openscap-utils-1.3.5-3.6.1 >  A agp9|et-=نyZ(;YfdCwwC?_WyͳƶCߒXX;d)O,{3#gO] |\n#V71-#Wp+<^&VivnȠSuzQ`糽wƲ\^[_jW*mQ}{q`ړ?x`] ξ HRUd0nSXce176419ad9c1dac25ddb85ef7893459f68bc91da344eca1c5dc7a7d7dbb0bb891a87db7f936c4d3a04bd6cda2b475eca99133eexagp9|,DHKco*a')YZF- 89ö;h\̷F[. )VfâRvfyӌRlۂnHrIc%9BM$ڤ;2o9%M5hRm16 %i' !qsE7F՞\:]}V,Hپo+fߐ <<@.vr&ӴO4V-h_M-`/LϪ| b駽RBYE!x>pF?pd  0  '-5Y   P  ~    _ O<d~(8/9/:/=>?@FGH I|XY\]^SbcdHeMfPlRuhv wxxyz $*lCopenscap-utils1.3.53.6.1Openscap utilitiesThe openscap-utils package contains various utilities based on openscap library.ag ibs-arm-3SUSE Linux Enterprise 15SUSE LLC LGPL-2.1-or-laterhttps://www.suse.com/System/Monitoringhttps://www.open-scap.org/linuxaarch64 if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in oscap-scan.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in oscap-scan.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable oscap-scan.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop oscap-scan.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in oscap-scan.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart oscap-scan.service ) || : fi fiH P; /'Rˁ큤A큤`agG```agF```agFagG`ag `agF````````2a38a20b37795feb3d83ca971791742e3fdc3fa6a13cd9ee3b67d3f4561c2017c17f840d9951a5c0b0d76b739053f83998f0484e16aac5a59610c645a61415c1ed54695a9b70f513c554f01999f4a6a55ae2986154b9d26c4e05823c64ef80c00809e29fa1c7c33e35c57379962e96e4dc38813c253bb54fbb333d627665666673385d11262550a7b1c665991419b53cdb491208bc03b25e1b914f834c55a48c0b328389d2ffc3b2b8e782216a31d589d14c3d966b5d76e0079a5ffa87752d882431ef7ba3264c0c0ced4d2ce779544a3f34f7fa2192dd6404da922ccd6b444cbebdeeec653a40c114909265d5386a29f1e4afa71bcaa632bbaba01b21ff90db24c7db43e1a984f84bd67c986c9c28ec99963be13f3a6fbe2bc58291ef8377dc92372ceaa10c867c308439081dca611a93e2069078cf81aae562a6a5238dadd28b6080b26f7430a8688f761af93e373185f02c801452a6e2fac919d9fbc593efe8135d3ba56802f925980aa66cbffd7841bd10e92888a927bc058ae1bfea23d0de3ebe1fd0cd236487ebd6e476311cc700b53f2fabb20cd4da634bd94e9521c8f1090cfaa6dc15d52ce84af9ca759af21e153034213d4ca817ddf353c2b77c8dfbea23214a33fe3561603ea2db357b39b56904e61441f9d18af1e24450ca47dd4d806c77c65560e602bc236887cd94db8e29717ee158cb3c22c9e0e554dfbd3363836dbe1c88996d343786749b5e116c07c6af6c5d8950523c4b2a4ef0ad98cda55f5d40f06414dca02e2c1c70e750d9b1cffa18e9b038a27874813b6e70df610523e68e60c4b1d6986f3c8f2a2e1c9d07e383cab7b2a780147901e464751667ac8cff9f2bdfe3ede51307587361c2d9fc7c0f691b77e395a2e343b9bcf24ec5d01d832962fb3e4051d51724d9213cffe08c8884aefaa31d700cee7d9cee3fe2servicerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootopenscap-1.3.5-3.6.1.src.rpmopenscap-utilsopenscap-utils(aarch-64)@ @ @@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/usr/bin/envcoreutilsdiffutilsfillupgrepld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libopenscap.so.25()(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)openscaprpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)systemdsystemdsystemdsystemd1.3.5-3.6.13.0.4-14.6.0-14.0-15.2-14.14.1aG``r`__/@_Q_w@^^{G^@^^]:\@\[@[[@[ @Z@Z1@Z1@ZZ@Z Z Y@X@XXoX2XW@V@V%@V`.V@Vf@UmUUF U#T@T}T|X@Ty@steven.kowalik@suse.comrfrohl@suse.comrfrohl@suse.comrfrohl@suse.commeissner@suse.commeissner@suse.commeissner@suse.comrfrohl@suse.commeissner@suse.comchristophe@krop.frmeissner@suse.commeissner@suse.commeissner@suse.comrfrohl@suse.comrfrohl@suse.combjorn.lie@gmail.comrfrohl@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comjengelh@inai.demeissner@suse.commeissner@suse.comrbrown@suse.commeissner@suse.commeissner@suse.commeissner@suse.comjengelh@inai.demeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comledest@gmail.com- Since upstream has moved to Python 3, switch the BuildRequires from python-devel to python3-devel.- Add definition for tumbleweed to openscap-opensuse-cpe.patch (boo#1186735)- add old patches - slightly renamed; cpe are needed (boo#1186735) * openscap-opensuse-cpe.patch * openscap-suse-cpe.patch- openscap 1.3.5 * New features - Made schematron-based validation enabled by default for validate command of oval and xccdf modules - Added SCAP 1.3 source data stream Schematron - Added XML Signature Validation - Added --enforce-signature option for eval, guide, and fix modules - Added entity support (OVAL/yamlfilecontent) - Allowed to clamp mtime to SOURCE_DATE_EPOCH - Added severity and role attributes - Added support for requires/conflicts elements of the Rule and Group (XCCDF) - Added Kubernetes remediation to HTML report * Maintenance, bug fix - Fixed CMake warnings - Made 'gpfs', 'proc' and 'sysfs' filesystems non-local - Fixed handling of '--arg=val'-styled common options - Documented used environment variables - Updated man page and help texts - Added --skip-validation option synonym for --skip-valid - Fixed behavior of StateType operator - Fixed some of the coverity warnings - Ignoring namespace in XPath expressions - Fixed how oval_probe_ext_eval checks absence of the response from the probe (obtrusive data warning) - Described SWID tags detection - Improved documentation about --stig-viewer option - File probe behaviour fixed (symlink traversal now behaves as defined by OVAL) - Fixed multiple segfaults and broken test in --stig-viewer feature - Added dpkg version comparison algorithm - Pluged some memory leaks - Fixed TestResult/benchmark/@href attribute - Fixed memory allocation - Fixed field names for cases where key selection section is followed by a set section (probes/yamfilecontent) - Changing hard coded libperl path in favor of FindPerlLibs method - Check local filesystems when using 'filepath' element - dropped, because not needed anymore: * 0001-Fix-memory-allocation.patch * openscap-new-suse.patch * openscap-leap-cpe-15.12.patch- 0001-Fix-memory-allocation.patch: fixed a crash during oscap oval eval- openscap-leap-cpe-15.12.patch: add CPE dict entries for openSUSE Leap 15.1 and 15.2- add dbus-1-devel buildrequires to enable systemd tests (bsc#1178301)- openscap 1.3.4 * New features - Add support for FreeBSD - Make use of HTTP header content-encoding: gzip if available - Improved yamlfilecontent: updated yaml-filter, extend the schema and probe to be able to work with a set of values in maps * Maintenance, bug fixes - A lot of memory leaks have been plugged - Refactored rpmverifyfile probe and fixed memory leak - Fixed SEGFAULT caused by recursive and circular dependencies between OVAL definitions - Fixed DOM representation of the profile platform - Test suit: better portability, more granularity in results, inclusion of memory-related tests - Compatibility with uClibc - Local and remote file system detection method was improved - Make the report a valid HTML5 document- openscap 1.3.3. Notable improvements in this release: - a Python script that can be used for CLI tailoring (autotailor) (thank you, Matěj Týč); - timezone for XCCDF TestResult start and end time (thank you, Jan Černý); - new yamlfilecontent independent probe (draft implementation), see the proposal https://github.com/OVAL-Community/OVAL/issues/91 for additional information. There are other changes as well, here is the list: - Introduced `urn:xccdf:fix:script:kubernetes` fix type in XCCDF; - Added ability to generate `machineconfig` fix; - Detect ambiguous scan target (utils/oscap-podman); - Fixed #170: The rpmverifyfile probe can't verify files from '/bin' directory; - The data system_info probe return for offline and online modes is consistent and actual; - Prevent crashes when complicated regexes are executed in textfilecontent58 probe; - Fixed #1512: Severity refinement lost in generated guide; - Fixed #1453: Pointer lost in Swig API; - Evaluation Characteristics of the XCCDF report are now consistent with OVAL entities; from system_info probe; - Fixed filepath pattern matching in offline mode in textfilecontent58 probe; - Fixed infinite recursion in systemdunitdependency probe; - Fixed the case when CMake couldn't find libacl or xattr.h. - dropped 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch: upstream- Add upstream patch to fix the scap-workbench build: * 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch- switch back to official release - openscap 1.3.2 - the test suite and build scripts were improved to support Debian 10 - offline mode has received some love with a set of dedicated tests and various fixes in OVAL probes; - the oscap-docker wrapper is no longer dependent on Atomic - Python binding are now more robust - HTML reports and guides, generated by the scanner, are now more accessible for non-visual rendering agents - Support of multi-check rules has been improved across the whole workflow There are other changes as well, here is the list: * New features - Offline mode support for environmentvariable58 probe - The oscap-docker wrapper is available without Atomic + Maintenance, bug fixes - Improved support of multi-check rules (report, remediations, console output) - Improved HTML report look and feel, including printed version - Less clutter in verbose mode output; some warnings and errors demoted to verbose mode levels - Probe rpmverifyfile uses and returns canonical paths - Improved a11y of HTML reports and guides - Fixes and improvements for SWIG Python bindings - #1403 fixed: Scanner would not apply remediation for multicheck rules (verbosity) - Fixed URL link mechanism for Red Hat Errata - New STIG Viewer URI: public.cyber.mil - Probe selinuxsecuritycontext would not check if SELinux is enabled - Scanner would provide information about unsupported OVAL objects - Added more tests for offline mode (probes, remediation) - #528 fixed: Eval SCE script when /tmp is in mode noexec - #1173, RHBZ#1603347 fixed: Double chdir/chroot in probe rpmverifypackage- temporary openscap 1.3.1 git snapshot - make it build with new RPM (bsc#1160720)- use distribution-release instead of dummy-release- openscap 1.3.1 - New features - Support for SCAP 1.3 Source Datastreams (evaluating, XML schemas, validation) - Introduced `oscap-podman` -- a tool for SCAP evaluation of Podman images and containers - Tailoring files are included in ARF result files - OVAL details are always shown in HTML report, users do not have to provide `--oval-results` on command line - HTML report displays OVAL test details also for OVAL tests included from other OVAL definitions using `extend_definition` - OVAL test IDs are shown in HTML report - Rule IDs are shown in HTML guide - Added `block_size` in Linux `partition_state` defined in OVAL 5.11.2 - Added `oscap_wrapper` that can be used to comfortably execute custom compiled oscap tool - Maintenance and bug fixes for a complete list please see https://github.com/OpenSCAP/openscap/releases/tag/1.3.1 - removed patches accepted upstream: rpmverifyfile_unittest.patch rpmverify_unittest.patch sysctl_unittest.patch test_probes_rpmverifypackage-disable-epoch-test.patch xinetd_probe.patch- obsolete removed packages: openscap-engine-sce and openscap-extra-probes- Drop gconf2-devel BuildRequires: It is not mandatory, so lets build without this obsolete package. - Add pkgconfig(glib-2.0) and pkgconfig(gobject-2.0) BuildRequires: They are also optional, but not obsolete, and previously pulled in via gconf2-devel dependency, so lets build support for them.- openscap-1.3.0 - New features - Introduced a virtual '(all)' profile selecting all rules - Verbose mode is a global option in all modules - Added Microsoft Windows CPEs - oscap-ssh can supply SSH options into an environment variable - Maintenance - Removed SEXP parser - Added Fedora 30 CPE - Fixed many Coverity defects (memory leaks etc.) - SCE builds are enabled by default - Moved many low-level functions out of public API - Removed unused and dead code - Updated manual pages - Numerous small fixes - xinetd_probe.patch: fix trailing whitespace in config - test_probes_rpmverifypackage-disable-epoch-test.patch: fix rpmverifypackage unit test - sysctl_unittest.patch: fix sysctl unit test - rpmverifyfile_unittest.patch: fix rpmverifyfile unit test - rpmverify_unittest.patch: fix rpmverify unit test - openscap-xattr.patch: removed, included by upstream- openscap-xattr.patch: build against new libattr- scap-yast2sec-xccdf.xml: remove platform cpe match, as it is impossible to match both opensuse and sles or official suse_linux_enterprise_server names at once. (bsc#1091040)- openscap-1.2.17 - New features - HTML Guide user experience improvements - New options in HTML report "Group By" menu - oscap-ssh supports --oval-results (issue #863) - Maintenance - Support comparing state record elements with item - Updated Bash completion - Make Bash role headers consistent with --help output - Fixed problems reported by Coverity (issue #909) - Fixed CVE schema to support 4 to 7 digits CVEs - Fix output of generated bash role missing fix message - Fix oscap-docker to clean up temporary image (RHBZ #1454637) - Fix Ansible remediations generation - Add a newline between ids in xccdf info (issue #968) - Fix unknown subtype handling in oval_subtype_parse (issue #986) - Outsourced the pthreads feature check and setup - Speed up in debug mode - Refactored the Python handling in build scripts - Prevent reading from host in offline mode (issue #1001) - Many probes use OWN offline mode - Improve offline mode logic in OVAL probes - Do not use chroot in system_info probe - Prevent a segfault in oscap_seterr on Solaris - Out of tree build is possible - Use chroot for RPM probes in offline mode - PEP8 accepts lines up to 99 characters - New configure parameter --with-oscap-temp-dir (issue #1016) - Fixed OVAL record elements namespace and SEXP conversion - Removed '\r' characters from help output (issue #1023) - Full Python 3 compatibility - Removed basic Python implementation of oval_probes.c - Added support for Travis CI and Sonar Cloud - Minor fixes inspired by Sonar Cloud - Added Fedora 29 CPE - New tests in upstream test suite (offline mode, Ansible, etc.)- openscap-new-suse.patch: handle SLE15 and openSUSE Leap 42.3 and 15.0 (bsc#1091040)- Replace old $RPM_* shell vars.- replace oscap-scan.init by oscap-scan.service, add a /usr/bin/oscap-scan helper tool for this. (bsc#1083115)- disable scap-as-rpm binary to avoid python2 dependency. (bsc#1082135)- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- openscap-productid-cvrf.patch: add a --productid selector for "oscap cvrf" as upstream does not detect the system yet. (might go away)- openscap-1.2.16 - New features - oscap can generate output that is compatible with STIG Viewer. - CVRF parsing and export has been implemented. - oscap info command has been expanded. - The AIX platform is supported. - Many documentation improvements. - Numerous other improvements of existing features. - Maintenance - Huge cross-platform improvements. - Memory leaks fixed (RHBZ#1485876). - SELinux fixes. - Many coverity fixes. - Numerous other bugfixes. - buildrequire procps-devel- openscap-1.2.15 / 25-08-2017 - New features - short profile names can be used instead of long IDs - new option --rule allows to evaluate only a single rule - new option --fix-type in "oscap xccdf generate fix" allows choosing remediation script type without typing long URL - "oscap info" shows profile titles - OVAL details in HTML report are easier to read - HTML report is smaller because unselected rules are removed - HTML report supports NIST 800-171 and CJIS - remediation scripts contain headers with useful information - remediation scripts report progress when they run - basic support for Oracle Linux (CPEs, runlevels) - remediation scripts can be generated from datastreams that contain multiple XCCDF benchmarks (issue #772) - basic support for OVAL 5.11.2 (only schemas, no features) - enabled offline RPM database in rpminfo probe (issue #778) - added Fedora 28 CPE - Maintenance - fixed oscap-docker with Docker >= 2.0 (issue #794) - fixed behavior of sysctl probe to be consistent with sysctl tool - fixed generating remediation scripts (issue #723, #773) - severity of tailored rules is not discarded (issue #739) - fixed errors in RPM probes initialization - oscap-docker shows all warnings reported by oscap (issue #713) - small improvements in verbose mode - standard C operations are used instead of custom OpenSCAP operations - fixed compiler warnings - fixed missing header files - fixed resource leaks (issue #715) - fixed pkgconfig file (RHBZ #1414777) - refactoring - documentation fixes and improvements- Remove line-trailing whitespace from last changelog entry. - Rename %soname to %sover to better reflect its use. - Replace unnecessary %__-type macro indirections.- openscap-1.2.14 / 21-03-2017 - New features - Detailed information about ARF files in 'oscap info' (issue #664) - XSLT template creating XCCDF files from OVAL files - Generating remediation scripts from ARF - Significant improvements of User Manual (issue #249, #513) - HTML report UX improvements (issue #601, #620, #622, #655) - Warnings are shown by default - Verbose mode is available in 'xccdf remediate' module (issue #520) - Added Fedora 26, Fedora 27 and OpenSUSE 42.2 CPEs (issue #698) - Support for Anaconda remediation in HTML report - Maintenance - Fixed CPE dictionary to identify RHEVH as RHEL7 (RHBZ #1420038) - Fixed systemd probes crashes inside containers (RHBZ #1431186, issue #700) - Added a warning on non-existing XCCDF Benchmarks (issue #614) - Fixed output on terminals with white background (RHBZ #1365911, issue #512) - Error handling in oscap-vm (RHBZ #1391754) - Fixed SCE stderr stalling (RHBZ #1420811) - Fixed Android OVAL schema (issue #279) - Fixed absolute filepath parsing in OVAL (RHBZ #1312831, #1312824) - Fixes based on Coverity scan report (issue #581, #634, #681) - Fixed duplicated error messages (issue #707) - Fixed XCCDF score calculation (issue #617) - Fixed segmentation faults in RPM probes (RHBZ #1414303, #1414312) - Fixed failing DataStream build if "@" is in filepath - Fixed missing header in result-oriented Ansible remediations - Memory leak and resource leak fixes (issue #635, #636) - New upstream tests - Many minor fixes and improvements- openscap-1.2.13 / 05-01-2017 - Maintenance - we always build system_info OVAL probe, fixed configure output accordingly - warn when the user requests to generate an ARF from XCCDF 1.1 - fixed a segfault when loading an OVAL file with invalid family attribute - added --thin-results CLI override to oscap xccdf eval - added --without-syschar CLI override to oscap xccdf eval - fixed a segfault when freeing xccdf_policy of the default profile - removed ARF schematron workaround when there are no applicable checks - fixed verbose output in oscap xccdf generate fix - do not filter fix by applicability when generating remediations from results - fixed memory leaks, resource leaks and other minor issues- openscap-1.2.12 / 21-11-2016 - New features - separated stdout and stderr in SCE results and HTML report - HTML reports contain [ref] links for rules and groups - Maintenance - fixed ARF errors reported by the SCAPval tool - fixed CVE parsing (issue #550) - fixed namespace of ARF vocabulary according to NIST SP800-126 errata - fixed exporting OVAL Windows namespaces - fixed injecting xccdf:check-content-ref references in ARF results - fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248) - fixed oscap-docker man page (RHBZ #1387166) - fixed memory leaks and resource leaks - small fixes and refactoring, test suite fixes- openscap-1.2.11 / 14-10-2016 - New features - huge speed-up of generating HTML reports and guides - support remote datastream components (issue #526) - support tailoring of external datastreams - various attributes of remediation scripts are now shown in HTML report (issue #541) - new option generating OVAL results without system characteristics - remediation scripts in HTML report are now collapsed - support for extracting Ansible playbooks - enabled fetching remote resources in OVAL module - added Wind River Linux CPE - Maintenance - updated jQuery and bootstrap libraries in HTML reports - extended, improved and updated user manual - fixed issues with proxy in oscap-docker (RHBZ #1351952) - fixed a bug in OVAL arithmetic function - fixed a segmentation fault (issue #529) - fixed results of XCCDF rules with @role="unscored" (issue #525) - fixed invalid characters in OVAL results (issue #468) - fixed a segmentation fault in tailoring (RHBZ #1367896) - updated SUSE 11 CPE - fixed many memory issues - large refactoring of datastream module - new tests in upstream test suite - various small fixes and improvements - openscap-1.2.10 / 29-06-2016 - New features - support --benchmark-id when running `oscap xccdf generate guide` - added CPE support for OpenSUSE 42.1 - Maintenance - oscap-docker fixed to be source compatible with both Python 2 and 3 - fixed offline mode in rpmverifypackage probe - fixed scanning of non-RHEL containers in oscap-docker (issue #427) - fixed regression in loading a datastream session (RHBZ #1250072) - fixed missing SCE results in XCCDF reports (issue #394) - fixed a segmentation fault (issue #370) - fix error message when OVAL generator element is missing (issue #345) - fixed failing rpminfo probe - fixed compilation on RHEL5 (issue #393) - new tests in upstream test suite - test suite is able to run on Fedora 24 - fixed remediation scripts appearance in HTML guides (issue #460) - fixed autoconf build - small fixes, refactoring, small documentation improvements- openscap 1.2.9 release - New features - oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths - enabled offline scanning in many probes - support for SCE in data streams - many improvements of verbose mode - verbose messages can be written on stderr - runlevel probe supports SUSE systems - new upstream tests - Maintenance - a lot of refactoring - fixes in various tests - OCILs are correctly placed in datastreams (issue #364) - oscap-vm can work with fusermount when guestunmount is not available - fixed oscap-docker HTTP communication issues (issue #304) - fixed oscap-docker tracebacks (issue #303, #317) - fixed container mounting in oscap-docker (issue #329) - added Fedora 25 CPE - only non-empty profiles are built (rhbz#1256879, rhbz#1302230) - fixed compiler errors on RHEL5 and SLES11 - fixed sorting of groups in HTML report (issue #342) - fixed version/@time and version/@update in XCCDF Benchmark - fixed CPE definitions to work also in offline mode - fixed sysctl probe (issue #258) - fixed manual page for oscap-ssh (rhbz#1299969) - updated user manuals and manual pages - updated .gitignore - dropped fix-missing-include.dif, not needed anymore- enable the SCE (script checking engine) packaged in "openscap-engine-sce" subpackage. - enable the CCE (Common Configuration Enumeration)- openscap 1.2.8 release - Maintenance - textfilecontent54_probe does not produce false positives on non-UTF files (rhbz #1285757) - fixed oscap-docker - small improvements in verbose mode - oscap info module shows information about tailoring files - fixed build with CCE (issue #264) - fixed XCCDF score computation (issue #272) - fixed segmentation fault in variable probe (issue #277) - fixed broken support for OVAL directives - fixed bash completion - plugged memory leaks - fixed fresh static analysis (coverity) findings - fixed shellcheck warnings - new tests - refactoring in datastream module - many small bugfixes and typo fixes- openscap 1.2.7 release - New features - OVAL 5.11.1 fully supported - oscap-vm - tool for offline scanning of virtual machines - verbose mode - added SLED, SLES and OpenSUSE CPE names - show profile description in HTML report and guide - group rules by PCI DSS identifier in HTML report - preliminary support for Ansible Playbooks within xccdf:fix - added "How to contribute" and "Versioning" documents - Maintenance - using bziped RHSA documents in oscap-docker - fixed errors of sysctl probe - fixed skip-valid option (issue #203) - fixed segmentation faults in SCE content reporting (issue #231) - fixed tracebacks of scap-as-rpm - fixed invalid memory reads in rpmverifyfile probe (issue #212) - updated README and user manual - many small bugfixes and new tests - openscap-new-inventory.patch: upstreamed - fix-missing-include.dif: refreshed, 1 hunk upstream- openscap-new-inventory.patch: find out the CPE ids of SUSE Linux Enterprise and openSUSE versions.- openscap 1.2.6 release - New features - introduced OpenSCAP user manual - improved OVAL 5.11.1 support - added OVAL 5.11.1 XSD schemas and schematrons - support for core/platform schema versions - support for check_existence attribute in state entities - support for CIM datetime format - amended behavior of mask attribute - added support for remote .xml.bz2 files (use with --fetch-remote-resources) - rewrote oscap-docker to python, deeper integration with Atomic Host - introduced CPE name for Fedora 24 to the internal dictionary - HTML report & guide - results can be grouped by according to various aspects - printing supported (interactive elements are now hidden when printing) - table of content now shows only selected items (rule & groups) - references to RHSA are presented as links to website (rhbz#1243808) - Maintenance - scap-as-rpm can now build source rpm packages (srpms) (trac#469) - scap-as-rpm now supports python3 - refactored oval processing into oval_session structure - many smaller bugfixes and new tests - new openscap-docker subpackage- openscap-1.2.5 update - maintenance - smaller bugfixes - plugged memory leaks - fixed fresh static analysis (coverity) findings - fixed shellcheck warnings - fixes for Solaris platform- openscap-1.2.4 update - new features - OVAL 5.11 support 99.8% completed! - new symlink probe introduced - new process58 test capabilities - added possible_value support for external variables - added possible_restriction support for external variables - improved IP address comparisons - Added Scientific Linux CPEs - Added oscap-docker tool - Created man-page for oscap-ssh - HTML changes - improved visibility of selected XCCDF profile in guides and reports - render rule-result/message contents in reports - maintenance - Tests now pass on ppc64 little endian arch (rhbz#1215220) - partition probe now supports remount, bind and move mount options - Patched NIST OVAL-5.11 schemas to be backward compatible with OVAL-5.10 (rhbz#1220262) - fixed scap-as-rpm to work with vintage python (2.6) - better error reporting when a probe dies (i.e. due to OOM killer) - dropped selinux policy from upstream (rhbz#1209969) - fix segfault on invalid selectors (rhbz#1220944) - solaris support patches: file-system zones, systeminfo improvements - many smaller fixes and new tests- openscap-1.2.3 update - new features - oscap-ssh -- handy utility to run remote scan over ssh - glob_to_regexp OVAL function added - HTML changes - show rationale elements - show fixtext elements - show Benchmark's front-matter, description and notices - show warnings for Groups and Rules - improved handling of multiple fixes within a single Rule - scroll evaluation characteristic if they overflow - maintenance - OVAL 5.11 schema fixes - Coverity and memory leak fixes - skip transient files when traversing /proc (trac#457)- openscap-1.2.2 update - new features - OVAL 5.11 support turned on by default - included OVAL 5.11 schematron rules - DataStream can now contain OVAL 5.11 - `oscap ds sds-compose` now supports --skip-valid parameter - HTML report changes - Notably increased level of OVAL details - Table of contents is now generated for HTML guides - maitenance - rhbz#1182242, rhbz#1159289 - @var_check & @var_ref exporting - solaris build fixes - xccdf:fix/instance processing fixes - improved (none) epoch processing in rpm probe - environmentvariable58 now emits warning messages when appropriate - offline mode improvements - other bugfixes- openscap-1.2.1 update - API changes - 5.11 schemas updated (from RC1 to gold) - oscap_source_new_from_memory can take bzip2ed content - HTML report changes - severity bar is now reversed (left-to-right) - maintenance - rhbz#1165139 - fix probe cancelation - dozen of bugfixes- openscap-1.2.0 update - new features - native support of bzip2ed SCAP files (file extension needs to be '.xml.bz2') - improved performance on huge XML documents, especially DataStreams - minimized use of temp files to absolute minimum - added OVAL-5.11 release candidate schemas - API changes - overall 50 new symbols added to public API - introduced oscap_source abstraction for input files - further info: http://isimluk.livejournal.com/4859.html - all the parsers converted to use oscap_source abstraction - introduced ds_sds_session, high level API for playing with Source DataStreams - introduced cpe_session, abstraction to approach multiple CPE resources - introduced ds_rds_session, high level API for playing with Result DataStreams (ARF files) - deprecated dozens of API calls dependent on filepath - introduced API for waivers (xccdf:override) and modification of ARF - initial support for waivers in HTML Report - dozens of small improvements - maintenance - dozens of small fixes - dozens of memory leaks (whole test suite is now leak free) - updated gnulib - openscap-1.1.0-fix-bashisms.patch: upstreamed- openscap-1.1.1 update - Hint towards `oscap info` when profile is not found in oscap tool - HTML report changes: - Source OVAL results from ARF if available - Highlight notchecked rules, treat them as rules that need attention - HTML guide changes: - Variable Substitution improvements - Show benchmark title - Show info about selected profile - Avoid cdf12:notice, show only its contents - bugfixes: - improved handling of fqdn in XCCDF - memory leaks - static analysis fixes- fix bashism in oscap-scan.cron script - add patches: * openscap-1.1.0-fix-bashisms.patch/bin/sh/bin/sh/bin/sh/bin/shibs-arm-3 1634197772 1.3.5-3.6.11.3.5-3.6.1autotailoroscaposcap-chrootoscap-podmanoscap-run-sce-scriptoscap-scanoscap-sshoscap-vmscap-as-rpmoscap-scan.servicercoscap-scanoscapopenscap-utilsoscap-scan.cronsysconfig.oscap-scanautotailor.8.gzoscap-chroot.8.gzoscap-docker.8.gzoscap-podman.8.gzoscap-ssh.8.gzoscap-vm.8.gzoscap.8.gzscap-as-rpm.8.gz/usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/bash-completion/completions//usr/share/doc/packages//usr/share/doc/packages/openscap-utils//usr/share/fillup-templates//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:21511/SUSE_SLE-15-SP2_Update/dc793089a2ff7282f351943a10d83594-openscap.SUSE_SLE-15-SP2_Updatecpioxz5aarch64-suse-linux Python script, UTF-8 Unicode text executableELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=88cd8d65b80377a6b4f94cb16958296825f89077, for GNU/Linux 3.7.0, strippedBourne-Again shell script, ASCII text executablePython script, ASCII text executableASCII textASCII text, with very long linesdirectoryPOSIX shell script, ASCII text executabletroff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix)HTML document, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix) RR RR RRR R RRRRRRRbMh.7utf-8e618edcf1c77dd168717e919c8c27dfc54fcf29f948108c695fb379461829cfa?7zXZ !t/!wW] crv9xn{( Og`s-!rg|C/}!`Nt g- CI`z#s\[#FpC!FͼʰUE̼t5:g+-k,//HMaDjqG3yOR9Qq(+`q[ ^aFi#K|1_c>oaD?KY]WNC"Nr(=Db)osp@}ͯx7Í {eNăUi9}M_I qhR/c5 Ok)ɘ1s1~iBZ4wWe (+zIJcI7r wh̆ OU)Z%c _͋4M SX͹bWJC5A9 -î=c7l~7p-8e/mީ1.)m Ɍ7BB 'Ʀv%Jpb{Ym!fOi'|/Z\>/͘)P`g+^ҧ\p`eqV"`!-I)f㝀y#2G,8>Y-vvr=YyƇ5FgF|4 'j:9¬m3WŰFH _! dUoK y.,rdT'y[ު 8 `l:iف/@ca4=T A,PyP"TL@¢ {VpM4mhhNR!MYmr&c6 R*,[h=GЖ ͝!fGCsoH߳h{aYBH惓D=XXvi荭љw:XR\(BM{dD[M#Yg]*Z,acy.啹kmx`-p# q6E 꽪ãXC2'ӼBK1KoTHiN-i6ejǸ* QDhSB9|Q=b:]5yp7zi}=_E v)|[_˭'yYnZgh|lN3T1O˹Dž%VDS{'w߯ yԊ*̓!sDiX&`eGoc7}S0&/G9qvvS$kþ#ͨZV]G |ƿ|y l衤]lf℞`=w]icf4&%B0ߣuēzT>~ᔫ2Ԅs8#tX6\ g$ W~$8뜀Z8DvgC|$ Q&U8 'FQJ.N~Q+V0T_A|XʛP=tʡMm>?h.FcPwLMξ)&r:QW(ߴNWjj;-\툟Er`9"6 mÎo{ߩ;ZClgx! _tHxsմw +WQ_q7e]rD7RB9HOzԻ6htRMɞ<2;oiz*}%!Ge-XA!܉nQ$ "@ 9>-6Z`O_ @R.@ (Nq ֳQO39e օH"i)tcl 9g5oQ x! w"u~Sd_2"j]>j],[.C4Y0-x.6QJe5Ԋ,8PHLd*XN}3 ldKO۲s?- 3Y@ei(UC2xtC n;?׹@3^U'n*9箐;ӛ:WW=q_[E՜n=l:ǻ *綐M3/>XWqNmiq@!Xk zR{39 )}\Mn0^Qh5fk#S! \Fz`InK%8ۗG<2}*J i'*cM$Mxw,'4rZ)&_Ϋ_5YD]!{W{v٘/@oT!_f~(S$#b!Qԣ6Dtɞ CQ%y3iG&e(zKVc~6,iL`[~e&ei'} V%p{8ó: :HtӺ<` C! y["`5+ cR<GY)(V eFOeK C bC6Awmgt ԵB)M2KG,KO[E{Ci'p1f$l6ZQ}^2òg .aYlnm0(t}y) Aayq7msՁ=;r+Uf6I7/jZk[VQxEዼ)Oa T1gGgqmEq-v%l@(ϾF}z5m}dW8 {rb>8" 1=?Jx0|!b csX*C!4وwMJ̀4j >CE<71]BP=9S+Qn %8'l"Ԏ&plP" eUXPOA&\dZ,a_VDTVrU%]8bWeO{vY;Q/61ֆBD/;)q;dd%Ӹk}5_De ~L]Q,p_WIZJ_ҡ>?D]xsJ\zlsK*H/4'V |~xjo#|+5c\~UN8j2`[[Ȍ՗NƓh(lGfJ!\.P3وP*hγ4/Yf^LM M)7=F]x 5yY66a^(O:&8 &ar1xBpisȗ+ثU>x93@Qxao6͖ #Z-' $*:R(֓e.߾!_״޾htj{q7jGUtVe 9~|Xh3lVd#ʥf6}/!/|Fа9 J/{޸ bݕT |n1r mN7wh0o-y">-“n21?*\gN1"s Q렱7ȺcFÃEAJwOK7gDFp\ oWD#lg\EOɾR *iPxG@Hdm _NohnV9A=lnF~M&2mP#89iE˩MS\넫s[FsWo+ڛP|ۅU@LƼ(g^-crl+-'rF.Z#RZqa8љ=D2]hq#Gr0>89`Odړ<]JII{E5&`5$?Xbu(I:l%F-R RE!NeLahy=BE>e$.z>}5 &`TYjÄ`^mZOc9֙WcNR*HY(Lt{d7|뇝XYzD!>?t%++Y)˵1z2Z{M WeLw+7>d#Ak|`’顚숒qw8RQ)X3 g)1#\WB;i|OmX( 1s١GC4{ C !81GkY" X(Y._y<vʒA<ΜRQɶ+oA,NJOMxoƉ. S+ pgb3س\v}6xJ#&ie ^y7WvA$ $ a6vȚU뱉(zVEJixiy w/+z+n׮vn(bA]^%7tqT*V @[6=ua3* 9blf$\(O'58YnXCZV*Q3ꭸ \R}[wAѣ/n4C(^7yJA;f.+r$Il}+]#2z{nMMIB7 DXM-H!nd  ֹ>1xE,fY$鐅) s ڍU40qeS]#?9ZՈhTúSd(t!0cp%#HOSd"*_v $ eGp=u o$̖(r_ӹd)QQLfXFG Vf[8x2(ݖ Hߺ&I.$2>;!ɏTn@R}a[{ TÇ6,~>^:rShx^n i(K`a7@7ƛUPn0td',R);ܸiXh(Azbz˲b{11H zBu8/v:ϾaC"!HO@lyk懳`rrTޤ4g|;AH>PAL!ؗ@S5 f'A%6;uijjԍ|D F)WyCR{.VT)SUaNnTu鈨xEinC K`"\uiH9ګ)UC7URRN2HylqPߍ̒QQXkvWvFsE)S W&Lkb8;|Khq?b\b`kS3w1h'AG^4ܶ clpcNSh* NҊȧa_[ޞEl<2_j'tt0!",4uT:>#BBCds?^v |W%u8"a_?17)u̍_*VQyq)q-%4* vE!Gi?j#V~nY 2A/k豄6S# r{xWS\}plLZ_/kTSv#jgN4 ֽCͨB9YCab3+4{k8KV)?};$ ty?# yzܼO]s/34x viOrFk:؈?mUUf'[ @G)2g'W((q}QtճFTu]P"Cksl_{1s= M^rWD gDž0qO-m1;jUS3N."-fW!}D4=5-cIp_s)'ʴ(2{a4lnPvͫz =;hJmHkiJ^nWT*1+wН e<-$\q%jUEÈ{?s<%*NErxqEg5*Z޲f;wʚre\fͩ>:5Oq"k͚rO{$sOve(]U>~jr –0^BٖpΔJwm{޷9qwkOce\c*8TQӸ!^INinYy0p]۽5 J(!HV~W$hWaڳE5τe8jgֽt8sU՘<~X}`Li*1=c[bN8[3?0׀V/Y(e$:v PMMƶ^CQI. RIt3hR!PS o[ jm!49S+D+AP9]y)&vPQ'"'.9 1Mɘ+@NTW_xb{R+Gl#2r5oGKmPMi 佂uj)ۋfT9) )V5(=Hc*`uhl*AcM_#HxNV_M䲪"|īl$6y= C'ՓDIh]%^=Nϵ|X{eutEȮp^բn&ҔmmFм{|ǨxkT5r.Q!kX#?v"vË 00\l-VrA!\֊^/  'JD;Ǜ|1;Ecm P"Q{Ǟ*X N6xa8!#BSY ݒj*ptdM?ē^# Z+Qf#}Y&p!HRkà&m܃U+ >U0wE`{~;`). r` (I$`3GQհA2Qٖ(hz'<P)R!^d(*6\2 IJSBCG=]=lD>tO~@\IC;rY*L}e7Ky<K|RYz$KUfbڗC\P)3 .|?QKbmbUӂ9Q+~x{n[k[qvgͩ0hAFY5a/xI̅ƯLI9rf|j1쬺ې&n5t?ngB&F o"cDV ݐ].?QO=,YJVʑY-ln}^u3}7r% %pEȤi (3ꉽ梟ILoZ >Vx푍}2*PVr#8Ii:5\]ZVs6&ԁZ՛ZmFhPH#A1*WkX4ORS7^7OKy0 -`Xol2} nyIUX6"Fo'K4 (ː?Yro[㼛 PI_|E_q1?7AlN (aZMΤ\_0To 8`H{6+i\ A@sgΦЇHvWGp\ K.D.+gm2+3B qd~N rh:` Y ::z6ޠ!-sk5x׶ux x=EI x}lb8Ac4︄~e&h8N,|  # 8?o.fi'ċ#vgd{ MpΖ~*_` >Bo&Pѐ\b:RsudK3 cU)K qZuvu[sEb˼;s=[}q:-%G^@VHϚ1m;9np{)~!k zQ瑱 6^SCICwb K؞\ "O`T~G|+]X ʘG5U5bNKQ$AS "{o9Z\Œ@ey$" Khg.,v TaaiQvJ.Dd{~ 94eÌ=% Z09h6hQi$vԐvU) ]oۭ{ 4A`:ɺŵ(" f;PH%6(h *Zn\81t5Xπ@̯C$eFJGڏw"dKMY)X8Z ?Xr~Τ(#Zut/) _<.Re)ԫ3ZOAo&w0ަ,:\StsRֿ5 g^-:MuYg|.1 zYww :kH0Ti^rH9j Z.'q7Tء8SBDoBZxDx6`S#>FDWˤ8 $KHT gxBi!V^g'E=PBYchM+̔aڇG'3r=ZށR`\X V癁*pdn򈑪n-2_:hJvIMn,[ {&oqwW[HLRxm~WvWz[5w@Q?4tH$9c;r/~'XYTK5)ݩא*8wfG끭KV#:~JTgx|/JZNǻ h,p*bЁsUq ):\ s\ q`;EŠ1uvI;Syǯ6sK_2-R-U=$.;Ezê㖜I_n#9(up8 n8wI 7&uV_w@bWV9} w3@T>uww: r5qvGL#.dKчUf9|d}ߣ1z{韺E%9_⭭"cY:__,EEɇ]ɒF̡I"Sǚn0Oas6o RuZ }"aD"T_;XR2*XD 2T"xM嬰oVnYDv"=V8"=ۼam6{o }E_X:-N4VRċYϭQ jfURKU~zy1y~7Fe]ade 3*=b-ixѣ6W4éb[?Ɛ+Hque /BK3+H8f )j45 `q٧Uݦyj {ڛ՞[KYҷO-A##иejvgM`9&]YJ $#< q1*'璼z{# od6. hm<_x/ 6GH0@҂7"nϩA.ݞ[I)v?F WᓂmFN=KG]#7{QMCFa|w)g._R55B*?ݭmq #$ ^h%!CYoGy&'O.^|fs$ߔȼe@v4- a07.#QJ4MVɳZ==xPwh-,N.g}+Lp58*,S8@H"Ēȍ]S#24e|2Be'_S~DTZ q*Y`pذܽ-מKRmXCė@|0(9g:@c@i8!ܜ&[0dej[I6H>V_1=а suR|?E|Ux#Z|"u$k%jӨK[[.+Ljn2[Fu_*P"߳w,nw裼J@ڥ2Ke6)asF㶷~.q "(:j]0=? AL)eR.F+P v/g㘛beo9t[ uO*RlLOd V. F?nƺ3Ͳ*Z]SnRe7 ;[4"&H ;L.32a"Y¢Q m-)Ƒ9pYݝpsQ^8q6ǼGrfESu]doCNs52x%yw7u#fZ*MG}O7j So&n^gW}fp"Oq# t!$|oFI1jZ ?җwEhgZRoC i`cۀ+pQd21F~GdA,K4fMnRXmẗe:n>w\AgjPS ԪBJ!qYB(ܺ"${߄}kEE/ɚaم\3hr lZT튪=as?5PLtPciGAl\;XSX!.pub#ev<) ̕&J(KY<],0^COF1x3)qi+ݧoAi_$yäzdDk9߾bS{$hԱYiìcwPߊxY2JY-'L*Y eo2ð4L=EЖ"P@+b˴-gQh^v,7BZ/=N&fBjA3v]w ~6]7y|\9s,Z0| 0nDk8~1+]@>QKF6fLX 1F6-'|mG1YvKA>H:'[.C_ܶHoT=Ui#PPFP7AuV]X0py#ePr`_/2C|)0 sԧJ2,$}#.K5Pt:45Vͷbxk3t{/k[ſo e~$I١pZT;9c@ԚiPmgxf(r5vϾ?d Q b9p`O$nq/ݒzn?נaZ?rLw^^sJG30Oύ N}DKe93 H:ŘYĪ j>B[͆OTvͳԁ-С>9WSS ]UU@JjL>Z*5t} 94fQa&n~\DS7J<j:4]\Bm3_tH`(aDsiV=/;^3o 1-yM8DSƣvI*\RԹ`@kԜDd/2 k4}4SI-QOHnhF e>% Ϥ&Õg9+UGMF\ ű ϑ87Pխ[M?%q=ɩo7.p_E8 %n8p%Q2eӋ1t|oE/6B:<^~F jEV v"|rvs妯tOBsYXN:EhdiT/uII0L%7x*{$WE8阤$EQK|dD٪3Ja P};*p2p$e^ Ug} iSRs>&jM\vኗҸlm\ qSA8a1O<[eSwm!#L-Sr !2p0r28/T30jL_B8l棪uv)y-A0;Cn\㻘Dg*t#mGFlt@ \#.CqO[ydްVL e#ϵC cU\ǎLmZPɸOojX!064$Q㪎'+naڍ4km)pJv?@h@W< ޚhI:ybIbM*MdžB0tY` NkkH"r"OPB_I44pJA*,S_ì}㉗/f;pD WwPuEO-ۈ*J2’Bb JZ^2N&VUv7>zRY NpϥeT.5Gĺl HlV\Y`| ) WIQG;cj)7!F|3b0j#Z6X 48 iV(D{Bayn('Jȶ-99ORbTm ,&RR *5P e?fIxO0akAKe5OZBn ,g)euUAuTz Ѧg]t!]w1 }x/6B&jP'l,ɶ'[y>|9$M^@e!崳b=`)imV3\=mBk! J3nK{ W%$gTx;& 9c6C8m dDQenj3^{HF[ *W j혈 ʧak"4|ˋ[ vn|aF:*yAxxuwd!]Я ZS7#9F@иV tV[m2\1i?؅Ԏc8;Ua<=L^: q$5&rɬ6qչqpJr#pUka>KK Z#b뉊I)D;鵒̈CaP&5%ZaYZ7?ض'\75]됍Z |p\.{ j j6WeRTE<Ew)`5kdkt9 "d\=mq/W$5hIX!Ca!d_!U :,I4&n5fUey`Dnt?j>ÌǬzzjA9ݘ''-߄j{Rmotdd*yZׇe+͑hUXAy.a'%'D^?kCeTP3P(˝w\J"k~ҭ"qIC: gk8 b;+hY2 US +jΠ6Q#9_aWP{7\`yHpQ6/>EPK9{wQ#$JbO&L rM,- W[Fv#Arc h^ONvq^M G4+ZZ$^/ǵvPDG ḒbE;g~Da XѲ.j `f9bS+*Ƶ>3Y_tE oI.,H3D;c ;r6zpj-Y&NX=qQ 2 ߚ&l -)* bQ_,MP${[]/%GS,Xmc'](P?_P_5d\1DK=*NLB(CK^ƾvYW{@%)D\xMwS *Oyf>pSRySy,:&tl15|]qpM(gIj=7k D]?^80|}RD5 Te1萠%-rQԠ9=2'C56UVY6Ê9b1ghT6~4 e `Jϳ-Mx XTY:a}]eZL*Ϥ B}nqR&4twV|߳P"ѓt*)uy%b)ZA$+Pcl a3󆠶L e+By NQGTCB&Fsu z4R|"Ϡ[@5qD0^O=5׫d!^BNh"WtiOU,ZZθ`)Z-+HYLE5vLܙrm?P LD5Fϳ01fR*yC){4m%72GsGK!(#j^&"];s~[j}GcN뱟&n]VA<:lӣpe$wڡ?9 yO['.']%1&%?pUF ;.Y.3I jz>!6_^4l L=# k k+`#З ٷ5S s($>S)w&٦"]tD4T}(s%:l؆qtKs͍kRY aK)eεXoDB6Y){pl(4H_F= >]>/,UfSl|G4s)ѿB&x|nJ53{~cN&{NfiI}ץèӼ P5GJn(㕤GЁAgUeAnπCg.3Grax#T139#zhm co^Y8iC?221lwe$ӂ/i#`w٢^#!0sHAc #;01 ޏCX=#t4@'#IO/ԽQHufIaS`uo7nԞT&-!wv0b-|}}WM}tNv?[5M;D dO/AW?|cvi5p\uCf:uG$~,GO):#ٖܞLKURvn%H3R9 SG?F&Fׇ.%0{ybmzùl?ȗ2W,CmALMΊf7f`@jGo>Ljp|)rksDWsۭMRV\ar3޳I"UۂJ VÕ4oxԿoxxY/AAXkd'=a-V rmBXcҲyrЙAƻ-f*rU[\R9emyf(( oTKn{BǣP+_:B֛u2Y.x)avۉm83J1ys0wl6FeգLg?䄽#F7GZ.R(-e?Ymq ¥CZgyh㈋f{ݐ0F4 wQ\<{*c;~sx~Bpq,`ocCF20~o"/L#iTObWӣ g)ۃ1g-f@) C9?z5z#Dr לr;C:rK:fxFX3DJ8eRVC; Qѕݯ1>yt5KRz1 .P`,wDxk X[8[vCoڄW@ɝy6 E]-`E.EGHGbxM46K7 mڹ>%Wwɺ۝X6D H^?`Qj:NO97%BmSm"N(aOȿb1K< k"5>o6[W;qVŶ*o\'1!F= jʘHYjjD+d,˗3˼҃m~H|˕K+|^{Gr;JZ)fHo3D,N17RBӿAI@uФ/JN=_8қ4k5f.RrFo3cYA#qPHʹ|Jű)^15;؋Ъ-L?Am|e!Q:9TQ  u-rBvz?uyTB<U/r;h y˦m^OdbE6k#ɄFJJY繹JnaSFݩyio@3.W x?EH fW=#ITۣWsYBB`t0O =WW M%٭/+;?OkX = ̯+ep0=on\Lk%So_xI,"FB{j'I6[ vҟ#bFP|!d؈6ᜦ6U09#.'[NDeGƠ*&YFs~5%AfNSYfޢ25& UEђU;۞˱W .;i` ȩBRD՜C\EqPlr$A7 S|66 gBۃmɑP=kMb)@{+ $SP l~*Vu8|d_C)Kv#V#!DFIA\>FC#-oo-QVeIq0)|>NO./gBQz+\m=NZ ;{KQ24F?j~2@\#xuhz~y{>cTv)ξ(.d9.5\6=J N0?BTF!8[rqrmN2'%W*`ں'd4I$j2K:Sf\b6˜ \/)fR(t | [ ]k3z`撡\= WB卓> k ŷ: ;dS_[47mHDM{>̲e(%;ΩB5$l,"YO>ҽCh/ 1fe&IV;]5,TܪRא>ScݎNgGj_ćFDG _ꒆJsˆt^*>09^2T֋k. !,e.F0@Kz)${5hԚdӛt#rmOA':U*rhOM7`#LhځI"y;TIMstX)m'M*N:4;%:YL(rqy3ل)f/Hl1$( U&~j_#AB񙪓wy;^@͋t!Ln]G U6TӐ2x\jKC1->*4{W)¬kj0Ub3gzZLΗ~BV' 9': sWԾ+),n:RǪ'Α%Vbo wz @ q Ĝxu0:̐d /j_W6\<̝BF۰y/ɰG ;d_e&ȳjǻ6q+6e/h6~#. X"3_ Z^nOTF&)uB̀WZI X=wNmF_&crK fr=)gLPIfB/ YjwxeCь Ĕr]9ij!m<ȜS >uR|cXqp&A}_aZ+$J7/?3>U0,xoꂲ }ký 0U!Nba[MpǝOe7ν|&\ƒ,V1_y;͊[oGh !e(fN5x7,kjd+n?.xD3'cqm =)hBчUU!fhc@#\@dsUݛkcXX7%>iOl2}2Bm롧  ml~.&Aܑ%yTKE:t)BY⽧Ҹ AcJ` 9n ߭ 2R=ZwTz[0?_eP-ۄ BUc$;ou祐CE>&_*碅nfwDx$2po +t=UwXIHoY*JUu|_/ $/]%pnVZyAwA;d<$^6ާS^}LɩѶM{0TSYvp #qsϰ@w72jߐ`@ضG̷򋸻^\obs!@CvFO*/UeQyՉiG6~Ԛ{÷`ǩ>Gbu:D-1y)QLojbZ9 * Y/qž|!d%R 3XR0!],F"v% q2>_c4)Q\bYqY -^}[xk&k Hk\ۻme֮Փ,څgN4~uB%ʸIVe=ݸUZDNS8 6"!`?BC`=`+Aɼ7e_se{Cp&+Dέt]OϠʕYoe D!a.+;xpKќ'ע]!澘#MX{ȚH3L#H0# Rӳ0 sieMLXg/K } e? P{>bT9NX2[V7w8qˬb:ә+oXhѨ"o1R|u]4^ &4(ϲt3 Eڏ_[HϱSp(m({o{%4r-8ՑKGdRyo}!>^BWlYI( bFupV0]q\ g3K?ݻ=ٚ0"f*̤\(| &Ӝ}aǭh|Pa'ٌmow'\5): (coËqC[mj<|dmZkyQ}sD5L2W@h Y$Z5g a8įU8Z ,oPzj~7~Mbye;PܰPumm3uzp *]@> pv~%4#fdOFu2"N~B|rQ`H(0N499ۣWx!/4Nat8Pme\v'-d|d7,8eq0M7'4",1>X~U1SC}8'K&c4霰x3TDi#6[Ds=wN54c&%V,|•ADB}KR81/8] 6v0BzV\xТ<#q,EqҺx]EU9e7mKMji;LD5P:A/S5TDrq=l^ f4%4(i(WSCiKe&M R_HV7@ ̋ |}SiSnxy@:&Xzѫy)޽u[`tɫGZoIkD>"ZIM7,p鑧-\fϯ"|]us:[e Y|3q]Lyxa=}5",޻_Wp`&S-69ƾGv{>#f_hY~z+,RA[< )y,d֏"* &u\+R虯[aFpnR5:J*5VmG<9SЎD:Iʥ, O`6X⏦$άZR&E pIEv ba}=T` wz "Az>I|Й6c0Y/!OQ[᩷o_"L Xg5_CS7:RwNJS lgU/hɾdՄ@uqRy|;ag 3G+νF$:'GexYK.yjHQINl@{tjx|&jnTha8'…֬5s(u?+31i/ed%/<@ɲzMܞE/u[ɱr{/kǓcl"*!ל=zc}<՝ Qgm.I8  g/fzyio,tZfFD1au#P%B l#{G i:3 &oZߒxťK/ٲ75ty;OOn!LFwՆ ~}BC6H"m^ZLIo~i-tK[ l1^NĻ48hPm+ (R?T ~\o>iFA qP UH`o45L\ |kb(*]_mGr(]|&p4Xe4n3 q#c%hây~S"_gcEcTNGRyn]<}1 }mKP|ƻQz-V|@vŃKV9_ҹ[SDGÚĖrEzuJ|O7klDuH;;o0p$G\KzG6mh vvYu%;.7rV,a9b=Ǥ+FW~PA 4Nw`4SS60i n:NBR&\K^VѧqX} olFZn|-MDTk}ۦcRTڮpUIu`blf>Ey?8:)Ţb#%ŦMI;<Mi\*SL۵gD##Pa}9pfD$i8TVQ=s^!QՂ[2{9ߜK8;lDiN+(-G`G Mdw`uDUx4:saZߠ0hnuBVu)\ ՗8=sz\˱u^k8EmUsW"W#׸?*" 22#n4Lkm|Ė[mB,1flO &)Ua]nwf7t-z`|ay}~==(%ɰhcB? ;LʂfǶ]̼f*PP&va&&J`gHTd9HX[)7:0E*?Q%|/[ RM*dȸ"A:4GSV3˽i-?58r_O5qSE±z}br~>[<]Lj:ūΣ22pAZG5̲2p%:uz)c^p$j:(vlrfRpYiKkh9H1d0'+_9i~>w ~wM-^aN K76we68yZفrrFfY(P[&>v5T9dVWt:Og>z2Lf$W vnDVMewa5'UY`\:YÕ0b<%?W#L'RTUFkBɖ^] %j袐A>FװU?yPN+Wڵn4WnODv6=Pn;| 刂AQQ7GQ-7%4| Zy1\FLɾHz3& &,1pc_ Pvi }|sc(۽ n, #ཫ3Y !7=@wsoWvnUʅ_m-P.J ހ},L-a6#Bml+S*V|QϔM/C?I 4jj*>"Ùq驪cB*x=% iZ+#M}Fyo5wᰭ؁ɲ5U`f`3]MeR\KGbutHsйV^iqlĴY$Mt]`i݀F춉Qt}^h'ytZQ=RYr:Uj?L7#2*Jb@C P:9g5=ZQ[{ٗ__cJs,j>o M9 ̻~I Gge>bq|Qsk{8 ǩ|Hgyl*| !Ocu؟9SQm/š-#C^C{yFn!۱?ǧMEEg>ދM0454|*`<%GBO8s=Xe5%aНJS^cvV]%Y-0۝frN^6Źu3#xp ~YUXl**Z^h3dnbСڅ\30S =71OpԾkжOQg-eW/SB:8R`߱Y`I2b_u+-$jw0wp2 gsHk~[B{vUsP+cm؇pc1ETT"?&.6}0j-j~C`Mv S6s!gW$x1ތd [ϔ"[QᄸB94GrN:?!jީxx6LFeQCLd1$?VF$^YQZsX`GT"X1y!6D`y'b ;6I\k 2'7c%Cp=4/bwO׹=#,ƕWߚXw {@JQPz"Kd(K~4~~㺶܉ВD.-8fӉ3xaf>Qm?Bra]ah٣8 %Ҥ-t:~r*Kk`քn{f`l)Zw&(,O(ӵiD\Ώc`l/) .m3_3|op3u qQ+bkhI -68;<HS/Gh.*bD2ԇNڝp(5_D-]C^DrjMPh#/􆫅5q/ 0t}@73:UP;d3?^{UjhYLk5$"ˣ#D/_9Qubͥf5-8LJuU «3Cr<!!nI'jt9StNORIC ^ Is` -!2;Yj'_B/t?KC@-ޚ4lrv,E4b~̨깧cfб+\lJLjOif)^W՚< "P8ݔ$<]~#>Dɻr 7WZ/NVCMFL60 VKFm0AyNH{ >Ndް=ę퇆).Ȉ9vxWUO2:Tj#[Wɑ Ef'kDV:*6RY􍫺7WC^֬L*]-MHv3j̍!}oO i2az05Z5ܻj, nh 8JMa5@'4mK$R/iD%6XdKTg9 B}`gp@TK l:[pn~k^0>0EgvNQQ ~$̥ lo|=OQ-%$~+ƌ5SP$2-Lm62/%0s(AW'}얖wE|%! ~~R [A+7~Gp}Lg`ZHv%]|{xI>h@L(_r5#Cabml(WC7;Xt!m?`)Űʗ$d ᓵG,5O$A@X[ B2u^1$X(\9mxFq`(38m~]8Z_$43MqY`aCki ~+?TE ]+pD2< ]hU H?sc]q5:t,hkɫ"d9$OxցNqn,-SO:cAm]˶нո nH9|<[biOH~J Io$*Gs_ΑrFܐJFGcI DoBpRAɉJq۫}9SlcϳyhL0d:u"y-!Fh&,ehk= ׬đ ]S/k Op[Y_d7ì(nR59c1;ݣO"_Y.S7IF?!8 W!=weҭʋmjGápNpu!G }Ƀl̻ $ (Q|5(a>iɌ mkSv6-Q)%ϫ[ C1ZURDv:kXMAĤ1rS-]08xJVF a 6!pzΚ-+fNŋQ0;ݢ{wh|>{aYChG?(^ rs;P^J(4{ ]C2gy_J 3*Nhd~;|Ͳ\_>]@.w!Y'& _(Lw6ONu$})]bV|Sq̕/Atl|߅kSڴW#PZɈCKf =t5 'J̫ X6tq2xіopٙ6je1y/s1ѩ>s+z{d:0uyO'Ϫk1IhRwsNscBjͱX? TUi3&v}sљ(6*P21;|_y9uK=6b"V'Sek L}p0hv;XњUHSzVSnugSm=ѵͫL52\Ib9ǫ&Q}mMv6A9N⾐/Ժ?Te~79`'W-:mo|S,0X<3 jх6k2??] D.wQ%& IIBqڻ(0#UDn ?9 6G8l5hJ>7"!(8 }$8B22R4ߠ3$d$[ IXaHHx4,C?9ɳi߀t 2R︚9hES-Cz,{ V+u oƆʷ䙩-.pxᩆ{uLZv0JZՒC^8){gl%|-8omr_KUV߼*%ܦ肊LF W?O蓵^U:z?j*{Xf^{.[$Kns*gurEGHУEIjK8Vgoߑ[#lC?!S7U_ʻigČ }>oQ8CMA[ia|H'ܵ%>q.k"1-lOTk\r5vx!ЏR[.=Z]$ĎfQ̭B9Z}d֤괾?ӍKqsBC1CD\܇SNhoA}[sJ@K;^Q6ɱ!NJǐ5I}ob$}Uw1.+Cg5Y:+Vi c?+i.کٰo<װ_goϭw/P{㶫:ڞ3\!y2)0o5-WɍQcz_T? ۾aq$뜜A9]oir ;2Դ 2I EJsjR­lj vl_#mۨ}:^]l;u?uf.$p jUϛЁfEڮRf-6v}BFPk'31^|xO#+He"DUBUi«sQs'56k`$ C_7&Zw]9JǛ_ؒ@.2,|E::}IyTBHE8PHmd 5y @Eq8iBd"bXjz0~W4wV{WRd/%.p@oO0 gF WV%ʩ7*K;>\a#Nͯn)~fkU Muť`۬Cthr-=I (M 5O ,Ħu6KWFl#UCxq)~nm?01;8,pȑ (I6a,r+^L\Ģ(aε&TRE}*<.)'?j|yfg ,IŃ`f΍_+Af\$4$3h\٘th*=:+4O4XAad\ BfByGi.[&>3f jgρkK+ţ2C~?*)f}߆[LD ]I6lI`p7rҥ,SGGi[˼Y;Taj$De7L&+B43[0M" _?i:pH]/M.ʎ@|0;cN+옐{y7Z$q0Iϕh읬Y!quԭB8Vڝ|`>OF`  ֦6(iXJv)IL8¿l frV,~ Ȝ/5AAAҦ% |O"!%Pdvs<5^ibtROXE823bTli`1aуs2æ0?ٌw IFWAu' f+u'!u?}H(to6r]vBotʠ_96 g+!עE Ѐ=16kY-@SCzT;)Y>(};;Ƕ˷5.K@njL|T"9H1O {cri7u5b*"/:eˬXRJQD|q$Cd\%Flpe$f$`wWC0lMҠk3'<|ޱh*󚩔pf&8\G"+a/ᮚ@G*n|-IWe|.Dd=+U,JsAhTS kBv C8ZWmh+cdԔd+ٮ$ذ9mqfy7&x0N0# ,2VNDA;$*RD*hjg8ń<wH`ĻǐSK(¥/[ޣʹpk{OR[뚝$02ԯgbmػ )À` w]xn+b2>\<Dc,9ʾZSgԘ4! O[=` 3Hhý+dkM~L~cx'C,ʰPbk-7S1]$Uf=ѽr]JM5Haq諸 -CRc\YÑOo~X 14~H4qwm[T Ԅ@dFS?1"Q!{Y[i>- 5g DNߟK4׊T&-ُ-&DObsUay։eN ɦbwc&6:6%Kdrk(l ^AnfŠUiHr ΏC&VIxn7K,vJ|_\u)Q6_G S}Ϳ1!c kc5EhDe!֕cQ<׵ctmSNs6xA>%+ڛCQ#X e.=q0"$ʼg/0禨' T˽p~?*_;8Tv(UHIOQw{ƴ cmaD4JtbYoFor^4 ð$-k G,b(Ƃ +p~ӌrh'c[nؤB!IgJpjZŌ㉏~`pg":vbH&!@wxLu:7!-󼌍I&9vv-9kD ~,KZԛܸiRA+Krjc'f1g?2TP0pж9/FR9B/1I3}o{D['u/s^<hn ?#uJ%cCZsr.אt\9!QI%"f(Bo JvK4y 5x+5 㷁 ڡXT$3F2N]y[L&o2gb=H2 5T4=paf`2K@{/ޒn>E0j67TbWTAȥ.h&ѵa밭k6!{[r+`j89lWa٤-h̉ʱybQQJ*:bB7پ'k!Gf[}E)àh(ۀxFmYf+30O1"<_t,(NG2#(t#揚U+D]TH{LMt9Us]z{MQ^&0VWR4nJn[]p&⋫. p*ԿE?x#hedLNKsez"@Γ/ _j^]$<VyzcINiRYyZ#{,N R[777Lt^J&`:-R@TcM!m^d(;\ҍ3N2ͿY_K|}_.[R"񫭓]Cv2k^[47&n_ -m\S w¾s?wqYsw.핫kTL̷Nm9a(A_Wᬸ}IpkMN:ΛS;TӮxqlW3mKA "OQpZYteЛ^Lk^C 2B'-LdZp5V4Fs:~TQ>R$AfymGf:tMNXOCP^o7J" қ1^G:C!]tY&F/5q*݌- jvo*}KA`MU2]p9i"Pl`+ 3:y^N>MoƖ& [iv46H[ho_$?~d4c6 霗Ze(Xp.VK\Or5hT]@bOS'#֞7*a,W<;`oǠ׬+&Z oe.xmJ uqFwLWگq΅ s,̒)Jz]CV[ PVna&c= wBK\Qe!E6=Ȕ9RnhqJFAF_g!A#i&YyDqw-]_d8a6]S lkdSDoqJ!;d謬Cж*4RFddԱ_Я}ۍULAf^ }IgCWEjAEx%C8WrQO-RdҸ~jNOxOśĊtb C8ۂq*QmSR]PGe_;,+4xm xCq "C۹p#-Mh(SxǾZ`N%)]J IX^"Ñ8t|xTrb`?!x{T{|tMչM@#u)ujEL3Zr7SP =Im0tM9F B49'D4Loge-=7XI>zWb԰'֨-8]Jb^yQo 69 tԤ>5:?M)Mb&Omءp=cmgg Iܔt-{~Me%Wg|ҞhUt p&F{i[#^YS,hR7xNƷ|=7ղQ3dӍno=uK[ TLI8ęC 7̫%.zEU"|G;rXyң^pE:sZa@ݩP8,Z@}7%Q+!1kGQ%;UF!t^轖_7"dt82YtS\j8QM9 RɊH92xԿ# ;c&eT:)+5iwV*(c9Aj S/ڣA K: /q`4( nsXqh$V"7<ľ0.<PR U1yN,l0Crc9`+r 0$'NH޷aR֓8/CH O32g߫JMVgf+[,B%XP:O~_N*ŅRD3N=䍣!baiɪdf'gX<#:o_2S~CFj̫tZ"XT@0<8g ?x;bH2bEbC* w F Z$nlЈ8T9$UtW0j74в}bP]"xUR`\,P]$"3Hlűڇ5S+TXk7,johYqZy(Sr21jr, CyNB49GU9N&f<ߢAx8٠Z6Xѯ:]Ny^&tX='\OΛڛ)[|v$ߟ ?u?DӎD ]%k_Vu'YttpF>w !n ,JoDP]'<Gi#UH`gR6EwW}iV;d9L!E' Gp6'9QjO:3`9%ZNJ3Yy4hɼC>A{K]Wf81=~]ϓ|`vWRĀ1~VFo#3Gy|x!E<6[zh-ؕ[:VAz#;9mwa32:1_E,N_$2f1؍yg Ѝ4δ,GFߕ`Sh8x=) ު or|z`\;v?U%bkfg*᭹X%8)JG1To:t\\VUf߶ܻs70 oP*K?w'GP1fTaU -ԱK,W0;6]~vRAO7TFNeo>*nb Bj,ZGŪu[#tmV[~j0ZEXJ-!2[? BMEbAtLZe&bJ@-<I)~}xoBV#AhM;y O-:^'&<z})SwZ5se#֜qz.)7w %GTy eSI :]""ִQ1CߗrucP9<7C;,X!~dK`#ti;?KGt8|@xox_V-.~_Mv]7x/wGc8DJ tG".\Zv wv]9~|XJVk>MD; 0b `Z~aK|k_5d7>%8"5AR@juĂ߮& Vfvfu֍_w\ c=ARmEUWQ[FKm޹E"wI@a$yxR-!mĢEu]44 yK50֨{K+AهEܫPj.yp乥Q"Ԉث 8f*]hDG2azApfΆ)FNcMEo|soKTaSiTsDvDkI! \ZwtL;)G3I Kw`W B{s)en܀~9 hk}noc*fn8ycfɣh6:{P˝oYU?I ]Gv.*βT3ZwboIG? -AGh R>_Wʯ`&X̭t_Fn<7[g9*/fqz~9>Cuf>[bMv_OSLؐCB^i}[J&fcDrhʅcs7U][*ު+t WیDȀ2rHYB_;pDyZae! Qϝ U,?M\f ӏ2KںJǃޅ-~ʖ[7'yjʇ+#FFrFBr O})k$g*2;N)YE<ޖ0*XVfTp:‰Qra> ;yoWَA>FoXRuZ,GRߧigiG9WkZ5CFf8Oc+`SAa! cGlH`wkAcYm?`io,TZc)wK.KzN׭ݡۂNC65 8WoĔ?ɾp\4] XqSB-:eԞkS6MH I']0emWDQkT Ӻ4Zܫ|_]!D_){Y:_k*n!MfN?F$Q#lXrS\„^p5:6:GMnbb D^v FItA]Y A CIդ:0pb%,)0dJ(cN">J.Uq]Wpl-hyn+ q>ω9߻AHP[.ǙVqz> m"qUɞ";59 ӡ:djy}$ 10a!΃vtW{d|9$w&S<5,XT4U4E` JtʳxoT)88 :|JnBs~A㌻M?j.8TG7fkI(FL K8yM'4_*33 M&V7 ?de͵DDq'#zk0Q l7dJ}MlPfDt2B\h] 7i,7etk伄Q?E{DmƠlUo ӿ5?m.&QҞ,(= 6|c;&6vi෍[D?4S-f#Jap<,zGqcl `Z#* nKu"*.v^&4*GQh."ǃ+pDTdOfl,ȥӚ*'T]2xe,Clu #Ϯ]}^ !}lƬ|Yf1է:+3m i7.U*[B5Xzh~>{NeF8'nQkE![Xcl[ME1"b7<|$N$1IjJ=mqE6LűġbEApX.<%x&oRzr/PI {7a(Ez"ľq#}NgX?JaO O((,"R40kVB^i]jX437z$\*g+!_/̎R #Gs !=#ўH %^BS`kQxH޿kmhFqC& ҮKĜ,ŞK=S|?Fx A$0;}6$zH㞾A)!:Q@]5'Vۭ/a]DZtCM  { HE~2}Ս?!Է J-U 礯'$d9KQ F,DRV=DCzQk6{6uQT+x{+9.zζts̲ceT<;wEU}k6cYHEO':,ږngG^+i8_7QPu E.|ɫ-ZJ'iE3&ܦFqBNF2zO4l4Y$/ R" =h[i}?+$$Ij&S%*o\a?ljɵwQ.82&0}hdq2Q>[ 3stMG ^ Ii?1ZV&h0N ځpɚ2@L?\؞ 8Wnۺݦ 5tL.zeH~3W* +?{ 9'UF/iXum7stL頡 A~䱟\5>Y