openscap-utils-1.3.6-150400.11.3.1 >  A co=p9|G6kZ (|TP y?kOKS8܉yXorb-k=G¶\pI)f<תv5,I`fˡ#<Z6M~T vHM-MgёFf1#xJJ!y'i "|E=sivEu Ox 'fb\x7Wo5hP%l5UP5Ux{Hްsfa2273ee194446b156d966795d087402b637b1e7e6a141280e8c259c3d120912bf718463f0049a5e0aba6d7eb7f11b3115bf2432,co=p9|^Q?zl2qn/s߶86,#6$l={2k4 fdA51cGXq)Ys2{S@(Dc"-.3(KA92@DT,Ⱥ*m,{gE*a Ea7ǹCSiak@ wTiMj]ѯBi3>1dwX40C,-a9yCw'z2v q,w䏴 `:Jv44>pFH?8d % 8 /5=a   \       4$L@(Y8`5945:5=>?@FGH\IXY\]d^bcEdefluvHwx8yz4Copenscap-utils1.3.6150400.11.3.1Openscap utilitiesThe openscap-utils package contains various utilities based on openscap library.cnSibs-arm-5%SUSE Linux Enterprise 15SUSE LLC LGPL-2.1-or-laterhttps://www.suse.com/System/Monitoringhttps://www.open-scap.org/linuxaarch64 if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in oscap-scan.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in oscap-scan.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable oscap-scan.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop oscap-scan.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in oscap-scan.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart oscap-scan.service ) || : fi fiP & ; 36'Zˁ큤A큤a#cla#a#a#a#cla#a#a#clclcla#cnRa#cla#a#a#a#a#a#a#2a38a20b37795feb3d83ca971791742e3fdc3fa6a13cd9ee3b67d3f4561c20178f2ec122a6ac9cd12f5c5dbe0b4a2dc44cdbd3a43791c54275c23b534e0fcd39943d768c49937f7fc1e969bbef6309471a2db3f61d83a15382fbce8f667ceaf9ff7e52c18c6bda9e1d461f51111041cbca65af67b6956085865fa8daa0c2a02fba19361c3bc2c17b29874141fd36c937c36d28689bab3390be11fbc1de15c2e673385d11262550a7b1c665991419b53cdb491208bc03b25e1b914f834c55a48c0b328389d2ffc3b2b8e782216a31d589d14c3d966b5d76e0079a5ffa87752d88abf9d5451a03c748170a33e8cf6e25fbb1c48ffec70eb0d6a57698dfca71f719b527e619f881d78a7acafb289c30718c3b85b5c86957aa3847faa9815199a28224c7db43e1a984f84bd67c986c9c28ec99963be13f3a6fbe2bc58291ef8377dc0464708e48104f7da84d9a642ea2e770ab5bf2e2a39f435f4a124623bb370d6092372ceaa10c867c308439081dca611a93e2069078cf81aae562a6a5238dadd22c552d1934dc46f6b05d11de3d0f1a06d1f314c20c6a4c23380d9c79eb5b98bbe8135d3ba56802f925980aa66cbffd7841bd10e92888a927bc058ae1bfea23d0de3ebe1fd0cd236487ebd6e476311cc700b53f2fabb20cd4da634bd94e9521c8f1090cfaa6dc15d52ce84af9ca759af21e153034213d4ca817ddf353c2b77c8dfa7b554c7b631d2546a10e08caa775421ead8deccf7d81cc3e211f864a78533382fb64b132eef61f9628d61f1eed6dd48a12ae0630a3c7a3b8d8d86b394c294be53339782007018f4153e1c5bcbebc5fa4711f414ddabe28c4a6116d5819350ae7e87eea1960e9ea5df6d7c09bb7accabd372dbd14b30f2789e07db1f3b1b3f291329c7394c5137098b364a372d5038eb7482fdd40fec29690e9b0c7d1014c04d01d832962fb3e4051d51724d9213cffe08c8884aefaa31d700cee7d9cee3fe2servicerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootopenscap-1.3.6-150400.11.3.1.src.rpmopenscap-utilsopenscap-utils(aarch-64)@ @@@@@@ @@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/usr/bin/envcoreutilsdiffutilsfillupgrepld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libopenscap.so.25()(64bit)libopenscap25libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)openscaprpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)systemdsystemdsystemdsystemd1.3.6-150400.11.3.11.3.6-150400.11.3.13.0.4-14.6.0-14.0-15.2-14.14.3c*c#aNaaLaZaG``r`__/@_Q_w@^^{G^@^^]:\@\[@[[@[ @Z@Z1@Z1@ZZ@Z Z Y@X@XXoX2XW@V@V%@V`.V@Vf@UmUUF U#T@T}T|X@Ty@dmueller@suse.commeissner@suse.comrfrohl@suse.comdcermak@suse.commeissner@suse.commeissner@suse.comsteven.kowalik@suse.comrfrohl@suse.comrfrohl@suse.comrfrohl@suse.commeissner@suse.commeissner@suse.commeissner@suse.comrfrohl@suse.commeissner@suse.comchristophe@krop.frmeissner@suse.commeissner@suse.commeissner@suse.comrfrohl@suse.comrfrohl@suse.combjorn.lie@gmail.comrfrohl@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comjengelh@inai.demeissner@suse.commeissner@suse.comrbrown@suse.commeissner@suse.commeissner@suse.commeissner@suse.comjengelh@inai.demeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comledest@gmail.com- require shared library in the same version or newer- added Leap 15.4 and 15.5 dictionary entries. (bsc#1203408)- openscap 1.3.6 * New features - Select and exclude groups of rules on the command line - The boot-time remediation service for systemd's Offline Update mode - Memory limit control using OSCAP_PROBE_MEMORY_USAGE_RATIO environment variable - Allow disablement of SHA-1 and MD5 - Allow providing pre-downloaded components - Introduce OSBuild Blueprint fix type * Maintenance, bug fix - Fix coverity issues - Patch the `segfault` in dpkginfo_fini() - Add an alternative source of hostname - Fail download on HTTP errors - Compile "environmentvariable_probe" on Windows - FreeBSD build and test fixes - Add offline mode for password probe - Initialize crypto API only once - Fix UBI 9 scan - oval/yamlfilecontent: Add 'null' values handling - Do not set Rpath - Do not split `XCCDF:requires` with multiple `idrefs` - Allow empty /proc in offline mode - oscap-remediate is shipped via /usr/bin Added oscap-remediate.service.in.patch- Rename oscap-docker to oscap-containers and provide oscap-podman as well (Relates to jsc#SLE-12852)- openscap-docker-add-suse.patch: add SLES support oscap-docker (bsc#1179314)- ship python3 docker module always- Since upstream has moved to Python 3, switch the BuildRequires from python-devel to python3-devel.- Add definition for tumbleweed to openscap-opensuse-cpe.patch (boo#1186735)- add old patches - slightly renamed; cpe are needed (boo#1186735) * openscap-opensuse-cpe.patch * openscap-suse-cpe.patch- openscap 1.3.5 * New features - Made schematron-based validation enabled by default for validate command of oval and xccdf modules - Added SCAP 1.3 source data stream Schematron - Added XML Signature Validation - Added --enforce-signature option for eval, guide, and fix modules - Added entity support (OVAL/yamlfilecontent) - Allowed to clamp mtime to SOURCE_DATE_EPOCH - Added severity and role attributes - Added support for requires/conflicts elements of the Rule and Group (XCCDF) - Added Kubernetes remediation to HTML report * Maintenance, bug fix - Fixed CMake warnings - Made 'gpfs', 'proc' and 'sysfs' filesystems non-local - Fixed handling of '--arg=val'-styled common options - Documented used environment variables - Updated man page and help texts - Added --skip-validation option synonym for --skip-valid - Fixed behavior of StateType operator - Fixed some of the coverity warnings - Ignoring namespace in XPath expressions - Fixed how oval_probe_ext_eval checks absence of the response from the probe (obtrusive data warning) - Described SWID tags detection - Improved documentation about --stig-viewer option - File probe behaviour fixed (symlink traversal now behaves as defined by OVAL) - Fixed multiple segfaults and broken test in --stig-viewer feature - Added dpkg version comparison algorithm - Pluged some memory leaks - Fixed TestResult/benchmark/@href attribute - Fixed memory allocation - Fixed field names for cases where key selection section is followed by a set section (probes/yamfilecontent) - Changing hard coded libperl path in favor of FindPerlLibs method - Check local filesystems when using 'filepath' element - dropped, because not needed anymore: * 0001-Fix-memory-allocation.patch * openscap-new-suse.patch * openscap-leap-cpe-15.12.patch- 0001-Fix-memory-allocation.patch: fixed a crash during oscap oval eval- openscap-leap-cpe-15.12.patch: add CPE dict entries for openSUSE Leap 15.1 and 15.2- add dbus-1-devel buildrequires to enable systemd tests (bsc#1178301)- openscap 1.3.4 * New features - Add support for FreeBSD - Make use of HTTP header content-encoding: gzip if available - Improved yamlfilecontent: updated yaml-filter, extend the schema and probe to be able to work with a set of values in maps * Maintenance, bug fixes - A lot of memory leaks have been plugged - Refactored rpmverifyfile probe and fixed memory leak - Fixed SEGFAULT caused by recursive and circular dependencies between OVAL definitions - Fixed DOM representation of the profile platform - Test suit: better portability, more granularity in results, inclusion of memory-related tests - Compatibility with uClibc - Local and remote file system detection method was improved - Make the report a valid HTML5 document- openscap 1.3.3. Notable improvements in this release: - a Python script that can be used for CLI tailoring (autotailor) (thank you, Matěj Týč); - timezone for XCCDF TestResult start and end time (thank you, Jan Černý); - new yamlfilecontent independent probe (draft implementation), see the proposal https://github.com/OVAL-Community/OVAL/issues/91 for additional information. There are other changes as well, here is the list: - Introduced `urn:xccdf:fix:script:kubernetes` fix type in XCCDF; - Added ability to generate `machineconfig` fix; - Detect ambiguous scan target (utils/oscap-podman); - Fixed #170: The rpmverifyfile probe can't verify files from '/bin' directory; - The data system_info probe return for offline and online modes is consistent and actual; - Prevent crashes when complicated regexes are executed in textfilecontent58 probe; - Fixed #1512: Severity refinement lost in generated guide; - Fixed #1453: Pointer lost in Swig API; - Evaluation Characteristics of the XCCDF report are now consistent with OVAL entities; from system_info probe; - Fixed filepath pattern matching in offline mode in textfilecontent58 probe; - Fixed infinite recursion in systemdunitdependency probe; - Fixed the case when CMake couldn't find libacl or xattr.h. - dropped 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch: upstream- Add upstream patch to fix the scap-workbench build: * 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch- switch back to official release - openscap 1.3.2 - the test suite and build scripts were improved to support Debian 10 - offline mode has received some love with a set of dedicated tests and various fixes in OVAL probes; - the oscap-docker wrapper is no longer dependent on Atomic - Python binding are now more robust - HTML reports and guides, generated by the scanner, are now more accessible for non-visual rendering agents - Support of multi-check rules has been improved across the whole workflow There are other changes as well, here is the list: * New features - Offline mode support for environmentvariable58 probe - The oscap-docker wrapper is available without Atomic + Maintenance, bug fixes - Improved support of multi-check rules (report, remediations, console output) - Improved HTML report look and feel, including printed version - Less clutter in verbose mode output; some warnings and errors demoted to verbose mode levels - Probe rpmverifyfile uses and returns canonical paths - Improved a11y of HTML reports and guides - Fixes and improvements for SWIG Python bindings - #1403 fixed: Scanner would not apply remediation for multicheck rules (verbosity) - Fixed URL link mechanism for Red Hat Errata - New STIG Viewer URI: public.cyber.mil - Probe selinuxsecuritycontext would not check if SELinux is enabled - Scanner would provide information about unsupported OVAL objects - Added more tests for offline mode (probes, remediation) - #528 fixed: Eval SCE script when /tmp is in mode noexec - #1173, RHBZ#1603347 fixed: Double chdir/chroot in probe rpmverifypackage- temporary openscap 1.3.1 git snapshot - make it build with new RPM (bsc#1160720)- use distribution-release instead of dummy-release- openscap 1.3.1 - New features - Support for SCAP 1.3 Source Datastreams (evaluating, XML schemas, validation) - Introduced `oscap-podman` -- a tool for SCAP evaluation of Podman images and containers - Tailoring files are included in ARF result files - OVAL details are always shown in HTML report, users do not have to provide `--oval-results` on command line - HTML report displays OVAL test details also for OVAL tests included from other OVAL definitions using `extend_definition` - OVAL test IDs are shown in HTML report - Rule IDs are shown in HTML guide - Added `block_size` in Linux `partition_state` defined in OVAL 5.11.2 - Added `oscap_wrapper` that can be used to comfortably execute custom compiled oscap tool - Maintenance and bug fixes for a complete list please see https://github.com/OpenSCAP/openscap/releases/tag/1.3.1 - removed patches accepted upstream: rpmverifyfile_unittest.patch rpmverify_unittest.patch sysctl_unittest.patch test_probes_rpmverifypackage-disable-epoch-test.patch xinetd_probe.patch- obsolete removed packages: openscap-engine-sce and openscap-extra-probes- Drop gconf2-devel BuildRequires: It is not mandatory, so lets build without this obsolete package. - Add pkgconfig(glib-2.0) and pkgconfig(gobject-2.0) BuildRequires: They are also optional, but not obsolete, and previously pulled in via gconf2-devel dependency, so lets build support for them.- openscap-1.3.0 - New features - Introduced a virtual '(all)' profile selecting all rules - Verbose mode is a global option in all modules - Added Microsoft Windows CPEs - oscap-ssh can supply SSH options into an environment variable - Maintenance - Removed SEXP parser - Added Fedora 30 CPE - Fixed many Coverity defects (memory leaks etc.) - SCE builds are enabled by default - Moved many low-level functions out of public API - Removed unused and dead code - Updated manual pages - Numerous small fixes - xinetd_probe.patch: fix trailing whitespace in config - test_probes_rpmverifypackage-disable-epoch-test.patch: fix rpmverifypackage unit test - sysctl_unittest.patch: fix sysctl unit test - rpmverifyfile_unittest.patch: fix rpmverifyfile unit test - rpmverify_unittest.patch: fix rpmverify unit test - openscap-xattr.patch: removed, included by upstream- openscap-xattr.patch: build against new libattr- scap-yast2sec-xccdf.xml: remove platform cpe match, as it is impossible to match both opensuse and sles or official suse_linux_enterprise_server names at once. (bsc#1091040)- openscap-1.2.17 - New features - HTML Guide user experience improvements - New options in HTML report "Group By" menu - oscap-ssh supports --oval-results (issue #863) - Maintenance - Support comparing state record elements with item - Updated Bash completion - Make Bash role headers consistent with --help output - Fixed problems reported by Coverity (issue #909) - Fixed CVE schema to support 4 to 7 digits CVEs - Fix output of generated bash role missing fix message - Fix oscap-docker to clean up temporary image (RHBZ #1454637) - Fix Ansible remediations generation - Add a newline between ids in xccdf info (issue #968) - Fix unknown subtype handling in oval_subtype_parse (issue #986) - Outsourced the pthreads feature check and setup - Speed up in debug mode - Refactored the Python handling in build scripts - Prevent reading from host in offline mode (issue #1001) - Many probes use OWN offline mode - Improve offline mode logic in OVAL probes - Do not use chroot in system_info probe - Prevent a segfault in oscap_seterr on Solaris - Out of tree build is possible - Use chroot for RPM probes in offline mode - PEP8 accepts lines up to 99 characters - New configure parameter --with-oscap-temp-dir (issue #1016) - Fixed OVAL record elements namespace and SEXP conversion - Removed '\r' characters from help output (issue #1023) - Full Python 3 compatibility - Removed basic Python implementation of oval_probes.c - Added support for Travis CI and Sonar Cloud - Minor fixes inspired by Sonar Cloud - Added Fedora 29 CPE - New tests in upstream test suite (offline mode, Ansible, etc.)- openscap-new-suse.patch: handle SLE15 and openSUSE Leap 42.3 and 15.0 (bsc#1091040)- Replace old $RPM_* shell vars.- replace oscap-scan.init by oscap-scan.service, add a /usr/bin/oscap-scan helper tool for this. (bsc#1083115)- disable scap-as-rpm binary to avoid python2 dependency. (bsc#1082135)- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- openscap-productid-cvrf.patch: add a --productid selector for "oscap cvrf" as upstream does not detect the system yet. (might go away)- openscap-1.2.16 - New features - oscap can generate output that is compatible with STIG Viewer. - CVRF parsing and export has been implemented. - oscap info command has been expanded. - The AIX platform is supported. - Many documentation improvements. - Numerous other improvements of existing features. - Maintenance - Huge cross-platform improvements. - Memory leaks fixed (RHBZ#1485876). - SELinux fixes. - Many coverity fixes. - Numerous other bugfixes. - buildrequire procps-devel- openscap-1.2.15 / 25-08-2017 - New features - short profile names can be used instead of long IDs - new option --rule allows to evaluate only a single rule - new option --fix-type in "oscap xccdf generate fix" allows choosing remediation script type without typing long URL - "oscap info" shows profile titles - OVAL details in HTML report are easier to read - HTML report is smaller because unselected rules are removed - HTML report supports NIST 800-171 and CJIS - remediation scripts contain headers with useful information - remediation scripts report progress when they run - basic support for Oracle Linux (CPEs, runlevels) - remediation scripts can be generated from datastreams that contain multiple XCCDF benchmarks (issue #772) - basic support for OVAL 5.11.2 (only schemas, no features) - enabled offline RPM database in rpminfo probe (issue #778) - added Fedora 28 CPE - Maintenance - fixed oscap-docker with Docker >= 2.0 (issue #794) - fixed behavior of sysctl probe to be consistent with sysctl tool - fixed generating remediation scripts (issue #723, #773) - severity of tailored rules is not discarded (issue #739) - fixed errors in RPM probes initialization - oscap-docker shows all warnings reported by oscap (issue #713) - small improvements in verbose mode - standard C operations are used instead of custom OpenSCAP operations - fixed compiler warnings - fixed missing header files - fixed resource leaks (issue #715) - fixed pkgconfig file (RHBZ #1414777) - refactoring - documentation fixes and improvements- Remove line-trailing whitespace from last changelog entry. - Rename %soname to %sover to better reflect its use. - Replace unnecessary %__-type macro indirections.- openscap-1.2.14 / 21-03-2017 - New features - Detailed information about ARF files in 'oscap info' (issue #664) - XSLT template creating XCCDF files from OVAL files - Generating remediation scripts from ARF - Significant improvements of User Manual (issue #249, #513) - HTML report UX improvements (issue #601, #620, #622, #655) - Warnings are shown by default - Verbose mode is available in 'xccdf remediate' module (issue #520) - Added Fedora 26, Fedora 27 and OpenSUSE 42.2 CPEs (issue #698) - Support for Anaconda remediation in HTML report - Maintenance - Fixed CPE dictionary to identify RHEVH as RHEL7 (RHBZ #1420038) - Fixed systemd probes crashes inside containers (RHBZ #1431186, issue #700) - Added a warning on non-existing XCCDF Benchmarks (issue #614) - Fixed output on terminals with white background (RHBZ #1365911, issue #512) - Error handling in oscap-vm (RHBZ #1391754) - Fixed SCE stderr stalling (RHBZ #1420811) - Fixed Android OVAL schema (issue #279) - Fixed absolute filepath parsing in OVAL (RHBZ #1312831, #1312824) - Fixes based on Coverity scan report (issue #581, #634, #681) - Fixed duplicated error messages (issue #707) - Fixed XCCDF score calculation (issue #617) - Fixed segmentation faults in RPM probes (RHBZ #1414303, #1414312) - Fixed failing DataStream build if "@" is in filepath - Fixed missing header in result-oriented Ansible remediations - Memory leak and resource leak fixes (issue #635, #636) - New upstream tests - Many minor fixes and improvements- openscap-1.2.13 / 05-01-2017 - Maintenance - we always build system_info OVAL probe, fixed configure output accordingly - warn when the user requests to generate an ARF from XCCDF 1.1 - fixed a segfault when loading an OVAL file with invalid family attribute - added --thin-results CLI override to oscap xccdf eval - added --without-syschar CLI override to oscap xccdf eval - fixed a segfault when freeing xccdf_policy of the default profile - removed ARF schematron workaround when there are no applicable checks - fixed verbose output in oscap xccdf generate fix - do not filter fix by applicability when generating remediations from results - fixed memory leaks, resource leaks and other minor issues- openscap-1.2.12 / 21-11-2016 - New features - separated stdout and stderr in SCE results and HTML report - HTML reports contain [ref] links for rules and groups - Maintenance - fixed ARF errors reported by the SCAPval tool - fixed CVE parsing (issue #550) - fixed namespace of ARF vocabulary according to NIST SP800-126 errata - fixed exporting OVAL Windows namespaces - fixed injecting xccdf:check-content-ref references in ARF results - fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248) - fixed oscap-docker man page (RHBZ #1387166) - fixed memory leaks and resource leaks - small fixes and refactoring, test suite fixes- openscap-1.2.11 / 14-10-2016 - New features - huge speed-up of generating HTML reports and guides - support remote datastream components (issue #526) - support tailoring of external datastreams - various attributes of remediation scripts are now shown in HTML report (issue #541) - new option generating OVAL results without system characteristics - remediation scripts in HTML report are now collapsed - support for extracting Ansible playbooks - enabled fetching remote resources in OVAL module - added Wind River Linux CPE - Maintenance - updated jQuery and bootstrap libraries in HTML reports - extended, improved and updated user manual - fixed issues with proxy in oscap-docker (RHBZ #1351952) - fixed a bug in OVAL arithmetic function - fixed a segmentation fault (issue #529) - fixed results of XCCDF rules with @role="unscored" (issue #525) - fixed invalid characters in OVAL results (issue #468) - fixed a segmentation fault in tailoring (RHBZ #1367896) - updated SUSE 11 CPE - fixed many memory issues - large refactoring of datastream module - new tests in upstream test suite - various small fixes and improvements - openscap-1.2.10 / 29-06-2016 - New features - support --benchmark-id when running `oscap xccdf generate guide` - added CPE support for OpenSUSE 42.1 - Maintenance - oscap-docker fixed to be source compatible with both Python 2 and 3 - fixed offline mode in rpmverifypackage probe - fixed scanning of non-RHEL containers in oscap-docker (issue #427) - fixed regression in loading a datastream session (RHBZ #1250072) - fixed missing SCE results in XCCDF reports (issue #394) - fixed a segmentation fault (issue #370) - fix error message when OVAL generator element is missing (issue #345) - fixed failing rpminfo probe - fixed compilation on RHEL5 (issue #393) - new tests in upstream test suite - test suite is able to run on Fedora 24 - fixed remediation scripts appearance in HTML guides (issue #460) - fixed autoconf build - small fixes, refactoring, small documentation improvements- openscap 1.2.9 release - New features - oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths - enabled offline scanning in many probes - support for SCE in data streams - many improvements of verbose mode - verbose messages can be written on stderr - runlevel probe supports SUSE systems - new upstream tests - Maintenance - a lot of refactoring - fixes in various tests - OCILs are correctly placed in datastreams (issue #364) - oscap-vm can work with fusermount when guestunmount is not available - fixed oscap-docker HTTP communication issues (issue #304) - fixed oscap-docker tracebacks (issue #303, #317) - fixed container mounting in oscap-docker (issue #329) - added Fedora 25 CPE - only non-empty profiles are built (rhbz#1256879, rhbz#1302230) - fixed compiler errors on RHEL5 and SLES11 - fixed sorting of groups in HTML report (issue #342) - fixed version/@time and version/@update in XCCDF Benchmark - fixed CPE definitions to work also in offline mode - fixed sysctl probe (issue #258) - fixed manual page for oscap-ssh (rhbz#1299969) - updated user manuals and manual pages - updated .gitignore - dropped fix-missing-include.dif, not needed anymore- enable the SCE (script checking engine) packaged in "openscap-engine-sce" subpackage. - enable the CCE (Common Configuration Enumeration)- openscap 1.2.8 release - Maintenance - textfilecontent54_probe does not produce false positives on non-UTF files (rhbz #1285757) - fixed oscap-docker - small improvements in verbose mode - oscap info module shows information about tailoring files - fixed build with CCE (issue #264) - fixed XCCDF score computation (issue #272) - fixed segmentation fault in variable probe (issue #277) - fixed broken support for OVAL directives - fixed bash completion - plugged memory leaks - fixed fresh static analysis (coverity) findings - fixed shellcheck warnings - new tests - refactoring in datastream module - many small bugfixes and typo fixes- openscap 1.2.7 release - New features - OVAL 5.11.1 fully supported - oscap-vm - tool for offline scanning of virtual machines - verbose mode - added SLED, SLES and OpenSUSE CPE names - show profile description in HTML report and guide - group rules by PCI DSS identifier in HTML report - preliminary support for Ansible Playbooks within xccdf:fix - added "How to contribute" and "Versioning" documents - Maintenance - using bziped RHSA documents in oscap-docker - fixed errors of sysctl probe - fixed skip-valid option (issue #203) - fixed segmentation faults in SCE content reporting (issue #231) - fixed tracebacks of scap-as-rpm - fixed invalid memory reads in rpmverifyfile probe (issue #212) - updated README and user manual - many small bugfixes and new tests - openscap-new-inventory.patch: upstreamed - fix-missing-include.dif: refreshed, 1 hunk upstream- openscap-new-inventory.patch: find out the CPE ids of SUSE Linux Enterprise and openSUSE versions.- openscap 1.2.6 release - New features - introduced OpenSCAP user manual - improved OVAL 5.11.1 support - added OVAL 5.11.1 XSD schemas and schematrons - support for core/platform schema versions - support for check_existence attribute in state entities - support for CIM datetime format - amended behavior of mask attribute - added support for remote .xml.bz2 files (use with --fetch-remote-resources) - rewrote oscap-docker to python, deeper integration with Atomic Host - introduced CPE name for Fedora 24 to the internal dictionary - HTML report & guide - results can be grouped by according to various aspects - printing supported (interactive elements are now hidden when printing) - table of content now shows only selected items (rule & groups) - references to RHSA are presented as links to website (rhbz#1243808) - Maintenance - scap-as-rpm can now build source rpm packages (srpms) (trac#469) - scap-as-rpm now supports python3 - refactored oval processing into oval_session structure - many smaller bugfixes and new tests - new openscap-docker subpackage- openscap-1.2.5 update - maintenance - smaller bugfixes - plugged memory leaks - fixed fresh static analysis (coverity) findings - fixed shellcheck warnings - fixes for Solaris platform- openscap-1.2.4 update - new features - OVAL 5.11 support 99.8% completed! - new symlink probe introduced - new process58 test capabilities - added possible_value support for external variables - added possible_restriction support for external variables - improved IP address comparisons - Added Scientific Linux CPEs - Added oscap-docker tool - Created man-page for oscap-ssh - HTML changes - improved visibility of selected XCCDF profile in guides and reports - render rule-result/message contents in reports - maintenance - Tests now pass on ppc64 little endian arch (rhbz#1215220) - partition probe now supports remount, bind and move mount options - Patched NIST OVAL-5.11 schemas to be backward compatible with OVAL-5.10 (rhbz#1220262) - fixed scap-as-rpm to work with vintage python (2.6) - better error reporting when a probe dies (i.e. due to OOM killer) - dropped selinux policy from upstream (rhbz#1209969) - fix segfault on invalid selectors (rhbz#1220944) - solaris support patches: file-system zones, systeminfo improvements - many smaller fixes and new tests- openscap-1.2.3 update - new features - oscap-ssh -- handy utility to run remote scan over ssh - glob_to_regexp OVAL function added - HTML changes - show rationale elements - show fixtext elements - show Benchmark's front-matter, description and notices - show warnings for Groups and Rules - improved handling of multiple fixes within a single Rule - scroll evaluation characteristic if they overflow - maintenance - OVAL 5.11 schema fixes - Coverity and memory leak fixes - skip transient files when traversing /proc (trac#457)- openscap-1.2.2 update - new features - OVAL 5.11 support turned on by default - included OVAL 5.11 schematron rules - DataStream can now contain OVAL 5.11 - `oscap ds sds-compose` now supports --skip-valid parameter - HTML report changes - Notably increased level of OVAL details - Table of contents is now generated for HTML guides - maitenance - rhbz#1182242, rhbz#1159289 - @var_check & @var_ref exporting - solaris build fixes - xccdf:fix/instance processing fixes - improved (none) epoch processing in rpm probe - environmentvariable58 now emits warning messages when appropriate - offline mode improvements - other bugfixes- openscap-1.2.1 update - API changes - 5.11 schemas updated (from RC1 to gold) - oscap_source_new_from_memory can take bzip2ed content - HTML report changes - severity bar is now reversed (left-to-right) - maintenance - rhbz#1165139 - fix probe cancelation - dozen of bugfixes- openscap-1.2.0 update - new features - native support of bzip2ed SCAP files (file extension needs to be '.xml.bz2') - improved performance on huge XML documents, especially DataStreams - minimized use of temp files to absolute minimum - added OVAL-5.11 release candidate schemas - API changes - overall 50 new symbols added to public API - introduced oscap_source abstraction for input files - further info: http://isimluk.livejournal.com/4859.html - all the parsers converted to use oscap_source abstraction - introduced ds_sds_session, high level API for playing with Source DataStreams - introduced cpe_session, abstraction to approach multiple CPE resources - introduced ds_rds_session, high level API for playing with Result DataStreams (ARF files) - deprecated dozens of API calls dependent on filepath - introduced API for waivers (xccdf:override) and modification of ARF - initial support for waivers in HTML Report - dozens of small improvements - maintenance - dozens of small fixes - dozens of memory leaks (whole test suite is now leak free) - updated gnulib - openscap-1.1.0-fix-bashisms.patch: upstreamed- openscap-1.1.1 update - Hint towards `oscap info` when profile is not found in oscap tool - HTML report changes: - Source OVAL results from ARF if available - Highlight notchecked rules, treat them as rules that need attention - HTML guide changes: - Variable Substitution improvements - Show benchmark title - Show info about selected profile - Avoid cdf12:notice, show only its contents - bugfixes: - improved handling of fqdn in XCCDF - memory leaks - static analysis fixes- fix bashism in oscap-scan.cron script - add patches: * openscap-1.1.0-fix-bashisms.patch/bin/sh/bin/sh/bin/sh/bin/shibs-arm-5 1670344275 1.3.6-150400.11.3.11.3.6-150400.11.3.1autotailoroscaposcap-chrootoscap-remediateoscap-remediate-offlineoscap-run-sce-scriptoscap-scanoscap-sshoscap-vmscap-as-rpmoscap-remediate.serviceoscap-scan.servicercoscap-scanoscapopenscap-utilsoscap-scan.cronsysconfig.oscap-scanautotailor.8.gzoscap-chroot.8.gzoscap-remediate-offline.8.gzoscap-ssh.8.gzoscap-vm.8.gzoscap.8.gzscap-as-rpm.8.gz/usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/bash-completion/completions//usr/share/doc/packages//usr/share/doc/packages/openscap-utils//usr/share/fillup-templates//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:27062/SUSE_SLE-15-SP4_Update/ea7f11b22176aec6b877f0cdf87d53ed-openscap.SUSE_SLE-15-SP4_Updatecpioxz5aarch64-suse-linux  Python script, UTF-8 Unicode text executableELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=060fb2bbb397bdd63c099c2001c6fdb2f98f3901, for GNU/Linux 3.7.0, strippedBourne-Again shell script, ASCII text executableBourne-Again shell script, UTF-8 Unicode text executablePython script, ASCII text executableASCII textASCII text, with very long linesdirectoryPOSIX shell script, ASCII text executabletroff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix)HTML document, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix) RR RR RRR R RRRRRRRR]n,C*SǢpk9utf-870776a93d3f4e797c9a52d7bfdaea52703e676a9148c463ad04ce2fcff51b3ad?7zXZ !t/43] crv9xsr{Z}^k y%W4h9h\zxpRF!p^?K]6>TUbq"@k3"ႜ 8ܑC6v|/0Z#Fcee7 R roѸ$ܹځ ˔98-)]p/ D+cZ.;0p 1ˎ46 no*ݡʖϒrߝ3»w4OY0^P2/3 b5Pz5xҡ{Y*D_ظ=|ӵ5/ԕ`\!:On1]Saj7vnNQ~QAJq~w#D ,SQ\bPBgc0YțE$ '8psaіmY:W҆ƨg012VG/MHnuP /sE)UK~R(ԌKe-szuioJ\7BynCjIZ U:P+.נa0YeWǤ@ZURONtBlBP;F'm;ݡf[iPj̀c%a5,B`+9VtHf1HU^h_̉_Ȼ@Cy׈Z?,Xpw:S\gl. Ȣ D]U}HŬiV| +@A%b|iL5өi 1dmo34l"hnۺ y'*jI*60#__oSF*=]`2N@N( V&q #& j^S$dg}Mեd7I?/lwnע. b͒@"4@MzH[Jh+NΗ9XXLvx*?IDNT,x';?%IWva_)aƄY=I8]׻u ] n &P@qü[1ggjHuPŒԁu*!诸]joD{dK!vcwu"թ= m$UL`a?Ѷ4hGZZχ;;(#CYM\GWB3crDf-6x5 n0._9 bM,T/爣8 c.H֋`*|%>Ck"0]wǾ@fz|kMCq/vzJNl3<;L=w1:xw\pnp~Ƴl6)gS]ɎFɇ թ0#v}'4vmXʍ aD;A8#v{7ѽZM+iPP(LP6:Jj4,/sz;u$DI絃|B߆GWאIhR 8Cn?K/>9ѣ)v-Xtn_=C~Uh/=F|SN4/zPV0& $QZ kBLp=Q1x4' 3h3}NC-;1gJ+p٩z,R]4z'ҷd.KSV`tDE2՗kA>@td%43fP]JVdH! 5# sΜ/iNr\/rMMHц fdKcҺ: JJ (y(TU9)ْ_ p3Y%Uh\t׸j2| gKVeMF"ojYCGA˯a]tYz4<#c׽]0!Vޚʥ/|~goA͝YXlrAA^[ ʱV>B%UN'az/(ޥQ_A Sa22#;DO$4K}#H#;g`S a13)&Ubǃinu(jVǦuS5ALB<7X.9fw)B K@r,9]G`%E/b;%} ;k66s١Hg5Ny׿rޗ[:`Z!y0^b kxjpg$.6#5*wX b { 0I ¨ @G“R<PG⳧V.sh1i}*~AI,'+k,Pզ>K:Nfx;/p*6?)k,Y=LcA{>jB ya޸NƯvs̀ Je ɢ1? ?Z;Ѩq0~fg5㰃 S-j 1VTSO?j0H{A8 9 sa4snQ{ntжjEsxm#ҫ9UoqتݎyYRњNà CDjx2@<3%J>单"PjAEJmVd`(Z, t:#u%g{5IAzIǗ<#t>LQ<7[ v C$Hѿ9۲f5j WHnX^ .0Y $zWWײ OJ_AbquJ(|RECK?hmIWyg_HC0E9VHҌ6g9)[>B7?MH9=>pQ^d}4ܤN RW;a3MOAvڌu{k25/߉*Ac.CmAî'bԧ̋_T#?>t8WO!:XD7*R=+JaѫS0 +(Ax9 I M"1nάt iMIN }kS֩I\]9lS^="6KT 8K]{s&d*mۑ Սb#,0_Ew;wl~qJDSzQ ty@(m鱸7 r`mZMNҚv0&`(NCzѶ/e#\E{O}s)+rjL5³]^ɛ)׷l1>ԡՇ SƗŠL&: s^5qD[s1N*^'l({\DՇ*UR=|U{N_%8 'ύ$ɍq^yubSc-RrFkƄ6H=Z8MXܲB}JeEhBdtгJꜲ9lҪFEV,6FFk^+TGFDتk qֶ FJ\hO9kEnj:#XD2?*LhR`hE5Ȓ\-Aa,S~ nOaܓpP/:Yðem̅#>6ٯ'=GlRĀ8X#N2<s(B?qZ$ndy݅vq}Ú&aBϱ~}ܰ3Tw#Ak K֜2H4uеr_<[؜\@P5XwcgPC_Nt!O Q~w;U^M A?]E 2 Mz;kG?1e% A]C뗃5`E&Sa'tbDݲîw SZ'z 58D>yt"1 Q1r'io*{YNF2>NFT@r'zzkJih Sq6$E>`>OR9=16f5'SE@\.HvR63i@SUB~d\~vr[M+dOXɛxo йuOf1jvIpZ(j/\*/9Cệ_cZLwT7==WnbǮ  z2kW 0S Z 7l;#; Bfnþ'|K. ߿$\_f2n !a % @gUC~Z4_ᄲNЩˇs|-]T ŕ=an9Ma; x9R6H{#9|KFŝP40lm=fO5N : 4D9z~bE" @r66MmI3IL9^E&T^]FAgk#E nAPN j1jPnt{,ت7EB$q j7UC;|ӧ|KOQYp_qкziFռT IriǝեjtۣNn@#IFәby2A^2OD\U"(I5î{h3`3L <^Kkfq mwVR#dr~yBmZsGw<\[14anRrv&]HwA4?osc\}+ &`TIGusQ!Q8 6pn[lNOA^elke}cFܮ P! sztߢ,d|}o1vfykOսϿX$gC!̕蚒FrNأ,gnyg+N:2C :ݑ8. r,~D̵4U71PTjI-u x0ϸrL;ՖXb0#/AuR}V6nAu]qKy1|7OF(õ4l̔fќimi J„ KDS0܍Wd+i ȿ <IѤ}y RqOWzs_2ÿk.lvzL.dti\I=$x:4-682fΑ5OkcH{bV 21Ozy)w 'g|\~. sӭQ4}y*j$n.GAՐGu'~u*ӳ[J\;0y55:L+ {rG;e1uLPoᡈ /qr A̗1dY"Os>[6$w`AA5&Ta;o|(`VQ{yP aG< aal6"+$f*uBW9&C6HلV[׵<&<;l:ƒO{F#! Y‡ ^nצ)~=:j.tޱV2[҄?mhsm0#c^Fzێ~˃B̦e&V`G9!;, ٬5X\Hnf$X5DpsruHߛtvB+NDJS'_Y̨p+TI'ۭ3'4 }QB]_B*02E{BxK٠=a1Y .w޷6R[ MOr}B!TJ6λ5 rGr3|XAԾReXtS&lϗUi({U.ȩу(vkX1z/5 51d#U#^fՅ#H1BHMsP >y2qHi?f% +; tTzQ1;Мؿgi'_\±rIѷ2Dٚ-;M2}dj/X\S486VX5dhC+գidHw ]XOl;@4NVΧ֓SXxC^t?%RR˓g~ꤼ*?5_b6m]tHMԎG .ʝ,UV:7z^`hk_T+PvZ%2TY>}\ 螴A%^;r`$_fֻ8н -o4jn v'.fbdأ6u gDV=[RFMvL{Uן|5G)ϒY >{̡* \g>LT="W{~H_P4iO"2m_,x\6VTM㳂P+Sž=E q7ꁉC~Uw+dO9aTWS@xs~|\pڏ/7WS¬ىskY p(43\f!?g^ QGz2xqp/9_?f:s!?@}z͟!GCx6D ME&*͍ Io@ry'vܢ`Jq(SSĆ\_Q vzqegk'4B n8 >̎2AZa z>h8Wn-iF Ԃk; xppջH{uBk*.̶yO1.b VUW^'@?,X;a}Ǻ"_[cXY\saz5: 0|Y*4\L_hITTKphYLz5(G~_2]D ed p44o= i֟fl`_q أ]_>6ƴ0U[րv\3pfwb*P/X??ݲO?fYX0^/M/WBGH -fuq9Pŵ{R5rI4T}GًE JZ\[/8+((+{nx RXa8zyIuG! GKH(KfjW"h8ja&qԆ}Ey2annSwdL `uVxt.^Dk?QjZHV~Ъ vėd@ƽds6MیXע"_!0Y:r^.({.>uOEe*;zq I!DxդSޤsUc{ӐGI/_)r@w~ԑt=G\`*3MYW^'od##tsgVԚ.AkN P[Ǫ辔Ll 0f`p=-HI"U4R ?uO[ zz47=bWVYԞ Iz | %;;d(E͓+RMu@QGiUPyЬu ܟx-]hga2F[I5%.Zf%HàǺ3%@W=lsFv4*{(t鵕bs8Y+ⷚ>zYq$]׹7>uZv lFߒӿ9p!޳ Y71-Myh-IU "'Z<4M^D h?ؠ3J?}e!Zb7 b#irwh}dXW5fYmg0 ]j ,M+wG.&s잦&@+31?Drt;tu p5hFt&`c)i@BVWx{oRcV5)<ħ`;8BV# @Y"I G>98@#Fi>U]I67$[=t#K]2zXҢ2$=T/='4.ݽ%Y: #Jwe+T90OԽki \ԌZ:&oSj揿ACX\Ğ2&K4 ~YU+o-tn6 7r DAh,nMyCa_<BwQm:\>C!Jt!A ] oL\Js&̶"6c*BQmAj Ap'Tgtq.rBs-MT̫INKϴW?$=낖_P_8-هjHZ"cDL4l0 _|mvj6*|%Yu5&)9W?򁹆6`HՍҩec1MҊ~2U6924LvZ״ 6/QI k(@NÅA :/S!8pNosy؆xܱT9ȬhBK+q>}:>G{[Vl˸3,O'5s s@Q^*8-r5J} *<!@#LM mCGbUXb)oMAz.Sl=̺q^Q .;6\L/vM+gDz ׾Mð8cMRgKazWnDNdcyr7&EgW|J ς'ds݅_ţD\᳑ؤ65 `fayXv804L",x/-lAeElq(P#Icu']C(!'? h̼5 i[)b)P?YFډblE*>+~_'W'Y֌VFg9r`:r ԥo\ NcC=[!j`*{MF[?#^ p7MuQWmv/[\6ʔҙ6U~m.NWZB#@꟢Zwuʧ̙8Cs3:oX㻇aA{m*j̨WE|OеZ`ŜULwud5z:M78E@ . Ú+ BvԱBg\e FSƳs^PB4v>d XZAtr꾥(=fTz`OMx@ͮYq 9 v>+ՠ'+9/{qh1GljX^fw_B!N#Ypb_@S!"مzO;֪:hi 5g877, Jѩ1&o ߞC}?5g!8JD؄ WAlA;Ca{O_'J9t:oM}',[vNL5ܫg 9 *QO_"[oY(PN l,vW˩,=RY5ǫ89]t]]wbH<ߚƍ4,tabS yOjof)GV bݷOx2t:%3{U~KbgQ {SSՃdײ7m AR_*LuEl=w<#}%)Ehu:*-*e L1uzcHP%QM.48]uHI?VuQVE82.l/moH}c@,eZYigw}v@yTG<rlR|Cq:hY Ҵ*/MƖY %2v\JR!S$Hiw ?9nʲ؀T$`_~'rDTM":\1,MѱY@H`ۗi|ϮD *AsRCJEs/Kbhd; X VK!(2w֠_apʙ1h^)d1M9!iA;15^uȣi vdd1[o4ǵ7"!YzL"zJPm̺Lz89?I3>s'q\EpĊfsDceiK3]tT^~X5@c Qjrf)SlID$~xDuo^&N>g2b9eZҺ-%׻[O-8C6{@jx!Ԁ'ѕ?b{奱 ކU^`AOsZfeiBذNƥMqvUR=jHvOT)@•PԱ['fcV%XsiMYϖW0n5Ċ&5BțV.k\s`,]W᣺)h_op h?seЎ C`gY4 ]=>V&z D3Jr+usC̀Pi lsS7lu`i8ػVSpk~!sg2T @ QZy§R&PXvYLqWm`qt&H{&sYgޫZbii?zY*ԎfnՑ<NIkҜzmj=`n07NDc{E;& 127\C35.G1JpDxLJ?y1ߦtiGD @jz{JXw^R XRx:0H}Z2YHKP$؉A(twa %YU2 j " ac$>\9u ƁZp?T\CmMD·idZZ%w8Y,6 `ݹ ޠŁ>FWҒ{:V~=7Վ=6IevS Q'6 B#1!}qUrsq'+ߐptdQBDo\")1f"=.cVu 9dl=>@ݚ<ԑB6:(z=*kZW FuY&T;f/O( 9_Ϟ%@?UxWS~al%zx)_i"*!B85Zg` nyYafn'=_aT~ 6CI)Tш$PC3n0Fz0Mdd?L'$Us7YZáT>~|ku1/ r/a&Uo 9(ʕ4'`5b+'"Y1Q>ÒNuto KUXUdNYu.HENgm6z?"癁޸Keu Nan%jcd/$4h ,oh oDcړ^]A@"aqkJ N \-˯>ڳqmv/(;l4rIn3~ۤFU@i'7lPS`sZ99i[wOԬWldxmڃPd1!)f7g4o ˿ܢDQN;v5Z&31&v^ioIdbU\*~>Fxu z{Pm͛ ȧ+~ ՘r$y& */uoo * ŸS06럲@L̢>s'aZs_dMHf1'8Ov,N˛c۟'aůʳ.g5?"P_$tl)Ÿc0|Cw.<@m!jxZX ;\-UōCJ5r7ۿ/VwRRFu)OS #WQ ʯ&|// 1@$pPOs)f ,iW`5xI]GQipz64] A<&{l ̌mCH c[|7( QlF;U+ý{/lH;V7>mb*׈ݫ.p/.?_Zgنg) h~ 9[8j0 no U(\?L^j7:p/JKzץR?iIIƁ*C6* 2 1Q sz> fDͥ%G _mwFcO9WO m]\SB>a$pRTצ)56;O+&0v+[qLVe*blf1b y DJ40S9as_U {. ,L6R6CG!q銼;;ۈ:|-rEoŜLw |UzOYSLQ, 1Z @SdHgŬM# &EکD%hF;YHc`jui-T_]xҀOoj!(Џ(*Q%}Kf)_ LJ.Gd@&P`'5OG"u'ƱO ӊ&E{n;,8ˍh2Dt>sԯdZJ^Ξ]^<|siĝ[x}wȘSh)+CU ׯriyrpS*ǻn⪓Hǯ%68V)o!PTN1{O'< E.6ý]`яhJ38PMs-r3/E}C0xA֞MLfҤ_:zL?*M>܇D[oP \c+׺1e}r%@YWm:0)2 &⯒W/Ru_mqj_ug4kB & tG<_#]@ h_$E[*BÉpA_\/S@}\ A ҙ?\uiN^.^5X-BjT9>QYN.D.583u5-[-'Z2E9-B)#6T ;2j^nRM=A{0!܏] ]8UD_/c S3Q(M %*v H@;l>*f=ҡ,sWd?v"-Oqd|@SKAg!./-Sz+H\-H=GWR{^7Cea~_AdJmXPQ4bJ3zp3 )@"f"hմiC&w]Ņ};^X&qmPytP̟3-IFǓ. r% ŪGp) FhD~)gkˊct#?AZ;8SPF!V纮ϋpΙ2356#KܥkDc~P0#CDd@jR6ZEZVYKT l$_;GE;na):ѴeȺI~rmwg5(u Jf~+jQX6\TInVGѝfe*/)%rXND*Kơ -18E1\z&i^aEC-pT{BĞMW]w tH9'&!Uz2w?*-;iaRɮѵ,2MU]_*W? X QzUhY=SݎJ<ׯ(۽YqBr iɶ[e#MA:K;\m {_FgJ 9'~p8ڙ Z2l='d6;^**|Nǀ{8xoYu(В"vC0OwuEfi#Qn2Bwδ4[_t\=:7Uz(m."\LjR*,ꊊq'B㾩{2n$DܹFp>gLefEIOtiGߨ9wS?*y7 e``)j7+vҋ1u+1ZQfv>:j w?('z.Ww B]cRF0LL]Rv錧U/^B>2֥TH&O _tE*2=zo_S4`d`x|EGx|{V'WMB~t|NmӔBo(5 CAmfom6:eg2$/\7 HYd:g*>DzTMPe!ऄdbTH5j@(yKGmCifuq6;=>e+"_Apg-@_W.fÆj=Fw}v?wHCO@29*V| f oi%p\?;kPk~xǭ20\[m {ԔjSkRsޑ%q{FCgc‚/+ES:ƈcV[aǏSNO0^x奉3*P '[ӑq'B06H nWcq*kɌ&n~gtW/\~=SZx9 7?Mbwf*/wK4#15JWWkFXT3um- t’&H#?mdU[9eGN_ J( xE1R-LvPp>`x7Oܾs:!{z%m"lGuȇ <Szq`k;귯IHPE*4 }ooIgeO)T&>0p 'L灐JFzŴ'-|0"@vbh5)o4y+ʕb Z)7|{WL~[o4/ oX q񨟅LJo BaJ;]ɨuL2X|q,:$~ogJH!$h^=ud%F)m*HvoP Rc[U ~`s y=Q&\z*[qy^{{C˾[8 z9(=FڒN<:b!1 qF'QRͺOj%.Zf &Wnlj2a%?4X'-^- i2o>[Ӷc$DkcKRdStH(["ؚhbC3ͿxtYtgM|n("iSPZI J ϘV3`889='jJ,[Nkޟ 9佣][f&b*R8:$u@(mdtLet6+# uv~u ɒ]e.&O*PV?yhk+ΦjBtpE+^j[L =e)0#YQ?cԠz.-ꉎD|(a٥ǖ-K@! Yǯ >A7&dl77!KS!bd6ETu۴E5"(dX-8k|ev|ʵ ݵ`?"VuՌrpa3E**pm N?ٴE\u/XVLZ#rFc¢C]w,)Rs_KL*&\pCH Fkk S')܋ )퐕6DD&v ү^M1nC~`;ysXÈ&<v&+f:I5*LvGH-lXR^}7IԊ'czoFr܂mֱ$#ڶZ-L&hqn-7$%s*|= r;asij^ j,2aD ɊYcKKT=#o:48 >Bz'>0ws?OTl'Kq0 g`c񕤧6W}NvXw3F3~N{Z-T_XCMҽa]e!{Ze"bLĤ˨ `wSI*ۭ"D}Ξ0CdӲˊ]LVU>7%`!iuLyb* Nd*-[T#qܶ¸S.0xk's.p="MｅsW쟸vwW^nJ7׈3+xGo>]=/]H,laM+L= gB:SXDٍK"[r~&Ħvw붑d2騶6&imQf 79?4KW`c<6}u|41=T+z~nE!َ WH/SEj:@|/Z8_H*`K߿0yjЯ$.Ǡ>c7NPô=<hrr9i^zF8H|)9~lh 5\w FO ]v0=/|tML!` W8|C;-l <$]msMΟe{wfr㐪Gǩ& ]mGQ#BcoK]k!ڌN46=Z[֔+EcuDQVZdx~ڧ1QL#rtG-nRXz?j?΄BlǪҋk(]_"Wz +.[an‡QV>gب}XL$JgkBktfI|7m8|'p1WU@ x 4gBQ1>EnR"0Ihю?W ['+CPꬻ)j ں.5sHTL뽘j͹\l3lrPs)@jߍ']_P02|\'6?ٕDC]z|ƴkSu-X /{E9rz?R3EA>gzrא7v+V2u,"gsls5>YL+OWtYˁWW y U!Gկ((Nf'6SY.#3pl#hw@H8}9h ,1w.CePO5P3E!j৞dڷ;li@n,bJUU `z gk!e[wߥ3MJ.Zb%j{eUu^5'R:PTk4OX~"ܪ2l~L:*Aqɔ/X-|cq-yr\du͊? /U9Sk~lG5hkxlHIM) a@~!?>{6yկD-J@glhy\9T%;Ĺ2m}]of̕{@+pEh]B ?Ve9 ؒ7mqzZݳ( s42&:!JOuzMo=f}-9mTu?pD<߰.55qG^??,w|2if֞ I{Hn`⟞aY[jVFo0j7E;O9D2I;*}EX?Bjh;<ܲhNL p<]Dk|`NkislmU/S4r JӊYkkIil:jsQ/M7` 3;Wu.n{ҡ4 5vҹ|~w 1&U:$(۫#F"YMu&HݑO"܊v*r Gi,Mg斋mZ(uWƐp6o];T YUZB o `0v$"`]/uUz!ufRoh"ĒX<]PCG@k[{mz), 89׵rg]4d MI͸#p?n@$Ii)p - 6[/AZssi7x>Z+$r fG57\)ɒI?" ~hjexh+4xF:ќmzv@kJ ASp%%(gN#vL-/Jn^rth-C3kn~^Bή<:c0g7>s$J)R |cE{* YZbdԶ{iU.ݑJ^Vt/fGMy(,I9w*s*d_y4dbH:0٨%?m뵨8#C ?:se1ӄ:K=&dc>t`^bIՁevW^ j vx 9l!+g/p̷pcwf YKXr_U }yѺm4y4$W'f;z5}ʨ:4phs;֓͝Ss[(\'k·L7L$yZ#є6,UGh ʽѰߍۀ6r.,=hBo aWsu( ){҃F0ak"ZHMC@l׎/fSh-,Ȥ9]fXBDxw?7#jKrmѧOPܓŦH^.]4,h96056"aFZ gx7}%urףoV8䣙벝3e؟PL];h]h@H'H=db1sxSRzVI<狠$ s`E֨ar6=ч@bk| Rrd4~m(ϹC{^˗Ky t|)C P\ǚp#{؛q>k ŢT]jy`phUL{kTáCEjcUj.]*9kGD%-U h+)0:\?6\bZg=;@l{ؕ*P:Ӭ['|i2AB¿y8/mo+9g$q|he(GT8!G<=pv5I1aO|M3IO0U1,aY^uԦ]ƷڔKa+;JeCwx[ W<^)Ԅ~=2X4K: H-iW0X+JFxe* 懔VU" G(H~t\iDe\g4"6϶J\mBo!|NYbYE)e] S"ACs('x L9 #J]Rj8z7^qhq9 3aA˰6uZ-[ƺy? cQ;?y.7Ih荥)_mlsr8?I5f~& }Õi K4Ed'm9`-[Ҕz 7kȢ3]s#*(jhԩ6hk[>#(se kvBєN-"a1Nշ? ,7=Q#>p: 64VQF+ewB#[Vge;!e >"G:!%c$ o53hN' ˁ&Te)f`-E8[s$;tzFB5X<{y"ћ͗ 61p%+8qg8g-϶HRkČjb&b[D:oJy>u?kp `^Ybb0M@H*W?G,7H8;{ԥ)tx5G_u+|, ωːpw9(Vo;s@j*Χ@R'EvT{@2axrË_*8ƫXI=M&[wfD}3SO@&1+ _$>M7z&\D[P΄{(=3nl`H]-!-΢ n(c[? xc>N$o_}wE<†XW=xiO.]h$+R?aٮԺ΢LPBvlLDkr Ne]-0Ɲy$TQoB)P}U!-*QO?])=l}Vh n`V zHU&ᎁ'^T~՜𗥱? S)N4kک!Mt5,'v*<N&毚X6zmdb]tFu=ж4/s(!!˙{7|ĕh:HJ`'R~.msWNOdB<866LŔGeȡW#>MAcv 'C GfЪ$ݡq1'{Ȝ~* 5ӟK%|_y#pJmj .r %>S<6MьIJM {E$~HR] [+jh^@[P}f2d˰ c|z-c~#n*!U2&{NZ9Q}|7ا)3x7B =A8y7d܈BeTA2 ~ ߜR W,Mb#>εތӎ^-2FByEc1}6p [,鎜 4U-܈2 Š6TpM^4rTߏP̍ [P\l*iC@ҷ/6AG m J"2ތ6(WH%vDBo3v TPo+?eB| ԦEpe8::6•B)_= |?teC*Ŗ㏹ 4.0bWP#PZ v;Ƨ(8żH:\ɨkK]gLQ"l^1LV&/cu+]ԓDfu.QyykYO 6Ip.HuBD>|g[*d#Imo\+­7>F y]G?e fᲽҬY=pQC,(/iӞ, x|YuK9k= Eּqp-"'F?9XRn|e%b23OS$3kԘ͠ #&ՋۥR%9W:nY?ѧ/;jPq,} W7N~$ź_M*|>I/E@3ឞ$XVP+51O,]RV_j1)ut BuPF`y]Ro;7,i14ym6΀C(n̲+aBU+8 f@UJʯ)~J94=Eglq6E~]znddDx!{X\l9ZjNFQ%&) Qa/6IATMUg'mY_ %4 ?CmA p;c/7h_J3ªe99-6j <سCA &J(3LG;aķC ]ө7q(S9lj/'Ҵ=koY'Z ]z݅  f B.nFЈiojCs tJ¸jx`L.O}Q[`z<؋nk YmHՃTit>C"¯Q2JdSXs0`ޞ^f2 >!3~qddY}q /lͷ轡.]$E{9S 70MUElᷫv^=YLC5[׶fe2;$@SbѩyDO~iw{̠Eߨb"(9:,nWrB`;S|r=ⅿVr CN-ډ~]-r3\Xk ,A"N1)ɡxO:Ҋ-k#A\H& !،:6RAj-JtO++E5G Ž,$iQܙMF^`k{JRBM*F 9 GF'# z @HMw,KVFkIx㿳X=6o_p& 2Ĝ$Z V)MSIJ.Tp~:UPe܄;.衵+ NU\OG ]ꕘ^tAU}ilRLݟ$$Xp䁅ꉾO=6TD\@UZהh3rd{ӱ!]Mtm85D҆PM2#L&p/12WF:H,kŹA`B}meAJ/\V; B&?q"y_NLt/!ω_^Ώ5k,{5[kJ-QÄ1 >QSR$vB=T>$fj6ނ44Zp-4vȏ{T1pP_Y?_f7?#̟I<ꍲNCJY(Mw 84JJ3<6UXB(Fu# *+ˢas 5/0mj|d_GqdVy.6HdD^ˡ_L җ-c?LPD|Xi *YA!Xr ۮ%fȁ$.W-i -: nD' Go&!Yפp*\iՋSP3_V{|8RƾfB?lfC4ͭHgbr%'ܥ`QFƆ;>ebsg+^x .KLfS-턅zb[STx' #jQ׹E&yUy/"GG.QX(0gw [jj`{gmk,*$Ov[eS Jos32@ 7km# ΃㵟HleߐezEb⡒1\յٝ4S7?$Sy Kj<*˖(->UJTt o)Eìs6*S17,%cgM=~\uLK?UcmC48:/D_c{ʘw~׻pCc NLKH&r>;8t= dͫxa"}]dXe M"bHp_~e~G6iԁ9>ZW ܡփl*+; ,LTQ!fڣZ҄kW*mtEu8سpS}?IDݰlwp1ԇ¿*Iw2si|/B}1MF>֯ڤ`(l@dMl4$i͈qu9e5w`KŹ{V824^fv9"@UH@J,!cHWYv$NKgr{p Zwyhvg(-#)vC-vq*Lg.zE?̇'Fy&A%&<ŐenM]k}Ze~=QGqkFd؏kL$ @oe<'d2:i-,,YO=TX㺌4B]˗-Qfٱ]vJgT,e`ɟ9U>n]g.ca-d:ND21uH}طa#/#V']iβYo;t!=ߣ4b,zХX&+z9*lo`x n%X[•Dl(L~D߶"(]mǮ @E ;`  N9%nxFm6b=â^DFrc2(~lүܣ8#Y(H>ꐴE D[d Z$0+" *%2뮒_5Amv|6]mSd4xa5ְ$3l]gA xMs>hKtX0mn2V-U9n_y((2w4җ-v>7I`KT3l詜lRaC_Dg1oj"InqwnBD5v^ͫz*覿כ 5SPZ/f_&ݜ|LZc!7Nfiy.wPA'/Qrgsi UoV\P` cDimy+0)8D~`Zbxpa6IS$l"\|U&-{F 3_ J=Fmt;(LokIny.NP1d QdљgV,"q?;@@Ȥ)0 ;Isǭ]v,b`>bfDfjf2}0L'^dz[\kR )C]P mNBk!1GNii7-Av{ܽ8.$PV v 3TX+׮ 窻^;$rgt7Ol˜>ftiU;S E|0M,U'vX&^2݃Д7&ćX}d ??V}{)ƍZcG*DϪ1q 2H3zi5INUּ" F(3&UJE!T`{Ǹ pg{|)B-l_4rڜrfx;b{|;.PkLjfzϝ܄ԭ_rl[(:$ لzwY b['ɘ99r,͕7>$Gn!\"Ȝ뷁#ס1?tϱV%=T}h^zM= {2}afwt@P@MsE't?pztV*?}.WLW ]|i:4J KʢMR4(RsVc &$"wb}AfWLwv/yw:Q7xr4ۻ:) p>ӱbaj?*d{r>7իlemCSi?wcBVzQ-ytםH!φ|Xw"WIpp\pzUS}i72w>l~ܠjǠ/C %0譆|Ѳ̹4_A1ߊ YaGgNģV0X0.\=:m&ZQ;|mnU{:^VڪUa%V*4>Uf'3]-S-DhbCo$wyQ)ILl4 g | _Љ9i]Jo+|l_R Īd5/2 e[Bnq7r<71Gy&KAʰsn}Dz@$6HKOl`\`o( V%+6 IiYY sNc `` B$w YPۚyg*=ŵ񒍉IYEQn>RҴBWR̢3$!77DT>f$~55$CQzF@չRFGQ:M zO|sXϐsy1ӣCa]?6rxtHt6?Y3j"a{!)YB;ئ̀kr _z)K̭6!ɸPy#g1M=P1cT~@"Go$OdʾƲy^(hE=CpWy4xFA~WGU&)5dy۳] o؛OAt(]i _bl7 >rnWADTgN56_>+쒎4G^'mxR;w;x3h u^r}ņ2H\ׇPKT~PEE!ڸ ^$C7c9|xW3kv`E%P}*)|1(ђsCpX"]S:^w ߦv[Y<2Sf[K@Ӷ4v)Kwo  ;M+<8$7HvDR0v@=ŸDM샴e#'ߵj9fri\@->ud(دbX}8'XIMj!*u ׹R3z꠸0KVw;E 0ChϦdx9 ̲n˿+͂Z*kR$vIVp֝Fv@Ƀ'Fu:Ԣ+tƅDȾմ)_z R{vG&6Oum"cfEK}r;o$Rk1x539@;TT\ZWHlMs'_i@(,ep!KtҞz:{m;mU$W }1`"{AaS܇zOz[H ".[vNL5~N`%5QmħC_K*D9a;Pn8aZv?A4eP&/[NM؝d`WCR"-+X bV *G__; ?΀NijYjGXlsZ?tϖcr0*^5l Yi*zE ނ4"sKB/MkQ%u((CWy/&oV׳C-Uks-_zMh!ve2 iW.5D.{3魝q_Y_ rNfŎBE6߅p찌]O,2צs7+|&r¢2BT[d 7'#ÀK{@q,rnʡ<{YYQvPy}AQ#Y܂pžFd浞Y~5NaW"K^A` >n8_7^`;Um (ðB"= p[3e=”c ]zRۙv OU't{+ۃ~KpfVJ}ʨWg\IxxЖ9n\0LR Q > 1 8ȸ*tHĎ̑dpªIN6OgzqqJ.}\gk߳@) T-=y:IׇP[ ([?Q`UL"T?0<$c&,H2~9;c^tNKcW<&+咢.fIF^*+j[Nm}jFӵg tu4RY#3HC>d_y\A8V=!][w"ưe1Iy}`!#2'bR`GEnUNFמ62q `ʏ= L&ALGeK|Af'D.aO?E DSŢG牦1>+b5-hТ()m'o9LaЖs-a*$_>>Hu+w]fkhC2ԏ 19^T)̚c6/6IS|aH*UI%ҽB)3پ&;>г}')9k2X{^ UelIgzcݥ)E(q@n4ϿLT ;iSuTؙKp@ !h(:v_DXLI0dR/Z#X- A[" 5ԕɟiuI9U , 5\h#Ȭg 5, #0&gd~Sh'l񘫶tqMP%RlHMeWўu Us5"Q~OG{.TA}a$h`4/_Tz,$] zb #Ev.PFhQ-^-8'w-H(Z0{VKֿOJooi `?(<^κ;KP{9-͏di*暩ĨOQhWt6.m 3hF,[g0|0>w߸|P(JxգD;*Z#oDO˸\,t)C{W!&''gf -m~z-QF HDUi@љpbTR6j{@.I'1,& Wm bkrKL[g)7vGT}9Q?p)ݚyLAۮ1 " èk9RAV.ҫmA̻;"locsgAZ}l-U{ijz;H0&"׈H  %j5Yӆ?8#;bPKb T`gRIx FZX!镤!\L4J̵֥sf`Ŏ=v0>ĒBW**s^cq }Ԏne^t] XK%ScOY0o!%Bۖ>$_ZȧB]Dl #צ=]Dfqbwm^X߄{ *o ?)E4aiRUu0ulb z$d(%ĵo%U; ]YHx6yJΜdR?S̉4ˌsɕs Y}H:)^;㼇l 30fVҨ,#z5Ut'5xR,T}e^rTM-;2%GG՟p-q'2uRޑD( 2bRI<-{_$g hf㢸( ,|ڼYe_EjD>^WIQI^in+rʃbNj+dhz }8m~{5͸*z CBӠqAjz%́7d/Hv1j#J$zX%?wB1Hh _4 Zk,LȂ!?C7Ei5)K&8 3x~կ oYQWVp+8S2(:+XOz_5W*)SBem b)<WUo'`<ްaqR4\܈OvX ^듚d ; @%$ROh/JtY:vm4?N 5Xe3kiqonKA}ksrQ4 %ץ.2hڂ5Bwe6{%gz >{P b_n'E-`/Ii$sv5!b]>"'@,MҏkvEh&Cp@d [-gYW?V>b bk \0ĥ-cOE~#nɌKT2cOv+ev N>G:pk}|jz+\ݺj0adc?i@:, _F7xhQSB$/dWƄmW) a ;Y]mWYӧo9ӰK-?F[+@⪙϶qKΘ>[A%Ck7gn.ä*=CZБn}0Q Jれ ZCPmS(e꣇33*]j*ccw./('V:. ^dJ:V6+wN#_E}2Ill:]1g>p5R,U'lR'K M;p_6iC9P~~lјBk0󖃶o8Kp3ٸ){\4s˖eGֈ89[G.WX'_:(KvĢ 4Fl ]T $kĢpYg mw?,6mmtmWS?)4 O&V z"hDrS5^"ڢ6CRp%1BTB"8fP+&@Jq, 0ۗTa(e 8ا>V7snNR^$)Ꞌ([kɨ`-V3:z ac9Lrj1e,AݦsBQ:-d`-_ڨ5{[]TEܑԺY^n')hC#=+:ؒ#6 iwY-*|i[թxf?`}i| h[`hF*3~ YTCJ&L]?2 } /T/j.zbiIk3fe.&Rl P+i%L_i6,wu蘱[u#IiLyQ{DR%4lEe0f"Ї` \ 0 `$X}M@򖁊-D8_AItLﶝ;QS5˔n:ϡ#TyxL|Zrr{qpjpG䤧k. 檢Cۧ/bB;1ɛ>(56Uo@:vDcNڥJl'3 '\t1ZѶ.%|u݌PΈ, ./1@Diϛ]E(ѽj5Jix>~Iܤ: GMuJDm: ^A=򗘽/Za]OwC0z:Cv..=3~ՎU>5 I+I1|$ZJ#!$E?~z/jDSCp~%̜*=Ģپ@411=|R/8- Ț񀽛ix<3t>sl  Lp'1/?_[D Z .bt~80Bbڲ6iKaM7{*9uj|(@c%a/Z4(n[Ɓ)LX9ኦr- üs_qjzU= c:8X``sAX3m^=Ӣ(T:|TiLn?O@ gX[X"5j_foB/( fjFQ0nBΩ|deO2uKـpe9B{It_ %<6 j.IaIs\3*!Dzo3 s`v8 M>&.U{^tݤ8g<-ՙÙXJ=\-a mS8oFj=9Cpʳ#K NKi!*YS«+3U.LG$h;j쀺X4Z_rcޜz7tTʃ֋b5L!~`L+W5^]Hk~g(/lֺTzLAb>8Iv 8hX n#3^!%҇2F frYQ _S^غyHY V nģ֡% I 'kujuCx^}FzdӃޟȂ'd2/Ӱ4IӲ[f~0@H\dv :71M!L1Q@e6 cN++QFӅqS>XE*#0\ DrEFcqQqz85kӞG55sZ\^o?g2.*XBC{y-^o"XDjMX4jp4gNs,ezc1*hMl_?'GQ4Kh~x|r4xZ3޽biI`ĭQeBS$%u3MBH<Q/> XR-.5(5돑@'\b +3`RwڄB)_3!aR@W!,(2^gǃXZ\K#u-u&].cᥠ~P|R*JX 4 l򭚎h'/yF("9M7#Z;SBϽ6i6F%˽bL`eOqŹOdVXd$v|\^3RX'}z# e~~qDC.'Мј:5&ԁX˟ :_eޓ$Bƶ%lCdSsbq;RB |Dz<3䗂]ςiAL`Fnx8^tL|'D u?ѡcP] $p9 5k@%;-Q9Pr?M'KU33| &g6o|9:Sr"qy*fxc鎜US*߶d#{#J)߆%(C0(#/ &kF7EVh>M= bԙ@ǀ\ܨj'(Ԟ\: ENhMZ!<Þ!R |"7Uxt֧~(m%//!lmҊ?#e.TJ҅MavuPZȔ ӼYaq|E BjL։_Y8ɻ[Gm>)d-i9 jw5/toVUwvv 4 WiizwNtv\Fi= fHv1`eB49E}_t)8FJ2/44:Xڶ^|[wǢAim +d9w.Q`mksȽ[) XT4][NʲT]HYB"[|Zb(lHaΫ9ab4?7͍8Bi+^z&py.2ӵ1hTxqv tG]ǾK*AؔJܽ̋9i1;cV1ҫ_޾9&B'm8bۦC:iGh:mCIYHvCm0kM45z{V$Bgںߢ Pus- q>#w?.uѨnV[ l6{._<.Ld֪Z;zĘpAA!北.Ɗ=4 %uLtֽ%WR5)9>F4Φ@yf9-W˂qΜU7K&/EJ e ?ZEBڄ%B qT~|Ic g}$N4oo;AB3"uJJ皫R Ŭ/)uN!b;K\: *<;k(aqhpP~ZhsM!SУ;˦;أξVrmeK[:Kc 8 ՘ kE>x@w:"9cR/~4ߋw.0@@/r3ó2a ﱙ# @ 增{Ҋ3 D V"8iZsocƞc*<)OwU(4 i vHxxL#T9LlvvUr H˭EA57xp="j8ho_$!D9[=9ost do.*ښ(K#\x\rPQ@ݴIFN45^2f<%[[TMMbߗZ8N^S<dzh(_Tm9}Ηf_ئv$coHF8d8ADfڲ"w-?w #mxΡq e%bJ߿]2Rz\#oUpGb;J\ SѹN)oB]id%=R؇^I3ZV?l]jh3IMio Zv@C%s=zZ؆ r!I  82 H c׶A ԃ cW2Lstgl+:;{^TNaeo"TfYL)ͨB b\u6tLZ̫}bTOܝ|$\%'WHAsdCwܳH j x>[fN;J$AUrsS"v^:Kr3Ny¾Qb]?keG2v98Ω9s{7nZV)ug&[-M$E3?Pɳ i_ p0G΢&M]cA09ͥn 'Y7IfOmOJAw#O-B=O:' vG=?}J׵.0'(jl$~~p;{%"WNPoB%QiWVyՃ|(颮?SMD Gƀ*ai*U_u3W. &Ȉe$;Atv d4KYbZ[#)辅ԟ:3~~qֻ%4u<5'UT"ukÁ'SocʬWք ۪ dNNtDgbXZM1A9Ne&_20ys-7׃,뙛Ẇʙ߀bZE]#P Z?*K|aGԃ,g9L|RWp*N "5j?5]4G'`\!Bڧ({du!H1hWdrT@OzZkn E)EW\GYM +tkkNk5V9-\ت]$ux ș4B#9E\VPٷh8ϰ4';l^0bT6>W ڙ6_텰Ob:kw{DLɈ)pODY6G[6ee_rW |̳ko0lzZ^Z.I}g'm ) >]  ㊖|>$+mX `Ko7F4?7oϋOIɲ#[Sū؆ (*;N6oj$\}3ƵY<ڟ޲R\^s/d˩Spqo}06P~%rTܥaxȾU3?EBx 3üEF4**&}]]G3Suy^;"^`LwRmpQe'1~$sypjI"̧:ww)]O m@AP`+;O.99up!,ɥA ) O ܈n}ʁwQEeƃ>u$ׯ歸Nz3O;/;DF< |ex:_gNW,tjklFm42ܡ_N9[)C-~NIﳽ:(',8&Fr$~黻$*`J!t9ZYfdSygvV/'ub6M ޮnY )qS=)$LA9jE_-Gx} Ki zk#wuáGG8U2-ypvjǒ/~l5oܟK3UY !rñtF?9l;Y~B ΌÀwRD8Zsa0?ESeJd;ֹj GX76V.!h h  IH>]%t_mMt$s`6Z~3xݘ|h,Ը{{3!lZxW#h**9s6W@(|v\`xK_nʴUmL "vF/*/wi‹m\&k5*ªLŞxq>;kL\5?e2S1U+J\!8Q^)4H\HB }B)z5yuf\2z$B 933OR~%J) xςT"lC. {g1qœ;G,>~ہIRe8_gHve%BfP)H#LnUN&eA??^F4 ?ő R% *iϷ;`8]R].PǤqY4JQXb_oʶ7D{{ + Sg1L e6y@N\՘;x{@SנUȖ&Љ޼tAlJRe63KFF* qꋚ|iC~/*Oj1o7\ RGŏ`}~S ׉r=YX:gC꼁.gy*(Rc42| ARʪzo(jʔ>')]ڽ,gҨ9ädyhӽ4j Hv>kKFD1uac97]jzNo?ԕsj"4%;b԰3F0DA)CtGndc^MdJF;I-9ry!"c>aefH~3wcy&.X1ZQPv=B @23́-{mkDP{;Q#P(v 5Cij#YZ:9iRӓմx޸NQ9c-W_$S%iN.ƶFL ;qOFy;v`y rjPHh6+bpE^6㡑[W"$8&̪aEg<'cUP֜u- +Qg"\Zƨ; >A6jπ*\l7^7WtԒ$/Ao/?~E)?g )W7C{tlwB6ƧL^"6!EZ,.|_v;:ax|c7" y[F֏f-*D/" :@ESKYHSrW, 7`)ۡUZn,#f ^XA(\ɴFOcBu{DtT6cgjV&$z:ƽMcӝO&t߉Zs^谵_yŀFz`𫆌ql堲%5UUŐ]K1pttǦVzkGN~ze| lV-F#ߙUv>4Ω ~ۘlۑi6LR7RT0Qg݋2n}9($c‰w;2Z4=׺na Ѕgκ5Րj؂,nLU4uSl.ͱl%&x:YҰ-ЎTWe){߻Lb-uH QٖG,47=y1ծwQ}"sq$TGH7h}V`vĵIܛ姴 ӄܫXT]̎= }Ym[rTlpem^QB6E(yЋꏆ,Ci a_=5طL16Ag11g^aD<_-=u'+TLy|$BBpGl (%Xiuܚ[kҞrU5`Z~[ݍk ɺf+TgD2pVqXc;N* M6l^z/ Ƌ j3a~2~t/ zT(l߱0f:U MUqg?Rjjܘ{=ZC7qsRYP.0ؘ׻ԧx5%xQX!#x*^07mȴw vxzpzA2tP{bSbK˃(^nd>1'PEdQ#Hc@ڕ$}SQbSF)1Vav7Q]EMq :v>UE'8^m5`Y>|bXrRqVQLEt)fK w trF2)csFo\L8^a . [sG!ʤ<Z_C8ҹENW(П%=OϢ<9 .i"hP[j%jHoKܜ{KȉYʵ3^ƈ@h===(<og WQ٩ŭ:jWZ0m#1ESʼ]6;yʕWUDgF0xK =KƄ&*ѣ~h,* z] ȇ/ΡN5 [D`-b @dB) PkYF+B#>$i@YUtC~m aJr,wkt6Z լwF8$+1p%՗,o9T]>BY#)b7-~BXҴ&[Y2s ތCԮ_$ }D+$cqk1 F糋4Et4fe0U'9tHe{8^kd Z@_0A,MybB%ߎ\ }xN $-[1=}ҧG.P{8M"&e ,^œS|uk9hfaτu |bيo`Cp?ZK&U"E/R8&F.-,% O7LtYh9 `\]l^O)& h>IX Oɢe1$ }S`Q.*eXgh7 ( sx@[tz$#`:5%`:;XQk6;e~qm>uK \}48v $LwJ7J|w{EȚyVdӘkkMExS2AB9B/hw:>o1R'R(bmQ0%jW>“~k>SdBfp*dݸUE& H#^2 ؚKM龭d\5n/Dp :UT)8C{h=rF7 EO7łT?=B9Sa70/r.H!!Ifxבwjk:=պeJ8ůu2ҟQpt#I Fv|o8pAaDU #` *'zCv_IWaAg;XAmZP+yD8rOc:'dK5~2UM>k0PhA1CU/V5œfj+7OnQϚ^Oy-*ReÌ#ʫ?eiF'cEf9!b6ɮqtHqBV^*n4)O[=k: _D[ Ŝl9 úsl"/ d{tH5;F vC䀩9PRĶ -rL+8&\!P۹CtmZfIX gˈ;YzgrFY# Z7*J8!͹՟ UҺ_Ο OFEܑOV`H-' 71;Scׁ[JotjQO#$VoQ*%l$@5e٭H'L是 +i$g > *[e-ŗyo41EDG)l$긻4Q`s8_ғF'Z?̍] swQ5GB {2I 3#i`S;c28gW()U`O@qDDZ;J<PƎ~Hb38D%GS6Yhx.6bv}VWC6UVr4o(|m; k+<5 {8m Spbk,llSH+}l  t /KWMNnI3%B/^|z j:I*bO KF_duP߾0CpS݅, /DWgfkÀfcRxe:i r)4p0ܭ{,sBK|xkN@Ȝ0hv4^YxCͯo< Rm8zvFu&aXId5-2 7 '!2+aX6q.*ZG]fBIO~_lmjE|OҎ8dRui~rUl'R`\O+.::o< ::SF+9GD^qm%>o3+&1,>䐟b@'ݞڸ~ЯNJ? _?|2P@1P'2[:fbΏW_n&"dk x,VnL6wD Vf ( F&]ٟ)`aA z1_ߧȿ^>sFZjvJVmvgAx{Yׅ=ZxNp#CT;`jDPRDhp!h"W7!Oᕮ?AVo2ٕ9J.Fr.ublWQ3i8dqGS0P[DSQ MIENڏR K{ cJ~H҃c4;~Ms9-Oh΁-}]7T0e#~b2cO>$e5}]Qh1Yk5/a-y[M& Oxn\䡊%M&VmqJ+E`ߎܜ+onC' Oc$`IDmƦK{e_|v+\Vm5Gڕoġ :q⊊_< ,MAU`GfD5ُ6NuCjyiUi ] W ѵ *dHb2[agVNv}`U@pW%ڀmpx%`P"Q.֨ЭQa[ԇL^9,>4 [}'ʢU4  $/% WV4Ó`(pLD,5G\ٜй#Z()Lc[f6d@<=ϤXHp Q]HoLCE/aw*AV@%tglT>zK,J2K#C`z˺bY.Wa=Ci "/eg3KxFg̭ @}n/EȺ90xv.XyCM6 \(i|8_N`AY;JaPx a3I8gaQ;ԇ;~ oH.1MHWjOEF*}:f]QUׇ }) TAɤymN}/Ee=͊/dg- _3HKwC@1jlM$O4j8aiŭvmaAl-qHm|v߈1v{ Q*$0!H(p= -rЪȓᐏ s 1W8azh7:"b݀&SxG sy) C]a܋gZ7".k(FQߘr$gHӪWSp@C3Cj9jéԛ׎s9f.Ə&XN|Ad0Q./ǀ/OV6!Uk$CBMj>{???1_lsmE3KUTTٰv3D;@_J^X){J+\+}3P{2wy (#>Oݡ-F,hP/o^iZ;Vٰ D ]ghV3Sb{~$" FtPR*&:n7)RK+b سoQc?WP9DC(Y{3748I1> -Aי3-TCg&B@o&|(!1X6ҁG'-DGb, ׶If{ e3Id{V 󷠕3 5YYXZ\3I$Jpԋsl`a -7ng`]PneiV&צVs0Ju`enf)+ד W mo͏9Sq\;(*,K랧dY!98ao+N=Π+C),:8{DNŇn`ҬmӾj^p$[,8( _!g*ڧjn &j2xWe|z=NZV> Ʈ[$_Й"Ymꏆ_'RYhk`l`O hB":Y[4\$IK0<VsMCE,buj.M-/Y R,} &bJVM#Ɩ{bSl\c+I"~M{sw(