From e4503e5d77801ed455f23e9ef3e10ead4a45bf5e Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Wed, 2 Feb 2022 00:18:16 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .../Feature proposal - detailed.md            |   7 +-
 .../javascripts/boards/stores/actions.js      |   2 -
 .../components/blob_content_viewer.vue        |   2 +-
 .../components/blob_viewers/simple_viewer.vue |   4 +-
 .../vue_shared/components/source_viewer.vue   |   4 +-
 app/models/container_repository.rb            |  15 +-
 .../disable_metric_dashboard_refresh_rate.yml |   2 +-
 .../development/incident_escalations.yml      |   2 +-
 ...trics_dashboard_exhaustive_validations.yml |   2 +-
 .../prometheus_computed_alerts.yml            |   2 +-
 .../development/rearrange_pipelines_table.yml |   2 +-
 ...settings_operations_prometheus_service.yml |   2 +-
 ...nt_management_oncall_notification_sent.yml |   2 +-
 .../ops/prometheus_notify_max_alerts.yml      |   2 +-
 .../004_zeitwerk.rb                           |   1 +
 doc/administration/pages/index.md             |  17 +-
 doc/ci/runners/saas/windows_saas_runner.md    |   2 +-
 doc/development/internal_api/index.md         |  10 +-
 .../settings/external_authorization.md        |   2 +-
 .../classification_label_on_project_page.png  | Bin 19568 -> 0 bytes
 ...sification_label_on_project_page_v14_8.png | Bin 0 -> 17728 bytes
 .../test_coverage_visualization.md            |  27 ++++
 lib/api/api.rb                                |   1 +
 lib/api/helpers/container_registry_helpers.rb |   2 +-
 .../internal/container_registry/migration.rb  |  63 ++++++++
 .../security/validators/schemas/14.0.0        |   1 +
 .../security/validators/schemas/14.0.1        |   1 +
 .../security/validators/schemas/14.0.2        |   1 +
 .../security/validators/schemas/14.0.3        |   1 +
 .../security/validators/schemas/14.0.4        |   1 +
 .../security/validators/schemas/14.0.5        |   1 +
 .../security/validators/schemas/14.0.6        |   1 +
 .../security/validators/schemas/14.1.0        |   1 +
 spec/frontend/boards/stores/actions_spec.js   |   4 +-
 .../__snapshots__/simple_viewer_spec.js.snap  |   4 +-
 spec/models/container_repository_spec.rb      |  39 +++++
 .../container_registry/migration_spec.rb      | 153 ++++++++++++++++++
 37 files changed, 357 insertions(+), 26 deletions(-)
 delete mode 100644 doc/user/admin_area/settings/img/classification_label_on_project_page.png
 create mode 100644 doc/user/admin_area/settings/img/classification_label_on_project_page_v14_8.png
 create mode 100644 lib/api/internal/container_registry/migration.rb
 create mode 120000 lib/gitlab/ci/parsers/security/validators/schemas/14.0.0
 create mode 120000 lib/gitlab/ci/parsers/security/validators/schemas/14.0.1
 create mode 120000 lib/gitlab/ci/parsers/security/validators/schemas/14.0.2
 create mode 120000 lib/gitlab/ci/parsers/security/validators/schemas/14.0.3
 create mode 120000 lib/gitlab/ci/parsers/security/validators/schemas/14.0.4
 create mode 120000 lib/gitlab/ci/parsers/security/validators/schemas/14.0.5
 create mode 120000 lib/gitlab/ci/parsers/security/validators/schemas/14.0.6
 create mode 120000 lib/gitlab/ci/parsers/security/validators/schemas/14.1.0
 create mode 100644 spec/requests/api/internal/container_registry/migration_spec.rb

diff --git a/.gitlab/issue_templates/Feature proposal - detailed.md b/.gitlab/issue_templates/Feature proposal - detailed.md
index f7d0567f806..862c0e03258 100644
--- a/.gitlab/issue_templates/Feature proposal - detailed.md	
+++ b/.gitlab/issue_templates/Feature proposal - detailed.md	
@@ -63,7 +63,12 @@ Consider adding checkboxes and expectations of users with certain levels of memb
 * [ ] Add expected impact to Reporter (20) members
 * [ ] Add expected impact to Developer (30) members
 * [ ] Add expected impact to Maintainer (40) members
-* [ ] Add expected impact to Owner (50) members -->
+* [ ] Add expected impact to Owner (50) members 
+
+Please consider performing a threat model for the code changes that are introduced as part of this feature. To get started, refer to our Threat Modeling handbook page https://about.gitlab.com/handbook/security/threat_modeling/#threat-modeling. 
+
+Don't hesitate to reach out to the Application Security Team (`@gitlab-com/gl-security/appsec`) to discuss any security concerns.
+-->
 
 ### Documentation
 
diff --git a/app/assets/javascripts/boards/stores/actions.js b/app/assets/javascripts/boards/stores/actions.js
index 48ca3239cfd..1ebfcfc331b 100644
--- a/app/assets/javascripts/boards/stores/actions.js
+++ b/app/assets/javascripts/boards/stores/actions.js
@@ -15,7 +15,6 @@ import {
   FilterFields,
   ListTypeTitles,
   DraggableItemTypes,
-  active,
 } from 'ee_else_ce/boards/constants';
 import {
   formatIssueInput,
@@ -210,7 +209,6 @@ export default {
     const variables = {
       fullPath,
       searchTerm,
-      state: active,
     };
 
     let query;
diff --git a/app/assets/javascripts/repository/components/blob_content_viewer.vue b/app/assets/javascripts/repository/components/blob_content_viewer.vue
index 547e41019a2..ca89e549181 100644
--- a/app/assets/javascripts/repository/components/blob_content_viewer.vue
+++ b/app/assets/javascripts/repository/components/blob_content_viewer.vue
@@ -245,7 +245,7 @@ export default {
 <template>
   <div>
     <gl-loading-icon v-if="isLoading" size="sm" />
-    <div v-if="blobInfo && !isLoading" class="file-holder">
+    <div v-if="blobInfo && !isLoading" class="file-holder gl-overflow-hidden">
       <blob-header
         :blob="blobInfo"
         :hide-viewer-switcher="!hasRichViewer || isBinaryFileType || isUsingLfs"
diff --git a/app/assets/javascripts/vue_shared/components/blob_viewers/simple_viewer.vue b/app/assets/javascripts/vue_shared/components/blob_viewers/simple_viewer.vue
index 2c74d56f617..4b222608e5f 100644
--- a/app/assets/javascripts/vue_shared/components/blob_viewers/simple_viewer.vue
+++ b/app/assets/javascripts/vue_shared/components/blob_viewers/simple_viewer.vue
@@ -51,7 +51,7 @@ export default {
 <template>
   <div>
     <div class="file-content code js-syntax-highlight" :class="$options.userColorScheme">
-      <div v-if="!hideLineNumbers" class="line-numbers">
+      <div v-if="!hideLineNumbers" class="line-numbers gl-pt-0!">
         <a
           v-for="line in lineNumbers"
           :id="`L${line}`"
@@ -67,7 +67,7 @@ export default {
       </div>
       <div class="blob-content">
         <pre
-          class="code highlight"
+          class="code highlight gl-p-0! gl-display-flex"
         ><code v-safe-html="content" :data-blob-hash="blobHash"></code></pre>
       </div>
     </div>
diff --git a/app/assets/javascripts/vue_shared/components/source_viewer.vue b/app/assets/javascripts/vue_shared/components/source_viewer.vue
index ba6f27698b7..0aa2589637f 100644
--- a/app/assets/javascripts/vue_shared/components/source_viewer.vue
+++ b/app/assets/javascripts/vue_shared/components/source_viewer.vue
@@ -116,13 +116,13 @@ export default {
 </script>
 <template>
   <div
-    class="file-content code js-syntax-highlight blob-content"
+    class="file-content code js-syntax-highlight blob-content gl-display-flex"
     :class="$options.userColorScheme"
     data-type="simple"
     data-qa-selector="blob_viewer_file_content"
   >
     <line-numbers :lines="lineNumbers" />
-    <pre class="code"><code v-safe-html="highlightedContent"></code>
+    <pre class="code gl-pb-0!"><code v-safe-html="highlightedContent"></code>
     </pre>
   </div>
 </template>
diff --git a/app/models/container_repository.rb b/app/models/container_repository.rb
index e14555f2907..c1fb2726d03 100644
--- a/app/models/container_repository.rb
+++ b/app/models/container_repository.rb
@@ -96,7 +96,7 @@ class ContainerRepository < ApplicationRecord
     end
 
     event :abort_import do
-      transition %i[pre_importing importing] => :import_aborted
+      transition ACTIVE_MIGRATION_STATES.map(&:to_sym) => :import_aborted
     end
 
     event :skip_import do
@@ -205,6 +205,11 @@ class ContainerRepository < ApplicationRecord
     super
   end
 
+  def finish_pre_import_and_start_import
+    # nothing to do between those two transitions for now.
+    finish_pre_import && start_import
+  end
+
   # rubocop: disable CodeReuse/ServiceClass
   def registry
     @registry ||= begin
@@ -287,10 +292,18 @@ class ContainerRepository < ApplicationRecord
     update!(expiration_policy_started_at: Time.zone.now)
   end
 
+  def migration_in_active_state?
+    migration_state.in?(ACTIVE_MIGRATION_STATES)
+  end
+
   def migration_importing?
     migration_state == 'importing'
   end
 
+  def migration_pre_importing?
+    migration_state == 'pre_importing'
+  end
+
   def migration_pre_import
     return :error unless gitlab_api_client.supports_gitlab_api?
 
diff --git a/config/feature_flags/development/disable_metric_dashboard_refresh_rate.yml b/config/feature_flags/development/disable_metric_dashboard_refresh_rate.yml
index 6f4235acaac..6adfba96e10 100644
--- a/config/feature_flags/development/disable_metric_dashboard_refresh_rate.yml
+++ b/config/feature_flags/development/disable_metric_dashboard_refresh_rate.yml
@@ -4,5 +4,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/37195
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/229841
 milestone: '13.2'
 type: development
-group: group::monitor
+group: group::respond
 default_enabled: false
diff --git a/config/feature_flags/development/incident_escalations.yml b/config/feature_flags/development/incident_escalations.yml
index ea823f573aa..3853a8be2de 100644
--- a/config/feature_flags/development/incident_escalations.yml
+++ b/config/feature_flags/development/incident_escalations.yml
@@ -4,5 +4,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74337
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/345769
 milestone: '14.6'
 type: development
-group: group::monitor
+group: group::respond
 default_enabled: false
diff --git a/config/feature_flags/development/metrics_dashboard_exhaustive_validations.yml b/config/feature_flags/development/metrics_dashboard_exhaustive_validations.yml
index 1fe4c51b6ec..5c3c76dd252 100644
--- a/config/feature_flags/development/metrics_dashboard_exhaustive_validations.yml
+++ b/config/feature_flags/development/metrics_dashboard_exhaustive_validations.yml
@@ -4,5 +4,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/40103
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/241697
 milestone: '13.4'
 type: development
-group: group::apm
+group: group::respond
 default_enabled: false
diff --git a/config/feature_flags/development/prometheus_computed_alerts.yml b/config/feature_flags/development/prometheus_computed_alerts.yml
index 5a9a989d544..97912685fb5 100644
--- a/config/feature_flags/development/prometheus_computed_alerts.yml
+++ b/config/feature_flags/development/prometheus_computed_alerts.yml
@@ -4,5 +4,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/13443
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/255304
 milestone: '12.0'
 type: development
-group: group::monitor
+group: group::respond
 default_enabled: false
diff --git a/config/feature_flags/development/rearrange_pipelines_table.yml b/config/feature_flags/development/rearrange_pipelines_table.yml
index aba990d891f..4f16d6651b6 100644
--- a/config/feature_flags/development/rearrange_pipelines_table.yml
+++ b/config/feature_flags/development/rearrange_pipelines_table.yml
@@ -5,4 +5,4 @@ rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/343286
 milestone: '14.8'
 type: development
 group: group::pipeline execution
-default_enabled: false
+default_enabled: true
diff --git a/config/feature_flags/development/settings_operations_prometheus_service.yml b/config/feature_flags/development/settings_operations_prometheus_service.yml
index 27ccaf782c2..93afe504b21 100644
--- a/config/feature_flags/development/settings_operations_prometheus_service.yml
+++ b/config/feature_flags/development/settings_operations_prometheus_service.yml
@@ -4,5 +4,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/24296
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/258560
 milestone: '12.8'
 type: development
-group: group::monitor
+group: group::respond
 default_enabled: false
diff --git a/config/feature_flags/development/usage_data_i_incident_management_oncall_notification_sent.yml b/config/feature_flags/development/usage_data_i_incident_management_oncall_notification_sent.yml
index 3b8d02cc2d4..558232ca1bd 100644
--- a/config/feature_flags/development/usage_data_i_incident_management_oncall_notification_sent.yml
+++ b/config/feature_flags/development/usage_data_i_incident_management_oncall_notification_sent.yml
@@ -4,5 +4,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/58606
 rollout_issue_url:
 milestone: '13.11'
 type: development
-group: group::monitor
+group: group::respond
 default_enabled: true
diff --git a/config/feature_flags/ops/prometheus_notify_max_alerts.yml b/config/feature_flags/ops/prometheus_notify_max_alerts.yml
index 2861299d9bf..bc08787e8ec 100644
--- a/config/feature_flags/ops/prometheus_notify_max_alerts.yml
+++ b/config/feature_flags/ops/prometheus_notify_max_alerts.yml
@@ -4,5 +4,5 @@ introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/77168
 rollout_issue_url: https://gitlab.com/gitlab-com/gl-infra/production/-/issues/6086
 milestone: '14.7'
 type: ops
-group: group::monitor
+group: group::respond
 default_enabled: false
diff --git a/config/initializers_before_autoloader/004_zeitwerk.rb b/config/initializers_before_autoloader/004_zeitwerk.rb
index cb05bf1abb2..60cc57c3282 100644
--- a/config/initializers_before_autoloader/004_zeitwerk.rb
+++ b/config/initializers_before_autoloader/004_zeitwerk.rb
@@ -4,6 +4,7 @@ Rails.autoloaders.each do |autoloader|
   # We need to ignore these since these are non-Ruby files
   # that do not define Ruby classes / modules
   autoloader.ignore(Rails.root.join('lib/support'))
+  autoloader.ignore(Rails.root.join('lib/gitlab/ci/parsers/security/validators/schemas'))
   autoloader.ignore(Rails.root.join('ee/lib/ee/gitlab/ci/parsers/security/validators/schemas')) if Gitlab.ee?
 
   # Mailer previews are loaded manually by Rails
diff --git a/doc/administration/pages/index.md b/doc/administration/pages/index.md
index 4d672091753..81465e0228c 100644
--- a/doc/administration/pages/index.md
+++ b/doc/administration/pages/index.md
@@ -238,6 +238,7 @@ control over how the Pages daemon runs and serves content in your environment.
 | `artifacts_server_url`                  | API URL to proxy artifact requests to. Defaults to GitLab `external URL` + `/api/v4`, for example `https://gitlab.com/api/v4`. When running a [separate Pages server](#running-gitlab-pages-on-a-separate-server), this URL must point to the main GitLab server's API. |
 | `auth_redirect_uri`                     | Callback URL for authenticating with GitLab. Defaults to project's subdomain of `pages_external_url` + `/auth`. |
 | `auth_secret`                           | Secret key for signing authentication requests. Leave blank to pull automatically from GitLab during OAuth registration. |
+| `client_cert_key_pairs`                 | Client certificates and keys used for mutual TLS with the GitLab API. See [Support mutual TLS when calling the GitLab API](#support-mutual-tls-when-calling-the-gitlab-api) for details. |
 | `dir`                                   | Working directory for configuration and secrets files. |
 | `enable`                                | Enable or disable GitLab Pages on the current system. |
 | `external_http`                         | Configure Pages to bind to one or more secondary IP addresses, serving HTTP requests. Multiple addresses can be given as an array, along with exact ports, for example `['1.2.3.4', '1.2.3.5:8063']`. Sets value for `listen_http`. |
@@ -511,6 +512,20 @@ Authority (CA) in the system certificate store.
 
 For Omnibus, this is fixed by [installing a custom CA in Omnibus GitLab](https://docs.gitlab.com/omnibus/settings/ssl.html#install-custom-public-certificates).
 
+### Support mutual TLS when calling the GitLab API
+
+If GitLab has been [configured to require mutual TLS](https://docs.gitlab.com/omnibus/settings/nginx.html#enable-2-way-ssl-client-authentication), you need to add the client certificates to Pages:
+
+1. Configure in `/etc/gitlab/gitlab.rb`:
+
+   ```ruby
+   gitlab_pages['client_cert_key_pairs'] = ['</path/to/cert>:</path/to/key>']
+   ```
+
+   Where `</path/to/cert>` and `</path/to/key>` are the file paths to the client certificate and its respective key file.
+   Both of these files must be encoded in PEM format.
+1. To configure Pages to validate the server certificates, [add the root CA to the system trust store](#using-a-custom-certificate-authority-ca).
+
 ### ZIP serving and cache configuration
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-pages/-/merge_requests/392) in GitLab 13.7.
@@ -688,7 +703,7 @@ To override the global maximum pages size for a specific group:
 ## Running GitLab Pages on a separate server
 
 You can run the GitLab Pages daemon on a separate server to decrease the load on
-your main application server. This configuration does not support mutual TLS (mTLS). See the [corresponding feature proposal](https://gitlab.com/gitlab-org/gitlab-pages/-/issues/548) for more information.
+your main application server.
 
 To configure GitLab Pages on a separate server:
 
diff --git a/doc/ci/runners/saas/windows_saas_runner.md b/doc/ci/runners/saas/windows_saas_runner.md
index b08be14dbc3..209c43e1e7f 100644
--- a/doc/ci/runners/saas/windows_saas_runner.md
+++ b/doc/ci/runners/saas/windows_saas_runner.md
@@ -15,7 +15,7 @@ change when the beta period ends, as discussed in this [related issue](https://g
 
 Windows runners on GitLab.com autoscale by launching virtual machines on
 the Google Cloud Platform. This solution uses an
-[autoscaling driver](https://gitlab.com/gitlab-org/ci-cd/custom-executor-drivers/autoscaler/tree/master/docs/readme.md)
+[autoscaling driver](https://gitlab.com/gitlab-org/ci-cd/custom-executor-drivers/autoscaler/-/blob/main/docs/README.md)
 developed by GitLab for the [custom executor](https://docs.gitlab.com/runner/executors/custom.html).
 Windows runners execute your CI/CD jobs on `n1-standard-2` instances with
 2 vCPUs and 7.5 GB RAM. You can find a full list of available Windows packages in
diff --git a/doc/development/internal_api/index.md b/doc/development/internal_api/index.md
index 96910892022..983953d2e09 100644
--- a/doc/development/internal_api/index.md
+++ b/doc/development/internal_api/index.md
@@ -507,7 +507,7 @@ curl --request POST --header "Gitlab-Kas-Api-Request: <JWT token>" \
 
 Called from the GitLab Agent Server (`kas`) to create a security vulnerability
 from a Starboard vulnerability report. This request is idempotent. Multiple requests with the same data
-create a single vulnerability.
+create a single vulnerability. The response contains the UUID of the created vulnerability finding.
 
 | Attribute       | Type   | Required | Description |
 |:----------------|:-------|:---------|:------------|
@@ -553,6 +553,14 @@ curl --request PUT --header "Gitlab-Kas-Api-Request: <JWT token>" \
 }'
 ```
 
+Example response:
+
+```json
+{
+  "uuid": "4773b2ee-5ba5-5e9f-b48c-5f7a17f0faac"
+}
+```
+
 ## Subscriptions
 
 The subscriptions endpoint is used by [CustomersDot](https://gitlab.com/gitlab-org/customers-gitlab-com) (`customers.gitlab.com`)
diff --git a/doc/user/admin_area/settings/external_authorization.md b/doc/user/admin_area/settings/external_authorization.md
index 81935aceebd..ef980981fec 100644
--- a/doc/user/admin_area/settings/external_authorization.md
+++ b/doc/user/admin_area/settings/external_authorization.md
@@ -105,7 +105,7 @@ label defined in the [global settings](#configuration) is used.
 
 The label is shown on all project pages in the upper right corner.
 
-![classification label on project page](img/classification_label_on_project_page.png)
+![classification label on project page](img/classification_label_on_project_page_v14_8.png)
 
 <!-- ## Troubleshooting
 
diff --git a/doc/user/admin_area/settings/img/classification_label_on_project_page.png b/doc/user/admin_area/settings/img/classification_label_on_project_page.png
deleted file mode 100644
index 4aedb332cec96f4feed2d71b72fd3f42b339b708..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 19568
zcmb5Ubx<5n^e?(VfCLE=oZtlaCCK9L1a}F#Sa1!lf#9x-y9PE`aQ6)ki@SSpeSGix
z=iOWNyH&4is%HCiPxm=zKgW6|LPc2y6O9B7003ah$x5mL04Oj30O9d1(kn%}w!8!Y
zK)hE`)R204dAYy8zuvlLV`JOd**T^G`1$xaIy!1<YTmrOuyJs(vl=@xvAn$8jNiY!
zJYT-tPNmFWU0+=v93DO`7u?+3yxjby(fGAnX0W`x{BU=6^77KEMgFjme{y;zR=D(A
zlj4}>O>TDf#l?k~nAj)HnwRH8NmjO$sms>Zmgk#gHdY-IX4Z@Q`>kUAijs<(y<4fm
zB}YfUl>+a(ySvHB>8F{@yNkQ>jfa=BzL)1U3WHjG7S^rJjhCyrU*6va?_c`*`sN>A
zmN$0i=Vot@?z%2s9?wskG$~GZ*N^Ct9>@XD%jN7WVXg&pD=#nKe9Dp%6Q9<8v9U>v
z{(IVed0}U@o9>^^UA(igvL3#9S-pPluqHgOU%eSgTQ8Cu8yN|4bZFXtZfs~ODkumK
z4W-g9$;`-PXZapCe)+uJJqM9@A38NKH0sQ96|P*3{Q0wPdb_uI=%vZpkAe9I9g}^_
z_RDtt^u^P`{bTpWW&iv}s1VbAdUQ}waJU9zg&GyJSo~pwLj^Bg;ph%y;4r>*OKePx
zYTf2Jys@sf_L#=m&(YCFoYBqMnVns7?eOw$d*W{c#H?X!eXf6Nw3bTSJH`21tM8YS
zPETf$;)hbmh%d+U_Nr+1gjCEZhe!QQh<m#;_tomd$;EwI`!Zkt!cBj~)WYi4+O&#a
z-FRnhwu9P4l>Cbq;NS7V?d-s2Q_Mt_JCm5p%iZnd+JQrC<Js-YfdzE4&hGN7VzwoJ
zIv;&O<B(@Tn?+9N{a6LSqvg>6z{zeO+O}ObFn3xteXc6FH@Ca*)41AO+z{o^mTE*V
ztz)3gb3B-%;tFwePVcJ<Kjow3Hx9nAHuJUAXdRjYeDBXGtq+G3X<7SD<r`j)t^a_+
zbQ0=3zkA*J8VM`w8JCV<<hA8TdcKre9Mei&!~Y#F9JW?LD0CAYJmYw*@{T`gGm4A7
z#PfWN8~6Q@`%)~XBg&hb7IjRWe5e<~D9&=IS$5`^gOD@3-Jt8sz%1f}>;eGDamq=G
zX?QLi&2dJ45F<ia`;y`W7l%o+_KMfWC7}@z7!ij%7uTx(#ulrr#|?^xm{NsH$*xmi
zhiC--h%T&)i@N{`NFl!jc(bL3ZVnEmuNhu@{j^w3cW6(yPkS}C|3B?kyXV=QTN!oH
zlY1W(FgD}oJ6==Ax@jZ;uqrm9XN^^62Uz7^xBNDsBew#KO_3K_07*~)m{2<hs8XU%
zc<N1dZ_IU{vctcVE53`3QOGTN>Pb8MhKRKgtbHYF_F(;r8n9E8N{|P|Nv*L9oiawD
zD5mmVC3;i@&V+UxXk0ZLmZSrp<}=mrc5P=?hi&{${&xP8ZwzmWtLa-w9+@j}zMQ!u
zZAq&Bw%V$JwY@6bKYiJ0F?BHCBJf<vk{vnQLjhKRmz)&Lcb)0rEE<f~9X;>d^bP^i
z62<hwOQb4W(~Wo<hgH6i{j9Jq{&OY<DHra53p~shmoo(9-0|2J6w!p&<^n&cn<Q9S
zF3oR@Q%zP@sG|Z8@SGwjG=PRGC8p7;+_<TII8HV|vjV<d`bZZm&9pIdgvV|R&N$Jm
zu5ahTET)ooBQ7WVEvYxxC=P}ZT}!JJt;>rKGyeA@%{NOj?b92zBE%SC(n)c+Nw89C
zB`sI?WrIjX5}~KW!%<MPUank?hj`Ai!qVZ9dkbuMF_M%L>4K1i&f&}S6g=#lZoagy
z7}JsNKv4!v5>01Id!hVxU7a!wgaA^fT6GeRu#f_8g|Bp~<&!TRRBqfCB_51cm{S**
zrW=48hGq~m5d%BJ2x7sX=R5frBp|h>wO|xu<`;|}o#$O-6sKJSR0sssy&Umx@NBwt
z!4OlPpg{2X(UIu;l8a{r2&SbH__Nl~t;>F6+8)B$SVkx^>A#ader3!M<V7dJ@*#xV
zTyYGIKCCh*$q!_sce1()_dw$rO>H4W+%hOXK7MoO)_9ZtRuC(wCxW@jTeo7G7<2!`
zwic#5@ac|6E$JGYeIs;uxW3y?=!U4j0=kNgeq3Jpm}m6(*<po11yrG@*?izNZpEEp
zjgvze#^-t&dUQt>;hELb6c{MzM>lqFQY~A2fm<7L`<0tOVJJnScK+9-E=!6m8Mhk`
zUTo~(gk!1B6)i|%jYv(efb*npvu{%l3<-UxD}YL8!gzj9uB_s+xPG_cY52O{i2v1$
z;Q6d&T(=Rm>&~%Qsl_Tcv!HRxjQB4ty@x?AI~m+}aYL+Ob|R-K)tYVbrj4j2f|rNz
zw>nD+L8WVhy6b5hflm|S8<_wr0j&LlS2-=us4`3pB<N#F*?Hr(4?Xp9n)l=lmc>_M
zD+ij{c~6W?5A4oMP|nv2awn{~r@mT=JED*U-`Yfrv2p%TKsc`&VqQY%<_LZ9%<HXW
z|88vVCuxi-*s*}nuHQD#FzQFVj5@gCTL?UYNc3FR!rsT6=W1ZJBW)BYqeAfQ|02-x
z!RXBwrA#FG6kUU?>dlr?0vHQ|D6ac_sOm|1jeVZ8>#Zp`U1f{V`Y_r2Z<Apca&)Oo
z5Z!sh0g!s4fDE`|<|jj7=#QI!b#ltRKDenrbiNsK99HUQk4;ePfN`KO$loMb?i7cz
z3}J^|q1RjaLKwB>Hqa<$cM^o|*FQtc7yXK>tUy6hIsH!QhI7OzIb!m$j~HD|l`@*4
z6BeSN2ckE&zYw3gXO_Y$EpWxOlM#ax3YABxT43Y4&Tlei%|irHF_gD*q2^(re|86G
z*oMc}5Y9F?7Ay?UplI?hn3?8ex91b+_I|fzGUp2cUkhZB->HT4x!6GtOFV57=VF8Z
zCV>(Y7h$lJ=Sk|Mg($|D*kNQwh}+LSo2TPK{z>@k?yg-eOPbq`!_AQ&k<||AHeB}?
zq@9MfV0C8B6f#s8m#z{5w(jtszG5UUFTF7A@vL%Yy|w3zGM>}=Ov1o*(giB;cd*K6
zBY#*zCyAC$<PUbw>@#suq?96TC&}fJx;QK8Hp5m_#a}>z3gy;hY}9bAv-<m3>7+4&
zvSi;u@_sVJfz+7Hxqrs)OfxVtim!i^RL>Wy-^0V9`Ml^RP4gfvnWQZ~na_xI@&WB(
zM4@)sB&&H!4vdt3pvali&ERt))X_I;SGelCkoNEm1z)S=lN)pj%fC|$jFyZhjz!Yi
z3X!+NpG^04en2GkJh2Ek3o3;9X#X;$DV3ho#iX1?c5$6`*KKR!=~T@cho_VOr6$Lf
zarsxD1Pl5S56i~GA-c`ZMJx(hLY39G_ymH-vJ&XJYK`2{e5=qB!uVf8duic*FeVVM
zD;wMVS{mX(YF$$cJ)>YrJnolusVVqnZYH@GWjmyBTNuk%M*~?$(9``sjssP{#oeZ@
zhkF*rx)aE_P*VT7NSd}4Ky|Sif|irH62QV>vTVQi36`X&KXk{T>ZB1G)2lNS7XYvJ
zcK5>FEHe#Q&twXdQ)CPq0uAD(iSMlS?I|7crPH1Y%hCgM2w2p`e2|+12@7GK@k;oC
zqV~Mf?&>q?9P{6Z95mT<egS%*;8>X5QJLPK1IWOyP$3YIZ6T78`ag;K_E?q>B;@G&
zGh^(soEp$=OVfe)p(`BtG-09VXNP-9zhTmauwOD7c%^M51L*PHv2ECWuyZ5^X{b6V
z{}6jxYeXY%;!Q(qhTF~;lh8OOepcy!v0}}MFcfGanwlFiV}QiR6bu;^%*k(er3j6g
z(FZH(1+ble!ETn2B|rCub~0_I?-z0zQs5@xM3Py&JOUQChFh?`#Y8%nJzZur1IJLN
zJXng|DcKPG8(q$4{>^`E*F&Kkb`38>C-S6B;+AN|jy1JW2gGg~{UCjp-!N+Dx973b
z@b__&qsrZK&hs}@AaDCoy8+Be%i~_+=`Mq780-jyq+7RFIbRLDDWhazAOt~`?Tx<z
z`*jA!;juU9%EuxpunWc?=hFi<4z+ugw@wpRF(Q_VocQLSvZJaf1AToH*M9#fggt&C
z8vL@VI8J=)u2xh!_v*+;i8F#=%7Ni$GgN~0dNi&Crr)LMX5i@rkfM31N@%w0E^Y<v
zeF*3c<1D;Ot+Uugoc}%O-}&1jDMnNXCRhqAwR>tv9Zenji>nRpS+$R^&68OU^K=G7
zYLjlGq6p0w?F=yK<iR#wmB9GhjqN8T`+=$*#7$vU<2O-Ku@RC_iy@svUhcC#c}^1`
zpKP-^V$PDo2Xw}yssFf(ppXGyk4b~p%9mqsNM;gu(&XH<=+GWwR_q=lc}dI23S4>4
zkD^)$i?$Ng!qY61Go!cb>JOM~H+08|lh2K{L`6!1&SbLCCb48`JZhJDv)f^IiHi=n
zu4Wmip=y{*;2T^8rneM{$o_Dbs_AsMS2oFy4F07#7RyqY;8%Av4LyB6Af8^wXqSHC
z%7#>RUWBF0N{NHN{Iex77E_R>lLW5{`!U(Xkd?khjPxld1BmL1%(Nmh4i-gu=%H<>
z{@GJ^45&blD@`6bVv>Ge13P8H<y)ruz%;Q`upnDWP*$cgGJgpAy3yid78hwxUgch;
zL1C5pu=hEa^0YCkREv53GadV<p&QHF1ZJyV?gx0{{wPngJhE;oY3bg*u7Mx3Z5M&F
zm>T#OZX(s83Fj=YEJT-pr2zV5L}6I8Q?sBiLMrh&tLtzT{<F%UW9y(~O1Wj+XGrrd
zIBn_tP9QC><D=%oyIH@+lJ+BK9~P@DPj`1xo<)lJUvU@G+$7PKB((Gs@Z85l+>3%9
zISo0EzApUXkVD3E@<jfi#664xhT$TSgdUHn>VBt$B#Xab$6uaJan82`v4oKN=veYW
z6Nu{S^g3r}?*~wDaPo|Vj`mJ2lxpxNOcq1&WoxcfJAf<|bhu+X4Ff@ys$Gkj#Fm4r
zHx)lTd_ExY${DTuTD}bhO8=fuZkJxpu&=i}sG+Pz+A;`UH<WIdjwYrUT`h!$7Q=S(
z7cM{Byc!%n&mtG;CTH=N6N$-w$~?)?gI_ZWkYheQFp;!wwW>FyT6NBu9t=5$6Ze43
z9)Iu|B$+L`5!h$8!}tW+W7+&wRZzsa1oWpN2Zt+p-ELUH3V&iJiQmPuF+*YZcRY)V
zE=G2GX6Z}S(AkYP!Q<~Hg-=GDJ~f0g>lO}HMKPJT!i&^^!=N%POCAE=&!!Y?<A{r;
zlmC9S)bvdd)fzmba(>HEyOT1y>UVJb=Y;a6gSyK1F56`3trV7uQZGk)C;VqMNBB38
zrg6c9VxozH;s?aU_sKo}w|IA!j67O$f1YtwJNkbU4%p*0#}5vd_mvS(HuNZfji?Eb
zjCYClqwJ;C%WCx8#YJ?pLg+}v$|8myuEpMc9xUO*4BEW-q>Z;VRQ>afd2D&(AK{B2
zbE7>ReA`g8l>qDbO*fHdAO#*C-{&*@`IMd3HU1Rm_t^8LU(pqRsGP9yS7z-;WAkl1
zeANo{t8afzCO*0u-rr(;!tFUZIHvs&QOKm5L0`6I@2r(fBJl)~<#!|A3;ck-xW09d
zBfL*g`D!I6>l{Zf{i1J`IqZHU9*U^{FY@Ea3K=QFTSPGcZ7olEKJEZH2WKt<n&TjA
zABm#I*T$f~e)ep9o^&Y|ET6&%kLD({=l4&(2IMHJ`O_i;c9IUce%2uaij&nV+ET5+
z-zvZ;|3m%7>+Puc=JgN+VQ`&vzM}%);Oc*v_)4Db_96?={_ia1|JDLbI^HW2g#`lM
z-WzlW-jDa>qE)}71Q~O7A&8O3n-oV_ApGAR|KG*}P=8u!%ShS*&OT0XxkMchYMPnz
zC?T!AgC#{DJhT~sr)V()lBHUTkGv=GFas>=M;CUd2hETIW+Zp^9$M`u06I#o19nCh
zXe5A<@L0~w*&n$GzrtJ6#!#!i0nR*FAD$!a#{&qxJ))*Kuq6?uv%{vDw?8(CUcB=`
zkyKLZscJ^9q%OqnqgAzYkp5mXhS2_eWR6jFWfA2aU4#@6CQrQK7hL5Fus;i!Q4~YU
ztxDzURik6K0&v$-n2AZ$ZoKWh9>yD~tHbL26q{p7J`R{SAU5?%6hvC1;GbkMjRONl
zhZ8LCi2?sE3eyFVzA6`UCxQWX<|2LX9_|6=&>U040;Cu~Wfg_lw-ZBzUv=%h{IgdG
zgXWf)y`Z;%h|z4aYabL*65oh#rC`9vAwHW+ACyjGewpYQs}`I9V>y}V{^(aa$flBR
zKn%bqdxL6og%O}$Hj@4wrBm$0d1n?Mpn2h3oQ<Gj!45Y13)uT}xveOKlzVuQ3VfYO
z(JZ{+1>3^q1Vl19Rn^!$56BB4t;tteMxVAE0Ab&kH7VG55gj3x(Ei;Kr)zWKHvx3=
zEJR?36tMt@>yzqP6C#w(J-xT_L7O{yYS?djkX7mmxCm%|S&P&i6oG#9-h3Sh#8AK*
zOZPVg464Xj!H#$k<MJxy_-(^pm6HSP0RmntFh1~W?_*8Od=@_jqG-@$kc*`!O6U17
zNhS~+jv%YDjS;ZVD#QtXLInKV9krnWP#wsQ!sCDd@o9n_pv)BlpU%6#=}Nu;qj(_T
z?GSwRMWQ7OA+D&BV&|xt-FavI^&i+B6|ezpVZ2@e{}{%OURU&uhd#Oct~HDh0~`dV
zG_fP^0fWSV$KH3Q{796&JNd$ZfB#mA0brFNmmN4Upk|2pzwr_ceLL9EK2qFQQfvOh
zMPz_Dix3Z(fD~a+#ni>p6-6{`QvARB61*jNDlCu^Eq6BMSFW%twjHv*g!~|*Z*e8I
zIEVWiYL08qwYCbh+oRDrHuHI~T9#79t1?(<xM7trfb4|C=I8-N0N!C#6maf!H`D!i
zC(GHlqA~4H%&?V(yuY!hv8R^NfUS9%$n`290QZWZ=c)%ls|QBUe~T!ZQPc=Nd>u{_
z$^Q0wGhmyE1?$}dvVNW(2xK9sbnc&z?qCEUA~t}t!w@K!;pd|wU;y5)sB4xU2{6C_
z|6A~0Ai%M}l2kGS!LeXVsaHB0AgGaZ9Ii?ODEe6QH;M#-VcXMp2h|2(qbt(_c0v*5
z_rDlreqF@X7*!PsAvfPPTMh^~xUb@s2LhNL_;X%+Hr}$?O4cZy5p$=!2i%B`J6Hck
zUn~K%^AhM(nJuCK+1koXZlv6H;mWZ9cK4IDH(jsrV$h`;7y8a%9(2@^u(#dumI<xl
zYz3FXT72E7!^<(tf*WZqhkC?U7_b{@rw;_cc-!ADu)O}b#!hFo1bk%Y(jNuz8JW*M
z9szpUDFJp?7T1|lht2@R&T3PO*^0t3wqRmFrv9e<!c-Eb3o$?@+<U6-k2j3jJegm7
z1i+`zOF~1@uajr~zd5h}x#MVd+G=VUp3mpEJv`9(UDxn!MPnRxn~dBgo8+ls{)aZ1
zQ_0A^PoVhHb-CE^49ea}Tq;^zc1u{))8Ek*6P(Je7jNeQxc8~&*+{d?4hB^Sw)opS
zuLe989mhJf@yS0;;!n6mRXIFe+<sa_L1KwhOz-L}&R8#7%qzf3iPdkZLLOHyXZ7af
zw1w-&YT5i$J0vlyu8O-a20nt_;xf9viZqs#QaC9dHYWO@Kat-Z*tE6gQHNk(_^XTB
zLOL8p!BUlxebemmgx^PXRZ)lVG2Yj8{J3W$``xFtD&8RjtJDJz{lD9U!zMclpjO=X
z>YyH<Z75w8aQx3XR)WX`JHdT0s7C~VMe~k|cIMq2@v~od&Ay!}@d#e5yeE<1C(fqL
z0tE30Z@sisMfYn$x0IUv?fHhE*y6JCiBYhhPZ_YEdj39VJ!@>|u9c4{g2w1Hi=0))
zU+ybFP^4SOXl!w{ERj;E)+~k03+4Q2!uo<~{XH9fzWkFW<b0jvRR^e#Vvw=^FNxE-
z$JRqt{YO#Q;)8z=Fc=9CeP(bbtUe`LY>@@ji4;NY`hr0Ms$6<p63!rIjk0m&s9^8D
zC}K3t`)pW#@|L>~LMrJ)i5>YjBRL%Lw{leNCD4n*smT<Z$bD-CcSd3nf#m90`HB9`
zT3qj~T%l6Oc9|dx^8<s|r9ZkHg>njVNGw(g@bb6UtNxu#xl)+cy|cBT{k@Dw+|R4u
z9vGra(;O;ZVQ&*j`h_mjt)VUuICfkn&!@-wE#iohwQ8C6(;(Rh>ld|G9H@mlLhg(|
zE^5pZ@3K#;w~U@v4*#8IBiluBrGvUw-noD>_s5V4P42c^TJQAPSn$}fBcR4c`H5rF
z2P_E+Zj%;=nUf9?m6Fmfn4k)O?5WDbE!s3EYKi6V_y*~@uh1!cJG8H8y4CS4M(TLn
zRz#sPn+s)wYsP%8napO*^sAP^1ua^6*HYa3d(P*?R3W=*EpV}<&G4O+xhX)}2peSL
z@3bx65F)?U=k10>zb!?<&9wb!14YN7$?;2{@To%LI^MWy(I5SC(%Tueu<J30`M9(c
z0Q0(`?aCQ0>dIu>qH0F4Ad4l93WZHG?8!ok{iBptk1!^g^tQH^*`iAhNHW{WmO6#7
z2~8dR?}CZnA0g+P=bb5x0Vx_p5VMd>^=g{%IHVY=2DUd(@%G8)cd4YayS|+m`NK6J
zXpt*vS!MPK?>|0d5hM<KKK3aUQ941CWE;iXtq=Ci7bQ%yaD+!>?L8i|uQ}#Qp_cHY
zc2fHH0$9VA^_t?Sm#xloBsj%T_(Ha2W!9JB_k`bhyiMvr2p>jPW;k^Bo!vWNJU>5_
z^p-?ax+_yc08~E;120ze8wxg{8BDUSg#^;l|7k(wy{jd)N+}j3Pp7udeU$3=BteS_
zaiNT`7OCsbt~(a5*zevzcUnRzSI8KsLWrC`N=w`tGmN|6@`>)G*bzjm`xX*Wp4H3d
zcR~a|V4VJ8Mx&L@q*!T-xzmF5OY{&NO;ThnB>f85ciTCKcG=E-oXU8c3t$=3(=t7`
z`mu8tB_^qxXmOb*M~Lri)hGT06kV=7B|(G{i&?nzjTm860sWw*6A=T=o+{p66Z)%W
z2lxYeRl#N5U2~<pJ)YOazc>arzgM=!m}|Tuv-@@zG=lHh8TLzT4<o9k!$9>tbBXmk
z&OMCQsrzr6O-xMOJr6URz4mmFA^Zt~Br_~2@NzCNO?Jm4QXm)T#`h&#@Z6vxRZtCM
zkHuJukt*=Rro_0cjJ*73Sz0ya|K!-DI8=l!=R$D;e<tL@uybv4`mA%lfN5G5&Gp>X
z(edx$i2`bfJw>9Ns$i}fhXuH)k{yA*2Sr$yA~^&hD?0`4z)pv__s>q$k(M9IUK*}x
z#th}F+tU`!Yj4Kut%M$p6LSZB_kZ1gRdIRoP3HQkG7GYGr2(3uVR;cf=R)vpCO(*V
zUvY(QepLjfC{sDl;+itz63JS5z9$L6x6%FeJ;yl`^&|J5;&&z)m|0mR*N+_BY2sIB
z<eP8`x0=<h=76NnW4L^Gn;nP#(%6l4r)Ref$2b^0)BKE+BL~*axQiw$BWWtRC=j-Z
zd-ZOh!0^IC$}br)SA?eby5v%Csc1u9bil|Mpq>ybbgsf$!IbW;@Ynr*N<W6*27wZB
z_>xMY1tdgn4XX6iSJafnLcRZCo#WXULPdx!k9L{B3^OrnG<T)@(slVSEtU%IUkLrk
zitFm$znK?r(fyuOz%u48uFiMu%Q6>(_**LJXE5X{VU$?|EE`}00_m5ER>bv4!|`k=
z1NY&&jR7!s?;g58Z9f#Gr!0gDU}rXnxv*C*k#EgFBegwu-s7YSp$C;=DaJ$k)B5;)
zG-C>*pdOIOIQ;E4dmY73j@|dv7I{XAF!PrG^i)XcuM7qvg+@8APhz<?475+m?MTq=
zUaM!7V1Oj3Z)hNLT{N!S?9+q~(mP^p2#~x#9dvHeZ>bmua|G;`SS-=9XkxUaAyn4R
zpJ&m8YR}$hs)7&V^oRG<n$0Rl-#}rmN_af-Q_>-F6lNOBbJ>=Yy2sFVwf;$gl|H8F
z!v9#umz4&$_{)LwYs4VQ3O~3e9p+1cZ@aAnPW=XfCqMOc`<yKym{9r{ZF7tY=1J~D
zyFuE&a0_$NlOa|&S7#aGTen#ZX=#c$q3cr8|9C4CZGt%-%of34qYs4vzc4bzJl@}s
zS&*fzR|&@bo73~lHDisreRsRr^aI9~tgVn3C@JGL`b7E(mz2A^p?{>fjsy2ZqsYWN
z2>)_;yr482UP{*t*9AWD!D~!Y3#8ar9G(*pCgHf*WhND{T0iL#jy?&GQz3W@(d`B4
zwMJT}e#=g||8Dr=ynVvo@hws_x-I6*at+&RT099Z6jtaz*sP7q{!=`yWzlW7{D#=V
z3k@{FuWX+`+(UjbI9A+!ci?Np+DBh5RA`N5{Tidg(>p4FP2$67iF3pUtU;?0D7aaJ
zJU0XN;0(V=&ES<csc4yQDceOTI1v|Nm~)iQ_E~$QZSP$m6QXteub^TS3x}O`R@M<5
z$a?n{x`xeC^b}iTIm_N4L8?e24L?qO^*6aOb=t!~#~dl|LiZ+pH8l5TCyQ_^+dtwu
z68u3+0UfNi1F1|=s2=Arv5nk1!rK3ZX3UMMGqGIV=Y=9YgYD@DH_m#>e(nUuF@@N_
zv?2u8UsOADp&oi7BK~S#x?U;*OAy?gUnM?fEKMpgn!NSn=hL)!^zz5~r)B_|CE~e0
zdKQuQ6fwHoJy-Tvnj*|-62r#9u*wMrUgNfN^Sb{sCJLwg=HJ7&pNBnI=k`RK%SvWy
zRIH5W=nQX86q$Y-O&xe^r!_<XrQTH-`8vdokMRgK*F>1aSPel`qcRA8r~Vhy2Up*K
zXhPy@juzY4f=!49)&;zZ^Mwg|WlY6NljZXJI;jaH=z}#XwWK3@wcI0AO>rWJ-ti#}
ztYcVxAc^26Tj+oIQ!UYyv!42LCYthEr0`RM0b2pD^$(IWis*ap_SEEI1VFlb+aF&M
zvi~`4{Xa%T?T_t+P|2Fh+wk&Ve)85&0S2=}e-srLG=9G{IHxuw2znn?Qy5sg*8xvL
z`GG{~(mywq+A_9RyP=qo7E{?=l_hl}q;+t-TJ(iqzdDOB--5MBjUT`Tc4hDt*f;#E
z$3L<H5>PBUIZcjl=3c$V`!e$sycZ15fg8-1o*;`}`|KPwai$d;5vqTWHGX`^QY!8u
z-?F10dx=ozc0oDoS|NVX&<t~WY?`Ck8pK>yA{f`C8~)tdT>l9PQLm4ZXAq@(iH!zK
zip~Iu9t;YN<9W(c4T{N#?AH)=N|J|JTPXN*PVMNycg&$z3S;&4&jBmD-mo4Q<I{6f
zX{E)7r@Rqwm{-otgD_YiC);JkrS-JP={m$iw@SU-o$R?B?FSYuhZR>Vo(vJ%LMq|=
z99K!r>7@QiFJ*>Qr<5uI5Vqd>8rA66SWtw}h1zA7V4TN;W1gUEJaNb_@#e?4kB)8)
z<4sR=-s)h<Be{nOIgw9yi!;L?>2>JoiW03^rI-?uj<FzP6G2aeE97A5{2<GaskGrH
zyPVypuwyk!W@hGzkDF2N3Uq@<t{*<g+pcPL{G6|pHEz#)@lz?oocGlItk#y$!C&q%
z<3ACARI|po<l&%JN_PeOigmx8D}i829>ePu>>IRmaCq+!B6j!{@k7{cKiE*?IN!o=
zIlOI*ImJlNd%?R~U3mSfkS~Avbh6(CnaoC^Za2sQZy(ykJ6=-c2wzKowy8O}&uggk
z=SQ8x3xUPO=eZYw+PF8uePAj4oFCUtn6lTBwqhCfBDi-Mo=|;UOd9<Mq>7fbc9HxA
zoENw1KGWda^5K6H`U5QE+p+JwuB9UR{$onIq)Vze@sS3xP~coe0*?{6Og2wy_K(Fy
zddE8Ims1bg&yK1AtB~DEwCuvw9;bof;bFA<Imc@bM|Ul;XA2NCIH#ftm4v{h?IM5<
z>GW_$%5aGIL_0*Kl0F>#tqASD0WUcE0#-AL`{OpP0$(M6hV-3(mRj~fWB`zL4MU4l
zHkjsK!|VH}@{~_rmh|P<)?dZ->@w1vl8~_Yh#i<qbI`eg5^f8!MJo-)IPQ@j>OxZ#
z?Np;Iv99_dqYSa1)qh#`FAWT`ZL!VzX`{iiw|nBzZW*bGoS4RSZCLGo`2Ae}aZPvU
zArNo%2xt0xxi_!qs&Fs_bapD2zQYDZ<M7z)<Q-S;lOtEPz7Qbk>gq0IQD=G0r6$ak
zb~3Qdq^_17M3Sd+H89to`M~2{@o+_vM3fM<uidtfPgHHt!(AR9AG@abu+49)D(s-o
zUg^~8NtHsN-|g;5!Bgrp-uW7QfrJB%`Sl|vZPnA78c5(h6f58i_uswwQaHJ|)a`WS
z`33`~ny*x&2WV0=%rYxtH*RNctolx4-;T;gtq5nO0(=wWaDTfiW296ug=FAw`ABV3
zcm9*A{@$mL=+iqcpevd$I=%(x>Y!FTCnrlY{AN?n*?VS)Xu8kVVQzuZFDpDK-0AvJ
zJ+{(gmWa>H7KC42Xo^{a2$93-PZ$1t&+r(7#duXO3>xat-_nRBQ$P8OZ@bBb=UBY_
zXG$G}IFa!Q=zJA5EU<@dlZR%u8HR5+x6eFPK*gKMS)QDnjL*IM7xvhq_(xBi{}T9F
z1fY`f#8q6VUzShHjcwz&PntXO-R#o=nc+qthQPk*Qpq%x<i0P78<C^dN|kW;)%#ZK
zYv!i80zBo}r_XA!pk)e0!|mlD4M?Z%F;7Pbsj|dzs^^%{0hTWh0L(p<@-d8WhLR&1
zZarl{nH{Yr_m+ueCz~25ao3zNpE0-9IrwT4Bon?rGTc;sS>A?bMhx*C4n%k8JB0;>
z2kcjO4~c)P4^xkif~KHcNSkdGUOLE^`WUWuR6GfM&c#u1+;La44cVw2B~JEedA2Sj
z$KlD2f`%p=v2_%)WaoEky*3v%4a}*LRQ8uo@-ry-YHdv}gbUT|8+mky@2qe1{VTup
z!w;0CS>RW{%4;Mq(@17fojWYoqBIk#y*`kvGqA5Qy!~ib^lhswrlMw)$jx8&pG3Kw
zgCgURJcvkG2Fa19fG$Wbha%!<g@rkZ2Hwn@_0du6pOAivPF<k>PA|jX@R%JyjU7fe
z{MUy7-~mQ!OBUKfn{;!UC>Lx=YZU%tqEuAw5!@;A{mptMFKYTaPA5;cs<&y5)OWj(
zz;p8~oJ-L$iBimh`?*(}wt*pM)w&0W)SKDXGljXP;}0v9rX`GzD=XmQ3e%}+^0c3q
zO$oz<?apc-to-4o!leSL5Y5_i?e9%R9_3Z|-#cr~f`A6q9+Pd--wp64EH?SPNRAL-
zzd7F&NZek-xlS1LX}b8(HB&Y11ShL#aCAV-3}>NgYZ%FyB}a9YUD27rj+T~#6_buV
z6P!>B<tVm$*C_2p7KKo#rWjxF=gvTNgsd(x0PGi8M{=tsm+fr_8O(=o1}C)8+}%rh
zucu^U0A6m+j4QnHp&`p%|J9DgTw<We=me6<HcOV1(XTEGpR=(?S1gvg>X|y`bC4=B
z0(c3_Uly;@do9_GRx~7ZuafRNpT>{6L$OabLtSg_|5yc4yVC8(qL9~EUZ`adiKKq?
za?eVOi}3-0l8GeiBD4W>xCr3(nxM;RKK+j&KoRF&#Xb^uORkW{e>D-n^BhF5<H#ir
zA<F?xN&I`Uv}wK`hvL5U<m8zwg%yDwAy9pn?Q{Fr(2~=+qW<&`f6kED`7Q~Osy#y;
z>E^5+sZ?8!zX4WHc}<032VR|_nOVKN+*OxCG4dGRn}6|DT=|YE)+@I#9#@)r`C8Vo
z$b{&NA*$I5*sxKIiNb4U!3_ECbk17;a9{_H7?U7o$ub!X<E4u)(K8(dh6|=Gnb;T|
z9zHO_uCaR*U5_8m*V!l$Q(Lv`#o6?hw<a@oDk~T9#BE7%N{JkAN;ss8Ki!!gg+dKl
zl|CiN2nqmUYjj3$Vw)(*AMG7@VkRdAox=#%L={rfijjSc`-5{J%NbPW?~5j@;9T_X
zEt%2XofiT<>6vjq0a-JnG0-&I+ZR$kAUI?yJRNznvj2ZE(~%$u>o#MWk<-jL-|l~U
zeAZsP$k~7e`!RDTcm}fX%^ITBhTsS#IL(F($EF6EZ`~hCF6{kL7C_RrZ>(78V&Ky%
z5&et=?pKRbufq#jLA2sd2_nk&YL<JK4Y^|c92WuvRD8nBHO-=;Ha8E~{qBQ^GHRFp
zVY7%5?|s4Wu(UXpB|kIFF|M$?7cO&K;GmVo%Jpcr8Ya-Io5)f(P&efF!i@&QU?u>+
zI)RtuH(*grHkV_0-#0Ad)bC5;R(V&H=XS#XCPUG9PyUpJnihK)zG1%bOpO47@zAfF
zK3)C%9QygGxmBg3sB0JVo8=5+l{CgP4@cnVlOIIjGJ*rF5pmxhpkvs<4hb<8u8C}A
z0k>lq6D<(pq}4HmlTO@SH<s`|Hxim0Ye)PcG4#GBQ6IaUz}saad5?n`7H2#61zAkO
zk>DSZW>z*D_-J)giT|-+t%W9QsBAcwc%nN_o->9@k-5y#eZ4C9rk9Yps<QG~#59Z3
zaBq1lcAze%wL<@q<m$0as0pGKS3RxNnun3qRy@64X7_#Oy1YGnA`>?AoB17>ug=N#
z3i;*p0pVVZv8My?dDyTxw;K^jP-vc4;B%??8S}zI`I{`S8ddOd1YMi-@?^4`B30{t
zdVu;1e}7Qd(;qJmK|j?~{VzuRAErZBuu${|Pla_my%fUkIXr>(GdrYkF1no#>E-0m
zxzZ=G_a1$!l~?{o((p7gux#jIQMX}VllZ!%S@J~mY7!st35f;gLeNd-6;ji%5>-b_
zJ-I+AiI4WkfBucliC_~M`!kwFkHt3n-@svkM}lD@BQ(!<wi_9m-R;-ChQ!U6qA{sl
z8%{VHU+}0d#a3~#&N|NHbdeD7O7*u|B0R<P+TXHh>CdJ=<>KRI3q^94wkKf(i9EJ3
zaUOFkg!CEE2cf^FWep4`l3^JfY3Wrw**Y(DW@6?JS>G;r)#9Sn{=f*iU|TfWM##Up
z1{6aT%B*taq@phh0!UiPIz|&jUz)(ocJZ+Wfu<Lz=CD%F9qw*EEEAph<Io_e#B@H>
z)PIt^*PH}Gj~siw5vSc39)8)q_YX>I0+Pv~SDb58EFCXv*k%Gq+B=1PMm^SJKu3SV
z1bmuCX}<HnW}@C>7w_yb*Q%G}sC^s8T(u13@v(Yy-mD<Z4?=TpgplTtgvBber?Pb1
zBf*L?hY!3Dt*269)slBDLv|!M-x*k>7&a!5!S9I0eLdb=n(<M;CLCRfT%7lBIJ?WO
z*=zI6RJ)0HcUo>TmJmz@Xddx$2z6XcSo!d|tZznw-Z#oN7;71O&k)~!SfgM)mbXgf
z+_0yDwX}HVwcCqx(GUU?ruK+EB7-Ww3c!j-C@}Y@4ZYd+p(Yj<7FX;Q<t$nBRUg&|
z=y#oHG`>AXQo<FWsm15jL#?fNoT)ny#l0UX+`BZ2Oqvv>AZ$E$zbo&q7g3BE$Oxif
zj!p)BpcVZ~CadL=Aek7RUP21B1ohBsnqc&zji2q$wLbqzFyfc>dbJuSv2uEk#&c@;
z=5zw_kaep7v%<&MI)J$XPU}#x4Ae8%zI+WXuPsYg_o?sX;}ifJ5dlDRcT8^=M;VB$
zzbE?kS?8Bih?ZEO%=Yy$o^-W;E+*h6&9{(GE8_S6{N^^G$Ea<S0|OBOuNRk|BY!!J
z+3^MX3BsH&`-}rFF8XTRh4_DzkN=;pOoUIStc35W&IGuMJo$!?z0u+plXIm1=jo2;
zXj@5yYjXYXKTCy;YBC-02lE`g`>YxLJIcG;CB4~Ch79!2az^hp^sCkFDv#s+vNkzy
z+UIKuK7^SN{mjSlL?nGVpigvdQ#RyygMryw6i>6|O{hYSM`5Ey%KeE^le{wJSn$c;
zU$ds-Z>nv5rgsE!R{RH;q_gvd=?vE;naK&s42qJRhZnbI3o2)`q3<6-_}JK@g`>0)
z-v>>4_LPHhkC0|tEmHH<sp(zQ!SuzMfeX2;=turwpmUF|va(U7L0CJ@=<;h7*7}0&
z&qnOL<Kd?7#|!pz4TRRqJG%^xM1H;v3u#^iiwwSC;lS1~U<Bx}{H5byAm8hy&&C(&
z+=%rbdCjhQjb(UQ_&;(mbUO&j;PJ5G)X-skfuGeyoHg;o&?VA|3T^W?%V$i^z0_1A
z%56khcdDKwU#B5r0wuF)hBX0SvV<U##mU&|i~I*CeHN!k%4#R{4HGYH_7fZ@e`+H^
zv<OrzSeE-ANJdOq!@|jR>e02&v9j_@2^i+E<N8k#9JDpiq>Q@|qIKbO%%lRj<0Md}
zmV)5BX-(_KKTZ-;^d{wI5~3M1d$qgc7sF^RzB@7m@>Bx5@Dqf>yN9UwslKa%U+2p?
z;qTKt)F*k><pFtP3SfqNdUtbvtaTw534-J4*u8IvKaGdEX%XN(i3RdJVdjg3{KorV
zdrWKLyrbV34uXZCMAaJO4IzD6Qg$QgY+@dkxex`jDXzzdz2LZ{@$!Ot>}e%0oD28m
zfZs7Y=FFW*nhg&tZOrZv`rptTF|_|)Jl<+_NnY<lY6$2)GB@;i(_N_?MYZ$3n3GFJ
zDUr6VEIN79H-YvzI$4N)G__FwlZ|y1mBl6*1ZT?2OsnOm8eI8BP_z4y%(keFwog;C
zm&iL#eol#KM0Y&BkZClOCcJs-r$DKl*N!N-$H!#SEq$7P+wCCgBr!||FAL_m9VBxn
z7IyS-F}i;1`k+N8!dsKdxpk}k66-<ARRhfpza1Q+|N2g@uxzAM0fAFI*Fs2MUT9Pg
z94A;mD8wJrlBf$I6MS4=*O^tT(5JxQ=3<&dWCmO6f_o6|x%|PToy|?oB%P{t?e65}
zo{l%pDtig7w&JLXAfRwszig<lnwcCIddCuG65(N~Joz`2;k?1#RX1V=e6aPt&qukT
z6=o$O&g+l9W=Gh?_=|7C)i|XYAH@7WfS_Xt4d`C7n&5vzOoFf&n0XYbmBibBt>N$7
z65?neLur&RFMgq1m0!DyU^OGdWHDH*^}i3A$)vTZSr_Qtj9IuLj7<L+)Fs4+h-WZV
zPo@GMdiyWUoL8!&aCifpYq_UDiH_KFRPsbW66_;2G$o??7#M@|diXZCc4$t^weE)t
zVSgOL7{G2ehXjAdrP5>;bZ2#W)yawKNs8ISD`F8?EW%+R5^}qLcd*s*z0qcW;^sG*
zf2h=MeSH3P94HFS+hO2;kP!H&!PL)~^QB&|E;3nV(QI2TOa+Sx9c&|G7t3YZ7VXB<
zl?0nbw1bH6NZWv>;>aKo3r|u;hBGetK%3;cmz5gqZcbYB-U4U09mQg2>N&2%c!J}^
zKkNi4Fwb;loIi}LPIAFx2mvLl?F=Og?<6TpcB5R)(2Qa@^M&0vQY>}ArSHv@)N@YA
zsQN`EAY&Zz_QG|??-*Q%a$#8&2x~JBJsLy)v$IA{=ssAJFmwnRf+wjq8{-c-bqxsd
z6szB5cE#>LaB#@ZetZ}V19XCUwjSLW7EUCciVMLEl3+DDQT-feE#*+kbOPDU;6eI@
zG-Qm0lD05tXoXVM7z21nnV5l(IR>cN8i5A_412cnU<MJ!LqlmB_Fq6Q>smZcDEbM!
z0cTW~8Ak7<wl&JYmGU$Y{PE><nS@|hjW<`uVI&6skP9Uo0`>)x0_G6D7XAq-A#_Qb
zdzgEI{QRLritrT-b8T>Z@(c``98ZT2D)5N+yIrGyoj|ep@b8@pz1894G(6xKK(l$k
z3_wkrcDu#_7`0mKy$2|`)Id?qh<)i2l%zwO;}?Ou<M_WTNhBTq+Kqt~@{KX-=m$5K
zAL<Y4S0*NJam-{64x-4a?ni#Z%FBmFWsSj@DHw-QY^r`Z_1%$d+gySSzbPPIj)Eph
zNzDL98+L2HRHR=Di+^Bmv{l?%Wz2j#N*hgk5G45ttY-$k{kp2vf#qsd>)ogQ-2c4d
z0fkYak(K$pe3@JRxX<Erng+F+jILQ{Qra6e-|~vHhTs@Zh((>~Jz1U_m~E8i^TBrF
zG_`7}+X)a!w7a%daeFfA>t^u9CDaN8B^8x)nRP0w^HtG*=Lwfn%F*;`Rdh92PdAtr
zRB1{4)>MDWzrr!otB)oj?YIq}urf7OY`yUZUyp{uP1K~_E1pGud#5%7Z<Zi!9YVX=
z-r#g4xOY}n2Ti)-b6Q44Ca;q^m)B%!#RbND3~it93|{8n%0o%}mdq*Uw2&TXycW(D
zT#~!fOIehwnNpQPut;UvJ_;KMVuBMTkCB+7k$A_s(RZWCK+b!E-d^8({M*nSwoV^c
zaukg&`iw}k;OXZV_(Ki}59;n3KK^g(&p{t!I%ESIH|(tXB>5`;sxy7Xx9WNqt(b~y
z*!!5Eyu_%j_nn2(8-s5%jL{GO(3P2_g(`hX+wO94d4{yF1nMsr<F~$^rMp&%4jl{P
z;&gDDwL1)t9#nnm2!@8_Y$u(nT*h4v<u2UO`lSG~wy+@rHlJqm=|<ifX=Lc@_;#<e
zgtEK9HS_0u1_;2&!d6n+b9$?)K?{o^Lpif1B;KN-w5#x@n7w^JLQ4Wr|1wAT1Od&3
zr0N%^Fb1h^)V@DYZSVPB4+-))8)merA7_HoG=Pp;wP9BCJ4o&h7tI>*i49H|ti-*C
z)$@0;<yXB|b&oCfLO<`=QC_xo1!9e;E}4Gavh!_F`NX2~L-|g?1tUwdd{{pcKQ?_-
zl?+UD>V2<98?M~w*jM)E>FcEoTuco_k0pY1Df&sf0Z8-0Aog~WinB)rfh|XE&AmWs
zNrYf_k552*0B%YKM*mX3R(a%uR!YvyNlGBvQ|t}CB$YE<1~++%6zCAoh<dI4hOe>2
zEUt*W&Grfh(sC`RRo}hpF7x#}31>$bxsGXZNO;7Ibl6n?=Rxj23OLMXvQv?RDk?JU
zj{uLqwhGD|S<wL}H1TnLSF+O>#eMKuKjyo<S!v_GOmhaNm4RNUKvw9%AsF`QkfYhX
zWPlI-z6&@$O5q*>Mcz%!tM5$5-oy~9O^&r3S<du1VO4O3T`ma}JY<a!;U7C`&ASCk
znP@BNGIcN+yVvwMR;fscJo_<(LY?!~QRZ;o77!svUIjj6nX+jO24-S?d(!lKAV&d4
zJ>-WnbHK=Z@h?_SPgWY&$(g>Qdri|VydZSlph`}hWe#%&C$q~_y!WGDylY~GxdQDI
z-DGA1wfkB1?+!gE7?m5dvJ}z6!~GLw7S#S(_;8_USY#?U>bw2<HY*TOl0@wGsVodR
z|A4k?^(`+B8^cfW93L4;EQ22re0hKUQm0&_LDE8<y4pm7|M0+F+}aKPDduCy1T!J6
z-SU#Y%-Bl@{Ug=k6)2vs<yuGaq$?2I-RCE$iR)EQm&H+nf*iwWntl+!-jM8OS@!om
z*rY<tu$HA;w-nCyxfs6UmMYxCd|LEz5;I=ORF4^V|3+!}=8(5ljEe;|tF6w#)c7jO
za+dmJr?Bs~n{;#3i+lq^zLOO*w1u<rh;6<}A;$m8S*_hIJrHWU$%_R5Uvmd<+be~&
z_7gvb<Y4bjjYI)GZLj$v_Y$dKgj+=CE#XVPs&=_MsKmoeB$3^M$z>o1QepM}ba#|x
z{Y=`0(I400IQ}h<pOCG-s=)T&xDbJ*%X7{YLIyD4Yezh8)hQq|%VRO%oXcPSIuG|U
z{_<s_+pA$aY2r~8@*PgT;-Ar2@->)L1MT~6$4)2>g1!)USqmD%zP3`8q33x5Thphi
zGCc%t48@JnexwnMtgdK%)gomcV>}8%O5YE<&(id(!H3@ifE52mU9wnjet>&*^NiK2
zwfT?+T-{o10topIolWpKic0jMHT8xoe+1mg6_rYH>N^NOR;bh5MoZ?9#VA!4bVA(u
zNGI8{2dT5}OoM&=b>JOK)gJwF2T=BFt;2mR@6xu3BcZh@2%ik_5XZx1lD7Sf$VsT5
z7;kqBJ<IXBx13TV_V?3p>2J-i$ArmbQ}G9pKR@TD2XAwDoj5g!7NvfK^V(=j?+UN;
z{<dGhw#EGBy89=_{s8F)^2dwlOgrU6{#VgJdnfb{y=!U~G@BUjTe3QlZ`MeY+ahR)
zz+wN~1S$nAeht3|qo2el<BSlnc3JER3%IP2I9uog$+_tshP5gZ-JO3Y9hOfOV)8Tu
zaBD%4QerZBV=Tqd+QZ)}AJ*blncOnoew#FS1Bi8)mksfu|FWT|)LfNR?}@O;&cCvT
z@gHbu%J$G`DtW*C;>?e2Gg=>YpwY%m`wZ)JQW8VWs)w&v?)l;1r1mX`=ST2L{Wipt
z+7lXIXI`KM!!-=bS5d&tZGN+|-+0zBAj^h)GvNJtkKvoR=8P$x%u@r^6ut^OSGNwl
zSBRD>pE?!muZ}FDjV6`GelhBAIBOu%^uDKsHKbXcmUU2YyZrh{_m>lvTc=dWIx;i7
zXOI#G+##MCHFW(qf0!XugJIRTtN8{;U1JcBn3&i)^Uq+^6&`gY9c;R^MWgK|38ahu
zwVO|!{q<Gthc+Z_3lL1XCgE+T9I}6)NLFU@>h$>dFBf%C*0+YVi3mDo4=|C;<g9Rs
z<P)07KSG7y+krO#n&M&m={#XMjb=r3Lmi)bC$^-)I9lq|L6cF676tKdSaLoH;8@n4
znWU?KsyMm~R^;qo{~>~lii&86z6y53o!#uoz<C*$#v2Ra_;kdb=_>$sM=gQA&x(Zu
z>1ZrM2NVexSVWF`80;7k@7Ge#E(%J|lg@VUxOjgS5P?blrdh(dJ;L-=Zu-zPGYZ-W
zl)laohke5Yvm=w@p7Y|tI^B8sGWk!glWzE?@X=^6`#-}#IA(a_dL_N^Dmqvpd9{1p
zM>;SfShm2sF01e)Q%ic6&Vl2SG`4vZSe*W_M@M$IasNDhCVRP_>Tx;)T>65FdgQ9h
z?;_P~glCcUE)}VOlP*SC`|Y3TJ8)O}?;`cOx2kev-~&<4&VNVi>6Ek;c3=3#2FtgG
zc`S236rd=b`9-2xd?cT7+Q~(BFr7(v`__$szUg5$qbtvRz~DGqJiw>=Vz;LF!i4}H
zE@4horgzl(dh3T!kl1L3uz2J|u(9_;n-ATzp@Yt}OSiQ`o0VI>ARIlzi_p&1K7gJt
zvU!2%17FKMQ!*|hG8@m@Z#)?BbN&kVkE4-tM63c!^<PxNwR+?gHuL8g+#}^0*kx=d
zU^Y;xb)`JpM(tXql?T5V8kn+!6bL3?{M-A;jlzBEgn~TvVA*<N$4$tTMAz8pRH(Ue
zWXcQ+1K$^$V}Q@NPec!3({+)f{h4kV&42BBF-X8X&*QuA!8+#sdT2*hd_8~|!c9rl
zcca%+c8*$bI*e|Uf8=$2uU~IVV>zZXj*=fn@kyW)fxm(#(Ic1FFg&}YKNiOvz~<Fp
z>D*f6Z&;3&L*H?rW|<f+n5ljMGZY9pi;x0&I|2xQc?ANEHxR9U&Cz5zC44tQ1Hao1
zCtacm8!{*f+QU3U0Xub6=cNZlGxr9?oAYm0O16ibp&5N-ue)O9la-GGl4b{5!js`v
z_9{Z%QsXPS=nXhRc3p6`gg+eC8%NZHd@hY29Nt|t&df{o5O))A!g0VVKN7b&_+9uU
zxFaD%YyuWMTz^G@H;1rx5y@WojnoHO?A~%?a2Df$LZ)}7hsZ|?GH|J3W!N3-MN*D_
zOHFWa^m{&Ls_)rO{gkE@|B~uwi1rNEj(m{NeNujM##1x?hGW7w(BIO>Nkj&g3RhW*
zJ$8GW@5QZag??Iy;p?FWJpQm;3%!8lM*)pGd2F+4!%*6~h?7J&+*m?^7$<F<1N_LH
zv=R~bOMoxc6<;9y`K?x@LIg_5bjurxpUNBk9^x@!Y2aMllurklZBU<nMV&WzGF}uC
z2u@LZ<<s{|P@>7@O$;>tU8%2nLBhQ4i+E%IPbXIz4u!&nMaZ6H85&ErOpR?ABYW3Y
zy0%INU6U{_S%$_sRK}8>god${2w7sX)YuJU8H4P*?3&3~iV&`QpYQ(o{(L{a^XHuR
zJm)#*-&vmLoO6~sCQhfha6rGp4!&OM+QozUTrLW}Q5fmd+sw_i^RHf~yB6Xm3m3f|
z^1+ei$yCG;FLDg5*XNo7kG&d;xT)e-!@YOmBBds7)oEQ<SxjldB9&`TG)1@th8@K2
zI<w3rA)LJpaC^+&Y{inR0u5DOZ1tq@+qtSEj?SiQ_qg)G4b?HL`uReli~ScfIgL@i
zNkSQPL+UdR{Jmnl#keXjwEMbueKT`SX**8od<8sb4)LJKH7Eg6GAAyp`f;6`XXEQ9
zgIfETVX82%Hu77XRt7eq_AMXOOFnq1+?|rW1{(~Lb4&N6QRygGhPsmWovB0JHut$H
zpF4`O!Q$RYL=xbgPvO{P9j9&eiyny`_!Ec+$TTEZ5c&EN#K9Xr@2q(<=cLfOj<OP)
zEfk3M#?zKxkHYIY#aAmk&T>8UiQ-U3gbU-U$K}7}KNn4qAi;;=v-Sx%=>&*!JsL-v
z0pFFfZ<1s+t8aB-Wl%oozvw-G#z@8eHud6u#O28^@c@jpTlaRDo6@KBUh7bA9>tl$
zXdyj0&iWoB+?}TOYlMSHtI<_j@#F;*8z1kH^hlLL{^rUaOtfpyt;nu7y&Z-XL6)EA
zcJ&3Qi_Q(B`%aeayLIfX$m`?XzE}HK<OB_UEcUzvp?=8HR#VRra6S}evrtDDe?Ff5
zy>5;4IY^{6MHp3_GP7GrL*yR-k8Pg!kLIR7=+R-IqV90?N}Z%yfgkF4j!BCqVJll?
zkKc+Y(iF?E%(DfXYgf|`%O&?(!qm@*4cZHa+=9{Gx8WMsxi8lgY6A+#Vj)9+NM?C`
z&MZ}DdQana;K4?{kZEjw6QpcC7VQ#J%YS(BSVBJdw0h4vRlpCvL7mfhWl>iJq~2KM
z)!h2J)ZGKubKkdeT{8EOy9n}0-Yr_sYWN+Ih<^Q$pxeX7^^we^bu!qQFnXrUTQGAs
zzqmU9p%NVOu;|$CnM+x?AF#NH6skxfVCk5WxIfiZs)k#wUNC%XC^&8tr`0KCbu6@2
z+&NjAZ!=R^wPkgVoMTB0*Y7=tcoj%!B3^zegw)p<5MU%ge=k+3kz7B&)D}`uVeB}{
zsK+L<AgdwmGc^JvfwMF7SH4&ne)5=F;NFgKWNm+r%5xwC!k7mZ%+uQzKXw2xQ^GcB
z(1hXphFNwy;z+*g#+s5x10A3Nv2MP-hmN7>K?BnC1)t>&XAvIcqteHRq66P)R{&yG
zI{aH4l@Ab(<A?Ji@eA5XZ<p^oHv7la5odyHoKoSBWu^K*t5upae}|qbB2w*+*;J@?
zTWXMQ@zyVl(U|LC)(Q*WBq2}z=Cp<A1L+jfIZuFk(@}%H^R3;Z3HkamkkwIDfT^30
zKL4}EBVhZA&sV+G=-H)Q;;yitQv;ZKnqb7J;OsuFh~ShbVs48j+}OVEWqR)e`(voi
zFr5r1I4b;-XoF9Azg^nVw*M(?HCMK8%}vz_9dQ|YS`najK?c!lYYc>>TPex9AKqAx
zMLEsilzaTro_|*^cyLyVcuDqsL*)4uFX@6LLuHobU7`j=?H2vp0LVOLTO4_x-xUa7
ze?}-#%W}|RCl8U}@;*^7#^SQU(Op!#_~uk3?6-$EIP&^?v^7W`p~yJGZTV`)0=-_3
zz!LjgcuuJG)5FyJHtyFCVCS8}(dUd2Bh~_rlf$hM879WOO*6N1$taytM3hzs55x&`
z_Lo7}5OA08ZjP(58R%UTPub^*uBpgL7c9XhtQ7#A1!=@)eKC4nB+ABoNXc^AO1*zl
z{NlTlCt6c_Ou;Q(l5f&qT10h);aSm5i%nZUsf57DCt1}<+TGOR9G7KP_rO1vrwe9&
z)g<PzBwV^yhIW$ClR_=K16g*;B6P(pmv%?_jW?&!GO5jW8!U5|bml*6VQ(NYod?uT
zwy^kmGA!;ux<!he!JWnFs2j@V^ypOmHm`)*pKr9q+sku#)7zXiwp0l!j%uR&!7=xO
zgsUM`rX)DjW!D4~oW^&mp(=fQL6E&>xxhNC2pf8tDBq?mkO(}jz%CNVX;PYzVl)0U
z&7rPPF=$p)?wz_^8m!X|q_-2qy1q*u(T&9ZIB9yWU|6I{T-~cCeEi=BpU481^L?N5
z-*i*iEEfmAu+IA}{8?N;>#G}UTiSAG&7X*K8KUvi#XdsGJZ<xub=jcSPvG}xZhsE3
zr-Yo1;;}}hB;of!394`O@);zB`cf$$7WZgj;FVv%y&0J>OEWf2>3da;n`^b}3=>qA
zN~WhnnHR?oS43cg3)g&=*3cOZK;T=uUz?{xM5_Uhd6GnQ7U#;;WNkcc)!o<1k~6Iz
zg1|cFkWfYTfRnBVy*Y)`Y8fm1497Gp2brUyj9g>(X}gU%h4j!{u}&>f!L+4tt$_He
zIh}i5%AbT{QWsu+cXGbqr(NZS#D<j{@$j_VHp>zX_fjN9YtWe}d3W2LhJby`zw+lv
z!R+8`44Q;R8!zUnZGgXBn7~A@MU<u@>HWOl6UdCDi~y|XCpv4`u0IMF{f=id5JP@+
zQE-IJS+-=9PW}T78X|8C@FIODD8kJ90Hoj6$Kjk51-wC|%B)_6gGp)w8Mm8B;G%|f
zE_W%DD{5V)5XU8m&@0f)ZN}~K-!@hgZ#Co6p%L>BQ9_CEp@XEkD{8BZZfzS?^mJBq
z>vW*opF0YJxCE@Uf;l@8X7xCcLOF~^rL%TtPZS-a(rx<G=)DBq5g+M9N3PN2S9*R&
z1=o^-!XdDi`I>|dIH|&;(*ti%S#G&pxutP(6eys=ecDn@i2qzWRQzKeu7maUYYtgv
zl0lySyimv!PdAt{tLgPhHZ#<G%=Rp6$1OUhV8YJtki2=g70BQQ1)rmf`}-PGK|h1*
z_YP^6GQKwZu@Ni8;=yV&TA4$s=Mp8dcCajF!I;_!(6k?xis=7>AC2pK+g@=-lb{h0
zi%)_0*5L3`Ya1KBMt|E#BNyZG-?%hAT-MM32k`!HFvR93*K$YDxdo4#-becRMnPZn
z;ZouRWoW=&3NX#lji;m>ln@gT=~bTRTB}R^7*#MLIC>b3Z!xE0yceDRqy(El{7h)z
zq5c(|g;7Yda;>YX?R4;zcBStZ^aHwTGDM^cSCSC7B>S&NAhswVEl@B6ld-eCig-j@
zT*guzMky-*&B=^b&FzMmxTQM|9a@<<Ej#a5Td%*TnbLjLKcFLfvq`TG1T?WJ_@K4y
znAvhtsn}=A)Id!IFtfJWk;&ie!{1-K{-s%Z%hP}4<YN!%qLTlcZiM)lp7>>E;x=H}
v4=7-Y;(7X$@82N*&6UlV{6RtT|0osJnlQsmryfiw{|&DjnH!d0LxleYGCY7F

diff --git a/doc/user/admin_area/settings/img/classification_label_on_project_page_v14_8.png b/doc/user/admin_area/settings/img/classification_label_on_project_page_v14_8.png
new file mode 100644
index 0000000000000000000000000000000000000000..4bd2e7d389b06e2d2bd0d17d5de982cb85c2328d
GIT binary patch
literal 17728
zcma&N1xy`I@GgqGLvbtaTHLL;yBBwNhvHDQI0tuk_u_VNcRjc}2e`lgO>S=T@{;!^
zliitQc9Y%ACX@NTjaE^TMnxh-f`EWPm6efHgMfer{byGrK>s(gXft>JH^EqmDT+Zr
zG$bH{O<@1?A>GuZ#UW~e#Has7L#QZdNPT^MeSCa8JUk2z4*nN#b93{tIQ{wg3BJ94
zd3gaZ0l&UJudc2}Mn*0#FF)^Z&d$z&K;Xs21sDu|e}8{|eg@BsffuHBcXyAEkEf@n
z_xJZdkN3edqhHtO2L}h&*Vo(I+eb%7A2(O8R~L78cW-ZRPmhncx3|N?!%t67udlB@
zK0f2)<7ug>>FMdQv9Uu#LnkLEo12?sV`KOC_g`!CrlzJ24i5VI`s?fK1qB7UxjFy-
z{d0A7RaI4;oSgjHSQHQt(9zNP_3IZOA75i*qlAP+R#w*X@^XHDeo0A5MMXtJL&G~5
z?CI%gZf^dyxhy0k^l*Fg_5Ap7b=lk7TUJ&kD=TYgXec5gVrOgX@8>5bCRSNl`L#O7
z!^87AKdq#s)ZgD95)u*^7^tqUzPPx^%*>3Bj~^Wsm7JVRO-<d`*T==hwXm?j%F2p{
zh6Vrt>gwvGq@;|EjRyt>oSmH7+uOUkx>i?LKUQXEW@ct*XXE4J!@|No<|Yyn626vz
z9v&XwDJT>a6r`o4>FMdaIy>Xy;+mS8zJ2?~&dweb6x7nvLPSKw$;mlCKi|>OfrW)t
z2LX|on3$51LPkc0fQZ=B(?d&3yR@{_-Q7JmH<yu-ans#gR8&+|Ri&$|Yi(`)esg7I
zW!2i++T7gC$jBHG5z*e(78x0-rKMF<Q}a4Gn3R<CG}Qg|cpn}f{`K~1V`HPKsR^nn
zv9z>2sjmqA{d+wvL0(=SJU0mq1M@yTa@AT}4gqo1(eSmi+6)2lwK#QLQE=W|-6g?Y
z1p%?2pRtvlvJe}#nh^Q5GV`^+*}+NnU%nMVK-~3r^r^`(F)>YfI~|nf4*t>}w>Nvf
zzk43(eYv{q5Mt?&79O!Qm=E=P9v^6>hU=FXY$k^2*Hazyc73_K{kpw+zBqe0J843N
zXk)_p`273=gAdkLKwBF#{_dYAM_UW?cPGbV{k;v9<&*AqR|or5#YL0<28;~!7beD5
zfz#u@o>>qObE6|)!(xsQ5abZDl42U(>lax;3hKJJqso~jtnR5bqWTzHdfebdG7|ey
zZKkm)A_Ns@b#m;a)LTXPkm~Bmh%@qlGf(RuauftKB*}56u#{K)IeOAH{oE;JX;82z
z7y}ru-!n4W*<HRe`<|a#qyR|-<_ceH?~1#}xqeq2&s-myZdcF{|6RoYmFh325AObd
zdAzv)Bg<XOvHCNCWTGE?Yc+T;5~Kf+ehr}AjB_V5Zj#C%c1*o6dpa;NRg3=mG|iSN
z-@8kcq`=&O6E%oa5eXy;jSv5ZKjow@&XN#Yyr(LK!@LhCBUqc*5ia)MMhM4$a!LS<
zreVM&Ol$(S*$zQe^#54_;S%!@IAxWm^q_<iHwy`4IJ5cL(Suo)O_sf51QXd*(2?tN
z?qO&JM!kYTwljOHO9X}1n)G^k&;1Z#Z&#Z2spDe2%<c)?-@UvII}k~j*3S%z9`Kl<
z-nNcK2+}5d>wLlp=>zCo%e8$xM9WBDTVqO0qfP&*L3WGl4RLt%b<!U5Yf9g_xWAv=
zS=iBYbGm&rMaOiJKC(xm1@k>3f0N4&<MDD8^!%6Yj_6cqE-ffj7k*=<1m(H-)gb$i
z#?Uk6AT|WbkH&eKN_DL~Kp7%`tGf~1lLHe^x?hf%8w+6jdAr}+gE>@HgOS**olW_C
zZLawzH6r+7(z-=^koVo}BWB}Oj=xQP0h?ysvCILe4X~4>Yw-(gr)Vv@eNZu`YW$m{
zT#aH&gd0J>I2(}Adf!eVa6YMYPeOW+JHja?iQZ?vs+#aOssWg>+89E+**b!n6I|YR
z<U@Gmw62vT4e?cHxYyhJWd$p5s(IOc*0!Qt%_h$|Q`&$2#6#u3M!mm;0r@x_(OrG*
z72JHwC5^V&`nr6lOhwM+;laCKwzsxGzCX$ND($KaWtB>FyACPQe{AR!|2zEgDgXKX
zzA^`pn;}WHPB5ZOuPv#Lqbxa(;FOHXjx%iC{zFl%TpBkM7ncB2S5nvmZ;imUdm$>A
zhW>CeaqMrI3A76L0n=a!-MUgIh%V*<j#}!WxMAV_pRz=+PE~819AoNtoOw4QF#_az
zeZ0|mkAKcwSf=I}Ea(v!h8SUn8oqFcHMtrjv~@A!wMpP(Ym7GEvk>xB+cvz1#+a>s
z8!#u?VFBK7VtLmX{H`?A5CdOBau|a}R9-m-%njr2PzMi$XU4+!I_M$OU>HPxJ3UQV
zj7%^qAN+64PRXdmo75!IlM=O69A>*XDA^{I={OrLnga5DEdsJ>l=%jIF=_1*l-*g_
zc&9E5y&`dRd;*#}B<Lu#Z!6?xIygf&MOkaovlUo}Vi{i5sOgt~MrPdm-2UlF{-uJ-
zyj{bus%eVk&cu(ibWUqtwa1OH<9J;Afo4}WIB#Y3Bi`nmQsYv;?46%X2VXI7;m3#$
zu~v3XB&vNGf4Wr#Y4*ZUVi9NT0vc*j0c{SN5Fa1gNl-)I2%{H_?D{Plgsxr}E)GIB
zH&^6zc;?Z(yS048YTu9FR6IJaZC8#h5Vd5=%%5mj`coEP+lZa}91?z=VgdPZFPSSi
z5i01vlk)r+EUdp#Wi2pF9!%oExuIU1Ls@?^xty2TdK{ff23f|nCm;017P$>GiPDT~
zl{@@ipfk*4fU$VOl+vx%N_rBGLPk$BibC(K9GmyWwRwdTrmHPyoSK>XAuawfYGI`(
zo-eFj1MEdHv6V6***T!*^FtDnXOom^N)};`%xa2I^Pr<LR@`<IL~^tw(>gp8ePcFn
zChL7#qhHmS%dHkJg+cr5HFc=A{~F2z5{0#<_Y@6Q|D++fM)n2;+xf`t^lVD-`6|XH
zd^KG(&L{j)w!EmNg)UMmN;SaGa%1*-Mn@C$zR1!qmX329xhm`}pw_;o>;aKEN@{@m
z3x^-U4RcyQ-ZqaodKVXziY8y2?Ze%2Z@lbWShVu0Vj}_BKH9(f_yKOttZ${*<WA_S
z^#4*XT`Fg~cHewtCPTK?=w+iE$G@-okt00?(P0EFAyLB*ITyfi^g_ziJl=FR36bs>
znZ02C7K(()S456Two43+V6~)fJq|==AN71y*$)=vTuc|{OH?1YO#}HTI_n~-q@ut^
ze(xs7Qsac^oe4%5jJ^?g6|<MxcEwi0mCxrF;5{|svt|`HXBRoSU`cE?4q2y!0CBEP
z^z7!1Q}YLZ=&CwDh|j|ti*~<Kmh)nzJ6~fQ68xqF?u0$yHj4-+dEv{|UXf=Br~Lvp
za05H86KsneOviW^&*x@`G|(GuGjc=18`h2-V_oWZgrtN31*e&0C(>?zpF7+*aVNOz
zS69v@?>pbijvv!1MmI<#0uH#%W)3BJPKjL;#e0mRc-t~?!#+d=OS))FW%cXKE?&pl
zm#ni5_x#_RTJAfl9g*quo{vH=f|=eN*&1E)5A)6M*-6Y}<&hQzl)fmRyaS~pJ0Oa6
zscSCc2w+kfTuvQV-<TQVHlh?x<FLoQ1iMR9kn-gUgu6Iv4bfz6-9J#bDZ4_j+%+xs
zWjPt@=J<R4Nw-Swwa26G8=alLCGZCI5q1!fQ@0%nX;_yXi>Z`0AB+s(iqZS6S>F4^
zd`Ij3NgMls1#@W&X0cmX7XRT+m+<nQ6p#H4ZW;A3ed4n?e9_+%7Pvfe9>bi^0{?P{
zRGbSvn<nPVby!fg7KEWx6cMBl&o}zk@@gQ-A2%33&@20Qa4#dMKC03Y)4^AG5~m}5
z<QVS+p7Po7-m%TD!{pPXuYB*8O==yEX$$>f>Z9a}^nhH7Fa0_JrDF>jyH&QR1;NDL
zFiX$3^4ecm{;6Y2Ii2t)$eM+3X^W?M*Ymj(FRl+TQzZA7uuA!Iuh>{jCZ}urAE6m1
z^1|5^fl5wpB_mxq2E5gE*IctU?2t5pRV81GUhq&Cm#Gv~F*#6vonqeh+-*X+VUL0G
zI~rDFs!NG0hWV8w&*gkZ=>kM2I<~UqcVLT8Z}?!R24lJj8h|rWl=sFXx3dTK=sxSv
zInnNV6Wj03N8Iu)`uwO8W>{Jn=p-)ZiuL0=uqxqSc<0DZw{ph>2ofv;Ov8CMz9aqQ
z#FbJNoQ{Sc;Gl~fKNWRt($OG1R)b&PDP$3LDZ@yx5M~+1h6^dgY9vW8mxl{=rc{P2
z7vc5Eh+4jT=+@Y+DCw4U8Aj#TK89EdY~jr9?LkvOk(h|N&&@Bb6Kv$zeBJhWK5hEl
zLk*i!;5<GPU;+7_yW2OfeYSQwyzbn0kKrSYDmH<qf<I?{Ff)rTK<-Aj4E?z^D&l&f
zV;!q`lvgt|A0+&3p5_f@tl2tgmv2u$>h4Db0yq@yob;b--rfT|dW34U?YcG`y&5>o
z+}gHF-GU0;=J!BNxP|wPRoeRcQ>E{g%l-`&wQ0YqJ9MlXo)(R0`LE4qn!N1JWzC#h
zmd#23fdwzzJZ_p7ZCAT-$ibIhUN?hJs2wJ17BBXF=*KnT6+s!*rLJud#o=<#F9T@&
zzQ<>Dt1duBcORVMBvscVwRzG+AZOf+%Vi)}|9gpSL+rO=#8u^iXoC!XTBOh0)=ohI
z((bQRv%hL;#pkYmIyPK3M#odT%X_%y9QCio97d3HZe{&tl8>27#gShD_O9*u{~cnq
zE+*W;T(Xaa&DxlPDi;|`dm3SK+z2AbhoId?I1?I&$`4wDHR5vId{Y&Ry9=Sv>N-rY
z@ZJOY7weqQtuF5amOTysmmdSpv?4OIZUn#d=5dfNTqIEO=f_c=BawM0d^gbJZNZ`i
z52dYls&nmCGd=0@)Yhr)+VOnPJ+LYp;oa0YKqA1;OhSIS=9(+rk%x%M;utX^ExJ@d
z669su_(NB>y7c&SsH!LH3I2;~SucBC5mk}D%HsENj5?@ufN8%y+|jArn-fJ&Muh0`
z>IXepw=L_dTFEHPbv9(ud34lZdX7PA4&AsP^+A)wZp+t6=R9`45FRRfCd2|yXg7o7
zT?j>Bs(^`|>u{w{NMbVuCb_rI@!`BTLRM<$`C@f(PF33#KXLlv*C$|$poycFf=3C4
zdI{rAZ*#kn*LLQO^SYR(-_J=?bi(dEp^pAJn~3hj|57*O&W8yn50bYRb(v)++gB7V
zrlo|yii5n7!R>CO&y`=hW}=2y*a@k8o43>Pid{!X6RS-aH95L}XDqnep*S)Rjx`9W
z3m1x5pd{=v@-K+?fS-8(vp?Xs^A}*HLwLuvCh}qSH!#5bjdA(Br-vu*B3(pRr{~o4
zek($+wMm+iGtF?E7IEqoy?P~^NN<CA83+_GekACsZkx<PjYGAJTeF=5&{{JsFK{h)
z<t%T@*Q{jKr9Xxpw*A<=WIjK!E}y%3o<R*I8j@8{!BC*02RRDm)ZjSA)4#yl`A}iN
zQzfHI!j1ejsW&!>Px}+HM5cgP($A<0g;@ZBNM#|qo*|R{OY;aB84H4no?$<l6mKjX
zemE?$M0DNiuHPjgg)b63bRKR_haoE`pP@@C`4hT8f4)%m=ep~>?+`pqB2!Pe<lQYs
zK|XnuIWsy`T{Al(l8CH-7$JudttKKFC0=7XuGX=0D4gaVesXqWy^OFh6b>ZB!65mM
z44k6i`df0^R8%>ba4orUd5POz!hLReci^X>NMA#fCddhA<We%!A&z+~z&CT-0DGTx
zlE<qpWBpHDDK}XjO_OR+Q>l`%RRtH9=Sf^?+T?L5Mu3ds<Praq`?O?$p(0tI<<7D;
zcA-;sOGXxp$D-Gw-r0lj&*W1@EZL}CC;a#J941eRjNMR8#83lJZ7DlTEBh0KrRY@P
z6CD~+N`?j23jyOsB#Iqr<KU^bMLM~~_P)?HKt1@Spcs8+ENOYTWGm<PtUA=RTL<&m
z1|;C_NCI56oHd*$01|cfVz?`b>&E3ibowsmoo{n75!f~XYLLAm4QB{FKFzsjGUpDP
zn4$;$WSc}yiF7yOeD;%El60^lhxQdLUKQd9v!_@EOC3|T#&G`O()D|&BPZ2u-7Pt~
zP9Ts@kY0g#n}MsFIKiBdR+dOfd=sPg2`2a>Ts-OX#7Yxuwe2`Sgt;ZY)X@>>1GR4>
zy8K5s{8(#2h^>t%RJhtR8fISc-i=sgD=rk4U3CHP;iy%Hpx;T1R<~yl2wL_0`uS6&
zbdo7+4(0*oXp_3{s(!@40yoJUV~&)#3Y7kOqvIld@hMIfY4hfp*{@THu-b*}zOP%m
z5VF2rQ{oC*Mf_fZ^-nj;3@;as#hc@+HI_x%RlHd8P=tW$zJZ+`={lEx@rze(dBz7K
z5Mn=np2)K}`~9?F`7?CC=a2H8&_4_1_n(Z}y=-Jj56aj9TD$o=m16{s-{O(fe*-hv
zlEG{?h_=LHKMhV<<th;FDC9|Y>LSPye*eE~AH*NB-{doh^8=(&l2YE32zUM%`9lTB
zzq|XPy<o(0@#@7SFkr;~KQ+*&SA9hIHtk6VF_#C%$1}f}=jsDA-r+@wJ45nYkW$8x
z`1bLU<XkRj2VzXj`18O|Qflv1BGD>DipPIT`jI486o%k~Eq845If`(G{P&+gaJ+Y+
z+m2uC4GzUvx%5%eR6xSZ9=&AZ9Gb@rXU@Ct9^Zd9uyDtBHSY^<=KJq_U>^2ObO*xO
zCOv#a;e~S2F@QAYyh12(y~W6pTDpL;{5~XSn+`i%V()52K70k~H-B3dooH9d?t!(K
z3K3EamY|wok(`__A?qIskEnUv!#~&^%<kh4m8QqC>)#T7q9bs`cmPFDGNFS?Pk9zN
zB@OU8Q%hriIZx{RWGW@C1D@~^ozjc?u((~no)#OuFB7MCQM)6R&NH5-6f6(1JBgK0
z&g20J5H_XD7Jhup$?<1nOKm&)(x^b!`EKav<EtDVleRuT|Cv<v(}06g`cNDTaT#*X
zY<Tv|Nnut$R*fY0MoXeMq3+R#oa#paKC5-$Qkl~bn~KV-O*#b0e-)#%Qefn17iwi^
zgvELd@?sLLzYlK)vai+mz1oKv*FHVC14WT~*t6rag(*{wZuc601-GL|%VkPGdVm|X
zka}zsi);Ga0|kZ$L?xH{PT6-c*vtfI{5xn&-<1Esdz+Aa2=F`E9Lf3)OUF_VT@!|!
z8n??MKB)*Bf#n6lRjd-Ln)0TKwkNB7?aVZf-&N@zOfX+n&^fM-Cs4dvGLwWkl^aCx
zSa(vCK#7IrrkyFd%I>|<+fY~)SwYX8It-e3-=cA&3tx}z2g$xta_IKl;rAg_gTq7!
z88!dP_R3J4_&?D~f=op!aQX#!qm9w9qv^7Dmni%w?hcq^pvW=l3q-!T80piZirLMd
zq5yRzgT(E8ENBo@cY}&4lIYUh*!{&+2QW=pbSP5gMCq|AUL?Rd(9u~ivXT_6`f4=4
z-H=K;6^zj8a=FX8*?e9ris<Pc_CznZ=sw6|@*fB}K2}1gj7al+JGuPKF)Q=Fh$5sx
zDE<m{`LWRx<5EG1rSeMvATqh&>j}!)*9BllSx+B#6t8oN0Q<;v0Ol-o-T)je(ocAU
zhr!TdON82?Drpl{gIigWuT?j+{-coh8**B+v(0GvQpIJB&AK(A8JHDJc_lb4;YLPt
z&vEW7I=5dZ@HBl-Vb%1k=QsFz@o0EXTrj)RT>UAD*K?Q3jd7ws7GBAUD!g-bX3Idt
z1R^BC^}+06*j%4AU*Zd`3&A_+CgoVPjcYG)QS4F@h?+R<W;9V{Hh8o3z&}DltBJPR
zac!#BTGB!iZ(p3ZVKb;wA2Dl!iKByCSCzyzbOKd`7W=I2&Zb4{3Jk9-!9^O~69u47
zjMqBeb}rkUdM=c2IG|E05=J(;MQtaSZ}=|!>Z#d_^P4}bHexVw;1O!zt#rEWD<`5t
zq@dD%fA3kM4)#cW|MUdHo`8Z3=qr_l_RCo(6jxn`V-^?4)Q&Ysm0ZBwuKQEPF^ga4
zGH3g{gn<|!L2I#5Pf|uppF~djpk&AzCeUS+(?T>eNueCVbD<AMp|M^tzB50jKybw{
z8&^ktytoskuOHiQT|YoVFqW0X<l;tz{B+cJ=qGx}m!%Uiluj8Q6}bA)c-^7#wx~X+
z!>rXd@Jab0mB^$|yGRb>M+0K0U%Fs@K%)$fHJc>x@<k0sP2f!PVLe19q#ep@z59^+
zpDpAm8k#{!dNUkZ;Y{p@c_~hkZ(%9BOxM^pJb>jo+(n&~9z~sgYCM)zRK&?9>s^#w
zkU`=b66xW^Y5T+*%C?QVzR}Ns>FxdlK>&d2UQIpOe5ZRTa|vK#DH~vZx3|g#9`oK#
zn48Q~*P{6DeCrQG`IlPK0hfR2PdRFU;f#nsiD*Z)+2k<_xW}LLOcq{&#o<!N8HL5c
z7qy8+Qv$mx#teWg4#&v7>4kznXkBZaZ{P<xmbuN@(2LoePt=(1MX1^{8_CU?IrbSN
zyt8YXz_UqvaOg2k=kwxyZ-mC0r36BqA*A5pR}j`epw^MRzj%MtT457o<%X$V<t-Tb
z>Hp7{Z9~<l!H%;Krx?<z2xemLVssg4Co7X1DkQK!>dqBeFYX<1pTC%_tFl~)gOGCf
zS*hkmV*th(eI<QG8gQ|p7ipnd)?%X&2+&im*p!j0md8T3T8~!yD`MwD&lTiksTo=3
zG2+KL<a5V`L)<WRzYhp`&=OguF<3$weI-G$(E+lWnSXPI($c0zJls1arPlDZ{~0qi
z>;Ns`vDgQ_!tFz_K9<#5(f&(BgcfLp+D;AKHgLRA3!__y49YiO!=xF`o97CaPn7+I
z79+~WZ#RV3+<?!-Rou)|vr3wS27AMHMvn&ngIUhDBR(xh;fyW(MLE&$hD0=aL_$@c
z7-5x5Zj4pJ${0>iDpW)h0sX@l09i3@mnKSZ7J4aeeRp=t?@wMQAvkt<dxE{+QQs&1
z*id6~zuwXtQAbAfmTLr#+2)J97l-`|v-80%rKd1LFOOa4a||;tn@4Y!gXYJ3j&rV_
z>?g<3G*rpz#tqCgTXy~l)YfV@j(PJr!U5oQ$NiEA+?TiWPQAhv+jzlGP-!Mk<3;r=
z0@Q)7u#cWDzCSxx?UAD`)P?<9jhzx)YNfS)d%@q*5D-d;5NIH&iBcT|n1+9$K2*lg
zb2%4f^0G=WVV9Of<6?>oqiR0EVXgo?-RVW!!(UQx1dAuQGR>vo{#Al;H#5nBsO6Lb
zTw<f5EDFEsQ%M3=q&BnxZhct}oe4Vd-*^QORSQhF4*(%4t(}vclP&z=;wuIpKUctX
zN8;^ytRNey$Sg^J8xtsMDW7p(D|w06Q5!}$_vF?7LDJrLs7$jwkkTPobmk-T^vS^p
zOOmYOm{ICIG<iGnfMmeuH?rQK@t*(DJxJv9<>}Ixu@Btr$^rVv%&n^gm^J}+g-ON?
zaOD$rX8~#Gi9uhYRZY?xWtZ${x2^-NURK23Q)0jx6G&a}YiZah(GW2?nBX1ZRe?@>
zE)0<56S+XCvk%^mC@VixfccF1W4Zi3878ITrMAypckKR!1(9$<>DT75(7YhedW9Fp
zyJ_S!eTml{3UG~hAMjFI&>}M#<EEsVm*t2Jn%aQ$)Te~*ihu!H4C<<|fir~W6fGnw
zPJiFKC4k`djlA?pYtk-_pJn;1s!Aj9Mu~)D+)9^o4s-F{ikFpk!TpMQbaGfTE6m6I
zopPh4Q{SvQkh^AH#iVZVc#U5-KtW$?EjH^{nc1&TlM~~wuc#<9!wYU9YW=Yw5HU#i
z<Z@qZK)n{t3O|w;^l05;a-o8gO;J$VqwJdCh9~gB>RAoqr42=LR2Y*1JX5kX4t=u&
zuLAAEPzN&jpqNdT{%yi0uk$o93r`*P(ujL*;$PbENb)7jhIy-$d#x7%SQ}JWNq4)$
z9rP%GKB$;#r1pDxPf-EDsyCxz`IgIJ|G?X+Qr>r|9as>EWab;Z(l=mPf-x6M)O<oL
z$X!iXQ^=$3_yWL5-ik&VbCv8ue|=Ktk>>`-(YV=7C6LGxU$!CW=J5`Bs8Ew&+(k+@
ztc`R+$9JMpjX`|?fDBB_UK8LG08y=dx&O4A!yh{P3KZ_x{sh2O<AkBe?z?<FlqOfT
z?TF1-dp2*Asx}SeemNFkKL&Pj)NWiC465XnES!#93#A>|P=1;Nka>aXd_ZXe_F7bT
zk?e5_p>4>csBagSf+2%)w_uhC#$);MZLmLTdM@LZBlUDF_GZg#j!`$Pc&%hvbEJJ%
zLFT+N{?TTYNdN2QHJ|Yx7hwcfk=__z)N^d!ncVmFr3$sS3JnLtN@*gZEj-v~vN1mB
z<Ws%b%(GvC6e3Szw0nS%O}jIJ1kNC@G@67dX%|vdSROx(iB*Zr%?-DqAzQTIW+9<B
z<;-d@)#KCw$v$A-V!up)^@<Y_lv#?hY8?_e$Tu56nfq1&_?{5Q%+k=R+pJR@p^`>E
zcL4Z{EMQv46zJ&*40?N|)-x=)iiuvnsfGW#_c<!|u0=U>VR=(fXdpCX_>MOd%l6AO
zh{+X0!cZmAj~bm^3XlCj!uoFY0c)LDRfMR9v=k8r<x2xlwWs}Hy(-+pvhPn4mn+Br
z8jL$JGr4w{Ny36L#>+_(mA&a1#G~-<U1%Tg=`g%hQ9Cq(zLj6kMGJ^mF7(Uvym1=w
zmG6Uq19j^(hnUEZlXLBTH`C?>>Yi-kwd?42)c~ybhl`#s6(~hrc+R}O|A!syP6!Z?
zzky7~<+UYe@12m&xw(+WfIrytCr=h@=4*7j<Kst52_%@&-+ZGuoPm1pPKErzl)gko
zmR`n2&JJ0I9JN5I{5wj1N~{4q6=@tM<dH9Vly|dObqp~|$Q-`u3oDS!1sIDCO3vit
z9G}wbxoE9N{)gggDNYvL<JGmiZus8Td;XRWxs~={S3r&f4=P+DnU-e8!O;?F^v7;z
zxSmS=gA<29kq6jIfPFvWyWEf8-}r?$y1S|WPNeF(B|^KnoclU@-Q-r3*Di)W<9Atf
zS~7n3`_FgxeaU`dvhO#V)VFRwyZl5jC_iqg=5qFrFT7Ek)wir+c6p{++eYrae>Tb?
z;Y{a^zVdr=BVbu@c4^;m$oMKYmF$e5dc|iWfW+OIQ=)w49VYz9`L@=oWK}0h7!T8o
z{&JZ@tYG`B^GO!qW($|zV3|cL2or)jZvOmOR-tm<O`!(dgXguK#})1$+|f-|>G_Vp
zl6*5BgHcM@@1ME4-Vh+Y1<t}*YH|O2*H!<Uzy5RjL4*W&p#A1T;sQ|biR)VTO@tOk
z)cG|3m~xGn`+2zCUw7601_H$TbZG{XMg*Ww{hwD+7?;o9B!aah3!JmsB(LK>n_i4=
z>Z3!2{GcLfLuuS(ZSjJiYF28Z22w`5p-i9;8T08QBh}rTa)4i(a9q}Gn#%d3@66&S
z$Ah`otuqk$Y>t1;ZzrZm%bxmq^DRup7wEbbPh`2-;)yH%wyNi)ubJvt*(3`A3p`h>
z{Yg1@!kh!`RTf=w8S>J2b#4M!;lXT{I;d6hCA;FvBfA3sYY)k{BWrWq9t5(RN@9mN
zboOq9CKzscV-GPjw-GH`$ZyGy2LgQ-thWsHYBDL4pNnt~`Q2NH^m299<t;L;GdYE<
zhn_;V6lHqng?0}%ZT0^4@6Vg%1sFyD9Zoc{A(V%lv9FsE4vK9G_|fl3W~ehLtFEqN
z5EtTuLnAQ$mdal`J+P-frJQ!ZZ}U%1v97cGp$nRqb?#kkx5I5vSpQW?vgikNTkz;G
zpDroW<1yiuI)?R`NCxv+aEM-O(y`rh%fekFa%sbj&|Jgh++w!wMg9Nb0`$;ro8_@?
zQ=-db`tW<tfiF=6gFvyZ8yX5KG>l%xuzAIAaLw$$Mk+WQR&b1kt!EMr0c@odGR1o`
z<iGvhfw9p-IjM<K|3Ncf(e0DWvy@L&CD@ZC0XFWqw;=#`Fq8{{wYULoVGFDaC8nCy
z2Wg{h)=jH;oksE_!!Ea95zHJRmh6l#dzLlw>mgR0pEl*I@bGN7HL$dk*XJAB8x_+*
zKB7mOU}3-x48}J&*DIY%nF4VG+iU8PdB3+D`G-#)gYOfcY#p4ELOz3N=80}LhrYzG
zIVb{<ds~s^aLjzEvMql4qC>1$F1rPBC+80$VW2^={SChCO3hmPirNzw0L?gn4fMf+
zD4L{)YbWFd0rIJ$_)5O^!M<AOz&n=c(5!hdKA7DICxWZFPPhO~x50)?9`&rYy2edi
zOm9QUoYB5jl;#Qw48Mb&rz*3mDY2%a8D=U(cV@i+hCVi|Ch&}HZD60kPnxJGS-Gig
zr-D7<20N=P^$6}&Cj7MfES|%V=^>~1ai4$67V0l`>(#rrJFQ-5M*s#fD*>cy0V3DD
zSEjT`Zmu{P{5CtJYfE#-r#U%Pdd3=7k!G#Zm&HPl=UMnlN1JyIE(Q;@t>FFo$C9wC
z)j1G7RQP3~qF8){1Bv_EysseoxMJ!i`-R2`!jdgzk5tl4vdX{@CKJ3@%UA5H2rokE
zKx>2OfANH%QQv3hKgR0WKKK6w1D2i*3Ho@NHHH%0y*qaeq>R~fVv1v8TisMZ<3jQu
zr+ACG_vD?c+DT~CxdxO%7XF8~it=*XCB(heU5M0}n8XFOi@JtFTDHPLot%%7d{(>F
z9#YlhL558tJ5I2Xya^V3J7`XF9Oa#})j+hfZsI4Oj@nydkJjT3hL`VLZl43#Q>g<(
zP#zGnYWJQ7YXoDZfJVUmIv8La1>}S630hy<ZO0_kRA|z)TJAHOh&G3`n6aC6N|yFt
zRpTVL8eC=qbzYBm;B<Qk0(<mD5?DVz<>~BuQ|nW2bRW${>GK7;$qQA~Lj*5KOe-{|
zjM8ael`Z9)zRQ_nVEbU)CDBmBDdBF}&8d`|B^?*NfeYDT>&s$NgCYsfedtxF;GV1K
zv5Sf&oWn#1w=>jv9g3uCs%|F41I>R%{3v^wE7~VMr9Y;f;2Y>J!w<7ekhl+}JrxB$
zz8`g<KSUTRbDt0H-?W7mr|2CN9)mEF2q}8xG>-Phd3UdO^W}CFcvr3th<`BfN;*CF
z+!^xig{rkaOSI~scodn>`sct;k@P;W{q3<90ma4jmK1|C04txJ!CCeB9nXKBo6bb<
z{<Q_ZQ=)xhvW4J>h}6(xkp1!k+^@QIN3AD)Qhw2fT2O}$zy<Y(kkZj$8rqH?my@6h
zwr)iMN`6Hul=uCLEbxS4hVMkxYA_c!Ll77aH7{&#TO+<QWULJFv*0fQQ}J1mw^+f3
zsT0NxI4B5`D@Q~fs2Q98flp|qB>F3;z|U3-$Ij{`-l=2MG^NEq)}~4p4-?1srGthS
zMHgOmz<~zz8S0NOOEZ~(yaQ;7o!0Z%4#E_<4v@*NU=_fgzR=F910$t5D>q=p%ymRI
zm*#kbS2BVGMGUkqQ5xjhx}~ep@euf~X0Xi*Nu*Me`0i5RgA#P0aC?<-JoNi>UBdCg
z`HrD!iP0a{+j;(;a-R7CdOy{H1nun7Y-BZwQowy-AVH#%GJLCLAIs8DSzpj00G<*^
z9NBZTw(p4`VX$<^xizHa7b7k+Tn4_^83FAALVg$=%AVxX@yg_Gz=dx}fM<DAnlyhP
z!xjVaY$#Am#e|Ohx2SOyxW}H}HvY~HQXO#np-UfvS^K^l3F3l`Ev}@}7f~G^uZ~!=
zQz(2kR2R6td9?f)+WR5|@viOFriSfv3d()o3+bOvtD>W$A73Yl$mS_U(X04}=x5Bb
zwa?G(X$)I_;2;rEK7Gg16sRF!+~tn1tz-iD3P4X<i}%pkf;Ybi8Q_YfFh}^F-k~AJ
zX$<m{Kuc1t;7VGwpC?Mw2t7F=h|OjJVD<x$Zp*o3?#gF^^VKu53~~l*75zf*;e3Yr
z2Y6D6D|-jHu$k$j*5H(MG#2US$kx4>SxxiN_3v!sbaP?&GV;I%kSh5sT-BH!sb=~z
zZYb58EPnR`k}dN{PFIjJKK=5(?XR|+p{?3O_ll@_&6>$-Qg}`@dS_G0y6c&`9P7<%
zkIWa+oKcX#<v#9LyHDNrdS6?SfI==U6%{z?i)?b6!s%<KC)XADALzXFJozNFLJYXa
zQL~u}s}#qfjQcC)kikiIb;`K|gQp=&VK^y9{oBs#Wba*vf>+rUpI@!LEmOR?()Ft(
zfN8r%*)FFf$U;nc?Cn(gn(Y0HC4j{3Wf9@)&iDN_v4UwALUF8vHC1j%f-t_*7`1(q
zbzlwM*A$-xX!DaFI&u{RvF7J&Nf99D7kH5bLW#V*?EvJ-zNmVU1X&z_wl_jczAUdV
zg0d#&c|Q%>rypq?m;+?j@1Px4Hqz4W)U3-X(nLv^mcr}dd@v<$V2`8>ATgl`o1oF?
z;(5iSO?Xt0dc|m_u7)r;zlJ|K)^?^98l%Vg$EU6?(EYA@!so@2Q_qkD^I)zn1NcC_
z0oOjj4v^qXpAwviMGmE(B&gQZL&hNGri5yuD4AiYbHJO+av0ic>iLc^$F1UQsZ@g@
z1v)i&r+hyS{PR|NB%DKKi~`KB-mfx#Lp1EQr9!nzc6C_yFr1s0=8cX$03Gzf^KmrS
zCNH24(%HY_C=s|jsNv?<y0Eot5W@Vrd@>!6ktG$0RFt(iASDRqpJ|?sRUuz<ZeU?e
zdoRrRFxufZEY%MZls!9oSML3oN!2l46ZXg{8vC!l=qZx=o+{5H$-eeow+D3a2J_o9
za{+EpGc+F8qMDdnf+ck&gX-K%tF@YxfPU8QZHLo`9bL9zu2UG&Cn%0WRV2|r){k=Q
zeWME+e*44V<8Y#>E&I&htSZWcTXpZP=O0<#pqVc{&GJ+ytSYmG8g$xe7jm{TF7{5A
za@FyGM!-7mTp8N>pt40bF?Si&a#Hvnzr{vj@vowi9D^x4+>N}c>%fw0;Wz$z@Fi5h
z7uv_hJnqI`Yhig*zKqK@T$Mv~5@*9owX#&I;=-sZp&w2t{a{K1wL*lU=_OU={qAQ8
z>zOu~Z~DW_=0314A}~j(k!5GxM}BHklOMUBrc9|IhF835{B#j9@Rll+dH;PabD8zY
zUSWkO++6cD)bv3;R+%yFHCcA6^Zv(J-h6Bzzw*^Tt3d6wE3(eq5&zxL&#-+K*k|S*
zKlXXQJ#mSR84(s(o@b)RHC3nl8-L`e>A!^%B-^iHvMAWZjf1aAbU7RiD?N?=5O=H^
zu-#XK6I>D+47g`#Pd{uS{hQ*BbZL^CFT~9bU@ErRiU#A30)^ctURRFb>yl~&Ds8hz
zqaG@TMQf}i3D+uA)m~2C9TS^(9KH1GOMCH*5ylb4+mWNruRXrTOY#C=kGAG<!97^)
zo=XIr4`q1GcE-#o8O-O#{0ntMNmeoMHi<#hTxR|w2S)dMB0M}>)<4$!RZ>f4m$%Ht
z^nIt6e0I<ipFY$TZ&$ebwMge=8O~Z}eJUpNJ*+BBK9y)zz6_Pjh56UNlCLgHnwo47
z&xqFshn{x=gLSUu-$UVBal9(3V%l=Euf?QG4_3d+h;RxW!0<lwqwHqnF5eS<Q+Vg3
zw`4e%Nx}fCsLHu-14nbts`KDR2wivG?m1ofS96s;sn6@s86i83Cik>(*ABJP*7r#u
zcC+4p<&rThx9$E`2j2`FxFz*O0-Ec1XJ;{9+!*2t<S`e0x>ZmIc5x4?Jigt1`1&gK
zPZnsSzLs7i<-s2V*qVNYoab46oXV17ObVa7dnB!ioRbpaxCf@J@Lf~l#^7p9Sba0C
z3Aix2wYEj-Z-J=LvO-b*H^zek+q>b);7l^LOP3xjU-BF5ySF8#o2HB$Do<}Q*f4gt
z`I@Q#$Q->R7R#ZfjW^XUh)G#h<nTUOg7hd#hPGJJ^gh$FBA$lvW}o6a&x0yP6Bsa-
zjrR1D0Z9%Av{WA*afziMd1VTm-?^bG2-32m)tX>db_S1iZkE;NKyjU9hvD)n9{KcE
zT*Y?q^Xyb;2drNDIL21z34H00KMChCSgC>#&IAegMdtk7ULWS{xi~q*E}jb%3a95t
zEd%2ToU$0`bc=K1_2TVE*I;ubih*TW>Y^lSW$&Fax0=slj*JcShF1hPNc`8iDCY*S
zi_GXd{qQzcN*|ZJYw91~w>K9D<#&J+;zb(TB0h7qy`G={)uFQ;Wre1`YN(4cXwY|E
z&_hF4c3M3dCG(wbZu%RIsa&L8I^A!KOPKuHs=KTU)uew_6!W~%63%&rCvJJ0E$<;0
zofs<`;ms{%dqS#bI`aBB)T$4!3u+ZOw@MM<mAZkNlwKzxkZ)CpoZI#=9=R}GJq*Ql
zN%m?ecz1gkvGM&qx}_yK34_0&Kb+x2<!Gec(M-BN+<HlBgHFzDwei%$lNI_5BSJix
zMc0c^GMv&Nro1M<du8HG@}+VI+a%1^e(l1(S}`+QmOdULz?}<FLbcxUTd`^Z839GC
zl>Utr2xs6P4@b}_dQznichaJ1i^RH13A$4I<?@=F-fM*|wLWj@(pF{KzY0q-#uU(h
z?EVE^v&pqwev<Y^WEc-Up-H6a6Db0^ZjgOUB|FhtX%xpYnPtD&is*RBdA~as(E2?<
zDZ?k_)OFihDUxU_hugtILQcbn1zI5BXL-TGX}KGWM{ht5>vDAHXXa*P_ic{)HS?o7
z+j=(Ch<L&ZCG@PXkVS}6u#3}a%Ix;10(#_xAFkk_13v^Pr>ao!9eL7-Yx_W?n%Nt=
zsk?2ecdz4^-Lyvi^DbhK7?&!yQaiWPs;FPdYbMo4HhHt=3QpPSr-r~LiBS1VfiG2+
z0*YjOKCrFE%``(_g2D|^$%Af->iWpCH2sKV_Yir~{#CDlM<jiqOCKtA0L?ObX~L!Z
z+sv5uPb_PHwCG<W^7q81h&2KNEN?qp%Qpj<^i`=BG<#JK0Ocyo#=l-?7pmJl?#A2B
z!3kuQ$Pq5?@Bg99fAjBU#AEz!eW?UTs7hHM@UL7l9{UPg<8JnvYSA0c5rnF+E}xoy
z{N$JTpB(gA^^>+1FO`Z+#US+~%#C<P@M1wj&P1fe6q2Z+!O1-Qd7wW~qPfaS#`is4
zP)M5Se?OJAqt`MBR{Nz@Y+n^+V?E1T%m3hO^wRq;EBXn%TU*pgm1?;6adJQWGxUvx
z*WQ#I*HY^iN<aKb?nyUKX*yyO>F<6--0jRceXl}B;xMm=uORe|`3~4R^4}K_iyN4o
zuzq>uV?d0z?0kGNW`)B#x~JQQ<uGqMu@t`F7dUhq*#TcN8N1nJI`&)Qi6k1bJWW}W
zCQIe6|39bz|4*)fdD%Y|iW7NwvHcS&;?J7{%Pas&ChD>9F+J6#B*vkHaP7XxaS=nf
ztf^e70(^qPyGwZd{7+#em*f;s5@f4IA|-Z9on&vTvqC*Up<ISCvsCD+{Ioo&nyNPr
z>y}kn@V`GVEhVI6DlTYtgTxv5WsR?UY~;-3W#scF=2#sxQ`{^hjqjB?3Kydi-rVIi
z=L}DT9#31Pa`bFc&qP%mTCK%}P4bo6-bhT8CELNzzr5(6d`+#ehX-SDs+QK%vKLPD
zvFn8VNf*x$*@=v>Vtf-Cvmkv2RZJ41+RF6c6drOl1Q9tG*JmI8S(ZNu*(*u2=)U7`
zFzNgLSp4Y*w%0ow_3((zubEbVdec_dc6mxYq`%jSU$Iq`Jg!0h;MR^|B41xWocUL=
z-B$V$=e&r%v1+!}E7Nid+Ea@>X3A=rl-O^~UI7gkclBGWK0Ku?lI|D7k=}hB4cYeY
zJxmdI-MMLA|3g-6`VU3PS<D}MW|_c><WwUWStfFrpKU7k^F9r_FuYX8Uc(c<B<1*C
zVE(IA7GAiS`V`s0MjpAKd6io)tU{jZJ;Vz|Y%=ypN?X(hLSmJHE~<VYyauDcy0*$3
zo05I#BB&u~_IfiDQg!nBAduVu!R<OH)9-4NZzdqu?HJm->JaDJjd(Ol)&@hjo>D-R
zU}S)1t-~KmjKHRJ^32g8()qfzeYX1X)TopOH#e%X#{56v!FR48Yxf6srI6B*L?@(U
zkl-<$61B`#H41O&Yr!`t0{m;9iVV(HW#KadZ3iN~x-v&U!M`pTN+asnhE^yU+ZI;b
z;7;-D;8%QG^-nJ?@%0C}YEVly|DpTGsHI{p@x$WmU8y>p_d?EkMweC%8Y7ioEvq+w
zjpZh!ao^P>wzChxm!;J}da0MJ%4OO#2`tyF7OR3J`X9No!3LMbk$R(U_eltUhQnu`
zHkoye(9bSPqD3~X_NAr8fr^r4o8(Y+oNr#YntKLP+lN>Vkt8G^4z%OWH1*e%g>Zk6
zhKSHRZ!>@57zktLcP3dh;Iz)&O^26(my+b%X{qS^RlP*2I_T0RFGL?IuJYP9NjrW!
z^%YLAa{u_#ul9WU^fi7?Z?EM0VZFqc!K{sV#k`NP-|o7x9&3ocy{$O8V~u~sR7wj_
zw>gjVtsP~l@WOGLRT~bm69tGWKu=M8Hpdt;v|gEEAqnYNh2VV3;T1BNU964BNN_kb
zI%VdYh^jmad%-QZI#=Yv=cL(#=H2X#A%qBq{_7e!VO*0xwXaPG*pPA)-XQKLsKirF
zS-0vCbQ6;a*}cLt_J<wy2QW(a<_-j9GxpGZiA9U_(cJQkpp@<2;we4xWNFgs4Uj)F
ze@9ng1TmBwk=DoQi=~f$gT#SF9&E&%7@a=svFxfLVTF}}`eXIyHQ3Q_g;{mjMaaFn
zkQxe+C&o-J?T=kf5s*w3>aRHgE9`f=rs}`+`7`tfF3W(_u_>~e)TLX+j{Nx2^JMsv
zCX?FGfpl^!#TcUW-2=i=W-y)Y%3&gX=D$DomQ5}bd^}EtJye3$6QJWTH(986jd!Cv
zxsp!7t`~*~Y8Vp0x61kzC{hK&SGstHUBdyQ`cQVgE+2)JJEAXlx-WJk!NtQr8dbZ*
zF93tdk*4{7f$0LF71)4<od>K1wb}TBfX2yO`q?P>Up0eba7G(CtQ(#~vl!dZoJtu6
zT#7Hjj=R4=Jb0oID;~->AymQmK-h7OBu&=zzefhMO4`wTw-nM5T4kbXv8=&?MkkwE
z8Y-RpR+>9d*G!ESyU2gsHJ;EjztJYwL%KuhWQG3fRoJ}2%5S+w+Rr6(S%Y~_EDtIP
zSF#tw2%U*yavJ=>B~a`ynjq*NVI@zPWf_k+*!ccut-S~a(ZDpCKhK0dEbZNS@gru$
z=exM!weUV8ZIqF1-RiGi`Uw0+ND~wnC5TTU65}ANc;4$RKj!!2rzQQA(c6N^2gXmM
zf>msUXPA?iK*C?>qPE2@*nfAGR5xf3_wErco?ugn2LfAS?#FWJ<-My6i>}y=mL;4w
zP&;w77<sP;{1#q#rz8=6LNK_9s!o|Id}C{&`kMtWsYB_P2fZ68Hd^%0DK~6y(?_q3
z(LZqd9EqNHWkAuO{x-Q~ti-<L>nVvGiXa;SZ0Uap7a*iW&zrY#sGF$OF2zb;$tXx+
zb`KRDqNT90qgpfy8_xKkg=c-u`5{ZPhn%060M72MZ7b?)BZPsh>@+3mLF~D+T;QGl
z61G$WSQD?{&_X(+n%DRzuL{NRAP0_o6PDn3MD=Bc^9RryzC^kgD3IrTi)E+JYV><;
zTu<th)VALZ1T(^8?U*KHRiFg~Zq2iGk9j-yh_9Zlx3*x)OSx=mMLUfxTiYP|+V}?X
z9W>YdG0m=t>GrYW+>P;H4uVfuM~~F{_J`&AzFqI0^T^<Vmfna<L|6g~ciqfHA11aP
z2r>!86JiT*Y=8VQBkj8Hmfj{TQIA^AOS=u-i)W?dP{;Sw9^o<3OZq_Ht$4V-9w~xB
z@ON+7@Vcl#_lV{8CMO)^qty2bk@a2x0g{_ub4&(P^AAP=;6Xf-mCabjYbwhzi93~h
zV6IYx+yvW{xGC=BX*5ky&VuwkaHEqK<btiFlazgVbK(_8{s1H@KI>aZ^T!Wg#h(O>
zcBtNen>9QdAZ?01=&5dV*`Hx&XQVJ)Z<DhesV(g@e@qRHN*%w4wnLP7jmR+0&k#a}
zU`EL}a-jVpwuuabKOw~Gd?(vwSpJ=jL!pTP;-jMsAnT_*{c}>=LvO>(L!_(>=`MVs
zzMv(J^G@g8%kb|*dtEovzk^e*WmOP`ZSQ*>X5IpmnTSO5_DQ`o?H;UF^y`$5ehZF7
zL0g?%=$|}%oR}{BCne`v!CXjA-0I?5AV&Al3K}mZIz0U3`46<9KW=J}*kNvv#KoRZ
zldIx}QU*PxBg~{=i;O6MSwuR$XhOwY(g!wjwzM3wtSXOH0n(u3J3qgh_wE!?-t#pX
zDJdG=k=#@jBI+JGDhR%vP@l?E>$l^Ea{zL$dxAGbjN>&?Z|q4+#rZFbjxbBg9$7|w
zTAh;{&)?2Q#lYykZfI<#%%ET;&gIoDPCDaVFgS%a&f@U8M_ajf&f8hJvssY)(tM{8
z{@a;Zoj%QV{otUoiWf|M+_(IycL?Sa2%-5NWevcJiU^`C*kdJCT4oSvKCpsFiUz}q
z2HV0q<Ke{D=9pr-ksuTX*r)XO#hcvyfVV{fGbbLzT<`})K{xo3iu3-d;)U=>Xb^bG
z;d>{Or7o!Z2M`$XfxdlZ&8D{1QaW<Gm)_iz%q)wWLcK?1Q&Yf-l`z`s9i@QTLk4<~
zb5-~|vTx~7KZ?!uYTU<Usycu2afvh1C7R@w8xvcK{kVO7Pgx`U;o__D(j5}^u%)?K
zip1^U;^QnlDX$g`I@O+k0gzr`?*SZ!&tHBZ)H)Kz?)g9Vv`lh_$HpQ7v!M#d2j@d=
zUEl+#{%~Xzq-*|k;^crj@0;7+e|x`L&{Q~+fyTGlm~-0WaEzyO`H<p+4-ZiMj_>W;
zc}zlnk}{^OXJPJEmXwk3V9EYQaH>ZEiQP!7YDI|Eh7XMXjg8I)Xanqa%Z=MbXHszo
z&A@gNt$p%s*zA1oFKxKzjV_g^tN0BPxasq(ttpG6L?YXOuSsOP({vpRWle4v;KmQt
zjOoy!4t9tU6@*D9$JrAl62SRaVxSRP$beLwfm@l_3Cmb4N8ya2CK;~sWiV5{g4~-(
zgI=S@kte$Scm=!w0=<p}tbpxnidH1~%T6U%t3E#kuxEbpi|0)s-E5nLuCW7H@I7!N
zlVTQ_JQ{g}AcfLOyTpop(xuVpq;FDVB}XHUp=PScM9>(q@jcc0;LMZ-qM^&y6}Kx2
zVP=+ihM9HSkpF=6GWfSkM|(pyjyP+~CnB7Uh-al|tMCW*<Z#ERs?6G@XjBKl_sxfS
zv4TNymSsR=`P#0=vp;}SiY*pk)tXn@<bvL+Zn~rVA)lWV!$qaJW_0Jkr(HUG7;A$m
zCs8D2Spd;^AFbk!wPpG=t0*#`aT;jrLGPUB*RAlaV6a0fFqi*?xQtV8PB^@e-s4FR
z&uZ-3-TdRajHF#+#jm>OS~A+cjC1r@G~=ua-BDgWzzLTqMyT@vgbZ*))cYHyuRwo@
zvhKqlU(Jko)=-Zj7`9`Uc%n81o)#3=qqyS;l8YFaBGn|Xn7@BiF4v3paYt;vII*r7
z6#D%m+HX73uMYWjM&|2#MFpMWv8^f&t`fw{6LPdEuDl+?q8tUw__D=E-rwV(Gp3{t
zu{BCVRqNA#u2Yo~N{@-`C=iWV!^+<PrmL2!BS~$Tf&lmae{P9yXP=LhS7AunZ9lJY
zYh$GUwxb`T8bIm{WYA;&uK<z+ZTsIqF#>6LSr07Z!2f(3THjK`k@3*3msiF7WHetC
z)XV&H9ero|G3EPa2##f*H<Jy#=8hX3W0=-$Z{U{5^Sg7#Wqf!Bvt&}t_~(}O%>c&4
zVg{H(H{mmCgetNN8x>%~16Z8411xmv$>fE|V+ol8_)Ddc?gAQPKCauZ643#Q-0ADc
zgt-{2yMz64#0DTuKKwndRznx@tcrPqgY7hMDXD7?5#Ny9zAYLmaI|a?R|c@DnCIFa
zv(Vg|$8#HIag$Z1e~X<HPq5hn9Rs4@c|wZ337#y_&T}_Z&fz!<0=viP)Zrv3=P@~q
zQ5eP3bxc+l*9Wr?HXX8Pmm&nLwn1A?bbDBuKpnQvv&m@3J;Z03TV$+m?_ftoaVI}!
z9P}i;UW?_e%yS#NR38u@Bjkdqui3^#wuV!t-&06KYk&4RBO*x+KWDN*Gdi&HgPttb
zX*=nrWqeTA_0U%|o~vGJnAoz_g3SSOndft;Ci_NXb5Jb0SM<T1h<3vSwMu~AiYZ&^
zSawd)`VeCW*maFfX4VO2#3bI<F>f5G89MqOFy(fH_<Nc(*&=p~;GJ^L^DD*l{N;`;
zA*w9e=9GGwadOq&ZDQNu7wKp@@jXFG`Or_jBLUXkYN$?;pttUV{WZzQ@O~TkQ|Zyh
z67G4~$w~WTYaY)X(Y9~fR1HyaG!}wOYumd)BS4V(&-!3!-!$n1H49R!r^v5<linna
zzvZD*J>&^Hx9j(*YMAN`HMmMm<H79Uz?>&P%QaY+8THBHMYBfF;Zmianxh)Q=5*A;
z>Igl|QT>{;)ckpGZc8&S^IX}GV)IpdeUJLIEF56otq(*cFG9Q4LabI#)(BInHkGO&
zEZv4WyHP!9g0Px=Y)@;TiY~a;UH95oY_H67Bi>jn7WXHf9!CHG0mey0K~!eq>#?5h
z+|7H|G@zV~>d7h}W#YlCsdhzG<<PQggvLWF*jc5jCX1A;;9I<xS+dYAHXfx6V4K}}
zqoV;n%GCK+fry!!RHrE~gBmvO?*(RRc)0zO9PTe<Pzi<q7e&Ek>0~5vhXO6{ucpMM
z`88i$7IsNJ7q3*$go}z+6lT8VcHEdS^^t$9zw80x9cRhpIQw(oZ73CIJWnYTKB9U5
zHV<!aCQYal{}vrZ+4(}jY9OJYTqu$ICOHQMl^x=e$%F3-vgJ6gF1ybYty#LWlwO`o
zg_c&8(MI-DOlb!>C7orvU%E6?D2fE0|3XW48*&S~6xrNs`5UR+!hMiZvOloG{DrVm
zMJ!DpeC>!o?;FI2D4C#N)f$Lo5$HY77E?$!Ar*GsUh*L-JO77h<l{oF1*N2N;Uluj
z#ikZ=W>z78D>qK=_iu#4Hz`POO!~+*wE~PGlKJmga^j_J%E9p=4#K~!Mud+!*Jt+s
z7e}#+cl1v#FJWo0=1M+}b6kBFMR>o;k#QxtAn^4o9G`~Z;4Q$r0S5;M2L}fS2L}fS
z2L}fS2L}fS2L}fS2L}fS2L}fS2L}ho{{nvj<3bX$m`{yw00000NkvXXu0mjf-9_st

literal 0
HcmV?d00001

diff --git a/doc/user/project/merge_requests/test_coverage_visualization.md b/doc/user/project/merge_requests/test_coverage_visualization.md
index 1ed6d969c40..a513eefbbb2 100644
--- a/doc/user/project/merge_requests/test_coverage_visualization.md
+++ b/doc/user/project/merge_requests/test_coverage_visualization.md
@@ -343,3 +343,30 @@ run tests:
     reports:
       cobertura: coverage.xml
 ```
+
+### Ruby example
+
+The following [`.gitlab-ci.yml`](../../../ci/yaml/index.md) example for Ruby uses
+
+- [`rspec`](https://rspec.info/) to run tests.
+- [`simplecov`](https://github.com/simplecov-ruby/simplecov) and [`simplecov-cobertura`](https://github.com/dashingrocket/simplecov-cobertura)
+  to record the coverage profile and create a report in the Cobertura XML format.
+
+This example assumes:
+
+- That [`bundler`](https://bundler.io/) is being used for dependency management.
+  The `rspec`, `simplecov` and `simplecov-cobertura` gems have been added to your `Gemfile`.
+- The `CoberturaFormatter` has been added to your `SimpleCov.formatters`
+  configuration within the `spec_helper.rb` file.
+
+```yaml
+run tests:
+  stage: test
+  image: ruby:3.1
+  script:
+    - bundle install
+    - bundle exec rspec
+  artifacts:
+    reports:
+      cobertura: coverage/coverage.xml
+```
diff --git a/lib/api/api.rb b/lib/api/api.rb
index d47709311dd..5100ec9ec9d 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -305,6 +305,7 @@ module API
     mount ::API::Internal::Pages
     mount ::API::Internal::Kubernetes
     mount ::API::Internal::MailRoom
+    mount ::API::Internal::ContainerRegistry::Migration
 
     version 'v3', using: :path do
       # Although the following endpoints are kept behind V3 namespace,
diff --git a/lib/api/helpers/container_registry_helpers.rb b/lib/api/helpers/container_registry_helpers.rb
index 9c844e364eb..78daf2c8cb1 100644
--- a/lib/api/helpers/container_registry_helpers.rb
+++ b/lib/api/helpers/container_registry_helpers.rb
@@ -6,7 +6,7 @@ module API
       extend ActiveSupport::Concern
 
       included do
-        rescue_from Faraday::Error, ContainerRegistry::Path::InvalidRegistryPathError do |e|
+        rescue_from Faraday::Error, ::ContainerRegistry::Path::InvalidRegistryPathError do |e|
           service_unavailable!('We are having trouble connecting to the Container Registry. If this error persists, please review the troubleshooting documentation.')
         end
       end
diff --git a/lib/api/internal/container_registry/migration.rb b/lib/api/internal/container_registry/migration.rb
new file mode 100644
index 00000000000..b84e14c6f31
--- /dev/null
+++ b/lib/api/internal/container_registry/migration.rb
@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module API
+  module Internal
+    module ContainerRegistry
+      class Migration < ::API::Base
+        feature_category :container_registry
+
+        STATUS_PRE_IMPORT_COMPLETE = 'pre_import_complete'
+        STATUS_PRE_IMPORT_FAILED = 'pre_import_failed'
+        STATUS_IMPORT_COMPLETE = 'import_complete'
+        STATUS_IMPORT_FAILED = 'import_failed'
+        POSSIBLE_VALUES = [
+          STATUS_PRE_IMPORT_COMPLETE,
+          STATUS_PRE_IMPORT_FAILED,
+          STATUS_IMPORT_COMPLETE,
+          STATUS_IMPORT_FAILED
+        ].freeze
+
+        before { authenticate! }
+
+        helpers do
+          def authenticate!
+            secret_token = Gitlab.config.registry.notification_secret
+
+            unauthorized! unless Devise.secure_compare(secret_token, headers['Authorization'])
+          end
+
+          def find_repository!(path)
+            ::ContainerRepository.find_by_path!(::ContainerRegistry::Path.new(path))
+          end
+        end
+
+        params do
+          requires :repository_path, type: String, desc: 'The container repository path'
+          requires :status, type: String, values: POSSIBLE_VALUES, desc: 'The migration step status'
+        end
+        put 'internal/registry/repositories/*repository_path/migration/status' do
+          repository = find_repository!(declared_params[:repository_path])
+
+          unless repository.migration_in_active_state?
+            bad_request!("Wrong migration state (#{repository.migration_state})")
+          end
+
+          case declared_params[:status]
+          when STATUS_PRE_IMPORT_COMPLETE
+            unless repository.finish_pre_import_and_start_import
+              bad_request!("Couldn't transition from pre_importing to importing")
+            end
+          when STATUS_IMPORT_COMPLETE
+            unless repository.finish_import
+              bad_request!("Couldn't transition from importing to import_done")
+            end
+          when STATUS_IMPORT_FAILED, STATUS_PRE_IMPORT_FAILED
+            repository.abort_import
+          end
+
+          status 200
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0 b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0
new file mode 120000
index 00000000000..205b7080f05
--- /dev/null
+++ b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.0
@@ -0,0 +1 @@
+../../../../../../../ee/lib/ee/gitlab/ci/parsers/security/validators/schemas/14.0.0
\ No newline at end of file
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1 b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1
new file mode 120000
index 00000000000..a72e2dcf9a3
--- /dev/null
+++ b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.1
@@ -0,0 +1 @@
+../../../../../../../ee/lib/ee/gitlab/ci/parsers/security/validators/schemas/14.0.1
\ No newline at end of file
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2 b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2
new file mode 120000
index 00000000000..1cd5dc2bbfd
--- /dev/null
+++ b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.2
@@ -0,0 +1 @@
+../../../../../../../ee/lib/ee/gitlab/ci/parsers/security/validators/schemas/14.0.2
\ No newline at end of file
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3 b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3
new file mode 120000
index 00000000000..cd9ebc4d907
--- /dev/null
+++ b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.3
@@ -0,0 +1 @@
+../../../../../../../ee/lib/ee/gitlab/ci/parsers/security/validators/schemas/14.0.3
\ No newline at end of file
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4 b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4
new file mode 120000
index 00000000000..9538bafecbb
--- /dev/null
+++ b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.4
@@ -0,0 +1 @@
+../../../../../../../ee/lib/ee/gitlab/ci/parsers/security/validators/schemas/14.0.4
\ No newline at end of file
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5 b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5
new file mode 120000
index 00000000000..28c2a49e6e1
--- /dev/null
+++ b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.5
@@ -0,0 +1 @@
+../../../../../../../ee/lib/ee/gitlab/ci/parsers/security/validators/schemas/14.0.5
\ No newline at end of file
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6 b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6
new file mode 120000
index 00000000000..f83876b4f82
--- /dev/null
+++ b/lib/gitlab/ci/parsers/security/validators/schemas/14.0.6
@@ -0,0 +1 @@
+../../../../../../../ee/lib/ee/gitlab/ci/parsers/security/validators/schemas/14.0.6
\ No newline at end of file
diff --git a/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0 b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0
new file mode 120000
index 00000000000..26aa0c4dc12
--- /dev/null
+++ b/lib/gitlab/ci/parsers/security/validators/schemas/14.1.0
@@ -0,0 +1 @@
+../../../../../../../ee/lib/ee/gitlab/ci/parsers/security/validators/schemas/14.1.0
\ No newline at end of file
diff --git a/spec/frontend/boards/stores/actions_spec.js b/spec/frontend/boards/stores/actions_spec.js
index 7c842d71688..0eca0cb3ee5 100644
--- a/spec/frontend/boards/stores/actions_spec.js
+++ b/spec/frontend/boards/stores/actions_spec.js
@@ -315,14 +315,14 @@ describe('fetchMilestones', () => {
       'project',
       {
         query: projectBoardMilestones,
-        variables: { fullPath: 'gitlab-org/gitlab', state: 'active' },
+        variables: { fullPath: 'gitlab-org/gitlab' },
       },
     ],
     [
       'group',
       {
         query: groupBoardMilestones,
-        variables: { fullPath: 'gitlab-org/gitlab', state: 'active' },
+        variables: { fullPath: 'gitlab-org/gitlab' },
       },
     ],
   ])(
diff --git a/spec/frontend/vue_shared/components/blob_viewers/__snapshots__/simple_viewer_spec.js.snap b/spec/frontend/vue_shared/components/blob_viewers/__snapshots__/simple_viewer_spec.js.snap
index 06753044e93..fbf3d17fd64 100644
--- a/spec/frontend/vue_shared/components/blob_viewers/__snapshots__/simple_viewer_spec.js.snap
+++ b/spec/frontend/vue_shared/components/blob_viewers/__snapshots__/simple_viewer_spec.js.snap
@@ -6,7 +6,7 @@ exports[`Blob Simple Viewer component rendering matches the snapshot 1`] = `
     class="file-content code js-syntax-highlight"
   >
     <div
-      class="line-numbers"
+      class="line-numbers gl-pt-0!"
     >
       <a
         class="diff-line-num js-line-number"
@@ -56,7 +56,7 @@ exports[`Blob Simple Viewer component rendering matches the snapshot 1`] = `
       class="blob-content"
     >
       <pre
-        class="code highlight"
+        class="code highlight gl-p-0! gl-display-flex"
       >
         <code
           data-blob-hash="foo-bar"
diff --git a/spec/models/container_repository_spec.rb b/spec/models/container_repository_spec.rb
index 27281060935..5dba13f5d25 100644
--- a/spec/models/container_repository_spec.rb
+++ b/spec/models/container_repository_spec.rb
@@ -312,6 +312,21 @@ RSpec.describe ContainerRepository, :aggregate_failures do
         expect { repository.skip_import }.to raise_error(ArgumentError)
       end
     end
+
+    describe '#finish_pre_import_and_start_import' do
+      let_it_be_with_reload(:repository) { create(:container_repository, :pre_importing) }
+
+      subject { repository.finish_pre_import_and_start_import }
+
+      before do |example|
+        unless example.metadata[:skip_import_success]
+          allow(repository).to receive(:migration_import).and_return(:ok)
+        end
+      end
+
+      it_behaves_like 'transitioning from allowed states', %w[pre_importing]
+      it_behaves_like 'transitioning to importing'
+    end
   end
 
   describe '#tag' do
@@ -819,6 +834,18 @@ RSpec.describe ContainerRepository, :aggregate_failures do
     it { is_expected.to eq([repository]) }
   end
 
+  describe '#migration_in_active_state?' do
+    subject { container_repository.migration_in_active_state? }
+
+    ContainerRepository::MIGRATION_STATES.each do |state|
+      context "when in #{state} migration_state" do
+        let(:container_repository) { create(:container_repository, state.to_sym)}
+
+        it { is_expected.to eq(state == 'importing' || state == 'pre_importing') }
+      end
+    end
+  end
+
   describe '#migration_importing?' do
     subject { container_repository.migration_importing? }
 
@@ -831,6 +858,18 @@ RSpec.describe ContainerRepository, :aggregate_failures do
     end
   end
 
+  describe '#migration_pre_importing?' do
+    subject { container_repository.migration_pre_importing? }
+
+    ContainerRepository::MIGRATION_STATES.each do |state|
+      context "when in #{state} migration_state" do
+        let(:container_repository) { create(:container_repository, state.to_sym)}
+
+        it { is_expected.to eq(state == 'pre_importing') }
+      end
+    end
+  end
+
   context 'with repositories' do
     let_it_be_with_reload(:repository) { create(:container_repository, :cleanup_unscheduled) }
     let_it_be(:other_repository) { create(:container_repository, :cleanup_unscheduled) }
diff --git a/spec/requests/api/internal/container_registry/migration_spec.rb b/spec/requests/api/internal/container_registry/migration_spec.rb
new file mode 100644
index 00000000000..27e99a21c65
--- /dev/null
+++ b/spec/requests/api/internal/container_registry/migration_spec.rb
@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::Internal::ContainerRegistry::Migration do
+  let_it_be_with_reload(:repository) { create(:container_repository) }
+
+  let(:secret_token) { 'secret_token' }
+  let(:sent_token) { secret_token }
+  let(:repository_path) { repository.path }
+  let(:status) { 'pre_import_complete' }
+  let(:params) { { path: repository.path, status: status } }
+
+  before do
+    allow(Gitlab.config.registry).to receive(:notification_secret) { secret_token }
+  end
+
+  describe 'PUT /internal/registry/repositories/:path/migration/status' do
+    subject do
+      put api("/internal/registry/repositories/#{repository_path}/migration/status"),
+          params: params,
+          headers: { 'Authorization' => sent_token }
+    end
+
+    shared_examples 'returning an error' do |with_message: nil, returning_status: :bad_request|
+      it "returns bad request response" do
+        expect { subject }
+          .not_to change { repository.reload.migration_state }
+
+        expect(response).to have_gitlab_http_status(returning_status)
+        expect(response.body).to include(with_message) if with_message
+      end
+    end
+
+    context 'with a valid sent token' do
+      shared_examples 'updating the repository migration status' do |from:, to:|
+        it "updates the migration status from #{from} to #{to}" do
+          expect { subject }
+            .to change { repository.reload.migration_state }.from(from).to(to)
+
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+      end
+
+      context 'with status pre_import_complete' do
+        let(:status) { 'pre_import_complete' }
+
+        it_behaves_like 'returning an error', with_message: 'Wrong migration state (default)'
+
+        context 'with repository in pre_importing migration state' do
+          let(:repository) { create(:container_repository, :pre_importing) }
+
+          before do
+            allow_next_found_instance_of(ContainerRepository) do |found_repository|
+              allow(found_repository).to receive(:migration_import).and_return(:ok)
+            end
+          end
+
+          it_behaves_like 'updating the repository migration status', from: 'pre_importing', to: 'importing'
+
+          context 'with a failing transition' do
+            before do
+              allow_next_found_instance_of(ContainerRepository) do |found_repository|
+                allow(found_repository).to receive(:finish_pre_import_and_start_import).and_return(false)
+              end
+            end
+
+            it_behaves_like 'returning an error', with_message: "Couldn't transition from pre_importing to importing"
+          end
+        end
+
+        context 'with repository in importing migration state' do
+          let(:repository) { create(:container_repository, :importing) }
+
+          it_behaves_like 'returning an error', with_message: "Couldn't transition from pre_importing to importing"
+        end
+      end
+
+      context 'with status import_complete' do
+        let(:status) { 'import_complete' }
+
+        it_behaves_like 'returning an error', with_message: 'Wrong migration state (default)'
+
+        context 'with repository in importing migration state' do
+          let(:repository) { create(:container_repository, :importing) }
+          let(:transition_result) { true }
+
+          it_behaves_like 'updating the repository migration status', from: 'importing', to: 'import_done'
+
+          context 'with a failing transition' do
+            before do
+              allow_next_found_instance_of(ContainerRepository) do |found_repository|
+                allow(found_repository).to receive(:finish_import).and_return(false)
+              end
+            end
+
+            it_behaves_like 'returning an error', with_message: "Couldn't transition from importing to import_done"
+          end
+        end
+
+        context 'with repository in pre_importing migration state' do
+          let(:repository) { create(:container_repository, :pre_importing) }
+
+          it_behaves_like 'returning an error', with_message: "Couldn't transition from importing to import_done"
+        end
+      end
+
+      %w[pre_import_failed import_failed].each do |status|
+        context 'with status pre_import_failed' do
+          let(:status) { 'pre_import_failed' }
+
+          it_behaves_like 'returning an error', with_message: 'Wrong migration state (default)'
+
+          context 'with repository in importing migration state' do
+            let(:repository) { create(:container_repository, :importing) }
+
+            it_behaves_like 'updating the repository migration status', from: 'importing', to: 'import_aborted'
+          end
+
+          context 'with repository in pre_importing migration state' do
+            let(:repository) { create(:container_repository, :pre_importing) }
+
+            it_behaves_like 'updating the repository migration status', from: 'pre_importing', to: 'import_aborted'
+          end
+        end
+      end
+
+      context 'with a non existing path' do
+        let(:repository_path) { 'this/does/not/exist' }
+
+        it_behaves_like 'returning an error', returning_status: :not_found
+      end
+
+      context 'with invalid status' do
+        let(:params) { super().merge(status: nil).compact }
+
+        it_behaves_like 'returning an error', returning_status: :bad_request
+      end
+
+      context 'with invalid path' do
+        let(:repository_path) { nil }
+
+        it_behaves_like 'returning an error', returning_status: :not_found
+      end
+    end
+
+    context 'with an invalid sent token' do
+      let(:sent_token) { 'not_valid' }
+
+      it_behaves_like 'returning an error', returning_status: :unauthorized
+    end
+  end
+end