From 7ebb85c48098c58c955c07720b92e6b75aa00065 Mon Sep 17 00:00:00 2001 From: Jorge Ramirez-Ortiz Date: Thu, 5 Sep 2024 12:28:19 +0200 Subject: [PATCH] rm: security: add UEFI provisioning section Signed-off-by: Jorge Ramirez-Ortiz --- .../security/secure-boot-uefi.rst | 13 ++++++++++++- .../uefi-lockdown-provisioning.png | Bin 0 -> 29245 bytes 2 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 source/reference-manual/security/secure-boot-uefi/uefi-lockdown-provisioning.png diff --git a/source/reference-manual/security/secure-boot-uefi.rst b/source/reference-manual/security/secure-boot-uefi.rst index 61e05e263..5948d49f9 100644 --- a/source/reference-manual/security/secure-boot-uefi.rst +++ b/source/reference-manual/security/secure-boot-uefi.rst @@ -132,6 +132,18 @@ The signing process in LmP is controlled by the following Yocto Project variable * ``UEFI_SIGN_ENABLE`` * If set to ``1`` the systemd-boot bootloader and Linux kernel binaries will be signed by with the DB key (``DB.key`` at ``UEFI_SIGN_KEYDIR``) + +UEFI Secure Boot Provisioning +----------------------------- + +LmP includes and distributes ``LockDown.efi``, an EFI application from the ``efitools`` suite. This application contains the necessary certificates to configure and activate Secure Boot. When executed, it validates and installs the certificates into non-volatile memory, enables Secure Boot, and restarts the system. + +LmP provides access to the application through a systemd-boot menu. Simply selecting it during boot initiates the provisioning process. After the reboot, the system will verify image signatures, and booting will be blocked if the signature verification fails. + +.. figure:: secure-boot-uefi/uefi-lockdown-provisioning.png + :alt: UEFI Secure Boot Provisioning + + Backup Current UEFI Secure Boot Certificates -------------------------------------------- @@ -159,7 +171,6 @@ Enrolling Custom UEFI Secure Boot Certificates ---------------------------------------------- It is possible to enroll custom UEFI Secure Boot Certificates using your firmware's built-in setup utility, ``KeyTool`` (from ``efitools``). -You could also create a custom ``LockDown`` efi program with the certificates embedded into it. By default, LmP installs the required certificates (via ``UEFI_SIGN_KEYDIR``) into the ESP image partition (under ``ESP/uefi_certs``). This can be used when enrolling via the firmware's built-in setup utility. diff --git a/source/reference-manual/security/secure-boot-uefi/uefi-lockdown-provisioning.png b/source/reference-manual/security/secure-boot-uefi/uefi-lockdown-provisioning.png new file mode 100644 index 0000000000000000000000000000000000000000..e1ec0151bd8ebc77550d608f9a47565bdb359a0e GIT binary patch literal 29245 zcmeFZ^;cV4*9J;yfwoXuyto&4cZx%h;_ebW#XVFgZbgCyS}eG`w^(s^cXx*XH$C6! z`Of=|aqs;H-ZAzM89T{bYt1$1n({n*hrCmkees;=IT8}m3wb#yH6)}b7Dz~sVxA%+ z?l7)@;6Os6K$4ewtKs=*4~mkABTL-n5u3Uc)Vus{E==8^XZhgfZP^NnUZHgvKFfh# z>WWceZNn`orbnxd{iTmP@3cj1zhQYwY}SLY@Z6i}>7?t3wY#WBNtCR?5B?NL$p7c! zeL|md>52Y-Z&SRA7Jb}~{boWO>B)aw;-8S(W1istvVMj1=s&IxI-hiq|MM2oqi4vk z0NC%oeSiCZq#&6+Gkf-*f{~ukJQZh_7ylTD`hTSa(+1Q2$5@D=qbZQeXda;u5&d5& z6c7r?f6N#$^xu=V{_mv!M>GG`^nX~$f6e1R-SfZZ@n7@!+amsZPX9-I`EPLf56}32 z3FDrDI%dcJnG2viVV6fn=0rqz25Xn6&;ONfEKxqOc-`|98IdWFjWmB%{CA*7d17+; z`2z;xtLHN$pFSZy{qX1VeENtmkn__AL^2Xo38KOI*Di@adNg%MLGc;!)hFJdZ-3`I ztyt`HNd}!k8T6sb^ETRwKRM(JJ>%Dga7GJhTAro^JpIKUhxOzM1tjJjv5eaPtWr2u z-0azh_E2qk1~0SZ_%#C4*jImKt6|%=k)`9V#wKa{)_vDh`iMnvHZmPDHT5&SK{~$q zR#V0OxQM_5vMx3I0;zVBebW@}3FcyXqqxBSM=Jj`YVb9d3qJb+)V zrjaXfVS&fPbMpr8`KDa@h)R)~4O|`AW0;|LDjGWh^SzypK)J@DrvgjA0LBZ7gJHw<8j8&4p5?J6d)8&+Nlz*ZrP_<>703xiBINv z)baZ8nSA9_Yyc9CR-=Nr&p(U%Tc>|7E|``e?A?ReWV8Yy52j`squVxkHl5DUe6C~9 zdv1ROS-h}7GcVLt&znosqSDMDutB}&=3NLQq`lBOomn&J5d86ZQLXhc5@Jh}{@F>+ zS>jLfuii)Lr~!-k>^JtNj9j$Sd@Z>oSo)Z+lrgv-bIc`9|?{^Wo8O+ii8x%_DmM zIG)T;R6cpdEZFE;`4wQt{zVt7u9Y{7F8|@>GqJl8)x5su#=h)vfqM9z=sg|Cz@pDr zZ=~C zB$y3$9prWE0c@mht?_J#R1F74zFi{b!+zBs;|dM0ZK~C!$YZPoWiOJ?Sik4XkzB~E zl)bT7)$m7VYm2q&@NKTHRU$KD&pUl7ipRpH@)YH_M}X_uGyjxGhg=a4-7)lprVTEWc^IB-X1^R0-87WYCU8unJ>%!^|c ztY`-9uZ-r({HZ_HV~j)2I*(OJ%t9<9RIH90&bDxiYWP3p`1qLKWf>_k;yqXFO;D{T zk!IxE=5d<8=EFR-QBF)PO`qhUoJH;cEVUo{DyTSXWcR5yT=6MuG2focEzU{l=Of>e zRn14h8XappL%ph)>1hcI<+NPxPjyhK&6Hnu%c>O(a2*BctP(mZF|w2mj-Y@%RR^P3 z2&c2bb;#2rZ!R?p{9<96-#%{t77$PTmw6YktK;dlN4*O@hS_hl?g7c@%Zf#1U^5S30`mVQ+bEv8xbHL|&A zF~$jX*xmD}#x)Zv7F**IkaI%rL{{&R=487TQHbn=^W~5N;nldenR;S|_2S++EbZPx z$e1>3@akYHznr2;av zu%B1Ht5@NK$zm=$tQJMQuUNU!9P1%xw?#o%|JKuGk@FEF7$sTrO&vfF?_JK}1Prqu zP-hxjsAFc1dC{l1)&i=kW3xXG$*8CNjE7TSWr)hkQwh4Zxg=$b4ZaiUhLh~8+x~o! z63D2J6rG&m1J}N!k}8?jz)%z5PO=LZTmJTlDNGxciM1&(h>P)k&pUO`wT@Cd7h=@p z2~9oPG%cV_W%~~^%fED6;8&ZkL?+gNFL%4{ShZ&~HNiWlpxJYHYk5fG4#D0hBKKnd zb9l#~)m+mgxFXKCP#P;xjcdCGKo#UvTD1K7(j~FfAC-Vs;`2qnk$G#n(BOjK{myup z&!&6-ZJDi>Sy%4JM6!?e2=0To)maT3Tioqt#6fmovGU<6$psj>Zz$&S?#{Q}^V`-~ zJj|d<-CCgo`_yszGF2)|y=orcefRQEZ8+6R4pOApG+_wdn&0&|oZ%_a&R$VLbAXZR zXsLo%I~n|BQ_Z?xmw&@gl2_j(cOSsyIdunKHfGUVw~)96GS9dyFPuh413d;0;HO=- zzJ$ZzFKA>hV%bM=19*Hr-!ISAxd1Qk`x+9?7#>a+DmL3oPWdD=vQC*VNBMQjmI&$_QrxCv|%^*z>8<6GFvd*xNdW-gDFAzz~~0>IF{_Y`lK=AJhWS>qTI7;k}iIo zUAjP@{7G9;240YVy`ZY6V^vJ$z?HJ=zE`tZ+AS9D!xKPFuJ}af$cp{H+RGMC}z*Lw$ zIFrY#-oEBsF2kp?5=+-Y{uYDpp}xwwt^)3aScVaUa;C4iXor7WFYW9I^I zyguKW%Y-3`ZelQ>TQenWA4RbDx!t*jjs86?&p2bg`ps?&{wCRGxXuWaELmGgwerD( zi+q~f7-C7S{DK9-3rNe*3_OTc8_Ceoo%rIpUV#l+8WC+4O>W)jJq!y}JBuP1TkoAH zxe;#Al}vf!Qjc(@4N+OG#&i$YKDodwxWc`&7Wa8?0F*?Pu}-G#mg?NDQgAFAb4pb9 zs$Kn`cq5$s(MLj%5@Nted)Joz;#x_5t`?XKvUMlnH6LFL0R-&APi>KOE3iN44lltMQCt;U$jh3q+>{ z4Py5a9Vp&I^m`?5uW$2w(a)zJ2J+;2P_C;68VV*y%(`>Kp8I*7PThp;hr%eoL^pSa zGkvWdv|1=~>{Cir&3Emel<$A}`aqdQcH(Wm3*1w&@!*}j4kf9)GBcquD@Yu!DEK~z zvc!?z%(7Oj37O%srb&sUyYw$2^1+)(<|Q?>`}ae`5bj5{=*S-|+a`E7cp-V55AWp^ zvUSOJ+T%xmN@6j6-&fBMci^49Br&e3LZ?vY->%<}5CSN}bYI!Tg?m!FyHoj*LUXRY zZ*gVQNTjTg>nuHA0hBek+3KYKKI_+L_r>Hb+C9V`h#@ zWTs@p_jpci?SR!n0uW!^hB^GMAo0_g&<~RsCP+BjL*d(rBGouSm6lB9H{$Z(Y_63# z*e9Ks{NOp{pKBl2XH{lSrMNpCy^4p)EIz8oGGO@#&UhJ^h%8xGOu@s67^-xT~N=I5b_rb!loW^=UBe zE%M2V%AexEXpWA?bAke5K^f)k<=s~Kh=p-o-rPl)1dndG?w<(RRILJn zS86D(1-1zm?0tkPFruz2GjVho0mD0$(kU3JWfx21OYh}bAyjVf*XV>9{DqmUvTo>ZgbT%*zE9 zJ>=!`I{`;0sxtZ7Ho2nNMGI+1_ks9^R;9C#AKT4*YQz36{SDjMN*>n`$X|@WQr4%I z0EB+ar@I+k!G5%_?>4|yfUSklDb8CTno^zeq7RVEN|l_R&oyFLYyxqA=}@2`_;b@Q zQ(f1SdMXtrEHp61?CzGv3++aCTd}ZHk$|c*!$7#H^htR8KDPPfnS68Tdob;AM z=y=7lOp?_2dP47&nPqU--hMJA!TvRmdBYfUV&s)#CAZlO-D(XKnC@+Nc=Ll~?ZIKWkoR|vYTc9lJ zb7{0!a?AF!a5C5?>TICLi}o8lg}_|eC|<|8;}aqV&yv)hEhGtc z`_6QxlPbdOYe!ao{owpOX#u6y*Z1#U3-8~UqC_a{8mBUdDVODkVUu&9=H6gjyopEY z$_Bx&=C|o;IF2VWJg44XkIO#+pdLdEKs3BmJeG^sXQojDdpg2S;tew$6*OGwJ<_-9 zhs|vhVHtipn(g8n{v-6nz;>SFdstVNyHAe89EHB0P^MxsFj^jgppQn9*MIz!WEpVLLRZ zPL_|29)MSik4$|M#i{TIhJEUDs4ILKX6>tz}b?)V)_&x&@x)rSh{OWl5xnnp35b>Q5Dr2+W130T11N z)mzC0x%~E~fa=5d-)QneXnEl!8*8{v+{n=Ez;0biE@wJ{bcR)pC+dG%H`*7dA@O-z z^U#nmx}KT|iGrk81#42|d)=V*QhnRZzNr)TGF(6N{i6q-5?w}>@6Bj?BKZ2Aenyi4 zF6@fawKhXgl3(ddvH2aS+EHjBbK}!%N;Ts->;T09L&DFSlWPe@V-V)0BZvK8rc81A zh*F29Wx!JLh84Dx#ST`2?Htuu7Ra{`D8p@X^7I|!SgFJI_1t?5ze*R=6h`Cd&PYDp zKl!3wXy%vS_@p6dysJeIyJQ1l%gVbtE3jyN{iMc;Pqo$jdY0X~!)AExKWK64D*(KX z$U5p4XL!3Irro#DNNp^pm$-m>_0P_+>YrkHbm_(?pXo!`D`<4f8qXyE7(>DZT1YI* z@@1Uzygl@;4xgFWsgnHqJY$bwhk>hFSdsaea){=m^8`@>!k!7*OE=?}=TJU?Q1le&ykz%Y@#b}vR23JgDDk-80IR>x)#Nu0eNq(THy@p zu)&y2@mWo?npNgoOGz$pA>?(ugex57)YP1bs-2!Mj8^L{*kNRAL?4K-Aa^BoaDccv ze9{iT4RU>^4Y;36`tYV8o8-w>aTJq0Z-QNDWS#A^F52Je)aSn0Z1{!yB9XsBLpqM5 zTh|w^LbE8@G#zJjCdiA$#kMSE8NYDwcc^&k7Haeo>T%huK=#^}p`Exgv+)CC%EZ_2eS@mdR!d9G8P0Q%PhTm~6~J%(H~@G3i#^yw`511% z`O>P#83(M6$q~eAnwAG=HPFrDT>l{aCHp6O(1Q6uShY_tRmos3R_hB}KzmR5O@VnR zcGT1k{BdMZ7-Q1Gb>~GL+}H0H1pRV=xvVe-9;&uIlES~6wY)k_xR@d=ehVQ1X2y@xYCl`fdd(m$nsxLTtX4!q4P#8(+~D z{OJ(Myb)Z`-RT}4F)wJL5lpx%YKJ^dzkTruUES$jM9kU&S^goM7?a0R+ozl^Gt z3i>%4+j}*HyRTnsfmJ-jEiGdh!$_#!Qw2IS;HLvajb=ZKB{E3g5yGU5p)EIiVYSY_ zBD}#GFJ{<0?o81=QX4OpyngLY{un$k7N~X`Xq^!dAWpkrQC$6 zXoj4|teUEr&Hn48#g=~Ra&n3F!<^ElL3tTT?b!29$o0U~z3uaRXH{&NIY??;5i=v_&KdR2{iI1Q;<*h_A_|kWXYggHS+<`ux4!q~ZW(!n%cvUI4PTx` zq@orxVL1a)4SZQ^a9uWlW~r}%c>5o*?#HtDDWE0ZrG$J?buDk~w=%BO)PX!MJ)Z$LR)TGGy-t2o{&o!dqn8|B2HQl_}1HX!Xi)7Ya;Pa)uhXm(-YYC18-HE?@V<*lT zp^$x{l*U_Xa{aBCnt;sPUQAvhhT*mT$|Co+#{wm!)|Xgpakj-;aWF?SY_mIV#yB%W zljuQ%&>6p2r)6|VtlGfayh3NVS}KXn!()(auHO4NbzA)^_u1yp_>_yZ%KM+Q{4A#C zQ~S^g)S5h9PLII2X507~Hn$D*uPWMe8Ezb#LaF+sLpm<%CtaixW^ka4GxV6bQ1j>zW8gw>#`*gS?8(~hkF&F1` zJgfHv8m#^sV_;i60ry;2C}tZ0zx{J926b$R560>F#YD*bPW(VDWp=vEYPz80#2ku( zmd%vc(v{b2v0rFaT#?#xUv?{_YCCpZ{DKPs6j{fw1&VS#w?u9|!!1rX zIC4q&_WVmZOl7%XBVV&8ye?GRZWz?l*?YJjfKAZDa@=F~XM6fBJ7k2Xc&fTCvz@a6 zIjXlbD(RcEs7=5|`q?VZdk z#E(N0CW3?hfzD_cAGKw^c$_@JtWED@62{}sO8KJZ4de|Dpu5@lVghQXhQrevER2c# z_qm?UKZDo&4##TCxvjzs$%R9 z^DqBG3+rZv-i!T#{XPI+4T;Q-R3uiS`w8mayE7ejc*=-ID_p*c{=2rVgIzB({KIgP z|0+H<+UAexpx)#;;L6}TZkxWg?TlM6VY^f)^73byHUk4h+c)Q#yV%oTh$cI3dIa|1 zKWjyBjO2*^fhOfMuc`3<5sdh7ERXd6`?oYo2z}$f0n_`_CngP_#gTD7=-dom3L^cB zjYTFw@$rSF6xv@fC?7@A|BiK(PKPv0`UE=>seQ!1dGgV3IPLH2=oRuadwOa?#5SKq zH$Uor@-a)IRm|mMOt!r-BJdomFg}wK{GSOlCLq~+ypl8dEq@G}8y4Q2u?p{IH=f`* zKK&NpqoejiU;=uy{)hF1w>E~1~%2uen0^0}px@3}#<-TG{zGS)9{ z5=#!#4MfTvZA*3pux%L)p*4$N*$kB32>cnc+;g(-%C+wn+v9K9gnjP>6hK3=K~41@ z?vokDdiXEpa_i&rXZjlS2G}u0#@PI^`NHw4jDewTb_c3c_*-Kepr;Bb%P2#*+K4I zSr)7CNlaus1B9EFZf?v)fLmC9oJL(DsocF!_~0{ce2ziX8#M;eNu*I5rUz&CM6R2C zr-R%%QDyoAUN2#pN_OSySTHJdeCsVAWFb+nm(Fz$COEg-T z4b(HtMJ}FKfaM7U_30mBziH-Gyusb`UyJ=Z)|d-?U?!Y}`HcofBzx?MdEIq*SWMGo zHi@+u3ERFzpx9^*^#niIWdbWd)B+)6UiEi(Gp+M|uUqEkMSxciGu#d%<-Ol*^o#we z$SXRdf^Ir0z^VkVokLSj&Hutl*8B?T?OKX84F;QL9UMLm%z<}(id6}XiyR=L0|RrP zgK0~@hi{1^nK3Nfq6KGr%7#BRpr8n*z1x?!+{1ee&CxjQSMmB`;mO@#Yp|h>97ek+ z7-r-oc3%!z9@f1jiCFGCPR#Tx_ljL#k~nVgWDKftZQz%UuuBs;i^b_tb5iGeLIR z=@juatYuQb?b6_jX-yaNLLr-repT-$kW%qDh8M6S@ zWDXCoDZaXC9=wJ9y5vCf4hE-fk1Z;-{3x0*HFNC0Ql6oV_0JpL{KcPpKfPm>G=H*M z{Cw{+3S#*}1?a!IYn;0ZH;k%Jc4BRj3D-^AN z?bmIUgfR|%dpO*EX$(HwaH&)-iNNqV-5UAsHhMeWn;=o!eIOAJeEQbGlcPkirClz* zTB_mMuFBlAXJHe>uEU7)GHp>nB(L68UKMvew$8VU1KqIC`F8BCSvQ~ly5nlXp@0wHl{$YycW$Zn<>0=q zV2RcKV=MiH>7&E^HLFC3l&6W#CTC}9q zCe!-~QVa#8A>w&lagIXH%ZsqXC;lt9-BE*}v?)%YT)dGhWP%A9gpY#eqAGvE+eIb+wGAb8Hy+L(X-PiF<-E5ustFsf;dEN6nuLE(|L_ z^MJ*n)APIs1=~2pcQdZtvj_6|c;iKv=30i)hGxJ+Uy60?M_ReQBp9ozv5nDAbdA?X z>yTQ6H`&g$s13xwfELd#yoT^J8&15jUhwOMpvgQ~yH~|s`;b!XzETtbX0Sz-d3fe1 zGUsuQ!_T8XH{mnm-1#o%=0`#*u6_AZeqk@LkFMF&TzvEb1;5i!9NU1zxJQGUdC^M( z2)mOhmmOV1BTTjNt9z(b88_9 z;(9&2)pHb(HK#Z6+RE4U-$jKc->)>;#oHtzNxhkk%@<6Ea)-k!B$_QEqQ&(A z@3ZI;8_T97urHU3mP`@>OuK6>39H8U9BlQD%}vPy>NWW=E0m%LN;)ZA`Nt$DrTDwo|ObjHnhYwlTnQxmUp7C2-_ z-023=s4_?@A18WXcUx4Cl`UmM1DBF-s8K=a6`&2btOG+<7=zk8{T3om6=B7^rYCOXDbVvVNOyP znQcXpm(F(J#F7*}R9xZH*tha((MF-j{xH^{C!;TuVe-1b-gu*tcZ@M0@TAvvP~}^ zn;nELmFJ6F)<6iYrsF8QVfFY)e@)9gB{~7Md!-6BUr5;(^>tF`%aadmb=gmN^Kx-X52uL$D0zfpd(n7PkAOj+*|VgZTUxeXat-&} z$@s_?qnD!B{!^!s!~hFdJ~~L5d>oeO> zuzHh0sOd|1z^RRiveyt-$b#&Zp{%n(Pzru+nSI}nG%8Y1cjSJ&?*Ke@Ev{sCx56PO z)$35*^XPa`X5v-jcf7;Q`7bideWyi-$9Y#mVo!0atIIOq;<_!XCJ21*l{(zVmyNFk zSBBfsb;Nj;m1||7ubXSGlX%7yYDd!5+_>I2`gC7KEnm;s@)pghHsg&0(;2za-_t>5 z9)vU`MssonPqnsEU^Oa(_9lE1=E{+K7fdixr>{5K$xczsfn#F2^Hf6{z%Dw_B`HWw zjIg>S=q~qrOz8&3slVYX!0|9XGv504-eGDX{R#$6lSk?NTZ)g*#F;yM_@Z-vv(OIt zYRZhCK=RjR$|IAmEAzka7k*JIYwxd4uxcL~0V$iegLnRhqvMeIU@rhtoY83b$H$N6b?+)9S5d5}o3{RX7>UY>@ zP{)n0pPrdqMpRYla|R1~jEg%|nO?-~Zv;DYn`-EPF$7Jx<`g%Cd^TT&kwR%YofzB@ zKza-Zu&wu+r{e-Rhe+`tL#?HJod(rEKh|aSP{nz?YpTq*vUdK#o@sAKb z)TD<$5Ru)fb{`+s*_(&aOk0*^1ytlw_0SvFOagaLoDXJN#&TVjF*5xdX@2cV_HN58 z8(>U$JagMRh%3j`w-Qg7xA6aJL!9I0d1)j>2g!|dsE%2;4qQUvacFoa`ZgJR6%>7~ zySgjwn(uZ{uCNXPp`!+%n=u&8d@AiT@Ue|vON1(Ui!3?(Zy-08Gbpq0Z4j0-bBOUW zfJDOh$>iSr>)z_Il{+bOsT-nIt z4U|3QbkHa#pb2>!jdl73`Nv1q6ulY@)f8 z5s4LJINOJG^Hx8_OX!Hf9`F_T#qe9(q6`BMgCG_QvxB}u$7!7{*Ua~#WT((ah8Kyh zL-YfrFKFw!+FI7%l;@5gy_b>hvYmm;q4+~_0Y8cOC67)hT*%Eyixz8QK_~jsNrREV zzCy`bcO@X#wforO^}c=(k@}e;Lg~7r=N7^JM<*rj%A`Nvgr@pXH{A8u$l|UW`wJwQ zdK@wRsxx`E=MqPpWol+m%0~apE&;SD7MxxkU5MiETFYT!%F@+TaGIwG7y6UAhhAEx z*P3-Ji0f>QeU}wl`3cD36W)DV+Ygv`kLd?2PewvlX})mmwGU;i=wdoOtvgigq{S)A z%PyT6I!iH!mo_$EcYPc`QE!*}MICckl1@TU6W|7b8aaUFcH zO`$$etW#pvOuJ4j9KJ<(?y3USQp~#GoMu^8Fqg5b#3#eQ?0s8rZAo3w?OfNR5(CH0 zQq5~rn5AxXT4s5vtjt#txaahtuxKoe6p}v1pZC?XrPIy}Akv(GEx-Vw*Stu(z3#}b zmo3oSc-4!Sp4yMU7|F@G_ABS=DCDhbva|YOY)C<(q!@oqu7-_Y&M1$uETpI`obv3V zxUNme-&oM6r}p+KU>d#u$M^-)6W8ygs;Lj?;HZ^tN-q+c(XO$>*Nd!qcK6v!BLy^t zv@NX09qRh*lX!2uRT3&$=@=PM<^FD@s5N>#31Na{T-I*f&-$5#WCZjBERt9HBU$V0 zC&B^ce78BJ=lbpCk*L;6o!Q5$J*Ynip*F*j$MGGPRbH{Bh{ga2+R?ag!sAbyMAt?B zTt<8@uUxpj<^Ws0u|ZHi!p6nJw)t+Kl_R?nh8ltiLIesClT*6zgZZRsmJ`7VW=Ph% z;!s+pPPKkCCH=C~tMvvI$pt@*TR4v}C!4#y-3y>P33{olyVeie2}_k0JF{F676tW_H01F+^RLHxq^u z23nk0#QOY>923j&lR!bqqHdUU$oq0%ho2}yU`!V zV%1G^!q)Y^V22}VgF6B|Nd@pWWn{u4)}yw{-3<1`nK{A{)$jfGxj%0|(Oj0?htEzr zw|#X~5IDMo~H-2$50IjGYYKR;R75C1~0NVmT&}JDtOp1!a2_5 z9*|d(un8t|1U=oE$!~cKRSZg=5@XO>LAG4yFTQTm&1Zl8l1k_rLfbsm;%tOaGoyJ# z2%YrGk1+=hV-TyIdg%m-Gy8}83yYA|baNHyxy2hEUD;ehvBF@><@|G(xp(Q^!;X0M ziUuxw_jKTh??WnF^_K~gn8nEg)jzS4KiikBDTsBm?63QS1Ed6-hweuQZ;ni8O^cEm zyh+6nt&xcYp|EI6w*(pd$f6GhN{$)x>8*jB8IS)`@xBo~1QkH8VD~v@V9a8jYk-OD zffFn^*YXV~<;7NI{5_w0_-Gy50P58Z;dc8~g ztoL_lnk+*yxGiCcRuKD01?={idB-=hHsR+kFhmC_XTWy_^Q&cedT}A)c$xb)e0l_? zynI-oI*e;+gc+M<1qn!!Buw?Pb?%wmKS%UTD}D2x@0FfcedTGMomMi#oSK#~^-3Gn zPIeys^@($%H_+;*gkH+fhIw^TE);XOQR!6@$Pf!)fSati-k@aUbJiIawamd`yeQh_ zWPg`+py_g@o{Ga+PX5Ll#8;7mkz^C|d}Gp+MHl7uEvwjWbm+~CU9_)uO5*oD{XS99 zn&Yj0KGluP(Zobqrj%Ll&B`b7qaUSy&C7#&Hx(N3#8T(6r({&fpKz0XG&X=I}Ml>Q2HR*FTr3<+0H~)@+ihTgRILp0UPb5^9)vYkLAgHal?_zTY^pX zxPYpj(%uAwgERLYDPx{tdU*b6syo;5x$u1049VUT!!B{M?;CEOwvXb@rf0P5jj)i4 zjgV%(#wYduq~AXnkWOqklRmOWy{TUwesK@4x1mkjX4DwI`>iBAfX2xiyO7QI8>bW1 zk21IgZe<`?;@Q^qk+0wMB{=M7IqB_D&AJhU&_H~5+588m)fD5_*oBVyCE5+Ku>qm{ zr##|_g1$*qNSp9W)4EeI&FSO;4j_(kQN;p)g5y_Na;`@Y_^HmV^R{}M(3mZ6GnKP6 z!0oul(2QaI63|V>-nN>gIY-UdL5Q^x33WeO3cO)f{NHMPx>P&%XvJ`H;Wo-^gKv;{m^x+QkVNg$pLHq6g|7Obt7yM;X*#}2_ z{u9fwx)&`cu7U3QA>t;aVcBtb{?tGO#utUjUeu_LQoSevDI}EOt%|P>vPcM+jR5@i zx8i+#XR5Cpu0WtX+w48hhUoK$ljHtgw3Pa3av%E11XgJA9q)Z=VX2{Eg+j1OddzA` zibzmGwUMEO>H$7LX)+ckeMQi7bkLRj)Y4D=He!jPCB-YjxU4&%*wNylsm^gI$tx}M~ay&1Y?|%4dQU>jvPK$-n6kZ?aw6KoL^Hrlz5?W0z2QFPZCcnTZgUS*7 zG49aI>H{w`d3Em*hZVX0BWt6GI4W_`x|zFkVVMGIz*sgAvUPS&AhLFGPqcWjXIpjo zabU_5W%{QD+;yu9`GCaMt-)!#QYRzVVzJ-1Rrfl4`MML+%iblvaqVc;6ztKg`RTE!{_Icps1L@=kAjrARD!%`i|gN4=$tr|##jUI?rhdO@)b3lm?I<4 zUjqH;sy$)}w#(LSrrK^TNYX;w8^wYvz}@tZU*z)JE<=0GLeyH5qBQ^V z4s@hAgW4f_Ic`?MU|i_;byQBbb}57VCdihBm7r!fCEB%acd&nuLN(Q{ZykP#o7`ws zg;|Kgw245HylHbPnW5I0ifuVcf0HskK9MoVdfQnfUM_A-R+LAPNxQA4#-q}0m^T#; z{;amXI+N}n)Nh(Yg zKT^@Ey;MFx5}&woH{@!Nw2KeG%Z)~#+{wC~`6Ph%sfJwFTyX%H+6y5=R^1Y#TxFcZz>D0hrxHy6SE zx{M*|eg$E5JiwDT&H+(lSB;E5xBZlJ*A;;TcKR0hgI+^6w*5`8b+9ruYdDkLZ5wS1 zMI2#5D8D)`w0fdY--0S~*uS>Y(I6^^hcS*-H%ARRaR)oBHFsu)pTkSmvlEVcd64M^ zC5JN5NE9IG_iuddIl8{s%;8HU?Sa_}_x(MuY*%y-|+#-<9(HNRCYc)6oz$Rg~`P zrh1#hToS-?5U(vx`BZ6r#?9U+!e2;b z+W|^LOq|ob)1$=7kB?8p6x=?;lzI&SNLi z{8C&?R;*vo_qO=cr{-_KO&sfKHsr`tXiY>>z%=Sa;Rhej7P4^h-WV>Y^;#eH7p(3u zI?GCD|EksKOrnv;nKHS_^Jo{wUR_z>;9$Fm%C|DN)ODs>eEN-kv9XB2@CDcHcWl{y zDUoZR_jTN6RSFqyr+wJ*jXQ@P0!-Zpmb+^S1FyIrBBio9!Oh%U^kJa`Q>Mf%lBuR< zKNp%rh2?Hi7d15B7;h8-8(!Y#Gi6*$F3;_-~&bV1l9|3MfII`Hwv!s0l3oH z^uxei^AMt+ELJ{#uJ$}IgPuCG#2bwpC^JiCi9B|?92A)K+#bHkQ;spti)4<`Q2s4` z-k?Gs{mbl@Y;xLt=T!`57r|bJ#=G=byj#;=b53>h6ypOCbBv}l;Hg0wOv>msel)U= zP}?$BbmQGqLY;B|k2&1gMYARYQ}!S(fTxSi&L&rX<`V--p1wUr#Y1Ne6ES~Z9&Htw z6UyHZzgpuZMjAb&_D4}=wve)(|DM)+oyrC4;A{BKK)2H9gEnPmat8N0EVcr_3Kq0h zMHU6P*q=JJNCKaoGsH{xsufb)#$R1?0}a^&ms)0~ipeYL2fqNMJF^kpkpvA*@!=dv zE0C!B-E`3Vq8|vkCl|x(pY3waieve{1ejqt!`h!Nk*%aunI#-ET^ReGT>!#=$VDpD zdt0=HgU?Uo2QBLS2C+S|)He=q`WHR+JG$76+o-8BGt4Umn-)yM%LHB|WX2uL7LW3! zH$Q9uDviib*Zc3dgf=h>Q)Vm8jY(f~dmZk3e4W`Uos23e+S#(UBZlT%7nBuX8v5N( z3d@v4-JdLygzU83^Z?U-voT$HpLV zMT5Lptvszc{3~F#ZGB|n6ArM>Z2RzFxn^OSQ_|lx4(;F;QMAI}#E#N8-+G2O*`0os zw1{P9oM&k7ro6v1euDtF&iI^AEj;ULi);FrRMSjrB}_bV9u4NYJghfkdLf=n{)-#J zfSgBMOmV*u{=12JzWK&YO!O9nHH1s-m$XM4R>xhR$aM-P`_z?E_RWY7!fDk`miH)4)!!81C`Fg6z8CuD{@P8x~PA!5!i7rM%1Z_~|K8$l06U zgpx@B#gD%UE3G(kTBbcpD;8(FA#YI{txu5F3!;$_WtD_;YXHYt>&uufMTT$+tj|8N zc#(~sPY}hOl>K4wpV#=rVaaJaOc*M&5=y>2@868cM6*1ma>afl4lCxkB@;MeNAMer z=rTlpHp);ng&?)7VIS;AbN{Wi;4twX1@&Sl<;e)sE>wb#u%O!aUJsY9^*3Q;Sb1lr z#wETBe2ZI3TKp#~SO`F{v1L{Y^M80$jmaO3hbg-xBA9!njG$@)@!CMVq_D6Lg4!^L zlG=*p^TCPAUn_-^ceQEBam|TGx}t?&q>b!oOdzw7L-t`nS{=>_<`TC12%0RETGR;{=hi zQ2zD8gI115pz@zz38H?JJ!%D3i2o(^W0q7ab)Oy0ND5+?X|pkrZ2mo=_lm9mn1Fy| zlJn*PR4`MmJHE)P~KT98do24Lbh+w*tYRf0F?IvH*j%!dE zQoMS2!cEvyNnG{*wwqXG5ga)}7>;VFC^glv)a6l}sx!k-!?1f3ao8Vp)D&JVH+>R68Ii%fX_9L5`coPGp&s!1I5WBT()?I@LVULMjvOMr-<}GN_Ur(?JzXLNXpP4-QA5KF~ED_{oFS^Yq{3)O}e$F6gq$8nys zE#?%(fMhIWBcG1a%Bj4iu%^ff$ewz9p6GTXPpFU)U-wm&yGB?L5ownU!l~a#-U4)5 z!R+aoEP|6vUbj=Y3somi<+N@^$1U<;=6A-k5!b%!8FrasRNr%5wQ&t{t+2V3%@Js|Odsir> zjOOCeyTw`Lh~fol0S$emXjT&4-9zn z9}$ZsBpER|2-?jOUH5rI4CQ)qXzZ8>FZOR(vZkN!XNA}U5l}4Dw;+uP1S69dfiK6i zFg~~ z{b|K&laE(oH8GY&+3dbKgQzIl&9Eh&PJtlP#kfVwKfV1T$!t_=-|KRr4iS&T2hs(n zk)+d2*~q*Afos;yu}X7WRNvSKop*I*m}%BCqg>lpG`UMueAw+3kxlq<8Q=5GyKtoZ z`6~dKf5W!751aJIQ!UHLojaqmT~a+H>FrPRmuIejv%&R~TD(5A;TqDu9^a3aPP(MI z)>J^*-rl4A#Rbji>tUv6d6v6g_iJZu-+72uVoI9_VjyVR1IT;8aje3JcL=}~Gi zk?s1*NtKDHK~$t|o)2BTe*gGKcEM(Yx^D%O*&!pVLnyIXlyzP8Age0{+M{EzvL>;% z+*{hGs=~{rqnm40E;A&LsinDqS%drF`m>ilw!+y|7$XQOC|_&2QuEG}pF4i{#N4+9H8cCAeXHD@7CS2zkCtWw9gQ-C)d;MJ-+rSx+qFo%+6Esd zu6V;zc+;7-tonBN8;2`Jx@XLVw^y!SLc=(QliA6}>XLcuAV zLB*mEDF})Pgg|xzlufetmy`9OMxS|U@@t=njq_()Udf^%%~xdBpY>(+c~Vb!c0`ce z;}{I5Sqg&5b(ue~MK(~bTA`K#Z=6!%TzKTx8=G!NacZpbY+5DpKCFD?_fLAP45KI> zpOC`_bW5Tez{Jkx4HffOjt(8!q+KkY0$Pf#-ngCp=?TZN!!WKDyYVkz2mfE{gsqoM zbF-luo_8YeMX=q!?>Z@`aM&S+`PNcDlAt9dK6O`B0(M?#;FI)AXuukvM;dUIDRBPI zWI$-6Du;T;i{eHx`O%*}GqX!AZ)g~evr@3E6S>}r z+(=0XA-iska+2!9dtUVz8XzkH^Fx)6cO!2hbITcsiw(XUdZ=~YWA4hWHH|9VDhz%g0^-V3qKaK_AFGd zWVnsX;C@$zjcXD%^@Oc0MW-MYE)Ye-udBgniJ_TSG!p$&0j)*-EyX0Rp@~$~!Gj#N z4D;k#2rKSRbVXtTdC*$Tie>OjSS~hfrfHo&;`#OA&(z()#y^qTa1+F{trbXXTaxlL zc{~pVqW5DW*m!tYH5Z2TNS1dQtxR!`%-))5(Y~ZlUiS@1(}Eq~`y@RZ5NXA?BH+~i z=G%zcvwV?{91re&YxX)-7#;JQ%zunL!%A1O%7elaOng7aDQDp_*OmG=>CG<$*4%;!d3Oi)H(#HkmK9N3ti_* zy@sCgdvtLww~xL*;3yn?&yt80TXB0b)jJvwll}qAzYyvDK=r~y=sE+I_4u*_m5s`# zHusji-wF4_JVlzq)F%=|@(R^(KmSx~rp7KXw0$BhT#w(b1XJQ@OBw*NXEc4H4=6&K zzwj#lm!P4cBH}}evhxUeTj903+vC>e7^T__%j(JSP>+mCo?>A!B9cxU3JV`DzqYX@ z1;RZT(+eGyXUPF5@v*F}qk1LwDqZbwa@qU+x_e>fHPL}a(DzL7%x(Pdls3q$0EL4E zBQ?g8@h)0h0QboET}0Et0K-tIvYJDS46S9p*{R$ihVe?GHwDKnxur-ipRCgT@rcaj z;klB<>cyg7Q*B7<75Tl;>hc%v$7#w1?6h{X)Hu`zx(uOXl0XQCh(dqh$0-^1E=zQe z2BBxa`(8jG7A(Xxw-&EC!by;$9!o~iB#Jk^{6Han&hEL}0nM~D4mn&WOjRa;I}ifs zsY7ly86BdYWDy1lDD@fK*2P*3T{OI*WVTchM^R+R4M-mI>bn=Mg*SOIAaDN!zA~N zq3|{{Ofd=?dKLIK-ma(>`1k`jY;<5IUQg$%(_YN+SdT-78>2H4+27TQk@?R)4WFW8W6 zuj*RFtOPnQAYSUkYXJU1uXwHPCXQDg6-h3vE$=AxVj99Cf08^*wGh<%(H@+oK-Z=f zk()-Ckay2srE&E!cd3GE$(SFeNyzG&hIao5tLnb*M>;DmAci%Fr(-THwm2GKZfUot z+s0#vAq;4e^iSiTW#6QfQg;SNpu$w{N0Q<<_!Pu8^mkIPz0<2TxTvOB3fx}ijEbm-{xUlT(b2|WH2q+{Q)|Rp%Zl#jWiRT z>)Su2qS^S$E+dU!3Z$l_U5rZELD+G7{V+u`=Vr|8QOpEMj`}28BX9|1+O&A1n^sqI zy&M4tC-qtk4^*wO404wwy;)>|1i5Z>h|T7&396`T`_QhdX6Jr;kcuO^76f&z3|)=6bVPdj^De`YpMOqiADrT0(MqFZ)a_-3SdgaT{%tR^o*_J7jPF1KQV1-}FL`303p%gF-E5mYb zxej{_oH%VM((U+pw?(RR3S<80SGlRIJ!Tfr+4W5}dGc-+FJN4QzBoEXDPnUDZT*@y zsEOeYG7^4w+4i5u?0dgpDAW2C5x>MTr? z3`aiSmiVr=A`IVO`~H_JO`WLM^^l-|uBGeJzT@)i-mpT&$XQIcdh@~cMYHBZ-o;V| z{?Dg#PGB|wBDm9B+HR;aZWE(I3SmO<+vtcJ>>I8Pi1i5mPgI;1~alq=wd_ID*>(dm3Baa30F!vHh{r2|1l6| zO9rJ;!?Rjs4uoZs#=%lNvbR;BTz;5m{7wk!Lx$V!>fiVu%!}}U_Vq)D%W9zyTFL>{ z>yXV>C;I7pB!3#EA5TzM5Kb2GmW{Z0o$~Md!=8$a2OaygO8{Zl_6EKt>o z4|kd$s+PH2Ju^&af_;}&JM0({0EN0Ec=LyGM`zA;j&$wDY=`T@vM!YioLKG7nw4-P zwYRWtojV#ZZl^6o+{;8)IzsPF=QX$53Kx8uS95z0G6Q^^h zEq5nKFuG#kHXM>L3Qi6Hyv$goaTLRHFY~H3DglV;8|$e5}3SC^$*hd=@4FjaQM9y-h>a+gWFTL zNUp9jAwh^2rVN*ED6VKYWYIA%@f-KzUwtE-M8#qj38XoERwXxP%&|$??lCr`W*M0N zE{u_e&5U&T`=$>4`2{>M7H-;ud=Cjwo?SskML`a(I$FWjDW-VBzl?=}QZ#Erc3U`R z)84cXId3OGD{qCYYPavUUXx%)HmbAT84%NobZtU&#pju>bA%}N!zsM@o(|;aYphC9 z&Z;w@oHOBE4G8N9sa&BU~|9-N|@0|%Jl7_GUMgN)s=HDx&e zHfIdXG^Vrn!wUMY3Bz}gdbe#;Ht`J{H*uj95>%LmG?{TeXPwIPf(0k*Qf~(|OJiq3 z0!rq`YJ}H^@{n4zhsX9-O@@t{nXmn#YHM?tg*JrcoB<-cb3vAl3mE_j=q90t`|4$< zRtXlTEVjx+D;_jF(V24P^Ar$H^Iq-85d0k54{)Wd&W~A5E+#|PbBEq)jDlLYvCfAJ z7^RXbVSJg7MzdyDgkM4mM1OLbVYqzF0Ll&(Y60YUqvUH7rdqOgZ4yccmi`Bfmi1Is zED(6p9*VZ!uG-w-PyQe*rwAXd(YR50f`Fy){G7@_06PC1zAB!=3Lx8POn*@~d3hES z(^8Y3(AXUfHLq6=H4<@vwuln#q4IzyQ zM{5_eR!Lm}_qo8y@3X25n(7>gyZ5bv-;&1N)N|b?yahyMj1JYPU9+EDye1Jyy@3h% zJw4fNg?(A(MK?UInQou}$!Ol077Nv8%-!5>Kbm1?}&J?jx} zAR=$jeWJDMX5DpzyS{4X=tUk2+4WLqf+FF*>=%GJbd$4k{BywQ4m9M&lL&6Lt(K6x-N$<;1+ zh8IeEcEwbFTl7LHfKd@C*=13!w-qG6b${~Y`1wG)x$@s67!hZ@JE-dRbW~hU1!-}D z!_dOt-#@J8{engL>d*m*1Gh~BS>~3lHOk!gS%p6j{p7I@ z=EqbRUsns$r(~oF$T~i5sTOW|`GLxQzpJyTn0mlN<9J}aOEEW5crhY%Y4!BB`P#QPd+~PFUk|qmBC7|BZ1F0N%z}@Kn9K9F5T4{-y{|>@H?D) zaBmwaCz4QMH(i4&jW64uGV*TM@09lS1#&|;Zbk>s@(hzlWayvjtnGHi3fLET8#F^S z+!mHlA))T6qO3pmdoMwKac4>I-6#y`bXxpx9?!hf7wzS~)8tDIxZ=X^IFtCP0}=Az z{|Eb)TNUh|8o9%{`9XMpU$uEqRsVzwS+BscX+)lT9NhLuD8R8>obMRf8l}LIKIF|h zTB?(2E9!aD7G+)~I@c0+Xy(#N1>-NpsG=X$P0&w9>LUBJ3So>yVFRg%F&OzRR;&jB9*T;TME!e zoAbkHF%K+ucKlxAvD?X70Y4fIu$uFU)rTsdPsCQgX?kv(Y)%Q|s8{&BLf~ISI(?kB zCC0go2ci{!ec=tm8~^2ENC6`)BKSty&%X;V;#_WLuuIn}Gm8O%p!0&qe00F0Kq($b z032PWtFC5S(65{N*5o-RikNg;979=lqB9i4Y4P5tzwTyz=J@Y` z5+q6J;9R~EO3{3Lj;=_>@kL!sH`a47x^3 zLwT<0F1Wu#!KBpFTJa2Jap-RW)r45yIM?*b-=a`BT+Mg)4CN%qZvo8%Kkz%(be-R# zFlen8M|_6zpJ{bEj(?`r>1z2itxmUxKfBfG*8OL7f02=KmZB`4GFG*fHC4<~bhdC9U17jUniNm6g4M j-$P*Q?wp@IZ@+qh?dNh~EVd#SfS;_CqGbLf{kQ)Etp|i> literal 0 HcmV?d00001