freeradius-server-utils-debuginfo-3.0.21-lp152.2.9.1 4>$  Ap`z鸋/=„}5Vʣ|uT /=7| 6e)u 剿{Ф*A'Ӑؾ^2~G4>= @WAي.RE ZddńwKL΁ f.~M%vVQIS8LѼX0$$Du]59含 6 CBhE~_Ği]"]^o(m 4}kN(\~©Ԯ'3af1369e11016985574261f57debfef0682ddcab2b17dd4829693f2de7a56a046d5a89d9451616889530229e74741b69a3ea41dc`z鸋/=„f#tMqa[^@ÿ 0mvkكJpFi,³ q~N$YyrݷX젤ˉy&2\ͱG/SAsQ+0|&Pwfd:Lͷ0UYMT{yysN̬9Z%[VwM%|[S$Ϙ{aی=Բ{.ek2U[n8 +㱑JO6y{᝹俞dŏQzqnX p5 ƒ >p@?") 5 k(,8<OXw %`% % % % %  % % E%  ,%   [(8'90':'F%G<%H%Id%X Y \P%]%^bcd)e.f1l3uH%v w%x%y< z`ptfreeradius-server-utils-debuginfo3.0.21lp152.2.9.1Debug information for package freeradius-server-utilsThis package provides debug information for package freeradius-server-utils. Debug information is useful when developing applications that use this package or when debugging this package.`zcloud127 openSUSE Leap 15.2openSUSEGPL-2.0-only AND LGPL-2.1-onlyhttp://bugs.opensuse.orgDevelopment/Debughttp://www.freeradius.org/linuxx86_64 NL&T!O#QKMM!OUbHe0jHpt ZAAAAAAAAAA큤`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z`z570b6aa7e102e43c30e51a02165f05791169589afb90f1f0b5673e7dc6d2b46d507f8d5e919058addb2706203fdf330519d1eb10314b7e0556fdc7e4c3105323b095f60660962aa8d2b675e0eb656c030c93704cbb5e759fbd09e3e7efa52df6df7751d044e1e8a0341aa804603e924c928e7eec8d191eec18793656aead4f84b587a66b259bf8735d6ae1f87f55020a9d7e8cddb11e2f52dbb330e018aeb5b53cccf50f07100b71e3374254bab0172e1e9449d6604f035ce862e0bec3d747db0964fe50fd3830eac08106875f91563c07fa672a388cf2de13994006bd6fffddebed392c709dd83c12fbd198f83b4e64c36d83427387e4047d2de6b7927a1c24161124f23b86eb712682ff5a2fdd53f48a0c666dd7477e2e35e989bf0dc5fb46../../../../../usr/bin/radclient../../../../../usr/lib/debug/usr/bin/radclient-3.0.21-lp152.2.9.1.x86_64.debug../../../../../usr/bin/radattr../../../../../usr/lib/debug/usr/bin/radattr-3.0.21-lp152.2.9.1.x86_64.debug../../../../../usr/bin/rlm_ippool_tool../../../../../usr/lib/debug/usr/bin/rlm_ippool_tool-3.0.21-lp152.2.9.1.x86_64.debug../../../../../usr/bin/smbencrypt../../../../../usr/lib/debug/usr/bin/smbencrypt-3.0.21-lp152.2.9.1.x86_64.debug../../../../../usr/bin/radeapclient../../../../../usr/lib/debug/usr/bin/radeapclient-3.0.21-lp152.2.9.1.x86_64.debug../../../../../usr/bin/radwho../../../../../usr/lib/debug/usr/bin/radwho-3.0.21-lp152.2.9.1.x86_64.debug../../../../../usr/bin/map_unit../../../../../usr/lib/debug/usr/bin/map_unit-3.0.21-lp152.2.9.1.x86_64.debug../../../../../usr/bin/radsniff../../../../../usr/lib/debug/usr/bin/radsniff-3.0.21-lp152.2.9.1.x86_64.debug../../../../../usr/bin/dhcpclient../../../../../usr/lib/debug/usr/bin/dhcpclient-3.0.21-lp152.2.9.1.x86_64.debugrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootfreeradius-server-3.0.21-lp152.2.9.1.src.rpmdebuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)debuginfo(build-id)freeradius-server-utils-debuginfofreeradius-server-utils-debuginfo(x86-64)    freeradius-server-debuginfo(x86-64)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.21-lp152.2.9.13.0.4-14.6.0-14.0-15.2-14.14.1`@_@_FN^y@^p^h^@\\v{\u*@[<[2*ZZWQYY@YlY, @XO@X@X*Xh@X.@W@WiV@V.Vf@UĝU@U@UU8U7@TZ@TTT~@T|X@Adam Majer Adam Majer Adam Majer Adam Majer Adam Majer Adam Majer Johannes Engel Michael Ströder adam.majer@suse.deMichael Ströder adam.majer@suse.demichael@stroeder.commichael@stroeder.commichael@stroeder.comadam.majer@suse.devarkoly@suse.commichael@stroeder.comadam.majer@suse.demichael@stroeder.comkukuk@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demichael@stroeder.comjkeil@suse.demichael@stroeder.comjkeil@suse.dejkeil@suse.dejkeil@suse.demichael@stroeder.comvcizek@suse.commichael@stroeder.comtchvatal@suse.comvcizek@suse.comdimstar@opensuse.orgvcizek@suse.commeissner@suse.com- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)- freeradius-server-radiusd-logrotate.patch: move logrotate options into specific parts for each log as "global" options will persist past and clobber global options in the main logrotate config (bsc#1180525)- freeradius-server-radiusd-logrotate.patch: fix permissions in logrotate global section (bsc#1170505, bsc#1174905)- update to 3.0.21 (jsc#SLE-11896) Feature Improvements * New stored procedure for allocating IPs with PostgreSQL Rates of 1500 IPs per second are now possible See raddb/mods-config/sql/ippool/postgresql/procedure.sql * Add SQL IP pool support for Microsoft SQL Server See raddb/mods-config/sql/ippool/mssql/ * Added RCNTEC dictionary. Closes #3168. * Added Pica8 dictionary. Closes #3179. * Add TLS-Client-Cert-Valid-Since attribute holding not Before date Patch from Boris Lytochkin. Fixes #3157. * Generate attributes containing unknown OIDs See raddb/sites-available/tls * Update the WiMAX dictionary. * Added ability to rlm_python(Python2) show a stacktrace from errors. #2979. * Add WiFi Alliance Policy OIDs. See raddb/certs/xpextensions * radmin now shows coa stats, too. * Sample schema extensions for summarizing data in SQL See mods-config/sql/main/*/process-radacct.sql * Update dictionary.aerohive, dictionary.fortinet, dictionary.arista and dictionary.erx. * Added VAS Experts dictionary. * Many updates to RPM and jenkins builds from Matthew Newton. * Added %C (time now in seconds) and %c (microsecond component of now) back-ported from the "master" branch. * Add reload capability to systemd unit file in Debian and RedHat. * Increase timestamp precision in postauth to maximum supported by each database and simplify (and make more consistent between drivers) the timestamps in SQL queries by using expansions. * Option to set dictionary path in raduat script. Bug Fixes * Various fixes found by PVS-Studio. * Set permissions of certificates in bootstrap shell script Fixes #3132. * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141. * Skip processing proxy reply if there are no home servers available. * Update SQLite IPPool queries. Fixes #3177 * rlm_sql_unixodbc fixes. Fixes #2822. * Fixes when building with LibreSSL. * Fix the rlm_python3 build. Note that this module is experimental. #3183. * The rlm_python should append the 'python_path' paths in 'sys.path'. It fixes the expected behavior to use the existing Python modules Fixes #3180. * Fix rlm_python to print the script errors properly. * Bound total query time for PostgreSQL. Fixes #3253. * Many fixes to Oracle sqlippool. It now does 500 IPs per second without any tuning. Fixes #3270. * Reference sqlippool by it's correct name. Fixes #3272. * Revert 3.0.20 patch which caused crashes on duplicate clients. * Update WiMAX-MSK attribute. Fixes #3280. * Fix crash when trying to access non-existant regex capture group. * Use timestamps (request or server) rather than SQL NOW() in accounting queries so that these are stable when replayed from a file buffer. - freeradius-python3_patches.patch: upstreamed- update to 3.0.20 (bsc#1146848) Feature Improvements * Added Force10 dictionary. * Update dictionary.hp with new attributes. #2690. * Update dictionary.aruba with new attributes. #2696. * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456) * Relax OpenSSL version checks, now that their API is both public, and stable. * Note that tls_min_version/tls_max_version also support "1.3" Since there is no standard yet for EAP with TLS 1.3, it will not work. * Added tripplite dictionary from #2760. * Switch to the async interface for rlm_sql_postgresql so that we can enforce query_timeout. * Added new LDAP option 'allow_dangling_group_ref'. * Updated documentation and functionality for EAP session caching See "cache" section of mods-available/eap. * Tighten systemd unit file security. Fixes #2637. * Disable TLS 1.0 and TLS 1.1 support in the default configuration We STRONGLY recommend doing this for all installations. * Add expansions for *outgoing* Radsec connections "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. Fixes #2839. * Add %{listen:tls} which returns "yes" or "no" for TLS or non-TLS connections. * Update dictionary.lancom with new attributes. #2847. * Added rlm_sql_mongo. See raddb/mods-available/sql. Note that this module is experimental. * Added more documentation in sites-available/robust-proxy-accounting. * sqlippool now re-allocates unexpired leases, to prevent IP pool exhaustion when clients perform multiple reauthentication attempts * Add support to radmin keep the history in ~/.radmin_history. * Add support for ENV and LD_PRELOAD in radiusd.conf. See the new ENV sub-section of radiusd.conf. * Update dictionary.aptilo. #3002. * Update dictionary.airespace. #3039. * Add sites-available/coa-relay, which makes CoA easier #3045. * Add example stored procedure for IP Pools in MySQL See mods-config/sql/ippool/mysql/procedure.sql * Update dictionary.dhcp dictionary with the recent hardware types. * Add experimental rlm_python3. This should largely work the same as rlm_python, which was Python2 only. * Add Dockerfiles for Debian10 and CentOS8. * Add RPM spec file compatibility for RHEL/CentOS 8. * Notes on certificate constraints. See raddb/certs/server.cnf. * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585. Bug Fixes * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627 * ERX-Acct-Request-Reason is "integer". Closes #2635. * Fix a slow memory leak in the file management code. * Try to fix file permissions if they get modified while the server is running * Fix slow memory leak with clients. * Fix request and connection timeouts in rlm_rest. * Fix systemd issues. * Fixes from clang analyzer. * Fix missing include for the dictionaries: alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn, audiocodes,avaya,bristol, columbia_university,freedhcp,garderos, infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus. * Fix internal sanity check when running with "-Xx". * Allow "inner-tunnel" virtual servers to work better with "accept" and "reject" policies. * Fix dictionary.huawei data types for Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address. * Framed-Interface-ID in postgresql/queries.conf is string, not inet Fixes #2817. * Fix rlm_cache to complain on unknown attributes in the "update" section of its configuration. * Add configure checks for -latomic. This helps on armel, mips and mipsel. Fixes #2828. * Add support to Oracle 19 and 18. Via #2857. * Add support for decoding tags in rlm_rest. Fixes #2848. * Use correct passwords when updating CRLs in raddb/certs/. * Properly separate "originate-coa" packets when accounting packets are read from the detail file reader. * Use the correct virtual server for pre/post-proxy. * radsqlrelay fixes backported from "master" branch * Fix DoS issues due to multithreaded BN_CTX access (bsc#1166847, CVE-2019-17185) - disable python2 for SLE15 and Factory - freeradius-server-enable-python3.patch: enable Python3 module - freeradius-python3_patches.patch: backport python3 fixes from upstream - freeradius-server-opensslversion.patch: updated- Enable memcached driver on SLE15- Add missing BuildRequire on samba-core-devel required for windbind support in rlm_mschap.- update to 3.0.19 (jira#SLE-5890) Feature improvements * Update dictionary.cisco * Update sqlippool to allow for stored procedures with PostgreSQL. This increases performance substantially. Patch from Nathan Ward. Fixes #2540. * Re-added "show client config" command to radmin. * Cleaned up mods-available/sql example so that it is easier to understand. * Added pfSense dictionary. Closes #2581 * Update dictionary.h3c Closes #2592 * Update elasticsearch/logstash config for v6.7.0. * EAP-PWD security fixes from Mathy Vanhoef. See http://freeradius.org/security/ (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664) Bug fixes * Update dynamic_client module and server core so that the functionality works. This has been broken since at least v2. * Fix crash in sqlippool due to escaping changes. Patch from Nathan Ward. Fixes #2532, #2533. * Fix systemd notify, watchdog and unit files. Fixes #2541, #2499. * Fix erroneous length check in EAP-FAST. * Update documentation to remove old "ignore_null" configuration. Fixes #2578. * Fix default POD port. Should be 3799. Fixes #2591 * Correctly encode vendor-specific "encrypted" attributes. Fixes #2600- reformat changelog mostly by wrapping lines - add missing bug numbers for security fixes- update to 3.0.18 * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss. * Do-Not-Respond policies can now be set in the "post-auth" section. * Encode / Decode ADSL Forum DHCP options. * Fix module ordering issues. e.g. when "sqlippool" needs "sql". See the "instantiate" section of radiusd.conf. * Add Big Switch dictionary. Fixes #2252. * Add sql_session_start policy (raddb/policy.d/accounting) This minimizes race conditions when using Simultaneous-Use (#2257). * For rlm_perl, all variables are now tainted by default. See raddb/mods-available/perl, and the "perl_flags" configuration item. This change should only affect people who are using variables in insecure ways. * Allow "sqlcounter" module to be listed in "post-auth". * Add support for IPv6 attributes in SQL. Fixes #2280 * The server is better at handling fail-over for outbound RadSec and TCP connections. Fixes #2284. * The server is now more aggressive about retrying failed outbound RadSec and TCP connections. Fixes #2284. * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list. * Add expansion for Radsec connections. "%{listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. * Add notes on running "ldapsearch" using the parameters from the LDAP module. * "ipaddr" attributes can now be cast to "integer" type attributes in an "update" section. * Move main thread queue to using atomic queues. This should help with contention in high load scenarios. * Add "recv_buff" setting to listeners. For more details, see sites-available/default. * The sqlippool module can now use attributes other than "Pool-Name" to assign IP pools. The "Pool-Name" attribute is still the default. * The "unpack" expansion can now unpack substrings. See mods-available/unpack for documentation and examples. * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE. * Allow for -LDAP-UserDN. See mods-available/ldap for more information. * Add sanitizing of control list for moonshot. Fixes #2318. * Update rlm_sql_mysql to be compatible with MySQL 8 Fixes https://bugs.launchpad.net/bugs/1795310. * Allow logging of only Access-Accept or Access-Reject messages See radiusd.conf, "auth_accept" and "auth_reject". * Removed Connect-Rate comparison. It was unused and broken. * Add dictionary.infinera. * Use OpenSSL HMAC functions instead of local ones. * Some SQL modules can now use "auto_escape" to escape unsafe strings See mods-config/sql/main/mysql/queries.conf. * Add wispr2date conversion in mods-available/date. * Implement dictionary-based handling in rlm_python. Fixes #2334 See mods-available/python for details. * Add support for SKIP LOCKED in sqlippool. This can improve performance by an order of magnitude or more. See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383 * Allow PSK and certificates at the same time Except for TLS 1.3 which does not support that. * Update docker scripts. Fixes #2306 Patch from Matthew Newton. * Add crypt xlat. * MySQL connections can now skip verifying the server certificate. Fixes #2481. See mods-available/sql. * Add better mechanism to detect MariaDB (Old MySQL). * Add RFC 7532 "bang path" support for realms Fixes #2492. * Update dictionary.ukerna documentation. Fixes #2493. * Add support for systemd service and watchdogs Fixes #2499. * Check for openss/rand.h, and allow building without OpenSSL engine. Patch from Eneas U de Queiroz Fixes #2517. * The default PosgtreSQL queries now use "ON CONFLICT" to better deal with issues. This requires PostgreSQL 9.5 or later. Please use a recent version of PostgreSQL, or edit the default queries to remove "ON CONFLICT". BUG FIXES * The session-state list is no longer cleaned in the inner-tunnel. This lets the outer Access-Reject section access session-state. * Fix typo in lock initialization for TLS sockets Found by Sergio NNX. * Add check for crash when home server down Fixes #2233. * Add username key for postauth table. * Better libpcap checks, when the header files or libraries are missing. Fixes #2245. * Allow building with old versions of OpenSSL Fixes #2247. * Allow non-FreeRADIUS State attributes to be used with the "session-state" list. i.e. State length != 16. * Be more aggressive about cleaning up zombie children when running in debug mode. * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries exporting LDAP API functions. * unlock files when asked to unlock them. * return error instead of asserting in map code. * Don't write 0 bytes to SSL. Fixes #2270. * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262. * Various dictionary cleanups and consistency checks Fixes #2281. * rlm_python has stronger thread locking to prevent reported issues. Performance may be affected. * Don't allow Message-Authenticator to overflow past the end of a large packet. * Fix crash in sqlippool when SQL server goes away Fixes #2300. * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303. * Fix crash with CoA packets/ Fixes #2304. * Fix crash in rlm_exec with CoA. Fixes #2328. * Print errors while parsing the log config, and don't quit when deprecated log settings are found. * Fix DHCP encoder xlat so that it can be used with a list of attributes. It previously only encoded the first member of the list, and now encodes all members. * The "expr" module now skips more whitespace. * Remove internal FreeRADIUS-Response-Delay attributes from attr_filter Access-Reject. * Don't send junk to redis when maximum args reached. * Small updates to IPv6 for accounting schema Fixes #2364. * Fix OpenDirectory integration in rlm_mschap. * Fix slow memory leak with dynamic clients. * Don't artificially truncate debug output for long strings. * Fix memory leak in EAP-PWD. * Fix crash in "hints" file with Fall-Through = yes. * Fix crash / timer issues with many CoA packets. * Fix attr_filter so that it does not treat vendor attributes of number 26 as Vendor-Specific. * Fix reconnect correctly in rlm_sql_mysql. * Fix rlm_cache to properly use Cache-TTL < 0 Fixes #2485. * Fix rare occurance of bad xlat expansion. * Check for rare race condition when a proxy reply arrives too late.- install license as %license instead of documentation- also fix ownership of /var/log/radius in systemd unit- update to 3.0.17 Feature Improvements * Add CURLOPT_CAINFO. Patch from Nicolas C #2167. * "stats home server" now supports "src IPADDR", to specify home server also by source IP. Fixes #2169. * Add Dockerfiles for a selection of common systems. * Increase number of permitted file descriptors, for systems with many home servers. * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs Patch from Isaac Boukris. Fixes #2205. * Update main READMEs. Patches from Matthew Newton. * Added dictionary.mimosa. Bug Fixes * Don't call post-proxy twice when proxying to a virtual server. Matthew Newton, #2161. * Use "raw" string value for shared secrets and dynamic clients It now parses strings with backslashes and "special characters" correctly. Fixes #2168. * Fix RuntimeDirectory for RedHat, from Alan Buxey. * Relax checks in 'if' parser from Isaac Bourkis. * Minor cleanups for %{debug_attr:&request} from Isaac Boukris. * Be more aggressive about cleaning up cached certificate attributes, due to deficiencies in OpenSSL. Reported by Nicolas Reich. * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall. * Fix double free in rlm_sql. Fixes #2180. * rlm_detail now writes empty Access-Accept packets. * rlm_python can now create tagged attributes. * Don't crash on duplicate realm + authhost / accthost * Allow partial certificate chain to trusted CA. Fixes #2162. * Treat SSL_read() returning zero as error. Fixes #2164. * detail writer now checks if the file was renamed or deleted. * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name. * RedHat Systemd updates. Fixes #2184. * Use correct API for State variable in rlm_securid. * Remove broken radclient option "-i". * Fix "users" file (and hints, etc). So that it does not get confused about entry ordering with multiple $INCLUDEs. * Fix rlm_sql to expand the un-escaped string, not the raw string. * Link default and inner-tunnel only if they exist. Fixes #2206. * Don't use both IP_PKTINFO and IP_SENDSRCADDR. * Always install signal handler for SIGINT (needed by Docker). * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs which are not self-signed will now be checked. * sqlippool now returns "fail" if it fails IP allocation. * Fix rlm_yubikey to look for correct attribute in replay attack check.- update to 3.0.16 Feature improvements * rlm_python now supports multiple lists. From #2031. * Add trust router re-keying. From #2007. * Add support for Samba / AD LDAP schema. See doc/schemas/ldap/samba/README.txt and doc/schemas/ldap/samba/ * Add "tls_min_version" and "tls_max_version" to EAP module for Debian OpenSSL issues. * Better documentation for client certificates in PEAP and TTLS: it usually doesn't work. Fixes #2068. * Distinguish login failure from AD unavailable. Fixes #2069. * Update RH spec files. Fixes #2070. * Run Post-Proxy-Type if all home servers are dead. Fixes #2072. * Print offending IP addresses when EAP sessions come from two upstream home servers, and rate-limit the messages. * Minor packaging updates. * Better documentation for rlm_rest. * EAP-FAST now has it's own "cipher_list", so that it is easier to configure. * EAP-FAST now forcibly disables TLS1.2, until such time as we implement the new keying mechanism from TLS1.2. * Add documentation for allow_expired_crl. * Update Debian logrotation. #2093 and #2101. * DHCP relay can now drop responses. #2095. * rlm_sqlippool can now assign Delegated-IPv6-Prefix. It also now can assign any IPv4 or IPv6 address. Based on patches from maximumG. #2094. See raddb/mods-available/sqlippool for changes. * radeapclient can now use EAP-SIM-Ki to dynamically create the necessary triplets. * Explain why many LDAP connections are closed. Fixes #1969. * Debian build / package issues fixed by Matthew Newton. * dictionary.patton updates from Brice Schaffner. Fixes #2137. * Added scripts to build "inner-server.pem", and updated mods-config/inner-eap and certs/README to match. * Added provisions for using an external CA. See raddb/certs/ * Include dhcpclient binary in freeradius-dhcp debian packge. Bug fixes * Bind the lifetime of program name and python path to the module FR-AD-002 (redone) * Pass correct statement length into sqlite3_prepare[_v2] FR-AD-003 (redone) * Allow 100-Continue responses with additional headers in rlm_rest. * fix corner case where detail files were not being locked correctly. * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group. Fixes #1947 * Clean up exfile code. Which should help to avoid issues with reading / writing 100's of detail files. * Fix build for winbind. Patch from Alex Clouter. * Fix checkrad for Mikrotik. Patch from Muchael Ducharme. * Fix home server stats lookup. Patch from Phil Mayers. * Add libjson-c3 as an optional dependency. * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking against NSS, which breaks the server. Fixes #2040. * rlm_python fixes. Fixes #2041 * Typos in "man" pages. Fixes #2045 * Expand "next" in %{%{...}:-%{...}}. Fixes #2048 * Don't add TLS attributes twice. Fixes #2050. * Fix memory allocation in rlm_rest. Fixes #2051. * Update trustrouter for new API. Fixes #2059. * Fix SQLite issues on FreeBSD. Fixes #2060 * Don't do debug logging of bad passwords. Fixes #2064. (bsc#1099802) * More graceful handling of "die" in rlm_perl. Fixes #2073. * Fix occasional crash when using cisco_accounting_username_bug = yes * EAP-FAST fixes from Isaac Boukris. [#2078], #2076, and #2082, #2126. * DHCP fixes, relay, #2092, add run-time check, #2028 * Decode multiple RADIUS packets at a time in highly loaded RadSec connections. Patch from Jan Tomasek. #2106. * TunnelPassword is not "single value" in LDAP schema. Fixes #2061. * sql log now opens the expanded filename, not the input one. This was a regression introduced in 3.0.15. * Remove unnecessary UNIQUE constrain in Oracle schemas. * Fix SSL thread and locking issues when modules also use SSL. Fixes #2125 and #2129. * Re-add dhcpclient "raw packet" changes. Patches from Nicolas Chaigne and Matthew Newton. Fixes #2155.- Fix permissions of radiusd.service (bnc#1053654)- bsc#1055679 - freeradius-server does not provide winbind/AD auth Added libwbclient-devel as buildrequires- update to 3.0.15 with security fixes for issues found via fuzzing by Guido Vranken (bsc#1049086) https://freeradius.org/security/fuzzer-2017.html * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret() * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63 * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax() * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp() * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions() * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly * FR-AD-002 (v3) String lifetime issues in rlm_python * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare- update to 3.0.14 (still FATE#322416) Feature improvements * Enforce TLS client certificate expiration on session resumption, and Session-Timeout. See CVE-2017-9148 (bnc#1041445) * Updated dictionary.cisco.vpn3000, dictionary.patton * Added dictionary.dellemc * Lowered the log output for failed PEAP sessions. * ALlow utc in rlm_date. * The internal OpenSSL session cache has been disabled. Please see mods-available/eap * Update detail reader documentation. * Make outgoing RadSec connections non-blocking. * Add SQL backing to Moonshot-*-TargetedId generation. Bug Fixes * radtest uses Cleartext-Password for EAP, not User-Password. * Update documentation for mods-enabled/ linking. * Enhanced checks for moonshot salt. * Allow session resumption for RadSec connections. * Update "huntgroups" file to note that port ranges are not supported * Fix OpenSSL permissions issues on default key files. * Certificates are not required when PSK is used. * Allow SubjectAltName as first extension in cert. * Fixed talloc issue with TLS session resumption. * "&Attr-26 := 0x01" now produces useful error messages. * Handle connection error in rlm_ldap_cacheable_groupobj. * Fix endian issues in DHCP. * Multiple minor fixes for Coverity complaints. * Handle unexpected regex. * Fix minor issues in dictionaries. * Fix typos and grammar. Patches from Alan Buxey. * Fix erroneous VP creation in rlm_preproces. * Fix MIB. Patch from Jeff Gehlbach. * Trust router updates from Alejandro Perez. * Allow build with LibreSSL. * Use correct packet for channel bindings. * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us a test license. Please see the git commit history for more info. * Fix incorrect length check in EAP-PWD. This may be exploitable. * Stop rotating session database files (radutmp, radwtmp) since these are not logfiles. - freeradius-server-radiusd-logrotate.patch: updated- removed obsolete freeradius-server-fix-cert-bootstrap.patch because recent /etc/raddb/certs/bootstrap simply works - update to 3.0.13 (still FATE#322416) Feature improvements * Add dictionary.rfc7930. Note that we do not implement the RFC. * Added 'cipher_server_preference' to mods-available/eap Patch from #1797. * OpenSSL 1.1.0 compatibility fixes. * rlm_perl: radiusd::xlat to evaluate xlat string within perl script * Allow authentication retry in winbind. Patch from Herwin Weststrate. See raddb/mods-available/mschap. * Added "recv-coa" method to rlm_rest. It behaves the same as "authorize". * Document Trust Router tr_port option. Patch from Stefan Paetow. * Update elasticsearch/logstash examples so that they work with elastic stack v5. Patch from Matthew Newton. * Print information about packets, replies, and contents in the detail file reader. * Update abfab-tr policy. Pull request #1893 from Stefan Paetow. * Reject packets which contain User-Password and EAP-Message. * Add example for filtering Access-Challenge. See sites-enabled/default. * Pull symlink fixes from v4.0.x. Fixes #1859. * Add systemd reload. Not everything is reloaded, but some is. Fixes #1662. * Better documentation for listen "ipaddr". Fixes #1921 * Add dictionary.cnergee, updated dictionary.nomadix. * radclient no longer needs -x to print statistics with -s. Bug fixes * Minor typos. Fixes #1763 * Fix typo in RPM build. Closes #1767. * rlm_mschap check for password expiry only if password was correct. Fixes #1762. * Update debian build. * update rlm_counter "man" page. Fixes #1775. * Remove erroneous assert. Fixes #1778. * fix mschap password change test. Fixes #1792. * Cleanup config file on data remove. Fixes #1795. * passwd module returns "notfound" if not found. * Check for old OpenSSL, and don't build rlm_eap_fast if it necessary. Fixes #1803 * Cleanup memory better after ldap version query. Patch from Aleksey Katargin. * Rename lt_* functions to avoid linker issues with libtool. Fixes #1277 * Many miscellaneous fixes and typos. * Allow long strings in %{%{foo} bar:-%{baz} blah". Fixes #1866 * Fix filtering operators, along with more documentation and more tests for them. * Fix OpenSSL fixes. Fixes #1876. * Finish SQL select queries even when SELECT returns no rows. Fixes #1879. * Set Module-Failure-Message for more EAP errors. * Correct typo in dictionary.rfc5580. Fixes #1882 * Remove obselete systemd syslog.target. * Client-Port-Balance load-balancing now uses client port. * Radrelay examples fixed from Alex Clouter. * Update systemd target. Pull request #1896. * Trim starting whitespace in xlat strings. * Get MySQL result lengths using normal API. * suid down after fchown(). Fixes #1914. * Fix cases of comparing pointer to NUL character. Fixes #1915. * OpenSSL v1.1 fixes. Pull request #1921. * Better Handle v4/v6 host names. Pull request #1919. * Remove "Auth-Type = System" from docs and examples. * Don't crash on malformed %{home_server}. Fixes #1922 * fix erroneous use of talloc destructor in rlm_eap * Issue trigger modules.sql.fail. Fixes #1923 * Document python_path gotcha's. Fixes #1845 * dlopen() the specific version of Python. Fixes #1592- Don't require insserv if we use systemd - Remove require for unused fillup- Merge changes from SLE to openSUSE (FATE#322416): * freeradius-server-radclient-init-error-buffer.patch - make sure we initialize error buffer. bsc#911886: radclient error free() invalid pointer * freeradius-server-opensslversion.patch: remove OpenSSL version check and assume we know what we are doing. (bnc#1013311) * merge .changes file, mostly. - do not attempt to detect "vulnerable" OpenSSL versions. SUSE security fixes do not necessarily bump version numbers as does upstream OpenSSL (bnc#1021375) - do not generate certificates in %post. End-user needs to do this manually. - keep FreeTDS disabled on SLE12 - we never shipped it enabled - require OpenSSL 1.0+ - use pkgconfig(systemd) instead of plain systemd as BuildRequires - don't list manual pages as %doc- Remove --with-pic which is for static libs only. - Use SUSE RPM group names. Trim filler words from description. - Do not hide errors from groupadd/useradd.- Add upstream keyring - 2 new modules: rlm_sql_freetds and rlm_eap_fast- update to 3.0.12 - still fate#320481 The focus of this release is stability. * Feature improvements + Add support for =~ and !~ in update sections. See "man unlang" + Add dictionary.checkpoint. + Simultaneous-Use prints out more information. + Print WARNING in debug mode when packets may be truncated. + Added expansions %{home_server:state} and %{home_server_pool:state}, which show the state of the server / pool. + Mark rlm_sql_freetds as stable. + Make rlm_perl less fragile. Patch from Herwin Weststrate. + Allow extended attributes to have "encrypt=2" + Update dictionary.aruba. + Add support for EAP-FAST. This is an isolated feature which does not affect anything else. + Update OpenSSL vulnerability list. Use a version of OpenSSL released after September 20, 2016. + EAP certificate verification is now done when "verify" is enabled and "ocsp" is disabled. + New dhcpclient and rlm_rad_counter man pages. + Minor abfab and moonshot additions. + Pass CFLAGS through from environment in RPM builds. Allows more custom builds. + Build with Heimdal in addtion to libkrb5. * Bug Fixes + Use correct typedef for older versions of sqlite. + Update mssql schema to add priority + don't complain on /dev/urandom in ldap + fix == operator in update sections + Don't create DHCP strings with many trailing zeros. + Allow MS-CHAP change passwords instead of complaining on large buffer. + Allow assignment or equality operator on SQL. + Update aclocal tests for FreeBSD 10. + Remove occasional hang in rlm_linelog. + Copy VSAs to inner tunnel for TTLS and PEAP. Fixes #1544 + A few minor bugfixes caught in v3.1.x cleanup, and back-ported to v3.0.x. + do_not_respond again works in post-proxy + Allow realm "~^.*$" {} and User-Name with no realm. + Fix leak when creating unknown attributes + Fix Debian / logrotate. + Make OpenSSL error functions thread-safe. + Fix crash with rlm_sql and updating SQL-User-Name. + Debian build updates. + Allow regular expression comparisons in radclient. + Fix memory leak on unknown attributes in detail file reader. + Update example paths in "man" pages when installing them + Build fixes for rlm_mschap. Fixes #1489. + BSD build fixes. Patch from issue #1583. + Be more careful about /lib/ when building. Fixes #1585. + Correct ifdef placement error. Fixes #1572. + Allow for more files in internal "exfile" API So it will be possible to open more than 64 "detail" files at the same time. + Remove support for statically built EAP modules. Fixes #1591. + Many fixes to rlm_python from Guillaume Pannatier. + Use correct week adjustment in SQLcounter. Fixes #1608 + Minor fixes to allow compilation without DHCP, VMPS, or TCP. + Fix checks for module / config file change on HUP. + Compile regex comparisons when sent via "debug condition". + Update filenames in documentation and examples. + Don't crash if SQL connection becomes unavailable. + Disallow originate_coa when proxy_requests = no. + Free rad_perlconf_hv in correct perl context. + Multiple fixes for Debian builds. #1510, among others. + Set OpenSSL FIPS compatibility flag when necessary. + Pulled fixes for the build system over from other branches. + Fix OCSP for RADIUS over TLS. + Fix skip_if_ocsp_ok behavior. + Better fixes for systems without closefrom() but which have /proc. + Minor build fixes back-ported from v4.0.x. + build --whout-ascend-binary. Fixes #1761. + Be more aggressive about not opening new connections in debug mode after CTRL-C. Address #1604.- use %{with} macro for conditional inclusions instead of hardcoding version numbers - improved package descriptions - fixed builds on SLE12 and SLE11SP4- removed installation of experimental module rlm_sqlhpwippool.so - update to 3.0.11 (fate#320481, bsc#961479, CVE-2015-8763, bsc#935573, CVE-2015-4680) * Changes of version 3.0.11 + Feature improvements - "unlang" comparisons of IP addresses to IP prefixes are now detected, and types automatically cast. - Allow shorthand form of ipv4prefix values e.g. 127/8. - Add "auto_chain" to raddb/mods-available/eap, tls subsection. This allows the disabling of OpenSSL auto-chaining of certificates. Which might be wrong. - Added printing of coa and disconnect stats (radmin). - radclient defaults to expecting Access-Accept responses to Status-Server. - Updated dictionary.lancom, dictionary.starent. - Portability fixes for Solaris. - More errors from ntlm_auth gets passed to MS-CHAP. - Update abfab-tr-idp virtual server. - Added "filter_password" in policy.d/filter. This removes embedded zero bytes in User-Password, for compatibility with broken clients. - The server now issues a WARNING message if duplicate configuration items are found. - TLS can skip the "verify" section if OCSP returns OK. See raddb/mods-available/eap, "skip_if_ocsp_ok". - Set TLS-OCSP-Cert-Valid = yes / no / skipped, which is the result from the OCSP check. - Interoperate with AD and "LmCompatibiltyLevel = 5", by always setting WBC_MSV1_0_ALLOW_MSVCHAPV2 for native winbind in rlm_mschap. - TTLS and PEAP now require "virtual_server" to be a real server. - Print WARNING when TTLS or PEAP identities are spoofed or not properly anonymized. See RFC 7542 for requirements. - Various rlm_python fixes from Herwin Weststrate. - Allow setting Response-Packet-Type in "Post-Proxy-Type Fail", which is useful when the home server does not respond. - elasticsearch updates from Matthew Newton + Bug Fixes - Fix issue where field nas_type would not be accessible via the %{client:} xlat, for clients loaded from SQL. - Fix compatiblity issues with OpenSSL 1.0.2. Ignore calls to msg_callback with 'pseudo' content types. - Data type "ipv4prefix" is parsed correctly. - Use correct talloc context in rlm_exec. Fixes #1338. - Complain in unlang if "else" is used with no previous "if" or "elsif". - Send accounting status packets to the accounting port. Fixes #1364. - Print out CFLAGS when doing "radiusd -Xxv" - Fixed bug with coa/acct stats value #1339. Based on patch from Jorge Pereira. - Fixes for LEAP proxying. Don't use LEAP! - Fix issue with "directory already exists" seen when doing "make install". - Fixed bug with radmin related to the option "stats detail " - Complain if the detail file reader does not have permission to read the "detail.work" file. Fixes #1398 - Fixed SoH. Attributes were not being copied to the virtual server. - Used a wrong list to global statistics in "stats". - Create EAP-PWD identity correctly. Prevents segfaults. - Dynamically validate authentication types for PEAP and EAP-MSCHAPv2. - Fix includes in installed headers. - OpenSSL 1.0.1f and 1.0.1g do NOT calculate TLS 1.2 keys correctly. See raddb/mods-available/eap, "disable_tlsv1_2" - Allow password change to work for MS-CHAP. This requires 'r=0', because password changes are not retries. - Fix home server fail-over for home servers using TCP and/or RadSec. - Special characters in expanded regexes are now escaped e.g. User-Name containing '.', and comparing /%{User-Name}/, the '.' will now be escaped. See src/tests/keywords/regex-escape. - Use correct authentication vector when sending Access-Reject replies for RadSec. - Set FreeRADIUS-Proxied-To in TTLS again. You should use the "inner-tunnel" virtual server, instead of relying on this attribute. - Fix debugging constants in rlm_perl. Patch from Herwin Weststrate. - Add samba-dev / samba4-dev to debian builds so that rlm_mschap can automatically use the new winbind API. - Automatically skip zero-length attributes when sending packets, instead of erroring out.- fix bsc#951404 * Rebuild of freeradius-server package fails * fix source url - ftp://ftp.freeradius.org/pub/freeradius/ + ftp://ftp.freeradius.org/pub/freeradius/old/- update to 3.0.10 * Changes of version 3.0.10 + Feature improvements - Do more optimization of unlang policies. This makes run-time a bit faster. - Re-name most of the functions in src/lib. Third-party module authors will have to do the same. - More documentation on contributing and how to write modules. - Update radiusd.service for systemd. - Open IPv6 proxy socket if the server is listening on IPV6 auth / acct / coa packets. - Create debian packages for DHCP. Fixes #1125. - Add more tests for "update" section parsing. - Update "man" pages. - Update attributes for Alcatel 7750 - Add dictionary for Boingo Wi-Fi - Add support for DHCP lease queries. See raddb/sites-available/dhcp - On HUP, check all modules for config files which have changed. And only re-load those modules. - Allow FreeRADIUS-Response-Delay(-USec) to be set for RADIUS packets. Patch from Herwin Weststrate. - Documentation fixes from Alan Buxey and Matthew Newton. - Update "logrotate" script. - Added more RFCs to doc/rfc for new standards implemented by FreeRADIUS. - Don't crash when doing "radmin -e "help hup". Patch from Matthew Newton. - The dictionary parser now does more sanity checks, which prevents run-time problems with invalid attributes. - Update debian packages. Patches from Christopher Hoskin. - Many other debian packaging fixes from Matthew Netwon and Herwin Weststrate. - Add "session-state" to Perl. Patch from Herwin Weststrate. + Bug Fixes - Fix rlm_files so that there are no collisions when loading 10's of 1000's of users. - Fix radclient to use our internal v4/v6 parsing functions. v6 addresses with ports now work correctly. - Fix sending/receiving packet messages to wrap v6 addresses in square brackets '[]'. - Check for sasl/sasl.h when building rlm_ldap, and disable SASL functionality if unavailable. - Fix issue which caused a non \0 terminated buffer to be assigned to attributes if the value being assigned contained an invalid escape sequence. - Fix deadlock when reconnecting connections in the connection pool. - Fix potential overrun in functions that used fr_utf8_char with a non nul terminated buffer. - Fix decoding issue for Tunnel-Password type attributes which were very long. Found by Denis Andzakovic. - Fix radclient issue with TCP sockets on FreeBSD. - The server now creates ${run_dir} and ${logdir} directories in daemon mode, when running as "root". - Handle tags when using maps. Fixes #1191. - Fix crash when CoA packets time out. - Fix parse error in rediswho - Fix regex support in SQL radcheck the "users" file and radsniff. - Register listen xlat earlier, so that it's available when the virtual servers are being parsed. - Parse Ascend-Data-Filter when given as "0x..." - Print Ascend-Data-Filter correctly. Add test cases for both. - Allow old-style clients again. They will be disallowed for 3.1.0 and following. - Complain instead of crash when "else" and "elsif" are in the wrong place. - Clean up memory more aggressively. This lowers the maximum memory used, most typically for TLS based EAP methods. - Prevent the server from unlinking the control socket of an already running instance. - Fallback to using the configured OCSP URL if one exists, and no URL is provided in the certificate. - Return CoA-NAK if proxying CoA fails. Based on patch from Jorge Pereira. - Lower peak memory usage by decreasing size of internal memory pools. - The control socket is now left in place if a second copy of the server is accidentally started. - Allow virtual attributes in "switch", "case", etc. Fixes [#1240] and #1265. - Many spell check / typo fixes in comments and example configuration files. - Better handle multiple DHCP listeners. - Don't print secrets for old-style realms. Fixes #1267. - Don't fall through in empty "case" statements. Fixes #1274. - Update EAP-TTLS so that MPPE keys are correctly calculated with TLSv1.2. - Always delete MS-MPPE-* from the TTLS inner tunnel. This allows TTLS / EAP-MSCHAPv2 to work. Fixes #1206. - Fix off by one error that caused some MSCHAP-Error messages to be sent without the password change version (V=3) and the textual message component (M=). - Always include C= V= and M= in MSCHAPv2 errors. RFC 2759 does not say that any of these fields are optional, and not including V= caused errors with wpa_supplicant. - Do not include M= in MSCHAPv1 errors. It's not supported.- Fix boo#912714: freeradius can't use ntlm_auth * Create winbind group * Add radiusd to winbind group- Remove gpg signature file * The gpg signature checking is broken and doesn't work- Fix bsc#935573: Insufficent CRL application for intermediate certificates * CVE-2015-4680 * freeradius-server-CVE-2015-4680.patch based on https://github.com/FreeRADIUS/freeradius-server/commit/a03814af310bb3bee74ea012546d99c48b0ea5c3- update to 3.0.9 * Changes of version 3.0.9 + Feature improvements - Make "pool" configurations more consistent, and update documentation for them. - Move connection pool logic to "most recently started", instead of MRU. This should help with pool stability. - More VSAs for 3GPP2 - Added examples of multi-value attributes to rlm_perl. - LDAP-Group and SQL-Group attributes are now dynamically allocated. - Only the "sql" module registers SQL-Group. Other instances register "instance-name-SQL-Group", similarly to "ldap". - Unknown attributes are now complained about more often when used in unlang statements. e.g. if (Foo-Bar == 3) used to be a string to string comparison. It is now a parse error. - Rename RLM_COMPONENT_* to MOD_* in the code. This makes many things easier. - Move to C99 initializers for modules. - Load modules in raddb/mods-enabled. This allows attributes like "LDAP-Group" to be used in the "files" module, without explicit ordering or listing in "instantiate". - Added 'bootstrap' section to modules. Third-party modules will need to be updated. - When adding clients from a DB, add them to a virtual server if that virtual server has a "listen" section. Otherwise, add the clients to the global list. - When reading dynamic clients from a file, don't expire them if the underlying file is unchanged. - Allow the server to originate CoA requests from the post-auth stage. - The server creates ${run_dir} and ${logdir} in daemon mode, if they do not already exist. - Add dictionary for Wi-Fi Alliance Hotspot 2.0. The server now supports all mandatory and optional attributes for this specification. - HUP now re-loads the configuration only if the files have changed. If all files are unchanged, HUP re-opens the log file, and does nothing else. - Much better debug messages for EAP-TLS, including which attributes are cached, and when they are retrieved. - Increase default max_requests to 16384. Memory is cheap now. - Added "stats memory" commands to radmin. Debug build only. - Aptilo controller dictionary updates. - SQL modules now use Acct-Unique-Session-Id everywhere. - The redis modules are now stable. - The LDAP module now supports SASL "interactive bind" method. This allows Kerberos based administrator and user binds. - DHCP code is now in libfreeradius-dhcp. - More DHCP encoding / decoding unit tests. - rlm_replicate can now be listed in the "accounting" section. - Better sqlite debugging output. - Remove "required" option from many sql_ippool directives. - Set default CA "basic constraints" to "critical". Fixes #1073 - Updates to help / man pages from Jorge Pereira. - Added more tests. + Bug Fixes - Be more careful about unused config item warnings when using -Xx. - Move more defines to be auto-generated. - Allow virtual servers in proxy fallback. - Allow %{module:} to work. - Don't crash in RadSec. Closes #980. - Return better errors when a unix group / user is not found. - Re-enable detail module "locking" parameter. - Don't crash when logging replies from Status-Server packets. - The couchbase module now uses "update" instead of "map", for consistent with the rest of the server. See raddb/mods-available/couchbase - Don't require NT-Password for MS-CHAP password changes. - Be a bit more careful about decrypting MS-CHAP-MPPE-Key attributes. Closes #1013. There is no perfect fix, tho. - Fix security issues with EAP-PWD. See http://freeradius.org/security.html#eap-pwd-2015 - Fix dynamic clients read from SQL in non-debug mode - MS-CHAP now allows retries (i.e. password change) when passwords are expired. - Allow "user=radiusd" when the server is already user "radiusd" - suid up/down works on non-Linux systems. This means that the control socket should have the correct ownership. - Fix issue which caused the server to sometimes have problems when a home server was marked zombie. - Fix format.pl because Perl is now more picky. - Fix proxy to Packet-Dst-IP-Address, so that it uses the correct destination port. - Fix corner case with cursor functions and removal. - OpenDirectory fixes and documentation. - Fix leaks in rlm_redis. - RFC 6929 "evs" attributes are now encoded / decoded properly. - Fix talloc pool leaks when receiving malformed or retransmitted Accounting/CoA requests. - Printed attributes again use double quotes instead of single quotes. - Set X509_V_FLAG_CRL_CHECK_ALL, and add "check_all_crl" to eap.conf. Fixes oCert CVE-2015-4680. - rlm_expr now errors out correctly on malformed attribute references instead of triggering an assert. - Make "break" work in "foreach" loops - Allow dynamic expansions to work again in the "hints" file. - Correct minor typos in comments and examples from Alan Buxy. - Re-urlencode the path portion of ldapi:// urls before passing it to ldap_initialise. - freeradius-server-rlm_sql_unixodbc-configure.patch removes hard-coded directory in configure script of rlm_sql_unixodbc - install new module rlm_sqlhpwippool.so- minor adjustments/cleanup of spec and changes- update to 3.0.8 * Changes of version 3.0.8 + Feature improvements - Allow syslog_severity to be set in rlm_linelog. - Allow defaults to be set for bulk clients in LDAP and couchbase. - Updates to dhcpclient. Patches from Nicolas C. - rlm_mschap now supports direct connections to winbind, which is faster than ntlm_auth. See raddb/mods-available/mschap. Patch from Matthew Newton. - Recommend /dev/urandom for TLS randomness, instead of ${certdir}/random - Allow TLSv1 to be disabled via "disable_tlsv1" in tls{}. - Allow Expanded EAP types where vendor is 0 (IETF) and type is normal EAP type. Supplicants sending Expanded EAP types like this are broken. - Add support for server side sort controls when searching for user objects in rlm_ldap. + Bug Fixes - Don't complain about "authorize" in "server {}" blocks, but only if there's no "server" block. - Fix cosmetic issue where debug from the first packet read by a detail reader thread would be emited during config parsing. - Fix ASSERT on truncated detail packets. - Don't use main server log functions from within panic_action, as in the case of syslog this would cause deadlocks if the fault was triggered from within a malloc. - Fix issue in "switch" when "correct_escapes = false". Fixes #911. - Fix sqlcounter configuration to use "%%b" instead of "%b", otherwise the new syntax validation will fail. - Allow forward references in configuration items. Modules aren't always loaded in a sane order. - Fix more escaping issues. Closes #912. - Decode MAC addresses correctly for VMPS. - Fix memory leak with TLS connections. - Fix state machine threading issues for conflicting packets. - Fix copy_request_to_tunnel issues for tagged attributes. - Allow "ok" to over-ride "updated" inside of Auth-Type sections. - Update state machine so that post-proxy is run though child threads for performance, instead of blocking the main thread. - Allow "netmask" to work again in client definitions. - Relax restrictions on SQL group queries. - track outgoing proxy sockets and clean them up more aggressively. - track proxy statistics, including CoA and Disconnect. - If radmin has a connection failure when running a command, it re-connects and runs the command again. - mark home servers "unknown" less aggressively. - Fix potential SEGV in PostgreSQL driver on error. - Fix issue where fields like nas_type would not be accessible via the %{client:} xlat, for dynamic clients. - Set default busy_timeout (of 200ms) in the sqlite driver, so writes don't cause selects to fail in multithreaded mode. This is user configurable, and may be increased if required. - Convert Password-With-Header attributes to binary (from hex or base64), in the authorize method of rlm_pap. - Fix invalid assert in state.c, that could cause abort in post-auth. - Fix double free when -m flag is used, and connection pools are referenced by multiple modules. - RADIUS over TLS accounting uses the same port as authentication. - Regularized return codes from radmin commands. - Fix RHEL spec file so it works correctly for Centos7 which uses systemd, and didn't like the SystemV init script. - radwho and radlast now have a -D option to load dictionaries - DHCP packets are no longer checked for duplicates. - Don't crash in sql module group comparisons in corner case. - Calculate MPPE keys correctly when using TLS 1.2. - Fix load-balance sections. Closes #945 - TLS certificates are available again in the post-auth section. They are not available for session resumption. - radclient encodes CHAP-Password properly when using -c Closes #955. - Fix issue in rlm_cache_memcached driver that caused variable length values to be truncated. - Fix track functionality in detail reader, so it no longer fails with a "Failed marking detail request as done: Bad file descriptor" error. - Actually add the peer identity (as User-Name) to the inner tunnel in EAP-PWD requests, so it's available for lookups. - Fixes to PostgreSQL queries. Patches from Santiago Gimeno. - new set of consolidated patch files: deleted: * freeradius-server-2.1.1-logrotate_su.patch * freeradius-server-2.1.6-rcradiusd.patch * freeradius-server-initscript-pidfile.patch * freeradius-server-radius-reload-logrotate.patch * freeradius-server-var_run.patch added: * freeradius-server-radiusd-logrotate.patch * freeradius-server-rcradiusd.patch * freeradius-server-tmpfiles.patch- Do not disable as-needed build - Remove the with_sysconfig switch and just stick with versions- update to 3.0.6 - fixes a segmentation fault in PEAP module (bnc#912588) Feature improvements: * radmin / raddebug conditional errors are printed to the output, instead of being discarded. * raddebug will exit if condition set with -c was invalid. * radmin auto-reconnects if the connection to the server has gone away. * rlm_cache now has submodule support. See raddb/mods-available/cache * New memcached driver for rlm_cache. See raddb/mods-available/cache * Add support for &Attribute-Name[*] in conditions. See "man unlang" for details. * Add &Attribute-Name[n] which gets the last instance of an attribute e.g. Module-Failure-Message[n]. * Allow for redundant string expansions. See the "instantiate" section of radiusd.conf. * When checking IP addresses in conditions, make the right side be parsed as an IP prefix. * Support JIT compilation of compiled regular expressions when built with libpcre. * Support named capture groups with "%{regex:}" when built with libpcre. * Increase regular expression capture groups from 8 to 32. * Emit error markers for badly formed regular expressions. * Allow 'm' flag to enable multiline mode in regular expressions. * Support limited implicit attribute conversion in update sections. * Support casting between IPv6 and IPv4 where the IPv6 address has the v4/v6 mapping prefix (::ffff:).- Drop .keyring and .sig file: freeradius-server still uses MD5 signatures, which are no longer validated/accepted by GPG 2.1.- update to 3.0.5 Some of the new features: * Allow LDAP to specify arbitrary attributes for dynamic clients. * Allow one level of backslashes (finally). See radiusd.conf, "correct_escapes" setting. * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. * Allow multiple new connections to be spawned simultaneously in the connection pool, to cope with spikes in traffic. * Use kqueue on systems which support it. This allows for better scaling when using many sockets. * Home server "response_window" can now take fractions of a second. See proxy.conf. * radmin now supports "show module status", as thee counterpart to "set module status" * "ipaddr" will now use v6 if no v4 address is present. You should use "ipv4addr" or "ipv6addr" to force v4/v6 addresses. * "client" sections will allow "ipaddr = 192.192.0/24". The old "netmask" is still accepted, but the new format is preferred. * Allow custom HTTP headers to be set for rlm_rest requests using control:REST-HTTP-Header (attributes consumed after use). * Extend format of %{rest:} expansion to allow HTTP method and POST data to be specified and urlquoting. * Add support for aliases in rlm_ldap. * Add support for connection pool sharing to all modules that use the connection pool (pool = ). * "tls" sections now have a "psk_query" configuration item, for dynamic queries to discover a key from a PSK identity. * Preliminary support for EAP channel bindings. * Foundational work for dynamic home servers. They do not yet work, but this is now only a matter of updating the "realm" module in a future release. * Support &attr[*] syntax to copy all instances of an attribute when used with the += operator in an update section. May be qualified with a tag. * The logintime and expiration modules can now be listed in the post-auth section. This makes some configurations simpler. * rlm_sqlippool is now IPV6 capable. Set "ipv6 = yes" to get Framed-IPv6-Prefix returned. The SQL queries have NOT been updated. Please submit patches. and numerous; bugfixes - remove gpg-offline - create /run/radiusd after install - drop freeradius-server-opensslversion.patch (upstream)- freeradius-server-opensslversion.patch: do not check the minor version of openssl, minor versions are supposed to be compatible. bnc#906682cloud127 1624472258  !"#$%140d980caa97b5f4939074b256aa84365c3e7ce3280c2932c87ce3c8ca8c04f49e4ecde1f2eb622241dbffa6e3f47530056155310762db129fadca1d8aa722d88bd4b7fcf3def1c38666bc015ad562e88cb41af3cfea02eb2bff585b29f2bcc5a14e99d4908220f8356c6e32c7a3a64512b61e0db56e07a5afa221682cfba19f72e9cc87cfb8a09b43e2979fc563fd67b7115d97230315a7a446549b5743299ad5d8ccb9ea6010bbdf711287999a1b6bb01c90463.0.21-lp152.2.9.13.0.21-lp152.2.9.1   debug.build-id140d980caa97b5f4939074b256aa84365c3e7ce30d980caa97b5f4939074b256aa84365c3e7ce3.debug0c2932c87ce3c8ca8c04f49e4ecde1f2eb62220c2932c87ce3c8ca8c04f49e4ecde1f2eb6222.debug41dbffa6e3f47530056155310762db129fadca1ddbffa6e3f47530056155310762db129fadca1d.debuga722d88bd4b7fcf3def1c38666bc015ad562e8a722d88bd4b7fcf3def1c38666bc015ad562e8.debug8cb41af3cfea02eb2bff585b29f2bcc5a14e99d4b41af3cfea02eb2bff585b29f2bcc5a14e99d4.debug908220f8356c6e32c7a3a64512b61e0db56e07a58220f8356c6e32c7a3a64512b61e0db56e07a5.debugafa221682cfba19f72e9cc87cfb8a09b43e2979fa221682cfba19f72e9cc87cfb8a09b43e2979f.debug63fd67b7115d97230315a7a446549b5743299a63fd67b7115d97230315a7a446549b5743299a.debugd5d8ccb9ea6010bbdf711287999a1b6bb01c9046d8ccb9ea6010bbdf711287999a1b6bb01c9046.debugusrbindhcpclient-3.0.21-lp152.2.9.1.x86_64.debugmap_unit-3.0.21-lp152.2.9.1.x86_64.debugradattr-3.0.21-lp152.2.9.1.x86_64.debugradclient-3.0.21-lp152.2.9.1.x86_64.debugradeapclient-3.0.21-lp152.2.9.1.x86_64.debugradsniff-3.0.21-lp152.2.9.1.x86_64.debugradwho-3.0.21-lp152.2.9.1.x86_64.debugrlm_ippool_tool-3.0.21-lp152.2.9.1.x86_64.debugsmbencrypt-3.0.21-lp152.2.9.1.x86_64.debug/usr/lib//usr/lib/debug//usr/lib/debug/.build-id//usr/lib/debug/.build-id/14//usr/lib/debug/.build-id/28//usr/lib/debug/.build-id/41//usr/lib/debug/.build-id/8a//usr/lib/debug/.build-id/8c//usr/lib/debug/.build-id/90//usr/lib/debug/.build-id/af//usr/lib/debug/.build-id/c5//usr/lib/debug/.build-id/d5//usr/lib/debug/usr//usr/lib/debug/usr/bin/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:16593/openSUSE_Leap_15.2_Update/01d40a48b058f57394a1ecc1551a3e1b-freeradius-server.openSUSE_Leap_15.2_Updatecpioxz5x86_64-suse-linux directoryELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=d5d8ccb9ea6010bbdf711287999a1b6bb01c9046, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=afa221682cfba19f72e9cc87cfb8a09b43e2979f, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=280c2932c87ce3c8ca8c04f49e4ecde1f2eb6222, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=140d980caa97b5f4939074b256aa84365c3e7ce3, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=8cb41af3cfea02eb2bff585b29f2bcc5a14e99d4, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=c563fd67b7115d97230315a7a446549b5743299a, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=908220f8356c6e32c7a3a64512b61e0db56e07a5, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=41dbffa6e3f47530056155310762db129fadca1d, for GNU/Linux 3.2.0, with debug_info, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter *empty*, BuildID[sha1]=8aa722d88bd4b7fcf3def1c38666bc015ad562e8, for GNU/Linux 3.2.0, with debug_info, not strippedPPPPPPPPPp{"Cj"freeradius-server-debugsource(x86-64)3.0.21-lp152.2.9.1utf-82a2a856db2dadcacede5ec65ed47b2433ed0e57ed880a9eedb6fa916c2187882?7zXZ !t/x] crt:bLL .Z,ʎj/:712d8|=ZoM@BWSOHDToPMb\Ϩ -^xL8@Lx:17^꿹۟xp$fk!Җ "+Cv&6P3IImBGn%={ ٪|F{tiM9ZIyp2J8\?ɪ朵" ZZ Q̵: xcZ2w!ci*vE4fB2m6lk Se?@6+"N 9Xz7|췀s2d@afc(*J,}S X*+X_ CЮkDF8Mi pjk*\᪃Zd+VP?SjYU3'->_bX7Mj8E7H7bm3E?ļRV=^Lxr )X^. ,C'e$ IE佮PL?!)i *_P̷-e1't2TOqicP>7Ţ4,gRiovF䉐="v-Mٻ#{KDx\c2EH6r;U(= iT2Uƅ9{ :/VJ1:d(vvr/ǵ24_Y$?Cтma&z ņ͕j3h4pXޥ.$ 3NGrA,ttϷx]kF^ DQG>5׷4͖CHd-0}Knmwݑi{F֥˱Szf=ՊMIm9B=ק_pp[dB.۠Ze9Uk Ђ7V\3?T= 0 cc&=X2]9%FtAA&%K]-5#A {A}x 5L^/+ڇ^/4Aq+KEt> ^ӝE#L`ŻZMrҝ9\IڼEظ",!5.}tXYjG$R?_$WNБ AS0@!8$#'DQ-@Lj #ү'; \D"f'5QU; +9I9d`۫Pj*P砵kQ_+D .s]C) 0A\>a->;h Uozy3\K!;r;/#]!J:'!9ܻ G.( ̄d<"vm%v}r籍i}u*55tj" fRsءȎ A cW5{3u`?EU%7uY(۰5Ife9YKfAY3 (kJ0v"olO @ F;}q*얠N4c";ψ8ll|v+}Pmǭè?!F>kl4bI T ].5DUXzsˌ~åḂ5@FܥenZt#.}!AV7B@DBcQa 6K4ncoyEr)>a>9>UBE2mHptL|.+Bb 0҉K{thg 2>xg6F p%E|(ĝV2Oףz\  :+s2uN .[=qžk?,cX> pۘnk>U\ճ#+Ń¥jGC=#>j'TTમrZbM 5 }V 66h&%Mr,Z#6_E܏iTur{n; f !CC5A\fN'h2hުfK}pISjAM )tP"PjX3" t'Z9jHbf- mQE#JaB3\%41 1>*G,sS `gc;Tʛs o4U}h5䆑 CZgC$F- `(!(9{nz!W$!4g[69aƔL::ku+ĊNt j^7/LZHj"s&*PH`eTrQwʳ!9AYzU8X8{DoFVk x~CeLtcE٪LJ-EGKNGN/hENпEvVwX= Aeߨv.+]Q` 7YZΘ6(-{LOP6y5H1$7ht1VCW!žF7pCC>unv~.ܑ|Jp?b|E\]v[kS+{V/?~.Ӫ:1EmuV?rrĺEf dZÎ"b`YmX;ϷM^&! a.BDiv4'amg;1\ߜS7zc] vP f]fBdo߳AGPɸ$kX7ˮ;֜b 'S.D1YisËlD f S|͝#|:*#Ys`/üe98Ơ{V⩸nZ h?,@۔uo-x؝H͂<()qe9ɣ =7W]DXI0˄4-FAGA˫Tek9w" p"))gruq] ڝSZϖLkI%܂/4XzAAﶬ;[ :/{ܵW ޒm$*VpRDdDb-+o(~F: L$F/Gs$FX$0T!x*CDrj`.K|0iBrChVp_QISaNuߋ ݠKBSn2cӨ& }$)3:H`PD5}0GdK~#]55+ )I3[̾-Q:g̑j|gAR toTѬ>;$ Xdbͣ~m}L]Dn3QeS QP4j)b ea!z~)EW#eir#s>Tye![$k QR2Hawݤ4з}Ng5[dL;״'gEh0"]5mzPnwrpU1YTdy({$O2J tas6`g)Qo/>".0>MW.sYZ4Ⲙ2T7|pU=ИC}S2,mxRVt5@B|l 64G,bosט=2f܈ Xn5pߏ۾" 'h!<Z0 b޷Ł&-e IVr@Zҿ'Sb t"+l-g+ _J'(O5TJP6B2 HIۡDx4G.1wF9,˩ڠ9g'h즡Tvz0`4];3HZ>ZAgl\~.xZ6 y.*x P E8! >ګ 9y ~N]*Z]svQ28?=K"7sp,g3x:#={^_, _#l#Th۩R isq_eo/}C6Q=UiUN3ݷ`9L$,/@HcQp9HG9.JM9H`[0OoNC˹(Y_[eu8`O+:̠G%MDYZ8?;O2Z2^| 6ֈ>MJ#Otķ%үI>6+!>Ku>KrGDыr .9 :gZ|5QGX ~SAQiܜHp hgZ*R*J-ظh,[8MXP#nBT=P6TA]Elgϳu;emV۴Z&9)bzNPy^h}k {MqP65Æ 57$X iL>i^5.6lP65k) F@r0vEh<ʍo;"gRCf W?[]ii0hVa? tt{%B:w2ҕVeK2pjʅO݁~`vر/'^Kqr|HߧlH'䍣P V:6qj~}&\Vr`?NVʮ$(oѲÍ7W@=^H']&+mљ=J-xb11\/ 32"-Z ^@U.JfCR]ѩ9Ɖʄ&nwU2i?"3JSwNTNqN"U9!}$ NQ*k T6P+]*-]zl }(kY <+P1e ьh)$LMF}r OZ*+?[_ cI5 fKF Nfg/ϗ2pg Ø xQTL|vg(k6|9 ]BcяFK=k)kk,+0ZpS㯀tD\a'<YY?I63P?ږ&'28Cԑ5GDt~-{\JylƸ#A$V3z0PB~Vر+b'O-l1ے򑭂0>EិS$m։*A`;vRQ&2z&-~_l\ -{6rS3%rOzXm+˵mŒ$-BߔX)w2 [[#@85-ԾM1*Kq^6Unxh @ު7CR/&Y+c[CoW{a Ok%X pW~}ܚ dݚ=_%r_X-}'z H lĪqBvwȭ(9i\ކMb=$'KV$vXpcSn0EfI|qSDgJ3`x/z`x)@P9xF3IÑQ̿2=DNaL+8/6o$zsb5ԘBzN-!AߢJwȡՊLEYnm6W:m[sOn?q1_?0֥5h2YGz-Q .S3`Xz_;?Qm}%*#͡~lՓuQ` ~>5g_ 36$cFPW<i<5hz/%oW72}^d j_ƙP>x݋"D9N790CnqAHk^b*&u nCRi,t^NzQq^L>BΊJs3F-t xɂuk\zC{Ё6{@%x߮iH:}hvWn#Φx)WUcJ v@XERߦ˗&E<0`rw!&3]dml61ZRc͈tMvF,;s2uoO .iJdn72k}), Kcoτ?ae|jӦUJn캰XCݽ"7_NJVg*D)$U)]`w`f`;c@$,1u + Tm K*qPGߐ&o|nI @ӼyF ŷͼL0"4UJ(\v;GdPD=d4:\wB ˷\7TYWCowiփkiӔ'J K+Xc q7О |@Q'(YpK Oņg-z>]3T >),M%OL;k8lQ{OZzTx!k |?LFg_hePú/3h“P}N_1$ܓǰdc:Jcjఊ*2LSuH(hwCnנg BKJNL^k`A3"fc;F)>! P\y[Jҟn++Eyj*z.O[k@ӻa[Ѓ\AKtl}PsTNj*߀]k3>W]zw9+D r. .ʡ'už}? _xը[y0aH;\zDC^+)}Ksw)̆vX~/OVؤf%$a7ek|کKOntQP2M%PsPXLEG( K<3 i37oSOd 8ɼHVV%+|qaPgd,ĎJHȁs_*!'BU*?Rڽת۔%zg@1> h! k0]jYRWuʋ*EVH{oG%+aD֌)$w[|G+l:зna\篟}l`ޓӫ2gLy VD֪UPڸ1 #~q8Vvvvu4l@Q&beUH^274ռ ؋HYȅQbaSRn[_LC|\&B#"~rGn9F$17\sPğ}Ab*)Ä8d%) R*lR{x*U3 , &0ohX 6g-^bTuuKR柭}>o)[@2f:+T:J>rTpbF_1w{@+OJJ8މj `ѽ1Ɗ0O?ƿXzsZ4؅/C^_ ")d+yX¼hޞ)?h*ò5}վWifWl6bLW@wCXR#ƒ0`z90ܳͩmQhkR|lڤ_r@@}9aׯ"ӵ@$+ayA "[[U|xRL,ln,,2;XXyיx| :Q_>U'.b5&羃u. Rv[6^~T1(9uͩʰo#l3Y/ XS K80* */!K4.b&{V~Y.v]ZtC6A9 }ޭls2`:N"TÔ5u`Y wL Bԧ9A~,g(B6S?/T}_<nGZ&)YMx۫Fg48B-RN v7yNek ̌]Άz̿X(\ݦ~FyU1ē3 ]>TFֺZ74lߛ:pQZ"R{y$绚d rʗ3c1fKbHѡ6u80L3.ͮilZP*hRhKcLNDF"TkGtA6xPe 涪)pk/ ȉMs:7+E:O$/p_V"~"wnE]GnL)Co(R8AWNi&q# Ӱ+ݰ`oZoJS>ZgNozPoO7K b?NX%X1rU)8k0v'6̚ !_SRSМ/N>m#0^F6Ҹ)j˗Պ70^\s3F 5-⋾͞0-j0 sGYg>6Qm)koX% i]5x p?ݕZ[R'M`=݃&CCUj~ư=+zv@|^3|DQxUr1RMgÛyI:fy-vw6yq|\]T`Zs0Xm DNjiv7 s:뢷_UH9FAJVU.Z8D> yǜ]R~C"vM?f|礖4&dnL$ PEsiŽF5r3S5^"ؑTjIbf `9OIi!Ѫ8!Y4bw`3ǭ[[nq!w_\]k rlYu{jT!HANe}~wt{q4`I涠yè-#8Бy3Q`lvPq Tdގrh?BCiZUeHkt@\26q-x/)q-ۨksYZ36t3A{hGԎ):8߷sD/?P WXuSǺJj:/֒֬JޅM}gPruoa@'~KuگSZmiuW5KծO>/ or6T,fOaZaTݑ;)1 :u{"#o0L֠sU`ռ~.NŐDayZw<W@능9gNa!(? UkRN&7 lTe]H:J*[*ּ_ uE=1xM ^mF]ٶS跁M6%Jm) 9R$X߆(Q|I:4ȼTEŽY$ Ă"@G"]!MP9e #ףWܬpIA g`5^.h$ %1aTN>vn0.ԅցWvZ;3{!OrG KYeZH^]=&Xhpe]g%s&6z86X & x5"^,BWK\6D_x2nie.Y/bZ>ɁvGVڦRc:cۣc.#uL` [)*XbƄYZ pDE_b3ʏ_Ӌ>*eh6!=' iF]ò$~#ypcѲ:f_V޸w@ᴗ.Pf*`򎷏ZqSeejc ڋV( UD1r̉}>[]oyU=$ga qb˅fxbm\ʑob,N[*3Z}c"kD6z@c=6"QUgS[ˆZ2/IYhB_I> i.grs,8|zM['cdğ۷]5>~\%8@h'26yIL+o@K+Э<|Wwc]z -e_¹Y]Zr櫔D^ֆ =KBGwP% qVnNPDgcH/%h]oЉfļr3s)\+vmNV Y (-"m&֧LIYOT,R\jve~`7 <hЂG6\Cl4;'@N}mv;ލ!L ixGP>Z}vo>!Ծ*tR4zn"{*kRa"Dil ;.ū|gAP){?8rzͼҵ PƇA-{Dޡ[X.ZxL3</)ʫWy9̢795 M.w H-vL76jSؿ~ܾHCW~pdQi`Tj?>_=UNRWFfѫR<O$]mYhX'X$#(k/8؏at^nlڣ@*,kM Y ݴi wd,g:Vo( oJP8m/fٮnfV4BMِ㝭O d) *y֙WVpg<ъWSGqc~/Wb˦bRU~Ip3?km*}~NEY\Z)n쳳 P&~觺c"+w xt[mb}M?rɡ{b/n]/C( ev;AXT|sF itk~mIaI}ϯP (Ybd?"\siF>b5h3rr'=BCM_-ŬecYP_ kW^ Bp|Fκ_bk}9Lkάщ1_^~Qt0tÄ=}hZb0}vΘ_G/"-?{tcLRD?^XFDL 8 q,eVX'=juV-~BT)0' duWj)!Ap03ϖ|xv_R)ks4j(54pQ`W[h{wU$ʪL`\ |N@cSIͪR: 5e屡@sրYn8lZzrX}v/{sT^* l($vo踸@nc_%2tyˀ89d1oGzaMn62㈅hf2@ƛ7!;:j9p pHM*&z4:1 *#vGѓWZ ung:EDDg)5s Y}w8* xʼn!^'rG_'x~#@Mx_.iI(ϛ`ଥaC%9H[8 sxbh0ņ&#( (?LְR3d _fKpL,XM6H뤐۴7Д7>N=X{Dk;t8:;k)w e &OJ?ZF!OIuLT9e܆KT}u~KC':Vt("Ϯc{I}Q[c01LiWJE9wPᩜ0{DPB} % ts.r7S% a`G}YGwݾ*2!DO^ǦB[|ujA٦Qdg3)'*NucV&7"f.Q`V07f#tS>Z]&,E/ \'1^JIA쁭st:<#jQĶ]Q4=~zdF@{E tF }oʗ|N콛mʺ7Qcdp_Ӈ>J 2PTRs;]Z^fB~77g( v{-_5-8Ox́9$0w\; t5'^[ܚfH& >!ssE!ԠH $i؜倕ZO!_>OLN#7_^ }m'pcC2w;y 厸+ IBeMC@hyX&E'ƀK;j÷|w|F7+ը\ i#`^ ,i|Z"MSo)*0|f()i~%;3i`Wɘ9?$s+o :Z,͊ +uL4j9j%t梋bE$v#O/-– 7wF*Zf+tB" +}mZ/= 7rXj4l>3=^‡XH %-%|'\ TFB )8c&rNbgcv( 'HA$(QIЉІ s JCFҢ3k4/' ˿+fMȞ Ç#ۢ!l&e-<> NjڐCqTs9w<.$})aA SQ%;s}nXcG3=c\6֜|4Fx-1k|QAY&<rIׂ#i#Vn[:>t|tz&=X./Gij/gz4NLA)Y_.pMDP*m\,Hsݫ$]C!i! [5fw)##©{x|>@f~Q w|I)۳r*y#g8˄pLvÄ KŗOzCAh!ٔof;wvlr@K谟q)Րx;c1PbKh1=[j?4ߟ(+p%,\e͇ YY"L|:;Eu7l Gk({TK{U$0+sj{}H_a{;v 7w?d/'}s)Y eU /)!?/ro0"$m@XQ=EL [@L]EtUA *L|]#AC |=R5b 9LIVXH5 lOA85M+/ @ٻN0Xd\+}J Rߖܓà+u*u=N\FF^yfIQ>v-N떩wXs v,dO˦یbPaz)̳~7uB<7akyW )!=ccm4nt,BX!5N0uzx Tِ q6bg}f@ mirg' /R q~<Gyo fBtֺ~lW%٨.<**!&Ab7e{-($ow@ igh G5;#a8`]C;U[7d Ƀ`磾wH~T Dş$K N?PQ9Rj4L}R4'R$V7q3ǏzP !fML$I!@k `_{0P—Mh%NHk]6M&{'p`% ü xq2K2L2Ү)\VMn [*] ^К:cdq$p#c-!k#fvDAJp}yk; 7gSvF<FBք8{Mڹmig^1`0r@_(i65l5#Ham=#![HT~,zQ~H9 z 9~Fy#i_[Ќ\Om]vAfQٚ nF Q`~Ԉ}p`_lE>CSM %1߼?0cˁP| w uiܿ3?RѮ{tO-L^,j7(*C7T7P%lI[DO(8"8>bm\w30 F쫒Q+@TZK(@k97+s]'NXT:"3 %I(/bh3k뒱PBxw\QsdEr(ws}n|zS#ڠfIc%m/ E#?e3{#'P.g, CceYұ&j1h7#" T #4)Wn@0|FKm@泵@zW9n!FӸ04nr"E\qZ\(]A|e, X> FUэ;W+ FU?ywM!SJA*7Њ-ºszCٱ\檘E,`r8% hv7&b]$Lԍ|:Zv7MqVT.wu|~2-waB (|̟ 9@SoE  Q[&>n1CT笩3"l>r_-|o}0T1?@u3RjW+t)ϏanN#Mt[g1*{3Z%>7ߔ 0ꚞUhTۯ1'$+@= V߻{ZJdkc6zEm8_lƸI$=0yf;G҂kӪn0"^h>3O H1l;I[I@B&G?Q5# G\Hjo (8Ɔ`y`@st)_~k8~wv}> MCRs20_Dž0Pg\!ߺ'59,Ԁ)VdYh4ؒ0S?9,3l=z[@wɺB{ւOүE~Nfk-&EpP<ꪯ 6XPx`Jy5f GS_#º"' FS5ݓ|[Mcj;RSݺd_u*}o|gOWfT%+P1J9$hkF ׽NDHl]?6gt[V}ѹKL& Ev#?3Y"e{&=N i$DEaEѡk|6?$ZwנY9_kL mrKkp139CBE; i_uڝgU fMlڡ?:FZGۃ׹Ym km6}2R6N\ï5C>Df`xS# AX+;XC9:)X!$po4huc9nS'z ?P&G(0و, -jeW5FR^|üؾ*w4}u q#8xzo \&̕\t*ʈ! _YV< 3 ~MKŒ&.} 32 IJu :P?4;z)2UVqyOs{&p3^|ri1d)|oK# Wy@('@Z}Zj°dzp>pUj7hB@ߞ5 '9or5~ I5o-|O.w?JUR}<\-bC K] d2]J~ {hB|'iHç~G1IX* ڥgpdžO $7աP`,9509B܇(-LR#ʳ>| c0khjװZ3P.eON.36j͖6K>:T^^n4f<-Àq̾P hdj>!:e `s*_O>^kNyKA./f*<3yX`2]9i1^L3܋w]柕7@j*(':7~hъ$IWd~SmLʔrzo t_8Su˓% C{<e<6|(o#SЖ㳐Hlimņu?)A G)T<Lv[ )C]9!l\VkP0bq:XHϵ} %X$JyoljȘEYfcԐz*I^OJͧs]/< ?f)ʊSvj6G4> AHOƼ&wrz$_gb(fXTب rƙO8eⰇ^N bgC\lPNV.S` iqbx̒i)A[ ڛ<F?񯅵XE0#+g ;S}

JK/APu9Fhf=W>1haQ/KcI--ͧL~D& 2{^SFeӄI0/- O'6=!\4h_e\.1N ?T 4aH]7emް|,bS 26:;gk;Ch@[ u]I3(OLt}X-8Ix1]߇妶1Í\ (vڞK?"2O7_9A,A翄dUTCzzp*v3.Fj jl,cЧm(tpQ@p,PU.lKbۿ STWͳa[f7tl(.HkfFˑړ3(Ieޱ2 3Kf:ǑŝJZ=*LA 55dXGLImձ@J:^,J٦6f!7sSI~Qڥ\NJQ?L>ϞFAuɏ8=|t I~:X*rݳˮ`]M<\֦-WPhЌٷD^q;Om1;7nfnV'[$@k(=[;^Bt)AgZS/#Z;4TA-켧&{#s7S.Q|~%`oAo:)uUu,>t&@.Q( Ě<@[?sye˘}&\_2C 9iD?jW!w\z Q`H;auҭDBCCLHY8Peu<ޛWHG6!ZCB/I)RDL_+1(Wpxe|rdjYj(0lߌN^.ҿӟˁo9_6{(jC} SԐbj-5Ԗ&LxVMҏ"+g sH $_q3َ[<7mg0~WDˍFcWw-Ep)J&lxn .O4/NV$2g cZbI^~efكti?2g x~ωk2&30LGjm2=,j>pI#7([ҳVLyO\]S:,XԔrûސ:zSz$E0SwW ^>Q=V~}>D5~ˠ{c6/G;digW~>=NF oAa[L)ܴז{  C& ZdlE4.*TTÞO,a҃@IwRKV2xZ%~C p@A)2=2Zy둩]^QORڅH pUuRF;6t_:Iyac!DqgB-`|h'}_Uޟv_>j%js;5x88.cvliΉF3ٓH\>O?mV@uJ'uV @(.btDE(Y`glA[b'sz :}4ay*Kcb#|< 53;S}[?'5اlίTͯ>x_nIO滍7WK9Rs[S[n3A}|ظi;oW-=n\:p%ă,țK^hbs\Om-TAo +I1l(%>37M )ۈ%S2_x =BY$ȡ謵6<) y: [RINL~0 . Ϛ4(!Lz0a|jYk8 umcUI}o7V>(t0Ɲʢ4u?',CMdpa.o[vAp9Pm> 񑾊5abQzr{ʦ/¸qQMLD/&P߲L,ZIG"eM lhidl+b %nJ"eQ}Pб|/^vMڄ]p:OcfRTbUmO.N"ԺpI%F[>\U(msv<'Çʡ8ih2_5֎t9I| Gw8,#!̩.׾GxM=o_~¦o&v/*媈!%0Vel2 WI{$mr7ۥsCH0M~KF.}x3.W ej A_k@)'d?i}9DžN4k#w}[/gАV1͹PڃHyE hE=.7XkYwyܓ_{賾xuo!#<)/PC9|nǸI=*' }_e͗y1/lA) 7ȹWR .!T]6vt"KdO <3xW3cQu/e*m*z(1<_Ǔ?gmWiM}[rG0/)? >LEn^Uqcd? +IF`Ӄ nϗ&[A+'.~XIxKM׵&f[bQH!yTt #~h8CXe֙ >**B:ycVUG[%Y/Xj ^ Ğp[!hG>CuovLmqV8?~ϖ43沈 shj6 ]c3H", 6Y/CO=iALj +OLx3.tb0zRpqU*HJ _1@5Ŝp YZݶIԏ9'$i#kI-\Nz݅Jl ծZC ڷ1ˉHVOޭ`}1a#>I8 Oyb\2_ cH3OaF|!a F:˙S/? _['3.PTDz(7Fel |G~ɻ+J hk|:${1+6`<$T)H_WK0W~)EZN&0eiwB;6j}edf,SEr$Eo:(%;^pw+=FWbtP/[ZFP$c.e*no ">|_t ZKe D;A'׮&Rt@Mò^wѝȨo5~b9t wS:ieSܻ<.Z?cP/)RO*.ILj;V<V-O1XH˟201%v=ӗ$sJ kp|` ύAc~-vSz PhY/Tz~r lJNmƛAsFnJ1NkJZZȧ_4]`93R% D|A~$uf,zwG3hl\$BBHkjm  >BEֆe@FkrTeQ5F\̐#^!s ]\etWlQI5-$Kwz=HDaP: \J:)sDifڶPm @,iKgY-<f%qą}Y·xΪ3%Z\xr#2K8xoYXM?"C4RPbFB2.P ( їr+`mU:CWkG| ~5Fp3UwʺIw"goϊ1o[U5%0Piь{לef@h vJ.`Fgh$KrsJzxCW^xlڒ1gFOM~㔣p3ʌi`{Z yMs/9ݯ61%#;Y#:ջrI{uqQi26Qqdx,gO"loY46PPX_X ˿1}R׼?s\+zˁ}$:;]yPopV[T,dg{Σ nt^)u\MFNl=8`E\wd%rrh#ǍROCȂU=}V:F>.z3M[w|Pz;Ʀ5u'yOG]~\mAy"DǮ2-@hofZR.D0OPp7Yq-E74?8EE~#UC&oL韂< =6Q)OZ䔞:[Ebu/ dJC (fXYOSzզ7ȷ "D\|SSAѿ9.ġd ;g4e,[Gw)iw4Ab*G섐p5%^P]^Xc CJX;ae76LXL\q,ARErW>BϣYN(^ :RR9W4K>%a4ɝ{JY C-ϦȊ1Ao#2MGpURPK'9 Ҿƕ=V.$3,̮"Kd'ߥz3O(_b*dfo]5"B s 7ZyKȬDԷ W)a?<"'`D.[ک" 9t2T~/09t4-G%@B{O$ﯬ[$IKa Ꙙ|%khYa ayj*M[vg3d>Z)[MjwN=dy[ 78=p{20EڔtxDb%z*OyR\U6D6gh/sה+ޕMلR TG"BphS9m?tBbo}fӵ [<]H\ 73wf<_Lc a}Oc^TlHSfKƶF+0ltklrgآ.Xt׶^A[ut]SO`ES"AQ_L|5I!|Ř!"E4Z9)v\1p \֢vf(av˵!5btw4in;.e*+qǘ¾\jESqp6gIS(r{ʚW5Tڂil>tFF. z1&AY _:^mJ2 #Ŭ&lݛй+pt]RnDp(ACoo.T,5=?A,{k@g?"-|7q\TkZBQ0tMڵ kˎGD › ?p*!k')5Gh 6A^kc:zX0v}'RRI}uؒ&> bq'*_'nQEAz<Ӫl~sێSi%0Q0P}H  #lu~ `ô<9àlgtc%}$*HrhwS"(r$67 U c70(Z!)vly6zS{]8RzhSYK󻯜Em25gTd}hcK֋ {vP(WwS4M*):gȂG.lD?^igWCʌFnc3V~Hik1R80EܤN9ibl39(͡*X*t7O.̡1]'x؞ox>= ӎ|+n%'xńsgcMFݫф*dCܨ 2܊" ZR̄!IC˶8>:=\}~iw9Di9 ;PL+ *A⠟Ou @MJ@<4 ?sx;ظ8I+#J]Bfit'] knW,U0Cvgq_;i3^" Nf`t$K]eh?aੲe*{9i!4 'k;h,^(*Ȕ/t mL?&N2ԞCZRY!BlSȄFF"/bHX%YanrÇn7"бhk{ģ܁KXTNE[4`u^ 'Xٛ7s嬂&~8Aȃ@5n!ٸ; w7OByzbta 8_V(2TJu9 6y+ڨowņAlN"NH(s~(BH-m]"cUR䔳T҆P/7gup|"Ē쫢Yv5W='oE'U[ICB}8KF5"Tρp3UEÈa\ +%{asP[jv*iP{p7slA8zź- A蕣G0X.,h7:,PKzݫ;HG|y06yo;a`,OBqr ֭Ngma6aZvؾ_0튏roPyix~z-zq |Jv.GKJ) ڎ )J{AMXG jiY\Ʉæ1ٸG"q?d0Z2Ցuqp S9{o >7@߿ƀgկL 4XI#X֬z 0~ ܓ @$SYТl:rc6Wxoi~o^ >&0} ]c|LDlsr槬# @aOW~LC}f&T8ja{M86ߵK6~ f~lĴ96lcsV-lͬ5A&؆o"/dzs]Ƴ^l/`KJ? 1؎ q1soѷɏW *(Sa  γkN;ǔ Ftx.C܉6PNH8RaaMq YR6NCiU+ek7j c4QA~;2TItBhWwAut]ܦ<:d|0f }~G4y)VmRV ZP/ 6 td[U)V/;1 A?G'To>AJLYwhnOa0(Y{fuG+ʐC|͚Upܴua_)M\*Mo+=U*cPdkXS!߱‹q]_Y3'.d֡Kn) 1'F~Ӎ;8jTa}j:;3b2 Jzċy^ >|Nƴ4mB -B_$*hPQ$qhkQP옃/Q*q4ϫ0eq*}nuTWfz*;āuX:fS@&-@|2RjUҴб95 ;"jwkYNӲ-mK^XWH3B()_qjTzmeu&Hs+q95Ԯ_z:]rb0/? >gq`'>R:d,p65̗>Y~>/mW4+$|v?wQkWqAF?>g^?VD*L"b'Ơ`$g ê ܦI>"%gyڱб /_w ms>ټ2>$ZkOn) @U1~-{8<'%"k4aچ kHwSKDPY|}Y =ٜUi+_9'HIsFK/i-eڕ8 _-׬Q. sI"‚,Zfo-ib.ݴb{`> O˺Y7!ʋXuf!u&eձ7%YVV|&:hNa/qoW$IxWFǷ)RX n^b9S qT2ٙyN Ɏܾ`9R+'y -إ2o@K3ɝ]A;Gr>A&̹ZAybf )_|q2Cٗk-Sv﯉1q/ܠOza}WZu=0σ/NJ--fn,vwasB35eca#__uQήׄw-h̨+˘M,BQfQ$勤7/©2 r<}NF~ԥxQ;/5kl vJx3bܷseNEJvR4Pze$3gleT@lG@mjqP$&D )vwzƘ7*S\c r!&o(bj |c?%suL" ͱ [Uv8QI5אeJB (JϗRq#0ş,˒')avsl{_ "XP1ªV”k9nB>c[kk@|VJ|TTD0MrIqxJƓz)_Sڌ|t6Ғg^|F0пnp+1igv_1܅j :qס!yyp 5`mێ,T]DƣC2)p*kǠ狮-˱ҕHMm&yBL߀ė-IdLy>;NBsۆ,A&=79Oϻ1>m*AtqF }Xp˖pQ*35eMk`. zO$)xo$tX@ց[qjdu+ܜ=9tN[ьV^c\|Rk^2I?U"m|9}dR@su F|Ϗ=[Ia+6AeV/ 8>T@#B&{So"LrrmszkD[7?S- ߲2vͫ혢q(9VRC3]iKs7#Lv~>^ŸŹ*Mh5Aqs@OC~NI|(U+W*Yw|(EW;+nkZ>\c?t:6w9K6MI 01־oͬsQ֡rt1Ri4>%^Hs[34:ːIcdUECvt6ЛhfFmAtίyZ=Lb>k/EaX X1e &" *.bU o}K,inc7Ͼ3=mog7~j/߳y[w^c|tLg4)qK30|ܦ0PiܑEG~.OH6b>sq 0(vd-qRq:" JE~NE^Y V;ڂ 8xUa2Jug|3̡#ޯ~#|Zˡ_ M388çW:EQQE-OyBI,UԢ2 }Ѥ@f4L҃@Xt`Wv Jl[ŸY UtHVET-Tԕ1'qpj6E I\K{Ͻ⩟fU z׭A38E=]TGZg\S^(+c{N wG2vYE10`cgZN53y5R>o*vFK8KV/:z ZY0:=_OV?!fsIOa-zظ$Q_ !b}{ y~9#jso'9$2s *HM Xϖ[\b.d5n$(-Dk%`шAHPm_ DOk h;.fT OyAg$u].9nT<]YX1b^he#}I\&]L0bG-&-@PSy:wp$$cB4tD=1UIZ DP I탕L\p7ZGej}Fp5:Lk)R(W[6BL/p}kۅ؃Ͼ =,Ww"!r7-j6\+1VĘHrKzo!NNmNT^$6Iغel 40Aoio+ÃB{>e+}"FIeGSoږ0;◵_Z 39WjfJ6Jmz=]у-_p${^Cox_pcs"]x 43GrRPLAМ[D:2v`I -B/3;] tGIT4~qGæӅ GcoZW*x`ՙ0P+Mw3I^d%g^Vn䶛Y5 IRj:#ΘʚۆȂn?yfguz6ê[w"hϪ/ זx\(bjrqWjӯlJGj~fRlKRoLׅ`fP8;:wd(A'x;y̩WжgN!M]jeA b_XGP&'a=R@:XmcN䈫hNm9 ]@;c鎵\ss!+vJ V r )qI!]cH|~ՆLE.J"k֥ 6䘚 y'84JE$T@J$bFyi_zu>kxOL՚LMSs px^3i 8B+c.նuAo| Oqz(?\7Tԅ_`hMtFM@y,QqhBaP]U*eiçT;8F ^;#`E՜ޫ4`"{APpL+VR;:YG,Jϻ|:);p8}G E- 4%Y򁴹WĕO.ӂX,MğKrJh9 0ԈrWX @Q${e̞^Nu("gX>(Ǵ=' Co."I;A:^"J;g-(ciŒ90X .^%\CVovi {kR侒9ԨnJGa4g@:NBUS_7;5aH!i FK7i&Z:Y"/gW.֝jl>G0z醘~89jҖ)6MU6j/An~j8\O'tСm1 ѹ %b/ɌkQň YHWy]B:" *YW<ؘ͇qA@je!+-],%;[ͭm{Kщt,6A| 9%buqE!DCrC#&" A nE:gЙĴ$K!Э }9xp6 4 ͹J.m]Y'v:GKͨ3Zn6;SU&Ω_V}vm Cfв ~g9P@XG(6:B'e ¼uѤ9_S{rytw9X!>U0;(ZuO>$?P-Ø{jQcp1(p#TLjZ(wj);0ҫgʩC?׺ag.AϐOG5$PoGDB,Ƥޒ ){9FM&>I9/{(k4y^'9vni%#06R s˕1WRF΁ 1]c>.jE̙@fIE O.el,<"%@\T%OtfE,;s~ )eҖwߪqt*׻KZed[ۡ nE˨%jFfESghڎʕ2K/Rw bH ޛ&yƬ$͑9R|yKԽUPh;1&AU ws%"ԷaɹDL*њ6[ײ8r@B$O"sj ;k!}0!]0ךⷷ!_v!?qmq~'*7ϟB#x_61^GQ~F} [}zT/q5L- ; !V)YTJQE@Q$N= 9?֡qI=K mZx;X1ܷmi"+NdBQP2$c QnQ}D bjaHԓOƆCw0P}U%({@+-ؽzU6xyOCf{[cM2ؼ*#o6%>D~ӄίaV*L.Yő\(WKi`)+f;Φ;+9#F:AݴwQ.M0aW*Jf=IdWr'ݷbڎ}x#D_S6V~ƙ[P齃Nw<}$,dQdFt8LR\ vRJw{T4;P1/j lAIГ ?Pu$-A!W' ZĞu+hBLa yV1oPSp +%F7(gZN8+ϒYo'^|(T0C {J+::iURALA]!_ӫx4 ]E eeѶFnЌ虜e0%RFx>Puf0D%hH7]sفFd|P7(TaiTyuC Z J(rOgM3|2ڤ,L{z9BV[;c{ swmsvΧ uY#U\@&ͥEiy%J#7#0C h; s|>R w&e~LVI8~T>Y;}YeJ+l Jtol@2_d#6Np- R|bYM__^P/;_^"I-P0Kt $R:BBbjg"gsg36׫96#!=g grΤZNص\)jƑUvq S#KR&:%2,mH^IZvϨb#U(,?b8J昶$R(IK|=OFFPź_Xb}smW&rsW ]V9{0ꅺ%i`;7)HCq0GvJkVA`lPO= ;AM_ZDby=hoN=1>Ӹ3]$}9R&O!u}wб8ZIӨx^ȺbdUxN ˖o$$ m0t(W]:zCp'+tcU&[#iXDYh) @Yʽ =F7܅@  x)0l%|:#NMd^KgS;ӽ;t{XamGjm"稫䞐A/p%UvͲ@{9B_bNyLb@hD8"F*OԬl=O3 !x͜~s];y-I@McX>/4)* Z]7X@Dz(?Ԛ;1(4F©%g71EqP@Xv}gv̩4]U;f|K7aDm%â*_GW7rJ9=k9b'ԣO]Lʼn|) {lw*m9J<'.+L'}l!C)л[42{V̥} &/,{Z3jQyEmLJPfo;e+ `tGv!ҟgx(A?-`6]lh`+Rc.|h5[Pauf&/xx Čmwe7 ^V/{r>rOٰAlVškՃH/mB'JQh[;%*2d7ռ/8@$ԖGP rC 83rKOjD{(VjUn K( t`C~f% @qơ.uQƙNz&9,$GuL28TnwNiY=rN'TmrDd8Hxh'-Ȑ= Z YE-ɛP?h ue3G~L^*|4-5:yOz񎚌6{br1fhxYfΘׯ>u䱞261>[~JBzp~ڭ}mAʢ柿O> )k^NXw` "hE-m|@I%Fy|o:w\YK%yF$8৛‚|L+c^ԡ7 pT †aJ*v;% Luɤ긡|Ņ\Bs*7l@]T'JLim]noW~q. q8 oz 2mAg߃$YDa?.ttp8{+P{fXz"aQp] Ѵg7>F_,IEU;c-ņ\}D[! tNxFm)d &-@U4b+#(s8Z~lJ" 4P= <&=}ʝ̄WfH8XtU||Ǹaݹy] :V:g@h3CY#˒?X{5Ο5s Ufc Yܬ,@jˁ1.W9qݗ* pۆWC_Jh\ OǤg Ov<N'g/kl^pq[?3#&`4,F^Swz$DoA}WOFAA4?bz'ўbR*,D>y򤴞7wN 9wr{Uk8K)6<*NHoCi6RFBF|p%D3fɺ,tfΓ"O.Yg\I'lgL_&\Vd,v'BP'$tKb@Oeףb"wBZJ%xseGqVP?OPHKXb#!c N#-d.Hᓸ|aѯ:hyVJ< p@swwCfuw!a] վE RhSN^oj1߼;6N''|{'m.О[>=i-4]Q~Bћ m2/c oDN4vt6.9=R`pDM^Q3!wԌ2ߡ{ExJ~ AkONSɴg_\qh!&*2U4U>i8iymb!+etDLImۼU:jLTO `}3*eoDhs~RFR5=ҩ|Io4; &ª0?1ieZ[ApȒXZ:Me񹜝3,f x6Y{\ t`X)V?(8 aj&8ƻUvb5T]̓ DB6@XfV كasJEֈZ=XE>vNK;Uv*׵Ea+n8e\ ޝ+A3*x!]=elΡVzӟNb,$ҷ۩ sΤ׀Ce-`uW,!iZ0yW$ϩq%@.AQl /7J}z=eWw#lD1gmBхh>m1JR!~_1e6!u6 ꡰԓy)tOe^|!Ky5QϿYTˁGƿg@3иSm@F&|VwmsΥ|*gͪk4(Spʩ|)bə{.(սuz2 kH8|,{L&rzë $W =Up;>UBq'w EGO~f#XASx(@.'lPqM%ebGbZb]q#G2|7X>ۦf18 |`UoxR2~-͓Bҍ¿{upgz*7<]yƃO_shWt TVHUKWM/rN+[8@Oo9^r"S@`C]yRN1c|WF1&~'9YZzJ͠O\>]& 4S="}Vm\s+HGSPi_h1R/>c>ײf!۾UGC}9I5 m x NX)cO}<85%Dj dߦfX2/R'+Eqc즨j07랤|iM)rX&᫃V%=kJ2ޏ;:peJvd5iN8|MEtҳ4[ЉYvŸQGCneD:U|9}+@' oii8e=Sk'YQO8uEx!$۴SՆF(cúoL\i^:7TSe.d\MՍ֖4(r"-JiK{ +%J.xk5Ή+OZ}2OSC'0Wqz#lSb\ִoF[eɆJ}(5j TPя7\(@Q̄$_ '3bvȅi ^]RjNxG ƼP]rF# O )c}t)SUnpZMD`(bNR9Gn8Ihf1aJgteh\؃%ZnSp;ILǼ<}&!N"@-9!h|$}!FlZ1UqєH鼙b~7Ef,́UcK'Rv 4T8%y/l#catUF;Ec-dpnk61K{wz 7iK~cÈ/.5vV[nB?|^^)tGs nq{0lRc#vԾ?F81{MLG1>n=Q]xZLە9*Vĝ1p] O E7&wms@O]$߾J*̈́ȏmb:u"kzCu%s%z z˓2)>4Z]?UMiE‡65 kF8.kBMA U)aB/M=3.J|"Lt 'ngpOD= OpиXqD!MD+V15D[eɛSV35'#pśvM~""fĜ@a֌u0]sU Eω,EvBl#5u+z\G=ِ{7 Na5W:Uۥx)Gotk4XdP ӜF[JZ!FQQ[58ysZ+,Z[4@:q*mƗvZ*cs6 Ni=G'\:ܡ顕 ه ETe-L)C{Gu_bSL66st}!>T$Ygc9&c1*ƛeBh\RR*C[U )c`ۍ";Z2_J|+or\LD7M>Z$x򔪪IWj׬zJ\dY'7gQ^ddSbP8Tq޳)5`e->Ny0zv>(ur ,,Sy6+͚lU/ySySp1˚I Wׁ_GF_PUڽ%0?_f w,Fp`Xsr1>Ϭl \iqb#O[Ef)R/ɞ0Ҋ|cNhFcm㸂4*֖_Wbvr4t5Y0|їM`s]IMMQoHtF+mx6]O2گSɁęѫ>qGTQG !^K蕕B0KyK+b{b#(* koLoSq5 4\=QLdxۗlyѩ!jO=%. 2su 3œ:*'D>!v#RQ^sƚy5ڠX<E$9m)Zvf#3tYKz0Esڂ`Tmrs8s@xtʁ)"{_Xr\O#)NlQ(,VF{[PvU] HBΌ؂W:UFJȵaBV0}-rB6=)*)Rv_gfc^9D(e;ˈxΕw룠)17hTޘHheJW\cԗ2Χ n\ 䯡H_ϣz}@8 wo>B{W8 9=5~^DJ@ɆnVH2xg֕fF?);aB^ =GɄlO}+_=_3Z{."X4"1j&sԈTj`Ӛ/!bIn'=Lca.Z(HUhz ״3tA&+* R1jh&|"9P \ W\((>|"3 }~r=-9&L #xz7/P܆\r]ܥDţ}-/ BW+G(hDO2Kw}dXPLRv~_/-؜u^PH[\g]Ϊ#fࡓhE"/j)m41&X1N5~fBY{2$#ͳzP텠rGqaqJ^eZyƎm)ռKl,\m$Ǐ O#$RIAZdea25W4w+$gs,6k&ft>Ij6i&nk78ڸ-z&G۫izʐ,- #{47A"|哶qL)quP}(+Czk< ?8jF4"̏י cU6QFٜb>m)Rzּ ]ʸR?ƀ GꞒ \y121TجZ1,3k,e5KT,<x,=WB Ć|Riu[OX*2 wYueSrBm2.gV{W4K ; Op;<0_n!k2v:Tq3`K&'C<4ețg׀f2iGfRM6hVѕċKRf}6tA;3'tpSd]rU] A 6gн 怘j$` X6jڞyB2 tHwBC,Q)x>S'QnZ)RsicVd2WZ3f"<A?p0xnDb͋jL3yd0Ϣboghz9"^VD]`bJ9;,X_0S[`=oWN,&: %ݖZ6ňY5/l1qHt48ژblJM┡'c@1cJHӇ' 71պ; B8ˏ: $|fO΂û&VFc2i8 ]OiAE kzLt*Clc߰$Y]О싔h;e{8i/'Xhqd',GME^&W̟NcH`ҨbwHlJq2 91"/Gm=f9ݱ D^7[(yxo,^qyDhZn hώw@[."\NH@NEXOF+;RL\7b5r6A+{*OF[U3,`8ƿ^6I*)'l)oir9:T7}SŐ,3 Pu_tO, ]䈐ˡ'!|r1xuʼnvzۻ* %T듺fF 8z;;>@qلJcp\R:8$k~R__P%PX[mӍlYQUQ@VƩ 9v; #(w] z6dtr'3Hʜmc݃*B+ b)ᭌf|VƖ-Syc{W${R\:? ]MM;KszQ!wzP@^[{vNL_S:r~ȣSU,wNK;8TR2U8r-JUEa$d`# JEk z_EOuWy W"6¬ȅA6%}~&)\"ew,i9;{7: l7qnJ:)z>j_[&ȶ,1v4g!ބ OW=[[sFu[ }*v+Ç=/[dj3;IA>xni2 YU'OI %4}Ahrt0^S nITFO<ˏf<zX}Gyqyw )@W8KZ1 AxkEEfE܋ 3VZrqlv).{ת(v>&fu+͋#š&'شbOG$RG.5ŪΙUQ9^gP"]} k[aYa # Tl'3cx6j0+KFc^Or:Uɉxa<*JU ~h\"m)p]>m]e=l*TV ;ff|U@(۲Hnqe6Nϸ3SZ%ū,fZO!PboMA )ύ~g*ga%NOkCJp ޕ\CwǽlR3AO(6vQ8FEr.z;rdWNN|0&| w?q7Vif9`ҫPJbK9b$8œ!V[_ d&J+֑Q}_Z)X@KXS嚾~e:7;!pp".@p N0*9}XM^5BlE!eeo8cz'%$Ckҧ̇Cݿ5\*M$98FD0Ka78iyALw;ID <2g.}"jG8d5U|)/ ֖[.ӗ<_jO{J\6MͫF\xQ||WGaiڀ1J73L=| {"*U~*.EtbO/ZO1#o<5ƈ{\%?("ڋ{cǠ!7ElsT@o{mLװ*oD`y,?d "63, i\ Nj?_a/MLIϑKm8ʓ߬9Wƀf!BA'+s*iѯj^H=eeϥ$D%QmWb⟵aNӅX&)Ge5IV:RPnHz;t4xPQS( j^gpÈB:el'sYQ*M0fzצ,Wy+v6wӘG5.ND@mbQ>^FG,#ϣʇrWY<3ߞ~NXtAE{ yPӫ>1,Ѕ;9 $pPj*ZȡJi-cl&A*XN< afi0GD{b^YR0&f{a.kޓ(=ݼ5ʲE_6 M2GWny^\áh On3trT 6iyUO'?&q|HHߒdJ0yFQ`v9LxHsGnͮ0|\UE.M?k\5K!%Y"g@> !sb@"TrV%V{4!xc;3-H QUy֘c?m !' ܖB_@ZK6e]H.dMrkDs 9)z\J$ >,Qkbu>t!f@E`S</W D ZzlݗS U?cW|,yf/՜ =#kkEc9DkoWxOEImD"-X.l ȦkYGﳭ:!=JO" ]ў U*ߴؾXu׵͝8@Mb3 4VqAڊ!<0}Pf@a0ҦuZ^DrVcHjp׹GRD{9Os-΁W#c@D[)"ErphkYoO ь6ôW7|*!-}\QPYN)46KH_lBk,^$pS]s-Lz_/Břilh)xU?lIUWB f %W 3@৸Iϡ<0bG .(\Oc~[W'%_?}n6R{{[6As}\YwÔHɎ@i' K7-r'(7A3&MA7;0Pc|JgYnDy[ܫY:mX?[wݞ D< R P*BrhB߭3ay4-3d^I%|>C`ieA3Vr$^S} MyUfs|}# x7AIcͿ߇s?ƬaYdEelOA uD"2ϩF,1V'1=/`;@TY(*|jԖ3h(n8yq TM<5CV5%ȧefXX䤨 зcpvwn'!eY =^cE"u.{ɭဆW3o27qH0AFݼ0D7J|$jst!N#js7*GH/Ѩ6ߚ@$r:2rCϢ,S?XNm[k ف$!.}XLbՈwA#D .I\LAPHe졓m8-5}%}S,dYV)39#w~Bo ͨLI,hB;jj{ %^]3v9jW53I?Tati\N`c}n^X7W`";#3# ]Gw$H]*Dpq;@=(#z2o|ke  $'d",#k*V5'o34+XLW* )AHnkm=_U uW1cnQԕȻQqևޑQD@%FWNg @S/DԘVOqtu12~[:wxB^X}_1Fd Kۜ"t঵CEg3eZeWl%妲y'F _LNtM= ڸ{cw\+_;3R<:cU'<<*T5e}aec6BAa]Dn@iR 0E^;{)xgy|X8U֣LوK'_Y1e1fUx> '>7n;%1,c<\vgi ɯn%snCz1䎷AA0~5>:^Mm,nutvD=Aw%wp++VV6=8ˆnU6~%%vK<>Q=.F=3F8g )h3igZF2S(b]CyBD.<2ߑJV!^lk 0^ X*2[% R/h pnTw|e4X]y'8+#w_Q^1 7u6BGy98^be#~ ֏*zarxPICb&5IC?F% +AgRaſ>{RLX R|Yڎ py odMY B:t*TszfNO2PJ /,H|->} t!V#i"AM~E,@3LΪ'nP-th0y |쀵_>.-'UZP%rQ/J:Ow㾠'tiG%^ԏ#0q1v:RǪA DY7jO :_XOqgjwsPdVeevqޤ3m.!&S5p_}}(GR>\P\ YݑA&SxyՐ~Pd .W(lpdFFm4L…oz:^:̋|=Z5 kH)'Ġ%^;N3\SE=V0:>zɸxM2+c5^>ȝ-?,2AU=7e+~K!ysaoA*;,+f+[AznIq8jzq}0ܮmAZpX5#%^ l&B `kzh\G"gFtk5%dצYSmB-%)2v@U!NںF y!#NbrEC!Z۩0 G0⭀ugշ>M)?$t.տob|g8|sojpJQ+ 4M!bcdn2́̒im]*_ߒ W82Q5c̝md&~C^.JJJUH &hrKC3,cխ?\/;EҌwX-FB oJ>^ۑƗ`rf$w)3zgqN XYZ^߇Чtcb0+kbDú5u"+꒕lN?rH{lq|J>@*{wqk(<3.rܻDm#H]"& XU] v}ElPzc@9voHRG"Sw$nUS 7Uo#-"!F1N/"tWq øq}#m<ĀɷANy}:9\d&v&9 i߀l]ʒ ض yzd0“N't-Iv#ALC&1!8Hqn.XUCIqi inp1f'H㩩NsGxgQ!N{ ݙG%dl[bʐX=Y[.z=#Q2uZ; Rϭ$C KӢǶk(Ic4RVV1hP˹Y.J _qSg͙ld .T)j0٤/qjaםb~sPb0ҴĽ|8' 3M"IS8x/1pCՔkd.$̛> ƍpW*酸K*R``e;7*sfyÔ@Y.u$aiVʠIY҉y,A!̀Qh&߄!6n@jcl kc اC-0Vv<}(F߽P(M T Ewo>&dWܿxp]WX&LבIٯЭtRGĨM nJWQP #E2GA+-sTm_9n?TtTp\${P~]&0{?%/WwdZk"D1)J],uQ ae40NPI| ªQi sErEe%ՠb aD@ՠXO*;R%Pδ<\guKD[:l(9!y,'  `GK joRM'>*nxΈsS7* ^ByJlh͠aX)i !Wԋm#?v-&z=s@m2F\3e ^ɠq&]Y`[AlQuE>"dh3V}6\Y-KՓm316 ӮCJZ@>25r0K:J{]pdTv;V> {.}Qrk[]n5h;?cjĩ{y2?3c32mojAXȊ}p@` ҩ|*o+sy*L^;gZ'ӮvS8LM? tH@io'.'b#د_!9ɺ E<.OJqǴni,4I'dȏb/ib#XTh-h0#RlHI,d!̠mt, %&;޽`鷥X ޒUf:\MM52tX~Hz-yg^ ">>з܅Z,.Ưr(_CJE;˞E\NnBUۂftEtlHM Eh/Fmvǖ3'}OPog۝(Tc O6nW~}J>4ѿhRm'_Y7^`;w]~:xTq#VN=F,gI#*Jy5i>qfPb 4R|KlK0~)pWƔ3əfTFxzE0(Cd[{=0*~[$"7R:C ^V~Ej6F7QT.L #Ǥ*sƜ3ѿ3?ɦ..h KtU  zTF,ʼiS^mbf_Zqj}X40#s~[48SCvqi}@6e:s-5zL)VHhxúRu?-rxϊ rTw hD uDž uzEv܆aA\NZO޴SC64xnOGv,ZŐT"7mB@G:,;wϽ5m6XJ7Uhm&_}"P#*VSd8e )HL)[hж,o[W/M*5fJ9#}4l:f✵?tq O^!jRruq7>dxeab[Sq]pB>g]P= M 싷4%Lux;/4Hr>Y4Ɂ`Дa*joT8}vʣz+ WcN6:I~PQi-WzGݜ+x-Npam B60d쌔`t c\),z=k¸`F8EKH.PW8 eQHAӢf& Uyzc \ R_`N-[;enUkQ~[,jY;1晊ouH[y`yi3J}uo5o(SR#Ӌu:*.=t!d }5q+}5I(EX0xYYꄊ1 TP ]dJzbv 3ui%LGhj~ء(VO>UadYaX34bg$AH񴭨&:0]Nkl^,_Г93<ͥde ?7eLM@ lvRXr>F P|R$~6f: K/W|w<u0$+2ݑ01ߚ(#64A% Y<SuV[kM;M8>M>5&PZ|u`hش!$Xkaxj^ٳ^$؜cKަ ImCBv4zc>}˫]?ҸfFmi7B[E1G JZe`5qSrސPf]s |)ʉ>ax~n8/TrGdKYl*@#fq oqrm\1bdD~%y!1TWcWʟ9]#'_әX/ R B&G`g ӌy-2FڧA] wl*m17ʫlRCƢ^ÖPK䤋`E:җ{Bgw" ۺtV4f^SDJg/Q܃s^L'i{'>@;5VD/aWRoE.o!~bI|A1Mx8|dg@a柗 +)C`#Iy ?%W7 \Y, }螡jXq).W췝y$:w{;Z>ޜ葪Dfh)\*T+No*2fiwz7J{rTQbv>,,s}ȧ3*ّFرjC`JM9OF@?[󥵠>PORhZFۥYT=sl45R9'YO) UnX%/nPnq0jпQ;:}5~&qG4t*-4ӓ>Ӎ {3o}T/~96LL; Ծd#2ʓE !=OY2}1_=OCr&A j\M1ejG7CL6=QUYrYA>GKPFwVv%T(<B9h2tXw''+Im5&w7 O&1-$+!'u 9$@[.f9GBVͳ^̹ 9Ȓb`̳%X=3tl@@IiDN,ѴԟtZm?7D@&^1m Y蕏Nh>D(+3:ZLT< ;ƻQgdY}̋ؼ.h'bw`~F4u 2!i6&@x, X: 6t-]WN^UI}-y*]"b6͊O1XzvK_*End!W=0i9݉?cUo+ }Oү&R) =N$-84"oMu[ i(^6Ao-~"!a[I@Yf;$&6 [HCDMV5%vmYc#bf9oR{M;S(9}yCo68|-m~U,;ҪAܳ>(:Y?=5cه >%g'K,j~+4zh:I[^Ax+P=1LKocVO9ߪ+={_)/(TƖ;N`eC̑,CЭRA\&HDsk`l܇$5q-iX 5N7tndk|@X@O$L|p>ΏǑHPo&`$T^QZpvX8 ę/>VzE5)W/3=7{H[HF&- 팆_!>0?tC ΟQs Qj8xDZnK󔜬u:;t@ňi4jMU A ZS!! нQPZZU_h̘'LpFpylE\Z޳^M-H=?^T:üEtڻKK9$4=zl^Y;^H=bQVP g6X9TD*֕Cg6\jZ8009rSQG+-ZԻ&dg4kk`H@5*2 '.E|d1OmfsTYӃ&]V;oVȥF.jZWk:LnvǁyܫMKC%݈Tzl27w{ g0Kpuj߬:^c!)"tD6&];s{xém h\ɨQ& 3'"x<ʐ 8f. p5h4椿U.)*3D=@UAgayi*][y&fKeD!iu1H+G#@fj_8^ng?b].}!8HigU!k(0|zftcpbHړ&8Ä?a)Pg7>jc}\|3<tEnql@ӭ捱'g.D=ѬXP@].޲_Z15;lTuSOv~:`Rl=/C~>iIR0Sm7m?S!RMHD^c-8wRk)M%B+L*=cZ74CuH}l8xO*):'݆$1,t72RTjӵxMۺr!_tO!`1]gdSk ݱO+a'|Jf1B;IZ+ٳ1~Pޙ&w RU4yC?!n.d&Ǝ&J4ARϲ64OPE{yNt7dmUt[{Eq"8Pi84,jmy"X/l)p^eRP n%Qyv)p~=ɷu/307Ay`aPW0)SIu ӟ896Ġ 6@)SH]HC{[~UZhug|' 02V;,O$^n͗n*N#h匬ZΔgm6*f ᣍDnR+1ZW?#hPRc.}o8۟Fwe/Kn`U" y}6}p i`:Pko>< 8ǁgZYA/օ~RY90`C&Tx}=2N>v&Z)<:-* 0;TOsAh4@j)ꯗ ʯqVN"*WyJ; k?f>ǁ,G@/@1Ȫvf4дYS8ȚvX1R^Ө9tumEߜ!S4hPhar'J 7K. gx7\׾ϻw=ȷvtWgb eCj]bѤɋ^l7KQf0mIԬ=D~BJ*7H|8Vok!NNm]Ï6au f>A{#x3,7Q7* (Uԩ1ykf_sB9 5ePjȊxS;q)pb8ۂU+כVXAa_jdŐaY`yWK,YObX(~2}_k)1NpH'ƈv[8; 9F3O T{4B)~G,q0N@DS1: b5'\[ deɀY&‹UcYOx:cCkan6{kl̚u+$&bJ1A$s9lAOQɵAr<ʸp&DXڻY)&tmozf>p?-!Br;Γ=TDPqdX8K+<];6P}} KH77NܺW£1$u\e5E{ǶU\ Kf]018n7Y!x NjۚB-y95_..z (Bcibmr`ޓM+@7iyke ئ+p`) aG4!2.(V A\=4EwWiL9"z󔡸p?AvͅHn7 |*n;[)UƩ,$/ICV?gRa$[)a䷸ IyFMfXkxG趱 xs\X5Gj哘<0X #&Un}fВ^$;^_IO*-RSUNEocEP0#+ KE 畲R&(3s`EvB B @}(zd[iR!\ -LN;v Kww YGDFkdA2]fp쥼)]FjhsJv1ZH ㏺O l熱z @/KeY݀i%M2_ΪjyWl_2^I&Ԙ*6=5nXz(< (!|p-j [߀p>v#-_ru陛 lu?fV87`$ذIj! 8nIhl-5+ڎ oB)j1U=#KOl&e/2Y_;L9yUhA౪uEiX/X̟:a1V[>s:aU(.Tl=$ɯ}`*[+ A^2D6b{G)ދ0 MFC4 r;/5ֳjʼ4b/gidޤwi*G*׵mC\K̹kUC%L oT{TkjxE3/@R$v^-Z[c)9&|56{i0ͪ>f\Nel33ջnG,W2@k-)8~߄΢>b~ZĨߤ%Or.2{v /őʴ5!#X(o΅GʮQ[E aHˁa>dwυ!a\%"U V o}E`AXp#}*jzwR\_]&ag0' 84j^ Sgz̃2TGx9:t= uЪdyB0.?$IO-Ȓ9)C?O>M*%A龙Hiq(oo0''se fK崙$ƛ"R_2!;qmY.@׏EFx Fr[51 {`\X@Joxg 7 Ρo҆ lfM<1`7Z*lOwY.\ڋfqp\sD䇡%Bd!<z"oA2@4XjpVjH!@|O$6+Wz%̧JbA-D6\}@UXTNr]h67ةuP H9)7ȅak_ Ԑ'u_l]W":fD"zCc&K+^w+8dbL٭Po8B!kyAr\Hh'ʟc!TkM_)|;+yY1p࠹!r)#7P"{ 8FMT *.qx1 @^ @$KIl]‚@J _>Cv;pPIߧk)ܺ5sWn\TM]#QTraO#:zܛ1'(^A,vJ#鿹?[Z[Yo]` a4|/q*4k`hL2:Cy ,e|NCW:zeoQAh@Є@~$>tLP}|pWvC9͙<!# `OxS.}ϕXeǚ#dmGBʥz Y=fAM栬bwC\K]|hup~rHAuFF:)Z0tmw9f3Q^ L073g>S$k."s#@e r0xqY x_T%_Z A0R} =\4)PTᑪTliu"VkONsdPuu޶CU }Zd`<,O#HZ*H9}~;wPˆTz;lon|'_crfDa2!1UT ?&?J-^6(GhݔXII!leJm D\&}XR^!\D-,ͮm-6O~}e*t0Qh:ܣ=w2$ Fv8"bKoViaQGSDi&"J wKC J\((:mMjoЃNWO;$[Usm*Zwk4jwnn0RKF ٓ6iq*lF`sY̞>h36m]r <+lI4>ۘc4c^ 5T4b 6,>]d#ct겎6XUxG5벞^WD_53 a O%T ^qHfZ{R1gyKdVŀNn*wPߛ~u㐌Εr0³DnV iуMglD[ÎƴC@Rxfqo#jzN7j-A|X*Raw}c>S#Kɹ\62< ސ̦e#6D냆g# phK^wXb# <1+j;HJϣlw~#w4N%mO }/du!;)G9AbXw24̧WSYy|qhADU&Rj9cF(?k&!o8bZȉ31ã2Ƿז)@-߇~wG,65\gNJ\ I ȗE࡭}/[2ZyИjϋ1R(r;&TaPvv!0< !;:3YՇc2띭6G<}BW|v-E׭ Z`L3ed>CE7c5쳼KKn! Z(-k `dU)K) hX#ә೑ozǾ/X;IKJpHpA T\ xV$|Rc+K:XBMTJ,YqUZmf&sƈۇCQ$&Zp1DxT4*G^+VC]6[('cd6QaN1kb8ש_M kb^?E8f9Bh\UfAOEkD7 M+f)NYgά];]κ`Iw, vC1u{7MJΌyFK*5Ϛ\䣥"b2qQ}ɫk3@XUX $%rP#-7 ֙@eO!~@@-zVVUft:HwcI:@dzmAGyIf%[d}0/,;wL,OXOk?Va"RȄ%#h|؎Jt2C:IJe4a<ʔE8[f)<8=4DZLMsqk "4x7',\P~BJsdlX; n37 ތZ1Z/)ӌg®T|ofv^1S,ͣ rnM5z1s d=ϢA"¡EV[c!K:N`T=5ז>ki y(dVZn/$"JC#fށ x&eF xdNJA7N9@ sMAԦ"mUeE^nX%CwD`кmVHxf"5Yf!Dr ]H6B]R;B+gݭ6vw2K(*e*s0mc^Si8 \IxX,p O$D ߆wlB>i}_ tH3R&uOr֢paCǘ(s6&,5C_W|d{ٞnOLq Uo_iǀJzhPw{Չ㲘ม}ɋ|Tk(O(d%7;Qg,<˝>. 6;%eʲw_e#Xd3[z슀Uj*=`9)8iI.& e:0G(횟 a/bJ-Vr~`hiǮ9b}zhr]e$ H#յ٨E4zKx{f`e^ۢsRt !:63uJxTg߰(}h_Xcq-F<>Sĕ/?GUKؐ,;{.‰U EfH{r $ K0E°N& ؂u{8cG:I emR`%pRb/#iA$抎{1Է  :4Y:>[C[FV}z=$#xᅎ:qhS=Q&;A"ۗwgɌt6F٥O _U`_El2V~^mL4[9d[ \Gi>ܟ܄P/>c=ES[Ĺ unJNοݓ&/RBˈ^/uo #o!-E ӋRI7LI2~sʌݺ%vjRJ+#hyp3gF. ކVzxǤ001b4hVΛ?L*41(թE0i.ECq_X٠+bt z.QfH*syz-:6;nr 3;R o"!`*qAfWTi2e~1Y EN%[jVK)kdKTtj0hȜ Ʀ\ҕX/!(tlKh eKU!wPibKA~b@-u|. SN?Y;G- l>?٭H}ڤD֘YkAIs /c` 0fpq6#o;ÅlՀR$*Vojçrx(12e!DʾQclxMwFE85Z4p%˧1&rO.xfE\}XХLa"(M*"iẈ8EIi8a']ڻC8 6fY*]?L5mkߠ{ejrcEVw+bh.uJ->-^:= $QSlbZ,H%ff&NLKv7{#C_iW xĤWBG+rdN}FBjC뒘Cngmk},Дp ۶NMZtS_Z$Zu]ºr0QNb.CÝHSI$GGbLxhn:,c1=UNtV~)aϖK CEiq^^Nq!̻S7H92Y2Al86xb*0P:]iNA{C4t`t&I;Oa\e5x:E!iY4?0YBb g(CTڂ$Oa*<%W/c<":pz~"HFMDPxG=_VTǁzr}4zcl*/yQ}/Q-PA!yppix5cf[25MM`4)'du?ԣԜk0d92+g FWT۞X6jFF9'ىjw]i\=iWIΑjXLuiI )pN3hFTaijٍ:L?Կ6w7=#{ۢt̜HoVɎ^#G{u:F7lyj%A!p8BO,*WBzFlX_`$$<1:p2 Q rc`V7x+Ѷv:!0н7Gv[ .ںkʧ-"6 8tjR z!Zq{/@en^~2pq 56͒ˑnN쥝z3~zLaǯOq2 Ȭ2-ȅaT-}ZZ`AB|tYJjyaGx!Z`%7g4XO g=?R[@Jra~W~M@i Kgk V/ ^_X$H=&LYC뚀 z^ BB,i QKTJSKɭ8L& xnRnjr&hR h4WTJ蓓/Q γg yA0I/q/l^쟣}<&r]FD=%6آAk!<ҡ#B{V1pϢho˱B ],s <*ePA\˶ZTm90EIGle -dNkqȥPɄslՄ*} Dv~ϷcXU<}Ot>мܯT >4e0+'>HJHVKW=u*`(`#ū;l "2M~2|ǒ R^(~W%(jG׷&U ]PPRHq{Mm!c5Kk"%G Emd:&՚nd2Fr}XECx< C~]y-x䫦wA_\^%œ&F7So -]Yui!p1 rc'Nˠ*#q|S7'$ݭ)D._"M ۳˶¿I#Xv'ѦKQL)ى,;fP 2b*8PЂT:U{i;3(nH اSD ~:V2Z]C->x/X*k\R6JgPvؼY[쳯);f_r=͌5v !91ZFwx%)a#@h{EuGGDxžGI,\V1g揤 t^EQieP E?ul_*S‹i$)4>n9n٪5bn"$XU T'UA)f,xU`af&IT'?ӇI4}E{(T' c39X.6de^ IDa+ ϣᄿa/7n44(|npȀ*׈>o>~%I)f@uP?n +vI{}0Oq٥Pa8ؕ¤08Qj3 9jc'!_$9"˷NcZmb,ST(N>c:Ip?bykŮ FxTm{B6b1:W*,+~LnZx i0sFFEB_Q3(Ez)}o N+HMK8a,~6szvhԞ^}; $Q .xeSɖM=7y(KMrN׭wEon,|kLI2%R %[ok^*|Od0 N˟{Ŗ4 R'Әԅ#}K<\2 +;{gd~$LZv&T6pΎ5$Oa%='Bd;ך"ntaN^ܿ4uU,g.#^ ?kar̳bM kqV6dhxgBBpڧbdo!wag`C?E09bpfxɕB[\#}L<.NL ߿=c;ͩ7@szV X"%Qhr7ٻN#x( 7ogO~jVJ,uh!_w77s?Ol;DXt9$%(W Jjdž "YxLh>pHV[W Gu⪌N10+]u#.څ9:0Ts ҷRJdag=a\EMZ%N:ZMk]VmT:X̙N17/ܝO~#LkNZϫ5vG9vfCdV)kֹ6̰kϳ 9|t[6N"{Uɿc9)<*9*\m[׽.ɠ9j&*E)4tCFT$^e٢lT֜.y>>\`mjʐ[TFC_ȇ..n`XYMx @[u3|pxQ]6W!yא;0MIlK©0L)zE6TPVN< 'g4NF*KjYG!=V'I( =L=FR:ɿ#~Lꗹug!K+=MGuKTPꨘ*RX(G$yM3^K;z kAp]bEl4cȲ 8ӱ_c@a>\\g!6p_;vhR@?˻iP܆K.7"" ٕ{[[Uh2AsJEi 5hܥ2 (xt K+:/v]5|Rdjf.zJ8:Q"cAHe $vw;_ݼ]O=^nT2 7F#~f-Y%v[ucR-cd(SrOl4a'}&9lA;%U"ѐ4C[$V_ 1 RɆ,Ӎ3=G9=ȿFlNhe I]:o\ٯ7ݫ̞+77 i λf7 5$-vQsM$ jY#<#i}տ'^\2$Na;9UZ^O,G- ̜ߣu;ؑ*g{.;m6Z@.qMxT׿;nnH~X"))0酉Ko^:-mֳs&!-qZxc}2j-/.dJ(I}2v6}a۷6pLHdp #|C3_ UJ7-]H&m,װ]|T.۽`:y&8FA(S#4 9tɜ(j!'o䏩xP+՞q}f EG PZqt1Ml)q&B=KY㨭˜(g8M'u?Iܟ|y|MU! =?쏁VkF2 F9PHK>~B1ٞ}qz5x;));4 ֹDp0Z4Fp_u4N~<| 34F#x!(o z=>>Wѹf2+rjyZhuLek4ZORX*Iw=MN]:rSߓg%f??P®!OFj[GՔ`R<$wǻGܺdtny%#$ QE=vG!XTz)ke2m_>BbʙCKHAdΕу*yT#S]@ܫ{pGfUD}|jc0+' H^AAz`gȉM+l$^TX0Gd#UҾaӽMvǞ{x|0c(ڌQRt{0[tkS6ggmْm=R6 <_z3#3|ŚD.?f@_yÐӛ#u]āՃ'>QCYC1~MmAKq"&=[:v*4pCxws):0^R*K)tH;*pF)hO'y\ 6'8UvD-/ׇ/5 S+_\Qx EF d'b쵬=niӏZ9jQn~J D^cx߭sUp&o84MP]0q U)% >*7q*]#lOZY3m6SX ,DSW83>H)na]BI#\IrIF"*b xpm  U7_tsә H5gݵ8a-𺷧O𮁹Īw f=W, $7% 7Pɛ C=Ow/gz7KujUS{<8oĊR|`Sɼ;|b+0uA#e@#Ib$2-޲Yr&N*7^s>2#nGSM>&ol[!u|,ķDⱭDP^<>v-ߎWb[q)4}2F$+{REػ(&`Y?>D–k+Yk5)^6*@<oXV.''`(42h9&p ;_~pT_3j!+ 1{-E4`NG4g_qD0r?!TUܫ@k /nagzx1Jә-Ut =^ Ʃ ?}H͟M.܂oM;vyp1u,Vڍߪf./Nm]WgQJbgXJ5kaWDN7=lo.(ks}B1mV۶-݁Q^\\y3L4^6JPޑ]eoֽrك8.;Hi4S$ĦX 5D~EIG- ]^X;޲ʏ!?LF/y\M iCRQD ^-acn\϶+(e4@Kf]nbp47k`3.9 8OL8/qg_צD"lb\ +7BP@ 6Z}ﰭN\T}m 8|`k OU az$g;Rmvf%~#;3yUHG]ҍO>@Y}>M-M؞kKD~'<7Xdpƣ  o4 -VvTjܰ/?~Arjs -el"_$2ΌiG|C֡״)}p0<1p#)-CE$ȢdeBM*&luvSGr#J_]t90tq=3rKdġH,jHC*ھ^!o2 @%&K֒6}ڟ1rjG\^ܳvqfy- ă+?CR49m5*UWYءDecε 'e+V(;ee8֊Ukt.t9dHbZ) !SmcDҨ[6P6 Z%5iJF>do]#\xk2VBpA3Q_)T}QR=n@Ʋh4ZQ˳+LR{*EigpOȰ_U.T!nGXY)2Af&uNvsZ63]D%Q!^,xTݵ7^Xf翷Q'zMҞd}Pe2 *o8Gϓm?eR[#6hP+Fw =0RS7t'ͦ]VF{RJ/+}z/ec C3t;N QVC~ZJc%)4׷|V+i[s,z_ 9@DzWE+Z",:g<-c=8p8pz0k`&BUa A fpG>rY܄ZP9 _auOH%J1a&9> ad=*mViuA8_М +L=FS~>FILҶ S~5CKt5 /_{yom8 Lz#'KdbeU1\mfɋ!eZFaHNT#D Ҷ$RiO2IzD~8 N,C߲d֑*\|I AJ6;JKCѮ=tٻ_,Pk`{{T{jrY|d: ׺{˔)~}:06j̆ Ѳ$>PX 2 \AiH`y$uiwkV^]ey]j1*0+"B9: ^giBىc}DaPmu#T}5W_NRbL*XK_W>!XO+:L(oB=Cv=?1{q~W5bi#쑵p >n!Qꝥ 2}gL bhN ZSCXrc⶞<̆k--_W. ~ Hǹ:2u2,ڟ@6,vT䓉VNKE޺b `Ga׽t-9i0nkߜ0qkUw f2ѼbOմs:>fQcʺ`X#CCߠF >VxT&_pCJχy7N7 ߸zNjdհ$1J[߸W'ڤ!5#+{~:zFiS4tcLk #SWxUlEwo#˦BZ@lGo0d#DFȋw55 em2M"`,r=51zv 5gvL5&ECl⮯ =ٙ mV۾X|fIEw3Z G0vV j^s3Q"ڰ:[oމ&W*] PD$2eЩZ!9MfG_;H|E$|]wu~e`C@;ȉMPҰTU'6nA0$"䚊UP>&zZO$>gJՒZr CJbc_̜.EXKJa36;k*,O#)#ysAE˭u\]RnA(_ nw1UEp+#D̗ G,wewޕX/DiklE. LaODa>oٵKyA⁢`j-m-@ :DM^c𘥪 ^ Y᧊U r)-hY兦ep8R+k'N^\C6mUHV2ک!.ht ۏ3 ?%{RvH7SՈEWMMW(4U#*nTy(̻he*g:sK-o3Ɓ(q[ Q>ņ2PfO*PJP^Ne~W8>j6G hbl6Mpf0BtpabtMW AmR8ju<ih1T_>ś&M:s 8{̑͸bh'7=n}ѠF,3 @7.AwBӕEǀ!/[h -kVcM~@RA's1")sUqIqq"݁[=QhNr}rg/x ( LK1|\2Khv*n)$ X59?@LbT!t@%t@$O"L^g[y;i'NC2vn*\j'r -2kp`UF0h`|`f,r60hGh cRRQƏP\Vn8wIzڨՠ5۪%WPDlʠ>4lQ t`L;s^Wܵh=MH" {DZwgzhH]^EXšrpfXu VW)j1uҼz'Mit/#") wt͑_e jfbom#6zTϤ'Uk7/Y{ T`s4:f|ie9/SYk2U#jLV֦:32cZ C/_O95L&HYqD Ur \T_K8lnd#= Q DV-SӜ*nU*t& (| F B8o̤7~PQ|]]@/KCi_y`MĊ.CHMPG(&"UG؍z=PoʝEkr::–^i7_b?y G ? }[Cbv֬ ]sw;N2ٴ9仠uvG\ _UZi?Xzw([T1>2Њt񡧦$%0hOGJ'qќգq|rg$"msW$\ZlF oC,lFV3J}Aq9q,^ְn6K/ԶB>xְ:ҋNPɶ%&EWiB6p MԴw /_Y3|fU6%:u7⎀)T6d'(ӗH@2v$J]etGrM bqgOzz zw{` V#/ js Yc2&+r4 ƃ]4`ytM+5퇨!g$~8)utn>ί9]8pcXw ;Uլrs$KZOBȗO8o 'ߣ̘@~־,if7[ 2݉ TaOʛ Kt&8)¦Fք|KhjYSs4"ޯTA#\@v|I|bS]( gk V]Qj:m(RxkGf`V)8=87C1B"5%!f;=Bubb*.Y1C/a n \swUTQ÷^A… YxD4i^b'sf0V-3>Z&wEp*PT*^kgzjtb1qAEwgtBtɧGB0{D\ODsT"6ߠ{"A/tۢb֨M|؂G,sT {m%"X0۪pTjۼ;"`2"/g~d5cw7K\FXfDdw R*?4hdK TkwYWozzz]ha$ sc]=f83y hU6Էi Ui$O#݄1i])mñ={XYI [ GxF7lrpSܪXI$|N)рr!Viaq:Ii}9|?iF0/Y#+#=| O֝kĮXJ[Uf i b9.>&"9Ja>)i#}7sEa+; P_&=e7]!eWj8;nRefGQ" ~'7y&8dd _z/!$=Sq8Cvu"}ւ2^G4w[C+ҰsI FF ǰ]$D-%]wy.: ?:gɲ&SO Xi^MQ:Ceq%˕Lr?rLi s򴉷#DDz5&hA?u'- a8*m ^_$%8wZ>^#\tli!Hhl!|8)a"#b>`#_c@lphVuŦf[Fpp̥VpG?ߕ Y `2A(ֺG?=m!:9K4DO⹜W{[EXѯn!8~ƒݬG 1hѻtC+AEaMmb1rǪEHi$kZ1'+. <*h&hx;ioijHjDciW'ԮTps"CU`I= )r 6iDp@|մL.jzr1]bi%Q>0s}Ʊ%YIJ}$7k#pT<5eхA$TSq;m[}s;~q\OPd'AZ6yIyGt\uΔ\E>Bq#z;6;X"W˴\yAo!҉S4ܢV2(^MǪ;Ty)rS򷌔V=<T3 MG;,bivB7-SJ=HsAB{FG`r`I/(Ov WAt9Px=Px2MZ=Nd.lՃcG:3ҘOlBC^(6 owhS_]B# !0U=$C5nQ-u_?Cx]Qw;25htPklx#kU⾮E _}*!O,Wg6X{fū&}7}AN<& ?[tԸ]jA%LXUF0GN yMF›?{<>åKEPx2,=,QZ b26K~a#Nh7]HI34eQ%\(KJO' x1&ď FH:@̞0+5y~'5 "cDU#Q]0'ȾK k<ԎW(z|>Cr]2ٴe"xsjδO6,kҺ(ѡGF FIY}R-"]ilq HwT#[K: Bݢch\8@9$A폡x4r37g6t>p aT%8kajdj뻐l۟r7A¦: s uli$I"\1MJJs3^*Y"J)oF\>+Д:bH8׊MD.7[u_ܔb/K B88½9Ջ1'Pb2^#Z @F>y8CM[/>7LjY CO1I{*G)b㱌ΟB`|Р[_,/%W:Wh[ǻ 3f?&Z `畣F5=NM#z?:)T|TsNԼZ΢ƂV\{:'|AWݣcz-72GRYdӕ= :'}:RmemUÞm鈴OAX2oIE0z3͚1$6?V >-wI^.I bo@q)[4=qw kfV (ϼo=Ez6\L~~0c%zُWTE_~S^_-bN"\N)9 [MAAގ,4;2W . 9C@hg!<G/tA T=e1 @NǾhmѭ G3XȝhJWpalϾ*_iҷsģRd.Ÿ/"$0^.Gh'u( rgs|MV+;D5ҊyaDP̥ne ?M$SS}Z*q*WHeq. ZjFqhB 3m5jYXiƜӬ?d#'9h)/ ME/9?ŒwAbٴ4?Lh)TMq N8[D'59K:]}֖83MgZZunǟFۅ 8{,&`뚲S}b8& )Tm& `P$ylY U+ur`<'X0Xy:0)˛eSl񖨚TD GpEV&TPo`d3'k<ݎպ*RROs/](a:W:t®=E lb_D&ASV@N&U]Uަ/;ǎDLr&v%Mdw5+mLtH]Nʱp1.Qz JnǬʼn'\Y"FAC]F׏ra4}ڎDynNcfqawHG{: g-+")skC2!\{Zo$fjNՋl*. I-rj&vD8B4C)4Ff</ A*~A9c:LL|+AH" =)@pC>zW`-EnHZA)h3kf;Q\ aQJH~d`fFpO]:`& Lf ٽGlP8ID!dǷ֐rWGՉ/ZAi۲Mh1f#{I-fSF3Wh([MẍxZɀk(tMW*-O7V ?Y~LZXj︋[ϴNsx;jg+Қ`eJ w]L>nYo 5P tw>ݢqߍ 0(@|y5^~0ӓUKiW 9X>F.3I<`&V%O@nNFZusNK֑.g<is@ V ~9RF@K܎j4&%q[Z/y _cQ(v~.㯉i:\^-y(H;&!O*iF%4{˓1 U=S&&$Jj /&) GeR MމNCt$\:}[Mu48~,)mUfhhX7*iL<đRRGҡuK92`OcЂbD~_PC EFkԆK Ekٞ=+ɳ~KtV'e)EvEDk̮}=-HBa^kTNRe 7X!zpW-"W~kxy0v3TwzAn f'&ߎPh8º#Nzrg>zNʩ7-fofNӣp& "=\^\$|'e,䣀Ÿ CDT7ߎ&?";Q#aT\uʫH4Э\M7@d.\ITs6 QXjBVv81UŘ0Oi-4f$6N䄟"T/syoź?1# ـSlc$y\='(LB!`5teZstR}YS4TpbqwCiA,0 1jc7e_i: =Zk)چ&ꔹ[0J4}K7V.jhK}cZPxdIz֔a #WitN@OeL>m'?h3d岎CxdؘܺdVQy~3󵣂(>P ܧ)!>$)!D;2`QÚ\M4JvSYvdqc,xLHٜ/JED: k3if/L@geQCO{P8mnC {| yCuA#UT@TIdL1x3pDR,"3VvwY\c3`ҹu| ;JeX?G6*g?Fv#;vf4rk捲pIS."bVǬFLMrc[c;#UbjX z)O(֞R :.e&ƪmy?bϧSTJyBTi_8 Jfܮ\>?pxOR |dw|?#3toU-~̾v 0($J#US))Q#lདྷ7Z4,40IH2.!+-eK(3H$.Y%o7 ˠ8l- ]`UٖJ.*Ə-W qz™FˊL+S%P/#^#0@+;2㍮*7E<5JMݍ>}9 n6 Cecl V崂/Főݴe4n%!E6pI+=dNY7$}Mṗ$ t_u԰w&sAYY&!7eWjs~:=A''ȺYߠғa2rb{i\ZB?٩RaTA)9B%;}IO-Ԝ\%oM$XDVVև25rh7Kd4$%qIЫ_y,TUe q{ |4T+)ѝ؇穯9?-1[8ز\|@\Ś71&{]3om OW= $ Z[>KޅqYE<2HaB|] 0k~]D:7 )dI/w]..&g,J//rW[.9X5 s8<#'A{:2i l](7*SFtX#;I.ޣ!Gm'7\*e43kIJdfgW ĪQcцjvy6U ac3]Afct)Ki#u`f_*ّWոBdmgHQpXMkb6?0wYs Zh|Z1ZK<p im!d8tڏƮ9sݟ#8߭=?DETpEKkI'd):y&՛<bV!eou+akI _ìTz$¹;)SDtv~8amJhp0v$ < rN,c@:NBP%4ѣB\'{jIf#qvS;L]9*Է^ي^@9U̓!շhP;{*r~k8[.T&M3fב&m%y[bUK-HNXxYVexIj[GM@Hf&85ƌikÌ2E_вøf5z iHűP4˱Lh/6Yم/iWKă+z&Ol2F_82*}N}oIi۱g[WىW+O^v|~ǩy9 s1Z0J\bYtbq7`w5pq@ز*:7MQu JӧlNA:a2? ~6f$`>%9pxWoFQbr'ȳ=Brs7qIlq`Eaزs(~pMfҜYer+NHyKW17t&܃5:t R=?,fS^pGť65mdHRE 2Υ]EF6dpW"p: C4B (ug/?4YJnN>k 5 }LIS=Z橈X[j0&\.Xqj4:`S=Fd&wIepP+rE2?|XV$ Ve2䐶H;Lbd̑Z3X/H` h4ksOQrAq㚧瑋I F`@)yQ>.x.Hwg|A_ݯgsƌ$*[Za\ЪNXJ9.s Dd}mEB a%5rp-88*6:N$E}seDp<#8k[y|>̻tid6a ].1_UHCae #]MP_YHnfZ3`{LZ85pkG1q^g}(vͲd:mJfJfռv9"!^O,isnJR0فl0gGizOxD9LS\%wL|mA[^7Y0 Wzn2j*uطMpGpE3~7hۿr$Y'KIPՁXrw|O-5Wp1Ky\%I-jC 6 p UJQ% X4t ?*"W*T .զu, 9]'!<I6ULˋAՂ $3X10~N|թ̼ Jv"5P aLZţJ4 wxN"xjMQP(E4^ImqVXo8w4uĿaA4Om+{f.rc2B~Uw%'q{VJf^z=%A&ޡ񚮅![ gJH o0%|C@4ҶSFJp{rA!aG7i-y~0;09[!,Ep M%F53m\E.(qq13Q3&,Lv|Ȝt9wB|m4݋$ihS:ZZBZ .M+au2*~Tmj򕒞ٹV[䬇pymtAh૳]wDV k, c;S1nˋ= \ק7pDfƘ'A@At(%~*%~*^n2ך1p8t nk?ƼLnl #,c?`eGٙL! d3Mb7ЫڸLNԟr$fa+y`05?u2Is )H4z.OB4+$yߢl-I,MzVT- ݈^l˿t;nߨ4z@4]8c/PC Ba)T# KVTZT[o'ߠc r Z-$>^tNN/eNx)Md03xY`D֫EԠf'Ϫ;iH }5v_;V$XD=g.\[ǀyeT鳟}QfNJeHZ6{y//!zw~ޤm U^GdHX̄MA/i# #(n@h=b; ۓWy*/# 7Ҹ{{,Hۮ (ciҫ~=آvEG;`Dlz Xp#Qі`x͡C Re`5 ߗ:io?`LAxuɂI?=&6(XcvKu}KPМuN֛jogX2x? IG#$|sն>V Ԋ$Jn^r vZ:W;UD 蒪0yCN i -qi-%d.CR\id#tD/fv.ky$Ar26,83}]LW,{IM\0^ge߭EL_v+)KkwFVkg̲ ōkB"KΐMW푞> ZLB&Xo7MQiD* "d: 1T qI۪GǬe02fWNVne`?YʎS.>ZMFx/gnEjE*wY⧃3#ZU rYBurH%)@[@@7W~`%)b,Om|/,:BbO\-m EIqڨ;*eȼ(qiVg?ʐ0-ߎq:xa P{1jslhSB1)M)B/|ԣ^WQN*(IŕݵvqHYQ+Uϑ=@`6,bÐddȠexP*lXo^ՍJgliR]Zz"\ ِ|dޤ Jb_[9$F'ҾWrxH>yފL;oWA[8K-B1TZ*jkL̙,Og(i6W1%RbԶQT=EsxVϟq +ҪaBǃamfGZw3, .xz&I"EBl@Z!ZY|xGa!_ã&6bIS\|S[n9Hı}RnA{+*kYmj-}kfAb4vG먎\u`D'9rZn47%;u}w!$E 7zwg08mx#î-QKD`Lӵ]I95)k6n5DnsAݬMaG΄a='majb]FG7 zZ-QIx^kZvܷ&OZҧx1^2%hXLW1g0xli38iWQ(sZǾZFНk|sك""=!2AKXoOF` By ɽ#MmxU{7΂bSv:#Zazl]j0aKN3R>ҭ$a3Ih$cn@SɊ>fp13}+&\ȉK5?!^V^4nQ [IP =+i:s'e% ۄ˽Gi }1]8Q!S#ej-V!ΫgihyS]/k^,hMőZF4P͐OTX3ӆyEn>(\Vɖ3Y$MőVQ\ ^w!:ԡJxȿ)w*ɤd&qqө6>I~Ѫ2+ pv50 fӿ`8qiEvgqjkHnZ˲U\ɱ|?kçJ&tA\tm6 LN<˦.#O5⺓LeO#6f7+P\n~TFyMn͖.,/.xCazÏGfgKDphW:!byDNIS:}4N9]moS/ SV8,8 gffE33'e$G%\Vh^Bns[f^ z( 0c`cT'JNuʨFp6 _wk~FP"?a(~30wibrΥu{I찃;ptLG&7 oMѲypT YR 7 ."5mGo41g ;83uS38vYq* v`?GdnKd%M7Är emxگۋ%XikSLI%vKn!aE/{+nZ&{w,Q@r? &=֐,͐!Lu)+WYlI)Bby|Y,M1K 68)גL }VFtCέ1Uvz"d`Jx^^QԵggj9-pFi I'd<:}c+6 PbD =:%֢/&1Aryuo/[7I9 f±x/|jnfֆuDЅH99Xn|?sHb>!*m[7]4ey(\(ڮ q34S05~3yX (/ԮvL5Rʭ>khAUC4Ƞnͫ226QX;7X _ 80 O/vqy\r @]n;&jWA5AIzrA)QNd#` F_Pi +7\ۨ}tnDjh0 3sOu[!*Xijߴ|曤aH*@WPP/P^`IgY@GmDc9BQjN#ZjnܶW6+V="5ӯ$<*p0.sxk$aB,S뤁"@" ]RJVg/"P{xKAtd:N[t-|%8˙~BjZ rQgs:(7$,s9(Jm ZRdfiӐ}ߩ %qr5W "xPl-I ;!94Z=ODBcPUsL1D>E-mqk`(k_^ e}8X2so_ܪkfcPNޠ=Ng83i)+nyT+מB7fG+p5z*?CO#L/ۨCe.˕T#"tXw٫)оhK?Qs\@Ɇ[Yc=5Kdp7AqߐңcZDjAdN+5V9aU 7#}^3M/ Pw0]O_R<U?,N2X$SU0VK]‡ Oz=}x?Q6ъ%zr._dQfNpRԗqdi2;e:#PH 6ѵ%EKOυ Ȗ8 u@DFscERo8 jkjőW'#E+( kA .|=R%d~4UMU#szr+z(kC/xtԿ3A:;0nߩ-GtTʁֶ.yWK}呁wqث"{҆Si<%GV_Wֺ mFw tIacc(A @:|gUzlK=#]<"nj)K*U5D\n[ylT`qw@i:~1^žac?fNγ` @?QӬN֫H,GE[AeF[W%nR?b 9~ò(8Tu049[F&=q#[˚nh#N_݊r hGF\^ ᤊym8k1 h|70aut9mzkو@ EJJklT-uF\J n>U0/;Uy|ZeXtZGE|̯/)x SN4r:jx4 $UwW/3 4U|-]9inz9!$ V>B|ysk@Y1?2u̳.L2Kx/Aia,؅82P"~DzIDbϡW9cz^MKacy ]SgPˆ.`tNt!&XPۺP=Qa-(M6lLc_|0cm̏'4$!&,tVF3nJz`A y[on 5nK*Z9bfYa&Չ)&AI>%"BEM ~.|'h_mz<}PZp7dyD m#0_>STGNh![j<[aB#ۇ|&( "4[XC0)6}mܨovTg1]AWԊ"ԛ$BbϵƨX*ο$m0t D=4-օM ]y^^uIs Þh?3ᅕRz= Beɪ]&9(P@ʤv!OMF:,>/b -%6(g]?qGcGBPE1_Wgo%/ "/8Z;U7InЙcȗۿ lobjPei;4M,HL$&y)z7C,S{*/ ΁(K,Sn1ȣ孬bo$TMVSjQ"b܂U'tpk \\YǁuYa^q-vqQھR<-/X}S? <ǃKrp^[t6Myva{[$68 2sE14 ӄS+ \tٴBfL;_}`5  .j( P oS--Hl#U'`Ub/IJ< @sl3jbG IbwoHY*J7 0Խ`'=fb0g$`fs&L}ny@@WuLy0K?@ X?4y !ף$=S o-eCc\d]g*`F,;Q]Rl$v \᱈WsE5ՓG{6?wg&Q+4׮%U}ZJIR˫"$Wuϕ{RwX& K| @Og2 ;AZP&xym|>jl:^46OTzGm{ޡ_aγ] FX,[#g#}c$ T~yWS:W& xG$WEF M\/ LЧ1r}f]*d9cQ-yxe˃WfǴRdSa}yVBMh>FUTs NW`TnX*}})IoZ\gq1N@P>`tE'~"akގ|\' CEri HHYbu8|EZA[*5τdTDߗDcz Dӆan t0f;v{ B@D]n8Bu;YnNI^D)m"!yTE'lz~It˛^hiծ{V$&tbV+0a ;g|,4ͫko¸ T߃?ZV"[zy E&A ZHD/2j֔| .ې[g޺Jj htj;tzl^"fInLVF$+a@jiE¬,T?L&A){(kX'xI M$ב+xy+39Rz4xq}R qԵ|rc_J;(]1'ڞ ak#fBY;1z~ՇFr~Sy}ĝ.5>ZΆB`OMIѩy ϰŘ#n gI 49O++ɐeald~qC2tndnƄS{Л>.Ii43Vo.)!J6 )DN2^849`_J).sXd-<ɜ~ɫibhýLzn-Gq}d(sf;w$03+~_Ȕ0\ƅ7~pmnfdyrPut:ac~r*7fBwykyiq'k縨ʸkys" i !(Ȥ;$K.K`5l4u=ƻm,g=T.R" BPiS`1 y۹/` mi7נ+!y{8&Zqf{6Dn-K芽YgC7]waO]KF6-0͎$hhSoƱ A"ז <8}$琣I ='L 3ݛpsXϡى[Q}46ҷ~,;|z 7NJY{wAh10pWFUd̟qA;9G3hb2 ˛kڜYc]psH#lhq}HV#V^o90\'d!Crm#&MBp!b[v`+ۃ6 G 綞nQft }T;*/)jL| cڔO0&ĶֶDxOT5 JSkw7:G$fYA4+}!5Uܷ5өi `$Uә g"rhN#16dj4GҠ1[y3B>)jkh=U65~!uG/V+qrzLX5_bt3lH;3{X \!PA2"Ie{Xg@xx5¸ow(<.|? ~ 9 +z?\-ҏ}TK'nY(i(Y@m&ewQͬ lw Kmq+7]`#$IdIz59,%.Ro*XUST*f$l$:9ufgUǁP8_\b0J[($dREnbs:Z?mg25M1XsEKgҺB/hpUszX!`!- {:T="2-(C=.츄'0&Ҁ;CxEօ2@.TЁy.*QK4<_>9l;k {YSbSGD7҉/IF^uoҠD`~gċzd -*K-+7ˀ~(srP=>DN5cː~C<-?oCc\3IYgTN؍\kUN!KR@=p(W@5wRݻvL#g`H XGh{xNfao%_Lѱz9IgaIRi,-tX=+Rlc%8!a4xca8uؐ7MTN.I:z//*Wk{=B٬-c$n;nFb*8x@0Fa59=WT\Ķdxh1Ypy7\ A{__) _yh}{$ڀzV",S}`[&=qxbScM[R ٰ,=kHѴ 6 Ul)f `wN1ښG7F익ߑAeZ\oe'@ ,?CAX:W_zRͦ@-8+*%ڰ=/jiÅ5HTSV#41)}t|94@q90h{֡3"{+-?#O "ǃa}yleUMBH pu #:ѕ EX*aow\IpE1x-@ys;%?U^xY {ʆHV^qZT)> YT|qN =n ,N; FQĜ_k qV1;}aˎshsՁԷnPFv +k¤@pzҡn:MSY 8ĕɶ#ZRE7yUN^'"ve&_Dmr.Qn!`eEu-f_tE4 ~"-0aH t}vQ| c2^ud}#}`~:0_n,H\ a<1*ՋmI5V'Z*Ԏ[S充SH[4|L`[ $<7֐f>*|Аi*K _Ј/RB?Px1|F~8TO|}s=1G"9~E:)BY]J^TbfYfx UE,Yd"uz}XFZ.Sp{=.ج5ok~2E< iBr:12VSPF dL\&E3>?k䲿jSMM8"to8&L$dEDjd|b,-dI9cGbeޞ)Kj~OyL}CWIcM8zˍ}dXC'~-={: +raTibw6ZTZVjEZȒih<+1qvu}&mƠ˟,W}LsQKA~Į"WQ9G5GSV"4˛j/a҂S/,CxsRd,eV)Z KaJuqGSXȔK$5E~Ǥ zW;ZdO{3Qw:[*͒a2"W}h'Miv2uj<2΅\|%ҐzOSL `<`eA8Rv-=Rvp,⌅sI = XXTc%x_@;κ-miMae[b: F|5+ =mP%) %I>b77uyi"14ȋS+KOcdc~sZ9? _/Tt Vq1͝j= !g=!Xxej"vsMϓ\n%ݚX~D0Ӷ2mN@QT++>2%g2E_vJ{%F:("7Aep?źCrL2xaw_=+69kRŷ55@X#@$JF~Z i,S4QX f+7Yr 2dGI>DŽgߪ1Jj7(&(u3̭2 aQpU(ߪ^жlp È *[_B8'ec&D`^!&b5 'ʚN㉥׼LoFVaȾ'U/ݯFjcT\9gZ{mOჹ؇Z ¯ߑfFc_];W^\:znu1}rsM9>CvTB'&i:nحf5|{?(˾_6rL$뤑2d{ޓc)}wr&[>E[ԿUP٨fOa\R֨=Ùo#*Ï4%hOo (䵁z 0 uf6A}#ȭ">fY+F,qV_k.ݱR_TI2 i7(0.`OxvS?*1z,3VJr\#Dכ-;ÐJF.[Ӂ%;&y/Piste"Uxy[̸%4@9խ!V°/ m۹2)Z)!pP{XiwoGSey#zݍfE-GUPsaz9,0x X՝P3`ȫr9vL[N6k~VϐƁ rw%&9w$9cQvɥH~+4P%?c=K^3&rSĨ;Jl CbVt`-#4l?2~."|+Ӻ :sP|g㓄uf(J9Ujn*ӌHbH8m !w Aޢ#ޗN3FR_ETf/JLfv۵ ܸv@s԰: ; +Prg1;M.辫_kMmViNh93Z XBUWNm tYtF}20!"»07j> geM)pfԗ5~ID87["}iƆΉ£w!('Ҋ@SNQ\WX?35HWSRU5PZiԫj;/ګM|8:n7'%q&Wf h$pT4']Jj,}OLOwWx"(o\l}qgt{g^W= _iM:hmbz)90.d?޲1${_(eZ A4G|-"VQ)P(/ŅB P ]uoՏ~=a#%V-:@"~+oNe.%]2SΠGt&tBvYBQcA-ܜ`^Rߛf],U Fƨ:4|Y&,\1<8nD,Yߡ:zA6c]B6tmJ΋U/9+?5;#;: -NYj8ʼ/wZeH .G"WKUo;,u?1D{9L􌸜0R6&Onȅh؅e(*0ӥv+ݪ6jJ=`4%?JsꅎEDN ӟoE nZ>WHֳo{) lۄiyf'u0`SnBC>WֹK_G[7z'G0(EF8ݹlN1C +ի4:E8="ehAtsZȸɯx pqQDVl{8&Z,Ճ#D:#rl0A !C6k|i K6iдO8phؗ~/lBǝV51qسUncx=nImuwF>ooƨ1Cm>ʭdpou؟Qsvl6=PE_"TTFƓD#$߼ܦmZ]J"dT%C5G3_0=-fBGfI(΂,ObŤʭ*-{(uQi[=,w!J'þ u݌͂w.?5pa }rZVZ|D=j,51e[Ͼ | cn4D lRܙVB@s6ֶ ᫡+Ia"kaoiވViVx#$mϫȟNȎZͦ9` D c|=&wÒp"A(umdꗈu/\2u(x`L;.qC5pB.H::S1dHϘ] {#r~1ԀQgn+G:f!5c9ʔRPM KsB/ k8N6X0G5kQA'za3_NF<  Xb| A]qZ%(3/hvЋF%N J+;9 wRU8k6ߛkU //ŦVRGz˔GF? +b xJ]NSƀVHH]$AgN>PsIFYf^ؖCy#ba%f[P89=V &hl/ ^vsKk .oR n^F7ҿ*|ގwdF1a Kyl_WKg=-e {V$͔9ЬsϼY KP-k{Ik"$ɀHLziQMn,hp_T.?`/V).x۩ap0r \ET},,I48;7L9| NeOgX=NƿOS`B\l^h9ʨFMyaբ\R9yz|Oл9^&f e75|7 WRov,s $* ֧6.ry&ʍ#}Y_k5}|g0Cs* t0+1LgI*/.ܬ5AfaXs!.%* c506~5Ф-O |72L東[ߵؐǝb ;$}]PɈ]ޜ0Sd}dʯ"Oʼ GK8 ?T!}CYG/DjViَ/7ed&$ճ7>nE'gnQU4Pkҭ@|"|FuH8Q>zUq1hRq`UBdJ$xqpڕB[j$|';8AbP9Ns)#̄oda"-Aȓ303|+m^>LBN ӽrƍ[S,F&H܁y fVu9x}, * +-p—YkG?h]Gz8drG %Z:>{c8Hg;&%q h|pVݖ(1'@m`AHiՂڼ|$^DO 3Oe)A7 R0e6'Ak[h t|4v9;[bT\`|Hπ'kkVGvF ޞƦNبGA$dNJ6`Ѫ?ޮ@%B4(7)di;K>ḱ59ZxHS#+j.啶+/'8QV2%УTsun*mKxhr9|^KB2YXJ@XH.r}DovS<3- ̶#] lψ/ĔR~T*ʻSIRa6){ǽ  1tVLsA?^sƥ,Bicg=#U`A1Qy)=&g3GhizíydGŎhqrޛ2m&]u&i 2qo]J)mǁg(~_JaOx, ]b_gq.m~Ko6 H%N9|9< Fq験W -OAC-<(%cB2y[,B0ݍMtδo/'@%/>%CnݕêեOf4/KSɍ9ʿ=:-ګ FƫfDtyb9fa!1= {S%葦;+y)%IEٱxhOPmt|^ڕOZR=t Ecsh~50WzfN>ZU4x:V؝LZ@5# YZ_a[hL`1cAD0k;h$ͼI:.עire1$6{%sƪ}4:{ %Ns1WHx~KpJ}a46.p g9&a)4j/ P}Z\2)sk+M RSc}gn`IS~,3ƕfE}[eȼ>Y BL)!dͬRα),8N__bRs9ntc  7אhڙ]97 9MjR AQ4@A=y&2W(rm1e. tHZe#O3`8r,2S%xTZN?cM{J1؀Hベ-XKfθKaq$vz#J=ׁBZJmg}SZ5|}˕:6{qz=s! ^Pø|'Km98>80P.)@}x3E7 %,m]o~ſyRLѠ 15W8`&Ub rkg*$R(<,y9&YX=BQe҂3:i5,zLi29ʽds*d /[dbA?!v]iR1 4jC-v~ܵ'e(ca*#Zz8c=z~g匼RL1ө'oR&J*GŸN^2^kut D[ʍcqt@ԑ֖wZc.hrMMQk̽S/m1I:4*ێaN- >m⸜x8fOΥ\ὡ፧ TK9KF:U@]UbC`q] z'idrm*0]ZHќ 8x&Y`;#:UIc3ch;7̓ͧS `]gL|v@(Ll=Z/= [4r1'i}@vY9EcI&g-2vv@WLi\'~A#x4L_#ޣ!}[z3$৅"ZޓA&akk`z2Mԇ2b"Kze,4|T [7>s{-hE7C)d!g!mYs("=bR,~f#z= Z{. 8EGlcv6M 5@o=1e7pN17rbi4ПxoGa2! ^ZO;sql3 ?>Ҭ5ĜKY̸uVcѬ,+ L35@r3ic?]h[zl^Ek'$ nD w@ MD#Bu1%|:/mnSTFE.=~&Ao^Uiā-d)KB){ >3Lݼ3Eu\j}tLFGn秋2כlCdt.%x.*a_ MKΡ|zX6w}3VmGU㙆KF@-'?lŋN,˒]SnH$M~?|!T #!NPQytH2qc[0-:!>VO8җHiqr%`=v.g,$ l"gYv%&wlA!.ЂeQ( BYT_20 F!y'c)?!WUq;LHE%wuDy3kEN <J:>۶;ic͞\e6,ơH72Hqcƣ{/q_C=I{XRT.e*#Qw}iheP82݁:$¼*vy) Hf_%){1. ٭2#-ժl_h.r|O wOHQ[΄3 sVyt(Q #}48w'iaCWΰB>U^*t$NԐd:#l>@j91L_ iz tU<>*H"1g8G2X/N <\{|,㩾V:Ƌ4#z{RTH9h6IJℼ2”( #5A. sj¯FjNxc馾WU}k1ys $0uOD#&\uE%@{%<49ik$FՐq UOWn"M oܢBOyd*M+ Ic{YVZ2f邝Lus8R#%/9N569"FP%-&Q߈I$L=Gg9jֿzuitxg0{ϴ)EGϖ U>j2%L /t[.c@DD ~ЈNշ-<7~Zz`OEe*CDF >@#}_ַ d-i'p3*sZ'nn637GN߬B7фv=0:X{r L)N95ǾgG|TIea,@v}4mrjix$}0~cxb)$Ԃ]! ' Bp]UboE9N%*38ofLdw6R- ,pYS`[z@~CP,2.~b3|ku"+w;8vSDNG$ ﹑ ^qdt/2Q; Dڣlpe"}/i}qd.Z5*DDh8bb+q $r.:i(YQMbZq_g=ur˺uHv ،Ϻ^ mnٶel8m6\Drck쟌ʵiR40|4+Y*(Lp>\LDxx2l~VFUkZWm(*fcqhFث \r?-ǴbJKfqB\TfJ^4ЯM>fa ?u0Υ{nq߽h S; E)N MBdT$b]Lt1?8U:ѮM؀dȠ|ycjrH1yFoT2Qw@|u ަ M%lpCvj;L My{͆0u??9t8\#,#$mIn ])w!KJM+Ъ띻" -'u1ږ1@^faɩ1Iu G|ZXTҭ\l"o*7(+ CԠxW[Sv[ٸ RvY^m^֧SӜos zTPUN럠Y@EW"G I+M7\=k|NLZ 1 -91'EH{֖sR!T=?DLhDv@Ȥ-X (%T{">8~!:t<>eyȇӄ*xH4\e5c'GZ)cu}%e@6!E'L۠RJvA&=QT\J=(Sro8Έm%ψ_q9(ew>Lx)Z$0͊,dNU(\7<$yQ<< r6#o2)uzy%E'b5ӗGvx'`gfb wç IBޤo<~BαHށ9B Rzfi{ +-.h) QWgH֩ 8`xljB2/mp@ﵛ`Ê8X[?vdtd@U?8N|5۞OF}p2.bQ'&T?(4klyўqVU96܂+7Cg(~'W@\+51?]kfbHA5}El9)]EWg;Q`oVH'7F+8se!h>yljRDuyb0-B p%`:ws9U'TcĄ`7m4=?*Ԥ6s$#l#Y0od?sǹ])`No?s W1WbaR/_k?>(hDe1۵h.PښB/#lj* t,B&UߟHcM)_RQʟ0Z6NU0kxT!z/?A}T|VVE܍fڣ{׍s7wRc8 -b;L!9saUO:eU^ q8f}pDZ2%l "$"t7k}nɜ (V ti8co^ ; {nBۖ"jf%Ӧ'$ EeW&O <^0bc_r+]^8'IdD( g'IK6n"fu7ZJXcUM4ݎ3 4:9~zsڋtX3A: Y d[qfAE}vʁޞnB-swW^q/=tr q'm~ 5e֝]|S=$!₌ 4>,Q]/:"FJ>D4qf. 91j1=θoec᎖em%g5,&f|Cܜ0of†H^5>,@ rP uWJzS1PE6:mD jqr {bvuF%[~bzg(AӃP!dxR't1GYՈ=Ba+G@'pp)w#H$5̭џh/9V 3,LkSc퍋dz^&xܣ_몆{^cG<䋬Cok{ ΅fYN5VQZ>LY+t}Ғ%yEGU+O0XE${,3dg4Np`$ hsVg}f{7b;<]ە .#0J>&F<վ|&c U<j>=P|B-i }o?W?G*c't被6}˟bEّ`(n~Rŧ)12P߾N)?ʞ1!ب զGzcγnr4:GǑ=e"E.ٖ2[ѥʫ=9*uv c;J#q>zW()S xМtG=D_xq%٦v}#XM$K65io(\5QW1ߣQg[DםɶԆMB$QOebZ!+3_҇S3ûOVփuw]ԊXi%#sbhG:uj0Â])ojw(9MY脓t7+n۝?p7즥η@j!6R77CP7)5ܖm$⛧pzQP'ɤ"IM/kA@QTyO '`ݒѡj}Lh` 9/S:4'$GMpgMa" z`2q ,/+`V uD7-/xsdCKk4miw"ˤ֨XB¦(ki7d"~#;C5앧{+?'`m١˥Nظ}ȺǞBt{!{} ez(t4&8O*t(r!uBuV麶ej2;)q[8ZcbhvXA3K;c7>Yun!-,i!s!E]ztNb,p?z3DgAR@o|FGCvS)|[rq7f b&EW Og+nPGޡDQ/Q 7.W{b @V6|쌿͝vխc#Ȱ`De 1EM[3J)Vm|@O=^dN)ڊo 'iCZ:V_''Xhhꅔ $dSPOℙq\Ь& :gi4摂t".˧pkdN-b'r\Ka%̔w>Ty(M°qemD8>,y⸟BH1ya*?G3J1({&&mW4G5rQ}uS=}~KyJ#DGt QyDy)@q.˫cX_gT{k\;N;3H+H>Ft3byKԴնe I:V y,EU[ĥ1n/(wpD]@FvNTk?|DD9ƒٝDSSY{ǐqGƌc,Uz6vM`E%Ug^cG7/L9yv\U-g^'Js8Dl .)a-x1 `Uʘqmoax~8M(U$<]= +۳rSR(0?6N 2y8a8,3 Ht.%qCWlSt,ױ`KhK-¥C0PЀfpO pL((, fdHV#`P(#= -.HMNJ с eڵ&jhEF|dpUpVm?}';"v(ɉ⏇{dX⹎q:@p=چ/i/!p4 `N4w_xLPp!v׻űWN|:GA #5tV@.MOO%#B|q吪8չC=)luسx,*|Oq5--{ vbĆaYQ1qJ4,U Ā Mb ܕ.Y{"J JǬy+d1N62NfGi>JM*x1pfK!3|3hQl.Ew]l0HAuG}BY5Fu<-!<G5<[ <鲮1G\U%mS5iʦ8eOeZBJ/2W[89 * ϐ1޼*/{J=H돏Aax_~N &f]Q+^ SVyY=\RQ3HI3Ihp:[[9Jq=Wqf~hѿ=P & ǁ= ~8@V_!i2Qo,/CM\jo[ % oje,~QFvE#Rk*\f+dXdÀ&-M|eVOA":}QBӤ|[A=S]EksGZY3 ;җ %s'[O^Ykx zyJi&Ѥ]~+0w.3R~-C.@)7zغ?sG?aV^x U.%8p.|-z !n~;洑h ,2I킧G13qCd3jB1pFAx(ʲ`Q^2uɇij̨Sn+ P*Ql@/: ' }~Aar1x1˱߳/41,8hԟTM8We!f3 P|v )nٹ聣 Rټ!\eq%ս=-R_У?u&t1NsРK&7[Qmpe RCW<{w m8 \򏳦 Hq ("@aXm#UYqՌ<^t'f]f,oefL?NS]ZsW"9W]Z#?Z<QJBdv& %. X_[0rM]l3 oX46᫞G/=R<qJ@lHQ卦/'hMbGV*SW1Y2=nVJF1հ9<_~v @ry"@|<$_!5K6pTu9z>8%vN`e&>^֧ٿ1kZ]mb1K_`e'Vٚ8)Df/ݑ@ȸw:Lp\n4=3l@Nj@mT]0}U\op\^ |,7)wR'R1wi):<*0h'G(xv9O`= )YN &^ }.*"RR-͐x'D$ARJqӭpPoH#cy<%$+轒U"?|×G&Vi|]Zm–O+ZJ|qV^Uͷ dm?~6;[ڂ9Jʗߞ鹯EHع8kH#kHj[o%s8&_,T,?>$;+-rCOog,y_A$Ctz|ʇ,1f+T ?K5$5;XbpDliYC)SWDï(4*Y)MUu097kF>6U|ޞ1Ae{q3BJʛ:Pg(F#=]pl !V?}ۿ7D,:Z;& IWU=ޘ X>p=JxϞYFvrYtN*eY2"Q^O&уV ѭ @*Wܑ3`YrkJ謎٠9Zn8D+0O= Fn|W9 )1'2bp]lquʗٜWLQJq6X h]pnɨ=.~. [4؟[F1i9ʏaOѿ<^}*  7$$(4ރT4SXi}u5iMVeBߚxqkÁ%S6&=Rw`4d[|EjHl@;v.׹ώot|i9-\ 1Xǐ>,٢RF&zÂkx*I^GI^vRn߭L`4Ww鉩tRPMgX"{8n!pi[{oU,y `/*3;F@BeUMOz4S}0Ј`k([Hdu@+ !pVc@[lY/jq.t^IƹZK"hueڃ6BrX98",_HGIUnƋzv-5Ʌx9"Ö Ino҂ RL iѩ˃9UY[;}j&HdfuuS? 4i):8# s-N #pg\Oi< cO5]ZB5 GvG؍B3`-cWNYt^߯g"Pjr?3A&mUF'ZsFmh 6FK 38Gp1Ɩ*v{T, Z.( uG.=/Ĥ捳 镸ٲ"9.f><F\2m73D6EP3k&)Mud,Fq ۻEYݶ{8C _=4qxx1qOW :"+jht[)YEj?TExw$U x f|0&{T xEWnMճԨ00;_([϶򴜻B iK7*쪡( HyT^uh;Lzϳ9ğ iD>.fj] l{SE8[/@(7/q]˕uO9Q'm\,R%O_a `Qw=. #E 0s(lӡ'b2 =, k7!+~i NE&w>hB'^2rAh|F: twt9R1f' ja'5g9)Z0$>]6ؠg!86BIR@MKa* nµ=z>ޏOzݲKFۆπF6^)~cԬ|&ʹh/I͇? UDh}0#.iKT)f;-^5gz}x۵YQہ\"c{N ԕtˁk2%nJ#ھYjVRmm||XB8^QL[ z"W5,ك%w|єvrhIܸ]AJfqxJ,fQ!@ƻS\*{iJur1 xf˻Ⱉ򨲲j/{(?Cb)M{kVzUR{W,_vICv:RV`cPHi#L׃뱜kU}W#يMYҨUݏ\Jۆڮzwc!}3zSW)o^TF,&ǠB3{ķXUt~xЈa9^{A!~wBCYSzl!& P+j _ Vr:k$SKUd%ڲ͟RVp3}[ s% n,3 =)bu >Ь)|߈ۆ4[e(c=mJ&26䧫D~ȗ @;[}ЩA瘣5{Jf虯>-M*gBo_Zc |?(|/TIYtKk+!'9bٔO]*+{vI(`avCǍ[Ac`[Y[$҄[Od."|pd1R& 8|I_<-cC#WٽGJr6Vk=Fz4O@LXĖvgǟ;ي]y:HQ)t0g$0o0Ax T2waAnV0[mdTԪ'@ئ6pAqJbN!{=`lDWü@_Džr}dZoאt=<*P-ċA9/;c0?Ri;قE/ ;ǐy-5; zDp< :o`:O nctU$ȴH" ;99\yR>x4PʀiƛSHC^Ji+yTo8΁hW'hd+_Ofd 8tsRGG[ 6S510@"T3 L2MF1J)f<&X^d@+bFa~^U{zNī3;pA Y >guaɓ! >q% |* Am4vNH&hឡB4 ԭږg!myeT]́#%2+SRbsWYDU5 O)aG$+`<$_K+E^8QY'~[urDs9?:?e7OxTvTiBK.\_쐛3u!v 5ʞI4\ec j їZ1x3gazD|>VtjF[_4ewL72p=@dMrL >ذn&-Gs2F5Hh)X;8Ϧ$~<{ i E,g`k"!H j ˟p4hH464iN_rd';=#(EC^l7lyH']HYi$rߧl ڦc&ӭHK/EMF7ވ_CEdk,`-l@dOat^d\K!P%=BTчM%DJ='#?x[0z"R߽hWzIJ"gtƌY"o𐝹#ȝ_L;Ħ 5tq&U#B{iXj)_/0);-S >D.@>|ک0b8KpCHk MvBӽx b=?[6 k]DA`MFBݧsToh$2bmB-xʀy0l"IVc]L*B59OI4DiC5P8C^P b8Zl¬׊,'g/3]t}9;?f|uB ZnW_M yju;>Rn]QaayF,@{9~P).uE&{]NLhd /$k|uR_YWZ5{S^?|JN}!bd)B񓯪9\ͩ7rSK_ۼz۵i+Aeu BEk{X'{Rs4J֟nj {pUL@GZ< R2:CQth5 ?wo<;!¤zi+\*uLΒq/p웉cCCX@iغYV3I@+QU toߠ/+-RINڃc9I=uc3S SiY,ȬvڞUT4x5^mRҍPύy~rK WMGi Zf`:]9iނGV Y|st1M,9rʥG.JmۉP^+g<*Jv 7 TX)cj9Qw5sZ*nM! v'"|m_T\Үh'e"VN~$`j}`ie&Au')cZNg ob>h&/_WTtV+g̥ZϏ|QeC+63.!R}hp IEk3^+1 h,Ц2>< Qiozu'(y /iA.t tp;Tfb*y$qxN?V yiOԷVD=7MQaaSPMh62#mtIn^0<_Wv0  4Cg1Wpm8nȈ[LG"qHw~eS;C6 ?qw .%\'(Lo*QW-OYvAՙcj{hI s+:Gn0L$K ^⩳{_uP-"0+W }.uW3"WYfm{2%JA4dٖGnM1F'}lΌKz_nZx IPYմՊ˦FbuY`}'IBrE,Ȫn` cw];LDg n(Qt3~V- _H,nՃn>T\:=T&&Vn^R&]p\BzaҗD3MF6Ph`9ZU9|!~_eMEYGUtJb^[oQRI4ffBah3SQ +rG1%I}JFH@^g0dxd,."+[!TAY8Z`o3!OTI'kRJ/۟^iy{%ޜ]p̏A`2rvw,E-|dXw?KQRЙ[i(0O$- YfP,nTwdQdo>ܨfy7hgV]4v#‡gpI 2=obdپ8g=Y| I^  }AܶcR_? ?U}ks} cOFPaCB`?_n8ؤ@$(si $QS: i`er4!""U_S F=o6Xt>k5Q0FiuA?8JFɐ(ZP6,$|Z`$ɓYKlA`}hOK/u7=c,; M"%OP_L(UR*tgRR1ƇJ˚|;ܙ)](qh˥'LX L*@Vo_3 B6ݠPXkt ^LfCW.Ŋ +{y`<& acLӸܩ3MVLa"$?nOݔ2vlK#'Z9v_}8؏_DUJsQtcQ&TLo6TƢ ߙPJ`_Jjr} Bzd+jʔӧb-1fEПqjG!5VRqi>qVPU]$9Q:1d h7uϕvUE}я̝/rDՙ,|9}l,Β(ag%vwL8R='vk>+?BEʊϐl"O[KFwe"%l(c9Gs] 3+yDCgAƁK6Z"aI95cn& 89r'۞^Ab&)B>Nrq#;&[w$0-ͤA;Nзjcc_lIDZث\ ל @+0MU,:.FGfA'yҌ:K q,ZÞ%mH/KT*%3ķ4gZS\UYb DW^~Rm3+^ =rs vP>BePaq5P8v@Qv Dٳ;ޏ K[9#T^Ww\LYaF3D^CӬpNM6OHU)31Lّ63d` TC C,3U*Mc<WW&di f= Y"(hZ[}LH=I#ecÞ#C3R3x7Hi#D㻨x4 N2s"XCbҦ"6pX[Kӳ[GpС/),*=Aόy45~emA|L8vr3 v;\5Өb :Ǜ<'>{LzNGk]٬qZf=}MSZ{rWϗDPI].XjM;<+%\"JܗEFJ=!ӶCKd$!ZEwѾErav71Fj\pc`&afq$OMQ%yiYP&V'ug!9X(bqOة(CP L "JY?Kvu}eB0Ew>cl0ß" dɔɫ3*“m}U%rQ[mf'')f=-=~SRAѐ L$ylƶa/"de[ C~ :)Nql3T6簧fp7XK{C:ÈUx{E)yZ1AjgaWH8Ap[~G|1T9WWTڇ2J,bE6}%WowoPV'ݾ-ezdȽՓ2,ŷx"_װ, mE|}KN/$L,'* 7&y'/Yo\%Eu}\5+Hy̰C2j<vPs^"ӄl@%sSd9e諾/418q+ϗU(\XҁLƋ[R^=v,7GKO|dr>-(6v Znnn`4ӤGY\r?&pbu nр!">(6bNW!Dت/S5ZUK!Fg"ʼ+B?STxomi,_ï8IeXXΉk%++4\c=|o0z',%Rz9> 1$IsYhH>ܼ]?+(F_bDΩ3}АAm_:IU>,f52<>SVf4+wKeD쳤w7h"oo"U 9'f} h kBȳ1ѤIEObdt 5|Yeiy#X3Z(u7uZv$`z +o?^iX1b+ɤ6vKŹZ5kŤ; ^9yd܀Ž<#G hjkiJaZ0{uorQQ˥6K<2G3pcVِϘaZhqV pn:L mw7,7!+>aYԻBS! FaSv`zU)Aћ|0z|Ռ{a_S+MRqB#:~dt` mE7} q ĵSꯇÍRlt%};R99;Z+NZ$Mߝmbpm=]K!yIԌYb=ȿ%.,NG"U]Ftosv@.گ()I;7 n8DHkn("- % o$"-yYZTW+ΟRYaΌŰ7ZrӠF.」9IFOKOpLpl]'  %0<ބxF4yu_2/hz%IVZN6luu33ɴxB9hv7(9;UV+>) @yC!ML` ;jl뚭ʇ =``m^4fd@̉ Bu++/QTZ HB{qIf M4g)w8Zw6؞[Qu6/28ύ}y#?_K68dwc)0\~BՃ4&, <@/gS?uC4rWKchV(.} þ㋱b IΈ욁Fv:dB^fjkri6<J˄lwU$vx+c12IeQJ' bL*W?jV΍.R;Al+\XZ${E3 pL1:zĸW<ר`(n^Ve/rFK!er Xs/m%>tyzZ[@-r\/vWp~t6yTƪwOB5G]^_cۉ,MQ&~=[*l48t@JκB焬fl$s= #5)PU8cϨlE64F o"D;k^:߈s'1 KꝎF<.3Yc^Zv{^s*HDt)a) a4zzRp7Tx2\U$.Tq.gU 0n4ss\U p0˟yt'o==LK=YWt|hX l 9bD}4!"($jU$5%x|KG$>KJ!1Yn'%Nw<5R1il>B 070u `◹Ⱥ w3MbA7uhDO06܂ >vʆF w]ahEJO!JV@'Xۑx;t 颁^Y r,xJpz7tWh=="3;u(}U/A5 k𨲑.owZ+ nfyq^uFyE7P0&Q]ᯢ]uw(΂>RJbnt9+ͫN{QyOD \[F-^ Ng>%#!BkOYs沓AW[%3~w0Wқg.v+~-ӱ> o? ?5T9b{ܖ>6}u o|³D&swBu<蛿*lmc=CSQeEr1-9 q8`R(hPD͏%tN-U_QlpQK}'vtj~Bq,#t5dj|I;[ `6:| |3bRۏӊ;ջT4T6p"*@39:XJ{0W0l엧՗?63hCvEz;>d@ȼfF3Kz5lIGt+Pn kNvR3ta:E}0M:4)_g︐RT-|EdljKD*6kwqi ʎ~/ww*ZCvO!;>>ҏq^(yThPܑ8wS>iKxS  OC\)%/51{Հ.ѕ=zZ%Qyh9 7@|(mԃ]/g"ߺ>!?>H#ZhiZ',?Oq蘕~( Qqj8{ӟLA ;^bX\l!)&%&//wL Ku cӃRRPkٱ m'komu5dL,,C,u8תCHhf9<9E}Ph\sʈ.)E'n^[/9.:_SeanHWUCiu;/x A؋|Xg01v8aO[åiP xl"e!@ ~|Mn+ "hه>rvǠ`<;jYI4>H@I:sށb3AA19Ҏ;X0:bJu5 ZAk΅鸭oCxW)w` ۛSBVʹE996eoNffs3sd;>z5w¯ Džs ϨSL+0K*cAmk:J< StAKsՓ!ÓW8/q%O%Hlhu2zR;%CRjP$Um@и{9@gOm^9 6 zEӑ;z5Wgwmg=en*%<wF!%ͫ2{g;кbE;wLxwH:^䠮? M nt_pjfNy /3X Ky)FA&[rh%Sx7_O]F`θۈk.'Zl2ΑKv_ ~yM&P 3#sUT#9DՉlP6y&dwui܀Gu¼x=!QV h̟ !Y5ړkCkD/G3X 5էrh@#=+`%!kϚ& dKS5֫v'n)ZQ!lkaNa#ܐ.6ΥN|DI)ABCtE3ŁUyFI/3"Z3 <%pQ~pdaSlwxXG4>SŮUWjR_ na!;2T'wnv7w&ga]TW-<l{;\C?">[M"61ѰDh!:30 ` E ҥ oB pHUL,Q,~Et^A(EG@+K\p>cGU9\a"PgIUcmֱ9}K*[rw~ZY#Sx }S躊0GmCKpc12L3bWK@5Y=yUc/ 2Y9GlF|dG8kizdΩ8 %{"BVrq6r Ԟ@s=Fp_:P .#u5ÄTp| []sWu2K^ 9pn^ ~ޙHr̝Ф/`co0VƶJ&Tr3#[z }T6Xcw"c:u z>}\vollG|E-Ī"fG\EqYYİsY[q"8 w#mu!+~Tؒ=d*S=t5M bv\?O]ˊH]#X9g&ODu)$J/ 4Ls~e^BOʶ0l,FqΚ@kf`qJT6mM{hvrNk#7&@PuG$LP{I7c `5EyHtk4̖qr'\|ÈcZ&@,c nB|A(*bm syQj$lN|?$d4ܙ7! #Հxߋ氀hzL 6e ?$P{ Qr~cMPݥo;F.)l8DL?4!f  $@Ӗ]w>FaˣB7!aJPm;-ec;36,e "CwI t Bk)2ؙۜW׻$qj^NFU*;M.xD/3{>}^{}jӟ|qlfgktgsHP~w %58i te5:qkNDr;x ;9~/Mj0@.,Sgr(GcY|!_vHM^H[ɱz3 ǀSnF3.9z05"W|sJ@OUa&ΩB_nP6K!ˊ`Xnۖ/;êm T|Y*bӝ2)+*&p@7#*An_CS$#<~n\T վyL# Xü zHpUW x7$c{_#3>7W 6p*ހlCm'$tL5Db ]>.ajf]hU鹆Vܱ`j[%M,=;L,joŀY iXc\jCL `É 9ܤ8q^O3K͓lǭbSZ h 6Vum=Bטp;4u#n}ܴT_ݖc ,.N!*)y5qAz +<]{J2z{<Vg>e9tN2C_Y(]?WhbYHɕF ؟U8nMfTx]\" K׏m}mG桭'f:PƠ0t`O#sG)srܤrPVzί1o;0RϦ̀ȫ%Ȍ*FUCw' W"MA8J\-fԽBsB[u C36PB oZɹb/yY ]$o E7[Cm}-Ϝpuw,:B_(pvKẄ3B?K)i٩->XfaU HY\եXgk\?1p'<ܹv 6h¦}uB x/H^ ʜ/9i0cezj<*5=Ksp,@e}Q+>.RzDhϮR)Ru`HΜ)N\3i:%Wm:.KݲawwV(VOgo`;p`}J'ȗH-3(Du8pSxoXt(a4? W?eYmo tC EsdCj*',6'UVU2rFي|zk.@%tl5Ksܭ B'ڝ0xXt0\hŠȵ9Pz&٦"s<fQ6TkeJè;@ O2F# I$N͉K+F6Y^EA0#L0: L՛2-Ey6$s*[Jk!9a $72YF@tZ2Baj_7#[pbWOI~"#)6XP0dF8 k:G1_60"퀊(c,- ]։GD0ghjT->;o%Qo.lLthXi< EoZo/{Ss'+c0c~2Rg'*ŻdV*U3oPP{H;\M,*My5<=UqtsabiW>ROkrPBA?07 k曛iQ HNi-:]~H*n`Q-_/=LN! i8*B Čr2P r`yM47JWF| APu[ $R#7X~j qb\5#fq?Җ߯ZvQ|kBѣgKUcRmwE_uS%MjeϣFG~.4,kMV1DڿkD nʦ;!U 6w)Ŭx*W+zcJNLTtrUb6nQR)mi.c9%Gioaor]C!~kA8[X~!g+nIBydiI&eb~ dp$P~CuGAFn7Hwb:Mh;\>ҮQ!C'~TQ8. oW% 81"Zv}^v f#vidgp{|&^9mkˢxQE[ҥ`ĬN>_?dKKHoEUQTl2oY,/"nk,X QTVU7zznR6ä86lɖ.gv_esxͼӱ?Ҟ%~ 9|aF_!nD:e C87;'d2] fYUޖ]^ʟoy)I`/Њg2q^cp *K$1U.J6.|YG}FSCk5JNY,Z*z5}}zDcG|_shbΕ!&AQ{0 lQr8^p"d^rt e"`'=  a35ı /Ĵ Q}]9?߱Kg' ļ:HԯLN9ƘcUx d.#%~jtG7NW-Pmyy3`9p`OHTdFVIQʀǛɿi)e.:t9,=qʲde{adSě^?/9݋g|eJe&=Tݥ(y>+61!}#/ \u(d9 0X#"MBܘ>)J&D_9J^xAh BoC?>@Xgj/jumȳEhn:5ZwRyzSbV.8gkfHRqe5muS2OvN7ﴂpȂ=X]O _ 3?Aܱ:i94K _..ll9CTIiv͋h(X^B\W[aeC6@ln4<礸e"jҮ=2Z2hՈTb@=;CJ2sl}B6_`rW?fTҞp7)"@x`)]LqUʍW'# `h+{5UpR(A+ōBAzycF>j3Z+l8,?c{s?D z~S(jB@srZT0r[.l^FܝHf#ҐE(+X et4;Es!8%p8p B_kO`dYfZ ))&4\o\>zqPɭn 4V\) „/Їh:Vο6H/r|Q:@z`q֞ ?(#\HVYf`# f_g>-3QZ:詭yh}˻Oh}}ͤ>F7w L:r9o6cՏ)Z%U3 i0TKl]ݮ٭}09т/^Ćsv,^k倾[._̰ɬOnJj sim,f`D~c^B`&Bذ2D~Q1E9_6\؀*txe(Ѧ>Jh ܵLPQ;i#nâ%+Ƈ QB,8 gqӲe,Կuxu^@oe] %?Bzv?wMkahOCbIJW3_BG HOUkLR;#@w~08|c%B mS]*2uy$`DM`N]^PÄ'=a^G5t W^hy.4nB ߹saNP$?pRr! p!A{Hrqq h|[b~c/h\꣯_ {K)U IyFvIP]-؂xag`,|g@7y}(r6J Hn욨L$_iNƔ{;*xN Uj&رAa7/O0*"j()9(KSJ }_C~(#]WmRj" l)zF>fXw >݀Y_E<9:PNr5O0ls|0a*h<8/q`iȰYdVDozZ4VOa!tm l9Z ߡq,ſC|z}USpv6.X;ՒX@SyBKz8۷(>N$^a(EZeZa7VcQ6\i "Kݿys1eA#{#GBbCxޅ|Z0VZTQ\V|PbvDCK@wQHqgQ rtQ#/]nW6yiㅞfAu9V ـ1ϹO3Ҋ&h3C#[~GWԭئ˙־0{^j!TaH93;?׶ ]c\1Ҿ(`e d`r^/u X]] H9`8\n+wᵽ:/{G"AYӡHJRudŀffF8pb?z]`ˋu-DBC`%(fwM@݇,g1vi'D;JC.nތsmm6LVGU#PQLmħE aB܃דV 9S|j"t826CM~K䭘X}oѴ7Š[!/+u:923//FS1toy9Azi,lrQIqm?IKGi/5>*ۍ=re ~ ]cf "Μq ҎmPu%.X/n< !Y $2cQ/x,;nVZSy}!Z &V1x'eB{7 QN`./Evm}01tYD}C{TP=O] ]\ݺ5U%cp+%"_cVJ.I^!z@ _2ԂA?`\\4:{"!9Zp_N[[%~gIǮ'ӝl9-t{u_$ X)Ĩ~V N6'߻nRP?H #مjn9~fȪ %'@n9#7u=_Yb CaIx%-Z+ud\Em"qը;'s<2f:۞yj+Ee?AQA~k<8أk*@KXqw"pnDD):L $Ac &[883?\[ޤ{丷C >ݏ,° BO?r.H^B҉| 2+9VȒTPk|V8 }H ;MUJCg*wCeM yǜ4("p#)|jyEM3O32-Ĭ4yiэlXb"ZzOFK(pv5P߹Iu=}p8 --e%^L~ZeP) u 'cLÜ=}#ϞjQoFWzٜ9<UcsHs)"IQ{weN[wdI$ԔتCJ6y]N& 8IY5^T/|MV513Ȧ(;^#/IHH0¦(MtTxi=g0}A5|Q>VԺ,&fR+x@aW+i]!GOR|@x+ Vh p-E9yᅖO0b yXy_gSvqZ=?, :a^Q-:Xs/)Jƪ]2 ,'qi5- AuVVc)=]D߷P}zA8/"8fP^uV0o>^(uz=*m1ҵW%)^LL@zhE6ODKדG?qг8"L© T Ahe:,0T0"Yj #!h-pj(%ly[/kA$!?[Vw+xԦG!Y_(GXyoijwN['!zw\Kr*"t lhnk]1m>`푪$q} Vf^! l4;2/j*) g{<ڗ, 2P=h( ]M /ɽƻJciFD'V;_6P uS L!eH<{vW)9B-+Y]q3&L3O5}IO9QDx!c$20gzFjfIlHKDJoM[m6S_+CWj&SQmTnW2i`8P֖#@=u0 Vvs-NK8Xys6HB[=f&q㯢%L<r!բkfVBo15j2I I]'2yIJ7?tKq\xrpf|޻ØE[@WHbRHA(5oy+h R.K 5l$R^s,CZ7F)/l9Lݙi^On)Oȩ/*Ќ&x.0xx$?vY|E n{vyANR[=iU $)G[U}WjFG-BOmyw yՅB<`цŜU($S7Q>}yKU돐EEWng< iglCζZe}!Ġδ-u\ru)  mjFIvs4`OTǘVͲk̏R{, _ybyR2JXNrΡr~Y1vf'c 3}C4d"|@^u~jӵSR\Cc9 EBdQ%!ňr],iߦ<:(1$QmSbnt9QT"sK="meJ6/֘.bazo%\<3#$ؓpQ"mwLI47u\N b/uԮXc/Psx%m(yzFkŚRiQ%HLҎ &s<0ZGuT  F2SRjp+0wl9{XCVƬ-XV}~q>` qe?M&] a>!]:oMLoLwm\~|XK\¶~x`EóYqh O|Ji ϵno2>3+?S`낞lƟ_h@\n#%3ƺO7<6Ks?W=LL\HtXߨQZ/3)#)ZxyW,yrF:\#͝7X/"({wѱBʫ U)R'%~zZPfqY D(˓6hh ޤ<&l7(!x8H[x^P1rRlWEJHqSWt)K~v}_Q\3y 1O#ԢE=5XZ$VE/8>^NhF?:EYnZP띗w ɬlY;[}!8c9OX :ޓ6ܧkJ,Rb`uGXFq?(؇dN]$ζ>2_"b@`mj$ꑽ3| a.t|Djǧ۸GK[%c1(φTcbu(r@Gv_֍hR1tMڋk WtS ܉X&MǢ/dT'Zw| Ghhokds2U[aqJi+Հf^&M7k -zyЯJ$fle)@A8WB?.anh5)+/Wv?kO_&kW"t{ZSZ^o30($E7iViBBO'gt")H!iR&(ZVڨcK(zEihVS070@lR̛:s“Xhd9D" .zњ3EX̩\x$v\Ϲ<2?.Re8sq)QxE#Ev 3jy~E^e=iYm*hmw6yz%>[bVNj)*>$8=j%(DKČ'V2+W|s) #ZQDԗ?VAԑ5T*omBCՍ?)3b I6Jqm'zE4%GSᲦ_J̣B H?=:&Â=Nhhd|Z_RW kbU%m0la:uUQ-*][69 6MXơ&Nᩗ=RS|X\\Nd,p/u,W_-]Sҁ5A( CܸfX̢"@>MU_dfiw_K8 Fr=$r| ɟ'Mh靟mTLj:UKd[R7)ёK0BK<r'Cʧ!;_98ޟFVpeT2bk 8a Wm樃ٝ#w kLբg0sT%M(t?YFvVڻZ^[x5M~SV=f#EHB6tL}U$JVV#a0F3M܊ u % yLgjc&u~o?TUAՖQFmpnd(#X&t"N%%o)~~2H+Iܝ$% 2/ !tKwݪo#Sm3 ,xY҈%2j'V ) 5pz^I"[mCWY!g}F"kaF~|.rơU /&|+MwէV74{H `5Da|: tE sNhc+)hڥ\Lkۢ:;(Q1}X&ZÉJ>RWʞ?(:kmy"?`;$|uٰz͛C9+@|nxIw[@*L S>e*Aԉ,]BڱGRf=0y)c_q{ 2 ?e;a:uQC1A6G@Yu𥤽j^1W92JdaGJ E9p#{t`)mkx{hixy)~^1?!)=8Ȇ?-/@-;(`b ˺>}{E٪4Dqܙrnʝdnjwx""|xWR|ћ$$/8hf|(FYhۑ:Ic?ajSW [TNsRb$O+HΧpk9?}XD+VCƶ.ù'7UBtD@E\witu2_Y. g oH!I} [E(uOy=&#fג=\@kOzo+>betX!30#x:jtQ Zۥ"**;VܖF*hO#vOuÆk 5쭿]f0Er >eHN4Ƥ.$@| ,3H3$#f[D>_$.r}ɨdT8|J4Ag*TEdĒ|&xGḼ04@0P0t.tYx7,n38jN)ySK~ ̮֨` P^IPQěR\,I0@|볐z]͠4|}zW+ x4aoM <b`Z_nim EL~KELz3D={8ϛ7 -jaeEGg;DTɥAWWSIQUhKՄqa?XnoAҜ8ÈC6m19ui־ ț?cU10K?x`ޔ{mgM#v:D<?ӳJ*]@UFهH4z(&Um="~|9DV VJ֥{.Mh289x*㽏9W9zJN[߿R*Q˼(ݱiyԜXr,I])pZ B %6T,n-s"Y͟sb&Ap7n.Oܒjr tSħlY%2j5hZrpezb% xkЏ}0˦yom-cu@KͿ Efdc^ w ˘H1͍lFZ+Ġo7FaDz鋧 e >x歾AmzdnKʖj[p9wrt se` (!:Ntb u:D]+W 233.D!5f:{|B`XCW#42#j5gva#9mP+)%nĮzE\!W d|+PȄ3!?38$Λsim׸cV?;9$IxݘeydH]埬9")QX !F+"Ƿ3<=t}ůK.fyH-zMg/[BϨDJdC5mp旽aoUz;Up/'Cpg#sD-x]mv%#^G*e_^\WV|MuBe`Ppznc!(D[@hy?푫7k%2p`ʺ;T3&/:ptO֒OxY<9@7cF :Cu]l#A˟o syK*%]PoENo'&R旒v)[.uv7t׋Yp2L~)miͺ屵X{+1ދvon/ǤkRhei]"&/ egvӜOs4X5-eǫ5M}2LAQ$C*7>? :va *~G܈z)" C.,Mvj&H. }&gørNr~ұiHGHV} HH%sq γLׂ2j 4f-Q=F.V9? uLefu4'0>&ҔM6£~'6h7D>QydT`T+ <~>E.S}zƘIIv탳Z3o>MݏTn r8Z zjpH29l'|i"A@+q!C+?:' qz@2A@sg+ԭ gE&ZK @W^fˌlU!B.r6[…5E`gʉ1"6^eqkq/1LH"(ETIŸ@˭!3&y8HgIV!ɐw5ԫ]d^^^spHj aL`PڠiSp]$i"4VQupYүL[&D12CU˿=cY\5p>?|!-NraqMgSxj0rY$ǼóOi%ר[UXEt%5X;}I&tEޡ~HDߢW ][1xТ|mUlPP3 %dNЍ7 %VV2Q.BWwQk{|Ll528^8k(~=?וO,*yIuηޛ~ho:D;/KzbZ|PYc$GQRA! 1MH &$"E>+Wv/q1}~`"-#DAH :798UF&4Zr<,"H&EFư~ EH wI/\_"o#Zw$L?L9C$.k pFٵj`"ԓᒿ=%qP$"%gjI2 lK|sׄvY 欭[3# T\o.r$i"pHC qX5U3nɺ|jmrՒ<6.62o1j5 zA[dgW.(>܋SCZazt G:|!* < 4  Ǘzo5py)S +W  :듷Ԫ%&T5U^X0,iTlkō e됟R V.5ldGqC>= |TR7'@ ^1Aր|*;c~ եwgTj7+ +=c?a|`u\8ڰ LH(,~\_L.-mi>i㷙$j;[by3щ; .a51NHƎcsK*"N"5\‚n,.!w]1)3ҀJv˷f +9 |iby 3ι-ӣCY *!AwR'fϋ2{!ˮ[σqhH@; I肨@ٯA' L/ ؀0?[ 42ڀ?ԕ0.Y`F\J(4-06#T5 d8V!G~sMY¾!U-m0IpׅEz՜ح8ىW׆B0c{yo]nt{^f#'2Ce>c(~lsŢezgbkP̓ xA8y0N./L:Ic|T]ʢn@(?^ dpm憛'2Mh )(CQK~jXa{ 7)0sE(vvw0iOիe V*bn# v ĸ_Sw* Ii9Rs{"w)׿uLz%@Gco=eBzK˵ʎ wEX5BAr f^BXMub D FJ^4 !8ɻ}jhW 햧_SˎR\(řFCbޕ^OtӨңxe)U3W5SϘ?0d|lK1R|4eYNn,EКq&::=3$ Ũshـh`NШr8>)ȨQ𼿯lx4Y9Y陏Nr}EJ*Z&WrC4+61vRk4L6EוVސ!Cݝ: o@;aAۃu8 7򊯮@**˟ʱN~bMH >AyiM/8y#z*G -/ܖp'e286AS޼,MDbT15 nŖMQܖu I%Ip[{ )E^o=#B5i$I 9(ǖRH)U\!Nt+@Uf}7B5FB4CbЧΎugr="E>*]qs-pYju\fKIygBƀJדvzlO |'N8boiJ5`W2b~>_o>غkv>7n`bS%IX4ExQgR.Q64ގ8|| H3ޑQ\xȠ$ y Bd'{gf)Eb6Bak5 sn-oָhɓMXvfQG!:EW\#&N &jJρ֯}: ($.b"{ 1 E#3]"Dw} [d"6RyUh׉b4GYR :nQC~6ܾNt,w*-yPPؕ1b!J̤FO"{*ޤߊM"e{ 4 5@@3\p=1)q|k-kEai~ͦߨ+nlMrd.N )UṈݯ0SąpYv1y7.y.U@je{#ujS&^I+%bM&ϘJY 67YR[]O(j8tYbo`PKSSe) hVz?|yX_GXuu<ʚz 30j QC#kqVY/9s'l.;dכYAs”aF9z G\'?IhCe5O,<">?S$؋3Ԍ=q U8:EGZqI"qFc>A AHAJZdőa,#&vCv78M_. ܬHrXVZ@;OeŅIDWQ&RlFPhr!KKxPZQZ (v)aD!:N-?zca: 2E4ГGZ"8\ȁ>9A=9ƾ6ݞ^c (Ԁطk,O8l\?T;_!` =8%'WCT[ˉH#Az(-s|zkFr{H䇓,dݕi&\2&Y>u2+,+=էMP~;:RiŴ:ToK?X:FDrt`;S"i |h%2Nro^vhӬ ߩr`%%NVlJˌW}C*tb[hBs8h HDC =bߧIcg IoìR3^EXg{J:t&J=:?Q{|z -}H8WUe̎6/}(`fjt:CM@q ʨ-fk;S+ 1>X碩xK)臲H5g'E} ~ Vt#s@O k]Qµo۰/(f)U Q8U+FܰDpAPi}Mp#e,\ 9"'_ YmuzfJM'Qz$뾀٨F̞uU,X i>]WDc/p!:5Mn  *Nް\ YZ