libsamba-errors0-4.9.5+git.187.71edee57d5a-lp151.2.6.1 4>$  Ap]x9/=„^@@jUFmLH6Zb1$ѻ7U,Eڍd(>Mʸ/9 ):Ȃ/aT{٣Q-"8`Yb}@Pd#롏|ZIq 31yz,K,]_S0~g:Uϔ$$*oᰮqj 5d|ϐGK`t859JWm*DS)0] +9P8[2NA̔OU <7951b862815f0fe9468dd9316862a64776be54e6ee534d307b348d84c14bf58d44fa2c96340b12cfd41007f81d19281318c4c90eG,]x9/=„ϼ˜>-p\Syq[q CN dŠni pl V 1b| !UQo:k|sz&&5Wbl(Z%NymWi9#Ǵ*ܨl$ q-S"U/Z6MtGy^ԙD jaf!*>#f9V/n Ul4yxXx4yefiiFM/.l%zTHsh7쉍 $ڞ})#>p@X?Xd- 9 W &,48 : < @  0 d s (89:>Uj@UyFUGUHUIUXUYU\V]V ^V!bV+cVdWxeW}fWlWuWvWwX,xX0yX4 zXXXhXlXrXClibsamba-errors04.9.5+git.187.71edee57d5alp151.2.6.1Samba errors handling libraryThis subpackage contains libraries to handle and translate NT error codes.]xOcloud109openSUSE Leap 15.1openSUSEGPL-3.0-or-laterhttp://bugs.opensuse.orgSystem/Librarieshttps://www.samba.org/linuxi586]xffb582fa116ee08355df51d2ec84690a20694ff9066469238e7789ff41bcbd32rootrootsamba-4.9.5+git.187.71edee57d5a-lp151.2.6.1.src.rpmlibsamba-errors.so.1libsamba-errors.so.1(SAMBA_ERRORS_1)libsamba-errors0libsamba-errors0(x86-32)@@@@@@@    /sbin/ldconfig/sbin/ldconfiglibc.so.6libc.so.6(GLIBC_2.0)libc.so.6(GLIBC_2.1.3)libc.so.6(GLIBC_2.3.4)libc.so.6(GLIBC_2.4)libtalloc.so.2libtalloc.so.2(TALLOC_2.0.2)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-15.2-14.14.1]_@]J@]:\ڭ\\@\ \N\e\e\}@\o@\\\\\4\ @[[@[[%@[@[ @[[t[#@[[Q@[Q@[\[[[{[z@[r@[ @[WZZZZZZ`@Z@Z@ZZ@ZZ}@Z'Z@ZOZ@Z ,@Z@YY@Yo@Yo@Yo@Y@Y3YYu@Yg`Yf@Y7Y7Y, @Y"X:@X:@XXsX@X9@X@X@Xg@X,XƉX@XYXe@XX@X@X@XWXAb@X-W Wv@W$W;Wu@W#WW W@W~D@Wj}W_WYZ@WYZ@W=W(W!@WW@V3V3VV'@VՄ@VՄ@VVIV@V`Vl@V@V@V<@V<@V@VjV]VI@VG"@VG"@VG"@VG"@V(V'~@V V7@VBUYU@U@UUAUĝU@UU@Uy@UUrUq@UhTU_@USaJames McDonough npower npower David Disseldorp David Disseldorp npower David Disseldorp npower David Mulder David Mulder David Disseldorp Samuel Cabrero David Mulder ddiss@suse.comnopower@suse.comJan Engelhardt David Mulder Samuel Cabrero Samuel Cabrero Samuel Cabrero dmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comSamuel Cabrero dmulder@suse.comSamuel Cabrero dmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./sbin/ldconfig/sbin/ldconfigcloud109 15682056474.9.5+git.187.71edee57d5a-lp151.2.6.14.9.5+git.187.71edee57d5a-lp151.2.6.1libsamba-errors.so.1/usr/lib/-fomit-frame-pointer -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:11057/openSUSE_Leap_15.1_Update/7d5b3605a519e39b7d410acabc99983c-samba.openSUSE_Leap_15.1_Updatecpioxz5i586-suse-linuxELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, BuildID[sha1]=eda9bb6d0ed3c412dc35f913710c4a36343283a9, stripped PPRRRRRRR:U>'7kŕwutf-8d8207b1127f10d8d43d58239f27348ba13ed23228ab1e1235d71aec024ce03db?7zXZ !t/`] crv9u#99xueRCF^#8cZ*<ViⳠLC{d9HIKHvԵGU(q)Ci$gy+z1w=K3J^WӏR|< 'ьY$7Ęi]/1#>]Gڀ9+PxTUo+(jy V𷋏@όE2GѠh8WqRGR {^Yi;@4iʈwҀO0SP@fG\EUI`l7@njd gI9i.(Lhv?cC$HS4lV`ҕE\;-nb-6CIvZS0?S!\o8df]MĻ]Gf#^ey܏<)n|xќ2a$4lDA)Fg)93n(n%B Xw#gRPArWYyC)y a%E=ۜ4I/"6%!ŻJ$y<$b) v Ѝ !ha~#Mw}61#WUz:M|8+Hg(n;t`ݗQ&2<T=2{^Hѕb Զ `UFm5=[Gx2qjx-ye eT|*9i8=Z~ V"+QMZLPU'ttja;IbEyg1BR(K~{ErWyS0ZnNT܌F+U @[=h =m489Ϧ+dʶ6 LeLZA=օ4|h5Ce%ʜwbj9:3#? ^Ş}i`،%3Q\JsAo45J gmi%q `}F KZ2ߍH%ڏ̪~ByP s|dWaצ8JB@X=)N,vS-/ȬhlU$3 QFkB'0?7c8wl.Bc?&Y|=$qͫ!n1ANڇН WK-j^#~va3#$^[X 784]Cu zt'91J-= *KgS%4QY$02 Hs'R9i:%|ӮTϊ .Nَ 9O6=[$7ݨIBS܍F{PKnf3MQ=} QlK/^D AL?QVo :_RdkmkܓڥClr+NX5 M-IbH:D+ 5)הgĻP8BQΓPWD4M^OABY*=oX1z임4_}\xՐ)Ÿ .ѫO*NJvaWz'b%(a%c|ӏ8-Mm2k6v!e8}!(ZzW 9z&Bq*m=ҨzUÚ$OD=T} j!P(>3[S* @4EF1jOAW1n*n0ol&S}6U0\N5!3{:yC CxVbP;K1pˊAgL+%*% !H)r'-,+mWq%d !pK_0tq_0U>Eߪ0ŝ=5fOŚimR%׍,涶74OM EHs3IAMP=t f:Ojg;R}9`g @vx/dCJ]%j;^ak8WNX o!n,u)=-|Wom}žg&[ml}i>QDЬ{ lvL  `IB03Ra,&vE(WDZJ6h|}>z PqxW #.Υ\_DjxeqeXSE| (S+F}++v8ښMN#H=Ӌ^lOdlj{1Z%/ QE.8^SH̚VMBߏ(.m%I%o-Œ:*xgG83zOVCvO9:74%w @CPhMi%&?j"f)NQ]r/PȍN >8::TlɃD&Hnf4ڿ9x铇*= dxf%ڍ:mK$>mYxr-qӎu5vh@RۿQ,K ]I *ù51o~.Ҳ7 U ?!iK2 igY kL|Њ@?5Pdp)b qV%qF&L*Z6zs'<`Lꝑ8s!P|CڥPp\&,ڽ=9tߓh݉U kXoq,Fjށͪ @!s<mɞhw z;I&+u-^ௐD({4QpL +% 1Eqv|ʀ|+t*{Kk&QG8FNw %:D4xs9 0m2?jt3|t-%o@6,(b\~iCJaF JYi:٤:.9kwb!^>_xNYޓ4@\mu )'(m$4}; 7/K# 4i4f"G t:\ϴU!Pp 5뒶RFt ]" s VCx,4RgE_'q5mEAT'Mr:Zj9Mot#Î|FR+K h49;6'0#bم^|Mth&4w!fRђ[#VQQ(`R;˼#H>-O0 DMB~,cSUepVC*np,hLr$CJ5YD O9^aCE[G16R$~iӥTj7t@ǬD77$\]<, \*-xq.qxiZcJ u"a ݬzn6^ uFaQn(|LJ3pWW?.ݴܮ;=~y{-.ha}e :Á["-$Y {D1@iYfzwۯ8kCȝŰ󢰩aYlrV$XmK,=r(NS ۣ.kur=@m"y1.e}$ ( IWc8˓WT @ik`DM^zKJ?!! baP)]*GVq\:ӷDʷS2,mϛJ,C&A!JWd 4Ð : _zJ}iỎt,DuQWQ:τb(x  iKrz[RU0<^<:Z=VxφE 1Yσ27NSW({Vp{vF4T,]eB 8CEn}UXfoFN3z.L<[ϷC "MXC쩞4ԡ'3 |h&a^qɃ=i"u0g1NfLD=Ok$}n~ny6T2iP{Wp;RWPN +-~df%+ rzA1; ۴؎ l簮>G,wGJ{MBiqLHs

hFdHB刉O&<" RmqSJeyghT?" FJ}ѢG΄ c-"gf֊}r:w ̂:3!+䡛_G ƊY#Z`).VN71}"4^;("z7A#7#agaJJؾ}D<3oC ZP28Q96$^_[g('2*;'wWœ}aC.mo.羼-- e=PEbY|Be@~`q ,;0WZ`P5ҝX%lCA {MbV)=cTX y~z&B0nwUE/~Tm\E+.Ԡd J+F^c;9]9=LK#E "mޡA0q4?T:ǯ%xwi/43M?i+ mU9mP*IٶMճ֮ɳyq]mc#ClXp",v>V-E>f ߬ {pƥ5214@pFO׏p[c<̷Ӌ`&PmĜh8M0+@R=vR:}F@'Ⱦeߓi-c\GJXTSe-bl~##]N.d;Ip`uG(\Y&lTݒ9V|OyvlMj`-ope:x5y ԧ{{!D}"ZZs56K1hQVPq ԁfYIox|F>5O!dA *t7"owӝ_0z8Ѳdeݠ Mi9y~7B eRMϕPrd3j 1Y -\YǀCqH4/AjWWH#Uxc̉÷DSBJ6ڶ|<˟}zSt̏AT0{挨=Ao *Zd7c˽Omx$i~dArqg^ɧ /=2ŹgӬSv#,Sɜ:y=~Bq.aM2@ᯧ֠Q?ԁlcIUO'nb8xGy_zY pcs]F&nA݁qbq^2|L*qȦ5=Qri$d™8/t!_Y{`3f\RRM\Y?eֲɟ5aq2/) }^ExH>5Yr`&Lc83*CV.db*5a8wU()H_SsXM  /9Ux$wM-a_l¯ݤ3qjHsDE0oi$vtxL]139bhUFiV$P\Q얦w(+˝" NvɯGjr@𤐖QoiG/Ju-̔Io@V|: ᑮI_ҽִMt6'7JdmjzR*$ͧH}8lR2=Fĩ @Bjv`g,x`K ,FUS)OyrR1fP]@/LXMYKn]yh'݋쾹$eM .wK~J5ٺ4c^u?~BppPȱ|as u^ <>zvO5A,nN<:keׁrl6#5[>^Zk໡1 q3RDSJPG*.F^IcJD#t%痉[{-q6'FYlGÕ$QR$.0[ՠmnZnu-<- 3^h.Ԃ\V|Y`6MQV{FBTOLt.D#PLvEE.ׁVR0O^no8 ptђc.wtgTRa}X&u|7H70w:[崗ui$mOMt)"fChQ+E4jSڹn:0ڂ F R0 -V >x;Phs3wC-1 o6+>QGoO.nQZv,N,0ĝ.NA 㝚k4)GpHUy"o$ bEDXp+FF 74{ͳ Ĩu ڥݖe%czY4@"J=*Bޓ,7I7Ygc~sw=B'QcU^u.)#ˋ8z߲т9Lj+y\-qPyAu4߈qZbM{`@Wlݐ^|ա6KoOu)(9U[)j_iH7/T\2.G DRB CҪ Iw#e3NcgE1v8xfk¾'iCkP$aL!GkܑMȄ@\ӦXπ:#Vk2>e{&EjO,/ɮF̖o\ #kdC x=!Y" Hάy&$_V"ObW_j/rߛqPÇDg.e6wh ~SoLQ&ܭN`\_  =Yi.ay?2t,i @8U0TU;ySuON i ],6y/G:пM+m63Nѿ> q% U.Vw v7E5',>FM' &Gpo8LP5ṿs*Ed3zSV o`=h>Y٣)qKf!'E'1x5 ^\R3PrW{Lh%{֠ba7Usüv39y:÷ezg(n8(F^P9ACFtSATq1xl飨*S- @dY6U&Q"UZl|ʒ,7u"mM3RM5#KhF_A詰$$sHTJ5o>\ҽKgV(&a4#2z~J>4{UF,> zF1x,+n00iDS)< SQi"gEāqm=:7y1aUzyX D8p>tc%Somt; PZh@gg@E3x. I'Pպ݂sOCA[=kH{)B_WB@WY+I[%e#zʮ=g_]%@$}iө1(n"sGg ( EN^!aTbہkwu9jLf&m)]bO"Ok;S@цrFd`nr=[enPt~!8 SVjOւl00_&*OtM&3 0aKH()g,IU~1T#אA pF.dYZPW?u@CZ++r|9s21{w jN b(?]QG_}y`5P93!q = 3 Jt3sN{c):?̈]W׬9'??wK wĬEηm)n/5b#Ν): R 6O?g a~Y^ =8eb*Oxu?߃]`p6&k\Q|mv [h@$퀦=@G7E+DdžՐJ1!jTp _njaD* FV?vLy#kB{;l@JUBhPg%㩋O&8*Alt oEޒaN-l t ϩ>UʠC.* PEDr Y]n<#_:qm;j<(WL.;8o}&Mz Bv`cgƛT *.> ^#,b R[gV2ƺ=j.894ͱ3\Ů –>91J2܃d_Pdo$nD>Hz*`5SZf!4EyLUOU0 TIW#6lIa嘎I}9QH9o35A=&s{be|qca xo`RV1/K^yRc YkS K8F?|]Sy722Qo|=I$|ҧ_k]!wC3%o :/a:r%{`0SFB.~6G~TzPB盛$.pqf/Rĺ؋$81c}/+ȳ0 r:=]TVL|6#u4zj^>F19wN<ױ,{w\,ĕ0V PlyL{R"l˭w*M_3^)[dg{iVUCI8H}TXfZFS{`S+խc~2_ >[-6e!oCQ̤6,Hɭ,˾lFBaΜiGRD / 9ladg[^sMhδGݟWΝ YwO` opѱn6KAvYw8tt/]=!%!O"?٬+q=#֘ ܮx5\eR7 !#ZuXCWJH@]A݀H{ 9z%E6kgE 0pMʒv(K&VEL}ðyl ˭x12XtE-|7plAmzP7Z$r)nHqmvtCz'5g9/4g cr~!vݬ>ɪm r>"'; LytYI >4KfZ9%6Vt> u9JTI42 p9/%7N,A%>To.b$d+ :!qVi$^ʨ,J Z L5ee#3)˛]ͤto$7($ap_Wx: $mZX̡bhHU)Ayd9RG$0+V$>ur)kxu"l&؄Vi^eZVaԑ3%| `<2Qu}F%lG~Ƣ͜G- y\S uRut?[^ ?tvYPԠ֒/DZ:d7q^d7p5)o$R8'd\qFGs~O%Cz'sg}8+'|e@\Vz dȫ%h3MۡgUGNyȪ6.D&( 3E?dO(}= qm ?J`Ôs7_g(0*ae1eb D@QZ[ͻ1IY!ڼzU#Nd-'ԻΘ$ԙ؇zpׄ%M:<[M* 0)YݧU($rEZOq4yN0KъƜ@1{)W?_ޚhn<3S  vg9c[he?jjb>^=%^lDx(X?*Ls$|Mm;.>{&4;-O58?Mu1a#ъۆʖ:<`ݦ!2 F P$U7|]lI z 4!Nּ-rZS|70D9|!4W`AIA!ADWZҔi %WTzgOKlÖzÏkq}_z7A4XB:_ʂ5(r604^5&6B OϋڙļaؐDc"9Lp)Z ڕV~v A ѨV\`kmj\jBg(pIcC1YgpsSpAUL]H$z8pJPX ARQCkq$T8dWg!?*f &/H*`zPLBPzv__/}v"ӚĕzK@dl̓G`S ٓX/u.1O@~Y>L֏ts Q"vYWT]2.l)xX#Lip2DMMmnŅ|_^6gyRR|Tfa (4$#$B"Z* pDEz92)\x%pɰ~>n2婡hm^ىS<Wd|Cp_ŒA" %{ecXE:"7@5Žeoˈ ni$b鹍@&rn-&׊fݓ=}/V6@|L-Ax6ßC}R W]QP[B(z|1)߉EyvnclW"Pl,b ,?8̲'\[~* J_ {[tNX;UmƠ4]^$$e=S1{vqk_58F3Z;fX(GA:bEqôabne|KUa+Zi:Њ2[W[#pvl ݪKi&E\Iƨǽ"heZucYҍhzO@ OŎ/2yI &;T%Nb{2 D=WU h7a 5h 9PD+Ϩqv_mE uH*=_8$E`'5Olax)H%͂3R.)ϺLj2}p NS$Scd`{}n^(v{HTGyĠɐR/)G:ҋ@ڽ'C}HK'/ f ։Ñ.E&#%-2B g}y#/]4F2b>J⠔2D2mz8I q'FĆ[\A瘐`jׁw_7uP.y1XʠWsftʾvYe("n2Р(2־ufa4YAV0JqG!R9K+W);F;ד')<%_gȊ)'RgCS^ShƜw#"!;µEd|춨f˄6u!/$Yr: %KU|h[ }t[(.!qN;QGG1K(3,qh f:lIw a2v0'Xg%xMX*n#=C> _Ї}?n/^5A`{^+/d=H^0sz#oԉ~J_+%YNBufSTvc75_Sf4S0Lի!vc Fb׼2-pG)(jv^ +k Ř* 6=G)F( [ z8uQ{'N%h|V'J8X`A8,&?P2Pd8'~":ԺV^pS09b(Xf? d X#K_E?'yGrt.٤^RE}|ș|Jw4*WnŅ6g<L-f,Ȩ(}o" ͛sz^; 9qR3ʹF#[KZASU!3MBvt=/slץEN"vp%H6qTjkH$,,j=dA9*&#zn숕ZVҒ%5PD V0DqS kEsu/=ZL?xr>cu"N(Si {̛Z )Nؘ8+&1SX `eMr7**m]&FwIim$ MCDT3L\0nkk'B'ē^ѻ>HjUSɻ bDM^sX7faSsĻciJX!~U!,OmRѳO[+k0-J?$rN74CڪE am;xDže}*F4jZOm{PV@ˋ:L"﹩ ׂP9hl^ysas>\! Qr-ywY4qк]KRZQ҂g!.b7ٕtdx0QF'&hM dW'# )K_Y'6: gmN3F=Ά]FQUş1,B8'Fy<=?k[pKl[8+A!~~}YqbrT=2r_oRJi,m άlj:\ݯϕLQ&סdlPD²ԘmG~,ld43i'`bvQ}7?sqQ]4z*p^2!/2* ̻ϯåf>_2*sWD3ˆ)A&7vԉl)nYn^q_I1E~IT3.dUs;6w\%U4PbyIڵL.?ް7c< n}mnO&)XI.)8݃nBFmT(*F3A|JJE#X"LI41X>!<}[w:Cb?f;f栆O"Mč>jQm*9r5`(1z;-RL0+KVvy-W>|R1<ĺ!YREz}0If~Ęjl51xaR(7z;z9P*L;e_w u`P4Ze+>wCHeh3`ÑK?6N;˓:Pm_k? G{;7W\5Hq39$ŗ6tbBa~N]$\%˯ tn&ef:f׺ ) nO>HWҠiAv:%9SbY+H9Jz4Jj^%5#V̻^0O@d"]'ToC)=gw7î1I8Ƞz![vE}cq,wش,=JGY VvyE>Y7XKX%^6T6ؒ{ E+q# PgZ@XT~c`[z\-Ή=z9Z+F9Ffe杭y@/xZع%v(S,1}=>!ّ͆ ->`k5+73eGy?g3*11XXPy%d `v,5i܇e^pPN1Pه?TNY=BP;SW];F,8Zi`,UޫɮX_/: EWnVЅc\F='7|zSq@ѱbA=H10 sl:VMwE s*[`uOL Gx 'J"xw+:[0Ҡ t`G$K$7a1jmf9N#TrV%ÁQjF%v)LL5CR S.4#-2eQq(t4=I1[ktjJdnV>Led".Jigس=HC0)IT-rgh/!IH=#  ci(̂#وY_"O>iEEx)\J6懡a߿CxI[-HۭȁGOCzbUY/n0ċINI,MqtZm`ͩb)KoO)Hf_'ϞQ|CPeiPZ,L=h| '[y>X~D|F!AI3x>0̘w~WWNEa[2wֺyQ^!M؞q sL~b#\x>-D= B}ܢWxS.3Or!Х@\ʏГhNF{S6[]?ɬ͑.PՊ93y%jU% 4홸A ŵJ*GWR3|B[-%=(ϼF*^$;% DO Jӳ.Dh1m.<n`X(]Y?%Mϕݾf[|"L+F|:!EK%K|q6k+k[k0H`(6F9.淿B< Y>9|wJ1hEdl r01/Ϲ$*o 7"mmȱ~E]<譽+C\s6#mH`<ܝuG(P:0I7n/Jm r47QH0c;A1 zG2"XTf#E 40ۣ&]'lJ7.OCA#Z?ks6!`s $J VP;"<'2 ~^2r4WNup* `l!D@>gq^@~->) I wfYt6ZpzESu5xR(9RlN0gZl~s&a$<U /ZK 9;h[K[j#@#*G?k,P; Aw^/,R߻UW9qthj%lK, XCA:cKT&4m=9GU|gЄ>'F*",~: TMD6W Zh*r9 %=8?-k(!.E咑-, ˥a vWDCVqTZ. ZBċŊm(Wuy+Z-иέӺMo@``Ԭ^O5 1 LIMƒ #m RM]7S{ՔlE\`2R.O{ǐ~8vB:4qS%`L%*X[`zDH O^-i?)62!`׃C ja1"s NmGAk|oX4u۟L: bHv(ɍWe4G] }~+nB5Wc$H#MԣT1 h: ,Q^V*&ɥG.n#_?w˅y[j:ݱLZ.+*65W2:g&A&;62U=F=WWH?_VJYҨDZxj-+.*t؀8^Yt3<0l<9Fkgͪw\ bvۯ Z$Ǐ-ޛH,8+.P'u=a';dkCOm~F67i$!$g? *v()37BFNMkj gDM̦ ToXGBE`kĦ%L jAp >)84nK;!ø)š]s@ $ܵfT!3HeKQ92:x?ģIտoЇMKXbj>4D̆!byn~2ۙy1BHt;iOӻY[M$îJ5ݢGwZ7* L1,DG4A^V,Y!=D a^%ۇa1{}tFCSzH^[,S6Zw_O|jC-h䷊S:I@-&M1 (!ףt0vߌR]5"RɰR}}MBx 6gϲL؀qjb_za# ;Y`LBvdO "L^aGO5qx0,I}/>p ׮.eJ`DF]e(|E1dihsؼy> a4?'TeYɆΩr{ʎ+D :f}hìdjjh>7J ifۘ}Z= a*K^q]{Ipv;+ ԋRǞ`P)ZP:`=b-%lkyd ^\I;17ވcQ.,k`Fv8 b5&HhvG:#u^1? |h+c6DXJrѱ{JXZ<,TP88ڀ_M0cd,;}WN+ ,Fac(ts kkJnИOy.TJ;AܢL@}aN%jؔq"LyXf9|rhӎ|9u{^ o[%+ߒ Ds_zoG/f8Kg)?4hi>WZ., #Qc'<~*[DK }' LIK4Z &/X--ѸSwu=ZSf^JC@&&е%?"Q;H9bs?[HmѻL6Liܱ4mz~Юi! %Pzfw֕sډiH 2^(\Q|?s< #x;''gtd/̓bBD>Vo[l3"w .Z7OP/N) m|#I}UXbkgWwaJpR!w*aTf6ա"7 %9m_̶3*חLZ4xxR~"t`}NdSٞN4>@ e~>6' A9l_eG3\/@;cU@%QHm?9 c$;ᰍ4/82X@^[YZ>(Wa.Ň& 嘒KE(2U.v  ]U0@!?s1Pq9 3^rYnL0Gq$^*qiZ Jmj{,N=B:;-Fm*KTSB'Yl4u =kQ̔ȆW:l|Rפ{DZ~!ja;_qׄIՕ4-{z5q/Ӟנw*Ir]ΐ[5 _ ?,PԶ׋!AܯNUrAWHp/HRd=l׮{zpv'h_DGו P@61J`vA\1t- @y{v`Ӏ&`K՚NfX[΁b?1wӣ{n[CkA9@@aCD]> ?24FEs2-[rp#UB!O]DF҈]._<պTq6. zƑU9С*(oН z-}HրқPMD ay)I7nchx! rNz+ ҩfGxY.ӯ7Lp' :?@fɎJaXb( 0־St31WU=qo殿_*&fVas9+O2[&t=3IW1CQKN;B.^F&v~ɥ@yõ3m <Ā;Ǣ10Lշo,[M}J_r(%<wpTz$ Zp0H/gQ% t PJCPg߃A"y ܍=ck"k$^e]&L7X^:xה"!{=6g·Px_u KǿunE~l)ؑ^E7eXhȷKWxq0lr:ͅчd{[++ZQבHOǬ^\%VScܷɂ\fc,a"0 ̆Y@cu:%] 3) &Skf0n:_N'ɴNv7SU67K?ioZ6!2%w(N,g^vX޹Npf:VTIG=luDF2x. Ȱ[|5s$NckBsF'-D0%-t\Ĝ;%{GmD$&Lbq}nTz.X(Zo>eVl N_<ABd8; Γk1Ҧ>1pE\onVq&uvSn94{4+iUMy'zMY~ץ6F/ĂQ-q2G$DqO=4![g/x-&t<:u;qrYjav+/n]OƳfm^!&nh^@[Aء Dp6x>OIնnɍ$g|9/U`+P!'_~É&*`Zi' )+>a[9=*WI A`ypFB3=hI1U>ⱫA١$T{otvU{MF.%]іt0~|L; Q,& ]]?_Fs乃o804O+bWgjwAōMt}?xSvUؽ4gHf*.ș=R3|P2C^Jwnm;Vyhiox])L#3|.XQKEئC}-cd*1ߗZt"34'/ze{~ yKH,AB,]th,HR =tML[Q>rsܕT]O%:CDF~`- yc۳p SM n(:(dm,XGIF;^4RQZ>|ozKQ /[kbގ*iۓWOxe3rXRS@(Lcz4POsQ)*Pw/R5U4M]y?7z $   XZR3dnT|`Im񾧫>E@82xfcO25ؼ8pVBD jP1jݣ%' z1GHpƈJW'EBM՚#}HĽ,RKsq`Q[eКz)WV.a D^n/C;UV.Iem|y~b:njr|Vb݇@q;YpT1Rnppb2rcbez䐀gb2;e}O}W=(zBr'D{'S;7iPFY ۚ*eds~I-pϊ0E2Ȯc&.#bwשgd!lčWb]ЉE=p~y WEWu$%uRI)~*ojG:w{&`IA9E(vwEPAN~t9_K^[G-Ɔˏ?Sوnka;3%]~LY0KJZcKT6^Ex^`m|*Gz!~NhHùz^k$p)CrYn>SmW4~?t5Ivm#cpC=Q*X]9~T|S4܀+]#}-YF0QyD+{AaOs}k؀D se+s}gy-?-{rVuG=zAauۼJ+f~!_g֩cq+d{=FNw3&nOlM5w'>WJ˨,ꝓ `Bwb14;i*svM𞲌k8WgϞZg%`Z46."'$bjm- DǮ;OFJ}#Eh t} NxpRӏ,fS3W3k]J};{}2|h+܌tslV ?Gx|NmqWtOJ7gmbac<$F qP${)#t"ɔUQܾ֖(SN? T_HI.my욅UDtw0b %4NDT.Tgo<Œ2ؚ 8`/{ @QFwD=VJp%Octh["J;"pUt~Qd71#E P(Gdct[ߥϹ<5I=ޠMySG;>q% 4z1M9ic܁/跛<8f;yq=3޽CxG>B<ɥAiAu)'{?nc""з Xb 1NC$܃:PF$Xa)B͊L?4~OkcGtWEK̟OhKZ'xqi0fXy')ACuLT{L/:;Iڇ.wE{"0fge{EfN ޼-05$ %]HIrrrmLJk35瑞sY73|鰿ϵAnZ{,JL@Xiy+dG )ǢG?~q=߯k`rJُ\BB1[Aϔ \C,`decr趃k6}d Ye iuokE[$j- W!^v k1-V r~s?1/AB%hL XWqhZetjVe?.Za0cW'F@績+[T<ܶ+~\]HNuQ4 4H/iw]8sؑlI3g' )WIz(Wj/3X~Y@7חP)hjssdݍ=c٧ϰ/qا0ފH.a`-wxX4 |A9 /$pr5h>MDzN,J|>a}BL~yk?t+0$(@Q{Yx">GƳ5'GyM/$~sMjeO-Hq**e}g֕h9A |C2]պj,iLtj̰ԅ&8aq'u g)PTuBp$ՕQ@$iy0r~Ūl!H9&nFÓ0`X~ #'Ԅ%u}pUWp}p ՖԎf6߄XS5m_r}UZt@i#uリXڜvh,ضE.S|Le$ j(]֕xG^ 9Kvb90\b?-VY z|I L.ѡ]'bR]OOڦK&4I w*p`1vxDa!? ܘ=U9Yasp:Nez"ꪓG>xO xMڱ2@?a$L0m^$T_h#6 d[¢P }N\z [a@^=ϫj#/hR?2e6_‚oKnPc1ge u8L b,'tCWAFc/*v_RFs)s5X;}XwZٿe 㠅c;³.*b~68XT^XKs&|uxwxHa,𢍡P0?eKԠUgYt>0/pMƍk5,ǧD#u\/nV=~EW߭ m˔z7uD.2x^=tO(J1̏ 4VVjǗ!+:H'c\Fq55|koi-!)8X O0 IބEJ7ʠhW='f>b@I=s󢄗sO!/gJP1e] <8Kel2ZI?H&L\i%y0*:<`saX7r\R`;o +^~'!v7y_4٨h0mB.iIF`dxsӏS\Kz+eJՕh$Zxrچtb`l1n̖;= Y*+tJ7ȫ&s&m6H/x}ˆ8vE캻;f05AB.;/9߷zB !͝84K2@ecAuF, -bJb8/,]ФqS|ke@e2tfl7B-L-ǷRj?9|1b&~^dtcq)J;=.jQݷbŲHaDtI (BȘv SPyY֍̜+v젛J;3Ic†/:]S&9v*NĨL@m~hơmN(F)y%r8.(=,5Yoj{99h Y;H69q`hV5q554\\[;:_9 eRa܆A=U9rɠ@8̟;Z҉7DH?l,a6<ϦtJOr:U% :㹤 :vy+ ,őA}ganKx#KEzT47>ܝBNVwQ;?@ 1&)9Pҝj̻\EmXgB{O"T^mwgpzft 6&%xhB+܅qz2 #v{iH|| "i'Ӫuɼ4fz$ 򺤼wpnR"St&hiJPq_Ԡ 7gW=? :vz>KTx)T+?!cf4)l]'qD`NFE7>?CeWQϳJh_!No|!lATyyx%NAY!j4 wP!Rp#QS ,s\Bo"G>'@'HHBZ$-v?dpIGoC)؍ ڟ!@@VBz*ke)U/㳳'sLH(d.˙-ЯCʐt6gꫮϚʏ*y{%9F:n\~:WP24_:`~k r a x=Stz^NSzܨJO-dďFFT4&V355TD;r۹oQKe ZuS\815_P K8i0Nb(|FvFpى^"\҈}}΄n ! mV /VI|lBXf V1ʢu\1it^?!lC̅c;,ŗEcNdyhWzӐݮb M]<ѮIsҥYk+jZ]Ukqޕ~~}foƁlWk3w&S=E_I9XC¯vDOd bۼ w8YΑs ; nrcYPE~v;P{nt4⫾WSWͺYuwQxI)TY2#}ɛ@UL"&AM{Jt( 両5Ia}3NVf+SX?W"Ҙji~xF_MIZ0 `&*{ @ 4(zՏ~PQ$@=Jڕau~ uC#Va\&,!|.N&{^ovv/tZgq'-ML|j#"w"'Mz0f^Cl`u4fdh0_ vy5lS5V"ޖDr&Gj'7۱U 0j~8ſ&kw>.b1,UؚJ;\^ QJTU2[%ۙ vПG}F䕹s4 My[֮ljXXor$(}.1O6^|iي91b=5 _ILHγyG&ݱef1 ˋbɢp \.Juvh󱡆NgRb E7֩{ļӓӻ&)Y#!4rc!B(\|Rwy)jOt5p,J/ V$A֚a{Le,":Kj\(Չ{1RhXN!qvt#|ֿw $t@7LIjbWmB=IyoȣMoج L|x$y *dVQh4 X~o8<dHVG̼j#gR[U4Rr^X,spV@tKKid#Lt"5ڿ"7 80RvQ(h0 ,W!4 ɐe’Ih[KV_CyB zX!fKzy%NQ"x`#5ks&w[[]ЫJϤ@e+1ܨK9h i#'8tP+ 勘N8B+:+ LwvZ.Sz EQ1G8-k,cH5$!5&|9Q_V*("3^K\b ьƻv1ԟ-(C8?:-n @uӜ́[d%x|qK&o)iLHWd`A LgT'hz 0n|dPǬ,+8L#$-Nlʲݚ|P J]e87!ѹhha }d3(6RH%i%rXrylBiz*[=2q{侧NZ⨖{Gd&\TѦ$iO!g+atm5]âU`R | (w0| @bKڭx[|VVgkuKl L~H@ uԱu-o+vC'G)+. ^`f@a;Y?Xӝ Q=-axj\fwKt0^Qpm3%ivphmq\jŏ7KvmKhn'f/Hr~$T?Ie.M9$ (Pn'HuJiZkf7 z**9F=Qv] s[>`q'\FZirwYxD2;8>7Oly2=%Z"I@0bICy3pb#q*GI6llY\ߴTc*Y=fct;徸c#%)i~-ƂCD*p!o:eyngU:Eaf nY%5S /{q(x# tM i@R?NY)㓭\1@e9dhN%rTGG1օn 0Wi٥q>Vu69Is]+lQK.؇(R>d1^l՞e!Ba`~Iy(kR#/VmdҢEE`wo ks'7 @o~ZC$3HR;㟐XK}i]5G7wͼ5itiE=륁sS<$nfDs"P*^.%h?6J%ka&MxGSןh}!he[)@I$mv^mxard`|y Ł},&9e ͆'3sbU8K3mRN~M-a$Zǒճ+(3^lx &Fr]FEdԔ^ ӏ"6RWc`u%v j[Fh))ݩWM_(ޏt~U%ǡopm#jfF%ubյ^n䉗=)0Dbhīb84>$T+`ᵀ _*5~˰:KPd>^:YB8n8~빪xC]b$ːWH+|]x) Uگ+hu&$[{{tC̻4m)P6ox\WP$|eX,c_OJTbj@{!kxBU>gVuqܳ9 f" d`]$U _:6ŪTM˩ad2V.*Zdv>"ՁLڲU;YXNO\$rcOڦwNA~ųҞʒsLсJEC i0SSX,w+ILsdQİ%U/6ѮZ\@AloRѪ"MtGJOpvYFE_2~6?$*S-{{}]8E[NGf<1e zn(M+klvqfU9E$>zLTո,͌iy// ԉQ\BMIjD_EՈss85CT0Y$|rGȍo6;ܓW{H>b! k&wޒ6]` Vߦim˩ -K 8L#:}~ LBRnR 5N O~rB-f N'9?RqxK{e OUM?K#0|G6 H4HI slH*m"a`a(w-jB8WBWGDiPu&%O螦g J 1?{?%gVODLkÌ`NqUϑ4w=Jc$HqMU[|MBqZAqR32paPLlexaWJA,),lQlwf 8C~givے.~_~[^/ҸyFJo_vdbd^h2畗K!2isJljCWN{)"tBۥiD*m&AH)wMP:;l;ںA!;ƩcO<==a< /C0OZ*Y#&hZ:w?܀:LK 8fHηԌ?(Xmouw-ߥ~J=Jf'SFG`Q7w()t%9ჲ/xUi UCR&"v!QKwX&HIa 6a5Kа,[ggUǼ}Ziui{cpdu{fYVKd9[{.BYWq/Mɨ*$w*7AIJ|1'Ed X"ds]a[!᷐S[m{1jO6u(BM(Z7pc5ɒ7&fjE*16xPexZboUqFIthx4?KhjR>~FWRPP|)1ٙ7}>#  A/4aNhe6UB/\~u8ueԐ? 8l(~g_\aE ?f C2IMYU¬%qT$}c"޲8lIz4 "cmeGUz֗gr^聋 Tib'p u 0 6Ӆ6 j~Q-5pr yW$ߐ)5mm{7~MKr~oViuk˶zc^UOwqt^B+,7']U%u,Uuj-ZbV)0r<~bps8;YMaĘcuHfuJ/$:{bVɸ\Q9yzx0*YI)'DUR2^;qxt`cbaPcn5xWӊG_?j}#qa3H (jdhPh)V#h|t9D"ThxàLFa1TzrMAZI8CǹgXf,\<g$_3s YPO ~c&Rz¸8iԉnjCΓ% 0\cۖU^fҝ7dGaҢ*E g=Yx@;c\XfhIb 5bM+v0L4*1NM@ |, p:Ye!om)<)ZnE**sBFok=} Q-ߕFVgwb^5fkRf*~j*;ll;~ؾ`=~$JtS$#{N]?/:iHagֆ*5f ([Zfv3EʺsL 79!A9BNi܆CN@]K&ucO!}dٶʉpu;cE;k=sQҎx+Swq:P?S51J)UnZB"M2]Ҥ ⅜&7 hTzϯܘq ulLOm?X&Di8!6+])_ i ;*vPTYYK].̽?E j/˭i Nìu˝[YB֓^p<@)'R&Cmd"oӧ4Xl1yz0u0-Hg`c)ݿ }N]zT4׋x Xyą\<{pwK櫖UO:5:XG|/I +8}dD1md{|t:WYت}WS :Ȁ[luOVFb9hkOkJǹ#V{H,׊%#b|Z{:RmHIb*j#[<8 o4=ђaO}\i_D+K\!;TU#_1TC]#AOtN@^3+\ {+y! ]zlw x69>) ͊IY!_*>9*DW)G[ݜJ: ɏB݁jUkAW1Ժ_kN@ (بZX@7ҙrhTt 2բT61n J'y>*KVztq eXjlƦڧo-#}I9d@2"}׳L=Gո (cjy7؏JXSVNuWsڨ*w/u⍽ZuX(&ܼJa) =xmyW쳛/w 11,)@C9E"21m%$B7֞93 >pf;Mހͺ"}YawhTf85 @-^k(k L:K >&"0QfO7I0ؗŖ9>ՎgƢ&..ғou@d|?6I鿟#Q?uL;U&T4WN2f>ڥ6%xfL_ ud`䵐˴夆=BsM*ЅyTK&TQfVQ'%-]%CфXl၎Yڧ (/(JED)⨙Ko-hL_Х!l$:V[E2Kͯ?=vTZۜd$=m/~!,MmܐQ4O0*qeAcA4xe>"gNF읮&ЩmlFV/3+":V'cj_)ō+ߜqJ[Y:pD2ǵ544EL![jr8]@:p?Dy =L~2m%OƜ;l;ʰ[ݠw%{~$M[w+LiP: D)kobt]aVX1}]xf&+rFrW\B'Mu(M'/dp٤|"u~Blo0HD;ϐ>ڑЄrW@U1&0?3) T]x)"]>Q06 THe&.j~Z16f$=y 'O!u|wڰL~)b!&X!мe˵SIju]flk::HrQqwXm iFSmqOSo-L)<2XTc} F$R9x"X}Is h5FaxX ?+l:O>+r/cۆH0 ,S64(Ol8fӯ( y-8b 9LlK_G1?"-iq]#HaCe|_5/ )9x%5+?ҤC~oDemZѠ[2$, uW. Kngg 2s^FRz&.tqM7(wd|8t~w}.6ݍ9f{]]zg+f*@&WqV1>"L "w04_HT̴Zm"O9 WG=='9idSͪ ,$59}}2"aX" $!Bwk;'hGW=W"5)Ӳ tE~ <s '6fZ;*A^>E gj<'j;e.m 4/F3cb5'5uE:L3}.3NE7ݨ2ƵQ4%S|CR!I@PY0rGo?TzFo*SӐp!ʰޟhh }}۠Rya/Hho%ƈVq$R*/;':0O$ٜh(PH^s υd#. o,b+=n4+Nɼ{ƞv56pM#ɖdа2̹'$٩39槙4+Ӥ'AD::|z1Ic"oRÀf۾&^#xp gj"OɜZoIpOR :4qF<zj>Ml"eZCM,p7[@>gIk!?VV섫={dB@:PŢ_c='0ttvZG 0  9q^VDm~<un1UPY#LJ+0*LQF+i LRm"'x 0vg?mk+Ӛ L _>/lF2pf8s ;IJ Six}aU]lLb"# і\uNa|2\WҚJ4Mf-[mzLw ?쩥ߤZ)\Wx+Ɩ++ \V@C}4PܴszS70Ir΋z_kNj0fȌ#J4US313QI=xZA'/]םOba{y k ԢUv3 HO fxМWu_ HI!ڪh'0u`qE G/C,s;m)emF;wujy|e!2Ty]9o4ٛ4'~&qncoъS56zp0uǯi15ʙlHQrCktFAl#Q0@Iʝ.SJ$c FaYdr+Tm> P8.UE1ghDA];YMfAz$b]ڬγ'`zKx\ˆ͈˼?w/Emj̲+ 3!IXDdf2g׀ۢ(&pcCFk8 NI{Ytj6$:xY "$ -e)ԥ =,xnSyf\^ogsOt\IFZ@\u>攟oUqQܾFk?O]?L".h&[=,NAe ~RԽ&dQ%SÑ݂'ҦW|xok?e&M |]W,y*9~擟qp@X6O LLpX^KEtNַehJO-c=:ch`O)DtՈŗ4#ܝR%{hKSTIs*$ԈF!![2eg!ǚTDj'F-=K_a}#Rh"!( pz7;տt>ŗ^+k2Y5|@͛#RG?-FXLPONZ^ΦS/#eM'BP잀L[b~DZ Um쑞{zOnE mщ,6U؞3TB!Hz{b} bQJbZa[Y'{R$Y,))24cÍK7$X, W‡hFRM6vMٿ*C*{"DYN۶o2v.Ω/~F3K_~%ԎP壝[pR$O;t0ųۀũ/3Dfc>LFUjOy| yD3xgi|#ÿ{:+ZLvfoYyXcVYeF-Ij*q瞹2`-lO >907,q;LL`W˪~uN}BworhNnBZz9پK*bf^^z`Zrӛ*YzO',Ĵ@8r,pR L2Ph馁9I|;6E*?t;M]_ ʜ`ow mo%1[s7t$*IF|jOGv&\욡BLЄS5 &j#䲖Vy~bs(` C/ Ih -<CJzV;.ӪXSp8)alWJ<*LuәjQBczj2:OP4qڄCOɏ`Jb/ˤmOT<A2&a Fr6"qjQdjt*||/QQpWG%]587ռ%?*v~"VeT. &?WA)ȏo@:MNt"⎷3 W5̔DUnoŧG`nB'嬢(2Jnve 6b Q<&7kQz=i 7MV1tު[ %BG4h 2 ?JSŻs EF ԏ|2& L&uC`Ϳ:;-k>e?n6Gv1л'4 WyցA9=@{g!4_ "S$S@YZݚdA\Pp)(e X"((LR݄FI4!`=&ڊ3mx9gHQu(Y1e~3Pm:4JvFjyfMfIOłclnla<1d.l &Oj& Vg'RO|4zX"ibl+oW7F߰|3|&R:cY[N9z ',}䮬O0=N@,$4Y\8-@Hyu狰 0RD?T| q.60 r)lDajy3{򁜪Lg_KZxyN> ܳh9;$wۋO.s#*#8Y3LdPE57i $ʖ.Ha2Ύ.-VQ7h,2r yUJnspPho7ĞܸCs4{Tm]-(Ӝeќ]I| Z;-wĠsn3Irf^gQ9Lʼn``Za:%<Ԅ0ZfˢEFՀw>jB{ aR _w@biP?`_zʗ>erp^K 2a:|Mo=F;rkJ~j\C o@07pDU||VgnاJEV8?Ѿ8񊑹jc8:aums9dƑ7OdxbI~ȐCyops|ESbdP~s6G3]\ZP/]޾?L$کP`$r@fa|{"HCՓga11oXonUqK?sZ;3;<>T@B`@8>qi4,b=YNT_}YQͥ^cQOR)ODn&@qUA#<YM[_ <'?ZwE߀S5bwm hBr^ a>lbFQOKZ{=#n{1Te:&nOb-54A𴒩C$@23/>ת)X0yƻsxzUIPqn6ʒnA6`!BYPXے kejȥ7{g("Ir̎T32c^ky#5 SSmCS[`.](/FIA(32ijko}vrEdi;5\::ޤ pOXr@"q'UY2@&jԾGf@b{'u/Iq ENAN 61uSXo GǠ1]$Rb? ;'խ,{kUGRWzo@pwwrbbTJFY 2{hF- ਋Kt7TV׬E*tYG?ĂCcc} /v&i}׆~\Y{,̨=lalh h`dzB$?ΤQ1ٯ7MWRr2`Te9rH\NQ%V',_uOW-1 ugҩ:>KP ӵTNX߭/Q' wB eV:zJv]_F"0l LΕ[&]ĺNC"Һ:86[[d_*ú(@o<M<) ZLb "v4jZ;gÅ3a $oa׊7tS=ۀ^{֩Y jPV~F@5Z"l, |8t+M$~ĜQNb?-P/NXj~/]SDtua2ߞY䏣YM${&_q@̢`D#xnL9v[-63ݭ`Y4,A'>NDO ZI}tJsP ^{T҂0?H]5fXAr\ْѲ!_!C> L7͢k)Ch'a0L$M6MizF=K8@|h0GWl}-$H^k[CE]R9|*z>=cҽc,>=(t 4⼦J@"N xR4 Z̼CEBCr'c*;쥾gv$Qy$ uGcE|zYq_KM^ <کלPskd z^H5բg=hP.kI}M.0$GmY?wx9\-S"e26G%'\,hgN~4PCE.=2Kv8naW:cדe4PX*}@4 Dyc_>`7=D4$q'm6,|19^WHLrsMĘ$&,6b4_ӥIѬ$,JFj ma(?Tw[c,rͮ YzCn"M,|@8!azǼ[ОNG(^ʎ߅ X"J^1IߴA {=8pd씪j4tjt!j=ATIN+KzD($񉜵~V{ BwӴ*P_aUO,E1+v?.ujJ\l N}qq',u}V eĴ5=*[gJ{{'>?ԡ7yMn$KY0N6tHo6|j<2Z5BZ|duXFڶWx*꧴w و` j%)q8":XVPK.)!1uQNcO=]W*^ȿ5!pW9\^UXdj@:wCEIp*y˟iy흝9 +L0 OR^ȥ13i:Zaj"7p%`-2 [HbiδE5`\{o\^vN &*_3Țz|yrw1Qx1긱.ڦ8ed2VX1 ^qIX3l*@H-Sw' ߘʆ80+di#%@s7KI;,/ȑgK?$;}]R VԼ zqmyg-pIBg\j& AӰM /eMl!t(FМ;afW!!$C7v,uHD<lxuTԌ5f4&vc0KK kb\@a!uF>Mfs %\'';c9/f\gZshOf8+,uTWfIHaō\1{26-Nr*ru(j 1k(gwr y"rX6xi1L0~&qlZk/P?V _F7-=sGp"b =S`O T ޻93,Q86ǒh0|.}pɸ~ d3,B'#P0ϘmQR=`BCH?f섋] m̾T0vmJ_f$-$tP-' -PRHHɡ‡֨Hz2JU覵(6ֿXCA =].Vs| wW gl$1tnf>5'c'~!zSD/*u_p†#Zh@PG!4c@IDůS#tR!)wp_/ LV\{td, ֪ӣz<"jzK 3: rԩ$ޟ5z3=N|5. w$!kuA/Q?02cZ^F"JWVts󲧉<0pde78"Tڭ5p7)^]NKؔ|bҨP>Ts̀8ǹ,RyrĺЭ~7WL) :_7~Hܚ^m+@lԬnIUIfalHST; B6jj9UkRH0_ۗ@֑:pqj\+z!նuMH0uߖ&V&|edDG[ti6Nq~ ";EtASp"a}?-=Hv@i$TymT?Ma*GE=I/rmh$AO9G_u 8ebMx.*{=BN݋ziSڌuǂW` kaen"9 /h(Q=d%hHu<`9ϻrzIB0t:S7 fGrr{ϼYRⓊ%8e{:fP5m˟a6ݰ\K.'Qxђ:)dUhSUcʤ;rxZ1eԔ B_b~.L8jB;r vt)cV+` jG7=;4> ^RI_}T`+u 1BEQ;7zRV&-6\.6W| yÿŽa.o iʄm.E_l&ewJ3lBoKab[gj/d뚪֥vnھ y;sWQBX:u]sUi.;aaę[~9-wr J|hmP5/ñtJ#!A{r\U^- mYl)VfGd2 [My2jl,/;]΀;>uKoV6x~x?BK]pN0jcZ89") cC:hv2@5d~pZGhwlQ2 2Cg6@cb 7/D8zޯ!݋!"50;(0jc`qn0/9"%MQv7F/ŧ6-Yaک1ԭ& Ae8+f~sC$_AzM&p@u >nP{$œ]e|ݖ܂%\V[wA"xdCE>OoDvwj]V+:NQYi0%{4OakIk]WIl/aYAI]*<1NAZLvM\qwjEG;/h S<~==)4u0؝RUq]FD}?2fsP: [-ؾk"GUϯ),;p|pa{"BUAՏgT(mn4wsjl+1msǩˊ"g ) E8`TW]-Pp=LQ72~\]WDݔ0.#귍eVȟca]3]k`R`w41f"r1+O^]p|jtҚtOR͇PY0_*ʦ!lSR~n5GA< b@rkV~ni J~]sQ@$er|ghM$oIUTZ.UV:_xFP'G (Ի6|-B{>R !wx lF+s3EHk*9}eoy#:H!ep[y+ǰHy Ri8dU#5q &9B\<\A+NƉQlܚN^C^xRMo@UM<$#ѧRm|$6&yq&^ V9{4lqO?{!K~ Ãp(lm_ݨQ;F"RuNY٦ul P\9J&+Tuү6NhhY,q;WἚ=Z:mhI(J!ԃur5ԉuQD螦dueN|tOVҎ#dM9G5 bx9ȦJ-/|/*FcUŦ3g$ .\*=6;6X:bՈɸ/L=Q1ό2C'9\zfsȍ&Xf0(d43/JRʊHhDl < ANttЉ4=bmq7ffzVݟʐu.G cT uf9.ґ/D#:R+):A>iX1R ?RVZ}wKuu֎~Sg٧!.=6g a gS2Amƚy4uj8oM-*nbnbjp<]/*@k^+tt$) $ƛ$;oNz@'g="~%_Z~`Ľ[WQpeN ^07XS@bKPzހm x<Mv: $odXAֻ Ы&eKDIEC GZn$!`[FVZ*ƜTM#N]P*AUgd#dØ7Fɋ D,q_8ڿ$s/5hB "R{[nȮ,-繯q^,ϯ$; (V7\Y y00oOpiwd.լ ;W,mŝh\6(I;,b7S<ս[̿Vդr[-óO@ eQxZB| $rcNw0RN$eɌTGls#O#ֻj. l0c?xm>T'GY4K-=6'j.["?{LvC]T@y{xh˧Zңݗb. $jR$}/ O`Nk4}/_B|xa ?_}%i= nla|:JEB[@NI-Pc91)XwI~ rZ%%Y/PޚtTwg P94wUݦF"Ɯ=*.$`{zŭr% !_d@KT.B]&c"FOS4,*AUAn={ꦼtQʐ}*U4hڲHˁ;j\t(E4#JTMPMpv˞ Z,yLͲ]sGe]y]jYgo8xl~eBNm^] WZԶKUXЪTx Ǽ"Dqu:7d`, =鶒Y1.[WZ AHD R0{@OҐ9/p/˯7+96gV ll)c0=vLάtX}n"v+/V`֘`S 3@ V1-Vpt9XVv7?2D)v@"*׬ Zp aOa9̫'^cGCF&$bTp.R6r痰޹vxcj3+O  `2|/Nrhev)HR0dba(kOtjUV4Vhm15Z8)6} &EWܛ/ڗ>#3"tl5K6L9-}}2tg:h^TuI YG #xt^Hu )PA " D#ATGNz HB2O$(  L61@ҋf#@\w ݠȿL?3 =㤪ɸs܉ ClCreqLfH&>M(xZC{N {0տ TR=2X.!TOy<[d8`-wg!2"+INz@+d#HVĎ e3%DTX ' J_ oHn~[cG6!A_ >LW߸t8;5>c[43EDP$rG֭oOSOU߻÷5{jB#2tNRXp˴A)m5{}j ^/HXv|fQR2r?xP?|VUOMu-w\7͍Ldp* 8& R( Wx^cˬ_@]jHbO]]7r SQvlL/Pn`Ǡ6''e[n'X "ui38{pݹ'iar'z6ju9AëJMbښ4\@p!uFr /L"ǐҮd+5<)vZך$JF &CP 7i٬:#َu/wO;nrl+>=:MWgA@pv݊ø >ӑ$zZO\TUvmmԝ,fUToJv^bZrp_gemg(ීCW9 @,O2=d&^DR Lݻ|z)O+iUګ4܅Xw4cVbKrrFAif*nKuyrHbi4v )NQ1ţT>u音wVԍ¼/D#w͚zv_. ["umSzzwDDCć0bF~yH-05)Țl30;hʳ>g[$Ă\!1 3?zp>yPKii\{Ϛ;e-ߺ_Omb0 k- J`䷛oZOkNDni-5>tYb~:H-b]"=xpu=40vg/T4V*Pk2$rͿ^YJyj{`@8YGە_2zt]q]<" ɶX[z, 2`Kxy͍"(颬|]`"~^5Jf$ %o+]C[&^t~ <j|^bD&k֖g:N=₻D36 !so=gUl*7S ˻I*z+jOU4l쭉=d/Twh L+4a4t,AQk֖ {,q640:5V DiZO^CrdrWĐu 'Ǫ&3z'௢fDe O;t">,5&mCTS*+(o΋7o;)bJuxw6vp[yAAZOI#r&EYWOߖ" "+ɾ`i4Co9sS# 36A>H]#6kk\ƤV7䶪Q/|R7<y.B=Xn6* 9zW&y&4b@ dӼMu _ryc)wgk N31,G3j$jFDto3vOv fQc(cZ`PcsuלhJL[H%D%N%߶0:^05;| <:66Kk΂En4>7&8x#8}ߖlba.GHGĊa,L%SQRșZ AЙEs,CMZZ-k#vV]9 q} o0+9oN&B* 0D&kg&PDbs/2Յog}߲B @b sk;^3 :zJ-n Ӭ G48r3N8[r[+݉A]9eom=bŴ*ɞ=b s*<ƥ^p${\+(@ k'= 7;Z=K94AywRia 0)Ew1(m~dz>-kMHL$ ȽB{=~B/n3J{(:xi%^UoUY85:7ʾXW^RXn\hp,`[ @n҉]+-Jvy:miRʱYBI?1 W1 *C;AI'M1] B둽"mal"?AX{E3r@gpvD3+>y[O7 A])oR^tkm*I`VH%y_Z" ]|B䁇ՈA dPV+\ކfp):%ȷsmX+3R0 7?QZGTJ$"/܈ƓgxA_*c5VC^>y߆rT=GV)ǨWsz"[ ++RrOI@ }rJr@FFf ϧt7g_x{KɚhwyKBc><'y%$Rk]a^@23FL-k1㜥;<:w#c/ެuPK ΋56ƟjϦq-yMikc_׏]r7^NCܢ\`ȁĮ/fl+Pdn^Pzދ'GvmzL`C0dsV/j(%V ۅ.5zFl' XA F qVm|s.+ޜFLJ6\w"V}k6_~ v6coT?dٻ[x1Iz%ɤG8xÓnwgC[zj/SΪ,m}Ou9bsFx4SE(G|M?yy It<~\.!H=x}.mr~yG`*LpM0y^,w0wa|kD<8S{5ɯf[ bX2rJqrĺbvK~G P9qHpy1vfҥa̿x8n:u";h<|9ߎ),F$-c)yT0[WBgZkhqd"lE$]!*>*$K-L]T%!NB!ld{KDXu_٦7v"lNn&{$Р!'(n(9A!n?HeDl2XBTK = "rMUémHTtԍ᪛Dp-]jn㦄Гf?>rJQ}"Y %صaZXe 0iƟ?kBi: i3Go_rUPʑ̱;QWkfʕ2 ҰHr GNN7W3B,=rּvҪq ߢkL@M s!$s.Yfđ`.}eA뼲j'q!,& v$ѭy1V%\ M,ZtI"|u[k/.iS/q(g! v)$ˮsP7?*d,5eЍю|zB |Z1h/al`"(ͺ}gFuF5쟧7NZ"D j+A07[( . k5)UmW+MUߐ>Iq1f A |M&>,IBMS,h'nLL d*q"d&1QVhm5Ғxft[K9ߞ1f#$ǢԲq@g3f[t*YXJ2}S$^ߔ$ITާaVgTp޶!=rj=wހ1;w6 cԙ ӻ뼻 7d 1ad cu\ DV F~^]`6fpe=l <7AԒӸC3띂&/cZHV 9qi0+})@Ģ:%9㬮ٶN /=h8Vȣx  :3,vocya8Փ1)uTc7\Y.M#=*r:{L֕h(ok f"|䴼@-7,4!"q>),^Ou+!@i(, +{d-1BC@qy [Nx3~'ȷ0} 9eutol`$]`t>E m@H;|>?V۫pc(v2t>.epMI ?1ta-~,|uk$hK4Y Ӳ]?rt`@Ϲ`@cb oQȁ #}ſrknFPRh`ޡ/2-ܺmv4Ov(rzS$]}BJAw5O9m ␱'_:t]S2&P Ub9-yIkw#Nf_4&##W#հEt(3?'Ig~(=r:AFdd& 3=ng%>%S M9eE,w>s6Ź*4*Z9hk"3X)ehAX2 r64ɻpW|B)ڹ}*&gnV2c5#?,I|*ߊ 3#!J[Մk;DJ8Vrpȓ3jKiYYk3"&-ʹvO\ lmzXv~"Zȶ·uJo?fb3꺓n,h,yoI͒7"`Q-+ Cv:w);/iVE֕L/@y}*&-] oӳE *_/ʍ~W[wY1m|>~H*3vgzde@=1O|< Qؖ~t . J@o? 7Fჿ Ƅ7Ɵd@gdѴD9qmӍ8(I_ㆸLoyApvs~ŽDߴyz_Wf+A7:Bb7zŚ8CX7<+VMiAXHaf1t=[B$ُZ<܏VY/׽]׼5xww"2"`w}Z90@_3rvI̫sq"8C9s%а*Sh \懞jSg h{Ks%-(.A [K77Nkl ܮ=d`/p|q X:+6&Txb$ryM:fN-mO&.ÐuϙGlm-^+>ur`XjFjUYJCg` ]7P ذcNFPv@#_3q ei|UNS&eK8Sm-uv%:Wޣ)%E{o ˍj*B8XbMd[ȃ[C\%تviyoUE !GMPl Ajl\N{?MNcJ~k:"G?k'#Kf}ڿ]qvq_mP*^ZBE9M`kf⦌P svIc!t/^E \xmqb!9%{mglƼs[ֈ^\~/yQ/o̾eH4 #Wx\|4RM bE#ʵ"%:a-W$tOj.5boFZYZQ.ݟBSE_o,~1EɼG«K_l X -QH:˺uXmaK!ףКd-,[+!ͅB8,/)<< 1qSZ9 XZ#M 9-L8H{AAL9Çj,}`VE}y| u 2kl>A?Lըi {Pn0N-Z47jKۻVUӳsOA^w?`.{O`&~t;g&(|_Кcs u v_ %k$D(wN` K+@<6 SDѵt"l9=Lc7/WgD H˒8g@>S/]/AaCc?5;USMml6+i:XI=ki49~fYѾi]R26(Y8報m'.Hp)l2=<:1t.0 9«SFlLB{u\V4z?v5wI˦JM&i>'ES A5y8AzH4ь6,<(;WUHJ(Q| ;~V-'OlN,mM- jG8b  Y:[K& T5v~FFGA 0zȋ['NwU+a o؝QĐ"fN׳A= ^f$(}zBAIoHgThY>[`A [T^] -,e,"nX* z]>ɓtO\]em؅Csp*ȚiڲF@ a7.K*UIPtB"3C2s; NL,~yݺ\|Ns*.{r{ оPE%U9L2Χٞc{Uh61=kւLJ4[Wp5m U]!.AĦ KaΥT "F.FdKKb=a>AH>@imMI6'cфC# )<9 ;#hTSby  w$@XЀb5j*ْX5 `i>LO!~yG#vvXWGe)G7JI#4?%h$`.6@]@ՊnM<lw}V,\V94ep&TÇUmzJv4Z 9yDy2SQA*Raw5@s{mtAn'v+Kƚ„Pݔ~cs0~HȀIX]#"D 3,+.T5Cypp@\\*c(]0۰ʘ :lz6DRϕv6eRBΧ>{mI&m5{uD6qv_f|6#5 [lvK5s3(S6D=F]pĢQ\u /#ȼntAI)|'rͲ˟Pe9|:s^˗L]wiĤ+:tQZ[p#[@0Luh0gy?"`{0:-p2B;<"ǝg_ފQ6S)s%o,t(eyc|i4Au\!cdjkE4S µO eXYn66ܠH61Ȼ,+HL=gЌ-"J\ Ɲy//KCBX4JO|"G;?t;FU#… (hi*Ay'KXCh]~.2xA?Y/r˺΁8ZT9ՒknSHV-jw+T陸Ss `BP6zk)*=>Vbm0o$0wzǙ5TDؘKBG+)T5#@ =x=ts9՟$psVӫ+mB)@.fM2M _ARxTTsO(ma:|3/. Jޯ=μ$@ ć^EtB[͋ÐPnkv&겺JŸpG`XL ܜ08  ]R3Ka@oҨ ψ3Tnlusn *w u{!\u>|i='X)ܰV0BsYJ[(s*P*}UoHM+T3:k&͸>vu$BC]h?A-#rяEm#TWlI5t%.rUN[RqA0PoNJ v|v.Ѷ6:)6 qq$Z 2вVX6H[H!a+ jpz$ )uш.[ÿ tH2D<,hŷ*[tp- ;"FgA\t1VjVDh7 '@Z RL!Lk.r~zHXhSibPzY=Uޚ採?D =+P|#ZA^EDp'Gʆ= GDT>(Q~X>?J H\@ST?MV&6DZ`jo͞ jlZ[CS;a/xcoRXmoJ*"}ls}Yqyhy3 zUv$7 b0k*\ ܺ0 I/,VHÒų FOf1w=6> /OxУ: \o]EDZt|{S!YnL9@xN`%+$v!zVVs;qްqe|M20Mռv Ke6:='s(^8,H5[n%٬Jz+Hu*?qtFo9ai2=mo>,ҟQl-Jלfv9ڧJFЫWȘ+'|ΟuܠW C/ * 3yYBܓ@h)Qv.xM9_3>ԦUtOYCJM,5M$%~Bk=6`1蕨#~L̬;6ൈԔa*:?a'C&lQUTK R8 o#ʁCg05.{S]j`q kY@zR7iE 96&yt[xf! d ?1EqbknQfZGrfA5SߢbOC@=EӖ{[l<߃g} m^" іgy-c2bN &fS"6ak#5\ dV=RpEy0ċe Ϊ˧TP.!f hkcK]OkO C;paytɗg( `$nru70`C—heq B7ӿMRTbf3N9@MƵEt//ö]"`炯<; B?29]oG!"Xo{ w4P }n,<ǶxVǘ\3CgJu7"ͬ{}S^WohF0y&ؓX+ LJ O' FU6яz|{9:XVa3g+n 0@3~=H :6(LnX^ 7X6UePk o=O 6UMSƟw6-="]JG;AP rꇿɶfLlX ?6 QKh/+xֳJD6$[4Z+@_utYဥ@'SX~uO%F%7+dyj[g1D\HW5uaw0NQɉʼnOxx0lzrQeQcz>>*3B#%v&=>)[ 9NK}F]:r-U4Oja$Ňij hBlL//OTJik?NG] i&3PZً)\Dvp(U­Sh^t%,P6Bn-\t)(%cb@l) !хPd7o}8k.(Ľ44Bp$/<s舷E<GgUIvkNP24H?̮i(!?uVZ(rexFQ;0OW^H<8pz g'N(`NlPLv`X<){(A^o@P?'Ɗ }vr|W |vK!\, ЌQ_Vt?5  !g|gn}t_ZW@ F,iH|n~0(,2fe6neczbp'g<9~̖R憐xװ~{xBϼ` E@Ǩm+G6yw hb)ipܷ ]qRq q6Wj!Xf 6^V4+O TXF^ZHlTc ʟF2}5=7%,)(V8✗X,ݴV*\S$\@f*| 9^֔z fr{$j[vu&7p_5(7!]0ٙKof z0B%oqtE.I =׆XlG/[MPҵ5|^h% 5C$T7rq`:X~׃/`~Gqr|g6*Ig|U`VWi9d (e!پo4 ih_T'VZr2\R:73P/}͇QAOQ^8Y4'O!'+2u;SW'Z`7anI3_ws% CZha'BQP-{0Q@j[3'lȷB3TJk W)ko0 [-E2!$)ilM뼭;'dqy lXBr+s*v%w߹ Fm tYABP:~"mFcM,'G>@HGńXb;͍B:;XV}]uZxO80NFl.v|0;m|+,>ڳ\Qq54wJZ t_HȼMvq\ k5C/S.2V$油L8<=# JD)̆9 US8%InWddW~xf[(oj YӀey瞋Q6 %4 LA$y 嘘GNJ!=OēH<"^gU1Q(`W>fI睘,tEƧL?D,#ӎ21Sg$YصY#ԚP1bծa P '^$%A= /\j}rbc;9W*rfF}Ul9Z^ NBb"K_lpnTk Њ DV?S|I9E!z"NPk <$s'(8s/gi V% xdSfsQsӿ+,6S_5b<|[כ^멒W{_4>ph-t,PgoNռ`y[]W^,ߵq%l/ID׺,B :PϲA-C{% fѥ|Xi G#M}ʮƈ^~[Rvsu_aͮb "٠ wi|Oo"0KRD}ǚMmbC!Q!WEӿ-u[ջ5y*S])(鹛FLT5~,PU5 3oĀFqA_u"H˸`( A癔K -жȽj4;gΪ_)Np45&Pc̈́YЫqu[#ʻ}z rvY6b2\Kʥ`e:@'qS Bkyi8NG&ȓheVn20lfhsEWGAT73wrt_p_nRBg@wvQ:Œ5h\xp7oX[@bpbw>{X8o',} oKXF䛋OO |LیM2VժMcQoXUhlR}2*p{F:${3֟Fn"a('50m ѐ 6Բqux_V8hp}yMXkk07|ϰ~%έCB5[H"]FEYV]Cn /Jb$JC n4j}WhcJq2+]e -Gέۺ ʔ n"?^y.a~A^]Ss$&?<$3eWXaUM+PW(b5 \pWҲJ.^tJà AAasiV)j,oF_+ aftAeU &`k¯f1an-4&:z9 gV6t70n]x OAu =mM2v!6gix-}ÈgxCCؘQZ}aole׏X5%^? Nx=EfG8B߽FW e \)KIH"hY`o7.&)sĥSVota=fe/I7:3:;0Rx61Q'f7p{ۻzw) 6L`XNk I%x=RO"nX2s 4ZR?R#l;^8[GaCČuiAxg%ء@ "sa<8{:!?pD i* WL?ﻥ> 'fs"ʭY4Z녬Y` lຉ9"r|V$ ^ꇩqӋ rm"ХN.UZ1Puþ 529a2E(⎘$=M:[+Bl,5k4?r72 ڎdNi|(ԾG'\Ch;K!WVCoAbO L?Q1s3Ao/ZȄ2SB @#m'kѼk{ X.pbF~׆.$s-Q:)*7 2[ۅ~'+f_S$Fd!B)@i6*}EqB!+Es޾R1 FcHe7W zm,ؽ `0U>,Aefv跢+7.]/9sܾ٭iF5[n4f겹D^% oR%HRb˓e?p%,!Ll'=!4IhD_1pk x e{2^g) 2rR @s]Z89pK!va?o6+ܪtp7VlZXPޜqp(5 _bz#xFC0xxHN 1v5qb[,gf7*GG8NiL˥.M,Gy Ri|&qghǑS'Dfd+J<`PmtEO;l CFU3RA!RoF>.f0ݕYVP $k]E-&\/1ҡkӌCNXG#" l6͝Sn/k?}4h ;Ajqf 9̳(#Jt`2[sNtzGyB5Ό`}BWv#gLw~dv NGʄB6ܱu~{.#9F[9ѫ6.4& !A?eih!(бboItM)> 0 QZA-fg=klZ^nӮ7]"؊~Axq6 #Q7Y87VUTMV_%l+-\ R !ARMy*}T8aVeADt8E!L47(pz %QA4"G+lOT R}Zމfpm3 П}`8p/5[4's`?6}eNckw809%e ༱@Ś/%aZ/2f|_!9òF|#YIN' rr ûͩ‰+ ֚ɹJ7Z\A=Qc*pOuXѡeC2 bc묶 cѵ?l[%CvV$Iwqyy2Kȶ J3£#$CWNfm(]:ģqrW {JCTiHH깲/'xeJms玒 !Wʷ"<߈ pcӤāUR CiK~f%:FV|ؗW_yUeh LB`G !ʗ8U8WYW} %DL I˯djrYہW2*If}yko9764(X(yTOwE'qY?Aw~hYĘ<ܫ̎>"S^~E!=K{V*Op $"w$XP?K,<~cԺ9i[QSҿ]gk53&4o$ʫx B1)g!_4D5cy'h gts#UGet8cIVgm3oO!Nq ֋lȭ6N)]\ r;Nx5yÝld23މ PW˖Oƶ쁡ghpZ*9d\ء$~i49q4 {v$0sYjJlL H b (Hv=@!qtߠxçA꯶#$d)LG {xi5/hzlG:5뿖#>%{ω ]*HH3?sGU JnxMLD{ih4Ꭻ@y%tZzb+ޞV?dc,-]IO} )V=$C8 k{O@wHHN\RNVaP˻2/YOBˌU5WNK+AdqfT9Pᱍ| ۀiߥFu j kdE37U\cAEYHD 8%E,)Gi 7DQ jZ#_zUE Ę;(99S"3Pa:9r/Z%[dgT$$1^DwCZs`A& `3F 湒b ۨgRőw4Z"~T|N8 r%Y*ݽBt{À~R "ŸiK8n/4S~S;))?wG ?% 9c*bP?Rͪ5l#2 yHZr7xͶo9d J_ܑaN@͵J?4CDsG㜘~l3cOb#ѠLѝ%ԝ\~rG?bVwOɍMrT۹j^b͞δDW \`u%`|E (ӳVV~7GF)=-Z0 a.p*/վvjVDXϬ ?A*iI4D%t%BT& #)hzޒQF<{Xk'[kğn {|opުqEz.c&48Epe~Lh;ЮAnchZemTrɘH'TcăonC&!A3;[ j܇BD'MDAp^x]!;_0,5 Y|B_\ "d8'7PodIw<3H?Q[fu=.T9U[BCK~S7 hoǚ/{" Uɲ{BQuvQů+b%ɣٲ#N7n+9|MoшhSΞut >^ZlJ2\dMJ_0!/g}*T3# OKr'XUbX8+*0-o$GMFsp'Ik3Dc$T8 Lds^<;@9=e%[U Gn)9 %ـ81 R!?P4pbd% R jddiKq DjAV$4~C c=æL56vuВ{`fRj"*FӘ4U}y&N4BHHc;(p/AgqbFk=z.mX%`.9ײd5y(x[ a륍^}m^)]e;r&2S6qHA7ΗJ9X&=Y 9]pcħpxsapݺtF8U3CSj a2|6pJ \_yBNyO]Pjv8P~rTd](IH[H}LR UdoJ}!H(0}jԔap-Kپz{z8?Hx:zS鵖߼.nKcEm&>+JVU;>B )|<˃Ge' ա6؈Udh_P??҈; vbr~D0:*nOS&R5rE%sH$l%K;X.LKz%иWùTpcrիͅ">!B4Q_$Bc- 1_G_T?5W>ʢ/ă hop>7w SBH]Ki[RLymPbD{YtwQ-L1og7.5eY0R% H|5&P|}d֡MeM2CU{yl5j*~tGssjb#\{Md_{cNO}vs'M.t1Lh7Qh?? Sޒ"{;`J` buH._upm 5̟%~v$t, ot@LhuHu@X_弦r Ydjxlq`V$sC|~LGmuY{9C_@ 9M<1Vġ#7d(= nW~Ә:\¿(pITE_3K o ޠ0gH8;󧪃M^M˓=29Σ-y MN]$ds[o^&/CUWBuzlj+.Y0"՘W(k98Qeh!*/=Ex|Z;#S(3/ ;cmͣpvjrs^_huMpLsy!I@dlT |V*"k>_9=uǡ,hDcy5:l| )7<2?ͫ|e]0"k!39i=o |GRHΖadmz-eJ[RL+u;1S3`[w\r&p_Ng8iEYt$5g%\=o(*לKX*U1/Ѽe@%M7niu!ό `S4"ІP0NjD~&ƞgC6,0-0 Yݧ8}Xh-\;Z!wtN}0!&P.9gnQJSjI_ѤgP]cv޾ibN+mv.B᧎ʯWdz2C[ޑzN`,-HƷ<|hRCh3fY ,pK-j@x7 >2_ }c;3$+y&nzC<䓯*5Dm{<}H("Sx' n.+\]j J^J76^96vGhbgE(>MsP&1Wj<>B'i!4`HP*bXW އ)I'+쇴4Jsl45&4o !fY#2@h1XII Fpx(G T3JgON,x@͙,X6֪D8̀8g}K5|DrN Y%j'r:*Dr*koՈ*HE45_rf)G񉅼E %t?(g9LX_'eQ§;]#oc]VsPI&>zGJR,؎q-CJ٦P_=gY2g,L%WQ-y7t{`[]]bBlo2&R[~(W 2MG瑊\a!rɣ Ǫ8V ohn|hζRk*u*mĘ'H{8Ah|̂T_ yt)Iztwmc9G\'WE6'WuDd 1hv-wyRgnM !;ԅ eCs2M̹fo#c,"(M }o:\!{=ԫ3`[fcܦZRQQ<_qIȴw SéO.I݋HtovU3N$e;[xZ7{ FjZP7!Pr"b<ޔ>S;f1gG؜^CgW1=|79!l&jb-~wW"y%#(>>·ే1 _>m5WA׿ x]R~Nҥ;DwGHNYs;!zʕ4Q [;]mS93$,mQU˘k q%l.Gk~`e?_αYHLg\Mnqbx%ޘ3\=YOVM{'/j7 H4]Q5;W֍C{A5f#~iU7SO` xXZh"j9bkAHT5eÑhamMqU(z\!_pXV=: ҮK޳5y^_&u%<Ծ8( h'` N,Dk:9*j>GU1h/YM dϐɞW'͙3nZLYeCB1?|G¥폆G;X*.Z_K/I1КZ7ћ쯞e=F9ÑM ~gzn95Zekm(^g޽n+w䮬.fP Xx!>V9aylr1H/ Jhn\[?efh+8tGP[ AG?GM!DxhR#ﭜu+#x3VɨG4aOWGz+sɯ'Y) X7;<喚Oߑc%0#lnE9+ ͊z /3"mrKp:1+;6V_^K4߇Hx+8pQ D&q_?t B^ƽ@#ϯXZ+>Sc@XFI|t$giOˆQ5(SPs*66q d0T¬YK\"4q7|=Kvы VH_.SvM Ia"/}fo:D=`k0zhuCFmg~0ƾ/wZAcnHHrRtCps}kqn>;e zs[orbk邊u.+[=|S}\LN⽻}.M_s$N ek6QbxD B^K%{ vОHʌ9Q[ .x_]S3/EPYE&>⭱79x\@#g`46FW+hFOя*3cZSZ$S栍!#+BZ敺jN8)<‡Yng8ϖ'UmCkpLm#+s+l_$jg}E_pV^O1qp@0l)Y"!Wrb獇Dž^9._ĝLCg<-,w~j"X8{Xxq`n1 ͻpﹿ-%(92%6 T)4 +哜'*tuS7xs"g_v(GLf o}šu[N7K 6B&؞ P_ *b}ث)0o*p<]/=o1Վ䚅 I^_nԨA@mdyTfQȪmD c# _oL"Pbq c)>ֲX~T&ԩׂW0/ lck_edX oڋB;;-c޷XN??_Iq^TJGt$by*>'v[Ub]A9{m킦וX Îm4c<[wj}./f ~O1"*ʂK,o+-sؖF-A~XheS_1Wc YܩS!c{څ>D¬w exCWcC$3t/ٺCwTe:yA>1YY*eHE;v0ȅx Qf:;"xgB#'ilr`,~ I\aA@\v3҅qh7\N%8)zUY풆~q}`cruZH7Q?b3>ٙ?Ks'd&;S曓'"9آG}GTBa+%IN5[[Yy]]u2ϺFFu5PSK} бࠔh4}\qBȱ<n[Gk`@E)w]we@^2Z闰h'gdٹ:dS-zץ ٰ _+x (fi5sjQjwUVĕdcӥC"D(segVP|A:ŷEb^m?!7 Zd 3oHf_DQ݀q .Ӻjq{ b/WFgɪsR?5aC BXW)gxoU󗡔+McouE:;)M.g1tn\UO= f3c˘(9sB PwZσpN|mCo |-pN _d vs)OS5ԅ q}lN-A}?_(b:#L%yrlΘMBĻKwoO iDUkm #+Jfk8%h  iVN&&0 Q\`)pאﲣѯ(ױ Yoޏg߅XG'J!SiQ/ς.܉ӺT*,Sͻ QC!˃B 1AT]vT xYfĽKi%t+r6R&(:(ËGL̤ )ٸ]dV4 6q<:KwChٻq('ވE"p1h+sc@z:7Qz=K?NbU\ìMxn!E#'wѺl_;tn#%0xqu~T<K28.iONyTaoϴHnls~P}AͲ`r2[yO:bAŦ<7SV O lGT91弗]gR0bZuکu ߵOXUT/^O_~ )<‰%͟7ܼ{a㊔(g*Qe4ۏy4’/Vgi5]S^}ƽ{PiP:R eJFȉR50!} | u!Bt"Z־&/m[S[0֫ 0XͭpCZnꥏ25v8crSJP>/obmo䈀 r#=d86vujn)m5s4bb(I-fb:Զf4!6S8ݥ0-EN ze7"l=p Xv"pu?@d ƳL:]٦h_Ql o.ݣ=|͂0ЎpMПbp5S^, C+uV`qp ^Z<c1ZohV5itfM)ȧTO+0AjK}ZF^addP~Q (i]r~ J9,5=8LA]φXflȦXGHM":YMzg]Gy>k. ߉`(Ǟ۵bF;k} 9B+*އf܌94 >O䥋bxhR-ZkQe' $wnXhIuO24u.j0#6˿Eݡxi[ *w5~?/aT@q2,t-1N+}0or «UDi0 {1W{TAR~颬:yUŞ3&jf sͨ ~7B׋͐NXQNrTIwp ȴLkJN,1T#kR+JL`%6kNv&ہ`b g?AGZՒS)n9#RKTzqQMEIBY4T]BB $C}-pjBl|=\ .^׃z>Ŗb]+m,[#w1Zvv2 @)i2fձU#WG(a3SqGk0ߜZYOx|*fr_\X̿0V |LM DP}C+Qd-f+O'7]kG[tN e$ a/3\8 gCҎ%IUځM& E׳ ߵ]p<3%[ r_7w5񖚅P;*+BО{9yπr:йFęh/9 +aoq2l'¥\\~WWt%Ԗh<4`Gm ć?-',z#&k::T3c =CL_hWePȡ+г s54dzfH_$}tԮ4u)Z<րw5؝Ѓ6Kxd:K :4O1x `^7$Ӓieb0v~g/ 5vlt_?N? HHmNcsnuN>.gJ#ʎڗ2S!K^&qUNjKyn!Q,$etC6e}xGUKF.2<h;* KcnՓ@ fHcrSqٻivTugveqk~BpiE |wXώEoV(?ޤ {-qI-'xf0m2if=Ծ!po I&\{|;|8 6w~&DF`8{LAdbmgz3Κ>Y+!Y')VG}Oy_9aڂA0-Y&: ` eI0ƌ0E#i\2҄z+[$Q0o߀Ki3zWv47<ѝ1pSڬ{-^?YpP DLht6߹ vߙX ֭egrD>!TnNzaM6.P:b:3~D+E2iJ 4Ȩ(ẁ=9b@X⭐/,2Yne+/7t,KNJcv ConDq@[GJ&j-<0wTɟJ:~X֙DC="x"GV$:=)r/b8 ܿ6뚭* rub^ 'd"x1yG*D< Ĺ?,ܛt dks 1C8FPq\]g@Ha+Z$\ : ˡP,N{]-be(lf5n:3COf7Q[ ѕf>9IٓL͝.;=QȊ&z |T ay{ j>s\$-:'QE ?=^Yp#6gԍg̎:E|/mD8' cHKtn4 \34K܍9|%DӃA;( ]REL<xnJnI1q-f*ܻ[A'v.S}$nfKw2b&=:d'+h1/mN>ą,|koG~/Ľ9tuB"0nE`XDgB!PHDUs׶8GTFvF3̆H}R? 'ں cM͵.1MРo9wK \eY9W%2AF<mTQ=$(D*CbH,C C2GfbL?|lgP=cy/LTp696ެ5ÕR"램lۚU|iRr h+X\Oރ:_S ",dV;ϹNM4H>ud%EHJ< ԬDٗO FQRrкI6Y; wi(74/6^  )~Um(] &iu&SGfCS MM09_WzJ}<Էpr` 4-//= Aw`ZBcnqj%S,a],~^  I@ZO0ztm/!1M T%) p=sgv lU?P]BO5W+Z`5@<.( ̇e~Ctˤg(qR_٥N0$j1(3],\g(&n#PqNUCݝNCDɹ S͈ jbԙqz;q1ŒAxڠIXgL+T]j]7ܢ^)H\z9| W ]:h^rp=& ?VP/WhFjq!MSƢN^Es?&怰y-$,JW+ge54Uh Oty1aU2$GoY} x}̃iYqL1:ꫢMe ^̓0<ٌ4~˹^qyY(;w;, GHs?7*J &>5$ax?g;5^lo ?ق65=T×H*d)+o$jֻe~l7&,Z=6.bH:J3X1}W{+FrF]"bKq1ꂻtgl @Uį$Ýbxpt+ Hڡ<YD]~SoRޖN"Q[UXG`Qj1 N}ypѤ*0:w$}i's$7t6|![mlh _l@{i-{}.C܍uͿ9pb&NTc D 3pO4-L 9!Hύb$5svkg,w??K(/X+z0AgSLY) 2d6 'fwC#v-[li@Cas$5Tl yp@0IBJה9Y*Ž—f:Ÿwăj]s@fpxČ?9αq.0wM ol-lt۸2'!(NJ=b04;%: #<*JhYUX yiQ# GASbVKgo5^,Z=j0"Gza*<:N`'~o]cXd CWJ`ĭIvFHОu` Q k)43iDW6>3aߕ *Sw45A>qiq[$B'VY:_u*_{0~8aSE_򡉢r 7Ի& tٹuzq|ⓩX=l$gnېa`hTXF`]B wT(Rݛ?1Gokm[Ci^[@pټR =#CGlؙj:帅4\3Wat;a&x=Ԧf5:Aވ"ٕƉc6b8hH* b;vr*•uP0.­7G,1b@5N/.AgUw{g4cJnУ_Y"?[U2rk&]VnNjw&}T#KgOds!vaNs&J$# a{Qa3sA|] l$֖oJ#pP)j+C@ 풆/JXpNf':g,%7O )ED>rw}IqɵaMRG+ Z0F3h$i{iKϼoXh̖.Y47* X/ i܄O򔱷%?GJs8z*wQmX@GԲ;эa^‰]Xh$ZjuǢ_f+%)1j՞_wt9չEդp\F|?j Iz!P5D+B]ɁlƼ1ܥE|>p3܉n7ص L ˈ g E a+ۥ8/n:v~"ZhwET$ nقNꔰO]uq|]y_੧PvFű=`fEv5]{Lzkn`ݾPFyCna:zkOI#&hڟ-2U9!|IC[#zBgahxD^p- MgY*Eж 4%0۞[\H~/.4jǠ҆A`h2f0yt\5*W6{t_$#Hg}>F<]:ѫQʏӛ,3B^2C q`iK>3!Mxy<,H~jJ*V J'{|LH_9͔QΥ>{R j?3eu7+.[£!4V 5~ۥQp2n@NksF5%.mϜY2nA#p(Ҝ. )V_6[Osz9K9䧔'B;*Et`t8ٌW]m̥{WkDR(.~$u 7⻭*{*jmyZT0C/EOjˬ8t%pNP*yf[ jf|.a*)I9GU(S5zUbstdVhϸ@{.aFz@(+SD&YHZ__N7j% \&tVT+D2ٗu5DdOP{h՚4~$lU?DZͽ' Ki0DԌBc7/5T*z#~)}Au[bRT4 ]2("_RʍGnKlNHAk>wX۔Zd<}J/Y2 `{z~k^MA_ZC5 ԟF;+Y`ͻl-o1p^+WQNB7(ZhǭHאZ)"MH:ۓڞ:! {r}N >[N2M}xyO@vfg?35/u_^ /oطnf/{УXA27i?+Nm.:=j|9{30wF$#,?>^~M$my.(SP2ȠZt{K0D1*Eey rީsž4E&kANPZhbt4Gi 2o?En5xD@Gp%&W{neOI3C bѹ]1&q'stɠj%D+욅,`Ѯrٝ=? t=wI[Wd z'3lp]&_!?2+5%&GA8~Txĸ`$|"r,*To*ŚЂj6MJϤLqWǂg0Bջfq~Vx2G\2go\]io#:_}B LJV:$8":;,k8Lj +}@T2C;}f7YDt ,/>m4fddYVvΡEa;F:O1Cy 7SmǸBuiߍ% ű.!=Bfj3> VH3t 9qoISJ u.@6 =L<4 ¶'b++֒w"O;CWkڛ|՞jxiS'6Yvace̾b'q[2bV:iz&8C0C%Nȧz(Ԓa];ꨴyla~Z/B4X' AAVyQ]xۉT.Jk |*-( $>f R"DS)6KՑ;) )k0@uLzʃz;sJL#Y JFo(ZFA1*wފ_^xM)" zɉK$'MS;d:xէ7d\NA蕅ѤNqyia.1G-FU̸` Ϻ!e=>pH]pv\jN"YO2N|CfsNJJBIYK(8|r5KW(Fa'B4Ȃ4\ ǑH*{4i"[Li>C([Eѥ4E bܸ?Bw}hзa҂ k8qtw4M+Qs> Eξ(e`1ѾK1bcGF(96# MS{TL:R`Pbث 1Փ9J|NK2"|1/e_vi}ܝ{<&^Co  Hyt-fG ({[9#޲]IKf 63 :KV:yc/n}0ZQLɎ4+^yi1tfmYW%^P%jU&AG MA(}﨨gpFo<4y 6(A ALy{L^@_g{ۅA؍07]x}CyyMj1a܉L 2f ,C'Ngn&OJUz?2-HE/6a[?/I;:H5d*#bqabhM.;;v/!{qbZގzQH&KOLhPW zɮ̳-~?_#i%ߴAa=)FVm(塤gdU @Hi/ݰn՟ jpjeΒ;Ar4∉cap1ik_͡Ɣ[Qb)%vi&ݬ!d%!'yy[ :q=~?.)F[n3K'1/3!O(7[SݓR9X^[e|u;f2FېM&d*UF966ox؝pe ]|#+o)5!6Mƞ16cLA[g 4՜!%{Wo>Q`e62[5aa)y B;EJ.?׀E&-\czWNH>ZDi핉Dt_zzuңd"kZ2f\~c; HXmicz)Xaە@"Xkvk1Ϩ~y=ʹÌ_BZh ?R*nQ&/r*ĘX /qBu< OiDq&Ѻ9Dp'7̹r z  *u|"f+YÁKX((1/K3967W*H¦ OSꢵ.([PjO" UM5"#w#]' XQ[u@#Y!׮*pɏ?QC^qb*uܷ,6Û.%Y^3p6 {:ѭjŶX~Pg?-܋Z}n ҖV{&3^Z16270p8P`y;"p2P.tsb,[5[˗t顢M,TP+YM%ʃ+?pfZX=AyP NMG}!V(-P24=zya3¹>di{Ա ۼYavh߬ ]Հu9Y OsЎVUc-JC-tfg|ǭ%[ZZm1j}c=ikXX;]1x4&W%v@q?)#k/m63/f;wBߙ~@ħ4>ȀSJT67!oVjmxs .sQMDk'(75{z /0#ϐ¿kp ;#d-Xوr~Pk!&Y[RPD?hED:-TGd/" y:n $&I*/(0Q[3-pJU\2YKf6}KAZ5Y 9 o.$;y,d}EG؉,7%^* p 'YGW@p=K9"ʂӱ'/!EN APuaG͢f&O:[oP|9YO=q-a 5sB0j<9r4fyƎƘ'M25_F֫$3m7 d̲BV-/ B08S(B^Vw0_8!:1~-HE<~Qg|(҄S3!3f R84/`oC]\%ݸ:+v]R`cZv)4`S\r+qvԯU*޼QE<1Qx'BA1;Gx& o'69evFzG!Տ/8H5>t K 2!'A@g={ry5 rxbel7EdXr~E0 yD^fﳔJ#ZlX~3g(:}}x } ԕOd>!w+ullX[.h7M7hZkۋfV%s'mNхtfKl8)k5O>bj*.t5&P{qʞ\ά DeɮEȬXTj8)T~#3t wJ>!Dvu"X%SSS1 h;i a 9oÝ( )"`y4+_l|yL)h}3wP}`9l^jX e'|q!ۦ8cL󫶨J^3:e"U)tɶK]MT9䔤c6Y7¦ =Տ.GWݬR.IQzk[;i(=+谮2x"]RpԧnU-?YB~:6  .Q鉊9FwR~etK(ڌ hLJbIvfɑř||a8iMۥ ),gO^] 5Bɳ@.?%dytFQ0lלovYkM呈KsaTd#fZ -#ا?luNYqo F?{s 'I^c,6D<,bB0'OAJ19a )./,AES]CDG.UnZY[~&,iR=̩PYyFݶџj!θ@]r Pد,j/K?Ӎsnu\LiKGI7t)nF&zYkiQ^/7!wZIK(-Am%ظx7zJ (:2~Ns/jd$_z@g78`՞\;] UJ*M[}ʻq? k* C|]9d t4GgKlwFLaXhdFsGO0~i_>D7(qR7ZIًCljky͖v/#N!9hA^:TH_G7 1h2a/`iPpQb\z7I)1=s{a%CT%q=ީsAM=`{EaSek W8@2Mw"?IPlHS u³Anf'ǵ@M_vĮ *.->ʡUEbmpAT w28 ?/X&*XR?9cC~P%`I ƾFh)PS#aH`A=z,'N>-0Ӗ`cG&qhTU/آڍ D5҈p 43ǻuɪnz魭!kcA ,qBOc]0*g+z%x.KDGf7],V #ݗ6$ 5H/EkhVR.D8;QY ohE("}Dܻ o`|PoB4iKgAg к1cq1:B.m#Jꕎ4 0 qCXt<}IH`@N6F]s @: #ɬoR8WzaXǰ7U{beE$'v ^o0}BlU<6Ľ2H <~!YTIˆ TQl)B=x=zg D%`5ik\N[Wfش'E-ؠ\D{y~B2ˇ,k62N$Wn 1Isĭ*>X}6hi-Gǒ-5Qgy&,歕iJhL6 ,™AƨώKNي8CX3㑖UpF&5FiIόTfQ}qa2hʅ)ugݻ~9yΌt<|;AMuy^p+:;1iܡ 0D"@8KؼZSZv< ~D2{{6 [%$jՕ]o\AfNYP4Ld Mˌ{O=uJhެ#0BOq擺8: [ l8^g&ϑ6&z:Iϱ\gcW7T^Z{mʸu9o-ʇo9#=+\E*FFC]3TFRXW 2b{W!n)o7}F{ȺM:-3圭lW%dH- m}09i#Swp"r9x!+WݸAP[tέ.h[ylJtDvZ18iãFrK236¢K]3#DjD0wC8Gf nx*IA_eQ`T'T[a7`|IN<*TX<^^z"-lP+bnnGﶼ69)h 8a/VUB`\+UQrՉD;Ei*76q&F0K nV#n*OA">pBOYP0,gب_b(8qW ׀ B\nIb32[ڗv-aq+66)AY֪TKJgwXU2Ο,JޕLK ٽja E[YGA [v~L*Y!Y\1k3׶5@/ |(K`!׼bvge4A 7>b CH!!5<zbRY>۵?_F+GxtK@/QftX ?>*VPJ-T2"pD6&qPȺ`E8St1ikE8zw: /m۱1ƈrP 6fGxUفNаY)EBonW8~8ؕY>}/Y;׷8F]l,M@6jqK ,T0s7IƳL N1͟gV>nE#o5nGM^@׸g/N RT#ZQ-P3,ez;#%*I -5"oɖ r 6 R7 껺VcP4}?R"/ 'J|X{QA7(On9WAP$tNn]8xn,eIX{-"\ S)[kPIj,N ϊybސ*-#kVmipKLw|Z>71ϣq{ AܓiYp`[+n)|3 J+׍?ux:'>  =˝S2:rkyڻT@G ϫ"͂'/N6S;hE*ӦaR:v'ͱT&mS1 XmRycRqdǮH;o=p0GCj4/Za0AT#+j)J3gPf) 8[k/I {"?~QEpezFiOp=tYP>Hw cHT$5o/Ea$+,}7֪yl_# ?#WAX_}LηlEU%C HK&\[hu !n7-yN0RI(TĚ8@,K-`9-IHcӨ xNl|,ky8}~ :,g(e2{d Լ\=HV:pս~N-1cB bS^bj2Ge܋r ǣkA$1d9N=rnk7Wa%c]nHU 4ڿ]VAX#g>)8Ds'ziV m׸OP:) JPk6`JH'J3wva7ب1jz6 &O%6@2i=Bz"yIP!0|q%X,cH-v(_p)nKX܊ٌ}`1A 0)$˱2;|~Ѽ\pDWmAhޤDFGgw 8hRHZ$ESR~g"K2e7Mnl~ffU ;Ma2f&>Q2m&7U/){slҡ;OqKxhr A)%S KȌ,*ggPET\{]IjBFa={R}S5%5.Yxc-eщwu>J>a_j1~ᱠbZ^4\,mߠA`Vw5pOM0}SR+ȆcJRHU({$3o&|uПai{j ;kdFic&_3&9¨_X8aXT^ͅGd/XaFo_M6V$ |1Niѷ(h[IzQWq,Ł+{/sXvȋ>s9ӗ)'` bBѕU0moKڛ;&[ssvW*Re.>-hKqkq GnOʥ"ne;iMLy` y`^-`B45S,̛RS2eK,c6YmXo;$(q`m-!D hDeA(>PUmt,w~b5Wwd9wo+݁mtS°;ޓY) !- 큁u)JI邇̿S&O<7# HdE 47SB@Sl lHcՓУؚYO& h}[ h{}GS`4  щ0\HjDkML)C To[yJ5ZF.ٵ%5m.-\2H[ǶXNCkt%Mרqs@Yeʍ́bM0 **&1z<0.c>Rt bFOgPב!T3~pS֬4j.X5筒ɧDr˙n|=8ReQx W6krDиb\,j\l^Es(H39usvd(Pgq# .㔎uj&983=栥QL{CYJ~hk/M*T>Tb燧UY?`o$|dB!l钡k7͆.w.wL4G:`rpooreCoj tXSyt߁ z ʕJz:g!Ce%7hk!*&QZl&#v t_D) =D =TQeG㍌cqV,*`w6R=9TcvTrH}A ߹*8G.8qZ$oF+{UB7Dlu(2<'vi߭|*A( U= s{qh! ٖ?U[AGZ~lB}P1g7|Os*&e B7+;swrKMz?@t6-cqtD]Gug:AJjg֠*jݵg]턙4cƜ YqXRBpAϹ^/3k!MAz1Ah78.mbg"X Y6{Q5'{Σi?0g*Bp_\a& c>Yu Rla${RV?77É<u\0 5~Hl4vmKrJ$qdie?25b^z =iοh9.$Ejx-(Ї CB ^^Pդ/\Pguɞ~@230?g]6Qmq1{i_Ôg4eY& :m0ugG>?륝helXK”: {y]B @0UJmR/QWBJ#t8`M%xdz!TId/_IϻX njmKe;foVMIRFZZhŔ@ +O)< q'882tt "00//u-eibdASC:M-ݝTsٌB* <*=I'j nP;9@葼P5 O 'ި/B.%bG}!# aA36[FO%At>}fZ`?d WMc_gMpSL "&u{x3XXA_QL1E/#͒T3hP߈n )9OL{,`7ً>&v޸q`8o1}B*pU3P{*ގ,1w;6.CmwMEjU]otψ;?H'nnc{u$0L:Ok } 7t`LzkYMW#|6n #(뵘s@r=NM:֮FEd#is;"hg9=n;`my4WslyCg<&Lܵ縪m>2XŢ9!\V&TIr'{[>]{""4,M8C#5icY_9Htol1֤} #45-dL^PM›[f|PQ3^&-D]WuJ^9R+p[-'՗c=adJ;xn%V-uU zUfl\t{Nr$Q?攑S},Zfz>c;ڦSӹv?Bg>,*ctV8_ 8-=o`%:},2WE5'F* {o`~taG(6۳/ 83}|l}$>( _Ղ[@ЋK;{r ڭ:"ub=ln͞LecyLH!?^R%[[?x^< i5EK wPŘ8A5iº+ŵH{'JĖ(,L" m0HWgّJ\yVl 2gk{@V٥AT5kkN02a:+aVJŰwDvch >=qYY@98wWJy#:AI;15Tb @Gnv3uV[xs/>v8mc٬||fZbBÇ)aY!Ns!0!Z5M!~8DػGك<~IxulyzX( :(@I2;3T DZv29z/ߎ}4y _ &#ɪ!uu@2겐ȇGQ +swUͿdƆç%8Nur]7 ӊ|tsgdd(9Úr̅<_;Vo 0O|$AiGVCh JB[i4uo{ޠPB*bҵDfHLDuO]@7Ł29/T(Go)Zyc$s7M; mQn(X٩l5RQDMN 0ojEq84e XUm&IxZUN0^n뿒ׁ6d _<=nAPAxkK{Oo2vy}˴t0R2Y~JVI>ۜZU"<DmTZ ^z=}IJc NV{d06Irdpwid阏ތp@Y1"ARӣma҅t4 ;(HT-;t4(̴ͬ5:nrpA|;DKCDg\VKt0yV)(Cb4ސ]@]Fbj'IU%4x Tb[N|IJOunbnhnŒ:HյlF9uK!GwktN%͉O$s[: 2:]IV':J(䴊p)7і>6k1tѡ䰠 qbD!Wz-ihfKx8`Y[0a|iwMf9k]뤏=˒.KuĸREP|R&蚟ȍoF<AǁhdA{)$KI|{>C WCc[$z{ q6Tgk%`@g 2#81V뗖4C#ig N{u'I͞s_=?@fd18$ iд+ɕ-,!Pm!FScd/t|R-%(Q})^/gH W.|k g/0;hБxnRsOĺZ󵙩0ιO;{#zr8.GfgL(;C_`ۥ#E#Ka?k7ɣJf %:t~Cd/MAo0=JFx0s<Rkڈx7UMxod?H1u/@0-30hV=H:1>( y/+Q1(u51խual=uA`ϟn^ű8O}Q&{lMx=޻rbC;KsCL攮^4fЌ L\QtBb:c%9>ί[SbG:: /[()Y'HbW'JLWƔG).;9 FK{Y{O1R^&~xuI(< :4dq$X;% Qz9_~`}1X8~eܟsZf̀.l;Ľqx?yMdBXyVυ%('>:EcxJޱH}z5vFTO5 l@'Ar؆̛0փH:ퟶfuGm%|웯lx׏^aIt?~iǰb˻PtDaݝEuU3oG}R!NI`M]I&>4t051U޺8FwTW"4@TC㙪 B>#&q𳉘37ےsүþKI4^ GjpHիt}Y Dj)ۗ$!-tj8 @zsx@PCхL3?&UPc4Y۫EZp$Jf~#:kR\miqMG\:TW3ٚ*3r#ϭ,bc-NYYl  ^[y~:B "ȺR҈ɷғnif  մw ฒn*>&fC/pxKhPSdP@ܶ\{t/VOa`895&+ dG*Z:!}\m%!RT܌nk>-PwhmPƥ/l šIBe5LڹEiSK$y2BrB_oSƧ`Z a8|X6ވ)C~.7G2[n<|ɲ٣n 7NSL :|P}7bIfᮀkO\+s#.?"ܻaUĈ@$jW (\@aNǀ14OmW$0js|ȷk\[L9]2P@4lI2q.onuBef, 1,և?r[:.YW.4ncn`N8@:96F]%-6ylڴ~ЦjTYySe%e$A+XMg{ry-S}0\ '9ٮu(^cλ]ygS7o77pOraMe!tQd6-m$nTP~"y "Z3N>i^_2$|5))Y FC;a{a>p?^d$6m`]tv-:zԇy.]8ұ.yi !鞴\H+o j [6Z3{t!RHFe&pcfӾEfFe9SJ)rtBaCSeT +*Ń6 8:3/@/b_EgP+m@JYmzb˳맬Y`6Kj|MmiLN2xsmګ7EgJ{eAvH;"qhǰGn9# L $_mϠ+0zff%Hj1g榵rHgApܤ:Pluީ+6X0Vɢ<% 4!^n }6gzt_}V(K.knX5?jnF`sܻ8#A8]>\(CC^\1dgLKg?0d3,CqeLA:W2zqd:E ]"V蔹a^aB'UDݘLvA˰ՙf7y3S\`,Y#bIE_ L--"TА5|lVDž-t| gZ!XO aNc̊IS@ìIyCFN?]n/ :i/#6O*\VPyQXRЎT5POq#k%˥FBy4?RBb- ! 2uTe} P&[1} gbQ&8r MŃvЄ[ސAAUrFl X<s"jqR&7 m8ou`BoI)L9 QZ{§#cyx2S(v'k0e-ꎘ3_^s4l.3лFŪ'ܒyUH-ϳrIbW9rL\WhrmPUM~˞0q,u|D[ۅ^(JaK"% F s: wq@ T'`AeGG~ rV'u~EbM5W_4}唥: Q/P~ `̊v ݨv ս bCI3: LP&"nZQ߽7E X ;m+@9 @ejBTXhS(5MZN0:)U?bIb6+W,NRy|>:bԷ(N,,yĚ/bz0zP٪[R%4E!CsGՃ}S)WT=mo D Ҥu`' ±p)_#CsȌ'<0<|PXwe[=mzW-m!U f՛} $ gqYj:{blg)@,תqHh0tiBT G&~7rNL $wXGwtO,w%b n#"!.ŕ$p{ ̽CDGM`tBBtCWӠRR2L<*o,ջ+|$E ;c yO&#.~D;;VOq(P7+?HpSpU[ >z^mQ&t:ү,}??MJ)iޞm7[8:-|kDbId!]2 [K,Ɂ0peB}$ojuY5ߣb@r)1G/l.h+7t|RnXVrsZ5[e tn E)8_Z>'œL ҇82']tr8M&YwMS54i$8G{P%PLA.>M|5OGӈu;]iNs\4dpV=FſՑHlW3z7up>Nyc] `жqU&ʍ2}Y0}dod7ĵ7IJ3GiwH6.Х?L٥lUJ - }Vu RntI ><:-] ?5pP`?9 yX"?#NUwZ0u]4.V:),C̩ʀχ` 6 ^ G];8րhbjޛ|8ȇ5 `h9'N:!}抧ԷlW;) xI>G~j _*ӃTSqs)fJLC޿L(iϱ^K hg5O<`I]LUE"KLGSf}kj&!1%2Ζ% 2)Vg#6DtOexMGelJ2ŖóRZ َk϶j1E[>k)'At{ݦTԭ@ڐM;ϡsWyio x`!!A#ZAx 1u13%\)|ϝ>Sk?t3y%Ӕ{ʨ(]䲈FD: TT5BzTm5CGYv_X, TN u mG$vfٻpUp\Ų^y\w2v*0G:E4Pͳob}iIYlľUJx |^0&j#=MB}>1 =+1MwiG]5?DVMmhůasz `#T'J Cog^wx^ۮ͘,|2(ٞWb$Wy<w!\˞Gcf @| ] .ܢ=w?䔭uSr[_#Kʐ1qw@E:i;7q4A0ѥgc^-ۥ)25ꋣ3roA#R-j\!0qsƸqkK1 'V2Ԑ[U^$N+V3aD[aիiלX]OKUC3g ~|1ׁLM]X PL Mq^ :1&A)YZ<#=>ɾy~d@OC##|(XO~N^:$#n9^C]?ڊ>|`lv(y<+dGB3,)q@KBB8)[b,4ëH85J*Z-HލA>l.Kdq:9%L~S2jERƊ H*gz %MzI{{YBg  ;R+ZlQ6 9LiW\lRoL(u4OB0cẄ::OB-#&s.@`U8iuAx(y RP.Bd{[ X`'X/Naw8gQ6Տf"S- 3ZYQp9muʆ4+yΤZ) vIq]V1My}BV nl<2} ș,\?{4tVGP[*SZM;#?xCHR#bi4xh" 6pNjiWEY.iPramc\:K*wAv M>м`^E$D$ W,[gMҥZCs+Wދ K("qf.[ԆzV"5#?zܤvm;%F- d\9GkC./;bas#_B~k6@|ڡd/rRʨҵ2sf}G")?‘V>Q޲[5kFFE-З|`.j),Xhvc+7̷C']OAH{,aX KV>X#x0-; 1XaM˒^4 [I RJ6eNdlPqAۤT+Bxε_W}*/cXV!ס)f#E ^ eBhRx}>U="ߐ`pؠѩ':-0ĊY4ᏜwDQ0Me!xd?eV/{]wlh`L[Q?-k9( !a䤺p$oY08'zת2GZQknsMaenpg412u5*bE ,Cٙu &7Fו_a}9ZfCG[ nIP>"DU3qI"eQUbl"@xb"1SCC}3p5хX?Re^3ٲ#ӊag ׂGH c+6K$29QM˃u zo *IaR RLD;X kP;| nXUі9rΎ8`5&^#ņ71<t롑F4IbxVqd}oqwULg>q7wu[ƷR$TEswHFkXDҺGzu .Tyi, $^"MMwb7B Pa[5-aJQ5m%)̋pML^!T IHHմ1^deŸ6<#RH(-()&L_Zw2/ؓ乢EK6\ځF9 .WKk ԟ}%bD)sR܍pO9njg<'z+z(VS 7csE3~Sa#qY90p.D`g-Ov=^H;ߴ'"܂w^ )Sʜ&ޓu%ʶU Nk7{=(GXo%/=Wf~@N;U/mp`} ^O[VcM(TVk& os^84%y3x$jלhI9NpIW o汎 jND.?+/3`T-)qɠiQNaÁũ%m67Ú HK5ŃSP.Aж!%lg>%T,onFJ C1LJX+/)jAX7?B8ڡ$a=O8nzĪtci7VҰ&ҘRS/iCD%ʯQ5@(tܤqAh%&| q tF6XҔjO ̋RO[I|jʩ%7@q!5#'0XrŲũ-6{Iir\r]䷩Kº)YGl?-]0%L*dm )7k@1[ctުxZH%c@75Ǒ|zE{[χL I"H=S˱0Pʽ$h7L ExEe OSQFgo2mmb]HeDs63ĵQ3IQc^&f螀O<-0xץ^r{abݕBP@ T⸨T?25Niխ飄{߾Ɣ MK ]4Z>1 NeQPG 2x<Ӵx9 sE;pL rK'똤:c']nuP.evrUmV4U/ LG]|s˲pdR:|(9{{WL lbzg4O-5/-*q_{j!+=;9^;n.I3~-ң VIZ{πcM75!bud_l{T?D*VFc3)P6+/,%ԃ?-'cګuq~ڴP8 _RY%(ݨ@\ϐ4;:ALqO Ék ǪyB2jnpFJ/gwYڶ̯4sJZ̙7צCu{L]@¤y+7(UdoLrk\ F|!8W:1W{[aEPH~ H1НޱR3CYIxYbJ.BS UB!l;uںڭ!Y"Y1+i,ID&a"AT $t> q{A,ؤ&65OZ3 }kRWJA IU6fg,-QhAgZtWiJ>wf6-|1uнKa%vN'?wcL;5"4;v^]jkd.4܀aؠ=Ŕ7:+k`: 3@q!F5"@Uuv(m4dTG -T5V(OR4|.giqJ_/% 06:7#kX h)tIN,ɔTw%+)r|Q+|QoY9<8z. WkxX@7ᬖ͖@ƉE f?b6%*W\B8B~?{Rgs{L gu׼A}uTzS8;OC8*:ܼ@kwImFx3g䱄Iٶ.%$~~'~Ё3_ 5_B-&CHRC\V'8*2(5JDNy6&K2A C$ao7 ?'.xXNs?yϭm.dxXVfIi YCqs?̎ۨ-Pjl~fkP@'Ԇ!)r_@̐o#u!G/z0K 5x-ŠUfj>W'vY_[-RG3s܊c=0̉BeU + 4}F[~iF~Mu,J'^i$Љk7# 6\1MUR=ƕ>TiKy(%)a^:,lq"<1{lL\Nw{ ֯I$l <)n'/w*kDȎŚ1D`t 4Z4nM \ \ (4&]!*Uv6+BCO[QBY (0f3ׂ~֒w2=Dg9aM!ݺcfGYkſuu0>vo dބR;6N#j59b(.@M1jhќdraw9|9A10B! K:MWE;•hƥLȮ{U_%5́ݢ-be)`Բo6h3/tq,Ϻ))+,y(g-:>nw[tk;@. y2MAش"Wyo%Rm.-mȉ:ms%_~^ߤU%' V_kh9=hH.Ɂv}uɗWV0F3yl^m"k&!ݑ G9V{_"y-jX t`*4ЩB|nȌ%+fC%Lsvl˴CqUE;TE 2N|pV22h;Ìy9꒥é+{X9.4,ݑ-6}g"5Js"91΂J0gaNX&1^`9΅ѐbSծ뮆/Ka;[p)_RNDuExʝ*UM?%bq.HrEJ_ \[D|e -.vDrkЖ\"VŢ&PO@RKR4~-ŵ%$ha[˸55c|9MF]cn А0=?yVUStrR^\qTD tU75rNp=iN0履֢<pH*na"h]@īfUN0C!Fla%!@6;2,2q~O"֛Y[U!(k@Ú*T#xhv,߷V626JV ʻ4ob8Z>_bA)sKu͡, }7K9M, qx 1Nֆ0'?_DC>d Z.\[Ck+S[lIܑp2ѷ uCivL?|_FhK([P!~ξ_)uŸp!g?;cq'eRżυpβmD1}.U :{oŕFO(7ځ|@-!L6_'5ЭʌU.f%?¼GA\jsK#>PiT >8 $|!.@B8Xy~N׽ÁXK~JE"qoz3D0Sπ~^B(cR~BZoM'!&@a |(cfZ{FdՄc: &Ѵ,U ':r@T&DU_Sצ)&A[#xԨ*լ-,E{@F| xWivd6]E2qXah_3ėŅ.$E4HYuzkj(9#yCW-8 :@4x!Z;>:/uRf^;d1R8rvֳRw8oq\i Qr_ #v7tAT1LPv o3tq"f/Ǯ,y8ݨ59H@L`I-M;0dY4k G&F8*%obpsUz?vmq/랧 ή1w~ NM*<"컘gv\xN恏3z+b1Fa /,DUF?d*zAQtUP*|mN8d2!fg$=^CuZR5'pΑ nf1Εq4|tZ*PZa—K,CP>fu"ruh?;l8:d<(aݏ Xzƽa\6P(;976̻WjW -BQݸi/c 3ff!@գȔ^|p4ۉ9aXExZ­ 9񔄸LD1=)3"Z;8[eI&@6ym`<2bHMe2: k3r'{KCG[J oop^0#eivHn1\MA0:Fi:PԈʠo/E!DEd=Z({nK|i 02>:'v85x?ފ >Q9vYҪ@޻36A5 @$#f7;Hܟ.L/a׍gL<: yHЃwquҚoA .4 |f ;`U5ت=54JxD?6,r4P J Pf㧩#耔U@fݜXoÿbU1L-K$GnUmS[# zGc$A/mnj+8qAU@-O`,}??v*",<+ #AS T?[7U8IRp񱘧<cI@|$Ϗ`Txd;`rh EXb1/r heO]HkaehO_MUKEZeA5w:sbCoQ,d`Pl|Uq]s9P}qMߐs9[*n J%V81ITI7SSԆ0M9UdX(ۉL/5 /x4#zlbeL%%כk&ľֱ/~n$am]L-B[N?Lɏ0! M|u#HJۦ":sjq;`Z1'H*Mc#K+2 $2_FD4?k.Vs C>>gM~OL FOutV{>~Q%~o^e7ڋ΁*xL+jTe/r4/Ҵ==*D c-8s=*ȂJ3k]ޓŽB$Ď_ҎfG/0~O4ή(z`eNNl}6vFҘ3r* oūGG`$#$eQGYn jܠ[ěIvaW6ǧC͕5H 75OR4r0)OGbA3=,(zGBY[~j{LLXolP@bZ7q>w.i{~k&/G Jm0+FMS-N>{n>n?!$M>Ȫ??P _) lIh<~fW-=ɴvqz\6=>훀.MV114JE\Fk絇Vnj$BITBjk3={R$A  w5b[Y/uo8|C~%ەqG^w 7+ 0wt'M/[9ߘ%þE+I :q[j[CqS.vS{M|P c kEZM?1B3zgی^SaQpn :]#l#OC^ yܑVm"%ge}wqcڰs B1ob"u5H76&B-zػiG +Dr 55H<#zv$aLwT Di#g}+dC`ͮۗz$^ɵ{dY) 'pK((pٰ``mRp"ڂ@S)\ }d!q)6;i޿̉"xвV( uctX4ԆB <~*vVb^Cu|mcnRQ/۔T=\&X35/fb`rmadJ֋h[%@h86"4k֨ ͋A>.$4r%?4Οٿ='8pHoXXT.,?r_"oVYs֭j>eLݟ6wORPљТǴ3hDu½w9h :%`Tp?2#dEjSSpF ވz-ПmlQ'[+)R$wi\4qv#wiV;SIϬ螤L1 P>@8 K^F\ `![h # K{&xMn/LU'O 6xw7]z !P|YoNvS $ˬAXhW}9@u|826+e5鱾GMb˔6O!_?;) (1&x2 ^C6=_4%i[9즀zhuiYS-p)f{~`]b*(4,Ng'EFkn7Ҳʹl H1^1@2vR(, 6ݑMr@eu%GG.8]PE({Stb0ќ>Ux11.d$yRnO&;O'-|Ў͋q:o[@rÓӑ`=;:8aS^-g| Â?ѻ":a-Tb 20=@pyMTYu3* u4c[4|N{fC :8cC8xp*Z!Y 11#_p pUz=W U89\0~>Sa䲐kPn̺0?jn&S{FLQ({]|B <'(糊`sjZ2`/o*Xa iKԵo;R3'*p<9p} =Й87JDBc&VݮYHQ?+_~:SgM3^[-  |s ̉ǜcxXr:[&,t^FQW*$ !L}!dQ3UҫK _ˡ-l\;jE840HFQ$uUCY\mJI)͍1ll~uFRev紪E8At z> D:QX5kō1:<"_gǭ5y+^o܄Ρ㬞- /z/t slɿt)&8&!G%%h 嫡[:ߥd @ElC*I+m* (SƠP彭>j $~K -n06 -,YٕGnHF9zV(R e$)/1fwuvr'1TɅj 2YОOmnDJ5ޅg uf ͱ Jreq(eoКVlX{W陁_ZK -882QFs4~|&1Lev5jm0/D1^c?LȗLSҔJF*7Q߅^`F}<+b۵ރƊN#EnLM_,nFjzBX<ǎf:;˯h$!v`p%D%?!b?+DRjce"]F VUBe6^S-c':"B?!6 5_UDy<oi&l'<[1cxn.ntG{[ace׭&MQ %^]%3O|6 *pbI8txpm?=+خt>61.ܴ8hm$Fo /u$A=EԳܺHPڸ̡VrwyfMVSI]33S~JW26:E-,K]yW&F'=8#ʽ&8\HD/)f*cn}_mJ^c Vk80]G+ް LZ'2;|ܕ;AР=ueDuJ՞c4Q`n G#Ζ< NNk{U-3:Fm-uۂ5S) 3 x?2a,~IJY2G=C}Bp'vBUZ*+v rQ- Xp09‘6LĹXq^܂2̙,Mᦩ2&*};5v:q\k4Y_zYLiZqg.nTss 0K>Jlb_V|{p]"(&l-gJt8Gw"fl?"0d-,PVD"0>容1n!8EXwT,K/Q9BBVv-ih׹/x ջ^B֗dmA1lEo:XBf5&c9WhBJ zs; 08PEN"Ymvx>۱dǕ?X#O@RvDko<8Lb %h0'6 {$$_ڥU$ Ax;+9~v`!*KIvi0(X}ztڎf;H)QNDŽݪ3p :VؔsZ $ <[x3Mzw "ya)_(8*cvg-W!k<@E9}VXpwG¦ZU 6~T`*PE|% 5対 jg^;%3R|4`5WM$i-u?gԚtH|X֭b~_v6*b]&J*U5|P_ C\6{.cPl2x1Y6%\vJ䁈& @4@V0KzvvJ'wv%wlcPЯTA*о%Ґ~h/;$ou 4?E|48\(VQL~ J:2D24.ݴ%{Qif 5]eN ,}T RQ< \ lűV[7p~ {R)g:Mh0øT6笗Ct˴m)**3JhᙍWzLUކ%9w8qv H>kt|׻/)HCa}d^dUa8K? qL9je!#j㐇KIkl_#}%LYk~#FU⭋3 QAМ\~v9f,g䦃؀kyzv +GۦD?h"6='ŏ'BE雅:$՝2]I PB% ʫIs>w@,U]՚r$q!"X}lG@Oc=֊/n [^zu=U>d9\WXAiVp&2gPqW⺎_ #![-ڻscq#_h /=@:AH>R.lj}˖[F/ꀈϟzѺ`AIrW1rwϜ\j ֐'nk=sǙ9ŽlV%[#=+ 7u |+.< DmA~o]+UC_aVa9_ˈ1Dk=a4&.1XNul!j,tƺ:rL7-d7ߒ{xh|gDjwσ>mUUM$![Ѫ"|i+uHVspLX8 _5V.%<X1FsJR 7Yz^ 6RFaPr5d8f߳r74Ͳ1INuS8HU!W[еO}D ~o f2ݻOqkV[2IN/}HoWJ(׮M"؂$5gko@*gqr/,ΉHbȒJEP}J~li\yjzaa2#5ce[۳G~ 5J Q.xVYQ|b"'>7t;N`DHsc/E~ _f\Bz\#;>\@kb*;+NH>7g!_bB9A vѿ$Gk_USx׊߄HGht@\+S) ]׫0XK⽦~䓣3wy晓$񉈓pFG(Xy2,О-^M{mܵ7.C' UZKM~x`R}ш}evjb֫1wrʇбVE76a*c8 C&Gy0(օNHz<ji1pѾ^±FUߪu{qY^Yxފ2{-M"'ߧDJBSZtk"wKA8َ(Ayo|߄bP/&twv:M@ujw.M(xFo{ӓ+|EtT28;m9 A ,7U_VF#ՙx#wE *YY eAZ {&Oi1lՒT+ nV 7նjogL1[;\R#Dp:j% h߁ͷ.ݘVjhjNw' $~f+v4Z<'Kb(l jٍRZHtX;%EpxW8yRvcC1!_O{+96oߎL|`nN"L&^~ĹCDl;sA1⌰4)oxRxIDw 7 d#c8蒺{ۯz}4u]T_'p1HRe#5ĪNJڽ j /u}nqO2[kw4P%<:AN坫y::vzSij^NѣLWTF&:+d@ KQ)iZeyeWד9Itj}hI7eGxw 5 P4塐O щ_{LTwD,vȬ.^A B&[qjA@P^D-3涱e!v@( %W gbp{%'r @0[`ufNDH-]!>Qr% 3Gs? \X K\TBqeiϰԊQȫ7vEs)J:`TAUpaˆR|h"k<_i3k-fo}b xWy"Nґ w*()ViHX PN{KB 7 DرGzYZ"Ř6z>χx^(vRԉ!IKQ`+6lpWx~"MrGqϮOKKxIzW'AV+68JR-v)h%ooۄ>, ܐ|^澳b}?_`"[TjؔI[vi< ?0}dP3.nxsȎ,MLV[W)|0Bhٙu38 Km:.$hz[)CidT ?%k"d 7x!+oEjPB'b$bp֨j:4t3r,i2:43B 7'.(͊yiٻ~m,F;hW^5d3ԓJ3.I3õvt |E߆1 J0 G~ַicwGL#M6rddE37H ǗEK"<2_pqD,Ҩ(e(Va#DPb@\*-˂I9= !AO [;t8="[_H꧲ev˧zb."b jƭ[$ק>k_{y:0;e)r0+-y9:"0>Fs: v ehFJ9gY%qAD m"ꕜɠFU('$\p|ؒ3 _1&=l#N;WrN+UN4"?xv0iVata~T23ꌗtM_^AM9an]j>#jˆs 8__Qׁ[BYn-A:\` p} *YW2 p B71}i&R$H/0;ͻ*%QcT]zaYAZ;?]-s \dйT0dGCU\ )‹=4cdVE`opRmQ d֦#fƵԴFLP)GU"|'m!\uQ.^>cs}_i+sԄ5vh v x\P9Ms,PI>?φJV ?1 oƴ.t; s-^?搙@fu7<r K-Q 3thG;Ek5)`W8cT"' J_/rQM=TCAb85榾1E~€X]&N!sn0T…w'i?뛞STUBQJ:;7ԘZ@Er]X⃯>:tR DcZ: OfxY! tRt$,Nhe(~W/Wƒqg޵/4 컶˧OJEZ3"u#nEV" "hV.e* VAe3[vWe_ޥ8G&j N 閡n*!uNtF_un1Sp MZw 3:Y̆+R{'QQ?M5'd`'#<^&˹x6X2UU哏r5}ZvobC8DTf ,[0نAv Du5?&r<^Rω4'Ʃ(y^y/]s \b813J/7zv5Ymk(iu\7>*x~@]|c.Ӛ!ꧭCy I1!fbzZR$p{f, TF(N^&`>F>@4UJ'?p݌ 6U5ƙ(W0٪c6tuF"vr@ v(@ `[ӮCA]7Miv JμcEjAg:~Jo2ѫ 5\l<7ڝ}>v1sd]4$^\zlE8=O3xwwݢŒ}H(L;N X,;8 {xnjzvF 2qkw{"iZ`C"H^Q̺JgQ␰tK cNiPY58aXky-U6sC0Cl4stCN΃S&/pA 1 ו̫i.bju!k3uHB9L6:⣡o Rx>>Rˆv]o'g D!fbuƁTsj\z"qԈ,YxB>O3&NdݪSGah:aM]s셥 sx"Y|=4У{M"'ܛjkFH,a٠MI kϹ3uGQcm@הZá23;n-P|593ٶ:s[aLlr0 |B!Vyמ:2kq7lP¿V+uwcc49OuIbAUoEFRY+)(hG |I_4hco4jpp/m1eFy"]b|vVb wcvl@s,CfDH\jiC"۠m@$GJ}CḢ^i'˯g2ՀaŅ}O{% iF/QkLi^r87~z[eGSUf@(}9J׬tV\4-Vn9ʫ炦Њ{PfͻV+<8G84jùB~mJ/|O_\\!H+J߄-%)wR1߳QQZ4B˥-Ø_? Vqz8TпK>%rRcg.vL+> WZ%MEŝExsb\օTq*)̥L-z%҃N߰d*MZNI;p} 2@yrSQ6{@7 L^P$|<1cz{l$td1gI>?ڞ|u@K p#FHGˈB6/YRge_ ~փo|ìA ҝzzeO< mc7z!5:HNRZ]f% gޜHZ~tLjmHE^VM;0aC>m7a%8drV`]J(A}(& l7 _ʦyLY:ZoOOeJuܐbj}-@gkA6т8XKfwTV3"^{Pā7F qaXis(}lޖhJ An't֘"R#CZFa1W4HcN>YS)dRܵLQUx)}.)idSޮ]|7f(?QꚀ=p'b07p?ƌ]KU ^NAΫBޜbNM UZrIXo@rZqبnޏԫgأwQ]+ɚ2 D9댲w"-3_xB$HC+9` $SKDžnAdp0v嵡Ę=JFqDPpkf,a^5s$^؈S2lVf}+$m,AR{.Ce[ g@/\oHN[))'OgAm|'qW"0~[TcTۺ >nnxK1Y "#.Ϙ]f!pur:-Q - 45yJnkɭC" EP^qd1!Y"z{8 -b % ' Mt;? ha@zcQ&⧭1%л3<ɐ+XEZUƴpjF;Op{B d^?in]a^ d$;Q-{yy̖,b, E%QFyT]M}-.tdXhfh}S`3m,ڶ>Gr7fӬĹiqCcT$,쵹I{0l'2|ğ#S-xsCsZBz؍ ^`[uA+=?\nat wB_Gr<6P'̫\'<_֧&!U綂3~!ihTމ}?!5!#jL7v|E/}ޜQ!]3z͊=biyR&1(vUzdcYͪ3|@[bIqsKRct 5bQ~8Qِʖ|hFymnez3eF-P77/ /TOR^#^ѱa @p!cTGh-FPt?*'kK{B@d`LD"rU"WD8AߓH&&:4hf͍7:Bh9QHYݨ*( 5,*~}!ܗL VqVuS@tx!+]B ]p6+%]$xi@;OkqP |QWN_0-!2_=k„hV P^eljc%"c:"3tH}Um,Ќi\㇩^A$/ιlB'UHrkGbB4|̞Λ?C P`eƈM-wȞ pLj)33 {9Ը:@Vj͢7]l` e:=î|]6O!dԯ{T<|pﰙYRTÖOj ")g+6"XBu ]DQnY.yfhHz'4"8`]8+PݝIs^ݳhݚ{m8\mxCCU<ʏydߚnzF^9~5⍟̊AP #N{n1vyVFJ%y+hFmrBC]Qn/%JN`v9?xI]mLLxKl7=k<^ӕixB1\ؗ1.-2Y5m 9fqKB&zJ2FZ8sS%>|#9'6aw>sO(4NeiFBl;Ce?XiYi&}nY_ZU̔[I:}!*%(S{%1,[2yHg""`[!,k*VĒ`Rw>w@m>c2͆cR&k)&ȇ ӭt b**VD̖䚁1Fy!8h0̜+[q^:_2⋖I[-46j$/Nh KS5r4@aJ$Oټ32D UH{HHU(n(ѣ!ƘYX aI|)e8Z-(i zɒPa8e{`le-..a қk@(JjdY[dʦ+qp9#1gu5n ]m bt p@=`'QynYm.6=SG"{2%xbĶ!.V]p6{M@M|u]ÎW=_QunZBa|Bl%Z]\M5X洞8 ? k!B]J|`7y̛},U&HL}ς3ʼn!9$?hO+[l$&00"3$~ ɞ9Iwut?<st_,D}U!qk_,Ud~dX(noFbBԊK|^.R#W GTSi6yxSR;hb] ;#݉,-yG7lMN#m I‘ǫh&aΖZ{OAwL>@"+1 1VHq^Bc>Eʖ @ EY= ƕ(}n!Mz>ш+ C9b7Zm:G߶{%]]wevu>ܜxg3喚\Y=ٟ'rT.zwU8fr=ndO0M-5i8 !3@ۢ'دP`O +2PaD~kg`il̘i{ ,:( kc\AO- VڜR/j9Ѷ~,Ew[gè!^6ˠNIk~cLq `x'rz΅OWc!#–`g0>ZKucA k_ >Q;DM hX_O{TRZڱ 4?BDNzFd a1fBDCt` d/KcNכq@uUsD 0Y9 OPri2TA'371=wxDBT08|>#b p#tU'tt҄;*0Ql77[=7ɟJ ㈴ x8fosBz̭p|IHzr)'v6Y"T\;6k{RǏb lr.)t%aGT֫Ppð o v 8_x;7 o'T:]13d;4Ӵ)nneY _9U5ѺWk< T5a-(溓l0 |QDCZC{Ʒ\1]qs{,C'[A+>` ûZqfi ohj34[\xX,='jWZz yB, ;ݳ{XVfwd;1,,֬*13I{K)DQ>607غOJ~k#r'OR\->1!,Skģ@^IH&hf-7Ek@0oWVҗ-]i:T9nݳi Jo?!p/u7xN~rMR*k3k;zZMJCU!xǩW$?@EPHaptȥlL?l_ՌrgvYϟS·<`J1HO>1|XI[b]ꅂGgDDiiHLq@I$C>wMtn[J֏9UnfI:Lb|9Oa0~^>.6z@V ِ,uyTkfřJ 0ӸH*\rew( xLݏ9޾7\?tN1{vI3?4zG(Hڷ%cwYK,!Qaj-%I4A9pFUn~Bܧ]`$*؎_(\ˏ k)N &kÜU{%5Q US( dBדX`[ 2 'YfI&A =Ǝv3/P)uz.n lHpɘ9bJz~70e=JNYaX)D'?ӂF@ kD3C0ft8P>Ѕ{Dovv71vnDݍQn0cc˷۬C RP+ROa7Em^=y\dwgW\<7S.TT4rACS(`ۨŤml̽%gP@ii>3OV,,׏͢NJR(<6[V9ξTAm) ,ܓS5$@헁kwMNw om۪5a?uG1,ĝeҮv'Wġ]DWA~7r 9Y3k %os6Y\xW߶c72:21 eySKam}Tr>&a5nPlQYYKh<8mD:[ ]vDc"QzS=!b]? l_؝JeF~H]&6yvc[Ffˊ8dXiRap–%]u/L : kHW;)8O;Q#x,ph+lDzD ,njV(b Ld+7;;Ч&3~x Y@0i=5(Wb+3yH[Rc6/]thC,lGiU6g[M[TgxB܃ҋΣ;co?\XTRZWi7k~D+q%MVߋ"a2.|91K۹pTq*248B&k^<Jq&>hkh2$i%/6J_۲i\5a^d *8x㚉l9[nDꃬRf , ECu"w@/ u&g4X~֞־< Lk8Dz0ڰlW\g;2"M͢:*JZu|Fl0͒J<'s3vKzFF{hA8Fa3;Į/O.EW:QN1&wFZ+ʩb5x~7zh>,K=K!Xwq) ҁĖW]nc [ wTu ?ORyXD's7? .Ҹh=6!+t"Kd[NBƔ𰕇%">vvP^1c2yE. w)WcFRPeH,nr`Γm_üsnvF9)eO+A*o+3IG`jT9q[v!0uhfd2[LaM2gRIӳh,ܺZ#ĖjbSE#9WFWc~P+ ZAügŻ;tGrѽ7%%[DVWXɬq,ۏ*ƾ3r"Ɍ7 yQ_#mfI(Mֵ#SeΎwG|.c@goY%YmI;~ k֪ls!ѿT0)mUgGͻCFjBUACyZ']2B^Y{Cݏs`}EU2ɍܺJrib&ֹ[n_pk*pW[ _5"#~kU/Pφx¯^ d=μZn@ALB#oCvLA_1j"L=x  ޥ +aŻ,h7*At$5W8c#G'Q]KFdcZXD"\m_o t|e>Ӌ>,aŝk7ҕV0͙f96EI$@Uz% ev}o48d9w5Qa6C5Ҏd.x7C5(!z9A_?j,.@1JʤÍ'f}OYh1}Z(N,Aq=+5@|8ߡ&I^集J/tp)Chމ"UQ79u(VW7m>\ڬ]ޤo{.0KKݔ "me?VU؞m<`!6 p WDKȏI:쿚ϻ޳R:ژCxiXowJפ9F*\1aZNf8ʲOzn띡0!U9u\T_Df҉o9p7d=xStKJiR~S8l (`!@?Fa5dwX;IiR\zƒTq^_ê򋶒ӒMXrD=ǺXqƅ5\"B[*{( ){ŧˎ8\QE:li7;> .*t FmBٌXYƉ _g8 Wӎ[Xwi9pDko>>6381LK6 %})D} .BbX<V˟mK*[ЋK &/*NIξi6[ Ԫ&p~fͅ t]+iOxdXmZGK)Z$$"h]'89cL 8&Q1H~ TcYO䧠90fǟ.BUn]%SBT%;۽* k|@gdPo32)H㢪++URL?( *vls/]F2IA\&iM܄޽jW]zma^W 漐?+JqH>!}=erԢf 5Gqfhj+]?K/Zs'Go;;|J5?l{è54>Ӛ۳fW᏾;:+-y;+ ($ǶV/_& LF'4}||:p:v6szbv, s!ٴ=RN6|Im(>'гcG 8!lkHenhHcI u&.3&Er4xhT+- C lj-U԰y2Z H/sݰw @f5MzO pUb& V6 zgW"趨=M H3ՏU-Ɔ^։櫈q/S >bУm&T'y\q~2G RC/TNE?7[^{gN,J@vݢ%ӁJ-=в`!yQDt޳d'JaĕpL呝S(>ţdJnjS1u~݁0T@G_J4\@A T O$) rPB/GCe)m[`+{TD}j gGL"DhqLx+eMޑn]]y&$Gj9=)ְ ڊ'}\ nMz+gk%ߢP Чa}9.1@ ?b5}EXwVCJ@Z'\٨OM=׀uM/B9Pʩ W +@r_@pr+]7fG"Qj: Bmt=w7^0Ze4v=./a[PhsU/g |n p G7ٕu((wg2dno եGEɨ8as1OF%>N2ҙI;1#V0=^8\?sp-?RZne SAż h=a=mʱlj$>M!1^E*s203x>Pq,Yz5r%<8^KnN"j8&ZK1\gho&7 u; *73֐ބkhԛa@2#P rLnUgǑ*-DϮDY% It[vLt"5 dʕ:uk?Jŧi۸ll13T!CD馭H콄*pO6U xB8'#a 9m4gȖ,%U'dҰvUNj/^"6aH!A-RQV53\5h9PqmHsB <&Ya[A:Momy uZxXL~s}Q \V4D֢^]y.K%Fpca ubF[t$ tj8>OWib^cIۓ_mfazy N$gVu>\y\LzNjڦ轉$Myk(FLmxzֽ0$z>!ЧN.c@9~$= 2vu[n íZ#S*HC7Wz7 aqt#9[VոnU҅z~.Xjm zߢgY|[MM9g|F 'wo-^Vp,H vQ+-Lh=BCa7Xm{ vOpȐG 2eIR/^N^TkHғ/e?.f@DGS|ℬh϶jXCBÑ)m ޱ3|}) W} Bk]h`[WHvB.~e;x4s32ף<i rK<zVε±#ۦMTNz0'YDp.3#ׯ*R쀴 ˏBݚNڸnq7AHЭ=d; K$O4cyk?9dT$IUj@E[iM&ɞ ˹TvS#- ЧP:%R2 >̨C1<' kx.tPs#[yn69oplA^YQ-*>Vpqa~ue{KJ \˛~,ÅYYdBO"l0NO-P4k"Z]06C) p/|XǒOPRA,(\j̾K,Lv& }t5#Q6$#b01C) 6r]EQjΡ6 HoKL"0Mvy^'L8?R a'([#wYn_]|T6 KA_b{M3nHmGNo ?bQTMM lHM 6II\SƱ";$$s\pN̔Y/ZN\ol!q^XfzqL;)X] 9J0$ǝk6'ߟG}ku{E6+tl))ƊQq ho"y;O>:O^s)c~[?&0}بObPѷ~^ XJ_8FupR8K: Un5nh,c7~D-?'_)gwURu)VPf|W{M=^h5 hܔ]9cuӆV/Vٞ@a 01C$! Kfk}ag9)j˂$իUC)vFN* P6L.30`]YZ=w\ NDS#1nRĵ؋ O؟NՆ?9d\Tpv9 !5v O;#0ӼewCoJ)8 pk pQXaI,Ih59{(. mկ_h 7tPN`*DmaHSY:-"x/BJ5e^tڠ]+o[nlk5A.Oozc+_&/=(' cu!>_`b<^&|L)ŲT e5g2|`od,Z)Je@(K#Oť`{N,-+>bP=NCEXXydkଋ~5RO*ۂ4g̕I)<dG[/"q9Ewd-Ur{Y7*F:*S]`)[Y[q Ԇ_/1=DG%Ak众Q^1ƝuC\`*|_VHrp\w S*_iQTcMFPwy"] L!ކ+0uZ4 ;47QgvpN㳯Y-oDS6h ~ԥ=~ݖicm AK|V-$p@ m=v[|=JGLɦ+s/SU>D>CjY9$a}j~&> _We3<Lz#_~Rr |+)*y3odm[?3[wQ M̧'q]zoGa M`qXUZc0Xz&9i0'U8f.ҹ %L\CGed̵۶ڒ|u11tA}c@% 8Lg[;>OFVZQӘ98 m R1MeyTޓ_B9dLnCoZw!}SdB36(EUd/O_1 Ip<=b UqJ2Mflz v*j3?q"ch&50e qOGS q'*)C1$;)vmCDm("ljl؉bo?BU$*{$N@,"p\.:U qht&LdXR1!;,FfX\Bi:drJnl^ؕF{$A}xDô(Gl-_*5qX<Kk5|qDHu>; #?>3;4*Cd2*Mf?Y^J8@/лVmoTՂWxo4芵Oi"G0Wdg*fDxl/o.,\%Nr4t|({yb4!%.!4;o\6E֊_7 G;bVw#`K2sDm&wL BeZ]ZHcQqbTb2h.=HpZؠcl@vX+:ݢ1ɪ\h+λoߏsL$N~so܇Aqn |<)\M6Vu咧6З{y9j?A'ԽEÍ/X{2^ϹP @GYc0.Zy<Ⲩh,<'X%QJuX(*U g AF.-w>J`ފ<߆ۨ]gFu@<ԣ3$Y:4+2BjSb3~b?bGd R@͙o{A(;v+Csj&+>BeXZ.~j iW+:} 4Gmj2cN6B(› %#/fnp48qHNǩ*U4#W7 3&:eų!/E7PXLf%aR < lw'r%D*oj&$Qeڑ/) kɇ W8YqA>o69 oڌU!8XCT 0/H޹a Qp(Tj< GY3,_f J!%JZJh6 HV4<?~(w@O bOhF$@fZ쾇 "JGP^* ZFqab^ \ Aˑ ^Kw5ͫ,'>+y~ִr}i+=2F72,T}O%*kbH:U)1b6ҳܬף12uqLuh3S5Gf5(H `]>ѼcRX>V7ZuLqW92+D ׍?^ ԫpnw}V;ӑj *ȳJ'ٴrQ\Ѕ 9=S;.t3B! u%xLY۷jI< sPSR@ -F3BlZkZ[bE7?䧢at{vx gߨsf ioMUzQ}&m˖l,0P b 6DzV^h=W8&VӶxʖNi&XmfuSŻXǀħKhHz>Ovad"xCjނ2OϫZ l^^2U9guowt}̷[#珆aK])J[bOkE6 jt;q=X7[+ 3,=dDmhig2x%1se݈DK^׶ZX}.l g蝵nDkOi'KpʼqV*}T-N&ϴm'un?!{“V3"YϏJ8BԗG.286C|g,[VuS0fe pO( S)qM14%O_ӾM<ς7{yFsS r jExr~KHLE99 in6OYՋP\Y]?;8;?{h Zċ'2Yj3rA[OZZU0\Wb)O}02>#_ZYmvGKe^$hvd%`1OGӈ* KGȆ5P:кd]k qXB|bc+Kfqh{?OuU3Xa K#W3! +NgE;yP)4RTʊܘ :vBegƋnErL <5hO-ȪM}b͏З'ri''-YD'f}+Z 泅LѶBn-nWI ;{T.,Llrv)U1kVVjQ픂jثmL(ku &qm')&t㋠Ka_M2*IdWڔibx xf#' ڳ[ A{[vOz!];-S}&EJ9*%vBRH=7PӹʵI`?j[]=~%OuUY=I@獘 HZYoVdTʄk{٠r9@ 7PXԕGuc/9cݘGd+' A%p"5v֯0ؚX{+/ċ7g-zpg{Qf<ǩ"׫LӀZn8FXϬbsp:ߚX>^q2-]y ai8&Ƕ/.g 3-ancu, v{ix@?Цr~ϝejZ%zLq_[檁;fYmr7r0d<CFzylN%z;Q,|D B0RQ -Dg?z]dnbQ1ˆrB0n=^R^2͛)S!U@R{-G \9lBוrG HzѯC&)Fy'Js /LZ}eqت诚3ܑkR)7N_%-r־&|sG;3rfAE* uzRu/x/г4 +̃5 k[(#܈DG ѣZ4XJLOy>ϻχӀ@Wh"ʉS9͍Zx3> aN)Ut25I|r񀂜gy}nCĺM S]Pi iYXE}O\/7R T^8($.6+u ]?U*:EY ڰw|x o\< =yk΀˧Й؃؋Ax$X ޏq|.]AK3-.)f?،]sQ=(v1_5tGN?RXE,Yl8\/  uS ZMOjr #DDO c:#%HS!;UU @ePkj.p~O ODg $5mRq@άK(OV֥!ȖhF#hBn[B:X85{*H,gcb r0REY\ntQo]"y_ pX!.2E>[m:F>T^F|X7W%Q-R"]jII]m u-Ÿ^ DDd^LFMYY4*Ʈb|%jwcA2‘[3 63Fto'80,e_aK d ײT;/B5. }m+׾ΨeiQ˼T9\I%&A,_ w/ׂM`qE@竰kvT<5r ZtqB20Y^sn`f}ͩhq!FqSb {4~*koe?yLOo 鹌()j/~Z7v|w?,')"$ZZZ8k Vr~{wݪqξ.DXŜ~V;u]XJ=8@USJr9g:z [e `G*ළPqCM}5*?'& RƨQ;*Umj046-]{ qx5WBsc=9slYᢈ1|h^[ңhZeSOZ H͓'}<= ڃp3(HH5* y:9Z60j0Pg̫=ZM6,l֍,(p5awxzDjjvg\A3atj_XLu qprXq7 [;%@|}bY*9H->erF[iM+C[v&U»| Dط7:.N-HLwvub -ͧ#5~*YYą%y5H%7) kʨ4Kn{݋#/Oh'r?YDߖ!۲IPgnh MbϙY1nT0 a[̆돾[T< 0z;qmª0SϣiHJۤ+]/ tۀU-']35Rά^a=1\=f\B2Z3N~3vNd.i&eWG+{yUn\j t yV77yyT x^d98@HѮcODx#W C@:UuesarŗhT;~oKꧠ!#IM_]zC pca[$1YX"t-04$QÉ1fA;6II׵KߑɬI..1Hv[f/&OK 29ݚr \YMj3>t+IO0:f:XN%t%FJSBe#-H&!6$wat gg:8GuiԶd}:{ Ԋ5O34y m<[ń MP\r{2D&qS(-"V3|ߧawIćп\T _n<:b$9 ȯf.q2Lk^, ta[?z"jo:㔿̬ZQXi~j; :cprэOU,;;V;rߕ_35!ϤOmuWXQw,D(+?^F0_X`wSD6lqnF4j4BƕSex?#q$o~}&+(qx@L{JO()=a=>3Yu(yORbGuS 2aK[)^ Fù$8JQTUD@}uA1, @bE^"<%]ߚ qgxXS]a"8cl̅wXۀ[rו},Zl-/ɬy*gpm*Q0I:-wR iߞG@E%dWm UF4Ul@ЋDj>YOu{1yΪD{FoPwҊ43|4cWn2_蛉ߚso3Df2AYWlo}GV#K[ELN|y*!SID$8v` e 7vQ4ك:@ .m&$s"UIa/"X;h˥J[>'~UKAp'A;J+qOEZ*$6 ˷) 4 aN VaO &qږ7WJkyh֑.E~wD֤7?PWa*3<"N!5gY5F8r-90#ɛT?AR$< *Ζ>d~B"Hï#$}T,טl÷weu -MtU76[`{Tikh8ϔ1d j=y6vg=SW|Gw+j }# ޱfHYf-պ5@G'#۪uTL?Dey-c~oN`ЍEz[v\U+#ֺ$5D\ұXt`vL}}#%2R6vG2<3;}f?J!y;u(6ޮ^G67||=2amc/,C2(s9P/̇3d NęF(8 #|}(Ԕx&SO~ f12:T2sB!@`$y:̒2˸@ɎՕ'a3֪fԹ賓zl:z;xW4tؤu7RoٖǦ3c@))P:ݎgON#iFcu3@p{p2~~BO$(=ALxl&N_]@mB ыJwb6H >s:El,zR2شPV\?5%$=DhMG*ڒ@34x8=U:(6^Mh6ꙝoⶄ8rٞfb7JX v#h^=e1v nڊJ<3g`iP|+v4ku_,cmCv,6`'Er! ׂLC_baI2_Q^+H0~/ƿ 2LC671piݔ\SPz Mvc <ұWjIax%\՜'FQS4-*aFHV0#+/QE'؃*Q,_STM5 b{]p\j/xtABȓDK藎aA=`A^ ^W1bۯSarR2={%] 3TIG2|_w  :0%ӖQR( ᜰ6 NX!BT2UGI$UW/p4A'Ya3fpKGްz*E c,Kp]onC8?#_!@c1[8>Ñ1D151+G&z9uU@ xUvx>|J nZ[J\oq܈OeօuHPJ]m$}$\5oD;[cz=Cd6(+3ή1t%Y/m9vh #&$lw/̧y)ǡkLz6z,Ģ[zVekBi4}2?^¾z*=OAxtU{w}LA1W Gʜh;{#Poa-1ݳWTgPӋ>'۝Uu!bj]E%LeM)%*{Tבm ,qUQ77v]?{J |@s,n)${ʃ`xvPvS2aKccj^+͖1NGy+$[hYqɑeŕL63zby)a^USr> Ce|}9VR#}O<t *?6LގP!$#JTo2ް>ˍ¯rPwrkrTBv&LC5|7 iDQ:PNq}Vβ,M[?eX.U8V9g$_1δ=lG!ggTؒPgd9K fX5c֠nx 1<+*}`W+P'FCưxrm3BM߇,$_$IWFab~}t7P=@jfttf7oB:OppQ.`,SD1\d.#iE^JA_rᔋcKȉ2]69.;H@I^?6@Dw=I\i}+HlۻYCژN.b>M4)gMO=$iWX i(^5nj7%B<9^%\ٶqXyFh!cd+0w8K#+r,KEUH%A*y/Dy{hoE2vmuI |PZo}vᲩc\ An4FE]ξKsNާVS !}Ri<3U-Ed;*֊Esx$6.9nq##Qd5щ*VRҩ#"IN6as&]%IJ#|jZ`l\ŰnN՚ dF. DeI yMлGk]pnM{L؆hU1m][XVyS"+>ID{qޅek(æUs,x>r2oǮ30up7:\дӼ8mn"k}YYLWMk~>d (F#7]ÏD^FLR/_Fi #3ţ^^ӋaE1{q(D]o*ޑ$)qg@DDpٶ5L*)-Kc0d `Xy]f]ruI h Hn+(t7x;#!C,\Ľ2݅6dzgȎ8'its/'MRέY[8̞ۖlЊy*Y4+mƌ إʘ{먊EE8ܐ+Do*cVQB!h#G7EI-}66âa Cѿmyjo<I:̔&jSzl@#s1+~_NrmՁXJY8ܞ^儏ۇB {x=?G((Y 3TOƳ#gƵ-{.R2y"j0 %1',__Q[vg)`E.HNѻ[r wBuWu&-]R/0K ,`H}KrdVXM؜WvE!s 3hoJk`ճ(6th M Kqt+Y9ҷ/P~e'GLȑ:0;;?_};R}flnRx&PF mfHxB8ϝ F?@::Cl&| mRjKׁ2j^](oXV'jFm8Yq?xѫdڏĐP{ N'KH+N=aEUOu{JM=x|BM W F(LOZhfnsz0ؐ'|@Rt*) j; Xnu>:0f-#OxJiC3bqժ 9ЗxG5m\J% \ ?Q%=OOa9rG.(a6BFA/Q\!գNep`rgkue\+!'u6"m[ u&L3Jf^o@|緊ɞdfaB1y3#Gu@Q ,a+*aGS#{>FH p,]lC.kYlKzdl6V] 1U/]9¤(sJu4W,>NdBX9yVظ7hY`!*+2/ʕ4 FN]мfSKfEF[c@xK˜Χ$(zABp&5p|s'+N:<@~Y'M] Jpڒ e;2ŝaW0RƂjdϛY>zs J~ƻ)VN|@^ 4B3,~Ř&`>ݱO؞ÃHNx]Kyw%x1 `g]Ɨc 19B~:4 4`Gݒ}N1h2Ϧ@FXv'@(Ԏ!JmۋP5i" RUHtfcG9&- *'ޏ"+3/^totf,i%\dStNlj ⢄eBIn0ADй U84IZrIY: '01p?lyww\΃%D`Zmy n@aK֒ftj*\ړ?|E Yk{IB +DفpMPYEoaH;(Iju9 BKiؼ.lzq\Ic5Uhb>'o]09xR%.tak nwtR>}Xv} Stfbe^|:4j %Lv 4Fw H;KB-視jV <&61CFx;L#Yeۧ f.+a=[#2>ȏ%06a2߂s1 p+ōfOH/Nok hI4>B~^c'xڤny/%2&cQ9 MF-- xV4]ͯNj}:Tc}T0ь׬= |%ݶIבE1.}w5:*[@ -v옹:Xpe_*3+4vjд9s=| ckWLfDIW+#6NJj|7֣! W&N42SVxbe;7F)6DJ\%;, Lz-:H5K0EY.SR"Wc Zo[-bSsVi,04 *)} ]aZ*ec% `PD2tNK-QI&{o@@Vt*Om`+\3#RQ[r\`V*u߯R]pp`f1pgmn"H*v?&X/Pa_77tloeh o/"M2ñ%]W p *H kbI,OlwJ&iڪr8B ON|٘:MLB ;v\q"Zc/} %] Sչ5bC.G6-6IC d21~KE<lzO&p{t.bZ~1d;W3º$} [ⲍ45rp~c?{?@l jE49|JNi]QvFCAu5&/]k˧aqw388>REqۑ\DÆZwK 玣a˥ Ĵ21 ?o^Pi^On1\G3h`1ȰqmWM7!5)y9kv;i8zݢԛbf@[z){snu Yʚ2 G3]6 Ұ|f }#fw`mS$1yS, Rڪ[ᮩmIdLzK@#웟vԱ1kkz!$9BNDMHV"h_۾YV*j٭'_1ODuXrSJ!˓9PDv,F1y"9$j2@(6΋Dqi\As YOX^a/5`۽wJ6~@uq/+\pc?D ]Q2SyFbѫ/[WY1!ێ@%KꞦ媎u=z?ma lv~]4,Y)J-Z-”yDHѼԋP,8ee9N*N%s,:1I;GkS RݹMmq oO;/j7|va"аj/[<}/ Z4t5ra݆YFox/8K5,Hqxfl34rw,З Xk`lw1}ya2>lX:{ڀϔiZQ`?Y oۅ =Ī+d.bWP{bPTSp}#>ՍXx[:? z(z/ԥH0CYM) +!w0vg3+_c (Wjж?o0r82$HuFa}M7,PEeS:KEK-VbC}V%*YayiT >C"\LL;6Ц' 4\VTELhE8XwR#z׌[ ɮ _/:uOj4?KI, 7,.]aXiN,v/p # #ľӾ& cJ(e:qMUUηz! cYԐ+qRO]l<&1/>V{JH}v^oPR ^;\LT)afJ*eE7!_a;e#R1ocLO}ۺcx˨l[o0N"}PLQE3j|GW}9߫B{ʪ\ͽwvh*6}ړIv0Z?ck)|[RԎ JH]-VEP*x5 rC>q)ؽl:DZN {sI+\0+@s.IP xGK# FBPuk@;ēHz݋RB7K ?a -œ&slE$p&'GbcMV =oyVk3x.DH!mHoPi/8+gr͋jJ'zj>ECwu1r] :mWǕy ׄA#Qe5-1:~8zߟN1)@0_M 50VUX5 dsrEjpTbۊgDGqG[H'dWԉ90Wϝ,iE:f%w {/iuI!CA`9lH~:A#ٯY.oyeV`q<vjCn5iLUƓ] S__^{验iM=4s,-Mˤq_ Kc|-gcd}DQtfϰrLqy+PcڔBwuq>A>K+b2=Y.u);ĕ|O#-G_jTeQkd@̔i`6+P2#NAG'`.د" ;r/ija3i0 <:5&GglQB=,1EIhf!i[F\nYDc;[eK7MH'U'{@&=鰮ţm^I}ˋO4aJSZ]8e2.8zo 2cʂ:m-[u M@٨ ^D85 *?pq~L"{\tg6ܲЍжF|]"9jܺ)31r)% !;b`aE^Z+Q 56r%)ts>c@ܘK3tO<% ԸF~5SL5-\0e~xZ}P("?:Ε|Ю 0`Dߵ#2N,!'p =os=烰LU f' o}1K7W$,kA!_9ruB6I&D((\_pwMKEgnoQ..:ڼa)#1Kֵ @2\.$=!]h@ϮwY]ƾ0rfɆP3L&6gŦ}1$Ƙ)rߤP-濯`l'e#_}YW1Ti.'2NJIR tuux`TM@fcyEМFFMA IRalc>YL"H&oC ;yg YZ