openscap-utils-1.3.5-150400.9.8 >  A bwvp9|0$'o0{'SG2J[И!geOGm@V ^Pyy kђL7Yd%(v ѧ;)3ʔٌl{p&OH( [xH Q>\q5&@Uzt65"yMu;p!7cf>40a}peG>/>3tQSbZrz_> cI~RbV)9҃6g!qc5d1e04c0f8b9ca5dd338e752396996943f92eaf7c1cf831a6376404763c07fc61de533adaeaed7c4807d9c3e17d82ab87a2e195s bwvp9|mG (Zk:ñd(eIjN2X,q^"RsE$=pyXE#' 9'>HxvE`4RDA~Pzw2ĎG>7p0REoaZJgFJ"tc/&pM9g0+*7 4E)C9tDAH0#ȖU3=zOוHKnioA!*8>pF?d " 5  '-4X   @  h     t DDs(8292:2=>?@FGH(IxXY\]^bcdefluvT wxyHzCopenscap-utils1.3.5150400.9.8Openscap utilitiesThe openscap-utils package contains various utilities based on openscap library.bw$sheep96bSUSE Linux Enterprise 15SUSE LLC LGPL-2.1-or-laterhttps://www.suse.com/System/Monitoringhttps://www.open-scap.org/linuxx86_64 if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in oscap-scan.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in oscap-scan.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable oscap-scan.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop oscap-scan.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in oscap-scan.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart oscap-scan.service ) || : fi fih ; /'Rˁ큤A큤`bw``bw```bwbw`bw#`bw``````2a38a20b37795feb3d83ca971791742e3fdc3fa6a13cd9ee3b67d3f4561c2017f49202e90f29e58f9dd17c0f316a98f5b834ed360b85b93b9227ecdc5147f8c2ed54695a9b70f513c554f01999f4a6a55ae2986154b9d26c4e05823c64ef80c073385d11262550a7b1c665991419b53cdb491208bc03b25e1b914f834c55a48c0b328389d2ffc3b2b8e782216a31d589d14c3d966b5d76e0079a5ffa87752d882431ef7ba3264c0c0ced4d2ce779544a3f34f7fa2192dd6404da922ccd6b444cbebdeeec653a40c114909265d5386a29f1e4afa71bcaa632bbaba01b21ff90db24c7db43e1a984f84bd67c986c9c28ec99963be13f3a6fbe2bc58291ef8377dc92372ceaa10c867c308439081dca611a93e2069078cf81aae562a6a5238dadd28b6080b26f7430a8688f761af93e373185f02c801452a6e2fac919d9fbc593efe8135d3ba56802f925980aa66cbffd7841bd10e92888a927bc058ae1bfea23d0de3ebe1fd0cd236487ebd6e476311cc700b53f2fabb20cd4da634bd94e9521c8f1090cfaa6dc15d52ce84af9ca759af21e153034213d4ca817ddf353c2b77c8dfbea23214a33fe3561603ea2db357b39b56904e61441f9d18af1e24450ca47dda55f5d40f06414dca02e2c1c70e750d9b1cffa18e9b038a27874813b6e70df610523e68e60c4b1d6986f3c8f2a2e1c9d07e383cab7b2a780147901e464751667ac8cff9f2bdfe3ede51307587361c2d9fc7c0f691b77e395a2e343b9bcf24ec5d01d832962fb3e4051d51724d9213cffe08c8884aefaa31d700cee7d9cee3fe2servicerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootopenscap-1.3.5-150400.9.8.src.rpmopenscap-utilsopenscap-utils(x86-64)@ @ @@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/usr/bin/envcoreutilsdiffutilsfillupgreplibc.so.6()(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libopenscap.so.25()(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2.5)(64bit)openscaprpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)systemdsystemdsystemdsystemd1.3.5-150400.9.83.0.4-14.6.0-14.0-15.2-14.14.3aaLaZaG``r`__/@_Q_w@^^{G^@^^]:\@\[@[[@[ @Z@Z1@Z1@ZZ@Z Z Y@X@XXoX2XW@V@V%@V`.V@Vf@UmUUF U#T@T}T|X@Ty@dcermak@suse.commeissner@suse.commeissner@suse.comsteven.kowalik@suse.comrfrohl@suse.comrfrohl@suse.comrfrohl@suse.commeissner@suse.commeissner@suse.commeissner@suse.comrfrohl@suse.commeissner@suse.comchristophe@krop.frmeissner@suse.commeissner@suse.commeissner@suse.comrfrohl@suse.comrfrohl@suse.combjorn.lie@gmail.comrfrohl@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comjengelh@inai.demeissner@suse.commeissner@suse.comrbrown@suse.commeissner@suse.commeissner@suse.commeissner@suse.comjengelh@inai.demeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comledest@gmail.com- Rename oscap-docker to oscap-containers and provide oscap-podman as well (Relates to jsc#SLE-12852)- openscap-docker-add-suse.patch: add SLES support oscap-docker (bsc#1179314)- ship python3 docker module always- Since upstream has moved to Python 3, switch the BuildRequires from python-devel to python3-devel.- Add definition for tumbleweed to openscap-opensuse-cpe.patch (boo#1186735)- add old patches - slightly renamed; cpe are needed (boo#1186735) * openscap-opensuse-cpe.patch * openscap-suse-cpe.patch- openscap 1.3.5 * New features - Made schematron-based validation enabled by default for validate command of oval and xccdf modules - Added SCAP 1.3 source data stream Schematron - Added XML Signature Validation - Added --enforce-signature option for eval, guide, and fix modules - Added entity support (OVAL/yamlfilecontent) - Allowed to clamp mtime to SOURCE_DATE_EPOCH - Added severity and role attributes - Added support for requires/conflicts elements of the Rule and Group (XCCDF) - Added Kubernetes remediation to HTML report * Maintenance, bug fix - Fixed CMake warnings - Made 'gpfs', 'proc' and 'sysfs' filesystems non-local - Fixed handling of '--arg=val'-styled common options - Documented used environment variables - Updated man page and help texts - Added --skip-validation option synonym for --skip-valid - Fixed behavior of StateType operator - Fixed some of the coverity warnings - Ignoring namespace in XPath expressions - Fixed how oval_probe_ext_eval checks absence of the response from the probe (obtrusive data warning) - Described SWID tags detection - Improved documentation about --stig-viewer option - File probe behaviour fixed (symlink traversal now behaves as defined by OVAL) - Fixed multiple segfaults and broken test in --stig-viewer feature - Added dpkg version comparison algorithm - Pluged some memory leaks - Fixed TestResult/benchmark/@href attribute - Fixed memory allocation - Fixed field names for cases where key selection section is followed by a set section (probes/yamfilecontent) - Changing hard coded libperl path in favor of FindPerlLibs method - Check local filesystems when using 'filepath' element - dropped, because not needed anymore: * 0001-Fix-memory-allocation.patch * openscap-new-suse.patch * openscap-leap-cpe-15.12.patch- 0001-Fix-memory-allocation.patch: fixed a crash during oscap oval eval- openscap-leap-cpe-15.12.patch: add CPE dict entries for openSUSE Leap 15.1 and 15.2- add dbus-1-devel buildrequires to enable systemd tests (bsc#1178301)- openscap 1.3.4 * New features - Add support for FreeBSD - Make use of HTTP header content-encoding: gzip if available - Improved yamlfilecontent: updated yaml-filter, extend the schema and probe to be able to work with a set of values in maps * Maintenance, bug fixes - A lot of memory leaks have been plugged - Refactored rpmverifyfile probe and fixed memory leak - Fixed SEGFAULT caused by recursive and circular dependencies between OVAL definitions - Fixed DOM representation of the profile platform - Test suit: better portability, more granularity in results, inclusion of memory-related tests - Compatibility with uClibc - Local and remote file system detection method was improved - Make the report a valid HTML5 document- openscap 1.3.3. Notable improvements in this release: - a Python script that can be used for CLI tailoring (autotailor) (thank you, Matěj Týč); - timezone for XCCDF TestResult start and end time (thank you, Jan Černý); - new yamlfilecontent independent probe (draft implementation), see the proposal https://github.com/OVAL-Community/OVAL/issues/91 for additional information. There are other changes as well, here is the list: - Introduced `urn:xccdf:fix:script:kubernetes` fix type in XCCDF; - Added ability to generate `machineconfig` fix; - Detect ambiguous scan target (utils/oscap-podman); - Fixed #170: The rpmverifyfile probe can't verify files from '/bin' directory; - The data system_info probe return for offline and online modes is consistent and actual; - Prevent crashes when complicated regexes are executed in textfilecontent58 probe; - Fixed #1512: Severity refinement lost in generated guide; - Fixed #1453: Pointer lost in Swig API; - Evaluation Characteristics of the XCCDF report are now consistent with OVAL entities; from system_info probe; - Fixed filepath pattern matching in offline mode in textfilecontent58 probe; - Fixed infinite recursion in systemdunitdependency probe; - Fixed the case when CMake couldn't find libacl or xattr.h. - dropped 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch: upstream- Add upstream patch to fix the scap-workbench build: * 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch- switch back to official release - openscap 1.3.2 - the test suite and build scripts were improved to support Debian 10 - offline mode has received some love with a set of dedicated tests and various fixes in OVAL probes; - the oscap-docker wrapper is no longer dependent on Atomic - Python binding are now more robust - HTML reports and guides, generated by the scanner, are now more accessible for non-visual rendering agents - Support of multi-check rules has been improved across the whole workflow There are other changes as well, here is the list: * New features - Offline mode support for environmentvariable58 probe - The oscap-docker wrapper is available without Atomic + Maintenance, bug fixes - Improved support of multi-check rules (report, remediations, console output) - Improved HTML report look and feel, including printed version - Less clutter in verbose mode output; some warnings and errors demoted to verbose mode levels - Probe rpmverifyfile uses and returns canonical paths - Improved a11y of HTML reports and guides - Fixes and improvements for SWIG Python bindings - #1403 fixed: Scanner would not apply remediation for multicheck rules (verbosity) - Fixed URL link mechanism for Red Hat Errata - New STIG Viewer URI: public.cyber.mil - Probe selinuxsecuritycontext would not check if SELinux is enabled - Scanner would provide information about unsupported OVAL objects - Added more tests for offline mode (probes, remediation) - #528 fixed: Eval SCE script when /tmp is in mode noexec - #1173, RHBZ#1603347 fixed: Double chdir/chroot in probe rpmverifypackage- temporary openscap 1.3.1 git snapshot - make it build with new RPM (bsc#1160720)- use distribution-release instead of dummy-release- openscap 1.3.1 - New features - Support for SCAP 1.3 Source Datastreams (evaluating, XML schemas, validation) - Introduced `oscap-podman` -- a tool for SCAP evaluation of Podman images and containers - Tailoring files are included in ARF result files - OVAL details are always shown in HTML report, users do not have to provide `--oval-results` on command line - HTML report displays OVAL test details also for OVAL tests included from other OVAL definitions using `extend_definition` - OVAL test IDs are shown in HTML report - Rule IDs are shown in HTML guide - Added `block_size` in Linux `partition_state` defined in OVAL 5.11.2 - Added `oscap_wrapper` that can be used to comfortably execute custom compiled oscap tool - Maintenance and bug fixes for a complete list please see https://github.com/OpenSCAP/openscap/releases/tag/1.3.1 - removed patches accepted upstream: rpmverifyfile_unittest.patch rpmverify_unittest.patch sysctl_unittest.patch test_probes_rpmverifypackage-disable-epoch-test.patch xinetd_probe.patch- obsolete removed packages: openscap-engine-sce and openscap-extra-probes- Drop gconf2-devel BuildRequires: It is not mandatory, so lets build without this obsolete package. - Add pkgconfig(glib-2.0) and pkgconfig(gobject-2.0) BuildRequires: They are also optional, but not obsolete, and previously pulled in via gconf2-devel dependency, so lets build support for them.- openscap-1.3.0 - New features - Introduced a virtual '(all)' profile selecting all rules - Verbose mode is a global option in all modules - Added Microsoft Windows CPEs - oscap-ssh can supply SSH options into an environment variable - Maintenance - Removed SEXP parser - Added Fedora 30 CPE - Fixed many Coverity defects (memory leaks etc.) - SCE builds are enabled by default - Moved many low-level functions out of public API - Removed unused and dead code - Updated manual pages - Numerous small fixes - xinetd_probe.patch: fix trailing whitespace in config - test_probes_rpmverifypackage-disable-epoch-test.patch: fix rpmverifypackage unit test - sysctl_unittest.patch: fix sysctl unit test - rpmverifyfile_unittest.patch: fix rpmverifyfile unit test - rpmverify_unittest.patch: fix rpmverify unit test - openscap-xattr.patch: removed, included by upstream- openscap-xattr.patch: build against new libattr- scap-yast2sec-xccdf.xml: remove platform cpe match, as it is impossible to match both opensuse and sles or official suse_linux_enterprise_server names at once. (bsc#1091040)- openscap-1.2.17 - New features - HTML Guide user experience improvements - New options in HTML report "Group By" menu - oscap-ssh supports --oval-results (issue #863) - Maintenance - Support comparing state record elements with item - Updated Bash completion - Make Bash role headers consistent with --help output - Fixed problems reported by Coverity (issue #909) - Fixed CVE schema to support 4 to 7 digits CVEs - Fix output of generated bash role missing fix message - Fix oscap-docker to clean up temporary image (RHBZ #1454637) - Fix Ansible remediations generation - Add a newline between ids in xccdf info (issue #968) - Fix unknown subtype handling in oval_subtype_parse (issue #986) - Outsourced the pthreads feature check and setup - Speed up in debug mode - Refactored the Python handling in build scripts - Prevent reading from host in offline mode (issue #1001) - Many probes use OWN offline mode - Improve offline mode logic in OVAL probes - Do not use chroot in system_info probe - Prevent a segfault in oscap_seterr on Solaris - Out of tree build is possible - Use chroot for RPM probes in offline mode - PEP8 accepts lines up to 99 characters - New configure parameter --with-oscap-temp-dir (issue #1016) - Fixed OVAL record elements namespace and SEXP conversion - Removed '\r' characters from help output (issue #1023) - Full Python 3 compatibility - Removed basic Python implementation of oval_probes.c - Added support for Travis CI and Sonar Cloud - Minor fixes inspired by Sonar Cloud - Added Fedora 29 CPE - New tests in upstream test suite (offline mode, Ansible, etc.)- openscap-new-suse.patch: handle SLE15 and openSUSE Leap 42.3 and 15.0 (bsc#1091040)- Replace old $RPM_* shell vars.- replace oscap-scan.init by oscap-scan.service, add a /usr/bin/oscap-scan helper tool for this. (bsc#1083115)- disable scap-as-rpm binary to avoid python2 dependency. (bsc#1082135)- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- openscap-productid-cvrf.patch: add a --productid selector for "oscap cvrf" as upstream does not detect the system yet. (might go away)- openscap-1.2.16 - New features - oscap can generate output that is compatible with STIG Viewer. - CVRF parsing and export has been implemented. - oscap info command has been expanded. - The AIX platform is supported. - Many documentation improvements. - Numerous other improvements of existing features. - Maintenance - Huge cross-platform improvements. - Memory leaks fixed (RHBZ#1485876). - SELinux fixes. - Many coverity fixes. - Numerous other bugfixes. - buildrequire procps-devel- openscap-1.2.15 / 25-08-2017 - New features - short profile names can be used instead of long IDs - new option --rule allows to evaluate only a single rule - new option --fix-type in "oscap xccdf generate fix" allows choosing remediation script type without typing long URL - "oscap info" shows profile titles - OVAL details in HTML report are easier to read - HTML report is smaller because unselected rules are removed - HTML report supports NIST 800-171 and CJIS - remediation scripts contain headers with useful information - remediation scripts report progress when they run - basic support for Oracle Linux (CPEs, runlevels) - remediation scripts can be generated from datastreams that contain multiple XCCDF benchmarks (issue #772) - basic support for OVAL 5.11.2 (only schemas, no features) - enabled offline RPM database in rpminfo probe (issue #778) - added Fedora 28 CPE - Maintenance - fixed oscap-docker with Docker >= 2.0 (issue #794) - fixed behavior of sysctl probe to be consistent with sysctl tool - fixed generating remediation scripts (issue #723, #773) - severity of tailored rules is not discarded (issue #739) - fixed errors in RPM probes initialization - oscap-docker shows all warnings reported by oscap (issue #713) - small improvements in verbose mode - standard C operations are used instead of custom OpenSCAP operations - fixed compiler warnings - fixed missing header files - fixed resource leaks (issue #715) - fixed pkgconfig file (RHBZ #1414777) - refactoring - documentation fixes and improvements- Remove line-trailing whitespace from last changelog entry. - Rename %soname to %sover to better reflect its use. - Replace unnecessary %__-type macro indirections.- openscap-1.2.14 / 21-03-2017 - New features - Detailed information about ARF files in 'oscap info' (issue #664) - XSLT template creating XCCDF files from OVAL files - Generating remediation scripts from ARF - Significant improvements of User Manual (issue #249, #513) - HTML report UX improvements (issue #601, #620, #622, #655) - Warnings are shown by default - Verbose mode is available in 'xccdf remediate' module (issue #520) - Added Fedora 26, Fedora 27 and OpenSUSE 42.2 CPEs (issue #698) - Support for Anaconda remediation in HTML report - Maintenance - Fixed CPE dictionary to identify RHEVH as RHEL7 (RHBZ #1420038) - Fixed systemd probes crashes inside containers (RHBZ #1431186, issue #700) - Added a warning on non-existing XCCDF Benchmarks (issue #614) - Fixed output on terminals with white background (RHBZ #1365911, issue #512) - Error handling in oscap-vm (RHBZ #1391754) - Fixed SCE stderr stalling (RHBZ #1420811) - Fixed Android OVAL schema (issue #279) - Fixed absolute filepath parsing in OVAL (RHBZ #1312831, #1312824) - Fixes based on Coverity scan report (issue #581, #634, #681) - Fixed duplicated error messages (issue #707) - Fixed XCCDF score calculation (issue #617) - Fixed segmentation faults in RPM probes (RHBZ #1414303, #1414312) - Fixed failing DataStream build if "@" is in filepath - Fixed missing header in result-oriented Ansible remediations - Memory leak and resource leak fixes (issue #635, #636) - New upstream tests - Many minor fixes and improvements- openscap-1.2.13 / 05-01-2017 - Maintenance - we always build system_info OVAL probe, fixed configure output accordingly - warn when the user requests to generate an ARF from XCCDF 1.1 - fixed a segfault when loading an OVAL file with invalid family attribute - added --thin-results CLI override to oscap xccdf eval - added --without-syschar CLI override to oscap xccdf eval - fixed a segfault when freeing xccdf_policy of the default profile - removed ARF schematron workaround when there are no applicable checks - fixed verbose output in oscap xccdf generate fix - do not filter fix by applicability when generating remediations from results - fixed memory leaks, resource leaks and other minor issues- openscap-1.2.12 / 21-11-2016 - New features - separated stdout and stderr in SCE results and HTML report - HTML reports contain [ref] links for rules and groups - Maintenance - fixed ARF errors reported by the SCAPval tool - fixed CVE parsing (issue #550) - fixed namespace of ARF vocabulary according to NIST SP800-126 errata - fixed exporting OVAL Windows namespaces - fixed injecting xccdf:check-content-ref references in ARF results - fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248) - fixed oscap-docker man page (RHBZ #1387166) - fixed memory leaks and resource leaks - small fixes and refactoring, test suite fixes- openscap-1.2.11 / 14-10-2016 - New features - huge speed-up of generating HTML reports and guides - support remote datastream components (issue #526) - support tailoring of external datastreams - various attributes of remediation scripts are now shown in HTML report (issue #541) - new option generating OVAL results without system characteristics - remediation scripts in HTML report are now collapsed - support for extracting Ansible playbooks - enabled fetching remote resources in OVAL module - added Wind River Linux CPE - Maintenance - updated jQuery and bootstrap libraries in HTML reports - extended, improved and updated user manual - fixed issues with proxy in oscap-docker (RHBZ #1351952) - fixed a bug in OVAL arithmetic function - fixed a segmentation fault (issue #529) - fixed results of XCCDF rules with @role="unscored" (issue #525) - fixed invalid characters in OVAL results (issue #468) - fixed a segmentation fault in tailoring (RHBZ #1367896) - updated SUSE 11 CPE - fixed many memory issues - large refactoring of datastream module - new tests in upstream test suite - various small fixes and improvements - openscap-1.2.10 / 29-06-2016 - New features - support --benchmark-id when running `oscap xccdf generate guide` - added CPE support for OpenSUSE 42.1 - Maintenance - oscap-docker fixed to be source compatible with both Python 2 and 3 - fixed offline mode in rpmverifypackage probe - fixed scanning of non-RHEL containers in oscap-docker (issue #427) - fixed regression in loading a datastream session (RHBZ #1250072) - fixed missing SCE results in XCCDF reports (issue #394) - fixed a segmentation fault (issue #370) - fix error message when OVAL generator element is missing (issue #345) - fixed failing rpminfo probe - fixed compilation on RHEL5 (issue #393) - new tests in upstream test suite - test suite is able to run on Fedora 24 - fixed remediation scripts appearance in HTML guides (issue #460) - fixed autoconf build - small fixes, refactoring, small documentation improvements- openscap 1.2.9 release - New features - oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths - enabled offline scanning in many probes - support for SCE in data streams - many improvements of verbose mode - verbose messages can be written on stderr - runlevel probe supports SUSE systems - new upstream tests - Maintenance - a lot of refactoring - fixes in various tests - OCILs are correctly placed in datastreams (issue #364) - oscap-vm can work with fusermount when guestunmount is not available - fixed oscap-docker HTTP communication issues (issue #304) - fixed oscap-docker tracebacks (issue #303, #317) - fixed container mounting in oscap-docker (issue #329) - added Fedora 25 CPE - only non-empty profiles are built (rhbz#1256879, rhbz#1302230) - fixed compiler errors on RHEL5 and SLES11 - fixed sorting of groups in HTML report (issue #342) - fixed version/@time and version/@update in XCCDF Benchmark - fixed CPE definitions to work also in offline mode - fixed sysctl probe (issue #258) - fixed manual page for oscap-ssh (rhbz#1299969) - updated user manuals and manual pages - updated .gitignore - dropped fix-missing-include.dif, not needed anymore- enable the SCE (script checking engine) packaged in "openscap-engine-sce" subpackage. - enable the CCE (Common Configuration Enumeration)- openscap 1.2.8 release - Maintenance - textfilecontent54_probe does not produce false positives on non-UTF files (rhbz #1285757) - fixed oscap-docker - small improvements in verbose mode - oscap info module shows information about tailoring files - fixed build with CCE (issue #264) - fixed XCCDF score computation (issue #272) - fixed segmentation fault in variable probe (issue #277) - fixed broken support for OVAL directives - fixed bash completion - plugged memory leaks - fixed fresh static analysis (coverity) findings - fixed shellcheck warnings - new tests - refactoring in datastream module - many small bugfixes and typo fixes- openscap 1.2.7 release - New features - OVAL 5.11.1 fully supported - oscap-vm - tool for offline scanning of virtual machines - verbose mode - added SLED, SLES and OpenSUSE CPE names - show profile description in HTML report and guide - group rules by PCI DSS identifier in HTML report - preliminary support for Ansible Playbooks within xccdf:fix - added "How to contribute" and "Versioning" documents - Maintenance - using bziped RHSA documents in oscap-docker - fixed errors of sysctl probe - fixed skip-valid option (issue #203) - fixed segmentation faults in SCE content reporting (issue #231) - fixed tracebacks of scap-as-rpm - fixed invalid memory reads in rpmverifyfile probe (issue #212) - updated README and user manual - many small bugfixes and new tests - openscap-new-inventory.patch: upstreamed - fix-missing-include.dif: refreshed, 1 hunk upstream- openscap-new-inventory.patch: find out the CPE ids of SUSE Linux Enterprise and openSUSE versions.- openscap 1.2.6 release - New features - introduced OpenSCAP user manual - improved OVAL 5.11.1 support - added OVAL 5.11.1 XSD schemas and schematrons - support for core/platform schema versions - support for check_existence attribute in state entities - support for CIM datetime format - amended behavior of mask attribute - added support for remote .xml.bz2 files (use with --fetch-remote-resources) - rewrote oscap-docker to python, deeper integration with Atomic Host - introduced CPE name for Fedora 24 to the internal dictionary - HTML report & guide - results can be grouped by according to various aspects - printing supported (interactive elements are now hidden when printing) - table of content now shows only selected items (rule & groups) - references to RHSA are presented as links to website (rhbz#1243808) - Maintenance - scap-as-rpm can now build source rpm packages (srpms) (trac#469) - scap-as-rpm now supports python3 - refactored oval processing into oval_session structure - many smaller bugfixes and new tests - new openscap-docker subpackage- openscap-1.2.5 update - maintenance - smaller bugfixes - plugged memory leaks - fixed fresh static analysis (coverity) findings - fixed shellcheck warnings - fixes for Solaris platform- openscap-1.2.4 update - new features - OVAL 5.11 support 99.8% completed! - new symlink probe introduced - new process58 test capabilities - added possible_value support for external variables - added possible_restriction support for external variables - improved IP address comparisons - Added Scientific Linux CPEs - Added oscap-docker tool - Created man-page for oscap-ssh - HTML changes - improved visibility of selected XCCDF profile in guides and reports - render rule-result/message contents in reports - maintenance - Tests now pass on ppc64 little endian arch (rhbz#1215220) - partition probe now supports remount, bind and move mount options - Patched NIST OVAL-5.11 schemas to be backward compatible with OVAL-5.10 (rhbz#1220262) - fixed scap-as-rpm to work with vintage python (2.6) - better error reporting when a probe dies (i.e. due to OOM killer) - dropped selinux policy from upstream (rhbz#1209969) - fix segfault on invalid selectors (rhbz#1220944) - solaris support patches: file-system zones, systeminfo improvements - many smaller fixes and new tests- openscap-1.2.3 update - new features - oscap-ssh -- handy utility to run remote scan over ssh - glob_to_regexp OVAL function added - HTML changes - show rationale elements - show fixtext elements - show Benchmark's front-matter, description and notices - show warnings for Groups and Rules - improved handling of multiple fixes within a single Rule - scroll evaluation characteristic if they overflow - maintenance - OVAL 5.11 schema fixes - Coverity and memory leak fixes - skip transient files when traversing /proc (trac#457)- openscap-1.2.2 update - new features - OVAL 5.11 support turned on by default - included OVAL 5.11 schematron rules - DataStream can now contain OVAL 5.11 - `oscap ds sds-compose` now supports --skip-valid parameter - HTML report changes - Notably increased level of OVAL details - Table of contents is now generated for HTML guides - maitenance - rhbz#1182242, rhbz#1159289 - @var_check & @var_ref exporting - solaris build fixes - xccdf:fix/instance processing fixes - improved (none) epoch processing in rpm probe - environmentvariable58 now emits warning messages when appropriate - offline mode improvements - other bugfixes- openscap-1.2.1 update - API changes - 5.11 schemas updated (from RC1 to gold) - oscap_source_new_from_memory can take bzip2ed content - HTML report changes - severity bar is now reversed (left-to-right) - maintenance - rhbz#1165139 - fix probe cancelation - dozen of bugfixes- openscap-1.2.0 update - new features - native support of bzip2ed SCAP files (file extension needs to be '.xml.bz2') - improved performance on huge XML documents, especially DataStreams - minimized use of temp files to absolute minimum - added OVAL-5.11 release candidate schemas - API changes - overall 50 new symbols added to public API - introduced oscap_source abstraction for input files - further info: http://isimluk.livejournal.com/4859.html - all the parsers converted to use oscap_source abstraction - introduced ds_sds_session, high level API for playing with Source DataStreams - introduced cpe_session, abstraction to approach multiple CPE resources - introduced ds_rds_session, high level API for playing with Result DataStreams (ARF files) - deprecated dozens of API calls dependent on filepath - introduced API for waivers (xccdf:override) and modification of ARF - initial support for waivers in HTML Report - dozens of small improvements - maintenance - dozens of small fixes - dozens of memory leaks (whole test suite is now leak free) - updated gnulib - openscap-1.1.0-fix-bashisms.patch: upstreamed- openscap-1.1.1 update - Hint towards `oscap info` when profile is not found in oscap tool - HTML report changes: - Source OVAL results from ARF if available - Highlight notchecked rules, treat them as rules that need attention - HTML guide changes: - Variable Substitution improvements - Show benchmark title - Show info about selected profile - Avoid cdf12:notice, show only its contents - bugfixes: - improved handling of fqdn in XCCDF - memory leaks - static analysis fixes- fix bashism in oscap-scan.cron script - add patches: * openscap-1.1.0-fix-bashisms.patch/bin/sh/bin/sh/bin/sh/bin/shsheep96 1651970340 1.3.5-150400.9.81.3.5-150400.9.8autotailoroscaposcap-chrootoscap-run-sce-scriptoscap-scanoscap-sshoscap-vmscap-as-rpmoscap-scan.servicercoscap-scanoscapopenscap-utilsoscap-scan.cronsysconfig.oscap-scanautotailor.8.gzoscap-chroot.8.gzoscap-ssh.8.gzoscap-vm.8.gzoscap.8.gzscap-as-rpm.8.gz/usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/bash-completion/completions//usr/share/doc/packages//usr/share/doc/packages/openscap-utils//usr/share/fillup-templates//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:SLE-15-SP4:GA/standard/86979a8260d59d0f3d47b6665501f0ec-openscapcpioxz5x86_64-suse-linux Python script, UTF-8 Unicode text executableELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=52fd27311a775f32b852dd64f5940623b90be2ea, for GNU/Linux 3.2.0, strippedBourne-Again shell script, ASCII text executablePython script, ASCII text executableASCII textASCII text, with very long linesdirectoryPOSIX shell script, ASCII text executabletroff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix)HTML document, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix) RRRR R R RRR RRRRRRfҝvutf-8162f9a642ecf5dd5548a5a6f70082b9529504420fdae115b297457234df0d908?7zXZ !t/7P] crv9xn{( Og`s-!rg|C/}!`Nt g- CI`z#s\[#FpC!FͼʰUE̼t5:g+-k,//HMaDjqG3yOR9Qq(+`q[ ^aFi#K|1_c>oaD?KY]WNC"Nr(=Db)osp@}ͯx7Í {eNăUi9}M_I qhR/c5 Ok)ɘ1s1~iBZ4wWe (+zIJcI7r wh̆ OU)Z%c _͋4M SX͹bWJC5A9 -î=c7l~7p-8e/mީ1.)m Ɍ7BB 'Ʀv%Jpb{Ym!fOi'|/Z\>/͘)P`g+^ҧ\p`eqV"`!-I)f㝀y#2G,8>Y-vvr=YyƇ5FgF|4 'j:9¬m3WŰFH _! dUoK y.,rdT'y[ު 8 `l:iف/@ca4=T A,PyP"TL@¢ {VpM4mhhNR!MYmr&c6 R*,[h=GЖ ͝!fGCsoH߳h{aYBH惓D=XXvi荭љw:XR\(BM{dD[M#Yg]*Z,acy.啹kmx`-p# q6E 꽪ãXC2'ӼBK1KoTHiN-i6ejǸ* QDhSB9|Q=b:]5yp7zi}=_E v)|[_˭'yYnZgh|lN3T1O˹Dž%VDS{'w߯ yԊ*̓!sDiX&`eGoc7}S0&/G9qvvS$kþ#ͨZV]G |ƿ|y l衤]lf℞`=w]icf4&%B0ߣuēzT>~ᔫ2Ԅs8#tX6\ g$ W~$8뜀Z8DvgC|$ Q&U8 'FQJ.N~Q+V0T^f ZM]dn}6T,eyr9[ !W?6C4>o')aEZ1鎛{pl >9 _ a%ucT7`֋Eב9XEH3O1|& MēGo뱃E1ǰ#)״&]A`< n;K'z@r 'cs|!q0X:K J-A@ } iMut6/NvY+1~ X 4Kna0_yoyT)Q6!%@v'Hri сk(:a%]ʩH EoDR=@Z)h-a4{2=3qc(3B qv)uc[qճj*i',JGame—}UGsZ^ѡ,o(+@5Vk`R(ۻr^cj 1'lLbd"@6m'^4Yzo{\$/ŀ j(5'0̏6 1fclL1)zyDw=:Rp3"#L&}!B,/(6BWO=22b*:x*+iKha)=͗չՋ:7M7/?nO)A0D0g"dؤ87z\=<M4M5Ohe$0V:yoF\T8ɖj|"Y_zNݾsiaj=i0TΞD?qm =Vu*< OXu4QP|VBE XTT^7.MFF SNnJ)C 6T'J3jKg.E9[`ѝf<q/2WÕ|fF(yZT]/:{->uHc\PTߩ]v=v|CtKD97'"rcpԵd2]loޮ+ǺǦj;G_٤ >I!ۋ;}|f3̚^9$NN-FUSfPuCˑ T?z UƐAydwm'ʀ>/ɴv/.Xec4qF47(P$}۠4H赑jq`*M740H;@m^hf]$g LON9hd dmHQu-Ɣ3RjoٵR:JˁR%Vr!)ĚlME@C+r;abB4Hя'p-qrwSvvtPocf5~AB#É=|ؖ<4g2gƥ"#RU6N0zZU&*J뒟no%\&j"i}ysEEwf8T77&e2ANGQK'm`&Vgx},M3*ZM[HCa˾ (9\?qps?ɓom:]lk@NͰZʝ/,Z ,͆%6noD֠ bxc/N9`~[Zڶ;\!ϋP~mY3ߝ B [VTu%K[]6p0>xǨpjħFrݟPE4ѩץZ}{t'1|Ҧ[w:.')g6`ٱB^hP]s" U\gDhw Il5Fҫ-_Y`,H,ΤK>l ?H}BIG ABoP9jʘf>66DX~)%l_2~z"QByϾ>GLjvy]+CJ"E%jE `ɩ-}O3J4xq]~M;ejZ2>hltATқ`V"e.WkdtM;YX9_V_nݒ;#_`Cڮ9?/-H3kQOUWPh-Xm3G1N ŔFt&$d65xZH˕Rʴ8~#wNP vFsy7DJz IVGٮe#`PkźzjUEJEiȊvrQ Rd-M11Ug 埖t; dykŏט'Pt_ Q뗪UT*%+cC&d<bZuB~>g'ˤzqBHdeLbd%X-ŔnG7=_pKܱ ƶjfF7EL`.궦M$ȭUѩEI2YR7V)228x#lNCy .w=Ѡt>6QG0-O3kL Q+:`ShS*g2~,˖~(wobm l^9{%Y^t1*＂l]`՚F>b*_saT[F7dJ@͂FU0㏱MDɹ|ڝt&Y!µ3leݍ$3- kf2PDZ&+@1_gÁY[XMIv6{Wӝ+jG >Y_yGAjh#q W ?HͫNy/7) vW1IYβھvؔc/m4+}ZJH_%GC# /BF 8Њ=鮰 )c'FL/ ;k'EhӯȽFZ4H ](&E  ڻVIw~wq nxeXsP`D^ ^uM;8^hKC[Z8r%q)XVTwBA2)|n_QI"藿CÀ!8Nq0 j?W$!'yT`4i#s8f7;7gj̪EPz_OszuK8);Р@<G{6{1tlE/B,FsOw-Dm4S9mDTSD}蔃"5'J`kgE(f =Xmň&Z1 ̟ @o[7=KaT3N&Eo.e;~[i-2W2#GO V5,pf(R ħw,:Q"~5'kߞB ?:QȢ/bwCBfRY;[cn W UNB7J;fI@ l=~D¦VxmAD bXY3'jd:S]IZNTL))^vkQ/V2c "khn_Ѷzٯ_ Mʖ0nC9H& 7yE!1RZ5-*dݙZ1\)Snt͂[zc#khLri;23=Mgb44vprP7ۃ9(YyN=,MkH w`ܵ# JBcEeN+idvNr5$9>fpJ;Bєjk%ƖfKξ W{!JS t,?6mA:Rccoo8-o&AYMn¡Nj.@:ֳ ŘLLwޔR4LIfp )3JZf80Qps\Im?0Al' \ faCmyd7|G (`9O wlWkP5g.bi x8:TM? _ae JE'9|1Q$S)0#P,uO:h;l9yEl{s~ɇbJzfA|{/H&%3ast9UdK `a׮=gP8$@6VJ2q=~?^'ٻnڭTC9{e8T l}(U v{uȃR\de L[/spq5מR#WK R$ŜM>^BtQW>y]`k;37wykQSB;4#0,]1 Xiiay \p؈ )(Ho|re 6<=!roT+TAHFZs+l|d~ujǒQRME+.jp9yng.݌ˑQ0ȠDd>>c:kG0#]W9O &;Ciz4IM s!uvS@>`*t"v2۲dlы~ݳ]i_a1Ahj"m_ۘqo$#ǁ"͟]!x .)' zc%Ii=kaeWX.DN xiB~Z*E}O,1~J; p=HW1Gݩƶ0_h!.{q&i'9&!Z&Ϟ{ϕ jU*I~_4E"껜PF&iՕ}~S'\%(pls s2)L+ X{З.NfodDЂGR0 ޶o>%o&T'J4Ce~o"ާ(T,lO]߳i߯>;w9{ W{E{1d1͜ծ:C `r)KWǜm+ m\IY+T&._o1TG"' u:!l0bagyZ8ˠH#=o0!݊dfVL},O^EX\onױYw%8h.K(>8wg*%%?Ymp]!pjTLa6kR;4բ 7mV_||6йJŸZVHEnޭ-I~`hlýDZlΓhq4{ޏ%4ZL&&^IAv=sկDvBE+{ue5/3@6µzlGsHvrufGnGtqؕ%v$!>Qպh@6"+Ǯ%|lXhSwY3 ag&>ltMLxFD65FqVN9ّ s{=1ş0D}Uؓ Ү6ILܥT ``AGIē|NDUU=فPџcg-^,ӆNfg-|[)yn,t^Goo,]Jr4tNJ ğj Q2DSq%H>Kh1a|ѩwE/ayitf;u#S;DTH&ITƅOMHV/H2ZFpKzC-Mh~C2_BX[ !4H;kú`V]X$9U[Z&r4uub2- •D J]!Ԓ" :jyjv.Uh8IB(|BXM&ͺǂCGTb&Vg1m4(\*~C,d ^HVvAsG~mk a%UPQ]mq bltGK7)̓bUghEiɥ-QG T8XNV2_b/eKJK0T9iΛ ޽e^meezܺ1G;fK+drCRC'`EGXB,XPlQnU=l?U0s?ܭya0bk;l`2e|8r{]lĈڻPJ- %.v& % 4\քl LAAHAeGseAlz%-B`>0h2t& b )<:4,M;CiS,{3ܩpdi{ТTXoyvŒ?ݐSV+دz8{:(PTKX1٤o/ޥ":TqznaX/*h.05O>|`vb F V LwStfe*ru)ewT_+K;a]UXnNh^N-)V+JqѳhJ=) MO7֗8 BϮV4Iϲ_}.yE5nX:]or;a6~<,n(-%塽aC} w1p*Nf%W >g?&YnU19蠕f<}P >~D#U]Htj=E@bK GͰ_ ,`7 3NRfʩ/.%S`&MKMP開8pJ,0lL=0m:1z#zc_x(: +RBVԩ&h 42H"N>(poH %摋o}˭tnģ0b6<%[ ;ox͍oI&BfvXngp.6rJHdI溿ܒIqu(Nb$Z,tx,w-g]`y% )ĩ3::p [){/22`‡u@dZއ9[n= “pT*}(JPPlxPRMûuEǺyUz.syyx9%t'i?|K{9X|jY2$uD m;vje{0؆ גAǃ{P$z|fZָ@FIJFD :J1;hfo+k*ⷱD7+M?kOІ8{sv)b ncmaڈs:T? 8ĪiOP{br~Tc& ew@r^+h>l"tu,PidMxcDJqD P`!>l߃KTZp+]J }IC0LlRYmMZ%R10&6 :)l%f ̆r)Y9ԤɐBa] 0J*4{-6qvVZ Eti0i<yi#*#*ƹB<(pj!pAe骠<;<=/Eg=׭~nЩgLOq)gv Š]-΀`{هIr>ұ : [#[)s'Gonz O:(B6zIFj}6)1уhtu52aF ‘%a|Π7-9DFlD;]M]ޱ1׮)$J;bb X/g$72,2;SyN]H)0%KN!X'J~C6UD_O!`!HYzMŧf&#h^(Rtpe184&:\їko燝xXBY,kr+ƈ>o V2w#Q$ka`OTDN4lZ$M;'Xrf69ucX;l$ATG$Z"(f.>goʡ"+ V;v| -8^a)vӇ'h&: =V(NߴYkT"k)j [v~F5补@(\Pדu~ϵXIK7 յ Egu!zVm 5" LV3ds]_bEn\$tʊG>H)%GOLЪT-m0m?L.*TͮQ@}Uw1gR|ȵ]y„.z_qLR`ӳLIגuފÇ8PkdFvVk 9APF jo x|3h @(]6j}pݑ@S=!6 ֑ D#ƖTB/.M 3˔>PIED%w,XرooR{zFHIZp2Ze,d5J3šb9O GC UOiEMjjM\"H|FV!wdDy%5TX\l5S4 uMdXfP2|D`x!{+iw&P>LHgTQÄG :KBzd{ ,\(+<,n]iúߔv+H>0A1ASE"$_@U w(־ЛǜzXHÕm6=e({L⣌R s^ Yk_&}s_Ax5(ㅍQʬFaT2|)=`&J\G4<7(o N{O9] -r*M,w019Ȓx[z吃\jRh1[B@븿&Ahx=iytp$3&c̭ƎVhUvP]X]d2-Sv&mPbt~ |74^=7$=& 5?[jI:F]`G}8}|Bq3;߀ڶ o#`nJ/"աA<JܚD wBh t;X+JpI`z7A4w'aYbLal+ -H3m9E-@|dydI E:Xm |%+LRj^H [^ v?~,_e-w@>];G*])(J Hح:/V?+^1@Vy~IP?([f( kV2Zǒ4x@IO+rbmmc/ gs@RKil;dlL^օA/,}˲ ~S+`ь/!ܐIjX)SM|'nס߳ ׸mѕ׾oSh'UW"r)$ȲYߌL NkYrPh+:$ i\ͨ] *|YW ɚLH6W 3YK"&}l3/@kB/,WL|į%xB~S!d$5ͨ%Jyܔxt̬@T{i@&A" aI-U8 YE@Vz_O)[}݂hf,}n;aSzdhN$S,DpJil ۑ= ӣw?CG>;ˬ}QJ˅OE$[hp13"gړlO{"rBG#WSxj WG xji!lKO צTTYXMQ{ăw.K/SIr}qDJc %!j ܓ:tلvmˡ>"8#h܎cV#)$HG8jF!qpDݛ74JB|O{xkKC(NѾnftf}8kxq`pP8"Y 8 dkGPfouA^|N\]q߁ $[LSѐH0yCV M=era_uL/*_v`H1A 6}.sD~%*S^Z\ĉű0,3U&ÖX`展DC>B$a) cb6xǎaι:SWd%KFcAx`鉝S O%P{I*A逢bhoG[ih ([nU1 Vp'+O4ڧ[@a^Vw2GN\0t7ݳ`zęV2óРV28iU2NZZ^:YMZ?Ȥ֞<;Xi{wuWT$4Y=*O%-KߥLjL؇Y:N׌+1'J* Y[|x# W4 9_n3T=PQ6֚`fCъWL/Iěk΍cJ?2P)WF<)ƇeyʞurYH"6?WtH8`s7`/*TOi@X2}s#*$JV7q.kz2 [v Z]bsŊrF8o:2mЃ2ϳf|howp{ڟ1ݥ-  wE=d6^jd#iTЋƬ- RB>o)x}1ľ?jpAڑء9FAa׶>0lD} xw! 9|. 2z;xt@L_&!]7Rb>C5w'H%RUKEG|څn3 X-MhT,f TP{I!~ B؞MNM˧ z4Z( bv[񹭬ME+ڏCZ]%)4gLXՏ0p40L;zHb3qS]`Q˷gګy1JNa-e֟3a0 |5-kaꀦK~X3M3U]"BS/޴-QUbY^R?WѬ\aL>pR-5ǽ" m@\p!xnڭB>O*M֛ɕfe>1Yf,c T6r.Ȑ= G3`dnQa94 Bb'64 uT{{x= 9.d rauU^eGomr5n=9MgBR{#\=&Qvk ։@oJb:{.j+85dߙWT'u?+K%70RƜ AH(=*WVUzV57#b@LDC@+*T M{v l}~ⱄScpɤBݎ.Kok@] M~6%@hs8D1g_|TMc=8LeRtbӯEJhCb`?l!aSQp)߂,x;>d"Sy/4(H-l\l3Új g<;&Yhz/h81㫃;%ǐ¶)2&'ERq , Rw`,2~c Y""S-qJ=4}HIZEr\Lnq?0Lp0eOT SXlºF? \˷3܊ѐ2b煓?@;FiZ9QuY-;([̕Pۤ,2d8w7%e^/VVz! q4yK msi1i ;{h$PٔٳgF`j LylșXR+ ->+Q (=FV"6$/ao| xNk9ֵNB-z hSTهI n] JkRnd yK.NsY$4;F#vbDZO//"ze|x/uKcq. #E܍BGQa"x3uUFV `Ie;oNzԏT.YJ.g,Z舒Yk=Կw%wl劭#)$t't oM9ƸvMPWˢeUt 7IE˳wܔp ^Պ>sjXάv i 9UyeU2_so 'r&-F"jXw݀fp?M CѷVóJQt_IuW5I] 9*ity^blFɃza²} /,t}Wl)jo=#uM;J#}BO^N|u5y6epL[/ i uiQ1ẉECvA LICWy( I7Z N`qjʨ͏a5'CK[>b=Uق"AqWl"de?9EAl؜ 8u$9tXAXQzv H 8G vZ8ZrlU.Q)9n*=cPpM#3(Z/& NTѿHU@,o|y`{< : I$]fٜK#,YVBT-*E_p9v'@Bre#ϛ8ܣYle]<-CpKZg$DBٿF_fDD O2\ظ0c^f@B6d_*J8R H"al:li/|@{ꔋ?޳yr\s2@ y䥕A+pɫJJ|RTmkKР ̄I@VQFX_-٘MĕT/26 ބUUEB7%J>jtuAJJ;Qn 51 2A }3W*tkm+lL~jy-iYRAa{  .(a.Iy<^`ϥ/*Տ W<慐'`!Un c4M%lQ jv _-M>R9=hԀ݊xVw.Cn0ܽ>ģ0[S=b]"`SD +,T\ 1S{Ou>4 %M΃IkWB^<Z­XhM@PSdٴDUhR3mŃ|K| cۄA+e]F8~balvZ9GuN'0'&glp$fz v;?*!< K6 >}=4~"G2/B` @{rдg< :2ZMq*/tXI/r1m6g fͮYQg[#k̇m^B60h2|"3.]Z6+l1IMj[4r>*G /h)rSAeBQ9 J~jyw+]NsQ;)Nbv;.^6'x-jϋ@v̶E=ͣ|M ֤Wp|nNv*4Dր8;uە@0 Ʒ_*ty*w_wDTyhƐ%ћt%bK-¨T˟L`T!NNL!-$j▫}BE#k,uKZ[(EyZU0wNaBS`N+ KdՌ-S'tkߗCYzKȤo3tWXgɈ][SҨTSmp0/*G]<sJ&'4n} vWxvrcNpfLxh] )xC*tf^giwoE|0[Bi\O1ϖ'Bf V a*ppJNKBi5Z4YlGfv6o)@^5Gk%2/:0Va9P el,75c2DqG _i(Jd34ސ8gF6M2A"ӆ"tڂ<582**cZ¬%ʞf[%vVqy7pA¤xnSpU$"ҫ6|q:d~]Oخ% `V GIGMw9D'2 gI{\4\ /%@O/U,$hCiףQX1~Pnb$^id?sJrLW![m!7 KbD!@T Np l~V0bfloZrV`m7J?tRS ~]<.딋&.&Ub!Nj1l1!y&Ib䭂"y` ؍;xXЋ8, !1 őH|/{U 8hb$ 4 )-7:02XtײwcL6 ~5J0.O' SR/ui)=|`)%kK[+&8EVqo߰{9ldm@e&&KuHR9n*=m~.qyH O5L3p-NԬd4WJ k9fzޡp-`^ayIÝaidDH[+2aj\}Hr"pԥyYn6?i7?Sj%GWuwsvx%ӑ]2#{Xmfi#*[CWOA,he_Z iJ3XiI)H ޑNKf8@UQ9{}uMki1Wk#C|/ ^\/QlU6_9Sg$Zm@A2&YwB#rPO1Z_MNV; $C`^׮k{*FJ^nxNF 0BsG"羮Eέ.Qc񪾈#F;SY5ʖS )Ɍ[sv J|,jX1(C2 5 17-$!O^POFJn3 G]0ݛ(i_D`GI!`][fSdp}cx0YY%L5l),}l 8(yʣ G$|U*(DD1hJ:/@qJmN~xV뒏D県6]YN:δ@V2%Gx\M53)M{A޷n=i;"rĤ;Wh ΅3zJ PTr]-Mi\̸aeH,۾y5hݏSbڔUhV0E Fi'YC%:\Q֙m8@Sm?<[5G E8N|fğ̙s+MrmmbjA)V%o%~IL%ψ4>'"d-ÂX!vMT5*fT!Pe%߯,yP_F:H5mivk?1/PA:13b:=s-)Yk*;ď4.W3{p̫z]w+>k st =+3$1YyzYϡ {cx.csL}ܿ,pvp`h؅$<-&7:I0XB-+q|W~??Rݴ.,;zͻS ⑄>lu6MUCEU#' F63ΦIlt$ ^h7~uXԓ|jg33iox3 ٘l%$6AլRa$9( !yPqL:QEiKH}Zxqzds[.bڈL:m!s9md0$)a8P&ߝb Y7:1M;ZgfgB2fRHEš1/Q~-[E1҆,mQhw\%:췐t(*O~=;~#Ru]61[TXU^ؿΈ'nqۛT*k*0i_t K, H& xeےg5,6ƩdCtS:Q2P ʓ[sʠtM@ȒD٬od"WO#BlAJfzhݾcl@iz;ΰYZwڐ3 o:@ N@\.pnABU P _\C|O`;kW~v.rhٛ1)j0J+5 7=i`^,ݚ.ٲ;sA;͝kll̎с+ւWa/p<4'i 6.@R>pUIt9SpV$/GF!4DdT?UL=魯 ,yqy\.x4;B#+㿋,[ Wn{Ah%?D hhԂ#S?-HF7RRW ~fے 5IKprHn1&N,vN-JO ! 71EzfGh`,1-x%.?E[:O=,g.(H vټ"~h?n{!rYvhc0+J8iʡ#H/MsiX%-B&(1XƼq4Z=4/&s-vEσmn ҆>1PTu { L7zr)|k!DuVrCF[̘_Xl=*t QF3H^,bz&'f/ RJ>eumFOqsmz>ئth81/;XԡVru!J9Bgʼu)Z`O"e5 "+9Q hqBvQ: fƑxPPC4݇(5jRĪ2k]Cݵa.E76WHч+4^2Am^[|HKZsNe TnPeP46PS~5(ZmI`HXjpSP3mP?TP '4DDMW{ڱ*#Y$&F#q4OC:.{UHMX4CV4VMD01vԮtB=.rѪWԯ~hT+_q5zP Q %]OK>`hy-\kwR b`%y$M>L@>t>֤u8ԆlCR b{oϑλlp/_Tq&я'oD{`8Z'LƘ{Z:ݾR<<&3[ 0>.BQ56Kqe-B x~IKk SFyʕ-`ei?U!8Őo'砋5WV 5v9`fp3P ߃ƣjB9 %A. 5  %Q ςs5 "6 RD o lk0dt  dpP+yԄq~>-t:J9J(M묚W0Wtp4inXYk<Xa?h^odr,D,zP&UNQq![(!, -@:cN`G&d3fH&?k^Fʪ{qHͺw-;-sM8ێ}cĕf3<3 VoC DT98ĸf.̨6Eqr)tG~LD JxBp:Dږ5nd[ߧ{+ $ X51<ÉײdG i@Z\ޜ+:\F,Bf%. eT\]0/b*צ9Ca@20g\Rp72Eh)r[x5ʿKLbL^ēѓm[ed=h]% ]ҋAɗ`fA]ֿ&6NSЄC'.x#X!s/XC7o~Dm~ }y# ޚ*iv31:a2$4y%I(8a{jJ]z{l)!f?`P*{I_ɃFH+ṙ;}]tZD8$ʌ@5;%MϷ<5_=|BZE3Pim1*IBhL""2QΥ0/ xI*VXǪ}k{4<\]+XIqaOFO^H#Sg ӑ Ĝҹp_#XA|?۽hI:pٜdطD/n9oԠ:IroMBy_<~&_pXϸߒآ]jmQAcZ[A EzU|u4&dJ*sffOYXM"߰LUJ"J#<%d{{q+At ~X~tYNQR뻾%i-Iˍ c9dUD5'zH'=8)( }JR/ N$2LƲ͚rl4 DGx PҕԇU5' le3iCXKzb>,O&5z\VT8z>$f2 \ۙXL*Ȱ=cЩ&:?7G[oRXZ+UN<,7{..xhH(gP\hL\VoeN|w,) [Չj\Iz.' 37:JZNtB~>J">ي:  ಈ'F;&錆x0›?[nO DYږ VV?p\c3p9_d QA`R?Oâwʧq6hH&>%f],袨| ##j ޤK؆KΚz'>R? P=ŒhWSW @M D VaIc1HJ[37\F9DKbΞv/,ʇc۵_E,*|D5*b47EUl.D׿yC5H`KOEF3G 0sDqpB5 ,R$[vjھdk[̼D紫 X,[)/16ACKcٹ-PhR}rⷛ4w,tʪovLu UÕ8ؼ{))Xchw;1?Aۣ#@BZXQrĪUݑ"%:5AyA`I'%`hRs+ J>IV@ Nt6B=V/s .q{|h DTBR-ӣ7EЎv\R@gJ7BM@вj`ww8N玶`Jҷ3EYZ8#;̽uSxm@@ <ˊySzgANk RǤ,? ~ VQLS0aY S(?301WiydYJ/ꈜQ 0aK;*emwol)IsWhE6[ e:,HJ zx9.HM5U7kK{quxtECy)JBv<Ý#Q!BypwڲgѰE8&_;r>sH n鿒C[JT_GN?u̘<+/:8_XgY),՛\5`ZgG;f8w`btb=sQvܨcSXjZ=c`xܝ-Em6'H9A0O?o}s՗Yʡ3жA% ~a7 @&G3+E͝j scG9M&[@_,X5-gQ 8v6Xq.e[)]=9^.Q.޸ Fdo<%TlkMl13["= #oʙк$p\hWm}fIKz@nƤ^im8" A^.8ыFќ8h"!i%˦&\jǻKcVM:#]rG4jwjkRHOGKuդj!Hڻ"%DQ}l3W/LkR9)"+h ;kpFo"-Rj;= ~dK7Y;dyVs;Cɝy _lg,8>+*Br:*j ) sM?2+o jWIhQ{=c%'fWB;-\TG=4b9,B\#i Rji[J#09lIq1|M9iƄ;iA [G\Znᨶ~~'֋b)woXȁ0i5V_-av471x4Alc8۠?;!j^Ӆ%9wQȠAwc3U~.;Iy_IHFʏ`B]H\WUa?0=XZZ~"lud`Eh܉uX!C%Z=˘aMD I˧ e%;&|pCvьdW]7ksX$3g y e{Uy]ps<2tNS \Jh[7۞2z'EGQfU ,ꍳ. Nxx<'nѠrȊ$N%/*mj>N/F[:t_BҭBUG&P-HҼ-,+Q.Z̠sgt1ۤŌ@Lj^"IC ;>h MU>G jjx-QP"/υ寇RdG8k&t|&«=qd h7ʁ `膙Sbsj0Ll+_Ѣ BRTK&BR,FBWQSgw2R{p#sfdĕ8tS*QEcmWiKDa=6VX`\J[kR58ܵmb$кGnuLO] U{A-A'Shp ;+SI-~AŦ4Ӗ \adC80L:?Dž܋G bRL2>uN.py#dDh!X *=>Z[ű\YA >:B:;]Ħ uAce.ɬ:Cx y l*DNv*S,zTTP@2_4!㿮=Uuܻh@va ¸ؕʄ&\<ٝT~&ȇ۷fS}j;O xNXj2X^)+o^X:UʄZJ(-76 t،)Rp;Apu^QZ*9U`Ɗ3}Vz![o`.Z~l,}ZU1F~ټA,B lu\;Dn1Fjƴ7{@Mi|G‰~WRDMday8bO$ji 5bOPV{O%[M1KisOZג p_ӆ`knN£nQyy%mf(j٢ YC).~Keo! nYLWQf,T ;61jݣ𫯧 wAp7g d>Ւ7 |NW+ay^ P̱ oֆiaԲr/wGj  873SO|5C TkUKHs踻nߞO9ݿTxCt2-߉o;pG#4S\3J̧ʘאַgBOL7^6R71Jϻ=j{f%O0i0Dw;o9OHԹU^*IQWpqNFxN1?-=>M H`Q#L@AԾqZE)τH Y&IUl}\rI 9)s 塬 /gfmHf9پhMB wH^n71 flW K}}T2dظ.dij!<\Lׁ ia`n> Ey"i*1 r+XPcr)v9K|W#+ѝխ%P&kL UMr䒳u-/k#߰%8prBeYsz:pH3T ,@Dtַh{$@Bzc_BCӸu;(\yXO*cM2{w5s Rrt"T(+]V֨K;KS+*HO\?F2R$ xHπlٮB)g팧+k2ۍ2hk⪹LGPӷNG|lgp.'YU2QTl7p]W03ݕU\|.bIKaʲ#jEASkV~xԂ=EL"ș6e9$:#%U,8i5o+8l 3t2{A-6|R4dkalQiߑR}1=Vҗ®݇܎ZROJ;\f 4)J\dts@@v~@Iq ơ{~2=D vF)s9#)i4')a9ЖH>0FTzcnͭ=m}줄iϰ}u و@.&Q"'i5u~NN[7"ina}F->!v"< S)zgɣ n [{7`AEˊ4I43a5!mZi^%m+E0}&p} ! N\f/@͋zd8wykSl%Gu?<720P9~H[l6Dik+1۠gqR,}bW+G̃IwH)ʜ/ njW1[fd2/1{BY^m/]fyd׾F0et-pp\>2K*ƤlƓ0x.ίc,V8>l}3=*wH cbyEU[= r0]PW4twӶ$V"?WЅs#5De:'1#V;hi%L}IXUG޹!k.Do:B.! k'55 5,Ǎ54x[pas%\3 E(,zQu\w[,9~$-'" 9bd*mlwUlTw_T~s[Z9lûp^"u٣O ߈~xM'F4w;b> ?)#|anI3QRSn ϱK\#04?ݷPqFۖo (Mn?T ;&[|Z/vKB:;ń8] n9",P_rvĽU،kiuܒ-"ɾsRQ=;)4L,5䬇Xgd`!r9#23wgjil 楢4kFK 'Ndt?9Ib32+YИNEԩoZ#BjRÙ/Nr;dei]qDYV]KY(D{ٺ#4B&}Ia6+H![*T_NC`;fK疂_Kj4[[h$qy0<㱒hQuU>˚^ncƣpq,N =6 &z3ܱ I(";Z)Ci3P1ww-H=#tU@`jFϝܿ1 gQ6XBFŕjnp vݠ4c@'uhnzs%o+}A/_{Uh҇GcL Y$+T, ^Zi!ĉO+3L`IiN H[*VT8==P7SجBUbt;a#cx y@b Y8 =Mw)/@SX Y,Oյ:״~/3H'Ge+@kVݴ;PzHh RTBџ7'=K_ҽl4bW\%]g,4u@p}n 1/E J1>7ݏǞȰ15%.{\˰- TVMmاKMVwKx6c/xt=~jacub /RU99,Qx3dS՝k?fZ͂)(dAxk(mR9ml~P'4[Oئpy?Z3w%+4)?uSbV.ye˓+EBNGVWVLX#+3:!SBZcKlH:.iX Pq~>{i_O4$I,.MA\pg/S<+(g11~_!<"Hq+㜵)$r.%B5&vU5.޸-y$/Yy<}`hI㵘nNy,M%uZt~0|wyFFn}.!m٠A>&QB,L!)OAQs=:m~?GѾV0Rnuā.j|_b=nV?ƧR.ހ5s|Ͽ73rgٔshUT“ô*?,Jy&,a ee\kV<YcƆbdj3o*GPdp@rjLZD$}%:(eb<&D1aGP %o .]frK<pý ĶUs)Ys9C,6ʘEhWG؃sp6 :h}L7 J+C5Ϥ.? yR돛7`e~#`_SV# $TvWWR@w3\1w$ \9໥gl-m!'c 1m AhJjq@a_~T:dV!y?6*Ja&MEb思ԛSaN4SY1'mϖo:5]EO!cR < mNAm79] 8\m~\֊C7mF快]!ZU,45mcïJ+T`cMc±=;!.j(EHcB?2Vl\"UPk HB 'ZVBAOJkertBntgȺ4[F k8eg(jg QLqҕZTʟ?F4=S>( /}Dr3e#-S~<,j?)؊q9j+;XP?GW!42xOzWȏM4.>@C.LDe˙5흶VQ#PǼ[D߸DޤEJqm-"^{c|u D]AM~ryϔ=TYnBVnYed>Ր0=UMNBsTڮBxW(" Xye\ݢU?O"%y2|U0{jQBb:,^,MtYDߵ(EXXp6_f1 %|OMۧ;մbBQNmk(m{CjU{29!=jwY='2;"'Yaag$#i >n%oJ|Yo4]y+A$s@ |Y7Vu2QcXpG,4Q*-$owڐU1 mv 3V=} _}BIR1\̷gh̷xMJ>js7jl+]$@y9ǞTXK`{yxSJVoQ".JEqlpe9:S >g^r O!Ho:7qGcOr~t2 @f>`削l+q趕gF4&VA5b nȚ,)$I3| =DWQ8jLƃ\~|& Mb ӵу{Lƿ"j(eFҸqB݉\^Q3dzw:#q?HZ",xL8ܙ ԁ)YqB0/Kyڿy!)xTtiniN,Z~+8^rzֻdPEt<[-w},)9v]u'0tOrJA.GY ]aWu}cHsX1hry%Av\kƘ% Խe NDZvZiC: n2yc똵.4n}L$-a*u7iZ:@:/mzGF&!IT9VqD[fhC8mgX.3>!~;F$V~&[wzuuTA 1VZ~{W&!ME.OnmE2q;Hf ru} /nSzF_J cE(sxO#;zXpvL9$r2B(֕ȟ{X(t1Haf!FpՍGi8 {*JNqT2*yxQ1_SA-tT',w8WY8\WYbfeƼV&bCl9PZEb$VEK'V_sռ♷[#b;E׽&uuuЎQ+xyCVɜ\N,cf۪>s{lbvݡϰ6dljO8CLg5& 1yͻ#ƤDdu/UP6+MRԬB%ZZTuc9)sQOR'L g70%*Z/K/V^`,ۿHjCu;qko ֤ ނHkKxSrdU0-0~uħ$1I0GJ4I#ԢEuۏ_=ʩD=pW,q@^dFgǓ7NnuխmB?섟a;r0y@vɢgY\9 #BaaHau[7ʎyț&SooeL$~cGgd%cp6.NČ :lS*5 O(Q~'M߀Me#:jZfG<RsR>Ae8'hE9W[e|ZKŎbLL2<(uǒU.k2RjMVxy10f@G Mz4m(*9apEvSf8osJCc a|VtbN>p- -X8V%WV b'`rr#[rxz%8@V{e-?Wk̃F_(B;-L6ь6|^yfI8s"0soۺ9 \Tn_(0ilPߪ:qkZg}}kှUȧw bj'BM-'2dPo9 )~LSzm, B:uh!aH H:~n9(`QtJ3-j4EF2?ӊ9\Ԩ4k( JvQ[US@8KI:! jBOOȦfo`zAmT\zCoXaN֦{llQ%=l7ߍ 7:q zGQ;վ.h0)*s`@ٕI!ls 9aϙc* S,e˔ake/NeǦﵹd8qwHcw~K'DiNcUXgmRSɵ-T['? PDjՇco^j%fxd,jG[fs&rëeu]ch co(y2dk;L%gU  u #Ӑhg@*J ɇq 8dKZ\wZ}2N]/EAϳ%߼z&7%By9'rjDݴ GXk;ԒXk7W&(c R3('~`aVab3x6׊H7p:-'KRrÊkAΥc@(au^K:Teծ2%m;՝dauz<`rB_+5)x D\n~kՁXbT?33BR5Rq ڽ ]!oA:My8SG4\R@#wNi_ s=a;`."hAʡ.Gf-)mzN۸5KVrᆂmbىԬ0J_dB b@WbDQ:fYrftfZT'q$uBp')\9w=W+A/y; 6TmO0@!aZD>(:ijzTx=Lz< j@-l3pQ4DSo q84`v]; RSQ[BD-'EIJ5x_ V |Bn%5@AW1sOH5wӿDEE ~(:-#SNC-;nŁu:a>ǨT^5n-pM٭ٕCCKԲdE'MgH޲>2ܝn*t˪p1W xi.$h\kSL:!w5P&p.P;oMR~&T: 7 .>e/b+L?tm; w.ykG10Wg*ظ =9#+o-ܩLXU6 x)%j5Hiء=3 tIbԌoJ&+ѹ{А,rk{ nEa6BnPd4LzKǖoT= ݰ7 P#, <.rV85@Ԓ砾V6͓*=u$1%:Yr!5 xk/{W֊%vNSk29o ?m [{%˖ DflZ;|Kn PAcMΆV C[rC=Ii G_?,/dҞh4Uդpv4\c"=R CZ=jou$_ѲIuH޻IxZguQ o}r#imFX,ޚ89ۿ=շO8Je`.x l \䶤ӣ e*R[yG6p͐L*ni&K{4ȷLCS\ S-ۖVa1-/ Z9;Ɛn7Z?wEC@)o\rЂ`Vd_+I)=mP΁UeǺAy-D\!IiB{~GTP٥6iT'qzR坈Yuafpx/8kiJJضC;;sޮЂ2_d7_;#[x/wgԣqM;1K06l(* G4j@smc*.(Agp{a-<墭zBbUM:qF9;~+6`nxo\* f67)oٝ9i;ў0/JbC_M l@gm<(C"Ë L,JO~jg&Lm<̦rxԳ]utxzN9zuc+-lhC6'mX^@}JTrm ,8%'˻`Z\44Wm.'tϯI/Ҍ)v,p>r8V =4NLjdgjv795w%h2,m3WT 7xNkV̯u7/Xr[h /B;RL u?cc:T sT “'ưNY{/.>"}o0~}\QP['\pS/Xa5- u<Hg9BeT;m KS9rLVފQ('FNAsa(:z9BYoSjdX^.?/b{ÿT!6?/+`X!ܜVtc*epK&.$d,Z;ݿhb>WCp-A$;{oJ]QJ#40 ^^SFAs@ ɘnL.7 47pzоVZ 4oZfö,3йNkڱ+JTToBV!Q_gxυ)X2x/69JꘃյDn6$"K$!$(*7g@CP'e]~QX~S}@6#BkPQ55z\2-8CA.$y`g!{9iv ?TpP>pL7U^N YnOo-5E70(S?aע(D쮺 )"]v&N%CWDފd > ϺPtO;be [$3SV%Ih߻He r3Oyև9Rr;ps ^GaXG̬c56023Ҝ7Vl:ojx0&f&vV%i8? ƴp(楯sa}#EDCe/3ÜzFUv'Hjk$[(3́FoebƵv,rj?l%L\*?kIPiK<7lz2$ph*\jL ycbデ&Ж R`!Jknr;Zh^[}'dΊ_`x=\8͗I)kzcE--mH B D96MHf朘,fIa)Rźs2zr;#*;*B-YϩTP[VUrUT $$},p{ ~ oϙE5|۔&+>, 8ꍣ.S9R4JRX]]!˘gO[9w;QD TDZccB[Miá3_޾ O"S N?v:3`]!1VɎC䤥f'=k $#W<7ΐK'4@V3,zr^( lqXF-mKs-+NG8u_%"d}ܾnn"+F5ۙS)J$bW2 ku72ɥFFpHmJυU>bu{ZZ6ʼSUөe>'r!1 9;֡rqN *OqG?<_,>1@2D.4Mݿ`4jc Iš:D!g6(bś0C#ѓڲ@0-+0֗ xOczGDڞƚ5DѨ!`5Qu0} u0Wjkc걮Q!1|cfw͚uZ^93U[^1E_ rsRp*٫k&S 6ȖaYTSv0`a ^ DPBs_G 28|`*_/Cg}"/ztKKʱ bEh'XZVX%&)FNM1#H>GjmZ8kG D79JŦq?Sh>ꤱb8Zd.>ϖu h5ӗh\G})(n+6a(HpX.x 0WE.6*Xs# *j)"({/4)ٶ+#%?-,?rgS\diec`m-)SÕH#]$)i/X4-"nd}R@4LFH-hӴty,L0fv5؁)]Dh~O vՒ~.sjs߽L(ũYI?@s_"yrGS?U ePrcL {`s$=%:^fm- Ɇy`@x#y`BH ӊvBxOo  R5xWxHD.`&Ci@yҀW~`lK˴w3LKGz57 Ϧ*a1kmqWB|,2+>F $fÄiJab-utǩÍ dѼYgΫipeCޒ],+pP.T  r-mVJ(& }Ƞ¿E"T~e.Fi01w }G,E'+N0Ïy92w}P((UOj6onD{u>Db3֙Ïo$=.<8La]d]eQ(@ђ0Wä22aצ'Hen v[F,)fR39FRw^i*cg_Ã|'s$k+NS=#ye8@bJ֌-[!AE^~B^WUM^i!̈'̢{fC {=*׏o;6P,'v?KF#̃6Wb:# "GܳzufM.w4SzF248 1D,k=ķ  $c:ο2T#MaHl%4{,\ ?zܥ25ɜz[Hw5~gtN6g.b[oPtaj}ZJ{2gAu Q9ϏO=8T|' & 'Әk? .|w=lkP^5E4ߢH;Υd4:7YxؗeQfɭ4zi y.'p 52~r &3BVŽuLs 3~1BKqZ7fM<m߄vIl?{&HvA*i dm ~M`Y9GvJ|Ed}y3Xfu71 J0cW&6~4oO |TԾ9"Vge0) ԥ&YQ![aOQ&ak 9,0^P.8}=t9)I̡ȡISl҈ z#$VkZmK;(MFjφ-Z1%s !Sm@ZU^qC*4idϞBzJR@L񆹍pB6?Yeh3pK|GPxu>t&(U{[I_A+aj*t0<)[ `n>E,5 `@v ૭?cmQ.}!45 fbZ/*?&v`,yѹJ$r6eFRE\y v"{k7jn *qF@= }Cڌ~Jln@e0՘}"kp8k~6iֈ~9b>C3MC"ѻ7Uw`v3C&(ǐ/El/4~+tv474>9?!KI\,-we5 >I y?p? = ~CRN̥Q!ä&e:ӭJ0 vx@RbA $s땐 X.:Jpk0 Dѡ>Nڅ1jK~w)o{]wZ ]zɐj֭a)^\[~ `KXqmsom8Aemag[תwoДGB sChFѭ?s*̇HtJ9Y4T/"'vœ\cb]5=iڔ Xq$R n&~;'Q&(٣>.Ԫl ij t(ԛҶ˭ό3ٮQȘ6q—ZKHL]\.4PW Qg%snI4rpV7~r y}Cb?&N71'-Qfdq@pB0P4CB|H}Z,Uש  *bQh7N㸮@=ܯG[GTvOPa>GՁ8&yB0[HKN\J8;?&v0ݮvݙ-/6$?p`*NJX߫  J+8 HLd):BXyGFC#OYP}<_~K@4D ̔IE5>⳽u@מ:E/uq*1Hp5<59`Y m1G?`8:p]MQү —H!+jƜ6|rHKv7^;=X\$zk¢xo3o.B\Mё OZyK~eKev{rF36qdx/Cr 4,Hົl)/I^6DA~I"(Ϧ4`j/09;Ufj/`T8ny=-TX*RSE,׀}(0_n%؉Itx{ū ;(rQ9}~qd ~PIz'gH>h_y;fQT7]i?"-Go[pb%7% ~M&=ǣ^gɼ=g%'a15S_֎R{i#7BODϣ0.*jxT{Hٌ/N:qCYi72JQ9m`B։grlMQ'nMq#3Z+9G8\3J7 Lv+j2ZCOd|hxr݃5B)oUh|'XՖiXG!=dnuR5 T\W}SwPO% 1𡬥{+BRW tF8cxƂ?U=], f80Q}p[ܕM!1A"O*'imIMDToe Q1&8tbMNXmr0Պ.4}A4[jՖ5d :eȗ)kY| Ahdݝ:b.V:'Z[dKGλ%T m㕒s$L;m㘙O_5oPP;;*dݍ~k p ϾOjB!؁З txQ_l|L9~j%YSͲP#uh$n< oh&ˌ9%ftɭO^v)IN$t^obq8aq"ke@Fw?6y@,>ЙxX]? ɶj",ɸwaRx |Q'ߎk$+|,@ݱ_V.J~";%ޜ#k-0Ы3{U- &eAs [yPQS [#{Yi&/'Mwk|;zf7G?iv0@#r+me~\2{dEU=' a=a~'_OPpbMLu3Jn©D~-%6Vy;~;C*55î?KzY |Z53°[\" EYW1wDmh' K7a/Q @`v1DUQ݋$#lӶ.1αgGK_y*6Ş0h~RGGlzU c;:eƞ)E2UT#"Tb*:[B|f"?4)22Bd$TJ)8!̇O-H2_a-bEnي$ADϞ˷&[ܔ0=u=úgxD5MjVXZDXm B5jCך4⓿g\W܄#?C*}RIX`-\g!j%7e_O9 g>yUw6 ``ճ'ziXșf<\6 ;#Fs,OҷA[߈wFᲖn2n68"ƹ !J 2[FeiTmMM>:vnJÚF0?Di[q A.ULV4Rݷ盱\9ED=~O|3?.PFîm!Df%ʛq= PoPܒSXػO {nYm nL1 VDF䳲SMyd5 :mNMK4&nTr!zk&M7jJ; m(Zb $^Q'u wDb= VHGc1(#H\!TN# VI~A qj]NS}b ke>PaGpHiꩪ JߴEڦ֊[#֨bA܄I)/y!JiŔ 4FGX60~\dm%_/7;sl%Ԝ.\1GSFr3YSƪ`T$}jז+0.,(i,KIUQ1z6y:G:>Gj\E6x%64p(#;7 H"K,%XxGj=]Ư0YJ8%'(?_nuQj]+#GMq%ʂQWGOY)o# #V^R*z%T (Bnv· ^wb Q;SPjvn :**wŗQxm[j|ʆ|.-Ԓ{' |GNNv7BI+-J.g|zr'lJǂ%ifYġ魜kVǾuĒbK>|buyvwۢeL5C-OJk6[k}XõH7;;GNrL6`FHTY1>`<n6xNJ٥V^̓L]x&QY*ov O$2Aq\'vB=-Q"3mtwɍ$E}KY1}OǤ%sK \e*&AF'?tJƺhX#!{o/t7uR`+jFATFĭ#l_RGSre g3%{fޕ]VXթIAJw`+l^) ؝٢ Hw㹙{`͢y-ml2nް7"\b @(R f0F 1'~L Zp W02RPTÝYDC>SKox'HA_-(KA~qGQƷYX-ĠqY(OH+##m⹖kt vX}"*-fЪdښ1>*QBae9|BU,3 . e-/ZR#dĄ&+V0P8miEV% hB՚*N`@ <rX*#aL}FOL[||;_50 1M4^b:лVvڲYí8X3zt5E#0ဂAg7@5UR y H} )u rkjtZ5-lR(M4e צ[)\\MpmķYLvf_`ca4Ƽ/ [," :(3?"bzB",t 0ΈwUIpQ2FQԭRf.divg&2pa HfIWN]ߚn،f=CD-oFi1vx3{K#av zȁn|דɤ0r`G^^#+_ }ugOBcţsx|`D 0#Rk#UZ.XCQ}>16Lwe 攌1}֔s~Pݭ&[\RS+$!O"ٸӌ7GB>-.1ŵMLӟڹ?:O k YZ