From 9e433132a15c95e48d2e9e4a8f3b0ccf943a9984 Mon Sep 17 00:00:00 2001 From: Siyao Meng <50227127+smengcl@users.noreply.github.com> Date: Thu, 23 Jul 2026 21:56:46 -0700 Subject: [PATCH] HDDS-15957. Clean up ozone-csi references after module removal --- THREAT_MODEL.md | 16 ++++++---------- .../docs/content/interface/pvtest-webui.png | Bin 13830 -> 0 bytes 2 files changed, 6 insertions(+), 10 deletions(-) delete mode 100644 hadoop-hdds/docs/content/interface/pvtest-webui.png diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md index f34c4f7bb2ae..69f3b9bef136 100644 --- a/THREAT_MODEL.md +++ b/THREAT_MODEL.md @@ -26,9 +26,8 @@ and acts as the cluster's **internal Certificate Authority** (root of service identity); **Datanodes** store data in containers, replicate via **Ratis (Raft)**, and enforce block/container tokens when enabled; the **S3 Gateway** exposes an S3-compatible REST API to (potentially internet-facing) clients; **Recon** is a -read-only management/monitoring service; a **CSI driver** provisions Kubernetes -volumes. Clients reach it via the S3 API or the `ofs://`/`o3fs://` Hadoop -filesystem over Hadoop RPC. +read-only management/monitoring service. Clients reach Ozone via the S3 API or +the `ofs://`/`o3fs://` Hadoop filesystem over Hadoop RPC. ## §2 Scope and intended use @@ -56,7 +55,6 @@ library. There is no single "caller"; the roles split: | SCM (blocks + internal CA) | Hadoop RPC + cert server | services + admin | **Yes** (CA = root of trust) | | Datanode (block store, Ratis) | block protocol + Ratis | token-gated clients where enabled + DN peers | **Yes** | | Recon | read-only HTTP/RPC | operators | **Yes** (read path) | -| CSI driver | gRPC (kubelet) | in-cluster | **No — §3** | | `ofs`/`o3fs` client libs | in-process in the caller's app | as the caller | client-side (§10) | | test/integration modules | test | n/a | No — §3 | @@ -82,9 +80,6 @@ library. There is no single "caller"; the roles split: anonymous access by design, which would be a documented opt-in exception.)* - **Compromise of the SCM CA root key.** If the SCM CA private key is stolen, all service identity collapses by design; protecting it is operational (§10/§7). -- **The CSI driver.** Not production-ready; excluded from security inspection. - Recon, by contrast, **is** in scope — treat it as part of the production - cluster. *(maintainer — jojochuang, 2026-06-25.)* - Test/integration modules (`integration-test-*`, `*TestImpl`). ## §4 Trust boundaries and data flow @@ -395,9 +390,10 @@ list. *(requested by jojochuang, 2026-06-25.)* **Wave 3 — scope & coexistence.** -- **Q-csi / Q-recon.** *(Answered — maintainer, jojochuang 2026-06-25: CSI driver - is out of scope because it is not production-ready; Recon is in scope as part - of the production cluster. Folded into §2/§3.)* +- **Q-csi / Q-recon.** *(Answered — maintainer, jojochuang 2026-06-25: the CSI + driver was out of scope because it was not production-ready and was later + removed by [HDDS-15876](https://issues.apache.org/jira/browse/HDDS-15876). + Recon remains in scope as part of the production cluster. Folded into §2.)* - **Q-doc.** This adds `THREAT_MODEL.md` + `AGENTS.md` alongside your existing `SECURITY.md` (preserved, pointer added). Confirm, and whether the model should become canonical. (§1/§15.) diff --git a/hadoop-hdds/docs/content/interface/pvtest-webui.png b/hadoop-hdds/docs/content/interface/pvtest-webui.png deleted file mode 100644 index 69e0aa121bdba70af79b75939e2d56468eb72b4f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 13830 zcmc(GRa6{Nlr65o-8Hx+xVyV2NMpe@xVvizPUG$n+}#4f-7UBW_gBokSu_7{)_Nb^ zt5(;QvrnD6_w0RcN2n-CqaYC?K|nyD$jV5lK|nxq1J|7haKN|9kxVl1gS4f%xQeW} zIJt_Wy_uzrDFg&vyosS9rYsZPu#u6W;qVwEJ(8oFT6lQ0nxS8B_h9!}_o!h{PFAX( z-X=c!CbUK`M80ZIll6ya^2b`1;fkj_XVbmcwAy1kYp9hz`CRo+bNLWeiL=|^$Y0>Y zXMQ3_%HiYVtNYvR{`(1q-UdC4OAp0|G@J!(Tr9pwByvKH@PzP1QRWBx4&N^*U^};(uQ<} z4DNd$j}Pha3Gg8+VM2H%ZuZF?zI={66%XHKH8QNZAMEZHz@SLx2njIqB7zR;XAVvs z5rBhx#f1yC4MW0=!rVeNd>&NGFtdR%x>{sst66_}d#i(khJKQO3+=*sdwc7+e|zhS z3fS8)GvrZ0gmC(8%$5s2i2^*!WBNtbOi>Yn0k}qhfDE&QfB~)`fe#_@fq;O@f%>ms zAh~m(|LYo}^Zh38VWd3-1P7O_gs6r)j zrPpGG7JK)&`fye6z2vxjKMJ?pVcsOCTO%UMpq(qQru`%&m(8Nz{_s%^U4{jr;AjHd z#-!e`uP>8kEJmYQrN=NTT;@@~?QZgLrucApiYk#?86=m)&>DHL-tlCyHX%H-MJ0W> zJs__|6>lEapTrm?ZPH)@+NrGkuL5 z5y&LgPsd8(Q^7s0{z zG{!f4QVDo|D3RIfg^59dp+K`mg;Fe5#V~r--y?cDYOsb(f#~6KInwxuz1+2!<@k4a zE9vfFDxc$fuS61!{-d)-r?*G-{XNS%u}~nNvwK=39xJXvZFs-W>%+eD!?bCcPD2?3 z>#|F=ep~W%v9hx1X!6adaPaced53b>%Plx*&vkx8x89;B$cvEC=JsSM*tdD`1uj>k z+E=hlvpgBcFRS6`_qkG$@Y}O`i0N2*Qo8U;hMifA!3-&BO|e3n*a0g#TwdepGG-QM z?j|~d+}w9en+Q%4XDi&JP=E0u@otgsfFT*Ik<~_%Fos6rjoDN?tDaDi3@WCd>56PK zstS^qhB$_{`wc?XUjr-kS6qY15PDI+%dp?{m7WyvRQJ9e`;jSwm7;K2BJn~Wvd4zrUyXNlTffm)f*R6w>TN`;(Y!Lx{5E~l?+yi)M|A3o zWD{uU$Ev;V&NwVC$Qd+B&=u2pB9w@QtA1wiI)x6#5J{tZzQA7>gE~A*(|!kEVkLIZ z?hb!qgMq@ebMK}QAeX2gOim0`;l6hZ;94WFk>?azPV$u{A= zU;Y$9D^BL+FjJ7-6Yv`%PuUACBbtwP)`82C*A*jzAHtB2?e zgwCFz9_BRaWa25EXB4?h9WpI;N0KyJ98C)`#IY*Wi(^OX90%l*{?3-F*I%7y&Nj=M zFsRf(poOQEF0qdx%q*fT94~j;wjF_!D|OVk8n^a-gTu1yZtF3_!%#`5HGh8+fq}xb zv%|4zjhVuAfUny4k{Zc}0Yg+&5MNNP4W0edZm}j{B#G7B(k4Al_FRGTSs@TEte%Mb z`ROA45;609wIu;$^OomH_jGeCZ~DdLbi)tA=W;+S2}iwIDU)w%;&?%QNQtC$3M`hm>_IOm&KH}aE=+m{8(s*F{0J>U3p3=*MRf=>1*iG&sDnxQeY>e_ zP>@Tjh6`f*0S?cR9p4c#imc-Q<@GX_9V?fB`j6?Y3XT?B!0M_AXbQ4@H__?4TLSpf zy;*`@#I_cma#nZ_7g?bUt3q$y0n-dpv4pv#{qSU-DmP>GaYa*oXbZ(R$9}oYx{cH3 zSNp2Jj0ZI8E++lD9=%**=@%;A#tL-pJCZW7OBZQ06L48U3Se&AqUl2Ua*o?BI26*N zaecm0L-ztOhliRXveDgR_-SdZuTc1xS{>x^gm%mG|F76wsL8o?M_(xJPZ@S-1b>Yc`%ePR0!!Lbl|bA zz~h7y3n)?iz}jzPd9jbI){PZR_uJb)XykFv-7NyhE&9ZIDA0d6AXg1H&&qb3Q=Wd$BZPlpIjj!djaiu*_IQE`%8IY_6+axIOFv;1t zYj6#*I^QXsk3R`V4&Nr)f}caoZyC&j=WVlIE4lQs?<-QEDNKNsJ?x@v&O*JV&^A9M z^S@xRl*I%~p$s~4gFav9kd^A{%#pAm3|B5D)t0u$HJiRa6Qdg2Cu&NEWBYoFSFS*+AUZL+UZD+MzD9FG-PuxH}I#mqZB(F}<} zm3nfZOXc+XG9O@B1QJ3w=#UAj?_q-dG|D)(j7f~7lP^MClo%3)twpFHn^k6%UQuim zzR~H^Ha+VgWPVFrxHOi=ud7I8#1^)PizMn5{A0D^$F_UMq=*!PjbA~-r?$OB7Tb)*B9e~|Y!&AG`82`#Yaajps)};& zw#$+%y#2FJ@9?@Ud!n}QY-d14h1s-X;hoxp{;vQPkGI2dn8LNO;3r0$l-lIz_T=^p z<~jX>AZ;!FP^wn+Pdi5W-lsy(*X=Rn)V^G+GB1{dZ|dlL$Hs1Q)=HtS?}Xke7-PPF)&l`NFfs;X6)wAxdr56Ej8 z$e-Mohd8#!Fc`YhrS|{Ge(`Gxf@eW6Mwls-PbuTH@br8|xccRG4gzV_s_>E+j*5HK z$OitX8WiL_0Pk+lQ6Rt%)LYKXa&#CEL^7b*#I`u@<{gqLYg=!rpy7V%+k(_BRB=Fn z;b5MVw1Q0ef^6>6@fsUJv8ckmtl#>#(kg%j_mFh!P)Zfo-80fNv0AYwtifS+T` z5oq2_GDCz&tx8>0z+2etslEB@0nl(4lncoW6`nUoC#o@6#wbLb1!TVW0U+N)Qyh4E zhI%Hy@(0a4_tzSPTOMokoxxb`P#=pQ)o4U=I1E}UEqu-=BGn!9(!3Pt{`Z$ygY@Qb zRmWFiD+5uuSji#Y0zT=E#Kc05Uy@*%(Ybf(~PT%vD)w$$8YvnOxN_xM!OLw+GF`6C5Z_4(pafyJ&;X zupAT#FQ5kcZTK(=n(fzdbNeCf%k(sQL@Ph+>k19mVY z`Rfvl3u_{H-+=Xx5~M76LuF)-=O8$ud+xY5a=1v7h}=e1^fxtj`Rdqn%JrEo=|;L{ z0Fs~9_hmQU!5&5o(~eFInI{9@_(Hl>1}m5d0TsN3EA?KW^d4CuS^TBAvb6+=c~y z_4Zf|HW%q-?i_r^+qt+Yf_!$N^*)uE2_y5Bxew^YaY(rbr`%t!338T|+jEqN#dO&| z3;wZrE^TV}*y(h$lz{aiJZ;?MRNRAiLH#$RUNn)qJG{R(cb1p_{LpswEV_GF?7f*P z1>d;EYPS`2zNJ>blAY>9K!iXO73)$505U093L#<-RWH=2);`@pW(Ie3n}Q40?0cXL&8dKEU)F^I`Er zbGhh#Jz9Rf)7f~vzE)S3l4#C7v1kPY{)mL@waBC+$i*=OTSw25oze499t0ldzt5NIss#@;x zl#&*wM>vU}O{dc&sOFNNj^`Y?6fB>Ic1B~b3L8K8@_QNANu)G z9`0xKh2Uf{xT!$dY(fJ~Fc@OF)2L6%GgX)}`rKaXXWkMnt?8dVeIY^^VijXgfc9$VWVukroj`58A3@}=T_1rx1v zwOKFNJvy(Ob2#3!EjM_f-H`EwN8&Qe;V>o^C(tTS>CMBmx*f|+G+9a}toy`0-jc~+ z4aI#_@aoiUQB!pK#QfN${iI_0I%r8<-^-v`rgF76R(T8O_;1C&3ziyv%FKHak2SmB zO{T4VI_RuYGojV>NG2+UsgMz|xIT;!CYf`cF!3y3=(~WE>{Ylek z=QW~qH}nl5PiPn+{@88UN{S>BUQxCms5*G1HQP6@<9XmQ2F%4+*PqU5J%>#ORVKb) zH6pcQx6Px|`K;^NqK=n-_uJ;C(af+t33ey7NlNWko@C+=7%lu~ue(EO`iGsxO5Fwo z9HDIQss5{rtv(L-;bV^Pt1F2+MZ_Eq7b=hc%Bv4^;mLBi*NK1s+oV>^;t1ffUz3AG zb!Sdre^F)gXT;rnDO!1p4yQT;VPmOhrhcHxvN#FB0iCSAJA_7Mj87eIj~6Mvu6HBOO!c%CUz%6*3YSDwunyyD2k z7bMlmsY7ykhvUb&hHV#ugj>69IJ8*vJ>NyY-Tl+CfO3|=kvEXgTBS!}l;1e9s&HkU zHQG#NWZ67R{9LYOl7bdk8XXS-lC3f@?pMRGJ{P8G&UuMkQS0RB2mjt$$f$D*}3A&jug8eR0nsnRzb}zF z`_~8Kw^!&^I==7Q!F&?~Tut>Au&!sb0m}_OS@W+KRLbV?>X*g?iIMiE4iAXS0j1%x z=&QfP@Gak-uUH4{5{kwUxbtaJQ4Hl>C>7*~q6rVNCC9RCW!?QvV#E$d71BPd9;y{u z+-4}x`T#-~M&s|SA{<7oDSgdy284fqf1f(V5%W0slQwr%8H8U%qmXd;FL$lRn~UHy zS1|a_v@%20Zcj-QPTrpKTO1JeCB0yX5pulE@XlkFCd!WSNTHR?or2s!h&*iTSuwfz zncQ~E-+poX_EO{O(OQlsS8`nW)s<56qjHFnyaa?S0GpC!Z@=3jskVfr6wmi?~{}@w5}4co0nSB*wlVG`@UjZ_>vb-CGFaq*rdBKE(aahi;fIaOh_E&+?1JwIj5Z$ zW7fSzY1k~KrgJ-6b$%1SnR}=k1Jm<^TQ`N>*Wpk|ilQ$hqi}PL#No>6@VC5vVQrmx zooOz_ak=vpNzt)oew4>;Shq$eQXPsWk=|V#_Xi7VA-sg&xYytXk|*Z4+#GWM09kFs zB3+FkqNRYIidI61Tvvl59;c7-%V(xlo-m=WyxL0$q|pV6@j2K`VNJJ1pDN?~EQgQn z>8kmP?5GxfGsCje`lMq^I9^`~uaE+7PK-iKwlX7j^zCcu$DsJ_vjmdW5huj=V_D1h zP!1NtK)W}&4OSb~RnY0lkI*!jTN4d-yI&N#ggP{v&oY!qK-*!t%!Pl$U)F#vSyf<&^MC#}jDGnD z?3t->97g-1SIL!hKCRAjCfzwO=>nFNE+^ATpUuZBl8+Cr@slzU7A1iF^;P8Q9~P+I zJJOt#W_Kb*xe_Bd^kyerQ)|}eZvJ1Z6pSm;pO*~evN%vG9$> z8l_ZiU@f+WeJtZOzBVrX@Y*Boa}#5XmO+?PwCfY}sr(;>NxK9<)HVXaIg=iG3FgSf zNK6f?YZqb@gMa4lu(=27y{%1Kx9=STWDABU0ILTzDNr!HRaD8+nE8WkWGHzQC-G0{ zuIUung{Ue#J6ZUcStcO0{uM3q(@WljKwwKB9UW#h${&II?l#7O2DoKJ4&>$^E~v}N z$q}0I0Df?GO0=Z_wCWWBa((cVGqb^wkya-ZY?9Z~&0!vvns_yl3;E_iVn& zKA8QTUO)rgjr?i9!a|C6cK{T^$$kUD9B73O2UXg1dQTO7@>3HS83xjglH5yvZHcuv z>3zHie+BtI7?oONfH&|1v}JGH7o!RWQj}Z)7(4_q=NsOCcIh3*o8x7#R(kMA%k0hkI9AKTtxV!gvW!P}C1 zhxtxvQX%AA-(k|e!~Acv0GN=8C+{$o-eJ}m1T((FeD7`qMYr@0GxHs$c^88AJ4_m& zd++~0AmlEo4?*LdfX=JaV1*<2e9@Q4YS5W;B_Fydwz=G3eSO-rG5z}TbogtCH2(v^ zXKE|xpRKPJoVVA9GxfeNo`77^MF(uN&MUS}s<~nzd7AnfBQLK{=W`tay}*m=F_Ok^ z{_XfuuNV%6(7pMuzwdkXMBwFmCJPc8&fRQ0<8TSklvrricNnYNw>4h@`D0s=HU3N@ z$K`k)^ipyT4kPs(j@n|>u5xG4s<0>=OQcT-gXga1m}-|fdd#2V!ZphRs$5@Ftxmq% zOczA#|NWgXRl>z!y6rplOeX9ruPHhEex5F5=wn$&V8vOe$mEDw2OYYddGk;V|UseEv7e7r`g?gVSnun2}j(?{33y z!|CQov%0?d{%S(FV><7TUW+5|dZJL8KJmqjvT&*E5}6HN9WloIe8tzDnQYe&LV#wK z&4CX?C5eA}(}&7DrZiQx0WzqsKCLU?>I?H?0kt3WIGGET|H|n|^TDbl$cPh%baJC* z0JS%3vmw)L)6>sY8*Ctjk>n_Xxn`^M`56_mFBD}o%eCfGjutDvvdhI&hG>6b(kJG3 zRalBQj@XyE)TuG-fr$##pHr%7lMFPJ2Y7N}E$;&(Yx>PoIeYq6jedHfpqDG3+Zpjz z%S?Y@tX=!1l+WSv4p25?T2~-2hLzgx7h1l6KITMnAUS#jVy=-^bHVTJrOD*czVl&_ z_5~=N?HtaPr_>Te6Z1}E#dtI-7pfxp7j_1PNR;Xq1n9Sl z*@ylfA+LvjyW#baI>5>%O*@8yBU%0$&OsS2=6brkI|r&KsH2_?$Dm5Q4NaR&q*o85 zhd$>K7zVApur*1m2gD6>F8s^yTQSEY=?(2_o~oZ(;==%*!M%WqPICa6f-)7SgG8GTncwrTIoxa0dOAvZ(WAL? zXVdW6`lqs2&l^yE)rhy8DJrb^TDKgfyLG(_0f3#NI&es)fc#3uHT0+XStCdRC3jaklu^^0oV)OZagjZ*iDU?W6 zbdtiN|L^xv_49_`o4(P6Si--(vGV0UR9a(Q=9k+Q`~F)R&G~m-q*ABhAAO2#H^AiO zZi0SO|9E^U{QdJIGN6$v%|UvnFzZUC!fkk8jUD-Rzu=MOG7IGAX7amXq6L>_%O}!_ z7Rn_>vg)>fxABkT7E(;-h`q#P(Nno252-W`tbqZK^!DE9PcWP_zZ zS=o)?lr{Z1lF8qs%!>$1J(7s6uvlnDmrhiaLO1d{145@gXP7pYji7O#I(cv*jFw^T zyw6h>sLq^Tn)}`p2rD$GnV3sL0*Z)1cF!es--OKm$0@wl=GG)N0IV4Iip4X1n)bB5 zA}_5MJ!C~TuG{dvzp8+u8p8xfy`(;EY%9pm{kT4ch+9jOxA1tOIy)0(=s1{zTOr=r zXAh$t9PAZ#S|4laBDBUrdn#G{Db6NHZJdE!Asc-2wDbL75|}giyWf%bBLbQ*n!g!V z#TAf%yIakcY$ZtV56HpPOTIx}+61Eg?Gwx!ostfwKo!O+9B8Jt2Zj}w>^lyzpUIgn`W}T7$eaIMqbIwUXjg+yamJAe=B~x|*M6CVrGO1m z0{AjW1^Ra&gJ|1;&;*$tw{OC7<0F7L)eV7dr$4BN8C_1M`4UQfV$E&iv=936cfk;u z->O`Y(=`zskzt9)e6KA~h($7}>vAT%Msx_^#(lw)c_|sK2OrgLCOMah59RCMepI+E z{d{)n^K|RM2Jv*vI2(^XK)c!$_;gVqn>wAiCH*FV&gj>?p;;t2a|%*vVn>T&-FrN=gU( zfyef!AyrQBsl-zLt>)EBpF}hgdJl!{#>k!$1rDDtY*ryTCBb z&FPBvfb~|<&L2qmed+8)`rOBOQfq7%f<278z2a=&qpxkQmHD{CMaboRS-y{npG*cn zFp^r6kJV1GesR3ni4)eb#N~Nqbm|I!Q_%6W6NuF$?uVxbv4SGURx0 z<&%Cj947vQN+v|CFrPE?$OO9u7cBAGsPud}L{=sMN73VG6yzi~bbL5VOvWXU;O;58 zKaowFHJ#ow!jcDV*Y)D+Qx*#-I*nCrF2`n>J1~vB9UKFeVDuxT&}Q!N;u+A_NnG0r zQ5b7T&}GFO#)&}s^Ag9RxKsrJx-}DDDc{j9+83J1QgzyD9=!|bEgU!^n(&2BI<|Lm z=!3A0umjS^^OaYTuRu!DQ8gv3bQh$Z=gxvzM)oyxx`s<)G=-Jc7rhin6|6iGItUjt zIMTSNNd|*LgbMl3n)~>M5R>gLL}Z!jJ9??U_dvt-uvku0#R(Ye_xg?nHM@+l(-87F zSn$Gpasm;9LLwTDo&0z4&K;3|t(z^g)7q%{f6(R-&4UX4O!_jS^p@ z@8kSrqDd|ga{cO9+c<|KM&0U2#$$u#l?g3yqjrl1%?`Pr|84iwZX^om=vEl(lSOx@ zcLyb4Xbtg`c;uFQ%KYKMFH~dzYJeW4x=T6l8KFpER_i{obwAzT#&B&p8++O26Ig--)7?2ImYt@CT4`X?LsmG%ifGM`d%ko zv|BXDh0@(5cj*%QH)HxKsa$y$>N~-C;c$)Zw?N>3{H6eIPF>nvrzF79w3;p}WI(Q;2jdZ`kdZ96J z(*7j%R~5A2rzAwdJ_HVXy2Ex|5;??$s~YYBT5b-q;$1=^L@Wdc!Ut#E=C#v)QsF?e ze7{?FrX>eVf!k6#Qg;O^aSWRhEbi#c6SPR)-s5_k^O@pU>0voM5Aj4IF-T(6K&no=D@8;IEEv2GxFx(2VX%3r!*yqs73m zJK=Tm#;0nCW9w`@I!sH03-ybRe)T=jD=vlcQXVtz72-bSYGre34P+|@qb)}Z$4I4M z9blkhw)Me!cywf?y9(c}I>jP~Lo*AnI@j16<@Ds)`1Oy9&GuUPUCNTg3hkbTg7zS9 z7a9A6yyOn&v<+^IF@hp}svETf(OEOHU};77oF{mfaKyj$eFD!fqnF}+G?WMi z-!`Xti{AWg&@xle82|NoLkV%I;>Y?SETrp7V#lgswIY1TcofbK%~CZ6o+WGgT7D$o zW;mqa)gShwRBXSCTjP(yC$(%!;v)Aml$>3%J?7*ty&4eaD6FTye)c8Y&#EhzTGu0U zNu20}I?gox#0-FYBeKivn`3gO=H4^T9zvCz;wlr>pH)F&;RzhzU?k7qI-`$}2=e9j!dBsAye z4OyCzcp`Ma0Q0w(1(=U_YV%S+w}a9HOvT)jw2ZOf&^kT@;Z2p%Gk~seqOWMbWM!TO zEr7hnit*dG*Qifyxe(PYoaBz{y+=z~>Z0$*ffIz*lC<-Q8k)muYf&fVgS_!Nr+?5o zwE4I?`8#89%6l_qx@J{V!l=q8L9C5`F_h*^i+Xrjty~zUk*=CdVV<6W175|AYDTa^ zBfYpJiUvM6NhUsvpgyYVumwtwb+2>5xOJa^g?$TS@pffU`(y&jCWBt_K$dWw;IR3b z%4GS43nA&63(nC&fByRXUJ{!>a!f!K<7B0lk|h5ctp!-N-FKw?v_$*dT9OYGR=oXd zV0;|8QOZ*2dq1Nehh_AbdqvrTZsP?Xvx?XaRZI(sOv(@;bskeMNS&lOuKi*z(!4HO zS-=(1u=v9xp0|-TQRA7BcHsJfhiG1Z7GrOnQarNiHVdATCDf&=&Kw3ppv zrIkH@b-Lijqt*)n8k(;w)fXf%{&5{v=>$(0)$C`hEpOyXKjdztXO z<{?->DXY2S@I$S?AhQi-@y->E&Q<#r>LOSt`tVKJeqatF8tB|^U3v+dG^=c7&75?Qj$4q`Q|jk)EGxT_!0}I zf185#dqVuQc8VgIBYneRf?-PE&G7B&@57s1?>i9L9Jh`OC)g2R4z54Leh56kQz5^hO@s@?6fPn(@ob$COYFZVvSa35-f_gxHNNUZ5RSMPpyuA=zL36KWT`-{!t(9mWr09P{dTv zqn2WEzouS$Z=>D}qap85|LuE1^b-3WcaL zx>gaDpnLEF!ufolEe*x%^Ch|s&rzSJkj-2zt2|<3g~QAaR$Ps_F&`q6U6O;N>Vz`BOnw0=Jn045@bhPh%mn97 zeXN}!m+^n$y;_W}`sO9u;Xi$%UqWo^hnX02=@Abb$Zw8s@DJVWo=y`Df{RbsS{gh3 z&TfC<-=`jl14YghREvyO!QAI>?AG~_eXUo24Q5P{&VvGi9dg5TUb$;emZK7g4B{cY{W94A@^`6aqqBvcJ?I>!!$l zp$&EU>50K;6YSm-q;idp4%WS{QLO#xK@VY6o#XTAGf3k%Xpnk`u|?|xmsI>Xp|S5h_JmDI?LzgU2hs!c`S zJ2tmQ_2*qlEqPZ`ad>~z0vc(R6riM*w@If0tpZful~e}DpUS|5dNF{Ks_hoX_TDP@ zT}jpWOP&3$q!I#B=>IS)Shr+YR_I+xv$o0NwxBfE3IV02y_q@-7`ly^IV z{1;cf$>SjaGh|Q!C&;6A(AmCg(`0~w4`!RGhd;$x<%r&&Gd$2r=!eYzMIzDsF$|Q* z1Kq{`?%~59Fc~=)P?3V%=VD@kq7-OyGN`0@8 z`RXn)lR>@k8zJ;pK+PscLg+t%H%{jk1~er7-3^@O21b4yCj2@_KBP4UNhAQDf?V*+ zQ}q;?pI+hJ`e=!#!!-5O`d=+vz;X64n2OD|OSK_@kReL1R-huS7bd4(q?glZJEK-8 zS6XU3Fw5b3;=$)Oj%D@zKLYC~1ylqVbBLjCgH;l&(aq7EB|!VTxq7v-P{HH%d0W~=Jxfw?T9nWd)RL-(^Z`BX3w2N%DGK##Sq)1F>ImHxyu`^0KV zB)`juI2Mgw&UB&rR5J6@7xwxE$_3zoUKmJ_yBKp4rl;#WAs5=YOF!MnD|=kM^5+Bp zsvu!(=DRd5V&!QU0))nU>jHsNJ<>014pS944%n^Zc$v}c3_J}7G^n@n)78ENDq0f$tin=t*6ATKgMzv84!4idgf1XNu5UJr z7aaUVRXoWQ0q-C-M9GUdn%BbS~Ybr%qQ{X9^4 zEd%cGNKfza9xd|6!fyOTz67{~05$%;Y79z>z4sq{f75qJ=uY12FYG`xWqglUc@LBC zz?<;j{edOGT#s47