qvc)OBLoc0eeM zTW$qiFr+U%914!TL)Cl)v=y-PZ6$E<;vF;9P@*#T{8dmR{>-i`nrzG2Mh+BpFYIqp zJ>PhNE|S~xOk^m=`XCprE+ey{%32#Y=HD%h^oM6F@o@@Mv0uNxTL~AVOUGok)hjHg48;%)+CleC&;fo21vzN- z3rQu@)?e0J)M5Ck#RgatYok)t4;=n|seJCak3uSFkXv4rS%YBO);MZamWR-Z_qr5B z3ZH_hA=OoG^jm&ntCV7?f4+tw+!Qr)w_H&x`?5|eS2Ic%izbO1#kbC`16@e$Ma~Ij zAwrCj_4J-NhwIr;14~{jzXZI0ibx2_eE4pOtpcMZ#Z8K-XtiTA}p7hCqs|OzwEyzS{p4&jGk{ufik!4I+kX z1YdD`si-m6$AV5!G&%pY#)e8@&TZg%DN9(6d;8g@5fLhtoF^~vP}*Gupwtj>s4{7( z>6;^*r2+=(#m8#U`Z)3x&?Ix#v`)Y~28oRLMq-<>3>@F@fL_sb!PDIU+n^bE5SStZ zC#EUg@JsI#_(WqvE(J_<*zd3Iifx}SMzey0n7<)Ru$x6gGLTmka5;1{!WA+ebWj(D zt@%+(36ituM1iGM&}%(mH)wtb`4Zp*X`90euN6@jA}$#gU$gOnT6MLd=$mJ##u+N$ zTPQOZ^^Wi&z@}8L^cE2hx|wWC{L@R7Cb6>Iw2PNsOYXAv;RZCRDCZCQyT-8Q5M&4{ zeSB?uOPN7bZe%70tMzNjfMHh3q@2JDYEfsAbiUV@S|; z@)Y#GEdMyRbO1|k%+MqLKv{Rh@pw;!wF=%ud6?Qafr0KX@7AI1J!|-osLPC5a#@y# zggv;;pY1kJ%lXopxmhw?VO`g+tEyf%)DAqP4(Fvhj(YhZ&i2+Y{O3f%b@t>rnZ|r@ zl)O*KPe8wSPL;u&&QeV_+m4AftR zC&}~FA>MEa->@X^{WooZTlIEs2u-D-yh%Z@UxIa% zxRU|T#&&F_Q6;jfB-LG|_*6Bmyb!8JiNQH<_^Tq5bsTq&4@+bGPkT^=s>l#BTM18= zuA;iEOTcIcUGWP9NWd?@=g@U@Sd~MmZo=zD>c&HIwLpAO=}Z}`9Si-4@>Mh=Ea`P{wYgJ zHB9a_w86un?6Jm|Sd1_bDn;E+K*1*HjqqF?kgaM=LTGt?@cPJTATYFXGUnd`^zt7+ zK-fkOJ`MU@8a@J;g+OhG zT1Q*Fj_655* zIrrr8fK&2!D(5zR?S&b9#GiS!!3p|ZX8f`PcBnF`UT7NThcNQ!P}v7Dts+3qAXEH# z59^7N@fs_(!1o)p8`7QWV`o5B{(~0oH$%c4)+;SC!w$&X07ohv%XaaEf(jirz4Fa` zpB^#pva9lsVVNa_hRj$z?5*|O5itFHt7YIMkT|C==b*+vFtX=%Z$f!(k1f)otrv1; z$r}R)IsJB3{luKT-Nvqt&;yXi&lDt=;?F}?-eiX}zlOUkw8G#bF|r-(B zic#Z1$`~k$`sc`{;6S=tevzGYHA&}JWWGmE>3r5TFqYo4(zcPbVI?5F#gWF1&1aM}r|}X7Bi7Klb$oX{Uh@rl#0$4g zRQD7n9yX_otR?!wU0x%F8~vSQ1-)O|h~Zg6YmV#mqG12Bqf*4RPM~1Y3MsaNX~!J6 zF;Nk8f>X8}?j(p3m=&;*dY98hLmxrD)>J?;Z$?f^7&CivhR;UrX#fK zJZ=B(tOhfOHmC94Sfn%Gvt_U>C*H>%f9RWzU8-2o@5C$M zV_mLT-8p{MrZ&KFx_f4R;$CP@21-Z77DvJxXxPEg=5;pz9<42KRB>o$q!0|I>T$0l zHl`vG=y8h2=0vOlD3-)IN$Gt0d9<+cVQem;i@OM`+_J!%>~fsv#0(CyQusOklXVSGfywbru4aJeftV!Web4~|L^XcU8XkF0*{_fgyWh~`N#8aiYAmJ>Xd(7v}%41E}{^6%5;!F!z zp?@8IG0K6Vp1OQc0>)q+_cZTQeq;FDrGf+{x(TLn+Yp z5}r#(wZE=t=EB&|ip=B?`;N3EcwUOPF0|}BSKb3;kccWqoE}q^0mGMc_YxTbS>i(^ z!d@pe>!umCz}{m*Ohk=vEbDntcA+G_vLzAKBP*gFdA1@#ljLseeo}mWBCzlx3jCib z0Q>*=?pPTax&HqY;D40V|2qW$VdwZy!Iv~40S8a6DiH#C%aU zv1}pWf+uf{RUb>dd$=g+(C#ifUf*0F$?ACh{3ydAX~!x$0 zc*j3cL|2tN$+0F@uqlN=j$yd zi4rJ9H8A{;XyxM^Jj>EB*j!KYd@3AzYrARH{g3IYn~?K#tI7lPJ;ZnuCbKOMgSs|h zLFFKXorYY=hI2SjLJ9@HUBt|FReTiYXCJn=dcL$=F=Qg*!C6Br`)|V;Hvl!MpH00h zndINt%|fFoRHvUH)Mm_g*Bd-DzVRwF_t1HDp@@2s4!Q)yjAD-oGu)C}!^N+0FoYxP zS&yT0dzCe@5m~pXT8Ij0x4ATpb2pqS$zpzXP+gwVCwbclbPJ7g+D2A%g0=L2_a7oK z5JEOre*tb;MAXnVEnvUm)BvifR=r{#(^$w>190^RTB;DZ>_qiHUiGolzjMx;wik>= zxXMBBToy{BzlE~NpJ;76YG>jG2$9uu!esnprPeUX*U&M!{uqpM-Z(3kZ0gZ5Gs#jr z314#Rqu4U7flo|1Gyrv#%V}3_+oPZ!LGdOn6E%r~7`4L<{x-npGz3uk2zn{WfLiG{ zb&pyvDvl}Gg5-H|Ch$))_;aRN*rDLICIIPr=QewJ-TC`B2n$4zDXOPlSuai1&R8() zPN%`S>)P#x4mlg8%-o!xj9k1-J{h;_((mX`r#?JwzIKiHDjGINgX_d?yq8b|0{I;| z=6IsP?R7qr^m93*r~xZ`u-2-?aL5`Bl!2!C#A#N4*?40r!O+4xd6%4}GNb!E;bdNP z&8L0|{@Y7|e)eU7U4*y2M7qZqB9#xQnOoL!7eR~Y=T*r)6r1V)gt*HAwc%4bt=HH) z7w%&xKU+icMO+j2OMcAHH!~S4bGOhfVVY(R3_njOdS}HR{tF0OqlgPTcx0b017&We zds-M>Qqi6EICb&GPP;PMd}7QII|oWbJRXbKHnL~OGuc4())um&G^aK(h0;YH zU`e3lMgVctm$AaRo=9~Tp&Q1X%R(^EB4E~V*FHF{-4#faaU!dk+>tj|H1J&xxI_kG zEO_?mntfa91l_@5EtTxzZWkJpgVo1d2j+JN6k2hI9RkSq(!#Wt3Y!siv(Vt&I2sh^ z>9n;~s@a9I=+VbD7!V1?69JNKmNCdZBF&Mhzf!h475etRbboiaGDV(C22jU8!=jyI z-L{S=(jzBeTc$NqSMKX6bSsu0w{{3@x!Xs-$U&e|Y*J)O!29HK&aN1}TZPxfTFCin z_S)g*MFJKqJ$oxie!f!ebEYd^JAXTGxGY<`L6xiHhDl5?fj;Y*F8r`Rr3h?-{)zt4 z*TTGc_v)=;@#N!$#b*B<5BN;HtH|EklW@WnAVR&_6Iyy8S3WV-o5D9RHHCk6ziKT< zgjRb6Y5(=o7CfM=QGg$K6-n?l5aYk*OM+IV`2I+#vu`|wa8AaOS5L)*vV&V>`@6Vu zi3%DgqKjG+yZTX$*H`3W|zIV_UrjE?C9y`(J^jrP#cGje~lc z@v)`{5e>qFrrP8F?f~LO)+aouNhLdMh+xk!JGMjJH7ee~e9Z5M8A73!`inU_tjr5O zwG2o$*by+m5aoblTf+bOJDBJ%gy>YXZ=q^Tj9@>wZ>)Xv|D)?GpyFtnwQ+ZMcXxN! z;O-jS-4=odhsE99-Q7L7li)7F36P(>?`QYB|2=2V?%AE{>aOnDnXajN>VX4cPolt} znY!;VyVwuMfr`K0GLOfh$xzx5r?i$%BdNA(<2rm^MS?^`Kc-7|*|;2qby7c}aTy1F zWW&TN`Q+=Sk}TCqauG)2EV3eYbm{ZvBD-?Mw3C(7Sb3BW(Ag$OAB$Pyy9q6_H_W1< z0I@JZWyEJ@Vm<_~$GBU%-@h}{()#&&YNJ3(8FU6CSZmW_zsl6NUEq&S)ju7=&SLS( zb0+UlIry|R{5(to|1e&3-Q+m(JbX4O{c;so=*P3d2)x%n}@XVqcyBZ^8>tFiv9 zEF^2X81~T(P}E3xZY6zPSvr2dZVX4Oi6aA9k#Vti-j9O%{)T{5zuRX!KNuMZg9a{J zrSeUl?qoX91|xZ%R^BoHNDv`}Xzt72`Z}w&n(L=&yz>l_LCK;tY;j(C8qp&`&0uUR z0@)R$IjZJhqyPy;rx-ljL&+NsqBRz{c6DkTWmEV~K*&hR<+xtj#8%B$1QELL`#MTK zwVLaEq16g+9%Z5K6X7P28(|(5&>QmwC)zA*(1xj|!zG7fNqFd^kgQYWYeTywIE z-{)J}@^#5sUSBQ(7DBd^&RmQx7?auY;ujk3IW!bHa`4C8cfYUJNd`9irngBMdMQ1(Ri0DjK(xf563^+6{{SYGibv6Z6RN_xL^ znJ6R~mU>n9RSI$R@jJJS?T@SPSF{mEt~vdtoOQ>{kDVund#;*pU}8Z9$P62J-Y_N& zo**tnVJxXtmX<&*TOmvX6A&`qTj-D|p}b!SNRVEJ7Y-V-HKVb^=~DXB5XotcPm*JH z01}(aoalg^pp*TxjYu1;j&h6pi#zR%Jo2IGu{&i;$)s!Akd^bzD#2{+T9N#ymLGvl zETo8s1<4^Q8ks{`{jc%MAa~#jN-1s30~QVG9I41U6qX@u>uj;m6DpfVAJuJBqMp~D z&k1$Avkm-u?JO&e=PGn}gRT}uK`S3d0g_v)m>D4Qql75)`3$1L`P2D{s*EPotq!Cz z_YZOtZC91%aFK)7{rZtMz&r+0XluW*g41CXMG(2(%%A|`JEU%Sj8)S|nHA}^}C+*E!&m$zKy=)4#pF2o#o#T*#b-%@*MWt-So)|<9BSIcm3`&dI zP=Mf7F7TNxEUh|_sUx%*f^0-orgN$vkedC@8fM)ipm9dTud1|6gFNU61z?;+YGLc| zI>@suYsqTp^FX%Ta-=fNC|Ij$^G~XJHLGWBwYQW-D&gu4?${b{b23&pztmFp^n~N8 zsUE4G=p6HLdCajVWFr&M+^s=Wj|AnYnP>wuaUsOrE6~wt&>rs#h!)4mIgFVGFR_N2p+jwrU)et$lj%-tYt7k;&L7LjU)k`=8J> zHXa_%f9|=t|5=Ut-+OLuASwYRpjgNLqt^5X-^<}2zL$wm$*3YjaE!L|npVZm%ze97 zPkR?_7A*V91WJv>y?dg|1%Lj#+B@Oxc#QiLJ0oR^K1;@gEN{!h^v}n+3Bj-~`%1T0 zK7hl#i?!L$68@1HfaQ;5cy}&6h@ZhrhYGz4$|5Q#tRLvLX5m{L4;XPk$y*x2o#WYh&9x zj$@tsduTYIW)6bazQkJsXeoKF2_x;i`MR!6)YjbVOCR_!yPAlH%8%rcdBC8!ecx+2 zG`(YtNZA8)c2{-8>g2!E-1n*Uq;$pS6r`g_Hd63zZg1lcNx*;u-qEaW_DS$n8 zJrL5kF4DL|zGzACQPv-?Jsj!-zk zyn%&^egqYRDZ=^&I}FUJ+Ap|^Ru7oi)2!xMcXlRKf%U&xdQl*$Xmr+pQgk@p%pWu~8*U!| z#?TjyD?#KPB@-fx6Y6kFf~gbpbDGDMEF!{IIe1_6jBvIEFrZE<0WV#{`g^5I=Mwh{ zC+&mPBay@CmT$a~If`uu`~H{(EO|ETyIJNMf>VCb$|0K_4d{>iR7iEzdiwU*N0QXH zBewQwGVn=tQYkSmiEPs*+EC?qc4BFJFkZ&ZO~iL2L;*-bgP{+33IUgOgOtDW-#v|;fwc99CryO>XH6Jb;J$J`@@BE z&Lcf`l5DnC%(fLBw=nZl?CEvrdkTToCMLH}Zzte0PyRpAjQ}#kDn;Y%HS7XSIbKwL zzlko6Oc#XBK_@zXA-4LSfp|In5XOyJB_>eo{ zN^2~a9~t3hU%HL0vGvY^8w95`;(Y$VGa%$!h0=I}aC~cP-&FiH`ZI;;;yTfTaeGCO z>w^BeTQQx{y4_oJ^v`*YoJ`f#4%A7w2^Sf>i&9ms2yrIa-#~?42n_J{l}-Sw>*-W?{g^kItU=(ub>Wn_IXr%w}QOT?uQF;X~NLtr04Sz|YZLrRacRsr&3V-H^szxInX1#mz5jpT4YEx&M_B@NuD zrQ_WrHDCp}6ZMBzpHESej6!_xR`PyeX#t8<4a5!$xeD7* z?|f=XU)+@~VNg7s{Wa3AV)XlAUjk4B#TZC7?&C0&mNj7pAkgp)2#cD|J6F zEc%B&O3=_%2z!3N_ETDqB$&afC$Ri{1$M{MTZ7uR2+WW$gb43oEuEpZNeh73VjfXe z`G@9YSYMg1qRTkRMK?v+B*C6damg(r!NF`Uc);O$Nj*^nhbk`{LkZNC^Cb1-j)h7S zHI}qa3#egHe+EU>^5)WrwL&&;53GI_V$L@nsR#iJrPWvpX$BJ8n5VRCh<#e{ewchv zrdwChojsG9_vSLOaU-A80La;Mo&AD6DEl$SJ`5TM2ZvL&$>r9i@Z?Wd;hfNhAO+HD zHoN2^yVKqNZiDlAR)0a?{EZZgt|e0>7uw!c2!bN1ke$`#`Sis`2u&WPFBY<7aQK3Q z--v+Z-@*H0F%|&a*|Ek%=m&64aYlOE3B|J1xq<3?|@SpnY3c zOe+#SR4(Y$@)w36od0tzIZq8HHWARUdJGLzNO5>wT@qP+{;N%{%?(wtTE?dMEPu=& zZ|IEG45v#?3$xi4u(|?;%Op6gA(YaXh=y=!%QOsfUUPysq88pzM=x9;eIyk_n}Ark zWPwu1b6p0CQxP)W@wG~E3)qUmVYwnP;);=+DmklLyJHSDpji^Yx;y~&vp!SZM^>h@ zb^V(MA+c`cj%d}|+j8Rf30Snv#h`CKLq&*gXo77`j1E=Hfc^C=Wb zd!m_sXMVzJXO(_xm1p+E@t19Q`)^fSJ7b|dM)dc!n7ob{!J~C6h|4Lw>s2EzEMZG^ zZ3D73eJpz^;lX|OZwUn8_YoChRY0S=ZX-@fUjWLNlfKFhfxdIBU}Tm=(S@Cq=lnjB zIN@+K=(pWWx3w8Lm4k4X>a2QvsrgWgZM$=-kneTrPrsn1N_qiRQghx>@`-jg02Jhx@! z(F8j{y<9y}P3jk24NYGzc`-h3x!=AC0+@;C8ia;qKhmG>TbH@J5(fw1Z>~Y6?7lYO zg&)Of-#l@}1*J$GAv?Tb-DcYQj~|)>{03XVKm!dqTIV@_PLJ&PHxo1#MTtLmEp^$y z9685Uy6n=DeP!sX{G99N*}&&3dN($?rgKXSez@y&3T}Qd-1Q>Jr zzF}m|R zs%p0l;%0F-NqOM>g69;;>F>(WF~Co|E;)28GF>(8sHvQZ(GP{2WkLa2hO?sr$F2OZ z&5?uTK#EBJ&@`+cE@MK&qUY`jrwjfQ8Cw)30f5c$&S$69^Rusw_3p3Pg=}1Lq=*a= z1Uf~xxhp%`Ci|cd)EBhS8f<>Xn*2y^796jV}ni& zdXPt2cN*p-;5;C(eieK%pT#I2s8F#Kn-zysKzY!fjx5P4`l#Z9a6?2|KCAVJb*2bz z+5sglz_T9CNg&=})?)kSvHwaUHiJp z4V-7ZB;T{cDz{D<#*d5TTasX)AFre0_cTz0GJ$TU{)hs%$w9K}nKC{sY#LO^j+GPn z1OnF*;@x=nqUSQB7anzA%0`?(8_K+~!vGlLqQx~1aVVT5{+rGLuMDF=H7!DdUx4c5 zzy~`wED|AvLL}&B4LBmIF8b8|X#$kw9CzL^^-*qRnJWREcaJH)=3D+Ogm!;|hd5Tk zEVmDS%`)Z!AylFgXAx-QrX}cI94Y?*yXj!pH`t)N=%<2~qH>|N2R|ofxTCEvVG_k&i1$e4-UjSD%J504J$G+K6B#%F?CpRi5wH#9_Wxd;k`s;VEm(yj)) zo6|eS$&s?eewSpD?6 zSB~&Jh>e6#E8;W?Xt^VD#uBl!-hi946=jF6{0X2jIw*F;Do>e6wiW|HN}q>`Ri1AiyvQAY-?w0J`;zOa zYguB=F)n@}MeR*}8=R0&1x~}!=Lz|mGE9IcBbIiQ^>|P(MeJHWSflfC@8#tDaymn| z7Pz=P0#Sl^jHI=(aX7J^y@T#;r5ol*N8&|k8JY$DjCu+=GagDk(GNh(vW9@(w1Gvj ziFHrlI(HwjvXAoLly}3ID=uHs@BYf`+A=DrU1R&*Vxt$q$pVjAP*=DVT|dnJ)Pe5g z3%KvMGB`RpkeC~_M{OC9l%(G}CRm`OAT2)|EE<=wLCCI5tfaCRAlFyz2=!ulP*@^_ zL-2PkD?D}W5!#^Rw=w~YDH%op zmSLAI^dnjGaO7a|$z#T=LH+2SmAqkT28z`b1Pu#43R#z~0%l^;r%-kB8K*O_Tb$=S zb*3G+R!?z7f)I9%CW}G}*g@@niGPc(IK}PUg2{k6c$;%Gg^Q{FGPhKA{)aS?pAFhZ zk`3O(D)t4pG9kq|A6ue3xA(Jq@b(#5tx2nXvS((_4kquhikSdmUmFgRIIP7Fim-rE zJr0i0w}60rfKQ)-T~vcZ1H?(ligaM&E}6SW{set%MZX3DDl(@C-;cQ|$l}7u$=fO^ z!&1p{^PIB;403X_JW&;tQF6L*5=7TyCXNq>qWPNs{Pl$;ysnMD+4Wi9*OB~+-AS(HV0ct1Y5SL6vih z(-FkDU7mh7W2e!p~$sWvhov zzMelQow}KBdMO9?Q8v_oMw!Zmv-pV;x}}^pdVmzAW}yrqo{D3|;ZLTy!2pDNa~tD- ztn!u?0uD*fp+Ai_8Q3%&pS5f?+IOcGqD-<@5Tq+Du>zswV-2GF)Mv(WOLd759dCQR5#<}u-1djN_!s-I* z#pvYZkf#vj!9nl{>tQcSwX3^OlJaRiDt@*l0+yP7gtiFpg4?|_RF{Le!sVeB7cF@= z=txv$ihWL)7==_wEwX4B$Bf*$@MBfBhl%;gQr4#~m~ALNCeQ2;wRaaXjtc7i5aBg8 znoIO8=lUyn7=0Q5l#Y}XLh8|#cYyK)Sw6AQ)`+^DrRw966OSv>=cpBG1ZWJ1?vI3U zRe(CLOs|i*%$pc{&hUdNU~K6=L^DXPWDea%PGvJYYQ%3taXQS&e4|NsbHs$8fpock zQBG_SxN=YmQ_;LGlF*7dPp0fVSnEUpbBN_(Jy&CmbU!&^k0mfVJaE@G#Lz1RtBIQ}J#GR#N~q{84}b{& z=pZNul6`D)%7B|6uz)kK_DZ@F-sAyN+*^6GOp0{O8Io~;6?i`@Rs;?`%T> z_vm&YcjwB2<4JBn>*me}dZs$VEF<}T=ly-=S!%HY*O!u*D6iQG#C>7+iC$BnhjBq& z6L=du*D=&)u-(O;ibI4{!i{rQ2{@~rqkrS-vun$HzN}n&lF?%ICb*;O_ge~TR*=`% za&-qS7=pjb7#4WD!Hz zxfCn-WVBuu!XWu-hMZ91=OfTW$B~pg9w<4d=<-+Sv2RbNsW?|adHuE)`OH^&6u|%d z9vb1sT~$%Tqs3R5z|~wc>Ap`l?wpb>L(KldGxda-p$zH zRKCy7fzJc+)3dN&I{xkddW6r-`HyWl8xI#RaMQ*WlpCmQOAZuvh6i5R7*VnPNvlzX z6B2@B7I$=Tvv6>8C1L#oxcTe14|RXBDgpOxY^d4(L<9ayl0fK~&kp_%Nj9v% zR_A|7{cFJ7T>r9-7s%>{4h-_a2jgJ}=J*i&`G^k?1HSvsR7ytqoCkv3%!wQ_6jSZONQBAEywf|63v($SS`#P-4j1%CH}0QUPc{Pn5t zoeIhW%=RG!k^z@o@j$DfeGZ;erT04C&jV27U^fMC1PJtor!N|Kkkd<^~E6a5Nfy34{Kpk!N3r zfmPcuz?MiePzNA-6dSm;g9T7LN)M=8A%@2N*E#kd3V8k~0C02i@CXV0<1v6&R<@V7 zzS>I1LoBJUqn<4$o?;)>`m&8JVWmc;`w%Ymp{S_Jp*IpKDQvt*Lm~(%1WY{3EIZ7u z1fdg=P4--iD*yVAtmT$c+lArwM?HLBhu*90k7_4=!cW1|>%NGyzq&qNQQ|xbWIO~j z7_$*+fcT=&OJ~+_v$dmETx=wETeMp`Pk6RhQhc==oNpLl3O~NkB55=pBJi@&E_}p& zOinolf(CWkCrizHQafk$;IXE<|*8BO8L|D$hfOM4z(OFEq#wgf9ZSHv7Q|I&u6DKoEQ)_jFlbc*=sQ32r%T_3j z`*$_S8$UF*4K^gBVPd^HwH_59wb5_bw-I)i)0DYB!z+7Lx=X1`^qhJb#TC|bS8*UX z4Iu4>b_>hA%Q%qfm3d8yh0-%bwM#e?M~a26_my&p%apc0dsVbc z{+uEOy)yzc1pkJpK2uxvoKzDPOiacJ_VYlH6R9OC*%vA*bY>LWuQCqtkE33F)Bu+(JnUZF5#PeTZ%RDgccE+@a6Bhn%NPn#5_vZBCCr&cFszIY^B zB%|9`@6mBybNG9v;-Y}!w_~!GxbYewaW{!?!lUU;l$n}-DMIhvsr*Q4&8Ls#*n@*{ z=1QY?(~QwO?vhmg8MkOx7q@x-m@c%J37DO)#GHfPQg6{4?4Gk6)2~XR(Rrd{n1C77 z7x;^T+N@H3ZeC&cADvwX4HLsFlmn6{Kh2jXbYvSFEHP(Z9+uo|4KcovX??@J5xYUN z%HqRrlN&9zqT+CX zfa5^<7L8k+2MoJd9N$}_v=0>0!0#517NfcNBpC)EVhon9P67lqNO(quoh*8a9&r;z zr(CX6`A8h#_)(zB5vME5rAJ$KL(aumruX8U&~6D?lo$~SIv3Q-KJk29Yyh_^DIo%t zjI*HQA|-Nhu;Ky~XaqfNN3!#*%8U>mwknxDD$I5Hu4tz|hQ;TOG6=j@?I4VjhLeX@ zF8;1J;|E+eMm^P;>hJwv)aE8m{`%S^lZ=(2JFg)8dI?(mOq{F5BS zOHAE~a`xeEAU4ZSZLaK^iJ__c1Dm)jXiG?Y%s)RXTWdJmV_w|38Z<5QFmlaL;2n}?Ph}Dz<2XAJIEEnvJRwHr z8{c>yV>(+B0Pc3d?&!$CTOE1ubT=~TV(};15QR#5iMw2+?~H;1TXUR81y+rRWXDJi zB)Me3D)d9;!VIO$!2le@RCJR|n0;grEe!>l;zBe~Sc3NA_GqU?Eeh}G8Q`DElt9-d zPPV5fbQ7a)+N}yxaM>6;Q1N`!oP-p*UoHIa(_y0zz^9nI2^54bar&RG8;#+ZlhsQt zY34<+;&Ck?-!TIuq5Ev==zLm_QnpB=KrZJ&VykL zhG)pR1RJVUbxI8uCjluM8l~K)AbXw=-2z>IG<}f0T%acH<5CdiFGAHWUMnb-vjnr9 z!QY&mcmPiWy#NAPVB2y_LYxMG5(}JpAtr|{-=2;~=JIEfSQMFn@%EU#5)0tErdNd4 z2yiJFOdT0y8RfE4>^n_W7KY&6sU9c_=p1}M{f_W={7$2Kf;nl7v_OVI zCiVq<-ex7^5gP1RcH(RBGqWk_>!H{y5~hr(k{#`bt?Tv|Ah>DB(WA`lYNEV+ena$6 zx^Y(PkNH33mn%QA7mIr)q2*RfPEI5$kAV6{(!(>2wUp(9xLNcAo_PE1RZf0C7S`+h zT9uf?)Ajv5deRSC`1@!As4E!yw=+Jz9KWrygn0eg#FxX@S1A#3?C7XvCT1h4l?3l=_ieAjkS;(a?Kp>>Wx|}pOp@cszIjJk`86z7 zw}!_|u!=)JLYf(6D?Zyq6Sj4lSThm-mbTS$83S2mm4q7Hv97J8nO=q9u9N5ezj;;BroQhns!cSjKHGF1w4>{B z;o$@BIkN71?Y!ZOeU*y!Yx|!UEen_N4=g%5Iif>d%V*sVekMNNh>2-556o1RISaT# z*7OLXqu*e4jn9VG{!A*O(gT)4+2pa&z$Zo}!Y6`sFK>Nrls-$C1s@trAhgDmCDFyf zz&z^Y?E0nCKm*Q5OQ|^g4CO~gZ3IvAZMhDxsL8!}v~ECTNZ8}gS8nfEii5hcOK0Ak zC%U>a&*GKO>tc;aPx;gE@X_!SJw^JOu*>M{_bWg3q)$SN7#8@;3&(;Hx|>qZ1H&D0Q_H&-Q6V`5 z7=mCGdLPf}A>z+mq3^7|n89R0^nf_&N;^U$2Ga~$$d8Bm`Ow*^AhN3I^0uSR{_Mb{Gxf= z+TBG(#~R0iBfpch_a>%{UtwjvNZVV(}pfKW2`T7QRRa&dI`1B zr^^}Y!H#{jWm?9{_^#1wPt>Dj0M`9O+n79*G`VVnYfLYtIk(EWMLYAaj8~TL;Er>c zN66zTC5Eui*h>cy>V&uluz|5kva!OO*z5>jCq2Krv5N1SrA_Bz zH8||eBJK>}r>I=;4)cn@nV(Wvys9SAXu|@FgFymSNy}Q&KBZlI1e>dC0UW*#TpEyY zQ)9`c=7IG4X{YE_F+vTCDO=EbzSlW8D?I#l^1Qu2bpjI) zHxKAK0W~xi4kn&KrDHF51R&iI5@FsvzDlu^udJ?a&^kJUbEB$XuA&E{>d0^IcvKg! zO0_}`#k!Q8<-2Mc;0fP?`oe^Kr-5jI#hdJdtzL59-V|Js80#Pqf@S6&`;A5o z^Xt#2b9IsM(dNgfTiUncAP1iIE9O+F(jPDk!%WAjhAK>4P_*N$Ie;E3cwN%KaN4&w zQ!I1*(*gYtQur{%+4d^G98^Ls8-t*Mf==ndZgu}9VMBbK#~+&U6c7yx?p2?_lZ*!v z5I1OuKdQWq$H^eYfE^<}Zgm(Mx>br;i8H8I3Hz^11TnII7p2EVoS!I!o}-`By2klb z&&i>)fgnb&OI4WBJPfcQfrgWmGi{QpmYG$UWI`RYX^?AvPE5&i(QmCT4xRQP=p<)j zUqYB**F*9P-$o%ptB!@$JdikqwQ#CQj?}KDm>(_G}XjwQr1{4#Y3d z9-GrV9IniYlQLOP)o*h;2k#j{VThZB8^ai}yk#pB>qf-@?EtJ~xoZm;ev*un3V?&0 z{Z8@3m(}uq(k1w7@NHgV8%dCwFC6boJ&{hu*6p6FE?sIf(4f*Etn!T7#uWJ$m|abD z4Kev13(ydl*2lUi;-`s&y~(;Tyd#I2r}!L zc+4gn*<9RDy8r|?8)dL6b;<@QdLycx^ERj4#$I0z)cqYo8)V>Qi_nvX&fFm@qlE8X2p|dnGAU`Bu}|g_d^*~dJ=`0)<9gwC0eb=y{%44c#DL8qV-Dt<#6do`SF-uH zQHy1ID7;7+b9?~&ueMZew7rJ?%`s~)u!XuR`mpD8KF+aW>r@L|4EB|}a-Mk9{LOx! zDKdXh7VwVADmbh{N_83Au24>+MY2u&?l8mlRsey^tmlSOQRDyTspA%RU~cl>ttLPfXO;H3G3yM~&nt-?`19r1T)q@r*M0+?7&$VzL9jz%!m zot<8ouV!R-C_RI%0(Ms&2u#82ZSx1{WZUDf($uAd8&U4@`vZX3>RobV4*1M3eWBG+ zvmH_4TRnU)ln;RcPFN0sV84le4c!*3UH}S{v*AGq4_RQK7WfNiURoI-jwS1q>N%IF z=~Xh)vIvNX(k>B^zVuDhVeRyf<$~^i`5Yrm#4q}Ims=qOeSD;O)2!*$mT(Ktg{ig5 z;Dg&48P#%ld8(>m_Yt$pm(U3EH?^=({H*+D$esJt2jMJc?2+bx*v)s!?gm_RPzKN% zthKZ+%2jjGF@6_9bQ~yObS>3hf>-i%4)B3u*Y=GoelTp|mH%CubZA~Z>pe5p+$Pbe z+5xOs(L6rwC%-mv23!;`&rE)Y;-R{Vb>w5K>vAS7k%Q#Ysd2X=ZKttKzl+P{T99J5}4wd zZ0Co2{5~~N_p^Hn4|r*Y2c_H#nQPE}}ztUFQrpy}z8^M*Xc7pNW zRz=;O<4z5!;Aei`3&&ZAG}};NVZab6?Px6RZ_N{Kq|c`IKUz zUe6l|vd<|?psZ?qES$kN#_E^~rXRZjIfU)~rn(4UicG9~oa*!O7zn_ZhEijgXCcUB z==+quH~9G~X2$IWhC76gzP*rSbm|jWxjwn>`8d#okd`&+I4Y>lqd+i0Wj#ix!rr@S z;b_jp4pvx*mzSx9ueiRwqobU*oe#@1fOvvm?Hu7Ws*XS46=DLAb8?5Y7sSq(?3R(7 zSg9^!pe~ZZ%vg}UJ^>IDk0LWb3MR2OxASs)G5HR@jNl~_?(Z3kL|6{b`WdU}i-b@3 zPQRkOXKt|Co5Z*|JKT{5@RI|Vzij%_Fc_VSJ+Bv)j;E1F9DGr)-`&~goR#?Ru}{tL z;n01&FPrr>^rLaI1AG#UDi*K@znsED;$lrV@;8QVdb4@n)s6wf1pBtpoj@@*LG5RT zk8P;t!z!mGZS2J)hIVdhnSxs7{+f$^zdDt*hEL39bd;t`2M1*Z_4B5PqmDsvTVwMJ zmX`$o+c|&B`%X~shWg>C8G+S6z}U)&QFgA*m&OEIKKUO=HFCN!JZ_BTVP{@@sj{59 zqm`7lB&8K#s!)KJb1$NDy@X=jak-NlVa91P{-Z{f8f&PjrbO$PL8)_KN61{vm&R|~ zelaR$Q|MUb(KdPcjSY)%2@+6d)#mZ6>mE-Cx-i|4iil2pZdNqCCBqL#@mZ(ebX-KK z#wI3`J{M?xQwME~oZuwT7_w}i3}IzBlE1eU^z}BGK|le-m8$YxbqQ!4gtQ^CL}%Zg zu|Lg%UZ!E|;h3YjNSG{i?8Z(P z<$koL7pxBmc9bfc$CR#*Z#b5}Ta|3annaEmMW@M5)$id?&7rX{V_xGm>s+%ZN{K&m zq1PZmGT$GfH=XNpt^r{T+>zLxtbx)btxHYULxk)rV79obv_m_^xQuy872SHu>ysOh zuxz_X7S2_E)#W2{svCmk3G3tbTJ;kJ1577bU8k;{#Ij{xhLXH!rzJG#qWU zbjcqYlnx8(+-=5+E}4X=sC-Yu*^2K)GZ5msGi#!Y%)W=EQqCS6OIc6N zFD0~}DWB;$vT=Q-sTylaitrfGQtp$*<1jvFvZ!3!PYEwKpDE<&sl) zZGL`;vvNW~nrfK)1IYH`ShwNBRsB;f?4DNuXPgwCJ&JbZ>B_OoPHTF>TI>NFwC6bC z0|RQ4r&Zf?gT^jrJDbA2XK204{a8IjIZEUs41I0|ke$?{n2k1&&?Qh$@*iJ0H{zH?uW2u^f2)7O`M<{zG`UwhgK z@KW99aIp#Lwd1iv$tn$xdo<`?B5rb58c47YYE$lFe}M9c5}&f{sh?N2VM!HcF#=O` zYc68rl}*fHVARunZh@K3z3GkK1sBl}-kTep0HCGgkv zF#JJk#py8S1D`y4UN27%ST&~77{r|*boOk2_G+(mzwW!hJW{rIZ?hm9 zJ}K!M+YQRJP}g@@>V)#K^l+=$opBkAX?&^;V-94#J?Dq~Q2+1oG7yiq3#*S=fN?qj z>Q8c%NR>n`yt!gb*fXYIo>;$rRjGIXs>pcXJk1Du&uSV%@ILzcI^4#0q*fWaJ@!dn za#o@AqPLLuHE#VEbCCR9`t@aB-F^~Gf|{XubJ3*v{29FDrypTpf^(f1m=%qMyJFp9 z!&_70J!-E;z!grx+^lwl(#^mbZUB!0JbSQk%})QZ?Ed-nEAshtT3oO1GbgAw}aY=CFji7<5# zs8ZXO75wk*^23gr{u8_5L~K0EFmm{+SZ}l=oQ}RsQoo+V-jlP~+#9ZSAV9A|(5TIC-DSbif#MmU7R3tJ^@j7spNbf+P1 z$R@qdR(I)9&}-eB#RBfL)`^WzkoBzwf^)t*Nm;E1#G!n^U@cVf3zWRvAhTuhpgxNL zBtMT{w>!vyKcOKaGY7fODX18N0q%G%x5SiX=FTzczXXI!n+!SgoWO3&{9N_xI=%GO ze}dN?-OgcNekwmR*!iTy6)x-V+jj@uhh= zq;ra{kwGq6&!{?6y@#mqSNOS+%sZ)Bf`HR4)FTz!wc{)4RzDaR5ew%d&vhoXJ{3~W z#4H2MR_zpT9y*}F4y`7%#z^qO8-xfB-~-rqSISKy&o3y0(MeitmLorY(~~~47Xbup z`yZ?aM`&!SV?ju~qeDBiWtXj-PJf%&pbBEp#GSLIyzZg9Pq?*W11iBOHL?0{zRp z4MphC2!eAxqpEUzi^!P%EoZbQ#@V`LU0KDhc#&c_R+&l(@k*)v?YoNqj_l3Xo(>Zy zbOZ~8k>(;zc{!xDI?o>Wf||3c+s_V1SkI8Mg#!|-&J9D0-OKu-SKWKnTA==B-{)#r zbi7Qz@IV2O?d1o49f!TI#H{c}LwAiU31rknfR>Xqi`WD_h74hZ_|C32f%DHw!Jqoj z$?1w<*4ffE_8^q06GI2*eGB;cavM0{y^@CP1P*xp(SdsIlWvvPpF4SuO!jU1=B>-1 zj<7mED}X4-HYdUA7pKq!sR`1nNx{AcD>jiciEAbR-jgNwI-gkwG}^~Z2LU(Y$pKl2z!bpS_B$(x*dK)FQF)hd}SUFWvadB^GHFW)dpRw1?&*qvM!g zNrPpPiFT}cT&4V8y_O)aK{gW*UUHG}oN7gx)fK<*jPW42tmh8A*0x9gT7?oK)A&W1 z>4#bma3CfFb%C11-@bS}L*mPHgKWKA$nis#jPHF$=isGbq#jb-1i==8mgy_L=YW$E zd}aP*KeBB(|4mSD`~C%qNl0zcsx`85LT`%DF4rN8j@hg$%ETCV?QLKWyE8_uL|`KK zCz|LhaSOgx?4Q{2|4jI11-6yZ{3DtTJS?O8NHjq$7XfGeAY91qmjb4jqX1L3aexhx z=)k%1DKzfCvIzbohRpj{44IRQm-jzo$U4yK>MI>WnDNwObI1rd{Y|4+vw? zI_;j__scHr#+IqQe!m~zeoIN0B#;iJJ5dvJU?pUTwAB5+CTAi+HXI|doo066P=Lgp<-UN(pfH?Y6C{wKuSf9 zrkV7Fj2hkTrG{f( z{O{(!)yAC1L{eHNLX4lVPNlt>`S2oN#@<-%Nt;cNIN)}!?4zR_0U>~Nz{(PM#Y)B8 zG)8V)qR*T)rkj;F_@j@pzdw1gig^X81B@%a1k)wd;b^+j+0hw(k}fV99;IEd@vh6W zmB&cNq=myJme_OuA{PB-tt027umAPX794Nm;rZ*}FVCc+rE3<0*1;Sh=n_*IEoYvr zcTA+n1GnFyI~CDa;2=y)|;%l93?FPAq91QRz+#a8H=r2$em z@A0BW9o?<3Xf~otxbF471@dIyxUfpY*gNjYI!erq{c+9MnzB?G;ybcopfYT81_CZE&#qC zWnYeJac3KB_Q^xI?`@O+zrwx(Dypt+TTwpPsOHf?U_uF6Xf}Yh700 zmGb?s2`wswDe`=sq(bY6u|gyKj;025W@`8eG=7K1V7ipZHedc~+^d_sxSrS7%kekG zEd5|CEeYh^7E#ta3|$VAv7yntb_$BF&=>MbcNvGJ7ja;B6#eh)zG)(Q#Z4gR6hiHg z*u9#{J1Azv`4Orutrj9Mg8lTpQp?Fhw~zV(58e&C8)if_8p}nKA#B>`c8&a>p(D2T zeh#nX-aU*{%OtJh`V3>_cG2{z8=3iT+3DP7(s9mO=1qlhfTR~YIF78gc?02?&c~$FH`crCXEYEte4y0{KKe$jL3S2PdzPI$PHt#4*Eq-47h(8h`!Sw1V9S(!&&W@i?(>WMGt$<*82@<~`g#^wk$1mD}4m6f8aO z@G)l!+h$qrwKe_?kBB@0bU)k?~;axtxR@}Qyrj7~C#A`jcW&jELIOm@-VFV~SRS}Unfrr$g1pP9gIi+>zP z(M}VZ=OsT)R{I(E z_n@~nCz*A9vYjoS?Mby2Lt5sta8A>xbcY(xjp-_R%)Rox%00Aih(75KvYbUSRaLTz zE}63`dk!~x{`QV3#`l~{MqIPRQ)T<~f>Yo_^G&(&6g5V1e-0@)#2pn$NF&w70AklLMh;Qo3JiJIysC)?b&d#P2 zmeNnb^LEae9Wf=i!ca{ycyK=K&<*_JfpZ4_3&=pL*8=0%%yuKY8%mxqV-}U)XlZdFrfq1{dC)Rz&wQR3a|h(0(On z$({J;#273LnH>^;ousi3=?I-m0&3v|E--s__73j8V3!{$)=hoBNR+92{%e-^)Gtu+ z6u$or;k&Ad@0v@h{Ce{L9 zNzp)k#T_0egunVubSTFs66GE~Qq$q`7`hg{#W63S!VWf;PtWD~!Pht$p#4x=Z`vA1 zlDt}eEahf@A8(v5Y9qU!{^Q$Kg9HuCi+YWwN7#Nwizodqo-)aQpiwLOTW%}7$cnRW z$2`O*%Oy~oz%jJS&9(Z{yMi11MOzUg&!6|sH{$X2V?qSdRN*-nW^TYC!?Dh z_s}hoATQ!FkHnJ8_KxWky?TnlTKRSb}29>O>B`E%J5qM2>AYST&AgO zuzC`IZDbRNBBFTu04zhq zxb)b89L9V$O-<^W1Ft`qvzj<#^@Aq%j+}$+jQ4WeI<$KMTu$W%8bPZ(0`iMVHDm*U z3cEPMFTiyac?T&~QNdk45n8w@Sdse<2k%`Ojl2iEv8`BZRz4X|M{JC8ubjMv{!*9V zkyVYASxcI*vKn%0RETyD_L9e}^3vy8g#>6E4~6g$R0Z>o z_@Utp@f)?j!D=8s@~H~{&blwIPZ97%G6wlVh)%Q_JRjmw!NcHB+`3xrPUNRL{vK@v zubeQ)pX`X#B66e>^D0@2h|}>t3$TV@mJGq>C`x9f++iIzaz6p&NVpv`+o2YOpe=$x z5gHtWOtS1V9^fxo!?oYjB^;J23o(D^7|6dN5l%>H6p-O)UWS5KlldcZ=5^6oQ>+?t zwcq9wB~1J5p7+mW|pmBfVI@%#b@kz$M_vRHUojuR|$=MoFw=Im(>f<}9SW=-WvNiYeV z>`!SZ@7-U7|CoNJVTai(6!qIztNiWOu@!26z%&MXXAfLuGeSf-)f?*jt!KF&1YKOl zSa@ZOiADxsnL8Kcs>i~%7H@*yjbc**FgxC?sSbSzJ?2khZY{iLwlwnA55ai1_z$Oz zo1o9B#BdxlLH&?mt|a_~gQ%RMdtqn7FJSv!Ir_6@Fr!A#W*%PLf1aHd>c0!fJN}?kP7i8G8;kLNBvN|W5*E` zc(&1J>##K`BdYTQ-s-7Z8KfxME7K%V$Mz8|sM5IqyZ_1IO6Qlx&i#o}*H_iwe;7TO ztjqu7)Jj89*L|q-lL_qb^GZIKq4VAIM%AS4Vgnm}%2xvq+D3^O`24cB-6rR^8UraP z*D%A3s_qZ`5ZqV%($JreU@iR=P+FU(HGPr4Md~aw1wr7sfeTc>GiuP~Y3!WAbwdoB+;)L)St*+N^7W*pt{~ z{{&`sQ+GYOGBxZjiFm6#`=>$eS?a-TYmiz{4^@Hyg+szKHHlbu#Fiw%W?ZByk^M_s z9bJaL2o3zIz0#y)Us7Li1F75hx=Xp2bscWaezEEqG{{fRty1#L!cwLDE2{+)!om}Z z+RY@@ptm~Qo&?%TkX2t%<7oG9PYFKBFwwtF7O8LNu^WEQ97st&# zkI}Xs)8@rcxn#aOdls~U+X)q^s& zfl<70>emzzuikd8Plx3K+D9~K%PT0;i?_7TWFSNDU@hbYInJcdK)3vP zd2UpE=u+WASR4VX*Ap` zy3}V7m?vh}T5R*v4}fERQ;S@}I+66Om*3lS*;f`(F{8{QUr3lUK`;F(sja2tPoB>q z%8t4ETIn;cf5tiS$SjogwGj~)g#*sxO#O=FoeWISAgG2 zCU=9!NCs3%5=dVCw%=zQs$n-Xv#>PZn_~7;X^1AmEt>XaIgs!cJPpOd!w%;`TrEu| z{Xsm=yX?)?ckh3JW;3;RC|&ri?=dnR96r!5Q5fuoXDi?{e_o!h7oo58M6Vn5Oro`* z!Q7)|R!oV?xHsk^3eZEar!pH+eTcVn<315w|_^9mCw|>ias+*x@1j@}~PH5jU{2v!R+Em+g zbCpR^+LEh&*O8UKUe|GcIIt% zVytUWBi?((b+RBQ6jBto77$&Z$A|^|{5}M$q5xVe@}VlL%8bZ*3t>glj24lNi*Ow8 zgR?O+W3ZBzBIWi%_nr6i0H^P3cqvlW9<6cDU_y7kWs}CT^z$txI&p5dto0cB?%xSF z@{q@nIsa5kQ~;|BJj0aDdC3xxP0g2taI`LLc+X_0GqF2bZWDabISPF&8a4y8A#B<~ zqE=)GtYzz$foy<4`RYP^i|Au@(|k)0|D! zL>9lxkyVRki|WVgMvmrKM2sbPPwAPes*o)#(fp~;jnEzi4N+S$ts0U}5K~Yh;vT#? zpWw&gBi*bl?b08_L^vuxD%_n!_e%E}qnRjkuTt3m;iXP@7@bdHvAiW=t0F6_;%%iO z$5l!wip+h=)v$k_GB)PT%WJp9`XzyuFs=5*;RU;);^9sx(VqmV4z`XgGrkZ^F@u`= zvL};6ULPuunDg1CE{?X+TKM$Q2;wxF*Om9~DbcYz$@{bGk#={7A|)}q7R)&wny+|O zl?W#>5IxPv*}};<>tPxqQ!YAGk~H=$*Yn!*d)i19XOo_2TH-ar%AaH5T2}PS!_7_^ zN9BdoX4@O=Bt|L#W-oqHJkYe1pJQO~3WI7mQ?KEOq%^j8|$82oZV47~bqW z1!rz+MYt9uYVsQ5K$)Zj$N0D8`cwf?^8x~mu)KychSD-MuZoh-H5BDUC=BL;5vL;WpTa0N+aRpF!H4^SiNctz}m49-MM5mG;E($aF_tA2*m^dr! zkKtZTC%p7Bf> z)#W02*u9|mYWE)X?*118;){x!mmRnXPlC9Im~=}T)wQ)XzPlcWty8ucIJ~SZcYaw} zy=!%5m(uZ?WS64l8HJIab7rhYQx2{BQ=s=T&dJWpN9zbQ2R*qu)SNbQ^(*W@3#{0h znKAf*VC3^=B{V+N9JUgg26D4mj0E=2g2VsLT*HteEvSc&eE*)d*0fSm)1>qzxG4EZ zYPu=3NtkbV7i!%W&KAk0LxRs)!x$VaWs2?>S`i?h*&G;Xv4(f=OBpkVeMo4%Q}eU8 z*byBh(~BS-WM41LNd~l%$79;JWnVU>#wnVAEUw=#{JVa|d-f$EsnmLhG)qkLB@Uuc z2KZfOky4_g!#jr7PVhdvmrR?n{X+3Jjajn;{pE5;C?`>Vo4B9wba{~LaG6+y_*}o- z-~rPTzC|u+*ODjwNF<>ywTQ*07X6ifTX=5bsEx{qLqrBZnJy`7`y$Ls%GJ4d-Q&;3 zK|TzslV$HV^vp?tl$CwB=$M;_DvJ$qv-77?CI9E-I0Q{U##T~`e=-AX4 z0YPpikg2(a+CkCWs10Su2Ysq~nEiuRE+fArlIQopF*xRwK;vGMWdgQT&x~D55hDvg zPhwIp7u)Nkub7}uN!3a4UOkJ4;EbeROyFDU^dHgDs99%qnee4o)qv{Z?L5Q~}mSuliz4 z>r*pX3aPzc!eaQB%*>MZ`F8~exrX|rvX^Yn#F&Y2D{HHYvNSZy)1##9-XZo+4<}u; zCj9On5YT*{=y=}naKkZLj9vlZ8tO6CeqehhiEX!5pD4{s8J{fsd^~rPQ1H}#usdAR zMV&lY>UEIcl4kMvz&cMOXaCYS>TIS5%CBY*FmR5)7Vm%>4mVzDhQy9>&tHD0IW0*B zFyjasi*?e`eiib&Y!Hr0N%yTr-0*R&B!|BFmXD_Clu0R1pD68CwkJxQG|D8OPT%prgRZK&S zdSCKwT<1>thh;NW163{_u1Jm5Vz+#+u)K1;QGEM6i|}13^SJ&>Mlk@RDPVhjbnAO zgsahVZ|*CG!Thh#&PxRI_ApfeS7LDt@0*GGn)-rPpJ!3j1?e?PHJ7NxLXIn2bd=05 zf}$#G-%89aoHjn0iV6No)=KO+h1FUtK>jNtPrk+g`@+Y8q%f34fEiJpV=hcGEe`a< zqNrGyna~}x4=IjpdF-U%ht#%TQYS4(V{*=foM zu|n<1UM@Lb45Ar6snM}z+F{Rypvb4>k2SBzmV#2EJfI874ISjB2HNE~J?l0$>%DdB zy*j==;&nihpv4`Q-$w|uL-$fE|AMFZp93>hGvUH&BEJ)6QpFrN+9WF;cop=USaE8` z9Uy-jRG-x>r&4){te?8u97a|Oh-6vGt1AW2+i4{~nu*m9vM~>8w61MD`sBUE76)%) zOmpW~h&Idvk7?>8^A%b1PNwMQ#}egOPHv{^MHsNoe&L>9Oa>r$nS5;CILNxGnDRA2 zONpGBo;K7_F)&e!i=7AQaTfPNZ5}-v!d3Gj@?^n( z6Y?W#&u8$d%^3dnAyK>vU(&0I*ymdA`Km}NWsY+471}+=NKlRN`fpCpG77_wc6O8M zs#aOQ%jZX^XmFho>U%zgB)&;m24O#JCv?S>)piQLwzLQYLH0R^JT!@|aha4;*E~CU zPH5A<=TGZq$L3vl=Wm2@gd1rz^0GK8wAhw@YqPt{7f)@qfH&A2=~{JxN${9^h}M}y z>VY9$6a0(VC#VCjNYnr{!yyj-h?XN6zT=F}q^Y-*DUsuaVA5Ln8~qft|^QgW&Tws=A4O(NL?Uqily)xgT;E(4UhUp>{vN|9HAU zy^ECHL&TjrYwL&e2pZeErG;MBIcRAoceQ+N!bVN|^jz;loK;_4_nwNLL2=#p%8%Ye z@o9qZ8j9{v(IP^RH*4jrO?otqSZNffn}7`sEM<1TzLfO$*(E&6v+j3Refw1Pyxewv zk~^reZVGpZISAL4+nYYO9vwf|z&RLQ2fe;6XnMnahZfm5CKpO)u;8&LuJ$q_j-Ft0 zm~!kFR_i>4((5C#rk>J1+;9TzZ>Lolty3kzArE_ppX6z*`fa40e#$m zI-{{jPKeW4uh)`(aw(^OuWC zzUhR&()Sv=`(%zVVGu{5}x;iaFYnXA?h zm(x}Wka$_sEHYbm_rM&5b{leNV`kWt{Gv(Y-DvRuf_r97abixM{J`?~{l;*HoctHJhnrc}7&R&|egKUOO)>d`%MHjQttGjCwXn{B}8Ix^j ze)S#?Ti}b0L$uagqViuPa@&F^U5MvH4kCFy&hf<+A6C{&7?+D^{xP1e9AV(vPug$) z;*5I8jA#qHz={--eYxzkVqBNSL%S-wqZ(}^UAEyE`^zyD#c)@evDP;62dkrc;hDT z>-ee{8KZQh3=tUcZ13$OW&l5i!pRQH?5LM*K4Lx_b9}J6HFruVC(fXtON;sqPi2YT zCO^=T>#E-K;$78d;0ymwz0EcADNALLmojIgbYNs7WZ!s+Nq#Iln^;Hf1bBq?k`g_kMD22fBsKz6Xjh7x-s1T&|*CaoY1a zqekR~O7s>Ce7el4$e8W&+CW;&cHt^KY^|C6Fg<);XihH@d>@xDZ@BNdIRB@o;s#Ea zq;*M>b+O{}Tn^-<45hs)CQh~%NO2K8`iIlS!H#G@l%>zs2&3__b=!H{HgO%;$;>VF zH0#ahlIjo>Syz>*@UYUZ60CGzT}j!?5BCwnsnr#l|Hq0JWA(3je+jz2R~TV7E#wzkXym0-WXY~`Wbx|%Vbs1 z8=SqBw0Cwzzo7RHc1f_R&nEEIBirXUB3@Xl_A`*RanRzE_nkEphwoWW-|nSjxou8N z`^AlptEi!_Ay8}l`;O&VgP9qUJdf?+Kggc#P?aSSn&8p3*%cphN9x5jn$&V`NSh3I z!f;DRB}yw!DAkn8G~UnI)_lo;tV{c~7DNw)#D+hGwxBxW(SO5e< zeUOAlT>t)8;^-@j1r!Q{!};OdKt5yCAE1RXHwtqBz-??{VQK<~fq-TZb7bZr$0w!Z zMzlu&02qX7IsgDW>hlPfSKh%)!r0ZELqY%q06_p?6kx+Y97z6CeiVL!!|8o72$&y= z!lSru4E7AT|9s(xL*b~`RsNzuz)&~}+2d~-5CVoFdrnypU?}L;K`8hd&f_luC;)N| zU-B0X!p{do0e$>M;|D>mL0SHyLHGf%n>P4hz<(S?pg8~6dk7yt;HEGi3a;XoVLrh1 zx%EtApi!0-%LLQ48KOC{M#@Pc8xOf7Y%^2dy@tP!XUQ- zfuO4DS{4=me9N`U;RG~Ch$LO^dB0YM-)8BwPWaFYfC0pK{dpG(+>jwUugy3_8Nq$%$o|qf2Z|YH3$lX-{eDu2KlSY zUgsYIf?Y%ZT(|$N1rQVjyqQ7}3P=J0O(&`>>tG_*;};$27$qdTfz|3 zxOu}F2pCl%H)tr~YwV=!_PFO@0{~D|C%Nei9~68I(e#&t zsDT=O^OW#|U_d^^4MqqAe)|Ffh2QQae0;YC8VEo1_P~X*ar4yi!@!XL1cDs8B1c`% zR<0NfKoWd#2`E1t4wC|lOF+f>K|qP?(E=g{g#tk0k|IL?Uk?3i;4BwcV`oy= diff --git a/tzpfms.ps b/tzpfms.ps index 0a1466e..0ce3f2c 100644 --- a/tzpfms.ps +++ b/tzpfms.ps @@ -1,15 +1,15 @@ %!PS-Adobe-3.0 %%Creator: groff version 1.23.0 -%%CreationDate: Sun Mar 10 03:22:22 2024 +%%CreationDate: Mon Mar 11 12:11:34 2024 %%DocumentNeededResources: font Times-Roman %%+ font Times-Bold %%+ font Courier-Bold %%+ font Courier-Oblique %%+ font Courier -%%+ font Times-Italic %%+ font Symbol +%%+ font Times-Italic %%DocumentSuppliedResources: procset grops 1.23 0 -%%Pages: 15 +%%Pages: 10 %%PageOrder: Ascend %%DocumentMedia: Default 595 842 0 () () %%Orientation: Portrait @@ -237,8 +237,8 @@ setpacking %%IncludeResource: font Courier-Bold %%IncludeResource: font Courier-Oblique %%IncludeResource: font Courier -%%IncludeResource: font Times-Italic %%IncludeResource: font Symbol +%%IncludeResource: font Times-Italic grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72 def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef @@ -276,389 +276,20 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-ADD-B)72 48 Q -.4(AC)-.35 G 42.103 -(KUP\(8\) System).4 F(Manager')2.5 E 2.5(sM)-.55 G 39.602 -(anual ZFS-FIDO2-ADD-B)-2.5 F -.4(AC)-.35 G(KUP\(8\)).4 E/F1 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-add-backup)108 96 Q F0 2.5<8a61>2.5 G(llo)-2.5 E 2.5(wa)-.25 -G(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F1(SYNOPSIS) -72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0(After)108 153.6 Q/F4 10 -/Courier@0 SF(zfs-fido2-change-key)7.564 E F0 5.064(\(8\) deri)B -.15 -(ve)-.25 G 7.563(st).15 G 5.063(he k)-7.563 F 5.363 -.15(ey f)-.1 H -5.063(or a dataset from a FIDO2 de).15 F(vice,)-.25 E F2 -(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15(xe)-.15 G -(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G -(umber of additional de)-2.5 E(vices.)-.25 E .273(First, the wrapping k) -108 182.4 R .574 -.15(ey i)-.1 H 2.774(se).15 G .274 -(xtracted as normally during)-2.924 F F4(zfs-fido2-load-key)2.774 E F0 -.274(\(8\), then a credential)B 1.604(is made as-if during)108 194.4 R -F4(zfs-fido2-change-key)4.104 E F0 1.604(\(8\) \(e)B 1.604 -(xcept the "primary" de)-.15 F 1.603(vice and all the ones)-.25 F .185 -(holding backups are e)108 206.4 R .185(xcluded from the search\); ho) --.15 F(we)-.25 E -.15(ve)-.25 G .985 -.4(r, t).15 H(he).4 E F4 -(hmac-secret)2.685 E F0 .185(is instead used as a sym-)2.685 F 1.555 -(metric AES-256-GCM \()108 218.4 R F4(EVP_CIPHER-AES)A F0 1.555 -(\(7ssl\)\) k)B 1.855 -.15(ey t)-.1 H 4.055(oe).15 G 1.555 -(ncrypt the wrapping k)-4.055 F 1.855 -.15(ey d)-.1 H 1.555 -(irectly with a).15 F(random IV)108 230.4 Q(.)-1.29 E(This turns the)108 -247.2 Q F4(xyz.nabijaczleweli:tzpfms.key)2.5 E F0 -.25(va)2.5 G -(riable into).25 E F3(salt)108 259.2 Q F2(:)A F3(credential-ID)A F2(:)A -F3(credential-public-key)A F0([)A F2(.)A F3(backup-salt)A F2(:)A F3 -(backup-credential-ID)108 271.2 Q F2(:)A F3 -(backup-credential-public-key)A F2(:)A F3(IV)A F2(:)A F3(encrypted-key)A -F0 1.666(]...)C F4(tzpfms.key)108 288 Q F0 2.238 -(is actually a dot-separated list of de)4.738 F 2.238(vice b)-.25 F -4.738(undles. The)-.2 F 2.239(\214rst one is as-described in)4.738 F F4 -(zfs-fido2-change-key)108 300 Q F0 5.181(\(8\). Subsequent)B 2.681 -(ones also include \(identically-encoded\) IVs and en-)5.181 F -(crypted blobs.)108 312 Q F4(zfs-fido2-load-key)108 328.8 Q F0 .081 -(\(8\) shops assertions around de)B .081(vices in a de)-.25 F .082 -(vice-major order \212 depending on)-.25 F(de)108 340.8 Q -(vice numbering, a backup may be loaded e)-.25 E -.15(ve)-.25 G 2.5(ni) -.15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.)-.25 E F1 -(ENVIR)72 357.6 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 -(TZPFMS_PASSPHRASE_HELPER)108 369.6 Q F0 .046(By def)133 381.6 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 393.6 -Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G -1.596(ill be run via)-4.096 F F4(/bin/)4.096 E F2 3.262(sh \255c)B F0 -(to)4.096 E(pro)133 405.6 Q(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 422.4 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 434.4 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 446.4 Q F0 -(Pre-formatted noun phrase with all the information belo)160 446.4 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 458.4 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 458.4 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 470.4 Q F0("ne)160 -470.4 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 482.4 Q F0("ag)160 482.4 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 499.2 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -511.2 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 528 R(En)87 540 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 552 Q F0 -(If set, enables lib\214do2 deb)173 552 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 568.8 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 580.8 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 592.8 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 609.6 R F0 -(The lib\214do2 documentation at https://de)108 621.6 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 638.4 R -F0 1.6 -.8(To a)108 650.4 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 662.4 Q F0(ThePhD)7.5 E F1<83> -128 674.4 Q F0(Embark Studios)7.5 E F1<83>128 686.4 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 698.4 Q F0(EvModder)7.5 E F1(REPOR)72 715.2 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 727.2 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 744 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 756 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 2 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 -SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) --2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) --2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 -124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF -(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 -2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 -(,)A F2(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) --.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 -(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.555 E F0 -.1(wa) -3.555 G 3.555(sp).1 G(re)-3.555 E 1.054(viously encrypted with)-.25 F F2 -(fzifdso)3.554 E F0 1.054(and the)3.554 F F1(FIDO2)3.554 E F0 1.054 -(back-end w)3.554 F 1.054(as used, pre)-.1 F(vious)-.25 E 1.272 -(credentials will be deleted from their de)108 223.2 R 1.272 -(vices \(as-if via)-.25 F F5(zfs-fido2-clear-key)3.773 E F0 1.273 -(\(8\)\), if a)B -.25(va)-.2 G(ilable.).25 E .594 -(Otherwise, or in case of an error)108 235.2 R 3.093(,d)-.4 G .593 -(ata required for manual interv)-3.093 F .593 -(ention will be written to the standard)-.15 F(error stream.)108 247.2 Q -(Ne)108 264 Q .464(xt, a ne)-.15 F 2.964(wc)-.25 G .464 -(redential of type ES256 is generated on the de)-2.964 F .465 -(vice \(with relying party ID)-.25 F F5(fzifdso)2.965 E F0(and)2.965 E -.499(name equal to the dataset name\) with the)108 276 R F5(hmac-secret) -2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 -(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 288 Q -(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ -n, the credential is asserted with a 32-byte random salt, which hashes \ -it with de)108 304.8 R(vice-pri)-.25 E -.25(va)-.25 G .963(te data,).25 -F .138(and thus generates the wrapping k)108 316.8 R .438 -.15(ey \()-.1 -H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) -2.637 E F0 2.637(\)\). This)B .137(mimicks a)2.637 F -.8(We)108 328.8 S -(bAuthn login step.).8 E(The follo)108 345.6 Q -(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -357.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> -128 369.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 -(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 381.6 Q F0 -([)A F2(.)A F0 1.666(...)1.666 G 1.666(]...)-1.666 G F5(tzpfms.backend) -108 398.4 Q F0 2.707(identi\214es this dataset for w)5.207 F 2.708 -(ork with)-.1 F F1(FIDO2)5.208 E F0(-back-ended)A F2(tzpfms)5.208 E F0 -2.708(tools \(i.e.)5.208 F F2(fzifdso)108 410.4 Q F5 -(zfs-fido2-change-key)60.228 E F0(\(8\),)A F5(zfs-fido2-load-key)56.727 -E F0(\(8\),)A F5(zfs-fido2-add-backup)108 422.4 Q F0(\(8\), and)A F5 -(zfs-fido2-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 439.2 Q F0 -.486(is a colon-separated tuple of unpadded URL-safe base64 blobs; the \ -\214rst one is the ran-)2.985 F .217(dom salt; the second represents th\ -e ID of created credential, and the third \211 its public k)108 451.2 R --.15(ey)-.1 G 5.217(.T)-.5 G .216(here e)-5.217 F(xists)-.15 E -(no other user)108 463.2 Q -(-land tool for deciphering this; perhaps there should be.)-.2 E -(Finally)108 480 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 -G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5 -(keylocation=prompt)15.506 E F217.172 E F5(keyformat=raw)108 492 Q -F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .106(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F -(to clean up the properties, or to issue a note for manual interv)108 -504 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 520.8 -S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.556 E F0 -6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 -(command succeeds, all is well, b)108 532.8 R .729 -(ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 544.8 Q F2(zfs-fido2-clear-key)5.146 E F3(dataset)8.646 E -F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F -10.313 E F5(keyformat=passphrase)108 556.8 Q F3(dataset)6 E F0 -(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-fido2-clear-key)108 573.6 Q F3(dataset)7.607 E F0 1.607 -(can be used to clear the properties and go back to using a)4.107 F -(passphrase.)108 585.6 Q F1(OPTIONS)72 602.4 Q F2109.666 614.4 Q -F3(backup-file)6 E F0(Sa)203 614.4 Q .352 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 626.4 R F4(must)3.194 E F0 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 638.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 650.4 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F1(ENVIR)72 667.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 -E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q F0 .045(By def)133 691.2 R -.045(ault, passphrases are prompted for and read in on the standard out\ -put and input streams.)-.1 F(If)5.046 E F5(TZPFMS_PASSPHRASE_HELPER)133 -703.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw) --4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.095 E F2 3.261 -(sh \255c)B F0(to)4.095 E(pro)133 715.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 732 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(fzifdso 0)72 817.889 Q -(March 4, 2024)161.068 E(1)191.337 E 0 Cg EP -%%Page: 2 3 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(FIDO2 back-end con\214guration)72 165.6 R(En)87 177.6 Q(vir)-.4 E -.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 189.6 Q F0 -(If set, enables lib\214do2 deb)173 189.6 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 206.4 Q .625 -(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 218.4 R -.726(vice which supports the)-.25 F F1(hmac-secret)3.227 E F0 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion is shopped around to e)108 230.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 247.2 R F0 -(The lib\214do2 documentation at https://de)108 259.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 276 R -F0 1.6 -.8(To a)108 288 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F2<83>128 300 Q F0(ThePhD)7.5 E F2<83>128 -312 Q F0(Embark Studios)7.5 E F2<83>128 324 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F2<83>128 336 Q F0(EvModder)7.5 E F2(REPOR)72 352.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 364.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 381.6 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 393.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(March 4, 2024)161.068 E(2)191.337 E 0 Cg EP -%%Page: 1 4 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 -F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.587 G -.25(ew)-3.587 G -1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G -(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 -108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(FIDO2)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F --.25(va)-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.307 E/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. loads)118 -201.6 R .79(the primary and e)3.29 F -.15(ve)-.25 G .79 -(ry backup credential, and for each success, if the de).15 F .791 -(vice containing it)-.25 F(supports the)133 213.6 Q F4(credMgmt)2.5 E F0 -(feature and has a PIN set, tries to delete the credential from the de) -2.5 E(vice,)-.25 E 5(3. remo)118 225.6 R -.15(ve)-.15 G 10.689(st).15 G -(he)-10.689 E F4(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A -F0(,)A F4(key)14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3 -(dataset)133 237.6 Q F0(.)A -.15(Fo)108 254.4 S 5.859(re).15 G -.15(ve) --6.109 G 3.359(ry remo).15 F -.25(va)-.15 G 5.859(lf).25 G 3.359 -(ailure and missing de)-5.959 F 3.36 -(vice or PIN an instruction for manual remo)-.25 F -.25(va)-.15 G 5.86 -(lw).25 G(ith)-5.86 E F4(fido2-token)108 266.4 Q F0(\(1\) is issued.)A -(See)108 283.2 Q F4(zfs-fido2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(ENVIR)72 300 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 312 Q F0 .046 -(By def)133 324 R .045(ault, passphrases are prompted for and read in o\ -n the standard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 336 Q F0 1.595(is set and nonempty)4.095 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 348 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 364.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 376.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 388.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 388.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 400.8 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 400.8 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 412.8 Q F0("ne)160 -412.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 424.8 Q F0("ag)160 424.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 441.6 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -453.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 470.4 R(En)87 482.4 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 494.4 Q F0 -(If set, enables lib\214do2 deb)173 494.4 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 511.2 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 523.2 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 535.2 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 552 R F0 -(The lib\214do2 documentation at https://de)108 564 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 580.8 R -F0 1.6 -.8(To a)108 592.8 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 604.8 Q F0(ThePhD)7.5 E F1<83> -128 616.8 Q F0(Embark Studios)7.5 E F1<83>128 628.8 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 640.8 Q F0(EvModder)7.5 E F1(REPOR)72 657.6 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 669.6 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 686.4 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 698.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(March 4, 2024)161.068 E(1)191.337 E 0 Cg EP -%%Page: 1 5 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) --.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F -(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 -/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G -(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.142(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.642 E F0 -.1 -(wa)3.642 G 3.641(se).1 G 1.141(ncrypted with)-3.641 F F2(tzpfms)3.641 E -F0(back)3.641 E(end)-.1 E F1(FIDO2)3.641 E F0 3.641(,a)C 1.141 -(sserts the preserv)-3.641 F 1.141(ed chal-)-.15 F(lenge, HMA)108 165.6 -Q(Cking the salt with the on-de)-.4 E -(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) -.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF -(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) -.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 -(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.208 E -.25(va)-.25 G -3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 223.2 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .046(By def) -133 264 R .045(ault, passphrases are prompted for and read in on the st\ -andard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.595(is set and nonempty)4.095 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 288 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 304.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 340.8 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 352.8 Q F0("ne)160 -352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 381.6 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666(SPECIAL THANKS) -72 410.4 R F0 1.6 -.8(To a)108 422.4 T(ll who support further de).8 E --.15(ve)-.25 G(lopment, in particular:).15 E F1<83>128 434.4 Q F0 -(ThePhD)7.5 E F1<83>128 446.4 Q F0(Embark Studios)7.5 E F1<83>128 458.4 -Q F0(Jasper Bekk)7.5 E(ers)-.1 E F1<83>128 470.4 Q F0(EvModder)7.5 E F1 -(REPOR)72 487.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 -499.2 Q(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 516 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 528 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 6 -%%BeginPageSetup -BP -%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([) -2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E -/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A -F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 +/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 -177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.978 E F0 +177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 .478(back-end \(e.g.)2.978 F F1(TPM2)2.978 E F0(for)2.978 E F4 -(zfs-tpm2-change-key)2.978 E F0 .478(\(8\) or)B F1(TPM1.X)2.979 E F0 +(zfs-tpm2-change-key)2.978 E F0 .478(\(8\) or)B F1(TPM1.X)2.978 E F0 (for)187 201.6 Q F4(zfs-tpm1x-change-key)2.5 E F0(\(8\)\), or ")A F1(-)A F0 2.5("i)C 2.5(fn)-2.5 G(one is con\214gured)-2.5 E F4(keystatus)128 213.6 Q F1 -2.1 -.25(av a)187 213.6 T(ilable).25 E F0(or)2.5 E F1(una) @@ -669,18 +300,18 @@ F0 2.5("i)C 2.5(fn)-2.5 G(one is con\214gured)-2.5 E F4(keystatus)128 2.5 E F1(no)2.5 E F0(otherwise)2.5 E 8.743(Incoherent datasets require \ immediate operator attention, with either the appropriate)108 254.4 R F2 (zfs-tpm)108 266.4 Q/F5 10/Symbol SF(*)A F2(-clear-key)A F0 1.778 -(program or)4.278 F F2 1.778(zfs change-key)4.278 F F0(and)4.278 E F2 +(program or)4.277 F F2 1.778(zfs change-key)4.278 F F0(and)4.278 E F2 1.778(zfs inherit)4.278 F F0 4.278<8a69>4.278 G 4.278(ft)-4.278 G 1.778 -(he k)-4.278 F 2.077 -.15(ey b)-.1 H(e-).15 E .565(comes unloaded, the) -108 278.4 R 3.065(yw)-.15 G .566(ill require restoration from back-up.) --3.065 F(Ho)5.566 E(we)-.25 E -.15(ve)-.25 G 1.366 -.4(r, t).15 H .566 -(his should ne).4 F -.15(ve)-.25 G 3.066(ro).15 G(ccur)-3.066 E 3.066 -(,u)-.4 G(nless)-3.066 E +(he k)-4.278 F 2.078 -.15(ey b)-.1 H(e-).15 E .566(comes unloaded, the) +108 278.4 R 3.066(yw)-.15 G .566(ill require restoration from back-up.) +-3.066 F(Ho)5.566 E(we)-.25 E -.15(ve)-.25 G 1.366 -.4(r, t).15 H .566 +(his should ne).4 F -.15(ve)-.25 G 3.065(ro).15 G(ccur)-3.065 E 3.065 +(,u)-.4 G(nless)-3.065 E (something went horribly wrong with the dataset properties.)108 290.4 Q .965(If no datasets are speci\214ed, all matching encryption roots are \ -listed \212 by def)108 307.2 R .965(ault, those managed by)-.1 F F2 +listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 (tzpfms)108 319.2 Q F0(.)A F1(OPTIONS)72 336 Q F2109.666 348 Q F0 -1.582(Scripting mode \212 remo)185 348 R 1.882 -.15(ve h)-.15 H 1.583 +1.583(Scripting mode \212 remo)185 348 R 1.883 -.15(ve h)-.15 H 1.583 (eaders and separate \214elds by a single tab instead of).15 F (columnating them with spaces.)185 360 Q F2109.666 376.8 Q F0 (Recurse into all descendants of speci\214ed datasets.)185 376.8 Q F2 @@ -695,28 +326,26 @@ listed \212 by def)108 307.2 R .965(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R -18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 +(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666 -(zfs-fido2-add-backup \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 -(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) -108 583.2 Q F2 1.666(zfs-fido2-add-backup \255b)6 F F1(TPM2)6 E F4 72 -(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 -(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-fido2-add-backup \255ra)6 F F3(tarta-zoot)6 E F4 72 -(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 -(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 -(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 -(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) -108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 -(zfs-fido2-add-backup \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 +24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 +559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 +F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F +6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) +108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R +18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 +(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) +54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q +F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) -108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-32-g56ada0e)72 817.889 -Q(December 4, 2022)84.143 E(1)183.842 E 0 Cg EP -%%Page: 2 7 +108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-33-g81add25)72 817.889 +Q(December 4, 2022)83.023 E(1)183.842 E 0 Cg EP +%%Page: 2 2 %%BeginPageSetup BP %%EndPageSetup @@ -729,11 +358,11 @@ BP (EvModder)7.5 E F1(REPOR)72 160.8 Q 1.666(TING B)-.4 F(UGS)-.1 E F0 (https://todo.sr)108 172.8 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms)-.25 E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q(December 4, 2022)84.143 E +-.25 E(tzpfms 0.3.4-33-g81add25)72 817.889 Q(December 4, 2022)83.023 E (2)183.842 E 0 Cg EP -%%Page: 1 8 +%%Page: 1 3 %%BeginPageSetup BP %%EndPageSetup @@ -742,107 +371,104 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 -E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.866 -.8(To n)108 153.6 -T 1.266(ormalise the).8 F F3(dataset)3.766 E F0(,)A F2 -(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.655 E/F4 10/Times-Italic@0 -SF(ne)14.655 E(ver)-.15 E F0 12.154(create or destro)14.655 F 14.654(ye) --.1 G 12.154(ncryption roots; use)-14.654 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.176 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 +(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T +5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 +E F0 5.266(will open its encryption root in its stead.)7.766 F F2 +(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E +(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) +-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 +(data will be silently cleared.)108 211.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q +(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 (\), and sealed)B .586(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 264 R .885 -.15(ey w)-.1 H .585 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q + passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 333.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 -(ork with)-.1 F F1(TPM1.X)2.792 E F0(-back-ended)A F2(tzpfms)2.792 E F0 -.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 345.6 Q F0 -(\(8\),)A F5(zfs-tpm1x-load-key)2.5 E F0(\(8\), and)A F5 -(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q F0 -1.412(is a colon-separated pair of he)3.913 F 1.412 -(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 -(\214rst one represents the RSA k)108 374.4 R 1.167 -.15(ey p)-.1 H .868 +108 321.6 Q F0 2.207(identi\214es this dataset for w)4.707 F 2.207 +(ork with)-.1 F F1(TPM1.X)4.707 E F0(-back-ended)A F2(tzpfms)4.708 E F0 +(programs)4.708 E(\(namely)108 333.6 Q F5(zfs-tpm1x-change-key)37.249 E +F0(\(8\),)A F5(zfs-tpm1x-load-key)37.248 E F0 34.748(\(8\), and)B F5 +(zfs-tpm1x-clear-key)108 345.6 Q F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q +F0 1.412(is a colon-separated pair of he)3.912 F 1.412 +(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .868 +(\214rst one represents the RSA k)108 374.4 R 1.168 -.15(ey p)-.1 H .867 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 386.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 -(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 -(he sec-)-3.913 F .379 +.15 F(pro)108 386.4 Q 1.413(vided, or the SHA1 constant)-.15 F F5 +(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.914 E F0 3.914(;t)C 1.414 +(he sec-)-3.914 F .379 (ond represents the sealed object containing the wrapping k)108 398.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.721(.T)C -1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 -(-land tool for)-.2 F(decrypting this; perhaps there should be.)108 -422.4 Q(Finally)108 439.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F --.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F -17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 -(keyformat=raw)108 451.2 Q F3(dataset)6.107 E F0 .107 -(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 -(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 -(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.72(.T)C 1.72 +(here e)-6.72 F 1.721(xists no other user)-.15 F 1.721(-land tool for) +-.2 F(decrypting this; perhaps there should be.)108 422.4 Q(Finally)108 +439.2 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506 +(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 +(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 451.2 +Q F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) +-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 +G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -463.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 480 -S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 -6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 +463.2 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 480 +S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.555 E F0 +6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 (command succeeds, all is well, b)108 492 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E -F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F -10.313 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 +-.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.147 E F3(dataset)8.647 E +F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F +10.312 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.607 E F0 1.607 -(can be used to clear the properties and go back to using a)4.107 F +F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.606 E F0 1.607 +(can be used to clear the properties and go back to using a)4.106 F (passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q -F3(backup-file)6 E F0(Sa)203 573.6 Q .352 -.15(ve a b)-.2 H .052 +F3(backup-file)6 E F0(Sa)203 573.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 585.6 R F4(must)3.194 E F0 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G +E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 +F .693(This back-up)203 585.6 R F4(must)3.193 E F0 .694 +(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G (nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) .15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 (backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .638(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H +(PCR)A F0 1.666(]...)C .639(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 -3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 -(hange, the wrap-)-3.139 F .463(ping k)203 638.4 R .763 -.15(ey w)-.1 H -.463(ill not be able to be unsealed.).15 F .462 +3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .638 +(hange, the wrap-)-3.139 F .462(ping k)203 638.4 R .762 -.15(ey w)-.1 H +.462(ill not be able to be unsealed.).15 F .463 (The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B (or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 (ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q -F0 .045(By def)133 691.2 R .045(ault, passphrases are prompted for and \ -read in on the standard output and input streams.)-.1 F(If)5.046 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.596(is set and nonempty)4.096 +F0 .046(By def)133 691.2 R .045(ault, passphrases are prompted for and \ +read in on the standard output and input streams.)-.1 F(If)5.045 E F5 +(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 715.2 Q +(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 715.2 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 732 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) 133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-32-g56ada0e)72 -817.889 Q(February 28, 2024)84.138 E(1)183.837 E 0 Cg EP -%%Page: 2 9 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-33-g81add25)72 +817.889 Q(March 11, 2024)88.018 E(1)188.837 E 0 Cg EP +%%Page: 2 4 %%BeginPageSetup BP %%EndPageSetup @@ -855,23 +481,23 @@ BP (yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) -2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 136.8 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B (is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 -177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 -.229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 201.6 Q -(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 218.4 R(rouSerS) --.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -230.4 S(ing one of the earlier ones with, for e).1 E +177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.73 E F0 .23 +(suite connects to a local)2.73 F F1(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F1(localhost:30003)2.729 E F0 2.729(\)b)C 2.729 +(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 F(the)2.729 E(en)108 201.6 +Q(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .11(The T)108 218.4 R(rouSerS) +-.35 E F1(tcsd)2.61 E F0 .11(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E +F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 +E F1(/dev/tpm)2.611 E F0 2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1 +(py)108 230.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 (See also)87 247.2 R F0(The T)108 259.2 Q (rouSerS project page at https://sourcefor)-.35 E @@ -886,7 +512,7 @@ F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) -.25 E F2 1.666(SEE ALSO)72 439.2 R F0 (PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E @@ -894,42 +520,42 @@ F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (and https://trustedcomputinggroup.or)108 463.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q -(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q -(February 28, 2024)84.138 E(2)183.837 E 0 Cg EP -%%Page: 1 10 +(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-33-g81add25)72 817.889 Q +(March 11, 2024)88.018 E(2)188.837 E 0 Cg EP +%%Page: 1 5 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 45.793(ZFS-TPM1X-CLEAR-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 43.292(anual ZFS-TPM1X-CLEAR-KEY\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G +(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.008 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(TPM1.X)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F --.25(va)-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.307 E/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q +(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G +(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM1.X) +2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F -.25(va) +-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F13.308 E +/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E F4 +(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm1x-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1 1.666 (TPM1.X back-end con\214guration)72 247.2 R .625(TPM selection)87 259.2 -R F0(The)108 271.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 300 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 312 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 271.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 283.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 300 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +312 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 328.8 R F0(The T)108 340.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -944,11 +570,11 @@ F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 446.4 Q F0(EvModder)7.5 E F1(REPOR)72 463.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q(December 4, 2022)84.143 E(1) +E(tzpfms 0.3.4-33-g81add25)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP -%%Page: 1 11 +%%Page: 1 6 %%BeginPageSetup BP %%EndPageSetup @@ -957,15 +583,15 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .191(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1 -(wa)2.691 G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E -F0(back)2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 -F .49 -.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset) -2.5 E F0(.)A .236 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .19 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1(wa)2.69 G +2.69(se).1 G .19(ncrypted with)-2.69 F F2(tzpfms)2.69 E F0(back)2.69 E +(end)-.1 E F1(TPM1.X)2.69 E F0 .191(will unseal the k)2.69 F .491 -.15 +(ey a)-.1 H .191(nd load).15 F(it into)108 165.6 Q F3(dataset)2.5 E F0 +(.)A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) -108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F +108 182.4 R .236(wnership, if not "well-kno)-.25 F .235(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) 108 194.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E (as set.)-.1 E(See)108 211.2 Q/F4 10/Courier@0 SF(zfs-tpm1x-change-key) @@ -973,14 +599,14 @@ F .49 -.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset) 109.666 240 Q F0 3.208(Do a no-op/dry run, can be used e)131 240 R -.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) -8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 +8.208 E -.25(va)-.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 252 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 268.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 -280.8 Q F0 .045(By def)133 292.8 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.046 -E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.596(is set and nonempty) -4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F -F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q +280.8 Q F0 .046(By def)133 292.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.045 +E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.595(is set and nonempty) +4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 333.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -993,23 +619,23 @@ F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q 381.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F0("ag)160 393.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 410.4 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .177 +(If the helper doesn')133 410.4 R 2.677(te)-.18 G .177 +(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 +.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 422.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 439.2 R .625(TPM selection)87 451.2 -R F0(The)108 463.2 Q F2(tzpfms)2.729 E F0 .229 -(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 475.2 Q -(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 492 R(rouSerS) --.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -504 S(ing one of the earlier ones with, for e).1 E +R F0(The)108 463.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 492 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 504 S +(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 520.8 R F0(The T)108 532.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1024,11 +650,11 @@ F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F1<83>128 638.4 Q F0(EvModder)7.5 E F1(REPOR)72 655.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q(December 4, 2022)84.143 E(1) +E(tzpfms 0.3.4-33-g81add25)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP -%%Page: 1 12 +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup @@ -1037,132 +663,133 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 -1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A -F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A -F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.319 -.8(To n)108 -165.6 T(ormalise).8 E F3(dataset)5.219 E F0(,)A F2(zfs-fido2-add-backup) -5.219 E F0 2.72(will open its encryption root in its stead.)5.219 F F2 -(zfs-fido2-add-backup)108 177.6 Q F0(will)14.655 E/F4 10/Times-Italic@0 -SF(ne)14.655 E(ver)-.15 E F0 12.154(create or destro)14.655 F 14.654(ye) --.1 G 12.154(ncryption roots; use)-14.654 F/F5 10/Courier@0 SF -(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E -F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.054 E F0 -.1 -(wa)3.054 G 3.054(sp).1 G(re)-3.054 E .554(viously encrypted with)-.25 F -F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .555 -(back-end w)3.055 F .555(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 -235.2 S 3.06(yw)-.05 G .56(ill be freed from the TPM.)-3.06 F .56 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 +(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) +A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) +A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.677 -.8(To n)108 165.6 +T(ormalise).8 E F3(dataset)2.577 E F0(,)A F2(zfs-tpm-list)2.577 E F0 +.076(will open its encryption root in its stead.)2.576 F F2 +(zfs-tpm-list)5.076 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 +E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G +(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 +(\(8\) for that.)A(First, a connection is made to the TPM, which)108 +194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 +(dataset)3.054 E F0 -.1(wa)3.054 G 3.054(sp).1 G(re)-3.054 E .554 +(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F +F1(TPM2)3.055 E F0 .555(back-end w)3.055 F .555(as used, the pre)-.1 F +(vious)-.25 E -.1(ke)108 223.2 S 3.06(yw)-.05 G .56 +(ill be freed from the TPM.)-3.06 F .56 (Otherwise, or in case of an error)5.56 F 3.059(,d)-.4 G .559 (ata required for manual interv)-3.059 F(en-)-.15 E -(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 -264 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 +252 Q .294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 (OPTIONS)2.794 E F0 .294(\), and sealed)B .589 -(to a persistent object on the TPM under the o)108 276 R .589 +(to a persistent object on the TPM under the o)108 264 R .589 (wner hierarch)-.25 F .588(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 288 Q 1.602 -.65(y, t)-.05 H .302 +F(wner)-.25 E(hierarch)108 276 Q 1.602 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 300 Q(The follo)108 316.8 Q +(the sealed object with.)108 288 Q(The follo)108 304.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 1.264 -(identi\214es this dataset for w)3.764 F 1.263(ork with)-.1 F F1(TPM2) -3.763 E F0(-back-ended)A F2(tzpfms)3.763 E F0 1.263(tools \(namely)3.763 -F F5(zfs-tpm2-change-key)108 381.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) -2.5 E F0(\(8\), and)A F5(zfs-tpm2-clear-key)2.5 E F0(\(8\)\).)A F5 -(tzpfms.key)108 398.4 Q F0 1.508(is an inte)4.008 F 1.509 +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 3.287 +(identi\214es this dataset for w)5.788 F 3.287(ork with)-.1 F F1(TPM2) +5.787 E F0(-back-ended)A F2(tzpfms)5.787 E F0(programs)5.787 E(\(namely) +108 369.6 Q F5(zfs-tpm2-change-key)41.248 E F0(\(8\),)A F5 +(zfs-tpm2-load-key)41.248 E F0 38.749(\(8\), and)B F5 +(zfs-tpm2-clear-key)108 381.6 Q F0(\(8\)\).)A F5(tzpfms.key)108 398.4 Q +F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 -(wed by a semicolon and)-.25 F .823(PCR list as speci\214ed with)108 +(wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 -(tpm-tools)3.322 E F0 .822(-toolchain-compatible; if needed, it can)B -.865(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +(tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B +.866(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) -3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.366("o) -C(r)-3.366 E F2109.666 434.4 Q F0(")6.728 E F5(pcr:${tzpfms.key)A -F2(#)A F6(*)A F5(;})A F0 .728(", as the case may be, or equi)B -.25(va) --.25 G .727(lent, for back-up \(see).25 F F1(OPTIONS)3.227 E F0(\).)A -.447(If you ha)108 446.4 R .747 -.15(ve a s)-.2 H .447(ealed k).15 F +3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) +C(r)-3.365 E F2109.666 434.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) +-.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A +.448(If you ha)108 446.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) --.25 G .448(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.006 -(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506(lent of).25 F F2 -9.505(zfs change-key)12.005 F17.171 E F5(keylocation=prompt)15.505 -E F217.171 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.106 E F0 -.106(is performed with the ne)2.606 F 2.606(wk)-.25 G -.15(ey)-2.706 G -5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .107 -(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F .289(to clean\ +-.25 G .447(lent tool and set both of these properties, it).25 F +(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.005 +(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 +9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 +E F217.172 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.107 E F0 +.107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G +5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 +(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 499.2 R .289(ention into the stan-)-.15 F -(dard error stream.)108 511.2 Q 2.624<418c>108 528 S .124(nal v)-2.624 F -.124(eri\214cation should be made by running)-.15 F F2 1.791 -(zfs-tpm2-load-key \255n)2.625 F F3(dataset)6.125 E F0 5.125(.I)C 2.625 -(ft)-5.125 G .125(hat com-)-2.625 F .507(mand succeeds, all is well, b) + interv)108 499.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 511.2 Q 2.625<418c>108 528 S .125(nal v)-2.625 F .125 +(eri\214cation should be made by running)-.15 F F2 1.79 +(zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 +(ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) 108 540 R .506(ut otherwise the dataset can be manually rolled back to \ a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) -11.538 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) +11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.205 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 +F13.204 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 -621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .352 -.15(ve a b)-.2 H .052 +621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 633.6 R F4(must)3.194 E F0 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G +E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 +F .693(This back-up)203 633.6 R F4(must)3.193 E F0 .694 +(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G (nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) .15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 (backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.424(Bind the k)203 686.4 R 1.724 -.15(ey t)-.1 H 3.924(os).15 -G 1.424(pace- or comma-separated)-3.924 F F3(PCR)3.925 E F0 3.925(sw)C -1.425(ithin their corresponding)-3.925 F(hashing)203 698.4 Q F3 -(algorithm)2.524 E F0 2.524<8a69>2.524 G 2.523(ft)-2.524 G(he)-2.523 E +-1.666 G 1.425(Bind the k)203 686.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C +1.424(ithin their corresponding)-3.924 F(hashing)203 698.4 Q F3 +(algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.023(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.468 F 5.468(yo)-.15 G +A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) -.15 E F0 2.968(", ")B F1(sha256)A F0 2.969(", ")B F1(sha384)A F0(",)A(") +.15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") 203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 -(", and must be supported by the TPM.)A(tzpfms 0.3.4-32-g56ada0e)72 -817.889 Q(February 28, 2024)84.138 E(1)183.837 E 0 Cg EP -%%Page: 2 13 +(", and must be supported by the TPM.)A(tzpfms 0.3.4-33-g81add25)72 +817.889 Q(March 11, 2024)88.018 E(1)188.837 E 0 Cg EP +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 44.133(ZFS-TPM2-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 41.632(anual ZFS-TPM2-CHANGE-KEY\(8\))-2.5 F/F1 10/Courier-Bold@0 SF109.666 84 Q F0 -.4(Wi)203 84 S(th).4 E -F14.588 E F0 2.922(,a)C .422(lso prompt for a passphrase.)-2.922 F -.422(This is skipped by def)5.422 F .423(ault because the)-.1 F .675 +F14.589 E F0 2.923(,a)C .422(lso prompt for a passphrase.)-2.923 F +.422(This is skipped by def)5.422 F .422(ault because the)-.1 F .675 (passphrase is)203 96 R/F2 10/Times-Italic@0 SF(OR)3.175 E F0 .675 (ed with the PCR polic)B 3.175(y\212t)-.15 G .675(he wrapping k)-3.175 F .975 -.15(ey c)-.1 H .675(an be unsealed).15 F F2(either)203 108 Q F0 -1.389(passphraseless with the right PCRs)3.889 F F2(or)3.89 E F0 1.39 +1.39(passphraseless with the right PCRs)3.89 F F2(or)3.89 E F0 1.389 (with the passphrase, and this is)3.89 F(usually not the intent.)203 120 Q/F3 10/Times-Bold@0 SF(ENVIR)72 136.8 Q 1.666(ONMENT V)-.3 F(ARIABLES) --1.35 E/F4 10/Courier@0 SF(TZPFMS_PASSPHRASE_HELPER)108 148.8 Q F0 .046 +-1.35 E/F4 10/Courier@0 SF(TZPFMS_PASSPHRASE_HELPER)108 148.8 Q F0 .045 (By def)133 160.8 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 172.8 Q F0 1.595(is set and nonempty)4.095 + on the standard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 172.8 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F1 3.262(sh \255c)B F0(to)4.096 E(pro)133 184.8 Q +(/bin/)4.095 E F1 3.261(sh \255c)B F0(to)4.095 E(pro)133 184.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 201.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -1175,10 +802,10 @@ F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 249.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 261.6 Q F0("ag)160 261.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 278.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F3(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 278.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F3(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 290.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F3 1.666 (TPM2 back-end con\214guration)72 307.2 R(En)87 319.2 Q(vir)-.4 E .625 @@ -1187,13 +814,13 @@ Q 2.5(yo)-.15 G(f:)-2.5 E F3(NONE)2.5 E F0(,)A F3(ERR)2.5 E(OR)-.3 E F0 (,)A F3 -1.2(WA)2.5 G(RNING)1.2 E F0(,)A F3(INFO)2.5 E F0(,)A F3(DEB)2.5 E(UG)-.1 E F0(,)A F3(TRA)2.5 E(CE)-.55 E F0 5(.D)C(ef)-5 E(ault:)-.1 E F3 -1.2(WA)2.5 G(RNING)1.2 E F0(.)A F3 .625(TPM selection)87 348 R F0 -.622(The library)108 360 R F1(libtss2-tcti-default.so)3.122 E F0 .622 -(can be link)3.122 F .621(ed to an)-.1 F 3.121(yo)-.15 G 3.121(ft)-3.121 -G(he)-3.121 E F4(libtss2-tcti-)3.121 E/F5 10/Symbol SF(*)A F4(.so)A F0 -(li-)3.121 E .78(braries to select the def)108 372 R .78 -(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.281 E F0 3.281(,t)C(hen)-3.281 E -F4(/dev/tpm0)3.281 E F0 3.281(,t)C(hen)-3.281 E F4(localhost:2321)3.281 -E F0(will be tried, in order \(see)108 384 Q F4(ESYS_CONTEXT)2.5 E F0 +.621(The library)108 360 R F1(libtss2-tcti-default.so)3.121 E F0 .621 +(can be link)3.121 F .621(ed to an)-.1 F 3.122(yo)-.15 G 3.122(ft)-3.122 +G(he)-3.122 E F4(libtss2-tcti-)3.122 E/F5 10/Symbol SF(*)A F4(.so)A F0 +(li-)3.122 E .781(braries to select the def)108 372 R .781 +(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4 +(/dev/tpm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4(localhost:2321)3.28 E F0 +(will be tried, in order \(see)108 384 Q F4(ESYS_CONTEXT)2.5 E F0 (\(3\)\).)A F3 .625(See also)87 400.8 R F0 2.247 (The tpm2-tss git repository at https://github)108 412.8 R (.com/tpm2-softw)-.4 E 2.247(are/tpm2-tss and the documentation at)-.1 F @@ -1210,7 +837,7 @@ E F0(will be tried, in order \(see)108 384 Q F4(ESYS_CONTEXT)2.5 E F0 F3<83>128 542.4 Q F0(EvModder)7.5 E F3(REPOR)72 559.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 571.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 588 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 600 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (PCR allocations: https://wiki.archlinux.or)108 645.6 Q(g/title/T)-.18 E @@ -1218,9 +845,9 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (and https://trustedcomputinggroup.or)108 657.6 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q -(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q -(February 28, 2024)84.138 E(2)183.837 E 0 Cg EP -%%Page: 1 14 +(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-33-g81add25)72 817.889 Q +(March 11, 2024)88.018 E(2)188.837 E 0 Cg EP +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup @@ -1230,13 +857,13 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 -E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 +(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with)-2.5 E F2 (tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM2)2.5 E F0(:)A 5 -(1. performs)118 165.6 R 5.642(the equi)8.142 F -.25(va)-.25 G 5.642 -(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E/F4 10 -/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 +(1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641 +(lent of).25 F F2 5.642(zfs change-key)8.142 F13.308 E/F4 10 +/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E F4 (keyformat=passphrase)133 177.6 Q F3(dataset)6 E F0(,)A 5(2. frees)118 189.6 R(the sealed k)2.5 E .3 -.15(ey p)-.1 H(re).15 E (viously used to encrypt)-.25 E F3(dataset)2.5 E F0(,)A 5(3. remo)118 @@ -1245,12 +872,12 @@ E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm2-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1(ENVIR)72 247.2 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .046 +-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .045 (By def)133 271.2 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.595(is set and nonempty)4.095 + on the standard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 295.2 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 295.2 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 312 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -1262,10 +889,10 @@ F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 360 Q F0("ne)160 360 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) -2.5 E F4($4)143 372 Q F0("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 388.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 388.8 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 400.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM2 back-end con\214guration)72 417.6 R(En)87 429.6 Q(vir)-.4 E .625 @@ -1274,13 +901,13 @@ Q 2.5(yo)-.15 G(f:)-2.5 E F1(NONE)2.5 E F0(,)A F1(ERR)2.5 E(OR)-.3 E F0 (,)A F1 -1.2(WA)2.5 G(RNING)1.2 E F0(,)A F1(INFO)2.5 E F0(,)A F1(DEB)2.5 E(UG)-.1 E F0(,)A F1(TRA)2.5 E(CE)-.55 E F0 5(.D)C(ef)-5 E(ault:)-.1 E F1 -1.2(WA)2.5 G(RNING)1.2 E F0(.)A F1 .625(TPM selection)87 458.4 R F0 -.622(The library)108 470.4 R F2(libtss2-tcti-default.so)3.122 E F0 .622 -(can be link)3.122 F .621(ed to an)-.1 F 3.121(yo)-.15 G 3.121(ft)-3.121 -G(he)-3.121 E F4(libtss2-tcti-)3.121 E/F5 10/Symbol SF(*)A F4(.so)A F0 -(li-)3.121 E .78(braries to select the def)108 482.4 R .78 -(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.281 E F0 3.281(,t)C(hen)-3.281 E -F4(/dev/tpm0)3.281 E F0 3.281(,t)C(hen)-3.281 E F4(localhost:2321)3.281 -E F0(will be tried, in order \(see)108 494.4 Q F4(ESYS_CONTEXT)2.5 E F0 +.621(The library)108 470.4 R F2(libtss2-tcti-default.so)3.121 E F0 .621 +(can be link)3.121 F .621(ed to an)-.1 F 3.122(yo)-.15 G 3.122(ft)-3.122 +G(he)-3.122 E F4(libtss2-tcti-)3.122 E/F5 10/Symbol SF(*)A F4(.so)A F0 +(li-)3.122 E .781(braries to select the def)108 482.4 R .781 +(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4 +(/dev/tpm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4(localhost:2321)3.28 E F0 +(will be tried, in order \(see)108 494.4 Q F4(ESYS_CONTEXT)2.5 E F0 (\(3\)\).)A F1 .625(See also)87 511.2 R F0 2.247 (The tpm2-tss git repository at https://github)108 523.2 R (.com/tpm2-softw)-.4 E 2.247(are/tpm2-tss and the documentation at)-.1 F @@ -1297,11 +924,11 @@ E F0(will be tried, in order \(see)108 494.4 Q F4(ESYS_CONTEXT)2.5 E F0 F1<83>128 652.8 Q F0(EvModder)7.5 E F1(REPOR)72 669.6 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q(December 4, 2022)84.143 E +-.25 E(tzpfms 0.3.4-33-g81add25)72 817.889 Q(December 4, 2022)83.023 E (1)183.842 E 0 Cg EP -%%Page: 1 15 +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -1310,28 +937,28 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .865(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.365 E F0 -.1 -(wa)3.365 G 3.365(se).1 G .865(ncrypted with)-3.365 F F2(tzpfms)3.365 E -F0(back)3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .864 -(nseals the k)-3.365 F 1.164 -.15(ey a)-.1 H .864(nd loads it).15 F -(into)108 165.6 Q F3(dataset)2.5 E F0(.)A(The user is prompted for the \ -additional passphrase, set when creating the k)108 182.4 Q -.15(ey)-.1 G -2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 -10/Courier@0 SF(zfs-tpm2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2109.666 -228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 -G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i) --.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.208 E -.25(va) --.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 240 Q F0 -.55('s) -C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .046 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .864 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1(wa)3.364 +G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E F0(back) +3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865(nseals the k)-3.365 +F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F(into)108 165.6 Q F3 +(dataset)2.5 E F0(.)A(The user is prompted for the additional passphras\ +e, set when creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5 +(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF +(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 +(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 +(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 +G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) +.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 +(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 +4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F +(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 (By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.045 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.595(is set and nonempty)4.095 + on the standard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 304.8 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 304.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 321.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -1344,23 +971,23 @@ F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 369.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 381.6 Q F0("ag)160 381.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 398.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 398.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 410.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 427.2 R .625(TPM selection)87 439.2 -R F0(The)108 451.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 463.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 480 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 492 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 451.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 463.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 480 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +492 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 508.8 R F0(The T)108 520.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1375,9 +1002,9 @@ F(the)2.729 E(en)108 463.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 626.4 Q F0(EvModder)7.5 E F1(REPOR)72 643.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-32-g56ada0e)72 817.889 Q(December 4, 2022)84.143 E(1) +E(tzpfms 0.3.4-33-g81add25)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP %%Trailer end diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 deleted file mode 100644 index 08a80cb..0000000 --- a/zfs-fido2-add-backup.8 +++ /dev/null @@ -1,125 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-ADD-BACKUP 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-add-backup -.Nd allow another FIDO2 device to unlock ZFS dataset -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After -.Xr zfs-fido2-change-key 8 -derives the key for a dataset from a FIDO2 device, -.Nm -may be executed to extend this to any number of additional devices. -.Pp -First, the wrapping key is extracted as normally during -.Xr zfs-fido2-load-key 8 , -then a credential is made as-if during -.Xr zfs-fido2-change-key 8 -(except the "primary" device and all the ones holding backups are excluded from the search); -however, the -.Ql hmac-secret -is instead used as a symmetric AES-256-GCM -.Pq Xr EVP_CIPHER-AES 7ssl -key to encrypt the wrapping key directly with a random IV. -.Pp -This turns the -.Li xyz.nabijaczleweli:tzpfms.key -variable into -.br -.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … -.Pp -.Li tzpfms.key -is actually a dot-separated list of device bundles. -The first one is as-described in -.Xr zfs-fido2-change-key 8 . -Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -.Pp -.Xr zfs-fido2-load-key 8 -shops assertions around devices in a device-major order \(em -depending on device numbering, a backup may be loaded even if the primary device is present. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html deleted file mode 100644 index e6d3444..0000000 --- a/zfs-fido2-add-backup.8.html +++ /dev/null @@ -1,153 +0,0 @@ - - - - - - - - ZFS-FIDO2-ADD-BACKUP(8) - - - - - - - - -
ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
-
-
-

-

zfs-fido2-add-backup — - allow another FIDO2 device to unlock ZFS dataset

-
-
-

- - - - - -
zfs-fido2-add-backupdataset
-
-
-

-

After - zfs-fido2-change-key(8) - derives the key for a dataset from a FIDO2 device, - zfs-fido2-add-backup may be executed to extend this - to any number of additional devices.

-

First, the wrapping key is extracted as normally during - zfs-fido2-load-key(8), - then a credential is made as-if during - zfs-fido2-change-key(8) - (except the "primary" device and all the ones holding backups are - excluded from the search); however, the - ‘hmac-secret’ is instead used as a - symmetric AES-256-GCM - (EVP_CIPHER-AES(7ssl)) - key to encrypt the wrapping key directly with a random IV.

-

This turns the - xyz.nabijaczleweli:tzpfms.key variable into -
- salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…

-

tzpfms.key is actually a dot-separated - list of device bundles. The first one is as-described in - zfs-fido2-change-key(8). - Subsequent ones also include (identically-encoded) IVs and encrypted - blobs.

-

zfs-fido2-load-key(8) - shops assertions around devices in a device-major order — depending - on device numbering, a backup may be loaded even if the primary device is - present.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 deleted file mode 100644 index 8238eba..0000000 --- a/zfs-fido2-change-key.8 +++ /dev/null @@ -1,188 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 4, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CHANGE-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-change-key -.Nd change ZFS dataset key to one authenticated by a FIDO2 device -.Sh SYNOPSIS -.Nm -.Op Fl b Ar backup-file -.Ar dataset -. -.Sh DESCRIPTION -To normalise the -.Ar dataset , -.Nm -will open its encryption root in its stead. -.Nm -will -.Em never -create or destroy encryption roots; use -.Xr zfs-change-key 8 -for that. -.Pp -First, a connection is made to the FIDO2 device, which -.Em must -support the -.Ql hmac-secret -extension. -.Pp -If -.Ar dataset -was previously encrypted with -.Nm fzifdso -and the -.Sy FIDO2 -back-end was used, previous credentials will be deleted from their devices (as-if via -.Xr zfs-fido2-clear-key 8 ) , -if available. -Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. -.Pp -Next, a new credential of type ES256 is generated on the device (with relying party ID -.Li fzifdso -and name equal to the dataset name) -with the -.Ql hmac-secret -extension requested; the device PIN, if any, is prompted for here. -This mimicks a WebAuthn registration step. -.Pp -Then, the credential is asserted with a 32-byte random salt, -which hashes it with device-private data, and thus generates the wrapping key -.Pq which is optionally backed up Pq see Sx OPTIONS . -This mimicks a WebAuthn login step. -.Pp -The following properties are set on -.Ar dataset : -.Bl -bullet -compact -offset 4n -width "@" -.It -.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 -.It -.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … -.El -.Pp -.Li tzpfms.backend -identifies this dataset for work with -.Sy FIDO2 Ns -back-ended -.Nm tzpfms -tools -.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . -.Pp -.Li tzpfms.key -is a colon-separated tuple of unpadded URL-safe base64 blobs; -the first one is the random salt; -the second represents the ID of created credential, -and the third \(en its public key. -There exists no other user-land tool for deciphering this; perhaps there should be. -.\"" TODO: make an LD_PRELOADable for extracting the key maybe? -.Pp -Finally, the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset -is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. -.Pp -A final verification should be made by running -.Nm zfs-fido2-load-key Fl n Ar dataset . -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a passphrase with -.Nm zfs-fido2-clear-key Ar dataset -.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , -and you are hereby asked to report a bug, please. -.Pp -.Nm zfs-fido2-clear-key Ar dataset -can be used to clear the properties and go back to using a passphrase. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl b Ar backup-file" -.It Fl b Ar backup-file -Save a back-up of the key to -.Ar backup-file , -which must not exist beforehand. -This back-up -.Em must -be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running -.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html deleted file mode 100644 index 8cd7f1a..0000000 --- a/zfs-fido2-change-key.8.html +++ /dev/null @@ -1,207 +0,0 @@ - - - - - - - - ZFS-FIDO2-CHANGE-KEY(8) - - - - - - - - -
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
-
-
-

-

zfs-fido2-change-key — - change ZFS dataset key to one authenticated by a FIDO2 - device

-
-
-

- - - - - -
zfs-fido2-change-key[-b backup-file] - dataset
-
-
-

-

To normalise the dataset, - zfs-fido2-change-key will open its encryption root - in its stead. zfs-fido2-change-key will - - create or destroy encryption roots; use - zfs-change-key(8) - for that.

-

First, a connection is made to the FIDO2 device, which - must support the - ‘hmac-secret’ extension.

-

If dataset was previously encrypted with - fzifdso and the FIDO2 back-end was - used, previous credentials will be deleted from their devices (as-if via - zfs-fido2-clear-key(8)), - if available. Otherwise, or in case of an error, data required for manual - intervention will be written to the standard error stream.

-

Next, a new credential of type ES256 is generated on the device - (with relying party ID fzifdso and name equal to the - dataset name) with the ‘hmac-secret’ - extension requested; the device PIN, if any, is prompted for here. This - mimicks a WebAuthn registration step.

-

Then, the credential is asserted with a 32-byte random salt, which - hashes it with device-private data, and thus generates the wrapping key - (which is optionally backed up (see - OPTIONS)). This mimicks a WebAuthn login - step.

-

The following properties are set on - dataset:

- -

tzpfms.backend identifies this dataset for - work with FIDO2-back-ended tzpfms - tools (i.e. fzifdso - zfs-fido2-change-key(8), - zfs-fido2-load-key(8), - zfs-fido2-add-backup(8), - and - zfs-fido2-clear-key(8)).

-

tzpfms.key is a colon-separated tuple of - unpadded URL-safe base64 blobs; the first one is the random salt; the second - represents the ID of created credential, and the third – its public - key. There exists no other user-land tool for deciphering this; perhaps - there should be.

-

Finally, the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=raw dataset is - performed with the new key. If an error occurred, best effort is made to - clean up the properties, or to issue a note for manual intervention into the - standard error stream.

-

A final verification should be made by running - zfs-fido2-load-key -n - dataset. If that command succeeds, all is well, but - otherwise the dataset can be manually rolled back to a passphrase with - zfs-fido2-clear-key dataset - (or, if that fails to work, zfs - change-key -o - keyformat=passphrase dataset), - and you are hereby asked to report a bug, please.

-

zfs-fido2-clear-key - dataset can be used to clear the properties and go - back to using a passphrase.

-
-
-

-
-
- backup-file
-
Save a back-up of the key to backup-file, which must - not exist beforehand. This back-up must be stored - securely, off-site. In case of a catastrophic event, the key can be loaded - by running -
zfs - load-key dataset - < - backup-file
-
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 4, 2024fzifdso 0
- - diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 deleted file mode 100644 index f7ab9d5..0000000 --- a/zfs-fido2-clear-key.8 +++ /dev/null @@ -1,121 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd March 4, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CLEAR-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-clear-key -.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 : -.Bl -enum -compact -offset 2n -width 2n -.It -performs the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , -.It -loads the primary and every backup credential, and for each success, if the device containing it supports the -.Ql credMgmt \" or credentialMgmtPreview -feature and has a PIN set, tries to delete the credential from the device, -.It -removes the -.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key -properties from -.Ar dataset . -.El -.Pp -For every removal failure and missing device or PIN an instruction for manual removal with -.Xr fido2-token 1 -is issued. -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html deleted file mode 100644 index 97e05e7..0000000 --- a/zfs-fido2-clear-key.8.html +++ /dev/null @@ -1,151 +0,0 @@ - - - - - - - - ZFS-FIDO2-CLEAR-KEY(8) - - - - - - - - -
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
-
-
-

-

zfs-fido2-clear-key — - rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 - metadata

-
-
-

- - - - - -
zfs-fido2-clear-keydataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - :

-
    -
  1. performs the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=passphrase - dataset,
  2. -
  3. loads the primary and every backup credential, and for each success, if - the device containing it supports the - ‘credMgmt’ feature and has a PIN - set, tries to delete the credential from the device,
  4. -
  5. removes the - xyz.nabijaczleweli:tzpfms.{backend, - key} properties from - dataset.
  6. -
-

For every removal failure and missing device or PIN an instruction - for manual removal with - fido2-token(1) - is issued.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
March 4, 2024fzifdso 0
- - diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 deleted file mode 100644 index 247ca04..0000000 --- a/zfs-fido2-load-key.8 +++ /dev/null @@ -1,98 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-LOAD-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-load-key -.Nd load FIDO2-encrypted ZFS dataset key -.Sh SYNOPSIS -.Nm -.Op Fl n -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 , -asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into -.Ar dataset . -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl n" -.It Fl n -Do a no-op/dry run, can be used even if the key is already loaded. -Equivalent to -.Nm zfs Cm load-key Ns 's -.Fl n -option. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html deleted file mode 100644 index ffc6446..0000000 --- a/zfs-fido2-load-key.8.html +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - - ZFS-FIDO2-LOAD-KEY(8) - - - - - - - - -
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
-
-
-

-

zfs-fido2-load-key — - load FIDO2-encrypted ZFS dataset key

-
-
-

- - - - - -
zfs-fido2-load-key[-n] dataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - , - asserts the preserved challenge, HMACking the salt with the on-device - secret, and loads the resulting key into dataset.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
Do a no-op/dry run, can be used even if the key is already loaded. - Equivalent to zfs - load-key's -n option.
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index cfadb9c..21b3f77 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM-LIST 8 -.Os tzpfms 0.3.4-32-g56ada0e +.Os tzpfms 0.3.4-33-g81add25 . .Sh NAME .Nm zfs-tpm-list diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index 9f0b982..b46a982 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -166,7 +166,7 @@ tarta-zoot/vm - available yes - +
December 4, 2022tzpfms 0.3.4-32-g56ada0etzpfms 0.3.4-33-g81add25
diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index 53bfc41..6600766 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -1,9 +1,9 @@ .\" SPDX-License-Identifier: MIT . -.Dd February 28, 2024 +.Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CHANGE-KEY 8 -.Os tzpfms 0.3.4-32-g56ada0e +.Os tzpfms 0.3.4-33-g81add25 . .Sh NAME .Nm zfs-tpm1x-change-key @@ -58,7 +58,7 @@ The following properties are set on identifies this dataset for work with .Sy TPM1.X Ns -back-ended .Nm tzpfms -tools +programs .Pq namely Xr zfs-tpm1x-change-key 8 , Xr zfs-tpm1x-load-key 8 , and Xr zfs-tpm1x-clear-key 8 . .Pp .Li tzpfms.key diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index 09f2ec1..3c2ef40 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -64,7 +64,7 @@

tzpfms.backend identifies this dataset for work with TPM1.X-back-ended tzpfms - tools (namely + programs (namely zfs-tpm1x-change-key(8), zfs-tpm1x-load-key(8), and @@ -218,8 +218,8 @@ - - + +
February 28, 2024tzpfms 0.3.4-32-g56ada0eMarch 11, 2024tzpfms 0.3.4-33-g81add25
diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index 98b9adf..96401bc 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CLEAR-KEY 8 -.Os tzpfms 0.3.4-32-g56ada0e +.Os tzpfms 0.3.4-33-g81add25 . .Sh NAME .Nm zfs-tpm1x-clear-key diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index 51bcfac..acf0c4b 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -103,7 +103,7 @@ - +
December 4, 2022tzpfms 0.3.4-32-g56ada0etzpfms 0.3.4-33-g81add25
diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index 0dadc6a..a939b76 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-LOAD-KEY 8 -.Os tzpfms 0.3.4-32-g56ada0e +.Os tzpfms 0.3.4-33-g81add25 . .Sh NAME .Nm zfs-tpm1x-load-key diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index d45f9f8..c6073ee 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -139,7 +139,7 @@ - +
December 4, 2022tzpfms 0.3.4-32-g56ada0etzpfms 0.3.4-33-g81add25
diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index c4aa80b..b7bd8eb 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -1,9 +1,9 @@ .\" SPDX-License-Identifier: MIT . -.Dd February 28, 2024 +.Dd March 11, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CHANGE-KEY 8 -.Os tzpfms 0.3.4-32-g56ada0e +.Os tzpfms 0.3.4-33-g81add25 . .Sh NAME .Nm zfs-tpm2-change-key @@ -61,7 +61,7 @@ The following properties are set on identifies this dataset for work with .Sy TPM2 Ns -back-ended .Nm tzpfms -tools +programs .Pq namely Xr zfs-tpm2-change-key 8 , Xr zfs-tpm2-load-key 8 , and Xr zfs-tpm2-clear-key 8 . .Pp .Li tzpfms.key diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index c2bb207..940b06c 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -65,7 +65,7 @@

tzpfms.backend identifies this dataset for work with TPM2-back-ended tzpfms - tools (namely + programs (namely zfs-tpm2-change-key(8), zfs-tpm2-load-key(8), and zfs-tpm2-clear-key(8)).

@@ -264,8 +264,8 @@ - - + +
February 28, 2024tzpfms 0.3.4-32-g56ada0eMarch 11, 2024tzpfms 0.3.4-33-g81add25
diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index f708e1f..9e5a51b 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-CLEAR-KEY 8 -.Os tzpfms 0.3.4-32-g56ada0e +.Os tzpfms 0.3.4-33-g81add25 . .Sh NAME .Nm zfs-tpm2-clear-key diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index 4abe3fc..79245b1 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -154,7 +154,7 @@ - +
December 4, 2022tzpfms 0.3.4-32-g56ada0etzpfms 0.3.4-33-g81add25
diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index cad6441..6f8fd2c 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-LOAD-KEY 8 -.Os tzpfms 0.3.4-32-g56ada0e +.Os tzpfms 0.3.4-33-g81add25 . .Sh NAME .Nm zfs-tpm2-load-key diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index 683ed9c..73f7e79 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -138,7 +138,7 @@ - +
December 4, 2022tzpfms 0.3.4-32-g56ada0etzpfms 0.3.4-33-g81add25