freeradius-server-libs-3.0.21-150200.3.12.1 >  A c5p9|"AaqqX >6/i7 _)}Zkl4ΠodrׯнV]jgP7؏*Xw qa`hjǯZ#BϬR[{=BzF(i`Gscqc ecrڸԤ[\<[+K0P`"ڍYݐ耞v볞%NHbdcd95c6fbf4f85d9922fc983a2884e678fa680fa03aa3e9e8b3fca232c2cae5459e25dd1342dac5054b1f5836c2d5c1385bb767c5p9|5D5'N@8mq8= LߠV@<y:[cK7dyխ!Ⱦ`NJu/.l!|}m.Δ?9A4Ϋߔ,|t8@%#lo8 /dGrrİBZCUb|}v <a}F'IF+ؓth.$5 >p>?d  . Hlp| !,L \ l   <dz(8(9H(: 1(FGHI<XDY\\]^;bcHdefluvwtxyz(8<BCfreeradius-server-libs3.0.21150200.3.12.1FreeRADIUS shared libraryThe FreeRADIUS shared libraries.cibs-arm-3 ZSUSE Linux Enterprise 15SUSE LLC GPL-2.0-only AND LGPL-2.1-onlyhttps://www.suse.com/System/Librarieshttp://www.freeradius.org/linuxaarch64  8 'F[AA큤cccccc^zM^zMeb8887ed1eb2c77d041d863063e7c001ab1ad4473bfc5dabc08489aab3a503887464c817aaabdbaafd3b4be4d6a6c2b1c5726e50a287075fd8a8505291822a902d839ef5afb3eb9b35359b7d9d398376909e21ab57124b37fac7e6591df064ff739e13ab687d1c6b4242fc89246f96a2bc27784cc7a0b9edb3861edc515e44568b9cc1e5d41938be45a368f126a6d1fda03d60a3d622dc75e776be4e90c2d2c6e6d6a009505e345fe949e1310334fcb0747f28dae2856759de102ab66b722cb4rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootfreeradius-server-3.0.21-150200.3.12.1.src.rpmfreeradius-server-libsfreeradius-server-libs(aarch-64)libfreeradius-dhcp.so()(64bit)libfreeradius-eap.so()(64bit)libfreeradius-radius.so()(64bit)libfreeradius-server.so()(64bit)@@@@@@@@@@@    ld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libcrypto.so.1.1()(64bit)libcrypto.so.1.1(OPENSSL_1_1_0)(64bit)libpcap.so.1()(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-15.2-14.14.1ct`@_@_FN^y@^p^h^@\\v{\u*@[<[2*ZZWQYY@YlY, @XO@X@X*Xh@X.@W@WiV@V.Vf@UĝU@U@UU8U7@TZ@TTT~@T|X@adam.majer@suse.deadam.majer@suse.deadam.majer@suse.deadam.majer@suse.deadam.majer@suse.deadam.majer@suse.deadam.majer@suse.dejcnengel@gmail.commichael@stroeder.comadam.majer@suse.demichael@stroeder.comadam.majer@suse.demichael@stroeder.commichael@stroeder.commichael@stroeder.comadam.majer@suse.devarkoly@suse.commichael@stroeder.comadam.majer@suse.demichael@stroeder.comkukuk@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demichael@stroeder.comjkeil@suse.demichael@stroeder.comjkeil@suse.dejkeil@suse.dejkeil@suse.demichael@stroeder.comvcizek@suse.commichael@stroeder.comtchvatal@suse.comvcizek@suse.comdimstar@opensuse.orgvcizek@suse.commeissner@suse.com- CVE-2022-41859.patch: fixes information leakage in EAP-PWD (bsc#1206204, CVE-2022-41859) - CVE-2022-41860.patch: fixes crash on unknown option in EAP-SIM (bsc#1206205, CVE-2022-41860) - CVE-2022-41861.patch: fixes crash on invalid abinary data (bsc#1206206, CVE-2022-41861)- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)- freeradius-server-radiusd-logrotate.patch: move logrotate options into specific parts for each log as "global" options will persist past and clobber global options in the main logrotate config (bsc#1180525)- freeradius-server-radiusd-logrotate.patch: fix permissions in logrotate global section (bsc#1170505, bsc#1174905)- update to 3.0.21 (jsc#SLE-11896) Feature Improvements * New stored procedure for allocating IPs with PostgreSQL Rates of 1500 IPs per second are now possible See raddb/mods-config/sql/ippool/postgresql/procedure.sql * Add SQL IP pool support for Microsoft SQL Server See raddb/mods-config/sql/ippool/mssql/ * Added RCNTEC dictionary. Closes #3168. * Added Pica8 dictionary. Closes #3179. * Add TLS-Client-Cert-Valid-Since attribute holding not Before date Patch from Boris Lytochkin. Fixes #3157. * Generate attributes containing unknown OIDs See raddb/sites-available/tls * Update the WiMAX dictionary. * Added ability to rlm_python(Python2) show a stacktrace from errors. #2979. * Add WiFi Alliance Policy OIDs. See raddb/certs/xpextensions * radmin now shows coa stats, too. * Sample schema extensions for summarizing data in SQL See mods-config/sql/main/*/process-radacct.sql * Update dictionary.aerohive, dictionary.fortinet, dictionary.arista and dictionary.erx. * Added VAS Experts dictionary. * Many updates to RPM and jenkins builds from Matthew Newton. * Added %C (time now in seconds) and %c (microsecond component of now) back-ported from the "master" branch. * Add reload capability to systemd unit file in Debian and RedHat. * Increase timestamp precision in postauth to maximum supported by each database and simplify (and make more consistent between drivers) the timestamps in SQL queries by using expansions. * Option to set dictionary path in raduat script. Bug Fixes * Various fixes found by PVS-Studio. * Set permissions of certificates in bootstrap shell script Fixes #3132. * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141. * Skip processing proxy reply if there are no home servers available. * Update SQLite IPPool queries. Fixes #3177 * rlm_sql_unixodbc fixes. Fixes #2822. * Fixes when building with LibreSSL. * Fix the rlm_python3 build. Note that this module is experimental. #3183. * The rlm_python should append the 'python_path' paths in 'sys.path'. It fixes the expected behavior to use the existing Python modules Fixes #3180. * Fix rlm_python to print the script errors properly. * Bound total query time for PostgreSQL. Fixes #3253. * Many fixes to Oracle sqlippool. It now does 500 IPs per second without any tuning. Fixes #3270. * Reference sqlippool by it's correct name. Fixes #3272. * Revert 3.0.20 patch which caused crashes on duplicate clients. * Update WiMAX-MSK attribute. Fixes #3280. * Fix crash when trying to access non-existant regex capture group. * Use timestamps (request or server) rather than SQL NOW() in accounting queries so that these are stable when replayed from a file buffer. - freeradius-python3_patches.patch: upstreamed- update to 3.0.20 (bsc#1146848) Feature Improvements * Added Force10 dictionary. * Update dictionary.hp with new attributes. #2690. * Update dictionary.aruba with new attributes. #2696. * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456) * Relax OpenSSL version checks, now that their API is both public, and stable. * Note that tls_min_version/tls_max_version also support "1.3" Since there is no standard yet for EAP with TLS 1.3, it will not work. * Added tripplite dictionary from #2760. * Switch to the async interface for rlm_sql_postgresql so that we can enforce query_timeout. * Added new LDAP option 'allow_dangling_group_ref'. * Updated documentation and functionality for EAP session caching See "cache" section of mods-available/eap. * Tighten systemd unit file security. Fixes #2637. * Disable TLS 1.0 and TLS 1.1 support in the default configuration We STRONGLY recommend doing this for all installations. * Add expansions for *outgoing* Radsec connections "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. Fixes #2839. * Add %{listen:tls} which returns "yes" or "no" for TLS or non-TLS connections. * Update dictionary.lancom with new attributes. #2847. * Added rlm_sql_mongo. See raddb/mods-available/sql. Note that this module is experimental. * Added more documentation in sites-available/robust-proxy-accounting. * sqlippool now re-allocates unexpired leases, to prevent IP pool exhaustion when clients perform multiple reauthentication attempts * Add support to radmin keep the history in ~/.radmin_history. * Add support for ENV and LD_PRELOAD in radiusd.conf. See the new ENV sub-section of radiusd.conf. * Update dictionary.aptilo. #3002. * Update dictionary.airespace. #3039. * Add sites-available/coa-relay, which makes CoA easier #3045. * Add example stored procedure for IP Pools in MySQL See mods-config/sql/ippool/mysql/procedure.sql * Update dictionary.dhcp dictionary with the recent hardware types. * Add experimental rlm_python3. This should largely work the same as rlm_python, which was Python2 only. * Add Dockerfiles for Debian10 and CentOS8. * Add RPM spec file compatibility for RHEL/CentOS 8. * Notes on certificate constraints. See raddb/certs/server.cnf. * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585. Bug Fixes * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627 * ERX-Acct-Request-Reason is "integer". Closes #2635. * Fix a slow memory leak in the file management code. * Try to fix file permissions if they get modified while the server is running * Fix slow memory leak with clients. * Fix request and connection timeouts in rlm_rest. * Fix systemd issues. * Fixes from clang analyzer. * Fix missing include for the dictionaries: alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn, audiocodes,avaya,bristol, columbia_university,freedhcp,garderos, infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus. * Fix internal sanity check when running with "-Xx". * Allow "inner-tunnel" virtual servers to work better with "accept" and "reject" policies. * Fix dictionary.huawei data types for Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address. * Framed-Interface-ID in postgresql/queries.conf is string, not inet Fixes #2817. * Fix rlm_cache to complain on unknown attributes in the "update" section of its configuration. * Add configure checks for -latomic. This helps on armel, mips and mipsel. Fixes #2828. * Add support to Oracle 19 and 18. Via #2857. * Add support for decoding tags in rlm_rest. Fixes #2848. * Use correct passwords when updating CRLs in raddb/certs/. * Properly separate "originate-coa" packets when accounting packets are read from the detail file reader. * Use the correct virtual server for pre/post-proxy. * radsqlrelay fixes backported from "master" branch * Fix DoS issues due to multithreaded BN_CTX access (bsc#1166847, CVE-2019-17185) - disable python2 for SLE15 and Factory - freeradius-server-enable-python3.patch: enable Python3 module - freeradius-python3_patches.patch: backport python3 fixes from upstream - freeradius-server-opensslversion.patch: updated- Enable memcached driver on SLE15- Add missing BuildRequire on samba-core-devel required for windbind support in rlm_mschap.- update to 3.0.19 (jira#SLE-5890) Feature improvements * Update dictionary.cisco * Update sqlippool to allow for stored procedures with PostgreSQL. This increases performance substantially. Patch from Nathan Ward. Fixes #2540. * Re-added "show client config" command to radmin. * Cleaned up mods-available/sql example so that it is easier to understand. * Added pfSense dictionary. Closes #2581 * Update dictionary.h3c Closes #2592 * Update elasticsearch/logstash config for v6.7.0. * EAP-PWD security fixes from Mathy Vanhoef. See http://freeradius.org/security/ (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664) Bug fixes * Update dynamic_client module and server core so that the functionality works. This has been broken since at least v2. * Fix crash in sqlippool due to escaping changes. Patch from Nathan Ward. Fixes #2532, #2533. * Fix systemd notify, watchdog and unit files. Fixes #2541, #2499. * Fix erroneous length check in EAP-FAST. * Update documentation to remove old "ignore_null" configuration. Fixes #2578. * Fix default POD port. Should be 3799. Fixes #2591 * Correctly encode vendor-specific "encrypted" attributes. Fixes #2600- reformat changelog mostly by wrapping lines - add missing bug numbers for security fixes- update to 3.0.18 * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss. * Do-Not-Respond policies can now be set in the "post-auth" section. * Encode / Decode ADSL Forum DHCP options. * Fix module ordering issues. e.g. when "sqlippool" needs "sql". See the "instantiate" section of radiusd.conf. * Add Big Switch dictionary. Fixes #2252. * Add sql_session_start policy (raddb/policy.d/accounting) This minimizes race conditions when using Simultaneous-Use (#2257). * For rlm_perl, all variables are now tainted by default. See raddb/mods-available/perl, and the "perl_flags" configuration item. This change should only affect people who are using variables in insecure ways. * Allow "sqlcounter" module to be listed in "post-auth". * Add support for IPv6 attributes in SQL. Fixes #2280 * The server is better at handling fail-over for outbound RadSec and TCP connections. Fixes #2284. * The server is now more aggressive about retrying failed outbound RadSec and TCP connections. Fixes #2284. * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list. * Add expansion for Radsec connections. "%{listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. * Add notes on running "ldapsearch" using the parameters from the LDAP module. * "ipaddr" attributes can now be cast to "integer" type attributes in an "update" section. * Move main thread queue to using atomic queues. This should help with contention in high load scenarios. * Add "recv_buff" setting to listeners. For more details, see sites-available/default. * The sqlippool module can now use attributes other than "Pool-Name" to assign IP pools. The "Pool-Name" attribute is still the default. * The "unpack" expansion can now unpack substrings. See mods-available/unpack for documentation and examples. * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE. * Allow for -LDAP-UserDN. See mods-available/ldap for more information. * Add sanitizing of control list for moonshot. Fixes #2318. * Update rlm_sql_mysql to be compatible with MySQL 8 Fixes https://bugs.launchpad.net/bugs/1795310. * Allow logging of only Access-Accept or Access-Reject messages See radiusd.conf, "auth_accept" and "auth_reject". * Removed Connect-Rate comparison. It was unused and broken. * Add dictionary.infinera. * Use OpenSSL HMAC functions instead of local ones. * Some SQL modules can now use "auto_escape" to escape unsafe strings See mods-config/sql/main/mysql/queries.conf. * Add wispr2date conversion in mods-available/date. * Implement dictionary-based handling in rlm_python. Fixes #2334 See mods-available/python for details. * Add support for SKIP LOCKED in sqlippool. This can improve performance by an order of magnitude or more. See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383 * Allow PSK and certificates at the same time Except for TLS 1.3 which does not support that. * Update docker scripts. Fixes #2306 Patch from Matthew Newton. * Add crypt xlat. * MySQL connections can now skip verifying the server certificate. Fixes #2481. See mods-available/sql. * Add better mechanism to detect MariaDB (Old MySQL). * Add RFC 7532 "bang path" support for realms Fixes #2492. * Update dictionary.ukerna documentation. Fixes #2493. * Add support for systemd service and watchdogs Fixes #2499. * Check for openss/rand.h, and allow building without OpenSSL engine. Patch from Eneas U de Queiroz Fixes #2517. * The default PosgtreSQL queries now use "ON CONFLICT" to better deal with issues. This requires PostgreSQL 9.5 or later. Please use a recent version of PostgreSQL, or edit the default queries to remove "ON CONFLICT". BUG FIXES * The session-state list is no longer cleaned in the inner-tunnel. This lets the outer Access-Reject section access session-state. * Fix typo in lock initialization for TLS sockets Found by Sergio NNX. * Add check for crash when home server down Fixes #2233. * Add username key for postauth table. * Better libpcap checks, when the header files or libraries are missing. Fixes #2245. * Allow building with old versions of OpenSSL Fixes #2247. * Allow non-FreeRADIUS State attributes to be used with the "session-state" list. i.e. State length != 16. * Be more aggressive about cleaning up zombie children when running in debug mode. * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries exporting LDAP API functions. * unlock files when asked to unlock them. * return error instead of asserting in map code. * Don't write 0 bytes to SSL. Fixes #2270. * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262. * Various dictionary cleanups and consistency checks Fixes #2281. * rlm_python has stronger thread locking to prevent reported issues. Performance may be affected. * Don't allow Message-Authenticator to overflow past the end of a large packet. * Fix crash in sqlippool when SQL server goes away Fixes #2300. * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303. * Fix crash with CoA packets/ Fixes #2304. * Fix crash in rlm_exec with CoA. Fixes #2328. * Print errors while parsing the log config, and don't quit when deprecated log settings are found. * Fix DHCP encoder xlat so that it can be used with a list of attributes. It previously only encoded the first member of the list, and now encodes all members. * The "expr" module now skips more whitespace. * Remove internal FreeRADIUS-Response-Delay attributes from attr_filter Access-Reject. * Don't send junk to redis when maximum args reached. * Small updates to IPv6 for accounting schema Fixes #2364. * Fix OpenDirectory integration in rlm_mschap. * Fix slow memory leak with dynamic clients. * Don't artificially truncate debug output for long strings. * Fix memory leak in EAP-PWD. * Fix crash in "hints" file with Fall-Through = yes. * Fix crash / timer issues with many CoA packets. * Fix attr_filter so that it does not treat vendor attributes of number 26 as Vendor-Specific. * Fix reconnect correctly in rlm_sql_mysql. * Fix rlm_cache to properly use Cache-TTL < 0 Fixes #2485. * Fix rare occurance of bad xlat expansion. * Check for rare race condition when a proxy reply arrives too late.- install license as %license instead of documentation- also fix ownership of /var/log/radius in systemd unit- update to 3.0.17 Feature Improvements * Add CURLOPT_CAINFO. Patch from Nicolas C #2167. * "stats home server" now supports "src IPADDR", to specify home server also by source IP. Fixes #2169. * Add Dockerfiles for a selection of common systems. * Increase number of permitted file descriptors, for systems with many home servers. * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs Patch from Isaac Boukris. Fixes #2205. * Update main READMEs. Patches from Matthew Newton. * Added dictionary.mimosa. Bug Fixes * Don't call post-proxy twice when proxying to a virtual server. Matthew Newton, #2161. * Use "raw" string value for shared secrets and dynamic clients It now parses strings with backslashes and "special characters" correctly. Fixes #2168. * Fix RuntimeDirectory for RedHat, from Alan Buxey. * Relax checks in 'if' parser from Isaac Bourkis. * Minor cleanups for %{debug_attr:&request} from Isaac Boukris. * Be more aggressive about cleaning up cached certificate attributes, due to deficiencies in OpenSSL. Reported by Nicolas Reich. * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall. * Fix double free in rlm_sql. Fixes #2180. * rlm_detail now writes empty Access-Accept packets. * rlm_python can now create tagged attributes. * Don't crash on duplicate realm + authhost / accthost * Allow partial certificate chain to trusted CA. Fixes #2162. * Treat SSL_read() returning zero as error. Fixes #2164. * detail writer now checks if the file was renamed or deleted. * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name. * RedHat Systemd updates. Fixes #2184. * Use correct API for State variable in rlm_securid. * Remove broken radclient option "-i". * Fix "users" file (and hints, etc). So that it does not get confused about entry ordering with multiple $INCLUDEs. * Fix rlm_sql to expand the un-escaped string, not the raw string. * Link default and inner-tunnel only if they exist. Fixes #2206. * Don't use both IP_PKTINFO and IP_SENDSRCADDR. * Always install signal handler for SIGINT (needed by Docker). * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs which are not self-signed will now be checked. * sqlippool now returns "fail" if it fails IP allocation. * Fix rlm_yubikey to look for correct attribute in replay attack check.- update to 3.0.16 Feature improvements * rlm_python now supports multiple lists. From #2031. * Add trust router re-keying. From #2007. * Add support for Samba / AD LDAP schema. See doc/schemas/ldap/samba/README.txt and doc/schemas/ldap/samba/ * Add "tls_min_version" and "tls_max_version" to EAP module for Debian OpenSSL issues. * Better documentation for client certificates in PEAP and TTLS: it usually doesn't work. Fixes #2068. * Distinguish login failure from AD unavailable. Fixes #2069. * Update RH spec files. Fixes #2070. * Run Post-Proxy-Type if all home servers are dead. Fixes #2072. * Print offending IP addresses when EAP sessions come from two upstream home servers, and rate-limit the messages. * Minor packaging updates. * Better documentation for rlm_rest. * EAP-FAST now has it's own "cipher_list", so that it is easier to configure. * EAP-FAST now forcibly disables TLS1.2, until such time as we implement the new keying mechanism from TLS1.2. * Add documentation for allow_expired_crl. * Update Debian logrotation. #2093 and #2101. * DHCP relay can now drop responses. #2095. * rlm_sqlippool can now assign Delegated-IPv6-Prefix. It also now can assign any IPv4 or IPv6 address. Based on patches from maximumG. #2094. See raddb/mods-available/sqlippool for changes. * radeapclient can now use EAP-SIM-Ki to dynamically create the necessary triplets. * Explain why many LDAP connections are closed. Fixes #1969. * Debian build / package issues fixed by Matthew Newton. * dictionary.patton updates from Brice Schaffner. Fixes #2137. * Added scripts to build "inner-server.pem", and updated mods-config/inner-eap and certs/README to match. * Added provisions for using an external CA. See raddb/certs/ * Include dhcpclient binary in freeradius-dhcp debian packge. Bug fixes * Bind the lifetime of program name and python path to the module FR-AD-002 (redone) * Pass correct statement length into sqlite3_prepare[_v2] FR-AD-003 (redone) * Allow 100-Continue responses with additional headers in rlm_rest. * fix corner case where detail files were not being locked correctly. * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group. Fixes #1947 * Clean up exfile code. Which should help to avoid issues with reading / writing 100's of detail files. * Fix build for winbind. Patch from Alex Clouter. * Fix checkrad for Mikrotik. Patch from Muchael Ducharme. * Fix home server stats lookup. Patch from Phil Mayers. * Add libjson-c3 as an optional dependency. * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking against NSS, which breaks the server. Fixes #2040. * rlm_python fixes. Fixes #2041 * Typos in "man" pages. Fixes #2045 * Expand "next" in %{%{...}:-%{...}}. Fixes #2048 * Don't add TLS attributes twice. Fixes #2050. * Fix memory allocation in rlm_rest. Fixes #2051. * Update trustrouter for new API. Fixes #2059. * Fix SQLite issues on FreeBSD. Fixes #2060 * Don't do debug logging of bad passwords. Fixes #2064. (bsc#1099802) * More graceful handling of "die" in rlm_perl. Fixes #2073. * Fix occasional crash when using cisco_accounting_username_bug = yes * EAP-FAST fixes from Isaac Boukris. [#2078], #2076, and #2082, #2126. * DHCP fixes, relay, #2092, add run-time check, #2028 * Decode multiple RADIUS packets at a time in highly loaded RadSec connections. Patch from Jan Tomasek. #2106. * TunnelPassword is not "single value" in LDAP schema. Fixes #2061. * sql log now opens the expanded filename, not the input one. This was a regression introduced in 3.0.15. * Remove unnecessary UNIQUE constrain in Oracle schemas. * Fix SSL thread and locking issues when modules also use SSL. Fixes #2125 and #2129. * Re-add dhcpclient "raw packet" changes. Patches from Nicolas Chaigne and Matthew Newton. Fixes #2155.- Fix permissions of radiusd.service (bnc#1053654)- bsc#1055679 - freeradius-server does not provide winbind/AD auth Added libwbclient-devel as buildrequires- update to 3.0.15 with security fixes for issues found via fuzzing by Guido Vranken (bsc#1049086) https://freeradius.org/security/fuzzer-2017.html * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret() * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63 * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax() * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp() * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions() * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly * FR-AD-002 (v3) String lifetime issues in rlm_python * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare- update to 3.0.14 (still FATE#322416) Feature improvements * Enforce TLS client certificate expiration on session resumption, and Session-Timeout. See CVE-2017-9148 (bnc#1041445) * Updated dictionary.cisco.vpn3000, dictionary.patton * Added dictionary.dellemc * Lowered the log output for failed PEAP sessions. * ALlow utc in rlm_date. * The internal OpenSSL session cache has been disabled. Please see mods-available/eap * Update detail reader documentation. * Make outgoing RadSec connections non-blocking. * Add SQL backing to Moonshot-*-TargetedId generation. Bug Fixes * radtest uses Cleartext-Password for EAP, not User-Password. * Update documentation for mods-enabled/ linking. * Enhanced checks for moonshot salt. * Allow session resumption for RadSec connections. * Update "huntgroups" file to note that port ranges are not supported * Fix OpenSSL permissions issues on default key files. * Certificates are not required when PSK is used. * Allow SubjectAltName as first extension in cert. * Fixed talloc issue with TLS session resumption. * "&Attr-26 := 0x01" now produces useful error messages. * Handle connection error in rlm_ldap_cacheable_groupobj. * Fix endian issues in DHCP. * Multiple minor fixes for Coverity complaints. * Handle unexpected regex. * Fix minor issues in dictionaries. * Fix typos and grammar. Patches from Alan Buxey. * Fix erroneous VP creation in rlm_preproces. * Fix MIB. Patch from Jeff Gehlbach. * Trust router updates from Alejandro Perez. * Allow build with LibreSSL. * Use correct packet for channel bindings. * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us a test license. Please see the git commit history for more info. * Fix incorrect length check in EAP-PWD. This may be exploitable. * Stop rotating session database files (radutmp, radwtmp) since these are not logfiles. - freeradius-server-radiusd-logrotate.patch: updated- removed obsolete freeradius-server-fix-cert-bootstrap.patch because recent /etc/raddb/certs/bootstrap simply works - update to 3.0.13 (still FATE#322416) Feature improvements * Add dictionary.rfc7930. Note that we do not implement the RFC. * Added 'cipher_server_preference' to mods-available/eap Patch from #1797. * OpenSSL 1.1.0 compatibility fixes. * rlm_perl: radiusd::xlat to evaluate xlat string within perl script * Allow authentication retry in winbind. Patch from Herwin Weststrate. See raddb/mods-available/mschap. * Added "recv-coa" method to rlm_rest. It behaves the same as "authorize". * Document Trust Router tr_port option. Patch from Stefan Paetow. * Update elasticsearch/logstash examples so that they work with elastic stack v5. Patch from Matthew Newton. * Print information about packets, replies, and contents in the detail file reader. * Update abfab-tr policy. Pull request #1893 from Stefan Paetow. * Reject packets which contain User-Password and EAP-Message. * Add example for filtering Access-Challenge. See sites-enabled/default. * Pull symlink fixes from v4.0.x. Fixes #1859. * Add systemd reload. Not everything is reloaded, but some is. Fixes #1662. * Better documentation for listen "ipaddr". Fixes #1921 * Add dictionary.cnergee, updated dictionary.nomadix. * radclient no longer needs -x to print statistics with -s. Bug fixes * Minor typos. Fixes #1763 * Fix typo in RPM build. Closes #1767. * rlm_mschap check for password expiry only if password was correct. Fixes #1762. * Update debian build. * update rlm_counter "man" page. Fixes #1775. * Remove erroneous assert. Fixes #1778. * fix mschap password change test. Fixes #1792. * Cleanup config file on data remove. Fixes #1795. * passwd module returns "notfound" if not found. * Check for old OpenSSL, and don't build rlm_eap_fast if it necessary. Fixes #1803 * Cleanup memory better after ldap version query. Patch from Aleksey Katargin. * Rename lt_* functions to avoid linker issues with libtool. Fixes #1277 * Many miscellaneous fixes and typos. * Allow long strings in %{%{foo} bar:-%{baz} blah". Fixes #1866 * Fix filtering operators, along with more documentation and more tests for them. * Fix OpenSSL fixes. Fixes #1876. * Finish SQL select queries even when SELECT returns no rows. Fixes #1879. * Set Module-Failure-Message for more EAP errors. * Correct typo in dictionary.rfc5580. Fixes #1882 * Remove obselete systemd syslog.target. * Client-Port-Balance load-balancing now uses client port. * Radrelay examples fixed from Alex Clouter. * Update systemd target. Pull request #1896. * Trim starting whitespace in xlat strings. * Get MySQL result lengths using normal API. * suid down after fchown(). Fixes #1914. * Fix cases of comparing pointer to NUL character. Fixes #1915. * OpenSSL v1.1 fixes. Pull request #1921. * Better Handle v4/v6 host names. Pull request #1919. * Remove "Auth-Type = System" from docs and examples. * Don't crash on malformed %{home_server}. Fixes #1922 * fix erroneous use of talloc destructor in rlm_eap * Issue trigger modules.sql.fail. Fixes #1923 * Document python_path gotcha's. Fixes #1845 * dlopen() the specific version of Python. Fixes #1592- Don't require insserv if we use systemd - Remove require for unused fillup- Merge changes from SLE to openSUSE (FATE#322416): * freeradius-server-radclient-init-error-buffer.patch - make sure we initialize error buffer. bsc#911886: radclient error free() invalid pointer * freeradius-server-opensslversion.patch: remove OpenSSL version check and assume we know what we are doing. (bnc#1013311) * merge .changes file, mostly. - do not attempt to detect "vulnerable" OpenSSL versions. SUSE security fixes do not necessarily bump version numbers as does upstream OpenSSL (bnc#1021375) - do not generate certificates in %post. End-user needs to do this manually. - keep FreeTDS disabled on SLE12 - we never shipped it enabled - require OpenSSL 1.0+ - use pkgconfig(systemd) instead of plain systemd as BuildRequires - don't list manual pages as %doc- Remove --with-pic which is for static libs only. - Use SUSE RPM group names. Trim filler words from description. - Do not hide errors from groupadd/useradd.- Add upstream keyring - 2 new modules: rlm_sql_freetds and rlm_eap_fast- update to 3.0.12 - still fate#320481 The focus of this release is stability. * Feature improvements + Add support for =~ and !~ in update sections. See "man unlang" + Add dictionary.checkpoint. + Simultaneous-Use prints out more information. + Print WARNING in debug mode when packets may be truncated. + Added expansions %{home_server:state} and %{home_server_pool:state}, which show the state of the server / pool. + Mark rlm_sql_freetds as stable. + Make rlm_perl less fragile. Patch from Herwin Weststrate. + Allow extended attributes to have "encrypt=2" + Update dictionary.aruba. + Add support for EAP-FAST. This is an isolated feature which does not affect anything else. + Update OpenSSL vulnerability list. Use a version of OpenSSL released after September 20, 2016. + EAP certificate verification is now done when "verify" is enabled and "ocsp" is disabled. + New dhcpclient and rlm_rad_counter man pages. + Minor abfab and moonshot additions. + Pass CFLAGS through from environment in RPM builds. Allows more custom builds. + Build with Heimdal in addtion to libkrb5. * Bug Fixes + Use correct typedef for older versions of sqlite. + Update mssql schema to add priority + don't complain on /dev/urandom in ldap + fix == operator in update sections + Don't create DHCP strings with many trailing zeros. + Allow MS-CHAP change passwords instead of complaining on large buffer. + Allow assignment or equality operator on SQL. + Update aclocal tests for FreeBSD 10. + Remove occasional hang in rlm_linelog. + Copy VSAs to inner tunnel for TTLS and PEAP. Fixes #1544 + A few minor bugfixes caught in v3.1.x cleanup, and back-ported to v3.0.x. + do_not_respond again works in post-proxy + Allow realm "~^.*$" {} and User-Name with no realm. + Fix leak when creating unknown attributes + Fix Debian / logrotate. + Make OpenSSL error functions thread-safe. + Fix crash with rlm_sql and updating SQL-User-Name. + Debian build updates. + Allow regular expression comparisons in radclient. + Fix memory leak on unknown attributes in detail file reader. + Update example paths in "man" pages when installing them + Build fixes for rlm_mschap. Fixes #1489. + BSD build fixes. Patch from issue #1583. + Be more careful about /lib/ when building. Fixes #1585. + Correct ifdef placement error. Fixes #1572. + Allow for more files in internal "exfile" API So it will be possible to open more than 64 "detail" files at the same time. + Remove support for statically built EAP modules. Fixes #1591. + Many fixes to rlm_python from Guillaume Pannatier. + Use correct week adjustment in SQLcounter. Fixes #1608 + Minor fixes to allow compilation without DHCP, VMPS, or TCP. + Fix checks for module / config file change on HUP. + Compile regex comparisons when sent via "debug condition". + Update filenames in documentation and examples. + Don't crash if SQL connection becomes unavailable. + Disallow originate_coa when proxy_requests = no. + Free rad_perlconf_hv in correct perl context. + Multiple fixes for Debian builds. #1510, among others. + Set OpenSSL FIPS compatibility flag when necessary. + Pulled fixes for the build system over from other branches. + Fix OCSP for RADIUS over TLS. + Fix skip_if_ocsp_ok behavior. + Better fixes for systems without closefrom() but which have /proc. + Minor build fixes back-ported from v4.0.x. + build --whout-ascend-binary. Fixes #1761. + Be more aggressive about not opening new connections in debug mode after CTRL-C. Address #1604.- use %{with} macro for conditional inclusions instead of hardcoding version numbers - improved package descriptions - fixed builds on SLE12 and SLE11SP4- removed installation of experimental module rlm_sqlhpwippool.so - update to 3.0.11 (fate#320481, bsc#961479, CVE-2015-8763, bsc#935573, CVE-2015-4680) * Changes of version 3.0.11 + Feature improvements - "unlang" comparisons of IP addresses to IP prefixes are now detected, and types automatically cast. - Allow shorthand form of ipv4prefix values e.g. 127/8. - Add "auto_chain" to raddb/mods-available/eap, tls subsection. This allows the disabling of OpenSSL auto-chaining of certificates. Which might be wrong. - Added printing of coa and disconnect stats (radmin). - radclient defaults to expecting Access-Accept responses to Status-Server. - Updated dictionary.lancom, dictionary.starent. - Portability fixes for Solaris. - More errors from ntlm_auth gets passed to MS-CHAP. - Update abfab-tr-idp virtual server. - Added "filter_password" in policy.d/filter. This removes embedded zero bytes in User-Password, for compatibility with broken clients. - The server now issues a WARNING message if duplicate configuration items are found. - TLS can skip the "verify" section if OCSP returns OK. See raddb/mods-available/eap, "skip_if_ocsp_ok". - Set TLS-OCSP-Cert-Valid = yes / no / skipped, which is the result from the OCSP check. - Interoperate with AD and "LmCompatibiltyLevel = 5", by always setting WBC_MSV1_0_ALLOW_MSVCHAPV2 for native winbind in rlm_mschap. - TTLS and PEAP now require "virtual_server" to be a real server. - Print WARNING when TTLS or PEAP identities are spoofed or not properly anonymized. See RFC 7542 for requirements. - Various rlm_python fixes from Herwin Weststrate. - Allow setting Response-Packet-Type in "Post-Proxy-Type Fail", which is useful when the home server does not respond. - elasticsearch updates from Matthew Newton + Bug Fixes - Fix issue where field nas_type would not be accessible via the %{client:} xlat, for clients loaded from SQL. - Fix compatiblity issues with OpenSSL 1.0.2. Ignore calls to msg_callback with 'pseudo' content types. - Data type "ipv4prefix" is parsed correctly. - Use correct talloc context in rlm_exec. Fixes #1338. - Complain in unlang if "else" is used with no previous "if" or "elsif". - Send accounting status packets to the accounting port. Fixes #1364. - Print out CFLAGS when doing "radiusd -Xxv" - Fixed bug with coa/acct stats value #1339. Based on patch from Jorge Pereira. - Fixes for LEAP proxying. Don't use LEAP! - Fix issue with "directory already exists" seen when doing "make install". - Fixed bug with radmin related to the option "stats detail " - Complain if the detail file reader does not have permission to read the "detail.work" file. Fixes #1398 - Fixed SoH. Attributes were not being copied to the virtual server. - Used a wrong list to global statistics in "stats". - Create EAP-PWD identity correctly. Prevents segfaults. - Dynamically validate authentication types for PEAP and EAP-MSCHAPv2. - Fix includes in installed headers. - OpenSSL 1.0.1f and 1.0.1g do NOT calculate TLS 1.2 keys correctly. See raddb/mods-available/eap, "disable_tlsv1_2" - Allow password change to work for MS-CHAP. This requires 'r=0', because password changes are not retries. - Fix home server fail-over for home servers using TCP and/or RadSec. - Special characters in expanded regexes are now escaped e.g. User-Name containing '.', and comparing /%{User-Name}/, the '.' will now be escaped. See src/tests/keywords/regex-escape. - Use correct authentication vector when sending Access-Reject replies for RadSec. - Set FreeRADIUS-Proxied-To in TTLS again. You should use the "inner-tunnel" virtual server, instead of relying on this attribute. - Fix debugging constants in rlm_perl. Patch from Herwin Weststrate. - Add samba-dev / samba4-dev to debian builds so that rlm_mschap can automatically use the new winbind API. - Automatically skip zero-length attributes when sending packets, instead of erroring out.- fix bsc#951404 * Rebuild of freeradius-server package fails * fix source url - ftp://ftp.freeradius.org/pub/freeradius/ + ftp://ftp.freeradius.org/pub/freeradius/old/- update to 3.0.10 * Changes of version 3.0.10 + Feature improvements - Do more optimization of unlang policies. This makes run-time a bit faster. - Re-name most of the functions in src/lib. Third-party module authors will have to do the same. - More documentation on contributing and how to write modules. - Update radiusd.service for systemd. - Open IPv6 proxy socket if the server is listening on IPV6 auth / acct / coa packets. - Create debian packages for DHCP. Fixes #1125. - Add more tests for "update" section parsing. - Update "man" pages. - Update attributes for Alcatel 7750 - Add dictionary for Boingo Wi-Fi - Add support for DHCP lease queries. See raddb/sites-available/dhcp - On HUP, check all modules for config files which have changed. And only re-load those modules. - Allow FreeRADIUS-Response-Delay(-USec) to be set for RADIUS packets. Patch from Herwin Weststrate. - Documentation fixes from Alan Buxey and Matthew Newton. - Update "logrotate" script. - Added more RFCs to doc/rfc for new standards implemented by FreeRADIUS. - Don't crash when doing "radmin -e "help hup". Patch from Matthew Newton. - The dictionary parser now does more sanity checks, which prevents run-time problems with invalid attributes. - Update debian packages. Patches from Christopher Hoskin. - Many other debian packaging fixes from Matthew Netwon and Herwin Weststrate. - Add "session-state" to Perl. Patch from Herwin Weststrate. + Bug Fixes - Fix rlm_files so that there are no collisions when loading 10's of 1000's of users. - Fix radclient to use our internal v4/v6 parsing functions. v6 addresses with ports now work correctly. - Fix sending/receiving packet messages to wrap v6 addresses in square brackets '[]'. - Check for sasl/sasl.h when building rlm_ldap, and disable SASL functionality if unavailable. - Fix issue which caused a non \0 terminated buffer to be assigned to attributes if the value being assigned contained an invalid escape sequence. - Fix deadlock when reconnecting connections in the connection pool. - Fix potential overrun in functions that used fr_utf8_char with a non nul terminated buffer. - Fix decoding issue for Tunnel-Password type attributes which were very long. Found by Denis Andzakovic. - Fix radclient issue with TCP sockets on FreeBSD. - The server now creates ${run_dir} and ${logdir} directories in daemon mode, when running as "root". - Handle tags when using maps. Fixes #1191. - Fix crash when CoA packets time out. - Fix parse error in rediswho - Fix regex support in SQL radcheck the "users" file and radsniff. - Register listen xlat earlier, so that it's available when the virtual servers are being parsed. - Parse Ascend-Data-Filter when given as "0x..." - Print Ascend-Data-Filter correctly. Add test cases for both. - Allow old-style clients again. They will be disallowed for 3.1.0 and following. - Complain instead of crash when "else" and "elsif" are in the wrong place. - Clean up memory more aggressively. This lowers the maximum memory used, most typically for TLS based EAP methods. - Prevent the server from unlinking the control socket of an already running instance. - Fallback to using the configured OCSP URL if one exists, and no URL is provided in the certificate. - Return CoA-NAK if proxying CoA fails. Based on patch from Jorge Pereira. - Lower peak memory usage by decreasing size of internal memory pools. - The control socket is now left in place if a second copy of the server is accidentally started. - Allow virtual attributes in "switch", "case", etc. Fixes [#1240] and #1265. - Many spell check / typo fixes in comments and example configuration files. - Better handle multiple DHCP listeners. - Don't print secrets for old-style realms. Fixes #1267. - Don't fall through in empty "case" statements. Fixes #1274. - Update EAP-TTLS so that MPPE keys are correctly calculated with TLSv1.2. - Always delete MS-MPPE-* from the TTLS inner tunnel. This allows TTLS / EAP-MSCHAPv2 to work. Fixes #1206. - Fix off by one error that caused some MSCHAP-Error messages to be sent without the password change version (V=3) and the textual message component (M=). - Always include C= V= and M= in MSCHAPv2 errors. RFC 2759 does not say that any of these fields are optional, and not including V= caused errors with wpa_supplicant. - Do not include M= in MSCHAPv1 errors. It's not supported.- Fix boo#912714: freeradius can't use ntlm_auth * Create winbind group * Add radiusd to winbind group- Remove gpg signature file * The gpg signature checking is broken and doesn't work- Fix bsc#935573: Insufficent CRL application for intermediate certificates * CVE-2015-4680 * freeradius-server-CVE-2015-4680.patch based on https://github.com/FreeRADIUS/freeradius-server/commit/a03814af310bb3bee74ea012546d99c48b0ea5c3- update to 3.0.9 * Changes of version 3.0.9 + Feature improvements - Make "pool" configurations more consistent, and update documentation for them. - Move connection pool logic to "most recently started", instead of MRU. This should help with pool stability. - More VSAs for 3GPP2 - Added examples of multi-value attributes to rlm_perl. - LDAP-Group and SQL-Group attributes are now dynamically allocated. - Only the "sql" module registers SQL-Group. Other instances register "instance-name-SQL-Group", similarly to "ldap". - Unknown attributes are now complained about more often when used in unlang statements. e.g. if (Foo-Bar == 3) used to be a string to string comparison. It is now a parse error. - Rename RLM_COMPONENT_* to MOD_* in the code. This makes many things easier. - Move to C99 initializers for modules. - Load modules in raddb/mods-enabled. This allows attributes like "LDAP-Group" to be used in the "files" module, without explicit ordering or listing in "instantiate". - Added 'bootstrap' section to modules. Third-party modules will need to be updated. - When adding clients from a DB, add them to a virtual server if that virtual server has a "listen" section. Otherwise, add the clients to the global list. - When reading dynamic clients from a file, don't expire them if the underlying file is unchanged. - Allow the server to originate CoA requests from the post-auth stage. - The server creates ${run_dir} and ${logdir} in daemon mode, if they do not already exist. - Add dictionary for Wi-Fi Alliance Hotspot 2.0. The server now supports all mandatory and optional attributes for this specification. - HUP now re-loads the configuration only if the files have changed. If all files are unchanged, HUP re-opens the log file, and does nothing else. - Much better debug messages for EAP-TLS, including which attributes are cached, and when they are retrieved. - Increase default max_requests to 16384. Memory is cheap now. - Added "stats memory" commands to radmin. Debug build only. - Aptilo controller dictionary updates. - SQL modules now use Acct-Unique-Session-Id everywhere. - The redis modules are now stable. - The LDAP module now supports SASL "interactive bind" method. This allows Kerberos based administrator and user binds. - DHCP code is now in libfreeradius-dhcp. - More DHCP encoding / decoding unit tests. - rlm_replicate can now be listed in the "accounting" section. - Better sqlite debugging output. - Remove "required" option from many sql_ippool directives. - Set default CA "basic constraints" to "critical". Fixes #1073 - Updates to help / man pages from Jorge Pereira. - Added more tests. + Bug Fixes - Be more careful about unused config item warnings when using -Xx. - Move more defines to be auto-generated. - Allow virtual servers in proxy fallback. - Allow %{module:} to work. - Don't crash in RadSec. Closes #980. - Return better errors when a unix group / user is not found. - Re-enable detail module "locking" parameter. - Don't crash when logging replies from Status-Server packets. - The couchbase module now uses "update" instead of "map", for consistent with the rest of the server. See raddb/mods-available/couchbase - Don't require NT-Password for MS-CHAP password changes. - Be a bit more careful about decrypting MS-CHAP-MPPE-Key attributes. Closes #1013. There is no perfect fix, tho. - Fix security issues with EAP-PWD. See http://freeradius.org/security.html#eap-pwd-2015 - Fix dynamic clients read from SQL in non-debug mode - MS-CHAP now allows retries (i.e. password change) when passwords are expired. - Allow "user=radiusd" when the server is already user "radiusd" - suid up/down works on non-Linux systems. This means that the control socket should have the correct ownership. - Fix issue which caused the server to sometimes have problems when a home server was marked zombie. - Fix format.pl because Perl is now more picky. - Fix proxy to Packet-Dst-IP-Address, so that it uses the correct destination port. - Fix corner case with cursor functions and removal. - OpenDirectory fixes and documentation. - Fix leaks in rlm_redis. - RFC 6929 "evs" attributes are now encoded / decoded properly. - Fix talloc pool leaks when receiving malformed or retransmitted Accounting/CoA requests. - Printed attributes again use double quotes instead of single quotes. - Set X509_V_FLAG_CRL_CHECK_ALL, and add "check_all_crl" to eap.conf. Fixes oCert CVE-2015-4680. - rlm_expr now errors out correctly on malformed attribute references instead of triggering an assert. - Make "break" work in "foreach" loops - Allow dynamic expansions to work again in the "hints" file. - Correct minor typos in comments and examples from Alan Buxy. - Re-urlencode the path portion of ldapi:// urls before passing it to ldap_initialise. - freeradius-server-rlm_sql_unixodbc-configure.patch removes hard-coded directory in configure script of rlm_sql_unixodbc - install new module rlm_sqlhpwippool.so- minor adjustments/cleanup of spec and changes- update to 3.0.8 * Changes of version 3.0.8 + Feature improvements - Allow syslog_severity to be set in rlm_linelog. - Allow defaults to be set for bulk clients in LDAP and couchbase. - Updates to dhcpclient. Patches from Nicolas C. - rlm_mschap now supports direct connections to winbind, which is faster than ntlm_auth. See raddb/mods-available/mschap. Patch from Matthew Newton. - Recommend /dev/urandom for TLS randomness, instead of ${certdir}/random - Allow TLSv1 to be disabled via "disable_tlsv1" in tls{}. - Allow Expanded EAP types where vendor is 0 (IETF) and type is normal EAP type. Supplicants sending Expanded EAP types like this are broken. - Add support for server side sort controls when searching for user objects in rlm_ldap. + Bug Fixes - Don't complain about "authorize" in "server {}" blocks, but only if there's no "server" block. - Fix cosmetic issue where debug from the first packet read by a detail reader thread would be emited during config parsing. - Fix ASSERT on truncated detail packets. - Don't use main server log functions from within panic_action, as in the case of syslog this would cause deadlocks if the fault was triggered from within a malloc. - Fix issue in "switch" when "correct_escapes = false". Fixes #911. - Fix sqlcounter configuration to use "%%b" instead of "%b", otherwise the new syntax validation will fail. - Allow forward references in configuration items. Modules aren't always loaded in a sane order. - Fix more escaping issues. Closes #912. - Decode MAC addresses correctly for VMPS. - Fix memory leak with TLS connections. - Fix state machine threading issues for conflicting packets. - Fix copy_request_to_tunnel issues for tagged attributes. - Allow "ok" to over-ride "updated" inside of Auth-Type sections. - Update state machine so that post-proxy is run though child threads for performance, instead of blocking the main thread. - Allow "netmask" to work again in client definitions. - Relax restrictions on SQL group queries. - track outgoing proxy sockets and clean them up more aggressively. - track proxy statistics, including CoA and Disconnect. - If radmin has a connection failure when running a command, it re-connects and runs the command again. - mark home servers "unknown" less aggressively. - Fix potential SEGV in PostgreSQL driver on error. - Fix issue where fields like nas_type would not be accessible via the %{client:} xlat, for dynamic clients. - Set default busy_timeout (of 200ms) in the sqlite driver, so writes don't cause selects to fail in multithreaded mode. This is user configurable, and may be increased if required. - Convert Password-With-Header attributes to binary (from hex or base64), in the authorize method of rlm_pap. - Fix invalid assert in state.c, that could cause abort in post-auth. - Fix double free when -m flag is used, and connection pools are referenced by multiple modules. - RADIUS over TLS accounting uses the same port as authentication. - Regularized return codes from radmin commands. - Fix RHEL spec file so it works correctly for Centos7 which uses systemd, and didn't like the SystemV init script. - radwho and radlast now have a -D option to load dictionaries - DHCP packets are no longer checked for duplicates. - Don't crash in sql module group comparisons in corner case. - Calculate MPPE keys correctly when using TLS 1.2. - Fix load-balance sections. Closes #945 - TLS certificates are available again in the post-auth section. They are not available for session resumption. - radclient encodes CHAP-Password properly when using -c Closes #955. - Fix issue in rlm_cache_memcached driver that caused variable length values to be truncated. - Fix track functionality in detail reader, so it no longer fails with a "Failed marking detail request as done: Bad file descriptor" error. - Actually add the peer identity (as User-Name) to the inner tunnel in EAP-PWD requests, so it's available for lookups. - Fixes to PostgreSQL queries. Patches from Santiago Gimeno. - new set of consolidated patch files: deleted: * freeradius-server-2.1.1-logrotate_su.patch * freeradius-server-2.1.6-rcradiusd.patch * freeradius-server-initscript-pidfile.patch * freeradius-server-radius-reload-logrotate.patch * freeradius-server-var_run.patch added: * freeradius-server-radiusd-logrotate.patch * freeradius-server-rcradiusd.patch * freeradius-server-tmpfiles.patch- Do not disable as-needed build - Remove the with_sysconfig switch and just stick with versions- update to 3.0.6 - fixes a segmentation fault in PEAP module (bnc#912588) Feature improvements: * radmin / raddebug conditional errors are printed to the output, instead of being discarded. * raddebug will exit if condition set with -c was invalid. * radmin auto-reconnects if the connection to the server has gone away. * rlm_cache now has submodule support. See raddb/mods-available/cache * New memcached driver for rlm_cache. See raddb/mods-available/cache * Add support for &Attribute-Name[*] in conditions. See "man unlang" for details. * Add &Attribute-Name[n] which gets the last instance of an attribute e.g. Module-Failure-Message[n]. * Allow for redundant string expansions. See the "instantiate" section of radiusd.conf. * When checking IP addresses in conditions, make the right side be parsed as an IP prefix. * Support JIT compilation of compiled regular expressions when built with libpcre. * Support named capture groups with "%{regex:}" when built with libpcre. * Increase regular expression capture groups from 8 to 32. * Emit error markers for badly formed regular expressions. * Allow 'm' flag to enable multiline mode in regular expressions. * Support limited implicit attribute conversion in update sections. * Support casting between IPv6 and IPv4 where the IPv6 address has the v4/v6 mapping prefix (::ffff:).- Drop .keyring and .sig file: freeradius-server still uses MD5 signatures, which are no longer validated/accepted by GPG 2.1.- update to 3.0.5 Some of the new features: * Allow LDAP to specify arbitrary attributes for dynamic clients. * Allow one level of backslashes (finally). See radiusd.conf, "correct_escapes" setting. * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. * Allow multiple new connections to be spawned simultaneously in the connection pool, to cope with spikes in traffic. * Use kqueue on systems which support it. This allows for better scaling when using many sockets. * Home server "response_window" can now take fractions of a second. See proxy.conf. * radmin now supports "show module status", as thee counterpart to "set module status" * "ipaddr" will now use v6 if no v4 address is present. You should use "ipv4addr" or "ipv6addr" to force v4/v6 addresses. * "client" sections will allow "ipaddr = 192.192.0/24". The old "netmask" is still accepted, but the new format is preferred. * Allow custom HTTP headers to be set for rlm_rest requests using control:REST-HTTP-Header (attributes consumed after use). * Extend format of %{rest:} expansion to allow HTTP method and POST data to be specified and urlquoting. * Add support for aliases in rlm_ldap. * Add support for connection pool sharing to all modules that use the connection pool (pool = ). * "tls" sections now have a "psk_query" configuration item, for dynamic queries to discover a key from a PSK identity. * Preliminary support for EAP channel bindings. * Foundational work for dynamic home servers. They do not yet work, but this is now only a matter of updating the "realm" module in a future release. * Support &attr[*] syntax to copy all instances of an attribute when used with the += operator in an update section. May be qualified with a tag. * The logintime and expiration modules can now be listed in the post-auth section. This makes some configurations simpler. * rlm_sqlippool is now IPV6 capable. Set "ipv6 = yes" to get Framed-IPv6-Prefix returned. The SQL queries have NOT been updated. Please submit patches. and numerous; bugfixes - remove gpg-offline - create /run/radiusd after install - drop freeradius-server-opensslversion.patch (upstream)- freeradius-server-opensslversion.patch: do not check the minor version of openssl, minor versions are supposed to be compatible. bnc#906682ibs-arm-3 16708474553.0.21-150200.3.12.13.0.21-150200.3.12.1freeradiuslibfreeradius-dhcp.solibfreeradius-eap.solibfreeradius-radius.solibfreeradius-server.sofreeradius-server-libsCOPYRIGHTLICENSE/usr/lib64//usr/lib64/freeradius//usr/share/licenses//usr/share/licenses/freeradius-server-libs/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:27107/SUSE_SLE-15-SP2_Update/ea436a6cecae00bf250af9f8b03f03e5-freeradius-server.SUSE_SLE-15-SP2_Updatecpioxz5aarch64-suse-linuxdirectoryELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, BuildID[sha1]=0d23314a318c6346f534c4c7e71687e29714134a, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, BuildID[sha1]=895fddd3e290455f8c0ad10c5b17b8f13cf976fc, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, BuildID[sha1]=1dc9d774806a591a1cc89285654318c7fdd64e62, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, BuildID[sha1]=23f2c585e95f24d6dad06670beac527440303ac0, strippedASCII text  PRRRRPRRRRPRRR RRRR RRRRPRRRRRRqaxdEutf-85a7f65ffc0fb1e45df6ac0f39ff447b7b3a0f70134f1ad1897f24854b3c8bb99? 7zXZ !t/] crt:bLL qE򀲌&ʆ-Օ/bJ[,%+@5+{rKA-crJ|y MV])R͹ب@Ӎ/ũ4utrCv}R08dA/u-V7uRgK\5æԅ k īZ!y;3t ;)Z\Uô_)q`*5W/ R 9р0۴OO,V{mS>z^kycjaI/R +@+Cj!kU?p7, 9,T<"./}6|, rK.U M E\6o1 `%'(82GL Wl4O-`%!rE2Z_S&`"zeY3Y:.Õ25u6ߐPV6;J ; 9-,NrT>鷻Vc+;?|.B_^8\v~6HbmDT4Gl\:ra=T^O)^lsG^f)!!try!w[zY n7\ ]StS 鐗aSnsAӪjV'gUnp4mJm! Е~f-:6u1ήM'}ҰM_ ZKn&p9@u),pfxMWOc~싃`z0pgAH 9Dž@NmζW{E$8*wu[nk̇0lw+Rk=Ԏ,{-!.;Z;Xp"i\(Prt+}9fe{Sӈi܁օ__r %m c;D9:b`ZP6JfT K)0RPu^cCp`D͊ غJה6/i>p躟LLLL?yk$R?yIޫDVQ+ ĂX{\]h P[F5,d(189}HɄ6FFסUٔi"VeFċ=5~B(|Uҗ>斖G,“T{HĘ-x{?U (3@:u YI! X?7hF>%lRf T5I_Pfuwq>#cV'hRȎWPD6SdI>55UV#InB -"ȟ6ʶpbƥVdZmMPR*'4^rswkg02Ũ2 VZITr:8_ G#%AJ8* =` e7uE:\>rEza[KI03*fDN݃b2^3_IQvhUm_3fZ>l tYfUĦ"Ƅ1!㏬l9bma!bW+)u2FX6:!?.<`T+}їhx0jidVΏ'v͋"g~^EFÄ&;D)66j@o&g¿ HS=GE#j6,߃`E!~JH+OJ?ʞ=H,ԏ&ؓ o8@aVru3aW[edN&`ڶ&ϭC7W>? UЇZ+J J:+z0a2hj,9_6pU ϨCjHmȠD^f(\`&m4 `;T&(6Є,/BÈ?:vkީ~їٽ <}:Y_eJG]==t9C:`Hί7oyJI@.vZ,t0uFfF0F?S"h@EX9'YIqbP;sD4=brGww{}ר廴ҩ 4h1%냅"+͜?-JS5> Öw ~9=~@YZ~?J)%m5ҷJoߦM'om>$1ZZD:F.0\5ꖬeZ' <(f{È:vF"x% !nZ.ٰ)rF:iuCW8 ۞F+!"Ξ: w:ZZIlI~^PENHk,5Ne7I=l$SXpk^u%aY/@#BϺ Dh}9~7(%$2A>ܝM; !_,P>WM4IT9i'J$wWmm1+l&LK?.{M^#ߞ'^ C3pJu4ls&~Ϸo"a1աVtG#pƪ*2QHҢ\͘˨#0p/$UƪçE_'kN iOr bM*=XJ Mv/Rj|eȼ%M1^x c`הGOߜw]w/;~CĵHN_1__CݠBpGt W=Npuh IqP"70,+:(B2)lȨ\qLhKvE}1o5}hS3 ~xuq8\I`QHP(?٫[DuJw*i EWEH̾bdx9.vkrtm.|~ "> d_}p(`aAq=KcwW9GI^XtLG`e<4o"6 j)fhEt OoΝEXu ր~I(5րdv'a'Cs9cʼ1э}WKj?dSx9.|շ4!8)SN9gRD C^bhP,(= m;iL蔰 ۬K;t^wWL &RVa@@ UuCe]YAC [F*=mKb߳ʷ|7c[{|pRmrY(h8pl=v/ij<%l[0q+@0mX,$ }R^[kWMdgfW)G ÊF8J2EgIqȖY\z(n}f2Gb(/qH G2_Px^p,Cq"+jB;ZPu11D`f*pPzT8"*v#Bb1OryrHg5Gt ˍwkR^a, 8@_ziU{7 Y2,Kt\Y,1d~0-OozV|}8/-n9=2vD.RwYϮC(_,J8K}4FJEϜwdnnWЖwLa} tsK u7!pH4'DyqO4۸ 7-s5Ih-h("+v>K)rByX^ǁm4F&b\QM;3 d}93L_(@)֐4TpJ/)3e歾Jb*"+x8*i/2RQ,|zt{%&|U0VMrIر/֧ᪧzʍZZ(sΫٱlN&W $k”G2]͢5F!3TD##h=d0t_HX _Ƨ nuM20a ʉ@2f%,xZ\ _҆wXoGA+R}*H0sgN⯚ửe&)`_7TL#FX0TЧZgD n+鞽W*V:_Î7>BP'm%)U=TEZ/@҄t_8 Fm(nSA"JdF=SAV(ԽdGehҞa ^B1J=z1vƲǡvv璧 B:cvϪٟ-^.<:3$hgY 5s<'6Qɩp?c\x3M\m%*-ګ@C2^Nӽc'l j 1lnMj.)\U^Vҟ,=:rp.51LuġFoAb7)AYca'*氕$^DE}ՓIevJ[tτ<2u8yb %͑鞰jѴ K3;[.v\Coc*OW8'3L%[-T2ʀ@?BPn "bDTml?܁FUelH$05WH w4̂<I /ei\…@~fYO .^8;gak_߾+Jy T+(`kUl3Yx'J1g@/ '/KW^ X-[i~SA[H?|z 1iHqyx[U#]tMvVƦ/[ 5=X^e1-#rtIlܽSQhF>_yfs{alۈp 5j|~H7hLSji$]H\riM[ӟ, jeBnI%~[ܗWG/F* }ѢBZ/:L;f`Lx. h&50B ,=dx K-m_Fqn;c P&td{~IijG1ޥ?( 96K|-D>78C;a+7ߖ2[áA"T^b. pJuũjDZYjeHQǩlWߜބ72_Z.O yǥ#y);5Vo :*$y>P2h H7gwfhDvrQ~c/3~s\?FyZocK |[J#!a\1M}U5eo>jT΋;{N&6~(ȻC\ZC8 g{VYY;-.t1YNZ:G}6vf3_>F@ڣe9~&c]m=@iJe1MESrcLߘ<*0Y9ϗ-9yM <jW BrR ڌsk Tx@Dѯ.)kSS5N|"hlt7A8lAT<]v#`R0WJ=hlc3gR|~c6Rklz7/VQe`$\1A.&YN'8a+up#O|DY|&:/!O(EMnܫoՎN/M')zi/JQhm tJEPǦ-a &иW-  @>26Ǩ?;s q>݀ d?I΂*[ VTR}ꬲ^3S쁘"UezriuD~@7A3Xy-ECU@[1IB!*'A@]Tp_e+bo}<x$E5u >Dv(T]bO Bo\'B/0tZ%pE}6$hl3SQR,eGzxX*[fܯ,KsduIZWxa Xy[kMKAMn4h+:'BBҐ$C>/Wkv"$;>evQn"^N׽WgyA ;зe!a%7s<{iG/Ժs [Zͷ |_>'(r'nUs1_"<~NtUܨ[ O*0ߚiXREg#DF0$=9B\E<8uL&^&7)$B.ݫطW4PwZ.85繘&4n Y}UEer'ė6(Z(x(W=+EX|^hS}Dzz +4EX[Ib@80~;O"Z_orlC3{e?kh̲ u~[~ݙVWj=R2a%SO>yjk#j1Ukʐ71núo,b3loqUm߮Ѱ醳Os ÖTjho.%}I6AG例][l~/Zb3NikfQel'۝elCgj^p{Xz0c}3XL y/p'Hs<#Ǥ}ECkZr`%{6dFBtiYsy>T @I~!t2Xy*| =ݫ*nhSޖ.U/^j$zLXnB|#!e3J(Π%:?nm3'.qw€ U3oRu{T`uz2^/()dްqɈA8ot7a41SX8 e':|yhk.=l)mnt;%u$;k'ï=gޒܲ\_hw.|98pUm#|a֠ܥ Xڐ:Br> yU%#ANkN|MxK o1Wc>ڣ\>Ȋ8v\q)2BqвZݏ9l;`Up5|-jbR:]ȉ|; Q̕xsE(Zi{ Us^x܏Ssc#˔5ݴEUO'enMt2Y͂]%`5銞5NNYT##i[uٻAxW{b:pھPAM NFU@HGYmx@dp@eG$T6/+W>PcSEZ cb+˂%u:*RianϮ@ުy،? hs59 \Vxzzd\4QIpӞ1lxNW|^yer'&^^6FOyCi-˧hEr[c=-[!0-=i(iJz35ً4TWOffs}vʷr! gf '2缣agGGrֆ=&6`SɖR@avpPeVf2{8K={6[t&$>a4G͒ lc#:a۳h(LX}YRTuHl !X% ? 0ŋ JR=[I;5hyEۺ:DVHO9ǤԵG~Η5nl2Zz|T]mM{ػ4m{['D8L]/EԺ‘yˇ/XPSovsIH@ͤ.N`Ѳ̥֨q]DžKrˎu黣6)_Eky˕A2F'tU}䋮swkbϞos$km}J5 4qĺeOgfH=b 9jf#JvTmêk>yr.ikU ι:s@l}?oݟf%xTc_S2A&+B6u^n:T-%iGBqӘps>!d0=-|.?X*6U7}խ yfF#NYw+AVX .<%+: R>ͳ'Ǣ 7I*y6IARXLi;еWV?5ƟNxMwxzSZ.>5%+i2g2&՘{_JVsLi#7dnoߢ+ yޛt̨/RNWҊr/xSB%Q%#<66j |Z6Ǧjvx3DEc3|3NQoɃj>uӎǝzv&Vӎ%=$( \y͊\˧#t,nT, thNIW#T_>l1̺^~F#@؆&OC\+j(mK-'$,b8| Pc!) )"SL x_q>Lpc6li8q5Mi<*v`j$"$w<8\ З*UlXWW1 1\@[|סh[0'd Mj( Dy<",to.|0$mF4N7zưda Aԟfˌ>t1i wneU'gS YӤ[BO~ 8miᾱP3*vҍ+QU= v&nnΰdLgm̻B\g2.>9F X;||%SO0Zk!-#hЗƅE,.[mҧ2i[OyO# Ȯp53r} F@=n> OCӞU?2d@3k_By#zWL E (:@7NgYqYUN{1Ǜd5)9rY/ԤM<&;YXW MqXXaWD;9[1L&VT" [fufgYLaBﴖ=j GwlTF(㆜/ab!AYc>C.5D}Slhq_%I[TOn%e?$HEBǜ)wjn;6Zw@/Ge='(32 59s!J9(UHD%g)Y𞋤ҦU:` +G6DPؚMGCTyǓAy@KQ"4<񋭎kUw";Z2TdL7u1NF7w 3cmMv8ڄ6Z/B7\Q^pekRD)"e(Z/ _󜱻j\*S++l/( jƐp֑jMg 6No5cB>ك %uת/hVI.\.%]YY8AgURe?T2K`^`()&tE: [<ߓX!B5YĎ٣Y0LDɔYol-zN(pPآ[2u*R-YW&H[ QwVsQ^v.R.2WWjIX"ׅtƐemk7=K5f<I!K++l@BE`WX 8XmW:=Y\po|sl KF ~(~i#9C]>( QuR]uGEf0jpO(*,0Z*G/P7},k\{nŒ MRݩm3{./ 3&!4\EEǼ6))# ^K"ʛ@Oip&2Ngס54;3D(H}s?$C4:nMX-4h/7Z쒆83D;M2)#ض֐̌6D[bU6(Cudˊ,`+pɥ*~mVv %4j~~DVV!N n[G|Íiq7_^Ɠ? BvF"1[ߒtͩ 4עOrU2hyʹfI&e4kVhGovkh #l_ZAPD=A5c:'s@W]eнT9rv]A;ӞqqB9ss)r!aS%fح6Y7;'"12eY8Y s5# M{1qHRX}8Hܟ՝NPiUN)!p{  `-IR$4zi?ՙBkoX9Poܪ/ց p[e_/|E21(Ž< ſ~pwtF*K>*ۇ|'q']wn=GԬ^ګs XF%rٕf6MB!s3Aw<,rN!鰝[%H8V g~`4/boe$_[ٹ*o66G뵠,+^RSV,V䌟-Z7Ix4VRĺйACʡZN3n記$%hkZ;W '8"ŭĭȱpzw 4AWfl˒VD&-N%-t7r)l0l#_TBjӝ3,7-H :qO3hd CDOY*#=U"4|Gn_Ksh- V@!ǒP6%Qtc0=mdZZX!cM,_FQ~y/^J]ː:*eyͭ\U%~˓Wm{jZ*~++ԀVA>+Axb[qQU&"TT̬ lx2oqsE0#S"eH\{IP ӈKa-++KҖi =RV0 >{ ԯ{jdU}V5 L$9!@ zp u@lo߄V$?)iXoZ^c$/]mx 0g'̊!> SݰcFi>tT(v1[cm喝@mP2w_BΛJEM^ (1T?Ujdv.GȈ~*gJ|FʉYSm4"kΓa׀HW6!;+L!gZo,Ֆ>z׉o+'CWY/!pI!6R_)߄ocktg(W_>>mD,D?~M@TU/]T0,)1;<ʳ Z95ŻYUdc̏J7Owo܇IyV*GGEX;ZE }1z'Ht]9d^*\z*m_] ͖D'6o822s;n8'H#Pe]YEWaM40 b' S$,4dzikh)#ƆI th']90uN2Uˌ_u{ݧ,FHy+ۡPXE>`VvDwۃ<^rb[oY8A{V}]4刕l/hYx,0ZDTIa( ʰV1B[S@w"*?+2T|Nw)o@}5O5M,y{+jmS3I/\]}K)?,PgƦm?hr  VI I½6{i3RnC.X kS௛0d\CP{R3UD* W.VAe K+|6X &`7ڬ{jzj']Dw¤ihaN`N_5-Ӷ3j4*h^\Ĕ$*[{£@ H fز1n%sI18|UwHR;֕z4ABs ?yϿ\z|gryҲ )P(!zQh):Σ}"n `^L/gʇs*i"=U /T#4MG@\ ۝ QU =b)(I4a!!sH>c#* @J8UHT/[-&9 A=8$RYg:OD+feۄ/ݲe,Fmi!+ˮ0=e]E/3ekn傇`󚀁t5RT)vZSЅQ8`1&ԛ^]OO>clg჌iS-S޺j\mQTz,MPDꙃALF?@]ՆJ0`:rwUlȆrEiSTKΐD7A.C|hɟ ` !ԛhv"LV$]q6 \㔖EɈ˔۶7o{*!|@%E\q9}g .-p=! ; M\ 7a +"z֎~: O%r6 OrԴh~dd:f3ލE?Ҏ$#㏒!'<ÜE>؊ю*x( +W:01( 9rQҬ/"INr7Kk+qvUNW&нId<915>-graU򿃐AʵF(ޟ!'#'-[7?3.pO#w[N%^&eRSe)19aw]NbT, Y6rq:0>7;}$h1)&u\B)599>RhIŋ-OK1`S#Hi%Ӡq'/Zs!Y?\El3g F6'K㲞D)7\CTJҲ>p垄r-_m0bz\ENK]^alEڵ.]eF#/8`HN%wߥYA290(>XK|eaڞۑJ0)0_fȪh;2B}3KZ(Davgpԃ{uOB]JG4 ,L fua\)K]^P{s {P,; ug=tP&tMOrW}9Z\ ֋ve*M-2%!y5~@ܧoփe?xtww>b/,cͤ Db7UrZ@ւca He-zzPیCp\'^.c9VD pjć%N \]t0ě.J~Ǯ xb2ޘ ~6JS?{ɠq \R>!_9R`FbHqTˊ|S/X`QP'&K}LsGA^e<8D36aI嘱>U-@Vٔ+ns+mG<-ނBzFn٤4݇A0x{S7hK7ZDۦx@LD>e=.gmB"Zn1!F}dh ; Ⱥё,ƎZ] zBXKdz *,@s?/=}1\ l)]eסfH޺Y{n>hZl'ya2}F $˂hޚ?4OYZE`WCBt1c KHc YQzX*P45Fʩ4l-JTUy4g~4u5|+DNKzte !W ^JRl lu<՘a;@cy]X; d=RyŶ_EI1Z_MkV4bƌN_cyx=S@oBIqmBba&XY!!؍#\K>t3\tǏxV&4H RW`%o2Qs rΨ,!^Sw H*/.s.zw-dȝ* 0_7j7 <͒[>6N!1 ]'6CfՐTQ,=qf٢hGIwa?+HmSiOo(PQ5PreQf`?SE;*4bC.Aٵsx6*4(cY*NXxs[b_^to)^ߢ@-Y,˨U20ù)H[}v,hIĘ/] `Oz.yD>s [ܿ ~s5WZ']U5 ^̺A#m%3/|֭д>lU;G?X|7-2%ov@)lI^x>ђoo JcND^l}UPuG\?O3; MUdrYwq\Zlou 4L<5Z.$ȳ0A9E86 XT!2n)k֔doelC j2y]f=!ù3E[ ]v!#[IٕxC5NDxěg(wwHxqma:ҠWZy]<{Jװb*:ӊzэ6nJ? ՟sͨos]W.GR}ruHXjfW69W!Fޥ.ySR:҈:TPar-COgkQ6PNì ۸81uJ&/ ܈To jԕ1aBZ^7T J"ni5 z2aXO^ɸEsPM}1B9UQ?Mf:Hi6(wA7hRYRT$LPّ g00`$EiM﶑erkXe@`4%ǸɥGDRMzްj]AVBIJu6q cHb:Z %Ek.w e[Fgb?Ķ>Xğ<]kXN!Y-mSZ&$iHAM;pAGE !bRO ҋڔ$)Df/SJVB$vu{ '\;ef~2*OYҖrwʼnK/ΟJXb`VSeAF$2(9̓ϗB !ij(\w&{qy`Rwa6`fHp.|bm=)3Mi/&cB- $Uׂ(A9 GZ m( j~bhλ7s.^$@7nGosdFB<ެ5I+]5_%߳e0ՈrsQ;0/eMjEO F.M7R8c52(ژB:ơyFl(C`]RkS0 WEH[UpOkHr S}iCk!iIK vp",x6^hP-NVc'hugFiB{QH HxrmLv*S:x@cbkA@^6 PrnZW0}<6 UqHFCKzI6ک Urvx+@J3qY SgGcp'(t޲=ZM>_9Y5Vjg7edlHbLMUЭO ) *^R#WO0+x8wc4Wa#>o+<:.(=6XY" $w2{aT:0LP4r>ef|^ /Y50W~B $ǻW~E/2kPՉU[<s潬- ymh X Uh' In<@zAQhW$63W v > n5X͌G"bYO * 7u[xآnWE,bT7H D!qQ_YBĎ+ H]nB\T4Ynɋ3Gal;4lCꁹ!93*~-s oʅO떂\sf#| #湳|k_׼(k UkUШ05)1߆Yp9%́&LۼEA(ٓeu0zi>v'Ic*%iNӊE1L]U!Qo+Y{!0BQykdۓ)gϫ * wp!Ê"|sicl@=R A^h%1F-ϼf5xW"JLUjLAvcto'Y^>LQNO&]kG5+bDe1(E84=l|9rm|6nn4H@rݛl)Q?%EPvI)|W̩'(Wzs99%e?\|Wwf#h͠zOu$XߎI9Er􂍞#ِ8Ohc S)c/l,yo|(*EXhxg VЋiIh5nMVV@(ZqLo%v&16hSQ ^ jC 2EiY~ڑ_]\ZC0hKϗbn辨ȥW*b r4Oa˗S9ܨ܀.c{MFRל|٨sDөR Wwt4n0ShlVuZN&*ӕBN)2N52!!LکG}AG $ΔKM)m^8|/'Zgf/Iܲ mDq؂ψhB?Kr(d]Ǒ|,K t^x2g;<(NP1i0x6c(1奬}c8m7-p>;2D1/d$얀?" @Ha?XX Rdb1BM:Ip5;z]aYQ]wv5` ǒ:߭^ztLj)9gYMJwEęHO;gT*eR_MC8⻎+jbEXeF&CҶT#L( kӓ&˶jA>OFNIk;P\B0lbris~{:<4;(u4ab4$t3c^~t^; Mi}&9 B"Pe{fy!rҔHƝم~4cIal[wP rs0~Ē4US5HX fa)`+cL3 .yܔc5  wLyMc.XQ>>}XT2?:/C5`Au!ZLdLD6[l_+iSL5]XXR u?صUpBȔ,vЈanBCzҪh"{­[B`)X I/ߍ ouqBx䳅OYI/=kQA\ t,5 !:͊/ (*Al\ͅP򤘣/}o7ۉ'9y6C|D :Uۡ? ᶫ2qXt$޷}ulohyP!Wz MnSf> R*EP9y'らA;&֛g3x?D?Elrlw]|1 viP;N2 nB+k$ݲ]OHKjtuDbhf'9etjlC=ƌQBip[9,`mu deAyij<]e|ZѹնTQP<2`QZUõh0LvҞ$I`xF5U;2:oѧ+sjZP.`.%CƏ+!8?3|䶖b|k?:TCݠVF:_ԧJN{UP4ȕcJ5™_f?Jb|\ZygnLyƶ]CFt J}( ]"8spB)ˆXlޫZLHԢonpJ@Q&)Dr fL"HZ,,z'XO>!2QSKs`*?~L`NI({$X?_D)HyWOC'.[Z*lTh;˜4FÖJm_jt!o8w)àI7 /Tj4#O^3s?C99 Lz ׼/a_56 _ 'qdY A?:E :%s9͝c9o:z`TV7B~Z phǀ~3KwxsđJe7L(E`‰&lb^gAkv$4H^?*4gP(4tLE81?;q 5A D<7iyKGH[H ,/lKZ_OSmI~$^F RCZY >Q1!P£Q-_'₶MiO&vEyաuz;MՕDGPZ 堣` M{9nn+W:m@:-^(QR 1v S d\wsvtI X-F6^A&1 ~&u{,)5-(}%j&D8U@H}ț} ~y. Zt!>KhiqNn*Ejl,ޒ}<Óz&Lq To (<8wJy!.xz [㬀XnD6UaJF'S37Ǣ8<lKRN#Y<.T}% YR#Zڟ(@`*BNH=n;+wS)/uWWSH3@onh$i;k9 -|wfg.ߟe^u3%r51fT[G!"#t&h$//m{Иİ':cOKiD_?lXZ~!`EqEIn۟o1,u ;*%ܜ4q\RiAua1MDeH+H8ܳR=|N s !UH(ܓIT0atn"o#zNK\׵Unt51v#lXqiO8@AȒhLuBsL|5Ϟ诨u@cUK*Yر dPIWy>ZyS?Kɝjn:q2Eʧ[&J]SC|?:xiRh=j fWph M䅭k$N'TW)߾ɐBԨR! qz$N] SCS -Vw.34Wz00pi-%0'`TJþd V7`6f<5;lMP\˖`ҞK{/?~< C{W']Y@& VPRĴAOݓAW|ݠmKn kͅx49`.|5PP ~{upD )g2ϴp~(61AHz&ܻDXخL,J!W.[\ ^i 6:F-6BjîѷT{к>C"0WChb 8G+LdƊqW]G[(W3yLQ8e&өWD'uƤUicL#Q}U@yȁ(nF7t`S? [PKX8)ΣF,9]Ca#.n#3J_J|bH.qז ~%| wpm+u@ v8 :Q O:%S|nD[7FM. 72Iɒ{j ~.0 exU 6"#wt,v9r3s~ {;.YKWrؽ֋/CAk՛*^y.ɼBΕf.~ԚlȜ).J1*PARWCմ(;K6Ns Y!Ey f>;އpDmMAB&3߯β^BTO.*QT2[ܛXcY֭8& wZ,=.1t?g\ȡ9hnpl.dv΍AAt4ҐET쾮 +*/0Q5&Ezr7dv;p9d·%@X>=pߓY.eH3xM:&hռf_'ak8IMh<`Jv'Ew}5dC]2/mPXSz21Zw[R7< rAl Zߎ-H=~;В 9@"Y-DL;EӪق% GKԎ&\y~k\ך}0R7vĩ6H8=JCj+t^OKMq PFvY-$m ZqоN.(lK kFJ喜knt)gx ЙE;,ƅ񔦆JT%`V!M\4d7_!}tͩ)2Ctg1m3w5ϋ$Tnت %7L:{B>[l|o?p`k^ˆw"ɽ~%Fa.5Ǐ\9rK(: Ot)-l,ƿ)x{Qۦ gM&`qyYHԐoklĂ  bq_%dGcx.6?Fm!P^8^xZH'(o`vzV[گ>VcF I#7XWF$Ɠ{yG5YTCrřRX*&cN?.R}9-lU}2Ak7(F@3Yȶʘ QM?[ICc3H>WBIKTRƳ]z}JznuHU[Sڝqpĵd)7 t^H]-kORzj x]ɉ_ӕ򌮷Mcؒ6Їz)~z.?WFu[zGOi: _ψg-TjjZ_H/vëΨ#sޟW8e]GLG Ɏ9Lȇd(`y]P2d*\+IPAK5], J>XRe$ХڑLUMeVt[Mt&-ڍ;AT;dH@-6Jsཀ#"̀(GoY sk42 K(CZ"ψ.$H92 O&vPQݳS3`I}S|Ls~xdح\:zdc(sfaiz/ 05;G.[DZTRsԫό:ņKOZbGI՗t0D`bs{5Ɯݐi} R ?caco($1 _mJ 4&j6ڸ8*ZCWG4TͰL{bo +O D؅ X,U~笝,aA]oU'?vPgOw< N,R5tmϚV:WlJ3TRR"Y.!1',V#xX%?~!! /XåB>") Bj}eZAWI rM>$l+Aj *+|KdbK<6| wb; {ax@r6E.bm pMG+Tc5_/m [aKEjN  稊)x]LUb;0sn s-ZqJVJ@mV37UG8أXlFXgM~./V[tf\f &%Fz 4qTV6OGGp"pTA"]!eV4Y&׭L㧷|]!nw)HY] "cc/)9J  O3kU<>6*8f1u'VJh2ud(jT[ffLDo U|:GVt@by Ly#d: 5iԘ=/0,u/՟znN~a8M0`3,8qw :$olJ^L[˽WF5IJo]Bє ɪQ Tb#; A8jZ<¹f|:ɸku%^ U8g=0q F6Ì"T\JUIK# >FW-E'6WL`ɚ@ G2Qa +z$u&Iꩱ0t|">a ,(rB[{^g6=8~(~"RLO{IF,z8p*3Px׎_lnBj %8x9rBtDb.ThZ}5u-+ 'dNPuU%n*Z6a&@ b|ZUR0 6Ch0'4GpڗpBQWI$,u( mלS+,<'_QO?PbIW81P&r n2(JbS`ma&nU yxsd%#&8\Yo"~Ã6sHk›H^w{R4*2EWB&HSR+ỏ\ga%m!P]qkIԸ&@ ^j0+KN<睊TW=\tkzQN:Mve1O(b4ŏOj=Q'ɆNɃwn>"ٽ Q {sGalK0b^1npAv~efoe}W]Z3-I }:rӈpu Μe\1oߘ\N4(cPb2쫎>`x$þ+$}vߢWfeⴔ ;nQyA{ .ϵUӏoOWxҮmB߁,{3]iQ?QǷ/2 YAB8ٟ+-h:)x Z^Ro@A-L7AwE;R:}%25*clwd0- cJeYjR,~岕RjiU9b*ovq́·7QJ9EϏӃ 1\9ec_Yah0 q͍4ȻPxH51uP\wA0B AKᕖVLVŲ@rP b#h{øWu!715B5huyx I `x{'d+Lmlav 4pps&ņkG o Q*&?N/T-K ͢;?ߤ{S+bCXv(?1kV}Liڡ،aW^^P9j;_mk')v-sdueo뷡i7{LYT{x^:Vp!Sp뀒+="a66KA阱颊\kĹG' AQ#$?M-&oR'V|ӎnpXMq q`GLA>!@lܼ+3]dxŐI0(R1Xڜ}m8fk/`+(RVM&n6h{W=D'`J^K|crBB|p(sH[KX!ƆԤ~+- ûղ2鐛"i`ktaϠjӍu]G"QB2+4mV>Ƅ4>{S,E' <>Q9}OpJ/W_7" C ~bl0eΆ ɢb+h WA?tƍPt}`HTk>,֭L c$) 0I9ப≳:h]?-&"*f(™n1־BG,L؋)|NuZgq{ff˭aa?2[2řO5d\7JbJe16,Ueࢮ XolZVZp.innv3#+anP-k[֏ 0 jԴ4ns|6YǞcG2JcM0/s:c[΀"ϫ֞=x?j砡a֢CeÑJuG {S;/}ECdDo馧y6T|9rϯ,#~ `P[s&tq\l$M6G0nG]772|+=9BGEAQ1 G_}MWۤ3p}`z~KѶTJcv8nu NtŖXx㦞jCݰTh5VXǕ gP ➦ mFLZvձ?BA-ę=ŭ|N8| i#[u*vEꈤF=R+gĽ F 'm!9=lSt98B=:ako",g2 !aF6hFQbmeN!8:|퐽 \?5-֒V1HsT>_wI%[HגL]gﴹ qz[̿)e朗T]=Y#m6FmStPkkdUg9(`6뫃e,Rԍ[`αH#,eќLY8?1fNu%0JxO ._>"#~8lL)NT˙fl7]~W삊k)Vf@ IBl;ƂmTvǼd%G\nu3k:ѷ'lX:s]gg'OKM ֞iB@oFBT`Ʈ6D/LPr$Rg`C'*!.hb c1 D ՛ lKS [T# S)CUM?J~cѣPVԁk4}Jn0 C+ǟh(!<W702E0LРQЎi=GwƤUf%Q5i Q#*td.wS1Hfq5q3;ٖ֙$=GcdEJ(M[% (E$fbE %_~U*Ưej%o泊XDZiAJ>8;Dlw6ڋd /b4lׄS1s`$ nZR$, szU?1k*Ď!'†2QTGfv]DJ2;LjArD KԩOyjxD*?5k>m/-1$dߜ{x"_OnbEAWoLo2Oϒu(?n'yaOmwpn1YrcG)K5F'6=*MiOqWunhU ,̰N W2a-Z} 9Z$xOHt 0[r(DN.Pa 5!JNjwĂ[Gsd1Ro(og<74aaT^t'LHZv 6f/ Ec,Xsi&|& ؠVdmO}?S;4'mze4Y_'AՄޣܢ ]ђDw y?`#HFitSHLzK0@9bLZ}Xﹲax5Ym8Ʃlhn,tfG!גMCj?fJvgU8A| |ƶTmLGr?mmV8z#"^q?c䒭 `Cc|Lm+Xc/g ֵ&EpA>~cV8&ٝ9֦+ :d<8~{JSSN $FJQ>73Lk7@Oۮ}sd!^u$igXBp?XK !X;-Գ"ԙc/ R'EJIJǫ2̤EwN z:?li/{yvJD$1#+ rO Yx=qu_;V R{ySP . !Vf|kO2:Q3%S[}Z-ZY!dfoO;8v;OUvHl§(1}+tB'cG8WZW"DP0e>kn-Y$xMoom n݄I*y2lHц}uÎv}삃Ii2'A0F5LϛK_nWC&O#.d:!@Z`C&1A$# pUƃ`M`r2p ,E%}HR{Ω(̮S|MLL]0MԻh~ Z&o[yl+ЗjKY,Mk9pQQ!8f$vN>•⺡(r]$M&BxLP2|XnЏ{4s}.7Xy:z8c@sJx:ÑuSk]H:Ee,6A6~ @HP)V:TbBʞB/~M% nŐʩOBZf':E7h2dzeR;&`; pzCpP:ߟeVdi$A7IG6؃PZX9֑"~By8tqUW%s7S-β˘@LG UVb4!M3  㳆; {1\K}ьɮ+q_*HA۝H}'(RkQ5F-^roQ7hxYft٭ԀV)P˻zj\V{n+M6NH]4:u!/7Ad _Pӧ9kκf+7udcP  *,N&*"oރ4$eý߻V°;ȁ# |ؘskp{zb <u {@PBɮXž.s%Z 5TG:E)>A5\RT=N3GeLw+ONRUůW YقP&AwyD6 㥃z M?l{ Ky[A˫o1dW[ \jmpG !.F1LjH5p;͛u{3o)9>d(ePl`f8Qr\cאQ/H75׆3php}&>@qS;]kݕ|擕N` OEo?f،_:f5~~kk4|H& =HK3iD֤3 %Z JN.('Q6fU/+*3☐ZPL֗e#h_e…T*$%wg4bstNi<x̞-RH%#_)0%*|2oJ0k9q3u  iVE t$Ps%HaB8kڜ`:O|ߢ;̄d!|Vֲ͸=UJ8SeR) KJkKqk N0;"}3_ALkH3k52wY?IFKr{>n{`*3RVɝZq*5Q]#>_`g%VbDKr)jgb=yJ@@W%wP4w-QJG*I`s)׶ƧS4 *03zG::|H16Yg(Шh^r* ğن."oW;eߖ鸐XOIFW0Lgm)=I~Jq慿6[Ayܐ l Zrtpe*=MW&U$lzM۠ O,"d&v2{>4d<sibRZW@3:{$uSrl!7;C|P63ΫiQlVJY~6' -2"q%/#v2u)_U#B PKQzcD(Zwo28^vlp P:34XtF ,.Wuĥgڪ{Nٖ3ŐAcT0JAD &c(P'HKBfLhjY(煑]V9]m(Kp/]Pﶏ6GaޣE3Jg\ Qsȃ"9cfqԆfI oo3Еhxe^'c %xņ߫H EM_=SݚlNmL(FEgHƦ;˘Vߝ04grnÊJV㰪DQ?_YȂ۫XH<Y?)Dso\H[*~Gf.ʪYBt gxIr|'e]#VM/O"F>:O_ǛrǮZQЉ(˜7]W[fd4 {aN ]1}җc^#UP3=3>ϞZ#!_{a H5ٚ+ J):ѨY-Յ/bjTĿ9j zB31P ! G;n'Ho㣲pi#(EWt@JOfWT)[`C t6@yARعm,.><'8As*Z'<&R`mdY=%V%H ;yBXzqЏNN ^mg/qI`M`4ei&-NRVi$62OzjC+%k[ЁnyO{zBtCz&i: ׈^K@}IgU׈$:A/'mpw =fX澖h]z:ENb/W"/Bs5@LEcq&RV&3N0U\߳, )UzgdѢw?ēIPz FxE-* }Ţ!<ǘ$M J*b:%dL2O=9ϳ; %)Y7gW1*LA14ZI0msg2ˑUυkVM׽ 'v W5??EvR~_C3k\D?||v6A@c>l@]Vn];1\.`+<,GM Q ;$Ůac#iӑõ: k'Uz;Ge&ʮjklhl/ #m$ X kf:&AͱN>| (v6!3ye`ʫ }B( SIMp&} |mwQpcz^o }? <%v+m :m)t|)BGȡwFpU#e(eye (lĿ|'8I{c^X^=3bOi&R9a kxv< Uydϵk M7\YЉ%@O]D1ʰuTX;e o!XTSďV|-Sva @̔j}KTc"ohIE9  lpk!\G3M/G ͏Zj#^EK[Gtf Ԍʜ,ή1@f1ZyZS z+xn0;A(nOɘ1;"%S¼g$DD&H,[J44׭=Hq?LoO " UmY||'3jSb4lJ wyYgcU[MMh guT0Qdi;aseW~11kU7Q;b{|o瀣ĬAʯ.XF݂{qqe,oY6mWǃ|5ฦ'?"yiLmN1K+>w9i֊Pn,IΧE9B)臉G; 8mDo8( i/! I)y`&!Z^đ#?c/tį^#R= tD4]~/eVSԥfo7z>31=G ߄criѕ^l'wNfVL̿LVi=;cE毮Vr3=isu Idj(ijRulQsotE~ 2UChhf<~N]^5VHDd &)$,gySR#V3l0o-Oi':L'#Wb)2E>6"m~ܖ@ԕ_쀐7 ^ ø!Wa.^^ʛEw8ŒU%*ᳩ%zxҐ|RQ6jϑZCk@Q0 xg!w{z]pjB1$YvRQN/6iI,;xxF4G_3x=7mI‘A37@? =(L t ]6"U>1dK'_'; $I[GeeFۘːԜ/H {7|*S -dUd2x3iL^^".N!p8uvwA!Њ)nDcJ56YGj?1~5IU% ;Pp2i$)C|~ ;Ȕ7t(( i2VD? 9Q؂TX9 s |$̵̩\_G^}*ckQxD߾xQi2 lY{:MuSH6S ݝ;i Ґ %i&\JѾ(SN5x'M,)42o%s+] u ߽V }t'kM\陉"}Cpg)D:IswR=u( o\o@IE:/ƛdc*r }aaGPL (طUj&!P -} ?ތF؎8tV&B}M1 8~'{``z#_"$I pnL 3pJ)pz$Tf,άfA+q>o/86S=eܲ+ˮ1sk ;tK١i L݁?!A},>CKl7J߻xY;I4n"%I҆}δ `␿|n;)?R.jM,K<Ưr(?vmj`F̆4Pq.7CIWMٰ{N^^ՑɈWDVJ=j3 oGY&ӈ~RLC-b^,j5d 8=zF<ӳGC?M!:鿉Zyjg=%A<5^QG,XsZ fXb=>"` #q}itmKz߃P3\eQdPS3ymQJZW1hd|#U@.Vr> 斲#[JS7Ӄ1cil3ҍwɊ2{K$<н-ҹqVPQ*s8|> *2SwNF1Dz.1iu+1L3-v˸ lȮ҈^.ZoO l'\ t vF} zW+-<.p̌.fm)6~? )&TXO1C[KL;̜V.XH]0@toǞ { 7s_fs0? <ŽX-2@! kk F Avv CpdQZ-΁͏ 9hNI Wέ.r9>l18oݵ^{5C&葭KC8 10K Ž@ 㠈 ed8,%Y1#B@Mi,f'XrUo,J07[ %fJ{`2fkf?SF˅<яB]䆖+Ӏ4>2h__ rD; y9k{2Jk]9h#QfG zFK%۩"U$_z9A~{ )ţ#NpD7BU2{c5l0Iir疌=}csRGKYD9en([); CuAX;"zwv9W*"2L.o5gՠ.4$lq*1 Q&CXEo[zDK\iPq~%L)?ijV8A|_Ƙc^ B4^^Fl W> k;PCrA-m㷴yM8 \JE`}j:+'Dp]t#!_" _A wZ~'Q*vdo_:qvMlKXL6^*X(T:Uu .IHFә::P %#cՁqsD(C+Mvzc]_`;viz9yaX_&m:ĿeTUyn^4 wg2@  #LV T1w.+ts#jbl*Ǔ-)z퐎ҋ8yFt `_A,t='IT]/PqmXCӷ[0~;CϚ=4#C¡d?I0sݠHu8*2o`vj"ʌu5W wJ@H1ڢYLXN5[M9i \ 4Kƺ;A,@+U!N 99q*sMuW4毠e]>]pĭou9' "˟o$7&kJmpm%6Lc0"nR~$QXI="V4^vTc>Ţz(O&R} 8,srI/y db)GJr}tP}ʔfK9'X6OF z)5و0mQ`d}g(#66Z6XW|6J~ Kɥ5QO\ě0 rgpzzybηHma`q2yACdIoj DAQ'ƒ}$XsKJ>A#L9>w8d4&:eg 'zKˍvBݶ<"\& 2Y/O> 2Rt(jXZqgUVjNGf֦&k~#7&JL"0p5%ip=P Oc﮶d_4c, =%RIzVۿ)R)WrF$XUjvӂtGz`Gʥ=<0_ P5UՒnOZ톻g6F(ғ'ឝ}c68żme t@򹥳HFefǹK6|]H?z$mred e`&-\-]8uQL3/t\W1]^z, 1!MA,2bY2#ŒÆ= ޶#]`]3Ot 0@^Vg8n?qhVP9*zEm!epqJzDw'}^z LW aJg0adu"*y|*?Q|"biǥgDJ+z)m+)"Hdikk"!jmo}>dTu-|׷Ove}eL|G9m`iETiޒG\:k2g~V۰8NT9E?Qɂ/nxikқ12a1eh5;xo۳Hk[7#槯b`+b %a-r,lt^1\oFjEtt'CI)Z Qi}Q`toh`T,~rARYJ\ؘt̏*E6zQ+-$p/\+DoYxFt_@6LܫJvMԓOy($ۮQ~ 7̀B!^T5m#bvzC(v>+PYUZWL'?'1x^8.fvs[8UW_LL7t9k?{QTeop}n@<Um44Ym{yPS~X$ [E6aB+V.\'b6̲L|ufdGx(T}뺝)`9/FqI+!{*EK4=[ P*z<7u-)v:E*tMRailL/=0|$^bn-Qψ[Bb~!TjF:yq>A)pL1h񃯱Z/ϐ<^>ytUTB?+5˵q&,=,glw2Jֻ1>PRh}G\+UcPWlo3 ~{Z67?^{#`۽?% okd0g'M4E: D͜ሻo%KKD X"q@Iݍ[%7~8Lrn#.950O eX:][Ekc>\_1LF%7K,0˕@c 9 QTIO[Ŵ ˦RB3-0;Tў-76id7fZ1?&zpcALJ0_EW$N2P/ͯPE)|`u` P_BPRW_VW*Ub*a;RWF|Rz[04)?yӸET=3چeD'8'b7(l qlQSa/B?"ٮU6 7i? ToTsuUxCTq#_q]%f_LrK\ff0I1Kw\:h-a"OH@OX官`U\3c~Q\93OC=k*vWX )%n , MRjOB؈bk gQUO-ɺ}(anP.jEybsDjMq*.5٫OuD^?*-ClYz\h>)L+s7ھe6bӆn9p*o(χqX+f܃h%ӰhQ~sVu7g!bLC^#5,d~_FSTQGAab%iP1D @xCL=1 \\3? z'bO+=c JE53SF"u-@ MN`YOHO˩? 'Ty%R$'6DmLV5 էK5ְJN[вSTw[KW(⢗Q-Y:B{ Xmi>AdLId@NtR1.GD&W]Vˬ"~e/x3;kJ6@M@\@HJ\S3QuꋘV+R05-7{.'5^p e j~6(tHy#eڥ>v E"BK',]?"H's޸CHٳe8Dl.AR6م:_H^<F`z5>R b#'z}KX?KwmlKv%SK4zyokap!/:eBLgO C]F, H󶍏=s >/MW?tDpGkrV{Sv]iK 𣤺ωT;o$7UiDy6u^7/QV%iJI&pSTc}tN8Fq]E4L\%?O_UFh'8MVxj7([ELu& 0ɦRȁ 3pIQlgmGlGdyz/v)1\grAwY",=\_~&Aƥt-u|m!g+%#=skQ@ԲƄJpvgtzHcQWP*\M9"ba*oj3B.ؠr9 5ssl}fuƅ$L5㦠.TrGg?E޴gR.:[wb nRT9uE΁/]E}+CmdM1X5S@lʈV0tmb)XG&ݝ[n9 1*A[Z FZR9{to*rsUb t rna,8ɬy|2}^,ߠ )J_ ()cElQY6&ٴر/ PK;W ȳfx? 7aN\?L㘎>CqH(b0pO)t@PwތC^k ?J:2cG,+Wdo+x~1տIS<3'UQ Aa5v(wzsi`9"i"-ˊlrGykC 3;Lcd7EFgIbrB,2&+=I%qX>rY]û3>DZ)9sHNN8͜r띋#|F_vm4)cu Zq:ef xGmI11j(4M y]SV ;#^xFݗ)LdىYlbd m9A"&Ew:@>* !%OIv#ݹu.?!Qi$\aY؁,2rW{GX F3h굞Es\WЄ92GH.Ogr3Lee]1LFP|~ O 0͉j/^hyTO,7Uܤ#ʥ;;إL$X:_YbUqGܙw|*lQo_>%K)A{ck ѝ9}[%}/MxBf VYʌLd8|_!% F1"l"൯5Cwg`m4 ϮjWZե0'<9nY3UWE4v/\PrVAW~ƋSN{s#  &xӳ8N5EU2 0?7CTtd>p/+yH$%#NrRW H[_ H?D/W3&}p]7 $e P`OH ve1Y$ ڥ.1~Y,˱C!2p1aB:(]e]^ʥЃǶbwzE_75(omgBj%e74PvG,%  cm1)_L%Ic@aDa-$fL^W9_蠨KL|7.l8)ol0#)qSp >zDz&nn2%؆gq/dR  yBj |WxJ3NZh3gCvamMN&b^^ V(k u)Jۆ@//ptEoT̃ymvp.EMKFJxYU-AVY͗ 5#mY1揺wi({YzD ׉zn2xA6xZ i9z{`MsYcl|l&N$?M~;3Pw(mwtZVpeͬ՛fq7Y@84U)>[:.;Xan j.|Ҙ:[݇&w&! hmՌ-{mIT6vI>ԚL8vG !0; -6҆b4Ѿ`Y)E@VyCwoL0wo@y@'sQW nd3L7ן`k@]BIme& ]7i/bŗ(u΀6_P$<`iGA=& :I)3YJ{p\ tu}O].],۽&E|Y<[3)||54Jn & [v+*!״L$gTWwWPrTVK^1ƖФAh6lv[.S NϟKj9}+Cy:yh77k'iW@*$ !d퇰`g'+Σ}X?@1K]0l]DVPTg"a N CfĆY@3=›11V/0r)]O}@Lw -{ +ͣ1^%GqcZE|%KIps5aR^F '{ j6OB'`.s3zu7% e?+'7Zjyw8Oy܁$dGPN ZeՠRD`6 .'m$ZMC6qTK#!d!s^a&`$70 ?p{ۏq=)]_녤)naP(H M#ˮuhLptww~`FʭA!bZDƮg]t4^} \5UԪ XVp gw ZO$>{UJʭTSg꣎NhS}r*|N׆ۇ!l@FO30m}:baM6獞5:m='Lq1ӰM)&["}琅>_!?s<(@'ҔXNکB3 &"YÌ҅BW>װG9}DX z`Z1Rlw]pZ87Al% 3!S{ j`tzFv " Po8i9bLJ;4)")P(SiKP>8vN#hAcڕq>OBU 8$F1fYǻ `O?rgY F:,b^!ugS371` ̜*F d37 70EA5@[TO~DOÆvԏu?5 kv4kc#?6{>,&}T/ڕ`>FG% J A7S8WT[48-Y/*950N+J^咈Y7&D|Z̃H 3kxٵߪtTe)ێ)w862ƩH{!',t~q_CC2-aZE .xeuCJePXi`tpѿ8 "Od:΅~u+QcB; 72@Ca^&%6wPՓ\<䘣-CZ gaI\N(."w2)ʷWT^hؓzyK*3FvޝW=9yYᆳ|(K802_08@,z#Vs'n߸N2Y8"ȱ|j(fϴ[XR"͎,{>QFXϻ!s},[ >gn!c8wH֢n$٥UmƸzղ¾V8Bq! *wy,IXfEPTXn\ej@6jx t %WxTXZGͿu—G%D~r:ͫ^YCu'xnwi2am"0WG=.vg:3>WcQSTzbqu(FФqmĔHA BHйΪ+E}P](ܑZE{1=7]>^2> P(%§1%:[Ff*CUNSڮ Y 95b+é~K>_B{bT[Dſ-IGs}IA G$h:O qB 1,,}}O*D0 EĢ^{ŮBE{) ֢)2krUݻYjenDŽxa!6Wv69-aѼdG.ȿǀcb/$ZVaTB.."0x1?iS 0O1IŝXZl40Hd8"޵ 9Up+#OLHT>i1ؖOIHW* ,rNޘ6yz%EJh%NQ~I&e?)?@ g8Q[;3Cjr:!z5nQA̭e %+w3+bW ~{= %]coH1%N>-U)PUSAl׀:1?syA޴@;Wabw.P0nv!ջfD<;JaN) IJHȂ|b.~%M֦ҞBĿ=xsoU؎[ycFoAt&'w!0v^ *Uj/:y%{ gQBoRq^&ߓ#D'~lxrB^ jSE]X:'mp/Qcf'`>M˗a)!N\ζPioӗ $ 7J]Š:io\'?p'<*갈j/|E6) ^*2 xv1nz䍎`&g~3x+"Bfh[o?/EIDzyjh;D݂_f53}#@^73DU*ɇ T׼\lV` O`ߤVu oc_BoV-mēXBގyMF jXvbIx  tQ_!Ic[>V.5A'k 7쉒Q4}2؛Ѣ2^EE2U2%ml3,5xM1pv" ڃj^I:&YbOjn.;)0hԼ<9|$@]Iϩ,{#%b@>Aohg~\?3.R8GTHUݽC+\EcK}Zq7\*ːeؚnDXx^Nggz,g ۳)@8@Px%uph3H 9a2֑`rlb]YҶYP%sbY1m3*JCb}J, ;K(~K9ay|E:Ʋvo9o?/ {%[ÏaPRK,ɲ"CZZ\ Q>{2jĤw^^xTjp3lʶ\;Zy/do!18< br?nO7.5*[} ݆U`N8ASrE2c 3$3OZcܵ ?m`6OKCe)iXj:T0xc~^%lgPdI`ҍEIocK9Rhxxh.=w}T0n^^!˷~Z0-K,]wIXQrXF0!YڬHNeljҏ=h -ľ/`bEBL@7RpwŞ+nxNbYߠb/3+nFrjӔ9$!K9 yp<"^|\#xaWs k'o" z}.eT;5l],=R 5wXrGf{과O{8nO'f, \Eae;߅V$"t!QX|x [ߣ~.cCG{, tZ#NuX6/ #1֑'C&xa1ޏv: +Qk'Q?s 0#n*3iw3믄^:5su]OǫR3 4PN5[<G,ߧ."9E3`#L >4 Ț^kuJ=܃7n7IzdeP)Cj%27 9Lq@-+z({v?ic#*-FE"S|O6 " ffH(DndkFB|Bޢĵu<@ O|,WHMVC]Ź(-ګ@Hs8ظb)قhC^ƨʫs>$"HƷ9Tv_D!ϠguBzR"E_ $xo=/~R/:+8mEvK^i{(ݝb:P*wNFg^p-]R%p'cI$Zʨ$#ë,e3i.#io4(Atq5"Hg|mG!t Q1xJͩ{lȚ~mG"A{rU۬3$\Cfi'h_Œxbr.( Zfhڨ}&ȓ-]`z=gWZKWk>7F.6貲%S`w6lQ4IbP ْ%GzѦ!7/wbHϾLj 8N;9Y'b=.[֐x|JRȁFʐ:~hC ,Xc7Xo# XYz,.1Y $aw0OCN\I :mp掆.JZ+xNY#Js6+;^$vS?aiXPҝA6[S+FŸ ࿯'q"͙}kG5\c#M60]{w+_\1']_;8ޓ-QivϏ63RH3 =2cEuu]Z/T=ӓO)9`oV[0P%(%C>yD ,p4`E輱y'rL]SDlYأwӞMX?K`4Y_츝^<_5[UegX ;Cj3Z%c,ög*8ff9M5A &a G~N;[1x뫮OԔ,TOk7gzi‰Qd%.D=S&q^f _j$%8~VpVxKɹ$M{'iخ\npIDzBZA_p {ĆG7~=Va`gU#nl@8[ >T%3z~4fٶQ&|cuф挏MHqHD%͞S>79ɐxfnr%qJ[Yv2o> u8S)Rw+fjyk1m 5|$hUGYѐ?/:x _]5&ݒ'\; iv7=mUq=2F)XǷ _]2- ېhI􌊈.h.yE0[ AQCCiŤ 'C="Ý, %5x̎1r\Ӵ >b1/Nyfv,㸤?HƷ?+@⇾joa?pegeVvxXLW?exW)w=?*B0nsgDr$^4B%q]TH$|Kro#w lF Zxccv`21_d蓻j9f%ls`]dEA`7 ͹P 4~VDY>+[hP¸HY]<18# 1M*$휞Aj|z_JBcg\eOjA؅O<'w7z[:E:-|{ >qcf6L5pT!nuLXXP>̃&U_ѹ Z ruFjQ~n[7s3oTݍ0 p{o{:ROGU`U߯ LR׌.Z/ 'ƒY)aPnun鐆݇W`&uB|!uVu>GXCUd pС=-%D-Qz O* ;fc .~/Aɏ$8'A6 ߒ]\}z=S\yYa/Fp|6xF9VTg{Vs7aVϲj`’6OصWUp1_f>Gi'wu'.l%Ћ)xJ,@x"*.;v:Hy]v^gө)_$ lUYdi'۷ ^ =eT5A3Zr]:Ÿ~)OYҵXw X&0Wd ZvWbS7 #/=m_ {NQhQe2p6wy͂3jٿn,V>AyK O>۞Хu2i:/T,BNfڐ̿Ar6$ ͅvr HLZN=K*rHx}e/r>f}Wױ/|c2hd/1O"}Q.X JT7{v1 b~|N[t$9|sii9cI<0Gy'kڽ;ZLOxɈjbaᙽca. !XСa*^?u^ݧ^M!d/xiSe(e_SZuH 8 =Csɀ6ἰH G) 1`-Z`v-WG=WS]/Hfq_FqWK8,˦i}h8O4]nO$[v=QطytߋԮeU%gB%>ַ?zGQ筪 6շ/zAMeCle2O<`>z ;Uh!t%ܥƙͧʞ](%vHҳGs&=5Ofrp0x }OЍ*MzTA[<:/B_ y0IO]uۚ<J;aꬺݣCղT )"$wQ+v>(LТ!`aSokd؇:Axi$Y!tiy2Ey 2Pݜ&xİGLMTpcV@0z B/buHp9mhCnKJ9SX7H&"1 d)_R$#N;}'j?WU唗5ٌ Blnt9>F,[&_=pJ{[n*vOʨK6o׺a1W+*;8lI.= `j4EH;s$)억Ԥ~KB`rFK^ *cVԼ_669/)y4e ꑷ6aMI7/J65ޣ)hJg;)ϩf!ԐtZ +N^ HP.[J(!cmQȕgAQ6@ܟY-ZcJ;!0ԛ,ݭwàSFh3w Z7 @zmt{2w`kTFX GjGtZ&n5>@L2hx [)})bޔw*!Mզvr>,s`m1րk HJ|d»"'s^kPd#S)IuTFpjrɎv| y$;o+l[nbkDw@60_}xkXJM OҸYn{je~gO|z(nf|ej\徤Z[cNzrkK_\)MR3 eKseJ1؛"ۋws/; ,&hd[|NCfV&3;9t&fuCbgx/eh/P~:tl=Pw f\!""I܁pR͓\d)Ҋ|h0EFj,4ٸDs弛1gu[-]`sV=Y2Ь͆]@{{jY&-5rsDkjWl , UMWsUKAֻ #x[C)6eCX ΩH\n̺h9AQ gM=2_w-:cV'2?a`ԗ{OaIw9ptu{5JC̱0:u_֯YR~Uw@(6d72i?g* |L{yGGFAU67slt  䶵wMî( Oc!AԶ:]z$YD%\5[Q:62:.u?Z ~HC*i7yBOmFdV1QXxSWME>哗|TE(hrlu͸ a͎o7lRR7P)!kr اf%# gA]~wuX?rޚiނPrB5msφ(P+0󢝞JV(OLIb}_GS;0~Xt)}H]*T˶?qO`y}⹬lu@9h{qL1읃k^U[ Pu=E>MHF\ŤW|( nHe[6E,;*A(#Gm M%Lzvsx>1"(U4]pU18g[,S5`($_b7R:z əjΈ]e8cz<;Ф[[[?fn&s/n|c.sg'x7a1T5b(3n4bCB~qeHM<玬wbx&;hj9qSI›۷2֜]5.A=1~Uq_ െz )؆OWWcNZ`yvSXJr"<%g x X'[VI(']]wHVհDñ7V*wݮǪbG:׭+ښjȵ ŝγx,]h( RgJ88%wïgn<fXE9lBW >6.Rn-pKǾUξƥ",ao%Hkz735?t0BqZ9FW`ɝu[?ítlI"(|?CA Ɉ3kCKo!i,L>!K[,1w$ܙ#u2S3{ y1 ?"}Gχ\;H (JՉ^DF P(WMokJ;m7Y+{ $Y*h}0aKG:†u>j^ pے^ ݍӱ 6v`p`k0hw]*ʻ5HRY9s^VtZh}_E9#*nқ.Ui_AsX3DYl?2J(}PHG-K~J>E DD&ۚܛL7DuM) 6NP9 ScF:e>+ 2J>,"W@+%'UAb;pP|+шS^DWF9]jTSi!d9>Т}^`$y[(m! |m]{}i9X̷nBJSw7j21 xĠ;gj@Qˣ5܄"H.}tz*}jp$LAJʃp)L!nm0 `n"OK,kTSCp"ۀI}0R(8pj,=.Y]K1̐J%YuK>n*ZRwaEkUMi1E)WY1@~B+Kr"A(:o&ϼKg^݈zkL%9eo<*=O_W7.| Cr80-È7י%sM&2Q psAZaB2Ue*i$p%C0G7v&)##&P3P't\bU3T%߉Q;y:M=fژ[0-Pߪxz Z;^ `ȩq\!/DERb [z6Fjc)?Ecu0[^Gs%mQ4N ,;ϒ_O|6 r̷R!45M7BT vuמrbhb=oCX&'1R=`h?f U{#rRgjbljzGLSaպ<G}!뗩aW`DțGFӗPMV~~rK ~Hqj0RWܾe՚Fe^F( 0xv3^] V}N._ZZI6M;d/'f$\VYf\FyZt/#.v^3rohczw(=zf2$*\Vnwu^i9SЮ0>ĔjGt Rj ta`͖2mFVi%\6E1b.+/AU$b!FEVkܷ;'v>GU^O+SR׎/|(ݭ }R0㐙7T^rpČOq)V%\ 265PvN_jNK͛7/v"SHmzGD=B?+_g\=rKCeJEx-}Tyg r0Ĺ/N8N †r k)U-J-9d :."Cдߜ½g6xWdǎunQPɒFJo%o )Bjn F y%-mh*ڍܡ%&WZz[4{F I󫞾<3=}'Zݙ Ym.PNղL4OhyH@p?܃e<@mq4/SafD~&F3bG%QćBi]y8" Ad{ ,n9%R[x#t!305Cʚx9eԛj1JLj'rȓHs]o90w8;R]ޣ I|7jV4qXv=X%Q@K.U9/Z߳Υ(``>uЗ:ְ?ۊ9~TY[P /׸[*~P?IPJ5YxfI,{?.iUv3h:·umV>#tejWy'?APv_T@xwh I)@\8xĵL XH*ݧ/.gGz+ϸX0xux,_xM0c $c#nV%7.i;Ȩ~{<6fݘ%fڀT%">q咀lxiI."sT|ס6x͚ Q?S3u rHei`頙>[U4#AaH]vNw@S5؊.9b\~yK`<mjAuL28y6?DB+WuErenfcQl~T$NТXxd{чd I0),3p}O?Hp㬃%ueȢm-{Mr!?{28^@jih(^9ϺLǦZTk^^G\$њJ@4`yMJ,/7o >E^z.Yr=LsLЋߢMXeJp[3<-cy8b}6g*ǐ5 [쨾"2Yr{ldWSSɭtֹ9qMCvfk 1ﴪub~ M]vGi}.澚\<7rN6/s0q-6ESEB̍ˁB݁|d[N3þ6〣mI5Ҁȡ"S\ȆU^yza>ĺ^bAy6|Fq[Ic. jMC:,"q4t HadfY`_jN4 b2})D+m҃ol?H ύ8ez)x~4neFUŠj}2 Q@Ӧ0o;|/۴ADx4 x@ 5e LAiY}QH㴞Szlv tܐfv=wq)H@r(i?0LcG%Vr]=XxGSZ2s v &k9Nj=,.}7kcZg~:ſӃ@SfiE4̆8'ho82zAmKb 3Mxҍ++(ɮSBFoߣ9ߔ† AsM^.)?b5 9jxukf<س@4πrEQ5XꭊIʊ,'}i~-ySuZ 96,ߵy'Sd)vĻ}B}e1!)^}N:],_5gwȮlYKK >.qU-ml6B8<2fR` mH` oۂog?mܜa-JIӸϢvgAN'q(AI3P4L74 Ҕ9] 3u˖B26hU9Vvrylņ&=&˞Y+t#`tfĤv:qK nbiof=} rEgJElЈ|-\<#|*g u=!;ɗO&lMw ɒ :H;\\QqNdL(.8U=^I/@~_(/RZzVʹ|ãU^ADO]ksfkpS4?Y,ꋧ4#4I`]]:A=%K̛$,t_E[>Dh&l%b'LnQ̿14g<hɣ]LB-MtyYS\]xΐ]?eWoi;3B te 0P[3~Nn0gX-H6Fε+b$Ľ@v5 \V<( Ed4 V^vd "?$G-ҭa! H.B?9i$++Upљwj2ORC|ՋYnC Hp#xS36/7w|.?' &Ÿy,5l ?/~]zPvPv0˺;$1'sZ+.O%Y7]yCs,\g1'1 %]˅wܭA?Ɍ 4 Vԃ(7 [VXvbW77+G "tZ ݎ`zEBlz ) ܽ -/@\4K^_2vQ-1@CLtyBv[C )LD u?V.?R5oѪbӺtA޺_r#?\i$O7,@Fsݮ\?c=vyX7PVÝrGsd[i'aIJH|c!)^mj{ELItմ)>5{Wj| &DW{%Ϭ <7f׬j chÓw4--9֜dؓdp_) NHTȃV& ̏*0}{Å!H/F4xB57 Z~[u91)/Y4a$sVd*lL(ةGla lQs4.ڹQ";~cP +4PIJ/R`\e_cX qq+}N k1Tj},; xC;=jO,I.+m8I+Įl$8a١qM`(ӳUPwozpFEuٶj`V}Kp G'c bĭ䲉8q}7r#z7R;kϠ+g$&XTHpFABq[ }]@5%}geĜ^xa$~*HC8}!?XWfIhR{V29N-,WiV]"䫞Dİ۟~Knl"1Uc dc4Va ǑkZ0 I߹S arďʁUa]84 ԰9Y P2֮$}8V8Ĉ4N8,[%ae$EF?R4y/1"v M@d[p^μ:z p[f$4l>y2(k&^vNe2YEM}/r!i;" oa#j\ fO=z .r[q5uA TJ3mwƯ䍰4urAk#KW3L2"嫃 U*x{o]>/L%?!#C Vy]˻todh@8w:g<ⱴqjԘylS1ʫU-)u"5 OdCSw02Zc49׶A8ᶞ6)6Su写DXt4ƪQ-`c [\?s@y~E^fP_Ϟ@TU勦ZaO?-@ Q=6ujR=wHq$f'nѕR#V eiEr3[m©h$0g/Vw!Gh2[N>wQzYq]hB . U~ qצ0q:a7qta/u#.MnEH"lf%Q`-xQ0Ub 8UM1Yb6d G͹KV#Ybb\oP >BqIalm 01 'nx6|a?R VUcI*yO 5hمV d7D?~;=to/xv5Bgy+npFwdy [5:|NҊ+GUA%~,Jvϡ&0eƚqW6y`drq.yĎ6Ӵͨ =M$Ņ . [paޜk('iT(NC\53 (]a. 18\%ˉqIJo27q'$tȁFOoFW?گP 7R-GrNHl+}is ZP_bl 5dKKSz9lyk!~'tӋ*62,x>nN͆OΔPt ks}HB(HTi`YKkN%Mpid}, qw-J~Q ˲ms>%cQUw͓\z,l' |& źfj*^SKñBdN:t(ęss%AN2bWEVQe7gy&ջǪp/:靍ܤQjc8]}%+hvVM&ڻںYM>rAjYt.7Wzsv!ndž tMJw7:ɴW^%4C(= *,Gã8t vtiЍaXNi&HSsk_:ϛ'XjOs1Q>Xf"<>_5d60r|7[}=1s ϔ S?krp'X"} _\rD4 S k"Q'[G3F]qRj%)/RgYh3)pМ O֪S>uBwDW)#.=i<»eA3UIBAˎfAPCk!6N⬌v3V|MbE jhNt۲k͍eސ;%D4GΣ=AE#c);U4DU2@ME9CS!d :pشHoy/c>o%aptAEZ6ptL@$62*Bl=F[?[?Eyь2Zɿ(Sr?( lC7-8EnaP."+-;&Ӊiz 0k淉/p|Ig]SCih[ ,C ۿ ,TfBY4i,+& פk/Ƌ];ԼŲ1!:"W/{[ָUB+񦪄>S}Z H`rHzMjSu}H%^&Y{Esv#,:/[^4ve]OS_3mu믠Jb6J%D3uRƒJu)oprp ]Pk N 6vV8rs$ ֖cR . :A n]A}auF#GxXԎv={ kaaY|6bӈ+}ZHS _^Z噅=nPS8e6e4s'7G|E;WOuXF,&b+P}-3M2QYc80?t NܺHꀄVdI` Z~G.:/5xgW15SC Y-DIߍs/FBrYXGݍ6|mfE#` ۴gaZP" yy xc9>Ttݦ!낕S]akPZ XJC؜(hi%5d eFV~M<Se;xD+\tA?42'~9=YkS6ͪџ|0{0d? uiܝMυB<;)7$(*AE];;?qTpP6BJOz+&k!s i"2[_9,jUZ ccet3hF\Jh&ЍCӊj>cT7a;o%%vAhMOʉ /}I:[Y3":$PMz`F[|ab""\(ҷFbAY=4[FG[ڂb@5[~pp!#qgٍrTLX_E bi/_\ j6m]\o/]ZD sQs'7 XBR*rsE?>flg4q,8PTfm%0b Xk&?wL*T/5)ezvGoe  CMԢg em$|]Դːme T~_ KQ`"'1Ӣ>ѥ$ԨL%j쨗nJr2I+7 eҖ6yO TU/$\9ITfcGUsʭq#~*|Yp60X#j6xC (B3Ą n s`cLm(vf8NQguWhӾcɤm5U-:^['w$FSy?|Vܻ ,/j(߲/m@.,h!<|JP2*r2=8ZX>1YX!/hfLǨGn%46~lJyl$L)me}Ȟ_S/WR֘B76"F%5b])胗*9Ὺ.'[$3vt%%GY©BS*|~( ъuiǤY@_ַRq~)Yzթ$]L$!T/lwDxUx U.V:zAt|$[>nGC lYOI8`#2 `OK0]v|x(yPk䆟!sn7ۡ%!E O`;ʫLO'y]㰶V Li''Yc4G(gpi*tudq꠳ @ӊ,&lGjXl =UOw+>ܲWYDcFCHDv @`"yz?amV4Gֻ=*ei|+%S\L1E` E n1dګ-Ԉ8AvwSrXIWYF0M^>;KugqW} xR, [쐀+]M5Vzbf 󹚆?6ɖ)MG&ϰ>݋HzT[^~ٜ9D!unہP>]C}[-Ӑ^0Ք׋G$LX̗3(LMZX~bvCnyJ7L LG^*5;i²n 13.EeN^e@ j nMr=̪$D}7C%Zt <|&rzTC]Dv48ZdN{L='g5q²lLT2I V\~޲8\$`aГ^19{ܖs۳ϐ#9nΩΣXrN'xGLRQn:mbޟJrj.tVux6ch bH&,VLKB+pIkT\~aܿ28q=vz&It?y,ş=fC ]?vQo8NH!ʬOМ"q|Q|+_SEn-%`=:xXn;6 {}84٦ZIZ!&y]"m;_?B2%}b !^юt7,Sň6~~<Q&y+_TӰf:"CDnCbIoI,B%xc7U ≲-O6TI ? ΀`)t>boH }x-6E lڌQeH, p΀j`l@g.Cc}a*Nbs8,^@|^ǿ8>hF}}k t˱icm( 1P`iC}ƸSv(I-#GyZ4.ܗpRJXr%'IJ4=|Y=uz4 m+uD^7Yl!VqP q%/CIeYi]>޿`$?YsikN)98%odI|yGyЫb|Ѕ :W{a_3ר2 s0q(Yd|c;Q䖓~SU{j[.hv-HWet$O+n&^5+uf.GkD  3ŏK-3A RpTlP#~\ dlŨyD7KpM3f+sALte%~ʏ`bHyJ2PN';>^ͨף``6K[*Xr ťN*zS"VM&MA1zυ1AՋyWE }֝Q<'67=.JED mSj<-m|;@ 7әc+YA-dیOŠ*^>[-J@Dg.G } Gֹ|g]ࢆ ܤi-ИbUӓFn6 p'O9JJZmdYUfJ7a[ȸ=U;% $|u(A=a;K;%0U6bpbJ<*!N/ePrSႭxN/㚲K@ w1(ޥCgތ>6BkO3!liok;'_$Z;89JTo}F= ǨTMNMn^(| lTeYݜO#z} >VIZ`&731$nDpF !`MdAxmmkC*i2xPڤ3Asr$cC'1Q3v,ЭI _xWՙ%1b!wg˥,kc9zf[ʮ_WE|xV(*9R#IpzjPiO|\+%lҔ2y%ÿMсտ2T_ʞ{a2Kyٸ-Ü;}?@SEr(1咽u.*5XZG('Ȧ I]y߈XA/ӆXbr}!&`ˇRrx[~?U7EϵhweRχۊ 2 rF ފb\Ɋn7ؼHHςpOJ/OwtMjEFcH?15v["'bWI6~h)cT e("~K <|oe*ݓ= +\Vԍ.4:KVQ?Xi KeكWJ$~ m3W;pcxJBɟ+>@> vAεs)TBE NA+dˈ@ʗ#Z,["S.Փ0i ] S6\TQ g2A9Nyܣ~?n>W8h7px% ?TYv2a㔍[8&wN1o!Hc"02NR66D2b(ű wɌRpkZ 9})rQ#H @pd_V3)y.9_bobBF,PXY9th _Fhhְh:% )"p ˕aqZ8m|gp /g/nyئB8]t T͓Yܽn/ Xsn4`Tg!҆!1z~N_8w;(߅m$,̡ԵXP +D;l8sAAm ~[Ij/,nmfƯ\&E.M"j܍J1 e*Byfe=7HW3_$t~̻psaÒN?'/OJkٌ (=`}{s.N/9#0)nHG 1©AT6ŪD~;|fs&x,BLs^+xLmY3z$ m1ρ<ȻL46’;D <ⓦ(x gBS{%Or瑌\uHܣç9k7I {@h<9kFsyo2WPkwq zt#]e"ɰW 7 a6>$92/|;Yvt48_u'$/uZzf]]'v?$}GTؔ}YUwEciK{?ڨòY @'ll/IMc+V Fv<G-dF}]' kL0_wtС$!$}S0egG>AO ME6Dfb8݂h b {;}paʐWȀR u57䁾iAW䜺fmx$+0fB o73(/P(_Le=+NV=yysIC&5uKr}2F䪉4M)& }RɏJIp:{sSgֵKwFMF6㖜Wnѓг}o׫NIz=u>2G~63lf6+: VkCm&`_1% Lc)D,+p7Q~OLϝ PNtP_t]YԠAʬ-~ +wLg A 6M$}+:QI4:`cfŃ2+hg܇pg,4g- ǁTWH" $B Eح@ƢDاv40N,2OPꬷP@{ڝ]RZo萟[S"ZףtlҞ6mMZ _!ŵDA2ȊGX_W$~CiE[0rz<4dE 9a!AnըvQ;CMщ!OjvЕ*ڬ MHj5o2~2:KdP) , H<xݤTT-Um _Nt}>A9C\Y>1xp4` c1ѷ$>F#^\g SnTޟ SCyG-P nj~|d!3Mrl'RT1["52~ͽP@ρq?=J?_ :z7r'_G^H5vQ PYbAuy,Dp/,\90\UM= i Ҿ;)@-R`t>Mp$sV51 e|umrI‹ӝ6VMrk\ڂX:Pͯ6L+Oc z &aUY=ζ׷X3 ZE|`iv$Dn5>\#~Q:Hև~b7Q$G$QbւԆc.<+b=TbF͝KTʋF"2/m}rgb<-cKteޤ@F!;X@2ˤM\ofE(++ C H!}-1>N#B &>Ht]JrZ/U T&Sśj۽wE7<f`L6 IGӦ.zvR轼( }Ooh97L {y.8'NpA.St=99bgr(x.ia%Kл35@x-ʚa d5eJ}4Ϯkj9N9L댝 L `Vץ ^XruNoMUx0HΞII)rV2kz]Oekv>ItDd f]=s//EU |഻ն7UYWǗl;?֮TIZ-a%e G8]x`~ZtPy4mRFsP]=PV_ݿ]v#2y#66 @C͕s1AۣdWxu ;`MU_acZS8A>IʘNø=W 3lס LiKDld)ojeY@!mrj^gаp犝B͍+΢R; KJ0v1Š+B<ǡRECFB!j 9xT`QOAI^914'I+K`Ε_,ie_|A6", C/B3|MuR#'R0ocKWr]nc 3un.mvr$9O?=^n@?GuݷtN$@ײ }Nd8$*KhA$]n#ʘ牊,K&,P.: 7jIŷ{;j>,>1Rb-;vM@Ka% TK3lQ4w,*CHuP}&䧑CоSu_\%/!Se^؂"gR[-y7v1ȭOдKX!a tdPx?`Xj@s޻);j&Wq gpB[$Ki'op\妱t鎇[4kF~橁[z0Gj45(!.yQ|wnz Z;&'H>S4jT0Y]nn^Zckr 2SrKhFh<zy9H{-W|&2 ?j\Iu8O9 @A[AoToXsQ^~;Wc`Sm푅-p4cJ1ze 1~=i5OAz)i|Bp쁠TI( gA5nr͜7O-@]`:ڜEu%_~ڢ$"Fh-mk@Q@[W|ܺ=bL@ Wg;wS$!=I%*~kUJ˅hr.##|Whc6 tpv \̓R硌Y5ςB@U;Z|Dnֲ@%Ԃ1ڽ=vL\;n]f4hv ҝuWKfQ$0@џ \]^)YDX(-5p9]c,〶$p/~|1+H w/W0b,{e.2[cc-X ?CL,TDC~,ljNM帩/rr/K)&vC` t& \>ã'ZVBz5#\)`=>Jb8n fا%v-&G/֢(0-W{1@FR1-J2P}Ј[=d,^:U0RA=9ĊQj(eb(_[\p.)CE0M-0ՂrP Ǻ/7ݺ20/b]~bԺ{晩2m~Iͥn6e)"y,4oeq+7Ȉޱ(*G0sJP;W4sY]x<ώW~w 5/>XgyY^L|76PcGf(C)~$h>KhR*rGY_"3wErqbԫO5݄n`cTw^tMcP jh~xTUJh0b?1sT) ϫ="{DoT ŎVpEƂF*g/a.yA Ls|>J>GH:&/oG`Sd;650o((8Ս4 H- #@&9w&^є':Vi%`1gxzs%jީw+ 9 ލ"ǫ?J bؐi4ϢD 7R$LwX@fzⱵ&N%TXI<2F@1X&O^TP[%(w>Me45hK~.%iI#zCo&A/q3A}~۷)rg%XID 1X$ !Rt3Fu ?5b%53n)86z=Eiz`utw7k wl&! i+\ sqoB-, V04,{qbFmYS HΊ`·E`[̠)z#kfmzf9baǩd0?}lD3>vB5+YI{d(P'^|͢2<o{OXOKcyT7V#U8^6"%5q}ܼio^Ɓe5kqmi>("*^g?qc` fH.w[\S"tW.%h5p{&-Jo*ە_#(*"B4Ú `^Uy2L*|>4/L<9>PzGO |?xMZ3 MO| h6xlGq>^Gw1̔;oH+6{vd!5?.fΨo_4yȩWA)l,%cY)"##ec1$7n'5KptUcy5|:[AcGZ!)<[1 kM}iC|7 ؽrZ*x[1+H>)\DrJX^6BlĿULK8m=Sy ްZ\%;_si s4JdSWXˊc>Y ~ dVo%{TǷ ;.ocjEU|gv`;vp{U;,9F5o]YxTҨ]既ZZqv#RELɾ$;餤mw[fңVҀWhi9181n3 P{) %k;et8/Nv x]fEZ JG+ h03<^]WթO@-+2<𞻫>ŀw?OIc1W_!0z38XSe䇿Ё17$u:l*{teJ9>n0Vݳҩq"Ĉ0YuD\^} EZ+GgtޫDwFsq}3i3KOo :WDUٟPr 64"aLۣ%X *{fd–OgWTa6}:T|zbh;lת:bߚ)*cц~蛯I,d@bzE~>Jio Q~] TI[K:8pk$ lS\7=|M2rti5Ͷzu!9r)9}l8y+4J ~9!pLT$ #yʦr2 nɩ,` *V e15tW N]bkhK? D(=V]dQ߭D Z?MGB޳ oX3$vD|$7!)9W$*!ye]Pۋ#)-՟Pu5&M~bٕ@tn?a,yķk>FC"zL[96aʘ'ikWߗFeЎvT:3IdM9 ڈ-n&doE^~y}7?@fĊfWnڏnP4g\~CSέt]9 G9zZxuJaHʰ'%%U}orʫUA~\*]mpe- ˍ2M=+DSFFp !*S?'S\Kz]s 0L88bx^lʞ|A%TLy>QRrapal˔l>4a{V("m {@i,!&[Y(s>rsO9%h+ =MpEXbQRV u5o|zH*ޟE-ZGܬ첩 γF XGчlUg+yMmA'AV5m|Cĸ[73'ƍO'1nx0ь̎sNbgM XZebWD R]=I ;37ړ8'SǘDkO 8s\d6t\̫xl:ftq&g¸8=ZH=r*p)M$ݨ)RY $Vi6Fc2^{#G,#A=ԝH1:7m*ekQeP 5ˣůM7ƅ-)54h3 f+o~dZ5g[`r#Cn(vf3煸t+X|*S */ܲ% d4tNQL|%:Wɀڳ-f?"ctv_ Q' cv&kP}$kNMq9V~/ZbB籐sy:K6k@ iYZmNl:%ZpԍtuKEgd9ֽ3B4!2'~h3Wnm*)jM}'Ͻ~d"tDq/gAlwgh#i *6W$ @MFB n2PZ&9FHGUꂒs$FY2M$=I{3Δ2)MC6g:CPd)^TunJјi%eB85){ O)4E ''z01&ej@(VEYHrLɓi'VX,y J(l(9Rf}jp$U&`'Ga C/Ŷqn=*B󃌨g5L]R8oב;2j1,b?=72>efo(Ś@ g]>Zݬ]u@=Io--p3 ukORuuU|DӖ?ʮ{b;+Uٳ\Z\塬D{6fnt.Q끆xS)WIRfl.(tPutSs'4փGA?-46OC7M^&?UٜCmsDټ fgǪp2G'' IbU(v8 ઩8[2I+Uj%%\숉S7˕M8iIy} ]lmJ_ܛOr4GjjbG;M D'asdIyU;?/oК {e/i^a/UH]t~oG`7p>YWb\rsymqSfɹZ@/&S0׿2rNHgMP+y3JKFUEue\AvJ8GލJd,g05FffcPE/C*TI3O? wbzI#^Zf@bgua&P4&W{nWIK.3'e7lus/?idP;1M C8-<0)a jُJD[iNO=qb0.unvyڶRەr>1h}[ӱKlӇkEG0s7hxjjǥL8:veVb`"31Sވj}Nuq]mUܢI·=׽a~](ymVNc<7إ@R-x=\Z@$$k|e$צ?l^ ]eƟ`9c"gk cjBfdW@ߡt}gȅeHRC\ Mw_Mm0F|p{ڕKA#ۍ ]Bݞ ݉M8:o-AzG^3T[+Z[G Q`=tԫ⿎f)gAbgbz/Ib7Fʧpg>֩SMB<$2Z\32c [AUa~Ѯ@x}sT.8/R]Mt}@z1bgQz EfNe-0 m;$K?cn⢏U ^QFLJ/~;gUت./oG+pDq&,}+e|3&dKd~Dbg&F?? 5E-!vz h]qb@/ Qp4(.zBTs#AhJ!Ж}`7I|d42{@2Д+Blp\LYer;V8v: 4~It5mMȵ3jr G'HM](X2`IF5cu(Ng'^)7'H^=@xӫQ\xX7;2H~цY|yfh01j=9C{^fpϬE)x"ll>VsX""+7A;̇|8FGm2yJCkSY^n-_4!C $nFiqJgM@ ]X:*L#Jf)s$.`2[[ڱA JyX 88H7)zms6:<"/A(azgm髑?Q^@ΡNϝ ژ"- +@2+#P>w+}Md(c:DBLȞX+{mc l:>'`Q#̖g+ 2 7Ɵ k7::4VWShBU6w`?-P#;Ll">*؎c;8PR6P(HBW Z<2L;wޟ~έXWrd(O:~8B SR"kzč WETmXҭ{e; Ls0X"R#ʁ #,#_:1umL̺m35qsX74(iq yFc#6qE8{^ Wf } " ׽|4"uD#hW\ [:ylNe^_@ ()sͫɰ\SPpR`X?0nmYwˋE~=!ahmb00N~0bJvGJx4. $Y)a:ǏP@ O;# JMW3 3'D%M4N/@@=qj.݄J7^.}7г%~Qg(ƅ20Kb[@2G G-nE4'[^WGr"{IÖMVSj.J}sg7jC'I,~P~DYMbe*u-yUQi I:ëXՓ@Jhߊ9FưUBv"φ7T(uN|[Vqs-GWK@DUsT+{~Ipwؘ:,\,>hKuxq?hzݗh|3ipRWESoIX"kH[DbmtP '} &"ݘc!Vb{:@K@;=-[K sD&m9ol{O[oRB5G9dlV$൹fWO6$乣=r-I SR'5ptoLAңGᘬi~Ec5P` o `txf# ס_'( "gˍE1H;5n 8%@y-ӭ c>Y)p"Dԯzdh"Yۂ4!?OthBҊ,_#o-ʜ oI5UXd!659Ehf~uʿ$޸F@g#"fZ.p{n,'Ϙ L.O0 զ:^n^1')mEpD?A<^@GoKxݜTVz8?vY}wpjFg2~"Kԡqj)gBo:J hՑ\H_PǾQ$NSd?tiKTCͣexH˫@xۃ#vY7_h ݥL ?p<~aEByQHdorb0}sRwsx]遗ex~ij4.3{"u`mW2_@lRo" kS*@bc>^XXϋ@b$lm h z6ք@t+AcHO)v$`Ln=&+!-nÍ3H X0Y-`mv%>q*l =A[A!Wo'e[ޫ6GnU<'D#Dž}3g ?GjL.w M~|ew'hGB6YDPX}ӥ~T zv׬Qb^x5MQ<%\gjR m W p*u?{$ ).â | uPRA_؉R]#h'ir]$cEw^@H09ٴNU I.18gU6-Mwsvpn幱ZF+w3 I߼eala5=LCyuT\ps؟Ρzo!1Oew?f3 NmD+OpQ\TZpO̫26p8#lNeק8LcA򭆨2\0-K&Z~GLm&>'FvƟEyJ&BRn9a=P_—R'}|!{ӛ$Q _vgV ߓXAgde[(Fz7&ӤTT!l&Ԓg%:ZÀ&';֜m#IǍV; |)(u͙,"I;ZxX|25.֖^P߾g^s 15m{uc (D L1[o`GΞS!֠m@|Hg? 9DE  &ʙ*īyhТӨ4Q~&}cSZ* (%3cqh?Q̫(ÜJ~;O:,JHxmũd )6"~{є)*"t ~jGEjXS'P(;]HS1) 'a J!KPOF](*ئ\&Y*kGZw\*x춥ɬ&R o ðIzk ql`,Ip7b^M?.7_qY*&37rk*wʪ&:$MFcT@ Lȅp΍{%5"v+34g봳zW+i66sXKJa!q niזO:F vA#9=*(u⡵#6 >ğR+Ӳoo|r|͆\3+|ϫf$bU2bs)r7\ma3IĈ# r8TA,Ci_)1VNy `iyèipCzL*J\:+|3 ~Ri̢">G1 90sڜ5׀駌7Mo$^/XwFsygt|1ݬZ>'&JE3ؔ7nώvzpoQ;ɌzF<=ɔ: NBjn:|/Ie4wO^#]}Ae70οvTաb̄gלK 0yNRt*eHXh `tȬk wJ[LIKH Xry,q #F] sNhU gF;"{*Stֺ0=![9.N~MvO{nY(;`hPJFk`GИxW1ȺW誃2hPC˰,&hH;e=<ICTgfB#"8+K?=~&SZ[.bJlH'ybIVJqg7Z7|ﵐjJy~.lR- -1~0P$=J7_@Ssxk׎٪UuFǐd疪~fs-*M YlчNQIqHlds"ޣӒ&{y/RW{xRbnw|j<M#\EWzc7Edc|PH]GW۵uKy W)#z¨+!tY\l9 W#QnYRdV~k臵VĽs3ɾ:,`3o槄hijD=qnVv}6g qHv-AXl&rcHav wLPXG`TKQleoߠxDIjrO0ԙ@q@dۍ#LCT-"nCJs_] -*w9+x{(f=<>l9IRzL(ZD2;?ֿn?6g)_B6\ZST`= vX.DSCv51EMp){%:[<\,A-Kg/^GtB!@1ESMVe,+ yXq\t15*;^c~aA~[i_ⱹ0,~H&*7ע5hd0db})5U'x >l/Gj?%:Cٚe/JA\ >r:l~옟g5)\gikK'L徐x&w1f!Og ["ćCF{S>Yx?JJ.YFG"WG"qLb 8p(Ng$%&ȰLo}*gt_%:H꜌C-w֪P$>`ndb}@:]bԖ2IN DZHf"!{ zBn?󹈻Le)o-妷5hMR%t5DEM*96ڽ A&}n%CSڟ ln[n+2l/; mSnrߎa=Z@:(!򚈥E,&PPYWtl#wz%"zDpGaT s3N8:>h)l$h$*lq.ffrv,,!A ([WW뢶r7;q.|:KO݈N@`>_{?!w|Q7uMI 2Ao{Qew@.UBb ձ.g7O/%@J'ջs~Z;$`_#NٜHeY~q|n51n!~X[\i`Xh--piuHJ>dB9D j{6 0Ac{Rrj-6#RPˑnla7mY/wwu7W|Ρ5DLgJp=R3c M̰'Y} gj~J4a$VlqH C/r)WUv]{8 X.@lCȆD"X&,ӹLatNʷoA u_2!U|9x|Ь29nhKP?OlcuڋALGF>|0rKQGGS@]j'י:叉1*l:7A뚘8ܓdJDhoƯ)SsF K0].ptcG,Ie8C* j taϼ$؈ 3H!jP,dwջ ˞Yo>)0۵f6ΩxoitCI :4[#;9rAm Yڹ]٤h)Ei$u/W9rﶹ4`;(=dd.$lc TϠ _%=yV)sq\'qVof&CVaGcu?!OnɜRx*l ;W4Jwpٷs@IgO7S3#UAbzKM1и沸OfEm=(/ٴ&_Pݝ˹E9w&oߜ>6RX8=ʵW%rep۲*&\v IMth3%n=Ton%,)WH%ǽn7!dy]qӟ=/Mpwٜ~O1y}-S3$rb>NIhӎ_JmYA$<+#6U`V_yfͣR['rDh/9i}LiHFY k.]"^H~(4"FۢDV8^*K[2SH_|j[Q-~zsgkv#CͫBq3Q&3LftNazJ:u.(Q]ȶ9Dg#܈Y;ȿGS(o^}?QbX.QӜ=L%B!>-|y_{f3?>AA|!LF=qw$j<_V{#WZ)ȐrtE76݌uT&f+&#ڏevs$yXAw@<7$^O+ag>t@Pٻ-Й|UeC5$>u(k~=# \ P51@-hpoXh;WK,@-h T SI#CICNGL{#)C@ןE\I3Oa\z5|\ ZWs9;RMVs N~c}᫇.|n)&8ITq"F(wfbL9i-QkjMÔm,-,Q.Q{zNS- gvO$!jGb|A~ׯTVUfTk/]Mh>~$_h}rEDHW`>dqsˉz)[pؾŀ %hL[l2Mw =eMERC٧Gu+n9D {ӽ27S=+Sqi:$eb/ozRd,/m|i0&[%XV@jQů)-{^Pe2̘ץ$=(ͰX S"Ϲ9/]%0 7֑&h >.ҦA%?;wWsF0](miL aBo&iCgYTC*HHpT}ZguA?[:e0Ⰼ'T`)bؔӇAQ09iʁBF0^{6FeoịPrΤ!5@]Ɠ uh}yN òjX/%_҇:%Y\qg[uF`A%_qxM ?sgXB$~J1mM*NxɸFdK~>K܁Ɛ{/ªpq$^Ċ[-8`; 7tkvNsLN1_*wqOK vHםV`u'kR=h I g\H1r2r<ԶR^CP\dNbd$gˡӁ -юHygH \Su#O@xzu wL osdTڶTC ~e4< 2zCa+R2Mw1PGÚ1|M~e>Z/rVi~|Q:ܑK?`QmT>ɴ _^,F`Y9A= s : ,aIZ+*ϥLfhS57fG^g=Eo|I?pnVO<RV&5>0B4ǁғ~w1"`/&٣^:ߐHW[ !۽aw:|P@[m1e\x7OY=RmtC{畝(B#tLP//*\XX`(DzܫhMIzP| kAzo1P3S >Vԥ$a;-O6w;HkA/m.7iv C* @cFRu^;м/iy^s6Apn*5_'9hJcvhi ]+.8ϝ=`]VbL-O.Cۊm7դ菎#\a=P;c="3Uasi{kxuyOctV6IynҹH)Yq^pC$Z?X[EEdU3Y5K*"O'>nri5\w׍HГBP݆ ^0Q&lmf@{;OG V 4@8WTS:%^i݁%f='Jg! %ݗBu;w`Bj G>͇y| fꀊ 0-3=P^SP5G 4MP*>5zzÊtZF\O,u.KV:i.d$7 G1l5 1 ϥ^K8y>6l/PM_KlȎ3\;jIS@M }s |%C5& P]_< 痗Q=ХfT=Ԥ+wcEV^PHXў֦6ʱ@B:~X.ib2nΫ>!d+n@0}&p뽚a>Hμb-=k]cdv4{, N oDU@ox Qe+:hf-pqC}8YFа@4i_mIqYayLֿQ`p hH߯J^9(،h!} ?C Ԉfx^D-% FJpzww宥?ZB ]fAKs*UhM՚Eg;?H!eF>q8oOm>fO̹K0ϝ I_Mi< Os@aԪ'oӬno쀿.I(í BB9td90Bb #q1N]sͧVXՕQßz!vO 0vZfȣ@w󰇬* q%CcJ`dϭJVBB"Jk~5䮋-'xYˌ 1NZo9֮􂇘~tyؓ\bGүoUcbHRi~/ sǷZ:=svS>> EzE~lOh" e4W}B|!,zczSv = r67u`-0@D:g%Jˡs^2I%XT+;f!E7}bfӾ޾f/?>G([鵠1P/7PeԞi)6nI}> .$P0AfF:)o}*~9ժSyn3<&^,_jF{H(Ck/ $pqeQaJCqX6bj遊_G XvgX'#;Fܠ? P=έbH;un [.l ENPH96'co*#Ta'@ͪQǏy/HVNfmfW*S;f0. 5 RP3/ۀx %iP9P2qY/^h9v=:29bMo#x/<"z5!8HT`tyY CS=s*E6v\9z',T [7Wа 7.-FBZCEIfOh0S<^̱S+m'\j=6 @1¯٦&! D,ȕw=<:qo'LtZ΢)O"-r0aSD۽#7gd{(*&r_rB%MOA9GbnI#G>-HԖ }3ˌ 7O!S7<)Zѿ8/{X/]Gf \z0>$=XD}Jbb~?pG0O_Mz@| .7?zyB9hڨYmmc5u6t$i{R-a}5Xh-e:o8gN/_gU5J"b[]WCI<:Q"@< a]G@4[Q;ɡ4S E j-%m=#oڦc+EolJk]XYbOK }f;F7%+NJcݖ4\U+"Wc=t:ky/WקQv(t"-V(U8 } $N"Y5É+]\+y+4(0 U,X1.?rYSg d!o3nhCPQSsU'(+ &1qk1DZ=y$O퀮 );Vq5t?FCw'##s7|^-t1=WSmɆvʈLIttG nYTmep94d] -Jۣ2Vݢ=kÝ%y4@].yi&B;.>p3c$9z|"bh-Ē0˂k7>wA㾁zL+rļHQgbR^B/|υޞIVfZhfZ"8 U3闢N"UJ\BM(  LGl,NJ$opusVmD ahp- jrtFo59|97ABë k'>5 އѡBe נ.M*> ֏:š /2$haD2{'B-0vMBcuC#nFjF7h;F]a $HlQ-㉷v1W#N](F|rKcy Anlr~C?}v/m*j 66IWwk&yDθ Tx %g?Û\\[(v~6S[Q0&oӭL5&{ȒY_Ҵ23ݸN#.=bE]$d7gӏ3Hi"$鋂q`-ϋ=݊C$ۏ9@>&'% OL]ԟ7ɖG>\){{j*|S$4[ϑz c߿#d:iAM=]2tMUL:иGGll?K^⿴euzlruM*CϣDŝ`{ BE`).zPbI8yJBɼNRuيOd4g˧pϨ `'9OT4Z$g*¢umi]>7J6K 8* ?2y7$iqydx)xH$9UL<ȲN~1)G;(A*b)e3E~oE}3bCRtz^w>?];ʳB]ؒYñ!?Ώi7WlI%L -btuf2?6M-F l& ePL19bOWK5p:㛥X߽'$.ʼr+^Vr~'wy ֠í0*ޗwm'H{sq!WcM8- i:e4/2(~.|Wj;;n9oF0ta/V wVd~"eHq:r^xF4Ly8}`~\ۖrPHeg J3vTjb@fK7[d昚 m*g$&Y%s_ 2m6ԉuIV~MYi1FO$j=dN18Z35NOPIc?9s\c*]a&E+"A8&E.I~B*?0'>NN;_ݱtikƢeX$+51fj'HF=yџdCqFObt;PW#Ю5؎)>z~XKRpj!&42; >`oX;6[$dou31'-#YvN=$FIY3@᭓4KmtD0 -4Uȏk[wX+r='Qq&xA v9`դt0 ԍU퍮nqsssiE2LFx:ҋЄe(I=[fmEPvzbÏ:J*ޙi(ULyL) VX=J, W~232PvxV>@1Fju!6)(s)$S_=($] ً`?!aiޅw]BRgS$9JʕƉ]?nP )[4V"q}|l9bdɺLܽXIsd8; 0<s3&z *_~Ad36+ J GFKh"R`Ij\ -ev'ɎrJLhtBz'Vvd<wi=ޔ }%sbʢROW>FtԑfP)]_/rqH T_}<=-EΰNEL!4}3̭2%˙:պ5}'%b'3Wi@m[y,;jxT |"j/f 2.;,Tt !iXL8tt~p~b޳l4IqM4a90{=iٸ @Y\@*+ףk /Qze=$Z~a}LGNSE- K ۷1]'$5UXqi^nWܗS7%~ߊsl$1pHeIݮSϿ™&10{'!Ci=DtbGltɔfy !j}S}z O2D"?BLZgkvcNdP`OҞ$)Vasw;V%Sa)]gط>:Z[GCߨlJ8t=iuD$^TSzQrsA썵$rgq3E%K[ԻE(/0t{p9L51)ʒ*IFYnwqoY\欻~C|G1`BJ-σO)8w^?rVl.ype? y7 Ek0$Zo' =%5h[{PFঐ#AHL˅ʤc'2x71x5>8!${H-.Do,4x bx ϥ8F}~-x. lAt˩:6;7f(Qq[WnDrmFD.ADR,urK=N5XoKB9JK}g07NJ˽Z˜ 3TPwh ^NN"_=F"-2ōNvja ^J"|u\j-qJr/vx3x@Yh9wjַw(eɳ;LWXEj㪀qh}]x΁(Jt뷞jv}S42s쒔2ͽ u:Ko3b- X2e-+qPB7Mdx&(~}cᅆOT Uz^Hx2{;峲`7: ن@99P ;*Xϧt%-2 l BobwYwOpIh2Z!溎Vk2}ɍ F8[Ql)B .m< d$SK05Z25rP)rv6VOim mZ˿0Kp KK>\NGVHf !\J&c{[W࿇5!S@*Z:=! ;0GKG<$I7g `l:Ťۤ_)ڋVɂ̌_Āo66KY~$_,ȢO9n@g_ xl֊o\XEBF0&w"X^}sQwuZUio + AtC]eNIL%`av.7KuJ]=edVF:-԰i.::`ci)wP6ǏN$Z)Y1 =)Q sP~A:])C9qq騰y7)ߕ])ɗ9/9vl8M'[qۅ>ͣni {kX۾Lt,T"n4_͌PBq^o5 յPnk;sLHTzybr&H ,mrDv1YszZCiEfg^N\Al9X@; TP/&t74!fG 0 x CśʃJF@=_8G6~VGT8"#tițgٞ? >Wjt7킷|h̝W93_2Rg#C:}i6 }+~t"~JBSJTE}P ~l6Y.BU]o”LiNi[3wnߺw'¿ߧĮ:ACW]Եd5:5rդ:s=E_ib-`S f.Qu|BF%~9@d-o rj>|ÙR XB}b[}3[cpL x]QZ0Y')ghW&A}aɛ7 5:$ T b=ZYk ?/mfi[&>Daþ/7ؘ-E=\d :ZѰB!H쟻i;#&'0qDKd+El  ,lϩ@q\yqȯ~!(}rHj KN:ŋZب+N5"KsS &,n}i1r1T%T% Q: M1:`mw_0H9[⼴w|j/-۔"U<]\k&\WfX_M|J~5Tiғ3?=X*%]]ĘھrĵQ֗Gf wkY*1wU6ՀHdKq&sWD6ʑlƜ 3N81w2WO`} ^G9qws=kqb M?lgSttϣ:r@Ŵ"vQ7k!-ljb 3(XP8BKA_8VF22|L]椫WD^Hb3of+ԁTLmtY6zk]XH@zjEuOwC_phY:gS<ҋL'#k3l6b4WxWԍ-c-z' >og$'} |n1XqSJ8J.I(DO7?v I녙BMg]i׭yr.BGlj]qAe/'qHY_3 6?9Kh*5a ,F/ǰ<W} ,)9h%|#d2W+{0^E3 Zxrp2ecx|% MSyak q<-pclv(4aj·C02g^4Jڨwx'{qKGqx=%D>ۘ)x5/q@ʃf@+W[ g17,LF-qjebR|&K0O$U7sUj`=u\<ȍ4SyqirJW=$LLj}[Z[ڠ9vq=8h2͐Urr +z楚!;%p *@[ |fʁJ05m~a`{WxVrۘέQ&>XC74 JA PV`d8Q-:+5s!6ŬS#ddzV `u<̈ y.+,&B:R7hce:k=լIa)P>',f,kG2CAJ+$&U( r>_554IK.aW11"ש zͲORi @UU0ߒifw.]4IAFgl_: 8M,Z<9wQa Rrz)UcdVxԑnkIAQ$ݞbT_Z" ׈umm"uAJ0@ՔXVC9hEE_Zt`{ _5EQ6Qw7'SQ%@*JV7fA[Jqck`4cNK/x9:n;pQ FgLyC%.CO;v ^/] gg6u_q,' ` Uhi߅=wQp:pfYS*Ԗvg?/@WVp  0'f 1 2a 2V0j#sGLWQ=cr1BH͔,)䫪9UIR}؎~R2R!,KecA}7Pw>SEYCZIw aI@8Qa!SQ*P~&LKƭ!f:D1EQZР75Vzc&Jb_+a}Μ+WqM<)>⪫|45nՎ m? :vT*&AKϕ%Bqkrʃ6)ڿ>o3{Ƨ ~Z+/NhY{-W*|'jUV8@ ˬsmp64dPj)"dn1ւ"?AvNX.LsjP^˖cvpw":Rg{&b>4- W OlxmE&MŜyK @dNB2 dg{ )qe1y;Jnhr|m*۶P e @kA$dJT7|H) 7'xY^/Zו-rfCQV6qʗ©>cQh85r0ƒc&}I4ia>%tl[bV-.v ND]H+g}2TE\gY)~n %T6[ǖ%RZ_ /_ !r3b5;Fr'{!nR>AaI,Qs.Z?:.H٣3Kha 8>/Y&sx hMB o*褁̹C kQլaFM=߆jhhǰ^u/c2@ÚWp25jx`Mc1}Tr㻘J&ABeP87}mәzcW( D6௫7B6 Gb@\ɿ=+2#*P?"&`W >@Kg2:(ީz]n\)h Q׫pȍtƆadQbʙ(myE:uӻʝs ZE/f2sghnIBdƊ=IzTAVH;xQ.2@4%Z2߈J3_ p VR._MM;e|2[OEH!z\f|AM)lUR& ^f$)i9 (d銅4[Z_Tmƨ&s_I3L *_ujN B1wbIե4IٌW98RG%>Qw8ltb))fTG4'Xa+}1VŇ՛E'~@WMH%(ԑþ2HkacCF.,эW+ G|Ƭ[eJ5k:?&bpRwE X%8c| k!@6֫s'{{@^:s271߅"]CZk?I/۟+a\1P\/Ut.J|M2:ǻ=?!|U*rL b|()c Ev/.LqAbe+r !,bf~z ⥆qRgAVfq:KE@2ݎؖW-fH=w*ْ{NpTd^U Mezh4)h:ERXmg1#,jd^,tj 5cPj=>s b5kݧc1еCK1!능j[=7.vBo >,>,3 l"t|1̈ZDx)dYħvG3e!_e6Zia#AA%/:!?<Ǿ^ Eh)n~Ukr L<ʬ2|FȈQHJ eA<鐵1/ŎW x)14>"lK%Fă0/| Â5 KDu)\w_X9 T^} 8"x(9fեt_Cyv\}X?cnu6'd, }S&F1JSĹ{-xƵ'd(6Agj+g5ckdqRݵ4ppWRj/{GEA3 =M"vBz|z!EcxyiWS7{(艂Ap^" ^иg뗼j.sY]eH^UHpGlP`^c|%JFy@q'٠Ao.G >ǜv2$f8ӝ:3 3[N?f`N[wHdl+dfmzs|e,)4UQoG|%vN C7$6Ljul8+G+OL y{..t=A;Xq5UC)TG KI!/܀V"@~f+xE[Ę0ŻC^t0a:۾RhAD`i6rPS?] Tl 7v.W8w႖.P='aZl`I ]kʭJ_QE xri96B=vרDAEm[I` 5~%)u;YeɷǂƆ KVc>o-Ce ˆ@}k~$~ts6 |oIEO a] 0\e ħ;}A{bKFJ?RFא0kzC}•C'Y_׽g '.f(H*|9U $ï'TXGi5+k!4l?*n"mbQ0N2+6>Lr ˭ \+$; ޹gDƧ_Kᒳ&QD3Y5~ߦ|Y ߢ߹ i |Oe'>q[5Iáv3w]LVXv)>M*POldsz3qfHJΧ[D/)Ih ?6ȑPuwgV(Nѿ{BȠD+eFqbpz $k؃>(ܡ]˒ǿOӏևW_3T> $mu DC[Q+Sr<jf'eg+v0!t1:0fN}QZAQTV7r\H3+1NpXQ.6)WePJ!S K(kp5IN ::ܞrK⡷P*DASDFѷܣd3l:Z`Od઼Ͷs%csg޸f@3SwEbUÚ VQs1Cyb=ﻅ=O "%pЄlpb %(gqha-1Y'XRvz>.xҊH;i}@KJU|!oAV,r`}i9q/YݟZfws]>qbS&v/fhl~PFQYRPg:Ʒoud{!OIxВ7vLuEœ$7{ׄ3z|A\,cCؠGymF~sߢ}KC#mtlĆ/_EWҸ="Bu(pIG n1*- 7*?#w͔;Gs6NfN&W@Or,UtS߹|&{1xL)AKطD%$5}`,2nK/f%D#3+0niQ Z y KYx#BG dŲBc$j]ChDkګZ Vumؼ쑵5]( Ұ1IHDN' A:o2 *-|Mޠz,0k49kcp}PDOJT,k=\LI>E1p}V#Xir0랆m\9{ɇzPy3qi ntoPZ3"7D9l*ZK WlgJW\J_ζ9c oy]d =:0S!x9/ɇ8tȥ 3dhE@ M쎕0=OӍ}S1eџqE*jeMz@^&1fV!3^raycpr`>8V թ\-O̘Ȑ4{A%yٴڶj=kj,7t5Oph]DAlEۅ6:(5f牥d '{.HCm\ShA]i*(=NyjzY2ÿKB+S„b))cImxuO1h~GA:zPS&e3[b9~O>(聠$vs췣[Z$0ʳ1-#^s-)Ԅ6G+ozQA.e8$Y0ϕgGLY&it'*#TVlDܿrz$]@S=}:/MAWp~%+%5<☖.̭0Wpo٭; "`¡Aࢵe$$k7$*^N&O?lB7w4k5J"/̺ $b<unmޟ QSY1~5Aԃm;:(M3B1t"_(gecFVH:\1u> n\XB/󮆄5L.<"l4Xˊ4A>^i@xvCe6O#]]ʟ8%SXv!}i1luڞK {2gJ @@>UFBoe1yhLtL֊`9Ҁ|6 I d%IX[Ǥ١!wDq0TFˏb̍" 3CPX PZLɪԂ)U ZyLj%-?y%*g5{<,:pq!R BwD_N |(m u iT,ء2]9Q蘖 Dy0hj-)=Y_(@#Å+9gI zF P jlO=1`n_9=)Ld!z3HG/O|~ȡa~37wb_l/JA3grfZs:q=ڛx}󞶵!Q%f#5,.d7ݸA^=(;B.RG,'5(}+|-kæ097YŘk⧼̒D{QfVtK8yׯ2-GYsȾQb#,LlBFZE6Jg)r\!̕>73<]kDE8W{F<pI~=@}w.kKt#xۇ2sXgad>egi[H8;֞CFX[#2nlVuD ~cv\)m r Vlh{wk2t=90nF)oГg{v4Ȥ |Zc8(0m49Ъ8&۱DrrsZV "-7}[SW+qk${׶lzC7#zfD~ck#벴M+HνzƣڑE7T#UBaJF7k( D[`׽]M:W:&;qqA9wJr+#OԬ^|Xb*n:L\YL>Ff&PQ291G)$W'60 J3+ZtFI!G* ?Nw te&qX4 .]eےqhNwxF;\]3<Ԛ䖕cGuXG3vUJLFxH-`ķ^Q>`BH>^n[6+B w6⚚: ]}Wp(4ZX lo7v7ڷ3ʩ琸x(-b  O-DI7bF eXTo?,-+Ƴ&#>kY)[\ aW"Ԇتݿ?y`>X]2| lI.PP<8UĹFD+vHšVÄp2zl]{q"MǍUԃ/}N":S :h]Ou ۝ C7N8qVs@2!rk0SE`pAֵ<A40[X [6Q0W= ]=oϦV,ޘR/'E2iڦ"W3m(ˤt-E_y=/|έ}QdtrTl"goh?,U$W=&K't:py-a^ʟ;rein:&냿11F>0PRDyP0đ̽a:OIip$Pލ |*DFQ_`@`ڤ~Bqwa: Sj~f!7Lۦ6[j^(jO43&%)M.ɰMc Zq)wz~\P,t@-Xu,dfsBaGd!gQ oNөU S1pϗIk}+{Vp"ű kF7U-o>s y÷T 8EC,w»=yr[ɗjg')Sf/&iJ -|QpI1\Ie<'_!7 0:D2-dlZ~/c'if+qg8;Z.[VR7,o/,fQ?3? GlNHº\El ˞B}'Vy9 [ ..)5&Qaid>:Ƀ~L^&V[)k0qӍv[4V bzj =;6*4F$՘ 1OwX:-YmV3/;)=8u);.88[03d("qzTCNbo9lJ_=.{oTՃ"~h{WyJJLt\:8kqo1=3+n(ڐ U.@]ƵjN?vdQ4宵>C{h!('?^?ӏ_G=CD1QqRhVKu؛"'=6Z:,rX7*(WY\#ZqF޷\lF3B@=E@@p*WJ];wQJ2K܁SݾM{=Şgrվ;Yq49_fM%+c^e >YlTܳaU"ɤ᢭vѕNmQB!L*" ~ IJ[7ff!9~7Ÿe◛;c-jS5y9o#۠3nJupkOu||N:bZ4lKTtymB1Wޖٔ%D4htvARd9סlv\[#{?Fd4G0#gX$z`VRa!|ӨZ"X-Eڲ#2=[6cSZY8cl\zqZ%y/Cfv^:#A~kVb*KNV"y^;mGNnP؟KI/fNЎ|5eS2ehdxC%O;ȣvD}9@!MgIAljQ3Y`!UMײJJL+~RԢB#\#s9"*{H73CpE 7ba [<'@KVCUd ZKl;91Rb;LB\ATӆS \(z`Q'Èɾa&r σGd!IXM8<6RDthd' (a-wݾP/g4^.]3&/cPxioy7G47^qmcO.,${U; ]U=fMrCޣR<2G"@ hYy[B 7sK<[΀1-4|[%ٌ98kro;ULA*/0evHQKx x\׫|g>h \;VwQzN$;~~9PZhd^hocQxU}s3&Gqz++nI>P!iSu?Sh4K,/pz\SlYFtl Mq.huG~v \]v| At_EB)|Cqw :ƊBU b>V9tظ|J^28k2^4X .3ɹך'ivi8\!P}dr@jҒ TOuޅLN7` Ϲd`//E$#Ӟ'٦N=«hrw֏ 5I-pu,WSy!o!㸉\߼i3>g¬iKWIr/ {EtY/6g4(M(M޹ђ6CadPfJ{lp|Ji}ÜH^C no|ڶ=˶@nwC*N( 3wT{j叙J&fnHpNwl%y}W]z'yCd<m8U$vFD\6{gH VW0Pc䚶iRLxڢ 2|55v ,=uEZƇg1FygЍ!0H쇼g;N"j/"Ⱥ=K29~"VsA KmJ, Ա,8Cv0^fhdQ!\Z:aj@~C/lb!?LJ=v~ڏ(Gi>'=tݏ ;Qr;U,KҞEӽ 9=mNW ,ЖdC y$5lļRw)W 6x7[(x+ܶSe]fYV6fwȞZjW#sL1;HI.K4> k<)X·oTu&]| Z)c82j$?u9z8Or`Y \f&QG򥇿)P*R"8CY32]aMpifi0| ]d`(*5KRf[HPǍK8QQ|bO|y[G?}+Q:tU5R_z\  [b: k: quy?I"fU&11WRoF¿po_`|4`} nkYMLV Z p O)n'NBS=\N!ޗܜέc 쮯lF>_nvNad02ֿXG=]'F(,ܩfqED6ͺ+||d6jC䝈8eB#!AޢCBÇ߳cPkHB4* VMyeYWUweZgTfcI'rhM?[G2V8I,C:w'y)ZU&D/ Q-Lg=盍Q3)+,G,nk6eu=).r#Q|* +[5(&DEJR1GVua$noW@^m#GH$4Wamt“!l%uhf$.uI6A(5wں&9C|Ҩ *r΅>8+s?)Vy"?u. ;BkZ46!BR,⮉׌Su.m'*4^ls(X{NɈVVX!هpa#ndZtr3~nH-lw-3ms^cK3u&QMh%^՜p;J 9+H#1cط> 1eڦTCUR$;1ً7?$d71IPm?>S!O1dSsޜ]礸ڄg99gSyqo1k+P&ސ@S %CRn֭*9B76t1#/"k{DF 26k:ۢT1ch.tӉ%WWTX.A *ZJү.:Z A19H'i%H+/usLjGVa@*^j޶~ :ɮ/`ǧЏGB"`;`TVdd% {P&ј۠8$EkN ~Y8*1p'nZvE̻iIU6KTSaF|=P }1Quuh: NxZwE 5tr%{qՁ{{E~ >;&"|0=PzA SNq&3yQp ۪/ǧs vuj$ne}Q6ܷg#C[ N#tr6Q"!t z:v'dH%%:u$-AVt(AbX`wW6σ=!;f?PUKEZ"ЬAcxٚ{rVҢDΓO^YmW)FDc{{ K&C^"}+ѪDjp^Em RvvjP'l~essLgٷ.V󈚜~E}Ѕ5oIŭ5ؾF KLlBoEd#ԣ;tU}X UvV_#^7@6+JF8ъUۂYɓ>=B}B '˜,0\-!sZӭ_E} }-qrⶐHS(VqQ6E$a/k'[yce%)C'5 D$-ՠĂ"ɼx^)ϮG9@ÃJ[_$qJe UX!m0JU_sx0,0ͥ@!ɪ]XP!BL3L|.j@;?x(Y=+-.=^21jth"GY@)n;<|N@Pz8g%jZTI*"_6br"IU. #ߤc: |^u7x HO]V[RWZPڙ | HC{8okyAgs9*q:(|ֶyԴwz>6$#Ktt3y4⸍G_ĵKFtk̔3sE.sqRFj!M~bA9OzW{o F%f'Ydߋ^:yu{ 81q_@AD̃6xbDdh7cں/#?^^=tA \3pLPe`F,LW67eSQ-W.Kg@m׽~RW"|LEL@>$*N+f@oF)Dl^^#V "=הvR#֨]2D2'Мˏ$Jcl {RExp '``P|L 0-,ęΡ(IoM( HSϭ Sڔ ăPc'Ǭ3>1CP4e4>&'&-sjAUq2DZ_ Pg]l ݗ:橨IPTEvXRInHҼ(-_ax)5ٹʎtNs/\d.%cIZ@5t,QD7GDÈ"L])VV:pDy3"y6l2\p?B䌏F464(kav!@CyAup1m PwH: 9c*NNd8{ M4a upul);FhUK)wg`/y"6wP$2:d~rV Nx(ҾMΫa*HB`ΪOPDA}qtIT6&6{9[}$y\fޫclQ ٕ߫Vc 4\2P@ia"!#\Aκ!U>2"1Zc"kRDެÖߎhDZ(= NLa{Ԧ0?fŬxlD8,[go 0h̃ch9 F[ogL CߚBP_4!nJe4v5G˟Tf/_ҳbǵ0fv >cS.O2P 4ePULF)JS*BU 8=#]:oQN@)ty HIGU~3母+Ic +`Y7ǩ|I9L7fa9h6ө%a&vې~eIOcK@iAhhb}BpMh`BS(䘩N(%EGXcRT@4%ۥޛI y@)G6}ӃNT  a Qս E[c?4X- iLnAT% ;"*vǦTuJf\[i[0s+ic;[gv6y:M$3j];rdg 7pHއtCtTd#9 ,ueJoTqbN*f,[z^/M Lt4Dv]/4=k1PVpC XL"" -=V4Z87Jpb ,~-6; i>Kq!`R>Ïp.;@XEymąTR+Z3E.C f}oԖ,vYG~]]5{S{\7hwO7_d8C/P[C%""β{ 9rǵvl!;Ѐ糧Adl@own(xjv̧?zUoP+&7!8!X @aB w#.sO'̉! Pw1PH(z\}Oz0t< h%Ә{ZmM! A ax8i ^%%Ep}ZN9"}z2 ]I@ Z4]`1vfsr j U}ԺEJn}=v~jrk!Klo PRFPB+D:arS/b=oTERHjbNg6Wa~BA7(|=Fj;ih`\ }/Fr4P"I SQ|B޻80GBn?^*l,ǩٰ,Qs&hNcpN7 x-fm[1s{aKKՙ"'cur"'5"a*4Rlk73)kobDW|O J~4sy>)7n#0H,; n) uBSuBUa|~Q4H^x2j'Mٻs?qh*Ҿ#+k&qJg;L恛#3k(,8aJF}+rpPIlCl2pgtxlexa=1IfAik|17dA(f9dyN7'Y*⩏sEN+{(y ŵ:N:ĭ;,clk.U JK#P)t *la> N|OUc^Z˦Bf+ɸ))CB~kl/^&p5/f ff[HO49¤ #q(ܽ)=Oӳ Px!.mCƘ\k%5C x.GrUsԳjQ`DRB 2ۯ(pA\p-nccTt[Clm(7qF;9^tWfjFC':y2MM믌ov*t 2XŸw wn4/߹3[,Ij_A*\;;e%&yhgu{_e}H"RGX|ʀVZउŒ8ǮYEҐG1=wZ!: g闑\9ZǬ /IqV4մ -}@ B9?-lIkgzL Dgb0@FT6 ^䀾WD ^rxpʁ"E<҉O6"H5ұa@z>jJ&]fQ/XZ aoFcZ#.^6J{a l"(g}7A( 7ϐ.\R8XPuƜRMdFdfԑ<28MW{ .a #>! 4wJ}k !%PbY\C!EMG4{|P=gc2 >$qq#6nH qP|bA̋)} ՚.]#$ҭ~qJa4O߈@-^Z}V}GJ|kй}*_W`VD.:9jn<[w_ZrXm(~I+%vަ R-m:r|p|f #9LNWE"&&E2ij$&:gLoG1); U KNIx,f{s`K ?O  zS*TȎ.%i/jEX U'wB~ KjXJ{vD$rJ5#|/ `V$z?0=\c\PY$`ESS\&))edϓX%tz4.q L"R)/Itv.`.GۓzL ?3ːx7hݡH.`ov3]~(>1bZ Vm<7UN~S~ةsDN- Wɠ+>Z ~y`573i[BMIjd][MZz\wE]%Y͛~Nífӈ.&pDgcᒭVR_Qhԟ?maڔW^ycojH?"`Vw:2H֓OUCDyUy: l08J]{=sʆ;m= /2)AN )u7v"چ='2d5h~!9R):߫Z"W}${}0YAך4ۀ6.*\Q}Ud')+398T=q '/ZmmF^/z@VHyxG0-=Ulh APh9IuOJ9V847+?hFM~fgↆ hEM9\7џtѿ&%sWѻ~/W '$3NƒGNX,n+)*@@ ҉ $-z BuR{&ٔ[$eAEWOiww bvOy&n>D.RppHޏs:OKVb#ѠjqP5լ5%h/69+r>ҷOgK|̔?Dp`rAo$*XVTҍ8ա7DT2Q%I C+YG9PRL@!iR^]-ac?H~)vq'|P 貃PL~Xm'*LvfO|N5.~4xf= O0+~+2<pr j.fszx-#o3[ S̒O4Q+^OT@pvn{?OY0Wa)? gkD9+l -oGbXJ>|JQ,i8}DKQh@V2 j4s R8y8: M9Xqwt͞ن@LuvP/e-]oFqAF"ak5ɸ^4ڀM`1SV](U@= R/40V`ˊɽщJP^eMWSfG)_C! Ҿ5}0`|~ͭ(\m}"%|VWQ6*].όiYkf@?Z@!#Rva`XYE**vM*S0ː]ÖCɁ~^f=<,&fħTsqaz>f..ؑޤD|y{&3\m6h5JB?jh^n 6 =?~[  o3t\89ƹ183Y |uu M X2/+3YrG@JGhGBz?OQ1͇fti*PH|![#OԨѺ* sE}-CTMwIHt{ _iZ|%Ssp/bǑQl$)tiF]{v)3Luq V3ʀN"6yhl9ضBNT`":bK)B+Hу(fVN/Ӹᵕ^ =ïjE^ jjT"t4Aaad 3׫{#GtRvxG31v4*OehUan:K闄l-d)2=Qb2<\ eqbϐz|HoρW x1L轔zɎuR-/}4?ҏ@`z7Uk饸RûRjS@k.#:+Z9$;)i d|,lg|3^V)yT]@.R<@Dt=9|q,Kn_9kTp J}_&Ian#sJinC PgR@4Uͬ雩;+ ΅ÏBI;Y??޶l8`xȼneF@ZI5m)}hg Ⱥs(g>%č^sl|foM@x*oŵmI+[H'ɣB bVqU1wa&_yU?XFi<([3W|x[$8v77L:$Y3LSs.̷}טQwklK0o;Lվ~DaD[𔿷 H82sF i`t~ ż ݁1|>[~žk}Pmsa$'[YfRȓ̯ _XZd ד >!.]|}Fiˌcΰ-M)~)y%d 96m'hQGbC9a$S5/sTpȘڴ|HUm& ×wOi9'G R7& $([?Un2(jt3NvAGq9%]M~1 (匕-k e1!} ֤.ԗdL2 !^|#VI7SD[?hG ,go+d} n>%4Y7,QQƜ3[W5/zL9~S&(i>4BZlp'6VjXHUy85B1eޛNqvHbYS7BKp""#qe-&u6i!8:!)ΣvxHI;yDA`Pq.72Q[_$SH8- RO;Zri|طL݄,߸H5:c+M+Xd_«yFR +ZU  '*4'Q[.F1|xNR}qtjɒ{c-[S4 195rufQ`|Dz{TW^^˳mn HG^C+ s?mUV 8vv%.}*"NB hW!AZ-tOӟE4.%:lrɔmZRJԌag/0eIHSOӑE`7ƣa7fVw|g1 d"3 ľVRpY<,Pg=EcX|$HڈAov^8M_pk_~2Ύ3aN&W%' oVPC)% ,QW jFl/.L/%_c5*'䲽gB= 0mJ$&4@RYOM,iԌv{- p5/t=j&}/Rf5UDsFYjv UȊР 0gzK#dMJVggKkuo$]OJM|o䪤6+g !lG@ '9KHTJI&HHrfk^dOUIQ^j*>O!(|-"b; =kdY5e_qi[z<]n0AǮq6_k_MW0\=zڭU QWo3]F٭cXc%J?OIS,Vgqin{h!> iJ)2I ءjx8>'׍Q'GZb^7oN(`a+!uj8_om GmG`]Qs[qʹ(B%a/b aTe2/5{-?=/nGl>/(m'eoў6邹)h/H42{(Q8dD+i0`+(3nO[$t"_ACj "n@L3h+٘dlVCx#{Ȭܾkt#e>v:sFm( 7ٔeÜ Ń%C/v=o0 N6'/ \2(I$䜫9*xN6ʴlx*NbA%p4f81b2YC5.i39fT,)$ٺQBt(0g : L<(zrGҮHE:.kWʊyGۇq܁6څ̼{ 1e ;Br%LJI:zA+s.gtS ]6eH #7ݓ=T0/q[ز\'%a]nkms-*rs v,E _[8⍙ag`gڀ/ƺ~q)0R{}'H N2ۆӦKt{9u򳎄+@’mNKps&_~yBÆPcz D7`{Z- aKyzg}r&#u.h8svGI>V@ֺӳfn''p0,.t_l;EӪ$Q9Tw0۰y T fbg(Zf OVS#VE 7j,/x濾(+_^5RtBۭa /SV05<.$}ԎJPuƥ`jikΌtLL:McuOQIq4gY}u V'Ҟ{tr3J2a9dLdܷQsͭÑmyDzqL2LWloRiCQ)XZpL+p1ׄ\:|ZQMo"qr¬eb}O4nUGb\u"kc#bÅR]LWW)Ǔ[\^EHfPR4ސJTwq,W;^봔59)ʖzu227n`\ ,H-UXwcˋRYma viwMYHI|2fVf.}X>X1}g}fˢ|bì+yu7 qԣƗRr`O}DM:5%}}.^Z*q1 =HRg_Y6!XOI2F&J^W5ruJJ)8Sfq@Z}a^Z-I[[*|f횳f#P׃OQCP;OhR*V Ⱬ ׀hi6Tߒ% ˑ)12x @"B`*^_5RrwU:vxs9|2Zbl{n @&ݷG>.wMs6V>tA(qYhTИ38:" ;iВf@pjwn*G[bIdȰuKg&_yi84 'g/UKXO RHL&+gUa`^ɽ/%Xv7b:6#>PZ7%YYQaBv)AFe&jdyCGOے%Q olarU:Z3$I/KGkoehzD8q– PS KԐuf8Մ\<|ApUi\&Y压ңig2=v1AԢE׿d(XT3 mn41`dMu7˙rA6 r,0{E$? h@xe5* i6|O4&q4]Maynx\ZG:D\%=! .ތbE/@~Hfl0rH(G׌yLVo(B=1wh-!1ub++_lC .> gcshR; Kt\똟5ڟ:Oڎn+ M~u\a_B! ]%I:Jzv2qu#!U\7ߐ´0otCrl$FW'3|j8HCjof7mB7* /6VTz &7^)nGxB2˜nVU(e(sk|$bD68E _ J8@\!%(~Z^@'ttNS[]7ZϤMa35 55o%Ȝf$MKd2$o#xF[m$aSe[Bz}Mqݍa4aߴuxqw렢3HŗuɏEGIC(~T1IMb=ّ EPtuZ<t\=ByVVdOɚ8H*; ( -sV[Li7+n]8eѐ'mw*c+zH}vCn>t-_%DAqq; b6yLnp4nhvv$/dŹYHyUrƪ*TL䥵DUU >_mZßE4{1޷>Yy{7NzdX 2dշ>=x6 , N7cDLt:6:rf+  iփl.Gb ]7c3-AzAty*|:'܆p4C¹DAR35šW\Yv"3N Q V]q@\%iJ&o'u y[b[ikP18):%`%TAm7r}5VO)Jt%뒛6{.G:6цf ~tC~j?n9?6>sPSbox4'oYks\H':Zk`kCMC[_o]G"DqЅJzhh5 pC4*UQJ9 ^-(3q!ʃCdD_ ^]3Xe&T]" !JnK[*Vp5TL O!>7̠޹Н8Q4na \P.t3Rw5se% dfU%:l #{TCj;I|q)y0$/;{#BToJl8Mg蝞jƦ# {+ B "r0@ ACfbp`Ȝ񘫨AsV:o5,}7QZjrL X]-qҘ<[)z~A\/YBj|_? + Oƣ+ il$(V B>0NT %?@T5k&j$M}{.t(,)!̰3jQ3fi2wIsZp',ӱf"68\m2պoʑh<f?;B1-k{LʗQb M_=]t8׊US͟=aOx7ͬ4)[0!XzI˭I3:e,HGD"5Ŕ"M3j o6SLQ9^Jm9I(QH@O=%aQ)((Mce@rIZ`?ES>=GK a)Urn$܋<вKKl >Re qκօdrbL[W¥͜qB30z :sEL4{cA[6݂eqZ;8*V{ҲzkFb =\-Ԥ!qC.Ql淡C1^aFwH/q0-;mK3 x;cǤT /BW9lxm$>&!cJR~n7 \li[@%@c86J dvpbn | 1JA?5v)O *z9ȡ Pnff?W%7WuAXYHX[-N7ZQ c{jx 2@Q ɮ^u 9c(8"&ޥŎ@KmNG}^T`Y4]⭘q?OHXsS,g][^ipc gDx~C•8ws95 Bu`( C7GU.JD/n Pg4ݑ OKE&OO ?!J4M37F"nyM3GI$e@KDeQq\V1MSx1ZlQ>xONŬ%; 9S ݋&$C3L;tl_:%1_xyq|,9 aċr1iL'xKl`w! Ug`\]q!k;S;iǬDŰFV] TgeEи.2mo>9[1h%y O]8ݵob]+Kt<@P? |\ uqe0OY>`|?|] 'G_9Wq\~1jި8ODN'4) tHK9 K$(>ԜkBQ \[}ivJFahv0_U^s̡BbGFk9Y{R' gi5c_1-ix^+7 @ 08a(.K0&=MYFD"(}qP;|1A)(^ vh,1 g%8$׋EGXMH2?˒1^..Ohpf nW@-3V0m}Ċ&&;]`"Yc_sY~srP@de4\xNᗅ,iӛA}˒bڌU\p@`L$RkjI};C(zy*kƑH5 +i2gk!Rl33e)d!_uTI|\92Rsq=e< 4*: raq,A8\ocPf1ICat5l4VW)@% zb~rYf0y95s[z^0gŅ՛Pš=]+㇏ж7g#k{Z\d`atJ1~cEEUvuf5s)rbi]s#a8O]j͒Ѣuv_,4KEkKFu<x2hlow CNǑ]a9TQJS?&#`uΪT٨qů2Ӧ߽$h}kmFPV 6EP!Iok}%#69>)1@*x*a~6p'oH b {JgPw,ȫ&<6`{'ֵq<2gɺ%,r*d]\sk{Oeϫ8S}P *_HT}@Z@絗tβp~Ky4bR%h2%Oa #S#l؉5݇C\qZhnYP)0:\o: t.՝~볙yu~L_EicVe`׏ "hs4OL*} t5 d䰨 pvHrU53/WgYP)9/MAV+'YS:;tTJ :aSo)2{7^n Rˢ]0C ]&s$}P\w=NhؠFD)ׂ[SOi_pޤ m{8NG@[F$h3?ꮦ-IxtkRZ1skTID <6d~{Y 2,>}XM'op!mg}XpJ(|`bDG{q7v{1ۋ~!sH_r4T5H/ jMD |W.wVѦHo[Hǝࡐj1Lw\.HՔN%V| NFי%]]a*L˫%**5D^wy«S ˙ FŒIZ&O!R ,>I2AR c$:2'~$+#Yʖ經R^4`6-5 UC}/K/؟}X@/ OxVSl! >aO^-Mڸ(Gڎ g" Θ3懣"3[WlɡčaK@濃}!JtzvZB2Rv;ʹ4O]IJ8wRw^(3&lVb-JQHjm]vX+kLwaPƞ:\0 atc%β=s:TDʴ'jQ,N&g]?5WY߂Vgu䶺 3YNrճٯ_߮]G5&jF66ڪZ Ԩ{9_iDnjd@_pZW'.=7f&z.=f# 4=,@«cNۼzlAW#kæSyl=Tq%^jB+'O(Le$?_ea>hI3"Y۵i0<]tuwy%ԁ?pij<\5]>{Wc={Wti7^f7fAblS鶼g_3- gŕrzNeM=aqpT#^llr\|GM_BZ\ /Uxӗ\zykYq+8gbA#9>D>եr" $\ChAjc%69 NSL^$k 1NB 4{>m([s«Ǣ= VVߘS dwO-1ipa~ _檇lYC}-{^i#* ܜ.FUM,ǬT2;uCI0BWZŐҚSdWK̮jlz@,^OVc#o' yVM ώ}?]p!"(R L77t|;7YIuN lꑌДخ wJpbafċTZ&\!X`G`\U# #AtGAZBpUdA鷶% "ޯuԘŨnCq.QyvhnJjF|;1 멟c==,ح}XZDiKK 0>l>zB SX&=9m&K<t_W([/Q2Қ `4p44uu+2AaUteJMŷ m[˧:DA+ ؝.8P6'TA+:{Gb"'&0ͲGGdhE(8dfgv7۹̋̆<̖΁nF67Ytvӭ-kI[r`2?cqsf͂U%Z4ji|MWqh4N wy8$48,@-HHpr4F֢xdS;,G+%*>uH!G\[JD hM X x; X4EeBa&R)Tkb[E6LY.kʙc=웤6 JAPud$;Lν(֦gnԹK~2M B(Oldtr_Eo6E۠V`p ho`%' .S^ck'MYҲ3+I>qA2"FM h(´*VG>G0W{"E*sJdn5G,gћ=a"sY-ª |K|yWݼQ:QxM -ܗlőaڣƕo-!71Ԋ!ۍWz^^E{Y 5컮,99jjL.hpdɵq+F}O9F<患a<AsYI =-txV;VB'&ܩ3 |K3yPR̨ ^8M <"^25;;P13OuX^Q.m%C*Vo4~NFM@?҂4nN 'wdU ?WTHw259F2-<鞓_f>Gך짐h|ڌ$tp)_zv>|B̬ +GĂNf:/ _4KYFSۥ0vpso^3WhOWnˤm7:qQ ̃sV Z٤&s^l͞aź?m>ɗI'SYb eϐEⳒ_Û/Uǒ4YoJ2].qyE^.sb.̅ Iwy_ -1ȤOa X I[(_znz^7=R.%0$_εȚ  0U!^jTCG@|U ѧ o$Jڙ}u̵[n`+N0MpDV5^{sjg&FXJɝP2sirnE,g9'GY*/8Զ5YD7߁)xuYBk249n7h/ravp|(oyrKvNx!ÉR+HhQ:룹o}C%{dK[L|V7zΰLb"|d bgڌͩQh@VǗ~hT'7M'cUiyR az((߈y(Ϗ腪%n_xLEB=JNJ OrYHш_;)vTT5hjhل.Lv avQ"[K+nX"Iө\H[-#ۿSMHn)"CTΓ`!Bj14fx%-R$6fЪ摑Z|;qxi]fsIh4O~ QpVU_ꒀ!ta9/m zVNAߗ DfLS_T$<ظM-qMc||~bm:+Esl{n0W2c5n˯/_혺^7*σ&pX;xA9@o3O_  2̥ÔY৻ ⨰a 06l|?t/΋5h"/{UG,{*cDs{eqmDي: )!o5wA6ٺkʠ2j ejO]sC*-r3a c@<O8DBҩRs3.i#;^S֟.|̆@ayZB@)25 i|#i=9zqrHCb82mB$C}DmG0 a.jZZM!򬝴;pt]pK{/B:Sg༬ЎI V!:9A[v^`_os2/共Jsҷ_/1gsLKv5SA㷏2+,Vcq9Xg¨K0#$&~XCoa~ |<9* _1Nk\/Avb5ͤ %}~Bv Q^͡渂8UA$z`*Zs.;?2u^O&MрRȨ0j ?yVLpXƑ4Q)*SLv!(gWb#ɥo I"6lk -(W hjDKW@vxӧ}o?Q+>c!ï >&ɥ[c;oyYxv) <׾lY߾Z!U j[ll3s Q5X.\ TkZ{F:ߢdݷT}҆Z6,W(i?Q*_>@CB XX o!#-]oz*I8%t-|f-Ļe٨(;~.D1 SEx} zKrJ|~苉MYmq,`sVX=+P&1Htlm$ϪB|ݎ)`aWP峛C[NʢMwctIt}UZt }hF0#X9ESCN dA9pCRiv55ذ[du4]d `~!(+_JAS LwrYɩIzR^O/|nU Ҷ_lq}ϼܦr ´ rD|S\m{;JSVM}dj9W4gѓH*+k U(%<`(V R Xm\ksSs',H70H2[о- _ v^"(9d0/J8n2Əe:WuUj:\p֬έrezrnFAf`A$Ur9R?k T݅3\t;Sl*g{ +9hʟL6k%s ;+9bh`yd_{I2i2a5m'$]4U|(\*oM|,ydOFsnlD w#HcI^w?P~!B pQDҏ=/ y)#߳O[lE3|ϔ b ?F_+ "9C +2KȱAsī. 7QMqAϼ5T2Ni7O0lIeWQӿ Й:*Nhvj/l-e<[ 3%p1wYQ~Ô!)9[io#P2E\8#. BjqZX˨/i۳|&>h:w@r!#l7&r#L2_t&SOפh'{Sm$F 1\t8O;C$ORS,OrX6},KKܥ(EfȌݫXeO -}Q/ϛKxPl!Ć/~ƚ ),<`)gBAdR-jXPq7[6+1d)#yZџ!vqmb]1ƻkx\ݎGD>o¤gB #':kraiGU7tU5\T?%r7ۗcCÍ@p|g)9Y-t3g/H-9謺ڨ-3yd=n܃\Op~yq3-5^ĥ}HV9,,H<:xiddLOu^/U-Ө FmV]]"\z_=sA(q&Ȫ/yQlW .ZrzM>P iVEF{x$Qq3ׇ&b;炕n4(YAsu}OUe&x)13-p b ނr@$|>݁ԇeWiu\׶`^RS3K.>od-"ϩ#G gA)|xxj[߬vNM!D%IٱN8I={1rԘjf;83n8<#RoK@D|27tpɸDDwv[ 3hk2yjTL+1B-yg: D(qƨC ma`"iq5&ekS9w^&,%[׬Y.=B9& E5%x2ј LiDh sXuDdd>"c3}T\O ƊXƇ1RYH1_UJO nB veW<3c *fmoA)IMzNo/^+*@Lgl*^iyD-MLKJ*Q|kOeϷ)cЙK?7t.@<^ۃŝc"RF~g!.U_!>bn%/rt~˵Poxh7nh _r<=̣Ah2t>M +u396\:U*mdHSzbc?ɿ+>+Ӷ=\L-MB܏B$~F֣#N^|]B LVԮҨgdfq%w$,f@ otA!ȌPԴ 쩕)^0JsafBbٕJ؁FZ^tSZ{ 2 ƦW#H&Y"CUJ$??U>`e{o35(%*H/<<+ĀXvʹlͿ0E])IJ-o/ߢ\K#lu84+cR?=lU!qZcX!\2_w~$ wsda4ߏiuIȓ c%j S k'Hٖ/DG_}>&h,v!49K&ےhAKPۓʧef5Ռ1JJ-17"gsЩ'p0;&,.Ϳ41_&Eφc&$Hi=ǻ2URC| 5Ql=G k_(B8\IU]% /YOJ%j#(nr6;|!jHge>kh-β/v 륖l 7xE%9mO}g U ݁-Zf)w]ĐG_.$kÝz{Kw\?8mK`=ci2`+V~ &|"/b|.n0 V` )M(j LXiƃgZ'OR'z樀zeIZڨx?? h$0 , Ä>-+I(7ؿx Szx|+\%6`E&y8+8MoL[~nA] H١ A,}vtmm!3A\PJV]ڝQϘ #vx++˶K pKT-dB޼&cXe@,>ڱft@sˋg&wax\HD&G`(!S*]˽Gs@.ֽ0ZθY(> !6n6;&%"2Y̜_kܔ|~<0>*8zxH\ku+lMq(rj>uh.P!+Ah;POe.y L;S'? .ɣUݖ<^(*Ќ}q)LJ¾P\dDG^J[*d/:jǗ1Ւ!,R^,p%2I0/Z: L ½"?l{tga2B -JI{6j\f\4 /&/_glNє߫rym_m∵Ʊ!iF,Ì(aD\>!] 8F;64D&hKP\"Bc[j¶ן[m3];F|zWkCDshyZc1]m;*06%9+DBlG/f^׃2zo ekjO/Qӡ_#f@y3ٽx+Qx (%fۚÊ 5\t((it@'M34>d񉆳'ca#θ=vjՍ!ZPUG3&S Y&XI*Io3[%AW 󕘝Xn[$~մbnS%"[Z\8vu[f2 =i4eF6KmUrTrJ$&x\8 Q{dJ*cR򐍕B!T&9f9u%&<FmEdp"똨xO:d`}S:zu"Py/^s{H/c,:T3lAG16,;@3P. nH\IYoxF?ny"xMbX둞DϏv0ZN4O %HXn< 4 Dپhw2^i+]FBEo_:4.5b˴2UӅڗJ&*ވz\f4~JúJaW'ԇd gն2M"a9/$lKK's'C$b\{ɼ#w+.+kf]*I: xyvCy:ރTE:DeCLC6Ysv y8T:d-Odp|CوYN(?'i-"r6~4X҉H8gUu=jKSˁݝ+y7$c"®xboڶEVq{lG3 %A% ^P5|_ԮlƢXt3XYh>ZWy)MA0X|v d ,R/3תdaw z~&\ ;buEXFN˺ D-b* F?bΗ&!/0Ηs9t^o 5' ֜xH##@@O'ȅPM7#gҽʇZ-w=Uiz5ɵlr_ށk\̜Z~_ARNO };͎ cCѪAQiY`ճbhas zs|hqK=~J /-xb@E&suJ(ј; ՗p3Y'2l=CE>}NA!Gc#}V*;zJyJ&!hIc,jdA2"20 $ƽJaT+.]wy$a!ms16T"*; 4=Pk]`ytT>SSJ: ٺ*m*h? !v?r~CSljy+.X새d֘eiT-gt| "a! NM/d$R*_)CS&lXj+4O,d ]Ž[aLNZ$dUҵ{w^|.bi lڒi^,V^@ (;^x Gyp1])tM@VU }P^%ӥ+#o)Tg}\gϟSZ}W1*àoPeղV52U,DU<9+/P=rxKyשfyi^zoq"ϋ QP-UY\` h*vCRO^I>K͎^ƞmu(3J f~553Ɯ@&"VgXFZ"dL$Ì9:>J9/uӹLv!IV!)6>x7Mf44 ^'T5^4*ԭ:M2XaxW,vШ^rwO`}! QBb:fߤŁhƦA$Pۋ~o."h^{F>qhma8z`ᯎlnF%*&$wcU^ڝjs%oWލⲖİg+Opj?J^r:!(DzbzUZkXf|ꑮy+ O}ĐӔ1~ =F!:dHcRT8•I[9Эb/.wQUw!}DQ㉝D<,?ÕwJ':F^~(OB>KEX0/p|,dVcYMic3Xݢ_3y$f7{<a /PZ_;Iƀao>F oH~Gh7wO|}H={w>B'[s)T)z2c}s7빔q(8Lu"_mvdWQ%&@ ȯS_/?GKܙS*ی OE1ϴEq=%[Yq FpD`}7p qKѓhG[!!-h3ry.̕ 7~`ȖмE%@@n (Q:,FY8KFt7Áx0u,,KL.Z%Pޱ%/&[R΃ygLf$XqL׾aY] }954 ȀMѝ2a{`fB|wZ5E ß$ǭ,a6er7tӈ; BUֆѴ$soi^E2 trPּlUw. je" ɒv`NU('1?7scWs <๥XV''0{R7pDٙQ2b <^&}K ?+v!m&) է׳"k>7-F20R(/$ݍ3 QoATYؙRKe7JHQčAh܏CEXNAA9C瑛9"~VkHU8 cˈf lvSL8<'TP!.<JiA'{'d~}@_!~| cLLg63 S@]k Ԅq4j)jmOcr#CY˿53XCN0F93vgKnŀɇYc+Hk02k|D@]EqEF]^Ӹ׺dRd3)yH/C FQfl֝nZy L@UG]U0"͟15vW?XjiLs0oA=~WG^vZ0Oais&S1%T{ Vx\ۑl\Yqo.Wԕ.: |ی,=)i<u]UV-{lưɉЍuX>xeЯ,F鈹 aHSW4Su=9kz\;lu뜉T͒|54}P@Bla|K$"ՂbXd?nfQ89L҅t/.Q}`n/|@ G(yҴenuȷ1_$_%5rem }Q}g9錂='ZS*z Aވ䦔R;>2G0hz5JebItVq{ z}\U`i2k v4ը͕ǸE)'XrTGi>_mjbRLL8UǬK:ӪG5_M7| )!I[W:!)ֽc`fO.\Ըgk6HbXP/8-虳s},`B[zrIVa&cͮ{k0|fI[8k^\ߎj({5LsuެhЇV)`v]D_,r"Wa-D}eņs{p)9b =5k@Frk2u >=BoɱS4tM"˨tJat:LlhqNwtٱ(#(ˡr/_b W/e%OT?SD?Ȥ;GVy|P7#b](6/u8} @sT!|@d._RK~G* x/BC9>QbSâ7W1E❭b|EƲe*^| E|P.ɷh{mPQ }O#7p26YVL(#!ٲ3o'1$c6?@rC桖oZgU@N 2QfڋQn6B+/՛7 j%}y˙LJZ슸ǪnMBdMMiwI8fn&smm wf~5M=vW۶o1y;'$2}@ !pQzLVF6s)a 70.楧L/g*L|r%{\lR||aO)0*d&RY Q&GZލo} #._piVװl^^* ]ڡ-M =2H#oJ|O3H:*¯[ː[ɃeMݦ:Aa(121{,CUWTJlPG N-kFnt4I.AMgel!̧(g$ J$IEY߫If?6#SPnC;f;leqNͰ(i⼬Vb_Q#jw--IǬ/Տv]>gSn՜2Жo՞qkjQ;6#Wz`r{#r,w \ #ƕR{%ׄFaCp .hv b!6*tu[;*(R-ʛmR:r`tkʗUlM:[CV!ɖJ3 .,kǦ-{ICĎ|Z77b;Y0뺷&Ǜ]Fv=)׃_2rZ*X-~ۙDD-;[Lī3#Rzņ(BbYLhCmc võZ{9dN^MA(SL?ނp1ff%As~Ys'%m|j,8/r yo%ȭ"bXsysɰm-_|IwL"HCfLyN F}Aː!w:.\^Y}Aκl X֡GV ΄d|bQIa{n:! yo%|.S Nb>8gs;Oy#sZ1J,lkG|R#<ɳ"{XAv7r&ـE}b&9ua̗0ӗb+74]-v8"*yNi=niKQ qd-$!Ga/srM5|#l`:Wb@]a.:|v6yMr['h5hB{iUL\ŽXߤJ]$+Gx_vW,Q*| j5dx=lY~'xr=9?,XK9Yp*>A&'~JYf}^)̏릩Up2)AfSvN LÉi@wJMm{gWkp?@i%N Wj{^4l]W+Zls~M吹*Ry:AFdU * YZ