freeradius-server-utils-debuginfo-3.0.21-lp152.2.6.1 4>$  Ap`L縋/=„T}2B -$,ZXeLY"NLIiߋgJ#;-]@ց˨ln3r lR(/4w^U{O=<W=FQhȮ+1}#RɶhYP/ 3ɨ297de2b251ac93337aaf33d5c3b0b7a8d4eebbe4a2cfeccb83fee06a24a8ee653000e235793027596c5e22d4cf7153e63d525eaf`L縋/=„$Blq9M= ΢@|V$,uN)PxiQ"(Rk%ϊ|lkSw9K*BHYΞ rAhkx/*(9(8243w&P:$P4ǩxyCۼ"*>-ٚEUR8V'T>(;!@R1Ց;cǀL! ]N~˪iai>Z<ٞ5Br$F(| x>p@ ?") 5 k(,48KTs &`& & & & &  & & Z&  H&   {(8&9L&:&FG&H&I&XD Yp \&]&^?bcde!f$l&u8&v w&x&y8 z\lpfreeradius-server-utils-debuginfo3.0.21lp152.2.6.1Debug information for package freeradius-server-utilsThis package provides debug information for package freeradius-server-utils. Debug information is useful when developing applications that use this package or when debugging this package.`Llamb25 openSUSE Leap 15.2openSUSEGPL-2.0-only AND LGPL-2.1-onlyhttp://bugs.opensuse.orgDevelopment/Debughttp://www.freeradius.org/linuxx86_64&TMM!O#Q!OLK NUb8ej8`sZAAAAAAAAAAA큤`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`L`Ld7568c80b79f7f0623e54afcda0c2d8fa93f796d1de695e764b70626879cf0e05b742ff1d7836cd1375f2e9718f31350418d50e5a9753575b7550a5ad99fdd76f037dc4c589c89ed5fc2d4549544a871e839a33ed9ad81082574e2c3c84efb4f69b6649ad8dad0cff533fefa1dc5498253e9b35611ef4607ec21de37e387f2c64ef48c82682c252aa5be6c424d70cad82649262ea812cd797e650fd0850e0404288893b2719e655e707ceb50d58bef4bab207f1c469c6ec6e521060edc53b8a82bdd38363668787926541eb3d7703772eff9462c06215b43e740afd4f058a74604c7426ea41d5f893fdf6406c6a2b0853683179e643298a7e49aadfa301b74b4b40b505aea1286a6c4a1efe99047cd5207aef63bdc885efdc6e01303188dbcd9../../../../../usr/bin/rlm_ippool_tool../../../../../usr/lib/debug/usr/bin/rlm_ippool_tool-3.0.21-lp152.2.6.1.x86_64.debug../../../../../usr/bin/map_unit../../../../../usr/lib/debug/usr/bin/map_unit-3.0.21-lp152.2.6.1.x86_64.debug../../../../../usr/bin/radsniff../../../../../usr/lib/debug/usr/bin/radsniff-3.0.21-lp152.2.6.1.x86_64.debug../../../../../usr/bin/dhcpclient../../../../../usr/lib/debug/usr/bin/dhcpclient-3.0.21-lp152.2.6.1.x86_64.debug../../../../../usr/bin/radeapclient../../../../../usr/lib/debug/usr/bin/radeapclient-3.0.21-lp152.2.6.1.x86_64.debug../../../../../usr/bin/smbencrypt../../../../../usr/lib/debug/usr/bin/smbencrypt-3.0.21-lp152.2.6.1.x86_64.debug../../../../../usr/bin/radattr../../../../../usr/lib/debug/usr/bin/radattr-3.0.21-lp152.2.6.1.x86_64.debug../../../../../usr/bin/radwho../../../../../usr/lib/debug/usr/bin/radwho-3.0.21-lp152.2.6.1.x86_64.debug../../../../../usr/bin/radclient../../../../../usr/lib/debug/usr/bin/radclient-3.0.21-lp152.2.6.1.x86_64.debugrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootfreeradius-server-3.0.21-lp152.2.6.1.src.rpmdebuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)freeradius-server-utils-debuginfofreeradius-server-utils-debuginfo(x86-64)    freeradius-server-debuginfo(x86-64)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.21-lp152.2.6.13.0.4-14.6.0-14.0-15.2-14.14.1_@_FN^y@^p^h^@\\v{\u*@[<[2*ZZWQYY@YlY, @XO@X@X*Xh@X.@W@WiV@V.Vf@UĝU@U@UU8U7@TZ@TTT~@T|X@Adam Majer Adam Majer Adam Majer Adam Majer Adam Majer Johannes Engel Michael Ströder adam.majer@suse.deMichael Ströder adam.majer@suse.demichael@stroeder.commichael@stroeder.commichael@stroeder.comadam.majer@suse.devarkoly@suse.commichael@stroeder.comadam.majer@suse.demichael@stroeder.comkukuk@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demichael@stroeder.comjkeil@suse.demichael@stroeder.comjkeil@suse.dejkeil@suse.dejkeil@suse.demichael@stroeder.comvcizek@suse.commichael@stroeder.comtchvatal@suse.comvcizek@suse.comdimstar@opensuse.orgvcizek@suse.commeissner@suse.com- freeradius-server-radiusd-logrotate.patch: move logrotate options into specific parts for each log as "global" options will persist past and clobber global options in the main logrotate config (bsc#1180525)- freeradius-server-radiusd-logrotate.patch: fix permissions in logrotate global section (bsc#1170505, bsc#1174905)- update to 3.0.21 (jsc#SLE-11896) Feature Improvements * New stored procedure for allocating IPs with PostgreSQL Rates of 1500 IPs per second are now possible See raddb/mods-config/sql/ippool/postgresql/procedure.sql * Add SQL IP pool support for Microsoft SQL Server See raddb/mods-config/sql/ippool/mssql/ * Added RCNTEC dictionary. Closes #3168. * Added Pica8 dictionary. Closes #3179. * Add TLS-Client-Cert-Valid-Since attribute holding not Before date Patch from Boris Lytochkin. Fixes #3157. * Generate attributes containing unknown OIDs See raddb/sites-available/tls * Update the WiMAX dictionary. * Added ability to rlm_python(Python2) show a stacktrace from errors. #2979. * Add WiFi Alliance Policy OIDs. See raddb/certs/xpextensions * radmin now shows coa stats, too. * Sample schema extensions for summarizing data in SQL See mods-config/sql/main/*/process-radacct.sql * Update dictionary.aerohive, dictionary.fortinet, dictionary.arista and dictionary.erx. * Added VAS Experts dictionary. * Many updates to RPM and jenkins builds from Matthew Newton. * Added %C (time now in seconds) and %c (microsecond component of now) back-ported from the "master" branch. * Add reload capability to systemd unit file in Debian and RedHat. * Increase timestamp precision in postauth to maximum supported by each database and simplify (and make more consistent between drivers) the timestamps in SQL queries by using expansions. * Option to set dictionary path in raduat script. Bug Fixes * Various fixes found by PVS-Studio. * Set permissions of certificates in bootstrap shell script Fixes #3132. * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141. * Skip processing proxy reply if there are no home servers available. * Update SQLite IPPool queries. Fixes #3177 * rlm_sql_unixodbc fixes. Fixes #2822. * Fixes when building with LibreSSL. * Fix the rlm_python3 build. Note that this module is experimental. #3183. * The rlm_python should append the 'python_path' paths in 'sys.path'. It fixes the expected behavior to use the existing Python modules Fixes #3180. * Fix rlm_python to print the script errors properly. * Bound total query time for PostgreSQL. Fixes #3253. * Many fixes to Oracle sqlippool. It now does 500 IPs per second without any tuning. Fixes #3270. * Reference sqlippool by it's correct name. Fixes #3272. * Revert 3.0.20 patch which caused crashes on duplicate clients. * Update WiMAX-MSK attribute. Fixes #3280. * Fix crash when trying to access non-existant regex capture group. * Use timestamps (request or server) rather than SQL NOW() in accounting queries so that these are stable when replayed from a file buffer. - freeradius-python3_patches.patch: upstreamed- update to 3.0.20 (bsc#1146848) Feature Improvements * Added Force10 dictionary. * Update dictionary.hp with new attributes. #2690. * Update dictionary.aruba with new attributes. #2696. * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456) * Relax OpenSSL version checks, now that their API is both public, and stable. * Note that tls_min_version/tls_max_version also support "1.3" Since there is no standard yet for EAP with TLS 1.3, it will not work. * Added tripplite dictionary from #2760. * Switch to the async interface for rlm_sql_postgresql so that we can enforce query_timeout. * Added new LDAP option 'allow_dangling_group_ref'. * Updated documentation and functionality for EAP session caching See "cache" section of mods-available/eap. * Tighten systemd unit file security. Fixes #2637. * Disable TLS 1.0 and TLS 1.1 support in the default configuration We STRONGLY recommend doing this for all installations. * Add expansions for *outgoing* Radsec connections "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. Fixes #2839. * Add %{listen:tls} which returns "yes" or "no" for TLS or non-TLS connections. * Update dictionary.lancom with new attributes. #2847. * Added rlm_sql_mongo. See raddb/mods-available/sql. Note that this module is experimental. * Added more documentation in sites-available/robust-proxy-accounting. * sqlippool now re-allocates unexpired leases, to prevent IP pool exhaustion when clients perform multiple reauthentication attempts * Add support to radmin keep the history in ~/.radmin_history. * Add support for ENV and LD_PRELOAD in radiusd.conf. See the new ENV sub-section of radiusd.conf. * Update dictionary.aptilo. #3002. * Update dictionary.airespace. #3039. * Add sites-available/coa-relay, which makes CoA easier #3045. * Add example stored procedure for IP Pools in MySQL See mods-config/sql/ippool/mysql/procedure.sql * Update dictionary.dhcp dictionary with the recent hardware types. * Add experimental rlm_python3. This should largely work the same as rlm_python, which was Python2 only. * Add Dockerfiles for Debian10 and CentOS8. * Add RPM spec file compatibility for RHEL/CentOS 8. * Notes on certificate constraints. See raddb/certs/server.cnf. * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585. Bug Fixes * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627 * ERX-Acct-Request-Reason is "integer". Closes #2635. * Fix a slow memory leak in the file management code. * Try to fix file permissions if they get modified while the server is running * Fix slow memory leak with clients. * Fix request and connection timeouts in rlm_rest. * Fix systemd issues. * Fixes from clang analyzer. * Fix missing include for the dictionaries: alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn, audiocodes,avaya,bristol, columbia_university,freedhcp,garderos, infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus. * Fix internal sanity check when running with "-Xx". * Allow "inner-tunnel" virtual servers to work better with "accept" and "reject" policies. * Fix dictionary.huawei data types for Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address. * Framed-Interface-ID in postgresql/queries.conf is string, not inet Fixes #2817. * Fix rlm_cache to complain on unknown attributes in the "update" section of its configuration. * Add configure checks for -latomic. This helps on armel, mips and mipsel. Fixes #2828. * Add support to Oracle 19 and 18. Via #2857. * Add support for decoding tags in rlm_rest. Fixes #2848. * Use correct passwords when updating CRLs in raddb/certs/. * Properly separate "originate-coa" packets when accounting packets are read from the detail file reader. * Use the correct virtual server for pre/post-proxy. * radsqlrelay fixes backported from "master" branch * Fix DoS issues due to multithreaded BN_CTX access (bsc#1166847, CVE-2019-17185) - disable python2 for SLE15 and Factory - freeradius-server-enable-python3.patch: enable Python3 module - freeradius-python3_patches.patch: backport python3 fixes from upstream - freeradius-server-opensslversion.patch: updated- Enable memcached driver on SLE15- Add missing BuildRequire on samba-core-devel required for windbind support in rlm_mschap.- update to 3.0.19 (jira#SLE-5890) Feature improvements * Update dictionary.cisco * Update sqlippool to allow for stored procedures with PostgreSQL. This increases performance substantially. Patch from Nathan Ward. Fixes #2540. * Re-added "show client config" command to radmin. * Cleaned up mods-available/sql example so that it is easier to understand. * Added pfSense dictionary. Closes #2581 * Update dictionary.h3c Closes #2592 * Update elasticsearch/logstash config for v6.7.0. * EAP-PWD security fixes from Mathy Vanhoef. See http://freeradius.org/security/ (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664) Bug fixes * Update dynamic_client module and server core so that the functionality works. This has been broken since at least v2. * Fix crash in sqlippool due to escaping changes. Patch from Nathan Ward. Fixes #2532, #2533. * Fix systemd notify, watchdog and unit files. Fixes #2541, #2499. * Fix erroneous length check in EAP-FAST. * Update documentation to remove old "ignore_null" configuration. Fixes #2578. * Fix default POD port. Should be 3799. Fixes #2591 * Correctly encode vendor-specific "encrypted" attributes. Fixes #2600- reformat changelog mostly by wrapping lines - add missing bug numbers for security fixes- update to 3.0.18 * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss. * Do-Not-Respond policies can now be set in the "post-auth" section. * Encode / Decode ADSL Forum DHCP options. * Fix module ordering issues. e.g. when "sqlippool" needs "sql". See the "instantiate" section of radiusd.conf. * Add Big Switch dictionary. Fixes #2252. * Add sql_session_start policy (raddb/policy.d/accounting) This minimizes race conditions when using Simultaneous-Use (#2257). * For rlm_perl, all variables are now tainted by default. See raddb/mods-available/perl, and the "perl_flags" configuration item. This change should only affect people who are using variables in insecure ways. * Allow "sqlcounter" module to be listed in "post-auth". * Add support for IPv6 attributes in SQL. Fixes #2280 * The server is better at handling fail-over for outbound RadSec and TCP connections. Fixes #2284. * The server is now more aggressive about retrying failed outbound RadSec and TCP connections. Fixes #2284. * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list. * Add expansion for Radsec connections. "%{listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. * Add notes on running "ldapsearch" using the parameters from the LDAP module. * "ipaddr" attributes can now be cast to "integer" type attributes in an "update" section. * Move main thread queue to using atomic queues. This should help with contention in high load scenarios. * Add "recv_buff" setting to listeners. For more details, see sites-available/default. * The sqlippool module can now use attributes other than "Pool-Name" to assign IP pools. The "Pool-Name" attribute is still the default. * The "unpack" expansion can now unpack substrings. See mods-available/unpack for documentation and examples. * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE. * Allow for -LDAP-UserDN. See mods-available/ldap for more information. * Add sanitizing of control list for moonshot. Fixes #2318. * Update rlm_sql_mysql to be compatible with MySQL 8 Fixes https://bugs.launchpad.net/bugs/1795310. * Allow logging of only Access-Accept or Access-Reject messages See radiusd.conf, "auth_accept" and "auth_reject". * Removed Connect-Rate comparison. It was unused and broken. * Add dictionary.infinera. * Use OpenSSL HMAC functions instead of local ones. * Some SQL modules can now use "auto_escape" to escape unsafe strings See mods-config/sql/main/mysql/queries.conf. * Add wispr2date conversion in mods-available/date. * Implement dictionary-based handling in rlm_python. Fixes #2334 See mods-available/python for details. * Add support for SKIP LOCKED in sqlippool. This can improve performance by an order of magnitude or more. See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383 * Allow PSK and certificates at the same time Except for TLS 1.3 which does not support that. * Update docker scripts. Fixes #2306 Patch from Matthew Newton. * Add crypt xlat. * MySQL connections can now skip verifying the server certificate. Fixes #2481. See mods-available/sql. * Add better mechanism to detect MariaDB (Old MySQL). * Add RFC 7532 "bang path" support for realms Fixes #2492. * Update dictionary.ukerna documentation. Fixes #2493. * Add support for systemd service and watchdogs Fixes #2499. * Check for openss/rand.h, and allow building without OpenSSL engine. Patch from Eneas U de Queiroz Fixes #2517. * The default PosgtreSQL queries now use "ON CONFLICT" to better deal with issues. This requires PostgreSQL 9.5 or later. Please use a recent version of PostgreSQL, or edit the default queries to remove "ON CONFLICT". BUG FIXES * The session-state list is no longer cleaned in the inner-tunnel. This lets the outer Access-Reject section access session-state. * Fix typo in lock initialization for TLS sockets Found by Sergio NNX. * Add check for crash when home server down Fixes #2233. * Add username key for postauth table. * Better libpcap checks, when the header files or libraries are missing. Fixes #2245. * Allow building with old versions of OpenSSL Fixes #2247. * Allow non-FreeRADIUS State attributes to be used with the "session-state" list. i.e. State length != 16. * Be more aggressive about cleaning up zombie children when running in debug mode. * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries exporting LDAP API functions. * unlock files when asked to unlock them. * return error instead of asserting in map code. * Don't write 0 bytes to SSL. Fixes #2270. * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262. * Various dictionary cleanups and consistency checks Fixes #2281. * rlm_python has stronger thread locking to prevent reported issues. Performance may be affected. * Don't allow Message-Authenticator to overflow past the end of a large packet. * Fix crash in sqlippool when SQL server goes away Fixes #2300. * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303. * Fix crash with CoA packets/ Fixes #2304. * Fix crash in rlm_exec with CoA. Fixes #2328. * Print errors while parsing the log config, and don't quit when deprecated log settings are found. * Fix DHCP encoder xlat so that it can be used with a list of attributes. It previously only encoded the first member of the list, and now encodes all members. * The "expr" module now skips more whitespace. * Remove internal FreeRADIUS-Response-Delay attributes from attr_filter Access-Reject. * Don't send junk to redis when maximum args reached. * Small updates to IPv6 for accounting schema Fixes #2364. * Fix OpenDirectory integration in rlm_mschap. * Fix slow memory leak with dynamic clients. * Don't artificially truncate debug output for long strings. * Fix memory leak in EAP-PWD. * Fix crash in "hints" file with Fall-Through = yes. * Fix crash / timer issues with many CoA packets. * Fix attr_filter so that it does not treat vendor attributes of number 26 as Vendor-Specific. * Fix reconnect correctly in rlm_sql_mysql. * Fix rlm_cache to properly use Cache-TTL < 0 Fixes #2485. * Fix rare occurance of bad xlat expansion. * Check for rare race condition when a proxy reply arrives too late.- install license as %license instead of documentation- also fix ownership of /var/log/radius in systemd unit- update to 3.0.17 Feature Improvements * Add CURLOPT_CAINFO. Patch from Nicolas C #2167. * "stats home server" now supports "src IPADDR", to specify home server also by source IP. Fixes #2169. * Add Dockerfiles for a selection of common systems. * Increase number of permitted file descriptors, for systems with many home servers. * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs Patch from Isaac Boukris. Fixes #2205. * Update main READMEs. Patches from Matthew Newton. * Added dictionary.mimosa. Bug Fixes * Don't call post-proxy twice when proxying to a virtual server. Matthew Newton, #2161. * Use "raw" string value for shared secrets and dynamic clients It now parses strings with backslashes and "special characters" correctly. Fixes #2168. * Fix RuntimeDirectory for RedHat, from Alan Buxey. * Relax checks in 'if' parser from Isaac Bourkis. * Minor cleanups for %{debug_attr:&request} from Isaac Boukris. * Be more aggressive about cleaning up cached certificate attributes, due to deficiencies in OpenSSL. Reported by Nicolas Reich. * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall. * Fix double free in rlm_sql. Fixes #2180. * rlm_detail now writes empty Access-Accept packets. * rlm_python can now create tagged attributes. * Don't crash on duplicate realm + authhost / accthost * Allow partial certificate chain to trusted CA. Fixes #2162. * Treat SSL_read() returning zero as error. Fixes #2164. * detail writer now checks if the file was renamed or deleted. * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name. * RedHat Systemd updates. Fixes #2184. * Use correct API for State variable in rlm_securid. * Remove broken radclient option "-i". * Fix "users" file (and hints, etc). So that it does not get confused about entry ordering with multiple $INCLUDEs. * Fix rlm_sql to expand the un-escaped string, not the raw string. * Link default and inner-tunnel only if they exist. Fixes #2206. * Don't use both IP_PKTINFO and IP_SENDSRCADDR. * Always install signal handler for SIGINT (needed by Docker). * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs which are not self-signed will now be checked. * sqlippool now returns "fail" if it fails IP allocation. * Fix rlm_yubikey to look for correct attribute in replay attack check.- update to 3.0.16 Feature improvements * rlm_python now supports multiple lists. From #2031. * Add trust router re-keying. From #2007. * Add support for Samba / AD LDAP schema. See doc/schemas/ldap/samba/README.txt and doc/schemas/ldap/samba/ * Add "tls_min_version" and "tls_max_version" to EAP module for Debian OpenSSL issues. * Better documentation for client certificates in PEAP and TTLS: it usually doesn't work. Fixes #2068. * Distinguish login failure from AD unavailable. Fixes #2069. * Update RH spec files. Fixes #2070. * Run Post-Proxy-Type if all home servers are dead. Fixes #2072. * Print offending IP addresses when EAP sessions come from two upstream home servers, and rate-limit the messages. * Minor packaging updates. * Better documentation for rlm_rest. * EAP-FAST now has it's own "cipher_list", so that it is easier to configure. * EAP-FAST now forcibly disables TLS1.2, until such time as we implement the new keying mechanism from TLS1.2. * Add documentation for allow_expired_crl. * Update Debian logrotation. #2093 and #2101. * DHCP relay can now drop responses. #2095. * rlm_sqlippool can now assign Delegated-IPv6-Prefix. It also now can assign any IPv4 or IPv6 address. Based on patches from maximumG. #2094. See raddb/mods-available/sqlippool for changes. * radeapclient can now use EAP-SIM-Ki to dynamically create the necessary triplets. * Explain why many LDAP connections are closed. Fixes #1969. * Debian build / package issues fixed by Matthew Newton. * dictionary.patton updates from Brice Schaffner. Fixes #2137. * Added scripts to build "inner-server.pem", and updated mods-config/inner-eap and certs/README to match. * Added provisions for using an external CA. See raddb/certs/ * Include dhcpclient binary in freeradius-dhcp debian packge. Bug fixes * Bind the lifetime of program name and python path to the module FR-AD-002 (redone) * Pass correct statement length into sqlite3_prepare[_v2] FR-AD-003 (redone) * Allow 100-Continue responses with additional headers in rlm_rest. * fix corner case where detail files were not being locked correctly. * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group. Fixes #1947 * Clean up exfile code. Which should help to avoid issues with reading / writing 100's of detail files. * Fix build for winbind. Patch from Alex Clouter. * Fix checkrad for Mikrotik. Patch from Muchael Ducharme. * Fix home server stats lookup. Patch from Phil Mayers. * Add libjson-c3 as an optional dependency. * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking against NSS, which breaks the server. Fixes #2040. * rlm_python fixes. Fixes #2041 * Typos in "man" pages. Fixes #2045 * Expand "next" in %{%{...}:-%{...}}. Fixes #2048 * Don't add TLS attributes twice. Fixes #2050. * Fix memory allocation in rlm_rest. Fixes #2051. * Update trustrouter for new API. Fixes #2059. * Fix SQLite issues on FreeBSD. Fixes #2060 * Don't do debug logging of bad passwords. Fixes #2064. (bsc#1099802) * More graceful handling of "die" in rlm_perl. Fixes #2073. * Fix occasional crash when using cisco_accounting_username_bug = yes * EAP-FAST fixes from Isaac Boukris. [#2078], #2076, and #2082, #2126. * DHCP fixes, relay, #2092, add run-time check, #2028 * Decode multiple RADIUS packets at a time in highly loaded RadSec connections. Patch from Jan Tomasek. #2106. * TunnelPassword is not "single value" in LDAP schema. Fixes #2061. * sql log now opens the expanded filename, not the input one. This was a regression introduced in 3.0.15. * Remove unnecessary UNIQUE constrain in Oracle schemas. * Fix SSL thread and locking issues when modules also use SSL. Fixes #2125 and #2129. * Re-add dhcpclient "raw packet" changes. Patches from Nicolas Chaigne and Matthew Newton. Fixes #2155.- Fix permissions of radiusd.service (bnc#1053654)- bsc#1055679 - freeradius-server does not provide winbind/AD auth Added libwbclient-devel as buildrequires- update to 3.0.15 with security fixes for issues found via fuzzing by Guido Vranken (bsc#1049086) https://freeradius.org/security/fuzzer-2017.html * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret() * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63 * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax() * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp() * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions() * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly * FR-AD-002 (v3) String lifetime issues in rlm_python * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare- update to 3.0.14 (still FATE#322416) Feature improvements * Enforce TLS client certificate expiration on session resumption, and Session-Timeout. See CVE-2017-9148 (bnc#1041445) * Updated dictionary.cisco.vpn3000, dictionary.patton * Added dictionary.dellemc * Lowered the log output for failed PEAP sessions. * ALlow utc in rlm_date. * The internal OpenSSL session cache has been disabled. Please see mods-available/eap * Update detail reader documentation. * Make outgoing RadSec connections non-blocking. * Add SQL backing to Moonshot-*-TargetedId generation. Bug Fixes * radtest uses Cleartext-Password for EAP, not User-Password. * Update documentation for mods-enabled/ linking. * Enhanced checks for moonshot salt. * Allow session resumption for RadSec connections. * Update "huntgroups" file to note that port ranges are not supported * Fix OpenSSL permissions issues on default key files. * Certificates are not required when PSK is used. * Allow SubjectAltName as first extension in cert. * Fixed talloc issue with TLS session resumption. * "&Attr-26 := 0x01" now produces useful error messages. * Handle connection error in rlm_ldap_cacheable_groupobj. * Fix endian issues in DHCP. * Multiple minor fixes for Coverity complaints. * Handle unexpected regex. * Fix minor issues in dictionaries. * Fix typos and grammar. Patches from Alan Buxey. * Fix erroneous VP creation in rlm_preproces. * Fix MIB. Patch from Jeff Gehlbach. * Trust router updates from Alejandro Perez. * Allow build with LibreSSL. * Use correct packet for channel bindings. * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us a test license. Please see the git commit history for more info. * Fix incorrect length check in EAP-PWD. This may be exploitable. * Stop rotating session database files (radutmp, radwtmp) since these are not logfiles. - freeradius-server-radiusd-logrotate.patch: updated- removed obsolete freeradius-server-fix-cert-bootstrap.patch because recent /etc/raddb/certs/bootstrap simply works - update to 3.0.13 (still FATE#322416) Feature improvements * Add dictionary.rfc7930. Note that we do not implement the RFC. * Added 'cipher_server_preference' to mods-available/eap Patch from #1797. * OpenSSL 1.1.0 compatibility fixes. * rlm_perl: radiusd::xlat to evaluate xlat string within perl script * Allow authentication retry in winbind. Patch from Herwin Weststrate. See raddb/mods-available/mschap. * Added "recv-coa" method to rlm_rest. It behaves the same as "authorize". * Document Trust Router tr_port option. Patch from Stefan Paetow. * Update elasticsearch/logstash examples so that they work with elastic stack v5. Patch from Matthew Newton. * Print information about packets, replies, and contents in the detail file reader. * Update abfab-tr policy. Pull request #1893 from Stefan Paetow. * Reject packets which contain User-Password and EAP-Message. * Add example for filtering Access-Challenge. See sites-enabled/default. * Pull symlink fixes from v4.0.x. Fixes #1859. * Add systemd reload. Not everything is reloaded, but some is. Fixes #1662. * Better documentation for listen "ipaddr". Fixes #1921 * Add dictionary.cnergee, updated dictionary.nomadix. * radclient no longer needs -x to print statistics with -s. Bug fixes * Minor typos. Fixes #1763 * Fix typo in RPM build. Closes #1767. * rlm_mschap check for password expiry only if password was correct. Fixes #1762. * Update debian build. * update rlm_counter "man" page. Fixes #1775. * Remove erroneous assert. Fixes #1778. * fix mschap password change test. Fixes #1792. * Cleanup config file on data remove. Fixes #1795. * passwd module returns "notfound" if not found. * Check for old OpenSSL, and don't build rlm_eap_fast if it necessary. Fixes #1803 * Cleanup memory better after ldap version query. Patch from Aleksey Katargin. * Rename lt_* functions to avoid linker issues with libtool. Fixes #1277 * Many miscellaneous fixes and typos. * Allow long strings in %{%{foo} bar:-%{baz} blah". Fixes #1866 * Fix filtering operators, along with more documentation and more tests for them. * Fix OpenSSL fixes. Fixes #1876. * Finish SQL select queries even when SELECT returns no rows. Fixes #1879. * Set Module-Failure-Message for more EAP errors. * Correct typo in dictionary.rfc5580. Fixes #1882 * Remove obselete systemd syslog.target. * Client-Port-Balance load-balancing now uses client port. * Radrelay examples fixed from Alex Clouter. * Update systemd target. Pull request #1896. * Trim starting whitespace in xlat strings. * Get MySQL result lengths using normal API. * suid down after fchown(). Fixes #1914. * Fix cases of comparing pointer to NUL character. Fixes #1915. * OpenSSL v1.1 fixes. Pull request #1921. * Better Handle v4/v6 host names. Pull request #1919. * Remove "Auth-Type = System" from docs and examples. * Don't crash on malformed %{home_server}. Fixes #1922 * fix erroneous use of talloc destructor in rlm_eap * Issue trigger modules.sql.fail. Fixes #1923 * Document python_path gotcha's. Fixes #1845 * dlopen() the specific version of Python. Fixes #1592- Don't require insserv if we use systemd - Remove require for unused fillup- Merge changes from SLE to openSUSE (FATE#322416): * freeradius-server-radclient-init-error-buffer.patch - make sure we initialize error buffer. bsc#911886: radclient error free() invalid pointer * freeradius-server-opensslversion.patch: remove OpenSSL version check and assume we know what we are doing. (bnc#1013311) * merge .changes file, mostly. - do not attempt to detect "vulnerable" OpenSSL versions. SUSE security fixes do not necessarily bump version numbers as does upstream OpenSSL (bnc#1021375) - do not generate certificates in %post. End-user needs to do this manually. - keep FreeTDS disabled on SLE12 - we never shipped it enabled - require OpenSSL 1.0+ - use pkgconfig(systemd) instead of plain systemd as BuildRequires - don't list manual pages as %doc- Remove --with-pic which is for static libs only. - Use SUSE RPM group names. Trim filler words from description. - Do not hide errors from groupadd/useradd.- Add upstream keyring - 2 new modules: rlm_sql_freetds and rlm_eap_fast- update to 3.0.12 - still fate#320481 The focus of this release is stability. * Feature improvements + Add support for =~ and !~ in update sections. See "man unlang" + Add dictionary.checkpoint. + Simultaneous-Use prints out more information. + Print WARNING in debug mode when packets may be truncated. + Added expansions %{home_server:state} and %{home_server_pool:state}, which show the state of the server / pool. + Mark rlm_sql_freetds as stable. + Make rlm_perl less fragile. Patch from Herwin Weststrate. + Allow extended attributes to have "encrypt=2" + Update dictionary.aruba. + Add support for EAP-FAST. This is an isolated feature which does not affect anything else. + Update OpenSSL vulnerability list. Use a version of OpenSSL released after September 20, 2016. + EAP certificate verification is now done when "verify" is enabled and "ocsp" is disabled. + New dhcpclient and rlm_rad_counter man pages. + Minor abfab and moonshot additions. + Pass CFLAGS through from environment in RPM builds. Allows more custom builds. + Build with Heimdal in addtion to libkrb5. * Bug Fixes + Use correct typedef for older versions of sqlite. + Update mssql schema to add priority + don't complain on /dev/urandom in ldap + fix == operator in update sections + Don't create DHCP strings with many trailing zeros. + Allow MS-CHAP change passwords instead of complaining on large buffer. + Allow assignment or equality operator on SQL. + Update aclocal tests for FreeBSD 10. + Remove occasional hang in rlm_linelog. + Copy VSAs to inner tunnel for TTLS and PEAP. Fixes #1544 + A few minor bugfixes caught in v3.1.x cleanup, and back-ported to v3.0.x. + do_not_respond again works in post-proxy + Allow realm "~^.*$" {} and User-Name with no realm. + Fix leak when creating unknown attributes + Fix Debian / logrotate. + Make OpenSSL error functions thread-safe. + Fix crash with rlm_sql and updating SQL-User-Name. + Debian build updates. + Allow regular expression comparisons in radclient. + Fix memory leak on unknown attributes in detail file reader. + Update example paths in "man" pages when installing them + Build fixes for rlm_mschap. Fixes #1489. + BSD build fixes. Patch from issue #1583. + Be more careful about /lib/ when building. Fixes #1585. + Correct ifdef placement error. Fixes #1572. + Allow for more files in internal "exfile" API So it will be possible to open more than 64 "detail" files at the same time. + Remove support for statically built EAP modules. Fixes #1591. + Many fixes to rlm_python from Guillaume Pannatier. + Use correct week adjustment in SQLcounter. Fixes #1608 + Minor fixes to allow compilation without DHCP, VMPS, or TCP. + Fix checks for module / config file change on HUP. + Compile regex comparisons when sent via "debug condition". + Update filenames in documentation and examples. + Don't crash if SQL connection becomes unavailable. + Disallow originate_coa when proxy_requests = no. + Free rad_perlconf_hv in correct perl context. + Multiple fixes for Debian builds. #1510, among others. + Set OpenSSL FIPS compatibility flag when necessary. + Pulled fixes for the build system over from other branches. + Fix OCSP for RADIUS over TLS. + Fix skip_if_ocsp_ok behavior. + Better fixes for systems without closefrom() but which have /proc. + Minor build fixes back-ported from v4.0.x. + build --whout-ascend-binary. Fixes #1761. + Be more aggressive about not opening new connections in debug mode after CTRL-C. Address #1604.- use %{with} macro for conditional inclusions instead of hardcoding version numbers - improved package descriptions - fixed builds on SLE12 and SLE11SP4- removed installation of experimental module rlm_sqlhpwippool.so - update to 3.0.11 (fate#320481, bsc#961479, CVE-2015-8763, bsc#935573, CVE-2015-4680) * Changes of version 3.0.11 + Feature improvements - "unlang" comparisons of IP addresses to IP prefixes are now detected, and types automatically cast. - Allow shorthand form of ipv4prefix values e.g. 127/8. - Add "auto_chain" to raddb/mods-available/eap, tls subsection. This allows the disabling of OpenSSL auto-chaining of certificates. Which might be wrong. - Added printing of coa and disconnect stats (radmin). - radclient defaults to expecting Access-Accept responses to Status-Server. - Updated dictionary.lancom, dictionary.starent. - Portability fixes for Solaris. - More errors from ntlm_auth gets passed to MS-CHAP. - Update abfab-tr-idp virtual server. - Added "filter_password" in policy.d/filter. This removes embedded zero bytes in User-Password, for compatibility with broken clients. - The server now issues a WARNING message if duplicate configuration items are found. - TLS can skip the "verify" section if OCSP returns OK. See raddb/mods-available/eap, "skip_if_ocsp_ok". - Set TLS-OCSP-Cert-Valid = yes / no / skipped, which is the result from the OCSP check. - Interoperate with AD and "LmCompatibiltyLevel = 5", by always setting WBC_MSV1_0_ALLOW_MSVCHAPV2 for native winbind in rlm_mschap. - TTLS and PEAP now require "virtual_server" to be a real server. - Print WARNING when TTLS or PEAP identities are spoofed or not properly anonymized. See RFC 7542 for requirements. - Various rlm_python fixes from Herwin Weststrate. - Allow setting Response-Packet-Type in "Post-Proxy-Type Fail", which is useful when the home server does not respond. - elasticsearch updates from Matthew Newton + Bug Fixes - Fix issue where field nas_type would not be accessible via the %{client:} xlat, for clients loaded from SQL. - Fix compatiblity issues with OpenSSL 1.0.2. Ignore calls to msg_callback with 'pseudo' content types. - Data type "ipv4prefix" is parsed correctly. - Use correct talloc context in rlm_exec. Fixes #1338. - Complain in unlang if "else" is used with no previous "if" or "elsif". - Send accounting status packets to the accounting port. Fixes #1364. - Print out CFLAGS when doing "radiusd -Xxv" - Fixed bug with coa/acct stats value #1339. Based on patch from Jorge Pereira. - Fixes for LEAP proxying. Don't use LEAP! - Fix issue with "directory already exists" seen when doing "make install". - Fixed bug with radmin related to the option "stats detail " - Complain if the detail file reader does not have permission to read the "detail.work" file. Fixes #1398 - Fixed SoH. Attributes were not being copied to the virtual server. - Used a wrong list to global statistics in "stats". - Create EAP-PWD identity correctly. Prevents segfaults. - Dynamically validate authentication types for PEAP and EAP-MSCHAPv2. - Fix includes in installed headers. - OpenSSL 1.0.1f and 1.0.1g do NOT calculate TLS 1.2 keys correctly. See raddb/mods-available/eap, "disable_tlsv1_2" - Allow password change to work for MS-CHAP. This requires 'r=0', because password changes are not retries. - Fix home server fail-over for home servers using TCP and/or RadSec. - Special characters in expanded regexes are now escaped e.g. User-Name containing '.', and comparing /%{User-Name}/, the '.' will now be escaped. See src/tests/keywords/regex-escape. - Use correct authentication vector when sending Access-Reject replies for RadSec. - Set FreeRADIUS-Proxied-To in TTLS again. You should use the "inner-tunnel" virtual server, instead of relying on this attribute. - Fix debugging constants in rlm_perl. Patch from Herwin Weststrate. - Add samba-dev / samba4-dev to debian builds so that rlm_mschap can automatically use the new winbind API. - Automatically skip zero-length attributes when sending packets, instead of erroring out.- fix bsc#951404 * Rebuild of freeradius-server package fails * fix source url - ftp://ftp.freeradius.org/pub/freeradius/ + ftp://ftp.freeradius.org/pub/freeradius/old/- update to 3.0.10 * Changes of version 3.0.10 + Feature improvements - Do more optimization of unlang policies. This makes run-time a bit faster. - Re-name most of the functions in src/lib. Third-party module authors will have to do the same. - More documentation on contributing and how to write modules. - Update radiusd.service for systemd. - Open IPv6 proxy socket if the server is listening on IPV6 auth / acct / coa packets. - Create debian packages for DHCP. Fixes #1125. - Add more tests for "update" section parsing. - Update "man" pages. - Update attributes for Alcatel 7750 - Add dictionary for Boingo Wi-Fi - Add support for DHCP lease queries. See raddb/sites-available/dhcp - On HUP, check all modules for config files which have changed. And only re-load those modules. - Allow FreeRADIUS-Response-Delay(-USec) to be set for RADIUS packets. Patch from Herwin Weststrate. - Documentation fixes from Alan Buxey and Matthew Newton. - Update "logrotate" script. - Added more RFCs to doc/rfc for new standards implemented by FreeRADIUS. - Don't crash when doing "radmin -e "help hup". Patch from Matthew Newton. - The dictionary parser now does more sanity checks, which prevents run-time problems with invalid attributes. - Update debian packages. Patches from Christopher Hoskin. - Many other debian packaging fixes from Matthew Netwon and Herwin Weststrate. - Add "session-state" to Perl. Patch from Herwin Weststrate. + Bug Fixes - Fix rlm_files so that there are no collisions when loading 10's of 1000's of users. - Fix radclient to use our internal v4/v6 parsing functions. v6 addresses with ports now work correctly. - Fix sending/receiving packet messages to wrap v6 addresses in square brackets '[]'. - Check for sasl/sasl.h when building rlm_ldap, and disable SASL functionality if unavailable. - Fix issue which caused a non \0 terminated buffer to be assigned to attributes if the value being assigned contained an invalid escape sequence. - Fix deadlock when reconnecting connections in the connection pool. - Fix potential overrun in functions that used fr_utf8_char with a non nul terminated buffer. - Fix decoding issue for Tunnel-Password type attributes which were very long. Found by Denis Andzakovic. - Fix radclient issue with TCP sockets on FreeBSD. - The server now creates ${run_dir} and ${logdir} directories in daemon mode, when running as "root". - Handle tags when using maps. Fixes #1191. - Fix crash when CoA packets time out. - Fix parse error in rediswho - Fix regex support in SQL radcheck the "users" file and radsniff. - Register listen xlat earlier, so that it's available when the virtual servers are being parsed. - Parse Ascend-Data-Filter when given as "0x..." - Print Ascend-Data-Filter correctly. Add test cases for both. - Allow old-style clients again. They will be disallowed for 3.1.0 and following. - Complain instead of crash when "else" and "elsif" are in the wrong place. - Clean up memory more aggressively. This lowers the maximum memory used, most typically for TLS based EAP methods. - Prevent the server from unlinking the control socket of an already running instance. - Fallback to using the configured OCSP URL if one exists, and no URL is provided in the certificate. - Return CoA-NAK if proxying CoA fails. Based on patch from Jorge Pereira. - Lower peak memory usage by decreasing size of internal memory pools. - The control socket is now left in place if a second copy of the server is accidentally started. - Allow virtual attributes in "switch", "case", etc. Fixes [#1240] and #1265. - Many spell check / typo fixes in comments and example configuration files. - Better handle multiple DHCP listeners. - Don't print secrets for old-style realms. Fixes #1267. - Don't fall through in empty "case" statements. Fixes #1274. - Update EAP-TTLS so that MPPE keys are correctly calculated with TLSv1.2. - Always delete MS-MPPE-* from the TTLS inner tunnel. This allows TTLS / EAP-MSCHAPv2 to work. Fixes #1206. - Fix off by one error that caused some MSCHAP-Error messages to be sent without the password change version (V=3) and the textual message component (M=). - Always include C= V= and M= in MSCHAPv2 errors. RFC 2759 does not say that any of these fields are optional, and not including V= caused errors with wpa_supplicant. - Do not include M= in MSCHAPv1 errors. It's not supported.- Fix boo#912714: freeradius can't use ntlm_auth * Create winbind group * Add radiusd to winbind group- Remove gpg signature file * The gpg signature checking is broken and doesn't work- Fix bsc#935573: Insufficent CRL application for intermediate certificates * CVE-2015-4680 * freeradius-server-CVE-2015-4680.patch based on https://github.com/FreeRADIUS/freeradius-server/commit/a03814af310bb3bee74ea012546d99c48b0ea5c3- update to 3.0.9 * Changes of version 3.0.9 + Feature improvements - Make "pool" configurations more consistent, and update documentation for them. - Move connection pool logic to "most recently started", instead of MRU. This should help with pool stability. - More VSAs for 3GPP2 - Added examples of multi-value attributes to rlm_perl. - LDAP-Group and SQL-Group attributes are now dynamically allocated. - Only the "sql" module registers SQL-Group. Other instances register "instance-name-SQL-Group", similarly to "ldap". - Unknown attributes are now complained about more often when used in unlang statements. e.g. if (Foo-Bar == 3) used to be a string to string comparison. It is now a parse error. - Rename RLM_COMPONENT_* to MOD_* in the code. This makes many things easier. - Move to C99 initializers for modules. - Load modules in raddb/mods-enabled. This allows attributes like "LDAP-Group" to be used in the "files" module, without explicit ordering or listing in "instantiate". - Added 'bootstrap' section to modules. Third-party modules will need to be updated. - When adding clients from a DB, add them to a virtual server if that virtual server has a "listen" section. Otherwise, add the clients to the global list. - When reading dynamic clients from a file, don't expire them if the underlying file is unchanged. - Allow the server to originate CoA requests from the post-auth stage. - The server creates ${run_dir} and ${logdir} in daemon mode, if they do not already exist. - Add dictionary for Wi-Fi Alliance Hotspot 2.0. The server now supports all mandatory and optional attributes for this specification. - HUP now re-loads the configuration only if the files have changed. If all files are unchanged, HUP re-opens the log file, and does nothing else. - Much better debug messages for EAP-TLS, including which attributes are cached, and when they are retrieved. - Increase default max_requests to 16384. Memory is cheap now. - Added "stats memory" commands to radmin. Debug build only. - Aptilo controller dictionary updates. - SQL modules now use Acct-Unique-Session-Id everywhere. - The redis modules are now stable. - The LDAP module now supports SASL "interactive bind" method. This allows Kerberos based administrator and user binds. - DHCP code is now in libfreeradius-dhcp. - More DHCP encoding / decoding unit tests. - rlm_replicate can now be listed in the "accounting" section. - Better sqlite debugging output. - Remove "required" option from many sql_ippool directives. - Set default CA "basic constraints" to "critical". Fixes #1073 - Updates to help / man pages from Jorge Pereira. - Added more tests. + Bug Fixes - Be more careful about unused config item warnings when using -Xx. - Move more defines to be auto-generated. - Allow virtual servers in proxy fallback. - Allow %{module:} to work. - Don't crash in RadSec. Closes #980. - Return better errors when a unix group / user is not found. - Re-enable detail module "locking" parameter. - Don't crash when logging replies from Status-Server packets. - The couchbase module now uses "update" instead of "map", for consistent with the rest of the server. See raddb/mods-available/couchbase - Don't require NT-Password for MS-CHAP password changes. - Be a bit more careful about decrypting MS-CHAP-MPPE-Key attributes. Closes #1013. There is no perfect fix, tho. - Fix security issues with EAP-PWD. See http://freeradius.org/security.html#eap-pwd-2015 - Fix dynamic clients read from SQL in non-debug mode - MS-CHAP now allows retries (i.e. password change) when passwords are expired. - Allow "user=radiusd" when the server is already user "radiusd" - suid up/down works on non-Linux systems. This means that the control socket should have the correct ownership. - Fix issue which caused the server to sometimes have problems when a home server was marked zombie. - Fix format.pl because Perl is now more picky. - Fix proxy to Packet-Dst-IP-Address, so that it uses the correct destination port. - Fix corner case with cursor functions and removal. - OpenDirectory fixes and documentation. - Fix leaks in rlm_redis. - RFC 6929 "evs" attributes are now encoded / decoded properly. - Fix talloc pool leaks when receiving malformed or retransmitted Accounting/CoA requests. - Printed attributes again use double quotes instead of single quotes. - Set X509_V_FLAG_CRL_CHECK_ALL, and add "check_all_crl" to eap.conf. Fixes oCert CVE-2015-4680. - rlm_expr now errors out correctly on malformed attribute references instead of triggering an assert. - Make "break" work in "foreach" loops - Allow dynamic expansions to work again in the "hints" file. - Correct minor typos in comments and examples from Alan Buxy. - Re-urlencode the path portion of ldapi:// urls before passing it to ldap_initialise. - freeradius-server-rlm_sql_unixodbc-configure.patch removes hard-coded directory in configure script of rlm_sql_unixodbc - install new module rlm_sqlhpwippool.so- minor adjustments/cleanup of spec and changes- update to 3.0.8 * Changes of version 3.0.8 + Feature improvements - Allow syslog_severity to be set in rlm_linelog. - Allow defaults to be set for bulk clients in LDAP and couchbase. - Updates to dhcpclient. Patches from Nicolas C. - rlm_mschap now supports direct connections to winbind, which is faster than ntlm_auth. See raddb/mods-available/mschap. Patch from Matthew Newton. - Recommend /dev/urandom for TLS randomness, instead of ${certdir}/random - Allow TLSv1 to be disabled via "disable_tlsv1" in tls{}. - Allow Expanded EAP types where vendor is 0 (IETF) and type is normal EAP type. Supplicants sending Expanded EAP types like this are broken. - Add support for server side sort controls when searching for user objects in rlm_ldap. + Bug Fixes - Don't complain about "authorize" in "server {}" blocks, but only if there's no "server" block. - Fix cosmetic issue where debug from the first packet read by a detail reader thread would be emited during config parsing. - Fix ASSERT on truncated detail packets. - Don't use main server log functions from within panic_action, as in the case of syslog this would cause deadlocks if the fault was triggered from within a malloc. - Fix issue in "switch" when "correct_escapes = false". Fixes #911. - Fix sqlcounter configuration to use "%%b" instead of "%b", otherwise the new syntax validation will fail. - Allow forward references in configuration items. Modules aren't always loaded in a sane order. - Fix more escaping issues. Closes #912. - Decode MAC addresses correctly for VMPS. - Fix memory leak with TLS connections. - Fix state machine threading issues for conflicting packets. - Fix copy_request_to_tunnel issues for tagged attributes. - Allow "ok" to over-ride "updated" inside of Auth-Type sections. - Update state machine so that post-proxy is run though child threads for performance, instead of blocking the main thread. - Allow "netmask" to work again in client definitions. - Relax restrictions on SQL group queries. - track outgoing proxy sockets and clean them up more aggressively. - track proxy statistics, including CoA and Disconnect. - If radmin has a connection failure when running a command, it re-connects and runs the command again. - mark home servers "unknown" less aggressively. - Fix potential SEGV in PostgreSQL driver on error. - Fix issue where fields like nas_type would not be accessible via the %{client:} xlat, for dynamic clients. - Set default busy_timeout (of 200ms) in the sqlite driver, so writes don't cause selects to fail in multithreaded mode. This is user configurable, and may be increased if required. - Convert Password-With-Header attributes to binary (from hex or base64), in the authorize method of rlm_pap. - Fix invalid assert in state.c, that could cause abort in post-auth. - Fix double free when -m flag is used, and connection pools are referenced by multiple modules. - RADIUS over TLS accounting uses the same port as authentication. - Regularized return codes from radmin commands. - Fix RHEL spec file so it works correctly for Centos7 which uses systemd, and didn't like the SystemV init script. - radwho and radlast now have a -D option to load dictionaries - DHCP packets are no longer checked for duplicates. - Don't crash in sql module group comparisons in corner case. - Calculate MPPE keys correctly when using TLS 1.2. - Fix load-balance sections. Closes #945 - TLS certificates are available again in the post-auth section. They are not available for session resumption. - radclient encodes CHAP-Password properly when using -c Closes #955. - Fix issue in rlm_cache_memcached driver that caused variable length values to be truncated. - Fix track functionality in detail reader, so it no longer fails with a "Failed marking detail request as done: Bad file descriptor" error. - Actually add the peer identity (as User-Name) to the inner tunnel in EAP-PWD requests, so it's available for lookups. - Fixes to PostgreSQL queries. Patches from Santiago Gimeno. - new set of consolidated patch files: deleted: * freeradius-server-2.1.1-logrotate_su.patch * freeradius-server-2.1.6-rcradiusd.patch * freeradius-server-initscript-pidfile.patch * freeradius-server-radius-reload-logrotate.patch * freeradius-server-var_run.patch added: * freeradius-server-radiusd-logrotate.patch * freeradius-server-rcradiusd.patch * freeradius-server-tmpfiles.patch- Do not disable as-needed build - Remove the with_sysconfig switch and just stick with versions- update to 3.0.6 - fixes a segmentation fault in PEAP module (bnc#912588) Feature improvements: * radmin / raddebug conditional errors are printed to the output, instead of being discarded. * raddebug will exit if condition set with -c was invalid. * radmin auto-reconnects if the connection to the server has gone away. * rlm_cache now has submodule support. See raddb/mods-available/cache * New memcached driver for rlm_cache. See raddb/mods-available/cache * Add support for &Attribute-Name[*] in conditions. See "man unlang" for details. * Add &Attribute-Name[n] which gets the last instance of an attribute e.g. Module-Failure-Message[n]. * Allow for redundant string expansions. See the "instantiate" section of radiusd.conf. * When checking IP addresses in conditions, make the right side be parsed as an IP prefix. * Support JIT compilation of compiled regular expressions when built with libpcre. * Support named capture groups with "%{regex:}" when built with libpcre. * Increase regular expression capture groups from 8 to 32. * Emit error markers for badly formed regular expressions. * Allow 'm' flag to enable multiline mode in regular expressions. * Support limited implicit attribute conversion in update sections. * Support casting between IPv6 and IPv4 where the IPv6 address has the v4/v6 mapping prefix (::ffff:).- Drop .keyring and .sig file: freeradius-server still uses MD5 signatures, which are no longer validated/accepted by GPG 2.1.- update to 3.0.5 Some of the new features: * Allow LDAP to specify arbitrary attributes for dynamic clients. * Allow one level of backslashes (finally). See radiusd.conf, "correct_escapes" setting. * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. * Allow multiple new connections to be spawned simultaneously in the connection pool, to cope with spikes in traffic. * Use kqueue on systems which support it. This allows for better scaling when using many sockets. * Home server "response_window" can now take fractions of a second. See proxy.conf. * radmin now supports "show module status", as thee counterpart to "set module status" * "ipaddr" will now use v6 if no v4 address is present. You should use "ipv4addr" or "ipv6addr" to force v4/v6 addresses. * "client" sections will allow "ipaddr = 192.192.0/24". The old "netmask" is still accepted, but the new format is preferred. * Allow custom HTTP headers to be set for rlm_rest requests using control:REST-HTTP-Header (attributes consumed after use). * Extend format of %{rest:} expansion to allow HTTP method and POST data to be specified and urlquoting. * Add support for aliases in rlm_ldap. * Add support for connection pool sharing to all modules that use the connection pool (pool = ). * "tls" sections now have a "psk_query" configuration item, for dynamic queries to discover a key from a PSK identity. * Preliminary support for EAP channel bindings. * Foundational work for dynamic home servers. They do not yet work, but this is now only a matter of updating the "realm" module in a future release. * Support &attr[*] syntax to copy all instances of an attribute when used with the += operator in an update section. May be qualified with a tag. * The logintime and expiration modules can now be listed in the post-auth section. This makes some configurations simpler. * rlm_sqlippool is now IPV6 capable. Set "ipv6 = yes" to get Framed-IPv6-Prefix returned. The SQL queries have NOT been updated. Please submit patches. and numerous; bugfixes - remove gpg-offline - create /run/radiusd after install - drop freeradius-server-opensslversion.patch (upstream)- freeradius-server-opensslversion.patch: do not check the minor version of openssl, minor versions are supposed to be compatible. bnc#906682lamb25 1615651529  !"#$%&0078e1268f9e5bf077e0e5090232066d4d939ef445fc46ff436005d1331ae6c55a776a160e531a224d087c86cffa889204dfc51986b5d581de516ee055440e12eef34f4d426e7823f1cece994a1254838c034fea9a7c1178a9128685f289c3089cbada6ca80f30d0c618b934113bba7b3c76a06904582fc6cea73b0d28c392dbcd54b9ef58b4b8b92c1257f5e4d3f8640e8f24f0b53495e4860654728f17b325ed6d74b9e2a0bee36df545f0dac03be9ce3014a43.0.21-lp152.2.6.13.0.21-lp152.2.6.1    debug.build-id78e1268f9e5bf077e0e5090232066d4d939ef478e1268f9e5bf077e0e5090232066d4d939ef4.debug45fc46ff436005d1331ae6c55a776a160e531a22fc46ff436005d1331ae6c55a776a160e531a22.debug4d087c86cffa889204dfc51986b5d581de516ee0087c86cffa889204dfc51986b5d581de516ee0.debug55440e12eef34f4d426e7823f1cece994a125483440e12eef34f4d426e7823f1cece994a125483.debug8c034fea9a7c1178a9128685f289c3089cbada6c034fea9a7c1178a9128685f289c3089cbada6c.debuga80f30d0c618b934113bba7b3c76a06904582fc60f30d0c618b934113bba7b3c76a06904582fc6.debugcea73b0d28c392dbcd54b9ef58b4b8b92c1257f5a73b0d28c392dbcd54b9ef58b4b8b92c1257f5.debugd3f8640e8f24f0b53495e4860654728f17b325d3f8640e8f24f0b53495e4860654728f17b325.debuged6d74b9e2a0bee36df545f0dac03be9ce3014a46d74b9e2a0bee36df545f0dac03be9ce3014a4.debugusrbindhcpclient-3.0.21-lp152.2.6.1.x86_64.debugmap_unit-3.0.21-lp152.2.6.1.x86_64.debugradattr-3.0.21-lp152.2.6.1.x86_64.debugradclient-3.0.21-lp152.2.6.1.x86_64.debugradeapclient-3.0.21-lp152.2.6.1.x86_64.debugradsniff-3.0.21-lp152.2.6.1.x86_64.debugradwho-3.0.21-lp152.2.6.1.x86_64.debugrlm_ippool_tool-3.0.21-lp152.2.6.1.x86_64.debugsmbencrypt-3.0.21-lp152.2.6.1.x86_64.debug/usr/lib//usr/lib/debug//usr/lib/debug/.build-id/00//usr/lib/debug/.build-id//usr/lib/debug/.build-id/45//usr/lib/debug/.build-id//usr/lib/debug/.build-id/4d//usr/lib/debug/.build-id/55//usr/lib/debug/.build-id//usr/lib/debug/.build-id/8c//usr/lib/debug/.build-id/a8//usr/lib/debug/.build-id/ce//usr/lib/debug/.build-id/e4//usr/lib/debug/.build-id/ed//usr/lib/debug/usr//usr/lib/debug/usr/bin/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:15929/openSUSE_Leap_15.2_Update/eac9e60d9efa1fd62a55f29a8baeff6c-freeradius-server.openSUSE_Leap_15.2_Updatecpioxz5x86_64-suse-linux directoryELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=55440e12eef34f4d426e7823f1cece994a125483, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=45fc46ff436005d1331ae6c55a776a160e531a22, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=cea73b0d28c392dbcd54b9ef58b4b8b92c1257f5, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=ed6d74b9e2a0bee36df545f0dac03be9ce3014a4, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=8c034fea9a7c1178a9128685f289c3089cbada6c, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=4d087c86cffa889204dfc51986b5d581de516ee0, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=e4d3f8640e8f24f0b53495e4860654728f17b325, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=0078e1268f9e5bf077e0e5090232066d4d939ef4, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=a80f30d0c618b934113bba7b3c76a06904582fc6, for GNU/Linux 3.2.0, with debug_info, not strippedPPPPPPPPPiǯXo5"iMfreeradius-server-debugsource(x86-64)3.0.21-lp152.2.6.1utf-867ef84e45a31fb01576db75cab3a9415981d0a14a3dcbf8a002476dc1c72ae09?7zXZ !t/] crt:bLLǩ--D~ã{67Acܷtw5 zy+2Phf],隥`KlK1^ 44wh5d9ΤՆwm+y(v[r>sZpw6s4>!AF[Ba1_.>>G|qhF"pؗS?OmmW}B̾q}6oN&Ah-d{t̰^hrtTbUwXEŬ^"7U?hٳGwa:C1sSU]ϗq1e[l3\sW6ux2ET"-y3#ۏݤ&k,kPVkin\`@\IDLW1qc& F$̺?ø `4IPKÛ<B%l)wvӸ1 𔌎ȡt A{\;F%I-uf]tn&G sz٤)V-bc'S9"b-*7U!:" C˲{8יI(&zޔ15=mMڽ h':ɪvF?Z[O4TlU,e oīS`"P0F@;{.D,'Qޫ Q, * )e3v9PeZWg9HJ-c$Bϴ=5 6Ku~J4vĮN_ņ|έ_ I݁}XP~c.+ٞցkғ@b"8k%/ ]Vs[y9+Qse^Pm\d5OEpruzE>AF5_)qࢲTTY+EDWOB 9ɀe@`HK~LHIS (ǃrm[!#b4oߪ~Hӊ6yGejy5!'j -.>+yqL:F.dHWҜb(-ޱfm<с|&SXķZxEqxZl~8Q&9ѼLҜYh2gdјƛx,_ )Έ/KQ'("C`]CIl&g4{ҹ! !Ju^_j摆r˭L:zm@|&1/]  ƕ]K ?jJY)Lq\V.+c)&U`'a,jJY] 8eFI+InMcm `<@hAh'!< eAh 0p`Pqm^x_")T <DgFml' 㠻Yo^vet Ɩ!ƕCMbpYLRD/@ ^"Z 6Y[Ι=U~P #l0{(/W}5Sq /Dcv_mr_3_%0E>j&NeyCVTY-lX2[[ʫrmJIB>-.(DiuC:[ m\"?-Ik0^"Kw'Vp(BGяnAWWh>Z£xSZy\$t ~'jN<^@FU5 &";{ 3:}Uw^׿oQh6e.ϯjRIݾ,B=uh~X I}_%.Z?%M+6`(i;y^/3_mꛉ z (D MWLI7~cݏ8ˊ73ur7(jV|/l6Hzv ܘ$}EI`- 5s`ԀWm8 [&$>+Nh>*gHhIh[ZwE!1f|) ھIԴ&F&zf='GXuxSNHr_CC|eݡXB=2.$WlˈKs~G)ʵʷ .8+!b"loTMS{0/S*wN50xC9a W"|Q4}Yԁ@@r |zRy?d ugo6%XcvFn4_RO/f!HNkŖCFƒG}k|6)g>g1jO}G4cԴWE/P, hL} M! w˛{$;sGȯ?6h_-x.0Ձ1B&JƏ%{ꑈ \IZm8PͼJXQ껣rEm,HHl} ;6۹t;4֡{Q'Cr`tm oX֭>|W[8(p~ҲW4Z˾ d>O"ܻP`bԘ7l-(*\ɘG@;Q("MwwksӪgywC핣*0tn_rX}dZ:|xB LO]>ؠqٰ 1ǎͣ{ PsWˍG6afȮkY%爆n ehC4:wd29X3-1 i@t!BNfASO>F~рepaXTK]'VK|..n=r{ɨ/=%?GVȍ*a߀@* G-484GU}t[9ε$UД(~BijFK^KfyB\ b $zjY˩֝d/$YSh[3GxڐT (,c_Nﺧ:deS>Yo xXGH9R =| Ԡ1Xd~ u5W{^XZ-~|E./ WWwiLc:ۈAL޸a9j&?,Ct!ӕ[Jc>٤KpI(ew@N|8XwKrz(R"K* 56VB"zϯ;C n3}Qq"? >ƀA-rfoLK`8Ւ(sJȎ80A9ډslBe5bV+';}MSmFлl& /v0X@ T<@ytFnNjծ'#7'1 kr^MV~J1h.vn)4~׭nc tR}uEn>2 k.,{1!u(l 4bǏ&ڠp֫]RԽ.9r;R}&Cp>)Us\8\^֯':#5Wېv'[R 8)x\ZXUqӧ5t"UfKpP޷ZkQLݷ+UM?R"(P?ݣ ׁr= ȢǡAzY0Ⱦ1S+\NK2hu>oo_WOE ʥa j(cW" [#G?E nCkrLħӈⅴc}.r< { ^j}$Oj;d-WsjrbnV"_&JƆ~,֡ y匿N׿ jGc܊gabkֿTo=p k)^ o mxCFnP'(hɡA 9bsJC9d" 30 BJV7t&J5]M]D4|'_Md9 MVnnnPP{d\g!ݠx /YVh#{vѸ'Jz`470c +g})֗91JQ5Wwׁ >q'Q3 >.opѡˣ/֏9WpqNh&(;Jc[nKFSXGu L~K,hh']W,_Xx;7"jn$'9c%YvKЕb<ŭ~inS~ 6 ?Va3Wz^4 UeJS_؉v5g17n{Ko!%;~iACXڷs*g52eN%x'VRѓvNS0<]֦8u*fb=5 Q*<Ho4 ^(@" 8D-?Z/u`r!2Ϡm(;9vO%b*:?`tZun=F>@Wl>⛡F\fbHOfnXTQ#O$n@-J]0avZ`-J Uv_J}.c̢1ep/P08aָ=M4Bɇspn5vNIzj=;!0Qu awӔ⽿Ke;O@*0ġJVfȬum3/C>b7'ln2$heB  { C`?qHςCB˒;Rqs7(s5VÚ4xbciwrB3q0וOŎg^C_NYaA[#zd@[ss0'ztʼ[KjPZ%ć1h-m Xd򑋽^ޙ bK BF,,L6BiW}2,1T4 N`iAir,"ô98#M= t0N47{!p4&zNrOI P<zy 'ù'el9L^dIj#TXV5g` )K-5a2="PZKS/A~ӻ MgT!3+dvh]>Dm<:{3ء)$$ 5kšTZCLeU`%{rsuyxO'+U З>U$a4+7LN%fm'J7SfjwymC=M7W(Hv4*IjT<Xl2&|$alGBJW ?D*[Z,2CBٹ.va| whH^w}ֱr"Ec$ah";Kz T؁k-[Y@ˣjްbcjZ!d]pu 0#uR'z'е!tTM.?E ?  ^Lī0R_I…"8?(qW 6s$O'OuqC`Qt[z6A%Ŝ .pbn L7&O3o ^p]è6(%d|CZ='h.z(BE^o3i*P lOu}3єqwfHwLA^JN3 nmsC궱?QŽP VSdl^j*-< &Jg)W|&iKtJ` :i< UnH|.-HgH]wx?Og6b6Nsxˊ$ޑZǢypb}Q ~;0 ]ÁOصiAZFP(%^͹Q/- ½q;::9TGϣ_eHچmv\$ŹdVlՎkҵMac݇iA̤Ix{cd.әi0"TgU dE΍>SXX`Z(L Z&kiR۪k+XY ȏpd9zݘ&eRm[3uy6CMKAE U:1+j|Iw1zA6u"*hӹgм\i ]u`Ѩ؆S*5щd P' i ʣ\xχd2*\6R~WA'ɿ/A'zroL*N@.]bh8hxoqrqӤcA 簻N 8@6G&7ST[oy-&t/<T0P.ZCufO|BcK̘Ţ5.&e-9} /EӁm˙ {teV YidfxǣkX$ћϑec ӟWZ9_ߤET^GWJd*'m^mXsW#UXoН)_CKp2=]7l9%; ?vJ)>?WZn9)$",ݩ6-5=|漹7>CO y{?l~ vUN[YLbi94,jIAk(A1<jR*l$s`lP;NtV4`-T d1t: &4n2/"vCR$}ߪ7sߑl< 1T<=R$o:mQߏgd/~⩘U/yy O1Cą^BI6ӷ]OSfGxHA$9.XBIGUHg9W07PbY!e#aP|/S@9O=Q RztS5@{nhK)PΉ-)_¦T@fTr1f}gB] vi{xs..ĬPEX=-vM7tBmQ%vǷn*g:[Nv[.Ƕ D: -$/C_eF>۞>܌ u)-mfP`><[MK@!uw"E;u>R ;tͱrNٚFB1X1kޣ_ ٝՄD;5b۞_#`醯U Yf#@ cf]=߆u Sҁ3$*lҹ.e~k!Pucc |â5+:FrgW NV)Ep9T}Q۠iمgfb uc“#oȒJtr:O#U^&*p*@"VfJ^3R3z⥉wy .k9 2 I4É8[owvѨϢ-M6<Ш 6"Jg"{cRj5i(w/{"*)|eӵפ\U / t;yLǖ{yxJ7V@v'cypɒJ}cף _LYZ-ӹLQd@>!T!v.:w+43Rex?o+<ե61gW[/7{}|o؜\O,VZKc*⢐}04gЯ)v5Oe,!BHz(O4'uf070kH#ċو Xob*FB2zPBW&F\` `Ed!Dͩؤ7W}l&Z`ԎME):\ ' ;!I39UAzC8n0H6Rl2/ʪGNCz 5ҹ\@rjT/D)0JJfRG@M5ah[!$@􇺞XV~W-iDT߷9|AZ۹/[E\JE~9|:z]8 \)lC]/ud~DlXX":r)DAjEFʹ=dl5;HlddS] Y(aGMY-T GMqW7e$V\ mž #ū AV:W-[,g|d[vrG)*@qG4|;QϪni-X+@)BWAvYL\{2 x:h_ WAs'_ 4YSYo^;d½jr5m 81aY7}(uQ / ϓGbN#`](5\mǓ&X8cȻ5v>tYvi1mAКC*x;r: =5;^N;;_hda m>^@=d+ne)sԞE|3;dr5زkg5tfAQ([eKyuz 0^8@y#/Ղ1<}y zr=]%ۏj\rRy}P ;'ijߠ@.>ܡmSV/.Tm%\)+W9vI܊8AV~lpO]> (ާyjܬcMWC8 5١mM߮DKsKbﭧWSV9ށ;CtlM8H(NFtק0_u\1Gҧap*pd`Lt_cs:;FsGA5~^D]t*j<.ƇmmFDG:dܓh0)ek/tMI5+ y'>g7trtPoJ"$?<|CAgx>l:4APIb=#D^>`;z$f Bo9Mٵ=1+h#ٝr٨F{i:tgTQDAt쌪I&"`w"i;0`u>t I@Ncq1 E=}jL +o[8j}$-͎eTՆ:nUnW砱QfLQa8TňhxɭiɕFC&'knjQCT>1J/k'dkbs疞 Rt2(y\"#W5 2XZ\y^giI M2QO[c7_K=bH6d3$ˏGحx hyzNW8ڔ6Vfశo7|^++\;o' ִbfc UC?;DVț;Vv{PHsXsv,A)'|U创jC5G45u/ukW@5&#}J}beU~# Yśsx ~(@M* Z+aUZ l|#}zZ1)aJ;׋HwՓݹV,]\7CБQPgiYZ v^bqл6nFzIe[Q%d2cn9qoCuϣ,DRy: =f gڀ(:? b|ъ?1U2&*'R,,Dz7lWs#_o $*0WܳAM(^[)PX^&寋 4A&╛%:WÈK+Fd3K۽$AuA䞅}/ΡdU)g;):~޿+-t!S 8 FCMqJhyn$Q/ŃRHQfro@5V6t^˱½ o-S9m]\ |~:NALD/|\+!L&l7 -kEVVV??Tu ba5!M%fYpcq>GԝD傀q<7CdoNqWx:tNS2:p$=b RT]aiR[F:j tȖ[Ϥsl](<J/:,a mR5E@{4WA9iPB@r3V?{$0> XS)u'?k_\Pؠ71ϗ{vA4 CQ@#{qI}_a&(ΖV0Qdgd`_ #۪J% NS]ʡ5c4Fy] W('ӌc} '9p,ǿi4"swp+e"n1/twcjfP2[W^Uoz%ȧu? @Ehb0p(ޕܚrky)BȕOAYw(PՇbƭ6X50E+eK|qW 5p&g43 >ωO\9%jKxF?O LwU'[2dZTRr]Boiyu yd!j?0,;by&Әt1;A(Gό'&<{m*Ty*M}PmpBdK{\3`%@$i:ADr}`z x#NgvS!{{Qn`cw0-2D2un5`2%1*oTVaT2S,F Flx{aGF60ZZ֑p6.BDAXX  yRHcDHfٰ}vy,Z_+e^'? =ܶ{ MJ:M#^  PF% HVd&9I?/WtP4~C/,a{DP)2SRݠa/G\eRH9b@Z{'>XݡJH :fg­2"֢S !RTwuk 4٣ZhXAi FsqfmzEYf}g>^ Na+n-ECy7:$= nɽɸ:T0wg8]nɋ?#[spQDз1rF,E˹( $o8o ]NE&r{<-(BBB:hre*Di V1i.BVAbۏrdEhI"vF!2*wuF[:Q!Gܐ+<)8wvP~ +=ESC44V L;Wm*(?q_rWFdD&y>^*(N6*XOuёȎ*anM0׽{[7tmR՛ \^q -޽蓑[-vTO^_^ z!rJ:d ^v۳ӰKs֭WKP-mמDrVL hjHx~?m,EeW;Q>ѕ)|BSv*s)sNTڊe\O_[z)k^yQϋ~l=pRsʻNȬbfTi!43w{aØ%>}jFc6Eǘχv_j_Yd}A4l0&_=2M1½@'\ ⳊqW$1S/OR`x}w%ybfiR`\M@b#:%b=iL,n=^Jr#<`B4* zl(:uSY4^'LxwW(0ZjElG,&0-W#p,"M[61%[諈b,dlU1gvuj'kutofclFczǡv5oOn/=/6DF^H zR<$B$?R9YXDh QZJNF36ARv31u]I.;=dxԂt {7o CF{ v D2XLH4y|AU2tQGJ܇JT4^Os;s+<ۖ*|neFۺqrv}KÈUq1-OŹ}%4 *l=*kǥ߹$]אXvK؃ɕꗏI2L !@0 : wEPWޖ-^"NV!竰1qgc%LC3$_BH[C9SKqیJ7- /I ĵޑh}WPÞ@5;:@bˁ`7Hkg8R)RB-A~RH9FiJ  HWS$KA^ć꾽1)kRnBt][h Eڲ6H,t !xs*+aS1OK#l-.6!xDOyG\yzFZۜ9;!t7Ǵg^vig=e7ɋp#Lx8dyt Pʠ!Cw.pCᛪ_mdbO%dІ3,ke?xF:N,a]Zpw3q -7,CPFSZ b%&?E=j ?TZ1"8̐Fݍ OkpK^ 6 ja4m#m9'z좘o¶ az r!ſ}ōj7 >#ݏK@5}r.&)}`6=ef/qi9sM=fB=~*8@S@OgGg{3p yXerq>Xq  *j{$gNi1u[8x%X@'js,~!33Ss6O>Sc5u>+1{bٟh ^Z(e6QrU/~drĬf%ẍ́EyFb[KJG!K͑[R:~R.7m>B_Ɨs:w矙Tֶ$*9柱y=j:9oGƧ[ t8Bka.N. AցPzenظjPfNwf<2F@0f\J+=18?R=FS%hw(Yj`'kxUfdZ<]D(H% OWٔ"k—KآR䋹c!(WV8 װ/mTIF=pf⃄viZkO K@u܈bq Z"|l}tgU-QN-Jwv)Ba%f?K,ϢPrc@Y9c/F/[V5􌬗"#B1MeJ1X׾ܳvުڂ8krU9 ixn8֮S[~g(Wr s|q)WlM _5dn|ƄȠیzC&eݘ0ydwzXW9-!_3'|5e.L?A=L{;So)㡭~|K0V*/Mߊ #zM \i7DΡ"Q0x}x#mC2<r褘泽ʅsjه`SK/7t߅;h07WF cD[O?Ɉχ6;0"f.c;S9~9KWx>3t2Lz\.W2JhUyO??~70C6< T؟U&1rڔ07;!5N@KdilSQ{0whWBfh)bx5Ɲd{E3$ui9qSڑ칕K5đBk{=hph? *V7Ap{~w:lP8v'M6\1H+~{DEN#G4XqC:|x |G_': B”ebLRuZٸըJ$W`+@l;ŞRH7lgK춎-N[q7 Ak2jU{O>%R !61Zr~ 3`jpה BכI}2\$0[K_]kR1ICq0hf =$c?IeyC3X}YKe&V'tDQ\ Pu@Tx /oZ;?(ZH`QRL&S ޼ZYYlLsV:~4!J*&F,@h^s~:A8^%e_%сp:`+{Iw13Za^S'$!KiWC F7S;hfB,Fd'zU*GFK*a;tP ޷$5?F2.v*vٷrb}Nvq~/(9e9i$l4 /2]Q#ⷉJ4^)Ǒ2hI{XPǛ赂/Hbjry2H'&1`q5Z2gmp 4>kGpݹ &*Y.'.qBuF4㸙3є'4'D:p vmrO<憓zw$|Ӎ.!9>BLPљ4.6^:Fh/ְ 2? ǒ8gMH-Vlj0x`%AwvR\ / ; &;XZ՜6Ҹ\ DVJHχSVDP20NQKm2wivTq \H&|T:+"3L']'hO-a 'h',86oE`"NB#gQꕚ?vF<~(&@UOKRT)ŏ}m@6Gm}th/AVΪ6`zU.b~ROlCcvսd7̸`-uG{n2&x22MHis/F\BbT9MbB6"bX0xQҖKE`@}a!aa<*4'#ϯjK qb|*sN l\a{'R H)&h&Йƀk-С\%4f8̬`PthV?Fu3 .GzY#wvExA^&6T48C~&0`l{5bDPlqAmN`G~λ@W`Y U,),E[6Hxf Nd#G?qJ]\x,@#˘ԭvDo0)]I#%M?4NWJpf XfIO`䘆0oa$'\). [C[dINk(<TA$nxj9voE<`/>z>YR>f0Vz` ?Ɔ`jX98`#~rx}58pnmNY'on[VیU}\?Ef=1aN&QzLn{6r,!}f5W 4#uKByU~yVcz˶֍4ftl屎EtÓwt&WZ_ v꒙1bo$`4.W/9t5%X-/BG|q#z,Gd)cΌ^ ĀaNW+cI )CrC,L猹NdcJ|{_u.Bm#<5J51ӫZL -zǓPy]71۸ ;(*UMCF46i<zl;sF '}B u^Ȫ̦ ($8¦=jZDPN$o$ka3IV$u׍\>F/=wuHY]ڢĄ=e."zyA2*)1gh2o;0AnE[gh3l(?CsUol;Re76H$6[ڿ]üPQ KL>4YH'_v ZJ:=-Dj a(lքq9_^=;%TC#&u"RU/ޕ9V$# YgRj5jz -(MH2tSş%l D c09m/Ō9%yX-"Uocsn23Ÿ8.8md㪹 :aC .TdR^f{zl dU+Ma&;{P5L'T==JxJU&밷J9Ge&4Du&!⣴-F H]܅`j-9!~klѻ9m[e+(eXEIReS<3ne¤/ѼAi6tl&,}ڒ5z{҅D}#zI|ˢa9Ӏ l4i,oBHGŎ LmBwmlf24wó C3Ljӌgyƿ 6U) Z &jk)a%T\-& uqā7i0D;," ǰ|$aD 78ALdhAnd<2IsБ=vK{~!RFe--p_3GUvM_z`0s;qNf"#50P)U)"oodGGM--YbP,2cA5~f%s{rؚvTxK& 5[P˩oxb8ȏG-7;tЧ@(H&DbgC-ǡ<>,;;6m6 dzg+S ~FF+y4kQ"[ Q5?!9*>i#6 ?c%lHm4{ C~N7Qjb|Ǖ?>xV/C x`~ʤ3)cLO4-E h anPP9.ɡi0ꀞqt()n]1Nn3D(ōܪ2f٣ WSt긙4" je*нG5u5Yz[øaR 6 c:k0!GBXd L:Ό!~=}[9+ |,B/?^4+=Cs{qoZ &,"Oۆ$ۚ}>EboG5h*^pwM]q:Qi :{Ȃ!u I^S.D8]]W` ĥ o6"?>ƕx%ْ! ,$P)9MBcx% HE\mʴS}`)&1ht|˘szumhΨ@8KpCY%څ/IJO%>0Uk۸f[? `v2ϭ~(`@v63`!3q翅@0)x=4*J#㣧l q3E ԗ3èb6lF!J~.{њ')mOo;:ON2.Mw@C cm '`5]@nB+u$`&pM1{ FFeajf\#BE? {\ݢcˠU[r@ 7Y3K~\ 40z O BCb ʯ/a_cq[?6yaz[YEp6y>  W`1HlT)nd[FN\_gN,x"ۏJ*,I %:'ޖ=`TPOpq-1堚4xnOYv #ðȍ4~`ԠÒ63SÉgEP)HDWuE3sA,@lo}v  &McgQwڃ`T\T80_tW8e DQhuIv\su(f4QЀ|eK##om}!`seFSWu;uȋ!"ݮvHgt"鷺󅞸9[_EM೅@7O:PՋw&Fu^8]۲6(*׵uڋ>3Ib`5<]nk-o9 F.I).1)r1ԁqSm3RY5хrq_j-齿fZ-wذĒcF.x;x<`eyZJn*7W*+C VaL̑u?Iݟ< dǷ܊TF-; $x~;$q<_c\lи$|K+Iڎ8vˏBN3Bմڒ9no]~ode$fHYpaeq,>V{?Kn0 veJh`s+_^Iq/b(BA!kFN2Q^"_maKhH}vϗݩ#/V_} (}K&O=3~XI/Zʯ,9r1x:kgpS3eS  St"`3ԥRz;hFo\뢯*#(?0]RfR$OkNemyNkwtOpj4.jWv&Ao~GFfb*/Ԗ׶B&6aQK@&~v7T_c5í *2@çjx DIcÃeR| v NQ }t۞*0vN6f/|V Ty7J!0|h``jZ o,hd7tެټġ"%i7!y@FOUMOОnAlz]~TIͤn7`?gBhue]e"B Fəj}ì(׺}Fܠ@*o#U mv׬jݘOV{/%F%{Mc.\9V@0Ţd&QTyH1>d»xC*K=ugW!QVPQn p5ljtZ]" "sDpu\2^I_TW6X T*xrDUAfۗhY0*w qga5D'}x%)Vj. J䫷1Kٲϑ`S8 ඏ)J; AxYr.#3`+xpŐE ~(vw(N}yɂ_໦*鲬/wC6J؝JU?VWib3"lzkEMLS8_.3&sb#S.y0L`AahjfoHۜ2F\txp)! N*Cc윈e\q,yYG `ŮMatkΊyT9(mv+ FjVBO p3ǛO!.%#̽֓rCW[-j8nlI5*Sĕxh p{U7W6\,`4Q~]JfY6Hx d5Fk$=3K?7 yJ؉"i7] 8 nѕ瞌7&fpe} }5!̜d*<׾ݘS]tT():9ɔުZTűPse\FǕ'Ig-Hhm!|=1dXUC3AF6Њ9w;0GU-YX|Ղ? 4:[z'+@=\O[ѡ3x\.ucyx5" \K xQ0,Ļ#t+?$ޓZƉ52E:j6P5wHoE큌-ϥ1vOjzM<ǾjJQXxH mmw-8r 5$E(S='GyM",/ė ϫ{ ,=FKW U7gjp R2 P00C!pbmܒ$Cj7Qkn,QPS֥ , yV8a5\O'߂ X?FI0$3qoAo\ c>hř QE;\# J$ N${2C[PNYMwVb]BvꐎY`H,ƘJJhKV,1*8.&n1I_J!Yqh4;(K>LIeW|4C@R-bWF)IsgbeaH B6D[b~ZQ*rҟPn4>;Hۮ'YD {~Y'F5&K[  ; Gy6jWћœ 1."4Qk-p=;\'t: KȁNvϺ7(:81pd 9”=8Nn\ ͑,0K[XmaPQS]v % R+llQX {m%ފ9:Dl-rjjOC8A^ic|0: !1zUTu> &|9ctd$yB;ؒlqbfm{pl^<[SrKq")anmހ~Q`#ziҞ ;)bkG&H7F]<%SBZu&$1㫑|3. \7;&SL:_GKcr yVEeKً# DI}bBbr|HBP71#P wNpRBvZZ/#&SOHIg [p$lZ H?p' VOtuTwW$Pax rc@̟\uwuݟ> cDT'3ؒ lmDú!%P1E#-G ;$ 1vZv5g"6ΥNI:qmJ1 gّ8 7/"Cc0zH8 ,u]]t0LZ{՝= #{ɶ\), 89۟(g$"*xMCkwcg0Q!`pr]hxX):@ӊ@RhA֕e>%6•E"ȇeHQ:@L M3k5#@lb: :}i?vĞl2\\/ MIJh^nɌs*2' ҹVWT20;Mx[0;lr.{efc7?jJ+R IS9/C6^ 嬒P*Ū4ڞh,.|aٚxrp%;lz*Ǿ +j4ʎ\24-Bkx_I,eKp<7mWYӰZN myjeTN^C-V14ù̊TԦer =t&CoH"?/@6H LwsvWƤٝ2NLeh؍`JƑ")ɏyP sd`?2=6P+p\!Ҙ !a_Eʥ|Q !8T}$XꞢS0< wc>uC΀ A;TIiҷ8+\s)PbuVWM2"garMSpKww%rf\.~37Nm C/6Dr 6M!31^Z!<-~nMحW"+n !,QYW;@88Ҥ;M~efzֈ >|y Q1KMݼ-$} P@([q֥(TF82F 8]vA)_&HhqgW|!w"v"Y4DNY*/<1> I|lI+_? jXc)td&2 oh-Fl{Q,kPDYK> /y &c L}<MI`r,O"0ͽ'(L AfNhAODnC+Zi,]m uR:D 7jt:h&BrCpd#H#}yi.nkRM(ׁFLJE' GLbKT9rVO4.ƎMPoJҲ͓}_?G{UKtЁx+DIޘ<[ {1/Y+&O>I]Qr䌧L''4L/ʯ]$Ûidݩ䁧&JEsU F2E_ܺ#FߑʮV4Ȅզ7-/J.2n58|u(yp71Oԣ`M LEc?<Sh,$DL!}64YWki "Xe.>Js_5Gʨ?$2D (|xֳ%Wp- ֢%eBe y8ƺqk@׬rNKnǣ!?q"y$Pȱle]Ju4BKy;31\wP@`(6ư#l[*R]ޗ"RMW)s.>gU|1#$oOl]*5h!Rq3kz<m]>i@L~[5oVf+Vc^E%H0/EUj*A#8n&RUs~LLvqF_CA|Cq$N.g|c#R]SwNt]k,p&PP3;R˛PlV:..N3T% ˵ɵqVʠ6fygk@~%x(Xϰ!Z*^"te-L>-Es/ Q̂)^% ltՇ?{υO:-Ds%~DVu{II K}O/*[Cpeg`XVn+Ƿb";egq^SX:Vһ|}hV4u~鄙Z[b!*n크Q |p]8dDp* 4~tCMZ'1;ba P 820C@e]g(f"ƀ}}zZlw[, lUF"UW1-Eؽ1E,;K3-=2"ցԿNo>b3 I#o/ZFR\+c)C 0ӾC XFa s?D}"sWϓydHn2sϚXY}BVGZI 0l3b s/7ޗRz}Ejg*v?./F7ynAb`̌2X{*۳•i?_g6*ټQ<"[q)yBq$q+@2Þ`^HV?F -9R&TTݭm'991i''zK'5Jn>x<]0ȅP_wRZd/EgEhkR%UQK^&sOW yCP6#i-,7/w&3i3'IcSA0FG:(|QAڰ!w'M"$L'A(@~>#݉=}Xv&lRl*~NC@~&$ސFT@Y;KmH>DQMk0_RF|֋p3H 1{VЍ3X/X)ӝ'|QrKZ ë E:t dM7ȸYTV\?6\1B IQ k}xA)`/pN|}43F{sݧ.$ԥ*8S8}u" .RlQ"ڗ߉ %u~(`\jß)FE]r_i7X.8Hs? Av DŽ !<ϴznr(Ij\ >]II4sQߩd?ܘ++vWcH_8۩CB>Get7*z?7xpv&Z/ Dbs*VpF8Q0kVT00lRI@5F04Y+V fԟ62>LC3֦O'P' e~2uFLUbt{F ]*9'y(F 8砪= Nu*Rf*dԿ{KmK- @fjXNl{ q11vwN+?{udcqЗ52uwRwC>R!٪d@Hs̢σC(RCKbE1w1޹g>;(Frfkdm.zr`chS,Wt]Z܃z^+K_+eׯ^D`3IWLb23%=yfY <:G&[nw~ `i_,u菢NxT*}i{ݽ5jwίgЦ =4Qc1d5% h.-ұ?r @h`-|/BJjVB-}(u126K.~/egPU@9Dty4>&aH#I c桹;,;eKIUwWXM1؝8Lqd B6fak<ۡ)5N4p_%QU>l%$nVqlIag[ 2T X( `&IEV0Oz(^^{lkۇ:*!lUpCCYO*yZc_pH]!'73l Xa`@u ߨ,t3,#_b,"B2<}8Rw֬P';#B?*t\'8MEӏ 2cEg}%5/} !z$y-ӲpsPe0ZaY q1e(q|Z.ÑbGnyXĞa|)\AĬ0d;~^;Њ_)/Fd@SrrO?)yjE.Ӗ§ J5vQdo_{ˁ4&I{aJ#iOX| Uþ=431yX]D֙POǂ G1-{u_KE!yEDɊ zp8)3daBKǶrʡ#1MMأجjݤh}UHW ̦(W/Ok!6Fc(jŌ4&8< - }ƞhKwXk\v9JkNVy"~`-`al[v)G +ΖTٴ)gSsԊ)񠼅R2B!qM6R/V_轝ZFWX8d&%+>p~\#cޮcS~XCE1aftOpc8&Њx嬋 R5~m5luƈ$J^8%AEO܉50z̍<@ f0e9I3 GU;ϴ'=/{,–ߚxhКR^Onۗ1i7rԇc@McxH(FE6ɼ{l[N'62rsP&F &qU= 7%)pl”e uJ8tA梼oo >:IyvDW;2dcC`1EvyH`0.&Ώ0ؾ450~X߰$% ᭺pe(0d!.ѽ -]e \dV@gE> %rXX Xۊ{Нc .F1 nvz53Xd2xNR@ wvŘ~NVut]y1ɍ,lA?q}*ߜHMC;ƿe Za!tSicDe_APmٍ5@ѬV:/tzcN~%PN9IYNJ{4}grx|.Aq=Q޷ŲR @u=?j5ޮl[phQ35\Ԙ C6#ݷ Jś̐NTdat:r2|Ș(R]pS4I/aT7^r{p6DZEG| lJci՛̵ 2[2c#^¤=hȟ8(0ћ Ĥ[@e>صFvZf WW[R8"QcEep77_ȅq񂶀cz~Jgٺky'aexs5A(;oア4'Z(OO,Ah[H]a+5C3xf9+zOrӃ )a"%J&l5"Ht ϰ{tSF#_c|p(5"p&-傷^6'*p BlVa0v n. jkX ^>Y Ng2Փ(*9#I/y i"ns6xFXb&tk.4)՟aghPv%<Ӝc8)M`,1pcLlJ=zQ*Kw)@CQƦF0O CtJh?",ˌ'2 {,>n w)EYEC@ܽ Vbjlpg^}O'$`7&hp'J*\ @tyyZDu &~~f0 {0J2<= ׽sЄQFqcB墡Y7)ɚƝ!+M&v< f \%˳+m !ڃA~^c=ᮊLMDTQ,"ܩqf}5U!O.FiaiiT,SQ63@:d?~7(rw$&EKvS>VL+zu3}'>ow)'ޛ"M7} ɉò\D@ǃy YCX&v#j&$=v+'NGq _#4+Am06nyVfF/q H/CC")$:dIT_yۓ $fޓ ]ҫFU= Cr@O3v,Ki\:JKDD?pI㡽wtg>P_> j!W-yb (2tIobqZiɡuxNS/rKRܲ>vu=2 f m{c.>"e"ETOJ|D1o34iu[Eb-KBEݵpKMz)OnUwVzG) J X]q_NWNA.}8& )K'-I!qo)>HpM[HA;~EeSbb佞s1ڥ_!H֍@/7zPPyPF:LV,*1~bv^h8#+$㒴ʞVA:^ZNKWɖ kOVuyҽ[z34uTOkExUNH6/j}J9Ϗ]rcO|l~8\ ^b{75+Dg4~Of 56\Dt+ZDV,aģ=DR!w,!Y,j~NT)*>O(]E2lAKdPUsU7ʙ7? RR(A}߷9G&uҡQY!RSX7YͬD+dCRuَ.ϋW16X|O/wk uyW`ɒy򨤝(³TñKÿ,U c <& 1n_k^9>-A@zem.i$2~,,.Fe;z7;ū1j y&8U@䖈ˀ; ]<{C>Z++}tY9[#RC^j"Jۚ-0̈P8kXDK?FիF \Vu 2cC1sJ95Dn`ΥuuQp+5Mu>_rjj.Ӄc$B>/$XuC-(~ gᶏyHo#!t4k@)zž##&x#yY{V9dW$@BH<]=gKߩ`)UGhQ]CAd8N(fy}? 0EdC/^ Ȥ0"Z2݌w(UF[㗿Bщ0=N.^5r yfZ`4xta+^cWe؟_i]MXb/U5I&yflsGQQiH+SD!-vw2K@~˴JYzz!}DMDaepYz}@~: -lO9o1dOF+ 1.m;m)1n!Xw`ɢz7YBss.,\}llo۝lYqj_sۉa7tF@A0Tx8% *֤15R=zZvA^Gg`48@VF~{0?XF|pŒ ^coyTƲ HCBV0ItxhNYYy#1a$ ;dWϒ^ R޽ cm8z! ] w'-=LȗUuyąA+L CLf;.~KR>V y &&XS8cYu u*e gJc8实cmQ`HQTLOOƱEF6`(+&VaÔmom떿{>V1iscD+>rоp$8XB[cx0M l#3MR%; jz7 :BW?R.TS@p'Joҕޮ חcGheTcw:ypGORH[ld&B8恑q}>Z1zrlt\ɑ}2'lJDVEK}Y7tF݅p/^iy'm&s brB<=l?Qx!ߟ1쀼~fP.X.L`]1c)lXl =?5Hy{ /bsm شze:8;wI1%AZ%eeS"Ou HGƓ}FzXrNweHh:/r i P8x+ a>WJājkr&)܎M(?Fе+V+WH QݸKẃ"[?n] )d\2Rⶏ'j;T#֨Nb%\ǵO!H6KK1qPx6~|\ٖ:@7$chOzfVP[&Oq՝\ }3׫ej,V3f` ._v3~R9_?xv Bs'﨩_b"(ìqO\QP\ԼıvT֭UI 9K#pwyXlF!)Ә3Bӂnu!q˾zHeM75v?Ϟ:6P\-:7fu\V| uU*`#q0ګ)‹ug.| $. *!GJgzl+@eҳ97_RD́;_ugeYrKg+-Vb.2Ra}]Z%(,`7IZ fKn)Nh QYKI@XU1fM([t C{~$_?s$WF_ȀЩfU9$C xߋiӧM,QJ'R:/6^'eIk<`=[k sM:ڢ}sojM/aA̕A\4vTIfq@GA,VMξ[efȑ XV?zvsوB2*CziP '+O/?zm0رkW @\] L<1QsqawixLrӾmI ۲0Xx_5{yoL}3:n}TErWd-㽀7xV2fiI^~G;zJ˲| &p-O̷^ W^~Yhctos2Wfk7&-c$:?33cP.k~ z5"}ŤJ\Si & F䕂¥A3}`8{Nfx4[D'Ljَv|Ϝ:㉛{'ҕQ@$ԇxcAVdq-f 6|aOQ?W;w!HNΒ}}PX[ayI؟\3̘IeRҹ(zD*=f%HVCBS+Ct9^ץ,eJ_e1T!I0VWdn9/گ/cB P|zNI>-{h+ՎaإQW7ٙ@)h*~'t/QBs\gresd2_{f6`1Ң# ~!DA'!l36~IT&c wwZ䬢I,C;F9׎)+1ܶ\^,,'?3e$ PJz[w7m=.|LBH.tk!!4WC߻Ea+8c=و'حL 9SOVNO3d ivTheP7 W+cy-oRhOߚxWRf4o#W#taP^x 2tj5Bâ쳚*Ǵ7#6YFDMqFub 8Gn]r EoE/ ׆AH 17 =ž:*::+Lc,Xgİ*Li2>$^Y<̀fP)(*). 7X8EQ%;ނD<&;31|ھ儂[CYWEJL`$^binFBS;0Dy8]\iGj٘hEtֳR˪$tGjC=*[qS&Dˈ;Mק܆ :82})6zDw.ߛhU΢]<0xmb}J{H#H%ܿ[E據%K ꟌA~D c*:-b0dgsT #) ﳐ 䉚x'}}ԙ%awk&hY6.dF72viB|Ye¸Fb. svrԻ8ʄ0c6S?gɁtӏGXUQ-,8FSj14ܶbѶWb0Fz.WDMR"NY5w~䔭05I"C^IKf=1x 0b! )RIOaqiri;yR?ٕi&<޽Pv=KͥOO.Fk'aA*TaDa0D|Poာu),MH'X)%^R?;wFsޑS?<[2)wu$ٟ-*4_..s$GAq Ewz|vi{qyJQMө -S eȼAQ)avgyHVawd>pS%v=iųMkhX f,7ie}#t^F/uR.-eӥޟu. p!|7{ړyYD+$w2a,2;kVa/|i(r6 ߆韝-{nk}8=DxU[,7F;{||r +\m-Y]N|"wKӋr^VD?+|Ɠ+r?pcдogne8ֺ̀hl'eVփWp>Y%bT~9*r*}$U* Ck:-12>p"Rte7Z*NSrU!VATFPf2Gh=dZ (0Mi)R"årTݜ$^ FD(-KaO :DLDNRŽm{X|A1ɸ$E0L}#rXFG ZtK޲% _ǻbMOdPV6.cW4LJFiGq2{5>rWix0Mrm>A֢qdk#N $!UaU{] sT+5@Z|r! DOf?6Ew/<6]=K3xu%$? J{X̑)Glve lev\u?!{Muc>#9e[`0{ҧ5[a>Mq,P3OOd(EsY:TJ(\mc+2 NMݜ-zf}^ 0xϚ. `Wxv]'iBR(e9Yrg&/< )ZJT)C 2\q zd)wZ5 ^iˢ9 !?2i*bq՚#Ivca|IiLfm-i|0g)Ys!Lwlk"׏C[0/NDsqWtgȾ3z 뮙Xk?δU8$8PEL*{{ϥa2aL9HudtGt.2щbL3°o.ʅdá\լbȐ1!9K1-(g%BFh 63'?pd rװ@^o_a>~dr p."qD#TfNQh\JqK܈!KHDk%ݱe,C.E@[֔ȂJMD  on0ֹY<8 1"N:F܊ ^ֺ8Ub/DA'Mn5~'+$unj_3&pKl'}V|@S\N S[҆L_!AAlH47Bͥ^L ;0Cy7,eī1MW/\ A|XQaD<+)Ȗ'YouucgcjT) O{&q am353PDKaɌ=E^ 5t2鷥=/)tQMRdѥr5Q^5lT:*zRׅVfƗv8v>Tk4'499UKb.ɄAoF B8-$r_ YvZT]>z:-їl&BTn(Xzɯ +[Kww=I?̏E#b銞J!}cem'euq>=ǶWf(sHDJ_O,FE&#nWPtdM46Mc<¸.!ڤe x%ejDB8 /-,z=Vx3^Ot[.?`5Dj62cq(p tX s l\鄥=kG̗Nb#2`pCO)Ë0>`` [ǃ\8\.Rc)C w!yd0P ̧c L{uImiV ۝G Sa59*9|[f8+A[0?\:oд1ъW[v >s$[!~WDLzqd$ b$0x%^ ؋җ_ܚ <cgJS-]q TĐ2nQ:3o'U\zx|M;CUҗJsљ&o7eM Ez&+ wzj%7k8tza|AnQH=ߋnpK˪Lj JSJvxYukpd'9&oFFKA-r:Hm 5a|Sk5Y>).ـy,Ąv"Gb~$#"[\JSR|vŠסE@1z?Tq6m\+U8USS+äX5 `0+r/Tҳ0Jv49%;f0^fW@*ϳ;YzEP1SG~= l< %L.V_vҟ# L% h vdل뼵V*H }{g~Qv ($f<^pcџm3/6arvbL!QDBya~<74"xH'B[? hwGk%x4[|`H:J%h ^ڠL:EӔehҽ8mW6abZ@A3׾z$4BP}a8Mz"PrEXڬ iMq]);b!a4f^=cDN+67,wO 2-XpUbg{י;,rtlAAPkgoSK>k;]!P UEˇfņ^;kS3 x\? D>  ,i1pt+_g7 rs 9` V@4AkJDd"[N K1px$;:qLKsmoUz*չ ,K g>G/VҞ+?SJKdF#u9Ѵ|}h>?|qS~?Oм n `c,Y})36)4䈂LC@7+ Ht]]{EއB–QRwX r#YZ&sS-W0@ƆP[.Ԉ{׹as! Uy֧#2o 7hw ¶x^n5Z{%X-yx/#zTPOJ4"c FAT?wԩGZ<09]#L ߗ3fg|~=g/  a}BmVST{\nuڡbjhvv'U"Yr1i$9PB p $<0oՇO}| }n m<ꤡ;0%5S9珂lQO_ꪼ*I.,2`xN(t>y5Yc۔1%4fc"\2b2K+i/}suIɠW# Bd;Dc4>`f"c#VT4VCkF+7C ̎^%.3`TZͬ8K-Xd&b8bK(uDZOavH;%_l7^.hUZ_Bƕu8i_20ǚOv#xtFX?':G}9ZE*vzEce!Pi֒}[1snGf=w -Ke3i)xax+4mk2C`陴HRUw|Tl^XӀHa\<:BP]~a31'7f:c Dn7!Ȭmqz JDfjS KUse#?^Ƽ'W1YRl4;4> 1;|Et!3,5=)Z%/rmzY9[,G}|[lע ßjw%/!lnp_C#EɻuXRTku~˘Ac]¨J`2#̡&mgΕ7GM\"|3Bs/30>H\VOZXZu\X,ГFvF;|* ;Y$1KŽ5Sø0 uOSϴlkʆiyJ"/S#ʽLw 6.I#$")p+(8(pckjwQn@n'BVJC1HC$Pkރ@yz=ڨZ0LaSj uQc%*uqp`E]UM,&~ș#wݼڔVnjA,HܷC ׌&bpqw[|y,-؇S]wp+ HG8ik0[/h?b%;. nWk“U!5D $EUDyӌʖ)88T>ߋͣ&Z\-(ZW>`ȥm_2rhSܑMWC*B~tA~-֔QaFtqW*qg*=(vA*s[ \unBilg#QSA0-݄6*΃ <6*ty(816NgZl.qM_Lpܪd]] !uǶuv6hYnƣL4C5 Xxج8 ]얨̬ɝ_ăڱè=-zGQKug_v¬e -uMhܸjZ]sŨcُR@Y}3[hҔmX<}00^Oio,U 2AV3kI6og>/М[r \D̐=펷q*虬NG0p`B_Uݦ~:*ؐ%8+Z{Tgf7GwX4ߙ_ZQdaJwL*ώuU/MHXV?^'Үiv{򗬍> att@fb&w~Te9ۍ/\TONOՇoif\qOOC4)yVy};SꚣfW<1dhX=pNVN'a ճ Npgu~VUq%` >l~`@qp&d; NFو[h3nNO^Z*μ:e6² y+{H²Eng eg`y.osh+T2ݹ&l!Zbg,πrc0PT,$@Ɂ h7wV #xM !=w|EKY&e}y5/.ϻ[GE6 Rg4ȜFTDABT]P 1:šIiw$XZ"|}r[տv-.RG^bɷ%o:-Ѵy,8\6b|pGg]o?ny& 5OY4r1o3o+zٯ;ԯxk|\ sՓ6IA)y>xrOv'a?)Ol9; m^Y4e(EE^I2I_JwPs[.HQT |C ݚpJ5҂O:,p;UC*Hؗf66Mh>҅3x{#I6sApw Aitv}<>6IHa#aŬHfoW.F]}+(KsE(d^=dmY QO:Q vm{˷5x@\gS~;i;,XO"1(ًxaUF>U+Abn^P:M(q\wldӖPå:<{4GPOKN'~n$&A k,:8VQu<ΛΏnM$p'w+[f_,`J S*aK<YcϰJQ!f ]FDb3[^0|tЅ6vьmͳry=$D>p*v䄈&MbqQx2HR06[z; kLK=Xz;FeM =@5H~m'(":#%,&v'=Z Aw#N8q I47Ds>T0TfOYSF#+"5W%|,j4ѣpAZA:^zx}zX(ޱ]U6=FRRҙw\W&V, @b2v #}(w' ԫH+[rw"D}.Sy.=]sVtH.Daq!n88Zu$qw@X8W) ¥|38~k86hǼ,βRj8n;,]_#\v_{0Ųuj-" yS\`:zBD4|4?dJ+Y{od/Y|Yq<'%j."jU4N\O7xAVF6sY<(6gte.3, {RX[/Fkg91p7;l,t #~gob&:pt ɵ|Q3,Hl,Mn[i(ԗ^)(f \vsm8rr㘥z Pˠ}HʹFA ;ؓ&R_pqqs*̶yIV]=atG`qn~aXMK460GIvi6_%! 5?|ohG=d4ݦ|imKL:]Y0ldj&e[]蝯Nyo!t j-FXWyS&XZ+0L xaoyV*j ՟.}1]bv' _@t7ʐ ZCt_4qk 7|Edޯo-D:H3ثiJNO3NOsyd!^ë%]?u?L8Zwlm/L1{Q|u; p1,-p|ALsyKI+x't)e ], XHF T ҏ,즮6vlzyiU9{+fLN_D`ȶ~;SV tM۱ʂOˆBj+$rykeWN:Ҏrq=Q 8g˞~82ve>ٝ1`$1ڌfNQ- qy='bWS?o,)1.R$"+NeYW@y6'ϸeZѥxwJkTkµfWoo_X6'8D=z2=tRrIOaxt3qTVA\@ސͰպ4Aˆ] +{19=|Xj&8;?\d4\!91DSIh&PO9<V.^ o$N὘k-@r5ёZw(=S+k$e*XGwv]gGTw]^A[T|3&qJO :Mp wȓV @kU2KACdA)_w>{/ۊ(~:nWPq-i0ɱE/+l.gbK-۱Jj_ۀRM}o*c_ _@m޴^ev /|np*u I;[ц~_qؕf&!9}RUE- @%-uۺ/ΰ!r)_)I 8`c橮:q=.Mc8q>ےl)^B:4C[|'0H Yf,WOeeWU4k/rb} Er)ݧ9^op3&=jVPEA!C6*B9i <{,q*(6$rQχe!rѽ2Sƒ]I`Dxٮ蟠m{4 +FeR7ITV>N}8Jw@%z5"i;6TZJ!I=ZeG@}8Un-jI;\ؖmcfڎ_*y0(K#[w yr llvI|~$)PMjZbn^naXY2w$ : H> @{䨓^eh8i~[r@NóQ3F )Ud^!k)%P?(Q\6-~!ݧb+6|,g0P,rJ8~o:d3˾V^O9(nQE@}}a/ |4mPE1'ܿ'~ TF;_Ux >SwG-foiQj'ʭk30|oǓv]Ҥܡm9|;!ϛ#PdBXҹGKvé~wjQWcI U;f'@X<oJ]Nn;=A oķ{9 +'uKT0R=~MMrkZٰ6R ~Nnr8H|gwϞlsިk;Cuƾ$­#`2-jK,>Gųf{{@ -ƬzoEbB6L`AЯDZ tɀ`K%P5n:QfR.5)F+ 3k/uBn֮Q#fLAsoHW>휾![10&9X#"_TyT?YgLW &ʷ۲o`g5qn4ejA.g2KnMnרѶ>c`lX|'?imq)0 QlYE#VKH4hDGkw䡬ڱIdOʧm4ڡD7^Bټ+L%t>gC"KvP*ÐkW!^L"(z릨]$H*- ar|]rPpU^X%dnèiZU/CAD@9J#խpو>r?BMn}w* ޸vb]d~-uxw Z7)fa/vQF_`g1zpgߝx'u֜rk=n|6 TiL:Z9(B7eWGB9 "HfK +#i68hnVvؑz'? X|[#S]jp90$)S3:>Ev]+ ofÇjy9|Q>`b adƥ|=VGyg)J \lpZi ^&9z&t4P)X5u*b$r21~RvY =2w-St =@ g5k@ZfTJOleBG%ozG?^B@M%-bƎ\~n".QJчG'}GPDNjZsɏ%"DfkۺHuuMV~0ٽm@szo]IP mA.rC@gPl':Ħğ3WmAe0Bwl70;'Alsq#~r4׏y20TG AڢDC_KGU(9 k6C*19PهEk:gcϖj2oj j*PWͥtoG+" FQfqĎ|`N5J)B爻l‹܉cP捵V?PRBb̓)i/u8i$>:ʦA9a{H˚y&f.6 O~zUAl$J`Z,W6ԧ!Z |OnL *]]r20F4B3*Y_RyB-jۡ*Q?cah2e:{7yj5rL# Uչ'<&(nw\*Ng}?$^^HZ_H6, ;Ltx ?ɉ>S!~ovXKKKܹ:enF- b1cRI|/t8ڝqr~w(/_#-@ 8W[)Vun7U8piM ;jB)vL-bwͦ0-Rvl͝TOD6zK%3Hu~^4U,ӓԼј|9p0'v)=r2-% rۢSIoMj^" +8+̈́F;jL'O><5 _o㣇XB9=2ErZWJ]᷇e fړuKMw3LoL{n]4͹cE{IaMƸ"<3oDJȔCbD݃{x&"|11ƕ\| kvA ;6d#tH`; VE-&P[O@|Hu;PEnv t6Y _x;RTX]U@@#t̤<087o'5 >\.-sڙUoOOF~|c$ ^.r$ X~x|07V#!fBq2u^[12]#o#}3>n_GV[Yz )18ݬLTZc O2p4^QJ>&\GL`У(ұF9% {Vo"v(,{>FvdeG)J[Enwz7Ij!ib .skc=jLe?9!QWFU~F^)|4,]q2ZZ >,LK/<;/)Y|k/oHzu~#!/ ӫò2LQڀ( ?'m(~s׀v\ۜM t:D|mA< >\1dхevxhProݢ'zzOx?U׼:7Ieڌ4;F"YRUD2 hU^O6Ox;r"u[ Ѻ3G:AB]Wey5Cyb~DdU o!Z3[*ΒTgz5;hMPbjBH)M&Oj,,n$ &TT$dM˾>N삧2vhN~:T;'߮jZP/{?co~2Y 4 Mr&z18^?P'e.D{$woZD5vؽ=ح`NگVxTq>*?;$4ȺD:4~?WC8.G**x{#'<6N<~+ _ trPvK? ~{pp-q!hcco8̋GϧAI%6CP3iS'!KiZ.Ơ~pb-_C,v[O4ynz;灱" *ٷ%:CQWHa=lxDL҃DUbu٤Qҗ2\a8?yhF}TK7ŦQֳ=ԕ%i;7|VxI[01.XI5my G GyRb)^Ј)>L v벞89liuE"wrN=[l " T7viDr˼43J+g4īfE3Hinm%Ùu-}3;݈>F  aW{KH׾) YKո6PQ ǛYH C]ONk~M'+aF<_;I.Z@A$lJc1:>0.D5 5hAu@+B[&?r3;V.;p8U:sBo5MDMU8^)5O0MOvFbSQk{E'm'vffuȻ=[bT^R+bo1U*@\9Z-MXBB,s1i+wRќ`{?|z6Juβb}P޹?ȥ alDQ,scroJ]P|zJ276NCA*t$]gKYx)Ĩ Iӫ+h丵pyІ]tl?IGg(趷&5%g)9:hV_it#µTd pNhCO(=rK :}θ,;Do#3x ܊h&QtqCXs\ Ͳ(P |:uWO:JB䌷x5q@sdX`.ʹcMwG {uf^!HB(BI=V5TA(%YҲ񖫉׾jߵnw,p(bbxO"9aRtۼRg\sTu& (sdɵšJ)Gl4fWAxh{4o帗Q9]`E\:+i"CPMϛs¸mFg=&kʥr^sڀs3gF3ki=/ZFT Qk)ؘ3@Ju ޲ȷ]LH /Ul@%uuZO\Yjv/JJ6^zfst*LSϒ5RÝpԀDwPR!V_ 벰aHqVpJFm-5l]J"uJE||<>4u>g3.uwb>YC(*(F䊩TJ`GgG1%,QxI7ͥ|hfvm:TᡙBKJ8 ?# Z"r*:ndu/7¬ioEÁ4Cz$E'9k_zɉq xoҳR0(/I,#F? <{Չ6@):/ pYxՠOwAYQW yÙ ӵ'ʓ1n')[lUF[SBNl*iwL/qTʇٍq^ш2,Ԟ;W^k_evtEQ1 (_,ݐv8jwrڅޒ]~`'Ȅ6gddg]RfЀ*x˴۠zv+2mHuq[7̓q@<?IbtUB 9P̰V&YK{@k~d=S@<07˾u8BM)p2(0G"e]'vYp!-ݻzD#d% %@+/{_2ÕAWx!o\%֣g lUerXa=tÜB'^$h{zYXj 'j2@3 *,C.᜹ /h):-H)",ԁ DMeme֣ < ԊЗp$vP(QSv/K5mU+h(9C,2HBk#wa E߆YC>} '(e(uښ;KG[\C@]hFa[#~f[l$j^ (]-L]<<4b*8aKv1l\Qq5&7\*e-AA^0+p.XZ2$Y6bYYN.jl&(I씽E,'5>2U񔢴=smuB v̊aݨQ% گI8;(6o"Lj*L>ܔ }cdٹCdڲ$%?Mssy/ryU.z>Z9z@( @B H'׮e 9SW56tԆXW5{xoe㿩E@Zi}l)H-+Fh Bmmx2"',Հ <ӾP%UMVт&#؁X7^}.R q7O2iTt \.rHVBff .*I*$Ka7xFx9ȷzR:ݮLsɊca @)ldG>y!?PrZc7 FKK}fpڹA? x~,7. ]ğx4ːOu0)=٬Nj 5"s%^9\zY:{~&P|sh)iˮWIPf<&ݭmh%D= ×`$ޅ]x6e>Gk7,3559]vdTR/L2 ӷB&|HÐnJכ?oOiO)5M&)FS#?聠FNZ>+*vT?Ѳ\\x M8?qF4^AWM:>r 1)C[ûݬݶ>F?6((=?_kEm2Cg7 rO50BmI\:Kwlb˳ Mo_G:aӑBڈ!uu=+1?ڴK!؛Gls/$sL=h`q O 2|(U4Mz˾a2UyJh l?IQD\,tV /kiIff4e?D"aTޜoDr{0q92ygtm:#=@͙ny ;Ik 2Ub~l!؞#f7nH.-FHPd&XoyVEVo)AqyK+D}Q3w/sbI?3k a7Ȁ\AVgFԪˤB!w%ŏ  {.m:ɲtuOA5pJx&tHqQWxwCbۥ"X(]MV4MږMfvYMr(6݆0;H^NNgݞ5ųd$@f@%^> .UKM_PGvO| Aw3;QV+\!Rh;8$h+6#V̌])uܡ)4twV-I|ݑ7f|zɽS©o&>.5TX{S$cT?8Z]Sͱ d< ۈVhhF9TƲ 顃BjBUidxZ O+]~\Cٽ%iFQl;_>swHD>s&MOo$MP ꚶ}i2>7>b@fQ%&1XG(%Z̍3 VReEEmW2)ڎwXʦ7>O0ԼcP0:zPW}A`CxA4/ȣw@c9Srd)btq;@ !(>>pk'^U%C!^v۬0}Zjˀ•k/)hxL-%Sxkh5% 4.vt3\!qTJ)(<BiIOLjJY3NdCSk97 b䌞 uiA? yK-`yЩR)u7\wJ]iSޒ{ N+h pڙYbfԚZ[l|Q _}X Cܳp&Yg"!nLy4 -n)j AX ư }|0o5xFOI)}<C;~AtL Gi;Ɗ /Lhr?yP-l?0M\#ν{q ((]JkV0+v!nd'$NjM򭘛S&[v,3c}b]owaϸmķq''r֢3>8%-KL7k q|VOrW-3!v/yJ.pMgU!HH0/7g`KE[ Ӂ2\ﯙ#o`hi7H‰ k] V q(s"A}ee}bvۿ ,cؕ/1d+n>Of}P5De+T֟_89 ݕeXܴ1lG5R2Α@޹|Nf[,eiƩh.xyVy.j|cjPmA yK6Q݊7h1Bo7Ӈcm~/ ׂDK7iހ^ vh+ i%\Q}1OeMG$,i!)3CEF_6iV2տ7e3nE=uv\i-,_aO[4u/QXcB.¦e6ec#&(β2)v].b6P{$8gPrRv)"eRdpiH頺u"Ți`0Pye74>e1tO[cfS1)S]\K,l?V܋h1F{E䚅ud԰Yb-\m@eһ.Gk*AЯ2Ec~f*VꁛF~Ho|4>kR uQ,NAi<]'r* 34yp3B0h!yP!3)Hj<~|MÄ#fZݰ0(3j6 <؏}IN4 5 ..E}QR]$`xUms[cUAA:C}˂^K &xudH5'̡^]z|xƇ?&ϖ3EY*S00(حgցa#'&lIWW V^_mC"-m&-y*2G(K?I\`pW틂0 y.T>r&MCk@^ 'uc pك z5^<}9ol(y߷&3#R 8`=KXfm{MYſ,fWInu1[S8EXĿ(+m]W@<թ[~Jok7: xY V3t/}.F9F'e;mD|+a3 60].Gi!?r-fRi#[&:c!o7-Lj,S} x{[^;<#NCv0Iw+#EPqO*8 ug%o@ar*AS|U֛"T\;el7E 22'1zJ\ypY#Noi0t6^𨞮 7"1S ft?Q/"]-xfbv&xqx=Gd { Tfc3g3 =W4 KaڨIp2 4DJxDdBiy4ש cY 5 QLU|mW>֍$Л F[+! G!~z\}bH7Bz Vj&Տ; y*(e"<|_z&y"c]pZ=L2:t>seg_luoaM3e\JP. g_%+)-#$h+]O_VTE&u}s/_*\KUys2&eWEA'!uD+8j< [u)fĐHb-/t7Ae+V&ZY4J> afxa9I)T]h墰pVqlm[O  ~-"=]N_MX ΣD @9{eI~4(I 4Kj ϥ0 #s&ȊL)Xn#[rc<_b>c{d3-vM6׍iS BrYLAɹIFn0tAz7YZgz4y9;U!b7j7B{[ea,g\ ۽*nsѪ~b;Ӥc` '$:kmp9z^-O8xtr: .aU{I_j|c]/WHd كMy笧af\FwMaـ[yDjKl6`x T_ `<*I;?kUq~,G {(:)]2LS,Ş+SelMnbHRm0djC*Js?:cCV-,&`?CNC=n9_T!Гd~N(]y$w8Lq4VdXI±0е$5bοKaPwssu'En! ӷS= ;˶c0턴/6SՈ}WfQX+!5K+MKC-xqx1CD9UKY(l|TJy`<հLzLI\X8~0j2 Gzq"bo{w@|U71YY^P4[-ˆlaA&y_]_}k Ѭ*6G y &3{7Bg{xmoySKP:.ls@)fsm.DuGV:,}(CS_PEHkqTP°#/2D7k($r2R]ϩΗr[7uCy&$<ǫJ7MK@/ΠBkੈ.7^GseiEJ?wH*e&[X\,<{CWz Xֈo"8 P4QOm. ][;0+@M2Ns Ir}BU$sRoY4b0 IE5o9Q: b`Ki_[R#?k,'̡܏7: GOߦ-aƛQiH[äQzo-ysoNz+KZƉi9K>YLc&P 0)4E7љ{%Hj/ Ѓ(9i q,#Ьv: `!C?Ӯ҈fA J[A!}Csi" T|ٻVDS[^6aDG:m-F}yQ:.PuE8WQ1(*П׋sX=Տ3Vf(#* #(U/!Y^n ^zPvY0Ea@ |[% /~^u"alt & k p&_{  rVIBtsnx׈ \X=] g9>XZAfN5YuhwDh*4`W=-CЌʧIB /bS+3]0D-4uv84Tqr&E[G}dndJ=yB0Ndl[ +5} ۀ R-Bzk\o`ԒZj]u#i~;n{ V 3,}!ԡz.ʗܢQ>n8 Biuw̰]Z߿!(Eh: otCa8yjd[:Nj<2 qQ$UA48>pKD9HHXUZ< }w <9 pl̺xEjk-WvT9P‚ nNI6_P@f xwS<}UaMN{8A!`+`ׅAz0ɃB.2"Oct[ě4"m,o ` Iq 2nZw$fmnl8〼BW[]&xSMEvG5:@ 6T'RKZ}gb0ɰ<z"hŬ4$؇b|/oP<܎<ލeoVl-336w: 6|㽎pj[JCC4#v_$ۀOP,r(ALtҫvh {uJYQLEiNLu6~I/u>)WOޜoOO%5NBAfWo#80z$qYц洠7+̝~bƘ%:WnXyhi,G6vf ~~zlBו67S)A5]K&ͯz~gT \@[p#οLȘV7t ES͝ߛ~֟R7T măubJLHOi'|QSvSܳ|-wAÙf$2vG+#)&^\ X|w&H"g؁A?L GstL[7 "+Sn/U:>Ua@O^G+2YmČNvF?R5z9Zݩ>Ȏ'kƥA (ݢ0X '=)QTH U V?MO+; xk=CEzLnP5|XĐieUk)םxY vWët l58OoHVZT>E ޅmWzGUKÝzJ } 0iYMTQz3U>fZEĢTm?ƯT \\ m=R0Q/pmZqʟ*Ŷ+mp S/arsс.^tC' O,~ J4pe7\g9:" (}TX]Mwd/&7}[ʝI.10x6Ys1U?xSQ`73ԉH˼lۃHK,U+4 jlanH>{/,5Cw}QpRC5U2gI@g$ͤژO?"rF !$Fpi:33[JNԜ_Mo'UL+, _.ԶUKP 8p.H9|(SUd^ێ3[B8nbcA@}/7aT'%o?" FwɗPVfUXZnuP?QIR(C"z=,ў+iYƋ|/t 7ACl~͏R|@2-7ކ&N32iʲ"grs0o1h>"A㫒Pr4!l 0=雮G[B Uݟ;zq΢ 6P%gR  z:"Z= yfCʫF9bneZBx+b\FJuԆ<ۋ͠(<ڃIГߨ)ւ&Qp|Nk>4u^RgEpю8PpXH BJ\@E!0euӹڥ& ÙnOpV~r-oYIJTWOzSޖ_@{5/r>j-qkL{Jc'R]O$Ŗn>_g)yRH#|${&i/ѺFdflfr h ߬Q vIvG&hDr$;4%q)oamm7GazZ$Qj1dz *Jd w) Ya٫)L))&P\R~DI{w9BD98HVuqR?#N<'iSD ݽe|dvaFY<;'Am)ɃtvA i% //\ FUb쇮 -BPc ,Xj>T !Q˛uzmZPҬeLqP5ހ*^%Z9>h0"&R}y]b,KJ&ɪoP+yE=HB2P}> W d);벳JچwJXs9SDIf\$^G g x z'i=/ⓌpR&" Ea i0L|NOot,xKVUfFO=cvk\ BV* rxJ} _39gfȖ\A.# d}r.;HcXrV(Sʕ P63s HFMOrk!`4%=fCk ǾO>Dʞ8EK6`?|BR|BYJtl!38~5F?!|^ytXoA&=FE4۴q7_[BwZ&]QҀ'|ؑ8#^_ ;Dľuk73] G2fS)EM#qb9CT(ՁhE,HHR.!ys$s(}KgQ3ֆ"Y-ߚw`ucxn7>ҒUńG;ylxJ H4!8)N}+!;܈T}*/͸fKԊԄZ0Տ.S )$}6d+<^97}Upw\uf<#BpBN3HwRΈ$R[CBX3-S(KO'Lqv|{s5#$~73G-0L?Y7P+\NVVAы?u4Cy+=;6:*}P!BN. kyրwT`VAož b+[@2ggnF*U$e!~j(1C+HnbyIjck>ʢ8N;vՎTM`nDHATŌێǡ<ߺnxmH+xş,> m}sԯo!(xv`W׹d%Og4"5Q [h\ CRtuZWFq1U2a`R4'DLHwEz=Uva6vT cw_F'4e(jS;U*>m~cج-QxQc)l&]&l Lm욜U\j9+b}'8 ],jQtNE{ HWdwS}|Zt8=%snkˌ$~Ti9g`M vbr|w}1>,Xt[o38 ? {H†l#EPSlI4@!;gv#isT9 ьLUhJ!@V<MSu:F-$/` rtulX112#F-?:[ϫ9A5,w['24X=n`Qۯ7(JoBVmVW cznݬQ)9S,X Xkk?^ҏMT/tԠ_V{!}dN>!@O5e} 2-/YdҮb {$S8 " ';7uu &0S E6%)lpw;ª դJN wjAeβ;3'+#TS$Aqp$?XTgmz Qg"}9(*'+Qu,l_-#j2`uvmFǘƽx{Dkjd!Fu2[c9xpd&u N6|et[3O}Ooeʋj WK&!Tx}C+9ijSߞ)9QK7^4gF'  ^xMx#Ea4M'e*=W^*՛[B!]w~/abb\|'&Wz8--C DUl6ʍ3QE5xne9?M]kXMd+z0q\Spe"/.yE}0!fEm {J=к:Dr(006_!BoKv@L!弾u`%\ALƥ[T;//eDPB2kݎPYCF%싗.cSp[羫ѩnv`D!QEem&P*6\9ce5 {{Ei_j?ѱ!-h^¨4dsJm/v 0b:F Rek["Se"حuE5Džm.]݈ty&?yG'd43|M kKrE (`2!!^:@,p@ +RH"ڬ[}?t@$󨳹 ٌC2Snξ_ a</ǃ.k 6d(8?zr-^/8 pӝUqyԘ`T v`b}uL| L3.howR ]rr+5+FF9nKp<򮡢% ~ Rv #z{)JkqFᇄ h`NRJ*3|[gm񽟀Ҽ ?V봁wJW'\!~mPW'5],g!J>~jyn@ J5U>fF58\v0]tDCVssIV_Sb37u'ڪvICI'ر:.i1H6ί~ί@an | BiBsl|nir,D014-dMt]q3rL~;9YGht~moyO{)*0ԁh8^s0t5 j3R=!#TI@MȫDT9cf|ٿ S_B4 87ҫ׸S)bbzD<"jvYzs!^AI4,Kk3~<u"^PYQvA Q?P~(cL"drS~2]; MvY4S f^dDsN/je4 =7:~f@Hb#+nDIS* RI,\һB`"8rKEt"ƑW=V4N+}6S |OPa2Ǟ: v+dN,:]# Q=C;JOex 8Vi{?̨qWe;HD:)T ѭwE͸ .MҳOh~D[f tCNNC6F}gu{D$w?%dz)'sx&Jvs\TpuƐNX%p0꯾f+n !u2(ɍ>-K eDsNc!XeD2L0$$d-EA'o >!w&boA}{"b-7T8QyRj 2g1b@ec~-ZC>XB!dGm$K}+#8OP55=9* ;i+ŷ'/jeaپ ᓴl7_ޔШ́'&Ou)=D2VLt6gp钗r$yJIk='O7E0"+^rn u V]wBFibl~4\Y0Ɨ uzQ^h\|Z7r4yKX$_v4 eJ?ey|qW9HGk[eBR:XRJQEDw:;ZǤ7֟7h6^_ii;n`qu^}o Z}LL Id)7rD*KPt%_l%w$kVRsʘX4 a fsֻ؄PiJ{a%^O$xs`o%^% t @wч'3D. P Dsb22Py7 U Q D0/|)kkDgoCva|g-09 cڐ_u=F7hzF sKjv2"lt (|UoRfN(m>$qj F_z tKpݎh~ Py'>|\NAf۝sy6;k_6,8) S98EFE#"03ϦrA6C2:g|,šHDTi`beYgS>3ݏfQ?ODײ*lp鵸G%]:;oLd"3WM*Jݫ;#rcz}t˒*B J 4O]]A:ߚƍPigg0M,Ey@.#G\ k'Rpr`gއәDῼVwE"[`A09b +gxG6]O VimL|,~#>.N홖|39Eh6cduVڈA0uPf$W)V)&ԙӇ  Pv b.H ׻p).t1)4=VGTYȋ5zq2[7-"V_:N;ay0\:=I99O;.gQT]3<>tBZuDs7 0ӖٴD]By៸u9;@|+gw=Q r@:c`'yYqǔOpgJ.a{bIP2_ (}:sŰ P(9xh8Ƀ5^O)\כ ^D51%`SoG#`w-6xOcJ8,<8Q$zϩfz8~j[yy jَN!8[\rV &~q$KZN#lcx03b?+\S,wT(݀W~h<:C+0<|A3{L QOeϳup&z V,۬Aqw e`:fa,ĴO90 mC٠7퉥 67Kdwoj?z_?<"l׼L,Oe耹1䬔>[:zAπch,%PHQ;[Z{cKܲǭT,L_VM j>gb+u>1,.:ˍUÃsalӖ4@L+;隣Yo>:">5|mG .X?e2g e脆|-dw%cMOnV{g-(-&v] r*2k_MJ>5ͤ$Dj2rk]û#~xaI23MdEs'J3+Rz4XwjlY! Vd7fX;#6~#-&ixU =wJɎG!^ʡG1cQ"˳7搽tfSKnxƷ3@IA̞P+r_&Y[hgc0JPS3<$cś=Bc}E@s!ugJ9%.iއ0W駽5 Eݿ\Wb( uƆSd7?Е=BL.;-鷗)9x ~mqU{w;ئy"j8 byffLRX8r{%s>7[ j&0-knhSp"(;_ռdrk<*$#dҾ=ݣ4$|}ee1\ sVW\To͢;l|hFr^,%T@|s~dNoe-w:_,%n lt=E +Uv`h+eZbo0dVnF.w}ar95[ٳrte#W2ݔ#6 dakC.~J;bZ kbـ79H v%N+\֡FMG~'^~& iA-^h| GKQR,,wBn, O']alUQc m\Nro#{UN t1¦Ȫ}U^L^kao+AQX)42ޠ:86jqFJ}>="Z^!|H!J p"IyQbT{ L>`q疧w-Tt%I7k|=v 0jtqG*’}L2)Mڡs-` pٮ߂,/(4n(FO#>)6u/\r}0 h4RV|>-kt LTh<N + ΁,Jz?p_ߠU\BK7썾gaZXӖj S@; ?}լ@icӶqUD{[sd۔;V^ELwQ4W⮯mL@$tF"V~+bvBCSD$QW-`KmNSB22 `t,U "#FM[c2C#{މzYkb@lpz\{* `%3ݗ ;QPfJCŊU88ZҨAhN8جGH^J׉m<):F_ٿA G Nb}k;eםD3}D/dɿUۋE((6'=3gXnNCcP!aELNHed,FKqȪNgwrML*O`AZsWm5eybd݀0;8GeW)lORӗߝ8,V?5p8?:&3z|6~fI~r\fq- ~F!6EJ$;GaKf#b,ˉV 1ut? ؔ)X...ƲOՌ>U'B =6lh2.07hj& } ϲCKE36 "{{GhuF+~ҙ̼r+pAfSo8I:[ }+ o<>+7Q$bb39V}9|()gҨadl`˽ ii ?ulI"78C1QV(kVnُ d0FOa& [EE*4 v&JDZEɫFk"P mtUwQ,ƫ9m!o1]u,mEw?{dYIc8+;8od[?%en/L{_nL[&)5"VтBЕAdZ51 +>d S=;'kg]߀ZҪ$fH°Qm֐KO=d,3P!iۼN itaܵ_ï/8IR+Ԩ⏇s5QW#טO$XnRwD{^.W(qGCo6lf˚B.Ix+0.Z偱0ă$όc{(G.V(ְ@2c}Mo%ٲiU7=ھpk 1EV.F@KO/n'[)4n)c;۳.l02ũaxN^%%GUnv/cVmTD3Ir*0&D~%>-Q9q'o/"39f]-]~sN{5|OikX=i?膶p4/K,?$ 5gqmYg {@V"AK`?}o/8 h"uJ:b4O9ǔRb/F[l,Q{-;]^A/ˑ#)J~u?&$!]l{[T[`x^D)VkBp*a\Yv&3f37'qw)cUG>gعX!r6j|Ba y#;_ZKFHK,2V룞( AQ* QܾJ7];MIoȷtt/=k8Bq\z~UriybjXB39`%"Gh\lXM&^?*/+,?&zO߂v9=j/rFbE Y2OEEtĆW + }[+GԚH=kURoGGfG6z J7%#ZV#_0Z^7_\Id*ax}쏯5H9Pg֌*$p,-2-Yg o6+D)<@W{Ր). ъm\3Rv막vռI% EV>?d;OzP2&ߖeGFRU/tU*X| CShp?N6!{)ۄȤGۀE{ _>6VuM?b #3*A/RA5tP h~]gMM3O6q͖c-^Gj1%}Kg e(dd$I}M6u] 즊6ط z)K73B=4-`lِwG0ſuir` s*E5 K#{8'ipuvҕt𻈻IVsʷ%ң+ͣW!!UXf_/?S׫Shݶ{&9.+? b%sJ5G@[@3p*!Jb騠?&5wO_qt%ϝJyOog;+mS!-s)0/J._bLı',R/ _fxӂ>f-j}f-M2_d .Kud\WB?蝨i Mkzq7~u1ygl&*`OQ,3 ҏhPs%Zsa|x s2,Y}ڄF" 3+'60Qx A\_ Csj ӿ1v4#p+a@ %@ ,fͭcHB-}Fi^oxZ@ r$)VU0PJ W]dR 6ѩ3]ۮKzq uMSĬtW9ʃ볒 cm٧\fuRt5:=l*hq2VۈRд|iIB<x-An{ִ[jp>@Y5|(x%KT=>JJ9v7UdRם-Bfț.9N7|^6Q8vwIr{a9tdd`m a%v҇ ;[G֗Z_պ}ߢn:6/A a ߫3 C)!njХcS]> :8(AG%p`air"Ds}BCpG7D33CVʿ92.Z`O4z0OT<\y@.߁7M`X86#CWɔc_zg("'d!$D^A%}[X e$Y<(6pa&3k *w/$jz7 ] uwU8{b.BŞ@=jtz}?愆ya{Peا6GBlPOG3jfx.c @~oCM-G ډ[8z$URac[qHyW7$6*ߑxUŸ< <)ȶ2.[ݝgA@T dm|?k> "OWBc,p8wTE RHFX6!z1 ίJJfMxLBkk1OޮP"E~VWK}#c]+!=—ͩbSSfU039\=ˢ9X{D`< hMEgW(~;FEYr55rwd F8G3 l$lXdɝ~$Q@5Z8ם)]H}~T_GK"!ZX^J:؛V ycc?ռZux2Pآ^vAHC@ 9c_kV&p˙f䠕JF5^UizEc*=3'4Iv֣;*,1V["*?Qlvj׎6PE^5uEeEP<%NLipQ'IŃtljDcN({qPl5ocú֗ec6, ~o<@@ghTt(~f5DSħk"Kvc*4chvVxfڗxzG|=)E0)𡒃@Emȩuߊ*h"ZY#V @S*jKU7tQEOx9+>ˑ*&m]kh޺Js Z)I?J11=AZFRxZN!^gxfjď1h7'&˚5v I]YO27jQ F5Ϝµ,-` ot~!3\3 $:z S6UAg y|< Wf38"#LNBVɎ$/WOH5?F%?yU0>ˢ<OQuY| |SSQ ZeGXëM5>p#P8>'1J/ C,tRs\tճM\V&aPxW('qN,:B#8^yVa'.;FPX W 1glJ,^?pؽ#M)} ]f(0|JyY;m,iN|k/,U$419!1/Wh+/x^ wwTCc+a\Slc._T^G!0x\ޑہdE"jcYeE)DJ]+b]F%&G:uE~j#_)GH#/|zD=\ B0*qE9_M9U혠a R=jV\&x~M~jq_`\!L?24T>8Y6ESGY fN;zdTԶ%{,7ݪI`H\G7DārlA {SJM-A`F -!i.i1 Y?s=%WY rz{ {[6am$roY/F`'/J.EYpܑ1,U eAW @id޻Jv鲊nNa@/K(_GFX4֕>t_CWqK==5 vYm_ 4j QAa(t}7M-8 ldNb<5tQX9n mXXCwSЅM^R1šxi+wNzѭ!H2Kd8hEwAk5mPxxK :-|h+rx3%)3X2@9*"/ l\L 8/^Jϡ-jfGo~wsb0d}MVGjB x3uIO ><4/)/Sb~p7h x'wolX-~kXx(%e˦Yoc*~bɥN[ZД Ye"xT 5Ў>K!y\*{ fJo] km"@`"2_YziPv fRصO;U۽T_@^ݚ*M`Lzц]^A툟 wWy)UtTXâB8MYVI`={0tP@[RJJ{P_`ߢc\I܎! Ć,Owc ``u mZоs312KS\Rrco1IʒLtWvUBANs_aH|GDY0N`o~l#S>i7M *v؋̣"D[\:\n*kQ TAr6`B"GsI4>`Hc;O<=h iF^"Cu}<ˇz9%vn̘uZv?̏^5ҵW=js#w=9\ey.ێ8>䂻 DCuAu}CWR:`#0߯6b P.0ulXGY3k&z!aK0j[u6(;aG\A 0N(|&Ġn<qPs"p%t;NlgoM4D?)+./Qk N4Wkyᝥ>&Ep!qZ ;YL'Y:z@T t Fq.IS3[&<}mĺx36;fdX(&P-o B7n{dO=~V^pOٍ(y*Ne,N(X]9~V~,OFN܁\!w:0eI~Ki l4[r$(f`ަK.n8W-ZT1E%̵ZSP#u*.{%Gsù5¤%yIz%F-v ړ Gj$<)#]9| EE===ו^"exXҟt{אwNk`"DޚR)>dx-Ġ(abR>`;&TJЕpKQujO,PkA xZ x=Q-X;B,:N%lF;E: |LW)V&8ch* %$뫈lڐy:qa.0u,\|^ ;3DP}kxg/e,궻 q(0ִ/?&?tb0ƒm ?EWq+V| Gu1$&&%`vF/EP`Ik-u L @*/e9=].zK HC wASg w0҃5)&[Ⱥu>/jȅV7A:v>> ?0^ڝ#85!R +.l0cX6q](xZnU3#V!Ee|͉mAe:TZt Y"u\O6pA kySx9ā214{`} p\E$&ǒl \EDE-BQ"9 l)gkhqf\4)9Z&BEL4$>׫{4an+'7{nTK9;.Wg{D}JV>0epfeKu"κ?ݝi -r#>h u;na6 ~mAġ?ixSKn-SPof$Ք s 5cɟf#!DBo caw7v}OPf'M>U:CzΛgo9бwx3LxTO$h\Iwk+lv$?$42<U'<˺9^Y01K`}H=\嘪M:[b<@o_W8>?+pzSt(~7\gȡ %\&hN }}fOm1o4F4(IߛZ, bSntb1p y.Vد[EnZ^t7[m,wrYX&. ':6/e~T!  w]f' K& ?Go$\*{=DO ^ ?tv/)br-ot~%y=pt[@0yFhm/VMdQ7x8oU^{|(._*{C7+O3lx1$,a) (1A:ը}p[ьyxwk:EɆ=~2Sm*t_׼ +i.ы)r%̇"G(hs7dxDdet ?uƌo 4 |R V=;1!z6ÉSM!:" ͳK#c:/;buXlŠmtcW3> OlfO |tr䖖o ]TpנBac fhPHȍc=6lQPlz Qve2QWi[3W6ܺ GEB}LKJ銷}k? p.P}Δbe7aEqͲË+< Dl_KKk_]'f%/*L~<(Y,Mb^*B V'olC̬ß2fO]S;${BM`džfBJ=\qc9:Ÿ T}6lSs+/?n2e ^Vp[|Ȕ!R~̸ V,X4xL>__4"`>g[ P%oy <-..w> Q`[,B96%'ҧy-uT|6}bń+-+ↁ4!Ja>GVvX!WWebZt]X,B9Hp:HIic][ Ia{~IZQ`Tr@I^gKNT =7id>+Tm59}|~gհy^F "[No܇Z43,Q [v3PL ӵl>eXEb6[Yا~UQ8"(2-K(lw 8RO;SDdP͚AHz1!E2a'a|RкEem&q}PMS瑌[ .NDAͩPpsb4?uky $CpwL=1f+<}aVX]7O_sJqVKfh w$(3F,tCLTUk]t"͵F\7:J_Ȁ@!D*+>=H !2uqXtU9f/7ZB _ZTݿώsLU mg~BZk<4%ޗ`E3nHOrIaelş=2tU@ TeJ&k8D?9(u\s֟vf`8jW;#jm'{#v}W)}h ղTx cR߿'{ӣ2T?hðЌo);>c UDς./\1 9? r=EA(F{\'RbB'K`So%;Fa;5Ȥwx T,"MKEyL]>xS"x)Kn$XڵP}: ș;_tG3ϔˉhs-#4<o Hus~W$Sr10Y#(=nK aFp'|@'ݷS'jVrfET!x2ke#O20Wo[?>rn1@z0ݑ^j5)!t- ب1+>aʛnD%;幔}Rҽ?;zBib<=MS]sՊ 5"8'.4φqnЏ[Lr×i <#-eĎtL$}G[)=I??l]z9uSUo۟[ōGC&Sg/o+L).*r[SFXQKf#[:~'/G6Ӯ:r{xt<6/H [-w4ת}Mtyl1EGO M$< tP~q7Fp m F{ԍL/ {Xzisx22b|3f;O WJǃK?ݪ._:\ $0%4!Crt%A5pT7qnDO ߳V x56[L lZF;,08JkW9;EaK5yv/D]%?"xHqU+sGIO> >Cgvs l^zU1ZG@vKÑ~FxtrZx%4DI D,dCo5 7R~=\A|'gUIQFY)p!q[<{B pY->8|}?q[}.v^s=͊#A[koz&f7: S"Wza7?+_¸OsIՏJ j2fpgaE6HsQ79UW82zOvxށ5%xQBrHp~{$fw= @U3zT "u)u?hjqSe^d9dӆ7'O~9pVXȦw>vnydX8wSj1<]2 9L%OECy϶%qRDBڶ@al)bY,|7U[i&ؽ؝=Ѩ2;s#`FR*N[! vC5@g{\L`bݞ/'A)9]h}Ycam$Ûb17B2\I Kc9mTF@Pޏ_qX~xaSG58i{%*20(ڀċ>ZP%%dR'U`_(GΗ-kR x^W`T23ToɯÛg46eq5 zc~lZ`xaJ#.8.{ƶwRnb%Q֣rJ0beGkX%+}5N(XW4hLY+Y FU_֐!p8]9`ڿ 9|Vm?@ [XK 4V'ِ()I w&Fܞ&dhKh(rtnjQ?Q@VR瀭kv`|lv촘WQ."JXFN'+n5'>po?>꾑6Wzw>h"%#j Yf j5L ZYu\_F1BJkqP $⁚>,+],f W;E`7Oq 9.E//4=T/wAtYH7-fA(-yl|ZqT~ݴ2;zW,iЄһtА$$}]egfWQ BM#pdp UFD)"[a 4\bN @4C%5C)h4NaQȐ\u/>GSWS6xtu*xfs>F[gR)Kgtwn2L9 kwGpYu=Qiv U1 ~vߜӲ\}w \Q/p4K& 1GBi>*E`} _W%%b+Y֛K²b-aL+~%V6xI62N~m=:bqҿ}ͫp[*KaXkqd,#V WMF;=N_϶Bg`spȺ˱Do/l,T(8xD0TuHlԧOwc<Fչ-\_0H$G&^'JX@"` {Fk`` 䐤?9Jm _ ˿;̽۾SůfwlQdH*0 "k:̜J#yԙ[W=F8 $yB0^EFaqxt14Mp:u0%:Sp([Aٕ /B)*PZuw8q0bpWb6 ㋙-:fK=gQ#J h7E+0, 1G6ŭLktyX!P%#O1+JϺU d) KUL/-Z|s9*v 3 7y/+=]/!"Fdf8<Ӱ}k "0n5l0>8&dDGvWPb+gĔ'#^>;e}qlTG"od:X뺘WFm,Y#ϚN4(Xv͊,J0Kmϫ1+OvĒ3`AIAq2G_6r:걧!Q7w1Ib;r 3%QS VwA ]fOc7tH)S#$]= )FNTuS(_7^d$_hPs T{ ~e΅U|]{/Wꉒ<ؚ]j7{8܎ \&&?-Ns*ߴ 708et]Pj8Ϻ)\zv73"_#_!Y^ ).LeaPÖÔJ9o14  .| f[ep:\TgDqe!@xzjLk&UURQXjӶxYJ>vđ!>Q4N8{O:W\jNW. jJ_ 6@8LDlpwlϿ#Sa7(vϴ~悹#[w26Dgw۝\CMUHqP; *%lnVB|S+/ P(l__^MIud8tz'$O~ChFRۚ@]ׇ}jผs\h`Fg:UԐZ2o^?qqrס9/?Z18l0({|wiT:Jmi2̸ dDjM#SUjNdBb,/E*.0z*Fq-OOL滯DUL%\)UŜX*g 7g3ڋJƦy͈ +Ӕb=D:DCP̀x2u&MqݗItIA#[>8²tߌW/?%C$p;߷dҿ|DMP82p ) exѱ,lOy, T+wW'pnRAGU|( ׿S~D<Ļ9ۄd'LBD7uqKRz,b鿄Rf@hԧ_.,L ˓ԕzt]zeQR}c>lxyvDËΡy裪hWxs+frLD?b5Pڃ(/Y}L >;fz` GPJg NHy SIO,g)AAy_#yQֽzu n{Ot ¸T$z]wcj蝙=ďL[m[)<*+Aa m*eV(b o|Ógvk %4q5F;ā3TXgj yxpT.`H?w/x;<H:&u1l@mB@-Ǖ۹EDpM\ᬣgRZDA{9t]aHbpACm)Δ0BWYm}DtVZ<14( 0nE]f6*ϥ,9TPA hTh2A#W%qZ6Q/6gZwt-zo'|SK[v4=8:tKo1>_T*aԛ&]/Mqg!H)#+5HzT]nmRhg^VvPq4FσnUX#/jf`T͕ "LyKМ~_=#^b}oj K㆔ڈThnC\lu8GқGTzaCIiPwt*υDרncZ6e_,ڮ);쉻f2 nHR!JpWhsZ;j:֋eIL˦D!4%(I4V\q) ʝHdAT04Iaœo6R2BG9yZ"r 8;m S+g.» M y1?.9T(R^Q8{+̆&{Ŷ{XW(9#(׭cՔL`'nReX ǚvq>?),[=g&@ڵzkt|U{[]Y >#BDTut=er؞W0d-DNYJ^Je8d{mAZx'IMCf||g^GN ̔C qbd&@U7AG;~9H#xtܶ)T_ɖ-ajYw;~ dRѕdbk#)B!_gEď+&;#Z}w}KPg`cސ3GEXm,&P/,Ky~8][\U .+8&mNjퟱAEP\֎ȅ[$] ~w*cygi,(SWqSaY!GgZvt i[?,=iߕوSLaѷI{+N߃P O-34 }0O[OʲBt2+KМMU`=KzZ7mo[Y>4I[t `'cge touߟwQzWkV`wq6S MyH/HƦX_xE p *GEp䨑.53.abOdV YerϛE!~0Uصs IqVQ0p2Dj+8OU P ]rE4E+έo91 *C @}8zp *Pż1L孴QT eNO7$\Px?M4#ČnL)?1GG?R! |`W6|֍1E+s4E,-υg S'۠.^,&ZCp%Od|=ɠbFѺE#qTmѣxۃW+\MsV}.mbTDyI".)x*ϣ &QmNެZ=Hz0(BS䮌)Ļ/7ai|>úʍtH4oJDfnW ג||sM rg,L){,7i; ##^j޹U.r6n MᬒW"KHKvP2;ׇI2U;Rxo#*> qEWCST ?wɅwjqp-} !c|=XmM~,0 &`e~ku{dFVey@7 [7zbw9`LZdAg2\#mIsL B`Esz((2sX˂$ Cͫ;sיG.>E^{ JS\,"XhRDȑ n?2<:(ZM2fCŔ ^+E@1X7ݣ<1玩(U$o`}e,_^JVH%M!)-#[:vI|޹x!HEUB^CH,T`ь޹mEUaY?x;q1]tSM'$:u0͵Eo ¡yA/#l;Eh;K{q_4In Q6`з#%;|ePERszZN(Q!r2Hؽ|5Uhy> 9N5l$B }]g ܚ(d׏s ۭGl1UE4pxWh*/"tG'Nw(|Rvs28[d.CPSպӕy[ :ʞLg LV@kN6z%`a Mg>L1ޅOf=$Fm!M(R^F8sў'a9gQ6E#_ɹwNjod㸾򨘼z;qo럙 q$wkÙY%}%;C)}|BZV֛zpKS8:>Mw)ʳْ7xx8"*M#2[ThJZ2r, c *6ؖ3; >Q&m^uR,XFB=~TKL&Rx06;+:{'xY:DEV g=W,(I1]{5~rJX||硄p2KgA(r'η%_A"L4v'镱<<$(PO`"gp ݋3**u2(ie/1,iZ|ֱ'zG\XQg{ ս$fQ|:TMnM(}R2& LgSk`I'y?|-I)s7_رtCy2H`?x_ˍ3{|1ix7 w$?R:3_1*GY7|؉'] ^9}v{Np^=mA.T@'U1gJa ^`(#|4j¿$7UVJ5?l tO #{db[ņ B%#hCva4; \ŞA:2M u5wtq\T%a1HL׆Wfzw3+VCH DLF&KYLz v#PVa?mqZR VD#4PFj'G/ s,Ñ VLuUp/*d'k_g"\ZMN ֚nl1MoFSFT/dno}$`VfUfuRnMJ6> ~ Y_fZY>*"D} "`S7hYi6[|is&-%)1DygKD36cU?ۚgis%U 7)!񇢃fv*Be*WeCN/F1d/THęmDV ɧ*{ZwJxشF*ix_ 7%ϒcS`7 E:ff&ta^ <<5> #by< .=Urת*2_3Cc*(CWgn[T{ 2W_%Y8.%wZ˔#oӮkS&gxQǽK)k m)ǰIkqUȗ q_ɯ0>p/uJ$gmJ8 hǶR&|0suXot hQ;peLG6ܪ}RTcSsɦI+}*k N+3^I)`Q\Ĉ|<,mZUe{+W.A> rU-naլ͎ɛS[Q(h?WBL$Aۥ*xɢl% Z;lr#!jii |!p?-0щ~*I]^(0I)GKSZ'`#ՙ*_#͍BXQ/Et+ZZX2HFxF̡rйtݻaUH bⱿG{br٭+ asﳯ1xXnVާ`xƳ)+:=U5zH| ױ̅ocT:@!/ uUZ=Fyh"-49SF7*13#֜Ԫ/@R%EИHıC,#!D:;nղ^YS0|o;p 2R@Gy.! cߟsx$R cĸGZ`}B=$e"po|osP> IH>o]23Jhi!^4RFH:-WqvQGZ,C#խDM+L2PW 2S !;ؠMՕkz|of_ITe؄)ހ6 "NoQSxm;3å.iJg,>,(豗C,GuQfjQzt!DB`,+=^},D4˕.if.Yr"G\REuϐ( .t K!rFWqg/5:ߵg%nOJe7{lvhT5IB̀UUX'UQ_FBN5!j 3:C,5tnŨͶcj6݃PDRȮV,W[-)Sخ;ͧ 7(}0VPaAmO(x8*>'iAb:AH#^?Lް@3KVjs"R+ꦥ;~\ĸj챑LYښvo5 q'~' hM@(`tйĸC8rc-v3: $(LIt'6& Na+='K?pUęC>EqnZ[tTo&ʍE(i~'C|&> Aa/F7&Npr|aGnPLsm@\rބxN0}TJ?f ӫtNAjt8TIt |ҕUJ%e;&΍γ@\d'‹p?Z;:& 4w)/<'9oMթszcBaO9_Z1E_^Wv(>0`*{&B@;/bt 찂TFNLv`f3tqNjm6$W- i]>iˍS{ViIf^sp64 RI# g>p$JOmb;ObEȹXQ9pA]@' '"/.!. i28#juSn'Y۞.ފuuhK8.S 82I @ )a'B]! NNBF&]&Ô !4Z;ֈKwy{ A]}UiLW+ր #g5Q#X$v_ 0)PK+nnT^/ǗM=2O3ܔNXBfƞm u.kY4A\(U|[]PG]$rP}-%K_D5 qG46aͪ쟉;\pq禺AIDw?#Wht[/SMgWUs# @~9tO [O::^U77m袮X|U3+YMvom.I6Svx wTCWU$eX#_qpoOh!堵D[-E ey` df+%tZhj/cKiϔo=TW!ȿM!~7S!龂q%b_vݕyiQJ"@1*74չgڽUwS7|\5]* л wXo!kkg3N%WY.Jv] [U8_';@5KMC6A(weg`/< pV r&lPA ?_e4ĝPG+%/Q?#e?1s 㿯E^ 5HT[ 48} ͊'uk)GRe'"m%ruE$qц$Е?J}ϥhf;!%\|I5ui~|8[ؼ@_=' c' E Tr*zSJ-+`7 Bc_Kn0/p M`]F :^]U#xkaJ <|46u pase?qoV b)U^(ckR IL !4 !M! Y|#ԟ1L_X58UݭT c+\]4Ǭt'"(Ncwk?jIG푡 6Ӫ ܾEYf@~YXomڏ_2^Jlj4D9옮)>1Bĕy<7BLWٓ J.Ft?LW֛&= `YOsRm_6&/3͇/ͲRr8Sb|JK%~lrwOcXC=ds?Qo2g6zd`u2c/p\$ɠוJ=k>קOKC>QlA6~7Oh.Lz_;lVwCaZa$HZ`뎉@:!@}gt7Oĉ)wN.)X)]Yl#3;>}tWcv >S $z҂ЎJ}a:h@v$ȭ>o*@yɨCpμgܒ}k] O'+䎆?_1HuH Z sU>*69։kA"<.:?DcWb RRׇol&`vr i*{HV-pm` 6tu,DN3'.ɽE= 9]{S ku6SIsgj(9Y!0״;g" ј F磉bJ17ĆA{ 7FR9B_6}ߌc:Bg!j@k^+eBYwg 59?`egݛ=top4A`o,cZ; ;#-ކUGSOH[ p|SW8 *.|rOPx>=St8mf-%ow.}ѬR†yN5wH'&q?UNmKiN#Lfh}lmAI/B/'\ޱy5r'##/~ *.*e 4J_%ôsEk>i|.]X[Kӽ c 9j3wua`tL%㜏7 cf`>7Pw|(QOJ07g OM} /ٖFg?B{2WיּL*+XA;X/넔57.2݇ !+bI5,Si1dt3O#QST@{CwV8' >,M0 ONGosީ2S?Ö fCB`'.vbÀ[-k|_q(>"T9`+{ݜ.߾۱jL MA>.2ъ Ϣ&!xvt"A9ߔ0&Z*X9z5M8OzuhfZ5jLdgH6VVRkR=  T֚|QNf*Me gr,{XFs~"$Pڡ)BIN66 : ֵ ]bCLwb:6\ڥÒ'nMV(ԃ\ !gb}8:ʕsdĵ3Elk;Z/hV}8OG7)i‰6#/ʅ Ҍ=_Of4qޏO.6 "B)mM$A5ZgEct;Sgbɯdl/\|mNA[Wߣp8{!J3k@n*L D{րu !fYU'7; ͓ז~ p_UY/6lJ8klHo]PC@: ~+4hH |Z;3:<F㸦:f缕k#H8MA6 ETurYs=4sNu0Qtϊ鼎D_?9IM'G` 6]U?$m[,ס-@t鑄gC`"TQ$t-CdYJõ;r׳gEϓK4ѭ:6 ˳{~Y}xaZ  w4o[Ad3R'* 7hgK@ʽ$ҜFd8BC9T4K)qcf M`$dkUvu۟2$^P(j.xnt#Ι 4u Yjg9]F="M y;W:״l%:xߝ^M9r9dA!``z<H~oE)9+, w^ IfҼǝ >yf/!Kg ':|{V2|n2}8^Ɏ'^B#@Fy0l`'gJ?nbc@"yĽҰ vZŊp+8OO:^G:bճk[#$$i`ƥS0uyOBKڪΣ~1{ޕ=bh3.[XQ*aj@$(uGdY\δX[k?3E{K-QS^Ͷcʛ}Z¯Ԯ0ю#o tN#C7=Ch)Ǡ}]& H2T”0wz̪* 8dhjmP/W'=f&`n.SÕዾXE$VO~Η.5X( 1FF']sIX*`z>%g+lф/}ptZ~5N(IҲL ! j>~YY‹vNȢ 䭇,lZv{!Eyt/y1n<8 l[y9Eįwm(YZ@[{c('I?s}}BurGKGʮkU 7{Cw9fj)ՏO?*AnJA!>ڽ61Ujkyj{A oVBgP33,{9Pfx;grO'2 NOdoI#t첗x5AuP2g@|WZT0+>]I: Ai!t@1Gf̣f5o}FjE:)|OAcVR V6@|_>9o'G.ҳद5% j;pK,6jc/ y.F'`KmI أ.Q\^M x$2f\s/Ҡʵ6GocDt誈nnY yK}-=cЩRUv(-\更( ʊk7fRQű;x_=\ o.B" tPhh"FQB$o/w *%F&ʦ!)=&eA5+ovXY*wהU4@nKsrti&qV Sd4sm- E(CށAt!m ;'|hħBO ā'-!۫FN[rgHTrw Wu3].ZFk#pֺ1I,Q0;fBj?]XA:Mz ODAv Pr'&C&U`ܹ REI>wg܋,¥{$j}| ;#p`ubd^2\a(cʫDb,: 3TT+d?tO H 6[A, Q:Ahjb?ZQ3f.j5xp"X{yK?o/: ܜ)*Q1A?@AY2Ǐ1r@,u]剞[XÊ m5p5{ A\QG  } oB:K\T?Õ m*~2h \5%2!yazNLzYC.^)Od2wüT ư``KC jC&_*m!d 7< bm@)i I6*9÷@v#*]۵G Ț\,]i岧Ҏ5> knCAJ+amtnSBܨ>hEƾ=iG0Haw¦à~Z(*P7EJ0n|@0Jp+&OW%N@1F].EV4f8&~I30V1,:#zUw$G.a²Gb3s]c\ `#H(,bLp;(6V rֵxzhPñ&.eBkaG.DcLVQrv [)wH7=[wPf-ThiLǵUĕ.PѢK<RXiIF9gxq* \Rn/ ^3[⿛gm֯kt*MZ,wI6g H"uƉL8\WnL;cc ʐ]K4kHe_|r=ZM>:>:Lku g74|evtz}׮ʃp9<`=zdj'nRm)%鷜y (ݑː.#<6I V5KBV*{+566䊁bly]/H\4]Jav]R'eI*W+[L 1cT/tp>Ux2$+=/ r6(AמO \!l]u~-Ggȕ >#[mhX+Edd-]@kqA`#N%婮qZʲCH~y`9A4}ص]gW(,w%P4l%> [L17:ڃvHxJu߭u`{Wzlq dRbo(•k/ռB扊+>֌0e g%~P6NR8`\'A^G$xvyVV˙Boe{5!e>at`4p4r1Au0'a鶇զt~5t G0>C|~#X-<[!RDp}e.]px+)PӠ.|5T ôֽG`=(C?6ΆK],rn$*.PXӻլ%pc7At&Y akpsn2MsDNE=wEGu@YmzkKO4u0e"agrZēZSͺt?LtiF#:SD!H>_U%14Z1v_ ;AK%_0Nگ 9ZySKZD^zhKUGƒL3NY;嫌v'Rkcg xd)U4L 9L@$JyDF¦GQYZ5,6&gOۣiiTL(ۆzhwѪZWfV@\i&ZM &i]2 N ' S k1du_WT-n0  Q>wր@-sd[g&h)Xƒӕ;Urn&8 )9Gk+0 r"X*`=e*R氏P,w~]g t"D[S?Gf&Ϝ2V6RxvEe`zGϲ YAR*#kdO+- '<;x\շ:d6ec-ܥ}Diڔ>ڊ槑*- ,[_VWD=L9ރvXT}L'IBgY4WtN,oqy)䬒*W䗟wp`f.BAwWs)GN~};_=4y8ʣ m !:hcL/aH2v M6^REkV^ [.>20O-':}gaڃ˄>L#k- /0 gЎ'EM;`sFKE|Ya=">oR㬉BQ6ˍG`Btjx{EL"_I?V\H"2F/s^V`%c9k- G=+lbd%{LTbTьW /2ٞ: 9yM>gz‡OAY1xkJabbO1D!Y. /μ.6ĥ,3^DfP<2|ʻْ/-=`l3<>TNVc/NeP!B]jEՆ9@ $\9 P bM@\ր"\ .聖 ohwv;g۬o14jv4QjM_Gpo˪(Q'VJ'eh\D4`)%`k9ړ=: lЫV6*;pqrCR p!#-/|=0>]-Vp~~vp i`C.6ɷZ/JQE0`bѶGqڑ*H=;d O6ƕ\KR3VWnyIcBMu ~g3(=6Y;"(.z-\'}⢤P$ L;BI424NtO?pv8JҞjpht& vQԺYQDbp* l9vA.2Dnp|fsiԎݜᛛ/j;&VDkL0GNu׆icI!h_B3gܳh $1pmEc4{jTv qvۇ l!✤f B`?T yTP8]߄r #c#=R=Lg%%T @!] * wAA|@?&9j 7 l0Q0"|Z+!镽 XC#J.F;xbؒaSm25vo^:GK7֨iPZ DQ!Ա>uHMf?.K^$ *"8>[6`XܾkYKsl@E,o!A5[ҿJdy# <]j")]e[P`cbA,D[E`{BWeݶ ,dQvs]+Cd%XAyP' /r*9|eLIrubMfyH .6>Zv7*?^&_$-O1)sMRK! CF O/B[RGnxpxRK} 6.T Ƿ$ Ъr}eה$BN̪K*Fhahj泉= 45 ^pVCRgԆC[3:ƷR(X7aѠ/LYO@HzCӺ;<5M NW"Ѿp-Wu|;uON2NYo\"8Z_/WLpmyR&ڈgOKçDEf8ZيPO!8vزytі?7K r>i&Yjq /[5f#0[J}QhJ*_-/^ھJC71(DY ?򮴢 GyRүg/R;~2,ɨeU2%ȸ/Є/Gn 2>Z~.lD`'([ MJf%DOZ{*̳zI"1#I=4@2קt->v T5g#Dx1DMNcli}Q*=.FVޤG>J )H(ݐ#". E\WYbvt`FprH2GlB㿸ثP0zSӣ̫ڠW@ zU G&t=|[7ѐfE IJ<TqV>J} l q'Eψm@j4M%8{BQ A)fKcinkiEubC[ƮNPƸ A7]g%a 1EDX@аRLp'v"ug/iwqq'>_@\[.HV OZ5/{F )j6W>󇝎H/! XrNU@tqz TRNTw=9@ynȓ&͘X͂w%J/!ā=[nʙVg?~?xtH5#s Yҳ\#q8|A!o%q66z;jL hUq,ȟã7(U570\W V1)IaHőutJuvh 'AWNCD =-c)R )/tk[#[BY.#q V}vW౯6L9Ӣg7k7p?z}XW98[hF}+{p`ŗNF↊ڠ, /rRom6rA4~9Dt&^۲Ԇ!r%[E0Yj4"uTνXJq#C Re$ v)=\ܩoQZc8oWOoIO[2lYNS "V훙UEYVrM2@NsXȏ3*p*yi{y e(Ot'\JomR#[iLyfbJcWQ[7SmdA/+Cc<78ր!0/f!n>eHIG>> mʑ 3R tJ/1U٨ۂNeQC#]'[~ޑ,_"nC4Z ee>YRX谋Hpx8bvӳ_}b&2`_օ_)1;ָ5=ⱖd (5$qZ6CF,(?Cr`,5m|[t nFmVn1 {Ut"3m3y)CHnj=tp|eϩibfe,9dTw4gϿmH5t~ 䩢TZ5Brm+;~Y KaT jlel}ET.5L2$ !ƍ7_7³c=#z ~݈{[fa*wV}AT(?{%Bm FJ \Hqy=p ƊT @K1l )(5W0pPtݬ ! 4] R-vL U=k.M6e0 Z R#<%[<}&RX]nk2v遚-HoPmf/囁 /N GSg"}?C܇c5cKMTDA 6s_SUe^S[)'cV0Gap;oǚu~˝uѥYA5 Y*یيZCCqC=% 6RX#wbgv(jax #SOh%#K4^N$K3W.ZGjp$M%aOZ!^POUw$;(B9ͻV%_6XWF _/4P xn@TgA7q<.ƨ;X*J?Yꛐ#QDld QA.2.oVZ/@?-l[+ F:{OQꓘӈ5x}=,b 0KxEiy! Bݲ~v*E 6pwIz;AbNT:дB'G6y.5l1!QM}`kֈW{> LS2.9VU̱3ynw 8y7!M@d%J ;FffĽ!םܾ꧷v98P(Q`.0 J^ p3sҽ:iYz^uutKKDM5 EÞ(2d/BqE |tVKjT>y#or})D%zGЈ+GlW2!DD:tmHMȤ+!eV]%I+m ={=^oVtDŽ\[$l|E1F) X>p{]CDVhfUg-PkQj;RKGI? g8|m?e^J& GȔbaaJyo6(]~JbRI$E=[R#_yYYSNJqSˊ/1ٖ`.I /C]9 P̕.<,ĸXaׯc`ϠuaxFp+NhInM8¼#[޳}H= (wqzzOo-C]rA\DPVͫFۭ'ۤ=>!xH-#5~ʶiۥpEKOҍk~Ⲳg{]2uP㺆>4tXjj_>&c2r)&o!v ^Z 7oB|Ե^j<6'8g^FN*D)DV,MsQ:+5O%U Qç9|zM ) hZO9 :e@\`q|gK8^MR慌@nU=jhr،Dϋ;pWŲc_[=2/S;"fz?,D@v~ft喝aEE{BnuD D EyQqtsΦA˚xgecBOֿ``\!!:rDH >t^.귋203kj3' +sw-Z4+/xϻ1YS^S~^@NG i}i$J[gcyHCbA%#u~oA+#qc-4HWNx{[CJLLV9k1?%$;Vؚ ]7:]~P'9De,N0ݲnB[5U|uc [)m`ρZc8^Tdl'7C;aRhS_NZ)`}'1(c>@Au<*-0`IIWɱr:5) -&5 yP&H@0u)>m0(LRCj= Y 1Kb8J{+G{wF|:`؏)}r6͍Boo-XU"Wm5j ?fQlq%=],oqHnZJEDF.f BB.)܋H`8ad69rsoԆSka#\7Eut_SFkfQJ&@̃ Lݕ<Ǖ;`D$*^r0W/4T92#pdU˦Wg]"I0.d@- K"KΦ[v̋U (aVp>'y"Ry%=7Dz@uc~ 5nLKUe&PϪV+)j9 p^UTkP;Noj lPaۃ6Y EQ;OWnZMX9p# ؚax ٫B}ፁtγ |;2CX|:(;?DRfv[gzAW2f.VS33Lιњ#3>% C%,٘9饰;-g9 _H 6l"iuq94LOSccٗ\m M;uIDXL>r?!=h4gX}Y4K\Av,7p*\[@"(h Iϳw'kܿz=J!^/D$j q)_!]-Z4xziBqƃeUwNbEV<9LzO헸ShRz9`Q%,?TC#j6{F?>t֓!pݲ"w{q& e0っLlOsIޏ/Jaa^:o)=}k}=? A[tfeP. V$ oܾpPQS?5c#~ivDu} Go>WQI9&fH{?EAnpr^_FZ|9pK.]u4#gyHfn: _Ok!:5 Mת?={SIb!GVpFArJ2/D<#]vF3[!?$Վa`ŢF-U>Go·i-U"N?4a=d-< t[ocihAcV(ҁT0ӄLuOb˔'\:gGZp:2&I7|* X) I;F [__lV=^t0lޅu552֐#q zw}UC(T)4r.g ءdC_O| fjX}ME|J $Q:[9]|cp7> E`n EыjJǚu?%6Ƽ~;EfK7gi?c-RQMK@( le+Lϧf5(VX1{蝜M'"II VT/r <լ)t(LnfLW= :~ؾ Z-) c5 mhS@ UZ64![ɤiNmu/.Ys,9ܲv> 3Әک,s7Y2QuWawX]?wӖm8Me24go- z~5$2 C) >+>#0U@"%`@@GT 4Iq$@.;#8՞ 4UNb-nP˸d?bxޭ'qńblY0kHSYНl,w&7_wi5oZ(j!zũ:?뗩_ l: ft%*4+ײ:n՗rH)Y Dz-&XVkFgݰr;2ؠܦ<Jvg$v}A3}CG핐G U̥OTLdlw< bLuzvNn앯'5.|88rNߜ)YQ? S7~ i#>otPc1Wy[h*`{8k]ѶO.[S40e:ISѥ-NqM D,(݀ 1RTK (qĉ 6jw : F|QuZ4/dun +1O'@Cj 3!ekK4,rB`+v_WWamԫHir77lХb~-DY$Q?r;0`_ 䂑O48,  0(Q |FfxI4Dc9$>?'O]P)|R-(9 Au5ߪ @`>6e܅)Df/mE˦hk ZW`l7|)=pB[bձNS[?" ݭEؾS#*B" ̢$ɬιvM¿7?}u!.4gБ/mdLXS>d--8VԦڀ3[虎/ZhmvY"ҴZNYyxCNiB@\Z6ɳr].omV|\Oі*Pf=KYcY:z@|,5nWf^^7OߪJIW)HCRUݥ:Ze Ig0=Bڗ].spn y#>hHbM (t0Du"|FO~ieG ޣaOKCUqcMpn$xMoV2CJ1Ϧ-!M(,EEnRvoO!I/v& ;{,NHܧNf Cw.t4uuy3z'Զ~Th1Fye챥}$$2r9}0=Iihsb`ϣ%ՊqD9Ae͇iM!qDSNR*SjBCw!+f}*Q/{8:G7Q=ִJDZq|Fa=Jv@aLAvx+9>qZ9=Sg;#Qum3ג)̷`^ d Җ]6 x˹Ou^-vfk,) VO7)vx+n0үAy.MH) !h-L!$1JvؗQWa ( g Lr)M=4 @HR[u^2)H' dt/"ܡE$rXkO s9{Y[:T\H6mȴ̙[CܚgNH1㫌h}6 0`5GfhZ0prVIK1Vk~R]_lhMDZ"wj4ӱE23 z+WӝXQWx,̬$c0GMUsiIYhwm?E .3!NN2g1L5 C "e5V { v4+:\l*wZ~Yڿ̆,a*ėEҟ?MwI:y jXAo4W)d3֊M$~N묗9B,Kd+^FhQˮ#P]3-վ̙Oz}Kfc-fc+.鷆ݥ0^fa Ŀ ^ٟX6ԅhU<򰉧}L|tQE fjЫ"#R:lS[s4ibӃ2G;LtAQG*pt#ik3ŀ! tA<.ISؕGBV,"ɺMX:+-t`t B&e`J{!jxu'צG5 [o0)H ?1uj4r3V* ,bl+$'=H}Mp(Kb[D(N6AH;쨤pWErM OG#SWUsQw}gn Ի =ڄx*oszZ{x>[cNg/wJ=_*IBo;fбyg*O#,'۱N]2ٍ~J(XWҖbX$t1NnV}lL2_s 61'iIAZ}xN CCK-t@p>IhSZaA٘+ =ğ=΁%pnGޣli:Q91l &QYCmB ,HgK)6wQ%Q'}L{JQ%|:K)d^as5-r47nҙwI~ =#4^Ne|8(?ұQdq<1㬽H n2j;iLN5wzXmG 2R-VDCQy6Kf9iZ1P֙O6?0_Tt r%N#8äi2ڍM&cAJ3]eQ4sG#)cP\ ք5=-$ФIF;: yS,9}e/&,4TMnw 4ql?+GѨɾPeU405S&TW}_v;̷.9r GGa:`Q=Iҏyv8jgdhlMl"NOv{&Ow6Fզsa~LEnqx۾̷"HY<20_ `aZ%X 4JPnE8^0 _jz &l%'=;L>[[aU3wOUq?c[!ű(p$Cn%/M1: C~ -dY-^2JrD.P%Q?k/Ud ~XhOrniRYӪy6\ʃh8hPcT, ]4CjDS?D׏E> `SRTDjŒ*j0@h->O z}'#dș[1+OdA:ȉ|kȧaILjWʦ:j]aAi]W`s@w-08,DC0ut:I8j4Rb1`zT뫟]<.nHd[Ⱥcڴ8R=NŤ]جOZQtlCeO&35:z6pDFmr@U6" /=(FP>nJ cJ+QvIԓml <סO\]N'@]\ y!i*wGI86X,ƣ D<'i5Z蝞'\ a jWuCP*P1 U-913F^P?S~"(1*vW%dȗ:K#imձȯxiD\ {ڔ׎mxm7˟ͦFxu'R 8UҴwK)eB3&Dsiz_ 5}1\'H cʅ9ar48&z )c(df$DW5*9~p)ZU:?A8IQ@C9s+i"Bu|e.nl!ET$>@[3ȓc rw; Y3uύ袲(qx\l*{{+_ܛ'^S8P EA9ID'nOdV.!g>11Y[}(PPL @s ^Sf! 2v{a7v p)?H)SlzxҤ˶6d3唛[[9^Qs B5~h\(Gg:uU SYnv|NxLmWS0'=w5q}` ?jcJi1(*c_|{m} 9 'V''Y%DxTvr+ݶy,hk7 B1RD$]5̖a(vFE 343 % $PrL-]x'V ʤb 4Ŷw4- 6)8lre<\{+K~zEBbrIro5!tt:8} ڠ.t1@CV:L$_μ8.\H;u`mڲao-5=Q,1|"tK]}Z|wQXB.wIHF;2ߛ꙯k .-z=/e`Wv4nc0TKuxaWȀd@" lB Q%{8Ğ5 [.__ˀ 2?>F<Ȏy@%5QV,0zq1$vp btuCidextY0xBÆxGZ6?,M;F.JX@ Å8ch~&4B)n mM ŦDײk?> ;$La0|a":6&;C˟"A_<7MFH ?&-0^/kJĥ>&YX7u׹7)rPP|}2dVf<Zw{[C ,aXY1"bCtF`duzs YLs[ᰛqTn@?+۠^] GT_4\;3 >)ojϮ^c :2p[e 67s|;~?ĻilDL՘A913_Ԑ"pq\a4"NDajs7h"%bv"_`("csz%:0W)xDTfȹˍ"C礰)HYa})G>`L:=7gZ/@w`ӫ_UѻFn Τhؖ sHS)O5`;cd8YXr k*E!y?YeS 7vIG%rˆ$PC$MZƋl:~> u_<㐰(oݟz| g]Co'A^ڏ`0%tCo[b&RDOA^ i BS]mS=ioqkX|a$(40aPjc'K9l0Q9\,zB Ȍ}US G %NQE?F&D+s~thG9{|FŬiȊX@E44H!cw:sw‚ E, ш #'_e0;OO;83-"%. ~V$O͋(IYy hײAi9 m7ׄ4(1$TiHGD+AkArJHʛ%Ԫ#[e2h)H1X  Pz;R_ 3v^iK~]^xؾ}ɵUZ_?VULpQ]h%t& XN*zj[!@bII)"^GZ4OeWjsc$Grcf؀kٚѡodI `{@ N?r ;^Hj\Zy"7YP:^- | Sm88& !^8-,q,t(z$<{JD=Dw'^ _ЗF{f']JaCs@5#<i:HLѝ;̨CJ-;B o-3ҐN#yQ5@vKv_Z,;?!"~,/9I6H Veoz5= s+]c6$TKEξw.—h8X$-Pc7T:pgf슅(cH c_kk/>AG"QZbۚ@-w8%p"gۘDU8|gIۉq"V5.\)`/g [JƚP0L;>䅍-xݏgi)Q4͌uH n֘0bPAb'u]6PnBys訬3:fn.ÿ=uSb8RfYYԊ@Ux: N1D"e-Q*Qg˨~,Tbp3O}Wo"}hM;Ájq<5YXgA AӸjiSz-L5^}:hV#@Ν _/ř.vIPW},EœPՊǁ'^aOQY'X.JP1)ȤGc(Nfvgc3~V >=P9Ba"a|pKZpE:+:`ԙf8&W`gXtGԓ2@0so} 4uOIG5j@Mڢ#Mh@0'G_kJϛ,0]fsYs0± Q>diLv5TsඕXјt…j0Qv˻KFc6z3#eBȌ|ܑ'Iv?>Gti8p;"CO!hf>d^D9 _U_ !rM/U9UDs׏OzpkEbTz0fnbmM̻a^xo;O}9u亪U{p;ob8՜B]ӧ[L!|weR&Z/T`dߦn2,:_Nfv97$lRbܢe:Wu^M  )‡nuJ^/Țò*+ YR8PFXǐU;11fW%OcCJ|OUzm/'-#AYLT01X&IY8  D TD\.҃b YE ׎DT JţD:y=, 42SwDO rD2o.6$x$0 5\ɸ:ˀl#v&:=w*3WTV21qW>A,@] aDI*)1^!VcL >T}Lg]2r 2$IVv{,u:-M&"h3qD_0uG :)>'6 ӂ?JI5*XpSaOdjMK*gx.LEL!.[l|K|;$/'UY)ұvv2'։z/ XV;B o-b:$9! uT^m*5\n+>&Fq@SZ޿0lEvˆUgj۰XjOi3ˣT̪$ 57N'qفOG_Z%VId<IQ -뀅XD݌TD9XrÉ_bk땀9Oir`M9uk@Xlt[O2!sD&$gu|_"3CgYoQTg(s F2%_Н;#eaPB"鳳.q0}}_dUk$2W_5?)e$De(| J@6ja31HIdf`2{ qN7OnI>9+oz~M褅ťڨ~SSOvgKi TRƘhz1o-+AB( e,$sUK@v.-M5Qh|bD9` @zs7PnavIzx0+V)ڣ} cm0?sh`m9nO_w=&}9i]X7e:Î!.G \U`ҥhR|.{71n]vm.Di3ˀ-#axq- x6-_C,GZ-l^6cI>ۢe,+=jzgV|f6;jqqm0S\v%500T.$ GOW=NJ yHǔCsqAsGz=|{aGҾ/)m'(] T.RA*K2%N FFo@ Fn*.P%ZHS=V1vW2R=l+h݁bUVasDBvp{/Rx+%$5L;tz4e&pp,EЍ"JX|xo. 2B(ݏV L̫JWیeIvS_u^ʆ$+^.QR˚D:bXwsu`NgnMg쳘k=<TIx倏!IT>/4Daa(Grh\&^L wzY}7n6dJWY!-t[NѮD+U >M%G (~J;,I4`nRvO a+z6ܖL) jGV^s=[v rVy{x uRgP9Ay ~W&d,Tk]Yh&ӊ>NfYSİ$[>oO 2GܑSȪtw81`#qby޷']<<2.@$rMe +C>2;w^ t 1u R.;HSHd0x=/jQkpTSh>Cί"lWH΋gvۓL~^떢q9…wG(2Mh7ӎ ~oRR.qW^+ʙUTMh>9ȗ&=YN8ۊ \9iy# Ю DEB-czW‡r)?ra}O~?a#ULl ST>~ $o54Kw#M挳 (UF,hTStxTP)nZbg4-Ccjg0c`bʰ}FjxRwXZ61CRɝ~+us[M ڥg[Q4 5( }^;>Wx5펇YF[A!kb1E!s {w Tap7iB 1 D)Hmq;I$5?Q8NE `'(Im!,cF6Gʴf0K\,ߛ?[/HvMp>?uJxb|b%?=VB7+1nۮ9xX"" .(䩼A)QƂzmLNv;d.ܾ$P{2Q;,/m;F)kV_uu`i(4Iw):t/5?kM~m6V[N>/X -_J1>\32]ϕC'%4;F|ޒt7đ=|G~XI&vLe9|IlGbwa\30,-% +PL?O2<PƱUN|zʂ*y$Czx;ׁPWXwd Q.&iMbUr$aQqYĈnGD,d$v{KMbb{iE;G>q8܋@8Aiއ9vEw keùysP8d xrLb2x CY4yOj /~}=]Iqns$VŏhK+*u~ؼb4b.! Ec3WUT85#&T/` _}F=&Y,ĠCbYCL I~PqZo 6hf@>X`g`(Ա% =SaEDQ?n&ToI3·{z#@<_-G)+gJ,Έz9ԋZq_fχv:~I{+ <ϭwam@.#AY {?٢h!H\NjBJ Q#bpv>kwDۉJt$R/qD)R8+~]-fZ'&~6]HZ;pP]; H0_O'h6AQ6r8Y!& $sF5H>eDztAWFE]%-) gFAL^s%%_F;nf5M6paV[8*pon^ QvV`6Ra]?!?fh|whx?mz󭜫3QajnaCJ$ D?*R(Q\|BCfWڐDv%CBY䮆Np9 G[L` zo6kBh C0! T3"T5{\U$} z(~tY#.6cEU@RLOXScCirsOX'Zr vF{rʛSK+Vߙ6:P}6r 4y" `kN`S0[gkbJhyÏ1޺ hN o2zhGbo 飦L:%zYj GV :8([sOL*esrur;G/ ۈHb_@ cn|&^(fd{/bN#u]9aq}ɫS⃧C>gjH֌ H7. e)uY Xh0V]!:ݽ"g-#oX-q1mu!'sv$H߿=n7{mq0cA =kҘ7$ i*!-z} _)xuOCx"9X|J23۵A@w06fNo ,,-l8|dOmFq85%]fv̨@mS!"CߟG >CZ}H)t.w4u8<[\Ōe{\Qc-~MFrJԍnaQCu(4t6 [XyЍ7IWu1Z'\Rf죬Z%VOQ8W>+Ӎ14Ύshϱ_v`\M˲RtL0|V%9z 2P?TH f&2LIpNA#vcδ?,zr_qB%iOb~e 5fs|\dF y8z ϗ60|/J0+'⯷!ox/PfɃh[qZj3./2_.F w!L2%DmdSVɎ*kz[7у:W0-{ HfGsԡ+~-w< a:p|mR]w佐yJPp8ɞvyB%:ݲwx'|bjޔEVap{yLSé1xb~,qk܋Yl 6 pC 4 9)OFc19R<H;ז0Z ErO?Ky2(g|tX]♒o=VlƩ59:mD!oJJR-qK1EawU¿Lyc.w['[Y.Q/Tӌ;Z*E8|@|/(z0J*̚ dKuSGqX4+.rP2$t5n֟>#=۝PN d@~Z̚A{ #6xd@me,g>TrZB!3 7=j͂\ DxrL.}Dddј~hԼ{ov t ݵN6BȮ:()A $(rLl[.cbYqh)ڍ% aR1ec{^Ksw*9e[K4"q"%=~9%\:;e2BDZ8p{݁*9Q%(_dKջLLn-Q*5,[OVGDx b`fRp΃e|xN.,r46xǞK"P8Lkر_OmL}`#6D߀,Wɇ*aW(m!u^>PA?nя>\&A9)F*+EEGMg\XXbvOQ =I)>SϜpt~-%Ѓۉǡ?"5E;rFZȌ0ʂI`y+!(h6[vɅ9BHaGu 2vƧ6h.lV<]![US+=,^GO 'U͗]Nb+VYYt$4~%?Md4~cMЗ Ǣa&,p>nU#%?v:jb'z;bHdJ94$Yx <$G B #clDd%Z֥D|jGR_mѡ7l9nXS&jHN6^. ^N M{C8A#T{^-6L-,)8K;4h 5kDnMq2vOy$n96u>?olQ5fTC]@z<,tH?e9p ܏Gŵy1rݗϲY߃ P`hK4U>F0 q2 #܄Ӂ7Ur TV.67VV 66g@UK)ezsvJƃjmQ?#?F5d x௼QŪ'谣{|?zxPrqGFZ:1tR 7T(G vIuSè`tճ7!fD?NۻƉڧCCQJl8Bn71] (w-zoL kغ>3Ddo_H )vb}5qd<6#;zud|__YwQNf|3КsOwӪF3`>'S]1TJzO#A rd,q?6}`ѷ[@_ob 1 `H,QDB ȎRNF<)!;g+ `9߲wcE9>a99RGO=7^~DzVeKu-P<I_:i$Ѥlm}D5۷yUM-CYLv@m%?$3[r!W;*~>.Kb'Y+_As;S~D&E.%]h~lsڵ3ж\<ﱶkM&ĸIg ¹S'"QDdHU^?%8°Opw*Wzp?Av~@V|A@VN&FN8˧Έ8ਬ)Ө pX5z7.,++t?tCOeu[#֒G2({o`AV?-_{xS{OG+-Ӡ)rI99X8Fx@itNLBj՚(İ${2G߀pgB*ȔJh:'͓CrLX3|/*>pfDEMM .~{!N֘P1y d2  (iJc *wDm`#JA[Xq;T>+cLI Xfƫ3/9muБ85sn-jQ'\aHo ӭaxrgsa6fl/}8*>0a̹37agl Vlܖ\=DZ*u_BOCHdС,HG*z"lz7Jݭ(HCA%u18nqeAm%h"Tsvv܂.J:x[qE;{C~;K-}d; ? HsbYFXv]"r c\>csD;jH R z]lI!bk.b+(+j.(e۱~ `f\n J>ktHLJνtR[>"#u_|}T@V.>6O+l3Q 6օ0aDG _ns3l6D8\H4Ge?* lxN=v*P@<}W:,2 1uR̋qGGDU^BLyS2l7>s@ߠwkT|z/ d) '%c<J 8 f@VŞ(m:WZ[?R:ih,+ߑJ.C(8>3 9 ARE䌿r 44AA jt+4rá}#h08mi-%<K:hePp[=æX>F?l^խ6Zs݅߉6sh}2wJx+$9YFW:0=Aftt,s3+*h9Hڜ491%%yyy3yjB)Lr8K1"}eX WuGЇM=؇Y1R-J~Zwt'&YX콑'Ӎ,ldȄkx`t0)X\m*;qRL`ia?w?A%{ Dnk-J=6:e5c#ywA!A^kf<2o!J0*C7$k7Xu c[|m9*{lwY実*2nNaܒ( ͓h*{?{c} dK7IPi^v^z.b)@JQ݁9MTrєh\d 2E}ؖe9Q N!/[v  N+,R*iR2O굃Pg[R G˛d_Le.58a[iP'~Q60[ !R b<#]Jl:+ Gg7wڣxo"i)w;Е₤bnw ](\xIz }Hh+ -d7LHŜY,+ Gx@Op@$n-) q IXd+Ҧ5@kS> hJk-Vr/+Uh!MHT,  5U:v2TzHvv@{K=Gp>Ċ߮^bN4c,0w8 P]K{yІ~*y1CܢXEGZ(=NP |} 4-{w a ?oGa_LG܄ &XQ9`aj,Q.zT=,m8'>z2lAߋp3em}^4Ȏ=&莘1eF*dꢂs解|%H1My-܂q -8ZFe"m1Jn@(хlyu^8D)^S3J'f>yQoi3!71B>1f۴dzv8Vl:E<3ZOٰbq ̇WEMUmxO?KK/[m1Њ`}jFO"ȫF@ '̣ڞ5#|]H&H1?Vq)wRA!`ڲryBJد ~_0łX^Iܞ7,P4XB-k%#Y4A0X U%.#xY%)cY]*`oyI^qEBMq3):G ZJcZdp`dYL Ql.;Կǟjߏ3ZrvB ;:sL%T4RD{NƦӥʭ%wsJ,dy'I15a"E1{YRRLDٺ/:hLC6CDu3"dEnU%aҹ?jZX?OxGG>9FgbWt_RJﭒ+H0wt3%ar=GewHƙkCQw $#{gzfijeChƲ'WĞX$%/>S2 6Y+ńUD+k˞JR>g`i ? HpϸRk# L[ŏ!V΢mw,i~oML@V~zc80zJ)+muBeeVrV~Zx4p42$B \+ vm^^ʂ%f,l.wɡ툐w]"]OB>n&n!Oisp=3kྭˍb:y#d]:)x:YTZWO`w[YQ&\ܳF@UL9h)oCy4ST,l˻j@S kkd'rr8_V^3-d^HWJO/oN;r!cb*5c]ɴ>fDVLhlҿS"o9+<}Oqm7*Ҭhݗ-y-CA5e;Bt, xYHgGބ 4Pվ]jw($$>  @yvSDj:M')}9FI$ė`w%sv+[d&~b M;ń5玔B&U?be 0#p+_˷1N]Bsi¾7U3ެKyu~ @-'vlam8;ngwv wl 6{vrk8F;jM!{&lb1XK;"?#ϕ-k.~40|h|bA9kؚu[t?7,+uSRWzy#wx*>82x_ Vi\X2#5K}&nNw8[77ol0DEgc+Now"[NKUqXd¶u16yNu^{2X)*ꙴw[6;ks۳(==q~-|s!9=ޛ&!Qhog*7e/~@c:cdx twxЯ/%7 ࠗ C%ڟ@/`*(8ϒؤLGKzD 3051E-t& >(2]]J\56IR@QbUX#g^|xMw0)0(RT={pz]4Wu:gjq(?1@mywl rI4B8KY݁Q w"Cg*& yZu 3 D&e$Mj ZWp[׈h'Ep]X^A`߱3c3"s2hVBZ#0,o5r?)QIS:R= 'w|\jp$AiC&)?47IYT N<'ACMx}^#-_H$ly4ّ*{iŘ2 j6i<ø?MZRl1nVN$Iƨ%эZq<&u ;Y6xW fJXFya<{:杏\8KKBOd( zY6%YN;]I@)7 Mxh#@OUUJHcEܰl>zώ8k~ݬ\ plt8$'{aX*j(zyyUQ !xvf? 6VF'M}pT8 0mPګAHs\5GQd(> M2O#K?iT%i#}k/cT3vu>HSg^ I\Hwʀ]osn^q]HfhOYO?p3,RCP8$ RYw Ti|xR'@p7Ŭ1y6#|5^9ٓ3C6*￸& yK +]?׽,}/</?{cK6 kXjgU~H'м[}C_Pkm@ f9i;nPdwXE?}|7x[\QnUF G85Gk<%Q`^^?MN ͐xx1`YI:vy%49y_9R絕ʞ umcax'wHXv0ʕ%xӡЕA>RKgrY 4gdGx1gdqSm"b>^+(__J_a@|կ:Y[CxICkTDu/ z+,~_,ˀQ jY$}^Wŋ?dFȸFoJm똾9q:UAq. \ 7FE_ ZFgjUT11;gy(rr_ :X-KPNYpV;8WDoGۛ'Sn:me?" O8D_5]7%ͮ:eNDNܘS&&ˊPV6SVϜxS֦3q@mâC䜃wry\mwU*֋pU3EZ`]=LR{ Ell:M< dyh8 3 キ>*DGIbx+Ze"( |A7,pڸ5?Pv<GMP,II:75ʴ}_iאnVxjTڷ ¦I@UɁsa֣^cTq;Wy_h Jps1"۞K.r6XMPtd2Eqg ţuhZoKjoЩ&\n|5瀔pE$s_7 `~hD1[|WN'޶_&I,Tvk5%]?Y/VbiȘ kFNެ4\;P8$r?}8C|"Ѩ$fy#_!tYV4{PRmZBN;5.&A&B=l6cQ`@!( }\bo6;CwT3KU2 NZeTpApBFX;=`w_&LOkas%haR>%1#tbDCiͭG0EOήЕBNh$J*|KK ̈́8DߩQjT^?P5ՙ]m&F}]91ֳ{)a Z%`p !%e1۽z{ Δ;>E-u+c *v9q-' 6zbYݱ[Ԉk1AF.ppHINwҵ.}K\`Hw#ѡoJS-DyRkG_v1>ke~jnxwRc Wx'Dأ,)AOP9X]rntcSz&IeHjϥ^ܨec5ֵQz#+,.i `$6ggYj\,1r4bE}W%XDA/9hp;Q9X7Fn*rQ&}0a =C3v0Р~ߖ5-[3u "]FZՆ3I<R/>+$2OdpNj-/X3+P l w}GZ {gJ}DJ~4_gȁ8E)޸vG? z Tm>M'kpOf.$nafJ&5ngHB]Ni8fxL[ÙQF>7"3 h]BTj nݕz5k16 >OI`45󳷢,`A 5` |4/(KX k[.H/ULp%0iT-}V?Qq%>Fm/+:8q#YR]]Q=+9.WFUrb1ĸ݄A$(30c]%=(mi$;$#U߻JF{yP`ؠwR/r-S0O [dw 9A(]m^ٜP 횃)' qe 9+м<_; }DVs #`톓I_e8>|~M7o;? ?w>}' TǢ" ߙwyv*™M{ 턽Gc]vnl8 .mfXR#.|%TLJpٿ_gԧ*:E;U‡}0L7ڋ`}CٮA¡bWm76 J8nݚGk}$nO:膜Yh^6.]*б;8;KoC$h@N&"%:f$OJ~~=ޖȕϾ̄\=!,W Q̙ б¾Xc`8tXs{fT%p]QibD19DTd )TOk+&)B'v%[zMt[?m= QޙDW#";bA^bc?!\D#KMUw;AOEuTO%n 6MOb4w Zbi4U9WxN_,'l'wе6 _ޝ<p ly䷆Y'_6ZcszZWBX$gԦ R(6(LqȕԪl^ [{g}Np$'ANarFsnIV VhyqUr\ Jޫ As˹6ʼ ͔垗p$e}b$Qe&X+22t'ѻt%Mv$Bd-GÁz0z!ʫ9\V@9mKT`N=~q!ޞwƌr9rbe4UEU>B`:xs';l5s±/PwHce"3z3 7=4GeSTM2ӏ0D0ꚷKY] CLc|mwO_,0򥦈qP;%c]8C$⁎ErDAaVfsyMMcX/~p0gI5] +#6g6ｱ;a|Ժ$=S)-.Wr5ǿ YqqS!)Nr"R9P6 /̒A`t]Ɋ@bnsvH$N&^XXB!ZC0#+DɎyn"6-"ydH9Xe_NUr+h:" TE'}(dz=! n "j85IKbfo iI^3Լlt^D6(zx V2n}q 8cg2'{nZOkEnhT'cX&Aȶn6 3J_Vme+4R~- *W4~j~Nd;qk"Ӈ BWBt AlȆQ`w0aĊ9KBM]ΧM},Ehɰ#CY$q) Y? [&/\jlgn\6OXFk䳢?֌$mT] bL":؏ 4IC01dy,Ua"ӔAU3ڞqv86k!\?y=6dxMwX][ ˭e =Y EO=YTMH )W!ֶ\$OY'3'숋6`,K] 3~nc7,r!~{3J}ԕc6UKr' FِB,,N^3=lbLa]s6wƤF*d ! ˀy /LpTwDRmJsE$U&>n2fZwl+_`+yX֭pl++X` xWMFl!e%|<|$}#̇*˘O{2b6Z*'S4QQ*gdJI0@-Yz_>[ZL1^NVJ3=ž&9rjxKG=(\"gphrvKD|~;$\)͊_G(3>$&Ӫe%a) L%"yvGvf,toW%Oम"ɻgiWh L6\ARVqM7"TQ&$$>m̉#1 h3ܒutlˮE<q[B;ޅ ]24zG 7d[%p.s9F"ϠiKF[<;  *J61m8u( ƗM1,Hf5u5F iɫY'l湶i3nyw_DȨ;#9i㾢g#fJc(NS,?D}R0O_iwI(؝YGY87«fK#Y?˷މ,R6ꯇQSGM|O`zif*ͭtIEv E7T'}\ mB B+=4Ujuzu ySwp#!1VNrёtT0pލj[]Py;X`8# *Fyz0)@~?Sk?t;:d..Q^F7S'(W[Vn?X" qY]Cd\l?[;!4ځ {l >Zq@yQ!B KawZҟkOB%hXO+{u#vגir}lVj(se3#_ 10i9xf :$Z_pM]|J+MQyP=Q "e; rRK7wIIexWν|a{`M[)Za4vI-ɤFZovN /dӥ!vaن޽8hbT's$(A0״k nRnfz$%0B˜IAvm^`9X՞@ËcKm^.uXL# 䒙8 }w"!+Y/lvk8l@Nwĵ|wCN&70 a^Ok ɒ) ]uS[ɡZU9]٦ vQ8JONY$I&By^`\todpI-W\VI< ]E=bOHDF1OfU&8FhF0Kuy!耔oFlElQ n^([4SF^DWz>;l&ٮě*c$ͨHW4DE=vNTƈo/Ar6-oZ=P۷3׬B -Vƻv)^D E!իzQlMSqR/dw hsg3$Hn~*l2}Ck7^{CݩVv,RYT1zuVQ q S^PTMښzηFB~,}*@$ĕxp0or{҇#Ah* !Ϛ4 Iy5`ŻF5]2e1!OG_l>6)ĄD%Q3NnDzoS|tpbIQiWeq 5^{aU7tc fybo1 U n8Ynx rdtcHhx{/pGTȈ$lU[y5N}/gT*Lavm(;o_Ss'&PWz~N+/CptcBqh.:zzkΰyUNzjP PA޴y c,u_T0ݜ1sH,?d^TZLIr5+۩6L ʮw"ɧl07π8ܘ~ziyuz9z܂N6Vys#$d*:DNBi\(RN5A;;Þ_w.NIrENu\Jc\ Q1{%tF'jkDO+[ٟUM8ҙuKLk"UvgEi%לs)صtL^qG79_gT<"'u%><\gUGqNG[9ϣ6BɒI=G#NE=s熂ɻ:ħ@IgRJi[ҿh1~lu3 [Z>,,Ib fp^#'{G,sMh:(T]b. _3D[ܳw;⚄OzD;k(:,Ѱ7(^LD Q0F}?.iplS!kHKRFjJaWlz÷W[?JOKGo= 1δGAȡZ,>@Wz_c]84p CWL. GYz HSJ k"ҧdC}( 9+bS,uwu!l[Ro0OX3&E[lhF=mPd>et~+ޚVOεH-jܾ7i}[-ì;UW P-%+NeKZݮ0мKo4$U' 5Q7 YIߣ'E8ٮ:6#ʇy7ɄI n*靏p u`=/ݽ FPqLk$gըHK~ g#BvȦX972]GqphLb?lpL -jzrdHb,Nsg[4@xݖ4F<*ٱ\ɓRћl&>5nRMKo$i`*lQ#eg G+HE-!on"zk>DLu^*!01ȟuw q3}X=bU˯BѨ-?AL,m{(}]vbڮX\ 3h{My6 dzBp ƈ&mlPf2`t4[FTHc BV-lگ/ 7:t?;j^ʽ0.uX[$;:""U~'_oBoX{?j (ېN s}KH?yO>yMW@c.q>j}UE P:u@_zK !=XuCx%%Vx*#.#/0/_]ҘuVBoiKW'_2=$]8^AVPlW<;,cw@s66`3%&0Ɲa.mqĆ"gvrXO?\dymvαč(|sxPUzbtэUTAD rc{Haq 8in`W.f3zyʦ }J~PYoPUb"ճx9Xv$>/^/Y6y%Gͅok}\&j2)!n&mj-9(iN;847E';ml}7W ¤R$f8}ųJj|$'"ГWW}g$` d%V"} 5!M;$KPk݄vj#RyU׉- 0" Cm<8%-Ȯys. A<o8=wtncL᾽ ڢ ?s`2-,!cAWd]ل<7|CVt+u3#_'.POѳn*3 ^+CS@ygK=CvqkY(I.^PS5T6Y(W;m>z`< O a.2 t%jFɶomy0'_7 Pa̪7.A/.LAAI i~.Shhq"kqseAM<m9Wqu;@CQ MĆ`佁O fe$?P#SE:so(F_f=+ҽbcK*(qNcKǽ߽\+p^=~ BsRQop1M2W&: ܁ U֘R wR5c =dsdΫT=eIZ:%cڒIᆹ|% B'yʣT9𛶮΋ؑyZ~LtWZU*~h `y iǀ>A? o+Oȱ$[ZOm:`Lv6d#bPYR2-Xl/L"KaD^WAZ!,xp]Z:ɧ'3qF7s Z; .'J_"3cΠSy08$rg"a,9|!K HOIP Xyj?VfQq` Cl{`e';2CCҬ̱-"_Q \X(=RoGFHtrO 3t$&;4 e:(NM [~ٻ*9M{ܞsI)TŁ/GgG4t۵> ((ʰÔ!5ŔD)%ɬcg-F­hh'ZLAq&$q^UN n3_)'yC.caԩ$5" ;v6Tq^DOdZ;} @:L3G,vIGxeZ4GZSx| i`W(Jfn@IS}M;h8vN1:/\xTc2\X9JTR H腽 <P'5ap%_=\Qkr(^A+e 7)<M%dqzLyB3qa1u]îyV ˠ֊n~Qd<Qv\ W/" пG;t'LŸN6Yu1IVkÎRfŋsssPHRVXe Ѳ7ƥXiIpͧX&y߂`لo0_xq33pw#%4iIPӄลPYZ6p34pDd(lS!G!XY;1k4 _Na+瀶Y"LH%;E qC* rZxyh,ֹkj#7f@!&p\M+ʾM@rl =} a]7ҷ/>_#ԀTw ͔0 :vK875EtiY7i棟R&tgxG ~_D\QGoC>A %_4ߎįQQXaܵaYH8B%c胢l>>?tJU_nfhKERRbZcˠdaD󿴦4S#EkY Y#v 4Cl/G|6&BF% v9otuvp,vʳ : Cq(8>uM>x)iwm͇5eb&O{r;C :AdJ#Fl T8` Ku䱜9%3\3 R= DQy [Jz2nc`F7Q9qҡ2ͪqo| [>h9wGx}tIo`BZ }7 xqwv<̃1t{Tb~lNhU'MʯVݓןf?P~d{VC<=q@Ql=lotMy_5wIjK ζ]n?X3^}|ml_,4b;J^LJ8ެClN\26M`}ؙ9՘?#8p+MHb"vK2U~iuͥ٠BpX RSOdY^=OG'n5?Kmíp~QDg^Y*3TnN [~̃@_['@P[w"7eHj뛯7Q:/kˉcƏKJ,-x?`4: x/m0C|O[xzhrpnȤ\FLYMc'[{).11\=PWp@li s4svg92]lkMEBa)Z#7$a h4W@N tS 5d\hR.]L!#mYq*6?.(bǤbϮWJnz wK-/dⁱ\W;6sJ[ܮE\ {'MLowۄjvmI&ؖ灿ݯ2|F M?DEbs5<2}|+JBL-KR~ҭH,@Vn4z/T7fg ], ٍXA_2y&.lȘ glHʉl{(,c=I!(PORTq&P,M=s $v Z"p<.F S~ν9"hi_θE BMS#ڱ*UP$ߦWɖ?6u; $銪(4EL??T3jrÆYk"}'QX||Ҙ1Q{'IWW[D}#m-1MIw04!G lߪaWz$mzׇ5;ɸ2!Jj ܦeyC>uqҜQj^XU8 10{x)i]3h~ɷ!gXW¾x=0dOZoF^YW*Su%i|nJbn $rii7&ExM {ݍ<;'x4EEùWz/WEMOҾe\K6p IF)6/DIe aS)L3۶}?l_c=u8KTn]c#n4O'J@՚RNFtzYD3Z+S)Q\Nc ; Nt2,)>zsDQ {_,o]?[mO\@2iXSg!H>Qi"QNt9lARm׭|H=C_ywq{c}bXkњyye{U]NjEP 0)< 5;ΈlϑqM3Ez-ˬ๨X8]fRjx/d@UĢؠb =־Wf5YHX:*p|~s42Ud}L`cï\TqzZzks_tcR[Cm)an?U]O 1lQni k|Ckh!'ܜkC= W9bva靏B{ G1UK=o_;fc.RX0?([`&I8)nr`9Ӻ"k`[6튩:6#XƏAD(c ?}֣H|^Mq\7*xESie!^YYMT) MV͌+|ͦ+AͫI%M/AD+fM- aqc{Uy-p]iiV+4:Mg׃gΐ˪MAҜ_{,-z[8NC@"_?-▊,$dx#r!h4rzZGYBt@09أ,S{:>ڨJ-ĴЂpenq"Lo'\a|Uܢ_ C㙡/Fu9G<:TD0m?b $Qb@V7 I`<-J\٢8xqjFc"7Q}y3˕I*_{$x=&l r ǾlF'X7{}1hsE+eSC!tp_tU٘2gb<}ep)Q {S=Qغگ,K=z$SFcE΢Բ^kV9ΐ'XDFT3И.0/p}d:tr*Ov.y0Zb|1acvq^f\qM2k(^1 y&rV ŷ!Ğ=;\Ӈ#ͷlZ-nKщ=);f5oL>BV79J禸k.=aIsmjF4%RN$!{KTMAa'V+͹'/k7Wn< ߠ Kv6ƙbe,| {a/&>%׎c1!)y{ӎȣ4d#'r4ő]\UR %Ux,Djz ڴaq[ h1 a2<24+eLh3.#x!Φ2$w^~i7)03A1fiMT31hOj{&&V^&wP•W=Ofw^`$"ZYk'X34o4Gz~}?Ad%xaxrk ya1qᲖ2D ed((;|( b`:d~nw)UܵkYuy g9zH3*AzjVAp<3n,4te:~9 F{m28\/Fs7G͎5 W3=F*bРDU&KH$O%#G9_rcMk;!yF51%Y9%a?qXJj7wwJ9x_= rZNҋ C ''6cR8 b \GCi-}6LAOQ>_nTGcvkU@:i|6C}n㳾ih6e"5cWX':[Ak}1]dlaM4$R@H:v,'GU|D Q*7 lu[^^D4E&ՑGYկ6ŏDĄʇtn4~I{^!Y+7XĎm_5鄐TB'JjXGؗPݜ)Uo5fܩv3 (2eh"Uv?g+$2ė^1gWeiK= 0v٭v%dSc/c`cHE)H g灭3$ķPZyŔR2f`x , HQ| 7ײևfKa RA_PmV3ҫ6`oYoǰ %~6\g*D;fWy:H+v]2M5|x0ΑOMwwlnlLk f O;;pԓg7/VjD\"]Xdn~vncRȾ0db8;kɮ0T;O/~Q< 틑c{xtq P:,-nu t45Rϥ#Y1}bkǻl?L Ѳorذ +9[R*xa6]zHib>Ӯί p ]uE a43QTZB5 { e@L E2"۬;H+rI/Z@ >QI>Zцv/=}KC#18-2+cXg EVC9l)6`X#X-W.-*5j,j6Qe1\Vȸ36˶Ah`÷QVTKȐ(Vit$;VC#(R*d/=/(eWڈ @ר} 0%HIZ2<ed;}Vx3waWcAG)̀k&6|ԎyvDL"tM-W;PGX1xnXj)F{50bZ<6O0]均2]+bg|g-} J.ꔹkb|M:gT\%*SvNæ-y<'l: 2w[3\̎^;kdU %]豺!~,S[+\u0T!Q^:<^yF)czG},;$IuW?~S}tgUpF*^Kyî4W4r,4x,i} L=ts}.h 4JII5xOna'B&6e-D!iSTЋM\O'V\F*ыLj޿pÖaYSKo)Ƕ^ c|pG>ϳaX}0J*+K5؉7N36j\Z[&a; .[ ݳ ]ܵtkLTP<'q‹_A.{V;{p,e )'{G4NL6UYdTR'U7֢H5s]n$q c7P:`s:C==Cq_`;9?33NdP@5wGxZrS~ʽMlt'GƛV{_L1PcW񍩝S;^s\D Ʋ{)tp5oN:`f0I|cJ ^cҚ^)DLZc]R<5L #;̖KOMs㧖28OTAG0~59۳_<\-VWKw;a8KdAgf>ZgkTγ@&#w yRf|y̅-n:~7`<# řuL|kE*~Ɓ飆.{s.G&䳐)do7B'gID9*uϖ'OTGpTV1 8!Ho'E,dz[Əޖ?guhorh${m̥lӑU4\81c@ykVd H<H 80S6i bF"]u,}gZL[4Ca(Qb:|EtQ@ҟ(h"Zo앵?<뉩u!Dt[04EtYtttqnS$+n[#+Ҭo5A`e]ؤ&oN}JaSSr(Hg9#EL,E(+q)24  FȺlP ~ip @aXrx[!3Lzz==j] 8B؋>]D(@;)*cpPG]ks1}m/>BIvn10o;@%^ry#nۯ2x55'%bɖa V2fvʡ2F$VE(W8Oc<xY -z̢"-Gtx7,}}J[e2@ɀrA˝IfW3}Ʋ<=?Ĥ K;\`d{PCR _E3Yp}I c{:2oF_P>r~Qr`l6ip3;AHE VRJ$s/44[\}lMkpgݼ-?+H Ki2ҵ?Yz9hxmhWWG7*vjXuܨ|Ic t۫vHˌ!w?w&@ 9(d8AV+(V"uʴR*c5IJ!2`?Q{M|PF~tw9լQq5@Y#}g`D9Ӡ̄um *&)rbV,>=F\јjN)4{@<<?B܊'.+ jJf&Ősw+t'xOM!l\4_3™ t)ٱrl%\3.0~6, qҫEj#rg]*mR/N_YeQKSɯHTZZb it7:ɋΫga݀9 0e/Z/N\+%1o:F`<8j@4A70H+YP_&ߤg*@{P40Xv1$ڒ;s |f37 grTRxMh IjKg#(`Ӓ6mˌMSyg \> $~20`\bQhE%*J<@U{ hM f)o\ܥt.xNnzMgh%.!xg>jK]$5׆-HVI/`[C:JˮHBU\,|5Vkĸ`#FJX19QVH_ߢRZea(m݉FX4׿l([a'8Ox҂9N:=oCJW0MD7C#55WҭqkD<"‡?DrcN-)(:QMqo߈ caV0ekQ5"y+W('(}Yơ;{ v-JOGp<&:s0b5^.xա4sqg8*Sb|\01/ (OR)nx9U'r9xnrN dQA,9!=x]i? pBnoUŖZ7I 49>?DBX?&QxrA!l)-PX9, :~ g-cg\({ ZRlSu4imf[XD|Qi]yIH6`Y`T/uh}lw Hᬅ]ǧ `zTI :MwRsH@|ҰSC*ǰLL=[$֖~񰲀^!׼G {ʗ(J?zhd\>IzZ?5^y2GF9 [=wjf{uz%'Zp6k3\ K7~kdS nQ;n+̭/ VfK kX+5D+3XMpw3\! s"@?wЉGJ=C˻5E9\TD*Yո*FOLd8>lδB. IN@d &$òʑҚ2oAvf\IV*N0qi'd Zt ̙rMVtb7x"CCvՅ,Og, ׅHڪfM>~7=5*YQTl_7[e*%K%"qn(%È *I YZ