openscap-utils-1.3.5-150400.9.8 >  A bw6p9|M(PcE3IPnH2$R B +\|+D5:&=/cZsGAprV>ſ 4}t8ޫ+;`Is>i^go 8܇m7(SM>ke+8[䡦XC(SΓ=i9 u0@ccB8X<=^Deo=n%^S04rm6xQru3HG%k+,q2085053d60f374d0f8fc8cdd063cd3e241383ff9f04aca26edebe3ce4176a9b91e2f578b4f38ef928c136792c7b3728271e5e7bcp4bw6p9|͇"YpWV\ m߷)˰^,wVp Iy$w>#Wf7_54.ExI]YAH9DgMhf w˸& )ڧfX >NN6Y+Xts6f#^d`v,QJee/#qGFz_nZ<@y!g-B#csa_;`d:*7pڏ<߷wLU\@OH* >pF?d " 5 +19]   H  p     | L$Lf(829x2:2=>?@FGHIlXY\]^bcdefluvH wxy@zxCopenscap-utils1.3.5150400.9.8Openscap utilitiesThe openscap-utils package contains various utilities based on openscap library.bwibs-arm-3JSUSE Linux Enterprise 15SUSE LLC LGPL-2.1-or-laterhttps://www.suse.com/System/Monitoringhttps://www.open-scap.org/linuxaarch64 if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in oscap-scan.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in oscap-scan.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable oscap-scan.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop oscap-scan.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in oscap-scan.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart oscap-scan.service ) || : fi fiP ; /'Rˁ큤A큤`bw``bw```bwbw`bw`bw``````2a38a20b37795feb3d83ca971791742e3fdc3fa6a13cd9ee3b67d3f4561c201774300b53f0b923c923ac7c45c5fff823c4914dc98e79a4ba7cf6df6a99fd9854ed54695a9b70f513c554f01999f4a6a55ae2986154b9d26c4e05823c64ef80c073385d11262550a7b1c665991419b53cdb491208bc03b25e1b914f834c55a48c0b328389d2ffc3b2b8e782216a31d589d14c3d966b5d76e0079a5ffa87752d882431ef7ba3264c0c0ced4d2ce779544a3f34f7fa2192dd6404da922ccd6b444cbebdeeec653a40c114909265d5386a29f1e4afa71bcaa632bbaba01b21ff90db24c7db43e1a984f84bd67c986c9c28ec99963be13f3a6fbe2bc58291ef8377dc92372ceaa10c867c308439081dca611a93e2069078cf81aae562a6a5238dadd28b6080b26f7430a8688f761af93e373185f02c801452a6e2fac919d9fbc593efe8135d3ba56802f925980aa66cbffd7841bd10e92888a927bc058ae1bfea23d0de3ebe1fd0cd236487ebd6e476311cc700b53f2fabb20cd4da634bd94e9521c8f1090cfaa6dc15d52ce84af9ca759af21e153034213d4ca817ddf353c2b77c8dfbea23214a33fe3561603ea2db357b39b56904e61441f9d18af1e24450ca47dda55f5d40f06414dca02e2c1c70e750d9b1cffa18e9b038a27874813b6e70df610523e68e60c4b1d6986f3c8f2a2e1c9d07e383cab7b2a780147901e464751667ac8cff9f2bdfe3ede51307587361c2d9fc7c0f691b77e395a2e343b9bcf24ec5d01d832962fb3e4051d51724d9213cffe08c8884aefaa31d700cee7d9cee3fe2servicerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootopenscap-1.3.5-150400.9.8.src.rpmopenscap-utilsopenscap-utils(aarch-64)@ @ @@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/usr/bin/envcoreutilsdiffutilsfillupgrepld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libopenscap.so.25()(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)openscaprpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)systemdsystemdsystemdsystemd1.3.5-150400.9.83.0.4-14.6.0-14.0-15.2-14.14.3aaLaZaG``r`__/@_Q_w@^^{G^@^^]:\@\[@[[@[ @Z@Z1@Z1@ZZ@Z Z Y@X@XXoX2XW@V@V%@V`.V@Vf@UmUUF U#T@T}T|X@Ty@dcermak@suse.commeissner@suse.commeissner@suse.comsteven.kowalik@suse.comrfrohl@suse.comrfrohl@suse.comrfrohl@suse.commeissner@suse.commeissner@suse.commeissner@suse.comrfrohl@suse.commeissner@suse.comchristophe@krop.frmeissner@suse.commeissner@suse.commeissner@suse.comrfrohl@suse.comrfrohl@suse.combjorn.lie@gmail.comrfrohl@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comjengelh@inai.demeissner@suse.commeissner@suse.comrbrown@suse.commeissner@suse.commeissner@suse.commeissner@suse.comjengelh@inai.demeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comledest@gmail.com- Rename oscap-docker to oscap-containers and provide oscap-podman as well (Relates to jsc#SLE-12852)- openscap-docker-add-suse.patch: add SLES support oscap-docker (bsc#1179314)- ship python3 docker module always- Since upstream has moved to Python 3, switch the BuildRequires from python-devel to python3-devel.- Add definition for tumbleweed to openscap-opensuse-cpe.patch (boo#1186735)- add old patches - slightly renamed; cpe are needed (boo#1186735) * openscap-opensuse-cpe.patch * openscap-suse-cpe.patch- openscap 1.3.5 * New features - Made schematron-based validation enabled by default for validate command of oval and xccdf modules - Added SCAP 1.3 source data stream Schematron - Added XML Signature Validation - Added --enforce-signature option for eval, guide, and fix modules - Added entity support (OVAL/yamlfilecontent) - Allowed to clamp mtime to SOURCE_DATE_EPOCH - Added severity and role attributes - Added support for requires/conflicts elements of the Rule and Group (XCCDF) - Added Kubernetes remediation to HTML report * Maintenance, bug fix - Fixed CMake warnings - Made 'gpfs', 'proc' and 'sysfs' filesystems non-local - Fixed handling of '--arg=val'-styled common options - Documented used environment variables - Updated man page and help texts - Added --skip-validation option synonym for --skip-valid - Fixed behavior of StateType operator - Fixed some of the coverity warnings - Ignoring namespace in XPath expressions - Fixed how oval_probe_ext_eval checks absence of the response from the probe (obtrusive data warning) - Described SWID tags detection - Improved documentation about --stig-viewer option - File probe behaviour fixed (symlink traversal now behaves as defined by OVAL) - Fixed multiple segfaults and broken test in --stig-viewer feature - Added dpkg version comparison algorithm - Pluged some memory leaks - Fixed TestResult/benchmark/@href attribute - Fixed memory allocation - Fixed field names for cases where key selection section is followed by a set section (probes/yamfilecontent) - Changing hard coded libperl path in favor of FindPerlLibs method - Check local filesystems when using 'filepath' element - dropped, because not needed anymore: * 0001-Fix-memory-allocation.patch * openscap-new-suse.patch * openscap-leap-cpe-15.12.patch- 0001-Fix-memory-allocation.patch: fixed a crash during oscap oval eval- openscap-leap-cpe-15.12.patch: add CPE dict entries for openSUSE Leap 15.1 and 15.2- add dbus-1-devel buildrequires to enable systemd tests (bsc#1178301)- openscap 1.3.4 * New features - Add support for FreeBSD - Make use of HTTP header content-encoding: gzip if available - Improved yamlfilecontent: updated yaml-filter, extend the schema and probe to be able to work with a set of values in maps * Maintenance, bug fixes - A lot of memory leaks have been plugged - Refactored rpmverifyfile probe and fixed memory leak - Fixed SEGFAULT caused by recursive and circular dependencies between OVAL definitions - Fixed DOM representation of the profile platform - Test suit: better portability, more granularity in results, inclusion of memory-related tests - Compatibility with uClibc - Local and remote file system detection method was improved - Make the report a valid HTML5 document- openscap 1.3.3. Notable improvements in this release: - a Python script that can be used for CLI tailoring (autotailor) (thank you, Matěj Týč); - timezone for XCCDF TestResult start and end time (thank you, Jan Černý); - new yamlfilecontent independent probe (draft implementation), see the proposal https://github.com/OVAL-Community/OVAL/issues/91 for additional information. There are other changes as well, here is the list: - Introduced `urn:xccdf:fix:script:kubernetes` fix type in XCCDF; - Added ability to generate `machineconfig` fix; - Detect ambiguous scan target (utils/oscap-podman); - Fixed #170: The rpmverifyfile probe can't verify files from '/bin' directory; - The data system_info probe return for offline and online modes is consistent and actual; - Prevent crashes when complicated regexes are executed in textfilecontent58 probe; - Fixed #1512: Severity refinement lost in generated guide; - Fixed #1453: Pointer lost in Swig API; - Evaluation Characteristics of the XCCDF report are now consistent with OVAL entities; from system_info probe; - Fixed filepath pattern matching in offline mode in textfilecontent58 probe; - Fixed infinite recursion in systemdunitdependency probe; - Fixed the case when CMake couldn't find libacl or xattr.h. - dropped 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch: upstream- Add upstream patch to fix the scap-workbench build: * 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch- switch back to official release - openscap 1.3.2 - the test suite and build scripts were improved to support Debian 10 - offline mode has received some love with a set of dedicated tests and various fixes in OVAL probes; - the oscap-docker wrapper is no longer dependent on Atomic - Python binding are now more robust - HTML reports and guides, generated by the scanner, are now more accessible for non-visual rendering agents - Support of multi-check rules has been improved across the whole workflow There are other changes as well, here is the list: * New features - Offline mode support for environmentvariable58 probe - The oscap-docker wrapper is available without Atomic + Maintenance, bug fixes - Improved support of multi-check rules (report, remediations, console output) - Improved HTML report look and feel, including printed version - Less clutter in verbose mode output; some warnings and errors demoted to verbose mode levels - Probe rpmverifyfile uses and returns canonical paths - Improved a11y of HTML reports and guides - Fixes and improvements for SWIG Python bindings - #1403 fixed: Scanner would not apply remediation for multicheck rules (verbosity) - Fixed URL link mechanism for Red Hat Errata - New STIG Viewer URI: public.cyber.mil - Probe selinuxsecuritycontext would not check if SELinux is enabled - Scanner would provide information about unsupported OVAL objects - Added more tests for offline mode (probes, remediation) - #528 fixed: Eval SCE script when /tmp is in mode noexec - #1173, RHBZ#1603347 fixed: Double chdir/chroot in probe rpmverifypackage- temporary openscap 1.3.1 git snapshot - make it build with new RPM (bsc#1160720)- use distribution-release instead of dummy-release- openscap 1.3.1 - New features - Support for SCAP 1.3 Source Datastreams (evaluating, XML schemas, validation) - Introduced `oscap-podman` -- a tool for SCAP evaluation of Podman images and containers - Tailoring files are included in ARF result files - OVAL details are always shown in HTML report, users do not have to provide `--oval-results` on command line - HTML report displays OVAL test details also for OVAL tests included from other OVAL definitions using `extend_definition` - OVAL test IDs are shown in HTML report - Rule IDs are shown in HTML guide - Added `block_size` in Linux `partition_state` defined in OVAL 5.11.2 - Added `oscap_wrapper` that can be used to comfortably execute custom compiled oscap tool - Maintenance and bug fixes for a complete list please see https://github.com/OpenSCAP/openscap/releases/tag/1.3.1 - removed patches accepted upstream: rpmverifyfile_unittest.patch rpmverify_unittest.patch sysctl_unittest.patch test_probes_rpmverifypackage-disable-epoch-test.patch xinetd_probe.patch- obsolete removed packages: openscap-engine-sce and openscap-extra-probes- Drop gconf2-devel BuildRequires: It is not mandatory, so lets build without this obsolete package. - Add pkgconfig(glib-2.0) and pkgconfig(gobject-2.0) BuildRequires: They are also optional, but not obsolete, and previously pulled in via gconf2-devel dependency, so lets build support for them.- openscap-1.3.0 - New features - Introduced a virtual '(all)' profile selecting all rules - Verbose mode is a global option in all modules - Added Microsoft Windows CPEs - oscap-ssh can supply SSH options into an environment variable - Maintenance - Removed SEXP parser - Added Fedora 30 CPE - Fixed many Coverity defects (memory leaks etc.) - SCE builds are enabled by default - Moved many low-level functions out of public API - Removed unused and dead code - Updated manual pages - Numerous small fixes - xinetd_probe.patch: fix trailing whitespace in config - test_probes_rpmverifypackage-disable-epoch-test.patch: fix rpmverifypackage unit test - sysctl_unittest.patch: fix sysctl unit test - rpmverifyfile_unittest.patch: fix rpmverifyfile unit test - rpmverify_unittest.patch: fix rpmverify unit test - openscap-xattr.patch: removed, included by upstream- openscap-xattr.patch: build against new libattr- scap-yast2sec-xccdf.xml: remove platform cpe match, as it is impossible to match both opensuse and sles or official suse_linux_enterprise_server names at once. (bsc#1091040)- openscap-1.2.17 - New features - HTML Guide user experience improvements - New options in HTML report "Group By" menu - oscap-ssh supports --oval-results (issue #863) - Maintenance - Support comparing state record elements with item - Updated Bash completion - Make Bash role headers consistent with --help output - Fixed problems reported by Coverity (issue #909) - Fixed CVE schema to support 4 to 7 digits CVEs - Fix output of generated bash role missing fix message - Fix oscap-docker to clean up temporary image (RHBZ #1454637) - Fix Ansible remediations generation - Add a newline between ids in xccdf info (issue #968) - Fix unknown subtype handling in oval_subtype_parse (issue #986) - Outsourced the pthreads feature check and setup - Speed up in debug mode - Refactored the Python handling in build scripts - Prevent reading from host in offline mode (issue #1001) - Many probes use OWN offline mode - Improve offline mode logic in OVAL probes - Do not use chroot in system_info probe - Prevent a segfault in oscap_seterr on Solaris - Out of tree build is possible - Use chroot for RPM probes in offline mode - PEP8 accepts lines up to 99 characters - New configure parameter --with-oscap-temp-dir (issue #1016) - Fixed OVAL record elements namespace and SEXP conversion - Removed '\r' characters from help output (issue #1023) - Full Python 3 compatibility - Removed basic Python implementation of oval_probes.c - Added support for Travis CI and Sonar Cloud - Minor fixes inspired by Sonar Cloud - Added Fedora 29 CPE - New tests in upstream test suite (offline mode, Ansible, etc.)- openscap-new-suse.patch: handle SLE15 and openSUSE Leap 42.3 and 15.0 (bsc#1091040)- Replace old $RPM_* shell vars.- replace oscap-scan.init by oscap-scan.service, add a /usr/bin/oscap-scan helper tool for this. (bsc#1083115)- disable scap-as-rpm binary to avoid python2 dependency. (bsc#1082135)- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- openscap-productid-cvrf.patch: add a --productid selector for "oscap cvrf" as upstream does not detect the system yet. (might go away)- openscap-1.2.16 - New features - oscap can generate output that is compatible with STIG Viewer. - CVRF parsing and export has been implemented. - oscap info command has been expanded. - The AIX platform is supported. - Many documentation improvements. - Numerous other improvements of existing features. - Maintenance - Huge cross-platform improvements. - Memory leaks fixed (RHBZ#1485876). - SELinux fixes. - Many coverity fixes. - Numerous other bugfixes. - buildrequire procps-devel- openscap-1.2.15 / 25-08-2017 - New features - short profile names can be used instead of long IDs - new option --rule allows to evaluate only a single rule - new option --fix-type in "oscap xccdf generate fix" allows choosing remediation script type without typing long URL - "oscap info" shows profile titles - OVAL details in HTML report are easier to read - HTML report is smaller because unselected rules are removed - HTML report supports NIST 800-171 and CJIS - remediation scripts contain headers with useful information - remediation scripts report progress when they run - basic support for Oracle Linux (CPEs, runlevels) - remediation scripts can be generated from datastreams that contain multiple XCCDF benchmarks (issue #772) - basic support for OVAL 5.11.2 (only schemas, no features) - enabled offline RPM database in rpminfo probe (issue #778) - added Fedora 28 CPE - Maintenance - fixed oscap-docker with Docker >= 2.0 (issue #794) - fixed behavior of sysctl probe to be consistent with sysctl tool - fixed generating remediation scripts (issue #723, #773) - severity of tailored rules is not discarded (issue #739) - fixed errors in RPM probes initialization - oscap-docker shows all warnings reported by oscap (issue #713) - small improvements in verbose mode - standard C operations are used instead of custom OpenSCAP operations - fixed compiler warnings - fixed missing header files - fixed resource leaks (issue #715) - fixed pkgconfig file (RHBZ #1414777) - refactoring - documentation fixes and improvements- Remove line-trailing whitespace from last changelog entry. - Rename %soname to %sover to better reflect its use. - Replace unnecessary %__-type macro indirections.- openscap-1.2.14 / 21-03-2017 - New features - Detailed information about ARF files in 'oscap info' (issue #664) - XSLT template creating XCCDF files from OVAL files - Generating remediation scripts from ARF - Significant improvements of User Manual (issue #249, #513) - HTML report UX improvements (issue #601, #620, #622, #655) - Warnings are shown by default - Verbose mode is available in 'xccdf remediate' module (issue #520) - Added Fedora 26, Fedora 27 and OpenSUSE 42.2 CPEs (issue #698) - Support for Anaconda remediation in HTML report - Maintenance - Fixed CPE dictionary to identify RHEVH as RHEL7 (RHBZ #1420038) - Fixed systemd probes crashes inside containers (RHBZ #1431186, issue #700) - Added a warning on non-existing XCCDF Benchmarks (issue #614) - Fixed output on terminals with white background (RHBZ #1365911, issue #512) - Error handling in oscap-vm (RHBZ #1391754) - Fixed SCE stderr stalling (RHBZ #1420811) - Fixed Android OVAL schema (issue #279) - Fixed absolute filepath parsing in OVAL (RHBZ #1312831, #1312824) - Fixes based on Coverity scan report (issue #581, #634, #681) - Fixed duplicated error messages (issue #707) - Fixed XCCDF score calculation (issue #617) - Fixed segmentation faults in RPM probes (RHBZ #1414303, #1414312) - Fixed failing DataStream build if "@" is in filepath - Fixed missing header in result-oriented Ansible remediations - Memory leak and resource leak fixes (issue #635, #636) - New upstream tests - Many minor fixes and improvements- openscap-1.2.13 / 05-01-2017 - Maintenance - we always build system_info OVAL probe, fixed configure output accordingly - warn when the user requests to generate an ARF from XCCDF 1.1 - fixed a segfault when loading an OVAL file with invalid family attribute - added --thin-results CLI override to oscap xccdf eval - added --without-syschar CLI override to oscap xccdf eval - fixed a segfault when freeing xccdf_policy of the default profile - removed ARF schematron workaround when there are no applicable checks - fixed verbose output in oscap xccdf generate fix - do not filter fix by applicability when generating remediations from results - fixed memory leaks, resource leaks and other minor issues- openscap-1.2.12 / 21-11-2016 - New features - separated stdout and stderr in SCE results and HTML report - HTML reports contain [ref] links for rules and groups - Maintenance - fixed ARF errors reported by the SCAPval tool - fixed CVE parsing (issue #550) - fixed namespace of ARF vocabulary according to NIST SP800-126 errata - fixed exporting OVAL Windows namespaces - fixed injecting xccdf:check-content-ref references in ARF results - fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248) - fixed oscap-docker man page (RHBZ #1387166) - fixed memory leaks and resource leaks - small fixes and refactoring, test suite fixes- openscap-1.2.11 / 14-10-2016 - New features - huge speed-up of generating HTML reports and guides - support remote datastream components (issue #526) - support tailoring of external datastreams - various attributes of remediation scripts are now shown in HTML report (issue #541) - new option generating OVAL results without system characteristics - remediation scripts in HTML report are now collapsed - support for extracting Ansible playbooks - enabled fetching remote resources in OVAL module - added Wind River Linux CPE - Maintenance - updated jQuery and bootstrap libraries in HTML reports - extended, improved and updated user manual - fixed issues with proxy in oscap-docker (RHBZ #1351952) - fixed a bug in OVAL arithmetic function - fixed a segmentation fault (issue #529) - fixed results of XCCDF rules with @role="unscored" (issue #525) - fixed invalid characters in OVAL results (issue #468) - fixed a segmentation fault in tailoring (RHBZ #1367896) - updated SUSE 11 CPE - fixed many memory issues - large refactoring of datastream module - new tests in upstream test suite - various small fixes and improvements - openscap-1.2.10 / 29-06-2016 - New features - support --benchmark-id when running `oscap xccdf generate guide` - added CPE support for OpenSUSE 42.1 - Maintenance - oscap-docker fixed to be source compatible with both Python 2 and 3 - fixed offline mode in rpmverifypackage probe - fixed scanning of non-RHEL containers in oscap-docker (issue #427) - fixed regression in loading a datastream session (RHBZ #1250072) - fixed missing SCE results in XCCDF reports (issue #394) - fixed a segmentation fault (issue #370) - fix error message when OVAL generator element is missing (issue #345) - fixed failing rpminfo probe - fixed compilation on RHEL5 (issue #393) - new tests in upstream test suite - test suite is able to run on Fedora 24 - fixed remediation scripts appearance in HTML guides (issue #460) - fixed autoconf build - small fixes, refactoring, small documentation improvements- openscap 1.2.9 release - New features - oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths - enabled offline scanning in many probes - support for SCE in data streams - many improvements of verbose mode - verbose messages can be written on stderr - runlevel probe supports SUSE systems - new upstream tests - Maintenance - a lot of refactoring - fixes in various tests - OCILs are correctly placed in datastreams (issue #364) - oscap-vm can work with fusermount when guestunmount is not available - fixed oscap-docker HTTP communication issues (issue #304) - fixed oscap-docker tracebacks (issue #303, #317) - fixed container mounting in oscap-docker (issue #329) - added Fedora 25 CPE - only non-empty profiles are built (rhbz#1256879, rhbz#1302230) - fixed compiler errors on RHEL5 and SLES11 - fixed sorting of groups in HTML report (issue #342) - fixed version/@time and version/@update in XCCDF Benchmark - fixed CPE definitions to work also in offline mode - fixed sysctl probe (issue #258) - fixed manual page for oscap-ssh (rhbz#1299969) - updated user manuals and manual pages - updated .gitignore - dropped fix-missing-include.dif, not needed anymore- enable the SCE (script checking engine) packaged in "openscap-engine-sce" subpackage. - enable the CCE (Common Configuration Enumeration)- openscap 1.2.8 release - Maintenance - textfilecontent54_probe does not produce false positives on non-UTF files (rhbz #1285757) - fixed oscap-docker - small improvements in verbose mode - oscap info module shows information about tailoring files - fixed build with CCE (issue #264) - fixed XCCDF score computation (issue #272) - fixed segmentation fault in variable probe (issue #277) - fixed broken support for OVAL directives - fixed bash completion - plugged memory leaks - fixed fresh static analysis (coverity) findings - fixed shellcheck warnings - new tests - refactoring in datastream module - many small bugfixes and typo fixes- openscap 1.2.7 release - New features - OVAL 5.11.1 fully supported - oscap-vm - tool for offline scanning of virtual machines - verbose mode - added SLED, SLES and OpenSUSE CPE names - show profile description in HTML report and guide - group rules by PCI DSS identifier in HTML report - preliminary support for Ansible Playbooks within xccdf:fix - added "How to contribute" and "Versioning" documents - Maintenance - using bziped RHSA documents in oscap-docker - fixed errors of sysctl probe - fixed skip-valid option (issue #203) - fixed segmentation faults in SCE content reporting (issue #231) - fixed tracebacks of scap-as-rpm - fixed invalid memory reads in rpmverifyfile probe (issue #212) - updated README and user manual - many small bugfixes and new tests - openscap-new-inventory.patch: upstreamed - fix-missing-include.dif: refreshed, 1 hunk upstream- openscap-new-inventory.patch: find out the CPE ids of SUSE Linux Enterprise and openSUSE versions.- openscap 1.2.6 release - New features - introduced OpenSCAP user manual - improved OVAL 5.11.1 support - added OVAL 5.11.1 XSD schemas and schematrons - support for core/platform schema versions - support for check_existence attribute in state entities - support for CIM datetime format - amended behavior of mask attribute - added support for remote .xml.bz2 files (use with --fetch-remote-resources) - rewrote oscap-docker to python, deeper integration with Atomic Host - introduced CPE name for Fedora 24 to the internal dictionary - HTML report & guide - results can be grouped by according to various aspects - printing supported (interactive elements are now hidden when printing) - table of content now shows only selected items (rule & groups) - references to RHSA are presented as links to website (rhbz#1243808) - Maintenance - scap-as-rpm can now build source rpm packages (srpms) (trac#469) - scap-as-rpm now supports python3 - refactored oval processing into oval_session structure - many smaller bugfixes and new tests - new openscap-docker subpackage- openscap-1.2.5 update - maintenance - smaller bugfixes - plugged memory leaks - fixed fresh static analysis (coverity) findings - fixed shellcheck warnings - fixes for Solaris platform- openscap-1.2.4 update - new features - OVAL 5.11 support 99.8% completed! - new symlink probe introduced - new process58 test capabilities - added possible_value support for external variables - added possible_restriction support for external variables - improved IP address comparisons - Added Scientific Linux CPEs - Added oscap-docker tool - Created man-page for oscap-ssh - HTML changes - improved visibility of selected XCCDF profile in guides and reports - render rule-result/message contents in reports - maintenance - Tests now pass on ppc64 little endian arch (rhbz#1215220) - partition probe now supports remount, bind and move mount options - Patched NIST OVAL-5.11 schemas to be backward compatible with OVAL-5.10 (rhbz#1220262) - fixed scap-as-rpm to work with vintage python (2.6) - better error reporting when a probe dies (i.e. due to OOM killer) - dropped selinux policy from upstream (rhbz#1209969) - fix segfault on invalid selectors (rhbz#1220944) - solaris support patches: file-system zones, systeminfo improvements - many smaller fixes and new tests- openscap-1.2.3 update - new features - oscap-ssh -- handy utility to run remote scan over ssh - glob_to_regexp OVAL function added - HTML changes - show rationale elements - show fixtext elements - show Benchmark's front-matter, description and notices - show warnings for Groups and Rules - improved handling of multiple fixes within a single Rule - scroll evaluation characteristic if they overflow - maintenance - OVAL 5.11 schema fixes - Coverity and memory leak fixes - skip transient files when traversing /proc (trac#457)- openscap-1.2.2 update - new features - OVAL 5.11 support turned on by default - included OVAL 5.11 schematron rules - DataStream can now contain OVAL 5.11 - `oscap ds sds-compose` now supports --skip-valid parameter - HTML report changes - Notably increased level of OVAL details - Table of contents is now generated for HTML guides - maitenance - rhbz#1182242, rhbz#1159289 - @var_check & @var_ref exporting - solaris build fixes - xccdf:fix/instance processing fixes - improved (none) epoch processing in rpm probe - environmentvariable58 now emits warning messages when appropriate - offline mode improvements - other bugfixes- openscap-1.2.1 update - API changes - 5.11 schemas updated (from RC1 to gold) - oscap_source_new_from_memory can take bzip2ed content - HTML report changes - severity bar is now reversed (left-to-right) - maintenance - rhbz#1165139 - fix probe cancelation - dozen of bugfixes- openscap-1.2.0 update - new features - native support of bzip2ed SCAP files (file extension needs to be '.xml.bz2') - improved performance on huge XML documents, especially DataStreams - minimized use of temp files to absolute minimum - added OVAL-5.11 release candidate schemas - API changes - overall 50 new symbols added to public API - introduced oscap_source abstraction for input files - further info: http://isimluk.livejournal.com/4859.html - all the parsers converted to use oscap_source abstraction - introduced ds_sds_session, high level API for playing with Source DataStreams - introduced cpe_session, abstraction to approach multiple CPE resources - introduced ds_rds_session, high level API for playing with Result DataStreams (ARF files) - deprecated dozens of API calls dependent on filepath - introduced API for waivers (xccdf:override) and modification of ARF - initial support for waivers in HTML Report - dozens of small improvements - maintenance - dozens of small fixes - dozens of memory leaks (whole test suite is now leak free) - updated gnulib - openscap-1.1.0-fix-bashisms.patch: upstreamed- openscap-1.1.1 update - Hint towards `oscap info` when profile is not found in oscap tool - HTML report changes: - Source OVAL results from ARF if available - Highlight notchecked rules, treat them as rules that need attention - HTML guide changes: - Variable Substitution improvements - Show benchmark title - Show info about selected profile - Avoid cdf12:notice, show only its contents - bugfixes: - improved handling of fqdn in XCCDF - memory leaks - static analysis fixes- fix bashism in oscap-scan.cron script - add patches: * openscap-1.1.0-fix-bashisms.patch/bin/sh/bin/sh/bin/sh/bin/shibs-arm-3 1651972528 1.3.5-150400.9.81.3.5-150400.9.8autotailoroscaposcap-chrootoscap-run-sce-scriptoscap-scanoscap-sshoscap-vmscap-as-rpmoscap-scan.servicercoscap-scanoscapopenscap-utilsoscap-scan.cronsysconfig.oscap-scanautotailor.8.gzoscap-chroot.8.gzoscap-ssh.8.gzoscap-vm.8.gzoscap.8.gzscap-as-rpm.8.gz/usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/bash-completion/completions//usr/share/doc/packages//usr/share/doc/packages/openscap-utils//usr/share/fillup-templates//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:SLE-15-SP4:GA/standard/86979a8260d59d0f3d47b6665501f0ec-openscapcpioxz5aarch64-suse-linux Python script, UTF-8 Unicode text executableELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=63c688df832dac5beeb06e9fec775a9746224871, for GNU/Linux 3.7.0, strippedBourne-Again shell script, ASCII text executablePython script, ASCII text executableASCII textASCII text, with very long linesdirectoryPOSIX shell script, ASCII text executabletroff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix)HTML document, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix) RR RR RRR R RRRRRRϗw#C&fԐqutf-805c7e258c5bc1fa8145858e76e5160a6487d3600c082358e60330ea3f7bae683?7zXZ !t/ ۃ] crv9xn{( Og`s-!rg|C/}!`Nt g- CI`z#s\[#FpC!FͼʰUE̼t5:g+-k,//HMaDjqG3yOR9Qq(+`q[ ^aFi#K|1_c>oaD?KY]WNC"Nr(=Db)osp@}ͯx7Í {eNăUi9}M_I qhR/c5 Ok)ɘ1s1~iBZ4wWe (+zIJcI7r wh̆ OU)Z%c _͋4M SX͹bWJC5A9 -î=c7l~7p-8e/mީ1.)m Ɍ7BB 'Ʀv%Jpb{Ym!fOi'|/Z\>/͘)P`g+^ҧ\p`eqV"`!-I)f㝀y#2G,8>Y-vvr=YyƇ5FgF|4 'j:9¬m3WŰFH _! dUoK y.,rdT'y[ު 8 `l:iف/@ca4=T A,PyP"TL@¢ {VpM4mhhNR!MYmr&c6 R*,[h=GЖ ͝!fGCsoH߳h{aYBH惓D=XXvi荭љw:XR\(BM{dD[M#Yg]*Z,acy.啹kmx`-p# q6E 꽪ãXC2'ӼBK1KoTHiN-i6ejǸ* QDhSB9|Q=b:]5yp7zi}=_E v)|[_˭'yYnZgh|lN3T1O˹Dž%VDS{'w߯ yԊ*̓!sDiX&`eGoc7}S0&/G9qvvS$kþ#ͨZV]G |ƿ|y l衤]lf℞`=w]icf4&%B0ߣuēzT>~ᔫ2Ԅs8#tX6\ g$ W~$8뜀Z8DvgC|$ Q&U8 'FQJ.N~Q+V0T^fru8ٹnjNWxiMT*yiћ "XfiM7aG=_z#xD~'^"rܫ ߸(.j͇q:ӼcIzL% 9l *σ0REN_ĔT F$ M$'_!X]M ڝVd#S3tfpol[cfV4O!w,;]*V R@*z`VIpgedž|%;eCDո;_B6a{+ey\˹;n(ھ&rClSc&2Aݬ!Xm9s?.Շ>1ΑF-byD49܋M:Xޘ Fxu/qmz!ZC<Jjn$Dƪs!k! }n%VJw,JrXSX+/~4gAz~Pw$u!k#eԇX ZT Lg MSۏqb TiPh`K^ftѧUr*A|W2ỐF 3lLnTqN |}$B+0L 1dA{kprR_ZG5j`ZoZ5t_^/&AqZG! WXͫ9Ѡq_@-E{{`˒1 ,Os->aPTwggl B׽vrRkL/V冟$TEJ}luas7<{Y/Xm;&EE"M,P8∿AW0jmzR2(bp<_q.qe񳒔dir v5֊dA䞹)͡=fK:~H] SEf 3]<}ǶׇlġSl a().?vt N, B9 3.Ӷ~7v os.UK diG@f7Lee< CZnjbilu<ÙPjḠP)ѱ"fɣoӺ/Zl,ڑ0|eaw6nMKa)P "B ^7奍W'[{ti/ۈ[R!ڻ|#%8 f;oaOZ)LȚϩJv()#g\D;ݰU\ SAP_@-4X Gj_Jrh-]Ix6W,^6rE;R4Ƃ7᥀V@ihDh Sb8Y@r.yKI !2KIaILk-9Df9` rC)'BݏKƁrY{[|Bx v3ө5uxQ$=wl)08OI1o2hYwRll 3>\欺,7vtbPm~^ӌ}TɛDנ-/W'@2s찀Uazڥ+Dj lVˁN$_#ت?3ǑC릆2 ѥ'Fݯ#1v^;"ڈ\՜ )gs1DjlȵMz{g2V mdj&_pM'Ubߗ1f +1,.DNdy~_E;bOkPLAV_n; ';cE%:ܧs[_{xk!l>ؕIu~gg%Ña&rΣMjZOthv~Lb"lCAi|h C%ߔJJgeWl(خ h$g0)`ӳuɃ󛨣+Hf:en㖗D!4^ nfMJ0ˮBבOhɓlݧ}2Lpzp: rWt p|E^$92JyEiYQR'ޜ;W8WcFCr7sj3 X@Yَ8po7Ў'ݎj] 6F?\jʱp'WnB"4kٲ6l8Jo5L}94P9:qiO)M3 Di9;PL+<wd)}+&۝9IޡH`CΉ}"+AR!٪O4#t7%ɮ&)a$R}Yq#ޒ>5# !_o@ ZwR4U ^Z׊bS펕ikyxULG# -|YO:le 8*A@+P]U秃 \ĐK0[5XlKo3{yD@m L;]8}{iD%1XԩQpirFZUrUw[Khi%x2J܃47YyZu8KX7:<*R4̶WU纟 o#ȴ%e߬a|Sئ,XnB`#19*I|W`)mC|NʼZ.lleњo"Y_Ul0$&-Rd Ȝʚ@N\G>˟5Bv:8O|!NDrH:8IpF:t+SyP-yq8lg 8WnT9(gdzfp"I:M抔 4n{„PQmNJ Ļ#/\fp+h3zߗvQP8г;Fɡė48Nzꪯ :Pr(K(m8eh*6/1 dʖl45 eNj{6I]:VahB]ACgD )g5N8F&ϼ*uzs汔CX(eFȨ7X9r">Oq.olUt[(pG?*?Mݕ+1W9R?񯒫شHXYTi@+ߝ2b~EX煩no[7]3[6y0Rc +)ϹN9H5P‡w5Rm3`rܬ{*Qix'#s{,N%nlZ$Գ}ZE/TǙtC'Y&khdwʰ9YGEܚ4Y]."L۴sOeD%g)rΌ Qく91n(tM4Llrps)z{i/}SV2ZZZÌ[- Ac+&:#yvuvacG!` t"WրHJr{xq3͐ѧ}'4 ~]ttKXH)R6@pʁӗw NڒH G.{ A=1iΫtc>9SIA2YI N@ٗY1O蝮<3Z!UyyEgvNT `#350[bd/\d6 5U3?O;G9?E89물yuf~kK^vOft\(@g]·d6FW<4Y*u,pF|&M2qѠƒp ec΂vTJ0g9P`noqt,>,2[ߌ)ƏZ0gM/GҜO63!aZGq`?)f(W>PEKa\7 5`9bve{// ;њqDY߳Q,?S)mGaU,]3p%ZƴާtW$ZOqҪlO$?i|Ƨx8q ϭ,S3JOu_$!FXD+~w#A< 7EX_.ntIhǁ=!#qS]wkZS_ A˾[ϖa2E $ "C9LZcv7gشyxzEFyWgM5$KtMV2ưn ZRڱsѻ9DNW9]hZۓpƽ6';4PHtGz-'B8邏][=bFr1$6R'nTaWfp~/Ч#9m>Y}+7/C`^&% ^S0;;Q `=ť"5ὠF"Y N^(i/leDpX炽z1CFc-*oX[+>mE󷚵NEc.2Jw!YW|霵7Ùq5cÚ$˿rνp(* #_?Ln뒬r-p0?sea<sc5&O~Yn ֨V<햨PBj 3Ǣ<9O q) YO9Dف\PsV0F5=W\!.&> >bɂϘd LȍI|-Z6ő@p W@CZMBὛ`pebdGq0/dd+鐸lҥd(Nڙ9uRՂQq:*jI\2 :Iثy 3!%1YQyЪ2;X'?\fi?ܝ&ͩ{LVXI5fGKuU67rEWd1_~ n(Y /Ze\bk,8@u#i# 3'kF13jPW`rQj'xa>Gjo#{ͬ[/Pm&1S_3~u  :n*7WN&SO1b^)fY&H{: {μ{l̾W)^`2-sOꎅ6tӕMsu3ZCߎD(+NC0<} ۻ`8=,Bɻ61֤z4>nt/Ij T*'b[ôD# ۸PIc򠲙{G66c?|mn pν,k+LFB92zZ%l)| BԔ'V5}7䁣N֗JA8R`Z?Gstj\ݑؔs}ޮQKKLʬ0@!@]*nI 7kS)"s->c&0OJݫgrĒ7 $B`uu H#`8\yP=5) mx$ ua +]i˅J=3G=T^Q/ݪyPҜ8"UVR~CafgJ M- Fe4K_L#Q39TO?×{kJpsfx.)W2gګ#fIْfޟ_Ϝ(C ~Naps2O̤G|hx0rV[cGGNKAv<:򹖧l *a{LӗS,]=-zt\*t\b *e 9ߖV@ʶ2=$c6Ba-7(Pdݖ.d5dL|7GO`n'CxstS^[Hʂa1DX|tCk)3ͥyQf5ƍmiw+aoC5Q߭2XG @:X .ϫ [~5`{|8O'R"4=cӨ1LJC51m;+?_W)wN`X"nֹu(, Y:&]kmY+n-:E#6FP u7lP`1k̯M)cƀeC?jXFRN' ܞ!thFnf/9ҡSWݰ8Cg/z lYdb p%1g>{xQW.*Sr"be3m {^k"wEzFaP /#Q332묊>NRK6:R֏`n+-+>Q:oU塏?PgA*ds >IW#:Ĭݘl? )nnǩ~@tׅٷ6 I(!=U{4]R€Ī3imӯA!17Ev{XHr^H!S|.1!U Xf'\1/u"w1ZeU-,C?mս [|KEk9rz nU"v,5{~WkVΩzmO"Er% c'y:(uh V+Ѯ~-)C rBҬh iVH}3#}&Xw*\hM}JVqqopwEyݒ9i],1fT;=FQ9$ ]S$rg+u#MGM")ŏlۺO\K +''xΰVk%3Jb6zݞa br5sKnk{;%xb)m1 U4$RY*= v+!= ayq'hkyZ%߈[Jjm2 \~!5) 'k5ECDa759< S:v xZa|Y%[JX %&q;lN9o(~}ubjX)%Qrp>5VmVĐ}CVEdsfNm$^dE1&x#uw1ZRe\Oc)JIE8IY:]Jgn~#Jymoo*ޡxq{$,VڬjA%gbJ`ShI?5hCSyW2oXvm U'eGB$tp#ZLsiE4Ml&pGADL0_$1N (?w$7̆mu)2{xHl-tc*#G0)IdÒj =OA]wU)|#(vW=2T}ZN}~eܖWͺ)y%O>[jff"ho:"oJK.ÿ: A8{Wnse k"/a{PMWN[D_4mnG{,^i5Q] C64{4ƦXڂT^i֤ٛy33 uAN3»M*vǻN߽(гCHSQw@ݍNNЊ e ) O1rxThhor'QR {W[}SqM(oǐ3sv$Gύ&4c ;&a~! M ]>+L i@.; B|iOdN7]?ƃe1Wq.J]eXDZpYgG MrG|G/cΡ:Xlt]氕8s^YHܺ`u_/ ˱)\I>f`aPk#6 D96ǐ 5ukv/.bK%_<4/]"j#'3$Ut㞂CKM*nԝJl5!J@ bRkaj/ m?qL m1Q[0 z̚56ҕJV0)A9r]k+CPbEBXryոz 9FU8,_ww{sۢh_M2˖XJKܛ$K?o\>8 )5`Lһ RHv4^5ecJ+߈a c2ݿ#Kg9b2c~qB*iG#rl">rVɪB7/VKYR],xQHtO|)o% ޠRi_^Kো^7y]Fpp(IM͚\hrFݸ+ψAC3T`~,YAz(Xs4HQ~x{u -0YjCfΣ`j6as8q^eŜ&( ۮ# ڶ 98J`xW#"0პ"lwPLQKb)N Vkb&p'Vs= xG`RgZƉ!̜vpom,>6 KQF[w+ |2@ddY>U| Nq.jNk;6W _<4Xt5YۄFv+\#PTj  $` xrU|4yN;'&"-IseEI?僙y_DX@;35G.-$}%~3 _2+rEЛU{-/aeʞi<1.t@GkL:~5Eia_lzjqɇ'doL O,p&$Ψ"MgqXްR>X::ց|úlI%%2O^e3=$n{xDVtf'rfT;>G{=.jɆ,iV[$՜-ӇGL<+{l;vv,Ah; !0 :Zs~ց-b-dz#9^{&67~~vz \6K!7mŧܢ,)  x׮a )RzOXZ.߰fuDpngy+X4Sb,{ ("#ąJ G ꦗҍdg;OGV,mޓQrT1 pȧE_Gw.%۸Np,Bf:R>ƒxR$vz:MF(zi9#7Y^,~ +&AL>[z:.?0( ކ}S2װH @q 0h~1}Bq$.xi]UXˉ%cdG}]1pzOx[;rm,Lhbj ;vQr B);+?^ LSr/2ek>կº}g˪rv Z>+`P/[ZZwS:[kvq@SPڈXa%x+aZC*'@Oy856T'^#Zp0Ns1Z6;IiDp&Y8]9 }:/#V[i%,ZIW;( emcaTmҠ0( W83, Q"<ׅZRV D9P CObꨀD8%K1 o{ ,"PAs! RO= A09) | n\,Iڀ6ח 2pjO.ۭ,N3a:1O*ùcسԗѢPE,Wd̡gʶnho:%F CI9N' 9ĴTС C)E-;JڀTaq&Ut Vh&^6Qjçᣡx\:(jIJ]hd7]Rf7^VBhIf?l"ƐUGKS0+5~fzO/c!희wGc,H<[ 6츂 Wm%YKF<4$(IZXm%5 m`ޅ9YtȆ N CR[ZPc97ϫ&hEA*$}(Tp5G̀Xe;c0xo6.HY:VPiS,OΪL:l:@XZX@XA!6a[.rG!%] Qi`+X Tkj"oN!6gEIQZJ?օR8s$>/̻h45\֐GʾR0.LݼE@Jx|? XlSP 2 r5G! = ~Ǹ3#%oEƽ V83ºlT,K]g|yj˖; \C6*}iAQOKPVevۇN[6F] $ v/Rv2Wz/]0'VĀ fz آ#L)r&70Lq?kwwʥbR,dxҏ'r-˨ơ~)N| )y,'^ZOwK-0> {퓴JHIisk<ӓ2E8뙒ӹ'PeNj,C?[,H*7t|;c_tȹZ&-/🁵E[r>:МJ\qZX g]PJ %ӄ9?gw{7"$M<$k3C-B2tCj'9>'[k:{sA?i=+nGyԦ7];$g`$}m7Dqog .[cxܢ5z{Tf (2:vDN;=$MLt_!m~5)XF1NY%3UXڨb#͍5y8q(j+)e8KW E@v➚(!zMhLfETA ٷʲc8T{p<}}P_d~Bz&$Q9Z}1ձkxX^²cK;|1 #7N  &X垻p*=db+bja¹UY晴I;)T80pg'e<<%qyNS2((lޜr\QdlյƳxCC(E;c47f8+i})Y`XgG[њ*%ͮ{/G'%Qq* ɿ^;Jzge>V ё+UZo2ꦻjôP\ehd`))Z:>,Lk3XF MӧT؁L{9*)(obf=`t HuA{ "K躕r[g,QYG$f}24aY㨕zI|HfѤI&Md~b]zQ|\ zͿ;ْb3i66 aMo`401WC<0XߨEIb} {^",io~ Hth D)wL*vE iUȞz9E%&v:q8CAt]K \SZ,%#\Wަ=IK%_j4 jP1 k6Ц%Eu-~Ϙ*De,B2\2~<`W2{U&5~E5}sR."cB|3 fꁗu7ůKz78}(A!F45&BoZRV8@+/zbKگPO (TNS;sQ 3 2ڮQ[{;T0_cM @tT`QR9PkPhxwM3.w) 62zxA0}}_E81d! /^rL6y=O Th8+N..! B|U%~c_#ZolB!5uk0QPQa/霟Ω8#cM/A`- 9kk8#8d)J#nuaOvO'6,ɓ/ThݍxkQ60kd7`2X@t`vwRo%Ay΄- sC Ro^S!Q%,_%jƠ^:tH ۱h|2j!3*(cѸhi5g^a%$>s2Dy48qt85ѩNwXWI ;daֶ\У~Hd Bfʮ.s1484;8EWjpY͑SD/TB~h+$C=U8R%zs* )%ӔG,[ݫCUl&JKͩ5Ixo19}jN*XPM] sLĶ4+ݙ:kIf@:E5ӃcaQF>^܀71WPN |˳d+رD< rNm䟘ˮi]ݧL])*gaOqV-a2q0>0 }-!qqv6%a Ubxc`W. ޢ)Z^mjb1&tvnŗA{,#f@ZCP֨5( ?q+VDY#^J14jYZ'0>1&MxEF=)qUbbOg,pW[Utٔ c~ӛ^)DI%`kc_EE~,*Hb_1)E]Vm$(Hxb)2 7zDuCX*'eW 6Y﵇ڎ Ҽk:6]wقT|}"D&ۊP2'./2ԍtc⻂.ѦҚQ,ڼ5+8͚ (lQ_i#~)#ų,E'g,D֭V avRkθ5/򪞳T 5?>Lr&E@9CTx1J-NS"%6ջ:Ԛҿ9sū}xSO;]%3uM\{ FAVp aUȸrx2&<ߏlqdj=K͕q 7ݢ,VGUD˰)R#|zc\/RqτQ #$ H kaX%MWX#ӶˆD5y;I>ʲUPZustvĢy2#o)q(#{4ZU r>^>s'I"΢TR<AQ1]>0hKqK fF量SguJ3Ԉ]~=G?Ӏ%l8 /4Ok選]Iޖ#D3\:`2VsپPaJ:?J=,xTBd`o[ϐ*KE>B[%_0.Ou"zo I*a蟈%VN@+[Ʉ9QJS`x&S* ]ܞ|f=.4>! '}l1iH(7lR| }{fXڌ0 ~Z4m_|HYx-XZӺZ9cb/0҃tPWCC#u5F$8F˼MI= 0_*^ exC+(NXkó*LH1"ܥo_t72؛";v9>1Xr\AM9YJIPØ pq'J!^!Ƃ~1~/i^tH+QʵO%euNoc}x>{ajS7߱umY.j; qbKCFs!Ʒ_ z8Ӥ;vӤ۝5eY,Sq S/.8WXCCk"v#%t7j͏ be2A+"-8[Xҳ^k#B:+n:*jU,)}۷>yxe] fz#/{TxHw52:{/t! <~'J۹[DqDEqKKU ^`(uHT8.oҗfN$01i 9i5/U[o9N2{esaUJ^(AU32ur{$0?B" `^ dw;gX 2&Lnzrĵ-l[&]( UYH0eq)w~O8?%E^ҳRx)=!@|E[ FiĨ{M55=J;D9(K3 djW*Rݯyl( gm[fu (0 !~[W]MclA2 z/3YO|uSgnV0_96;DxAmiokH5@~=Cfڦϣ;8ͤ$|s *>IBDX`qә'Twp,+&%x5DsGn$voX>vH@EK`ME{?x LL?@T{9-㤐|~sJiw["',a#5#()Bsc81'I7zA@Wҍsc 4RCNx-}dc 5Ϧ($g6darIك[Kӊ ^%I򨨎.8+/Y+6s|0Hm rU>,OыaYC$p#槈aS+ 'p)'+otҜ-Bԫ]q  9,ֳ,k`+LD;Ko|Ql?6VFҙ'!䩹@W -&9dt<3O=*S m@[{q^Ǩr_Vp*Hʮ;;6w4 p8: c?p'@hۀZY&__Tmke_9v]_AbNo[ V6)4MΊ4SyN"Hcmm[sQr,ށ<( O2ҁ9dQHɊ)ʃ(*Y͑p+h&})E qpR(0YLTgA]=rMkgr"隮}0pp>`SS"eG* 5^*MN1gؕm:xؽl>*ƗZq2o#ۑGKqZvސ 5#eyUC^|/Yxʼb pA_%3*+d:D3:o_#({[½4`3%:C'C&bTFU&an9#,!s5gKǠzY^+;T JJ;;aM/_gBͼ zO~ #12R&At04ǚ'"z"Ӎ2{xFn!PM; g2!~hP貭QR `gu͍n OnCT *m [kqx8a9W5Kx=2f=p2dHԎTȨ^`|08Чl_}7$f; ^ZLbY+ń!d #oͩf,|$Pޅ4"ch6w;xHq["*b/(͔H?%<`vj*BLK'?U~R@DrL1'WVqGKn)U$4Sz\8琘T58#sopN̼(Zd1(7όz\=3(J81v5)kn6Bi*Y^| ]=ˉѝIez{Y Cso;2~ dĂ叱bzW vZ,ӕS[1iSU%Vr@9->D,8Vf l'nX~ oX 10 2v? 6:FMG_B՜bJ5d>gA:VrS@4^5MZ},%X!R{i`xXң~8,x.R6Zrī]V6=QW]q{X9YwÐRi$FEFM)GϢOw[zØ=PhCXۋѻ?XqP8eE"ԃBy 3'c6`蛦`xҢ7F أBۀb['3MB!3I,z޵?cҶE^/X1U>.,,]_S?tKΗz oT4k?㷪'$oj͊mhZ_YD!Z[D0Ëp/Zs8F"JB!kJ3aHTP(I /V#iS?U#S]>j*Rhi6ޏH'gRXQ# \Hau V|>᳓-¾6~_ A&h!X,MJ)uy #uǡ]_aFfdҔ~ ]g-44KTv;:6kK p9({vϞ+}Ya蹀1:l/Q p]d.u+R1t$zC=K@^@l4zSB9?"yM~ nC,Xj A|鈿p\=5z>Ű.XA'4>w`FGl,dN f3_f`s3ؐI ;ghu(`_)cNb^cAe7}"y^Cxa^3"NVx)OpQ$%Fy$XXG]ޗUw#liqXbE'\ɅQ>?SO0\/Y8E=5"1ɖcFqV|uqw,35^)gǛ%❦Gqs9f(wa|.2oD" K 0rΛ}RPf~;">zOG:lGĭV]PBK9:%jZsѝoeh.;K|+* A/Vg*HS} (>B:=urMr !őq̖?Qow)ټ㿏FZ캢`"QF2k8Q ،hOm3xoTG˫ 6 N:M`.&tCr{ x<)i'c&@$3Y5F]' E'Df)g:供"4|\ {U79!XyewP9q1}cmNFPUQQKE| ;fPHDT¬IR'M3r.wܫ}YMiV+*@)bR̕1lN)F)>ċX ӻZ@T(>]g >%cţ Y#d!D1W}3x@S7뎠5 *V8.<` +O\C}2-C"wXI nqq@= .bwi܁$9640M# ONxWTj}9±"W?zh,h|Jjj@rF]Kh3f=3`H`K{͂V&Cۈ{ ;-p@a)f׫nuJwfq`+,K3=&1MYgXWQ>cʨR .J |ժ"Apx=!:Ӿ# Oij`dBSIc}qJB=#!F0v / U3dH?9$,IBՂ2q0mF,b>?{_q3eҏ8aqsj=NZ`YZ`Ja05m1.,I@yaiR,2,O{fz_O ]-lIAMDrA@Gn0t|nMF(gHMKr}<", ?!m!:D:z 3؛j "$t\Ì #.3U}!Il/L{CUT)}>@%겞 HD ƍ*gny ]Q~@ϬJ%:=hj?ba $\P_&'րp\tOXϗ MDŽ)ԱuM'xE>.E~W6#߬%,J}9)UFf@*2M9|ZßQ9?uY$yhÕ+bRev5ƔR!DbhpOCzlK 4!9}]uʏC%0n((6Vn>@ZE)Gc0Hp1^)?13?핆c ı0RM!L=dgV5_q {OOܲc=i 9bV2JRk6I$m%hmFEEzBvAzc>YN`)q4wQ~EfNhY'qmk>0OcfA@2r7Faw->ֆ20L䚃t+A jւhŲh. ow,2feXvc:Eӗ|,nXھmaHf+e0ǛLD`X*x!'})-ZbǼX3P9͡Zs-?t`s g,o lI}/oFbX<=a\zdc|EG@n) a l.a(I @gjLg͗"<@{lR!i]&B0SFѷڛѮxm{ )-&sۼ׬8b+VuLђ6 dlg[ *~K(zkЅ|{XM1Hwcr.}me/ӠvJNY{,;XuK?a6btC B{Q]B[ZAO!ŠVNc\ dI6ׅR^}^4@';ʑ$)!s,WW"ݦZ(.hq}zB=rz 3v<% 3ԣH 2HvR?YyNm:l;"|^w|jj]B̾j:%$ 'Ht(4yLCKJ/Ho~8^ߙ{I8C73^v 1wKnqZ Ȱ. 1!T!o.+jE52hibϨ/i<Y޳<@#MYu5ABmp*h\d?A3tQ3 pL\hӓɉ!QM*J &++j L>m}m[1 Mןk' ԠAѽa'SXDeER$7Y}KS\3^u+MN{ӘEu8$’Ƹm) Z=1m^/_ɽwGm2 ߥ4\+"E~W@V>'waط(k cI~Z_ tw&{\;D+XH7zt]Y@eiv}]JC-\**GqEi׵u[kX0\cU惦Wkw^l(; toF?[hjӤr}auYۢ+TPY#v6h0xDlj_][#dVR4;o{I3Lnvۅ 0jYcb -?^^ˆ+E)\TA[u|!j HYsFTWЊ5H:M0ު&IJ`Hj@~gmPYDL$ONCc{ w6ʼY\aKko~KH~#mM ڬ"(fLIk} ]~ 93-¾nxXE dd ݹPs x۳nA}@#4+FVIj#>RCM9w%v*7Сg F?8$b6rola>Ơ zR`/o_3L82,qWdo(arP*!1q&\5 7ϳ.6aX!NC+@FP 1Էb&gvbx c-vKPOc?i62'0{!S .{E~:7R|MR>;("U0YJ\ыǨ° EEHR0 nQRr*#?>՘j>D5XetN+ "[>2>"Gg-P+Jk'BISy94+=γ lE<~Z`lB l5-/(x a _HU\x3W"QyAӢqL!ewW!%k]B;ZchihxX+6`gQtd>"M3$)a䋸wYTϚEEf@:fս{dWw~o(CwİఉВK{O@N ij- έfJq82euLm]e T,DI3ۯfƃ[ $UxHuP[r80)֌GmvqF2ςbvu|Cs$eU|TGޫݎ5Oa;0T քnZAt޶̣ œzTA\4̅F~PFE ߍQ22WDT(dGݞoDn{RU3BGyEgp30ni$@8w 9x';y4zru{˅f6'SPƦLӯQV[ZX/`}myhj._=kF&ɕtD[&L)xw~J% R.B*pJQC5L3g|jˈ*`sEXlvt@Ix!PR9fW77w^%>Ͻ pTcVyO17]:Z" ,o&"i7ਂ-6-2f ~H;YZ 1<|MR {HN Aذ0e 1H̓@XhK p=s`οjw N3 h$rܴq?v{e&?r<0[H SU48z?Q+FTlek+}݉'b-zs+_`6\fsW #z#$G3Lt?ÓG\Rp̖Ivb "&D&=Wpޗ@y&H.[+F6ohHcQ{wsE.Њy, ܉dLHeEՃD((>BNNlh?~F+.,gRتtt:_fWtЊ\[^Qz{ś"z@, 7TzbB ӴdFf$#S(3r]r' L&G^'=\hj.6_^ n|k߫A| kG/v%&xZ >'^ErzMOVZ[iW2oXIǹXW+%a$SY |zcn*/%Uw3>V[j]N" XΆS1S∝0zO`CE{CP3tk-[rF~g{.p^ߧ׉N7N\NA>g^ MLZ'm9sFl10u:l>ò3g3n~ И(tA~ pΛ X=@72! EDT^",wL[yx]^XQyn%"1(̿hy(HYxwh߃4EPY&_O E[X~s UzucՁGpqЄ׿tL6/⩛Ӂ$2*RVYA^ l܏7"/M#Cbnt)Iģ4J-31!nty4|TZ$,9|6p{8}a0y62&6ȊmpjcCzDmuZN/XKr1~#n1N#ٹvdɩ87KPwJ 'EY њ\Wq"7sp sv)lbWw+W\u(pB6Wq 奛G]j[2bզEI3Bm}b1#̂%{ ~ַzйзrtp3JsL|'I݌ hKWx{ )^<M`[{ۗlT#tyBv4/85s$E!a\}qRs abf%s@l[iGg !0'K,rCAEЁL{fB5͆c"™UUY85Tƞ!j>)(ŧ2fƖ˻| 샙ܟ@NCWY"kIqEEP3J>&wD "Ah R*Gg,Fh'U[OyRXƫYe$mhʊn12:vy mTb2.~:M=J"aqa)R&pM23sWqYoe|}jܭ4XcaeΞdZ5q=C9#ӵK$fflЗx;Ӿ) B!1ry)9@mr7\o֕6;"N >$ǐ}*_[@߯a=!"MӔ"t3mIZҡ:ޜ~O Ix@Zžţ]<_+hv!C+DxNZU#~8T?3m#!qQlp`LUM.N!'{VϢapl%~3ZsY+"5,f4zp8PCWIF zorx#b+sIzw9JMi@o6k 㐲3O37/׈_4ղB5W%d & ءoL/z*P~G1rnpnn;̑vPӵkaq;Loe~ZT{-Qtڶ^7W/ PήCŪ2S69RVx"9Z5i;tLW.r/mHK%?FX5yX]uKA oyߴËD m[G˰ls +d ٮ䝊ח8tÐ,{| 1CPs+O %s˜J& 䳇zc+*I#C?toR@^7ѓ8wVp'&Nyljä^) +?-ϖߧO@BPM`?tȱ RSmtZ8v5Lj dzf-m!RԾ>O$s+527F:Zc*S<.x&ƪy%!Ƌ J.ݝ~ۧLĚyP&o*aeyrx,";F5m^diܚTMFL˻VDi<= !P~1+0+$*ުgҠҧUw1.TGXP+cɳb7x^v]ӹ%PXǺz}.^@ jj G9}f dϹnyLIps0MWKHieL֛ւJ`cW yP@{d$U̱2p+}idS{M0yt.\ %jiUo׌֥(0"+&KBNkWTE,S0}hVq,]iJ@ջ+GϽPy<71ZnXszxF TӭB뀯(ۦܩl2o _XAex>1wx2C0Gr|)P@@ *X {H8_i?Q^[1K8zyޏeGz q,WUV9o }f+ WN8#ʍܧm6dNut|7hHwI^E51ƝGmrއX cI?]:D 4^Vp!ܧ܅^4b+"SKKIVgw_>}ُLl"WiҖ&wrC4u_oVt19k9}ԟNם_$q!kq|^#I!qˁ?S<|SG7`V?Fԙ.k/YZ{~(vW$F:0n>hb9/0Jbj("^GKD`@Ws1f]_L 6 %gz$4^NWTQ~3J>{,qTom[r-aS*,DەU-@K$JR53&]BcaesԨc\\T^;W`8rHڧNi$>%PRڤ Bc䇊EXs_ |_V]QowOs]r 0tq7Ӗ;Gt+s Б% zM{;noqW67S] ?^ͥM 1_@6SW倉 /`lJf3Xpdmj1Y% s3d}{fD+Ij3q!<M<\M&[lUעPUU*O]!xi{VA2>%i)*A3n/4nׁ1N{:[R ~V8GFA!@c)'4U9H!?Urx߅ ;>^z @~ pO!|ќ)gX9D|vOޗg~-|i}s]UrsR@?LO*c֜-~7 6Ͷ^?7uq-j=@1셩wDLm UXT+-=x~x: *UjRN %gUpH_F_dRe>_>nouPs/؊G#K@rkWy44W%I%VD$u[ ȈAXg2x ޕu2Fhւ#C{0*xl?pIJ,<7W^]9aX'aL^hSci 8/ZJcs"- $6igeݰz]KOf/_E>Vroj"Z )uT^cr܇2xN߆ȑK@rhRgWܺ`Tpyooαd 0l+ J^M9'ć%1Ziҍ5 /.JRi@v/αMgfe}JY뾪$#s6ȑk>mċpG ur‘keX!M {p1q[|;in5 ޽ָB!]qWOk+)3\<J,ó>j{Pχu6l'#;:Xx,yzSvk T7T XKF^f چ;>hDjaǠZkFݻj6: b# Fu4hYfx4/{b< 4Q,0xI""zQ7K3'uECyI'+W/7j6~z[(.(&i6TVIC1Kۋ p_2[cxDI{9wFTds3=B̨Q&˭8?L FF؉/<ո5NJiDE+Q˞g3 uFgFrJsQ̹l qϸgU}YސJV*8%]|9"z(*V3ܹMY‚-"=1eQ |mt5ՉK+`ܮo6Q:+臦6Ml[ڋ4 XvYNW1)bwjrK9ar/R\C . QL=D be֖:Dnk_<1-dw*: |RUc*]e4X{^Ŵ0qN<6}@X8ж#Oa}*ckP߅3ᰠ]8O{^'ܚx=*3nřZa= mB&@oxpjP`Lh^_ҴP0U-@ltqWOf_އ;^P >D5#FBW 7󧰥^DT},oӝ;>C8m )Ø mk TwLvոͬd_`G: zWG? #VxJA5)me&~]A<ԼrP/tg .yb"co`{Ipk3L"Ҋ1v,ĻgZV"t$coݨWfZX[H*63\q7RoH|er2:F"![e^r8 Fo} W32w ܤ]T*ebHDXAI rͬ:$ɿh]S7i"tzE\c]5\@||Ă߽!{A4+\|v= ,S+vmSrpcZm񨜀hNF@ Ϊq~.n,޳18emCqq"}RLǛ$B`U;8 N D 3fC.~$u oX#F r',EW#19y8Y/Mb,$"l , {KY dqbwQL5rDތ0N̹۫PNzd>nn S1kf\LƓ4g.c oR0LUc{ބ}-봷,p EYalXX&4,76GzrkC 3 D}M&~EU Cs*w/x2`i͒wE\,lSwQy#~Rid6p)G@H|0K@w'0+OQѩ"HLNs;$;z 0b3W(~6Ui0ARmԚ8NƎp(\0ƔS]|K97 bJDU"ݣzc! 0)4O 82.O2(8%62ν'΃$ qmS; T f,I󜪣m*d8{g¾e KA|C&2F`H 3cZ#>ofWbhucnHh+XvO/44w a et HLm[2VPؽ0Gr|`zomr,Āo:)XCuݡZ8ˠ^KORtUKr262jf )Src=AmU19b(o0T?)`:&$V x3ÿQ ䷗LQfe1ɉ9 h;LַO<w~t5yuQC̯_6k0 ' ƀdĞhiR3n)8n/ tUλw:XMj};t/\ Co9GR^>g45T{5Jx+x`WRDQtT S+2@"PU(ɝ~~@,1" >U|Wb4PM[A:&(HY`4o4K#nƲ>X."Јǔd;,l9 ['a!T??%A1*j 3 C/dC<+b P*K6`6 VU^o/q2ѭV".j27|r_I!4C{˰DRhm8Ms42)svju:] 3Z$[Ԉ&ޔcJk 7.\ۣn*`ۊ o8%X N.Tş>A2)|wLɢiJ[PA`ubN@gD?␣:(QSG#Rq>IJ@^q;1y $]ej@]1~{W(]_%Ͳf ssK2v7To0 }=c:7&iEp)ёF³) 㼢b;'lZ< Txw-r¨tn7$b$gjP,/+C:)ϓIxH/nx*8e}'* B;ӄ&wQȖ?jnr㛔H&g^l$/Z*Sc>YYBW2MDKЮi샞6^xܥ)hZQkb2 ɁTT*Zrne94ݭ|V?_A^ilpJ(ꅬmԆ#̌m!L}h&@ vdR Ԗa?eVrQnUX)T >>pt87MnT_ a'iVLdDBj[FHrz?@ Pj6rKj9^SUڔ_آZ7I*6.i%R[k%Իe){Vj>R-,BUM倨ЇzL \7D!:"*X9hz|MoC'[fHFTڷa?l ڮIY}D tsK$봔ƛ/hɋ)P,I,Z-g8 lrϺg 撡J]Â_:&/- L:6z+y2h"QVW9v61T+k!9~Aml3HAQ DeF+*lg[NudXKL`a[y."ƎP/,f?+TIt)pl_չ7jdd% \A^R<ڹGpe2X{r84;N[1v4uwTW'æzIdͧ{Z˟w 4uyfQ=e&#˭Qj@:;Qz:r]]7xcƫxt7%hB ~ش0ac'a!7 gI֙IIT}˗A`b:X:gM &FWɈ*4hGEtI<v6UsNQArZEJ{5ۡ bhGJWҝo]u1zrC42z].F=칿gRU;,d{&@ja*t[d;1or >'JeacsKaQR3 6 )sϤ%3ORed/\o>.jۓ ~kui.S y3Mgz g ]ĨddRvx@.Uy6.@Q]TӺS(V-RcGn g?:搳);:O2-3eAf6am8me1?Ml5r9Uh T+V\Vw $b9*>&;B?5/@M6a/і}%J&ϤGgM%^fYe3?Ea=x+h37߇E lmN.'u8&   0iqA3-i&h&{W΀CLPMƮZGXN Pmt_F NLp@ZIi;[Sod]9kG=Ea@]Z\bS" T?[8?z9JxcSǫ|e?Dp%0iW¨;ҧJƈ `SQb^1ɵ]`C}rhB{Y0M)-prq AV^xzG.)у8F^>@W27\,0H,}6rhC^렇$k?Jia2UƲj:r!^T^U>a]d4 e_F /^}v|h.9#B( [:9(()r*|%7 ry{mFP#6  !d\ޭ=~w mar[Bj#@:eLn`[j?D篳lq"KZCh$A^u}_Έl]+}Φͳd@Ägg$uX^(Oĭ+OTNc _X9I3m!I ڳ(5G̍UOEGu4Dp3ũ{NfD'Ҽ|eG,R'@lno_*}#]}SܣgB_ʷ]D[CbsPw0.~t@5; d.h켩߂oMF^9w_9ZQ.z t,lJ52V~B+#2(DkB#2r4)DDB'!誫%P7=@֤v{2/Iy퐬f0=:وEJCjHNNG.O45 Lբt г<S2d}H1-N9歰x:Qw!J)ʢ9tTm RuL07x4m*Fb}C4ϟ 8Du1?nMLp{FƄ" .CXp0"q22y 4⓿F$}vZo|K(bHߊQ2k m$#?nn<@ikI|97:80W 8fICt  `31 Pky0jd 6B{tEdr7pxq# lƺ&T#w4Ͼx ;E(rtpcG:C{bxxH|ocO0Ѻ&ȺuP}L-x828ի0K,[IG4z I ]hY87M:/,[եj)NJ|˸УGMUQ ΫFc\''/cE2iq{Qu1% WEn] ysE-k#XG73.+5B4 Biw{XOv/"Kjj*uOF5Faa{AH 5gJ5A]΄$2<fAqP޺Kv}`+ _6$kI:sVx+a laHEȱ1E&83pg11V[cRP V"55չ`klP` aEVI-v> iz.jnj6 H,*FD32JM)~캴Rw&gIDl6Pf6&͂NJp):bJOw{bB39ò/m+z/< /r!xsK1?iaJڢ1v`U7AG _ٿ~2ꇣEël73OF+ nETl4eh4 9Fd4R*n00S' /eD2ͭ!rSVoPvEZMRLBF΁-ҰJ9]{)r0z Sdel+׌v[փLg 9@/FQޒkR=,KYTkjiE췽/r@˃`ؘJZ)DN\w9q`A׮Յz?!U\r СT*ʆZD{ŕg1305U{r2֌ :;[!8cPMꐀB||sP8f?YnegURUs;gD)y/ibE}T ު+#DM^Zhˆ:O@0S!W֝V}8 q@K;mĖvWc׈czE@)9_xjS-Au- 7<[jƒ1to]U>B'YW72Ӂލ+8V`xŅqQu;8yaWYHF[eT<Y8?C\5FWu)1i,Op:4T~6Gƨy"Qz֭/f?5VBpDKxg|p# f=p>Kd!x&^|܆fҋ:(wVlFТUsHX0=>x\5$l]$% a}Qo.B>AqZl7k&Ũx!ͅhu:E \E2pbYА✊Fj~k!:{SIg2?"%f'T\ň_@PFvq]7??(UڰuM!j"xFtU\oNUǍwPϕS ˟x"~n)f)DJ79d"" [ bJhC$=4eSMn5iB/筆F<XlPڽ݁E8;-ڜ-c" $\XrBW-TUs;VI8'§تym'4p|PWUFm`j f@q+ͽ`K|wVR>0?#s ɿq s{p}ocHdJnlɁA) 2BH1Te_$'%.;l=bW*QZH W_& c=PikXBJG}%Jy8^R&A*btS}d&x+T*=Ɨ K1e }Dv{iGTBT,1N>F Ј 'Tо5LMo:gvWy4Qkxjζ_a&2C,nc{V&ﱁ ۠m ^22G<7u&sYkjqrsrRU&:2C* ,߻,YHj*-.Oxi3&=q:tkfAy,\6^$*{{Th1۹wS3@_J2k!y#7+"Þ1ጊ$iU% N/=Bս(ob[%/+Й-C& 0WjhF(GXFRzQNcAޮ],fMٗFz!v* ?dɓ0+ 1LIe+6eQFr㑒 94B=d,ˁD~EZIBaEޑJ 1S \$A3 *[`?&!M []JQ%Fs$\['~'zt.DRf\uX&G悅u =z  y[ wu8@eo؜OY+h -A6ǭgh0\J-X"&NL+S)#n@?x<~8>{zH B/" )g!ɱZŽ̝1ʛ;dv[xQ<?4JW}pإOE׽񙇅E}$NAYg ujF}k{)Ek@m`jSFOZT 22aHWlB<#/s0TbBT%"-%& :4B3v-SQpx(K?_Ħ*o;nRI#1+C:*]0pN|}Uyϥ _ #TJ7)1MA6!@BT ?vj C{PJ:y4Q䑀kwT6 "`~n!0=Z^uFE|_'3dm1OW9!sv#m7+V\nrUDisʅ&O~cƜȈ&BK,lX'"l"V @5Vn6D)|Sjx|$tw3j,̲v#>VXS&)eh9bkZδ"Zp~v 6r`~@B:?/g套HDZC 1Q$sΦK 7.v'NjŅG3O}mhQ,|iR-:ɤA?fڸrWCrl/_vGw`i(gI9{9.gt;{䉠δjlNgO&|lJZoyi\AY峷zsXrmڔDK* gۙFUךS> T,TX4Cƥ ql>1TF(Wc[QMu:B8j-b:Qsݙu^(C<ưuz <6;|XwGu41M{Na&q7 [&`e5,w*ZWm p?||jj`( X/tW+"+82VdF.;&€q(F'gqK^߷ro8*7b5SE+q9t 1ikuӴi"?گrIe5#Q$csSYC5L9MDKlp 'VT 7ȆƀbU'K[BMNjoi/Xt|G3QFhDKS|N}ȵӜz9uP7>VYvBqx=T{c?}oA7HK.\G,ɕ+V4?BkeNqCH\,%Ʉb"@@\NQM=QϣC PXWmӛ5rt[$P  r!ɯ1R9, (u|QA4O{Q/nElZek(Cwŷ*^ 0|]GZ6"<m̺ǵH@J=d 6wmd7&`=-B^bJuZ|Ǹc!TVpx:|n7'v\ؔW#/$v}ȍe<'pKf㣌W </d {yH$Y\"x=ѿT.w{# xnr4| nn3kYTjV_'}"Gb`=_&Uo$8hFLȕփo`Ҵ; biБtoٌ)>*5VIg@7PDnf8; }D/r (8T=TiV c˚s&eZ)vb4tˉTήOWjF"5:1Rtk3W^~KM~(:QHq!xvU.GH-\k`gZ+HF 1Ft'wڲi>U?O)ԆA¦?M;}w8q˘.sjR{{ !`('C#z"']/O|z!9X*d3t]=f|ՐQ9)@G&4Ҕniy]PEӍ:ۉÛޅ%g9GN(uX?x${C5iT*&Ug@m{H )KM#D ar~5 ߗ5Q'~jMS8,z䁭~\b޻(^ Bd2x;Hkk6ZUP7/yz+M|[Z|ؽG%{]4@9ݬ. q©3!J++͏4=D{*;bDvuw2-ž bN)-0i F~Um?MkweJsdž0lU n 2HiQ%;:Kms1%K,ͥ~^_l. r:쪿\}`^z0'Z/O~v.Rшh_K_az̳!HjygLʝ>y-D[9;U]k d܅_~N3k+CW5D?=vꝻRV*Cr[(Bk)*ZG>;L]1 `{D.cHARN*xu9Z-C6 Lٴ%DWOOuJN֏|Gd~s y=@9LX*hx꧗ct?L4AwIVn-20? ЭP }#A]Hm`TXS рe,bg)ݦwGtvXz̉Υro Jnec{e6Xξ Qށmwպ` "hǜeE +aX|,hskjtp1n}K H>xe~PZoudE;+D޾ :d_ *AILWr|hwl܏]W=3[ݭ7RJ~Xr(D[Yieu'g=٢[(Cf!I*Y3sX {R4IJGKƅzp1Q 3/fȨsy6o.s ,amǫ97,;7((*mSY?YxCT0WD"dp*͖MvA@ 3+#Q?͑qI!g3`SYLcNCsɯXxy#7vڅ(LZDF :RV>-4jց%J[oC3jR3o@RO|ϵ̈́sQiASUkӒ [l`8czq@a=F)fqBMzM jJi;66eifpX A %f6FM*O-h/ky"*܃