#!/bin/bash
# Author:

WORK_DIR=/var/tmp/install_catchpoint
THIRDPARTY_REPO_NAME=catchpoint-{X}-repo-third-party
REPO_NAME=catchpoint-rhel-repo
EULA=${WORK_DIR}/EULA.txt
REPO_FILENAME=catchpoint_{X}.repo
REPO_FILE=${WORK_DIR}/${REPO_FILENAME}
AGENT_CONF_FILE=/etc/catchpoint.d/agent.conf


OS_DIST=$(source /etc/os-release;echo $ID)
#use only the Major versionn
OS_VER=$(source /etc/os-release;echo $(printf %.1s "$VERSION_ID"))


catchpoint_user=serveruser
catchpoint_group=cp
[[ -e $AGENT_CONF_FILE ]] && . $AGENT_CONF_FILE # override with sourced values set in the conf file


usage() {
    info "usage: $0 [--help] [-V|--version] [-a|--accept-license]
                               [-q|--quiet] [-v|--verbose] [-d|--dry-run]
                               [--enablerepo=<repo>] [RPM file]

  --help                Display usage
  -V, --version         Version of Catchpoint Synthetic Agent that going to install
  -a, --accept-license  Accept EULA and suppress EULA popup
  -q, --quiet           Suppress outputs
  -v, --verbose         Show verbose info during installation
  -d, --dry-run         Display installation command without actually running it
  --enablerepo=<repo>   Enable extra YUM repos during installation
  RPM file              Install the supplied local RPM package
"
}

verbose() {
    [ $quiet -eq 1 ] && return || :
    [ $show_verbose -eq 0 ] && return || :
    echo "> $1"
}

info() {
    [ $quiet -eq 1 ] && return || :
    echo "$1"
}

warn() {
    [ $quiet -eq 1 ] && return || :
    echo "warn: $1" >&2
}

error() {
    [ $quiet -eq 1 ] && return || :
    echo "error: $1" >&2
}

fatal() {
    local exit_code=$1
    local msg="$2"

    cleanup all

    error "$msg"
    exit ${exit_code}
}

is_offline(){ false; }

print_version() {
    local rpm_file=$1
    local version=""
    if [ -n "${rpm_file}" ]; then
        if [ ! -f ${rpm_file} ]; then
            fatal 4 "The supplied RPM file doesn't exist: ${rpm_file}"
        fi
        version=$(rpm -qp --queryformat "%{VERSION}" ${rpm_file})
        info "$version (local)"
    else
        extract_packages
        version=$(yum info ${disable_repo} --enablerepo=$repos SyntheticAgent 2>/dev/null | awk '/^Version/ {print $3}')
        if [ -z "$version" ]; then
            fatal 4 "SyntheticAgent package not found"
        fi
        is_offline &&
            info "$version (offline)" ||
            info "$version (online)"
        cleanup all
    fi
    exit 0
}

extract_packages() {
    need_root
    [ ${is_extracted} -eq 1 ] && return
    rm -fr ${WORK_DIR}
    verbose "extract_package: mkdir ${WORK_DIR}"
    if ! mkdir ${WORK_DIR} > /dev/null 2>&1; then
        fatal 5 "Failed to create ${WORK_DIR}"
    fi
    verbose "extract_package: extract tarball to ${WORK_DIR}"
    if ! sed -n ${archive_begin}',$p' $0 | tar xJ -C ${WORK_DIR} > /dev/null 2>&1; then
        fatal 5 "Failed to extract packages"
    fi
    is_extracted=1
}

cleanup() {
    verbose "cleanup: rm -fr ${WORK_DIR}"
    rm -fr ${WORK_DIR}
    if [ "$1" = "all" ]; then
        verbose "cleanup all: rm -f /etc/yum.repos.d/${REPO_FILENAME}"
        rm -f /etc/yum.repos.d/${REPO_FILENAME}
    fi
}

customize_config_entry() {
    conf_message="# For Python compatibility, place double quotes around the values being assigned, if editing manually.\n# It is recommended that you use the install_catchpoint.sh script to modify usernames or groups, to properly chown the files."
    filename=$AGENT_CONF_FILE
    local key=$1
    local default=$2
    local current=$3
    local message=$4
    local extra_message=$5

    while true; do
        local now=$default
        local newnow=""

        if [ ! -z "$current" ]
        then
            now=$current
        else
            current=$default
        fi

        info
        [ -z "$extra_message" ] || info "$extra_message"
        info "Current $message: $now (Press ENTER to keep)"
        read -p "Enter $message: " newnow
        newnow=${newnow:-$now}

        type="user"
        check_type="passwd"
        if [[ $key == "catchpoint_group" ]]
        then
            type="group"
            check_type="group"
        fi

        check=$(getent $check_type $newnow > /dev/null 2>&1 || echo "Not Found")
        if [[ ! -z $check ]]
        then
            info 
            read -p "Please confirm you want to create a new $type named '$newnow'? (y/N): " -n 1 -r
            info 
            if [[ $REPLY =~ ^[Yy]$ ]]
            then
                break
            fi
        else
            break
        fi
    done

    if [ "$current" != "$newnow" ]
    then
        if [ "$newnow" == "$default" ] && [ -e $filename ]
        then
            # remove the current customization since we are going back to the default
            sed -i -e "s/^$key=\".*\"//" $filename
            #echo "REMOVED $key=\"$newnow\""

            # if the agent.conf is empty (except for default comment), remove it
            if [ ! -s $filename ] || [ $(cat $filename | tr -d '[[:space:]]') == $(echo $conf_message  | tr -d '[[:space:]]') ]
            then
                rm $filename
                #echo "REMOVED $filename"
            fi 
        else
            #create config file if it doesn't exist
            if [ ! -e $filename ]; then
                agent_conf_dir=$(dirname $filename)
                mkdir -p $agent_conf_dir
                chown root:root $agent_conf_dir
                chmod 0755 $agent_conf_dir
                echo $conf_message >> $filename
                chown root:root $filename
                chmod 0644 $filename
                #echo "CREATED $filename"  
            fi

            grep=$(grep "$key=" $filename)
            if [ -z "$grep" ]
            then
                echo "$key=\"$newnow\"" >> $filename # quotes for python compatibility
                #echo "ADDED $key=\"$newnow\""  
            else
                # replace the current customization since we are going back to the default
                sed -i -e "s/^$key=\".*\"/$key=\"$newnow\"/" $filename
                #echo "REPLACED $key=\"$newnow\""  
            fi
        fi
    else
        : #echo "UNCHANGED $key"  
    fi
}

recursive_chown_with_new_user() {

    if [ $dryrun -eq 1 ]
    then
        info "dryrun"
        # NOTE: Dry run does not currently include exercising the custom user or group functionality.
        return 1
    fi  

    local path=$1
    local old_user=$2
    local new_user=$3
    local old_group=$4
    local new_group=$5
    local message=$6
    local extra_message=$7

    if [[ ! -d "$path" ]]
    then
        return
    fi

    # don't run commands if the user or group don't exist, which might be true on first install
    # for serveruser/cp
    local check_user=$(getent passwd $old_user > /dev/null 2>&1 && echo "Found")
    local check_group=$(getent group $old_group > /dev/null 2>&1 && echo "Found")
    if [[ -z "$check_user" && -z "$check_group" ]]
    then
            return
    fi

    local needs_chown=""
    if [[ ! -z "$check_user" ]] 
    then
        needs_chown=$(find $path -user $old_user -print -quit)
    fi

    if [[ -z "$needs_chown" ]]
    then
        if [[  ! -z "$check_group" ]]
        then
            needs_chown=$(find $path -group $old_group -print -quit)
        fi

        if [[ -z "$needs_chown" ]]
        then
            return
        fi
    fi

    info
    info "Checking $path for files that need owner and/or group changed."


    if [[ ! -z "$message" && $quiet -ne 1 ]]
    then
        info ""

        if [[ ! -z "$extra_message" ]]
        then
            info "$extra_message"
        fi
        read -p "$message(y/N): " -n 1 -r

        info ""
        if [[ ! $REPLY =~ ^[Yy]$ ]]
        then
            return 1
        fi
    fi

    if [ $quiet -eq 1 ]
    then
        if [[ ! -z "$check_user" && ! -z "$check_group" ]]
        then
            find $path -user $old_user -group $old_group -exec chown -h $new_user:$new_group {} \;
        fi
        if [[ ! -z "$check_user" ]]
        then
            find $path -user $old_user -exec chown -h $new_user {} \;
        fi
        if [[ ! -z "$check_group" ]]
        then
            find $path -group $old_group -exec chgrp -h $new_group {} \;
        fi
    else
        if [[ ! -z "$check_user" && ! -z "$check_group" ]]
        then
            find $path -user $old_user -group $old_group -exec echo "Replacing user & group for {}" \; -exec chown -h $new_user:$new_group {} \;
        fi
        if [[ ! -z "$check_user" ]]
        then
            find $path -user $old_user -exec echo "Replacing user for {}" \; -exec chown -h $new_user {} \;
        fi
        if [[ ! -z "$check_group" ]]
        then
            find $path -group $old_group -exec echo "Replacing group for {}" \; -exec chgrp -h $new_group {} \;
        fi
    fi
}

bannerize_text() {
    printf "*  %-62s  *\n" "$1"
}

bannerize_line() {
    printf "********************************************************************\n" "$1"
}

customize_user_group() {

    [ $quiet -eq 1 ] && return || : # customize directly with /etc/catchpoint.d/agent.conf if needed in quiet

    if [ $dryrun -eq 1 ]
    then
        info "NOTE: Dry run does not currently include exercising the custom user or group functionality."
        return 1
    fi  
    while true; do
        default_user=serveruser
        default_group=cp
        default_browser_user=serveruser

        old_user=$catchpoint_user
        old_browser_user=$catchpoint_browser_user
        old_group=$catchpoint_group

        # Reread the conf file without defaults so we only have whats already there if anything
        catchpoint_user="" # serveruser
        catchpoint_browser_user="" # serveruser
        catchpoint_browser_group="" # cp

        [[ -e $AGENT_CONF_FILE ]] && . $AGENT_CONF_FILE

        bannerize_line
        bannerize_text "Catchpoint Agent Installer"
        bannerize_text ""
        bannerize_text "Catchpoint Agent requires a Username and Group to run as."
        bannerize_text "The default username is 'serveruser' and group is 'cp' but can"
        bannerize_text "be changed below. If you provide a username or group that"
        bannerize_text "currently does not exist on the system, it will be created for"
        bannerize_text "you. Agent will use the username and group provided to run its"
        bannerize_text "services, cronjobs, and other processes."
        bannerize_line

        customize_config_entry catchpoint_user "$default_user" "$catchpoint_user" "Username"
        # TODO: customize_config_entry catchpoint_browser_user "$default_browser_user" "$catchpoint_browser_user" "Browser Username" "(Recommended for Browser tests to run under a different username for security.)"
        customize_config_entry catchpoint_group "$default_group" "$catchpoint_group" "Group"

        # Reread the conf file with defaults so we pick up any changes
        catchpoint_user=serveruser
        catchpoint_browser_user=serveruser
        catchpoint_group=cp
        [[ -e $AGENT_CONF_FILE ]] && . $AGENT_CONF_FILE

        info
        info "Confirm the following settings"
        info "Catchpoint Agent Service User: $catchpoint_user"
        # TODO: info "Catchpoint Agent Browser User: $catchpoint_browser_user"
        info "Catchpoint Agent Group       : $catchpoint_group"

        info
        read -p "Please confirm(y/N): " -n 1 -r

        info 
        if [[ $REPLY =~ ^[Yy]$ ]]
        then
            return 0
        fi
    done
}

prompt_eula() {
    [ $quiet -eq 1 ] && return 1 || :
    [ -t 1 ] && plain=0 || plain=1
    which whiptail > /dev/null 2>&1 || plain=1
    if [ ! -f "$EULA" ]; then
        fatal 6 "EULA file not found: $EULA"
    fi
    local eula=$(cat $EULA)
    if [ $plain -eq 0 ]; then
        whiptail --yesno "$eula" --clear --scrolltext --backtitle "SyntheticAgent" --title "Catchpoint Systems, Inc." 0 0
    else
        info "$eula"
        read -p "I have read and accept the terms of EULA. (y/n) " -n 1;
        test "${REPLY,,}" = "y"
    fi
}

pre_check() {
    verbose "pre_check: check hostname length"
    local hname=$(hostname)
    if [ ${#hname} -ge 65 ]; then
        error "hostname is greater than 64 characters"
        return 1
    fi
    return 0
}

post_check() {
    local warn_bits=0
    verbose "post_check: check time synchronization"
    if ! systemctl is-active chronyd --quiet && ! systemctl is-active ntpd --quiet; then
        warn_bits=$(($warn_bits | 0x01))
    fi

    verbose "post_check: check timezone"
    if [ "$(date +%Z)" != "UTC" ]; then
        warn_bits=$(($warn_bits | 0x02))
    fi

    verbose "post_check: check firewall for https service or 443/tcp" 
    if ! firewall-cmd --list-services | grep -q https && ! firewall-cmd --list-ports | grep -q '443/tcp'; then
        warn_bits=$(($warn_bits | 0x04))
    fi

    verbose "post_check: check SELinux status" 
    selinux_status="$(getenforce 2>/dev/null)"
    if [ "${selinux_status,,}" = "enforcing" ]; then
        warn_bits=$(($warn_bits | 0x08))
    fi

    [ $((${warn_bits} & 0xff)) -ne 0 ] && info "**************************************** Important Information ****************************************" || :
    [ $((${warn_bits} & 0x01)) -ne 0 ] && info "* Enable time synchronization: systemctl enable <chronyd|ntpd|systemd-timesyncd>                      *" || :
    [ $((${warn_bits} & 0x02)) -ne 0 ] && info "* Timezone is not UTC: timedatectl set-timezone UTC                                                   *" || :
    [ $((${warn_bits} & 0x0c)) -ne 0 ] && info "* To allow users to change Network Settings and Troubleshooting from Catchpoint Portal:               *" || :
    [ $((${warn_bits} & 0x04)) -ne 0 ] && info "*   Open Firewall to allow HTTPS connection:                                                          *" || :
    [ $((${warn_bits} & 0x04)) -ne 0 ] && info "*     $> catchpoint os --enable-port=443/tcp                                                          *" || :
    [ $((${warn_bits} & 0x08)) -ne 0 ] && info "*   Set SELinux to Permissive state:                                                                  *" || :
    [ $((${warn_bits} & 0x08)) -ne 0 ] && info "*     $> catchpoint os --set-selinux=permissive                                                       *" || :
    [ $((${warn_bits} & 0xff)) -ne 0 ] && info "*******************************************************************************************************" || :
}

prepare_installation() {
    verbose "prepare_installation: cp $REPO_FILE /etc/yum.repos.d/"
    rm -f /etc/yum.repos.d/catchpoint*.repo
    cp $REPO_FILE /etc/yum.repos.d/ > /dev/null 2>&1
    if [ $? != 0 ]; then
        cleanup all
        fatal 9 "Failed to copy repo file to /etc/yum.repos.d/"
    fi
}

need_root() {
    if [ $(id -u) -ne 0 ]; then
        error "This command must be run as root"
        exit 2
    fi
}

accepted=0
quiet=0
show_verbose=0
dryrun=0
extra_repos=""
rpm_file=""
archive_begin=$(awk '/^--ARCHIVE BEGIN--$/ {print NR + 1;exit;}' $0)
is_extracted=0

args=`getopt -o Vaqvd --long help,version,accept-license,quiet,verbose,dry-run,enablerepo \
    -n 'invalid arguments' -- "$@"`
if [ $? -ne 0 ] ; then
    exit 1
fi
eval set -- "$args"

while true; do
    case "$1" in
        --help)              usage; exit 0;;
        -V|--version)        show_version=1; shift ;;
        -a|--accept-license) accepted=1;     shift ;;
        -q|--quiet)          quiet=1;        shift ;;
        -v|--verbose)        show_verbose=1; shift ;;
        -d|--dry-run)        dryrun=1;       shift ;;
        --enablerepo)        extra_repos=$2; shift 2 ;;
        --) shift; break ;;
        *) error "Internal error!"; exit 2 ;;
    esac
done

rpm_file=$1

shift || :
if [ $# -ne 0 ]; then
    error "Invalid or Extra arguments will be ignored: $@"
fi

if [ "${OS_DIST}${OS_VER}" = "rhel7" ]; then 
    repos="rhel-7-server-rpms"
    disable_repo="--disablerepo=*"
elif [ "${OS_DIST}${OS_VER}" = "rhel8" ]; then 
    # take all the repo from redhat8 distribution
    repos=""
    disable_repo="" # don't disable standard repo in readhat8
elif [ "${OS_DIST}${OS_VER}" = "centos7" ]; then 
    repos="base,updates"
    disable_repo="--disablerepo=*"
elif [ "${OS_DIST}" = "amzn" ];    then
    if [ "${OS_VER}" = "1" ]; then
        fatal 3 "Amazon Linux AMI is not supported, we only support Amazon Linux 2."
    fi
    repos="amzn2-core"
    disable_repo="--disablerepo=*"
else
    fatal 3 "This platform is not supported."
fi

if [ "${OS_DIST}${OS_VER}" = "rhel7" -o "${OS_DIST}${OS_VER}" = "centos7" -o "${OS_DIST}" = "amzn" ]; then
    enterprise_linux_version="rhel7"
elif [ "${OS_DIST}${OS_VER}" = "rhel8" ]; then
    enterprise_linux_version="rhel8"
else
    fatal 3 "This platform is not supported."
fi

REPO_FILENAME=$(echo "$REPO_FILENAME" | sed "s/{X}/$enterprise_linux_version/")
REPO_FILE=$(echo "$REPO_FILE" | sed "s/{X}/$enterprise_linux_version/")
THIRDPARTY_REPO_NAME=$(echo "$THIRDPARTY_REPO_NAME" | sed "s/{X}/$enterprise_linux_version/")

[ -n "$extra_repos" ] && repos="${extra_repos},${repos}" || :
repos=$(echo "${repos},${REPO_NAME},${THIRDPARTY_REPO_NAME}" | sed -r -e "s/^,+//g" -e "s/,+$//g" -e "s/,{2,}/,/g")
if [ "${OS_DIST}${OS_VER}" = "rhel8" ]; then 
    verbose "YUM repos that are being used: $repos and ${OS_DIST}${OS_VER} repository"
else
    verbose "YUM repos that are being used: $repos"
fi

if [ ${show_version:-0} -eq 1 ]; then
    print_version ${rpm_file}
fi

extract_packages

if [ $accepted -ne 1 ]; then
    if ! prompt_eula; then
        fatal 7 "EULA is not accepted, SyntheticAgent installation terminated."
    fi
fi

if ! customize_user_group; then
    fatal 9 "Custom user/group invalid, SyntheticAgent installation terminated."
fi

if ! pre_check; then
    fatal 8 "Prerequisites are not met, SyntheticAgent installation terminated."
fi

prepare_installation

if [ -z "${rpm_file}" ]; then
    rpm_package=SyntheticAgent
else
    if [ ! -f "${rpm_file}" ]; then
        fatal 10 "The supplied RPM file doesn't exist: ${rpm_file}"
    fi
    rpm_package=${rpm_file}
fi

if [ $dryrun -eq 1 ]; then
    echo "[Dry run] yum install -y ${disable_repo} --enablerepo=$repos ${rpm_package}"
else
    if [ $quiet -eq 1 ]; then
        yum install  -y ${disable_repo} --enablerepo=$repos ${rpm_package} >/dev/null 2>&1
    else
        yum install  -y ${disable_repo} --enablerepo=$repos ${rpm_package}
    fi
    if [ $? -ne 0 ]; then
        fatal 11 "Installation failed"
    fi
fi

# Change things that aren't currently handled by other means
if [[ "$old_user" != "$catchpoint_user" || "$old_group" != "$catchpoint_group" ]]
then
    recursive_chown_with_new_user "/var/run/catchpoint" "$old_user" "$catchpoint_user" "$old_group" "$catchpoint_group"
    recursive_chown_with_new_user "/opt/3genlabs/registry" "$old_user" "$catchpoint_user" "$old_group" "$catchpoint_group"
    recursive_chown_with_new_user "/opt/3genlabs/network" "$old_user" "$catchpoint_user" "$old_group" "$catchpoint_group"
    recursive_chown_with_new_user "/var/log/catchpoint/" "$old_user" "$catchpoint_user" "$old_group" "$catchpoint_group"
    recursive_chown_with_new_user "/opt/3genlabs/hawk/syntheticnode/service/chrome" "$old_user" "$catchpoint_user" "$old_group" "$catchpoint_group"

    if [ $quiet -ne 1 ]
    then
        recursive_chown_with_new_user "/opt/3genlabs/hawk/syntheticnode/service/shellmonitor/sandbox" "$old_user" "$catchpoint_user" "$old_group" "$catchpoint_group" "Confirm" "Change owner/group on any existing Custom Monitor sandbox scripts? Please double check for security."
    fi
fi

is_offline && cleanup all || cleanup

post_check

exit 0

--ARCHIVE BEGIN--
�7zXZ�ִF!
t/��O��]1�J��0N���(TG���(��4HC�ݬ|���-��]ހ�=X�H�I�tbC�>�E�=����
���1�b��E�ӥ��i�XROB����|��<�ό�Z�:i祭.c��E"Q�_�KZ��֞^�(��S��VE�g�����j]#���=��[IJԑ�_`Q �/T4H$�X0Pe�Q��'|I�wSP��=޽���/��Pu�==[���?Y���V���ɝ%5<�f�.�}|��%>�d!�5@U��8�������9"����ۍ����e�n8k�D?kl���==���A���.�5����HH�+G��1��QL�=I���t2��
�-�W�A%�Ak��^��=A�����Aļ���q�!_/}���p�SA/�l;�QN�s�_a�^uh4��U�j�m��k�md�+nP(��BV	认�M��	�dMo����Dʕ.�,��#G��}�s�����@K�<�̕���IT����7i�c���O͡��e�T��@y|�X��&��t�f�C��;U<�6L�ʯ�i]�t9֡��+������iMw�<VW�囦����i��/�!bt�,hnQ�5ƋCS 
�Q�q�{��?;ra���[[c�o��
�D6uף^����⿋��F��&x����"����r�65Vq�?�=w�q@i�Va������A�8���]����*˖���#��s��*3��}��[�P����kB�Q⊡{�^�f(K�G*�
���N'�f��|̌�$̷�*�\�e�>���r��*.8�zX,�]�>�����[�uX&Xإ}+A�ۖ�#��#2�9ɀs���������� D(-��|=Y�Ak~S�q� =7L�@�[S���݂������̿b���`�Cr��Vƣ��{���a�m��7[��-��X̚Y��-���5	��w5
�P���ŵ
� 
�$���ۈ���@�7���{���Q{({w��
��mr��U/���Ԁ1K=�d�K=7���h=��L0�!έ	��n����7w]�%�
<�$�
2���V�S7/�i�'yTB�i3`��R`�şK2�H������P����P�2�!�}�\�V�㘡O�5ΟK�e�
���0�<:+�a�4!�{-*:���L�L޾�s�t��+ '�ׁ�DfH��'�"�)@�P@ءk:숀$o��^^�=���y5m>vw�=#*��DcI�g�9�
��,��]tXn/r��0P�b�
��T�P�[#�������ι;�ܰ�c�-��~�|�b���f������]�����R�G��m�[D?n�l�U��a�������"�1�]��Z�b��&�*sRO�q4n�d�v��B���t/�t!���j	_��S�%��~X����S�U�)�u_��n2,��7�����o-y{���p�ë ��po���&/M%�@����$P��J�'���I���$"ϭ�8��?�F�H�y=@�g'�R�Ь(Os�m�
9j�p�lr.���8b������qf9��JL\�t��'$m���Z���:��=�Qo���>Np����f8��p�NZud��c/Ig�
�Q.��C@��ݱ	px��	�b���IPs�����Yf�K��S	��>�+����J:^
4%�A��)��6�#���z x
���]��Z��R�ŇDxg�^m�>x�iXQ0������G}q�V𷰖�4Х�����
NA��r}�"�����E	�F�Cй[���*K���U4ԭҽ�9���]w�!�/]7�-�J>�\`Y�|������w�DH9�o�kj�m~(���
�$���,�O�F��-��J�L�ݜ�D�X��@�����1r�S[kN�
S�,dy@�hD�ۨh�HB@�Dio������ͰV9#/�~�"|������(�q��m���ڼ�_}�;�t��װ�^��I�5&�垌�1����&�>����7�Fq�w���;�8ųSZG���E2���
����hy(�|wQ>\0s�Ɋ)O�����;��}K�&|
��Pٖe�ҵ8�ɸ�A�/ex�7��5����s@5�V^/�sE� A7fA�X�%��W�}�r��Ǻ8��L��*�Δ��KNEkL�Dd���ж�p<��&Dg'�=NΪƃ_Bo}_��v�-�9N��xIB��mg[��'4f��Vh���'��?�-�ΐ�+�5�G��Y���B�\)�Xt��s)f��1˃e�%��c����,GoN��G���]�Z0
`��9f��v��-gꤼL|-��YGT�5�Z���9���'����،wnV_[�
�[�u�X��iw��mf,\<W�!A��5
�үD}��,�H	R,j�#�~�:T��ǻ>N�>�#���fW����ڏ�����ã6����)�<�k�M���d��N�}PF������1K͒M�K�wQv9��u!������ބ&����lG:+4��A"_��fJ�iL���)-�N�50;��֕�Ժ���.KHQ��f��%RRR��|�މ�Z���1z��ēc��SK�zH�M4�J�B�e�X�Oa� p�o#����6��*C�iںbw����c<��f!u )>S,h.t+��όE�B�*8�����qa�f�P�ĭR�1S���g38��EH[0
K_r:�ε��Btsc1�*/RQ�3�?�����`e3���W�E։孯1���A����@93��h�U�������߱�a�v�������q__�/p:��s1�d͔~��F?zT�r;���
L�=�uR�v�q�w���h0����2z�>Y�W)$��,
7��*F-�Ylր��G�����6�S,4S���U'^?��Ip�1�~����S>��� F^´�j%�H�u|�ժ�Gܹ�>C@C9��UҰ����}��Y'��߸��J���E���_�/y7�#�Zpq�qVGꉷ0������B�h5"$x��L[@��}�['l���5)P7vWIq�;F.Q�B�:��.�6�U��\��ܜ;Pr�xb.�������.I�
l=�+��[��b���,�CM�W�Q�d�­kO'�_Q��}� ������8kZ@���M�U9��ĝ����M74�~�	8ŷX[z"FwdhE�ٕ3����\���[k&��D,�i>w@q�~3���خ�U�"3=���p���Y3�.�C�>�n�J֡9����Egq�>,;b���xr�9�nI*��t�t��A�]�o:�3c|0�r�n��Ϸs�{�A0�oĐ)�E4�J�5�/��`�J�ض��V�c�a���5��
F
и�V���~�a��6Vvh,�x���פ�:d�U��k���!����qS��a�3�7Q�wS?U�lZ��#(N�E)"TX�nCx�ʝ>�
����r��ǫ�Ȉ&��U�z;w<'tP����T�K��
�K�j���K��Vg�.�:b�����+����_��|�}F�r�f~oh��F
{�ї��ϥ��&�˺j]���T���q:�eA�އ}o�V1�e��|�j���פ�n�R�T�$Z��4Tei�Pv{�a���rŖ�'Nd��f���f��;_�(�O���w������$ϋ��dX�Q2��o�А����O\��	=��QD���3StU�]A��7�:D���#���>�x6�)�
���
a����g�YZ