From a567a146c4eebb187debb7d975861400ba2e8856 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Sun, 3 Mar 2024 13:06:47 +0000 Subject: [PATCH] Manpage update by job 1160988 --- tzpfms.pdf | Bin 86977 -> 65713 bytes tzpfms.ps | 1565 +++++++++++++---------------------- zfs-fido2-add-backup.8 | 125 --- zfs-fido2-add-backup.8.html | 153 ---- zfs-fido2-change-key.8 | 186 ----- zfs-fido2-change-key.8.html | 206 ----- zfs-fido2-clear-key.8 | 113 --- zfs-fido2-clear-key.8.html | 143 ---- zfs-fido2-load-key.8 | 98 --- zfs-fido2-load-key.8.html | 117 --- zfs-tpm-list.8 | 2 +- zfs-tpm-list.8.html | 2 +- zfs-tpm1x-change-key.8 | 2 +- zfs-tpm1x-change-key.8.html | 2 +- zfs-tpm1x-clear-key.8 | 2 +- zfs-tpm1x-clear-key.8.html | 2 +- zfs-tpm1x-load-key.8 | 2 +- zfs-tpm1x-load-key.8.html | 2 +- zfs-tpm2-change-key.8 | 2 +- zfs-tpm2-change-key.8.html | 2 +- zfs-tpm2-clear-key.8 | 2 +- zfs-tpm2-clear-key.8.html | 2 +- zfs-tpm2-load-key.8 | 2 +- zfs-tpm2-load-key.8.html | 2 +- 24 files changed, 605 insertions(+), 2129 deletions(-) delete mode 100644 zfs-fido2-add-backup.8 delete mode 100644 zfs-fido2-add-backup.8.html delete mode 100644 zfs-fido2-change-key.8 delete mode 100644 zfs-fido2-change-key.8.html delete mode 100644 zfs-fido2-clear-key.8 delete mode 100644 zfs-fido2-clear-key.8.html delete mode 100644 zfs-fido2-load-key.8 delete mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index e7323f9117ad5a002dc9ee3cbedbb2e16cdab62b..1b61e7aa72c277198aa3f8cf5967ef5e885b8bb4 100644 GIT binary patch delta 51888 zcmZttQ*@wRw5b9qji4ngK za5JwaWQxu2cc`Md(zUU&^CZy^GR;2}FzOc3FY`UQ8hmW#NGuGf>yF5N5G!$=qU#94 zP*XChZhN#I!SdYF%w#~YdOqxPSmb9-{%b(~lAlmVvSZ|h<{*LhLA0eM*4tEBCoskE zW;7lvmg~6%>S?E}k}{?BH26RCGx_lSDq?)MTnzX=>6CAyxT=(f=?o&_)RD8)bqdwg z^uE-{EE-gggWR#-$B!@DvYv^}Zp_HiQC4VzB?}lNPHYJv80TKUzn&~CcJuwdEa#w> zn}lJXGOBi74G?nL!oFETWA!!7+PSgV;~0Du(kRh@EGu7(H1XV^s6K?1JB(TiWWlT- zQL!RTpC>{ay$Cu^`>Rw-h|zCcx7De{QOYD(t@I*n)9TsbjaM7f<+2i54~|!t0*b8_ z@yHcooR#raq{h+S5vO<I#nq8D!gY*S2@G|5nPhXR-^L9)YAhd3WA~LGXO{~fOh1t%M}^lBOuJzrzPy*{ zZmWn8B%k3th}EG*3IgiTbvU1?p|nx^P}u`*XEY1*2@B#v``tat!5IfqS5zRy;$m#j z&eSzo>^tiak$+FO@F8~2!I*_w=WfB?H?772Tw+(pOFH8%{4t^2T=n|v1qClF1&~RQ zpvjAtO-_t` zXTzaYLo9l)+%Pk?5=bAu?!ldue#65eTPv9%n;oz94R4-sR&(ztqmWexj#)4g z^W;h)iuO{QFHUX)Ha|3$(efl7J7jb3#p@IejQ?Lm@OiYl`0#=WxaP?V(Al9w-gM?V zmY2~lP;(#L@9Cj1u}d+uZ#8$~)SM+i%7rOpx7Za1eneQ90q4svZlLUnSY^pM3_K4T z3`06Op6Txj8>1{r#l7*GQPvNAjo z7ZMS0|4i}0bGhWjG45qZDw4aw^tvl|)s_A_HwP78Ov*+a;a8N0_yFV{ovtZ>(7fA& zWif!)Q)_7(8nHWKoYhsI;3+R}{BAXjn!SU`XPZ*a3a#$4r64v-^9ln)8SAWdqtQlc zeWjKbx{vTH4zrJf9B4jm$n6OE$1c#65$1c2TUAL#O4MpA$%--mqTLpi2!4BJm1k5J zp?*2ns0v1`VS^}3&CO~H_D&8ou(QH;?^Pxl=MHvnm`P8Qq2?5s@kk$+CtR`;D3yj7 z_u*f!DXe@;PoR-7Fb7r5bgkw%l>4^kS2oO3EgWE55z( zxxS||3hG;Asy9Xirb`1r0i8!AIIoyv(<@IaUD1tUq_VyDgNyb2hbr-MrKbz%{3nl& zlU&@RTmQ4wCvW??hgIL=@kN(R9mCO&HK)J-tZ}nL#1R}t;pX|!P^?MkeO4nNwp$-w z2K=0F4f0+4Fd1g>Hn3)`AdAtk+Ei>jNFg7yqzY9ilgTRXBZM#k!@zu@QqSPK6eoF0 zk}gN7Sf%SZTurS2NXw}(r=g+JuTMSB0XG`_ozAy4W;@7RTq|hz8NGi$&`e=W63qL9 zeU=hSOXe+s%Zjv??LU`<0fThZ;k{+8W_oQ*Sduo{a*8VvyCZ4xO)X^_Dy2sY~DYr_I~N(PLOu1re>n z3Mdc0U~C0vXa18w^<%9>O{DkZ^WUtA3!1mryGN$uhhusER(#&(?SFn5UmRJ6)88DT zbvu1I+Y0u;@uQrBuB-;XE1iMbrjLJg(RD6=>z^CX9FS)0qt*Dvrc>Nbts$tuMNWuz zZhr%?J}9VSoxs_@b;N?px}RM5Q;GKb-8 z!nd~JyC~nz2~3ji4PH|uMKcUN^-{BjVqea#fOZFvi*GkDDx*+sFr4!o)V^1FYZ&nk zOg_I^6PuEuU{B288?9BH2;+G4DH0c)!EeyNa$=nRW4s7-ICs0!xtbj-lJ-y$&NDhu zlh3vOL!6}?;u)B-tttN+v($|1_UYd$`(CImjY2QG%28pzJ*QreCcw|?yAo)N#WAl` zEUS!9@=m}q=pVk==7Y}~M2jbPlGHbt2Y|u)fL5% z$^U!c<71LDwKI3IAo-cZqDldzsL88tFr(xceA2my<_<&(e2_ZQCMS!)%9}i@oDQtQ zajZ5p5T-j_5!V%S89G?t5?{`3w7t7M|BVA71FQE8b=Tp>+2oExYA7@ED8b}Pn6|*m z0Oxks7=RGN5DO$_^sgrPL=8q5Gl%~AAn_qrvik#Bl0E`M-x$P+q42E0jZpScGM8QL)N0{Ibu3c6Y8T_E zR0@x2>sf}ZQaf*E!&YCQRwurKl)oVdE?}&b^re{NHP}wg0RS2AtXM1*gct#1lit8S zYm{3r()>i_*X)TCru=9Mu^mp}z-wnoitTu{!*kLs3Sp zMgQiCdY1LdoI(_k>J0VV;oO?DSX|ML>0Cwx3zjA!8GoM(6L-?xq&kzW&^sp^04Elx zYQ%YDn(EeZuWS=|FljO1aR_Te|7xJ`>|J1Yv3l;`LlFOS-W6KxaTPmMg9s^sS~}#J zbv%;0@$hKut_%DNzGlD?e`$KRk{ZzXi3(<$i1g?afRyxk>;nXXiBnNlfhL?@up6@ ze||vP!?ExEr$J{ICsSkF|4}2$|4}0c5exJGT(bTDktkC-1u&%}?|kqFwddl$J-cN5 zcVz!Bs2w+-_+_>326xQ_EgGssI>UI% z2~ry48M#ft$MD< zEppSStqkH08sK?t--F|I<0z)7-D?PNGVleyp5mNO!d?w;DF1FHZ}Bb1Y|3NzWy3PL zgxr|qjJ(<0QPMSfYx|buwv*~sPk#(QdS)dfHKa5+O(|BY>9y`ja5u~2Ho58kZE=l6kZ~$c zY<)al0bNyDE1YC2{b^)%TpQhX54wL49gTV%c;5sZ7TE5hr}`K+MtdFeBmVx>?Ge1p zk?&1W^x}zJ#|C;^Mz3v$_&HG%m^bwJ+oqPPE(*?`{;oRgJo?VCDw-ET7VUX$#u)9Q z;2kgI>91Uo382Dq#z|D|8{5xdQ6Kb|kTym<13#X(K8}|jFRDf^-0gLxC`45|arTp_ zHBhvZtLrsjcOLh(?4y!x3~8$LL$zc@W?xet?Gmh2A(jq=*r?7})wgBjx(90^#xCd%@3`ocICle~7Q^k#mwt8B+@ zp|C69fW`enTt)WuEN_d0s?0w$+2)I`&yZluHql$~S+{q4oaOdg=VYZ@)>pwZ18x(B z_0qG82hYCPWTdlmC864f+hd1iMlInIpMnMdS`E&7mF~AE$sbem1v!Ip!pR?d*wHTT z*`-)#j7tw!LAhfiPIs=4BaDpZ@EFr>hKD7&Yt{1v%9=s=6raJN8Xtw4LMExJpLhS; z5~A*d-;Pupll5O0*1)k>O3OX3h-gw7QY{b|NT67#=|A)=h;;!;KlfbIt-n5b5xMB3U$FsADZ<> ztc5x*<484TEkU9#@INTDf3|5iZtnN}iZSv_#Za_LP+B*H=njJz^05-f04EpU9rL8I z;vV*UtnCE#Wdt_x!jf>xjUSc4*dj7$Z+j4Rgin`tDza-TxdEh#G;Wk)H)`6QxO?$0 z^QB8$7+;_W))}@(I+9d@SQz>)o6K`-iy2QbZ^-#AKfcy9cf(7?L77b_&EBhPpOG;O z5a))i5v62(d7NmasqJzS0rCPzD<%#aZr+wy`yFAP3vi3;zm7(LKarBJ zaM1GnLQsM|0-xH?=i?A-?dLazuJ5``Hr=<5YOX8_I9Uuv=2Vh>*n5awFdlX`3K1>; zDea3P0yj+(A5y5q1DoznB>#sFo0?h9QLA38=Qh6AwV1*=fy4L_lfNYZY0`Dzogk1! z<7eokj~0O7k#?pBfV;_yz2K5q5XJMB5|h5r);m|$`Nffl(LwJ#Tcy?TFqf$YDykFq z?I6e#sJb0`9cC-F7giZ6VhuoyqC)w~Yuj1>7D~7}eEK)6i28RDy~TZg{?VHoosc5L z%w%ylKL_hHbt84{En=iQ;B#tGDhqqW^NFY@PkIq};+s_fbZIM~E_Sj>ZxWXD-@Ka()$``DmyXV2&_aC2`L%|Jq~ z$j!c|yJBHP#ltCWu+Mym?r*!IJRL~EzVANx_U@gTK>kkmjKy`FPOb)M06Wh%Ruys7E&h~$5ULr949xDokjZnSr`yLchO(1 zK08U48sxB25;3sw7lqr5K8zNDe3-%`eq%Y52C((cvHIx_0#E~rb~+nLjhz*y)NLsF zkEs9D6PIQn403Kbr6k~dXjl*bV-`{Rrpncwf<-|>b=Ludx3gfJ_t7;SRYp|=8{;=w zT^NV$9B%3sW2*AfQ%$#66Nr}|Lh-DmkTFqH-uOWznT-QNJ;z++!1#H@T(r3oWLi;h z2gG#QQDxcC{zz;Um|};CqqRFN1S9>JzHR+f{Z#7EA*_sqv7-^*cPe5l!!AZAs9;$L zXibpwsh4I;99BA3yMwc$!PwKusFZFR{_!ZRg8d)BC|qC#$JyGQt24aZ982zh6glep z`)W?^zY=SUz9U31rB_a>;2V5S2{|4E19XjcQYEN=X^U1*F!7^k3pAc9p%BI@hw)g1 z>4K!sYWvaBuG)`yB*JosL^?z^O5wAm+lC9zo{cH<_JEAy)7yG+$F8n7{1Gjcq)Y~T zC}4nYkaFGBII=6_X&bVlIKrDNw1WUGGk|nRhf^FqnzhK}ZCwzn;?{)eyu%Vl2l&lG zav`OK@Dc`dAFb-lBn#GUDMb75eWb{_iuXMGv)6)nQm*qoTx*LZz2)m5D|uTh3rLQr0OwrG z4;0d0t144!nuD$Yo9`k!We+iUM`L$3vUPzjW5vWk+lj{SGM&mvUBRlAa_}x<=RuS4 z99y_ObB5)^nAt>~@)E^&5o1vtbzAVroI}t-)LaZib^m1B-^$X#O;Q4fiN{4-Yq67@ zm63WPcUn}~!&+2kYSEN90PHg@-8?^sKk)G;Q_o6z27>4X)og<<7HZ&gXt8|RndzYK zqP#y-eVQ72!$~Ii>?V-xZQahhg~6Y7Qt*~)Mwbnh&)YI)r>%w8r1GF%!r)sDcu?l} zW3F}uU7oRNicP45Bh5-Nt0f_D5HK%kqPbpXw~3zZB%oJn2HV`rfGfnG6pSg#v{W-o z#?UbetHh}F#+*B(|NioF%a&+deC-8$=E{z5_h5j|+{C$j0d-8ig|>a7VRgJ0QF?|_ z(Lb>BtKd7MWjDAb*VhwM9XnV@mJW|KIx=s!_q*Ab+rU>L8|6CgMzZ{LonfBg2Uj1i zV=VfQqQTi|V4gCnPhY>cNH3C7rQX3s5rNz&6dc zErcfDuN}fD=!lDwgsZ9fvF7DPvv?YDZK>7oRX33e;5sJZ(%1$T#V7wB!QXA!GhIe!WwAiz*QSqV zL(BGF1S)7Bm86HQX2*U*S+f2Yl3Wpsl_OR5G(KQt89_ShvmxanWh%QNJ9VvS+M@Kx zAQTP$xBph0_wb|25xE}~nB@sGAKFr6INxjH$s7C)4F>8W?kA5AP^+3pU)vMCeVGy( zN=4Gdsc4ysh9e!WPl~EOg57cUE(jMtSQUW}p)K3zSe*Fi}2- z<={Dky&Gm>6=#vtrfbE2#m4PgOejzgZmB6B0~i!S3kH&v!pM&kE??cVOmis4G;IZs$iYfi7syzqrT?x<~@Mdr6IE)$Mj~hdWNP zT*%M`TocEr5_mh3C(h&5jqp+_t@61?a*6!{i zIJ2z$J%MPp>hZT9`Wf`adxXB6@~~2}2baR^8}mPrY$fEHIP{aW6@bpYr@K_JOLM2^ z&Jvl?wbL|ey_tB;Y@DmNXMq-R1BLD|kfuDi}jNL}g5)=3X(s!fu zuEc|OiIW{iN|eeE0q6kQcR7rG5}A-n?|VZK|ECTMkEH9F+Tm^(a4qkmvMUF&&usxr z&kj*nRYEI@pDu>%Cad%aj$`pvOf|~hh7!IPd~_qpkm>Pb&apE}wFyUP1Ds;w1Opd9 zUEfUs1ws;61TV&@SO4*W1vPkD<2I+mCvK&SNNfj&h3@Sgu-EkPlLU&;;mvU5ue&OI z5;q?c;=CTeAoK}UdXBPiPCrF@sPw!!1{#yNPKtJ#kh5~j3EWa&+(r!e<=I9T+i(L7 zPpPsE-1oAE3sWTCd7ipRDxs`s&yO6j{)N>W5^Bd#hC7q_l}8gs%uZ()YS;$2-&mm- zjK}V3%jOctz+_xU;wemY6Sr(}`mOSoE-RQJT}Nl&682YxIHSgf zbm%9`e+w{FWta>6VAvUX;8IW6k*J#`&>p9heJi--0C^1w8aosPVA95Xd4(Dh1|}_!Crf)B77TQ31xI_1c~vz zRX3#@G*LJTzh*qgd_1me%`1wS%PtgKYUuq00K zNqh;7!u{1Le*HvWEJh83gKO#4AB%cp*69I6E&`imK)HGHJH^=#ASNV|#HV7s? zrU>C%g$JkeGFC@o8UiUL^~mk-{{Uh=@HqzeI!T?IK0h5VcqgjwkE_jOA(qOiq0;Pv zt+&=geMGSyso>DutUaIGJVoYz5Ut$<$kYT2b;mEQKvas_!k)Uu%>7f49famWl5>Vu z##pCQpTNHFs9vYU^db+q6g7OGR@hZ3_iPiM#te=xOu#A&d9*8}YBnO_gQ0FG;_+YE zczR978xi-+h&a2CAR>z)n+@Mh3fLAIFEtiv$YVbJF7P258OlVeu+qU{ZNiuY3YMFVJ&@_krW1RvdIW|qn^bzwHdHA?G1ZHt#JeaE!W^k zCTUBzM!P(D#M3t;PgJvk*9TYv?rUM&^-icb(PvweYG!nP!z+X`hJ51aoY8yb;2c*~ zdP)|K7#Xg={}&_7E<$`Ks=Cvw1RD8ZQ33GF$+4|V|cpMqQR^*wxMK&U4+ z0c*h8iP*%nh*vt|lkF5f6t5txfTC2K7heAqI@V`Gv`=lcdCyrj7W~8A)_K`nKW6Nq zgQqKaWd$_h*45pJ^lL2eDjNG}-tmKJBThp~NK~yBj-?H((ott=jb6A7x>&|~*qb1MrRMfG_H%M+^{>%zAH^v6zJk`hLo?UjQ z?ZVEO8R0n!PCXYTi?TRO9&X(aggz2OMw4f~krW2?o7=fd-XwXWE>z%$5lPAIcVlgo z9!;VD`iB52`$1EE&sITTCc?Cw1PrbKpx+86KL0bF|L<^S{l7?^g^QEzzf0WzFZN;m z-%On~>HlTwDVnv=0j_9muK2tLGZ0c2^jOWq8OqfO7?CFC zDi0O*QC}&aao*JD*PWIL&}3wHdcF5KHw1oS5UOGieNXm{hA7SYK6l&0R^;+yQWx|tcfY~mTf%U=A( zwwY&H=JM(>43bR1tQOvE`E0QB5ON3Z)%70o-6Ds66Q+wTb_4ve-T%qbhoz znFImgPG*M|u(y&__kQ~;?KDv0%oO_;8U-5>y+Fi|HyCGZ{nFP6Un89bwdy*=X#0;V zShPWM!0fuz`*wCd^?3e^oleNvEU+iZyv0hf&{H^h?LEW*fjeb@ zSZM1rpHn%ifK6$p7fK^x%%nstl8Ch>i}c94`(5LwX~q$j>$H6hZ|>#>ORNc&SSs~A zM;Q_`_PWohtm-DW5*HEP$>JhkWc`U7$QzSj8#&#o9HIRK z(kzzNq-3uHCmzkmb1DI9QwO0Ssr+-{Dana!TWhoD-AS zF|u(t4rc4VJm{!cI9h^r5m!Rxaw0-bNS=3+D0lz_T4#y9&?dOtl1WsMI$#GVXhwHV z?q}1p5d?Vr{y_Fk2;3ezGZKmC=HOxNTV5{SsJxq+%?uIdvGKFheUqQf@mp9+{Z^~B zbR%2I`80(77ewCufI}a2%>-zd!#TqP@EKs zhnNX#FWJF7PwR|chub4WH>?c6(Pkf!pjVWmXQ*d(c+`d$*!h$GNGBDZ)v_wlOY29~ zIhojhz7pp6u=l@;K!9QG>k6_;h$`k~8~$q%H{WTlw8K4TF)2u;vu6Rr(&W7uCI?HX z4a#U;EHkF_Y#{*7&Y?56rg)B9qBZIXPVD0T;~cN2tvyp44#o{Smc18nGp$k37YVmc z=KIasIZ~Xo@%)rC#kRjZCsk9B8#QF11&)UZUx1W9e%!WPy6uhBF?d=t2OAfA((<#M zhbVyM`n~Cu0&asWT}iN&=%+T8H$xgS$2~I}UrYPsi#}s#!m=rTNIDXk?dSbtTUymO z8~zGL-`s8p-eQWBk(da;(EK74u*{?>Rit*?!z?cZPJ%~h0SzaD7-R%iy-`C(BoRlC zOh>BO^s9Z_gVwL1nkLKv4kyzyHkofaTATzVsKJz$D0S9zc#$m~(V?%&=V$ou@S=qO zU^2^%%_@ZNdO!!?B>$uy#38c&uqc1;Y2o8-G&s|_#VfKA1x7G1+&|$oC_B$9n;67u zU`BvKBPWri?@I7rbWtqbhD9%1P7e`nz9{Fxc#qIZ^HO1_k)9+`A6&z!iq^SI)m!J} z7T?Ba~)Zp-J;t-F#3i;LC{PPKsSKgB~ZBXju-%Upx6zj5mx zht#z7^ZL5EyknMk^7KF3tzg-`SrI2VH(6)>>*LZ;kK@dV91b0!8=cE5RcM>JrHnFy zD>&D@GjV61pM!83T)Q6+O-ow-L4bte4V@|?ai^8tH^4HjJ9r@f*W37;gH3(*c)gS) zIfi|cb8`c+|URJ;+BsTRvZxNwJKuwtVl!HSj1) zHAK89!8PhNKjU{^V?=5qHS=ZHm)tPYn_aj|92%R={keYi`p5M0 z444Us<>&wJ5&nPuH4FFuFBNCy`d_IyD|ZreIyq3Hy%xJ6fi=>7P6rnXsw&*12CsQy zy55TBZqw$iBNJat2w~GmJ|~Z9+PK*G!DA2pE%W7Qr|yWpl}nDZ>JQ$K+Li5n-I0PE zZWI~*weXQ;M+H$sMNGN)5t#|hGkCRTPu7Zl4mq(mMA5+E!kNSt;V`tJpRC+qUEiG} zegbR0pKhH#g0Q~`Uh3^KyG=noeSMno4J-{Y#w#SeJ>?9Yu&cV ze`-gaM|=&|$EBVHOQtVy*dy?aG*4OCJi*%&t;AB}{-f9o%*ItpY>QqsrEIdO*6q>bi|7Mi{8^Sji;)OLL`u z%f@`1oib&HH&rb74OBr11gEg`mnz>S1q;$3jZ{}C;1(iRb)XO-_a4XGo?|Ee#&GZS_naQ^D3?XW`*TmO@Qnkch^d}0@v_ighN2|{ zt*1>2EXK`SOBAp1Ra4Z(eh`+|^nh}nTa_)p6ZS`hPWv`jo3s~a3@IvoI00$Xnf(MY zR6wv(w554s$l57ix!pD?+7AmbkFhAQD^rI2r$vcqW*mt0HhjJ=VFKm(cYLEdy1Q$+ z3{w4{$K*t>>CnE%lYx2#dX-Me1XxDvtbbtjI*Xf;emQ%ftPv7=_#?Y)5d$O!vJPg3 z;9PfjzO_~%Zt5NEYg#EOj;@ZMa94?)+qSgrX9#C#d^W*iv>o85`A*|La?~c%!jYBR zhh416b@B9=UM?u&d)v}o!NaKZp26GP(#q-G7UqVW(|%~`H0SOM_KzivUHpF=^^Qt{ z+XXGebRxtoS#30OAEb=~;((yrU>rORuwjq^Pln&qcQp5GzuTK=WAr&J>#KvtW5^(R zER4hjo^y(qv5cBlO<9Im@aLmY4ygq*%>-u#`B%X`*WEIDF8g;Oft+OsdgP% zrc0>m-kzcJVuiZk1qczSEMZ&_ zSm%bxgkfvMB4GNL7;M)Rc12G`GjAqpa5>w9nsY zU<9*Y3G12si<<%J0EVw%_vuKwfxp4M_Ln$mvq=&zg4VP z(3g~C4?BeZ9BID>h!|9{^<`djFFy4A&k`M_hS`o8)&Q|YI|UsfM&aL78Hjz5k20efB}?rl>i6a71eXcfUlf z6@+-UrigG}-RP8@VQn07CLNEvK%t{9AcEU@`JF+_uKv3jRgzyOBS0E@e$)kGv^B>- zeGn456^NKmA(I7(d0epIg81AD=1g-#Rf09DqQ;-M@&WyD+!onDQVwHn#+!HMa~KZr z7ycmKMB&tJIrw2B!~$|U?em0re_~Wz|5ivy`@0dde2$O5E!Z6tKe;hvyR?&l@I*hi3&|9@2*;d8>WW z$btv~d&bt_yoxA__q6WlKdl0N7%%E!A0@UOb5$H)RZdkmx~+L7x2$SS>71yCC+qz9 z+k!xffg{~xsa_XKiNv?9PFzQ1ZViMZl3AHb{n3A`Hg$geJz%q>pe7|Msc}ZgVcZM{ z84xML6u}wY2)&|asb_fjF@O9>CKp0tBJb_r1Xtw)hEq|oqKH&*^+e3B{ZJ&o>0Ge0 zC8o_4Y2m%pb(W#w=h>KQT62eyQN7~bpF~M+8@R}>fgm%u#D;o5$E>XT6nMu%0TqOQ zmOfZ4A;{>jw}Or#(HbQD9udeTP=KB;18AtCpoLcX_u#>d8^=C&!9;C1@unhUhS3O< z9CSk9TCUD><;z0Z$lFcGu-{qd3*pSB3!;$p%-1&&%rAE_Ka=`TpFH;dJTx(of`TJ8 z^6P>Y(g<(XXH)CO)!5ItpBl<9faS;P9M6 ztC#$74^vQia9SU36xYPj(j>PzW7J8GSQoQx{qc0zluQb(Xz2asNu+qZu2 zoIoFb^Yw9m?Je~D*HeKHM_`KulV<`K<2Wfk+a~PQ>R`@4Bdx7E*Z)?-IY1pc(?m>v z&iZ0Xtn`1X0~*Er%y1O7Vqg$oO&Yf_-;@U*0%d;Z!y}ehoHL@CKDQP%QV`6+tn9H; z$O(x4ZlP~MA@Pdr{J;}V0KO>9xsT+H+1eM9Z;5JyN;^VTG1jSDs`94ITs!Ji3MeA5 zLQ$WyTl!VXwVMiZX}Aip)O~5|`7f3Gp!ra!UHF?r4D2UPoUM)w7+G0-f5IBkHnTPo z-E7eB2#u8r%LzZTmVXQQGK)W1UPj5-x{I0z4lHO}XlWokal$ zR=S(VrciH2htEUzvxAQ2d&q7nBTFBzBd^xYKAwKBR&yYQkIooGp{vx#K?pNFsffVZxMeoS-hCC%!7a zHN_CkhZ2;unD@g5%8gm)6W(_bBX{F(YY9uTJ|N8cjXxkvj*XruW*Y|*-e{_6H3ywEmo$i=k?hSR)`J?{#M$i3!miM3BY%ED0Lc+k6&Q#(C2U_op zYJRtL$ao|I=ojeI@h*8YRbOUEP_ddn$&n>_PC{eMR(+mV;3kG3F*{o zMK(vvQING*{oH9@U7y{pB${OM@QeKm(7+w__i-)GTJ26=I{dD`+kT~Sq<6&#Uzb`uhJFGS> zYi$JCoPPQT)P(T%9sNsd^@R1BUumuwZiiMj1)oeg%2437t`EimI2_Ym`Z+XB%w2GW z{DhZg?O$8ng9~EnDFj+Z5s8;Oqc4pJ3!(4~4T^+9KtI z(dgjh3dkD`{Z)HTdcDo$#})*`iJ?AqB!0g;s8IyO?m(Q>5x!IOyue2+GR^a^K%YK)In%VEM=GeQmjvvJ`pSj+9|Uo$8i%uN{&pn(|tuwuT z0{l&wXL(!^iR7_U3$I&uB>Q{67t(*$^+pzs<+A@)6Y~U)MINqgzkMcJzoSl|qj#f` zD^LqPVo+bQv!kJ)qO^V;b_1uDc7umYbc)=lb9|)|Bc#fo!+U&akocz4oN)#|pC2D< zBd-foqB8eq5qd}ij!}9vz+C+Lkv*zo?%J>&C&gjygv64grSc zPazj>(fvW?)f+d>-@*#(4kaBm!nI^s>9;>dAK91ol_OILdy&-a0;`uk8=_aT?MtsR zuyDrT4s$lGriS`8NBQaqM=5d1Jcfivio&Yijmpu#GO~`v;Cd$-Nh^YUBdX9oEbG0^ z^a%l%jR;W{?^KP9zVM&2@dzSlJcFBN{<4Fh<9AIy7WkTYToFIBfVE=_|c*A z(gu*GtYOVjyeu|3|K=k{Gu4w8wpNT60%icQ+uFxzRk2)iAY?(7y34p$6s1}RmQuH6 z>JLQPpI?y(EKN+7{vL3$>-<8?1o!YD#-OoOQ<2H+3AP)}K@xChG&qwfVI>PxM7)H* z!kX_!^+V{PnoNpljMbkTeT&or`q^ufT+3|||HRKbTGyhCI$IDt(x`Rf1=2a$cRF%mSrues`pf z9|+AYP@4{V(T;=YB)8$!pK7!cV!&!Y7k9jY-r5zjtS!l|RrXDChV7T%f6Q3xI|OSDpA0a!~LB40F@g9zns&@!C&^?GrR z{v!8eTzMc?J_x1IiqyZ$Vf`Cu`r+%Vp(m_Qq3g#WAMfDqB|R6pU{N(FW=2lZ1|azi z*e_gJO+<6HO^SoGZtV=Exr6{~8v%&)gNuqQ3jrb5Yww5XIYFSppx@P~jQ8i5y8E@g=Bdo>~!z!;=gSz&cZdw63l| zVssU`O1b^OkF%K*iEio2>KA+gcSS3`?r__W+mX;eUm!!D@hJH2w*gdJrFKW?IfJq^ z4gQP&5n>_=u|n^*Qpkl^3p`Pv?zC!2>vTluHTpz)pE>DTsAE=R6@M+v9629?e_(04o#rhqW~obC*H!K`h5l5e`s$67v;s701E8;4lb zdMh}a^RQtv{&prNasnL6#BJzow~{B&8*R>1%@)8K*1bf~jUsx7M|4uJXcBy?wZz9C2+y+9gC@t#17Pk#K1c*4Q8BnT?sHbY( z8X-s3A}LMrc2rLTI_Sr2z0Sb4mPQAz*kL|B{Fp z_Iv_7U(K>^lnvv$l>6!of4TM~Zga%vbz~VCXH^H!<#tj%6cU`>_H+6wZPLl&m|Jh7a~rs2v%<1pd4Ktd)RHc!p;Z$R~5u zzoim<9WXYJa?dy1to(;IN=wGmVEgvrI~jHL9*1R7Ls<@Bs;%dnnoom+v}rw9+G2J-7ME zLW?cdYS5p@m4(#(ZMGA|F5xe291L@_s&Fo`vYBj4UAc8*1#1aePU~Gqv;UR0-RVL{ z?8yt0_+ey8P@S8`q!ukWuOM+}-;&?=^D+74bSFe!=7l(=d{h{*8ZR&!D^M30ux9$3 zKZ39n7l1*XY?22AUwy?|y!f5+<;oFDnmcJ^#|rbPD*aEaEEl1qDZJzm zv@G+0W14{j8Bzg`J%o5Y{1X4K6Rv~~P1Cm-1S2laU1Br!w%@Qk0 ze*^f%-<_y*e;Ehp%qB1y18UJ&M3rCr(vxo)KY>4a0v3kS* z!S26*Mxv6wUg;_1MlN8(&&W>GsG^+?U= z@-@^jiW_StMw-Lmd@8e1lppkup`(*==sjQuShCtqpc#+Z+G0zvtq)_rC9EK6B=@t7>|Bx~BVECI6?EfI-;b?HJEC=tLE( zL!}v4US}&OHJ(b9Dv%3q*CVjl1y&G}W6&$e!5?vsqZmv|PNE@%gvC{PpK;-s1crX7 za3-j$4Ir$aR4-ad=Cihcz!Y8hhsxXr$ve0ez{N^Jvx5X+Yi`D=$3$55#yuKf(DFp| zQT?2LFx=Yw0R7727H1@zZXuC!5JJn|TFi#F=E8|Slu=t#U>H1fzU0fBkUVLG#NqM& zhM_K&r`w}gV2!|NlH~{T(S-izP~I2Af!IBj3!qNR-v8YvL5-e(*rac+N3+>Cl_7dr z3_8R~RaB3K;H2EUp*s)A*ii#ay3{_(|M5uMes4~W4W4Q0*@e^3Z|YD*j4aLeeaqoU z(5cJuu(Dj`tg8{V>(niLE0T5M4~AQV27ZLo9^ziIb2d+*zQdwQ#dVl@JMl|W|IrRx z2*AazVRtwsQABec);5iY&4ZK5bR!MBL7U4jq^PpwfP;uWz zCykFlj81i_R(oS2tZg1L-WE!YVhaZH#CjK6;5m zw|!?K>5T)4M>gBpUYp(Z^le277{F`oj1VayyR6--H+v&zMCOER*$7OrW^vy*%vY>_ z&OY0Rch7Q^W^p>DTW+YS+qu)W?^@;xeiRr5$_XkJVEPLrjD6u!52{anc7ChyPf8tS z@o(CWBy?>x1pe6B2+6_en;9B7c1 z=>S+Pef{#hf{a+WA+*W_%AzIzRWOmzxVbn}V&b-{S(ZbnTH9{~7+vMZjMDc>n`c}~ zamd*>pZ3n=ugy&5O>kGKKulkG-z@vVmrTmv(~ZN}%w(eD65>GAM4w1wPYmISu-t`c zJ>;OfjJP9Er?L!wDnr5NEx;KY4@WZsAbP>56(vz=`8vfWF(Ff?o}2$yQGgc%XjVJ_B)d0p zjjL!__xUM2PoW4Z=0o;j!ut3L23dAwAaSK`}%hmbvMD{Kk1EOjR;9#M~+( zTPoLxs2{trZ`qN+&G9cRenkbC5ks4>Sg}Z90VbYl*~)1*fj`tBlPYktXa)EA@hY^^BM|H-X!=N#DDs`z)m@9#NMdy_7_9mwcr9I2NbF&l_jb+kl%$ghZ zZyvzDf|=$#oP>0~S1jfcfk&L-L!8B}XIRDiXa`juyk`@9oNM{I1zwCBf(dajh*jVzj#7;xG=q*HSS4Z;1dVa9|5tHy*(NVRaVQw-tDAd<1 z0NEGOK8PTr!Oc5qlVH8Jvv-Y@g8)o)^UP?6IuI*=_fRu28fx%ktN_COYGSF73$Fst ze)qinCEiY8_Y>oIE1qY;**yab@Q+jTB%;#YtDaU&bx0KRLjmR=G>T;9QV z1wMCj2Dh(`7U35X6-Do`&fRd>x=i%0)p}g;twu-AXiFW!o2cB^ZDj)o70V7;H(o?z z?Uf4RA#m_wp5P3hOT|__Lj;ai#9gO}#CVQIF_$lqe_eBR4o7@2+PGtJxTO{;>8u#FZ#v;1Iwff-EYoTKYX~>*OG)cmE|-`H-oT|eWh4cv5{@P| z1J^R;7NxhawPw_tvrc2n;El4OgpxeiI>8xiej2t=PE0lz?1L{Te>}OJfx$OJ1G`yd zzbJdtp%zS0EUm+s^vkqUDC)K*$02~mYJ;q~=k4vu{mZ>a>(_cM$9k;O{fG0LUpBmS z%xlBJh!bfb-n4SRMtUt#)l!~o(o@kOA#G70AZb}3tm(d@h@8>LNnnk`1>jGEmJ}H?)$|X=@C9(>j^NVZjKRFPjJ-@FElBGo;ZmMXv`e$k&SyJiCG^YT9K9K$L zDVIgHhqUv~xwbl&Ev^^Y{Oo+oG;>4S(WI%`^r~>U710dtByx*hcyKx$Uw%@m>;HP? zQamINU`KqK`@TpzICc{#7%}7|kDcwI3#vgSJ9kIZ_G-*%VC%%FW@5ZqUgtq9h0sXy z1wocivCthNNxqL^)RSN+&59S0?N}f5Ok|k>3|o5nBC%K~VQUI6*atho+-C<8{#_iaegB zcCy>jCcJAh5t~;ao=#gH?c-U0nq3#eH!Z}E3#bOT9%f{YvHUYS;Z ze~1~0^FEXxFB-BEnJp5}h`6c6>w3ScjQAj&5a{A_I6{i7*Mg0R3zEV`_KJ9RL$k~f zg}57)f1~LO$Z6EqhnOKrH!`Ji1lgv_a1B4SBn>j+fn0@?Z;Id5 z3BCPI{pV(kgi;+;86(xUt@Q*h`Jox(9^CX+e)`WEf+W^8rZY?eK->i4)ChxZ0;{NB zmj$vPMe9#h3t;r3Qg1=eiepo)$yo_|$#ObK*aS*1=$3D%TEB?>Ivwe#nT-qdf^9>i zz~X}dYt~^E(bLL#N&-Sg3^yc+-v2z83GFJ5ttxgXoBgJO0sX>3U(F-Fvpj)!BJ zF(K!3VI~Vr{>9TSB(1DBcwOuPg9id4D0YG&SEh#yY%3AeFl4<3WHxpQ8WOKL_riw1 zbbwQEr}q@$1}yB>+7LU~rvrBWA>GzKQ&AybjWuXmRl0o&5Rd~RlNrx|`NfG@)!4{J zo6#+rrvnm|8!8$S3@giHN~iKaiS!N z6?QuIL=w}@Gn)_Bh8_JPQ+-`o$^^yw&Y-?WSex}ah=0g~!jbZ^ivw=ve1P6vYwO(h z>&ecmNeZMZfCcT#dA3Ku_47^A;>)g;0iz+@lx23?!}ip!RafO!3>BAFOr`x;Xbxi- ztS?VRrY7~|b#*!HgN|BA+9m8gE&j#s*+9$I#~VU?qsf5f{199O%ucaXh4P#n-7%uC zIvfvEe)1oz=ifupXP}H<+r~*5D#w#gFf*1!9B+l40hw`O43-c@H)!Lq@NUz&C1|po zrF|ti;Y(yPbus!YcBKpjgAhE*qOJN%z$O;`^|JBBpg5y3(7lR<2qbR$)O=YE+s$~) z2H6`PHaf6d-SxpD2V53J-=4zn_mL$^c{4Z`$dMYq!%|2UN>S1|TxHi+e~`uX8=bbj z851?W0K8L)V~R-+El&{PmsIvxPWft~kB`3Y_Rl-_ZuH74OZjbstUq@{Q)uH*KwCL7 zSI9^ut8p7Qm0Vb<3ve#TLRQ9FnCQ@xSy6NAj1lSg4#3LO_T4L;p0Dl?TRi1YU6E)l z-Nsq`mUk>mI55}*qE%pGR>{@iM$Yd!>(itc0`wT$B`_$^WRc501UTk{_qB1gv_aLx z!;mym)0q!k|F~3y6;Kf6!>+BtH}C45F*g&+yXd(Jm+`wmDF`{9(|e@`VuvNz>LlkpkP&k)ras{BjpHPkX*IxGf zJ=~jmv%2Ok&i@Gr7-zONfRdiTJ8d;=I+)wi|oV{?D4(Uw>l8@dM zRJau}8(Brt2YMrt0|yMPorumYrsTxX09OMf$PYE%l1G?1PbHJu^=X!eF`ibp9?sWq zUAPsJkr@2e%}NFsD7FAebpiDv*akN~5W*#Iq$2q96H%+?NW|X@ezS+?u0W5?l^+-s z;Y-21hf7q#nPNyg4T`}#!#D~cvhDbO0mSa`?r<1CPp)jfrTe*W-gx0-cv|T%0aS8Q z0p1_25BkbCu-lZ~yNI%;61=^6Lc7CnFAUL(3r5{QA+~mbC!5Y>rBV`_HP1ZF1Ns=+Vg`%AHSnF+FqM!hRj)8A(Q^#398=$N(Ss-8yW;>Qy zpck6;pTqqO?;Eizq&p3Lb43lWVF*HNcj|95O70Y{x*(OP+S#wh0?h8j-fO7t*URTw z3rv+(v+MudTb@qF5v--O^sK9mK2sZPySl~7@RV~krT>Vj*!Vr9Ok3f~2+80^h^~8t zJ2M@DMsv4{U|*JpCvVJ$ZW3V)A?7}gze}@IzxR!3Z;C7ge=e&0a%_5&H9_8eCWv(4 zzIElSt)lRjVz{GCm{q00p&$j@%^FzlnY}c2UW2JUYFMiP&HSMT3 ztEUNE_b>9eA^K^j?5B)MPnsA?OXz2X`zNts8A&u%*eQTB@V>yY>01a8EEq;vE z8@I1l&T4BKz2y&dsNWhkW7I~{6}Mn;^e&(B2fyww1%yrhF^@8}g&klDDqaMadeXVl z^NC*mwo_U$`{F}g#Zycs$@z(=_gx)U$6mA6vUIR8x`4i9`ug&T``;)W;M2}4Dw zrO71Dt4nfRLEV3n`vq+*5K!Dx(a~agm$2{IgA>AwB9;AzM?HcuAWL7LnF%{2QWOqq zpas}bbD~jWfZ3t&YIArWe85Av{m_EFFns&8e}8jhQ>F!lJl);M#Fa`j`xfbyMzb?T ztJvO(KQ$mY8~_ZvSYTA6CbK(!=O{#;gG$uk?Lj%g3IZA-buOA+cYvYApB}e6y7f7&-OEiwb z*~efTpJY9M7ks6~*5D8NULVmB;f-bVgTQrAz>y5i7)`QJS4di1r_hcaLLLIQP{lX# z02BmS=iI9cvkZ>Z9>Bwf`y^1^ejS@G-)qwZR!^}St>v5+kd3`6SPxZ>R^fLLn!h$> zfkJ}kg_ve6hKp<9pDjkY-yMAV-LpWV;sd7yp9gpS2b~9n+1r&`ELRu`-NWRFN(eA$X#1;ccw{YBYtP6|`WMc#9MW&&-xRb+~e1?e_5V zb;N>H&Q13p?B3^$$YSXoSAC}rM}cek=Xc(pGs95SO=#wz0YA>CeNjA}LR%8gd{=na z&OYk7thYkfzX1rw`Q{nPL-1-%RKUJAy@3RAh2+QzA=n7zQ(=OvBX^ZBg%41mMJs^Y zznIo@bmz{U7ipeCRuFuj!{d`p3)&Wntet8K>X=3nU4pUAy;yiSUO7#ak5RUP5=!mGsOHIxI;CK@C+k_VKI+{ zcC@;R))i?)Kn`Kmt8yi!Gu;Or{Z~3?I{KtAVW;nb$1b;l4JU_&2UyNxXX3q4RoKTB zKPZ!Z#Ipd&7L_0`8d>_SSpBe;VFoB!P@M5nb?C;-W}5Em%Qi6VXHbigLp(CGxx&Mw z5|6CJ8OT#qR#}0ZoiPhz4GKKZq(h4Z}hDF=+i1;ua_oq19lq7Jd#z*s^+_a3{6<t!RNgIB(nD!x(G79iZ?vV> zN9dT>FoM|I*sG{3;`FK`TD%5ov#qrYLo}hcTqc3RA6L{6|7re#ka11Kk_y}s|i2%Qw5 zny}tS<3942$B{9Xhb8GOeo$TNgu!Y(yGq$T$JqoX%i_S74Vo-jH#_)^Syt~i5Onme zr7YwJ*+iWqbf-ya7jKJ#=~t4mB0{#JH29ta3ek|lwaWaB_#aK&BYxQy=9u+~<38Rf zKEf$fB~3q)6=i-VQ;{v3s;{zR_=-FMD$qi%$E-6%OC=Q_WlZEy!;&tHW&;L2ek{46 ziP1@t05P;ceV0(=yLlgAQY6jB&r<|6399~4ZwTpyTELsk`ZWX6F_k&QKt+Roqy$!} zt{|rqP9KufnI|9WXx( zVX_RNVHx|F`tsgkzr268zXSlUeDroSkk6-`I%J)B-d+-O)Y~isGz_~0u-@nqCLXG_ z4sS(Ab^hcG-@;BnKZ~PuE9FtCSS)wwKrWUF@o;(HBGi~m6exgPVP_4c)X-M#4z{e5yEf(jtK&ft;#XRly>>%A&OjOG!-_p_DIs-)Z4Txyv6B>$LFrw z^5CI}ODL_FJz%!lc|13D_Em`0ZmCGLt_~X9iJ8J35o?O`brKp zGzg50bVHC?A^;-kn^>!)BLz|Uc_PckcC0*Wif}3x5hkTMjka*}?&g}y9_XS@6(j!D zw*6+WBO|gba=DAMe>_|!?NN|0A#7bnfwA=yupL_YdiCcCm9B~VbzO!H7xpkA{`V;%XHm4251?@}jo`6%{CaR#xDjE~Lqw+AivYcnMLJ@g{30CK+lD7MTlBAw;t(3NZzz{SaUt< z+i&zh$v5d0eIhWBSR=I}La`5rY=Vmr)&>qYhji&&b$iiQy0M2m$B28me{Ejx2A#bo>DN&Z!D zW=`-e@t!Ppi47RT8IE_91s%m5z(4GAx0`Uhqov8N(5!^OhE^Y4SCbIZ8h0KIO37Dp_*(F_ShlLdZXkxgw(pHZw% zr_*Lr@z53_4wHY^s^X)Vw$6Lr@Es_Li?5W`NmD0c_YuNX^yRv;4Am)!`pR+5Nrsx4 zMF^I}X)}M9J-Y-^xWEa@bff6ggVC2~EPBXgnt6v4`hYAMZ`k~wDglr{7XgBug`Eq? zp!@fmyKcg#GVr7KSqnuXa5M&$F}aKNr3v`MzHCa*;|$B5T4Er{N*7n#g~FTQ(0vo@ ziT)F+Djl6%Bj3h|#V!nmCXqMc*?UWPAaKJXlJ{)=q0okoTuXgPEiNQ+E;NSKqo-)m zp5)V@r!Z*}OcqTx?KC;(!tWgLWUQ7%j|iCj z?nMsBh*2t^6ozk7agxdjj!?-t6S&%<+{%#pIZyX~ZE@Wts=Rlg9@YtS-SmsAzdQgp zp?28y-o!&r`h}K~2TmYbPxL-Gp?b~UL-*vMRQeaRH^CpS$eP0;^5%WOO}YPFi*Ez` zeEb+$Wqh|}*|=6pwB%xw2y(3$1xuSMLHK#^ftBMP?LO;+KMVKwMuWCLPbbe7&W$)v zkU=<|dk5OTGBlRsDjs(n?s^h-k(TUEh_=gz0^j; zJGtb19?gGfK!L1=R9RqrHcFQJ-u3E$B8#;{f>a{|XR*A4YG55|ZJ28L^4o)O<>AY{ zXMw5SqUs)}4VO!(vJh10x(!)I%jrI9RKN_3@5W*Nc_x{L8t1tDowj%&L@-jB_FPKw zViJz8|ESXJV(Db>u+PFQyP+H4C!0nGgwz9PKUMWy9bG%0NOjXZQ8dR?Rt-a7xJOZ) zXEt0suUOR=WPI&{lH?*#Jpojtao&efnSnMv)LoRXBkfUNCdwAIqTDn~6^o)UYRH!R z_{$TI3YrL^8Jxsx8Tx%1;rD};=qyOh@vHlP(0%`Q*ctyLIgVy|9&NP%5G-SxZAxPR zDORA)MK(doRapb1Td!=`a()VTnokU>bKee-6h>9nRuVOZ0{v}X!x>}@mr{6hR|P>H zJ-m2p*0Izg$#TgPYvn`>(5kOzI@FT8D^`S2 z_6PiVIv;+T;JzKMP~PYt`Vy$IyuHuNy{X3((9LVe;9#(s$9&M&lh@aoxfu_Fe^)zt z%USx1mpMV1mR`SE&^Z3*;nZrNxD5rJw=55sm9japIV2st0H1nCNDOWRAZ+UQu+3ST|HsM(S^p6cvb{RELs6FX!(17LIq5(^9JFD*#vPOk zTjUOC&l6FE#rK>8mI|iuw@97VjQvhJGa8$_jHsliSv+!4`xA>tZC3o^l~ZLRG<&li zkv{6;cU)sEHy9R7kR(vfv6t7(4H2C(@i78C-UMyBB#f~GKnb`R`z#b^?H*H_qR3ygfK@(&4%|>n1>Y_;sHl=E|Kd}W z2g!y81huXQ}x6=z}TiQ~W3L3+F;KO-Cb$ zzg>-IbH%MVqALVW&hI|IO3T;8G&wXu9M=H;;#0^d%tZ@r7>H9stF3~Y(Iqtm#G0{F z5|~&wi7PyF@i;FIJFCm^V&$Pj9?&Cl@@HkBDl>u;XZ0Y@mP8wH4tN5$LtJznMs6y1 zW+`FJ^wLSlIdyHI)yD#BcY15GGy@Q!?Ft%=NQ8Y#K{aHrl%%zh7yP0@`0|%uWC6g0 z-WD91&_t*Qd=PCW^lqz)z!%M)q+$!`-~>tMm65zG4Aa?OXKr(qqueg)i)Kl>1vsAO z$~pko#coyb*cW zit5tBw7tCAllFxd+BljcngfCbbO0pkwF6iR9-B?WQPoeoszAs!_+sKoy$f^@rAKYk z!P94=A%m?1w?GEr?*5y=5QK_xQS@8#SX-S%-lFmE{!Alr3{W-~N>;6DqN7TN-%Nt^ z7Wp&H=&g=GChTFObOL&W>13;TGhow%lOpy)bzqLezy69KrOEM-ZJ>LE*9OFCFj>82 zcmr}ax#}xHeBnq?m$a&Pt(t!h2^N1sRMZ8hjXLgh4Dj`fAUqB~Au8kqkDm|~M^+*O z@(q}`a82ks@RKG0zwiX-}(nol3Y~mousW>@0ZMxf$|uJTVWZ7#IH`P$#xHQu26E_ zZN4ooDBui=c3LSGnz)idx*=J`vJJTKGL~cvzXa^%7LQey?axw??6TD*W{c*o4Xr5k zWO3M`jHhXx9Z|04hY+9TeyrA-6Sbgo(|ibltsvpT(?Z5OA2mThJ{tLB6ItrQArPfZ zl%2f#`nSask|-A#-2DrmVyyIuPnmi>jk)EvdU}36d69sx_=A!1#!2I6DXNxd&@pFJ zVG2qff!Ht=0B8>(iqL$KZ6Cb5dlqjGym&ZqrjdZsqVC`0mx!_<2qw@fKzZn_Fo=cr zWDX2i9NymCU8j;u!S`D zi`kv|dhMlMR#_u?7%{iiyW#yH1q_;2pD8H{qP~d(g+Ej?}swA$wgDy}4||hAKRHL+(S&Kh!@& zl!tydP-0-k{!!tv`MG#H>hA=-zddTI&o9fh3OgA%^b_{S-H$uhg3=JiB@NA$UWHpK zYB4`z6dBul4y*D_Ayib~+NzUi)}=2{9F}P$iR?c;WzOoxqU+7%%Nz(q*D`Kpsa$-K zt!`#eGGxjd;5Y=zkmg>d(}942833pPG$!U+n(F^f4mxS2b+xsv?jGvJ@N&*}L;P6XJKORNdm{vy)%#GDaQomX;v&(0t4FDP!X~I z#n-69vHjhr^LhDKi2Yw7c5Yx}4Jo`n$tOeZ4sIl@EXlR}++6=f{D1Jo`fvDpRc^Sy zD-o*9s;r!Ftbft?fB$mBv2p`r>KXC>kVF+`C@|mEB^l`fRF9J!_1<_uI7@T{ef9q?yI_r2EDqqy}2u+jGM8Y zwJG!81aWg$Qx|I|H%Au|Hg4cR4<0!;FSER{tDBgWu?q<+D-W}lwV9iht1byQ8ynnT z*0@+%f!iHez`zy=U~CKg7mj}zWFg^XVfn1$FEf9S&)omSe8&D$ik*j-lS8^y%H=zepC-P*79S09v$)0S|lRfOoC(g#T*gZ~6ah?O!c& za(xOJXxgTQ$U?&VNzdQbKTqIDTOl6HXV3X8@L7bD>$6D-2UABgYX?gbE_Pr-9|73s zrS{Xo2Rkpbv%904xr?=>l^Yx@I}fwDy_vDA6&x!E3$ukaP_u&sN?Kb@R7M9l(}WAm z?Z5}-wjv<1asHQlxLAPBE%-p>UUDE&Clu5_qGACSbYTL&G{XSpn+1R>%@n|#PIzEe zGXn6kiwelp3=6z%c1QXjRB`-^DvnR86oHjZBtXI@d@wG~zp@) zN=ZRhT~-$8*Fg$I@8Sk7cIW`TTd;tVovA>XZVV)GbvZ2wCHl{Y$Hm&*1!&zZ2t;Yd z2GTZ@K(N4l606*WL&fzen7`+L9G`dU-$MVy{tW|BIx&FmE!e>NE>d9rC-JjgaKQI2 z7~okK?I#m(pWT2Tc+~+3tZAVGHqiu+NT%+)r)t|JOxDMIF6#8Cls$7(btNZWb;QE*^G$W=T6^OIH$B zc2-sv4mf5JSJTfS?{CWI_-E`SZT|N*l5lZx!7=~s;eXRUO9K=8vB6ncIMa#fKrp2m|dCOnBAE@X#aUKB(3et*-1G68Bjil)&Cf7IJto$>l^@9 z9!^d{!T)fI;gyq{;;XEtMKt0V7^)l7kvt{)eQKDn^ebk5b@%y27mQ}9tdE;(z{JNG|9%NL|LD6DYb4ep z5=mUzagj0CXidpi%`qSoO~jzU91~_sVxYk14f+;#CLT}bn@B-{3tP?~6iPz02T7iL ztv$P4&<8;bPXuQiamV_|)~yY)90tUCqu5kxDkI-I3ckN}KZ7?D^a}&Je=Qyct>W&& z+lc3yVc~*@&p0Ep?4JYtZh03S?ks9gpj7kax)uyKi4oA%wf`OCdOd4xOAcxl*np;q zKF;)8w#SI6fol6A{9)qppf{)22ee=cQ70^%h7+byZLvPnuKYPvqE>gtaS)nn`X%3g zu$Z_6G0_=Ra)s?o4=G%3&skBBW*$r3QC6-%bU@PWa_a1J7I+8P=o;>RnLA?h3Jgf% z>P{$6a$$0ZpWmG@QKB*qw(F%JF7O`Q#=jL%D!VWxZ{8J12f~Na+LQb-~K##oKXg|afPG0=LqWcx` zbDtjkw}Pd!@^x|!4-Q>Fl?m4s;#g_s{a=HBfL_E$lF(r9g_#BejsoAXuzW*^P2@4< z>d7WK`$6tJI)Q@6X%%PV6@R|HlA8y;UNhKHjA$WzKk_95Y*!-8{dCR2MtW&cyIK!` z${_>HcmtQ-1}&iPww70xQA3AqNW3I231(;)PqL8Nu>A#)Jw}G%s5tjPeH9-*dI`)S$4Ix)oV0e*ig-1+Di8hQY0!7^A7lwEvtv} z1_8Qf)^wmr)_YZ=Qnesn^3yuyL^wge)hn4%mHQ%7M$knIgduCA3tv|1h8S?h(N(0U zP?h7F5@2;xdw}QmfEV=IV)d~6jZ4eKdPQjH(G?zm0bV+GEJ#9=b;M(0x(^~nu?haR z;Kv<3&Morq*`;azEwVL0o1A*7s@%1Y0{yh@A`hZ4^i6U_L8zCpb_uEjg~j4+Q+=R5 zvV6Z4=U1m&XNAfrP0cEg;8$zt;!D<)O~mj`Q7CFsjmUg3t8k+~lFdD1zY^T}w@!lq zf*=Wij@_bZ&kBV_rW38jW$rplhF^vRFMq&^D8u=ALIAmjIZ##wm1U|lLgX06!6v;s z>8c#BrNXSj@3w)gkDRz4?kw8xZ1K&=XLNqIM)G=em`D{`%5=}x3}!=QUTAOyixaK` zarFSPTIhf-}FK*4D_Bt3(LcFFMCM6}63aj%M97&6;9NH=}vMFgP zk@DK17#eD|fA%!K&^m?GPF zOboxdK|vh0W6PWjRV`c5sa;CtD~=8bTs?N@@w-24@SQbwUDFMW;b%CeOC5{lO#Qae z6zsWK6wH^N_H#=oIfJzA-Bv$inTQj zO3S}Lw%Tk{+c8_D>!E|<17n}zfUaxe!1*VAkP^>rMfXtOCS@wDGv2;9U7p#zn*O0c%&2$Q+wO7PXg=YuRU>aunpBe((67_%!6Y(Cjf9RL z=?NocLVnHU9Qsq7fg~sL5ysMlbX$~xOfTvY7Qk)7x~<4S`X!R^yXqkDrwjx6HyB?N z-fe|5GEJ23sMPO7CYX)sKc)PH�GCpd(vD!LLc36M4jIsJ$TajnLadF^#1rsURQ} z`6k(Z&fM;3>27E;Bda)lyab8X8xMP)+7I1L&P=Rcz-XeXiD zQ33uadiDPv?zNH78P@fmxZcSjJxq#Qgiguvk?@`Gyvs*Frxwhn$ehf~5%PA6eoGms zbS*n6|DDt3sk5t#zNy-KzvOm^dpS+hm}gFCZE9cKitEF_bxvA`=xKB?kSW6s$ZvJl zButp#|8BeUYfEYCa@+RFzb(FPwGG?uavc!=Q=wsZJ?dOAQ^36K*V%CMeslihb*>ug zA$(AGKm18~925xq-I2vXrgpIdRb7HX67e0(amM;LakN}KAffQ(SaQ#jAL<>O%I~PK z`>^MoGcsf1oY5f3CSMuj6jD6tClbk=gR(*imUKM1peH@)0Y2$szG)6B^bFh!kW)aj zv6avyQ#Nc!Y)QFbCrry+Ll~cDSy2P->|yob18kB|>2GGahw&21tCXah@ic6k=>?Xk z=eft52UFu6a9@a-3b)*Dny(j3+cC5uf=ap|M_pf{(ow8wxck8sJ?jWS3#>8>ov6tH}Y1(;=iUDfUoGVr0})d zg&L#o_g^%^rJw{m7sYukqFhBNS@5dYU$)FTA|H`C+J}odFr@#G&}yUBjDfhsO@j49 zqVK1Xj|mAz>KQR2_d-8z2G}rtOC8SV>H=$FC%3R2#SN-Tic8EgzZE+^Vz>Y_R0$XU zl1$)L&9bL$Ld^6^uCE}yD)`n@T07^?hQ#bp3wN^3sM)@YO|D>_sGR3@v`J-*2 zZPsRqWQ|IAisDXm)5$Pc&^$Y|?P*(9uXa;JcPq>3#7xgB*>Fuz*jMH@E3{z(E}GU} zLQ}D_O>3h039{+FT|jd^c!~%>on~c4z$ii3+!e3!!N~BQhIl{e%#_t?1B+I$D#Q@F zJo{X}S%7k*`5O5ft4!P_qMk{_73H|ubGL7WB1XG?A9#h%lvJEXFAIo47U{+@F5+ob{3ku%`lHxol-Xb0l9mQ`&p% z!GQK?ScHdi7P6|EmW7dDT~@_XR|?n^3gR!C4j3xEkFK(v9iAWa1_vulSX9KmDMlNe zl`MHcVLJ3=^C%Kb>APgRdexbYVk7Xc#2&NeDP&NJFGG)^e>pn566Id$Jx}`fUggLK-Ey3_xclw(Q9uINu*O*8uvbnaR z%F!_y`SSbLu2;v$SRp$VP7IM?4lZHE$!)yg>FjYE;S=`$3Db@M33Ny%aU#b7N*rNa6dPck);!0%5r)65 z5LUU75^xPp!@UV>0C5eO#M@FE((}G~N(equVp2($N1QsdGGZXcy1=)l}k8(Zpl2MGMg z*aFJSuY6@oUE`5c_^6HfFigYfA>7;zn(9%GX@cd`Oqm=* zecOlJ)m=V4ZQ;my>$CI5E`3ra-K-jXTC^)_J1HFoWJPeq2Etb`b5PC?#(9zU7KvI| zENki*egoy+$PbJ1LjJvP(a%f3TPdq%P8Wnm<92h_vC(n%RoKzPW%GE$?MBXV+eq5h z#F_zS_a$7?=M3otCkmaSI8~yAR7fsD$!u2z1a2u6%ZA?8mTl5Q$r0&yAIiF4heBke zZc=G7fKGYh(xK+Odmg2!YMzX8p6MWgNfVtSvy*wXIPVIXXkHFbENqa&9T&NR|x|%4J8!+(cCtOgYfZKY3up zi(>`abp}6XPSox7ZOuNNFwE1V?=AwpUkgML;COCRTF6}5ZJ_K$8IuQvkNGy4LbdEK z|4Z*j+zV03m|v>_B~KI67amatB`qD2vBj!;n`cwED7_V@*ORCCs&@+!SrI=s7n?6z z(9$-JaK?wsi>GV8b=Ym0+JM;p339sy`JYx~?fau}oXA#3(9GnX1jXu4QfWAxSry#m zfLQWU|BQSgvwpHwnxgQOC%AJDyw1XjuZSO0qh2K=mW^hcB&PNj{(K0Y$fhTHTUFA` z`aX3B42S^H>fyz>Nm0nFlB8I$B)Up*>;BON0nrB@&{#@1 z3D`nh+kGWvEUlCi52$0nkvgT=Czp#%qjRlZfQ(+=OSTf08Xl3zJwhT5{eBPa6rM$Bo|`!Oc*pGk?1fgd?5OcvGQ46W)&WBkBbNM8Z#5#fZnYfBimH`5ZTl zty#B?gPBU|8=Chm*1%4zpS$2F;4tJScw?F2b=d$`qjFk9-AkDN4%xu?tAi}kC{$-y zSZhZ>$!)KgOL3o~Ifx(l=rsLtFxVevgH>z)He6;A1yce{tsE#^gVg)|L#Mez9_LIk z&kmDHc}h?>Js;Q78g_5UCdWZD=8KNq$2 zzJe(A&v67@4P9eR*MMaE1&CkKOY57C)I@Kk)YUBT79Sc?S9rR-jcD`xhX4I0h(h9X z>o_Pcj;C1&)wn+Wl;IPaOko~$ZozKPI%Vf$(-W0h(D;s$5KEKMuDsWzba>GBWP;?truk)*grzds7v~ z5Ui1l5{d*H5K7uODS-Ip4N4SO=nL(<7~2zCN58bhXmbn#uf*{FpygHVT(=z2N1JZvf-%LUNJ3C@}8o>1O*k_a!)$&H~yR6Xc&V3T@exzO3gpcmAgA7P@0}Q{YWdJvb0LcJRTgbAW~tG(#}z_EA+^mn=Kx?`U8-u%!*a@uER-|9-@z( zw`sz3&!Yqt221|5jypub3QI<-Ij64oH5oxhdn_;>Gs;91&(!DQ9h#GKr7q$@c@SgJ=UQlCDhJgS7sCvif zOoOdkJGO1xwr$(#*fyTncG9srwrwXJ+qTWG-}f8moW1|lxU23l>i1eT=e*XcCPsFb zG#Y=Y=y*(AaF^KOKL>*|{&MYbinl?OXK-jT%hWiXbo;wzmbO%XRefXjFO*~E7jBc> zgQ2a@(#`8B8ETDq+4gH;PF0li_V+>rl30r>VU4L^G;dlhCr58$+gwx z1*hp91U&*=GesB_Vl>2nymKxr9C?~}eon_rTqL(bxYCb~)nK)jG3o?PbIeF_+*MK)@ew5gq(C%l)W!^d&TWI%#dkgbg5OP&kfO21z5G}lzl-+ zvxt^Pex(gO>D^S1k|F?6I(7-{%cw|tC%;3$*Cqq3TG5}F<@fAHC$<79xv~xkeHR%g z2yF8ccl&juz7FoxrLr;d|2R^&?pn!yxH;mhiDOh_W8QHb3$AO?uNv3}lHq={cjQKA z&)M3-_@=Q}w;htNJ=n?qICxw6r*@tXv#Hg_~`%uk&xl3?_N+0tq4g0Uk;0*B( zyiPi|gK6(Bv14FS!F{|3xy=ak*ke0yR;2^n1Yxdg3&!`EMt6^@d{EIds((nxEU31Y z_L?7>>lMTko-3*@Xcma=fiue=tJBdDl0VI_u(-)Ik&0aEcRBo;`=%pv@j z_MAMwzj~&{v;MpZgDNsXMKQadg7X*YQi+4L^bP!U-B)-yMM4tlgn#>fe6^ZB^B0yh zu|hos;*4{5_$#uBms`oeftUj1;$mZGuUjfz4SJP7xvI6HXJHGDDb!t|vMyHi$gFEG z`>uKyjI@T^XKeI1K49bF)=7SJACb`GK@wm_4 zJSzsR92p;zFAo}fLRn}uBwl3wVX+h_Dd2qiy;A}oNBIkp5VemsMTU?pTG~bWSW;Vz zN49dXC-{0?o|gd+b~vd*#zkfn7=~3vvS9&c@zsait)sS}3HD!e3+e%#h*<(?QB376 zzm*kEIjZTKifL+;kT8OYTR#;+T`|ndAe;;OG(tdJS2OGY>Vf2^zM6ab-ny_(J1AR> z9+R|s`$1n-8|ENKupRV_rEB8yQ9N%zC@s9eYfHm>FgI|#fN}2Jjp;v_^eivk-h z3{H_<#E6exA;7Em=eggzrTYy~bQCRPO8RJ6c%b{&ONqv7v^kP#Ny4~=uKV`Y;y5Uh zrFi>P{F4mq9>|+;^v7ePqN8KVB5G~Q%F1fvD?5|IcWDtKpx26IL<}MqKt;SkH9~= zqie3fY-G_~2U`4VzX^(TfAG25Uq5vSa10$zePkkM?1P3M-|^ zHwUmg6=>!#6wtMywU0^?=I7E!Sfr=d)rNVZQ*ymbtkQmK8^Qq^;aQEN66F?iXHD`J zXTlNCvZE0!${%U`Cgo;t4y7LKUlPUfS)e zr{{w`GUd$<@^cO_i|^2Z2^JGWD36Kk@UT*o4&;{sIC-YL1lHO05qPSL=g3>jI6!h* zy*hUNew&(~Zi+0kaCpz&KwJNQgJ=V9AZXpbKvT<^xd0VqqbqgoMMneVzGU@P0T3D| zEkxQAU1ujB*wg7-A+UMk4}seG<9;Ei=hH9#!dyyWrJ~zz#=^>kY|{6ovTX)>DcrQF6e0Z(}X_TjV{dPGDzK=EOKo-x5Gtx1XoOc zuFE!6isPL%F$3~0qrK=&3{$)qH}Oa+^Qlst7_}T~J{g;zjQB;xb+*_{FUeOJ-v*OZ z1GdruLWl%NZTJTI%8*%Uj|@7pPwSi+Snbc*kk#L;gRR8a?PHB&&RSB1 z+rHM9_Y&P4_(mhkv9cl()?>*Aj7rTT)6>ac^w`jJR2>aEqIkuA^|i|n~S_zb{x4&dpKCmSIjAD*)+1a(f1&Fjf$3_;$f z4jBdXk8Fn^#%qCF1V1KyZ0Vjl*93SZcKQ8c85h8cD8JQPFf6$?MUS=?IW4Oa_8jNG;Sum~ zjR+n%?zE!@H=t7>J8gP07NpuR!KQ@0O;`@T@QYdZ+S`l(lV_VC3=lTt{8qpQCZIci zqm!aXu&FMj^~~H?k(*6xks_r z`U|@+5~v6N_C6T7*JTd9$evjA09U6Zl4rTZkZz4+p#IHN*m~qs^bC zIsN_)jr$xwv#U|m*IP5tcMfP)tJAO^l3zK+k=amFnyvEl10I{Q3Hwu_{eu%09=;Yk zrE|^y7@~HgI;O{_Wl~s&w1)ti&iy(Jdrm%E*<7>Qrku4k(G*M4w+dPMW@iTsRdA3JJ9YlyGXRG z6*6wi;}dF++>Ra0Z)NJksTryl{Kgyo?iCj?QYCozxQzdKS^bFx{yc^51fSj?>Fb-T zq+&V-Un-8OWGN1psEL*yCXwZ#x`cUy`WKYPYg|ipBG+C8}+-)CKzs^HygAAocqq z4+Hv0XTBqFC`Uug#q!+jU%Ih)p%{X4=UbNh0}-S^xl+R@H3qya(}-BJczq!_)xXDf zJg(Q9djNf^Os{a+w;&E=_O8eVPrIZXpXhdb*VK^?i+lxp<^Y+8k}_|fHPYmA30_;T zWr1?bE=>_kB}*PI^um$YMSGb>T55B{d3Ox~oVXMCk&s+A z)MeapdLg}hZb??gayI<+&ZOXrw)%;Hjoy1c=`y63Vr$5HSK6=#MQA?vT<|9i1Axqo ziBa5k_h3)7D`1ls5cQ%B1gw}bAxZbT1HZ8gfRGSrfjXCRTeWf4$_6sw%U z-4W%(+0G)@nJV$RNSO7DfZPrJlBPXnr`s%CUoVV1^ zOnNEngKbmXOk|)Jx;qTm!(~UmF)UBu0T2LBrw5VeQX3@WW_CW^hG0?m`+N4S?|Dp2 zR6T&GP|g;~q>>_$0_+wX?2K%1;L4u1)BNjR;zq+{1tGnet{tO!) zc$C|-5117a_ADl&*sEg>UU@o|TaXvpIpg;yQbIvPrH308_4#!tz>~jX_hpB10C(eT zqCh@AAPgckhH>KOs9}0LEN?8fKlhbB;JK7j5*nM2m!WP}Zs?Ov{Wm~B$wI*6!%b*! zKzB;Atx@2?brPwiNDfQxn87ISHR<$v6?q1D6%fRs%+U+iFHcIg?h_q7FP(t^z^Sdj zno6~x8{4!P^qaEKI~7g?>DI{GxPxb0B9fL>MmC|0&68L#nB*EccL3b+1S*G8ure zu}Z|s*lGpIke~>u71PK^;DE8IsAG9co)`ROdaRHDLnC!}m0#3?-p($Wq1D!(53*}+E>=k~|gv%zd1`4{dSoVSZpo-9n4HTeaqF=FQ! zhv+H|aoTe>ss39t+%wEOG?Y=RZOr?gGLNAphuh}Mc5;Z@CHVyU7+}jDSV*B_ zzer+@a-^WGnoNy&j(RR?4bz;JCF7;CK*cx_bYJRAWjGO+C0q?CxGc|1Av_YAF8nMn zS+t!`p+cxSlY)LE(ymgPf^DV{TNJYBdG048=O+|fETP=8 zXnD?m?lO^qqI^-tyyzWOBv)3S5}+f2B8jb{0t4nXm|;8_j?bB4;W!(>`N(mJx(>x_ z>F^F|j_nef^Y<9gpcpQR5bklm{k9T;PKtmn&sM?Q@l&(V=_9E^+AU##^)y%ZRdf=w z&Fj6}y>(-3VsYR<$2XV8Tr^UJRkUy04u&e3ESKC$`2jMzGyFz zCoHc*cW7gMginitWR|q%Kwo1F`?MG4U7ai5RpzQOHfwvtUC7#pQ|#3&<6;uQL@@lW zM`q4l%0K~27VN_}5!DeAx?0%;uJC^`Y zr@_c!dKBbZ>#g>mkhd3E1_ks3n4D=!OZ4ZxKFDKczdxW|e0&^qNxPA4xxq>qQ;&r$ zRm+|lkGhg_Ca2~uh&RoXLx;~|Zy(xpo$@Fzl@!xJV83E&rwS8C; z^8SEW@gzFK>y^%yg;KyTRkj44W5aDEz4f$ZAdWrABv zy~s4um1>)>mD*UXC_QZ(h&d~A%`r)~;oQZ^&h=_zv6_3WMG&CVqfo8k1 zl^(1)*dU{HLvFt$*r4ho)8|2CAfBMkqufal=2kJ*RQu_;ZA58&_4&3pe!bD>J~kjG zA!4fE@*S1$nDvKB)3AOF(e~N7)}Em`yK~6+T~fA2;Ct`5xmVV8*Gzp@xJ!~^SME}^ z>?#`Bgw;1Ikhkm4EeS!NhFlC^wZ>Hl7M#$??gnUOsKV4NcCDJDs@bi~xcF&-EiF97 zTW^ptu-vcCOy3MPXt;W5f#}wAmc@U%3Iqt30MO8sq8Z|GiV^5??)dM=JGx1c=f6fA zn*5rfiBRx;C`43jh=nHX5~-*~TscR=tJwkWc_q2ysE}#QJbH*=r%OSnnBOjSg>L@1 zyR16B`G)O*dR@7jtB@>7sGkh@$ytdRT8Z0KXM|Y=eS{O!@MH}ZMkkr|Bo?nw+k4jYXwq4* zRqT{2WjE-};eLKJcbi?&x3@7xXzI!(Se1;RY_$|6M_d|pvTP1qn@?YWHGIvh%-Y|?-}xM-`tcE%fi z(&P$F9iS%UD_DzPOYMU>A20YdXA+3YJ0mDRL93ikt3+N?Z02dBl%~a_5iXfe)duV{ zrWa(k5uvZ5k^I3YK}IZEh608gPFAxS;bfwyQuch%czsHm)2p+I*bT*qw5Q~l%Uyi_ z63Q#&+lK0@kritdY~lcCcLjfqFfOU{jMK=yt@9NP(TmWdCn;vL8QBO|p030B36_udkdO)*IY*&aStwj zHdP)sw$d>hY5yHdAIkRhr!UQ@C^(ArD~tmC7K?;C0~TZ8S9b*B0(jD+U=ed{Yyibq z{C5=bE7}4Rrmm6XXE~ERM2Rr<*Z(N-oVWLbUd_j-Uy9D@x{F zzEy&4H%{l^HI{D_yv2K^1C^=AfjQU}X!Bu>>3ZVmJx(==AAZR#A)@$PaQEPisJS zuMdD37sHTAcveBRPjCNQ?BMJbITt!UB-ss^m=8m^x7i0O`_r2}-vG)Di(IWG8Ogdy zXZ(jdmH=gjLCV+>vxojO=)|8QDnDWcDxa{%beC)sqbIhU0DZCC<{QkgP&h@w=}y91 zzgD*rG;+JlN)>urvNsEav^Lj)*C#|N=n7zCKE^JHGdl1BCeyM&R_M;2C7|PcG5qkm z)gJ{>_^bqGk>2Xx)Kv##SEF|+$vZz#cQ%23+0ge$!8=2eUy_57z~#$?8MPsIA(X%S z!;_iK;9@f0Q8`9S31^0GeyJk)LM34`6<*jh+nOC6nwdp`4qlbmTcYUrGQV+GvQ+`P z0auTzk6`*QRrTiK9j7KV+ae3Eh6lH3B*l2&V2mKd9D#^ZcQ{GNeK;6KqD;dmPe4GA zsB(KR_3h*Y5*oN#158+u=Km(SQzvwd<7HBV6OsS9-h=0MT&|=$v43CPYk~dHb!PP$ zGJ6{?L#k(wx<8+g^KwokYnrNOL#hWfru(eP@L^hkt4*`LIQ`i2-(4)&P})LLPa8m& z>kM5kAlbq}jR5B>sHy}YiUXb%{!djAHzicQDD zeKCE^eQn-o&6#e0f{|vemK|x9hum(Rc& zC#E9whchwASCpkr!R(#!y~f?}lG6oBGhWyd&g{#EjdcZ|otADM8l&G{#Hdb%9rqMb-VTG!DA;z=F-?>gsZ;mPkWXz$7aGu*0x!|;r zovCaweYTpP`Mh%XoK`Y`8N1QUA#b&A?KNQZw0RNli|ponsf&{CCWtqaxEiB7437%e z*-%!i7{5WS-!^HiQ|3vC(+3>&k5o;0YAR>6@oOIiUv{E3zcq>>#AINAl{dd#B14C_ znZsrghNGLe#vse}u0h?12EZF1dwviIrxx6SWiSSXU`ZDJ&qFC7#x%C9PznklH)pK& zD7OL8wfu4TwAU9t@pX5PPN+-Y`>6!i`tdlnF5>ZK z-vGlZI0cHaN(cZlPdI&m`s^hk?i7teWXuoef`Nm$|Azf+^1CLKIZ$DGR3G4b5`4N? z;RPGcJMG4MY~BTYL+LyU`5|EIUM$^cA7*FiOi%WAOC`+V|9NJ+5x2d#o@FF|-RR^= zjGFabo8OFEecsypP5yeWFL6U}3+ZP+ExiK22mKwmUq)IG3mk#Y4<&{iY20tkJ?5~x zbQ2)^_Jx-#n2?vAniuRmB?YUeuCAk_NfQR{n^^}inxX{oC^hvNxcwv-hwLXKNmfLv zfS2VxaUg+p?aJ?=cocL$VVxW2(RFd#tq+i=5!l%(jme>J9D&pzK#oizwB+L zV+M6-Hbsdu9t%;wv=Zc@GgN+FU23@H^e(zoWE(fB-(f-CC#!$k9vEi_;I$Oo=(T`RTbk zNcRp)CVAs?(l*;>?|^_OgL2SghDiS~vJ} zz2z!QpO~KD-G)@cBlc_AeW;?(f+==J0x`;YxQV+{mHC_4Y}SPEpJA%@%9l@A$yh0r z$B@Wf?Gejo1) z=r{q&A-9Aj_jyFJNG@6@E-N&czanWGjdnu7V=-fxd`7ZM9f_6yq@t{mD{209>m=PAaE37bNg{=brVjBOjs4>wSe=%n;g=fbM_`z>go+%I7r*`p zJq{Sewf2vbx0k$;kI99Zk`J4OikF5CgAW7Bu*MrF=Vk6>9XUfacWbEVsYRVx)v^t< zb+Zjkv*;)3#>vKKW+o@pL9z5w_tq}_q7Sm?2)*EVOpxf&nun%#1Nq*_eSxSi@!I14mSw(Z<0I&f$3uI~! z#ZwlJWz{|9&28;c8d273=S}yX@y*{gzq&Gnf0xWBbgg#9$fX3J9A(0LU3tl?G-Z20_??~)IFU+vTUVcc(>&LY)*JxeN))n{dq zPk+F8adpF}Db-#TkK0KdD46B4(o%4>H^-1MN=7?#;~(vqiCoIPva<%*Gul!mOe)b= zj3*3ZgrUj&R_tJ3e{`7N4NrV+N4l!Kg}p1hu=gw&ugiZ8cN zjIQh9vvVbVIoEKV2ALngwbJnNiv2(+_~qWv>hQ}mpNmI;8@Qx_nhdI8zHlDJN%EwB z-2f$o)n-fNV31^=Oj){qO;{>8far)AWyREUs3bo-8_Y^Af=xLJMcE)w@#LITx&i5t zd_C*YET4^r6}!X+AvGN%eR4=rVbY9Ox%r)*^ZMT?b!%R0NuP5755f{>nmSRtHNtNxt1R;CA?UimO+c*jCeq7&$rlTo5(@Rn6t? zNGeW7$wA&>vY^JMHEvtTt&FFZuamEns~4?a{U~bUIJVhefwrakDQT6*p+UrxD_YPe zKyqL#&p{BVpD~(nN^6gx%Qv}gD$eFwZBb*X>FT4S2eh6sy;I+|x?2y=_N&u>qmaYM z^cVb(6MTl+WlgdA4V5Hb8ZI_|8g{p=@()BI!kc9JDL63i{|P!*ype)({DU9Nz9|7S zB@@3ZCA+)}p>X_9c3I{BJv9GIHvdmRmxYs+<3AsoHN4bREieFqU4P4Bnu`&W3%#hV zmymhadDhoe`wN3`gCdNYTZqc2bl1Q@AV7@AA)%m+C6zXH(4DGb1weF~bR->XCr>l& z-ABr0H`;4YT=*Wyfl>MSzf2H*9D6o>cDj2%I(vP{V-`abrN~49UnnZczY3En=wf1G z-^ke4-#LUIQz8cShmdQqP4^s<{auX3Q*l-IDf;beR^>aaUK7Bt9S_Vby`i1MSX3fS z&p#2*N5U9ja5??ES`9^hNvKSnvs0gQQYvIs#Z4)_d==(m=ioK+7<}=3QPT5p5HmCI z2#_;TFtD&|cM}l<1cdR?3UiZDkZ~LD-y|jber{0V24f-=Z)LMHQ?iqIDCtR9Ow7#H z9xL*fY%qqa^f7Tc1C23Qgr}$|GO(vZn4&Y4%%LAFC}OR56h0J zn)sCeL}2^<*pNuYz41Id6bxclQ)yqdpk8%Sqzrku)7H{`O{dYaFX3k*q2I!cT06?4 zXF3~>oI|n=IM2wnb1|Jw^B)yE*V3}4VKz=~;Cvk84Wwno_^Uc6#s)a&#<-ogQDDx;JNFhR3y6dTjF*aU^3jo&ZQrXMfuI@Z$D z!mFNLIhBJqcTsJx0N0bDWgfvzUE)~?o7&ub0$*Mq(*rg@-EFFqal{n7!J_Ded_%jO zqbeZ;Y?wqaDZ;FkEMwAI{`Q0_`DbZq2;@L+7Cq11eO6>JA&&t;*xXe&sPQ~};oRpj zk)9avqVeLIS{vTtMn7hCUj%zP6dz~~kG~G2b-1X*66W=78$>4q!Cd(PUr!SQBf#41 zH^Ypnx>iZyOyxL$z=nHlmoBDBI<4D`OXH6O>=HyE)0HKF-^^@xxXbFvqZvfHL^Vb? z;|Pk+OEtd~vt;Hdb&C}5GPL&j>5yX28y-@82gND_gv+(pr|4Y#NfEm>B-j^^a2CAw zqvM3oXf=OO55sj3d^q;jyGqea47BT^|IL@MzMyqu&vg5IA8|DyK^QcaHnrwK)s$VpB=N;K_meV}oE?9XSpuH`1OoY+6JV>Z-f$O?V zrrhs6%Ky$uuAHkp>})0X)x$lPF8&7{e3UMiww^d{HMjlSo9!^?u;egfKUS{rM-TS* z_ncT>Le9s8%!F)AMG}i%n5>z4d#cVvViSlufEW?nBf}P(!Xa2AN*}guT|i4_O>J$o z)O4Vs5s%diI26gnsfHNwgesV)=({EfQu{WwS>0SGo?X!|v4BXE+(9-La61im zr`KgZxeb#g4h}$>qN{3*H#ZQ+xycU6qDZ8gxo@+>ebdRA<7wvLbNs49gqjWv-s01@;I2rTXROP$n8nqx1v ztb}8oi1^sB)oZaZbR)hakl5fZ1eQV4N7Vm?3%glVW*V8yN3a$;d)|!a78rT1Ou!;))0 zB$B7XbB{!9Td^Crk$V@Qr*5%{>^_7n`=+54L}~j&S~H3&F;JNgR6E*}Ztxo)3AZaE z{OzNywiELWDKZ^1u?v3_;0CG(@CS=%l}*=@V*XkjizTN?gL4xLwQVX%qfsMJFH-^& zqcfdWaO~is6O<$ibnOM-x;#;U7!y9QUhD;~3g%1DSRy4r=4Lo<4=S z>>Ee2SCXW{y_!V~t66nRyo)N%It5D76pMv9ES;SfVAQ|f$&vr+Hed8o*<}~>DFsBQ za8Q>w@Mz>1Ssf{2IrG1eY8=iU=e?^HI7ppwozR&{v!m$m@qG9WUN2031vu;v4#-sZMvsm{-jCdOY1vGFiL$_+21uNcBX!(a+2xV#0Yhuacwx z+}-C`Gs@&q6X&${J>7{KePEoK0*ApSEE}r`w$JY z11P=EFCIb?r-p>Z0~J0ltWbDhHeTVb+Kd*YJ)dI5u5zZdDXX?(x`&X|2`U=jAry`x)r*7t(dtXB!}8cwTI{YNW>I zr$#p<85}Xle#$?Iwxd+MAGh8b$n1ZRO%*d&{Zl2w6B;nP6=Z0?vYj?Qx{c1ihKdj| zLgK~c<$&(7g>ubnp8axaWlUMa-}Q4)>-)nmQBHykc(C$H+sU~+acB_moww!G?vE_O zT2Z5UY4WwUAB1!?=`VHl&a^r;)36+)ok9GQu3e0Z2LsuqEEUkj;u5*$pD7Rj?dYea zv?CS*T^Co{6u*r$Zd6C&FJP{zMVU#*d*!=M4;sJdH;M55=jjpKSKXa`cTtx{6lf004@lU55>}#$J+ymW(xEBEMUS+L|(oW+y?EH^+IdmNFgl13~X<(L$Qv{{N{y>C_Owx1Qx`sdv+X8gry!f4`P>tO$HwX^$&#Qz7uF=w>+2g0%R za!D1 zh4qHh^^!Y9%~Fncm&cZ$GgQ!eCVOLpR`lg)@6XrI&X3;@009y#~Qs9!fqmUR@1e8OzBtv9~hs8h|Wq~yW z#?0R5FP}maX_3$GjFVj5=LWS>s`n?Eb!2`H)GrwcV}&%bckM?-r!Xy= z$;pHD}fw=x6$8xcfv+C#@j8R=CJgkR$YVz8$}@ zpvz+BI@p%mno7&u5epOV!CRZi8(`eU1h-d2+=MXT+CW_R%eNc@cXbt@$%U#TKM8>@|_Ev+-zPs(AJ1Ssuq6Enm-BtMdT znzZFkcDxnjJ?cx(Shvfhc|)V z1Ubq*7Mt>MLk@zca|v2!N?M??|IS%Kv>^~;ojW4}{VHxgtV{4uOebcXp0<}T@Q+R7 z%!YZVSX{n{6?X&M>;p~z7l7auo2Gs?twW5MKrBHX8)gx#dUBZ&g8L40ddTTxl=h~c z21FNF%=wP#f?yUQ-tdlvC$io6co)=J6Tdx$f3(7X(oI;+-!#+C;Uv&d-q?XxtTZI(&6`SE(@uHo75ON*evK~ zW^CNl*7S{o>6l z_N!OB)6rfsbp;@TA6$ssEoC&z@tn3hGJIc2c2DQ@0n;tbz_hMw9D#^Q%DRM00#2yx zk&as;F13lEP1CCtJ&|62JJQGns}6#c0x1NI=%~h)RMZbCgQ*2n6sKg?pgjni`n{ib zUvR_}_ghSaq*o}Yb<%e8bV680B>7FW`BA&)sR_B!YCg5J`OQEm2DmSA&UvM&b-)Sg z^;bY}0yb=2GO8tLE%9C2H~$8zW<1L5Qj%@509%^06}S4v1*hpWZdbTb)0e;{xn()$ zEa!_8RHHwbmVt=u!KGRu9qK$IjWGD-IxFEy-44CgC)&3TR6d-KN@#EST)&>UrO#DI-=8T`4K~>8I6v6+t4NPpCrRQ)^ zX~!BZCl^6Xz#)=ef zJ<{CJSCtpPV*)}&vrF)~5u1KGHZ+Z10UAV-QwoQMjFQ(ic+N)f0Dua!;~(__y8GSY z9I4blS%Zm>9;j|)BYYni^x0rbMDgnOyEo#Y*Kc^6jchlsDi|!2NI{7lh=hOT$Z1{Q zAiS=+U~3UpDRL!yp>b>%%)HMR<^E^ch|j=+2P5<~uU!K4cPWuc)sQR}ABltpYfKee zY9}p9+?4dG$J#W*EC6ZvSZ$KQ-~WEUOX8^9n(JVV`_b3iT0=e(&b(c48MgMFboA7PLlD^>-dAxRc`6eq zr(83g386vG(!|TzKY>!4OJ0c|LjgI53n1j%)4D&Q*R~3P1xUnV^d$Q#WcV^{f1pG_ zN}HXbfG|Xm{taf3_wjGsq=q;xnxRjbgb_mz7h*wLGoud`aKrpH9lz84S`tv=g;0Dx z?kC&Ed}=$9Z^oTve4B590P5n-uy5Hp$AZj-QOa}=OovdFyWmna2g)N7IonYGMQv3) zcsA%_iNNQ(4mh;~%Tc!603C^kFAb@nHdZBhqUxw5NVotGLwQH4N2pLRMYnP-@fHp{ z2{_V>C`prKED3d@MERHx#Y~cvy$-n8<=4%7nMUo=n3ZV4GM3Xn1=rc$F2gr-*-{o4Nqh&=>s zmX-ghs(`3qZrV0)%0Gzf|Kr&dS=!bMb=ffv+wdpUnHI?>O1Qj`!h%GI2T5p#83-H7 zwGn6>k)5#u2@FXV9M(r5cRTSg3KCbySNcBjkTle%U!ktZ>t;5wfHYm!K7clV#lI(d zH~qLD3ShumCqI+HuGYn+k2pDIj6o?rqn99g3&}A|Ud>I`&^iVt9N`+wV4>MqTiv|D z0k;ab`8xThOt2Hmkm$qnmYU}h!Mfy^1Q695Mu4&v2QCtjQ2Y8?|#(QrO1)U6J60>G3B0gi5t8ZOM+TN`J*U%lJ&+x}f zNn|Uu6`qCcb7SZ1?g`VF)i0V~RzgzdErgEbBa(%Uf7nHv<8UjfS2X>DlB8 zNVD0Iv42I6@Z$y@Z;vdR0hGI(&v_6C0{{ws&a_WcGUJW3wvcp=EB}x4r9|14P*mK5 zeA}Yq*F2RRVllV)adEC~uxwO6$JDhZb31*djg^C&uA^oI5+{c$XZ5zpcq?HB;aZN{ z`!xdNE_*%H^(#rVDIm`MR?c2U6Y231ZtWl>xLRR4lqjP^=TZ`fenKqc?eAUg0>H0+ zHnKJa*|YNGB>rWYZGxN2(T50(`=3$-wPaVa*#0r1(yp@WgE>yu323U&O6fmO&j9Pm zN@^v6Qf}2?ek;*2B$pSxY=458uvd9|+PEY%Yqb&d1bG!Mn5tu8i+q97W(}lILx-)u zp}nGZqSUhm*;HCO=4;}Zmw~U8mw=a|QJg24roeLiVO3#^gm`3IYOq4(oMjg3??CB0 zceEfUvGAao=ckn$$sbx|oKd8z;EX(OBjl*B`O&fn^2fe?vkBRuvEzi>V=!oh?)c|> zo(>$kQv-SP3MDDSj=|rbVKfLeXV>nTiH!ouHM^9{#rHL%hC1mKD$x&M^ME*851uj5 zlJ`xKuy&)AAB@7GuRu*H+!*Hf7y+wFG_mpknOf>UO%Q(7a-yR%Yk@^;9TN6`HYqjA zACGW=ON3qCrn2$U;Mfs=NIzwZuYn_IS0SXj^L9!DB0~hhV3Nf>xM1;mss_cCeWw29k$+P#d(7j=F+nz$am$Lf<_gzyf2csnns zinmi+aZ~<%&b_=w72%{O`7LM8>WB<)ZK17hW(QB6{}X>a@#M{~BuR(XNe-T zB30xKc&<$1-(-Lz28aFc)@ymZ7y(6Nz^_lqE=#<(SLBNYn( z!MRGsZGK8AsZzc$p0{pc*^0t;qy1r{oB|owR}cavKP+y29|DBkeAD^PGXkORy#8R( z#+1?rsB&GABo#Qu8c18o%uQ+22qU8o&Y`V~;#S_w;fN`#L)akT^p+DtLL&zRs894{4sOL-I*!JE{1Lf~L{yLz^PMGRh9CSU zEch_TN;jtl=4zMSf7k8F0^|PQ4X7M2Coo4kuN*M0FbfygKi=~H+`>d;PXzP7 z9~^8<{{zAPuQL`dPL6-X=>IPnQEG1F*1h{!`fg`!6>)=f4jBzs^|MS^mGm zuAQ}EAO_RbzrssqpC0!Rgn~mH$W&;@(jh|vT^evRlrH}3)wylr(-oRg=<(er-3^9( zLY2xbZOGnM^C7Xdk*evc=64b6QU58Twn?p5_yn8zN zEGF?PCjFZ)*LMzM&4NP~%Zww4wlIn#TNq=2MUlCN#)^$~aRRZ9DAC!3M2hi-`Wv*k zRM}$8Qi=I@Wz|K@TIr=tAb-S}`M)}%Ks^glT!mVoq8|XVMt4yJ1`72`>69&!plTB^X65+;j6$xM(R@=iT$m_}+uPu16CxliPm%*rI8=VA9%_yK znVIR zcXqoS&POE63_0(o%BZv!2sMkog~_&rkg9?D6j{h>$o|FDP{OY|Jx|&51i{T?v5IHIXZo$hv{fbGi|3Ls`Am;K^9p{ zx3;Fihvre;qwsSME|Oy_H^4}jC(tyJ{q#HcAHi2;W~dF-H%DLbbz;Rf!IzK3NSV$9 z{e}&5y7VGFvaoh-{L!TPL&ix{;A>Fp7STEdjGujnFmOSMYnjWxFxSotr;n#1iSC%0 zU~y$96f>Uz$jhd@#l}~ZCZ2IUs4@BaYd7L`ikxc)44KwhFPRe=S4pk#97OK?BF-UuR*=5Bn z5*uYVmv_YP51eEEnU+Io3v6$W%?@zh*mgv>fTUZVu`Ir%y<-uE0{!V`ie+}5iD8M0 z)xg(Hzh<*#@9p(^}>ysm^)#%W)v?kiN z0q$`#B30ENEg$7i5<~q}StV^nr0X2UUcmZk_X2igFqhCS*%&l$tpqe1YNOtsg8ef4cAjfvk@vO84h@6Gj;%%4$pMBLUmq+*yHjV7sO7 zR8tOAOG_Qj^wnClhk#+@(q*f0rXoJKOA^%5HuN_lw{H2yxMk=4Xg$9I6N_$2b|ySnyXg`VtHSM-vhkehN(5@wt$CDWW`3_nyK(r@^#oP~rT z*6geNZ=8(0#TW4ePO5SFl)Ks}vHKWvOdsLd3+k>0S^cbsWFunq5PK>SaLI$RHasC{ z&+ASz?@o2|$U26W-nS_3%U$ zmtVm)zrj$@4FSVonOzCQKpChQ(wLUc6j}nCW85x@Fh1ML`Tp&nk2V2s9vaJ0Ccz?(afHldbrOQ{>v7mE>S)OpI?KUv&|6WWh_Auc#D{LoXkSHlz0dt>M%@K2R;>HScIKBDxb1}~MQuMa(5 z-8kDH01VV>5$Y!$WnucMD{bb5gD8$M``4Hl#I9t8dsQ|_DR#G!KsAY93P~+ zj75EGc%{AQzg(Y?86F1xJRq)mQ=a|GsOJyzcXrTd-AYYif*>DXg^lMp!Fhw{rU~0q z;fO&}T7lrwJw$by?v%PcWJBU~xs>Qo21sCXhLgB+K)Yv*fVtS@xpKUfhrmaX!5cUO zv6S%;)Fe=;w=Yx|k2~XlunFxsjLnWdT342buaUPalM2`)ClOg)+V}J2&&Ol_<(@7Z zXb&77#Z{s-VZ&Y_L%&V|eFmmogIp$y{GFK{{h3;+2hUT3f^`MFZi&N{WD$(SKN0S5 z>H*NOz=ll>7CP8>sMZtR#CqGDA`(HkBgOptk6UMqKef>zSB!nL=&D)FC zOi~77DfUXMQ9nU0Il&))3zbcB&Ake{M{q4vhMY&`R0JE0N9<+L9$Ket%*a!>z!a1-(PM2?WB99w%*vP$c2+kkw-Jaf3;Y#7vij-I#p2)If6@ zuop`9ktKsIbPbGU2|w?qpgED3(uDvK6t{oK#VYW|Y3;8deCFp>%gicTP`z&{gBweufP_xm02O-x-aa&9yhc$uyST zCd@qrbj)U9CcKRcT|H?$9VD7`@d&LN*c3+Eq6q@a0Q3<`_D)GMmq8z`!*W0A%?q{uu7@WHQH5q|aCC!D# zH#+vbe-boU8+~Vo*-E7Kssl`OhwuMlmq%=%4g#{pvk9%GiR8A0g!S$|>0h`5yEY6w zqVx}iKwoMXSh@%=VILUp_-Q_70#s*jEy$M5d@{_$7E9iH>j;|ZRyMIc4{4G7MCW45 z0=-m_B&i8$5Nf!LIm;`hAG!QMu$z0^whHsAQ{M`%4s+50O%oo14dV|W%NvoU7mjrT zo7|hYaDXFel>^GH)QOpERTg=mG1bK5kpc7o*rZ7_McAXWj!KHRX{h?c6~voZPAE6P z01R$y%&vjyaJscz3mxh}!U$0mW2RzVZz;nby(tWC1ijE@>WtR%EKT8y@X96Brj>mS7hk|yi z>nL!R5wQg`BlYavS_%^(mRaWeD>zAo#YQDn*oL9%T;)is{$~-z1QgP95SIma z(?eI#Wsh;RCAf*Hg&#$-MJRXL;QP^nqn8J~PRs@jNi=_KxQ3;oI)Ms2AD~c>88uPo z7)ZCXRS;32f!Gem3y|l-*bVUO?i{mf z(fxRC;S5gUY6kBXS(p%rm9D!9I^P8(i=Z=KZX*TLV`CO$4a*n2+LYrn7wR}{J&+Z^ zs(C*zT_AEkm6T%6%GyaQa3)0Vdm)IZWCcnPFe=NL#Ah7lVr~Fe6mh%|kqG&#>3MB` zr#=UcZYJDEU2F+JlXOc&EM6DF+iq26l&2FbyvecauZ`gnHr}YS%D}y60&%dT91F~P;2Q~QDP>i*F%OLtDr46HMF;EqATN)yFb6M^)7`&DO>x} zKc6+PaH8&wOZ`KLJWss|s_L#fiyeR)eOdaw>5D}QTX(?n_8i0R`C;y!G&yZ<4PrjrIQ)1q7Jo&7mDE-KXRf8ViP%+TWNfgqK=HO;yl*<% zp6DO+W(3~Pzo%cYiMo1TpMtB(sz0cAn;g@ykqt^7jXFB!qIshsqt$j5R9m+Ud4z>} z0YHIXpGSFy@7L?0OJRMcZda!&(CF~h`YHv> zi&(pLugy^8E3UOxLL5Sy&_qrjji>kd;P3i$MOuJ|U0b7Fw1Dk#R?Q59>BNE^BhZq} zO^{h3hg*`#Qkd~aps^SRjr*ux>WJ#1Ae*>0U$C#Eb6)c>pbf=>NXJesVZ8Clr(xoL zb#!Prb};I!`-+S09~id+`E2>qW~DD-mQw8QV=s>t^=P)VO4~u%cv)fgYo2BAKZMbT!dB4%nAYJU6Vd&LHwzhpe=Joq&U&BmizjT@&f z9|{>Ola@7>8^wg7M9geG$w0)Y-27*Ms=aPe%|xl$2?eEK%|-ei2u2`BrZE+ zo$!F{zC!$smK;r5|9c&>M}P+TL3XR=x>!V|dep718Q391L}p4j>Ax4aWdl=F4#Ngh z@=-AA-v<;JQbvs;LWdX|dCKF$hk4@KVvWq|!Kc`yjeXGK-mNB&6QtP5LZO_Bj+Hti zfAT3DP_(PsHmfyi=Yu{aLVyGJFU+~4lH1L$Bq9c>f2LB&B!`~Y@fx&Mc#!HvY0+rx zGMW}!$J%mxVk^OVqvgwQ;uU3Dmw{7yJJt+F#TcIZ<_q(fAQ21?jMj$ zqDPb5*R-g^t;wUK|EgiYr#ZEG7$zd%8M~~Srnpp1ArtPQzC3%qI|o*3Z$Jo|^JU%s zl0=l|00?tM81p#q!f4UM55o*_U_zZ8)`IoXR+={PXLo~}~t_gr0n;pC9`DSv@0Ca zDFKCO=Gp70`0XZ2wh3elW1%0%Bk@`nTlb@G(g9P#GNvo{;-9TI^#_xhp>+o38Lmgb%LH(i-Eh^`tNOCNbz(xm0plVe|^%E9iqY9|)R(pH}k4d%FREtc8 z$mFPDlcuWm&Y|keth&UMEm@YQ3!+Abx{;uhT&)aAWitys&g5u>E_GK;%i| zJvE?`ykNFk_yWiG2x#Wl=UFIxz}wYSw?~i_&k3Vv2jV$e)bGVn?iY-H!{J~cb$m}` zC}p5YtoQ`D3tB=#mIk?9^AL$L;LDtL2tr|j=nc6KDf^uFYeaNzRHc;7Nqox5!pyp+ z>4Ke`7#`K(ON_lV@hq<~Xdw^W{F2ZxIh(f+a+<_w6bGJ!RE3J6kw9bcgJLh8XT7k7 zY&VrAwus{A>_?AW#8d)??3eR6*K4n%KsGI=HMxvHeXg^}Hp&Ja?PWax1Q&xWZril| z*Hn7DX5hsSs1EdHvt5l)QH)7Kst^~%w1xXuYoi{;9DK{``y#0P7E4?4`nwQ5Yxba0 zUlX`o^uXR<4Cgm9-se_f#(A=sUv|*dWH{;|W2QI#Mx)>!HYH|1KBXB4(|v~12Gh;k zVc1;_*e@TYx#&JXBr8EYtXt4ssPJTe;S?76zqz5#-?g2LF-d{dmY!tAQWd7 zRI+X@7}=b0XR?g7Nk8iet^CYr{&IY3;#V(HkTY;f=xl^d039H~e!?L@+=im9|2uX!h`Wx-m4Q&&5_puWq&ePO7kG2T z!~ic`mexnv=~*TlcjBOxx+g;75cSeBI;7})YU&+0e|zM}oX3!5N3Jr32Ro;IU8zxg zKJDxFyBsX3lIRN&tX`Rkllpl%}BT47^G(v}EIRX(Q=-{_o1ngCJPZ(DY5 zlWHpnLhWfkKwm-%{N>vj3tIBb_|Sd5ED~?GoeQ?v+|?GvqU80TUUK(;14WA@W3lzv zK#7|VdMU4de^~=Syu3VU2K8A;>`B;3AgkVMvVwy8wF;eXUuq{Xaldq2b$x2sB1XRx zHs==*V@EdXF0VLf?SGlx;2sP2i-PnSB*d|Xytm$XGatt-5qHbG|gziof+J;p2HcUL2>Z|$o zi2V#4Nllws#Wfeo$a1%z^W8vj^5+dRZqN+YB=OME?mP%CYaF`Ib4bf5ST0Za;+e49 zF8Z?wep!XcB|+3;(}D9K?~=E=KY~qHGb-B+Ip73B7&*F)qg8|~0lo7*bEC&G1+#Q= z0sahfW@)5lR7SiekD+el!)Sr^XogAMv4dBxb2yNm%dsD+oQ3 ziFRjxa;8bb_IGGlI(nuzYVn_!)3G#66Fqn}u3sQnrdenI=na_%!n^Q!(K@-BU+y$4 zpSfL7O{5_m-*&T+0y{8r>Ki%9SENNh=lx=>A5%75%Aqq!1+Px5O!^s4M;J=@ktvW7HmH$#tW9JLFx*ri z7aOM;G%^qP0idOj_DUCBEbhf?96rO)W$bP^oU!D0qA(b!K*A+^5eoUXWm6FK)KDwA zqg`+(@G7NiEdM173!{?dD;xxVE$QVRmBhl$Tq(~o3AOTPE%hi^rbgqjtr=V%&>5#P zT*!+=gxAqBuWb6MkBp;vkbdhHDkOcs1&Bm>vEs;hAupY`~Uvd3uP$b-a26k8Y< z{Y3%bX9{Y9I2L+2Rysy>g4gs?o?&@}XfD2LJoB_r)ps1-hOBO1g&FcQSAkC)Id;(* zO2<-I3rC?$kmao`)^#GkZ3iyLAR}`CU4(=MLC$TB$2 z^vw1xaNkWKPbcU~;lXH_ps)@XIoEAM)q6R8yp%~PYc0XTKSZ}5IaY+qy|WLp2U+nQ zpFBAl*d8KDEW0qk`LDdMv-|tzBFqKZQ_VKkVGYzjUthSV+o18Ex;GepBkhI2e>nFx zn>t;M01)_IYP?I$J4u``9N_ct@DRbxJ=^CGyt_TQKXqiz7wGe2ja&hRymg~=?d2`5 zP!dCWd>jty2K ze#6}Sfb=!BSbjwB{5;IBpejQmZ^=k4Nh?D)CY6zW%tPs$l+~&FQIjC}>#+kWwD(Z~ zJOID8mMHC6ORz5M$`TE1znpV4Ioeh8(M%0?Fx7I=xi@t~)ro4T$-L6biL*HH3wRV#yHQUX)~UPvx= zRv*n^#42KoE~5-*t)P;_#Aarp&TrQ_&_6jPcrUrB zO;F94c2vd#{4L0G*+F*?G{n~N`1NoPT)gkJK0l#VL7pf6%Nnz>{f{^1=H~i8-Wb~k zj*avGZ;t@2Vjjn(iZHZtdh^ItyS-Q#=axCJ$IP zI?QyG3W^EdE6rwH4zl9CamvLI4 z4Xt~u0c7?1IH1f+6ivmTNF1T+Uoo4)je1$rXwIbJ>;T-*wn+*!Q zE{js9&7|eVE2vh|7ar4bkt;eLapGE+RH1^rcpNo}y-I^QxtZ4SFM1~KJxZwV@^tPZ z{f5r6Us_6n!D<(}H8K07PUIRmuaehrU{{i@pe;=Gk;^SzMsJ8xrxt3#$zyPT9`txI z&seC4o`0bP^}GM;v!HSMRlvNk<`M2y&hGZpk^_{Pmv1m2c~fP8YKD6pbwr{e0pMI96m3!9{0Ors6VpHbY&C$u39gRTx{G=@?@adgvE z*8)b@g%y3{n&(65@P56aXrqE&=6(J&;lMqI0BherN4FR#g+@4J2-;gZW4#2RF?-{_w83t6aQ$}X;`+H6#J->1O%o* z+=BU{?c7I@8t`5dvVcEYEpQmVgi!=O8C3$dPY6VoRSD>%;tMQ6{4E(09aGxeLx3b1 z73Qlo$I0i-JYvM&Yd=IjWmqf^P6 z8hQ6z%&lm}lYFbQ1wE|4kuZYA@>d35`&Fs%078vWA4aOb^EV$+5CD6v_>rW?B zfsA}Z7k~5Lcb}9mmtzF+YwKF^F6PV2)X$c1al^_NRI#P5@Q9s2GMdr6Zg#q&K?$dH-aCU63%i~i_7g@g*Um&JH0 zoKk;~bdbvLhP7M`!PqhUE@O&E@q$_J8SLxu0hr=*2o;>y`jpqmc+-dryC%Cwe7`Sv z)g=vz|Cagxi9lI7*t!4T2$c7~RGyvX|ERq7ro)yL+DPvOJ)UTw6IjED!ww>ZHZRep ztR0{#(=2fezBuA)p5-9HG^zN`t3m0b^|tPaxUDjKIvayJ98p_y_rhhSg07bu$$WS~ z__}ZWd6=|~`kzw9JEQfFOzYA4{m~WQUqgmfY9DrTQflL?1sbZ!>&U0ehp?~D1K>Ko z1MtTtAi(~I=f}MD6EQCAB;!zJHY9oSarngwrNhjdr(s8DeiIi!a4F?*2jWTqw|e2f zVyp677vLX4pYv{(nbVHy4j^d5zgTTQ+5>x_jVD-P`fbAOVjsjRfKYzvyyNgn7SfX0 z?!cdNXluC|(}Hh58*AO~XVMk40rd0U!9P~H`J3o$DHIUQjt7NA&2`uwVCt{8`drq0 z~>qZjA8+2?1P zTZa!w{J?!+1ejl%YHs1h1E&^2p@H&J;qj($9D7sKd8@eIC_}I8zk!~Tj32N394`D8 z7&7i#oNSa4)$8(u#}Oc7OksSO=xt;Vud!jQSB*5$ZdsJ8WyZ+Dsq^FJie1kV-V@}3 z=5~W8^f9cm9*sKbsa(VHv@beJet7-y?G@|4$aeoVp}uY>bk>?00Q<1@c}ynA3N*SB zCW}aqeWLKqIJhG~`L2CN^|b#rLlC);#a@|_N9kJcf^r5hTXLC#!URJ8OixO1004e% zRTI~>0~(UnSUgKXwurLE^nCPL|2+DWwoB3Y63J7b;*Fa_B1HQu;Gn?^2_;k1RLAXk zi@41uh7S#FaG}EDfbPw&Bs%Vk#c*5C3ZYyscqHw3NUf8^am3c7n(K~aZyA#zQ%%%( zdTvD>z0TLW$sYnX5*R8GMjtVYA+93oPQymTMf}eWx6K_t!aYtw=mwrVVry0v44_F0 zRJM)bW{QobU0Y>m5#wj4$t7S$(EG|0B?Q<^+L2vkYz%1Zzyv)F5)^m#6Ya)2jM^mo z^!F{+Wp)04F<($Z(sAgBazVA@AmU`d;NWtO3$QAxlj$}|!_UE0AU=6^`orFiXR%k? zC(Su-C<5n6V3yz=nG9!{(~m4At$8-V&p+P}KF_P(Op>HFJ*}=ja(T2T4eRpy47$7c z3>j(-4Dy*zfd33;4E3k$s3BLlp##nH>UiHDVP>i=J6k)`)=sBs&(}54Rb+~+;R32y zMBFP&e#vMiG?LJ8yMy;(D0fWwH*Ip;$Z75=xr6JXu4lk-yNLcm_+(m9Ynysc?-&u- zGa$&aAsFGS1Sr(I6w^uqe$^XNZiV%LQV||;J`N#C1IyN@AaftcS8b3cbP#tEzdj$7n(j*C1aJ)e?swHrZczJasCP8I<8OLqhEBA?J7Z_q1$`w0f z1h0xDz|Q`+lt9v=z&>-(ryM?{m+HgTt<@tnCXK6?7WH4_Sy>{^<8whp^Lttw zMt%f!#5(kt#im3$#AvV@Vy^WSfx&a^31TxMdITqsD+A%X1wdP`MJJ&-{d{l<+ozE~ zl`H^h*);LvxDb^WPjE2B`u)(j@+Cm&vR$e=bu8iy#f97P31K|=dU8`=KDmk@0X}W;=a4w7m zSo}1)OwQOq$=W2|;cdjy`~mt8(Sw-#_3wM-NCbN4%07LlR1@gZpkXYz_Fui$(vkj$ z^1~BjZiMp!d;Ef?;Xnd5n16KGBil=gP#sY|v>zKE;`}4m^4a5ziI@`$)o&J7Inef_ zMiZA^aoW?QR7GR@nJFTjtu;DTSHCTWftAu%t>h@!kG)lZxw_CSdTjEIvOm?)9w3NL z(CQk>Ew$t}NBymH(FDn>$bjvHwx|QntyJ_DR-?U)d3ir}b;kga1{{tfeRx8!Vd!}BW)TX!ml=thUe(DLS0-wJB_=0cIAV{pZ_a`Xm%EES%zBly>19;l{p;G#^} z1fm_-N#$E4n*Ln(Z>cY*@+XQAJrU`m5xAqO5hGUl#@Rsp(ip(#J*x)|QZU}CxpU>` z91@9Tzh(m+z0q_?cxXsM1y;3!!>;#P2U<-Vm~Z&uf3x1oYo z^$jP_GunDp=n{q$jIAo8{?C1HAfa!ie64FTplYfpf20J?@p#|!(K9~TF1PJ}@vyehn^ih zFDFBzqx0ZAbAI)q>vPYFu+?(S5)oJceVlsrBQN3@vi!4BpVAGTOutBM7=TL0+qqc` zRqvz=-@$}0b(0*a%S*xY{l0>IKE-8{@lcB@&fd;%!2%jppvPYVw~NsuuL}5z($4)p zpxjpW6U`;=oI^6e_T4ZU*2cU^jTUSY zV*x%&f|F9*fSh1Zp5}~B`(A-J=+8IdjRiHA|6)ycmj8>DY@9s*H&Xatqxb)2O^*M| zn)Z%|Txfs&pXx}W!03s|q)H@uuFB-Nb{sakUrh{yxO6dMBu8z`#_8wpeEN3U#D8Re z4iRNk9LINB#=zEpW4ujGvCmGOq2IHJ=Dk}7)U~1`3n~gJ{0@l9GOS|cGgMUkhxTOD zk(V(IA&DUw8Gi`D*p}>jdinzY@^uUxVRWx^D2p+UuOH^^asp<2aeSG-2@;@iLQ}vZ zeNu#rr=5pV^2GQz3&`ihD}FjhVU6lUUAw*E_Z#6juzcj$8r({&^r+Bdus7=|eByji z$YdctwdmY0ff;A~C9=lyYB=rCxwQKY`wT8S9llx*y`SIjfKrvLkF4f?cTNZ-omRwt z-cMjTdN17Zb6weoXSr7F$isDdMv`^H@WJQ^y?A22-1rh?tjJCmaL>>B`0XKzW3=0r z=Cj75N-z&p-r12NzY1GX$lC#hCN-_6(Oh<>mW=9$r8!Po6)W1Oq%bma578vp4Eb1D z_-*pLSWb-K(my)i!QnJ|GOPg@`#LSgtAp1v)bAqtie zY4Mz0QB^+!uyYPDG)TBgq}Id(?sx`|*spvaDJd{P4o_FC!iUn@W`clK`a%K=n=k_m zcC!_d(%iwxzd0yWSR%vMrM?r!r)lI1BLpqtlMFpB?FAe8=U2I4OMP2IBSWIUbqh(iqIY4Y^fPH)Ai4FQ1B=8tb*$laA z?f!c=;<-kXQTy2$m%IbgD9%M(Hd*iCX8OE9h|WW=2&8Wizt=T7sj>cvvf*&aYr?cc zsgfN-ACAVT@Z;bC`74xukwER*qCiMo|M4j4W8qJ0WbeWk#vr|gBfB10$4G0JQ%@C3 ztcCzsn3Nz5zksHfp%;G1?X4~iq>2PTu;WQc@rrZO_4Nzmx@QFz?^LN8%@5OQat(Cn z)z?kJIj6vlHxV49MEPi#^Jk_)1|$L#Pz~nT_cbkdOejDDLWk-XlN+D{|0$)W! zwL>~+KqXZ=k8e0?;>tI$sjWufA4%qVq4Z2>{22yOX@Xc^0nB0=s+KiWu%S>}=3m-o zYFOSpRKozdYc3#pA6-{wEK7npO)Ulw&M+3Gt+GyBvnOgl>PQ+i=RfqZhhj533j^3Z zB2G!kN*7O&kR5Dfrp!rfkE?+Qo z1{iIHY^hVX&?GEeNxadA3fs(FHSHnE{?8ic$QxNI0kJ>>jEwp8m-XrRbWfc`5xUK^ zU@IS5$DJL$S%gWjlF=bZ;Kx`bnMcPw($D8BWj{&>-x`566OW4CA4N!r)%1h^mh0C!R3prp4E!S>$xsd zCK%>J#tJbK-PBr>eA$nNLJ|NI2;|TZyM}}l(TLMtx>%9ndMZR{So1t8On1caMQy=L zJ?@aT|K<9ab61EIY!BNYImPQg7PW}lKuZ6~ME@Uh9rGL0$5Qp}C$36Nl?SEHO-*c7 zO{3$goxeyBv&2NE!&u5xCmGPnHjq~$;hMvCO`ZsE({i%HIm>GN{OD=&qb#RNDc8G9 zaFpl``3tedz)k`M0=j*;XQL);y+_b?+$+_0Dh4fjNy(H# z-wD*iJ|xm9l#8s)%GWZX#=lF)wCbx&f>d8Fofc}pl~`{J=eKWw#kUScDA8PxsU>99 z@z}uLFS+*0x1V8k6^wgKa>3x$WW>rj7F zPwA&LEj!2HQI=oN$FxBIg`~{HjPGn~R|pg_-MxsihCrgW+Frdgjy9nE3F#Veq)H#{ zkQR+B-yJA33=#%UK=FW_e|~}774tOBi`1hb1|%_@u39BWMrlC9OColFt_%tfk!x!<*cDJF+&X8ML;&@7 z|EO>iKd%AkA_&-={)x{-m$52>HAL|%d~m(eDSq>CvQ!K;iIGnqWec@~WQFd;(0#aL zz6)K>$KEi={o*?mu`l0p;vK8ha_V9&k7?{>w3ySDkg{fiw$4v0V#>PXRp&3r1^2ea zx0Q|}YNvrYT$z~#FwRTo9&zTRRRJFz1|I;CAw(onj6k%ZTcWil*x0`ZR_=)sR87K) zO6tIjyV0U*^HwpwgD0Z)lHp(a2IZdc(H|IP(uYu}`lmRCYT)RJU<a+qAe zD^bJz5UC6sfT!B`c6i;fy#f1}XIhcFeZ=59l$sj9FQK>icOP_)XF9xm79Nx};=RAi zoCFNht?4RRgX@J$x2I3qN}&;*cpOC1)46vGU3>6MHl8+q-W^!G7sJ|2TXu|sgK3Uy z1AKkxCYy)dmjkkg@V(#Lf`!fc?v~THVmesib3(?N7N64Xa#zev?SPI>Oa2j+uU}d< zIA>bZtHHpd0^F9)_q9w4yBG1^as_M3Hkqx zh_{@wcrUy{s91Fx(JE-#yB(qUZ`kp^QGb47LmPS9{5Mf?{0~vFv;2QV#r@wz#q+<3 zYFc~SVUq`|_eBjQ1hkTYOq1e?-!pe5+JZ{vKdUMkfHv%A3F@q|B>M4jo;7NmM~(M5 z-(QhS@z)%PookXz3sOsOZ!?~~uH{N&0}#CTWnYAK)JUCqepx6_T1($it7oTgN5>iz zKP-j{Swj$z7?7w##-S&dkxzAfvsZ5)K=_YOJ1*hOAJEf~=WZou6u$c!Z?;IkDZTKM z7xc>z%m5zICVh?Q7Qc{oj4mSE834Ax>1vT5X}uy;ko3x5$0o9oaQkTu zD)qiQdbb_IQPJo?9g7T`!ynnPr4#?1 z;rV%Q(ktzXe0&}b1}-#-5)h~Y4fEer<9gbVzXe^U>;HX}{x(c{ZYbMb45T(u+a-vJ z=G{fZ1{&y1nmWsr+b2>(i@Odv!rFgy&oz?Q`Kwcu%~7cI|L22Gu>_9Al(Sn-6$g6i z`L+Q(Z?X2{<;J>xqW!8EXLpQ)I;mkqDC-Tl@tUGPu5|pJV`mgT=wpyfZNh(xy> zL+#T!EzC+s2pvp-W{&cn^BLNu&~#nlW>hTArMi0gSmM~BOIwB7t0e%#{b_N0^o`kH zxx$oW!aE!G^QBvBAG?P|V4Gpje<_usKNJElqjWlgw_W*V%n>ru1nW(fshRw70PPho z9%BIdi&VV|hlY?4RD7TY2<4-ZLSFOOaC%;Vt&>?!n2!RRb*jTH&?iJ1M|q_ihB!u^ zYz~L>TwV;Rcjfc6SSx-NMi`L=TL8{-w+N%2;jxeYxe0?AEN@vru}dZT zodWP0MTc=(YMER`ck1MQ-ao=X6BUk8H3k9L&ImEce3j~G3zvuhr+*FF)wp10-zynQ zNK@65Vbjzo>mB9Swf*@erQj%zSWgjaab6QBbo|u1&@_e5nHs(TWm2BCFt)V81&Cc$g{lEpcpm;OKP5xEuiif-P&eTN!`@kAQnrouB^;`AG zefK#Cq9*su+X$rvSk)Gp$nn00JowBw7C6BO9Vnyqt7LABQU_}~;T#gvXRT1w_I7p~ zeCCbqD`XTovmG1ouC}5Dusa++L@n%d=H#HD9>aN|Vp}C{&gkIu&RQ>xVRp~)H8!w^3-Gydc$~mx{ z_-*f|$G#cIJ|O3dEI?Z-s;j=X6|77NHd80pd(%9b5yJMaqf45kf?KH7ALSDjBgyGS0?;rv>r?mVnbKVMM_P1`jNn<^am~Wz{XW8INmgT1 zyoM(oQQ_Y6co~WgT&0z^Sc9~KmU8A?(K2t4vI%tna@%;I#T%^}-D0hPpP5k`t@O-2 z6w0Io>v_I}@Xr_RaruCe6+VR;t(>Tez3Tfx%&pk!rT;@L_jXsaYl1j739P2(=HYXr zF}{5k&@rF)93s;iLK)q3xy`$hGtqf*+w7qhXUn!if;V7i(>@w+kI+hki&Ebm`#Lvx zeo#;Wrk%5G7Jf7)0F%Gy@HGrgIw`Ay^sI+?15w5cO1P?(4cr<@I4d`P^L#Pj_7|qu z8jMctdWox99#6|qIC<*aD3fWs zkEa-_4k4$ItQ%Vhust%mk}9Ww5~R&eCM$)w5HT<^TmlNe~w2rH6gBoCK7W{GDSEIi#VXm zy@R7tT@-#%Y&ws{X*;~}YBhi%t{{?DBF5{2JzDB!+d;3tDy~Tnb)tz_(Gck+!b`>g zCDd6F)bqeGqf(7y_ZOUjj}=8@Q5uCYEi)Q1z(`pgW(a-N)N9`vNyzY7|mi$?$U` zRU7`EEB~ zqF+uIdm0vEQ;0{m7JK7?pjX>(`mQcSjrWIy{vT3HewK;CH=)A&o?)n&# zr$69K#05Db%|W0Q*#%zroYDMFpWH-rx*ur^W4R4z3kY4>?Ne(Kk9}We6Wl2W>RT8r-s!j9 z;Co|aQfs`ydcJ8x z!Yv9+RUc5@WI@R__`>YexG|DUGG9MXr=bl)%QAUdmqTdFMf$6tc7px&bsLkb%Kq%{Xu!cnX!`^{%BEpo5m=Tx|to%xYCZdV- z`NsQv29cP)_}5sPmMBa|v=l-;Vb_ZSAaxq!Jrms_S@(3e&jj%@C7L`NSkb6kLD; z5|d~GN1SIX3TkbF+O?ZPT8v{Usnp_zp(01?Pd#`~p$^f%GZ0hU)haalprbJVvlh<0 z;GWt1!3zv!#{y+cDHs1FcPw(@cyFziLUC56S8cftfz@tUFIy{5ahc@Xq7K&o;ZXk7p z)XyqyMTyqP9DZds*Zly9Ez46zFXv-R8o@;V1y4dWl93X;(zAn&i=?{9B>=O(%j8e` z<7LdkVzEaZOE7m{4@-cWyEzmF<8K{o17*6)hrV7yIja1F4L!k)>^b|~4?>IA^zU4u z#R67gICmYpMQ_DtDa$k9A^|=ErWnQ>Pb{dugvlr3VetFCIB8XvBFM-q;BYDzK9o0P z5wv+BPwK22&o6Lc0!cAb+XN8_Oi*?fwgi0%A;6T@l;egtO7{g-u{U(9SZ^xUr))i! zBtp|Od28%CWQ0Monj=S1$G@VK04I6r@rkY#N==T z>A0iS_Gdl(h0Xp0V>BlH%j+-R1<-+@2moaP6|_e&L=UHHhcxl9nBjB-CPSY^qB#=@ zk?HwcXa)VHoAx`u&Q{`66Wk8MZzY#!;%F4xXiSN9zx(7*AvISaHPJSl0`bx^DBRS_ ziSA1idGZCN8OQC$E^}8-iFC~djwl{Ngj@6qva|Q%q(AeEg*|a#k(G#7mqSYUMF2Fp zEV1D9o6i#rhMDP{EJV;ZMx@Cz?c;JS4qDoki`#mguB{vLYa>^Rz9Ggqk7Q9{le)F9 zl8HSBD?PUFxrcsXoU^R0syNeuUJi_9plxQ>XqaTChRHRNiA+8Zwl%N2-eHeH58RBB zhq0hFcYbWs+P=Avt3kVb%6pL_13<9H+cL`JSi%XOQ!GVZ??>9%ZtOARi&tF%@c{@%g0 zGV2hs%m2W2bAnYcz2&W2OEx61mAyxgdM<5Wzrzsju*=F*e=*r>wMCO(gaBxzh=#kt zRx#a6oeUrX-pA}d`|JsQ8G73 zYO=Z$N!(&faW-ubw`?I($A|XHRkmjOZ~T<^luY95*B#JM{wE%W4ZTI_l1*8$Lt-judMbP!>4JKK&c(!SupWgEbz(r~i^IzHlui130Fonq7~dxJE7xv) zW7r3^H+o1$s6Ls1QAfPgn{u-q8(a8y|9eDL0E>TzAF0;iFzZ+7)>1PL4rF{u%T&Fd zm%r_6NP&StNFAe{gn;ZmZnQj0Aa!JcLcdCAn!@P5&>9iiiqp|>)#Zc&NhI_vc$vRA zE_AV+Tb}iAmCV2a0JkKx3u36QjS2J`U3zetLF!Xr3ZtPHP(Zpdl+bBSFIiz5v8k-d z20J&DMab=2iK-C$W%%;93f>-`_dHq#iI)@DhZE6}(0sdn;T(y?&j zCxIh3w^TZ~%Bm&d+ivEBY}xlVutNyT8gN5+L3jej0ArAA?DbxJ5h{|jKaR+>d*13( zW-KzPFhJCkh$A~=%{3+xgzJm?%|jT z##vVfVAbFBf=Np2v%Pu5#B#l2q$}FcrH%_cA7onaT zs)Fr)UBXWY0NQ7KjsaF1z%%4MhWdhyLwcYsfU!mk@_{^dQV$i0RILLmiye0%rS=tiRiPz8&%W%lQ$Gga5TS3h4e!N74_=JoI4Og6@v z8Hfx7G&8}kT*M)iQhlMcDR^kpbOPXrQWOqZJXaJDsiHJp&8E~BJB0wq8zHu8YD!&U zfMofoWlbP;JhDe(=CMMaz`y$8<2{l9NM88fLYZiuy!CR^TG6PZ>2yr4f?4|HUdZWUp!RT@!yj%Nm9N;|+q>N7 zuu6sR(m3D#(nMQ$OAxWLmEF~|bC3rYz}~$J^CH3x;pU38*q-x=d<+$}Ln7r@BF3Km z;^F1)7_oPtk%N|V*6GE8SsHhFOL8G{Z$BqOs$9@!FPj8*sA%{$$ z0fzm^6V_vJ{adsXV0`mOB2bCnJJo8@sire-8I~dhFh`XdvKw1cc05iQOWqa)x>W+@@) zfB{<|O6PU%{nqBcOoV>kyYvfMVC1ihlfvo34q0?V3ilvX@QDy!Mnj^XZzamN4$5Sk|#wiM4wh#wWb8W$PpVRk5nW* z5X#ZvJ&<3uzD~IGa}9Hi8XmwhGTiOd=5R`mTK1R4x!{S)xtr3dma-$BMvW!ZndwVb zJI$kdDJYm)dQ^Nk6vTccfT!XJMwLu($nsJ0cpOmyvmWdUgrQ2L5&W%rC}s|o!`8fpqY)UuJP9anO8(pz>?e*U*&zkj$;MS|Ei=g zt?}D2FYqjs;DRx=**uqb4rPKGD!JMT9fSTk#O*+|w?{%A1>hGUrd@EY`9E;~TeGgZ zCR-l2ApAr&lojklx@L26uLLGdvGUgCh(l~!Q4|&-xNm8UUh~K_7pVm+NFP?8AaOQe zmt9|DG2e)aV3?(!I=b8#l7B3;@Lb1oNh2rVOiw7P0dtu$3@gzwZ%Z8^iy#n+b)m50 zLl_=G$sio{0=Cc*NHJ_ZlWet|4$u+DXpNui>(g+lAms{(yMA=w@arM3tB&;&prkdt z@Xnv3s%!%Atd}MgQO#KQi3@BC5pY$^{6L`Kp@|ytu~((JJkvRG(&c|w?l3f|4kr;l zi|Fd?Ebu~3nXQe>tY=ip6|?*|(`isay;AiU6xf605nmx;tva~iiUj{QYu`?9OMBtHEvHH#H15H=~; zL^w-;(ayZ!Z^*KMd)r9r`Cw(Z)J{!2Y34?N1UUMmdSc)x##=7#sPmS@UR7z#u;Abq zuyZZGnuVpo-bls16UvNFL|F|Rmshxe*Vw^hZCAEoto7OxuI85RT(=Z%+c6YbLHHB# zY+bCBF+j3Y53dtMM!kR$B2la%#@DRu8jpcZRDXPN&%z4J=*yfS#dYySkDwN!HZF{v z03zklBct>d$oeu?8p1NE1EFr>Iq|h>O*VFI%B?nydaM`DJWaH_C2+Q+o@htvS0XNk zA_#IU(dH#Jig5xElilC;-}Z;%KT8iO&;*);V59Z600xe=5sZnqZ?qI^#03x`Dx5Dpgnt_fcpo&!1Dt`mUPS+zv?;5Z3i9FUGyQ z3Tw31jDvSoz3Mc**Z=7k%xMv~0X2tmJIRTKc6ph?*_A~dov?eTOI5*avNe1QpI9Qf zOeBAux7(w_R(c-n2#gjwNLIT;DFPaHJ$qEY->H8Q)2uWg)e~*!gO%LZZ>3z(84hJK)-KT&f(P&;mZrPc@xDWTLVQ9l)4EC~ z%qU@lvT(5`Tq+3zvNU#_HrP?Jy_WR-$F^ijqoI&Lr#2_Z_{n5(TC55uAFXyQ2vOoO zl}Ug5C2y^GO%eFO`VmsCbro|wN7^8-e!0GE*rj~`;z}iy@O2SbI2aWA7^^|e=NH?G zc?{dGq7n5!=ehA{98SH*c-5CuI zmfUewDVzuataX%gDG_OejF;0X`dCn!pC(3t=8O3c`sZ~nhTfNpYOATt7hdfuh~2c~ zKet~ZRkFCJ=WWG;6HpkJs0M1?3UcL_+LjyB(FfXtN@j*y@1J9Co*37n1I4q!7>R@T zqL&s*giwEB(X7TLfvEC4Q52%%IWEtV^F@}Qcp@hPS{hzk@eC$T-j$P6J`ku2p&jqQ z>@oLe@qoN$K)dVo60Of6Rvn0ExVr?~M3bGsb_{;q1IPSyeNPMi*0~&%+RWozI!F`; zJ)k^kw_;Hl3(9nqylKuo+9H$7Wr`m2TlmqAguF}C*&*h0P#LqupN zlR-%UC`$60TdJDrf~e;13xb#baM3Jm%_TGL2_#&F(mouCF1rw!25)aFq(W$hDMSbX19|A6Pv9pxdLY8kX%b6OnJ0rk zMSZLe!_h5Vd~MH~&h6Hedodjn%O+NJ-3G}6P?Aa*QJN zZ@Sb(RU0aj-yunC$NxR*K0k(XOZ68}gJNpx?9D?lwT+k+12CMP{qQ-?Z>lFgphk;? z1)IEJds022u!QWB<@c1Mjf*AmsELO}@$cSAn7j0%w`=5o;v{2mGHv~;SebNO09tq= z`yJHtK;7i4?+7&)n+h#|NScX}Wx4B6`jUrDCy+^v{K1MUcY$9Sm|~n$vj;B+CTd#G zpo(2~9n~56$d}HdM9Ia%AmTL5wLc@GvN1c9Q=~4(sc9Rp8|2mLkpD)Ppx=#W9Tzli~#qG!Va)`zm%4S`f;}=?`WUrRiyg7J2j+D^(tzLv0ZQL0-ZIr~ z5}4cO1%={QAFB8U$WR}yL2_Uj`!omGWZ*9bM321}NeO!x+2)X4!M7asmAdGU$yACEmW=`!i51qGaYxVqj2h|!d`~E7|_B(*J4H*XATxj#J zV~m`H%5a@cz~yx0_7iP#foDOvS{IL+k90Y98Ae$x2|;!g*fuqxc>Q86Eee_@JWx1< zV2^ChovN5P4MXjPJ7c-anRtOEsex?f{d^cRy${8}7@@Pdo|SIY1nAuf*zFF#M?1DH zb{V?4)n;k*c2a!Zv2kA4RL~kvkp(bfm;dq6p#^+W$_usx9m5yvi){bgB6KOri(HcD z)qS3Aoo|-Fw-~>54mca99iynK8E(t$xeOBt8SMq8{uC8%e6q*_0-;aF$>F^(2E)C# z=?J*h3gR#9Y%A~J0R^lDI6ssI5l8dzM567OH+BV+f@ojN+yx})Z`-}Z?rh^TtB?p? zEaz$J2~2Ocm67F3Ao;u(#w&PTB#&8}pa_KDgHhe&3^QScIK}{#$t5FyJ%GlSdtG-h z#(it&JLS$Fnys%-)taD^Px_Jjt=iFvXCYWvi||pgzGE!~0GV2qa0c0En>W=q(A0Xs z*OLpi8+&XKJm)Iw0PBWGZO8!1D5R=#+daXz!fGV(jC>P(MX}#^c8iPRT;xoOy4Gf4 z6Ak9?A`MGboLst$^WS~!w;h`a?6z0dj{)uGiHn2tzo;AAe;YLaWBd9K z(3~KsPXVaX(6-xTM;F&WQNOK9@81tgERDbbUzXZjwz+iYQ_ihw(3nLr7q1gnqKv{T zIbGK}uC@1lx4N>eW&n&KUQeu?m~&jaoe0o#-0W(Z)OZjf zkhHdqp-1lfy;(f8+HZ5;ZIEdRuvKxE!b(MIN}@VVw;hu0K)3=&tR5{8y zBNGRF0nuAE;IkK@$)5^Ht`k0SVG9}f)D0dWVe|o?!Jl5luRw(dFmK z1TD{x8uJH0#G8I$l~h97o%imZFYn1N@B-+G+JZvrl*i!im_@kF7kw*RLLsQEZxK%k zwW^8d-(n)=|w|%J0r=MYdi7t5=Y3G@u zJ#9o>I)jkeUK*M|Uaq0H;aB}Esb9Z7BbG!Av$h6TWnj45`lo<8?NKE0$hy%Fb zDUFT@GrLwZGA1@82j(K)$Hf2>0twpXBZC6rM}Kv5jH~c3RgKOXZ(o}q86hjwkIWh{ z{ibQ2w!>2$z!z6Eb4v6MDewnC%zMPyGqaACO{WYqA$V)^7MF=LmIrUD%?Ayj$bhb! zj@x7YivzY`Nw*0eq)=axpMA6wApzSMWPPL|*XR6b`PPa}Sq%~{t_HA>VCUU0c$t(t zSq`@cVj;U{*(p4G+ajT#En4kCL4^DWpADr-+sCSJrgRk|Tje$F4N|9jLePs+Ni=pn zm3ivtU55};(5eGF#8xxN8Fzo_A^w_!7hy^{l#^U6y=$&5##Z< z0&RmuX`>akEL}-fmcJPSy@gPO09#KLZ~wP+pOjmr>hV9cZ`h2Sd?L$PNtM>QPC?kfzTFR-!~o zUKYG8AMv)H?QeXZtHuCwJw1UT-WkF*+y}MNUg_J_+~$Bv)q-hsD8Q<0XE*qIV_F=d z62*YbPCamZuL*mO1-5`f#E(dw=A6! zX1-s1JfolOgJYD+oU|`eaZ(r}jvVJLvKA*4Tnk}JlpMG#%dvLz=y@x;Bi|4N7;<8U zH})akJXUC`bZV8Dzt$To8)iimLq2+!DtWG3-elYjZ)I)q#1&vzot#E)~t+TQKc1W;@AN${!ZCS|?(W$S8e*D}51w*XCet$0$FZqJSDn!w7o zf%E9Sc=H8gMnYsYB&j@g^YI&2`&c96L8zl^4i>7uJDE#;+n~X7v_XsBZdbV1}YjLeUt;QOjQVCm!Y zeZPOnw(jlZ`n1)q9b#t0Q;NOG(&P`!q~~|~>T&=if&W6NG}2ye645LHO`E{TN712{ zzdYkh1^{5XKAjb-sx+a@p_X#`!Ci=Z(zf#Yu>10@Hikak?XaZP+X5|Kd{vmIjOFO@ z3T!%f#4KMiO;jA$;Iz7Q9|6UPG7Nro=_#8$R0{BuMTbsMPXuL3Fs^0VPS@;gmZHwm zZBgP>kzlCn7ht^q3A04en%Dt!WxqS`xn>5L0Ne-Hj;$&x`=fN2XCeDhAa6F7%m?&3 z3d^N5cT2(DmTZW~)hiM*7;Lld;4A)puK*bCi)|8dKnn15oY%ROq(&Qxa3Bo>d`^-ihxQP{eq|D#E4HgJWMK~f6=^(s znA#_}Jpoir^wcJ#TVWG1ak2m3A^+bF$p0Dgglt^@(}=D5_qxKrIX~PzT|*cEGDk}r zEg9Zk$Z)~BuxzvM&bN?XrHj`1&)U8$sVsFc_OH!{{zdZ@*xL$grnGYP-EfWMM0yRDUpu%2$681>_SQpO2B9~4f%Ohz{7osgr zjoeF7n^P-2{p=wgy_5VWS(Jlam3rmB!nw34SkMi{_gl9VdX)boGQnLKCAkWqL?BlG z(*9kOotkF3Lh>36G$^FpjodSO@hC1`f~g z?2(iZ4hVEKNtY~lM$v@O6sWQPVSiC}M43irS4kz;hj~4$_YRo;OTf{O-AgekH-H*7 z44MNx!z*#9k=X{>9w%J)PM%q| z>FsfuW*Vj&zni_d%_T({3;KF9I3|`bRxs2rB3@DsB0K?vT6NLaZ^d!HJQpRS>}N}~ z)Ygs@f4!h4q{d(YtYTq${yLu2#{dFLd9EmB=)mfxk^PPCDp#5==frDQ)TL6cjF+t` z%J$;MTh>;*H|<=X2A3@CzoH6I*kg!bS;KHO3vJ4r6-{tQ3L8dyZ5#;`M}fLX$+>+; zXlLf~N{dDn8b5}l?tsS2}X#cHFw>{763T)5T;_v za`z&j1`+fDB%{u0b+$%6?nr42+@C-~l=%PX@a5gPJP1D%w)d`boW`2*EV;4b%Eq3G z3%fbJ#V23wK3Q|gUxyAfu!~`kf{4^7Xq+%s16=6!x)|F12h!8UysDott3{aAj=uL*nvFG zk|IjcZ3JpY%LT0^D<*QS4Zjq!2c1Zfs`wQWte9a%a9@tt_5~ySp#Tr1=I9GkDyLx5 zrX=;a%$eidW%XS!#J>Gp3h>{tf;)ejHDxVgf;pi)5wh;_oe_uEEtqBcaFb>^$TSoa zZQJwLa2sp3)F5gni|&2c>zBXC2{D^1Wv{@@)}j2`no+KYxYSiXA$ z3#N_OjPV8shVlv2s{!tpr78EUoiTuU`bVGdJQa5MpEWS$wp!nz*IcLQ$~|3uFJ~Yn#*UU@FaRP#~8%{pLs&>0$F`E|M*jOxIid5mI~K zf;Ox07%mJ0uaY2H>A$Tz9y<6n`5_rj_pDdvlT&u|bt-HkfdHTyz9iUs)af@2J9G>y zr(Rhogqh#Z4;K*+D|RW$7VVn@OeYQ}ckd+?3_Df6ZQS}*)!qLD_H=+Z&$nkQ4?cg| z8=lgWj1K*rTs8J|^4`tS?Mik`6x7g8E}U6~C{eNz6>7ihUxa@1ikcQm0fzs+V#R;H2_(6Zoqkt`lwT3h zwRzMU`oErB_xTs;5i4C?za`1_98EdTy5O2pWXl{6(gD$^3YQHQn~wMmD#TRrSEWrR z;BcV*iS>O~+MKMnP1CwR3#<#4O0v|7ZF5vRv7t&PUQZ#!Gt(;5UsR@PUe3QV{pshMg zT`kdNwWK)Jt{!a`DDgbzz=i!Xyn4wS7(j+3w5~ePpG>Mrx zg<2e)lu&Mt{Xgjam0*T~Me`P+L;JA{0})z z0Oie@sI*07%{;oP^c0Z;!QQz(gKfAEYMFfY{Bl=QCE>X=pk`rZ)`If)psnip>+ui& zZt^_C^a#bZl3e46=P5!39>Fo-F0rl6)lq+kJOa_I90KOqltLCg0-)dFk&8#c9Zb+x~L(bY|Vxy?db%27N4y41!lSMlm;Ryg1U6y;f4WR z{_SBlRaxWmsv*?^2K((`b!BBrUb*Ms*1z0Lml}y}9wUKBhastpQb^4FM8~}`0L8Lk zy>DON3YO<{UxtJvAmdjYKy^Cgt_up3FJE3XInBL#UHmLCPBj>0*;teke7lDY8l>sEMTx4J7WDP5aAmXh?&i%T3t3=~Bj!pYzvA;`$xnGF?X5 zCw0k-k(JjqFs))ASDy&0BT#S30B$7o-d+A1a*il$Hh*VT8J@RlQY`VEv=T`DvLJ)= zz+$~DC{7MI?xQSK)4A|Kjk8UIpeq~+rzaB3(=cjOx3}* zn?$N>ycpAO$3Gpjfpg4ttOsXsH)n6#-k=hJ9;KhUFyJCTxpe9g(~} zONANSp)5`6$xny%SeqvmXIlx4%aXaexEdiQ`9cjPNLepsW-fC@K%nXbi89shuUJKX zlKvjMMdypXbYQb=LybNix{F6CN|{L%N(%Brme*g{HQIH=b1_f}z+!!QRGM1h$0|i9 z18S~e0M)v`9;4Wcml3J4nxK{b^rDOrx#Lsvu1n>k&}1Mc3}dm}hP4Yw9{C4fRgtWV zpC*xP?g*|*LK|eqvj!G^*{Q_zSAP63UNE8h+J3X0_^dq1cF`i1)@z|qojiNV($alI z#6ye4*VEfkONAO3Kz_8@ob7dbuo$;nGh`J#=}E4H$kX{k+(|0BU;uil9>ZeV5@Qhak0o@-~Y~2gNH6%^j>tGA%!PaTXt<{fqnNTr!oi^w{l!Lm@ z6_WhIF$Lw4Z8x~4*>qaJjJ%t8%Zg|BFp@1H^gn4J@w6-cKsCCy8kHVE!~rw3kNh<3 z{Z8ExnBfL6;+v8@mN@{x_;|7-^`VvXhQQsq%8jKVorKlLvidr+ihqQ4E-x6OYCY%8 z87E42em{R!x)C9=Ty_k)-Ei6^ z#!IQu6p*R{X_fV^wb0ZvBlt`>8MjWc!nOoq1sj$eUk@`x7-~Ndyho-g^>f=paYKFT z`ujkQv4bnedl-5q``r|!EfV(y9)7IclEmHAcXSn>{+N7gU*+%U=zpDOpa5F8b5!^krOlpRUgyMQ!6wIV2Z$9hVTcKdjGJfbI|^26WLOLUDLJvkTOB&zyEXv@i1I|a zBy*>?$arFT%|wOb?4Me!c!wV2vGZ=LoAbk}wK(c3SRrQHq~Cv=b$!CW(W^FnW#aq) zx&ISOp`4?Zmo(s?FsFv3x$D+MFFBbwONkuKZ>t~P_X5VuZ1CWXS5_`c{}kMHNB4GX zncLAPOA%87D6>$@4!hn5B5L%zJ-^3k56y@)oUBr18?H5!s#eBqnmoN$A*+q9N$;YN zO>#^NX&)A|zrU(HXfG?4`LyV*8>=YVKltu9X}z5e;276Jibd-;Ayz(85N(ugZrZ!C zZru8q#LUpWu{$kWeBOpQ{O9k1qqz2XWv>>FLXQ*y@quP6vRS(vK}aQk`YFNMZ|~ms zYyfY)%|GGqptX|Zvhk#p*=6n{Cv!s<2DM=hG$&sthOO)H+hC!f8k5RaF&0YfGDOo( zO6b<{B0WCO=Mi?NpuT8Ma5$TID?H*QPKSm(RWVb1xT z&YUR#Yueg&*^>aY#=_;1m@x|=C#z?p!dVCb_6?iGs|$9kVWRR4Rls@-yr1lji}B)V zPF}3aAC$`+M*7^tPoLa=;4<3E-Q@=>kh56y<2!hR9gu#~B2E0BijSd;i=TAiF2a8L zqFPBx8#N!@D3`^jxpw?vy*+B%v^)_`Ddap;A0; z!Sv~Y58HX9Qrw4^GDo-dyP=M_YUBBOvmO;)I?=l71vfU2wp8-mUAN{I1Ap4PAUY|a zL3|xAgb+7x(D4lBwhASIF`m4_wxwqH*j2mYfRr{#bX-cDZzt2#OsL^e*vyD3OPe&1 z(;h!OCh7SPb)r5Mcn^03g4d0@v~**V?<~#9FC=)=F>4oe;g5IS1-y`}F>;{A4H7~t zq&u#eis#h+7&h(z8^v;?&DrqClwOJF`0vV0a`jX%U&<_gG%eDhc*rkbtOb9Sc?`b7aoJM;4GCylC4n? z{OxyfO`lpu_r_W(afE0X?>F}MWekw}?@96AxL@uZ=j@70;x0RG+&OchMIgTcx3v-F zN9#AyYP4NKY}3M}qCQ_+c|t~DX}}Iqi)hVQ7vEXq5Mc|IjdiLmf0@OSK_KtQXUp;( z4=f(Jgo*Hg;bf!XNM5VYSKdc&DRw91hTJ~$LmK;L3)mn1yw45Z^-T3DE@8b@!KvK6 z;yFhC`jCzB4P94!bz9zmNdHv@^moCHC2Pv9$+Y;%94wynW$gr@o=aBpm~JimuuZ3u zy-EY?H3h5mhAk9fyE1%DsPuG2BYd2?@GiPM_UKn|zn%Z+F$mtdRz389A#(l()u`z8 ze_BG{2LDi->%Ip-zID~&r<7128tSV1a?TLE50_}r1{)-N%E%i4K$-IaO@H(= zCg$ghN{8=WS_yNjm0*MW_`nZDENkEH1z|=F387kJXKFuy6Viz;CQS%Qlz(3I9Zw=9 z+}GrXhV1%mT-@AQPT%AjlLDh7%JJg8$9I$hMjCcu;a4TEMRfTvRmKj3M|M(>nE^t6 znWg6e?L@Y8=D898j7l27HmLZoNH`}*!(T}raEks;!dU5P{adqlSG-}{0Y30f zCr$Z;v~bJr?rm)~ThMaNXu8$#KKX)2a4eDo;SQ4o(N29b)B}N*ypHzq{RnDVv2na% z^)%4Tzr1m*9CZXn(!IRLvqwvBDFDlkMtXwJOy?)UYDzlu9p}^uSgJH|3?YV{CZx~q zqfp8Jis${g(oqtQaP(|PMExoe$cr98XW4Q6eB7wQsp6Y*GDr;m27QoS3mAwXZgD=A zwGRp^0go$J(*k+PqXnMVI838qqFrGt*8B%U3kVO#ya4ID8U&mc2qr68i#q8D^ZFFAke*&)hYq!w~+`juY5jyQNOR{ z_;h}Lo)ix|q{ywdw2vJ!2*+~t{FqkzNWGFmGPFhln27Tz>iA(#h!^N`z-olyIskwa(oDIdgSO>dTsdGNa;7s2C>v9D2MRn9aq9; zWuH|Ad3S;1ZcBPX5?JmFdfP`@M<YQL6~W}G`hVqErsx?`ER(snc1p|%dpeO%xq^CzKX1(-Df z)Asm>#6j2}28dcOl&dNPNk&y|{bN(DrG#WHu3Xavs2cKn7s1tI!V&tqW10iP*)xS8 z--*$?TZ0)^eYHbLxaNJ)tsu!}lhb>*o5Ad**mKSmOL;eSlbg#5QWsMJY5ueptm{~% z%@hehnZYwgnaea%3gB^Ljhy=msLc%kA#m|`)@nm@_cE*yP;wVooBQCl#QZ?wh&XxY zaKBe7<$MYE$ryWv$t->$#s59D){G@gsG2X2|T?y`yIUI zKe%3HZH%``-?PnvF4oGnBDnAJlnO;LcT_`-g?}9FATQgTo2uc7QOlu#COixPFi#KO zmlOS*Oub+Z`^S}c!zH}i%P{F)s8CL(u!#j5XGDa4#0K(QSh8n8;chV92!4@I*g7zR zfqNiPZ|DJ1ZZuqDgnwF`1b@*Bs5v(yJhNI+tj{=~!#LHkA!2EONxhMSqI zU(+=Wac1(gH!{D0k2mqwh6*78vHqBK#a?(9f586=q|YHci5`>dvBRc066bk<(R{#x zeP?CZfc5ot!mzSFnE4mQ9Whs9Tcit46?ihF1i?;d=JmkZHRQev1@XZZz_B&V0Iw=L z?XiF=9_eKhbMcQz+Fj0CUG85QUa(Rw~~_#YD>c9W_fGLJD$YzFK=LbfNlnEj`)Hjbh)H zadjAH`fW>SW!78z%*^5dd4cKkU?yQ<6vO?z#^K=CYy zNgib<+$)?@Or#$C=tx|NDjbIYY-doNQ%OJCFD?@bB5UjezvL_cWmY=CKJ^8)cl8+w z$}ZUIpzPCVerb!kuQ;0ahb9)o>7p~LT>Tf{&|K5MZIuQ#6@i^agrgL8`vTT&`9r`2 z3;!H#zx_Exfeu=L*Mg3cpaL;M-{i^?L-vIh{*n#+uo?w~gZ&){kdJdFH^y2%fY9y^ zLS~b_4?|uIvtg;`Dqy^Dx-LI)RZ$jU&k7^Z1k(n!7O=h z`*oAxp1RNP*dHq=L29M>SMWG~A#(brZe^BeAZ$*j*ZZLYa9m*5c8_N(;6AE#Ga6+v zXN}|DVADUWT3@KH_;L1U#Z6O$LC=HPM}zMD2|iPl0e>!;Z4t(F7Z^+Cxn6|4^k=ry zMYb$Kl-v!+$uk2#?8u*1U`8g?HpGeRkqXi z;Kd}P@!etqF0lRrMVg(Ove;l2gP)JU;o|dtQ`(e(zA4_eC%>U(E3;+@x#vL-pL1|H z6bY!1k8p@)ATiO>kp$C6(nm9ds=NrB*a1=e*~GTO`+<0JihX7;1r(^+L_cAm#BS11 z;lRH)K4cc|3rE35+A{>a_>b#pVl{>%KhDLJIa_Ib!lI7!AXyuhaEcS75{cggk7y$|Dr=8^=6Z;eU_&&CAX~rB%=6B9Pn3j} z4I@fC!3qyT`CO~g<=PqA(UQkOdRU}y*(E^~DjruJzMyW?O`xaZJEABjI<**3pxuGH zL_SS@HVDeU(U{sIHDE@eYX`|F#AJTy@pg2Jz7xE@{QT3I3;(Ymf&IS#C)7QQV$AGsX-pAcG^ShDZapOKHa;O2rIanbMa z$De&Z&jxJS8j-sJD;A{)=zFSr5gbS&tt*LPhMVMLt2;nkx;cSa%FW5~%R|mcg}!0N zj&;JZ+Sn*GQy#k(p2Tn!@@DkhecXyQgIXwkF+2Ps_knSugtnRwNw>mfzAA4$sC5G4 zBJ8Wg-53f1)Fm8kzJTZ((fHzB)Jk{om*4q~{!OK$q7Uhm`a&HPLKae5GX=&M6Do}i zEKh&RG#sFCq#4iVtfcWFc{dlfU>p7tHQc6Vte*h(7eMl?%wb-X<*(KN5dyEYGj=at z-3ezq6SH1!J@vC`6uVe3v5I(RN(c2mT#W2WUMg61-FgvjAK;Up?ssx-heTrS)T@5Q zjrbx=-5>BQLl^%!qKY}Zhyqaa(ruzE?0Dk2pvSIVALC(!7h@E_@71| z>wtV-{~Z&{QQSB|Ok3mH!)Z{+QPUVo1}jU#sXxgp8tUwp`xNZ{KKKZQ$`2C+Ge@c$ zekJHgU|!i2QF^+*nfleUF-Fj6Nv0j}W@dnulLiiqha;pk`pqQRiuBKFU(L>sRviYj ziKG32Cu=T!K&n3Nao~HtF5{}>;+mbx9qgrlhmcdf#%^LB25 zFTaaCmQW=QW{~AbO79SE6QE*&@+WT^G{9$N#iE^w{0uWUe5;rJynqxkm^Pe_z(S}k z(=1I;$Ypd+1e>qVQ!*1GaG`@W=lu0@crJGa!h1Akv7dfcMY4btR6UVaS!h9 z?(R--cXxMpHtxQ$;O;IVXmAMb5&{JG;4b-)bI-l!-S_@tHNB_1Y^r)@%}jMw`E5Iz zIRU!6mn8<}V2p?sz!befTZ%g(ifQukCfIG1bzrt8;3l?tF==%q$6TU!D6QrO!5)qv z!T4z|kq$BCRZP4i1!mUsCw1=*;eSn0w8&xsfaUQJ1D94)N(BMnm{>eE(GWW@-%F~a zE4`M`_~&n(R}YBJcv}ZO*ANFMZmsvD`g5s%HMuVbtZ(9Nr`95kwZ?7JDdT3|x)bzT zRzRlMl7MvEHV!xDseD!C>N=tq7mcSWzGIBJd@9JxhZDhc58!2b#IYY9mA4VMW)zSI z96LTvikuY*6fDDnAmjhnNfJ7&>xQy(Cf2>^PM#y^G4#!0_e-*<+Dp7%#)diS1;f8^X1wC zn*4oO;QHi7tU3Q@+voFFYvDDJi^jNx8@m%;S{h4N>wW=(D?4buIJ*1OD{@~`W=L#0 zgknZ@`MXaDeRe3XzqS2>aiF__gccBLiP&mePy}5A$qIH6nW3SPqqBSmfPe&W8fpW0 z{xTXyEmc>A3EY!R;wg#h3@ouvvh~|fYbSejI#CN|Q0@B$6!0mUMZ;#@c5U*=?D)8! zgRzWELR@YcmX_xQdTqhevK>I%FO^@>8>7g+8Dj6gv{R zr1v4H(7l*GIo%ORgJ@S)0CtCzS_{phs&NHIn&lO+T<~BbFEs2nu;+?xMUm#(e`xy3 zQcbyb&ds_HhD1UMF9m@g;2TsWd(ab+GlFPuhBM{fZCML{X_gfGy&CjUV?g4en@gOo@4bW+#`9sYqe!Gj@HEA#wEf5cz|zTp1s=yJKFUo zez)-oe8(bFgrC;!?w;rI}}`vg%XAz3&U-M(OGFo5>%$^`t1g#H}t#N!7dS#NX826b$4 z0!Stx4Yasu)Kj%66zg9Xv%%%yvb0{Ta(A8rS1 z^8(lo_?UD29<*4($KEOn3fyUB=JOA1k6tTTy!j4jLdz5vZJz**CqrML)R}Z*!A%B2 z*)w7=m6g@A2C{p{lNNj6pfkSEUu=brnX%1GVQG`^MYDcqjgPQV>0B?0JXy zJe|H6jGv9UTS5)sf?Y&SP8^D$uMF=SCdZst=Hhwry_c%45s6~(aLfz7h{4-`>L_oQ z9D7VGhWvd6*AkEFf-cgH6Am z7#L44TXu7{YcT~~Bhwjq?a8jbzIt(oU_r|m52_VS_Q)pjyLY9Zp(LlXj?Y6=0*sSt zfhspwL8cBT^=Z)4lpG~?#iY~ugFuh=BV^nyd5(hYaebAcM>i>xqO*)hF<;l1-sHZO zM?)vCy#xV(@`FgD?MP#g*@pANo@ymJjwL+(dhw?kr#F9S!Cb z0r3c89>i)A$bF5%ajd*1ahuwgXxt_Ee3FaFrf?Ynvy-|eZi{Si&DzaC_Yx+&oiohK zg&yIqw5Ud8wOfhL7I>e(HAEh(FGX*7@s_A87jA2hZfK8IFv3k(-w7J zRxu5Qgnh`%7*ol^Js@n*x=>dhg1}q5GxHa?tt<>Oo_36(dZ&HR$NGxp28AF;z9%ll z(i=l`XROBIg&U;APV`(1zz1H$uc<>@Nk>AViHjV?%cDkGnr`IJUi)#pMfyE3#q5jQ zy*;~g|5pj{zq4hs^05Bf3CQ(#rt<$hymPVq>)~DhEh#zXVE3LTvP95mm_*FHXCPSC zC+F4XPvo{8Yxcmwzy>SbIQq6^{DiXQGJoB1!$ZIiS(OxOp1H&P5s+_M#a=>_0(W|k znmb0p_!o1}1`bpB&4N!iu_KDgSGH{uOqiBHZF)hi>dASNVA1Hlf{$9fb|Rq%hS^=Dt^#*`(`ewE*OEeLD17$I zmaD4Kr|i8Vxb0ZUinXnL9b&<^$W}k>0Je@}CMl6rx#F9-=3Y@!elj~zH^O2}omG2Q zjn;bV+Ay(Aj-o_4<9iP@5=s6x@S~cfWQ7n3)JMAg*2=2|nM^eETdBf6<=6_wqorUg zVv;^sV76P>foTO%L`td8M&klkfYVWhD*RkBf5R+012+oP@Wmr8^{jnvAoy1~A0S3u z-5vX_2F?f4Dr&TWO9<&aEe7>&qSZMkTwyj-`x&as=jp}vbHT>2rbZ_A(Vq~iE}lS-)FK+Z;ctt zIu5Yu0G?IHs87gVvy*lYj=8zZT>)BdrHBZW&Lyb^`1Q<$H|4*sT+1=nPpHc4I4)YCQXAr ziph2C@6YPueyo>{m`rCT!#?$Dqm?m_B{DtYSik2E6dEk_=|}nPo_BkG77kc;C-Cn> zvlT-%MHMmUKw`~ZD%bkZKo*^OGy#&g=WQ#`zXbWOVrEfBrrc0>KnYDZ|@QJPe@+E7&gqGdz!BGFi;4a)82w(pEvT^lCHx2mGDSb<60S$Z4jQIef287E ztmrmjjvU+wxTbolRRDVwfQn1s@`ae{=8g z=GrGHAf*}7mycL~oRP^uPkujy{d;$a>4sy09Ya9(%j3=S#Oa`4z|-l8iJ<@0>GhEZ zFCKG69Ty1DtDCk1OVY`LLj|?3Wm&LlxZE@at|6IBLgHsD0ysNhGr0+(gooCJ+&VuT z35Wf_#PIC4MK5`8tFAJ<1Z;&A#bF0b+vZ-sHr(NGKW`5cwA*=GX-*!!s=O2f6-*){ z8H)${$-GZr3oo)*GQaYvw4>8;frdf zaGB{?T+$fJ4#YK^EV&s5|9ep#DjJ`Q-JBLL%1^Xm(+_5qT>K$ElF0hy-rpwaBLEVJ z?U2h^K8w!qCvoeRdP4>-+{6?$bU!b68NB_)tCLYMp$q{uA%mM+H>E9l8g6o8$EV3+ zRB9Yr=}N)*aZ0tgP#0jwM*UQMUoo;PYz39J7K21>?*|7PA9N&RF)3Y#MHF||L4(K& zsy3xhRBXF8f_EEHC*6^3SY!!6GcgZo$?)APWEimgrhJ%V198Ic$3XOx!! zCO_k29I@qI)Few@e$C&Srrf2VOUD!QRZ-FrcYV3o#MyOpPSOTCC?JGaQ0C|K{;W?%vW{3CN^|AT#y6d zg5j=q+jb|yx8hSgUW_U0YHh9aRxV|KuoQw*O_F|?fk3%pI1LhApNv40m9P4j`U0EB zDoSF^dH1PyzNV-;U3yoeBAmhQLp15&dF;h8_wkfkJ4}<#1j~>!;Jsv8PV%$uu&GM`ujJ)DRcqQ`a>cDPX zgguL7f3TK<)eLv~+$u!vke(s+BtSw5(I}`gn-QHawM=;?nuuu7NHK(M@+u7yk0AWE zJtO5YDd6jRda|Ec#CgZ2TV{eD&j5-QLrLQ*2SHe&+6A@CHwZ;mOlA{r16_XeQ9@S1 z>_oe%Fz?=DZa0>^IWA4EjqADNV@kiItZn*vd#)HkqLzgRV$v;*9ugfrL%@a}5|bWr z7y(W!bjRv958kY}a%6>W%eC>$$?5nW!IZCT8TAT`Va-v$*?$Ft1xg>!oIGCoAj4>~ z2YD#{4s>7Ky;=EA`t0m!M^>&H>;km01suOV$u^ zz5(&N!m)?c*jF2w%U*I&K`ymrR@eci?Mw=6WELL1t+JZhx=?w0aDsf!qXTN9MwfU9 z{OE964z>2W>WhCy55KlU4rNLZ*7XH^fBG+x?OF^;?otuDbWVPvP!=%%&0!+`vyig3 zqtVSe0;?$559Uv<`C%a@<$fat z%Bn9gY6}*~q$4K8_)uFu+fHqaTQO5w>$&h?2BygAOCu*uZV>~({5)pDm-JL+qCSRq zN!%A8dCrU{_x;W`H3?mohnJdX3b$Z0#y0YEi_W7}7hcQ?u1EhKT$zNU#+5U+PmNG; za{fz!&2ajmue+^Q+zh6g+2U0t;~n!I#ZT~YS7OXX^M(!M=|#hAP+X(u87~7x83T+b z7n+;~JTTj#af=cFqp+ycyzn5q5$o%Hg9!qbOO-wN@i$}3kmqs|E#M0yotBDxPuJd# zMNP%TuWFo;r@g-YZ{f_#t@aWPji00ZLHi|jz&TEguY)zepsZ6=IlBUqSXhismNU81 z(I~fmST4*ydpurVZox5hcYS#cSeLVy$=3^sFTjn1Y_>xLWX(S(_Xp$h*}_{fA{WekD;BcVLl2=;K*n;tdN( z!|FuUoXPXS(BW-RYJ!!)8L+ur@CDLy(X$$LZV3MMo|@@$^oU#nFce?5Br&U$*4Ez#B@mh`Mfmu zxu)Yq9UH2Kyf%nx!jtAjgQE81I05eNQ2bX*W&`ytY-(BOP#!Jpw=Ib}GI&`Vu3ioi zq{^HE*HKkvgxA;OcEM+pGT7s*CPNp-3Wsa?%3@0#0AuS9w^?+#LMT}3Wt@=Sj8>5Y zTY}$>LihMYphI38qAcq)1Ms2gaaNMB29{e4E+{qxLFzkM3K2`lE^;KvyFE!R7v=_6 z-qO|nW`thN{9nEVuD^qn*;rWr?MvYLcaSnXKa-sKpR&tb9RCVnT6Oq$K~50YKLt6v znCOOq;!zB?96;hIdxh9_H8TuVH7VSN^!O%$MBR4U>wbM6bhC#}R1zHNZ~& z#D#{_9fyVhXpLg_X#cJ$Zw6Xtsw~Sdeb!QoD^Yn$c_kGq)7?W9NLX4@-dik9#FZh` z&h}0uK_9X|G37A}APDxl*)tQK_@r!iSuO!$Kjk?547s5vuO+IONZ$|f2Hg$F)EZ9v z&glzn$v(uVH?;70mbG|#%l9j-Wn}GcPq35}8FK!vrigICIYsi)Q02DuBEu&sF1gI3 zM@0OAuBw{n7vCo|7|?GLR5~k3hXnLL*`s3{E|>H8Jko{<^}r}4*_EF(g!H@Hbo8qM z&9>uQcrR94i=`vBzoPj)9VKpG>+_(3oyVKH?}qTrmWZXTcUI4*)OlL1nSxGmVS;DK#rp`tZ>~Zlvt{AjfxRV&S1Dx z$TVWvcWiJvP0)yB3fh@VG=7Xm6uuGX_R5?!fZ%YBbE0Gidx5p1RE&W{Vg^o@YG}_V z1?!JLdTy&F^Bc7Tr;!L|3L(|(0UkkgZldX_DXMK@sm)lOSt2uykZfTlbb(mouH-P; zylPR}9;jm8KXZSlJT4PcfiwlpwMQCVLwqx*ibf6oG{$KgEijZMXu@~NgsuJiYyg}+_FRT; zNtb2}N!&&C2|1)yf{F%43^F^H@te}cCb_9Yv2U7;96}Su=0jhtWHkGvCU7GBGXfK&PVi>^VI>+zdX%XpZr)uT2+O!*o;+ALrF| z`*c0t9Qn1hKkhyHwLITs?N(Lo-XJt?Ds^-UZ@g^5=&ewffViUh0@xg;2j%fcf4LQl zGoZv}SEhk5NC+nulDe0;Rh<4zFZ?F$e{dV2U{6E)TygpqY@}{{)em#-xb5BGow7Ut zEnxzflgAvGS1d9(S3R{ZK$p{2SxAMrN+{*ugi4e;=*X^TZOlRDC0VcQ8HYOM8;*rn5BNesj5O{g>xYf6^N$BOTE-!;|wAxq2M{3DF zMJnB?y9VjawID`;B>BEzqFo@W0twKQ&YDCzmy$Hz>86zq|j zMr(aOl}17?L~FxesSI4y^@Z9$WsY3;f7OGJVUXpnT9iXG-60DIcnDcGJr7bgXvVqq z2IU+iDyo0bnhgL{hR4AKVm}(H`Mi}*60WU|`+{T0-Sf7CtS}-tLbVa+_}-1siuo1U zAu?<4GTRqF1;%MTYf8xE6*V@c-L+v(oWdhH!{K8Zs;QX>m^{e}W+RIHXMz?g{Al}) zJ|aixrU-9g6N}--tC647eSWu4Pl|Yc+kO`3n}gj~=QyH(qE#@PO`$*4K5^$%i2Y`P z*TzDK*8J=ZWNwSti4kCZzPiyzFF)SOeab+|Kk?s}=WIC?Ozgx{)0$h)2)rfI75Gt} zWcCKeFG8A4{?-hJJB8 zpo4qxwI111ea%DSquS6axDo6i3{zdA;cg@%ql`FjVo#I1xHOiNC7#- z;_!A00vva@QMujf6yx)!PkhBx!GyNlPYVvnaW#75YAQLVV=b;EiG-t;xYG3(_t;Xz zQ*HoPh=jSZ1|`IipX_u&N)If;2+qg+t6+}4GZ-DUoq6Xvip#ey^s6gd&AfUz!ygsl zJ(vpG&{X{Z4{PNAknQc5R)PCzp3+Z1 zdq33%H0w3s%alPn0VY#LN)!4N!k&~c8IMsL$0`9#M z)Hb*qBHmmVC3oZmNM#^HCaMq2kLs%a3YAIa732>8C`Zc5Y z+cnXsYz!PtY0U)5Dt9{AIMtO!A|MaIv?9F5F_#ZPM_FUN*Ivo%>}N{6U5CSlpb($! zu^3R=&bGcy?zyK8*qprf=^_-CXBXAS2Z=OO3^E$(RuvkYYgk7*{W*_Wilw1#rx zmMH}%${94CZVIn1T7TpiYDlosA1s3!6v*5>CoE|m6QCAh{2{omJ*2MC9;Y+_++3q; zwEbVzN#6;?6JtJqX}=lr$qejYh2F0RsXg!o(bq}$Q*xyz0FK1@s?#w^qNcCUPHi0+6TXc{h~CPrfZu_5`?@nG zrgx&UtO;1(_YtYU2@1k7i8(sBnLD_-60^R)54?{7oeX6VtnUts|Au-e{AcWqr=y7t94q%bMJl$xvHwYt=f7atSpS0kH;w;r|5KdxpLE$c z-(i6d_86dCO-K%kU|<|vf3P{uq&0fY#Kgz zz-b#DD$al7{zn?l_bpZbgC5Tx-dyh?TmMDxj|b3~cYyxU12j{ar~6mn)n<@m>*xBmzWjOs)9$0-r~G5_CE{9k-2{uuxN z2k}pi1bY80r;TYKqF5v;E%VZC+mYwtSBKZ zEh|CyW-1qJa~GzMZorjBOT z4wl5+9Dm8g@g|cY2N%=Z!ZdcZVluaX@8DS2nVBrC;aE7>n4H}m-OSBQ?Ci`f-2Q#w zVr^;V2AuLFhEh_MRhN?nqWF>k5xww$^1dFxXfJf&g6}8boew&cvYLX5oGLKVj}XY} z%LT>xE*Bhd#vctR?}hv?B@qJM{R!Wd2u}P~tmncH{Y{ZHKwdv7;Bo*du+)#bi4&Ob^#2*d*p1Yn>_%c|)p(y3Y7o4YbdyBXVAn*t95=z%m|2tX%y**_N8 zcE<<2Yvb=fwm&zxe;vWSIe>{dSy=vRoLqkt`SrJ1E(0>_RABgOX3Cx@z zfcoot0J2tyfpKyIdwMB>ITfrx!%29cRWveiXB{0{i%FYFhshX7SV;`rh=u_QSMovH zTRXVB0*PYqfi07y!2C)nRIWdF$p75iE)Hfv!GAgBy|Qz(q1DheS938u zEMk|nph4Y-%ax;Wqi{{4WFXMtVN}8bMZ}BP;k(XAZ-P_I(;KNJ;$Ub$qQkdqiOy?* z9a(bCpsUhfC|>U8WRInvbu%fLzkpL|C#X*rM^|bC=C2q0$k^5=eC;5;07Rk-p9Va=@Sp3^p7=2#GU{IU}&^ z7_&U@ps8=lVYc|2!VDf7SDoRV^7w)Et>YAS7q7G1S=P*?vF>7B46Z=#Gcpz?N*4<& zJ?)Uc|IX1eL(y7cQK6)-SDXRLXGQ=gso7PPVhO=-fTa?8%gzh+Z^#+C98M_i4m*P{ z=E||QCtF|c6H8#L(ka5*DQcXNbh{T#*Cgo{eeKT?@1i38Jol;_nuaI5x4YV&sN{1m z7b`1nzd0((<_K;RM9iRbgzG3w6b`8n&fD4G?@CV;tmhA@8q7nCW@Sn}D0u)#7m&iprN@s@%?#9@&qk>d48Lr75wMm(26cvyKM26#byF z9Sv_R8LvP|$;OqQnWvVK_LtLE0)S3#?be1Z^+kXD3OQ>od+jfi#xf8#^D3iV}L74+eV2PC>(Eyk(Q zUYqUnyKpKUq!z@_i@L2V)0}8_diIMeJKvkX$G1#0b+MX!kGxEBjFrO%JZzVLC?X9j z3kfY70pWyNwoQa}HO8^*;k=Y^(+lV2kuIy=_|7&W`gSuq z;=KEukt-`+JxPC145Jkf;FRta?JVmO&7oh#=72LCA&Tk0xmQ~WUygG+QYrfb$B;0D zvr!9ULh9JuP2T(Lk$R-$>`QiDr5eAR6<t>CuGF!jH_~*DwZVm=S6%?yzceIIWDWD zq z8xdV;P*{45!@X$O-yTe0!O*OVzKK?fEY3Jkio@;dO_NN02b7Fpv^m1T>0zMn2LD)D zK_G-p^I|?vXZpn(Ak${)*+!V!luBzK&CAEdrh2%I`NbQ>gvIm@L8}`G`gnXMa(kc= zXxY%nEK;;c_PJe7GXB@_d}WKY^iixAi-uPer~y}xcfU@EIma?Gf)LraN6>Y0Y(mH2 zO-DtKeTeC3A^KCZ7VXWeb?FOmjeOsj|!1HNXEW0C&6Gu_-2pL;E_ztDM&F>N}W z^bDk$tHmf#_ad+(bkChq81`MCUUU*Tv}6fzIVn?8uL8tF)L-k23_wg*n&bpy3E=mZ zY4ZlNiV--bPuEDYk-=p4%4Q=Ru}s+(qrTxiP3qo;of!7ot-clu1dEsB?SYFFoZ|AX zTcxC74@#%i^?rtEhCY#(Bb@7sOmbQyFj0YzHVj4T2}*nB?BDl!4rc7PaXF`TF`=@O zQaBgpWd!KwWb4&d?(#XO3q0h}mXyJC#Ih@=)>6RegVxm2wOW04 z7^4%jOI0XavPh*+yTCg(9V1O7dNi85ZYvEK^?43`g?MGkiKSDGa+rUP1MVBRUxLH# z*73qxqe>fP5l#ctzyY|6ONk@7A^Q8_bZNa==K$QYsp%4IqzwBX+Dy4s%UBoR4tLlu-B6(&MQ~eyb*nc|HzVz zos(UuQnHhj<57oHdyd1h&eG%Fe;e5qm)aB*kG9SNdVca|MK4s77bz zr_sTqy|Jz#eo`DCbf4(0(= zL}IJwEkQPKEyEE_9Z-;g^=C#oS`M-KlY5{#7Fp(9y{J?;b%zSBdEcf)c?HOU`Djv; z8F4k-hMO@gdqf!NqOor5*wZb#hL!-at_BWlt4;|ZiiLK1Y(es{>6^fTwpI&v{7AxAQgMIy zs)M?b+Ps;Bx0`o1-C0yU=sF9s`Db#Qm5(NNY*Q}P^y3av%$GmN7>Ui@fV=uDxIC?-lp7G^~FLS%)tC(WZL^>s%V#}9f2Uk;ql zJ4t%rNjiu;ZXQ|A6h2>?%)Gr2fD|FYF4ynjMG~NxYdtHqBDMc8&5UVhgm9?%BB!DC zmeY2YiS0U-MJ$=u7tQ_kQ+ZRLp$hUDaLrph5BxE=^NTc{!k3nun08JuC?No-m~r_U z8-J)~b9??SN-rV(IG;F#clTPc_Z8(uv?*{u>2-gRKvmvA?lMWnW~)IO;9Vx&>-U4e zgb7j=CRp7~K7k#XF*CL*BllKxghZDk#VO{TnupK?^+k=Q&43*pmdB+=TH{F?nxO0g z-H%W)?CMej&5CU{8t&12RdQgbmO8CZCumy~&%a6l23vAPp0Wnw&Wtwpi;ubFm34rl z{DKE576wjx^Y{sWi%uIWU_@XDw&87GZP)$jP|F69-UnUnKCB^I)~ZJ<9b-rIZn;8P ze}=6EkKR~_L)napAOU`$C*VtBQu0HonuKy);*J)sVxQqQ&3TJoHafCsr1CYL;a!lb z76sT*g`<+ne3wX&zbr`^+Qo~K0Z>2TpcHxu9;z~q ztRhZLCi2ju<06xb@#;!KrkEVvC};5aoxysa68E=_r(0s=^9U$Xe%=Qkx-tX~U7TYC zC2xxxG$@MCWnDQ6`MVt7DvktO>7gpK%Z5yr*EUm0opv?+Mh`m-X>MR`nd<_aUdHbZSlTyh@+NLuwue_C`L-dPbNaWVNL{@Ub0J;qAnSlz z98^sMc3xOnAsl;y(qIR}8GS|dH3GjRHL_O3gs?$56QrAH0o#Ta@d#zCkrW-jFvfYb zEL60|CTE9rvjl~f6SGzd=qH#&!y*@so7FKsnOCgdpU;L-6h!769c_>JP8}(mBv}*w ztgWD={cc?-6W^7xXBK!(IDpTLYKIS<#$La%@q8#5fu}XJUHw}svF@`SvL)gnb6T7K zjN@T)nBdtZ0Pu+jCiB;|)rh_^$}>`HWxpd=f$tB%rJ3C8i#6-@J_c8}aG8*xPy8Tj z=}5opU?Ui2)7C@Ow;?o~N9EfkB$uyd7~2r5z*rMGd!(;Jm!W5ZJ#0%ZLV9Fkp-oL) zU1&I@wT8db06ZaR!gyWP=v~k7*&SD}tbup#Oo?KEPC%=Vq_lJYWI{_`zF7H3{C>0% zY(n{=b0y%X)6}}pvq+e^d7XalosLFGE`+5N5!n4{@lgC2PJpdzu-yS8ai8>I<$FO zI|A24-U}ejIPFuFzkQw~uT!-ijN#vepM)IiF!-!53ToZ)m=lI(89^5h>mbU27gNutiyKR9v}TH75Mv@;Kox6o!ak@&SK zT^gm*MP4rR(V71GysRNzvM158R={?{h24#cr~yEx!`9lT-yz*3@wJ539?Ql^=#1Or z%wpK4&cs~APur00cW}ia$!2;#oibL@@mDwV=vw&O;_7z$PtO#+RRbS=GNc_RXA-Vz z^~Ze2;T*n%9nRSd!jA;a3f}p`#59ZDo-(JBU*?KrBa|^(pt@B&+QfY}fPLv$+I*F> zOOOP(kJ1@!5U|b^^Q==!EES(H@QH(B&22-*eCdBO=JdE9wP@%zTit`#s& zuAaRkPxB2|St1Po6`#pi?Ltfu@4Rp4Tg>`Xm^{=9kPw%VJab+64g<4bQ}D!ni|?AR zHfF=wsq0b-){|F$)$^2FRT3wYR_j^%Q*fh%^$XQA86m(~5w(JPdo29XKXR>=%0(cdZp~DValvC2OC#6Ckl+(KcI6Kj_D)U+ zKtpsy0W~cTsa#6PGp2J5F6rFEbwL97)CX$3_ zK%NF)sRltL%7}y1&=v?u*O6)|VZ3Oy`pth``Ns__LqB=#)kL9LPPX3J!9Dtgs9eO@ zdSy(p>UK!F2K?TTyvz0P-aFa)Sh97v3Q+2MDe8A@SdH$1gx6@+@BHE19;5jjj5k4~ zckb@tah3U$yV_=(gEhIn=d196xkoTLe)DwNZ&VH@N}LHPi}1wJA@;8h5gK&~}aSoM>v zEu4fmJGoF}aGwt7{KYT+zPX;Vh!kgqoUDabNDwkYcPjndHD_|br7Z*^|H%#RRjSqk zPNfAWRVrb$8Ir>%vc8*2aB3qn51^B)5oUKSRm4zTK{|CN<>j0AioBDZdBPR37^rtb zq+%1Q%)x3ELZT<-wUfyqk0R+s;9p#EF7*KO<{jT*G`i>;$+O%6?|8 z!!0=3Iw`DKZHzU;nVK?>y_3e(k86xv!Exn%RU(X;kay4;|Af^(MsUFRmWi>mfYE1| zaw1p;N#D;|)H|E83-Q!UG0(bd)|ryGQ@o9#!0lLe>shYTLP|!xO4T)0**$A?5xr@+ zI17I(hB4v@#`=R$kh^4fP~nLlFM+?=s=y*1l?udgR}!LEgtN zirM%fG%iUO61cg@Ae5C}3;vUCKtKao}Iu$*=ko7IO zu3?I9%GU{AU7&WhG%Y0`6P>0Rs1ui;By$(|FK37uf#$hWl0w#R%N;O;_wKbw#{!N% z=d=NO7Ks88SJ~`Lap^|@QNKEG>D>Iy9%-M5oSxMki)na1mZQ#;&T+XE8#0Gt2&$7g zUs!2jGKZF$}+j@*@P;~#Edf@pqP->Ued>K1>IlJ}trjk?>x;Eeq7+vOurM(YB*l-OZ zMdM^kXP=)-@j%E8fL84R@rS0)s2xb?-k%;kO~;F0;N(yz`p8gDQ^DCu;`M~OGc;+G z=)1L5{`1TE2WeX+>hDSfOX%+O7jW%Ha)lQvhDxsG){^?B$}gPqu$2~7tj$rmB0;}o z_|rv>O-;FW2KOu20LrK`jAPZ`R?{`HViucra-J@F;!lgI>L%%370M;#=@T7w zW{-<(@NC9B3)6CCDR53uvYn)DyLJ9 zVp0|e@(8+PmjQY@4Lkh<6OLUIQ+|%!F)4y@wZo+Mpfgy~|mE5>e3AuIS zk!xxk51)xN5`g+6b2EP_2_r3|KRledA?31)6RSbCrzqO9$f$6t9epO1cWXMCYPDO-h|)gr}W9Ax-9frrb%-TWBFxX!K3u<#eE$(4Yo zb*yc_7a*BfDoa#_G?;L@pznvHu00DW zJ)B^U@bS|OXHJ|Is;t+_IBRBtpEc`+&MJ4zZA{>NZ=be`NwB+CKV^x zLNi2_e|1U@K>(5p#vUJ-*?&}*b~cs{yR_1e`3%``H|4`Cr`2fHm~N*XspCee=$I ze!Kham$f%<4?|q05)fOqhi)fioi{m_dT&K5!ozJ+0r{OZ~*CX z6<)Dcw4kLfy=oDoJXb}QtT=2xYc!2U-TH$1wYyfU?irA{>RPcFd^~0C^mIhMth8o3 zF~-vBvawP)&k|C-8GEBP3s|n!2Z&UHi%hl)Lrjxz!zH09s3x<#&iGq@PVbcW078FX zbqFaw{pQOfhN+uiStlBFh`Mr*+Q_VDaQ2;z-+6lgRRQ;u4c42B|CL0zir2|x2C&M| z{o*^&E0sV!WmUIeyI1G`65@U=q^I@v+S2-ha7JiQt&3Xkrv2#BWf%4=FgdEec(;!- z;AcYAkmi-Mtk@}nPrQf%55u)359rI$lENonC*_Z9g;m@l=!?-3_d+8=IYSj3z%*gm zl>LG%3nOGg*O0ROk)G@`+E^69fWnr5306b$vV1kEUesNbz<`YjQ$sj1vS_d@Hwt1X z8%sonY$Qx34AsDZ?0}hx0E&F4oE>o~O2Yu%0Hp~pO9;34IJw(^abMCo6~KT33`US8 zMvB4$4ZjZ$8kY!7?#KRsf=f0!^C9O_oUO-C?g2i(Vb{%;q%+`tc|}U_V;bh1&Lc2g zlyVMuRo2NV!L|#mfG*|iI=OD#AM-5h5~?{*#i<+UWM%Dg9qPm3V4If9D(bn&*k-CD z^j&zR-C3H_5j;MxmTZz}0`#7+^umeM=IcA@kDyV)xQ2P=get6NcRS@CcaE)W@O)o6 zuyYj@v|P+C=ZSND+(($oVdHvp3Hwvapb20RVH#p>1eaQylJp>U`F>hD$!1Z++t?_k zMd*l#9d{R@jf#(>^C;rNI1Jz|fOz~){dIn8$VAoJAj%7*dmu!k5#XupoXtZx5=JbN zxm!_2Q6Gpq6&U6x)e9w61hvji3B8Q-O1$5Ma=_YGlL6UZU7SGE1>rVbAIIxnSosBG zy3DrFBU+icWVJ-I{96GPKWJXR$j43dO&26Gm^mZnp?oHl^kW)L;-s+P~L zAPPZ_u&>d3E#B#pV4skSORD;AR)i}w>p`*`lye^%`^dx&hym4DJzSf$#|bBcODbaLJ!&Q@(iGOq&dGjC-62^S7)Gp7*vKvOx+=%tzd)L=^4jGeyK~7JLqOTDCU|y zKCLoHd#1btAcaqiC&5c$Fx6l!tTe4?Ef_VWh{Wt~AuM!v!&kODfVR-!{*FWw_v z5CW?&S2)F+!7=+P@i&n=q%{qn^{a2FaX(h+WLT$LtP=%&Q?%qu+bOUToYzRqLWmZ9 z;lO1q!>0hC5G+(~PdbfyPJ=QA&b0?OOAuJcgBD0#gQ7#d3iK)na77qVqOR^=I7~leLmyIas5;o#K@o4ku#p2 zlf7Sr0L$~EQM(=(%6{K+Ga7c>pR*B2)Z5CE@B_LP5X?WN4<8S3XApQ!IY^Q`qYZ=!q=c?{{h8=F4mv0!Or&naT0hf0K5q4Mo-V4!bK;P6iz(o%l{+moq{xrwsqUIZB*K}ZQHhO=byGJZQHhO+p1Kh z?Yy=2*(c75xQ{bt%;(W&AN_0JpsJ3k$|Rd(Qdp8e@5i5%lZYJD+x3GIearL1PrKwP zUqpf9u|)s6H;VkVC)ZzZol*`!JFH-i&}@K08l~jwlBxpQNL61#jq23}OK4d_c)5-a z_<*okEX*7|{nnsbGMD|o-FFbsUK%>tM%#nL1zU+kdx>%~>GIY%zEQCAI6S8VP#g{z zsyY*RqmRlvjPOYnsYez#_jKB7zsIR*R#SmGN40n7GmQ}uW8`)ZNxorA*g7e~CwBl# zjCj&cEmRP$HDr8(F|x_CGDS{m#*==ZfR1FSrMGoc=?;BrgJ?N@Mx(}wWyAb~?4N<- zn&fZ46z3w0Q~#>iP0PfziSfq`Lu~>fqn**%1ShMbG4`GCXM~gttKX9hk>k5 zTh6pH(iW}FU-0ulDM}e>stL(yP-lQAdwrd4ojCt<3j8Qb1v&*VrNMx4%^N!-y&|bX z*XHUFR?HKe28p;`v3yO98D$+6gETu2e^l!e2bZt@kAeGY)v+Mnj~ zo5z)RoqZ5al5-flD5~hX9T|-zEymZK+%12&u%vzsAbE!yt1=@Xvu<5gU#7HNh%B|!^a{G{t@KXt7>XY`$)r&3Bz0Fq zH&@RX)r!^ngkvmMa=b4lZUsQCJvXy&XVr;r6=e}67e5~hHk63zlg3E>hsA{$0q+VT z&t>+W_(7;rtsRDK>+h_4^pSTSR=6O{1k5<4(t8nh@fr4ucyx0CvvwWL*Lm43#ikJN zaw=79_N8%Dy@1>wYct|S)Ux^wj^XKM7k<3JEpbM-+1r-lIwie)0V%)`!8{C=8(Enq zxUXe#zF@UFy~Ze+1XUrhA8q4RI~KpV!(>HLr*g+Yytvo$yUMNyPuJANUok(wZZ_50 z>zJORGusNspl@5AkY&m(zq$4C7ICkNYkZrIJAbJ=RMgg+n2`7TIr?U$0^OXUO^P;_ zzgNG=@q?p>nH$N*DnS4!`HK~eY7Pa)10a?Q$tTGm(MYOj8C!DA=w4Ih^f_8=w-DJ; z-eBUfQg)Mr0PCdH^qeY|Kwm@p2KPaY13san8ef;BNV3-M=r<4BeAron#H$THlzSJs z1u$(1Du9@Dx2}p}6-LG8($pa^URpL9<~lAPSmcz)J{*&XF$aJ)b?#wf_9uLxt$u*H zQckZNLYZ)hl=>*O2yDPQofHoUC>csf?e|+Tb`~yS5qDEGy89e&2N{t;C)^wKZcxca zXs56uC0L3W_*IAJ8UnUj4UM9jmx#rqhLDr0kU0N1DEP?8Q#+s>e2=JvZM~cgv;g~9 zYtlO(>RV3HX&aDiF;~yD#$xrUq_a>SEEK>9Me% z%dV)JyyGasP9PuC;n_{Dv1D~wb+gL($;-P*(_#S=h(&KtdBvrZe^jJ7O*s0c)C?b5 zUOpu}7%F?H_6s=e!-r;04}&Y!^F*!qnY%4;^6;6yI|Pt=c=4-7t&|ew*hz~j03q7$ zFY2jsn9P^nZON_xI%;+tN&PRHL>Vsd4MJp63NeC5ah(NfV7Owq7g((XyK+<)EuCUU z|Hq)INlfeo`y%#Zs;I{o%l7!ns?U$la9sXf2$WF4)Pl$bn?MxV@**PKKV}J-^dHC* z1yVpe``-YawJ8|;KhSm&p;0SQH(FfvUKqT#WJQA3TB-ux=-#lo{S~e6;x<)EmSQxf zs!6qqpvQs*lJXIY)@WAP6P%Gy-^a0YJ(GgE*StQNsovK($6VUFJgbkoUI*$U!@ z7i+rho|huMt5~G*Q;$%l>=q8VB><`i~3f{v_xXW zV`{9Z9I31>+VevS*^S48*j% zuhuZ~PGIkfzZMDJ{GJ~VaVTnz1)KsMgr&mT;2~})trxI53boHq^6>B|A7I1wkbfLwf6Qm(rDnBi)@mk`h!UfyGdVm|pHWal%AKesfaj%Z*I`*v692aQ zw5vYSHl+Y`=*i|G1Frjo|^~Q2(rs}O&0<)xxhz9iJTuy=2VZ;G9ClN=JU{1 z5;AFvgSQQ%HylQ52c0IrovrxL5WNVeeVJx?a-?K|V&)zdh^4&>)~J^!FD`qk!R2fC z_(GJ4gfG3|XA8KEtHiiySHpYDOr&GNrU?uCm(u;t)Gu0STjm7h{l1+S zhu(mcZt_N0IP&=>vv#3u)im0k%&=a3>@NOn$QTiSf{w8YRD}%p!mK^`u;WE(!fg*E ziDklE>RhJlq+#urHP_Q%BX1V<_*MG|!oRPm?f6=d&xu)|DqhG_MfkM#F_gebFC4$$ z^;sxkmyFYA=rV5J9^ECmdhDH73JLZlL_O#j8iJl;(o)yfYdr#B)X|4pOKU4p z)MP`;X?r!*;@phI#M~qV|COZFasGHZ{WCz9`{VVn-^02lE!!zm>8&HT4olatQAPLr z;p~Pim19abG(zT{AAhpKENOYg%Ut!)%9I|&D_72Lm-`QlKedZBmAL*(wbHDu1&-|> z4fbZr(BY*Gz&q;hqOSown*nA+##`N zv;N&peS`VmCQH~t6lV?WYi;bBTLakh|kb5u_FzM};8mIRiyN#bddwnk##`;=GsxbB_`^G^h#44XsM57}KLjtsNat~7f? zg=~KXN(u;`Y~}%PEgzt$FL)RO(aEc5rIO>^>GUxs(XO=v5pIw>8VPQqy!eqamF!b; zv7l&XB?!l6=;yaLY|D3nrT6%PdA0C6)Z)F#vt%mgr6XB`l>cJm4+fwT!2*_5eLJ5qf z$=&cy!;p+KX2e?Jv9I*9&#=NEd`^?IapSz?e#OW$N8fbwe*^FK*By}}7J}Gb0p_hc zR9>XY>f>47mQX%0xxhzY^X<(F^hJys&;b)czq!VCR49YQc?{} zY7_8sYHEPkSSd9o&-)L}-QTtriVp35CuIr+pQjsfH_X?ZOUjaCToW78q03s}#T|?oOoO)4;Th}J>NP}M} z2(AlCas^HbuS^_I`Xp_QY*ng`wkF|al_ zi%Joalqut=G(>u#ZJ@=1@fnq6bvR4Dh#z2s4KGzd;#jqEYn0!f&JjR^Mz_=c3eF|14EYFiSbkXPJxSf(B%0^&looi0wK;XT@1mD&qL25i) z+otjk9!E{Zu!~$12k*3v#~RfUxR=d|Vo7^BXP+AWMqZXBuVG0xJjDBREZZeVI13

An5*UzWnWR{DXS>`6axn%8rjA0+C{hz29VKs+!fZZ7 zgq(fEix*gXDd01cXh_xre=hcpkJGBsuc>IszNY??(gxbuM-8VDVkv!Es@&P+#y26| z0qT`;jRXHsUfP@buj{r~6S+-1Mwn{HKlVKU!Xc_f`EGQaw*=i4)(8olf&kFfd=TLA z35=+;IdbcbxQ}?qyn0!BqheiDMyh*0v1@_R*FIO>RQwUC#9!hvmq0KqckYpf$@tkD z779$0)3gag76Dq3$*D%08Td^s2=dy~Nn9qFMl)T#ye^1bUO~@0H)xoqi1`$nVfR;i z4d&$ETnBSQ{r|!MykcrZgYw*Ba{(qr0-bXU2PJhtu4RL4UGd< z)+*z}U~tWg;Uxtm!L++C)CX47&(d3~zGJliA@e8sp>Ms(2EER7oeV%MZjW#_GdbN( z-a%j!Sc>!MAl3jsEKisLKq2iD3|OloM{8f|`uy^+d&Kwl?rHRRO&-5HI1m3s7byVU z2jO!qe7UIU4Y2b$ino6mi#^OK6 z6EUyT^c}8t38ebOgaClgF70y+PkNg#Fr9b*`}hEvcHjz>W7Y1C?F&64tfJl>nZ3}= zLm+5;>#21!R!G>4<8)f!ab(2_H}*=%#-oyforXq>2>vME_u)7>(kPSScIfP5r$mz9 z$K3!^gQ<`VeZ~is193oKy+>jM4!aN@)hqM@#2;9K>T^F%+H|J_vZn6 zCfVk%)9dGb)SoH)%b{QvUvq5Q(~OEcv--dn2=H(vLLBjRq1R-ytBNvRPnfNLKjYj) z$MsW_^`QWu9UzJ}JKn5VUD+vU9xbWQQ27guxB{6+ZvQVR>! zhoW&6Pg>MHt5YA^klP(Xwx+8O_k z-|aH1`8EOeiYaGxOY_o!#)fR`aHn7!r9~Ix*@T3mQy-Fk7WN+cT2clIOVIN`)Mzb6 zt?d95^(YPPsmc%E3l3Xeq#Io7I0WS|%hiP~Mj}~SHH$&B^kRuz!^Ce)`G{XMBtN9* zzkj3`1(*T|`1e~2Ha@|yxY=WbQFE2;-jy?mlE25Kr3orj#m}_*^H0^}IhI|zjEMHo zFX|d|2=Mu50?8o_$WK{AuLiirI%ZC`V)6jrKAjELdX8a3rX;{W)9s^>Klxhr1gHm^ z&xY)mgi4zNt#|gnZS`t!v$V!4-hfj-`$NsUJ(0jl!$a^L5yh9mG{{?s--~@L`ZtD& z95EhKJem>V-Gy-a)2y)C;d;Z&qn!`mNGNU-uw#NiPinN$Z*h4ch7|gx6dH)6OdJ3Q zZPy)Rp?&%ApI2rRGw+bBx(erg$;}fXOOITJnEEK@f@0O3K@%{}6&9xBRa23#G)IU2 z&HqeBj~q+HFsMdZI%n0W_aYX)^qv6{WMH;#XsI;OzDi0KzTzg~A# z=uu%$?^*7J5hz!}ABB^}2A}5tWLfMW_LCea5b*kbiA6A z2?D$Z?4I6-WHjoKitNsS6b3kzeng4zix_Qexqi&O-I9$+V(Zs#wotB1>{0=ehfh@- z7GI;q<#^}KiG%j;Z8$&jLw3mr?qXN)TeDHk+Fy1!_9f1Q$lF2s{Q+fLH}o?hdHe{y z!QgzlaCx`kLM^r257x?QJnQ0pH@!YCwv`>^qG&2aY%&e5DHAG#?}-iqp1Ny3(!Pyt z?oiucr;CurSt^yJBNDcn$9n*7tu3$JbJ(>3GJfF2aYZH9YFZ+*JT{$qmmAS3HNm|z zfkqxxj8r6sxKWuc)CN4g`IpXf?r^7YjyLGBMYIJ%@Zw`Bx|^KjbkN&`UrFAUYj2c7 zb{<|%EahPCc48-M{^*&ghCr^MWXOs~Ze39~VY%Ac{1TlUCta|L1Q(wHVef@rxxXq)GinQkj!)$Mo^%|jym*9IG8v*};44r_gsr93ur=ZdQHcS%`wv_jc z9z_V4vN$UVP<5-XYR9J!LP!Xh`fG_6()nhPvm5khx7fs|t@o7Sj!)OSHGjY!T_crE zXLF+pc8S%C>PQRfOJ<^WLZQ?(qg386o9D?a=oQg~x_>e0uAJxp^fx&9}Y^)F7w{@+*58di#`8W{fYU$r$T zCYQXI2&D#)Y}UguV`_Vrt;)B>fiB6_oYH(jT`dmacV;uoWmq=^H7Z|Djs zrUj`Z4AIe1-$Wcc9$X4Vg+(*Xy9?~~CeYQ)lEks!Y9hH%%VdZAd6{aKm$ zN8)2R^J0{VV=sc`I0PLme)CIBf}fD#nBw#m8|7t(*gQrhyo`eDuV`;^SLf*q&!@kS zY0YQrA;axwugUr8?c>X)PoE)xS1>ona&LEOQQPUsQ^XwTpFRafxS}Y9TZQc3$=QkA zJaoj&CT8ZUkCpo?HW;JTdYE0D_P>T`4TCa}WuaISq0KOujHZoG;K{SS^6o774b2&+ z(le%M$pbR_!I+ye+A_GNbj@EG zZ0!`tXHWM;CvqH{nr1w3-0{rQF3yM-9@~Bhks!h}ceGX(sB1Lj#*5n}03P0-H(fM0 zf^Z+{5Xiemd2Wq7+J1;Z*qwK!OEO@jW=hMh7hfXqyxY%D#)!G7 zp+$%Xga;jKRISfl(Dzc$9*<)c68}>2*?R!T5wyheBMy@35*o5@H5 z&0{1qhKJM78}!}H7oSci>0cmaADyDRJWyZi#R)X`P3r2kejjfEu!EXRFQlBLUNwx3 z@!STW>bJX^S$ue{#F;07YfMqQk=xk|Ddozea{`o&xCRrFP8>1pHC&#K%?y`xJSbXVZ)OUz^L#LZG>n~7LBJp2N$>`dc;>YyFP zHOb(R1srgx`w-s%&Fdse(gt?%B!iD=jWTu=t%Y`nL@^jO&PhF%M@lrs*U(m9$1v)H zQ2YI$`Uiia#=Ze0*GrgXwCPoe41pV6?OkO;qlEK z!J_+z@4bRsi4py%Lr9KW;6qj1Xn$f$&l!s3E=ZL+5olrKHMar1zu_)?j>*3ZbCdu=6OJ0ZJal&Xc8b7GV;aTyXY=@cMqi81jS`E-s7dAE*)14R7+Wvkb zolMB#N4KPan-|k(_d2VPf2pLFuzZz#E@9s9wan0QP1y*uuilGE{nweBP$$H^7X5qco9lbA2zE|WaTzy12?i}*J z4N6$nG_*6>E3Fwevvf+65sNG~FSB)H^~v^n=njqmnT!m?el~#)(r(Ho?0sw|KHn+6 zRsL1}F7AHvYTSRcUz_7cKfd^VD0HQh^9k}#Dh8_-U1?j7Tp+xaeTsJ-gZ4QlM{Hq}(D{#9}v zEMsB=V4T(N{VI_CGYa&hS8X?Rgp^co%lZcgxx-l>s24pokgQ>dm9o#h#^~R0au!Or zbqbS9zI;pnMpMQZs`oOGI?4~)){PI_L9(Y}SslX855&2)eu2T$&@JLPQ;PpG!0Y4c z5o%&{VBn9RW6N_$;iAH!%;dUt1|inaJ^~DdjHg|PO+NloV-`o)vxMYXs+=^OwHj*=&l3; zVB$o*UUtY>8&7E%l3~kZ^)YpKlh)h)>8YKau}h;Wv7U8S2^LoQY_L7pqzmuu+=5vo z35Ri|^Cc+m0)Z>mca8wj2I(3O-~Q`nwvCI((>eCS`oZ7m1ZFLHPbkR`bbecldzEg%3f%u_8xTg>*gJRVC_kpl(siR=r1Q${v^*^uRx<%b(Tv;OF2~3qkVvX zuO9NzOakB&`D|lq(3ff1r=G9^sG6hOIak=&mqUBBcrE|Cl&8zx_He1CpPS2-(}G&t zJF9+f77-KLwVk69U3z<;W9=ZFCslCOHt;n;V(0^TE(#n5otU>d3>?(ui9g77)Vqjd zeI+2*BU(Hhj^ToI5cwF#;Q0wBqJZDrC2G{bukmEG-Mmal`;hT4(&O9>Xc!)j{sNEV z6{Bmrar+GD8^FZC=>3`gBP10`6s3%C!UHaJl0WG_aHyH@t*l^VwVwH6g#V)2a~RGz)s>T#GP_$<=$w5RlqxnYV(6LKq9m zRp@*DLc+)aD*tv%y0_vDuq{0(1Y4hP8!F!7ElSZZo6y7xq;Ia(z2snWr2Xmg`bucM z46_Uw)4e=5+pwtzr zSU0U~>||@6B*L#tfWKW8;Rw8{B>8cU@EZ<7XM|z+62^f7)yzUyqsweRqZ6=E@Y9^l z63 zLvPwWCF^-Hn8tw&hr-~@qJ)B%xpS70wUJ~+xGllP=@-(m16*TyPV0(b=S zSwN2fLwQ@fO?Eqfg%&04dvPA?r!D=`6h9Z*b#k0NA>BWL`bmmfFDp(LVOsObm2ebe zZQ@aE8XBd_<#>8iWnEeI-xfnW@aH*8n+Oc$q{(res7{a4a>X^a!5Zbh`N@eM;&v0lA= z-?pm-PipS(>@4EqawMPzbgmL_MH0&p&vW?rV1V%l9JB@uxIBqzfam{;D|%+gD400( z7{qOjEL{GHAYd4TTulB+dj2^cIR5!{j2tD+{-eV9&tnqQtVYsY1q}6nURWAAtC+b` zG8i!!Gng=#GMF)#|Mzm}e^x{780?b*E76j+XR+|9{>L~XZe?r6Ldf|aZ^M7>f^stc zFPgJ({WqGcd%3EZVF1qW@5_N3m_WfPpbHx*$Jr$;M3<>!3W-}&Tjz;)wl3w`F6HzW z$-Z#%H`Yq!v?X;6*UMn@)sV-K(}K_L&d#Rym1g0}QD^Uba@V*ldee&MJF~f1D1Jz9 z{5oFz`#!q*K1__Tt*`*mBbgt?-BMZ_CAujzX{yYK>PpdC%X(JJbxShmg#;K%KeNTJ zzpAr_K(bx?C(e3ocGos;b9nMk-OF?0&FVD~?db058OCXJoqoO$d8stYQ{32EVh7!9 zR_&2et3oR{2FogOF04%lKjza;s3UcWY7*J(tCCVV*r4*#rj7xFS8u|lK^yV*p&vge zhFGnVzPL1ygK{w>7*R96#LD`Dr z3%wd-H_@rzGnq5gX*jJvZLnMCy>!2HqQyNjjz+fCgm6dt2t$`gE!C5*lh2!kGUZQt z!@D*+trr_6E_4DQc+5&@b!Z7}tB+?4ZA@1D89p(ewJWThDXI-*^yQd+hcP~P#C)Q3 z0N;h9)iW)tlv{(#3|uXE%FwlQw*g=ZP1V?vF}nS>(_Sow$Xu3*ZgT-bVgx0K4nu&P z_V3X#Y)<-T4ytw};pgW6g#|twI*_^p^6qh2DW1~KUWpCB^o@*zj0c+r?vXLPXjsqe zgl><7-?ijY!$%dH;w3YLM8cM)fl@7`N9a1NHbDw@U^45K=Nl^0SiD4k%wffBOdB#g z8~TQDHe#RoPVJSL_eZ>$^6;?Ty>}f5gI7@K{rT=n0-)zJx+;AdIF-jV@eBTzXZqdR zJ&{$8x0C~r_`}fQ1nx}ua$WVfh&lPVLKbwy8s1TpV!M_pi<2+EyK3j8g$Ojr($b5r z&?9GD;B>1U@xF(r@E(iP)|ygai_)lX)qg1%d?5*`4Mc^D+{;ScB3cxl62A zDP{^z2}xYWTntr(5J+@*m}LSuVyTG~vCDoUs+Ietsr}_=tuiHU5UBDy8AZ{Y~as!uKWduAqpE3 zHnx7DML>$?;wZvdyTxN{gM7nG2ca|4qB0jor@Z?tFXf_@Ym<4c`a<=eLCqPVYD{$tywYuRxpLw5=U9cJv!onu=tDFQq?E?n?l8+r1zbl)H;L08zn#^x-3B_cqzoVH4&> z1GbHsiemAS>oBaqOOB;DS)^}_J-C2ZWuk1BH>vy|xF6B+zu=&v)l9@Tc1?-Y-%~SP zF`@Z5l-@D9&tK{kXJ*pYv31ZEMZhA2#<1-YR2(=g%Tw6L?@p<)o=Qq4f8_6Xts@-0jI}?h(cSC}^9XFsi4#HGwObk(CJjWD}bj98{F8TL=m|%UTTTiY@75@(1 z{s!bmTMz_uF0+)J|10tUKRrD9O>nRRV=&z3?VC7DKWVpeeaw*&%RMhTP8`dWHrL89 zoaace3&28hz+)T-vv#+Ox2%Jz2Gs#1lkucHb!rn5weNJ~ImGw5?=A_i zHA6TUX@?F=&qbt++Cw#CTxw}LPTn}Z3Nb>GzB)+b`#U}xS=F6LLS_T@guMaKIciHA zg%FF`$7jVXP@hD?-pTj_JaziCw#4w(^Vuq>3$nKklfOU_BVA=ufR>O9aKmm!np7qm z19ZUJ6!-2e5t2~zvoZW&RScC$x22%95)%@Nvzb9yl0Xw!LR=)sEaaPW4dBv7>ISph zaP=9u=qR~zF#X|<1C8}cVgdj%Z4a{nMn?nhmPHC6^AZg9ma3FuH6{6A5xh}>VG;gV z(39Z~xgSA!s)87#KAt?O7PW#MQdLw`1~Khq)DPMj+s32@_*pLGPTAs+R#lMo8QOif zx4pYa5po=Z$-~cStq?gvH~NxI``1OSjtp3nLVzx^FdI}lA|9PYy5E5CWs<8l*HhX| zqYKi-Y$iJcxuk{a#@i}ko*ae(V0|)ODcIH*^qgw6Y&x&5Kiutb-yRQRB<8)`cN^mQyKW~}mL#S(fdj`DO?Inx_L|#fjGQw6Mcwntp_KKx zf+q1#g(z4p{P~}7iEsg|n=yRFGPtBZWpiD2^2zoDy2GVctQl`eEmtr+M6~kE`Qn4b zz|?LQJF-E;NJ8=~VAv(%iC|JzZ4<>gr9hiZkpucc8lzEPUWTaSHdGrbjb%gxypXxE zC-FDfdk^AMWBa_E2V5+&j%v!|MiPNO?qj-3L(xloiep)l_r-t-3JB#Op7-JBL--Qn zxqzU&{BbC(XLtz`NC=5-RKktG_`Yw_*}~a@a4(7tN8}v;9RC1)Aq)C4uSbydR-D={ zG{i88H&FU`f=A?r(uirxW_O%d8{EG<(gQ>JoRz+z^?oz3F*yWYh~1F8NRToP!ai>h zuo&d-TqFxq{^EebH29+ip*Eh+lJCFZn7i1XBhi z3CTnw@^pgc48#DYQ2{;^hFKIj0}C{zPg`m;XFhTj`caEbBF)@p(I2;{nkAJ_7Axjk z|NX2D%)VJW=k!k0lQX5yCyl{cCPpytt*;v3A%0XO)JK3fO&5Mb6XijkQKLWctokdb zKivx+4h_B1%F1mSvOj_Gh9X##29s$QOrM4Othz2!uq~YY(dSfi_G~7&>ZG7<*ZFB8 z1V}6m_xP8*g4^wxEl%);R6A11!#qQB3F72|ckZ0qRU5eoBs3fq*Nimh?|oOolWXH_ zeV*A&3C&@be+t&LzHm~E67QvqhA`cWMjg}%9CYqIt_d#dRWg8bNW5c6eJH)W^9 zU=#Ut7W+I4>GVbmyE8;My5(q;k$fDk$i|~&B&GUjtGgH3=r&>~6lcrKRO6rKtS(-% zPXnaR38HoQ2F|2?{gAK8JY>n!<{EPij#f#XYWZ)#Ry6#U#{7i9qdbP!-8s;@Y}LV)#JC7*S*qE2KK~I+?;7b0oQOH!rHvSWTu_?j8^3p>7Vuzs9><)d zk7&xZ_#GBp+q3gA^x5}lCco2=$Y*ohA|IRPs`Z(J%*s>u)vQN@y3;9CBQD*>dVu9{ zn~$kJf)F?td7}XkpW92_Q`VWSOQDvYw^gHtz%lt-Deu2j`T_lIdju;{9s>;$`e`3VSrE@<5jGv1jKQ^D!P zcpU)LStF+ZZ)A;{6hA}R#ImajjKcXJnc9DoFVla>w`pe23_S^Emm2W@m%aTDHVX?o zchPCBHNMeX7bB5do>C1!e-1W`mfrt5X_733r?DZF(R_9CC%>)0R9=O8} zCa~avbflczoPRt20F#A*>c`=ENSE_-xc3sK$G*@4ElQ_Xf}xx6rO!JsECPs80Zh-x zn@m{-PvB?ykV2_p7r4>;@%6`B!`T>t=btq|{CCItkDXT#;jUIr(?{@j z{Oa+QR#&Z|-$7U*A~geU22-RFmgi_?v5K-W}3(yxhoPe!fRM! z7{{2uAzTw6LreIK@;4%M*xMMnAy8A+SJIX=73KFZ?lAeGoH0v7%(^fwMJviu6 zgPl^NNqzBpT&-r?wN3)OH&}hvpOMfE@@El*B-O|ON8^oRr=&*m9Z#b<*m#PUdXkMc zgYDZxj%-c&q2y2%oYMS?td8jRj&6@qy3AI4?M2oB*0JV3xjoLFrxFhRL_r@gcp)Tm z*F}{exOY?mi*S`2rR`h=gToURrM-xAykV6plonp>?GuYDck7&deASJfK#@~JPRtXg zV9QE?n#l?f9U|!zTh?PSoVF$j@7Ym5SN$g?HDY|eTxQ@g;S4Vm_VadwFH_2n*w|1* zb~?Ot3S0tC&emTi)f89dQ$u0St_`iL@{07;6pgfIs|WSwN44)V#xc`qHRu?JaZlz| zXqgWDh=AR~HY`c^P2ESCSG*G--NPC#@2f#T8%0(~Sh3JT;#ldL#qyWy>DlCQSW#uUe*;0np?_vD zny1x|?Qa+X@Y6xHyu!9^lyEq-2f?__dZx!52mzZMi6iQN7nQVs20e@}Cm!fp{Ls7S zA6n-3nq^DZ1dZ1eR5s$9RSY3f>BELGZ{N1G^d90AIY4L3?Bqy4yj5~;6z7_6)^bIE z@l&TTF5<;Tk!n%f99*(Qmns&(p`c&i^34~y~M?2u&V}!1dt^9Z+$dMboNuoF@ z%PpxHc=SI440cbgsQAJ#dq6>dX~<>#WhCr7lQrlmas>DirO@vd=^2wT{j2xz7Gf*9 zBeM0xg1A}I;k+Z1N+I-g`@k6nVMubwj`j0?a(;Mw_^i_K#t-T`PTQKJJE92%WcQXP z<5jU(+{70v8z;dY0(US}Jxp877{KoqBjo+Hy9V{VQvnD*xW0nVYSrwZMf8SSx9ccn zvWgRKSq|H+|FxK?mabZ*ZkfEYE}ONY1pbr1xufjyZ_~S@ChjD!oe^`j^~rOa4xLwE zlimc614yybCF7TNKDd|D@49?wfbwsB9a<%PHn8Jh@OU-9e#ncdY)oA&D>@ou&w}E- z?}j8Nbbd^B-eCC?*MXh`;ZpU|)#w0-a$Dikz(r9F2tp-@DDe+PqD(|+(f+qS-`$rj zj^t+JyTz*w2Vi`dEmuhSz&V0&)N6nc9zplAE4nYN{BSa%adV>DV>3SlfbTA=zUh%x zzNTdqM->Pgk#Y$sC8}L)O0+79qw45*(i7G`J(z!$zoM*^*pb6Ctx`i3#|9YMVi5e+ z?sfDF6x4>~#k{vA$NGEXqInZ|e`AInb#G7<7VKa?zRIC?5|XDsEZgi(2f=pb0`@ zJv?q$6yKP<-wBquu2%q0b}IhDh<(G&=<=q0c3F z)zOX_(@hM_eT4eMGQaH=`w+)-#K_#t%s|}~%Gt;7b$l@d_VJonwJzZ7`R1yc&g(BE zr=^1lE%)_?Th~2XX#% z;{m9p*&#QOalg7e&TLI=fZ79x&QyJh@kNjl=)NagF`V4&mGqtT`BRYc+VxT?75?M~ zZIEw4!o=dITChbL#GyjKSV`e0I%&VEJ9 zVLZlVgwLJAsJF)f;rq6UG)O_hVX&Dk05yr}*qt1TPzNPid+XP5a$+;v6Lj&U*j#?hc4daaJJjx|a}sxV*^lV6@h zvygcM6^@65zIOv@sz3cBqgDGb|76K1rwop;*^tz7+feJ3I3WNBlYSv@^iwj8v1y|@UfO)ZdGqHost6-k%$TkAKww^C%vuo#5UoZRZTT~Pd02#Jh zfIn34mUs%Y7Y#s)#*Udxl-&7DXx57=^Lg!uEAO;~L@Lx|cpM5jVN3}lbK;_R;evvV z92RQQIuO>C-|jgCzyv=BOzUcL{wD}+li-d`wR97uPlu;a%O3h3fK&(` zZFxUByy)xOHwhxKUss%iT_uG5a(}fNuY=a*IOzZU#=*>07DZqGt;V8tN~>!UE2ft?bblO3L7%j>{%KXr}iru zvXwoXwb>V*wpqNa1Y(6He>+j>_s(p>lX?q795Pz+15Be`CX?m(+|(3qZWp$0F-{XY zN|A~K|8y<1!&gbU1N4nLSuMOP^Uv2eYV+ds3%zFvY+NmHcdK5AT{~R7w#Hc zy6kN;F33?Gjv&&NGUbw>#`u(}HY{=w`Hhs*uM~2x6!blO9zcFTbIu1;l(v<%bTuyf z+n6QXh-rR0Jh0O+Y)W)V?mW#8|D;{tP%a&rVFgwr@foADlqzeHZOQH z?zRosal_EMPVoyG-h@PM6TA{`lD<+H;~g51j7>V>9&DiC4W(&5-NV+@eYl%NRa+Zz z)DDM&hC$l~QE*T1{MITxn6}MY;9^OA+R3`amey1+1~{eID>ga_z-)8=-S)lSpAox! zT-N2BA9J)bZSO_G;1hnBV3V*iXZrLUazY@SCTR`R)hsuR&oMEE*z}>;>cXy#Q%4ki zXn_D3`%CP1$DLX*R&%-^u zA6h~c3@<#sL`zjB%-weezA=)baKblY_hoV}Bf%GS+4OZoY7j}jG)9b-t{;k7fGOe9 z#PQ*Fa-nXCFr}gux@Op;drDcm?3F5rGGPkLeH9s9n$x`x0Pi{!?gA%!-4zxtkq-Q6 zL#)v_aJmSA`c;j(4Zm`Gc! zg4?PxbKxGV(jj!f!2d{8f(-f@$XUYsrbYs9FPl$+t?g0u8K|*UxQaC$UL3weC7r3( zv_L_B4XxT5@Qc&Yk|s0QJU_#7p?hgzZ-;Be`3CheGmr0RR6sbzH!HFiUrA!=!m(Lt z^cV9=#jR~I8^&KU^CBs`P$QjVQ6M$916R{f>De>LDEMi*gtBL8nLVYYGy- z17LE#K>m16670rxfcFT*8l?_MtFyyj0%xCr^Uw8YfWnxLmRwzDe?VR~^aqIkF&Ly@ z$rvr?9`iy8@?zCpS{jcNsSS`_RA6>NwYwM#VR)ST^YS=N2yusSb&HLz^ki+@d0^yn z`C}tU$%`b!Pd}H_+q3gJBw#^6GI4osAwBYVFNx-Qq!g91Q708yD| zMhiWuzKZN~zOvkkU!z>HcVVK0p;8u9-t)N_ze4qG2HD+jPWLlThzf<9@d2;VPFG)^ ze>f%Le7=D9S8>r$OX4C`8xazLN|?BOJ(xxUkouTSyM#HjNrFqu(iM!D4kUhTj+4?$ z7sei($zi+nW2vf=6`V@!9+MYgwoESchZk)8=?|=fPTmTxwH`0laNbx^Zkya4+GNvnff<`ld4+ez8&1RO%(mas^t`Vza(j3JTVQKuzdl2;aAiPj#UfW8gV`x- zjqQss<{zmfT1^Xiv|TSgZ&WSqTR zeY=oyCj4{Ycwsx}o7N)f6$aq|z&!N`4w_ZEJkUUGXnhEsEs4)!^ZzUC%;TYI+c+MR z)Cl3V4MoWs&CHoIn>E`^2wCDOr6&6}7?rX#C{&(MLkLrmQV6M}n#e?vJd`XgwlO>df%tFnRz~+cm6uA`Ca#Yo!`C8e4IJwJIbw+2i9%#TGGt5tZwdV1ci>-4mB1v zX<5}9Dc_mp%-z3U@z-Z3hm+D$TFa3sH?55gq^ncZI`+O>lF3;dd#{->J@q`OS4Hdj z3_@kFC`hZaE2ge_2D;a;AjWfPaX5VMTggn}d6fT&2Idcgdx>mDac5Oo_)hC>N4cYe zxknCHWe%Sl<#0+D7`dBzOZ#1&*ZFZP#21L9YJ)ce*HmAXC1Q){ zVJ|Eqr%E%dsOvgM6K`5F27p2H0>&iJ;Nt$#cE0>m;_! zH>M-in#q6;N?m8VmvrMp`LhYc%`2CZ>ow)sd$hlwcqG@?{qXB&<+3E-m0nHmoR^My6AHVnm6>zt31;tbPfpb)%Od48OahXqqcwUC z`!{J1>Wi_eTvvx|xF;{+gL6>)t~V0H2v<_AHaz?7$58g6eEE&Lit=NSwn~V}8PodS zT+AQKvU1{9b6iT!Stq^fY`?v$^6KM}a977>>mt3k_4CMXY?r%ClC71-Zq`e=(pB~` zyI9UlbazsFsMniG@)nCLvzB^@Ts_IZ#^WbL?busW(|4)|(hEz1{5ShQ6{Bq!yhwd* zUeVK5+AC&%<)&+k-vQKB(GhX<{>FIJv1M8@FE&r6evNdeCEx<)Hx+eMuY3Qjs_Y~K zh3JpzL{Bvso{u&9IH$_qEz60X`ld%*N}zgXGc(XP3-Zm1T}NKOIIAjAY3ySDIcGi>BBbF_k0XP3~CtHz2oi?0A6Qj3zTE(9_{&g4#RQYjf)oredsG{$S+Zf+V z#L#Vbyz0tdZ^Idf=HuT!57coIYfFfFCFC#u#h$vDH)~NW6OpJibewBdWk}E*+m|~g zFKfkAkH0o7@`SznE~00k&qUe#hyBNu?`Y9Ij}+Kz&Ogo05^asMey_dtmT0dbPLiYV zh)&W=3j+68?*^R~mgIJY_=k<%U2CtK&Galbw#kx`cbjbO76~}DgRxi}t?~p< zs%&IU8JL|m@hxfFS?7Iiv%Qp0TDG%y$xg0Uso7U4sgZ^EW87}SQfz`=x}V`4|1h_L zyGJ4<3rkI=L!4_-a9)Vf4ZG+z;oysC(?~{aqAPQeIWpiA$Zr5@#paH=gvHOg+mEX?FOL zQFhjd>(_sTY>p;cjD9c~ zh&C+DK!q;0Ii4_a40d!ID|~9R>cktnb^h~x*31)SXM4vcNZ*RZ*LoKH*%e&qjKHo* zlJpLwt~&9Fez|gI&N74LlFHY|+>u5P-Rt#>Dzb`NKTy?#=(4PJHu+oftBczkxpj)N zSH@VZzR{Uppt$@ycc=_d6kl=70WIt2ESGd~dkM=!4wYLVL9N-57+bmSs<)|-aH4Q{>vcPTX%&mI*?lO!nAYpN;B$4>E}X>9*@0PY zP3!!yULm2!&dX$em}=)@dep@(+BD29dXG(jsX3wU;g8WVbWU+?T+`QkwdY!%1c^-T zbbj3P*-C<2KAgoV8`R3_)>lkkkWQ|)N*T&(bhk6P>_Mt!_rCx`)@*TZ+Tf;EN(!azTkUt-6^ZVTFqW zd$qhKBK;!Ml*U!7khU>0y$cv*a{S9)#@&^S?aR+sm8b&hXQY#m<0o&a=Vh7EY1ZC>WOLP#!*N^GX;? zY|T(8Lqw3YGPHY?B_=YZT9OT7TUT;xe=rx-H1A(jm6EmlLBPBMWh)YrOtSKT1CtECf?3fMGSc`q2llJVOEw@;M@&<9Z&s1UY*%(ryIddXa zL0f9(+Y6QXi0BedoBf4%@tcIA(vREZJ-oo}_{^}o{g`w5ih5q1ebJ-Ob{Fhm9PBJv863XHy^T; zUr|rHlfC7JsVsM|F4paUTtSv=lfF;U?fJAVj}iJ6&8oFG^ZIq1j(-V1kRQ-fFhs`< zU{kmQuIuZxU#mHefGpoc)~fvR0A1xbOu};GkI~iB6_(euQGNtwINd#>`Mm$y$|38$ z6Czu>^=}8{wrp(QR9KsN_xYJ2=wDU+*6TgRO-FqF?hUF$YH}AYe5Nru5*;ry$ZHXa zahw>#cV|%1+cQxY%G?;qDHeFs$edI6O8fm7c z7IbgRwR2T(w@tg}dt{L6m|4f~!(eMC?9yEx`q=&@-7(Fc3o2CbWxiES} zf;XPv*%ybMb7L)AyF)r4C0}tX!Ak?=4tk0+N% zz~TjTM3_j%r^5g+WDmoH!oR8qiFo+Imply;h!`08#}fmI0EYjJ2sjdiyW-Q~i6DP_ zAQ=mD`TlMX?jM5zK^zREgJ1tE2EYQp34gwc!4crgv^+Wt5s%|{0U~ZeSD$%xAOOH5 zK)zfi^)&yx!RM1f&~a`C?x^V5GU0U8zlWT+N_afc@ezYZY5C`O)+ zp%E6CtXLv|{k>y20R%}*0sEm<1+&t48zce(7Q)j*ut2iF8G|@144C6-56Xo>XwVBH z(fz%40UQn{I`RlXkW3P=6_WAmpj?5O4&ZSlfnma9c#DSp2XP=w80G00z=Ifm7XT6- z#@q4ep#4d}84!p6eTn@{fO27sCQmL7Adr~+)_`~bg4^*5K^#$_7{~++zcWz3WPu^U ze2!;M3SI`+OnQym+{0H$MS-=G{L12vW z1ZdXqIRov~Wd7L?EktNh^EwD^q5?xqgdQghlL&dn1cZi;-&T--`?*&`!e4HIko)|d zfFw{*2W@8jMU!v@+~0jLq1k_cL4$ti&VcBqs%R&_2rpG={h=L$gCRyL{QDnOv=!Yu zSQVNS5Z@JTWufY32#`SvnSv(*=2)_s8N~tveeMBd=o8VLM6sYyNXGwPu?MEFh8_49 Xjd9>G!^;~> setpagedevice %%EndFeature %%IncludeResource: font Times-Roman -%%IncludeResource: font Times-Italic %%IncludeResource: font Times-Bold %%IncludeResource: font Courier-Bold %%IncludeResource: font Courier-Oblique %%IncludeResource: font Courier %%IncludeResource: font Symbol +%%IncludeResource: font Times-Italic grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72 def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef @@ -267,943 +267,562 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis /eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash /ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis]def -/Courier@0 ENC0/Courier RE/Courier-Oblique@0 ENC0/Courier-Oblique RE -/Courier-Bold@0 ENC0/Courier-Bold RE/Times-Bold@0 ENC0/Times-Bold RE -/Times-Italic@0 ENC0/Times-Italic RE/Times-Roman@0 ENC0/Times-Roman RE +/Times-Italic@0 ENC0/Times-Italic RE/Courier@0 ENC0/Courier RE +/Courier-Oblique@0 ENC0/Courier-Oblique RE/Courier-Bold@0 ENC0 +/Courier-Bold RE/Times-Bold@0 ENC0/Times-Bold RE/Times-Roman@0 ENC0 +/Times-Roman RE %%EndSetup %%Page: 1 1 %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Roman@0 SF 4.998( 504 Gate)72 12 R -.1 -(wa)-.25 G 7.498(yT).1 G 4.998 -(ime-out

504 Gate)-7.848 F -.1(wa)-.25 -G 7.497(yT).1 G(ime-)-7.847 E -(out

nginx
)72 24 Q/F1 -10/Times-Italic@0 SF(ZFS-FIDO2-ADD-B)72 72 Q -.3(AC)-.25 G(KUP).3 E F0 -44.693(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G(anual)-2.5 E F1 -(ZFS-FIDO2-ADD-B)44.692 E -.3(AC)-.25 G(KUP).3 E F0(\(8\))A/F2 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E F0 -(zfs-\214do2-add-backup \212 allo)108 96 Q 2.5(wa)-.25 G -(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F2(SYNOPSIS)72 -112.8 Q/F3 10/Courier-Bold@0 SF(zfs-fido2-add-backup)108 124.8 Q/F4 10 -/Courier-Oblique@0 SF(dataset)2.5 E F2(DESCRIPTION)72 141.6 Q F0(After) -108 153.6 Q F1(zfs-\214do2-c)11.008 E(hang)-.15 E(e-k)-.1 E -.3(ey)-.1 G -F0 8.508(\(8\) deri).3 F -.15(ve)-.25 G 11.008(st).15 G 8.508(he k) --11.008 F 8.809 -.15(ey f)-.1 H 8.509(or a dataset from a FIDO2 de).15 F -(vice,)-.25 E F3(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15 -(xe)-.15 G(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G -(umber of additional de)-2.5 E(vices.)-.25 E .479(First, the wrapping k) -108 182.4 R .779 -.15(ey i)-.1 H 2.979(se).15 G .479 -(xtracted as normally during)-3.129 F F1(zfs-\214do2-load-k)2.979 E -.3 -(ey)-.1 G F0 .479(\(8\), then a credential is made).3 F .571 -(as-if during)108 194.4 R F1(zfs-\214do2-c)3.072 E(hang)-.15 E(e-k)-.1 E --.3(ey)-.1 G F0 .572(\(8\) \(e).3 F .572(xcept the "primary" de)-.15 F -.572(vice and all the ones holding backups are)-.25 F -.15(ex)108 206.4 -S 5.3(cluded from the search\); ho).15 F(we)-.25 E -.15(ve)-.25 G 6.1 --.4(r, t).15 H(he).4 E/F5 10/Courier@0 SF(hmac-secret)7.8 E F0 5.299 -(is instead used as a symmetric)7.8 F(AES-256-GCM \()108 218.4 Q F1 -(EVP_CIPHER-AES)A F0(\(7ssl\)\) k)A .3 -.15(ey t)-.1 H 2.5(oe).15 G -(ncrypt the wrapping k)-2.5 E .3 -.15(ey d)-.1 H -(irectly with a random IV).15 E(.)-1.29 E(This turns the)108 235.2 Q F5 -(xyz.nabijaczleweli:tzpfms.key)2.5 E F0 -.25(va)2.5 G(riable into).25 E -F4(salt)108 247.2 Q F5(:)A F4(credential-ID)A F5(:)A F4 -(credential-public-key)A F0([)A F5(.)A F4(backup-salt)A F5(:)A F4 -(backup-credential-ID)108 259.2 Q F5(:)A F4 -(backup-credential-public-key)A F5(:)A F4(IV)A F5(:)A F4(encrypted-key)A -F0 1.666(]...)C F5(tzpfms.key)108 276 Q F0 2.238 -(is actually a dot-separated list of de)4.738 F 2.238(vice b)-.25 F -4.738(undles. The)-.2 F 2.239(\214rst one is as-described in)4.738 F F1 -(zfs-\214do2-c)108 288 Q(hang)-.15 E(e-k)-.1 E -.3(ey)-.1 G F0 2.5 -(\(8\). Subsequent).3 F -(ones also include \(identically-encoded\) IVs and encrypted blobs.)2.5 -E F1(zfs-\214do2-load-k)108 304.8 Q -.3(ey)-.1 G F0 .775 -(\(8\) shops assertions around de).3 F .775(vices in a de)-.25 F .774 -(vice-major order \212 depending on de)-.25 F(vice)-.25 E -(numbering, a backup may be loaded e)108 316.8 Q -.15(ve)-.25 G 2.5(ni) -.15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.)-.25 E F2 -(ENVIR)72 333.6 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F5 -(TZPFMS_PASSPHRASE_HELPER)108 345.6 Q F0 .045(By def)133 357.6 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.046 E F5(TZPFMS_PASSPHRASE_HELPER)133 369.6 -Q F0 .896(is set and nonempty)3.397 F 3.396(,i)-.65 G 3.396(tw)-3.396 G -.896(ill be run via)-3.396 F F1(/bin/)3.396 E F3(sh)A F58.562 E F0 -.896(to pro-)3.396 F(vide each passphrase, instead.)133 381.6 Q .643 -(The standard output stream of the helper is tied to an anon)133 398.4 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 410.4 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 422.4 Q F0 -(Pre-formatted noun phrase with all the information belo)160 422.4 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F5($2)143 434.4 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 434.4 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F5($3)143 446.4 Q F0("ne)160 -446.4 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F5($4)143 458.4 Q F0("ag)160 458.4 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 475.2 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F2(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -487.2 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F2 1.666 -(FIDO2 back-end con\214guration)72 504 R(En)87 516 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F5(FIDO_DEBUG)108 528 Q F0 -(If set, enables lib\214do2 deb)173 528 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 544.8 Q .625 -(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 556.8 R -.726(vice which supports the)-.25 F F5(hmac-secret)3.227 E F0 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion is shopped around to e)108 568.8 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 585.6 R F0 -(The lib\214do2 documentation at https://de)108 597.6 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 614.4 R -F0 1.6 -.8(To a)108 626.4 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F2<83>128 638.4 Q F0(ThePhD)7.5 E F2<83> -128 650.4 Q F0(Embark Studios)7.5 E F2<83>128 662.4 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F2<83>128 674.4 Q F0(EvModder)7.5 E F2(REPOR)72 691.2 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 703.2 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1(\001nabijaczle)108 720 -Q(weli/tzpfms@lists.sr)-.15 E(.ht)-1.11 E F0 2.5(,a)C(rchi)-2.5 E -.15 -(ve)-.25 G 2.5(da).15 G 2.5(th)-2.5 G(ttps://lists.sr)-2.5 E -(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 817.889 Q -(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 2 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-FIDO2-CHANGE-KEY)72 48 Q/F1 10 -/Times-Roman@0 SF 45.243(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G -(anual)-2.5 E F0(ZFS-FIDO2-CHANGE-KEY)45.242 E F1(\(8\))A/F2 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E F1(zfs-\214do2-change-k)108 96 Q -.3 -.15(ey \212 c)-.1 H(hange ZFS dataset k).15 E .3 -.15(ey t)-.1 H 2.5 -(oo).15 G(ne authenticated by a FIDO2 de)-2.5 E(vice)-.25 E F2(SYNOPSIS) -72 112.8 Q/F3 10/Courier-Bold@0 SF(zfs-fido2-add-backup)108 124.8 Q F1 -([)2.5 E/F4 10/Courier@0 SF1.666 E/F5 10/Courier-Oblique@0 SF -(backup-file)6 E F1(])A F5(dataset)2.5 E F2(DESCRIPTION)72 141.6 Q F1 -2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F5(dataset)3.767 E F1 -(,)A F3(zfs-fido2-add-backup)3.766 E F1 1.266 -(will open its encryption root in its stead.)3.766 F F3 -(zfs-fido2-add-backup)108 165.6 Q F1(will)3.514 E F0(ne)3.514 E(ver)-.15 -E F1 1.014(create or destro)3.514 F 3.515(ye)-.1 G 1.015 -(ncryption roots; use)-3.515 F F0(zfs-c)3.515 E(hang)-.15 E(e-k)-.1 E --.3(ey)-.1 G F1 1.015(\(8\) for).3 F(that.)108 177.6 Q -(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) --.25 E F0(must)2.5 E F1(support the)2.5 E F4(hmac-secret)2.5 E F1 -.15 -(ex)2.5 G(tension.).15 E(If)108 211.2 Q F5(dataset)3.244 E F1 -.1(wa) -3.244 G 3.244(sp).1 G(re)-3.244 E .743(viously encrypted with)-.25 F F3 -(fzifdso)3.243 E F1 .743(and the)3.243 F F2(FIDO2)3.243 E F1 .743 -(back-end w)3.243 F .743(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 -(Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 -(ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.465(xt, a ne)-.15 F 2.965(wc)-.25 G .465 -(redential of type ES256 is generated on the de)-2.965 F .464 -(vice \(with relying party ID)-.25 F F4(fzifdso)2.964 E F1(and)2.964 E -.499(name equal to the dataset name\) with the)108 264 R F4(hmac-secret) -2.999 E F1 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 -(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 276 Q -(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ -n, the credential is asserted with a 32-byte random salt, which hashes \ -it with de)108 292.8 R(vice-pri)-.25 E -.25(va)-.25 G .962(te data,).25 -F .208(and thus generates the wrapping k)108 304.8 R .508 -.15(ey \()-.1 -H .208(which is optionally back).15 F .208 -(ed up \(see \231OPTIONS\232\)\).)-.1 F .209(This mimicks)5.209 F 2.5 -(aW)108 316.8 S(ebAuthn login step.)-3.3 E(The follo)108 333.6 Q -(wing properties are set on)-.25 E F5(dataset)2.5 E F1(:)A F2<83>128 -345.6 Q F4(xyz.nabijaczleweli:tzpfms.backend)7.5 E F1(=)A F2(FIDO2)A<83> -128 357.6 Q F4(xyz.nabijaczleweli:tzpfms.key)7.5 E F1(=)A F5(salt)A F4 -(:)A F5(credential-ID)A F4(:)A F5(credential-public-key)139 369.6 Q F1 -([)A F4(.)A F1 1.666(...)1.666 G 1.666(]...)-1.666 G F4(tzpfms.backend) -108 386.4 Q F1 2.708(identi\214es this dataset for w)5.208 F 2.707 -(ork with)-.1 F F2(FIDO2)5.207 E F1(-back-ended)A F3(tzpfms)5.207 E F1 -2.707(tools \(i.e.)5.207 F F3(fzifdso)108 398.4 Q F0(zfs-\214do2-c) -22.318 E(hang)-.15 E(e-k)-.1 E -.3(ey)-.1 G F1(\(8\),).3 E F0 -(zfs-\214do2-load-k)18.819 E -.3(ey)-.1 G F1(\(8\),).3 E F0 -(zfs-\214do2-add-bac)18.819 E(kup)-.2 E F1 16.319(\(8\), and)B F0 -(zfs-\214do2-clear)108 410.4 Q(-k)-.2 E -.3(ey)-.1 G F1(\(8\)\).).3 E F4 -(tzpfms.key)108 427.2 Q F1 .486(is a colon-separated tuple of unpadded \ -URL-safe base64 blobs; the \214rst one is the ran-)2.986 F .217(dom sal\ -t; the second represents the ID of created credential, and the third \ -\211 its public k)108 439.2 R -.15(ey)-.1 G 5.217(.T)-.5 G .217(here e) --5.217 F(xists)-.15 E(no other user)108 451.2 Q -(-land tool for deciphering this; perhaps there should be.)-.2 E -(Finally)108 468 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 -G 9.506(lent of).25 F F3(zfs)12.005 E F4 11.171(change-key \255o)15.505 -F 11.171(keylocation=prompt \255o)15.505 F(keyformat=raw)108 480 Q F5 -(dataset)6.106 E F1 .106(is performed with the ne)2.606 F 2.606(wk)-.25 -G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G -.107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F -(to clean up the properties, or to issue a note for manual interv)108 -492 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 508.8 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F3(zfs-fido2-load-key)4.056 E F49.222 E F5(dataset)7.555 E -F1 6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 520.8 R .729 -(ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 532.8 Q F3(zfs-fido2-clear-key)5.147 E F5(dataset)8.647 E -F1(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F3(zfs)5.146 E F4 4.312 -(change-key \255o)8.646 F(keyformat=passphrase)108 544.8 Q F5(dataset)6 -E F1(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 -E F3(zfs-fido2-clear-key)108 561.6 Q F5(dataset)7.606 E F1 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 573.6 Q F2(OPTIONS)72 590.4 Q F4109.666 602.4 Q -F5(backup-file)6 E F1(Sa)203 602.4 Q .353 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F5(backup-file)2.552 -E F1 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 614.4 R F0(must)3.193 E F1 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 626.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F3(zfs)233 638.4 Q F4(load-key)6 E F5(dataset)6 E F4(<)6 E F5 -(backup-file)6 E F2(ENVIR)72 655.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 -E F4(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q F1 .046(By def)133 679.2 R -.045(ault, passphrases are prompted for and read in on the standard out\ -put and input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 -691.2 Q F1 .896(is set and nonempty)3.396 F 3.396(,i)-.65 G 3.396(tw) --3.396 G .896(ill be run via)-3.396 F F0(/bin/)3.396 E F3(sh)A F4 -8.562 E F1 .897(to pro-)3.396 F(vide each passphrase, instead.)133 703.2 -Q .643(The standard output stream of the helper is tied to an anon)133 -720 R .643(ymous \214le and used in its entirety as)-.15 F -(the passphrase, e)133 732 Q(xcept for a trailing ne)-.15 E -(w-line, if an)-.25 E 3.8 -.65(y. T)-.15 H(he ar).65 E(guments are:)-.18 -E F4($1)143 744 Q F1 -(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E(fzifdso 0)72 817.889 Q -(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 2 3 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-FIDO2-CHANGE-KEY)72 48 Q/F1 10 -/Times-Roman@0 SF 45.243(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G -(anual)-2.5 E F0(ZFS-FIDO2-CHANGE-KEY)45.242 E F1(\(8\))A/F2 10 -/Courier@0 SF($2)143 84 Q F1 -(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F2($3)143 96 Q F1("ne)160 96 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F2($4)143 108 Q F1("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 124.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F3 10/Times-Bold@0 SF -(127)2.677 E F1 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F3 -1.666(FIDO2 back-end con\214guration)72 153.6 R(En)87 165.6 Q(vir)-.4 E -.625(onment v)-.18 F(ariables)-.1 E F2(FIDO_DEBUG)108 177.6 Q F1 -(If set, enables lib\214do2 deb)173 177.6 Q -(ug logging to the standard error stream.)-.2 E F3(De)87 194.4 Q .625 -(vice selection)-.15 F F1 .727(When creating, the \214rst de)108 206.4 R -.727(vice which supports the)-.25 F F2(hmac-secret)3.226 E F1 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 218.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F3 .625(See also)87 235.2 R F1 -(The lib\214do2 documentation at https://de)108 247.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F3 1.666(SPECIAL THANKS)72 264 R -F1 1.6 -.8(To a)108 276 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F3<83>128 288 Q F1(ThePhD)7.5 E F3<83>128 -300 Q F1(Embark Studios)7.5 E F3<83>128 312 Q F1(Jasper Bekk)7.5 E(ers) --.1 E F3<83>128 324 Q F1(EvModder)7.5 E F3(REPOR)72 340.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F1(https://todo.sr)108 352.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F0(\001nabijaczle)108 -369.6 Q(weli/tzpfms@lists.sr)-.15 E(.ht)-1.11 E F1 2.5(,a)C(rchi)-2.5 E --.15(ve)-.25 G 2.5(da).15 G 2.5(th)-2.5 G(ttps://lists.sr)-2.5 E -(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 817.889 Q -(February 29, 2024)153.568 E(2)183.837 E 0 Cg EP -%%Page: 1 4 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-FIDO2-CLEAR-KEY)72 48 Q/F1 10/Times-Roman@0 -SF 54.683(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G(anual)-2.5 E F0 -(ZFS-FIDO2-CLEAR-KEY)54.682 E F1(\(8\))A/F2 10/Times-Bold@0 SF -.2(NA)72 -84 S(ME).2 E F1(zfs-\214do2-clear)108 96 Q(-k)-.2 E .3 -.15(ey \212 r) --.1 H -.25(ew).15 G(rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np) -.15 G(asssw)-2.5 E(ord and clear tzpfms FIDO2 metadata)-.1 E F2 -(SYNOPSIS)72 112.8 Q/F3 10/Courier-Bold@0 SF(zfs-fido2-add-backup)108 -124.8 Q/F4 10/Courier-Oblique@0 SF(dataset)2.5 E F2(DESCRIPTION)72 141.6 -Q F1(After v)108 153.6 Q(erifying)-.15 E F4(dataset)2.5 E F1 -.1(wa)2.5 -G 2.5(se).1 G(ncrypted with)-2.5 E F3(tzpfms)2.5 E F1(back)2.5 E(end)-.1 -E F2(FIDO2)2.5 E F1(:)A 5(1. performs)118 165.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F3(zfs)8.142 E/F5 10/Courier@0 SF -7.308(change-key \255o)11.642 F 7.308(keylocation=prompt \255o)11.642 F -(keyformat=passphrase)133 177.6 Q F4(dataset)6 E F1(,)A 5(2. remo)118 -189.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F5 -(xyz.nabijaczleweli:tzpfms.)10.689 E F1({)A F5(backend)A F1(,)A F5(key) -14.189 E F1 10.689(}p)C 8.189(roperties from)-10.689 F F4(dataset)133 -201.6 Q F1(.)A(See)108 218.4 Q F0(zfs-\214do2-c)2.5 E(hang)-.15 E(e-k) --.1 E -.3(ey)-.1 G F1(\(8\) for a detailed description.).3 E F2(ENVIR)72 -235.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F5 -(TZPFMS_PASSPHRASE_HELPER)108 247.2 Q F1 .045(By def)133 259.2 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.046 E F5(TZPFMS_PASSPHRASE_HELPER)133 271.2 -Q F1 .896(is set and nonempty)3.397 F 3.396(,i)-.65 G 3.396(tw)-3.396 G -.896(ill be run via)-3.396 F F0(/bin/)3.396 E F3(sh)A F58.562 E F1 -.896(to pro-)3.396 F(vide each passphrase, instead.)133 283.2 Q .643 -(The standard output stream of the helper is tied to an anon)133 300 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 312 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 324 Q F1 -(Pre-formatted noun phrase with all the information belo)160 324 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F5($2)143 336 Q F1 -(Either the dataset name or the element of the TPM hierarch)160 336 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F5($3)143 348 Q F1("ne)160 348 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F5($4)143 360 Q F1("ag)160 360 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 376.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F2(127)2.677 E F1 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -388.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F2 1.666 -(FIDO2 back-end con\214guration)72 405.6 R(En)87 417.6 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F5(FIDO_DEBUG)108 429.6 Q F1 -(If set, enables lib\214do2 deb)173 429.6 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 446.4 Q .625 -(vice selection)-.15 F F1 .726(When creating, the \214rst de)108 458.4 R -.726(vice which supports the)-.25 F F5(hmac-secret)3.227 E F1 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion is shopped around to e)108 470.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 487.2 R F1 -(The lib\214do2 documentation at https://de)108 499.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 516 R -F1 1.6 -.8(To a)108 528 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F2<83>128 540 Q F1(ThePhD)7.5 E F2<83>128 -552 Q F1(Embark Studios)7.5 E F2<83>128 564 Q F1(Jasper Bekk)7.5 E(ers) --.1 E F2<83>128 576 Q F1(EvModder)7.5 E F2(REPOR)72 592.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F1(https://todo.sr)108 604.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F0(\001nabijaczle)108 -621.6 Q(weli/tzpfms@lists.sr)-.15 E(.ht)-1.11 E F1 2.5(,a)C(rchi)-2.5 E --.15(ve)-.25 G 2.5(da).15 G 2.5(th)-2.5 G(ttps://lists.sr)-2.5 E -(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 817.889 Q -(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 5 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-FIDO2-LO)72 48 Q(AD-KEY)-.55 E/F1 10 -/Times-Roman@0 SF 59.683(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G -(anual)-2.5 E F0(ZFS-FIDO2-LO)59.682 E(AD-KEY)-.55 E F1(\(8\))A/F2 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E F1(zfs-\214do2-load-k)108 96 Q -.3 -.15(ey \212 l)-.1 H(oad FIDO2-encrypted ZFS dataset k).15 E -.15(ey) --.1 G F2(SYNOPSIS)72 112.8 Q/F3 10/Courier-Bold@0 SF -(zfs-fido2-add-backup)108 124.8 Q F1([)2.5 E/F4 10/Courier@0 SF -1.666 E F1(])A/F5 10/Courier-Oblique@0 SF(dataset)2.5 E F2(DESCRIPTION) -72 141.6 Q F1 1.142(After v)108 153.6 R(erifying)-.15 E F5(dataset)3.642 -E F1 -.1(wa)3.642 G 3.641(se).1 G 1.141(ncrypted with)-3.641 F F3 -(tzpfms)3.641 E F1(back)3.641 E(end)-.1 E F2(FIDO2)3.641 E F1 3.641(,a)C -1.141(sserts the preserv)-3.641 F 1.141(ed chal-)-.15 F(lenge, HMA)108 -165.6 Q(Cking the salt with the on-de)-.4 E -(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) -.15 E F5(dataset)2.5 E F1(.)A(See)108 182.4 Q F0(zfs-\214do2-c)2.5 E -(hang)-.15 E(e-k)-.1 E -.3(ey)-.1 G F1 -(\(8\) for a detailed description.).3 E F2(OPTIONS)72 199.2 Q F4 -109.666 211.2 Q F1 3.208(Do a no-op/dry run, can be used e)131 211.2 R --.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F -3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) -8.208 E -.25(va)-.25 G 3.208(lent to).25 F F3(zfs)5.708 E F4(load-key) -131 223.2 Q F1 -.55('s)C F44.716 E F1(option.)2.5 E F2(ENVIR)72 -240 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER) -108 252 Q F1 .046(By def)133 264 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.045 -E F4(TZPFMS_PASSPHRASE_HELPER)133 276 Q F1 .896(is set and nonempty) -3.396 F 3.396(,i)-.65 G 3.396(tw)-3.396 G .896(ill be run via)-3.396 F -F0(/bin/)3.396 E F3(sh)A F48.562 E F1 .897(to pro-)3.396 F -(vide each passphrase, instead.)133 288 Q .643 -(The standard output stream of the helper is tied to an anon)133 304.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F1 -(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F1 -(Either the dataset name or the element of the TPM hierarch)160 340.8 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 352.8 Q F1("ne)160 -352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F1("ag)160 364.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 381.6 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F2(127)2.677 E F1 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F2 1.666(SPECIAL THANKS) -72 410.4 R F1 1.6 -.8(To a)108 422.4 T(ll who support further de).8 E --.15(ve)-.25 G(lopment, in particular:).15 E F2<83>128 434.4 Q F1 -(ThePhD)7.5 E F2<83>128 446.4 Q F1(Embark Studios)7.5 E F2<83>128 458.4 -Q F1(Jasper Bekk)7.5 E(ers)-.1 E F2<83>128 470.4 Q F1(EvModder)7.5 E F2 -(REPOR)72 487.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F1(https://todo.sr)108 -499.2 Q(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F0(\001nabijaczle) -108 516 Q(weli/tzpfms@lists.sr)-.15 E(.ht)-1.11 E F1 2.5(,a)C(rchi)-2.5 -E -.15(ve)-.25 G 2.5(da).15 G 2.5(th)-2.5 G(ttps://lists.sr)-2.5 E -(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 817.889 Q -(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 6 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-TPM-LIST)72 48 Q/F1 10/Times-Roman@0 SF -96.343(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G(anual)-2.5 E F0 -(ZFS-TPM-LIST)96.342 E F1(\(8\))A/F2 10/Times-Bold@0 SF -.2(NA)72 84 S -(ME).2 E F1(zfs-tpm-list \212 print dataset tzpfms metadata)108 96 Q F2 -(SYNOPSIS)72 112.8 Q/F3 10/Courier-Bold@0 SF(zfs-fido2-add-backup)108 -124.8 Q F1([)2.5 E/F4 10/Courier@0 SF1.666 E F1 2.5(][)C F4 --.834 E F1(|)A F41.666 E/F5 10/Courier-Oblique@0 SF(depth)6 E F1 -2.5(][)C F4-.834 E F1(|)A F41.666 E F5(back-end)6 E F1 2.5 -(][)C F4-.834 E F1(|)A F41.666 E F1(])A([)234 136.8 Q F5 -(filesystem)A F1(|)A F5(volume)A F1 1.666(]...)C F2(DESCRIPTION)72 153.6 -Q F1(Lists the follo)108 165.6 Q(wing properties on encryption roots:) --.25 E F4(name)128 177.6 Q(back-end)128 189.6 Q F1(the)187 189.6 Q F3 -(tzpfms)4.897 E F1 2.396(back-end \(e.g.)4.896 F F2(TPM2)4.896 E F1(for) -4.896 E F0(zfs-tpm2-c)4.896 E(hang)-.15 E(e-k)-.1 E -.3(ey)-.1 G F1 -2.396(\(8\) or).3 F F2(TPM1.X)4.896 E F1(for)4.896 E F0(zfs-tpm1x-c)187 -201.6 Q(hang)-.15 E(e-k)-.1 E -.3(ey)-.1 G F1(\(8\)\), or ").3 E F2(-)A -F1 2.5("i)C 2.5(fn)-2.5 G(one is con\214gured)-2.5 E F4(keystatus)128 -213.6 Q F2 -2.1 -.25(av a)187 213.6 T(ilable).25 E F1(or)2.5 E F2(una) -2.5 E -.1(va)-.25 G(ilable).1 E F4(coherent)128 225.6 Q F2 -.1(ye)187 -225.6 S(s).1 E F1 10.289(if either both)12.789 F F4 -(xyz.nabijaczleweli:tzpfms.backend)12.789 E F1(and)12.789 E F4 -(xyz.nabijaczleweli:tzpfms.key)187 237.6 Q F1(are present or missing,) -2.5 E F2(no)2.5 E F1(otherwise)2.5 E 8.743(Incoherent datasets require \ -immediate operator attention, with either the appropriate)108 254.4 R F3 -(zfs-tpm)108 266.4 Q/F6 10/Symbol SF(*)A F3(-clear-key)A F1 1.778 -(program or)4.277 F F3(zfs)4.278 E F4(change-key)7.778 E F1(and)4.278 E -F3(zfs)4.278 E F4(inherit)7.778 E F1 4.278<8a69>4.278 G 4.278(ft)-4.278 -G 1.778(he k)-4.278 F 2.078 -.15(ey b)-.1 H(e-).15 E .566 -(comes unloaded, the)108 278.4 R 3.066(yw)-.15 G .566 -(ill require restoration from back-up.)-3.066 F(Ho)5.566 E(we)-.25 E --.15(ve)-.25 G 1.366 -.4(r, t).15 H .566(his should ne).4 F -.15(ve)-.25 -G 3.065(ro).15 G(ccur)-3.065 E 3.065(,u)-.4 G(nless)-3.065 E +/F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 +10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF +(zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 +/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q +(wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 +177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 +.478(back-end \(e.g.)2.978 F F1(TPM2)2.978 E F0(for)2.978 E F4 +(zfs-tpm2-change-key)2.978 E F0 .478(\(8\) or)B F1(TPM1.X)2.978 E F0 +(for)187 201.6 Q F4(zfs-tpm1x-change-key)2.5 E F0(\(8\)\), or ")A F1(-)A +F0 2.5("i)C 2.5(fn)-2.5 G(one is con\214gured)-2.5 E F4(keystatus)128 +213.6 Q F1 -2.1 -.25(av a)187 213.6 T(ilable).25 E F0(or)2.5 E F1(una) +2.5 E -.1(va)-.25 G(ilable).1 E F4(coherent)128 225.6 Q F1 -.1(ye)187 +225.6 S(s).1 E F0 10.289(if either both)12.789 F F4 +(xyz.nabijaczleweli:tzpfms.backend)12.789 E F0(and)12.789 E F4 +(xyz.nabijaczleweli:tzpfms.key)187 237.6 Q F0(are present or missing,) +2.5 E F1(no)2.5 E F0(otherwise)2.5 E 8.743(Incoherent datasets require \ +immediate operator attention, with either the appropriate)108 254.4 R F2 +(zfs-tpm)108 266.4 Q/F5 10/Symbol SF(*)A F2(-clear-key)A F0 1.778 +(program or)4.277 F F2 1.778(zfs change-key)4.278 F F0(and)4.278 E F2 +1.778(zfs inherit)4.278 F F0 4.278<8a69>4.278 G 4.278(ft)-4.278 G 1.778 +(he k)-4.278 F 2.078 -.15(ey b)-.1 H(e-).15 E .566(comes unloaded, the) +108 278.4 R 3.066(yw)-.15 G .566(ill require restoration from back-up.) +-3.066 F(Ho)5.566 E(we)-.25 E -.15(ve)-.25 G 1.366 -.4(r, t).15 H .566 +(his should ne).4 F -.15(ve)-.25 G 3.065(ro).15 G(ccur)-3.065 E 3.065 +(,u)-.4 G(nless)-3.065 E (something went horribly wrong with the dataset properties.)108 290.4 Q .965(If no datasets are speci\214ed, all matching encryption roots are \ -listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F3 -(tzpfms)108 319.2 Q F1(.)A F2(OPTIONS)72 336 Q F4109.666 348 Q F1 +listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 +(tzpfms)108 319.2 Q F0(.)A F1(OPTIONS)72 336 Q F2109.666 348 Q F0 1.583(Scripting mode \212 remo)185 348 R 1.883 -.15(ve h)-.15 H 1.583 (eaders and separate \214elds by a single tab instead of).15 F -(columnating them with spaces.)185 360 Q F4109.666 376.8 Q F1 -(Recurse into all descendants of speci\214ed datasets.)185 376.8 Q F4 -109.666 388.8 Q F5(depth)6 E F1(Recurse at most)185 388.8 Q F5 -(depth)2.5 E F1(datasets deep.)2.5 E(Def)5 E(ault:)-.1 E F2(0)2.5 E F1 -(.)A F4109.666 405.6 Q F1(List all encryption roots, e)185 405.6 Q --.15(ve)-.25 G 2.5(no).15 G(nes not managed by)-2.5 E F3(tzpfms)2.5 E F1 -(.)A F4109.666 417.6 Q F5(back-end)6 E F1 -(List only encryption roots with the speci\214ed)185 417.6 Q F3(tzpfms) -2.5 E F5(back-end)2.5 E F1(.)A F4109.666 434.4 Q F1 +(columnating them with spaces.)185 360 Q F2109.666 376.8 Q F0 +(Recurse into all descendants of speci\214ed datasets.)185 376.8 Q F2 +109.666 388.8 Q F3(depth)6 E F0(Recurse at most)185 388.8 Q F3 +(depth)2.5 E F0(datasets deep.)2.5 E(Def)5 E(ault:)-.1 E F1(0)2.5 E F0 +(.)A F2109.666 405.6 Q F0(List all encryption roots, e)185 405.6 Q +-.15(ve)-.25 G 2.5(no).15 G(nes not managed by)-2.5 E F2(tzpfms)2.5 E F0 +(.)A F2109.666 417.6 Q F3(back-end)6 E F0 +(List only encryption roots with the speci\214ed)185 417.6 Q F2(tzpfms) +2.5 E F3(back-end)2.5 E F0(.)A F2109.666 434.4 Q F0 (List only encryption roots whose k)185 434.4 Q -.15(ey)-.1 G 2.5(sa).15 -G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F4109.666 446.4 Q F1 +G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 -G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F2(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F3(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R -18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) +108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 +(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F3(zfs-fido2-add-backup)6 E F4 -(\255ad0)7.666 E 24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F -6(filling -)108 559.2 R 6(available yes)54 F($)108 583.2 Q F3 -(zfs-fido2-add-backup)6 E F47.666 E F2(TPM2)6 E F4 72 -(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 -(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F3(zfs-fido2-add-backup)6 E F4(\255ra)7.666 E F5(tarta-zoot)6 E F4 72 -(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 -(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 -(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 -(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) -108 691.2 R 18(available yes)54 F($)108 715.2 Q F3(zfs-fido2-add-backup) -6 E F4(\255al)7.666 E 72(NAME BACK-END)108 727.2 R 6(KEYSTATUS COHERENT) -12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X) -108 751.2 R 6(available yes)24 F 12(tarta-zoot/bkp -)108 763.2 R 6 -(available yes)54 F 18(tarta-zoot/vm -)108 775.2 R 6(available yes)54 F -F1(tzpfms 0.3.4-14-gf5996ad)72 817.889 Q(December 4, 2022)84.693 E(1) -183.842 E 0 Cg EP -%%Page: 2 7 +(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 +24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 +559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 +F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F +6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) +108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R +18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 +(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) +54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q +F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F +36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 +(tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) +108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-18-g1f9fe81)72 817.889 +Q(December 4, 2022)86.363 E(1)183.842 E 0 Cg EP +%%Page: 2 2 %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-TPM-LIST)72 48 Q/F1 10/Times-Roman@0 SF -96.343(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G(anual)-2.5 E F0 -(ZFS-TPM-LIST)96.342 E F1(\(8\))A/F2 10/Times-Bold@0 SF 1.666 -(SPECIAL THANKS)72 84 R F1 1.6 -.8(To a)108 96 T +/F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 +10/Times-Bold@0 SF 1.666(SPECIAL THANKS)72 84 R F0 1.6 -.8(To a)108 96 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 108 Q F1(ThePhD)7.5 E F2<83>128 120 Q F1(Embark Studios) -7.5 E F2<83>128 132 Q F1(Jasper Bekk)7.5 E(ers)-.1 E F2<83>128 144 Q F1 -(EvModder)7.5 E F2(REPOR)72 160.8 Q 1.666(TING B)-.4 F(UGS)-.1 E F1 +.15 E F1<83>128 108 Q F0(ThePhD)7.5 E F1<83>128 120 Q F0(Embark Studios) +7.5 E F1<83>128 132 Q F0(Jasper Bekk)7.5 E(ers)-.1 E F1<83>128 144 Q F0 +(EvModder)7.5 E F1(REPOR)72 160.8 Q 1.666(TING B)-.4 F(UGS)-.1 E F0 (https://todo.sr)108 172.8 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms)-.25 -E F0(\001nabijaczle)108 189.6 Q(weli/tzpfms@lists.sr)-.15 E(.ht)-1.11 E -F1 2.5(,a)C(rchi)-2.5 E -.15(ve)-.25 G 2.5(da).15 G 2.5(th)-2.5 G -(ttps://lists.sr)-2.5 E(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E -(tzpfms 0.3.4-14-gf5996ad)72 817.889 Q(December 4, 2022)84.693 E(2) -183.842 E 0 Cg EP -%%Page: 1 8 +E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +(https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q(December 4, 2022)86.363 E +(2)183.842 E 0 Cg EP +%%Page: 1 3 %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-TPM1X-CHANGE-KEY)72 48 Q/F1 10 -/Times-Roman@0 SF 43.013(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G -(anual)-2.5 E F0(ZFS-TPM1X-CHANGE-KEY)43.012 E F1(\(8\))A/F2 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E F1(zfs-tpm1x-change-k)108 96 Q -.3 -.15(ey \212 c)-.1 H(hange ZFS dataset k).15 E .3 -.15(ey t)-.1 H 2.5 -(oo).15 G(ne stored on the TPM)-2.5 E F2(SYNOPSIS)72 112.8 Q/F3 10 -/Courier-Bold@0 SF(zfs-fido2-add-backup)108 124.8 Q F1([)2.5 E/F4 10 -/Courier@0 SF1.666 E/F5 10/Courier-Oblique@0 SF(backup-file)6 E F1 -2.5(][)C F4-.834 E F5(PCR)6 E F1([)A F4(,)A F5(PCR)A F1 1.666 -(]...)C(])-1.666 E F5(dataset)2.5 E F2(DESCRIPTION)72 141.6 Q F1 2.866 --.8(To n)108 153.6 T 1.266(ormalise the).8 F F5(dataset)3.766 E F1(,)A -F3(zfs-fido2-add-backup)3.766 E F1 1.266 -(will open its encryption root in its stead.)3.766 F F3 -(zfs-fido2-add-backup)108 165.6 Q F1(will)3.515 E F0(ne)3.515 E(ver)-.15 -E F1 1.015(create or destro)3.515 F 3.514(ye)-.1 G 1.014 -(ncryption roots; use)-3.514 F F0(zfs-c)3.514 E(hang)-.15 E(e-k)-.1 E --.3(ey)-.1 G F1 1.014(\(8\) for).3 F(that.)108 177.6 Q -(First, a connection is made to the TPM, which)108 194.4 Q F0(must)2.5 E -F1(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F5(dataset)3.176 E F1 -.1 +/F0 10/Times-Roman@0 SF 36.913(ZFS-TPM1X-CHANGE-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 34.412(anual ZFS-TPM1X-CHANGE-KEY\(8\)) +-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 +SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) +-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 +(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T +5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 +E F0 5.266(will open its encryption root in its stead.)7.766 F F2 +(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E +(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) +-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F -F3(tzpfms)3.176 E F1 .676(and the)3.176 F F2(TPM1.X)3.176 E F1 .676 +F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 +(data will be silently cleared.)108 211.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -1.74(xt, a ne)-.15 F 4.24(ww)-.25 G 1.74(rapping k)-4.24 F 2.04 -.15 -(ey i)-.1 H 4.24(sg).15 G 1.74(enerated on the TPM, optionally back) --4.24 F 1.741(ed up \(see \231OPTIONS\232\), and)-.1 F .294(sealed on t\ -he TPM; the user is prompted for an optional passphrase to protect the \ -k)108 264 R .594 -.15(ey w)-.1 H .294(ith, and for the).15 F -(SRK passphrase, set when taking o)108 276 Q(wnership, if not "well-kno) --.25 E(wn" \(all zeroes\).)-.25 E(The follo)108 292.8 Q -(wing properties are set on)-.25 E F5(dataset)2.5 E F1(:)A F2<83>128 -304.8 Q F4(xyz.nabijaczleweli:tzpfms.backend)7.5 E F1(=)A F2(TPM1.X)A -<83>128 316.8 Q F4(xyz.nabijaczleweli:tzpfms.key)7.5 E F1(=)A F5 -(parent-key-blob)A F4(:)A F5(sealed-object-blob)A F4(tzpfms.backend)108 -333.6 Q F1 .291(identi\214es this dataset for w)2.791 F .292(ork with) --.1 F F2(TPM1.X)2.792 E F1(-back-ended)A F3(tzpfms)2.792 E F1 .292 -(tools \(namely)2.792 F F0(zfs-tpm1x-c)108 345.6 Q(hang)-.15 E(e-k)-.1 E --.3(ey)-.1 G F1(\(8\),).3 E F0(zfs-tpm1x-load-k)2.5 E -.3(ey)-.1 G F1 -(\(8\), and).3 E F0(zfs-tpm1x-clear)2.5 E(-k)-.2 E -.3(ey)-.1 G F1 -(\(8\)\).).3 E F4(tzpfms.key)108 362.4 Q F1 1.412 -(is a colon-separated pair of he)3.913 F 1.412 +(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q +.294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 +(ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) +-2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 +(\), and sealed)B .586(on the TPM; the user is prompted for an optional\ + passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q +(wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) +108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) +108 321.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 +(ork with)-.1 F F1(TPM1.X)2.792 E F0(-back-ended)A F2(tzpfms)2.792 E F0 +.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 333.6 Q F0 +(\(8\),)A F5(zfs-tpm1x-load-key)2.5 E F0(\(8\), and)A F5 +(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 350.4 Q F0 +1.412(is a colon-separated pair of he)3.913 F 1.412 (xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 -(\214rst one represents the RSA k)108 374.4 R 1.167 -.15(ey p)-.1 H .868 +(\214rst one represents the RSA k)108 362.4 R 1.167 -.15(ey p)-.1 H .868 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 386.4 Q 1.414(vided, or the SHA1 constant)-.15 F F4 -(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F1 3.913(;t)C 1.413 +.15 F(pro)108 374.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 +(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 (he sec-)-3.913 F .379 -(ond represents the sealed object containing the wrapping k)108 398.4 R +(ond represents the sealed object containing the wrapping k)108 386.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 -(nd is protected with the SHA1 constant)-2.879 F F4 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F1 6.721(.T)C +(nd is protected with the SHA1 constant)-2.879 F F5 +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 398.4 Q F0 6.721(.T)C 1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 (-land tool for)-.2 F(decrypting this; perhaps there should be.)108 -422.4 Q(Finally)108 439.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F --.25(va)-.25 G 9.505(lent of).25 F F3(zfs)12.005 E F4 11.172 -(change-key \255o)15.505 F 11.172(keylocation=prompt \255o)15.506 F -(keyformat=raw)108 451.2 Q F5(dataset)6.107 E F1 .107 +410.4 Q(Finally)108 427.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F +-.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F +17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 +(keyformat=raw)108 439.2 Q F3(dataset)6.107 E F0 .107 (is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 (.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -463.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 480 +451.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 468 S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) --.15 F F3(zfs-tpm1x-load-key)4.056 E F49.222 E F5(dataset)7.556 E -F1 6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 -(command succeeds, all is well, b)108 492 R .729 +-.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 +6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 +(command succeeds, all is well, b)108 480 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 504 Q F3(zfs-tpm1x-clear-key)5.146 E F5(dataset)8.646 E -F1(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F3(zfs)5.147 E F4 4.313 -(change-key \255o)8.647 F(keyformat=passphrase)108 516 Q F5(dataset)6 E -F1(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F3(zfs-tpm1x-clear-key)108 532.8 Q F5(dataset)7.607 E F1 1.607 +-.2 F(with)108 492 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E +F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F +10.313 E F5(keyformat=passphrase)108 504 Q F3(dataset)6 E F0 +(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E +F2(zfs-tpm1x-clear-key)108 520.8 Q F3(dataset)7.607 E F0 1.607 (can be used to clear the properties and go back to using a)4.107 F -(passphrase.)108 544.8 Q F2(OPTIONS)72 561.6 Q F4109.666 573.6 Q -F5(backup-file)6 E F1(Sa)203 573.6 Q .352 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F5(backup-file)2.552 -E F1 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 585.6 R F0(must)3.194 E F1 .694 +(passphrase.)108 532.8 Q F1(OPTIONS)72 549.6 Q F2109.666 561.6 Q +F3(backup-file)6 E F0(Sa)203 561.6 Q .352 -.15(ve a b)-.2 H .052 +(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 +E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 +F .694(This back-up)203 573.6 R F4(must)3.194 E F0 .694 (be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F3(zfs)233 609.6 Q F4(load-key)6 E F5(dataset)6 E F4(<)6 E F5 -(backup-file)6 E F4109.666 626.4 Q F5(PCR)6 E F1([)A F4(,)A F5 -(PCR)A F1 1.666(]...)C .638(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H -3.139(os).15 G .639(pace- or comma-separated)-3.139 F F5(PCR)3.139 E F1 +(nt,).15 E(the k)203 585.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 597.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 614.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .638(Bind the k)203 614.4 R .939 -.15(ey t)-.1 H +3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 -(hange, the wrap-)-3.139 F .463(ping k)203 638.4 R .763 -.15(ey w)-.1 H +(hange, the wrap-)-3.139 F .463(ping k)203 626.4 R .763 -.15(ey w)-.1 H .463(ill not be able to be unsealed.).15 F .462 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F2(24) -2.5 E F1(\(numbered [)2.5 E F2(0)A F1(,)A F2(23)2.5 E F1 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F2(ENVIR)72 667.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q -F1 .045(By def)133 691.2 R .045(ault, passphrases are prompted for and \ -read in on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F1 .896(is set and nonempty)3.397 -F 3.396(,i)-.65 G 3.396(tw)-3.396 G .896(ill be run via)-3.396 F F0 -(/bin/)3.396 E F3(sh)A F48.562 E F1 .896(to pro-)3.396 F -(vide each passphrase, instead.)133 715.2 Q .643 -(The standard output stream of the helper is tied to an anon)133 732 R +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 638.4 Q F1(24) +2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 655.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q +F0 .045(By def)133 679.2 R .045(ault, passphrases are prompted for and \ +read in on the standard output and input streams.)-.1 F(If)5.046 E F5 +(TZPFMS_PASSPHRASE_HELPER)133 691.2 Q F0 1.596(is set and nonempty)4.096 +F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 703.2 Q +(vide each passphrase, instead.)-.15 E .643 +(The standard output stream of the helper is tied to an anon)133 720 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-14-gf5996ad)72 -817.889 Q(February 28, 2024)84.688 E(1)183.837 E 0 Cg EP -%%Page: 2 9 +133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 +(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E(tzpfms 0.3.4-18-g1f9fe81)72 +817.889 Q(February 28, 2024)86.358 E(1)183.837 E 0 Cg EP +%%Page: 2 4 %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-TPM1X-CHANGE-KEY)72 48 Q/F1 10 -/Times-Roman@0 SF 43.013(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G -(anual)-2.5 E F0(ZFS-TPM1X-CHANGE-KEY)43.012 E F1(\(8\))A/F2 10 -/Courier@0 SF($1)143 84 Q F1 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F2($2)143 96 Q F1 -(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F2($3)143 108 Q F1("ne)160 108 Q +/F0 10/Times-Roman@0 SF 36.913(ZFS-TPM1X-CHANGE-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 34.412(anual ZFS-TPM1X-CHANGE-KEY\(8\)) +-2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F2($4)143 120 Q F1("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G +-2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G (he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 136.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F3 10/Times-Bold@0 SF -(127)2.677 E F1 .177(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F3 -1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 -177.6 R F1(The)108 189.6 Q/F4 10/Courier-Bold@0 SF(tzpfms)2.508 E F1 -.008(suite connects to a local)2.508 F F0(tcsd)2.508 E F1 .008 -(\(8\) process \(at)B F0(localhost:30003)2.508 E F1 2.509(\)b)C 2.509 -(yd)-2.509 G(ef)-2.509 E 2.509(ault. Use)-.1 F .009(the en)2.509 F -(viron-)-.4 E(ment v)108 201.6 Q(ariable)-.25 E F2(TZPFMS_TPM1X)2.5 E F1 -(to specify a remote TCS hostname.)2.5 E .445(The T)108 218.4 R(rouSerS) --.35 E F0(tcsd)2.945 E F1 .445(\(8\) daemon will try)B F0(/de)2.945 E -(v/tpm0)-.15 E F1 2.945(,t)C(hen)-2.945 E F0(/ude)2.945 E(v/tpm0)-.15 E -F1 2.945(,t)C(hen)-2.945 E F0(/de)2.944 E(v/tpm)-.15 E F1 2.944(;b)C -2.944(yo)-2.944 G(ccup)-2.944 E .444(ying one of)-.1 F -(the earlier ones with, for e)108 230.4 Q -(xample, shell redirection, a later one can be selected.)-.15 E F3 .625 -(See also)87 247.2 R F1(The T)108 259.2 Q +(If the helper doesn')133 124.8 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B +(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 +1.666(TPM1.X back-end con\214guration)72 153.6 R .625(TPM selection)87 +165.6 R F0(The)108 177.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 +.229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 189.6 Q +(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 206.4 R(rouSerS) +-.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +218.4 S(ing one of the earlier ones with, for e).1 E +(xample, shell redirection, a later one can be selected.)-.15 E F2 .625 +(See also)87 235.2 R F0(The T)108 247.2 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 -(The TPM 1.2 main speci\214cation inde)108 276 R 6.915(xa)-.15 G 6.915 +(The TPM 1.2 main speci\214cation inde)108 264 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 288 Q F3 1.666 -(SPECIAL THANKS)72 304.8 R F1 1.6 -.8(To a)108 316.8 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 276 Q F2 1.666 +(SPECIAL THANKS)72 292.8 R F0 1.6 -.8(To a)108 304.8 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F3<83>128 328.8 Q F1(ThePhD)7.5 E F3<83>128 340.8 Q F1 -(Embark Studios)7.5 E F3<83>128 352.8 Q F1(Jasper Bekk)7.5 E(ers)-.1 E -F3<83>128 364.8 Q F1(EvModder)7.5 E F3(REPOR)72 381.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F1(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F0(\001nabijaczle)108 410.4 Q(weli/tzpfms@lists.sr) --.15 E(.ht)-1.11 E F1 2.5(,a)C(rchi)-2.5 E -.15(ve)-.25 G 2.5(da).15 G -2.5(th)-2.5 G(ttps://lists.sr)-2.5 E(.ht/\001nabijaczle)-.55 E -(weli/tzpfms.)-.25 E F3 1.666(SEE ALSO)72 427.2 R F1 +.15 E F2<83>128 316.8 Q F0(ThePhD)7.5 E F2<83>128 328.8 Q F0 +(Embark Studios)7.5 E F2<83>128 340.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F2<83>128 352.8 Q F0(EvModder)7.5 E F2(REPOR)72 369.6 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 381.6 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 398.4 Q +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +(https://lists.sr)108 410.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E F2 1.666(SEE ALSO)72 427.2 R F0 (PCR allocations: https://wiki.archlinux.or)108 439.2 Q(g/title/T)-.18 E (rusted_Platform_Module#Accessing_PCR_re)-.35 E(gisters)-.15 E (and https://trustedcomputinggroup.or)108 451.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 463.2 Q -(able)-.8 E(1.)108 475.2 Q(tzpfms 0.3.4-14-gf5996ad)72 817.889 Q -(February 28, 2024)84.688 E(2)183.837 E 0 Cg EP -%%Page: 1 10 +(able)-.8 E(1.)108 475.2 Q(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q +(February 28, 2024)86.358 E(2)183.837 E 0 Cg EP +%%Page: 1 5 %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-TPM1X-CLEAR-KEY)72 48 Q/F1 10/Times-Roman@0 -SF 52.453(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G(anual)-2.5 E F0 -(ZFS-TPM1X-CLEAR-KEY)52.452 E F1(\(8\))A/F2 10/Times-Bold@0 SF -.2(NA)72 -84 S(ME).2 E F1(zfs-tpm1x-clear)108 96 Q(-k)-.2 E .3 -.15(ey \212 r)-.1 -H -.25(ew).15 G(rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G -(asssw)-2.5 E(ord and clear tzpfms TPM1.X metadata)-.1 E F2(SYNOPSIS)72 -112.8 Q/F3 10/Courier-Bold@0 SF(zfs-fido2-add-backup)108 124.8 Q/F4 10 -/Courier-Oblique@0 SF(dataset)2.5 E F2(DESCRIPTION)72 141.6 Q F1 -(After v)108 153.6 Q(erifying)-.15 E F4(dataset)2.5 E F1 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F3(tzpfms)2.5 E F1(back)2.5 E(end)-.1 E -F2(TPM1.X)2.5 E F1(:)A 5(1. performs)118 165.6 R 5.642(the equi)8.142 F --.25(va)-.25 G 5.642(lent of).25 F F3(zfs)8.142 E/F5 10/Courier@0 SF -7.307(change-key \255o)11.642 F 7.307(keylocation=prompt \255o)11.641 F -(keyformat=passphrase)133 177.6 Q F4(dataset)6 E F1(,)A 5(2. remo)118 -189.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F5 -(xyz.nabijaczleweli:tzpfms.)10.689 E F1({)A F5(backend)A F1(,)A F5(key) -14.189 E F1 10.689(}p)C 8.189(roperties from)-10.689 F F4(dataset)133 -201.6 Q F1(.)A(See)108 218.4 Q F0(zfs-tpm1x-c)2.5 E(hang)-.15 E(e-k)-.1 -E -.3(ey)-.1 G F1(\(8\) for a detailed description.).3 E F2 1.666 -(TPM1.X back-end con\214guration)72 235.2 R .625(TPM selection)87 247.2 -R F1(The)108 259.2 Q F3(tzpfms)2.509 E F1 .009 -(suite connects to a local)2.509 F F0(tcsd)2.508 E F1 .008 -(\(8\) process \(at)B F0(localhost:30003)2.508 E F1 2.508(\)b)C 2.508 -(yd)-2.508 G(ef)-2.508 E 2.508(ault. Use)-.1 F .008(the en)2.508 F -(viron-)-.4 E(ment v)108 271.2 Q(ariable)-.25 E F5(TZPFMS_TPM1X)2.5 E F1 -(to specify a remote TCS hostname.)2.5 E .444(The T)108 288 R(rouSerS) --.35 E F0(tcsd)2.944 E F1 .444(\(8\) daemon will try)B F0(/de)2.945 E -(v/tpm0)-.15 E F1 2.945(,t)C(hen)-2.945 E F0(/ude)2.945 E(v/tpm0)-.15 E -F1 2.945(,t)C(hen)-2.945 E F0(/de)2.945 E(v/tpm)-.15 E F1 2.945(;b)C -2.945(yo)-2.945 G(ccup)-2.945 E .445(ying one of)-.1 F -(the earlier ones with, for e)108 300 Q -(xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 316.8 R F1(The T)108 328.8 Q +/F0 10/Times-Roman@0 SF 45.793(ZFS-TPM1X-CLEAR-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 43.292(anual ZFS-TPM1X-CLEAR-KEY\(8\))-2.5 +F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF +(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G +.508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) +-3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 +(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q +(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G +(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM1.X) +2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F -.25(va) +-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E +/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 +(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 +(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) +14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 +213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm1x-change-key)2.5 E F0 +(\(8\) for a detailed description.)A F1 1.666 +(TPM1.X back-end con\214guration)72 247.2 R .625(TPM selection)87 259.2 +R F0(The)108 271.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 300 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 312 S +(ing one of the earlier ones with, for e).1 E +(xample, shell redirection, a later one can be selected.)-.15 E F1 .625 +(See also)87 328.8 R F0(The T)108 340.8 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 -(The TPM 1.2 main speci\214cation inde)108 345.6 R 6.915(xa)-.15 G 6.915 +(The TPM 1.2 main speci\214cation inde)108 357.6 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 357.6 Q F2 1.666 -(SPECIAL THANKS)72 374.4 R F1 1.6 -.8(To a)108 386.4 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 369.6 Q F1 1.666 +(SPECIAL THANKS)72 386.4 R F0 1.6 -.8(To a)108 398.4 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 398.4 Q F1(ThePhD)7.5 E F2<83>128 410.4 Q F1 -(Embark Studios)7.5 E F2<83>128 422.4 Q F1(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 434.4 Q F1(EvModder)7.5 E F2(REPOR)72 451.2 Q 1.666(TING B)-.4 -F(UGS)-.1 E F1(https://todo.sr)108 463.2 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F0(\001nabijaczle)108 480 Q(weli/tzpfms@lists.sr) --.15 E(.ht)-1.11 E F1 2.5(,a)C(rchi)-2.5 E -.15(ve)-.25 G 2.5(da).15 G -2.5(th)-2.5 G(ttps://lists.sr)-2.5 E(.ht/\001nabijaczle)-.55 E -(weli/tzpfms.)-.25 E(tzpfms 0.3.4-14-gf5996ad)72 817.889 Q -(December 4, 2022)84.693 E(1)183.842 E 0 Cg EP -%%Page: 1 11 +.15 E F1<83>128 410.4 Q F0(ThePhD)7.5 E F1<83>128 422.4 Q F0 +(Embark Studios)7.5 E F1<83>128 434.4 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F1<83>128 446.4 Q F0(EvModder)7.5 E F1(REPOR)72 463.2 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +(https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 +E(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q(December 4, 2022)86.363 E(1) +183.842 E 0 Cg EP +%%Page: 1 6 %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-TPM1X-LO)72 48 Q(AD-KEY)-.55 E/F1 10 -/Times-Roman@0 SF 57.453(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G -(anual)-2.5 E F0(ZFS-TPM1X-LO)57.452 E(AD-KEY)-.55 E F1(\(8\))A/F2 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E F1(zfs-tpm1x-load-k)108 96 Q .3 --.15(ey \212 l)-.1 H(oad TPM1.X-encrypted ZFS dataset k).15 E -.15(ey) --.1 G F2(SYNOPSIS)72 112.8 Q/F3 10/Courier-Bold@0 SF -(zfs-fido2-add-backup)108 124.8 Q F1([)2.5 E/F4 10/Courier@0 SF -1.666 E F1(])A/F5 10/Courier-Oblique@0 SF(dataset)2.5 E F2(DESCRIPTION) -72 141.6 Q F1 .19(After v)108 153.6 R(erifying)-.15 E F5(dataset)2.69 E -F1 -.1(wa)2.69 G 2.69(se).1 G .19(ncrypted with)-2.69 F F3(tzpfms)2.69 E -F1(back)2.69 E(end)-.1 E F2(TPM1.X)2.69 E F1 .191(will unseal the k)2.69 -F .491 -.15(ey a)-.1 H .191(nd load).15 F(it into)108 165.6 Q F5 -(dataset)2.5 E F1(.)A .236 +/F0 10/Times-Roman@0 SF(ZFS-TPM1X-LO)72 48 Q 51.153(AD-KEY\(8\) System) +-.35 F(Manager')2.5 E 2.5(sM)-.55 G 48.652(anual ZFS-TPM1X-LO)-2.5 F +(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 +/Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G +(oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .191 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1(wa)2.691 +G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E F0(back) +2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 F .49 +-.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset)2.5 E +F0(.)A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) -108 182.4 R .236(wnership, if not "well-kno)-.25 F .235(wn" \(all)-.25 F +108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) 108 194.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E -(as set.)-.1 E(See)108 211.2 Q F0(zfs-tpm1x-c)2.5 E(hang)-.15 E(e-k)-.1 -E -.3(ey)-.1 G F1(\(8\) for a detailed description.).3 E F2(OPTIONS)72 -228 Q F4109.666 240 Q F1 3.208(Do a no-op/dry run, can be used e) -131 240 R -.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k) --5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.) --5.708 F(Equi)8.208 E -.25(va)-.25 G 3.208(lent to).25 F F3(zfs)5.708 E -F4(load-key)131 252 Q F1 -.55('s)C F44.716 E F1(option.)2.5 E F2 -(ENVIR)72 268.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 -(TZPFMS_PASSPHRASE_HELPER)108 280.8 Q F1 .046(By def)133 292.8 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 -Q F1 .896(is set and nonempty)3.396 F 3.396(,i)-.65 G 3.396(tw)-3.396 G -.896(ill be run via)-3.396 F F0(/bin/)3.396 E F3(sh)A F48.562 E F1 -.897(to pro-)3.396 F(vide each passphrase, instead.)133 316.8 Q .643 +(as set.)-.1 E(See)108 211.2 Q/F4 10/Courier@0 SF(zfs-tpm1x-change-key) +2.5 E F0(\(8\) for a detailed description.)A F1(OPTIONS)72 228 Q F2 +109.666 240 Q F0 3.208(Do a no-op/dry run, can be used e)131 240 R +-.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F +3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) +8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 +252 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 268.8 Q +1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 +280.8 Q F0 .045(By def)133 292.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.046 +E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.596(is set and nonempty) +4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q +(vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 333.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) 133 345.6 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 357.6 Q F1 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 357.6 Q F0 (Pre-formatted noun phrase with all the information belo)160 357.6 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 369.6 Q F1 +-.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 369.6 Q F0 (Either the dataset name or the element of the TPM hierarch)160 369.6 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 381.6 Q F1("ne)160 +2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 381.6 Q F0("ne)160 381.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F1("ag)160 393.6 Q +(assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F0("ag)160 393.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 410.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F2(127)2.677 E F1 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 410.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 422.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F2 1.666 +G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 439.2 R .625(TPM selection)87 451.2 -R F1(The)108 463.2 Q F3(tzpfms)2.509 E F1 .009 -(suite connects to a local)2.509 F F0(tcsd)2.508 E F1 .008 -(\(8\) process \(at)B F0(localhost:30003)2.508 E F1 2.508(\)b)C 2.508 -(yd)-2.508 G(ef)-2.508 E 2.508(ault. Use)-.1 F .008(the en)2.508 F -(viron-)-.4 E(ment v)108 475.2 Q(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F1 -(to specify a remote TCS hostname.)2.5 E .444(The T)108 492 R(rouSerS) --.35 E F0(tcsd)2.944 E F1 .444(\(8\) daemon will try)B F0(/de)2.945 E -(v/tpm0)-.15 E F1 2.945(,t)C(hen)-2.945 E F0(/ude)2.945 E(v/tpm0)-.15 E -F1 2.945(,t)C(hen)-2.945 E F0(/de)2.945 E(v/tpm)-.15 E F1 2.945(;b)C -2.945(yo)-2.945 G(ccup)-2.945 E .445(ying one of)-.1 F -(the earlier ones with, for e)108 504 Q -(xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 520.8 R F1(The T)108 532.8 Q +R F0(The)108 463.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 475.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 492 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +504 S(ing one of the earlier ones with, for e).1 E +(xample, shell redirection, a later one can be selected.)-.15 E F1 .625 +(See also)87 520.8 R F0(The T)108 532.8 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 (The TPM 1.2 main speci\214cation inde)108 549.6 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 561.6 Q F2 1.666 -(SPECIAL THANKS)72 578.4 R F1 1.6 -.8(To a)108 590.4 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 561.6 Q F1 1.666 +(SPECIAL THANKS)72 578.4 R F0 1.6 -.8(To a)108 590.4 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 602.4 Q F1(ThePhD)7.5 E F2<83>128 614.4 Q F1 -(Embark Studios)7.5 E F2<83>128 626.4 Q F1(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 638.4 Q F1(EvModder)7.5 E F2(REPOR)72 655.2 Q 1.666(TING B)-.4 -F(UGS)-.1 E F1(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F0(\001nabijaczle)108 684 Q(weli/tzpfms@lists.sr) --.15 E(.ht)-1.11 E F1 2.5(,a)C(rchi)-2.5 E -.15(ve)-.25 G 2.5(da).15 G -2.5(th)-2.5 G(ttps://lists.sr)-2.5 E(.ht/\001nabijaczle)-.55 E -(weli/tzpfms.)-.25 E(tzpfms 0.3.4-14-gf5996ad)72 817.889 Q -(December 4, 2022)84.693 E(1)183.842 E 0 Cg EP -%%Page: 1 12 +.15 E F1<83>128 602.4 Q F0(ThePhD)7.5 E F1<83>128 614.4 Q F0 +(Embark Studios)7.5 E F1<83>128 626.4 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F1<83>128 638.4 Q F0(EvModder)7.5 E F1(REPOR)72 655.2 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +(https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 +E(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q(December 4, 2022)86.363 E(1) +183.842 E 0 Cg EP +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-TPM2-CHANGE-KEY)72 48 Q/F1 10/Times-Roman@0 -SF 49.123(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G(anual)-2.5 E F0 -(ZFS-TPM2-CHANGE-KEY)49.122 E F1(\(8\))A/F2 10/Times-Bold@0 SF -.2(NA)72 -84 S(ME).2 E F1(zfs-tpm2-change-k)108 96 Q .3 -.15(ey \212 c)-.1 H -(hange ZFS dataset k).15 E .3 -.15(ey t)-.1 H 2.5(oo).15 G -(ne stored on the TPM)-2.5 E F2(SYNOPSIS)72 112.8 Q/F3 10/Courier-Bold@0 -SF(zfs-fido2-add-backup)108 124.8 Q F1([)2.5 E/F4 10/Courier@0 SF -1.666 E/F5 10/Courier-Oblique@0 SF(backup-file)6 E F1 2.5(][)C F4 --.834 E F5(algorithm)6 E F4(:)A F5(PCR)A F1([)A F4(,)A F5(PCR)A F1 1.666 -(]...)C([)234 136.8 Q F4(+)A F5(algorithm)A F4(:)A F5(PCR)A F1([)A F4(,) -A F5(PCR)A F1 1.666(]...)C -3.332 1.666(]... [)-1.666 H F4A F1(]]) -A F5(dataset)2.5 E F2(DESCRIPTION)72 153.6 Q F1 4.319 -.8(To n)108 165.6 -T(ormalise).8 E F5(dataset)5.219 E F1(,)A F3(zfs-fido2-add-backup)5.219 -E F1 2.72(will open its encryption root in its stead.)5.219 F F3 -(zfs-fido2-add-backup)108 177.6 Q F1(will)3.515 E F0(ne)3.515 E(ver)-.15 -E F1 1.015(create or destro)3.515 F 3.514(ye)-.1 G 1.014 -(ncryption roots; use)-3.514 F F0(zfs-c)3.514 E(hang)-.15 E(e-k)-.1 E --.3(ey)-.1 G F1 1.014(\(8\) for).3 F(that.)108 189.6 Q -(First, a connection is made to the TPM, which)108 206.4 Q F0(must)2.5 E -F1(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F5(dataset)3.054 E F1 -.1 -(wa)3.054 G 3.054(sp).1 G(re)-3.054 E .554(viously encrypted with)-.25 F -F3(tzpfms)3.055 E F1 .555(and the)3.055 F F2(TPM2)3.055 E F1 .555 -(back-end w)3.055 F .555(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 -235.2 S 3.06(yw)-.05 G .56(ill be freed from the TPM.)-3.06 F .56 -(Otherwise, or in case of an error)5.56 F 3.059(,d)-.4 G .559 -(ata required for manual interv)-3.059 F(en-)-.15 E -(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 -264 Q 1.74(xt, a ne)-.15 F 4.24(ww)-.25 G 1.74(rapping k)-4.24 F 2.04 --.15(ey i)-.1 H 4.24(sg).15 G 1.74(enerated on the TPM, optionally back) --4.24 F 1.741(ed up \(see \231OPTIONS\232\), and)-.1 F .576 -(sealed to a persistent object on the TPM under the o)108 276 R .575 -(wner hierarch)-.25 F .575(y; if there is a passphrase set on the)-.05 F --.25(ow)108 288 S .48(ner hierarch).25 F 1.78 -.65(y, t)-.05 H .48 -(he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .481 -(ys prompted for an optional passphrase to).1 F -(protect the sealed object with.)108 300 Q(The follo)108 316.8 Q -(wing properties are set on)-.25 E F5(dataset)2.5 E F1(:)A F2<83>128 -328.8 Q F4(xyz.nabijaczleweli:tzpfms.backend)7.5 E F1(=)A F2(TPM2)A<83> -128 340.8 Q F4(xyz.nabijaczleweli:tzpfms.key)7.5 E F1(=)A F5 -(persistent-object-ID)A F1([)139 352.8 Q F4(;)A F5(algorithm)A F4(:)A F5 -(PCR)A F1([)A F4(,)A F5(PCR)A F1 1.666(]...)C([)-1.666 E F4(+)A F5 -(algorithm)A F4(:)A F5(PCR)A F1([)A F4(,)A F5(PCR)A F1 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F4(tzpfms.backend)108 369.6 Q F1 1.264 -(identi\214es this dataset for w)3.764 F 1.263(ork with)-.1 F F2(TPM2) -3.763 E F1(-back-ended)A F3(tzpfms)3.763 E F1 1.263(tools \(namely)3.763 -F F0(zfs-tpm2-c)108 381.6 Q(hang)-.15 E(e-k)-.1 E -.3(ey)-.1 G F1 -(\(8\),).3 E F0(zfs-tpm2-load-k)2.5 E -.3(ey)-.1 G F1(\(8\), and).3 E F0 -(zfs-tpm2-clear)2.5 E(-k)-.2 E -.3(ey)-.1 G F1(\(8\)\).).3 E F4 -(tzpfms.key)108 398.4 Q F1 1.508(is an inte)4.008 F 1.509 +/F0 10/Times-Roman@0 SF 44.133(ZFS-TPM2-CHANGE-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 41.632(anual ZFS-TPM2-CHANGE-KEY\(8\))-2.5 +F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF +(zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 +E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 +(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) +A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) +A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.676 -.8(To n)108 165.6 +T(ormalise).8 E F3(dataset)2.576 E F0(,)A F2(zfs-tpm-list)2.576 E F0 +.076(will open its encryption root in its stead.)2.576 F F2 +(zfs-tpm-list)5.077 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 +E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G +(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 +(\(8\) for that.)A(First, a connection is made to the TPM, which)108 +194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 +(dataset)3.055 E F0 -.1(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555 +(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F +F1(TPM2)3.055 E F0 .554(back-end w)3.054 F .554(as used, the pre)-.1 F +(vious)-.25 E -.1(ke)108 223.2 S 3.059(yw)-.05 G .559 +(ill be freed from the TPM.)-3.059 F .56 +(Otherwise, or in case of an error)5.56 F 3.06(,d)-.4 G .56 +(ata required for manual interv)-3.06 F(en-)-.15 E +(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 +252 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +-.15(ey i)-.1 H 2.794(sg).15 G .294 +(enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 +(OPTIONS)2.794 E F0 .294(\), and sealed)B .588 +(to a persistent object on the TPM under the o)108 264 R .589 +(wner hierarch)-.25 F .589(y; if there is a passphrase set on the o)-.05 +F(wner)-.25 E(hierarch)108 276 Q 1.603 -.65(y, t)-.05 H .302 +(he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 +(ys prompted for an optional passphrase to protect).1 F +(the sealed object with.)108 288 Q(The follo)108 304.8 Q +(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 +316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 +(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 1.263 +(identi\214es this dataset for w)3.763 F 1.264(ork with)-.1 F F1(TPM2) +3.764 E F0(-back-ended)A F2(tzpfms)3.764 E F0 1.264(tools \(namely)3.764 +F F5(zfs-tpm2-change-key)108 369.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) +2.5 E F0(\(8\), and)A F5(zfs-tpm2-clear-key)2.5 E F0(\(8\)\).)A F5 +(tzpfms.key)108 386.4 Q F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 -(wed by a semicolon and)-.25 F .823(PCR list as speci\214ed with)108 -410.4 R F44.988 E F1 3.322(,n)C .822(ormalised to be)-3.322 F F3 -(tpm-tools)3.322 E F1 .822(-toolchain-compatible; if needed, it can)B -.865(be passed to)108 422.4 R F3(tpm2_unseal)3.366 E F4 .866 -(\255c ${tzpfms.key%%;)8.532 F/F6 10/Symbol SF(*)A F4(})A F1(with)3.366 -E F45.032 E F1(")6.866 E F4(str:${passphrase})A F1 3.366("o)C(r) --3.366 E F4109.666 434.4 Q F1(")6.22 E F4(pcr:${tzpfms.key#)A F6 -(*)A F4(;})A F1 .22(", as the case may be, or equi)B -.25(va)-.25 G .22 -(lent, for back-up \(see \231OPTIONS\232\).).25 F .447(If you ha)108 -446.4 R .747 -.15(ve a s)-.2 H .447(ealed k).15 F .748 -.15(ey y)-.1 H -.448(ou can access with that or equi).15 F -.25(va)-.25 G .448 -(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.006 -(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506(lent of).25 F F3 -(zfs)12.005 E F4 11.171(change-key \255o)15.505 F 11.171 -(keylocation=prompt \255o)15.505 F(keyformat=raw)108 487.2 Q F5(dataset) -6.106 E F1 .106(is performed with the ne)2.606 F 2.606(wk)-.25 G -.15 -(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .107 -(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F .289(to clean\ +(wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 +398.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +(tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B +.866(be passed to)108 410.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +(${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) +3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) +C(r)-3.365 E F2109.666 422.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) +-.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A +.448(If you ha)108 434.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F +.748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) +-.25 G .447(lent tool and set both of these properties, it).25 F +(will funxion seamlessly)108 446.4 Q(.)-.65 E(Finally)108 463.2 Q 12.005 +(,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 +9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 +E F217.172 E F5(keyformat=raw)108 475.2 Q F3(dataset)6.107 E F0 +.107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G +5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 +(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 499.2 R .289(ention into the stan-)-.15 F -(dard error stream.)108 511.2 Q 2.624<418c>108 528 S .124(nal v)-2.624 F -.124(eri\214cation should be made by running)-.15 F F3 -(zfs-tpm2-load-key)2.625 E F47.791 E F5(dataset)6.125 E F1 5.125 -(.I)C 2.625(ft)-5.125 G .125(hat com-)-2.625 F .507 -(mand succeeds, all is well, b)108 540 R .506(ut otherwise the dataset \ -can be manually rolled back to a passphrase with)-.2 F F3 -(zfs-tpm2-clear-key)108 552 Q F5(dataset)11.538 E F1(\(or)8.039 E 8.039 -(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f)-8.039 F 5.539(ails to w)-.1 F -(ork,)-.1 E F3(zfs)8.039 E F4 7.205(change-key \255o)11.539 F -(keyformat=passphrase)108 564 Q F5(dataset)6 E F1 + interv)108 487.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 499.2 Q 2.625<418c>108 516 S .125(nal v)-2.625 F .125 +(eri\214cation should be made by running)-.15 F F2 1.79 +(zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 +(ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) +108 528 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 540 Q F3(dataset) +11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) +-8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 +F13.204 E F5(keyformat=passphrase)108 552 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F3(zfs-tpm2-clear-key)108 580.8 Q F5(dataset)6.029 E F1 .029 +F2(zfs-tpm2-clear-key)108 568.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 592.8 Q F2(OPTIONS)72 609.6 Q F4109.666 -621.6 Q F5(backup-file)6 E F1(Sa)203 621.6 Q .352 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F5(backup-file)2.552 -E F1 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 -F .694(This back-up)203 633.6 R F0(must)3.194 E F1 .694 -(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F3(zfs)233 657.6 Q F4(load-key)6 E F5(dataset)6 E F4(<)6 E F5 -(backup-file)6 E F4109.666 674.4 Q F5(algorithm)6 E F4(:)A F5(PCR) -A F1([)A F4(,)A F5(PCR)A F1 1.666(]...)C([)-1.666 E F4(+)A F5(algorithm) -A F4(:)A F5(PCR)A F1([)A F4(,)A F5(PCR)A F1 1.666(]...)C 1.666(]...) --1.666 G 1.424(Bind the k)203 686.4 R 1.724 -.15(ey t)-.1 H 3.924(os).15 -G 1.424(pace- or comma-separated)-3.924 F F5(PCR)3.925 E F1 3.925(sw)C -1.425(ithin their corresponding)-3.925 F(hashing)203 698.4 Q F5 -(algorithm)2.524 E F1 2.524<8a69>2.524 G 2.523(ft)-2.524 G(he)-2.523 E +F(ing a passphrase.)108 580.8 Q F1(OPTIONS)72 597.6 Q F2109.666 +609.6 Q F3(backup-file)6 E F0(Sa)203 609.6 Q .353 -.15(ve a b)-.2 H .052 +(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 +E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 +F .693(This back-up)203 621.6 R F4(must)3.193 E F0 .694 +(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 633.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 645.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 662.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) +A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) +-1.666 G 1.425(Bind the k)203 674.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C +1.424(ithin their corresponding)-3.924 F(hashing)203 686.4 Q F3 +(algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.023(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 -E F2(24)2.5 E F1(PCRs, numbered [)2.5 E F2(0)A F1(,)A F2(23)2.5 E F1(].) -A F5(algorithm)203 727.2 Q F1 2.968(may be an)5.468 F 5.468(yo)-.15 G -5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F2(sha1) -.15 E F1 2.968(", ")B F2(sha256)A F1 2.969(", ")B F2(sha384)A F1(",)A(") -203 739.2 Q F2(sha512)A F1 4.983(", ")B F2(sm3_256)A F1 4.983(", ")B F2 -(sm3-256)A F1 4.983(", ")B F2(sha3_256)A F1 4.983(", ")B F2(sha3-256)A -F1 4.983(", ")B F2(sha3_384)A F1(",)A(")203 751.2 Q F2(sha3-384)A F1 -(", ")A F2(sha3_512)A F1(", or ")A F2(sha3-512)A F1 -(", and must be supported by the TPM.)A(tzpfms 0.3.4-14-gf5996ad)72 -817.889 Q(February 28, 2024)84.688 E(1)183.837 E 0 Cg EP -%%Page: 2 13 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 698.4 R(are)2.5 +E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) +A F3(algorithm)203 715.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G +5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) +.15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") +203 727.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +(sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 739.2 Q F1(sha3-384)A F0 +(", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 +(", and must be supported by the TPM.)A(tzpfms 0.3.4-18-g1f9fe81)72 +817.889 Q(February 28, 2024)86.358 E(1)183.837 E 0 Cg EP +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-TPM2-CHANGE-KEY)72 48 Q/F1 10/Times-Roman@0 -SF 49.123(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G(anual)-2.5 E F0 -(ZFS-TPM2-CHANGE-KEY)49.122 E F1(\(8\))A/F2 10/Courier@0 SF109.666 -84 Q F1 -.4(Wi)203 84 S(th).4 E F24.588 E F1 2.922(,a)C .422 -(lso prompt for a passphrase.)-2.922 F .422(This is skipped by def)5.422 -F .423(ault because the)-.1 F .675(passphrase is)203 96 R F0(OR)3.175 E -F1 .675(ed with the PCR polic)B 3.175(y\212t)-.15 G .675(he wrapping k) --3.175 F .975 -.15(ey c)-.1 H .675(an be unsealed).15 F F0(either)203 -108 Q F1 1.389(passphraseless with the right PCRs)3.889 F F0(or)3.89 E -F1 1.39(with the passphrase, and this is)3.89 F(usually not the intent.) -203 120 Q/F3 10/Times-Bold@0 SF(ENVIR)72 136.8 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F2(TZPFMS_PASSPHRASE_HELPER)108 148.8 Q F1 .046 +/F0 10/Times-Roman@0 SF 44.133(ZFS-TPM2-CHANGE-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 41.632(anual ZFS-TPM2-CHANGE-KEY\(8\))-2.5 +F/F1 10/Courier-Bold@0 SF109.666 84 Q F0 -.4(Wi)203 84 S(th).4 E +F14.589 E F0 2.923(,a)C .422(lso prompt for a passphrase.)-2.923 F +.422(This is skipped by def)5.422 F .422(ault because the)-.1 F .675 +(passphrase is)203 96 R/F2 10/Times-Italic@0 SF(OR)3.175 E F0 .675 +(ed with the PCR polic)B 3.175(y\212t)-.15 G .675(he wrapping k)-3.175 F +.975 -.15(ey c)-.1 H .675(an be unsealed).15 F F2(either)203 108 Q F0 +1.39(passphraseless with the right PCRs)3.89 F F2(or)3.89 E F0 1.389 +(with the passphrase, and this is)3.89 F(usually not the intent.)203 120 +Q/F3 10/Times-Bold@0 SF(ENVIR)72 136.8 Q 1.666(ONMENT V)-.3 F(ARIABLES) +-1.35 E/F4 10/Courier@0 SF(TZPFMS_PASSPHRASE_HELPER)108 148.8 Q F0 .045 (By def)133 160.8 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.045 E F2 -(TZPFMS_PASSPHRASE_HELPER)133 172.8 Q F1 .896(is set and nonempty)3.396 -F 3.396(,i)-.65 G 3.396(tw)-3.396 G .896(ill be run via)-3.396 F F0 -(/bin/)3.396 E/F4 10/Courier-Bold@0 SF(sh)A F28.562 E F1 .897 -(to pro-)3.396 F(vide each passphrase, instead.)133 184.8 Q .643 + on the standard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 172.8 Q F0 1.596(is set and nonempty)4.096 +F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 +(/bin/)4.095 E F1 3.261(sh \255c)B F0(to)4.095 E(pro)133 184.8 Q +(vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 201.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) 133 213.6 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F2($1)143 225.6 Q F1 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 225.6 Q F0 (Pre-formatted noun phrase with all the information belo)160 225.6 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F2($2)143 237.6 Q F1 +-.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 237.6 Q F0 (Either the dataset name or the element of the TPM hierarch)160 237.6 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F2($3)143 249.6 Q F1("ne)160 +2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 249.6 Q F0("ne)160 249.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F2($4)143 261.6 Q F1("ag)160 261.6 Q +(assphrase, otherwise blank)-2.5 E F4($4)143 261.6 Q F0("ag)160 261.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 278.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F3(127)2.677 E F1 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 278.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F3(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 290.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F3 1.666 (TPM2 back-end con\214guration)72 307.2 R(En)87 319.2 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F2(TSS2_LOG)108 331.2 Q F1(An)161 331.2 -Q 2.5(yo)-.15 G(f:)-2.5 E F3(NONE)2.5 E F1(,)A F3(ERR)2.5 E(OR)-.3 E F1 -(,)A F3 -1.2(WA)2.5 G(RNING)1.2 E F1(,)A F3(INFO)2.5 E F1(,)A F3(DEB)2.5 -E(UG)-.1 E F1(,)A F3(TRA)2.5 E(CE)-.55 E F1 5(.D)C(ef)-5 E(ault:)-.1 E -F3 -1.2(WA)2.5 G(RNING)1.2 E F1(.)A F3 .625(TPM selection)87 348 R F1 -.978(The library)108 360 R F4(libtss2-tcti-default.so)3.477 E F1 .977 -(can be link)3.477 F .977(ed to an)-.1 F 3.477(yo)-.15 G 3.477(ft)-3.477 -G(he)-3.477 E F0(libtss2-tcti-)3.477 E/F5 10/Symbol SF(*)A F0(.so)A F1 -.977(libraries to)3.477 F 1.145(select the def)108 372 R 1.145 -(ault, otherwise)-.1 F F0(/de)3.646 E(v/tpmrm0)-.15 E F1 3.646(,t)C(hen) --3.646 E F0(/de)3.646 E(v/tpm0)-.15 E F1 3.646(,t)C(hen)-3.646 E F0 -(localhost:2321)3.646 E F1 1.146(will be tried, in order)3.646 F(\(see) -108 384 Q F0(ESYS_CONTEXT)2.5 E F1(\(3\)\).)A F3 .625(See also)87 400.8 -R F1 2.247(The tpm2-tss git repository at https://github)108 412.8 R +(onment v)-.18 F(ariables)-.1 E F4(TSS2_LOG)108 331.2 Q F0(An)161 331.2 +Q 2.5(yo)-.15 G(f:)-2.5 E F3(NONE)2.5 E F0(,)A F3(ERR)2.5 E(OR)-.3 E F0 +(,)A F3 -1.2(WA)2.5 G(RNING)1.2 E F0(,)A F3(INFO)2.5 E F0(,)A F3(DEB)2.5 +E(UG)-.1 E F0(,)A F3(TRA)2.5 E(CE)-.55 E F0 5(.D)C(ef)-5 E(ault:)-.1 E +F3 -1.2(WA)2.5 G(RNING)1.2 E F0(.)A F3 .625(TPM selection)87 348 R F0 +.621(The library)108 360 R F1(libtss2-tcti-default.so)3.121 E F0 .621 +(can be link)3.121 F .621(ed to an)-.1 F 3.122(yo)-.15 G 3.122(ft)-3.122 +G(he)-3.122 E F4(libtss2-tcti-)3.122 E/F5 10/Symbol SF(*)A F4(.so)A F0 +(li-)3.122 E .781(braries to select the def)108 372 R .781 +(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4 +(/dev/tpm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4(localhost:2321)3.28 E F0 +(will be tried, in order \(see)108 384 Q F4(ESYS_CONTEXT)2.5 E F0 +(\(3\)\).)A F3 .625(See also)87 400.8 R F0 2.247 +(The tpm2-tss git repository at https://github)108 412.8 R (.com/tpm2-softw)-.4 E 2.247(are/tpm2-tss and the documentation at)-.1 F (https://tpm2-tss.readthedocs.io.)108 424.8 Q 5.774(The TPM 2.0 speci\ \214cations, mainly at https://trustedcomputinggroup.or)108 441.6 R @@ -1211,184 +830,182 @@ R F1 2.247(The tpm2-tss git repository at https://github)108 412.8 R (speci\214cation/, https://trustedcomputinggroup.or)108 453.6 R (g/wp-content/uploads/TPM-)-.18 E(Re)108 465.6 Q(v-2.0-P)-.25 E (art-1-Architecture-01.38.pdf, and related pages.)-.15 E F3 1.666 -(SPECIAL THANKS)72 482.4 R F1 1.6 -.8(To a)108 494.4 T +(SPECIAL THANKS)72 482.4 R F0 1.6 -.8(To a)108 494.4 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F3<83>128 506.4 Q F1(ThePhD)7.5 E F3<83>128 518.4 Q F1 -(Embark Studios)7.5 E F3<83>128 530.4 Q F1(Jasper Bekk)7.5 E(ers)-.1 E -F3<83>128 542.4 Q F1(EvModder)7.5 E F3(REPOR)72 559.2 Q 1.666(TING B)-.4 -F(UGS)-.1 E F1(https://todo.sr)108 571.2 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F0(\001nabijaczle)108 588 Q(weli/tzpfms@lists.sr) --.15 E(.ht)-1.11 E F1 2.5(,a)C(rchi)-2.5 E -.15(ve)-.25 G 2.5(da).15 G -2.5(th)-2.5 G(ttps://lists.sr)-2.5 E(.ht/\001nabijaczle)-.55 E -(weli/tzpfms.)-.25 E F3 1.666(SEE ALSO)72 604.8 R F0(tpm2_unseal)108 -616.8 Q F1(\(1\))A(PCR allocations: https://wiki.archlinux.or)108 633.6 -Q(g/title/T)-.18 E(rusted_Platform_Module#Accessing_PCR_re)-.35 E -(gisters)-.15 E(and https://trustedcomputinggroup.or)108 645.6 Q +.15 E F3<83>128 506.4 Q F0(ThePhD)7.5 E F3<83>128 518.4 Q F0 +(Embark Studios)7.5 E F3<83>128 530.4 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F3<83>128 542.4 Q F0(EvModder)7.5 E F3(REPOR)72 559.2 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 571.2 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 588 Q +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +(https://lists.sr)108 600 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 +E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A +(PCR allocations: https://wiki.archlinux.or)108 645.6 Q(g/title/T)-.18 E +(rusted_Platform_Module#Accessing_PCR_re)-.35 E(gisters)-.15 E +(and https://trustedcomputinggroup.or)108 657.6 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ -r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 657.6 Q -(able)-.8 E(1.)108 669.6 Q(tzpfms 0.3.4-14-gf5996ad)72 817.889 Q -(February 28, 2024)84.688 E(2)183.837 E 0 Cg EP -%%Page: 1 14 +r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q +(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q +(February 28, 2024)86.358 E(2)183.837 E 0 Cg EP +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-TPM2-CLEAR-KEY)72 48 Q/F1 10/Times-Roman@0 -SF 58.563(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G(anual)-2.5 E F0 -(ZFS-TPM2-CLEAR-KEY)58.562 E F1(\(8\))A/F2 10/Times-Bold@0 SF -.2(NA)72 -84 S(ME).2 E F1(zfs-tpm2-clear)108 96 Q(-k)-.2 E .3 -.15(ey \212 r)-.1 H --.25(ew).15 G(rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G -(asssw)-2.5 E(ord and clear tzpfms TPM2 metadata)-.1 E F2(SYNOPSIS)72 -112.8 Q/F3 10/Courier-Bold@0 SF(zfs-fido2-add-backup)108 124.8 Q/F4 10 -/Courier-Oblique@0 SF(dataset)2.5 E F2(DESCRIPTION)72 141.6 Q F1 -(After v)108 153.6 Q(erifying)-.15 E F4(dataset)2.5 E F1 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F3(tzpfms)2.5 E F1(back)2.5 E(end)-.1 E -F2(TPM2)2.5 E F1(:)A 5(1. performs)118 165.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F3(zfs)8.142 E/F5 10/Courier@0 SF -7.308(change-key \255o)11.642 F 7.308(keylocation=prompt \255o)11.642 F -(keyformat=passphrase)133 177.6 Q F4(dataset)6 E F1(,)A 5(2. frees)118 +/F0 10/Times-Roman@0 SF 53.013(ZFS-TPM2-CLEAR-KEY\(8\) System)72 48 R +(Manager')2.5 E 2.5(sM)-.55 G 50.512(anual ZFS-TPM2-CLEAR-KEY\(8\))-2.5 +F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF +(zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G +(rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E +(ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 +(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 +(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with)-2.5 E F2 +(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM2)2.5 E F0(:)A 5 +(1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641 +(lent of).25 F F2 5.642(zfs change-key)8.142 F13.308 E/F4 10 +/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E F4 +(keyformat=passphrase)133 177.6 Q F3(dataset)6 E F0(,)A 5(2. frees)118 189.6 R(the sealed k)2.5 E .3 -.15(ey p)-.1 H(re).15 E -(viously used to encrypt)-.25 E F4(dataset)2.5 E F1(,)A 5(3. remo)118 -201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F5 -(xyz.nabijaczleweli:tzpfms.)10.689 E F1({)A F5(backend)A F1(,)A F5(key) -14.189 E F1 10.689(}p)C 8.189(roperties from)-10.689 F F4(dataset)133 -213.6 Q F1(.)A(See)108 230.4 Q F0(zfs-tpm2-c)2.5 E(hang)-.15 E(e-k)-.1 E --.3(ey)-.1 G F1(\(8\) for a detailed description.).3 E F2(ENVIR)72 247.2 -Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 -259.2 Q F1 .045(By def)133 271.2 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.046 -E F5(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F1 .896(is set and nonempty) -3.397 F 3.396(,i)-.65 G 3.396(tw)-3.396 G .896(ill be run via)-3.396 F -F0(/bin/)3.396 E F3(sh)A F58.562 E F1 .896(to pro-)3.396 F -(vide each passphrase, instead.)133 295.2 Q .643 +(viously used to encrypt)-.25 E F3(dataset)2.5 E F0(,)A 5(3. remo)118 +201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 +(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) +14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 +213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm2-change-key)2.5 E F0 +(\(8\) for a detailed description.)A F1(ENVIR)72 247.2 Q 1.666(ONMENT V) +-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .045 +(By def)133 271.2 R .045(ault, passphrases are prompted for and read in\ + on the standard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.596(is set and nonempty)4.096 +F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 295.2 Q +(vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 312 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) 133 324 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 336 Q F1 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 336 Q F0 (Pre-formatted noun phrase with all the information belo)160 336 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F5($2)143 348 Q F1 +-.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 348 Q F0 (Either the dataset name or the element of the TPM hierarch)160 348 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F5($3)143 360 Q F1("ne)160 360 Q +2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 360 Q F0("ne)160 360 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F5($4)143 372 Q F1("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G +-2.5 E F4($4)143 372 Q F0("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G (he second prompt for that passphrase, otherwise blank)-2.5 E .178 (If the helper doesn')133 388.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F2(127)2.677 E F1 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 400.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F2 1.666 +G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM2 back-end con\214guration)72 417.6 R(En)87 429.6 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F5(TSS2_LOG)108 441.6 Q F1(An)161 441.6 -Q 2.5(yo)-.15 G(f:)-2.5 E F2(NONE)2.5 E F1(,)A F2(ERR)2.5 E(OR)-.3 E F1 -(,)A F2 -1.2(WA)2.5 G(RNING)1.2 E F1(,)A F2(INFO)2.5 E F1(,)A F2(DEB)2.5 -E(UG)-.1 E F1(,)A F2(TRA)2.5 E(CE)-.55 E F1 5(.D)C(ef)-5 E(ault:)-.1 E -F2 -1.2(WA)2.5 G(RNING)1.2 E F1(.)A F2 .625(TPM selection)87 458.4 R F1 -.977(The library)108 470.4 R F3(libtss2-tcti-default.so)3.477 E F1 .977 -(can be link)3.477 F .977(ed to an)-.1 F 3.477(yo)-.15 G 3.477(ft)-3.477 -G(he)-3.477 E F0(libtss2-tcti-)3.477 E/F6 10/Symbol SF(*)A F0(.so)A F1 -.978(libraries to)3.477 F 1.146(select the def)108 482.4 R 1.146 -(ault, otherwise)-.1 F F0(/de)3.646 E(v/tpmrm0)-.15 E F1 3.646(,t)C(hen) --3.646 E F0(/de)3.646 E(v/tpm0)-.15 E F1 3.646(,t)C(hen)-3.646 E F0 -(localhost:2321)3.646 E F1 1.145(will be tried, in order)3.646 F(\(see) -108 494.4 Q F0(ESYS_CONTEXT)2.5 E F1(\(3\)\).)A F2 .625(See also)87 -511.2 R F1 2.247(The tpm2-tss git repository at https://github)108 523.2 -R(.com/tpm2-softw)-.4 E 2.247(are/tpm2-tss and the documentation at)-.1 -F(https://tpm2-tss.readthedocs.io.)108 535.2 Q 5.774(The TPM 2.0 speci\ +(onment v)-.18 F(ariables)-.1 E F4(TSS2_LOG)108 441.6 Q F0(An)161 441.6 +Q 2.5(yo)-.15 G(f:)-2.5 E F1(NONE)2.5 E F0(,)A F1(ERR)2.5 E(OR)-.3 E F0 +(,)A F1 -1.2(WA)2.5 G(RNING)1.2 E F0(,)A F1(INFO)2.5 E F0(,)A F1(DEB)2.5 +E(UG)-.1 E F0(,)A F1(TRA)2.5 E(CE)-.55 E F0 5(.D)C(ef)-5 E(ault:)-.1 E +F1 -1.2(WA)2.5 G(RNING)1.2 E F0(.)A F1 .625(TPM selection)87 458.4 R F0 +.621(The library)108 470.4 R F2(libtss2-tcti-default.so)3.121 E F0 .621 +(can be link)3.121 F .621(ed to an)-.1 F 3.122(yo)-.15 G 3.122(ft)-3.122 +G(he)-3.122 E F4(libtss2-tcti-)3.122 E/F5 10/Symbol SF(*)A F4(.so)A F0 +(li-)3.122 E .781(braries to select the def)108 482.4 R .781 +(ault, otherwise)-.1 F F4(/dev/tpmrm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4 +(/dev/tpm0)3.28 E F0 3.28(,t)C(hen)-3.28 E F4(localhost:2321)3.28 E F0 +(will be tried, in order \(see)108 494.4 Q F4(ESYS_CONTEXT)2.5 E F0 +(\(3\)\).)A F1 .625(See also)87 511.2 R F0 2.247 +(The tpm2-tss git repository at https://github)108 523.2 R +(.com/tpm2-softw)-.4 E 2.247(are/tpm2-tss and the documentation at)-.1 F +(https://tpm2-tss.readthedocs.io.)108 535.2 Q 5.774(The TPM 2.0 speci\ \214cations, mainly at https://trustedcomputinggroup.or)108 552 R (g/resource/tpm-library-)-.18 E 111.845 (speci\214cation/, https://trustedcomputinggroup.or)108 564 R (g/wp-content/uploads/TPM-)-.18 E(Re)108 576 Q(v-2.0-P)-.25 E -(art-1-Architecture-01.38.pdf, and related pages.)-.15 E F2 1.666 -(SPECIAL THANKS)72 592.8 R F1 1.6 -.8(To a)108 604.8 T +(art-1-Architecture-01.38.pdf, and related pages.)-.15 E F1 1.666 +(SPECIAL THANKS)72 592.8 R F0 1.6 -.8(To a)108 604.8 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 616.8 Q F1(ThePhD)7.5 E F2<83>128 628.8 Q F1 -(Embark Studios)7.5 E F2<83>128 640.8 Q F1(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 652.8 Q F1(EvModder)7.5 E F2(REPOR)72 669.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F1(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F0(\001nabijaczle)108 698.4 Q(weli/tzpfms@lists.sr) --.15 E(.ht)-1.11 E F1 2.5(,a)C(rchi)-2.5 E -.15(ve)-.25 G 2.5(da).15 G -2.5(th)-2.5 G(ttps://lists.sr)-2.5 E(.ht/\001nabijaczle)-.55 E -(weli/tzpfms.)-.25 E(tzpfms 0.3.4-14-gf5996ad)72 817.889 Q -(December 4, 2022)84.693 E(1)183.842 E 0 Cg EP -%%Page: 1 15 +.15 E F1<83>128 616.8 Q F0(ThePhD)7.5 E F1<83>128 628.8 Q F0 +(Embark Studios)7.5 E F1<83>128 640.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F1<83>128 652.8 Q F0(EvModder)7.5 E F1(REPOR)72 669.6 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +(https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q(December 4, 2022)86.363 E +(1)183.842 E 0 Cg EP +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Italic@0 SF(ZFS-TPM2-LO)72 48 Q(AD-KEY)-.55 E/F1 10 -/Times-Roman@0 SF 63.563(\(8\) System)B(Manager')2.5 E 2.5(sM)-.55 G -(anual)-2.5 E F0(ZFS-TPM2-LO)63.562 E(AD-KEY)-.55 E F1(\(8\))A/F2 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E F1(zfs-tpm2-load-k)108 96 Q .3 --.15(ey \212 l)-.1 H(oad TPM2-encrypted ZFS dataset k).15 E -.15(ey)-.1 -G F2(SYNOPSIS)72 112.8 Q/F3 10/Courier-Bold@0 SF(zfs-fido2-add-backup) -108 124.8 Q F1([)2.5 E/F4 10/Courier@0 SF1.666 E F1(])A/F5 10 -/Courier-Oblique@0 SF(dataset)2.5 E F2(DESCRIPTION)72 141.6 Q F1 .865 -(After v)108 153.6 R(erifying)-.15 E F5(dataset)3.365 E F1 -.1(wa)3.365 -G 3.365(se).1 G .865(ncrypted with)-3.365 F F3(tzpfms)3.365 E F1(back) -3.365 E(end)-.1 E F2(TPM2)3.365 E F1 3.365(,u)C .864(nseals the k)-3.365 -F 1.164 -.15(ey a)-.1 H .864(nd loads it).15 F(into)108 165.6 Q F5 -(dataset)2.5 E F1(.)A(The user is prompted for the additional passphras\ +/F0 10/Times-Roman@0 SF(ZFS-TPM2-LO)72 48 Q 58.373(AD-KEY\(8\) System) +-.35 F(Manager')2.5 E 2.5(sM)-.55 G 55.872(anual ZFS-TPM2-LO)-2.5 F +(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 +/Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G +(oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .864 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1(wa)3.364 +G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E F0(back) +3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865(nseals the k)-3.365 +F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F(into)108 165.6 Q F3 +(dataset)2.5 E F0(.)A(The user is prompted for the additional passphras\ e, set when creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5 -(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q F0(zfs-tpm2-c)2.5 E -(hang)-.15 E(e-k)-.1 E -.3(ey)-.1 G F1 -(\(8\) for a detailed description.).3 E F2(OPTIONS)72 216 Q F4 -109.666 228 Q F1 3.208(Do a no-op/dry run, can be used e)131 228 R -.15 -(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 --.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.208 -E -.25(va)-.25 G 3.208(lent to).25 F F3(zfs)5.708 E F4(load-key)131 240 -Q F1 -.55('s)C F44.716 E F1(option.)2.5 E F2(ENVIR)72 256.8 Q -1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 -268.8 Q F1 .046(By def)133 280.8 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.045 -E F4(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F1 .896(is set and nonempty) -3.396 F 3.396(,i)-.65 G 3.396(tw)-3.396 G .896(ill be run via)-3.396 F -F0(/bin/)3.396 E F3(sh)A F48.562 E F1 .897(to pro-)3.396 F -(vide each passphrase, instead.)133 304.8 Q .643 +(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF +(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 +(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 +(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 +G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) +.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 +(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 +4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F +(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 +(By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ + on the standard output and input streams.)-.1 F(If)5.046 E F4 +(TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 +F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 304.8 Q +(vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 321.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) 133 333.6 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 345.6 Q F1 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 345.6 Q F0 (Pre-formatted noun phrase with all the information belo)160 345.6 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 357.6 Q F1 +-.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 357.6 Q F0 (Either the dataset name or the element of the TPM hierarch)160 357.6 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 369.6 Q F1("ne)160 +2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 369.6 Q F0("ne)160 369.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 381.6 Q F1("ag)160 381.6 Q +(assphrase, otherwise blank)-2.5 E F4($4)143 381.6 Q F0("ag)160 381.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 398.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F2(127)2.677 E F1 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 398.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 410.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F2 1.666 +G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 427.2 R .625(TPM selection)87 439.2 -R F1(The)108 451.2 Q F3(tzpfms)2.509 E F1 .009 -(suite connects to a local)2.509 F F0(tcsd)2.508 E F1 .008 -(\(8\) process \(at)B F0(localhost:30003)2.508 E F1 2.508(\)b)C 2.508 -(yd)-2.508 G(ef)-2.508 E 2.508(ault. Use)-.1 F .008(the en)2.508 F -(viron-)-.4 E(ment v)108 463.2 Q(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F1 -(to specify a remote TCS hostname.)2.5 E .444(The T)108 480 R(rouSerS) --.35 E F0(tcsd)2.944 E F1 .444(\(8\) daemon will try)B F0(/de)2.945 E -(v/tpm0)-.15 E F1 2.945(,t)C(hen)-2.945 E F0(/ude)2.945 E(v/tpm0)-.15 E -F1 2.945(,t)C(hen)-2.945 E F0(/de)2.945 E(v/tpm)-.15 E F1 2.945(;b)C -2.945(yo)-2.945 G(ccup)-2.945 E .445(ying one of)-.1 F -(the earlier ones with, for e)108 492 Q -(xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 508.8 R F1(The T)108 520.8 Q +R F0(The)108 451.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 463.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 480 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +492 S(ing one of the earlier ones with, for e).1 E +(xample, shell redirection, a later one can be selected.)-.15 E F1 .625 +(See also)87 508.8 R F0(The T)108 520.8 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 (The TPM 1.2 main speci\214cation inde)108 537.6 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 549.6 Q F2 1.666 -(SPECIAL THANKS)72 566.4 R F1 1.6 -.8(To a)108 578.4 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 549.6 Q F1 1.666 +(SPECIAL THANKS)72 566.4 R F0 1.6 -.8(To a)108 578.4 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 590.4 Q F1(ThePhD)7.5 E F2<83>128 602.4 Q F1 -(Embark Studios)7.5 E F2<83>128 614.4 Q F1(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 626.4 Q F1(EvModder)7.5 E F2(REPOR)72 643.2 Q 1.666(TING B)-.4 -F(UGS)-.1 E F1(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F0(\001nabijaczle)108 672 Q(weli/tzpfms@lists.sr) --.15 E(.ht)-1.11 E F1 2.5(,a)C(rchi)-2.5 E -.15(ve)-.25 G 2.5(da).15 G -2.5(th)-2.5 G(ttps://lists.sr)-2.5 E(.ht/\001nabijaczle)-.55 E -(weli/tzpfms.)-.25 E(tzpfms 0.3.4-14-gf5996ad)72 817.889 Q -(December 4, 2022)84.693 E(1)183.842 E 0 Cg EP +.15 E F1<83>128 590.4 Q F0(ThePhD)7.5 E F1<83>128 602.4 Q F0 +(Embark Studios)7.5 E F1<83>128 614.4 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F1<83>128 626.4 Q F0(EvModder)7.5 E F1(REPOR)72 643.2 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +(https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 +E(tzpfms 0.3.4-18-g1f9fe81)72 817.889 Q(December 4, 2022)86.363 E(1) +183.842 E 0 Cg EP %%Trailer end %%EOF diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 deleted file mode 100644 index 08a80cb..0000000 --- a/zfs-fido2-add-backup.8 +++ /dev/null @@ -1,125 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-ADD-BACKUP 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-add-backup -.Nd allow another FIDO2 device to unlock ZFS dataset -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After -.Xr zfs-fido2-change-key 8 -derives the key for a dataset from a FIDO2 device, -.Nm -may be executed to extend this to any number of additional devices. -.Pp -First, the wrapping key is extracted as normally during -.Xr zfs-fido2-load-key 8 , -then a credential is made as-if during -.Xr zfs-fido2-change-key 8 -(except the "primary" device and all the ones holding backups are excluded from the search); -however, the -.Ql hmac-secret -is instead used as a symmetric AES-256-GCM -.Pq Xr EVP_CIPHER-AES 7ssl -key to encrypt the wrapping key directly with a random IV. -.Pp -This turns the -.Li xyz.nabijaczleweli:tzpfms.key -variable into -.br -.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … -.Pp -.Li tzpfms.key -is actually a dot-separated list of device bundles. -The first one is as-described in -.Xr zfs-fido2-change-key 8 . -Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -.Pp -.Xr zfs-fido2-load-key 8 -shops assertions around devices in a device-major order \(em -depending on device numbering, a backup may be loaded even if the primary device is present. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html deleted file mode 100644 index e6d3444..0000000 --- a/zfs-fido2-add-backup.8.html +++ /dev/null @@ -1,153 +0,0 @@ - - - - - - - - ZFS-FIDO2-ADD-BACKUP(8) - - - - - - - - -
ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
- - - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 deleted file mode 100644 index 6bd3f57..0000000 --- a/zfs-fido2-change-key.8 +++ /dev/null @@ -1,186 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CHANGE-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-change-key -.Nd change ZFS dataset key to one authenticated by a FIDO2 device -.Sh SYNOPSIS -.Nm -.Op Fl b Ar backup-file -.Ar dataset -. -.Sh DESCRIPTION -To normalise the -.Ar dataset , -.Nm -will open its encryption root in its stead. -.Nm -will -.Em never -create or destroy encryption roots; use -.Xr zfs-change-key 8 -for that. -.Pp -First, a connection is made to the FIDO2 device, which -.Em must -support the -.Ql hmac-secret -extension. -.Pp -If -.Ar dataset -was previously encrypted with -.Nm fzifdso -and the -.Sy FIDO2 -back-end was used, the metadata will be silently cleared. -Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. -.Pp -Next, a new credential of type ES256 is generated on the device (with relying party ID -.Li fzifdso -and name equal to the dataset name) -with the -.Ql hmac-secret -extension requested; the device PIN, if any, is prompted for here. -This mimicks a WebAuthn registration step. -.Pp -Then, the credential is asserted with a 32-byte random salt, -which hashes it with device-private data, and thus generates the wrapping key -.Pq which is optionally backed up Pq see Sx OPTIONS . -This mimicks a WebAuthn login step. -.Pp -The following properties are set on -.Ar dataset : -.Bl -bullet -compact -offset 4n -width "@" -.It -.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 -.It -.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … -.El -.Pp -.Li tzpfms.backend -identifies this dataset for work with -.Sy FIDO2 Ns -back-ended -.Nm tzpfms -tools -.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . -.Pp -.Li tzpfms.key -is a colon-separated tuple of unpadded URL-safe base64 blobs; -the first one is the random salt; -the second represents the ID of created credential, -and the third \(en its public key. -There exists no other user-land tool for deciphering this; perhaps there should be. -.\"" TODO: make an LD_PRELOADable for extracting the key maybe? -.Pp -Finally, the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset -is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. -.Pp -A final verification should be made by running -.Nm zfs-fido2-load-key Fl n Ar dataset . -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a passphrase with -.Nm zfs-fido2-clear-key Ar dataset -.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , -and you are hereby asked to report a bug, please. -.Pp -.Nm zfs-fido2-clear-key Ar dataset -can be used to clear the properties and go back to using a passphrase. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl b Ar backup-file" -.It Fl b Ar backup-file -Save a back-up of the key to -.Ar backup-file , -which must not exist beforehand. -This back-up -.Em must -be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running -.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html deleted file mode 100644 index 68ea232..0000000 --- a/zfs-fido2-change-key.8.html +++ /dev/null @@ -1,206 +0,0 @@ - - - - - - - - ZFS-FIDO2-CHANGE-KEY(8) - - - - - - - - -
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
-
-
-

-

zfs-fido2-change-key — - change ZFS dataset key to one authenticated by a FIDO2 - device

-
-
-

- - - - - -
zfs-fido2-change-key[-b backup-file] - dataset
-
-
-

-

To normalise the dataset, - zfs-fido2-change-key will open its encryption root - in its stead. zfs-fido2-change-key will - - create or destroy encryption roots; use - zfs-change-key(8) - for that.

-

First, a connection is made to the FIDO2 device, which - must support the - ‘hmac-secret’ extension.

-

If dataset was previously encrypted with - fzifdso and the FIDO2 back-end was - used, the metadata will be silently cleared. Otherwise, or in case of an - error, data required for manual intervention will be written to the standard - error stream.

-

Next, a new credential of type ES256 is generated on the device - (with relying party ID fzifdso and name equal to the - dataset name) with the ‘hmac-secret’ - extension requested; the device PIN, if any, is prompted for here. This - mimicks a WebAuthn registration step.

-

Then, the credential is asserted with a 32-byte random salt, which - hashes it with device-private data, and thus generates the wrapping key - (which is optionally backed up (see - OPTIONS)). This mimicks a WebAuthn login - step.

-

The following properties are set on - dataset:

- -

tzpfms.backend identifies this dataset for - work with FIDO2-back-ended tzpfms - tools (i.e. fzifdso - zfs-fido2-change-key(8), - zfs-fido2-load-key(8), - zfs-fido2-add-backup(8), - and - zfs-fido2-clear-key(8)).

-

tzpfms.key is a colon-separated tuple of - unpadded URL-safe base64 blobs; the first one is the random salt; the second - represents the ID of created credential, and the third – its public - key. There exists no other user-land tool for deciphering this; perhaps - there should be.

-

Finally, the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=raw dataset is - performed with the new key. If an error occurred, best effort is made to - clean up the properties, or to issue a note for manual intervention into the - standard error stream.

-

A final verification should be made by running - zfs-fido2-load-key -n - dataset. If that command succeeds, all is well, but - otherwise the dataset can be manually rolled back to a passphrase with - zfs-fido2-clear-key dataset - (or, if that fails to work, zfs - change-key -o - keyformat=passphrase dataset), - and you are hereby asked to report a bug, please.

-

zfs-fido2-clear-key - dataset can be used to clear the properties and go - back to using a passphrase.

-
-
-

-
-
- backup-file
-
Save a back-up of the key to backup-file, which must - not exist beforehand. This back-up must be stored - securely, off-site. In case of a catastrophic event, the key can be loaded - by running -
zfs - load-key dataset - < - backup-file
-
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 deleted file mode 100644 index dd2a76c..0000000 --- a/zfs-fido2-clear-key.8 +++ /dev/null @@ -1,113 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CLEAR-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-clear-key -.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 : -.Bl -enum -compact -offset 2n -width 2n -.It -performs the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , -.It -removes the -.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key -properties from -.Ar dataset . -.El -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html deleted file mode 100644 index 46e553e..0000000 --- a/zfs-fido2-clear-key.8.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - - - - - ZFS-FIDO2-CLEAR-KEY(8) - - - - - - - - -
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
-
-
-

-

zfs-fido2-clear-key — - rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 - metadata

-
-
-

- - - - - -
zfs-fido2-clear-keydataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - :

-
    -
  1. performs the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=passphrase - dataset,
    2. -
  2. removes the - xyz.nabijaczleweli:tzpfms.{backend, - key} properties from - dataset.
    3. -
-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 deleted file mode 100644 index 247ca04..0000000 --- a/zfs-fido2-load-key.8 +++ /dev/null @@ -1,98 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-LOAD-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-load-key -.Nd load FIDO2-encrypted ZFS dataset key -.Sh SYNOPSIS -.Nm -.Op Fl n -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 , -asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into -.Ar dataset . -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl n" -.It Fl n -Do a no-op/dry run, can be used even if the key is already loaded. -Equivalent to -.Nm zfs Cm load-key Ns 's -.Fl n -option. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html deleted file mode 100644 index ffc6446..0000000 --- a/zfs-fido2-load-key.8.html +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - - ZFS-FIDO2-LOAD-KEY(8) - - - - - - - - -
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
-
-
-

-

zfs-fido2-load-key — - load FIDO2-encrypted ZFS dataset key

-
-
-

- - - - - -
zfs-fido2-load-key[-n] dataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - , - asserts the preserved challenge, HMACking the salt with the on-device - secret, and loads the resulting key into dataset.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
Do a no-op/dry run, can be used even if the key is already loaded. - Equivalent to zfs - load-key's -n option.
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index 9c30432..0c94139 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM-LIST 8 -.Os tzpfms 0.3.4-14-gf5996ad +.Os tzpfms 0.3.4-18-g1f9fe81 . .Sh NAME .Nm zfs-tpm-list diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index 4a5ba15..17227f6 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -166,7 +166,7 @@ tarta-zoot/vm - available yes - +
December 4, 2022tzpfms 0.3.4-14-gf5996adtzpfms 0.3.4-18-g1f9fe81
diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index f94219a..ec6ed71 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CHANGE-KEY 8 -.Os tzpfms 0.3.4-14-gf5996ad +.Os tzpfms 0.3.4-18-g1f9fe81 . .Sh NAME .Nm zfs-tpm1x-change-key diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index 05c6297..c89e18b 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -219,7 +219,7 @@ - +
February 28, 2024tzpfms 0.3.4-14-gf5996adtzpfms 0.3.4-18-g1f9fe81
diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index 7a4716b..497706a 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CLEAR-KEY 8 -.Os tzpfms 0.3.4-14-gf5996ad +.Os tzpfms 0.3.4-18-g1f9fe81 . .Sh NAME .Nm zfs-tpm1x-clear-key diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index f136b1f..7629cbd 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -103,7 +103,7 @@ - +
December 4, 2022tzpfms 0.3.4-14-gf5996adtzpfms 0.3.4-18-g1f9fe81
diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index ed90bdc..2063291 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-LOAD-KEY 8 -.Os tzpfms 0.3.4-14-gf5996ad +.Os tzpfms 0.3.4-18-g1f9fe81 . .Sh NAME .Nm zfs-tpm1x-load-key diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index 532446b..0cb98b2 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -139,7 +139,7 @@ - +
December 4, 2022tzpfms 0.3.4-14-gf5996adtzpfms 0.3.4-18-g1f9fe81
diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index 7ba6738..7608f94 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CHANGE-KEY 8 -.Os tzpfms 0.3.4-14-gf5996ad +.Os tzpfms 0.3.4-18-g1f9fe81 . .Sh NAME .Nm zfs-tpm2-change-key diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index 2b9b361..bee42b5 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -265,7 +265,7 @@ - +
February 28, 2024tzpfms 0.3.4-14-gf5996adtzpfms 0.3.4-18-g1f9fe81
diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index 052d016..bce1fa5 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-CLEAR-KEY 8 -.Os tzpfms 0.3.4-14-gf5996ad +.Os tzpfms 0.3.4-18-g1f9fe81 . .Sh NAME .Nm zfs-tpm2-clear-key diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index ce66ed0..08fd439 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -154,7 +154,7 @@ - +
December 4, 2022tzpfms 0.3.4-14-gf5996adtzpfms 0.3.4-18-g1f9fe81
diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index 6d04435..2557b24 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-LOAD-KEY 8 -.Os tzpfms 0.3.4-14-gf5996ad +.Os tzpfms 0.3.4-18-g1f9fe81 . .Sh NAME .Nm zfs-tpm2-load-key diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index 96bad7b..7ecc602 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -138,7 +138,7 @@ - +
December 4, 2022tzpfms 0.3.4-14-gf5996adtzpfms 0.3.4-18-g1f9fe81
-
-

-

zfs-fido2-add-backup — - allow another FIDO2 device to unlock ZFS dataset

-
-
-

- - - - - -
zfs-fido2-add-backupdataset
-
-
-

-

After - zfs-fido2-change-key(8) - derives the key for a dataset from a FIDO2 device, - zfs-fido2-add-backup may be executed to extend this - to any number of additional devices.

-

First, the wrapping key is extracted as normally during - zfs-fido2-load-key(8), - then a credential is made as-if during - zfs-fido2-change-key(8) - (except the "primary" device and all the ones holding backups are - excluded from the search); however, the - ‘hmac-secret’ is instead used as a - symmetric AES-256-GCM - (EVP_CIPHER-AES(7ssl)) - key to encrypt the wrapping key directly with a random IV.

-

This turns the - xyz.nabijaczleweli:tzpfms.key variable into -
- salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…

-

tzpfms.key is actually a dot-separated - list of device bundles. The first one is as-described in - zfs-fido2-change-key(8). - Subsequent ones also include (identically-encoded) IVs and encrypted - blobs.

-

zfs-fido2-load-key(8) - shops assertions around devices in a device-major order — depending - on device numbering, a backup may be loaded even if the primary device is - present.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-