From edac28efc0c7b369406f7d40c528a8bba8ad81f1 Mon Sep 17 00:00:00 2001
From: Andrew Block <andy.block@gmail.com>
Date: Sun, 29 Aug 2021 10:30:46 -0500
Subject: [PATCH] Initial implementation with Rekor chart (#2)

Signed-off-by: Andrew Block <andy.block@gmail.com>
---
 .github/workflows/pr.yml                      |  62 +++
 .github/workflows/push.yml                    | 160 ++++++
 .gitignore                                    |  23 +
 Dockerfile                                    |   7 +
 Makefile                                      | 173 +++++++
 PROJECT                                       |  16 +
 README.md                                     |  10 +-
 .../crd/bases/helm.sigstore.dev_rekors.yaml   |  44 ++
 config/crd/kustomization.yaml                 |   6 +
 config/default/kustomization.yaml             |  30 ++
 config/default/manager_auth_proxy_patch.yaml  |  27 +
 config/default/manager_config_patch.yaml      |  20 +
 config/manager/controller_manager_config.yaml |  10 +
 config/manager/kustomization.yaml             |  16 +
 config/manager/manager.yaml                   |  55 ++
 ...e-helm-operator.clusterserviceversion.yaml |  53 ++
 config/manifests/kustomization.yaml           |   7 +
 config/prometheus/kustomization.yaml          |   2 +
 config/prometheus/monitor.yaml                |  20 +
 .../rbac/auth_proxy_client_clusterrole.yaml   |   9 +
 config/rbac/auth_proxy_role.yaml              |  17 +
 config/rbac/auth_proxy_role_binding.yaml      |  12 +
 config/rbac/auth_proxy_service.yaml           |  14 +
 config/rbac/kustomization.yaml                |  18 +
 config/rbac/leader_election_role.yaml         |  37 ++
 config/rbac/leader_election_role_binding.yaml |  12 +
 config/rbac/rekor_editor_role.yaml            |  24 +
 config/rbac/rekor_viewer_role.yaml            |  20 +
 config/rbac/role.yaml                         |  98 ++++
 config/rbac/role_binding.yaml                 |  12 +
 config/rbac/service_account.yaml              |   5 +
 config/samples/helm_v1alpha1_rekor.yaml       |   8 +
 config/samples/kustomization.yaml             |   4 +
 config/scorecard/bases/config.yaml            |   7 +
 config/scorecard/kustomization.yaml           |  16 +
 config/scorecard/patches/basic.config.yaml    |  10 +
 config/scorecard/patches/olm.config.yaml      |  50 ++
 helm-charts/rekor/.helmignore                 |  23 +
 helm-charts/rekor/Chart.yaml                  |  14 +
 helm-charts/rekor/README.md                   | 255 ++++++++++
 helm-charts/rekor/ci/ci-values.yaml           |   4 +
 helm-charts/rekor/templates/_helpers.tpl      | 480 ++++++++++++++++++
 .../rekor/templates/mysql/deployment.yaml     | 120 +++++
 helm-charts/rekor/templates/mysql/pvc.yaml    |  27 +
 helm-charts/rekor/templates/mysql/secret.yaml |  30 ++
 .../rekor/templates/mysql/service.yaml        |  22 +
 .../rekor/templates/mysql/serviceaccount.yaml |  14 +
 .../rekor/templates/redis/deployment.yaml     |  96 ++++
 .../rekor/templates/redis/service.yaml        |  22 +
 .../rekor/templates/redis/serviceaccount.yaml |  14 +
 .../rekor/templates/server/deployment.yaml    | 106 ++++
 .../rekor/templates/server/ingress.yaml       |  27 +
 helm-charts/rekor/templates/server/pvc.yaml   |  27 +
 .../rekor/templates/server/service.yaml       |  20 +
 .../templates/server/serviceaccount.yaml      |  12 +
 .../trillian-log-server/deployment.yaml       | 100 ++++
 .../trillian-log-server/service.yaml          |  20 +
 .../trillian-log-server/serviceaccount.yaml   |  12 +
 .../trillian-log-signer/deployment.yaml       | 100 ++++
 .../trillian-log-signer/service.yaml          |  20 +
 .../trillian-log-signer/serviceaccount.yaml   |  12 +
 helm-charts/rekor/values.yaml                 | 225 ++++++++
 watches.yaml                                  |   6 +
 63 files changed, 2921 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/pr.yml
 create mode 100644 .github/workflows/push.yml
 create mode 100644 .gitignore
 create mode 100644 Dockerfile
 create mode 100644 Makefile
 create mode 100644 PROJECT
 create mode 100644 config/crd/bases/helm.sigstore.dev_rekors.yaml
 create mode 100644 config/crd/kustomization.yaml
 create mode 100644 config/default/kustomization.yaml
 create mode 100644 config/default/manager_auth_proxy_patch.yaml
 create mode 100644 config/default/manager_config_patch.yaml
 create mode 100644 config/manager/controller_manager_config.yaml
 create mode 100644 config/manager/kustomization.yaml
 create mode 100644 config/manager/manager.yaml
 create mode 100644 config/manifests/bases/sigstore-helm-operator.clusterserviceversion.yaml
 create mode 100644 config/manifests/kustomization.yaml
 create mode 100644 config/prometheus/kustomization.yaml
 create mode 100644 config/prometheus/monitor.yaml
 create mode 100644 config/rbac/auth_proxy_client_clusterrole.yaml
 create mode 100644 config/rbac/auth_proxy_role.yaml
 create mode 100644 config/rbac/auth_proxy_role_binding.yaml
 create mode 100644 config/rbac/auth_proxy_service.yaml
 create mode 100644 config/rbac/kustomization.yaml
 create mode 100644 config/rbac/leader_election_role.yaml
 create mode 100644 config/rbac/leader_election_role_binding.yaml
 create mode 100644 config/rbac/rekor_editor_role.yaml
 create mode 100644 config/rbac/rekor_viewer_role.yaml
 create mode 100644 config/rbac/role.yaml
 create mode 100644 config/rbac/role_binding.yaml
 create mode 100644 config/rbac/service_account.yaml
 create mode 100644 config/samples/helm_v1alpha1_rekor.yaml
 create mode 100644 config/samples/kustomization.yaml
 create mode 100644 config/scorecard/bases/config.yaml
 create mode 100644 config/scorecard/kustomization.yaml
 create mode 100644 config/scorecard/patches/basic.config.yaml
 create mode 100644 config/scorecard/patches/olm.config.yaml
 create mode 100644 helm-charts/rekor/.helmignore
 create mode 100644 helm-charts/rekor/Chart.yaml
 create mode 100644 helm-charts/rekor/README.md
 create mode 100644 helm-charts/rekor/ci/ci-values.yaml
 create mode 100644 helm-charts/rekor/templates/_helpers.tpl
 create mode 100644 helm-charts/rekor/templates/mysql/deployment.yaml
 create mode 100644 helm-charts/rekor/templates/mysql/pvc.yaml
 create mode 100644 helm-charts/rekor/templates/mysql/secret.yaml
 create mode 100644 helm-charts/rekor/templates/mysql/service.yaml
 create mode 100644 helm-charts/rekor/templates/mysql/serviceaccount.yaml
 create mode 100644 helm-charts/rekor/templates/redis/deployment.yaml
 create mode 100644 helm-charts/rekor/templates/redis/service.yaml
 create mode 100644 helm-charts/rekor/templates/redis/serviceaccount.yaml
 create mode 100644 helm-charts/rekor/templates/server/deployment.yaml
 create mode 100644 helm-charts/rekor/templates/server/ingress.yaml
 create mode 100644 helm-charts/rekor/templates/server/pvc.yaml
 create mode 100644 helm-charts/rekor/templates/server/service.yaml
 create mode 100644 helm-charts/rekor/templates/server/serviceaccount.yaml
 create mode 100644 helm-charts/rekor/templates/trillian-log-server/deployment.yaml
 create mode 100644 helm-charts/rekor/templates/trillian-log-server/service.yaml
 create mode 100644 helm-charts/rekor/templates/trillian-log-server/serviceaccount.yaml
 create mode 100644 helm-charts/rekor/templates/trillian-log-signer/deployment.yaml
 create mode 100644 helm-charts/rekor/templates/trillian-log-signer/service.yaml
 create mode 100644 helm-charts/rekor/templates/trillian-log-signer/serviceaccount.yaml
 create mode 100644 helm-charts/rekor/values.yaml
 create mode 100644 watches.yaml

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
new file mode 100644
index 0000000..8e188e8
--- /dev/null
+++ b/.github/workflows/pr.yml
@@ -0,0 +1,62 @@
+name: pull request
+on:
+  pull_request:
+    branches:
+      - main
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    name: build
+    steps:
+      - name: set repo name
+        shell: bash
+        run: |
+          echo "REPOSITORY_NAME=$(basename $GITHUB_REPOSITORY)" >> $GITHUB_ENV
+
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Download operator sdk
+        shell: bash
+        env:
+          RELEASE_VERSION: v1.9.0
+        run: |
+          curl -LO https://github.com/operator-framework/operator-sdk/releases/download/${RELEASE_VERSION}/operator-sdk_linux_amd64
+          chmod +x operator-sdk_linux_amd64
+          mkdir ${HOME}/bin
+          mv operator-sdk_linux_amd64 ${HOME}/bin/operator-sdk
+          echo "${HOME}/bin" >> $GITHUB_PATH
+
+      - name: build bundle
+        shell: bash
+        run: make bundle IMG=quay.io/${{ github.repository_owner }}/$(basename $GITHUB_REPOSITORY):0.0.1 VERSION=0.0.1 DEFAULT_CHANNEL=alpha
+
+      - name: verify bundle
+        shell: bash
+        run: operator-sdk bundle validate ./bundle --select-optional name=operatorhub
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+        with:
+          platforms: all
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: "Build Operator Image"
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64,linux/ppc64le
+          push: false
+          tags: "ghcr.io/${{ github.repository_owner }}/${{ env.REPOSITORY_NAME }}:v0.0.1"
+
+      - name: "Build Bundle Image"
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: ./bundle.Dockerfile
+          platforms: linux/amd64,linux/arm64,linux/ppc64le
+          push: false
+          tags: "ghcr.io/${{ github.repository_owner }}/${{ env.REPOSITORY_NAME }}-bundle:0.0.1"
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
new file mode 100644
index 0000000..9c5fbb7
--- /dev/null
+++ b/.github/workflows/push.yml
@@ -0,0 +1,160 @@
+name: push
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - v*
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    name: build
+    steps:
+      - name: set repo name
+        shell: bash
+        run: |
+          echo "REPOSITORY_NAME=$(basename $GITHUB_REPOSITORY)" >> $GITHUB_ENV
+
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Download operator sdk
+        shell: bash
+        env:
+          RELEASE_VERSION: v1.9.0
+        run: |
+          curl -LO https://github.com/operator-framework/operator-sdk/releases/download/${RELEASE_VERSION}/operator-sdk_linux_amd64
+          chmod +x operator-sdk_linux_amd64
+          mkdir ${HOME}/bin
+          mv operator-sdk_linux_amd64 ${HOME}/bin/operator-sdk
+          echo "${HOME}/bin" >> $GITHUB_PATH
+      - name: Get the version for tags
+        id: get_version1
+        if: "startsWith(github.ref, 'refs/tags')"
+        shell: bash
+        run: |
+          echo "OPERATOR_IMAGE_TAG=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
+          echo "BUNDLE_IMAGE_TAG=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
+          export TAG=${GITHUB_REF/refs\/tags\//}
+          echo "BUNDLE_VERSION=${TAG:1}" >> $GITHUB_ENV
+          export SEMVER_COMPLIANT=$(echo ${TAG:1} | egrep '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-((?:0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$')
+          if [ -z "$SEMVER_COMPLIANT" ]; then   echo "invalid semver tag ${GITHUB_REF/refs\/tags\//}"; exit 1; fi
+      - name: Get the version for merge
+        id: get_version2
+        if: "! startsWith(github.ref, 'refs/tags')"
+        shell: bash
+        run: |
+          echo "OPERATOR_IMAGE_TAG=latest" >> $GITHUB_ENV
+          echo "BUNDLE_IMAGE_TAG=v0.0.1" >> $GITHUB_ENV
+          echo "BUNDLE_VERSION=0.0.1" >> $GITHUB_ENV
+
+      - name: build bundle
+        shell: bash
+        run: |
+          make bundle IMG=ghcr.io/${{ github.repository_owner }}/$(basename $GITHUB_REPOSITORY):${OPERATOR_IMAGE_TAG} VERSION=${BUNDLE_VERSION} DEFAULT_CHANNEL=alpha
+      - name: verify bundle
+        shell: bash
+        run: operator-sdk bundle validate ./bundle --select-optional name=operatorhub
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+        with:
+          platforms: all
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Login to Registry
+        run: echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
+
+      - name: "Build and Push Operator Image"
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64,linux/ppc64le
+          push: true
+          tags: "ghcr.io/${{ github.repository_owner }}/${{ env.REPOSITORY_NAME }}:${{ env.OPERATOR_IMAGE_TAG }}"
+
+      - name: "Build and Push Bundle Image"
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: ./bundle.Dockerfile
+          platforms: linux/amd64,linux/arm64,linux/ppc64le
+          push: true
+          tags: "ghcr.io/${{ github.repository_owner }}/${{ env.REPOSITORY_NAME }}-bundle:${{ env.BUNDLE_IMAGE_TAG }}"
+
+      - name: "Verify bundle image"
+        shell: bash
+        run: operator-sdk bundle validate ghcr.io/${{ github.repository_owner }}/$(basename $GITHUB_REPOSITORY)-bundle:${BUNDLE_IMAGE_TAG} --select-optional name=operatorhub
+
+      - name: process bundle for disconnected support
+        uses: redhat-cop/github-actions/disconnected-csv@master
+        with:
+          CSV_FILE: bundle/manifests/${{ env.REPOSITORY_NAME }}.clusterserviceversion.yaml
+          TAGS_TO_DIGESTS: ${OPERATOR_IMAGE_TAG}
+
+      - name: Archive the bundle
+        if: "startsWith(github.ref, 'refs/tags')"
+        run: tar czvf ${{ env.REPOSITORY_NAME }}-bundle-${{ env.BUNDLE_IMAGE_TAG }}.tar.gz bundle
+
+      - name: Upload bundle archive
+        uses: actions/upload-artifact@v2
+        with:
+          name: bundle-archive
+          path: ${{ env.REPOSITORY_NAME }}-bundle-${{ env.BUNDLE_IMAGE_TAG }}.tar.gz
+
+  release-github:
+    name: GitHub Release
+    runs-on: ubuntu-latest
+    if: "startsWith(github.ref, 'refs/tags')"
+    needs: ["build"]
+    steps:
+      - name: set repo name
+        shell: bash
+        run: |
+          echo "REPOSITORY_NAME=$(basename $GITHUB_REPOSITORY)" >> $GITHUB_ENV
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - run: |
+          git fetch --prune --unshallow
+      - name: Get the version
+        id: get_version
+        run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
+
+      - name: Generate Changelog
+        run: |
+          LATEST_TAG=$(git tag --sort=creatordate | sed '$!d')
+          PREVIOUS_TAG=$(git tag --sort=creatordate | sed 'x;$!d')
+          if [ -z "${PREVIOUS_TAG}" ]; then
+            REV_RANGE=${LATEST_TAG}
+          else
+            REV_RANGE=${PREVIOUS_TAG}..${LATEST_TAG}
+          fi
+          git log --pretty=format:"- %s %H (%aN)" --no-merges ${REV_RANGE} > ${VERSION}-CHANGELOG.txt
+          cat ${VERSION}-CHANGELOG.txt
+
+      - name: Download bundle archive
+        uses: actions/download-artifact@v2
+        with:
+          name: bundle-archive
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v1
+        with:
+          body_path: ${{ env.VERSION }}-CHANGELOG.txt
+          draft: false
+          prerelease: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload bundle to release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: ${{ env.REPOSITORY_NAME }}-bundle-${{ env.VERSION }}.tar.gz
+          tag: ${{ github.ref }}
+          overwrite: true
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..67814e5
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,23 @@
+# OSX
+.DS_Store
+
+#EnvTest
+testbin/*
+
+#Bundle
+bundle
+bundle.Dockerfile
+
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+bin
+
+# editor and IDE paraphernalia
+.idea
+*.swp
+*.swo
+*~
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..c32bc9b
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,7 @@
+# Build the manager binary
+FROM quay.io/operator-framework/helm-operator:v1.9.0
+
+ENV HOME=/opt/helm
+COPY watches.yaml ${HOME}/watches.yaml
+COPY helm-charts  ${HOME}/helm-charts
+WORKDIR ${HOME}
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..9310f79
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,173 @@
+# VERSION defines the project version for the bundle.
+# Update this value when you upgrade the version of your project.
+# To re-generate a bundle for another specific version without changing the standard setup, you can:
+# - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
+# - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
+VERSION ?= 0.0.1
+
+# CHANNELS define the bundle channels used in the bundle.
+# Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")
+# To re-generate a bundle for other specific channels without changing the standard setup, you can:
+# - use the CHANNELS as arg of the bundle target (e.g make bundle CHANNELS=candidate,fast,stable)
+# - use environment variables to overwrite this value (e.g export CHANNELS="candidate,fast,stable")
+ifneq ($(origin CHANNELS), undefined)
+BUNDLE_CHANNELS := --channels=$(CHANNELS)
+endif
+
+# DEFAULT_CHANNEL defines the default channel used in the bundle.
+# Add a new line here if you would like to change its default config. (E.g DEFAULT_CHANNEL = "stable")
+# To re-generate a bundle for any other default channel without changing the default setup, you can:
+# - use the DEFAULT_CHANNEL as arg of the bundle target (e.g make bundle DEFAULT_CHANNEL=stable)
+# - use environment variables to overwrite this value (e.g export DEFAULT_CHANNEL="stable")
+ifneq ($(origin DEFAULT_CHANNEL), undefined)
+BUNDLE_DEFAULT_CHANNEL := --default-channel=$(DEFAULT_CHANNEL)
+endif
+BUNDLE_METADATA_OPTS ?= $(BUNDLE_CHANNELS) $(BUNDLE_DEFAULT_CHANNEL)
+
+# IMAGE_TAG_BASE defines the docker.io namespace and part of the image name for remote images.
+# This variable is used to construct full image tags for bundle and catalog images.
+#
+# For example, running 'make bundle-build bundle-push catalog-build catalog-push' will build and push both
+# sigstore.dev/sigstore-helm-operator-bundle:$VERSION and sigstore.dev/sigstore-helm-operator-catalog:$VERSION.
+IMAGE_TAG_BASE ?= sigstore.dev/sigstore-helm-operator
+
+# BUNDLE_IMG defines the image:tag used for the bundle.
+# You can use it as an arg. (E.g make bundle-build BUNDLE_IMG=<some-registry>/<project-name-bundle>:<tag>)
+BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)
+
+# Image URL to use all building/pushing image targets
+IMG ?= controller:latest
+
+all: docker-build
+
+##@ General
+
+# The help target prints out all targets with their descriptions organized
+# beneath their categories. The categories are represented by '##@' and the
+# target descriptions by '##'. The awk commands is responsible for reading the
+# entire set of makefiles included in this invocation, looking for lines of the
+# file as xyz: ## something, and then pretty-format the target and help. Then,
+# if there's a line with ##@ something, that gets pretty-printed as a category.
+# More info on the usage of ANSI control characters for terminal formatting:
+# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
+# More info on the awk command:
+# http://linuxcommand.org/lc3_adv_awk.php
+
+help: ## Display this help.
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
+
+##@ Build
+
+run: helm-operator ## Run against the configured Kubernetes cluster in ~/.kube/config
+	$(HELM_OPERATOR) run
+
+docker-build: ## Build docker image with the manager.
+	docker build -t ${IMG} .
+
+docker-push: ## Push docker image with the manager.
+	docker push ${IMG}
+
+##@ Deployment
+
+install: kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
+	$(KUSTOMIZE) build config/crd | kubectl apply -f -
+
+uninstall: kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config.
+	$(KUSTOMIZE) build config/crd | kubectl delete -f -
+
+deploy: kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
+	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
+	$(KUSTOMIZE) build config/default | kubectl apply -f -
+
+undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config.
+	$(KUSTOMIZE) build config/default | kubectl delete -f -
+
+OS := $(shell uname -s | tr '[:upper:]' '[:lower:]')
+ARCH := $(shell uname -m | sed 's/x86_64/amd64/')
+
+.PHONY: kustomize
+KUSTOMIZE = $(shell pwd)/bin/kustomize
+kustomize: ## Download kustomize locally if necessary.
+ifeq (,$(wildcard $(KUSTOMIZE)))
+ifeq (,$(shell which kustomize 2>/dev/null))
+	@{ \
+	set -e ;\
+	mkdir -p $(dir $(KUSTOMIZE)) ;\
+	curl -sSLo - https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v3.5.4/kustomize_v3.5.4_$(OS)_$(ARCH).tar.gz | \
+	tar xzf - -C bin/ ;\
+	}
+else
+KUSTOMIZE = $(shell which kustomize)
+endif
+endif
+
+.PHONY: helm-operator
+HELM_OPERATOR = $(shell pwd)/bin/helm-operator
+helm-operator: ## Download helm-operator locally if necessary, preferring the $(pwd)/bin path over global if both exist.
+ifeq (,$(wildcard $(HELM_OPERATOR)))
+ifeq (,$(shell which helm-operator 2>/dev/null))
+	@{ \
+	set -e ;\
+	mkdir -p $(dir $(HELM_OPERATOR)) ;\
+	curl -sSLo $(HELM_OPERATOR) https://github.com/operator-framework/operator-sdk/releases/download/v1.9.0/helm-operator_$(OS)_$(ARCH) ;\
+	chmod +x $(HELM_OPERATOR) ;\
+	}
+else
+HELM_OPERATOR = $(shell which helm-operator)
+endif
+endif
+
+.PHONY: bundle
+bundle: kustomize ## Generate bundle manifests and metadata, then validate generated files.
+	operator-sdk generate kustomize manifests -q
+	cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
+	$(KUSTOMIZE) build config/manifests | operator-sdk generate bundle -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)
+	operator-sdk bundle validate ./bundle
+
+.PHONY: bundle-build
+bundle-build: ## Build the bundle image.
+	docker build -f bundle.Dockerfile -t $(BUNDLE_IMG) .
+
+.PHONY: bundle-push
+bundle-push: ## Push the bundle image.
+	$(MAKE) docker-push IMG=$(BUNDLE_IMG)
+
+.PHONY: opm
+OPM = ./bin/opm
+opm: ## Download opm locally if necessary.
+ifeq (,$(wildcard $(OPM)))
+ifeq (,$(shell which opm 2>/dev/null))
+	@{ \
+	set -e ;\
+	mkdir -p $(dir $(OPM)) ;\
+	curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/v1.15.1/$(OS)-$(ARCH)-opm ;\
+	chmod +x $(OPM) ;\
+	}
+else
+OPM = $(shell which opm)
+endif
+endif
+
+# A comma-separated list of bundle images (e.g. make catalog-build BUNDLE_IMGS=example.com/operator-bundle:v0.1.0,example.com/operator-bundle:v0.2.0).
+# These images MUST exist in a registry and be pull-able.
+BUNDLE_IMGS ?= $(BUNDLE_IMG)
+
+# The image tag given to the resulting catalog image (e.g. make catalog-build CATALOG_IMG=example.com/operator-catalog:v0.2.0).
+CATALOG_IMG ?= $(IMAGE_TAG_BASE)-catalog:v$(VERSION)
+
+# Set CATALOG_BASE_IMG to an existing catalog image tag to add $BUNDLE_IMGS to that image.
+ifneq ($(origin CATALOG_BASE_IMG), undefined)
+FROM_INDEX_OPT := --from-index $(CATALOG_BASE_IMG)
+endif
+
+# Build a catalog image by adding bundle images to an empty catalog using the operator package manager tool, 'opm'.
+# This recipe invokes 'opm' in 'semver' bundle add mode. For more information on add modes, see:
+# https://github.com/operator-framework/community-operators/blob/7f1438c/docs/packaging-operator.md#updating-your-existing-operator
+.PHONY: catalog-build
+catalog-build: opm ## Build a catalog image.
+	$(OPM) index add --container-tool docker --mode semver --tag $(CATALOG_IMG) --bundles $(BUNDLE_IMGS) $(FROM_INDEX_OPT)
+
+# Push the catalog image.
+.PHONY: catalog-push
+catalog-push: ## Push a catalog image.
+	$(MAKE) docker-push IMG=$(CATALOG_IMG)
diff --git a/PROJECT b/PROJECT
new file mode 100644
index 0000000..7bcdb90
--- /dev/null
+++ b/PROJECT
@@ -0,0 +1,16 @@
+domain: sigstore.dev
+layout:
+- helm.sdk.operatorframework.io/v1
+plugins:
+  manifests.sdk.operatorframework.io/v2: {}
+  scorecard.sdk.operatorframework.io/v2: {}
+projectName: sigstore-helm-operator
+resources:
+- api:
+    crdVersion: v1
+    namespaced: true
+  domain: sigstore.dev
+  group: helm
+  kind: Rekor
+  version: v1alpha1
+version: "3"
diff --git a/README.md b/README.md
index 52b3e0c..cf45fdc 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,9 @@
-# sigstore-helm-operator
\ No newline at end of file
+# Sigstore Helm Operator
+
+Helm Charts for the sigstore project
+
+## Charts
+
+The following charts are available:
+
+* [Rekor](https://github.com/sigstore/helm-charts/tree/main/charts/rekor)
diff --git a/config/crd/bases/helm.sigstore.dev_rekors.yaml b/config/crd/bases/helm.sigstore.dev_rekors.yaml
new file mode 100644
index 0000000..000baa7
--- /dev/null
+++ b/config/crd/bases/helm.sigstore.dev_rekors.yaml
@@ -0,0 +1,44 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: rekors.helm.sigstore.dev
+spec:
+  group: helm.sigstore.dev
+  names:
+    kind: Rekor
+    listKind: RekorList
+    plural: rekors
+    singular: rekor
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Rekor is the Schema for the rekors API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the desired state of Rekor
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+          status:
+            description: Status defines the observed state of Rekor
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/config/crd/kustomization.yaml b/config/crd/kustomization.yaml
new file mode 100644
index 0000000..da64eb9
--- /dev/null
+++ b/config/crd/kustomization.yaml
@@ -0,0 +1,6 @@
+# This kustomization.yaml is not intended to be run by itself,
+# since it depends on service name and namespace that are out of this kustomize package.
+# It should be run by config/default
+resources:
+- bases/helm.sigstore.dev_rekors.yaml
+#+kubebuilder:scaffold:crdkustomizeresource
diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml
new file mode 100644
index 0000000..9aabc87
--- /dev/null
+++ b/config/default/kustomization.yaml
@@ -0,0 +1,30 @@
+# Adds namespace to all resources.
+namespace: sigstore-helm-operator-system
+
+# Value of this field is prepended to the
+# names of all resources, e.g. a deployment named
+# "wordpress" becomes "alices-wordpress".
+# Note that it should also match with the prefix (text before '-') of the namespace
+# field above.
+namePrefix: sigstore-helm-operator-
+
+# Labels to add to all resources and selectors.
+#commonLabels:
+#  someName: someValue
+
+bases:
+- ../crd
+- ../rbac
+- ../manager
+# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
+#- ../prometheus
+
+patchesStrategicMerge:
+# Protect the /metrics endpoint by putting it behind auth.
+# If you want your controller-manager to expose the /metrics
+# endpoint w/o any authn/z, please comment the following line.
+- manager_auth_proxy_patch.yaml
+
+# Mount the controller config file for loading manager configurations
+# through a ComponentConfig type
+#- manager_config_patch.yaml
diff --git a/config/default/manager_auth_proxy_patch.yaml b/config/default/manager_auth_proxy_patch.yaml
new file mode 100644
index 0000000..87213b3
--- /dev/null
+++ b/config/default/manager_auth_proxy_patch.yaml
@@ -0,0 +1,27 @@
+# This patch inject a sidecar container which is a HTTP proxy for the
+# controller manager, it performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+  namespace: system
+spec:
+  template:
+    spec:
+      containers:
+        - name: kube-rbac-proxy
+          image: quay.io/coreos/kube-rbac-proxy:v0.5.0
+          args:
+            - "--secure-listen-address=0.0.0.0:8443"
+            - "--upstream=http://127.0.0.1:8080/"
+            - "--logtostderr=true"
+            - "--v=10"
+          ports:
+            - containerPort: 8443
+              name: https
+        - name: manager
+          args:
+            - "--health-probe-bind-address=:8081"
+            - "--metrics-bind-address=127.0.0.1:8080"
+            - "--leader-elect"
+            - "--leader-election-id=sigstore-helm-operator"
diff --git a/config/default/manager_config_patch.yaml b/config/default/manager_config_patch.yaml
new file mode 100644
index 0000000..6c40015
--- /dev/null
+++ b/config/default/manager_config_patch.yaml
@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+  namespace: system
+spec:
+  template:
+    spec:
+      containers:
+      - name: manager
+        args:
+        - "--config=controller_manager_config.yaml"
+        volumeMounts:
+        - name: manager-config
+          mountPath: /controller_manager_config.yaml
+          subPath: controller_manager_config.yaml
+      volumes:
+      - name: manager-config
+        configMap:
+          name: manager-config
diff --git a/config/manager/controller_manager_config.yaml b/config/manager/controller_manager_config.yaml
new file mode 100644
index 0000000..abdf3e4
--- /dev/null
+++ b/config/manager/controller_manager_config.yaml
@@ -0,0 +1,10 @@
+apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
+kind: ControllerManagerConfig
+health:
+  healthProbeBindAddress: :8081
+metrics:
+  bindAddress: 127.0.0.1:8080
+
+leaderElection:
+  leaderElect: true
+  resourceName: 811c9dc5.sigstore.dev
diff --git a/config/manager/kustomization.yaml b/config/manager/kustomization.yaml
new file mode 100644
index 0000000..cd5f2c3
--- /dev/null
+++ b/config/manager/kustomization.yaml
@@ -0,0 +1,16 @@
+resources:
+- manager.yaml
+
+generatorOptions:
+  disableNameSuffixHash: true
+
+configMapGenerator:
+- files:
+  - controller_manager_config.yaml
+  name: manager-config
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+images:
+- name: controller
+  newName: quay.io/ablock/sigstore-helm-operator
+  newTag: latest
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
new file mode 100644
index 0000000..e5f2b85
--- /dev/null
+++ b/config/manager/manager.yaml
@@ -0,0 +1,55 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+  namespace: system
+  labels:
+    control-plane: controller-manager
+spec:
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        control-plane: controller-manager
+    spec:
+      securityContext:
+        runAsNonRoot: true
+      containers:
+        - args:
+            - --leader-elect
+            - --leader-election-id=sigstore-helm-operator
+          image: controller:latest
+          name: manager
+          securityContext:
+            allowPrivilegeEscalation: false
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8081
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            limits:
+              cpu: 300m
+              memory: 512Mi
+            requests:
+              cpu: 300m
+              memory: 256Mi
+      serviceAccountName: controller-manager
+      terminationGracePeriodSeconds: 10
diff --git a/config/manifests/bases/sigstore-helm-operator.clusterserviceversion.yaml b/config/manifests/bases/sigstore-helm-operator.clusterserviceversion.yaml
new file mode 100644
index 0000000..6ab4f0b
--- /dev/null
+++ b/config/manifests/bases/sigstore-helm-operator.clusterserviceversion.yaml
@@ -0,0 +1,53 @@
+apiVersion: operators.coreos.com/v1alpha1
+kind: ClusterServiceVersion
+metadata:
+  annotations:
+    alm-examples: '[]'
+    capabilities: Basic Install
+    categories: Security
+    createdAt: "2021-08-01T19:23:55Z"
+    description: Helm Charts for Sigstore Project.
+    support: The Sigstore Authors
+  name: sigstore-helm-operator.v0.0.0
+  namespace: placeholder
+spec:
+  apiservicedefinitions: {}
+  customresourcedefinitions: {}
+  description: |-
+    Helm Charts for the sigstore project
+
+    ## Charts
+
+    The following charts are available:
+
+    * [Rekor](https://github.com/sigstore/helm-charts/tree/main/charts/rekor)
+  displayName: sigstore
+  icon:
+  - base64data: iVBORw0KGgoAAAANSUhEUgAABOgAAAHmCAYAAADJDbE+AAATjHpUWHRSYXcgcHJvZmlsZSB0eXBlIGV4aWYAAHjarZprchy5sYX/1yq8BCReCSwHz4i7Ay/f36mmKHnG16OJMCmRVLO7Gsg8eR4oPeef/3eff/CRa2tPLt5qrzXwkXvucfBDCz8/ztf3z2MW8vv1x4d9fbXn11/U9PXryCP6+evfnr8eT1+P/7hQ/f7Ohf7DL6z84QXp+/3jr2/s4/uN47+taF2z8OtH+/n33t3uPZ/djVwpQ/1s6vMWz4/L8MRJldL7ssqn87fws7+fnc8WRliWww4rTD6XdYuWwrVs+7Fh145tvi9brDHHE53vMa6Y3sda8tjjSiFZyvq0Gz31tFNLMa14Ukr5SfF7Lfa+b3/fb1njnbfx1GhczHjJf/18/uoJv/N57wrUiAK3t/X2aXCM6oOpjElfeRoNsfvVt/IW+Mfn98fzS2MTHSxvmRsbHGF+LjGL/cRWegGQeF7h+wdf5ltdiy9KMu9dWIwlWhCqpWLVgsfoZjnFRoMGK48px0kHrJS4WWTMKVV608AR781r3N7nxhI/jzMq9Kekmpze9DRoVs4F/HhuYGiUVHIppRYvrfQynppqrqXW6lUzNzx59uLV3Zt3Hy213EqrzVtrvY0ee2IkS6/de+u9j8F7jvyMMnj14BljzDjTzLPMOn222edYwGflVVZdvtrqa+y408677Lp9t933OHaA0nPyKaceP+30My5Yu+nmW269ftvtd3x37aurf/r8G12zr67Ft1N6nn93jUfddaH3EiaeKeoZHYvZ6LirAwA6qmehWc5RnVPPQo9MRYkssqg328J4rNLCfCwWRv9H73527rf79lDrv+pb/J3OPWrd/6Bz8TnpD337D13bYsIVPtOoKVRNQ2L6eM6IjT8Ue7R6+Nhn1d0PVxw1t8qgdDaXWoizn2vltuN53DBWoAx+07mZ94l7pHST76fMHRAS/vS5yh3jtlHPdC68ChyZ7pzTM1XK91rinSa1pRkXHJxWt82VJ8iu87S1R+WFnqykVjMPsOy0Nq/x1QvVKm50J3S+zbTgvtU8zpjrKqxroWnP6LeVeyCIVWuagCDw+PbhKmE52eeMlIJrxzH6DlpRs7PU+zpt57huSfMphc7E2SiBOpyTSgXOKvQbvgr5O9+f333ir99j6rztoJneh3erqfUn1AMS6U7wuXnwtnlP3FQjlg4inQ3xd3tbc4mcGd/Dekflma563Ub9ypNrHDH3kyicu4E3P72ApeK52Kh98DL6U/oos8Fg/JBrp87pxQc/3dlHfYplDct6Fw3wwKz5yol1NAdelbfYAIDRsNt7Yjb81ghotk97GxVX7fOhE+1sZ/bYque9gt/ba2ZhU61q93g5cPhERu8Ne/Ml0JvLoAzmPg4DkevZEfmLftJed4LbMVYFLGtmiGjdwW4YKvg/hVrSajGcbAzngulADmO7Ev8Oz0zm081ZAi6p2zyFOSu2W6nUydK+WQJDwTL9+irAn78//98v/vv3E9gDRVgNi8JW66XY+qEwjnFc37ex5gst6tE9N5VlUlYY4Lu5GODF0oRch1jNK1NPJ9vTlwxW7gmiOnMeazdo9nqqHtbBRvR4bQcMR9v8e91q4GOVBl3gUHo4gGHOxyfqOdSuvdupatQJkXLF7mlM5q9RcWzSPmAr7UHjx9swLrqAYj2RtfrTmaxYMUUZm8MwAp+h6+XEv2feEa6Z+B743KFctOT2EsDg1brCSGeWA6we3jK3uTajOwEr7M6CghjSzi2gMYXdOu99Zx4HhNkGX93PWKdBfCWW2s5xcHRhDFha457BOoiBQyoEcCbcEtNgskAKLEU9ZhkNY4a0gpnL1RwaPGPTNb6Mm8frVBb80g0i0UcTeKgKE5QmTHjznH3nenYDjvW0shfqpXr0zNZGjKdY0TRQl6iRRct3iXkn9LB2zRvi6G3XEkPrhlhhbDaaMGdjxHIswR9698UzI/9tXP7y/fkzUBEZhgNY/gGlPF84/aB0NRjKkFE6iJ22/NJIPYj4OVjgto0egOy+UoSEcRR7RV4Di8+2t64Q4DTKWvkqBj9I09pFXSuonG0Imw47tNF8lAWhAXR4DbWgSrP3IIguFo+rm6cjNC+h1JkX7PKUHhCxRDZA3+1UUI6ghzt6KgdnEwA0UrJ5Q00f1HlH6ONCk3MXcOvwG91DRerFoUzJuUNh9BRzmjYv5jLrdLbj6VZ8/jjjTJtzYRwOtDOoSCo3rgKusH6o/4VdPTBuaNdeiFnLolVB2Cg00oCoyvwObE2jAmz6gE+7gG8goIMaXcDGTGXmkPplnA+JQ79zeRSkvYBNtsSzwFTCNSUuQhcYSam12gb8H9ITQuI7TvaHqvbiXcaAylHXmBkqRjLxkl0z0+S4HOC9kJWD+OTmmcLW/vAlrgV0bxQp5dHZCk1DfIH/Ce3CESOSV1MZPm9LpdoADrQS7a4lu8zZELFhLRA0RnMbraayuD5YMqH4G5/Rr+zEWMASasF5UXZ4HdiqjEtJC6Z4Dtdd8CKNwhMdLJLsA5Qxc5XCwhhzWlf3mESC12H5N0IcjHJuXaDg2vEB32oU69toF9eIchT9hFUdh4QNBrnjdgQ7bnzWRaOgmPcCckNpibi5EKYorSslYhgCrAUI6B5Dh7MyamM24Ek453T8GXPwRlW8KP4Fr12ZhboaOEoA1HcZoBbtxZICDlsl5ZJkFKhmN346ZOEsjgkYzoEwU2CGaMEkVQbk4WLmlwooJAyge2TXwM+5UB8qQYv3PLPBTzgS2Hvnu3yi+A2uXpO3xVD7g2KvmRLGtzEDMMpKGwTTWFh+iN5Oa8xaNgZ4n+5+QCb1FOd1NZr94ZUfx0AYfDugkJgZCcRaFI4XXhgCFp9ghaMp3zW2mbjWwOGgRS1cwEjYu/i8ByrH1+BFU3qnm+cfowszg0QiiRh3p6SNAdyF5wizQUB5YShxPBimEWCNpwi89BN5AHlMXMyHBIBc5k2B8mEWABTwBC3IZwcS28DcNZ5YhnW2L84OEhDCDpaJOiHZqPSQt9VWKFI2yJwAi8CUwqTRmhAQBIQHYvJjtCAyNs8N7Bezy0BBGC5TDe82Mjtu3XCDR4WGVOGtthrUMFE9IghzSx1ggtffJXSNGYbN6iDr4L0u7FGIf1NqisEGbogu16Lqc4j2CORDxxxsST5jMTCW0sOlmQBxC/wZ1l2RyMObbMiaGkSxKc/PC1+YawUqucGlAaVl76wZ0OSj6Ydla4QA28turHdjG4bcnt5g1WMT24CX5essTAvv4lfivdv1hZxcYsN8DpMdPE1wlW5vjBJowA59mok3gW/jguUKgroWLpVBBruk2oQNqGgvMZNiE05iAWhz8AsizQFSh/BIvRabA5GIBHkUNveUcRMYZzwp8o/gtcicJzUQhkzsHjTuPJFTFI68yjrw4w7VY3M7CEbPuBbWByHBoPRjcAl9b9pmxSvE+XSZvOwJJpahXq3QzIOyDQArTG+duYFquHhzqSrzFqjZFNHpAOtDdETRksV0iwLCi8EGtfvBqgvlhPK/WFWBypojuiXQAnQEFEBgUAP+KJB4o3h0kTxK2wV5Y9JnyLMTXfuNII3uBISN4cfAHX7Riawa2pHirix13KcShvkH2+RNL7Qw8RaX0cD9YZxw/0QJHULBtYWMQEgfaFusBAFSAX6fZZJ6n3OC9JhYcKFBVSICIRKPTwbiYG7ZPObqTpaHpcbTkM/pB1khyJd92aHnFz8UZRsQGmS9vYOecLj0C3/siB0aH/FrlRFGcENnHUkeqstYUiMcJTMMXBDlQR571YK/u5Sl4yPyVMXdUbK6Qq1vKilbEeC6zaGFYAIy2o8Jxj3ACQCDOP1vfgrSfR0VlPfDUxHn4cgJH+BpNU14pnTsWXoRpFXu1ROvjtvwKuQFh9xwUPfbHr3miEt/26MMHPmDbDrWD5bGEWMWV8DXs1xinjQClWeYaNvOSB6PEblgErLkrHHzcLpcnjRAi9nGAwtD7KEzcNbhMyoRsea4563jCXLLtTV5Kvo3EcVL+mm8Hn+3D/QcK+tAkB4KyKAnMQX4IavgG8AInnTSlGsoKY7HAMzWic2aIb5I9xZADnZe3sZvfCimXQPK/KEPCzOUdbKAbiwGDVrQuXVjYGRwtUZX+apsosSEWEt1U3/Ua4RAft4MiSeINQARNK2sjOuS1jHNx7MSPjiFF6TZtApgIbeY4GH1eYO+SUShEWYCM1vJT9U7ywPQt9sbNg+Vzfc9q9GpTSNnYTRwTb13voxnNqJ0ZfcYBAagfVwWLv9t9a9OSyoCm+K0+Ox23rASvM/QTK42seWYEejAiGMcwis9qAG/gRWgJSoKhRjYbH4RRq6ITywTK4GcZ8KUkUVk8QDkZcYpwkWy7nHYD9pkY40xwjcSDhfAqaCqAUbcmNH/3FYpI5Gyuu0n+yx4Xbqz8DyQ7Ko6sSCYYaK6ztYJJIQgKIS1UQdgwAaxaTj6TYLELjlJ9cGkXOIFQ83CmUTQLLcLXbPRTJosLqDLzuKj0GHCzgEE6B3T5sSDiu7O+ERi9mT4L2yriK+DE/QeXmcqmKNeqnCPEckfxEcfgbSLMNmLeXY/sW06rNsIPbR3E3GhdtqYD92lRFhupSHbcSChm0lnjhOAFvD3Gz0o/Af4T/5GPhENhcXT6MSGhIl63UMJoAZyciI/MNMBX4pLwA1CAhgpfAxTgrt4+CX+kHLigO9S2mB7106B/HR01HAwa1DchGWMCJfyxgX4V5rLVPH2O4Ajzzg10xnG9UGDYVbvEWt8DvKQWf9gUNguuG/jxT0GTZlvial4SXvF4Sm7vz9kjDtpDxrM7xGmlDcoDRnh2zDfdJ7uQdfQKJGRCTYjz82N3DJFui9Ch+mldJeQpP0QntJl3AkUONZJ8CPgrKp7PvuMaQQi+IHSEGyCHDvoe5Y4787S+XuOXUJHBHgSA/c3W7cDjHj9rNADjaPHgjYkVjEcSDeBKLGiQVB4zwzl0mywUcWHM/311Zidwy4BxoyILAyCH9A5C8IKNeHpaKiM56M7VEenDeAXk17CxMsyhLSXYEJ3YSo2genKJ2I9RShTJyOiF1Zb+wbEx0mQI58lpO70HuUUPFY+dIRHIA9+lxSQ6OtEd7D2cONl1UhJJobxtrVErw+GAeXHqDKSzD1kPom5K2CUM+kOfoLMV+ko5SYz493Y4DAnxkI6uguRx4CvH4x0SR3VD/flxCnrh3IwsbNBBvBiw2xk4pEbvN2/Sv/zvqjUZs0HcL2yqBsC+Bdpqp/2Hsce3QVYOt2aO8jgnLsofrQPyTokC7T6h2KfAtDxaIILG8BGblgq2RC3G5kZ73FrxuskfE3YU3cPZDN07vT6MTUbO4yrfZ17zbDUjLBnxMrowF/Wiul1JocmYcYwua4DHIidNClbjCjjwuif6SYUMRjiX3g6USPo1nueHk/OHWFmTvBHN5D2UAELMCUdBh1YA8z/EoOR3bHH2RjlrhMNkM1KGQF5R9Ud206mNwNWjG4jckmpdbomhDWdfYEHCIAxfcyOFhVgNIxjYR4g5lXD6hSVGPs52gETpME2CWAXssYIDLI4vgxOBh8M99OhOyKzLQwEoodC6UCdbIwJYp7ZRNH8kZr75mcGclOK9HFiiA1MzHqT0X4sKpXER5B2diyyWzSRFxNsMm4Ob0Ccdp1WiTbWBL9cGKpXfmfThhZQo6XbxuyFSAEp7gpD3jeMJqob3rtQe+h8z3SvUaaOKzLOlHiAVmR1ssz7bCZkyXvwWqC/cb6EjSFKg6HByJUDx8wjf9jJAd4n8ZJRRGIEdRSAoo3X1RYd1dEKHdTgxXQvxppi+tDJFxmeSLbWaE5AIyPpJP2ukKoOojPhUO6FLMLbYSRJBEitxBYFliayDkIkSqgx4J2HnY8dzu/hI4Kje32SOzkAUa1UCIonFc2z3xQAV+uWFiajEk9YF8hElSEM3YffUC1LwKCBs4E6MgIbV4sRIeBZ1AowPtjxEed75r2wvwgVZpOAqdPW63jWMnWE4KoW2Q6OLjpDqjDkxL8wSgvhwBoc3aiZ6pkWxyiMjY/SeW7DmOFHlby5cAQF/IMcgrKxk4c3bwQOkiOfkfQYreh2NQlh6X8wILmw5aSqCSMH6e0WENqroySHzPAVXSfb4uxFy5h+rKlu+GokNAkI3xgyi2THQTsC6XnSaS5DOIxjJqUwXJjLbKQHY4GL1n1hgFJ6xqZgP9fI7/Eve4RTQTSKobOhjJvf+IaCHdBRke4LrKIpeBg0CCMiQ1i3JbWWAqCMnSCYb1eOTQkbB8Ra3gIL7Egxacqm8/iCd4TYWlRMhoC0Anz+BwqMKvFT5xty3XgB0RJUAqwHbY3srjAz5f3PAgOtfmyNuhWlMxGqMUoAYGO+HR/SEUlkAf6F+LEHGIgtlZuK9Gi1jnVMYNg5PxFPiAwHWAyuXrKOTVM5XH5Y54zAFZ5kxPBG1I/E4kwzsNZN0emgPPW+HwTvvXNuDWM1xJw36E4f1qSQds/EB1svdwNaJZJcwgfnyCqktXWbOUOkD5Yo8DjBr2rTWPENUwlYgeR5iWroD1KPV8Tv6AgQK1J61dGaIdAH/6L9ytaIZhDWvsN87+R6h9hAGV4SnvyMXOHq9WvkXCNHHk8ZH0SyhgRGeb5m7mvkum6jpbeW7x21En/3Vunzt++t/uWFdKei4wX/Bbv46UBFbYZZAAAMY2lDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdck0cbv3dkkrACEZAR9hJkE0BGCCuCgExBVEISSBgxJgQVN1qqYN0iiqOiVRGLVisgdSBinUVxW0fjQKVSi1VcqHwXEtDab/y+h9+9989zz/2fwd373gGgp+LLZIWoPgBF0mJ5UnQ4a0JGJovUBRD4RwLuwJgvUMg4iYlxAMpQ/3d5dQ3aQrnspub65/h/FUOhSCEAAMmCOEeoEBRB3AoAXiaQyYsBIEZAve30YpkaiyE2ksMAIZ6txnkavEKNczR4+6BNShIX4mYAyDQ+X54HgG471LNKBHmQR/chxB5SoUQKgJ4RxCECMV8IcQrEo4qKpqrxfIidoL0M4l0Qs3M+48z7G3/OMD+fnzeMNXkNCjlCopAV8mf+n6X531JUqBzy4QAbTSyPSVLnD2t4o2BqrBrTIO6R5sQnqGsN8RuJUFN3AFCqWBmTqrFHzQUKLqwfYELsIeRHxEJsDnGUtDA+TqvPyZVE8SCGqwWdISnmpWjnLhYpIpO1nBvlU5MShnCunMvRzm3gywf9qu3blQWpHC3/DbGIN8T/slSckg4xFQCMWiJJi4dYF2IjRUFyrMYGsykVc+OHbOTKJHX8dhCzRdLocA0/lpUrj0rS2suKFEP5YuViCS9ei6uLxSkxmvpguwX8wfhNIG4USTmpQzwixYS4oVyEoohITe5Yh0iaqs0XuysrDk/Szu2VFSZq7XGyqDBarbeB2ExRkqydi48photTw4/HyYoTUzRx4tn5/LGJmnjwEhAHuCACsIASthwwFeQDSUdPUw/8pRmJAnwgB3lABNy0mqEZ6YMjUvhMBqXgD4hEQDE8L3xwVARKoP7DsFbzdAO5g6MlgzMKwCOIi0AsKIS/lYOzpMPe0sBDqJH8w7sAxloIm3rsnzoO1MRpNcohXpbekCUxkhhBjCFGEZ1xMzwED8Lj4DMMNi+cjQcMRfvJnvCI0Em4T7hKUBFuTpGUyb+IZRxQQf4obcY5n2eMO0BOXzwcD4bskBln4mbADfeBfjh4KPTsC7Vcbdzq3Fn/Js/hDD6rudaO4kFBKSMoYRSnL2fquuj6DrOoK/p5fTSx5gxXlTs88qV/7md1FsI+9ktLbDF2ADuFHcfOYIexJsDCjmHN2HnsiBoPr6GHg2toyFvSYDwFkEfyD398rU91JRUe9R7dHu+1Y6BYNKNYvcG4U2Uz5ZI8cTGLA78CIhZPKnAfxfLy8PIEQP1N0bymXjAHvxUI8+wn3UK4l4OlAwMDhz/pYt8B8KM13OaqTzrHS/B1AN/Hp1cKlPISjQ5XPwjwbaAHd5QpsAS2wAlm5AX8QBAIA5FgLEgAKSADTIZ1FsP1LAfTwWywAJSDSrACrAUbwBawDewC34P9oAkcBsfBz+AcuAiugltw/XSBp6AXvAL9CIKQEDrCQEwRK8QecUW8EDYSgkQicUgSkoFkI3mIFFEis5GFSCWyCtmAbEXqkB+QQ8hx5AzSidxE7iHdyF/IOxRDaagRaoE6oKNRNspBY9EUdBKah05DS9FF6DK0Gq1F96CN6HH0HHoVVaFP0T4MYDoYE7PG3DA2xsUSsEwsF5Njc7EKrAqrxRqwFvifvoypsB7sLU7EGTgLd4NrOAZPxQX4NHwuvhTfgO/CG/F2/DJ+D+/FPxLoBHOCKyGQwCNMIOQRphPKCVWEHYSDhJNwN3URXhGJRCbRkegPd2MGMZ84i7iUuIm4l9hK7CQ+IPaRSCRTkispmJRA4pOKSeWk9aQ9pGOkS6Qu0huyDtmK7EWOImeSpeQychV5N/ko+RL5Mbmfok+xpwRSEihCykzKcsp2SgvlAqWL0k81oDpSg6kp1HzqAmo1tYF6knqb+kJHR8dGJ0BnvI5EZ75Otc4+ndM693Te0gxpLjQuLYumpC2j7aS10m7SXtDpdAd6GD2TXkxfRq+jn6Dfpb/RZei66/J0hbrzdGt0G3Uv6T7To+jZ63H0JuuV6lXpHdC7oNejT9F30Ofq8/Xn6tfoH9K/rt9nwDDwNEgwKDJYarDb4IzBE0OSoYNhpKHQcJHhNsMThg8YGMOWwWUIGAsZ2xknGV1GRCNHI55RvlGl0fdGHUa9xobGPsZpxjOMa4yPGKuYGNOByWMWMpcz9zOvMd+NsBjBGSEasWREw4hLI16bjDQJMxGZVJjsNblq8s6UZRppWmC60rTJ9I4ZbuZiNt5sutlms5NmPSONRgaNFIysGLl/5K/mqLmLeZL5LPNt5ufN+ywsLaItZBbrLU5Y9FgyLcMs8y3XWB617LZiWIVYSazWWB2z+p1lzOKwClnVrHZWr7W5dYy10nqrdYd1v42jTapNmc1emzu2VFu2ba7tGts22147K7txdrPt6u1+tafYs+3F9uvsT9m/dnB0SHf42qHJ4YmjiSPPsdSx3vG2E90p1GmaU63TFWeiM9u5wHmT80UX1MXXRexS43LBFXX1c5W4bnLtHEUYFTBKOqp21HU3mhvHrcSt3u2eO9M9zr3Mvcn92Wi70ZmjV44+Nfqjh69Hocd2j1uehp5jPcs8Wzz/8nLxEnjVeF3xpntHec/zbvZ+7uPqI/LZ7HPDl+E7zvdr3zbfD37+fnK/Br9ufzv/bP+N/tfZRuxE9lL26QBCQHjAvIDDAW8D/QKLA/cH/hnkFlQQtDvoyRjHMaIx28c8CLYJ5gdvDVaFsEKyQ74NUYVah/JDa0Pvh9mGCcN2hD3mOHPyOXs4z8I9wuXhB8NfcwO5c7itEVhEdERFREekYWRq5IbIu1E2UXlR9VG90b7Rs6JbYwgxsTErY67zLHgCXh2vd6z/2Dlj22NpscmxG2Lvx7nEyeNaxqHjxo5bPe52vH28NL4pASTwElYn3El0TJyW+NN44vjE8TXjHyV5Js1OOpXMSJ6SvDv5VUp4yvKUW6lOqcrUtjS9tKy0urTX6RHpq9JVE0ZPmDPhXIZZhiSjOZOUmZa5I7NvYuTEtRO7snyzyrOuTXKcNGPSmclmkwsnH5miN4U/5UA2ITs9e3f2e34Cv5bfl8PL2ZjTK+AK1gmeCsOEa4TdomDRKtHj3ODcVblP8oLzVud1i0PFVeIeCVeyQfI8PyZ/S/7rgoSCnQUDhemFe4vIRdlFh6SG0gJp+1TLqTOmdspcZeUy1bTAaWun9cpj5TsUiGKSornYCB7ezyudlF8p75WElNSUvJmeNv3ADIMZ0hnnZ7rMXDLzcWlU6Xez8FmCWW2zrWcvmH1vDmfO1rnI3Jy5bfNs5y2a1zU/ev6uBdQFBQt+KfMoW1X2cmH6wpZFFovmL3rwVfRX9eW65fLy618Hfb1lMb5YsrhjifeS9Us+VggrzlZ6VFZVvl8qWHr2G89vqr8ZWJa7rGO53/LNK4grpCuurQxduWuVwarSVQ9Wj1vduIa1pmLNy7VT1p6p8qnaso66TrlOVR1X3bzebv2K9e83iDdcrQmv2bvRfOOSja83CTdd2hy2uWGLxZbKLe++lXx7Y2v01sZah9qqbcRtJdsebU/bfuo79nd1O8x2VO74sFO6U7UraVd7nX9d3W7z3cvr0XplffeerD0Xv4/4vrnBrWHrXubeyn1gn3Lf7z9k/3Btf+z+tgPsAw0/2v+48SDjYEUj0jizsbdJ3KRqzmjuPDT2UFtLUMvBn9x/2nnY+nDNEeMjy49Sjy46OnCs9Fhfq6y153je8QdtU9punZhw4kr7+PaOk7EnT/8c9fOJU5xTx04Hnz58JvDMobPss03n/M41nvc9f/AX318Odvh1NF7wv9B8MeBiS+eYzqOXQi8dvxxx+ecrvCvnrsZf7byWeu3G9azrqhvCG09uFt58/mvJr/235t8m3K64o3+n6q753drfnH/bq/JTHbkXce/8/eT7tx4IHjx9qHj4vmvRI/qjqsdWj+ueeD053B3VffH3ib93PZU97e8p/8Pgj43PnJ79+GfYn+d7J/R2PZc/H/hr6QvTFztf+rxs60vsu/uq6FX/64o3pm92vWW/PfUu/d3j/unvSe+rPzh/aPkY+/H2QNHAgIwv5w8eBTDY0NxcAP7aCQA9AwDGRXh+mKi58w0KormnDiLwn7DmXjgofgA0wE59XOe2ArAPNof5kBs29VE9JQyg3t7DTSuKXG8vDRcN3ngIbwYGXlgAQGoB4IN8YKB/08DAB3hHxW4C0DpNc9dUCxHeDb5V33XBzdWT5oMvRHMP/SzHL3ugjsAHfNn/C6vOiXr5r1tTAAAOBmlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4KPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1QIENvcmUgNC40LjAtRXhpdjIiPgogPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8iCiAgICB4bWxuczpzdEV2dD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlRXZlbnQjIgogICAgeG1sbnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIgogICAgeG1sbnM6ZXhpZj0iaHR0cDovL25zLmFkb2JlLmNvbS9leGlmLzEuMC8iCiAgICB4bWxuczpHSU1QPSJodHRwOi8vd3d3LmdpbXAub3JnL3htcC8iCiAgICB4bWxuczp0aWZmPSJodHRwOi8vbnMuYWRvYmUuY29tL3RpZmYvMS4wLyIKICAgIHhtbG5zOnhtcD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLyIKICAgeG1wTU06RG9jdW1lbnRJRD0iZ2ltcDpkb2NpZDpnaW1wOmRlZWQ3MjNlLWJiNzYtNDUxNy1iMzQ1LWVmMzExMTY0ZWRiMSIKICAgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDphMWVlNGVlZi03NzgyLTRjZmEtYjYxOC1jZDcxNzBkOTUzNDkiCiAgIHhtcE1NOk9yaWdpbmFsRG9jdW1lbnRJRD0ieG1wLmRpZDpiMWJhM2Q1Ny0xM2Q2LTQ3ZWYtYjg0OC1kZDUxODc1YWNhYTQiCiAgIGRjOkZvcm1hdD0iaW1hZ2UvcG5nIgogICBleGlmOlBpeGVsWERpbWVuc2lvbj0iMTI1NiIKICAgZXhpZjpQaXhlbFlEaW1lbnNpb249IjQ4NiIKICAgR0lNUDpBUEk9IjIuMCIKICAgR0lNUDpQbGF0Zm9ybT0iTGludXgiCiAgIEdJTVA6VGltZVN0YW1wPSIxNjE4MDk5MzE5ODAxNzMyIgogICBHSU1QOlZlcnNpb249IjIuMTAuMjQiCiAgIHRpZmY6T3JpZW50YXRpb249IjEiCiAgIHhtcDpDcmVhdG9yVG9vbD0iR0lNUCAyLjEwIj4KICAgPHhtcE1NOkhpc3Rvcnk+CiAgICA8cmRmOlNlcT4KICAgICA8cmRmOmxpCiAgICAgIHN0RXZ0OmFjdGlvbj0ic2F2ZWQiCiAgICAgIHN0RXZ0OmNoYW5nZWQ9Ii8iCiAgICAgIHN0RXZ0Omluc3RhbmNlSUQ9InhtcC5paWQ6MWI2NWI5NGQtMDU2My00YmZlLTkxNDMtM2VhZGE2NmMzY2ZiIgogICAgICBzdEV2dDpzb2Z0d2FyZUFnZW50PSJHaW1wIDIuMTAgKExpbnV4KSIKICAgICAgc3RFdnQ6d2hlbj0iMjAyMS0wNC0xMFQyMDowMTo1OS0wNDowMCIvPgogICAgPC9yZGY6U2VxPgogICA8L3htcE1NOkhpc3Rvcnk+CiAgIDxleGlmOlVzZXJDb21tZW50PgogICAgPHJkZjpBbHQ+CiAgICAgPHJkZjpsaSB4bWw6bGFuZz0ieC1kZWZhdWx0Ij5TY3JlZW5zaG90PC9yZGY6bGk+CiAgICA8L3JkZjpBbHQ+CiAgIDwvZXhpZjpVc2VyQ29tbWVudD4KICA8L3JkZjpEZXNjcmlwdGlvbj4KIDwvcmRmOlJERj4KPC94OnhtcG1ldGE+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAKPD94cGFja2V0IGVuZD0idyI/PvdMX8oAAAAGYktHRAD/AP8A/6C9p5MAAAAJcEhZcwAAFiUAABYlAUlSJPAAAAAHdElNRQflBAsAATsAzNk1AAAgAElEQVR42uzdd5RU9f3/8de9M7N92cKywNKW3svSQUBR7Ima2HtiElssFJEuRQUVWywxGhVFsWDX2I0VCyBFQHqX3haWbbMzcz+/P1bz+1pQyuzMnZnn45yck5MAc+d9P58783nN+36uBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIcxYlQLSNH/Uvs+zb9UpPT9G0ZycwJgEAAAAAQEIhDEFUXXreeLNzR7ECVUFZlqWUlCQVNKqjfz0+mrEJAAAAAAASAiEIomL8qIfNNwtWqry8UsYxP/r/bI+t9LQUNW/VSFP/cT1jFAAAAAAAxDXCD0TcxefcZHbv3KtAIPirf87j9SgrK0Nde7TRiLGXMlYBAAAAAEBcIvRAxNw87lEz96tvVVlZJWPMwQ1Qy5LX61F+3Rw98dxExisAAAAAAIg7BB6IiIvPGmd27tqrUDB0eAPVsuTzeVXYrEAPPjqCcQsAAAAAAOIGQQdq1G2TpplPP16gYCB00F1zv8a2LSUnJ6ljlxa6derfGb8AAAAAACDmEXCgxlx09jizc/seOY4J/8C1LdXKTNfRx3Y9/tph531AtQEAAAAAQKwioEPY3XP7jJnvvvXl2Y7jyJgaHsCWpfoFeXryefanAwAAAAAAsYlQA2F12YUTzebvdtRI19yv8Xhste3QVPc8OIwxDQAAAAAAYgphBsLm98cNNv6qqhrvmjvgYLak5ORk9enXUaMnXMbYBgAAAAAAMYEQA0fs73+9zaxZvfmwn9Aa9kFtSbl5WXrulSmMbwAAAAAA4HoEGDgifzj5BlNWWhGWJ7SGfXBblpo2b6CHnxjNOAcAAAAAAK5FcIHDMuzae8yyJesUCATdPcAtyePxqFvPtrrljqsZ7wAAAAAAwHUILHDIzj1tpCku3u/KrrkDDnRLSktP1bHHd7/iumHnP8JZBAAAAAAAbkFAh4M2ZviD5psFq+SvrIrdAW9Zqt8gT787rV+nsy84fjFnFQAAAAAARBsBHX7T80+/1/ONVz+bvWP7npjqmvvVgW9Zatehqe596AbmAAAAAAAAiCrCCfyqSWP/bebNWaby8sq4fH9JyT717d9ZYyZcxlwAAAAAAABRQSiBA7rsgolm86YdchwT35PAkmplZ+jFN+5gPgAAAAAAgIgjkMDP3DZpmpn95RKVlVbImASaDJalJoX19O+nxjEvAAAAAABAxBBE4Eeu+NOtZsO6rQqFnIStgW3bKureWrfdfS3zAwAAAAAA1DgCCEiS7rrt6a+/nLWo2769pRRD1d10KSlJOvq4rsXDRl6cS0UAAAAAAEBNIaCDrvnb7Wb1yu8Sumvu12ZI7bxsPffKZOYKAAAAAACoEYQOCey+u54b9PmnC98v3lOSUHvNHdZEsSy1bN1IDz46kjkDAAAAAADCirAhQQ2++i6zYul6BYMhinEIvF6PevbtoImTr2DuAAAAAACAsCBkSEAX/HGM2bmjmEIc7qSxLGVmpumYQd2bXzv03LVUBAAAAAAAHAkCugQy/Pp7zbeL1ioQCFKMMLBtWw0a1dHjM8YzjwAAAAAAwGEjWEgQF5011uzYXizDZnNhn0E+n0/tOzTV1PsGM58AAAAAAMAhI1CIc6OGPWAWf7Na/soqilGTE8mylJ6Rqh692mn0hMuYVwAAAAAA4KARJMSxS88db7Zu2ckTWiPI47GVl5+jp1+4mbkFAAAAAAAOCiFCHBo34iGzcP4KVVbQNRctPp9XTZsX6MFHRzLHAAAAAADAryI8iDOXXTjRbNq4g73m3DC5LCk1LUUdOjXXrVP/zlwDAAAAAAC/iNAgTowf/bBZOG+FyssqKYbL2Lal7Nxa6ta9jW4ceylzDgAAAAAA/AhhQRz42yU3mw3rttE153I+n1f1G+TpsadvYt4BAAAAAID/ISiIYRPHPGIWzFuhstIKihFDUlOT1bxlQ93zz2HMPwAAAAAAQEAXq67402Szfu1mOQ5dczE58SxLWVnpatuhmSbddiXzEAAAAACABEYwEGMmjfu3WThvhfaXlFOMOGDbtvLr5qhzUaviG0ZfnEtFAAAAAABIPAR0MeSqy6aYtas3y3EcihFnkpN9atAoXw8/MYY5CQAAAABAgiEMiAE33/SoWThvhUr2lVGMOJeekarmLRqqR692nc67+MTFVAQAAAAAgPhHQOdyV//lNrN29SaFQnTNJQrbtpSTW0tt2hVqwuQrmKMAAAAAAMQ5Fv8udfNNj5pF81dq795SipGgvF6P6tbLVYfOLYpvGMX+dAAAAAAAxCsCOhe6+i+3mbVrNisUDFEMKCUlSQ0b19VDj49ivgIAAAAAEIdY8LvIzTc9ZhYtWKm9xfspBn6mVq10FTYvUO++HRueff6gzVQEAAAAAID4QEDnAs899V7Hzz6Zv2jtmi0KBoIUBAdk27Zq52WpZetGmjjlSuYvAAAAAABxgAV+lN06/jGzeOFq7dlTImMMBcFB8fq8qlsvVx07t5g3bORF3akIAAAAAACxi4Auiq752+1m3ZotCgQCIpvD4cze1NQUFRTk6V9PjGYuAwAAAAAQu0t8RNqUSdPMogWrtGf3PjkOyRyOXK2sdDVqUk/3/nMYcxoAAAAAgBjDYj7Crr38DrN+7Rb5/QFuaUVY2R5bubm11KJVI918+1XMbQAAAAAAYgSL+AiZOnm6WfD1Cu3ZvU+hkENBUGN8Pq/y6mSrS7dW84aOYH86AAAAAADcjoAuAq67YqpZv3aLKiur6JpDxKSmJatO3Vw99tQ45jkAAAAAAC7Gwr0G3X37jJnz5iw9e/cuuuYQpQluWcrITFNBwzp64JEbme8AAAAAALhx/U4Jasb1V04169bQNQd3sD22srLS1aJVY02+8+/MewAAAAAAXISFepjdf8/zzb6atXjN7t37FAqGKAhcxevzKjs7Qz17d7h9yIgLRlIRAAAAAACij4AujIZcfZdZvWqT/HTNwc2T3pKSkpOUm1tLp57Wr9e5F50wh6oAAAAAABDFtTolCI8Lzxxrdu/ay15ziJ3Jb1lKTUtWw0Z19eCjI7gWAAAAAAAQrTU6JTgyw669x6xYtkFV/gBdc4hJtsdWenqKOnVpqQmTr+CaAAAAAABAhLEYPwIXnjnG8IRWxAuv16PMWmma+frtXBcAAAAAAIggFuKHYcSQ+8ySb9YoEAjSNYf4uiBYlrxej/Lr5uiJ5yZyfQAAAAAAIBLrcUpwaC48c4zZtXOvHIdgDnF8YbAsJSX71LJ1I93z4DCuEwAAAAAA1OQ6nBIcnDHDHzTz5y5XKOTQNYfEuUBYltLSU3RU/84aPuYSrhcAAAAAANTE+psS/LaLzhprdmwvJphD4l4oLEu187J12h/6Nzz/kpM2UxEAAAAAAMK47qYEBzZx7L/N7M8XKxAIUgxwsbAkj8ejwmYFeujxUVw7AAAAAAAI15qbEvyyP5033mzZvFM0zQE/l5qarK492mjC5Cu4hgAAAAAAcIRYXP/E7bc8aT79cL6qAgGJcA448MXDkrJzMjXz9du5jgAAAAAAcCRrbErw//3t4lvMhvVb2WsOOAS2batR43w9+vRNXE8AAAAAADgMLKgl3XPHjJn/fW/u2X5/FV1zwGFeSZJ8XrVt30x33j+Y6woAAAAAAIe2rE5sV182xaxetYmuOSAcFxTLUkZmmvr271R8w6iLc6kIAAAAAAAHsZ5O5Dd/2glDTEW5n1EAhPvCYlmqWy9XT71wM910AAAAAAD81jo6Ed/09VdONcu+XU/XHFDDPB5bLVs31v2P3EhQBwAAAADAASTcovmPJ99g9peWs9ccEEEpqcnq2qONJk6+gqAOAAAAAICfSJjF8rBr7zGLF66maw6I1sXGknJrZ+m5V6cQ0gEAAAAA8H/XzInwJs88dbgp2VfG2QbccNGxpCZN6+v4E3v3OufC4+dQEQAAAABAwq+V4/nNjRx6v1kwd7kcuuYA1115fD6vOnRqoTvuvY6OOgAAAABAoi+T49O5p480e/aUsNcc4HLpGanq06+TRoy9lKAOAAAAAJCQ4m5BPG7EQ2bOl0vkOCRzQMxciCxL9ernavrMmwnpAAAAAACJty6Olzfy3PR3G7z2yiebdu3cy1kFYpRtW2rZpokeeORGgjoAAAAAQMKIi0XwxDGPmC8+WyTHcTijQBxITklS1+5tNOm2KwnqAAAAAABxL6YXvzNnvN/z9Vc/nb192272mgPiUHZOpo4a0Pn2wcMvGEk1AAAAAADxKmYDulvHP2ZmffqNgsEg4RwQzxcpy1KjxnX12Iyb6KYDAAAAAMTn2jfWDviFZz7o+NZ/Pl+0+bsdMoZkDkgUHo+t9h2b664HhhDUAQAAAADiSkwtdG+b9IT54rNvVFlZRTgHJOIFy5JSU1PUvVc7jbv5rwR1AAAAAID4WO/GwkG++OwHDd57Z/amjeu3KhTiQRAApNp5WTqqf+fjrx123gdUAwAAAAAQy1wf0E2dPN18+dkilZZW0DUH4McXMMtS0+YFeviJMXTTAQAAAABid33r5oP7+19vM2tXb1YwGOJMATggr8+rzl1a6LZ7riOoAwAAAADEHFcuZh+45/lmsz5ZuKZ4T4kch645AAdxMbMsZWSkqnvvdho9/jKCOgAAAABA7Kxp3XZAo4Y9YJZ8s1qVlVWcHQCHflGzLdUvyNOTz00kpAMAAAAAxMZa1k0Hc9VlU8yGdVsVCAQ5MwCOiNfnVYuWDXX/IzcS1AEAAAAAXM01C9c/nz/BbN2yi6e0AgjfBc6SUtNS1LFTc90y9e8EdQAAAAAAd65f3XAQl5433mzbsluOQzgHIPxs21Zu7Ux1LmqtkTf9iaAOAAAAAOAqUV+oXnbBRLN5007COQA1zuv1qEGjfD361DhCOgAAAACAa0R1kXrdFVPNyuUbFQqFOBMAInPRsyylpCSpecuGuuefwwjqAAAAAADRX6tG64VvnfCY+WrWYp7WCiA6Fz/LUq2sdLVtX6ibb7+aoA4AAAAAEL01ajRe9Nnp7zR49aVPNu3ZvY8zACCqvF6P8upkq0Pn5hoxlv3pAAAAAACRZ0fjRefNXbZpb3EJ1QcQdcFgSNu27tZnHy3Q5ZfeaqgIAAAAACDSotItcuYpw01JSRnVB+CuC6JlKT0jVYXNCtSjV7uGF1xy0maqAgAAAACo8fVopF9w5JD7zYJ5y+U4NKoAcCfbtpWdk6lWbRrr5tuv4rZXAAAAAECNivjC8/w/jDa7du6l8gBcz+fzKi8/W+07NNeIcZcS1AEAAAAAakRE96C7c8pTe4r3sPccgNgQCAS1dfMuzfqE/ekAAAAAADXHG8kX27p5V04o5FB1ADGlsrJK69dt0R9PucE0blJf/QZ0bnjW+YPYnw4AAAAAEBYRDeh27Cim4gBiknGM9peUa+XyDcrITN2kKD1kBwAAAAAQfyJ6i2vxbm5vBRCbLEvKrJWm407qOe+WO64mnAMAAAAAhG/NGakXuuOWJ80H786RMWzjBCC22LalZi0a6qHHRxHMAQAAAADCLmK3uO7dW0q1AcScjMw0HdW/k24YfQnhHAAAAACgRkQsoCvZVyaJ7jkAscG2bRU2L9DD00Zbr7xNPQAAAAAANSdiAV1ZWbm4uxWA21mWlJ6Rpr79O2k4XXMAAAAAgAiIWEBXXuan2gBczbYtNWlaoEeeHEPXHAAAAAAgYiIW0FVWENABcK+MjFT1HdCZrjkAAAAAQMRFLKDzVwWoNgDXsW1LDRvV1WMzbrJeeYd6AAAAAACisDaN1AuFgiGqDcA1LEtKS0/RMYO667EZN9E1BwAAAACImogEdPfd9ezllBqAay58tqUGDfP12rt3W6Nu+jPhHAAAAAAguuvUSLxIKOQMotQA3CA1NVn9BxZp2rMTCOYAAAAAAK4QkT3oHMc0o9QAosm2beXXy9FTM2+2Xn+fegAAAAAAXLRmjcSLGENAByA6LMtSWlqK+g/soqdm3kzXHAAAAADAdSLSQWeMyaHUACLJsiTb41Gd/Gw9NfNm67X3qAkAAAAAwJ1sSgAg3lR3zaXqqAGd6JoDAAAAALielxIAiBeWJXm9XuXlZ2v685OsV9+lJgAAAAAA96ODDkBcsCxLGRlp6tOvo6Y/P4muOQAAAABAzKCDDkDMS0ryKb9ujqY9O8F6+W3qAQAAAACILXTQAYhZlmUpKztDRw3opGnPTqBrDgAAAAAQk+igAxCTklOSVK9+bT361Djrxf9QDwAAAABA7CKgAxBTbNtSdk6mirq30chxf6JrDgAAAAAQ8wjoAMSMlGSjho3r66Fp46znX6MeAAAAAID4wB50ANx/obKNcrNC6tkxqCHX9aIgAAAAAIC4QgcdAFdLTXHUoE5Qx/T0q1cnKbXyBe1dNc2k5vddlpzVuh0VAgAAAADEOgI6AK5k20a1sx11aOnXiX2Dql/Hkm1LJlSpyu0fKlD8Tdv9G183mY1PYx86AAAAAEBMI6AD4DppKY4a1Qvq6O5+desgpaZY+mkKF6rarbKNL2r3wgkmtd6xSqrVsqs3rf4CqgcAAAAAiDUEdABcw7aN8rJD6tQqoIG9AmqQb8nj+bW/YRQoXaPgmvVKzu02v3LPAnnTGtf3ptTeRjUBAAAAALGCgA6AK6SnOmpcP6h+RX51ay+lp1rSQd68akxIlbvnqqpkmZLz+m7171temZzVJpWqAgAAAABiAQEdgKiybaP8nJA6tg5oQLeAGtWTPJ7D2VbOyAnsV8W29xXYtySl9Lv/mKTsdl2TMptx2ysAAAAAwNUI6ABETUaao6YNAurdOaCitkaZaQffNXdAxlGwfLPKNr4k/94l88u3fSxfrVYeX1qBQ8UBAAAAAG5EQAcg4jy2Ud3aIXVuHdBRXQNqUFfyesL7MFZjggrsW6pQ2Tol5RSFKnZ9raTMpm09ybWXcwYAAAAAAG5CQAcgojLSHDVvFFDvTgF1bm2UmWHV4KsZOcFyVe76UoGSlUqu3X2Zv/hbJee0tzgTAAAAAAC3IKADEBEe26heXlCd2wTVu3NQjeqZsHfNHZBxFPLvVMW2DxQoWaHq/enae5Iym3LbKwAAAAAg6iIT0BkKDSSyjLSQWjQOqlengDq1clQrw9KRbzZ3GJciJ6BA6TqFKrcpsH9VqHzrR/JltfH40uoT1AEAAAAAooYOOgA1xmMb1asdVJd2QfXsGFTjekZeb7TvLq2+7dVfvEDB0nXy7e8Yqtg5V6l1enDbKwAAAAAgKgjoANSIzHRHLZtUqWeHoDq0NMrKlKLRNXdAxihUVSxn5xcKlq5RybrnTXJORyVntyOoAwAAAABEFAEdgLDy2Eb16wTVtX1A3duHIrvX3GEwJqhg+WaF/LsV2L9Kpd/9xyTndPT4Mppw2ysAAAAAICII6ACETUaao9ZNq9SrY1DtWjjKitJec4fDhCoVKFmpUMVWBUrXhMq3fqyk7HYdvan5SzizAAAAAICaREAH4Ij98ITWHh0D6trO/V1zB2bkBErk3zNfwbKNCpSuWVy5e55SanfjtlcAAAAAQI0hoANwRNLTHLVtWqVenYJq28yFe80dDuMoVLlDlVV7FSxdr5J1z5uU3C7LkrJat+OMAwAAAADCjYAOwGGxv39Ca6/OAXVtW9015/HEV6OZcaoUKFuvkH+HAqVr25ZuetMk53bx+NIasD8dAAAAACBsCOgAHLL0VEftmld3zbVp6igrM3b2mjscTrBczr5l1fvT7V8bKt/2mZJzOiR5knMCjAYAAAAAwJEioANw0Dy2Ud3aQfUtCqhL25Aa5sdf19yBGTlVxaoqXiAZR960gt9LeplRAQAAAAA4UgR0AA5KWoqjDi396tslqFZNjDIz4rtr7pfY3nT5stopNa+3kmo1J5wDAAAAAIQFAR2AX2XbRnVzg+rfLaDObUNqkG/ksRPsoaaWLW9qgVLyeis5t8jjy2jMHnQAAAAAgLAhoANwQCnJjjq29Kt/t6BaNJYy06WE7JrL7qDUOn2UUrubxagAAAAAAIQbAR2An7Fto7zsoAb2rFKXto7q5yXSXnPfs2x5U+oruU5fpdTu6vGlN6RrDgAAAABQIwjoAPxIks+oc+tKHdMjqGaNjDLSEnSvueyOSs3vq5TcIrrmAAAAAAA1ioAOgCTJtqS87Cod3zegTq0d1c1L4L3m6vRXcu0uHl9aAV1zAAAAAIAaR0AHQD6PUVG7Ch3XO6QmBVJ6qpSYXXOdlFZ3gJJzOtA1BwAAAACIGAI6IIFZlpRbq0qnDKhSlzZGeTmSbSdaEar3mkutd4ySc4u6elPrLmBkAAAAAAAiiYAOSFC2bdStXYVO6hdSw3pSWkoC1sCbpqScLkqrN7AyKatNKqMCAAAAABANBHRAAsquVaUzBvrVuY2Um5WgXXOp9ZRab5CSc4uaeFPyNjIqAAAAAADRQkAHJBDbNurarkK/OzqkBvlGKcmJt9Wa5UlVUm5XpRcMuiEps8VdjAoAAAAAQLQR0AEJwJKUmxXQaQMr1aWtlJ0p2Yn4hNaUukotOFnp9QfyEAgAAAAAgGsQ0AFxzraNenYo1ylHh1S/jqVkX/XDIRKJ5UlRcm53pTc40ePLKHQYFQAAAAAANyGgA+KUJSknK6A/HFvdNVcrw0rIveY8yXWU3uh0pdXtT9ccAAAAAMCVCOiAOGRbRj06lOt3x4RUUMeSLxG75uwkJef1UHrD0zy+tAK65gAAAAAArkVAB8SRH7rmTj+2Ut3aSZnpidg1Z8mbXEdpjc5SWt0+lnQlAwMAAAAA4GoEdECcsG2j7u3KddqxIRXkW/J6Eq9rTpZHqXl9ld7kD628KXVWMSoAAAAAALGAgA6IcZb1/RNaj6lUj45SRpqVeMGcLNlJOcpsdrFS87pb0uUMDAAAAABAzCCgA2JY9RNaK3TasUEV1Km+nTURw7nU/AHKavVXS/oHgwIAAAAAEHMI6IAYVN01V6XTB1aqZycpLdVS4j2i1JInOVeZLf6klJwuPKEVAAAAABCzCOiAGOPxGHVvV6HTjg2oYV1Ltp142ZSRR6l1+yu75V8s6V4GBQAAAAAgphHQATHCtqXaWQGdOqBSvTsbpafZCVeDkCNt3+Xou/K+Or3fX+iaAwAAAADEBQI6wOUsS0ryGXVpXalTjw6oSYESrmvOMVJVldGn86TXP0zX/rLF+uvFk8yjT91ESAcAAAAAiHkEdICbJ6jHKC8nqOP7VKpvF6OM9MTKo4ykYFDatN3Ry+8l69s1yQoEq2uwYd02nTDgGtOrT3vdfPtVBHUAAAAAgNhd/1MCwH1sS0pJcdS5lV8n9Q+osCDx9ppzHKmsQpo13+jtz9K1d79Xxvz4zxjH0ewvlujUY683b374D0I6AAAAAEBMIqADXMbnNapbO6hje/rVp4uj9PTEekKrMVJVQPpum9FrH/q0dE2KqgLWr/x5o6qqgE7o/3eTVydbz7x8K0EdAAAAACCmENABLmHbRmkpRh1a+nXiUQE1a5h4XXOhkFRSJn2xwNL7X6Zqz76fd80diDFGO3cU66SjrzFt2hXq3oduIKgDAAAAAMQEAjogyixJPp9Rvbyg+nfzq28XR7UyEmyvOSNV+qX1W4ze+tSnZWuT5a86vKfUhkKOli5Zp98NGmz6H1OkEWMvJagDAAAAALhaRAI6I0OlgV9g20YZaY7aN6/SoD4BtWiceF1zwaC0t0T6apH04ew07dp78F1zB7zmGCN/ZZX++94cnXv6KPP8a1MI6QAAAAAArkUHHRAFliUl+Yzq5wXVt8ivo4ocZWYk3l5z5RXS2k3Se597tWzd4XfNHfA1HKM9u/fp5GOuNU2a1te/po0mqAMAAAAAuA4BHRBhHtuoVoajds2rNLBXQC2bWLKtxMqNAgFp1z5pzjeWPvk6JSxdc78mGAxpzapN+v3xQ0xR99aaNOVKgjoAAAAAgGsQ0AERYllScpJRg/yA+nSuUt8u1V1zicQYqbRcWrVB+niOT8vWJanSb0fs9Ssr/Ppq1mKdc9oIM/P12wnpAAAAAACuQEAHRIDHNsrKdNSueUDH9KxSqyaWrATrmqsKSDv2SHMX25o1L1k7a7hr7kCMMSres18nHX2NKWhQRyec3LvTeRefuJhRCgAAAACIlogkBHfc+qR5/+3ZVBuJN8EsKTnJUcO6QfXqGFDfolDC7TXnGGl/qbRyg6XPvvZq2dokVVbZrjm+5JQktWlbqDvvH0xHHQAAAAAgKuigA2qIxzbKqhVSu2YBHd0joFaFibfXnL9K2rZLmrvE1pcLk7Sz2BeVrrlfPcbKKn2zYKXOPGW46darnUaP/zNBHQAAAAAgogjogDD7oWuucf2gerSvUt8iR7USbK85x5FKSqXl6yzNmu/T8nW+sD+hNdxKSsr0yX/n6ZJzbjLTZ04ipAMAAAAARAwBHRBGtm2UmxVS+xYB9esaUOvCxNtrzl8lbd4hzfvW1lffJGnHHl/MHLvjONq6ZZdOGXidadq8gY45tlunsy8YxP50AAAAAIAaRUAHhEmSz6hZw4B6dAioT5eQMtITbK85R9q7X1q2xtIXC71asT7J9V1zBxIIBLVqxQZt/m77orE3/lO33HE1HXUAAAAAgBpDQAccIcuSMtJC6tgqoGN7+dWqiZ2QXXPfbZO+/tajuYuStKM49i8txkhlZZWa/eW3Ou+MUaZH7/bzho28qDsjHgAAAAAQbjYlAI5gAlyFJqsAACAASURBVNlSfk5Qx/by65wTq9S60FYiZXOOI+3eK81eZOuVD5L0wZcpcRHO/Ygx2r1rn95/+6tuf734ZsOoBwAAAACEGwEdcLiTx5Ya16vSyQP8Ou2YgGpnJ17X3KqN0juzPHr1v8latDI5Zm9pPRihkKMN67bqvDNGE9IBAAAAAMKKW1yBw+CxpRaN/TrxqCp1ay/ZduJk3Y4jFe+TFq2yNWexVyvX+1QViP/3b9u26tXP1ZPP84RXAAAAAEB4EdABh8i2pTZN/Tr1aL86tkq8rrm1m6S5S7xasMynXcWJcQlJSU1Sy1aNdfeDQwnnAAAAAABhR0AHHALLklo29uuM4/xq3TRxsprqrjmjBcs9mrvEp1UbvAoE7QQ435Zq52Wpe6+2xcNGXpzLDAAAAAAA1AQCOuAQNKpXpdOP9atNs8QJ5/xV0uoN0twlPi1Y4dOevYlx2fAledW0aYEGDOza69yLTpjD6AcAAAAA1BQCOuAgZdcK6rSBfnVomRjhnONIe/YZff2tR18v8WrNdz4FQ4nQNSdl1spQl26tNG7SX60HH2PsAwAAAABqFgEdcDATxevoxL6V6t7eyLLiP6CrCkgr10tfLUrSNyu82luSGJcKj8dWQcN8PT7jJuulNxn3AAAAAIDIIKADfoMlqXNrvwb2dOTxxHc490PX3OxFXs1f6tXaTT4FQ4nRMZiWnqL2HZtp8p3X8CAI1Jgrz3/Q7NtXrtJSv6r8AdkeW2lpSUrPSFF+3Szd+fBljD8AAAAgARHQAb8hq1ZApw4IKD0tvtfNgaDR0jXSlwuTtGS1T/v2exLi/Fq2pbw62XrmpVut195lvCO8xg152nw9e41279qvYCCo2V+u+tU/363ZEJOekaIGDXP17FvDCesAAACABEFAB/wKy5L6dvGrWcP4XScbI+3Z6+jzBV7NX+bT+s0+hZzEyAWSkn1q0aqR/vHQDQQhCKtJNz5n3n5jvv7zyteH9Pccx2h/SYWWL92srk0Hm8Km+Xr5w9GMTwAAACDOEdABvyKnVpUGdHdk2/G5Pg6FjBatlL5YkKyla30qKfUkzLnNys5Qn36d5g0beVF3RjrCqV+HkeaVmV8d8b9jjLRu7Q4VFQ42ffq11j+fvoqgDgAAAIhTBHTAAViSurWrUt1cS/H2XAhjpOISRx/N9WnhUq++25Y4XXNer0eNGtfVI9PHWi/+h3GO8OrRYpgpK60M+7/75awVOu3oW8zrn4wlpAMAAADikE0JgF/m9Trq08WRJ86aykKO0fylRk+9nqIPvkjW+i1JCRPOpaYmq3e/jnpkOiEHwmvUNU+ark2HmGAwVGOv8d2GXerXYaSh2gAAAED8oYMOOIDG9arUID9+uueMkXbtdfTRbJ++We7Tph1eOQkSzNnfPwhixku3Wq+/z9hG+L375kIZU/PZWVlppfp3HGk+W3wbITMAAAAQT+tWSgD8nGVJHVsH5PPFx/sJhYzmfWv01Gup+nBOsjZu8yVMOOfzedWxcwvNeOlWAg3UiJ4th5lIhHM/KN1fqdOPuZVOOgAAACCO0EEHHECbpo48dmxn2MZIO/c4+u9snxav8GnLTm/C3M5qWZbSM1L1ytt3Wm99xHhGzRjQaZTZX1IR8dfduH6nrr30YXP/k1cQPAMAAABxgA464BdkpgdUUMeO6dtbgyGjOYuMnnwtVZ/MTdGmHYnzIAjbttW0eYFeeftOwgvUmGGXPxaVcO4Hsz5ZxkkAAAAA4mUdSwmAnyuoE1BykmIyoDNG2rHLaOY7Xr38Qaq+XeNTWYUtkwg3xFnVt7Qee0IPPfzEGMI51KgvP1sR9WM496Q7uNUVAAAAiAPc4gr8hCWpoK4lOwaf3mqMtGSVo3c/T9XqjV6VVyZIMKfqW1pr18nSsy9P5pZW1Ljr//yI+fSjpVE/jpXLt3AyAAAAgDhABx3wC+rmhOSJsf6rqoDR+19YmvlOmpYmUtecqsO57r3a6tmXJ9M1h4hYtnSza47l+sv+TRcdAAAAEOPooAN+ypJys4OyYqiFrqzC0Zuf+vTVwiTt3ueV4yTO6UrPSNWr79xlvfcZQxeRU7y71DXHMuvjpZwQAAAAIMbRQQf8gpxakh0jvVjFJY6efztJn8xN1u69iRPOWZalVq0b69V37qJrDhF141VPmGAw5JrjcRwa6AAAAIBYRwcd8AsyM2LjCa67i41e+iBJ85cmJ9R+cz6fVyefdlTza4ecu5bRikjbW1xGEQAAAACEFR10wE94PY5Sk9wf0BWXOHrpgyTNS6BwzrIs1W+Qp7c+us8inEO0+CurXHdMd058ZRBnBgAAAIhdBHTAT6QkB2W7fGaUVTh6/SOf5i/1qSJBwjnbtjRgYJGmPz+JW1oRVSX7yl13TDu27X2fMwMAAADELm5xBX4ixefIstybeIUcow++9Gret8kqr/TEfThnWVJWdqZeeON2691PGZ+IvmDIfRs9Ll64gRMDAAAAxDA66ICfSEpyd+I1d7H01TdJ2rc/EcI5S52LWumFN26naw6u4caHMlT5g5wYAAAAIIbRQQf8hMdjXLv/3PZdjmYtSNGWnV7F84MbLUtKTU3Ra+/dbb33GWMS7mK78B74lm0K9N/5nBsA8W3Y3x4z69fuUH69bD004yp+vAMAxBUCOuBni293Jl8hx+iTr31avcErx4nf76SWZalZiwL9a9oYvnjDlVKS3ffRWbd+NicGQNyYcMMzZtWKrdq5o0QV5X5VVgbkhBx9+P5iSdLmTXs0c/qsBudc0m8z1QIAxAsCOuAnPC6NhVatl5av9aq80hO3tff5vDr+5F4vDLnxwnMYiXCrjFqprjumiXddQKANICZdecE/zabvdmvf3jL5KwMKhRy99uKcX/07fn9AhHMAgHhDQAf8hOXCnRkdx2j+Uq82bovPfecsy1Kd/BzNeOkW662PGINwt1ouDOgAwM1enPF5z3lfrpm9ZuVW7dq1X5WVVaqqCsoJGc3+YiUFAgBABHTAz9i2XLcH3fot0votXvmr4q97zrIs9ezTXrfccTUdQIgJDQvzjpf0PpUAgJ+7c+Irg5Yu2vj+1q17tX9/hfyVAU0Z96IrH7ADAICbENABP2G7LCYyRlq+1tbWXfH10GXLspSVla4/nnNcw/MvOZHbVBAzho//4wd9292oivIqVxxP48I6WrCe8wIg8q655GGzccNO7S+pUHm5X8FASDOmfUJhAAA4DAR0wE+4rXuuvNLRxm0p2rc/fqar1+tR2/ZNdfeDQ60X/nMHgw4xp05+ljau3+mKY3ntYx6oAiCyigoHG8uy9PmnyygGAABhYlMCwN2+22pr525bioM7Q2zbVmZmmt7++H7r7geHEiogZr328RjLckGan5TM72wAosMYblkFACCs62VKALjb1p2WiktiP5/z+bxq1qJAL799J8Ec4kKd/FpRP4ZTTuvGiQAAAADiAAEd4GLGSDv2eLSvNHYfDmHbtjIyUzVgYJEeenw04RzixruzJ1pWFDetTElN0vip5zOnAAAAgDjAvTGAi5VXONq731ZVIDazdJ/Pq3oFtfX4jPHWK29zPhF/OnVuom+i9ISGL5fdQTgHAAAAxAk66AAXKy6RSstj77gty1JqWrK6dG2lx2eMJ0RA3HrilcFWNG51Pel3XSk+AAAAEEcI6AAXKynzqLwitm5vtW1L2TmZOuHk3s0n33UN4Rzi3ntzJlnJyb6IvV7b9g015YFLmFsAAABAHCGgA1zKSCort1Thj51j9no9qlc/T2eec2yva4acu5aziETx1YqpVnpGco2/Ttv2DfXMmzcQzgEAAABxhoAOcCsjlVU48vtj4/mtXq9HTZrW15PPT7TOveiEOZxAJJpZS2636uRn1di/P3BQR8I5AAAAIE4R0AEuVum35A+6/zh9Pq+at2yof03jKa1IbO/NmWgdfVx7WWGcCckpPi1Yf69196N/YX4BAAAAcYqADnAxf5WlQNDda3Kv16NmLRrogX+PIDwAJN372N+s+evutTp2aSLbPvxp4fHYOul3Rfpq+VTmFgAAABDnvJQAcK+qoK1g0L05usdjq1GTuoRzwC+Y/uoQS5Im3fic+fzT5dqza78cx5EkWbalUND535/9IcjzeGzVK8jR65+MtSTp6weoIwAAAJAICOgAFwuGbIUcd2ZflmUpLz9Hjzw5lnAO+BU33XHej+bIizM+73nWhUfNmTLmBVNaWqlb/3Gx9eLTn/c866KjqvduXEXNAAAAgEQToYCO9TtwqBxjFAxJjksDuozMND39ws1MbuAQnXVhdRA36taz/zd//hfOAQAAAEhI7EEHuJQxknHceWy+JK/adWjKSQIAAAAAIAwI6ACXMo6RMe48tvz8HN1yx9V0zwEAAAAAEAYEdIBLOab6P26TkpKk9p2ac4IAAAAAAAgTAjrApYyR6zroLMtS3Xq1NXz0JXTPAQAAAAAQJgR0gEtVh3PuSuiSkrxq1qIBJwcAAAAAgDAioANcyhj37UGXnZOp0RMuo3sOAAAAAIAwIqADXMrIXf1zlmWpdp1sTgwAAAAAAGFGQAfgoCQn+9SwcT6FAAAAAAAgzAjoAByUjMw0DR/FwyEAAAAAAAg3AjoAv8mypPSMVAoBAAAAAEANIKADcBAspaenUAYAAAAAAGoAAR2A3+T1epSdk0khAAAAAACoiXU3JQDwW3xJXtXJz2lOJeLTyGueNFs27VFleZXKK6rkrwwoGAwpGAzJMUZOyCgUciRjZNmWjKm+7dmyLNm2Ja/XI6/Xo1rZaWrSJE//mHY5exXCNUZfO92sWbVNpaWVClSFFPhhbDuOjGPkOEbGmOrHZluScYwsy5JlV49vn8+rWrVS1bBRbT30zNWM7Rg1dcLLly//dtPDZaWVqqwMqqLcr0AgpGAo9P31TQoGHRnHkSxLlmXJGCPbrv7vHq8tr9ej1JQk1W+Qo7YdGl4xfMIfH6GywK8bde10s37NdpWWVqq8rErBUOj7+fb93PueE3Jke2w53/9vtqe6j8TjtWVJ//uu4fN55EvyqU5+ph574TquyUAYXXbWfWbHtn0KBILVn5HBkEKOI+Oo+nuTMf9bBxin+r/88Dnp/f5z8od5mpaerIIGubrvCdYFhyIixbrj1unm/be/otqICW2blem6ixxlpEX3OMoqQnr2rRR9+nWKjInusWTnZOqFN27n4hoHRl7zpFm2ZJN27ypRZUVAoZBT/SEbxjH2Q3jn8XqUmpqknNwMdejcWLfcexFjCDXmzkmvNFs0f/2aLZv2VIdxgeoQTmG+flq2pdTUJBU0yNUL741gTLvQ1AkvX75o/vqHv9u4S+VlfgWDoRr5HLUsS7bHUnKyT5m1UlVYWEfHntyp4TmX9N8c7zUuKhxson0MC9bfy/xzkVHXTDfr1mzTju0lKi+rDsCrF/M1O1R++LEwJdWnlJRk1aufpfadGmvUrWczPoADuPbSh83aNdu1b1+5/JUBhWroc/IHtm3Jl+RVVlaamrWoq4dm8IPnAa9pkXgRAjrEEgK6n6uTn6NnXr6VC2kMOuv428y2rcX/C+OiLSnZq9zamerQqbGm/uvPjCkckd8PuNls37pXgWAo7EHcwX/ptJWXX0vvfjWB8RwlV5z3oFmxfHONhnGHwuOxqwO7Zvma9tL1cTkuCOgw9K+PmYXz12nf3vKIBHGHvMi1LHl9HuXkpKv/se00dsq5jBck7ufk+Q+abxdvVHlZlSQjN0zX6mA9Sa3bFujxF69nfv5w7YrEixDQIZYQ0P1c/YI8TZ85iQtnDC1WF8xbq0Ag5Ppjrd7fMF39B7bTTXecF1Nj7LyTp5otm/dE6JP0APXzePTh/FsSZm5OuOFZ8/kny7Rn9345jnHd8VmWpcJmdfTyf0fX6DkZdc1088Vny2WOIJX02LY+WhC7P7zcNu7Fr995Y363fXvLXX+stm0pLT1Zrdo20GMzr435+XrRaXebbxdtjPpxdCoq1JOvDOa7SYS88NSsjm+8NHfR6pVbVVFeFZPvIaNWqtq1b6iHn/17wo2bfh1GGttz+G/bkqWs7DS9/snYmK7dX86+z+zZtV9lZVUKBkPKyUnXS/8dFZfj4aLf32VWr9omf2UgJo43LT1Zffu3Sfgf8AnogJ8goPu5ho3zNe0ZukPcbOqEly9/67V5D+8tLovdDySr+stfr76tdNuDl7p+vJ3cZ6LZtrU46scR710kk258znz0/uL/dWnEivy6WXp39sSwn5sXZ3zec/LYF2eHoxYX/GlAzO2jduZxU8z6dTurb1+OUckpPrVuU6AnXx0Slbnbt90IU1UVkNfjOaS/Z4xRIBiq3nfIJX7YJzJcAoGgcmtn6v25/Cj5g9/3v9ls27pXwWAort5XUpJXrdoW6KnXhibEue7adIgJx+fGqWd0j5ktS0Zc/YSZN3uNSvaXKxj45e5qy7I0f909cTMGzj3xDrNu3Q4FqoIxvB6QaufVStjrcIQCuifN+2/P5hMOMYGA7ueaNK2vR58ax5dVFzr/lKlm5fItruwmOlIZmSnqXFSoB6Zf6cqxd8bAyWbDuh1RP454DeiGX/G4+fjDbxUMxPaiMCsnXR+HsVPtmKIxZl+YgvhYGTujr51uPnp/sSpjpAvgUHh9HjVrXlfPv3NjxM6FG25PdTtun5X6dxplSksqEuK9FjTI1WVXD+p15oV958Tre+zeYqgJBY/8hw2v16O5q+9y7fy4/s//Nl/PWa3yMv9B/52+/dvowaeujOk5f2q/SWbLpj1xN26Tk336asXUhLoe2xF5Fb4GALF9obDJ5txmxNVPmG7NhpjlSzfHZTgnSaX7K/X5p8tVVDjYnNhrPJ8kCWLIXx41PVoMNR+8uyjmwzlJ2ldcpqLCweao9iOOeAxffdFDYQvnYsErz37Z4Kj2I8zbb8yPy3BOkoKBkFYu36KiwsGmd5vhZvR107nWucC5J92RkOdh5N+fND1aDDNFhYMTJpyTpC2b9+iWMTNn9+swkvn3W9esYEjX//kR19XphJ7jTVHhYPPpR98eUjgnSTt37IvZ83F8j5tMUeHguAznJMnvD6iocLA5oWfirAO8AoDfYNs2RXCRPm1vNO+9tTCh3vOO7ftUVDjYpKYm6ehBHTTl/ktIjePM1Rc+ZGZ/uVIf/3dJXL6/8jK/igoHm4zMFH22+LbDGr+zv1iZMOPhnBNuN5NGPZ9Qc8BfGdDbr89X12ZDTJu2DfTMmzdwnYuSdWu2J9T7/du595v5c9fq3TcXJPR5LyutVFHhYOPzeTTo5M6afB/fNX7JrE+WueZYjmo/wpSX+Y8oZNu2bW/MnYNju441xXtKtWtnSUKMuZ07qtcB7To20ow3hsX1vGTVDeA3WRbfT9zgktPvMUWFg01lRVXC1qCiokrvvDFf3ZoNMRf9/i5+6Y4DYwc/bbo2G2K+/HxF3HaD/l+l+6sXgJef+8AhvdlB3ceZRKiPJPVoMcysWrk1YeeEcYyWfbtJRYWDzaDuN3Gdi4JAIKQbr5oW97Uf+tdHTVHhYPP17DVKlOvLwZ7/t1+frx4thlGUX+A4Rn85+76o1WbymBdMr1Y3mKLCweZQu+V+Sdn+ypip/alHTTJFhYNN8Z7ShBx7Sxd/p27Nh5rxQ2fE7dwkoAPwm8jnoq9ny2Fm8TcbKMT/+XL47eLvVFQ42Fz4uzv5Ah2jBnW/ybz56teu2nQ+UubOXq0+bW80M6d/1uC3/uyQvzxqdu/aH/c1OanPBFNUONjE22b0R2L3rhIVFQ42/TuNMi8980VHKhI5s79YFdfv76j2I8xHHyzhRP+KYDCkosLB5oyBk/me8RMLvl4b8dccdc1006PFMPPCjM9VFcaHIDiO0TWX/Mv157h786Fmy+Y9CT/2nJCj11+eqzMHTYnLeUlAB+AgkNBFy1/Pud8UFQ42gQAL1gNZumSTujcfaqaMeYEv0DFiytgX93RrPtTs3lWS0HWorKjSlJte2vSnP9z7q2P304+Xxn0tujYdYrZv3cvkOIDSkgrdMnrmonNOvJ3rXISU7CuPy/d1yRn3hK3zKFFsWLdDRYWDza2jZjL/vmeMdPHpd0ekHjcNnWG6NRti3vnP/Bp7mvDOHe79PnLK911zoZDDwPs/1q7ernDs7+s2BHQAfhMddNFx/ilTzbw5ayjEQQiFHM2c8bmO6TKaL88ud2Kv8Wbm07NyHL5o/s83C9ard5vhvzh2T+g13sR7rYoKBxtjmLoHY9WKrerWbIiZcMMzFCwC/nhcfHVOdW8+1CxeSDf+4Xrx2S80sGgMc+97S77ZWKP//kvPfNHxqPYjzBsvz63xW7C3ufQHou7Nh5qtdM0dUHmZP+5uRSegAwAXOmPgZLN86WYKcYj27S1XUeFgc+kf7uELtAv1aDHU7Ni+j0L8An9l9ZPKrvvT/3863g1XPG52xnG9bhv74p6iwsHM1UPkOEavvThHR3fmB4ma9t2GXXpxxuc9Y/19nDloCh04YbL3+ydz001X7Y/H1cxthqcdfYu5ZfTMRZHq9Czd766nFp970h3M2YMUDIbUtelgM35YfPxwRUAH4DfxkIjIOrnPRLNh3Q4KcQQWLaBDwE2GXznt+73F+KL5Wz77eKnOPuF2M+zyx80nH34bt+9zzPVPmeefnpXDGT98JfvKo7pRe2Is/Bx99M7i2bH8Hvp1GGnWrt7OyQyzF5/9Qped+Y+En3/hfuLx3y/+lykqHGy+27Arou/DTfvQndBzvFm5fAuT7BAYI73+0hz97dz7Y35OEtABgIuc1HuC2ba1mEIcoYxaqRTBJa44/0HzwTvfUIhDsHrlVn343iIF43TvyVtGPW/eem0eJ/pIv8Tblh574Tp+QathC+evi9lj79p0iCkrreQk1pAF89bplL4TEz6kO7nPhLDUoGfLYeaLz5ZH7X3s3B79feiO6TLa7NzBnQaH6+vZa3TtpQ/H9JwkoAMAl7j20ofN9m1skh4OAwd1oAgucOHv7jRzvlxFIfAjLz/3FUUIg9p5tShCBMTqwxTY2zEytm4pVr8OIxO60Ee6f9tZg25zxQPRtkX5O3jvNsPNvr3lTKojNOuTZRo3ZEbMzkkCOgBwic8/XU4RwmTS3RfSVRJlpx19q1m6ZBOFwI/07ziK0CBMBhzbjiJEyOnH3Bozg3bi8GcNeztGVllppbo3H5rQNT+u27jDev89Ww4za1Zvc8V7iOY+dD1aDDP+ygCTKUzefHVuzB47AR0AuEC/DiNYtIZJ776tKEKUndR7gvluw04KgR+59Ix7jNs24o5VGbVSNfa2c/khIkI2fbc7Jo7zT3+817z6wmxOWBSEQo4SORjds3v/If35S864xxVdc/9XtPah69p0iAkGQ0yiMDKmuq6xeOwEdAAQZb8fcIspK/VTiDB56JmrWbRG0Ul9JnCrNn7mzomvDFq0kIe3hEvPXi0oQiQX7iFHfzv3AVcv9q699GHzzfz1nKwo69o0cUO6o7sc3JOle7cZbha79PMg0k+a79ZsKD/Q1xBjjLq3iL3OVgI6AIiyTRt3UYQwadWmgCJE0aV/uNds30o4h5+b+fSs96lCeKSk+HTXv//CDxERtmSRewPm28a9+PWsT5ZxklwRClTfrpiI771kb7luHvHcAd/7jVc9YYoKB7v6Vs7t2yIX0PXvONI4Dk+3r0mhoKOj2o+IqflIQAcAUXRi7wn8bBZGz79zI4vWKBl7/VNm0YL1FAK/ODYCAW7fCZc27RtShCiorAho6oSXL3flZ99Ts7pxhtwjGAzFXCgQLm8e4AndZw6aYt5/e6Hrjz9S2zD88djJpnQ/T1iOhPIyvy4+/e6YmY8EdAAQRTu4FTBs8utmUQQXfikHPnh3EUUIE6/Xo2kvXc8PEVHy/lsLH3bbMfFACPeGAoO6j0u4c+OvDGj4ldN+9L4HdBpl1q7eHhPHX70P3cM1et6uuvAhs27tDiZJBC1ZtDFmjpWADgCi5NR+k/4fe/cdHlXx7gH8nW3pPUAS2kLofZNQRUUBe6N3bAgqiEvvHUINiUgRFKV3EBHpIAoECITQewqQQAik921z/0C4+hM1QHZ3zp7v53l87r1eYee8M2fOnPdMwaC6FO0+PgkvrXbSpMZQtGV4rOljNuJkulJUvqIfgmBH99JyhCpPaNVB6HsFln4/lzq9MkN2dXRw//lH/3tI1UE8N6dQYve59Za5zp64pe+xI1dwc9gaf3AgnxSKigQdAICd3EnJQBBKiZePG4JgJ60ajeZGgwmBgMf6+ceTCEIpUSoVtPXX0fgQYWcftI8S4iWvRZ3h3GJBfk5016+m0pcfLpFVRZmMZgoLHsx1Wj3nEmyjqVbcS3fNst8X466wj/w8aSx1RYIOAMAOur85B4c2laLX3tJhfaUdvN8ukmdnFSAQ8I8KC3BCdWkpg2X8Qrh0IdnuZej5dgQvLDCgMiTikAwP8DCbpXv4gbX2oWsdOg4jfzs7f0b8pa5I0AEA2AH2nihdI6d0DEMUbO9s3A0EAf5Rl9dm4WWkFL3Yui4+RAjAUGyiScPW2rVtXzh3CxUhIdzC6SXdGPSHEmGNfegmDl3DM9JzEVwBPN9glND3IhJ0AP8Da0fAFooK8eW71B60reogCHYgx82v4clcu3IHQSglHl4u+BAhkIP7ztvtt5vVHIa+V4KyMvP/dngCiKu096HbvhXbPYgiL6eQpoxcL+y9qEIVAQDY1sj+y/nuX+KEL6dKpSQ3D2fy9/cgbx83cvdwIbVaSUWFBsrLLaK8vCLKzysig8FEFgsni8VCRYVGMhof/N+2Mm9ZX+TVbWysfhX/BYNN+A9SWMfPFIxcXDTk4+NO/mU8yN3DmVxcnchsMlNubhHl5RZSfl4xFRYayGy2EOecDAYTFRcZbbqEq0mz6vT7GbQpUWRl5tvld/t1XcBjjl1DBUjUgT040VoqjHduYgAAIABJREFUSnMfup5vR3DMehXLHoHfw5CgAwCwsQvnxN3/gCkYBQR4047oCc+U9Brz5Up+6dwtup+eS4X5BjKZzURWeFevW78ixSWhTdl8YLMjziGuQ6lUkEqlJIXyQXNXKBTEGJHZzImIk9lkIZPJTNiI/clNHbmeb153VNjyubk7UbPnatKcxR89U1/X+71InnIrnfLzislgMFklKeniqnnmcv6ZQsHQpkvBF+8v5l8v72fTD0SOlpxTKhUP/lEpiDFGSqXiUSKccyKzyUxGo9lhrtdi4fRyyFh+4NRUfFgUXH5eUan8PRtXHWkSPnajQ9yrCqWCFApGSoWCLJyTxWwhC+dkkuA9mpdbRNPHbswYNbWTr2hlQ4IOAMDG0lKzhSxXxcr+tO23sYwSnv3vmvZVr78NPvt2mc/jr9+lrKx8spTSzJNVPw/BINfGerwVwS+el+aXYKZg5OysJj9/D6pWPZAil/YpUfsZ8fkynpSQRhnpeZSTU0CGYpxa+1+OR18VslwaJxUdvzKHEREdLoVViiu2DvpLGxr+2TJ+6UIypd3NKrV2Ur9BZYq+WHoxiE2IZMM/W8af/KsJI6PBRBcvJFNaapbd67JGrSCqVjOQ7HGKtFKlpOlf97bp8+eFhqN4bnahpPsFhVJBHn/MzK9RuzyFlzCGH3b4iqfcyqC8vCLJHzyTmZFHYwau5NPm9cL4RWCccxo5YDmfMf/9Z6qnBRE7jkvx+pVKBfmV8aQKFX2pTDkv+q84DO33PU+5lU4pyRmUl1skiRn0u34+5SNiuZCgAwCwMYNBrJd7tUZFMVfnMGvPRFuyfgD7c8IjNiaBMjPznjpZF1TBF7Pn7ECKyTkXFw2FNgmmv8x2+b3kf37mwg/+NjDt+XYET0xIo4KCYqvMDpW65JvpwpWpYYiWlm3RW/WleNaiv7aV9i+H85SUjKdO1qnVSlq8rj+zdjmflE6rt3urX79rOKNd8rifxn65kv/ykzTPCGGMkV8ZD2rWogZNier5/+1uX8n/jh82f/mX9vpBuyh+6WKyZD+WSGGbEzlRKhWk1qjIyVlNapWSXN2cqJLWn541OTdp+Fq+dcNxSd2rXt6u1OKFWg8+tMcT0bGS/dn/neX9cad5/NKFFKET6jmCfvBAgg4AQMbcPZzp0LkZNv+K++eEx8j+y3lsTDxlZDxZsu6Xw+Px9dnG2oSN5+n3cyRT3jJlPWlPzGRGRBR9qXT/7j/P3uz86kyecP2uTfckgyd76XjzvVCaEtnT5n3GlgOjH/1m+9bTeUpy+hMlFSpW9qcYbDkme7t3nJZkuUMaV6WlGwcySiTaG1N6f++yH/8/0f5Gi0n8zu1MScXFbLbQZz0W8UWrP8M4xi7PBCKNRk1lA7yp6XPVaUx4Z6vUw55fpHHfKlUKahRShb7b8AUjIvq1FPLHSzcOfBTT15tP4ql3xLxH2zYez/eemCzUfYgEHQCADc0cv3nDuhWHhCiLs4vGLsm5/zVjwf9/oRz08Xc85tg1Ksj/9y9ufv4eREloT7YmleSci6uGoi/OYrZqIxt2j2BEREP6LuVHfr9MxUVGNBaBvPGufZJz/2vL/lF/eWG5m5r1r8uAlEoFbd43Ci/wMjdl5Hq+ReD9HB+nVp3ytHbHMGaLWe4P98x9ocEonpsjnSXAp07Eo3HbEGOMXN00pK1S9v8/sF0h2vab9X7zv8ayIvAv40l7T0xmJ69b7zd2Hp3AZozbdHLT2uhQs0msD5n374k3rlXgdgUAsJ38vKJOopTl6KVZwr34RS7tw45cmMnikqJYxcplSKl8/GPq9XdCgtGabKvzKzOFX8jJGKNmLWo8SM7ZQcSSj9mxy7NZsxY1/rHtgm1V0pahqVE9hevrdh6dwE4lRrLQJsHk4qJ57H9TNsAbFQi06+dTkimrj687xSVFsbU7htn8nvv97HTWvkszUiikkdM2GEyk/+hbbJBgZUqlghqGaOlUYiQ7fH4ms9Xexa82nSB03SqUCmrVph7ZavbYyCkdw05en8vKBYr3XHu/XaRQdYXRIwCADaXfyxWiHDVqBQkfq22/jWEn4+eyNq81JFc3p0f/3t3DmYaMb5eA1mRb167eEbp8KrWSTiVGskVrPrf729miNZ+zk/FzWfWagWg4dqTWqOing2OEflv/bsMXLPrSLBaXFMUCgnyIMfbopbL1q/XxIQIkMQuHiOiltvXJ3qeTjpvZlcUmRDIvHzdJxOyYoIfpOAIXVw21fb0hnYyfy6y99+jjpN3NFjY2ru5OFBs/l0V+18fmcdl1dCJr+3rDR886EVy+eFuo+kGCDgDAhvLzi4Qox/pdwyWzbGr2Nx8+mlVXNbgcvduxaVu0JNsa8fkyob8Eu7k704lrEcK16Q27R7C4pCimcVKjEdlBZW0ZSZV3Z/SDWXWNm1WjBjotPkQAtQ4dJ/wMK4WCUVxSFJv77cfC9MEH46axkMZVha/f4iIjjflyJWbRlRb2YAuUuKQoFn1xFpu16EO7tMmur80Stk69fNzoyPmZdr1XZy36kJ1KjBSmvzAUi7UtCRJ0AAA2VJBXjCA8g837R7GhE9rtQyRs69DBi8KWzcfXnQ6fnyF0wvn4ldksMMhHNu1l6sj1QrycVKjoJ8n4LVk3gH2/aSD2npO5TauPNMlIzxW6jBonFcUmRArZVpduHMg692wp/OkRIj9fpYIxospVylJcYhTbd3KK3dvjlcu3hYyTm7szHYybJsz9+vIr9YWJTfe35giTVEWCDgDAhvILkKAD6SksMAhZLncPZ7svqSqpHdETWKvW9YRa1mEtaaliLO1xdsHMRZCuZYsOHBe5fBonFR2/MkfoDm3U1I6+PT96Ueil4rnZhTRz/KYNaPFPx7+MJ51KjGJbfx0tRFscNWA5F/V+Fe1jZsSSj5kurIoQZbl+NVWYuCBBBwBgQ7eTMxAEkJS2jccLOdh0clILcQrxk4hc2oedSoxkjn6AhCizfgwGM25gkO54IUXc8YIUknMPDRnfLkH0JN3RQ1c7ocU/GTd3Z4pLimK2OuSgpH7/VbwZkQoFE/Z+/X7Tl6ySANtRGA0mceoLtzcAgO0EVw9AEEBShDyCXsHo2JXZkp2K9m7HJg7dZqoLcgjNraR7uIFBkgZ9/B3nXMxtrJRKhWSScw8NGd8u4b1OTYUt3907mWj0T9D+3u3QRNitLUQ81OWVNxoJXac/HRzDPDxd7F6Orq+LsXcgEnQAADYkypKrFxuNxqbE8J/mTPqxjYjlCmtaTdJxHTezq0Ovc50wu5sQ1yf6ycMA/+Ts6RvClm301E4VpNovVa8h5snaRUVGmjJiHcZl/0KhYPTcC7XpZPxcNjGiu5DP0AlD1ghXh2XLedH0+e8LP+b4/ex0u5cxMT5NjLaO2x0AwHY8PV2FKEdOVgG92mwiBoPwr37bf36vaGXy9XWnxWv7YwN9KBGdVo9+DiQnMyNPyHK9+qaO2ndrniLVuG7YM4I5OYu5N+Wl88lo+P/Az9+DYhMi2fwV/YR+9h87clWo8iiUCtp9fBKTUj3bk0GQZa5I0AEA2JC3r5swZUlLzaKW9Ubg5RX+UfLNdLEGmwpG+yVyKASIQ6fV8/GDV6OvA0mYOnK9kMtbA4N8aMaC9yXf/x67LOb2CDewJP+xz/w33wsjEU5mLem4WrR7VkpEqOcpApxCjwQdAJQA3odLi4+vez+RypOfV0w6rZ53emUGXl7hL7asPVpetDLVEGRvM5Cen7ecoOa1hqGfA+EdPnhJyHLtiJ7gMIPBJs2qC1cmEfcusydfvwez5qZG9cRLyFNQKhW0/dA4ycXO3rPoLp69afcYIEEHAGBDwya2XyJiua5fTSWdVs87vzoTL7BARET7d5wRar2NUqWgjj2fa4CakQaFQrz3gqIiI+m0et6y/kj0cyAsEQ/meeGlOg4V48Xr+jMmYOqi93uRsu+bFApGb7wbSvtjp0gquSRa3QVIbPbcQ/aeRXfzxn373wN4DAIA2JaXt6uwZbt25Q7ptHr+YkMcIiF358/dFKo81WsEUofuLc6hZqShXsPKwpYtP7eIdFo9D606iPfv9Q36OhCK2WwRqjxOzmr66oe+DjeLqceHLwaLVqabMl/m+nDW3LSvekmuvZ0T6GAXqc6e+/924G633xZhJqtNEnQY+QA85Y2Dm8chVazkL3wZc7ILSKfV85Aqg3jvd/FFV45ysgrEGWyqFLR2xzAsc5GQ5T/qha8vi4VT9KHLpNPqeevQcejnwO46thVvuwlR92x7VkPGt0sQ7cCIggID/Sjg9hK20LxlTcnNmhOVt4+bpMsf2qSaXX9/9sQtfe35+5hBBwBgY/UaVoqVSlk553TuzA3SafW8lW4MXmDBLoLK+yIIYFUZ6bmk0+p5WLXB/MsPl6CvA7u4fz9XqPK4uGocOt7tuzSfKVJ5TEYTnY1LktVxrowxikuKYgtXfYbkXCmR+n69sxZ9YNe2cOVSymJ7/j4SdAAANjZiSscwKQ56szPzHy0L69P5a7zAOrDhn/0gVP02fa4GKkWCqgaXk1yZzSYL/f7rRdJp9fy1ZhPRz4FNFQp2UECrNvUc+1k3qf1IkTaj45woWYA9sGxF46SiU4mRkk/MjRqwQqhnRcXK/gRPLynevkvNkaADALCDOvUqSrbsFgun2Jh40mn1vE3YeLzAOqD4a6lCDeBr169YAbUiPZv3j5L0i9fd1CzSafW8SY2hfEjf79HXgdWJtP+cQsEofF5vh5/V1FywD0BZmQWyaOt+/p50/Moch2hfVy+nCFMWF1cNjZrWSfJxrVK1rN1+O/2+fQ/qQYIOAMAOvtvwBdM4qSR/Hen3cx7NqvugfRReYB1EwvW7wpSlQkU/at+teQpqRZoCAn0kfw1Gg4kO7DlLOq2ev9J0Avo5sIo5k35sI1KCrnrNIFnEfYFgSyuzsx0/QVe/YWXad3KywyR/E+PThCmLfxkvh4hpaLNqJFdI0AEA2ElwtQCHuRaLhdOZU0mk0+r5Cw1G8ZnjN29ADUNpCGtWLRNRkK6dRyc41Ayce3ezH+xVFzyY9+0yH8k6KDXnTt/YK1J51u2Uz8E8Li7ibDtSWFDs0LHu0LU5rfhpkEO1Lc7FeRRUqVrGIWI6JryzbPckRIIOAMBO1vwylGk0Koe7rtycQlq34lAnnVbP278cjhdYeCajpnbCCRES54iHfJjNFjpx/DrptHr+fINRfNaEzTNQ0/As0lKzhSmLSq2UVewb6LTClKUg33ETdDVrB9HYGV1wGIQ120+BAUEoBbMnbWljt/4X4QcAsJ/X3g6hbZtjHPb6EhPSSKfVcxdXDb3dvknmqKkdkWwR3MaVh+uHj9skRFk8vVxQIQ7glyPjWeNqQ7jJZHbI68vLKaS1yw+NCKmiH9EotAp9v+lLvIDCk7ejvEJhyuJfxpPomnxi/82az5lOqxfig6LFwmnslyv51K96OVw/olBgbpC1nfzjw5FIh588KRFmJBbkF+8lIrsEEXcJAIAdTYrozqrXDHT46ywsMNCGVYd9mtcehhl1gjt/+uZZUcoSGOSDCnEQJ65HOHzSinOiuJOJpNPqeb9uC9DXwRMpLjYJU5bGMtz/SaSERuqdLNwQEjF15Hoh+3rOuWT/EeIeTLbf7ipI0AEA2NmG3SOYh6c8ZgoVFRpJp9XzlvVG4uVVUAnXxTnBtVqNQFSIA2ko0DIya4s5eo10Wj0f2g+nv0LJWAQ5IIIxRpPn9pDdLFAPgWZs52QV4IaQiKuXbyMIDuhemv22HECCDgBAAL+fnc7UMtrzJT+viHRaPW8dOg4vr4K5dD5ZmLI44hIfOVv2o56VKespq2vev/sshVYdxKcIOssCxGGxiNFEHHFv3JKoUEGcHTg4obuQioT4uwiCA8rOtt+WA0jQAQAIIuZaBFOq5NUtZ6Tnkk6r528+NxmjUUGYBZnFAY5pT8xk5u3jJqtrtlg4bVl3lBpXH4J+Dh5r4tC1XJSlXa5uTrKsg9XbhwrzQchoxHNYMmMmB91bVe7u38ux228jQQcAIJCuvZ8PVijkN2nodkoG6bR63qHNdLzAAji4X+OmMTd3+SUBTEYz6bR63qwW9uKEv0q348vg//KRWQJdRKIka+G/GQ1I0EHpQoIOQNSH8x//gLwMHd8uoV3nZiTHJB0RUcL1uxQWPBhNH8jP3wNBcGCHz89kLq4aWV57cdGDvTh7vjMXfR0QEVFeXpEwZQmqgMPW7c1oRNJHKkRZmg6lb/Pq6Cb2+F0k6AAABDN2RhcWmxDJNE7y3AfGbLaQTqvnbz0/BaMeGXNzd0YQHFz0xVmsXIC3bK//wtmbFFYNHySAyFBsFKIcCgWjr5f3k+3en6J8HLVgqwnJwGxHx9WhR4sYu/RDCD0AgJiOX5nD5JykSLmVjtl0MoYZdPKw69hEVqNmkGyv32x68EGiF2bTyVpeXrEQ5WAKnMsjRL+ABB2AbCFBBwAgsMPnZ7BygfKdYfJwNt2n3Rfi5VVmNDI61Vju1u8ezl58ua6sY3D+7E16sdFo9HMyZTSahCiHUiHvV0OFINePZZMAMu6HEAIA+C8MH1TtatfRiSy0STAxGVfE8eir9HrzSRixyohao0IQZCTq+09YXFIUU8s4MZuTVUAhVQahn5MhbDQvyIuxUpAlrhbMoAOQbT+EEAAAiO+7DV+wU4mRsjz58KHUO5nUtOZQvLzKhMZJjSDIUMy1CFZJW0a21885J51Wz0f2X46+TkZMJkESdDL/IKtUKoTpB7asia6POwNAfpCgAwCQkMPnZ7JqNQJlO5vOUGzCDBOZkOsJn0D008Ex7K12YaRSyXc23e5f4uj9dlHo62TCLMiMKYXMl7iKst+/QqEgYiwDdwaA/CBBBwAgMRv3jGCnEiOZl4+bTAfQnHRV9HhxlUE9g3xNiezJTlyPYLXqlJftrJ6zcUnU/c05uBFkQKUUIxkt99NDRbl+zjm179Y8BXcGgPwgQQcAIFEH46axdzo0IWcXGS4F5EQ6LZJ0jqwwvxhBAFq7YxiLS4xiZcp6yvL6L11Ipo5tZ6CvA7ABUWYyMmz+DCBbSNABAEjYpIju7Oil2axFy5qkcZLfpvo6rZ7PHL95A1qC4zEUmxAEeGRPzGQWlxTFvGU4czj+Wiq922oaknQOTIVTq+HPL+gKvKIDyPb+RwgAAKRvwarP2PErc9iLL9clZxd57d21bsWhTmgBjqewyIAgwN/8GjeNxSXJb0bdzaR71OuduUjSOShRTi+WewOzWMSIgFKJGXQAcoUEHQCAA4n6/hN29NIs9uqbOnJ1k8+Jr6FVcXCEoynIR4IO/tnDGXUBQT4kl9Vg58/epCGfLEVf54DUajFmwMt9DzouTIIOr+hSgdXIUNpw9wMAOKAZC95nRy7MZO92bEoeXi4Ov8m6xcKpee1heHF1IPfSshEE+E87oyewU4lRrGJlf1IoHP9N6cDec6h0B+SkESNBZzZbaNSA5XiW2pmzsxpBkAjsFwilDQk6AAAHNnFON/b7memsW+/nZ3r7uDn0QKKo0EhtG4/Hi4WDSL+fiyBAiW37bSyLTYhkVauVc/jZJzggx/FonMXZQzYpIQ0VYmcWhEAysF8glHqbQggAABzf8EkdRv4aN42dSoxk1WsGklrjmAdK3L+XQ8M+/QEvrwAytXnfKHYyfi5r3rImeXi6OOx1ttKNQT/nQNzdxWmr99Lk+XHk0+4LhbmnNCocGiIVag3qCkoXEnQAADKzYfcIFnN1DnvljUbk5e3qcLPq9u0+g0p+BliuAY5g4arP2O9np7O4pChWSVvG4WbVZWfmU/9e3yBJ5yA8vcRJ0BUWFcuyDi5fTBboQYx7Qio0TliODKVLhRAAAMjTzIUfPBoCdntjNk9MSKPiIqP0L4wTtQ4dx/fHTsEQ96kGmyph2sGMcZtOjpzSMQy1As/ip4NjGBHRlx8u4Wfikignp1CYzeCfxdHDl1G5DsLX32OjQqHoZLHYf3FjoUwP6MnNKRKmLM4uGtwUElGjZhCdOHZNmPK4ezhTUJAvmc1mVM5TY+Rf1pPikuzz60jQAQAArd0xjBERjR+8mh89dIWyMvPJZJLuwz0jPZcmD1/Lx8/qhiTdEwptHEzRh8R48Y+/mhqKGoHS8tUPfR/1Bx3bzuC3bt4nQ7FJstfDOVGbsHF830l8jJC6EZM7dA4LHszFaFfynJgpQnL0ocAgH9wUEhFcvVzsiWPXhBmr6Ee+07RDjxYxqBnpwhJXAAB4ZPLcHmzvicnsxPUI1vqVBuTn50Eqie6FsmPbKVToU6hSrVxbUcpy+VIKKgSsYtPekez4lTksLimKVa5alpwkukwJh6k4DqVKnNey9i+HyypLN6jPd8Jcr1qt/MsKBxDbCMFm+Z88eu04akXakKADAIDHmrPkI7Yvdgo7cT2CvfJGI/Lz9yCFQjpjRodYrmsHQye02ydKWfJyClEhYHVbD4xmx67MZnFJUSy4egCp1dL6KPHW81OwF50DcHYWZ1nj7duZsop9zFFxlig6OWNPM3h6NxLvIQgShwQdwP/AJyuAv5u58AO27+QUNnJShwbVawRKZlZd65CxeHGVuFkTt/RFFMBWNu0dyWKuRbDnW9UhVzcnSZQ55VY6Ks4BiHRQhNw+cBXki3MwhqurE24GeGo3b9xHECQOCToAACixTr1antuwZwQ7cT2CNQzRkkYj9lamGRl5qDSJO3/6xmJEAWxt3rK+7MiFmeytdmHk6e0qfHn7dpmPjxESFxjkK1ab6iqPNjVqwAqhrtPH1w03g8RonMQZC+fnFaFCJA4JOgAAeCrLtujZ8atzWKMQrVB75/yvnu/MxYvrE1IqxanPS+eTUSFgN1Mie7LfToezrr2f3yjyjLozp5NQWRK3ZF1/xpg46zjiYhNlEfe9u04LVR53DxfcDBJTp15FocrzxfuLMe6VMCToAADgmfywRc9GT+lYwdfPQ8jyXTh7E5X0hOo3qixMWUwmM83GMlewsxGTO3Q+cmEmaxRahURKojwk5dNo4U8vZgLt82oymh0+3lvWRpc3myxClSmwvC9uBImpVbfCRpHKc/kiDtiS9HMAIQAAgGfVvluLlP2xU1jb1xsKPZsOSia4eoBQ5Tl2+AqWuYIQftj8JTuVGMm8BFz2OmrAcsyakDiVYAeUvKQb49Bt6vuF+4Waoq3WqKi+rlIF3AnSMmJyh84ilef+vRyaM+nHNqgZabLNWxSGCwAAsjBr0Yfs5PW5TCqbq8Pj1Wko1gtCYnwabV4d3QQ1A6I4eDqcVa8ZSKLdJyBtHoItb8zKzKdNq444bN8r2gErbm5O1Ln385j+BM9s57ZTexEFacI0BwAAKHVHLsxknl7izDD5uNM8fCp6Au27NRfqBYFzTr/8eOI4agZEsmH3CKYLqypMeW7euCer+DviDJGatYOEK9O8Wdsdsu9tHTpOuHFBhYp+6FglSi3YoWkZ6bk0fcxGjH0lCAk6AACwit/OhDMvHzFOIzstk82uS1PlKmWFKs/p2CTMogPhfL9pIHvuhdpClKWwwCCr2JuM5g2Odk3zV3wq3BaHuTmFNHn4Ood70c9IzxWqPIwxahCi7YdeVZravNpAuDLt3H4KFSNBSNABAIDVHIybxtQC7KljseAj4pNq8ULNmSKVh3NO2zYexyw6EM78Ff1Yecx8sbk7tzN9HPG63NydhSvTts0xjvV8qzNcuEGBi6uGhk1svwR3tjSFf91buNODcrMLadygVRgASwwSdAAAYFWhTaohCBI0fFKHkaKV6dyZG6gYENL2Q+OEeDmbPGKdbF7GEq6nOuR1VQkuJ1yZzGYLdXltlkO0rQ87fMVFnG0aEOiNjlTiRDzh+9e951AxEoMEHQAAWNWi1Z8JtR8dPMloU6zicC7mvkEARETPPV/L7mUwGcyyiXfqnSyHvK4VWwcxEct19fJtmjh0jeT7XxG3vGCMqE79iuhEJU4XVkW4MuXnFdMnXeZj3CQhSNABAIDV1W9YCUGQoBYtawlXpoz0XPqsxyIMNkE481d+avfEitEonwSdyYGvVbQN5x/6aVMMbVl7tLxU4xpSZZCQzw61WkVTInsyAkl77d3QpiKW6+Tx66gcCUGCDgAArK5MgBeCIEELBEg4PM6xI1ckHdcP2kchwQhWYTKZZXW9n/VY6JD3UoUKvsKWbfr4TclSjOnLIWM552I2F/+ynui8HECnns8Ju1ljSBU937DicHk510//Xt/wFxqMEv6ZgQQdAABY3YRZ3fBlGEp5sDlIki/m7VtP52dOJaECwSqYzHra2Jh4h7yuLQdGC1uTJqNZyEMW/s3rzSfxzIw8cZ9njaui83IQNWoFCVkuzokipm5NlmOdjB64godUGcSjD12m3JxC6vKq2PtpIkEHAAAA/6hpixqCDjY5hQUPltRLYljwYJ4YfxeNyoEplfYdWqvVKlnF22g00+yJW/o64rU5OauFLVthgYGa1hwqif73reen8NQ7mcKWz9XNCctbHUjn3i0biFo2g8FEOq1eNjP4p4/dmBEWPJjv3HaK/jx79tq1O0KXGwk6AACwusnD12FJn0R9s+ZzYV8czGYLNak+RPi29X67KK7T6rnZbEGDcnD2rmNR9y6zpj07Ti92xOtq/WoDoctnKDYJn6Rr/3I4T7mVLnQcmzSrjo7TgXTo3uJcGcGXLMshSde05lC+YdURn8c9k7mF0/DPfhA2BkjQAQAIqG+X+XzWhM0zHOV6sEGttFWtVk7YshmNZgqpMohvXh3dRMTyNa42hJ+NS0Ijeoxhn/7AP+22AMn7UuTu4dxWbtd8Py3HIT8CTfuqF7P3jMz/Yig2CbvdQMt6I3liQprQ8dNoVBS5tA9mzzmYPTGTha9TnVbP338v0uH6zRZ1RnCdVs8NxaZ//e8OHbwk7DUgQQfwv/CYBDsb0ncpP3FrthjiAAAgAElEQVT8Oq1dfmiETqvnrzSZIPkH6K0b9+17WzPc2M9i875RQgeQc05Tx2w4PmnYWmHulXYvTeM6rZ7LbdP+J7F/9xk6fvQa6bR63qTGUD7s0x8k3de1rDfS7uUfOqHdPpskFpzEmqm3bXOMQ94jL75cV/gycs5Jp9Xznm9HCHP/hlQdxPPzioSPXQOdFg8CR32dlMCw8+zpG9S42hDJv2PoP/qWhwUP5jqtnhcWFJfozxQVGoS9HiToAAAEc/h/vurcS8smnVbPdVo9b/fSNL5l7VHJnMK0eXV0ExG+rqvVSjSsZ+RfRvxT5rZuPE4d28ywa3v74v3FXKfV86TEe2g0/6LXO3P/cqCi0WCifbvOkE6r5y3qjOAzxm06KaXreavlFEkkBEqLaMvyzGYLdWw7w+Fmg0R8+zFTKKTxgenCuVvUvLZ9D4/o9sZsrtPqObeI3xRUKiV9u34Avh46qDffDZNEOU0mM+m0ev72C1Ml1X9uXhNd/43nJnOdVs9/O3DhqbaXsPd48Z8gQQcAIJCZ4zdvMBj+eVp2UuI9mjJqfXKT6kP4p90XCv8wnTpmw/G/vIXbiYenCxrXM2rzesONUihn/PVU0mn1fGi/723a8D7rvpDrtHp++LdLaCwlcP7szX/8/xUWFNP6lYdDdVo9f++lcOH7uZdDxvKU5HRZ1d/Xy/sJl1iIv5ZKH3Wc53BJutDGwZIpa1GhgXRaPW8dOo5vWn3EZtsOjBm4kocFD+aXL6ZIJlZVgsviQeDApkRJ6+CP5Jv3SafV87daThG6D50+dmNGs1rD+NTRG87eScl4pr8rIf4ubVp1RLjtUZCgAwAQyN4dpzuV5L8zGs10PPrqH7NNhvMRny8T6oH69gtTuUib0NapVxGN6xmNmNyhs5u7k2TKu3/3WQqtOpiPGrDcau1w0+ojTR5+wT0WfRWNpISeZCnrjcS0RzOIe74dwTesOCzMDOJBH3/HQ6oM4pkZeUKUx7+sp+zbVtzJBOrnYPsaLlk/QDKz6B7KSM+laWM2Hn+z5WRu7b4kpMogvmNbLEnpEB6lUkGde7VsiqeBY2vWoobkypySnE46rZ6HVh3EP+nytRB9aa935vLG1YdwnVbPN6w64lNcZCyVv5dzTjFHrh4XrQ5UuHUAAMSRfj/3if9MYYGB9uw4TTqtnjPGqE69CrTq5yF2Gc1/0D6KnzmVRMk37wsV13nL+mIZSSl44aW6tPPnU5Ipr8VioV3b40in1fMyZb1oT8ykUmkH77w4ld+6cZ+mjdmIRvEUftt//qn+3IVzt+jCuVvJOq2efHzd6cCpqXa5r+dM+rHN+pWH9x58yuuwFj8/dzQuIoo5eo26vjaLr9s13GH6fV1YVYqNiZdcuW8nZzw6MbJ23QrUoUeLBh26tzj3rH/va80m8rupWbRv1xlJ1mfN2kHUsedzMbhbHduiNZ8zqZ6YarFwOnk8/tH96+vnTs2eq0nT5vWyar+6eU10/Z83xZy9cO4WmYwP9vD9txn3z+r3AxeFiz0SdAAAgmj/cvgznzjGOacL5249eqCWKedFzVvWpEkR3a32QJ02egPfvT2OcnMK6cypJFSkAwv/ujdrHTqOZ6TnSq7sD/dyJHoweyGogi+FNa1G42d1/dd7Y/AnS/m50zcoPT2XHu5rZO9DT6TOaHz2gzMyM/Ie1aeTs5pCQqvSwtWfWfXFoUPr6Twh/i6t/uE3IeNatXog0U7b/Z6fvyel388RMhZXLt+mkCqDeLf3n+83bGL7JaXxd47Tr+IH9p6jgvxiUquVFHMtwmYJwO82fMGa1RzGi4uNkr3vL11IpqmjN5zVafWkUCrIx8eNXmhdl8bP/Pc+eNinP/ATx69Tdmb+o393NzVLsnFwdtHQ6u1D8dFQLmP7Ls1oy/pjkr+OjPQ82rEt9tFzlykYaTQqKlPWi2rUCqKIJR+xzWui6/9bAn7DikPlO/d+PmXMlyv5nZQMup2cSfkFxVRcZCSzyUwWC6epozfY9LpE7FNt0jlEzFh1cs+Oo6EWC8ddCsKrG5xPA3pYyN3VvuXIKzDT2h3OdCjWmey9hVetOlr6eslwDCaszBZf2ZxdNFS9ZiCt2Dromeqzf89F/MzpGySFTdGZgtGphMhSb7/vvRTObySm2f364pKimCO2VXDMttOy/kien2vdfkOpVFC5QG8KbRJMDUOrNO3Qo8VTzVQZ/cUKfvb0DUq5lY76fIxRA5bzXdvjhI+LWqOiF1+uS7O/+fCJ4/PnpNz/atWmHkV+18emMUffK22MMTqVGGmX8XRYtcHcbLLvMuDadSvQml/kl5x8o8Ukfud2Jm4AQQVXC6BN+0YK0y5tMoNuyMieYZPHfsvPnb5O2dm5xPFoAQD4i55vR/AL525Z/XeKCg107vSNvw3yFQpGarWKVGolaTQqcnJSk8lkpsJCAxkMJjKbLGSx/P/ALvrwFcnEtlmLGnQqAW2sNNVtUIkuWHHJATguayfniB6c6Hk7OYNuJ2fQz1tOHNdp9Y9ejlUqBak1D/o6Zyc1McaosMhAxUVGMhnNZLFYHo1TpbSc29vHjSjJtr85ff77kli+9ecTghlj5OXtSkHlfahy1bIUPq83mzV+84b4a6mdkhLvUU52ARmKjfRwUsH2rf98mHD0ocs2v5YatYLo6uXb6EgkqkpwWTqViDjIzY7oCQzJdXHFX08Vqjw2OyRi/NRPWJcebSvUa1iNXFyc0BIAAP7k4vlku/6+xcKpuNhI+XlFlJmRR6l3Mun+vRzKzysio8H0l+Sc1LR+o2EDtLDStWrbYKZxwi4Z8GRebTrBri8onHMyGs1UkF9MOVkFlHY3m+6mZlFOVsGDJTZmi2Q/IleuUsYuv+vn7yGpOHHOKSszny6eT6ad206RTqvna1cc6hRz9BqlpWZRUaGBSrrix1Bssnn51+8azhRKnPEnRU5Oatq8bxRWo8jUa2+HIAgC03/0rTBPf5v28B27tUmZO38w27Y3klWuEkgqFQb3AAADP1jCOaYWW01pbEgNf/fqmzoEAZ5I2t1sBMFKatS2z+G2utAq8n6+tJ5u84d3bPxcJHkk6K32YQiCjE3/ujfz8cVBPqISaWWQ3T7BfLdyHGv7epNYP39vYgzPGQCQr6MSWi4qNXXqVUQQrGTy3B6sbIA3AgEl0uW1WfgKYSUurk40elonuwymZy/+SNaD+IT4u7Rx5eH6tv7dKlXLouFLSECgD42d3gUvvDL3qf61CoiCmIwGkzBlsesc6cEjeoat2xrOmrWoR27uLoQ8HQDITfiYjdxkMiMQVrJ6+xA8Wayo35evVFCplQgE/Cfsm2U9DRpWtuvvlwuUd6L+8IGLZ239m1sOjGZOTmo0fglwcdHQzqMTMBYB6ty7ZcqrbzZCIATV/uVwIT4kCrGJweSZn7HuvV5rWr1mZVJrsOwVAORj/66zCIKVVK8ZiCBYezDTrUVK114tgxEJ+Df6j7/F7DkrcXZW0zdrP7fry/+uoxNlnXw4esQ+s+CPXZnNmAJ5H5GpNSqKvjQLlQSPzFjwAWvesiYCIaDEhDQhyiHMLqOde7SNWfDdCLbjwDwWEOhHSmyACgAykJGeiyBYSdcPXsBSAhsYMr5dQqvW9RAI+EfRv19GEKykeq0gIcpRvqKfbOvAaLDfLPhTCZHYKUhQSqWCYq7OQe3A3yxc9RmrVac8AiGgz3susvsHRSGzYCs3TmGt2oSRO5a9AoADe/uFqZhVYiWVq5Sl9t2apyASthG5tA+r37ASAgF/Ez5mIzcasYzfGjROKlqxdZAQI+Xth8bJesT+bqtpdnuen0qMwtuSYBhj1LV3y7aIBPyTtTuGsaAKvgiEYE4cv273Mgg7TW3kuA/Yj7siWANdddJosMcCADie5Jv3EQQr2frraLyw2NiKnwYz/zKeCAT8xfYfTyAIVlK9hljL+Ctpy8i2Lm4m3bPr77/2Fk7VFkmL52vR0Ant9yES8G9+OTweJ7sKxiTAB0Xh15HOmTeI9f7ozaYVK5XDslcAcBjd3piN2XNW8nLb+giCnew9MZm5ujkhEPBIYYEBQbAC/zKetOpnsQ7B+engGFl/GBnQ+xu7Pdenz3+f1W9UGTeGAGrWLk/zV/TDR0IokQOnpjIXVw0CIRB7zogmkkCCjoioS89XYr5fM4Ht+m0+8/R0I2y2AABStnlNdP3Ll7D60hoqVvaniG8/xkPCjvSj3mmKwSYQEbUOGYsPEVag1qho74nJQvZzL75cV7b1cjz6ml1/f8XWQaxOvYq4QeyoXsNKtG7nMIxB4IlEX5zF3D2cEQhB2HtGtOSmpG3eMZu1eL4BqVRKtB4AkKS9P58+S3htLXUaJxVt+20sBsZ21qnnczHRF2cxL29XBEPmMjLyEAQraPNqA2HLFvX9J6xcgLcs68Vksv/SqNXbh7DX3wnBTWJjTMHopbb1aeVPgzEGgady6NwMVqVqWQRCEIM+/s5ub2qSXDM6Mbwf23nwa1atRkXMpgMAyTlx/BqCYAXHr+C0NJEcPB3OypTzQiBkCofgWEf1moEU/nVvofu6XccmMpVaiXZvJ+HzerO4pCimUOCRaAsqlZJOJUSyuZi9D89oy4HRrPlzNREIO2OMSKmyX5pM0pu6Lfp+FNtzaAHz8fXEaa8AIAnjB63mFgveW0vb629jxoCI9hyfxIKrBSAQMoRDcEpfQJAPbdg9QhIj3nadmqLd21lsQiTD/t3WpXFS0chJHZoiElBaFq7+jHXo1hyTkOxEqVLQi63r0ZzFH9mtAhyi196wbQZ74+3nNjo5qdGYAUBoV7D3XKl7p0MT4WeUyNmmfSNZnfrYF0lOpo/ZiK8Qpax8RT/aGT1BMv3c6PDOrHlLec4E+bT7QmHa/8n4uczD0wU3kBW4uTvR8StzWIceLWIQDShNY6d3YacSI5mLKw7dsiVfP3c6eX0ui/yuj12ftQ7zWUU/vEfn7fu/YiGNa5ECSToAEFTj5tXburnjgVsaGCPq0rNl5qSI7uj0Bbf65yHs+VZ1CEuu5GHUtE4sIMgHgSgllauUpe2Hxknu5lm46jMW0riq7OrrZMx1ocrz+9nprGpwOUxiKK2XZwWjmrWD6PD5mQgoWFX0xZmsWnWsQrCFGrWCaH/sVCHuaYeb9zxj7hds96EFrLI2AA8iABDO0Ant9h0+P5M1aFSZsPTk6SmVCjqVGMVGTu3oi2hIw7xlfVlsQiTz9fNAMGRgZ/QE1r5LM8KJvs+mboNKtPXX0ZId0C7dOJA1DNHKqs7MJotwZdq8fxQ7lRjJnJzVuKmegZu7M8UmRLJ1O4fjJRNsYuPekSwuKYp5eGEmrDW4uGqofZdmtH6XOPe0w74dfrdqPNtzaAHz8HRDog4AhLN86yB2Mn4uK1MWm+g/zcP0ZPxcdOwStT92CmvSvDpm08nAuJldWfTFWayBrjKC8YSUKgU1bVGDVm2T/qmQy7boWb0GlWRVf2+2nCzkMu9jl2ezZi1qkAIfCJ+ISqWkxk2r0eHzM/DgArv4/cx09nyrOqRSKRGMUqBQMKpeM5CiL85i42Z2Feq+dvjeecuO2axV61A0ZgAQ0p6YSaxV63qEr9oleGApFRTSuCpFX5yFAbLELV7bH7PpZGT5j4NYXFIU8/ZxQzBKoEw5Lzp5fS77Zs3nDtPXrdw2mIU1rSabOrydnCFs2Rat+ZzFxs9lfv6euNlKwNPLlU5cj2BL1g/A2APsat6yvuzE9QhWq055fOR8WowoqLwvxSZEMlEPXZLF55PREz9iOw9+zerUrYrZdAAgnMilfdixy7NZ0xY1yM3dGQF5jIAgHxo5sX2DpRsHohN3IPtjp7CwptXwEU0mfo2bxt7r1JTKlsPM4cdxcXWit9s3pj3HJzlkP/ft+gHs3Y5NZXO/9+0yX+jDUvadnMze6dCENBoVbr7HcHZW06tv6ui3M+EYd4BQ1u4YxmITIhmepU/G08uVuvRsGfvLkfFC39Oy7HB6dhzL0+5mEuc4ZAz+rm5wPg3oYSF3V/uWI6/ATGt3ONOhWGeyd1OtVUdLXy/Bfhu2MmnYWn7kt8uUfj+XLBaLrGPh7KKh1q/Up6lf9RKu/b33Uji/kZhm93LEJUU5xL35frsofvlCMhkMJodtz4wxqlEzkDgnunrltuzbTpfXZvHEhDQyOnCdl4RCwahGrSBau2OYbJ6zLzQcxXOzCx27XpUKipXIdgxDPlnKjx+9RgX5RSTn1yPGGLl7OFOz52rQrEUfOtT9GFZtMLf3/oi161agNb8MxftEKev6x7PUIPNn6T9xc3emsKbBFLX0E0m0PVl+Mlm1aSqbN3ddm/27ju8tLDQgUQcAQpkwu9ujB8i7rabx28kZZDKZZRUDpUpB9RpUomVb9OzoJbQJOVj+o54REX3caR6/cPYWFRcbHeqlz9fXnfbFTmGnEh/8O51WL/vBx8NNmT/pMp+fP3uTigoN8koGKBj5+XnQ3hOTWWyCvOr+9zPTWbc3ZvMrl2477DjcYpbOB7aIbz9mRERTR67nvx+4SPfv5cjq/YgpGHl7u9HLr9SnsTO6sN/P4pkM0rHuj2fpgN7f8PNnb1J2VoHsY6JUKsi/rCe1bFWbxk7vwg6fl07ZZTuneeDgrvuIiI0ZtoDHxlwii8VCyNMBgGh+OjiGbVkTXf/ArrNnr19NpYz0XDIaHTdZ5+3rTrVqBdGiNZ+zk9dR/3L0cBlz/56L+OnTSVSQVyzdAaJKQQGBPrT90DhGiajbf/LtH3s7jRm4kl+9lEIpKRlUWOC4yTpnFzVV1paldTuHMUqQb70/nDHYOnQsz0jPc7jr8/F1J0qSVpnHzujy6ANhhzbT+Y3Ee2Q2O+5MfqVSQQFBf/TRRHTgFPpjkK75Kz59dP92bDOd37xx36HfGR5HrVZShYp+tOXAaEbxRLuOSu8aZL/pwLTZ/R98ve01hd9ISiVOnAiJOgAQSPvuLc7RH1sSbFkTXT/6t8tnL19IoXtp2Q4xnd3VzYmqBpejldsGM0oi+lUiA2SjEUsJrGnBqs8YEdGEIWv4ubgkunM7k4qKpDGrTq1WUpXgcg9miCHRXPIx2bz/X8o+bfQGfuHMTbp54z7l5xU5xEtD2QBvCmlclSbP7YGZwX+yP3YqGzVgOT908CLlSzgh/+e61oVWpcXr+kt6Kd/mfaPYj2uPlt+/80yyI30gVGtU5OXlSjVrl6f5K/oxipfHfcYt9n/BVamx36ytbNo3ihERDf5kKb+RkEZ372Y7xLP0n/pcb193qlW7PM1b1pfFXJP29WAN+P/o/M4InpWZh2WvMoY96P4Oe9CJa9SA5fzKpdt0/14OFRYayCSRwbOzi5oqVPCjRmFVacz0zpJsW306f80z0/NIY8cTeBWMaPV2+eznMnHoWn7x7E1KTk4XcoaVm7sz1awdRCU5zESEJa5S2b9w1sQtfc+fvrE45VY65ecXU7FEErVKlYL8/DyoTv2KFPldHzxDS6Bvl/n83NkbVFQovSXuarWStFXK0oY9Ixy2rkd8vownXL9Ld25nSma/OsYYOTmrKTDQmypXKUuRS+V5L7YJG8fL2OtQAc7JbLaQqKdmysmn3RbylOR0Sk/PlfRMdVc3JypXzouq1Qykpi1rNO3Q47kYR6kj3CSPET7xe370yDkyFBvIYkGiTm6QoPs7JOikY9inP/C7qVl0/14uZWXmCfHwdXJWk7u7M/n4upG3jxsFVfCjSRHd0Z7gmcyasGXG+dM3RtxNzaK8vCIqyLf9zBtnFzX5+nlQxUr+9M2az5+oTSNB93S2rD1a/mxsYnLKrQxKv59L6em5lCPAfjtqtZJcXJ3Iy9uVfHzdyL+MJ0Us+Rj93FOaOHQNP3k8nu7eySSTSewllu6eLlSrdhB9u/4LWdX39LEbM65cTPG5nZxBRUVGKiwwCLFfrlqjIpVKSe7uzhRY3puq1QyicX9augsAf9zDYzbya1duU+qdbCooKCZDsVHYpJ2rmxN5eLhQUAUfqlO/YtuhE9rvc9R6QWf1LwYPmMuvXLxBRqMJM+pkBAm6v0OCTroiJm+teiMhLT47u4DycgopJ6eQiouNlJtjndPzPL1cyc3dibx93Mjb240qactkjpza0Rc1AbYwqM93PDMjj3JzCikrI58KCopLdVmsi6uGPDxcqHwFXwquEfhMsz+RoCtdIz5fxu/fy6H8vGLKyS6g/IJiys0utMr4zc3dmVxcNI+ScWXKelH4173xjLSS3u9G8sSEu5SXK8byLKVSQR6eLlSxsj+t2DoI9f4nY75cydNSs6kgv5iysvIpL7eQCgqsM7tfrVGRWq0kNzdn8vN3J09PV/Lxc6cZC95HnQA8hY2rjjRJun630d3bWYszMvIoP6+IcnMKqaCg2GYHT7i5O5Ob24OPXd7ebuRXxoOmz5fXPY0OrAT69JzCb6fcI5PJjESdDCBB93dI0DmmqSPX8/R7uZSTU0Amk5nMJgtZLJzMJjNZLJyY4kGVKxUKYgpGSpWCFApGSqWS1GolqdUqcnVzImcXNbm6OiERB8LZsvZo+SsXUs6l38vxKSwwkNFgIqPJTGazhSxmC5kt/MH/NFse7M/DiJyc1KRSP2jjzs4acnHVkKeXK42f1bVU+0Ak6Kxvw4rD5W8l3XNKS82Oz87Mp8IiA3ELPRrPmYxmIsaIsQfL4JTKB32dSqUgxhip1ao/2oGaXN2dyclZjZk4dta/1zc8+VY63b+XY9NZs2qNivzLeFK16gE0b1lftIEnNHHoGp6f92B5+sN+2Gg0EXF6tK/dw1NvOX+wPJyIiLGH+5axR+MOjZOKPD1daEpUT9QDgA3Nnrilb/r93MWGIhMZDSYyGE1kNJrJbDb/8f7w4B62WCxkMlqIKR7czwrGHu0/qHj0PqEgtUpJao2KNBoVeXi50OS5PXBPExJ0JTY/cn3V6ENn4zMzcoSYvg3WgwTd3yFBBwBQupCgA3h2n3ZfyDPScyk3p4gKC0tvlscfH56oTFkvqhJcVnYzOAAAwD5UCEHJDBjUJYGI2ITRi/n5M9cpP7+IzEjUgRUxpiCVSkUKhcKhj7gHAAAAeBqP2/sxfMxGnno7k/LzishkMpPF/GCDesaITCYLmYxmUigYEWPEOSelUvHHLI4HyyUDK/jS6GmdkJADAACbQ4LuCU0K78eIiPSfR/DE+BQqKjSQxYLkCZQ+F1dXqtegOt3OsdCNpFQqLsKhJQAAAAD/Bsk1AACQKiTonlLUwiGMiOiT3lN56u37VFxsxP50ULo3p1JJrds2obd7v8iIiD7qPomn3c0kgwFtDQAAAAAAAMCRKBCCZ/PtirHspTZhseUCfEmtRr4TShGjv+wS+f2aCazliw3Jv6w3qdDWAAAkK3zMRnxlAQAAAIC/QIKuFAwe2TNs5cYpLKRxLfLx9SSlSomggFWMHP8hW7N5Gmuoq07e3u6kVOIWBgCQmru3sxAEAAAAAPgLvN2XoqmzPmcbts1gtWpXJncP1wcb0AJYwYy5X7BO3ds0qF6zErm5uRBjaGsAAFKRmZErRDk2rDxcH7UBAAAAIAask7OCqEVDGRFR3/en8Tsp97A/HVhF5+6vnKM/FsH26TWFp95Ox/50AAASkJiQJkQ5GCMX1AYAAACAGDCDzoqWLB/DnnuhEQUE+pEKy17hST1Bnu27leNY85b1qWyAL9oaAIDANq48XD8vt0iIsiiVyhTUCAAAAIAYMIPOykaO/4AREY0eOp/HX0umrKw8spgtCAyUujGTPmZERCMGzeMJ11MoJzufLBa0NQAAkVy5kHJWlLK079YcCToAAAAAQWAGnY2EzxnA2nV8qUHtOlrsGQZWNTNyINv480xWs3YlcnF1RlsDABDI0UNXEAQAAAAA+Bsk6Gyoa69Xz0UtGsq27o5gVYKDSKNREXInYC3zFg9nrV9p3K9ylUBSq9HWAADsbePKw/Vvp2QIURZ8vAEAAAAQCxJ0drJ42YP96coF+BHDaa9gJV8O7bbk2xVjWfOW9alMWV+8kAEA2FHMkWvCLG9tqNOiQgAAAAAEggSdHY2e+BFbuXEKC2tSm7y83ZE8AasZN+UTtnrzVKYLq0kenq5oawAAdnBgjzD5OarToGI/1AgAAACAOJCgE0D4nAFs0/ZZrE69KuTkpEZAwGpmRg5kW3bMYTVrVyaNBm0NAMBWOrSZzi0WLkx5hk1svwS1AgAAACAOJOgEErVoKHv1jeZtqwQHkVKJqgHr+XrJcNb29aYzK2kDSKFAWwMAsLaE63cRBAAAAAD4R3gzF8wXQ7ruW7J8LHvx5RAqF+CLgIDV6Id1H7l01XjWslUj8i/jjYAAAFhJaPBgLlJ5sM0BAAAAgHiQoBPUqAkfsVWbprKmzeuRh6cbTuAEqxk3uQ9b+2M4C21Sm9zdXdHWAABK0XsvhXOL2SJUmUKbVEXFAAAAAAhGhRCIberszxkRkf6zCH7tyk0yGIwICljFjLlfMCKiLz6Zya9fSyGTyYSgAMATa1xtCDeZzKRUKahdp2Y0Znpn2ab933p+Cr+RmCZcub5d/wU+xQAAAAAIBjPoJCJq0RD2y4GvmLZqEPYMA6v6+tsR7PW3mverWLkcKRR4hwOAkhv9xQpuMpmJiMhsstCmtdGk0+p5/17fcLnF4tWmE3jKrXQ0CgAAAAAoEWR6JObbFWPZS23CsGeYLNgvOTZwaLcl36+ewF54KYR8/DxRFQBQIvt2n33sv48+dJl0Wj3v8VaELBJ1rXRjeNrdbCHLVq16ABoqAAAAADIAUJrGDFvAL55PpPy8AuIc8SgtdYPzaUAPC7m72rccCpUHuWu7kmvAC7hPAUASdFp9iZ5Gzi4aOnpplkP2bSFVB3FuEfehHJcUhWcKAAAAgICwB52ETZvdnxERDew3m1+7epNMRjOCAgAAdtE6ZCzPyMgr0X9bVGggnVbPFb7hlyIAAAvGSURBVApGL7auR3O//VjySaOObWfw+GupJHJyzt3DBQ0VAAAAQFBY4uoA5i0exnb++jWrWKkcMRzBCQAAdlDS5NyfWSycft17jnRaPW9cfQgf8slSyc0Hnzh0Lddp9Tz+WqrwZa3XoCIaKgAAAICgkKBzIN+vmcBatQ4lbx8PBAMAAGymX9cFz5xYMxnNdEBCyboZ4zadbFJjKP9p03HJ1NOi1Z/jKx4AAACAoDBQc1AjBs3jl84nUmFhMYLxhLAHHQDAkwmpMohzK22GqlYr6bkXalPk0j5C9IW934vk507fkFwdla/gR9sPj8PzBAAAAEBQGKg5uE8/DOdJCbfJbLYgGCXUoJaaBvQwk4s6h4jsN4EDCToAkIJJw9byrRttN4tMrVZSjVpB1Khx1eCh49sl2OI3h336A//twAUyGkySrSccDgEAAAAgNgzWZGBexLo2Mccu7E1LzSCO417/ky6kMg3VNyWN8RIVZ8QRNxeRPRJ1SNABgBQ0qzWMFxcZ7VoGZxcN1W9QiZasH1Aq/eVHHefxi+dvkb2vq7TUrluB1vwyFM8SAAAAAIFhsCYjk8Ys4WdOXaXc3AIE41+ENK5NMyO/YMaCFIUx56q56N4xMmRfJiLbzkJEgg4ApECn1Uviy49SqSBnFw1pNCoyGk1UVGQks8ni8B+u1GolxVyLwHMEAAAAQHA4JEJGJkzry7bsnMPqNQgmjZMaAfkHD99i1K7lLa4BLzF3becO7pU7ksqlPCGnDQDw/957KVwy2S2z2UL5eUWUmZFHeblFZDKaZTGr/PmX6qChAgAAAEiACiGQn8iFQxgR0UfdJ/HkW2lY9vofNB7BW4iIFWdd5MXpsVR0/xhZjDkIDADI3o3ENARBYB6eLhSx5GN8WQIAAACQAMygk7Hv10xgr73VPNbP34sYhu//ycm7DnOr8EZtj+APycm/KTEFZiECgHz17/UNvu4I7q12YTMRBQAAAABpwAw6mRs8omcYEdHooQv4hbPxVFBQhKD8C6WT32UiYsaCFIXBq565OO13MuReJ3ue9goAYA/HjlxBEARWv1FlGj6pw0hEAgAAAEAaMIMOiIgofE5/9tOeuax6jYqkUiNv+1/UruUtboGtmHvVniHuldqT0rkMYX86AJCLGeM2nbRY8GFCVH7+HrRi6yA8lAAAAAAkBJkY+IuF349iREQ9Oozh99KysD/df9B4VI2jP/anK7p3jIruHyduLq1TcjlhZh4AiOjnLSdCEQUxubo50b6TU5CcAwAAAJAYzKCDx1q9eRp78eUQcvdwxf50JeDkXYe5VXynsme1PuTk24iYArlvAHBMW9ZGly/IL0YgBKTWqOjIhZl4agMAAABIELII8I/GTHpw8tugzyP41cs3yWAwyuTKn27WmsrZ/yY93J8u65K56O5BMubfJMyCAwBHsnHlkWREQTwKBaOYq3OQnAMAAACQ6ngOIYD/ErlwCOv1wRsVypcvQ0olmsx/UbuWt7gFtWEe1T4KcavwFik0voT96QDAUVy+mIIgCOjdjk0RBAAAAAAJQ7YFSqRr71dTlq2fxN5457l+Hp5uxLDu9T9pPKrGeWg7M68an5Czf3NiCicEBQAkbXCfpZgSLBjGGL35XhiNn9UVD2YAAAAACUOCDp7IwCHdlmzZMZuFNa1NTk5qBKQEnLzrMXdt50DPan1I7VmLGMNtBwDSdOjgBQRBICq1krr2fn7m1KieSM4BAAAASH1shxDA0wifM4AREfXpNYUn37xLZrMFQfm3G83ZL5WImLHgjqI4Pc5cePdXMhfdJexPBwBSYjKhrxeFu4czHTo3g52YFIFgAAAAADgAJOjgmXy3chwjIur41nCek51PnCPh9G/UroEWImKG3ARd4d3Dp4rvHyOLKY+QqAMAKdA4qchQbEIg7CwwyId2RE/ArDkAAAAAB4K1dlAqNm2fxVq1DiW1Ro396UrykutRNc6rWm/mWaMfaXwaEWNYLgwA4hs6rl3T4OoBCIQdNdRpkZwDAAAAcECYQQelZvTEjxgR0YBPZvJrV26RxYKlUP/F2bchIyIqSP2NF97ZR8b8G4TZdAAgqk49n4uhP46lfrXZRJ6WmoWg2Ii7hzO9+V5Y7MgpHcMQDQAAAADHgxl0UOrmfzuC7f59PvP188RsuhJyDXiRedXqH+Ja4R1SaHz/eP9F7ABAXLuPTWRvt29MXt6uCIY1B2oKBTUM0dKhczMYknMAAAAAjgsZALC6N14ayE0ms2T2pwttXItmRA60271hyI1vn397z2ZTzjVyq/guuQa8iPsUAIQ2fcxGfuS3y5SSnI5glCI/fw/ad3IKngEAAAAAMoBBH9jEyEFf81MnLxMRJ9HzdPZO0D1UnHWRK1RuSrV7ZawVBgDJ6PFWBI+/nkrFRUYE4ym5uTtR42bVKfK7PhinAQAAAMgEBn5gUx/1mMyTb94VejadKAk6AAApG/jBEn7+7E3KzMhDMErI28eNQpsE05zFH+EZBAAAACAzGACCXXR8axjPzSkgi0W8RB0SdAAApatf1wX8ypXblJ2Zj2A8hq+fOzVvWYumftUTzx4AAAAAmcJAEOxmzvSVGb/tj/UxGIxCJeqQoAMAsJ4PO3zF46+nUm52oazj4OSspvLlfalxi+o4mRUAAAAAkKAD+xs6MJJfvpBERqNJiEQdEnQAALbRv9c3PCkxjW4nZ8jiejVOKgoI8qG69StR+LxeeM4AAAAAwCMYHIIw+vSczO/cSSejwWTXPeqQoAMAsL3Jw9fx+GuplHwznTLScx3mujROKipb1otq1a1ATZ+v0bRjj+diUNsAAAAA8L+QhADhdHtvNM/OziOj0WSX30eCDgDA/sYPXs3TUrPp7p1Mun8/l/JyiyRRbjd3J/L2dqeAIG+qUMmP6ukqIykHAAAAAP8JSQgQ0rSJS/mpE5epIL+ITCazTX8bCToAADEN/+wHnpWRT/fv51JWZr4QJ8T6+XtQuQAvKhfoQ3O//RjPDgAAAAB4KhhIgtCGDIjkCdeTqaCgmCwWi01+M7RJbZox9wvcGwAAEhA+ZiPPysij3JxCyskppKzMfCooMFBWKSXvvH3cyPX/2rt316jSMA7A73cmk8nMxMREELwVEreRqKDrtRFF7XWXVVhtBBELQVSCsXCzq0Ql2Kh4KVTQhfWCyBY2q9vvar23TrcQC3FAQU10JhYR/Ac0zpk8T3Xq3zmn+Z33e0+1FD091ZjWVYlypT0q1VJM76luPPjD5vvuAAAAn4ISgqZ34+ffVvx+7+GfT588izdvxj77fjoFHUDr+Gng+vjrV6NRr49Ho9GIev3jx54sy6JQyCIrpCgWCxPXWRYd5eLJgR+/OSQ9AAAmixKC3Dhz6vqGB3/8da/2/EWMjr79bG/EsuUKOgAAAGDyZCIgL/Ye2Hb/2q2jacXq/uid0RVtbQWhAAAAALmnoCN3jhzblW78eiIt7J8fXd3VyDKPMQAAAJBfmg1y69TZ/en23ZE0v292VCodAgEAAABySUFH7l24cjit3bDs1py5M6O9VBQIAAAAkCttIqAV7B/4/ruIiKHDF8f/++dx1Govo/6uLhgAAACg6Zmgo6UMDe9Ov9wZTosW933YT+dnrAAAAEBzU9DRkkZO70u3746kvq/mRblcEggAAADQtBR0tLRzlw6lteuX1ubMmxnFdie6AQAAgOajsaDlHRjc0RsxsZ/u378fRa32Mhr1hmAAAACApmCCjiljaHh32vztupWLlyyIzs5ypGQ/HQAAAPDlmaBjStm6fdODiEgREXt2Hh///9HTGBt7KxgAAADgizFBx5R1/vJgWrfx69qs2TOi0FaIiA/NHQAAAMAkUtAxpR0c3NF79ebRtGpNf3R3dzr2CgAAAEw6BR3ExH66LVvXz+1fsiBKHe0CAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACazXsJHfyzmmMu9QAAAABJRU5ErkJggg==
+    mediatype: image/png
+  install:
+    spec:
+      deployments: null
+    strategy: ""
+  installModes:
+  - supported: false
+    type: OwnNamespace
+  - supported: false
+    type: SingleNamespace
+  - supported: false
+    type: MultiNamespace
+  - supported: true
+    type: AllNamespaces
+  keywords:
+  - security
+  links:
+  - name: Sigstore Helm Operator
+    url: https://github.com/sabre1041/sigstore-helm-operator
+  maintainers:
+  - email: ablock@redhat.com
+    name: Andrew Block
+  maturity: alpha
+  provider:
+    name: The Sigstore Authors
+    url: https://sigstore.dev
+  version: 0.0.0
diff --git a/config/manifests/kustomization.yaml b/config/manifests/kustomization.yaml
new file mode 100644
index 0000000..e054c2f
--- /dev/null
+++ b/config/manifests/kustomization.yaml
@@ -0,0 +1,7 @@
+# These resources constitute the fully configured set of manifests
+# used to generate the 'manifests/' directory in a bundle.
+resources:
+- bases/sigstore-helm-operator.clusterserviceversion.yaml
+- ../default
+- ../samples
+- ../scorecard
diff --git a/config/prometheus/kustomization.yaml b/config/prometheus/kustomization.yaml
new file mode 100644
index 0000000..ed13716
--- /dev/null
+++ b/config/prometheus/kustomization.yaml
@@ -0,0 +1,2 @@
+resources:
+- monitor.yaml
diff --git a/config/prometheus/monitor.yaml b/config/prometheus/monitor.yaml
new file mode 100644
index 0000000..d19136a
--- /dev/null
+++ b/config/prometheus/monitor.yaml
@@ -0,0 +1,20 @@
+
+# Prometheus Monitor Service (Metrics)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: controller-manager-metrics-monitor
+  namespace: system
+spec:
+  endpoints:
+    - path: /metrics
+      port: https
+      scheme: https
+      bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+      tlsConfig:
+        insecureSkipVerify: true
+  selector:
+    matchLabels:
+      control-plane: controller-manager
diff --git a/config/rbac/auth_proxy_client_clusterrole.yaml b/config/rbac/auth_proxy_client_clusterrole.yaml
new file mode 100644
index 0000000..51a75db
--- /dev/null
+++ b/config/rbac/auth_proxy_client_clusterrole.yaml
@@ -0,0 +1,9 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: metrics-reader
+rules:
+- nonResourceURLs:
+  - "/metrics"
+  verbs:
+  - get
diff --git a/config/rbac/auth_proxy_role.yaml b/config/rbac/auth_proxy_role.yaml
new file mode 100644
index 0000000..80e1857
--- /dev/null
+++ b/config/rbac/auth_proxy_role.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: proxy-role
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
diff --git a/config/rbac/auth_proxy_role_binding.yaml b/config/rbac/auth_proxy_role_binding.yaml
new file mode 100644
index 0000000..ec7acc0
--- /dev/null
+++ b/config/rbac/auth_proxy_role_binding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: proxy-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: proxy-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system
diff --git a/config/rbac/auth_proxy_service.yaml b/config/rbac/auth_proxy_service.yaml
new file mode 100644
index 0000000..6cf656b
--- /dev/null
+++ b/config/rbac/auth_proxy_service.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: controller-manager-metrics-service
+  namespace: system
+spec:
+  ports:
+  - name: https
+    port: 8443
+    targetPort: https
+  selector:
+    control-plane: controller-manager
diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml
new file mode 100644
index 0000000..731832a
--- /dev/null
+++ b/config/rbac/kustomization.yaml
@@ -0,0 +1,18 @@
+resources:
+# All RBAC will be applied under this service account in
+# the deployment namespace. You may comment out this resource
+# if your manager will use a service account that exists at
+# runtime. Be sure to update RoleBinding and ClusterRoleBinding
+# subjects if changing service account names.
+- service_account.yaml
+- role.yaml
+- role_binding.yaml
+- leader_election_role.yaml
+- leader_election_role_binding.yaml
+# Comment the following 4 lines if you want to disable
+# the auth proxy (https://github.com/brancz/kube-rbac-proxy)
+# which protects your /metrics endpoint.
+- auth_proxy_service.yaml
+- auth_proxy_role.yaml
+- auth_proxy_role_binding.yaml
+- auth_proxy_client_clusterrole.yaml
diff --git a/config/rbac/leader_election_role.yaml b/config/rbac/leader_election_role.yaml
new file mode 100644
index 0000000..4190ec8
--- /dev/null
+++ b/config/rbac/leader_election_role.yaml
@@ -0,0 +1,37 @@
+# permissions to do leader election.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: leader-election-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
diff --git a/config/rbac/leader_election_role_binding.yaml b/config/rbac/leader_election_role_binding.yaml
new file mode 100644
index 0000000..1d1321e
--- /dev/null
+++ b/config/rbac/leader_election_role_binding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: leader-election-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: leader-election-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system
diff --git a/config/rbac/rekor_editor_role.yaml b/config/rbac/rekor_editor_role.yaml
new file mode 100644
index 0000000..f34ca6b
--- /dev/null
+++ b/config/rbac/rekor_editor_role.yaml
@@ -0,0 +1,24 @@
+# permissions for end users to edit rekors.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rekor-editor-role
+rules:
+- apiGroups:
+  - helm.sigstore.dev
+  resources:
+  - rekors
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - helm.sigstore.dev
+  resources:
+  - rekors/status
+  verbs:
+  - get
diff --git a/config/rbac/rekor_viewer_role.yaml b/config/rbac/rekor_viewer_role.yaml
new file mode 100644
index 0000000..449d93c
--- /dev/null
+++ b/config/rbac/rekor_viewer_role.yaml
@@ -0,0 +1,20 @@
+# permissions for end users to view rekors.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rekor-viewer-role
+rules:
+- apiGroups:
+  - helm.sigstore.dev
+  resources:
+  - rekors
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - helm.sigstore.dev
+  resources:
+  - rekors/status
+  verbs:
+  - get
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
new file mode 100644
index 0000000..23c89e0
--- /dev/null
+++ b/config/rbac/role.yaml
@@ -0,0 +1,98 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: manager-role
+rules:
+  ##
+  ## Base operator rules
+  ##
+  # We need to get namespaces so the operator can read namespaces to ensure they exist
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+  # We need to manage Helm release secrets
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - "*"
+  # We need to create events on CRs about things happening during reconciliation
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+
+  ##
+  ## Rules for helm.sigstore.dev/v1alpha1, Kind: Rekor
+  ##
+  - apiGroups:
+      - helm.sigstore.dev
+    resources:
+      - rekors
+      - rekors/status
+      - rekors/finalizers
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - serviceaccounts
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+#+kubebuilder:scaffold:rules
diff --git a/config/rbac/role_binding.yaml b/config/rbac/role_binding.yaml
new file mode 100644
index 0000000..2070ede
--- /dev/null
+++ b/config/rbac/role_binding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: manager-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system
diff --git a/config/rbac/service_account.yaml b/config/rbac/service_account.yaml
new file mode 100644
index 0000000..7cd6025
--- /dev/null
+++ b/config/rbac/service_account.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: controller-manager
+  namespace: system
diff --git a/config/samples/helm_v1alpha1_rekor.yaml b/config/samples/helm_v1alpha1_rekor.yaml
new file mode 100644
index 0000000..43f6229
--- /dev/null
+++ b/config/samples/helm_v1alpha1_rekor.yaml
@@ -0,0 +1,8 @@
+apiVersion: helm.sigstore.dev/v1alpha1
+kind: Rekor
+metadata:
+  name: rekor
+spec:
+  server:
+    ingress:
+      hostname: rekor.example.com
diff --git a/config/samples/kustomization.yaml b/config/samples/kustomization.yaml
new file mode 100644
index 0000000..4004e6e
--- /dev/null
+++ b/config/samples/kustomization.yaml
@@ -0,0 +1,4 @@
+## Append samples you want in your CSV to this file as resources ##
+resources:
+- helm_v1alpha1_rekor.yaml
+#+kubebuilder:scaffold:manifestskustomizesamples
diff --git a/config/scorecard/bases/config.yaml b/config/scorecard/bases/config.yaml
new file mode 100644
index 0000000..c770478
--- /dev/null
+++ b/config/scorecard/bases/config.yaml
@@ -0,0 +1,7 @@
+apiVersion: scorecard.operatorframework.io/v1alpha3
+kind: Configuration
+metadata:
+  name: config
+stages:
+- parallel: true
+  tests: []
diff --git a/config/scorecard/kustomization.yaml b/config/scorecard/kustomization.yaml
new file mode 100644
index 0000000..50cd2d0
--- /dev/null
+++ b/config/scorecard/kustomization.yaml
@@ -0,0 +1,16 @@
+resources:
+- bases/config.yaml
+patchesJson6902:
+- path: patches/basic.config.yaml
+  target:
+    group: scorecard.operatorframework.io
+    version: v1alpha3
+    kind: Configuration
+    name: config
+- path: patches/olm.config.yaml
+  target:
+    group: scorecard.operatorframework.io
+    version: v1alpha3
+    kind: Configuration
+    name: config
+#+kubebuilder:scaffold:patchesJson6902
diff --git a/config/scorecard/patches/basic.config.yaml b/config/scorecard/patches/basic.config.yaml
new file mode 100644
index 0000000..a32ceaa
--- /dev/null
+++ b/config/scorecard/patches/basic.config.yaml
@@ -0,0 +1,10 @@
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - basic-check-spec
+    image: quay.io/operator-framework/scorecard-test:v1.9.0
+    labels:
+      suite: basic
+      test: basic-check-spec-test
diff --git a/config/scorecard/patches/olm.config.yaml b/config/scorecard/patches/olm.config.yaml
new file mode 100644
index 0000000..92e3e41
--- /dev/null
+++ b/config/scorecard/patches/olm.config.yaml
@@ -0,0 +1,50 @@
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - olm-bundle-validation
+    image: quay.io/operator-framework/scorecard-test:v1.9.0
+    labels:
+      suite: olm
+      test: olm-bundle-validation-test
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - olm-crds-have-validation
+    image: quay.io/operator-framework/scorecard-test:v1.9.0
+    labels:
+      suite: olm
+      test: olm-crds-have-validation-test
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - olm-crds-have-resources
+    image: quay.io/operator-framework/scorecard-test:v1.9.0
+    labels:
+      suite: olm
+      test: olm-crds-have-resources-test
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - olm-spec-descriptors
+    image: quay.io/operator-framework/scorecard-test:v1.9.0
+    labels:
+      suite: olm
+      test: olm-spec-descriptors-test
+- op: add
+  path: /stages/0/tests/-
+  value:
+    entrypoint:
+    - scorecard-test
+    - olm-status-descriptors
+    image: quay.io/operator-framework/scorecard-test:v1.9.0
+    labels:
+      suite: olm
+      test: olm-status-descriptors-test
diff --git a/helm-charts/rekor/.helmignore b/helm-charts/rekor/.helmignore
new file mode 100644
index 0000000..0e8a0eb
--- /dev/null
+++ b/helm-charts/rekor/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/helm-charts/rekor/Chart.yaml b/helm-charts/rekor/Chart.yaml
new file mode 100644
index 0000000..da0169d
--- /dev/null
+++ b/helm-charts/rekor/Chart.yaml
@@ -0,0 +1,14 @@
+apiVersion: v2
+appVersion: 0.3.0
+description: Rekor is an API based server for validation and a transparency log for
+  storage
+home: https://sigstore.dev/
+keywords:
+- security
+maintainers:
+- name: The Sigstore Authors
+name: rekor
+sources:
+- https://github.com/sigstore/rekor
+type: application
+version: 0.2.1
diff --git a/helm-charts/rekor/README.md b/helm-charts/rekor/README.md
new file mode 100644
index 0000000..7a98148
--- /dev/null
+++ b/helm-charts/rekor/README.md
@@ -0,0 +1,255 @@
+# rekor
+
+[Rekor](https://github.com/sigstore/rekor) provides a restful API based server for validation and a transparency log for storage.
+
+The following components are included by default:
+
+* [MySQL](https://www.mysql.com)
+* [Redis](https://redis.io)
+* [Trillian Log Server](https://github.com/google/trillian)
+* [Trillian Log Signer](https://github.com/google/trillian)
+
+## Quick Installation
+
+```shell
+$ helm install [RELEASE_NAME] .
+```
+
+This command deploys the default configuration for the rekor chart. The [Parameters] section describes the various ways in which the chart can be configured.
+
+## Uninstallation
+
+```shell
+$ helm uninstall [RELEASE_NAME]
+```
+
+The previous command removes the previously installed chart.
+
+## Parameters
+
+The following table lists the configurable parameters of the Rekor chart and their default values.
+
+| Parameter                 | Description                                     | Default                                                 |
+|---------------------------|-------------------------------------------------|---------------------------------------------------------|
+| `imagePullSecrets`    | Registry secret names as an array                    | `[]`                                                   |
+| `forceNamespace` | Explicitly specify the namespace to deploy the chart | `nil` |
+
+### MySQL
+
+| Parameter                 | Description                                     | Default                                                 |
+|---------------------------|-------------------------------------------------|---------------------------------------------------------|
+| `mysql.enabled`    | Deploy the MySQL component                    | `true`                                                   |
+| `mysql.replicaCount` | Number of replicas to deploy | `1` |
+| `mysql.hostname` | Hostname of the MySQL instance | `""` |
+| `mysql.port` | Hostname of the MySQL instance | `3306` |
+| `mysql.args` | Default container args  | `['--ignore-db-dir=lost+found']` |
+| `mysql.name` | Name of the MySQL component | `mysql` |
+| `mysql.image.repository` | Repository of the MySQL image | `gcr.io/trillian-opensource-ci/db_server` |
+| `mysql.image.pullPolicy` | MySQL image pull policy | `IfNotPresent` |
+| `mysql.image.version` | MySQL tag or image ID | `5e12fb368c8fd19e10aeb5a5cf785107f8069c08` |
+| `mysql.resources` | MySQL compute resources | `{}` |
+| `mysql.livenessProbe` | MySQL liveness probe configuration | Check `values.yaml` file |
+| `redis.readinessProbe` | MySQL readiness probe configuration | Check `values.yaml` file |
+| `mysql.service.type` | Kubernetes Service type | `ClusterIP` |
+| `mysql.service.ports` | Kubernetes Service type | Check `values.yaml` file |
+| `mysql.serviceAccount.create` | Create a dedicated Service Account for MySQL | `true` |
+| `mysql.serviceAccount.name` | Name of the dedicated Service Account for MySQL | `""` |
+| `mysql.serviceAccount.annotations` | Annotations to apply on the dedicated Service Account for Redis | `{}` |
+| `mysql.secret.annotations` | Annotations to apply on the secret containing MySQL credentials | `{}` |
+| `mysql.auth.existingSecret` | Name of the existing secret containing MySQL credentials | `""` |
+| `mysql.auth.username` | MySQL username | `mysql` |
+| `mysql.auth.password` | MySQL password | `""` (Autogenerated when empty) |
+| `mysql.auth.rootPassword` | MySQL root password | `""` (Autogenerated when empty) |
+| `mysql.persistence.enabled` | Enable persistent storage | `true` |
+| `mysql.persistence.annotations` | Annotations to apply on the _PersistentVolumeClaim_ | `{}` |
+| `mysql.persistence.storageClassName` | Name of the Storage Class | `nil` |
+| `mysql.persistence.size` | Storage size to request | `5Gi` |
+| `mysql.persistence.mountPath` | Location in container to mount storage | `/var/lib/mysql` |
+| `mysql.persistence.subPath` | Mount subpath | `""` |
+| `mysql.persistence.existingClaim` | Name of the exist_PersistentVolumeClaim_ing  to use for storage | `""` |
+| `mysql.persistence.accessModes` | Access modes to request for the _PersistentVolumeClaim_ | `["ReadWriteOnce"]` |
+| `mysql.deploymentAnnotations` | Annotations to apply on the Deployment | `{}` |
+| `mysql.schedulerName` | Scheduler name to use | `nil` |
+| `mysql.strategy` | Update Strategy | `nil` |
+| `mysql.podAnnotations` | Annotations to apply on the MySQL Pod | `nil` |
+| `mysql.podLabels` | Labels to apply on the MySQL Pod | `nil` |
+| `mysql.extraInitContainers` | Extra `initContainers` to inject into the Deployment | `nil` |
+| `mysql.priorityClassName` | Name of the Priority Class | `nil` |
+| `mysql.nodeSelector` | Node Selector | `nil` |
+| `mysql.dnsConfig` | DNS Configuration for the pod | `nil` |
+| `mysql.securityContext` | Pod security context | `nil` |
+| `mysql.tolerations` | Tolerations applied to the pod | `nil` |
+| `mysql.affinity` | Pod affinity | `nil` |
+
+### Redis
+
+| Parameter                 | Description                                     | Default                                                 |
+|---------------------------|-------------------------------------------------|---------------------------------------------------------|
+| `redis.enabled`    | Deploy the Redis component                    | `true`                                                   |
+| `redis.replicaCount` | Number of replicas to deploy | `1` |
+| `redis.hostname` | Hostname of the Redis instance | `""` |
+| `redis.port` | Hostname of the Redis instance | `6379` |
+| `redis.args` | Default container args  | `['--bind', '0.0.0.0', '--appendonly', '"yes"']` |
+| `redis.name` | Name of the Redis component | `redis` |
+| `redis.image.repository` | Repository of the Redis image | `redis` |
+| `redis.image.pullPolicy` | Redis image pull policy | `IfNotPresent` |
+| `redis.image.version` | Redis tag or image ID | `5.0.10` |
+| `redis.resources` | Redis compute resources | `{}` |
+| `redis.livenessProbe` | Redis liveness probe configuration | Check `values.yaml` file |
+| `redis.readinessProbe` | Redis readiness probe configuration | Check `values.yaml` file |
+| `redis.service.type` | Kubernetes Service type | `ClusterIP` |
+| `redis.service.ports` | Kubernetes Service type | Check `values.yaml` file |
+| `redis.serviceAccount.create` | Create a dedicated Service Account for Redis | `true` |
+| `redis.serviceAccount.name` | Name of the dedicated Service Account for Redis | `""` |
+| `redis.serviceAccount.annotations` | Annotations to apply on the dedicated Service Account for Redis | `{}` |
+| `redis.deploymentAnnotations` | Annotations to apply on the Deployment | `{}` |
+| `redis.schedulerName` | Scheduler name to use | `nil` |
+| `redis.strategy` | Update Strategy | `nil` |
+| `redis.podAnnotations` | Annotations to apply on the Redis Pod | `nil` |
+| `redis.podLabels` | Labels to apply on the Redis Pod | `nil` |
+| `redis.extraInitContainers` | Extra `initContainers` to inject into the Deployment | `nil` |
+| `redis.priorityClassName` | Name of the Priority Class | `nil` |
+| `redis.nodeSelector` | Node Selector | `nil` |
+| `redis.dnsConfig` | DNS Configuration for the pod | `nil` |
+| `redis.securityContext` | Pod security context | `nil` |
+| `redis.tolerations` | Tolerations applied to the pod | `nil` |
+| `redis.affinity` | Pod affinity | `nil` |
+
+
+### Server
+
+| Parameter                 | Description                                     | Default                                                 |
+|---------------------------|-------------------------------------------------|---------------------------------------------------------|
+| `server.enabled`    | Deploy the Server component                    | `true`                                                   |
+| `server.replicaCount` | Number of replicas to deploy | `1` |
+| `server.hostname` | Hostname of the Server instance | `""` |
+| `server.port` | Hostname of the Server instance | `3000` |
+| `server.args` | Default container args  | `['--bind', '0.0.0.0', '--appendonly', '"yes"']` |
+| `server.name` | Name of the Server component | `server` |
+| `server.image.repository` | Repository of the Server image | `quay.io/ablock/rekor-server` |
+| `server.image.pullPolicy` | Server image pull policy | `IfNotPresent` |
+| `server.image.version` | Server tag or image ID | `latest` |
+| `server.logging.production` | Enable production logging | `false` |
+| `server.ingress.enabled` | Create an Ingress resource | `true` |
+| `server.ingress.hostname` | Ingress hostname | `nil` (Required when Ingress is enabled) |
+| `server.ingress.annotations` | Annotations applied to the Ingress resource | `true` |
+| `server.ingress.path` | Ingress path | `/` |
+| `server.ingress.pathtype` | Ingress PathType | `nil` |
+| `server.ingress.tls` | Ingress TLS configuration | `{}` |
+| `server.ingress.tls.secretName` | Name of the secret containing the ingress certificate | `{}` |
+| `server.resources` | Server compute resources | `{}` |
+| `server.livenessProbe` | Server liveness probe configuration | Check `values.yaml` file |
+| `server.readinessProbe` | Server readiness probe configuration | Check `values.yaml` file |
+| `server.service.type` | Kubernetes Service type | `ClusterIP` |
+| `server.service.ports` | Kubernetes Service type | Check `values.yaml` file |
+| `server.serviceAccount.create` | Create a dedicated Service Account for Server | `true` |
+| `server.serviceAccount.name` | Name of the dedicated Service Account for Server | `""` |
+| `server.serviceAccount.annotations` | Annotations to apply on the dedicated Service Account for Server | `{}` |
+| `server.deploymentAnnotations` | Annotations to apply on the Deployment | `{}` |
+| `server.schedulerName` | Scheduler name to use | `nil` |
+| `server.strategy` | Update Strategy | `nil` |
+| `server.podAnnotations` | Annotations to apply on the Server Pod | `nil` |
+| `server.podLabels` | Labels to apply on the Server Pod | `nil` |
+| `server.extraInitContainers` | Extra `initContainers` to inject into the Deployment | `nil` |
+| `server.priorityClassName` | Name of the Priority Class | `nil` |
+| `server.nodeSelector` | Node Selector | `nil` |
+| `server.dnsConfig` | DNS Configuration for the pod | `nil` |
+| `server.securityContext` | Pod security context | `nil` |
+| `server.tolerations` | Tolerations applied to the pod | `nil` |
+| `server.affinity` | Pod affinity | `nil` |
+| `server.attestation_storage.enabled` | Enable attestation storage | `false` |
+| `server.attestation_storage.bucket` | Attestation storage bucket | `file:///var/run/attestations` |
+| `server.attestation_storage.persistence.enabled` | Enable persistent storage for file based attestation | `true` |
+| `server.attestation_storage.persistence.annotations` | Annotations to apply on the _PersistentVolumeClaim_ | `{}` |
+| `server.attestation_storage.persistence.storageClassName` | Name of the Storage Class | `nil` |
+| `server.attestation_storage.persistence.size` | Storage size to request | `5Gi` |
+| `server.attestation_storage.persistence.existingClaim` | Name of the exist_PersistentVolumeClaim_ing  to use for storage | `""` |
+| `server.attestation_storage.persistence.accessModes` | Access modes to request for the _PersistentVolumeClaim_ | `["ReadWriteOnce"]` |
+
+
+### Trillian Log Server
+
+| Parameter                 | Description                                     | Default                                                 |
+|---------------------------|-------------------------------------------------|---------------------------------------------------------|
+| `trillianLogServer.enabled`    | Deploy the Trillian Log Server component                    | `true`                                                   |
+| `trillianLogServer.replicaCount` | Number of replicas to deploy | `1` |
+| `trillianLogServer.extraArgs` | Extra container args  | `{}` |
+| `trillianLogServer.name` | Name of the Trillian Log Server component | `trillian-log-server` |
+| `trillianLogServer.port` | Hostname of the Server instance | `8091` |
+| `trillianLogServer.image.repository` | Repository of the Trillian Log Server image | `gcr.io/trillian-opensource-ci/log_server` |
+| `trillianLogServer.image.pullPolicy` | Trillian Log Server image pull policy | `IfNotPresent` |
+| `trillianLogServer.image.version` | Trillian Log Server tag or image ID | `5e12fb368c8fd19e10aeb5a5cf785107f8069c08` |
+| `trillianLogServer.resources` | Trillian Log Server compute resources | `{}` |
+| `trillianLogServer.livenessProbe` | Trillian Log Server liveness probe configuration | Check `values.yaml` file |
+| `trillianLogServer.readinessProbe` | Trillian Log Server readiness probe configuration | Check `values.yaml` file |
+| `trillianLogServer.service.type` | Kubernetes Service type | `ClusterIP` |
+| `trillianLogServer.service.ports` | Kubernetes Service type | Check `values.yaml` file |
+| `trillianLogServer.serviceAccount.create` | Create a dedicated Service Account for Redis | `true` |
+| `trillianLogServer.serviceAccount.name` | Name of the dedicated Service Account for Redis | `""` |
+| `trillianLogServer.serviceAccount.annotations` | Annotations to apply on the dedicated Service Account for the Trillian Log Server | `{}` |
+| `trillianLogServer.deploymentAnnotations` | Annotations to apply on the Deployment | `{}` |
+| `trillianLogServer.schedulerName` | Scheduler name to use | `nil` |
+| `trillianLogServer.strategy` | Update Strategy | `nil` |
+| `trillianLogServer.podAnnotations` | Annotations to apply on the Trillian Log Server Pod | `nil` |
+| `trillianLogServer.podLabels` | Labels to apply on the Trillian Log Server Pod | `nil` |
+| `trillianLogServer.extraInitContainers` | Extra `initContainers` to inject into the Deployment | `nil` |
+| `trillianLogServer.priorityClassName` | Name of the Priority Class | `nil` |
+| `trillianLogServer.nodeSelector` | Node Selector | `nil` |
+| `trillianLogServer.dnsConfig` | DNS Configuration for the pod | `nil` |
+| `trillianLogServer.securityContext` | Pod security context | `nil` |
+| `trillianLogServer.tolerations` | Tolerations applied to the pod | `nil` |
+| `trillianLogServer.affinity` | Pod affinity | `nil` |
+
+### Trillian Log Signer
+
+| Parameter                 | Description                                     | Default                                                 |
+|---------------------------|-------------------------------------------------|---------------------------------------------------------|
+| `trillianLogSigner.enabled`    | Deploy the Trillian Log Signer component                    | `true`                                                   |
+| `trillianLogSigner.replicaCount` | Number of replicas to deploy | `1` |
+| `trillianLogSigner.extraArgs` | Extra container args  | `{}` |
+| `trillianLogSigner.name` | Name of the Trillian Log Signer component | `trillian-log-signer` |
+| `trillianLogSigner.image.repository` | Repository of the Trillian Log Signer image | `gcr.io/trillian-opensource-ci/log_signer` |
+| `trillianLogSigner.image.pullPolicy` | Trillian Log Signer image pull policy | `IfNotPresent` |
+| `trillianLogSigner.image.version` | Trillian Log Signer tag or image ID | `5e12fb368c8fd19e10aeb5a5cf785107f8069c08` |
+| `trillianLogSigner.resources` | Trillian Log Signer compute resources | `{}` |
+| `trillianLogSigner.livenessProbe` | Trillian Log Signer liveness probe configuration | Check `values.yaml` file |
+| `trillianLogSigner.readinessProbe` | Trillian Log Signer readiness probe configuration | Check `values.yaml` file |
+| `trillianLogSigner.service.type` | Kubernetes Service type | `ClusterIP` |
+| `trillianLogSigner.service.ports` | Kubernetes Service type | Check `values.yaml` file |
+| `trillianLogSigner.serviceAccount.create` | Create a dedicated Service Account for Redis | `true` |
+| `trillianLogSigner.serviceAccount.name` | Name of the dedicated Service Account for Redis | `""` |
+| `trillianLogSigner.serviceAccount.annotations` | Annotations to apply on the dedicated Service Account for the Trillian Log Signer | `{}` |
+| `trillianLogSigner.deploymentAnnotations` | Annotations to apply on the Deployment | `{}` |
+| `trillianLogSigner.schedulerName` | Scheduler name to use | `nil` |
+| `trillianLogSigner.strategy` | Update Strategy | `nil` |
+| `trillianLogSigner.podAnnotations` | Annotations to apply on the Trillian Log Signer Pod | `nil` |
+| `trillianLogSigner.podLabels` | Labels to apply on the Trillian Log Signer Pod | `nil` |
+| `trillianLogSigner.extraInitContainers` | Extra `initContainers` to inject into the Deployment | `nil` |
+| `trillianLogSigner.priorityClassName` | Name of the Priority Class | `nil` |
+| `trillianLogSigner.nodeSelector` | Node Selector | `nil` |
+| `trillianLogSigner.dnsConfig` | DNS Configuration for the pod | `nil` |
+| `trillianLogSigner.securityContext` | Pod security context | `nil` |
+| `trillianLogSigner.tolerations` | Tolerations applied to the pod | `nil` |
+| `trillianLogSigner.affinity` | Pod affinity | `nil` |
+
+## MySQL Credentials
+
+Credentials for running (when deployed) and connecting to MySQL are stored in a secret resource. The _passsword_ and _root password_ are automatically generated when not provided.
+
+_Note:_ If you plan to perform an upgrade of the chart, be sure to specify these values explicitly. 
+
+An existing secret containing credentials for MySQL can be provided by passing the `mysql.auth.existingSecret` parameter. This secret must have the following keys:
+
+* `mysql-password` - Password for connecting to MySQL
+* `mysql-root-password` - Root Password (required when deploying MySQL)
+
+
+## Integration with External Components
+
+By Default, the chart deploys all required services. However, configurations can be applied to offload certain services, such as Redis and MySQL externally.
+
+To disable the deployment of Redis or MySQL, pass the `redis.enabled=false` and/or `mysql.enabled=false`. Provide the hostname and port of the external resource using the `<redis|mysql>.hostname` and `<redis|mysql>.port` parameters.
+
+## Ingress
+
+To enabled access from external resources, an Ingress resource is created. The configuration necessary for each Ingress resource is primarily dependent on the specific Ingress Controller being used. In most cases, implementation specific configuration is specified as annotations on the Ingress resources. These can be applied using the `server.ingress.annotations` parameter. 
diff --git a/helm-charts/rekor/ci/ci-values.yaml b/helm-charts/rekor/ci/ci-values.yaml
new file mode 100644
index 0000000..ab804f7
--- /dev/null
+++ b/helm-charts/rekor/ci/ci-values.yaml
@@ -0,0 +1,4 @@
+---
+server:
+  ingress:
+    hostname: rekor.localhost
diff --git a/helm-charts/rekor/templates/_helpers.tpl b/helm-charts/rekor/templates/_helpers.tpl
new file mode 100644
index 0000000..9240d06
--- /dev/null
+++ b/helm-charts/rekor/templates/_helpers.tpl
@@ -0,0 +1,480 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "rekor.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "rekor.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "rekor.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+
+
+
+{{/*
+Create a fully qualified Rekor server name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "rekor.server.fullname" -}}
+{{- if .Values.server.fullnameOverride -}}
+{{- .Values.server.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- printf "%s-%s" .Release.Name .Values.server.name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s-%s" .Release.Name $name .Values.server.name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create a fully qualified Redis name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "rekor.redis.fullname" -}}
+{{- if .Values.redis.fullnameOverride -}}
+{{- .Values.redis.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- printf "%s-%s" .Release.Name .Values.redis.name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s-%s" .Release.Name $name .Values.redis.name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create a fully qualified Mysql name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "rekor.mysql.fullname" -}}
+{{- if .Values.mysql.fullnameOverride -}}
+{{- .Values.mysql.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- printf "%s-%s" .Release.Name .Values.mysql.name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s-%s" .Release.Name $name .Values.mysql.name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+
+{{/*
+Create a fully qualified Trillian Log Server name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "rekor.trillianLogServer.fullname" -}}
+{{- if .Values.trillianLogServer.fullnameOverride -}}
+{{- .Values.trillianLogServer.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- printf "%s-%s" .Release.Name .Values.trillianLogServer.name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s-%s" .Release.Name $name .Values.trillianLogServer.name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create a fully qualified Trillian Log Signer name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "rekor.trillianLogSigner.fullname" -}}
+{{- if .Values.trillianLogSigner.fullnameOverride -}}
+{{- .Values.trillianLogSigner.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- printf "%s-%s" .Release.Name .Values.trillianLogSigner.name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s-%s" .Release.Name $name .Values.trillianLogSigner.name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+
+{{/*
+Define the rekor.namespace template if set with forceNamespace or .Release.Namespace is set
+*/}}
+{{- define "rekor.namespace" -}}
+{{- if .Values.forceNamespace -}}
+{{ printf "namespace: %s" .Values.forceNamespace }}
+{{- else -}}
+{{ printf "namespace: %s" .Release.Namespace }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the secret with MySQL credentials
+*/}}
+{{- define "mysql.secretName" -}}
+    {{- if .Values.mysql.auth.existingSecret -}}
+        {{- printf "%s" .Values.mysql.auth.existingSecret -}}
+    {{- else -}}
+        {{- printf "%s" (include "rekor.mysql.fullname" .) -}}
+    {{- end -}}
+{{- end -}}
+
+{{/*
+Return the hostname for mysql
+*/}}
+{{- define "mysql.hostname" -}}
+{{- default (include "rekor.mysql.fullname" .) .Values.mysql.hostname }}
+{{- end -}}
+
+{{/*
+Return the database for mysql
+*/}}
+{{- define "mysql.database" -}}
+{{- default (include "rekor.fullname" .) .Values.mysql.database }}
+{{- end -}}
+
+
+{{/*
+Return the hostname for redis
+*/}}
+{{- define "redis.hostname" -}}
+{{- default (include "rekor.redis.fullname" .) .Values.redis.hostname }}
+{{- end -}}
+
+
+
+
+{{/*
+Create labels for rekor components
+*/}}
+{{- define "rekor.common.matchLabels" -}}
+app.kubernetes.io/name: {{ include "rekor.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "rekor.common.metaLabels" -}}
+helm.sh/chart: {{ include "rekor.chart" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+
+{{- define "rekor.redis.labels" -}}
+{{ include "rekor.redis.matchLabels" . }}
+{{ include "rekor.common.metaLabels" . }}
+{{- end -}}
+
+{{- define "rekor.redis.matchLabels" -}}
+app.kubernetes.io/component: {{ .Values.redis.name | quote }}
+{{ include "rekor.common.matchLabels" . }}
+{{- end -}}
+
+{{- define "rekor.mysql.labels" -}}
+{{ include "rekor.mysql.matchLabels" . }}
+{{ include "rekor.common.metaLabels" . }}
+{{- end -}}
+
+{{- define "rekor.mysql.matchLabels" -}}
+app.kubernetes.io/component: {{ .Values.mysql.name | quote }}
+{{ include "rekor.common.matchLabels" . }}
+{{- end -}}
+
+{{- define "rekor.server.labels" -}}
+{{ include "rekor.server.matchLabels" . }}
+{{ include "rekor.common.metaLabels" . }}
+{{- end -}}
+
+{{- define "rekor.server.matchLabels" -}}
+app.kubernetes.io/component: {{ .Values.server.name | quote }}
+{{ include "rekor.common.matchLabels" . }}
+{{- end -}}
+
+{{- define "rekor.trillianLogServer.labels" -}}
+{{ include "rekor.trillianLogServer.matchLabels" . }}
+{{ include "rekor.common.metaLabels" . }}
+{{- end -}}
+
+{{- define "rekor.trillianLogServer.matchLabels" -}}
+app.kubernetes.io/component: {{ .Values.trillianLogServer.name | quote }}
+{{ include "rekor.common.matchLabels" . }}
+{{- end -}}
+
+{{- define "rekor.trillianLogSigner.labels" -}}
+{{ include "rekor.trillianLogSigner.matchLabels" . }}
+{{ include "rekor.common.metaLabels" . }}
+{{- end -}}
+
+{{- define "rekor.trillianLogSigner.matchLabels" -}}
+app.kubernetes.io/component: {{ .Values.trillianLogSigner.name | quote }}
+{{ include "rekor.common.matchLabels" . }}
+{{- end -}}
+
+
+{{/*
+Common labels
+*/}}
+{{- define "rekor.labels" -}}
+helm.sh/chart: {{ include "rekor.chart" . }}
+{{ include "rekor.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "rekor.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "rekor.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "rekor.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "rekor.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+
+
+
+
+
+{{/*
+Create the name of the service account to use for the server component
+*/}}
+{{- define "rekor.serviceAccountName.server" -}}
+{{- if .Values.server.serviceAccount.create -}}
+    {{ default (include "rekor.server.fullname" .) .Values.server.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.server.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use for the redis component
+*/}}
+{{- define "rekor.serviceAccountName.redis" -}}
+{{- if .Values.redis.serviceAccount.create -}}
+    {{ default (include "rekor.redis.fullname" .) .Values.redis.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.redis.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use for the mysql component
+*/}}
+{{- define "rekor.serviceAccountName.mysql" -}}
+{{- if .Values.mysql.serviceAccount.create -}}
+    {{ default (include "rekor.mysql.fullname" .) .Values.mysql.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.mysql.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use for the Trillian Log Signer component
+*/}}
+{{- define "rekor.serviceAccountName.trillianLogSigner" -}}
+{{- if .Values.trillianLogSigner.serviceAccount.create -}}
+    {{ default (include "rekor.trillianLogSigner.fullname" .) .Values.trillianLogSigner.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.trillianLogSigner.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use for the Trillian Log Signer component
+*/}}
+{{- define "rekor.serviceAccountName.trillianLogServer" -}}
+{{- if .Values.trillianLogServer.serviceAccount.create -}}
+    {{ default (include "rekor.trillianLogServer.fullname" .) .Values.trillianLogServer.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.trillianLogServer.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the image path for the passed in image field
+*/}}
+{{- define "rekor.image" -}}
+{{- if eq (substr 0 7 .version) "sha256:" -}}
+{{- printf "%s@%s" .repository .version -}}
+{{- else -}}
+{{- printf "%s:%s" .repository .version -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create Container Ports based on Service Ports
+*/}}
+{{- define "rekor.containerPorts" -}}
+{{- range . }}
+- containerPort: {{ (ternary .tagrgetPort .port (empty .targetPort)) | int }}
+  protocol: {{ default "TCP" .protocol }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Log Server Arguments
+*/}}
+{{- define "rekor.trillianLogServer.args" -}}
+- '--storage_system=mysql'
+- '--mysql_uri=$(MYSQL_USER):$(MYSQL_PASSWORD)@tcp($(MYSQL_HOSTNAME):$(MYSQL_PORT))/$(MYSQL_DATABASE)'
+- '--rpc_endpoint=0.0.0.0:8091'
+- '--http_endpoint=0.0.0.0:8090'
+- '--alsologtostderr'
+{{- if .Values.trillianLogServer.extraArgs -}}
+{{ toYaml .Values.trillianLogServer.extraArgs }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Log Signer Arguments
+*/}}
+{{- define "rekor.trillianLogSigner.args" -}}
+- '--storage_system=mysql'
+- '--mysql_uri=$(MYSQL_USER):$(MYSQL_PASSWORD)@tcp($(MYSQL_HOSTNAME):$(MYSQL_PORT))/$(MYSQL_DATABASE)'
+- '--rpc_endpoint=0.0.0.0:8091'
+- '--http_endpoint=0.0.0.0:8090'
+- '--force_master'
+- '--alsologtostderr'
+{{- if .Values.trillianLogSigner.extraArgs -}}
+{{ toYaml .Values.trillianLogSigner.extraArgs }}
+{{- end -}}
+{{- end -}}
+
+
+{{/*
+Server Arguments
+*/}}
+{{- define "rekor.server.args" -}}
+- "serve"
+- {{ printf "--trillian_log_server.address=%s" (include "rekor.trillianLogServer.fullname" .) | quote }}
+- {{ printf "--trillian_log_server.port=%d" (.Values.trillianLogServer.port | int) | quote }}
+- {{ printf "--redis_server.address=%s" (include "redis.hostname" .) | quote }}
+- {{ printf "--redis_server.port=%d" (.Values.redis.port | int) | quote }}
+- "--rekor_server.address=0.0.0.0"
+- "--rekor_server.signer=memory"
+{{- if .Values.server.attestation_storage.enabled }}
+- "--enable_attestation_storage"
+- {{ printf "--attestation_storage_bucket=%s" (.Values.server.attestation_storage.bucket) | quote }}
+{{- end -}}
+{{- if .Values.server.logging.production -}}
+- "--log_type=prod"
+{{- end -}}
+{{- if .Values.server.extraArgs -}}
+{{ toYaml .Values.server.extraArgs }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the appropriate apiVersion for ingress.
+*/}}
+{{- define "ingress.apiVersion" -}}
+{{- if .Values.server.ingress.apiVersion -}}
+{{- .Values.server.ingress.apiVersion -}}
+{{- else if semverCompare "<1.14-0" .Capabilities.KubeVersion.Version -}}
+{{- print "extensions/v1beta1" -}}
+{{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.Version -}}
+{{- print "networking.k8s.io/v1beta1" -}}
+{{- else -}}
+{{- print "networking.k8s.io/v1" -}}
+{{- end }}
+{{- end }}
+
+{{/*
+Print "true" if the API pathType field is supported
+*/}}
+{{- define "ingress.supportsPathType" -}}
+{{- if (semverCompare "<1.18-0" .Capabilities.KubeVersion.Version) -}}
+{{- print "false" -}}
+{{- else -}}
+{{- print "true" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the appropriate apiVersion for ingress.
+*/}}
+{{- define "rekor.server.ingress.backend" -}}
+{{- $apiVersion := (include "ingress.apiVersion" .) -}}
+{{- $serviceName := (include "rekor.server.fullname" .) -}}
+{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}}
+serviceName: {{ $serviceName }}
+servicePort: {{ .Values.server.port }}
+{{- else -}}
+service:
+  name: {{ $serviceName }}
+  port:
+    number: {{ .Values.server.port | int }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Determine whether the Attestation storage is file based.
+*/}}
+{{- define "rekor.server.fileAttestationStorage" -}}
+{{- if .Values.server.attestation_storage.enabled -}}
+{{- if eq (substr 0 7 .Values.server.attestation_storage.bucket) "file://" -}}
+{{- print "true" -}}
+{{- else -}}
+{{- print "false" -}}
+{{- end -}}
+{{- else -}}
+{{- print "false" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the location for file based Attestation storage.
+*/}}
+{{- define "rekor.server.fileAttestationStorage.path" -}}
+{{- print (substr 7 -1 .Values.server.attestation_storage.bucket) -}}
+{{- end -}}
+
+{{/*
+Return a random Secret value or the value of an exising Secret key value
+*/}}
+{{- define "rekor.randomSecret" -}}
+{{- $randomSecret := (randAlphaNum 10) }}
+{{- $secret := (lookup "v1" "Secret" .context.Release.Namespace .secretName) }}
+{{- if $secret }}
+{{- if hasKey $secret.data .key }}
+{{- print (index $secret.data .key) | b64dec }}
+{{- else }}
+{{- print $randomSecret }}
+{{- end }}
+{{- else }}
+{{- print $randomSecret }}
+{{- end }}
+{{- end -}}
diff --git a/helm-charts/rekor/templates/mysql/deployment.yaml b/helm-charts/rekor/templates/mysql/deployment.yaml
new file mode 100644
index 0000000..2492f6b
--- /dev/null
+++ b/helm-charts/rekor/templates/mysql/deployment.yaml
@@ -0,0 +1,120 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+{{- if .Values.mysql.deploymentAnnotations }}
+  annotations:
+    {{ toYaml .Values.mysql.deploymentAnnotations | nindent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.mysql.labels" . | nindent 4 }}
+  name: {{ template "rekor.mysql.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  selector:
+    {{- if .Values.schedulerName }}
+    schedulerName: "{{ .Values.schedulerName }}"
+    {{- end }}
+    matchLabels:
+      {{- include "rekor.mysql.matchLabels" . | nindent 6 }}
+  replicas: {{ .Values.mysql.replicaCount }}
+  {{- if .Values.mysql.strategy }}
+  strategy:
+{{ toYaml .Values.mysql.strategy | trim | indent 4 }}
+    {{ if eq .Values.mysql.strategy.type "Recreate" }}rollingUpdate: null{{ end }}
+{{- end }}
+  template:
+    metadata:
+    {{- if .Values.mysql.podAnnotations }}
+      annotations:
+        {{ toYaml .Values.mysql.podAnnotations | nindent 8 }}
+    {{- end }}
+      labels:
+        {{- include "rekor.mysql.labels" . | nindent 8 }}
+        {{- if .Values.mysql.podLabels}}
+        {{ toYaml .Values.mysql.podLabels | nindent 8 }}
+        {{- end}}
+    spec:
+      serviceAccountName: {{ template "rekor.serviceAccountName.mysql" . }}
+      {{- if .Values.mysql.extraInitContainers }}
+      initContainers:
+{{ toYaml .Values.mysql.extraInitContainers | indent 8 }}
+      {{- end }}
+{{- if .Values.mysql.priorityClassName }}
+      priorityClassName: "{{ .Values.mysql.priorityClassName }}"
+{{- end }}
+      containers:
+        - name: {{ template "rekor.name" . }}-{{ .Values.mysql.name }}
+          image: "{{ template "rekor.image" .Values.mysql.image }}"
+          imagePullPolicy: "{{ .Values.mysql.image.pullPolicy }}"
+        {{- if .Values.mysql.args }}
+          args:
+{{ toYaml .Values.mysql.args | indent 12 }}
+        {{- end }}
+          env:
+            - name: MYSQL_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "mysql.secretName" . }}
+                  key: mysql-root-password
+            - name: MYSQL_USER
+              value: {{ .Values.mysql.auth.username | quote }}
+            - name: MYSQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "mysql.secretName" . }}
+                  key: mysql-password
+            - name: MYSQL_DATABASE
+              value: {{ template "mysql.database" . }}
+          ports:
+{{- include "rekor.containerPorts" .Values.mysql.service.ports | indent 12 }}
+{{- if .Values.mysql.livenessProbe }}
+          livenessProbe:
+{{ toYaml .Values.mysql.livenessProbe | indent 12 }}
+{{- end }}
+{{- if .Values.mysql.readinessProbe }}
+          readinessProbe:
+{{ toYaml .Values.mysql.readinessProbe | indent 12 }}
+{{- end }}
+          resources:
+{{ toYaml .Values.mysql.resources | indent 12 }}
+          volumeMounts:
+            - name: storage
+              mountPath: {{ .Values.mysql.persistence.mountPath }}
+              subPath: {{ .Values.mysql.persistence.subPath }}
+    {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+    {{- end }}
+    {{- if .Values.mysql.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.mysql.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.mysql.dnsConfig }}
+      dnsConfig:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.mysql.securityContext }}
+      securityContext:
+{{ toYaml .Values.mysql.securityContext | indent 8 }}
+    {{- end }}
+    {{- if .Values.mysql.tolerations }}
+      tolerations:
+{{ toYaml .Values.mysql.tolerations | indent 8 }}
+    {{- end }}
+    {{- if .Values.mysql.affinity }}
+      affinity:
+{{ toYaml .Values.mysql.affinity | indent 8 }}
+    {{- end }}
+      volumes:
+  {{- if not .Values.mysql.persistence.enabled }}
+        - name: storage
+          emptyDir: {}
+  {{- else if .Values.mysql.persistence.existingClaim }}
+        - name: storage
+          persistentVolumeClaim:
+            claimName: {{ .Values.mysql.persistence.existingClaim }}
+  {{- else }}
+        - name: storage
+          persistentVolumeClaim:
+            claimName: {{ template "rekor.mysql.fullname" . }}
+  {{- end }}
\ No newline at end of file
diff --git a/helm-charts/rekor/templates/mysql/pvc.yaml b/helm-charts/rekor/templates/mysql/pvc.yaml
new file mode 100644
index 0000000..b3b6360
--- /dev/null
+++ b/helm-charts/rekor/templates/mysql/pvc.yaml
@@ -0,0 +1,27 @@
+{{- if and .Values.mysql.enabled (.Values.mysql.persistence.enabled) (not .Values.mysql.persistence.existingClaim) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+{{- if .Values.mysql.persistence.annotations }}
+  annotations:
+{{ toYaml .Values.mysql.persistence.annotations | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.mysql.labels" . | nindent 4 }}
+{{- if .Values.mysql.persistence.labels }}
+{{ toYaml .Values.mysql.persistence.labels | indent 4 }}
+{{- end }}
+  name: {{ template "rekor.mysql.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  accessModes:
+  {{- range .Values.mysql.persistence.accessModes }}
+    - {{ . | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.mysql.persistence.size | quote }}
+{{- if .Values.mysql.persistence.storageClass }}
+  storageClassName: {{ .Values.mysql.persistence.storageClass }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/helm-charts/rekor/templates/mysql/secret.yaml b/helm-charts/rekor/templates/mysql/secret.yaml
new file mode 100644
index 0000000..462f8a0
--- /dev/null
+++ b/helm-charts/rekor/templates/mysql/secret.yaml
@@ -0,0 +1,30 @@
+{{- if (not .Values.mysql.auth.existingSecret) }}
+apiVersion: v1
+kind: Secret
+metadata:
+{{- if .Values.mysql.secret.annotations }}
+  annotations:
+{{ toYaml .Values.mysql.secret.annotations | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.mysql.labels" . | nindent 4 }}
+{{- if .Values.mysql.secret.labels }}
+{{ toYaml .Values.mysql.secret.labels | indent 4 }}
+{{- end }}
+  name: {{ template "rekor.mysql.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+type: Opaque
+data:
+  {{- if .Values.mysql.enabled -}}
+  {{- if not (empty .Values.mysql.auth.rootPassword) }}
+  mysql-root-password: {{ .Values.mysql.auth.rootPassword | b64enc | quote }}
+  {{- else }}
+  mysql-root-password: {{ (include "rekor.randomSecret" (dict "secretName" (include "rekor.mysql.fullname" .) "key" "mysql-root-password" "context" $)) | b64enc | quote }}
+  {{- end }}
+  {{- end }}
+  {{- if not (empty .Values.mysql.auth.password) }}
+  mysql-password: {{ .Values.mysql.auth.password | b64enc | quote }}
+  {{- else }}
+  mysql-password: {{ (include "rekor.randomSecret" (dict "secretName" (include "rekor.mysql.fullname" .) "key" "mysql-password" "context" $)) | b64enc | quote }}
+  {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/helm-charts/rekor/templates/mysql/service.yaml b/helm-charts/rekor/templates/mysql/service.yaml
new file mode 100644
index 0000000..e7d9667
--- /dev/null
+++ b/helm-charts/rekor/templates/mysql/service.yaml
@@ -0,0 +1,22 @@
+{{- if .Values.mysql.enabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+{{- if .Values.mysql.service.annotations }}
+  annotations:
+{{ toYaml .Values.mysql.service.annotations | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.mysql.labels" . | nindent 4 }}
+{{- if .Values.mysql.service.labels }}
+{{ toYaml .Values.mysql.service.labels | indent 4 }}
+{{- end }}
+  name: {{ template "rekor.mysql.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  ports:
+    {{- tpl (toYaml .Values.mysql.service.ports) . | nindent 4 }}
+  selector:
+    {{- include "rekor.mysql.matchLabels" . | nindent 4 }}
+  type: "{{ .Values.mysql.service.type }}"
+{{- end -}}
diff --git a/helm-charts/rekor/templates/mysql/serviceaccount.yaml b/helm-charts/rekor/templates/mysql/serviceaccount.yaml
new file mode 100644
index 0000000..c3a3e5b
--- /dev/null
+++ b/helm-charts/rekor/templates/mysql/serviceaccount.yaml
@@ -0,0 +1,14 @@
+{{- if .Values.mysql.enabled -}}
+{{- if .Values.mysql.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    {{- include "rekor.mysql.labels" . | nindent 4 }}
+  name: {{ template "rekor.serviceAccountName.mysql" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+  annotations:
+{{ toYaml .Values.mysql.serviceAccount.annotations | indent 4 }}
+{{- end }}
+{{- end }}
+
diff --git a/helm-charts/rekor/templates/redis/deployment.yaml b/helm-charts/rekor/templates/redis/deployment.yaml
new file mode 100644
index 0000000..810f915
--- /dev/null
+++ b/helm-charts/rekor/templates/redis/deployment.yaml
@@ -0,0 +1,96 @@
+{{- if .Values.redis.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+{{- if .Values.redis.deploymentAnnotations }}
+  annotations:
+    {{ toYaml .Values.redis.deploymentAnnotations | nindent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.redis.labels" . | nindent 4 }}
+  name: {{ template "rekor.redis.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  selector:
+    {{- if .Values.schedulerName }}
+    schedulerName: "{{ .Values.schedulerName }}"
+    {{- end }}
+    matchLabels:
+      {{- include "rekor.redis.matchLabels" . | nindent 6 }}
+  replicas: {{ .Values.redis.replicaCount }}
+  {{- if .Values.redis.strategy }}
+  strategy:
+{{ toYaml .Values.redis.strategy | trim | indent 4 }}
+    {{ if eq .Values.redis.strategy.type "Recreate" }}rollingUpdate: null{{ end }}
+{{- end }}
+  template:
+    metadata:
+    {{- if .Values.redis.podAnnotations }}
+      annotations:
+        {{ toYaml .Values.redis.podAnnotations | nindent 8 }}
+    {{- end }}
+      labels:
+        {{- include "rekor.redis.labels" . | nindent 8 }}
+        {{- if .Values.redis.podLabels}}
+        {{ toYaml .Values.redis.podLabels | nindent 8 }}
+        {{- end}}
+    spec:
+      serviceAccountName: {{ template "rekor.serviceAccountName.redis" . }}
+      {{- if .Values.redis.extraInitContainers }}
+      initContainers:
+{{ toYaml .Values.redis.extraInitContainers | indent 8 }}
+      {{- end }}
+{{- if .Values.redis.priorityClassName }}
+      priorityClassName: "{{ .Values.redis.priorityClassName }}"
+{{- end }}
+      containers:
+        - name: {{ template "rekor.name" . }}-{{ .Values.redis.name }}
+          image: "{{ template "rekor.image" .Values.redis.image }}"
+          imagePullPolicy: "{{ .Values.redis.image.pullPolicy }}"
+        {{- if .Values.redis.args }}
+          args:
+{{ toYaml .Values.redis.args | indent 12 }}
+        {{- end }}
+          ports:
+{{- include "rekor.containerPorts" .Values.redis.service.ports | indent 12 }}
+{{- if .Values.redis.readinessProbe }}
+          readinessProbe:
+{{ toYaml .Values.redis.readinessProbe | indent 12 }}
+{{- end }}
+{{- if .Values.redis.livenessProbe }}
+          readinessProbe:
+{{ toYaml .Values.redis.livenessProbe | indent 12 }}
+{{- end }}
+          resources:
+{{ toYaml .Values.redis.resources | indent 12 }}
+          volumeMounts:
+            - name: storage
+              mountPath: /data
+    {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+    {{- end }}
+    {{- if .Values.redis.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.redis.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.redis.dnsConfig }}
+      dnsConfig:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.redis.securityContext }}
+      securityContext:
+{{ toYaml .Values.redis.securityContext | indent 8 }}
+    {{- end }}
+    {{- if .Values.redis.tolerations }}
+      tolerations:
+{{ toYaml .Values.redis.tolerations | indent 8 }}
+    {{- end }}
+    {{- if .Values.redis.affinity }}
+      affinity:
+{{ toYaml .Values.redis.affinity | indent 8 }}
+    {{- end }}
+      volumes:
+        - name: storage
+          emptyDir: {}
+{{- end }}
\ No newline at end of file
diff --git a/helm-charts/rekor/templates/redis/service.yaml b/helm-charts/rekor/templates/redis/service.yaml
new file mode 100644
index 0000000..6340f13
--- /dev/null
+++ b/helm-charts/rekor/templates/redis/service.yaml
@@ -0,0 +1,22 @@
+{{- if .Values.redis.enabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+{{- if .Values.redis.service.annotations }}
+  annotations:
+{{ toYaml .Values.redis.service.annotations | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.redis.labels" . | nindent 4 }}
+{{- if .Values.redis.service.labels }}
+{{ toYaml .Values.redis.service.labels | indent 4 }}
+{{- end }}
+  name: {{ template "rekor.redis.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  ports:
+    {{- tpl (toYaml .Values.redis.service.ports) . | nindent 4 }}
+  selector:
+    {{- include "rekor.redis.matchLabels" . | nindent 4 }}
+  type: "{{ .Values.redis.service.type }}"
+{{- end -}}
diff --git a/helm-charts/rekor/templates/redis/serviceaccount.yaml b/helm-charts/rekor/templates/redis/serviceaccount.yaml
new file mode 100644
index 0000000..bbb4670
--- /dev/null
+++ b/helm-charts/rekor/templates/redis/serviceaccount.yaml
@@ -0,0 +1,14 @@
+{{- if .Values.redis.enabled -}}
+{{- if .Values.redis.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    {{- include "rekor.redis.labels" . | nindent 4 }}
+  name: {{ template "rekor.serviceAccountName.redis" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+  annotations:
+{{ toYaml .Values.redis.serviceAccount.annotations | indent 4 }}
+{{- end }}
+{{- end }}
+
diff --git a/helm-charts/rekor/templates/server/deployment.yaml b/helm-charts/rekor/templates/server/deployment.yaml
new file mode 100644
index 0000000..bd7f559
--- /dev/null
+++ b/helm-charts/rekor/templates/server/deployment.yaml
@@ -0,0 +1,106 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+{{- if .Values.server.deploymentAnnotations }}
+  annotations:
+    {{ toYaml .Values.server.deploymentAnnotations | nindent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.server.labels" . | nindent 4 }}
+  name: {{ template "rekor.server.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  selector:
+    {{- if .Values.schedulerName }}
+    schedulerName: "{{ .Values.schedulerName }}"
+    {{- end }}
+    matchLabels:
+      {{- include "rekor.server.matchLabels" . | nindent 6 }}
+  replicas: {{ .Values.server.replicaCount }}
+  {{- if .Values.server.strategy }}
+  strategy:
+{{ toYaml .Values.server.strategy | trim | indent 4 }}
+    {{ if eq .Values.server.strategy.type "Recreate" }}rollingUpdate: null{{ end }}
+{{- end }}
+  template:
+    metadata:
+    {{- if .Values.server.podAnnotations }}
+      annotations:
+        {{ toYaml .Values.server.podAnnotations | nindent 8 }}
+    {{- end }}
+      labels:
+        {{- include "rekor.server.labels" . | nindent 8 }}
+        {{- if .Values.server.podLabels}}
+        {{ toYaml .Values.server.podLabels | nindent 8 }}
+        {{- end}}
+    spec:
+      serviceAccountName: {{ template "rekor.serviceAccountName.server" . }}
+      {{- if .Values.server.extraInitContainers }}
+      initContainers:
+{{ toYaml .Values.server.extraInitContainers | indent 8 }}
+      {{- end }}
+{{- if .Values.server.priorityClassName }}
+      priorityClassName: "{{ .Values.server.priorityClassName }}"
+{{- end }}
+      containers:
+        - name: {{ template "rekor.name" . }}-{{ .Values.server.name }}
+          image: "{{ template "rekor.image" .Values.server.image }}"
+          imagePullPolicy: "{{ .Values.server.image.pullPolicy }}"
+          args:
+{{  include "rekor.server.args" . | indent 12 }}
+          ports:
+{{- include "rekor.containerPorts" .Values.server.service.ports | indent 12 }}
+{{- if eq "true" (include "rekor.server.fileAttestationStorage" .) }}
+          volumeMounts:
+            - name: storage
+              mountPath: {{ template "rekor.server.fileAttestationStorage.path" . }}
+{{- end -}}
+{{- if .Values.server.livenessProbe }}
+          livenessProbe:
+{{ toYaml .Values.server.livenessProbe | indent 12 }}
+{{- end }}
+{{- if .Values.server.readinessProbe }}
+          readinessProbe:
+{{ toYaml .Values.server.readinessProbe | indent 12 }}
+{{- end }}
+          resources:
+{{ toYaml .Values.server.resources | indent 12 }}
+    {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.server | indent 8 }}
+    {{- end }}
+    {{- if .Values.server.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.server.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.server.dnsConfig }}
+      dnsConfig:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.server.securityContext }}
+      securityContext:
+{{ toYaml .Values.server.securityContext | indent 8 }}
+    {{- end }}
+    {{- if .Values.server.tolerations }}
+      tolerations:
+{{ toYaml .Values.server.tolerations | indent 8 }}
+    {{- end }}
+    {{- if .Values.server.affinity }}
+      affinity:
+{{ toYaml .Values.server.affinity | indent 8 }}
+    {{- end }}
+      volumes:
+{{- if eq "true" (include "rekor.server.fileAttestationStorage" .) }}
+  {{- if not .Values.server.attestation_storage.persistence.enabled }}
+        - name: storage
+          emptyDir: {}
+  {{- else if .Values.server.attestation_storage.persistence.existingClaim }}
+        - name: storage
+          persistentVolumeClaim:
+            claimName: {{ .Values.server.attestation_storage.persistence.existingClaim }}
+  {{- else }}
+        - name: storage
+          persistentVolumeClaim:
+            claimName: {{ template "rekor.server.fullname" . }}
+  {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/helm-charts/rekor/templates/server/ingress.yaml b/helm-charts/rekor/templates/server/ingress.yaml
new file mode 100644
index 0000000..808abc1
--- /dev/null
+++ b/helm-charts/rekor/templates/server/ingress.yaml
@@ -0,0 +1,27 @@
+{{- if .Values.server.ingress.enabled }}
+apiVersion: {{ include "ingress.apiVersion" .}}
+kind: Ingress
+metadata:
+  labels:
+    {{- include "rekor.server.labels" . | nindent 4 }}
+  name: {{ template "rekor.server.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+  annotations:
+{{ toYaml .Values.server.ingress.annotations | indent 4 }}
+spec:
+  rules:
+    - host: {{ required "An Ingress hostname is required" .Values.server.ingress.hostname }}
+      http:
+        paths:
+          - path: {{ .Values.server.ingress.path }}
+            {{- if eq "true" (include "ingress.supportsPathType" .) }}
+            pathType: {{ default "Prefix" .Values.server.ingress.pathType }}
+            {{- end }}
+            backend: {{- include "rekor.server.ingress.backend" .  | nindent 14 }}
+{{- if .Values.server.ingress.tls }}
+  tls:
+    - hosts:
+        - {{  .Values.server.ingress.hostname | quote }}
+      secretName: {{ .Values.server.ingress.tls.secretName }}
+{{- end -}}
+{{- end }}
\ No newline at end of file
diff --git a/helm-charts/rekor/templates/server/pvc.yaml b/helm-charts/rekor/templates/server/pvc.yaml
new file mode 100644
index 0000000..923daa5
--- /dev/null
+++ b/helm-charts/rekor/templates/server/pvc.yaml
@@ -0,0 +1,27 @@
+{{- if and .Values.server.attestation_storage.persistence.enabled (eq "true" (include "rekor.server.fileAttestationStorage" .)) (not .Values.server.attestation_storage.persistence.existingClaim) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+{{- if .Values.server.attestation_storage.persistence.annotations }}
+  annotations:
+{{ toYaml .Values.server.attestation_storage.persistence.annotations | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.server.labels" . | nindent 4 }}
+{{- if .Values.server.attestation_storage.persistence.labels }}
+{{ toYaml .Values.server.attestation_storage.persistence.labels | indent 4 }}
+{{- end }}
+  name: {{ template "rekor.server.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  accessModes:
+  {{- range .Values.server.attestation_storage.persistence.accessModes }}
+    - {{ . | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.server.attestation_storage.persistence.size | quote }}
+{{- if .Values.server.attestation_storage.persistence.storageClass }}
+  storageClassName: {{ .Values.server.attestation_storage.persistence.storageClass }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/helm-charts/rekor/templates/server/service.yaml b/helm-charts/rekor/templates/server/service.yaml
new file mode 100644
index 0000000..557e863
--- /dev/null
+++ b/helm-charts/rekor/templates/server/service.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+{{- if .Values.server.service.annotations }}
+  annotations:
+{{ toYaml .Values.server.service.annotations | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.server.labels" . | nindent 4 }}
+{{- if .Values.server.service.labels }}
+{{ toYaml .Values.server.service.labels | indent 4 }}
+{{- end }}
+  name: {{ template "rekor.server.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  ports:
+    {{- tpl (toYaml .Values.server.service.ports) . | nindent 4 }}
+  selector:
+    {{- include "rekor.server.matchLabels" . | nindent 4 }}
+  type: "{{ .Values.server.service.type }}"
diff --git a/helm-charts/rekor/templates/server/serviceaccount.yaml b/helm-charts/rekor/templates/server/serviceaccount.yaml
new file mode 100644
index 0000000..07a0dca
--- /dev/null
+++ b/helm-charts/rekor/templates/server/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.server.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    {{- include "rekor.mysql.labels" . | nindent 4 }}
+  name: {{ template "rekor.serviceAccountName.server" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+  annotations:
+{{ toYaml .Values.server.serviceAccount.annotations | indent 4 }}
+{{- end }}
+
diff --git a/helm-charts/rekor/templates/trillian-log-server/deployment.yaml b/helm-charts/rekor/templates/trillian-log-server/deployment.yaml
new file mode 100644
index 0000000..c3255f4
--- /dev/null
+++ b/helm-charts/rekor/templates/trillian-log-server/deployment.yaml
@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+{{- if .Values.trillianLogServer.deploymentAnnotations }}
+  annotations:
+    {{ toYaml .Values.trillianLogServer.deploymentAnnotations | nindent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.trillianLogServer.labels" . | nindent 4 }}
+  name: {{ template "rekor.trillianLogServer.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  selector:
+    {{- if .Values.schedulerName }}
+    schedulerName: "{{ .Values.schedulerName }}"
+    {{- end }}
+    matchLabels:
+      {{- include "rekor.trillianLogServer.matchLabels" . | nindent 6 }}
+  replicas: {{ .Values.trillianLogServer.replicaCount }}
+  {{- if .Values.trillianLogServer.strategy }}
+  strategy:
+{{ toYaml .Values.trillianLogServer.strategy | trim | indent 4 }}
+    {{ if eq .Values.trillianLogServer.strategy.type "Recreate" }}rollingUpdate: null{{ end }}
+{{- end }}
+  template:
+    metadata:
+    {{- if .Values.trillianLogServer.podAnnotations }}
+      annotations:
+        {{ toYaml .Values.trillianLogServer.podAnnotations | nindent 8 }}
+    {{- end }}
+      labels:
+        {{- include "rekor.trillianLogServer.labels" . | nindent 8 }}
+        {{- if .Values.trillianLogServer.podLabels}}
+        {{ toYaml .Values.trillianLogServer.podLabels | nindent 8 }}
+        {{- end}}
+    spec:
+      serviceAccountName: {{ template "rekor.serviceAccountName.trillianLogServer" . }}
+      {{- if .Values.trillianLogServer.extraInitContainers }}
+      initContainers:
+{{ toYaml .Values.trillianLogServer.extraInitContainers | indent 8 }}
+      {{- end }}
+{{- if .Values.trillianLogServer.priorityClassName }}
+      priorityClassName: "{{ .Values.trillianLogServer.priorityClassName }}"
+{{- end }}
+      containers:
+        - name: {{ template "rekor.name" . }}-{{ .Values.trillianLogServer.name }}
+          image: "{{ template "rekor.image" .Values.trillianLogServer.image }}"
+          imagePullPolicy: "{{ .Values.trillianLogServer.image.pullPolicy }}"
+          args:
+{{  include "rekor.trillianLogServer.args" . | indent 12 }}
+          env:
+            - name: MYSQL_USER
+              value: {{ .Values.mysql.auth.username | quote }}
+            - name: MYSQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "mysql.secretName" . }}
+                  key: mysql-password
+            - name: MYSQL_DATABASE
+              value: {{ template "mysql.database" . }}
+            - name: MYSQL_HOSTNAME
+              value: {{ template "mysql.hostname" . }}
+            - name: MYSQL_PORT
+              value: {{ .Values.mysql.port | quote }}
+          ports:
+{{- include "rekor.containerPorts" .Values.trillianLogServer.service.ports | indent 12 }}
+{{- if .Values.trillianLogServer.livenessProbe }}
+          livenessProbe:
+{{ toYaml .Values.trillianLogServer.livenessProbe | indent 12 }}
+{{- end }}
+{{- if .Values.trillianLogServer.readinessProbe }}
+          readinessProbe:
+{{ toYaml .Values.trillianLogServer.readinessProbe | indent 12 }}
+{{- end }}
+          resources:
+{{ toYaml .Values.trillianLogServer.resources | indent 12 }}
+    {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+    {{- end }}
+    {{- if .Values.trillianLogServer.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.trillianLogServer.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.trillianLogServer.dnsConfig }}
+      dnsConfig:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.trillianLogServer.securityContext }}
+      securityContext:
+{{ toYaml .Values.trillianLogServer.securityContext | indent 8 }}
+    {{- end }}
+    {{- if .Values.trillianLogServer.tolerations }}
+      tolerations:
+{{ toYaml .Values.trillianLogServer.tolerations | indent 8 }}
+    {{- end }}
+    {{- if .Values.trillianLogServer.affinity }}
+      affinity:
+{{ toYaml .Values.trillianLogServer.affinity | indent 8 }}
+    {{- end }}
\ No newline at end of file
diff --git a/helm-charts/rekor/templates/trillian-log-server/service.yaml b/helm-charts/rekor/templates/trillian-log-server/service.yaml
new file mode 100644
index 0000000..45e590c
--- /dev/null
+++ b/helm-charts/rekor/templates/trillian-log-server/service.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+{{- if .Values.trillianLogServer.service.annotations }}
+  annotations:
+{{ toYaml .Values.trillianLogServer.service.annotations | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.trillianLogServer.labels" . | nindent 4 }}
+{{- if .Values.trillianLogServer.service.labels }}
+{{ toYaml .Values.trillianLogServer.service.labels | indent 4 }}
+{{- end }}
+  name: {{ template "rekor.trillianLogServer.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  ports:
+    {{- tpl (toYaml .Values.trillianLogServer.service.ports) . | nindent 4 }}
+  selector:
+    {{- include "rekor.trillianLogServer.matchLabels" . | nindent 4 }}
+  type: "{{ .Values.trillianLogServer.service.type }}"
diff --git a/helm-charts/rekor/templates/trillian-log-server/serviceaccount.yaml b/helm-charts/rekor/templates/trillian-log-server/serviceaccount.yaml
new file mode 100644
index 0000000..4979c75
--- /dev/null
+++ b/helm-charts/rekor/templates/trillian-log-server/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.trillianLogServer.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    {{- include "rekor.mysql.labels" . | nindent 4 }}
+  name: {{ template "rekor.serviceAccountName.trillianLogServer" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+  annotations:
+{{ toYaml .Values.trillianLogServer.serviceAccount.annotations | indent 4 }}
+{{- end }}
+
diff --git a/helm-charts/rekor/templates/trillian-log-signer/deployment.yaml b/helm-charts/rekor/templates/trillian-log-signer/deployment.yaml
new file mode 100644
index 0000000..6f675a3
--- /dev/null
+++ b/helm-charts/rekor/templates/trillian-log-signer/deployment.yaml
@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+{{- if .Values.trillianLogSigner.deploymentAnnotations }}
+  annotations:
+    {{ toYaml .Values.trillianLogSigner.deploymentAnnotations | nindent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.trillianLogSigner.labels" . | nindent 4 }}
+  name: {{ template "rekor.trillianLogSigner.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  selector:
+    {{- if .Values.schedulerName }}
+    schedulerName: "{{ .Values.schedulerName }}"
+    {{- end }}
+    matchLabels:
+      {{- include "rekor.trillianLogSigner.matchLabels" . | nindent 6 }}
+  replicas: {{ .Values.trillianLogSigner.replicaCount }}
+  {{- if .Values.trillianLogSigner.strategy }}
+  strategy:
+{{ toYaml .Values.trillianLogSigner.strategy | trim | indent 4 }}
+    {{ if eq .Values.trillianLogSigner.strategy.type "Recreate" }}rollingUpdate: null{{ end }}
+{{- end }}
+  template:
+    metadata:
+    {{- if .Values.trillianLogSigner.podAnnotations }}
+      annotations:
+        {{ toYaml .Values.trillianLogSigner.podAnnotations | nindent 8 }}
+    {{- end }}
+      labels:
+        {{- include "rekor.trillianLogSigner.labels" . | nindent 8 }}
+        {{- if .Values.trillianLogSigner.podLabels}}
+        {{ toYaml .Values.trillianLogSigner.podLabels | nindent 8 }}
+        {{- end}}
+    spec:
+      serviceAccountName: {{ template "rekor.serviceAccountName.trillianLogSigner" . }}
+      {{- if .Values.trillianLogSigner.extraInitContainers }}
+      initContainers:
+{{ toYaml .Values.trillianLogSigner.extraInitContainers | indent 8 }}
+      {{- end }}
+{{- if .Values.trillianLogSigner.priorityClassName }}
+      priorityClassName: "{{ .Values.trillianLogSigner.priorityClassName }}"
+{{- end }}
+      containers:
+        - name: {{ template "rekor.name" . }}-{{ .Values.trillianLogSigner.name }}
+          image: "{{ template "rekor.image" .Values.trillianLogSigner.image }}"
+          imagePullPolicy: "{{ .Values.trillianLogSigner.image.pullPolicy }}"
+          args:
+{{  include "rekor.trillianLogSigner.args" . | indent 12 }}
+          env:
+            - name: MYSQL_USER
+              value: {{ .Values.mysql.auth.username | quote }}
+            - name: MYSQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "mysql.secretName" . }}
+                  key: mysql-password
+            - name: MYSQL_DATABASE
+              value: {{ template "mysql.database" . }}
+            - name: MYSQL_HOSTNAME
+              value: {{ template "mysql.hostname" . }}
+            - name: MYSQL_PORT
+              value: {{ .Values.mysql.port | quote }}
+          ports:
+{{- include "rekor.containerPorts" .Values.trillianLogSigner.service.ports | indent 12 }}
+{{- if .Values.trillianLogSigner.livenessProbe }}
+          livenessProbe:
+{{ toYaml .Values.trillianLogSigner.livenessProbe | indent 12 }}
+{{- end }}
+{{- if .Values.trillianLogSigner.readinessProbe }}
+          readinessProbe:
+{{ toYaml .Values.trillianLogSigner.readinessProbe | indent 12 }}
+{{- end }}
+          resources:
+{{ toYaml .Values.trillianLogSigner.resources | indent 12 }}
+    {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+    {{- end }}
+    {{- if .Values.trillianLogSigner.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.trillianLogSigner.nodeSelector | indent 8 }}
+    {{- end }}
+    {{- with .Values.trillianLogSigner.dnsConfig }}
+      dnsConfig:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.trillianLogSigner.securityContext }}
+      securityContext:
+{{ toYaml .Values.trillianLogSigner.securityContext | indent 8 }}
+    {{- end }}
+    {{- if .Values.trillianLogSigner.tolerations }}
+      tolerations:
+{{ toYaml .Values.trillianLogSigner.tolerations | indent 8 }}
+    {{- end }}
+    {{- if .Values.trillianLogSigner.affinity }}
+      affinity:
+{{ toYaml .Values.trillianLogSigner.affinity | indent 8 }}
+    {{- end }}
\ No newline at end of file
diff --git a/helm-charts/rekor/templates/trillian-log-signer/service.yaml b/helm-charts/rekor/templates/trillian-log-signer/service.yaml
new file mode 100644
index 0000000..b3f0606
--- /dev/null
+++ b/helm-charts/rekor/templates/trillian-log-signer/service.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+{{- if .Values.trillianLogSigner.service.annotations }}
+  annotations:
+{{ toYaml .Values.trillianLogSigner.service.annotations | indent 4 }}
+{{- end }}
+  labels:
+    {{- include "rekor.trillianLogSigner.labels" . | nindent 4 }}
+{{- if .Values.trillianLogSigner.service.labels }}
+{{ toYaml .Values.trillianLogSigner.service.labels | indent 4 }}
+{{- end }}
+  name: {{ template "rekor.trillianLogSigner.fullname" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+spec:
+  ports:
+    {{- tpl (toYaml .Values.trillianLogSigner.service.ports) . | nindent 4 }}
+  selector:
+    {{- include "rekor.trillianLogSigner.matchLabels" . | nindent 4 }}
+  type: "{{ .Values.trillianLogSigner.service.type }}"
diff --git a/helm-charts/rekor/templates/trillian-log-signer/serviceaccount.yaml b/helm-charts/rekor/templates/trillian-log-signer/serviceaccount.yaml
new file mode 100644
index 0000000..b00d9e2
--- /dev/null
+++ b/helm-charts/rekor/templates/trillian-log-signer/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.trillianLogSigner.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    {{- include "rekor.trillianLogSigner.labels" . | nindent 4 }}
+  name: {{ template "rekor.serviceAccountName.trillianLogSigner" . }}
+{{ include "rekor.namespace" . | indent 2 }}
+  annotations:
+{{ toYaml .Values.trillianLogSigner.serviceAccount.annotations | indent 4 }}
+{{- end }}
+
diff --git a/helm-charts/rekor/values.yaml b/helm-charts/rekor/values.yaml
new file mode 100644
index 0000000..0513b51
--- /dev/null
+++ b/helm-charts/rekor/values.yaml
@@ -0,0 +1,225 @@
+imagePullSecrets:
+
+redis:
+  enabled: true
+  replicaCount: 1
+  hostname: ""
+  port: 6379
+  args:
+    - --bind
+    - 0.0.0.0
+    - --appendonly
+    - "yes"
+  name: redis
+  image:
+    repository: docker.io/redis
+    pullPolicy: IfNotPresent
+    version: "5.0.10"
+  resources: {}
+  readinessProbe:
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 1
+    failureThreshold: 3
+    successThreshold: 1
+    exec:
+      command:
+        - /bin/sh
+        - -i
+        - -c
+        - test "$(redis-cli -h 127.0.0.1 ping)" = "PONG"
+  service:
+    type: ClusterIP
+    ports:
+      - name: 6379-tcp
+        port: 6379
+        protocol: TCP
+        targetPort: 6379
+  serviceAccount:
+    create: true
+    name:
+    annotations: {}
+mysql:
+  enabled: true
+  replicaCount: 1
+  name: mysql
+  hostname: ""
+  port: 3306
+  strategy:
+    type: Recreate
+  image:
+    repository: gcr.io/trillian-opensource-ci/db_server
+    pullPolicy: IfNotPresent
+    version: "df474653733c51ed91d60cf3efee69f7bf3199bd"
+  resources: {}
+  args:
+    - "--ignore-db-dir=lost+found"
+  service:
+    type: ClusterIP
+    ports:
+      - name: 3306-tcp
+        port: 3306
+        protocol: TCP
+        targetPort: 3306
+  livenessProbe:
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 1
+    failureThreshold: 3
+    successThreshold: 1
+    exec:
+      command:
+        - /etc/init.d/mysql
+        - status
+  readinessProbe:
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    timeoutSeconds: 1
+    failureThreshold: 3
+    successThreshold: 1
+    exec:
+      command:
+        - /etc/init.d/mysql
+        - status
+  secret:
+    annotations: {}
+  auth:
+    username: "mysql"
+    password: ""
+    rootPassword: ""
+    existingSecret: ""
+  persistence:
+    enabled: true
+    annotations: {}
+    storageClass: null
+    size: 5Gi
+    mountPath: /var/lib/mysql
+    subPath: ""
+    existingClaim: ""
+    accessModes:
+      - ReadWriteOnce
+  serviceAccount:
+    create: true
+    name:
+    annotations: {}
+server:
+  enabled: true
+  replicaCount: 1
+  name: server
+  port: 3000
+  image:
+    repository: gcr.io/projectsigstore/rekor-server
+    pullPolicy: IfNotPresent
+    version: "sha256:3dadc6f0d718c9aab3beefec2131713b52af89c280aa460220fa2a7ec5ca4205"
+  logging:
+    production: false
+  ingress:
+    enabled: true
+    annotations: {}
+    path: /
+    tls: {}
+  service:
+    type: ClusterIP
+    ports:
+      - name: 3000-tcp
+        port: 3000
+        protocol: TCP
+        targetPort: 3000
+      - name: 2112-tcp
+        port: 2112
+        protocol: TCP
+        targetPort: 2112
+  readinessProbe:
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    timeoutSeconds: 1
+    failureThreshold: 3
+    successThreshold: 1
+    httpGet:
+      port: 3000
+      path: /ping
+  livenessProbe:
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 1
+    failureThreshold: 3
+    successThreshold: 1
+    httpGet:
+      port: 3000
+      path: /ping
+  attestation_storage:
+    enabled: true
+    bucket: file:///var/run/attestations
+    persistence:
+      enabled: true
+      annotations: {}
+      storageClass: null
+      size: 5Gi
+      mountPath: /var/lib/mysql
+      subPath: ""
+      existingClaim: ""
+      accessModes:
+        - ReadWriteOnce
+  deploymentAnnotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/path: /metrics
+    prometheus.io/port: "2112"
+  resources: {}
+  extraArgs: []
+  serviceAccount:
+    create: true
+    name:
+    annotations: {}
+trillianLogServer:
+  enabled: true
+  replicaCount: 1
+  name: trillian-log-server
+  port: 8091
+  image:
+    repository: gcr.io/trillian-opensource-ci/log_server
+    pullPolicy: IfNotPresent
+    version: "df474653733c51ed91d60cf3efee69f7bf3199bd"
+  service:
+    type: ClusterIP
+    ports:
+      - name: 8091-tcp
+        port: 8091
+        protocol: TCP
+        targetPort: 8091
+      - name: 8090-tcp
+        port: 8090
+        protocol: TCP
+        targetPort: 8090
+  livenessProbe: {}
+  readinessProbe: {}
+  resources: {}
+  extraArgs: []
+  serviceAccount:
+    create: true
+    name:
+    annotations: {}
+trillianLogSigner:
+  enabled: true
+  replicaCount: 1
+  name: trillian-log-signer
+  image:
+    repository: gcr.io/trillian-opensource-ci/log_signer
+    pullPolicy: IfNotPresent
+    version: "df474653733c51ed91d60cf3efee69f7bf3199bd"
+  service:
+    type: ClusterIP
+    ports:
+      - name: 8092-tcp
+        port: 8092
+        protocol: TCP
+        targetPort: 8091
+  livenessProbe: {}
+  readinessProbe: {}
+  resources: {}
+  extraArgs: []
+  serviceAccount:
+    create: true
+    name:
+    annotations: {}
+# Force namespace of namespaced resources
+forceNamespace: null
diff --git a/watches.yaml b/watches.yaml
new file mode 100644
index 0000000..1d31fe4
--- /dev/null
+++ b/watches.yaml
@@ -0,0 +1,6 @@
+# Use the 'create api' subcommand to add watches to this file.
+- group: helm.sigstore.dev
+  version: v1alpha1
+  kind: Rekor
+  chart: helm-charts/rekor
+#+kubebuilder:scaffold:watch