bubblewrap-0.7.0-150500.1.1 >
A c p9| ;N0Z 3CD<% MR\3!Z[=
3ڦx0zފJ1쩨
+ZO"s $V'2"K#Nա/x2SF{P;͞Ebpbc;ATXfy!{ V5 B>*e6 ?bat¦26 !=`ʴQPr:78~ BܲSj V`YaZ619baea9d4cd97e2ff5f73c3557e9fa1a904472a eb62186239beb45e4026018ae370567a87816ee2c1bb0d4812657f2d76a8c7ad , c p9|<$2hls(g%IdV_Lf\g^>mHw#+zx}BRaV$Q
Y]PV@d%su 6:3k+e౨P
Ro$&c#%{7B~WR<BL\,
5*3nEbhڈz;kRN(LI<, ˕IKܑ)My*x(g\ O32E xLڕWM\-]w|o'] =P | > p > O ? O d
N 6 H ^ t
T
. t ( 8 $ 9 x : W F I G I4 H Il I I X I Y I \ I ] J ^ J
b K c Lo d L e L f L l L u L v M w N x O0 y Oh z O| O O O O C bubblewrap 0.7.0 150500.1.1 Core execution tool for unprivileged containers Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged
containers that works as a setuid binary on kernels without
user namespaces. cibs-power9-13 SUSE Linux Enterprise 15 SUSE LLC LGPL-2.0-or-later https://www.suse.com/ Productivity/Security https://github.com/containers/bubblewrap linux ppc64le 7 "=
R c' AA큤A큤A큤A큤 cccccb6ccaWΞrccWYcb54b4f96c93724d64f93f91dac6e9d1256fec785365b532dbe6155e5a44f3fa4 5841973c78b2a1035c3457b372e16d45d6541b6fbad436857c1cfc8070dee1ec 3d24b91752cc015a140d69d627d6098e95e9dbbfdc1f08e6e0dc173d4e32f0ef d7ce88ff6014f184097f7527d406c14ba163d71bc93e31e95d784ae19c2b103f 571dbc8beb5a43236dd4142345ad74c6a536027820747ac9f6eea86925c23610 8fd08d3d6db04338dd4ac9b710b14b23a21162154359c6ef5cf16810802eed66 36ffef204bdc877c55718ba5509e049135426a913c53a34fed3590e197f61904 b7993225104d90ddd8024fd838faf300bea5e83d91203eab98e29512acebd69c 10333bae89d15c61f046bf7f9af5d0af40517daa9501d1370d46440acd094681 root root root root root root root root root root root root root root root root root root root root root root root root root root root root bubblewrap-0.7.0-150500.1.1.src.rpm bubblewrap bubblewrap(ppc-64) @ @ @ @ @
libc.so.6()(64bit) libc.so.6(GLIBC_2.17)(64bit) libcap.so.2()(64bit) libselinux.so.1()(64bit) libselinux.so.1(LIBSELINUX_1.0)(64bit) rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.3 c@bb!@aHw^@]\Q\h[;@[IZVYdY@Y_wY&@X @XS@X W֘WWdmueller@suse.com dimstar@opensuse.org sebix+novell.com@sebix.at bjorn.lie@gmail.com sebix+novell.com@sebix.at bjorn.lie@gmail.com alarrosa@suse.com sebix+novell.com@sebix.at alarrosa@suse.com sebix+novell.com@sebix.at sebix+novell.com@sebix.at sebix+novell.com@sebix.at sebix+novell.com@sebix.at sebix+novell.com@sebix.at sebix+novell.com@sebix.at sebix+novell.com@sebix.at sebix+novell.com@sebix.at walters@verbum.org klember@redhat.com ignatenko@redhat.com walters@verbum.org - update to v0.7.0:
* --size option controls the size of a subsequent --tmpfs (#509)
* Better error messages if a mount operation fails (#472)
* Better error message if creating the new user namespace fails with
ENOSPC (#487)
* When building as a Meson subproject, a RUNPATH can be set on the
executable to make it easier to bundle its libcap dependency
* Fix test failures when running as uid 0 but with limited capabilities
(#510)
* Use POSIX command -v in preference to non-standard which (#527)
* Fix a copy/paste error in --help (#531) - Update to version 0.6.2:
+ New features in Meson build:
- Auto-detect whether the man page can be generated.
- -Dbwrapdir=... changes the installation directory (useful
when being used as a subproject).
- -Dtests=false disables unit tests.
+ Bug fixes:
- Add --add-seccomp-fd to shell completions
- Document --add-seccomp-fd, --json-status-fd and --share-net
in the man page
- Add attributes to silence various compiler warnings
- Allow compilation of tests with musl on mips architectures
- Allow compilation with older glibc
- Disable sanitizers for a test helper whose seccomp profile
breaks the instrumentation
- Disable AddressSanitizer leak detection where it interferes
with unit testing - Update to 0.6.1:
- Add a release checklist
- completions: Make zsh completion non-executable
The Autotools build system installed it with 0644 permissions because
it's listed as DATA, but the Meson build system installs executable
files as executable by default.
zsh completions don't need to be executable to work, and this one doesn't
have the `#!` marker that should start an executable script.
- update to 0.6.0:
- meson: Improve compatibility with Meson 0.49
That version doesn't allow more than two arguments for define_variable.
- Disable test-specifying-pidns.sh under 'meson dist' while I investigate
This test is hanging when run under 'meson dist' for some reason, but
not when run under 'meson test', and not locally, only in the Github
Workflow-based CI. Disable it for now.
- meson: Actually build and run the tests
- tests: Fix compiler warnings for unused arguments
- meson: Run test scripts from $srcdir
- meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
- meson: Run the Python test script with Python, not bash
The python build option can be used to swap to a different interpreter,
for environments like the Steam Runtime where the python3 executable in
the PATH is extremely old but there is a better interpreter available.
This is treated as non-optional, because Meson is written in Python,
so the situation where there is no Python interpreter at build-time
shouldn't arise.
- meson: Build the try-syscall helper
- meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
- meson.build: Remove unnecessary check for sh
- Add a Meson build system
This allows bwrap to be built as a subproject in larger Meson projects.
When built as a subproject, we install into the --libexecdir and
require a program prefix to be specified: for example, Flatpak would use
program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
Loosely based on previous work by Jussi Pakkanen (see #133).
Differences between the Autotools and Meson builds:
The Meson build requires a version of libcap that has pkg-config
metadata (introduced in libcap 2.23, in 2013).
The Meson build has no equivalent of --with-priv-mode=setuid. On
distributions like Debian <= 10 and RHEL <= 7 that require a setuid bwrap
executable, the sysadmin or distribution packaging will need to set the
correct permissions on the bwrap executable; Debian already did this via
packaging rather than the upstream build system.
The Meson build supports being used as a subproject, and there is CI
for this. It automatically disables shell completions and man pages,
moves the bubblewrap executable to ${libexecdir}, and renames the
bubblewrap executable according to a program_prefix option that the
caller must specify (for example, Flatpak would use
- Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
tests/use-as-subproject/ directory for an example.
- Use HEAD to refer to other projects' default branches in documentation
This makes the URL independent of the name they have chosen for their
default branches.
- workflows: Update for rename of default branch to main
- tests: Exercise seccomp filters
- Allow loading more than one seccomp program
This will allow Flatpak to combine an allow-list (default-deny) of
known system calls with a deny-list (default-allow) of system calls
that are undesired.
Resolves: https://github.com/containers/bubblewrap/issues/453
- Generalize linked lists of LockFile and SetupOp
I'm about to add a third linked list, for seccomp programs, which would
seem like too much duplication.
- Handle argc == 0 better
Unfortunately it's possible for argc to be 0, so error out pretty early
on in that case. I don't think this is a security issue in this case.
- Fix typo
- Remove trailing whitespace
- Fix spelling
- bash: Fix shellcheck warnings
- bash: Invoke bash using /usr/bin/env
- bubblewrap: Avoid a -Wjump-misses-init false-positive
When building with -Wjump-misses-init as part of a larger project, gcc
reports that we jump past initialization of cover_proc_dirs. This is
technically true, but we only use this variable in the case where it's
initialized, so that's harmless.
However, we can avoid this altogether by making the array static and
constant, which allows it to be moved from initialized data to read-only
data.
- bind-mount: Be more const-correct
When compiled with -Wwrite-strings as part of a larger project, gcc and
clang both warn that we're assigning a string constant to a mutable
struct member. There's actually no reason why it should be mutable, so
make it const.
- die_with_error: Save errno sooner
We need to save errno immediately, otherwise it could be overwritten
by a failing library call somewhere in the implementation of fprintf.
- main: Warn when non-repeatable options are repeated
A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
would load seccomp programs from both fds 3 and 4, but in fact it only
loads the program from fd 4.
Helps: https://github.com/containers/bubblewrap/issues/453
Resolves: https://github.com/containers/bubblewrap/issues/454
- utils: Add warn()
- Add SPDX-License-Identifier for files that already specify license
This is a step towards REUSE compliance. Third-party files that we do
not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
- tests: Use preferred spelling for SPDX license identifiers
- Remove obsolete .travis.yml
We no longer use Travis-CI.
- Remove obsolete papr CI
We no longer use this. - Update to version 0.5.0:
+ New features:
- --chmod changes permissions
- --clearenv unsets every environment variable (except PWD)
- --perms sets permissions for one subsequent --bind-data,
- -dir, --file, --ro-bind-data or --tmpfs
+ Other enhancements:
- Better diagnostics when a --bind or other bind-mount fails
- zsh tab-completion
- Better test coverage
+ Bug fixes:
- Use Python 3 for tests and examples
- Mount points for non-directories are created with permissions
- r--r--r-- instead of -rw-rw-rw-
- Don't remount items in /proc read-only if already EROFS,
required to run under Docker
- Allow mounting an non-directory over an existing
non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
/dev/log
- Silence kernel messages for our bind-mounts
- Make sure pkg-config is checked for, regardless of build
options
- Improve ability to bind-mount directories on case-insensitive
filesystems
- Fix -Wshadow warnings
- Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion - Update to version 0.4.1:
* retcode: fix return code with syncfd and no event_fd
* Ensure we're always clearing the cap bounding set
* tests: Update output patterns for libcap >= 2.29
* Don't rely on geteuid() to know when to switch back from setuid root
* Don't support --userns2 in setuid mode
* fixes CVE-2020-5291
* fixes bsc#1168291 - Update to version 0.4.0:
+ The biggest feature in this release is the support for joining
existing user and pid namespaces. This doesn't work in the
setuid mode (at the moment).
+ Other changes:
- Stores namespace info in status json.
- In setuid mode pid 1 is now marked dumpable.
- Now builds with musl libc. - Use /bin/bash instead of /usr/bin/bash in SLE12 - Update to version 0.3.3:
- This release is the same as 0.3.2 but the version number in configure.ac
was accidentally still set to 0.3.1
- Update to version 0.3.2:
- fixes boo#1136958 / CVE-2019-12439
This release fixes a mostly theoretical security issue in unusual/broken
setups where `$XDG_RUNTIME_DIR` is unset.
There are some other smaller fixes, as well as an addition to the JSON
API that allows reading the inner process exit code, separately from
the `bwrap` exit code.
- Print "Out of memory" on stderr, not stdout
- bwrap: add option json-status-fd to show child exit code
- bwrap: Report COMMAND exit code in json-status-fd
- man page: Describe --chdir, not nonexistent --cwd
- Don't create our own temporary mount point for pivot_root
- Make lockdata long enough on 32-bit with 64-bit file pointers. - update to version 0.3.1:
* New feature in this release is --bind-try (as well as --dev-bind-try
and --ro-bind-try) which works like the regular versions if the source
exists, but does nothing if it doesn't exist.
* The mount type for the root tmpfs was also changed to "tmpfs" instead
of being empty, as the later could cause problems with some programs
when parsing the mountinfo files in /proc. - update to version 0.3.0:
* The biggest feature from this release is that bwrap
now supports being invoked recursively (from other container
runtimes such as Docker/podman/runc as well as bwrap itself)
when user namespaces are enabled, and the outer container manager
allows it (Docker's default seccomp policy doesn't).
* This is useful for testing scenarios; for example a project
uses Kubernetes for its CI, but inside build the project wants to run
each unit test in their own pid namespace, without going out
and creating a new pod for every single unit test.
* Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
and we want to support running rpm-ostree inside a container as well.
* Another feature is bwrap now supports -- to terminate argument
parsing. To detect availablity of this, you could parse bwrap --version. - update to version 0.2.1:
* All the demos are included
* bugfixes for the demo files
* There was an issue with mkdir when running bubblewrap on an NFS
filesystem that has been fixed, so flatpak now works on NFS shares.
* Some leaks have been fixed, including a file descriptor leak. - update to version 0.2.0
- bwrap now automatically detects the new
user namespace restrictions in Red Hat Enterprise Linux 7.4:
bubblewrap: check for max_user_namespaces == 0.
- The most notable features are new arguments --as-pid1, and
- -cap-add/--cap-drop. These were added for running systemd (or in general a
"full" init system) inside bubblewrap. But the capability options are also
useful for unprivileged callers to potentially retain capbilities inside the
sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
Conversely, privileged callers (uid 0) can conversely drop capabilities (without
user namespaces). Contributed by Giuseppe Scrivano.
- With --dev, add /dev/fd and /dev/core symlinks
which should improve compatibility with older software. - add group - fix build macro with rpm < 4.12 (non-Factory currently) - update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes - upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
This release backs out the change in 0.1.6 which unconditionally
called setsid() in order to fix a security issue with TIOCSTI, aka
CVE-2017-522. That change caused some behavioural issues that are
hard to work with in some cases. For instance, it makes shell job
control not work for the bwrap command.
Instead there is now a new option --new-session which works like
0.1.6. It is recommended that you use this if possible, but if not we
recommended that you neutralize this some other way, for instance
using SECCOMP, which is what flatpak does:
https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
In order to make it easy to create maximally safe sandboxes we have
also added a new commandline switch called --unshare-all. It unshares
all possible namespaces and is currently equivalent with:
- -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
- -unshare-uts --unshare-cgroup-try
However, the intent is that as new namespaces are added to the kernel they will
be added to this list. Additionally, if --share-net is specified the network
namespace is not unshared.
This release also has some bugfixes:
bwrap reaps (unexpected) children that are inherited from the
parent, something which can happen if bwrap is part of a shell
pipeline.
bwrap clears the capability bounding set. The permitted
capabilities was already empty, and use of PR_NO_NEW_PRIVS should
make it impossible to increase the capabilities, but more
layers of protection is better.
The seccomp filter is now installed at the very end of bwrap, which
means the requirement of the filter is minimal. Any bwrap seccomp
filter must at least allow: execve, waitpid and write
Alexander Larsson (7):
Handle inherited children dying
Clear capability bounding set
Make the call to setsid() optional, with --new-session
demos/bubblewrap-shell.sh: Unshare all namespaces
Call setsid() and setexeccon() befor forking the init monitor
Install seccomp filter at the very end
Bump version to 0.1.7
Colin Walters (6):
Release 0.1.6
man: Correct namespace user -> mount
demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
Release 0.1.6
ci: Combine ASAN and UBSAN
Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
far from the only program that has this issue, and I think the best fix is
probably in the kernel to support disabling this ioctl.
Programs can also work around this by calling setsid() on their own in an exec
handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
This is a bugfix release, here are the major changes:
Running bubblewrap as root now works again
Various fixes for the testsuite
Use same default compiler warnings as ostree
Handle errors resolving symlinks during bind mounts
Alexander Larsson (2):
bind-mount: Check for errors in realpath()
Bump version to 0.1.5
Colin Walters (6):
Don't call capset() unless we need to
Only --unshare-user automatically if we're not root
ci: Modernize a bit, add f25-ubsan
README.md: Update with better one liner and more information
utils: Add __attribute__((printf)) to die()
build: Sync default warning -> error set from ostree
Simon McVittie (4):
test-run: be a bash script
test-run: don't assume we are uid 1000
Adapt tests so they can be run against installed binaries
Fix incorrect nesting of backticks when finding a FUSE mount - upgrade to upstream version 0.1.4
- Build also for Leap 42.2 - New upstream version - Update to 0.1.2 - Trivial fixes in packaging - Initial package ibs-power9-13 1674763271
0.7.0-150500.1.1 0.7.0-150500.1.1 bwrap bash-completion completions bwrap bubblewrap README.md demos bubblewrap-shell.sh flatpak-run.sh flatpak.bpf userns-block-fd.py bubblewrap COPYING bwrap.1.gz /usr/bin/ /usr/share/ /usr/share/bash-completion/ /usr/share/bash-completion/completions/ /usr/share/doc/packages/ /usr/share/doc/packages/bubblewrap/ /usr/share/doc/packages/bubblewrap/demos/ /usr/share/licenses/ /usr/share/licenses/bubblewrap/ /usr/share/man/man1/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:SLE-15-SP5:GA/standard/cec62e13d095ee152e473a00b5338661-bubblewrap cpio xz 5 ppc64le-suse-linux ELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, interpreter /lib64/ld64.so.2, BuildID[sha1]=69c811ce3b57cdde85baa08656b6ed903a75b386, for GNU/Linux 3.10.0, stripped directory ASCII text ASCII text, with very long lines Bourne-Again shell script, ASCII text executable Python script, ASCII text executable troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix) R R R R R {2m vwȂ˞h utf-8 01ab147a8a762de3f07cccb27069c1a3abca3e2f91c56600cb8ccc7457f14c4a ? 7zXZ
! t/{]
crv9w ^W#LQuBa# 3 9-|"0z3=m\ɺ4 ROsV0 ,mos@8W!}hV YʰYby[|O·kU _FL:z߳)
_
ާe0FO$٠:47|Qo"Q#+_]!э]mKUx>f.JȋʁAط9\e(G[ < .n~ N(id)O>gtÏ
ճ:;r&4t5o: &P̲Wv9Rpv?I^=:vLX?u>&KMЌWLug>aZμ4Go"~`6Q"M1NB_=ڍ\-e}B 9oxW5 ߸GEyf 6ox a8w =%%>0T}^3ht]ɼSkWKA =SfA =) QE`やi}dDy xm8&x(˘ojrmPMs1H
(v^"ԯ j%~(3+횖)|ʩK|AhA(Z\ N~z , VpO=Ρ
~{TBM}o\Bnd{s <$oz,b"S2)/ `p=p ǚnHXsGƙx5͋qW7a LC]&{ќ͐]*028+W6bܫ1g=b1xJţzk&8GI3S
Z*X*w=E֕l
B3wb!vN\ 'ЈNyBW"pE k q]t^_6W'WS łtQN-UR K |<:,8)%)d
9*KR_7$_xVKm#BP?cbqZG4_,~KэDu_<V rm d
9:ijƴHFρyC1QChgyU J=UOR5.6I']p2O|Mf,F4U?n]+c%?OaA)-)CۙGyHg EǩXB_2^ װX$c,Co=FJd)V:bq8$SH~)roqN ܅证A7$ er
1%hH Fg%̣@V
^?J#m'j|mnfCrgA$o-^JFYS m-40Yj$}egMi.XIfI'j!"MwH!g
S*δxZ\W ֓5(
| E}_QL+6δ=v>9iEneK ]{d8X|Hvh@0jckE\zb اk<(cnx uQ7IH/Nc|ʋyjtEiV`tB?ż8+vH'⭏Qy0&JYF
g6 wR,JLmȸ 1"H2[^fNXM_hf[JQwR;?ŔEb@8c+[
{2IxA\Q7EJ6t`OŸ7*ĚJ#0}G:E '']"]
;?1Ŏy@3]vja^(6V
x9.T*8W&>5c\ .qAdMQ@d آ+ǥlK[hY}6?8{x=ȵz վ>80vX#lv 37 x}F8pIaf+"
6~,`̏#|Uso?Twv$:
dE!vZ9
R OA|cx=F14&N6vTJ8H_I
TL[S9}ܧ4_гHeb!sgatؤub6l_ܣH48
3_d[#H$bc`t'4[v3 N_z zuz0r/pC)gS6)g5En!гuTUzl(,!~ ? iY쌉 WEo x4_Mh?kH \ol`qvj
p_78_[(i'_(ARh6?.9r&#>`U@n ,POONk?6bs ^/RfG8enRY7du>Udlo4 \l&'o/\mq߹f} w:)|~օWIReхb?W`an'ȖYu+`%0 t^{ΰHO/]. >I͐ϖBN;2A%AE|Eml$].
a[ʿ G~~!)Wzѕފ>a GG
)Gs~!d}w2m} (#q
@"$ ݭgY$KsK*-Pj|/`ADW
i
C-Td{îV=63 rlFU@Sfu1E7
s
9*ƌE)+V Jyr ;
Y^ +0QA*HFٶTV R
N ЇJ5ɿ kN閇7Ok~}[~zV%ʓ7a`?FhCa'Xj1I
d$wѫ%ZFC2rL i ,o7(_u1 7;dH=Т~ȷPdxw xCwd(|^ݔ ر&ѫgA ]
ZU#J1/oUZ1]L:NBZQd`
$y>`MN̹zTS5*{Ni([QNL8t~[f=6y B^# N[p+ 88(A %|+
fb Z[QSd[@rWMSW~:w4 坸Y|` H S4],n\돏 iBr 9b@[nwܓX?JKԦB|Ԙ d;0-
p9*yrp I`u fYQ#r=< m˚^ۢ gf`|RuNg Ȓ"DkRe |{"M~'H DUq:E"o
C * 1;rxU$`H[Rb ejv# f8vU 7a],`rʤ - QߧK^)CRI, ${1-,#tܭBqQ e¢w'$LVo'ؽEΐ;a*d)H |ܮ)Us']&?3:+ת'S 9j={KEmXflfBi<?6 {l <8<
^f~`r֥I٣VJ tmhglL_} &E":e^lkh|bW-jOi(sXƩu&~)RWdKMOKley} !~0,kG}e>u"
?ﺑ 89tOp#"MBB=%SKSl^Q
3SBiGy2F 䝬nrֵ^DHXj!%DTOϨ8r5m25=Qfqkx [d P- Q{ǒA '7j0ݜDT0wM aX#@fb_Fw #yH[7=P@x$1"Ƃs0F{(D&!AUd{g$wݓ۶Puu1_4'\ˑ_W81 yG7!MyKt㭥$~)Y#ye npW1?" 52rdĝ![uU+TTO3n`ᱧ*NfW=H@%.TG-[TCvcl T$\܀%"d0tjM^NzUDfT]+gA%Άӗ:BAekzG3hYmZA^;UFfе#QÈπ2Hԥ+{S
zݺΗ) JB ` Ҩ: d7
G^ f4M] %?m%#G``N5~Ta Î|OKhPx!bJ-G
\?X ݛarB
> K~dRϿ (t NlѴU$mv'[yl{]m2[JP-
"0jJi -j2c 5D Z-f 5#q1o^B[t@ S CZ 6E$rGoA.w4fWe|
@CpYi_dQRQ2tsPo>fdWMB)xېz⺍b0J/
=V"2ł%w{sL e0Ry,_uH9]Ʊ=.
jMOA$bcǯV>K!Irvlr9?xVr +4fT iTS&_]Z
aw1
W1sIB#IiI O&w MflתHƓmѕ'rizzMl= a_G=H<qM(z *%N,b*h %"m7}T]|/c{Y6HԗV "F1 e#i\QfԷ7[UWOO'z.ۅO3 #+&O.扯DACj+7{ b !@Ҟ6[H Aݒ U 2Aj4T C3N:|#?"}e ,˷_Vx#+X2t23{_ VS|f7XpQ!~LG \S
"tQ^e8j #Y#T #ʩ b*%֥FҖ6~_9&Tc5y;gVMTvv*j/t#lqX5-0?|#}Z{ҜpHn$P,C ;NQyC>=pgsKk!lTkV4h^j~G Ɗ"'1'k}G:&Ƶ<͕rr)[zj3 YwsאԀ.[/.&@Yd"dPz5IS:CLXA#H\ekڄpahsZ(awf IgH#s߽ӛUci"ubG %2#>R;Յu> Cf}gQf,wSX 2y / 9>LC;}- +`' | \$x6ֲ3jWuEx,Cc1QLT'X5aaԟ(K^pо_h>84
oxS'r/{,*ՍOZ@Z fIC!U#P2t2Tt <*+sY3rXk2db.6@\:1Fmk4'1ׯR 9Ѯi0 OW;|}Fb\!%D(jEZ#[" ;ZRJ`}(VoD}Wt3ry1 ߸KGʖ"n8T7okwHVY`O &:Drx
Ě$HlB{/at"
UA ޥWIok ?r|_
u3QQ_$t~)Viˠkf ! EgyyF"1s'2smGmPZir*VR<&ʋQ)R6iFs
>HM ",INv-D 6m]wY=r4~bdd.8 `nЕʫ<cF3Ygpu&
+IWLTGӉ цʤ$7g>}_= L*eY CkaL#Mx 3zg
,/ޤdSD/.ݱ#.:2/SaVM9zҦ߹ `ŚŁ=&^<kӍz_§ )g*ߙl[o搒=! uABT E!%4˽Cjz
'Yx%, NW>wx[Jw[3f{WDdŐ)^i Dzq(C^l4*-Q|V}pgK6n+t-CPDT~@J.^wOؕ 1ÄYFtbvhاmI8 蒸Syz11wz"z#ǟ0`k hav
E;B;F=g)4*8"9A7 7ЯB#IJ6q 169w]Cvdz] S]_
7G$vg"fX}[ twCujq
7' h! 9Vg&lyޫX ,4{X:!Yramϯk/ܩ\A[swiߡ)E ym{f
B;ǟw'͠%5K*>
L6Gi Py*A2ClyH /qsvW܄窚*n*L֙y,P A~uO~RK[& wXR'{lwJׇ@{" ~vfN@m6TΎ $ HMQ"F\BR1uC؎h0eԊEeͼċ<5T}[hM4 =1+80"Gy.[_[ng8ɾs*A*Xɼ믄 ܍ cPevz?+ X!glf\C8ZK0pYpt0~qWeN F*N0jء`e^s
fX.sO |+9HWk0xEmXMdn F/e !$WŽ
Gwa $Z7[/R\} jQ s<
JŴ؛-N Vp:|<
^BcuF&#ra8!`ξ
vOvgZBfneGU%` u
Ǽi}Ol4|Wk2n}`{eo炅 ŭfȍ_ו@GRL/8kT?9GM]Ҙq#Rh5MUH }7M݂ ɲǢ~Cvt9=Ջ^s'0s!ssHq"TQ\(~N eoqlJ&|o] "CO
TSc_ [CBܪ\g
OGIh!
hIBUxV#VOwM5zPeYgi`#9 e|ے煯[+BM3h%g
Si(M:Zњ%z{F
F×rY47 U=vv_ivn$8
1/B0.a iRݿ=V,+*GmAظ7G3 Ows=PHKM/v5Y(CFqD`KpOQǂ O9 3>Ya"ViN} e L>o,]c7m"}kk_n%x\@d9CQ$SEQwPqu-~=Ml
ŴfZ9q`&ּn<% D>jLf_DުF܊ e<|I&$aЛJ1KE(()_j1$a#H]{7u{ȓX 9ۂRBa<]Jk8"(m,tǔ[L^/i|8k5K%& o*c]Yv atڇSVNk<%3Mq:
iƶwfK7@h$*FȺCNa@ [:ݷ"ܛz(\ %Y`;vHsrHbF0xU$gZ-tLz"/۞k2<| b;yDSi",<ήȹwNgTSqCr?SEI˕oߣm6{@9\C"r9~XF(s8aG*vڕgkΧKW`Pj!V Y0Rh\|ʙ ǟ; Pw$a0 $ͺy +ͅ
Midei IzhSAqbˉpvJ;55fCarj
goēPY}낅:KpǕ_:PĢt
v8,&tdQaB%yo4w* b E|G3PwƦ$aYӝE9-w6>^"ؖP)CW^#9d퇠2SP34Rܩ%WmG 29VRKKA0?ńx [jm5)n9oϊ60?KWº?pLxVARvb]!]QP ZlgNe XW'wWH
X7p(;^RX)UYgbvup}q jct'bHhf?{<l.>_ \4ؿץL>2 [OY/t1h* ǩl/} ql^ho1lpsz.%YP'Lk7y\hE>^;n e#Jܛ@5I-cBU
4W'y.q bp ;hcX(| W՝Uhc$,/Z% Nr 3\PsS.48 6YZ='ҹ֟SA {oI+q*:]g N4Gܴ/ҁQC3H
`EI ٙV`W a<} ䷗~w'a/Oj|baY}d1(LsEId8 NI%mgzvrOK |
7Kɵ jڽ]fgAԶQ4#HɸЌo
؊;( ˊWLo kUj!D2%NWae=` HtеXO@~ٵZ=%dd^,u'YEc'
^]Qv:O)$#A^hky9$TK+ s#?VҾ>B_OPH<l2C,CkC8%yKmBRR
5 oveVM *QyF#x. 3Y8~|Q'3&&M!Ao&[J+Iu`6 >YH[s~Q`Bށ H2we`tEjs#+СH=ؒoH4{<}2sG&w g v J^ʁQ7MgjK]\k M|ZۦQYr`QWtWˋCװ49Ŧ!57RW]--wOݼr굌gyB8@2v@V]
Ete` iQT1ÈT" +:G"=gf$|+nPk?N1HE}X/{ f1Q:,A+3۱{z@GzGh8~ !3ChJd+.9hZ͒C42e :h\@G||yaCP`r)\QqccI,XCOAS0y5UBl= * Ǝ{r\2gp~c>-QQf2vQ OY%w-Q^}(N4dF[iRȳ$X[5dVt2Bvti9He:oq3V~,.
`Uyq 7q(vR b2llCĴn:s>ym?Pe1(U d2 1BaEduG6dW7 5/.c
\>SXxhc:))4-'+k̐K +\/] ~; {3ܘwɉ! yZ[Q$SVʿ|ɨ?4ձY|RȒL¦ w WĬC{o1s sPv 6Tepd-r$;ػ[R1Gݱ'=g3Ԇ(
WJݑUR|i"*Nq"
j$ Qi0A90kE 5@ xlX;/ 2Sy4UrIНx-k1(lʥwKOQ6(l*QVRF^)Ki>Ӳ#r,6x2|5~ATL^^!0Mdv7 a>S%V6*81˖,/6ԇ_>DdN8R/lsmW#>G>
5M~ x$o
[/H\+mЃ@sjJ=7#6#8V4 hUIQ$8$/BH G_ǑG>23CZ<4 J9ѯV&q)jF(fջloQow8 L]/P ʎ?ݙH diNVn}j>?AA
MSZ(-["w&79>I:Sj5w27k:j0bzzxN.,tvQ$&{.+y^zWSɼ84V{:FVLu!ΑûOy20+;:p&l+{'SqRvAYg=te0|(Gp~_' ~+ìqg34dDelhHp,-鼺l OHs^Nbx9ބ?:ܘ ; ,#y- xDLtq0`ֶn60wym |̅wpѳd _ch|p@<56f!Lj
h=an j7t$+Ԋ~bƃ=;>wU^~""i6~)77ZoB1K/(({s!z"K$QT~P߬
ܻ3F*#Q#|~q|cls%vo^Zg-k)l ʾa f dʈ{}
p#34"i Cc|yS\pY>
eyHDLA7[܁<ꉠTU{wdVyT__ΜZӜ]_w Fg+?e>Q (%F__m=@"Uq/ĈT
ea'mG`{xa Si-xYj" %7f(nȡ.̗ݲ/ RS> :X_ 2=&* į{|[lߘje@Qh
مX#?3e E*\τuP%۷d%7gdM)aב g@kW$ZyQ^IHz O;zWx 98l6\@nFk}VM*%hH O` `L
@Q0ќ!d.}^+r] T KyYj:@x=)V߷=8{-Bζѩq? 'vΫk{C0\ݕ{/:J\G}в67j2V< ˚?uSf?/Ls(?1hsܟ#PDy5YְW\c[oOr3 3Z/ ѯP #^y*gֶq4Ld4#9
ڹʡ-T 1 \5];8XS4mXS<-?LЬ-%&Iq^Ըd9B҃ 0 a
aTcvax(՛H
HJ/ ~UBYڝQ7%o yIz T0@ 1-e7zz> By6" ~SnGW͒*(
EP`,۪l[Є7{n$fD}x|q GDV\{'m5+ɥT:IzO LX6
uqμ|B=5x̦l^SsȕHI,^ԧYDwaw䈘_-Mʻ i%"-CfvXMpH.&Nm=B:SI0(p\
q8s%ۙwO&]XAc[ .Gin>#ZRW0ktM0X!JENt{,jp>(ZӪE]pW{;V%o
인3Ok~)H{[^`ysaY>%ņS%@ $9JUp:a So);P wp듮(7i"!uG M7Μd]Vۺr! W;`aEi`4w'/WW UUYS[߂U*&
M"ӑӍs-ވGw7g2˖[9h`O<+8KMw)b
*LFTKeN`_勰@O51nJ~3^DH@#,I'h!.MgiwdMn `9%>3Ku OhVLj[}%ѓA;,?FS}wj"Џ
x}N;=V7N:7NF/.#$\ēo;>ȷKwc /ۓ]}`>iAUH]NZ #TM`p
ߓtZhÃSĂCle P01%kI $`3?J~gY \LKW&Fn;jL!= Z(_"ߨV9
-
JԻ?v* tǒ^2tS{yCrRгu@j7xSicX':3 ژ!C@U:%b$sHjD
J/`?LWy)7ԗu%,A~KM&<UKdhf,BbxqFه%UEXI
Z`3fD ŋ>yr&I>; ]'Zt AoV3Є(3 ;=.4aNY y j/q*)xŤ~$~Ŝ1π?y0
Gr ߶vDj6 ;
(}!O@вzu(&26WPV%c'vUVr6s̷$d7}tZ,uJ+G
>X56G i-cIU]83d';0-xpIK ]YvEJYdL|&2i5a|b:0D / BH*ɪ wr;0_)+m{}g[RbT.buE,o7h| R8k4/0YŷIh.Bm
6I95.#ܧT{m6 Uז;Yc1e\h2XPcqۤ]C^/!m!t\"m eu{Ӫ ӥ l} D ʵ "c|Κ!^Paώ#G@Hz2\ ;X5A8YK3sȆVuha̫cHS?Pǻq Ԯ+P_rQǶS~?=6 ;^Ul_y)yཾIAF>ȲNuLWqz["y [j*gz{
y<ͭ/Wm̅q:WMb&u(m :Ldc(,M4gˌ}8W A~cT bcsoxA9C*"i6ز}e=n5F +qS~,Ol voAM\/;fAM\o&: -ed=ݔ G 7-1
3 ٠쩖-M;yTMTBrn!
Ezx$ 8PUc'O)l:VBopdEPF'J<(""GYk bsXb ;g"` m2.r;* BHSsQ'9A?Wo[ir:TO<J,3
:ɔ7uoVAȜJJ,Qn>T
FBVVUWq\
/V g*y'4X! ne6
$r+``㐲v
VfηF?VţPHRDEi0z{ȭvNjg=
D;E8 `4H6WI/ gA㎵YH6 K/k &Z TfM}x(t1,;'aNko[cq\rq7oF @1ia&XHVxA"2("D2XMk8(42L*5ց k^C>` j'_wv2
EV`۴_/ =FmeGPpXM3%c?X\YfI!0,ط} ЎU]?|r6Eb^leQm\R\z lsE~ҶL "j>%Rv:k]\:K-Dj_&;r'pȟdrʎΚč mQ銄8lEkytq>g=L
:!8+09\dIOTP}ӃEhV*۞,kE`Hr(zٟCXrDx RN1?$6W mR1ƹChU黒u$ڻ,|~xTX (FAv ^">QS~ zbM") [mZ؋۩pT&~)\RqjCZQCZMF'VQAAaLwbkrY? wm??в16zcg̴ǟȰ _BT!pPE85jߘ9-|$ɳl$#d4ԑϠ9\L08 ~<3$Ir{
*3 M \m=}RH *@&-khY 7,UCYp\4<ؼbyzke{a rzYqө O8C
}䒪wOB;(Pj m{ɰuHgTW9g-B\*]><54.?Q2'JP; [:}_
"Ҩ{aj\ڂ#ȡtDv0S/hf Ԍ]Ԍkqe%VO_@A31x ux!~gGMr O7bwPUi!QkzϏ`$1vz513JDf: `ٵkǵYK:2>жZƍi]Y{s1͑=R@ WP@̾9{l_ {K%2+ iFkn42J<
ݞl}K7$Yk>>략A0WT Iɖ_֟jQ)6vՔqpїHJQ'+ؓ :Ԡ."/
{n*?=j# oG!] u z
UtSm8<:>GKOz$̻N;,= 6o
b>/u$u]Ps@ fǽRO(' i~H$#zHJ1S& E s xPU-` Ի8aeUynbJ g#x b5JU}.cˇ~S,+s1+*_^.
PAЬ=|?X%67\V⩇~ХKbL S*
F!Hz:Ϗl9&ɨom]P߱sT 3>ԭ |s8 in8x/vT3\XN1ԮLH ۪rl.b%=8AڧI\ g]uRjj>D] 8 빌#X^H %Z[aʦ)="+g5g\ T
'sR~;p ^^ 4GCW;]*Ր-B3T\QZw]iG쓒[*@9 4r!]:u6 K[>wH4J g~ܿemH
!ՇBH(H~8k|q6/lA٦{=>G< =*^UX 7K 2L=#t^|`轥6C2-=s5BoQPV S[bMu'I!q}B#p^&:-V k*33M2
yu[f|(!'CbzeB# yfH̭%wlD0ʐØ Eh)FdCt(F/[-b Ϡ ɽq*o 7.,gբ1"{~buJH Gv= v͘^Z&Xm+iGr-cxY ӑxAted5%I=Aes .ի~ u[+ &3%9bvMcRbOD ۮ[PFpηf:^kR4vy''ev"ܹN(\kljurl77r<6b 6ѽ܍uVv J:S,Q5~wB] V,v!QI? ?ߨqHV~!-1p=宻7g\Wh۬'8R>\n FS3Xr
=߂ |Po $QdDaahxe뮚¨3N(1k;S
٦tDˀl,qF8Ї~<zS@ H eY-<-iO=.@cajs&$p/\ɒAl'1oX4 ikJExmyߊ zOgN_MW?5Rv| fP 4OZcɕƙOv1$P Q+4}7,9`CGLZ߾!:F m]^\
7(WHkGx$ <f: gg ͫ/.R^Jſi DplVuZY I}kl3dw\AAȃ ,z20c
|>Jt0TUJ t-DDwA+ ;AVE ?`
aw噚ӽOlX`緃w3 0"\i8RSw!дz=z ?т $M#ELF?PST<>rFpkK{#Q@T4Uæe6y6@%)6\mF&M@,ǺT hTEa*j˿s B43Y
M d ]sfU⺉b>`XG
(m7-u=DM]$a] $QVJ5 !"[|C7@ ;Zae"4ȨUJMļ(x6ۤn5(D"y7]"=+mp
](sBW.m#a`~;K BMr Wqik^mȖ&mM~}#Ԧ;5
5nW_/$%J 39
C5fDVb.-l-xSZ]}W'HkvHn Y s&0QpjXhs*ې -Kx*HT42AnO0:_Xlbeyc| pV !k8::ODXɂ7۸Đ7\0DLCN@bm# -%Dپ w& `}B5
-VOU*o3Dޠ a^}R61%ŠC矎7(uˈ{8wq-[p7@P1%>'/: c M{lQIhoͺQyG#: raBтS=egM/l-tqU=[>CqR_O,$̈vR (DHu11"5H1n{:IE?6UbŜh_QjkqYp] iCPD *3*yj4o2t-)(Y^F
yU| A dS|qǻOfhRxnnJI^DfVbsr>bM[V<.NflG(l_ƿU # W%lypDhy/^Gle8khIL# j=tq-SC*_
̫ O# T}e fz̫=! `V?KůlO[%
. _+_3`ZmB }> P%t 'x Bnf$BzP,q+=^{3yo;Jbi?O/jGpe
ӂϭ;buCjqеbM,f%FczϤLD =P~ꩧ<~દcIw)5#0ӓ=ⶼfnD )wq
t!LOpA S PJVUcmdnV|TiʜHu %O,W3s'rt|TjLݦ+ # ۤ,Ot%˧W;,xO(>ىbe)qꔺkFJn*=2ԧ' fH)Td3OF>&[,xB][S ' )a=id fGf\>S d~
$lS}q-x ZFyqm r8~kI DyV#I8g܋"ueSw8uax|f'x[ :vpʩ92pK,Nƅ# 6R@^M߰7DljRYI 9;E )#O
+B3gFw3`hf? \zJG~F#>Nv-UnCA/1"9::xg X* ƩP/UUrP>"Qծ=xF-Q{CHP 7CJ ze^cI\&6Ps`_#/}Z:1ͬ{iØ"|)Mm
G1_1A LBi&<н'SM=֨˭b;obInw^0[8 T$bBؖglEU< sG +QJ
%Sk'OR]9nU!e0)gmgyZ%^g>0CA ¶|M`Sr n qlP
zΉ|Yȇ{Oʣ
~8!R9^Ez8PU',a\i1X7ZcFE4,{~HBr8 F*6" [&fKM˞w''Q[|qZlhw ~&KWH[]"
N/-g6BDe
[-KE7׆:FUm¦5@zV }g.6a IN$_|ҕGVvw< ޣz@!y|oqxt mpft!O23cF
R+LK̵c6)yI{X!5!nLJ2ECe"uU.qW3ny3zD=:FG$[Wѱ
Glq3 _8oR
tXXX8Sl+F G<PӡE9VJG0]yySrR8zkC#3('Vɜ]$EKD ;ճ+@5Sÿh G`Qq)vk1*NqsطhBQ.1=}2GӐb]vbd 9|9ۇ,ٞ 2|:gҢ?
*z^^'2f;o
ۯ@C66@3:4+ 5cJ$3t/I PBAp jW 2BM%i#椖ʠ tZEy~W| 5#G_4 6˩G\"vIvX:3AEDxw9$*v~4ͤՉъ3Q2u!
s霛y,)o`x"-\&L~ 3nQwJpob`NU|-; 1ݮp':m^P'Z+V'2* f
M D;kuꯦB VE
Rh Z eN29E%/yPuirv$Q?TnK77~ǍFO'ZZ+egsKWc^;՚!u*9 +tmS,_Q(g%~7Či~l]в l$:efcEn밖-}CsP(To =UE}`
QxhH^@ʏH٩ _ G PF/ӓVٷTNJWH[;^Gymr| rՕ%{'l@YWز')VwW)Mq&O葑ʙ>%te1ȖCBPd^kJE kcQ6K@@ƇD#sEgb4 Fb E[p͐' ykˠV,AE.V} *U':BGK=pyN nkEA/"=CU MU)tT}HE >CH/ #PBnҊS8
'27_kw\9b i: ik?zmI FꨥWܴG6Wm%:B ᇼy9(fM][߰PG8CWoCT jܮͶ.MEn2$l\-y{)0MR(FB,N)lZOEɼɰ@-m1r۴ YfRΥ"htYl00Ed{~'I ^pEB:x?q3rLL^Z dIq!^@ .Mm# (`,a1枽J@;U374KEI<[h>Q]z`
i2(q&P7| ֘NCI!vY'kHW%15&.S*GI${Z/S쏓 ̂, o uVCM 6/
E3F^zX365vi=Ivd:AG@;-ܿzq,
aЬY:uQ1&z1A2>b^ oJvjǙ+رx?tB˘GZݸ|I g:c:vNX3e,Ѵe4zxANhj^[jmYH-|su}eU+
O/e 'CglĵL?fg>gеG#r&ZR?'@q iTzGt5uC.ϕdTF+gz -Ϸ8odOhY]pf*`x$d`6nTf;4H嚴g ZQMnUBKb;f_0䬃֦/w(ݢ4I T8JL_Qw SMn5˨omX "و|aOCc)ugI IPu 2MơH=ctaGgJ
ݺnsL.Ϟs+F]Sˏ,}d*iD.9cKl,j^$,r3;D:=MQ@/־WZ7mhV)Z/bgQP`3~A B =8D'yg;24S7wM\XEɚ̣Rxnyj*I~IcUBձ!yD9Iמ'W w36Jj` p|h\(G8_hL}7/ #B(ۓkf`L~m1qQiqT[zv#mZ<
c>fK 5HH]!H#q s3g,k0dprU-D(Edy2@kŦu6R)Š
z ĕR&~=67;b[,d
*z7Z86L,]' 7[jç
aQfz}Vz+a^m Yn;Ihekљnr6) Vb=
ET bݸJ9iL
Zɿ9 !v.'`pn}
@ #j[Wpc~L雹τQ>8!ޑP;̵jgo˛k"Ws,a?M8azA$BVA"ϮY'%k"ނ]
ĂA~ eqBuVughhc uf^ݓ+̙x [ Sb̧/XÅ+i8ݼcӛi%vNw@P qV
2h/FvStUv MЉC(O7 Tka}/}a3",cJb}xRPYj*a\d'.. Z!t[؎B
t wݨ:!̄䢠Ȥweqи${oq}!}ơVFTUK
g-GQ6
B2 ZBH3@=->J!"9jz½_vݢ*{<
I.(NYivig~)|(\
n1RpC"ep:˷πK}SƞK*8_ԧrs潗ș6eH- Vk%) N`!) {B~l) z͇ gd~n %r*3 !M^$[YY"+5}$ѺVdHF?q'E=&YGZRrq@Lʟ~la ] cleΎjv1E|6ct&h' OLHfi7ꞿ3`bZvU6t+ V/
eϥ}X E#Y`fUb cwspZK8(qU:- s6>x Fӹ'i"SnMw9Uӊo TFC|nvSHD9Ru2"F˭%}*.;(mafS4ka)&ЏJ/Jm{TM=U +0Ҍf_z O־
qېr %@dU
"ahD%Vƺ 2\oe ~}5L
uG"#84<g\ۤ G9?b׃Wo5`8ngok; Y=zN Bֈ19Nt;ðzK9M [^^gc?b!ILX@>W^+'aW01auO,'dU.yF X9)}"ɓC9Z'/6 +=K"Ӯ >C6L8
]D3/j S>)$ȹ/f}+D}j7S{pC͋! Raiqz_;is}:1Ax"_~A?}_wF; : & >[9/R.qd,`vm[N$ e XT\xĹg O cAS -z =;
4V֡ %v܊u_<3\uJ y5cof^ :$\q&HmNRoO E+UEo XtDo0$9e|MvAx-[0.QӲv2;GjBp3씺zf_g)#`;L4 ڶ~+4,*8Un$=!( }%1>7[$ ]g(m仢agU? t-ب+24NNJF$21=Zo#(.?^9*4"Lb̊Y^Q 2 &&V[ Lמa9Fk=#& Qd QT^QB Kp%Q =5[1u/%) hE*Lmi7&2 ,OVp<1\3A{)BW^dY\b([w>a-|y2aw?hӑ
j!r "R ;~O zrw!uNPL" `]ݐmX
WFsha
$ߝ#N
ZD*f QZٍE'
$eU&~qag-@Rg-o `ֻX= xuf.xOetLI
닽?hE
\VͲ 3Ā9l 3v7Ɂᶘ:WsHLySNm- ޮ[㊇uyN1p2rP eitLܷn/nF;qIGCY榷
8\Y( >*?Gvwb^2ʮ-4v9A7ܯ;; bŷ}dg ?ޡp8듘q1FZ mxHϟOۍ$\a<~Qbw(lضp?@/[*yTNgz%ISkwIiFKd
n ϕM6XSetnn
AA7e"pKx[ 2
_td Y7NnKPXB ʓ|/h>:W
1E8f:jN)$_3FԪ
WUb@,QxRjj43$i=;d9!M KϫOjUpn~H;Mף,O?E+:Pa'l{W>-݁> =dvdRb (s&g'oÐuݨ|ZL3[Y
B;t0UA:s#^qkmznG,FW"9Q(F."Q6@;g1MSB'Z%(,-N V+f >*X
VjǿbRu&ob) o?*۳R6SqM72lUKN x8mAZa#,;-v3=B#y
J>πkvB Ҋ彽[SE 7M?C3Dq4x%b7@#ܿEcY5Tt
"?b;*grFUJ z1 \yٷ
p]z%`&kʇ<}r4Ý_$yֶ8}y*P#7U ԼؗSWk=1cK BEsd ˘FQ}s=sR^ O ō \DrA[A q۶t E+IT §9?C:jW|NLbȁ bJ
|q diY HJ]u
1*M}c3B
9l| ieVH( W#9g=
V)w(Fg.3&HBuZ\LxWDsc&-fi}I Y<#N Rpc#[zb[ 58J>>6;pRf6jBu:|iYI{Q
Fw}BhҴ5&W_Σ뒯=ڧoRd
wcκHkE#Ѕ]PTfў-5uh̨k}7hH/ 1TgI$iz`#R}tF4p'$Rq\YܢN Q}K!9+{@v%_Myfh҄@G@s*)ofmt`d38"ubl=9T-nR.Q>ՈO8Nx9}?sjR,U}@mfeRh7[6
k> 9ݷ4QFW R 4o)3 ^ɤ(] ~Mk2'pɎ^4 [2Bق2DQR%@!-? +{_^F@x@ja4Z pF"OR~H>QR d!ja͑kKKF,"VH
TAד̧~Yo6>$dXlK 8W#+g_~ A\'ѿLPf9g_eSK84&Ob:cLj KX4mH_9c@15h~ioc>{a
yDaK>iWT8 ?;״랞ҧ_z% $8u ShP,*X
xqZzgp8{g"5{ `x
D b*,=3^! 1Vy13BVwGo3?[ 34߮H#ܚh} 텱}(ԞHo([`;n3l4Bq I~ f:jЦ5 @bϥav = g;^aT 1ְ<+;BmPG":J}-n<w=ܒW0Q:1K){(*f>=mM;RQ3vrt=+شEy6Wь+Vl@
@$B/҇n|U5mfMaOxlt琶 oS 0;'BsТta"jX(}Dp|-k o!> vSOzGF iϣ4szC!Z>ר`LFHv/`4hx~8nPsWQeClyuZg3SEp/JFr݈/`[މyZ`ʙ7u!\.]gSEl~qtff]ڟ;|R5e< Mzپg^)_V'A ]_dA1R
;yќto$@1xrceT^S(BPAēMȦ|KE#e (8
:cQ1 z<Ӿ< tEfdwfܧ dD j~Qp{BFYAyngJ*< xM ,Yq݉Dy5>Z C;KhY=۸HQ7iw%\s~ }CaIPI$l&qFvI|XPVaG
z2" W=> )(99T9s+PYUCgsP :m\F'EVʈǪGDBԖLf])
͈U 8a a2Y0?G"AO}Ƿqqͪ:Fvkۤ2r%h 3yH9e]7_\%=Q, P3{ܥ.U -3Ē`".:T|`S{/5i6cL+@ЅN42ӊnQ6k $zR15r%&x}D&Տ˶͟x[5%4{D J
U8v,Ȣ&ZR n [S.B1zI28+WYI$A*@k(6_R _yє
i&qlj>'9fzVWg&teXk 7tˋHT0[ 3:.ʯ * ʔJ *D0Ŀy տ8Ef%@QRHLǠӔhp}f{(9B7f5G" 5(8ɥ'nG`n&l.@_Wy;Ewj7}yV:iH AՖ$'=ͬjߖ`҆R~?$l\Ԓ\ BڠҒ9 $[BNW6T5 \P}jAۊ3 &vO"뤋( :*J@@Ji0ay¤煟ᓜ? =#HU)A>p=K0NE:ԯj<͂\8vgÅ+T嗚rNjtp:`J̎cR%y(Z.|&"Tel:&r@
zOu-
~VǮOwa? W@a2ƹ[/F DZRTPAְV4pG}
弼^0E &4XMM\ABъ/ͨ(L hݻ]x;é=xx5Ov~h-K& ퟰ/L{+Cq4Y0rŰ$yb|b^mB|mޘSvaI-I^BFmFuXȱ˼Y҉tRp;сl 9녿Ay NH+U=πs|$TAgcYf50A#fBNl,BTX Ї;$Ĥ z4hǬW WHbܓuS8F#1Al/2iJ^ .A`Hꬿ_ZY%uo}}}SCM ;IEx֠Kl I E fza! @w֠I"}1k$'ౖ +Z>(/%sM8N3M;iΪ@y -T'̿,Nw
(!OH\/
D&SZ ,.ؔl n\O%3LZ/K\oDpyEԈVǺ_Ki
Rud 1lM3C *@B#l}mZW.Ińm ul1沁+>
~k{n%4 p wEvEn G)TM٥Hi*Ro ~H
Xny Hmۅ`cJ߸@/'UK\= ^,?!:=X |qcC4H$cCs/琲*
-XCZbM'7Eꦎں/hQ Eeʹ
{xۼ\&>C<0z{$[`9JGoP~, ^\BNQ1wq3lz;.(⏓:@rU]c/RXrp 6{wضuvXc $E7/7ECxFf$jForR_3QpBY:
j ^ (qk+oVy;D߷x 羂j CD"Lz&Sc&{aze22 EkeJ2fy#ۥ9Z T5̬".m1*4
( =ViE>h l)3{'-Sb"
%Z.'{}UN&VD uNG{2X98S^Hl`mEqĢZ*j_0ǻ 6\0>24h=3.I%^RP7"\68 I"F"*{[oȬ_!!KBIV ξ
Rn$>_r_ e @yg;
l 9{ RNN{s_0ߝ6x;=PaAl#mdtTg;aӸNك@A_+;52C3EEHuDz -7[H9A&ǁ"~Úux !f tV6툌 ݩ, 8'_&;?#4T:½ƶz(HPT%xٳqG xB6Rb{ g_?[vU9@89':4W(b Aah%I@rm&.9[jG gt4OGrIV?]hT [%|yz/ȰCCȻ4k]RIx\A8
B Ƽ\Oe yL C{*S
R bX_S6Zld,;
XX ^H
4!l2hRS+ ^x8aZ.2 A|[ayzP(ݽ=+ܻx\+|kX DП -cD Yr9| "*Ea|3Aн'أYUw0C*1
2cNdwyzmn`
wZ UD3o.'s^'
FGVS=t`<>j"!.|Y 3zt# 23y x%Se3B``ǣհVG5y KP:|Ԓtb*e\LNvOG`d~dK H=Wcjר|R{?;GF˚pkU
w= UP'x.&埦)z! @43߷F3BYg|]*߄hgQ, 0 *;kSpi8ryhwϐ=DHpÅ;g_O-9a9Q%`rTK `LG Kj+<_ACV_#W˖3+ĸ'M?*z O=d+b
jsar\P=DT
`t &H.LN()ձoJL Fb!VF.y ,hWP2G6|^+Tmcr]ՆF8dMq5ݱ@e1vCNֵ3{W-0 8Hu2u0,ٹmup M!x~'YeУ$S2abv::3Vc
L Nf
ysqs]/1b<B.Ѧ~W)?7l&lwm
EеqsϪ/_v!m ~U5 \,&; .w2WDB>;^A5R$:$؟Ƀªw~eeXo6:*֞,AX[eBG}fk7mNn~"W0 bߖ{ѭ3
[_ɈHQ1ҟqa ,g]:6*'퍷^eM a1k@
Ĭ6։
*c{Arӑ?R2 )IE4L$rƃ~4PM_N9z^z^I /Ѕ$bxk`B7
d Gf-/?M Pr#ùq m"aS'cI.Y49Khтpw@RAW kr?2TdKR%\;GO Lޞp*:У:S{cHlCY`f' o]8JL|*v3AHqZ lLe>8;/8z 'Mkz[{6<8URjjOT aV*~2yY|ḽtyQS+ $ѐxTXPQp2N>u0S @PsIFlDo!2- v0 s&gٖD:%7IT|ԓ>,v(01{> B§N7G7jYҝxkFD6R4D )] ݓCVrnbk4L<Q@VZۅ 44 s^ (k1U9_l9MW yB ۼ' Vikŷ"ku08_>Tâk O`jD ;uE X̞92Uh I
ӫEY+RA a?l {Ee
YZ