From a0dae5d40e872a3835311612159a262b7133a1fe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Mon, 4 Mar 2024 11:34:36 +0000 Subject: [PATCH] Manpage update by job 1161507 --- tzpfms.pdf | Bin 81305 -> 65601 bytes tzpfms.ps | 906 +++++++++++------------------------- zfs-fido2-add-backup.8 | 125 ----- zfs-fido2-add-backup.8.html | 153 ------ zfs-fido2-change-key.8 | 186 -------- zfs-fido2-change-key.8.html | 206 -------- zfs-fido2-clear-key.8 | 113 ----- zfs-fido2-clear-key.8.html | 143 ------ zfs-fido2-load-key.8 | 98 ---- zfs-fido2-load-key.8.html | 117 ----- zfs-tpm-list.8 | 2 +- zfs-tpm-list.8.html | 2 +- zfs-tpm1x-change-key.8 | 2 +- zfs-tpm1x-change-key.8.html | 2 +- zfs-tpm1x-clear-key.8 | 2 +- zfs-tpm1x-clear-key.8.html | 2 +- zfs-tpm1x-load-key.8 | 2 +- zfs-tpm1x-load-key.8.html | 2 +- zfs-tpm2-change-key.8 | 2 +- zfs-tpm2-change-key.8.html | 2 +- zfs-tpm2-clear-key.8 | 2 +- zfs-tpm2-clear-key.8.html | 2 +- zfs-tpm2-load-key.8 | 2 +- zfs-tpm2-load-key.8.html | 2 +- 24 files changed, 287 insertions(+), 1788 deletions(-) delete mode 100644 zfs-fido2-add-backup.8 delete mode 100644 zfs-fido2-add-backup.8.html delete mode 100644 zfs-fido2-change-key.8 delete mode 100644 zfs-fido2-change-key.8.html delete mode 100644 zfs-fido2-clear-key.8 delete mode 100644 zfs-fido2-clear-key.8.html delete mode 100644 zfs-fido2-load-key.8 delete mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index 12e04500213310f923bf1f7ea66a79b6007c54ef..29f6b8bf28c82c75aa441db9bd63f3d4311d2b50 100644 GIT binary patch delta 45127 zcmZU)Q*@xwwyhi6wpp=l+eyVq#je=-W81cEvyxP7+h)biUFY7t&wW@=bGGq1dux64 zZ;YAo4l&>lQ4bFaO#R$&+89OkJ<*c4vr8#RX3oUjd{(ewGqa#vL(Qn%n)Sm06GOGp zvjo9NtMmz&=-UV6XF!7RWh7J+Wyg_QVdbCCt{2L@Zy{0TQ4@g7zCjn!*{#Eg;7UW4 zd#&`sypyCTU8OH(LxuA++B=*(F!*=S%rf+sumc^--Ygsd_`aXa2HH96wx^DX5x);` zGp{COi!JVVsH3^lwXw4Eq|gsCEj|=6>K4&2^F6s6d~D}PEDdPtj>yS~mAOyRb%bDO zs2J6@Jz9@od2eZFG9cJIANDyd^Rp)ZH6VW}OlTn4Gx9-mlEC{Q+WjEb+f-dAFvIX> zG#)LM@3{r)e@s~?WyT8*|^I&nrG59K`QK11@*1i~N61hQ9eF!Ue7`2qhLRn-{ zv7$|%C&C-O2s%#ttJF(~(Qn+h)v3f$DkNB~^rGz38rk8ER~ysia*{tE9Iq|~m0By} zkt@WxD&wn2jibFIPVq3_^qwpx?ztA$E;ihWk8iej5CUA}4RN%D|DkEv1Za9D9$Fw+ zUTy%3tHW!A>lm++7#j4l$rjS4#tl2_EFVpy_mv-KmkS?EtVmKLBI^id-LMc}-b-}1 zRYV9<&u|{Z8qlHz0d?p)T+cL6+Ngb~9D#N-T7~(91#zMM?jGgfj034Fs*vJwF}7%D z8d@w4opp%FrqeC_h@EpV=AkyZTd?;{t8oCg_|@@}&UlMJOeha`z5aSZ!OKbkWD+E3 z@}gCf7Y6#3<)%>~kPS5~Z77D>7-w+;g7nE8Yypaj*L3VScADg8{DA`Q4n`7ZQq4My zAfZg^V!_+<%wi9_l__MTX*1?2O}|0 zt`wqZFSYsNMrw1V zo))@~@GB0pkCFmtK5fYD2>Hh$*pw0GdyZRGNli-BYA3~pG5@077L^EoduE+yR2QLf zIoGHLMyzRzC`ZG?W(W380W@&1!FKOeCK>1c>E1AxnI=cgDKh7kIWAAQWFt^64KeP+ zzg|;Z`IebLBVk|;s+#NgafeaC(y~?lDlT$wTj_j@CCSWA@sHkwS{-R!7?;MrYXtwf za4b-N0_>qP6*97hDiv(k{e?zdIIfRzn*+wFW4cWyn3ZL;nmmny6L6tf*d_2_kLah)B!$morGsoZj@8$j;Z7NVLjN2A)3$~Ug~bi~UP>5*|c zS37#-(0F4ycy=MuHo8cwCEy1s14BWxc0iYWr0*?PLCZxJ-6sR}o5pOsO8FJvLF8QD zQw0U}Ei%;`BLdT<0icA=BNCcd%CYTL_#so#jbWs^y+_8)c21^7yj zOQnK;Lcp$tr)wv<$h|hTj*``gF`KSp-M&&MR31&ItaNU`JmIM_omXbi!P+Gx$qy;f z)7l2Vtb_w)9alkwd8in8DA%p8s?J;(F{=a1AzjdDWI&+rnYv2%DfN5c4GC?_?)H%Z zjImQuYkmMu$(!ne<12oo7CHJ9ljHR}(hY~sSEPE&9rDzr@B7pC?c(S$tg3?OhvEt- zFTPN01y^VOlVJ5@tz=E4_v7M8e{|7xu0ZSG8_yh&X6&QY_{OGF+|HkaP=SkF5bZqv z24HgBScBOMQJ6a^;p(>JRbfT`1 zYx9>lOC`iJFlAdy;WcKd8Q1O8zg6zNP+JCtUT&2$!)}`=dZSlrMjpowLAO33luSPo zOnvPn92H8uxc6uy9anwMh&S&8^Xmis-yx{GnZ2pAi<6nL9o&Cz4!^A7I7ygE{?EzE z!p-%+HCE>TDf06($(z|*xLA^~vLvAjQ2`2S8_Xy<2A^~;Vz~p6f*+)gKa!J0(KG*^ zm&^t=Kyt1&G!UjcT@lw6a~}qYO}rSzZTD`qbt(Bl;Gp_Xv2`zu5A05Rx`Ycr4${^1 zN4QAdj}naPT42fxi;Ga;?1PPt&k>7^`un);&dfAWTc|lW5lz^P*6E{sUwdhE+yUDK z+``E$Q)wCCWn*L=YF7ag${?oa%&|DAzhF*Fq5eRTWR9|Eg9efisOmCk(L8Vv+ssqbP~ZM=H)XZFbL$v2;~qf`F}Y1ymD~TBa_?1+2bt}#LWg+Xg5NQNoogM z*3XA9=%nuQ)QPm&W_Df;Ts2-fF9Ct_h-VR3>M-I4_<>629C@=baM#Gf+FU6*4`KN~ z{i&?p$@EiYyqi~u=bV?`aZLXR(Y?5uT>N0wYWi@=llvOO*W!|S2if<_z;u1K|HAB+ z?v#w%6&K)dhY(wGyJqtIXMm}+z&oMdr6m;2&c-gcz;gfZa$^&M+3*JLh7r)sHOvh_ zj|vTs{GIbMqTQ`KzhG;BD>9Ec`QCdLD_PV#ZN1oHk3u332CA|hCrF=|wJ#`RD0`$z z3`_KKtDQ1j4p`Y&xt4idhzV(43)L4D8se_#oNdCuoAs6+eqd$>xd5!5HVjCtfR4i zH)WU>)e4TaSoI3&+TrGes6&0?-nR9H(etE+9=QiGSUf6KHMT6ZUc>x<$?C`b{_87F z+TuAf|5}^Zrxn0q`(FZOW%(a5aauLLIvQ;YWFk2%3oJ8;rB3fP!%<)2cYB=$a}cuZcJWhViWnML z`q`P^=bLMspIPoihSYcSw}G7!znlBr1*}$I-*-b+t=Hdq2J()i?!MfGn|)W zJ!jq{&X5fMK3MJI_QRPS(O36g64ps> zs)%>Gfu43RR}LpcAD+9&rm+jjKC?{}=wHuFvU? zDXu#eB`KBn{h5`g)gHU{6Dl$^^Q@?{)(#Ix9`-FkT>R^<-W$*3Guvh(cD=YRR0IOi zL7%s#i%#DmYO=lKIZF-x%d0goGlF(@an64Rz+rEOVNbh{YlFw*lLCB&siiEom=D@8 z99dK%=JJodE(3xKyM)9mI5VOX>&vM8ZoV_$&c91PAH-1C`a6jd zfDo@eybewYWdS1br02%WukIHq2g-nyKcuMDKQcHHQ!sTWIxEJB*2%9!3FQPvkvO_X zsFU^zF6vf$Isd_K_$CcNyUdd&xMER>yeFDJ>aH$rTEyJt9)zK4FAlDI8Z1pko7rk$ zh3L`J-DTP}aTuxM)n+sd`u27TIq6+O0im$1?+q&=fBb&g8B~T4Tz~CWk6$s`+#N|; zR|P}oDtSrvbP^7*Nf3ot{YFqK+%UF>D3~yjBM6J$zB?;hz9~R_EZ%;EU1`FpO@21v z5|2R-?JxQX{^Vy$v~Dk}r?f{_-H4S13M z#VD_+y5|Dmlu#(nkb~>}(v$jCGRO`oH z#9FB1HjY$h{wYMz3H}%5$KUNA8&`Mx_Qe?arQ#?*OHf)jgy{~081k_aM*$}n-xZ6b z(c&JCd%W!gjb#LO@WPUCstuCLU~ExYw6{Hox-0ifb5*%D)!YD5C0aKsaR&|UPQ1PN zm-*7ADU2^r1e*-ILmesVKr9S>mrdrmwZ)95lsDx37P7B3jot842~cLUN%OAiTK8wn z0>rr?8$@Y2UtXslGBox%i2y}`qcsyJEe~Hytiz57?*+K!b@Ju;ovtq&vBta{G)`Bp z3)U3QSpT2^DTB9E0ApDp10^&>QSXd9Tk1|DSjp9zh&|_Y7g$|`(;tJ ztoDw)K4#>wVI4Jmx}&Z==T)FFoUMs(Hb7lPmBt|!Sb3Fz%4DR?r9AVjmPT5>A&5?y0=qFU?y7WXKB z$gkQ3SPskO@3?XB<`!&y>D+E@=9DvBQ?s0Sjy)YtJIHw|ocn3h`anuQF{7_yZzSGq zOJ97aU1cCxclAr10mM}f)IDnd{0^z>bid%;s{ZMU-Zz0jlo|q`l`8$#^Zsl_SV2wK z4?i|`NBOmciv(xUy~tWW0UZc*0x6sa4zrGm1W<|Al&mmvAqfh$xW#Q1xs{tEd6#62 z%ovrRAUB_ARCOme)v044F zXb_tr#c{#iPzeM&(Jia-w>2z%l~?`5U8MD+0PWTov~-U~>~y~fDTQiB#$m0?TGK9n ztnW?6pSh+s=o{Qa3et8>^_r02wH353D=9${&A=#%^Vix$4iFtW#-46oLKY6GrbMU$ zmYg7aC_|nu$ttt$zLbIVp&ipw{+L30G0XSwbjqTOhd}(Z)A2ymJxy#9H$VJ|g-oXC z(w)Pfg@=dinLgBk3LtaHub86>Z|$L^1_mL&&$`+M$mc^Tsb^DB!jnE8O)0w26ji7^ z4LlUfJU{Ou8j(WBS_qaXvu^BWW)$RSGzyNBoaD+drJ^eatdLmq7qpkz`1dNNK;Sl1 zCcm=W2~k5MQ506E=U@4c_qZ(XcjY0zUeB!loRk@WB<6T05IfH(eRL4d^X97#CYRpbCkkL0}~<)Wox{%jK8V>fGd{MXC_GoeiXhZ+f2FYcylXe~TWh zy_+xuq`B4Wr4^R&D?tuN`IFz@ZOeX1Kz{dbIxNSxNAk>0(wa%lV}3@L1qCghb=GSy z%+MwT+b!k?ch7=^VYK6p;fBDSW^rskn~Wv_jO~jI{#t**$-$)hT+PJ(9A{@%t;&0i zt3(?M$+O`GJ8&NTAZK}LSq?ui4$l8l;%~`BCm|raZic|>F6ofIcTFLbl;DRYd5$)Y zqoY1Wo4G^lsXlj9FfKHE7v@A1JFG~hiBXZTi}Jv6`~{LPJ{bL{;~{M@+Q|?xwIp;L z;JWV2-85H2O=y0!sul52cND|MgxPZsZM(`l4;x>yHq;RREeDI1)+X!hCBi$9fX7B? zi9a?3oh42#gJ7meS(l$Gidvgek;yJcuX;o2sxta4#Vf$(KZi*4`L;G4BM+;`q~4pA z?I#N6aka|%4{>O2G6ZjbQL5ZtHGeZ4sQ0e+M$Q zhxCWdIT|Sp{4|KB&WKklhZ&)XY8DAv3&nxRi6v-RfdAb+FmJ~+f~w26+&=R#8m#Is z*nC8SRS~;UxoNL)(rQ>!tVgc17(=qVSOtQlws+QkiLc-s=9X#6aRMizwOwcl6pmES zHj%(eldG;a8C)%0(x`XUn4V$>!S+3Z{3*-z@*K0+syo>K*@^tJB%bA zKS)d+MZ?s0baQGIX`rga22Y)D>_`Q8dzK2E;@kH9b60*~|Jj(iWbH98AKgNs5rZR3 zcw5^XzqO+7!&ZYM~7#n0Q;Sv0+N6ZJGOS=<#DzC;+LeSy4F{P1@jD3+HeY#)ch zgg75J5D3YP*_OkM-zF5PqkULUE6)J8DdOYKt;mmmG2dKeu(@vTZv8D0xPf0Ym!Lc@ zmKz$EC%0SRu^(%>jK7{w9_h*3n)P=f+I-f!y$~z9{h|!@W_xiwJs3~ee=>fw)|D?% zQ?!vfp~wxcEkD+)qK6d^02bt%CN89ocV>-R<(aM!iA-O6t?~8p?DbF88&0bNw0YtU zH!s=_+uD|~QB5;O?AG>brWA9yEO!kmREs(vSKsJlKRMCYJsD{5&lW(we;2svL6dcs zH4uKhUw@H>xLi_5&rLQ5K8Aw?6$A=|qCyj|Zyan-o$hvOygXe4%{?NeLnW-TM~4-> zm-%zB@8n>dm&be*f?m`X6^qteeS|DCYBFnGX=J;vp9$07H;*Ms%~$THx2_hxsTc4O zDu-Y$t|DnF6?sTFATSSV_ZA>ek?qy*9T%Y7TlR17`mKpbuwo@bog%}lRuD|6$V%4F z{DNnX#a|40Z`oe}92p*lW9C6=E8WU7qgw%KE3u~U#UOWsp^91VTI;Hnm3VoSmK?cA z@!sdp6@tP=U05P1PGl%>Yxd`3%qA>-Ym_lk;>IJ%sey`8%ud&pXPip-b3qJ-G?9#g ztexw&>Q#p{RfT}vQJuIo*O({~zA@#w!8P{6Ff@YH4kHpkTAVqzZ>`~eO8h2lvxkTw zA(8Jvcl-AJcle{rL(}aDI&V>a^Z56x`FW%BQB3o*1(pHdyXi(Equ|m|a;a&SP8-g~ zB{+|z-mHXtk3Cb_i9;_?f;zgjIIo@MvATDawQ|n||I{;|ZfRkw#>vy;6!i*=8<)$@AxPDY)W{Ccw8z&`Wz@tyHAjG@|Mc}SEHR%>(irusRchaEFm7G$2h)w6l|pn)%5hc;MV zj|=!zdO0XTB!$^^)U8pYAb9G^9B+Q4NG54DlJ4!;?DIFhdJO%zaulpSRNRp>t*)4* zM5V)O?4oeKjlvuMr6gcKCXwHea971~rlY|ioG=_Sb-%Em#GIb{qdsdIqAaY@1FCi{IYngA&? zS*8dk1DU|blQv&!bd7M-=f zy9mxKD}PTQnyq>?^+P{{zIcz&msc55PWIqdoPA^dCz`E{ToZ?WlC}cSx%YIJ3Uz7i z^nCoA`txc0ua1wpH>+?dNqwJLA4q3LGdlJ}vB*)#wlTQNvCPfl;ugMe*&kjll9^|S zUwOlvW1_K*hHYWuCw@=PQ1e{71M_{f?E(D6g07JmW5@}>K~~_WU;$&d;j_d9fq?Yg zD7`C*pk3l*$Kev?@#y*K`NTv6^A&CD|howi-^-S$hHw^es@1nA+-{ha$ zf|#BiVy4B95itzWF;qaKd z8hjEDKNI4-o`4Ya33YmoibzgBWqPR0yafgtlY~x+cABuWO3Mk{QeWIg4EW{QMi=`~ z11)cJ15vV<^L&$^6Qr2_t5wvkMJu1Dq*V zC6ef zz^RBdS;N`ipuvh2*C=>@=wiZ*2l-v6!X4D?fox}lfszz>FlkryuYgae7DSrYAWO2xN=M;?IZ44kOU&hTD^KTQR#_R-~- zWq)C{Vl0Yp{Y}F#Y>b0qyG~3I|Vy?2O_VZJ7hxqWwZMG}?kq*Y3o&|cGQ%h8gZcjc!9kPX?G8wxl zR4yNTe;05O{?UZW`;D;{*^FsAYV@NR!rF-=5(jMqgR_vw89CT%4^@gF%7zigrdG}koB*YkUytA>=_TV@h8m+YY&}* z|CnJv;Fq^~3$x!cZAA9@j}j~`DwO)+**$TE}fE0QFspt7D2ax zu3!MiN78L-5qSQI;yjlFAmk_gHS?nX!X)*4kedjAONM4j6{M!INxC`CH@hkfKd?hE z=`lr!+$ugeotLpW64Me$D{Dkye7To13-gbDO8g{STtGdjQ#*VBzlgr4@)uF+12(*O<9~igJITxsl|Z zp;a)}=`<#=?>nm3sW81L0xrc2-=`IKRm(lwM5Zx=;|mk8%0eFP3#prpNcdrB+KG7m zS2mtrlktWnJToHB?jwlEW5{R2cas9PMaN5xMH}*%PrnO%h=vCw0iKj^%!noUhfjDSYF)qKE@)`dU~kA7&)QKR4Or1bk7?5?a~}*jf&Ty<#>vLcmYg z;7BGJE4N1bJO#wlHzQ9}^MTg~SOT7F5xezHs5r4_JCkZ=bOFOFgffPF;^>@_dzIiE zS2dL-9W;yh-{p?r=%Tu}$HS*i7{KwpWjfn88y@GIT7L1wr_f*TGp=U_B;9TP{1oe^ z?!@o=FWnPw#z)~NS$_V0%RP{bzf=FDl=%&`w5c-ZUX9r?mOHfRfzCPjd?nGY8{1%y z_XGTg@oq#Gxj%xp?_5ASV=g;IR70ATmbVOQ;M z8`us{Bw3z&(BNoScGIK9#Fs(;EG;Q#aPZ&A0k6RXV>TzW=Kw$00n~qrZpqj8@R4;BuQ}|GPLa>5L(s5pR{Zr^zp9#@Ewb2$mXVqBn4|iMVWpn+Q zv4_7sUBN3Wpb59G?uKPvV}Vz(*hh;FGNz3L*5&|kP6Z1vSaJWTr|u=;ZG~l^$Mqq)_q#Oy5sqJInGqoj4$o_QSz?%t z$Iw8VWnr$iKTNiz@du}{F6UC2sO_%1z=7>g1Y;sHu+$f|7u#zqRi4RUgKFyU;JR&|TdOV$4~_F?~zJLCPo z!yvZ*#_DYU2dh&8TDlIKoLG{ECt9~PXhx3G=hqSeu4rwp_0~n}}b?;f1*bsKu#MsTBn65yg zfLDV7y@TlEpjXpu7%dzwoC&rRi_Q&pZrq-bdbao>c0GIF1{ ztvlz9UlZ#}{`B-V7>G*DwgSm^;bN?R7w8c3(fJwZ+pLIXAFPizvK8>A>PvPG9ukFG z@D_CP3#)0FmI;YpYNkVTg)lIqvA#Q^OPt_XiaU^*fXnhzF9*?&ABH(rKKSH(@Gf-z z`bQBr0*n}dWOfxWleKPDDe!qn(Xl(b5mo z%s>?Oo92n;#YPC_lCCPg`q%b&*�z zUDO52I*s7QX=S|o~7G`&rpdAvrdph@d zygT0a^8I%#n}?A1LjGe-_ri7oCW6TJTvyaQ%S6-m3aA5cypeH`-U?&Dl`%6L|KNl9 z9u@(D{+;h44ux1^R{6QUh}C2XBbBJMUXz(y2(*TKTWyJq6ZCDP+3%H@G_P_? zyoikBme9VH3cmICEt*4c4Nbs!cOpYqRts7Sn#I`_uILm^jzL+vDmjCuyhQ|L z`BG>^lrN@!IcD0_EiqoD$Gf9|0?<>tuwKC6LI>eKB!lJBo#|N=hu)X zsC1OB#pvO`_aW^=%XoYqNvp`o*~2#5v8ogyCi`d-j+hB*dPXl@y^^(naEoxK^07cC zDdJhPTT*os9{rIno3!ipdH}0Ik)j34f2Rh?7Z)m;YSJF>caVivf`*10g+hqfR3tfR zfJxEhFh%XOL9gBQLAFw}l1%zILobnGNAR!@jakOccUma#@XT3G3Q_CqS;DaNcrS)k zqyA_F(_1d5CAC>9dPP|LX%o_rx5y^TGU$m&?BY&#j@Q%X@gHMCxkMtc@x21ZJ9%7T zNozIl;-^lr(8=3wuK2QOhiZyabrb}!!{+Ltn(?qi358Q09dZ;}o(b-tirRFj`FV3! zVkDRT!9+XmS5m&{X6(41t#?%4w3bT!~}Xz3-52E!I@Z_KcMT;;6#4`yJkFllxI1V zV*|KMY)Ii4R7F#@ys`foUd$Kk!lzQIV}bo;v!>=x^Mu;K_)u@7o0OsZ`A0L07FPcP zeMhT*; z&5us~Fc$>%^;^)*0=R8vAe_r`g zEvWt1=95`NbLE7IY1*LZ@!3L4sFqiBYFmEr4)K|to#gVsEco>x1De2dGvJb-vN9QQ zoq(cV{?B68rN9-!>HE7#^eXSR*IlFPx(ArQSd8%lby)Vq!s}`|oAdH^Zw z)#LqmhQV@DNZjr{*Q+%IfJCj~wv+0- z9gSPG-<;zwjAFwfxCnmt)7_BrUp(Gd0jns{sx4nrII$;u7Z_1!t* zC$Q%G>DK8Z1pABNrQSY6!6&j}X6}yJaoVuG?zpepxzJs$nR{8*_EBft_fl%J)@_@D zRXgfD;_FX+T?+kc%OzwrkGWCQ z*D2cMLqgL`%rN~^!UTBJ!CiOXDliy5qGEHW2c+w(t=pPmgn=55mQ2#WG*{}k zY|O{mt59WlQ^$heKoyigaEUm7sqtS@vLOATmF@}!+(P854iqEg-=iAEDO;3JYyU;O zJwb$e+SK%9M`s`Hq9OM0gGiaL?Waw&X+=d1k8%)2_c%p$Yr1J%NT0g;ZAL$N1KhFT z^T&6{o}CG;Yp*qHf3uJUW4TFd;A7I<6i&d72%I?|_J)1_eZ1{kd;WX6d&u2}hf$Gd z;MS5=KixKk%0HarG|=efJ$4dk4EIid&*=e=a#>WmKlkJg-#9>unCkhGC=2~%C{{Ai zdfKGOV%)s7MEM$DHAPeG2Vr$h52)n1RoMwRVShyEv~P2_$#`+akfPFu6OcBYIZO~k z1q3@qTUjKAtex_g+i#Piky(Oyj7EW7nK9%)ElNf+<3Oah;q!Ni5U9+*;~Uk{-CfIP zkm|D@QxLtTL;D_22I>{)RXQaTU>U8m{e{)*EN({n`%!V?YaAc!(&Nfm%vz~-cd<# zyO5>0PK3A>o2_Q37p_LdtJ@EQ|3^oxtQk=Zoaw&Q9_DbBtu!o zK-ij9rA(uD!EwN(5M}_!!Dv!f4AoFsKRk%Y-taeOJpYM;KexHCBET!bB+D$CYTuD% zwuGwT?HM{RUZ@LRfDnPo62=WN-srcP6(@-FsC`BOwN6|te5@u!!CknhT_FhRkEi&7 zb#9nUNS^MYVpFp76E-C+Z&P9*mf3o(lqk6*3>NvIAq!IY2VdqoMn(h^1`6zYR`zR{ z?{=$3pM-4Q*85i=4zRE-=PP2#grZtdTWh7%$$p)V%ls<>^bHaIlTmGu3LfgEh;sw? zwV24|&oz?eAJpf*^@6u$O+f@kq@GmduGx>fvM8ILNHvn>)Rc12G`GjAqpa5>v`*izRmltUkjWCM+$cI$#F-e#day&~U0w%K!1b zREmGcX`_i;eS93FMyey}65f^5C;^W$h5M)rf?L~y*aJId{ta)(w|538J0 z#dnovy^F3c)-Eb^r)86S176pX-?z8D3W^^E(t7z@LyWck=}0=69Bsc}5cEv-5(M=6 z5^@pffG5Q=FR-W*CgSRN8B)De+BqOXDyCBO&X1dMGs0b5t*~{;nbySOB@=enZyoCu z^d&9T!vUc`N7}CmA`Vq-bD7uNiw`}|TB4)eFxxT179gHzuc#x;C}K*Tf!GI0@qmWH zB^k%m*U)2^EttiwUMug!Rk*sgUFPKP4;Gko+m@_W3E*ShXCJg~idoPHN3<63^h?%S zLr7$6iHhXajZDcK*2WQM(($?rmi{Wklhwjx?zA^lUFAH7oCZ}d!zhiQns3D^q(&O_ zP}ZrAX)dWEmz>C*7bS2{tb#4ME?iOvB6ysa-x+?|*MB#oN(snj1jsSe}BHkqAKje8x00(Q9L@OUE)%NqpPtBy>dQ)<8HTnN_GY9{sm!Q|H&;12#(vYEq(-8fS!mkDKEl z1ENKkqBtWPp;t64^$ZVW^T&_m@*yN93f}%ra8*8FI29EuN=OA)PsAMB4@C-_&ILPL z;@aGimflNUXBnD)o{gzyHFp>p)hpipNmLYefr}iP2(o{c*irB2m{oM20`FKTp@Q(w z(*G1o3NiZYt)OE_wg!p3M+9;U7NDog0-9U`OmBV^bh1Vr-mbo?y}Os89f~+tor3$4uxgO6z$jS074Y~{fSa*>+zq3K6xL9 zV(?&yE3k=A98+NpS+U7y=6YO}6M#Y^cN6Q^<|tYI@j$vmOR6W+`?(3yVc~WJyP=2} z^iO*^>BYNOurr#oVRzbn61mYs&`XH)aURYhtcSr#_UWpGSeqaon%>ADo_3 zX!TNL_b>&O2dDMnMsZD?Elu*9Ge(^hh;=dBHXl!iO}QRo1dk?gD0Ku%bpYvgxkKys z&I$D4H-8_`*WN;p;({N1I0Abtm;w{HIOj?6**0PC&kpANGt%0sbNz31oCDOsGcCmQ z=d3TL#7h6CI-pV9&m2eTXABJDt4ZS)=9|i&hd^1=e0anX%X3CFv**^LMoNM?n3X*? zN_jys(-!&`6cVq<&JR411mKI(g6BxVn7w@=`Ie|QsI((g4P%|Ar7CaQ+_j@lwSY1L zD-`uPyQN>XT)U|tmzKK_OT+g^y}+ePA2dG-jf+5Yh=IeziL>>Q0V5lWFDtCkk7l+; zqMHr+9pTYZ5qXhkw(@U5UuKCX8$3CU7U+V!l39YMPQL1aTEgW}DS-DQp($76PiIlU zfwk`Du^H5x(c$yp{p=q{i#=qwl;Ne1*Wp*2W*<+#SL->DAH0xe-@9<{wwB|22ZrT& zuu!~M%ucHy8<*~Ur;e5_b@FtRig`-%@RmEIStsas!way?uZn7gL}4T&m^8t@3F=BC zL45xTh+Q3Do~3P@+W=wNI!>nlV8y)aEC+|Ab0mgE!HJ1Chnqe}KWS@*(cFkGzIZI8 ze0x0tU^w!f%Pcj*+66#C+NP^L(Q>%*4hidO=uASvPTMK6IJWWECTNEKe)-&gkkz_( zCvc$}h+Yb8nUvMjQu|yk@W$FMUlTHQ%IZ^^SDG!8-?=Ed~>me=_ff4U`+R%_qF?B1Z1U-_{bAWPL!G_Zxpem>e5DQO-6FB)rj9+3d7> zE+momB1_vmE;^L%^r0ji>n|;1E=`#TJG;Sx@dOE^d0wwuL|})woQq1CrSma~|7dOV zr@BE1$gn-1XMtfCFh}AznNCXr2J*ha#E=EB{=22;`Je8cm4}@*=|NBgxYC(Q+-ybd zy-~}@D4TRlWd{8M)%5vIz@vh;5!sAwQ6lST!Q9nsKFTsS=aGF!%avv*ag%QE4Iu`ToHP<=5|) zUgjuVS{_<6*$@h?jVSsefL>v2X^-q}1eS;QqEe&3Ixe z8j_xJ!En#ZaaA3V*W>X&K*`smFeDsa4`?SsL<0Pi%u z{A|TAhL+)&`i=);gaN+hLqiTPua6Rw%spbuj&76%lO`?ofoSVe5EnW6x?3)((dg*q zVUM5D4vP|aNnCzZcHk`Dst8>aQ&MlbjO{9bvOHUNBWZcXwH9e99Qa#JV>x!n#}&Ik zU(zkF?{bi84$GvcHw(d{GtmhZtt)IqL7z5|u#LKJR{$n^#vg>4e zNu>|S;-PT1IBR~D%LH%vEs|9PbNigtx%He?gs4>>0^Q$3B1kD3#h^ck-1XR+hfkfN z#!+P+QkqLHIv&8+UK#B|iIQMs3SVa!`lf#oiA@*p@l*IwHhr?FawJ_x-x|2y^}t!8 zPcU-JdU^Y)mh_i4zLjiD|GZmsITbAryfgrCuThE(!+rb_^57+7$2I8+6X;sjZ+cO? zwZ6;xb26Uv_?i+N#c(k38YJE|;uX@r9%3ZPO`$Thyw;{mg*@f~0pWOJaQq@kJ_o5m zjQ4S?R}w2|t$`!C-X3bHXRcCsS7)VyYMFBkP5O+Ysg*gSF6oFl_X1?e0fYiSsgxM# zFVkpawf>XmkEZLaN_Yf-V^v@gpNE@9z_T(c#QWAcH{#OD(X#Qwq$$=74sB90&rZV6 zs-Uqzu$OA! zk76Q>g%qnES`iI2e#Ul3dzDDKw4eerrl9f00*@`VK1_kC!LygyuTG%mfzme`Eh_5= z!gFkyj%WN5&i+_eHCXhWYWm0$q8#8>4!w}wS(froQ?jmaOo;pPhwP8FV6FH(FAvKk~J6ozB<09x%n*BOd`1|`oDmM{fzXD z!S;G)MhI#iaDOhe!PB_3&^g`p+>%XFa3aw*I5?Gju}8Of0I!P~{Cuxrc}lRFQ;ooA z_CuP~+&?or@Qeio4%Zso$Qtezj2^%L4(bh*9&RkK`_IQ5QH!Ez@Y0y`zFswT{%Yy%)+MN{CT1T_HL1`zEyu7-a9tJ{s(UDLwcJoZZmF+mwRYxbQDZFl z+vu(kS87s(``(AJR{#RI^A5SqbK14=l24=v+HsPjRN0ZRL#E=$>e;I=<)G7+p7-d@ zCZUU!jYciBbE869W>YXy+?iHS{p`V;I>Pc#R!t`B3@KcuCFv0eg~y0Yx??T+(c4I& zDh~bA#W~n|yUMP|mP>hf4h-kyUwI%oUSJk0e1%v&I%R+7dyWnu8lHQFii0sb6q7e; z33~$1KgzY@qx9yr8583B30HLy1J@exLH_{(zhO$~;_Q4Jy8vt7C|4KAU6m!%SIVOZ z4ngD{;RV9Go!*!%=4iS$gcU-1D;(YMVzZ>kCXtH8Snwlm5IZ^#xW;!u@$5p_2j@lG zfdp>rn7Okr=ZS#lwmw9)e!+&LG6esdqFu-dEWd1g`FWQ_S&Qxo9?V&ppEuW{F3VJ` z$i$GkqI$4#v$MQDcLRO=A#aY+Nn`}Le0D@rQ0;5Qb%-v}Y@q_hQG3qTsog$I9PV=J z_Xcs&-m5zwqFq8r2r~qvQd7*oi1dGz8f#u$|JD`hGsXiXZSN(2OelOin4`5GJ?gnF zPZnA(u-SsJGP+94`QNOkYM;fAG1=*yuByqp#42UdvvmpTCz*6nyDxRS)8+Hg>D_3? zM(xmuQ@f+&ijrZuC8Su++Hb=<`*vZT4etuQdY`a5fudr9AL*C|)B0M-l8WD%rW_ zNvN}qF-ztz%~eRC&KS66|M`RK;{e$crJry*ocZ^0HKk~^LH=C5wJ7e-q?@TsNts2M zCxuuElWz!{TcC3W*Kl=2fs)0qfppfEPUk< z{QSGXF#t~Z_-d?~88{b`Rpr=3%vzv%Pa#yp8pPP;w;Z2GY#M;6&@Ywui6E04Eufrw zh*XR-6I1aU?pAVUDTy^kUF+NSPvV37m0uI^2Q-t22YluHNdcUF%I%s_JpdPOqms4z zm-v(-H@)WugyR?qH3c6VUnt6+HZ%XRarXbi);mB~)_iNfv2Ckk8y&M_+vwPKcFYcU zY}>YNJ006e$4TeregEg2` z!YroL_eQT@TFj#zSK6?~*Ml}L;j};#sL|cf4{MU zvyg6UW+0hBn^9XOHkiM-&&TxY(O`LU9X z;RLSD zEnsZO6bW#+YCICfLmE`+hQ7@A@bkh~Ggk_3dO0h`9W+ix`Jao&|Q1xN>pq%v zq@fryq9iSy);3N3lE|;y>>OG?r1?v;CJPfT*YV2OCov@2(EvFzp`?Afa7e6vWkgQ} zR6>*yQL(kpO>AnP3R=}=#s068CK-dnFGxHT74e&Kp`#Muoj<&kb}P@)fpg9pml&Tb zF$5r*SlkH71eRkTNhdJKj-@0U$AUQvImQPj(phNlP2%nOiE7r<;JX*0N1uzt>*6P- zAMpNDs@@!O$KnJjz-r%=lnS=%QI|vqEoaH|to6=Ie*pWsR4Jh->QV)<>{|M`3=_-li8KQ}cXc z0PiVOzhJv*%4%{Zm8~=@?ItBu4RGwd;=2#r!;UjY2e$%?c`t4Ug*$HEZj13N&nxN^ zjo{Ifq3Tj`DKV=*!g0&YMJ|}1x{H@6{7WZs@7cfmzSPvKz+Chh6VGdrv8oXG;RA4$ ztOO0vFzEyPRbj_Dt{`O+V*t%Eg7U|l_a+cmupE;@LvqxChE-0mzpUL5Dwv@ZFxlW> z#_{dP2PmSRtr!DZW5mB&g;NO;1*OOyyEUdZwO4MSNQG*Czf%npf?G!(Gkf<7-1&LKiEU~`rePW zKI}KwQdYo%uWKw=TA$c+^|+RY;GyYW*AK7lT?o_a?bDW1K?S6gX~y>745R>oB#@~M z@T0UY6 zl)#e<=rrvN71F%4TKOwKSZ(XKLzift6JFjD>XEfN&_1Z2KWSp>H53<|0&R>$;s=AC6k%dH)}rJfM5Kn2fY7I zMpki_JS%!EEWI1{8{ZrK9UUvPFx2P5J3bK=)VhLS7Rs&8;yXIg+{DyRzr#BN8#nZ} zRFV|36|TDDf+b^Y`r#;E!s8A`YbB$v7)VPM$J@jqMxUyo(pm)taTJdMva?& z)-29)Yh&viE&~CW=-{5w3brFw9CTALHXNw+VJHQ{ZPhcE%7m7KXZ&@)-x6yfuvx`8 z-HG8|aI}q|zk*<<`Bo^u-+n1%>{E05c_-~>2flBqk^(3UATDYBegi&tb^&*&g%;)$ z6cIsZx4~6=+_X&eSEK1Px3f}P#&Aa!!jq`P+ht`F2NlZ(StmwVZT+1R;?ckVYM$T% zpHsA64D&F@AG`qmB%D#k|JCDm@kKM?9j_z3 zkGc~KBwO%g*w+NS5*g%lvL{{+9ujFLGz0<`OfW@ZRdEk6{+gX)q(>Sl%6M~|xkd<3 z$o|BaR9=+OO@gUK#jf-c5~k71?FV&z#tEoIJT@8C9_?VvXS1EH0D{C3fsN` zad#*_FoBVA!22TbR87~>J^gwu7EsfpK4Sj-r0t8(O}%64mTL0#g_se)>_HiRQTn{uP&W#ThKFH_Z4^IDyD9BZ(_!~|8F=3NK zw1W|ARD%g+M=%>8$z|^f)?^Z=lwln{?fVM(loD7M5~ZXFNg!kC@RJ(Y1MYUjqbv?~ z21;nG4k7Mwa*7JKwAp+fwlQt{x62aX{BHIJaX)G_vir35-A3T@rs=V=40(W~X@N~2 z4>5zwHF11+tMy35#%1b0@k!;(jjTu`3s+&3CiKs5N?|XqM_{j>C!wdWiSOKupv6rGJnRCNXZnDf)5?21AE86AzsU|+rt@DxA%Gqdt57=fja;)zVU=7+V!nzun zFY!Rgu%X&`k%!ewso?g4U*!dM#j~AC7|?I*bQRoUd&?7eXHt(YP&eSeDEK8$GAVtW zSGSCE44M36{c%d23ryi0Idq=^G^lF8je@wBqO_P_)QDF&~R+em;^2-E~N{gY#du8?F z+_a%vWUQ$!PMjd$*z4DG3u(680Pzialsi#8b+W@voA=ZG)6_J#`+m0fZk!0|%#6l& znc?Pl`+66@__lAM&tL!tm@?03e%zhfw`echiK67xh$^!k3(jN+f%WDtO;e|uysapK zebiP7O1_4DpuxY|zvye+`TRhLsWa{~pC5n=gV`(iQK~p6LwkzotqRA@n3M2~_4<22 z@&c4Wvw579zHB_<3^R2}*#2I~F)ccT-W($T4s9G3-eo$g5KWo`P}EbH8M;I!RUM_b zVpBw)+YiC5DAJ_21gvM)+bAAi42U)y13f5R2t(qcOUjXEx89Dytd+jwW~BwY*V*XL zx5H&d^zO$n?kv5rHcS@XYk1!LVMJ8-=9xqsRX}=d zeufCYq;$Z1{=EtsaC)M--#hQvz1c0R_`_!xWaG61np_Kq9NNO3sZ{Dmf(n;Wec_db zDnG}9G-TN?Gh=N!G7Bm$?J**~?mk#qnw|%R^UJlvA+wj9sT&fFrTb{J-?H|_u}Avb zK(ta!%yOAZ-0=AWM?LD4JY9wsaSU=aY2@Nhe)jpmLoHklfEK8VSO}6@QVP?N^RrWF zNG>^14($3me8ax(1yci|tdp*@P%*C)l$@abC7maVXU0gpT`FiPZsB_#rbDH zzj0R-r1vEg{bMOCu|tA>Yk9k6q>)9sxWi-*gV`%r$)N58;J48~xuq`oOokTWbpD=* z-++AvmJURhW>YevXg7T%$d8qt5+|6MFNKp@HOc13fGBs1dpF11k9OQriEs>F%LWB~ z3>0gCget#kK5VVacM!rQPo#YK%QF#+hH%8+3qG^Qm(D=9?Ui8+^3bI~p5rA-p)^sX zy;}Ley&)Vq5a||tA3tJOcvm=#)w3I`&J-Wl?K=;A40j8?C8f+Hfahn^qn_d&>@G#e zKBBY&OT?XZEGW!xd?eSoOhyF+MbF$FoHZxM`tMoq=}_>n{V#1Qr%^oP3S(ON;iKGDAJTVGeFY25Tfgx;Lc2kp;7-?L$EE* z#*;Prjvi(SA?iAgzfZkabI?h2Fhv%G&oWn5bZv{LnJrV?K2rAkp=sr!xis&d(_Q)3~v$ZxZ?RXntxH)Yr;wjV;MjWxco7|(irMDfCrIY|{QW<)aAZeNy zo_^i;S=X~YWYFjbqdBkJOMfSYHyR9P!e23#J}Vzj*6wUrkq@9Jrqc9f6@`>gSO_F6 z+63=$+`gpW6Z>fo_Y)yqoqjTx$M(h8&Tnt03N7j$ydqI5S`i->FB7<~e6qMfddcT( z=L`xj>KF=3=ofj1XTL&H!xOhl0OU@%Zz&ks7X8Q@M5gpxoF-vs;sMZmpsy< zcGhl3sf?t^@4(>bUccn@YaTB7g-kx1MwnQ`_Av$&EQ0@d(Z133id^p8D=M9R^P-^m}12fn1lg~c>+#~tZ_p(NN?ZyfE>E-@~r>O0Bx zhBoF8DCjC}Z8ZNAd+6SU6U2k^BjcG{HH^V8T~CjR5j!Yc1P-dN5!hOJrdFws*(&#L zb^H)`#7(&S*oeI_bpLYraCc`_tO12Q-BHKLnM6JN5$=&py*EW8-_nFX)h96I2MoDd zW4-tw@2HCY@jIF)AeBoeF+aL(LC&|GR^F2WuzZ4}(IFhy31YZXC>I9UQMW+qsk?eU z^9Az6S3{Q>5h1Ok0i`bN#ldAaj*rK+@Pcm=A~H*I#hJ&&>&D=0qp*$6(q9J!-f6Ja zz9i-~VXa}FScby{&i(xMWN1cc5_vj;l49C5uAjsO69_^ULaHO^X zZdTkE{)(2{Un#QPR`p;t&!**lPkcP$g)kK1abh>r-YZBzPW($ws2Mxca^s zq7;W6f#-wnx#FdtIEDD!xEsT?Zsb2dZd878hM>?sPL3!Ak(a>w(0u7%&lZC54d?Hq zWzY#3ZyZtZkSb4eQNEoSjlib55}StsSb6e9VZAkQ(eT;^#z~RbLwDf$3ai5kx?>Rv zL@pY#KR^t?%UX`&Dm}dP4NC0P0rnDe}m0%7fCddYIdm&?JA30j29JuY9Nez2P*4$;j`Z;7N z!QdR;cNzNI4y?oSaA&Pd56L$Hf@3#?^l87&%!&jOZY#}ShTBg|pc)M=3u|Z}r8w{) zTm5^+exA1%Q!Xr(HnVu~#~i(lfMh{~9-j^mci%cq-JWa%`r>PSg>7AhV{kOv(%!z9 z^HVY}H!uUvgmlpq<|yI>t6$oF)Tm4l^MAnYDyW5K7$6J^zSRDas!AF+q+x!Ugyrvw zWfYFIpR{zEw2riN@gYJEgZ`&Z_x`nK#|B4Oj-nT0-4W&3r=`Ob30`99fCRHLkT<>XMod4|T~(K@VAw987Q+X)rDn5)hDgPqScp@RrzkDb{W;pA z7RGAjxL-*J7FViDH}keNf~sje^Mr+pB0@tjI+QX5vv?&ZU>4EYmq2hF5cQ&K+_Da$ zNnvxHUbMpu!0!-$Zo6X+0T_GQ>XKs%6{rx`Go`QO$rWp0_Fy?GR+CC@GKzAQ{C&%; zvmSf9Pg=xEE$EP-YzEa}`E-XuO69{-)*;Ffn8PM6JB}iUvykcHHC*S^AQuTvND{63 zsjBS>h2x9n`w%nBnxR-9`KP`sYA=d?S9KIHYP?{zKX_8TKty2%0r-;Vi2c&u7$Bn8 zSQX^rFBGOxW407}4My0pc%5)1wb`;aJuJlamv}2%#MtwvI0a;$iT9HGR}Hc!uVeS- z;L1sEVaJ*@o=!t4rBsp_q5xpH2CJy>wD0+Ot{RUP6jB8tzmZP)L{J?%Ofyuns$G1tHF709izd6g|`2m8C-oBKM{3so#eS+>VDe2^C zmOK4UGL}!snx72cbwn-_l($}%vl%m7&o$zcVP=Y16F2VViQ*-cNLg4voFFf?nm|dm zY@)ixhT$#z0w_fbx*fAj6)BRCf08nmK@Ew&GMx46cN<=EK@+8wAOT`%fO;>X$ae5N z!X!%k9KTHDS0^a{w~`^G6Kn*p|JkeVmx8ItE($6VFr4ULuChUk$U!KxVM_{qO#fl) zO^xwDt##aFa>D-QCR2@iLLb7J;rbDru(&&_JOmDSqQzjAYqL}NET)LwTx4^TVgo(loRa8PT@N5xRpNi+&MJ z;Znq{RJvGV*NR;5BgoC^@AfzDN=$4bpnTOR8mPS7;JB(dRcYbUjKC6@{CEj@cTl%G zUO0a)l3R+e#|Wl)I~b&aALS}}Laf%npI(DDtV!Y=?xkZYNiFNgK#T`=vTK= zDTU%UTGr>Ay!`0^7>!3~;% zT8i2{5X!s4Mo{TGWvy6QV?{u$ox*(f56}$o4S9J@TFQ@Mz_SX4FSN_eqIq)e$dR$VM16tjRJqwOu)8k7`{fIm5EVVH<=$%E;P&|Uh zNi&4U+VkncUExB6O$id7ZpjC9OPqkj@Y6bDtt=d;VB62$Jq%sEiSsKW($;r5hdsIE z`)hWvkzM+|7z#5Gx(odXsgOIpuZnflm(zD&{f|9M*&HutHkXXVs z!h*4n2do0~5!U;Tw+D1+oprj=S30l<+{cK!xwf`%_xQC{!(20y4Bi2MqaO&F4ufxG zJ5vzH(ZqRVXL9QH{@OM}Y2#&Xcg$rd)YSZeOpnU&&X)M6l9@TfH^+N1+b7m%2&F&W zQxvclvjhLM$=a>Q@r;xtgTF2x)424lkYFk$@VxzA)^m!(PH^g6Yn?0PQi9 zAum)k6g=l4Kr*YC%LUNw;%|1sydOy)OEj75qls){W%7z*aXy_qn}mn92yvY7yGj`! z#iVK8{qFmbf|%G!akV5>9Ci;OTxn01GxI>ToSyf&(p4xZ?i#7HP>Lqgp!CHxh};!U zK$;7Ak1mX!EJOZd7URrcIKfZIXyIC`|Glh^@?}oS@!zy68#5axkXcIvprvE~#j*^4 zxkVsEg5+Txg|iJFs64KI{1sgCRza zuGxv>mL`V3Sc5mE^T1k3FvXr4X_hsMc{PAMLTgrcTqD~@7)*BmDidVHFo`cL#all& zUg-`;u+S_efab2~+=$jabBl6VY2^u~Sjt})tDLEN`pwx_RtpWF6Lowybdij5PeZ{C z#~-OHvJ@CwF>LFubB2XEvkC1;@XQ%rc|7o~>ktrG;`=AjyB1zKCW5spwnP2ryhh?} zGFQGh@-Qiyg$@mpXhV&_I=-hg5a&%G6@O2YLFe7a)wiKl^VfTz&@bIDj>YnU_FQ7o z+mY+__lOjl7iTP>C#8fKEhF7v%6ziZzms*Q;R{YV{<&%0}(p;j9RCcH(vL6|&0 z1elg3F=m$YA=F#H85r+~9G_*Wwt<=UR34fOW+;7)>6bV76U2+=+4B%UW zsz>QjWBVwxz>~^Wg5g)7Q1Q>WvM1Ylv|%NWLSf1Re%Zzpd*C9(u+H6e`mg@Xmpb>M z8VDRY#P639g=$w1dBX)27c%9CjmCxWNMSJn8^E9zJvvo`lt@g{xir)A6?^FB6QyCA z>ykDI9i-8NLX9asocQs;+8e(~mqiX&ss}digC_59Yvvx_p?;~) z!LSkn(0EK`4!T!B-OOzPRkULgD?YY51%{GDsKyg6JH(YJ*+Rv0|Ma%$*4_(Nq;O>d z5DJvKF5)AZhYqh7*W+=exn((xfFm(JL-~G?ixd`(i~u8{I*Ts_m<9=xG=;89k`0vK~OGd`aB}}dGb|jyH(t6hY9ZXWaGRHak z(T(q1Hlk#qa3@wt@IU~R>7$Zxv>T+A8j(^eECdk;YUFuGV0;Ps5s`DtV(+_N(74)gTrg`Wz@$a8a0p8wc)KZGkWgal^QvMwSFykdqL^*7c=~Kh!Z&f zQU7$=*Z0#+VeMkEaRNM^SWn8hoztU20QdpLsDAe8jkQpBz(rWM^5{g*c3C&8e2zR` zxjJndzS4!uwxzSb5IlrNzrC8gFufPiL)L!tI@gH`scIwU6e#Civ#{czCxiA$RWxS+ zE%?Q*(_3C!zVoptty@*zpJphDl&uO36+_o0^h!IOHjIUH97PJFnrYs ziJ1S?2`-rb)(QG&;zAVuRr#!ire6RGi& zn5+$=fiIJWC(A~HzxhlQ@O_SbOmB9@CwY7*^5*P7nr2Eu7I!_%=%+T0MFIOl7Kn@0L|!&6 z2zf%UcH7~Nf%yxd?16DDUj$0c?Y{qPB2EqpW5B2=J$plAI4#Ue;uxhSiuC>zBt-dqf!0R}?58^a14lR(z$}JY*gLMIdIcJ9MkerbSW<6dIO;WL2&!auP~L zSRKEvX#XNmxDCOhA;CfC=@3hm0|6rQUa3cH5VJ3hzgHrC0E{Ej&-BI)Y=Y0+m~xoj%>zu*|-$Ls79 zErHRM_Z?Xrj%O^OWT}zGpcZ#5T>U3QUeb!@b|8vOsmGpQv(Zj%Jgc$62DJ}2FTo;I zNW!5^6SsU4Kz?BcNJ!u>0{V8^4>;D6x z6u+Vg<5qBhq|qP*@k+s7?{HhBTdx+0XEbkdFqt(JudkHFC5XWdq`pjR? z8%0ShPL=gO)+q!M-3aB*KFnfybus2BlmU{x|FyP}f>FuKjz9FUZ}5R8%?O1B-BQT= z`}U^~W37fIx%q)8*e_Ycd3EBd7OKNd6OU-(W@Oq+9sV)~B8JY^vB@Ucml^4G*VAIR zwV{@(V|>r-@59gwexr}C-@`{g2(195DF6{}`*c>d1lx`s=S;JA)CkVBsK2b(cHcW6w^L!Q%t+Fvd;53et7%! zwQXs?oSyyDA15m1_K@AqDB=Qa{YHx&nSHN)^?>nD5(`87RWvwwiFaxO4x2OA1A*3{ zJBNe1{{c`gApV(a^Lzm)$#=A007|i?0QZxeE=W2m+1IKc|f${+Lb1kV@S-+Go%5VY# za7?21b}puNF3u$XZX@t-+t+FS-D805Ke7KH>i>7_Kj-*gvH!`-_WzUjUlY0iGnVZ? zdD;Hi%i#aY`>&(T|BB`Mrw_p70!&cuhROm3FyKTf72!YFjWQhTKk}WgxBncm{pW~{ z3y54s3a>}K>adaFivjZW-dN(q8tl?3yy^g2&iNLV`T;Ql@kNKD^P*( z`3O+TtekMHoIv|3VPHl+0`RG)fI1ZjkpCTp|38UcKII+nLz^w6rrP;ba3Uwi1AGvL)0TeBD;_dPXQo zEfoVXqY@Ie12n1`CkYgqo*5ai$n&KxsGo0! zBpltf*R#}BWJCJ$kDJ$avb^99?(v_uY0sMb{f-^zjHV~Nt7E^f2Ub*VhFGm; zCC%0DTwerWLf51qc4##_g}Fg%GE-_&_ffv^Q-!s7hdGc2BDEh%<%0Hj628H_-@Mnl zrZ4d{m@ulzu1Dk67+IsHC56$~{D+OMwupy?=6vT8okmp}b|UBX;V56p&fv{#s;B*~ zpmJb=@qT`gNdi*n4`>Ri=?qQxY-F?Cgvo?JJg1%}HQbyuFA zk}n+40;^yQyDLsl(HU_$$Qz7Y7o;iij3z(m)E~PlRY~H8N*A#;NNbE-m*SDK`lFKc z5#1Wre2;$*#4%1&;RZ&akMbgXZID1jXm*fp@TW04s+=qZC;CG8N_f?vi!s!$!YVr6 z9?Y%~1WFBh07OcvRPEOaeev^x;T|fTTfzXKuvhA7jdxAsLbBs$M-5MRrpkd&eVSKF zf=bW4fD7oyF`ax3UlzS*(!JGgg^5aLF@jtc?-KLFa3lXhx`Fp0$C9;ytb4}o(J$6F zt;af~N2KpzyDOsl#7Ey9n5Oxd*=&!l8-C|3ai8CA{hzvB=p%{kz?wa(Wvz}b&M`Wgk z8z3U%caBPt&PU&`|2SdLYR?H}3hc%jXKHG#TUAWgAS3XvamY=((9Dn;(hO2m5ZZDv`ybrnU)p z(!inQ9YUQte*yebSjlM_3uB8fR%ODC3C5$;&*Bkjhw!P-XqbDO?*nBR5@o7eK~%vT+M1m~ zy5X?zyMNrTcTRi@2u7Zt$J|}FAz2x>0m*Do%zjDeFAyCiT)yAYaoDb+THecOd$%;9 z6QW|XY6{C#DkbtIR&F5ZW+2W03=t|})41rII$}$AaELaOLMz-sav)r3xHY>rYAOV< z6J%I?ki6SK*21K$a#2cc0K*#Tp7Nk>(M0cV(&) zyY!-Z6lQW~W29jvHet_pE2~7IJgy3}6jh8*F|9nDdmsslHt!}sS^cO5jJ>TYGej2@ zSs1Ew)#CMp78x|;1@MfEH>fj+gRviPh|dzOf8O9@i2RPco;~mXrFk`)RAj+O2L5Qn zkE*-?B>P1u+XF37+(X>zXK-T>;P3up&BU(Ra4>RI*wzzE5+c$jO(gKQ5Di}=4&~^C z>S1m;GJO#w!>g_$Or%RA0J15vlr3HPRKY?ZGi1}#g15+*i_O`TbNDziM7wH+dLC(E z78n?1G~UE?UOug0NPlVWcWPvGS2qGP9F+kJooz`!GJk4PSj(fbGoI~BrRt@L)J6cb;WtY$-b9k zQkf5E^aQv$kY;w@S5VjmL|g^*8%Y;ENy1JzVBas$02zsMvhCPt-$V9|Fm4j*bX6M% zXj(HZk2v+ta6CK!Ztz~>J3G;oFLqnI*XwiSsl!6ELwx7PEX1Nzc7Hl=xW#@hl*awc zOx@-=y0xOkwB22dKNNIl7a12C@Nn|Ee!eDvb&f6%kSEYd{hl_%tJM?3O8&EM!mM8& zZGNX^`8>r=@AMt+9i}_RbI;B3=|}idz!4apTGVLCcwl7;AaRQkXsfm`o76UD%Sg}t zGBow)hAohasLL9Z3?!YP@yZu)ojOp@;V-~A0MW>DfyY)5pmtAC99z4~eGkf&%ed}B zpkVWfWLywpF?_kSji^`2yTByo;n&jmCu^+{XIzFR*0@M%;RoBck`tjhuh%eS#2Rko z8f^9>)CHQ7YC%daXr}H2P}NdT6kB_5CQ_8PS)jnQq?>2N zy5w}HE7~npMU9q9F?5C|w30f3udPzKJ7NrUe}?%KE_<*W%TsP)mkm>{bQtol<|u-O ziw~IhC{vwwl5Io&%=t#q@51<-m13Jb*{)YdpS#X9C{Osu0MF+{vb*y76UH5bRi;7} zmQ|E6K)c*mXaJ`*?p0QYlEIIdX;4FTta5VQ>g|4IH`Kd<8TGoKchiPDuir>^6d+ zGfJqgcwNF)%~!A4^%00K`ZP_^Omv1qwr6GoXe)$Ty!XyHhi2pwuPkqtif9abDF|Bv zlQR1qd%;5d42_Lh7_YDhsrAah?iCx!htWb)Xp>K!ZIR*CarJf+vfYc5= z0Hmblsd0fhZr*^7wmVZsA!sU6*i0J!oT%6ibbrhje*S0Pa4r^sJ~koIw`4jsPDv*h zyr9s(D0(C-9E4p?%@t;~YH>=51UcDh2+yPmulORXA8Zf#kJ+bTgzC%01vm558?5M@ zI-^xD^~RUJcu;*ZqwpitDt`kQB&M*=0EaO9BBw+cSV;JFlAKYcMrwH?EzuI$Cur&e z05(?C(+Dk_HLk%`9WCP6UcGOr-;Z0Z<~3^QXS0iUku921+p|?FK?K+nlt|PWlE(KF z3VzP{3!tvKDZ}LCw-hc~R*roa#5+{VnD!7nxnQiQ!T$5$xUABa?z|k6e_!+t3wTwa z7UZz1cs`~-fa+>gy`OD%{wPS;Gl%NzaV9&v@1fhqO7qc+u>~m8HH?iL@3FK>Qj_X9 zO~R3Y!9|nl)Zt*>V~GIE*-J1|pL6p^SM74AMs-A7Eq_G@aP49&4lGn4NQ+|qRl-|* zz0i#YJpea}XhZKtBEG}BKElsH0B{=1bfkXv;=A;}h^|Yk#D>4Cs<8(wJJJdzqcN#r zF496qKK`lq5E`MN8X`Q8CJG#EdUFVkBfVvjEmpXpEMjZO7=HKE=_lgy|tgG1gJbVdS0 z`RMcm(}!EB89R_zI`Q6QW_I=z9QRnE?VX2|)3m`($W1MKP`s236}PC%q^`KF96|ro z+jdV&B`>C@OIxc|b1GP40IX!!!3+z}b;`Y_mq$Eckd!Uf`Whz-`o_xU9Z&+CSK9<{ zv;p>qI~)O`5$5{hR@WDtidvh$L&9d^DyQeHJR|9a@luk&PHI=11&kPrI@Y%#4NgBc ziuz8u!76Iu+tXFzqN9bKlp8y^)+3hhc37mJN@thSmmsnQL z*_D!SaiL+Q?c>|n2=;#+uq6+`r9x>XDxjR0cSl3%6I0~1Tkn35hd>dzgfP0>Ct+?* z?d!xL(q;(yu1p3_vF)O=;X*1;juPG}31hY#BO9vomQFX@FBS$B$pYOo@dyGuQk!^koNA>G?TeYC`O=^h#o> zTWkO&NEro`KRids1)1e9o;2ydWu>(u-%}aI4*~ArJG>^_1F#AC2#$cXH;v~4TP&-J z6)0+O+WF;fL4@qaZ9FK2lv7{o(3pt_^ao^a*ARk)>2(fiZ2`SFUP>w$Llzo1Kg zc-{UkA*6`h5i#;}5|#~Vg}XVYWmrma%ho?W&%(na2mFEkwS~wzAO7aT^E2m+#`+3n zQ9}nWy?S=xZ{}-4Zlzx_82+k(E%!@2wV!V6JT5= z-VU5x3;-_MG}UJIuviH4O5@*0sdEadNa>ShB=7=^90n^3ib7-)&l{^Fa!v6#DHJ16 z>L1Rjk*0c_gHyBRLY(p)llh>e&gdC%pMM-)^fN~2XAeQqb9v<=Nl3M&AX^48*Cw%> z2%aS1XU~yWgdU3+&rdmb{b;$M8SxHsi!|DV$^eNp2YZVi;t07bo<3kDq8$y$#0K2^ z*EEA|^etxVz4a{t4|bpQ&~vFNh>U6B?_zpnoRcMUD~sGIsE)H(sB6&D4PNi3x8R>x zO+1NmmCSaBvK*GrO@;4ebD`0D-*6Vd%8;<`k#uJsHk{ba1RWrM;F~a(xYFpbuUL9S zPXgMDEMzSruDF#?A$|M-+77J%#Z2^7p>KU3O>wV(=P)HRF>w&;FH)ml9s02j(Y8WozYeyld-6XlzY=Burqj79P;@1^V1W;{YO$ zYT&~HwQS3pH+>UwgKS!RigNknX1-6~s9dYqMxhI_S_#d{azM$>K!1071q0zqudRdf zI_8Q;CqQn1RW`}VrarUvLBfPT(|7B0ih@xfTsrCOk5nKmPb-4`Vt@EmCzSdCf2x4) zcCQ&34pECYTM}4dsH%w*C{s5xCjdER>2M=coqGjxI|5~xs60BMFb6U2-_+FAo%?Mhe=bOV z*2J#b-j=x~$T?R@kHI!C-f1&_qu3|^JMu}54x0$FJx>64g&zJ}h1^j#8=#->nc+!V z^i9Y)i@ROc5S9)OWW=&%we}lypxpaM?x0^;bo;=5AtMH*W?N`XzFoU!s!Xx`JHRE z#j$|mJ0hW+D#R@svF^lS8i2}G`7l$6Qga6w9ozaC9$^SBx0Oj0{idO)m60qyT;L1e ziK6!|!87#9#K|vvgeyIb7J?r|N@4<&wC^>&X0*-a4u%<&RzK^e*4`9T{xGBK?e{hv zv=ZNEZYZkGf}0}{>Ky@{=vB$N(TIz+%j-OKJ0E9DKY(*j5@tL;!2o=bkhIN=681I9 z0M%yDDu-jq+8B)UDAy2w1Gc$rN$RO)*`X_f^<8HRuI2>%ltc`Cm88vCRkfwnR8`C% z-X7#4!ZCHIhftkMK|iD-!5JryFvo$kWRdTaQq##3gAJHMnRJY~gxWHqB5-78#NYvY z;iVT3fpr+<^#pU`y( z3yzI3UeCQBy!~Wxe7Dbob`GxKB#=ayc4!zg&z`R2+KAD!MFZ@wc1r{>@W9@wCW)j| z3}MO|VQ3Vq$;h=@P!vS~zjXi^AD6o9O%{B>pN z|1dvK-%>AtZv?}-`dM?uokaOV-&vE}wz&dY2*V6|k6D}sq_ z_kAL!3mf$GQ(51G_h}NB*{DXO1W2nt5KK%zzQcWec%3irFRpkP{ zz%WOb%%oW#dYpZ>2r3Ke-p^MiQr}H6o>J`; zU{$b#+Va5>>l>r0wiCD@1gwh2x$$)V28Zx({RMb*k5S$fjG0y%G_uw&hTeVh(?F~w^M~Jc ziMsQ*M(hzjBRz+kWJas2U>jMrjYc-wK_5jUyu|&hv75v*PB@{y2tyyIB05a1GJ?+S zcUZ<)aa{ z*rV+&k(XaZ{nI#Zz`)I#(bZYrET}^S(f1|qeLI7l>Y&>ZcW6Ulfcb^o#Tir@p{{61 zx0pSxw@o`7-YKn;xN<%G^4t(SRgkG*8^ zAVf#S|4(6G8C7N1wJRkh(jAi0u!{|wlU`f1gxOfe|sH)G_6QB2HO zU=3!}kPDCE(6P&?Sm55>*ZZRoHk+$*73`Vw3;9>SI6{QrS(o$gXRpfO{>5jP6=l97 zxoeJo;z|=?z+b3vGjjsf$M~1k1Uz$nw1iJ-dG$k?Xh19n)m)m&(Va_;84LH;e zpOehZpTEyM_Ipq5tP|l9SK_&101*|JYqO`)7I^AVzAwpQA|4Nw5dQ&K|s%xN@GHHw$?&~0LRCt)QmT)h`?AGw;WIzcoYOXg@Ua6mGisIlP3&-jeNKuLR+T4%{1Nss ziFSNtk%O4XUe!hKC*ZCduAA}kXFnn7$T(SIT9oEt?3Kx#a?Y<@GL>&PI75DTiwBL0 zp5RSNd5}I0XzzLCSx@lwZVOCxeNTevCvLX3R4H<`WOC2@_$c7(9uyLh`bhk1S=LD4 zrbcS5MmBcdy^gpQ!}2Ubnv}rOTkB8t9X34SN#IBAzZGa6m5kN!CHcE(w|Xb$Mdo3^~0D_?S7|I zWjHq|8NMr@mUH2oZVa*}5ywU7G*v6ymf&~qUO9a}2jcLm&JIh~%(2nvaJV$$&wW04 zqj|ajY77+{Zx6%3Ik0nmxHn{l={as6!A9^_z^WPn8r%){9Y+$PBQhC3ZeB?mL0EK1 zfg8v}BdRSdH>BC*-=CMPEst530av3-#u&qhR-vjtI1=FY?T&Y>e$wBnvf97>Qto^8 zB=SCeZcjjFxaIbfTR9HiQBt8#um6&u1-R0YiT{tB;avJ_J}tT9t$^S9ddSZlKgml=t!uP z+m|hhCDTWkx+ug6db}#k`Fs+-6vSd+_s;zdxByklMRFt2hqy@H=n+JFc-{kFrGD%A zDUv{5N*5xJGs-3u@UT(^!Zus$EXjT!<~*lSi;Wd*XWrrL z2@Pt*R$fT0y__PimLxX4O`M{vZ*+V=fj_z+!84I2L-<|u(L`bYz%sC&o8m}_^!uSs z)bp3CgAfHo0w^O0ko93N{XpsukY@gTU@ zULeCj2%KA~L^cW}JVJSH1#U%dC2nPI6>c?db#4uAO+;)L5#n@h5TEBihui-+5Jilv z^TI)(f1ZZELf6okp8CQt*fK3M0Wd&?fTg13Y_Tnp~ z3!;+3L`9wwR%^6#K7#%nhJ!EPAp6_^?z{s~_j>M+uNCOHq1jlGsJ*?9$jPDaNncW& zmL0ZltKx~IfQT?i>My1hPIcBzfZkV6u6sF;=b#P`!O|Ui1F%zO+t5tF#Sm)9a=}n4 z{c{C6kuKB_NqbD(=up=MsxP7xJnc*%dME$u9n4~XUfE9M+Lqfw_(9kG5;c(|%!g#f zhP0vQ;g)>om|e8$Kz5?M$!ip?9y`Zq+_$nAPB^Y}TVJ*ZG*e%OxCMIz1#xTF_j;T# zXL8l1!)$JC2fAR+h)v85xGj%g_H#A+33_XSb){G82v*!3!X0sIteS^!VD4(;EZqJ6 zC;471hW*hgqNN}A;DyN_o~^$a%DySgo3QPVt;$VMbuL(+z_O-Uml*n_rS?qy+Xv!x zu?DsL59DS_Q8|GVZady`3f?cGa-~#jCoFe_cAWc@2vm0qfD<0!ISK`pAAEJB2&Bo? z)UZ(9JClqDLa2F@EF4FCdC#DGgtHg|mJV0w=H$*n>BAdU%J2~Bry=i77B8nmi5Z@f zD?*BZjrV2aO`g(f3@uUyWIsm>ZgVyx7X>_)TNVzDO)P%+j0%n>0CRdu$Z}R~8&Ce8n(R}AA9Rm zbfq?0N-|&mMbeqEq5FfqhGleQEUFlZ_d(CM9p?g+Neehn_hD#hsFbdD8cpBU6!und zc>7QM82KfGSpi)RkL7S^w`aLI56Kad9Fm}K0M&Q#>IyLvC%Y5{w)V$e@uC9fqizHS zVa%O!#;HBXRrFH+A=_!CS?x&DCKhR23S-#q+WHvHR!Nv&0NB@9(_8Mjb@c9l=O5*c zR4F;BId^!@4;M@XM_i8twxxf5~$x5&ytSA7Zv7 zK3{1=-vD}lLTMHhgmT0!ht+2Us3Z-ZW!IKWxoMs0N-LObnLFbi)(mv5ol7v?lo08u zwzq0LKEi4J(7A!&tiX7G=falc+s9qrMkb}`6D0|c<1jp!ZmJ#6hrb4!h5sxi6SqFATv9f5F3hcTKV!6&5@;ESOUXzsm<+ld6agz-Yc8O@6k;Ju^1D- z9SXX_)tWtDO5zk56^{)dKvm9QaJK>1-CP1437CZ2Fa8YpLc{~hKZN&IP_8TJO;sdC z*Hl08+K#b;iIlsTn3PTlzt(qI%x5egUpA;(>0z6rc5=&BWwcA9cB-ENZhnOMQHkiB zDQxq!aw93C-Hq#stZI*t%tgxqEupfbM0`^Mr6KMW)L{HPEr4T7tsAKoerc z@W;q}!jHNJmCbNBJ{X})W%Q+<9ditboevv9Ukbepip9WbBcNr0;AWffNW~N8@TISd zeoymt&CJW_BScRC^6TNEZcX}ck={91WV`rKE`xPivkV*j^qMo~zoUcV2yeKk5h<}r z+Odl)+nu)wYjtOgcKGKumf8F@X|xkh;r^Df>)2VdsZZbAyl^2G$TppeI9UrV)nc*k z|Gf5QGLCad&7JH-G}9ryPJ2n&Z%Ua=Y5BgVkIcPsHY&K)@nmpL$)`;Ga!yGsJesj0 zndHn6+V-q}2#2xC!e}$OlHTG1V{yfLj7T;GyM%{%y5NwwCdAvD?RcKgZSxxZ4$lAj zR}fTAECtG@C$|}IK`O)kgV<`aAY90?Xnpo4LKlkH`*i?Rgid$Q$v~kTsidH!tlZDQ zyg%DqHfA$Vq}#eq=VI)+%EWohId@;%B4G1!sw_91l}C-J^9trrrBm&7_)(O?Cc4eJ7?or%Lpt5=(mCP3zKv7Whsxi5zw?Ff7nYs$E!>adM{cE@O%(CC7+=Hv-J}to{5wS5l1IV0^x5Mf&0JZM z(l6cJCHSLGaSv#}q-S(IiTw`8)RWN7Jib%naH2$=G{FQMe@s*L}8#cuCTCX*Z@>KpnHc!W~`A>WgCgEzl zv7m!9`m`^|Pch%O5~4mHkgm2W*xffX2UcZEEs-haU}a+|BZ8~HlbH(sephznLO|M6>Y+Qz zk1U9|w0CC8ev&G`IDFlhs+7(==`=OcH^e-PUpauH)8ug_02dyMPoF81USNO-Rt7b> ztXo~sz2E)5v{$J_;brLw*CsDXTfn4SHrJ8FU3v0;Bwmp+s@O3NZ}o~yAH#O*zAeEh zCm@{RHuyQ(5g9!!37e$jbxSDjI9lA9NDeS6%J=#0`@3+u3!-rVsjiXqO(8(N{2n;I zuqoNe2nYzvEj=66H7?SvO!q;2JmeuC3oByApUey^2={X7I&^;xr+wdBv^2t8?l6-5 zgG=9nzAQRGwcMc7^C+WRUQmagznQ2ZsMOh_edE#SC=^n2i@Q$($!IqQROM7 zcRV=VUeOhL+{K-5AI^hvjuqx3EX2!?Drl<77sBPP6zilQ%h5VNE}{g#qSbm#HxdHA zH~<6QKAJzB0UY$NUq!3O3E@n-1g^7>6R{@GxRaBw^4RF-?Biei+1>9hl^NcCy=8B= zkz)#~tQy>*b0vOdea439?NhOMC)rIIL+gz`MWx*#ztTn;4UgnXezsl2vdU?nD)D3c z0zU)ueIUXGiB6D2w6(?)Bkjh6C(8iCg^Wp~7J+A7tI}WFn()v zB_n<8jp7OsZkG?b3KKatq<<~l8HQ9i^(?78@Hmh;wLJs@G zUl{&4BBIZwxNVA34T6$bVjJK@~g6eiAG9`Qo92{hHn0l z@RBvAxsNKD6^)kZ)4>W3%yFuiW7GcX`${eLwXPG`v&-zVy8y3}C;VimU%}lema%%U z5`tIxIT7wTBPU2|g{CnC`Ss@BR_J(l+=kf}ops0nvrwmNZye9|33?BtLfPTw>|OD$ zHf{T>`&inggKF9yJT+qi=iTOEIcDi{v^bHPTU5om8VaWn!^iiXrH98el3O&mnLrf8 zJv;@elPP<5DO=r;8rJz5Nqz62vcJK%yX5NbLIOS%_2d?CJ$gHTs6A@Bc!SE2^1WdF zWntja!lv7b)WMAA*tGzkw$3bK@qV`E8IyyQ1+rySqNX+XJ?f@kv&hhpxFY)6h~a)= zDL1Fp%(3R>^wuM573JYKrXJCZ&Zt;gLhIh{GKiai1Halx>b|(CgdmHO*+dBFs!%e!;=U?# zHQeKM#(4Q&)bfehtqlY`P0hp3F@{OfZYz>e`flTyhkLqWgu&+Vl9PO8#l2!(7io;W zl{PQcAq_i!f74Nv-tw0ko?=-p)?G8_XKYpO~kzmw_MVK9qe z*B_|s&$iAkQg_WJITsrqZQ}KSmT=*dcJ+twA5AL+Bm^!Erb*~S%I?Q93tiLe7|nR# zM&H&1N_EQ*;9s|DCa7*14|gV;nK=&q1(NAXNm_!bSSXzg<+XFEt2Eke<9eIqe!k%K zL?iqpQ&t!s&l_QU(e_+0E!JAdn!xb!fS<3Ghmc(?SEGlS!+Z{jql<@DC+J|=prS_$ z?m$Bcjv3HmDRajt=K@^hj&)|>DW42B) zZd&Q-n#99#xwAs}u%0|Vxx>Dx_C9zf_d^YErr9C*Q{?CFv;b;%=2i>USp$hZ(n9!+IT-Cl7t)FK?+bL}D@%<1+)C z24%4IG&OZ}Ua|$Fc_mlCjRu+dRp8Za1}^uA+`v@?o^(-|8d^c-PbeO0^RnU!!Ml$w zKgo8CGdY@JcC#H!2{d*#+<~EztsJ;G=T6W%w~IcJyI(5{iKPCGFRQ~Pxi?<0{;H$N zB<3o<+27N0NpGESF3ME6uAe-*gE^q1Cr(C)xWJri4)uO{BBfA(ran*MC_tlm9G|r#?jK5vopKjP{s}9WVsu*goOzl0}bieCq8Q&~lo`xlnNv174}zXDn^XWJS}SZ z%1J)%#qF)`OTMDG3ybG4hj6olKsTgdfo$b&nqHI2kBhnibf-FR3en*UqSCAUVkz{y zb^Uuq^Td@*Z-{~66VIyygj}wU)-%RqKjy7w*H`U3)Nhq|EGx-;>y`ONEDf=XM~|((HVwwUY z2we;e5G(KkLqh9irGADEqu=9=Wbu2BK^DV6L7gZ?$jD?$74( z7*ZmwFlCD88)i9gyF4D(Q44tQEKefW=&Ok7^#>3Lb$)6#a~m@hRUtJVjJy2>9KgY$ zMtQk7JIs7%-y8n{PD+$bPz%zGO=}bquxcV(y55XSQ-~X~{rn-kx+uIVZUSU&+2Ab2uLWWW^J9DeI zv3w9Zk%NPAi~wD$rbLJO-^RaGjWWB!`#isp(e?I(xS zcu#XpoQ3wA;AN@q6_;5VY%*zfeZU_d=C@5YTQ3i|$O2Twv1M;QH~h-4cayk6k1(mr z3(Vnz#yeW)m6YUb>&-czFEe%B?XR+Z;$E#AN?~|)u^pEuuMY+(CZ3Y~dh0?`mjCLz zWb{&e$Hx&qD{ZB>_U0sVMhK#97oo3>-@+y{_U)|gx#6}fF#{@`MSU^dB*8>-sj5x0 zyUsREf~(_W2m;erLk+7_X&$UrW)t{NNKtCXW%2O~!;tc-SQ#;@#(HHrJ-7BghEuq2~-XIls9)6WUKJbm}XPX%(5VCVDdbh zr}2p-i345IN&{vBsx?=fyax{nC#?mnr9F4}pTZ}36EtZXJXn-yY^}(hki^>tV=hU+ zPd#$>pWL=G0y(b&%KA7cn4d)Adw?s%`&Jw&rrL2ktaXazN#g+#S=Lop{j&XDmxNTg z+gCJRc)X)w>sFI_OhI|^s|*=8_)BDCelU6g4lfsH2w@l<9MN`E1SRA4#?p&6s zA0C4U`y^{BE#&cpKFjU^e$>4&$k!@LXZzBI4j+No5yAE))NsCBmx-2BaZq#^_*iCB z7rpqxrGUR&ut~6qua&4$b3MF&BdW$n=^?ev&$#dW4pm}qd=Vm^zS14NnGPb4+PNd1 z4Qj8@GBZYIQWmS8!dMYbqf->U-NK5WKAwEBHNwSdJC ziis(d7$mi!?tj-Q#69%N!>u5nhBHEBcAU7}A)$?IoK z0umi$d7eZ*6bOh&Rx!sswRj%so_TB{Y-A1^NP0DB+mo5xg$i&^s!M7Z6f_t9?2Bm{ z3}C~eXE2jXW{)H5`^EK<>yw^*-oY6BwH3EOoKU3H$0(F~q+)cv_!f2nhzhL2X(UN> z4qb?5PvGLak>lKft4_0sMDu&JdIlK@?@#O#5$X-^R8E4^B1`&j6mOnFQqQVlSzvSL zBV7T=c4fu(CF7bUn>niJYfJUDEe9N0wX0IzCQ|yfK*I8`{CcJ%A^7R^i#tj13_EAj zkp!Qw52E@uYeyrm}FReR04u5h{xEf(}hIx@=YLL1jCQea7T%Kmrhc~ zWgLcOVz>S2UuAf#<=C5dqtqwSDS#YI0W0HaJL@*VK)+_r=p;@VpO2#UVVZgqej^)~ z-=7U%GMc(?oxHbjz!*%*XX$5yPZ>o;)-QOX+`TJ=1J3F` zdUEW*9?JMh{_)_!`T3t{Q?tE#NCt$<)fIA%q#}o8&s)(iiS|ZW@}A9^z(WDbSTlK3 zr0kZdZWwu4ns!xwQ2ZM4os8vkWiAt@NaUyU%bEsdZfn1ISNTn3`#ap(-1!D)x))%? z8(`N7)SqjT9W^2E5B%62b}Pt41-$Azi5Zber|;2b6C_Y+$mZM4NFz%Q)IRXWLw`Ib ze{$9!o68orRWTo(AQZMt0}sXLD2PEj{I=NWDzB$VWDw>Y{yCzCLPT;*rsh{JC^=oF zMJ#ujtFFykhk<;|aP9e>f0Qa*wD8sJAcwOL18$3!6wkyu#kl)wMDzelY>H6Wy{tON z6t?sCJoK0aE;M&*S~AydcnjH1DaWne{UExWZ0rwab3T>QTtL%x9{6ywa;BJ?jwl{2 zUTdmj^3tQ+k3zCkF7@5gwx@oy-Ttsf9?>V6|Rq6KP#*)H={B0HQ%(O>N6GC9VrOU z`Ar!e?j}nBf6iT59Qv!H_{Q@M{TfYko%cM--mxEPUott!M;#5ppB(Eon-45vrAVT| z2?jYzKEF3NkfbPYiTU zGged|EC&%732yvCaQ)g8=)`VGK9*^eiJ}3rh?}ope&aA}TpdHYy~LCXg>@|MS=BFbm_FGEq`J4jNFoYn@Owh1aG8G?kFH55tUbqSA3z^MDk4P!PFZSG5;5C)&>=kj5jFE?Y1_lHp zl_&Pfzc!-fKd9AM)W1U!SG%dO9i8PwZ*3fZI@XDf{kGH#F82*;hiTj^eCG6qz}t!5C?>XqCoU2}w$*tFY#KD01uCc#9Hv7`j*WaA zBGQb0Z(Gq8_BNFs_lo|oo@hlX2@s6Ynq;8ChjDFu#-;GDh*V&dqi6onTy}x7)9`&_ zcIa?vY$SBI(CDT0DOQ9Ftf+0>S>4=d<{{hF#%Ry^0y_LcJYigbYc;?PZvVL_Z8}aS z#Jxt$uoSGD=aEyi-6WispqwiTwRCbC$I`sLV!|KRt=Vm5u}k~drs5m%0m@of#jlla zWVNnL<|OosL2GSfBlAk*ql3&g-zJBdEDwSH3jeiN=fQY?^vyYFe|qcAhiBZUl(zU~ zrheo2`zm;Q1k2V^FL2si@Qa)4W-_>0P{{eQ4TGL|3-PvDXk>`M{5~S$)A32VHMd+Q zD_weB+s|Whqid3FQ>0+*xJ>>oQU7AMryYDIx>lU==b4KwGPzx;{;?z%MO+IZ)%cl`oOYr=YtlTa< zNmg`hDiqO;>>{O8pz$=UWIjTKeP<9%UgE@TQ&4IJ*o~S63D&EXMJ;g0;^qYlNbg3l;F;yUU`&cuRKt< ze1zWz%hp*-3AlV}*Cq@4R#&dKDgZMQyzltp^Fr5EAJW0Vbv{wG|CyCsh?UrozO%<5 z?Pu0zgdMZ;NuTvXM{@hAe7uCY`lk{({vh9x1%E^P>BWS;uZzS&GlWk=d+6Qy+#QJD zEf5?Cn5X^PvNC2a6KcNyQSNmwBvnX{e`*DHPgqLd+jOWB_8PP0ebpY8LpH6!_N&^< z+P)Lr(WE{9tw*xemYJ4iFZ(y#Pl>N`38}Eqn^k2VD3+YVW_*$raqb+wwN;iR0x>J1 z^Q+%4;`JF-(EA9Rztm<<<`CHTn&m`!KjA&_^zPHoGjcCYSDxhwT{g87>4l_&qjPBz zIK?GdiHR}C)k#->o^x}6)XA;J^;7LIz8QYRc-nj(v@s@3NnoXr&~WhuK%%*ANKE#v z)p@pswK;ZvUUT}DL}7B1Tel$pyK=q-Nvf-|3wwtjzwQZ8h}W_RzcaVV_<~Mkij}(kVF@4&!Vhi6{0N{7hF3}N*$hBAXrAt3Ng#*b*tqrcyWH^6$C1{| zKct?t5=l_?h^gC8`^<(}|9$BG5&m_8mt4Al6*z|_d)z?q@<&?Qexm2n-68Ui<8Ljx z=SJ&O`5!LCia{rLxgjmGzaH`Qdzw$wSU9t5O&K|>O8V4H6##A9x`V|6e4q`v^(t1a zEPFkMZRU*vLvP=?mRRc&G_ZMhJ84d>bZxwULuBwk_+=JPQIOTAljZ+8qq9~aqxryc z3Qw`+V%p=VU{N(7P&A=EMA6><$*D-M*i25{1O`$V(qrgvf-*IPU;clB((7`tkOcAY zq5t77_{SS?-4O*+3NaG2E&_l=jf@4+00Q~J5PmQ;u?qB%6Yd|+TOg!1#@EJt023G# zzzGC_c{zbVb7Rhj=zRbu#Dov<8o~#G@d9}32Ej-hNazqC5Da-}r-28F^1lyrJV?Cy zP#D&4q5mngP#zvI53M=v|6m|KKE8+RAioQ({r|NY>&HWDy#K#ML;8yq(;{}8G z5*?sOjBpSH`gbcJ7>xJ9C4WeOc|f2Cc8NbR5QOJ%Z9Guk-wY3b)&uhW=79SH;{oyf z$5QwM`d{W$H2n_nKMZ)tiG5_`!4=)h(w=rM<&u==Ahhq4@V*-9~ z>)&Gx27>=J-@qX7?;ZMg`R{mwA12)2dl?i2<>5=b7et~&f+kW5A<-J}O28z=r68hE zUYG<7`miR&B_H+^5Qq=N1CfA=L4^hXzcuuKQ{_0nHFkRI=457$1%&{hyjV<3lFCw8 F{|C}-AcOz_ delta 59958 zcmZU)Q+OcZ)@~cy?%1}?j-8I3bZk4R*ha@rI<{@QW81cqv-Upw|8Le+)ia;(;=7tP z-Z5wO`9q|?L)5~90x4SSPU{kARh?&ae|5`PTPdQMgF2o~O{1DqH0#w(I-3%jb&0t# zPy;}MqR8J|w^hDUK1VKd`gSB}-NwtD_t@!2p!X#@VAgv~LVIuk^>m^@4D1MSla=6Cc{Am3iXo%b37vN(vP(11(NXK#= z>DgIuLEi);0_~MUWy5&aE2y(ZXRcej@c%0Kra(wMiRkN&4 zG@YKZXk*7#_A#*cMmm8E-&eF+7Am;njtkv%w9I(MVuSBAKkX2d@Wo3nA<{f)#Uq=j zXrc~x!PAO_buTl0ZN7~k3{>SQYhaJNo@+Asp{7g&l#c;NLXX*C0R<#MnV#(NRMTI+ zueVlif_QBpK2KHa1M5!#-seGwc$;l@AoeaJIr8TA)iX6m$3#qvnO|RhB^5FlQ_|H) z^1=c$bKzHVQOnA1RFmFycy=SL#aobyp0UBXU@s~d(%|@i4KI{Z*LkIo!HC`#9&LPZ zz!C?5-Z`9_P^mo;_t5deCgSIyO;DA5Q?}2X%}y#elf|o{-9tm5rjs}UiAoFe73yo1 z6a*cke#oq97bIj~nOUCif%^Bfd+-BDBE?g*d?OjW$l$CwBckg@?oaQ8fEK&x*6KmD zT^h=rYUYFPTh#~zKW!?CFG5qazw#2qqFsLgMK`VE^Q9uZ!Yz7Y)H}=ocyhHw^ImFR zl73;Y{30g}bZ!`!$^pWU35^`zObk<31T&aB&7bSGiJLL~SlkOvfx|6WuD+6C49Ywg z?})$WdM%B#+^YQ_ko5Q#@NUe4O3K5HA7oS$>6ti{Gp&&qQ9{@e%@-P&h8fOe2q11+Bo{&=yLxdv+ZyWjc zg4$wFcee&XVpiB-$uX|0G6B)Ii84XQ?7+s6h{pTfizDLf*r+rlr=kb31DZM(;z=pv zN`s^p)KnQWc0jwPdwh!ayTV^Tu@nUnzyc2oK(y=%RvKOCCy+(OynS=KbFZJqWM;@* zi-mgIXNJZpRFK?3e#>u2h4F_ljaL@deS?7&l^pP87`_eLn|z!*m&eE~_P0c z?p+)b-NqkCH&Gfbq$raOX%0{Bh$+K|Qoh+lf~c-gxBaO`&cc&DEqCR0)WL-fpfuEJ zVJ$HDo}QLe%-B!YY$?{rYqB?1QcUR#FikwTfx)zHlj%>G^3ICJ-d4!#>{*V!{sN6H)2A*VBs?h|H7;OR+7Y@EiAbS zy}3|M5%XQQXN~-otjqd~7%`80sU9tGYmAP#-B$IdCdGVFW$ns29CC`-Qb5RfvA=Q@ zhkM`VVXQS6k;OOc5>lgzC*V%;BB^gFpE8V8koS}e{|CsU-qqiB%ySyCQ@C*iT#}lbp#V_bp@t(>?ElB0CEW4>sPwc{ihbF|@`wRZCDr($20olLB8Dy375C--# zf{sl~aqFmtaCE^2))w4|B6E)2b?%y*Gc!-PlsY{@!LmO<;hXa?5;~lJASb;C=<*h= zLg7pzVluOqAsel-;Fl*xvBP0qL)$5Zx~Sp*G+w8!Agw+;QJOS^-GIlivcRKT)H~%x z4c3O-$osN?h#sbQ2KY^JcWiXR(e|W9rhd5Ni?{NI{Y}lCu9?G{wKiJ+%{2y#^zPxw z(v^jte$9ygZ*QHuOHj!7Qv`b-X@K!exdr_8W4WRQyJ1G7q+xaO{d|7);r{(Jtm5<$ zWwevdIxlQ-wdU5U-gDQ`Zl@V{*-14f`V3?65i74w4|}$g8rW=tOrdaW?eB*2SIOfA zbvQ^zGr;`7!IVv0UTm&Dppy>$)=^%2zXZ=PMoiQ9p+_bsT9aPy?`FvRG%_|=Cpuf*tSsOLvrGKT$Id;Ij*F7`H)x7@ zc0w3A?j|^S2r#qOyl0YNLbcDj%p5JRoU|W$nDN0x__#1j+|B@0h$1uYm1asrKr*590MJoGz~<8nCu632v^!gI#SlE{1H~LWQLFqR_iDi zoSu4#HD&)^R2soJ6U)h^eDb{WxsxNsxX-9$iDK8EfvJnfjQWvy2eMf=3YvQ9CDX$~ z*q)ss^>$Q9^&8b?r05zQg3R*z`k=^vV`4;Ji*xZ%2oaI6g0QxB8;f|gy2jsXN!J8& zZG+NL|A;`=zSs6~4M$btRSR?rTa0Q!ev~*Q zNAwK_ioseRd&jMJ%YNFiuZfjp?F&%uY>DHV0?)tsehku{tei_8Yw;C!M6f2|DJM$H zCY_mXb5pB#a^+m&DxQFM)@Ij_cXLgXoF;=GidVR*BG#YzZ<>KP;n;8E)iQ6VqVN(G zeX?SkF3H6T_>e&MjzIyvAZTKKqD*de9|x25+kTi$)>lSCm3ZgDSMbg<80N z1FVKW6ObQW;G@+dV)oILsHI&}4=KXwNx}7(R=6gNQY<7mx@?#eNctI}>GhahIvD2R z$J-a{gAw5WjIgI9amlE@Iw>s&@A}K2!3+dzMV9!t;l3aan=%G9!nl@S-ibw!%p-@l zPO@=asc`kWh^%&u!b{=s;;uS{?$0n*0@)Wz^OEdagDix3N9THaQdz`4gg6%OIDdacAzMxY!>#leSXUY?fe+<3hC_3cP+0XA+A0C;mB?!X! z9BBQ~aA0VEQo4s68Q)?CGnJ+f1?#}6J`$V^cJR5NV3Y+gqKbpED7o4y_CbCk0Vi@X z=J`u4_xV@tD)4`Vee2wG%pItEoLq{36vfuqd}GJn=gCIXmf6lRul7dc6^^)qnRZmR z=)hEE&_`P#w>We@O&XS^3<*$y#kl+yx^?kbiTdj`z93^lfmJ~H<7CjqSJ(unR5lM` zgzw}BLwv_jsAX`AH6Hv1w08`{5s+fVa`4lWInsH@KRvkAKS$}DV@Ra?uri+`E z*|pb#*M^P6M3M8~2-$=(Y*X#{ZyHclEhs@fjm2gkSEqXXAJ@C7dG z5ze^BnMp@kNnH<3x?arQ<{I-{$0bCgAD^d(GY!L`hB%j3bO@EdG{&W`*MVfk*PU|^ z=DU5~Wq-1Y_V{GBcH{6us&ntFa3rxZ*dgcwqGe0fPFz4a@cmVf;rlv#>yZW}vf^>o zgW>(C{nQK<^Vvjwae|!b`|b^Izoc}q;8}ZP8$1LLrAZ*(Hw+UQ`_-weC$Ndm^t;0H z$jj?dnIi(}a`;fb_V_sU8VLVrwen65%h`HKbuZ+pf~^4e*-~j4woGAi*2Y3_v8+99 z=Y7r36d&glav%T?OQfn`8nebK-m~wqfLfTfm z>$rhu3bx%?=pG+6z~seUf@dgy<-Oy*Ro_C!u5#(lE0&NyQ2Wd284xI}%4wCaxGkx+ zgffo2VeaFH@^v2dDlWSvtfQoKt{Xv&ZZTF~;FjFkW!V+JxuNcTTH;FEu;LYZqxyIi z>UcBuHnlTxc5yN_vW5H4o4v6W949d|@&9?Uv9h!OPmP7={}uW9ndD6E%v~&qS(%BM zll&#g0r{l$Vbrecnl!O;gugH_LG~-RMz%G3@Spez-|%5gfdIeu9=~ZKQEQgUepJwhHKubudrzzLK?|HnT=kx31tOomOo5|11 zmZHY|;%TALm`mrw?Wiq(|5b2Ft8%(BRV#fn>J9#N5O$SR=pKFK*mA9FwzEi*QDEnV z*|E*bza?=rsl)7$WW7G_N`8C2dVdaW#_r!V#yWf**tF4m!p6y2=QedO?EFun+dx8o zpkuf5ePLe#zm2e=jmp5I#qPqjuAHB5+vKpTb~}8&Hz(ko|4q8;Ew^)<(MhEtn@&FQ zJYL!+rAdoS`{^%R&;$p%phL(x^>q}wHS~LbBr~gDWx1b_GhEwhwi?_Yg0&dxbyOAf_|zMIoynGa+fz*A8g+a`pB0aX{vi;$@H7uh`K)>uv zubBb24<+?f1U#$+6gbQCn(sZ&nWnmmss%M#{v5~`_Gy|paY^9ctXr|uYQm!x%d<)m_m|L|y1f&=8PdHC!iedb>$xmUp9ND*5%^V9PH#NZREP^QcQ zKZC_fkk+*WVu>sSGFvw-J1($Td&vz>sl~xre-CS)oWM7gOOy&sQ}FX-^p6$s4d_+R zwwwcnv!d!;!34g>PY?H<1$em(0yeLSl3bI2q;9^19PcD;U^Sc9O%K8s!L@7iCIrxt z)kKkJvo?yn-ohOt1)FlfKZ=;qrZ<#x_aU!E)g;{#=QFR2l!~p}jAoy05!MrNlbsRS z7r&mt>>>pn!~Ff|j>xx$P?XLL*@KIpnX71|&8bk_xzc9K(p^%E7)}gH>~$EGpzx^- zHd8I66_8SWNWYNd;i@z=>jVQ&j*`6%WARaq7BfsK&|US)J|43He=LdqkOLI?-Fvlb z_qG-!7+d|QZDdH!q=@=or1{i3%0i8J>{^`0N^3ab!DT#U!=I`yiTo2a5GlCLu!cdD5WiUf z^H5;j+|}DSbz8nZ6?_fqR*{T_IQ5P&@?U>dR$I3t5>3)zOkC4r+FT7ONIORQQ_*iNAvq~D;`z5D~KObZXMyKhwe6wwb zaWAJ<11cgQ)9&Ri9{yAoiI^{?P}_T_W%N*(u6>8&LSZs~i(pOKm>Wj54dN}^V;(`gmT0g;r-?NzKw z@nCK-2w~<3$W($S%`((qEC{fBn+5c8CxB(_-b}{ML^IY*uV;L42L89PumHnIFx8A8FVer;%VlOleDg zeai5H;l8*!(ARi9wDEBScQ;N@;us4#2A{rOh`vSqOEcI>@tWIqd=>*yn@SBNn>uos zAAepE_rv|qJ~tboxI)_S64L{bwC-7wKE*vi{WsP=?^F=;3?li;DpP>UP3;QfU*mHk zXZ%|GB+5DAp%G8AS?-^@3h!DjaQVN==x4Vm*;)IU44`Aq9p{HOIy{S z7!}g%xrG3G$P}tKA*&_^SlMd}xRMb7GtiYrV_S?ut+c3VWw}5^qEwBsr|?tly92ir z;#BDsDiI3zdAq($OES4gKN zuaSaty+uL6c%<5bs1l$u!+l!huk)myL*Pl4)u&?k~$kE4Up}fAb#^=^(a6 zEwNlVW5ZWlx-9zXnU6@1NrM4l9c#)&%1}GvEs6wJ84Du47Df!3uz%VeBUSxXFyQ7r ziKr4$63efVIE35Y9KdEL=E@f|-rjz?FY#u2&b}J$&8Lm2(z7Q89KU|H{SHxB#Zve5 zE44n$NwuI$)0{|60#-++jnBx0e@)<9Fx~aW(b{pv7_P5=;ycC=DHyWhh#G@3fY3 z(JvdDzZ*Og(;|g$GGS*1=R^}A1ufuLEc8~7BeCLIcAvhYz95NnkZlW{Hm&x`r-O)Nka~HA7k#&`@#} zDR@dNaIU=MdKR2r9(0jedNNBOdoLlsVw}4sgA@HvE;$}C!AZz`7G`B2-3+lviglI@ zARpDeTPsl@M3e$Dw$w!nf+!F{wIn4UgQJQKzO^7EZ4*3?vPS*~j)y?S_)ux5#9 zE0vKq-SO%Zn5{pN-Gyf-yJ;|6R!dcjVt>HB7;%+hvXYveTq9ecD8qGFOIi4$uutvp zq&j|zjNQEd*}CqY#dfRyaqZ}=$5jWb#&=-((r9GSB4!V;-m{YZ+jn5U9P;t9J0O(j zw}Mhv8KbAh#DqyT?1;4ahj^a6XxpjC4F<~aGXR$$YSkSd$SMTn>! zcMGnEm!6r_=X-sEwt7D@Pnc4#%CneKUEP(0#9G9%nfGkG&sZI{lcZ7jc^K>Wkt$hq zU*~dBqc*>bc{j9(oXW+Dupu3@xG4DUAq3XPtDoBnp1QAkHm| z+tdK1i~NYtyc{8UY(*JlIU{1z5v71A70sOU-b;xBTd@pB5ahtDZhOH7bT4bl`x7_y zb2s{+HqQKBcAmyEjWD@4b$tXu>2qD%bW;vP)ZJ<$SgQn$+wUv00l|YL76jbC-DfRo zT*jd)ia`;*5*`@mo^_8(!ex;N$t%!~v4((4%c_dAYbu{1lxu3sOG8GQ!a!+YiEO`w zjWVt2y?!ZcB*N5=ZrO|;Q>{YB*=+5z4#_5Clx=>^%6b77gJo#Ih4bT4JsNT>T{Mrq zbDc&~b#xO)Fec_DFX z&xy^gg+!TA>B~L0xvv&6fH>BWhz{ABN#1fAZM#jDW9o(wHrrKc1-CdE)5ew=mRuC^ zs7rq?rkC6Z}@b{l|vhO)G?fPj=qkbNGY(a9sVuLG= zgX@+bD{?6m^S0)v?i?1na&Nr7B`8)bp-v0YqlC!<5%-q_Ylcw8=s4gQWQjPRGvY zKtrjV@e~bq8);rJ%?Bo5DBp+M_$6q^1zT6s;VvDFPR2{=XcH`CkICTC1oi3Mr?%O~ z{*R884l0*YAGvxL+`$orqC@anb}%>9#}}tIy)6EjN3U8 z@WWwh`B0+%FGf=}=z^Pz?t0SN?JopQvL`(nosF+r<3&x$-v3|k##Xe}QBM8DK97i&B z^C%?=ri4tX&9t5j{#PbKtnUQ%?g#Pqs*DNVr42eV#C@YhMw1r{;j!cnK!$vELFC^; z2b!e18#dKB2{AorwUN!{hhg9$>A~7HKQUHupL#uuQ2o*}k0j<)+D!C_*w@`m5wPOd zIGBbcW;*b53#)(&U)!eW2ahDfUx&jBeZlVaLQ0$9aa=|sC82dyxo+;WIAP%Si}Cx| zqVu`LA0u_>^j80Fz&B|T$QsjOx8?MtS@_-pY#1capoT ziNgCr4`#D!%2cB22QVR!s!p*w^W*E8*$7WuqYMe(-8l340W!Un?33e;xy|=R)V5w3 zUJ?Wxw7;B;8Mlhed=rZF?_kOAy(4wAYjA)`~~CLZN_NHVG?t;+i&t7k@d zr6=@KiX6-`lU8gFHk4lSnz&}+06m?$8B9zDolR5MTaz>PlSD^CJ#78%zv}tbnpWgB zdK7FX3Y+(PSt?A7b#Jq_Bkt05^9i+v(5Z@$q6&^e&frq%bq#A-8q>5Lz;RofJCl#0 za}t>JV%Ft_!>K0i3WibUpG0xN5aw?W1(uID1sFl1MPnRd;T!OVGpaZXfdKo}L6c^m z-TA+)T$U;;W?8WM8P9vceE4S}0qu>ZagaAkL?1mWVo7Ffxe^E-YEgSDeMSqW>J7c6 zAtix}6x)SU)2(FO*010S zlEl`rxUX{TE)$m~{5#3^Gu=+X(vRzN`Rx7cv0MIg$<-I+q{PUk6|jSU81-HS*?RtX z3YT#qtS9zsqKoEdRD9PaKS*0zM>QoZirl75zMCFxRxL6pNAE-g4V}dbRcFOIJbX}cYC)TOPPmO zz7)cox23kUF;C>f;uU+dm655VgYp8kTRaee83KJ&-b&E!03>bI+)-hsZyK4Jjpfks z5%Dq)<4P3SkIx@82!ZiIWs_59%y5_RY|phuAa2^Z>H8c<3Nn z%qG{NXJ600_4A6?$H))z`PD*oZ0uvM)MIS>qY1|qv3V3veL95Uv(%x9io^GzSEn`) zU+3b4mXV-24X@6Bs>d`(;H`?E+U5AxqVY zcVMNRRSqDE|CaBPgz>85pMB>4sVU<5Qd_*Cg`$PaM;Co!Balzclw94Y{N`v#!&9NV z_0KwH%pe$0y;NY@voAMu)P}zAMuZ zT?t78AoF-iy}}4mJI>M;vFMb%+EnJt>xvNV&}COQAGCO=f+^vw!IY-_BYlT zc9_6;V<_bexQ(YIe&yeK%5sNN@SjegiuA*bx9@%LKI7H^Iylr7TNQZ_t^8fC)J@`R zAzp%u#c$Rvo)D)I9XXv{rfrhdmZ%+K( z$Qq4DKG8$nc8S%DB*%Fo#BFJTyqc4bF@>;-v%QELG;vTIPXZKt@!HL1yvh8z)LM_l zTvi={p)w%-6ExL7V{JDG-28QiznnM!G%8z7Fk1#a;Bmr9ZlW;C7?m3brzc^fu#YPM zt7a%jb-_<1ZCJQXzyAVogi3UUl!h2!O4deq+vJIJy6o7habLYBKV>xP zyI@I;vOsz*|CqTR;r{VLdog&9_Z-Fjx~baNh?sMPW~nW79^{;Fe-h)Uw+>Q;>r$AZ zJgJ9@9q$q;Y-!PT_()ul(`y?_7|o%)qDEuE4VFTe8q}x=r+hdSe7cXvOxOoRuQszc zofyGy%>MKHOjGCZr25qv*uY9^@bClY@4H&(uPI?7W%~9jzO%+zYkOliW;^$c6!&?y z$|;(jiKudg-=tmo1i`qKD59}Ee;!r(f2N0L1r!)h#h*c*lKnzBf~!!2JH^dPYml3k zO)iClI;66p3YJh%aTvmQBQH|}^7Q3lj(mx{5mdzMO6+rG{pjY$KszzC&<@M_HPRxR7Jh>Q(^>E3T99q%MqQbde@+6S0R1(et) z3lDkuh-s`ObRL0NrHR&I0X8L2(!tFEZ-#L-v1QFeesNlAqKL_e!8nGdj1Zkya72Ui zF!nKb5S<`AQt4EyUI*efUChpaQ#dF9U(x zsYFzd?Sg5d04~-nPg*bD%K6qj$GS|8=Sf0}8pwgiUu_+_lRX{$fS7vCObwvPiPN87 z(=kI|tC$Y4sois1_fBK#PfOGig2YwNldR$(K`HU#+xy1GNous>BKit?JrWk3Ix{kl zx`OSp_|Zcqz1-pt&|$4(?{{4wKTo+^>u)8Q`bzyPc$;{)kGb{?F})Vu*bef?+i8*% zd7@I{*Ts}39iRIQ;(0Xd_Ne$Pn%X=N<@R)T_lDUPUm@5;WdY9 zizYlCp&p&~>mz&nGQiuFPydrMQdG`pofa>IB$l73Dwgbcuj+l^q6Ast&M5j%iNsCz zh71_8cXy3D-*Tl%T&Ev}1~t;0mB1bPMH0I$7yGi)SQ0!$G&!N=Z;LU0Hy^@ z1Ox`Oa@6=RDYhQ+O@GRKN8{r>B7dMIF6naILPTcNmVvAHXtrW^aW42VN8dXw$z{M4l}j{y>Ykdn_S#suqgKvgc1cUQ-K z*uUxA_dan@1z>)ZjpwrgKgR~!&ob`yQZyWW`(AEG$Ne#98aol?Vt&-==+fr($gW#+ z%HDqZ^5F_a4y-`B9ko+phE|LQ>6bB>#&PB^eL*CYSCXeLq?!<^&~N^p_)u!*WrFmL zg9=5HSQsPcH2!5V7oZ`Y@{q?t{YD6T~^ zcjx4APi1#Y|B2Ym8w5>#HfVG8HK;TU zIRPK;J)G&9eJ!q^;-M+WGGu8;(ynIu5W+af4Mcj`;w-Vj6kJ2&hQ-lf)DGS?gQ1un zs=r&R=PLP9Q&~*OJoL`xgKB>04)x=VC@rnsnm6I>X>K(U7NeZ9!y>dy_}~u{D!@2$ zikhlXM2~AD%J&mLAM;8FsE8OVg)+z_-A!YG;yW7uTVu{d&LJuhmWg7TnI8tG=F0L4(E;u6M~s>RXPz;{cp z$3p{wfo3QJe=Vrzib^ziW$DtwKL7cW$j#<(O!?`ES#pIhsw|aft5~T0&SPhNr)Cm~ zZTH7_WoUGa{!DZ!4$<<^NoZ=%+6K9cxVXLpV$zu3$V#7W?PMB)k@+kgnk zIm(qvZ$6MPm54og5loP6re-p{ISW`=usjXKg0_PtheBC$pWw&;VL8nZ8AdffuS)5J zB?pC4`Ez<>Evhf_R47dIeRlmk4V;BMoEGI<6()8Z4iSbzhnI{7fPq0&2Va*j=*2=! zTWS#CK1lYdHKt60aygwuC=K#7mY^HQgbHJV{MK!fgJ-WEaaX@KF0sk})y426hj*L!J0~0rJiS-tFFP`MNvQ z?ffC3B4!iNbW`OCF~OS3(3ot@bc*}W(LRj*%D@bZkM2kOZ=_vcYRy;nL1|(QX(s(` zD1)If!Vz3bS51A|qBalHAo#pzofAORWF$dk?jSC0jI_gG07IcL9-5ZTP#9N+BXFvy>!0XSO z5AweOvYGAcK%((n+_z;-h>>~3tOttn@3R39QmURTfj??wcN{8O_DH={G*W1yG}e{1 zGW{v632)|+wBDgAOaL{JnlY$Llmd;a)qz+i^}+-S*=AqfC;8^!#<(<684kLlHD;-X zY~R0WN0>O!j0`6}H73k3S`n1}zkw_&Ld-?r^(G*6-lbM^u?9;Jq9Vhh)*z=;F^9%a zW`2$#>eozmewxiPNeKFaOZUpT+5vm(d(vV$j>HWkwjmhw21g?E%aJ6_-KTct#K;kaUZje5El=uxaw1&?EK1cneH>a>#yy_7gxIofP zYL2+J^JSZGf&aL*qdma4g`exR|MX{dOMD(4T%EnXVoAX`?Z(1yo|JKSnytvwZJDR| z@8P9f_)j$X{$8Ft(p)>iyNmgGZL!UEev zE#ZC{v?6w4(5%ZHTYI0$Uaq73<~bnUI@zu)DCmO@P%xl@@?>_rjp8iq*Ai%cSz9z# zw0<&yVBiS%Mtm^+F2S*Vi05*XJ_$o%KPCW5kr446b)GGDYP-p?-(nAP3S3js-YGWnx?{T>3%Wl&R}OkKlpVJ#)%}#K0|qf zyxcJ7!v(N>y*{V&0PeQ>UFlQXczy3|?CTmFGt);silv9fR_hLago@GDe;WAoyWYPxzg5&!G z^G`)VnG;(9;G_M*BAJoU*e$`0k~DqY=E^2$w19z!rkYvT*d%+I6(W#JxgB7D`#YDb z3)|q+O8Uh#ahckTqrxNRENqIlLTT8V($5OTWd#OTXGsdYUHnoDLziBNp}(41np+sDT_oW5W89|HwZN)00P_)3ah_f7cT z_5jg`H9q(gf5O?5=7wPNB9B^On*G_MvTpMuL+i@D1B2o&S{bJ&AyLQ?#5S1iJHN$g z#BU-K9VN7#*%rP6dWnFQm1YLnU0n*Ans%tG7_TLmDBkLa4D#r@ zKjGcK1VF{eJ}OQx4lgs^@44*lLxsJ@nSf}zlVP|;>sWR13@mdD3w-Xu6^d7awdA4D zRM&nw)r0V3<+kkw*pCMK$o9A0i-8X+)Ub-Z+IED)N<@e+?_$iC5U2sQF0d`hMbJx9 zqdc@Vmse^i<%B#nE_gma;zbc2(QCxm>l-B$e)x4iNlYan-g-;en(|2TbzeP?JitBY zl5VytOPNi(;UhMa=+$qKWUsM?Go$)~hJ9fue?Nf`v9AY-A&ng&zsN3iu`o?aaUTo) zb)TKu>eQGvp-YGl+To;wgdZ<_HiIKhHdNs))C12%xax^A3;ja;N`)DpUOlt+dZ z1M@Yt!**<6nVs1d#x00Z-``-d64+9=;%*b0rh`hyfU3{3eGWgpANysTU1XDfXT+EX zA|li?e2Cg^Tybk@qEI7bu**+pDZ0wC=77WKsyVQB$S+y>RFtg%3 z6@ZwA*&rbgT6O&@;tdCuXT0d&NKQA1eo~Ld5M>5pkp_mXvtW<-RR{F)06LUC4JRar zd^wat?3-cY=1pi-#VA=WNJb6Z)TM|z!g(w&jh|xWZ(9y`4T(Xdw{Uk9FBueSkfg4H z^mvtO>IMs)IIF=Wz8x5(6dgs0t09oksx7HAAnytdIbCCF=?h!R`H8?9r9ageD2zZAG(11e;@}M-$%+H>@o6&FQ5#w-&83JwCws zY{+rHp3#rH6iLS2L#MSwqil~&n3#6A?M3UP2sSn3&?T1Feol*)1Fn|8zDB)p z?dGrw*asm|09@(qGBDBsB~raK#2KSJ4V~^fl=w3YNgQ_rJWfLE#O`8N*)qJqmWP|_ zEy{(#qx*6OR%)|8bpUB`w40zE%w2;Twmpz^(Ymhi;-^7%RK47vQ^Lz}(GSWu1@^3V zs)s1KB&XGVjrd?Ce>8z^QO~)SmiP>-fx?3*Ly#a9v&z__9^e*>d>hjpm#}cgqD_*; zKm>c;_@?ZZ?1O#GY`qaHnU)rba>$f1l&z4FbKv8Iq>Zf4{!@-fxuviI+9eWw(iGep?9IP znb#yC9JX;$SmH2-d`i4|k>C=w9wB$%dOnRxq^xMe0$yx|y_BzTn4$2f@rn;2#B?@K z0GpxcJ?ACEhm^VM))XmpitAHw!b&2JB;%eZmVH8l6l>l<6j+K6o8L1Gr6&<9cDnG& zECtQZ2;eWczF(htks_4E6r$RPF$*qyY~@zk6*GJXJra<&Z|`L4K za(u;)=z~PhMrM2g;(XC5{A5dC9bhhAd4N>rmzU?~l~s9YL~Rdn4FzxsVQlh&-7%&>zq#9 zl-tfo;b0>ozAx>ukE^QlULps(^yJ_qzocgu!?s@e8UOJIgbQX?erL7UUr8Q?{}%JW zyKR%mr1*2CfiH*fA!TUk6d!h8(z&Qx&?D||X~~VKPm9dZD7z5|H_Dh1{!EM^PrEiB zP|a@`(>-8u+ZKd)C?pwtym;N_m}*1+$T&xOt&Bf-z51Q~@;wqW>w`q@0ImNG zeQS#XwRPPf>G6*J&h!b7_UQ5c*w-pg^eo_EaWH4XUskJF>s-#cZAFQbnE>e(hk#^zpTT|o)p3*0;H(QYGg6v2yEWb)w5-hrSrp(SC_k5 zHLEe(JvT)Fpn_egp`;Gp_nvUMi?>)V<3bddt! zLN!zZ(GR1K@&%MyrfJjs;{%mg$;p+9e+zo_`g^(U%*-T|nEkSMA}q6}uGT~OwByrj z2hO(g)5yltb}JSF<~>liPml5>QJ`rZ(}bg?cpw^o!5hJ&h+(8vf=HtvS=3-L{c!}{ zve4eLV1%9^JOqO+Jg@7$gM|ysE0JutExF%^RWgWW>XGKvs=- ziyI#Gkj|i0G75~}9MdAzRgZ(9RgY8eFMt<+Mj~)Zmx7kC9JrI@H$^3%ukr$}r0QCR zy-6~Pofn(QsQ5>G1OIYSQqEwCA1d=^2F@>gMO)m|>reKT^O%t5{vD+qq3{C3e5cj+ zR8JtbqfRDP)=3z2s$ps7(q}Q_*7=^Lc5#{A(?ifKGdLeRIvdeU_mnNj{Z!@66;QkQ zdiaC;bPh!MMMVg@Rl?avtIs_2CHrXT`L@m5LKv89P9P8hn&Z_o+7gxYETL9++oZr?Kg^&T-iBl zUvM0Ck?&TWQ+MVulW{7?f6ubn|3@`)GK2CY8A*yH)gnLwQi)yX8mce<4xm5_;kGx| zp~vLyy-RGZDTaT}ND-i;XeG{4f^vdn{HbxyyfHZa=4Pr;g3KfL?D)-uC%8fxP+mEi z%4A@6%Z2rl1^H0&?cK!(yRtcEPo?WS{?@a^=hn>Y>6!2kx?&yuli9q?(30>?Yg)Y{ ziTT!v#!37J(qN~gV&%-nwkJTdrU&SK*;nSm}F1Sb&ve`K9wcP3D`Ws_8F zr-Di~^1J^g6S z!cs8Y0jRS7(sKIXX{8oKu4O`^2-H$dhyD?J18(p9@4uA$KAE6EfB15)o7d*Y_Rna* z-O{tLGievXoxW3c+)rz{zt-Nlf2jIwoEl!A;Zi z;jeR%_dQg5gHN^P0iPx4E_Gt{^~I=-+IEA@E+e}Fp1Yk&s)uH-xV`@{gV1&kb3ccjDwn$|69vf478-=?Y!XUo6XPb0j~Z(q=`ZS-apabG|#B z94LB(Z=Zi{C2R!Yjts8~-I5`dt?)DYj|R%%ib0qoFZ%62B*ioA%Bg(%#S;TN7|o9N zd_~-+n}0xK%f|CAFenCB=Evq6HG0;-j)sa%x7WimKBCWBUUV5YlrZ8X3Y>i-c^amv| zyfRRKJP4_lcY0xnu3wv6fZJW1{q(E* zFPCMRER-Wd#s~{Wqnf-}I#7lncBUkaZ&OlNdynkjbczCQ$drGM*;lv_cPq`HWHN%n z_hnpyO6ab_GH)y>Eq0CtvaTdvlgl!Ndo^mk7I$mUtEl8^KH4yj`(@p@JY&!@2-Qsa z!+e=^2#G4YjfDq|<`+2900O+oW48n{K;Zj3gC=&JYwK^o8LW3Lg5ra5avk#;1(h7D zUP@uXSjnU$1Nwh}Dtr--#H?cr*ys3o*hcEeJK#|l2-`1rZt_>nByV+%9%S_81#d`8 zQP{sl`hp~ciqSnrJ1O5F$>9`0Ppqfj!fWAsi6cF z^m||WrI8NxD6J%tRAnu$114m)X&tL*nM4`+8KrQb()KcS!gf%sfvHsR`X+JHrZHOx9-u)1pL}j!z2*$q8J!E)betn&Utjrgy4#?O#(G#Y_;#C)Xl-0A^9e;{9XV9vyBKy*8#a0Q5_5`17YtBzBgyQutF341^@xsVP~7LUeuouW-u@u`v5<1UO3=uuTRm zJ5yrtM2M;I{>d6VyVbu0?$cNtrJWJ7M!OmSkD_@sp_{P9gz2a*ucKqip>ei(yB(B( z2FLK-Xi>5y7m;vCz)))~>|`n?Rivyh4IYIJ`in1@0#u2T?No$MWpJs>!cR~v@64?J z9(H(|EojAYfe#lH#m`Jv8SE76_M`*D5#2O9A2uPYsVwU0Cc>dzc+T}U$Rc{3BS!^> zScnxma8r7pHek%2GrA@2Vu+(YdJ}5y zG$?C%0PNk*ZkU`A+^wjNKi~hJ#feDfsVhY2&f}Y(ktUcMGf3aNtUiJTc3&A|B@myY zKOUskNfNVhJAwNk8=-5z>ud<}t{vrUU_D9L3C@irhTzGvhndZxXTdPwL~FXgT3~j0 zWEGkx51HQHQH|fzO}!%An)|$^(*h7@&E3+A0Q&h!mQw{~y=Za353X5{(pRG9sX+l@ z8l169ah9^n)Mrv6@w9xI8>nIzp-WD6C;d;0#3mW#s9# zr}@8Evu-y?fP^pQN4{8(JqV)F0I8)}hvUX$`*>5yvuUCI%Oxe4y4m1JY%Z8YCxjqw z01M2aM)*`Eu45elGcLprneMCfuqE8INP&pHf`sKg?Y!qrq1oD4u3n`lT5duE!V7t4 zb!44%2C*q`^VrU{?}I4IOm(N=96I(%JO|(O)xA<7Cg0RkgRl-KRGkm^;3%;W=N2Rd z)%YT^2OG7Lk8PSbvbSY5lKYpw6d%q8aO5VEDN?+c>Wu>tYbt0|_ERirZ6N+TaH6~> zEXjjNm=Vu%+&(#H`KiO{H$;C^U54Ujs#yaQAFyqibaF8U=IsB`w%ADqIZFrI4-T_6 zM^^OSO&%?SKTVJWF(f}dLK=$l4jG^SOuVbk(s=WGy4Y3B$@dPmXhDV=#~>02P-2v> zTBox$N%=i#q-;?oU^u&Y(VQ9)_+Tw&h~S?A{r9a*EYz-+b8$vFOTJ47FFjc8O2mKk zuqwICFLhTa3lsJCMeq))D7s*V;%Y@{nOvb|Q8~#JmSrP^_$6xmS6K3Nq^VPhXpT=) z5TPVNVXQ;%#RJUU-xJa9v`4UZKzpmLYgtk+37ZnhU7FPxEtZ0y#;N?s)ZWdpEpy^y(ghvJ?U z@QO1&x`K}`=gAlh@%4pw7Omu`46%*~6?bOv6-&FW@bdq7LiROXxTLlw%GI!4%6DNL z|7GG737&HaskF1;iS)x&1Q2*!ZCGUU3L6lbc3eqxpHa-Kp3J9_eC6?!9>rV0$LE>x zPOziZGZn@G!^1-HC(1>}Ikf0`f>tGUXE5WEck<7C#r<_0wA5|j!i;0$u6oo*kW3G# z%Z|nhiCBQTwt!g_lw53{Nv9K+Uk@2C>8t7Hyv37z81*u0trS}X0|cs{Bj`53hDeEr z{qFCfA}Inf7}Jp(>=H?$AaH^F6a9n7gulaZH`@F)WBL^XK}Lp|NB+@RovP&x<{c&h z+Jd1wl_u9@XjAx!@+?|M*jp*16KTR^=BseE7PUdS{2WO#ZIMcV7N_V;uo;v~h(~*mRI`09ccxJWH`{#K^>Coum!{^)?uROG<(|e=fvZ+gzdKIk^^`cdf_Y z9GY=gpwlut9*FQDXlm6MiXFPFdK3VGLQhqD_+eves5zZ1Y?a*QwcXP@o>oq&)Ue9t zf!}Vj&})AA7&u$bTXycA5rjzKD2XgmJMkhR9vzrWxlXY%WZ!J1R2{<_2;X-eShc}=VW2)q>t$zI!22lnx+i7n!!Qr^Sh@d9iQHX z&6jZD&yIRo4PNGmutDo60ePA%1Ktaa<2@xX=T_PJXcDyDzD+aj(j4Js3Ft6gjGed0 zNj*U>Z|UYe;FiC}CljHbe^__VD5ED6_+6TpxF2D=?4A2@v0VhB{yZpu&MUt!2P^xc^K{W5D}T1<5I6J z&6;f?A`wt$UBMZyeH(^zpyC{-5Wy*Neb~{{J!^L0!(;K5@YVnR+0ioYO8KN(L^s>D z;=#!Y=yG%Pc$&YP%fq7;aT%-|oVI#=zF)Sb{kHe?iEI7szD{G6Ve$PA$w_Qc@ zgW6lszTuw|(m{*AU9rVK;4?@E4(x?ZG8Lki!@sMcPqF8oD!!xmua0Nbdz{9*>UH$- zIInv?y{}<Xiy76`Iti(YLiC|Vj5Dlj`4)%#wgP0&_+VW5`RoL$rPX~d2F zKvK>J!SWE(Bi%o-(77b5m;rH;d=Lzq>f?@Is0l*H+e|%eF0Mld@D9o1wZu*1~TW_mWB7Yo)} z5n=q9Hk4qviOlvvUh3u_7mK4XoR=jLSb8&o{!Ua%6DNLwo!NaC@Y_AnY{)K7rAX(_ zuwxzY&ApP>i>6LZWOq_M58^ov@I16Yu_hWbWt1Gv;DW{*$PekZp6rp>i(I z%GTtBemF?5|45&HVDoU={(dNjnP<9sPuC`3W&M%(bFus7>rwVvcI#6xlF7fa|EKCacEk{Yxrk2!)S|x#?{qp1iw*>nuT!c@e1!5KE;DcI9mlGz1BTOT2U-BLJktaw& zp)(jFFPw^^XJ(J@ zQUtB8LHGh*5sTpVaeayKr!iC?Swuf#Pbpdv3zlln*}A-$FGym9Jm}$yA$yxwA7X)` z@R!VU1>38SjUGcpNt;OeSc;*YP2g(iXgvgm{+XzJioBQ?^&Wxj8t56{p`WA@;LCQy zU(!h9%ax#4?)ltdMsA%WQw<<`L4Xk-xh5iK<;Me6+9vp zioL5D85nkIH+N_=hM8)KU13Y|M?oj&((y8X`L7aA{=~oJ0OtgWyx7B?dXakHH51{9 z2Jsr<8F0btu~r$9osFkBO#IkZwFPFoIN8G)(sBfj!nI}K(1$VnK(^pV;0PsS@N=Zo z-#(1nlj^;8M%*Oro&Q2{0r35~gmp7QP`U8l+s!O!Iq6ac4|PjWPGuI+Ke8f{3P~I( zuItFk<>Zm$>ikp;bp&(e1C0p0BiJGS6NLy>@@?b%%W58tRNX|E%;x5vs%;$`o5vH* zY26)oDk?ecaJDYbKnqfj?3mJ4aA;Z0f*Rly)-Rw}dU{uV z;X)AP<8O-&>KM{!Fip{XNcl7NRb9PpvExqyU5R@6=*rf104y~;6N|P7@UsA4g^3xY zqt4R;+B)^eIWDC86vigt^Dw?&{(^gt4GGhqp$4o5Dx5^l#5koEfMQ{a3UHPKqTt<` z($iW9En<~k!79=vA9W~{XoHxl+Lg6J+`!#j>ZRYiPW5clGD(vj&bMEW5RE~Tufx)k zr8k+WZzPu2fV2hQS_DGc-U;m6aggXt_`jUe>iv;|uF^%K`UD)^>7UY*zTG`|Lzr)ZBr z=lAI!kAj@HRAC>}m;H{(Hc3r#_k-uy>ZZ2Rv{16PDkwaaFZb{zT7lhwx z9=`6?&dBQRRv00phz%mgqQhTteeLQ2)^t!&X#I%6Ey0Wg40Gcjd_AE%xvIi$p5oJL z;K)ar0C}l(=j=NwOm!zZLK)tn3Dl6msi@8ps8hLV?ocj+zMRn!MPr=D;wJT~nRA4U z98#DR-nfCs!6Xj|YN?jx8jnNHqGxiIYkT!{)|{wV-{27?69aQlrCp|S#}4pM724XC z-YOClfcKvYWf-Fqbes*9OT^G#5YV+-72sDoz`BpCbs6#JjWqr_s+&87^$I*O(?dOZ zgFoq`gSY-aDfJFt_Qdfh`8wdWc8YGJJ#-({@hNJ`(W=)P0q=L947aom>X{)aqJOmk z+7AN8$A)l>yMrLXA}iMSn=;1ousHMXu6k6jXWy6_@y_0e@*-A8E1rMFE{L}_R3hLy z`PbEK2dgdI9z)ey`6B6DZRTg>E9+BPy4I$A{A#{IvR0FSoKpXvg^HQ}zjrkB>`V*^ zq`CqCRc+gYW;9`)W7QjKtlquQLLP0I*(dOZ3=pvHC_ViG7ofT1qjLc0fz5|(NE9>5-`DK0ox#BHmzhY{O<0}JLOvLTp zhIpG01p@|!?B5b1494L%csF7*rjTty#`Kt4^Z{4T^}DtlJ1})=S>fn$Wr`jLC53`B z6irljC58DN;DHCdVB`*uDiaLN!8#gac)LBtk2%v-=^BKuLp(iirA3k!{{PkXpeB?%5eQ z-sO}tqNw5Py_HVF;EmhE>2Ja@9KF!0t_aN$Kvz zqb~DVrhE2qWV5K1M905|w|AG<+Cr??RCdyW?%+UJ@TzX4P?aTu5lG0USCh!IxDz$9 zNFOHuU6czrYB5YV?d zQmR17xzen0M2Rc)$&2>X2Oi0AN9Q81haWEPlWhMK1@Ne$3lGdqsKCkf7K&Yx!b;E< za!up0raV0KsB_>PFn8Sw3q0kgEOCm3VCK(W-k$`ozZ(JDY2Vi8K33$fqRRw@Ul|V*0cfr-utA@)0s3=}y)t=*yUGEr0-i-@M_x@9GCK;T%C5QU zLW4~Z9seEH0!}qDi7F4DB@&XdWS> z1N8kdMcJ;Y_W1!P6zA*XDXJJXvq!WTth|++0+TxO1E}!FuuQq<`}%?4``HjU?ppzC zIOpy0(AF`?Y9x8*(ns0NU=Ixs3BT){xgJrKtB7x5fkJQu&t+r4QjYJNp=>wI-0;6F zml6O~7-FZFUyC19uX}Cd1HV#Y%&MZ*b(p{JUpK%< z(2h(P@U*An_E=5!*ql7c8jVpA{v@KvhT%%$W8rrmTkv<3pTiBN!6`_Wf2ooG`mv>W zt9xEH9n1dL%>8NpE!~Xbzm&jBs`MSc28gHjXv>_i0eKv7V5W~ChyD#s5Iq1%-GXx5 za*cj<_ZI)P2k3U^)b7rCL3#qK)GS8fr$@t~MnF0KNP6G@Sk@%%%*r3EvpG$J za%fm-`NApCt50GC;<5I;lVNGn-#2oaK{p~;8qGc*fWn52Fy&r60 z#aJGXXi+VBhP~peB=|L_Oi1~V%Lp2aHAhupI^oEOl7A1z6RUAcDj9!Z}h%Oy}+1+bi_$8;<<2n7KUM09(kR z0_=QCsrw4N;a)~89?HtG8!N`Drbfyu8+#%$@MdYM&o_(xGp1t8hXzE@OT(^#xk@t` zfXR&~*iq}tSy!)MjVYB9;XGVo-LJMVil)F2Fbi`dKz>D@-k?vTAJB3I8_QHW9W=FKF4~uBJC|x8$ zo~vfI77Zd4DYM$63aKormnpX@0SOqULiVN4HlEO&#EXHX@9pM|-Af(GMYG!i2ZS1e zPZT*kl!Fq6&r!QJG;-uy=w{{-(adCtsD>YecK^Zw%E9EteGv8g<*dRGmdmb2PF7zA z2?53Jl!cw7|-YT&YSlOF+Z3G#w->9F)62d<#U46nV-|HWRsqS& z)0w?TBR|I(%a=8HeA<>~O1C?WR^)LP+Mf_Ve{1*9c6nQy=Bt%Qm#SKK8<0tR1nA7} zY0KV@)T0RI5#w@v9w$s3mQdwP#dcw>01J-T^WMr-w^Ar*jW3D({mYUP5s0y%er7{~ z^~O-EsC0w1!@D5GDCkXhvvfc8=qs`~WP+cGE_8qn;68BQAQzBcVZbt3;Q2-D$+>JIcVB7%O zA{p_Beb~A!1UFsskISToZ(L;=l9H>+C^!+nwUpkP@0Ejdr*-wk=4rKSMB@2zzFusMBW>#M$@is z|HF20okjx-U&?v6Q^4#S+MnI}^Xla!r#?UHjZ$a|381K3MM@q}Z`}}9$_av<-@Ph2 z%~nfqAbbbhu#*SQY=V>-RfOY65Fp^UA$EcrQjgIUQNYhY^`7^urV}{43<(iRyOBDKrqt*)CtJpQ=qlVq4tgn%Cak$ z6th*GErIlKAON_$h=h7seqZ!U(CZ4cQ6gVVo{Qlw5se|RY`iBQpAkN#?K6U!-A1h> z*Nkk0aGZx7M~-qKe0YKy&YxrvRd7}o*^m5U{WNXPSG|*FtbG)@5Jl%2SRy=PVKa!L zW}_Tjm0pNx0q7Jf#Ds?IkG2loUR*Y@lZH|TsC-Q^H6T(7I{+8;P2Nd>n69I;IG2V= z7TB@rhVtU0JOmZpxyXeohXPjHhwq;=RJa0T(Gy=1%nH_alJYzSy<{?7E}ec^JikwB z8v^;cb}AB5@6o)6uKC`qEJd=_P1?y5P_ILpQ-l>g*TZ=f4l@TLV1RM>m}I3loh>b| z*&~Np0idqZo77~(oXeKLhPS9;BxL03qfkP)&*5$k4hE@3aIOKTX~^*qRvs{=;Jpm) z`{0iv(8}-Ko3E&k83(`HGT%Y2*bw9>CHqeh(FJ;qzFtxq-FvgywE3q4oHIe_C#q~8 zDEP*##@$bkWU%mN4BQU(mxSQtLs{L7#>Y1f4q!qb!(pE^=-P(!T#dN0;sHg+A=y)r zHAMS+f%YJGYm`Wn9|3~NMpA6%ZXHZPUg5KMVs!x`cNT?(KA}4vqy1h$4qX01>Cgwi zqHYIl74Ht1MOVTSD}Wtrt_D@w8RySWUsa1nMGkCPj`>i-3eVP+!y{i_2OqKGOklbK zs_U`6;ggGE13u1bxXQaW$`C%b!5>L#A^>D|Ck?NtoRQnLx{SLfJ~ap$YiG!Lu734y zBDi(BiE2;kckq{W2GOVh5BO2-r4{z+OG#cK5`Q?81Jox z*^+-^U6o>o53m11%IWUw(;vc4JWaVC38B+-*sT*5(tKwf)aEtTlspk%%|U*A(}4B? ztcx{$W4F@Rf9lf|<{R=S_DR$>?_$5A=x|yG>!@*D(Z7sT)wQO3y4U~#$v?=uk5;2E zw5%UH*F--LO8T4+;SYa>lP&}Mo88LS<*DP(16$*oYCBqS2`za$#KYsKUIn5FFI^(% zV3Y-_KaT2Oq$hW+uHUlvLO`U?_JEgbF&C#6K8YIEnjz0qjOWP~S9|9e^hut{u{XSH z!0`v-kJz&-@%i~LH4fiqE8ABz8bXS3`j~}N51v}gZ`S+smLsHrfv*=ZLwEZ}ZjZ8_ zw^TR;CSLCzwyrs4DcsjCaXMXRJ?eSn>@W=1e$I0sX#Ayq62q(8vcS+b&TgoQF!tc}W+4hFm%y5PEMK zKxD%LhkRH1ZFf`}jm#ntEiOc1g9pXh=(DX*p|=6Ev#@eTz1b8Mf39WiF~e1L-;hwD z!I^-qaVlqx5kZTqFUd75y?p=5LJ>X!_XJM)bQUe?w;%5}1e&+l#Q%=j{^L$!U}s|e z5B9~v@ITnsf2c2(ggjQ#AJzK?OMKUJjh>llzjA|gIuNgZ6#{NdXT@eyRni;7x`I?~ zh1_Oi`3S?PLK_!-Ntg6X%?a<7q%V+|QWMc|=2Bf=Kz@WCK^z{fF3F1_q9|49>GsRF zg)17wvnsC+{i7w_SIZh0ptJ4m!anh03DT!Ob9uNpmkLnP-Oluo~V^whx+S1 zLv?pD!q)xevB&#yvxf)fdw(@Ymv(G|C^dS{1kW~!g%5#AW_)8f3aBEv9!6*P;>rVAICoa=2em&m*_wp zGf9q6%Asl6RkzI>pg=|@QLxMC@$)z|q{cyiZE~a822wi3`=CSqWcwFyrU%%&gRfxL91K&FN`%|N3+_v`M)~X)}^2kbll# zF{?b{imw0X+naysverTUWQ=F%{N^lF1(p81Y7)Ze-Ggrl~eP9DhxI?@tB_F%fL)_e8}~Uutz}qK6=dwE zVWtN-#ZPIPqedu66&hoCn?9Z7fJ2-QOn@U8$`3W9;U6^(nQIp-S}ixZ{?ZN!v5*6Y zuj?1yWp!RgSmsBoTq};FEE3y<=&+y;$YVa-;b7xgsDPMGt)wDw%pbg(@w5+ONK0%E z-y-M7kJ+o*QCaD)Ie4@&_<3lp0`G~VD7}#38%-hbEA}X-L^^4Rwfd;`-+z8Hj&d}y% zg}-yiH(9J4U2vQbixsT)MQOMd`kM^%OSLcudRkK%MGz`%nD|U{La4da1G?g|>FyYS zJ6s@UTIah8XH{k>EsaI8nz8XOhca4j+ANJL2ZIH71T(sP2rH2h zy#USnxRpcM&HJ}v{-nklaIr@UISk|&$>YpD95OnCf$L`&N*NOLy`N-e;&50pKP|7g zxyY+jk<)TV*7Asf^+h-aoLeudW`*j-zKviaj?<2H6Vk=UGzSohV(jk?cdGVhUeba{ z;mCWEc=?cZ6vwChr_=#JQ2Z$A$ZvyD3|jU1)4 z?!qvj_%v|Tsw(um2?61?5wmfw*}AFw?|3rLvUsV*Ih1rSvUgZTRb{&*!FZWRP0H+Q zSOjV`M@$5xJl{TBGk)Blp>^@uA{k8!s6u!>8OAf2MHcAkCApRy+0@v0WO?fta)g8Z zzx)oAa(7zS$MQ`;es}^H+0=kMm?V=#^*EIRDIX~hsNUwMPBmgah9_t+2-Z4q5-!gy zsK4i{$-3k6TSXgMLqk{HqpqTJSHc#{$n?f!>rS>D*ycuN+MyHi@@kO^{?wVtTn%~j zyl<}}tvo{ReiV%)W;mfFY4ZrP9|V2zUX2pxG^+gXRv~2ot|$&FFMyrtAb00;ECRua z$cE;Xou15%SE;zNQ_b6+fg@~kCrmnQ|6XQ9g=dH>pKHfN~q^vVyu&AGDM=ogD@qq5zrSi2Jb$^PJ<`Jg(R~n)&3D{4uLv z7f?@J;nFnAu74?336+&*gNU~*Ks~Xg?$<(KR7_kw5qQ|OH_<3>APkTwr21TmdlX-f zN+AW91ACaD@$thQHD%))-uD+Cyf2Moo#f1Vk>HZDlvsC^mo|HsWia-D#<^0dWs3`j zlJtf+F@SJbm#)F;x-8BbMjK<*t&q92wFq1rsQk02%eUutJ|uFXN}x!ZJRw|e_#-dW zKija+6)%4Zqq^IeWk>UA!ft7hf6Q1%S1bmIY_q}0uo!hbdq7Et)ntGnlVz99+-rlU zXI?c|tq@$6=k81>eRU{k6Qn?Ao6|EXOQ*j6V6iQmID;*aLsOWXYhCXNb- z;g-WPMKAn4-B@M@eIqluwojlwQvD?yVm!m!7;>2oZf0=+TfO)v9h_;>>54_E4_0!% zoS{96XmX0p>Zbd4FCL#1w1bXQB=lwh8`qIn<^ei9fr@^&#lF_}?PQL531sn;x>ddd zTUui#GfA36fyCDZdLO=5zAaeRPXrY}d$QCLT1q(OlW0qU0)Kw+CE6T+v48SMps zw&vH4tSejw{m?i*sf{XlD?PS|a|dGiZDqnowg(TOZ)ji(N6{adIuF8~NPgI7Bi~D= z+Wd(kjiL0&XPNsGX(q$TCPfuZEJTfo>JLrGhv+qx3v~N;qtCiJBjYFZ;IROl-{3Hd zwG&l37&A;F5ve42eLWW-U+nYQLF}G~j9bcuw@aoclKAcrjuOLp%BxJZ9~- z$7Lz<7u`)r9w*MhGoke3W9)zvxe6Az-4W~&;&~Q(k&cbh0=a#daU0%8MiAFC0zr0` zm0Js$k=R9-{&eE#$W7@{HS=*8tK_Jh3Nwl__Nd`8IUnTV?f6@`dvj5)XFn-c+Vu1!K|fx`hlSd0S0bj$WmBIOgYnz-2_;!4A19_Dk;veU zqhLqz$!>EBvmDuw&Y+=AWrTnKqUnn)0&Bk;*9etM)j8Pakra0I#IUB!cXp%*I0(BL z=77tGAveFv$B}i=-wfbqOl8LBgqBD7D=tfRjGKlie`BhQL>GLLhjs6%!O!i(C)^=b zq7>IP75TzBLS1RIXXcW#G#mBuIS75rXuS*hlo=J zNVI^H${L}+chLFzaadzJ-4oMSAZZO2NFGNO8&aBp{>VGns~%7gx70KfNy17Zw(0V2 zK`gkp`PZd`;^MIT>}2Y`G7*H!`YAf3M0#G7YkS&eYM;m%+mg-?#nRbbZGP*7`OSO1 za`*$5UGP#$($!q;5rM|_(v%O%o64P@UJk|VfOQd$EHlmL*yZ*aiyH1vdFFhR(Hti= z?t#=2&VUTcgFYaxw!teODeQem9*}L<>E*0Fx18SZeK$hgD1AYy$E*6sz>x38fVnDdkh@6W4m+Gox&0mSF^~j!KkC6;#VQA!O9;nv$k4Cjkt6C zSlk9M51>r)BbiYM{UXa!*-M6koIR&Hb!hx2x2T%kZ_s;%7GrF*3%6cj~2cND7}|VEF+QzLQIURMBJ` z;bQsQ=GfII=Kkg-Tnr76L(EA~fTULWVQsJ9gFFD@_kCO1BOz5w%4yW5eo zcX{QnKAmsILevn7YVc2cako4Z{nWHM1ykWv$orL+*zCXyh$vcu4dgRJdEFen0tQ#aji4d>kXYq#4} zufd<71}EUKNTa4<(A4-=%K**-8E6T$O*nenMLvd@A9)O&mV{LfN{O%CrL!co@}c3i z<>A_xDmXFH!^NpD(RFLYX#PEm+6t&#A}t7HM;Y{WwZ^M{NVs!Yn|EYfN;r$0JYUym z9dYIzD-L7~eSh4G&)FG@Hlg$sgvFc#qhZ3JK8C)>DIeS5qza{V;{m`vI0+u4@Iny{ zKb949Na`;YBru`?TE8RFlopS zVByW8Hnv)v{N)q60ayipc=f@7#Nhxo=`(>V98uHZ9YiQv*?}V5Vryo^34i`K1s!E= z=rN;?3SokuYO0H`HJ}8F87~u<_^`@^Bxz zBa?uM>TyHL_0c#uX>{{-uQGeBgsJP}{odpIp$EMt4Tf!v31Iy7?eb&OfQO8BZP1^3 zT^`82OoF@D&lZJ5(tB=PBB(!}71G~7@wY!y5?3U?OQIQYnOEWsqc1b z5f6iuHbGXU%ZZ~C7W_S(;~I3Sqk8y6$qKxT$B43uE%&u*AR9=}HdQ()0 zw@>LzN#eNGFY&Q8u`_63miYK(1hUFR7$uHe1U!P+mR+w%H_26JOp>yl>c|*!9C52< zw)7ipq#f`nB`;WgahU>izKAoacZO+%-&Gs}_jWUJ*%HKT$jOGc#Ci)WxKBH6m7f@M zZaorZRDgtLu^#*YhllhE&BTpBpeKFm*n~qlCTY#si(gE0bfFrF2mW&Nox8^*=oA_P z<2vCTBxdu2Ag^a&ARnZ62&d>(GWjl$3}=vVvu(0HJ6~E1%}(_2=W=@FFwZ!LXRf_d z1fuO?eB8O({o}QfF5KJ#dFksepLXkQ)ZMJsGJp-M96en2i}pPp&5+f3cwOx2^tW0r z6P%o|IkT0{vH~gQtDz=eg9^*+;rtwh8Wi%bvk75=XsE(x7Py9vyd2Q0vFnj@?Dq(t z;PpC(1T6h{aoL17_ic7F^Tv|>_90x~FA!g+sIEPE_}p{zOb?7D(o&Cp+j&(q8dA|pLgaxg(XojrHT+Cf>3eIqV}X`w|legspn^^5_5YTVok3~_<=wQpPmaP zN$Bw?BQJD4VlA6>p&Yl2Cvx7_--5T&40*?Np#Q32S6wnc`ZPAq({Ilw|ETmfgK5=6k$eh0su04bDKP-2XKg>P3n z^2D3#g>Q1PU+}u%7b+VOs9$6SR|Z)Z!7s#EVBLZBPS6?HMF=n~$Bios&LVs!9^~$f zpC4+_y}2hD@gpQk;U(?z5Epg>pB%m4lmbPIItAkB)|h_UM=P z!L#whfm1_)JZDckmLh%vjwYn*BHCKz#oi86JXJ9HtF zy00pWa?z9rQPrDrrpUZ8yc%GR|MHHBV=x#zT^ND}j6@_7BUX@~qBMv7RElgTz*96z z{m>QSxAIG)_D`0enu01Cvn8FS{}#I69t9q>dLN|FF|h&)`bj3IFmWQ51^__L4p(6u z&xPQLYgt5<`+xX)2k1!Ft$#SSZQHiZiEZ0vhZD17n-fiviESGb&x8}(_~)GS-uvG7 zertVebys!O`aOF;wF|v>ZH0gm&=d}roy+QE)Do7lH}8UL!-2Ft->O9{$&~@iBpa{J zltE7@kjabL>I<3~8MA&sF4S-1%Y7Ere#UrGFuo7cUNWG;omYpul3_1z%5|Wbhe7yZ zxK3Qg+LOOL)V-l+8(8*kQ`nwGKxI&VM+zV$v^(|YnoM6whkcG@CfHd8JOpth^t(f! zok3c-lkh4+0V(gGijNyIHEm@q1dbtj9|RLmNfj)|s}C7g(LAne=vF&2>|Df_a#ITa?Qb&gh-OatUI z$ZVUcPl|k5bNkabMd9Rr$7B}NbkS@p?Z4A)_fk-EK%2LdTg~1sEO)0tyAa8a)tP&* z(m+I*l;dY11~hHO4PhX3n7D-l^{K>Xw2?^W9d}Vnz~bOFAQO_6k_1Y#3Ir>9ZYiqT z1$uk2#1U8`MANs^o(g*lqVf}VmH{UAa~@5(X`SQ978IeZ_;9MN^Yr*VQQjVEyWMkM z#(YoD4MiE@UuROF;&SG9vqlJmS&n;hS zn!TEne_9&iaBlvE?35;+*3`h<-9pyF_#rUuq7hFhOA#FGb$3gwFzVFP>Sp)!MnKztPyQ+Lh^p3sjb=4xJgdgKwu6O(sI_{IWJ>J97vGAnj1>xgVLm3Z~<{F65BOn^7^a3QPYN}!Z{j49;Jv3p%9!ZxzMb3?jmh| z?eMoKW!4>EPWb8q`zbel+(BdKKj@1^QA?^(3iI}KIL zIt8J|{Db+SOj-vxJ1ZNo{Iuvs{uL~XciMfsM<2w=jB{DZ~)CQD+(|D2u3|uo6gFHw)k3c*1P~y)(n2Jcrbj4my>9i=6?{M|=)9tY9ER;5gbMpmjgpJ4CTh%s zq}nFzMucu2bA-Dg0V>uAITO&0kfc-9DS(|`FPiWBf9iJz%D$hNDxG=IdE4}$m*+8e z^`f%0{=5+`Z5X$Eh0DB}KpUAx3o!tbu7r-iZr%&O#Te>5NUfObu%s^Xgxf*h4x8@d zqx>C~oF}`Jw^G~iy@)>!4}3|b1*@*=m?z2^Lq)jhnoUX|Cdn0ji8y+yTa0bTni*ir zbe8#Qc6UZHY>YHGM9PKA|E(3i)R2n9Nhom0%EEk1>?nm z@7ZeN5xMcKy(Uh23t1?5r$tY_2p-VAFe37UNlB8?)Lr3tlSbDN$o?d}h zY|Yu6?OJckeixTH(|^ev(opt>vkoZmQbltUppx)~QUr7oR`^Hu6p0AOrLOY8S2niJ z_o|>|I#0@#DB_?s0NgxdPOO6(CO_JDlSf*qY*iRczk}Th$>as7ZZrW%5yYo{M3z4= zWxFv%w2wS6h`3yx%F(cQ^}7IwNne?3@zlK8!jP^L0@%0>mwgmyK8Z_efs)#Y;=%-k zV%5`|;5QH>@I>gso7jM#Knj0rWFd`BABdnEge^}~1jto9Lwlkg;ecM;9;Lv86XZ&s zXb#>L$cTt#^qG>2{Ngu#duK9w6|5cVjq@&O7iei2=&?etuHvcpk7GbG)R)$?iNbH> zoBXa7b9|_nL6qAGDAw$wmA3;0_X{?vp!IJBGv}rR3S@<=p7XUTNOFzaWSc^^&CWsN zq69;;rf5;y+Uh54wB|0qSqR3=OzKC}6dTDyJOdvptlG0Z>< z__g&Jn3(f=@|Z_b5sLui*PU1y%g5!}T25(BPE2VN*-lv46Hn_-2X#&dF{n{L)OU{=n{jc%$| z7k($K@v{|*VrUi>`btziHe0n2ogHTwt|z#yx@mIRkzv7gVqrvB!eoRcdXr*r)+Y5& z`wc3Bw?vcU6HWEAS*H_~m6Xm|vVvua0kP=Kii!Mb!V(KGHn=QX5Cj}?t=$s?W*;>f zuu%h|lS@01Zot>mm)fG$rSz8NS|WY>JPA zcQwU``7+Sl&Sh(OqpJ@bCn7c~=zo-lp2Fs;W;&CE69J7aBE2BDQT}MGwhqXC_4+0s z8@GvArRsepkbl_OLW=(|bC=e8^rWT&_d)Q^%2m}O!P81UWXrHYfgnFr7qsz=Kme9f zq>4rYU*^h$DI@~EhXjefl5U{11X~|XKJ0BQWGV@pz7xcTHOZsLjm|t87U%=0R2x=w zW!|tU@BwR-MSJ_cD+`$zvkC}W`RDnwk7Jy7Dvy&2qoW?-qDHbwXIVZ9~ZH(4X+wjqqN248NK3;1#W0E*Q1$9Lwn5jO*! zsMi#1uPD^gsP3=>b~h^Oy!@(2RYOywD(2Nr2msMvpp|)bFT4dSs;EzYe5Pd73u6Rt z!MNAxBaI79OQv#~H85-SxSZM#+s_Q< zyXm5caU6~0W4c`f!XOUYmixGJXO3^>Tsov_d3=|mJ6RGvl2yq{9K)0MqcoAvid+p+ zu>i~{pF-{z%OMO?ms`N4;_)7oS7yPm&J!Z6DXk)QWPL%C8Ge+nF?BS2yITNPs2y4$<665LTK>div_T<&{@ zaN6;(Kjisht7LREzCWBA6b29*&<9pMzPt{(Kj%RE9#~AXt{Y@_yN#K z*Q%=}mhDpVyK#Njw-HM4S$;4Qz8}6LeCF5thJ}qjvjpnHs-+iuo|O?}U5< zE2b5V9xfMf{Pl&$m*a@)@Ix?USJ&ki>z}1)2GpHJ^>2zAw;^(TZ>MUEJ0<>dK))lu z@}y6@$XO8mZ@Z}3Zgm-|i;-{$pdp0yJsCAJY9dQs6r=;(f}XB$k?mQ2!bZC$1OtKx zMw{NEkPasWoN{q(QIJ+%RQr3vmz?iG{%+5+#$Cyo1-Nte0lb>MRHJ4y6|M}n51RaI zwY%cve-J4}WjF%Hy~m$W{FmBh*-Av=VE?g-80Pnu^k(lPbQp*%Spe6me$sI!EXl~h z$M~)pp1E8p+~$mSrxIN8TC?e}2ayQ`J8d5qpx1OXo1%XF<+1S;e>=VkJCy-rA9s4%y*`UMsa|@$sQx7y+;@{ZbWY_3lrDC{u!UWW zhFhRCrhy)M!NDFj4+2!A%wr3V!G`cI72!9|aosZ&jynWl;9u4I&q93cX;BmqT8L3}EoJ!+e>x|pSKyVtE z!2IHhiNJ2=qnzY;l0boJtzSVm$oHhN{YOKs3HmM_sk3SV906d@`Uv8N(t27`3h>U4*gp$PcUhPA8&>f&ur$A=^K z7k)LKLXyn7Y0V1un;M&1`<2lSqH|vL0(sK+m1ULN*A*gjdSZ?09ufgj7SZA}q!RXr zF)7pUsirm?nKl3c0$exd6sH*S-)2!~W>0IUcbw+7zJ5T9Jyey7q^H;UW!@JI6gz-a z$(s`?Lq+K>($SGJ21)y84R<;Rte8GYV+yC3b<3OCmEkwLUJho8HFXs%lu+{k86O{^ zS}L0H0(}2>!R}JFmVJJgMnB%b^w)F0n>Rt`?LvzHKqRp9dEsJPcl%oI3(U+A|IY#j z70un-S5$hUtv%M+`J>mqxGmE_w;JYI{f(`grYtNzA>XYHo`q3ve89(@>tr$$(*BL+ z-jB`EBK{W|99dE4}p_6kxPG8ae(U=vT8^w`|U)uSI7gpI809g~bDr2WrG+Q2X zp39#ofXGD~Kk*BBXzQ;??6srUIK2qt5r`~hTxAKtSPwtKY8R6WsCd#598=qaaH>1Jf=HyM`WUjy5$2%lW8R zS5kM@=Eya#ZoU`#*H>&}m`3M++Y$eMS^u|z;ACnG$IimR{;xOq-2bZN{vU<}CooW& z5>y*#YeWj*;7!I+D-l!GOj!xg+pD`3KF`GGHO+B|2}fKdiC{mx&b{!r+9F3r--{xC z<6i$F(3IDikMe}^NBAdJm;M*amL%_beZ@u75VGi^uwOi)6K8`@``O_gooyxO*(ZOl zHz`V1t@5T@b5Nn)(%Puz+Wk|pBb~tZ9BVF9vz!$?H0KQ=itJ+ z-2k1WJAdzzAFoPJO$mAK$eyC}tcDg-E-P31kI~mn@_Ji^&}S&HDK!`og5PG&&u$%k2B|<%68m&bNkcX6DYplqDWZG+=60`$`K{cJIVqtp$+PUR zZ(VqRN~6~*VY6pQiVUAT*bYyvnm+-gtbo4QuW9Uc2QhU{%#LZ;D_Z4;2+RIr`6G19%IsAb|ld1uh;7W#KSzduBVTWx)Ge^jhrqN=~)6gZAY8yBtIkjq5~ zlAlrrUjNMFMH^Zw5|hlAgjgjxy3$oQ5R@Z~YTyogg-{F_pVVXEMiji0OkmWAmv=Vb z2D6XGI?M8^QUR_LA^6*94kATAGG+|;Hx2=Y|_EBRt?&y!u zu{6NBu%Q^vSpB4`S>9mD(&&>|KcK0_?vqiO?r5SR<>GZ}EL)AL-*I{R>I_I$lwA4l zENoT;!{cCF%o+*;%3h{uoB?JLDbQ8b7g^qIf z@!Hb1B;0}3@L3B_s&5w}43%Fq~Y_vRHWN5O-Iz?vTPY-mg;=#eHG z5lOci!~e8_2Dd{8tmwL!0UD4u@%R<&&jE$id!SK98a7S=!dL(Sk_-!OCkC{{F^Hi@ z1#`I&r4SXk3aErTp;&d(@$7k!u?S01^492K%~HiPJ49jqPE3H=QU2Y+jwyz-33))^ z-R@9L31vp$DiFO7H$YpAO`?ZKhD$nx_^*8 zG33O37&A0=vVJr4+Ol%P&3&_uY8+aK>C;`(#DBPtN@qc7w@f`L`(WW^nIsc4|1}@& z3mgZ{_k?J;rPPv?AE6O8z+&I+v-@0qRrTLJKSE2_HIqPMaO=azwuWp^(|kTwHpqI9 z4AHVGprWE}NqNFRvX#lmn_W^ZCI*~c2zN&Co@B%MLM<;6W)h3U+ai)esIK$%;x?J4ae&9hO8 z9n6mUFu2BhXE}V~6Hy6%S9HS+gdF8ge49;I^?7>W|EV?nM@<$WekVueH87ET%x?gS zaul>f_gGU+TOl=5-0ilp{DKug*B1Mugtu2}t{En})!G}nt676e*(Qir-`**E!p}>{ z+<(PJ?gG!)eXfg62=d2GBrzW}b{-70mUG!L%TAi501cxpSJ3}B9)YG5jY?1^KM9q9JhwgjYsXG6*O|n=I%km76RiiP9H@N% zN0DkwkQ|7fMUAZd3)rLCq=?=WcLaOW_dmQ11TG}TC;%AlK}C(T)=?T|1dw*_{J_3f zUYxPiPL`}5xfTMOu|9bwQ*#lpaYP5WtrEo_4IB`V91n7U7jNMV!BI~pHaql5D=6_6 zqzK+aT)(v){zLjWWM>v|o zJ2@k|q=1plP>#Z*uSs@>RHQf!Q<0oW{4^QJd8S%j0Jr@!#CY^1AhX! zX0?rB6Gd%AQqf+~(Uu3a^T~sz%kR3A_Q;)>8NyNKd;P&l=zT1)e!_WMFX0Q>dXhX^ zV>|=^PAg?uq0aCh)Ud+0X#IY7AGNa7gs|)VbP}<$wBe;|m7p0ZRIzjr`aXT(r8!tR z3=wHOypC0n8Q+E~#muD~BH#udQJsl)-m~S)M;GAeE&t`@EPpGY)$a+K zgbjlS4zf!-a`DCd=T>uFl0MGtAj*o?onz~m{AJ{?pb!zw?Dv_4vaow*B3d$GVC+b$ zRM^*7(#>-@7iv;J(E+#F@MKj8k93=IKsRUccQS(7@aiE41S(>Dov)=>1QJR=myO71 z9GbyM7Qzc%sA+x?50ddP30qqc+Rt5= z31Y4a-OI9o5W!%y6RnBWY3<+8s=3xxxC#Xb!J5#ivwz3AP)xfZF<)RIEqI|_1bie4 zWspU1uFco}44s`}w?^`tBV0CKL4qGJLw#S>nZc{wK<#x2XRJ-0DncIaV-Z-#isy&- z`(Dl9cwl6d(<3^ua;UY<%u(=LO&MvW;4&9ZF~Iki6u909m=qGearT=dv>;N=eVl#x z)1SL2d(gMDrD8_OZ`J6=*SQ4}tN6LWe2j3yE|+c(=>gVr!&)+cFZ0#8tOFE=3?hzn zycee4HA^3cIyhcn0_5&L^W2d-87y^qVtv!iYFg6X8X@L>_HWfwVqnESs_@vZE}o2S zwufFj?=^H2T4eu*uWwUc*AU21V!>Kq$G5r!Dl7DT+geW4~Zt<{h; zV5Q26kaV+!1>+43NN4jxq>`}|B~mars=#1B#GHA&Cz{>MCuISCF+d9~8(AcE-F|Yt zW`2BP#yZ3k{kOvXZ`GRfe-dNZc(~btt+sBU+&~69av;77JaEF+h>Gp6h#FNmAt5+s zaVJN23rBZ164t*mZ2sQ&N$xLQoekJ)YfH`ccTmm$g|huc{{KLEfPJ<$)a-xz0sag7 z-(=a@{=xp6#{W*?@1~ajNtd1LFD&rM0TYzF5!q1*42+Ze@6lX;IU)Y*0672ZmhhjW zKU3sBN8@w-WoP^s_V3IgRXAX*FFtVAR+pOV-(&xGHe7#282ul5ynplN{wwR~zv%t# z6!}l=r`SJvV{-qS#{bgg27Ynow*QAA+dp$-`)7;&AIj|i4C44lnjHTKisK(Sa{hDX zIR7~-T>n70{(*4)1L6J$VnFiA(!d$R# zV1kbb7!T(^WH^BrKDxj=UkoT^HF*sMSs=3CcVMJ9M&p8?4;UB^*FPw(PiEqcb%BeZ zV4uYy|K`vA*Dl~e5CM>QiUvp*Jb}jj_f_zD7yr*4%gqhM@8@Xb5BUoHufrXQ8Uob> z#zfnKIsz}E*}!caEr2Z3m_UvgDIiys7#jEASH*vj;Q5OLfSZ$tM@Y!c-POXx0nR%o z*V{*5ZKeG_p487t&khq$v6pIX+1Bo}j90bCATITRsHn<;4-zRUY@*2bWDrsam_(Kt zc9`E1gw8~^xwAi1`PY8sEdMCCTNrA4(8Kq0?77&w=>Yf(KZZ`N`614{bbfwf#Ca6R zcnGF3W+F2Hi6!CZF02t|KMz}Qv60yA&~E6w;MrbD@zt(y<}kn%eudB?X*3=n@Uqb^ z{JKjwIp*jO9?)r zr_*m?Rq>+T-)3T_zz2yzh;oXlJZ-NZelpr}x4#BI051T*)cpsyuqa9%zF7eG(33;_ zgO}oJax15e-t~P7VI}_p(nT^vM=9}7M!|M!bEl*3dglk21eqC{I_nFZ{M2egy|?EV zJE08jj~b9SerRl4Y)D4K<3lTy{gQvK&6me@WE;O*VopEbFL~4%V$6|g&EZ~& zU7=a$@L|E7&bB0EnjOaatUm@zX}CNJnj6=`&&#;G>o>r6RgS{U!cop{OF@>Ta-`x+ zz{w4TIWeONuJs$Gp$BM0} zIPN3hI8wgF;+7Twzn(3Q?JiL|1PN*2cZtV}(VTse{0bmq43(})0R(@S@QVKWXVFXa zkeetr?R<^OS7IN>p8{2mI8#|JGuE;TayHH~vj^u7?WT}LnGunoOHqUDBhTk^2XLd3 z7A8>5I0HH+QYM!GD=t8RM$p}QC_B%p%n0FWr;^>R!dzeIhIZ_0SbFLtgTQOu2Er(5 zIB{U@8sK&{w$Ej2)ZGNL2vXf#YlqSea|qup-MAh=UlgPOGtaJ$+OA))NUII`Q|i0X3E`Hmz4`BT-8uExPj8Sj_X}YB$!N)N|e(DKKt(KR*iGd2N0nxt(#{4 zHj8`&`9)Z~_Nx7Y&8mL+;S!86uDI0JJdM*etNW{kky~LB@1Qh$I+F+)$H^aoBN#%! zBVu%+@s-yRriPyAzEgcznixUr??s_&|JpOnqqEJ~6ai^>Ftx<4LOP?o;$B$o_Wm43L~S3~JaFaQTJ72U)VW-l4UkMBjA;zBe~Sb`4X4rs?EKNQ~4v%sy$ zlt9-c{%lQ+>n6uswOJRZ;j%HdqvH9hISVOty;=m^Wx~epgHJMd5hw_qd7*(#(rsCE{8@zGDVTLigI%)A_a>rfrhOfM!V)iz`Q3_JNGP*Z?jUHbc zG(ijTFYAeq?*%a5ID?QlHm)${ozKGy7mK@!mTByA9H?V(qJvqhG%b%QM_!6q_Qw>; z=fN-rBC_OMLk(5Fbw~}ArT{6vH%fU-LUunQx(B)aYGO3%Izvs_!=)f9T!gAyyi`!C zWC>+Efxr6m#}jxQ2_CtxzweVjVvhrYpkK+HyN_2P;t zV?%LgPw3#C9GOieX6Gj(LT%%qqr%lXAQm|BMoj&>d~-Y&ozI_5Vo_oO#@lW7N-Tiu zmRS{EE5M~-FnMT@W0cQIvFAKt)ysr7zti%A{;q2*RfO-&}MjD(sa>E@ZjTFUW7+$i}4PrUW^Dkr}e z59@t;sY=Y@<@Wv_JK+y4yfcyn>IQ~Bcf!Y)=f7F85K4px)*6Yoltw3~wZN&Ira-rq zPOoWe(*#46{Cx2GDkUP09UHUE#B3zBlH_ygvE^MH)(NPl9pkXKOqz9^PH`IEGjFe` zyoAN-((s%PRdMV?$S|X9!Dkz9!nVl}YbN5~)V5x(U?8jhCZPs*q-!T>rdK8S+gX3y zQuwMRWq2nEjp{*W#GPgUP7Caa&rK>32bZ=cLHDd|Fy-a)gI5)8a%Y!OZM<3a$+mO9 z4PB254XoD$B zqKkupdDy|(`J(fk2Aq+WQgP@B%Abtd2%ctcxgM~n$-Q{EW}*d4%E>EKk3gSzsY z&b+xmbaiE(#k-K#)drEC^4jp=!SD+`MdnXo*OAwq3xD;LFG7nL7Wm5xM}l;=POnr= zu0#~S@-FataCsoeb%S>BHuocWj29+d_T)+&V{gBnt0rFJE>j(hCA%8R&Xbx zLUI5w1i>oyIhxf&#Gk%E-(Gz-gUNyD265Jvc7jF>r5Ui09}D;QrL$K-WL4AUZDI9@ z!Et)ePNa%ymWs3f7|)2*u4I#*5=$;$!E3&aIAUn~{xmzJw%IK1P^2I)Cnlu{hw^nC zuQu9bW@hnb&CeCYbB(u0IP@^z#ev;8CT;_uTtPFpS!lu{kl^ne`#puYp4GNN1rX2j zLi4uy`!^~&))*EnXAzU;AMW{4{M-@SM<*#NGC@}O?0|vT;@q1nnhn0_O1G>!(lA>u4X+wiPQgdmwc5;T^k;>~TCUNFriayB{PXlQ0j}R~xoOJz z9~w`~^eOZ=t8Zgxle+v7vb{TG4YBr9ja5Mq6-`z8OaAI)8Sqob-#giiu|nixDhFir zlImiQm$TGEoqB02w2YPU-C}<}Qjb)8_Mthjiz`6MkgGAc#Pn90b+4XXv^S4pys&%+ zcbdgKL>@~kGlYGrTw@DfMx|3u$|BLiUfPdTC&b-{4T@KijThd)W=Dvc@Y-=_75{CP zF_n+?-EnsYal0QsP34Sth*t#8{FuVxRW*f18x~j^3KFDBTJa;}OU9*VsJXfpz%i=- z+<=6e8cQy{0Hn`fJ5BE!Bh-+XvIXt&=!la;x(eqSnMO0SyXZE&Tu}@gyeKFQ9j#68 z9l7)+qN=Vq0v# zpnZEY#WKe~?$=+|#`vl@)Ar3j50#M1)*!gQs6%?7OFdvo*bram;g@D21;lp+k8fYV zQ;hqQ5Z7slyE?tc5@e9#z>bg}Hrovi-K#~c#TnGU2?wl<2Q#woh|=RC&W{&E&(hCo zUE+Lc;N;L*M-Zder7F&99s<~sK*LGOnKnt)$jm5AFrkjxewS;0N>0mh)o-aO4WIHQ z=pbifUqTpX*F*A;*g_#etBHrz+?P0jwQ#OYjn=?Q$%2!gs2WVznbq5ldT9zUzi81P}1!|_R?Qn1vsY`9mmbR7? zPN!1fC?U*vejtws2ZK_eU^1|FamZAxFdB%*C(QO(=4 zKPU&-ZmKtKFjC&&s{bnWDjh@e;O*oiUtUo-yu9k4l=nO$4?s&{?^QPif1!_21BpT# zMx+U4y-e&0du3QD;xK;m&7PkgOR2Twt?bR2OxLgh6lVHhOcD$C(UTWuwoTzbWRsk) z2~V6IyiT&6g#l9V&r?#i7<*;T!KY%~*du(9+bHU+81pdSB=!rj zy;IHSMl6=;q41(*%<%#6FRkg?XuIF{Hb!l{!4~Sj(SLo)zl~xc9c`H|^w8L@ae7qIfNR8|r*OsU8w338<;S^_s~!?wNp6kqa)sdMkZo zXm12l-QMnji83R*Md==B5wO2#M_>wFYn|UmC)*l(m8LEyT#xZc-0KI#*Zd|&=77%* z=?$-mnQ4!S*zD$ero0adbjETF0{b9(8N4Z4Jp&Y{=E8#z9Vrw_RMfZ?BY9ScLy#y zDg$T@e*S1%l&j&QW84u!bn35MbSu|hf>-kT>}~?ZuI-mldT;oHSN@|s<-ojV#%Fr8 zxmBW3wH;WsqIq=OM}BGI0yryOo}So&;-R{Tcj9BK?{pz8lY`{aseOe4R)V(c^Ii_G zzr3QPQmx=8OQO3vgBsR^CJ92uYoBs6u z;feq@({O(P-c$zl4z@Uy&3@eHVPN-`zsAH7hBDsGXSgOYZlJ-$&l0)(g7$(o`VhVC z6qw|hXyb=_*qI!!zwVmE1D>1VK`Hk@<{NZfIL~i|l6eQu;|yR%{mjGd_tq@Axq~|8 zKYA}Z75{xj!%&%J|3E-cU`^lLLjqVY8rrU|Gz*==?E18Av42R$zS7p%rOg|J8o`yX zc7XBUe2cj`#hn~f!OynZjlfxmHd|L=VZab6Z*MH`Ybg+Jq%Wi`ak6+LBS@u!^;cOzT`L$4cF3zpqWsqQP&|!qjMY9FN1q_a5!sX4=XIh%ggkGue719y}gpQjStH!ka(P5?G)iSrk+3W6=EEa_vaRAH<+C< z)jcaUxmsPuKwTt@nXxE$Z5$vb9z$k;6iQ-aZtv~>Y_bEsjNmO25#SY%L|6&W`kC4v zBHDgcIVh{BpEg9CbPPgU z8=If8ye0VGPWgYlZwH62s~?P*5m@&Jj;;(F<>u>zG$zsV$^SyCmD7#mac8Xjdg8sC zF3YJqQcY<`QeFk73I%vR^(Ly+ODfeJllyZe%s55Hf7qx}YXddelx*`nAax3C51Wk( zX`I{gk5e(5M8~R(wJj)Y{Jsd6BmresW1h&m=J|-A3)2Oui0I7cZcWouHgtcOm~%X* z<0?uuIzFCaRirhi4%!$!&Pkv#XxTOq#>#Lge`hJ^=VLOBfC5M;SLM6t6wulaYeiy- z&AmBcf1Ck5&%oBhF-LQiFjHjj6fMSsvsa6dG5ZbfDd_}K+uOtSF5zqU1-n&lpaXq# zlG>hofwqw7?dPF>`RuTg)__N%ThFd$LdAWC4@&H8eJtCnCGE@NYff)YPn>JDrATS2 zJ3C#B$Kg-CP<=qClT^h#rgTH%_aph+Rmo(ev!5FvYum@O`P{ zdgb~hEL+c#hFsA)QdsekqKqSN%rV*W)Be zMLc*k!*JwIYE^yf+w<&81%f*D{o=kts=EQ~_F+YgDq@W&rA$&h^ZBfL@Om(;O3@Hh zAm!+fQ2UMHx}9(5+uyojU%DjzV3Xl>ijYLk=r_l7EA8WSQliQ^-6J*cJrUY=@sf+g z!qL`9mu&#hu}g*Z^9L?R=&+zp-KVYTQb~wPDt9$ptofcbgCH(Da>hH!9J*PmZ(F?k1g&@8*P0+eJn4=X{Dv^}@yFhexK&cvv+I%ScV|z) z*cZK1rx?jEMx@hKi>o!$PJ$aqvOE@h!_4HU)N}INk@MR-+jo_S;6%66y}h|70TKE7 zb;lh5Z`C~xSKF{2dmej~obrf-2ZOF9;wBHJ{v?OsR^?9idnnHs@kz_>hIwUMmULkj zBQQnx<`Onu+2lM1Mm^o9A23t-S3R-6!9_HLcV|a!-qZY8!;uN)W_~*6KHv3O@F0p{ zpN^U0$Z^zd|p)nF=(Lfi^M=g#!yuJ%ax>AnlhBjx(^~iBPIRGc7-w})VTvoom4rR8DTxMJtl)Og-^9^%z@0e>vCTh9b5q zVqIcGo0H<*YOhAX6;8qYoHm5=ji7060FMGZd#G^jcHfcg-s$Bl^66AYLg0R{gWv{$ zMemV&J>F=TJ`d>v7C}iaKC&v!Jsa-lJ{$rF4#-q37B2QztpVci<~&bf@Jhd*f6NI} zvECM(TwnTtC_){j*0%KItYa(ZvtekcGHJVU*0R4F&MWQ*T(Upb+`0_x57STO0=&Nd z5vC3XRchU|hX2^AJZP`&OXxXzgzX&z=|+3r?U)HsqEdfpqGN-|Z{-Z*cC6TR{0XuJ zQD;#bzm49*&*y#<=!w=;;y9^4@^lS~jTEPNxKdaTFbp&Cps#@G+KA3>YuHceUNW^= z_{=LeKWOSJ_Q>f;=so7wsQNz`Ax4!xKCJt0R0<+MqOdcZx$RKD4u>wp8E)*-PMm489-!CRndF& zTj8fd*uxS;EU@#VIP+BkhszT+oKmQ8&BKB%0OxIHKZQxIGIp^cNc5sQhp1xrzSp!H zf6>4Ko=(6!8axi^U15tB?gCmZ(=EI7>NfwKIz|VbfoICZH7N+-tA7?DY@M_|BEgf^ zm4Ub}oAN$W)2T;6uXSe@54g)&BR2kntZ&^Pnz!RDWxX1hfFhyjY@v!@q~z@mnJbG2 zWhDZTv>Lf=bCdypL_uGMieT z3aNX1h5=@?Zj!eE9Z+PCRvTVxBzWcnLIel!1?+h!<)@Gr7FEFLq%1beksrP3NuM}~ z00OrH_SZsVw3yI~YpjKp`gqhn#7IGlS$wC%wN2V%HF zznHh82pt$faIR&2s~+1VGNyma8>x+Ru_;?qR-$RF3U4fQ=a`Z}R&69`B}uc0ZQw)LAV!$q%xV)j|BMv; zu`ivRt_Wtm9bIELLWMdpbZEg`;PvxOP`}Sg2C_3a;PqEK>Zxz0bw*$Q#3?e_+|<=u zr$IeoO<_(TQLtTJlJyIx&^W0H(yK|)o+m3dkqe1iHUQp>CI7OJSqC)M*G%O>D}({a zz$l*^vLF;DK~OSp6O3dXe(dj{VyE=wfEBewEaE=M=QgAZf4R&eqsmM|rJ44?Tx4Vn zGm11+7MW<(3D3Dslv!PIXM2uXN-w4?$5XWUF?oHwK9S6 z{A)DPSK=S|*73mL3jY7`WCQyv=sw-*XB8sgte*`Mm@74bu3I?3%*t&v?!SWz{=-qs z`?sT*lZ%)4KOMz7(CX?d?Ly>}yd%~OvCyDX1jSO6TnwU=sIUd5g|vz&h+ue?bO>GK zB=(7H1GCkLphJ;_xhe>KL?U&Y5Q?Uq4TI@>`@%Ze*$?*!qp><|UR`&~u5HGa={^1* z4{sk*61Yf(5@e`$*i7pUoX&uVgTu^zo+OsQ$jdxY0#B^>SF)!ETVjU#$bK?#tWJKLB3J z82gtt8R-s>d>sy3_wrs0G1^3bNc2!K&syj#7ml?7Bds9iB8O83kuW2V`eja<_|BJlS>m{Kq~GhIuC%7hBal~hTTTmEUR8J+>hUnP(#Z;!lngwjE@|1yhf35%nenf9l5u6rYEmg-Ya(%lT&e^X z3UQ?pi*U(8CB;!Q=2rf9T!^U}itl)jK1NHLujE;qZM;CyM{YgYmq3lsl@!S?@}lO$|HZcC757qZGI+&m#rzCLZaX3?&RWxr>MQ(_ zhxm^#-mGHY!Ri3xs*q5+q1$OcnshG5IxWp2>9wB0} zZ#Ft|zWVx62X^3i>-SGl120}FB}(KFPxK-{sf}byM6bUA8n2N2?HA@4euHF+xjoQ0fUeRntmvB8A z{EFns=D4uRzp}UAk+qkZ8wcQ=7F{r&Vc+Z1YH(dD}q6;NHVrm*@|2vXadK8l}clT;hs(~ava_#&a_Kh!;Ly* z`!dCkRo`)p>JH{WU*`+VZQ|J!JXDUvGvvZVa6KB-mHDO8AxzA%Xlq4fXwn6lU05Cv zr7)1I;2vZ@Mnrj+C>*DZ@uM8(Sy5xU8crP<^(ekYD6tCV{wE@j8iR0x#05{I{J3rt z`6P6J-O$dJahNn1;Ou&9;jjeyK2^N{?FU0M4=JOYmT&vw=A6}t>!9iID`mYuHux=& zSoHQWzQrz>gIOw1Gk8@lJXv2btWuFaK1N?@$6>Y}zKl|~vAL0Tkcm>FhhNeSuh2I)?Lt4OCXbT2uMhagdiy; z9sltD>;K*t_}2OlYq2i-o@eiU_SrYM_w46xkqO}gKn-_qYJ%W!{ZEClN4K51y!h`i z04u{bleM#A98@1YvD-aEsqr(<$)b-&SlfE!*tfCQ#HULHiR<<1T^1xv46yo^~ww%L|D9nHTY z2*-T=yg$$%Noo-#RQEez_*Bet|JJZ$pmbn@yT3|X#B7m!%3RplotXE1N55{$|1<$e z88i%-(Me%bLEhC`j#+H{RP=1#><^$yx+;Hz{OY3>54sw!z^kIYGpJ)0XHyt8ZS z;am1aBaT_(sq$Sqfhowo`MTVAs@g+w<#z|GoC)Fg32EuFNNvbRtiPyc-H}3(oJFht zKAQhFfc>SK|G~40IQOZ$mBZm`^Af!$poEs5to^e@h3W@Si z7Z|Fk2KVnJCeSd?blTdwmTAe?D6|D>MTq>|pc15%K(?+P|N4?(gV80(LY?x&c|q#u zt)K?$uAtr|QMrclSOaJCnO+EGygFbv#Ar^Q|2BMvmZMvp7056Pb;E(8!8c(uW7%Kv*b+rdt?j|g3bd@$7Nc225TqrS4Jix-|h}b zq%#}vV>t;-CCcwjyx2mH)mrsXch`g)3oRHemW+XDq*7Ztay@%O^FQ;My~e}){xp=H z8=PrxCzPI;mV)}|OQyiV9?T1?=P5%`XrcG7^gO(!VPO$GeGrx*FfKi|CxSD2$#tXyK?>VALeC)$P3wZkhu8fZQ4>Kt_6}jp1tU?1d4u?Xy2x>y$BmQVOLvW+cS6EG` za)z3SZ_K;m`s9HhC1a7#1!+ZEA#vb0h(ec4A5X3WRPW@@q~QL z9puCU4;23*FgT&U7^I(W_}sA)+HF^cM3c*cTN|bIn}BuPy2NNQR1}k_G$l2 zX5MQh?;>n@hg1g+HX170B;gS&NzF{o$N^lQ3cvY*^Wc#2A;%iU?|+E;G+RB}kbi&n z^dvK2cRf490aA^TL>BWN6*wWnx6ZNfZBE2;0c!0D>J^m>C4po}N&tnSyib2I{$skC zrY%PAFw{S|S{1K14y`^Im8R3%JA2|Pn-KyLl&`4nwV&j967+BwW8sxQOfoWn$lN+3 zQ#};2wRjc$W)zzOgxU3KMRn+1*daWbvAyVy+2Y7+f8gQmlE3UWZUVl?62tL~1dT%i zd6IlbY(y30U*>m)TqWo2h3lScXN#Cv3e-()*@qv;Yqdk89S>}U$Tx;mnN!hZt5iju zMN9~7aCpNo7-`1o94_`0dv&!s79s$-Hx9M7#O8N;K%w<7CR|3pm~Y}8w)7EU${!rV z7MsiOp9A4j<8$@VgF+AZO|e-nE}$4eJF&Wkxw|Kd24)o@JswW_Rs4ya@0QNTJvSop z&k(ykx%#u^u|571+EP3fHJOIyf^&_3J?AVowTY-1);Bmg);|+F?Jgahrc$Tf(pfW4 z?&@v%RL_0Fjd5snfUdoF{yKg%5R2f&J|*xfDhHtXO7%dzYs--*=w$7yt;5EojEK&6 zzIHFw>R?5YKA9GY2A20|!PUn7-vW;Im%BeUckfP=xxT3V_TA|IWJAGUr*>-chA;a% zKNuhmKQ83+=)2!MYgSF(EHSXrr+6`Nzhjh$p4UHT(`|BYqdAD2Vg)nYsOH|lcY$5S zk4^mr0CQPYU|D^>*7RAy28pxG6fBRnzdAZTjpTlyPX9%@L#Ixx+!yPk=}6dlFvF45 zM9kvmVn$p_gb>cj{9`d?P-9-Jx$x2Z4Xup?xjrRCwEAEswNS~3T#Lctj9;G64`s$>gdvcjnu%e*(pm- z@gwnrG?BP{YdDwlXy|fl^^a4}q()Xbw@b-03Q3j0mwy*d2nkInYPa64<$0~c=|!Ne z1pVzNVjScCS&X1chJo%a6gjs}j$$FG$WbxS;||RB)!kB(`u;~beUD#j??`^wCdy+i z2Po0pm!hRX8_TogX+(X7|bFqoM&(6Su8qXvV>?a-lrOr)FALcO+DIh$`!&Q)n79Fm z?-nAW`pDWKw3qL;oW>j2b#y4lsDM3o{7_?PExK)9933_vtIGI1gEbNNDMGM?n^l03 z70*05HmKpLRZ;qwCO?+aCF{+} z)8J*?ZkTXQjm;#N;TmH0tDIkJWKcAh*Z7n`ss3r`LT5&)+=j=|x$Z~x!Dl-V4Fb+( z{D3EiF}?DVR&02DodUr}N8{QK<)RgA#vaz9)}k8r*e0lZHWEhN`F{Pz=7T)|>wG^x z!2pv3uOAVcS1E$9tB%%aOgxBPK_YE-iCQt3iiC#v|> z6f`t`o=fxGzaK-QpR$0T@1ZUkp!BgGY+*RvI#SYO$Qo}x$~?*%FGc*r!);slc}sCU zOf^M6RLMfr;=F%`T8B4$i4rn-o36f6DrI0jRFKXWn%WuUtwT22>bDawvGiATt_!3X=Nfuv&sTmiQ!Wj(sdHhkJ`4Xu8l&65ld0VEzW?W;A9 z(Q(IB8wx4r!$C0}pXe-{_YvHza^cBII{_)qUdDEzWPRBhO?QgV_38QNh*`B3I{ftm z`LI5#MJ-|-NqRNP@9enjDhsQaQRI`&C;l`+FZ(2^t)&z|R=_603TXQE+asTOd5iMP zxLde)aS^<1mHCT-<_Ht~2}s}F*L;>4UeLTy&A?Un^PpaoYwe<-Wv9oY&;_K+jISB$ zr*TkhOqQL?2Z|Ap{Vi>vUa1<>lp0L4l~|jy)v=nHSy-CyOfmYaG{q3%7Ek*z?Me6u9EV}yVMlNQ7mJh0e}TvO=Y4tl?)}fv zY^GNBrHej)eT>Y2L=5yx6ot6q+4B3&omOP%Md~X((ffjW@z7q_WbWBEE2>0k+!uQm z4eBM>QJIab-N)MosGPAn>%HE-B=rx zZRk2Zp4kyo>q#gi>uxwcM#yZNVB5v__*dpu4G$^b57W#WGlN?KV?Bc!2|mlNlZClq z(Bk-&z?jDThgjebZ$q&v3t{!b?`pDZ%!sTv0IR#LXpuR%faCaAJ{Cqs3}%utq})!} zuJdj_==g0NH+kyHqZQ5>OxV`v9FjPue%{3-C-%*@m0m-?-CGexp7Iznr&aYtg@}fr z6HM7$52nBzD&Azk(YmPVErX%X#P(=~O~_gIDD1IF_zc*Fuw@I0D!bs%&re0%St4?C zqbSbS9)B7&o7j>4lS*4!W3hA(pRAjOO|^typ;kZET2Meub2d#AS@I@VRxO4lx*zWg zax~W>axBqjO3zePg>-(A`fp=ir1mJ!5S10fZ$pv^VsZ)~{{E}e2{;Zf$$E8JkNzMg z;HdnlXnPXfJHvO3dZOIDMq&56w>s^9OaZyY(uRbsima@PkCloXM;W0AGEa=7Y4z{jD&fzll;^EM3`VyrGz)26c_)PbP=F-&GT$T)eL&Y3x^_=e^@E)=U|1laXXv>OH~?&$VzZFaG7}W~Yp!@?2`Y;}v%DLrM^4 zAAWKI*t87JHZXXBK{=cy!h3HZ$4PINs^T`r3$^=%K)x}C4=Y#UiQ7ssuEkw7c@1%} zOmd=Q!fP^p%E0J3e*R`eep5MpS-F~bW$A}H@(Q9Uea^yCJz>-LmNPhX!t$k&wkEQ& zCSuxc#?)oF{HVJc3HL=L-4pcczqtn@Qz;J?gy;jl(r_}FI4kUq;cDUh(o+DdWTB5} zf17Y@0ydUrRBM&V*$24#Ir{qs9!c10S5#K}x#S;wAs6tO@k$-l<+%Ic%e>-??K@Q4 zyB`gR&noLYx^NSp1al5C=$1CCYinzKb3F`SrRXql@TjhE_NcDiwmPv(?Rt54o4oBQ zxsjf8R-8slE{(ew*yj-EXv^c#DuCvoC)a=~dqQ@6Li}4tMUJFwCB%S(AxO4XB{W{t z^J^(&ODis_0P1tA=v~A=HG}^?!A2ly+E8yAdH?(PTGL8NO_Rcp;H>mLiRrrFI$?p~ zZJ2dO1WOc)&Ru-=x`!blQl{wsVU>aMS*<}q7AtsnK9)1G*@uQTI<-E1jUCx_cY1+G z2l=%R;UvSeoX=(Yb;G`VN{wBl;80w@U+7Qcvd^psA&Jy#mo!ss>p2d9Dzg42vp^xy z)#VdQV<&Kr)mx^+*nYlbliIA+f$n^%D~z3}phMhWXu2ZUb+}wKQv7GX+~6L=BECf) zNzbAe-AELnE|svwx)$9wq{W<^G{l-(O(_jrHOMQg(U-W~z< zhl#FdO%K)_V?^l`0M{_jsm?vy6G?2lmBu7#Zi<8y*=OT<>x2Tw_Jdy{Bwf_WLZn^> z`!8yij1R1GHM93Gex}M{xUc+Tb`JyR@KebaPt*R|3(e5DG0wU3Z`8-7DIi810b|i_ zTAELS{^w0X(Mg=re%Uhi;qiJSt>pz?h+6~aOs-zzJJFVQcYrTRIc#6pzZ*qHc%qhF z7}U9%Tb_80Mp+=SG<(_ISnTXYl`|B`5rDGFt%S(!meW5eLn)Oy%{3*|#HhuQuj9M7 zD&8%bsT!zqaB)Ow{4Q}T@D9(f&>O|K&$o!!mNJj;uYL%Dd-%TEurrIgRfgjzrNxYY zSH$5SdkgAYK;rX~S;&!863hK+qOq>Au-*4*G*w|nol@O7sxruNd4raM@p*7`b^U9J zpYzAfPo`o+K9RN)J5FJ>m++JQip-aCGE)aIHC-JKQ(`(u$;&d*Hf zj@gHnM72G3QgCvw&{!ywrYYS|R$_4>F4hep3;O(i>t%Bc{_2ZGmh+r+Wk9q@d$Ny1 z&JTlVhF5BIY>8&rYd$zijO?-I1?ggNYP2V8KBcLP%+x@;0;hM?#%8szVYN@k&sV$w zd^dPui|Nk+V7BjGW))BgcYMpv`GR4HW|uwfML>9zFJwKA6p;r$e}EzC>P3_^(30XYcq9 zirI|eZ|)N%sPHDgn239(*su|N_)OU_(JvBawRn)@@FMSBE^}cdlzr@wc*Q-ik?A9!?)`9K12!W0&kj% zZ&A_!VTbGWa@Hojnnujj3RErNrY5FxyI&tm`@h;HKFYW5cUFBZrg~aoJ2%N0+}tpQ zJH!}_>&odvm)D4npJ(74g06$!*bzLv=DtOPY#x&fqcxcK+!0svh>WKrm>i}U`-Rm$ zN3QhpfV8Ez>?>{rf%fP2rnBj>bUfeCj;T~>;0Ml19nPkR2zH0SJ2{R#*xAVENEY@4 ze0PgL+v@xvezgZ~Z$X$69A=zczg%6U{Gz1MSA6dAPYmdzzd?4XzjZ(#517tuE|wEy zch>8(q#La8C!x^gX-IHu#I2|zA1P9v-;6e<+|FyWiyQ97SDf|BMWw)WB0y>G zJ5UkyedhL2`*(-{*PQs_6MJM=>{yy~XOm8L*^sua#z*DRL;W(<-tJ+hdr-c5tH5I6 zi`WoK+aG@o<9NH2jMzR&$~MNUO>${un631_pmJtBVANO~T*~y;&(_RS>*tfxRtc2w zsB0CTEx)~I{uFo-x^H7<*pl+RMdQtA$pFAPv!XchQ=V+k^6>52aHbxA?e4m^K}H5& z`Uld|=6;P8^N@(Z#_4p`@Pe(KbZZCMOquMB+SaokMxz(ES0vDaaAGqjJJ9?aJs-63 zEi@0&SZ|2Pf0W4U2&Ql$o(tWJ;`Thn7gu~x-6&yPA*}h=c)EIoo?|z8xAUVj>SZ&~ z5q^dhB`C>R`^W9{WlJk11x52k-!D;_(1&3vgi8WgqDxs{+=6x9sfH6Ej!Qb?aijy7OH#FpaOL;E%rv@MFo zp8Pgw<@T`N{Jfa^C)8kF#xhij@rY#S2m5A_Tj=aturOm`KxWhVZ`69G9p4iwAU{l^ zuW+F1Ji9V;w#R!7X))V_tMH(`Zt~sq@M)1bop8uKT;BZQug}EcRbt`>PUj>I$&w9m z;&U7hWF+)ueJUnSwiZZnVLiGB(8GgEwvghya0mEsv7;oY&gbCNQs3MyM>z!9@Gk?zc(2X`@XfP;L zTRDgIx)r5!nKku3^IUC9gx|#{;dX{7lhCHj{7z1tKw3R=U_D@ixlp`Ml5;z#>^11f z{uB1c4eoQn4VD%qtS38RqO#(hy0a-Z5K51MUPt=ki6~1&GS^`cf2#!j4nPsm%0bol zz%7EaQA;rW8+iyO$)oWwC$750VXY$WfT zT+q$yy+NE4{MKjT|KyqD`v*u6(yIReW^Nv|sPehBV&d>ETkQ2t2A13U#I%3>=(vg+ z>KX#G#=qxSkv*7|DarNNp6@&9(=E#KWI_`>+77#tea;jb+34-*asSzX^YMUDgc?_5PzVng zHL9yJFbD=g79KMJ5Eu`NY~$)qDBmUD#1$Ee90HEw*tjBt!XcMz5m#hz9uVY)1H5q1 zbq9Fis7Ro&01Ev--a~mImvkUk6!JoO!8Z(}*4$io8is&elCoUELLsQ1>oPEy??3%6 z?V}n52EDEj1c!jH%b-v=2t^lh+5UAJj<^{a2n=)s3x+_hPZtOdKp-dziz^C22*m#~ z5*Xq-7z&0WP(&x!u{Q<+2BRkGT0ba+_y0PB8vnl|0rOsR-CR+K0`pxDAsB+VIXVdZ ze@Qa-N+A=z8iT2=0$-1Gw=T> zhC&d)CCANGBRnA3^-!b0H>QLK1V>zt3>3n5GiP{Ehr~4-JfQ#Q4DfIGd3X?)3`AF* zf$;I&knupE*QW`Eg+^&HU$P1P+YzmhMp${^my7SN7(s#gu7?!@<%3)q9SQ-3 z^4u_t5?yltTsGi;vL6M8U5~Kcs8b5;Di{PpkkwN9}jqHc>Kp`l$+pA!dFE=kB zC_11UQQ+mdZW((E2YM6&#W}?-BSEh#$SWZ#4ugn8Bq0z82m*m2;JlKO;!<#N qDJg^~1SBT>|L>uHNz&!wN@ncr>gjB5feYtDoxyOKnI#paaQ_c09NV-2 diff --git a/tzpfms.ps b/tzpfms.ps index 58d48b5..877aca6 100644 --- a/tzpfms.ps +++ b/tzpfms.ps @@ -1,15 +1,15 @@ %!PS-Adobe-3.0 %%Creator: groff version 1.23.0 -%%CreationDate: Sun Mar 3 20:01:18 2024 +%%CreationDate: Mon Mar 4 11:34:36 2024 %%DocumentNeededResources: font Times-Roman %%+ font Times-Bold %%+ font Courier-Bold %%+ font Courier-Oblique %%+ font Courier -%%+ font Times-Italic %%+ font Symbol +%%+ font Times-Italic %%DocumentSuppliedResources: procset grops 1.23 0 -%%Pages: 15 +%%Pages: 10 %%PageOrder: Ascend %%DocumentMedia: Default 595 842 0 () () %%Orientation: Portrait @@ -237,8 +237,8 @@ setpacking %%IncludeResource: font Courier-Bold %%IncludeResource: font Courier-Oblique %%IncludeResource: font Courier -%%IncludeResource: font Times-Italic %%IncludeResource: font Symbol +%%IncludeResource: font Times-Italic grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72 def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef @@ -276,372 +276,15 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-ADD-B)72 48 Q -.4(AC)-.35 G 42.103 -(KUP\(8\) System).4 F(Manager')2.5 E 2.5(sM)-.55 G 39.602 -(anual ZFS-FIDO2-ADD-B)-2.5 F -.4(AC)-.35 G(KUP\(8\)).4 E/F1 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-add-backup)108 96 Q F0 2.5<8a61>2.5 G(llo)-2.5 E 2.5(wa)-.25 -G(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F1(SYNOPSIS) -72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0(After)108 153.6 Q/F4 10 -/Courier@0 SF(zfs-fido2-change-key)7.564 E F0 5.064(\(8\) deri)B -.15 -(ve)-.25 G 7.563(st).15 G 5.063(he k)-7.563 F 5.363 -.15(ey f)-.1 H -5.063(or a dataset from a FIDO2 de).15 F(vice,)-.25 E F2 -(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15(xe)-.15 G -(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G -(umber of additional de)-2.5 E(vices.)-.25 E .273(First, the wrapping k) -108 182.4 R .574 -.15(ey i)-.1 H 2.774(se).15 G .274 -(xtracted as normally during)-2.924 F F4(zfs-fido2-load-key)2.774 E F0 -.274(\(8\), then a credential)B 1.604(is made as-if during)108 194.4 R -F4(zfs-fido2-change-key)4.104 E F0 1.604(\(8\) \(e)B 1.604 -(xcept the "primary" de)-.15 F 1.603(vice and all the ones)-.25 F .185 -(holding backups are e)108 206.4 R .185(xcluded from the search\); ho) --.15 F(we)-.25 E -.15(ve)-.25 G .985 -.4(r, t).15 H(he).4 E F4 -(hmac-secret)2.685 E F0 .185(is instead used as a sym-)2.685 F 1.555 -(metric AES-256-GCM \()108 218.4 R F4(EVP_CIPHER-AES)A F0 1.555 -(\(7ssl\)\) k)B 1.855 -.15(ey t)-.1 H 4.055(oe).15 G 1.555 -(ncrypt the wrapping k)-4.055 F 1.855 -.15(ey d)-.1 H 1.555 -(irectly with a).15 F(random IV)108 230.4 Q(.)-1.29 E(This turns the)108 -247.2 Q F4(xyz.nabijaczleweli:tzpfms.key)2.5 E F0 -.25(va)2.5 G -(riable into).25 E F3(salt)108 259.2 Q F2(:)A F3(credential-ID)A F2(:)A -F3(credential-public-key)A F0([)A F2(.)A F3(backup-salt)A F2(:)A F3 -(backup-credential-ID)108 271.2 Q F2(:)A F3 -(backup-credential-public-key)A F2(:)A F3(IV)A F2(:)A F3(encrypted-key)A -F0 1.666(]...)C F4(tzpfms.key)108 288 Q F0 2.238 -(is actually a dot-separated list of de)4.738 F 2.238(vice b)-.25 F -4.738(undles. The)-.2 F 2.239(\214rst one is as-described in)4.738 F F4 -(zfs-fido2-change-key)108 300 Q F0 5.181(\(8\). Subsequent)B 2.681 -(ones also include \(identically-encoded\) IVs and en-)5.181 F -(crypted blobs.)108 312 Q F4(zfs-fido2-load-key)108 328.8 Q F0 .081 -(\(8\) shops assertions around de)B .081(vices in a de)-.25 F .082 -(vice-major order \212 depending on)-.25 F(de)108 340.8 Q -(vice numbering, a backup may be loaded e)-.25 E -.15(ve)-.25 G 2.5(ni) -.15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.)-.25 E F1 -(ENVIR)72 357.6 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 -(TZPFMS_PASSPHRASE_HELPER)108 369.6 Q F0 .046(By def)133 381.6 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 393.6 -Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G -1.596(ill be run via)-4.096 F F4(/bin/)4.096 E F2 3.262(sh \255c)B F0 -(to)4.096 E(pro)133 405.6 Q(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 422.4 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 434.4 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 446.4 Q F0 -(Pre-formatted noun phrase with all the information belo)160 446.4 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 458.4 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 458.4 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 470.4 Q F0("ne)160 -470.4 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 482.4 Q F0("ag)160 482.4 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 499.2 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -511.2 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 528 R(En)87 540 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 552 Q F0 -(If set, enables lib\214do2 deb)173 552 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 568.8 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 580.8 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 592.8 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 609.6 R F0 -(The lib\214do2 documentation at https://de)108 621.6 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 638.4 R -F0 1.6 -.8(To a)108 650.4 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 662.4 Q F0(ThePhD)7.5 E F1<83> -128 674.4 Q F0(Embark Studios)7.5 E F1<83>128 686.4 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 698.4 Q F0(EvModder)7.5 E F1(REPOR)72 715.2 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 727.2 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 744 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 756 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 2 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 -SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) --2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) --2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 -124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF -(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 -2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 -(,)A F2(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) --.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 -(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.244 E F0 -.1(wa) -3.244 G 3.244(sp).1 G(re)-3.244 E .743(viously encrypted with)-.25 F F2 -(fzifdso)3.243 E F0 .743(and the)3.243 F F1(FIDO2)3.243 E F0 .743 -(back-end w)3.243 F .743(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 -(Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 -(ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.465(xt, a ne)-.15 F 2.965(wc)-.25 G .465 -(redential of type ES256 is generated on the de)-2.965 F .464 -(vice \(with relying party ID)-.25 F F5(fzifdso)2.964 E F0(and)2.964 E -.499(name equal to the dataset name\) with the)108 264 R F5(hmac-secret) -2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 -(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 276 Q -(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ -n, the credential is asserted with a 32-byte random salt, which hashes \ -it with de)108 292.8 R(vice-pri)-.25 E -.25(va)-.25 G .962(te data,).25 -F .137(and thus generates the wrapping k)108 304.8 R .438 -.15(ey \()-.1 -H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) -2.638 E F0 2.638(\)\). This)B .138(mimicks a)2.638 F -.8(We)108 316.8 S -(bAuthn login step.).8 E(The follo)108 333.6 Q -(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -345.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> -128 357.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 -(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 369.6 Q F0 -([)A F2(.)A F0 1.666(...)1.666 G 1.666(]...)-1.666 G F5(tzpfms.backend) -108 386.4 Q F0 2.708(identi\214es this dataset for w)5.208 F 2.707 -(ork with)-.1 F F1(FIDO2)5.207 E F0(-back-ended)A F2(tzpfms)5.207 E F0 -2.707(tools \(i.e.)5.207 F F2(fzifdso)108 398.4 Q F5 -(zfs-fido2-change-key)60.227 E F0(\(8\),)A F5(zfs-fido2-load-key)56.728 -E F0(\(8\),)A F5(zfs-fido2-add-backup)108 410.4 Q F0(\(8\), and)A F5 -(zfs-fido2-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 427.2 Q F0 -.486(is a colon-separated tuple of unpadded URL-safe base64 blobs; the \ -\214rst one is the ran-)2.986 F .217(dom salt; the second represents th\ -e ID of created credential, and the third \211 its public k)108 439.2 R --.15(ey)-.1 G 5.217(.T)-.5 G .217(here e)-5.217 F(xists)-.15 E -(no other user)108 451.2 Q -(-land tool for deciphering this; perhaps there should be.)-.2 E -(Finally)108 468 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 -G 9.506(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 -(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 480 Q -F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F -(to clean up the properties, or to issue a note for manual interv)108 -492 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 508.8 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.555 E F0 -6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 520.8 R .729 -(ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 532.8 Q F2(zfs-fido2-clear-key)5.147 E F3(dataset)8.647 E -F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F -10.312 E F5(keyformat=passphrase)108 544.8 Q F3(dataset)6 E F0 -(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-fido2-clear-key)108 561.6 Q F3(dataset)7.606 E F0 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 573.6 Q F1(OPTIONS)72 590.4 Q F2109.666 602.4 Q -F3(backup-file)6 E F0(Sa)203 602.4 Q .353 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 614.4 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 626.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 638.4 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F1(ENVIR)72 655.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 -E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q F0 .046(By def)133 679.2 R -.045(ault, passphrases are prompted for and read in on the standard out\ -put and input streams.)-.1 F(If)5.045 E F5(TZPFMS_PASSPHRASE_HELPER)133 -691.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw) --4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.096 E F2 3.262 -(sh \255c)B F0(to)4.096 E(pro)133 703.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 720 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 -(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E(fzifdso 0)72 817.889 Q -(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 2 3 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 124.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(FIDO2 back-end con\214guration)72 153.6 R(En)87 165.6 Q(vir)-.4 E -.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 177.6 Q F0 -(If set, enables lib\214do2 deb)173 177.6 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 194.4 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 206.4 R -.727(vice which supports the)-.25 F F1(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 218.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 235.2 R F0 -(The lib\214do2 documentation at https://de)108 247.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 264 R -F0 1.6 -.8(To a)108 276 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F2<83>128 288 Q F0(ThePhD)7.5 E F2<83>128 -300 Q F0(Embark Studios)7.5 E F2<83>128 312 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F2<83>128 324 Q F0(EvModder)7.5 E F2(REPOR)72 340.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 352.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 369.6 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 381.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(2)183.837 E 0 Cg EP -%%Page: 1 4 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 -F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.588 G -.25(ew)-3.587 G -1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G -(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 -108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(FIDO2)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 -201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 -(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) -14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 -213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-fido2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(ENVIR)72 247.2 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .045 -(By def)133 271.2 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.596(is set and nonempty)4.096 -F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 295.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 312 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 324 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 336 Q F0 -(Pre-formatted noun phrase with all the information belo)160 336 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 348 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 348 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 360 Q F0("ne)160 360 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F4($4)143 372 Q F0("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 388.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -400.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 417.6 R(En)87 429.6 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 441.6 Q F0 -(If set, enables lib\214do2 deb)173 441.6 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 458.4 Q .625 -(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 470.4 R -.726(vice which supports the)-.25 F F4(hmac-secret)3.227 E F0 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion is shopped around to e)108 482.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 499.2 R F0 -(The lib\214do2 documentation at https://de)108 511.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 528 R -F0 1.6 -.8(To a)108 540 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F1<83>128 552 Q F0(ThePhD)7.5 E F1<83>128 -564 Q F0(Embark Studios)7.5 E F1<83>128 576 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F1<83>128 588 Q F0(EvModder)7.5 E F1(REPOR)72 604.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 616.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 633.6 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 645.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 5 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) --.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F -(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 -/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G -(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.141(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.641 E F0 -.1 -(wa)3.641 G 3.641(se).1 G 1.141(ncrypted with)-3.641 F F2(tzpfms)3.641 E -F0(back)3.641 E(end)-.1 E F1(FIDO2)3.641 E F0 3.641(,a)C 1.142 -(sserts the preserv)-3.641 F 1.142(ed chal-)-.15 F(lenge, HMA)108 165.6 -Q(Cking the salt with the on-de)-.4 E -(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) -.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF -(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) -.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 -(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G -3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 223.2 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .045(By def) -133 264 R .045(ault, passphrases are prompted for and read in on the st\ -andard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.596(is set and nonempty)4.096 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 288 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 304.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 340.8 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 352.8 Q F0("ne)160 -352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 381.6 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666(SPECIAL THANKS) -72 410.4 R F0 1.6 -.8(To a)108 422.4 T(ll who support further de).8 E --.15(ve)-.25 G(lopment, in particular:).15 E F1<83>128 434.4 Q F0 -(ThePhD)7.5 E F1<83>128 446.4 Q F0(Embark Studios)7.5 E F1<83>128 458.4 -Q F0(Jasper Bekk)7.5 E(ers)-.1 E F1<83>128 470.4 Q F0(EvModder)7.5 E F1 -(REPOR)72 487.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 -499.2 Q(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 516 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 528 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 6 -%%BeginPageSetup -BP -%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([) -2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E -/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A -F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 +/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 @@ -683,28 +326,26 @@ listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R -18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 +(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666 -(zfs-fido2-add-backup \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 -(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) -108 583.2 Q F2 1.666(zfs-fido2-add-backup \255b)6 F F1(TPM2)6 E F4 72 -(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 -(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-fido2-add-backup \255ra)6 F F3(tarta-zoot)6 E F4 72 -(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 -(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 -(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 -(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) -108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 -(zfs-fido2-add-backup \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 +24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 +559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 +F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F +6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) +108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R +18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 +(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) +54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q +F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) -108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-23-g984c5d5)72 817.889 +108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-24-g52a4871)72 817.889 Q(December 4, 2022)83.023 E(1)183.842 E 0 Cg EP -%%Page: 2 7 +%%Page: 2 2 %%BeginPageSetup BP %%EndPageSetup @@ -719,9 +360,9 @@ BP E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q(December 4, 2022)83.023 E +-.25 E(tzpfms 0.3.4-24-g52a4871)72 817.889 Q(December 4, 2022)83.023 E (2)183.842 E 0 Cg EP -%%Page: 1 8 +%%Page: 1 3 %%BeginPageSetup BP %%EndPageSetup @@ -730,193 +371,192 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 -E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.867 -.8(To n)108 153.6 -T 1.267(ormalise the).8 F F3(dataset)3.767 E F0(,)A F2 -(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.177 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 +(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T +5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 +E F0 5.266(will open its encryption root in its stead.)7.766 F F2 +(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E +(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) +-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 +(data will be silently cleared.)108 211.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 +(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q +.294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 -(\), and sealed)B .585(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 264 R .886 -.15(ey w)-.1 H .586 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q +(\), and sealed)B .586(on the TPM; the user is prompted for an optional\ + passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 333.6 Q F0 .292(identi\214es this dataset for w)2.792 F .291 -(ork with)-.1 F F1(TPM1.X)2.791 E F0(-back-ended)A F2(tzpfms)2.791 E F0 -.291(tools \(namely)2.791 F F5(zfs-tpm1x-change-key)108 345.6 Q F0 +108 321.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 +(ork with)-.1 F F1(TPM1.X)2.792 E F0(-back-ended)A F2(tzpfms)2.792 E F0 +.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 333.6 Q F0 (\(8\),)A F5(zfs-tpm1x-load-key)2.5 E F0(\(8\), and)A F5 -(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q F0 -1.412(is a colon-separated pair of he)3.912 F 1.412 -(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .868 -(\214rst one represents the RSA k)108 374.4 R 1.168 -.15(ey p)-.1 H .867 +(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 350.4 Q F0 +1.412(is a colon-separated pair of he)3.913 F 1.412 +(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 +(\214rst one represents the RSA k)108 362.4 R 1.167 -.15(ey p)-.1 H .868 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 386.4 Q 1.413(vided, or the SHA1 constant)-.15 F F5 -(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.914 E F0 3.914(;t)C 1.414 -(he sec-)-3.914 F .379 -(ond represents the sealed object containing the wrapping k)108 398.4 R +.15 F(pro)108 374.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 +(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 +(he sec-)-3.913 F .379 +(ond represents the sealed object containing the wrapping k)108 386.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.72(.T)C 1.72 -(here e)-6.72 F 1.721(xists no other user)-.15 F 1.721(-land tool for) --.2 F(decrypting this; perhaps there should be.)108 422.4 Q(Finally)108 -439.2 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506 -(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 -(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 451.2 -Q F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 398.4 Q F0 6.721(.T)C +1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 +(-land tool for)-.2 F(decrypting this; perhaps there should be.)108 +410.4 Q(Finally)108 427.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F +-.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F +17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 +(keyformat=raw)108 439.2 Q F3(dataset)6.107 E F0 .107 +(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 +(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 +(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -463.2 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 480 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.555 E F0 -6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 492 R .729 +451.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 468 +S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 +6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 +(command succeeds, all is well, b)108 480 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.147 E F3(dataset)8.647 E -F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F -10.312 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 +-.2 F(with)108 492 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E +F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F +10.313 E F5(keyformat=passphrase)108 504 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.606 E F0 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q -F3(backup-file)6 E F0(Sa)203 573.6 Q .353 -.15(ve a b)-.2 H .052 +F2(zfs-tpm1x-clear-key)108 520.8 Q F3(dataset)7.607 E F0 1.607 +(can be used to clear the properties and go back to using a)4.107 F +(passphrase.)108 532.8 Q F1(OPTIONS)72 549.6 Q F2109.666 561.6 Q +F3(backup-file)6 E F0(Sa)203 561.6 Q .352 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 585.6 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .639(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H +E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 +F .694(This back-up)203 573.6 R F4(must)3.194 E F0 .694 +(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 585.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 597.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 614.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .638(Bind the k)203 614.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 -3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .638 -(hange, the wrap-)-3.139 F .462(ping k)203 638.4 R .762 -.15(ey w)-.1 H -.462(ill not be able to be unsealed.).15 F .463 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) +3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 +(hange, the wrap-)-3.139 F .463(ping k)203 626.4 R .763 -.15(ey w)-.1 H +.463(ill not be able to be unsealed.).15 F .462 +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 638.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q -F0 .046(By def)133 691.2 R .045(ault, passphrases are prompted for and \ -read in on the standard output and input streams.)-.1 F(If)5.045 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.595(is set and nonempty)4.095 +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 655.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q +F0 .045(By def)133 679.2 R .045(ault, passphrases are prompted for and \ +read in on the standard output and input streams.)-.1 F(If)5.046 E F5 +(TZPFMS_PASSPHRASE_HELPER)133 691.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 715.2 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 703.2 Q (vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 732 R +(The standard output stream of the helper is tied to an anon)133 720 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-23-g984c5d5)72 +133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 +(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E(tzpfms 0.3.4-24-g52a4871)72 817.889 Q(February 28, 2024)83.018 E(1)183.837 E 0 Cg EP -%%Page: 2 9 +%%Page: 2 4 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 36.913(ZFS-TPM1X-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 34.412(anual ZFS-TPM1X-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q +-2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 136.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +-2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 124.8 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B +(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 -177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.73 E F0 .23 -(suite connects to a local)2.73 F F1(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F1(localhost:30003)2.729 E F0 2.729(\)b)C 2.729 -(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 F(the)2.729 E(en)108 201.6 -Q(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .11(The T)108 218.4 R(rouSerS) --.35 E F1(tcsd)2.61 E F0 .11(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E -F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 -E F1(/dev/tpm)2.611 E F0 2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1 -(py)108 230.4 S(ing one of the earlier ones with, for e).1 E +1.666(TPM1.X back-end con\214guration)72 153.6 R .625(TPM selection)87 +165.6 R F0(The)108 177.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 +.229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 189.6 Q +(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 206.4 R(rouSerS) +-.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +218.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 247.2 R F0(The T)108 259.2 Q +(See also)87 235.2 R F0(The T)108 247.2 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 -(The TPM 1.2 main speci\214cation inde)108 276 R 6.915(xa)-.15 G 6.915 +(The TPM 1.2 main speci\214cation inde)108 264 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 288 Q F2 1.666 -(SPECIAL THANKS)72 304.8 R F0 1.6 -.8(To a)108 316.8 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 276 Q F2 1.666 +(SPECIAL THANKS)72 292.8 R F0 1.6 -.8(To a)108 304.8 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 328.8 Q F0(ThePhD)7.5 E F2<83>128 340.8 Q F0 -(Embark Studios)7.5 E F2<83>128 352.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E -(https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E F2 1.666(SEE ALSO)72 439.2 R F0 -(PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E +.15 E F2<83>128 316.8 Q F0(ThePhD)7.5 E F2<83>128 328.8 Q F0 +(Embark Studios)7.5 E F2<83>128 340.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F2<83>128 352.8 Q F0(EvModder)7.5 E F2(REPOR)72 369.6 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 381.6 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 398.4 Q +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +(https://lists.sr)108 410.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E F2 1.666(SEE ALSO)72 427.2 R F0 +(PCR allocations: https://wiki.archlinux.or)108 439.2 Q(g/title/T)-.18 E (rusted_Platform_Module#Accessing_PCR_re)-.35 E(gisters)-.15 E -(and https://trustedcomputinggroup.or)108 463.2 Q +(and https://trustedcomputinggroup.or)108 451.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ -r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q -(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q +r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 463.2 Q +(able)-.8 E(1.)108 475.2 Q(tzpfms 0.3.4-24-g52a4871)72 817.889 Q (February 28, 2024)83.018 E(2)183.837 E 0 Cg EP -%%Page: 1 10 +%%Page: 1 5 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 45.793(ZFS-TPM1X-CLEAR-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 43.292(anual ZFS-TPM1X-CLEAR-KEY\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.008 G -.25(ew)-3.008 G +(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(TPM1.X)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q +(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G +(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM1.X) +2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F -.25(va) +-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E +/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 +(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm1x-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1 1.666 (TPM1.X back-end con\214guration)72 247.2 R .625(TPM selection)87 259.2 -R F0(The)108 271.2 Q F2(tzpfms)2.729 E F0 .229 -(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 283.2 Q -(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 300 R(rouSerS) --.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -312 S(ing one of the earlier ones with, for e).1 E +R F0(The)108 271.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 300 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 312 S +(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 328.8 R F0(The T)108 340.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -931,11 +571,11 @@ F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F1<83>128 446.4 Q F0(EvModder)7.5 E F1(REPOR)72 463.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q(December 4, 2022)83.023 E(1) +E(tzpfms 0.3.4-24-g52a4871)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP -%%Page: 1 11 +%%Page: 1 6 %%BeginPageSetup BP %%EndPageSetup @@ -944,15 +584,15 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 -(wa)2.69 G 2.69(se).1 G .19(ncrypted with)-2.69 F F2(tzpfms)2.69 E F0 -(back)2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .191(will unseal the k)2.69 F -.491 -.15(ey a)-.1 H .191(nd load).15 F(it into)108 165.6 Q F3(dataset) -2.5 E F0(.)A .236 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .191 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1(wa)2.691 +G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E F0(back) +2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 F .49 +-.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset)2.5 E +F0(.)A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) -108 182.4 R .236(wnership, if not "well-kno)-.25 F .235(wn" \(all)-.25 F +108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) 108 194.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E (as set.)-.1 E(See)108 211.2 Q/F4 10/Courier@0 SF(zfs-tpm1x-change-key) @@ -960,14 +600,14 @@ Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 109.666 240 Q F0 3.208(Do a no-op/dry run, can be used e)131 240 R -.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) -8.208 E -.25(va)-.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 +8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 252 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 268.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 -280.8 Q F0 .046(By def)133 292.8 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.045 -E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.595(is set and nonempty) -4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F -F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q +280.8 Q F0 .045(By def)133 292.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.046 +E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.596(is set and nonempty) +4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 333.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -980,23 +620,23 @@ F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q 381.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F0("ag)160 393.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 410.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 410.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 422.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 439.2 R .625(TPM selection)87 451.2 -R F0(The)108 463.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 492 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 504 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 463.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 475.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 492 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +504 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 520.8 R F0(The T)108 532.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1011,11 +651,11 @@ F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 638.4 Q F0(EvModder)7.5 E F1(REPOR)72 655.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q(December 4, 2022)83.023 E(1) +E(tzpfms 0.3.4-24-g52a4871)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP -%%Page: 1 12 +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup @@ -1024,112 +664,112 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 -1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A -F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A -F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.32 -.8(To n)108 -165.6 T(ormalise).8 E F3(dataset)5.22 E F0(,)A F2(zfs-fido2-add-backup) -5.22 E F0 2.719(will open its encryption root in its stead.)5.22 F F2 -(zfs-fido2-add-backup)108 177.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E -F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.055 E F0 -.1 -(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555(viously encrypted with)-.25 F -F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .554 -(back-end w)3.054 F .554(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 -235.2 S 3.059(yw)-.05 G .559(ill be freed from the TPM.)-3.059 F .56 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 +(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) +A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) +A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.676 -.8(To n)108 165.6 +T(ormalise).8 E F3(dataset)2.576 E F0(,)A F2(zfs-tpm-list)2.576 E F0 +.076(will open its encryption root in its stead.)2.576 F F2 +(zfs-tpm-list)5.077 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 +E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G +(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 +(\(8\) for that.)A(First, a connection is made to the TPM, which)108 +194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 +(dataset)3.055 E F0 -.1(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555 +(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F +F1(TPM2)3.055 E F0 .554(back-end w)3.054 F .554(as used, the pre)-.1 F +(vious)-.25 E -.1(ke)108 223.2 S 3.059(yw)-.05 G .559 +(ill be freed from the TPM.)-3.059 F .56 (Otherwise, or in case of an error)5.56 F 3.06(,d)-.4 G .56 (ata required for manual interv)-3.06 F(en-)-.15 E -(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 -264 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 +252 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 (OPTIONS)2.794 E F0 .294(\), and sealed)B .588 -(to a persistent object on the TPM under the o)108 276 R .589 +(to a persistent object on the TPM under the o)108 264 R .589 (wner hierarch)-.25 F .589(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 288 Q 1.603 -.65(y, t)-.05 H .302 +F(wner)-.25 E(hierarch)108 276 Q 1.603 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 300 Q(The follo)108 316.8 Q +(the sealed object with.)108 288 Q(The follo)108 304.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 1.263 +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 1.263 (identi\214es this dataset for w)3.763 F 1.264(ork with)-.1 F F1(TPM2) 3.764 E F0(-back-ended)A F2(tzpfms)3.764 E F0 1.264(tools \(namely)3.764 -F F5(zfs-tpm2-change-key)108 381.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) +F F5(zfs-tpm2-change-key)108 369.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) 2.5 E F0(\(8\), and)A F5(zfs-tpm2-clear-key)2.5 E F0(\(8\)\).)A F5 -(tzpfms.key)108 398.4 Q F0 1.509(is an inte)4.009 F 1.509 +(tzpfms.key)108 386.4 Q F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 (wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 -410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +398.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 (tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B -.866(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +.866(be passed to)108 410.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) 3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) -C(r)-3.365 E F2109.666 434.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +C(r)-3.365 E F2109.666 422.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) -.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A -.448(If you ha)108 446.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F +.448(If you ha)108 434.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) -.25 G .447(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.005 +(will funxion seamlessly)108 446.4 Q(.)-.65 E(Finally)108 463.2 Q 12.005 (,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 -E F217.172 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.107 E F0 +E F217.172 E F5(keyformat=raw)108 475.2 Q F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 499.2 R .29(ention into the stan-)-.15 F(dard error stream.) -108 511.2 Q 2.625<418c>108 528 S .125(nal v)-2.625 F .125 + interv)108 487.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 499.2 Q 2.625<418c>108 516 S .125(nal v)-2.625 F .125 (eri\214cation should be made by running)-.15 F F2 1.79 (zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 (ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) -108 540 R .506(ut otherwise the dataset can be manually rolled back to \ -a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) +108 528 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 540 Q F3(dataset) 11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.204 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 +F13.204 E F5(keyformat=passphrase)108 552 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 +F2(zfs-tpm2-clear-key)108 568.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 -621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .353 -.15(ve a b)-.2 H .052 +F(ing a passphrase.)108 580.8 Q F1(OPTIONS)72 597.6 Q F2109.666 +609.6 Q F3(backup-file)6 E F0(Sa)203 609.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 633.6 R F4(must)3.193 E F0 .694 +F .693(This back-up)203 621.6 R F4(must)3.193 E F0 .694 (be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +(nt,).15 E(the k)203 633.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 645.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 662.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.425(Bind the k)203 686.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +-1.666 G 1.425(Bind the k)203 674.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C -1.424(ithin their corresponding)-3.924 F(hashing)203 698.4 Q F3 +1.424(ithin their corresponding)-3.924 F(hashing)203 686.4 Q F3 (algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.024(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 698.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G +A F3(algorithm)203 715.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) .15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") -203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +203 727.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A -F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 739.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 -(", and must be supported by the TPM.)A(tzpfms 0.3.4-23-g984c5d5)72 +(", and must be supported by the TPM.)A(tzpfms 0.3.4-24-g52a4871)72 817.889 Q(February 28, 2024)83.018 E(1)183.837 E 0 Cg EP -%%Page: 2 13 +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup @@ -1205,9 +845,9 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (and https://trustedcomputinggroup.or)108 657.6 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q -(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q +(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-24-g52a4871)72 817.889 Q (February 28, 2024)83.018 E(2)183.837 E 0 Cg EP -%%Page: 1 14 +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup @@ -1217,8 +857,8 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 -E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 +(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with)-2.5 E F2 (tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM2)2.5 E F0(:)A 5 (1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641 @@ -1286,9 +926,9 @@ F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q(December 4, 2022)83.023 E +-.25 E(tzpfms 0.3.4-24-g52a4871)72 817.889 Q(December 4, 2022)83.023 E (1)183.842 E 0 Cg EP -%%Page: 1 15 +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -1297,23 +937,23 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .864(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1 -(wa)3.364 G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E -F0(back)3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865 -(nseals the k)-3.365 F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F -(into)108 165.6 Q F3(dataset)2.5 E F0(.)A(The user is prompted for the \ -additional passphrase, set when creating the k)108 182.4 Q -.15(ey)-.1 G -2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 -10/Courier@0 SF(zfs-tpm2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2109.666 -228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 -G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i) --.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va) --.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s) -C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .864 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1(wa)3.364 +G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E F0(back) +3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865(nseals the k)-3.365 +F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F(into)108 165.6 Q F3 +(dataset)2.5 E F0(.)A(The user is prompted for the additional passphras\ +e, set when creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5 +(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF +(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 +(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 +(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 +G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) +.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 +(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 +4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F +(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 (By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ on the standard output and input streams.)-.1 F(If)5.046 E F4 (TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 @@ -1364,7 +1004,7 @@ F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q(December 4, 2022)83.023 E(1) +E(tzpfms 0.3.4-24-g52a4871)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP %%Trailer end diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 deleted file mode 100644 index 08a80cb..0000000 --- a/zfs-fido2-add-backup.8 +++ /dev/null @@ -1,125 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-ADD-BACKUP 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-add-backup -.Nd allow another FIDO2 device to unlock ZFS dataset -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After -.Xr zfs-fido2-change-key 8 -derives the key for a dataset from a FIDO2 device, -.Nm -may be executed to extend this to any number of additional devices. -.Pp -First, the wrapping key is extracted as normally during -.Xr zfs-fido2-load-key 8 , -then a credential is made as-if during -.Xr zfs-fido2-change-key 8 -(except the "primary" device and all the ones holding backups are excluded from the search); -however, the -.Ql hmac-secret -is instead used as a symmetric AES-256-GCM -.Pq Xr EVP_CIPHER-AES 7ssl -key to encrypt the wrapping key directly with a random IV. -.Pp -This turns the -.Li xyz.nabijaczleweli:tzpfms.key -variable into -.br -.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … -.Pp -.Li tzpfms.key -is actually a dot-separated list of device bundles. -The first one is as-described in -.Xr zfs-fido2-change-key 8 . -Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -.Pp -.Xr zfs-fido2-load-key 8 -shops assertions around devices in a device-major order \(em -depending on device numbering, a backup may be loaded even if the primary device is present. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html deleted file mode 100644 index e6d3444..0000000 --- a/zfs-fido2-add-backup.8.html +++ /dev/null @@ -1,153 +0,0 @@ - - - - - - - - ZFS-FIDO2-ADD-BACKUP(8) - - - - - - - - -
ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
-
-
-

-

zfs-fido2-add-backup — - allow another FIDO2 device to unlock ZFS dataset

-
-
-

- - - - - -
zfs-fido2-add-backupdataset
-
-
-

-

After - zfs-fido2-change-key(8) - derives the key for a dataset from a FIDO2 device, - zfs-fido2-add-backup may be executed to extend this - to any number of additional devices.

-

First, the wrapping key is extracted as normally during - zfs-fido2-load-key(8), - then a credential is made as-if during - zfs-fido2-change-key(8) - (except the "primary" device and all the ones holding backups are - excluded from the search); however, the - ‘hmac-secret’ is instead used as a - symmetric AES-256-GCM - (EVP_CIPHER-AES(7ssl)) - key to encrypt the wrapping key directly with a random IV.

-

This turns the - xyz.nabijaczleweli:tzpfms.key variable into -
- salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…

-

tzpfms.key is actually a dot-separated - list of device bundles. The first one is as-described in - zfs-fido2-change-key(8). - Subsequent ones also include (identically-encoded) IVs and encrypted - blobs.

-

zfs-fido2-load-key(8) - shops assertions around devices in a device-major order — depending - on device numbering, a backup may be loaded even if the primary device is - present.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 deleted file mode 100644 index 6bd3f57..0000000 --- a/zfs-fido2-change-key.8 +++ /dev/null @@ -1,186 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CHANGE-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-change-key -.Nd change ZFS dataset key to one authenticated by a FIDO2 device -.Sh SYNOPSIS -.Nm -.Op Fl b Ar backup-file -.Ar dataset -. -.Sh DESCRIPTION -To normalise the -.Ar dataset , -.Nm -will open its encryption root in its stead. -.Nm -will -.Em never -create or destroy encryption roots; use -.Xr zfs-change-key 8 -for that. -.Pp -First, a connection is made to the FIDO2 device, which -.Em must -support the -.Ql hmac-secret -extension. -.Pp -If -.Ar dataset -was previously encrypted with -.Nm fzifdso -and the -.Sy FIDO2 -back-end was used, the metadata will be silently cleared. -Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. -.Pp -Next, a new credential of type ES256 is generated on the device (with relying party ID -.Li fzifdso -and name equal to the dataset name) -with the -.Ql hmac-secret -extension requested; the device PIN, if any, is prompted for here. -This mimicks a WebAuthn registration step. -.Pp -Then, the credential is asserted with a 32-byte random salt, -which hashes it with device-private data, and thus generates the wrapping key -.Pq which is optionally backed up Pq see Sx OPTIONS . -This mimicks a WebAuthn login step. -.Pp -The following properties are set on -.Ar dataset : -.Bl -bullet -compact -offset 4n -width "@" -.It -.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 -.It -.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … -.El -.Pp -.Li tzpfms.backend -identifies this dataset for work with -.Sy FIDO2 Ns -back-ended -.Nm tzpfms -tools -.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . -.Pp -.Li tzpfms.key -is a colon-separated tuple of unpadded URL-safe base64 blobs; -the first one is the random salt; -the second represents the ID of created credential, -and the third \(en its public key. -There exists no other user-land tool for deciphering this; perhaps there should be. -.\"" TODO: make an LD_PRELOADable for extracting the key maybe? -.Pp -Finally, the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset -is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. -.Pp -A final verification should be made by running -.Nm zfs-fido2-load-key Fl n Ar dataset . -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a passphrase with -.Nm zfs-fido2-clear-key Ar dataset -.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , -and you are hereby asked to report a bug, please. -.Pp -.Nm zfs-fido2-clear-key Ar dataset -can be used to clear the properties and go back to using a passphrase. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl b Ar backup-file" -.It Fl b Ar backup-file -Save a back-up of the key to -.Ar backup-file , -which must not exist beforehand. -This back-up -.Em must -be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running -.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html deleted file mode 100644 index 68ea232..0000000 --- a/zfs-fido2-change-key.8.html +++ /dev/null @@ -1,206 +0,0 @@ - - - - - - - - ZFS-FIDO2-CHANGE-KEY(8) - - - - - - - - -
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
-
-
-

-

zfs-fido2-change-key — - change ZFS dataset key to one authenticated by a FIDO2 - device

-
-
-

- - - - - -
zfs-fido2-change-key[-b backup-file] - dataset
-
-
-

-

To normalise the dataset, - zfs-fido2-change-key will open its encryption root - in its stead. zfs-fido2-change-key will - - create or destroy encryption roots; use - zfs-change-key(8) - for that.

-

First, a connection is made to the FIDO2 device, which - must support the - ‘hmac-secret’ extension.

-

If dataset was previously encrypted with - fzifdso and the FIDO2 back-end was - used, the metadata will be silently cleared. Otherwise, or in case of an - error, data required for manual intervention will be written to the standard - error stream.

-

Next, a new credential of type ES256 is generated on the device - (with relying party ID fzifdso and name equal to the - dataset name) with the ‘hmac-secret’ - extension requested; the device PIN, if any, is prompted for here. This - mimicks a WebAuthn registration step.

-

Then, the credential is asserted with a 32-byte random salt, which - hashes it with device-private data, and thus generates the wrapping key - (which is optionally backed up (see - OPTIONS)). This mimicks a WebAuthn login - step.

-

The following properties are set on - dataset:

- -

tzpfms.backend identifies this dataset for - work with FIDO2-back-ended tzpfms - tools (i.e. fzifdso - zfs-fido2-change-key(8), - zfs-fido2-load-key(8), - zfs-fido2-add-backup(8), - and - zfs-fido2-clear-key(8)).

-

tzpfms.key is a colon-separated tuple of - unpadded URL-safe base64 blobs; the first one is the random salt; the second - represents the ID of created credential, and the third – its public - key. There exists no other user-land tool for deciphering this; perhaps - there should be.

-

Finally, the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=raw dataset is - performed with the new key. If an error occurred, best effort is made to - clean up the properties, or to issue a note for manual intervention into the - standard error stream.

-

A final verification should be made by running - zfs-fido2-load-key -n - dataset. If that command succeeds, all is well, but - otherwise the dataset can be manually rolled back to a passphrase with - zfs-fido2-clear-key dataset - (or, if that fails to work, zfs - change-key -o - keyformat=passphrase dataset), - and you are hereby asked to report a bug, please.

-

zfs-fido2-clear-key - dataset can be used to clear the properties and go - back to using a passphrase.

-
-
-

-
-
- backup-file
-
Save a back-up of the key to backup-file, which must - not exist beforehand. This back-up must be stored - securely, off-site. In case of a catastrophic event, the key can be loaded - by running -
zfs - load-key dataset - < - backup-file
-
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 deleted file mode 100644 index dd2a76c..0000000 --- a/zfs-fido2-clear-key.8 +++ /dev/null @@ -1,113 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CLEAR-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-clear-key -.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 : -.Bl -enum -compact -offset 2n -width 2n -.It -performs the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , -.It -removes the -.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key -properties from -.Ar dataset . -.El -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html deleted file mode 100644 index 46e553e..0000000 --- a/zfs-fido2-clear-key.8.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - - - - - ZFS-FIDO2-CLEAR-KEY(8) - - - - - - - - -
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
-
-
-

-

zfs-fido2-clear-key — - rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 - metadata

-
-
-

- - - - - -
zfs-fido2-clear-keydataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - :

-
    -
  1. performs the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=passphrase - dataset,
  2. -
  3. removes the - xyz.nabijaczleweli:tzpfms.{backend, - key} properties from - dataset.
  4. -
-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 deleted file mode 100644 index 247ca04..0000000 --- a/zfs-fido2-load-key.8 +++ /dev/null @@ -1,98 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-LOAD-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-load-key -.Nd load FIDO2-encrypted ZFS dataset key -.Sh SYNOPSIS -.Nm -.Op Fl n -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 , -asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into -.Ar dataset . -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl n" -.It Fl n -Do a no-op/dry run, can be used even if the key is already loaded. -Equivalent to -.Nm zfs Cm load-key Ns 's -.Fl n -option. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html deleted file mode 100644 index ffc6446..0000000 --- a/zfs-fido2-load-key.8.html +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - - ZFS-FIDO2-LOAD-KEY(8) - - - - - - - - -
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
-
-
-

-

zfs-fido2-load-key — - load FIDO2-encrypted ZFS dataset key

-
-
-

- - - - - -
zfs-fido2-load-key[-n] dataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - , - asserts the preserved challenge, HMACking the salt with the on-device - secret, and loads the resulting key into dataset.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
Do a no-op/dry run, can be used even if the key is already loaded. - Equivalent to zfs - load-key's -n option.
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
  • -
  • Embark Studios
  • -
  • Jasper Bekkers
  • -
  • EvModder
  • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index c553b59..fadf155 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM-LIST 8 -.Os tzpfms 0.3.4-23-g984c5d5 +.Os tzpfms 0.3.4-24-g52a4871 . .Sh NAME .Nm zfs-tpm-list diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index 8db240a..a6cbba7 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -166,7 +166,7 @@ tarta-zoot/vm - available yes - +
December 4, 2022tzpfms 0.3.4-23-g984c5d5tzpfms 0.3.4-24-g52a4871
diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index 55ad674..32d21e4 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CHANGE-KEY 8 -.Os tzpfms 0.3.4-23-g984c5d5 +.Os tzpfms 0.3.4-24-g52a4871 . .Sh NAME .Nm zfs-tpm1x-change-key diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index 9de03f8..de2d26e 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -219,7 +219,7 @@ - +
February 28, 2024tzpfms 0.3.4-23-g984c5d5tzpfms 0.3.4-24-g52a4871
diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index 5034f0b..26b31df 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CLEAR-KEY 8 -.Os tzpfms 0.3.4-23-g984c5d5 +.Os tzpfms 0.3.4-24-g52a4871 . .Sh NAME .Nm zfs-tpm1x-clear-key diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index 74f103b..5c0e7e0 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -103,7 +103,7 @@ - +
December 4, 2022tzpfms 0.3.4-23-g984c5d5tzpfms 0.3.4-24-g52a4871
diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index fe0631a..32c6ced 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-LOAD-KEY 8 -.Os tzpfms 0.3.4-23-g984c5d5 +.Os tzpfms 0.3.4-24-g52a4871 . .Sh NAME .Nm zfs-tpm1x-load-key diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index 95bd024..72ee017 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -139,7 +139,7 @@ - +
December 4, 2022tzpfms 0.3.4-23-g984c5d5tzpfms 0.3.4-24-g52a4871
diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index f7afb67..422441b 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CHANGE-KEY 8 -.Os tzpfms 0.3.4-23-g984c5d5 +.Os tzpfms 0.3.4-24-g52a4871 . .Sh NAME .Nm zfs-tpm2-change-key diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index 8009c26..64215ef 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -265,7 +265,7 @@ - +
February 28, 2024tzpfms 0.3.4-23-g984c5d5tzpfms 0.3.4-24-g52a4871
diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index 63d9dce..c3a5df6 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-CLEAR-KEY 8 -.Os tzpfms 0.3.4-23-g984c5d5 +.Os tzpfms 0.3.4-24-g52a4871 . .Sh NAME .Nm zfs-tpm2-clear-key diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index 3a1b5ab..4b88c30 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -154,7 +154,7 @@ - +
December 4, 2022tzpfms 0.3.4-23-g984c5d5tzpfms 0.3.4-24-g52a4871
diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index a17182c..3856e05 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-LOAD-KEY 8 -.Os tzpfms 0.3.4-23-g984c5d5 +.Os tzpfms 0.3.4-24-g52a4871 . .Sh NAME .Nm zfs-tpm2-load-key diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index be44508..a175783 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -138,7 +138,7 @@ - +
December 4, 2022tzpfms 0.3.4-23-g984c5d5tzpfms 0.3.4-24-g52a4871