samba-dsdb-modules-4.15.5+git.328.f1f29505d84-150400.1.44 >  A bxp9|zImbKlP *ze,Ċk>LL];/0֕Ue6OEH$x?ZDniW!J&~Y,*(f!L!?00x bQ* }&LDogkY`5Wݾy%gv&.cYdQ1VDOΎoac=ktH&L)&lIςՑϔSsrL 06b9afdaf9b705ab9db790cf148e2481afad575599ef8120522795833fc210d1d5b3970964183e7fc71a89a8f74d715256c6ca32Tbxp9|lL1fD5BƠؠӍY8j<_=yuctt|5n~pA\X?\Hd0 < N 7NT\-x- - ,- - M- |-0--(- rr(r()K8)T9-:='>)O@)WF)fG)|-H*0-I*-X+Y+\+l-], -^.b.c/d/e/f/l0u0-v0-wMp-xN$-yNDz[[[\\DCsamba-dsdb-modules4.15.5+git.328.f1f29505d84150400.1.44Samba LDB modulesThis package contains plugins which add Active Directory features to the LDB library.bxxinomavro4dSUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxppc64lerm -f /usr/lib64/ldb/samba ln -sf /usr/lib64/samba/ldb /usr/lib64/ldb2/modules/ldb/samba /sbin/ldconfigp @p @bxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbxbx645286364f50b6e0fad5b4c665daa87772fd7650785b98e9520561ebf823b0e7b1774530f4ecedca2ca7ead66e3156270332a817bef15891ca7ec79c2ee0b4f92f740fa379e864563bd7a71af1b5e894319aa38e31d6b15413610daf7bb444abc009ba1558722a9bfc36a04735a49568ae9792754e9d94c7ac45b6f20ddbd1798ac93bc96067909048ae0a4ae54e337ebc879f8cea52191f00179de21e2501b75b0ba65c96c8e7fa98a075c7c0322cfb5378846bac262d0d0cb482fb3d815a9e182c958290cf09de9f48382dfcd036887b63baf16b2ea1efe95fc1e09ab19ee4564da63a1d58f3adcb162545770e011fb9b0a3c60bad6f0da0c920c27add75936316530aaaae275b03db7bc2b8607df72d882e1be8320e3d689b405d29b4201fb8cb5784cd735ae1e7fc109da748b698c19dc9ab287acaf3df82af9b0c72fa7e42d88cf3aea212d1c3b25f3712f3c474097ab9262384c0d442f0194ae0c90a29aa84df9766aed1b34f4f90db543561b75f30e3daeeca21e664e78c9a267092d01165930c92ff10488759cb788f6a16892f8d50f17e8884c87b47347bca86d8ebcbc70bb962aebdb6067d3acf3f15624e9bde3386724047df1fb5eebee2d4d39c88c7653f1f55e4fea787ae2946a1af1d7167cdc66e3b9f0de9dd726e5bf138501e4df5bdcee46c36ad2bca52bd3fff3b59bf38aedcae9e83fff38b62ba89e73a3b79433072e8eb20bc146d9525f60d6bcdfd5ea4a88f0bc5c9e037eb8738bb362400cba2b27eea50effdd79005eb79867e861313ef5230fa7864b61f9da266263db526820a3cb068744119bddcf4df99f331bb3cc13d307a4de81da026ca9e2d583455b9aaa9c439b99d210ec6333e36bde9adaf3b02552a0bb2f298120d3e6fb915a123535fe0565181dbb742b823b86c3c331d36882572f498929e14168c2a3c0e80619768afa4fd4c9f40668d0d4d57f08cb7f79361cf7bd78caa9622f70b5a15b11b8bf40365123f88cf7e0c7cc621470f220fe9318fbb958ad4e82eded7ee44f1c51e44bbe6480bd617ffa555cbb9b22ee1702728bbf42772018c215c88bc51e6b68d8bcbd0fcea0ac6352b7433f1035f82f263339351c6c5a9d04cd05dc275f8cef3e333f7d3478504729ab5e2c09f838f1791cdeed653db58a0b88797db3efac10800d9c3a8d916711a2e7e03e85fc2742ccf8c3f480dabc6e4b946a3ae91780b9c944b7ce574576a0a71b8fbb413c099560f2298d59463235e1452f71025f143f95e900e901fd7da8a32dc959d41887e8a03273e7bcea08eed4a2a887d99f8e2251388acf74dcbf2b8fdb2ac40b762f4b76a60aa95e4d0731274c90c9a2897911340436ab603469db6891bfb0bd7ffe35091ef4a792377df682586147b13c84355afc1fb2ef858d27c02002f7d3cc4cc5999c5f06f36023a536359b8d697062ca268310e5660ca4d0f617e0a9f21ddb2ded5d9f4ac38820f73882a2ec4a54a09744ca7b6329cfd78e28cbb0bb891cb3e8f91dc3ebbe5c0dd370c7312ef5e4603de66ab558cd817fc3c0bd9e4921ab813b5164f39281909547b27ce78e49405eb7ebde32dd763ae7e3a2d7edd8de3a5c768552e5b617c80c202f2a0791c957efb4c75f6d641a3cf707e9f45c0fe4da113f595342a877e9b25e749b74fd013879e00ec955c1d94f630f6a150af2451ba7ec1bc6682a33574c6038d74f509d6f41c6dc7dcb6bbfe68892469b0c97718aed0681e95aace063fca693ed080ee3280cb13f0d1b3a64982a09ae06f4d2fa3e2e2545709f6b56069bf047bb70eb30e89a224c52aea7ae254e69881b8e16329acdb8df6c2baeb706876f9452aed13e96d3c742a3b09ce5055bc4146531f884e072f596977994a4b4cdb916d848f0f82c216ee048175b2aaf90db2d5f01c69617de16d110e3215a4f20ff6fb2f6f3716d443cfd438f7125a6cb7a239bd989163b7537cd4a3f2423724f0454acd2939747a8ee82c1cd4066f350322e698f252adabc330c174ddece046d843e92357rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootsamba-4.15.5+git.328.f1f29505d84-150400.1.44.src.rpmsamba-dsdb-modulessamba-dsdb-modules(ppc-64)@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/sh/sbin/ldconfig/sbin/ldconfig/sbin/ldconfiglibMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libcli-cldap-samba4.so()(64bit)libcli-cldap-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libcrypt.so.1()(64bit)libcrypt.so.1(XCRYPT_2.0)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdsdb-module-samba4.so()(64bit)libdsdb-module-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libevents-samba4.so()(64bit)libevents-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgpgme.so.11()(64bit)libgpgme.so.11(GPGME_1.0)(64bit)libgpgme.so.11(GPGME_1.1)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libldb.so.2()(64bit)libldb.so.2(LDB_0.9.10)(64bit)libldb.so.2(LDB_0.9.12)(64bit)libldb.so.2(LDB_0.9.15)(64bit)libldb.so.2(LDB_0.9.16)(64bit)libldb.so.2(LDB_0.9.19)(64bit)libldb.so.2(LDB_0.9.22)(64bit)libldb.so.2(LDB_0.9.23)(64bit)libldb.so.2(LDB_0.9.24)(64bit)libldb.so.2(LDB_1.1.0)(64bit)libldb.so.2(LDB_1.1.2)(64bit)libldb.so.2(LDB_1.1.30)(64bit)libldb.so.2(LDB_1.1.6)(64bit)libldb.so.2(LDB_1.2.0)(64bit)libldb.so.2(LDB_1.2.2)(64bit)libldb.so.2(LDB_2.0.5)(64bit)libldb2libldbsamba-samba4.so()(64bit)libldbsamba-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libndr.so.2()(64bit)libndr.so.2(NDR_0.0.1)(64bit)libndr.so.2(NDR_0.0.4)(64bit)libndr.so.2(NDR_0.0.8)(64bit)libndr.so.2(NDR_0.2.0)(64bit)libnetif-samba4.so()(64bit)libnetif-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libsmbpasswdparser-samba4.so()(64bit)libsmbpasswdparser-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb-wrap-samba4.so()(64bit)libtdb-wrap-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtdb.so.1(TDB_1.3.14)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtime-basic-samba4.so()(64bit)libtime-basic-samba4.so(SAMBA_4.15.5_GIT.328.F1F29505D84150400.1.44_SUSE_OS15.0_PPC64LE)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-ldb-ldap2.4.13.0.4-14.6.0-14.0-15.2-14.15.5+git.328.f1f29505d844.14.3a@a7a@aa@aA@a@@a@af@aUaTU@aLl@aHwa9@a`v@`a@`<@`@___i_@_|\@_{ _l@_i@_d@__ @^@^^2^2^^1^^Y^J@^2@^&^&]]]])]@]@]]@]nU]nU]i]e@]_@]J@]B@] #]:\ڭ\\@\@\ \N\e\e\}@\o@\\\\\4\ @[[@[[%@[@[ @[[t[#@[[Q@[Q@[\[[[{[z@[r@[ @[WZZZZZZ`@Z@Z@ZZ@ZZ}@Z'Z@ZOZ@Z ,@Z@YY@Yo@Yo@Yo@Y@Y3YYu@Yg`Yf@Y7Y7Y, @Y"X:@X:@XXsX@X9@X@X@Xg@X,XƉX@XYXe@XX@X@X@XWXAb@X-W Wv@W$W;Wu@W#WW W@W~D@Wj}W_WYZ@WYZ@W=W(W!@WW@V3V3VV'@VՄ@VՄ@VVIV@V`Vl@V@V@V<@V<@V@VjV]VI@VG"@VG"@VG"@VG"@V(V'~@V V7@VBUYU@U@UUAUĝU@UU@Uy@UUrUq@UhTU_@USanopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- Update to 4.15.3 * Recursive directory delete with veto files is broken in 4.15.0; (bso#14878); * A directory containing dangling symlinks cannot be deleted by SMB2 alone when they are the only entry in the directory; (bso#14879); * SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used uninitialized in rmdir_internals(); (bso#14892); * MaxQueryDuration not honoured in Samba AD DC LDAP; (bso#14694); * The CVE-2020-25717 username map [script] advice has undesired side effects for the local nt token; (bso#14901); (bsc#1192849); * User with multiple spaces (eg FredNurk) become un-deletable; (bso#14902); * Avoid storing NTTIME_THAW (-2) as value on disk; (bso#14127); * smbXsrv_client_global record validation leads to crash if existing record points at non-existing process; (bso#14882); * Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call; (bso#14890); * Samba process doesn't log to logfile; (bso#14897); * set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert; (bso#14907); * Kerberos authentication on standalone server in MIT realm broken; (bso#14922); * Segmentation fault when joining the domain; (bso#14923); * Support for ROLE_IPA_DC is incomplete; (bso#14903); * rpcclient cannot connect to ncacn_ip_tcp services anymore; (bso#14767); * winexe crashes since 4.15.0 after popt parsing; (bso#14893); * net ads status -P broken in a clustered environment; (bso#14908); * Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before smbd_smb2_ioctl_send; (bso#14788); * winbindd doesn't start when "allow trusted domains" is off; (bso#14899); * smbclient login without password using '-N' fails with NT_STATUS_INVALID_PARAMETER on Samba AD DC; (bso#14883); * A schannel client incorrectly detects a downgrade connecting to an AES only server; (bso#14912); * Possible null pointer dereference in winbind; (bso#14921); * Fix -k legacy option for client tools like smbclient, rpcclient, net, etc.; (bso#14846); * Add Debian 11 CI bootstrap support; (bso#14872); * Crash in recycle_unlink_internal(); (bso#14888);- Fix dependency problem upgrading from libndr0 to libndr2 and from libsamba-credentials0 to libsamba-credentials1; (bsc#1192684);- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899); - Update to 4.15.2 * CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication; (bso#12444); (bsc#1014440); * CVE-2020-25717: A user on the domain can become root on domain members; (bso#14556); (bsc#1192284); * CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC; (bso#14558); (bsc#1192246); * CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets; (bso#14561); (bsc#1192247); * CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid); (bso#14557); (bsc#1192505); * CVE-2020-25722: Samba AD DC did not do suffienct access and conformance checking of data stored; (bso#14564); (bsc#1192283); * CVE-2021-3738: Use after free in Samba AD DC RPC server; (bso#14468); (bsc#1192215); * CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability; (bso#14875); (bsc#1192214); - Update to 4.15.1 * vfs_shadow_copy2: core dump in make_relative_path; (bso#14682); * Log clutter from filename_convert_internal; (bso#14685); * MacOSX compilation fixes; (bso#14862); * rodc_rwdc test flaps; (bso#14868); * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal; (bso#14642); * Python ldb.msg_diff() memory handling failure; (bso#14836); * "in" operator on ldb.Message is case sensitive; (bso#14845); * Release LDB 2.4.1 for Samba 4.15.1; (bso#14848); * samldb_krbtgtnumber_available() looks for incorrect string; (bso#14854); * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED; (bso#14871); * Allow special chars like "@" in samAccountName when generating the salt; (bso#14874); * Correctly ignore comments in CTDB public addresses file; (bso#14826); * Fix transit path validation; (bso#12998); * Fix that child winbindd logs to log.winbindd instead of log.wb-; (bso#14852); * SMB3 cancel requests should only include the MID together with AsyncID when AES-128-GMAC is used; (bso#14855); * Prepare to operate with MIT krb5 >= 1.20; (bso#14870); * Heimdal prefers RC4 over AES for machine accounts; (bso#14864);- Enable samba-tool without ad dc.- Adjust spec to use pam macros; (bsc#1191046).- Adjust spec for size * allow some Recommends instead Requires to be configured for cifs-utils, samba-libs-python3 & samba-gpupdate; (bsc#1182847). * remove fam, undocumented and unneeded.- Add missing build dependency on bison when building with the embedded Heimdal Kerberos- Update to 4.15.0 * Removed SMB development dialects SMB2_22, SMB2_24 and SMB3_10 * VFS layer modernized. * Add the ability to set allow/deny lists for zone transfer clients in Bind DLZ plugin * Server multi-channel support no longer experimental * Improved command line user experience, unifying the options in different commands * Winbindd no longer scans trusted domains on startup and will use enterprise principals by default. * The net utility is now able to support the offline domain join feature * New options for 'samba-tool dns zoneoptions' for aging control and to mark old records as static or dynamic * DNS tombstones are now deleted as appropriate and use a consistent timestamp format * The 'samba-tool dns update' command validates and rejects now malformed IPv4 and IPv6 addresses * The 'samba-tool domain backup' command correctly takes out locks against concurrent modification during backup when using the LMDB backend * TruACL support has been removed * NIS support has been removed- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/sbin/ldconfigxinomavro 1652094409  !"#$%&'()*+,-4.15.5+git.328.f1f29505d84-150400.1.444.15.5+git.328.f1f29505d84-150400.1.44acl.soaclread.soanr.soaudit_log.socount_attrs.sodescriptor.sodirsync.sodns_notify.sodsdb_notification.soencrypted_secrets.soextended_dn_in.soextended_dn_out.soextended_dn_store.sogroup_audit_log.soinstancetype.solazy_commit.solinked_attributes.sonew_partition.soobjectclass.soobjectclass_attrs.soobjectguid.sooperational.sopaged_results.sopartition.sopassword_hash.soranged_results.sorepl_meta_data.soresolve_oids.sorootdse.sosamba3sam.sosamba3sid.sosamba_dsdb.sosamba_secrets.sosamldb.soschema_data.soschema_load.sosecrets_tdb_sync.soshow_deleted.sosubtree_delete.sosubtree_rename.sotombstone_reanimate.sounique_object_sids.soupdate_keytab.sovlv.sowins_ldb.so/usr/lib64/samba/ldb/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:SLE-15-SP4:GA/standard/ad59b5f0b76cde6393d70ef4aa779f24-sambacpioxz5ppc64le-suse-linux  !"#$%&'()*+,ELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=44374e9163d7c2b886279fcf387a4ecd71fbd7a6, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=0209fce85ebaa468c1db753422c89bbf3fa80ab2, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=7d27261f770b958aad9d54660a8eb8eb6f4e9f48, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=84d1fd9f089a519324e6bb9ae239fca67758e8d7, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=dbcb9489b8e5dd31e115110efd652a4b84d4f280, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=d92c324d8eccf026fdedd2c2f331135042fe65b3, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=0700fcef657af7d3eb1a03862eea4837e1a541e1, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=cb42f5662e90f24c833f02b0db21dbbc9eb3e8c9, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=dbe895f8642b300dc987324df063a6cdc350893a, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=4b3271a8472dd3fc3ec93ad9235af6e7e3e5966e, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=84989479f740cc3d99bb998beeb79b574fe32ed5, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=4bc5095fd313f0f3ec083a7d80247b0482ea7c6d, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=64fc1d1cee7c58b9abed84d161419fbaff7055c4, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=31ed80638438170e87e3c6a7fad958d03fcc8680, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=1ac5e1b9704bfa79a7ce4666a6d76cc29d1d3376, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=455ff6439629d50872643fcaaf6f948e5c05e38e, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=5664ddfbc0634e802e1b543e4f8d82369368416a, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=909a2c8e39615fcfdeb29b9e7898096e01db67c2, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=6e8bdc29dd350d34f0e21230a565771887dc0942, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=7743f6cff779834dea0f5844a0586ee8e9bae367, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=23657df2577d427953cbe6f1c9fc28950603a6a1, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=077f9634a1a85231d85fa33449ebc2e5ca7490ae, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=d031eeb581ffd5cc6540d77196bb50a008c04bf4, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=4ffe902db731a74b25d23e5f4be47845e17eb8a1, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=ef260082ce9d9e75309dee00307f9387be6abb4a, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=fb99e90e90073eed08968888378a705cbbd75fae, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=f5c541a7ce2d73ac8146221c0b75e2dea9d97244, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=e34a81fee7270e62f233b9dd6b198d714bde58b3, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=047284e627b9bedff2758aa3e033a04e17ee1fa9, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=a2bed1c4604faac3f5449ea8db5f834b3ffa9bcd, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=07308efcca4b570a79fa167302e11c2c28cf1b7f, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=b3a1d33254812899efaf147dcd7c8caa96d15695, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=d0efd524f1783d74fea0df7101dd27f3e5bb5b91, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=fd6dc26d7e19fdc030fdbb269204189b4b42ce32, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=c36b558a7c75e1a68256d4f25a0326c60e0aacec, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=59291a4878431ccd4e5265e4808ee33d6f48b0c8, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=801a051c3fd11b397e059bf8ae3faaa91324ba72, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=2ae71bf73a6488d2e0fb4e95c24c37cacb07d640, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=e5a7462da484d51127a1b70a9dc9a802e7612abf, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=4ffee8e32b37fa6235c78f7633cf403403d75743, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=55b90447409681d253c8ba032cc1c2c912e2f273, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=06d457b17f32f9123ad3aa29f6ccb9aeb4f7638a, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=e431f3f09d95c935aed7cd27f0c9d35877cad6d9, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=0b29a54f5f93f69517c103f6ca883656faf7b4fb, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, BuildID[sha1]=0cf4b199c91e434dda06c71f32c1ed12c2b841d7, stripped5A]l'07LWgu#.Ziv.:      5$ ,    RORSRRYR)R RR RBR[R3R-R+RRARZR;R=RXRNR`R*RRSRR@RR R"RKRaRYR-R+RRXRJRAR=RHR`R*R!RR[RRRR RaR-R+R%R$RYRRR=RJRRARRPR(RRRTRRZRXRNRRkR!R&RRHR#RR`R*RR RaR-R+R`RHR*RRKRURORSRQRR[R0R8R1R,R6R-R+RDRCRBRRARRTR=RJRPRXRZR;RRRNR`R*RRYR)7a;%OJ* )r/70\Ǻ+_⢢q\#Hqx~y ='~ch<"8f9,*w㞞(}β$B)$>\B |x [CR ;BﰡA(k764-[ )+Kc/.Ci,MoCL‡ gOj37o&YqL z7΂*7XYz-J7}YT!8XrI▌_w"D!(v&F_` ѥ?ЍaypP*?w)S4Xnlto|V>ܿ]KK؇^؎Lj 3M[GH }:ZUf3)i ;zR?(i_T_c2|!Qu4LTnȋexg+Ɗ>IˣSbET!8E6Vr~9@pAfUZxF(yBlY̮F:'nHw<|m6 g >7b`GI"?w/?+ӝcCb+lGin%m*/qIp+4ɔCE4%J:įo(<+1K>-pulZ\6*%$VA&\#q`bo &*u Ss%9$5WRd|5;֦>?;/DB-0[-)kmz@6&D"' uhV -e(g!k׭d rD49>Fϣ\χ`l%+j`QFGt 'a&8$D'g}LUX_)ktTt׊3@V z'ZޢCq2DBy@:Jb4o `tc}Z~ p`4f&Y7y0vFaN}܄U8mN#Y%~=1drY1- zgHe;;N*c5jSK 6)1;ԵcF*wȋnqmeF' D%")pQ=%a<=HonZpseO1#xm(4WSsxF_`KjoY\7 ;]YK3M'+jU\<ϒhbv,2nH)#ބ[U;L.\l3xw 5IonLlQP=y9\Tv> $SV^Dơ D󇷖5ly=E&u^G{d@RehHX>~ X&H2s1“\BҲ{둭C8A@e?ϋCJ fIk[bi~V@2_jT4Sut5v2(#5zl H*CZ'N!øZ=w]]e}kOltDtqU2 cpƄR |LFxY5)8-rQ!56R3@x Lcts^[T u~aB .\үz3WNvQ|*Zvxl<ǖ+؏dQ}GWB:Zb8bݺ\m[2Nca6~i~nr'ly]m]Bp?,s_|17-%(*M)J*:-IKCQq<lG:A3y$k9BeX@09<ɸeNvjDm,|:_^bμΰ!؜6:o4-ŁJ,Y2yIO#{U֜ ;\Gfjv{+6wg{S-&r4H@N. *+{BWs5,+ŪWmAKn n(7E^VH1^/['HaϮqr3 yb^kO6- ˑL;b%k)[q^]F"taafA[1gQRAbro)$ ~d}i&|c?wkq5i=oHkޭ<# {-8mܛ)05-;ӥ^`XJu4a.%=W`+/g9Tpb .R!ZKv#D+ DSiMC 1:,5ֿPkFެԶNf~<Ú8?zrW RkbKf)+VDzN_Y>!iS-.z,bQ 򴒓Sp?A*qM_,fq|jgsM@x=DGg ߒ{&(8$.gyqz{pيWYBF:IO] !+;ժ[ HX]A_$p/"7k\P!NVfs[l_|@XLRFY7nq '(AՀ` OTxu 87vDzܩ.,{=>i`VWLa7P1"ݹLX#oFdA,z.;]*iK'Ui^}'0\PvnR{O(hZz?bڌ=sidV$9J@ߗJ\Fƿ: Bهǃ&L]rEqbP4-Z{ER#!>?.:Y)u5]s6&sy)VPrtoRV`7X"Wz~F6a~ idϔLM|o ʥB >є.TB2F@l e?Ux Cb;-xf:BDgiHn`m;冨k,)!\rO[9z->h*]{J#dizuFދ4菠 Y8#gګI@nsFddeu3zEͶƚ@*6$dR~敍Y~ zj>h-l#ON@01D,mfm=\&ufsiGQ$Nv:PHIEgZnMnqkFBHIqV/ jLp c[S!YC~/1fBȿP#G {T$3kɧ _d*a3'gyJ% -vk;V*sؗ D륟,<Lb bKaoR2ch&3c:?'>&4>b"wp6GPX X=#Bn"GxQB 1 I $Ә}ZX>iP<FL3/_E[Sju!$(-1_SR'@Q<Р{N?a|Y tsQ&&r+5wh_Ǽ*Xjͩ-WlMǙa6:SK.ofUѵY!)o&im+GF;X1+'~9οׯA2n0E|T_ +o,3r1U:Sfc%t.&cG&ˠר«HKLW7L[t[Cz{k2'2lD 9㶧ĂqH6 P< !{[G4V[z+ l?$*@m;4Y—g ʡa3̧\_{Y)tzdY?o :٣YifܩfcWant="T-A1FY"uLH0!?t=@͇BMd ɔ^\ w7#){dՁ-<_/BrYQMȘ'BVI75a?QV=& FY]`εhr6ߤd״:#SFEbOڗYa"y:nƱz#>T$rⶡ"WAŶ)VU>ŻۍThs"&c8-8,c _YeRן(s~W_N̒xz9w)Q>%'P[}BPLخ7 <6ֻ9׬,8[%ɨX}xAr⟐1be+ BEZFzuOٺXob%;u9NnsUPLXSw(5TZ/c.V` ATM c9[D@kԂt\ M\h+ȕ$hGLprX-;м&-W2}jԨfIQKR~i{٬8.4 E 1$Z_`Y_Ѝ.) G I7(=cϭ3.<5 KOՌn1W%ȱ*X뿌d鶢h: {`u19.vH|ZW'/E%+0EH/$̆NJOV ec*@ނ;t}=5L~xjr6IXznn`*4ihI.ו9[m?hlAYr/մ5biipZW6VhIx /CTPKbj)ڜhsE=j@J6w,x-)9"nWL-$N=GV_9;{q$%+4V}ɠghQ8YjNlTj! O];WKZJYIgPCOqՀ{ :dSx+8R (=7dLJV`$%X< ѵBy+ %1֡1M^FȢO٧h}l}R'3]KP,!qt $ïGC r^ |W$=o O!0%P*8͓{ ܋cqf1cHwet.jvq24:y5]iB)j|r9r ~=9 Pamm1ԁt1'e̥KSp)־^)@;Ƈ,{QXEQn2c(1t(Ts?t;k! {0CC mYrU8[UI$z JcTքT FeX2 l'TkHgPUQ^yJ|2oNm.U) Xf!T MC[`~ߧ l:=mBq \Tl_t[_uPgՔb6Se[p݆Ѥ;mY΋%:u{t'qxa"s(]rI&j,ՍmNżd PazVrHh"'I꡿Ug, uQ'Krq&`!JH[NM a֌w#pY|V*"%: SmDЏ&n ?:>HKhxmx /}7ҴOYDID-:2A! I4Se)p vQQ Ƽ5Ӷ𓃉[VL͕ VKcG@ă@5*Y"jn(#[.0>ֱs~t/(Rک'!. -0jW|YtMRo^m+^)/P""Zgȋ/=,%=+Dds4ys9}(KځRSQtGZkp yIÜ&t.m{,-[ 9/eU6~`<9 aaOUP齄:;8;B8ϒËFXbrkbYimڋڒ92} r);^9e(Ӱt(f^7{yL'G@5^U;TfBKDs_E ؏t#gKi./ӫ" J8~aeŘĒFQ!%q\\` ð-IXٛA(8._Պ>LIu5_f8`^<p*qnVa=ײE0V%R Tp.BHf(4)Du b"6Avk.ho Bs/&_m\ślFN?i !O§`mqkpmuJZLdp{r=a}O~x' [uOLT pOM +||XCwkܳ}7KC/#MS:u+/b/0ƒ3#;)r.l{ɵAT{16$UK"|FHέ}PaO!"uor 8넰ĕz *n|K#9?:%U;Ypyi%4`|b7mEV`)W'QSl)ARo^)5#$6F9{ y&u/DLXGR ֔nPTc;(~&C+{!k t=L&u]ʜ%o}$U%<ꇅ_ЧUo1bnQc,01aRW*N7q0[`Mu,|h2oP+@qH`%>r@*`+E|9=)geѱ/G}یHy8xX))f>rd/FxpUhw[g-ܫiGd4C+q!ƭnL IGte ph19oyt EL2;tiyS^P9N0Ɯ .13,Rg4J40=+. ;i 6BcZ.(+Ä&^f["Oћԇ&qG E3$Ey Wq e`WY!'zSYi%i`9Rl(Nerd60s'/~XYw=A9RNZ#)/_AU'֑iZ{Ԕ>"\9 n{8E_nGSzνLGBA#-CnvhZ_Ϳw=4{@KS[q>u)w4$dbVzq,/gVnlA1Ō}骑ݙ+قyqHv63[ߋYQrWJQ*gN/dƲ$ 3dc`{0)}Зع_V5)ڒ#nQ"2~  ;FtG00V5q/i.73@d6ڴR|ϵq- mli*3d &MͶ~8"ZCh#uSl6 _S(7m{2xZ0}Pq wÇ!œ2., 8%wY˙98y eS%q6`RiO%/C,a3Sũ*Ac[Aqe$zs*{-|C \ҶDB {z0N !jvjڟ쉱ٷ yb+_2f@?Ǿ2{IhQA%Pai jn_AKÃF;K-ZE8+UG5jyf3|0pMxufBҴZ&.P(|M7C uiM7F[F JC13ʠsѱkU?udHcQ>Ezȷ^VUm-vT$zF4)6"Hx༎DRDb\2-eLNg&'#R|grO9_Z0 jJ%PjBn gdT1gEHBFȻ=h^ܛc:xBe5[U% pR"4paі.PoӝX用E0_m?%;!d2 [Wg p;и͵?<t7-"`7(t0wnۙF@]+ltPGCMf cz#E8meT<8 kN gY,?kCdj@YvlLRA(AkYrVN0ǭn9'csHYFS=quN(/[,W6jy#+AX^-̘.6oY yQedJdED/ \H±QQeI*P?Pł8 pn#a;z%姞M) l7V>p #L&qT <ŷ 3_ƌқ̬BXs-:byۼXCqыU+p4"w 9aFgMSQ%>KpTdBnU$,ävX1/o7|˽UdYYN=+Q-J45NF;V(Da׆j^ F}m+׻DB<x^Aj%_ґW HF[ TN뻮Hs9+ʂ̭`uen!10PŹ2(gvsד!&B# }q;B>; lDYX鮛]tAC*15=|`oף Wz\ ?ڏf:SETEӒSⳝĤj<=D+]c"8#BTLF09$J&$&>;GSjƋYyS?=.Фd}YRj~Z6rK'KmS#uiU{GduM<%U: lقQЅ?otE 7lܻWf$7ٕX ׁ:"9~)݃ؕ|-bn,iE`RY>A8zʓֆKԼ[k*1QgwP jC&ei{YU9dY7+}lMԁ{IN?J0-&z'!Ӑd\6_֋»!bR-/0)\yrp4N xY9=r w?goxYHX{Rdzaj-Ъ|Xۦ7,_\ N]xXI lW` +(ZQ,#3͜%4x$ 5'xCCP:Q,͔M޼ZQW:6SA<vTi< %)N Ys Pc$ 6A.n). AV;q&R{FaNriW+2Kx[e%Yt7;ۑ&5"Pk~uEq,zQ*8xo&NR|o5t͝p`ZDPFF(j;_ˀB(<$ot+Bڂő> ^5\41M&c$tn`prhv*}[d3ej**)Ey~qBqILqY1:sǂgӱhSp,;ISjLW}m?$NlWNf"Hk"~zїrK+G/@,Z.K ~)'^k*WuS> h3#{ YB_C1q$C&%^ K2(Tް?UR}rZ2."sH$ Dy˂`G2;Ǿ/vw"ץWz IixVV~Ei/Tj"R|(( sOHҿzMDz CQXtmhIU2 "t+V#*~|4 WIP܀߸B*B4q&GdMc~SgnRûju`R8Pfۭ%AB%wsA?"7+vՉ>W6C'jǖU$=Y)@ځ!|_xoK4Ж\?T™|"pb\6/X4JjUu4Ҏ+G-a}RCЮKQyIoP׍WjbUzθ'l5V;=I谠cq$ԃ Fr}%oYV>묐FC&!ҧ@KW6t!3 F++^OݽJ['@DF ɛX}Ok0:}wF{WXih)҆H;5)etQCÎϘm;l {WKE)˟Vf7Ik醳9i 6ʪ[;ywU kVĜNB9{EX +fAwThY;a>:ǗN0pjyGB>ТeV(rXˁ?\Dp%ЊRi|G@)t^VÃ+4D꒲ҡqȆ.}ne%즙6"ek(<6PUf Ί`Tus ~m&2,7a=2q훪uGxSq'VRNNNu?i aIHzT7,NQfOP -Ӌu:H ? m3O4v WzI,@^A:ѡu)7,gѐ;C@lLq=+~paUEb荍ΝC 7:9ШM'/ O6&YTZǘg[<夾l.Y9 M$;> Х-6̃Ot O3?$ Ò?4NTjJeCyxa_He(f5Iw;;lIղ/ȓ&b~C´ 89 2B[5P RqiVv.>$w}!zv%mқ26T/n^fI ?I-,ͽI^lQ2@暂U? HkgYY~&}'e0%3 W-L~Iʚu#lSj^b'׆rسjg7=3$G)s.!U[Yz}R;x@"1NQEEՇRW96H`(O}6fN2Le{(B+P3n/OGN?D y/?@K:~e>y"Bh6#T"j+51IJWjTr[B!}?ÍX?lR ߀M@lD~=xХN(笗@U6}L,JÝrhӪ_ڞLjTb<e;b2˃3ӗ=,k$0͖~܍QNt]MaGWIav :.r!aHwfƴjQet| ~2FV|=/P?}ԩa}{BCJ]"XUTz?Xd T .ud $?}F U4s4-=ōdd{1\Od)ː8Mn' *THsUտlOǧrj$B-7-"q)l&`"6DeKvHm&6kB%KܢT'sx}U°ˡ~< _1&U6,Vh*LΓծ4]e!XuekSc#4sG>{4c w"|0rEd="l{ؗ}Pkp*.nH~x}IܾȋG!(^*Vu&1Z"/ﬞ,"U."m 0ԅ꘸T／B^T qImx`0+q h elr"D.WIZ#g [lSkldU%wHKgOl;3*KeC51.W!JxZ(j—4)E"Ј8+/VP 1FGI~;,~W&E*13u(1SY}k(i3:ͱecc3\C}8$^ϡ=0 a$y)̓Gu?@n*]0>mRR[m;4b3B#X{,QA?{h)dzH#Ý/ ~]s/yzɿ5u] t ~9Pt"ZG\ Z'Y6>Fs$v+Gg{+AzC '̀^g dG<9;w⡪ zWuNRw.@HQg][}I߽iie*%q mU0݀t~{Z d F=NAܩ,DhOrxޡZw-G3O/>M5~FC`|AKRޚR _(#As{̞An#n'C 'OtKU uv hb㛶R.#R#W*yT~iٟd GfB[bYa2P*v(}j#fC/ozҏL)0JyW$IO0ICre-N߈s' ')|VTXC );'\yZ27GƘ3(pI4rۀb#TEm{>yԊ!ydFj~+;z jϮ,? #BX7DL1C9R2?:W_2#ebߌ K՗)\ Dv(V( RǞ)C XisrUEug#qfEm$ >a}Ta3r!Z7k^ב%WPg[m{4,|͚dHFg3][9{'%TdĚ^n>Yc,L CCwf6UF EH@웈jAZL T&e00MBGJX1Z_X=r`K"(1XD c?:Rmihj[ݨlХ:I#J4nՂ("0(a,KXB*O1 #$%6{3%6Q~{?gszRҲx:XcAP1]ximHF#ώhG5YE.ɸ\ߘHAAAM|5翅ojozƟ\t/ |iQNpwc6D6Z8A&.\Lc h{&.^j㉛6.z5Ilw2 z-9ӲnJ2aفR=F ")63c+uw{ȏfyVuɺ'D= V#)N-WsY#ᶕSnn8k &Z?.z/K_ў7<${1)굃U(Xwn?/^ @l>.QXS H 7ӐF AA=wv X6]b BT` R֮TzVg%R})[~SL“B5Dȅ~KqT%Yʁ[zCSZWcӃumO"E?^r{Z,klYS^r863=/f>dj_DdnWzq+'7nq @ EgSMǭ]xa55pZ-7#j^36 {,:]*O*~@F1lkz-ՇOkTW;f爦"} -o9ƃ.sZC3<}LeP+4%TГqwC*;PbUug@C5ftT",Z|;5`DS^$&Ê`URxen2dEvzoGue/wk\XG: > č9=X-^/[~ un fJ;f|(Ŝ{2$ ^crWϮ`%pHтrbtJuX7kg`(:Ňԋ0NL[d5ǿ2xh.6g,0sีfAJI&u3g>] ]mE.҄jm8ØBy j@I䶡Q07/>VȰ]̎@{{ł*qgRD!@95& ꦸuDn"ӛL~Az"szթISB:ne'AĀ>v-=Qb*k筒( ޛZñ;ȑwGT8ҸZV7OvdjXT}GXT3 6^;iX!au)>bM_T42lλXCx dՙ|.qin623eC:k n$G`5J<-z88i]dVrN-0UYfha%\1Rixi˥UsFr3м?猨?}}v:AQmBQ nl5~ḥBܦ\>p;-Z?cQ.vr%ueT#nrwFsD!co?n4ޝRYt[@=r I_~Y|kv|uX:-Ƣi=C+(~ڪpĕi+>,t*< dׇ֭ Y7P2n5bXMw0^2P &dd:В_ybc S,(&_/d_pb?ժV:dJ S7Tm!r֚gS=]ʺҾ:3n нA\n'u6g,UVڰUꦨ{j̔}O)-A+\̍#eo.*17wkBQUK|>yn Fz{@vWg F0ri ;iT ꟒DkirK|-vO)Azbzl; `%"(NT1*(}=]$Te{X+Z;<l)O69YiJedbU2Pul#|`Hla3MJ-!4/bg X#(R$>8U!Q;2%'OطL$|]1:T\~ p^$K-ӓ `5޿W[ OXo(s̷8\Ȼ6Z1n"՝y | v?wx*5Rg0u4!30ϛbaۓ9hn/y]Si+L6'un!)}P\T۩dM!;[5)qSF3oejF3UbOz/u6jr\4NT&a0r8*,Ɠ&- DC.:d, Z "ztj~ulٖb/S k 8O 9U׼nՇ<Cֲj}وMS$~AT{bB崾"|xl>2U6*X;cE7V^8eQ.Q.. Nks*N2)xzRW*Mx"G@c hYp@:V},\ԙ[$sz5EM߻Q|5W ~]]Za7+5Ie{4e-Y|W(3IlD&ʰ+KYr1us oZGIj£¾ש{-g-^]WHie-nv5|v}273NpM[_i x9l`DD>dzԏiVbep508lFOu8>+2@N.3R$VH1%k9R\وUT?b!" rvf?IGTE4+ɡu6"Y=+vp-<u-`}shD: XlI0z$K( xӽ5S G)'($R%(pp zͫ{z umx~o;qT-k1g0T@Y&BfDȄ;yޅ,A@UebׁsVD㭔ǔCً jGnQeAi IWn{@ kvϬj (֏99. ȇ U i@[l_E1{Cc"My!|_/OlHs?cšVm70Y-2C{udiCfAe:z`c1'[Fw;ܗ {{58M]ȥ}F''"O $̂0@mD7 ~Yhf2`QdC|RbY_S54ϣO?뀵ʌ U2o\ONzfnY˛1FmIk>;NH5: '{ ˱/kZv*x7bW$Vy-e=|†mk:R^'$8?,T;h]ח7tIu>XWlQAf#ǧ+'Q!Mπҩ.}VYjZ6}>F8]b%sU/y? Ke%_WƆ쵒s jߎ@jzLXC &aieXfZZyN[hs|YH5bϝ_m#5jX.OiT'pF+YVfv?@1( ƜrGzDϪ@Z:hc4u@a? SJK3(P_״Rf0ÂCxR&/cu&0 %q-b>fA| Z>呴,֬5@Ê<`b< sOƂ(0!9;u[."qh.xt-843#8#pbjIX 3̨D򉚉#}"(m+I 沢ރx5Iy#7nJVu$3v&V(2nM9P߄5GBs #o_ M k_tA[ FH 9) e&[o ؞|} jȜN0&-XO-[+J?4P~3dAԆø밍ME-n{,_k('t")зV51^a;/RHSHi kOMRllnʯdq7塶LHqȦ]jqSz>h xD* c'6xG-b.3'O J!]Tۂ9 ŐCq16i;{'z}+.~ns{lSTEE(0t I=[{?qh{N7i; 7n?)!wP T E'4C +%vg+>>ʄC:>׿<1"-N Jvw<1 (M>NDL_gc ;0 ƙ^^tݲb5p{jSœdS/3~#ـp=5Y\ 9ߎW&}\Yz4FlK!NT,'qޯ֦Zj!}Wٷ][`)tGo׷_mH]mVIh$qJm[dH}ej0gmdXK/H!*eGFR?;AM@Ʋ2yS7|dgڅRhS",+^]4oܤfXc6Ud(1"H't7r1.F~XH07rdA)Er˞z$, VM&jqmL#y!o!wRTy9>_9O-#um ٩YL<LlfP"'L.﹢[筲1 9W:9R'I{/l,<\S4K0f+;O~;{&'"!8򭓏1EfٍeuG*`EՐ:[M-i!QNpU:y)Hh#)eVL0Ӥz;eL:k%SJx^˨zE*p%~lF!4Qy$pNrI[T@QƎQ/Io.p> ?UvG>&|']~,7&]`-#/L_X(p`4y -X"ҳU {-;jL&@oS^|0\ׄyB3gQL97o۶]Yo+6eÙ]*"(CjVfLjH4|&i&9:7],ۭ2A jO}MmPʺYxZCx%)!S(Jcva~:l>gaBI=y8ll7zi7ԇzWg.f/ cnOlT3/3a 0 4~z!| q=gXeeDD! I+]\f',bmsZw*V .#s".:qvJ]|QvЅ:g2b !CkL_Ljt9TDgОr3v꒟leUI(\0V^O.5;eNf$J:ݕdW[჆g-*>m=S` GγvlWD3SmQyy<(?.6?Oon`?TΟ)9P1x]1X5+^wPu -ޜT23?cNk$"NgtTc,p5Oe@٫pyXI#k!:C =* !Dy^3Jew#ު90n'+ M,r+Q4 %$\t&bo_}bѽ3gύ.Ht[j 7qpuKxwʟ3X fW󮙪G)gfW=IZDgXO9)w)ߎAXA C.?QLO+o^%:A>`?d8~ѭ ow8k4&B8(*V׵KjSU1Wf8X lsC=-3= -Z4F]H P_J,۰s{Nɜ L0e@|+ht/rHbsO{'mK]p|ЮPMqM خ= P.ŰQ~EC ȁvYj1=f&,1E톰h@Ԣ7XLpuRBJP9kt>ER9^nq}Bl:z B ~|Sб彛5% l?۶C/^-{=Z&!$fvR]5WIJSK@qN`n6DžT%Vbl[W< clGmdK(!V j{St<JT\myc)b.Me~вQ[tٕkv7"˺Stϲ7R(\z]j}Jٵ@iNMva9a p42}1(_U46j1>>b$!܈sQf>8"Z@]/ws޺VZ4[U6z3H2B8D od"Po?(/m)n\S6+#{pUCXW\3|^w4֥G#S>:1؛{»DS$ጣ ֔j3M: A3ȿ*OǮ]Ȕ`~ w>MZH inQmBn\ߓhP`w߼~Wh[Yb'aLN/3K.Ϋ6i{^!f;{h/΂KPU^Y{FЙT[&y g{ɋ03  <2MukG)C)vBcfw3`6[d鼕pcXr-h:xK2zN]Ncog+?A%ʭSx"CM҈+- |P}[Ӱ3 *j+Xy Go~_jr|bXg"M9߬! /ƭp%fܜǸ\T8چClOq9'bm΋qއD|K4 /SvO &2cuoj)YVoޕG'X^Ga&I DbG)Ea \!{kdGb%K/:<6fg.Qiw3[o1z# Pl ѸP.!e o{\ܣ"C!p4mm4VHJDYI#@̮b̉e<|OŠb`ȬnPo0IEEӉ]xQ*xTt Ĩ '5c$: 2gt_"UFobvENBcF"oP`~e?xds$]*"QJu\+1 f낰 H۔Iע,'SPwbU쨒K(MG,3<#WnyZ@]o_Q#2٬4/K9i^(`WAZ7`;w+~'rFr#. DUtll{pMPN b)|).MV2VDvjZž@Y- p2Q+ROK}8֔~HE[kcEp(SE 5! VSI&91vzW+H8W7(QAYGFHJtͯ:(\rlNEGsXօG3Hfk ¶@k y<)=rsbռ?L&JDZb({ ` z/zÁ ø*tbS^MoW-?:V );&sj9,\ة%Âg -K7zFm%-mlqY.~5zmwߟ>C>3h:DWiE\p!1,})Ъn^\%ݢ䦅lyνR|Dɴr ^@ 㘫 j"HUmD(xSVh : R1ռ 7Փ5ZBǰЏx~(=h2LAirX5`vu_O>]67dGc[K:F%į7e٫nZg-ӥU7RQT D6kᛛ)@j -`:C'z8G/W8U |Xsfrnz؀>J>4.ڙWˊ'Hb,AѽջӶsT M&W_W3ɸ!XV쑹B&HSeS(oawW^ ,l0\$=pxrGrIhgJX "GgcuLoOb4SzU{8z5,"֏BFɈ#{3BQm(FkJg[{kKm 1E\Sq{YS g⸠.Y{gi$Bۼ F=$9`5S'̆Fd5eez!}f v$T?(܏)mSH]lV :tvn N W:܌}6eNH-3Xٳϗ'iRsK1~:5pywZ5ad(1˼ 2pvN/dIsڣў܁jU|& k9Ui1#UFuos'0xM_tbZ"ohpME,;%4]_j"V̻]a;<똹ĺ2͟ =%NvUYM!Gԛ\OQc  f>w03cF:2+؂'6SOIڮ8N14llPd#3?uQՉŠ@WIXV9j--PoQ +u?Q?pTvw8eSoh@ᤕG}.&>lMjH, su{C093mɟwmIabk#փaNgl,f Rm2/OlQLTJF@wsx1SUu#9=U{?دY!`I֑OU9OI/ŇHn\<0eHB/ y,S4kz`ǛoߦxEr('yA9Kf?ɄCTU, ȝ|xqFkP%6xXxgR_| !x~;OS7>,K]\xK. G)R'V@SG@aufm3f^0`#")1٤ߤдWP7ZpzSD }{ , *~7Pȃ̑Z_ag9WWe$xOEEޖyee;5<0OT#![M<7j%GnW $ dI⼖ Vn'E63^ǎlkP/5GYi>1ucֈt3֣`҉ܑn󽴫P kk/TdjG.F-w=YZ&eG(nG3O\^ϫ"b~))f:_Qr µ[tH#gߟ5֯ƺ1CAI.]eʏ#Csy̧Zu\i̧fԱv DgE+njGz$ k2B#~$D "6"!]LlZq=0jNB6e&|s8x(mfV8Ԭ >mxm֍鍰)%m}˛3 $;HIfE3Nxlnrt,ysA#?${<F Anw[El&?EKɲW̲=A&|f򸓃th2E&묏7 փ?|[!߶t/wALɾj~Nnz0/O3D2и Au0lKs )~ArQM8-ڰ K 9p*.3.͆AkմMC0߻: n{^ߨdRBjݹf"ߵ$ ԯE~XSC 0yn8 k5'LLg+/aG"'Z$$O7 9ⴂBD:L7Dw~#}1z+J0(cTJ@X?A;Ikx;qY[]>JhY/up`Fx-%;7r MdJoMĶ̈! Ҟ|KQ`eZzhS٦L`x]VztOsL̷Ab=S&^ɟ[E[*BRx!'o})ox̷=@mAkzG)5{[?ĻSt*qre:*lT `繋TJ eap=ήJ]ւ˹$^ XKe43^OJ*=7 =t|N2w,b/B ^JNY6 HM"|g]F}}/¯7Auf8k{jU@S Q ǩ )48nWF'&Za)Qf2C5IFz P[+tV0 Jh'pr}5KM4y\B-6R7tGo}񬑇kO4hi.u Qq@j1vqgY¤9C$_6c834ec+ke`$H*/WfJ`zY gx~( i$g|kíP|Ғq9Ox#c9dZ,xl{xriDOmg}stN΀^&65AMg: J`s,Xx]UXR%d oL- {~ ҍsȩqF<>I(e{sYD wu!@$Ps,dC@^xe4n P% `6O],͟Aw\5yw۫Dj1@oDjkfjK0K֗fRNwMx6a! pJ}gTh(*='`FA-P&!S')t 24_KU7LN7\5Tpb0ӷc@Fcߺ\=[U)Ĩ-9t`IϜA)&JzӖ\ߎbd{ qOGAWŏe9CΰXl-oם8&O3[Y|,zaNH)5do 䫧] 132ip 9AY "w1GjLr}0{b{ h!k Q1m]5e;L Y~?֯Sm9> FL_&z#`L}_2S]ߥ5+5T1~IIOgՌȺ"l_3}ɔNy@n,QbG+ӣ%#B( a"Ӑ2d;O!rGWcÃq$.4Z-t4E#&Amz`I;F-l#;Wה)[`P {}dtx_BVU.L-Qr&um4 d)+v71W z@bu%+@,XhL0r_*ܣ|ruc"PZ͗sӒ$i@{$ptfseBlyf `N88Z`ba #oR`GP;'sKH\B>7I.]@* .!k9șRh(d =]t,厏tqid>VMޖAdiJqY"!@>g|QCDNp|w|v-Px-cGrFsntLu=P=?hLHvr2J6[^b"T}vsdXvA.~VfX 7cOR's_IЂ` l0r$ހLAW ,*VuZ,#u1R#}6^wB~<1^݈pFɴ躉Q52O>%71|,#YYj>u9?[hcV=wߛ˪Z D|FZ A+m{^ 3s1#Ƚ u>I=üh%_L-u`4HVw&%]i[aծ A $arImqyRF4!7~`S y䄇4 8=i‹3barţHQK;gI. XS7>"8 R6Òd -"AeuW 1ߣ~jpb4D@OH̒fz(lfyPٞ{ܖߐc 75__\wٍ34eI`c.ZWK̤x5d4t\jD b0Xpj8.9EF*F`fS8n`Alڒ^X^2Z{;U-ˍwp$X m6Rffw+} nڈHPO˶nDO; `ydzn3M 'w0ngo/ܵ70qּ ^Z?$P\5PR KzG_!. f{S(6nX۩Q6 W%yqt9%\pjG~k#u}S]}\Bx#Gݵ GhPFM1"I%:WJ!It|$̖ {!}6hlU#a$JcfV3 IK# o:>WZf2qx )l1=iVC J\ dkhpwÊ*љ%_ fs Xv [Ls=dg :Lq[ .r?q>Jd &G`x-P9?DZ Rժ kaIE {[Ӊ_"/ZMp5CY[YCYm;z|[ʒ=ʡ]=$\OAV 1x> Z}>Ǎ<"8Ꭸ&xYRhk;|sxK'UIǏ/A= ݬ(+R,%ЭZu,)'TlsǥDPp'Ήz6\]bf.`;1(1^ cЯ5ևZ-g|}pqǙdzb͢fVD )#u糓GYt(̋M=#iwc#*r"F\ D)ng$p_grr=53xD9Ht%c,)~!٨./y=RGU6o*(x3"G YԟJDoa0"xP0yaq/vntkSeQFebqcnr. Y W=h\׹ gt^ZE/3r9N)9zÔ+՛Z۩V/*r`X{ݱ28t0Tph'mUu,gՍpy /,z`Y+pүaL`»-w*t\3|atika4K"$P ut2ߨtwq:n-ע'~]gEXh^aSPC#CꄢcBOr @nޙ6 Wj6`݄_ boШIiBQ6-Y\F,:vKb3!ϖNjƆ^E]~j6NzvV_+$VWGeJIF///A//lh >Ra:4w)I1ƽ2VTd3$H{뇤ZM?; r0Z05e *c/Ζ[|)Mb}Au-o>;A٭:KκeAUs2b!"i [)hD.>ZKo&j [Z<A`%FhC<@̹" 源uWuK#2GJyEAqޞ^Ϩ&^lwizлZqd84з!nc}v Gn;:2IV?E00+UW"D)JuD`ϙkC,gJ؉+:U.ǘ4P:(n_(Uil$/g >TV='C V-KxT&¹qJջ6G/ma1} 8K2,>UtSfNOolO j[c#`5rlz/1 #20iORR\A5h - /O遷s5lmKLv>5#Q,ɭmFwj,Q{^5nBh * {!/p)1>Zsɮ]iB,3)fJ9>TL“u.N8ږwmɝX~aBOͦ4TClX"Uf\~SוubکU7 DǼ93kHHi?JXʾmvRRK~OUO(x5-m^rh[ȾLzT0Xm*#.?ϿCPڿ/ۛzGGUچ(N(1nWE 25e;.ԌЍN?,0Wu!23@s;:#s& WCZDNVKhrn+.8[cfz`uYO @Jr=tŐ pϙ0ǿ6'ҕã $>wv`)uG؍Xs^bő]hpQȚ]'fC"#NSO5MbEŰtFdhz.PWLYͧDԋYE9h1Dr+9fلM1lXDH56*F0?[)n @c~⍦ +Pst3:Ho/jC@@$:iڨ60 dHץlγ]*I 4'^_/wf bBK$(j>jGBI8zq,Йm3@ˏxIcK\V\(G.0!YF9tF?&l{gVLR2IP\9k*BUB uL1&sk6Vp.\z'5pM,+9*,|y~KC/# $g($=vRr骓)~mR.8?b,5l֠MR0&lg5[[TE3z '52,\/@%ҚnB(2Q~<Ӥf(ǚeN8펬(ث]N^r[XbWކ/C A#G>Dvr_ED[A,A{9PmZUX_p E.Jh*|X\fm +^ԸJ7_^ طc5] ի82=qis@_w4]w_ @ku1|4SRW/odW4n7s(8WNaZSk_+*s 0-K1 ޔ VŸ;mW+YpX|:m!Pju,Oc[7K7:ۂ ǝhkHe v+2E,z3-+'wm¬oOD@^f8F͝53(V^L]\̑a}s"ڡ ԌL*eӅV^br?L=¿6N pX+f(9yt; q=35I׺# 6__mpg/$D;3 VDpҪ؄"F-:@ MoQ~5Dw5w8ZqgK#{8C8Փ# ec>rFLe @D=A0E<=4!(5 y?l*Oެ }aLMӝ3Sw<&.% {J3HLxLk|lǧ^iO5}h,8ٓa[Dc.I5~%C}ojZ{oUCx{Aɹ/?u!MQPaFq4 'J81$BIXIUPQߢOM,VK"zrYWjUW{YӪ윈S9eUMFZȮ㌆ :3C_s/8I8sTMM,>J6pҢ4L{3h㩔` Bӵpl占 smdK DM~ۄ+W|dN`5YUEտOSoUvd"0\zTH>s4vU8ѽƾɚH/F܀~-8gBt|+\ )MnV:2X /1 pc2l}_oK˖gE M>$Z_m!qe_ov)=S5C}ˀF6 \jy`<:}$*Bxu9I`u+Fe3wh_F fM_嬳 viQ;N?̝t*~cj3ڀ}(1/niMZT(rC3hէEcŽhɣyXJ?M_LD 3UכAy^=F;i4t_3Yw`?uE#= Pb}}fLbIc P rp)&VgF@8b/vS=| ?;i(AZRA(`(rew2;QDT"]s(]W.jpab~VQDO(Qhbռa3f#1գZ& cLVArʦ0e]@/Rtm3m=70?G閪^zvۇԶl7٥ee]C;/?)pw::x,9(!?,&Ta~|\i?U!vPA jZLf2ӗ|=3qgx7A2m٬t!`t?pr*.s&ͫvSIRFs͕A}OvIzepϾcW"sDCL:(جn?'lCjl8vle>< `fzAi@LVK4{]k@%*Ww*H?F"y}ww(A ?'Hƭ"cW^{Z┉Mg ߶p${7_Ӽ9=&)l!&l̩7'L~*UX> %γuASf%L2[i [ "9"dAɣdKeIH`&Bu]#60o UTWVYDr",Ǩv.P FG 7y,Z )F_XO5C;3 k#.ĿgFW60/Od<äSl'B]uS?=SݹRh? aq_75#3Sl$akbXL0%m5sww±wJ25 8[RaIցTChOmꡏ:wU|s53uIeʩ'>ܣd+2zGzG 1p UxL<-T k#*L-pNLZ`O>6w{?^ V\+[ZjqoZ!: >L wCrn/=tT'XDdYUwt -XK5Gw硳.1<4 ZSF>⬐/҂uZT1[\tyh"ABx)TG TýEZJв<:MsMp^)B@GHZC%˺TyuW`$4l)~z΁:GYqYdӯș(PVҦO:0(W3LzXz50ua'輘pM`eP b8 )4o !TK%WZ?c\Ǧ[ 3Ǐ)kך^xי,2DLAwU?do猠P豙ʎ8YU =ZVvfhi]Br_#m K"=$\NΔϟ12LnD@JXx@a C+4YagagyUoߖo:QBn*e# lW#5%͊^quԖ(i(o3&iiGgG6/Y0#<f0 @qז Ln{HH@L*yу,\۽~|l&C`Gvfk7s0%fTQ>IDkͯ]{n0K"7U'",EdOOyq5bӣjW+-VI)~v?-;uՋDA7YN̉^Lrp09?rG*I`SCAb׹de/{C`0KvZ HZC䐫lxNHֆCu1pѮyּ6"XiFRUp߶u`ƒmgNt':51_zDf[yɺY93O㝊#INu0~,'JA D23 XvQNAxi?ϫfTT֡ Ru*W%,ɰ E9n9OB΀x׆{UUz&,=GfS~/of(.+6 %2)y[}{?!=@jg}Em }1m'y+x;yz @^H?E[q-0}s4,C-1>D5wRdmvdO!MnKX]cU:^`X[{N|cɋLve+uXl-ɓ@8X cudOgqHRe@MBuĸ0e.}|Cuᣲ؅kQoV=O@=ɅKuC?l;Nf_3pw7O `/YY=h.np+q~B家ϸVᕳEb>VR+hO5k*ED $hP_5rfZBg3*qywl6%}ڴ|ZLj_J{>N1[u]0ug:VG>͊iB?D=eEBӷylnǐkR)jmi_ _]T`LeBe¶{;,"WLJPh@E1.ZH@ܶ65j`@ r]f@s_g `EDr; hC }[Q^Zs(ѩ X{ *Nq6ݺe9!􎈸9!uړBh,B{%YF}YT c_e#Zr5+/&ly>tDzZ`{bڑRF= Wi ԹfMr" y}mJZvNc@2,jiTY6jۭj#Tu.ᧈϳ` 5djj 빴ؽZ>QHV';{Ձi+Q$FgSZ-<1^ucT{`T{&Wϛ%otqIOրu?8qhGݴ7kW2 پqͱIω@Q,xf9pPfb.,~L4&gFp:) 489;4 mPKlڷ[5 =:Id;rR}oN=G3(uBq~h1,h ᢛŀ&%*6r2sqL@hR|䓑8}JY;L̶@Pd QG\޹EMώ5g\@Ñ*sE<~I':G?J-Bbf?Wnu БaY n2Avkx@#^PrxGIj&y'{$c|eΜ:eZ`n_i$>4΀ˠ =!hP<Vz2#lnKHCtc %}h!o26T?ܚ0'mC kSB-5\o$kt C1M\Ǹ{/L!IҩYiX{՝fӑOc"b3r) O /PO[CyuX,>:؂_>zy~fVћ0v#g$`pF63]|߲S4u#H<6"kFi #}+1S"'c.Ws"`Nzb^#Ԩ/Cc svLxkUʳrKlDLi3V̬Khr;K:$.G>tZYj]y/5+b~ ; ?9z'^.Ğz,4M׿s".oLҴ _OrdpZqwUм}Y[#a:|7.fc!E|N7^nk5or:K@NІ4kFSAV֓\VY*qkȑAj ׹_xS4 >CS)v̱V [ 2A͍ ũ>|cXnUI~y7?#r6Ge]qyޟwۃi7aOFRiCbۆx/q1^T*R1cd:ASmJ3cD@EC-.܈4?͕Wc)nX3YG9M ixGo$ހih|/h$⸬+7ϯŝEb{ 걖 OuKRb%q{!V#)&'1nƸ6NdsɣbsX*!g"xC= -uxsGHWόFR5aj˩&6`̗zyLe-+1~/1W!l}̨曯\ ?i$Kv 5nyD^6d{{N, `c/يn"QL+ / pϐ6]lPd Ԧbȥ+tx+9a& Jkح(G%jU]!"b%k0A%F:f%]7\eoI τ_@ɦhNA3ӝgDtEN޵)~U{ѓ7BǍnkiڢ\S,Mu}E! іa.GF}YDTd}A^CfcdIv9G kqWjc :}ƂݣG]7y]f$]^8Se^mڣK)+s0e} ^TMgͅە/lSa8pBmOtP|jRml_oop]xhRIS8!sbd%܄a*si!9fk@ѴX6ecu#g2a9+{F26K2Aq-|5,o2(jȥ~ QłP{Vexb^1rNR 藋 PCri{zxHdnwL yxCNi#8F o*605pħ6{NM H5$ٲmqVUVe(:9ܖ mqᧀJ^5| :B. 'ܰO !Bd%^vR_ߡ~$,1-l{ۘI>kQ!r "b}}y-?J]۶ł 4E1?O$rxh~)ђsS&jC__F;}6R+@Q |ogxe G``RD"/J֚)xoVS7(S\YNϟ,ᐜ<[;(gE|c[lo*if̤f;dTF>|X՝|oVg4}UWZ(!YhH('8-USç1SQ84%3op~X֝v4G @ۭM Ȧ5Ҵ@ml!O?R⋬{IR̮.f^6{!=_/#o%ͯH/WR-H QF7fbnNÓ.˧*耘6|-aG+<7*wʎN)}m?wOR^p0֥,YPWޤWxoF4~_׮EPO%u*F;B!V^bacenǙ'>1g>j*5&#kc/;~HPH1u hEU& K\,媒NfEiIrB}.ݬ(QP=l|C/\_Vɋ yG7A'2 _)%9F9gmmr? 2ks.C|˜oguEIp:"U; .[|0%Р`wV=+2v\0QV˚|:rCM>QAsXȪ#nށ6hpYT*RVTU&dؓl!=(Gvdek0WNjMDr؅>hwym6Xoo8,șA=e GNЯ҇§vsqIdfT/TӬU!YGVɬޗ=8n?]84ਠQ'֡0k"HJM]\@%M7y 9IE>妑Yi7{xa 3W"N7- J Q)L?= lBTioBl.X;CsL񋛪EZnezCDΛ7?*HFa'o3yj53oDJ>&v90H(dk]sf?0Ђ1a;ҏ~/d✹5/( ~7)cNmTBX'u}ed"VN2N\ \$q!q.g!X員a P\>_@9h0!x( ˡ6n|5iSnp {^6qeqet4>6\wDVI6h- 狔b?J[ݍXK G`Se[6t6/c \!RTř;RF*H4K|o?Ż&vb!4^%AAlgNz(48Qv@v2& ;ǰ'wW|[ Z6!dmJzpr:d>[l)"ZHSad.SZ09Cj75P,2dSV)){<3!NU=I0N~ 4I(KEkK}s6w C3!vE;-~~#-;ntT⺫=H1`,.ˠNȨw֥ԞIb;{(f+ 'c Q]5v@Jmz^n^rcHz^zR Br`a=W7 ?}U98ng zsZ<@S` CO8v7mo8@$hꩄ:@z0`RCc $4`@K664tg{i˟㺧dCchV>ⁿ5F7uX5?CLw̭6zd䙆u5l%9(Q#l%Ǟi&L 8Xk9{:O.z'd wc`BgHQɹs=!h!YIoaeNe\6F`[ms9+Åk^D6QEXZ]BO:!/n☌E铖颏;c4P̣029Xs ;^rOBWZTbs=ZJuTBta'<]Capf:)ģ(خQS_ '!et{O%N9{f>孜hxW LbԚ%>buA؛#-]H%[i9YAP{WC K(#br_|nu*BJ cuC$20ϳW㴩-֑8||fTϔԩ- $#-?#}7 @ez*x1$ Z0 ?6(]}TĤyRϺJD4u:詉ksQ3* /Qj˾n7\ J4;M;_*Av@Zy  P`x's\_wޕv rL\ /e}ؕwW$AOP_t.5I .:4f fnkmE`Zytփ:C)IwlWJo@WD]괁Kڇ;wV,> pr5˱{n'';;H;`z%:srQ BF1(t/W̰h3}k3춮{ƒng_ж"V27oUnq=-g"uݧWNm)5WF3NTn*hȦٷFlS`(E 6SHMm˗L,@an չ@4eqsU2=N)Uǧe0ݼ^Y="G -k9XV^e4% +&Aat4L~.R PPƠ Y$}'݀Zpf4sv擄26*엶9D]ʋ`(-nduPC\-(-ρVL~J,E_͢P 8;/dyDODW廠~=IBby%,V ۦKCQ 8jY1ay_ '!kj[h"|»nOCw*]ɓYU*FPousIev >ԘlͬdN] U>(RD},@84AZD+K1?=/F&N*&'_t-Kq-V4bьR 2+Qquq#IB8q/} kaQB0i #'RJJtǃ] ҃]iN@_qʫRpK A<0odopsMAcg6}E\j^N.TK~wcIj|7hG,Wg:[~|U,$7_}ظ)L qfcp S. *jT1\\_u9%`+ǍV^b]ʢcjC*&sqY&_u:I/?3V?X-6C]_% k$+շMO{x%tX\b \u:-WIho43AԎSU}^md֗N#3mB &8F*LVhsìP{Л`HnC|z&l/*YP˸V9(T6lkgA lNĒ&7C| ݕ` | S+1(8bRR,QFPG=1[ܝ0 8xbˎ3ʗj,e>g&QRqRGTi]"-s\s̺G- P2kDCaY!unzls!rXSGaİ KC~QGj-oa G}V۹zqr1>p]Cm/e :I&^T=]:;qE!sA30ycף3sw6PtaL|6O>Co9;..W|Nf1l6oTQ{'l+iIW1* vUgr )#7Q|W;x`F}bxO]8a:icN$[nkTq)sF! ݰCZO5̓ϯ>,0gga{ _'n\yfg@Q)TUO b۵1'K|'DAM'U"IexD+*ް.\]I$zԊUւ #1Bᗘ>,$ o[E$XD-pP09x+Pq8LcYԐf6Kt*܊e!XGfm}ﮊO=sUI;VqBoѽfEL yi<IK K)AG}jbE|c tjU+=̳s|l=ɗrRGh:GttԎtaU)8;*Y4/Qޛʾ{g/y~Kd#FUPX_MviAcTӂE0N08 Ȧ@ #U/uԐO<_(̏$Ŏ޺ڮx,5'=j|f"ڭ79[N.h]>j TeGbƒdAicYim8z+OJ|/yŴtd>ϟ9b !tRhFk|sY3{;^7X$ċ,vSH9<{E]@?NY@M; 3;~Wl]1HAu?kt< 5Wf}}|=n^/LDlN].]YZr8NtIdg2:/a0Qa$cs%ܼB9Y 58,p`ʯAU@tØ$$ qx,EQi[Fl  ~}I@J׭XxX`NJZ{bXd<|%b> '\;nGLME):=BLhжO6x3w],?&1$ M<.zڋlj92Ĉd{0ZnL]nh5;ۛ=h 96MoAFуay搔"N[J1N›@tc3 ]V|K-Np"[O?ۂ? c{&NcG1BYQ$n@$`JHm#[ 1JсA"yW$2 `Jj_Iعİۛ %UY3\1aeZ#)՘@.sçR]opQA%|3쪿Hs֜ޘ^r{?0#Eܧp3n^$|9tk-S)A="WMw cYwrέh\\ qNt>Izɓq&L |1'J8='qZ7]waBeVMi7B4rTH}h.NFZSk٬td>3O<Ǻ!0@6'*צsѩ;鍩grM:5p.j(kӳ;5jacrS/ |aSM{ xl^c-b;ú€xitGR:''LJޫM6e]ގTգ[e4ڗ5K9?X痓< jp^'杄}JǐzU?/ِ]?v[f7"RsΠ:!j]B]ZbJ!ȝ1E?a~)1!m3`4BG] 3u05odBP̈́/,V$RegA#-,k%J͌&3ubii喗m&W_;>Irt=C2#^*}ͶTȖ~;ڡws<~')/gvY!%=]-iT%Fwo~=HG9գ t}:kfbPHAv(qox+r!NJrK8<Ǧ_xZevεdx fI(T?.$5 <6{4 B6(wrzbcIc(KcJ[̽LJ3}WcU$2hqƌOjzB$=q>- 6*$0&Ev[OD{ZL#1Fwܽbf?<;Ks8!6|Z[S 2TFr7\NfEd%èRt'Tdk*#a+Bqݚ.JV4U, jh"iC@F*+3]xs)+z32 V6dN@g7E]re`xP~ۛx?c?3 "BLjh.w Lxm_إ. x:8WduX'H GaX^0G8WPZʣjի ä_<߆|+RKn& k*s},W<'FQ ],7JCF)bՍt ?VD/ Pgѓnlu/ | LԻ> o5.<߳)E݆o'\Ж&m'ݸ0P^\ 4[o'ULsҐR'@S ~9>Khp,$LuCm-fv N8KYƋEF% %=.?%[ֿěєx6&Dt,n8 =E`Х&w!hD*33*yxb91_ @wn)ŢDxF8 Xcf@M_G7BWr]Y@oeS;joE8]I: ]>\ 2F3r.)so U)<$B%}NKC~=Xr33 (.l~6:̻oXQmA>Ieġ ldfGy]y/m|e9@Xx8{s)KEZ;)T HtʊԢ ;Jꊁ ]܈ dFg($F:Wz#e{w%18fqa|Nҵ+ s8:9RĴxXUMQg~y1epy9< Yz,_l^qm>|_Kk!tֻo0)' 2`ջ/GhxlY=3d1W(^懋gj|b^o}&8]Mm( lOf I4V߅n K*&0p I) Ip﫲Q~ ۈB"xD'G=Q{.ii$P/: "W 4` t|)ޗRK0hP}%Y?gGy /OZo+Wi:+6҈^/Ȕ;N\Ԧa^J՗V6~HWHm`+1!nF@sȉTxreYewp=i/"l-uXb̬c) /oPݽР4 R/XMckzT2ED|90&ƈEVb{: ns0 ۂUO yC5TNmzI0OG 9*DCIZ}(POB78(^حa&)n x&ҹ94_S?VՒ^k 04Qeg}ß1d6IKS#ȔVix G >$-Իf >֚VFm ̊zr/ _HL SiI8 LcGűJlF-HFFb옠; 1u _d@/~l gD P9?GFwNtr{ߖDRJdU,/[lm88@05̨?Xdo#_%CʛNWOw4߂B5 6? HB$MV|p FzB,7x6A 9BszUϑ\㜃E{2R{̎rA]TѡD8$U[Z"%b)Wl2lcqŻ;\L~TɞM%SV< 'E"#Ph#6ъѥݣNRmXL)PR:oT5.w*].YO7<{ Y팖.[n/d-I.3-k /1.L-|`l%vn? NxW{W'Qt|jҚo~~-7dT噖JqTjbQYH)3i:]ܢSBɿy~\"4)mZծ’A%<ޯ yeO٧`]Gi(b7'%a>-i܅<_-mc0l-DX=6:{"£e %B D*px (v!hu!m͓%)w̫RѴrE8Itu--c Isn \R=Dw7Q4 r_ڊCuLC[9_:LDk SF \Y9Gb/ Q'FH=rPcZYpLƄL+ACCrqI.cRäoq%+7@I:#5^%sw{xRPNڈM&4P=F^#Abt&^NRÊgYڎ8N!Wl=W'/u LczmR^䕬WK'O`M'&aMHc MA@hծM)XʋF6kNsJ]d&[ 4*?Pmx?t) 7MD C*S-h`):XU[[ǩа#ˇK{Kʪt(j-{e,$J=Ak6LQV<f?vsPEs=:vSn{Q]q9тUݘYB|. f8lРuPE?x$-$ºxq>쪉;lYl]ܹÉ=[9f'sR r/9y-R3zI/gC8b߱ F.>}]Cb~d7R: ,l9}5Sq&cĭ4$Ow2:öHA:ύ rB#}Aa˽o030bֱgB0 uc]Kݭ- d߻!s○]>^JmrT=3pR%hFCQ4[\omۮ@%k^ڢ)Wz)s6ltRtLvnAEAU m3Ra1oZ軌DR3 ݻ-l"YE~LH:2G5e޼MG6ϢRjeW LA0j.#fkDnזd+n-zmI0iAMȥeD ۘ'cK-S"9 ke4U Yp˦ V[?oƎ4 E%&?AcqW1Lyv >Ɯ%=N[Ea&[ Y{EP@`BRnu-R #XH?%Qˆ9\xg +iUba^Z*Eq07Ha{ E=n7X+FP{mA62sZ@4yMi E0, \=udHO#RiDҞGp2ԔBŸ o4;߲0*W̘1M^ 60],]IbQ0Q5ۑ!-*WUT;~+۸%I峪Z+dS(K!G7=ANr[@ ;0 .]&mؤ[t z9*x7p٬ %g@5=!C bS3X;u0eQL4%FXgP1IY*|ݚW~LiO :{#R}Oˇ& [?$a9CJB#>ś%;.ZUe%]msU.sdQrR?.|0=76Fd6M\Ш=ہ1ŴU;M.S;|m̵ΉcCbמ'Er~SfNoGs&,lkI8+[7>3[YRO8 +]ƑCHɯg';9g D'jE?@At^։&t}WW<O[>Q]cYtT"g9:NsSi!ҒVn ŧ-¹;_c#Wt3Fq >\u*MX]H'gq'҈N Z"2{i 6C +ogu7')%"Ur"sv~#pڻ(БU ka [,(K|k;~|A n-9has ײ crP1|Umьhnr1p,/iW<E =+*Acj|o8Czen '-&$7&7*!jP`Ro:zD)L)&n\?k%HPˏ|7m vܿ Bb/G#dYraږ^ +e I7jY-%=aȷm?S ;b6# W=#KҐ|S;z5 KCqQְ`@If#Hg <3xo|IQpAkD~Is)̹.T@S?+(]2PԕocX=̢ֈ>287Ub |dR'^E(9zU 8km!SqB~I&q&)B>Ls=xI6[ۥN_6._sљ`ƊrȴCggMn‹l߂_%q m4J̧tgz]҄U {ڥsuszvr+ ę['P rzX y9.9 –dm|r*ml\t† WcnFqf &8ðH1}~y#a\uMI@$)ˡ{x+!CbFGL-q"\Sj:vshάHN8~*-3@@,w[Dh߇#Ei9xF}h;$Z`Z$5g߃K!v_Ikt- 2JyDP/FIg\)a:%"~ZНXLhcfl'@wEXމ:iMy \!aciq~=`x{B6o&qVE P yV-̓9UN>$; NZKz?l+ An˔6"Љ&(lL!7dC 1NPF<3R`EPBec҂#Fl:OhKV1}@D'`0y|4kӹ{偦 N=:kGvK #Xm|1\laj}FԀn&ƨT,NJ *攋'T6h{ (&1&q ; ,*E.}H۔L]u kZ<_jL*Vy|󫴁0w>Ek 9MT#aFk:"; ã /yB  #1980Ȩ0A ^w2}sF;bX煔C=.@#3 rFz2Wq\ K?4TDńsm znkt0|EVs7XW*grDa y}܍pN^B}fP٥EGI.9$] n 3]b'WL 4ŝu rÿA0u JcE-ySi?N/O)Rg^ل8 L`S|Y9g@50|K},ϙ^DP@W-0fpjO}TF vݥF! 80;[ VFk$eS63=bCFۻQ;%j@:!*̦*0A' e $kD o_$'A0€:Ӥk'c k=-MjQLbZU){5v~_gf=P؂txb$Q: g=B/_ՍA c8oe֣g<2|لOoA[QnTqXlN3;}2c\3Oj E` <ă[kui{ U[h0ܣ]9}گ# ܙ>uŌP?ShC,]V1vyWlAS=B$G*о{{_ʼcbdK1O DDk.i,ɽ>1?r8G&Rqdۗ:dߪ5 m r~arI쌲\EtT/5>pAbL髤ԡE1T]Խ]8䡗LJ%K%p9N7udrmM<vs}>Hv[%5NM5k'ɧ-8I6'sV% O?\j~! Ajy.ڲadvѾ/>>λ+xd3u:8ȂJCՄUA‹*LnGX\FKΆ 3O6`PA٩G ԮW$ȫcv;h$-f0r-:f3د,6Ӱ3!,'1ñz !dw&<3IB!*z}+֦ F2"(".]H75{e?K{4hҨUݨ>-\ 9ݹɯw^Meu-w+r9g<xY⟔͙4i;ߨ6wgp썿BXER[GkKo93c+Ԟ׏Ő>)^oc(zбgE#U .y7F&ɒNaߺÍr'A)"5&or5Gm'@Y{Y$^?(8*SyqCWCFjzPf4A׳ΐEO;bZ5,${i[&H5`^ǀz U3Ly!+3=A8r7zF8ʹs8Xh|&P\]gdZŦˑ5Wݢ39$67ƹ Z@ fNf!*-J]K`~g_MxccbQ,5YU \/ej/:g.>pJ G%"ݭ#@be/Kws}(״\-q}to[yB_,ɤQ͗m3+c=s]D)q[ 4?ӘCbEGDV D Q:-b>QCPmrH3Q\&|xƣK)c3r;rvM2a¡R7;)RDž#b z<{>XKABL=Dz`|/IEiiHn6# {rфw3) Ԗw tdJ?9]b.L=i;u 3/B ;^c-R\|u"ڨFG VڋĖ&G6/ $Mwj?] Oc`{0e&8, wqK0hVf[3Or*O7]tJ(gC{Z_=#rh!X~ t )/ȷ*!iU!9bP lDPjEcAe ?<|=KbS˃bU x (b4^-|,dbAm~aiۋ*H>D=v*5_9-ܘ;b)/~|lU`Z׎md]dotCPc_"9W1] iO>vԭ^&8?GE8e? [F" wbuN Vq癏#QWQ!~PW 1Jղ2 ^j@#95:~QˈE"VyvAС8a.[ *xuԯ-O8mUK7 3|!>wkTH\ɤKPcu)irRnfj}>*NsʙA{n~K|i8#,620]'rC] '+Sl]|ْ|2hՃdNhadk=#F_A-!{  UjST,PX\ih)q4S5NP,2F_l+^}FWeA0(Z Lpl'h>20Z{kxmǹlߖʆO7'c '&W b ( ,M0<.ɭa5hF>?ʞZD7]I8`u.')/~ @.6|>On`E LEon!cZ5 )/':eKIf)xJ]h@a1rߊMz3 E,Xl@VCLC`WjNtv0᪐PT[t쀡ldXPņO^o#ߪ2=1S6DTgzVwho(G^]|U@˭+Pxz0s:ez/QQ/R/~72'6Ьp+p{!947'o3ꄳկYX6ZB0F\6PWA➕9Co7Lyg?NA=t4 $cXiqL^AguFc2#P0CzcIsGvd il՛BgO5  ٟɤ2g'3 m$+n '嗺_]BB3hQF|ojͰ'Zlx @]}!K7i[MJېhaLb?0S1)e48HqzĆgbb qDwWe|6^`]|΍דuZ:.\3ezGp-]h6aG nS~XARјZZe${o&ӭ''&(ta}ԵFeez!{fCj@\b+Xm,pZNycݞbTKa G<v@3KlTuL\O;j(qE]NhlQw=6(k LV+P1 P|D`̂XZX}.c~+B:xlK\͸ݧTr*jaGPaǰDG2طerlt8<Di5*LeCHkl| /.adž!l7'k/U2#oW =JH! YR'V#S5b-+j0{a9Y+&]VFU&.lC  ^|im* ?9%<&j& F!!+|q_QJuԈc@~[*c1!'.д5 /m+j+SRmiV09>vr9谊G">gU;$1gN.'10ٰq6AДUdpp Ӟ x]Ll Cu kkhU܄\6]̷_$䌖WԾ5oԻ_w7=AA Hx3q;/_[Jt<$ ,$(S۪ X[{ H*\{TB6w܎HˑgS6vTv}B?pe _M w~ٻyT)%S}Z=`FӲ^ ^Wg[d_7^㨯FE[䆹*Wg :e!N8Fm<дϷL~zn[$x@S1$¸VOS/U3'Q-5ެl'>;ŇJ˕\ jwRH;wmzή ~ Mth]nRFkj"XWʀ~nwxL+usa&ÅU6l_WW[-;f^j WEel ӞFP}xNwriV L1U` /$VDM{#XTTCҏ*ʼ-62ćWY[22+T4a8Ѳ4X2 Zx"3&ԛCbR(Tfq;G)e8 t#ҕykQg(mjPP$ssԓǝ x#^|gFm--zW[ҡ\'RJE0'}EIƻ}:Q6t%BVpSOZebM?:&DJAs= Xy8؎n(8آFc=bItDawNpGTM z Up-9q8{  O)þNPX7 :i-]Ǣ |]Tg|VF Jyp7-ޏSN]k.+- OFOo:|"+OT eA1F-rPjcPQ?lߔalx憎W7Жig` \{ʇ>b`qCb!3JE˹q\OA7zcXǡ[e!v?-Rc&ܮ;H|ŮʪW^lx+OSz=iڇθ]NNm^ 12V gBOcgw5\ܞΔ9I=v:'wnb3.{g{hOM2cbPjF޾MAbD Fx0a6cN:D?I@s-8>oq `Nc F7pZF0fB2p' 2R/'֯(` )0gwٯc=rQvF#;yW4< 6]v"VGNffo7vx 8a6`3*拙1̍'V'$ۂQi,!Q9+'6?9^D|s)d4 |jP̅-|/TNr pqz՞}9@`!i+_'!2yf'恛H|J/Dz+1)YvVa\vK70z^&c4įM2azl{_P6@'jgMFO9 oZz6CY k10Rtߍ\f;QAjy7CT}vUp{[]E,=P`7Djk3zoBq,̫nSQEZ3gw^$ l;7Z[*Ng0+Ɓs4,Cng-|I v:,j$FnA}ZqZT\hi7>>}(0"H5%MF 3m\cf0NW4iLIUT8q C^A㚗5v9Wq9o^ Ϣ<5Í,H+fpL3^2兇]$E[\6ǸOip3A;b<[0a*C1G(*]5 9m?aSlq-_dk4ϸd]lЎ3OJdV[Ǿ/z+{ s \ЬMIMVͼyIM\Q/ E<+%yihRr, pe+b8 +VZǦCRֿ]doAA\ GY"[ /pV+pȽYuXSQl;P;y׳Gƍ-= ^[βҤ. [:4kŜ}U'BgaPB/ǟc ! T\*0`eZ: VR~rK>5ȚX Δ $"̔-, BUOv,JJ@oZN%-oCOr`_MtgIZRz2C"6kr\IUDVu/O?‘JN/ZAKVU l{Ayk˟'o7mV_..ˊEX5խQFx@5S"k{8ݏ\7 >  /)R]A>s3"2v+&#o=2&ʥny "rm]|wKmkҭ^-Xe$ڻXYB;yUmd,vB]Ņy.2'ضnԾ{[LK̚0v{r"nq LZwOK]J[43j˝z(E3kU438~(P(8w'xtR<1:`zW3ŚxwҨ+B6>bٓ]:-eTy7&zdHEF㨾bUI%rd0WRu,փv$"@:;d+`nK밝bG[G<1 RR$kO"[=?-67M24oK5Q9/FZ`%܂5V9/C5yIZ CBUL&Cd58NO@ 7<!2Sʳсle=6%6{n:ߦe7 . [NNC!i葁y {X@؂.䣖dj5 u.q0BZk$R'i%;NQ|!2&[Ŗ*!vlk!͖[{-cgqjɧrIZ)fìw6pM!=̵|y7] k*Mm ;bcrdZE%mW8@k}zHw>Gk֍eR~ odь']pORl]A}` Pd-{ro|D;ޔv RƄ`tbQeMnaW +LUAq 'nb>S#!]2WAג!Ko O&Z1U%dq#!vtCL:VAwG4iC_~,H<ֵ+0KY sN'x$f&4"< 1h)̟wBꛞcgyy Rqe?z+|mZL[V&.z6 -Y`8eCf|9c,۔QCkPn0l~;b1ؼQ(>6QǽH r`EnzHʻ$$ K0T ?# CFza rFG?B~ZQ".eØcxA0Th ]7+( оsKD,H9iV0J(G_.M*LJ-q C-q!DXl%~|»Ɛ;_YRd?ZvT &bm-9-,D&C1뱸؜DIuv/AQbBC@<7b<k57 >'Svkn^9l>ƠHjk6JU85D'&&z\'R o-ue^Tu A %` ӓaoGŒڂR\AM~dA,H( L[!:?;6W{+kRqKRW'};mIsn7{|{FQUʃeW$2\,W^/H:^GoMkʝHdV&t-hA,Cd֯aiBi+8ZGKg֓!RărGv0H`s_ZY=8TN qQmpާ-8L>\> ZLy*QV#u8xm,r7ka*DV*VD<Pvc'AՏ`#B@$Lڽ( "y(]%:؝b\j.Ac0LN萈QH,k%qBqrD:Ӈ47}^fj[=,A07MJryRu[PG KS{7D&f;P,ШƦ*J$5HO`#Qi?1K#,%^bٜ́D_$9; _߀Q:@K٧<P^_N𝲿P$a31]Ȼt`8b W ~G¤H27\fYL*A؈7Kcߩ_ň@ ܖ7 G [=nq !Td5//xD]UhdxV 8kwiNtDEA"?B6LP)=L8k q+cFD>u&*6I25&#Hy38")[U#7)" ?jz3]葙g^t +KC,@KzBz `# 4|prt(E'aPM?~s5-5q3dUQ7E-Ht{3T*$뷁BDA̸Aca$RQ@=|Np{=<)# zsَsFeXDzl!,y[ wfI=vيL-JR:^ 'kpE#\oNm"Xf _KrI«TVhvln-k?ǩfݰed~(tOj࠹t-η5`ISfIEf֎sHkڳE 6P,;#^P?96) w,La֭ٺʘ(O{['ioX! jo?OJJjsD&v=pnAvUޯ%ݟZ]_Oy3Dڦ??01!d)g3Yjig9 %Z hdzqWy8&ѡ©,o43!>Wm܄I}|:wOsݡO:VT(ui`@ɧ ԶaC؋,HsO6sJ VvMJt3!Ri;xB4N-!f,͂*u)"M' EOr>I{o% 'tfc r>Q#.W'K&Td7]2݀rj#g`u}(QwZTAYn#|P3!ܦ&LHRҚ9c4, `u*[@JZ\5?p`Z@8;sLߗN(O+GS9<;4RN+73s%E-f'=@OUjQYb/[*/y1BnAr}^=НP54`8!HnKmx,.+\V@TKx^2wR[gN^3Nw`KB=܈CbɂzN2 *zpr+w)sHpX1R@/u$ nڂ:Yٰ7TLd ePvuxlTlh'tX!A孋u10uY\7Wn@&m[0*d,nCK>olzIY?u6X۰$K˶.d MrϮۿ˶dLǩfSh@@hV^޾TW; pE!xM~tD)h=VyREʹ_J}A ֧ JN}kM nd>oLm~TpH@`< J5 + a}ʌ]rr$ ]DWOP%3W0zB ֣3XM&IQSÚYnh \7tS Cޔ ؙ0D%=0jgƒ7.Gdͅht{d++[ ΠI*M9L8Xb7]!]oB0Nϗ4E%H削V\}0Е sЊP2.arONCH'I<'bd=DOه~*jpIncvaРb|g1y1jK}@Dܲ)v=JiTx7z Iua]pTDIi[cH#U_\\CG/:p8F@F#(5ҀcjSY XӉg`3pD1 d#bClyS+RӴ~(z1)B`+~r<{(-p=EepXT˃İi:(Vg}xt1㡞!->y&L"&!|k,2b4_$ \NI]t{)g,UV/@PB9xJ%nT'd4X'`kN{C?ͰZܙN(.yNO/sY!GT6YX ] {:j.D"y,:hD`!{{ia~hʟ:x;WD^(uR~*=!IFހ8*λ53j%Vjd\|83ǵJuO+zYQ{\YY6d@.,#Z|/CEuC>Ԅ3A?g@"A\ l ˕tI##hBƁ6i5C.) /#`%:Jq9&&Q-H BSp'kb!܃Rn¬Zw{{=|bD+IYYܤQU6ntFd)c.؄4֞ԊCkOtEATw)X 6uw>3tXNR3ܬ J:WzDJagc w[*~%wqFC+KBD,<-o ɄeTʑ(gTޗ$ Ytgn{n]1o٪duQ ̆ {rXJ+`{~(v.;7(1qR|>X+]62ȗqMiIݶxTQa灹pggV"H0$^&E(Gn NTCSq`=k[j P,n oY:%]ٷ܏mÉL~hoROgLh};ƌK)'^d,1aHXƬ>ZD=46Wނ>1oOo0IpȊb+ij}q0צ9Njh4g#^lA'`GRRjOlǔ@ %n$H{ hæ<1I1Gt3zLKoiۈuH~&o&aR*+p*UG\4}_C+2t@㫓 dYXJw†^~ܟl(GR ;笍EY*/ۀȝT7/G\)zSWξ&-*s⃫ԯ|7"g*\NbQ' &ϓRuz6cI`ga2UX(i}PF&"ӞRUleҔ'ƎRtn0**igܣډ9d 6Tr߄SGnEŝOnfu-W:KPY{~LW/{ SYbCΛܨ!m@$86AbsT FyŨz~s!͑C Yشt.,ŸE}f$bt5Zp-fҝ9-a1Ù\2h [9&~ l|WԛNsQ^jlGhltS +Ұ:l_~ݺ Rxo$c@82Kv8k==3Av(ϗqG:݂#ϩ04D¹zYб!HnȔ".&*"[؂*߉i,T)n~ ,] Z`"~Vt0*i=e'\}4(Ϳ48X?,3M<P /h/%樊34>,5 DB(9(}|\̑|ts@4bY{&+<[`{0YP!2&˽;f̓0 dyg%f=j$jTa?M-,`fW-=ٱ!E他nf  㙻3a 4mCk 0_4z5U1]DDx^"0{\f)jf;r))ܨ&t:oF35kCY瘠#3`ludB5 (R+A'xZd$d(7 Jg;ˣ=I2p\%Ր6V;ֿ%cۿ[icTЊMR 3+K}L0.20d+]p8f&@Lu~=bC({@g esQv3{핬tLԛl1$ 'R/ujC5GfA&Zl\gj^C^v `N4 ESvKpTwR,y iBt!&L _2%جsLcY-h}'4ewS'[xd&ҦM %P/yYa !!DCBZ-U9nV]7,xhX27ڿ>Kt xbfקv,&pfDt 2#=>dt0jAV.ҟUe]u-Sv;)L<ڣ,[y?pf!~r#ˤ6PsE33؀&y.mE?氬HB/*Hz̗UU%><[;3J<3 x3HksjaB3pq;-yڞBu~K^J0o!^ֲFyTRVURO.Lu00+YՍ͋}l$jf>)^G"WafhޭstPC̬e}*0 753JYrCh<6Ш^g[tkv9ON :I;;Eh-W{pߋA)`[` cD 6z;FDi7 rkW"u`!O]|AwrcarpͭS1̳EVٴn'3 sn"ȱ`, Ajn­DpS}eӺ#n7OnGi$6 ×vDH@y;\|jttBj\ ECeY'fU|$w6xzQ&ݮ{2j$P{u2 YYGTent\[7[]!4}{ +lk2}/jy`"?C$~qw2 1kB Ih+Y*}M0TczqPU:r1G+Y s dS39hJ])B 1oDv7/D(&>=FЮ_~;-˖f2kQYUb1D4Ӽ@Бv7#< dE }2kst|.B|d}~Ю>f 0̻hnQeu݇O~JS͔%-mn7?ru!ֳٌb聮 7|*kP1y9S-ЎpH-<6e}ϭPxoCH8( uőfSDޭ4ԶcF!:sKuja2}u_.>tMfnI4 r8{uMY* mȯ&:0u>&Lt+#|*vߖM}f_=WxR1.0b=lΗ?EW2B-tL~!,:*/)q})(C5!-0r.ȋ1z~M;lײKDi;f HB9@<>$ ߁POkQ6e/G~u4~(BDev^I"( ab}(yrOhzEhDMԧUW'v1uev\>(#zq ~FYc8)iCs>'"'B@<0vjd89XǨKHc7=}ڗYUH,ӣW߂ț^,34=gX'˃!\GvR c \4]h/+tE})iux}m?d*zA_r.k#?Y}$5omı5se~M$Ŀ0@,Ecy2 kW2ʖG v!9^:E0W AW%F.*s] Ư7b4nT, fjVm-d^TVUpiڞ ǣi?+rQ#̞WtduD,τ)7gyI/%]hyO*N ",(E_Cƌ=햋XL 쒝Ց]H<㾤BV# pÛq">$ʹd9J2iHF'D},޼yqBkPهH9>-TޣYCvg D( ohtݭA<2oWAw8l׏FS*j+ pIUMWٚ+XV96V,$v~HLd_B75RЍxGQ [#CwtZ^ҧw[Ȟ'enH흲wAvyʲ'AIn.g5ssKЅ7ъ%+?>;g)q7HȃA}o@BEaTJ TM s 4X3jo(H7C>/)`i\rܢ \V/L5d8AԭCN%A|x՝$+Q;nF8Iq$7=1=8MCtI"Fsy@.#?#b¶TwbC(??d Z;.)v L6%9aYD@gg$Ttf ɥW U.I\T)cZhŪ<Ic'W72-y& cU0 f|KdS63qrԝrhS1eyHݛWُQ{N;`Szeh$TqTAXvf.( X=,PQZ@<=镴%%KFnRȝ*r 2$Ǐ Nt,Ԡ7s mVu &7.>%~T{7.9>k"'%/Hv1 3g5l:5u#~o[ {M|&G63!Fe^6&;Mp>}ӏA3>sqvߓ\V#4)/eO%&W Mcj:ħ<f8,7WhEͿA!H$L FuHӊN#P:i-/ZcI 5m]6T$MIa9"'KM[{WU9BXw8Y{2kh<_1׆?xѿ0%'^)8>>/ɀ s.P[`^f-A (1ƽ47Qºow^bߧ Ux='p/PBCq:AEF޼ #_t0W3c>8H)ce :<ιv:ֿ3d~wɩrIƏV)[I*u g*8c/ګOrׁIիB#qnn(~Q[H1nD{4X6C6O4lYq $DB`εn9Jg?dtJ@?ui' /7POD1 &nQUC(33.x9kʨ\ ڞEs ?.  *pkjפԕYI`b k{#f(W i^9_#7F@VBsqr +Dh 9RZ\|(tRBKaY O%*p8Q7XQCբ`5gBFM,~ׂMo:3d_r$i%OR^#z>zV >4,ESR*%15b0+-; ȸdnqO`A/u Pp tSLGh};;#K^tiD.`mL۞:A, RŝOF|Ryӡ n۔kK9u8Cp-p|U]n6 OC$ngXIvyE$p4I@>3xԣt.cVbTL>#T  A ܎VM}B";Lr, 6ŜLג0b ;AYW\9߁u iM@0DJ`d~P6+VP1f25Iö\3҄c3:WI|xBˆ [L~C->=N2!6=LM@n' :2eܕAOk7],T 9;I E;7[)vlp&P+e]}T |#^a4AG9YZeڿ@¼[v]٨c<ejU0E0\*b$7 2'q?;{@i2\V"oᙄr[Q@qQKtwbfصdDneX14b%l9yq1hh.qpz5Лxa`3 Ndp 2}.Ψ^F7XAs䣠E"`mxqPus&]P1\Hd .Ŧhiˊ$q}o/OegQ"a5#ok_8'drDAtI%!q?cΉ;uЪ}u<Vl)G <]\kh1HɫSDsr8wfFW߇!h˹.TA>"I}&mc WSyh'Z!S暠KrL] o)cjj)S"t}RoRjWvObJJg؆'hzR$ 26> eĚ\>ux4qHٙJ0U|)Ԭ(.ڱ2(1FN|VO r:Á8tPbuHf@zXUQ9iJ 47_0i܅cWt!]Ԩfg}3 DvlvӸehdrYs簅tS!%Dտ`d1Mo\M~"hb`h0 +Ƙ7=ʧ pNϿ[5we9C "ˑnd.EfZ*_,z/ڑ+/QXRza~Fΐ.yӀVlɐ)qa}[(׋ܴC r"i㧭g$sl/#(Q;B=uf*!HDw)#%@2x\P9"w!߲tלd{jcTaDTE- 02Fk{͙~ K02̜|zg3:BQkkg(g8ᇮʹuz- ϑ)BQBJܘ,U XU0^^]ULtVM}o/xmJ8Vw34QV,wNRɾ1Lҍg!:f`%)MA-mn50+ o]b>Ab:)ɼ7;>vlier . RlzEx)NZFَVrbGRxag56i,r}4-ot| KYIhIlZʻ/S'@ Gb49h1B GQ婂ի^;S&SG^ UnXҪP' wuaB@tt*(RȘZ#yKOB^7Du/ntRjpT(AQy| >i@ r.ϯ2 b[Ю RZVnS =Uu󘯆eLݞḨ;ɟͷF pZR WGk ^~Mzbz,XnR;q<'u{o*1 %xye;/Th༻JMV$Kr;#Ȋx@Gb:9] :J= IUSS. ,SՕɖn@[յJh/L@8rB;A@̭x4  g#l07.|N)VTרl`.?M4cZL eQn}j7_/4qXߍ=Djrqwg mH6х#湻d+/.-WD5!|".ͽwua$nGaFa{eܒ8b@SyazG+q$d[ͥJ5kؾ1n>VTL&v՜]f5zj+J7~#-_jA:̘ WJ$n%-/n U Ig;aaI @5K?MsWsALD@9Ը_]aE%d̼*avF@d ",SQg`{VC.Lۈ񤒂{2nXP3œG?CjIgT iPIsIpqջ[f;%*M@# `T؇ 6;s4}5tѥQ&d(^jAp͐'E7 kB;ZM)*,;=:pSJ߀4zC/QOSvܼgvvcx:2BXg}NHrۇ<_4A19h#e8lֲ"y2I;S rsgW [=F$RzW'v-uڥnbZc,o_O_șNfXbٔ%@]F:~e|C< dwTQ(km44 ytD ￾!=] 㭠lom}ە܎~Ę?5n;sXH֣k LN\:QTƬ6Ng 6arPDBa oBcCn ov,rks@^iޔږs|Du .ld:a5G:=]xʈ q_%mNbH'| {%3E:WoC,<еnʄFԧUpZޫ+MOŠN3s >:=D1 .*ykL%!$a av e _}t=';L5$CAD7땐/QWTXmfBZQiK5h,bù>X@5RASGL&GXF~TBܗ!c~{bTO MM&>@> W?kk^ J:2Fy|t؀Մ5 y8E5EGA0RAB'*%;eZBbiwjvbп仯UĄ~m9NQ-?\tIHU,7Avg\W .^p1//WvkOis}}O%E63܈ ۦ13vL(-`'zreҌU]i%FuQ ܡUi@8/M#ClEܑTEyG T_* ,ZeyN &bk] B0qP |L3?gǖ!g"maH`={~$}f]=>mz᠂t?>#2 ˗Ӆ |{G(6|c ֠XXHIa]2VFzcl vkX"a+ӴTEpYL9$T8~p)*iRvlk5ðL*iQEE)Oq ߱wi"*൏$9m38[!VU%#vHQZ K"lVs)u`&$5,1t[-r _fdv$XYJMcl s (b w`cFXo{/Yԕ,9;mǵԼM䱰,K_;0l'L%k-(N c q@Щ 28Yzq_iaB[MO"O\X)7֋I]툳cXjٽ?vx ׃<0hy 2^ ӆ=Q˘mB V'+[;PA4 Np~OY`#Wod0=M1X;ڿɭݶA1@ߡ*WQ΢3_7sLuyl<FNLi9SQ^Ԕf-w]bW6mS`b $|2FhP.EGi)tø Hqh/G "6إJu^ 4:& [O`|79s~ϯfwjY<~`8?raMPns(D_Tk]0SԒXup%"L3_+'қ#TMQ]$p`q|(*;&QdM1jz>xhS Fi/܆Yfg>\oqӺP paXSGgP:۝\KegPLP&}y7ЌД^=~>|YqK= JwRaaqd-` 7QUj*Eq¼čQHwt@b9 3OP#rO][T| h p/'(:fXV3j*<}UWc_?@"hmR5ֻܵa[.7܏Z~+5x\觝LH(y;gNHͶmB{=m OdΏ:O87-\_i(c,A]'ȗ44Z`.ԱPn$a6<8DB1d,:J .) ձﴹ7s^7kt[%3/)@P5BJD: kNVgk%v$Qӿ1;g6=o/p M: f/mP`/WƫYN_$!cN88A K7G?g3k{:/Mb2詄\P[& c!S|qN< {2P=ߝz0A$O6R/y:r[AhRcz7ёF;r(ck'u{R|GBI0e}LY,2-_AQ{]KW%'^)?)3).f|Pdr/ˠ@q]0D<)8==L_)Aug:`|t2 0.KX.ޢfO+=ch8v_"ۚψ "ܐϺEsьgMsoR@;k0g`gVLcQ["/ { "՝, ng5,klHXNsT5ژ';Wtvf9Dh6aJˁ$B‰]Tȑ^ԢL`I{ND%?ُ{Mpz~]t|"mB>m/)MvnɏccVm:]P,LtR0yKgM- ŶC>`L(hN2CZLK}&~OdI%BPc [%E%+4DB/D?`'-$@L[d+a3BV.Le_[)ĠGQʣ8(K.xޯT: whN̋T訓Z^+"it&tŻ*E@՝fot|Lqu;'-"~wfN Omnt2lnh0纑Iml-?T,>tMS~ɓN<=kGXI})9NSCHL0.vzEX8_YU3~ D(ϳ4-& s-}[7H o0GԄ'Ȉ%0<_nUk5JwE 62c"1gWԽ]JYܤNh:7zJ-}~RnLZӋY|/:V|!Bi ݣ/@=|!L#tum _"EC@y~oh~~OE}Ci)XWFg)룟۞raYz2R Ԝm0(>>\́+,y]tz{'yoXެ/S~0:߃5E=]<4# >43}~ui3Z{#<΄5~98<8p߫$Ijvz7"14gj9zKmel)!t?HA@NJQS;ZJMH˛14c Ն"-ZΠ&rޯԅk=t*Pkk: ^ se'! [r^???a g7ZvP順s uӳD#&rj@n݃(t4~\0Rh)g/EfK3S`~Heb$V9e56"X+g2{ւa/5a0)ϗ0|#>Q[Υ<- Y=dt-#Fb Fk'XGtN Aɡ;P$ MA&t$w/rW1aAǟH~k 8؉_U[¡华L]EJDi$rQ~Htʌ%dm`#]P ,{d#īXS{"ՖN ib'K3 @.C+(]4m7TMftx=˜oyDQ?$ $l26o֟_rS4l->_zdi. /#!;7WVInGez#dwد,aٲIgG(ʇ^^iJzeԩ/1O5 VV;-˄Z> =h~$CxfrQU` G," N%Eژ!_8ඓ~PQ,~ݓ~隽2N}*5 ܩM5gsBV㧏,g&i(Şā}>֝j1ry_L&G~%v]%_G+x E $Fl{wYޢj <#W{gBP9q4'WnMlfޟAM tQ*TH!azrnȬM4ir#,b3ɛ qE{b);!@f\ kk;j2ġ-7EmݫhyRYqEyr a ,7|;\CPY,}Ur9>拦&[EQdz֊9Rm G65H@ī8-ѱ  (ߋfRp(MD'?[Ov^ 0Žyr$%7,INGz)w8؍o8l DhO_dI]X!;ij>v@U 5d 9yʽNPjBq 2g,#b(\h冐Xx*!ɇt^2B]c |^桮O)*&n/piHVX-%sͅ=dK˴]񑰑AQP X/.UGyd!58ҋ+&U,|G,2$HbWت`ϢbB Hܦ/CW% {8d2SE; %o/~ն1"TZH֖-'O唉6O[Y(ƃiGeR|G+S96*VwrCp+ܘ~7sy 68I!pz^g9k^3e`_=)\ |{ 9!d_wb*ΖkW8pSWSzWqvH(a֛()\pG0?a9umᱩ=7FkHyE;i.Vtշu7[y Os;?;dz.? Z&K%sG[Rz<e=)0_둨%-{g"n mxƶ@ XZ3#:¦*2#Y"V SR^LjvS1$̙䃁}0T4^rE+ߩ8o XAٷ<8gw'GrtwхFhx1pFn3GW_e~(*V;o,|4VlmY@HÖ#G,@Q35iN(Xu΢yy3{z"=}֠+23jL /C0P?zM' Q /x"+?`ENw@F֤1uS΁tj͡~%2Bө"b|kGC4ceG$XP:Q\ JcFK {-lO7y fFu=) "(MlW%/ -<~98;B ?2˾xmo !tz ➓HrC~ ܠMt㒬l6egp<#1{N22߇ ]3-: ۔ 1 Bnu X2f$,>%F^:ocY $JɁH=R,-֠c{%Mwsk0_{᥹|I?`*iFQ* D6s$r#7~YTP&f Z:Yyw R* !`?Vg\-#3v9PK )^F30Sxi轷784Tܹ@l]dTKNİBHWA1{.I^=ÂHq82Fʰe&GFE+s}ˈ'lH`1: U!Z CT8>A?o> NH%`7^ycV4_..X>,`1OHZ3sd `]6NG(2‚%~1  K B4Slu.@Ř`E1:Uv/FB5ʭ$RMc@z@7S|̪6^QxÝ!0\ YLMG_@-RM ]eϐ.‚[32 QԸdtb%7s|7զ]H5[゚,8 @:ޑRhb@ƥTopC;\lMY%iC$8.0lxܕx3ZwF>5{ @k0Vpn[8Mbq*<dpj y#SXt^ݻ2н&V]c qH Xj8Aؔuzz^6M7Ŷ[v}o&(!5[R! 5!/W>$hJ7ڨܳH-[ q<=GRwYZo9g&c2 aܯIidw9.p 9DW̦nڢ璉w2WYq|!u1u|@}!>Cc2υR}q?2`3H^m6V׌W1d!72t3:pޞį ߾-d1 qj  _2婎!gL.f:'>eB]ËLc84oBIT~*[ OSO99gCR> j5_q63g*j=Q°^}nÂ&XW1Aޤ%Td^Ni/!ǒb o(1 J;?Xk57r42.|/Ǣ"LL&miٞ:TI[y}/9< EC@cr| O:Mș,&OfP(t9'#?ך=`o?OOA,~Wwyek<\om*C^iQj rS?l~3%_w10MT&7WKJ!MJ _e2`$x?Se2'<þ#91SFWG7a _B'@}OPLZ&Hkfa,B7.}jܹ47v]ͯ4oZܛc>'HюЩ3j \~@Ͱ 9w\:  < cTN",Mfm hħQ&4i7gB nyAٲNsDcjߗɚiF\  x/%.tRjL 4zוeY ~Jb&ɟC'a=э '|O_ZSޕGKxQi1NE0mLDKE+_o T=iNѪGy9"=Xtsš0|5"l̜*FV~u,'7  O:,V054]*,t_Z$ٔ4u3ˈ} =Yk l;Ѡ'`;M\HZY1 dרQ+H@8} 01ǫ#.?/r86?X jF/a;\P1@ijm ?5$UleC-|mS}I2a"Fy/<==+FkLn,PA+%7[VLƨ1ZET1{R_NξakN`#.$ 8-8>5,GDc"ئPn;)$Zu0.\YZ8P=q3U1?^ <ҝ|V'+χIA,unbqˇἸ֫Yܑ:%ā.>䊝T|M RX>CuI] p2EI-.0uLe> keC= 4KRBi {\,WN;&@rސknnRrCr*Eï԰hkɴVoe,3te%.W&G5rn*<jG16-Ț=$,Ƥk0|uQk33K[b w$Cvwn %}"t'gN{5lOʼtFn2ڐ -{xK/wD.Gچ*A{R!4]O; y(RҿzL%mDМ+?u?^*#㬍swEٶ!g9A=]p2T?mkOhHX~Yl:h9 +NwY pA:vY8JEyQHR?a]|/X Hl"M`$dDҩ|LNzUKFv@hnwqf(}f\sc#b2A"&,nb;&R5@<#N4a)+/J8,o i' Z\K6܎NyA e 26MCaM1TZZ[NwoMѷ0{Dh CcQ~b6 +2+BIU546C>Yć(8eyGOo0+Άl&1Cxd%Vc-/NR!<>)7]sF w6_fOߐۓ.^GJ '9OX)W )޻< _ qF `%J Z2csۆKU&[=NZuD[xÎW\s ؄kMZ@miMT{Ɲ=|wm6HlERĠ ah0{/$xnkL_c0XIX8ɵˮNx.׀K[E&c7/_)3L_Ís(qbzkvE H ]Ebku3-!zÀM~0+bKr*׭;6LΣsOx7|$504))|øD{2DѫGx'Ci*b:t  bo$,̦ kvɸVO|I+ z4ԗNJ7鶘$v h7ɱ++[,䛟bȚE pÇuœ}ܽdM Ā9 { ؈f:*4OֵD"&}ת."?4h(R/9G*U7OЅVq(:iC-vBhȦiLYVRpL488?OiL"FRΔ+#d]*ȹ.Q@@XynIaIn|~RlHqeBUos+xYĊ5+. ):em@^_~ro2HwB.3͎@f 7$Pr/$TNkQ~GG^>Q\|}~v *aALoXQexLAM6[j M1_8.2="ßZ`8 SM'nX\ksBBNʇwscfKf)6 -cUj_kMvpj WrHr7S$;,P=@p~|lZl5srS e[mt @KS?64Ms]HBj۩b`}P1ywe9Μ8K6G:- Nd{d qUn h# 9@Xz"]2zOd>+&=LRU~ϮK[43CފV0py*e2jx6Gڽ2V7P{C|Poekf?ΩJ!"͆'_Fv8\aܞ ,}Y!Y>:X0F}HRe"jfqsVӭ@/=L_g7l|˞/y,}Iޱ*90`%kpȷzyru}'a5H[f-R/V 1=W֭~p [/Jϵ F$5&BJ ZR=7 xO<_|;::|ReK-{jdLPbYى"h2AiI?i᥸32w3Gn ǕDPEiP%ZLh\aݮJL>wFrbm3!=mU Hf `Pyh"zA-Vbpg4, jHGɇυ%opݾqc7G;'y qKԽ۪;f0 0¤1 AR,HSN.#"̎jJQ[ ?#5CdJQ`G'(gvR;9*OQ 3օqv:jKM{w3FjQ;u٨,c6phL)zJ- h/߁]jt0EBPt(v^M1~Lb SFd , T/٪I6@D_=?QCF/!>3_YbZ0ٚ ݈,Ysy3C TJʣdk_o\Þ6vWڃcsŁG_:"\a^R{ӎ5R@']c.7 dD#Su3҂ A?P0qCe5aQ~Y:nBF:(\Ԭ/қ]x=6NIX+# "[EpuruUd;"pr*0LR%IWL8.^ ҰGؽ~ iQnELB,fgѬSJgɥIGGiXӿs0YVҍڸ(͡>1j-Jӝڛ1kW+hՍ.ZCXuS{o1LU9& ߉N'⬢H{t}r$ ;Vy>Qfe0\c#t95ۑr:dX)OAH34ۘ8?7` X\pDD[髶s^bpRu$5PbĢ,`!Bg)۬U;Nd|%Rx cR4r7Ja4 ?ZAQZ~?ɶ=‡g:p:kKx/ - i[?3.z^%+":Ƞˠڃ i6./4y덎xẍqioTd >?.J!눡ZZ:WnskQW\@*x*!xVt~*{`Bz],xi;,dJ(2]TK6ޟmQ]lS?UrU-g)AuPs"*Bg¦nè|qn'Ů>pͬ3h5ZQmK텿J(\g n]sĹzX+TB oiVF՗,T갪VO0;צ#ؚvoC:V2*FFrtާD>+[j V.]rMJ.tNSձ[Lݿ3wpf/G|L:b[@ )qيdI:zԙPկʩ ] ng\^VA8mxZųjRNIIs498'4IJ0>1ҽas/ yyTPGԋ +2ɖSNAd*HEqf*~Iᮔ(g峉h=!;9A0Nf+`w1;L.Ѱ`ۍ[VaWby~C*G<ܐ22L(`H(э8G^f1΀=&of;u5?tUeU tjGr;p0&!äXzw['O\]'N<2-%w\hmQTN6oC{"(n nƭrNXr^~֨>۠U%u RFqs_$ ^͎"(tWO"X_ a E,| <ebSwh̲>i UgF+񀢞3)/TQ@"ݧ;b ƍBHC3lC:Ƕݾ*Ox3-u:4v1Z;/N3v$NljF.al CJ6 "Yr$bψmkƜN`RQ-W!-|?{ q$,*e1PD ?;al_ItjI>&e!0&TN pRT_+CsX VA0T'jEGM67~Oysﳈ*A dw 2ID'ms*L7^y%$=7v:,jk@7|y߯2}.iğ=b͞]@B|d߈Jl T-z0UC;Y?7m^:`)PYa|܇+8HP瘬#?"LZC6 [ =`A`&\9%s #oHu,#jy p2jhWt%M+tÌ^W!LS&V ;~T_: (Vv>`}M@  UqL8%^ %<8Fnƚ_=ܽ @6eg$ WmXJ{@(U޷gh `(ZšxνtQ@aԖ^(mDvWh!9k="bc\2w= ܷ[])oŔ5YrNy>4=D%8Ԇ@SRc>5G5y3,rJC{"##ɿ(jedVK&Fd7@cz[^́;t L1YK2ۘ= xf cu4vS/Pa' _cUFZ~! ʩʚFsɬ TŅܱ5ڔ'>p8 sen t{K6derJjQtFy ,uUX}+R1ۍfL]+0{¿S 0M.M3yE"){R8/3F-͇NB}$ǂŕd>R'ͱ CSw}pJEL>h 4y%&E܏)2 Ѽl?$U5U{ЯE]H?]\WM 2)ΓKG ߂0VhQ 4d s= 6Utt'B$ (aY<- j!-sϬ/uf܆xnl#IaVfS*=GO0~¯$ ڴj!}Ogcx%L4wʐ.B/bŁ%B;O+EP\X1ܽ7cs 0 i] ͡ L ioA:y=)߀X }ڶ\ҙ 7=]%z%Q1}'(͈h*HR(NRDp9fS'(l*GG@މ:2MP _#b/୵rU3%a)\z6}AjjR͈! CQFƮ]Yt Gwٹ D1m+JǸv)T818ނÇ@K۫kӭr~)Za)@T6 ~unw݂auՍP,^%vCσ?V4մk[ ÒB'PǛҵo"ZZ,OQJj1No]J{|b8;d7@O!ay-os#5&fj&a^yg ط[֯y(غ#Gf/us _*SY7݀BchY:鐙d ;K qJfv %3Uw:BZT-a2~~舶lN2fOQ *޸І΁K[/pF|~A+o2݄{gT\$%4QYvjbw=>=6k *U@+TBN^il=߃[%wR摂a IIsrpu^GvmN`*?+TOJ}ΎUVw^hf&/UrvgKgH:/ >tL>]nsZ%֪G:An~SUF]s(\fQq%jV,kbmdk֤|΋Jj(RJ-? RU}ٷqˎp6$IXG &ug(أ6!U~GɞOzQZ?NCҙKD#UŐ|IÁA;ʥ_ &. LX$>; <^p% H,{% %~4cϛ1 LXX( ؑ#ԊK:ˍyO}[s\yoA,N[ UnQ͒0x 'l]mz=itBm)$bW,Ge.1}ZcC[>=kcLisE<-}[Nݳ2ߠ5YIؕ4Mj/T@m.9؝ W50ӥ&WyLaNbu3P)dU,5޸vMՄ~Oݶj.5V&q uM?La9{omZqi/߲#T]jE.-Qn;OKr{<#b v mpA:ew;E֠D% R~ZFB׈Bk ) l3Oa\`0xk֦$]p +Ti>%Xh 3@Σ <3;rNEuXï4Zaܴ JWXmZ͏TyT:_1<2uOd #bt|! \.ˢ Zn'(%SZ|]].a"$ۺe/+ EnϞ|_!q#P[ DdK4zڛ˅f!Fd!K8PL3i)~ ix<,K?|;qĨ60.B-A{@fᡶ? 阼 J` ~}*p) `޸:/i1c> eLjSΊ#~xcbXD kaZ}̋6x=kdĉaRao0"i&0D{f@9Hk.=wɛ;SA-̬8~RAS%a {di:|xx _1Ovo`~^@ldO',$) pc>ąCHj+@ [` 7Su+ 3}Vwf * "UcA:LЖ.`o@yӊZQw)G~`#P!]f^+bs,6nI}󀆕 L UQpWs|揬#Y!FmSW+W+2WW(*ox]|/8gm?ʷ\j)]>(zl6,S8ٲL {i dIp J}jߜIfrqhVP곟1[8qM̗=w!_MTBaghƺԑ냗[B[ظ($g؍CFK+qu 2+1ZD^"QVxIq\eW!ubŴ2`FI|P{B6g' v@~iUA@׻ Cd?ɽZ:T)"oojH6#k b)D6Zb袑> ojZ,`|cgD,DD08Ok*,̏kRlHVCv-?ΈVT?eZ8O׈g3+DUa$fV5ٞ!ٷ~Q†J/Җ]K 9Ӆ$oំC|O`.v^[5۶cLqEb|.3U{w$ޫw),3Y`lN=ib_\9fD{>1$]"_Mn% u>jK;|zߐ=&Li$>]2_ 7gPUϹ{cۭb5*aqT=X\ ,D\:bY;w`lЉ:^5yݕC7ƍ%s@>OM-#X/L@|TWAX;w S7yZ&A't P(m sb8҆@'Nt'X#_HcQ^#U@B/SŜXPM[:{-mc?h͞G*;sɧGOզ-7JC_JYn|e3XpE'e ,|ܱet8;Vr˽#NФ!Uo1Q#s_5O@yۮ f q2YFz$?W,A^]u30NcRR o肰N }QxDY7x P&zsd#1AG;Qi52p_4#'ŎD)n꿜b@<.KPi1}R l4̲vqp=qJe-PĴ &~b+.{,S:$=%+=ql0*+!uq^Mi~z= xLg5p4FhӮoP.nKU>  >iF aR?] A=)DC 7X,6SƋ +/>R5ا^@QEޗf =im4T*n);[ /a Ec*e5 )w9O1!e|:7!@5}Ѧ{Y-6q|TQPgw "kPOXuLxʳ &eǎoL5K݇R r)4r#~c̰5ثYS'%bqk nfX}CJJIŀnj;CdEԒS49Ӈ.X-plT϶47g 'S>Ժw]zy"IZ2YEwGȽ,Rbub!;MdNAGg/xZR8sh 7{~J& Gʑ.hRֻ|y#zg/fD9R-lN} ~!LvZ\J.4=UgwpWaqIVVz7 J7ZM K+bMHL8<9-3yVNp-2Owu@Y @Q QLM[3 3 Z;waդ9 8'馎${tplaȌ$2E}$󛒌d3,d- a (h] ;[6j{ҽY1IS~8Vt&ۏbUKb""\_S%VG VcS-lp53J +g{dXˏPg*GdXHOGpnpm~|mԗ&ôcg}yä@7\I"Dkf>H{ziq)hռߵf_/ɣL4J1M@MU>R'lr$ J{!#%iJfip#2|KŽ ;p(>ܬ5s4.%u)}64c炪5#__4FpX4Di e!#kO.S<0iw;&JNukT.9 rKI4=4FKdf2D>PN.zAK݄ʀ$ｑmF)30)M)c&lF6$W7Wm&; {4}qTXdBep(R$ψRCk{S,dIY5#|ר*/I,.vM+'?vT&3i,աMasH&Τ3O\jypa`"CvkNTag?ݝrqrF(78s ՝0ۡti{-T;*]Xq ~ 9 &qV[2cPh UJU ;" dVr᝼ ؙw#@ӓb2W3 x%[= D?R[E*hʘR?o&UKnP=IFMhXDkL^dg; eI+c+8N뼷bۄ>a'8 B1|0[wrڷ2% 3A_^ªy] *JBd:8>hsˉ|:JWITpp;5jD)CvO,OgNL͛yr ad tO!o#IToAl U2Ԫ83ȍ~-R[yyaA͐ 4S D 9?x0-@8{:w乂Q4[( wo?*ax?Bt[|ILYf챂/;^vON xlj}`z*剺Sۙj95byEM^j #j4y- t\| {nWB̫4ֳuIزZɟNタD)"{ _ O}4/V Fbs@&)쭈6q$KqNJź{&BP5.ϤWYA7aE")y-ř iOdR/ӿ<_[͡m9Mv1Ayl뇬N]PLEbB\P#Nw=Ӻ|tƋAϓS1u&{[P#Xr`d|!߰V'=aD`\ )WC\2DIEIQ[{2"c35wޞUGv)XqP]&NKxDdo I5Kht5f7"duxylZY;:)@o\Y?=(!p'wj]Bf|"/M[Sz[: JÝN5 .o ;*_ToD."F# ,t!1ŕu˘#nQdHvޖa,}lxUJLC4d镾S0#d x 8a8_k磪j-ruQAdu3/E+zɿ T[+epGYʿGdEn(K\=O9CW H~3R 3~6BD.qf@}&DB4bz&.S$2T4$7>7pY'8%lՄ ^(&eʙ4ZB~T KmLVc?i֨ 7>xѶ[GBσuCfQ CC7B9ظ,AtB`P;!#_mfg&gm'(LCw EـJZM^p8 Oy0|JA/tH\>'<*}HK?s\ق+w_պ#SVOºfxNN4y糀{Kھ7+_uw>.bc%p6f~w*x53d9l]UN74,^NrrԛԎVxTl&1G}{LOYҽGWR߻x-^#zT=|3J7,KПm'X  Z*8NT+/}Ӿ/ෝi '^$Dt)I{z|B:t k8?g>@̫' :V_n ĽwYF5 S9W|``b|ȦY^9 pX$}T`oW9ch 2E\)ͳ Ԥt{.vcb~k9\XC lLeICA&^H[!]j5:+kCqU\CѭQFHRiQisҷ׌b5>{'yJ^u PqUGCYT٬l= 6B[\ ;"@;3Na2t#{e8 ,E(2rI=fOBVDMkRϟv??/razJ8{o2̼; u}L)7iq_5mq-mjT+]\)\[`FIke3mVD j)35՚Od6E \sE(J5P'% GS}%E5R&N,rTBa,hU8r0B0ܺ"n'm`SB T(vE(Av:=N>XfAm⯎"#VB"{Cq9um62oO\Ri:hqoN߿TfG\w>UISyyČKd%1R 9vf1Cit:FjS5DwȂ'5D냗mh>=HXӵq*@t/FU-YG(>9+%D8'%e.*4uN'Hiu-MxRps~46`ʲ'!DX~Op|;Oͫ'cS#k2EF %F1C"SDk Qq݌&a;d43ʀj_4D}faV%EAБ"N采iF}M៥6Zzm zNĝ0Qf[Wl|nIFFݱ6懖&ﵜ8VIXhJK4@iM),rje!_U);FtsZ"X2P,I^m8#!5'`֧o"7`54X5 m=5cU?§nuqzH NN0M&gKLI)GpHǃy|]D㻪{)ƺdIO2_aXn> =YM|H[D7MZW{Ts;~ʞ*XW7+bHC/:,Ha$hʃ\!Zxx{2iGc[hp!8 Ki'd#{,"̪_֠UfL)u =EF0S›-*h4B.qkjLQ ;Mϸ둎1T,b៤Aa6D}b]Qjjo%}PO,ك=4+FVdȦҰ3gܱJD<{r}ޢ3QZuD/ HO*Fzs._Z$;K'}o'Γ)`;ʮ&is ɖ4*rL.m۱&{;*d C i^OJo@ j>s7jTΡEÓz2 )m{y*>1k4^ᄙG\ع3pQ \Ǖim|.Z QH" a/!i??-ht@v"wOvWĉտNay;90Ą4`z/hs~_!.MsPP@mYXy~XK!rHrJ(;PB:cD\ _EeQ/,$H:~2:ƍ2NhbMb!３b_5=H('Jykg8!lC񣒍:AabҽI mo?+%VR|-<$,3,!V0EQib,G_DSq-+MRi>AnGt/6 6~?b6=fS`]v s("0Z!%ƪn `Yz`^I~yZo$W"! gJۧ(Ho<&GP*ҍ2tAFNȾ w'1C-?V7}i(8 'c=[u NAgNxsIJnI*X#@osV7Euz{}%*s:<!`" _0eFuܬ@@LULF;RihDQ]`T7CI0y!`Y)(XccKy?l"UYavS#Q6$3鬅;/ht`g7n]qUMBߵnU#9ybVAI&w֣'j~8 ;/‹ϻM8E`Xbs38 qV@0mSUU '=!Iފ,X܃O5yd2 ޼51%?ŞE5ǏH cNI d )D`2޶'LRakjmɞ!2TTuqlrQ%ƿߝN]qwqe(EmҳmKqH| 㜋?GV&QƢGͦ?;h|`BPJ䐅  ͑Y ǩ4F1B?_ygpuh8Jmi9ZȄ> χi&%dNx%> }tdִu4fmF e2čj;H_M,aL8}j1]@u8cB$Ȕ.$~۱k<.7Ŷ٫M.ΌtߖG*1y=!&If3mEfbjDa]OwnEiJɌ tx8iU 0Chah";i̯/9lWuqo6_פqeixԯnR eoQ~5cz|`qoum}b&QbcTzަVrz' hh~j o;0}YtLnhY9g)كM4JዎC͞-&tmF6QYIJ+mf0/nP^qy2#=u ҧ3*1m'!=8 iłz=n GPT\\ˆd!YZ jaE#_PJlJ^:bdPY )S"tҴXO$3ɾeM[TFkT: y ?tsBYFKEcѯN4{AIL+Y̳m.8+^d- ʸCztg Oqϓ+S)mzhԴ5}劙;JJ+4r"%%V5sS?+G o.joSgU ů{b U7=1Գh$#uAMsz˩S={mw\ntW?k2g?Ouwb-~PӀn,.MV*bH`lICA.<7C xrVtZB B물pɖ+RlJI8AʯSJ}~*M%rL@ق|evK/~;&6'E>!rR "(z`-9<6?.mteѹ'fE,&5iqE*eZ܂*فG1_"`],JZU .\ fуXAЅ{F>tx -JXNMS7hn}&^O #x2@.Z>kΑ>/)/< fLJkϐ4^,b]B<n>i.8C^ Adůb۟bD'^pvz0SaFT]XՖYd̓e]>1 L ;|^@}QHbBDIjuLDtEܙhR==ulǔn/LMSCyD?ʸ8.eЦJeQ3I͸CdcFsFe2](M'MtQ}U̇OBa+ t铮T~O4:|: 9$Tg. - ݒ2AΉDBpm+G!)ܼ5.MARd?i>-zo7G -} &k/.y]PMiy- یA<.[x-l\٠y4z כfUtYī IqfC RɺGMȋ{ 2- 8! %ARdR]uR1M9a SU-.[ Fes;rKs?mn$:Jpj]mvbS~ ]0&$K줷\ 6(/zKKe/NW2픺`d`84(<!2d] =DDI~ R6SL( P[¢=CUEZ3LaI[gv:R @.8f+%ښ_Tb2^!dĐ}Gx{7vSNڣhpzШXdz!~  oSiv^Lh|/#6l&Ntc%mɻm'\N5z/œ@¨+:2NCXЏ5FSGw[3"/o֬(9S.Yu&`K(!*6 1AqOqM <ﱩKq.-/):!%.[.xG!ͫx6ѿn@'Eˤ3Fpbb A`lntSuLy 18$"OL}gCp<#ʚl 35nHNl?rql =Kފ44Y΃TӞ+iᲶ~/"a0:w))KXzf#|@&_qB'0 xɆicmC,|Xa 5p  T~w8N<2[\i?1$4~j*ӧ:儖T:-idc:Ͷ:NXq|jcf \ N.KnM-$kQ.E( )F:_u Wst_ݪ]k| '^@ $K`Gm3:Y:;-Ly^5^2# yK9Ro.X;b׶[Np^Jaf˗p 6x+ƻ_;#sܞtOc(t M26V{&BgoOqG|e8.cފhŴfƨrI^Ґt6Zy3ZZ%J-α+hS[a\ 5 njV=:6o)&UlF&ar9` Z03+K.`pi|7' f/޶¸ s рIK e7%kl(pouyVTcʝW{Wg7ӗ.iVtsL}ɵ;p>p-M8zv1eZP>z0 LJ4W!e, |(iٵ^1NHs-KӶkQűV/ZҕA3[3ܕ eCr#׃M: ߊFeq&@eu",vԀxZ4p;cq4:MP!5Q]xK_. G -p &Q$@+׿^rG"dUSmRAS;^ Xٷ9H}@5y)!"1W &lz0l KKBȘSA&FTlrG#NsGB?E='h̤!4;cdN ז8bMckgKՖ2F 7y{>؄ &|{0<3c[Fo!a=I/!!|rLdH~e9/wMd8ÄnIHw|.o+@!⩕1 )-.u=x|[O\/,_PmI^Z P( hRyGr<( ·gCN.RC8ʪбtaf%.Xͅ}`*OxlGłp^u.?_u41-:@)v4ւ#\x79 /kU q8ݰ_|WjF B,lb| RdAJC}&ҢQ-[_Jb4ݍ躽;lHUyv8G_ rU 5pN3$N~[l6k=ESgJ]gY(g %}/1n[Lo޼Lod}NeDYr4@hd8ƒ[)0I+P9O6} }a{ ^_qd3//od봍Ԕz)h/MX0,7_{ te&!{~pO! b.]-c7`}?Yvrc&Nvۥꪙim~ͽ^ܷl-IJqRi呏*?JoW~Sif:OI#G GC\ҔpS";{އ "y&%D..=0q GR{5fHFFIE6`GYɓRIB!v#o3ԝ5pCPNp9H/{ P! ~}nպOD2WpgxiB6' 9,}! Wnݙ6erof~!mh WB~)/#L;U35v ^/Z0mGAt Piz)slp}ᷜ7sºH-5Q ^5zqFo7L~G:+^M$6 мƭkR"+IKUճ7zaL*!-Quqc(AS+G@cofhŌJ ۙ]CG7(X+ӪS]R$NYjY۶҉~aa2kdbv=@0X_%rZ8VLZpuKGP<ރ(P6Όo"%:rw\M .lom@慯-fye m6Xef93jP|Q ;!d0@Jؼ[k J9-33x 5\Vnx45)@(;/n[ p_6{ 3D8UQi@%*@͌[-6,V!Grw3e#䞸f0 *A@|E r.`b\dD'2A}w]Jd;Js" k,$N1/P->yOz޸>az`2O#simizy tC跤Jo|A:;~M",+ YeCw(%|Ei}MHqv1Lw'-tfh2uNōmYBB»7s\}5y{k;/ݷp_&;GuW/atJ:g&he|5r.)x/~(#Z@]]C-Y5'OK&`QC$DPA3DZ2%o`w̿h}=Sp vTA{]~pTXL_ 5pAEFal@(po?MPf8YN3CrpmRנ|GU}UxG+!L2\[2l:^j+OcF!Sq`H`qzuT&۽,TA+q@] JHW~&tf J$w._mC6(9Y&$Ss@#cxü]jqa&M?kIh*`(X3ҡxAXW|@ǃkj;uǼw3nE F0;t)]Zo.[xhj؛>L[ڨPoqoݛ=k'HB6'ݴ*'2-2o1{IeU"ELCp  uU$ w28NG$wۙ4uTҞAP)^XWlv`g r6R'ELS'&oTh&NE,MA  q"ʆ.k *F*0h흥b_e.2h*r#%5O`uBOd}\| iK'dIꜣh.gLM8};S?qQKgƌ[9oIoA˼av$HϯW:@ d^r]9=y t O<#L)U8)K} '($mtȊe?? "S4#IrØ:!|jF#)ldSD.K:~=+Y hGv,gT(r!`}^1rPgiTSdQ  ng<DL(̜8Kx56&S!t&w[s9 @ Q܊xDñ@U>"'kY5ӹ' C+-̧zHc5w@CViJ MpL`Ud]JO{dӠY68X&_o-ica*TdƫZdT ޑ܁i9W¬VGn%-ZUo+w1 Yv %g#/jQyg&:$P2wWO ī"W'@ҝVnQիJASI򩪒zqS 9x :+吪CZq_qbk-{ryAl'T-d~VLj/=e  һ6!`/V^;L"λCׇ1`ĒwxBŒqtBDpKP3qY#@PTT"%W@a MǺ&sv/6`]KK]`A)4o0O2(a/L?E"8z9s+dZU@ /dZYᯨ\e'r2OCv0R۴ c㰜@"6M(XARFwjynpj(h ~`6)=T\;ֈ45)>ǢN%O5SȒ;Rmy)+e .E `"ܝzSk?~MߒwL!j5qde*PjB%Vfv%5.(aW^>8r! _"S.Q꒮ t.}T^l|wϻV^*^x$q*ݵkПa@p+n1XhEOjv Ja QZzhҤU9T׬5λᛅߞ>Yg̜Ap {Oq)J1Qp.\i#_Aj1O[wG´ඊg le[\l'u(]8Q{`Xo0vV.I_Z-("OhXBio`mPI^AN cr^ReD' 1 <(rx }[D -WDȆJ;}\]DqRW)>I3D>wc) _Fׁ)/LO09"Z@ߢLҫ.OJY:ƀ_i=쏐 C(T Kcm@-#n^ଋI 7U4[W8@E/u$53Sݷ_tK0Cڈ"'QꩈIq4?0]S~KlKnbbΆ't A#j  5&K8-.; 4vk(GS[ɱseP&|j WxY=ѸN!Z\KlWǑ*W)N ;]~fɑDNzWW+H[Z^ _; s:l{&5? +Ya sH2cK2@pA9|UY*L^o#xM(:Q$/>n603ܢ³ɉ9^ֲtTFי:9FO~CߛC'/s㞣S*e`Q2vB |*dqV+X+;!g "Ps,Xؖ+gIpR'Z Z_Qʗx.LTgD2:VǠZfyPms 5KAQ[.4(Rj {oKJ8Sr3D㐅QaDҒwD(Vl-ebJ:b~WHW^^}E|v"wshbIIso<|=ٿ hN xl׹֍ {vX*+h؀5Q#>Yjg~}N4Zr [ C66'&1DIl |K|q$L ČUw8Xx6oy7aH@]:+@tWRѢDאn0~#5bĔi0љ*orKpdc .} |A(% ˞'+xn ZxhsڿN A[kab|3(>-O0:Ct)J9ՉS! H_S`qLAB(L Ohu|eA.r87Ƒ;4艌k`Q)?L":cl N^ \4J_gtUE5Uxu7iG4 tGA쯒ZUvnXOcG$` -#x|(_lAD4TU|vn'[mtDF1 /G-m'Gk% JݠHY4 +Oۮw",b6:/mHۜU"=pH7>k0$=-r0ÑDSPч]VNj[S>r" w&/u2UXj*4'i#EBQܷ^8YUJkU`-" !4 +爘{rY)V#U4=v> T?W{FX>R&$Ɗo_6n@s*`/#] ǫD)Ih6ʔ^`C}3&|1?%V[xvFiv^cguU8vV֪OMq=/u;1ƌ<2o'H\c' 0DIsDz+5=NHt{H&1d=)<, .8tI S7=@'"%RbWIСnX:yi%|S(/tp;{ޭp"ͼ̿$7h9S@s^?.[8芕 FaKVb`JD/ R8ex1T DO@A)/0`(m[t]M1cFvY"5b('y[=֛ kK![z[r1VW.r!#XC7Z#9An5{e)^2ʒJG1bSHt4"݊co@<Rk ӑsB\?]z2C=pK+"z$@[:#ҹ .Mi :QDnl ʗHsD&|Ə/ !A󝡏K) 9ӣ$FSIjmv2̝`O C 6`peB-kUrr|@E?4똘6nsShb&Wp6]'*V\`4(g6?^hi8$Yڜ >uKt;b8>7}+d,v*G`J$>S]Bϖ/vwwt^t=># {] Q-pڜv$;[:Vѻ#tR "#@O m'Zt*Q]ݸd^gǣW"9 KC%vz)Wb݋DjWWgsyr'obQKc]}h*  k0|ԃm@ nw΁d}1U~偙5; vmIu"#dI-y(w?JpF(xT,k"Wq. h1X1 J [ޒ|v(~Kӫ6ɸl=> ]sl(?ɸ-H0@0);!?r<84!-+L$ukR|Ml]Cl(ˮ>R~;Qb+$bm_K={xG=!IRJۍi:;1L6 D`7eՋP3xK:h?;dIw*3"tf+oh ^Bmd@bʓ'\+ $j+aOfph0gq?u3INrlW^||,2a߯3 1%,LRLYUUIFg>ڑ)z?*GzW~`r7em.$|\a-w)_*\t&)` Tv3QKZ?hSVG8Z\/ԳxKlbʹZgd? 1:]s<)0PY&)3}'r'a25['ނ; a9GGg-mwE Ab>5<щMdD9*x8^a] Dv N` ,| ךp*2,O ~歩^á> h3UMV8ؐHa9ib# J7A]Ԇº/N8EdwL;v4 w@#q4s|AaZsx<2(n_|r9=E9Y&=!sjq8p$p!g:ʾ1&QKjXQ*eiQ]z*fCYl^芟'Ow^wWy>+b0HubHiꔁ2 %"mg[Xaŗȿ\=u~AڔܐNEFTD7&mW#ve0_>JQBv4}8 [Hש9AW8C tpx)“tQja 8pAJ;ACN/rE9RWh:f7S LhKRm'ti󠮣e@U ʞvFXVnƂ.h-tOz3}0,=Qt~ 5ϐehu_qIA]679N#{?mgQ4@5Z9%\0S]hht4KؕX-| Mjᓆ- =R}Y\.aoHq >}w(gU >/pj{,TUIH8:t:D1\9.p ,[u%trUc 7\\s|4ѱ.oj3ЂbT4ր{7L%7̓w̛|.ģ+Ъ :ڍ(07m/XS=Bt:i (b3q68i> ;@(M:2*ƛ!S@i q^H%&yzS= ̛nzNWGQ]UlQ\E爐>J4+ghpSSɀlC}94??= @]XgP+t+^k9WSĎXiVEvULِ(Xn~1;[/뤀J):Q g4c8dH8fq]@KTH`B'.8 m AN}ox^~[\C˴M|awCq֬QMdRO핃@E`% _F * 'YaV@TO.նxߺʆ^R&Ky㴁0xLēU[SE7gtUI|1$iVO /Wz W:ñv/}gcћ VSWx!Gdgdd) 'm+$ՅBZnr K#rð j68Aޙ HkQ]5/Vd!ɧ,A9KnyuOSڷ[_|ߓ;Y`27nab)B㋴7h OژtrDZVGz+xv&lh@u1>i!\tQ=~ HHFHŶ$7cRNIxHGAVqz4)6W΅֏OC% rm 'a0+Fk Qf,6]!7){ |쭮ݨ[o5`xw x h$)5̯ww,@KlCwyQ rXFQmdiz)ŜZm $iَl#o\NKmd 9Qm],vL[[q_GǖpCoMH=ڵ"4d>]06*vjysYhbI;V@\qgK D0H}L* tN8'd ;&&V9^ɋ2G9\$Eآ7fэ$I7V}RēCHԂ??w, (P{_} z%^v̝4nu]Fz#Dz |dXA,I r5R̥88K.|iuH앋: ׍QJ#X~x<"\CwS%ajsƑ[]ϦHE8Uhq`Ҕ^T ;cmoV;)9T?ߕ%)٬!/VתцƩ\,V{6yx"v)\]Yb{lB YN**F$bN{MdWJKY ?NzU;?kΥTp.j*t+8Flw3?`6ڏ^|Gnad&&"kk$m>tsN:ym\JzDcogt=*LthPM@x& [kԃvxӱ pr}2$ɆY`ٖ aҔ nPrdu~GZ +%|60P*KcC(]_Cj#l3_=@+R%~̡P(K~P%igM,UnZt+Lܣ٭@L_-R6?~FlOJecPq{@8D 8\R1!hFxdmZ}X.}o:VoZi]FY:g3xR G(ex^㜤ífip6ʤ\gm@BQ_9Ѽ{=P%\ؒ(EC;@8L:=K$Q~sѬ8ף[{ݙF<3swlIhĦv̚8U52 ̝̞RNʃ UeYҳ`v3} @>]M&O4 zFd <5-u󼦲'?Z:]l2*l!PG6x[l>+3Qf>*_X:y&([jBvѾ|` ԍ%, ^reT lЗim򫇽?'H/'و]ɩ*V{ݎAXꙜ\T.Y;ln1_3Uқvؾ9۫Whm \oh (LtK*Lp2\y4Dnݝ^-vpKjF1HztЇϟ=a +6n/]C2ǘr$Ll< L?wT{ۙ^ۙ=~bN;O:u-1qH`x;N:ٛ/}<@@H[pãd 6~ 4fw 0;8`V;(yi ԖdBXY#AW_̊0gsƶ},# 1(נonvya6 w2( M Zsy\NcՒCrpM"CB{S{g4zr:?% U{>eԿ% Lc0UƳlO<)eO` @VeHXxץZQ7Eͭͳnpe!=tӷPx=%zYfZ)&Lw|)קX5q}Gs2BJM_9jȡK7Y0):b6+ZGS!Ep|Т.B_AXDKds|: t\ҁv9i4?Ϣy"O*ݥ ܙM7WG8`lӸu^?u{#Ͳ(k.a]G9S4>a@ ^n9 poТ$1.ʲA4 csܒzv4̡x?|2NEG4,ʅ'8?&C>y3Sr1%&rSYK#Y.UNB;uDEA&kZ|69~ϖ7%ř#o*.NY&&1I\ߩ<~%w}H V=:]%D|{5Xb8 ! 8(DWy/Fgįx}_1F SSx8YtrqNkpQ6DWo(hҸ_,uHT7BX;\DiB4¥3påTEoש󑦨|g] iO]+qArO(U]GGYboP:aપ\IC{L2TYSMe(q9m4bgT]RZ{&C{2Pll潥 &anfC3ܟ1!0oVsii59^(piאORsl`:t=d-Zn0HQ\:.GLMEQs?YaYJO^rfa| r |1Bh -Օ_nYnRU%!~V ;VXx` Iv[|t&!3c9$i*wf`mAq'ę= PHE M+wpⰛ:n"zlcq^5$x`H=蔘^]HpJurF_Qw|)`{n4`eF1yH02Qo娋!wdaFK/Rq>Gs/pQ(I"01rL>[vBGDo jsc …0Y o}QҠ&-ڜӑq I[TXz`0܏hȌ;We|Hf j@>pϸHf AqպK3(pXԿg z5ԍ^a6{u.֥o\YfKL\tÒpvRX3PF&x"Z>2o똴܁_ A<2O!MҦMOvJd/Jnz $ElbNe]:L8 qYf㤮xx$+m;蔥t>LT$tmz_GhIȇ %.t': 4lD j`~ϵFlTNMFW~[- bcp9Pip#s~# GiݔG!HC:t)Svp Yw琄/dnX 4h*fe\<"Aγ,ېWx(2°=ʕeiE,Dij̄WwwjYT9!c9U)҅i!%`b3M4UG8x FcЛְfc5 4WDV5 OuUҮ|E4:xptG.sb m"+&Ƭvyѻ9q x>ht- hw2zŽ{T*x*f MK]q)V1E\,K*QH⍵5S.M!<8XlNA"[4(&턡˹t1<[z o uGi(F#]T80.5{j4O=e9nFa[ 1.1zaZEw֪_9$>T:1G?,-mFlY]hj*:3FK TT{ViUo$[#b$=@:!g2tdU+O2/7ZZC*^[NM7'F4z:wZHQ Yܤ(G)2]z ;ņ/c ~pQn\h173O_LϫFDn\x][I +͢%/#Jgc/cl"V]'k ,R5lüQ\q|>D7Rv[>$"D~ S8jg.J^J/`$bb$7"TXDCwa(0YZ[TE[E$Cx߄kr5# ܿ퓌bq<?2^0zs63j<{z6 ZH)bɭz0]YZx;q;D!V 1ɸϽ)Vf(1, =+$e⪀YPyZV|\xS+O5]fNvmoךH໫NEJFpۤeb/S}t?2WzjXRhK.e^-N&A~ ϊO6XK1ݛFK uuĢbwM ]D B}e׮X׾B W|A9c~28!q]j=+ r;A*- <:8#1%N+|+n2}-˧.Q +P=(jPrAjQq[գey#j&tP{. o;DGc|oPP`_S.眿 eZ.`&ޟwZ}%=}f.|z*b2PboŌӔkHkNسT"SrK. /=lV`b#@hwIYKY£1% X񩀺FR}1e4AGC?S?5GY1a:j@ AϏCj 6'!9洁2Z}H y?LйEv0+de)jyTA} 򿽏=W;hKt.`~\0DqZ6y`xq׋"? < $ D JNU҄>j*ƙ7@ w V]*T6\Ϭ4T vOF b3M)@0+@!v>az$pz~J REEE-Gc>T:^MHbs`)쓅\:YyD[?&̞̀ |q\H<]&|^)cΚm \ZُH#>X%l 7#;*u†l\YZjp\^βIY+ǘqK VO[L5*U W/yW#)pEop 4Us#5$ٖKOO/PCkC8O53<{%,(ZΌLK}4e(nyƚq.|d(9G>oMn$iK.b "=v}tkIV=O0 /FL8ԃz~p]VY@+S$M"|alGʙ9u7ܧ%Z%Q Θ#چ2A>)槈޾Q- ʢaB"mnwٸcfBg/]i4Cb*~tω:Q rXG 6oR4 Np)RQ;Nh_w`=V11KL1k"Ya .!n~V>Y@8 ͶάqG{PWGdaQ+ |Ku(Q v<j@3#Ns"^ނ+!Fxת7rIeߤZ",;OU<0FLOZ.14u? }o]6NN? 3 .&),"1!W,J- 뫬fjy:6EqTh߮Awxu N9GXiA7]d"GTѩ党^,å4>nʔ&4m|F^ YYFƽE 0Υobيիy-zSqٰtpnSΖ0{z9[3_FVY"Sde̠sңwɹ^l7I~I9.nj064A߭L:5W+E- 9L6AZ 4M'ݚpMmGNǚ=?{T_+1SEC1KE(3P~}xML&anrW.?9ڼ^M$Qɤ[H &tZUvY `)/yb%BW=MHtIĝt(AN,_zrd.:5'Z5κA5FJ=cR~v06Ķ& ȮLVV !$եUҿ3Oq]:?5A=YӲgJ})ѱ {|\ӄW*E燢xSR,}p07}1Km`74"VA+^T  =**x-АVފ~"5Yc:'F{'yMfMȻ`jjNrx_е6~%k OT@/gﺣp򼗍?bDq\\, 2I_oruM8Ooz17POlɉqu9~ w`ò8ÝJh5Isps. swss4Mxx/6N\;6r]pDC=PYcѶ.&m~ύA<LٱEŽTd[:NP%4`G8\p]7 X"ŀ=8iZyZНDr܁+ZCA$ALӐ֮3kHPֺ)U*LpDML\l/gZVׯ{jd+,~|B>H:[G@0d~G3]"%()A9g;5Ա>@.3=?qK,b(;DǬf46h2k xp gwER{l._8 |b]s;FCe7\_5?f7QE P tM$Yv.e5_¢ڦ^MՎ7Ȼh)58LXuF8aZ۸q0YG</8t(dihѰ]N pr2F":N_G >1͕2\H$<$b4 enǼw4-o;D Jvcc"Nk}6#olĨ򁸡_ˁ o&/Cﾀgr^3Ͽyɡ/ ,Y*q`jlc_a,g|ܡ|2+YdrnԊu,Eͺmrg1yB]rNhD[ԡ3 ri}#ZwC=i[Ct+;} ! p'r۫0d _POI9" _-uc[bEThƝ ":^6e.g2HVx]CDc'xrC~nU ЇU3K;|̸P5h TW]̨ I8hcvU/{qb=p/a5.9>tD>Q-u)F+l?ta ׂ"^)ڀ.Eu@,~uHnN7 [uItqp@?=i8L,CCVv8wc{<5(Fm@_wsw.CB¥![4B% ,};#4.T^F5ɪƕy-*"/}y)Ud㚵:zDFgcj"u)\^i1, @,5@6p(L>n!Rk0Gk1l(CXV`qƜ\fFbݕ AIF۞Yl 1oqnx>>_8M!T$~OM$[qrx\!@TSw$EGÙ^!*UPP{H\@ZeU?w΁\Mp) Mݣb[)npoe UiDVmںAUhJk@aCx)TҶe,.>S%HT1A)]dYI=o@A3U&Tx#1e" 5%@5[MP)Ӛ ?`\ugX"=?y4>an'좊-QWEk#tʠ%J:ETdGG3萡2Tv{$1VM4VPɁXLq놀O-B{½^ffۭER!li qvU'Ԯfn˦k;}lI'Cs&`K:Z()>qb7nɭ˦XP,\ z:L#$uv;֗Nȅai FfD]S;A-Y@fPZG| xdMؤ52v݇6nXbdkWg. 2K}j\]@`+;jmL ]걻84@ЎM2ʇq(4>,piv܀FX(wwè{ʔ%u"=@g䯨(Nf{IDUwPq7EÛ4inYM(2f"1~x^uB_mzVco1  !QF[x_!͂O~#!Y "~allB)Wd`C<e> /. #WS⿟/暌tȒkE>{dp4Ha`f'>|~H!̙'nZdqytW]|sE+Qpv:3=|h2jeTJtE24RG!r^&tAs "-q9t:xi'[j,5=d8 5 #"y+UF,uJ no*hδpNȩEMp َqs\8RA3^f?UPz!2Q˼g 58\t>(Hڙ=9MП^xlI濣" #;GT\dä:EBP.M؛ǫ.|yւW!{c ƿm m瓥xL g2$!"&sW< |t*%3l<Բ, RY_Z_a-|HVsO-UIWSӯx#<'0ي[B] +NSd/6d{_t+!ii]u'95rl\.>"sFnh5 w )|WEt:7倠EaP1@Yd=قر0 0InhxM54֝٠([aNeh{#b8,q5PR;`cN J<ؓJ- ;J  ]#.+!%Pde0,7Pdgy܋G\ϽhO{e iwiƨҏrqfgM&ꙮ5(5k8 8#o.^^澔ьmGOxb|WÙ )=%]O_q~;qHH&۵ fV>7 0c2%-ֻ_oe˨(q.@: 0[ {ӻ#Oy$b4wEiux-qq(1%]p:qh*Cn>e"yv:8u,?$ :ށ(ЦcƌyDABPH0`9W)kl[k/vYYh5{R|8&aUz4Dm`Fu?B33?4Ppѣ͠[8Kܴ|#J9f+ IPE N*ڞu3TE49+kQ̈M06XѰ1&>Cssю猢NYfs kȐSNyȴu v8Ԣ?65 IX* Tx=d[L}QF}.CWu{/;kyV)STx~`VWʹC nfT[rrĺԃNu$2 R"\+ цnC5c(Oa[^"O ;nt;&hNU|'*QMt9f"&g8#{ '־[sۈD YA[fs81 6a R6:hkrQP`W qaM I±Y|I8Y*Ut ۰nb]3`P97.*Vkh& zU{KȿTz5&ҩ  B Bөr]K`>}b[~>p 4vⰴB،chʫњu|Y%b2̚Cc#څd͟e%yI$|m[l^,Aoi3C33uZu1%ɸSx>ƤdiiEY ՒGCMԃ7DѶθ錗>S/nG[LX9[gԍc @ɔpn;5KvzoC.¨s>Y V*-fc~&ӔrODlh^THEwV}wMh7frRS1"3%zv+=hKERG4_ӭ#J|%}8mA4L4/g-_-=:ڟRaN )zYgUe8ĞR&;1sy*7 `%(iVr5/o3t ͚=.E ^;]^.}ReRm^SK5A7 qz>Va>&*BOۿkIi>⬺13ΈbnsιrGdr)[safXUg$)kdoE+B%&>ZOt?A^JXm-Eށ6غ @><`BL`^G'o_SC'&^C2CMrA+Rfn<4׮v _S7ώ% }>Gn;F:M+r?TTy ?eKHO-17oݭL+ICȮC$7}Ye{=蓭V]hg10ܦmź,y+\=Dt^0: ܎75/R]wV0{_F.kHD Kk\>SR]$xukju߮@p? N1 ;ūkp2Zu.XCcEQ/c8$ `=KN 1Ŝ 8WcwZUcтe-D+pSKW+ opL!#&ա2=%1 nؚ[)K/]u՛j&-7y')b 쥻|i2/^M:RLv+_p؇K?M5a14!':gTtm89g܅W@{Go@81)h!d팈xR,IwJ5{!#6alY0lF I, 3F^es-aqFN\%>OlɍB&OlvG3E4Cd6;䙈9Qy3Xo bazϘR#a8+;0l]a˱,EXLo1[ ܠqjQE$ y3DZ.Uh6|`1>GzDyxxS! :רٿ`D),G_'_K/~ʜ[d8b? E;)pZ4;15єyUY6=M25ZW\4<mTt2+'ˬkk,Gge*ND(W G> aW2KgYѝJ:[O1ПcfҾ)4޷]W^d̆NFcu~XBIъ]2,#8\X<ŀo #?מT,5G/k>[w2 jtR+uob:x|Y$盤y{-w / Vy}Z׌@)w\M˛[(c\&쾿fu& _\mU G&]K3!P˃pnk3 -Ų: %R) WDԴeZϽ9Sa yU:񂦜~ZRH& m{|}juE`WXDĀѦKy@n&|zΙy:qf5Sx_宑.٘c#(k '7|B)0(,b>uU-mW Mg k" +8RHl5uf]rrOo8hV`Q\pѽGG \>3<6yڃ!=[[a`[S$k{`E F] 4~n&F2`x,ނKUh[,^ػAˡYz|(r~?5/4RwS^aE_v-'SMCB~$8{qoc>|k4"={;8v85-oj4~߬Y , };5z` VP)BrJ)dv8EԁhyRjg'S|0 Ԗ,˔Qud9Q !Ї1#Z(|SS-A_a YuP:̰ah+?F@Qj`ҨB ƀU($s8cZҫ nv)goӴuut-y`n mQbt'2pnH-\A_(?eOմl6SZ+w[J+A>b`q>C *4JyϢ4Pt_ zU'[G6/S2єMVb+y߂;P69}mHsaƟ2A7b\ꤑTIV{.fLĞWPF# yb1 +7J ҏGZ%_WH`xHj5xY).bOna_ū6Ş ӊV-O9sNF\N~jA+tmnB;$֮N(/~3*s0M;,,7o?iؙ-<v @v7(`v]I80Ͽ-&soDdP(^[EqAVSD^3~E6?Dۓř,nsۃ½8>0BJnBTZj[lJOpQ<%NZ#P|==ubdE&rN-7\X b}o m(c5?@lI2!;bL"?Wr)܉F?Yڮ 7yE 03\@I̟%j܆v8GA`ALgl?lfoYFi뷽shPޅMq\ X|B b[սE'E ZYr  Mh 7@ {yQr9))*p մdo*Z3X+"Vn:.n7P;( 6DkOyoNE;+Zn/_Fq_y^*)1H>ͥ?\$|Xyv J X~wmA< !M1NCz{Alы`spK``SpgM@8s<wi]`@@u]v}bOiP0{E'Ɣ nrXqEEh&S{v\9V(t4B:CLÔ 2%1 P{s;෧&ka?ǗBk ur!Jb9<F.i@ZVPM睻}rU%"}؞x ey}Nr?gV/9|uD&j {f:?̍xܑ"*ĝg^/Q:{8m@!w7k8i-u?IK,{'N4jO'D=HJOT 3w"(*@>")m^_Z Q3xJ %ax@aK=u>!ɟbOn[ t&vF]P vf Y,|R^1hF |zvqW=$ul5Z 3cڱ<'ᰆ%vaNȖI_&MÏ8?Dۋ*Zm)bҨR!0SFC&H:R It ¿ajXC^u@V!5)2qK5#;`8Z.|tjj膢VpgEc3E+/X-c\V4=@=RD"HU,\P&^ty h\ceXSڹ4ۺ1XM152Jg#S3tǫrbkcն`B-+m^]ອX་Tˇ Hڔ )bPg[.@I3ߡlGf4r}NН"9lR BƊCekWSyP^#"|sGfuK Kj(HAG*@9nz=ܝxP{(# IƆ0<|Eɳ{,-xbjw%S^̅zҲXNF CAO_\TseP.A4 ^V"(l&,g[>ɕN%մ3<;c  NDu:uJmL+5v<!#$Y__7Hk:±lŜ6'x;jfLtɆ;Z i[w_~9`V_&rU+ !)i`_1qSS)=OhKeP?;gV Ӷ}\Y:aAc?j^ײS8Kُ/Vi痳;o~dC#naW$l|pLY tOAM dc4uCB-IxO?RI{YWǴ `" dЍ߁ %ޙkx~Lgs+Vk`?KQŃ5vùdETrBZI[uk+#oYΨnĎF"->JM6J֗b ` r^L`kɎ6*R(;֘:!5$Գ|xxəpGAGs% X6p@6m;A Bv"4?ex|(9ސ,\zSM P&SIp葟@y %{v~+TJxXe /(̪{\\*U^Z|a:%0mR>DǤ}wjA.#9DH{G|4$#bÜXlp!;b:bAR=FຫUSym\0l1W"NqL[-fiqCE>7"s6)ʵqA؎YHM~BZoQx^)h@P~?Ƽ.%7Ju03PZi9[횃@>t~l0DsU+WQ }Ҹ4ě`4|:!GleVe9^WG&Y`7n\MF(szrp0udʕc9w@b"E &U=J q#=):_/Y1C/ |T> ,lJ*bP!̔5t`8}#\z̲ m'He4-uUpQuJ>x$&?0fBj ZܭgsW ou AGT $ 6Mh7|!$_!ɯwJIh!-afr:#ƴiG夔eڼ1}ચ9[ ")wzLAwoא1^ïRIM`1~{ʏT< (Fg!J‰q>+HCǧ>vp¶Q0 d9 N6Ad OY*z/< c^ݨXhSW δxހПHak.r}3ni?LUSuc%4~6}vF56ΰґBHR`'EE_FSO7Y'`ac'#_+9t;V3@r)VDEmn_m;dJ$vY^#J0: Qݗ~ m t`3-~쪯A``R?k~B1,ۑTw.ʽ_FĚm|fh"ciQ5\G:^Q X$C >=;CWaoqVWQIUW4uV"?e Xp^B?b͎L&ظQ|7IvuRt ,!pGlq'fyՍܰkYvl.Z*UaEph6zpBԸnr|a& 4 5p۝ 0};霈 u;q݅ZE``F -lW 3:%Ry_FMQw,Lo:U5V,Bmp޶ZNS̱HQO-2/}ǖ F"7[!- h? =h(%Rh,TeNو| m"K:1ZC<=v71ܤXn!|8KIzΊ4] ;0 ڷ ~n"ͦ#2H-dXH^appݩym~3V̒y UF ot~gk8[p 3Z(2ҥ~열n|q9B}{=koa#nMU͖z*s>өopbt1KRQ %nt1m:QWx [DLz6|>إEbzJNF $CGQng9K<G ETl|\[ oru >$_ W4@XM4O'Ŀݑ( G+O۠~4QXou1QYYY<R #${tZQ$ 4ڦۏ:K2 S$-G7‘!59+%V3jU/3$Yt > B"+.`/rCEx(Qjr.6:oqTnc U\8\s9zrLIhTDi帾Lgq[1E| vo~N>}(KyӸh-}mH?KHQ9)""|["02d{#Jw]:nzi4slY6 ÔMT- 51M:|읆Ȃp462ķAKTer$v=d Mp?_"AϚ՜c>no/r!%\2wGƑ FB @6d#`Q,faםofC׌3pS4嘄-"Km C(R4nb)>,߶z]6մF7Vwꤜ 4[KЁǁcuA0='/9n15RNxFG-\C@\~Ayva^G.[ F$S5{euN~h݃՘4̪\ژ-bUskUuJb·7⫞qI=ԣKҞ@dC4& h==C o32*6?VIi pa^m6o3%?DߘX!6s1?־!ɝ0/t14UA2W,JY-*s!h3S pz o9 o| +/ ?U 1U4"{0g3R֋k?+~(1FU[GIUr/ 0;*a1t<~mbY7K3쪸rsj}?3wʸ+f2oW[rbmFuRr\kguuplxhx`<}FԚn-Rϻh>j9/{[=KowҵKRrTΩ$]n56;oTH6=lc'B\{擷;jQ9{zԲzQ$fÈ6P*W9qsP!+4b CC( Z t  T#6hVNE|p|ʉ QB=kWbdb8qY>"l Vq89M:ӷ 暵Xj~UZ)-zd=߬EW[6"r.PK3Mp ~iUBVJeXV`,c|0n7w? Q^XnWSDNU9auzYỲH똣&Хo,eYT1w$G1^{.Q$ق _8l*\1 e8G:Q\uoƐor揬b)pUZf0}ֺO JM#R.2R6 J2Ww(6e-GNmM͡ &w Sxb)ɷh#+4ΔɲApIvEy uz-ׯ Y (h!yK 6K?r+-Ejop}b~PP(ك`;ɱ֝(Z=Y/a@ЇD̽KZ%шVf$q(<)P7xjRk RFtXWGZH6t75 ~B  [#JlYn}/)a=K>Bs0荤K/?-VXTrmбGH d ጙD$urq&3-knʅyrj7<('n贬&$da~]Jo)HZ,oF@ߋ)x7KY;Lbǃ &c0[#ŘyFv,m͒(P(Dd f:RtPH ]UE+G'ZlON2./\ajn8i(:ܢIi zbqys/^ i B(h@ͬX n!al݄032&g,1~ze24nJ< R.= '"6IIMyE}y@ N=v\=_$)i3 HaWL 5tʳ(4J Xƥ.Xۥ&vG5uԿrP,wgLj'XT{ xWdG)h~X{:UqxS2">_X'XQo{uɅww~$ȵ?-0G:z?w"rS0xQ(y[W/ 5j4O}K[J| d"?*2}x&h@.; \F ctAyGG m>4tP̦+T<mbaX6) Np ;kjQG4/T!]D^:1iGٯ[fpj$>@NNesf,/a%깒%7qPL Ud]mo󎭈60A*,n1`,۟?slc/nG S2Km&QKV-A"qqV,gȂ*x06/E\Sbx l vy$N䫐 @5-H{mH- n[ɋDN V!nnHB>~XXH1#gZS5wk79P/o?sX ?]Ҟ() 7`}F{~?Qz|޽ *]p=m pC]N$9}hU&w[x.=R'y5Svy%C_@M iO5מVyh'w,V08J>*6Aݨg98^;X~ὉSp4s١pFfPm9HϬC{XwLxPnW=9NM/H|a;A\"Z] F5Z:] OYm&>G:kSn`A #1_<AoةM+ WE-B;ȆZx%S:`>$ys.w RfuP<<<ƶ7!z~}3(/( ͟ =nKH]51LoF o Eă<5(XA=J4ν!e?S/A ƬCAyLNU  ,.fqR8!ι1Jt.!Y wlsa}`1'~ܻ'RtM;=Qrr"$ ; ?U/ s_XM+R{K4T ڏvCG⡥j?A:I~|J+M"kl,j\!EL#\Y8pu40ֱ7PnZ tafyƔrR#l뢴gs좹[D)q7kmP/T|A O&-3R;u[rS pr,ZDO=$"q )?(ta _[rxs):TA'VJ>xMatRHT]AN3q_LS!,bMY#Pw1Sd$>E̩!I6gk?cq|팿n];l-$+,x3SŖ7ALZ;( u̕ C̕@,mtTkύHF6vKH8drˍ1zahS;n6p8]|Hg,iX'x 1ҿ',Kgs8*c\@\L{ic15LJWrG0Ly\PdhAFTѸ/meôi!~{v~_ 0':鶥YNpU+S[ڽv4$l6KgG$9!2566VJFWmW-D{A=r!0/߹(Du"mx#Eƻl6uԵKv43N|_a owS/W$սL&\~g:Gk* A"@Iȱ9nrU?b'Lx)aoHH.vXu!&O2Eeá^fJ!.h^iQfK RJcӾcQ4^u T/Z*MJdٝ$i,nM"$r. ?ZK˹Od>'H|Ngłuϋ}d+`V[:Lq74XCR)F$$A_SH s zCgO딑Rvh{yd<<_y6:󬩸r*f=+݂ˈׇEN.͋nԢQUvEY8ɡ%'8B²ٳ Ǘǃ1"yE&j^Ntǒ{Cċa\B|G:xZ*& ge1мWc47rw,ܭ|"H~.hTgOY(T$U#+!v_~"=Q*q&'Nk2k]>7: Ê y)kkpk]ZX+}Hynz=ewv[9@ \P`3]gBD; WD CLJyHH9~Щ?79<&L]o FfMMd Sk,\^GcFGT56z%%H?d}z,5R"3,-j6?Rp #nL>\zC0.DGяc_O'+*a͢EA[4TDefb)eur=pcʁzXKt$gcGI.>P~30!BEsbיA3%ilD7/x|FL_F+tn +w ڂǞ9Aj?]c;ng oŽV`V7FFpߵjt].BBYWa GĬWK+By),NY8)zMGmkd;:80D>{Qecgk!h<&"a@[gREwѐ1Q)sM>B:2oWTt& 6.HiXLNg_KUɬ˱0TF>5EK! ۀN*#׸J]ֳrS%&+x`K6 ^B܌R;fe9%\exvFL%NBͬ](h$AMVgR ,s&D_4ϣ;PW X>rφ:d+a|U'gsSgj07 +K|QT">(Ny<<V0ZXhpN|J L$ iqPGbOQZ-57$J4-ZzC0Drs%"?wWQsy^|K.wWxΧϳTNO +]KզU϶J&aYNsR=nKwDh _o&v__Ty/ :ӒT==r A4]^! RXv]>/s⍂ uh7>q w(2M 2a@3~3})"rxT=YN$ef1Zچ}NJqv3 <4(pDD?p@֘][Cle騦0& V1˾KS1oYL?"Wf}Uq_ w-9Ui;OS "6XANp8;$ӗErbVߡ`qŗB:hwvSoY8)Qi.ǵfSG}Z!n MjS!/H}>Kfi\fl;7z٨(@z 63ܳ90S$ ϩ#o&HN/+  kp%_X~[4BJťTWʭ?{ |HG5S5 n ?C/~m^wO2H7e1?bN#'~B0sb51PGPsD+??ߖ約LW@Xs՚_ H Y_KLt%AlU{k~ `[bnT&JM_]W8oϤ&?l߰m<6fh!^f)z7=G+AXJ/1.\ӖNݺa9-uFGR#a5geq[[ͪ#) G2T͛%]瘾܅Gq@v;%|` E-[LVh0M V@Jގs&FY%OhXadF`*i{*G_M%Z 09e#m,mwTspCȋX$I.&U%rFV xǖR4 < y6| U_j8v>2.?2dg5kvJ_"ǨM*}#٣.])bnPag^_OojݤC蕌Ւ?Ѥxo gHVC~E .{S}VSdkB:ŷö]z+e!ls6yXUB몀W_QHVz[j(ǴE0.KjzʅϨjDejCR&rh\C*"{ѮUBa?W [%g?74Wv6dF#fށ1|@xo}["xopdsk0R/ UffFgP*O F ‘O|Ϛh1_g@۶D>$4"q>Rɽ8J=u6*g}g"jn}~twD䀅dZ}sZ~0J.m@Fr%/Ko V(и#$c9*SPU/}P6ai?tDFV(MC,3.}V4G7.!$3831v`4s,jPޚ'Ԗ u~L<RS3g>ݔ-v+UTCIFϿP6+d=*hSDpQb bS֏hԸfQxʬoowVhp,AMH Պ:X\_x` ψȸ㝿/Crc^L$j9lSwwFNp NZ^OI r&Cb UT J_ۆEm9E>u~&i_~U9󬠚t L$%z 쭟[Rwg/ȕz5Ǣ9aw UmI|QS2e50Er=r*)&pM7bL %sUø;EiP]ܚ7߅RĆ`i]+v |YE1X-Wړ3L!KnƏx 1)ob%3 uQOzGT"e:D:?.,/Un +Oz:,~"j!r07[UK@cG;iztM+H=iR0]]sȤ 4òeܩW:jGTyҎ>Ci+d?e,)p[&.E#hfᥨmdM)8o9\MIl`aӿ _;?[~~lAN]1&I;/D^G& 0K !ەRH(!Gnt_0 `ZZz^wcɚezN~,\!=T{\\lrGY S& _%aȰgD]wiS1&f!F`J +N;3qePE"6wNm5Hk]0l2C*_]GC|3!вp:;](~#b>湃ڽo;ͧsOQdY]Һw9v%K:jR x)[pI- -bX WA,q1 >n31XtGueɋ9Z]fF̕T>TPˣf}i&!BKԶP>HcVSH/ ns+ (?iԏWN91 &oi)'ViړL9A!7}`l8⫟([X !еz(MU9HC#k"Tc8^T}XDW  [cϼ@E7,_%= Gx}zАQHցve胙1ђlu;"*o UZ%/%r@t59.1J9a4f5"k/ MO37hU@ qG]Df$ɖe\$}dЇ޸$_ZZ'*37NRM p1D)Afyjx9](!_2gMx"MI*7M*a^=2v~B3rNKe%;*$ܼ_"|X6Nf۵*dTj/~H_HؕGH届.HfnN_(r%1W W5]'tcֵ.vՕxsqSEr%W+iOAY1rBNWq*,rma,H A` 3oE^ž^!Bw[|JA_p.<[WZCǽuV}'V9;4#1*n㼀E6 /MStd* Чc>15]|?h%CEr{.)İS.c1fD ;JGuJ4qʼ y?L* l̃uLE|;$H+ ɥm\~$j/TW^:r}o WA ?U2PCQ < Gj:a}|IYx8n˚yetMj0jwFxxŴ9 7ZA KՂ K]93D#{&Jѹ}O-+MȑUԛݎ>¶DRNRļ5|) Z0h5tY(H:фSe#pgZ̿Ιm7}zUUMu ^0 Rzz.r>!U'=o^R/vUz-6-"*M*c3)BP%]y˨0&$% IQsQ%H_IY\杬u@ JQ}q0A~58dz!"6Of * xtP>5ʵ}q1ڭ %Hi6Fbى<ђK&*pd0>什O(hGuPU);3MCg #StBo4\I*2Jk*{(Yym@H*oFؼv̌ C1#l rzkӰ],|%:PJ Hq)з% XR׍M!%0C u?<1eK7 7"jb9!Z칷¥| ǹ RhpDE.߾ѩIDzg)S9}z͑Zת^unDXdcXAH-(+S @[MDUʊ#np)qd=G[I~~Lq$O3BB̖ˤs:fp2KŲ/2=a8[ ̳So]QOg؃:eFYO33~<b3ZbHcutv<5;)TR\#67T@~*b"H;Á Ak8jΰM10o+p TEHsB~b69^S( `gÖ|PCEX)DK\0!!ݴq(&Sk +n2> ϙGPa ݞ+81O-+D#tiPEGAnK/-FgY碳=Zvq dZ;y>L 'U-{^`6rg\_Z-BC=?Ƚ8j 9*% `$pk:qiy7`yJT#ch=żXvDh^Mq/`^mq?LD!@rQ$Wc'V0i<m^l/]#x[~[؞]c*@j* !Z.ג1̜HSۭaEv8Q.k;JefLm"GL<^CL\-9H $g%Uyt9*5ˀ_zzbi0$=yoL4FߡltӼx߿^zR ͙߂q sN$XꣁG v2%84]I#"$F韢 N<leLȝED T~qɮ} sBi݀3)%|Kbn~c7U~L9X?O ISEDbb&EBVo!rvXQX%hn+ oϨ&Ycq3×SEH&Y:P|m ҠNߌH_hx1ȟ6;V Tc7Ʈ̅w}ye5ʐ'GlāT;k؁ȚA S^YOK4wzSm #Ѫ*EuQ䡘C Me"dՖ;ݷsDVH5M]ZJiRմ^sg o^`CK Fҿ MQ%q\#ֱdkم0]&"QxwcX5'!;e x](/ٲ Pg(8wPZ؋%N8JEG^Ř}NgNQSz *7ZW\+z<n^]>.qe'~,h_T?pVdrcB39"4w4CG'DX?PAKdsq J>:M!aǤixD%coh/kevC_*^dQ)[Ԇ)\j'P^i9*n=XgVqhpW.NI\ #w_HHC=;־`IŽ`kO8U*f;Z/ FW@V:.{ruEh,Mcϊa6~zNV9Bu!dIcǤkjeN'H.uQijAEzX,t)@#KY+rH0c6iRPqD6Y*w1ҎGզԖK<+,)îEvӱ|wLjjC `*L?XEfCvT&;iN{M⍾ B Q^nen8g Xd t?_.I1B!0;Ͱ8lCB& \'?X0T2[EK bC։h atϳhrtnYY M{Njӣp|"Q]l&M*ܗLjn-{K }}f_WSȬةPL_^ Kؚ7?k=;bJ'Z~ #υ/__؂R5wHvt*` J/T[o;)Q*|:O-B~6 ^w䤨A=b+XڃOTDD(&W+!ҙqGsuAJN@}JS4TM72ד>̴n T37z/$SSͿ>j1btb9k?wtm[0ݱ=&!#CK=lk^Hd`MH%jGLNAVQ'K1sGD~*JLة-yj_Z(2`Yʩ [KWٕ{F%a%hmAΠ1S'P'([')L{q'KD9sbI9n *`اiu0;?{*nbP"c@x{ϸq1gpR\f,oӘ1D;T;f}*MuOZI9FQF`jIAntn5߷V| l 4\&k-ZHBtT0 vxjo_OAlU51 0 #RL]w֢l<k 7RXĺWt,)T9-6 TZC!s0ynMxJ;rUlgK^* ;V'BęnUKxmpS PW_zmnM_Gv96D1HO/8Lh\09^)2di,O;P X쳃il8|8|m#* X,bF 6BB~L_[ubN4:nI<& ]8L8=)Ų BoRBQ<[0][oc(I8Z%$GzƷӀnM zfHXdU=#zu(Ќ2SK@^6,Vށ!H%MYY#|:ݙ"zM†!G}#Wq;t^y y++ 9=ܣ"4qd2?z wν&ۧ`{U!<=\+n˘V(=1Nyjjilzk8y. L;(tCZb/TX;~Jj氃r;a[V9Q#?ED&c.-l3&ÆB8y{u~2h)ū-E_-$yޱ=>7WQGI5u4,[~B>69 5"VJG&Ij].un^`BF̶Ѽ٫|-m=}Dg=咧j;؃˩х@@ OxX9{E,2l1ff B8}׍N5}`'5],LQrϤ':;%bbS=}jWEz풻aV,q,_] e{ ߍS=?\b?&aW&ͣt0 w,&h.H1LU_?{AxHϙ3^&&-c"6Ҩ1j9^/Ip ͝'> #޵:g IT450>VX.zd$9Q3BXB%צAa158VE]j.3 3wwP3n:1bQ~iDȁv+r*w8ynLu+;=M{{Q; [G#(ѰB䩩)FeOc̋DN֥$$im)lr^݈L+ar(%ӊ<аKH3ǜ;N* _:- ݽt")k(]b`46O*<6;sǥ; (}q9;f 7PbmAmTK^|I,C0f\-[-E;9LfLxHWmmL;Ƭ ׿Rջuc"kN!l=pZmvR S̯ 1F{e u^Y[|aQeX O {;ĭ_P~ -7 'q\=#\w9_nb3Ϛ;9N?y  V^ Rs|{Q}^@JPcRį* e]Jp` ZU3WOgzgl#zWe&>@>t0-V SF)|mn%Եm)w\0֥[VA>IE*Lo7*u Gs֫.KBݘv›RvK,4*f^~7<͵H7aU]k r?'08…!Fm>u(Wzh2Z 0,#Xo ӹyUwsWrJԄu+dz%ͱΧ5g(1( xm  >ƂˏsY  @9=`YN|WQF\& chEX * ֫az+qg5i| 3df1 +fB\yhG KZE(D֙z oGrΖ^SFng&X tϰ@ڒ5-|0*BN>+9=˖tsI 7kfD ʦ{'=4#'ŊįHӷ^ d_&e',2[F 9Uই݃ÀN~O@隀cllO";e9QHK7AֳZ=nPX9`rϯqS4E/߅pIdy`> u^@;QKzY a'_~f~H,a^#, N@wTc˲ *PJBcKuZ-:ky [G3bИoV9q"fn\ ׎+ B'L37ltpI [fi?6ثQȸ J}\\6L]RuLXs,W(!ׯ1ĵI,q,F&wkD^葈cЀ$NVxa& ?@Xo$VwqYIWxD[Np {F&shvm(JUIY#!T+ n"Zυ~SӨyA/5%,EBLRljStj W ≞FkFN*]^ų00&JcUs]ZNa-&a&b*f>膵?0ObmCq )kS41uxt(=-8x)n@w@͔taq/p/7:H,{IC@YXp&C_>3^Cy8.P H7y.,qm!+w^" H_NëB$0.VL{֌?t%2&Ac .|މ8й}D|@|+iiv LPMOԝeWےLШк=E0." =#ݔ Bͩ$`$PN-'F͛=>[1ƼR e*.L0p?0aC% G99O+jS8DG/@w2;x)9QX"ml툉"N˲n(ix5X(}"wa4BOa lmr3MsqWl5Y%e_ $nt97:<mgYu}^;D7xudɯn_ٗ%=x碹f}PZk>Q;)i8 &l̘偿t$%!SOwlxkz>װ)(Mfc\me'oTjWiUU^( '+bxXi3GYL0s2ϙeoUS,SYI-̥lZf#Ͻa4- Em]haETd(5Ɂfz "Q\l:B>B׷M;n[Xծ6X6[.'1ψf \BJo/{\L+C0 vQ~'髖uR1;Ӱ{)@6ِAUk!CN[ge]imz>#3FI*ٶyMQz8Iz1P&rGb5Y=*-kvg%W+=(8@[Q|*غ Um6_ݼHҁ/9fik,!|ХO(p!zj[r9Nlm"X rwFp MnMI)1n6"D%6SoLDBu =neNy|GƮql`'2*/xI9N\yJ_VE*+4hGj7'o|>–A.f PL$1+sցQ YZғ#DH%@>G%[8Ȁ8mk"_@uEQS *t3;y*L Z2V!oՅieyycStB)g-۞,h`膟f/$"ʧ{.bPf˱=q:uܐK[RLHί/Rze!C,?ѠdaUihz9O>z൸> OֺH멑;8GNGlVPmS+쵋'YIR /L 8R B1įhc8&ۻ\u3krŧៀ$vBH v_ʞ")gC*̹a>k Fq`c^;aB OWd(]UyjྥqQLdSbI1s.f1%d\"%ExOm\rOG ʓti3sE^n婻x򎢤 2Uѥ v`m[kj-`MyZiЛ\-b57d<}|oc:K*ک3AYbs?]Y妑Rq 2Va ]?yGv@106?`E 9e|c!OH=oUu&zSMz)4I86a!IY$lȧ`50Цk3ʭ]Q9m 5RxվKA'j3G?̀-ѵ&\8ˋj^g[8j3:_s +FQ:t-=y)A` ɩٙkmL?KƆ8h"%(Uo-VoUJ ̪ȕ)˜$Q!#C%6ؾ]Budr=.nG X\+GasZѨ\Yfl]PUL3 1v=L|A)jMy2fI D κhQjFjVdE,{HmVZDM91ZFE}۞|,Rd 漥z|0)PrcNvUԗIrCoY)Lҩpؙ'š%SGE! \7`i%^bmM$q&ӭ.4\ TL' _w+OPGqyqt'_8;g Ք6rn&IJa,[QzjPfRYi(Ò &=m5z# f1_ݩہ&eFG]w[{*aH9x>A2P:M=f'Ju&7M&9TmP)2.QVKOm|NU\ ɪa J.qOhSE\/N\c9wN<]EdK `|# ,kbbSETV8e5(j)4ٝ{95wջƳr?WVOaܪ;;@`~_\k?54k¾uSc` ضEI-eT9 AOE,Xt##'ER~#ނ#Nҩ>>QE\mI2\}[TZk8k[SU~_ N+kfV Eq| &QjHVƹ|) S>FI83ɴWͲ)Rc]yvDLoH{(BŪV.b{ 5WjzpOx2X)Հ=iRW JͤM$-HOx_DqDDv&(gr,/༙|EfaTWJRxPۤ>i;僿Q|GA[5eWخեH2ګO!_`Z y"ACqTY=( Uy+/CXrs~3i7idnTTH1O'80SpLھVIh[D2٨~ܤcvwu_q~v}-攬 Vӟ#~4W/|ZH`1<#Q @?iڣ T}9h7br5JD 6 , H\ "56d@lNT,-嵙xO~G -a_ýb?*#o'Af K>V:xc](=r#"d*ZirC2]v3"Hp..aFb8xtwn_=rFu+Qf2/c.Sۜ y=#庼qrڤtK?|bߕ|c{JW$50bMÒ'],d?NB8 \)jg}rVXt~EsAv)(F#J8/PWGz(gxNsW}i\}ī"ghIQlna?1Nԩ T|:P z*o|][m`Ů<ØHڭN _YZHH_NHGPwD0[ vy&暼j LQT!.zi'( -䌬ĕ0uyDztHp<>)OUz䮐kH'O21w2=jZs8%@N\^ׄ*{h5*_'_?g.3Ire R jWh-ϴFk t vodg}JZ?%5X͸ +cΏVqпrU Z7dq,ي=J-L,rѣ_0?iX|{y5YC4k޹4U)I,R&Scgb]]-~J+~]rhV c-oBDO-Ţu-ے=Y@<&Evo<"?mrΉUgD|ex ڻk!=@؅'hC'5=r\'>z¿H-!?MLV@6Kh N4A; lVHR1 Njd՛@)wD wq[zjIf7}\# " (E[:(f`j2Y1V/kw5G4T_*_ .) ktJɧ'}_57a-( (rIM+LUrlkd~z R3heh*R瘮-VKG=42HI#%pSVú\/qM$rثxo9 Zܫ7'W."*75@N5 f3n, .%*%;ه*?fk ~"Nh㭶 Kr2FnbDlb3;nG5'<|$l6:Kߊsuc{ M/?OIWTz'##spW_rFdUC0W #@`BYFʶRXJxi -udFA/< INW?3?4Ϣ kI"Eq&lk̢74y*c`j9\ ~vA! v OvOkBqf#- bqLANŗZ@2vށOfu(dpo15ni3N{&ND[+M]Z=S|ʒ+9)lFVW{P}chݮh#`Bis,5(wJ@$J VٮH^k;A>-Z&vN7dĨ ǫaɉ3pnY<.SsQ5t&^UJEJѱ9̱'-(GFA urj#oE)s*:oy>S1+s~\$>8|( Gk5 a-ϗ6_s٢aj?i2i|3.C Ҁ#Z)Rd1#+A+ǰiߠ]qѻ^s@ippzQN ,b*3 P*gD<\ڗt_ Z8FȾE{,Oq2>]^i՞՝!ڗNja*q hf\o^a1gC-T.{:hcTr.LF8:(sYޏv bl !Bϫ%9Hg"\e=7V8dM۳76*gj-"^-Pwu)[vT|fZK&jP_Ȧ^/@RJb!S W.}1rrЕ5XW-poЖ\ ,D#^0_G6lT׷gs):yiXaA,a_W8|*?NGvar{U´Rؙs A5Z8)#4(xY?Z46'evJ+>b#:01t#~,p Gta}>!K`QEqKO@!m8 p6ݚu3bx 'NAO` c0yNzYP&W~GZSgRdpzQԫk"ruэkߏeKX3T'@m#^;;vbJd!*ꏘcM.&&J{ik$~{ 1<i%8VK,)/c^]x`VOWTnŠ:yZ IՅ?*D+Z?ռK#Dc\ ,0LPv"=!JC26EB*#zH.\ 0Y]@~%EjZ Ib"̘C0Lzʷ=s.Yv)3+ ѵ\Xf,f4pN7GyWᑫWn6 N3q+DreOIm> ;Zu.%40U F0Ǖ{!>G`u~|[1BGPgAhlc]<h}5#} ŴtTs?t O-!CICx›#ehSYmhtb˅=_#GNzjq_XbABu+39[kf`+iV`6am>Ag5RTG"tfڕM#;"q!5SGbo<&zji.z%7pr~*%U\Z3unĿU E- S9;T(~OBBOjAh٠%hymM[Wf.3QoJz >'ʁ@H1Clqd-1ϗy\4*?:${?, s&=z`G .a7}٭eH8ͤ/-mP ݜqLK[3L%,>oEĸxXt9:VG L'4wV R{O1⥭iMkLǟ&0^"_bPFd7cA&`)ߡ Oa{n,9P&M}d+CsT/ֶZK -0VZP0J><`*g38~a3KU/׶uTb\l|[jg;TE VfEM~EBN )ju7|K)7ZǗh:S.+՟ClM;qELyܡa >J췤eوWVm+פ5ZDgA=vthF{7{FhGC#P)UCHZ=.ZO,+jg+ ZX$Vc[@rB-·/{NJ+0|ϖ42f{ђ$7cزG{DTyN\f ~ҵb.J1ݣ7`skއE-2j%1PMvm5e܆(/n|}D>)/"֓q%<8d^_^A 2$H#'y;e`-VN??&6^N4 ќruõ]nIV3s@r<p@~`c0Wa2v ߕFiEX'M2WV 0 Zt]xϳq7uc9Q@Gv8x1̌XI:hQ _3ȵbB!,nYO#|oJ9J$!f^({Y:k=[V14Xͬg4B4^٬W,,܄J }]:'مՓDf?+ܷ[ g1bj;kX 2EJtmmhﵘOǾ F\P#дʆY۹-}+[юPFz9&O {LrƟkR^*ޕ9;ױ(n*C_4wKV;FLd^opҺY#(qym`{B=(+N8^aNVlpj՝#2,>=vs9@љDžRDR[F(l{y,f= ʸ VZUWW<:F(UgXGYNՙOuw?h8stD ʀط8:?4`j1lDZtVIbJ{n< V#x缦c*±'!uWuM?iQO܅_C#5CxSVڰ,H"c 8lڣپibe=`vMdcv&^ -.ķcšCe7-zrؼ&3Xqlܱu.C͢~JJlZFRLX`9 7$!qa*5(+$)Nr@fqN gE~,, \m^Wf ؒq[ʓi#@C8 OZ wnNԏT|g3X(rѷNDJ^!2x5[YWCAó^v=Ɣ]4hQ~ayKUGˠցDcB:|\MV05ze:Aw_ Q)4txx lA)2ك(pkx\26cWI'P6c߶X߮E)1 xPx$gQCmC^9J@QƚI^g:;<4Œ!ο݌6QV mnn璊!Bc-Yo`.5I# zXlr+p7ҡ KiGF c|R보5sL^,xeG|R Gbjdu4ӂ0rriz$jjUL!YBǮ Hy!-K;ڈoPO^?>!NJ7Lso0 ]; " cېY:~#CieVk<`T~hp*4Hw/>HhI#-Bx( 4pU])2*oD ˆh׀/P:sU?FS(dmdFՖ r}xA[rl`b}Rx'VliK" 9uT&ԂMMpK xԿ!zyߘPR. JiF;VsWFd}+!$rPj3qp u:f2bAMu7x02޴J{# C!pqΪ?%?Sz-.#+YZ>+IpS[B8@{vݔ{lfCJ}i>/ ھAjs6 }1l3UmnvsIґs8pL/q\1qQTnj"z#,#]l0mºӶY s9Ǥ*GZҖciR[m,Q۫GNtJyMtLS,CAP*Y)P=!8*ahy3<"9$pBwb(f̑ ?KZQ;>a0ſ.cY]ɲm= //нhQ"-1CQt-dwXF%|@Ρ67(7Qtu+Z^{ehv jyx\U ??hmEE!~`W+4WU)O'r3_~'iϥTY)^^Q7?<`#Kk2;a 4&;}D\-@ ~J_V;{p#̲V"B@4=y M蹯l.YmUkŷ5MdCMsxcy3!8- 0?F2 W(c8˂s@ʭ_/VFR&ٻ'}ºV -qC=xpqWKӲ ΉE9uUuZ(w6guPR֦}x T(t8αˬ:5.6;Ǣ(RCHSx-+$U)EUi{L%4m[SO- dJ3lW&Ar8 OG׃/8H'E;Ŀ˗x f9<'S!o+Phzrץ!wt3|0D"lRMoS4x:3p۝Ȗ8Cݬ?X ną$gx㺮9ja2hEjdW$κb^c/:{=9S+oXxZ#_$PuRThM/z4kSrb3[@*+A8˺I`xVIʲ_EV'gESA' 9~Q-<s\?".Ř sp-q3-lR䐀fIf׿ kk>DYKɢԒ:^zoTZVJ%,)EhW!z_;i߲}v}6Krn[l>v :x+Gg77` \: !-a9hȆ0}I^2~}@r2r~V&7v;CwV*[гg tKU!(f45J{6 F(ڄSY$[גmhtp 2H\DZMn,p\ܢ / CfLƟBo9\+hf"bѲc454i:oߠEn2 Ndg.0s:l_+>݇~E&?lp!8Tq )R㵊X_i+\ _{>hM?w p=z'Sr<'SP9Q]t.?V=`HM/ͺsfZD9Km<#wVصq9Ux &ZCs9ۘV~2O/P`-ITI94{Jeu{t9zdX:ZKFQSkQh^GIk7ܥmonǙi`Wd  1$zB`mn :rY[E){PQbKS$i̕)gknb\Sv&bAegD4䏄#٫itMeA<{:c8,5jn/E[ݸ ' Ix/Ql Y^vDqھxODx%&K̘w:xR81|ٺǯoo/x '#2fcjPɻ^T>ƻTؘ#^?[A )Bȸ?U0o"ﱎَze[HLSj9- Y*ۇ |-o.YjÔ$.@:92f/א3OK 9QcߑjVtFSRKnV} 6 F0ޑ]YCk`f:5z[pyfa˵L! 29*9ˣM‚5%=ݐ^<<{3iCԞ)CMi]2~[50|e2%5 uL?^hb'$T?.%o ~^əop{ObS>`NJkC&y=5 ϘWA ~!_(P϶/0 +tsC+4Ș3!-;~M؊$N5F/Ml?a n\OhAوhOvCF ]2–xmH\<#qpUB˔t(nh` jxnL c!Y%?NMեkW LkfӫE]Y78+w ;ed#0_n&lWrtjO;;̋k`Taa#D8,_ pGyIW%e p\9;֢hbXU HX‹SoүKn=lUn#25/6/L F?YS/?Fi5s*k4RLFx}L?#G~^gd" VۤA쟞Kūpiɖny8/"Io7W2^YX{SP0=]lQ9#\o ^Ӊ_3@¨J9+e|tz>iyiʙֆrQ6cXEuҩxK$"cȇeuħ%?n{'H6yɅ<4A5#K6 ?n*^!8>cH\}k ?ۺRIX86+,p:KF8 n;#zŬ'ً1T>l?F`􈞶 I\C=#&:v41.^dv)h\)7<^8 ȻƮ /xj)i#-[ڀ~BQzI[Yxc&&Tg8ș U0&goʌKRbnqi:r1(ԈB^﷼t]hJFI8{?dwXQ1_~2$*,1ܾ$lJ` nٹ!\?#pvE^ r@bF8+!Fz;4Ii! Vyjyo]jH9TzQ^Oc X]慠gz:V$ntuC't,^PD"꟬ *WBћI |tE,6 J$zE-phޯ{IPBʔ4tX[oFCl_XCEYD}+'.!+3&O=$;wmV!<&Z\QgG3g I3&7:8QCx|ԗVjch#M93^ua. H-e8!P6u.pcmUZu!0B&pQC[WA/+<Sk:+пn;~V=w!9l4j|W9֗S I7&mH1kf̥ʭYMѕ,0cT/ua0f0*L\D#X];K ~NF)Ȫ?h5=ң>rBV#M6 VBlT_ހЇ~3}O׈ֲtO$ ~T$of.3B*I:NUME.~B]uf(GkԀ 4P DӲ3>S-x듵V:5FZ?z$[;I`UBT#34$Yƈ~m*ߵw?i ;6{dn;ѷA>\L5)DTR1]&bx߫eH{QI(o JgV&Qʼn)qH u-fhgkl?~4_qzڥ&DoRϝfFV9~͚$ uukJ/%o"e15}xIc8$wl\x 74`h )5u@kS~zu'a\}c 'L_t\WzA&.v'Ci8w磈${p]_CָafmCឦb\fۜE|ቼ;y.E7aQݺm dUD_SX)8C^t_|dt-G-lWNY0)P|7)<;B [Y }" "n**g=`ؙT6o(ir ,(')}b6V&׮~\O'Gn7 #f)iGHǛ@T@ _2{`ǍIm-6Yxz(=4^Mi#Fȋmn@5 6#}⎺CGU9+wQ'<&n1˓r~2:0:+| ,cz$ *nb z/|TE4):cN,lNdc`kZ;cȼ>yd|9a<%Bb*dzH4SKnZ)Q\ Da5 Aq,[,t}kt)'' `=f|+~A`kݡHA˚]PIc h]urm#mFdht0F=Fd*5ǦTj­P?r*!yvډm^_ǥcmDi㞰&iQ ?E"X,J*MX7:I6|]g2[6Bva5vädk=ݢU erm¶ &^EI.Y c.`xgI0QN ub`T17K&C;z_66ܑϗ#vxf*Σ?cofI|C&|Sp{_td R1C@{/X Ŝ743+W24" YQ&ݙ<'f.)=Mp`pUu.[½ƶAQpDy$!J @L 3ʈ˴~PҰEh uU9(\;5Q2)۞ 8[,A7/?gR{!{C_01byij+O jWkwLv;tf/ q0fs 4&[3 ݨ5u?S;=q(sqhbKHޣKyֶ%e nG9&HO3z:SoI^wjJ$ })څ#3d-!ad{+C fG$vg,-K"#>[*u[G.^8P|}s,VDcճ߫;g3e+im/cn-m=K =[|04ڥU/o WASN1u\RI*`9 p':aqMƼMhʼ۸ݟε2}5ګgZuq t [}nUrV{ыkىĿbxXc,}$~w ;1[8%[!9V79g\IFsmdewg#_,dZN/ e.Ȟʍ΅9g$PõƷ 9Hgh,U5Ъ1 {_!I8(gE6SÞt`Hh-quLmG|zsUkz=3naQ@ҦY-.a ^H3Y\kA0L" k~W 8>rBţjDQc!2QtlrCs-CrLot|2/ cK/bOc2,em ]mS,'mUb񾧪"6pvD#3?&Qf|+%g:ŃJoeTZLCKz,d sPόwgwP0,iSX!}bs}p$s uGq3L([RO؁Z?MpCJ +QHE^ i:eXwI^–VHCbܴh'mv֯SLKLz{S@WJDm~ M ˾=ж_U`-uDP:K^tzpeA&Tߒ'./hȏn,(?[aR0 _go>A![ntҧP&b:~ԝ#ˉ E/Eں8FlRVDo(JU7#1Z`ײ&Je\|flCme~} cU}TF!gT={U=7ц#!۰dS^vq}sQA^FfNֈ:ܸW*C3#Lm\c _W} aVer{Jۃi QbMhZ f'%'"XcJVqkGXF7}@W@Zc)?v.1K=(oFm a&-P!+_՚$Y36x|)QF­66MwfG]`_k9@CٖCt.cA *Rԃl - F:ϛTVē[QSZI)ex_*w0Tߦ> tZ eBOgJ,И,E$%N ęm%ٴV$h]g˽VڍtlD _#X6[ ׸w=q9.>0+ʡn(HRlv(Y=tRWJdE@R5 urVӽht@U?t;Bc&mVbn"&r6B']zW%6p<`%1p\J(%}.tLԯMb&e!rڈ^wL,p.@={s9ÒeXgmp |MނW 7#Ex%zc_I.!9&ɀ%yFyy+,kdD#voan隨EL#jjeˊ2,Ij(JLRHCe)$ZF$=.&\qm^JgG?H_!~(_Ev !r2I -N(/ƒ np\VxM.8G4UT|+ˠ,Tr8#o[n %U[oEVEW$EpތvGU@JߞP{Ԭ KRi^{9ut0#"ˆTj+U 'I3¯_s3̠V0#d.|l?e+pv,pzJ# 3_naXJ/wSYi ph:6'M*TGP$J FNؤ"8n}~EIΗfN#.Ԫ> /6I[] :Ɠ)I.Tq+Dd QWHxܝ*bi5%F%;fqZ3f]TYqkOgAZ `|iVgZkE)רXMER[[P|%߿]abñln֧"a-3yoǜ/F] D?%U =m5o SqIEGRr0Yh'Y7wJꜷ_9f~AK井 H⥻P1SJgVή 3].7yF/0\vv~Lt>qÈSDed 2)柏%mH\i˦|R-?qd.e [ˀBvq5B\٩q6 -!פHS+ [Z6zzm(2MpUDe>#T.vv4~g C>H\!{e!hhу6*)yows:7lл$ zr^jbpO3N.搷9#N< քQ}q^ցg#38ءԽ|q :|$2,i6|hcF̑㠎c6W~|wWFyW?9r3md ڿfa[R(#@Сk7;en8,L=ovWҵ_zG!iP;Rc R >J]# 6FH%b6sqԩo#5a&MY|/_5{%`*sH=/60__KGp:ӀvHH^cJdIXƞ$~t C0= q + aܦeH]TwV qդ[1F'PsJW-򨽳!L f2l:({f͚AUG2-[bª|ғl]Z]G>A/SڸPpAXyN5 Sg#UdɦlbmP'-U=M~KԥJ7(diJиch"v[GQOrGHRHbŴ!r|)Qδ$X8H~x#9i+g>d1B9ͷI5sEo|{dyveMi퇔 cU\mcAkgJ+ qBT~hW3|\JrXӬa)$-c̣FVY g^3`2O)m8كFZolZvSN T^Sa|+"3Z2(WΕXKAp{o0I L,+P[-Îj {$L'&ە=ɉp$l&ToͷlGv~>PA.T>:D7> ۱U6,~7Gx/(롄=$u8?2F/9T2~8˥k'Uo;M7#Ŏf|tӀsC&jWOp,& d{<!ףwfezL;Ġ<1xږ:5|(("I sxZ5r%LïJBp(NVdh5dnѴK^wR}y]=a$,v (V?[1u\Y"nӶ2+[=oZ<ٸ` x y8>Pٯi-v%$-V9&ZAɓt_0ܽP)Kx߰Ȳ8ț&2$[%1~@L=b,>QC[y]{$ G}ʫ^&A.4ҵIO_\Ajb^)U0,Q+ƒMl rSʡ|kj44 Ep`/NIo8.jצO~[<\@v=c-ϏɬK=s)qh]6ެVos] dJ"7d/$5+}ިbqV##QȲ5tWMco>_?^Ql L#Cpyì\oP#.[ GSaC8!\Pҵby{߸2!by?`'_|C{H M=Q:2-e<Jz ,gUsoͅ xK7nC!IA}BʁG 4tbiEjlj6 b.{d=,vN%D)1%m ,+t{$Wd|[N5BE͖^U@|}3kd{@H_*M 4hHNN)=D˿P8`$HD3иQr~sfY2fdBWuL'8:#h|i& J[LWm,B>g5c`Lq'}8FofD(iLj},۶\˟?IbygWmZ=q~݅<E Უj.C2$ /|%usoc`bS;F ibXATU)b`1֒3v/IjB9ߥTų+%a a%2rAMUbN8"M*F[e/[p , 0L&sS?fELbSOi4">L.8l/tw?@ t' ZXR~rxSTd})@=* b j)mډr?p~|ĺ7iYOf? tb[I0b [H:,ur&_~0B,/3:~M " 7*UBaJφw';F?;/wmLΑG]?.9z[߰si,UMJv53>Tէ`Dr[|YPiV4 :O /qYa#= %IщE_qI~[t^Cۂ+7ٞ`K߶K:} O;>&W7w 3%iI(-A!  ֯+r*Wuw̽ .rCUơg wʎl&x:y *'rD? fdl,\h]w'ohhrk_}1fh؏cj$X HU`tsʝ?X^yl6RTńeaϚXVXKPN n ހ_}rT4S8B zHKP4YDKe+ojֆ- LF%ԦD" jm;_)^k6AA7;D KOGm 2j(FiuXVbJDg" Ŭ/ ޤ ESj["ye cUt=X7 ñ[8?-xPWvb+tA;a:,gHU%_Rda*e^GmpDE Tb*֟4}.4vcaI>:ƩT+;NzCP0p4A[_F@OU\^sq.</aW-:2gAV^S |] (.Ft+KRI|z5R_K;ɿFܷN^(,*Y̺X.xVVis\j&zP.]>.ulf`NnZqY["JFzzfp4jbVHA;{EF nrc3T!vJ^2>oď:X68{N H'QytwXNA$,ß Ua35brTY3V@rbRUT0ՊmwNℯ9j"(b %19ǃ!pfeDkT  iǙZ / &a獷<;X v!n (ɞ4f{ラG+lOd KMm.G9}e/L7Q̶ pfym! [K:Yc$qbF$T dy:{ 3,sF1r#!|+$!>zkb?QψK~>~c:8sQ[cmaR=qڥrϣIEY=\@XB:ňWlJFFp e^\XMAddrb|Kt F9R gte Xn;zqjp_q`oAC3|M 1k˃V'VSQX,[ozHoZwVg\BUeLE^F)n3?Eaqiԟ~dyd0;2ũP9:&HJ|w Nm`4)7T)Ld#fjXg$cf+n(+FSTb$%N'ii2*ES) FBS@,)=5èISł~` 6ۘWÛ3p6EF,ErqV,%LD8!zX]m>(_ph޴Dp_D|A wsCIuP Kw4BI<V#VUki{|!󟩁 NтGq&xѪ͡4NXge;58nm>78GEͯ?w*e0n:xa7 [eqȩ5i`^7{ی?rT9ĨߚU pPB+ʪÄT\"".m2@]X $Ĵ9ztXڸqM;XY2V@$k%@>RrB |QzhWLHEC&^P5^h1sF5{/[H{n7`P"6MˤNFi^sv-zIH4q .͸X*QHGy%U 7kPDrF9`9̓CN6@u8)Yw=u%YH̺Tqza>Y<#ŭlJu?"+`C+sM+[zc IxcaJ#b;R)SV lZvFjWDZTy&dv;…i uKRӾ α4U^8tY|.57wW sXi\)5ҢPL>mcv-j0&B-\-Țlf*,򄛍?|+5;o6f6%5smg$f{@ԭ&LjqDl#6T.3Jve<db5ͱ}\-#|.JCHwy09F xyceQrݔ4˅WlBY7']cL~q{evc bXhƾY'͛hw\j%J0FL8HOsl,r7A3HFrlb%Žژ ߓs͛lܩ1'G=a]50e(3p-Y[pЦfԛ۬ye>1l_+@?tA 9[AQI7R8㌥d43#q.lIEFab?m gT Qn2%K.Jv[uʐ2ş-nڄ6[i$q4oyҔP=iBb 9x΂ C=H?ϱF\:Jw5dOI$@x}k\I|.T7+m@;E1W, =I㡨G˾tzΖ@sh샽+jkl`9dkW- pa {rvPQII |9#ƖHI)5Tn+5Mz'AHHeKSQٙ@95Y8!`&=` ' qCpTmU&]Hf,q3ܣN ?ܾ8}5>lb޵,z$M+JIG.g:D;x`Jܿ๥eu$O5ck厍"`dH'}" 9c)~.?ktv 0HXQ;;2@>o05|Z-~Em&k7uY= YWNhIcQV϶G6co0%==E1\pkR))"$ Ĥ4^\IM㛴G*HvR T]?:0P%)6dPN3nkV<ʬF?} r8ӄD!Vf녠'e % }1 MUл2^7GZ#\m|ՈҬ=A(#i潐݁뎟K3 4<VVw0ʳ'Ex aJM2D׺%9s鞟"!_Bąw|Lkwڢ =E6uXKyCK9%JfNPS5sۍv/Cnau\ ҳe¯GSt8SA/kW׍uG㬵C{KLv#FдǐbꮙKDnP?!pEYo?+Yj)Xҫ68M+ɮi HMaI9FS8UΈ_Ci?d5 Iߏ./Zu9bCu"yHIY=B'^#>q as>B*w*L7FH>i |NզWp2L}uz.e/Q?pBY;1*l҈x \U^g/ tw/*;GF{J}mhKɱ'![i3a%5-[B)(l'%yC3T(U=U/ FũE ]a>*KQw'|p49F.), -J.f^fJ^{Sj#[fn/BLaz*>GԻĒ8Q dʈ$Ú*VboʙZ^)އ`vO,CQϨ1m\Fb./IS@T"l/wrxl&YNI{8Kn9ܝ m2B)N_UιZ4oS+#quَf Pكvh:VoNO U$  KRɎl6|r;UnT륐"ޜ.*B pY5Uw Y%]j@\=Tc *;[A?_a>c) ]Z1IfrGyzO'O<6l 짺̕i25Lbx]LnyeD/&=`W+^p&<{Cio"s@s`ÄwFѫUq=.F,(m[fIRim{ΏO n}ٺwV&I+Y=L|N1RvTHM^+բ{,~J!vƊ|'&۽#ت}G+8HJ}`K֓'|-[.)ME$j#Xqz<>pvgtZ浘Z$"E'\\ ncѫC@HPMHD\5D뱥K"!1uI`l]HFߓs3kTي3,dZ[Nml6eKA 3#1eTR)ttÄ}BBz}*j4f D?@(Ŵ?%4uralfb5/h4a='cR0IN7JٔǥN+rGD 9mIg[TwQPC&Nx~XEO#M UFe_vd)g>U+ OAoXk_Ys߯'\6 u3̧6x L .Pă1 r9z[Um+`@a΍ny͐:/ aEe`JA԰ 5pds[ϻ8E7YLT5I3 bE)2SL@YO㝣VI*?Q$|ry[(v [9 )ʌ44H#;Qm)fSIe p-:15tNqsؽRbzy5\6i}aWWicpkG\#>ÊtY$G[<.GsfAv@k#&hc^zSzy\+tKZS,s-)X$UsDw)__,E3oۊ9º4ib0pLzO^)wWQݸxj4+ ִvv@03(.٩ ZuaAxd M~.l@D82=zGtsw]g"As?eA$O85Rd+PRD4\JV*φhĴZ `B_Y|ND꼡幙{&  $wJY@>ઢX̶ОhӅ3;=eStc $+^wdL1x\ QD-&hl:+.--J7=i5U!9Ft[t@a895&="ѱC i(};`uQl&()a(P5zP=bJc%ny)Zpfۇ޳CX_Pߑ+c]HH#GԠMoڨ$~\ f[ QwU涃1yD5>0x.MD3)B?u ė"O`vG*dreBYjZE$)h:?ղ,[ V@YnB(5wc}ow- k l.umt22wBߖl\ 3-NTdPkn^ 'ϫkq-Jf=$PpBXeW- džd]H9"= r{!,=:3[!wu꧁՞S!]. QzҞ۰بIcxFf^0](\κwa%~ۜclXœ\`Vy]6 8]Z̕'dIA/$RrUDq2l&xGʮ3-9x?-^ ^701FH: kcq}37 i dYB9٭-ƅ=]֙M>ءwG]$ܪ1ܒ'.IG=GkwFVdvj7tpAZ6s{3Jew=;|*-agN9fM=M G>Un# qxR&`S;pW v0o POdtIl}<\LD0ޘ\TuXI46hUȼn>@ʑ v? WU񓁪aRe\4ڛl #%6L_ĩJLe7rA,כx_cZaW::L/%_^,^UoGyI ~HIb1Ŋ'i~6}FR}r\-HSJ.;bOXHȵFEYiϧ#BޠyEc5[s} (l5_|j{ǸCӴq * Qo1и!;؎vݢ]er!FmG֗K<[Of boQ=GWUW!\P Ý;M=$-X ~ȅ~d=^mԄ+ x`Yg`Mkh|GX*`\If.(1}Z3eEu_¿g Glr"aCL߽ٖBn v~?j3|BDCIT*z=sr q^3ST9e_|6 '))Ԇ;rDZT:Gf /F4kɡBAr۠ʼn/f_! 栋]єAxVAf,SIbm[/%C xͿ[-E*ܥ*N¨i:f+7ggAx~D#)GȐڬ+!Ӄ@,.Gpa9D4c̉F@Q|hēߎZaRY!hkn gjђ-Ysppw"!uk0 K9s8%q$=lC kzA"jp>$O+fu_8,)>moV 'U7˿f *{26O_w8`hJ;2..ԌldB0fi=l緲"B6uN_o~GawK^({J[2٫%1[ ߞ?ĺxNP;P)P F J†XAQ4IB:f# jzE#lfA^D+$s!X|zZ*2oKP(Aq{ϧϧnkղxP;w?L1<2n0 t"qE 8miGj-CഅuT-Gb"3Rd&2S=p<,{],}AW햡د?,+YK\9u@y'A iMoWT/JjWIjTDR/|*pﾆeOtDSf4Fej\W/l^enGHA2akh;fir CE]h5JDzwE1xG,$geH8:;kY 4}FG+ 9藸,(bqNGSi}[[jJVr翅])9HIIB k ͨ̾pH* Ap7y$,=YiWt3NR/M1 }χLcGO<FQli{۴ڽ 6V˦]rUޒ`cԒUf<72E.(?!~5gD3ky P̷G)PNwV(.%.@n1z׷0}`1$BVpȖpyy0k}rP)>zTu I /5' tN"EͲc\F3(# 58K/39+2Xi_/# ph2ÐBtĴ&@EvFj]֦Y\.C򙓪KWMƾ[^[Wi:x$! g_}JeIէ4@>Z䱜<8"*>#tǐ*/3a3Rgqb"X܃nl)SdzdԌ^]o*Jƙ0")cU jH2U/!  a*0Mw5Ԩw^0gFm[;)֦|$/V`ƢQ%pޚ }Y;D>Na4-|BzV\UhIc8?VԳ˲@.JrSK3jO'*Qp{`.5ͯjJa5` l `a F<;.cU/[WXiLiVDAiz Q d"ydRFPm)Đ_=c @U<DzTjTx8k(?j&`ܛ z:ub4cy^Ō{ߟmC::_'KZ>Kl5Ti~lO iXY=/ES͢Y=WE7 د~ILHL_՘zQ`rEfUnyY{σ@Vol(+OjZ,*/: w]!-fRwEh+ uno~ DiD R_Uńm/W!]5m{EMW[yr4 _K๎r(!L<3:zO/'ْ fLgj%_t ,1)i$%?a!Olno4@*uo'fO0[on,\ûB*=ZCx˚r;m?/BA'T\g9gv~M]g\+(qǬtjm(vպƯeJYś՟jʗbHdˍ@e6*?)Uۏ;&RxRru"06 !6G5aI\HO6qLC#VXJz1<"%2_C=\F1Cn&K1L PCDVx D}yDr.N]Vu4p^֫^T%A8 خPE\?Ll[_-?`x/3ONyElX%!GJT AOlzp%]C~\7Zr%m6?O-m0?Q{E J65\60@&SfTs$g:RR(W6Λ]8-Ln2]T+0łwI].W$v?&(J9^(5@,fe}qN\#w jCk6#N(tG搕y SO8Z]fO:AClԊ:3T|zu}P#v Y#<=Ƌk{Cym*xQCAI-"Bp~_(LN]ݣ.)eԎW\ 䝔w>۰θYUe{"͡sJB: U﫲@ mY0bYШ7A#TtVE]\7y8.S͞=m+ҽ5&u&ָ -Yd{=σX?$r1E7-jN؃/{|? wVgΝT"6Ҝ?ڭ퉟'3{l^4GDϻ be߼*36DS&PlA0R)`JʏĊ 0A6վ `$犃@GBs7{s]юۘ Jh 6߂H`@Xu ?9qq2DEetc Tx!o'R$ iꃖ 51˧Fk/?GScu͈txr֓t>qkS֋7Ṿ?%s67 u`3cn2&[8hAfC)~|+w^",hOGuDQs*pH医?b!]󢉥7Z%z8|)w;Cc~Skf"V*Ƌ <3Tjb3cj$6j(!P~&Pz RCoąɲ Q?1SDE?FW3ryqW=~۹795y9EYzy/N#2iJ(e}kP$ggX.DW%AhFtJުrpGO&v,ku3a$*)0ʠxM=6IS7 u P,K$A2YIѽqDxagyج`w"a~zk񺆔졃w4l} UB}NĜCHp(q-`K'?}9̥ƾavGeQI 긥^b eDT nn{to>d-7wȩ"a @J*GS6ovqr,d0#a]}M0kfȦ$š4G.} 1byd6yw}٠lP佨|#O(0'dr)%[4|K^\ȚXɈje] pMz(30qx5^ /Cڱr}Â{ki <f㷁pKmk\Cwav$ݵEIB+y_l]φ~+ٚ7TSK21B(1Ae3nKUS4(l?x#A(bm*AWYYT7 DGZíZFsƄ?fv-`W~N[c0Ѐ P~<'Ң&!\04!{_ZV[~AɬBCx7VMZ8)oen_ ˖j nvl1Sq֎l@: $f RᏦV;l>aTsd|0?%h'bS3BS?PKh:gtGvE QNZؼkxv`@ׅ1No51''Gܘ㷒fvi$\?۬<*#t7W\SSM4B29n]T}X cr P!0"Gc`f>PrDL+߳ S S:_%bAp_/9Eɽт#uIYU5ĥ ìKaDiif?py_lfށlPAΪcgkɺ%eq`:`179̔hk[a  i[+dժѦB\a`5#qadMic_bJ\4' OP_PƎή,ݶo ['qnzsh "ҩےƁHJOokynh1!8.cgp9޲BpB<79It2uKC"tn0L//ݷj 1%q(Cp9 LQ 5eFyJѬZ{)@^6x n״ ,RG3ٸ6"> ChZ;O6j#(lFCͩ dz.3b?zՑ~ĤI<'I5N!EjUnFX#\*Nh%wGZ Sz4O\oSRu=zjT49&۞` xpbX*HLWV0WJ9SVUCC00a6sHґQ=VFm<${n!._ԏ跬ڼZ!"WreDŽ:vV0wU9o7Hή6e!XIh7/@}%=HG{c T>(_Hv>{Jcx- qH& ݗt3M`ޏn+ܥ{PU7 c*TZ<||]XCOe$-gU4;TDܽX1v he~.swoGgr40079#O'cXT)×fp0.Y夶hL?> E?066D*V]uz_"cD@XpA>>s/y-| d8k|%Jgw/#IqǯWluPB1V` kW[@ 4CX1]t%o=w4ٓ{1tXIҶW/]6??2K ݂zx6'M#~$pQKkjCMFqF v IT589609^Z_[ M#`ƫ#Pr-8ȄZ̡YwS_l"aˇy>䗅1w-|c~r{xs=*,0"cj< _S1X[䥈e5D];RdU h ]~u$kFdA\Ӵڳw1Y\4,.CILcX9)这}qBR%g쀥q}h*&fsj'ϥ& dD2s 7rTpq'YD `_CbwozGron H–͒3ʧqbsTJ9I| qFث=@-W걅q2F_e}KP ȦU%H,.PskKVRz9yL8@8]ʋ7ZbѴ;%|*paHƉOB}wc^~XV;aTVSቹz#ԯKΘÊXC戱tB(1"5IqcrW\ fC2GKTclt\1|_ojUʾFҬjo6&]7`ZэN9Xf` oNyc&%f⤱IoGaЙ@W/7o8_P_N鍁3v3Ac׽XVHC.̺8Duҳ#֘34+3sͻ,.Gpځ_в !(P^oIp#n'<$iPUtQXɌqS⫼S:)7.|+cZ:ov㥘sqe6[SӃ8>ݾ^*G䍩2  n|lHo Nb[ڥ{_2-z '#7<+u_AS6 @cA۹ &3FS:4@f3efj(- ě4ڈcpr/N+*BoP6d`̼D(Ǎ!ЬU Vw|q^M)@UFM譒LLo@.dͬ&&ՆJ(_-b+=jf n|rsnhwkIERs1e =8EX>lY,? 4K%b9C,橦ROlۜf%y@u, >mX#̑":7@RJ6IȠ{W[uYTdw`ƂQ?i_y&qIJ+tueŪЍeS&>036ax&:׺Sv臧=[{f)k 7Tf:I1--euϺ,'yc4.a9OZו5DOqTY=*\0c0v5 Skg=Qe^3@g|σsőv4驖Ւyu&6\yuKwO7Qo5D,D#յ5g4-$@8fl'=[ { n Z7FbE$rWfUɧ{I:wPw CD :2,5YUE fw!_zvLZH3t|ۣp6Ꮲ0@ Dz'{ɭTD{/2e=Y;0'ēSN}h' .7jm2'RCE^w}l,q=K D ^aGL " MaW?LH_ĻF:g2 Dp Y$L_" Xmz'G}DfR_Hհ%/ :\ S/ܨgxp;ް{B퇮*`&&S Lky ҲMC'!GGǺU~T#6HBU!VG"v1̋Q\5!@>V^,)1SL4 +I-9gw 1#8kJAuL 5*iXϧG<;m sC 0:#*-S<@ b}Hu_3*?v碈w=o{EGJ X%]P-]n"N|u,V#<35e}'^">&/#`I+ CߑVŘlbqzٻEx iTTSSc눉)gBdٷv~ywyaqR_4 PCc6%#$&/Ϝo9#c=(de6^?iN_Q+ p=JR)ȰX u c}Y! fb~üz}H1} מ9GeP-u;*GWTNņ=歵B@W;nX)gLVC\R 1=RR?50 XFLUP)W&q԰B5*CewּӾ]vq뢫a*!GlIeQl2gLqFn 9 >xa3R]nkv#駖Q_^_9H@ϯ/ R% .ՈH) Df˥> ]VWzfhXI8/2ĽJj`ָtH9׺U(YrJ\Gp+"m-L>\@>X|^W d3'5:[D2ZPZfh/&}Z0W>>g#N! 9[ja!z^RR{wM:OeK6 _=U[@Fǘ3~OWn3,$<q^uL5T ++ &6M&3TŦmf78dN0Nnr[k7qr` ydLFOºhAZp:s7Gy)%1z^w8z=,V*^z#e띊-|)j?S/ԟ~^>cn\T|ޘ.a\*i} F6 Bd! G7V(+!+`r y=\ߦ[D)q9~IϨ}pho! - wJo1R:A c-٤yq,]FK"i"-0I_}: E{J_Gq۲RK:9PG It\)w8UāgM}FȕbnM5ƹn /7T{fϹӟf dS)M9` "QU(jdi)4O\(4ժKʽ`@1T`?<"6T!Y( G$֜*1ҁHo]Cs/-pr ~- ti%)Y=,E[rW_D}ATtQI#3X [Jcor (ؘo %7;_Kc1ZF#2:k4tI<$.ԱDa ^Q͡ Bm+vFuc2Dsj3=wCHݍG+w%X#(WT\!f:K?}qoK wYCsMw?\h( jSQ*1eQ(䍳PĊҹdBM^10XYe$ pDǬh8W/Yr.ؒy[yR7(C=D}/g2#)X7e]NeJ>}#%A?wZv 3<SKUg(4АF_ҍ$>3${KzO*&%TXEܻuLwʆHikDZ'֬u|ڝe Bk819mP /SyOL 4 [i{Fy2zDSiۆѩ#dʉ+k F05NfaGͬ|ͱ3M'/s/F}*V:3,m%Z7mMqS!~ mJ|T} 2X=Zr˄D'rye^XJSK݀#Baû%EBpK訪RGo3g`>=| f0Ǟ^W3 gZCETr:K:# dM1czX1Qd$BK3dY\2Z(gg#pFe*S]nX 7e)c8b^Mo A'-b9 c5½Zt6t~QwDQٌ .Nkq(|;n9_N> F5ct\y]֔XңҒzsW*(3 ţ N21q;VÑ?|T1HzӭHmoxfئMA|vb-<+ k$gv2e =q :R3\+Hv'H& z_t|.qlrLh5ji [|sgO33^{/.]j70$ncVa/_g] :PG;e_JC Ց싅xe獹xԬU[+݅T0f)q/VIq5|: *<?AK3 HƠNQW^KREL0(G^?Xq느ca%zK~.B1! D+Rp/"X9~eKJE\=. @{D1⵸%\p n&_YI2Gy#"ssr(b:۸,$$غ Qn}xoTyezkEDgSцKDpOLFR^[o?5}lyWhu2~_Nx2_KULn˼ySo%Xn"F|lKBNtܵ(E&m0⵨~ok/A;G7֌W:h( >;odNɓjK/ʎ#qλ.]ކ|)* Too%vAkD>zCF%do==&R*Ja#R|u5Jb['٨p߼F7zW"M7:@ yEy~=uV??ӳ'GXtp+,!u 7b*RY|P# 6Md/GyEx:K}MK鸕qzm6X5_VJdΕ OmmC,  |N57Ѓ7?1l].Lꮄiu`Լ\D7>,El_q_Z ̤9U,OʠAgɏca9,x}M~OU^H'ܳ>uYo3W%-2,ܙ5C"@<pmsX36ZU#w)u*=>_`wf%1u!݃;hCΛd483fJsO:рz@rrմe<{ ^&LN{33Vޙ%Lkɏ]/.$.fm7PoD~jU7LSǒ^hcALа՗7~>Ql 1`:׺vx%D"APbSpsG{| UhK78p{>=l38%.IYIZ&E<ŔfԔHd*@kI~dZ=fhF&s 8)D -,P}dUy(1̌ o8yE Krkd_qz 8|C&?(pKE?燁=?:N<]w;*˲"\$4у TH\a~DP_rUo'`H!r4J 8Ζ'@ 1Yekr1wJTvQl.ir fe|POE"9Xfeڞ!?D3$_Sށɇ7O{+c#ʓS;1h;oaq>8J鴞x$xɄ,`%UΧ`aɭ[D~SgT'@HF̚\iW %@@pk2 cUBhCɤ#8O g-sy}mN}XsE p .-::ק`(ЇؗqI]ְ;=,vuZД ܻ wB C~HR :&Ck&0rLɟt}i"*EˆB+ȧNʖ#+pJM<^3clOLAS[#p [݋8X0 ?qeG)l[&K-f nq)xI&W(} zc-hZ%lm_٬%<PӠpĶ6ʼn$>kv;-xؤ \6C7N y@^A~엲)ؓ(:I| XZRu,qBV`8aקBGw>^ ;\,5ǑfP(;;`}!sח[O*/g9%*:j-6Y#['Lk4jB!X: pf.B5`avCܻZפs{6-@`1Qx#L*0eϽutի -:?,(ΨBod5=(Z`I9O0+$z+G&sc9axW$k KdqC-=Yh˅~Wrc3,wjY6ҫeze8,U8S,ēQc1v Ȓ 052xz Ի;XX$KnWn(4n>plNc gɺIJ]選ǭ/j ͑L˩=DSzMmL6DLL@j~pbptjnw0p7"܃D/kzט0<~]hqF?s(+]jdP\rݸ gSe⭢0 "n ?Od]6lcSr&w>5/vP:QռN*@Ob舚Bn+KK;oĕ,PÂ%bޠӺ~ d YUK ]נ&bie}ۙ+l WTfrAlԒPtgKJҼCr&]h*B4 RTJڞwpC:7:?&to6ޗ_*?eRBjoFx~eME&ܸ ]4q,_D hbjBWKW;(=ne|ETxdݖЭBY ~'F76aˆ`[ ֨M!C-[]|j}ýסWW@+F&3F'4 VxoUV?YT~\r#V%3$Pï&M[p-CVuI{YW9P4cD'RFVd'}=: W:rM:YlaZGCRQ'>껃J4,=@8`$ Z\j`eRa?ziu3k @r)d>+m)x->!۴1TiKC-kBXS9&(T #EF$dVZ'7f/cֽITR\Y y:ZX%Ew*bV _^Ng{*㮮l~j#xٌV_ؓ)ÿͪ\=ש$_T:]6L2q(nZ"~>aEœCs1fgdMFO$]'צ0Na,ѽ[;W,'p{zaŸ tc@I-2byr苿Ѽ+}rxwiv,U[\[%%b?A (U٭SHi M;\DvuHH @hyjB[ZJC(5:;QZJzuۏ P"aS6l5ߨ>l3s$w9_m9 d%;d`on?dٻvcQ([ǩn3FwǡlJl(T71}NHJc`,xG/1GT~m-ɒͻ$ubĭ6HƉJfbF*"DjZD-1_<ԃRT/&u @i !$A)i\'U[$*'c@y= Dd9Om&5&Lku ]B%Фd!Y0Ƴ0T+rt;SGA>{.jQ?S%@wRq|[5}>SMl^LX0~/ÙĉDxrTdGv\jΖic|!y\ߎqCbLvlX"ƥ*wMݵ0}@pohꪻdVh{LrI=:g9na+@JX_Vu0^j.1Su= ZN3Mxi( 8' u^!z-Y%no(Ħ%?mӡ8"h? Ѽ"[|L3w_z٬0+jϥk\C+ݙo\T:DS2hVZV{hcWnRHF&7֫ ̅2D=u\،h@pGxbV|j~1G<99ԔZKs_$FٵG{3/O')kyMrSw,1}^tO@fʴ(5 cspj]F6b(nXÙYS<.xiPpfjIWJӄ[tB.h"gi%tfhJo[~su:hO FinE5ԛApFXGm)t]YygWhMKaנ8h/Y/wH^V'c`*x.yyI_@Y*k^f {nǟICA%[B=<_oi%{`ڊ3A#fdn½J5 _Wڻ wY͆yHuƷsܖ"}N_bx=o1 zuV4\?L#0Kfb{eMVȷL+l,DreEѩ&@S oќwq0=SEPN";= d9T oxD7|\zNOPeztX4B]B툆4A~@ΑvAh*2jT]1Y[=ړ(h*ϯ-Z@nɂjqW6du3.Nj似V_1E%AdL^J Vb?~ NU_qz@1fXcg u B>BŅxͩئغ=?)㛓&1S*1fcKOɟSvg_cgtr8$Ϝ&GEM9嵋iS*T02,|7TWpOzSREa~9,-ZOCF~Ȓ~qo*8ZE)l w2ԍDJ݇Q(~8dژw-;.o:;'EI ‰W`wN" d- uj%Ғ]Fu{ZW' >c!2!j@W 2P2%F1nrldJ ^|}-''X Dl .4&0Ѭo-{KxJ>M#3E@=e`y^|K~uR5A [8a>fw )'-UT,%{[5",-IK_Zs2n;j[4mrxf|*!ɹ^ x&OrHD6ZEJܑPKFO2KHuCN=uᕧX%@pc91 Ns9տ0rċi͇Edrܫ -_DP|]jq"Sco=e8;%5qVS'S8y)萕E\wtv8O@({niQUښ gnN:e 5Z"'E9~a4E#([H\A`n# +\}$}GO)2٣/FT TNO5ו`Ĩk-<g&6i^Af=!V w3#:Э3ejK`Xө"=EDv-b4Nv:%\hyo+mM'͂2= S=zt)]vzLUh__fQ ml-!{GTn]X᭷s*h`WimD8íYDP")IΨ{rbgv:2͒SOq*FiB ,lohwOPCo< ylL;#tKC,p%cᙪ'l!7x|هKz:/I}m)$QhKL`g} ^ln@8 z3C-$*x܂J=4/^)_ҁ-Rj'-_g~՚80YW{Yo۞qlhx%:IdkZҔ j=><{l>Zw3jqۂ>{sjjIWBkcƑ~OFA-܄pAN~z ׾S>[όxn農~O؋CHIX.\l͕J^f$ b,F=)LyvRtaH&؇6&^U=ى_7Zրp++ q|8j]1'wQ5{} ].fqTUYÚɬps W:&FEBEx^fB*<9h )/O݃%ϊ3\\bNEKL"O5V!m/)fnUjv.d[N\Jl1 L2 dE.~BÏN A{TV|b\(x5VhHy P Ӳ.?Sj,agC1!k0)eI+d·ctoa~Rm ^E5+0m1}}]shLZ:A="Q {~p:ՖfԿXleȝyJ달̬3%Fݺ ǖ{KGq-v۱$͵c`,.w+VV=&.r(A8d.2@:|H8ЄFeaty')sG{,%llD&#qxKqD쵁N%c&Lې9T[n*s0k=p/J_1nzt;-HFQqNRWYW:5қ f,RMJ6|9i 3 !.ԑX$2Lx֛g6Nn:vywyszkKFG&3ҕr$վ HWg mw]\W;U,|[c}6ӻi4gqb I~ԦzX]k@`bV|Ϙ{!6֑uR R͆[7e.*m‘t46b0g2S4@9 |G+GH4S4pg*Z*O 4eTRe3 靶9RE.0),.QDС cҕtMzζ!%@6F115AzglYys"-ؠ.O>3TJoEن4o}?%NKMmA8z^C&,^qkِ7jwX<r2E8KI˒zՉr攟 _\orfo)* ^Ԟ$`S]F7'+T8-DX :VU$@0:CF0=rŨ_O{5Grb54}#KAwN1=d(dyJy(bSՒ\rbkA^ѹ߄gɖzNA#Ї-pɐ HG?y8R9_3OAl'ัXN^h]m$4@HfOFŒ^[R˳b( NBej-~'S8l cxL:v=6xS͡|ll19q7?cl"fj9{^L')8D%qãBB6V-`>>]H='gfb\n@4a:o „@7Ks/W.~I􂑋Fm>d5ڼQC& _ aL}5-GvvjbevPH ~Y22~_ôBQ=,9^+'=zb߂異" _*ǧVTS1]LiVȪ>V+I$f >(c@>^i!HmSP-pöP2llPr&11b" FJP@|)0Д t f5%3s`jϞ+yH~u$N u$mhf:̈!P| HSt+EjgHA-eG51Tag^ZlO֛/i 8ݕ edJ/sSWh: &&l}2f'MVw7>p=2%q׹f^\%j ŀI2e5 39˯g[%DvYffrf vt }>Lj}Gj2ԭ^3dQծ >8](9}å4usκz!>띤AtDR:03POcAc hY>l`n2zV nwKxT&\c07k|8Zׁen4֊aL;Ľ8 7Ǥ~i ϰ"ti1,L0@XࡽksBjC/'\S_Y{t4jT${iA%" uQc{QrGU[w gi 9wClCB¾X;q$FlE(qin*qoȧ 3Wn0͜L'{s-!#Xj`4@$Y] ϷnZtg6R4jp7 ,{3Ӿ[YfM1]LxaD CtKGÊ}*[]vGe… 9v{ B3mUt#* 99aQ?ldD\/n6{Nf|b~.w}ЛM)u8M(³!Gdei].Z;kQbs_9VdY+{eK[neFl,G,rhĹ3K{Dic W-3IIP~xG fUuoZ4D̕3NfbgU%v VǏf?RYvPW00[fs Ei1W2ǹ }8v˖ALmj'-w'3hM4v$ɯ$<\ž^N)`ck,'KX(?C(z'GM!#1#KFǓJ.ā_j緱'(ؠ I v&/kӖ Fb6?m"gCorVЮbEW9?j7 ] ۏaֵs8|ULҬ++]!RPx@?덵ż\"/n Z>*-)u釦Ţ, kTISNv7H-z(_`|!D L4mU%Z/Z.p>;{99PN#W2/!8yֲnC]jK_?$4ذK"!6gVMX`jS$EM|0rԶbqv2ي?9O!q)0@;8Avшhsܚ FDZ`؃ 0{[Vx(t 糄UBT ' /Rha!<2C{%L-گֳc5y1n1^c;1l_4z# }xwv2AH `:E#:Fܨk8b k8%(JS _6\ TKvbF(+qw?6|':w:VJ{|qӲ98a'g\Pv]Ő A$X׾xl}/OpTޫ#w|[m<셫iSRCZ_Bc.΃ yyoNZn稼"IbI?(-hFD8Y͞Iw,#ψps@kɳ\+9i%k='J>2X)^cJS] ΀ AD:C?drbʨkY/SH#Yރ?01|@۲ # Kce?ᎹLT)2zxlNт }k+š{)"ͅ;BW@ь=ڽBإ?#+)8Vp6*8gv+Ƣaa">],O<#5oA^n=a((s7{-4Fx6֫)&Urt(N"erL YY#'I=KEY1jjw "Va0OyVM14syhO:<`9k }Qx:wθ,bV16/"T||wϖŽ';JF}bk},}xbY=ڐ+-Wi%ǿ7oLry"!E۬l(7H#H-[x1Ͻ)Ǝq(@ t>ڤOrR Ŧ:f/7I|]7( VMor/sܽԜAgMWI;Uä),p݅8UPyp|ե7^GAC61Rlv3ldw]K +eZ0 dsW"vqOJuFثv[Jȸ6wD;| +O 6@Qp}1i*Ƙ$ɸKT;\(.j5N>ۚp_ᝓ#>t3z/|rɃИq,ݯ>~lMEyeCv}j8cq؃v ڷYSE/L,3p=ʍ SP9-M)yO,[9컆Eow9 Ŀ qM't"8oi߲0{Q賋hF}cDqW"BDc!" KzRU_9Xak-rp{ѩ݉b*"nK^kDܼ<=%rpZaahQ7ApŽaj0CmB=,S*Ds0s^-WboU":?N?s\N9wX_[:iYJsTt("Vu.X స(MM]N_1]COeȋt%U 5Z& cLzBH0'_LEM'щ*n@ۤ8L =p$q~iݯ("?ZWOKB7Swv`f&(6ޚSBz 'kNfߔ  CAdjp db@SQ$t{i . x"wL1Ϧ(OÆMaZ@\(wDUr呂"8Έѩ*v;3Y͌`#'rJV"XK4RdK|n t{pk MOrfDr$@N+ReU'c96xG'bsp/ TA⡀cMmQ,`)Zꄸ6k=k1W˔V:u@nx bC fRfgέ*0,^~XV5iF-|v(ۦg+Ta5"G1=2G*d7x2.BFTUIa`SIemRXE\Oc08nj}'g qmרԷM5iԶ U~ ځ,t|v̡00s*v3ZnCi)+ ׊VtziY-USA]vTkz( # = O}fm-Q])|Co»$i'vx^SCpoYn뽯8 DwPX~rFr O8<5e!r?&zBD4K,9U6YF-Zz4#y.Շ 7D,&021Wj[=vp2Bn-E&6G N\rcM?-ܹrt3.I+4ŠNi^ qHEkxÉŘ k*H@ߜٞF)B| nHPIBW6f\j+`F3Wx1h/.Uc X/0'.TC N.Ҁ(:\%gf8~do 1裛:Q8?jJ3puUgx\l/; l}55޶"wrMS|3 4<4E |7gº&CRHj0HkTqL4tfl 4'&=\L7gZ. F udWE?{ !Zވ". GJ|WY;; ~{!yC}$# C.4MixrfOsBW&Ms9D&v?`3ob#GFCY5ǾPlrEz]왈+7%w/Ku \bjT.eEin™E! p,6 S UYI8ic=m II*ٰқa(6!Ն:MlѯA-u:v# l?Iabm Оe .mq<UHq@ a~Ύ 宩NH $ ̫Z[ηpۊ_!zo7r!͜=3P8<z3xK&-:nRYIFbz<#Z w.tj\8(}JaпVֶ,Y>O7:rWsINڱ-P᪸$5E7O%(/ ۜ#l߻5ZѨhW^KX>n-,Ԩ$ru|) "w"9z/)05CIDBr O DuQM%SQg}@79(6;ۨ 7UF|}A/_h4M)d)]\oދİ:to@i6R )VA}9q9%ݭ4$518kD Tud+1[]xrJऩ#&&[Q1GCjf?$&x<j7֟h|Ja5AoǰK$_njT{7\Ke|˂< RMٻ8 s{!8dqxO,Y s:DN3dfT[]!zD(͐)V`Lōd='W'ِZR!qmN|Â}' ByӬ\qM f_H֞[քUod+|ޞ*sԤOx!H&ƳX7HGأר>TOdzQDEHykk554u]$봨 䔳LxE ̵N`dPgk:/NV.3aeέKlM؂vCrqig[6"aq(,1!2\FK>ȫm h{r]fzQg;!HD_^{.䙆v ƊKS|-,nuZ:ͅ U79h~MIW'iOhN8rޯ!KIȥɱ1wo{F JTS\]$i*83K/oE:gJ4 S^ :}8 Cl1 ƚx:W=8,q.?uC9hkAPiAW':CƆzKy cQ#D2]mZ2ꑇ]y !ʭBh4ϭraiآKWCUQwDUw7 n}=vLN YPERmvxwyGG?' sޝSd!Aqb4"RӔ%X_Ȭ]#-R٢w#n ۧ8QH{ͯ;0Qӑ^=p%|0e?'DN n B&P&eGD'^~q;#rMͶ}Y;gHCD7̖DX(zS&wI6 aNE 塳z\yE'pxSBk;ڽuNfge-%vdLa-P&q=?<{'TTypBcYΓ!s0@bAԪ5yC8jx) %r (2;6l)@a"l2Dj=0| ץu+5KRHbXw3_zP^NwfǥxrH 'NHbUwWІ\ZEzڕ 0Qt-±Š/5ēp מ)m<=V-1|Hq7f3 nAT5-KVI.CH8ki. Gu2LCBR]  U(ABCn&:1yid_v|i)FiձP\_L"ჱ`7D$n˩zFIp;ZS>K]Kv"t @*|:I<1| E6P1~\ Q&eP{8|Sqva'a9I"n8EêH0?飖R^> j%ɢ@qJ^ukt!G;F|΃!op^h%_zvV?8 .R46F'sA C?m3 { +gJ#࠹irf8(DۓdકBHp5tR&_"_9WƏLFh|yUTK_'q뽏nPkGkx#e$Of@=6+fy?E$mRgؙvmmEː+ Y )!]/8E|zXRZk &t-Or ~7E2O:Q*x!-aaU[0g3dsltG2&^1y|v.asfuCEƺFAy 쵂 \VaQnBҘ=Sš7~=OcHhXbۻхf0i➸[ Cb1kgR –'c'pv抦d#DUPgiVХg&a55A8 6zA-r(86$&“^yT<{:HjlϱqP$%bv? 2K qNnrGxlBBȝ7q%ڄnڨhHq01 Fz^~\_ƹM$Fӭ uU,IIeXEB6KNRTw:'u?Uaa[y?1 ]M{ឹ{y#̷1J8ƒ9 U]VY_JJƂWbY9,3@CB17\\>?(P)p;G#ecJ^"uP#FCuq5E,OjAx8V"( (id^fJI~mvf<߫*rtC/-~)a\; +ѳ9,S^|95ى2^̚8V >nWpJr|оBfN24-NCIVQLZ{'P_] WXҜ+n'vuOce@T\ux3< -]AhD!O8||D -Ϋdf4>; Cho-8v0~Uz$K ʜSү35l若ۓR--*13w:g@u4ȍ@Hj8ZHLoYœUhR֍".@{(0ZnO7ꌲɵ?Gݸدy'`tg#:C aS?MkW5}ɱ- ;}7BO*uH1$V$[؊Xb)!WDC)8 A 7xVՃO4Ԏ\ )w2LdyCʫo֠L.kܗrI^EZDQr#, B$ɸzU|ia@CF_]AqU7%`/$58(G|t'*~AϹ&=ށwAkY,MN' fgI` =Cv:ip@la˸Dz훝~b6<:w }cq;î;^!xJV1F; v۱݃j0DB^𛜟qWhwM_Zv7|wAO7y杞:ϋ`9ҠP)|׹@%iN~j+bi_sU^+b8-!΀#$bT|J)*qisnpDCcwÅndq'wx#te}o+sqx-eILK'[GѲIf#l+<r^ u|G}&.K/3~V&nZX)si?R#lq/8K' DeѪI}>ح _w<'4vܙk񡰶?![ulxr}k.Y"ѻ5=Qch<Vx(pD#PR ۟UeCkOD3Y4ӎX| ۠*]^#a$GU{^M/$NMwr"ߑ &`f􏦂 cJ {;0/Z6WX vs*ߥ0CQDDQEpŹAP qckN A+=3c`ק5h0."S;t,h۽qT/#v3!9clmZUq׃ :˿JG,7[Ċ!e`͛Ɨj%|U}d/2o]3;9͚*D8^m0VzU2uuH~ %0qb:m脗I'fH%k VE:s2V%|n^DO7cgJ\1UIFzzs)[p{@S0u o3U. ֳTEvm$F䢯W]]%44,}TB~f $覛改aTR쪴.CŔ5HtUZU=}TadXY\k+Pup/2,==txŚu4m:D|5 :2 }@с Zj^I|{fLMU 0i+Dd@B2񩆻IΧTNAS@D)i$/KUSLnV c'ټB0P Y zu&B?@NuH硠iTa-;R|{X\|֔w`*nОZ٭3)pi\4CU\_n^5ҖS_BKnnnYUi/Xqݨvyqs~5v6vQWfjZp dԖؤ| rpk-DntfN vq?)!8_BCj !qų+ l3{L;~ (gnTn0J^y|*"Hmu7-Lp#yx[xA-!U?\ęz3h-h4Z.g>^ݔ"i1p~|Ty}Ө@ۚ{+ĝU~(|~aܞ 1:vJ-/Iu vѱY!S*< bX *y6WFddZDfaf7I3fd4̛7Aoc5G*eҖE"Ц Z* e?m{,(Q"$p6bMlj/\WäAlXTSAEePJRBmE4,&x%s\aȂǔUwQq[Xq/)+ըӨ{AMYJQqYݵ3 9[Vy^7iį!`H簨wfNi禔%uжff޺%>XkH˓)ڇഢp"h< }]6qsϘml]KHzKAT ީvnn8eC k;↜eOC)CQor }jwDg,O宽J3:L.+ âv+`v*$+x=Fv*0y+/gH:K*θR_yiF5tgJ{2u-md*}EI fz5"6tư^oVxɌ'JY#bSGJEf1r*ΣNIn/d0B5Xi*kG }o`Z)A:Q?Yn^0J=>}T=Ks$.?T~2dXV5.~uJm%8o$壣!XYTRdBq=z wC_NȔHbV=/OZEYIzڶnl1]Kִ's[.mEi _bGeg{~!2,'9w I}k=FCy4m <IY*5VG(Nd;K+,'%2qfnrDwKer%^u@LãM:0ii~lJhF>>Ls>֊rfo0VXo M;uaaKӉkE I{r[}~M|fx(g8bR#94] basF7YL Ig (u2dIan{ժ;3pF3\v>E"<OӇ[Zt}NȕR?[y\FR J. I!Ąo]LKI461:U(Ja 7̱lܤ,wt,Q1^Wjt|T4m {0:q.d˔L2PkF,BdR 3ڶq*K/ mp%,$ێ5S3LP@?t[,K}6l^q %]Wdq" 0+rdJch}q3 `ZK6qqic`0Z[uA@^B\n2l4!ҹDmr:Bu O-n~|eF3 /