dehydrated-0.6.5-lp150.2.3.1<>,y]+/=„PSҔWv /P%8LfGԍKѴƣd'ܞcbو>װͩDȸZGD*NI܎كKP 0D{c}?)_J,m3'ө?`/%w*t`ۺ8 M7ֿq{4_EyczMOޤAL1<ڞHȞekU:8+LO?Od   U $+ V,"" " <" " " ""`"Lt", ( 8 .9!.:%.=Ev>E~?E@EBEFEGE"HF@"IF"XFYFZG$[G(\G0"]G"^Iu bJRcJdKeKfKlKuK"vL4 wM"xN"yO zOO O$O=O@ODOJOCdehydrated0.6.5lp150.2.3.1A client for signing certificates with an ACME serverThis is a client for signing certificates with an ACME server (currently only provided by letsencrypt) implemented as a relatively simple bash-script. It uses the openssl utility for everything related to actually handling keys and certificates, so you need to have that installed. Other dependencies are: curl, sed, grep, mktemp (all found on almost any system, curl being the only exception) Current features: * Signing of a list of domains * Signing of a CSR * Renewal if a certificate is about to expire or SAN (subdomains) changed * Certificate revocation]+build80{openSUSE Leap 15.0openSUSEMIThttp://bugs.opensuse.orgProductivity/Networking/Securityhttps://github.com/lukas2511/dehydratedlinuxnoarchgetent group dehydrated >/dev/null || /usr/sbin/groupadd -r dehydrated getent passwd dehydrated >/dev/null || /usr/sbin/useradd -g dehydrated \ -s /bin/false -r -c "dehydrated" -d /etc/dehydrated dehydrated if [ -d /etc/letsencrypt.sh ]; then mv /etc/letsencrypt.sh /etc/dehydrated; chown -R dehydrated /etc/dehydrated; fi if [ -e /etc/dehydrated/config.sh ]; then mv /etc/dehydrated/config.sh /etc/dehydrated/config; fi test -n "$FIRST_ARG" || FIRST_ARG="$1" # disable migration if initial install under systemd [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$FIRST_ARG" -eq 1 ]; then for service in dehydrated.service dehydrated.timer ; do sysv_service="${service%.*}" touch "/var/lib/systemd/migrated/$sysv_service" || : done else for service in dehydrated.service dehydrated.timer ; do # The tag file might have been left by a preceding # update (see 1059627) rm -f "/run/rpm-dehydrated-update-$service-new-in-upgrade" if [ ! -e "/usr/lib/systemd/system/$service" ]; then touch "/run/rpm-dehydrated-update-$service-new-in-upgrade" fi done for service in dehydrated.service dehydrated.timer ; do sysv_service="${service%.*}" if [ -e /var/lib/systemd/migrated/$sysv_service ]; then continue fi if [ ! -x /usr/sbin/systemd-sysv-convert ]; then continue fi /usr/sbin/systemd-sysv-convert --save $sysv_service || : done fisystemd-tmpfiles --create /usr/lib/tmpfiles.d/dehydrated.conf ||: test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" -a -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -eq 1 ]; then if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl preset dehydrated.service dehydrated.timer || : fi elif [ "$FIRST_ARG" -gt 1 ]; then for service in dehydrated.service dehydrated.timer ; do if [ ! -e "/run/rpm-dehydrated-update-$service-new-in-upgrade" ]; then continue fi rm -f "/run/rpm-dehydrated-update-$service-new-in-upgrade" if [ ! -x /usr/bin/systemctl ]; then continue fi /usr/bin/systemctl preset "$service" || : done for service in dehydrated.service dehydrated.timer ; do sysv_service=${service%.*} if [ -e /var/lib/systemd/migrated/$sysv_service ]; then continue fi if [ ! -x /usr/sbin/systemd-sysv-convert ]; then continue fi /usr/sbin/systemd-sysv-convert --apply $sysv_service || : touch /var/lib/systemd/migrated/$sysv_service || : done fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable dehydrated.service dehydrated.timer || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop dehydrated.service dehydrated.timer ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart dehydrated.service dehydrated.timer ) || : fi else # package uninstall for service in dehydrated.service dehydrated.timer ; do sysv_service="${service%.*}" rm -f "/var/lib/systemd/migrated/$sysv_service" || : done if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi fide=} L  u AAAAA聠A聠A큤A큤A]+]+]+]+]+]+]+]+]+]+]+]+]+]+]+]+]+]I]+]I]I]I]I]I]I]I]I]I]I]I]I]I]+]+1a6a8b6d78625b980f488df4c0a3a802bad21705f5f1f5b406d31fae8ca15bf0ab7f7be38680c113a7e8dcd6302d8ced5346e9b1e1e531f9e592571800f445e9056d34c015de0456d05c833d093b91678b1a8c674d32b171767e8e4710f00f863df2202369447057fee4b389ba52a555a8a654a5d24bf2abfd895734c5b45078a8428de9317af5567ff55b71ece274a1c3fdb5370836c3594aed8077563342ae79e9ad514e9395c69726b4686c926024645978541effec5992148f81a2e71dbf703bf89cee896fe86064ce464d6a5397bde95664618f64778119e4a634fd22dcaa6a7b95435c3f485b9b03cddd26ecec4d947d7495181dfb4fcd07c33cd68c92b4583b7dd07e3e2a08906de38e7e329d41f921ed9dcb6310b3886e013a6b87232d33abd4fc44f73475833ac300fa9873af1b6bcc664430d94577b889360aed583b5c9c4d710b9c9a77ad77697f583dac6f1c578c9aa25bff9f4151b5ab1b7d36276d8f9bed9f8343bcf4f1fc7fc752aed369e1dde28a2565748bf192c1becc126d5a67ac7baeb7e9e4a2589910c9c3eb1c9d4378adfd0b35ac8a2d0ab3446c7e016998e29a3c7f88ce6b63bee1ce9b697e6b2fb7c46dae0c4530f1d8535f35eb5767080cd00f74b4bf41e494bc1425c6c6ce738373d92edcbae70fab844b860ec9036e75738286e7644b94f6730349b43358c641b69085d2a23b55ed79ebf56c6edabf7f8ad1531421ff597a92be6eef789a8a901fc975b2b5ae8d51ed69276d2a02aa7e92401072a100e71426acf8047e9141bb6236ba1e31419ee89dbb7e2f6014651fe5ea3ba125c9b20108152fd0b4ebb505a87995e7d4375f1de3b340e6ac13d1a39cbb4fe06b63d83181bb8a66135ab619aeba4e6347a1612a07996c16a49bd6616f94776fa0dbe68bfdbe13f87d41eacba31d46d111b41251da0eb0845807e1c0eefe2617d1b040c6cd368b3feff1baac27e1fd687fc2c93ddbedb9f679d74b8bdbd3b95b97dfaea32b5148392bff26d3ee7009ab689e2b534bb97d1b6fddd843adda77293cda886a63db66d9c6cba8b91dec1bae7b3687aff2ca3818service@rootdehydrateddehydrateddehydratedrootrootrootrootrootrootdehydratedrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootdehydrateddehydrateddehydrateddehydrateddehydrateddehydrateddehydrateddehydrateddehydrateddehydrateddehydrateddehydratedrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootdehydrated-0.6.5-lp150.2.3.1.src.rpmconfig(dehydrated)dehydratedletsencrypt.sh@     /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/usr/bin/getent/usr/sbin/groupadd/usr/sbin/useraddconfig(dehydrated)coreutilscurlopensslrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)sudosystemdsystemdsystemdsystemd0.6.5-lp150.2.3.13.0.4-14.6.0-14.0-15.2-14.14.1]^@] \GZZ`@ZZ@ZkZ\Z\Y@Y@YYB@YY@Y@YY5Y˒Y@YYYo@YX+X7@X7@X@X@X@X@X@XwoXwoX5X)@X$a@W@WA@Wo@Wo@W@VVyV(@Daniel Molkentin Daniel Molkentin Daniel Molkentin daniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.commrueckert@suse.demrueckert@suse.dedaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel@molkentin.dedaniel@molkentin.dedaniel.molkentin@suse.comdaniel.molkentin@suse.comdaniel.molkentin@suse.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.dedaniel@molkentin.dejengelh@inai.dedaniel@molkentin.dedanimo@owncloud.comdanimo@owncloud.comdanimo@owncloud.comdanimo@owncloud.comdraht@schaltsekun.dedanimo@owncloud.comdanimo@owncloud.comdanimo@owncloud.com- Update to dehydrated 0.6.5 * Fixed broken APIv1 compatibility from last update- Update to dehydrated 0.6.4 * Fetch account ID from Location header instead of account json (bsc#1139408) - Update to dehydrated 0.6.3 * OCSP refresh interval is now configurable * Implemented POST-as-GET * Call exit_hook on errors (with error-message as first parameter) * Initial support for tls-alpn-01 validation * New hook: sync_cert (for syncing certificate files to disk, see example hook description) * Fetch account information after registration to avoid missing account id- Remove RandomizedDelaySec attribute for distros with older systemd (boo#1110697)- Update to dehydrated 0.6.2 * removes 0001-fixed-CA-url-in-example-config.patch * removes 0002-don-t-walk-certificate-chain-for-ACMEv2-certificate-.patch Added * New deploy_ocsp hook * Allow account registration with custom key Changed * Don't walk certificate chain for ACMEv2 (certificate contains chain by default) * Improved documentation on wildcards Fixes * Added workaround for compatibility with filesystem ACLs * Close unwanted external file-descriptors * Fixed JSON parsing on force-renewal (bsc#1091216) * Fixed cleanup of challenge files/dns-entries on validation errors * A few more minor fixes- Don't add intermediate certificates twice when using ACMEv2 (bsc#1085305) * Adds 0002-don-t-walk-certificate-chain-for-ACMEv2-certificate-.patch- Fix issues introduced by 0.6.1 (bsc#1085305) * bring back man page * reflect new endpoint in (commented out) config file section (adds 0001-fixed-CA-url-in-example-config.patch, backported from upstream's master branch)- Updated dehydrated to 0.6.1 (bsc#1084854) * Use new ACME v2 endpoint by default- Updated dehydrated to 0.6.0 (bsc#1084854) Changed * Challenge validation loop has been modified to loop over authorization identifiers instead of altnames (ACMEv2 + wildcard support) * Removed LICENSE parameter from config (terms of service is now acquired directly from the CA directory) Added * Support for ACME v02 (including wildcard certificates!) * New hook: generate_csr (see example hook script for more information) * Calling random hook on startup to make it clear to hook script authors that unknown hooks should just be ignored...- Remove redundant noarch entries. They cause an error in RPM 4.14.- Updated dehydrated to 0.5.0 This removes the following patches and files, which are now part of the upstream package: * 0001-Add-optional-user-and-group-configuration.patch * 0002-use-nullglob-disable-warning-on-empty-CONFIG_D-direc.patch * dehydrated.1: the man page has been adopted by upstream Starting with this version, upstream introduced signed releases, which is now being used for source validation. Upstream changes: Changed * Certificate chain is now cached (CHAINCACHE) * OpenSSL binary path is now configurable (OPENSSL) * Cleanup now also moves revoked certificates Added * New feature for updating contact information (--account) * Allow automatic cleanup on exit (AUTO_CLEANUP) * Initial support for fetching OCSP status to be used for OCSP stapling (OCSP_FETCH) * Certificates can now have aliases to create multiple certificates with identical set of domains (see --alias and domains.txt documentation) * Allow dehydrated to run as specified user (/group). This was already available previously as a patch to this package.- revert accidental change to the service file- actually try to find the real path to bash and don't hardcode /usr/bin/bash- Use /usr/bin/bash directly, rather than via env- Use sudo instead of su to allow for argument handling, also works in all cases when no login shell is assigned to the dehydrated user * updates 0001-Add-optional-user-and-group-configuration.patch- Commands in service files need some escaping after all. Fix ExecStartPost.- In the timer service, execute root post run hooks in ExecStartPost- Fix run of root hooks - Simplify root hook execution, this is also more robust- Remove unused hooks directory - Introduced a directory for custom post-run hooks executed as root, see README.SUSE for details. (not to be confused with the native hooks run as dehyrated user)- Clarify necessity of enabling dehydrated.timer in README.SUSE - Submit to SLE15 as per fate#323377 - Add optional post run hook directory, executed by cron/systemd after dehydrated --cron has run - Remove hook directory intended for packaging other native hooks. Will be approach differently- No longer require nginx or lighttpd for SLE - Never go as far as to require acmeresponder, it might not be available - Drop -update from dehydrated-update.{timer,socket} for consistency - Add distro specific README.SUSE / README.Fedora - Ran spec-cleaner- Add man page - Ensure dehydrated is always run as designated user * adds 0001-Add-optional-user-and-group-configuration.patch - Introduce config.d directory for user configuration - Avoid warning about empty config.d directory * adds 0002-use-nullglob-disable-warning-on-empty-CONFIG_D-direc.patch - Fix sed warning about unescaped curly braces in regex- Swap statements in post: installing services requires tmp.d- (Weak) dependency on dehydrated-acmeresponder.- systemd update service: ConditionPathExists goes into [Unit] section- Use timer instead of cron for systemd-enabled distros Note: Timer must be explicitly enabled!- Drop the (undocumented) dependeny for mod_headers- Unify configuration file source names- Bump to 0.4.0- More dependency fixes- Make nginx and lighttpd packages into features Default-disable them on distros where we cannot provide a dependency.- Fix build on Fedora- make permissions of the lighty and nginx config files tighter- only own the configuration files and not the whole directory tree - add BR for nginx, lighttpd, apache2 to handle directory ownership- with making the permissions more tight ... dehydrated can not write its lock file anymore to /etc/dehydrated. To fix this we now create /var/run/dehydrated (sysvinit) or /run/dehydrated (systemd) and point the lock file in the default config to that directory. Please adapt your local config files accordingly.- change permissions of /etc/dehydrated to: root:dehydrated u=rwx,g=rx,o= - create the subdirs that dehydrated would create later anyway: /etc/dehydrated/accounts /etc/dehydrated/certs dehydrated::dehydrated u=rwx,go= - tighten up permissions on /etc/dehydrated/config /etc/dehydrated/domain.txt root:root u=rw,go=r -> root:dehydrated u=rw,g=r,o= /etc/dehydrated/hook.sh root:root u=rw,go=r -> root:dehydrated u=rwx,g=rx,o=- Add lighttpd configuration via dehydrated-lighttpd- Test for user/group before adding them and don't suppress errors- Fix MIN HOUR order in crontab (boo#1009452)- Bump to v0.3.1 - Rename to dehydrated- Bump to v0.2.0 - This version fixes a json-parsing bug which made letsencrypt.sh incompatible with up-to-date ACME servers. - PRIVATE_KEY config parameter has been renamed to ACCOUNT_KEY to avoid confusion with certificate keys - deploy_cert hook now also has the certificates timestamp as standalone parameter - Temporary files are now identifiable (template: letsencrypt.sh-XXXXXX) - Private keys are now regenerated by default - Added documentation to repository - Fixed bug with uppercase names in domains.txt (script now converts everything to lowercase) - mktemp no longer uses the deprecated -t parameter. - Compatibility with "pretty" json- Explicitly add group and license, required for SLES 11- Add nginx integration package - Proper dir permissions for apache package (755, not 644)- fix build requirement for shadow (>=openSUSE-12.3) and pwdutils (before 12.3). - missing changelog for last change by danimo: do not require mod_ssl for suse distrbutions.- Add alias to /.well-known/acme-challenge by default- Add cron, do not remove letsencrypt user, adjust permissions- Initial commit/bin/sh/bin/sh/bin/sh/bin/shletsencrypt.shbuild80 1562061713  !"0.6.5-lp150.2.3.10.6.5-lp150.2.3.10.6.50.6.5 dehydratedaccountscertschainsconfigconfig.ddomains.txthook.shpostrun-hooks.dREADME.hooksdehydrateddehydrateddehydrated.servicedehydrated.timerdehydrated.confrcdehydrateddehydratedLICENSEREADME.SUSEREADME.mdacme-v1.mddns-verification.mddomains_txt.mdecc.mdhook_chain.mdimport-from-official-client.mdlogo.jpgper-certificate-config.mdstaging.mdtls-alpn.mdtroubleshooting.mdwellknown.mddehydrated.1.gzacme-challenge/etc//etc/dehydrated//etc/dehydrated/postrun-hooks.d//run//usr/bin//usr/lib/systemd/system//usr/lib/tmpfiles.d//usr/sbin//usr/share/doc/packages//usr/share/doc/packages/dehydrated//usr/share/man/man1//var/lib/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:10543/openSUSE_Leap_15.0_Update/2ed2452beb25d250e97eb7c611af2c3d-dehydrated.openSUSE_Leap_15.0_Updatedrpmxz5noarch-suse-linux directoryASCII textBourne-Again shell script, ASCII text executableBourne-Again shell script, ASCII text executable, with very long linesASCII text, with very long linesJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 463x251, frames 3UTF-8 Unicode textPython script, ASCII text executabletroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)RoN ldehydrated-acmeresponderutf-8d2f161acabce9fd580f65eea5976e8847faaa7c865a9bf1821b484d2b3d56c19?@7zXZ !t/y$]"k%w kE"#;5'tbb&&qr.&mrKqxDiG+`ӝo-9#{o8$Н:^8Z,I^3bm>6'LLNd_|M=\@%܅i*/FxCfj5*Ԕ.:,5 $RC%Z<0Z!P}⃬mn_%c/#d<_ٻ:'PФ8),.]6$RF7qӹ Tēq33"Ln朖lP`e矩'DbnkY]H`W&´ipkx{ =۸gMH+7cwTU0H™^!uj8%סyV-S 0I7tƝX{#IW>RNN/X'!8=YVXsudXBPI4>%>v"5Eq#0o$/ZDf}q?^胈?,ɚQo>Z>_%7(#8|qMFX"&q~c_|n8v]L=|fscC1jKW-osɄݖ91F Rѯ(^J QDŽl2@<#bx@衳 Zw d\UHl WR!8%ih'r 6 g *V;tD=42&6P؟S37r? 2PztXϙ:Sww' 75H5/#P]:2TQ}4NN%+},IoₜlA|YH{"ĺl{؞b>#334B' CEBx2[?[ + _23QcX3ԺTx_p YS:DbmͯwMsЮ]P!kMT9n{ps=:svLӲ;?GQzYt#8*"Ei1oCߖ>G&)sͩ?=$UJ=L +F漚EtBPb$?(&؜$ΒOρy(Ѱʈ ܿg%9QhO8ƥ L܁|t4>& kc]>kB cLN &,-+_axU(bPL4O46v ;&o?7Բf#\XKfSN&f;ߨ(RmZkGP%4Њ~5X 5d)'{])O$,kFW+2BL$&kA#yg##8 a'K/fj~ `ptxECvGB (\6mRAV+Iu~+mcр-||AAǮM҂ٱg?F qF?Z{1 O,(jO73hI('mRnm%ܧjMvR xԨ#ygEsD4? ZT֝F(s]-u1QcRqL؟#`M$3K{"=Wk8J19GѴ~@[j(2fbt&䶵6Cf~-fr< yuJLmRf3T',WrOj-h4Փm DMhzC҈\k _A@6gz TGg/B XD4rQF7IА-ؘ<Q+8Qi'AUnepsZ):Ԫ7yӁ)=Aaw vd5o tȴqq7@]RU Z{qO9-Q_}y)}C>39cj+OQ۶gM7.eg@-v/ᬭ2?«X0%ӝ#`F"k5"{/2ʅ15]M=Õ-FB쳡alzsr*9zBU-`Nӵ9doۤ4wh',G1EX|)hxUAӞyyyҎR޶iT2I"d6*+=S: t&bJʄZZ8^A0!#DƆV6&۳"츆%0+{5wwx :SĊVOy#RX$qۛ]pI-_XA`[8NWFQ@~Í\܂H+Ͼ5Uv&7񝹶`0$>[5h'XXxAnL%KFrldOU6"ipK" )\Bf2!L5JSZx5*zُd uw7RPDLv" }SI\=:gkWzzfp2Cp(MKBq|#WzQ~/ >Zg"OC-^џ?bTI}NP&  )6gk\}d9ґl}Pٞ]{k >FAetT𝴈IStGt~8]UzUPV+ !!RAKNl?sUSLf*\ZS*km|%SePh7EmN`P`Ei̶'g +6h}+sMy3E7$ho@e.}] v|H &/Ww=25ùs[tsr@8ŰtH\z}EniE$PcG7ETclS>jpʚKҌJO<۵qrhKP<NJ;C6 r皝x fC񟳡3/ݚh'ORq OIT}^uP*?*gFAf+6*wDÈ+%#> (^+"fvU wJ>`@/ >QA1r<7%ۉLnE>Ձ-oBa=M:g[G[4q4]-*̡O,қjbܑogAbݞ 0h_wa; 񧚮 إSf+ѐNbu][dLf~DX>CW?S6*LD'~  ڧN 'K:\r6O.;V<#BeK"*vZ~1}DІЀvOƛղAjbhfGS @*;r<-qυ| @`?k'8ݳ;^mde\x(iTW"ArWVv;(i۬1>\8jDCwG/J3SZ\1%}gWYr4UkB'fAds(G @ 'ۙ[`* 1o}A2uf ?=BjiN:Yh[y%1r4 FOޓV?Oܭ}lu$:５9jG'#5 ed@N0NX "VP-~C@{K={ |pVy ETfжMZdHAώEZ7ck^ð82H5TS$;u}t }mC%\NKٿEҋ !5fF lj7y2P@]Xy2ADu$Xm5,11n7Y$ފ,nU>[SZF5|3=I՟Iadonئɂ58/bRj9vF[ ~Kkl Uqx[\HQ]=Qo9~Ek=Ą˝QP!uG L21䋯ӄRP-E2c'WEq#;ʁ>)Wn꭭DmJWwEׯ |vB1VG wDrnа3&;d ٬[n. ul1"^_hܲS}D΃">X\x͂B86Id@bsRxmchAu rmy"x% J-":P7̱|'2 #O$HJOoO9NRb3غYzٕf:R tC&0G*p%؂rAdd|{6ԳҘ<) >q IƭG뺑W:YMϪyq^77lR6d ];|`2z?w4L5}o:1a 1scpLTƪ֜EAO1>SYQ))2P]'w-nX|*a1^Gq fBvCttp<|̎p֟! -;hjХm^Lc:k6|*%t5 QX>+֎x 'glʰ/fFom m߾c<08LۤRJHtnSxpsV9p"F8i)\]W0nF\a?6S"Fn NΣƽY6T>X]k[ 2iam߽ܰ'ے^U Vǘ۱H:^\nAPoiSTiMRqܠQ ap-,EѦG gB' цB|k%Wa-Lqʆ|bu)x eu>9,j.6%@ЀQ%Cb`L%~t1Mᷟ,^U/S2x&iE ceHMC#Oy&>.j=MEy \BPlϨQ`$}XAlJVPU/5tXb[rpIV`6&E!ٵѣBe{D9f\ڹ_ cðSuAyH È{C3]sbEϴ_(p@O0(Z֏4>SL k>ZnoxO|ի^(M4PQ(eZak2+)2cd>PaBO;-LIl+}n)4y wגV[L\Z_UL/kFd[ΗD_cZP"PFiSF#U=:9vk'ZI'u0ylM{rُ۪tՄMƝE$&&:0қGt6>^JqzbR?Q4"}~IN*&8n-3jH- {R4NEik9nᓫ老AhC:UFAkWpK;@ ::̖h="c "8s Xdn8*3ׂʑ$f0,"BaYIJ~d)u(9W$gtQc{ u+~T8faW*K85SZ.'KR0m47 `4I5א \GJgP˞2tS$٪}G|*te 'p/Ķt ]3vudsv܅KϾܚ~d:BYSD>|c*LbzHQV]E.ot*k;ϟ5_XM烍̏*'E~?gުk@g9x_@/ wYlY&BIdǠSIE 9Y=R|Ѵ 駪bH킉k#,Djl2ZEٱHiU/:`S+O&WtZiĨKRP7έn#`+5{O"g~n_>>_tjfk6XEvg8,F}J]Q7aH[%UBC?t蕂,QZSѢ`T+s&'L*q81Pyu56){tꁝ)%"D3e3/63g %M_c4$ֿ֭wF޶ Y EIy줓D;+o Do98P3͉ªmz9nsGuOn CaBsycE$}K & E'/|ڴqbOW!8}Ij-D3X q.Nqg n俽Cy8]lXPk,b+-<44}*M)kBh|6.*CH똚`D|YfE#=c;$j[~¸F'VG9KacbA"BFs,3v2rQ9f  v_ꗦTҧD~icSYS' 4] IM'Dj$pbcIᣆŊN%MMMDb$9Xe~Y{`%)ARb4c >N&q2Ab{&(`MCT0ulCfS&9.0?6PiI= kC)m"k6+aS":cçX@bt©Stk~a˥{~fg>b*'OȘHLZFZR]G3@{/q ln!bQ8 Rp lrV(D71(5pY$Ԟj$(V,<>2G,7|C"!zG%\IrNt}T6ʵ kʚ5<[^8/'/[M0}27k ycw +NQak?D-{\#&]AwlL*."F_0GE `y:P BT+0]t/|JKW@j0gSy@Pے&.,6P} i1C4kƙ?x*J@?pH6@K U Ӹ5͍gEuSԂS7ͤ`j-23Ĝg,3uAUyϊGU7Tr G1nዩ!#pLofM{^6%O7|$p ٗr)26vEsPf-0D&HabIP: YZ