From fbdfec895bb1f2754fa2199264573fa052513958 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Piotr=20Kr=C3=B3l?= <piotr.krol@3mdeb.com>
Date: Sun, 15 Sep 2024 22:46:13 +0200
Subject: [PATCH] 2024/QubesOSsummit: initial slides version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Piotr Król <piotr.krol@3mdeb.com>
---
 ...plementing-uefi-secure-boot-in-qubes-os.md | 321 ++++++++++++++++++
 ...ubes-os-summit-2024-day-1-closing-notes.md |  10 +
 ...ubes-os-summit-2024-day-2-closing-notes.md |  10 +
 .../welcome-to-qubes-os-summit-2024-day-1.md  |  12 +
 .../welcome-to-qubes-os-summit-2024-day-2.md  |  10 +
 public/2024/QubesOSsummit/3mdeb_itl.png       | Bin 0 -> 20201 bytes
 slides.md                                     |  35 +-
 7 files changed, 393 insertions(+), 5 deletions(-)
 create mode 100644 pages/implementing-uefi-secure-boot-in-qubes-os.md
 create mode 100644 pages/qubes-os-summit-2024-day-1-closing-notes.md
 create mode 100644 pages/qubes-os-summit-2024-day-2-closing-notes.md
 create mode 100644 pages/welcome-to-qubes-os-summit-2024-day-1.md
 create mode 100644 pages/welcome-to-qubes-os-summit-2024-day-2.md
 create mode 100644 public/2024/QubesOSsummit/3mdeb_itl.png
diff --git a/pages/implementing-uefi-secure-boot-in-qubes-os.md b/pages/implementing-uefi-secure-boot-in-qubes-os.md
new file mode 100644
index 0000000..595e0d0
--- /dev/null
+++ b/pages/implementing-uefi-secure-boot-in-qubes-os.md
@@ -0,0 +1,321 @@
+---
+layout: cover
+background: /intro.png
+class: text-center
+routeAlias: implementing-uefi
+
+---
+## Implementing UEFI Secure Boot in Qubes OS
+### Challenges and Future Steps
+
+<br>
+
+## Piotr Król
+<!--
+
+This talk addresses both the technical and procedural aspects and aims to
+provide a comprehensive roadmap for achieving UEFI Secure Boot support in Qubes
+OS, ultimately paving the way for a more secure and resilient operating system.
+
+-->
+
+---
+
+# UEFI Secure Boot
+
+<!--
+
+TODO: very brief intro to UEFI Secure Boot
+
+UEFI Secure
+Boot has emerged as a critical feature to protect systems against persistent
+firmware attacks and unauthorized code execution. While Qubes OS is renowned
+for its security-centric approach, the official support for UEFI Secure Boot
+remains a significant milestone yet to be fully realized.
+
+UEFI Secure Boot is really Chain of Trust technology, which covers very
+specific part of x86 UEFI compliant boot process.
+
+It covers only transition between UEFI BIOS and OS Loader/OS Kernel.
+
+It also can cover DXE images (typically drivers) authentication although
+reference implementation does not enable that. Despite providing all necessary
+libraries to achieve the goal.
+
+-->
+
+---
+
+# UEFI Secure Boot and Linux
+
+<!--
+
+- Current Limitations and User Impact: Understanding why Secure Boot is not
+currently supported and the implications for users, particularly those needing
+dual-boot environments.
+
+-->
+
+---
+
+# UEFI Secure Boot and Xen
+<!--
+
+TODO: Why Qubes OS is different?  What are the Xen challanges?
+- NX bit
+- relocation, tklangley `.reloc`?
+
+- Andy: XenServer Host UEFI Secure Boot update
+  - Microsoft mandates use of SBAT for signing Xen code.
+  - Live patches require signatures, while Kxec is more complicated due to
+user-space code.
+  0 Purgatory runs in VM context, fully privileged, to ensure Xen’s signature.
+  0 Integrity check on regions before loading to avoid rogue DMA corruption.
+- XenServer Host UEFI Secure Boot update
+  - Expected changes needed in Xen to support Secure Boot:
+    - xen.efi metadata changes
+      - Add SBAT support.  Contents to be provided by vendor
+      - Support IMAGE_DLLCHARACTERISTICS_NX_COMPAT
+    - Kexec
+      - Embed purgatory in Xen (can’t be passed from tools)
+        - Includes SHA256 for checking the integrity of the target image
+      - Check signature on new kernel+initrd
+    - Livepatches
+      - Check signature on livepatches
+    - Hypercalls
+      - New ABI to check all pointers  (Discussed previously)
+
+Notes from Andrew Cooper, mentioned by Trammel
+[here](https://github.com/QubesOS/qubes-issues/issues/4371#issuecomment-682614795):
+
+> Things like LIVEPATCH and KEXEC need compiling out, until they can be taught
+> to verify signatures.
+> Beyond that, things like the GDB serial stub probably need a way of being
+> able to be compiled out, and then being compiled out. (This is definitely not
+> an exhaustive list.) Xen's secureboot requirements also extend to the dom0
+> kernel, due to the responsibility-sharing which currently exists. For a Linux
+> dom0, Xen must ensure that lockdown mode is forced on (/dev/mem in dom0 still
+> has a lot of system level power). At a minimum, this involves extending
+> lockdown mode to prohibit the use of /{dev/proc}/xen/privcmd, which is still
+> a trivial privilege escalation hole in PV Linux that noone seems to want to
+> admit to and fix. I think it is great that work is being started in this
+> direction, but there is a huge quantity of work to do before a downstream
+> could plausibly put together a Xen system which honours the intent of
+> SecureBoot. I know Safeboot has different goals/rules here, but whatever we
+> put together called "Secure Boot support" will have to be compatible with
+> Microsoft's model for it to be useful in the general case.
+
+There is classical problem here which involve premise that either we doing
+everything or nothing. So for examples there are issues with locking down Xen
+and Dom0, but that seem to block having UEFI Secure Boot enabled to the point
+of the lockdown.
+
+Other issue is PE file format vs Xen requirements for memory layout.
+
+This talk will explore the challenges and potential solutions for implementing
+UEFI Secure Boot in Qubes OS.
+
+TODO: where to put various BIOSes approach: Dasharo, HP BIOS, QEMU
+- ACER seem to have option "UEFI file trusted for execution" or sth like that
+
+-->
+
+---
+
+# UEFI SB in Qubes OS
+
+<!--
+
+It all seem to start from Wim Vervoorn (Eltan)
+[email](https://groups.google.com/g/qubes-users/c/vrzdJmPNzrE/m/MC4l9QTJBAAJ)
+about building chain of trust in system using Qubes OS.
+- thread gathered a lot of emotions, FUD, ideology etc.
+
+-->
+
+---
+
+# Challenges
+
+<!--
+
+> just signing bootloader and/or Xen isn't enough, and would result in
+> something trivial to bypass (for example using kernel parameters).
+- _marmarek_
+
+> relying on Xen.efi is very unreliable depending on (...) UEFI implementation
+> the requires File System Protocol Interface may be missing or unable to
+> access those files (including limitation like ESP support, which on ISO9660
+> is only 32MB)
+
+> boot parameters modification is problematic, so in case boot failure
+> troubleshooting/recovery may be very problematics
+- this dev feature, regular user should never need that, we know thing work
+differently, so maybe there should be better recovery mechanisms
+
+- Technical Roadblocks: This section highlights technical challenges such as
+signing GRUB and Xen binaries, managing key enrollments, and ensuring
+compatibility across different hardware setups.
+
+Let's say we have booted system, what is next?
+
+-->
+
+---
+
+# Why we should care?
+
+<!--
+
+The ever-evolving landscape of cybersecurity demands robust mechanisms to
+ensure the integrity and trustworthiness of computing environments.
+
+- Security Enhancements and Benefits: Evaluate how Secure Boot can enhance
+Qubes OS's overall security posture and protect against specific attack
+vectors.
+
+TODO: mention biggest SNAFU caused by UEFI Secure Boot and explain true reason
+behind that.
+
+-->
+
+---
+
+# What we can do?
+
+<!--
+
+TODO: explain possible paths for integration of UEFI Secure Boot
+- how various distributions deal with the problem
+- draw diagrams which show all those boot flows and provisioning procedures
+
+- Proposed Solutions: This section discusses the steps proposed in issue #4371
+to sign boot images with dedicated keys, build unified Xen boot images, and
+make necessary GRUB configuration changes.
+
+-->
+
+---
+
+# Tools
+
+<!--
+
+TODO: what tools we have to deal with
+- sbsigntool family
+- efitools family
+
+-->
+
+---
+
+# Processes
+
+<!--
+
+Leveraging insights from ongoing discussions and issues like QubesOS Issue
+#4371, we will explore the necessary system changes, from signing boot images
+to configuring the system to accommodate Secure Boot's complexities.
+
+-->
+
+---
+
+# Plans
+
+<!--
+
+- Roadmap and Community Involvement: Outlining the future steps towards full
+Secure Boot support and how the community can participate in the ongoing
+testing, feedback, and development efforts.
+
+Marek's requirements June, 2018:
+1. Binaries signed in a split-gpg compatible way
+  - signing key shouldn't be exposed to build environment
+2. Make sure kernel and initramfs also gets verified
+  - how to do that when initramfs is dynamically generated?
+  - what would be role of shim in this scheme?
+3. xen and kernel command line are also verified
+
+Reading this: https://ruderich.org/simon/notes/secure-boot-with-grub-and-signed-linux-and-initrd
+- why initial loader (GRUB2) cannot be signed and then continue using GPG?
+
+-->
+
+---
+
+# Extreme approach
+
+* Trust only keys I personally control
+
+<!--
+
+What are the capabilities which my system support?
+- UEFI specificaition clearly defines what is supported,
+- every implementation may do things little bit different,
+- how to test that?
+  - practical test
+  - trust spec version compliance
+
+Why?
+- revocation doesn't make sense, DBX is evergrowing, on many systems space for
+DBX was probably exhausted or will be exhausted soon,
+- maintaining revocation list is also hard thing, you have to rely on UEFI
+distributions or on your vendor, and we know there are various vendors with
+various level of caring about security
+- this is at least one reason to have only allow list, which consist only
+current system owner signature
+  - how stupid this is, we can manage passwords to our banks and creating systems
+to simplify things in that space, but traction for UEFI SB management
+simplification is non-existent
+  - we can imagine system in which keys would be managed by TPM and protected by
+user password
+
+TODO: introduce UEFI revocation
+
+Trammel already achieved this approach in 2020 with Qubes 4.1 under safeboot
+project.
+
+-->
+
+---
+
+# Evaluation
+
+<!--
+
+Short approach:
+choose RSA-2048+SHA512
+
+Generate bunch of various DER-encoded x.509 certificates and check which are
+accepted by UEFI Secure Boot menu.
+
+Hey! 8192 doesn't make sense it is too computationally expensive:
+- who cares I'm doing that very rarely
+- ECC is not supported
+
+PK enrolling test results on edk2-202408 OVMF
+- RSA < 2048 would not work.
+- RSA 2048 SHA256/384/512 PASS (112 bits of symmetric key security)
+- RSA 4096 SHA256/384/512 PASS (140 bits)
+- RSA 8192 SHA256/384/512 PASS (192 bits)
+
+Let's try to run:
+- RSA8192 SHA512 signed HelloWorld.efi PASS
+
+Experiment:
+- copy content of Qubes OS R4.2.3-rc1 EFI partition to disk and see if it boots
+without SB, and not boot with SB
+- if yes, sign it with 8k-SHA512 key and check it if it boots
+
+Above works very well, but, when trying to test media and install I get:
+
+```shell
+error: shim_lock protocol not found.
+error: you need to load the kernel first.
+error: you need to load the kernel first.
+
+Press any key to continue...
+```
+
+-->
diff --git a/pages/qubes-os-summit-2024-day-1-closing-notes.md b/pages/qubes-os-summit-2024-day-1-closing-notes.md
new file mode 100644
index 0000000..4ceb28b
--- /dev/null
+++ b/pages/qubes-os-summit-2024-day-1-closing-notes.md
@@ -0,0 +1,10 @@
+---
+layout: cover
+background: /intro.png
+class: text-center
+routeAlias: closing-day-1
+
+---
+## Qubes OS Summit 2023 Day 1: Closing Notes
+
+### Piotr Król
diff --git a/pages/qubes-os-summit-2024-day-2-closing-notes.md b/pages/qubes-os-summit-2024-day-2-closing-notes.md
new file mode 100644
index 0000000..2a329c2
--- /dev/null
+++ b/pages/qubes-os-summit-2024-day-2-closing-notes.md
@@ -0,0 +1,10 @@
+---
+layout: cover
+background: /intro.png
+class: text-center
+routeAlias: closing-day-2
+
+---
+## Qubes OS Summit 2024 Day 2: Closing Notes
+
+### Piotr Król and Marek Marczykowski Górecki
diff --git a/pages/welcome-to-qubes-os-summit-2024-day-1.md b/pages/welcome-to-qubes-os-summit-2024-day-1.md
new file mode 100644
index 0000000..b1a9f3f
--- /dev/null
+++ b/pages/welcome-to-qubes-os-summit-2024-day-1.md
@@ -0,0 +1,12 @@
+---
+layout: cover
+background: /intro.png
+class: text-center
+routeAlias: welcome-day-1
+
+---
+## Welcome to Qubes OS Summit 2024 Day 1
+
+### Piotr Król and Marek Marczykowski Górecki
+<center><img src="/2024/QubesOSsummit/3mdeb_itl.png"
+  width="250px" style="margin-left:-20px"></center>
diff --git a/pages/welcome-to-qubes-os-summit-2024-day-2.md b/pages/welcome-to-qubes-os-summit-2024-day-2.md
new file mode 100644
index 0000000..9f6f854
--- /dev/null
+++ b/pages/welcome-to-qubes-os-summit-2024-day-2.md
@@ -0,0 +1,10 @@
+---
+layout: cover
+background: /intro.png
+class: text-center
+routeAlias: welcome-day-2
+
+---
+## Welcome to Qubes OS Summit 2024 Day 2
+
+### Piotr Król and Marek Marczykowski Górecki
diff --git a/public/2024/QubesOSsummit/3mdeb_itl.png b/public/2024/QubesOSsummit/3mdeb_itl.png
new file mode 100644
index 0000000000000000000000000000000000000000..7eb0eb10e1de1f676bf4a49781a716ea2d046ea3
GIT binary patch
literal 20201
zcmdSBWmKF!*D#6|9lX#%id%~fKDbM9C=_>hcXzjzQYbD(ixqcwcPQ@8P~15~@B4Y)
z?>+1LasHllEoLUUlD)G%*-3~{l$S(DB}9dRfkFQuC8i7m1BVFxy@34ksnvhu1pPv>
zm(qZKV|2g#!G5L3AcBE`x3W-CcUG5^<uS6eVKOkbGc;jxx3Pz|hJoP|bhkG!vNCZd
zGc+-?u;r(PG_}!^Ss3%vs&UAH<m^RF%q^rm9Zf!Z%BvW8S{ZR0(+Ucp^11Us0oa&0
z8<4r%Slc@BxbxHgh06o|{Zh?L3vJ|RY|5i7Ch>0*Xo;WJ+}YWlhnd;U&5g;8jmgf@
zjG2X-o0}QL%FN2j2yMaW<YDV<;Ld34L<xm}O7<6qn2D2-qlLY*g`F+g3rqt;I~Qku
zT3S@He?bd7J3Cq!{ujEf6O+N;8kd(YOi-ek4UC<bS(rdC!y+T&`=>pRu(8ui@gF1~
zO&tCf{wY~o{KaH%;OJzc;$d&XPpfR=War{&WbzlnOQ(N<h&q}WIGY#?u!30G8A05P
zEbM&D|F2gsIR2-DxV!TQV*z#+He(}hkP)L1hp{0eI|qjWqXEbm#K>X7ZD4H7VZd&}
z_CJ9B>GHq9NEkw)aIkW)a&mC9u(NP+bAUnr#r*f>|8B2h=VE03LW%(Ef1CYJ-QTu+
z%rD%vw)lrBe+&O|<-a}tVc9<o{|~YJe;1Xp(SOBc@8W3vR|SlXm`$urY)ovOUxdW+
zuaJz5c$_Vqtxf(%M8ek2|64>*-Q%$~ur=eSb!Rj-F*R_pcBU1Ov9q@@AX9QNG;tzR
z_(=957czT0Cub8!GDb3%{|k-(g5_iWKQR7ZDEy}is?Si(X8y1KLks`4AQM}t**HS&
z!$$S_H4F?H%m*=H75B8`bfh$G)rDusFikZUS)N_0FC=j}eOZokK@Rd&<ueQ%#e2Ea
zn&$U`>&%=8>*BA)7z&Y<#eRg*ynPoq?H`DT1{aAODD*4!-p_Y8gV)K-)wRmT)z#H+
zb!>MaJ-y+2$!Row_?&mlB2*ZeJQz#l|DPXu-t%0wlVGxG*<5r5G)^L;QjQ-_b`r?s
z+Z~pRoS)BQuX+mJZpA5RiRPm7R&6z<C;L^~85TWPVT<%D(llH#81-^4hCj@5Dx<}*
zeJ)MysU0`(8pSD1jo!-HjDCN+0-;UPd|Xg|zNQQsd3tkfQoTaLk;JcTH{94Z5pE|~
zp|>9*LT>cC+Ct*v$0>g;C#R~3@p1iVQbAvTX$7e<WJdlO;CYq}@Om+n`?;ReYA5N^
z5NX1^YY0QbW^}1}McckJdYrBcdC+Z@XHVwG6GRd*%Ed3mgu$1=hQZskvHUp2^!dW<
z`-9CQ(W4V-%1)}E%%FOWjb_{wtK3w$7=;Au*Rvj66hA8bb4j@=(szM9-8e;wtI|~7
z*+T80u62r89CC~SJgpcno5h=In|s3%dI+*OZmoKlz@&Ls_vg3SQcJO%<@MMTfvA<;
zXJ2F<SL0r%dMI!bpk-Qf;`7fMQ~AxUY26(GjApAwB!;eNa&5eRtDm+z8|^?+y`vxs
zL{X$^rVQ@Y4MWv95y7kuvl7MG9cpT7X5C*tP*PEl6USiGhjfcM1K%~oMR?JEc}jkG
z8`q~Qfcy@>XuE*WE&_BDiX3F#)u|N}pvema9KBu?&qb$PBmhj$CxpJ5i%o#E=rOcj
z;J$Dta^#`!d(3Sd``ssjabxzUhK1yFDWCJBK0^8AbFsUv+P*2t5uZYGzTI2X+(BJq
zhL(Z>bzi;pe%Lg&v`W0V`<(3fiSc>!@GrGuRMz1dv*d<akp?uAoFg^s>OVgP2LyOg
z8p1jVNmWWQK1cugWka+p49t78N(ewaR-~I|s*RE$l0dAqlAMexTb#2G7B*a<{mZg1
z3uEDQ?u8TTo?c%n*AE)`O$9Rq$}fv94%ss07Y8$>7fTiL^%Ae+QvN&uDDUDBjkay}
z11+-K^wKJsBansVM$8@Ncf(sKOfdtGaqg>-1HV|&DqN*b6dFW;^{4$`qag>Wi2=Rk
zP=dtk8am171oO|nOAuk0(i>nE)=;9qMx+dFh~pw;%dj}D;n%VYKYxY`_Qye3oH`!N
zkgpqyZxd&jck-R7cb&zJky!i^^VD-a>n2T47)5}BjhJMTO}`GeU9sr^KE^n%k1~;J
z>zbqxKJl@n_{!Stebz(rAWcmfcoG~yY(rQ&9Mh>!rTmz+ntWeky4tBH&$h!qtsi;*
zOe-dQI2Chj*pz5vw?qv&PX6N@w0tFYN8Y7tk>(&##R8caRf4A{xsD>(NPBbe$-C(R
zeNojqNGN_&-e*-!j2PiF1;$21a5;jij0DVU#A*XuC|wCCm?t(2?m0beTM?g(Mvc(J
z4$Xy|@ZkwQ`q_Qk{Ic)%=80mt{%C){cZ0UzHhN^C8niYR-ACUYootd0i^Rxy^Ona@
zaoAkAw_3<tO$mNTlU6c3F|yLAFRASFKt)KWKj&YHSf8F+Vs01BR2Y7*SXT2-oCbVi
z1ejVHtf3-^VVq`ouT<{6iE;WSIAO@(;r)FTOr464cprg$nkwJD=1q;9hTnWxZzB_h
zK#Vl*>M?nV8iaY!tddNjiA-Ql2Qcqiq60`!;GW<ZkYV^v7%}#yNlpzlV+YM1r<eyU
z-#Ismy0Gx2_&V$}6Jlte3FWdpf7?&P^0BcgHK4}9GqmreJ$QO@)7dTU4!E9A_ZV{-
zId_8%NZ^({Y5Ew)2FC0ZI%BgO+!}ZvXVe@0?gRgqb(9cTn`EMp4k?q4O$(!C{+Qk~
zt<PR{{3*Wny{^<4D*-@7xb=MrfRMM@&J_C9&%P<W^vafr<f}u8=cO<ro*yRP^Dz^G
z)EPK+)6Pj{)ri4H=pb;#b?D(QBjlrpxiav0C(QDjx1W(79)E=g*=q+!&YOF*iHw$v
zZ~R~n<x@`*wA2uAAnC0y`Y3bSJs>1(AVjnyVE|ID97P3IWmrNLRmpDnNmW$l@FP02
zY5sfLF?o$(^W^KH#&=GnABdcMzcPWd?EXaJsSo$Zy^866$Be!Epgfu=Qs9;CmS5gO
zCUM&&+P1Qd4HpaUkD;mVOFKM?5~JXdCMNSF%MTIxFg)pjWuQ;>BO_;`Fz%2sk@-J5
zmC~!W7(II&(^^YQ6w?sLDQ3!_(OL~P*C@6OTlbpFfeTVIr~&&-1i9QZdpPnml6XgD
z+At=|Lw#Fvi+g24aryPk%pB3i4aLUID4v%h@nv~W#!R1X3i!s)13^M^G#QS|aBZH6
zQHa$Dy;~P6;Y?$o3(=!RSAag995cUx-B9C;GDSw`I_N-34pL2rF&Jxz0-qks(^xK=
zt<OBQpC-XsYPeKR%utusk#(No#30eKcPQFH!XHL%4mFB&f;Kyj-x=0t%-)3q=AOa`
z?OiVSBTKq&YiEm-_rnh^L6tjyIE^~kro7KHQf-HCMGXvK;8az6s|nbqNl?tuyY}Ul
z{rvPyTrPFLe$2lZrBPUs@io52DbQdXeazjMe=alQt(W)v#$~8)p`_2f>pnK5Zf%dR
zb+96fn~=zsvwkYT!q9E3As~T17#Dz#s2jH4Oaeqwp6@t*s#>?vbx<rksVYY*)*Y-U
zdk2u<8OqQ$Wq6ojFj~otX$=)rI3Ia7X<^yi_cU72iIEs8Cwhn?%{<XM+vPNRS~a@@
z%Q^UBAw8Ls=_81cQz~jL(wCGLDczHYvvEx;_f^ireK?PSOMvIHtQcZjA>-X?Cx}N*
z7-tb1#zXlQvuGzM*sT)HMmre0ffDp{6Irr4<X-=-v5a`tf3;j&cJK{qm?On29Z7T%
zaSsd=3Jf|xc-Jkdz(Df3&|vbVdkc$`SBu>!rG?QGe~gbj^9k6wCPJBx_@qXBJSVo#
zXG2UfH&Zvb_nXVKet}uEuxqG@Edn{4oFfQd<Din8;)l*y23Sh2B)aeMBN$lulTKbu
zWYz!yPS|U(Thr@cOS8!_(&?yZ{ox(1)lu=F<~Bl;qr}R!eOu8N%Wh}FmU=yI^&gzm
zGA^n@Q9)U#mv3-nPbzC^vdZ>t(%m6y95tW#7Zu}mP=W!-F>-QP2)_KA*&4CO>4@Yz
zr8aB6wi=ImV2dm{Nv@@y%vRJtRG+ZdT_;S$Stt-~+uU4KOW#(BTuso{&1<!>tqL4B
z8J;+}<&WKWdpI54mVBnbv2;X`JYk_nJ-v&^{eJwB`TJbc{nsELTCI#Pt<$Dlbt$pt
zXVX5ryI8-his4;zn5_NQ5(%zm?XG|6UU)p;&nz5pgRhOc{o`RpHD?8^w;4D!jxPBO
z*1+0s(H-qfS<`;!!&#@{@NO+3q~C$w<{G|<afz5c2h#TG7X)fdzaV#GruVzgE5@s^
zUM;(!Rws#8<+q!jUJD&A?*kR-(n?PlAqwf*MwvGupYBJwI4}2oO$?r02VJkVQja10
z^@Fz75%2oSDUfuK3+%f+FzR=9%P)_)*9e}Dt`CnwkbWEu7Nuu)VR53uvsMd}@*y6G
zQzo$FTL{=Segvl5hJ2QUy?f1KAKYP)uiMBy=zs`iT`=rjE_SGHW2HQI4$;#uVe4F<
zO+7EWxkrm2N9oM_^}w<a;dzv=b6ny_C7D`Qs}E-#SC@V(;{{O8Et9!Eq7fxd2^`=~
zsn$ghI*ot83RX$)NU^);EjwOys=pr@xuPA*%x%OwgK!1Mbov8qKsC$>(zlgXImkh5
z!$*UWmOk($&DLR~rE?=_%PHK%A{4VJY|vb>N0a7m41{;`%W_k8OgJEG%MT|RZ|
z+!nc5ewMVhV+ay`0fK|W&P-IAz@><YSg`QSwEuD=Sy>L6ePBz28h46TT;aFH=b8b5
ztLhZ#;D*@7FG62-D-2~?T8^m;<cSZreJ-7Z^48C>%rnA;34kH61i#t2xOkUQCW~W(
zyEYAzT*4MsErNms<yhPf@+>k`=En8&4i3DNLxcyTU`f6A9Hgvb%`5C4CCfm2F($zQ
z;5;_JG<txeW-k`vS6HtdZ%N?NgE9o7YP*A)Z&bU38uSnjo6&VPa(OkveEq0PU~uYb
zW`IR}XC<x(jL%j;U8JM^(kiBtjvd*9fwk*d44%^q@9LqD8pH5l8!@A98|y#J9CQ%(
z399<Z-iuGw5G%Z(R9%LE97HJ&e5k4d`R6XAyWk+IF`oz+u3;lCo&^gloTxF)egIxj
z87c|^tq;4L6g$_HB>>0-_BgSi_FgH0pLYJ}saFJSrYdrBBdr_(?c;U7fBTeJTJ~0R
za1_-L986kJ23F#peNQBX7u2crG8iX9npZPeivcG7PQcVK7!TVOG7yr&F0!&_Kj^NE
z6us2=Q!mI^PL#L3OxAa|W136Smu=pkiVW-gmg*9J<}6db^p8G^recyJF!7rb5K6g$
zys8OxFJa+GgtCi^#4loougZPNTMee2!OCjn`?RkSw@qFnzD5kjQdXe@3=Yu&=m5y%
zd4>P!k0m0dL~zonUmpRF3VoDmrfaGT6K-j0N#v<29#7-B&_dHG8HbQ1D1MZQC{suT
zf`CjLS>=aN)KKKYV#kSeq2f_E6v!YGOo&17Q#_ZM9ekG~LQLDQe2HTcg7we6l#vFM
zfQqyA&dx(1AkpJ|X3-JgtUEmzR(@%}E&76$6-;$-I75g)f%uSIh9ry?D@GG(6eCHI
zkf^S#Wf`85T5imagAx+hp)~)evY}{z_EznlJ3gVy9t&}v9+n8jKr}n^$u?c{>CHXc
zTI*v?>Qnyt($Iq&H3lMuLdBu(eAdA$UNzS`HMkI1sHTclNF@}x;R3?CzKD@&)A>Dr
zIx?yBv-EO7{+?Rr7fyClLJaxFO1v~bZ$4e1EbvoCNCKlv1i0n`E+n2Ecr#oB@$icB
zNnLv5g>o?$@3$@cyz(3l+X#jtqg&Lmv#l-nHjP<kopV0;(Y~Yn!hK^biwq8#Qf>3z
zO^IoC`kqQ#uJm*qHZSBv@6@g3<b6%ov7l>%W>|df?|c@@MJ34qoGxKt{b)rkr@o{S
z`8}mxiizL(DBcy9Z|hR)X)K;kEt;*Kt>5#y>LX$Knl8MOe>!P`soz;JYqqtSPD_7A
z6+^bGf{GRslG9;er$5wru<nJGTUlR>ybi#s`blcBdl$Rnf~AG?&0A|L19(O+>GrML
zug{R>V_d@N*T&d^HN}(8tS{g~l<=ybm0c5AZ#hJLIN3-(i5MMwO}*C~CpGZ5`3&(k
zs(Rcm!C&C`+?JfToY~wX>zqFAivKDDJ?2Hx`pJwACLR*Z+28lI6(I+hxNL!Sh{L`M
zjo&JDQs4h}?GYYkucN7m6Xnyz-jNN#7H&Wbl2r@bbpii;Ymx;Cbp{pMT^gWY)xzQ+
znrT<|XRsFa4p<4E?d&lB6c?tOZh*$<7c7+W)0hTivDF%}<r?M=UT;frIp{pxgt-t6
z^qV%sV|iVs*K!&gd4@lo8UbDrJS8@P_KZ6M9O$s$!E0_Iy%q59TpJXBWrlUp*DOM&
zNA=gPgvHW|B7tH?mBIS}&g%0f%%4voH@tOc{F%q2`&zMIAk#nA9~Zx5L;}P6g}c`h
z>xo#9!(?<ujIn?ion))rrkw{Vr=AeTBh;X4fOWSJN|1eRnWvS!Mi95j<t$VULtx)w
zn=+UpNW^jW-g*l-<kzJ@*9>o$?@qqaft+3m*=nAwmci^XApc76Z+1p?u`<uD5Jii4
z7Bf^P#O9;v14aWwgFtkl=&>NWjK4$1@t?R)er7In{!YX(4%fknWH>9t+2V?}13r(2
zsX!g}J{4nHx(1zOFCT4qUu)aYc2}G#QLJOirYIjAPzNErj41?`93G*Tg!7UIal)LP
zsgGzI!euln)EdC9MpmeSkn#smCUgqEX*O!=+lNeA91qLf>wMVd#s+I05D~?=^Vo=q
zWGkyN5{SJ>2I^`Egc8BweUBUAG4*Ua?UCPiv?~`LIfptO<QedJ#fWcIO<jG0W239w
znsCo3Utz)IM>u8Rb)0>u{PB5~A#XRI)IqmS>dq_so=jB_5+y-_m_uf~1@)OPPe07$
z(qv9IY$Kj>(d$OMY1RRJ#8Y(t{Q&<_UqF(}XYgt4FuRmOcRQOcOs9T9hNt_RB=gau
z2t_g<hVi^JYYkrjXS8_kf$x7IN+rb4a%nCKTuekwU6yPLsY4YL9U(fA5`&2~odfrG
z%M>O51RS1R{JCyykD>68#!vItjeI;m=sm=$;fVxaal;#Qi~KV<sT4&eC4-}?F@fG}
z$+sa%J|Tod`roVM%tFK=!-3Xyfh1~VqfeiWd14BMLLS<QjA&&+S3v&8X>kfstQV(<
z3NJDkeQ;oDwv1q=7Ybu4<gBUqjvnW?3s>ixT;Ms>;BzOG-vj^*{^j&LQLMAM&MbN2
z=Qe&e%wP13JWB9xG@Y+5FE1su%Sy_MSm2ge5}g0a7%FAaXhjB7D&=>SDRvw4xo0V0
z?`SPxDI&S%tYr13UELW4q9(AO4L_q45YpRC{gy*Qc=7{Yqog1pm63y;GpX@TN-!Ig
z1%1ejk>jn+LElZsI0Jzd<{EejLhZ>5lZL|?ymQI?X0a?)H8aVr<_XxSVPD}x#d9Z&
zhkxmUmeEtSg~vVK2Bouv!%y+4aoh8s>jx~AmzItsQ}+p^ZrLPl*_1W+`b#u~wN1Nx
zxI_9^JE<kOt<2u%*pV^_GR&&$*&$e2zPGfrdaN<zIJ@&79E>db`Zd?Ea^9GG*JtDC
zIXNX^jmdp$U%H>jZajOArCvLBYFpBG?050|JRPMH$i$nEw<Tp|g=wrkn3WVBqTCPb
z?><HcCk7>wzBq1Z;7m+Tqy%_JIR6F_8`vk$b5@4+ki7OnrYU_u>LI}sKAmgcPOupp
z4X-r|plr$lgGTD8(+jqeKX}0aEOh8P$uyudpYFp$pY_2(sA25G{|7AaryEv6lB=rR
z$jZhA^Cg4UQhH6vcKq@q7GEm0M<b4_hQ~76r;}g(@MiMtA~wxbCSX454KgLQ-I5HR
zn&}xCPv~0yufbAN5l0lN;#8hu)q-b7U1&eiS1*lxb}SW5ZCaRMg185!p(paV(bnJ7
zA5B`kmTrTD`rxPWwGhVid<G8bJE-;k3VI0<o&NDSId9%|TEibHoJPBz+Lp9RYOyr+
zF}ayePXuS=&5=&Q8HXjJ9MYs&a(8A?^cN+Vy!y`&#KZzHKO*(eM0|X#qrHHD7vU28
z$&E5j(5BK!_K#-6S+#SL^yH}?fbmj;NdKz0v{-Q^Ha7e=xaVNv_o!A4Xq5oss0Oa)
zshf==MBn2yOlaXcs~3&qzG>VC<Xt$q^`8BWWzcAbrXnRksCxcT2^;T492wd?@J(49
zt-B+xmI{L0lDd$N#p{B(6@zyg`_8_Aj;F7K9m1bJr!M;e1^(R_;_}zEOt6DtQ5#9#
zo0n+}bRzSMX2TloC<tD9BvtL;=pq?yD~yY5gKT~HQ6ZAer|04*bp9*d=`c^b>kt<9
zTThp+Nln)f@p+ez#l`P0-bei?vz(Oq#}1`5aAL%w8_@9e7Y*8MQwUv3OM7|Gf?Tg=
zOMB}^dB^JamYl-Ud?1H<Tt{<yT&=fDPFNg9a#Py0S5{MOd*g$n#Qm<Mdw&oc75oZP
zxO6HKjnMgSZ|V}a4F^^O!UMY*hty~{{1e~&qepoRw-*{_1QEu{#~?b!lX~zE<|wIp
zPSfvP-=aQbWS)U%uHcklo7&4Fjy)4{+GGfK#TXCGJ$#bWu1Ts8Obu9Qro7{}Ori*)
zW(rcjPY=dW0K8E=IE##bP3z(Pm!<_4-%f;R*J}d;18n$`ZtND*gIQ-^nMQ#1x9u|B
z<hR4$_N75i1#q=SWAK%d6pEq|!Ai6)iqL$o{%$u<<(+Uf&zO=JA*Wj>jkEwZYHNLS
zY!y*9!@my1Bn&K-36=z`lziJf)O_7+#a(*h_$xN8EU*&|uL0t+cmDKlJGMwF!X!qT
z2ItB6{q`G&HHEM3OZPNXr1O_bPgMjPLeu(+${GKWCPipRsJ+OfW>V6=nyeZ3+S?!B
z%ecsP<OMIpQ2BD&@c<|FfmIiwGPxD-n>WSpjW+T=^ai8gN}F!>#c|PmAn8B-YY(0N
ziForL$<pOZPC0sCCoc$lH8DW=o|T!Oru>HDsHzX~UU3=dz*I&m3!<^|{fC-Y!NQ_C
z>6niP6o4|;D)?*GQad)@z&7GnfkeWm7(6PSLYO?-*;iy049^)}CmIKR!lC5<3iD?>
zg@h@^`kc=ZX#{uYnogW3qt9GB%=Z&b#VMds{;e_<PEkje=*8~0JB|34T;9v`j(6=f
z%K<-r3<(+IUZ0`-p=ZHwWpLB|S_LSYaoiB83cGfegOhOJ&Qs6E#-@lAo*@4}d=e$5
zxtnKU#MmGs>uVaGRN!UEH%M8p>WwDcE>Gjr5SN4I<NqDn5r{={1*O0!G7Y=1v@|?r
zN4oM$k34~dYw>&-W&T3iYnEUid{A#-Do%poO9)iN=oIo}o|)i)+(R={@hb1PnTj_>
z(FoySr*1yG`z5PSGExpgbMF<*!TU$*>IVn3T|lT`2zo+>FV7`m7<z*W?FN+9=$;m@
z&MI|ZB2}Pz*id}jkPVB8nEw+6I+e_e#%A<Ien;~%z!q#oy?X0xPmBrm`B<?uPeN;_
z!Ch~tYyJTOuB&|dL>M5{-k#OGZagzH^P^0Yweux%?F~5D4^|8aJl>xl!}onEa+FO`
zF;YkYOXWjC?g#DsgdL!h3}kY67$}#8<1&Kyx)yc$=bwI$3>|&dIyin=Uvo$T%GNWY
zX7i7-y!$MR;Zqz>@_7R~{jo$m;a_?wWWXQ5j5#dIP+)DPtZ1U%hdDi*sYV^Svs%y1
zA~+7p{0{<!j3B4!x#v>$P{;(j-?IMd<1GGtH*@XpFSN5;fWSNuS#Uh;i&|#Unw+8r
zPcC#^q5Cc9KR?vSy|+~S%Eb%yjaVXxFfUBZkN|`R7A;_(`G7YEwGGB&lz`BMp4|)4
zbV%pEq^KzH&}A&SvHw3cLwJbF-_%$Pp~Q+q2j7`R9Q_v-$_p$<5OgMjOhEPG-Ud5f
zR*%N<|8&cJ8Io{dXO??sJAdX&0KpO&4E>w-Q;`B*bieZ$8$u2uWhN9ez&iQ_yr>48
zR9YESETa2I(f|fO5O4XBCW6+S#YK?cVf4fTm(JowJG1K0e!s>+93Axxq6FB!Cj)pI
z>7WD|CS`vCxkD4NxR<Lu<wjVB-7lmj8Hxk)!$mu7-RJF*4i~-rmb@$%r*Z0uju-Vr
z)dG=&21&RBVOi9GKSM$84!H#Y{;{^j!Imdxq9b12Rb#*Xvk=Qe{k&t;_>R|z_QfsC
zUE{2f&;9NK(NJ#n!+d;gKqfeAzO0aG^Ly^WH~n|n8^JxUgBW{HBm4gA=9V6TKQcD*
zR=liIr8YXDN!<C+l!z4+_40HZ>w{aA&+u%@)fUQ32J34LpcH{+9$@OX?0sLG2K`tz
z!~}?QrRIkFW8|u`V8mGrA37lm1~BwsAs#>%nVQZosgZI|*BC-8`yqOw9*mQ(*>(?A
ztEqOWf8uqt4xet2qL=_nbE;o!u0nH(j!S%7K7C!^5lDn}{q459z=CG7H}R<hUM;lZ
zV`vP-P6ZB0>&<lyK(v$U8JgW2i~TOlo7IL%NB<Wq78GkNH-`7Y7GaZt=Cp2WQQ2H5
z)=l#^N>hI0Ck92b#||tcc*RgW<<Rf`I$B?}LJfBWU!%Id7xna99R#Timk#~@{(EJb
z`UToWXaK2q@}at_lrAyvUE>7aIQ<tZEEnX^KyC|+B)ZciSn^xnujI5N8{fL{Ob>iJ
z6!Wd}6ik5cXKi#?U-S=NWTFvAq+#9qqU3s@(<7Ft?+@Nbpt05>yhf;gq0r-Nr6uDt
z(jzm1(8z5cQcuOWm(<22Q6x4?f3RCnLn)+Hy)G~}e5b|FZ)hzt`QZXF7w|ZAjm6IB
z>Z$bY-^R;d;~`sK2d~e|NoB)$(uNcx`4a1i|9wdfFs~*z{HO5m77a9E!leit4{i9b
z8KFDnf`FDckG@75-4VT817Bi3e4*JU{v#kj8=M$xI3jHycN^5xc<1G|>wMXGKX&oD
zLpN_i^{GiZx5-)LBvIPURU)9-S<NnF65<_e)L^pW^XU52?8GgS{lIh7I@;KzpfEU>
zdg#gG|G6{kb#ju47=^<oBiDb<0$_LjV#sX1()!~b@{XoY=@SLZV0R_a7b|_ddQKXA
z7CAi-7N|2@vF<viZ?nDtJ4V9c=iUj)@At#%!xge0b>=?WlO}JC%>{WyLwAfbrD$U6
z=WP#0R=-?$8nI0Mv_HfdqpnEhan8)tHWSMu8OfM2$^=+MRk3Ud7B;F0xYH=RRgla$
zF+<WHV+Y*)jo<D349-9eT;b6(2}yI5CnPD@cgQ&SZu{1Fz1jI|!7@sOwXc`P6BF_M
z$=k*{0iN<y#X^i0mzkQXF~I_>u$CsCi%9D0hRbSQ)O>LRkh2s!2f-f|X>Kt0-85!X
z@+;Z{@Z`}U)9~c(yDxJTfanTvnArR6ISdi*ZINzV6w281o(c6k-R19TxR_yVw+HVU
zwOcb*x}1Z<FmH!wsW2*ATUU}-CO;4K32DkkWyt=v4~?xlRt5+&h>OpMSXxDWrk#tw
zN-X*q1D(%NQjKMQ<Zs#~FBh+O>m`QW%B-<Y!A@e0bB@Gi>3@WEdsE=B+C{;E{qT0w
z<vsS8#|ig(#T@olE9vASrP<WrPWE^X`1X1%Z+WIukeldYYn8rEb$LI-BMBng#KXMN
zVCTEgIM`ITf;!{2d&n0^w#1!z8<;c2y>6Wz?AR@~&NCR9u0P7Qm!?~I-w5zJn{$E&
zB2Y5b!NJ<_qrHSVxr~hUuZP0A{<ss(O3EJj&tvkj-*@&a%Z@)%Aj)^%o_T&vTLgwn
zU<z4jakGn&ZvjWFwmBl{I_}LMUs+mRC(S{=I0;f;IaEH6RK*>R#fFE7<T4)9d8tT*
z$GI=PaU=euK6z6}J2HBma27tI7)X<Haon(*!Mz{S4O<{4`(w%?JS)WUWI!ix=FNTK
z^!k0zY$V5r^cWTwG4X=|Y)+32nC-4zY=`L?=vvHZ)akI8<la*LF?A>Z4-&~<CXY!Z
z_HdN37#u8hesx7;|1IfZeukHgGU-k1TbjNU3jeEVxc+bRaw=w2iqo%RyRr4B$gDf~
zJPc!gLtr3A8jAzCmaO-rYkbYU-0F9nWOHlbP8G26i>$pKH$;%#%&=|Wpx+bgK1a=A
z*URjk>pv+SAbQaKkslFO4v=>q`2usJbXeop-wPqzHeZL7e3-U}6^tUa@`Yv-HZBvH
zM#b;?Nk>z7-g&jf$0F2kyM2pvJ+v9jBm9bV&69^$IC4Vk|I4_{sRt$L!|Z;CJ^B?{
zKem`UhURJ)Kc?R<YMf%eHuqR=iIhnHK%AE8^+Llw*`tWdra-y2FjS7l=2(4*eP$6x
z38Y%~5#X=iwvn!NSei($YV*#`KAb;Ojr_4S=T6$~Usq=+Xo9<bwpN(>=A<yg_#7!$
zq6Vo=3)c_cTKNbM8@xk$FySM6{#A;K6))$N$8~;KTTRx7oS%<BOHKe|>mChrk_GbL
zRbcx_MG<Hefc<_zJAU6^;kOQlelh#iOZ1Kh8VAOm(5Y|QLY0!F+Zz_lV?%}hNBn*B
zK)a5m2A?NC5HZ~j5dO&5theh*IE-taNO0V|prCKsR3vKd$B|qgJGY-2Zz>u`-S>l*
zuVK?e*Hn3&BMZ*jUzTg>PLPq0vrex~J^Tjlcz6lX7fLWn>$u)7=G96{@Yp*isQ2qq
zUh^IJ6)Zw-PuZafe;FGJguYj14f-yVE8gB!{C48X+(b+F`U9(X*BrkOW2Nb}?pLap
z-_Lbm=Mvio)7MUy@NMYMsA|xLI8*X46RpIt|Jv6#lhA$>3zo;W5U2Jl!LaIIvU{9Z
z@XF1I7t9Ou?0WpZC|i(01*yW9x&6^xD7uwxAu%j)6C`&fEXiKzxG7MNVWAmOQH+~N
zkgAlug8x&x*g4SC=*LcNvQK~5_v2iFiJUVMg^-zh^5s`-stA%kPAWQH)3gO8UOy%$
zhPhMBFxDwIWcax*`F^JHoYfvFB{h5|%?t68pW6QDr7Y$9r)A#WdF4EwC!Kn%)lpi`
zG;HuET{ei0`#$z<)NHz5-O0`n=5ZUFVDq1PMhN6H>5^+@x*>1(%5ksj-nso#Su^P$
z+RlXj8#>}5Fh}(-oz4ws+|OabQ;+uVM!y}d&RXEHs#P>oSj_B|Vd#lyp6V#6=|Qd<
zHr<;K?VB3<Fh01^ro}Dgit}cqO?;)ft5+f!()@YeoSS;#Y3B%myR2t?jeHcu1fST@
zTFLT-^mZ)pBn#CU<wHhm>G{Pf?8q0RGUU4oe8k+d199>6&qdR^XLoKqq{}lddOt-c
zN2X)KtEhP*H!_tqxb>d}2V<Zc*kI*q`CSIN`NgN!iPqgVts_bS9v$xAQ75_vg5$p7
zJ}YuEJt?n_Q8tT@G1FMPd@D8;?+;dg))4h9q(4^mTy<S#U)|O*Rdp#9aG>@DS&@Fe
z9&7eYSSG_bENIg)6C8I4f1Ic?TiC=b{AI>0Kfl^+72?x(n0n;3x?;F`xnp|&Td=H7
zfhSi^2eTmXUcj2v)bFzQ$JNba$?@jXs_cEMTU{Ze4<zv%;%gP<vrCkEocdJT@l>H5
zw*2;xF!u^?ac&;-gh%BE$A0^PY(Fs(1IGyaapt3K`s2BuopR_sMU2<#Le5EM2EJ-e
zRwHXxFlud9>wW3S!P25G-u*YHw}V$Pi{I$~I6P)@&9}vS@|Ye1W(-5mAN<~osqJP(
zf9ai@m&{zsIcq)s5pxyok@Wl3+1;Dj#cRmCq2G?ydE%*X%Gkpn3e`-##oB3XMdkeK
zNc+2eySd+PPi9q~0&e|}ey2mK(kdNAo4)odY64Zgty+UYcVaENcQ?Wme3RT8S+z9g
zw1<>en0_^y2YXoeexueO6N04js?>vTZaOGSj(Jz+e;%ww)4wU^Th|ujCEGa_sBMr~
zS=x2T<%?5D<C5f;q=oA$3nmX*v?Ge?Ii+mXL4$h;ccWACC)IPfkft*4vbsj%KCkmt
z7=_sTRj*Gw^Fa2_+j8C(tuFpXkN6@JF(pThWB>k*mOP2;0qN5yq8Uoxao(-V#WU@f
z0o1PD!(VB|E^$xS=FWlxL5DwoH#LU!k+;#`+K8}=Ge`o}Jr%R&;l?;Ze&&8l`uIsF
z&K(hQkaSl!<KHjVxqG}C2CDe{p)I70Y^YJ_8%qJn<vBw!sQnscOzf;a%=?Nc9n-F1
zdR1CT<l&+_?F@1;TUqv|K%U_+wzrYTC^V6uH4upkUkf;lZvfMWynCJToRUvG`fB6G
z*7sKbez)8P2Z?oP#SS8U|CpI!uu3hzc2<CigM|BuQ3ae0oq^BVY60tLBi)mmD9A@0
zTO6~n2*M?_FOLYf`PSOk!&`laShu%)8RmQ*cTBE+#Fc)MClrB!gV{~<dc<)VU6^A~
z%GpXTWmEk=7a{uiBwCVqb2EX9w7?Zr)gqTR)yeUW*D~~IsGFRk6t{J}IL%Q4sKVR1
zCXJ23)z++ZRz3Tak$3(WrnVrMcu%QN6dLYmI@-YE5(kOGZG9*TO6+P{XC_Ll>Rz?q
zGk192x^>yW;(9lM5Qc)(rYaDW8>}y)v2s0tfA3n<clcDTi-Lg+AO6FJ*;Xac`Z&SD
zD<?detxPj-(EH?4X2!)lVfE^u<La0~DjtGnt7ZHAvWKpB#Mj-bihx6bYd)ZN9_Dh8
zCPSiAdVssJ>&uPg((3Khf`e3uqz2S}Xn(INN$Xpw>LR!m=hJ>`6>F_{8O%x<rzTi8
zn<20makIwjv==d@LQ?i^OeyS51ajlWpP2*ga1=48ag+5tIRg+C7HzI(3k8613+d`O
z8n|~v_Dp$|Q~PF1@=oDwA#>|e@4~A*yye7V;pEp+?xz2rJJ^OFb~)91&6Eq+ELciw
zs6h~o*#7w<znkTIuXO31nt7s)qmQ;$4$qZFXy2xOy*HGv)-P$bEodDp8}_ju-dT|I
z3)5a)N(WVdTFJQdnwF|{{#5gxN76HPt|9X>C@j=CsgA+v2(Y~MaX8Nn5e~seT<yn2
ztYz91a;5$$bPWj3sMA%X)dXfeKXb={Dr)u)`|~#6Inkc`p6I6f2%NYL`#k1*V~UvS
zrbn|QiUPH-3(%zz=nND!to$~2hg7Xjd)s(09D227d_wWx5mTlS5pT|H0Ld}d9<Ejk
zCZFcHt5k=uF#z)P??&-EVM>Q^1y=JlbL_S2qL6PV@z7M&`IX+(#^DM3Cvlzx@TGe#
z<J=2a3}iZ$A_u`k4-uN?<516q`&($4FCfL1{!$~I%{oIwa=($xe+PS-ON;png1>v0
z%@o{$r%<Y70$xAAY1WKDnF+x{EqwB;i+fv6ZfXB^GITS<UBsE1*i}IC@R@dFErD6=
z6`6j%d{L!Bi+M(4-))_R!D$gbwIx}ywt@W!WNwiw0#v{KHAoeK3?FkLv&}ic=Q&n1
z5mfkk_aS5mzqoqc-fXaitl8eL`Pold5cx7!3kHL@bGuMMR!#ox81C45)v8`rBg0up
z$2E!e4}|^?dY0$NK}Y^FVgdrbW#`070@K`QZQD1d9P)73P_0HDAbPG<a=DIPteezz
zS5%(C9(|0TW^M#`dQ2dr2H^zmyEkTf*F2Hi&XqP`9IKq>dL?<2#E4O-R+>9Uf-m8>
zs~pa9z5Sar=oqVuK1&FVvTQF=%9?qL<bU0BFmFo=<B>qmI*(@ClLxxLt?LV*r(NGs
zm~0fmWVo0^fJ-0RlWhrxPo?PlcBWZTYx|=~o?Z{@QWaP~_dMqqJhkej-@hohzQq?i
z?y_Us$m@c3E1G|@npr5iyNnw2b5A&Lo8Azr>?l=sL70LOe_kEr8}$NfJc2O!v4gw~
z;_)K#Ju<f(qP7lOXb?a2Zl;eA@I}l)zB*yDrPE2#5PmJfeO%f~Yw!#m4%bo4b?(&v
z;s~~XFw<>OuZf(P3<f204yov1nCVribDy%6Y3Dsj0Ey+X{kq=e3<-xchy&A{dl_b)
zz5l?|v&oZ`o|Ud<n2|D$;`;otpY30K)=8xW)Q+meqLSZ~KUi1#K=TnYXr3vkV|wRE
zeFmwY=39><PC{TcSM1MLTkU?}P-H%@i`)-QDoe6=69^?A_Q&^<)3TcdcSJYj7qg|I
z(PAdR!(NtpeVQ-O`z4fiFLI9)y!K;MF{}*KzIxjU<01K&qm6}|d7n)QSi6{D6_lKV
zMVP*MELJ&u-hAfLavAWx>uit)W+{-u!Fvdmkm!Jrw<*8l;&cSvhjljSpe&=ni}C$5
zR*%3F<CnkP(Y{|IN-Flw)<U`r?C&?Ag<b&Y#J=r5zxh2PqpEA`=@8VSd=}~HXqFE$
z1R=ze&ZF{|`}w>n?bOR>F@lYq*`FJ|Ag3ip$^%%eIe`&4zOUjIOI`=M+K%;6Bvd+J
zzgn?~(m{c*GueyKH>O0AFX167<{I(fu_Gw(U%>oGBd3h<mW?uxLGK(aqqW+H#~ADH
z&?I)p4A4fpc@C_p$)#rg(nI5Hv?=Z^muM8T#b(P>#ryQ-+naLG%_p44n}NJlmtiPP
zabT|+$4npZPoxE?jiF|?N0nifW8D!FHY?6O%gFGw&z1AsVA}kGT732~Gpx^a<;`v%
zV%Ppef~K^SpWgy462*W^t=csYzNh`~@rpxnn`AZ1_H=~=1@7k7D->?DOAZ!WwKX?N
zR;Tp!{#+1l@5MgMJ702(oY_8eHBw=`Myfj)N4%fx!%!YQ5^w+`$B2TnQrl64=L$bn
zsR4=UJJ(|8xJr;=(+JBtu-C1Zh^_-fp*cGoL_Oz5#+*v~{2G9PKT~ij)`{;j0lmL-
zMg?XabF)(eq1IX{C4fl`?RFfusx!+a;72dLka;^a;M}{UT!3QXHdz&!oMF8;V^2al
z7?r>6K_pX72`K34D2Z8!tBZr&>gM$xCPY;2urT}SCnZ{;q@*4M`Xk>Jk?;mwuXmHL
zG2z4dOTjmWc7{+OnpGF2yeXvQP-Q(3Lz^W|_;f8qWvHnoi(VTX-*lyLsCxaX*SmSQ
zYl^LN&GwP+v{{j6dTPl81y7?tU0&KiQQ1(wjd!ONLND0*Ek%B=-A>MId>-x0sA<-D
zXWXdcZFRGcrffUxt(-%WA#fULQS^D9)WkFwQ`g{Bn+muz*ST~~A_h1kK63eda?gh`
z8AE(D&A6@w+GbUP?uPH%qE2Zr43y&wJEk4`=}4B`|6cay52^rb9<D%b3<nX?$IWIo
z3|e{@s`EX=Gs4V}d-N2c{NrUleWni5I_``ix-&iC*VtO7V<tRNg{?TBfTpzysWs*Y
zzv+30&1iTr_mFdZ@Ie9yG;*GLa2OMuNA2g<l7)@W=Gdy`wGaD?bYlM)#EaI;S<+56
zks$UixZ}2tQ4M3~qh6*Fso$OK_WU^E1!~ZTjSExeh!S7ZY8+-?`yV_=jB~TE9JY;F
zv4gnMSrCz#H&<d9S-ckVJ@3UF*36#VD+%pjg#V=9s}<w#aL-9u-7bsrhy%z-$Rt2(
z7_sO+msoiHl!KeD)Wm+CCH%Il@3#T#{S$*Ol!$a_i1H%M-luGAGY!cW>(S$Lm$|$5
zxd2`0q)zu38_~YM?)gyvo?cML+V6Clz%sf!#H~zmnFv@g@fD<aD<Rlc{TtgvXn_n1
zguh-w0kE{RRDDZ!7bqOD+54%8&sTV~XH6j-MvR+Aq41Lq`QEJhb8B@ZKAB~ZIUr3?
z^I`8$ZKIG=4M?`+x8^%j97`5y|MRt(?;R$7;R9J5>BBJKK36a02cpKtJuG%$vvF|8
zDraGTS1%^}LZ6>&{^OV3w1CeA-cA|PQJwn8*w+k%xe_ORoA;6MOOh)@xTs;*k%!lZ
zQx-<6O1aUmhQ5{Do*fW^9h1Qn4{v)8yesEdHrQ)Tf`w0jL6V{!YlZ4mleuLGZ)aDF
z-u|v*+;!qQPR|%`J7lO!&e(UFRPJM!t#QouzUoRd59s?KF6YEQ%5@nHSdL)@b+)I#
z22@K9d9^Z)q+FK=zd0*Ml1ALV)LN<L58Tw<jNyt#z-OIwX-EwZ(8`$Gs&a5ILq8i<
zZef?nNRLGI(7e38Py}lGLnfTP+v019(U!|GGAS9o>%>$BYuZ3n6LgEX+a4Um7z)Z1
zT=<*7pd8eo%fVZd;EvLvY4gXAZ5#@t=<}<sZXw^XVfy@frsUNEc`-@IeZUb!d6(fy
zG$Nzf@tg5e6fk5|Yt3=|rK&aH3F)U<e)^eu1TY7fKDd3|9aJ$P8~inQgwzPeEMzZ)
zHytzE85y=ZR?u~nftP_%*O|JVMR;6a`Yob(XFR5?NAtr6T4qvgv#_EdEGGMD^eMwp
zb@(x<yJ*mjV%7UMjSP;#u)RROwof(rtM`BQuYA2!e{WKkXSV9wLOHHbYm6x0*tteK
zR{C+2Aoh(%yP5s3Ldj`T3cS4oq2Gmq;c(6<*4$+p+wdar*o3mw-Mite`h(PG99|aM
z=zHB{LeY|njMsby{>}<X-Ww~Wjj^XZ{QSi^OyT%z_x^OqraEg2M)9<WTogIEy}<re
z_nqXV$g;Skh9uA0Lcj30GaR@l6W0ly`k?;cupaUm4t8*P`jh7jVb49$H%2y*0Dq;q
z`8^pCzGNB-IJNMO1>NG~U&&L&Zjujf>I?RMVT;nyyvrC*6=qvEwiJlGHI&Vo<yGVF
z%bo5=s^o7HXt>P)h+H|;jMo$NpjwMR@ec7MeLml)O;9B%X3p*|VdH@6vktnIzj!OY
z>&r@_cMljS<qCQ<@<H!3NS4sk(^o82^Tt<&b;9iPkzG0l5!)qg)-Hdi>^;4s;a;I}
z4e;i=k|a5w%d>C$2#r!)q(B9ST-xK4lP0;<>o^{syjHFJ-6ra*()udr8bQH8md|u|
z&OIh5W>~94z-}&nwq6*@MTO@M@9pG?wwMzHa9K%)hLOS>1Ahyfa2R5*?`$BfQfcD2
zFG-ZdM8w#{tU0h)1m+sWDewwEKaC=a!02FtkTKGN@R<--I=CtLd`_UJtAu2T8Lhzz
z!w5q2Zw(Q3P)_LF!FTlAK41s1X0^Kk7}ICxT#ZJx8zz&o+`i)Pal>4)*eNx7Oiv2L
zu=MGlS`S1jYJv2CicmO2jg|A&5zEG$raf$8o*YJ7H8@0?99=9|NvfV>X(10mZ`0J4
z=asLPYh-7yU}1No?z(u8>vu-y(i=neI@p9(1=F|?ZJ0DNmB$b$P)CWE`NQY+6)B0?
zgGn;58&O!N@JMw^(*y>OXR#-rPnbUy?<XYh2Q0h-dIg-I@!^V*lOfoXn9}MWBYNxE
zlOWPjybmrzTzb=aD1|Le><tzR*qk~%Gy`<P2>wc{a?EbBH0WP?G!#hj^*WAUO|Y`V
zkz^%55hL<u+Z`ENYLe`1|K*D>rknQZK)h_K>X*^0rKCNFq^a+v?VksxpvPsRVsYw?
z(3;8jH0Z3lEz;YREDd0$MP!v}YZ8#J;NAHYfMANDUm2+4xn3ds^dDSl0ZR`Wo{C20
za+o(4e4E#<s%20$n9DXZCA`>LNjbliMOV<tm07<(TP7rOX#C_|%4T-;C@7NhksW%2
zroz%vh@1Xmsw>5CoG`d!K~O74Gs4`%NReDK0yq$dzu`uzUUYY{euItI4g&_i2Y&!F
zn>l3r<6vCMDRD4jVITw=JUpou&qRmA<a2NMfW5#+rK>5-qf9v>cY2N9*#{+(QExh7
z(8$+U>JitymJTf~N{z^<M3&7fJNJFApT4Gy*^{K<6XPQyh`@B*Zu?<4_@CwWq+%o5
zb_=Bu-OVd;h09lme{}8xwhQN&#M-`gmdR>@gHWbnB1IG>VId};$2E(3lT8L*;*bB5
zfUZ>Ax$EByqV7J4zvHE#z#_DYm0etIunRdL^zRDA6;w!L&!Ki_Dx?pm0Bm#%Noo5n
zXU>%rMUjGCLN!-Ablzf*(I-R}mSH3kz;%|wCt@1m$hR4{;#iyriEg1^#u3mIisnI=
zMl>Aq2-mlN?0${G2clnwLjXC<D=shFy~r1f2fmPo-yd2i{koQVVwT$68l50)32;M=
z60u%ZVM+;Y&Ni4K9SXUB>YLnzq$VH2Tp1eJNM+C6ChXm1&+jhF+BJ&G-THXzt*F+P
zAng&FqrIZ)jn{3W!a#lOLTQIHBo#Hv$1s<SrJh)xi&X_RRW*pJmeyi!cmR=3Wtv$P
zC1l~UcV%+>E?h$&9sW^gUm2L}i65{XEx2z(;%c64;bp4vAfB;VAP$UHyOyQ$E^2IS
z^%)3*71y~1t$~HAlgP2ArM)*2L8379z|P91p&N=s^a6~q@VNzQ=gRjvxV2&Wr}Fn`
zABKo_H`&0p-ua*2CsLk7eB%4`(Dk_V$_q}|%!D5qqq^)5Nj^7)U%lYnlup-fy?kjk
zt%nE|{I17X2Zz12{U;rtSiT)M>cTs0vq+u}j($6J=A}*Kuq;nZ6Va!5q(rn>QkSrC
zJ_IyGaSH7?r*r~1$7SnX9%ORu%~3?56eU-)B4aZPbLY}w-Om-f<<iC8Wa!PLlQN)O
z6OyXVgN!}Xjt2EF9U31dKhSPwZF79GI4X_>UBT~9@9&<R`1xC<ntgxommEk~CGsj0
z=`40P$}x<USJ3fOXFU0Ow5=Owa{}onv{X9kF9IKjV<_}}e5+-*A@8{%dMU5s&NQ6~
z%#JZmo&5S44_RuYvsc*2RrN9({1ifj5pLU0JV#;rJ{l&O@x$?BDM_LWL{&JpvtK7V
zk+AbGqi5h>TRCQYzm7dYbm%2-cw%&05_uOA5UDSf9&E@W2JqcR4QdYWn5xMh*A0-O
zs>)KR(?MDI1B9;%4KOL4V^j9TV;NsfjTKm3^ca1capx*{ACzpeAFi_c%$3O1vq(?A
z_27<_)`ARzL661C>>y}@pKP|;F99`@Xkncl;p}BVj%wmvL=M=}T}$N`m*bHv$PHng
zu8jLvXm_8o^-aY^zAD7IG|I2i?>0-*j#>W6VG>Z=q=xGtHp8DL!t;O}CzaT@aL+Xa
z-7fji^5~Eb>wYW39rLN!vN!F@t)P@wl(hVAY(j>6{O6>=|JOQOT98vhn4&2pLUB|+
z!gd+In9{Dr>yYC)rT&`!flp-N9$(!yr87%x5AR|+uIP6!uzVsiR1r&tgR|Hsc@b1h
zvI|xUqTaw7O(fkIi|`?#@yn#{L+d%2+GywfI_z??s@6mo8FV}VC&`U5%U(XSNj^O}
zaCZH4E8oY4b^LWL@ts$p$C-{8S{@*CcHf|i965*w*9*t^TL6=e8eBK(tS53<CE+%N
ze{`H4K!O?Em0Q_mRP7do={9KgEy@RdS3jg%cmDQsT~xPx8Zokp3Z?VvJquzPox8;3
z{jYg$Lo>*%?74N#Zm0>ru?Ip1(;V*|ucP=dc3f+Q?N5#+y4l*H1yZ}d26s0wAOsDP
zSg?X-RzC7Gh;;OExP?iuG;JBLE8~6#Q<>gA=KA5`@a%kI#zV&^!>b&wiFGIa<ISUf
z{&0$yt5RD!gy2A>O?PO_EE~%w+v(RB)BL{2>z}y~o+GOrl|lrKo+KR^5pbwM9Te-s
zbc$#&A)?tW+hGDsj7~CuK1CU=)XLS?`{H947B*N$pNG>;bv?CRby4`)9yLZtUUO2l
zZ(&#SF^^+bl1eBW+U)ev#FPe#r?f$nyp>kel2r($;ZjUsEPKoKfX+9VpqUIVr*x?%
z*W$6T3EE>Z=JyxQ&>KH55fK&M?NcY+RFjT9`PAks*`tm%F|+)^!?|V)uSsZUi>c`M
zW<LbKW<u}7rW^;l*Kof6je8w=J;~4#!rICPgk)2IU)AQGC<DQ(uiR+*)&8Vcc5m>5
z_(xw6*^)<|h3|TJHYMl+#3}A2o3I!t0}NfMw~h)Whl;+fs|flq%J?0SJvT`hC>qMP
z$Ykn5lzL!b&;T$07XX|Skzch*=4-tg%{{fXrWhN+>vQiV#yIrGDSs*^lJ-k(-nPK|
z1gU5oq^zB~A<PS16f^Aal+B&((`>KTsGyrk>TGsHYs<1~)^j?qxD;?FSPF{Xneh-3
z=jn>nEx)h+oSo5T*8tapjTp9X4x1LO$Gg3MmjVBl<%W#7ZriqgI(@$*gJYh0VxNh-
zpHZO|6#xHJbLQP_plujuEUkSo)wFh|jW(24>7WE-ohqd*u|#4iwM-&n8C%s_ieR)w
ziM^s!R8x!~ncCO1YOjhtwloy6MdVG-c|XGY&-)GT=iJXZ&-I+^cU>RxIvpN-eCl42
z^;HN}!R8G>y4~p5VZB0}`#{Oc3#)X;D5c&Vj9z>7$lk}6RDgFSi1IJKD3!mvh_1Z+
zZQLgB!MBWB{PF?z_+iQkrBx$d$zNYYHKUi2=xOnT&w&3Tn7~_DUX)96HYkPqG=g}<
zSL^*UGPnUBtX8d8kZ>NJhPTCG3zl0?{%$hI$ra?#b|yP}gB$;#ES0w4`H`I^&3H;4
z6oxb_MDd=9yu9!(eJAA9RK))IAj=V7dFD)V#dlX!nZ7)k0fNyl?HgYS+WlVP2J-Yl
zUSh3U-H^#JvpCg0Z)iHd^&7T$)_-_pzAtwJqS>v_qe3}0Y1@WZJpn0>kB(y;F|IBP
z4B;1TIs<I+-^zd-gRus!UJRdJ&*u##NQ?6Wd$4b4@!HPH;>##5cFiC}T9V4G+48Tr
zv{s22m<yVS4${Tr1`Ne3I;Puov1@R`l4aAC^O?X-b(FV9V3E?M^L7VT>eR40c#qI!
zt3B+rDHiLyf(5JQ(iczWT6VqDc`M~~Z;7Bk4CY_9anqo@HOk)7fv0(lwDvFZLs2<o
zWLyA21NhSd(jVa{%d>V>P>&MBlNcApCTlg^!Avi=;g%tvmI&XDm;}#QZ9>BOHA#s&
ztxp5CHTbM7s-ns$p-t*e@vJl}el1-@kC40fpq|iWbivcNa4m%o);{v;6O^lfrEcR4
z<{<Ub%LM7=17$s09!r4|*M~mIlS2-jHrXTuleCd3lQpBJnLl7M-Q#rbM<!?j_;XM3
zHLQtSQlmr|cC=udFP+Jn%~JGBU+?)N?trD?B>LB&*k<HeX=3<1F|=DDIXgc}LSKl_
z(CSLvat!j;{pTK~67Jgt?T}>pFa623p1*F`v=wMT<4^qkF0roqsI03G(Ge;Q!H<*T
zzSSBG$lK4(h^IM*F-T!FL}y1!{xjkHTh8ktX@)sKt{p1yh$tnPua-5H&`PK5Y9E%#
zIG+KOygalGZD=VA4?uhj@7gh3b5l$TPoQtLl0i8|en!gR^W|D^b#zUe+$*^|{Q(b&
z&Xokz)MN-PcHd7ak1#e68`MNLy)!t^cz-i(@vqnljgP}<ye#StX6Cc4>u0dJ<||i8
zVL|PPUP;042VMHaERd-B2I)Sedt%1Pn9?OUU<IPR`8}vH>{qJJZkzIMths0XW1|V=
zn#>iKua(-}b8zV1@tGrPcEC&S{E>4D@p2|(5l+2fSVUA4t!U*n*iK&_e~^6~UB{aM
z&asBo;uL<j?fkbc>4N}vy@PcVn-q8C9n79~0k~D?n(sx(*8@Etqj<@Er}>%?Um23V
zLuuGb?Z)!AdL#C2H2likBQkt*b#o$@*~TuFBpxaMH+c?!`>;=n`MbZ~EhSa|t?8dI
zv+`rqqJ359s--LQNsETJoy&B!MnK4&On^jG*iy&kSZhBv5KCGb*o}dr7A#a05aLPE
zuUp0PY<#_d?@wx$4xVm^HYoY+n_aUVL4O6wsJlF~?l>bDSuF51{0XkGTEf*Rpk6qT
z;^ougA=6Te9>~8v%%FmMgxe-&e2GRoE(7~1($pKY(FDzV_n-G=9v^g^b6UmzI>Q@@
z+`j~#aUPfC^ak$@Y*`v&CNlt5Mp`r55_-%p&?)S;&!0D#3zEpUvu1B=bp^>6rBvU^
z@`eCKmvl08)!&q8L5@<nMIo~8@JxP`n$dBdW&6C)wrW)Mq?c#iONQL{=pB7_`#hD?
zEoT`+o)l8y-)o11B?U-U)O+tr2qI-Kb=4-K-Q?U$Lp1MgfGQmHYDYr!vCWQn16?$f
z(O{RXnjO<YDdfoE=EGj))dRv{(QU^0CyD1|^{-{2HNpzg_3nyx1XIB+uhXc`E7w0c
zaB9A8*fdWVUB$gI0@W$he0n}NUhbzrE?61iwC2-#8nmjng!xAMcDXOwGXiu!l<!4m
z>xLJmP5JO3f7HBoP1Jk0$MT^6iDs(SZ+1cnT}}Es9UTVTyYkpV_M!|m_5O9$HS-Bm
z06ZIDAu5;`ayQ522@km1zQ<a&p;GTWOQlz0Q}ply^fH(vyUd*ToU}NA9A+DJhX`iM
ztJa}9S(}nTBCm*2Djx!4R<2`-eMBt9ZM^37@GpT;)%MgXX<TuaW^ok|WZ0Ql!7`B+
z;m@bde}Dv%^At*{N~YbfY&%V@G?i~&kh2hZge^q30%1K?dhwCUK-eGs`F3(3Lw(un
zL-+PW@rD-LsMglp_l3<YQUl0|=61t_4p}~iJ1~5t17!YTE_`jNqtV!EmspYYj<0i5
zE5(NkD42Bra**bj!>OvY)a;b(?)Rj>q8so%UPsxvZs^aZY{WB1HJ`gxjH-w3t47M9
zPru8}LjwO^3(SoPB=2O`j(Anrisx)jUb{-DZ=S-QDJP~Z2o!y{Qf{E%Thx#goK4hv
z2nmWRY3vstcifaB_`Ub=id)AR-+m?kx;T~%IHZ<$$@q4{=lrr>+z<`mFA-2cH;psZ
zN#&MN2C-3KG;E{!fYBPA5?75{+#;%=5pjP;n%E$x=~N&X8e;NKyHar#b<5B6_H9P!
z5g@eE{_+ZJ#rf$}*C=JYz%u-4Atf!iGwJc%op$4oYag4#VQ-A5X7<%_13fsWO!Yj)
zkO7-B_F6Mj&|vuX(og{~Gdl<(6mQDMmWuQ!OCiATa(1#gSag})`eE<B<DX6$o33SP
zE7u*YY7gF^nolQ`n*;JRWD&wWxG7JLP!Epdgt`7jtA1@8i)b8r5enA3L)vGhT*!?j
zj&j(^ngA%?BGe#e{on%=B)y`5K3bGV%bZ$2KEGl;AU48-GL#GZGSa>&ynhPDnN+Q{
zr-lr(Kh<(I$jo!m+jQJq-&xZWA>UinE1Qbp<NjN|j14yfVSCI!?kdEeSNpkC;KCqc
zi)-(eH@$%2FjWqrsi<>(h<=_qHC3X~;Bh29pr|!sgc(0!?|Y*ozMW?p4K&j-$6i%x
zey~2<rd>()t#%)j)E7}MUVXZ=1oKU{@?RAAa5QvwEbT&<1NUU_yxA8I5y+e5%K5Eg
zfSBb>;AkBf_nvdeC8^b<Traf4Ip?<h-`SH73oI5r&ZfoWTF5>MtD3A7$!J!L_yRd<
z4(GaV&~?tE#GkJv3c)-o9Al|YO~IfHU7K&(B;pv3_4!t&CX=K4e_Gh|zi66D<Vd*B
W+lJecJZ*lI(OH|@n&D01@&5rjb4nQi

literal 0
HcmV?d00001

diff --git a/slides.md b/slides.md
index 9fe6262..0d6c7b2 100644
--- a/slides.md
+++ b/slides.md
@@ -1,8 +1,7 @@
 ---
 theme: ./theme
-background: /intro.png
 # some information about your slides (markdown enabled)
-title: "Presentation Title"
+title: "Presentations list"
 info: false
 # apply unocss classes to the current slide
 class: text-center
@@ -14,11 +13,37 @@ transition: slide-left
 # enable MDC Syntax: https://sli.dev/features/mdc
 mdc: true
 
+layout: default
 ---
 
-## Presentation title
+# Piotr's Presentations list
 
+<Link to="welcome-day-1">Welcome to Qubes OS Summit 2024 Day 1</Link>
+<br>
+<br>
+<Link to="closing-day-1">Qubes OS Summit 2024 Day 1: Closing Notes</Link>
+<br>
+<br>
+<Link to="implementing-uefi">Implementing UEFI Secure Boot in Qubes OS</Link>
+<br>
+<br>
+<Link to="welcome-day-2">Welcome to Qubes OS Summit 2024 Day 2</Link>
+<br>
+<br>
+<Link to="closing-day-2">Qubes OS Summit 2024 Day 2: Closing Notes</Link>
+
+---
+src: ./pages/welcome-to-qubes-os-summit-2024-day-1.md
+---
+---
+src: ./pages/qubes-os-summit-2024-day-1-closing-notes.md
+---
+---
+src: ./pages/welcome-to-qubes-os-summit-2024-day-2.md
+---
+---
+src: ./pages/implementing-uefi-secure-boot-in-qubes-os.md
+---
 ---
-# Provide path to slides you want to present.
-src: ./pages/imported-slides.md
+src: ./pages/qubes-os-summit-2024-day-2-closing-notes.md
 ---
