permissions-debuginfo-20181224-lp152.14.3.1 4>$  Ap_r:/=„ rIT}QrvۻGw~LMHy&VZ2'Lsk]iAF'_OouYE!Wz q- b 'ZH^,B=v&:vJԐ.T,J3Dw{5[,#hr^Q}.Y>On!Tv|VuqjE74ড়+p"nP&1cA1Nv4}*3դrm 5`56ca43c536a90878957f7282040608a8902dcaef76c47b320a73946e383c7d44c6cff4148059a9da5280c95ce10c6fa0e68ce739_r:/=„bB_(?.AfQ5&EYYal򵍌fO(cja?E-մǿ  i]a1hQcAeMr  R.naqSk Fr2v8PiD}w296$yNs!Hݗ1wvM8M]Ӣ12 ֪jedkaޯFZW%{&)!RamݫJUHdۙS*19=Z/$AjGlCq>pA6t?6dd! . X /8A Zl    H ,Xx3(O8X39$3: e3F1!G18H1XI1xX1Y1\1]2^2b3c3d4le4qf4tl4vu4v4w5x5y5z55556666`Cpermissions-debuginfo20181224lp152.14.3.1Debug information for package permissionsThis package provides debug information for package permissions. Debug information is useful when developing applications that use this package or when debugging this package._r/cloud126,openSUSE Leap 15.2openSUSEGPL-2.0+http://bugs.opensuse.orgDevelopment/Debughttp://github.com/openSUSE/permissionslinuxi586M,AAAAA큤_r,_r/_r/_r/_r/_r,_r,_r,7c4f8e0cdb2f485b57d1bc68b539f43044ae15be3dc32d1cf20c978079944a6c../../../../../usr/bin/chkstat../../../../../usr/lib/debug/usr/bin/chkstat-20181224-lp152.14.3.1.i386.debugrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootpermissions-20181224-lp152.14.3.1.src.rpmdebuginfo(build-id)permissions-debuginfopermissions-debuginfo(x86-32)    rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-15.2-14.14.1_i^?@^ϧ^>@^^y@^\@^Y^;^:@^4]@]@]@]@]:\8\b@[@[z@ZiZ\Z%8ZZ@Z@Z@ZNY|Y@Y˒Y@YY@Y7Y2Y1S@W"W@W@WBWBVV@VV2 @V +V +UuT~@TZ@matthias.gerstner@suse.commatthias.gerstner@suse.commalte.kraus@suse.comjsegitz@suse.comjsegitz@suse.comjsegitz@suse.commalte.kraus@suse.commalte.kraus@suse.commatthias.gerstner@suse.commatthias.gerstner@suse.comMalte Kraus Malte Kraus Malte Kraus Malte Kraus Johannes Segitz Malte Kraus jsegitz@suse.comjsegitz@suse.comopensuse-packaging@opensuse.orgmatthias.gerstner@suse.commeissner@suse.comkrahmer@suse.comkukuk@suse.commpluskal@suse.comastieger@suse.comrbrown@suse.comkrahmer@suse.comeeich@suse.comjsegitz@suse.comastieger@suse.compgajdos@suse.comastieger@suse.comastieger@suse.comopensuse-packaging@opensuse.orgdimstar@opensuse.orgmeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comkrahmer@suse.comdimstar@opensuse.orgmeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comkrahmer@suse.commeissner@suse.com- Update to version 20181224: * fix paths of ksysguard whitelisting * whitelist ksysguard network helper (bsc#1151190) * pcp: remove no longer needed / conflicting entries- Update to version 20181224: * profiles: add entries for enlightenment (bsc#1171686)- whitelist texlive public binary (bsc#1171686)- Remove setuid bit for newgidmap and newuidmap in paranoid profile (bsc#1171173)- correct spelling of icinga group (icingagmd -> icingacmd, bsc#1168364)- whitelist s390-tools setgid bit on log directory (bsc#1167163)- run testsuite during package build - Update to version 20181224: * testsuite: adapt expected behavior to legacy branches * adjust testsuite to post CVE-2020-8013 link handling * testsuite: add option to not mount /proc * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922 * add a test for symlinked directories * fix relative symlink handling * regtest: fix the static PATH list which was missing /usr/bin * regtest: also unshare the PID namespace to support /proc mounting * Makefile: force remove upon clean target to prevent bogus errors * regtest: by default automatically (re)build chkstat before testing * regtest: add test for symlink targets * regtest: make capability setting tests optional * regtest: fix capability assertion helper logic * regtests: add another test case that catches set*id or caps in world-writable sub-trees * regtest: add another test that catches when privilege bits are set for special files * regtest: add test case for user owned symlinks * regtest: employ subuid and subgid feature in user namespace * regtest: add another test case that covers unknown user/group config * regtest: add another test that checks rejection of insecure mixed-owner paths * regtest: add test that checks for rejection of world-writable paths * regtest: add test for detection of unexpected parent directory ownership * regtest: add further helper functions, allow access to main instance * regtest: introduce some basic coloring support to improve readability * regtest: sort imports, another piece of rationale * regtest: add capability test case * regtest: improve error flagging of test cases and introduce warnings * regtest: support caps * regtest: add a couple of command line parameter test cases * regtest: add another test that checks whether the default profile works * regtests: add tests for correct application of local profiles * regtest: add further test cases that test correct profile application * regtest: simplify test implementation and readability * regtest: add helpers for permissions.d per package profiles * regtest: support read-only bind mounts, also bind-mount permissions repo * tests: introduce a regression test suite for chkstat- Update to version 20181224: * whitelist WMP (bsc#1161335) * Makefile: allow to build test version programmatically * chkstat: handle symlinks in final path elements correctly * add .gitignore for chkstat binary * faxq-helper: correct "secure" permission for trusted group (bsc#1157498) * fix syntax of paranoid profile- Update to version 20181224: * mariadb: settings for new auth_pam_tool (bsc#1160285) * chkstat: capability handling fixes (bsc#1161779) * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594) * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore remove all of the following patches which are now included in the tarball: - 0001-whitelisting-update-virtualbox.patch - 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch - 0004-var-cache-man.patch - 0005-singularity-starter-suid.patch - 0006-bsc1110797_amanda.patch - 0007-chkstat-fix-privesc-CVE-2019-3690.patch - 0008-squid-pinger-owner-fix-CVE-2019-3688.patch - 0009-chkstat-handle-missing-proc.patch - 0010-chkstat-capabilities-implicit-changes.patch Because of inconsistencies between the upstream branch and the package state the following previously missing changes are introduced by this update: - Update to version 20181117: * removed old entry for rmtab * Fixed typo in icinga2 whitelist entry- fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch) - fix capability handling when doing multiple permission changes at once (bsc#1161779, 0010-chkstat-capabilities-implicit-changes.patch)- fix invalid free() when permfiles points to argv (bsc#1157198, changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414, CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)- fix privilege escalation through untrusted symlinks (bsc#1150734, CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch (bsc#1110797)- Added ./0005-singularity-starter-suid.patch (bsc#1128598) New whitelisting for /usr/lib/singularity/bin/starter-suid- Added 0004-var-cache-man.patch. Removed entry for /var/cache/man. Conflicts with packaging and man:man is the better setting anyway (bsc#1133678)- Added 0001-whitelisting-update-virtualbox.patch (bsc#1120650) New whitelisting for /usr/lib/virtualbox/VirtualBoxVM and removed stale entries for VirtualBox - Added 0002-consistency-between-profiles.patch Ensure consistency of entries, otherwise switching between settings becomes problematic - Added 0003-var-run-postgresql.patch (bsc#1123886) Whitelist for postgresql. Currently the checker doesn't complain because the directories aren't packaged, but that might change and/or our checkers might improve- Update to version 20181116: * zypper-plugin: new plugin to fix bsc#1114383 * singularity: remove dropped -suid binaries (bsc#1028304) * capability whitelisting: allow cap_net_bind_service for ns-slapd from 389-ds * setuid whitelisting: add fusermount3 (bsc#1111230) * setuid whitelisting: add authbind binary (bsc#1111251) * setuid whitelisting: add firejail binary (bsc#1059013) * setuid whitelisting: add lxc-user-nic (bsc#988348) * whitelisting: add smc-tools LD_PRELOAD library (bsc#1102956) * whitelisting: add spice-gtk usb helper setuid binary (bnc#1101420) * Fix wrong file path in help string * Capabilities for usage of Wireshark for non-root - remove 0001-whitelisting-add-spice-gtk-usb-helper-setuid-binary-.patch: is now contained in tarball.- 0001-whitelisting-add-spice-gtk-usb-helper-setuid-binary-.patch: add whitelisting for the spice-gtk setuid binary (bsc#1101420) for improved usability.- Update to version 20180125: * the eror should be reported for permfiles[i], not argv[i], as these are not the same files. (bsc#1047247) * make btmp root:utmp (bsc#1050467)- Update to version 20180115: * - polkit-default-privs: usbauth (bsc#1066877)- fillup is required for post, not pre installation- Cleanup spec file with spec-cleaner - Drop conditions/definitions related to old distros- Update to version 20171129: * permissions: adding gvfs (bsc#1065864) * Allow setgid incingacmd on directory /run/icinga2/cmd bsc#1069410 * Allow fping cap_net_raw (bsc#1047921)- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- Update to version 20171121: * - permissions: adding kwayland (bsc#1062182)- Update to version 20171106: * Allow setuid root for singularity (group only) bsc#1028304- Update to version 20171025: * Stricter permissions on cron directories (paranoid) and stricter permissions on sshd_config (secure/paranoid)- Update to version 20170928: * Fix invalid syntax bsc#1048645 bsc#1060738- Update to version 20170927: * fix typos in manpages- Update to version 20170922: * Allow setuid root for singularity (group only) bsc#1028304- Update to version 20170913: * Allow setuid for shadow newuidmap, newgidmap bsc#979282, bsc#1048645)- Update to version 20170906: * permissions - copy dbus-daemon-launch-helper from / to /usr - bsc#1056764 * permissions: Adding suid bit for VBoxNetNAT (bsc#1033425)- BuildIgnore group(trusted): we don't really care for this group in the buildroot and do not want to get system-users into the bootstrap cycle as we can avoid it.- Require: group(trusted), as we are handing it out to some unsuspecting binaries and it is no longer default. (bsc#1041159 for fuse, also cronie, etc)- Update to version 20170602: * make /etc/ppp owned by root:root. The group dialout usage is no longer used- Update to version 20160807: * suexec2 is a symlink, no need for permissions handling- Update to version 20160802: * list the newuidmap and newgidmap, currently 0755 until review is done (bsc#979282) * root:shadow 0755 for newuidmap/newgidmap- adding qemu-bridge-helper mode 04750 (bsc#988279)- Introduce _service to easier update the package. For simplicity, change the version from yyyy.mm.dd to yyyymmdd (which is eactly %cd in the _service defintion). Upgrading is no problem.- chage only needs read rights to /etc/shadow, so setgid shadow is sufficient (bsc#975352)- permissions: adding gstreamer ptp file caps (bsc#960173)- the apache folks renamed suexec2 to suexec with symlink. adjust both (bsc#962060)- pinger needs to be squid:root, not root:squid (there is no squid group) bsc#961363- add suexec with 0755 to all standard profiles. this can and should be overridden in permissions.local if you need it setuid root. bsc#951765 bsc#263789 - added missing / to the squid specific directories (bsc#950557)- adjusted radosgw to root:www mode 0750 (bsc#943471)- radosgw can get capability cap_bind_net_service (bsc#943471)- remove /usr/bin/get_printing_ticket; (bnc#906336)- Added iouyap capabilities (bnc#904060)- %{_bindir}/get_printing_ticket turned to mode 700, setuid root no longer needed (bnc#685093) - permissions: incorporating squid changes from bnc#891268 - hint that chkstat --system --set needs to be run after editing bnc#895647cloud126 1605530159c373805f95cdc88e724f1d6f257e8055b01ed1d720181224-lp152.14.3.120181224-lp152.14.3.1debug.build-idc373805f95cdc88e724f1d6f257e8055b01ed1d773805f95cdc88e724f1d6f257e8055b01ed1d7.debugusrbinchkstat-20181224-lp152.14.3.1.i386.debug/usr/lib//usr/lib/debug//usr/lib/debug/.build-id//usr/lib/debug/.build-id/c3//usr/lib/debug/usr//usr/lib/debug/usr/bin/-fomit-frame-pointer -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:15002/openSUSE_Leap_15.2_Update/3eb488a46785bebc2ccd039d1c7dafc2-permissions.openSUSE_Leap_15.2_Updatecpioxz5i586-suse-linuxdirectoryELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=c373805f95cdc88e724f1d6f257e8055b01ed1d7, for GNU/Linux 3.2.0, with debug_info, not strippedP)8֖mm)h2permissions-debugsource(x86-32)20181224-lp152.14.3.1utf-800cba22b7202c4de157488bcd53847f124b72ca43ef1c0994fcff9f887acc62e?7zXZ !t/I ] crt:bLL GAy]rG݇2yŸmg֮zۚj'EF GAj4_ a`WetfZGDPWlAGHyz3R : ==4?zU$:|JOƺ8n es)^htsxwn7$n7h,V,f`oULݚ0h?3ʈ$K}-mXDĜM 3x`~-\Y%_'"R6R]c6zO~JBLSe| pM"'ìktL)7yI*iު WNbp7Q{j[W-)>SՂvSQ{N4Nں)=ħocyCcVJǀ[#"ﵹS fNc,P|;rryނr$93|OodoZ,YjCeA|󓥦wsX 6{NUU5ɹ}d X1?Y&ͫ{?x$5N}qkvEKN% !a4Pj&&@=D9<,Sowkwgi[Z;9g5i _< ^_BqoKvQ& ]zƟ@9v`;[ XV&/CgkXDL.+bH0hX()G^`f"LJPMFE:7E2m$`Ha]bغ5.|FDIZGĘb(z`k`H?XRo[ %c3˃tv5-䒟ZEmrwշk8\W몂@utxj- x !7쩇}PEMcň'~bb‡K=.X$O+V?+cxܛ`4GYeZ΋;?B1:J&ׁ ƌ5̱*ʵЅV["%QCIP;G%8vJ 9WzvٴlvKLtɈM28F'n0Z(`KbB^5GM9v )w"k-J5 oU~QI@t BT̅/]o⫅==P˞yfK»bE'r/1w˄Ҷ^>W6JLTT X3ql4O,]Z9;]lyB8}359zjCyNAdmKmKyG7Y .? ]F7 "W_3tf(/AP-87x)-d X C}Æhgn,ՖO(q,u *xf2 QKh*rG`js3K-ܵ1pIȾ25S‴$H+I KH{NvY[L`|| Ϙs+ixdwC഍ Jt.: 0{6/0>ag:cvU7_$ }KSОHhqGF%FY6.-}pkjlsXhFU5麲LlvU-t^*G$E ot[ jdnp9'w&m&7+MbS([WEj蔬>zh653=?Wl0|RSm9UZ@@/>S\ޟ)|k!prKwa|D#ܨ̣=@r0欚UK'#e6̙_I$8tYVom](SHg-dz$*Fu-0ۯreFѠc#{ދOg%)^r HOSlyso3付̯^4x;*F z43KZêڞ~/nɍ(۔֦`HEi[l-0d0Tm/DH%ceLNiv?+hj#+;z:1baz!ɧ%7TV+.I܃8Ѹd{ٌb ^Z+fl$'"9ə ~]dK6=X䆱04{!K5 rq5LeHEr2܋ =06tm.ؠYJ ѹ>KGNN!7V$]kı٘ `DsBn%n,pJ۝- bCpeb-2Q'9wɯt$J#\)dHY?Uad'T=(db-wn dLH\('WaB>Qy$-/ckփMS?ԥNс&tKiX:WPi~cO" 6PpLjB_w1d @Pn$]Y¥S,U܀zvĽ8K \?_fגOuj!t ޏK R!6OT/5';#AZ=Yg<¢>fjY/lEQGf^|fdweP!`c-N}ER?,h?#@v] 8gVG[o|d N^&5hPkbˬ.v 兾v4(@9[t @3us >yM:\fn+#*ard1"a)-_RF%79s>K_ʳ}q0mST"C(Ů31=-RS#@-Q !î8q_~ezn\#Z_i [@{ _G NJ1*-z:nƊo(.ID% !@Z@ ?/^FЙ -W9v=˖\$J40?;ܤ?ˣL!o/j"vsˢ_4Y.CHznAbԙFsNMhs<},rIڐj5eUF)Γ "ۙKS6Je@̖E IvE` }uOk.2`BEƐmjƶ}//ك:'@SY0ᣌLaAG}0@ũ՗ء5ӈzGB2:h1NFLxzc\w+m(Mjr\lv%,/P] r꛲Kdr3i{xQk(;-^Q+v)ZSM8*dc1\bCfPi|4£K`~!o. ?L= n݅!]7ƛ^=bvcšk3.1yS+'OL?Wzm_ǩTT2PH&5Yٵ@ i͇ ajHblIEqHH-츪 g%hMtP|Z6WRrCgsg2awP՟KVWUijËrLT<5Zi?5ѐ1z/Z$dÆh儨s͢9qSYF3{,B.G9FHS1Vn `_Lz3ҒPs| ΂Jz Ā{.=iX71djcY glZ4A;6@[;'&bbaڗ||U.[G6k@w2Z;IRd iwQFv :ǥ(E{n ;_:U-#P'h(M) $LIJwO )'$6cwpxNUݐ2cF./=/Cz. rHZazq%ʑi{nQpSR%{=^|\rsX@FAu}$qRzY vntυx*p{lS-g'a_+[g@ڋQ|5 #C BRF$wpKp% e^fU358҈1;kgHI`]DAJ)6-;flLM8*. ]0p r0␤vM\XHx}n2&Tk+T |`ⱎ0j!v7ˋ@y0 &`=O 3mVp,eVbCHp8">Ǜi9>?^> d#{*TC#p@k"xHԡsH٨cC[5{Ҏ?TJۏvžۿTS=_mҰY=8^ wB}RYK ~e6ʂqJr z*jWWj6w#vLPW~ݙ8r  <޿㐗($ϓĿm91 ۆ Ybe)#? mF'/ ;[g ݪoO=I",pF \n( KKI'DoHd[Cl#_t !o{-x|DJwB$Pc٢;{^9ߴ)'W~dY8vsE Բgqg:ŵB?p7߂.aSKe]qY QI%|e6#O{М q['_QKYHqzG`;A9!!aF2eR> `<.51%Nn6N 8M5 [T<}ViAF~ R |f):D.c,Nnk^ N0 XZȇRqБ7ɂ0gL =ç d!\oNUi"|g"y>S>%bϭJ o~>NYPqICI{OٜO AsR @DaR*r.Yj'oYVT-SU.\:Y섈vUZkP[+\pxd'nn~4(g}hWcNPE\& Np!ҟ!xVdd@kfνCX.+h+X[L5k$ɩ- -WBCҝ+-3#<9n1Is%}as' rn?SVzP m:f{4Ǜ؏]0A=z=v/F\ ecZ;5*plґeT yXj(\D'%s^kUn2QZsKe6k%x[øٗB)cuFyvxO!΀j#(L+8<(q1EYHm!.C`08k?K׹@GKma=KpYH9.˞gY`JGHV`.CGT@&d&yO5җb=df24x.82Rc_H0~ClHlI2Oh{#$[aITjԞx\y?[G 6&=j bCQ, 2X4Q&Nz0e\*! Q` usV`ۗKHoVOY>  pf֖[ PrHɝ6Xh{G7.f1!הVvdM^˅え ,[QGi5ZAh9TI<*ǖK J@C<@Zndgn#U2,9dl QfQq֚:],6w;=[@oY^5?Q:$ .Oe:#7!Ҹy%$Aݽ[ѸńBT%_:Rw ɻ4$=f׹ToKjJgd:uKsS,|v}E$s+" ! eBX"J?&tqOU#Kv ,%"a(~ ˆn7R' K襓2>U?]z6ĥ ;lˍüےi1R>{4a)YN]lJ?5v87H&khHVߴ=j,T_ƀWR$d20q,xXLZG ( <4#tEG1<-K(fJ)R&qK9wH 4Jx=GлUj"tJ孨r9#ƄO:4^r xs}-9Fxa:W6-mNCL})V&=ʞJ)~$] @K`VVZۥcc rТYpj"BҨ({w-ЃnZw:CIʁ1*LO!k̢ǫhCXVORJ$.1T>6Ę8w+N y4V_Rź02P=f& /s. sK5IFo1S{ktsR XL"!bș"[F Yӡu t~/si,&z6 G+χa߈NJf 'Aڶ; jֲ2 Fi)u\:: 7[R4񙴆_m -i J=g/Bۂx=p}3YBQ\Qު:'\8PQ2,,,X&\jmj_wd]ݺ=f0AW&-$zSQڥ0#%Icp$33{#5\r.BFW yj18+hi.kDQxU7ШT3 0A]ثR`Vr6֧m*NJ£mM򪿒``Y_H5.pbZiYD]2{zK~v~OLm֌xB~ jU mAiT[yD|߳#3 ᎗-Vm$PmŽ}e@kJfguP;KM-ݠm c2.!l$:o4F@&T8PRh"gE6l5XZ|Io%7@>^-L=̢{q13._ǧ\rkN&3$,_pYEdfL>=nߦUir;'`;(T }\M~ګpy6*/O0K万ZVb\&"/T՗oS4%u EgOkrʆ! ơ" $)hGRXsك3CfN:wBvU%M@Tdh}3^|U|毣c1s@y yv||s:%-Q޿ >6Þ猞 PAFh]\ůKP›uBҭ11 IF.Q˷0;^o5^73U+.ZBIgM$+ې9,åiۦ+:;-  шI /R|qyUh\!(6}c8UW^,Q2%fђmbJ&RvX8OYG҂+bc>]gRx)g5jGq %343 cP\y $+Qڍk R] %GKh9v@dBbvkRϾˣ`XELN4$Oc3^!E4ܽz5"F:'@sޢ9t  ΦU]Llt3̽٧&maXrO2ВIJ3:*xX`ѡ1i--YTbn'l`27ƙ7"Ho͎MfKHjL a=ͣkR >p"jE Ggbt/$ԙA =my.?SgRQSI sp!!.n헖lD-Y3uEP{-Kn u: Jc"f oك&D:́t'1d:&\}}jP %DݴwSΗ.*4z3@CV)bW-к>b MN%w'<_ v*2%pq I$j\9̫Os^~&8`bȮ9Mk5.1;[ImGwV\dnלOWidFvjFeF)߹V[ό;,%Pm67-88찳ìTFTj= w>ÉjF:lHX`*]i RἼ"\/j6.jiiX-'{v,MflѪũ†̸&?Y'3jql.ȟZ85B=Al@ +Z腝whU-ZFFPԲyQHg Cq{`c9z&L&?|ch70zݕF~To<إ2gb/POO2G}Qr9@.B/ر.Phkj0I&|Y6\9H1l Jot<{a4$& v#;/ <2U]xw^T ;8L򆊡Qc1SPbhu!NPMg 1M3YrFe+Y '{C cP(y7KfVf Egjv{l/jsQȼkz982h&ÅEN=h#ݠW։˒RN]a#X<0'S4'|+wkC%u^OF3S)wIE0?Dd~O˖ _~=4D@N}:ZẐ.E9 A6AE=E1$ Y*BP9Gw^oYAFzVS{ЭKeKߥ|O;7K%ij\?Y^]M[>=38eH)!L2K]5+U-濮Ջٖr5yrx]GwMԥcg;ݜn[n^/#v*%FC<uƐŵsa'󩆑9Ǣ\=.uji $DddvNQ?$i93?hA7IYUeУ3o;0¤~,W 0P•>krʜt$T(#ws~5FN^ƣ pSR>im S/(.){\kˏ-ڷpؔhCMByN#}21\c~q*xGy8Ld:7;V ƨAB& qMun8!lQqqMO*yD۽u-;E-6,m 7uG(UYņ-Ep-mBS{=gc)#~}oB6{]!B!vE&t|vuޥ;]˶F7LZ*|d;2rB d͗F.ՒJ0wg!eغT( s0,]Tf##@2J*{Z>NA˴m 7wԔ`҉]PML̝HU Wr[ߨE [6 x͍4^GF/M5+_I1UZN-dL:`q`QT*x5S^Pv߅,+֋GKRnj^؄Cp29cс}>ALdLBn:Iӱn:j( PMC y)8b[Ň P }Ug tF߶uHϰ\K ay0StVzgݒ2 Z8:L_99rk|.`5v}6?X5-#R w'!udq}uP"+!Sږe%'.bD5x3ʷ:YYYfSߘ2iI%lR  Q73MJqÁثp+NwhoԉTSiHMm ~ L=kV=Tios裁33XJhؗ,N :&OTdC~&xl3 E~>GN{-q0p~gHP_db$f7d ֫_ Ģ9ȥxT(/&W!{&[L sOsή}:G m=u =ͤwP? dO1e){8&y<Un?}ӄ|pmҞuxg]7cLKec$KTkZe<; t4s^vLlP'ygH߉IbfHN˟Ї;Hx$/@n/70Gi3qm`( Gy"/P":3 CUуO r<ԋG>jkSlYӉ*07,]mYߓ}SeA`/%~LTs1CgҗUSNTǓ,5C(4_"E>fV*àKi+ DrymꑌwDJ$l=еzx`Q}|m~>khT  F:;C:! ГW#h#^C}@QFEW".;ezfry FAH}ǧ3:{;=Ve7aނs̄ʜv4u?~:w\Ia9`v.捠 KuMpMSf+zV~}CyԳ|cy ȉ>#8A/Xl`;{@Cd_(Vv ת W!T ,a5/f<_YDF)5p7촂qy&DR;{:_,wQr `q#/f .^k`ǥz| x}TYHxS3&)!#uHo}3\?zE+: MV8Ak\o֬9x,ۼq/n1?֙EXuf!jhkX!#9ڝg|ed$9A7*@-^VU nųJ ̟̆]ak}xo9FXRmne.nЋ\쾃GVpv : fV(S,܀= 8 LjJ"qVӠ Đy;]RI|~ W9fP3DnE'Șg9uk5GkIs>!Ɏ@ p vS;i)+3썽pj9vH/ѣ(D{qnj憫bT3>tumi&Tz?BFa4 i12\}$f~RE_"~Ky0 y2gإ棘o)ſY,gX{0&CL78zbYE}o `Rpe$ 1%8uGD]:08>'R+T˺Nf% Ns8@IJVx‡=YBX'ݥQKՋvDx;8D4d.tBi-&g;F}Jup- d9!ؒh;J=VV -@nC߾9/G+[5 g߭P9ǡL2u=8m)C5-J5vAGF^4'7/QS8l8RM m V\>'G=U \rƂyMBv f܍rcdQ*q$E@,}SY 7ֶĽz %C^aPA*й G \ H0;yw"#*aYIJ9 M<-\D/Ӥ숞2z\o߿tG /"I zp}Ok'KtM8T-N-eix}< { :](X`A +WHE0N RUr