pdns-backend-mysql-4.1.8-lp151.2.6.1 4>$  Ap^/=„Xwe2_$oXrIx\H#-Q0Ct 5(Dgʮ Fui7(mmgw]>ғg% h('N}|HC*EbtZta1Дѯ*ZuMAfO' 8 h?=lΏE5 jdp>Z?Zpd ' > 6Ztz       9Rt,(8191: 1FVQGVhHV|IVXVYV\V]V^WqbWcXIdXeXfXlXuXvYwYxYyYzZZ Z$Z*ZlCpdns-backend-mysql4.1.8lp151.2.6.1MySQL backend for pdnsThe PowerDNS Nameserver is a authoritative-only nameserver. It conforms to contemporary DNS standards documents. This package holds the MySQL backend for pdns.^~cloud117խopenSUSE Leap 15.1openSUSEGPL-2.0-onlyhttp://bugs.opensuse.orgProductivity/Networking/DNS/Servershttps://www.powerdns.com/linuxx86_64A/ 큤^~^~G^~G^~G^~G5f7d9e570b26d4d1563cc2a66db707eb491994b9380e8a84ec3e55d849615429d346987088607845ccdca47590ba23aaac3e4fe7b6c29ebb40db488740e4544efe692ea2a767b8d3087861366eae702fdcf25cabb284e36897be8b9853da65bf2775a0ebdc23285ea081a549cdcc531ed50d5cc0baf3727e719f0e907efa928eb31f8fa8a79897ca5565cef605a92277b805232ad26f247375a68fc99d33a9f7rootrootrootrootrootrootrootrootrootrootpdns-4.1.8-lp151.2.6.1.src.rpmlibgmysqlbackend.so()(64bit)pdns-backend-mysqlpdns-backend-mysql(x86-64)@@@@@@@@@@@@@@@@@    ld-linux-x86-64.so.2()(64bit)ld-linux-x86-64.so.2(GLIBC_2.3)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.4)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libmariadb.so.3()(64bit)libmariadb.so.3(libmysqlclient_18)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.7)(64bit)libstdc++.so.6(CXXABI_1.3.8)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)libstdc++.so.6(GLIBCXX_3.4.21)(64bit)pdnsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)4.1.83.0.4-14.6.0-14.0-15.2-14.14.1^%@^`]A\@\@\@\[[[@ZZZЛZZZ@Z@YeYY5Y}@YMYMXDX@X~@Xx@Xx@XN@WW@WJVV8UUv@U>$U8TPTи@Tи@Tи@Tto@Ta@T_W@TR(@TO@TO@TO@Adam Majer Vítězslav Čížek Adam Majer Michael Ströder Michael Ströder Michael Ströder Dirk Mueller Michael Ströder amajer@suse.commichael@stroeder.comkbabioch@suse.commrueckert@suse.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demrueckert@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.devcizek@suse.comwr@rosenauer.orgmichael@stroeder.commichael@stroeder.commrueckert@suse.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.deadam.majer@suse.dedimstar@opensuse.orgmichael@stroeder.commrueckert@suse.demichael@stroeder.commichael@stroeder.commichael@stroeder.commichael@stroeder.commichael@stroeder.commrueckert@suse.demichael@stroeder.commrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demrueckert@suse.demichael@stroeder.comLed michael@stroeder.commrueckert@suse.demrueckert@suse.demrueckert@suse.de- pdns_maxmind.patch: backport support for MaxMindDB- Build with libmaxminddb instead of the obsolete GeoIP (bsc#1156196)- CVE-2019-10162.patch: fixes a denial of service but when authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. (bsc#1138582, CVE-2019-10162) - CVE-2019-10163.patch: fixes a denial of service of slave server when an authorized master server sends large number of NOTIFY messages (bsc#1138582, CVE-2019-10163) - CVE-2019-10203.patch: update postgresql schema to address a possible denial of service by an authorized user by inserting a crafted record in a MASTER type zone under their control. (bsc#1142810, CVE-2019-10203) To fix the issue, run the following command against your PostgreSQL pdns database: ALTER TABLE domains ALTER notified_serial TYPE bigint USING CASE WHEN notified_serial >= 0 THEN notified_serial::bigint END;- Update to 4.1.8 * #7604: Correctly interpret an empty AXFR response to an IXFR query, * #7610: Fix replying from ANY address for non-standard port, * #7609: Fix rectify for ENT records in narrow zones, * #7607: Do not compress the root, * #7608: Fix dot stripping in `setcontent()`, * #7605: Fix invalid SOA record in MySQL which prevented the authoritative server from starting, * #7603: Prevent leak of file descriptor if running out of ports for incoming AXFR, * #7602: Fix API search failed with “Commands out of sync; you can’t run this command now”, * #7509: Plug `mysql_thread_init` memory leak, * #7567: EL6: fix `CXXFLAGS` to build with compiler optimizations.- Update to 4.1.7 with a security fix: * Insufficient validation in the HTTP remote backend (bsc#1129734, CVE-2019-3871)- Update to 4.1.6 * Prevent more than one CNAME/SOA record in the same RRset- adjust buildrequires for mariadb 10.2.x on SLES- Update to 4.1.5 * Improvements - Apply alias scopemask after chasing - Release memory in case of error in the openssl ecdsa constructor - Switch to devtoolset 7 for el6 * Bug Fixes - Crafted zone record can cause a denial of service (bsc#1114157, CVE-2018-10851) - Packet cache pollution via crafted query (bsc#1114169, CVE-2018-14626) - Fix compilation with libressl 2.7.0+ - Actually truncate truncated responses- Update to 4.1.4 - Improvements * #6590: Fix warnings reported by gcc 8.1.0. * #6632, #6844, #6842, #6848: Make the gmysql backend future-proof * #6685, #6686: Initialize some missed qtypes. - Bug Fixes * #6780: Avoid concurrent records/comments iteration from running out of sync. * #6816: Fix a crash in the API when adding records. * #4457, #6691: pdns_control notify: handle slave without renotify properly. * #6736, #6738: Reset the TSIG state between queries. * #6857: Remove SOA-check backoff on incoming notify and fix lock handling. * #6858: Fix an issue where updating a record via DNS-UPDATE in a child zone that also exists in the parent zone, we would incorrectly apply the update to the parent zone. * #6676, #6677: Geoipbackend: check geoip_id_by_addr_gl and geoip_id_by_addr_v6_gl return value. (Aki Tuomi)- Use HTTPS links in .spec file like mentioned in PowerDNS announcements - removed obsolete 6370.patch - Update to 4.1.3 - Improvements * #6239, #6559: pdnsutil: use new domain in b2bmigrate (Aki Tuomi) * #6130: Update copyright years to 2018 (Matt Nordhoff) * #6312, #6545: Lower ‘packet too short’ loglevel - Bug Fixes * #6441, #6614: Restrict creation of OPT and TSIG RRsets * #6228, #6370: Fix handling of user-defined axfr filters return values * #6584, #6585, #6608: Prevent the GeoIP backend from copying NetMaskTrees around, fixes slow-downs in certain configurations (Aki Tuomi) * #6654, #6659: Ensure alias answers over TCP have correct name- Update to 4.1.2 - Improvements * API: increase serial after dnssec related updates * Auth: lower ‘packet too short’ loglevel * Make check-zone error on rows that have content but shouldn’t * Auth: avoid an isane amount of new backend connections during an axfr * Report unparseable data in stoul invalid_argument exception * Backport: recheck serial when axfr is done * Backport: add tcp support for alias - Bug Fixes * Auth: allocate new statements after reconnecting to postgresql * Auth-bindbackend: only compare ips in ismaster() (Kees Monshouwer) * Rather than crash, sheepishly report no file/linenum * Document undocumented config vars * Backport #6276 (auth 4.1.x): prevent cname + other data with dnsupdate - misc * Move includes around to avoid boost L conflict * Backport: update edns option code list * Auth: link dnspcap2protobuf against librt when needed * Fix a warning on botan >= 2.5.0 * Auth 4.1.x: unbreak build * Dnsreplay: bail out on a too small outgoing buffer (CVE-2018-1046 bsc#1092540)- add patch for upstream issue #6228 https://patch-diff.githubusercontent.com/raw/PowerDNS/pdns/pull/6370.patch- geoip not available on SLE15 but protobuf support is available.- Update to version 4.1.1: bug-fix only release, with fixes to the LDAP and MySQL backends, the pdnsutil tool, and PDNS internals- Update to version 4.1.0: + Recursor passthrough removal. Migration plans for users of recursor passthrough are in documentation and available at, https://doc.powerdns.com/authoritative/guides/recursion.html + Improved performance: 4x speedup in some scenarios + Crypto API: DNSSEC fully configurable via RESTful API + Database: enhanced reconnection logic solving problems associated with idle disonnection from database servers. + Documentation improvements + Support for TCP Fast Open + Removed deprecated SOA-EDIT values: INCEPTION and INCEPTION-WEEK - pkgconfig(krb5) is now always required for building LDAP backend - pdns-4.0.4_mysql-schema-mariadb.patch: removed, upstreamed- package schema files in ldap subpackage- Update to version 4.0.5: + fixes CVE-2017-15091: Missing check on API operations + Bindbackend: do not corrupt data supplied by other backends in getAllDomains + For create-slave-zone, actually add all slaves, and not only first n times + Check return value for all getTSIGKey calls. + Publish inactive KSK/CSK as CDNSKEY/CDS + Treat requestor’s payload size lower than 512 as equal to 512 + Correctly purge entries from the caches after a transfer + LuaWrapper: Allow embedded NULs in strings received from Lua + Stubresolver: Use only recursor setting if given + mydnsbackend: Add getAllDomains + LuaJIT 2.1: Lua fallback functionality no longer uses Lua namespace + gpgsql: make statement names actually unique + API: prevent sending nameservers list and zone-level NS in rrsets- Ensure descriptions are neutral. Remove ineffective --with-pic. - Do not ignore errors from useradd. - Trim idempotent %if..%endif around %package.- Added pdns.keyring linked from https://dnsdist.org/install.html- Don't BuildRequire Botan 1.x which will be dropped (bsc#1055322) * upstream support for Botan was dropped in favor of OpenSSL, see https://blog.powerdns.com/2016/07/11/powerdns-authoritative-server-4-0-0-released- This makes the schema fit storage requirements of various mysql/mariadb versions. pdns-4.0.4_mysql-schema-mariadb.patch - preset uid and gid in configuration- fixed use of pdns_protobuf- update to 4.0.4 - fixes ed25519 signer. This signer hashed the message before signing, resulting in unverifiable signatures. - send a notification to all slave servers after every dnsupdate for complete list of changes, see https://blog.powerdns.com/2017/06/23/powerdns-authoritative-server-4-0-4-released/- added pdns-4.0.3_allow_dacoverride_in_capset.patch: Adding CAP_DAC_OVERRIDE to fix startup problems with sqlite3 backend- use individual libboost-*-devel packages instead of boost-devel- update to 4.0.3 which obsoletes b854d9f.diff- b854d9f.diff: revert upstream change that caused a regression with multiple-backends- update to 4.0.2: The following security issues were fixed: - 2016-02: Crafted queries can cause abnormal CPU usage (CVE-2016-7068, boo#1018326) - 2016-03: Denial of service via the web server (CVE-2016-7072, boo#1018327) - 2016-04: Insufficient validation of TSIG signatures (CVE-2016-7073, CVE-2016-7074, boo#1018328) - 2016-05: Crafted zone record can cause a denial of service (CVE-2016-2120, boo#1018329) For complete changelog, see https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-402- BuildRequire pkgconfig(libsystemd) instead of pkgconfig(libsystemd-daemon): these libs were merged in systemd 209 times. The build system is capable of finding either one.- update to 4.0.1 Bug fixes - #4126 Wait for the connection to the carbon server to be established - #4206 Don't try to deallocate empty PG statements - #4245 Send the correct response when queried for an NSEC directly (Kees Monshouwer) - #4252 Don't include bind files if length <= 2 or > sizeof(filename) - #4255 Catch runtime_error when parsing a broken MNAME Improvements - #4044 Make DNSPacket return a ComboAddress for local and remote (Aki Tuomi) - #4056 OpenSSL 1.1.0 support (Christian Hofstaedtler) - #4169 Fix typos in a logmessage and exception (Christian Hofsteadtler) - #4183 pdnsutil: Remove checking of ctime and always diff the changes (Hannu Ylitalo) - #4192 dnsreplay: Only add Client Subnet stamp when asked - #4250 Use toLogString() for ringAccount (Kees Monshouwer) Additions - #4133 Add limits to the size of received {A,I}XFR (CVE-2016-6172) - #4142 Add used filedescriptor statistic (Kees Monshouwer)- update to 4.0.0 https://blog.powerdns.com/2016/07/11/powerdns-authoritative-server-4-0-0-released/ https://blog.powerdns.com/2016/07/11/welcome-to-powerdns-4-0-0/ - packaging changes: - remotebackend split out now - enabled experimental_gss_tsig support - enabled protobuf based stats support - no more xdb and lmdb backend - added odbc backend where supported - drop pdns-3.4.0-no_date_time.patch: replaced with - -enable-reproducible- update to 3.4.9 * use OpenSSL for ECDSA signing where available * allow common signing key * Add a disable-syslog setting * fix SOA caching with multiple backends * whitespace-related zone parsing fixes [ticket #3568] * bindbackend: fix, set domain in list()- update to 3.4.8 * Use AC_SEARCH_LIBS (Ruben Kerkhof) * Check for inet_aton in libresolv (Ruben Kerkhof) * Remove hardcoded -lresolv, -lnsl and -lsocket (Ruben Kerkhof) * pdnssec: don't check disabled records (Pieter Lexis) * pdnssec: check all records (including disabled ones) only in verbose mode (Kees Monshouwer) * traling dot in DNAME content (Kees Monshouwer) * Fix luabackend compilation on FreeBSD i386 (RvdE) * silence g++ 6.0 warnings and error (Kees Monshouwer) * add gcc 5.3 and 6.0 support to boost.m4 (Kees Monshouwer)- update to 3.4.7 Bug fixes: * Ignore invalid/empty TKEY and TSIG records (Christian Hofstaedtler) * Don't reply to truncated queries (Christian Hofstaedtler) * don't log out-of-zone ents during AXFR in (Kees Monshouwer) * Prevent XSS by escaping user input. Thanks to Pierre Jaury and Damien Cauquil at Sysdream for pointing this out. * Handle NULL and boolean properly in gPGSql (Aki Tuomi) * Improve negative caching (Kees Monshouwer) * Do not divide timeout twice (Aki Tuomi) * Correctly sort records with a priority. Improvements: * Direct query answers and correct zone-rectification in the GeoIP backend (Aki Tuomi) * Use token names to identify PKCS#11 keys (Aki Tuomi) * Fix typo in an error message (Arjen Zonneveld) * limit NSEC3 iterations in bindbackend (Kees Monshouwer) * Initialize minbody (Aki Tuomi) New features: * OPENPGPKEY record-type (James Cloos and Kees Monshouwer) * add global soa-edit settings (Kees Monshouwer)- update to 3.4.6 [boo#943078] CVE-2015-5230 Bug fixes: * Avoid superfluous backend recycling * Removal of dnsdist from the authoritative server distribution * Add EDNS unknown version handling and tests EDNS unknown version handling Improvements: * Update YaHTTP to v0.1.7 * Make trailing/leading spaces stand out in pdnssec check_zone * GCC 5.2 support and sync boost.m4 macro with upstream * Log answer packets only if log-dns-details is enabled- update to 3.4.5 Bug fixes: * be careful reading empty lines in our config parser and prevent integer overflow. * prevent crash after --list-modules (Ruben Kerkhof) * Limit the maximum length of a qname Improvements: * Support /etc/default for our debian/ubuntu packages (Aki Tuomi) * Our Boost check doesn't recognize gcc 5.1 yet (Ruben Kerkhof) * Various PKCS#11 fixes and improvements (Aki Tuomi) * Several fixes for building on OpenBSD (Florian Obser) * Fix several issues found by Coverity (Aki Tuomi) * Look for mbedtls before polarssl (Ruben Kerkhof) * Detect Lua on OpenBSD (Ruben Kerkhof) * Let pkg-config determine botan dependency libs (Ruben Kerkhof) * kill some further mallocs and add note to remind us not to add them back * Move remotebackend-unix test socket to testsdir (Aki Tuomi) * Defer launch of coprocess until first question (Aki Tuomi) * pdnssec: check for glue and delegations in parent zones (Kees Monshouwer)- no longer ship dnsdist here, we will ship a new package based on the snapshots from http://dnsdist.org/- update to 3.4.4 with a fix for CVE-2015-1868 (boo# 927569) Bug fixes: - commit ac3ae09: fix rectify-(all)-zones for mixed case domain names - commit 2dea55e, commit 032d565, commit 55f2dbf: fix CVE-2015-1868 - commit 21cdbe5: Blocking IO in busy-wait for remote backend (Wieger Opmeer) - commit cc7b2ac: fix double dot for root MX/SRV in bind slave zone files (Kees Monshouwer) - commit c40307b: Properly lock lmdb database, fixes ticket #1954 (Aki Tuomi) - commit 662e76d: Fix segfault in zone2lmdb (Ruben Kerkhof) New Features: - commit 5ae212e: pdnssec: warn for insecure wildcards in opt-out zones - commits cd3f21c, 8b582f6, 0b7e766, f743af9, dcde3c8 and f12fcf7: TKEY record type (Aki Tuomi) - commits 0fda1d9, 3dd139d, ba146ce, 25109e2, c011a01, 0600350, fc96b5e, 4414468, c163d41, f52c7f6, 8d56a31, 7821417, ea62bd9, c5ababd, 91c8351 and 073ac49: Many PKCS#11 improvements (Aki Tuomi) - commits 6f0d4f1 and 5eb33cb: Introduce xfrBlobNoSpaces and use them for TSIG (Aki Tuomi) Improvements: - commit e4f48ab: allow "pdnssec set-nsec3 ZONE" for insecure zones; this saves on one rectify when securing a NSEC3 zone - commits cce95b9, e2e9243 and e82da97: Improvements to the config-file parsing (Aki Tuomi) - commit 2180e21: postgresql check should not touch LDFLAGS (Ruben Kerkhof) - commit 0481021: Log error when remote cannot do AXFR (Aki Tuomi) - commit 1ecc3a5: Speed improvements when AXFR is disabled (Christian Hofstaedtler) - commits 1f7334e and b17799a: NSEC3 and related RRSIGS are not part of the dnstree (Kees Monshouwer) - commits dd943dd and 58c4834: Change ifdef to check for __GLIBC__ instead of __linux__ to prevent errors with other libc's (James Taylor) - commit c929d50: Try to raise open files before dropping privileges (Aki Tuomi) - commit 69fd3dc: Add newline to carbon error message on auth (Aki Tuomi) - commit 3064f80: Make sure we send servfail on error (Aki Tuomi) - commit b004529: Ship lmdb-example.pl in tarball (Ruben Kerkhof) - commit 9e6b24f: Allocate TCP buffer dynamically, decreasing stack usage - commit 267fdde: throw if getSOA gets non-SOA record- update to 3.4.3 Bug fixes: - [commit ceb49ce] pdns_control: exit 1 on unknown command (Ruben Kerkhof) - [commit 1406891]: evaluate KSK ZSK pairs per algorithm (Kees Monshouwer) - [commit 3ca050f]: always set di.notified_serial in getAllDomains (Kees Monshouwer) - [commit d9d09e1]: pdns_control: don't open socket in /tmp (Ruben Kerkhof) New features: - [commit 2f67952]: Limit who can send us AXFR notify queries (Ruben Kerkhof) Improvements: - [commit d7bec64]: respond REFUSED instead of NOERROR for "unknown zone" situations - [commit ebeb9d7]: Check for Lua 5.3 (Ruben Kerkhof) - [commit d09931d]: Check compiler for relro support instead of linker (Ruben Kerkhof) - [commit c4b0d0c]: Replace PacketHandler with UeberBackend where possible (Christian Hofstaedtler) - [commit 5a85152]: PacketHandler: Share UeberBackend with DNSSECKeeper (Christian Hofstaedtler) - [commit 97bd444]: fix building with GCC 5 Experimental API changes (Christian Hofstaedtler): - [commit ca44706]: API: move shared DomainInfo reader into it's own function - [commit 102602f]: API: allow writing to domains.account field - [commit d82f632]: API: read and expose domain account field - [commit 2b06977]: API: be more strict when parsing record contents - [commit 2f72b7c]: API: Reject unknown types (TYPE0) - [commit d82f632]: API: read and expose domain account field- set $LD for now. this fixes the configure check for relro,now.- remove custom PIE handling. upstream does it for us now.- update to 3.4.2 This is a performance and bugfix update to 3.4.1 and any earlier version. For high traffic setups, including those using DNSSEC, upgrading to 3.4.2 may show tremendous performance increases. A list of changes since 3.4.1 follows. Please see the full clickable changelog at https://doc.powerdns.com/md/changelog/#powerdns-authoritative-server-342 - move man pages to section 1 to follow upstream change- disable botan and geoip on SLE_12 because of missing dependencies.- Fixed broken _localstatedir- fix bashisms in pre script- update to version 3.4.1 Changes since 3.4.0: * commit dcd6524, commit a8750a5, commit 7dc86bf, commit 2fda71f: PowerDNS now polls the security status of a release at startup and periodically. More detail on this feature, and how to turn it off, can be found in Section 2, “Security polling”. * commit 5fe6dc0: API: Replace HTTP Basic auth with static key in custom header (X-API-Key) * commit 4a95ab4: Use transaction for pdnssec increase-serial * commit 6e82a23: Don't empty ordername during pdnssec increase-serial * commit 535f4e3: honor SOA-EDIT while considering "empty IXFR" fallback, fixes ticket 1835. This fixes slaving of signed zones to IXFR-aware slaves like NSD or BIND.- only enable geoip backend on distros newer than 12.3 before the package lacks the pkg-config file and there is no fallback to finding geoip without it.- fix permissions of the home directory- enable some backends that we had forgotten: - pipe (main package) - random (main package) - geoip (new subpackage) - new BR: yaml-cpp-devel and GeoIP-develcloud117 15859381224.1.8-lp151.2.6.14.1.8-lp151.2.6.1libgmysqlbackend.so3.4.0_to_4.1.0_schema.mysql.sqldnssec-3.x_to_3.4.0_schema.mysql.sqlnodnssec-3.x_to_3.4.0_schema.mysql.sqlschema.mysql.sql/usr/lib64/pdns//usr/share/doc/packages/pdns/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:12262/openSUSE_Leap_15.1_Update/7a6cdf7879925af089f69ecf80dec0c8-pdns.openSUSE_Leap_15.1_Updatecpioxz5x86_64-suse-linuxELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=739e09978448032807f1e8cf02f64437f5e7d179, strippedASCII textPRRRRRR R R R RRRRR RRRXz^utf-8a6a5a7ecfdc0e546cbff8602df1128a860c06996842318cf2b66f57686b87d8e? 7zXZ !t/wqM] crv9u,2p1; Q.TF90Jv4rͿ<&ߘbd@>E(nHg2$ٍhg] MWaߓm|͟Q/]N,X/nFkf;tʻ/|ӝ'4˿w2!DM~L-ǁ2Qk4'mr}k!?346_mJTJt0L'NpP/! }vgC¥sλ .p+Hkd6!+,+GaGX|1E IoA؁.Jli$K%u7%DC"΢샯w#J ohT}V΁F8 : *da#'w O@gW+n՜[:5b3}󿷰9mYf4XB G7َjFjU4(^4`>LޏB!C])3o8@-=O+cϽw_4 j射wD7<{AT5a!-4Hj5R6f¢f#qH(xX*W :vHp뤦"+b~BŜf^#َ O1e=G6R"K 6vnp@@8tzq>&9=Az%@^J12gPx؀l/_75=RZԎ8qsJ^/7 {fm} !LA̵ Ooq2QY^/:~'?6Eb JTv\ݟ-mAR&l+l)*g0@&й evJ8s?bPoL,ypgįUP>4"e L|1T3n7 n|A]pB*ï=4su971(rSf3(:;zk[UviA_skHB+Ζh_8&{䨘ҁgw*[#1nk.xZ*䇟Te1?rV`yJ캊$s{ł<7oC: ndG8z0|$~6]4-ݐD4qTTS S*n^58efp=˲zGPw|`3E*1^|Y# l%zd/ܮj*@r*JV-XAuz9pqY~ f^]Y '"lE?, dBCO]2n8R^27ϸM|zj,5𬮅xǍ8| fv%4S*"ٶɕtȩ1,ڞ5;\LG OMF^$?@O+?Ъ&9EQ?ɰ@hDծI|QFoK#|Jby΃=PuF5W!Q`n'tzBu!й/K-^ulbבAP)Irp !Tj8e~*^z߳T{SoXҝ<"x=FX[h\Ewq\S kKw,[ _K]"5 wk*_Fk7]ID/0Q,*ƈecrU0p94lS&5萷 I9Ȁ" b,eM'idH0P/8 Ri*{cD*@jLphRA69 &e8FT:mz0PhO]n ך l0.@ ,vYו9PQ}&>J~t6_&=>9[yoN I4jsoU,tE8c:p YAO^H"\ryFK2ip3Tib3NJv!zAp aڴm, ϑ-D-J^27[]oV0C7QuHgͷ?[qJRhOIb~~&>Q")AK=*H M4EBVbX~̠i.KZh]qvlO2Rm],쭭ԃkOڊsn~=ϹaE?pE!H ǖ:J˒P(6 x2 bG:d7z\nܠ\o|l mE.R4/7DW˂j9:*2sSw##uIt.%vA Xa:ZRf0e O#8`v{baӼԌ TnN\c{sb_smBfX2eDV Vx[l ,sN ae`n:7>73N%x3Ȃ^"we&s*SHS.*DROLUZ(:XB4D2D0Lm d%>--pH|+V9Y4'%[F,o֤J?)nMeSHjC)\Mϖ5T% X&J$A#_{.~cSGdTfS}5uh.=(hy)Zuq&NKD6`7T;9ķ܎;DJo!3l컶e>i?^(O=Hpe$o-n=|{i8 T9՜{ O^>=uxuI!% "! Kou8*ĈV~0( {)iA͆ 2^P&L!_+`hWEShC:]" P9"!`Iy#k^uwzao>'z4lcxAî_@& 9vywSы(Js~i$ooЫyfO ebRd6L:dus_Y]Ͳ\q0ڽm XHjTYMV \ Lv;}_-¶X]PQ/Oƫå>a/pߓ$٢*o)MUD!܎#3} Y 7)ql ~-q 22~70k.i5&SKUvOSe5K+& $Zd,yH$M>1mR(xp9ރ?O@^9w**N|lN{aU; БE~H08h6S\ +<iʈeENo@ 2E.eQ)6[yM}ك_:bYsWj?PGk:'r/z}}E;E{E*`b9/t)CŠ@Qf0whPh3UXA ,q)jR]P\681Cv8CjH!]32y-"=zvyj#m|.,ɸᶾߚ/[ qϘ^ /ˮ}w8)|A3Gq_LeGO Krnh͎ѦkH(P VNmFJ4Ջ*1SUWE*ڐ'4[ {E$M@?8M"+gۚS3dhVOO*sCj}}wHl:yL#ܻmG" 'FR/!Ix`*:M6'nv UN_ Iîp_??婪vs#D\tD^#hF˩Cܳo=M$MM-}zp$.uɘUy•] gC'n׹ a: #y>(_cqnyA(1>f/{7! W{Gng1:7)"00!x VU( $>qħ?4uֽ9OE%v5u!̮/M S;"k/g٦L\p9}Ef$c{ h%zJZƄ?ޝlH+BJתΘ¼6o7DsFUϾS3A^V2^c3@>+4?[z;%13nVV6= y^Wlb%<,oe> Z{ h(VE!1!$wsxQz䱻˶Qw ؍U8BB.]mV% pP>e37ԝQ#Ѕ 6%9+ e-wJ[f]̣TsȚ#2xBXlYȊTǓB V6yLY X.P5&^uS_D3AE Wh>Wd6ʼnj}3dҜ|쒹M{v|*5#测ub_ub eLQupz^pC7.',G|=9W@6'oVׄK 5NO6, 'T@hcĒZP/56/;5#^PmTGM_D\JC!펉݁kwQ)s&ֻʹ嘬Pp8t jfG^0u@g)=`͑84;emIo3`ęx*X~H:w(?cf|vj fy^ rv?FQR6Dgl:+V&eW4]!pؕ-D6$M9_&Ɵ8y},F$3=YPaN "M{u!9- y9Ra/gߣY7O5a 0'’%: .y~@ 7m.%NPȎ4(tt==n+8YF  A_͸Gn]d; ncGqđ7SEu ju^{ΌibϓBvo95b5 g$?eܑ!I^^:RƢT7{!S}eS ت|є*^Zw Qțv+ZDv,:[ > =7JTZ@V.<׭TET+ABLb{'z"5)WfE?wQ)J{/9UjX*&Dߟwf:4ci|(k9wd9ۏWY9/fV-O%,Bqi )qH]I`,Ieּ-ef&_q@Ou5Q\V[q4nSe{.`zpPqKrXE  yBeO z ftƘDĮ@eyicƼ߬((5ϵ#~ T&4"Ë>͛ewR\1' ՗:4}L By,-D QX|?)-cVj?A0,٥9x($x:;h_"Pc vZ4K{K")F"u [MܘВED_ҡn>ss֦]R=u&ThQ#GAiHiG:z/ ,*Yf.zdܢW%ޓ\EWY@Y@w)f:Q {DӦ'Il.Y fxwCfLAqAjڦݐ(Qq.h||'?G@˭5w{ .֓(%@Lmgjƙ40D^ >*ZOVl"U;X׭ef+ |Pn|a;pkDJ"7~),:\e˴geGFXN+!CCoܧqө9|?{i32;xo7'x=cT1"d*-]p?Z`dӈt}vK%6HN5,) 9Ŧ j'_^X3FJ0y:+xdw\$gn74xP 4W@3ܰ7X/fIKp(3rSNk[{ %M}.DpW;n b^}ʰfdK"$3l] \k!kQp{\x@fLN9hh:xl=:H/d}>6C}2Iq1~@ukUWd3-Do}w )zGWjcz7s|lIĥi )ֆV&7"JXJxCF>ͻ!>y֏ƣHWH0@NSV?r5~KQp\ UO2;s`nJKB. 8>K#!ì eۄ V &X*£C9Wlιaz!hUFdo.tdT|I l.qX)$kOU~$S 0;JX Gu:Uhk*WppxҖԮU9`N385|2wn67\ĔةlP:?Qj3o.*Yw/DMdY3zl'4f`>z%]n0u^&UyD˜nsEETe4-Em"H W 6$B&&yZ6]<k ۱~ߠNEI"qfhFDu cݫ0WjR7= vN9WQXP00?s=u;?9lQF6lM:^7Np(v+zZ= o`M2 =(plA;xrO(0,2ʘu1I7ЂxI4BV S>xdTJxB2`Dm_ZZGJg큉 ֡&<Y?pN+)@/h1lgGZ {0H/RWotba .QKFMh PwWQ yPcX0xo,BDxl\ݓㆨi_4ΏMYD=UC9)gm 7[ڴƛUc{| t/K;OUИNfPys/rju|1I+R<94šbe^uS $;qvLX(lhDCFZ#a0 ?5ɒ}##]:E0N6<oeGBeIDovd``'L 7MvFK CM܌S lԳQ%HrB[t`"= SV3Ϟ%T$I䈗$yy-lWIG!2wQm&Kcx'`{|fΉB@\9% ֠6*m0yHU{xȱu}X@ R0I:Il$^͌w9wA ? w%)AAͲ+-,0V1mIǠwLץ?rEm?.&ڨ b0 BiQ3PP5ɇb$v BէԤ̓Bfra!o"?'bU$C`8~*b?ݥȁIR9yauѻ. r\W|UK.2ZLq./V]ө>⑴ƅvJG D#2,!$UF;Q1zwwucrfOfA:8%Athh[MN lNO֖Q-kz=sAd,"e{ = i.*9)b|g]NPDx%9Ĕ O1o%!,}L~~37Zs;QZ:H837-Iq6?&!H~htado-ʅm•R5]_Ҋ^IxYVҳDAO`~; *`_xm|tB8t2gBz%>hm7_zodvjǂaH);Hڥ9ӦV _~TވTaNWU(i yB3I50[`CX,Oy~aP l h F8Vɋu&ZUgg,V_JI͖6J=W[jbc\8>պd/a9K LyC.FJ'j`\ \rqzFc6xyЋAJad{?n/GnavݿRI^OMoe|yUzPoލoۘ+d)=N.^tZS }ZȳBW#XhmGם+G3D(ܐyI7moM2ɼ8//4<ɫR00/<5T)nV\1֢+erC>%|/\1VS\뗀| vkd߆>W- " ٝLE_4|Rk:F;bU$n(!;C*#FVy֓whx{-.~ ]N: Ch^X6o(UofHr.|fpc|Glytt9iWǕ0zxP@{0L^goXcn_92U9ٳ%" kjC%-#iyd?â@]+;g)BO2֒%Dk7ށ Ρ 3A8%ߖl2"U_$i¡:|2yF˒ݸ2\{e$dG9IW!~&sA7fI *\:̖}FDGAr3¸ë?0qqdm\veN+ eh92y>m!N+>tI_#~v%=e){Se`?MrCLGEgQ"D<3RbD3^hIc|,~הo &JsB?(C;Mr\Ќ*ltzpyaEp^;eNTmŸ{,n<;џJ򟒃ցD^Ml7$k=1?-\O0mi NFJ-Kk.T; xZ/z<ϔ~=.۟6O6RFBx@ݫzL 6M|g8Bū! {^j Q.W @X,ڡՎPVa1>oSJ/KIJfTok1Q &y24gd/[Z/IٮkܴS,V; mt$@#PJ?Ss\l}&bla\YXᕏ;[MCIY&IJDv U5rZfj# D_cP 'C20Uv*|( 4q :.4B}DsYz-͸I @ȫPaCH9Ș6 Lʺn(XUK Xآ+ }ٗPF_ܶ,Vنef/li.ΫT6`;;N}ȬTWPdJ";8_Pfސ{|=wKf]1<ёS3[XtƝe~pTj%`VR>W* >{[%sgdKK?f$<M z,2gw'/"JXTҥ)ފSL)Γ,!C3U0;W~`k?k*-4˸HTt%,lw1AgMヮ<e^@?i,%*/,Vz*{fفE]{#J9t!kyq&/Q##F%%΋9d"jȄvG~uq&^J0Ocɔ ܥ?VRl%,ÜQ+(y؛Ԃ#mL  NĀ%ʗt/ `mGV6! #OqY@]6xC\I%ɸJ eY4b!:ڴqp,yK{4[+ܛæy73)7!2q4?94B"Vbh}k$,i""kA$MU)4+F3 &԰kɪj.F$Gr~)aG $.M1(meHς&*<Bʔ[u8qrЍ YJNCåǖ>*(-}2&yORԍ95T=GTCK]*}bi>xZ̙Ly'pѧq\b$8D'5?Ƌa5>0ͽ\ P)}Ҹkv(U`sNy@ u<LEtPY~f0P1wO8O&q[c/fg0%$UhM`s<|K\#CKij Q/yc Gh0MHLO J< ܿgԇ6ʕ!tظOxH;M<) TxxYWXÃKaLGsy?Ӿbq2 ?lAʧ6 `TbU6Vi:A𷁷e= vO[D<>hC n $ ^czBux3NZxYyIYk̦^/ e6 D$=eh1Z(>AR>-~¶v94Zw&حo]O;ӎq; Tsy1›ZQ/a/jqqb%Ү:zrV:̤V]YcRpDHj<צ@~پu. aW9S!fy+3Šq;}4cvGn52:銜3N]t)Z58ud;x~ E.g}N2;9nڥ֩lsט)j-b6VبgN޽(WDbp%N׉ 8qBZj=w rwr(̷$83*atW9s5k^a'|/"j!\PXxF#,;5wjؾ֔%7l3lҡC bIꋤYG 6^w(x+_Q8 4-'s:F"a(]ggpy7ՊAJ NH(FߠTUsr]Vq)ϋU@\PVѹ/ާ~㐬^٭IC9 ?Ra%][5dI7ذe%hW]\ןz;0xb!Qt!%]݋:G=M|x|#\uMhhɠ. HJ% 8/%`U(,VI!T4 XvCڮ#@jG²\׉<!/JǛWqϾ+wHKzXň!3](暫lNJ>2Qn{¨:Y4?nYI^]j)zٸ:BvD6̧ՆpW;5s{$tNm\ݜlo65tR鼃qOB5=4^Q@(Ϝh i lB%z+Gծ0}]C7Rs6j'WJ:4/+i>up4.A~ց?*ċOՃA9*1e{3IdÚWɈ㱫CϮxX%߃'&|Qj D "7!!#$M ^K8y9m-a-Kg@Aϖb4GMnDYݗXzv_*GV(Pw=Eڒ3J)dh'fcKW'빆eRy: 46[\ôM?r,?h8CVtلr5*:7ͪ} N|g)#Wh&yWbȘ}OSrB4NϨTf(?6ЎF=ϐ2;<\PC{/T6"UMNvv0tV8Iogkȴ4v6 _~]m/y ΃h|EI3TΎc]fP/ hQ a9Eh{aU(O \Ҹ)ߎ SoӫR{"{ =W:zZfc!gZ]:ִC!=ȉ/NflO }[6 ;MyrpޤRH4h#PɄ3N>2drHC@D-Tﻈx\h QO ğ߹ȓh@c#Xa"8SB򥫲.֐U(Ӵؔ/'> Ŧz@ݤS_krˏP8_mi0OSNB60Mtؠ3]lEYm-V?s &toz.֔G !] C E)` W`I+T̴(ڛ~h ӼH7Ac {;x(֛;fa7?dxP[9(COE,DHxlZW|I"{6W?]Z)Y7ck;e>Qq-l])E]qq 1EmKݺwxx8(}{Qau2gQPh@| G\S`ôqj3whС篍mF?eXjs Qf,]P[;21X( 8=^-]9_i@X()]>s1(TNSn/̓ekf7X)zŒ-[0Ex' EP$γv&^dlbeѧ^%5Sկ5"d{:P fwe@Ҋ1/3(xW"_ Fj={twot6B>XҼ<,?$ΰ}fJZyս0./r,pevʫhYOyg4=BW7x `M $זǟ$u'Do)E()*(APSb;/ymtt?j@V߃y^_;w=x\-1`So^R^T.=x_~=#Z1'D!_nz//pCP]eP I7[L!:jH蝷{ʆ?4X9\qX5m?#/_ P!$qjT*NxoYܼ|fO%ay[" P'dhN@=Bh.7ɜ5 mTJ9&yv茑h~fap4, m%*x5?j[;Ln⤏Ѝ +QBV~\h n$fh! I_vT_?2٘z0ꪄ8X& 3%=ؙ$i,s^d2g]Mv_rcWQg6omUcPiE㫀uxY^*#63rrc,Y،\5LR,Vdr5xՑ&{mm l0(% &ARՓ ,1X5`'a2#d{s{8"10jޠ>>ݦNخM3U >3мDR+Vhu;zd<ݘz:z;G4&z}$-fWH:@aXS\1޳aTy ge)TZ_\8꿲B%Xf)I5y3yhB܌3~G:6eFmemd0KX_ '8f)KB98V` 3.gxR z#r'=.:eHD Ր6&1x&Jْd?e!M }ZaJ _.S,{w0١$cIF ̶T&0nwD4/QYwAD@mjVpXi`a胀^V&4dp~gE+|=$ݦ $eC&866X.oIO_E=XF̭c,O{, s ƇٓIz/1a:,Z:^Pd5xrr :<E7DMO)So>H8ӥa R`{!+uSt-73qF?oUPc@_a4]"EKߍ)!5uSo,H7agL<rqF QA^[BZiذ50^Ȅvd]s¥9'd` ⮱iUU1\>~ay*.PbH 4{.\w`Cډ26J~OkK mYŮP+9;EgT-y3|2a܇`ƈ=&nȸi S|9],$ZV#Fι#f`Ӳ*jwCN?v~gȝuuJ̖s/x^O|GtԛVi۟-S2/&{7!>:p)-f A>D= un&<] M76Fgx)cQH϶mi0B\93&^1b|XUNG_RĨ+IM fg;k:+8MgegAϢYF<-}]i܏%ؒHPƼ}:/JE-EçQjd/ ܾp,eu\&dcM׵ M#{I}Kx J3brl[i <-`WU`T&{2I1o,P_s s'2|R՛hҊm;hdׁI$7{Z5GH"'! EC}G@fwмJٿuP4B^?ZzUjұ0ITUj Ҥ288,7{)=$l?FЗ c3FA1(qgS[}Z#ӆI z⑺[rnHZ lzX"PnafӼpR~&9b_({|4#1r-ټF#aZn-!0}q lD^E!01ӡ3ۣkɚƞ[}C7uv2gd\i\g?$>Tm!W _=㊋Ka= Q~u_q/Ȉx?8{x&]dT.Y[yRH#uQo#ݖH6jE~Ts1 A*xGv8*\)utc_I]t!?G(.P`tf+3]m)a ۹ό'dtpR-cUu=(pVkAP"ygtI!BJkcd+;=2Lszi/2:ht&Ow ?5z-Y Q"f|P0'U#r2<$"B_e&N:|~Oo[k^5Mᤠ8yW|gF%wN#.kX3$@c'MUi͌ܿRyJMLi ~_ 8$&ѭ*֑gpȵ e9RmU JRP,'2yɳR<!~Oɇ>*'@KCe:ʳ ";A o$./[?AVGd6vmV%80QCyit'`}ꗐPu.s!|\A/SWr*,;zQZe:U* c$pqm 3E$u#s,O+NxPe ]؃vHSM/M]A'9#s~ĭw EIR(U[CYə?0L)oYEP-'8T9 )iʡp-< WlԅUTdvNQ X=!A\%OC%IئA+ Blx&&+'^0!{7w1CYwFx.\Qbݜh7dS[ʸ]gG&J1*4H˧pY}cS+xbdAzqp :+?cpO vǚALTMVd!9dSn.i\vVKn:Ӫu>p:~2p1F8TȈ5Hϗs.YD kA+:RV0BpMD<\ -f n(Lpg\fHLd^N_FE8W;#5{.k+UFk&@P%7Jl("+nQ;|' aXc~ oLYo=*fbأvn fd+<߰1Ϲm"~<Ѵ\7?~ ̮cQ0yu>POLbk*G`BOV"A;i OTx @{<,.Hk)+1|# 7fY?Vإwjҷ3I\j[@'po/VNwۏy$mO4~Ka?]1q _|ʹGhFG~Ã1%a@l,d3*գӀOBcmJuí{zI.m†d#@ u*pZɎo c!0M1:ie_;? bL^~矋V"Ez̆ѡ~{"FԮ]SwR=YhBdٰaB`$饵LHG+GԿpY;/oȌL6H{L4zo3yd,D.~L@?oPcRd8j] d$ܚT}9նP* \(5 ZKt#hgZуi@ؠɖ>W<7L_ ln 'TBr~ّ)~MY4b" G|~ڔz0]l1Ɋ 7d!1KKPx؆kx #hHHw>SthVe!bW.R u~顏c4ލMHNj`CÓS}VzصNCauai٨,WO&_WD&2GU%ZzF $^ ɍFU"jP0W^rK_{7bɜlM͘,&ƚK<8/gҺ]MGZ9JXMybea,ژNWu0a(٣ $x9p}PuѸI,.8>ƍy*$h qj++^ nmc14=x ΁OFjw(4[o%q( A~ܭF_) W=y?z3Hɣ*?i닇PZ)ڦQ~d !;@mLhSbi8?nB>#j)CʼnXͶJII# Oќ7 4U'sn$Dp)ʱ qWpUE$1iJ5n'oufι"rl0IZek:b޲'H2g(RGk[8F>uʫ ʻ1QV9ٕ$dg@3ٗDT-%\ %dH8&ߋp,iGgA %rj0FYXJ(x\dǣBF/ق&coA߲@Z7!m? ]F^W[]ҁ| 6 6pR -#FY1]+%Ƣ3ɞS\||ڼP7"9r;pV^ q1s vjĺBN~ yp /מ~.dB Bguwo IG?9VQ-86$bbFAja ~ Ov,4Kg$$ [vqh8}\JP>#íAy<(_Hy93;w&#B?#O4](xDST rlɽS1٥~÷:p-*RF{ƣc{\t:'4+80z!]UKe.A ۤf6DyyφIK!&# uG:ɥܶ:엻3ljt@ɦxZB0-'5fa(Y)J_*|i*kwϨhC;<Qjo}ɭ}\9u-qRB㦖lO)=ݔkS#Nףj#c蝉;_Ȱ؏#|1%y B95Q[ ߡj֩Hg9 '_Dׯcyqf੟Hqd8l9H30N\DMenNAVl!^0U,D 3>boާ߀BsA5m;`Z'3]V}a6/'~=_mE ┾GKYe-+ \c'`ME?(@aut'W!>0/lNaRUj9Wl=F \f c+(Kt ~Ozz:R;12 YZ