From e05fce85c415e41a067fb3c62945e2816a0a8a25 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1=20autouploader?= Date: Sun, 3 Mar 2024 19:44:42 +0000 Subject: [PATCH] Manpage update by job 1161212 --- tzpfms.pdf | Bin 81306 -> 65713 bytes tzpfms.ps | 916 +++++++++++------------------------- zfs-fido2-add-backup.8 | 125 ----- zfs-fido2-add-backup.8.html | 153 ------ zfs-fido2-change-key.8 | 186 -------- zfs-fido2-change-key.8.html | 206 -------- zfs-fido2-clear-key.8 | 113 ----- zfs-fido2-clear-key.8.html | 143 ------ zfs-fido2-load-key.8 | 98 ---- zfs-fido2-load-key.8.html | 117 ----- zfs-tpm-list.8 | 2 +- zfs-tpm-list.8.html | 2 +- zfs-tpm1x-change-key.8 | 2 +- zfs-tpm1x-change-key.8.html | 2 +- zfs-tpm1x-clear-key.8 | 2 +- zfs-tpm1x-clear-key.8.html | 2 +- zfs-tpm1x-load-key.8 | 2 +- zfs-tpm1x-load-key.8.html | 2 +- zfs-tpm2-change-key.8 | 2 +- zfs-tpm2-change-key.8.html | 2 +- zfs-tpm2-clear-key.8 | 2 +- zfs-tpm2-clear-key.8.html | 2 +- zfs-tpm2-load-key.8 | 2 +- zfs-tpm2-load-key.8.html | 2 +- 24 files changed, 292 insertions(+), 1793 deletions(-) delete mode 100644 zfs-fido2-add-backup.8 delete mode 100644 zfs-fido2-add-backup.8.html delete mode 100644 zfs-fido2-change-key.8 delete mode 100644 zfs-fido2-change-key.8.html delete mode 100644 zfs-fido2-clear-key.8 delete mode 100644 zfs-fido2-clear-key.8.html delete mode 100644 zfs-fido2-load-key.8 delete mode 100644 zfs-fido2-load-key.8.html diff --git a/tzpfms.pdf b/tzpfms.pdf index 716a893bed655365320a5b61a9f1bb892641d933..53eef3e6ff5dc9322428aa49680d9ae3b7c1aa55 100644 GIT binary patch delta 45064 zcmZU)V{o8Rx2+r7wr$%^I=0cVZM?DVbZmBPr;~JSI~_ae*g3uT-TT%#_5E5^^Y0q9 z#vIR_>&F{JLl8tgJSZ@wz2UMkit2x?C2wz^R+!5219$UD!Is_Jl5!0-t7>aD00&GQ z)mGmM1S6x$FKD7~50IY$3Bi|@R85u}M{b3ce>%NdDEGaAM3qNP0)F%jx{1wh9ZZB) z8L8Z9WftWhr^M(feXWCQe zYajQ=<%C>`<=qZ-EKjBmR!+V&`u-2gcSVf4Mf8gTZ=MD}yEzgoLz=onax!9No)dIk zVHg@JCbey^)gxKR>f}}pYDXcS*l*)U7j4;3#1_{UR^xor_&tl{wnS{CiRSeyxr{)!n?Xh61&KSqXRUPw$I!pbd1EhVyW zHd#!(SkuR`$VM-MuFKvk^%7$2E6+_$I&q8&305nE7{|0mPGsZd#&pFuDeZgb%L^f; z*2+ZWN(t_&#A;HLSl_4+KzcAUAm<94(Q*Xd1Rbn%>C= zmIziC8!6H}1i}6AhFO zY9A_Ru>FiyQ2}9LLU_NYR|PoJK>CU*q(nlT9onge7OP`t9U`*Xbc+CD=NybhxNY7R z>|N7p0*}Py(UR_Xi(p(hFHgO}dST)7N+DzlBxvfQHPGaPfqrSVXip1XyM*N?slKZLj(BMYEfGN0>xxI&dsPkys{IicoZx+Wc|y8n6YSv5c1|@i-xy zd(U5{Xkh}!5W(ls>JlRhC*YbV&p~Gg5BM`#>R6vgK0z)0aKEMpBP1>)(7x0?iPLkJ zWZam;c1zr0;D<#;8F4-X5(dgIiB*?eBf#^q0Wb{N)I{d76%M9vD3y06YsT4R1}aT{ zX6Shym&p^U7kjGa*pGP1TZ%&d7i$lik4y{Z^XF1gaDUD5!Si?&Br)#fNGemi!SuVU zb~Tj8T$@8m&L_V`9pYD3g!us!UY+h~BJ&>i)+GR5Pp!3mc+~E&Np@F#lDC3_$(zj( zfSR*|DPW&g!49qAwxuXBOZx%?Lly6;eXZF>YI~`k5x$4;Jpr?ik^*QxX~^pc`^zcR zlojEBhFe`lO-j^iFU^iI|E$v%lMH@yYLjnV7o~AA*Qf?YtZ9e%jfR)q9_)>xfs-A! z`%hJhN#3vS4GY<6a@5>n3qIMSilhs6fIzt{%%l(hYE5zFOLhW{gpnnrdai@+7Ne52 zWvk*vLiEnA%Jl|IiiLyXFM}zyI?}obE{#Li2>w&iSg^qa*nMX@Wb{v}bg*5|XBu^p zgg&NiP8gSt={DI=HrCM^@(c<(m}waH0I;g$}jkiqGtx)Dk!M0(doVzQJ8KGl+gJ^!t+YG zcD)L8vX$K!#;V(Y$avV#$kd3Jfhun|(D@HOT^IR;2aoGcTLI#iR2sxjM!} zvNe~nzqYtJVUh^W;&AfC`NK24{bOkU7D;fXT6&ySG(wF^iRI%%wT*sJ%;E#{O}>7x{`=aaRrnQUpT&!yR+a?sOF(o>Swg?!_!#y z#5wKj%k2a6(fyHvU@Ja<^Y-6>tWU0Nqvy>FU=?(~N0n|^_@ z#aDTPt-r6mb3vN1fy33r#-yF*Wx~|_Jp#s;tR2Wa=C*@4$&L?$X%2#*Cb|X&jz0+uoT z`t7YqM;3+Q+bUO<`SyS@T<$0@yGb*v-GCHcv>Pp)Sw6WG4ocE%x}&LuvSi4q->ug3 zoznX&XuY`ukD05Ri@AwCoVkOU<98c4E)o`!|2o-NdAR?##>VnLMF9b3d2D&U(|4hxRp)-8P_dk%S)01QQKmAg#~y9ZxMwhcCniZTugj-dO7@OG$4PDIS| zAeiEnXPECtjtD1pb@=IBCHX-iXUfb!wMZ_s(R4HRaQk7xd=UJP3BLftt%Dv(BjrgP2| ziIw4nXjX$afkzR?$gBa8MM1Kv!(vW%2Hm#O-L_(ao*+5|gDpO9=)Z-93oa;^Zu(n( zw-2jq6wllzm40YKQL|fSJop!e&`a=}2FW%LJnA96QM+^un1CgwRff9(CtF{_TGRp$a&wBd+u6-o|%yV1dZsqn3IoNzC-I1?A_S&0H~ z^V0i69MgTNTWq4*1s!ip(_G!#lZa8*w(rywj#iAa@TXh0(a&;Y^1+0^dimJg5qM(U z8XrX&w%aPHojFF2_8Z&bvbbD7ECWvt|60IZZ2P?}%gka>_^8FEUqs&y$0|%6?w7!J zJ?$m$HEy89B99tU&Np`$w?_AcqAXu|jye#UKvUws-Qd!jea!qlgR}IXD*s=7va$Y; z7P(k>;Ryamv}_#zDNxRT0;K?^bPZfLxf=af>O?vmG%Q-fIY4jN*92syt@gK8m($8x z8|h11D{x1@3y3Sq#E;yb`)}MDjRD=|pkVKb2U|biT-ex+Y9T9Bd)zJ6QIkdbky0+}*ehB%-m(F8XO8#i z!r!YOqU8O@nreIty~Pv2eER>I;5priga?drMevjE?IMt$?SxlO*iQXBZ7K!Uil0=jQrYX7c(!~?g>Pu?$v-o%T8 zy8_@(u&-k^uQTp_gajw8@b^jgd~Ou2V;kKnjBm4qA?KWGLQayq_}A6Y%SeyIv_-2g z4OOonIhYnrstsj7ZCXq;#@2m@ccokpwsk7+QxK@*Kh&8$AAq*DYo=O5BL#hMBgO7L z`SUjZ9}>B~V}RBbP>gC^Hon0gN-<@@cve=}@7F9x^- zZq!iWyQYR+H}tzZ39_&9yQnW*4@??1E?5B9TiT$J}c_XBW3rjL)6Yiq>WYDr!{Ev$jL)?F{u}Z zm1hR=+VoPjXDES#JW_ggk^@%uoH`Ge%08w?O#o8wH|NXj1Fz%+LT~7etaxv4_gpo5yp{mXlO#z)`l~r5zfQjdWMy;mMzGq4 z+Vg(Njd(*PBZcN1BAQq?%{p&Zay@b64e%BcOLMt`38TL{t*p1mA5-it1$IqfSsFNM z#P99T^w6LOOct;4GiVbJP{M-=&AY`#)}O^6QmVNdWOXM6&@}HrI#H{g?+lkcb!~5S zfMx?LXKmu5Y4M3&?7s?W^fZ9Q?%3CyVJw(>Brnd<>3*>S0pF55eWyfIgJwpWGH|zr zUpwACtm%6|(f~iAWJrHL3FqQFejFAN4@AGU&yo_K(RghQB@GAZ%!K zOWX9*Tallz3Y@YU8A7gVWT$-rX7n7EGCW{?!PDt2Y?iWG*28{>x2@v79nS$?R2oIK zLsk`vEhdLIW);4Ip1yR>60)m3~sI!!2<8aiAG<=4<(u6tLUfsIk zFhB#|+8{LDr{%6!5l$-l@Hh&M-Uk@chxL?w_?UlrkSTb{hb=6xd}S?CI21mg{%JBg zY8$S5dA-y8qd(jhe(M*EgJWGZtDom5yv=-Ty4Ze$`loO{r1sZW3~9nRh0?DERPZUT z=I_XT>5OSQ*B*LXirzvvzE?>(9K5?4ZGB*6gP1j!c?jQKx%A$9k2*P^aBl#ig$~e* z@W>l@k=bo>Pdj0;o27qkl+j@zi3ByYFoI1+H6Kg4RUmp?`kM0rA!eJZrKb`%%Y2fDWk^17oQ$!+lWGCM5!+r%?8KRRHj_@K@q{}f*1)Rr^e+mh8w<-SKH*FufdRUb10p|S zJE@BK#9%^s&H?*avb09bPWriYsE`i_rue8YoF5QAyypHraK^ zd)*JNu?e6T3J41-yxelYh&E1;q{AYc(Pgj|xr>wr3m+Q;oWR9RDT2PuX#!14Ak}c9 zXyNjDlhO$vzPg8|bxu;^9BnY;$51k}f34uPeaiv#zKV}~k4`ud1s=V2N!b;mI|!T^ z(fEgd?@B{aFknR3iZ7!-MPPN*+(>>J9YDo0AbNIhuv$cTlqyrqWTPx5Y8E68w;6v> zBL;bYiANm43LIDy>z`ru(=P;}2AQsQHnN(yDo$y9rxskI_+3w2wubPFd&4F-1?PR+ zYUq?jO!D_Py8?t~waDI?qU|)vqy>+vZ8^9Bd6rzgtU%I`@{#(joDD6< zAHFObnWkT4Q=%%^|DZMSzZW!Ks%HigJ+oV}VgX}kp!8%nv5 zm}d&uAs{93VY-k~(fRzHWcfG)H*!;`{#6-`P*Ej>>JT_OEZLgbyYn_IJyYPRGB`J@S=SeE%f7>neI*PYq#aS;P zm-FIk$^N|%YccE7UW6Un!Q7PjdYOcry}id+YPYc z0t@m@Gw0MtJF~{M@;jaQ0;9L$Tb%954hARcQ8-mWlAOs#0ywP)o}Sa#tY$j>25WzE zrwrAat#%F1Rg1eGhF<8W%`#xOy0KE@?yZA>_F0}6v z26xgL(qNz50_i{XWZ${IYq^!dvH6%orYln<_lh#}Q*ArmPcfYN0bsd~0jG5&dn%~q zybed5F0R*mSa_yyCW6gEa;i_58b@KaF+K58p}k)29B99xww2tcQ0013c4aSajX4UW zTpf)XZ0Aa$k_c`|`?k(_d6t^zo3D~Ex=b=2R?4v_9NSw4mEOa-&w84ldU zEHP76UivmC{XJ@Xk`O;9$xbZt?X>2G%kwhlQ|&e~u}m`nGH3<(PML}o!h`$UOCuwE z2p3^jw`EEq53i@ksoTrw4-H%SX7*az>|DcMA;C9mZ_Ymi%wkfKKvH(;lqS%}1GqjU z#4J=-#}G3s)un$uJHIRpyNKa@cZ$OfO+vM?M7Aq#CQ=Yb67*T!tLV{XZG%kV$HId= z#P6IqXEN7s(jZ(H#ONdXnRahfc5M@zm|_KL${p;f)%JnVeL!w5z>N9zAklBYOMsO;S zw7}N}PA6~?ZF!+gPVm`|rR>|kr)d?HFi@zRIt!!eDI%B173^(i9jhdt!X}d^@e@10 ze=aRo*So9|D4L|D4=n47Uko8S%Q$_Pv^Fdv{q=KQS8yd)Qkk`Fma8N{zus^qsgKGI z@@sHwQKYLfgBtRb;)v2oM$S_d!rN86zo7bk7Jc3q8BSX|+v=(`Q5~hD$<g&uuH4&S2xIGX3QC{(uL^NCdU>1OW z3Vr?-WgxFIq@3!-qd5D@@>eWJ8Tn@d`ffY?4 zr4;o&76TxY1&P;bB>wDE*7?hS%CO0 zHA~HV?H0`c!LA1g5D&RRVu~Xt00&utpMnKUJcdt`lLUh@cVqM~B|~7y(ZQtVZODFP=Z6QqW4smxiLK{jpHzQ8d zRR#p-(Zp)zpDMmaQvT-x^uwu;nTeyW@iWS`Nrz|y+!B%m1Lr_p-*q7+LJCh5KgNhp z|Ixk`4R}W5Hn-CUZk3x@dh$cYy+GbRyYRJk*E5yrPL8Hnb47Z z0u$TB`>itv)HirRHdV4X_ECCE!BTmf;kc_YnNBIGvePa|iNK|pG*!bj(6GUp4c9ny zZ|Ho&oEP~`x6%{T{GM!Qgo47LRl(YA1v9Mc@DyCi@v;bK#Kedm{djq-5JOFlr7!@7 zlZg*5{g@MprdbN@VM@inl2;yp=L(*v%E|Iwg+ECLt?|?2oaK0Cvt}wzY;~ex95%th zJJF@OnUN{>gfxSyxU*j2(m&Lw3=xrf^AnkX{2(IHA)ODHQwHIx_wT_r5T5PjW3^D( zRMY;@+#x@| zi*Cj=8#SgYfv|DmjK)FRz~Cz4bwv*K`GYDZumP4-PR~J*oY-4^UA93RgQNI;#(P}8 zFe*)ifKo7mz=Q@}R8rBvF2v@0OW3cI9*(Sg+Qj2#g|+)mp}#D!@9@jpd__60KWs(! z1dbFm@Js@7*oga|7yl>#(`{jxeN7v|__KdPADAarR;uGzlP3hEK1D|0#&k+b(pOr(z!KNo87SW*Lr9UDc7SFotm3< z=JT4T$OHFdb$S4~pP?e%iAyUGRpR!rC+=}`e-*#|g62VzcZF8LSf|&Rz`pCKS*ODE zp$NJVH+q{^+*PgcZWEox3{5Ob!YU7Ya44c~HYO2(p=l@L3tZWFd`ZO{mh{ewI=zb` zB99}VjoeKM+7=rxGZAaZXF2&Q^dlM`{DD+yql?4dgfR&eE?w1w>vJymo92G5u1(>a z)D=hV+c4C^TKlmeDgL_7At&IEd6Lx9VZ_#QH0l+%#SsRy-9w|9Wvx9L9r6_rPhO3^ zQ7r~u?qLaduSD(FJE0Q9pX^O*SkMKHE)mKZ3y5QLNA6TYbKTWcmUPi96P+rY!O_L^ zZjOdeTrhy6JF86gFLpexSG9tYi4Wo5zNg$zj7WOh0tIO{P2I^~cb|I4zDy4yk8%P6 z{Z@ZK&VNt+l~xuo)Y75)G52D^fwA17!vJ*7!51irbzR$qdcE!A-;Z}AvVQv|bo0ht zJwa~pb4S)I*zNq@zO<_5S7R1b&;vua)}3&gUp4^jo;vQT{cZ!>;f*HC_Y4^v?aFC- zu$=fb?4PA2?06T#CSJ5N&>JI)#P`EcX0ejHevBbo*m`^6+ zqx}><6u&U6kdjP-4_^NiI@U*0tY2-cWzT617X1C~)>-*nKW6-alear~RV6gx*5&Q6 z>`OfGA|C%>*+Is81vY@B(klr4D`6)$M$}eB|g9j2rn}sM8M(sY%fa=v-27m>aZ@%)%HiowKURk ziRf`Hm5bT!dJ68_X)AC&7I$n4{Gu?ld}0Th8{r=E&a z#aW#u54P?G!XJnsV=1yFH ztW|j@Lk(-Fze4N2z-~=VMg9Y))CKr~J z(XrOePc&m^nX@a&Aa}GjcYJ=s83>tk2CU|xER~uh3^`Lv)%!}vn9sD21Yery&JG9N zgMraVfsAXvWBv$Y)Bz0Chq|}y3v38`Y+~%@4@`F;SL`%RzpXdti~lp;o&53fbubu}n0*D3 z{oKvO;5OJX?7j0N*uPm3%OTVNZ)7XzRn?#D3_L6bweU6M_&Zk9GA%Qbfb>j<<_ckO zR%3m4RF?$7ku*;*3jw#)hkh<%fB+0jynN{K+2C#X{1sg>4+4xhfMk9dG?TqR(yGx)B!0|=KL3%BU16RiU(fA7=%>SSm5DM&k6Ll=Y61OhM^GB>9 zOB$&{rS+Nov4ucu^k=IrnQ4NdZIq|4<;u&&afByc2SukyrYi@*n5p??HlwrMwZKV$ zW4f}|8^dIV6Xcaqk47pjFK%tY!9D8V&W)QMH-FI3h&b0N8h0oYYo@>rQ3}oi zO?>y2I8!tfke1Es_`M?P6jqWj^}?$Gv&^*6kmpf8_=~>ly!X@>Ta3N!kDMV@_t^Me zwp{vKRTghC3A)41xl$~z1C9w6QV$3eCQ0{8S+GU5NAh`e0*|E5jdbXhx0x}oHEQu3 zf_r!p#+wTny0TixTF5NUu1IC4SZW-~(q-u>H02EfLNbpfs< zbiAi>uvTe7n)h4LKV_Yn-Is{VPxW5C<~^lE`l;Y2X_87u*;<@F{#zf?9<;32$DxeM zw{H%x&Gu|6#fYhXnuH_fLYm&OOP4QXEg(FiJn8(b&?$;|HXK$|-Gqm~WXdP)yM6A# zexgXz0u@f_A@U_fie{R$M|&M);Z>mFk;dT=qPCSOE*fCcG`Y+%J8jTww|$VU)NCY^ zey-397AJP3Gw??ZGiuq2-C-7OJ>Sms)@?ZzWD@=`T#I^G^O0v&t&bKtbMsz@*@$ zKEwgC!H~FM?@7_!O)NMwTk|_~JsO1iXpyE8ti`G%osq}xFF7LaDzgzY4n}u-OEI=f; z)e47(f2aQPp(qvDZG9n(^MTK@=B^mW#Fbc&UB3jQ+0Xq&lb&#sV-=u42!q6x*Js8yd)-GTVog^Xc(@I6%D}_C0>%2biwss(4Fu zbiOX%+Ln#Z32KYI%0xNAuQ)5pMiz@c*W6S{kSxu%ip0{OkdwW z!m!y0+^ZA%_szz&rdme4>MhTScxQ{e9;dnPp6+^YT?Fbr(UG4E@7WI25I?DjsTSX( ze*p80KCL;Ewc;OxE}RW9|Lx)N#W;*@=*KJ9SXZ}ah#$b3|A$AXpD^rqg6DdNECs*l z%9*)a7UyZB_PV3KZr37DwPv1WIlBklasLbH&03Fb3O1dXv#8Hs^$F>xq0*TPJPufk zj`!3>!pg)=k;-oaF}rdWSF#5}w6m*JXRH^HHM|zaF`p-BllMtY=k3mm4=}?Fk4Y2Y zP5ZaqeXGD=?1+l(tv--xptf#jju8QBGFm#x@Z4Nw(6TX~;Gja4MfUDYYF&Hzx%N97Sty=| z^e22=hKIs2*dc){*ZrSizrXLVdp6#GA8+sTw&7t^DNmF~{Gc_KIVk)o!0J|)Y;zZ;2{4z!*$DYBY0Z!J;2Bvwz+lmtLn zUoikG`5x8wf-czaQM&EhJZ-W*+;OC+43Pw+O{b0%#85$@F0s~@$zf|J0u>J1q-bPT zU|yp!V3+2M1&@nTu`D!$?Y)2GCFPYH(N0Y(&h5A)4 zsRUTY>+HW_^*c+Nk-ocnp{x-SdIci8Z4m<`hTohljKFzr@%(FT!aOuOIM=k((wyC$ zKj1EtJGbrW+D{Qq(FE*5CFnZ9PYPVd{p4v(r$wWywhy}4Q|l5LFn!!mB>!y7c7+b1 zGI)n>^UA7Zc3W8*aZd-JY0#c|E;v4vHg*Y)HR>OhhPDe^N$5sNShL${=H1Jh1SJ3= zH=#IqnqWg91Kx~g)3>yD9A@oJba4h;*7Y?Z<8kDWd{)MiLQlCR%UH%utLChOtoZXW zC<@c>t&iXYPdV#q7M-#Oy3HlL2XON>Er^oR6cp*X*Dr*D} z#CT)CW_E%Q(u2+^1=KomiO7+fFa=N1qE4j{WFVg6JJy*|Dj|8Mmx^uajy7ysM*gPc zKs<}hS{YGlX#_0tenU2-2p#{Ab&RYiW(*YA_3WIN2>sm!`tXk-KK!Z_8tBd!p4ymebQJKr=iZE)TO`4$(f$(7*_0jRFGvoj)%g{8+0nR;YO% zKiXZrUe1?19kKe1a+$HTnCpNU?7JPKX(OYlI_bcNw=!vg9hZ$Ja`o|XjGxjSDHrhW zT*gUwlxaMNT@XAvmc(AzY4c8UKX*q;#+5s?x_a2Yxm12tYu3Bz>0#}nLU&pWyf(zyIGl`Rl6|A?4+w#tsab-6USC2k1|9IGSmpy3RU$;)oiD;_ zmdZK@L`lU}ir)lqv#v*YN@^6gF1Rw9Sbbz8Zu@QGeL_BEq~n;&In--&LF2j)ypx;qNwIuaf+ys2ECMZYvP(qtI4G%^5(?|Jd>+o zORtKS)PX2o*X1`xZHM}=W>jfGxvU^r==l*hh>_M@LycdM(5*n!d>Z*Tkhq5hD;|iC ztx)a^4^(AX<7yiGc^f~_cjs-f4J4Ha_GY|!R{^J?pg_@g(oGa@y_S74QxR5>lWD(4 z%)4XblKR&oLOQcX%!)aJA{0I;Mi~*xA_bR&DzH`diRuY2nYbn3TpD5vOqr9ArSO7*h;qWF!2NhP9sYo^1Z; zfm}X}#8kmIunDf(4-BWWazzQL@bZzEQ|G=|Vbis6XG=ndC)&z)sp~XLGr+qs-Tdb* zMpn&=Z+{9Eg?;cMrzV2juO$xDyEzsWy~p5NR!XQ4{L{=|B~rpnf%+@x7*eevqHj^b zJVJ%&nR0-p8VXu?bzl!3%(zMXLl;cUh6{f>GG+v=D9L^&1g`b!JWs(lC_4p*2|3PN z+X4}s*-T*+lAihcCW86pE|w?K!0F?MUbX{MLm4PIQsaOwXc5iGW&;lOe*fz2NR=k= zfstPo=cdR?rKB;PQ3>{QKc3$`Sq#*?w)_QsvQ{2V?hl^7Taa5 zi!*vMP*nZhw*m^wia9o**%5>&_Ui+s*3Qcy!AaiFu>?F6;u37)1IJ86Lr#41iKQM_ z<*@|YX77@(m0`stEEYP zbH=!n01d<5?yaF?1+q(iOP#Uu~&Qv`Ljqq z+TwlFXn`)wFP$ZL?BuT*s3lwumj?LWlbZ50esvZH?c3;W9+^YE8Xr6j-p&4Uw)}(a zkv6>a{xbYx+wA8Z@M1FuLdOSb{RTglhWN=b};CdV;GyI4(dyq@YlA>UM#}ZUFGFf=E`QmcR z{CsDmNGYiFpB+8#|1|Gxyd114_d=q;rS4SnW-Ds%wORp2`J{9DzkOEd`n{0-(WvBA z&5|A-dW~rQkhM}y@p#$z-}|Xb9UbpeN$tc^fcMOz2=yAXF9L9)inS=ri_mH*D;hQp(lao|$C1hM$dPW<8P#48o zB75w=s?t|sGgtWY_yaF?J}WQPkY&QKySd~-f2uf zoAG!*&EK*s=%(=>g_Aj$wINSU660hoe0@E*#ICj?=gHYNFFt)SD-Tk+Ep95Y@J0q* zrb?}a)@0fP7hE$}8)fU8tp*ss0Zd$rM*Lti^1!fD3UEvg2EqZ|jGVfUt3>@pt(+oMHUf{^J8X4i@d9_O!dl zCJ|SBsyai+@v%@W+7`O_C_JiolqiNZ3fIr)gW=b|*4f`dnXEToj@w!(a4!Qu1$9|0zN0IT#ldHF%vk*j2@ zGJH{7NxkVJzN-+*>U7!TljjImNqfw|Z9m-tmR?_x2YRNXUUJh@nRn9)>l4qw2?O3wkQ8Rr1@OllnHZTk!te z`{svfqo>gLi2v{f04Z?Y9q5G^rof~2ZKYtvNegj35XF>1_5~xiuc9lUodQ#*RpB3m zis_`@uqhp#)s5|=i0Jb1_Wa(?Hdce&`ZoKh{MPQow__#BdO^&*aaoIZmK}%JB3IZQ z9i^(YLj9sPKbdQXR;+z=#G4d!ed{NGcB1@;E?zj!VV_zMvAhxBK)_UPqd5hqASewn9mwBa73)Tc zlJwmSzRoE8)!;lDn?BJ?TjW8ma`As0BmvqGB zZb)zYEouf7Sm^IsrXCrL^+^-+=_zT&KjMQJ=u|UqbYF3>cfw^T8%1$_N(POrGm-TK z8SNZ;2NTf_-k0s7(hyf)`S+hINy-Nf>h93w@Ikg*F=CZ8_tn9OJZ9ix6;Do^JLGKJ zN`u7d=eat%ZMGS0iQ5kyz0Ap#F&CT}_rNo5kmNX7U;%k|p-K;z^N*59)KA{Z_}f0v z81)!rcZvB$NZb^v(cTr_wb<0sR9vD^+42>W?^kFzR!5L0G?AS)ZPnQufe2s*7CJ|x z#zIU`eA+V}U}7|IT})?=<=(21PEEEfDQ8tCQt$(&cnejC2XNsBVpOUJ0tv=z0n&z2 zJ*woLz#0E60SM!|9;3Ef zc_&fyKPEW8?FaA0J(qcropyF_gf~<3=W5Dmfg?a^LfRhdB{`Edb)S@UBx-{ncFz4!f*h>m|+%^L1<4MSdJlCVO*SSMOoK{G`RWZJJ|5g1Ow^S66rhFVXmS;=#>)Tdq-Qh@$| zoeF7A9DxJ(et`Sl@QHit-wwXmxQ`5xA5w?`k{0{2BHv)!wSxZpXf!?0nE9Go5231t zm}5BIv{K`Q2B~?J@0@5)>vf*5`LZlRcU4`lg*PvgHbdF;w5v>dpZ2jfv@3yED>Gl!;C#P7FDQbHf*h*6A8wlsD_Q^ z&9`h(V;Fbj0xu#*D~GxzrgDyvxJ@(&2{$b3ouz_lq@zk(1kTXOE5>=f)N0s@U$JKe z8hhuZK7fiiAfFYsNV*z@X1w(QC^C{t%sj$iz*(LBR^6Y<3rZMu9W4B;g+rj|0az!zZR~{8 z8t1RxszLQXsoVsc!wXL%QlSgUma=b~Goa4OYF}T8xh+$%ArnLDiRr^8%+B)p-465# zguOb)rjQZf^4k+lLA9@y)FHaXvPTP+#Qbr!Nw4u^=JfogerK2<l z)?pi-t>7UGW>}QoE2k~J6rnW8A@R9Hmq}yC)@*^i%$FfA#Cn*Y5y&$yZQ>CvEJWDKC%kC5Me z%9{@z{&(u;k8?g8ii%|v<@8392(b!Z&_h#h=Ou&;t#KVo0=#-Z2AR!y> zKoS)HH_q4~*#1k|5-}NB{%n!)#a&~GgcHTz7@3F*t0N5#@bhniM*ukC!;1;lv9a5q zBb&*K2>FU7fib1($%2X6e9nVoXdPoo^qVdr4shCW7gM?%uXYgo*Ybw8YY4 z1ci(NK752B7QG2M7eVGWWK zFi*xTqH*mh;zV0_=}FwnsHrS83?3r9_YITwa$teR>$(nrt1P6>F|eFv55r>FyXxUdxGaBe^qQ~EGFK$4@5f{hUIs*QT#$TW_m zw_HVjPk*np@RsuS+87lRG}QpDkFcG~CbXm^MUHFgB;-NNz3F+kct`EA(FwEpL@DMp zoN;7=#JgIlAjS;~<>I$aIb)Sh?4IJ|x3hZj7C_G2(GHj@B+xzgVxcliTyhx9a#i~2 zP--UMehbDqIqIm4kjkDzX=JV((0=6T=Qk8kmlS_co52nk$P5J8UoAFYV%p@C{?v>>PBS zmM)KbyadRyFx3m|ULoS#?GHd<55NfHiKSSK<+FoD>Kx&}85aH` zTAlXAlykt*wz$?u`-FmK-sb1d`r#_s=F9%pU1#TfDkTfhfk=sYQtKg$2E}CmIYVyg z_|hF9a2kiKAd$Q6>!Q?3`x#F>`#}7-=H9SU?v4hL)3yx_Im~ZYP$q3Py9O7PNLTzy zvH+UEvdKR;*X`CG2}f^h)7}$oeGQ=KP9`->$hN=nec}REIICEMOeG6FECvnnG(U2G z=|9CGk1~<`qJ&z6Ab3%52gjJP?{g*mP#2R6i9mDh{7KcL=2m9Wc!=YXQ-G{coPF>u zZu>8tPc?1x2PkIMI^+M`C<>(umA zD0$yJd)DX78>6Ge9XS+K7EIPcKd@p@lXgOiS(lS9&VgBsgw5ic1xSwVVf?t3ydZ$P zD?a{$Y&3tKUWbXQ5ZoS^uPPiBXG3O5DEb?dY5CwK!Y8CiAvp)Uch z+b?o^jg!DQUeuoo+3bwuCxS2;6Bz0xa&;$&y(V^*eX2Nc(%UH&G-X8Qr***Ioqx-E z^Cx7>lRHUynY7X@Ir46VT1x1Yc1X@J*K-D|bCFpv!|MdqZ}JAjE$ z(Qo+Em-yyc{Zzf-UXa-NT_;6hiO<>7h^$;T2u0jdXl!vk2M%^R^dhtLX{_vt@0=Tv zG$)_}lMR#iY!2kod&;fAl*$+kfeIHXcrHV1tMVki{Pza4nFp=$tZa zZ*oRo(zDz~aK=q|pa6U|Ldn*|))8rpfFcVv*HldW(y92HGFn`mcbP_E}tuK%iA zd9`@RJGFGg#&%45eVWV%IIv$?L@y(okHjxbGojn8W(>O2V=FX2iQt`U-{|=baIS}< zFAP!Md{~IQ2I6H#3Pp6FVPEIx{NCQ96Dh%RRfD7U$Tr=ELG!Ww z!W@iZ^5??fb}~zsylzZ?dyCYsbZ8MuKEjTa?r|yFT4E&9EfNiMvzhC=AE`mu-w?$yGF`E04BS*e`$w05GxOR zsF@fI)%!7&1K~CsnakzEE5Wn>dfsh{w-MN_Vw`Npb1yjCC(U0%Fw=Z1R^02n5H|6v zyZOA84R8S8vsOz76bBKPwewzs&z+vb9cZIP_=QA8(K&2z)gQGi6aCd{IVtF_){!&X zR)_E=D)V()`Hh2$WrwUAFQT#jP6_cCICwcvaE{NZVym7Z0!Jg_uG2_jJV&jV%bUoz zp}97PBR&{y+`c%{Tmu!X07&T#O*KysCi_E7n-}S<7>9F4%!p-9^ zZduRe6cfQ4xDuy`Bu7=k(Zr_bT&CEj@D{e#jQViaX=on2RW_7Rk_X!$IET$o!xqYk z$>xN8^abUM|7K@k&~0d7H;e2SWp6svj46txbrh3+m39V2)!OJdq_I{nYwme>clz-5 z;L-BEPRp?lfOU58cyYUF!$ZroJ`#*LnFiubBeyx)Yl*6s@>-pqiUtX3ivj^j!wg|f z`yEB(oLWu-YXU9+7Xx+Tl(vqpfn4!L$sAHHfdVU$MF5>oT;t%yfgtVm@5&%qS_I;j zigt^CrUsHFrM^s4O3){=Up~dMsP>R{-Ua7&$Fju@V3F0&&bL%EH?$2+nzB`|5{F9> z&EQ@l_s1JIPKV>$DuufK<~yh2(YF9L#Fx3@Mbg3X+d#pHAt!n4Y!6*f4NBR$d+OGA zV+I3TCk8bWV*Szg6LcZekUKKe0Ff}u1ko@~dupjRTp{BHJ?i{S&J z@5xQUfCW=bF<5oneT=^rCm31L#>#TO+!pRpf)w&*_|mG2l6t8y^{Cj@KEfh2`UQia z?$0%PH(Ikr8o+Wm&JJKdR>oO5r*C3uwrTeBZa!z<0AUf*i>*(GA{ZIg^TR};NA<(GD8&NYEb@zrt_Hmn?tON5o=6~31wR-4W<0v{w8m>EcyZnGSY3fU#L=?AW`Kv7&E=jl@pH5NP|eP5`Yz>3?bL&; zL@O6pX^bZP{tu;y57#5GU*DV1+uziG?w65Js)H&+q}q6!G(+5@o8HQ*|EwWM zVr@e@{S=6sK%5$3uuWhk)%&tQ_LFGc89=oFMlUM$4)nYzHr4tY3t=x=PCE&!K*=TT z^4)X`zu4y4XnXZ+T%Z?hD;hZ#F9cYV4vUDMR?bTj5HezoqtTXwa-*k$X8aQ?QVTV$-OElrsu-`E}0_XumX-T?6r zc~m%7K5=ot&72R=yKiZk+j&3TeK$#gbY({4zsU9oxOu%zT728HGGH)-158_Hw?6Jn z?^$(LY{yV?YQ zSk4c@MZoM9NtG+l$N%hBxn2;+P`RBg<1n_$8Hn<}=4ka>Z4wyd zXtKzqp91Xj!3Wy7S^#ZOHSsVcjns6eL)T}Q@~{GOqI}r(b@-+|y>q4}LU|WGSK(4V z7bpcG#|t`d6!XHwchzv{IMI3qJ5RBu(s<1-mi%C2E;~l&oG7z$+({^L9ee&9^#bQY zR!ie|8jP|OHaCcebc7$3(Rfg;FeZUK2%Yb}W2XcmlmUW4x`2oViKV#!gL>Ag7-fhe zE(~(#5>3tk^uMQ+qy9Bl{eF)Rrrs>Bxr_790Ra>4C`j*1rUpkcSmFl+gSLte%SfY( zbcqLPUWT)m?$RN>$-r-8_XXu{KbVZHBIyFX5x)Tk46U7rE-a?y#L%t>NRS_^y(Nz^ zb6$$4wCmC=j{q^AR(BrGHy@q2<&u#YeAZ1$1{f%|07-QL^&hbHZoD9bOWsI7;4e-^ zt(qbc|19{;9$mNsJ+@YUVvvU~1@jy&Q3_{@A??;H2JepGD1gYe;rj&;yTiM~VXU5B z+jOVOMB-qF?wt!I1c0-tI%p{nmPrFus_7^PEwi5QJcmkV`^XIy zHR*EAUTwVu54lKTc$P~weu_kYbT@Jw*~vcTL_K{<@soF$_L(!y5j%RVIxaA_Mlyut z0uw8RTvWdi&3?z!g3Wd;wLmX4>%V|o4euMZD+JJuJ1RAB*TcVizkR1fOp^Q;A?ORCuPSNE4^l5qrUC@ei|YogE923xQ1urfU5Tutdd zW6FR38B(SxcV&R2cOyjCJ;wbt6M;s3zlLC6nujNE%!?jj4I$<}fxkz+Tesg$v_DN2 zg3mHnQE^q+D9YDZ);U`7=b>fgytTaWj^uP2Wig#&DQa}fSw9YLVRCwZ>-y-E4i-lP zNTh-X!OG3a4&+x60rp2C0m?-QoGqSh3;KDZlG_!`>WV$uTChPC;>kHN#*|1q5`kuBih}qB}rh`vwyv(AYAq?&reh_hE zdBCJvhOd#z&rvC2Ic8&(nuM&eTK#6O*fS-rX3nHb(AIMsT{SY?wgo@h9k7#;zN4jB zb!CW_cjl#kZm*aEbgrtg$$Ed!x_YTNl4Ej$KyY|`SE{IS!RzxY{a}4=XbLsT?pL`D zqVQ)J67`DStw*9WD0-S!6u;abAg)Eq4bzZ)hNTby_6wBho0>^@;w?c<6gkA!S61$k z_lpSYZ;egjglWeXXP5u|Zuf|Z1}f!i5HXlHF0{ObXo7GE5GGLAH8CV=eYJLW@9ETw zBZH&Cfn1OWRyt@lSfpCE-Pq=6!LRSBhjuL(Olkc}PhUBktP0aP5#YZ1*}l5iE&hbQ zi_Cg<_h0$e?^=cVYj|{Z)B=7?RbhQ<;Fdz?gg(N%|jD4dMd_`@DFRsDQInW7h(L3DGJWOGnvgEO_^n;?F8zDY9;PkMtT zBa#lew*598Q7K3{slqA|C1IT#``jKFwr}rYe>jq?U?EZ~eFE;2OhEZOIlicbiy-kT^7Rr(#}VzXRm>Xc{)orzB584Nh(K5NKOTMv zkgIqGc0>Sf|6y&f^mjB#Vzq#MYnNI$B;*>Zc*QLtskgQ7d*bRpsQZ7lZ~7wdBE=^n zC5v78NS%FrE>R%n)NiEwt4LLv?<*I%57L3i0eXo^XU!7Tb|NG%juyzljXDkT7hkwD z#DyE|3-kd5DHeTf>;8+hJs_zeq8MV9G7tf#1`_6~k-NjD>z+H@U6!+cH+u)FX%GV< zlO_;dwRFhsI^DTU%g0jV-$9O%u&^g5V=NsHtDMb4mSG6WAWIwmzPui6EOnj5ES%J(AR!YHJo1N!Z8A&)yK zkWEv}sDCBWpW+E36cQgrbaF4c$RtPgRpO<=)mpszz{U0RHR-;hSR@-b4%ocG zIK>pa{kE8-E`uSK7JxTHS3*e4yts+YyuahW9`i=YauZzBm+JmkNk2X?)N`Nd! zm}r0Uwb1w?nGssQW+lGd9{jda0%h?@%qY$Jy=6#&k|qjsq);gSE+-0N?n^w5C-2<} z)l_~+Qlf|PkL5@0_9JSo{F{`kRIKDr$nkIwSf(M?^#?afNOtt;rLr!mVnEM;#6KFQ z-)LK{4c{@ZeiX5nrFVu`#OYl}xabe4&5qU%3{i|8XDK9xZp{zocnP6m0fu!kOGYpk zd6I5V>x>@a4H*)xuW3c4bES1$2dW8qn@|}_28Giy|Go2qI#1t9(!{%z`0_Be`vNofDnAppKJ9RJ){Z28Shk%g?c*8er4!8rz$I(KTXq3{&GhT z;PUdvn%07=bP_Iwa{Vj}<0F}Q{C6QFF%Dxeyo_$^K$wT0Hf7!}e3{XIazZ!g>rTl< zSvBiN~^82B@GB$B?Z2swTVX z!qu9S0jtOeluy=!JYN!KK08_^RmKZqY*YLD-FXZRg0=S6j`l+tDKZ&Ucc`m7^an0H z3LHBnq&je2(R%FU`>KNr3-{5QRR;`RZ20ORGth` zdwOA@^+fB&JPq)g5pb~7u51TovvrB%)}u4$=~!!k*mQPW>YMZctyRA6aO%fzm3?O{ z?8m~0UK5M074ssEEds_znSo^JK(+ef!c!?cjeXW4>;4m zXa`AJ&OO+5VTlGqf8UzfOW3f`V>B=jNc72nIvjb=T=YY71;i2?2;BelV0eYrtxm^A zAJqi)7EITTtmx#u8{koa<|HauGER8kv+$3GS&fhX(lAxgSsZq@!GEygcWH^?wFh9tM=9XK zNCG#58Yxl%$~IOXCHw5vX(G4$=ib$+jmnq^6G3P;cBgqMB_#A~R8)#8!nK0_R!&W- z8x;~wH`Cui&qxvkisl;%Hgzwp*3;nQin&s}1Xb>7c4-d9t~Cxs#}lDwhQCec%zLyp zNPmlO$Dew*xHFZ-Jz1Tr1c|g-pM=@ChWBID|=8r#B`Ke7-*rQ{i3i5EKL4# zM#eQG{D~D;bWy#p5kURzBz8?Xv68N*u^}5J*q`GP-yhs!K}b+DQ2V$z?Ppt)sd2DV zIqCN%v7|#|z3Kj*!+nbjCwcu~`nH3QU}r~BoGDulo?v<8$#wEWNCZR~MDu{aB-qxk zN`&3%<_>FVF%}$*oiwf$7=iu@8SJ zNiAE4@Ap@rw`9KUfG?oOmn9(meaH9iL;riPRMjgAmG{HQ)fUcHSZW4J-VNaChX`(W z_0N+RHqGCC)20O_b1xzIJqPcvvib#U?L9}<91L!L_thQFr9o9(e|MH_rjj`yNA5KD zTd#lZ5ojF@CyArscxnCWJ-yV$^bt9Tj9JmXQy4AZ!7)U&Y-E&Ca}=Q3Wc7ucmsGc+ z&N75hQ8ltF$rzOM-XEz8UOZ;L{sk$`53%H9b5=7m1e=7@ahSY@pF9I8eWUy3c~K1+ zpE*mRlHO)kECFHppI{kU^+iBbZ9E7zW;RYBleQ=jG?h%+)P44OT@d>4j?ZNBZRWIcG9* zT2+(*&^DC_0F+B#BadW>!OPSyy>F`` zlp}=ID0hJPqXzKtsU|ClIYCx)hvH_0!%{_Y@2B z*KcTNf@jXi>Z74=JqLj3GXMJ&-+Fk}_$bzzgf309d99S2G_D^K$UjNZtaNFR#G2{^ z*YUk&fjDo18Th;38Fb(M-2I!{zsJ4@3&-kxaV6Fdv}clwzRp~)e@11{d^i*O(#wd^ zva<}Q0hUwUf!(aXn!aF>Q;uBtP?jkx?(3Z;znh1Pk?Gsr*VFr)Kk&$-g>^w4HWG0} z8U|<}*-Cc(r+)5JlMiF$SVjqrRPxEjLJC#HMpzzigzb7G``=Otg2AIOLhR-&bGMmK zdQa#5#x|y@%SD1e$XiRBi9M_A*<84jMl&%z0W$(h#HFys!QlnUY2v}2^aN>EGvHS#WeH#GF7y>G9CN80TmnD7=IhG7Z=5MbJt#F<&nMo@18e!=)g z<@>c-hMOsHP_N8cqJpBq@MavE>&B@{nVdh63W=ztv%Xy;2Sl{(&IP4td;l@NIAH>GR#Hr$5@)jQER z5&gWq3j5lECB5>+O_l0s?!`u!4SzRzN`#>^FSw0@hVZRHHDmOtvHet8;7R4H!SJh4 zs04nwv!^+Dbzr59L1D_r+Q*lA;UdJd0_JYJ16R#{$ej664F!)L;19}(L3L_|z2SmN z2%8JQ#^FMErL&lV4Pj7=9iC`FN~WahURY@Ri$C=8i_tL6^~f5A57X#Fp~jaVOiDel z_9y+O%O!^^*9V*M!xIOQ6wT4tunZI(@eN{#{dEWL)VMU@WK<2&d_-jlx?4ou3gEVa zD%mzokQiT`217|D)ZmGfAK^-oZlmJ4dwTor(b*4HqI78r5Du2PD&Z%YhmLHN(C2Zd zxnVhpf+I0GMd95qK#GV%Mu3r2pT~Xa#=S4QM3AATe>T}V##ek`Z^wbuLr4AU^Uc?ZE4YVnnf6F*tmt zUdH^a;!q1Y-J9OJbK>UC+^LbHSR2<0wiZ-AW0~Q3A&%h!#{#qDU*AuDi|CY!PY~eo zBzRLMZl4?$gYQ#}8RVT@+XDU>zen_{j!pJ$RrInd<}2b=YSMP#tDL)SS-S=b!$W8d zI%+72(EAWQkw=GvZ5lE_4N9_$~{r)x3a?WLS69BBG%2uAB)KNOf z4pp)2*$O^@dt-_ogvcjRY&y(2Nj<3~|A=K#`jUF8f>XU-UB4Lf2`2A(_QfHPmNl?Cpm$x0GIFz9P| zeQRt-6{I&J;4N_1XGLYG)RMWl<6S{Ny>TSACv1hdSWDz%2WUem6n=Hsifj)4u>i^* zoY?k7goJK7AXJL@Y*oq2lj+l8Q<>*${GgfkB9N4&6KDQ1)w^gmG1A>1&6_@h&RCk& z)!0Qm*RVQ3A57Vp=DU^Oyb$`bO&pCYJ{m0Gi<-5_=I4^>_M4q%~%)tVO{RK(GEL>Mtp7OWih0~Gwxu-R`n#Hh`&VV);MSXUyT9EZ)_ zPmHF4fgRE4H-HL0U>*fUAZBkk@TktCMbZcs{;2@Ts@hQEBAkY>I&oFi`9*|q8-d3` zf`iV}A(pEK14QS2G7i}wW?!2BtVH`QmW&9KhO*ah0YJv!lGY`}Ab+==#^G@Aq4=>! zcL_c&7UP6G#&yxeh+e4+IOn&CW@!#)#+`B%u&Eiu!Z9XIG&rVM1LLaix^g+3Pgy|8 zGNMaCt!`Pk29HO4WR)!)K$Mv>j=bg51G{zbY{rM1G(J3hgi25$2}g2FJ${hVCX1%h^_7amWO2BmjF%amZPjMBI}tWp;~2@s>5Bfx2Bl!4 zYvF>~hgmG29>#p7iZtJUjb>zE0BVJKNe5nzO@7d%+2OFDn@WX$-|h!6*6LW&S|5l) z1JXoYS0^v)p}IW2;}K0>kIwjL!e7Kg#M9Y-$+I+nW~A30Z>yd5rh2NbiCv4o4_eWafQI(%Ru-OU3eQ)=fO_Se1Q=9ViAD@}_y7t^Hy|XtsVoy_dD$+0Z zK!Ry$17(4{8UOPdaIt$Yt##{(=J7>@m=EZfV>+Bxbe|;(z&oz5ZOI1Y_wAiX9jjG3 zLiW0%NC>hG8ZUO`47?6B0wz95tc)C2(cs`E->C^W>`vYH1=~Yzo%S34ClGQDVQORg z%JT(;q}|ef0U@2{$QB>GjFTrN@nM51-HA>UdCmmT=@SZ=eS}B-iQgO<8Bp5H z?uA9FQ#o2>m>a&rKtTA{;MiRTA&W>YqTK&za=dT*s82WrJLvx@DB<{T#QW=QI2TZ} zz!j7mI8pEolm}>7U`@r!`c-bC3MVKC$0X+H;AZaN=1TIfdH=uXzLNdx?9cX}*nhb2 z|2y^{x0nAT_CI;q{y%yDHE#RgW7+Z=vv#l~;ba4q{&wdC%_(q;SuLa4^x22-mI8EfbnJm>n-Pi1E61I7?)Fw9|yrQcJ3 z<-JX1!DfRxc0;0}lNu(3Lwbry$mQ$3)T8?Bf38Po`F#5Pn+Le~bPNb4iMLC* zUPV3WV4Ii}^wFBSTorKk-Fu=qSK@aT-akroyDfNLB>fx$jSmu09GD?xEUY!&xjb9` zwRJu7Q-PR4@4mOqC@IxV1Ir^$m+WQqz29Y4|&M#|*d4Wo1DsyIDK zPUI7er3vYdC_R~8)Dr-f%YC`Tb>JSt}>@(t&XoKsXLM2yp*@kstFdV+Qmx*dS>S<$Qi&q%M0gwBYr z|K!bX4(U-++#+;Jj*o=ze8+u0`URC>HhJb$W{!}zTl7cDK!t1RY1yBgR!^NhUGy#0 z-iIZ(BiySQ>V`aXLTgj|q83~qzU>RrT0~Ey!+}g0Hb8!hvnFA}B;T;@?&h}A_SKH< zi+^i;>sl+e-4$RXepR77Xfp>Lyo>>=!R_ngd_IA<(Kve8$@ zIE55X`h`R?=dko^_9-1tF6c#1dVp8Dh3&CCLG)a%^S?W3vjF1RnmuX4BC zF6!@>j5{$jA%aS}Ajh5jQRyhwG;u}zBVRvlLUYFuegqM7BYG*cWK0!u^CAR^)X9V3 zsL-%pRJ8yiA5>pF_3NOujE(A=gF+xw{aoCNIfG4`;W4J+;NpXo;=67Nz$Mk^9`by!#P00iv)hv6OM#N07w@l{lA3Wps2uQ~-P+mL>-F-%4~h?ogBOj1=4qxS%%80bt+O^uBU zBI+1LTv1M%JU1!=D{CQ)%>cLl*EAmqz4*uwpO`RSj-djlcCeDgk>@KZr9s~d#u91B zj|o%y#bS(NyT!HP;GX-{b2f@6!Cnf4<+1_FO_981jA?&k4+pfz!XiABvyfHQv@DGL zYO~6hI#a-=Q4lw&+hHj6K08Zyce#Jg8yv1MVo?(NrWpP1s9??m3e%z|n@5pgO5Z2j z)v5maU1S9Qo!Dd6d`09F6GWk4&Us9#sgP^`{rA%ghluJL(p%5Y8R!-$cXonjdk!+- z4NI5~@A3_F-f1B9Z>XAnaH+Csv2`CL3kK2K4%TR zp=(U|mpOonv~J06Ghxm0o2P`}BPAx4bal+3Gb0t|j1I!h-Jr1!<%FiCOZ9|gH0AC2lSh?a{&1H;?RMJa1giT0a!+^p?5vqR=cCWg z8@uF1nRKgi@MY2NN9$<`U?eMoJvI=&oQa)celX69wD*Uog~hU_j$t<_*YEtWC@-Xw+`E=k34S&%X;hdbn(z{C2yQbKEhKwl%S)huM1zm-IPDI>m`X zCof8sC?*w>i%>G#QvrcnO2x9Fv$bWN@=$U_`qPK9;n%JZ8L6980!XG+p1g9XzUZ1q zX{?+lqnKwrOkmVRC(rC)S}V%CMrNE)Aj_|GS#Z;}z9+@>;kJR+X+ufAo=tGyddS1R z&*{_lMb?AD7AFisM5UNpia3^KMTBzMl`%I_l?77{H1kg$81-Ubfp-0cA2TQF_WrSM zpH3L&>Ctx|f!?nL0#J0kuqi2ID(Ny%_M(W%gTlxBm`b5s_Ltw(`x*B}R6Oq2VnD&& z$jHwvO0T4)Lo&Wt`C#*E>K3K9;`Dy{5?}e(LPS=?&&|b#e;Zob#u3i=h-vX`-M1FI zHB%c9+duiuZb5$4imdHm42}cY>KK~onGiPxZDdrJ3}7Y7glV0isnSi*Zw; zkk`dYv0zEG73xHo#FX&R_Z72g3!={mJyaz#CJM_w3)I=`elvT9tA`TsXfOZN`B)ws|y%qe`&>qKy-y6Y2 zU#K&Gw-AIQozieyu0b8%hV(P)4Fp8OPg%u?+qQq>AyxSTH;lDOx0RiVQmPxx`wnYh zH`dQx5HNNWavS`6nf`s*09K=7Mnm08nC~9h!1%j^EYcWMM_5=(dqDABub4|wpQ1U4 zANbe|-AORmGn2uZwSOxvlZb*T0j5?C6s|$)!@-f$+!42PrkH2DNrgNGsGFXTa~(>j zT7jVkQ$@5RpMwj;edC1zl5^>BWu=R&L>i^8DFCJNj=iH_c!g8LEw?Vt36tQ*Y@?V= z#puT#ddUC@#8JIi-POaN%iF(aVA*7C=Z(V-U0BKntLs4#vvAcjJG9=x^pbd~X&}c1 zV`)UjSYH&w1}K%s=f(WC8$po9Dy078)O7z(5<$k_Bj6XJw%*qeCH^^%plhM)Ea@7M ztbon<6}_~+nMh6a77AU>0&nr5A$5h9tGkF+zi#~D+aPiY+(H#l9vn}z5XuRCx@p4~ zG?~IY=-h(6o(+nQr^Xjbv!IDxB_ZZUqdj@ADe3T_;pBRQd(Qi9fe1DEmWQ7fgjs;^rK%Ijs%Q&v-pLb-WB~WHa+V&56?;<^#SpB~%VP2b8xRVbI4OYm z)h$XCXXqQvycp{XT6@2=#8^`d0*}PV!Jy@J&DHF0`VvLR`Gz?8Uoa{OmR9I&FO+9M zhc?4ZxQ*y9%P~>adTR&(_2i z)uU}BMFelRzc*IH(*;k-x^C7!3i#8ZYMl`h5=u=!FO-IvT?wg#iz!SmoPMSiQ(9W3 zWS$I;loP2iOKIn**cEzY&dnALT?3wFDzai#y=!rjrHANZ=WQA>-Sa3wg~5`)e8Yyw zSzyU%H0RXyz9%EdXpaZRV@8>X;+gtfJ|Ol(f{WTkq+xMj?rWXAU{wkkaX(a_l5(;U z*Y5jV!Nt0R-NQxvB6+ac{(EFE0r%-=tmx+;p4kp|Z9Acmn(mpae{_(9a}1!mzmNM3 z&N&zPX2)Zee?n_*hrXzpb&6LzzwkHbHN2qOpcDarRSPSpTLwd*RBSvpKBQZG9~&3a zg>boUB*n)d+AAas$T~GnFVpd=m8C5`P~Fg!V}f?b^2B4Bw>P}`Ui$lTN|r`5L9XLc z#CUGVF1Glam609(_o;~4_-sH*YO_48Zt}Pk7@8*Ym22#=B`vzbZc0)|J{G>?u@yB* zlJ&X&`Ch4xbnIlZJz>=&r2KFrBmRD=RSF4snZAukequ+M!pPjd(TiZr=+u%$2)}UK z5zTw36~)08hK3P~;iAj$uVo`0g>=Bz()p$=bwi=ctL5A4^Fz|~_JRTTZkeKtim{sF zAU?TgmQK9Qyr0M8C9YDNq1@>QhwAX(m$B*vk8{nx;kmcl#p=?i$($NurV6rsuUGK{`<6wr^wT75@ImjYX7n2p z2$fT};I6Eyln?L~3b76Vv~I(EU{TnyAD!3?qTfR2rg zu@BsbiU-Ya?3YaFO*8~C3rXrsFZ(s0D{w>y1@f^@JL4Ekb^5)}M9q09S;Em+%Xw*W zRz;;ak{Ufl{Og@+gAzSmmEBzp&-pgd0XjqMqYV7lD1$3BAm}pr)E=&*r^KF-RTcmK z7VJ7B+;fNhv_%a-e-(_qt}T?%Zx+)ts`^IFz@+geDZ8N7R@!H=Z=v^tLA5i#QYGES zrl0NFIY4QtrL^^I8;P6YBC=9wt*g`lw^WvfQ~U9^PDmlv`X=}5rHPc1IE8FWC-*=* zfnE?-m9ey?2VvEvpgd7!jVT)`Lc&Hzm@J5@{|{2ZbnILJac11)>FvcM9f8gJRX9wM zDLR_@?G!?QXt!!Syp>5~8vDN}3oV-T)*5654kzX|fH z7&(zsKwMpI?HzPWWop1L3MN;-Z|GUtL1GK{RI09v7u~byI>^1M9Y_cRHgeFs%+6?r zwJ+4SbTcgh=e$%?;X+Pz%Po%_%aKEJ5TylR#7@Z`@d&&gvsaHw!7B&GhZM_0#$GU% znvF?kS!JwNf+dAq57}EKi1Ab=$i(RVbSbjLy z7abE5TOL_wTV7sXmrxbipSv|W-|EE{(it+noZlNbZ)mYbZ=T~^N|DIfw8ys3+K>wt z*)-hItl;V_EbI`u3A;^)6a@n(#|!#?Uae*q_K9Zo~|i~QtR@vJ%Ie&v^e|Beg%4H3+dA)wg9D#F0XhJ-hPQlRgO&_t)U*y?To}U^g$Uk4pxOMm0bZr-L8AfXX zQ|NoEy%Iq+nJl;BC8AlBBbf5WDCtxhvUg5%(Q;^`5gtDg?>#WJR^T?WXfJ~-zvMSj zk?toUce{eQL7s&O_@fvRKq8#gQsvqdGmU)n$SNWC6}zDNjN5_WeX&8WOn*HnNV;T-MJ{-Ptcw^V7{y<(7`G zIU5-3e_x>5AsdO>{+wZ`=gypgi?P#}y7ggV0P>!)`l|s*O_P?Q9Z7DplXo2H3~f-j zyb1dt9Rl$tNE!tUize7hDNF(YT7sBT_FC1G0fcUC^zitVUp_1dg!FxBXNfr9P6`zm zXWi!NQ^7ia`-K#CHkLJG&h}u6aJvrCv;ajf?dG<)za1bHQ=ICuPnF{NWKGO~y~=7Y z`jEmEFUC*Yf0KPzEl!GF4zrkyD*z&YP;;LwwlGNX|43+uORj}j=>#JNprkhb1^LL3 zUFnDlK5$6uni*X2%;oSN|09|rR*|b#%-HVrZq3A%pvckmSI};45~aE z8!~YNj$GiV^gJp9y~0`VmjQD1!H^T0cicyRhr(dN+)EmtvGwM0Gw<1?l7~QWQhqys zra2pgFHZE^T}hgQQ$m0P;6Y$`z1{O5KyBEO4uW%wWcf8TahLV9^R&@bqeNyNY4|7DMHbtyJS z_4I5cV#xc-=;8h`rC8f5uT?xr=bh|{xVV7%qp|(FifT@~m&Te2s1Exb0CxmBFq-IR zW&F~$z?%&}whksDAmcI@@UYLDgH%9>$Wq~KeRiUwXL*C~YcT<9Jt zfXxtBx}(880U3o`al2T~4X`FDX!8*Y2iB$N(bb`*WmUnSf_^MzwpcYe@#hwff;1Bb zzBT+p3e)%Q2329=fI#R((?l_Olf&)3&t0uEX5o*tX2+da+&#Fv%jKN+``&v_a@V@`W7hOu+iO>??yjzbkvX}E1hw*WoYl;%85~y14-|h{{}PEe>8tjaf;PJH zGAKX9fmFT$&ibe#N!*0iMYbt=G_G%I_u|cr2uDWqhYtR<{pDnxg{EQCvR}At@J_ez zJ-rCQY9TzYAc-4QPA|4!SZlCQ12D>i1gm3K7f```!Fwal<;O`rhL@Ipc(5SMOlaLa zKC~rszKOO~u(~3kZpXw(Ya(Z+>Gb;w{;}5R+1#EJ7ttKqt1(+z-zBygQZxLk(VL*% z%T|RpiwDB?&=;+w$EW_7Z4RTjhjLX$OQz3Ho=)>cmv~liN4_@<#Mx+Kq_0qC+`0kC zni~8m?}u-1k%=#(f2^qGw6~RYwnKMoR4UXgy5**~iKORM6h}(DykPo}H z1qaVY4rw0pp9iQMDfelE)D5#MFjmpvK0~g1PXlL!2de#xo;-z=avS7C zs1Q(ml`O|D&j9Ci<08O^7jH^;DL4-_(q?JI_;p^Jz9prPS4B+D4r7+DUVy5mK#NSOO=RHDZC4K> zGM?zHSq?wB`1Tl)lU;QtjbTHfBlMinD0at{&egO++m+d`U!@+y+EUv%V(MP3P=W7ptyd2jLTxAbvR0uc(r0-E?jEyL z@rB~NR&G-Qg=Wp~h4B^5c(`%1dm|@oq`xsSnCOj>DrrPG<3~Cx-8PU?sJm=`%pypO z+Irm^kPgD0BJO8-tDOmv0J0T=Navd3{P*fB2Ylw+PWhw?Fs^bf5Gx&-g3c6>`JB@c zF4T0P(mxFKqn28_TEn4^3%t;jOgh)Yu4S&ggF%lnsM=T#&Xn7 zK(jF-m69NhVIEu!0NJJl@#~2=PAH^&!uewZbqgrj4bAzvy0uo|fd_r5;EyVzSx!>mwUUs!|zS5h=qgA^6I;Y$A=REp3G_M z2Wz}vua4{uUn%-_~|2{ zXe!`x=k#{9Q)@_~{+qy=;~++Djx2%fCaZqbb=>yh4CW6Q=!_p&3EcLoLyn4i&Lcd0 zOezTtN>pBXFqB}*+_zxbQf>73G@X>@gnlG5+MwB z{PZvS|5*}_M_6Zs;f!Zre+vr%#G^fke`X?r!N8VblVy`*lV?+4Q)GL`rp%_orW(Jp zzJkg5_X_$ymTKciH@Khxz&{sWH4s%)rl(q|hFYd2C)jo2K|t|HX)AR+q}M^u^pu)3z-ZJcr|`v6G9k>O#d1l~1TI~;>AenNpaA7Q=k*&n_9;rDx=PVQtW*udE+ z5%7I|F9-?2(fIF)&dQEDc9bv#Qvf(fc=gxQvS*qbh8$kEukQL-PUgY3&)c9owFe<* zbXFl5?AOEa!7ByBUnps1DFnOWgT-u+(W63~7fD)$h&VfF0F?HAce}{Neq2&ru(d4@ zh0w$9r)5$cF^D(bswI9yuXlJx*O+yb(qQ&y8N&~7YQ5HWQRt3RNcOLt=eJvT235bj z4|WZ54-8~eukUj|rORNgO@mlISPgbV9OAc-H=$OXzS*?zY$hlzur}m1l;auDcd>Ux zEKq7vQl#D9jnlIY_?_l^((4UGr3jT~?L!NbKfT#_JDh!Am^WcH5L=a-sN_(vF@a)1 zwjnzFRqfpyTso`%25=k%6J9Z;_}0p!s721p{h9Ci)jOW!w7_1gyjgFDAD-X2yFLp1`Vpze zv6Kwuh=clm($5dzmxgI0NQKaVu~~DVhGPIMY#hQ!tcqM>ru7<5bNfQ-fL=@21`Ncp zvFf3K0F;aAm!Mi=Bn)v27ZoFrq<*7KFq{|GP(V!Kx*hcc(>~^a*+JkkQ>2H`c8;I) zr1~h_b%b8K#`u_{ebMc^(NesH@>Vei>V}?AHY#RO5wY;XcwUFSKXx4o;3iF>oIOV& zr6J;4>ZxS?+f%69L17&im@zWTx^ui*%_b;hFrDo_dy6?0t??YWbc7^t^U}2V9EH*p^ z++4}9%H#e*NgJj!!@XQ>N8IG_`U=;~#|LJPTM4aC_g73BI?t{xnQ~P-*OHJm+%|DQ zKdKq*UcVHjxi7)dR_bU|d3pT0?NirgJWB;q^rI7Fl21Qdc{_o)oOh%cG>%#CaJs2> zJRkZ2XdHG?iZ8g>@*ti4+Dy~`g=XKShvI-QsR|PD&h5ZyN{WhG2~UAYjCtM(JV^kZ zaE#rRUT{lnP+q-o$h4fXgt20;%OIQ)I_x+M$V5)1{UV)8&!s zVcHs&FQX9+`B11o|2X1vhQ4d|crW(4NWXY&Fdk6l00j2vvOdlyQs4pc*nAVtIo=Ao zqxc1LJ@83)2Y#%IAnKkPz+K-pkTn!{6BZWNEa6d`kwSh$pY^^$$y^)N1ip(+sw%xh z0=`T6oc;b+s4t12=DF;aAO2!4!BE3?zg0+nbm{JrJ87l<{Tg9J3^Zh@!|WEDZxi@L z|6Z@M58dk0zTAejCbg;C;8sGWOyF^Kv!+ePam845M5tMUc13nyx!@oi(-7#H;>+9o z^_Y^ZT}?KEuT3*^8EGwqhv^Q;j1~9T8nvy+} zK*+Bur3Aw3b^#N@#n6|q+yXDUhZKy_H$UmaO{MpLIX__@6u$ha4}Q=8J}?&PbvqV0 zJqSJ9kW)MXJBK@MLue+|$2lV}y&oGfk%LDY9e#V#ZyW#7p(5MKn|KAN*_Nr-;H%x7 zzA%Fbh{L{TC5=ysO;V3tqTlIyNL;Twr?$qtv^2}+sYxZDK!f_3#crTx&V50PwtVYE z$eV36AAY(XQmRI8G4O5u<76Dm@H;nxQ=tsov^w==1>Y$J0{NAv-hKkN#<|F#HoMcI zd3opxopgG0Y|HCgTl$cV~vL8gk}DzwuRU7{Zv_Q8UyD$oUU7l zZIx!V=TVjrPo&b71>tcr7Z3twN_?^xu_j`y#@-27 zvqc~=duOP;w^|Ul zg>^N7ooddqYfCQ$I-XCMO^3JUua3irtd1n#GsfSo_gTDFn93i_ z=IlH%xxjR%5vax(3p_lhOl^flLym6Adn1BcymQoFXu1;|bBDBrQsb-C`CXc_pjULg zQPK=L)EicN;vlEH7f9QWzJBf$tUT_Y_HK=@r+;=HsKofCM6#Hffswup2deBMITbYX zSa$4$h2LB1t~JU7%NKuR<3N-B>Wj?M&%4Gi@@aIF_ERJM!*p|)m4k4a&$!0CP=T?8 zwAnI=MJfG`OZL6KHvnsg6vD9vBj zk$m3~YTc(BvDsT~Is6@8ES$}<9}aBXMk&Yfzn*jo*kBsRVMv~JBP3kowA9Htz`XOd ze%f0u(|h>-z|>(WO%qsIHMC3NjH_XB&KTdb*N>rY@2b0gXy+JcdQJX8#i;k__ty ztE7P)ek;qp-&C`ma9sy^HfC6wo*XxjVo*s76nb#3d=9U3 zRZ?jZ+_-JXxFkG&t@rB~hccJs5uOc}0_=+}c|sJ2*-nI~FT&n~b@AfGIkxQTRb>MW znYbFUdM7&pqRI0~mJBh?{Upf@2;?+h4_9A9?52vDw`^`_R%=o3wCsT%-NrXP1sIi_ zVW+zTvTpXV)YU_kAdJdypP?SJ(tP;l2r9#%tB+4s{3mF2#H5512nqf9_t|WLdXUH#?|qbtV3ic8vAXcS?&W3Vh;< z_45<~RLC3OvfY+B>+N$nAia+kGJ9qGUjhCcf-Rsc0*h=?2KVb(euNP;vLIU$2`W2kpmHud|FU`N zZvA5ATf17`N<(50YG{7lh)AHAnJbcq*ERUzXLJlN4988b@y^%8U>X0>-X!bWpF-^3FeHsU!u zwh%RQxw!g;=6Y90{D{R0(aUC7YWnpm@}uus0aaEcOb9MNk|<`VL5BsT&vs?<$VcYp zfh1ipCgXELhQIxgB&xQms;1_9#vlaGo-7olfwYvBj->>m~ zb(k32=39oVIT?eEh6IQ$#6j@h(pbh_7zL$rJ5j3 zb-ZH)R8{D^6r2D-x;?@UJ=_NQv}j$(3#i8zr&@Y48r;0kxu4f@j3~emeile0)#`fQ zAa8V9;zIq%$qSf4zck#4ZmO@WwVi(bb*0{o3uhMz4{Hb04cqP20lD23!yT1h`p&o9 z9(!BHx5}5e4+THg_4>Sge0T}t*kQ&>4&tLPfU@kzhzh;2u;jNRcU179ejU~JaFZ@S zyk)dSavV_n8ofi^`c4^l1YV&j^aY!&i<6i$eSx>3%#n_S_5xwN@_VFab@ z!75qBh=H+(X)Sj-Ue=!NIR?>XLh)yRST72P`r8~k%!!AuZ_hh* zqv|^PX&UlwX!>M>jA(j{1I6+Kdk}gG2%!Dn2FIjNWbC*C->;O>voMI*165M>Qnga` zj8a$znfs~xfBYC6P=zDVPKZYK*;{3m;1<{7fIHj`lO5?}J&F=s37V0(i>y`aH<^xS z*Xk!`KoBe@E6@i~#6Z|%dEX+5s=cq&N!O(IeYu$|^29u(X#mG360yb6*Scifb_Dg# z$WhwD^te;I(;c&*GdAAZFp{Yi56r!xfa1Jsa)Ms3cH1~6BFMaq`1y3bJ$CXlt=o4f zSKEWD+NWmkqPaW@4z1O7hjU=N&FrXu2N{))>FCtuP-$H6#O2B800DBJ z&+x7so$$)?HD<)3mJ>R&M!3z@ezc>B}olHNlwy-~0a#8qK7v&nYl2qlakfgs4`342nw2^CfUS?`4ytzsUNGS|UN!M3lYnMu@3get+ zF6G=f6T}E4%(FyG_>A{?uv*%dLM|KQj^Cs|ZYYV1-EksvXf(2YRQ4X0Z%@0(*F- zMHR|`)PUy=Hc9TzEtw|<*J$X5`D7kVU|zx+m0a3JT1dSyG@9~>b)feW_`^JPyc_n5aGs`+@ryP!I1ct zd&TG7O=u5_@%j&MF~NWBZu-Z@AaH!;0~Zts{^#3fH8&MyQ#`0|^Us2anq2hwY&Qmr zNle~3p1C>Yj%+_-zYzVJTJi#Vtyy^3m#_x?h)Bo=5{e6&xF1VV1z{=H*mRs8Hn%X>QA|?W3C8my=LELwFpcCJkM0A{104$wn1X|q zM}UT%mKDIM(Lzq~d|VSLPIh`c7AEnx(;Eqi_NOE4S6vYy3db_3$)8f=c<5Lt0fxpV zD(6L+la_crB|7-TT)qZ)0HGmz+9bl^0QT@?MHA#RQ`!i(j1xlveG|Z7lE#o#Z$@%A zJi9|uT~fmkpNYUXA7rB-c19FRDr4znrZ|HBE7mO5ui7$shhxwW=4`xi{1M_=k#O}e z#faJoElj*1MM#DHNRrSzB0t$a@AZtn-Ta}mX0xDZb2LIdm87WGSEh+@vU3GN}Mh=7cDz5WBUSB34-cRLGQ4lO226dZeHw@nU zj{)4_RKG&P>_iWoy6~x2UQ?~$x*kklm0>WHqi#KplAcDTu;(E2nj1`8TeR~9_%^dd zC9z0)X9?Mas%lU8j%?n{y!m-UZRECn8f|KeG?bK2Kfnl`(vOUIMl^$abUZoz@x!5r zl!X>p7OT1=JGbDM&6mcg-?2swWhUNo*;%g1t1))+)KNesk6D0w$rQboqruXj-@K`= ztxi%pGQBPP+QdP*p$I`+nu(*AIAM}!JZNZP;R0c5u1_0A7kj0;LfQ^r@Q8r64es1^p#5mRzsQyShR%|Roybz^((G5 z9z&^tPB%t3?xES9MF{RD(0Ky>VqL7WCOG=gm&taofMgLmk4t zh1U=Xij7IuT;&3i(-d2Tb5~gF+PyTX2*>o+X&?O}m7qd}8goO;4&GGgEo$PN6B|V1 zZfoIDZ*iF3KVh#2Yod98SLd4ZaSU}eDv_TdcP;jqoH&!6?r(b?4JpyO45W0A`mGLh z$Ke&Afl0J3NPNgC%3bSc(AicK353lj&2h9V;$&#T78?;unDj$Z~p>$JYP zc1)cvmXdmi1f;S}0{Puvuqf^|LM2cGPy#_J>Vhq5M~E z)Gv>tq8Tx1cLUM`G7&{_0PP?dW7UQP&4JizSXC$mI)Y1*6(Oyyzgn0MYWn>sbBCYsTl3SO~U{+bXr_(wG;oPA$lTpnm9b?i z`f0dn*|jeOK+^pv~bJQp9HYHqnE5tz3x z)7i{4^HJ~j{Yph)KWk3%$!sVdDbbaOAF5NE0-o3_$wx7YG?deY6?FCS&2Rk45LZW) zW+OVKNMsRr!toI}y;r>*-fWp4#o7-}s;ThWJ?9vcbSE7X5)afTA^1Sx9Ya8NeUpUuTs-5l+`TttLkizJTo zvab2NLT$eFrcTF62D{Y=>y-kv^4xQZcA5n85*2cVz-IRL<0z^Rw=|ePwQBa-=&e(; z+7*4mKYmzEx0?zArZm6 z3kUJxUr$ccEZC$o7%0-}+AmH-^zZO?j9`LL<1%=nl7(;Y#7X9>Wrk4`?zc1nP z&tjv6^isNUyV>HpEMgt^3<5KOBuUR8Tq*mNP<8Fu75x+j}&8>^Z1G5tXQ`dK3vn*;^1SxNF4vB@EH);n45 z^`o7ay5h2E0CGiCes%N`M!$XqrMG~|dv&^GX5ItOITpC+39mu4$FCRXgr2I-oGTMr zjPFh*7LyK-FD3AxL^lK_h6c>Hr`-d24$c1Jrw=N3XzHQdvpn(RsSA1F#+Xof-qk{E zy`{J8qRs8Y!cvarm)WKkCaC#&&1tuyg~?5>J$yVa<=l&6B)4VPHnzX6p0MC>*E6wa z=-MT7G~U~xyW1cE+B0}t5pj%AzU+KjW|sh9hBPB*u@eVDt0eX<2f@r_XnQE4up#%B zt^+(y_uQ0m_%#cy?BV8uiAwG&Ag8g;!qebgde`6~D)3tCh;Pf#!xJByf1?PZ=$wZB*1C!d6zJrpOcg<7*hgEw| zkg&fuxFNS*(Y%d*zgMr_q>*>n(Z#vMLJO;b(W}Q^b!xSHGx{Tr?lVf5aRO06X1`{p z-?#LxTG{mGL$fIixt8l`_v3;kCI0}S#ExJ&8=F^Wf_=iXIe*^}*KH%gIKyCqIexq2 zt+Pde`G|o8{u?dfdAs|G6;9nf5ll2L47e_W9flkh5yArk@qhrIzX4#_{(G?lfN7^@ z=K>pZ8vwv892_5j&p##xEYE-e>?{CI&JSQP*cc2lfz%BHVYXoqARy4QibhTt(*OCp zzzM^p1BRgdCGej{4(8+pa*~^n|Az+P=H`C>804=;Zu37hFo^vxxQKtz0Nh;QXZVJH z)3|^D?$35$7-}d01pZwM00QB9PQ$+>fSdrpGfKd}X#f!C@76fM+@RlSKn`xsXT*np z$#Md~e|rjjrvBG`AP0!+8CKw5j35Yz>lq*8Uo;>)nEQ7lARqwzhl3o?oWIEexFMX+ zh#3E??=So8>;Nth*Yl&!U+urnumeDU{{zV~9PY#QZtPK|t^y&Ts+$s3QOb{5*yHBe=iv4}6{sem4x{ zwhEuzX1c;IXR7gpL~GNY5kXne>unj{G;H2 z03i7HZUR1c=Tj^R4O z%MWXFwuV8U$q*Mk&+#(R_haIpJTlZ-KtFZ84Ku*Y?DutewghcQY0^YXTig4bj;=U$ zVHOuf6?G+gi<0ATwx{PNXp0d#33n*w9xmgVtI#ZRrl~`KV(OZlD8Q7-#eYcr9lBas zJEa3l>rI#-|93gM%%ITji#K-ZmJ>zI&)I5Lp*e>AIIEH5_}Z7MYFU+N zIyGt0%8IGvqi^qxcmf%|uVA$-kblJ)7rNQPnGNa>rVmR=Rt?Ko2_;r_AbNOa_06`)73}Egba(BUthh&<qUWGZP~|*Rme1_X4oWwZ#jC;HLj$0?gD3%!QWO0Z>T8t* z1Qo4r(5!M7BxGNSQI6+<%6Q5>_yHu5{3%+lffPle|_JM;iJGSx)$9x86) zK0&X%LML@pPH5&H@7?Yx+!!U=niX#Q&r7|H+;mPeWrFc+EH=BqMRpn~7qN-#}Tv=1HS6)Z$9GC!deXSs|q{Z#dqLbaR*YeNP3q;@~U_=6i5bjvoW-nc3EjF2(pL0SiyN$xqjYQw$g zmJAazWF>gJwuxh{b&=d7GgmmSIdETy>bqLSPHu~W2sxt>^P<=OMSNDva=utc5`j?)lBV)nQj)n*OAWW4uOx2Ch9T{hs$S5T zQO&)@G(9aI^||woX@4%3F%UK)*6qWB!MM;=`3K>YMS@D45lLtAJ{zc&{};3ARJ^q} zZMUYpQ?I_cZQ`?U$8xRh2VN61{XGPmmnhbN4*7zC$0+z4x9VF_TAT54CX%M0_$Kt` zLMcVWcio;j@^`Wh^KT-AT(YG)l)$Y~TB0^v6;TcH`NE2tm2+666p^KXkg+0vr6@M{ z-p#{U@hrOE$e<=woQnYDn?K&=6vCmlKHLU(5Ij}w8J!q5<|x>dY~9bp^cg9`=|+b9 zE)k!=n5>sV6Ez0uTW^HgKg_6ivPskq%J(!F>?Ka7i2p`VAb9xci|X{mE-ZL(T%@fp{|~c*`n?m7Wh_P~qm&EZzn2ko zY+8a-OF4+81J=K`;6@mkeeAA%*VL4mdBUOC;RyhMHy!VG2u4$aB}mv&M2l>29} z7UV|mm;FQZ&@X3z*A!>RMmrp3PjYw?+Z|7=g*)tDYR**kEXItr;kq%$C=BAehbL3# zU)1z#dc3*4b?{R0bKCUJSOsp^1MD)d`j?dD8eXgSp8Nt?-`YfWacCv+?4bI_WZGWU<2Mea&i zWn|wH9Nj1pb?=8RsjP5ydY!+U0r%7J=s>OTOjVN-pBwZp(Qh9+_e@$23L<0B6tS#? zFfyD?aIz3!daY^CB*BDopLv-vT23ixKlCu;gMr|2VTP!U4k#B!qTegY6pw(|wajez zVSr1L@39HDSBsGh+kx?jS2}(Sw1ZOD6Y`_89@xQOX%%WqTC4CzSiz7QKss2hBVVw4 z>Lyl~&b=r%fUzf*kxBaGdgpN_M~ZNsQOXd;u0I2l7mpcr!|@KJGj8P6by7>FhXpX* zJA-O%KOxm_RF)B=tF`en%j)WaBIia$2)!0(%!;+_a!FXUX77fX6>T*hxAP6kV@)0}_ zA)Nr#e#1zJ;NRuhLZ+9Ts>ORcC2e6#eettD0a5Qa7=+`V;<}Qnv<1tiDONkg7ygJBwVFLDVd}* z(``;FwGNK#OB{t0@Q#|Sy0I>fDdN*)@I$e3R~3Z1GyhF95GO4AZQL5h?NnrL!op8x zOw%RVSUw+8C?yzcI$NDZLgLq0%!X$lVNeg+q>kWC<+*5NB3=ba#5AY^D;%hW>o>q^ z=raN7(FHDAH6msoMUhI%CH0Uz{1*wh-qH%kxM7NgI9sO;V*+s>{f}R|j4thT^KfHr zi*>>9aDRqbQ<6BORbHJGmxFixrBR^!gEb?I{abNf5Qa?YgBqY+%P#LkB8caa!doU- z*shd0dR&B7+ehFevAA(ookI7g=_`P&3&nW})~x|1g50BXU0unogh`Qd47+Gc_F5%6 zN2tR>MYr|OC}IA#n2i*&8zNuONt<<7+=MfwamPOf-mv8Da;U85_p1+&4A4U-Auqu!ECj;#~F34!50rWq`K$#R>Z54VUKM{cw*%I-VvBN>c{;D8XV}j0J98JXWIqd5tYdn~-DVQ(&JAxcCa1V3o+^!VmMD zVAI974~AL>H(TSvZT#?#p*sRnte6f&JsBgNcl`6hw>fTyK$P^Bb_h;cPpdmQnHgPs zEVyl0h)opO=Y~ngm0%ic#*C>!RWzaab=4P}d|aLC@UX9UQ*-UH>v{w8%kH0pRUdYh}ya~u~Fj(mKc9!}Q}g&JU8UeUr={8k^6x?Ts86<&AFK^X7$ zxtIM(%iH3US=x-k3nUN?`_nCtc zyiBn%b^!-`@UTS6a)wbW%_HL`%i$~m_^>oeE9nO$yqjbP=nFp22!xdDTVj&dqFu)g zTvM>^h64BasD1`7&SG2xxhwA-@2$FKQdZ?lcW#k{y#AWsPR{^eL1lJ}T={Krl_iu> zg>&sNLUgl{(gLT%&Mwog;LQzH&(jh|+J+Ukz#HYqt3dmk zk+-RxiL;B7si7_Ge`fYZR zJ8hXIt#`OeMNOGolEgp#^lG_U|M_D|CyXWa%LO=YXGz`6`Scq)tgd*c-LAFAFrT(F zdNZu$|IOfx;r&bAmr`og$Q{FBIL@buGaJwp5a@2q(f4~EtMC5&`Z%k`eA;I4^Rgwc zHotgUXfWc?{%|{L&D($FU(&3Ysz}vL-;8>LdmVsTB@wts9X_^P>zwH*l%VI^d0}*H z_402{97$?7J0xDOi@TEBUa#7pMVYpnn?hTMs|A}fd{5XoIqTS_>VcUTCART!GJ(}$$7O(63^qM zY*HFENwuE-u>_5?q4GO~oKsy#p<4fV?~7z)_NyrK6L5xYUCmO3{e!<2L$yvatyOC@ zjyj&^LZKazj>%n>NwFl75Vgt>)eXdSq`k=h?L$vU8u7IQ+PqwSy*+tuvHyOo=&o9s zGSq)e8dh)ljVZV%g@94Yk*aGy8m{s^Jr;9YS?Ss|pzjYBlz8u_jusQ|?6keTPhFp7 zfm-+sKj#N@ZtHINc{_V{w)nU%icw+z=xp8qH!{X96&oDm$1B|*s$Ih{yae=0&vcvU zaC(tbPldq4ia~+1T(9|_^Xw_gtEd`K!{yKZJVBqv@e`K>-p$$-JIzK+a@w`f2q z_ofnQHFec-*hdy-er>KK@D)8|?yhqH5$~fXqA!<+#kMlr8%k%yt_ok+Av=IZhd^{G zsDx+WY1hH%%G%v~q*zcZ8CV9JF;_(x;IO5u51H?x*#?Of6xk<}z3Aw1oF~Gsz!+N` zLbU8M3KN%LT8O>jau;U6<1&&Z`YcT{7(t9wUgorJAJsZF#I?s#+|rzmYO_3+-0Pr` zNf=K;Ls&PZ1t}wuMVP~-P6-Z>z2@Svi}aa)o#0#nhb2L1+00AN1rUNyC_@=C`~CD6 zFF{(?4v576!jsy%Y1(ms#o9}3uuCou%=mj)`(y{cDPJO&qnm=CC!>C>h;95>^=!>P zkUuM|%HdDoY54ST-&uf@&A?~z8ZXWWG#5m`kT zc{XFC!0j#AKAgWP3(S$nj5NL>pSurwEvh8x6g!`JWu%mE-DWiTYzr};h?(pR%e?q? z4`da}Ya8V4N4H15)rTT?WXK#`h-R*$kTj)2app*wElYJuE}}WnC9&3`Re-{!(%DQl zlaxbB_9Fg9iifRK*Qn(WJUL4CHi*UhX}FkSN{;HPTl(>s1^8o#_k|oF%kAE)Uc0w8 zBSPEiMQtNNvL{8<{U*ty(pC}}*$|JBBE_eo@l`ElOb(Rm8D1;QzBU-CrPm^oKUSRY z+t%zNO)kxLV7Uc(T$!$MB&^Kzyc*}2ei}kixkCpV#q!^(OgH!<{gPpd&KoD z;v4f>`pH_#0KQAe_LdNPs?lpPYAem5ga?*lWBMycC!b*bQMP`3)COhl=71d(%j0q2QgeBxk={$!&zlvsffq}+g2t%yR8!<|Z; zW$^Dm!&}EQk{MR>0%K(E8Pa49ir@ohw3qw}si=2Lz~kZKUvvn?6!5A7uwhcXaiTL; zj`bdJm>b+!B3E-_mG`!_(Fw|M5+n%n&~vRQgap@G+B*&eMz7 zYh4T=?Xt|gQyuOHdGYXBoO*&wr45tb69$hJmZFtXKfGVEJ9+a!mY}s8jpdqb+l_kI zHS2#O0Mcz@j9JSrsx++sn}k{s1OV0 z6oC+AjDSqVf6^%Z`I`wIW{*tVzbi50=IN(;I}i#j=)XCuH?22~C$5w#M&U0SK|xs$ zj~B{}ijMU5i_ymPbHy6-Edh_3cnp?;e^js`gMn4!Y$1;_@`>x7qk!^Dm$oU80t* z3$WR~Ty7uAlY|-M0spjEc{soIBLp>`N}GjkJ3%`3T>|8Igven zt!)DNoZ!%qE7>gPPi?t(4F|Z~KPA+7o985ID=4e6%j{Jxsffh^L*m6d4d+}|i$s#Y z@Usjmi%p=1Xt5p(@~=#HEX;qo=qLD0bf<48LJ4s-;6*BJ<2#3Z>hNG45(iET4uK}s zCNCqVplC`=5zhm}<6UzE=naWaVmK$pghfaTIjF+q?V2ENt)zCerFVyS`z#d+-Fd6kbPB;8}L6{`NwUe zj{FiCJi|ZUr!a<}v8&>FSG zbmfc*S7qt4=%;HwEHx?x286Y*DG@3`?T9ri;9q4d2=!PP(rLi_X>*KJ@mEHJo%bZ9 zOhisByGCRaY<+V8n;D-iTTp*{6LnwW&h(slHQbv|8&&zmniO#S`q^q6BEO2E=IK{r zeU_bSL7S#Ao*;APwUlv0wyE>ax&(D$&Lhy#MM6}I97ch;L*1~>5*XUgw?qu|8ZARt zcxd;+`?sd^_L%fZn?>fZp~&6C4aD&}vMPz5^ASywc{*>nyBIQ+$A04W} zUCVuD?7Spu{y9DZ4}7s}uDdpLeay|+UKEX?dN!{Ayk`yL#WV_e@t2_LLk=TaIGk`+ zB}1&tuQcY^W6L0uNGs~5@;l+P3U|mDDS%bZWpO!{tKVMm(Bw{tz1fpxzk!}tWY4GI zRlOZvtac~eiVLLN;Jne3H7;CG87;e-qY7_JNaKiizc<2|1JEIuArUWGAp00kadUHn zkafnF>V}>8w#Q&k@HM=Xw?n9*>1OdDl-TjD`b#bG5JJ~br3?EEy*j5!Y6I$vuOj(R zY52~SmR!$*v&w=lGD}Wo@MZ4B)AUAY)5SI6sIS0aQ~$;xRa?FyuKU;4ClCseDaU`IhOrdcv!lI|*ZkkfuTj zY119IE`ibd6Ukk0W}=H4y?M1nr7#v7_QjB+6rGvG?Bp8B0$B;R-CEMZ7nyZ(e<#)P zQ)u+&{m<5Q*9@jx7525Gvo1$1j4IE8bEOQt#3W9nE7+85%)H{+o^x#LM=e#3+{#i2XWfg?pnpUM<;-*_tw0dsVw;bLvb&`zzj zTO*?h=vnxis9jAPi_aTa7Rtk&^t($pKE1#k(rFgozBx|3tmWIZC#1^!h--oL0P>Yo+n7DQ{h@nsjBKsLS!yv+RS}6+NZAy+euO{_&kjD`$&~2ysve+ zs8*fdMZX(dL`vmghTo8iS=N@^owj3O+ zFWyP5Z|@)PQ=7Z>a<;eh0KnPL`}X`9lc9>ij-mul#X}vP<~$QM0|tfyX&B$d(=Hdn z(=E5xa@yWXksas3tnSCSn#=lZ%t;J#IpQV3n!g^k^jqqjNlc*>p(k1bVPb zKnrVrFDqAlnOcy{o2o7XzvQ{Lb*eF&F6wTz0jx!w+RgaNte^iNi3uL(U)Nc)Du+?1 zvO-WqkGKcgxo7R8qF`wxeDcZ<$5;cvrFm7^*)^5N0LnGB`K3N1O}@V*uvn%~+(wDU z^j@!oITC(yN2hdJm!U?!{cNV@S(|v1KFT()dSyKygU&KE;KKRws15}wmNuHp-nmvi zsVcgWEf^jBu&#TKbL~Zp*E4Uob%d*6bdl`xphgHhE_R%%Ybu3PGL-*ss9P6czDelj zH06)?qFkQpmrZhOH1kHukDug)c+S|*||9XC(JUl{dbsU zPXhiEWmD9&?bq4ShV&k3!;J*Vd-BE3wu;$eGK*~2ez`H(j55xk*p?=Ur6%teR(oH@ zZ4r~N)+IIJq6~zK5%?XqoPHPx&Q zLJXn}mc}KaO{%F0))2m0G&Nob=qqe4|HpBZ0PknZsn^pKSL>sM9Bxkgxu-!^FJtMx zbtRZaXYY#Uf3%+<%U2V}kB?vwXMfdyK)jR5wL_i>3*0?`gW;maH6R(Nq9{4jlyg)F zZ}Vzj6Y3|_ocEGTMWcf3yd`k$ny*!@uwge-di;ASw1K7n`60w*owkQiwi-z~>o-i> z1?;&74fK8Rw08)Kjglv6GFe2tF;O&}pBQ#sOA6R`ADVWGT2rf?haOuHA28YAh+*Nl z<;4nJ3dFpv`KdXFg|6HiZEx|56p5?RKy)jjGeN|CXLO$C6`^@cWw=l^o%1z;40~gz zDW3}qzmt-&60a*evQ}&OzK83<4iS0(1$sFg>x$<43fXC`gBonIk$NGi|AEu8@;Fda zC}liFgWX1&=TGr~$rZ@;;xv5m+i}3uR=2xL1*4L3Q#jfL3)rL6c{DwzAIA zGSfokQ0O65?SeZvB9piCU&}1!;%a05R;(1>AkN}_HZ7RJz%$Dr&@aN5vJBj31x{p8 zaR?n((#3=1;8$?XA;yl#wU>n1Ohco0tiaWb1f%%dF`OWoEU}p3m4ojtJmjS;2=Ye zV!a9?&V~(*$T^UW@G`-%;9oNR)H?Kx#+AXt=;~HXD5BqrPki~s!xlH@D+Oc=W zNgfaf1CyvL%UaQ`KuJkBjaU@h2d>5`tf%U1PuK` zHpCdGc?Dqbh+*c`vR;;cRTXBvv(uT)rR$&@s}QuR*9&Tpu0D^yS}D*A>@VbytTjr9 zdrj?VWGn1Tvlb+Y{)zKA4+L%_B}yY`REOa-D&p$Vp1`{r_Qc{2?ToNmW|lyVyCOlQ z%IxwJ6L3W*Tp^kvrOK&Gpc{2AwI&)Bpi(0X2+DwQ=C-e2@O-fjSZnixun5KxPu@IA zN`NUMQD`x&Cxic!ju7cR`FV#;w7n{Af_rI$iUe`rV3E=2#YAu{0ql?>U0o3RH`9V9 zsqBVLc1%D_4OnetvG}3sdq{XNcg~NGmfxpd&%jr`G|wZ7IF&RJJ|gsXHIWCb_%#fq zA&Qvxi*8}$bKq&&6k>Bp(EW2bywKzCS}&lm2_D0tCsY(zSCQ@FJc|JlcO~oOxP5l>z2RqTk2E(i zJQm77cKVE41xB86glcI5oAkKU&<2@B_!Ol$9qA)fPbYPfos9;Q)AlZ?_#y5SB($me&UIPA4g9eZR>~9W`xF;c@Qsg8a<#TdiEJTdTKMFa6P5q@~P{Y)arsV*R)6&$DeEcIj zfk8KBT~08Za>6cu2zmZV7zYe~{`Qb>`FN9$9wb^g#vvB29(O3Ck{u`ruwNZ8Y4X{f z|HsT>sk~zL7e+7Rc`uj;?<^#st-&-7@wq2AWaUB`#ChYj+?B@A-QKEGLBFk6&JiSm zscmsz>DW~&CPnaXf<-jlPTtaw<8%4!{p+zy?sLi27v!Ya&<1F+gL@e9UIp2D{&)(P zb|I)E@@u4x=A~D7*CIPeTU!5VN>CWNO_6*zHPWQ0?`KUEHyY5FYDL$%~oSCn}*#Z4fzy#6v^J^gWtdeN2pBSGk0#&gX z!FoTS*+w)uL>%okvCgu=~`MSFHpP113u_M&_|`M1TCOl!dBJ&C-l@!14EOMEGixX zZsuWJu>$My`GYzEFgBoMa_Wp8?h>Bmxz+&0O*xkyA(Ntk-@8X&T?S1+iD(>G<+*m2 zKfZpSnjl9ztWOdTrOj=D?KR7biLvk8CAiBDKT)mCs<$!lNTC?K3F*HLq{;q5)Rj6@ z{VTNbWCPS@{z}&R&$~Fhp%|x>VEjCMGRaR>oqyiZI@}n8ASgYT#2NbEE}o=tKZ0n` z8(jyVeLZ{E&&yvQBR|OIR}0iIF^@S?k1_3!#vNBg=8--1XyJ#>QU}M&58nr0omxG7 zoxA>a1AIVz+BW=U-8ye=$)T5YID@>wI20SLOFCeD^B-VLp!cNdlMzy}3tUZvEKx1m zfst}nK7c6tSGG$W#;t~T_L=vmx{&Kjb@7G%DeUS*BwgUe=318(hoh}zURH`j8h$GXH!#XQQ$(b@^`sXGl{Q( zcnL0)lhg$%zR^BV>?k!|t#VvL4~z7f3IlVky}!qq3)&x8pwdWIq`NO zsW%+?L=Se^C05ZBALj}YwWbAfYfL=G6u>CV^dM|d$3d|@@sabyYc-j1C-de|X+9Ql zShWX+N`v%`Q&)+`+HT;x`RfdQIdA@HP_i0lv=FUuOAj~A9!I474Hlw3DHNFsEO{f$rWRF*|AmSyn0W5%4pDY z!H^tbg7jL(p1vOD#D1Z<7&ym$j^cdXROxL%$UZ``)Dk!ka?Z0qiE-3j2dTtyDacTo z(EW)S?-D6!Y0-K3NK~HPV;f2k&8D=XN^QXjmO`5v)Sv*XbT}D&x{u390Q5$$HnBFI z7{YDL%=vw$sj+!d{_Y5@XC~2qz{dLbuG;Z?Qjk#TSKAfOS;LIAy^$NEoqI-#`#ej< zBz5(}{dUDW5zJ%WJ%A|9rZZz4_i0OeuL#hcmQas6^Y0Um9 z)ln#kW*h!1oYc?%daLFYf0GAtK+69W`+B`nl)g-e(bYDvi}B=lJs|4OZAgY~p65Vw zQodC>P=+QT!+c@uw{0zW+>JFE+{8zL2(g;U46lPAELjtm2ujC(Dn7<6iwM)p&l2Eq zCY-~nr$?>*R|$@1*pJ($n~A>C)%P`BIU)tGUT~dEE07vb1S6@Y-MhQ9&mMxJhyUd5 zU>kBBa~@~g+kxGX)DOfCQ&)pv`F=pfBZ9V4f^I zs_4$MQ_ z$J{}5fN)8sQ?7a)h}m@h$oQ89B?5}JQHI4fU=xn#oyT4hsR6KqmN5q9+nsyq^W{t? z{`A<+pCSz4VE*e#G&$Q=9tJ5H^P(a@27pD?5l&h`;#uys@y87_PVozk*&5hefAO56}Nx z!E{;t=q8m~ZU+2mG1f8nJ1>x)C*7^}wvtSJCFk42i(4|PmWI74D2efG70Yv*;RHt&lD)m}KvRS`Nw7(j(!KjU!G&6FC>Z zP{SZFrAhKyb!B{j`+XrH7K?)Z7fiDJj~!rUV`KXtm}Fu3FFU}(`oA!_&yF(W`&dmB z2}Vo!ORI3}d7iv|t7^UD#YjJZT^lW0Y}m?Vly>&kt9z?CA1M014K1XaUAx#shlwBX z`42~Cdzz)ijr2o!-j#p0ZpH9EaK3Spoc&(-(zu>Ev|{ayI{Z;SDQQnZ^^Z#4_iv#^ zBQBRfw|3k0k-a@o>g~#-_sJe9ENi$^ z5?qFm!x7UyS|8aaHpu)Ok@M@iVgv<=f6o0&uj8Vq7%x~m-Yq8e{H+0#H|Z)r8fM8M zAX_U{vSc=tlks-3sWYIu3)5H{#32~9(e`zI^3sS)ACWgm(dQIxocTGRG6&JSv;977 zZYt-!R}2)8pC4i2`mD#xw!!qXjC;Kl4oBU-m)+5Jf6Si3OhmqzA8|Umw0S+U>(ZFC zx1YLvxI&f%%a>~V*&#knBSMY%+XzhkIPH*a@*C>7%}e)`5i zxq?Y7G$OgFR_s0hJ47)PQ*oOOp>r*MFl!()>?8uPckfqk4Yl>J^V3_x%;v8!jzuzO z$HY)~MOSm*iO9_x1a(~&Xj9eWnjGp<0Tc!0QA2bk&4hQcr3W1jSrgu+H6p+p7qFF` z3Kk4s*<9g(j=21z+jO$|^!DL4Fg4C6a7$l5y2v7)(RGVgNPZy%fi^fY>aCn+GdiyH z06PZAI`%=peQ7%~3e-p^)(pq_(Zh)*tan!^msxk)3)3A#`SEY0SAnWol_;89mqv^& zcSv(LJE^fCcob7D`4%-&$|jZg__8Rkm9@{3fzS7+@C6aOxb}teoz3CQUVEw4fZ`D3 zI9#~*P^N3vwU}OthlVWEprrwEo2uzU2>k%S8R=zN70vx(qdBjp=UM^RO3Tuun%ikacS+=yb)_pW2=#%2>Fy12EKXR2XBZ#9@>#z z*i@A~dQ1yJu8-*Xm|H49S;$B+lukP7ZVCew&(UaZjWH7`o3L1fBPyf*q7ZAC1$`T! z>eVy(#Z?~{w$VUzX&G3+KRDePfR?l+V@b3GC=2#?co<^1I>Jm{O2l>oylgK^wSoxUMkB{wooIt1Tif zHc2W|Ri~cn7vz%8c*mNQU`L}e>%^cpVQX0*3B1a)J4fW-EanGd#BkV=IDE%8AOfom&3(O+-8HXM1+O1G5=&6+aM<~;{U zp@>e+hA0#U;nrAc=`7F?BxA58EIGOMSuDzEMbF#)vJ`<4)ZqI=TdDwL4fi9)(_VGk zNrYz?smvCVo;I5Z4!6i{<{!~>)))(`$!mgIHsrMBuNDk9?hZrL^+JPGvHiY$`8+{l*BFyjJsO=%%a-};0+F|)#MQ=XH z{sqWnwygt+Mze9>menDK<`FX<$V$d%{T?Kg-GBN1sFL2XDQnsz_E1twq6kx4SJX)N zr7$PFnMcxihbjXMRD`NVpe|AJ)GAg7A{|r<3&HD5Kxn;7tY%~Nmmq|NhJ>v_PAOv!jh@W> z97EKu8SMNtnxvE9_4t?Wm2$KK_SW~LM6?}=>W6JZGWr2OB#W6NMcSFw*WAo8rfP3? z-u1%TP@S}mCuLQWeK6SN_;Hcmv*rGu<3X*B>cIe#g<*xDwYJSR;&kG-r(Kh`!6T|x zq{tujNqv6c+GiR^lRNd}6h;yx?!xQ_@v~czS6^Lo=se(a#7}B-5~JCx4&H$SB;BO? zh+{iXrV;o*cI{{n@NMShIPE(Xt!j?X#f7c4*Hb9YAEVh=Fy=}bbEn>lJl&RlivJ#3 z%7Obtk?ZT>x+BT4<3G-r~_WY%MRpacn?Ab~ZV2sQ}g7rB#oEPj4fMy2?7aP>FH zA6Yeq|HdKK|DSxAnOPbC7l%0h2Z!MPxAl*O^Z)YDq{jdK{N#JAE?cB*Y9WI)34i7J z+s1A+f{cfxnMQLBNyLDPWGDnmkV)kdv*m;KYxn`4u_a+)Y|QTR51|ce+SUAKvBL8X zDoGj%$$vgSg`EcHwvQIWsCMTcRWphSOi^MsXMY%WWh^lKK43b4#CQT{RiL~<8g88N z;a~#3UZ2ys0C!ux&h*J`+^=^Q*7ejB$?2nR1uRF#`d^#^aTG&r(=S<6dL@)ALiY|v zuPgaNGaZV0;}W9$xehaw4SvXqvO51dZf(X5G?2_u2&vRWlYT*pgZ*yk6Q_J=s5$ao;;mJ3QXh z^LH>E)$+pCJJ8U}2-wRTL`zFrK1#)BjEX0IT+=_LOs?8<*l$m6O^7oRSMm3$;vG&L zD4EcEzBsm*Zrjn0YD76QF`MiYIYiJ8EH6tKLnu7nBSo?IWg|$}OzV73EgM~Qdfoul zj_@n4re&GNO7|;s$1X7>wWUiEj+zJB4!6g_`adYK!wU9^Y(ts1Ai%ym&(L4Q zkU|T*Av@yAz}LjU^(h;!?v&u`Nc;-yAl9?17le3(uMq;SZxoSr0_m!YU`q&bSIOqe ztBkf>^l=GJvaCIETu99);Fo#ZQI8~Q2_3`NCd(WDS$pFkI6D}$H;9PbR*S$BX*V9v=cyD&l(_kd5W|RAgvy`8GFZ57X5P}558m5uh zk-4%*4UlQ(V1wka_ZQ=vO~|uUIBD!?Jbt(gJq)yZwlaKw{}Law1<68zYfd(K54_)x zE*jxe`lN>&(&vKsadZzICbSuy-dftQYyk$jlQxf=ZYNvr{6XxNzHz$#3rgD+ zWJ!c2o2BVEKM?-JxZ)*5B#f7eCHr08lm2)gpTKGd2opRZ=hrb=Do zlhX_o+roS7v7#$Y&;}GL-@!WEmIbN{kx$PeCRVX9kpHnS%*VLpHY39JjtuB^L!uGETmo10NB3sTCQLi65G?Xmc^dfjn2$u?c&=%8c zUyoI@##+-~Z@Esec5y%%xbM^mJO$`!U;w?_hH#^H4#hz1i80QNL`1uJvG~*cd0#nB74=}XAO zp4M(5zNl3KKimlvE>qWheAQ1Ii@-(x9VYHCGjqa4VeN&Y6?&2pEeRLC)}X?4*q+`7 zeID&}3ZDDXYGt!E(d90}N|OJwD_Xe`hCRbf5G|6Wl2ATI4WQ|Q5DJjJhd!h|%$O5& z+mFY~+bCeEssV$W%K(rLL&M}g-&^ehFO}K5Tp#NVH(+;I77*$4TKB}r#*l|dru|`F z%gE(qisrvoelu8i#;o#yg{UjWze#Vh?6>*WavF_W+1J4p9Qu+$geRUN8+Cx;h{&K= zwMRC3t=s>o4C0$Z)M5tXJ}|@N3zG5cfjT{kE7abSSIHRGbq8Vx!o8fLu&Gq*YY<&& z&QDd`Q>F!P>N~hM6LMcGP%DcY_G{AViq&r^b%PYpbjiu41y2!OO3?Wxdv9%?z>rf& ziCva8x+g~*sVcb%p)7-jAcNZMzIAmKg7X?2S@$YIhQhM9-;);UyvM%{e1Ak-vA?`w zfMV(v)1DfH6a#!ok2t`H@$wJxhscZ%K#V6kg`afksvXRwZTmZ({qyneZF5lt3BC9n zBrE26c;Q@MF%B?1*GQ2+23a>Y{j*^yFkaUSnUvHb3?R)N@768LoEwQQjEQ?ERs2oJ8J&Z#T z$RsQj^H27dtja$es)|A3KJ)g8%lzGhu|r; zy00|*sKr*zrPMg}{YoY@mdi9;MzUz%WXRZr>{Sb~O=7yAf{Q@c*qeBu`%#5i(-umi z8ws|09R3q3xUlPRJq=rB){r~r0}S|r_*VKEPVnCx!}-4)!^oNx!XX5tsEjMGGooeL zeWI@sPaB9K36QCUBr017&ueU=wJ|pJK=H6Qf&Xs$yp@g=A^4>=1n22;)q2eT2+c?W zl4;L5Ki0c5<>?aM3E7{Zwj;`2;AujCP+8ARL6lE~0`CZFa(I$MWFpAVb8~#Wl2l*H z!4-GNcCbtz4!C!g>39Oyig-k0X-DG|0rMsa8>LS@Bvc^Gu2>S$&`ek^zrhW`k>w83 zDnNvg5ldBNFvbfZ>{$`)SusUM2oN~;w3dzYc2Utn^NNP+Z;S8uVdC{;8M=o;4-E%m zb|?%dZ=vx${*YV8+mJ*dBd9qVM*Si8n6jRs%lv2O?a*%XuG0t*{SNXrVnGK>SPtGv z@_M9n$q#%7S6q@S!uTYn!pN0c>yk`0og=tBlyK2?6$oYA%|ZWIt8I*&So|fhd7KE` z4K2#e@%y*vn~809W&)55iB+@YoJvSY^u3CWS?@A>9UPIxmRY7{oAXGdlkjr$4U;~+ z@9Z2<6U&`_?UTTt<5csVfqde85*?l|M~rJ}uZ&3q{$Ll#`!4&og4vSldK}kETnOkS zLBZtb0;H&ee=Q1gsmiSj5`jPXebh{u&h#_Zt+Gn5-s0n8T=#nDw*I^h*PXn{TU#t& z1@vP_PL$Xqkqw@oa&AQD^-%S>wAjygtfaGd^4pj%ROkawZd-M9aqvnLOJZl00y&BY zQ9HJVOG@nlRsOlN-zre6b7@%*!n){I*@=b`RXby%0`l;$1VvlA$wm}uPJB}j>?|H- z%Bq_urFTf6gUM|KyV39A!d9QLMfbV@0BY38R{US5koA8&B0D1}SCWy05HP7F=e#bN z*mU-L%AYk zE}3V$F#|6D3PnI!#Y8HDzS%7Y#>-#GhvIMVP9B(*%~5+w9pACH?j;_#CT>s9gt;H( z>!_cM=A{Of1aF#CYVApkw}3N2-Qumu)AMrb*4YQ$_p0~f{%QNSmKUJ;b?Nm-cY5_u zWPNng=kYuO+DJc`cuCV%-poF#tR-oZ;|y28to%_b?Ui`?{wv^#&KG?K6OX|RbXh+* zfzUC}jjl|j)^z$x?%F$m!6G6R(-S~b7)a0QMP!g&5dZ(kxToOE!fjo^vCWQc+qP}n z=~$iQkByFP+qP}nww;__RcGyev9IU#top_n@AKZshei`?rUER62g!Wy?gJja)%w0z zp~3$7ao*dv=BM_r7{LAVi-a zjL&Io-%>gjK^yUH)5{U)h4{xlnxpZT=E{KYGEA2inbyWq^k!|l@m80qLjnK&ZYAyG z0xpI8r!1ZO8=%GgW`PF|v8a!$~t2z;$mmo6p4KG}H(w^*82p zz?ci)H3g$X1oFc?x`8b^ha{*GQw_6Iw0Q0^6-IoUjfUSJv!)s`(PCe zM{yY(@Jr9H5?Vkjh4Lci$Zg`ht5S2VNml*h*k~sS$X8_rkLGD)x7_%E2f~9m;)@aL z2d=+Q86buG#J;fn{>NwzM1OynNMm%6ix}^gGR-G(>N8~tpwPcp!pnM%VHhBpWw|w) zpHOMPD&DMDaG$x*olXT5Gb(r>w7wcXig-^+P=#T`oXT1F6@#aZI<#sW?ks?DH;Alq zj#D|E&$M)E>;S9N@sY2B|9m?LG`?cC;0CK+3vks_bE<-)(rKn)?^Ur|wd#v`IeOoA zB%e{<$+T?dX+)?O+%PiN`Vyx*bo{aSt#|V*rm<~X#4ZU|3b!^|%F%)l<4meMp3}>O z{Ky*ahn1}z!iDjuDoIcV7C-h@vy7Y;=r z8L-s_y2X39hkKBI{qXI!BAfjIhczzN&Clw!rjp;`xm2%um=ha z-U-(#FVbG6CA54-aKwSUTW|^Eb$I5jHI4P|iE!4n^jmUSrdY3bt@qMi?L`%>V$Ek8 z=1IST2k)O)^b8VB3!!j7R(%rE%5F2UA%N+^B6pgw0Lu6su{;pO!S0Z`L+AR&J8%Za zeT#_HP@H1Nf_6bA_nNnAcnEef1^Ivx9#DlJ(y^r7-vX|AL4MBBI;su?v_+EktKHlD zHA|U01Jg%&BPEeric(arAMw6mNDL6-6{-&@GT9}}Ue?$}XlEUr*pWRCszfNAi<;ItfNUn(DohIbHat*gUUO2;FSz}#p z7-WzXiolHzi@%HO-g4RTditMYIYeL@hht!t8V!Bf;3RJzofNI;1eB9cx{qSVVTz3} zN4|aII_i1fU7X`r%O8q+$jXMqLnI8lzF;9f$#QfX7i~2lb?>niYcS@U%YY5L9>Yw~ zT}^_Lorz)^vx&b&)_+KYW3~ya@`XNq^q{;iD6wL4;hRo!JF_~*^Ei=hSe|kR>}*E zFScwia8j-U%TDmi6taNzeE<(Mg53H>rME))Gv?B}E4nE{sfWg*GVOFU9HOBHegW6` zWhU5I{WZcoCCoVH12&y0u>|5|v;>0+#xEZAuR#a&*2ih*BpfmB#=v9f-c1$ZSc>R8Z9X1{C14@3g15RfoXJJx+|sagx{JG+DoGV78_Pq-;eeq4sg+U<(qsp9 zu`_vmy0VBw(3!V6Ae9js$=Pp>`12JL58MX-mF=rEkcGZ!al2OeKWG=Mg zsUUs)Tfs1;(4KrqbO5^zYPw#Ip69o$u85wtv?pI5gy(VMGI?6ckp>GyR_7E6R%Xm{ z4{mEu;6dHjX4na2XBbb1sdX}BoO~`2z9^;`dLR0mA_D8jIh)we(hef?{K_clWdt4~)}qh<8@L@97KxB*2`NM|zP_ev-{}L0K<) z9Pp!i)|1?|gjH&AV7NBV-{m+Pg%!GUS@C#=ApWHy_k$3L2lNGRvC#8~dS-ln{wjUZ z)O=Kqa8n3o(tt9m^xCuhUu#)+o8&-ZS4yMb94B7HG3bEQ(yXHiv+)Ch>EyYzu>O^j z5-fvk2xLw-ECA^#35bU^)^H<2sw(e^K7b7$@}E5SQ+?bPYg(d4!dOMd_L*_r_o3El zZ7kQSGL$Gcrw0*$y0<;HOFD<#QnG()=RNR6QedOKS9T2>|00`5X!`D6t&mh|>Zw88 zfETUKhktaIUX1eymW6J772k)8Ud_j`NF3eYwjIqS1Td8n!P_5uh-ZoyFQxk6LjJW7 zF)jNS8)_6V1Xx`*j(ziza~~lA*FzQCg;0Xj4>9K8`rExMsh6BnmHa-+k$*LW18poFEwa5m*aBvtP8>g ztdI8aVp?{C?HDJVI@wFY^X}OL6cD~Hs|rDCr>k(+u8lJLt6F`THX-j)NTHxI5us1? z-vA|2ge>z069K12VdrQ@8i3O0tOon3Dv%dS2->N!s$&xBSWr%>MCkLUIrEJ~Btw)= z_L4#%&Yd?3-`;TCi!woR#%EW^@znw)vk8%r*zS_8(zFToF^S6VERjlS*EK;t-XEyG zrc1Zf)z`E=h?9j+X=o@R;B@vmW=Gk;cDW#3jiITpWZk{^=na442Q$TB_ z=i@2#(d-(70Rn?O)2sB2j=Hoy6QbWh%V*Ojy zQ%TP=z2kZHj8+r7YytTFHVdN$)YsV6X2GU&@0>VP8dp_(iOxj;8R>+}81Tg8%Skya zeK0q5cF3)+>4^8pF`4*}zm)mGHLbJ}3X8C`p&2by`}qCSFRsaAc1fQz|MZJ4cMN?Q zN;R{Sb)1BHpf6Sq(wvsF-o<7%^3v0yDuYtn&j6Fwb_`##j=J!-0J> z!}2`IRSDP#W2}RZ_-Q>cAXlJt>)}qQ#{8;h+;j9y0%fewHWVby*ruo3v<_A-@2eJH zC$^oZo*&1TqPEtj_PSCms-U=_%q`I}*}GgWCJ#4cO)p)OKTEc-0C^*A>6AXu5+O}# z({^by<6OI_!_~(}h))3p{x`O7Agu^w56`8h>*|&y+pE8d4xh#fAeg=gHqkbH=A_1w z91)AN%9XO|jgbvCj>oAX;rJqL8_~-9h&C=k;!&mV@yi3|WAjZj=vr~wl6gz>+llXG z&E_b^`!O;qH^;4BPmUwoT3kA?&aQ$dLhmjd_fXw6PC1fC`sS#kr+d!w(3ju(J>k3m zqlj@1(6#Et!_(#A?Df2GKc7dyAnrC)H#B4W^zyLso8iaN*UQuM`(Wto z=$=4;9>8tDy-6fa%|C1G;`ZFju8a-`?A)MK6x;YaVgSQ}fHkU{$-!RB5?|H!RJo=n zxo%3`=k$5@$GTH}uE%9(iMk}1NlryJ@e=Qvaac4k)!~~05Ia^di5N0wxVh6uQN(ju+mf@Y~jD!(J>iwEC{*j1TE@)sse2TRYqa5Kw6Jwey_e|vj zHDGNbqu%Q*-rcaHkKc9U&-2GRmRAXqN;9LYt3ZJWN4CWEma>YC8HqBRi)p>zW!fY| z#WyBedCmC^fU!?IZXDq3dKjVvIWyY*r)}#(hC|YrEJ-OCmQ&+t*FVf0vEzNVo*@_C zsRL!P=uJyPgT20>+i-Cm+}zoHllsb$zv@WeKnbnVW|kM(MBS;C@!>Wcd)8Q?YTto& zsu0*|`gtooo4}hLd%cJx{#*}QB*I*N=P)mI3(w73`Zyf-bs3JyQnjWUn-`BO&UdjganNC83i?uq#YcDaa;aL*Xrro0<3O4k$o+7zkWX{ z+^9dtRsgm%_oi^|@XhFA9LK;4?hCfg6Wb|TMB=R@O($7^Tk|7KDT?_N(H}bRnJu4LXi`)pUnNt3Uv#76^n7*iN9R!`4 zs03}kW5UDtCkRim;x7W{R?Yt5N1Oi`ZT2y?m39wqpfky&xNP+w2jpU3G*_(PK^bIB z&v|l1NNoa-Xu$YS^acXoW$CHi`GMjB9b$w@1n>=`RMSDe$_6b+?}Ldrp*L$_ioSaL2~se;}R z?8_-{;3PTa?ipCE5~g|Z6nMpO5$(hq-6jq8bBGM&2tYv|r0hwr*lDI{Q;a>s%FrN% zU9qcHqM>P8*TEg1_{~%vQm8NMb*~LgF!Ll;Ur;;$B8SacO6!aghsE-U$D?_kR}tNytEhhlG?m~)D;zuPVOyoda8+!{Z5YEfW> z^ChJwQd0`uF-D@ds@4bx zr}O=<3q(uUjEC5aWW_x$rYE`OZ2(Idun~c{zF!*0ehN4)7oMP7dVLU9=ykeuY`>_B zH`_->Io9V5vgN0ZpGSz-Z)i#`Nm6Q&4Ip6d->y z|9e{p&%LuR@p{lP)h44u<$3t>x4Npj>YSLWw(|HEB|j9C ze{rJc&^yI<|BisM_7Uho_ky(EWsM#ofyg|1IyUBuB+ykQz>X0*8oeJWq$Pxfn0bEU zQ?Ms&H&;W<16 znEj5qO(!=xO)|^~vg0&(d|CpUWp4;1M10lmVN2dj2@ZF`)7_Bv?feHzJKog?NlDyx z_|gXnmBMLo69JFGkHj74qH0wQz6Ku|7BdX_c-jt|J3dca=#elSs2!(7A;-Q`0!&5pQQ?J$ixz5~ZkxgK1KqVJ z9@MK&tMXd-%cwywbqXyQE|_UVDT+Nb_{8KD(k>fwngOs=y)|{k_BH17_I|%V{k3<0 z(jx!p7QS2}J~rU=VBZ%Oi*;gXoi}ld%4_+xsSD@J3&j{?8?DM5@x}FqH;@;ZL)J>1Oe&IlKe|r z?mk=Xd9n2>b##Bf9Zy}oTl2{PA(F5DZfG>EmQ;BWB8?p>-zzOkU8h6pKdOxT&4SIe)GNLH{?8R;6M;8 zu?9#Z&Rl@{U=#!ZfxHU+&W{s`A*}OZ&Ll2VNQ$TOnqKsUNUQO`u^B(KaBCUm?r~?0 znfNur1WPP|VdYK%`zzFo0A|tD69FwI6o#8)ESC7v5jJ;cKEzmc%u8pP9Q)rd=(Icn z{8`3P)+KuX#gw56i9onqi%5q8TyNgffy4N1C*v%k2xg2 zjvX?%w|aaiU}iDgBHa6=l!3_^pAxR9rRA-%bd;yeQiB#0__Fj9&Xy92Y@WB{j00zF z8uVTqa9{D<#8{T&!1GFH{t{GQm({d7X9*!NP?{X-M2!1a7j`>=_1CW8MQ2EIbS}Vd zu~$Sg0*me0{sqy zYKJ*(XUHN_K#Utkt|Lc z3o^#O^EUDSQ`pm7L_s)qh;NB*Om*)cZf~`w*l%Gx6b0QOLAVfA-N>Wr%fh2jP)%>< zQRi`|sWef(tO0vUvLP6SaGli>xdR{Dl?7wQXUMD9BhxDCDMLcArwj3(NKq1aN*4P> zDa~VR8{$O8fuU0jEj#)(KY(on6BXQnya6HlbZPQgRw4@RU_zyg6q`aN>OrA&>s(;Q z7=%wys=Q(vAeq_X3`t{gJFS%?N4kqATAa;===+JctNV1Auo6H1^b^UYlC(OgLO+&_ zbv5c7b;ZCzQnu75mmO_>oI~cpIZ26^`qULp*>H^FrMs6a$itt;9YETT-G#m>)ftP8Bv}>LGwx^_l#j>fPx&) zL}pU}S&ElB8Ie1Gm`KtD%i<*&X=$>RI*t_A!Vz5}S0sv3F60_?jO?9lgd>+fr}$(& zHF$oc=yqZbYAL<72taTfU3`Rx4*I4SuY6Z6Fi7}MQTefVll8bsmSpP)%4}%+b7t0H zuxiD%V1u$@ew?exKC4kzi1~>UfRGo8GPqG7ohY(?BG_Roql1t-^z{A z!gj_i?0ATXI?37ZX@Q0KE~25equ<@x?h(xnXls2l+CsK|j=(N<;IzmE)+0b9nIw4O z-5q_vUp&@SGpm|?)&!lfKJ`jyE3pIqqWvP3u*Fm0^VG7E;sxy`8kv1hFrhzx@Z1RE zu;=VV`eC~m11!T9KDzx_`zHI|Z656jEyh|_#aOAc|2(|?Ir#%zRyGIw_S#wqwoO0P z$@wjbrm$j`KJIl4VD8=2+wN|&A;`qPK5mdH2^XGkzpmo{f@rwuL_1rE{1mPJWm8t(K;A zm+buBBM=&-l-G&F&HjqZw)>NIv3<`tZ8&2#xfKk($CM(&v43lSJWZ1}IsjTb#v_76 zu5<1#j(lizJiB~-WPYdd`o_S5P-K^oZjDXE#KrtS2!`#y5sLrqdt~GK{|IKoeq$J8 z$a6^pE&wDC#+elpf#Gbz5xdC|hlf8|yD>U4fLsE_BtlhcJmTJK8{wYjYox&(5owiNb%z?Juhzxn|UWIn(7^CEswpn2!sz`T6LY+#>h6SCBCV^r4f%O)ED6{WBxrKxs9NSA)QuBe7Wr zYsg>WmlM?jEPu6i%bML8BnQL6Vpod91P@JP;x4=8^v``s7wNhXCpgv0EkiYJ{CTU5 zY5Av^)#hN6?X1rQD*7>4h^IwWTV_<|(JsnUpD{tG*V_KSM&^~s$e~fT>l}}!@%i{R z$Mkl0N2i{hw52Y9NYoQT7Y^Rx9_7Eo^kPrM-SqRo%@zB$FB0crkV|*tbvj!Y18ZR_ z%SM{U!%zzc=E_85i$=){+_hjOG3dM+3C&|J3)o-mdD;qF*U5;dQQ~VOdi;%o06@C_ z%z*D|j$0T!#HXZ1m~kG`g0L>aSV=0}>W#C{X!;aoF0m?Ljr}4$wqvOozYSY^rN>#d zyBL|&|1FOs(&hc*9+D>zo3zBU5kEZZrDZ&oXgmWW$AC&9t+~X4M@E7LB0mbhGt`B)@TWar zOSi{cU~5GHnuA{{U0;C@{OhRoV_7*)W5syY^k{iyV^3rT!5n?{#a3}Z#`NFv;Q?`s z((oH#-qK8FU@EgoF0}e`j`$YfPgkf+0uiYSi?Q7QjF~dT}Z8D*{Ha$WuLxEQ&0vg32f5uk#Hhkmh5GD&wCR_k>v8 zSRiGKB=nk@m+pesiG5GTK4*NEpY-Q|%_Oe@0}j4HXS;<76Zt|uc?$@E$5sIa1PGJnDQi5PG7P@P>*)J1dl=t&0s9|g>r>w zi@~q=I1CMQ5bQ!|Z0M*=jW&{dFTam&ui`kZFj zXTab@)S`}yN|=(88HG_icC_YPBYc84-Fj&ZGw`)*-{p)Z_bk;tBmHgK&7xNi7z2WV zztsZGQYSEQO(#28zB@q2UMfF$m?L znIzu*)vK=GY`gppB6!FLH+AUBDMFJ`MKXa52?B8!>L9Wy`xH|V4g3OB|L0-NVlpQ% zZvHgd9))VZO0)_hu1%HcTo9xj#g18PNUgq36daWG<^9KlBb5&hRoQGAK%OoE5jgu8 z3VccP-Pm`NX+g&?*_$=M0v>G+S{mE~A#tm9RL=(g2wg||IgMb&SSkyfRRl9i6nMLR zk0XJjKr;6Cm;bC-(}ArRN_q}LmwiOeaW_)}eOoTbhCX?4<%w~wI|qUzrO zOGiX5ZUs}FG1>$7PebXsc#`Db*AM=%QqC0`bw_m0X0$ z7&|J9bLm+XfSsFeX)Zs@L(wo?i`-~)sNwW{1qWTBBa~T+o&}R&SFv}J)E20jWRe+k z8I8)~g?v-n5UDQoQjw8+j~BcQtoG*=sFQ7P(@vj(dY#f-B5j#?A1|VD*|?Da11uva zd=(?CIE1~Hg$^o}hG1t|g+UP{H<)#%dKozkpRHz#=70I$ zoJkUY2{p$ck#{ytzJ4ZT8<*(k!wMEF>IaGG0gzk9E_6K1_ z2&GHaBVVG5x?S)!f_q?g18E!VKrZn48Zla^T8xtcDv_`M0l~o&@tc z1j$rpgVL4J+)o@$p50U$h;Y{;)Iao4hly~E@nq-#q)^$N^a2u!rXDw1@}4?GbRg&) zouL=GM%8%45i6Fe2AnHsP>qlk4zLmHs5wT1zGS>jU`cppX87 zROXhjKHH0PC4-V(m6At~Z-b%bj1TqckKw0(EO?(tVA6BA>=G8!{N|iA7qr(^{~*0t zflL_zYT5^|FV~ICJWAgNwPvWTHkD2tlj!U}BtfGYaa)J#=y2UJzD+f>bZ2_HI01pl z|0uh!ZlfQJf_|F;U%T$ZIqiZb2 z6#vxtJHZX$b?^kdW zPsb-dud<%^RCq*I0iPbuu6Z?C{I@PCMgvzvx&@S#B~?DZ(&J!`sY?Sf@070CgxFa? ztqUk>w)0<4cAMaV(r~V2FPpU<=f4?jneYn0)8~Q4NdSN?qx9-O*|E@=HJr_>hGSUexPjFTX_#eT>;$#ndwDEvIRPa&2l) zn2)OigKonn%5a>3$G1GmP}{mdSv@V3!;puI>ES(3jgA$4uD!Y5{#D-zpl3)<|DXIR z+kZ=un7LRv{;Rpzng6S~{s(ihC**NZ{3~(aWRLH9sWG&)=vQlyO9v7#szSt%?X1{p zs!Doi-cXjUtx()*EFWbaQ*PsBD(RAYtvMCAmhl6URBa+1$y~0>3(Su+B#t9sFd%<5 zL6V>iJKK5vv35s?e9;ilXL_<>{BBtX2XwZ*f0_viY}!^o8e^dGQi`G^5x1`C0g9{! z<4Ie&^y$7oGBoz4B7b|nKK1xKZT0ZO{v5337%+^lOzbX|5ggikJ`AA8HiVgQ9ahy~ z?5NARGIY!=CQ!oKt7}MMk;#TR3jNUWMVtW-M4C-L1}2Jm_AeEyIhQu~ndmHB7~wj` z-@eH(;gcR}VI?V&$T~I6xEr+j0F)^yr3?00y#9S09@gNBjNm;M8g13SeJDl@{fY^# z2rX|*+0*e%&onpYNj{*Ud%U4((ZPrA(5XZyJe>6paAi~N!VPFSph}I`st+gHm(0-5 z4lt@`K!`h9j@BhE~W~F%NZ*TAiG}5>G}8` zsyM0Po#;(eDX=|vofxq0Lbxek+8EHUX+GXnj~l9@po|V0H7WS~=(uw<)@SRUbE=zD z*Jt(2j)mRXTz^n#HgZ(G&&;sX=WUj2>iXT`<+18%ZGP6e3wtBia1~i&;1xhbXP6C0agk`P9z=?ln) z#4PYPK~{*$d@*?2vu5`=prRm79+@oVG_On%k_w<@cqI+~e!N^-VaVxe_5A*FH?dE7 zKy5RXE>L>OV7IJ1=8dTz^y|&Pa$9P?E-KLhc|ldzo1MB$aGE&<4C9Y__SSm7|Eq2A z#!qqf(m3<3Y}v@&njkL?<^MZX&T|!tt+>#1g|zr?u^3{F=lK!JJEo}V3tvb|mA?f> zc2$|`N{eUb279VQENh&69O+)K)7|zD34S?-6wcZJr^5xD30BCf2g0q>Yfku{ zqSZ35YlyJ))3Y%FT;iv7tk5D=Wed%)eJq|&b08ou1|}g8O_YWk(uj_mhOP99Rcu$9 z+(Gq1L#-7d5bFBH_BdQu5LblIE7yzTXo@7aAUmw-0`u68cDXtE7b_rVQY&eRo%4sT zXa6_`Gp8jsM{H9G5ykF1EL}e@Del-6sfUe}4jze?on$ls;Ak|h<=LZ+%flWjrS@iM zS+pE0E!Bht%H|$mm3!iDT?gf#}=s)9Z3I?{9uJU%WWl0Nc@%^LpPhmg^ zR5n9$UNZCqI1uig^39hj#}=I@CI5<4`=K`6i4rEmf@&1zz|82Vp^898@J9+HE$aN%;BCuH7$pUMorBP#+P_@Or+ew%Jo#*foaqoyl3qL%ArkHnzl;g%E93v zoWV`69>YuIB`(3TKJOG!_woi;t)4YG0x!3z)R0;M!>;wvNpkbQ7K!Df>0F%3Ou1rC zxbyiDfZCX>-huh6+MCo-0U)ey?}gOkKd3<}^a3i#W5zh9x~GI6Qb(pN@#(^aFv3Ag z7o1G)!1d|ez}SWD);%>De_}ZTv>sTSI+<`V1G$zPvVbhi?3d}@KdiD3i+a}RCP_Q2 zQ<)?I9-QF9n|(>jRn^O=Mjii*EgX z*|0}_b)7O^1oj+pD$HdSB?wEUZEK^suFH4qp<=9n=WEE_EzyJB*-EpL@A*^&N`*|D zdgapre8<(@yy0*jL1HGg?3Bobh1~7gi7Zk8(2%;?&J6)Kj3)8z0e=-YbL`l!;gr86 zYM6^VoYm$pv-Fcqux0hwRlCue2|o)>R|hF~E5B;M{r%O{WfA0y=6hf+$AB{CD|9QRIFM88X%cDaXeCloR_IV}3D zNY&|De_^QlYFqwS2AK|7K$l0Rt)r?IM*L0$Q#Y#V5R?s!iITnrOgW;S67z-9It%RVib_|Ja(a9s zs=Rd^CDO@pFuwz}+>^omseB8NACUk~IX$2RF2gEaJwdBXAxOawX1MjGUyYQH`3Ecn z1bYKG37>xsEa1?=*;F+>u$Cp_||4-+K~&{%36^+ z(e%0bd<|91f?ux+gA!uyK{UM#Rs@L*Me`_|KO|G}evK;644TrfR#7zoz636s0Dz12 zFn9NBJQC4`)SmvMqvySEj~w&3wdbcR2jqB6(-&nAc!!`96He!KW7CjWn!L=VuOm}} zj2rqu51^<-jd~WU&`F1^Q6ys7h+yz}T@xexWfzsOnM1E*mpy6TbyisO1W8L(fImNc zOU4GP?;W51fnN4jDiH+Wx)k`5?htr_o1rD5n4&b!)>SE1Qm?pn(8$}Fg(qq9BuP4I z|5;&yUbyF`=dm%DYP`m3_KUJnQ$pL_Xf{*l7X7rzNVdGB0_PeblS@C>%lRFk@&^jP z-18>6fM>$)Mm;KWM@pE2!(94rSeuq9sdZzHH|@2o=ccR?444jQ@hj{%O_G z+0r+k9M7_TLs%0yyZ*IUJxoE46EfbW0PXZQUB50Oi%R0!sqo{Tqq%l@14*EC zA??>{+>_KsbP5H)3fRjWT~G-AxG9^+2!KtN&&54&B&!FLvre}suhpk>-?ajf-wKb>b= z23h)|YgOvNk<*^dOp+s4CiioLIY8)DY70^D7e@myoG!P76_cT|YExrCg88QfQvXhq z4;9qJit$D`U-xfEF%T<*d2F2c7vK=NlN(>cy$7-Ru{9T@+(!T~H8gNWpc;)%Uj*Y% zCO;l<&9U_-(oaQDPD!YkTT7Uc)*qQu4KwMe6&UpI#hiC_M#WDW zB47h}ejs3%YA37oF=tuDBU8x<`g$%wzPT2%gExjE1qJ$tsm&l#Rd1}U#STQyIo?~W z-D={+=Db`O!6?x814iD5&m91GmwWa4;@uW=0&+Jh_!kr8^blzW1TIXyJO}pW1hJCL z!@EY8{Fd#%Ps&o1F1wqMy-r<2X2X~!#<>8eiWThed!sm`WDD$$;vJi%1&Rl-6ZQg6 zEFkXZ#3Eemt9RD&qkos&`qRl`qPFD5G_59JZIh#ODlDnXxS~hK6@5`gcH-~gAFL#J zlRLcUKRqo#fJal?B-?I%M30+Nnqk|rb*UUg`5vCcsh2B4{pjCIcfs0+FqjNJMYjOg zS)%_)!HRaM$*5>~J6q(RwpsP|JjW@?(x&HUX{L!XL2R^chZ0E*UiZ3vjmrdW4k=O^__@-#Q8m=MsPZV%#rzSOJ zesiNmz`;1pu!p?9%(?kpzRny&0hR!NGg?bQ7xX+D(6}sxaXxy|{LSeyas!AdevbX; z27ixF-w3Bv=~8_6RFq5CNG;Xr>)gP%-O*q}PiRTq9ZUS52`m@>3^{Ngp=0cfRu1GaG>OfnT~xzyz2o4am!7! zQRE!tl3Q*c)?_04TZC>M)R#xy=cm&Tm5Cs{cF!@PC2|WAygM`Y(+8xkI5v#_s5Y*i znhV>fZ0|lBl_Q^UTq0MpGVWHIPl)vHR~CZMKD3@pOp2(Mha5}rl$mM1CvJBy*mUrC z<(Ugjrt>^>_=mE~xC8R2k4AvF+6M1@$yG6RwC;m)hk{DoRANH80O=vQgy*@2ox3_S@D@Tr`pMsUn#h2tmpYm z<*|V-F}2`J#=y0_@>F})1obWr1eEvHTdMQISol!WDBt&b~{XmYgu8T|$O(u4oV&?RIYM@`LI! zDyoXVr@e%}Lgfqve=by=S~s9H)dCim^da`{klSOwjadT6q7T#9Bl!>MAoP3UO9J!P z>_>Y$3+I;FOEASk1{6R*73<-qBvZEiMG~J!7mI1*=CR|D!6H<~98-@V1u0ub@ZlNw zVRAdvmA>@W=;IxP-cnIC_>1>F!G-fd=|1*@5_+ac9zBxaK}mQg;l9kv;`&)OsQeI` z$i*#CwrHviX-9T3o61YU`@Oa#Mg_J1EJd4$0hzdT#HCIZ=_ z-kZW9vnZq}K`cXeocmVZxjZmK4Jd-GK1e`3b9e-}%Ixjs@p;ef4FLFEA13tw%>L~E zwWq9%jLiQt`~SB(`G0SE?EfiuQDzXgN(hl)1o+jwxkUVHMn=`Kpt@>$jt(g%3}+Lo z_paOby=uw$O!^$r0RoenlV6ahNDChU!{~_g$@al`L)S_rl=-y!jz%DXy%O(<3Hzk8 z{tibt{ZF0U{UC$-Mx3_nUx_$O#!E;`*I#SwTUEC;~ zPjy6nYN6e*l0rkQ@W@YPBqFaCXoSh<$(fds%?K@wY zt~&`=Z#FBQK|g|wk0GKHhEIZFXmc+Y0o-|05mKw#2(>rLJ#}#3idfrCafw*tk(Ylp zEHlt4MLji>-@2h>Vn&KhRAjwJG_MX&`gZQ=r=7cnS`aM+DidI~?kOu} zV#@gle%zn7MjQ2PxzN&fV|W*yaMR|m!5GVk3%P|yf(OBT4}Ol4-Zvr0=ZhJ}06+pU zj!l@5`9o{y;|-)SgAgI%6u)_DYj0YX@xL{i&T{iBwPg%?tEIG-E@V z_YwL)GfdEfi*;^j5F-y{qVV)K0~UhP;ivuL@7LQyS-f2(ZJK!O0{UG*dlHfe6GXkO zG!1GuHBD&<{+%cr07u?mZr}Dy z1c{he#(l|GlzyG6MfkhDEzk)?{AXrGqDFlD!cR+b zzYkovcR9?@6Xt!H+N5EG9qj0`q$YMTnu1*0ClEB!6YI1z2C_( zd1aayP0^tu>M5rx{btSnq-J)5YT-aQj(ru7XvyQ?)OfR@h{&TG4*cSsMVIAJ2cixd z<0EJ>q|G+Ca<9=)4zL!~{2{fZB}%ZlVy?wLX(y0T>UepcoTrisMJTw?k#(;qjMkUu zpdR!#Kf$cqHOkZzfI_UB~Ab;2cDLBAU>Lg;;2E3mBvyK+&vl`4~fKgo~s$ zuWjMM5y`XlDf`vX>uz;|-Cq7cKjEJu?P3)PrFa2R+`=L**9#1-0x3~+dYeINl(mT= zkTJ|pJcbr=BzmN|__O@SVw$2K+4y;iQ+6G`tyh~EI~nX00Q+VI##mf8J;$7?flI5< znrI6-A5DCgm>E$kR@?1GrE+Zd1MPoJEo?I;+X`hX;feaL=EOuJzvlmB1f6ZoDuB2j zxgS17e~AeUY-zShMKj75l{h|i-rzQ}t}i(1nIH-RfCbx!_3tS`XP;Q*n-D8dRr&T> z&Uo@M-}O>J0AjmTm6Y^lwqQx~!dP9G@J)3`@{rUQpg5Dm7#L%Z6 za44K2Xy`^m9(FRuA^=m5RLf~ssK_V(2PJQtu;9HkgNgNbWB7nxdXgG0k>`aO{8OP9 zH{>hua6CS#tPm07!>I*u))AaCD81@>_0fR^X9cR zPZ1F-KT3DTzZYuogOvtmyjKwP{Bw$pNp_4DVQH$M1y$lkB>{z?auJCP8RF)Is%GlC z8*COa0^qmMAiTeEpkHwDR@2*2eD#iAH&>UQ1jm-vItkin^b+@7aG{++Cix(wl2M#E z;V;Y-%m;t^`wwO>r}nkE(kuhL=(4|3F?2y4=P-5)Zb0uCR~d|X^Gln|jAoyl7dAE( z18+-1Z$pHzm!_m1>l_E4`%gzCWiKOho#{P^>3|udn7h5H1IzZZ-AHnEjfOgtilEG? zBIpwrMH4rQ$-9aY=;!s>K=oajr!ws8gUh}~q|YxnggWB^i}`^FKPZ#}i9)408R|3m zKdR82L^<)V81LHyf|tN_t1;6=v}NP*>FB9!Lcb#g9n;{0D-FT&A5hAmVO^%P@=>JW zs{lQTnITKeQrV$=u}#VtihV!`iHasVPldFyD+mi|>kq)R;C{M3?_~qlWD8OY`D?Fk zrGBpekFR%tu4LQxhhy7T$F^;|W2<9ZJGOW1q~mmK+jctc*yy0+d^zXb``&%`KgKu4 zu3Z?vIoDdVR@GRurjo)FRdBUt*HW<*)`P58uMjD6l`#CGe21BRgnyheCL>tUhI$rd zsI5(NVpu^y>DF8zFCg~hX*?BhYgzl3yjvBtXA)5Am)?^C2nlV@y?7_nR?=XfBbW$w zRsnwk$fNtskS{JE&0R@&6rg|<_fX$Y>oPQGr4KB~N}Ei;FZPG2pT1ADKm=MHw7goi z33ha9O?@=*3XCq?`mNFKyy6VdfiaZewAGj9%+QM5!Fb(NaVKPj#9 zV?gHACa360`epnbg&-`)-jeff&YKHMjrlxmiXx6J13|!)CqTL*Rw@CGol*UeKT1gA zcd~O3QvQ1qu&kmmEYJ>|rI!Fo-(S87^VJ?CM>`}AB_m>#NVZRN`)a7YOQeRIlEbxRJf$#r2 z7b`%}AulWDrJJ*agykG-vaO60cAUT&Mam5giz&zPWq^fI;%W*%O<=M$Zf<{u}%1B}V+Dolb8=~CnD&79olBgF35^b6S`RV=l!j;XtatcBsj7Wk_khc8JQ4E(C{L}>n+ z^PM8bUoP_$GR0+IhQG>xq9xpU)iGx4d8-~k!3>#Vgf9;k<`*X5ah<79)y#F5+faZD z(2)-(+i_C003mi)HJxYn)3eOVl{uDWfTay;7#pipO+&e8TJ+fEIaD&+N3OG?KXPIB zY3U@m%RveaGg@l$Rut@NY3A9+5r0byIeC!hBL8AAYRo!;=j=D znd&)<7IXhq6|+WOup#eoekg;+4$kJA3_@ONR0H1%mc#?iFPld%#L145wkC}a3H9nL z3w6UKINR#VTh6z$YLHz8IzAKnqlXjH&jZ=QRQ6EubB_fV*;GdQpo>Z zJo(@05?Q%9|EE3)*T3^j|L@A1i{)P{Z(CP$XA&k!TVq#Xf)plT(|%nNOVZ&DBbZFM zT$I4c;?X9*mp5|0UBR}d$i1ZryHATi#+EvXf`)F~q~^hXPVa)FVwHP44$7RG1OZ#NUl zA3!xoEVde}F%6Px8M7G@y12~|?gja&SR!OkKsP{=PE{rYc6vRi>km$9cLqx8&rFmq z+-NO4#-o9nQk zDs+e2LEa9T?&GD{4N1zC*~wk0uB$KPi^T(9Qfa}esW|11bi_~*YW&SA$se8QjJ`x1 zHPtQ3x?{-%ux7l-cs0GhAQ?778l0mPL|QVQAg-x)NKKni5hsOwGqO+OF6E3jeaWra zCXBM+U<)j&%F#fF>?#yU6SnW#s$)8uz>c2CS~|E-F~H^LeOzu|T`UwwM&H#gl;PKWgfhpOGCZc)dhC#&T>{O0|y|3K^Kumf|{}xNhoh=CJIwOFM-EcZUf#wyz zrs6NE4*y;dkMLdf{5J3n#1K3Iy5Kg(?!ue(z%9a-y9om1DxQHYQIC*c zFK&;L|KS;OId>F0&kAIC_%ixT(N*5}H$7WNGCCEk9jcAXE@&rcDQW1j0*|imQ|}+A zfFvlz){BXPA73{4oXh5TQ85E3w&PJO*+$Fn2J#;ktW-g3-|}ZJO$g-43Rd0ct5uL> z8@9q&he-rcPuzU|~-@tvejn zI2=Z!MmDSO7>(S!q6!EFGU3Zi709IzAzKMZ5DKYBq=9`}%38i+Q1&Tz7*}M4gkW* z7?UZC{gw}Sqn)bOf!_&f_$+av5S&Sgz7koB%~~l)Yr_$O>ke+MZjw}TY>@vup&&dY zelpwwy-}ezbCc?)?FJ>mTY~ZFnTGnstizegN^<8cS^l#4fN0ca*+kwnVUal)D_o{E z2m+3n=H8h;lb4z_*r-0y*|m*uHz4f%rMhr+DXnGsH1adqv`CiP*k&ZgDW(X2fdyvA zZv_8a1a`PuCby~uqE+m-OgK!tp}v6FqUwO~vm%Up*c;g_;S|tA$2Pxhy}9;Ve}<@b zn)ddPOmM;wR)xpG`>OAVdD75ajwNe&qpN?|&xEa1&`*?yo|$mpyl!8pZ$%63?(6xcY>IZMmhA@ z(V0hsd_4fAYTb&C^cyxgK46WaaR0!2Wg!D&Rvtk!?=o-pF*PCM0)6sJaG=tg{j}F` zF6ZO&GyfSx-;E1wtT*&$ZIjq9p7bt1)3H>}8>9MpvEC9M8ZD7?+7L!r0xKvU#;L0zi}^v@(y*m8U>i z1=V@87;;0c5Jun@jBAx1(zxKXL<)y#9g}9SD|E0^rKR;;1B0X3$o{>b>e8{Ijo>Ps zgmr;ZFUyy)gN#7l+b;5G`_Twq#=A8j4C1hLsh2ZX#`sqDwOy*FTfHRh*^_#A<+wIbcTl9P;41EW$8VsX1H<9?xNEc_s|YJR!oG(kfy{rXrg35QJIM zF0D}wRFJmN2vOjCgnV1h@6sr-6p{p|ly7PW;qJnz2&>~)w`fro^upA$>1fIdpGr}| zu$ff{!#+gLw;p@s;zA;dvrc=2oNwqQ!yI5a#fugV-FeDMyZ{2P63-oxP_Po36+5|7 z`A0w63a5frgvIW4mSgL-A_qf5fWTz+x6Dh4Wn#So>yGlNTGODD>jU?o940JuTJxkMot5Ykx<-Zd;CTeB*&6;XrnJy)tTjzH@E5UfLO=0|>*!#A0L^Y$(LuLI=!(O<(*^eoYJ_LgHbew*%oGeArqwXxK|4{gP7bMI3 zcCN;-Q{*cP^f~q^ObTLPVO~Z`^bI3B`A*ZI-o21P)f3t+X-6j(&cBNq6=k zT$`TAf*J5T#YZaEm^leK@D$%U-93jhnahm9=3JaJPIER5_AnxzV5jZl3iLNE^`?jq zUujGndFhl<{rTqIv4y*BNeZ4QuF_JY#_+7-<&V>wkaKA;wsD82z26tnXO&B@SCzj+ z0{d=rhAt^RfKuNbFsxx0qu>@OjHsc9UU0C7%>n?G_>Gvw!!EtVYocEmBoZ}ca?+S3 z7A-YbB-{kE`hc4vu(D|58Tmt7yxTL2FJHUMmk67Y6E8<`+24L_ZjT0Y8`6!{m~%T| z1dY_LAWo(7taZj7U?4aQOkgTHVW*g;=VStia*QTj>Rjy89a~Bh7ubvzqwiks#x^H#3M@&}$d}zU1lmm6} zwx{Dl5&H|mjHZwzGH+Wm1AV5(rq+I?w}WV3R=hx-^@TC7a(O#LWK2)2Q9eK-Aj%+` zfBI3vHXD&L?oKtfSxL7MAi#BFPH~7L|E&sj0y279J3V7Hw)OPzR3zLzF0XSH zF;Hv(l0|P0r1WLQdq~H}$`~Z=pZVBn?XaTzB#g)%qSq~MXIF;bYN8#6oGzdze^{W~lBe<%+e zpP@LEKpR6+Om?0m9JL}*RgL5oKi&PBJE6-Ad>&wdAr|2E7|?JrD0VjX0-LCm_)fK6 zm^LwX&WVPcS{bP$uPm;T%uGOK*_OlIsGI`fLnONw%-UkiQHSnhsMBb z7ZR2^_66VqMiBgUH@k7IlmZWzBJM`4!lOPJ2hSyMF1(>iuDjI)-(5Z-Szvw2E;C^9rQ&;6VkvuM-BoZKY1~2m(2V8^ z*I#ipOfVrA^A)2urzM|3Af-PC{7W_dTq>`1xNxnFj>w>SQx^1S?lIj*8{U7D?+Jil zn_)9vxvcmMt0AXMpPO|)T=KoSzZjbOz59H6m)%E*JW^1D(the0Ok^H}CY+-rzn^L1 zMh~dCA0@{!im#`VN4pW4sv$PQdUzpJt&573VwHn{24ltB^_3RtGoA-59la>KW~nF# zL%hh?%AW{cYOK5OJCemM&|MNFHd%p{=Nq42)8@UmzfQwZz&oKp50eLSncl#(viG}E z&osOlb;MK(D!mep;%G7`O<=j<3kFpXg98>7v{B{ny#2*bYQKea4Jrw)vq=@U>Zq3; zH$;HoLkJi|S5!)se_?qDOUTPFSIY2;J}4@k6Oq6rOgx8(vr|-iU;)YTUYy%9$tXTsy_zx>CtO&lTV`LIr5MmH zUDQxvj`p?42$SV~lLu1@I`M+rC=l4(4@QsOq0IPLWP+7_rUgl^!LC#TMZxj_4#fo(38>Xz-IfQTPH~ z8FPUIj2UhBM>{Dv2JIHSys>YtVF0ikDGc0>BEO592Ofo3qOMQGCM76d0E@zuOHNqb zKlz~71$SGSWHWnza{CH?;Wrp~GHF}<04OYFaN2HwG+}Qg(*40=>EMVN2`wNXqFT%{ zMT2mS5Cs87Qhgr(sj~_1DCiPe<1110Y*Y)js^ljSb(qE;ZH830qqJbNp*0bU3()M_9=v&w7<>%9#{_)`b zerVy(2WHFMNH&v}?0(eAFA6CBVK(&~!gJDnK248irLuOd)-MwXCGnu5QqZ21Jnw$Z zZ0D?g)v?(Pl#7ymU2?B=U8hAeVgYYv{@I}wyUBX>k*N!TvneNvzC@y;!a)8atya;# zYt%Cs%(MdM4X%$XUMJzuohHm?qUcdu5p66~D9MRsP6PK>*%_>pQGl;yENTIzTf<9X zX6)SAJvDM9d;Mnqc7w`C3^TkpL>XMbXuuEou-Ebp5uFn8Q35=kc!_CLrG_aPXlmNo z9;@p98jvTbdg5nQTBZ+ws+VzYKU%9YgRy;k&o(u`QaTVYLKHp79yboirDLx}kGOU3 z?LsArw7FDv=vC@=EPx0qHsV!&OY=AcEh2Mx^o5;^*VS}*%oVS~i9UD?W4q>1X|Frc zjo8snKl-m7xM_7lsEzp;=wbxeBIv)=0n;Kij|E3;g4L3ovg`_|S!$u;YEc>^nMXr)fHkTztWo6;4lAoql^_P! zvhwNBF-(I~fGYJ15(L67@~^Pg@(Mz1T*xR;;Xj89OzA??h6)5y&HI8wnhUEtw8dwouK{r7EoR+Y#3woL~I$r+8e8g|6gztOgTYU3NVv@&~ zB7e>fr0KfS5dcvm!PsO4J7iD;o-^n)#^ zB~ragFFV=K;I?_*#TiGY3Z<{e7O#21X`*>FUI4fPK$ci9XsI96U9D6frwVau$@3V@ zs8|P}n6bp*kM)L%0MH8Ns0$CvS{B#}UZY&~m+Umnq%FEO!E+%B z}6uODXw9h_>GOk(nDDjDbDHu z<}Y${JVt7WD9x9U{i$?!}mjUU{1odeuk4$!(OBq zsa;`r;#TU-KC|4ubNBGpc)>lW3zHSraE{Db)P?&=Dp-Hx0c7_%o>&>+>lZ>;9DRDm zd?7$Kg+p=RATs!}p|)-N(enqn>%#>A=z3e|K=xqz01*!ZlPbu^hEMd)qhIfM;7Ec8 z&&1h%uGm84@`5E|Ay7scwO;t}T1%dNANnG(|1IgJbv|M?L8xe5pXQR>jLFgysa;t$ zD*ux8VzI?ST_a?m$+4+5wr}6`%S7#BQ1CI$`m-EFag_#$SvxcPB?Luh@Ls+ZpxQVM z$*$f0vvBa#n)kMuo-`UMg6ScjO&s0U)E)H2k6;F!t;SNY^$|f>s9x|u(G@Y>GgPGVq1KXEdtGC{2}5l0C?Q;hLZ6A}q1EO2beOvE$`ev-;o-#D`dKP`lW%=~{dioLyrS1zi z{_E4FNv)tq=uE43)EL~hVf!L~q+qE#v5Hx!OE8fkzo*N)u{grb4NSfpJ(+r# zbkqqP&e*VID*9&U5^^^Fnfukpcik+)dBB0QW_UYE=+(ZvODPMw@fh&nrP2a;df_|j zXv7RUrvP|@Sp5Py9Ui**_QSLD$89#(_uGNd_L|n5ZN17DIO0F1ZcL<%)!haKiAi#fw}%4;^LD{6=ih8; zaarsF#1tpxnSdYbz?YzrXbV7xur|va$Yy{U09x+l9aDQT``iHqO7W zz$ZIQP_71KdnGV14z9ncIsY;<{MP{f4&?t&>dz>+PilP5zqE?~!u}l`qzVU&^Tr3x zTI*18{*?sazcGI~5&a*2Jb$;%^;clge_{VNd;BMsi|sEgCfEP)_}@`-0Tms&Z2xJH z^`E}6{&U9m4`;T2h}i#;Ci_2vV*f{u9RJ)oj(_e7=RXk6e;}OyK)C*a=#zXl>1OXr z!omTZcI1QR{-=%4Ql(fxK4*TkzvsYT_xV%VQe|aIf;O=asgSKiGguWs9d?r{a=#%kJbqPmizw?0{@dAKHA?B|39d|`tdoZnVqG;K077v%?QTL22}PZ0ObZ6 zd58fwyz#(3$Ajp~1g=p5%i8^z@_pJV*K5pn({^`2RZo3y%uM&G8R= z4&aTK4)BjR29&az+*f%SAgWJ2Fv=67Vadk}>~mmB{)AwkX&{X~#2V`S7eT?ex&EQ! z`s)(#IDh~cKSd3s51c^b`g?YKKHdL%lDW8mbJ6S#0zqNW|CYj7)E;;f zl>jWM5Jlzsdxrc68E`h56TrdEEhy;X>TGUo2j`icYGXSP|DZ|zt1a&xK8 z!cf~EU3?$=o~y0f4uG%FWAN0P58}*A=jSh4j9Z?Jn_wDaCL%onP!xLU#1d}$^QZ+E z8;Q*Z?UvR9p7oU!U+o5G4g*a7R}c--*M>s`9#)!#U-xOor|kWK1KMp9rDok}9W%P{ zSe*?#jDi9zWc2)A5A_ssX){QQd2dIfwkrum5w)v79d?CO#R~U!O+`(Bf5ZnNO39~k zwLF@Aq_t%4ehq%S004lghYv0x5tLkfQ$MbuC%d>m9tx{TtsGXmzaNqb%lQ_Nu96@+ ziiv+R2((j~IUIM_I{tx)m!6@nvAn{`OQ|%_eS3bf5lrX$r~-N8gT}VThGZ~Es#B-Z zr39ok_zw9r!0vLGFx6#x=B!F}Ds_sSQ!S&oz_ zx(6wD3H#$$<>|>^VKq%qQH5{6HzvZO?OF`(o`S%^3p1np0pMT3T=B1`ZL zg&}(!L@=T31CVw)`raIo4*Dr>keAAc052U|9GQ3%kZ6z$Z(qGe#(2!&?-`4W{EOd? z$)4lKs)58^BtD6MOm3o0)$~dcdhSl;hSRDQHwBvx4#t=&4c|>NNA9>v()gxbV_ckF z=lNng(VoX)wj+r-2D~KSV%FI_X4t1*l|*9lMMg2F0jSUL7yUKarF>jGLTsXAKL$#E zb$S#qGpdH4mv(j4tAp<6ge*#7Pr;dhlN}0nWJT5)>xQJbDS;rt4idL& zZi!3n1&~?uqhsBYLgJIg;(4iM@Ed)5JmSua5nWNSKS02-r+ACOEzSpqT`Z36Em7D7 z2!6%y5{nU~zEG410}wF;OI0NU0_(*+qQXuVJw%SUh+|PV=Xdza87781tr6eKVLw%0F~4b{z`@!&@tf>*?3qnesVN|?$#rj zc@|{`2zMKmtZo&i+5#7}Q*VRfa|dYz9?Lcm1_^_SLrZ5rmz%KzPHV&NMwmsA%BE@? zlx~MK$0n*!r~SbT_Uh1T0=F`uy}-(QP$ zfT8?oFAI;5&Tq=M=YG;tuHHHA<8+a_XY zs=k0mt_qqG(r&YFPs&zbo$N3#?p*Ynnr_qCT(x*(I3twtVc+I7Uy1wj+tnob1iBJ7 zP&(IfJ&TD1k_b|Wvb(@%-<@45aUOVu0W`%m(@dYvuNY+$6FBvOL~Yqou%#!0|Q!eoksXqjRs{#N%bW-rNJunLS@4Yq{_kA0mPKF z6HA!AWDw2ug&Jal)KFLgc4BsDr$x>3@93G}-^i3e*The@rp9%WqHo$Pzo+7|GPI-O zd8;`J%6Gk*``u^2#vFi8GIbHi3tr;%Jzh5$!7-(%ms(KI3u7hVnnS*0`b$9fTG!Hg zw;ZKzl177OihmbVj_&AhB=UV9YyS zh88S-?foj4okCab=6|;F%nmO(ACEBO^j>W2dFW z)jTBTKl4OP30uBB9gE82%OWu^G6v)6Hhm@L$92i52(9Mll-Hj;($6-`Vv|0p`A3^fT33%i`;@RxI% zt7ED*7th8JxI5JaMFE|K@1xrm+QIKItRt9}!blIGA7Er#z~^aFG8(4Fj$fdj^7=gdF{mo>@(jlPjo?`As{o3oW!Wk_hSo zhCX-3%bV-FS+)>Nga_6dfwz=OE33J{p`0pDyOl<#VQtk2Lz(n^`1&d-EQTEuz0AmD zD7lj8b?vt0`8}kw5H#=Suwz~q z$pjo+nyPr6i;}_Qm+KE6RkX>SJqES$Cey9m(WT0C0QCo&-H_Tw$Lb120@UD>5IYswc{U72V0EZ}jrLZqYkZE*O< zK#`6-+q2h8QhLVdkyZB-Ci)O2`SSlps<9Nx1MD5IMsV=X_%(<8LXS*4~# zlS)_cn(o4n>D%g`W{1=^o5bu2<>h2WB{kqs!p8Bcql{-}7H`*loI%{zczT3_kMf-C z*o>lMHNlG#S7Wgc`ftc?(w>Q)qyiw&YnKh(uh&&SQ=_ z=DxCxWKgqG-`Ct5@&?XlC4rYBJv)uvE7dSvfEPVIhqNO$TS=+MWQKQVx z{|Nc5HnSQ9Sd*;g9Gz(Vvzmi{nU>1Wx%-xrs+{-n^=X+dneKM=ZR}!Fhc8^FcZaMl z#&)WqA^@VSu|jXjSDh>!e(JQolhp_-NH)5BKw3AkCgyZGQ$5(Bm!?e9NEzQH=I0~T zNEr)Y|Ij8jA0=J3O8*+uQ)$+f`-1^$NL1OJ z=5%z#!7fdOV~y-<6O*gRHoR5scS@49Wewvbd*ftz_w28sGV)d zl#v)n_f80ol%J*TJA#ui)`T-cVYfmEtiOiFD#*&|ZG zx}Y%A#_?6Etz2bQRlVlX8JsI+-SQ7QFv|9VruIMTVn5O>kwdXAWoCFWl9DLnK@z#c zH=%+Uk?+1D>SOVwcw?)V+_yCbS0u&R^M_!Wy2Z^=t6@g|emqwf4j*ay6MakbRvc*0 z-FC&4237hChJJ|gSk*v}Wir~pc{fUU{)Wlt#o@4RSNU>nYNPjll z4Gdf>g)PPC)qe>2t&9gUuo7KF=QLN)&*Iq{urPHDOp4l{H4IqJr zlaMuOl&q4Tk)L2h9ks5PZF)*d&34vnsVWYg@+Ro`!pgRUFwUln zdl-d2egYo%{C?6Y@G|f=FTRB& zK*bx5ccz|1t77AN&sm!xxe=gW=?7MMMrCb+d<)E}BD#i{c#i|fOTYzT>KPC04rUsS6I*N;tZ>i3e&Z%8+se}o#>KM6ACmL9t-A+3R05|Jpuqw66 z`l-6ZsvYyzr(8y!K?mx7_M!FCa56>c$%AKZkQI_Wzm-YAamRd$=IRI4BMB-ku^8!3 zO730}gsEi6BNG`S-&&w%`r3{LSCP8Z)~so&IpDM_wv9a%vfEJ^Z}If{kyp`D_mPf= z?DK?AS6o_zF6h68VnoBM0isOkikF1749zQfdJYC<0o#qWMs*^_BstpEiXUKo?aLVa{!3NqTJ@c(3yT&@XCTpYemvR;HF1Mn}CleZXpr7yv! zVqDn5y^!0l7j74@$1&l5he(U}TOTsyV!nwV6kvO%n9YrtFVjKcMM<0C1K?j;)3ng` z>i0KBtvtaNYJbp$J!SB6j1F0)nd4%xt<;utC!iK=^m$K``GGQnw@>_l!}?C4E^X5p z%3-)jwt?RjX3*9`0C1l1SXXL{_E359a@;~eW@sIR=HY=$QO!)vkAl3Dtx?)xKXyFb z3T~i6_KbF7q`T0j*NUUpxh}^7SVwgwY~?Ie zbcqg3m_4|CRWq@XKkB0;-hoCc3Ku7UiSvN0v?6bB08`!G?tzIkCA&lE9%$jWy=q5b z3|?!UKR_qj8he$ZDkWTxc1zgr2gFtFenDo3&kE`dt%{y$j}G7L=6$Ak2=I5rvJU|J zAbJ_REnL0$4oJy?2O&IUhJjk(`#$~LLJx5)QL9wPu|!3ul9`@OKtz;&iHH=`J6?;m z-8Y&Cx*zl{R)~mCQ~$1GX4Vb zuYrCh=H?3Dl-~@v@*aC3oJ5V>)9n$vcu(0}fs6LaGywgd&25XaRh+a8JA#M~{pE`; zrCLkyN**4j6SCkaW75pR#bZ19UgR0;}0m#_w z;dN%yB0xdngg7gh{|qlJ=4h-{Nivy;sFNNjV`VgFJEMCgavLsN`;aTcOX z*HxJ5F@#Io8%q0H@`W1c3TTQP%-_feQYc})m^vPNz_NEKQf-iLF2HEu^O&(W@a-yg+VvTRD}skc}b5H8UltQe9eKT{x48p)hA{TofP{ zO{R|&Ok!nb>*@MzyaT?B;3*vL=MjfQSPswf8OI+a?j63}ry%E%7p(RsK4!)Sck~sg zXwT^N6xPEkSiv?1)EtsmUl(DaPuDbDwH&e#0D9T>c>emG)E zVA=0Kx-x8-lcycjkVwNT_Y0|7RwtI*m7zTB%yTbIhC^qhlEQ|hv;s^O>KSnENmQ4H>1bmVolr0yvhdN@kRKAqEc7NHy+A5Z>Ps5z$&+7LC)LGX3Z zqHQ9Ch5ktH-a^2~%Xk_AB_2?!%6rwxuXzyCio_g~b9=`2I0Jf_j;)JhhUP48s=(GM z@*NM(RxMoGbQj!R!U3eZw}YOyaZoaf!YI9SjpFE}=KkbN86ONqezLFrB?GMtK%yv3egD?ba zi*HR-LuruKre)|NLiQFinO{}fqMc$~#y+QsY(D1q%Jz#}v|c0*IiqzXv*05|8b#ci zVYJuvoO8$(rra%k({crLv7hG$6qK!+RaBnT9E02myK!rT;K-g;t9sYA=h_zY2XyNB z#D+nty8vtsV1*6KVhkxHjg#H;c)#`F^70qK$UfPKx*25BDC(}`63(xM^hzLvVji3E*8?u8@L{!#ezC_ zowlS+At5R%-}~xh$@{Dk0CC-sJ>E%X*UelhYX^>{tgGgm8rsKLz<3_*B5a{RxnUQ4RgOA*-i}W zHhkzu-()kJ$CVQRCzX4TybXD(a`dvpicX*gyB`PbDPHJ6pUU`g)#hBkq0`CM`upA! zwC-hJYdk;kq$^(F8^X}XiLDQDtAvny*CXX_XOG{QqVBmvw1lD|>2$^7YSpxZzy^{G zxB31s(-%~#Il1kK`R$$U`*K8ZqPywd-kdYP@I1Ym(+*F7>OQ-(bx4mbw=GI`X?Xk} z{jMeAMmMGYM7zLNB$b_;pKkaj#@B7TT5rwhwstv%XzT+MbnLChSv)@m@ByfBD z=)4kBVb+NRv^LD~!LoP4j69MsaLHw0<`Iw~gWo*|yj%~#AEZ^B4q-m<%Ax1?aCd`M zVJeM6+zCME%=G1~_DJ>Vyz|c^<#_ev_+;6J1$MrfA;9gElKy19L75Wl+<~P^EFaAX zx18A?lg60Br(8E;N9NsgdMF6>+ewgy_;b6k`X_q~K+8|1C`*A7k@^Kw*?K51X4BZy@C?_!^UwYB=o#!=v?S&~&?k?l{ zvbT0W875K9z^tig!fgHwUPAF#7?{9p2L@(E!}nd$F43XQNwIFVS3}?mhd^F-8$#(u zz%&;(KpvhgSg3lt?^tI4{Q4F7d@4QO|De}SU<1Ic`^dE(XE;oki*yBxpd=d?QIYDJ z1^4p+4gmxQWU3kq7duRIfVkd_`zZuoY4^E#PKc7_F8}QJwHJs2)Nx96OHcMXwsIaT z##dEFEf!v0A$5#1adv#xY&+#K{ z?-)oo+Vft=Opp?#`b#4%D@0x^$7ka8vQ7J+AX^YM=GAfA=skSAuDAZ~XpKeolX@dh zzd^B)Vik^73TgocA;xZWWiVYEQCV$u2g%(_CRPhVJz8dmjeXzUvU}qDyS{H=SwMbZ z0lbB+J<2e0d4I6nXhk?41x--Bp2OaMVYa?ESVd87uR1;7%mj4h(=O?k7Nmet^j5T- zghR9qf8kN_>JyGgeE_yszvc%0o`2su+{;H*r#ni=&fCmEGNWvH%wk=D$W>)FQQ6)@uSqxlqP{siEx%_Jcr4Pp{1y$|6|`E0 zOIGpCUEVuYv^F|D_mr`7VgSHf?;>2tGI4!GoIABE9dTVI`F*CUQ9+168 zY;=OGXW1W|yW=Qnx#}N}BCgjyCwa5)wlEX(ns$RUT0)mBX_>gM|hwq`O-yZ zb9mf`Q@6`M*>72>%)afbqAoQ%B7h)vao69Du6R8uxAn_gSP`pAPpG6W_1^iVG`-ke zh<%L0z^$Z_e-AS_r}mheu=QL{Q3i3jE%;h@Nccri({f11By9t|Y>cj9RhD`;(f60| zb3^HOQqx3!$6KgBl&seducVuOU|>Yd9Dlg4v#9hak-Eoc=wUW%CVBGF3jwxh)uGjf z0vBE&L~sD_&w?IGdC6Z23d>-$lNXz0zZ}2mN}bsW1N^uA4%ULBH5t*rS6K=v^>M3x zh?0VSXEwE^`LK{wX!I9|y)NHwpxBbzrcNY3)~KIpzaN|XjM$+FjsLk|@d%CBqWZj^ z;>KmmN4s$5+G5ojIvy-8O$YEs0=LKOY1@Yp^2cz7elcrB5j-@6;8@H2Q8~6rWJLFt zJ5n9%WL2`JtYTZdNIn#&OsRx;rPTJeqvE$Ma}(L!ZtRGTV2&`{RHPv%i}bVBquZ^p z`s~N;H~S;3CrFv^{o*W6^@EFD%X%VLU3*oUpnj%1v(?Pno+d%uP{;r~x&D{qu=kbN z6`mOA&M_ta%<2fxa*`%tYyUqXgBT$`Gpmi@d^3{pr{1)(I>MN>Hna`h2xaQT(82k0 z{=c7Z1NyyI(vcm(0k6N>QO~_IEYth)CeD$`=B94mI`wM_s|vFHi2`kM6D?mj1jk8@ zkzS1p_uW~riJVAWvfu$8%z4)ZOxmC^-li&lG=u1Y^bB%2K?{N*;sizWR)I*Cp{Krf zDmF@rhb*W?qTvq#UUxxV_{$~c=@q8pDor$pX2K(5n31HxGRQ>RR@^R+Efa$v~ZeONea9&DcTKhSRRV(2i&-;xg@=Dx{Zy5)?DdYQ>NgK#o zPWx$K*Dn_aXZb9LkXNn&+}*+f!d7gfasBOP@E>Mkp1-Wi01i$bp8qryYeTE6ue1w( zndBLq6Hog(-yNx?}kLV*gKZ&E;`fPx5yS5Ax2^@YSXfpuWE5)pJLf-pw~p^r$o zW)nieq_b`?ZT~<>J1gtY1Hx#GcAH1n{jzhLkwsdM@5i6F4@q%cqylj=R2yu@^*Rnm zK=|QNMn88Vvwy^Ot_XoU*88hziB`2sYgk4bsvoc$WbilZfSZTXcJvQ`hcd>&wN-kW-6L;@-PVJg2Ys{_ z(FutzD&|ECt;NEr7GR_mq*VB5icwe4u))nPLATZ?Lh3juH2Mc6;C0L-E2DvPx;Y|` zjms(5@?9zwo!Xl0K%SwHQiU-YlOw~qSg=GezeL%lygV77Bi6Zek_P!yY#jI-P-t6@ zyU05pmnq|=_OM7l9Z0^`7@kCI$+DVca>$x+Yyqb#fw_EavG^iflHhnkk_yQPa)lXhvQc@1Kk_H;L(!8()H6^WU{nzlOq*DX zqv1kpOKYGgRa`VQLbG7)Rhw@khmnH$>8(pFzULMs8uMnQE$gkP7kOv{j<^2s6glwX zkzBNN&8*)tkShpXVj`{S#GU<)i4=9<`VqQa5yLBTULK};uO-9eOH04=!%~};=c`Nk zzCHNm@d z2x!_e} znd48|caAPk+pSRJsdlZAf{a-gA~RX>Otr@x7*v}2bf@$LeADE{E^cTawJF*Q!ah{+ zd(-+=k+KvxN6`3B0W0N32*W*{U|(=}o;XskaSb+VkZns8K32WQF)BNl{JkBoFt>?k zlkrg56E2Vo62Nt-QCH@diia>U$D%A1l%Yu%r1xOCL6ky3ZUTFdeHaksoFZ`?(#Map znPx?dXsbB1rPU*O7okMUl>48E+^Y0L2@)3E4fA5VjpY*20X9QBH%1{+V1SF?TMI`; z&<`o<`Do4bP28jmE}Gu$i<@)bMw|ythF>XaeX+ssfW#tqk8v$Ff$U6@xf+41vY|+{wgtSNql2X#~F5l;Qe&3()-hb?8KIcB?%r$4u?0xU-%r)(vq15=9 zmt@f=V{C0bavZzZ8{)Gi0&-j{+!dLZ3$Yn=&5bVmnN5UE?`d>Gj=oT7ke&&1$WN4QCnw?`}(E*xT~^KnDZTuHTmkJX(gL4xQ{XV;z`oL*w8ow zvzTu=<~`g2^j|MND0iaH)v@%t!^e~*WSecd*U|hlf^fpu&-)|&iKG@$LiL~nhEK&j z&o2!-MoI@}sQc@*Wy}`2XDo%C-HCbM_Vnv!{Ld2*DZ_>Vb2=&PirlRCJ_g>=G1*0b zx6(kmWUZt=opJAEaBd2>BjHIrc_(#PlCz)gr|0+m1;3td?Ne-=JzhT|4I(*iapIMY zDR#f`L^y}tU`7Qt!)TGHzg-uI=wf8_}u&LNdCANa|=sj z8utylk5O!}h|D)#>aqctsD@ViC z7A5-500}KUS%(*i3e}I`J~=tGLQ?vvcs|a#^JAt2R~V|P1`i)3CeX0Vb=umxmTAe? zD6|D>MTq>^q7tN(K(?-*{_IV#!RQiXrA~S3yd?GGPEdn&S5RM)s9ZyNtbw!nTpx%s zUL9dK!emaK|1OP7PMOuh;-^`j42D_X;v8|K$!IG`kexoHNR?1&LieesCV}i?1+6F= zA!=Vy9uEK21y&1<5S+Snsf%wjH2%j_L3en&o4V%cY9UXUH{0pc9eP27qeT6{Y0?f; z7PL0rrC|Q`xQ+mvpgcxK)w`bt^H~bN)iol5${wzgPKx<70s^U-E2=!9c5Yvn9u#$4 za-2FVp23B7XBE-C4V8$?H?&{MS#l-)IWYzaf#*lWUnOhogS*0hBm=c@f)<&)yZeWC zU$DuKmFT8DUn0uVJ^wk+bLtif-Z)s?_+>&GDq|n$8hR6+nW0Ev6wW1 zym2_(aUB=NEqswcOu)@q*uqliCn*x7ueihQga}aIi3ww`y06^FM`Ai!5lh>qw>04m zRM^4B^6k4kKlmIk1GFFM=ucl`PnK6Jh@;pX9N>xf({|JQ9x%CGGfdFLw4~Q;dW7w7 zv~)7);w6*v2NJ!izvZ^dgRDI3b<9UpS)vX><3EPfxVhF|`c!g(K4~jr1XMbzS|#?NM|wN$8r*wNt8dBdbxv~sI}^$ z?yd8vKsQ2VfjttfkyBzZhrZtl z44IT%iad0AR-u6!$0MQK1T`VhF@H3i5vWn;Ypf=+Bj1{cuPpoG`s9J1Bx8{;1ZhQD zK?|XtmE80J#O=Ro-HH5FC*Prs;Z+dk29O?+SVWCgV_v055pg&^ULSeFxd!sD?+YcS zHuKA{x2`}yzfz!)xeL1JEU8vadD?FZh!SUgch3jsGV|Ujc^6^JJES^rveQt}CJB#O zNorayX*M{4kFbUNo29;QGpX8 zeCHAi-{wp#7eTE(MZKnSr6iCHN(rDal=m4d#(zRL*R;dr9ftaWt5xx4>)7g}QE588 zy|X8-vKb*Fg7P)hgZ8sLPl6s!V=TOKh9n~ckj$M6GSy=tTZ`AhZ^yAI0GM5`*HlN| zhaE$cnc9o)nJtgK@kcP+E&0P?<0jyHDlr<*M9?@QkS7U0VJE5}?_Jy*ag|)O7p{Au zoh@QwDNr}FV;_DRuhkBYc095bBHtQOWl2Sotx^?r7BL~T!Ql(TV4|6%bGSNC?9+OyB{sj;0|>2uIps3mYrc(l+|o~kDSvbdS#By~nOvxk9u|7UZ;H)& zbp^%<+KbgS%-ugzG%%|O>G5#Vui{Vae7|xz>A4k&e*xR?$sn zehoM|To=o^(+vfGoZ6|$8+s3QzB7UxzF*1b(RaUn-mIFuU1DIP zPw{f-VaGTTJ)eKhw%hc=R&x+J#TsU~QO$#)Zvy*@pPB{>5G-X?fo1jiTC*1gTO`gh zGmt#m!RqMvG?IsbI)hi`4xKu&a=q3kvyqU?V8#=vshH*M<&3zL2qB!a#V2CQfX4pT zK9lbwphQqU9I_VX*f2X@}GTMY3L(*tDbaX|ET=4-xVzYLn2dX z^4V4Y0v6(c{@H6$!$ZWY%$gx`l`ku@OHaVI6l9AR-jS~|+=RgH+q%(-cpIID8y}KN zb)Af|NUv1Q)$Roua3mF;6ne$I3?A#~_9mjyC#VyMNI0;5&p7J(aV0rYOI^9hci5AP z(7EB~dF!coh@BwuIXt?>FALcO*h(b$GZ11YOx%Eo?-nAW`oz{Cbdc}1n#LE{b#g4n zq<}qf%Ahf_5#6>Zjt*IjRb_gS!Ip^o3?|sZ!zRGQhG(7}8`SXreR+AY5-wfAOWjZE!_W6X8U$Rc_yJFkWBTMJt=RG4odUrpCzIL^ z<)Rhr#vaz9)}k8r*e0lVHWDV?#X zD1E92S{Tl@j+OKnvc;Q^vy8LFOA&wfaNE^=(NbIwQBBbgRk9GZxE!3L*5M0Zp#)9e zrK_)$N*US=6{Pb8r*;N;E7Aw`+x+}U=t`F!VTDtSSN5H|mdiz1in1e4;xTe#_|f5c zAnAkvcfegrS&weAEuVHh+@jcxW$dGWTqo7geG(?vK5Q2J{i^smw>#9^&mHsGPAn>%HE+ z;*!^3W&Pd%eDZN8(bY%hC+TLOQE(A+{`Qp#MKIYJ`Flk>c*zK9N({*^ z1qnv&xyqy}ZOPTX?aD4#Z|FKdo!b*r>q#gi>uxwbg~{xi zVB5v__*dpujgBZk4Aab;FoRkmCVGZ75`0!&rwen#z{T-vfiaEw3|PRA??SOE3nBHw z?`yJa%!sVF5LWkF(IRtj5ss4sa8@QJ3>K0yq}*QEzVm)Q;PhP`4|(d^<29~1Ovuic z9FjQZLB8cACywp5wLU|?{W}pxp7Izn=T-GYg|LR8GfdfB59YueD!ycdqjgc!J4QpD zson7kn~;m{amW*q@HwCjVapB@we5mGKR*?AZ-vOsjiNYPd-7S-d}2rT4=QbGjpfn< ze6nsJa)@0pAu;Z)9YUxUa%P| z9`1w@{YjMSV(rQ{;|s+UHK=PWe>y$l{k{^3xsX%l;%FBGRcXK32(^sDFdSy`1zY*`Ay~Y zW#ww#m8Bo+$Sa6u^tlR4^@L47SkB?l3Cov8+M3A9nuuw)8B>?x@}u5rB;1#gbWhQ% z|KuKt%%nV85~2?npy6URaaP!$z}3R}siy!`$wD8~{yOE@gxFe{Q>|4d=NRH1=aPTaOD^Cu=ao9H%X$A%@1o+%-FsBK`=1PmFDmOix^NSp26K%t>XtUE zYinzKbv+JWr|2+n@TjhE_NcDiwK}s)?Rs^8m%Qy6xsjf8R-8slE{(ew(B~NEWXI$2 zIs(l>Pp$#A(FqA|h5fs6iX0i-N{9gkf{;nAN@#qj`D-a8Pa7_3%M+|klmzzA?!kX& zuwj6IX0UmoFuwnu!Pc}=Qq!dHBe*F2Kw`QnxJg)Gco$;b5y2Y8s&gNoqmCgYM9LK1 zKddrPKC3k-$YKre-luXVcKgtL3UDVNNoSAFI^2uY;YyQG<8TM?HyMKZvzGD{Q^U0pu0GQV_?Y--V61$0E@ zC5_vtj5$PR0+eZ!v$rq8y`@~8``11HY#bz3|C$WwsQYysmz7laWz6i)c>v-V)6Man zx4W!_ZGZ17Q9905iy{C&H%xIyF)b!8EtX$^i;>sV+(PZ3_{X>nMb~?M%0`&|!*)(1 z|K$76?}1`*%qf7z{U$2}tZ81EyOzR67J$B_Lj1fi9DY%At&U7Bw zo=IZctu-b|^H3zD$UdLU+awe?wIA+{kaSTe3z2#i?7ys8GC8!)-OMq#{Dmrq@uBj| z`2!4`B)MJI7d`(?}6hsW!U zwU!rn!R`!QGP`eMp7zunrlj^iBan#-^6$CRJ>m?Q#DZKv~EaXfoiRF1c z)mYb9*zWr*nyN6PPO0t^wK>Rfb&HmQ=|ymKb^RNOAB(5WPiJC7K9jZ+JI-LWm++JQ zjLes>Gr+#^b+}&?#*E-+s?9YQx<4xp^v5EvT%4QIov;rriE4Y|q~PRUp|MmZO;dW9 ztiH7WC!A&a37a{Pma1td}|I$_UXS?dg6_IX?`dIXG5n7~ zS*lrZAvNLOiF0Y94(uJ0l@GlO2TiOvG~*ADzYS{7>Q>SyJ%!g#-E9t|s`-Vpt>o2} z0_p6uQXbF6=?B}G2RB>SHy>5`Y_Z0}TNu*ap$ajE`Jf3+ofN)eYo6&;-GVrxT+8Xr zG`&azmibRy3rmO;01uzY;$ecV7i{{+~L>)zMvNLEE#2 z8Y%`RYVmOkym}lZ{SceS&qi?7e2Ki6@n462%ii-H7PFba-##QtP~l5{ITiO@%e_Dq zNvX_ULAFY>=NQFXC$#>X!>gR!@PnP*w7RNQ_V0>?F-mF#uCw}{Z_$0f0b+Gb#vnKFMJ9%!r3E?G@5ys9TnPa z%f58j-Q`Q5vRcF&ZjExSxxgfN!ZkwU%r5oNkhTT>Nwf;$z#|+z1j%%Whd-uaPl4|^ zqcdviEoVs}a=jU~7JoXsc2ejV7FGpvyyc1}Xu|Z{!Ndq`m}fyolPa(=+OQLR{6g6< zH7F8hwS1K0@G|dxEZsj|1eIgg>Su3K8@WuNmd@8tce zSevp@(>^`ddmnE#(9pZ5qGwRj@U{Ab4^cw8z}u$cI|xdeu;a~oIct+XO(Pa+1*#Tc zQxkK!-Oo>@g9CPnkMpeuomJn6sh(HZE=+R;H#f}SjxYt|x^nr@Bxrx_Rb zPgfTyzbI++HJ=CkQ$zabZ;@TBjDwQd29&NhoxA8WP+Y zb1SOIM~al^H=|7`xAWQTZs1%q^1t=jFzEuQ$o4b3`{tYC+y&!)4)E?Ot zJCP>c*`$+QHll5-@kx37SielQuX~jF0T^Cy6<92M6&pfn`~8n$9AB4`5&LIJ*~WOa zX>N@Sv$ejLRL)FCOd89>E1BN<*_wH3gK#-*l|TuPx>n)&^1BD-&k!#|4{gj0TT))M zXuKUqlnimrttn3ZkS9B^Jbt$^nyJTMyT7SzkdXmT|43TeJgBi|9ug7QIGe5-Ua+&5 zZtWnODU-cb+j`N%Wc2dxngm)9PHg6M2bzDQ=c6|GQu7Fn^_GbICyBg{UN1NR(Dsoo|O=*W51=ymb7W;5tTK)2rJn)!^SGOxEX zN3(QLR5N(rc!F|9A$<`!-hc%XTZ!ig?cY|=wkQ^R`pck|$HRL2%X04TP=iew%TOt% z6Oz5}9NR%|q4V#6!c2t$nN63!P)nNjd=Y0<`C$_Mg+o=B*_D~|J>DBgi}@a0g-7jm z)9+_T&x_3IghL+S^5u^XJQs&niHRFHU6M2;OE$!bFK{}LkeN&b`TO*9Y$JXuS>Da_|U?VlR)YEJ<|B>8)n99DYPJ@S+^^{^|_~}Z@ULxK< z7)`6icpGmaOt_&%71=CU@4RN4`D4L{ZoC;ogHfT{$~mmhttg$_tf}w0=XzTr^gccb zk26S_gf?aFS90nU((17T+Yvj&h2le!oZC@lpFv0V@37x)P@gLvptLAqJ=qyEl@;I2 zy=}3fP5>qN8|9VRX{=*_5HzY_* z0{e%l;=k_k{&R0&-kcl_Rt5S)kA4@%4}kEa$Qg8wc>YschgA3&pws;DQ5Zv7cgR|mcKjI)3kHCoycnO-{%`5cDHKJ9(0KYl z6bu4g^KM*U^!D_){}iBbULcAM<1ZN)#0x~>{aXeEK)^`KGiC$`!i(bD`1>XpeodnB zmkdP@aZTp&mkbOA0Z>8uO9tfyfNlZcg92^>;Df^c0g6Cb{|7yo4|L6~@|QzCFdy(% z#i+$LD2|7}^dKp@M!*5ms1i=6|qXh;*|366vy{0bt+aCyaO{w!A*+20I@&N(2 z5P~7MB7>^rR*S(v_^ob2`MYM8`A;R+1t1@4B;AmKK`_Mi!B~GOf_VYg^g4gZP{y~q zgcksX-2x4Q18@7|1>6L~3xNHv4DoOHd3j;Lo8bqej`g|;2Fwcr-_%3df^H@zFBo=B zrSn%qQ2wq-bN-cG#~;iKhTrTbl<_sm&cBMN5^93rcBZ4!`c@Qp`EFH=vb{BAK|nYZ z@fVtFFsS(7>L---%_yLZZ-EAZ;h>v(D1Y#qkwJ<6FF(Nl$$peETdsEoZeNTIx_XTc4JC@i<17$^pyTMgkurQLto{xfjFP+s6ogkb3H&VoYW*9X=8 zUrSt_jje3Wol(?F^gOCo-sbc$I6aSwg9D1J>6#&lo=3*s!hs%z6vZ>eBO^htD+qyt zB*gi6C8We9QD3b<2?@w^2^bhI3gd+X#l&H}yu$w~a`~LvoPvdw1 diff --git a/tzpfms.ps b/tzpfms.ps index 002d4ca..c91265c 100644 --- a/tzpfms.ps +++ b/tzpfms.ps @@ -1,15 +1,15 @@ %!PS-Adobe-3.0 %%Creator: groff version 1.23.0 -%%CreationDate: Sun Mar 3 18:05:39 2024 +%%CreationDate: Sun Mar 3 19:44:42 2024 %%DocumentNeededResources: font Times-Roman %%+ font Times-Bold %%+ font Courier-Bold %%+ font Courier-Oblique %%+ font Courier -%%+ font Times-Italic %%+ font Symbol +%%+ font Times-Italic %%DocumentSuppliedResources: procset grops 1.23 0 -%%Pages: 15 +%%Pages: 10 %%PageOrder: Ascend %%DocumentMedia: Default 595 842 0 () () %%Orientation: Portrait @@ -237,8 +237,8 @@ setpacking %%IncludeResource: font Courier-Bold %%IncludeResource: font Courier-Oblique %%IncludeResource: font Courier -%%IncludeResource: font Times-Italic %%IncludeResource: font Symbol +%%IncludeResource: font Times-Italic grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72 def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron /Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef @@ -276,372 +276,15 @@ def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron %%BeginPageSetup BP %%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-ADD-B)72 48 Q -.4(AC)-.35 G 42.103 -(KUP\(8\) System).4 F(Manager')2.5 E 2.5(sM)-.55 G 39.602 -(anual ZFS-FIDO2-ADD-B)-2.5 F -.4(AC)-.35 G(KUP\(8\)).4 E/F1 10 -/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-add-backup)108 96 Q F0 2.5<8a61>2.5 G(llo)-2.5 E 2.5(wa)-.25 -G(nother FIDO2 de)-2.5 E(vice to unlock ZFS dataset)-.25 E F1(SYNOPSIS) -72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 -SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0(After)108 153.6 Q/F4 10 -/Courier@0 SF(zfs-fido2-change-key)7.564 E F0 5.064(\(8\) deri)B -.15 -(ve)-.25 G 7.563(st).15 G 5.063(he k)-7.563 F 5.363 -.15(ey f)-.1 H -5.063(or a dataset from a FIDO2 de).15 F(vice,)-.25 E F2 -(zfs-fido2-add-backup)108 165.6 Q F0(may be e)2.5 E -.15(xe)-.15 G -(cuted to e).15 E(xtend this to an)-.15 E 2.5(yn)-.15 G -(umber of additional de)-2.5 E(vices.)-.25 E .273(First, the wrapping k) -108 182.4 R .574 -.15(ey i)-.1 H 2.774(se).15 G .274 -(xtracted as normally during)-2.924 F F4(zfs-fido2-load-key)2.774 E F0 -.274(\(8\), then a credential)B 1.604(is made as-if during)108 194.4 R -F4(zfs-fido2-change-key)4.104 E F0 1.604(\(8\) \(e)B 1.604 -(xcept the "primary" de)-.15 F 1.603(vice and all the ones)-.25 F .185 -(holding backups are e)108 206.4 R .185(xcluded from the search\); ho) --.15 F(we)-.25 E -.15(ve)-.25 G .985 -.4(r, t).15 H(he).4 E F4 -(hmac-secret)2.685 E F0 .185(is instead used as a sym-)2.685 F 1.555 -(metric AES-256-GCM \()108 218.4 R F4(EVP_CIPHER-AES)A F0 1.555 -(\(7ssl\)\) k)B 1.855 -.15(ey t)-.1 H 4.055(oe).15 G 1.555 -(ncrypt the wrapping k)-4.055 F 1.855 -.15(ey d)-.1 H 1.555 -(irectly with a).15 F(random IV)108 230.4 Q(.)-1.29 E(This turns the)108 -247.2 Q F4(xyz.nabijaczleweli:tzpfms.key)2.5 E F0 -.25(va)2.5 G -(riable into).25 E F3(salt)108 259.2 Q F2(:)A F3(credential-ID)A F2(:)A -F3(credential-public-key)A F0([)A F2(.)A F3(backup-salt)A F2(:)A F3 -(backup-credential-ID)108 271.2 Q F2(:)A F3 -(backup-credential-public-key)A F2(:)A F3(IV)A F2(:)A F3(encrypted-key)A -F0 1.666(]...)C F4(tzpfms.key)108 288 Q F0 2.238 -(is actually a dot-separated list of de)4.738 F 2.238(vice b)-.25 F -4.738(undles. The)-.2 F 2.239(\214rst one is as-described in)4.738 F F4 -(zfs-fido2-change-key)108 300 Q F0 5.181(\(8\). Subsequent)B 2.681 -(ones also include \(identically-encoded\) IVs and en-)5.181 F -(crypted blobs.)108 312 Q F4(zfs-fido2-load-key)108 328.8 Q F0 .081 -(\(8\) shops assertions around de)B .081(vices in a de)-.25 F .082 -(vice-major order \212 depending on)-.25 F(de)108 340.8 Q -(vice numbering, a backup may be loaded e)-.25 E -.15(ve)-.25 G 2.5(ni) -.15 G 2.5(ft)-2.5 G(he primary de)-2.5 E(vice is present.)-.25 E F1 -(ENVIR)72 357.6 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4 -(TZPFMS_PASSPHRASE_HELPER)108 369.6 Q F0 .046(By def)133 381.6 R .045(a\ -ult, passphrases are prompted for and read in on the standard output an\ -d input streams.)-.1 F(If)5.045 E F4(TZPFMS_PASSPHRASE_HELPER)133 393.6 -Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G -1.596(ill be run via)-4.096 F F4(/bin/)4.096 E F2 3.262(sh \255c)B F0 -(to)4.096 E(pro)133 405.6 Q(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 422.4 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 434.4 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 446.4 Q F0 -(Pre-formatted noun phrase with all the information belo)160 446.4 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 458.4 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 458.4 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 470.4 Q F0("ne)160 -470.4 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 482.4 Q F0("ag)160 482.4 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 499.2 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -511.2 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 528 R(En)87 540 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 552 Q F0 -(If set, enables lib\214do2 deb)173 552 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 568.8 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 580.8 R -.727(vice which supports the)-.25 F F4(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 592.8 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 609.6 R F0 -(The lib\214do2 documentation at https://de)108 621.6 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 638.4 R -F0 1.6 -.8(To a)108 650.4 T(ll who support further de).8 E -.15(ve)-.25 -G(lopment, in particular:).15 E F1<83>128 662.4 Q F0(ThePhD)7.5 E F1<83> -128 674.4 Q F0(Embark Studios)7.5 E F1<83>128 686.4 Q F0(Jasper Bekk)7.5 -E(ers)-.1 E F1<83>128 698.4 Q F0(EvModder)7.5 E F1(REPOR)72 715.2 Q -1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 727.2 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 744 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 756 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 2 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 -SF(zfs-fido2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) --2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne authenticated by a FIDO2 de) --2.5 E(vice)-.25 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 -124.8 Q F0([)2.5 E F21.666 E/F3 10/Courier-Oblique@0 SF -(backup-file)6 E F0(])A F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 -2.867 -.8(To n)108 153.6 T 1.267(ormalise the).8 F F3(dataset)3.767 E F0 -(,)A F2(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the FIDO2 de)108 194.4 Q(vice, which) --.25 E F4(must)2.5 E F0(support the)2.5 E F5(hmac-secret)2.5 E F0 -.15 -(ex)2.5 G(tension.).15 E(If)108 211.2 Q F3(dataset)3.244 E F0 -.1(wa) -3.244 G 3.244(sp).1 G(re)-3.244 E .743(viously encrypted with)-.25 F F2 -(fzifdso)3.243 E F0 .743(and the)3.243 F F1(FIDO2)3.243 E F0 .743 -(back-end w)3.243 F .743(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 -(Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 -(ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.465(xt, a ne)-.15 F 2.965(wc)-.25 G .465 -(redential of type ES256 is generated on the de)-2.965 F .464 -(vice \(with relying party ID)-.25 F F5(fzifdso)2.964 E F0(and)2.964 E -.499(name equal to the dataset name\) with the)108 264 R F5(hmac-secret) -2.999 E F0 -.15(ex)2.999 G .499(tension requested; the de).15 F .499 -(vice PIN, if an)-.25 F -.65(y,)-.15 G(is prompted for here.)108 276 Q -(This mimicks a W)5 E(ebAuthn re)-.8 E(gistration step.)-.15 E .962(The\ -n, the credential is asserted with a 32-byte random salt, which hashes \ -it with de)108 292.8 R(vice-pri)-.25 E -.25(va)-.25 G .962(te data,).25 -F .137(and thus generates the wrapping k)108 304.8 R .438 -.15(ey \()-.1 -H .138(which is optionally back).15 F .138(ed up \(see)-.1 F F1(OPTIONS) -2.638 E F0 2.638(\)\). This)B .138(mimicks a)2.638 F -.8(We)108 316.8 S -(bAuthn login step.).8 E(The follo)108 333.6 Q -(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -345.6 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(FIDO2)A<83> -128 357.6 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(salt)A F2 -(:)A F3(credential-ID)A F2(:)A F3(credential-public-key)139 369.6 Q F0 -([)A F2(.)A F0 1.666(...)1.666 G 1.666(]...)-1.666 G F5(tzpfms.backend) -108 386.4 Q F0 2.708(identi\214es this dataset for w)5.208 F 2.707 -(ork with)-.1 F F1(FIDO2)5.207 E F0(-back-ended)A F2(tzpfms)5.207 E F0 -2.707(tools \(i.e.)5.207 F F2(fzifdso)108 398.4 Q F5 -(zfs-fido2-change-key)60.227 E F0(\(8\),)A F5(zfs-fido2-load-key)56.728 -E F0(\(8\),)A F5(zfs-fido2-add-backup)108 410.4 Q F0(\(8\), and)A F5 -(zfs-fido2-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 427.2 Q F0 -.486(is a colon-separated tuple of unpadded URL-safe base64 blobs; the \ -\214rst one is the ran-)2.986 F .217(dom salt; the second represents th\ -e ID of created credential, and the third \211 its public k)108 439.2 R --.15(ey)-.1 G 5.217(.T)-.5 G .217(here e)-5.217 F(xists)-.15 E -(no other user)108 451.2 Q -(-land tool for deciphering this; perhaps there should be.)-.2 E -(Finally)108 468 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 -G 9.506(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 -(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 480 Q -F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F -(to clean up the properties, or to issue a note for manual interv)108 -492 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 508.8 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-fido2-load-key \255n)4.056 F F3(dataset)7.555 E F0 -6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 520.8 R .729 -(ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 532.8 Q F2(zfs-fido2-clear-key)5.147 E F3(dataset)8.647 E -F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F -10.312 E F5(keyformat=passphrase)108 544.8 Q F3(dataset)6 E F0 -(\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-fido2-clear-key)108 561.6 Q F3(dataset)7.606 E F0 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 573.6 Q F1(OPTIONS)72 590.4 Q F2109.666 602.4 Q -F3(backup-file)6 E F0(Sa)203 602.4 Q .353 -.15(ve a b)-.2 H .052 -(ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 614.4 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 626.4 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 638.4 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F1(ENVIR)72 655.2 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 -E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q F0 .046(By def)133 679.2 R -.045(ault, passphrases are prompted for and read in on the standard out\ -put and input streams.)-.1 F(If)5.045 E F5(TZPFMS_PASSPHRASE_HELPER)133 -691.2 Q F0 1.595(is set and nonempty)4.095 F 4.096(,i)-.65 G 4.096(tw) --4.096 G 1.596(ill be run via)-4.096 F F5(/bin/)4.096 E F2 3.262 -(sh \255c)B F0(to)4.096 E(pro)133 703.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 720 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 -(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E(fzifdso 0)72 817.889 Q -(February 29, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 2 3 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 41.363(ZFS-FIDO2-CHANGE-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 38.862(anual ZFS-FIDO2-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 124.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) --.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(FIDO2 back-end con\214guration)72 153.6 R(En)87 165.6 Q(vir)-.4 E -.625(onment v)-.18 F(ariables)-.1 E F1(FIDO_DEBUG)108 177.6 Q F0 -(If set, enables lib\214do2 deb)173 177.6 Q -(ug logging to the standard error stream.)-.2 E F2(De)87 194.4 Q .625 -(vice selection)-.15 F F0 .727(When creating, the \214rst de)108 206.4 R -.727(vice which supports the)-.25 F F1(hmac-secret)3.226 E F0 -.15(ex) -3.226 G .726(tension is used.).15 F .726(When loading,)5.726 F -(the assertion is shopped around to e)108 218.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F2 .625(See also)87 235.2 R F0 -(The lib\214do2 documentation at https://de)108 247.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F2 1.666(SPECIAL THANKS)72 264 R -F0 1.6 -.8(To a)108 276 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F2<83>128 288 Q F0(ThePhD)7.5 E F2<83>128 -300 Q F0(Embark Studios)7.5 E F2<83>128 312 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F2<83>128 324 Q F0(EvModder)7.5 E F2(REPOR)72 340.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 352.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F1 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 369.6 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 381.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 29, 2024)153.568 E(2)183.837 E 0 Cg EP -%%Page: 1 4 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF 50.243(ZFS-FIDO2-CLEAR-KEY\(8\) System)72 48 R -(Manager')2.5 E 2.5(sM)-.55 G 47.742(anual ZFS-FIDO2-CLEAR-KEY\(8\))-2.5 -F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-fido2-clear-key)108 96 Q F0 3.587<8a72>3.588 G -.25(ew)-3.587 G -1.087(rap ZFS dataset k).25 F 1.387 -.15(ey i)-.1 H 3.587(np).15 G -(asssw)-3.587 E 1.087(ord and clear tzpfms FIDO2 meta-)-.1 F(data)108 -108 Q F1(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(FIDO2)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 -201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 -(xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) -14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 -213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-fido2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(ENVIR)72 247.2 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 259.2 Q F0 .045 -(By def)133 271.2 R .045(ault, passphrases are prompted for and read in\ - on the standard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 283.2 Q F0 1.596(is set and nonempty)4.096 -F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 295.2 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 312 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 324 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 336 Q F0 -(Pre-formatted noun phrase with all the information belo)160 336 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 348 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 348 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 360 Q F0("ne)160 360 Q -(w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F4($4)143 372 Q F0("ag)160 372 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 388.8 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -400.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 -(FIDO2 back-end con\214guration)72 417.6 R(En)87 429.6 Q(vir)-.4 E .625 -(onment v)-.18 F(ariables)-.1 E F4(FIDO_DEBUG)108 441.6 Q F0 -(If set, enables lib\214do2 deb)173 441.6 Q -(ug logging to the standard error stream.)-.2 E F1(De)87 458.4 Q .625 -(vice selection)-.15 F F0 .726(When creating, the \214rst de)108 470.4 R -.726(vice which supports the)-.25 F F4(hmac-secret)3.227 E F0 -.15(ex) -3.227 G .727(tension is used.).15 F .727(When loading,)5.727 F -(the assertion is shopped around to e)108 482.4 Q -.15(ve)-.25 G -(ry such de).15 E(vice.)-.25 E F1 .625(See also)87 499.2 R F0 -(The lib\214do2 documentation at https://de)108 511.2 Q -.15(ve)-.25 G -(lopers.yubico.com/lib\214do2/.).15 E F1 1.666(SPECIAL THANKS)72 528 R -F0 1.6 -.8(To a)108 540 T(ll who support further de).8 E -.15(ve)-.25 G -(lopment, in particular:).15 E F1<83>128 552 Q F0(ThePhD)7.5 E F1<83>128 -564 Q F0(Embark Studios)7.5 E F1<83>128 576 Q F0(Jasper Bekk)7.5 E(ers) --.1 E F1<83>128 588 Q F0(EvModder)7.5 E F1(REPOR)72 604.8 Q 1.666 -(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 616.8 Q -(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 633.6 Q F0 83.763(,a)C(rchi) --83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E(https://lists.sr) -108 645.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 5 -%%BeginPageSetup -BP -%%EndPageSetup -/F0 10/Times-Roman@0 SF(ZFS-FIDO2-LO)72 48 Q 55.603(AD-KEY\(8\) System) --.35 F(Manager')2.5 E 2.5(sM)-.55 G 53.102(anual ZFS-FIDO2-LO)-2.5 F -(AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 -/Courier-Bold@0 SF(zfs-fido2-load-key)108 96 Q F0 2.5<8a6c>2.5 G -(oad FIDO2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 1.141(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.641 E F0 -.1 -(wa)3.641 G 3.641(se).1 G 1.141(ncrypted with)-3.641 F F2(tzpfms)3.641 E -F0(back)3.641 E(end)-.1 E F1(FIDO2)3.641 E F0 3.641(,a)C 1.142 -(sserts the preserv)-3.641 F 1.142(ed chal-)-.15 F(lenge, HMA)108 165.6 -Q(Cking the salt with the on-de)-.4 E -(vice secret, and loads the resulting k)-.25 E .3 -.15(ey i)-.1 H(nto) -.15 E F3(dataset)2.5 E F0(.)A(See)108 182.4 Q/F4 10/Courier@0 SF -(zfs-fido2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 -(OPTIONS)72 199.2 Q F2109.666 211.2 Q F0 3.208 -(Do a no-op/dry run, can be used e)131 211.2 R -.15(ve)-.25 G 5.708(ni) -.15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708 -(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G -3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 223.2 Q F0 -.55('s)C F2 -4.716 E F0(option.)2.5 E F1(ENVIR)72 240 Q 1.666(ONMENT V)-.3 F -(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 252 Q F0 .045(By def) -133 264 R .045(ault, passphrases are prompted for and read in on the st\ -andard output and input streams.)-.1 F(If)5.046 E F4 -(TZPFMS_PASSPHRASE_HELPER)133 276 Q F0 1.596(is set and nonempty)4.096 F -4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F4 -(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 288 Q -(vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 304.8 R -.643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 316.8 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F4($1)143 328.8 Q F0 -(Pre-formatted noun phrase with all the information belo)160 328.8 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F4($2)143 340.8 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 340.8 Q -2.5(yb)-.05 G(eing prompted for)-2.5 E F4($3)143 352.8 Q F0("ne)160 -352.8 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G -(assphrase, otherwise blank)-2.5 E F4($4)143 364.8 Q F0("ag)160 364.8 Q -(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .178 -(If the helper doesn')133 381.6 R 2.678(te)-.18 G .178 -(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 -.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 -393.6 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 -G(ther reason, the prompting is aborted.)-2.5 E F1 1.666(SPECIAL THANKS) -72 410.4 R F0 1.6 -.8(To a)108 422.4 T(ll who support further de).8 E --.15(ve)-.25 G(lopment, in particular:).15 E F1<83>128 434.4 Q F0 -(ThePhD)7.5 E F1<83>128 446.4 Q F0(Embark Studios)7.5 E F1<83>128 458.4 -Q F0(Jasper Bekk)7.5 E(ers)-.1 E F1<83>128 470.4 Q F0(EvModder)7.5 E F1 -(REPOR)72 487.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 -499.2 Q(.ht/\001nabijaczle)-.55 E(weli/fzifdso)-.25 E F4 -(\001nabijaczleweli/tzpfms@lists.sr.ht)108 516 Q F0 83.762(,a)C(rchi) --83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E(https://lists.sr) -108 528 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 E(fzifdso 0)72 -817.889 Q(February 28, 2024)153.568 E(1)183.837 E 0 Cg EP -%%Page: 1 6 -%%BeginPageSetup -BP -%%EndPageSetup /F0 10/Times-Roman@0 SF 93.563(ZFS-TPM-LIST\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 91.062(anual ZFS-TPM-LIST\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm-list)108 96 Q F0 2.5<8a70>2.5 G(rint dataset tzpfms metadata) --2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([) -2.5 E F21.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E -/F3 10/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A -F21.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 -1.666 E F0(])A([)234 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 +-2.5 E F1(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E F0 2.5(][)C F2-.834 E F0(|)A F21.666 E/F3 10 +/Courier-Oblique@0 SF(depth)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F3(back-end)6 E F0 2.5(][)C F2-.834 E F0(|)A F2 +1.666 E F0(])A([)186 136.8 Q F3(filesystem)A F0(|)A F3(volume)A F0 1.666(]...)C F1(DESCRIPTION)72 153.6 Q F0(Lists the follo)108 165.6 Q (wing properties on encryption roots:)-.25 E/F4 10/Courier@0 SF(name)128 177.6 Q(back-end)128 189.6 Q F0(the)187 189.6 Q F2(tzpfms)2.979 E F0 @@ -683,28 +326,26 @@ listed \212 by def)108 307.2 R .966(ault, those managed by)-.1 F F2 G(re una)-2.5 E -.25(va)-.2 G(ilable.).25 E F2109.666 446.4 Q F0 (List only encryption roots whose k)185 446.4 Q -.15(ey)-.1 G 2.5(sa).15 G(re a)-2.5 E -.25(va)-.2 G(ilable.).25 E F1(EXAMPLES)72 463.2 Q F4($) -108 475.2 Q F2(zfs-fido2-add-backup)6 E F4 72(NAME BACK-END)108 487.2 R -18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 +108 475.2 Q F2(zfs-tpm-list)6 E F4 72(NAME BACK-END)108 487.2 R 18 +(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 499.2 R 18 (available yes)24 F 6(tarta-zoot/home TPM2)108 511.2 R 6 -(unavailable yes)36 F($)108 535.2 Q F2 1.666 -(zfs-fido2-add-backup \255ad0)6 F F4 24(NAME BACK-END)108 547.2 R 6 -(KEYSTATUS COHERENT)12 F 6(filling -)108 559.2 R 6(available yes)54 F($) -108 583.2 Q F2 1.666(zfs-fido2-add-backup \255b)6 F F1(TPM2)6 E F4 72 -(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F 6 -(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q -F2 1.666(zfs-fido2-add-backup \255ra)6 F F3(tarta-zoot)6 E F4 72 -(NAME BACK-END)108 643.2 R 18(KEYSTATUS COHERENT)12 F 36 -(tarta-zoot TPM1.X)108 655.2 R 18(available yes)24 F 6 -(tarta-zoot/home TPM2)108 667.2 R 6(unavailable yes)36 F 12 -(tarta-zoot/bkp -)108 679.2 R 18(available yes)54 F 18(tarta-zoot/vm -) -108 691.2 R 18(available yes)54 F($)108 715.2 Q F2 1.666 -(zfs-fido2-add-backup \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 +(unavailable yes)36 F($)108 535.2 Q F2 1.666(zfs-tpm-list \255ad0)6 F F4 +24(NAME BACK-END)108 547.2 R 6(KEYSTATUS COHERENT)12 F 6(filling -)108 +559.2 R 6(available yes)54 F($)108 583.2 Q F2 1.666(zfs-tpm-list \255b)6 +F F1(TPM2)6 E F4 72(NAME BACK-END)108 595.2 R 18(KEYSTATUS COHERENT)12 F +6(tarta-zoot/home TPM2)108 607.2 R 6(unavailable yes)36 F($)108 631.2 Q +F2 1.666(zfs-tpm-list \255ra)6 F F3(tarta-zoot)6 E F4 72(NAME BACK-END) +108 643.2 R 18(KEYSTATUS COHERENT)12 F 36(tarta-zoot TPM1.X)108 655.2 R +18(available yes)24 F 6(tarta-zoot/home TPM2)108 667.2 R 6 +(unavailable yes)36 F 12(tarta-zoot/bkp -)108 679.2 R 18(available yes) +54 F 18(tarta-zoot/vm -)108 691.2 R 18(available yes)54 F($)108 715.2 Q +F2 1.666(zfs-tpm-list \255al)6 F F4 72(NAME BACK-END)108 727.2 R 6 (KEYSTATUS COHERENT)12 F 54(filling -)108 739.2 R 6(available yes)54 F 36(tarta-zoot TPM1.X)108 751.2 R 6(available yes)24 F 12 (tarta-zoot/bkp -)108 763.2 R 6(available yes)54 F 18(tarta-zoot/vm -) -108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-22-g7c0393e)72 817.889 -Q(December 4, 2022)83.583 E(1)183.842 E 0 Cg EP -%%Page: 2 7 +108 775.2 R 6(available yes)54 F F0(tzpfms 0.3.4-23-g984c5d5)72 817.889 +Q(December 4, 2022)83.023 E(1)183.842 E 0 Cg EP +%%Page: 2 2 %%BeginPageSetup BP %%EndPageSetup @@ -719,9 +360,9 @@ BP E/F2 10/Courier@0 SF(\001nabijaczleweli/tzpfms@lists.sr.ht)108 189.6 Q F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 201.6 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E +-.25 E(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q(December 4, 2022)83.023 E (2)183.842 E 0 Cg EP -%%Page: 1 8 +%%Page: 1 3 %%BeginPageSetup BP %%EndPageSetup @@ -730,193 +371,192 @@ BP -2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF(zfs-tpm1x-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k) -2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 -E F3(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 2.867 -.8(To n)108 153.6 -T 1.267(ormalise the).8 F F3(dataset)3.767 E F0(,)A F2 -(zfs-fido2-add-backup)3.766 E F0 1.266 -(will open its encryption root in its stead.)3.766 F F2 -(zfs-fido2-add-backup)108 165.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 177.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 194.4 Q F4(must)2.5 E -F0(be TPM-1.X-compatible.)2.5 E(If)108 211.2 Q F3(dataset)3.177 E F0 -.1 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(PCR)6 E F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C(])-1.666 E F3 +(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 6.867 -.8(To n)108 153.6 T +5.267(ormalise the).8 F F3(dataset)7.767 E F0(,)A F2(zfs-tpm-list)7.766 +E F0 5.266(will open its encryption root in its stead.)7.766 F F2 +(zfs-tpm-list)108 165.6 Q F0(will)2.5 E/F4 10/Times-Italic@0 SF(ne)2.5 E +(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G(ncryption roots; use) +-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0(\(8\) for that.)A +(First, a connection is made to the TPM, which)108 182.4 Q F4(must)2.5 E +F0(be TPM-1.X-compatible.)2.5 E(If)108 199.2 Q F3(dataset)3.176 E F0 -.1 (wa)3.176 G 3.176(sp).1 G(re)-3.176 E .676(viously encrypted with)-.25 F F2(tzpfms)3.176 E F0 .676(and the)3.176 F F1(TPM1.X)3.176 E F0 .676 (back-end w)3.176 F .676(as used, the meta-)-.1 F .926 -(data will be silently cleared.)108 223.2 R .926 +(data will be silently cleared.)108 211.2 R .926 (Otherwise, or in case of an error)5.926 F 3.426(,d)-.4 G .926 (ata required for manual interv)-3.426 F(ention)-.15 E -(will be written to the standard error stream.)108 235.2 Q(Ne)108 252 Q -.295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 +(will be written to the standard error stream.)108 223.2 Q(Ne)108 240 Q +.294(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15 (ey i)-.1 H 2.794(sg).15 G .294(enerated on the TPM, optionally back) -2.794 F .294(ed up \(see)-.1 F F1(OPTIONS)2.794 E F0 .294 -(\), and sealed)B .585(on the TPM; the user is prompted for an optional\ - passphrase to protect the k)108 264 R .886 -.15(ey w)-.1 H .586 -(ith, and for the SRK).15 F(passphrase, set when taking o)108 276 Q +(\), and sealed)B .586(on the TPM; the user is prompted for an optional\ + passphrase to protect the k)108 252 R .885 -.15(ey w)-.1 H .585 +(ith, and for the SRK).15 F(passphrase, set when taking o)108 264 Q (wnership, if not "well-kno)-.25 E(wn" \(all zeroes\).)-.25 E(The follo) -108 292.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 -<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 -(TPM1.X)A<83>128 316.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A +108 280.8 Q(wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1 +<83>128 292.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1 +(TPM1.X)A<83>128 304.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3(parent-key-blob)A F2(:)A F3(sealed-object-blob)A F5(tzpfms.backend) -108 333.6 Q F0 .292(identi\214es this dataset for w)2.792 F .291 -(ork with)-.1 F F1(TPM1.X)2.791 E F0(-back-ended)A F2(tzpfms)2.791 E F0 -.291(tools \(namely)2.791 F F5(zfs-tpm1x-change-key)108 345.6 Q F0 +108 321.6 Q F0 .291(identi\214es this dataset for w)2.791 F .292 +(ork with)-.1 F F1(TPM1.X)2.792 E F0(-back-ended)A F2(tzpfms)2.792 E F0 +.292(tools \(namely)2.792 F F5(zfs-tpm1x-change-key)108 333.6 Q F0 (\(8\),)A F5(zfs-tpm1x-load-key)2.5 E F0(\(8\), and)A F5 -(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 362.4 Q F0 -1.412(is a colon-separated pair of he)3.912 F 1.412 -(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .868 -(\214rst one represents the RSA k)108 374.4 R 1.168 -.15(ey p)-.1 H .867 +(zfs-tpm1x-clear-key)2.5 E F0(\(8\)\).)A F5(tzpfms.key)108 350.4 Q F0 +1.412(is a colon-separated pair of he)3.913 F 1.412 +(xadecimal-string \(i.e. "4F7730" for "Ow0"\) blobs; the)-.15 F .867 +(\214rst one represents the RSA k)108 362.4 R 1.167 -.15(ey p)-.1 H .868 (rotecting the blob, and it is protected with either the passphrase, if) -.15 F(pro)108 386.4 Q 1.413(vided, or the SHA1 constant)-.15 F F5 -(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.914 E F0 3.914(;t)C 1.414 -(he sec-)-3.914 F .379 -(ond represents the sealed object containing the wrapping k)108 398.4 R +.15 F(pro)108 374.4 Q 1.414(vided, or the SHA1 constant)-.15 F F5 +(CE4CF677875B5EB8993591D5A9AF1ED24A3A8736)3.913 E F0 3.913(;t)C 1.413 +(he sec-)-3.913 F .379 +(ond represents the sealed object containing the wrapping k)108 386.4 R -.15(ey)-.1 G 2.879(,a)-.5 G .379 (nd is protected with the SHA1 constant)-2.879 F F5 -(B9EE715DBE4B243FAA81EA04306E063710383E35)108 410.4 Q F0 6.72(.T)C 1.72 -(here e)-6.72 F 1.721(xists no other user)-.15 F 1.721(-land tool for) --.2 F(decrypting this; perhaps there should be.)108 422.4 Q(Finally)108 -439.2 Q 12.006(,t)-.65 G 9.506(he equi)-12.006 F -.25(va)-.25 G 9.506 -(lent of).25 F F2 9.505(zfs change-key)12.005 F17.171 E F5 -(keylocation=prompt)15.505 E F217.171 E F5(keyformat=raw)108 451.2 -Q F3(dataset)6.106 E F0 .106(is performed with the ne)2.606 F 2.606(wk) --.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 -G .107(rror occurred, best ef)-2.606 F .107(fort is made)-.25 F +(B9EE715DBE4B243FAA81EA04306E063710383E35)108 398.4 Q F0 6.721(.T)C +1.721(here e)-6.721 F 1.721(xists no other user)-.15 F 1.72 +(-land tool for)-.2 F(decrypting this; perhaps there should be.)108 +410.4 Q(Finally)108 427.2 Q 12.005(,t)-.65 G 9.505(he equi)-12.005 F +-.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F +17.172 E F5(keylocation=prompt)15.506 E F217.172 E F5 +(keyformat=raw)108 439.2 Q F3(dataset)6.107 E F0 .107 +(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106 +(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 +(rror occurred, best ef)-2.606 F .106(fort is made)-.25 F (to clean up the properties, or to issue a note for manual interv)108 -463.2 Q(ention into the standard error stream.)-.15 E 4.056<418c>108 480 -S 1.556(nal v)-4.056 F 1.556(eri\214cation should be made by running) --.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.555 E F0 -6.555(.I)C 4.055(ft)-6.555 G(hat)-4.055 E .729 -(command succeeds, all is well, b)108 492 R .729 +451.2 Q(ention into the standard error stream.)-.15 E 4.055<418c>108 468 +S 1.555(nal v)-4.055 F 1.556(eri\214cation should be made by running) +-.15 F F2 3.222(zfs-tpm1x-load-key \255n)4.056 F F3(dataset)7.556 E F0 +6.556(.I)C 4.056(ft)-6.556 G(hat)-4.056 E .729 +(command succeeds, all is well, b)108 480 R .729 (ut otherwise the dataset can be manually rolled back to a passphrase) --.2 F(with)108 504 Q F2(zfs-tpm1x-clear-key)5.147 E F3(dataset)8.647 E -F0(\(or)5.147 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F -2.646(ails to w)-.1 F(ork,)-.1 E F2 2.646(zfs change-key)5.146 F -10.312 E F5(keyformat=passphrase)108 516 Q F3(dataset)6 E F0 +-.2 F(with)108 492 Q F2(zfs-tpm1x-clear-key)5.146 E F3(dataset)8.646 E +F0(\(or)5.146 E 5.146(,i)-.4 G 5.146(ft)-5.146 G 2.646(hat f)-5.146 F +2.646(ails to w)-.1 F(ork,)-.1 E F2 2.647(zfs change-key)5.147 F +10.313 E F5(keyformat=passphrase)108 504 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm1x-clear-key)108 532.8 Q F3(dataset)7.606 E F0 1.607 -(can be used to clear the properties and go back to using a)4.106 F -(passphrase.)108 544.8 Q F1(OPTIONS)72 561.6 Q F2109.666 573.6 Q -F3(backup-file)6 E F0(Sa)203 573.6 Q .353 -.15(ve a b)-.2 H .052 +F2(zfs-tpm1x-clear-key)108 520.8 Q F3(dataset)7.607 E F0 1.607 +(can be used to clear the properties and go back to using a)4.107 F +(passphrase.)108 532.8 Q F1(OPTIONS)72 549.6 Q F2109.666 561.6 Q +F3(backup-file)6 E F0(Sa)203 561.6 Q .352 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 -E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 585.6 R F4(must)3.193 E F0 .694 -(be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 -(-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 597.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 609.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 626.4 Q F3(PCR)6 E F0([)A F2(,)A F3 -(PCR)A F0 1.666(]...)C .639(Bind the k)203 626.4 R .939 -.15(ey t)-.1 H +E F0 2.552(,w)C .052(hich must not e)-2.552 F .053(xist beforehand.)-.15 +F .694(This back-up)203 573.6 R F4(must)3.194 E F0 .694 +(be stored securely)3.194 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 +(-site. In).25 F .693(case of a catastrophic e)3.194 F -.15(ve)-.25 G +(nt,).15 E(the k)203 585.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 597.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 614.4 Q F3(PCR)6 E F0([)A F2(,)A F3 +(PCR)A F0 1.666(]...)C .638(Bind the k)203 614.4 R .939 -.15(ey t)-.1 H 3.139(os).15 G .639(pace- or comma-separated)-3.139 F F3(PCR)3.139 E F0 -3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .638 -(hange, the wrap-)-3.139 F .462(ping k)203 638.4 R .762 -.15(ey w)-.1 H -.462(ill not be able to be unsealed.).15 F .463 -(The minimum number of PCRs for a)5.462 F(PC TPM is)203 650.4 Q F1(24) +3.139(s\212i)C 3.139(ft)-3.139 G(he)-3.139 E 3.139(yc)-.15 G .639 +(hange, the wrap-)-3.139 F .463(ping k)203 626.4 R .763 -.15(ey w)-.1 H +.463(ill not be able to be unsealed.).15 F .462 +(The minimum number of PCRs for a)5.462 F(PC TPM is)203 638.4 Q F1(24) 2.5 E F0(\(numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0 2.5(]\). F)B -(or most, this is also the maximum.)-.15 E F1(ENVIR)72 667.2 Q 1.666 -(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 679.2 Q -F0 .046(By def)133 691.2 R .045(ault, passphrases are prompted for and \ -read in on the standard output and input streams.)-.1 F(If)5.045 E F5 -(TZPFMS_PASSPHRASE_HELPER)133 703.2 Q F0 1.595(is set and nonempty)4.095 +(or most, this is also the maximum.)-.15 E F1(ENVIR)72 655.2 Q 1.666 +(ONMENT V)-.3 F(ARIABLES)-1.35 E F5(TZPFMS_PASSPHRASE_HELPER)108 667.2 Q +F0 .045(By def)133 679.2 R .045(ault, passphrases are prompted for and \ +read in on the standard output and input streams.)-.1 F(If)5.046 E F5 +(TZPFMS_PASSPHRASE_HELPER)133 691.2 Q F0 1.596(is set and nonempty)4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F F5 -(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 715.2 Q +(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 703.2 Q (vide each passphrase, instead.)-.15 E .643 -(The standard output stream of the helper is tied to an anon)133 732 R +(The standard output stream of the helper is tied to an anon)133 720 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) -133 744 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 -(y. T)-.15 H(he ar).65 E(guments are:)-.18 E(tzpfms 0.3.4-22-g7c0393e)72 -817.889 Q(February 28, 2024)83.578 E(1)183.837 E 0 Cg EP -%%Page: 2 9 +133 732 Q(xcept for a trailing ne)-.15 E(w-line, if an)-.25 E 3.8 -.65 +(y. T)-.15 H(he ar).65 E(guments are:)-.18 E F5($1)143 744 Q F0 +(Pre-formatted noun phrase with all the information belo)160 744 Q 1.3 +-.65(w, f)-.25 H(or use as a prompt).65 E(tzpfms 0.3.4-23-g984c5d5)72 +817.889 Q(February 28, 2024)83.018 E(1)183.837 E 0 Cg EP +%%Page: 2 4 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 36.913(ZFS-TPM1X-CHANGE-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 34.412(anual ZFS-TPM1X-CHANGE-KEY\(8\)) --2.5 F/F1 10/Courier@0 SF($1)143 84 Q F0 -(Pre-formatted noun phrase with all the information belo)160 84 Q 1.3 --.65(w, f)-.25 H(or use as a prompt).65 E F1($2)143 96 Q F0 -(Either the dataset name or the element of the TPM hierarch)160 96 Q 2.5 -(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 108 Q F0("ne)160 108 Q +-2.5 F/F1 10/Courier@0 SF($2)143 84 Q F0 +(Either the dataset name or the element of the TPM hierarch)160 84 Q 2.5 +(yb)-.05 G(eing prompted for)-2.5 E F1($3)143 96 Q F0("ne)160 96 Q (w" if this is for a ne)-.25 E 2.5(wp)-.25 G(assphrase, otherwise blank) --2.5 E F1($4)143 120 Q F0("ag)160 120 Q(ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 136.8 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF -(127)2.677 E F0 .178(\), a diagnostic is issued and the normal prompt)B -(is used as f)133 148.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) +-2.5 E F1($4)143 108 Q F0("ag)160 108 Q(ain" if it')-.05 E 2.5(st)-.55 G +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 124.8 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F/F2 10/Times-Bold@0 SF +(127)2.677 E F0 .177(\), a diagnostic is issued and the normal prompt)B +(is used as f)133 136.8 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an) -.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F2 -1.666(TPM1.X back-end con\214guration)72 165.6 R .625(TPM selection)87 -177.6 R F0(The)108 189.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.73 E F0 .23 -(suite connects to a local)2.73 F F1(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F1(localhost:30003)2.729 E F0 2.729(\)b)C 2.729 -(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 F(the)2.729 E(en)108 201.6 -Q(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .11(The T)108 218.4 R(rouSerS) --.35 E F1(tcsd)2.61 E F0 .11(\(8\) daemon will try)B F1(/dev/tpm0)2.61 E -F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 -E F1(/dev/tpm)2.611 E F0 2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1 -(py)108 230.4 S(ing one of the earlier ones with, for e).1 E +1.666(TPM1.X back-end con\214guration)72 153.6 R .625(TPM selection)87 +165.6 R F0(The)108 177.6 Q/F3 10/Courier-Bold@0 SF(tzpfms)2.729 E F0 +.229(suite connects to a local)2.729 F F1(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F1(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 189.6 Q +(vironment v)-.4 E(ariable)-.25 E F1(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 206.4 R(rouSerS) +-.35 E F1(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F1(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F1(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F1(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +218.4 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F2 .625 -(See also)87 247.2 R F0(The T)108 259.2 Q +(See also)87 235.2 R F0(The T)108 247.2 Q (rouSerS project page at https://sourcefor)-.35 E (ge.net/projects/trousers.)-.18 E 4.415 -(The TPM 1.2 main speci\214cation inde)108 276 R 6.915(xa)-.15 G 6.915 +(The TPM 1.2 main speci\214cation inde)108 264 R 6.915(xa)-.15 G 6.915 (th)-6.915 G(ttps://trustedcomputinggroup.or)-6.915 E -(g/resource/tpm-main-)-.18 E(speci\214cation.)108 288 Q F2 1.666 -(SPECIAL THANKS)72 304.8 R F0 1.6 -.8(To a)108 316.8 T +(g/resource/tpm-main-)-.18 E(speci\214cation.)108 276 Q F2 1.666 +(SPECIAL THANKS)72 292.8 R F0 1.6 -.8(To a)108 304.8 T (ll who support further de).8 E -.15(ve)-.25 G(lopment, in particular:) -.15 E F2<83>128 328.8 Q F0(ThePhD)7.5 E F2<83>128 340.8 Q F0 -(Embark Studios)7.5 E F2<83>128 352.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E -F2<83>128 364.8 Q F0(EvModder)7.5 E F2(REPOR)72 381.6 Q 1.666(TING B)-.4 -F(UGS)-.1 E F0(https://todo.sr)108 393.6 Q(.ht/\001nabijaczle)-.55 E -(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 410.4 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E -(https://lists.sr)108 422.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E F2 1.666(SEE ALSO)72 439.2 R F0 -(PCR allocations: https://wiki.archlinux.or)108 451.2 Q(g/title/T)-.18 E +.15 E F2<83>128 316.8 Q F0(ThePhD)7.5 E F2<83>128 328.8 Q F0 +(Embark Studios)7.5 E F2<83>128 340.8 Q F0(Jasper Bekk)7.5 E(ers)-.1 E +F2<83>128 352.8 Q F0(EvModder)7.5 E F2(REPOR)72 369.6 Q 1.666(TING B)-.4 +F(UGS)-.1 E F0(https://todo.sr)108 381.6 Q(.ht/\001nabijaczle)-.55 E +(weli/tzpfms)-.25 E F1(\001nabijaczleweli/tzpfms@lists.sr.ht)108 398.4 Q +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +(https://lists.sr)108 410.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) +-.25 E F2 1.666(SEE ALSO)72 427.2 R F0 +(PCR allocations: https://wiki.archlinux.or)108 439.2 Q(g/title/T)-.18 E (rusted_Platform_Module#Accessing_PCR_re)-.35 E(gisters)-.15 E -(and https://trustedcomputinggroup.or)108 463.2 Q +(and https://trustedcomputinggroup.or)108 451.2 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ -r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 475.2 Q -(able)-.8 E(1.)108 487.2 Q(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q -(February 28, 2024)83.578 E(2)183.837 E 0 Cg EP -%%Page: 1 10 +r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 463.2 Q +(able)-.8 E(1.)108 475.2 Q(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q +(February 28, 2024)83.018 E(2)183.837 E 0 Cg EP +%%Page: 1 5 %%BeginPageSetup BP %%EndPageSetup /F0 10/Times-Roman@0 SF 45.793(ZFS-TPM1X-CLEAR-KEY\(8\) System)72 48 R (Manager')2.5 E 2.5(sM)-.55 G 43.292(anual ZFS-TPM1X-CLEAR-KEY\(8\))-2.5 F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF -(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.008 G -.25(ew)-3.008 G +(zfs-tpm1x-clear-key)108 96 Q F0 3.008<8a72>3.007 G -.25(ew)-3.008 G .508(rap ZFS dataset k).25 F .808 -.15(ey i)-.1 H 3.008(np).15 G(asssw) -3.008 E .508(ord and clear tzpfms TPM1.X meta-)-.1 F(data)108 108 Q F1 -(SYNOPSIS)72 124.8 Q F2(zfs-fido2-add-backup)108 136.8 Q/F3 10 -/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 -(After v)108 165.6 Q(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G -2.5(se).1 G(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E -F1(TPM1.X)2.5 E F0(:)A 5(1. performs)118 177.6 R 5.641(the equi)8.141 F --.25(va)-.25 G 5.641(lent of).25 F F2 5.642(zfs change-key)8.142 F -13.308 E/F4 10/Courier@0 SF(keylocation=prompt)11.642 E F213.308 E -F4(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 +(SYNOPSIS)72 124.8 Q F2(zfs-tpm-list)108 136.8 Q/F3 10/Courier-Oblique@0 +SF(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0(After v)108 165.6 Q +(erifying)-.15 E F3(dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G +(ncrypted with)-2.5 E F2(tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM1.X) +2.5 E F0(:)A 5(1. performs)118 177.6 R 5.642(the equi)8.142 F -.25(va) +-.25 G 5.642(lent of).25 F F2 5.642(zfs change-key)8.142 F13.307 E +/F4 10/Courier@0 SF(keylocation=prompt)11.641 E F213.307 E F4 +(keyformat=passphrase)133 189.6 Q F3(dataset)6 E F0(,)A 5(2. remo)118 201.6 R -.15(ve)-.15 G 10.689(st).15 G(he)-10.689 E F4 (xyz.nabijaczleweli:tzpfms.)10.689 E F0({)A F4(backend)A F0(,)A F4(key) 14.189 E F0 10.689(}p)C 8.189(roperties from)-10.689 F F3(dataset)133 213.6 Q F0(.)A(See)108 230.4 Q F4(zfs-tpm1x-change-key)2.5 E F0 (\(8\) for a detailed description.)A F1 1.666 (TPM1.X back-end con\214guration)72 247.2 R .625(TPM selection)87 259.2 -R F0(The)108 271.2 Q F2(tzpfms)2.729 E F0 .229 -(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 -(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) --2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 283.2 Q -(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 -(to specify a remote TCS hostname.)2.5 E .111(The T)108 300 R(rouSerS) --.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 -E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E -F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 -312 S(ing one of the earlier ones with, for e).1 E +R F0(The)108 271.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) +2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) +2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 +F(the)2.729 E(en)108 283.2 Q(vironment v)-.4 E(ariable)-.25 E F4 +(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 +(The T)108 300 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 +(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 +(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 +2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 312 S +(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 328.8 R F0(The T)108 340.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -931,11 +571,11 @@ F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 F1<83>128 446.4 Q F0(EvModder)7.5 E F1(REPOR)72 463.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 475.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 492 Q -F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E +F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E (https://lists.sr)108 504 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E(1) +E(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP -%%Page: 1 11 +%%Page: 1 6 %%BeginPageSetup BP %%EndPageSetup @@ -944,15 +584,15 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm1x-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM1.X-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 -(wa)2.69 G 2.69(se).1 G .19(ncrypted with)-2.69 F F2(tzpfms)2.69 E F0 -(back)2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .191(will unseal the k)2.69 F -.491 -.15(ey a)-.1 H .191(nd load).15 F(it into)108 165.6 Q F3(dataset) -2.5 E F0(.)A .236 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .191 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.691 E F0 -.1(wa)2.691 +G 2.691(se).1 G .191(ncrypted with)-2.691 F F2(tzpfms)2.69 E F0(back) +2.69 E(end)-.1 E F1(TPM1.X)2.69 E F0 .19(will unseal the k)2.69 F .49 +-.15(ey a)-.1 H .19(nd load).15 F(it into)108 165.6 Q F3(dataset)2.5 E +F0(.)A .236 (The user is \214rst prompted for the SRK passphrase, set when taking o) -108 182.4 R .236(wnership, if not "well-kno)-.25 F .235(wn" \(all)-.25 F +108 182.4 R .236(wnership, if not "well-kno)-.25 F .236(wn" \(all)-.25 F (zeroes\); then for the additional passphrase, set when creating the k) 108 194.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E (as set.)-.1 E(See)108 211.2 Q/F4 10/Courier@0 SF(zfs-tpm1x-change-key) @@ -960,14 +600,14 @@ Q F0 .19(After v)108 153.6 R(erifying)-.15 E F3(dataset)2.69 E F0 -.1 109.666 240 Q F0 3.208(Do a no-op/dry run, can be used e)131 240 R -.15(ve)-.25 G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi) -8.208 E -.25(va)-.25 G 3.208(lent to).25 F F2(zfs)5.708 E(load-key)131 +8.207 E -.25(va)-.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 252 Q F0 -.55('s)C F24.716 E F0(option.)2.5 E F1(ENVIR)72 268.8 Q 1.666(ONMENT V)-.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 -280.8 Q F0 .046(By def)133 292.8 R .045(ault, passphrases are prompted \ -for and read in on the standard output and input streams.)-.1 F(If)5.045 -E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.595(is set and nonempty) -4.095 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F -F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q +280.8 Q F0 .045(By def)133 292.8 R .045(ault, passphrases are prompted \ +for and read in on the standard output and input streams.)-.1 F(If)5.046 +E F4(TZPFMS_PASSPHRASE_HELPER)133 304.8 Q F0 1.596(is set and nonempty) +4.096 F 4.096(,i)-.65 G 4.096(tw)-4.096 G 1.596(ill be run via)-4.096 F +F4(/bin/)4.095 E F2 3.261(sh \255c)B F0(to)4.095 E(pro)133 316.8 Q (vide each passphrase, instead.)-.15 E .643 (The standard output stream of the helper is tied to an anon)133 333.6 R .643(ymous \214le and used in its entirety as)-.15 F(the passphrase, e) @@ -980,23 +620,23 @@ F4(/bin/)4.096 E F2 3.262(sh \255c)B F0(to)4.096 E(pro)133 316.8 Q 381.6 Q(w" if this is for a ne)-.25 E 2.5(wp)-.25 G (assphrase, otherwise blank)-2.5 E F4($4)143 393.6 Q F0("ag)160 393.6 Q (ain" if it')-.05 E 2.5(st)-.55 G -(he second prompt for that passphrase, otherwise blank)-2.5 E .177 -(If the helper doesn')133 410.4 R 2.677(te)-.18 G .177 -(xist \(the shell e)-2.827 F .177(xits with)-.15 F F1(127)2.677 E F0 -.178(\), a diagnostic is issued and the normal prompt)B(is used as f)133 +(he second prompt for that passphrase, otherwise blank)-2.5 E .178 +(If the helper doesn')133 410.4 R 2.678(te)-.18 G .178 +(xist \(the shell e)-2.828 F .177(xits with)-.15 F F1(127)2.677 E F0 +.177(\), a diagnostic is issued and the normal prompt)B(is used as f)133 422.4 Q 2.5(all-back. If)-.1 F(it f)2.5 E(ails for an)-.1 E 2.5(yo)-.15 G(ther reason, the prompting is aborted.)-2.5 E F1 1.666 (TPM1.X back-end con\214guration)72 439.2 R .625(TPM selection)87 451.2 -R F0(The)108 463.2 Q F2(tzpfms)2.73 E F0 .23(suite connects to a local) -2.73 F F4(tcsd)2.73 E F0 .23(\(8\) process \(at)B F4(localhost:30003) -2.729 E F0 2.729(\)b)C 2.729(yd)-2.729 G(ef)-2.729 E 2.729(ault. Use)-.1 -F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 -(TZPFMS_TPM1X)2.5 E F0(to specify a remote TCS hostname.)2.5 E .11 -(The T)108 492 R(rouSerS)-.35 E F4(tcsd)2.61 E F0 .11 -(\(8\) daemon will try)B F4(/dev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E F4 -(/udev/tpm0)2.611 E F0 2.611(,t)C(hen)-2.611 E F4(/dev/tpm)2.611 E F0 -2.611(;b)C 2.611(yo)-2.611 G(ccu-)-2.611 E -.1(py)108 504 S -(ing one of the earlier ones with, for e).1 E +R F0(The)108 463.2 Q F2(tzpfms)2.729 E F0 .229 +(suite connects to a local)2.729 F F4(tcsd)2.73 E F0 .23 +(\(8\) process \(at)B F4(localhost:30003)2.73 E F0 2.73(\)b)C 2.73(yd) +-2.73 G(ef)-2.73 E 2.73(ault. Use)-.1 F(the)2.73 E(en)108 475.2 Q +(vironment v)-.4 E(ariable)-.25 E F4(TZPFMS_TPM1X)2.5 E F0 +(to specify a remote TCS hostname.)2.5 E .111(The T)108 492 R(rouSerS) +-.35 E F4(tcsd)2.611 E F0 .111(\(8\) daemon will try)B F4(/dev/tpm0)2.61 +E F0 2.61(,t)C(hen)-2.61 E F4(/udev/tpm0)2.61 E F0 2.61(,t)C(hen)-2.61 E +F4(/dev/tpm)2.61 E F0 2.61(;b)C 2.61(yo)-2.61 G(ccu-)-2.61 E -.1(py)108 +504 S(ing one of the earlier ones with, for e).1 E (xample, shell redirection, a later one can be selected.)-.15 E F1 .625 (See also)87 520.8 R F0(The T)108 532.8 Q (rouSerS project page at https://sourcefor)-.35 E @@ -1011,11 +651,11 @@ F(the)2.729 E(en)108 475.2 Q(vironment v)-.4 E(ariable)-.25 E F4 F1<83>128 638.4 Q F0(EvModder)7.5 E F1(REPOR)72 655.2 Q 1.666(TING B)-.4 F(UGS)-.1 E F0(https://todo.sr)108 667.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 684 Q -F0 83.762(,a)C(rchi)-83.762 E -.15(ve)-.25 G 83.763(da).15 G(t)-83.763 E +F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 696 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E(1) +E(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP -%%Page: 1 12 +%%Page: 1 7 %%BeginPageSetup BP %%EndPageSetup @@ -1024,112 +664,112 @@ BP F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-change-key)108 96 Q F0 2.5<8a63>2.5 G(hange ZFS dataset k)-2.5 E .3 -.15(ey t)-.1 H 2.5(oo).15 G(ne stored on the TPM)-2.5 E F1 -(SYNOPSIS)72 112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F2 -1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 --.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 -1.666(]...)C([)234 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A -F2(,)A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A -F0(]])A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 4.32 -.8(To n)108 -165.6 T(ormalise).8 E F3(dataset)5.22 E F0(,)A F2(zfs-fido2-add-backup) -5.22 E F0 2.719(will open its encryption root in its stead.)5.22 F F2 -(zfs-fido2-add-backup)108 177.6 Q F0(will)14.654 E/F4 10/Times-Italic@0 -SF(ne)14.654 E(ver)-.15 E F0 12.154(create or destro)14.654 F 14.655(ye) --.1 G 12.155(ncryption roots; use)-14.655 F/F5 10/Courier@0 SF -(zfs-change-key)108 189.6 Q F0(\(8\) for that.)A -(First, a connection is made to the TPM, which)108 206.4 Q F4(must)2.5 E -F0(be TPM-2.0-compatible.)2.5 E(If)108 223.2 Q F3(dataset)3.055 E F0 -.1 -(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555(viously encrypted with)-.25 F -F2(tzpfms)3.055 E F0 .555(and the)3.055 F F1(TPM2)3.055 E F0 .554 -(back-end w)3.054 F .554(as used, the pre)-.1 F(vious)-.25 E -.1(ke)108 -235.2 S 3.059(yw)-.05 G .559(ill be freed from the TPM.)-3.059 F .56 +(SYNOPSIS)72 112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F2 +1.666 E/F3 10/Courier-Oblique@0 SF(backup-file)6 E F0 2.5(][)C F2 +-.834 E F3(algorithm)6 E F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666 +(]...)C([)186 136.8 Q F2(+)A F3(algorithm)A F2(:)A F3(PCR)A F0([)A F2(,) +A F3(PCR)A F0 1.666(]...)C -3.332 1.666(]... [)-1.666 H F2A F0(]]) +A F3(dataset)2.5 E F1(DESCRIPTION)72 153.6 Q F0 1.676 -.8(To n)108 165.6 +T(ormalise).8 E F3(dataset)2.576 E F0(,)A F2(zfs-tpm-list)2.576 E F0 +.076(will open its encryption root in its stead.)2.576 F F2 +(zfs-tpm-list)5.077 E F0(will)108 177.6 Q/F4 10/Times-Italic@0 SF(ne)2.5 +E(ver)-.15 E F0(create or destro)2.5 E 2.5(ye)-.1 G +(ncryption roots; use)-2.5 E/F5 10/Courier@0 SF(zfs-change-key)2.5 E F0 +(\(8\) for that.)A(First, a connection is made to the TPM, which)108 +194.4 Q F4(must)2.5 E F0(be TPM-2.0-compatible.)2.5 E(If)108 211.2 Q F3 +(dataset)3.055 E F0 -.1(wa)3.055 G 3.055(sp).1 G(re)-3.055 E .555 +(viously encrypted with)-.25 F F2(tzpfms)3.055 E F0 .555(and the)3.055 F +F1(TPM2)3.055 E F0 .554(back-end w)3.054 F .554(as used, the pre)-.1 F +(vious)-.25 E -.1(ke)108 223.2 S 3.059(yw)-.05 G .559 +(ill be freed from the TPM.)-3.059 F .56 (Otherwise, or in case of an error)5.56 F 3.06(,d)-.4 G .56 (ata required for manual interv)-3.06 F(en-)-.15 E -(tion will be written to the standard error stream.)108 247.2 Q(Ne)108 -264 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 +(tion will be written to the standard error stream.)108 235.2 Q(Ne)108 +252 Q .295(xt, a ne)-.15 F 2.794(ww)-.25 G .294(rapping k)-2.794 F .594 -.15(ey i)-.1 H 2.794(sg).15 G .294 (enerated on the TPM, optionally back)-2.794 F .294(ed up \(see)-.1 F F1 (OPTIONS)2.794 E F0 .294(\), and sealed)B .588 -(to a persistent object on the TPM under the o)108 276 R .589 +(to a persistent object on the TPM under the o)108 264 R .589 (wner hierarch)-.25 F .589(y; if there is a passphrase set on the o)-.05 -F(wner)-.25 E(hierarch)108 288 Q 1.603 -.65(y, t)-.05 H .302 +F(wner)-.25 E(hierarch)108 276 Q 1.603 -.65(y, t)-.05 H .302 (he user is prompted for it; the user is al).65 F -.1(wa)-.1 G .302 (ys prompted for an optional passphrase to protect).1 F -(the sealed object with.)108 300 Q(The follo)108 316.8 Q +(the sealed object with.)108 288 Q(The follo)108 304.8 Q (wing properties are set on)-.25 E F3(dataset)2.5 E F0(:)A F1<83>128 -328.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> -128 340.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 -(persistent-object-ID)A F0([)139 352.8 Q F2(;)A F3(algorithm)A F2(:)A F3 +316.8 Q F5(xyz.nabijaczleweli:tzpfms.backend)7.5 E F0(=)A F1(TPM2)A<83> +128 328.8 Q F5(xyz.nabijaczleweli:tzpfms.key)7.5 E F0(=)A F3 +(persistent-object-ID)A F0([)139 340.8 Q F2(;)A F3(algorithm)A F2(:)A F3 (PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3 (algorithm)A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C -1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 369.6 Q F0 1.263 +1.666(]...)-1.666 G(])-1.666 E F5(tzpfms.backend)108 357.6 Q F0 1.263 (identi\214es this dataset for w)3.763 F 1.264(ork with)-.1 F F1(TPM2) 3.764 E F0(-back-ended)A F2(tzpfms)3.764 E F0 1.264(tools \(namely)3.764 -F F5(zfs-tpm2-change-key)108 381.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) +F F5(zfs-tpm2-change-key)108 369.6 Q F0(\(8\),)A F5(zfs-tpm2-load-key) 2.5 E F0(\(8\), and)A F5(zfs-tpm2-clear-key)2.5 E F0(\(8\)\).)A F5 -(tzpfms.key)108 398.4 Q F0 1.509(is an inte)4.009 F 1.509 +(tzpfms.key)108 386.4 Q F0 1.509(is an inte)4.009 F 1.509 (ger representing the sealed object, optionally follo)-.15 F 1.509 (wed by a semicolon and)-.25 F .822(PCR list as speci\214ed with)108 -410.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 +398.4 R F24.988 E F0 3.322(,n)C .822(ormalised to be)-3.322 F F2 (tpm-tools)3.322 E F0 .823(-toolchain-compatible; if needed, it can)B -.866(be passed to)108 422.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 +.866(be passed to)108 410.4 R F2 2.532(tpm2_unseal \255c)3.366 F F5 (${tzpfms.key)6.866 E F2(%%)A F5(;)A/F6 10/Symbol SF(*)A F5(})A F0(with) 3.366 E F25.032 E F0(")6.866 E F5(str:${passphrase})A F0 3.365("o) -C(r)-3.365 E F2109.666 434.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A +C(r)-3.365 E F2109.666 422.4 Q F0(")6.727 E F5(pcr:${tzpfms.key)A F2(#)A F6(*)A F5(;})A F0 .727(", as the case may be, or equi)B -.25(va) -.25 G .728(lent, for back-up \(see).25 F F1(OPTIONS)3.228 E F0(\).)A -.448(If you ha)108 446.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F +.448(If you ha)108 434.4 R .748 -.15(ve a s)-.2 H .448(ealed k).15 F .748 -.15(ey y)-.1 H .448(ou can access with that or equi).15 F -.25(va) -.25 G .447(lent tool and set both of these properties, it).25 F -(will funxion seamlessly)108 458.4 Q(.)-.65 E(Finally)108 475.2 Q 12.005 +(will funxion seamlessly)108 446.4 Q(.)-.65 E(Finally)108 463.2 Q 12.005 (,t)-.65 G 9.505(he equi)-12.005 F -.25(va)-.25 G 9.505(lent of).25 F F2 9.505(zfs change-key)12.005 F17.172 E F5(keylocation=prompt)15.506 -E F217.172 E F5(keyformat=raw)108 487.2 Q F3(dataset)6.107 E F0 +E F217.172 E F5(keyformat=raw)108 475.2 Q F3(dataset)6.107 E F0 .107(is performed with the ne)2.607 F 2.606(wk)-.25 G -.15(ey)-2.706 G 5.106(.I)-.5 G 2.606(fa)-5.106 G 2.606(ne)-2.606 G .106 (rror occurred, best ef)-2.606 F .106(fort is made)-.25 F .289(to clean\ up the persistent object and properties, or to issue a note for manual\ - interv)108 499.2 R .29(ention into the stan-)-.15 F(dard error stream.) -108 511.2 Q 2.625<418c>108 528 S .125(nal v)-2.625 F .125 + interv)108 487.2 R .29(ention into the stan-)-.15 F(dard error stream.) +108 499.2 Q 2.625<418c>108 516 S .125(nal v)-2.625 F .125 (eri\214cation should be made by running)-.15 F F2 1.79 (zfs-tpm2-load-key \255n)2.624 F F3(dataset)6.124 E F0 5.124(.I)C 2.624 (ft)-5.124 G .124(hat com-)-2.624 F .506(mand succeeds, all is well, b) -108 540 R .506(ut otherwise the dataset can be manually rolled back to \ -a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 552 Q F3(dataset) +108 528 R .506(ut otherwise the dataset can be manually rolled back to \ +a passphrase with)-.2 F F2(zfs-tpm2-clear-key)108 540 Q F3(dataset) 11.539 E F0(\(or)8.039 E 8.039(,i)-.4 G 8.039(ft)-8.039 G 5.539(hat f) -8.039 F 5.539(ails to w)-.1 F(ork,)-.1 E F2 5.539(zfs change-key)8.039 -F13.204 E F5(keyformat=passphrase)108 564 Q F3(dataset)6 E F0 +F13.204 E F5(keyformat=passphrase)108 552 Q F3(dataset)6 E F0 (\), and you are hereby ask)A(ed to report a b)-.1 E(ug, please.)-.2 E -F2(zfs-tpm2-clear-key)108 580.8 Q F3(dataset)6.029 E F0 .029 +F2(zfs-tpm2-clear-key)108 568.8 Q F3(dataset)6.029 E F0 .029 (can be used to free the TPM persistent object and go back to us-)2.529 -F(ing a passphrase.)108 592.8 Q F1(OPTIONS)72 609.6 Q F2109.666 -621.6 Q F3(backup-file)6 E F0(Sa)203 621.6 Q .353 -.15(ve a b)-.2 H .052 +F(ing a passphrase.)108 580.8 Q F1(OPTIONS)72 597.6 Q F2109.666 +609.6 Q F3(backup-file)6 E F0(Sa)203 609.6 Q .353 -.15(ve a b)-.2 H .052 (ack-up of the k).15 F .352 -.15(ey t)-.1 H(o).15 E F3(backup-file)2.552 E F0 2.552(,w)C .052(hich must not e)-2.552 F .052(xist beforehand.)-.15 -F .693(This back-up)203 633.6 R F4(must)3.193 E F0 .694 +F .693(This back-up)203 621.6 R F4(must)3.193 E F0 .694 (be stored securely)3.193 F 3.194(,o)-.65 G -.25(ff)-3.194 G 3.194 (-site. In).25 F .694(case of a catastrophic e)3.194 F -.15(ve)-.25 G -(nt,).15 E(the k)203 645.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) -.15 E F2(zfs load-key)233 657.6 Q F3(dataset)6 E F5(<)6 E F3 -(backup-file)6 E F2109.666 674.4 Q F3(algorithm)6 E F2(:)A F3(PCR) +(nt,).15 E(the k)203 633.6 Q .3 -.15(ey c)-.1 H(an be loaded by running) +.15 E F2(zfs load-key)233 645.6 Q F3(dataset)6 E F5(<)6 E F3 +(backup-file)6 E F2109.666 662.4 Q F3(algorithm)6 E F2(:)A F3(PCR) A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C([)-1.666 E F2(+)A F3(algorithm) A F2(:)A F3(PCR)A F0([)A F2(,)A F3(PCR)A F0 1.666(]...)C 1.666(]...) --1.666 G 1.425(Bind the k)203 686.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 +-1.666 G 1.425(Bind the k)203 674.4 R 1.725 -.15(ey t)-.1 H 3.925(os).15 G 1.425(pace- or comma-separated)-3.925 F F3(PCR)3.924 E F0 3.924(sw)C -1.424(ithin their corresponding)-3.924 F(hashing)203 698.4 Q F3 +1.424(ithin their corresponding)-3.924 F(hashing)203 686.4 Q F3 (algorithm)2.523 E F0 2.523<8a69>2.523 G 2.523(ft)-2.523 G(he)-2.523 E 2.523(yc)-.15 G .023(hange, the wrapping k)-2.523 F .323 -.15(ey w)-.1 H -.024(ill not be able to be).15 F 2.5(unsealed. There)203 710.4 R(are)2.5 +.024(ill not be able to be).15 F 2.5(unsealed. There)203 698.4 R(are)2.5 E F1(24)2.5 E F0(PCRs, numbered [)2.5 E F1(0)A F0(,)A F1(23)2.5 E F0(].) -A F3(algorithm)203 727.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G +A F3(algorithm)203 715.2 Q F0 2.968(may be an)5.469 F 5.468(yo)-.15 G 5.468(fc)-5.468 G(ase-insensiti)-5.468 E 3.268 -.15(ve ")-.25 H F1(sha1) .15 E F0 2.968(", ")B F1(sha256)A F0 2.968(", ")B F1(sha384)A F0(",)A(") -203 739.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 +203 727.2 Q F1(sha512)A F0 4.983(", ")B F1(sm3_256)A F0 4.983(", ")B F1 (sm3-256)A F0 4.983(", ")B F1(sha3_256)A F0 4.983(", ")B F1(sha3-256)A -F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 751.2 Q F1(sha3-384)A F0 +F0 4.983(", ")B F1(sha3_384)A F0(",)A(")203 739.2 Q F1(sha3-384)A F0 (", ")A F1(sha3_512)A F0(", or ")A F1(sha3-512)A F0 -(", and must be supported by the TPM.)A(tzpfms 0.3.4-22-g7c0393e)72 -817.889 Q(February 28, 2024)83.578 E(1)183.837 E 0 Cg EP -%%Page: 2 13 +(", and must be supported by the TPM.)A(tzpfms 0.3.4-23-g984c5d5)72 +817.889 Q(February 28, 2024)83.018 E(1)183.837 E 0 Cg EP +%%Page: 2 8 %%BeginPageSetup BP %%EndPageSetup @@ -1205,9 +845,9 @@ E F3 1.666(SEE ALSO)72 616.8 R F4(tpm2_unseal)108 628.8 Q F0(\(1\))A (and https://trustedcomputinggroup.or)108 657.6 Q (g/wp-content/uploads/PC-)-.18 E(ClientSpeci\214c_Platform_Pro\214le_fo\ r_TPM_2p0_Systems_v51.pdf, Section 2.3.4 "PCR Usage", T)108 669.6 Q -(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q -(February 28, 2024)83.578 E(2)183.837 E 0 Cg EP -%%Page: 1 14 +(able)-.8 E(1.)108 681.6 Q(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q +(February 28, 2024)83.018 E(2)183.837 E 0 Cg EP +%%Page: 1 9 %%BeginPageSetup BP %%EndPageSetup @@ -1217,8 +857,8 @@ F/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10/Courier-Bold@0 SF (zfs-tpm2-clear-key)108 96 Q F0 2.5<8a72>2.5 G -.25(ew)-2.5 G (rap ZFS dataset k).25 E .3 -.15(ey i)-.1 H 2.5(np).15 G(asssw)-2.5 E (ord and clear tzpfms TPM2 metadata)-.1 E F1(SYNOPSIS)72 112.8 Q F2 -(zfs-fido2-add-backup)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 -E F1(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 +(zfs-tpm-list)108 124.8 Q/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1 +(DESCRIPTION)72 141.6 Q F0(After v)108 153.6 Q(erifying)-.15 E F3 (dataset)2.5 E F0 -.1(wa)2.5 G 2.5(se).1 G(ncrypted with)-2.5 E F2 (tzpfms)2.5 E F0(back)2.5 E(end)-.1 E F1(TPM2)2.5 E F0(:)A 5 (1. performs)118 165.6 R 5.641(the equi)8.141 F -.25(va)-.25 G 5.641 @@ -1286,9 +926,9 @@ F(UGS)-.1 E F0(https://todo.sr)108 681.6 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 698.4 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 710.4 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.) --.25 E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E +-.25 E(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q(December 4, 2022)83.023 E (1)183.842 E 0 Cg EP -%%Page: 1 15 +%%Page: 1 10 %%BeginPageSetup BP %%EndPageSetup @@ -1297,23 +937,23 @@ BP (AD-KEY\(8\))-.35 E/F1 10/Times-Bold@0 SF -.2(NA)72 84 S(ME).2 E/F2 10 /Courier-Bold@0 SF(zfs-tpm2-load-key)108 96 Q F0 2.5<8a6c>2.5 G (oad TPM2-encrypted ZFS dataset k)-2.5 E -.15(ey)-.1 G F1(SYNOPSIS)72 -112.8 Q F2(zfs-fido2-add-backup)108 124.8 Q F0([)2.5 E F21.666 E -F0(])A/F3 10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 -Q F0 .864(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1 -(wa)3.364 G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E -F0(back)3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865 -(nseals the k)-3.365 F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F -(into)108 165.6 Q F3(dataset)2.5 E F0(.)A(The user is prompted for the \ -additional passphrase, set when creating the k)108 182.4 Q -.15(ey)-.1 G -2.5(,i)-.5 G 2.5(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 -10/Courier@0 SF(zfs-tpm2-change-key)2.5 E F0 -(\(8\) for a detailed description.)A F1(OPTIONS)72 216 Q F2109.666 -228 Q F0 3.208(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 -G 5.708(ni).15 G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i) --.1 H 5.708(sa).15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va) --.25 G 3.207(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s) -C F24.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V) --.3 F(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 +112.8 Q F2(zfs-tpm-list)108 124.8 Q F0([)2.5 E F21.666 E F0(])A/F3 +10/Courier-Oblique@0 SF(dataset)2.5 E F1(DESCRIPTION)72 141.6 Q F0 .864 +(After v)108 153.6 R(erifying)-.15 E F3(dataset)3.364 E F0 -.1(wa)3.364 +G 3.364(se).1 G .864(ncrypted with)-3.364 F F2(tzpfms)3.365 E F0(back) +3.365 E(end)-.1 E F1(TPM2)3.365 E F0 3.365(,u)C .865(nseals the k)-3.365 +F 1.165 -.15(ey a)-.1 H .865(nd loads it).15 F(into)108 165.6 Q F3 +(dataset)2.5 E F0(.)A(The user is prompted for the additional passphras\ +e, set when creating the k)108 182.4 Q -.15(ey)-.1 G 2.5(,i)-.5 G 2.5 +(fo)-2.5 G(ne w)-2.5 E(as set.)-.1 E(See)108 199.2 Q/F4 10/Courier@0 SF +(zfs-tpm2-change-key)2.5 E F0(\(8\) for a detailed description.)A F1 +(OPTIONS)72 216 Q F2109.666 228 Q F0 3.208 +(Do a no-op/dry run, can be used e)131 228 R -.15(ve)-.25 G 5.708(ni).15 +G 5.708(ft)-5.708 G 3.208(he k)-5.708 F 3.508 -.15(ey i)-.1 H 5.708(sa) +.15 G 3.208(lready loaded.)-5.708 F(Equi)8.207 E -.25(va)-.25 G 3.207 +(lent to).25 F F2(zfs)5.707 E(load-key)131 240 Q F0 -.55('s)C F2 +4.716 E F0(option.)2.5 E F1(ENVIR)72 256.8 Q 1.666(ONMENT V)-.3 F +(ARIABLES)-1.35 E F4(TZPFMS_PASSPHRASE_HELPER)108 268.8 Q F0 .045 (By def)133 280.8 R .045(ault, passphrases are prompted for and read in\ on the standard output and input streams.)-.1 F(If)5.046 E F4 (TZPFMS_PASSPHRASE_HELPER)133 292.8 Q F0 1.596(is set and nonempty)4.096 @@ -1364,7 +1004,7 @@ F(UGS)-.1 E F0(https://todo.sr)108 655.2 Q(.ht/\001nabijaczle)-.55 E (weli/tzpfms)-.25 E F4(\001nabijaczleweli/tzpfms@lists.sr.ht)108 672 Q F0 83.763(,a)C(rchi)-83.763 E -.15(ve)-.25 G 83.762(da).15 G(t)-83.762 E (https://lists.sr)108 684 Q(.ht/\001nabijaczle)-.55 E(weli/tzpfms.)-.25 -E(tzpfms 0.3.4-22-g7c0393e)72 817.889 Q(December 4, 2022)83.583 E(1) +E(tzpfms 0.3.4-23-g984c5d5)72 817.889 Q(December 4, 2022)83.023 E(1) 183.842 E 0 Cg EP %%Trailer end diff --git a/zfs-fido2-add-backup.8 b/zfs-fido2-add-backup.8 deleted file mode 100644 index 08a80cb..0000000 --- a/zfs-fido2-add-backup.8 +++ /dev/null @@ -1,125 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-ADD-BACKUP 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-add-backup -.Nd allow another FIDO2 device to unlock ZFS dataset -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After -.Xr zfs-fido2-change-key 8 -derives the key for a dataset from a FIDO2 device, -.Nm -may be executed to extend this to any number of additional devices. -.Pp -First, the wrapping key is extracted as normally during -.Xr zfs-fido2-load-key 8 , -then a credential is made as-if during -.Xr zfs-fido2-change-key 8 -(except the "primary" device and all the ones holding backups are excluded from the search); -however, the -.Ql hmac-secret -is instead used as a symmetric AES-256-GCM -.Pq Xr EVP_CIPHER-AES 7ssl -key to encrypt the wrapping key directly with a random IV. -.Pp -This turns the -.Li xyz.nabijaczleweli:tzpfms.key -variable into -.br -.Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns Ar backup-salt Ns Cm :\:\& Ns Ar backup-credential-ID Ns Cm :\:\& Ns Ar backup-credential-public-key Ns Cm :\:\& Ns Ar IV Ns Cm :\:\& Ns Ar encrypted-key Oc Ns … -.Pp -.Li tzpfms.key -is actually a dot-separated list of device bundles. -The first one is as-described in -.Xr zfs-fido2-change-key 8 . -Subsequent ones also include (identically-encoded) IVs and encrypted blobs. -.Pp -.Xr zfs-fido2-load-key 8 -shops assertions around devices in a device-major order \(em -depending on device numbering, a backup may be loaded even if the primary device is present. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-add-backup.8.html b/zfs-fido2-add-backup.8.html deleted file mode 100644 index e6d3444..0000000 --- a/zfs-fido2-add-backup.8.html +++ /dev/null @@ -1,153 +0,0 @@ - - - - - - - - ZFS-FIDO2-ADD-BACKUP(8) - - - - - - - - -
ZFS-FIDO2-ADD-BACKUP(8)System Manager's ManualZFS-FIDO2-ADD-BACKUP(8)
-
-
-

-

zfs-fido2-add-backup — - allow another FIDO2 device to unlock ZFS dataset

-
-
-

- - - - - -
zfs-fido2-add-backupdataset
-
-
-

-

After - zfs-fido2-change-key(8) - derives the key for a dataset from a FIDO2 device, - zfs-fido2-add-backup may be executed to extend this - to any number of additional devices.

-

First, the wrapping key is extracted as normally during - zfs-fido2-load-key(8), - then a credential is made as-if during - zfs-fido2-change-key(8) - (except the "primary" device and all the ones holding backups are - excluded from the search); however, the - ‘hmac-secret’ is instead used as a - symmetric AES-256-GCM - (EVP_CIPHER-AES(7ssl)) - key to encrypt the wrapping key directly with a random IV.

-

This turns the - xyz.nabijaczleweli:tzpfms.key variable into -
- salt:credential-ID:credential-public-key[.backup-salt:backup-credential-ID:backup-credential-public-key:IV:encrypted-key]…

-

tzpfms.key is actually a dot-separated - list of device bundles. The first one is as-described in - zfs-fido2-change-key(8). - Subsequent ones also include (identically-encoded) IVs and encrypted - blobs.

-

zfs-fido2-load-key(8) - shops assertions around devices in a device-major order — depending - on device numbering, a backup may be loaded even if the primary device is - present.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-change-key.8 b/zfs-fido2-change-key.8 deleted file mode 100644 index 6bd3f57..0000000 --- a/zfs-fido2-change-key.8 +++ /dev/null @@ -1,186 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 29, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CHANGE-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-change-key -.Nd change ZFS dataset key to one authenticated by a FIDO2 device -.Sh SYNOPSIS -.Nm -.Op Fl b Ar backup-file -.Ar dataset -. -.Sh DESCRIPTION -To normalise the -.Ar dataset , -.Nm -will open its encryption root in its stead. -.Nm -will -.Em never -create or destroy encryption roots; use -.Xr zfs-change-key 8 -for that. -.Pp -First, a connection is made to the FIDO2 device, which -.Em must -support the -.Ql hmac-secret -extension. -.Pp -If -.Ar dataset -was previously encrypted with -.Nm fzifdso -and the -.Sy FIDO2 -back-end was used, the metadata will be silently cleared. -Otherwise, or in case of an error, data required for manual intervention will be written to the standard error stream. -.Pp -Next, a new credential of type ES256 is generated on the device (with relying party ID -.Li fzifdso -and name equal to the dataset name) -with the -.Ql hmac-secret -extension requested; the device PIN, if any, is prompted for here. -This mimicks a WebAuthn registration step. -.Pp -Then, the credential is asserted with a 32-byte random salt, -which hashes it with device-private data, and thus generates the wrapping key -.Pq which is optionally backed up Pq see Sx OPTIONS . -This mimicks a WebAuthn login step. -.Pp -The following properties are set on -.Ar dataset : -.Bl -bullet -compact -offset 4n -width "@" -.It -.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy FIDO2 -.It -.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar salt Ns Cm :\:\& Ns Ar credential-ID Ns Cm :\:\& Ns Ar credential-public-key Ns Oo Cm \&. Ns … Oc Ns … -.El -.Pp -.Li tzpfms.backend -identifies this dataset for work with -.Sy FIDO2 Ns -back-ended -.Nm tzpfms -tools -.Pq i.e. Nm fzifdso Xr zfs-fido2-change-key 8 , Xr zfs-fido2-load-key 8 , Xr zfs-fido2-add-backup 8 , and Xr zfs-fido2-clear-key 8 . -.Pp -.Li tzpfms.key -is a colon-separated tuple of unpadded URL-safe base64 blobs; -the first one is the random salt; -the second represents the ID of created credential, -and the third \(en its public key. -There exists no other user-land tool for deciphering this; perhaps there should be. -.\"" TODO: make an LD_PRELOADable for extracting the key maybe? -.Pp -Finally, the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset -is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. -.Pp -A final verification should be made by running -.Nm zfs-fido2-load-key Fl n Ar dataset . -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a passphrase with -.Nm zfs-fido2-clear-key Ar dataset -.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , -and you are hereby asked to report a bug, please. -.Pp -.Nm zfs-fido2-clear-key Ar dataset -can be used to clear the properties and go back to using a passphrase. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl b Ar backup-file" -.It Fl b Ar backup-file -Save a back-up of the key to -.Ar backup-file , -which must not exist beforehand. -This back-up -.Em must -be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running -.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-change-key.8.html b/zfs-fido2-change-key.8.html deleted file mode 100644 index 68ea232..0000000 --- a/zfs-fido2-change-key.8.html +++ /dev/null @@ -1,206 +0,0 @@ - - - - - - - - ZFS-FIDO2-CHANGE-KEY(8) - - - - - - - - -
ZFS-FIDO2-CHANGE-KEY(8)System Manager's ManualZFS-FIDO2-CHANGE-KEY(8)
-
-
-

-

zfs-fido2-change-key — - change ZFS dataset key to one authenticated by a FIDO2 - device

-
-
-

- - - - - -
zfs-fido2-change-key[-b backup-file] - dataset
-
-
-

-

To normalise the dataset, - zfs-fido2-change-key will open its encryption root - in its stead. zfs-fido2-change-key will - - create or destroy encryption roots; use - zfs-change-key(8) - for that.

-

First, a connection is made to the FIDO2 device, which - must support the - ‘hmac-secret’ extension.

-

If dataset was previously encrypted with - fzifdso and the FIDO2 back-end was - used, the metadata will be silently cleared. Otherwise, or in case of an - error, data required for manual intervention will be written to the standard - error stream.

-

Next, a new credential of type ES256 is generated on the device - (with relying party ID fzifdso and name equal to the - dataset name) with the ‘hmac-secret’ - extension requested; the device PIN, if any, is prompted for here. This - mimicks a WebAuthn registration step.

-

Then, the credential is asserted with a 32-byte random salt, which - hashes it with device-private data, and thus generates the wrapping key - (which is optionally backed up (see - OPTIONS)). This mimicks a WebAuthn login - step.

-

The following properties are set on - dataset:

- -

tzpfms.backend identifies this dataset for - work with FIDO2-back-ended tzpfms - tools (i.e. fzifdso - zfs-fido2-change-key(8), - zfs-fido2-load-key(8), - zfs-fido2-add-backup(8), - and - zfs-fido2-clear-key(8)).

-

tzpfms.key is a colon-separated tuple of - unpadded URL-safe base64 blobs; the first one is the random salt; the second - represents the ID of created credential, and the third – its public - key. There exists no other user-land tool for deciphering this; perhaps - there should be.

-

Finally, the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=raw dataset is - performed with the new key. If an error occurred, best effort is made to - clean up the properties, or to issue a note for manual intervention into the - standard error stream.

-

A final verification should be made by running - zfs-fido2-load-key -n - dataset. If that command succeeds, all is well, but - otherwise the dataset can be manually rolled back to a passphrase with - zfs-fido2-clear-key dataset - (or, if that fails to work, zfs - change-key -o - keyformat=passphrase dataset), - and you are hereby asked to report a bug, please.

-

zfs-fido2-clear-key - dataset can be used to clear the properties and go - back to using a passphrase.

-
-
-

-
-
- backup-file
-
Save a back-up of the key to backup-file, which must - not exist beforehand. This back-up must be stored - securely, off-site. In case of a catastrophic event, the key can be loaded - by running -
zfs - load-key dataset - < - backup-file
-
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 29, 2024fzifdso 0
- - diff --git a/zfs-fido2-clear-key.8 b/zfs-fido2-clear-key.8 deleted file mode 100644 index dd2a76c..0000000 --- a/zfs-fido2-clear-key.8 +++ /dev/null @@ -1,113 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-CLEAR-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-clear-key -.Nd rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 metadata -.Sh SYNOPSIS -.Nm -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 : -.Bl -enum -compact -offset 2n -width 2n -.It -performs the equivalent of -.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , -.It -removes the -.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key -properties from -.Ar dataset . -.El -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh FIDO2 back-end configuration -.Ss Environment variables -.Bl -tag -compact -width ".Ev FIDO_DEBUG" -.It Ev FIDO_DEBUG -If set, enables libfido2 debug logging to the standard error stream. -.El -. -.Ss Device selection -When creating, the first device which supports the -.Ql hmac-secret -extension is used. -When loading, the assertion is shopped around to every such device. -. -.Ss See also -The libfido2 documentation at -.Lk https:/\&/developers.yubico.com/libfido2/ . -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-clear-key.8.html b/zfs-fido2-clear-key.8.html deleted file mode 100644 index 46e553e..0000000 --- a/zfs-fido2-clear-key.8.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - - - - - ZFS-FIDO2-CLEAR-KEY(8) - - - - - - - - -
ZFS-FIDO2-CLEAR-KEY(8)System Manager's ManualZFS-FIDO2-CLEAR-KEY(8)
-
-
-

-

zfs-fido2-clear-key — - rewrap ZFS dataset key in passsword and clear tzpfms FIDO2 - metadata

-
-
-

- - - - - -
zfs-fido2-clear-keydataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - :

-
    -
  1. performs the equivalent of zfs - change-key -o - keylocation=prompt -o - keyformat=passphrase - dataset,
    2. -
  2. removes the - xyz.nabijaczleweli:tzpfms.{backend, - key} properties from - dataset.
    3. -
-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-
-

-
-
-
If set, enables libfido2 debug logging to the standard error stream.
-
-
-
-

-

When creating, the first device which supports the - ‘hmac-secret’ extension is used. When - loading, the assertion is shopped around to every such device.

-
-
-

-

The libfido2 documentation at - https://developers.yubico.com/libfido2/.

-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-fido2-load-key.8 b/zfs-fido2-load-key.8 deleted file mode 100644 index 247ca04..0000000 --- a/zfs-fido2-load-key.8 +++ /dev/null @@ -1,98 +0,0 @@ -.\" SPDX-License-Identifier: MIT -. -.Dd February 28, 2024 -.ds doc-volume-operating-system -.Dt ZFS-FIDO2-LOAD-KEY 8 -.Os fzifdso 0 -. -.Sh NAME -.Nm zfs-fido2-load-key -.Nd load FIDO2-encrypted ZFS dataset key -.Sh SYNOPSIS -.Nm -.Op Fl n -.Ar dataset -. -.Sh DESCRIPTION -After verifying -.Ar dataset -was encrypted with -.Nm tzpfms -backend -.Sy FIDO2 , -asserts the preserved challenge, HMACking the salt with the on-device secret, and loads the resulting key into -.Ar dataset . -.Pp -See -.Xr zfs-fido2-change-key 8 -for a detailed description. -. -.Sh OPTIONS -.Bl -tag -compact -width ".Fl n" -.It Fl n -Do a no-op/dry run, can be used even if the key is already loaded. -Equivalent to -.Nm zfs Cm load-key Ns 's -.Fl n -option. -.El -. -.\" SPDX-License-Identifier: MIT -. -.Sh ENVIRONMENT VARIABLES -.Bl -tag -compact -width 4n -.It Ev TZPFMS_PASSPHRASE_HELPER -By default, passphrases are prompted for and read in on the standard output and input streams. -If -.Ev TZPFMS_PASSPHRASE_HELPER -is set and nonempty, it will be run via -.Pa /bin/ Ns Nm sh Fl c -to provide each passphrase, instead. -.Pp -The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any. -The arguments are: -.Bl -tag -compact -offset 2n -width ".Li $1" -.It Li $1 -Pre-formatted noun phrase with all the information below, for use as a prompt -.\" Passphrase for tarta-zoot -.\" New passphrase for tarta-zoot (again) -.It Li $2 -Either the dataset name or the element of the TPM hierarchy being prompted for -.It Li $3 -.Qq new -if this is for a new passphrase, otherwise blank -.It Li $4 -.Qq again -if it's the second prompt for that passphrase, otherwise blank -.El -.Pp -If the helper doesn't exist -.Pq the shell exits with Sy 127 , -a diagnostic is issued and the normal prompt is used as fall-back. -If it fails for any other reason, the prompting is aborted. -. -. -.El -. -. -.\" SPDX-License-Identifier: MIT -. -.Sh SPECIAL THANKS -To all who support further development, in particular: -.Bl -bullet -offset 4n -compact -width "@" -.It -ThePhD -.It -Embark Studios -.It -Jasper Bekkers -.It -EvModder -.El -. -.Sh REPORTING BUGS -.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/fzifdso -.Pp -.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht , -archived at -.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms . diff --git a/zfs-fido2-load-key.8.html b/zfs-fido2-load-key.8.html deleted file mode 100644 index ffc6446..0000000 --- a/zfs-fido2-load-key.8.html +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - - ZFS-FIDO2-LOAD-KEY(8) - - - - - - - - -
ZFS-FIDO2-LOAD-KEY(8)System Manager's ManualZFS-FIDO2-LOAD-KEY(8)
-
-
-

-

zfs-fido2-load-key — - load FIDO2-encrypted ZFS dataset key

-
-
-

- - - - - -
zfs-fido2-load-key[-n] dataset
-
-
-

-

After verifying dataset was encrypted with - tzpfms backend - , - asserts the preserved challenge, HMACking the salt with the on-device - secret, and loads the resulting key into dataset.

-

See - zfs-fido2-change-key(8) - for a detailed description.

-
-
-

-
-
-
Do a no-op/dry run, can be used even if the key is already loaded. - Equivalent to zfs - load-key's -n option.
-
-
-
-

-
-
-
By default, passphrases are prompted for and read in on the standard - output and input streams. If - TZPFMS_PASSPHRASE_HELPER is set and nonempty, it - will be run via /bin/sh - -c to provide each passphrase, instead. -

The standard output stream of the helper is tied to an - anonymous file and used in its entirety as the passphrase, except for a - trailing new-line, if any. The arguments are:

-
-
-
-
Pre-formatted noun phrase with all the information below, for use as a - prompt
-
-
Either the dataset name or the element of the TPM hierarchy being - prompted for
-
-
"new" if this is for a new passphrase, otherwise blank
-
-
"again" if it's the second prompt for that passphrase, - otherwise blank
-
-
-

If the helper doesn't exist (the shell exits with - ), a - diagnostic is issued and the normal prompt is used as fall-back. If it - fails for any other reason, the prompting is aborted.

-
-
-
-
-

-

To all who support further development, in particular:

-
    -
  • ThePhD
    • -
  • Embark Studios
    • -
  • Jasper Bekkers
    • -
  • EvModder
    • -
-
-
-

-

https://todo.sr.ht/~nabijaczleweli/fzifdso

-

~nabijaczleweli/tzpfms@lists.sr.ht, - archived at - https://lists.sr.ht/~nabijaczleweli/tzpfms.

-
-
- - - - - -
February 28, 2024fzifdso 0
- - diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index 5afcc41..c553b59 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM-LIST 8 -.Os tzpfms 0.3.4-22-g7c0393e +.Os tzpfms 0.3.4-23-g984c5d5 . .Sh NAME .Nm zfs-tpm-list diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index e6e0a85..8db240a 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -166,7 +166,7 @@ tarta-zoot/vm - available yes - +
December 4, 2022tzpfms 0.3.4-22-g7c0393etzpfms 0.3.4-23-g984c5d5
diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index cbdc272..55ad674 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CHANGE-KEY 8 -.Os tzpfms 0.3.4-22-g7c0393e +.Os tzpfms 0.3.4-23-g984c5d5 . .Sh NAME .Nm zfs-tpm1x-change-key diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index b7d7382..9de03f8 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -219,7 +219,7 @@ - +
February 28, 2024tzpfms 0.3.4-22-g7c0393etzpfms 0.3.4-23-g984c5d5
diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index 7a6d437..5034f0b 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-CLEAR-KEY 8 -.Os tzpfms 0.3.4-22-g7c0393e +.Os tzpfms 0.3.4-23-g984c5d5 . .Sh NAME .Nm zfs-tpm1x-clear-key diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index 712e75a..74f103b 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -103,7 +103,7 @@ - +
December 4, 2022tzpfms 0.3.4-22-g7c0393etzpfms 0.3.4-23-g984c5d5
diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index 187662d..fe0631a 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM1X-LOAD-KEY 8 -.Os tzpfms 0.3.4-22-g7c0393e +.Os tzpfms 0.3.4-23-g984c5d5 . .Sh NAME .Nm zfs-tpm1x-load-key diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index f7dba44..95bd024 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -139,7 +139,7 @@ - +
December 4, 2022tzpfms 0.3.4-22-g7c0393etzpfms 0.3.4-23-g984c5d5
diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index a350b23..f7afb67 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -3,7 +3,7 @@ .Dd February 28, 2024 .ds doc-volume-operating-system .Dt ZFS-TPM2-CHANGE-KEY 8 -.Os tzpfms 0.3.4-22-g7c0393e +.Os tzpfms 0.3.4-23-g984c5d5 . .Sh NAME .Nm zfs-tpm2-change-key diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index 70254ab..8009c26 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -265,7 +265,7 @@ - +
February 28, 2024tzpfms 0.3.4-22-g7c0393etzpfms 0.3.4-23-g984c5d5
diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index da1dceb..63d9dce 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-CLEAR-KEY 8 -.Os tzpfms 0.3.4-22-g7c0393e +.Os tzpfms 0.3.4-23-g984c5d5 . .Sh NAME .Nm zfs-tpm2-clear-key diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index 5fc7340..3a1b5ab 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -154,7 +154,7 @@ - +
December 4, 2022tzpfms 0.3.4-22-g7c0393etzpfms 0.3.4-23-g984c5d5
diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index 90cbd4b..a17182c 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -3,7 +3,7 @@ .Dd December 4, 2022 .ds doc-volume-operating-system .Dt ZFS-TPM2-LOAD-KEY 8 -.Os tzpfms 0.3.4-22-g7c0393e +.Os tzpfms 0.3.4-23-g984c5d5 . .Sh NAME .Nm zfs-tpm2-load-key diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index 479a0cb..be44508 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -138,7 +138,7 @@ - +
December 4, 2022tzpfms 0.3.4-22-g7c0393etzpfms 0.3.4-23-g984c5d5