libsmbconf0-4.7.11+git.186.d75219614c3-lp150.3.18.2 4>$  Ap]܌/=„an4voJscVxN|P&E!xLV,eQaHM߱m6ʝP!¢%E9xr='d0׻dtp 9(Ϯ䳲w#I4oQ % */stN(8$rúʥ@ocPgrBwX965336e48d86bcabab84595442086eebb6a856cc7ba2ebea3d5d809108d90371f5dbed4cf895a9692537d539c76952d4c1f08d80L]܌/=„|\.;tsA]ڛ0a쇹Vg&ty &OJwuY{_~|{#&!2B{\sqVS8CF6{HNҲ5{yUwW~Q̔meH+GFL#*uƯZ"c5X0ƚS ud'vzSi\J&iY饹pHBhBX FAEijk+W3[F,3)+@>p@D,?Dd) 6 S &,48 : < @  (ccHc(89L:$>?@?F?G?H?I?X?Y?\@0]@4^@Db@Pc@dAeAfAlAuAvAwB8xB<yB@_zCCCCDClibsmbconf04.7.11+git.186.d75219614c3lp150.3.18.2Samba3 configuration librarylibsmbconf is a library to read or, based on the backend, modify the Samba configuration.]build348openSUSE Leap 15.0openSUSEGPL-3.0+http://bugs.opensuse.orgSystem/Librarieshttps://www.samba.org/linuxx86_648]x47a218e1ae0799f68b3750a4a39a182eb979c615d11a47f91dce9a502b745b91rootrootsamba-4.7.11+git.186.d75219614c3-lp150.3.18.2.src.rpmlibsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0)(64bit)libsmbconf0libsmbconf0(x86-64)@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /sbin/ldconfig/sbin/ldconfiglibCHARSET3-samba4.so()(64bit)libCHARSET3-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.10)(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.5)(64bit)libc.so.6(GLIBC_2.8)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libinterfaces-samba4.so()(64bit)libinterfaces-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libiov-buf-samba4.so()(64bit)libiov-buf-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)liblber-2.4.so.2()(64bit)libldap_r-2.4.so.2()(64bit)libmessages-dgm-samba4.so()(64bit)libmessages-dgm-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libmessages-util-samba4.so()(64bit)libmessages-util-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.0()(64bit)libndr.so.0(NDR_0.0.1)(64bit)libndr.so.0(NDR_0.0.4)(64bit)libnsl.so.2()(64bit)libnsl.so.2(LIBNSL_1.0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2.5)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libsamba-cluster-support-samba4.so()(64bit)libsamba-cluster-support-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libserver-id-db-samba4.so()(64bit)libserver-id-db-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libserver-role-samba4.so()(64bit)libserver-role-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libsmb-transport-samba4.so()(64bit)libsmb-transport-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libtalloc-report-samba4.so()(64bit)libtalloc-report-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtalloc.so.2(TALLOC_2.1.0)(64bit)libtdb-wrap-samba4.so()(64bit)libtdb-wrap-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtdb.so.1(TDB_1.2.2)(64bit)libtdb.so.1(TDB_1.2.5)(64bit)libtdb.so.1(TDB_1.3.0)(64bit)libtdb.so.1(TDB_1.3.11)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.13)(64bit)libtevent.so.0(TEVENT_0.9.16)(64bit)libtevent.so.0(TEVENT_0.9.21)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtime-basic-samba4.so()(64bit)libtime-basic-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libutil-reg-samba4.so()(64bit)libutil-reg-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libutil-setid-samba4.so()(64bit)libutil-setid-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.7.11_GIT.186.D75219614C3LP150.3.18.2_SUSE_OS15.0_X86_64)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-15.2-14.14.1]@]@\\@\ \C@\N\}@\o@\\[[[;@[z@[i[6@[5@[ @Z@Z@ZZ@ZZ}@Z'Z@ZOZ@Z ,@Z@YY@Yo@Yo@Yo@Y@Y3YYu@Yg`Yf@Y7Y7Y, @Y"X:@X:@XXsX@X9@X@X@Xg@X,XƉX@XYXe@XX@X@X@XWXAb@X-W Wv@W$W;Wu@W#WW W@W~D@Wj}W_WYZ@WYZ@W=W(W!@WW@V3V3VV'@VՄ@VՄ@VVIV@V`Vl@V@V@V<@V<@V@VjV]VI@VG"@VG"@VG"@VG"@V(V'~@V V7@VBUYU@U@UUAUĝU@UU@Uy@UUrUq@UhTU_@USaNoel Power Noel Power David Disseldorp npower David Disseldorp npower npower David Disseldorp Samuel Cabrero ddiss@suse.comSamuel Cabrero Samuel Cabrero aaptel@suse.comddiss@suse.comaaptel@suse.comscabrero@suse.depalcantara@suse.comscabrero@suse.dedavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- Ensure we build against correct version of ldb; (bsc#1131686); (bsc#1125410).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- CVE-2018-14629: dns: CNAME loop prevention using counter; (bso#13600); (bsc#1116319); - CVE-2018-16841: heimdal: Fix segfault on PKINIT with mis-matching principal; (bso#13628); (bsc#1116320); - CVE-2018-16851: ldap_server: Check ret before manipulating blob; (bso#13674); (bsc#1116322); - CVE-2018-16853: build: The Samba AD DC, when build with MIT Kerberos is experimental; (bso#13678); (bsc#1116324);- Update to 4.7.11; + s3: util: Do not take over stderr when there is no log file; (bso#13578); (bsc#1101499); + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + s3: smbd: Prevent valgrind errors in smbtorture3 POSIX test; (bso#13633); + Durable Reconnect fails because cookie.allow_reconnect is not set redundant for SMB2; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + Fix possible memory leak in the Samba process; (bso#13362); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add virtualKerberosSalt attribute to 'user getpassword/syncpasswords'; (bso#13539); + smb2_server: Set req->do_encryption = true earlier; (bso#13624); + s3:winbind: Fix regression: winbind normalize names doesn't work for users; (bso#12851);- Update to 4.7.10; (bsc#1111528); + support the new v4 Performance Co-Pilot API; (bsc#1111374) + quotas don't work with SMB2; (bso#13553); + Build failure when quota support not detected; (bso#13563); + vfs_fruit can leave lock records when testing for netatalk share mode locks - causing panic; (bso#13584); + vfs_time_audit is failing FSCTL_SRV_REQUEST_RESUME_KEY requests; (bso#13568); + g_lock conflict detection broken when processing stale entries; (bso#13195); + deadlock with ctdb_mutex_ceph_rados_helper; (bso#13540); + NTLM authentications using default domain/workgroup stopped working; (bso#13126); (bsc#1068059); + vfs_ceph lies about flock support; (bso#13506); + Using sendfile = yes with SMB2 can cause CPU spin; (bso#13537); + Durable Handle reconnect fails in smbd_smb2_create_durable_lease_check(); (bso#13535); + cli_splice() fallback code reads wrong amount on termination case; (bso#13527); + LDB 1.4.0 breaks Samba < 4.9; (bso#13519); + samba-tool trust: support discovery via netr_GetDcName; (bso#13538); + samba-tool domain trust: fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + conn->vuid is invalid after a SMB session reauth; (bso#13351); + Durable Handles reconnect fails in a cluster when the cluster fs uses different device ids; (bso#13318); + cli_splice() doesn't correctly return written bytes as it's uninitialized in libsmbclient code; (bso#13511); + Threading support in talloc_tos() crashes when enabled; (bso#13505); + Incorrect talloc_stackframe handling in python ACL test code (make_simple_acl); (bso#13474); + Fail renaming file if that file has open streams; (bso#13451); + vfs_fruit: delete 0 byte size streams if AAPL is enabled; (bso#13441); + Creating missing remote databases during recovery can fail; (bso#13500); + CTDB_BROADCAST_VNNMAP should not be used; (bso#13499); + Fix building Samba with gcc 8.1; (bso#13437); + Uncaught exception at ldb_modules/password_hash.c:2241 during new domain provision; (bso#11573); + "net ads keytab add nfs" writes only one enctype with older kerberos libraries; (bso#13478); + VFS modules that implement pread/pwrite must also implement pread_send/pwrite_send; (bso#13425); + vfs_ceph is missing async fsync implementations; (bso#13412); + net ads keytab list fails with (smb_krb5_kt_open failed (Key table name malformed); (bso#13166); + s390 and s390 needs to run with 'use mmap = no' by default; (bso#10765);- Fix ctdb_mutex_ceph_rados_helper deadlock; (bso#13540); (bsc#1102230); - Fix vfs_ceph flock stub; (bso#13506); - Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); bsc#(1068059); - Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Disable NTLMv1 auth if smb.conf doesn't allow it; (bsc#1095048); (bso#13360); (CVE-2018-1139); - ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes; (bsc#1095056); (bso#13374); (CVE-2018-1140); - Confidential attribute disclosure via substring search; (bsc#1095057); (bso#13434); (CVE-2018-10919); - smbc_urlencode helper function is a subject to buffer overflow; (bsc#1103411); (bso#13453); (CVE-2018-10858); - Fix NULL ptr dereference in DsCrackNames on a user without a SPN; (bsc#1103414); (bso#13552); (CVE-2018-10918);- Update to 4.7.8; (bsc#1099702); + s3: smbd: Generic fix for incorrect reporting of stream dos attributes on a directory; (bso#13380); + ceph: VFS: Add asynchronous fsync to ceph module, fake using synchronous call; (bso#13412); + s3: libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457); + python: Fix talloc frame use in make_simple_acl(); (bso#13474); + winbindd on the AD DC is slow for passdb queries; (bso#13430); + No Backtrace given by Samba's AD DC by default; (bso#13454); + winbindd doesn't recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Fix interaction between chown and SD flags; (bso#13432); + s4-heimdal: Fix the format-truncation errors; (bso#13437); + vfs_ceph: Add fake async pwrite/pread send/recv hooks; (bso#13425); + printing: Return the same error code as Windows does on upload failures; (bso#13395); + winbind: Improve child selection; (bso#13290); + winbind: Maintain a binding handle per domain and always go via wb_domain_request_send(); (bso#13292); + winbindd doesn't recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + Looking up the user using the UPN results in user name with the REALM instead of the DOMAIN; (bso#13369); + rpc_server: Init local_server_* in make_internal_rpc_pipe_socketpair; (bso#13370); + smbclient: Fix broken notify; (bso#13382); + libads: Fix the build --without-ads; (bso#13273); + winbindd: Don't split the rid for SID_NAME_DOMAIN sids in wb_lookupsids; (bso#13279); + winbindd: initialize type = SID_NAME_UNKNOWN in wb_lookupsids_single_done(); (bso#13280); + s4:rpc_server: Fix call_id truncation in dcesrv_find_fragmented_call(); (bso#13289); + A disconnecting winbind client can cause a problem in the winbind parent child communication; (bso#13290); + winbind: Use one queue for all domain children; (bso#13292); + Minimize the lifetime of winbindd_cli_state->{pw,gr}ent_state; (bso#13293); + winbind should avoid using fstrcpy(domain->dcname,...) on a char *; (bso#13294); (bsc#1087303); + The winbind parent should find the dc of a foreign domain via the primary domain; (bso#13295); + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400); + Fix broken server side GENSEC_FEATURE_LDAP_STYLE handling (NTLMSSP NTLM2 packet check failed due to invalid signature!); (bso#13427); + s3: VFS: Fix memory leak in vfs_ceph; (bso#13424); + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407); + dfree cache returning incorrect data for sub directory mounts; (bso#13446); + Looking up the user using the UPN results in user name with the REALM instead of the DOMAIN; (bso#13369); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + s4:auth_sam: Allow logons with an empty domain name; (bso#13206); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + build: Fix libceph-common detection; (bso#13277); + build: Fix ceph_statx check when configured with libcephfs_dir; (bso#13250); + vfs_glusterfs: Fix the wrong pointer being sent in glfs_fsync_async; (bso#13297); + ctdb-scripts: Drop 'net serverid wipe' from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + smbd can panic if the client-supplied channel sequence number wraps; (bso#13215); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + s3:libsmb: Allow -U"\\administrator" to work; (bso#13206); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + smbc_opendir should not return EEXIST with invalid login credentials; (bso#13050); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + libsmb: Use smb2 tcon if conn_protocol >= SMB2_02; (bso#13310); + subnet: Avoid a segfault when renaming subnet objects; (bso#13031); + 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:smbd: Do not crash if we fail to init the session table; (bso#13315); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Bump vendor-files - Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); (bsc#1094881);- Add missing package descriptions; (bsc#1093864);- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available. - s3: winbind: Fix 'winbind normalize names' in wb_getpwsid(); (bso#12851);- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./sbin/ldconfig/sbin/ldconfigbuild34 15724612674.7.11+git.186.d75219614c3-lp150.3.18.24.7.11+git.186.d75219614c3-lp150.3.18.2libsmbconf.so.0/usr/lib64/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:11379/openSUSE_Leap_15.0_Update/be996b7f12a3d56812e012720e2d8123-samba.openSUSE_Leap_15.0_Updatecpioxz5x86_64-suse-linuxELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=7268b7164612fe667f8ea32714a0eec04073d427, stripped_PPRCRHRRRR=RXRR!R+R;RARPR1R\RZRRRR#R/R9R?RMRNRLRKRJRFRER)R%RURSRTRRRVR'R^R7R3R5RRRR R RR R RR-RRR"R2RRBROR$RRR0R.RRWR[R(RGR,R:R8RRDR RRRIRQR$vh]3BFNutf-8b151d87a3b03208bbdd76ac575652d28ed7bcd56c05d3b950310cd093bd7ce3c?7zXZ !t/:] crv9uy!Ke \B{yBDU[SFP<% Y=3ρdTWO+Lp sSoQFk?9Ezf@7cP GD˯͋Z,tMKG*EըIj6iюkbcCB&SՍ:4t($$(DZ*:|h2phXxi[x.tդ>:{>cq19?L\ϭO`Vq@0R!WQA!>ƥq徺]*QT@loӿfi.22xTJh7h@!KBG[ D6vgQKta9i]N]OA . Lo qܓ0# ~~`:=aVp\17f@Gh@Op}|Ha o>?' bN׆IR` LP.SchU2oib9 {eRE<j<6Sx3:B e6X? #MzOK> _wgDJ=@vBM&_UEhߑ0 Z-z"R-< !y2 ]VE3_Fƪ &rVD=_d޷w| c'4:? 7RCŌe0?hI @de䊑qNZZ90Ne|w_=ӛEߣDn5QRkNשk(<+.cͩ#;dX*sb׮ɔWk3N${cnhXjşB T|\z&\G$cn5vs˻,-ĶxH^KʨSAr^q (T1#w§`yȋשQO;+P= A5/TTCZ<9&~EP~L ġ+=H/34%zz4be0-$Ol'$t3 .p4bxXKgO ~g0ukqЩ./]I#Sh޸_U ڟ[, jƛsC;ZjNx5!(rj F>QnH*ḁEe8oҦ >)x$I V6@2le+Y="Y^X/!t=tote^1 OSOR!ov2K)<$ 9pIї؀Zz3't'ao&9G.JPޢ'/ z`|?U%k91:/‰*4\:D~ [쁵5|-UR?XaZ0 )pW 6 @&y.~3Mk80v}$I5$J0gqEq7wFr@}FDF2tbQwq~'!3ջv]4K D A|=8ktR!H ]7lOЫ1*o- aЀ??*t7>R2LP 낧b,nbKH- M{=џofDrw81߂~<,/t%g?p ޚ;>oT,TWfDt̟$sJke :(4;*/jZNM:-@WwV]e\x;eZ1}!4 BJw1ڴ%H\.,f:߰T8 j?H2=1XoS 5lTj*khnkZ)<](kto#A$Re% z=2 }d顕I X29I4RRy`0}GΊ[\Lp D-(i2r?Їa'}Xl qPL0*C?-¶* Ls #4Ԏ 74O{|SusnV"di`xx WB,(Rp\9ˎ!ǴwU7W%4qɇe(mjbv 40pzYH MuN1kZ;J%K~^{UCjd&LԢǒLj0RnL~w}_Ftwbtcb2wT.\NNݝ3 C :v4_ h9:`ӃdgyF<_AGX^p(Pác&Қoȝ>QT^/N#tuiVW4YsI"yʨ/bUj9SIʭfi5Iu¶N*71 Y5\k5~M#ܲ<%d!AxnTpr +i2Cvf2e_v Q~e4ho3m𠛰!d5Wp `ZGs̆-nXlWZ~.,;!-I<Ҿ r܌lqzu}7%o4HKIU!yDqgP PFS*I푐[WoF6 :7&Ul&/Gca"Sh{/ZpqR,J%$,TEQA<:$[%p]V%7@^)CF%vlطr LpZ!rH/ }k@zscVUWsrnvMKJpX)|ѹE蘩'7AyVFa^:/ż1pJ[0[UBYH@,fhY|\m l|+ DA'*kn躑gݣc̩m+7t$'YtAS#VjX8|)? A!SÐCU i7qN߯WoERVYr{t[\s#p>JjM ??J$8p wS$)ы?jI<ϠKDWn= &'v*S,e8~ PQǶhwq@U!W3uVڜy\@ihq"i @*"R T 0-Ezi2֔hz9r ,$j$ly|zE0Jԣ[qE`w}]O1ödi,:,<%;xs5ga4ɤRdqmc4ĝ~Req6sB.9SJ rWnFysUZ;0IiMdsIh0#ѻenu"}orUEQ#j+w"}mQZRd%XhVR*j%  ;lNJgomn=eFhPc+59 >^ $20qFL=z7Gǵ$:z 0AƂ8 ۅnw0 \D+1q^?9AeՎ lH.@sˉ`/\HңwNg7duh@$F~{`viNWE6Nj9lf9 %{\ Np.w9 vIHy,Pz=g.BFJ:ʧ>EE6p'B@Kk g }#p#66'7YĔ_&}O> oՂajWIq0ƖZRZ5#,hLSl$JyZ/{-p|34c?=e=n2L%Y&bԉEo4M{vB& E7|?HiJ Nl=4Jw*Ծ}&QY˧`-[I:cW%ID6 Wэ*C?.ThX̃.vюGHrN.r~mK%^py\7?JP1z`QWuXpEdruT\Yĭ>QS;d9Gq˃&ȈH${e1U]z-lr^WhAp=T t-^MQPbݰur>׏-e}g[94e~X&lve]wv@U^ cQV#}B,"vmzuiYn#E&#& 0xMij|ȎBX) YWSݳAȚlGdrlCeCyꏞįd Uu³܌s@ǃϱ+K\o 0GюPG/lT\1Pn/$(~CUӜ.JP׶(c5<=>k289LwZ#nK-T|/Cɞ=hz5˺^c|ŞncdQC4:3@uBVsw>M&y­Fd׹u6s#rLd60;n^{xI>sXcnc笁؞f@5P3P3bl=zl x1qکtA/:_t*}`Gi9 t;>3o񸌥_J'.S*)sJ-'sd{FGe/( 'X T q{D{KmE}4roFIAa;DTtTer̭ ǣ-c4=yaJ `T)~scw2w7& |+G0 =&dgK:MX,h`+6UDVXG+d.47-ris]!d3=,~sן zd` {'CmE,{JJ6x(TwU1U34zYʶъ (18 ~kp6G|ٵ ioBJzqu7t,la8ՇMOm^z7WXS*bK.;$Bc~5m,gѦgǿDZk+ʺѵŕd\g R*ʻZOӁ.">w/t2kB < cxpm[nC, ctɐXsp{t9\P@vQE\T+uZv*;m5`n.U1T 8=2&c817_#D&yL43d;u>1'hD8gpG762= 2g`[)* R`y&9hֲe9=9(p}R}|<)!Pjs0aˏd݌Ć_,WiKb (!{qyro*rzأ' #iДԗ9T>_!8¾b EF,B8?_Eގ h8:lN!}MT@n¤c: %tL8z0wTL$P0Q/P yG7}'UH%I#UhFwAy*`SARYM %,0:X}dAɪ0-;3) h.&v/aBVZն*rc܍Yk:8zOZaU`ӎts%D՞4EnP#8Ws:-`+2BWYAf0j[ Unfz{2/tJ8(ـ}.t,b (Ia}tK8=[ OA}Rϫ#ܵ&ݷ7)![vV}΂p">H^]bqqUϧ-wbfVZKa#}I cf(;3ri\4=faTkolÛ &جv-F쎎Q. 7wP]R@Jorao r0V G-E#u?(i˛?蚗8<3D]&4*hPjT>\A\zsQڂ]&4 <SlMf97O m Ŗ2HO)AӂӶ T\w(6*62 j_l"PAFɧ~}`1B<|/yC;A ['}*Va:p;?y Skզ~\}Ӡx`|ה+PmB9&ɘ'>1xӸtW"{vc.[H ip>-usbk5LPIL T"L A%y2nmJ<@Ǡr;4:L:,5GtiXBbY`GMSFllߍL{&t^-4t!߻SZt%ʤ">$~X!̖>= /lwD!~80k7[xeҮZ#g4`ދyu /]QU K7cr?p dw=t̬,}L%q.ۊU`/!Y/)6&W郵(sYhыc$;Q!oI u 7E)h* %,xB 'Vwڸ^vg{;7'D#D>y/3Osq {72JJw]tNOy/h$XPT0؞Z5(l%A8L?.8\I9 <+F_9_VUfx.kjD>ץ:ˠ:"uM/g R-a;"uRHL/@ 8ҍK4UcV,eo6p)04/PJa/2ɨ_(vm !ҫ<\0=3l8vEzC2YWExӰ,UvAu@CCq0$`B KT߅/OL^Y;P P0`TΊ {IV}o!\u`TjK@3gfD . X!h{:n+8Klv_ Se(D6 nGNf) Hα+4ňAE$$f/f2/F7E=eq勭>?ž^\ra*'F84}Uaj2BVxbZ'd˛ĉ5zgμLglm͊rwM[*qt얳] 7'zZqdlI(zK+UBJKSjadKYO zgAd^YE`N'uX4 Fw`Iӱ۞ÿPOT5$ v"mP-btI۽/K[}% RzqtzXw$&X@t7 c]ա(jeDs Qo{8v.&7#qr16ޠORG0v;/Q/r-(ǻ,a~26ˡ|H}K8zT8C^2CW0Qth=2RpM_z"تdmdX3ͺ%} '{Gs%/K8Uj~zO2k}R2e%["J+\cƩ0CTY- Gg(^ͤ٭kVO>EQ6e&tJDj?zӫb1`r %R:|dmKP)1}zFlz}s`QWNZ3h2uEՀ֤&;ggA3N < 0ή\Z'ZFʥxo*wb4-Dkdyjjq@?x!["|;A1@* ć 'AƽE^plZJ%:c k>gho$q<}/b%j}0oҋdO0^'T cc4C u/X'ߟs.y4_g/ c.9p 6^9snfK)m= [hX8y A4R{c1&VuЃstIjY.=Mn5/J(5" eJC/$|jhC|LhOnM,sw e ø~y{I^ 4?_;5 *X&#.%'R H"tvx3Ӏ8B ݙT_^9,?6]7C,/O7 0D\7FeRD|f,6V3#iկw؟ԯi;{h^ ̈<Ҡbw vT0Io-DMi+F+zQVn7ǘrPL5p^gq(b:łsmBF%2mA.L:A ,7=]x^vaK[um!>@>؈I㜙)%?Hzn6$J|Q?a:sK9[m&8"LFwۗLZWE"ک }.mN6H1428T_i:\,6?yi)m IaD}=ޜ~X(if%IGפr_ǩP q<}Y-Ę?* iE~XLv+vR<-IDzX6'\$"Uzоj}Qj0@Lv : C@;8ؒ3R3XE`OV_*xyHo9aI M4%קXn*@:[p>ܸnq/*t]T*N{N]1$I~l'"PI_gCgiw)5D2omޑ_LиІN#\@|b3" }ٯo|ӸX`6RsUc դY}q4Ud[!u2*,[K Úa1KȝwgߴI/״F M"ɠGg },}r^n_z3. |= 8!29HӴNl2ya۬썼'$>BOٮnvV<1c:- v4uHW`}߰&3?xu&c5@e|OBNcb^j n:n E'E|ۉPB}xx#:9G)O0{@C?@L%<.x$W0JӗΗ-u O*;RCWX:LoOtP {6s')aG~,{AT}+(g:f5}'ɩnVv> D-AS7\>`ݸ؃*.,LIUJGw/y{tvy.v?W {QI1>j#' NSN(BBYcDiYj>gܷ4y=AQnoVK?2X#y'$k*y0VܲAZȪYPU\r=8|b/b;Z!YP\7 bn96[XoS=^%s g*ꉗFSgFǀ#wbTq( XW .Kg)JׂAwQ=3ds B"%Pz=i% DXü 6{\l -o c wq[R"[xFש. Kpu-ib& 2^{O9~2ϡE[uV6SΝ6.[~{& K Mp* yGFIcM~l/-oJ^'0OծKz{sH\7?'$?)W.X=YkoC1S A)¤uUK_sΛX=1c mD#@bK1 \Jr.6uv@\L%Wpk9wdlv>/hg5Ӓd9^ u:a0@;oiN&&LF1ů`t}ƆJZTsD-):oH3Ev0)'}6G=> -LbYBdo;Gl֭T_4o\&mW?rbU J}͛!J?yly#Wq1jMwrhU82:dQ=*'\d W&lѴXs)0F`fsq# 7HPX6e*-Ɏ at{q4.%3Jk勒.£v8iB Gk\n:trQE 꾷,,[q:t7;.&' [tdXXLY>劺=34ά`2Smֆ8I!,oJg x7 B? 4#z~Gy3STP\pmA_mЮŔN3!/*40t-o\崓v'@JHP H01'syܫn;A!ڒ u-Zv>jΪ 3_LNq:fOBݱGꤦވہYqdZa?%p-غ\Dk#dr+j;/ҝjC``zcKepi%}TM5ΦQ/=]ӆJl.WAx򭊸pmPyYn=O?ؽ%;z}(/"ct,o$ ;*1§LS8 S^uTBӛu[`mcǴBX=`=PN}KT $6Wͧ&L8|okR~sNLp"DٵBMF Up{|X;O P ǶWFdFPț6zMsji"^3㔈--ɟYVmXzկ5V] Ka5K SxdFƙz\bF#p?)`}bުϖ2XQ~_ʣYc(RAfM>UZsƋ S?`t=pW qp0SUa 裞E{KDzWf< A^))KP\|$6.VX39\YDe(8U,x;fwwtPNwtާM1*R8bR[)V <}뭨''5dž P:y־@@_kPn3^ (~Ő>X EQv"Ʉ#iÕq*#+b%`P~ZAQ9@B.V1ɸsKo{"B*QZQ{'7ut(Hk?.F_:GcPkaԊ ebK;ZVo3~%Puګ:>hBdruFic|җ[3ҤxQݙe0W),E\Æ)i2a?Wcq6fC2WP<2qPf.71 5W&IR;@Nt~t.uA;gf0[*agaiqi= #/!>WZgQHmlv!*fd!,㵦t|g2s0K$^S( vvP{Np \& IW]JLH?a)u6$x/uzE}R%+ 'k[`Μ$EmAF\ x/MДA8> @Mr\D_  5B62n<|gţGzLx8gx6|/ 8gi$zB))Skͺ[ ʯ z9̸R1&ESk~X|s:x&P .`B W5LW|aJ,}!,a6r֤i=~ꐯ1ؗofUg3z!yZ۱L#!S\Ռ0&XoH=tVil8 _&w-2XNF<ͼ{P l*"%7EBfi&MqzqMѺ p&6sW d`,eK}lVʯʝ-sdxCxuJS}5\@ 4CMBgLlYO.'E"5D2Z'Ζ7>a"*U>c mi]=~P~Cyho%ܹ-"[R-w4h `TG-8D@u(* WI Vv(.\/`(ǀK֮uf}5s(ЎA.C9%+ 70 yO<8?x􃮯/f[ _. T^nFĹ9b!xYs5.xӡx4?3)$PhOɣ!ycuWCZH7 l-]vi {Γ>$Q5j;9y$8itbY#>\/qx+f5HIz,4S+/-t3`/-`qF2_C; rv)sŢh38 _hmP( >b;QT"`UrqZ<> _|$l-ޖϸH MI̭}ܴ!%nwP=n>!m_n5Mc#Hܨԑx7T Gh\\Ukܢ+4#K9B`>+~#[ItN8W W፼/?"\kM  |{4C=|O9J! ?[ ʯG^ ˀ5ˬJ %_lp#{ϊK+]Tt%Fxa @]]m]'Z@'=uH'rQ_Pƕ~A8~d:zٌCHȐY,i)_?=pb !&i_.0zygb0M4m`~,n~. a'=#AN%BYh]j(%ňXO/wjߓ82kmEr fjTSX*[*ܪy4 )Roh vҸʩYwTϦ-^ +5p)1_ݧ)_F~/^\tĒnA_YPw}>Dg4Cp!9{J͢>D?D/t^}}Yp΀2ݷrh:z ,`͆g ¶B$xHSS^C!h!7~М$g6>A"j}uKwH$z(K=CjAG}=EL0 bzW!LRJ4 ڋ co}P7ͻpS5XHe{jB,Zraz~o[LzAzZ,R0u!#C|g:ߎa;wQf[y~?8WVdPߪiʝxwTYeCR]Iڣ5OƌS?WC݉#vmqLuB+/+VN\ۏ_dΙUQ+m^سۑcr$dѼj<-cqmoDO(B+S7SAm,p{AUgFy?IǼ`QMujO%cv0vۂ/zK/ &@E -rXQkWzX m݇eݯA[bAGY\#ooi,Ҿ+ۢ4qUyHg =[:4gZbFrܝ3-J@LbR;y?07ͳ7Xzdj}_9f,j=`bS#|?ڴ8R;*mh"EDiqyBQ3( bv94PNXNLD[KE0,vh sYbL'@ MZYVIYwi! oXK9sDӊm50ŧ8x<xEHIQ1 %7l3g>LQ挢B=z sE$Gs8Ho"UQ+z/FbV#K߹cD![z"){S1JL^$GUi} J=-f]qJE.,AlAS+$LQ;d!*.f_=N} ȵf(0e6-m6 DB5Z~3%AC^ Uݟ2}ѭG}ؖ}A c2{c."$kQLu+\őt:6/^zB |psU\{;h_,zV{98?EUr:A HNJHL MJb JyPonuoGLrAqWj׺x6{9Bejk>{4aU$I%lV}e$vh'p ܑRĬQ,aV![ A`0޹: 3 iA[**vL[N$v\Xb[̃+dz,|4ֻe-? WPk?Ԡ;Ll\5z/>,Uv`nCAɞꃍBƢCLJ_ȱB$/#c5|e1ؖlX Qܟy)8W`T; ,c\4RTO*r%J]AyorVz}mbDIF;Z6ډԵo/D^_Zߴ>]u\'=mV Tqqϫ 2+f"-]9sΦ@D0ʎYkN^ùh)p7޽23.$!޻&\۵ B{x?pw-C!́1HڞUYRuv-&Q}}\ [=}|*}ƕ\6/~40(4Įr鍶] _Q|Fxl Hˣ s@؁c}RZvBEh38h aR/k7 _PpZ7)=L?+ᙈ?|2@&)tzcu;oQ"{/831[w۳4}L7t@UA4UuoA$c̯WE4G`+ _u2X~d"ImobҦC#d' Ko ԇH :֑&1$],=6`l 5TmPV! 1OljݭJ.#ˉ5 #q5qե",U&=De2HɔGD;u"Z<ӢfD=W/3*  )pYzB㓳.8x_17ìii@(pp%jH6Q{ |q7"쀡4x Aeq<ݽf|J\(jXo˟pjC'q\"RJպ%z)CV%w9m\whq)spQ:*lQI{kn@(LbtTL%jnM]Z/t)Ū$IZ'w7+P#Gg `uO$z^%Fs+qӊ1A %-b!bb"LfvAx]Gv7(RpO{F¼0[ipaX{er=4YVWH*-D@!oiM˅#~tRoS+BWa 6ɚ:Qf=9? mWDzN9NЋ19JDH4[/ZGQM1ؒ$y9JԜ@8lD\d; .WwMء^Ri~(\I"~ ne킛9V[J796g髙8a&$|N0Wmn zo3 WZ/'*+@4?y#K;8*r{=8j~Mjѩ?> #}T+ac覶%5J嗷t@ _m{e(Q_穟n!.TvhmMӈ;5#[He0fO%|ZŐ+8EқiƓ.KXa?.&y~Cb?&Qd|hBH=^+V!|`=PS:&55<݂շoIٲW{eݙ:P|%=E (l6%&̜=g` Sl ͉X)ozfTE~ʚ\ 6$G k`rPRObμ 0JqlE )na xrpgll# ڈֈr!6 zV*AD2e Z/T^< 3z4F zS-O(!u3'`vҢȐ$ze3 dSWD/6`*k 8dOqނwP[։7z V^x0O-vK֌bΓo Rq;]OfrPDR$U̮ YB\[}45FSƎكUPסί~Q^;wв)4" EH$j}[ 0mˀ>= LǦTGJ޴H͑O(όvqy J}HIGu&_ثλ0}qBap#(O!}Yf&yaL቉BgEs*V(o5GߚH 31҂a|kŒ]m˵2#Nqzղ'/S͌U<ͬy itۚiqDNsP:?YWXQ#EfmU+ NKDє#/(Fjl8=YM)^.顜'V\*[*|EDM5 Yvc{gZ#M <.`fU~u51t}]h;^0A+` f?IKݡRX~.WArI)\^A8 ,AdA BVQ'3D"JxJ/{ĊyLw1+J%ֲS -FzcƂRbԣ BW\VV K 8$(MHbڭZ0#جIM$⊖ܔ%)]_o~oH@׿Bji[M77z[a\د5|nm=o %% )pm Wb5qS2ĺҭ8uRn2s^EX| L^֐Ѥ!0ⲣl" !X>iR`ȯy[ Y8TyՂ&EǶ2d2/`h"8,ʯyȧѬZsNe '>w'x#~IDQx5Ω]Be&qF2N[>6O٩ rح#\>e 1#=0Y@ޖ#xol|rl&&;QQ~pNIk=@%-{mM4'7gGF*3Tp2D(JJ">!cF.+6d ˣ1Cvg{* e] ب,kT"BpTTo :.e+z!iB*Cj֜#/ ?״g+t~1OS(~k0 ;lNӄd7r&0EqWpw KEm"NL]47!7`Y,KUmA" sb8z[ d]|75Ci1SZrbsthFՃHЀ=32, w2s=ot60hu;pujDDn;ESTXq=mmX.Pufj6db 0Q{jTU'1T',B88/3)ji$fO]H=Vs! qF% 2uA9AnB ΖS$9ACX*z(_EVO[`;1RlNd$l}2l?Q{lh J/-*hH]5?:L\^M+-9|5?US{6g Bhv/b/xRh.W m6=/̪""?I,Di߀OOW|sdvJIRc4.({awEpCw}?e,cp#C!mill`,;Rpph,ST يX#u*M9ju1 Om4tTOUb2]"W^ZjA@UP=&Mg]Evv'Yr>&.QS+ӭ1`GCki,RLdRdʾNXI>H~cFm*@BLU%#T{ڴեQ# BbrVdwۆh`[epdpK~dVZ;:y ޡpi"eʹ#ps5;yYY῍wkv:5촫OS'خ5zV?gJm%ݽ wf)]>< ҉ԑcHQ%ȾPfrfP}=(Q>쓴BZ.K?ALV~x$H!Cw.-o@씝qK윘*|V-a$"K 8VΧA▟{Dtd S-nli鬣^m}(m$"i!]'!‹΢kRs*oɌtңvU %iqZdZrݤ)86l/mP;-cY+e)Y16D ks ufǨa 4"4|[QSo6᎖MP# cı!j¯Hc>Gz~u.>ew}K#'_ffILi'q)E#9FPE&Z~?Rm9ڼN 7p0՜IIOtL0 NC))^|oh5GE{yC[ ~-cE:c܋J.CVy2+ {ШO2XC-_*.v}ulkQqh,x*akA'hj7?OjTClظ25Q8P!k}a)&j eBT,FX*TrglɍN~nBI['`IY:1hR7PL6OT==LZtX'&MXj B; fYmk'~H=NW]9c]Q⧾cz$ͨu>9}ZO$xAkjmJ M9 8{4{pʍWKDV_F nOHGU26ODR޴ ezl G]]rz L94USy\0?#(ؘ.4B@§HtkeՄ,?\@y:mgUYlU-̣ylA t\2`R~$v;ڛfi_BVQQtȋ1W+R ӞF}{jsAUu;w2 2h4H}E&\i&Ծ,0qZS=˳}q9%P$t u/嬴\UF̌L%js(Cj6Glzz@ (8fqElGm(*B;GRTȁZςI~'"_h5%L?? J!2o3%y hX6潺 +|AG0rVC%< ` F. B: G bZĀeGd^\s~Jn& 2]-Eэarv6;,)Zb nt2VЏ>[NC~"<}26lj&MWzI~_Rlw=aӷ]xMxKHܥff||6 ZR69Wq ]_fC7!uQ啺f(yr[P-ghQ200(k;]{_UHͭ-ǙWο_:;)h70V8s) VVí#vfMIڰq2&MZ;1k 7(WL!Ⅶȡ+> U3dqE#J;ОĚtOm*PlΙPM4ĭoYON91A,ThO R(27rWakLy65P}8ˮ!X, q ȳ8+30ab ^fwsR.j-A0@74Qz!Tg9 f Ka-GK)p@{ x]';ظIjaآrqHD2O3 6i‰C<cd8XhYN[}nlkuZ2"ghl584~LKB3ࠥIb{MjEQ3^rx ՙp+vlu0gǤx{hB{;hͷYƫ-*R [R6-ҕrME@O2%L1!QMdTHIG+&1^4ǣ3[envy$~mf#RVHi|W*2q%_Okɳh`1X@4)a(D]W.SCnnRP;1"#aٖ+7먶!XH6EIy_?c@!gdQ I5:vBER,+3_Iap ,{n'b%φ즤 XL)D)ԓU kn ,Hx5KuZ<;`> w\ =3CKEB h\q7atYjɡj$UL/Ώ(6fzoxE"4~' dkW.3 \ھB@yOmdu;cfuSU $߃Ф`<Ў"QdB$m`ToLhOUfXwP9 qh;rfcz `R?ΰ,-w}2Sr)tl@X\ݧ+f6W#zݽ v r]$ҝ+"?|T!" 뢹kIz RޓK`xlA'MQD~f3`Љ+ivi#K`栋a[&E,SE`Wy7YE?/ߕ<ń'4baawo EYܶ >Ra)颿HvO[";W' ŀж jsN:x !*h0G>dD>J0}߮ 5>d*]~Rx5o|H(@m*aΦicKˉ"re#E&u_DbM9.!\Aɴ/ >% JQUPڨՊ|/ievC=ᑵ73MĊ tV5w%? gTptŴ|B+U(Yoa aha̔H{Qzq˨ZCZ$eZ,^lg0$t܈ ؈0\18ymƍWW:u]oգBDw< > >(ZI^xIR*˺i˒ג.MT 4x[3H(d kOLlI)n\`+%uh{EJH%-rۻdgk ƚ_ٙ=D%l~Y\n5;<Ƕ[bMp/ tkC4Ltޙ:(%j7Et ]}q r7((Zhf@sѷ)H~`+-S̲蹹,,RObAMx6xƄEyLv( BPikIZgtab\yDsȩt'Q+z`?H9cVQ+ @b Cz?l 2Ϯ3V ClyP5 Oj'{P&bV*Ɯ g+B)PmBB~(h% Զ9t \D+/ff6Ux(m5*5*ፏK>*q{"}ȱm_KAbz^ˮP@O-pLDX_ĤajN7aIy u2'V-Ehd: LɒwND<&)x:TT*Hè"mlom`uAѴ7{Ѣ Hz9 ʅ5wZZNmܜ1Vjak]L!8bR9=Ǣ%)~[YŎXg0߹ *9z*5ȵZe' WƦa/^(iG6V)T^MD&ZPt7^\|hY%ct%vchZ }H3݊ oJ}J|><" Yڨ1gJB> ..3h1N[܏m@GthhN#w%YXoGLz?Hĭ%O'R+ H0}w6™Cu[?bƸЬ$$ ֹ2mpW80_`EBOCQ8W'e e.t1um;PWOmgOI#H:لHo_@߀x:u\Gn*.8I DOlxp!%4 |0PmXE r#^ۺ5q} 3+@N'?``PߠȤVhk?صp7lwF| IO(4 l<%|kjݲ]\5/ڃ `c/L t˵'$DGOlʞ=K@k[8ڣK;7Ċn]R4& o 耻x.n': #=ٓ$$ ZGHW9}5 LAkUVo * W wxȯU|1S5zUN>/L`s; B#.ŏMAKӹʀ=5VAڝRLOi#4v-ʪ2\Jzd38qZ^\@}& |#u^Y~T=I| }i2U].Sv_w7L}o,Iܴ(z>Ի6VWl1i^f4W}!{#ωY#I<%e&_X'qzvU6 gn?(Fd8/ٿ @ CX/8yE>,Y sLG8LX~egxNP9:ؚ.' TxYQ05e_MZP{2o5 BNXϻbXv:ls=Q(L\B$,L1 ܗ>@'bT+IˑB}le#Pܱ[EZjs5زpВolJLgDf~{ f {l44ݟHGOaF49Y Nm$iX-Rcڦ*+msj[J;\ǐ"sZ&X~.ea.|bYr4/Y`֦ġ1D SESaMX3"w^y$˓dHS\BmH%<$꩗$Mt 5sح-aG)p8z?=j^!< 4pw.F~ Uq0j}@NSNؘqY*wT̥RPXѪ2Zig`!}ߏ@& 0s+\f஺a6P,*R$|'eƸ>Yx <o3>B*wޗιX❴'65ÔwY#Z^OF/F.}=. zKy@0?G?DⲸqs:p8[M~Ʋf4l;׫?*UY=,(yC6.B6rP_TJρ}O4fp0)k5LJeX ?yPa:I6fYAB¤2`R:)QgiJ~-5hPP):{R t{ V*зslU-]FqZ),nSH^!TN C~m*>:L;|vWmq0hr.Lrw ]XQgL~rBJѬ!^i:d[$K"rřU} W&<3<&a)#1E鱔|1x/1[,|;{J?ǫ1苧n&AO @ZZ(XXw@ZKwRq )MڣR8ۊJ)AעtƍHvUnl!gu+W<"Ū ac%'~Dӫ{FCQeF v:."~ܺdH)b-kohJOm[b"ڷ}&_r.Ư B}A?7mJi:KF|HW1{/=U'2ψ5}EV9~9T~D׌oe7 AǪ"IAe/,L1&ՀڃR18#@hd^!F@(h!:M,$f|[iݡ3.QGa˲w=2# $$^>zA<8]  =ς4VT$$[9M-Ί𝊣SozZ٠*$ڕUKǕKAKj\%Q F%Q*(@?TJ:_g"OKvYT#ڕes^.=uš56=AM}B8{|n$M\G:v/Y~ፍ0u[7Ob'`E:\)F (o۷eTz} _9.M],ɩ벖^) V83SK%A?Lr`"Ĭ'”R vj3_l|Q֊q`t"n֓d3Ьc-ŋNKjH(0 (-$VFd|HEy8gQ4qasU0F[2sd_'u(-|R7a pةĕE87듕Qwr;\P,-\CRkx25YGs st$ew[ptLPLǫNen6H& 09Q/<ҎyGӬ!D#&G_،,=Xf ݭ#kX),̴H+>s)Ų5~TnOԚ*/!Iǂ;8v-jno =zh朄6gdh$΂!Mwcn/yZLwA`t7PM_ Qp\#QhO d[3<%J5qnX( Jf$"~s %/&K,. i-"ld̨Re uѡKF:\V_~g#+WER+LoxћKmɐ gYW ,Dœּ2'T{+S8q}@4tx! нy~R%a:Dr窏qD_c69(h|珉NϽ%؎T0p'r\+y N>ࢭ=ND4J_3 눙Zq@eW#& ]Jpc:/2]1( +&ƵaǺ9@Lt>Kt `ϩԠՒ[ &*BHWի2S-M џ_S'dD&/v{ۜcU6\5Zߦݚ3EPAOTJ30|`Zn+0A﯒ǀ!;UJ2t9mgޣ"mӽe* kdTzdO?2jQFz'^nG(LYw~S%|Z}>rRtoieZ:sc%m6s} ;mk!bPV?zhw)kL -Kfv1^#2:I̻)zȄFa /nh5䀢=|՜[b#` ?9Mp.yutb|Zl#r%ꉪsEӎ BӏMYh)iz#=8C⏅ 8 w-Ɍ?ѩ1\TuL)[VTfvQfY!'IqadDdc vDń"=_ %=ÚܓTF|X?f .J]4>K HO|vMK Zy"y2rD[ :;/$kO+Vx5)_#=L G_pKH~?0#4k!Tm?"yacZÝsmk12 [4[68PuaT5067hw`Xl = `v$= Tm:!4OT]0r!z5XXg&04l E Ze< y}E;opm;Wa, mפLcKo^H4MUu' 9Ŝ )n:Tyk%ɑ').PQ(|bnl;t[oWqIXM 0 5%gdzۘ&C!a+I; !gpԑPŮΐeL o tJX Aba+ɓzGD9AY\2d=R41cNhW4:ܤ\oj p| LWox,:e?u#RÄz܀i|Qιwn.&|OiRK\\ pV[7WKx`Uq3,߮Y3\(1,Ct"zك7ߧ n+Q qw]/'1'ۉ>g>轼<]uJ[+,wmQ{ Mx!?̷ݘe1mWd:&Us,8$sdc|r'b0efo쩳f?פ\y_@v$Q9^q[H.inS5[++:Q,~!i\K5h${7D` lږt6!Y܍{%fw_hiPb6w q/j^r~Y{iq/[CKtEl+Ptl{NsL{w۪Tw$.Ydv>jhG@3M9l/z?s(z똝JtgԾ T*YB k#HO9_ɏ3p/O%eո4> lo٧!yfv:THpoJiO8vg!{t"|j[PTqjNܚsRp%e{=Ip:([ʭq`5B@F*~_wϾUួCnLa ]g֘|W鐉C9i^&: zv7'U̳ #^%7"9S*ȇ(2pX]₎m"00i$-q֥wdV[8'2¢MКyi&*4frc >z#B0RLFTQ{TU p#zo%n)vk L1n{N9>`ˠx$`)LF 8ϽCx"4R3fp5$* nce47VZ>37q:uQinE3ųGǓmg&7rXƟz{Qqp0sBvےuQ݈t_.k6 ;}h,ۗln-,P6i'T^ 37l,`I֔p VPaeL4C4kІGPPO2ξ&5袼 5TT8]HQTɩuM[ 4fǓ#<] 㨉a6(j)|䖩k~~)3nF m6!cr:\ l~Cv"̆`$` `6H47mxYmIeʂh!>J |k3XvQ-VnpӡܜܜfX%QUKR!Arm/loN|>e*Pxff̍hLi91ÇaPz*N(s=k)h;Y^ޚ}̂)"ޘ~Ȗ>mSքáOR ٻ!Xj>1l>a75AL6 `~ ,>@8H\-3emͮ%y@(Pi 芋(xS疎k.sս3gI޿;p_־JѺvڴ.C м6Z>IeOȇ @؋-t!_G4/⺳Z#/TWJHMgS}4uv0# z%.rqBD}?ffolEh6VUGɨY&8un_`kiw7㬹փ$M}M>Xom޶-lB%`8!zKy*}pQ1~@S؍cAIVԷ4K8+HuvLrf3Ys?;cMe4=clq/-%({lTb.SzL[ AigS2Pb,L,W^/A>vŇ/+vK*i 2dA9#'ÿK/p*\^tڄ>,zVPu,̖^=kǃ3 8I%wSDG5O۝z6'ěX?yj/4WSa) K6WaLlH0{CZ!Ʀ?lssX/|o s{]A\>TdۗWjS=ND+i2T/ |sD0g-9V#^=矮(7+wR1W!}ck`+>! ]s ȮDTdo>]~]}fLܳã\Ч򙧯] ٫YԶKP"!! L͗ {!&f\nTڎj36٠oF<:,-5uNpR+mY#5"a4gC!LDw"<1gr(YQ_A?"0hkih}'6@ &+t_d eĜY8mP%ļ̩5xg!6¹36jK,+5|ƀCha֚@ g|UՃV}9㤗~8k L.Ә'o۾}qqQ~SgbIA~)\6r?K/B,M{`,eL ˯1#||wu븥[)dC%,9sc$l9xsR)A=46ρZcy )[Gf#͗ڕQ<32$et^tr6P`Lǒ6ׁ Y͏{ I]^Ϲem A޾~\M * b2_FG`Al!BF/rC N!::lTnoPDM,G3+}Lcy:rX#0I8"086w,ʰ*ȿül4ʓۈ!e0Y6G]FriOZ&sDDKeo[7H1t?eYzȠuDaLQU 6N qM1.AΈD}4ڎf`J5fLkpy5`.|3寰FAL]{Oy>)? ߵs|,|_4̮z#&!1w_>*WS{GX\$k\$ط+Cz X˃ 0 삳ט @rQc.B>1 !hU qRICLz&Fݿ.T;9>ԄH G]@[,oQ3HrY?i t>!ˑ!3eMD+{V6+U^C&BxVe̼Y3H}(gJ`'kx) a$c2pa36® wMz|jh-ruƎDHjTc˭g!4GG5RodO"ļ=n\jj!i 8kličlzYqСi<ߟZs7AJY𺄁<}GyK_+7e~2={;K *r>8Qyz2;IHĞNt 80u*Jei^Ɔ`Z'JI>>` 8dJ랠yZK0ێR&TtDXq)]u5NU߄qS-s} H~H*D@_ңV Z[&}zCEE[#vQ,^: e8^7j9{,C,@9lGޮM :|Hb$)%c/w2O`U(A%Uu )~԰:&[z>_\۫pOü 70bŁ&45S&}C|Ft`E +Yׄ)<&|M)5xbcȆ=N#ު;ݼKܼj z6E;T7K:ڼAe@:VOi~e Ƭ)]˨5M o ֒'U{{2E$mhem))}W$tW 7=t7٣ #D rUp;Kd'>KEo '8 E <߾x}׭u!XyDh`PE}u*o?-HA-߃P`@v`Sw'/TMFPeENYQrNK4۰ղVdk2hۯ-zV*CE!'pi`}:/K-D&4nL}}M.Dg33.YҶ҅q$ BHTEi(d`_I>}KncNÊ86֏T_UVzڮu sa|l;% .9}O*nIk #?FԧbϕZfrw %vo" \. S0G$ KKyǪXiG=u3ۘW'>}yCVnXѝAckI&` fp7.lǿpʖJb\)*#q -賗?DaDIB@qCA6etCiW NmNjˎFP5*KZb%4tm|"?;¨k}A@1+W΅,򝆬x{o^x>,:XXMXJѮ`zZh /i{՞wҥl6Ȕ3Fy;rBjI`U†l$қDu~=g=ucV.Gé LQqD튇WЂ@,Gc |oQG0qnJ,K8cq-+l>1 T֛?Q,Z6!&4!P] V]f7]>,ș 4rv_]py, _[B%+ȱX 3e>g&S>m᛻#otb[4x=zB)Kt! Jq6jq(J6>'V;DqiJډ͑y1}`lQb!wsLąӞ ;x~Eܶ ;^0DwvW-3> iWTU&ULKNvV3ga8Z x_:kGϑ EkA%asNs5cWw0zPMlj7rS$ӷ\Xn᪷0|*^"<4[}BR2r_Ob(7*vSEXA H[)ggϸ1 ȸVV#lXؔ}YlV'ns+OeW)BuJR2Tѕ{vZYJ,<&m4W<:Bp 6ZC*EP XG$֑IqDe5QE:%wһ=&$'V3k/>*"Kͪ|Jd}pfY P)Oc¾j/J?o 4+x.z+vO췁I/Cmrr%jmQ-'ы|7N뷋!;*7o2 G0YV0.vCUI@eJuiz='݉G ![KћcpT4l l9K@ J&&EM< n-=M <>Ȍfh-vCOaE9F 1Ո^a/vU &/VBJnvE^r@ZkahQQR/z'头Hk:ZWI7`w|FoKdh+mӲ -DDݺZ\#R/,:tTyקDUgW#k΍W.k@ߧ:ü6n4T6݇ .OP@|AMv2D3K.aWԖ|Y;=)H35ym_/,R"mժ^ :&E/EFxUI{7|9 hd.dX=UФj#ɼ@_5#Rգ-&x"2=VB7FyO50y;!+ifyz$hB|HW 5#1TCۄi\X|fRm (c:ӉhF+|{6ž=(bu$geS"4ap%|FyTͮjW%kJ yP6T-l}c@W[齊U~+/ -6.KE{8VsHIf@Ćl≽vn"n-k6Df3(H3\iKOeb'NT%=nK5/!Bۚ`6!ո6']+MuɆ4=sOqvE(lj>l yzt?CM +'U4@T'⪷M(_A@T 79Qf0'%8PrL/KxuCD̽A&gB![_qYZL>Z8 KR85k ᕫõ03qϳO!P⧘( hPO\,74orS!05ug\1ú /AxukLl4r>Y<[XeQwKHO~;KڪWIɖY3R(E]8|/Pm0=M%"HM1WyP$tqպbAU Y@ހdl,k^KdCuܬۉ@2"XA=f껢t.݂#9A^pE`αOX$$&#DԦ̚+ձOk̼B^tv6 laETM:Փzȸp܏;jH-sPLQSd #1eIFjvS#yx2m՟z|ǽڎ$]P#gأk̂ϏAT+4;f-"ޏLWPW޽wC5648yOՍ 2UZ90hnzG<A=a*h{bZ*446e`l=L ˵[C"AX\tP!bϟXX>Kΐ9>D뜙lg& si4I)857JHɃna9scVzj13.O/( ̴bx:,NI҇THR+)Tha1⠀W?T6[!JS't9k߁QY^3$5a~W }6~eCc\)I6`2@+b}gmI&>z1Gna*;> hPGg@vI5̫4TzA`FTe'[Z'gAв&0A>:#PH/YNN'ִ1fqW&͢-zȤÕjjF+J#:*5ligiX͜8bN=<  pA19vaCPjɵ7`d&'xetepr<|V گ"&/Ikڲ8I0Q,{9*jP[zT`$6?`pKY ;XAHs'\ Qus&y܇?2GzoOWOTG̉zEQ$!5 h19A6\91j#uПUH]2Kk=`PΒ~z& lEa:IT:)sUTpSN7 vƒ85Vp+:={q-,/F?wv]B0<ה~*.q'5 SoKX+3UqGrquZ$0&^ o:5רRY榵¼Rcp(#"{ NXQ~ p387)U-)xLaUuXW Ev4Ώwv]uJ?L:5H`}LJC"/"9\(ĻP|HeXԇyNOh;4LQm0@y ؈+$/o_T:فψNdQ*Nt8Sb2 Caev6;$ J8qFQx \IHd8C^`e)+Qy͡BΟ_xY]f[*+ S$堜z5L=: E7Yϧ%x=|A`֦o侢a/fbZǸV=4/d޹LS GMJtԗNWW5}f\p){Og/1` AM(B2*4x7I_ Ѝ­J%wBk–\03ߥ-2Tg|?i<"eꔚ1Ɩ.O~ [jCZtDf Ouah IbHzXU>ES!4%+ +Peѱy8%2vw݋"],x= ?dJU?0[s=A9!kQwZDfc6 ,_u WXW R9k|p^Vdo{vXGdhESkkK 0,+xO.eHK8 VҁÕEOs8W:ب57isq"$j3;]AXI^R;PhBˇX23e붳p^C@hwwL!E8d"|§|Kځk1 ^_&vE%JtYXPTX#ACy{$룥R<׃\V"SCh5W׼RQV[W*r 4uJĆmSU5x~+^[B!Mlkz)d_4֞@t_TӛcKWJK}M3< 7@#'dPOW[ĵ&}+dDyfЊMZJL {twC]G7-2j= DU0X=I;2z8ߦXp87g3%6BM֧JTS;=-[06D負2bOgV)xJEso~!{6އ# gM|hb +ײlo_zE=.5"!=a%R[?z*V R^#>5 4e #$樓}sNwغ?6WuQʡ4*<"ZB5I95&\zJfx"QqIJ.gYߟ9XaѭkX4;+\Ǿ4|eX5d#a?j 4v yb~a68@Ob br]T6?v&EЬ\π 6z\]iL'kAtSs[͜Q(zJT ^>ߤs0Ja8Sڥſl89TsSL$9P %˘^pDNyK„O3*L,^Dq]ib_PLu2ci˫G1$+\hDÊ+71\ZьWӲA59O&1W=V%.Ly婞 `.ntЗƛDtWJȍ PܣVzNd(Ԇ sHj:k|)>ևWn1$ˏ雪ڮ؃~ZЪ#;p,v38$&D\W0[>p1{^jsO#z m˃kD{9+0܀{+ &ݘr?&x޹z@waL%eC|$,h8ߡ¼m^G=uL|1i3 ivjkCAԊ}'DǨrR~(ש`mr P,h&Y} 37x?9M"/*3˟9^ꇊ =`eH*hr3տwtvF4:/J2nm/(eCKL HVLuT.\ҎlbW5qDjT 2vj%/Fܔ|D"&K$[_A FP򰿏+ $ۥnX>ўHg9 _fʳiy&gg p0ɧ8:SrC4ٔy 7w֓1%]\I?`S6wK*xfjDFY`؃R统$2jx1לcUs]Nk@޿&;[% :ĐK Vm~^5.gRDºp)w MJ c6(,(dmڟٻyd]b~ɲ ͏36x@M<Ǫ4 [8=Pq m ('} dΣ!Tz& %w䥳@h2QrsTV mq^ _GW_,#bdEuVI- n3ڕ8-St&qӶqi嚣*:R~.]l:}ba=ϙm[:Y3߅ۙ,O}0-f)sWRI%wKwFF8OIDzȍċ`Ei/evmܐüG}sꭙM mq%QN7V:UÎ;RŨ#*8[}GpobƬ\^Riۃ0+A&;W5*Z-&#:sYns d/Uh`Ja)'28ć⇖cKE-mLqrW~扣dǻzN+A 61{ļa7Vj/4l2gy"0 |TK ?JА8Gpp`s#sɕF~%^Z*z}UnNTGQR ҴC:H&FV+ow[ Y R}h@iZս=%=Yl`w΅+RYϣEQlAP7QK8G0D1Fi+#vJy~ zoFmϋ39?'R:-%qI0m4z{UTǢ>\ɛfPGF.ظ4Bc hm"ے8UoJ?tpZЬ4 Ȭ"f̫/5~8[>s2׳%@ٱqh0zRlS״)-h#kO̧1"Jx$%Oc W/U-3em @LbЦ^OF"#`HJRUmr;2S*#R!%\vDq'Al LrB\]:*"U[}8٣EgN۟Wב~ @B;_񰍱^ջg] 3Hfn) y6]VTӰH9pmg|$ Z➈y'9-1B=kD(~mT rz]tbᅉsێ;?,@kTA2q{pA}dU17ʆK?w [:ds0S4@bXB*w/$N燤Cn᜼jhֵ`BsNcw'f3ė1ċKsmipcؖHs`}KCR'RW"Gvw ^(ZN$PaD td+u,Go׭*`㍢TLVJT윫!Ȋ7Ί%ƕACB3{v(LiF5b@_84S53k䘲l'b^ZF#&T͜\Iw߉CW]p)Orܵl.#qڍܛ%Բoӻ9:;flYoq &ێAb·Ҏ^@ S2eO.0TJᖡf6"L/{_x y泴O ź72 L E{K4Hm[=Qvuk=z16E@Ff.ʚ,?J Db2 ˕NQG#Q/ĪNoN%p Ԍ;lKvLW@֙#|V.Ԯ|aW;],?Q{7NI 2O.=86ZUa+t-d,@k_k!'<1Ľఅ{(\\w=W¿HCil=F16>Ťeq~7&R,)JǑwo6 ȍiůH _Mhܼ|pȦ?|}Րnn.M"=ۓueu|cJwеfGQbЂ;R.*VnLƞ' ZX%OZD4V*ۖ""YN|Y_U d+Y[OrGF2F;[Yt\#T=]&㼇b7ʾ~wxϩYpP^7!RsfVlMҲ_PT˛?,&_::n^o^'.ll,0 P3E6@Q(᫆JPz/3-CWe10oO1(4_-*Lr,Xm}(mE4NvX[^v2EPy!%t)&9DHljs?Al;Σ A1a6W 8_LY^&eݱs]yRRo%sNm6!ĥ ^@= Wjg[){Gp q{ܒC[fIIS\v7;L5YK6}ј{zcjUrU5o9ǪqXEeÅ -ZLu3ɯ6]t"/e|=luo$Rd-]'!jVfSanαGrs]ryѯ3Ē6IlUe]IJ:RMCg5#,7@=Ͳx9'ȭy 7|0H;L}Km"q8P p上C!r?A<1yعw5jF~,ZÀ|)w*d&FrLWoI~ћY_ _I Mq e36!gdȞpð"v⺨4;6v Ʊ"te,#86 4 MzD^/e 3A {nYWYη׉%֙1Kâ,3󱞧`l FώH}Wvr7 xZ6qQ5>Q~+MQa녟(8Y'en ӑtPǜJЫJ!3W_PS }R}ӶZX>R@++\Z[".I;/oJg*֠Œ8?.*ouFA plPBפj' -&ޚ"U&7)6M[E 8TwR%MDeҞ}<Chx O7]ly}Ў^`_1c!y# X3V(pFҾy̘[ˀ坬ؤEһqrI2B?bwD:lpaWHo8[(Gm^rt1xu^q hڸSZ16\'3ZpGs yȃ_7mK tr?7)o;Z|f ERŀِl."mmKyя^ATUĺM@?,$!C4wK fe ᓸNjTP-:qk~wqm#S%_0h6W?sc}x"-ˤͰ yo#(tLy_ >9ම۝߽w2k?\"(GBs=IJܬy~bg;K Un9?Ԩl/;[Ov^5d`Hq6,(=%}asN6] w׎–[uChcLpSt~pWZA^qƋ0qSMөXUdlѸ.YPN!55A zy}9E*р-{8GIliq2@Dz|{Ww%fՎ8r 1IaŭS;CG0e,YlxE'~1 3}`cIYJѴ2vWWjsg;`$,OK~=7"POFo* iedh?̔ +9< x~q 68.^o ZpS>brD#G,"?̠>wJ 5 \$dw¤RֶfM+M7>gW]mv碿SeQ y5id>Y.㺖j5痍.n&-ؔt)_ϳc‭XQqU7J粙JQ'A9|p=!JoKw^5Nb;ʗJ#-=8959T\ (?'#V18M=JdDil"GˀcX kxESۥ~V6H׼ 5z4k`fEWZC9.c6~8'S12Nj$zlR- V"j ]҉i=pC m3)vF7ݳqot9#֨ +L@^f#οOeӢ tUFddmS|#֎$ }';Y2K^>^1a &aw5ݝ0{H܍7Dڑpf*,Rrn%RQ?K?|2I܁(ùò8QO,+/ׯڃRJe#\pP

ڌR<!!qvFt\[ev^\O4FO{ du >qT-o+0f?&b7C؍$ce:j6~/ 5)Wzj7`鏎S4Y@9wV y.a!#iQ^-(g+!nPg9hIY>иzï~rJ\/_Ooe & Nʻ^xuU^C[?o"b Ȗg1p VQDeU W*{ *QT+fUI?v`w%lxĀN} V>=Q@W^ r"bf-o=3ߐg6⺏A1Ս&h뱱k\7n+CPĂY^WM='Ԭi?}jȺ֯y TTZ }ݾkiJ;;hȟLB-ɝ OTV-/o.[9Y{{aGm}]g"cER-i Oɍ-㝁R. )oWP~>8KK\Z}%~rV̩%iǔ΃ ww/XfoIcl{ Rm)芌Qi_䲙1oЀrK{L*Wd4q{OQ^AJJ-]GAN<"Ƶ//'Q@daXԎlP'nD1N݅$Xaxa5@&fQ1ڞl%sc2| ĖEδ󣚜K0Gk NV,1 r*7&:DEvm[͙VLa7 H)hR8ݷ5]d7(a4-WElˡ9(eX@?ƽ CAdT %JzQ?ʱ:tQL',Z]:񛉒3_~MBBhb=dCE§S{jg]za2$-ɎȸN\'/gҘCz6$p{aA> EjumS>{75veVj6L_Ga34~Ylπ [UNg[mE /c-&k}ق+1v.ۭ2Q1OInA5Q"xD74 j D xQ1hϝ / p`‚s8҆wzKa5Ǧ\/"RffUYS IZ^)]e%,/h;(=7!6t"_ fhpE/c`}݋BnCҌ#`τf!\> x{?SyeBʼߩ`nPf>`G3K,Y紬Vc4~)YF-$y 4=v"&/5Z1K lSI۳*OOLb/0fP/_0ӈ/G |o1=AW9'@yԒ+)OvAj"xWE>/SBv`mO}[__HH{@l-qUءԚHYߤQv2DՍ-,c05 :{U`BArH-Lʁ2ݪϯ:+q;oO)>es:vW.z?P fS\9)Uc6c?0*^=yVCSB,X ׾ln]m//qJ+g4:2mlcޢMͱ8M_oj3#yty؛c,1ٲ͡Y+N 5K$֦x 7 SvEȎK"/P9\`ǜ) Y~X?Ήg8KTUdyPi-|W^16&V|~_bd~ji Q')#: N"Vc LFL:$y~[3]bF %օ-Q+mY {3a*v?V5 (Xg*Hh'~\lm1ns޸<*x !ٓ/mPĔŕQsi#K4]W|h>meǙj`pq]HFu'as]l7 3#SM1[+F@+ H@CUEC M ar|MswG^0a:cWG %޼#{OOW~‰CO+SKg^@>$~"a#P\Rr{~ ,j &iީv[\Uy|o|.ȕ0Qbf !Z&㏽TѨrA~Q]im[єMzOj0#ׁn~xOx(s3Q4M_)qK_n )Mfu=Xk3nL n{$~>UWqB9+s-^H ]Vo9*Y^p7&+o.'DwߝegwfJ:z{Ёj: K}z,0I$j\vXi&@JȀC d\}).Zk30|Tg(6K%rbP6g LO,O'gܠ勮~i ?6[,eUɆp_â|}|rbI[Bp#ґ Y>Ą\S<߽i]`, ۏiTEZ<[ bKY'PV8ڝfUtoZE E"4YP#"!~ۤW6_n 6qߐS q.P"ڛ-BSo?k@,y!s 'XpI&ٕŅz4JYMAu)g7=\sBS(HT$/J / 8,NK.|qҬ85uJOَgu/C{([5]ƌn8}z$WqKJAMmm|iڡfXŷ}a^W XfXR:ܨz =P,=#*^R^JDŽ_U1ZI(&p2*0F$&Ah孬 Tq 1m'|yǍF(}J0$Ük\NGLb/&`ÖT`HܷMxx1~#-sc=a6=8RQVTAh48h3c80I;D z}(:nE$R m>4}-pGs=ȟi2`8*'HNx(>N5. nk{o.o.欨%iM%ЊCq!D[#`g\k񣷨 #Ó~UӿaG>˥zӺrrO.c '.AF]}nG jL(& FyX:RsR6$ )#9ΝocYlU I*4CAlۀE2)_E]w5g@..w,ےd`YVjǼE;j+HJ\t>Q9`mhez*ןıDL%N7z,˶N (+dÄMEs.`M rIgw욖=`q)xКx"fQzGD{ juz:OwQT $ 0mfJ*{^i%]+OȢULib_Ò(ݰtm.x.kY?+L{`e?h 5I(]r9-H'$=an!3r!6٪JTnV;v[ˋNO\8/Wˍa&d{rO9u!ON{;l[NiUМ#YNlma)߼yJxSwr#zZG~|Xywc^͈X0)wrozK6=uMnid9fuas1=!ЇXeVkgV6њ1mW4!Kq)xQWx/i`!^4_tۮECvvC_˾%aS7>\"G v-\WOPo 7lahIs c-j}D`} EsCB4dz|H9j1XB`XqڃٮeJBbf) 怵>oAD+{* 8;SBjv'EUizäIZl"m?s%SGnVj+.n90>"rbqr]uqYEd'7plubA>½Z:O*\$e &Sw{!X6Y]xǂOy )DpȊ|7=^frpoug"DV;.oAW e$Ɍ(.ŋɯ5~~rJeij4(nc+Jr&]nG5>Ki70k Ƙ;Zre[KH %,)B='Ԓv|{H,N>8VᲙ[3Sv\X/a"E:c t,Jc/ NV9j\ء$ƙY#vkgݫVsɿ'),/؂$&H9`ynagٵѴ<\Iktz@ RUw}b"g^s;(`_Rt1dDĖKx &XlPu<[A@:%k--3( B;cpGjC+5D~;>L:V2Ԇ T_\=7*^_=L3ߵ BݗRgUz6]t d/] <T7H°z.L,wKԬ nA梾]7-X{ sN 1"uB7g 0©e8v"-#Nwe0~i*@A~ z>0`ЇfI ]ޒ_gM[85G#l<䢬&(3`>W.GˉDd'jo5qѢ\nCwz_c]i,if9@1!'rّ$cOEg3 Xћ34z8%YF@lђpw.s=9…:R.&F2buV[ 2|~m[mtiŐzwl1gR+DzD>bl. &2XLX漏}]bt1w |oVDre| ld9t;զ׶Jqq~9n5#֨/vf)qUȥ.8]U]FBn(#Fr^K~+ ׇĔ%58gR&ykә}o7qu4rQ0>mi ?QbeASp~}޿O0E+>}>z{v$Rwjޘ+S{y/wxCHZ_F%ünZes(rLH_oU'v$bR30]7a.5/fkT.Vp8wI0@ Ҧ4q_$3dw(FzԷ3D-MHz/ a_=໙䩇贜 Q?[ ⍉ٝ 1|?m}-UiMxJ-(^P(1W;BhbAgfzfEqmiJ~v׍"d-(0qǔ45tL3R \^li4SźL'G|~䚶AdWc ҩq<&m뿡[& $&{p9T"EQ?T<Ħ\E p F[yh>yYig4ő-5 nbnjnX: '* eR|%UDe ]P^&ާhYN"aDvϺ^Uxx[ P7Y.nIUlӑݑ6xObD0BB5YK%vS} @wuv ^PŢgoX?ݍfeF'cWc4cF? i~湩6bj=l Cfi u_ m !$K)PfnDmDaG~FjD9u'1p~(Q;)Gcv'x,P\bŨO աvxB}.WdW}з"=*)aJ #ZwM l. MTo ~h=qMk+c= eɫxj Y7t籡$ !+AK Cq2gN[k!rsE* ')Y[' Cָ:^qGc3Gv‹/Us| }yǛAfSRbj=mo]/SPڵ.4og=YםwƐ1XWi75(L,˕̧,_}q> " 9J[/HHK^QXHs rQ| IuUÒi<<Rok~QЅSQvZaw&>j?V/HV_\)@!8XӶQԢe'ȐbqXTY,㷟opj!fC x?9^/7sxv[ǣ%U܀`@D6Vs~ =r -~X8Y'ggahQisXvf e1{:+uo#aur+ە:4 ݲ{3 %|6{ }Z (m==DނĔf|g{m#&La!]7T᠔10Q[ཇrt-=0~@W` 1YPoֺOlN PKD*hzX>`ۂUC89*6RmGΑ#9ȿk<@ygYh|y^ܕNbI8˓ _7«˨g3totur~=gD]s/Ui-\~'WM~CkI< :*8l8ui׶_N?ne68< ^+U+l}b_P1)U+w- aE1k<~SM"<՞=^9􌡑ý:˓ xSlAOIU>á' ۥ >b܎ݾemh+gwlK ϣ%G"LNqup4 ׄuBE1%O4׮\yRކ ߸1|-W9 t"|"C_jng1-TmSBY8*(-U2c M,ysXpTG"$)L)^ Я?{ߺ afQڔ yҟ  b0l㖊f#;u/q8 ސU~ Rf%3)alka )3 0qZl@,"=M*C*.6E->2<*cIe մK);ebt$hY{<LǯP{"kM S|tL!To_XBȰ[+Uԯ:{sjwfmHC"]NJ=i7MҏEb X= VRbN]O̲۳GnZZw㡖˺#d<0 e+yVBz:V]|T7k ,9~c/KP]`6;fMov^NgES.kD;X%SgmT)Bǩ* o+uI}u|w"oTvz3M}65>v`>zm.UR$~/m:MC?}˽6N'4Ye(;c+ϗeH@1 *sr|NB #7n.fK&ޗE!BR ^ߎ> , G_r7PGA =Ðbg4i/fS'SwlcV <~Ͱ[nKx枛)N&dBͣ gHm; 0|+ޱ(l m\ۚpaU qLu[s2eC.3d-x5hV*um}͡>#WKIdo %.%͋k[}, n^.NaYbW#$"u_ޤ_255Gzc2)7GV% [ؾp j8m6pŕ"9E0mB\?E's]VTD4u*T)'|=q1&s( 9teP;2f%1p}y 82 RQEW-͑#)qU!=@=ҳ-8?L)l1"bj -Z 9+ Ql&_d͘Qm.Zӈo0}lmd=Z^sHfiAc~7@fAI+ZG8_j^fXMƙb4jGŗm̉lo#c::ք.}7Z7e+f rЛFa.Rvu'Θ4)07vgfӄ5Ǫdd|WqM/Y+4ޞ 6C98n ;whA8t` G-dP;Rdɠc?DYب K"ƉD (rOkPDf~oh:XhSܳT̄ B*Ide79 u S$jXCIu/8_caA=IXH~SFC8eZJmٹ|>ݰxWl&e*鱙,T,Άә=m~2N:GB3#IS Xe3)ٱwȧ:+\uiJVAF$kOphp9OyW?Çi$Oc5> ^"Z!:@ >Vrׄh&c U&<ōQ֚_ ? k{Ģo3} Nj4OSl Sƚ&KFr!heC;W\RR3)1-z{5.'ϯlz.UrIRkm+B]F9g$UTnmuQe޹&c^"DS&QGX.~(FxU6 "߭paVQ-)]wQ.֟m}I̓,5kyҖ'?gaʢwfjxvՒwvm;jf\(JRL'&p.0C/EGpuxAH=|'e }A'jjXD^L4u {t-(~+` Fgn.w |&y?i]bk"_^E_wP'=q+#2S7K/Ha^QkhBV(_߇5:э sD;qWsN;'G,^ 2AW`j K *_F}O䁼O#^IW=Qs<LW|Fl0miS%;Tέ\1aU!֤,sR83DI/n֫É,FGZuS4]}qٛD7ǹЬ)7y^: PiO/fZ s3`.i9R)ut+Հ]:<ї`b'TX.{,sO@I_}7n|[F\$PC[t=%e!Ԇy] fIC=۫6Xo^hx~3E#yV¹n҆,p|3YbIi\q  Ml&@5ն gx'}-E#F{. Cc)3Q*8;R66+ 8?QlGoOil:nS P7Bs}:o|sl[ R:V+.MI ~לO{S+^ApmIu6&޲yO$-AN܃Ar]lHd luLqLZ˵T_9AxD! 7Jj]+W9ɳ|;cF/lLIUk|$F_'Jx_ao{83 :Hs4Mr[?) Ο=;_0]di55 Xw%ﾟNO5&pyS%Ǟ3HO=똨`H{&06.D68Dr3R64;2 &5gMcs(\]MSCn3 <Ϳ&p~ý4[UDTS w盰 XEjO=BP'(I}D8KP@5La7f}yC]t~Jǵ!Xċ\u3J3C`b׾&ӗɳln3a6Bv QPD'H2.e \])iH˅,Bz㐰yJZn2kήW!\mF/HS"5h#7~+?-zWH[ƅx4qV-.-p#+?z"r:{Hg-QZo{5¨U8x7E8<#q;rZ . !òXMA2X6M\KH&>_P']K[5eAYuCsjeFɟ35yIx%߸p\1m'@҂j]`{oam8H`$28K[DွIOB| Y1އ,<fˉ4`y!?;@|K-ZlL\]I]ȍGٜ--R&Zs;ԧҰdQ 0ݖs)ypT-4Z"ȝhRXš}XMwj%>dn8Q<74DȩRE|QZ-ϕj,Ng]!lwM_닂ӿּprZx3B-mB70/MMl9v)7U݊c"Sd` -ӎ+F:3~,.8WV[vʿyz-)\[v:Qـd3EԻ"aUNdI8[35k1M Ll3R>hAhU2ɸ!*v󀵅lo:>0n(kRm|{hPq+-&~{^d!5i&m E{1"ld  `W}>Zҕ@l^t!\D*!Q?r3p*r?D :&r Ӥw=6, RUDwsZ@nB:A ;lőt:'nْ|.@>Wn}Jkv*KOsZ 0WL%X( F*8I1+z~YD[7otmC3gAkw܆@ $Po =k$wW!2i*%{ C-r8>$ԉb{J(MOŵW̉_FRf$:F{l%(e;$1IWoJt}_|@|m P~OGou`^xU LO~9oA'z\Nk܎m/ﶷt(L@L FD$?=ɪDPlU[x<:k{.e*aJo =3ҩAkehz1dg Di; BX~^Jȳȳ1!@]%J43p/WzʳImkřPdKԭOra Igb[1#} XŲo4ק%ԑPji Ԋ pIY}/QE(h)]TЇ12gLS qk3_K\XrIg)Kɇ"NM=itl+Ѹj?m / 8C+C,2VX1[M:Q"O"ؒMI1\#sGk7굸ti!G]1hӐV[1dupJҧf14Et;w;f[,؋:}2@mh2Gϥ~%Yv+AB9J!6xǏ׭j@_VYkRzg!_,$:?lp8q-l(XM< 8d|}3BGylR'ZBn*\K';W Bv賀;n-*S^]_ L]4opv/]$NwL&BTۉ aU>YG_:Q5c)sW P#yQ|g3shb{B;H g!ԳDgRdѭkQa4,ADV(A2_]EYm#Sӱwl{<"1$lq] ׉¬ eF&/:¯iV'O@BXj1$u ѽU-OWY³H0G"X(TN$a=G&n%JsSY*oIrh U_j}P=HnɍG^F^Vf*Vّ2]Y` 3Jޝ0}~Uq& PU=HkXt=_dҷBv?\Og<V6_RDM3ݸ0xAf/QO}Pz7`Po3 p"pXNDeZ}UrKj͌C$R*nf8&V7L,~RSJ'i1bzvLt|`ӆ*Wp}&|o@9Mɷug/Z8P㖣o~{It)IzȨIIJS뿲X>6 I;kHK>Xx%0؆V*zg %0e~F1\X $MeV3 }R&SIS`ڒo65ba]- aau>IJ*[X.;*WZǸ=퉹Ab; 3`h{f5X0H+|I=K-ȉfD:"foHo'0ˆ6*Ǝ%Jja@|r)d<#CY%fJvcw9X槴QMuٮI&J1*.buמ҂eֽvQlWApb0jP{)kuy)sj)IAi{T MO"/t{vguPL#讫oR 3q>  䅧$=VB$m}v}禲!ԫN炜h:LVj 5FJK@h_,{ *iK<>%x "302Y{rI>XxdحAR#G3d!^BU R`٨m 6l!W')G׌jrf$k1ћ~]p3z.\H[w'P'a a,HW3P3sJ?4Nq KvӐH7uE B=9F sd$^2B9ܲ-Oo<<65u٩b+5K9švٍlwQFPcƿ 1oAiJ<,3@j]lUD]8N}xGJӚ1+rIٞ&g=b$oB)S7kgBMR밄 dߧyB ̧k5d oxRvI  @N\7⛹5ZIuuSWejmYSX%7v#'F7g%tUXfUP>[ײԺo'Ț8C~/QlJYiMB}W2N*]:-NA"E9— VF^DŽ}Il=ZS;GpAgDž/m;w*n'S,\Zʗ|0^CJ}-CESVqϔV4_#z4ƳYsQF\Y&j_3~fA1hHf`P<ዏ迶ՊsfV tUBRpb-{903 ^z^YegzSz*%6Fq(2k[AFͲ2/iˌS6Z3HD (q*gPv8D<4!߶)L`BCP21biUñv~wwh>(sF-@ʸ`!mcwULTf1][R*s)Rl\0%ܾ_yH&-)vOuӴ &]w (pPO]C^RI[%q!r»h+ޙ_{&6zX)q:x;%rQ&|-|֯@QCcM\4.F?IEI{_ {L_kT`6Ք4մT{K,C]!gj#\"|7ȑ fYTI'RO߀Bߘ,,'o!47e/!hu3'[ =JUAJ}BoYTL֖Mh(υK ms;w)w#PvE*$ ߛ,2!df{ڶٸ:4+|oۢY_'޸/ ο?okW80ܑR`M(^sKns/d %.=IĖp^0(f٤[< tHPrsGncw46v*$6fUZX"G)/m1o>4̼x>)0, #V@P瞷q+)-7jd=e+tP^P  I-r%3G_ZT$i#8荁{u39T 9iAލ +qzD)]6sߞv˂8X# ,>.9蛰{ aӃV!m4fd YKYoG_b7z}W\'=˭c!h̰3]5QH_6j+)MjQ?IQ~]ErМnQ-L/N_'1YOlNA2?_20j̒LNGF2rPn!m+Vf~M,RfUԲ;?ק248l1 43{ٹ=:L_bEOuB:;5'Ț^*kJ>`?]EXIr8O25ĒSkˁTn꽰U'Yh +?}i ?n;ߙa#<eW++$:/߮p :c=Dn ̾:0$ [v/|AԿXS_v3ڂ'GX}ߌ]ĉ]Y!)>nD@pewofFk%AȊCOl|O\le\z֔,R׎p9;έlY^]iC) >)+d?w,-RF/R*>x7_?¡f4D~ pyaGK(_71B3_q[ `Ҍul",(⼊B022(=$Ry.N#5 xB8nDY O 5m>|҃9peg5( =(sro KpPT\ݻB Th>׷ $ ڥ\+WLP97oQUlY}hox޼8qkæA%ISxvB}"Fsq]!DRRc1M#e.YN@Tc!^m{%sk[q9J\NZ`gx*Y:+$*"Xn NlZ[l"p NjS:i[.? k O#/RH najA  FhZSyiaԅR5`Qgs)I<}c^#QcD,26j4.XEe"> ɇ2?kJ~AKH#t rwP /Dߣ` ;'>G*LzIlW,f$(3tlTKI)`X>[q+XãSsA!NBfAft1[g@h8:2`$s@=J8( !}9IzpH` 4הV9 °2fҨR6CрYzߙ,c'MjBq@5U [X|*(ӧe-ޘUͧLuxcI/,Oa``֌P0O(`=G~۽5)-IR2C mXHiϻ&lD=3M lCST!F{nbt|{@WyS#Z᧚d=PQ K Z1# p1X2Ye\Nqr9zX>/<`dg|LZ`# ֞(]iL$,UF I'so[x(ejZ?mkc)<1 )3) Rۨ 9Sd `$}%@(UY] po;i$iϙbvC;6kI9"|'gTr ^N:fйPl - I!-cPj94.0ܗfv0S4knIsen)Yf%Qd(e<2&݅s&@Y0(t0z~CAw6F܊ @\H]Efb 뇽-'ƾ穙*F}kEvVHAtC>)Ƭ ͽZR9͒I"=/urݤRQ/(=LiJ5@5l+0-§RsdBeuա>B?,qbeWUhSIXn-N8EuB􁂒] ѡSY<w׳[f,hXe' u{8ԨDU\%4eׄĨ'߅ʝ59\3?6u|gbFޫ:.P Ć.5#s,tFE`oCDK2b|Mh<$M, P]jTq9aK1䌀 6Ch/ʭ7:զlw+㔈O% ]"xO@ MNh#O.# q] q<}H mȤRɌk4.XSK,p- Lj֌M-X461>U&Q@{JK,s\ٝGc\`ͧhܞ$ &[nK|/ZR vMD B9ϖ Pg ]wbEj,l2M jJ3V$>Vo_>a-=ҡh9>p4>R1*cŸ0`8~$%#v{3*CI^$C=LuExd%]Z &(B*E/׋4gu.UU(,7\NXlF{U49~)ᚡM;]D(&ӎvKn( q׽^!)L\c/U,b C?5P%V0ÜA{0 ;>Q:CP=6ɿh kCC+c3G.EoֺsA+P;j@!0u folp_{QFxS`;ތ/:_0CyMl \,#.Ssۻ6"eϻe pf稻i?P-7r=؀>sT%s,VFOl֒$K{%* lo?]ӏfT'a&uLhz|f~/u %QH'-=]3:}wO87YDQe%MѨ̑1 gtPM>qW2*4 l4 7hwa$s$+ks.@ڸYCCD ̺P9ԊC -0Zݖtf먐n|UK՛~ẳ4b06NH:Bv;3k)I'Qo E'<C<^nQg *G>9NʊaV^] vx8O-L,@qmʺࣱܺQ̐3KkwNlGAđ3\89k%(pZM{ċskKA`[-6i)i$U:؄q@Ű벚ax_sʭ0 >6)(]#ف o~)}QV8hΏֵ+1ȯ{ޞӛJ<>~X=0],N@>K`PeP޺ĥ`~ʹib(Pl> JK f\+|3ZiԜVaԲdfC86mxl\|jvEyF sr˰YR/)fǥ7ɖ.f&m~sI8R40 k^gYLO(ٞ^7*I6^\ܽNQL&hwk%K!ij4Qzj.Sse!o%9-ĔISz1oRin5ytsX #n#.5=~[]%Ovs_N}$זܺ~ tKiQ|^9Ŗj:qcm :4XiLkJm5ižSӽ B? vsG{D0XId7>0n}2f;Gw9Ku`m;l6) Mcw{h`2[etNCSrg;Cx1p͞ngSpԻ<>{V["eu^˃Nt&M>S@l8CzMKZIQ}T[+ҦYAcq/ʈ0'O|9'Htl8 z!3>s%R"G&iNQ|kZ2RMis{&QfO+7LnBHq''Tgh<@p^Ͻ6qCB ijxc^ ^gzy%t߸(UGTNz/ ),^8-:ۭU.1"q>=Ś4)23sQb WɌlZuX|7vLD^O Eʧ沅U=.xk>)~^[B R_TgQ- wGީIyRYL<4sJ`pgW{p 2xz-FW%;ϣo9~~J j@0P܍_w#.*t޷S LF(.0<[}H|O@u|S1 䡠S Q՚r& s ӗ%*|oت!:B xpĵT.lL,R` %lvv>a rGg09 Np%Ԇ"UFN=__S5o[4[ljk^)A>40k:^-H=^qF>Ax<i,PYjԪ Cc]'ṍ<ȶEǤ0ϬLaG~3O$.'!p?fl5%$Ec5ȝ*`嵁T6ϧ|:}@H\H ʏ99M SWw֕\u^e{mǃ*`H!åuG:'m=Cߌ;\z0Yz8a)Gd(c3m?uRyBa֘ދo,Lnوp> {X叙ê#Rm眷\2%`;R;(c!UkizWq Ey*rwGD1 m0|7S8$Ԝ ރ>+T + DC\g"i9Hc\""C<^Tdu#7mќ?y)6,DtJe 씰,u˅wh ΋k@Z %YNzӗ)s7sv„AKeV >T0ӭTw&bod5|*O`YuLZD=x4L1Ad1^TC-x鏢nm8Rw>Ai%̩3Y%Uao tеdkuuD[ ?6s>fF;9}3+_3VWxV 62 .NiR&b˻Ʋo&˰Miyp,$7xzB%N#Ӕ .+-hBei,=1F3CD>Cm/Xq7~6/|tg6B< AiPBޛHLbO[N8e\ECl2¼F }ҁx>&=f*崗jח2j]تL┦an&9(U | MlYo;לLJQls2O^fq/6#~_ q H5z̊<*k%̰x1 TbZ"ڙYǘ HHn+9M0DNoplJ=f]ƀt{K+D$@ (NL[߀j|/ ^c*ۅ∌⥓=aeM-^1/iY_d"5ګzV  ަGl]&58zoM1:qlZֽ/r3gC#iR#DAÄMTFIb2\3"8Eû D.ZXJA~4.NT]x;4cӬbFmWÏ1;Ќa5{-@\ИIzԝZϖD9,gPȅk[gp6ȹT3iU]7Dj Rڡa~J\|l9s9*K@h*e3:!@kCs fXdzaiIo{Ӿ{/v541 ]IVYEq@uf+f~;HuڄImيwN^],ZUl MDo-Y'm}yt_BH $hY\RL64ŵMk82[7 {`4rFz>bTp:Sm#TTirjnp m0vzje蚄8e*:Eu`>V,˔pwc`|掯n(h.H5g^^e/A0 7be*pH!'!-_302T|lûyPw*1%4"&8kڌ 80ExDNQ>F P Q+t1(p *)eKF`#v%]|Ѡ7- ю&Y R…NJ_=s [OCQCN~ ޫ"kT@eڃ)fT \KL$qge<\K [Q 1bhd8 O'ڀ9 o)P]RrZ 5Y!Ss0{fƌ߿̷jRjw6uu5tEZZFfovԥH{F.\OZ ̀񑀓3yc?Yka/HJd97`sJ)̸ \-+_3nSD6cpr\ၽyMZPC˦_ }Yb*>8y(5CLbliD3Ag 93LR닀!V]+LoQyuټu _P7\ot1Ey0QBC ""uQf} u* |q{tFHe|CT>UQPɀњm9.k.|}jju$3@?j8Dq:,f0Q\WbflBO&} BEi^E2P)=aFo:5qmq^ $T?u?V[*aC /y~m)׭-1D T]M}vL=DŽIO KQ\ƈZv~U$|alH+],sLjX{KR73UKXX"/.\q삖~1 |);'4Մ9F_xy:GM) WRۦI(饂UEf/}#ܬnHg *(&!t/~ Nʾmg~9&K&~*ܥ k\m /ESDUfY6B2$~_ONQ֍8Db JЦy5ukJ qE`B:q@ %E*MPl@k ]K$μsc=fO -eQ}0h3ބ)D"nDATJ3+*ցl*t8l_ zi^2΀Vy^|H߳-ν"1: &$7ӈm]ϩ&fjD0U˟_RMW SFS ߦSk-7É>ZfSZP_VR#eaԬ0 ik y[&tmCEY8KJ9 %X-m !R)oQ8:?Ce/g@]ixϰAKj0Q=a#p"'Dɔ)7TNvGa 9Qk%%pT% =a49?ԈDS!ֆkC#G kh1 ly9^iY&ZBjٖMV1}t\&c[Kc*ģRžnDgs-3Yn`XÙ=[^`_u\Xj=z٧3WU^͝o{&Dj_ K8Яڐ+)[.I=ux>ޱLCuTqX7 rv}g#0z媎T=p݄'T卡>}rzf#2q\3hD .6Պy<ci ܮګdêH@Oi 2|9Y)ԝ_7EcӬU1aDwE &˩). 5R")NsA(jYpg4P*${;q?>kpPXD8ڵk [hY CRc1(1:E}N( T>.~a*|@"*' \Pp#1Rz4ps&6v%dU\7 fY+L t ݺdB,Y+Զ Dո#+-3G+CPJKy<|`vGzp sStIsa@4F^3=VU'T;ѓ`_馞~ZZ#{кBi>`X~߻MaFFTӰxxmAFWN"!ݘ{O(5.yCD@r\+BYkTa<[gIYD3\yV0R y}^יwS.IpI @J}^h$[xIѝ*"Q&G,~kW2pDdhGMTȮJO1Qg(t1+INǠx Cfwn.6J̉hDx״d(=A<䎈q^5Ïצ*jK8>Nw]*aӷᰑNLPtd" ni 6AD}ͦ8`P*n+Z{$_#/BE~gǼajDZiPI:6R[@`+)66n!\mmsjc[A+n?C9oLKfU -&4"ldzIڎsףсf㫇>SQvE8B܉_)'2OC7¥Nqy{p r!LrR C CW=-NTY x=JĀ:j%hLk,*kiXJpt2^R&t#fK 3/`b˗Δr0-jQ|,Zz1>4lu/t,{w'4eBCMMg 0Y蕻yJ(jDs~\tMiј/kMP>\t|z^گC?: ij ENqtǝ׍'gN_2,ʱªCOM'c)[ßvQʂ>{D&՞#;t6w8 rx(_c%~/=\ 0*p8fӐ+Nd{QO*Ky8 z -t`6EQ(h5,fa}Jj*YW|7 @mq.Et$ת&ޑ@6b,?2DoW~\LwJ١.Mద5΄I÷cDteb4\{GtP y>'~vi\Fl@c7Q 4ɟ tdR1E B/گhLkkx2wsNH:oH!J3~V:%}R? 'xPSҮډ3MQ.rN&Aa?q72˒3*e˷XtT.!ˋgYh/gf8nXfAoMt16((ϫ#B-߇ɂ_]P4w(4+VI+Kkљ{?~–V,h0(o $PpτYl\@#lă@?XSg4Ӽ 1lžm5 ߘܦ콀VO"A{vG#%=KDV)Vx֙xO+v( U{8Șߚ]W:Lika*ܡB]M땞!g/~a[z:ϣl`^zw*ltisXFS+I읞׺?Mr0)2Z߂Q/niRAʐx]oAˇ؂xpM߂ްI(V%dzW9zIVʚ?e٥<7ƫɆpSRgD#7(NSOvea/K_4I78T: ~Ɋ{id^*#Q{":m|(-=1@ʊC_)=xpS0ڮ =NhD+x%9`u^g32c,O M&y{e}tqhŪ>%5<'T`%ʱDU6xU11>N>=W&c[Hoަ0n8 6UB}Xph \cٛ_ #V閔Wn)Z\DN giZe9ǂ6t} [(2N|:Fyeq`dl0-X-'Z>V5q͹\@&.]?7`Q(- &AT7~ rWẲria%q~kE 0~'&'qbx9k rODAd_J]P(p^8m,?yC_11ۧYZGv |T1:hyr<5ozc})4 wM@Zib"2B.'C.ᗪ5[U[äPY-kթ [r(Un5s SFsz~A1|؛t46pCax4rlklhJVYi1Y0|4[u8;[Q.NR̜p8CIMy6Ś`@.]`{ lϢ s 0/\Q93b)n aoa}10E%ms+oFfq:YLҖMf|\?Š ,dًkp\ 872e3&QF| ~x&TBg|Zւ=5p y!YSc_ 1(omSXul -.{)&Twpqe!qLl #B́_9 [h.xc* -x]5WAJwGTg̛U"5u k/{G%x)2X'Eq[6Yp';\S%"A db%GE LPI1?}ɢYEm* 41a9Se)~c-2G aB>wt[oVp"?H4&E46~,%dhְM)0t aG3| 7q^t<,ϻJ(x'U5*]%%N+jZ9Dptkx[>sWt 馜TܝL@g5 GlZw)YQ\M_zMM8uXxFn0 j#h*&$%5BĞJґ-=r@sh-&##S)q X<ʏAS&ܨ͛+sEg7p^EvyVNKy[qZoȴ= Bb  m/thCDb .y/KÜ{u߃Nd%X#xP̐wP ے#}Ty^=0|Ou4W"a$:ubC1xD5$K*] c4@$8q砵W"ZH||O7=>%K UՇN"CǦG"S"zGa :tahICm CN"Fw˰)9IAUc{[ld5@qiOcb3V<[ qb׽%W*MMmIN-Rꈎo+ hG4CMʿH<`&f!`GwurSX;ʤg  n6t*wɫOG0)|n(kNiZS4R~nw3GAt_V IDF `%L!?Y{`&`<hZ/Zk40vCWNF:k;οV_D)RÇi D.?9"u[yᵽId[䰼5~(OmY)56pE?D`ݟ:߽nC\4>_" "[ÀU}}q/ ͓@+j*:bcz7 X/|bIR1=;`kRU\-h:NE<RIbP=X[x3V̈fx3\Ț=nA|%FR—e8%vTiwAImhCԀbeeR}h?3xz9c7n\)!ʈ9'dk!% mn]64SՖ*~Wp ukx?e{69A;u1f9CMkJ$ p5u{$fIW1g:gh]M'َ䖎Ԙ&z6sn7.@\ّJ<˥- B,)X~L`*"@\~Ay E3G޷1!9m}Ũ {W1t 4Y* bAH3]v&Y@U^ћ \{sj өBŲ >SyȎ,/jI຀ * 9jK{)/W0ϏlX-nTFئs~ -ŷ[w#pGb['*Zױka5 \i&;j-M}ZiPQ8 %O5AkȌO\H@Q& leNc <Gs"U_/@fǭFaNڴqL4#?Q|LJ@q`IX~]y Kіg'&=1y[,Wmj;O"kUh[rYm[=,y^^[e<U|6.F+q0\mhy -E)W'oOaeJFb,\#fEF+EG:}X۫D@8 [ bLx;HTa YX ‚!>/K58$g2b ztyMPD1wX?T.nP[JU4 䍟JQ7 }g6,%$4 W-p#1Ћ[nI&YIdϕ٬-^6 KzK2^?lVd>!,JiL!X Т6.ڕgY2.=!+ yS ChV(f˴Dfp4̥UMoC Hœe<<%c&jWpZD^Zi{E/Ycd藪0 A6z)7 OIßGE#w(%?2^=̧(%Sd&W!kR©ƴ A1x಑f`%G؜ghc|ƼL+~݆Ѡ,[oUQng"g/m 5-tJ*`zXL 4 '˳\V%\LEl{,u|(Քp5 z?Q.Ν!*\SERr$D8 Ґx0yl< ^]wyn*4Ӑ/?ɐ<ՒE h,Ϛ:~K.+hȍ9<v.u*wRA(Gz4%*84EA=(g S7{{wgP?(;sUR՝53[$#I?.Y\kn0'9$fZ1+s->巼Bl#ͯDjv1/~\[&z͕ I#;GSmmO!UHY9 GAai5L0 lN:3EmZ5NѪ/ );۫56geBX,qs=n/e̸g[V|lRmK1fH7h 2m%f ;: (,̹Ft(“E /|3#!H P93a1TNP<\يOE= qiĺ{RGn=xC kH4KʢۤbQ13^b*;f wiX&jFl2twtpy+NLj)?1eʴZcnnr1(VkSl]$I$DzLjEsKKyYsE & ȝ/ w|ؘf`t kx@`_woKxM3dV GU{۸[MX'4;ϩ@7Y8盘}l%i{n۹ߤθ;d@S큃=NxߩYJCL57jfIXxdފ%D j6kVɃT+8oݶ-H_dslGG$ ڢ܆쾙SRj{dmB9oNWĮvAf- ;c~ys4ȾAM(LڵKfeb"]tj5wrOI[w_>㆒~gt>υJ° KM㿾m|(Ч W6j܄#1|JgmђP6>ȒhѲ$4DlF]SeCXЉ5Zf~?[ Dc68qW7rfZ'K6%F"/(<2Fቖ`YWǙVkMw7XwtX|5Ot}jJ<:\(<ـ3e5C z$ޠ S`MW> n{rTO!}e.֜ݢR :=(ZllwV~W/l%'ǐ/l^8)՝+A488,#o頊GhY3obaym ȏo.Pzu}$=ؖ| + K73(MYGV=3I,lW(~8+d,S94tߧU<|]+~b z'd$-\Zw(o^TrQ\"ŻlI 1)AVLd:Z.ζ;M%R=cHOg?58 +&B!ZXቃ!۩"3(v8! wّ0 +/E}~WH03vK쾂FŮW kJD .Ċ }keM1%RŷT9`Q@ۊFhs"h-ȶ*> 7q=8HeXS~8(4US+ѸȄhp9Z_^i$>D/-ZĮF+Ћ$RUbE(fΖ}B29lzS|[2/rc\Y 4ήxWU>5ӆŨIzN&c~# F"7y>襇"џjއA:)nߵsE$674 t(ŴFYZn;MAO| fsBuVdQZjBc~/"|,0>ptnБׅp蓥LYI^kZ%GVSEKJ9C.sdU9l0 wj;X=yoY$'蟅 5 juHn 4IdIKޱ᫼cce=9L ~[[UdթUUD6+S?m6! C0YX.v_>ŠX} nLp*0pˇD퐛=oQht쪺;LSCG`V 3s*:/a ~xAFiKq4^UCcAU4E?J)8tI +Puṭ /urb% @M}$\VG^#5 ~hȊi/W1JgUt $e|p%΍=jCbE=IN m-w6ڛ}jFEyXwO0ooWޮCi@?Ygt^K>v R/+qoӟ %o׺&"2N >e4Z< EN]ƫ-/cU4O`!MV{6ʨF*w{{C޿#8;ތ„ =gԸawmYh5Q<[ݼPD"Ʊp%k3O~{Y]H7z!̈́bJ,eWptĥ;Ȧ2?)Wᗁ Zx(L?0kĘ]ȉY"7hd*[I}q;8B=Na#>#siK /г^"_">h8ꦩh_![-TwYU(V1zLTMV'rBkypculE8XCTmcŬ5 .C>p)*=-K4YtSυ(l`K݂ϩ0'MsoDK2 EP$!j2wQDtY>E[Ђ3R}}؁lr Jʫ~v8uSXϻ @(屹mQHP" 1ŋETǥ;M蟂jiu9O+?<+S]eh>J絅]x91A/*›8ȞyBuҀƕsN+ k]x6eWu})ҿ:dض!m7BFgنDbp%{CFŎwfjoq6 ե2O hv}B-~zw' ]%~p`|ӝk 4oRk xKt;sC'd<_O!m:Fqqi.:gNxr 1w9 OywEW+?x|K8ЭRGV1sי1=)۔xQKf~ gMt.p+w@I}]Կ=GnڴS )Q;nL / ?s(p)^7Aa(N62m*]Sn;f|(T . 5ۈu+Q%}4+A|IAIljH3 c=+K7L3(C@.*l쩜|4ރu;lʂ 翩cgdGjtw4L-QRCQf3@ &牺馭YZ3FR)ux> ;}vpy~A_OǍa"咧AE9/n͹áCmϱh̸D4F?8.9Վȥ#Z)< W)^d{¹M nfϷu> f-䬷<;0u֒ n@F|\6?qP痽, '^"\En $*%_ڶc ]ֵsq/N]mrlDpٍȬhtC>D+{ \HY>2T#VVv6k:oN;(XmT™Z^p=Bzn+l֯&g Q&[F ~,<+>-ӹs2`_u60-!t<֎Ρ zc=x6kdrD\ymqXUO:ΕRY%}ońըf& /0|(uWH:rZEVE^5VGdZjI5 C@3z#׎}W:}t ,hVUKo?+cps܆ww=/!ʨLO)L,ShoPVmd@ǤPb2J^Zc<'182>pN=EQݛW/2x"0qqzcG/M7_Bor8GknuևUO?f}5C_M gR <;AaitT=N"Ԗx?/K[`69>"&IYzr(7B-`sQTeowvJ6C&u\S -[|_s6!<"ݴ aFQNl3$* ;'8aL }ܠu5#LQ# W7e  @" vor+%g7(EU9h&8i%}uhzWyH$rx;`思qH:ʕ[<{Bft9ھY2;[Yvd^ HQy̎žͥuQh {`b.{;m\>B2)R5͎ɒਙD. WUZRG8/Q&jTy1+,wJw}鷵"Ѵ-S" aF |N ◢|џ*EcWD%hĕ>BӥݸnP+MU]&bu4(ޯ_< iNn  @`#3uoy1NZٴ[5Oiͩc͝9e5UFYImAT/Eu} `jQR7Hy]Ln=zę%וd8o'70agЖf AfIʨ΢=WGma>Aq@eEZ"+X ` ϫgw-6u FVG߶@%wbIեА{'w1g۫ecz-I[[m[ X1d?rgަj@^p\\ _CdpRI0q!r 1r˩|~,3Wd .wfQ#52ݫ+ l4uGe7j[)#)UJ#FvwumuK)dϖfi è? >.P@u^}WD||%\!TaZ*8eNSΧ)O< )l|Μgut2= Fs-FDha1u|Ef3h5.!NPgi0f\ M}@0+V&2-l{<۰Vt*ȕ'۱ڋ C~3x!-7Ij؆rM=:qGX NkTŻF_ ݲQs&XR`z$bǮ}qtpގ+]K,|W'DŽIqWXNoB+.aLKl(ip-T pLKP0R?v=bD`_%R"#[svr9s(rZ@qbD#,7`#BXREȨY_ˏ!sVq#f,;w<.Bʚ ‚' owFuY)c#Y،Nmܤ۵aR'v7;ggIpROނ&5oLoBSZU$F%f ;9 >6Uod-6Kt\u9:T7A bv;D,t}6pk:rGE9D7o _KhN-vNF*W<6fa\q )[e%`ALiPfg$p-mpJ82#go)^,Dz1WɊ`4Zk6Y6ɪjqVZwqSG p(lC= BfD_Oeۖ}-5Nh0 F|@7KXGr3A/K!vU:VvDTTXIG%Vs> gd}^3_\6u1@WFG&d`ݤgQ̘)|`'k^@t8X=]#aR\'q6J)0XUU,R /Q"Urk~;T+ %MNd%P 2+ʬ~tq$t1Βj'V^ T>K9&C∙?NkZ[u DRk&%;+ZI&b% 0lxa# ՝L RwT݈抇\VuI폯)z=lKzD:83Fn:Mz@rD2lw6t +4P“vZ$[yʠ2V|Ʀr Xi.b5j cEN{7(J |60"݅e6OFR U~ޮp5Y70G@6wUU~HQQ'?qP>gmnYOިK\kgڡpp.fsCY54gYOG%I'I5da ? ~9&+y^cd%Q|84%Hԇ:pv|-):߃kכFLݲEf0 ~W{8%luX[Z r~/?lw0^W1P$=ι15s=b&?aA?ހUyI4IK<9 >ei#!$J.6[?ȴ~LM•B煟*C劷}yh5m[6P' ]pYai <&籕 6WG(5QQ#8fIMk/+6Hq!Ar&U*dI4"V%{I>Y07y5PѾQ.=Ҫ:.кfGQ.]eJji"gxZݪc&ی& j[x9B/'T<(JfcenRgl0r^? ~C5'wWuWn&ϻ'V~.㟕6-}zĹEJ`]*9_@.@ՒrpSiw@ۊo9!];:7~~᪣Rs՝CÜa~_З7A_6=KŸo5fmIGqrt&bl56@ݲ~ÍJ)lS_({&k;j> xk =1(;Ww%ux¡0ݐr r>< ҄#;OxX_-EZ2t'0 .-/e g[zz9Ċw}6[(lws_WQG"eHWFR>Y ` wG]#0FB 4^huO)DB\]|04ps|_64Ѷ^/ʲ`: ώ#EJxM8"QQ2w_Ҽ$˸뇍%/W/ԅ^9͕##.@sL!t5zp[`_I)3rA۹9^zr(w^4+Lt1Ap =@,cq1dži8H 0wEÁ$*A;^Sc}{tjپXp!"٠G*!u `ㄼ**g2x'Q@R׊s H 5 "sW"FHm(k zF JzPW82')PәL.YG;g!@v/$N,T2aힵS?uOn9&Q!T”O]E퐭,/9Zos5y$~߶6@ Ƣ>oy_ .D ."Cnj5$wPDG!T=hm) VQy&agwjJl98/Շ(JDe<,k+ׂ`sT@gkw,'KEl3 t mk%ͼwǴ Ɛ32=@6&?݂Eh7j}ʁ*zSSM jYi{EN7<`;g@OBwV/C'O4d ˥_jFΖUjԩ.( YSSH#$u]nk^5EZ4_i /ؐ=|/D7$SNP'a*vy{O CN4mP@_aSy5kQMgf@~*Ke^)e#qqP(D0R4/קU%vX[T6fηբ~Gmʍgꁏd˞m8>\˞"+PY13ZEz~P`1Z$%%b[/k?t[ W5Dd-U0MXTuc@m2Nw:wف_GL'im?ʓry21^6#se^,/ŕ$GA݁3 {-h~Dѝ_#tP4A!.2h{zr u)=JO?$w/5{D$yA&2@eqyN푬uXW@WѯWX̴'k=^pz:(1ڦtA0 ٤x.vCgXjCԲkZd.Ѯ#8΢|MYAާq9ѧ!ΛkEXmSԱx$( XQ&aˢw.e 侎gt'=$ E|҇`m'Lsf5fX~Y#'yq`lIZܦѤ4Kҵ F<8"P5ٟ~}C/R89ʏ8bM!L MzzT@(aeqL() 7'lE'%ۑ>*xIXJc15xG>.gtzQ,Qd8FNUds(a].56:Ub_o`!k\.M|A[g @#ҍ}N@*ITEqO|[Ln KUPNpJX xk&p^LLXw(} $*Ĵ͠."nldT'N*+Cg)]dCE]MOM'W[O(HG3)6Y6/?PE /9W?`w 4!oi 33@IDkjP]䯼+T9h~9 -wMqp>ނt#H[ 2R8~OP&a2xK:H >[)];X= ojKOw YP[d"uhB-iCGm}/s0hR(~Rtߣ<"SGe v$Q^ r;yڴ4|4%Vs~y ~ZUښWjgr =$ G2ic] +%W>)g~H >ET9>zemNmU"3B`t ձmAZk"ɶ:ڵWQN9s'ČiYwMZ imUvOI*%# lQ͒>%ǒ_o}>#X da.‚IGd4 ǭ:XS"GK545|i K!IATP ifj)8PgX4KBh@1+3y]C|芀6Pb<$SSqtݲ*> s-IҒv;\ ! T+萯wE1Rw+,!A!&\=Tߧ4* G,}%?Y]R!k(I\I߸Q\&=q;R&(5&/w|l`>[s4Ij&0g2Ƣ^N| B*cpY0V*k9~ʯC7o:Uǘ1 tS+6KVӺ@Fy| s/<B+]VY?нl( WV[L/^@vUi˯ 7U9O svN:5OL%gDsŸ94v46XpO&mBfx ٻm("V[@Ӝ*dΝT4 /UaR%ad ?1\ U*!n;3LL^Vֹ@xRiK8.iPyaΏt8K=l⊯?BNյdA/YKk-S5QI. WG駺7'Nj￠<D q(Ee8iR~gOIH?̈́M '&?,| Po I'oWh=nL) _}6ѷ_Ahګ9u<7Sv8u7I_&o$PM4@pa2\0\ Bw4~I~ 6Yj$㴊삧?eBcM!Cؑ)݇]dD,X9Ck.! 57I}k{tYD|U?Dc_i_;DwaBt{M 'd鈸X'9Jd@H6pͦRЉ]V`^9&( R8"mtjRVQJo>5`;ㄉbSFhoOpo՞2$(c|tǬ?,qz~IA(f "ɼ,휮ԔP9К?4ӽߓZ͌>tKRܹ>ejT0u&AJ ro@뽦ZhqsK%T]Ԓޣd(NɂaHuv)4S vZ-hmde週pD#{4ֈ{(]wЄϰeD:6oǾV8pn~fgoӓQ-?hض( p5rmp&HX+Ipd.w.yj~ AKxI' #ٶ~7E0"-<$OL$;"*Pj9Bso;},ފzBm.n1/`Xg 5^\5FX_g@7" n*(BvoZRl(d𣣼}Sh{*JxF%N!^ r'XiJVINBEҽP|&%3_BCo ЪXC;?L߳iLmh 5lm$-K['kZQo6vۭ`'6'Aa3* xnb+խi0wms0EPYuK KЖ|~WCqE}i'_B̖R{w'VRl΄h~p4&o;e ΅ oW2S 6d3% ɵ.н"'t? %Ez %uW]{L =$tф/r#|Xa j = Sӱ{V`Qs1oA`ܒ f@dwHBB.uLs4wIfPE8U`!@M}t% H."=NFOo*.1ݫz[Yn 0jLܷ]p*50:.4(O~A=е#mN7/DYhؽ6湽rЬ ʼ*0bSݽ:ƃ"GO롯܈%ٵ)Vے_5E7z$y()Swݲ]TGX 8e^=Cw>>J6_.M w.;-vVI[qKO lp#%xg([AS OO cE^q][0ԩD H]sPB\$tGG^+В4lwc+ESe9*8l i@baBTFu\ڹ*swT.c]\}@[(mWn2X-pP;Z7%{.*ڲ^j<?S9h' @ڿ+;| )+TZ3q raKG yLUO<MV[+gвBY35Ɓ(O\m wr5,p_ ! Ȭ 4A}AZ[wd JV&`cQ-s/emΘ 'Wü5V)5^-jFǛ+:Ҟ16* @ 8 y,.JgG1T˖8hsP_vC(`|'njqI)ax詡Z$O S6)@ivNʋ(2ݖݵGchr_(FlВkP'l-u !~";3:OBx'` Vۡ2 Z" r?#qҘ1+EG}|1T)ynh&/xBM Z TPc/+yp[,)7b<>\`W,%p'G\kOt)/*b=EŰd8%x8bA5 a|8F?ϖA/6I )Ns;Ea`(G $*J\obuc bkgf'AjaKc$<%ntC2BڭKj%DD\4QB˃K;kZ (~Mˬw2B4+$]MzE]DE'+٨t=~&Ri-6m76KKjƠEgDzpsEΊ9WOfs=o&{xTjDP{=WD,h|mw*%i'YoSF!ҫN.5'NC+=AXm{L8B}n?[hijRd]m|ET'zr?nف ˺x\-&+MJ/t qcw+ k*`t&y7i 5,z܀^%eܚDl4V ̜;Kfʉux&}o 8NEj}y!f*5%7gdP+[]?+sbݝiݳܹgDjK "Nxk!,[kA"~x$`}  ˗XЩmcq ZXGY?=@+$ knLj]UuwըɔxSzgg;긬,ji]&vwVEz}(G4|oQynQ|tOgi/Vk]vsa Xc.fz!nE3xծlI_; %`M(.oҹp>y},URcX]l&Q&^G]b<)} x%[cRe3yq,9Ĩ ƍ#O3~n<'UKK9t*  i1t|\OQ_%֌cYuENz:=nTjmSY(jԟـGo㯬nxe0'XV ,O nJ1 :j:G:[4H3E!jjd=/1嗓3{ R)0B|qV"REx+9D*<&KxIa"=}G/Im,#1PN-4" ڃ)͡7VK6Z9'[~Hg K,f4B#`{8Ab,"Q7Ou{[,Ug8ۘkx4F&:b 4Bq<z9&X^?*1RqZAr@/˂&P%_&:[ 'a,PՀ3k_Ԯ@}p!Aێ-ڐ􌁱^btm!f hAw9V!)ؘ+*tX-(-`]r#/mhO@&{v؍P]Jc'+w~AF`Y`az=p[LςլNNMeq@] ޝĤmjEf0B/uO `Ɲ=PF>L 9šH3nUTJK.}UV]23uS-[_|l̲BISzUͭ5R 2ZuU 2k]_og5W[">_&$S8+|ʯ8.ӻ`M/r7V>@]Tw8CJ@ bE^6p4~8 @'nd [!OK%ǣ[!N._BOiyӿ]d^pŵ*0ݎL9Zdn#IR=_g^!MyPZ9&!#!I*7rb/?9%.XM3%F߽ޯ]FXW!q@&0_8~&q#x_as5漁4ǥG_:5ݩ{>յ-MG^Tӱzä>ܸ԰bz=&xv&UH*wP毀[0Mb.6 $nb/gkwߢCut(vp)#Ȱk$umoa3@.,+B>ᛣBG,AS g1tɖRug Ciw?M.ΩI)ӄ]xs@e2a͎J[#jSoKҿ5?uz%``VKɻ,{A ܽ UI5FUt g؝ŠR{TW ٛ@Rj|}L2^o$rO@HAۮd8b͇xXgx܏Q*B-Ӗ:h))Ph@椒'˂9'iZb~Vz~xRuhr-*q{: gI݉:J c k=H/ mӊ@ Vc}ʖ?c!C!VJ` [JNFxO~A@ (:-7Ix^$e̡n#g Ċp%x&cGCyflO\=6jN ӓ&n`H3\ם7u1_dOHMCR" cȔ'si3'[Vto/kWCa fCj4dhi<y@$[@}UO4IMmӼmWUey.']gi "NZWᒸ ~zP:A_[crW>qS-Be1p2kQ8{< .ȜffGr(MEm8 mS|[O>_ao(u]y6أZPOt e)Rqp8-S5āR¿>f5Q+KRO+8K~M2cѪ$ Ϻ EVS~т,ncCHZ%#FoPC&jC/k䄪iDFb`8j=6E$Wx}UevGTW67JXB6|U:R.zqJǓ(.u^*NxXˡZ ר6EW?,UUSЅe|` Gm.]ik($%O G0k;IK4S-Q@7F-Dƺ^9\Ct[!->eFk}C=@'*fg5V9:`4᛺;v8Uj 2dsbC`АCʽ Ѓ6DrdmYi?l30 ʬ=Zr#? 6-"Z[ 3Yzw۶6tm7ZoJvפVYl&Q|%#Wh[Scz%-cB*巇RɺseW#M6&tKhS.12B!XhE2`Z"8qb#AZIc\Zd3WX,Hb#_ 4]^aW ʪ1gMyBw@d^oc V1, 3jI^,YZdxvͥQ&um^TS>hQJ<㱞ɶJ^01 g-{e#& y|ccexvw'i0&}&>4a/xn# %r G&s~QN%wNL>38I7Rq~!UJKnygh#Z1=ꃝ ]nz+I6+p^)q&ō\5(SI(WxѴ4WnK8Oni4b#'4lx&@ X֘)#N kDg`@EfӘsZ"3Mב E˴"r#6PNfFX v檬Q̍V. 4R` W2NJ0[>Kgp nͤ@/Io/]yRhaMDPd5/W?D..l}Rf/ 8eqN!6oj[&~F N)J&lتj}@Ey'c1n~l Q5ʡ&pF=Ot/JR3:J܈Rd&U1f_3H<6i؉4sK +} K~7,&)~]dT` h1 pvJka翪kK l2ݠu|MdC }o9 Z G˓+`i dozK/>?1K:xh-,CftY6k KA *YxѸꝘmwWAk'&|&~ޗd=@#Ƨ6Hln?(jl`qȏX.{wzLb}ci2{ (x%a4;^}fQd2{Kԋ:oHtW{0-҇41q]"HccҊt^Oͷ($ oeWv/@w g2y^ahy:Ro=W`Ы˛}}g _K)1!MnqF"Tͱ͆ƶq(i$?/r6V*S3FzY>nT#PQH5UɵSD_=at19lH,v.RBU/)%08gw .w 6:}"9ln'^p8CU2"ג~h5:@SZV[2GpBaº/``Á.8ͿCbS2M\v P܊;%>7'w!ԗh7h M_/\eEܿTkDo7%?>w'%6+1#3@3vNG0=Z 9fS1GKfC>K6s@dh%%NpɣO1)M藲A.`wK8,K1hLzX0HU< .mpJjt1!EFU'3)"^;A*?5ߥ+ 플 pNnwYKl}y!HoI}e_FH P2rYooQK@9}T1?L:׭w|Ros|I}0Ř!倢?Ng"Jg** ʦt1)7u6w@cWǬݏ-;qG2akt1&Hݿ'O0}>%?wY/)^qq*\uo7Pι a|<^%̽|0dW!5ڸ mB5pcLwJQTvo\b%W%N̴8',+He 녴\JO[4>*g*ȸ<ӝBr{5әW~S#[񨬳c0oM(& A1 Vu]4G<'"ܲ>T`2D$hL~YI%0!jsGm>g3$y.#T -D#-gb:U{w*Ix{((3$͙*MVvf#RO#,]cC@4/kOY.}8lç83l  'Sq[_3V!;7EKFzsIBꂣjM['`w /^Y<\O>mt.CHhB[TJӻO,E?/܁鵓;j~ru=0D#^ L>LaǏ*jYKHo7S.64 N,mc& [EME?"H?ƗQH;2ut/a8he) u 9~t:3- icƆ6ۿYA'$R% ):_ N`*9>}A^&(,ϊ1CגMQz|F˦@)@B{¦0$׹y_Hu&b ³۪jXpK; 8ʌw@y9AuwaMނlR'e#~ls(U{7m76P8ϻzt( `is<CXxbHb( OIG,ʌfr!>h9[D'D^&}DѡtkExKt4G\\G>Bbsz~H؍hN,[u݂^PG"4c~ ljnztʴ,8̛UOd3؟" +X-tש2 lX̙CawFHwVMT# 46G}yQP+]BN+2H́SISɴC56^鮟#w/0b ҫC*)yze_AG*AU/n=*$"CtR;)^ im`R颀]ݐvRDpM(_v-Q&?[BUՠArqZH@u"bn䯆;z:]dj[DsMEH RtFG]jZC|p0GDf+6$?ב@C jTl2gNԘk)hêEo|6p*1þCݓ^嶄׆%ž@ >`3ZX"8 mb6>{!f/1GAJf8x+ .* 31#LH;tɑ =b:{UF§0zkG8u%f0扶FqU "+|(|ymgs heUa1͡ZGFNv$3Ut%h$/ytPjˑ;L=Nj/PRh[1P X8?o4#'z29Us~`eٸOghrtry i "z]v=S/ZBfz_j[g{DM9(sfFIT&t 6@I7Xl;{!AL5NAԅn}siW$jnKlT;c lFi 0xwI]}iX }$pJ!8ٚ kiI~ST9ABOmnX:{AF mVdXdyCyqŮpbO5Av#Ot rm*vPn'up6|)Ah$NTTsљK'?J/ Id=LyVcJבEB> j hÐlY ߊj̶e%V=byN0cgJ='0ON WۃX,Tl (~+J% U:uEi30% +7{b!iTlJڀWUkPFK- u=zMIw͎DLz͔-L A-yerNx Dw-W6pA'Pwb\)-WfKBgo>1ZH0lɌV8mw'4Q: Ɵn2M'0`2ȖiKɹImg G5^tZ:KY0,9-eϬ"}lKEOj~Wd U@+?;aμ g0b@|E̒p@,IZA#+tBp$Cٺʘb?Pˈ\XJ]Oy !%mzd:bX,{n'#aƝ5@vX(/o\ă#~,jZ;gA`LߒS=dp'(>/*F ūj>O$F 8mQ%?cJc1s qѴ^8OCfI.`4 k{L2+t ] u+bulf,1{|0yB?[! =iRN(NLF p]wHBVgN,'0&XėFǙpi)hD"YxgƘrvi EAq2+O:0>diYDb2k1YrWj2Y!}Z΃7;pҰQR!-@m)jhĎ D^UqSppGEewGPT$U{G>Jy>3gD P-;mU54\%J$ |pZK+o,4JQhy?c骠$ہn{}-auzTn -ހ h; &]jɚF%j5v+M\"lnV`lŭ?SziHhZ9XMv;(WG煚Z?҇V3ŁVfLYR<5U$kELjM!R`/ˮ8Z)S$#q,`X%"᳃Ԋ+U Y *ޒ24JP)80~B-O2#Wϙg #rͬ­]1c!ml -l4iOq=I3 {?$<x i :/G愊S2'.aJ:⁵+~?<t>NmRP颙[!UPn41ɜOa+whSiD'"ك7*qONp] 6P)T`]wqkdn"'"_EFx>-wIؙ>E⤟|||/?x#.6"EKĔ ǀ}U4\"r-ׇY%9e}\Q&\ʟ&e5洨G/۔HLV,̺mTO h,&LEtNfbUr ЎР1AɡcUL(eu0 25$0-ڸ qD?fYO[LlH:(;k12#v5K6PSd NbuD] wzgJod*p2u,(tq!,֦3v}1%oVNŝL3j$t)6_P%!06y5" MwgsM"G=*~NB6Gpu]:&xapGb7(ߧw~!=V͚1w` caaܶE}qkEJO|➜<&ia_R#]8r`ݮ,ɹ,Bi _q1Cޜסq=厱33Z-) L(/%Bvg4Mu1Q )9yF @?FA.?U0#3G-}s]-?_Gi=Vql3qXT|QչN Uu RR'8zCgi7ev1`5,N Wma7ӍJ `ꓹl_[,\:yOjObeLc@u&t7mv,>E-x~c͉JIoxͽhZ{nڐ5b<]XAmU_ '9Uq{ڏ=pȷQ@ݴ;̇m*b @Gq_ȕ;D6N&"dt?Q]gܴ_^Q2Hr%,W(l6:>; n#ldQ,hA)Zl eh!!Ai+P|Nߧ1Yw}q&򬛤hD,4H8JʹMՂ J,TQY7x)ӳ*ED#N 38z囇a';ɰ_5ɚVJ*h3yd<+2Aϝڞ4ǏAQLZb* #0gU!/"}7'ߕ/CFY<9gA?z+ډ*} #Y3Wr_CmD~כ6y{}L̠(~U ҹ]cR6$tP ']bM-oajʻ}JD1yTǑFخO^bLo\VmND1U2˭j1:+;$bA;zgy hsX ҙ?$DŽLldk!\|JƼUڇ2]^椰m!$V~`zS6"B4,`$\ToO5]IH63V̌rF%y.hqA *hY-H-a0IUDFVт4ƻNQn]%=h4e>c[ [#"_E"*<Էx@`k.wY2zYzJ}h:m2+W@ggjKVިDq{1 mGոdcⴰ̔*S3υ>qfDj=Hgt y {DMEQ4QM 1Wͷ"Q3~mHM#ai!RWVCQG7xMj#kɭg;PZ,E8 |:`; sokSbGEI;s`eCBx -J8j福fB8 ` gMrLV?Hvo 0z3`a>1x1n/Z;$ 7N\2d {im׏ZQn3T" >][%j2eݤ݈ǸJyZYC~3i;+w55^ʹnGC(=4ue;6.$W@s;ԘՇa+B/6 ~!jm̒-07_|,zgoɚTwK~dζٮCaBnv e~&#g/6/vS-3Rp ߞNgdA.fjFHs(hB/BuF=G)Rc Iƫۢ(t}n~5GЭisעQLs2Mzp種ǕW  Ck1ޢOֱx 8(,&qRE*~4Ό1~NΛdQ8S&R.Z>]OGc3mZQXsH3/J#{L9,Ms)r+=mtm]'5vݙFZ/sh]bžz Ϡt6Gv& #nq֏LMp"Ġsm 樁Cp ={Q3pлeEn07M, ֬Py5`ʱ !ֻHi^}ׇD?xfNq* O Q<(rygHz~QkHGf4r[p e2;_ qNOxRfй$I@PLGcnO0!9&cԖ.%ɸ4^eH: HRg%A|#m䃡X\K7]eF@mr_wl=T [EfpC8O8*yqE6&xnPܛ5!K]T3r|Q~ OtL>2H5d_eOJ `.R&>R=Ħ- e;Cyv@`>3Nĩi*,pBB[TuO̟:-X?aFPy'쥸QH5Zq[ '%|sd;/oq2 1dcÊߛȩa?zxgtf6u=yT}`4c`}^)#̹5Ul;K| ]_hdIV%UJկXwv0$X,/iS*\zKG5FN{6GVdQG :"j@%ޏh}E7sz2F"S9-4oSN!Ƙ2!RHh19K*2IAǶ@¶ H(%W&IV8>RUR|'Tʂ1J@ _@[$WC ϾɝqxEcb;~xpbss̋$rH"u{I}dR2ɗjlǙ]Ïc&:ippb6\wv_.XR0Yk( Z\ ]o+t:MԤ*)M2./q> 桛S@4z3qtu$v^De?hrP|InXQl=NxM9ߦ΋F9ĊRU/F( Bƛ.j`}"FlN׬NRVQo^mL>yAHaLzQrb  4ǁ:y s2%|CԔqF>>tUu uw~=OM6].ƖU)V:IS&ͼӃhI#ZzP)@_Znd6h0HtWXB̏6 ̄/x~+xK)D&HR f{pyhdK{IM;zo+n gq c G_ o `GIJW#\l p5)z_qkk7P_&pi]8A ^V  ,PwkakgMc䢐yjԙ&hhU\UQBuGE؃~9?+*ܷ#{ep |q|Go۝ .^ ep~ +Ւ%Ok8hnA:[0+u8qfq62 ~h?n^3z&(2Qwj]Y-H⫿OS^%?nT'|t %OF+t9Y@gx%@oAEbrRP|xũ`%GNkt<|9c̱fm FFN[a[ D5E4>]kWRD_Uj\ 7*ɟXP1pw5?k Lхuu86ۦbj& ;atC, xBƔ2ѡcI1LEhbAe-̊`=a0f0("k,).Y~lнIWJܖ=y?Z愲+o3"o27L.[KKa<}Zd< 4߬ (I'5 Nw;jg9w&Ow1vzE32y 1}k\KZ;کxrHb[ j~ ]MI=UON ]0sj=:NӊwViI&6_`R$^J}GV6?mZ&Yu !eTS4D M< mvGoJ(`h7Յ-pᯆ*ri?\l_W2yIԩ` @)30dV4=vkw9ZZSp[02yR RTMglŽ+ KP -Y FP( W//9{pF[zW8!wX!g.aä8q(v:ĿwJ6#nG2of"vHI;<`C*+fIȉJ+T!Y1's Cl~g-,>C!:zh_=,L^`7Ga:5;^~%<<2(nj/{ֆ= fҐlpd8LV""&TZWoi R蜞Zp>\:RyR.p議XPpA{GGy#EA tP,w/pzl[R@t/N+?3",ޝr-rk.M+}#cISQ{uUǜX/zkWdq73aIU7F[hHLǔ{l:{W/iqu B䑆NјKd9F )=BZŹ*?'I39L2Bhk0l1z%~oz*^[ ͷ9H+ʘwNZ&'NnݖSdP`]kQ$.fC{6𖟬[NI1z5(`؁xE!+OtxS. _p +[g׾$~[(  $ppupMs8J>xKG.䪢'4D/=SܾL(V䖧E\JieW4)w2+7} LqoQG.jA"ozlNWɀw|&f_Ak}W6'!$-lZ/*`\SlQ+XʚeY^s>r[@6K^WBOj c?pTsX(B?P5ҲChFφFujq˫R,M.0"|IXc$g_Qe `9suHз -P$gps'1{܃檡m?dw1+Gt>;/,Qfd!Uv"C~1vSRVq+s#»)p*`F_B-O .´DːXT;Ooq\u[kv(0< M)շPڧҘ)[\rbC7pnuoezz5#kXjLYv<8x+k(¨[.B%ʨCڱP9|ϳELVz .Ҡq|Y8m&+%6-⤯*91aמy7YEz<+m]F/ gn3\{Kv3Ǚۦ&>If Ox:BX>`5jm*~"f YůRս_Sh>mآs͏x(`窼JGī@,os[vϤ1G {T2!=SWET D'a]))^b;SvHs ҈U,sŖ*_b@:e^Kq͝ Ѿǩ껼;|\杣wl9B;"SJ6XSF <}NrXNc@6h$׃Cq߬ܿpZ5 sԶɈU kR:ۧq>p#bF EKETU.QpƩcA5,cx5WEgIJQ4.=&B,)=#"$jDtDʇ-{V bC7*߀jӍPRR6=[p@0z~}zew8G\e+&J< 24;< 9‰J]LuX.uiVʨavolOa=o}̠3&/WF^av?uP GF9-졇ddI~%Ν4Ntsâ#Fke?"SRG@i5,~c1(+poUԜo^AkVҳv3%H <&8)E6j7[ccH\nljQE:pЃЅ5͂YD\ 26j92Ăܵ8jD lL O( [\^aj2Au9ݍNWOJMpՁS;&03eLCFZ)1~NNph(>b\bw` n0#|м␄!Pn͐`6guIXL!jQ%xQ6-a_w4GZ"3(E1ߠ;krF:01lSްG/ry 3ض#CMZC'< u!!q]a箏1[G"$*C`tCp#7 LL;Ҫ+pWS Yk`Pc70zj@4>hHT“a.Ԭs[7'zr&G~`H 22a o8N&@҇3}Go7Rӣg`=45|aGlrBYA&y7i~͝RNYϋ}ܡnCNr%m|'?ҧTx7=uZ[ RKK('㹛&󺂝9UN:O]<,k+ Oj7q:IQ(¯bH],L4!G N#촊᜿JCJq/ ̹FX;a7*[ Xrj6B$KpySrO|>z9 MmR+IouHEʺ i?F%bք[|)hըN.93-@/0Zei!e.y'Ewԑ_3%3t) rfU!"-6Wswg< > G9D*`) UMn1n1ǔqޚ HW}͢OX^iPEp}c:pRn~=m'ۻņs#nPʿar.X%a0nŽfQP. \SFV.{r8X&%(r*?$WvҠŀl'PN<2?A{H`#fbzg!ܧtYS?u,o}CRɢvBn hrVmgF/i}[Wf\W 0Rye\ v2\'q]OqhS+Lh#Oi5]=nOּT'X "^zˍ1xׄrӛ>?hVbg-XXHFr{i?HwAR͉ ҂ZYIwR#f߫5x~YteL A>g\$ΐEm[g*1RN,)dGW\ QmW٠BLty1 Hc'ieL#M;aʩ8/~'.;FtZ/KM9fLF) Aпe_uCJvU|`|LAC+J!ߗM.q#B]Kb/yiz&s O °2j8լ}܎d#HJk< dLd[H$n,F6:. 0۔;NR!Z?ƫ @  |B2F֞7JnT]PBbhhalE쟛lil*J.C\ptFVB_?e9J 8 =eNΛ? 9O[M)dmVt! ʶ5]C-`z*1fټlN윝ikzOz?5_A2Y0*Y2}p<ɅOqa':>Kr'j!|E)`* TQDr(20v(fEU"H  Dvr$~ܯZ$mU6 >tmR{~dOZ7s-a{ڽk. l{#d8p8?!(J4ߋTv5L_ 3SُhrW/LŌt8Be;?AEns@T\yr@Ď+b?, +c&6@j@\x<鱍6TAq}lуF\,0_)& ," ,;0#FuwQà c+r@ [[ opw KMcNXWզơBg MCzg9ȇG>mD CZ&t`fSM Y~`̇Ŭ`8BT/L[6tÏ%\5F2(s01|DB4^ r fQ转ǽ(S/e*O> Y0 |Br!qPU_4"9g%֙0$.vnQ;\CxM磶ux8+ScE\0hġL d5 J")EUr#%GP<n 3)ECr$c7k׾xtr_糈&q4A@hGdrk gIdR2&!'Zv}XPnϫ<ΚE IU?^DN2֍I)'Qkszc:6 Mٖ 9Ԣ;G)TĢHd9Z! 4<Ԅs ҉E#5 ec5[5$B2|[ҵٲ{籰S7#MTtHQIα5R$| };9RBR`;eguב:^|V_ #plsw*m=e׬/h`Mw R)1<C1ޟR(`s待?&Y?8 fOSs8&&ekEzn}u]p=rh7HN.L^R(Zb^N\ip;ɶ=KƅpՃ)u2$x2@+9lLLk#ڰ䌔w~>_3*_7;2.y=nAȘy09=I/+Cir@/,SNGĴí0=`MY-mK3y(RcZpʹy.)V̛۸o-m%o%9R**~~4HL}ŒPY7wȫz:a1:OyLK㡄*ݯ~e< 6:CIMnQN:mђ(`nFnh>9ϔ;po ,BfTcli߃((Góm sUTU03<9בBFjYZ^,)  ~O-vbN]q"j%Cc J?b=e 5>?" X=V}a&"]9̰SSHr3 <謠BR;xOeZřI{wEqZoV׹۲^^IĘY@ tW.2# ΀x^U3ae:Han5M^GzU/{KJ UlJ)-ӞDSC|.j[~Z Yϸ(WBo~^,gXê| o4TD)q+LMT.Rz>p4}^4hܴGg]bH%@V8l6oWLkEܳ;@L%KAH(6`9v1H.q԰bs7v{,\,立?X[#*`^]䗯|>L=q|!a7 l,)cl6 8Z3ف;@U Bqۋgz@QOeֳi7:ġ#P &Ga =ۖ=z4PkjES^1wm+i4 sz2랔ďgz$3*&=rh;^wHPLJGbʙQfb natp&2 =t';֞C3O*2 <Ct]6&. w$Qٶ;7eCLNR"gƐXgqD|PDY?0ݼ[˲-iK 44υO8@w4#o͛KM˪M?F?,>Dĝ~wVƙ7Ri7rA*/T<:5!´savÍ_gO[zz("OD1uy:. 4}ՔxŚ2Pc}d jP <#;WVx0TLsoȗ /8Pv~;1n`rh$0yϝm>fMkp|MԶNN o2Q+@?V4a;K-KEȖ6%Î"sٰL )efNzT틂^D}RpӦ/Rqw2 Ѱ *opxd3mGng ɡ>&y ߫X X)> -p g"0ۣbH@.xJёJ=^\e,pcھsق1KS@Y\ۋ% =ݒțipW݂vU3 6a*,̯`=Z+jY~n^F9RVϊ9ʄՊSt,'9y}ΰ 8H$, @ra45dwL z[; 5-;~`o-F8PKFOoGLv9שn8g`;TmG!&Q{em*e4 x_緸7[b߸Ia>M.|Z}&um=&u+N9C mOu`Vs<&x8t8Rn4D#VxHp*9u6-6ZѽHq&ҥ"lQ*VI;nk^| }jp+G!1P|8 m%Q `DNqdmQ ~9` XH3K]y7,!#_0R1dp VPЙ ^ӭ/e(aԡ+]?@fF fΠլʙp ~09*?]_#S0d|1B_\5=iՆ%Jd$(b8tfazwS ewF_v2 9 GPlw2 e 5WLbeAKRd㨥d0Mot;R6SGg~970Gn9?/<~[ ٦c]dEJPkcPu쇇DG,`ܜvy;*;e?~ǟ窋J r Rj!+q1 aƇf$ !1Ho0*l{7άQw"-D@7. 3hsӑFEBOMY8goj9 \H-tmdF{g93(9e79\M_`k斿PnՌ"c\t,V!J ߆Ȯhu sqv֐qWϸd+jB(f:,Ra 6ɗ-*ORUEK:td8dYK(XM]Aw=DcQQ/^2 g9ś<`rӣDENYT{k@BJH!O%3៨x'-ꦎQGGP# Xoד<=bܝb|ʹOtlL زLRG @yt%P.|U#9"- xx wr84ȥ W,s@N. _ 0R \I}m m8描.)˞6.IaXoNdUtQuX~]Bw"풐3>2Ik/gzmY ҡRMBx2䎝Ч hЗLwF͔udU_A*u0Vޮ\I$0l%o3]UGx1 O5ސ1gG)u:w`(ʆL7s-bT䚨R]L=ɪEj{ m@hʒ-*lqgNJ吪8&qb' u_:W|I:Ic#O;eckQWqoz>ޅ:Q֑E[ࡍ ,('7뢔r2=u%R UkmY[N5ReǻqJ_@|<#3zx{Rb,̉-4k'Ua߱`u9U5Y!$'[PJaywwÓPބ8QCG!5ޚEJ eg#nW+2,2rIó7R&r" 3ԳD"cjF "a!^OdX96cɝbWtm67?]a4W6*Kc 8nycՍdE!C/Qq>vMx8EsW#5+iJxmx q'k tY änԪ=fVIFR/WKÔ%K;93Ң@8οHNZֱH`{ygZ'ȠHz]9 !uF<9+Ρs^NC*N(v`goO+u-[lj$=[x4->ux,y8X~[jft?}PZ*A a\t*\!BZж4S=?3ld$WD˜i~u)!m}<ђqiXHԥ:щY+n0nw904$>IJl'% ]3#{.Z=cUEDojr4x;I%6 BS,:Ϥ9s TJP̩ek!(#+OyʺVL-N6LxCHkO:tK=̈́J oZ?΃ƂHJ͙^LV DK@ݙ&V| L{BW"R^լ zn'd_/c"ypvm@e豋y0)t} 25]ϴ,e0ʞpKg~iEW > ` ,nLJ?EǨ9z%T3a}J;9 }pv&@>Pf&OC%,BȃJßϹ qa96 t@wό|0$`7qHXZ Dc&jJQߥ_R'IT F54lu.-Zj֘"x͉k؉ʵ/NJ`b|o"M뷱ºJuKo.tc*,,dֲm`@YRĆ}gf8?%83WaJ&϶k^Rs>"8cudE@d!,u;2_2: Mv =QX8-Cpdm 0nh7yO7 BKGWی{ګxYHej:ܨ  dMfҔo~14" zvŕۻ% k$)Uoؑ[nR@ʂ4Cm1a 0@5d+RScMKG|hZҦ :}Q8ѯBfbqO0)klPfX*wh+6ȞbΔXvHt#`~lM[9ųDHcE!j 0t20D2#oO![$}ڧ+yןXH"?EV4 JyFzW~"*G/ Fi0IJ.0^MQelV#Z#^Ղ:!$9D &n/ GFѬ䫠󜱧|~sE7N4ę ӹRm\c 5 q38gt Ty& \>mWw m+i`~MHb2;5N s {幢o=-uEqVGa6QYq*pt^) }IY/T);-air$q[y!iEJ-cP1e4Eo3-?Í^B8%IV!6ɨ+"`*5L/ߖYېfՊ8`ݯc欦0XLBJRnҗt8TD\@s&CG7¨V "~,r/Js=ٶ ߗEGG1xp4eKg-xdfxB=w QԲOl3E6mhT( ^;f67 )X+i -wb-ʇ\.auؚxc SNxCՋrB{H⟀iIK'0M7vc6B¤yfZF'%g}Y=.;$L39TmU|H4<#pS:fC˶b!]9)WF<6Ë^( .ln"Qeͺ{BS+Y H^6h Y?*䩺 ̘аzh:QD-s$bK4юcfF bqaZB)?^-psRԑ}Pf)k&xOۂ;2!0/UDMO7r'WLc t/9o9^^iW[X p `\D<^k :3jrG.-nyYqU0*8C *"gqp8)c~LP&ZJ5i ba;2dZc4t$\,jXzitqФґݑ;ӁFؑY) h"IW,&(:41 [@9[{Gͷfq3Ԍ=jy1b1x]XkҰf( {Zj9߼/ 7)G}jo;ZTT"!7B Ti\IaKdzJV$YPM~9ve_Y `LO!Z!7N TI.a&2Vw`ʽ5f:t%Ny,FͶm{ GCZɲ} 7c Ɓui'LP}"I'юThҿR<>U,=MQA ޻壢(I8ݴ_8I v}]@eA%>[z]{]A:R\mNZJךOaBh$+DU{ Sz L^Nu% K:##P^Gv^+3qW<ͯש,Zu܏RHC x++ӣ{6̗@c7gŠAWM{5vEwF'E.`0Z{][{$v0FaY=O Ra 9gi[ͥNYZ~Ɯ"qhIĚ\_R gotePAu{q醁K6 <3iY:3MCˢUT.+RiUIGfPEQnΩ=J:h',j?)$2EzbKr0P;ƥ$4eJ+cU؁vJ7 4Z.0x6&1c5kqɫ0L-Ӝм\mȱZ%n~}FN.j a w{G8g&h/4\iA$G~e-: U{Yi>lY͆Ң)T˥ w.O5dz\aį;&2iRO>YTm~gP+\[ YBʃɯ:ck5‘1^.B&B!>B:̀bI;$L4ǍO`RrS6D%%$=~p5?J2dc'x]FX1+ ֪́uS( $VVsRp7ʳ2|UVEiOkEj{q;t;_)jt(<47vIT ':|YM\@{!:J\ )= R~\mk_O}| .JxS>/i=2c܌ox6ߠbֱKGuXҍ5%|h&#Wa0Zbƍ[_ DzN }B(H|Ai:~qj3-jn{k 2 ?>)NZACEYkv4/ˣ #)fXSؿc~@'V =`1Dgyl.0A *v_= _--}Ojg;%dwS@tqzS {POWCV֝f6GT` ~O߀U=Ųklkgݿ @N͜+CFbF?u_4ߏtsvS,9{"+Wxqƒ\#oExpK?Qx?>b??&ͭ9oC.Dl 51V("Nux1F秪fvq/Ah'(0ߪ^(BF,#u^xƵ/;_& GYrRO׼4W-jr$kKVȂEehAG$ T&ln8ۃ w/- PfWjaRWO$ȽS~gI&4<ޤq}3#06 ?(7P}U{Cy_8}E<ԮSOškMxMEg\ڞ\a:lPW"r5'A^ek'nM[h@oJ(~ KR#st- Sg?'F&JjV\evּ^w@[fyj{h=2%wgl:(Po;f'\AJ@}iA?*XQ}v1t J1vSWKM~n}ϊa~gï=iP4A@,3+զBt P|ݣ.Ӂ|?k_D% ›+>I3(T3{)UЦS,砤4 ?/:UDI=3U i#GĚu3.Dh3~N*HO?v4!vbdr.[Hp_1˜ctn#9|P|ϽFx%JdH+By6 %ϊΒ+$cY”#6#weI4>7_kހ;ڎڑ[0֎d F旮}+L( 2t'?*y^9 7Dd QG 7`K߶EViaae qsr/!d='%.j=n!e.[RXkb G6|W̓d]vklJ4 <=yHx9>/y?.&s~hw4ZRn#v3SuN kB~~Bn? ĽJS[D }Ha]$1n{[eJm s11 MWA, 5抣 znJ#G ݕHo0ͷY!Gm1]joI%YNtQlC$>LJK`R]pÜ 8yn"|x49TkJSDNWl z|LCz$Q!\5rAnH!Z{{u9€ɪ+Qk$`.x\-_8dCLjr+ %d򄛽5|WƜ{Ym2co,]z2"!(0> G{EMڅ3sKUmά'8(ţ=w_{f;w AAK쪙-g\a ptt0?IOΊe7ζM%`ըϨϼ-'g3$ks x=T6M4 is@#9%Rat4>9":ݤB.1L #QwRu{Ml&Y.n1Ze /%$ak_37@]Q)avo ]dz>^nuízU)q=׍m+Trgb>4Ļo˒-nJDA*7P(Z r8 ^jqEO c.1Φ~>}*vpP߻85g[0ȬNgCz^(3H.V fhC3}A^`c)zeVu.?'g&fs߶(~CtӗVi`2®Ʈh Br(dSbV1R ?^!+H$ʮ|X{=3A)F)#)F[|It^@3 ITi4SM'f_ %F@BXv?8hR[9O_b 3[#;ǚLQrQ =&% N"(,qKźg= d6voЂ[ϣ(\MJ<#f.Apj|Cvoc6A\grK]X&F3<~f c R#qSۙY]ݞU[)I_,tٗ{ ;6|JSkccMzgYH :~zk_?](ŋޅ9ek-"8^nsG ,EdްN0N#V'@<_\z;ۗ=|Qq rrv"=XhsH±"Ͳߗ7r&!,- S* Yk%X^e|==#,U 'uޱ)DU[os 1LVj*'9N 8p/ָ5chw[{Ւ}RTzk>J|~{I6G}ҟNḢ XDùIW+!ِszYό^^M)hQyo rE#Z 'Hz4}᪔d6+^mxIxR&9tڣTRD' r{@#X@~HԜ̊#!L--DGUFOi~~7Y}OqUiXRvus)Q( Cͩ*}R`?+ dטSؗ**So+5;Ԁ M~paH~G]E-ЪvDq=hUVv!|C7#8~['&c1tl呼p< 5BHa$4Y->N8(\5}&߆ -~Z\M3=irQakBqiziqMG8E|QxxrcXH2b@5,Q=Ic'/* X.W^aA)td_0ss8 HBC'Ⱦ~ q/Ebùk-q=<%GY"$fy4VҜH"Ͳq:4b{gmoF(IEWbdt4GHE,FZvfCcָ684a"j{f<{C_x׹1QuoX𜸉ipFqi8 Nzs_79`@FhuG!L8y\u"w@YfYBNE4䈳5s&ŧeK^|zc]¼ϻ}%\/B5.QI-&i\%$w:K8 08o0RQR B16R'qp ?x]'}bW-; }~d4!GDȑFt"ai"m /#>[aB 'e Mhy5m ͰWP4-uٶ %U>7U`jo_mⶇ&C&6ۂ fy8%UT5U^-WdCD N,+A`8EC? |Ք?il~xۻ/ +MYDWU~ff_=`  ̇:^Oo_fث^<4]@2(G ܤ$vM9`KKQcSD3ͅ[3 2| 1N$I b,`W9 /6L $r\UkCR0{xI*ve0X lupq*lf#25O]7nYE"_!8{Fx}SO3\h2^T KjWl#Zɻh/1 \.oqxx|?'d̊82KŻ/P=L ZCIQԳ煮.'D0WNr; 4S¤%cQmz΋@b/οPH{ohFl\*z(5nB. :\ o_iɔv>օ8,EWYuA$V#4Yh"UWo>IER9ٛ`W(Q'V<`Sq6ye _F_*pǫДypG26n 44 rvRLi1ZpQRBuWQHTY4⥀ TnrKȾ1yN#m܆ ^驙.g4b]S;oo`wz>a]O>|mΚgc=(em\]^6&6 x3Y^Qt9t_jˆѕC.Q8Bo▢2ARV|\о5>~K o,c7vhOG#t:`EfŢ"r)QT9^>oϫ=˸솎p7 p5㔫"C°njM0i v;R( y0mM\zM.7DҊW)-(<4ס:H7O\6HJ>W0@ J"Qeł`|CXBY$[1yMkWX8 [+Ч&6|Ps_J0V4rzkCFy>QhZ;)eRBPjW00+ ^X=g`:FO žv۔Lk[Jwan =9NfQ`/BМbK#3e@|&m/1z8#ub, N\y.\"!]뱨2.c@umV'w@JMOv7_ך&* '?y?Lm bYйWcx/ U.z*i6@nȩf e>:<L:ht3{mTQA-cȁ[FdrjEL1#U@0Varm_L!#A$ejURQu.2fy3tzpe'Ԏ"R%,s>ۄ@" 2~ ?QVc3&C1m 0Lq%e5pӻq?BɷSJXgP`\t 6etcY|ߦviBmE$J0*!;I^k?DSf1u<+L?[BTBORfN*`A\rΐ.PHg">4fc uRd ?>eU~CA_C_A5~-}I·WP0y23TZIltW0lAճN}̔$X쮼9>~ zthS~gv[0[ r!flg"te~\1*G5 +\bskrpxX=%&Z:C#yn8^n(H:^7U4t%u\5cQG3N,έҏp⥘$>0!CPbm :!dZ yr<1empt ɕЫp2$*g ZTzafYh^;I\4rwVplCSדAk" s܆r_pXSN8(|nN:}e+Bl`r܅RsK O>`ícx΀3bz6^l5VL0J?K)˂v_߂Ou{yŹpPJ;`Rڞ{Z:=OHFFe9@M2-œ#|92UHQڕl݉W4Lк-a0}@)iE=H L%Leg.:D h 31, ;|tAI!RƝvpefW4M%Σ}Ё+kwiE0.yB@qaE5 J^M~,1u^w`jabP(5TW[_%Gg19>I&'&s-~IbNn{E_v78ߪ)7=Dx]׭!K~ZH4I&h)/V75rSrDk_\|PË}oE,`ըlZ肱sy9]ࡏC2IW-Q'OQV6? ?Bɧ{qJ|ˆ/y^;ř;KۛۃIY Jεs P7 :jBԽq4lyL!$2 ֙{E՜ZNgiEXnCU'#0+4yr27ˤҌrtkONr\1]&!=ILH:}G=bu^vOF1 ͸^ yy|+8L`юUepb-Q,@HT .,H3[ ޤST iT/]zЁ0 3QqkC9!D[Gb[b&e3 ,W熇Ј\m=2DǕEcs3zC"lnҧVLHd$MKc`_TuJJ#Va+y7_Gу[t!O(:·*}tѽд ٽae0{˫\Uߟh&zODl)6Q'v[r5 'oS ?k @4F~1S,4ٰ*C B5Ӝ9f;{I?,SF&W}uo6' :q"hIe]g`ׅ[صVnl;(딸Vpʤ䕅lxYc(Vѕ!'PaQ*݂]T4`w%"%kkÞ݁ VQ!j`ilu,cֿž.!`tn ]of# d/\]Y!7eоjX*AihǢ@(/'ndYӦdqG\d 5sK/;!K\e3k,2(]QLy̦l5TNe_^l!|fN'Ϩ9UQ?sN*8*uK-Sό AΣS}yvz% I\ j3@B ?6gp٥Kr!3fkkT`7 >{ ])]C|E5ٲ>;. \>^Eb($ui-oGNɎW]шِM1]Š~A&&[tX3=Udep&\樀ݿ~]m(Ǧ/źnJ:ZD?09(fP썾>o߳b\KvD|bTʯc 5p+w;x/AI&}6'WXڠHx}=k#T<UVTv=p~L̲D| :uć _qI cM;sca G:'j)Jm 0F\kK\J~+2,TlEᲲ]25&tup} A$k:VFbN *C*aH¢on`3"\F "Puc SCFe!%u0Pt3As>"rMZHkvKH/ -%SwLʁ -|l_|b3 tri8Ds y]N`ϐZٿO8{MEHX,uH_}V`/'w}nUd@PGeҘ鑈x#s'D;#n KZ ]I&G/;ܷ0ZD;osC.b fFmnbIb ú ? OaMeab"f`8'xmH<SElg%.#5*'c횘ۦ)f؛2#Z}>e":R=]w3}lCK"nIFq{o|HGpbYLJifJńTEbaT[0ԧ\^B+R]܉QYL^N){ȴTtYw?Ĝ;ԜEeQ@p!|`uC ^<L!݉XuC>Vک׳ G[xLyѿ6fqgPUOc#v)4THc¸!A+4{FLfK3jyH ɵڑ/C燄1\YČSdNJ'fHmӵUxvNjKg(8k8HT)X zs#S]4k+9Y}ϒVj1ו[-e0KlOES{M|k4[M0Z3[Y@CrsH-SGk8ٛ5S\_ee0IWc9 ˯{|2S1Iz\mcnhr+W.;Xk3!nB4lb뀏}QXa#K\@><)P xuO]5u 3ѠhrvaٚW ^hYP6NLޅ։ ~4f@ttnL)6S2 &:q h t\<?(ԥ񤷦K.߶0aʽ#|^MN}#r6iS+QP7GJZN*fo`%\*6CHFyps"W<ե hɄvEWAE V).t 4%"5-̄«9sчP?m#|^ S|Z 85Gt'DO[6&\t`8_HuO^n'+',r#H'\8p"Od QTkH(o/9@R]8+Ř̏a;|iZQBZ{}wF>mI !Ldٶ柯6]pQfN.=eFd/QLZ!Enȭ5 H6aq8tt HȬ?1kXpCZ iK -ցS,bWXM%y4YLж#Y¼:-)!y ^Ք7ŋ?M)n\^2R| Z%_zvWRj;gBcr=Alo^B+bb坈ы~/$Ur/{{:.S)qz.=HY`ce@%eҨVVM\zVJIՁ.?S+,!K<8â3L3k`1*Vu˔֘:7u#T)§F÷VI:(ݗQhCp͓hI@+TBǖ@~]*  I0㑭 Zf؈iꟺXIfmMh{ANrk"οɾ!@i@>rHX!.ְ֦΀M&KDc=6΄[`]_K8ץC%~x|u ^~6<V'cun1kJNW`1U#?|瓎gѫuCֵTbjHAj)o Ú.ӦgM=ѳB3C `f,Fp.jCZKmw'b !o% w둉7 q :U:+8D] 5$hUZz6~wݟtX"eWVD4e`# 1/weS{Aޅ('+=QjemX TN e3Q Y?PV{Rm|u}C13p1k=QCޘr;5X `ne,*A G 9 M9Is2IS ^PXο!=_O?Dn'_: w=k$􋋝RP7'BqHRSE G]p Bq|3|5 F#ǑZYI+uW=.4WAue|*2o:q}rf?&Ӥ==pjm\ ]yܾGv[,DcA/d|'4#.gclT&LYuڒDT{a(:mkA2O,G4cS 0~FKU+9^CsA Js%/tVa,Q㴂d o͍`!ب!M_h¾ن5 vs{jDak .CxљyS=OʶOd -['V䙡u}pdFV͌*="3FE~3ޠr7(tR#gY'B:MPrrg?\^1:˥n)m-ˆ2tx;w’7`|CxX,#?QASTޟ1^4 :KfQl7ZQ\p*:l3ZyZ{6!͜!']4vN=GDl''~44mcDz1~ WJWV7xVXTlz E$7[ b,.ayʥ.yԱMe#5m;,߱'Q _rCrVv,+~4V̨^U"GR绠<էg,^ǔhç@ƶ# lXj`h5tTMV3`Wl?IXCrcrQ!7v2PM|ࡐ4ji!^*D\g8:Ju~p)8)ն{˵m#>{/X)"GX?*ML-]6>/zXp&G jkXՐ<5>η( W̘JF5% @-3NpFEIF;d2%⮅U g͚fdHC]U, ࠶Z86{E su[nnx e8lz%{ȔmΞ\۝wz-vo`5ST}:lճ߉y{d#:1An!i1 RY1OHثJ6 YGB˩u\AVc E:a|m_n >8^ YZ