samba-winbind-4.15.12+git.535.7750e5c95ef-150300.3.43.1 >  A c# p9|z@TYKAԛ } ke[ijHJB ufMa3SvTL;Q/gUs:GI$ĔjŨGy"b4Q`Br>S+8na%s>o+ ~&%A7hh q[ug` ד,e4ht/z 6D7 |gh̳ߟc~ _)Sf/LD4A#dce7629be3e994e2bcf7f710473e35c2e6f132fd0544aff701352e398351c18e249702d273a3f8d62dd6c6f9664e7e3d3a792b13c# p9|0(_Rԝ/^6n'#۽ӳMpKQ! 5;{ꥬէJp<g)W/6he-jc) kY33wJK)tO$"VwiiHv)~)8HĨ'(,$ModߞHI u_ sΏ\'pLbd?bTd, : R .4<.1\ ~    T<88(9899=:O*=T>T?U@UBUFU$GU<HUIUXUYUZVh[Vl\V]V^WbXcYdZeZfZlZuZ4vZx w]x^y^\zaaaaabbbPCsamba-winbind4.15.12+git.535.7750e5c95ef150300.3.43.1Winbind Daemon and ToolThis is the winbind-daemon and the wbinfo-tool.c!(ibs-arm-3lSUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxaarch64# we need this group for squid (ntlmauth) # read access to /var/lib/samba/winbindd_privileged getent group winbind >/dev/null || groupadd -r winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in winbind.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi/sbin/ldconfig if test ${1:-0} -eq 1; then ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-down.d/55-samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-up.d/55-samba-winbindd else for if_case in if-down.d if-up.d; do test -h /etc/sysconfig/network/${if_case}/samba-winbindd || \ continue rm -f /etc/sysconfig/network/${if_case}/samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/${if_case}/55-samba-winbindd done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in winbind.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] && /usr/bin/systemd-tmpfiles --create samba.conf || : PNAME=samba SUBPNAME=-winbind SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable winbind.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop winbind.service ) || : fi/sbin/ldconfig if [ $1 -eq 0 ]; then /usr/sbin/pam-config --delete --winbind if [ -x /usr/sbin/nscd ]; then /usr/sbin/nscd -i passwd /usr/sbin/nscd -i group fi fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in winbind.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart winbind.service ) || : fi fi<rX%0I^큤큤AAc c c c c c c c$c c c c Ac Cc Dc c c dbd95eb7e0d1e8c973d39fb53be9be46276b21bcacd8b0ae1adeeb63651f6fbea676af835bac5e037fd6f6d9950ea49ff3f39bc693d479069190927c1c53083993a1caa0988f1da58a965d7a954f36d791af7b63f8f4d458a49b7b48dedc7909f5330847db9091146499528ddb2b6d45e13d57a80e462cb58070393b25cca5a5be29a4291140bcafb58aa52b264e89e50a6f1b4510f81f378d9d2da081d082db48c787a47c3127f9c5fdde2848eeac71a06e22cbf997c132d74ada549c086e0d24a667352bb81e32aa8eeffc413a316f9f4b631b3283f12c23ea95759948b8209a16eb3e6b8e2bf0b1ee56f8a98e8ed307633badc5f3c02d8a82a4293ea474395d1d3584e3e6174ae3794b2d5198a5dfef89a4940649b6fb419ac54b5c11d054dfb07845968cdefc79f6399f631e25ce563f57d90f71bb2df14649a21a23ed81e1a3a9cfe39ac33d50de710b2cf477bacb2e830a29b3893e8446308a1d86b57ac6b4b0325dd3211474ac785379683cc4e7f17e211327fb9d536c1ff9138de03eservice@@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootwinbindsamba-4.15.12+git.535.7750e5c95ef-150300.3.43.1.src.rpmconfig(samba-winbind)samba-client:/usr/sbin/winbinddsamba-winbindsamba-winbind(aarch-64)@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/sbin/ldconfig/sbin/ldconfig/usr/sbin/groupaddconfig(samba-winbind)coreutilsld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.2()(64bit)libndr.so.2(NDR_0.0.1)(64bit)libndr.so.2(NDR_0.0.4)(64bit)libndr.so.2(NDR_0.2.0)(64bit)libnpa-tstream-samba4.so()(64bit)libnpa-tstream-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.14)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.21)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.13)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)libwinbind-client-samba4.so()(64bit)libwinbind-client-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_AARCH64)(64bit)pam-configrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-clientsamba-winbind-libs4.15.12+git.535.7750e5c95ef-150300.3.43.13.0.4-14.6.0-14.0-15.2-14.15.12+git.535.7750e5c95ef4.15.12+git.535.7750e5c95ef4.14.3cctc5cM@b@b@b@ba@bascabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.denopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comscabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689);- Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254)- Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- CVE-2022-1615: Do not ignore errors in random number generation; (bso#15103); (bsc#1202976); - CVE-2022-32743: Implement validated dnsHostName write rights; (bso#14833); (bsc#1202803);- Fix Use after free when iterating smbd_server_connection->connections after tree disconnect failure; (bso#15128); (bsc#1200102).- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Update to version 4.15.3; (jsc#SLE-23329); + CVE-2021-43566: Symlink race error can allow directory creation outside of the exported share; (bso#13979); (bsc#1139519); + CVE-2021-20316: Symlink race error can allow metadata read and modify outside of the exported share; (bso#14842); (bsc#1191227); - Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- The username map [script] advice from CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails; (bsc#1192849); (bso#14901).- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899);- CVE-2020-25717: samba: A user on the domain can become root on domain members; (bsc#1192284); (bso#14556). - CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID values; (bsc#1192505); (bso#14564). - CVE-2020-25718: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246);(bso#14558). - CVE-2020-25719: samba: AD DC Username based races when no PAC is given;(bsc#1192247);(bso#14561). - CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues);(bsc#1192283); (bso#14564). - CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215); (bso#14468). - CVE-2021-23192: samba: dcerpc requests don't check all fragments against the first auth_state;(bsc#1192214);(bso#14875).- CVE-2016-2124: don't fallback to non spnego authentication if we require kerberos; (bsc#1014440); (bso#12444).- Update to 4.13.13 * rodc_rwdc test flaps;(bso#14868). * Backport bronze bit fixes, tests, and selftest improvements; (bso#14881). * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642). * Python ldb.msg_diff() memory handling failure;(bso#14836). * "in" operator on ldb.Message is case sensitive;(bso#14845). * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871). * Allow special chars like "@" in samAccountName when generating the salt;(bso#14874). * Fix transit path validation;(bso#12998). * Prepare to operate with MIT krb5 >= 1.20;(bso#14870). * rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645). * Python ldb.msg_diff() memory handling failure;(bso#14836). * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848). - Update to 4.13.12 * Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806). * Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807). * An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817). * Address flapping samba_tool_drs_showrepl test;(bso#14818). * Address flapping dsdb_schema_attributes test;(bso#14819). * An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817). * Fix CTDB flag/status update race conditions(bso#14784). - Update to 4.13.11 * smbd: panic on force-close share during offload write; (bso#14769). * Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731). * smbd: "deadtime" parameter doesn't work anymore;(bso#14783). * net conf list crashes when run as normal user;(bso#14787). * Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607). * Start the SMB encryption as soon as possible;(bso#14793). * Winbind should not start if the socket path for the privileged pipe is too long;(bso#14792).- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/bin/sh/bin/sh/bin/shsamba-gplv3-winbindibs-arm-3 1669996840 4.15.12+git.535.7750e5c95ef-150300.3.43.14.15.12+git.535.7750e5c95ef-150300.3.43.14.15.12+git.535.7750e5c95ef-150300.3.43.14.15.12+git.535.7750e5c95ef samba-winbindpam_winbind.conf55-samba-winbindd55-samba-winbinddsamba-winbinddntlm_authwbinfowinbind.servicercwinbindwinbinddsysconfig.samba-winbindntlm_auth.1.gzwbinfo.1.gzwinbindd.8.gzwinbind.xmlkrb5rcachewinbindd_privileged/etc/logrotate.d//etc/security//etc/sysconfig/network/if-down.d//etc/sysconfig/network/if-up.d//etc/sysconfig/network/scripts//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/fillup-templates//usr/share/man/man1//usr/share/man/man8//usr/share/omc/svcinfo.d//var/cache//var/lib/samba/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:27033/SUSE_SLE-15-SP3_Update/f968e6c693d465d247e96f210be85c5c-samba.SUSE_SLE-15-SP3_Updatecpioxz5aarch64-suse-linux ASCII textemptyBourne-Again shell script, ASCII text executableELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=3051fc350617e480b35852fb2b04daee781b48b7, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=d458e1a3b9ceb78e0170f0d81cde8e2478cebe22, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=b3cc002b483d9b096e9f5087a6a122305af58ff3, for GNU/Linux 3.7.0, strippedUTF-8 Unicode texttroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)XML 1.0 document, ASCII textdirectory3O2RRoR R2RWRSRR[RR.RRkRR}RqReR]R_R5RYRyRRRR0RiRnRR/R4RVRjRdR\RpR|RhRRXR^RRZRR-RRxR1R~RRRR R RWRSRUR[RR.RiRyRRRRRRRRRhRRRVR-RZRxRRRTRR R RuRRmRORSRRsRaRWRRQR.R7RAR[R R;RERwRYR3R2RR=R{R_R}R,R*R"R?RR]RoRRRRRRRRRyRGRRgR$R(RRR5R&R9RR0R RkRMRLRKReRCRqRIRURcRiRJR RRR#RRbRPRVRdRDRRnRR:R\RtRBR'R)R|R6R%RhR^RNRFR>R*c氿>_4Uu֭TA|9M4 + fW}!1J')y{#r ~($'˿_IpŤS٬8)~HOaCDjYd/9M ͆ޗy_.Q7&&l4,fnJr+%KOkɻde0y -2~aT¶m=:}MUu[8ΖӦyLqAͬKQ?`mOHB` t;:rǹ;ًtt_3E3Ko oAq>g_< nQz':Ga vU18;ӟ㸬5rHRV;Cm]VrLGǰ&WAvօ?jBZQyDˋ$"Sylˡ}+J!҄(&f")ZـȦ1M͛Ec];BmE'n:=PXLsH꽄A^Z?5{eO\ ,% 2/8vNxw4/;<IU^4f~`]ׂގ:ma 9X:$SJ0:bKwGmZ~8;K+qL4Wn 6k`3dQol-o=Y͇ζZrU*0%ee uzH|ʕU@Sa,e"{D!M? xlY*2uc0vic&Y(d~ǂvoW| 8n~R>OjGi6'G,D:,-9'~-7v6HGUO/#Ab,y&v9 ?a~HX=,窠P ;evudFNtLsZ!|DS+Fx?wMf4hbujux:g 3ȠhUg;//qKÂs>/ "Vͼ`}Zr/ϭ q& +i" SV,5$d&TsI9^W"`C@auwBŌZ꧿bN4HF*_Mm`s M0ܓ"aI7?c:u&N߯UPр-P_1"l#pC_Ým)=YL=$~גm& tALof?s' UUk(V!Wڅ!Ȏ" iZF7Pl@aHfn&>I,gcm.6YJhٙ»5gBt4UwM5`ɇa^׳0'x5hwxmX{[*,, )xF'*VuIH& fR XN+ k%zH4$ Q4ggO7O9^xfVޯEMΛS-?p;g/Sf.GaB̺@{6=d~K#J6<+vEM ]8ϖ! uQגB Ql|SW\+74ݍ8YeM>r5n x6FrGI|ih^Vk:A/aG8u4,O]N7*7C_~DYѬE\\M*qӿՁ" PHG $B]p?i>kTX۟ut-iò2Siz'OaATO ]Ć4č[ #N,14;ȝ:еIh(9gDHnX!vl+S~) 6$5|Hxo"/4KԂ&hoDGftΚgYT;7vA_ojyyoL4a$,ʁ :'>ڲ,3z8b-:~3l( 6f1T&M>wК O]匄뀼 |T4 sFɎoV0nن3TG[P^{GR#p?6&&. B0-zbakLnd4>MKs/J ﴛdnIdoɕe.犽!e;EgS tcgs@mT3&Vnj"82x6OY!vj* 2Kؑ'Hڹv\D\ tφdߊ_~گ)dՅ&֍g))D):76pbq3!д.W[PޥFD0so'K!>CUYx8qB)bycrn&'0WpUVLk ʔ j$q5܎zV`O B|i7hOZ%ަraE'eOvֱ";q`-FCeތX7=.gGa 1-L73cB?siXZ):iDjv[2]ݖu]c)׹cNiD6LSzn6ttL>qց&/ kRK=+Dq띴D޽E8e0gb"'D T^FXHdgkoRiɗ|pbꬶj>n:(]mQdRO&Tc^dziTp"vYy3U\TǷpQ!|:1wr-׻klL?#Xl^<'^ןWw3J0x!w`*>Fs3|` =/ R4wNsv2"BCLUClS8Qj4e<g6(N$l&ӆbl|CC^ 95&r'SOʓoυ$3"[;Vr{^J{]G {23 1ʖ6i'ixDaCv`ЉaX?fRwʻ^Nz&u_5۲qKҡ5 7imIeikH:Jm˫FV|+-Tp.4ω7`~&|]R?ڡ$_#Gޚ=$2A`*m)0@_vI9P3tllY"rW8 է`= $n>pp 2Ys_;9jc KT[o*ț/̌-gLr dG< bV1g3k:ȍj0Uh=I<|uv`+JX,׶15OX~ҟOLzrלgзCw7"߁EbW2lXPX֯ 9tsD!AjNj>z Gq}h /=Ե\jD!TBb,|ឃʯmef~7we)!bΠ7Y>F^"z?7@X=FՓ#FixZ"`4;UKa!eat3z@91zh$}2q!\1 kf } VM2[So  #̤OY i#z^>QhTZymM0ߤjYHbc 7R}}4dq8A-s7C-o*X)"tG5R*wj*yFQvZnQ+u7A':Z\#QS)pS_ΨxMgrFP9v-;9{<Ɲ@v̭M>ۘ=DitIрzШ>.H*EVmbCPp Gkg^vK8b a5PMPsfrU w"xS&GmcsCu,ÿ ϭ߁*7$>{;DC|ha9֛B2o0uǝ ca7vh)z'[lXG_$_N|LI2_숨ύM Xny䄳6'*ϨC|h{bL4 WMu@q0C/[%b;`qŪ"}ذO!7%qk : > D kIwwscq2aVV$e^po-Ĕ,pF_~=듿ǀopE.W (SN䐶໭,y!eiPBGf( R0Gi-:__/$&<ר0N374*JV^KMPff= *JT,2ux~' Ax6Oarʣ0ђ ڴgK1p:bZ]u<\JWj.-۽sh(0+(?T1mO5qْ)sEn/,ev|:*lg32쵱!ꥳpb$[ 3ZʮVRZFdtUz /qPFҰgVXv! 37)oWQ:'Xڧ U(x~ +Iht[Wg*QtCf,)4ų ^ȾqW͎q"@dJםSMqA5鐺)9w80MSKa Z|mVyrF޲19/x`pG{M+2#V -"rbG9˰#lɞ`iZJ;4QGq1Fx@M=5^TߞϠf)nlPJ5?b{% d5$vRYnP{X]^XF,Þ1ݛal3ͨ9qfpC)Ͱ|4[܌yqzoYgnyu>1׼MLjY|-JE֙>/ Ӝwt|:m{V} hbBSIiHenAt~o 3Nr:j448P1huK6UtGo%!Əưic9P>U7: w7?1ɷ$&KȀj~/sʇdE;Ho(AE7 KA" q`Ʀۚ/0CDxg+d gty5 Xp0+*Piey@0vnFXXW=bhK[<%iN#4uN蝹؏/? 7ۘT[o;Jbz(]rq{ Kڐ_eoYʠɤ:<=x)$3<\u-dQ2{txI9V+B#BoTcɳ Xr8:DߩgT-miRIÞI$xmVv5WF[lth Z O-C/kќ\8 'X^뜪NpC+^%v 9wO£ѡsB:%s8$sgk{ !շyF tB KL;Z7x}k15Yo,{[eT֌߿1]kښ h*R$BrvD4fqϤ04 dpfӞ@"mZKDL]=S@1OVnn-h.ۏֆdCg:jJ1gwnhG[~2uT?fy\>A[X>z셀9B{(L d:%Y_rUVͲB|a?(FϙCvq_^*k @=uφdBYWk4\IJ|Qf j&XƬwoC;mRCw-EH%U9"7Zەh-Ԇy)J#b S94}Ǔ'ҥܮ7 ,!HB9nԌI=L/,>VQ`QƓrVfHX0 ah2ey RfKs gi^ Q Z"99VnpN&p)ChW| BWto|1R&/8EH>4$HLݛ/pf3>:5:%,-ĮD@Oy"|_T&mD!};HR0U *:e[02Q/dTH'"Jˮ5\M5}EHSK,x&5C4U(冟M uφiz'_ZkTq= Xqyl!W8G&肉˺J8!dB{!5Q÷SAfH OCRrDCDرO4;RF3:۫zg=19ЩGf5 //neX%\;Jl $ՑȾx,?l7@֝< ]ȤѰ+[pp3R: ɰƌ]#,aW;T QxN˪WEѐx 3&{a/6$j_-;8uʱs)'*v&hɚI]؅FOD-|Sh`U fw_a >ح੐ Uߤ氤3ţs,DyF0 (=cQZTv%|̰|f@X:hAR `'j~=*{WtݜLT ’.Cn[&`5׿3W:]RƬh8j^eḯB`6=&C|uXVuo(ě84N= l}{0Y'u~ӑ:ysoX.8b7>Y<\BD^jWf Ԍ9WJL.R:XsʥGw[O] š3dl1mzFS F?1"_'+B s5б d_`V!6 |=JQ%|YO$;ܑ^Խ1%jF7) B, Y~ 2D >rBY'O e-iG}/4C-6ܣcT~ACEihi{0PP&^ "<- &XvuLX ٢Ä-%{h Y`0'S;XHm4lI%o97k, `̣u>%4B8"'}~WhLteOɭKlAX!,dѲw9TM|}`dyZޗ!2bN=@1;rZLk"jߡ|Wvb? ~.7KvȌGۜiѾ%&S344]>MD$!{JJlxTjoe8gDT}Hw$  S!HxЯlP7mɕӲo,vӰ}Ox"> 봉uY$Ts"hYIWre1Gш4=N;ѽ2QKQ#i1G%>Rw#fshy#JCz>|112X5ADՆP>3N`J)cJgkpN^wjc߫!*b<Tn;'IŽZhf!&AzE Fط  ߑ%Z0X_uM*i tgJ̢ æ)/'*BN?jx"(Tv EX]aX-Z\Р[#z{nb0  5͟0q;7 t-s:3qnŬc0{{G=̑`!cʗ  ]Élt_" (JYJU])J?Jli8TLw?c<=֊ E픖IBμ_ o͊nV]~&.V3i'Uf-Lũ/9VKwYyAr8{>騕g̪ %K_SO/yyJG+ IlN'e~a"N\Qp}ޙzjT.kaO6AN2ӈ~%/}5o#ƂqF)gSB0 YTS_ScͼVGeMPpK}UY5cq/Syii #Z-=@Zy+<<ԠǤ}h 1И,JD7Q8 40ك(_+Bw<}SJ&Y(<ƒQFdV۸/X6%%A>΄;)Beu5;͘6\T=_`Q]ؑ  C;$wMʵ$ -9j常Ėy>˖F,W&ji nPHV qcֻƠѸJKz4;!z9UMP/])t 4C1})x;mBʛUK$ۄ%)ﰘ0ھ5jqPFK3*K%V,`eґP ix+ ;R@ n~`d@<= i\h)w4bj}"tÈ)#̖N=VFP9fInjPSݎ< r"g1 $pe%Y "KUVtj!wݒTި󇕽!c#ʠsNQ}X lktx5Y&馎,?9X&6=P:8PU+Cg=.?AxSG5Sba=#^d`scA" 9mca<6t[bDӿ"ryai6<]䠳6Ar#wW sbs wXF۷ ߒvvYU7|_VՎ1g/5KGIQ.D lE[}PAWrsZ:"6MٗJl g/fMnnQ:qf\\ԷqW5\R :*C;U95Z8H{_VLP*dy&-i\JN*H$RU[Ms LZ,.'12duUq lHvë,W8+r)ۡRs(rܨ`-jR;IIG8Er5B[͸A"5hJ#3ߗZ7~dd;`Paeϴk5r'p[#'JRsZS ࡤТ`F`TsכsєCڃ%bS36*&ꤟ )]KW(z ji3~y_%.̺2@敱 Q)T%)D74Dv笷u&L-{&~w@+_u_0۩@Lsh&Scv@n5%GF]Le]6e"imVѼ[\č ljKڬAVQ^A8IΛtLSBAPog.@wh^DŽ}YiW CkR2۵Xbߞlr N4AE ai' p"BӨ~O/Ơ@`Y3#u~cq$=t-rj4g2Rz\Y,8$@!`LR;;Y/`|c~됯Kl5]u[ASVR#"5h2!AXbtÊJ5(1X4|q<? gsH*dg6V^A;Bʏ2wIfIz04#-o rߏDy^!#@j`܎:ܳ !X l αd0Р\;b0TP  mu[d)N MBgml 8veu@<#og~A]CUM:p'l  /6h |\L'et?+ީ®KG;-$q1ovF P%˩~T1Y[o/q,doP&fAI6j8}/P<[ tuˇD/IC<3bTMz@ٮqu;4A`s7gn3x$Q } ?/֠% '`PU 9,m cs !}#ɋ^ZV}τTUQ"-Bf)`4}'OBF)Ghƾ b0uKNsgVteΔJmFiL7`[$hUz -f#CQS"E[ (Ԫ30R}.b_0:WQQ9IwܥDXW *Ϲ ^Y$O]Gf[{3Z1Ɣ닩E&5N{8Q*dyˣ=OD~b>(4:ho[j A O!2}{mϊ$ثADۿjoYC}׵4mW$f5g8եԷӒPU#'Z8)IUѧ"'VlAݧj)%< ?u{$=h=̽ ^S&/m͆k?sZچɢkaV !b!2h879hcRԩ8&}p*ۆz{Ϭl`%elw;)t#2r<#ddvav|.Ik.z'i5 @`0g$iJ[:?uq A ]\MU'z Y$z0>rVb*ZEK1 ]2 @7| JEEϣ$y0i+I0)WEwRnBfv $'ҽÇDD[鈐ajwp,.ȓ =2GbuLHԉD3z`.͖D([~iy#PY:neFhVNEJoOO\*~]f;]nݡ}:aW[PV3iAڸD.~| #\o47gILn|2{<WN P'SkS~;կæf;uHT1,j"t>KiPz {=o^|VH | ^ltų󖳃POKs$iX|l'Η܏YnJT!Zȧ"oN8ڭcU2^:O2Sh@Sx,Z7o./tuvaٽӿq9D xP)-2Z88U/0=pXHt`LnkHW{cA 2 ̏vS< y"حO -(4嬂őIm"u$8-q0kPg<@WYqWdvpr|tC`aj{R&QLp:L>gXeiŠ;3`6`,21͆`>Cz:fTK1N/kylF<_8re3IisIW+UBlơRKRgM&mBo-BŤL* K$0]Pсo] <XmB:Wa֒bk TXN8+E{WPrH {dI+G*Z2;Ϋ _DeZ:5nI}u]A#iF[R5N#gMvQ/IPR#Ԅ8svG<7c#7eReyB0!=Iqin0NhPl2:ڣs\*X#{'Kz^ʜU%ǽBE):ź7'IZT0'WU6Ycx"+E _+Ђ^\fjX.}<]$Ks5_s/پb)Fcvj_ ZOaPi y4)M!1y K8 x©x*܁ @76\;vMh ǝe HOirE"po&oY1١}:#D.S Ѩ{RJZV` Uq*޳OpI+CY J WgS睭kdrx*l'ZV?*;e-H2kQbS{Ts ?x)u< 9!`BUv6[ u,'E͸-R6Ƹ&5[FB. SQ=*:aq+-| 3Ti` ߿/0s~eq_(i^R Bh # = =TA N] UNSr'U=# HW}eOST*J8ס'O#"FR-?t>*<6(>-Sq}e+pȘܣKEOqPJF1'{sݧ%SG'lH}/w9-.pA!K}p=`]G 5Ӗb<+'&Dž#!#.cV6=W}9V >UEsD2+(&#rI"U[6=2$Wx,R!*dǒPnt%R)MpsZ Lv۰^ᛏ*|S+kn$b}u 0 Q|wǝnjJlYq2Gt."k03B/@@hdw̗C*b07WЖok+5Aڢ,GH=61e#iQy˒AhtZ 3w kV}uh¦CrJ Ka]k'q"#rZOk8v%*FKQ{'䰻$~*"N6 C dHoWmNto[e%G+E4RSĮ>hTdׂT۴T,]uP%X0] 3ʷIV(0M*m#j۞9Зh2lF*Ekq8_Bb>rordK#sRD1C* hv(qp~&>Ax"^ԙ+/);"B~T3<ù0tJQP w^ꋦb@x6ڕf K̫F1L`9ӡr hb(&1J\TP-V!sۓYX*$~X= k8$_x%y'BaAC;I FXWslvF$E`k;κcAN-*Յ~A([gC%/l3W\[:ٜK/I\i< \@x GEM㯻h#, V&Fv(QU+-BQCv%?u$ܩZZLSYsV/ z&ˇhH.)sڟkq4E[Fc ]Me-1q*llO'&B8@vB4GƏaB啄$^t#i)jhYҷ[lNZtj~жڒO3lqn) ..V!a+s\ŒgbNDȡ5X=OuR@=Lu {ңcϐYem}UEM1 X'+ Y+)YF4e[s A>`v>!^M;CEAJZcd2kx)VijHTyg%ס\ѫf)3>tX<.6"P J/%Quft; ҽ dx}\Έth2xFOl_/W-B˧6~*]^yF#O*Gu?,k4qNM"`c>v9bd.` ryK&tߵq~ٙ7tN>MW#kokr1{@ zUA'>rA.5P7ggb  5i(ڵb]S|." Z'%3]"3F"s_.H9}W!pe1u}kE{1UbY#Zc1֕qX_"!ZTo@#6$+!՚sF9gtayX+e~: хwҭv7>BU\vl!6frXikPk/%ZOb(1M`N(Fʁ4MiKJZ ^JWv_6F>e06a a Hh pzh ()x2(XxѸQ?N@l&̵wdVkXgʙM;ݜT6&uZ J yӶRB'y*{4svWi(|X7 1ĵ1\ #A9G;7x1P2:/e mGW_ '6je51k 6E720E $ils^^#WdЭG5.ƠlC+/95PQ,N&I |tG^rxy]('іƭ3$"`ڮomӔDs HCr )*NiEo]7`aŧlfdtϜjȺ4"=b"a6/el박D]Y6b:몤6}2DF@,7l"9"{#3~u#fyu $WJ|2*u4˟9Љnn q#юQ$dE dж2m#C0 '#8Dx:qm !o)˚JILJrUTNլB,*Kb/g0 C*ݐ!1pK6AT2WTuɫ0#$r~,dmG[Ԗ WAL`JXLb̴% jydK!M&'gĞ0{Weפ=GYa- F0?Ĭ`|<].|Xˇl];qB|%W<)|L٩ЊB@hEL@D[Yui3wqhncƌ}ʍ;?d1:MDŽ rF2o iJl8ՠ_iѓ<&r9BZK7<+K j)gA./V]{wřN5Cr~,MzgIHd*99NFJ%HCgiJ0w2tG%,rάyN?M!_yd8V՜)n$Hϫ GNe@ruE,+T/!y&U)G6j{w"|Se)>%kE/6gcSu[qaGrr"бpڱʭ19UW6̊nDRXlr%m7"!)mDǫQG7X MPGxp?qrfvv7\Rn;=Є1M%Fm*A:8^~ru :|ѹdے,Ol' e .-T?q} 7{/^{!4AkSflv>L0,`RUΫ4&WGpCʀILM"%oykQox6,۰"RACoGg#(4~RVj ܟrE\sx[MhGJy/Z`% Q pd9cnjqaX[.b)~2îWq.g4܅Lty6 jlDAidA{?Ho-a"FSigBu103|5UKTv@CΑ-PTpj?b(:f6n_άQ#-3%\e&V,~1H=qhEn#j[@x֞" ux>^ϥD^§GM9[.s\<4jmoǻll [4 BN)-dmoZWQ,+mut P~c'@jkuR]Ũ=\tǰPHMԈ7qa}@[G7ؒԍ䊆|!A]A`b&C)ЙH W"ɺ0.jEs X4@hυ\)cn4ƴ7)Ew>9WU (d >n]"*iYoL8-9bGaZI z[0<\RsAC 0IβG+J1:l ӒNḊ)Y pcBt:f #T}i#] s7޶B]D`׉NH%-Cs):K!FtÞ]?vUfYASBAMąu.;'g[,Yr3Ҽ z5pR-mlo6|{n]!@T4H5aqD<3?(W>1PRi)hsPMxBfX]׿NC^WdeL/F䴉l!pW]^BmQa2Nm eђx?:2A!=Ƌ 296l(AĒ[4*UtA[95Iec$MAj"(q.1]؜ J(pM -Q͔@`]i.8fts ۊR$]R5hcm!>Y"3͖c<)#$8p0?fT}')e PzF9#,TWwd)>OnާRD6k#lb!@Ԗl*̘i}@jʦ"΋X~Wm0 j-g6š² #ݭ FOmEl#4o& C>߰?dZIdxyne$BV/jyX%S ʢ!]HV[NUզƭ;AX-sqZ>b"˭4铇[,ƅ<{!{g0q;}VPĹ%7I^4`9~ʻ<͘?Ϸ7V8Mtrpf(zEi f}\k3AY)N{q ӑN.,W#ux+eh2Aje)YVWnxh7u[1V \/@sÛ:5|<˨AuTQ|zvc~vm6מ*,flIpf:ӱYz*:vBOmNzݯe^]=di.~+䀚 mv͹H8e{ ~l7ȵwd>a\TG^{-$sЋyÃDVUj65ᚇT7 N^LAgt٫#fYi8RN(\S n.)Icݸ$ԾEWS2~d#m~þdd6u>\ڡ7. `E-<=*i8TtzW")cvL(;d6爄"W/Id=1rvPIY"/q=tr[9ct5iuT>QKϷjQ+BFtCfVXKN|1o7[Gx|9woOo]$XJ+ *Λ9GU2%_"Z^Mp6v̞EC7^Vh6,HBbcUznT=cZbߎp+ʓeo `ٿcw QYd>>i`°7ԒJ _NQuB~Dž\7v |g0{'!cNN3h&ͼ+"D|N ,nƱ!dX39U]d0 H(EeGjfAs9U1vieH wи#2u=-gܪN5HXZy=h+K x,1(DӲH-kF(p1WM)oB _$qWf/Ur`5ؽS1pq^>z>r[|jxZ9_~(Q\\VB w) -m[yyL)dBdś9hzO>(y(*WjƯɩwSחݳļD0yc)MDh*Ȟr-TPfLyY'QٴyEA[TZ˵xvhtUR}eAnS(Ծܸ( QFa:G]h6]5@>lJs_pkZ|WC"ZӹfEf_+1\sɑp@{81NO]>^~mŮ,)/cY9Al #_}X|cȄ9h`ʁUQEɌC'l !][cSZ ɂk$.8Zp_ڡ!MT-RG 񡷬w qb tR-H7q1"蟂ݵ6 wN!e{'Mihx?B$*5;Pwc>mDfˮBDfku  LhZ$ϴM8~qwޤFtF[#l1s.0WRcYvJ%d$7#ކ ~|FhCլY2Y]jy\Oߖ t* I -),ώIbz{twُe{ bOC*:OޥfΕp8Q#%yH ~7]Ѱ\f9W+9s::b# :sR&qv"\T~^(d)WJM B0.i|#|0{!rZ$žZP@rOwWg]`  SB?&q[P/&phzc ~% B(okT< 1/OлAǔ_jCuh@)!̄’#r3 $JsDM }OfIRF/QS>FqsG@@+Jn!ΏL6?Р/<ɌVqLu療4{+ /a)"*iu _/A['(n2'DYF '+U*%%N׃ʖϮG*6qLp֐*sdIn";Xd;TC! ڑ1l ʙ-!k>t5eU*)ѧ~<=;@}wghu8kp./DFy#bRӲ87Y | R+EY<=iSixϒpuQ8t?ءN\5v2baڣ( jz_?]^ouS Pd# 4t$fgUD{[| хc\Jx'yc D PuH4]gڲ<>J!$D^Pi9a.bMVO~ B׈g%Ml;* fig3m"3Eq? /5-via) "Všb<3pԩB=ie%gW&L2,fGb1@q,rmt=hPۉG#ع}fVX ft$%:AgŶJOGvp ]]LS@WYT=Ca<~[5;K.PLC$&ڔq7 ^:MȢ^aYPfIB6r^ţ4Q1{ZQDW'iY;+rYͥ$_(Ts)2[|V uGW/0OnYm9#'+Rdw>JZDN#n~!>Er-i~1 u+J]$?ϴKҖYu=*6!k,͇OF=_ݐq'jt!("-(-Lv}ݭ=ńz9Ti FX De}aiʩ aS*&fʺGGIVbR nlP3C6i)X$,Cjj{56@G:InPnm|Ѻ%[ZduE߿;VL[3SB+oTA=*g^: i8Y.ood\); =? +̝)t$R`<DLM.#ooc` -Ȭ5h` ȑpMC0H/V\zˆ| K /DA?|k[ ʪ+`5 l`& 9ڽba^q*Ëw豶^'r5sArf5™rˋTSc'(_n,]Ҭ`,cö@3 FZ?LΣiҁN|StP(鴺|ܮkN蜨T6K(ӶT NNt0e 6Iria+T7m? ISlQ`AE6œYz]GsG#t>14yn\ʄ{]Id:%wbo+ij݆^8jYHm,[8eSOj-NE]8}i5Xs3X=QD'xCԫoJvAxk fS(F4q_^I݋#;_4-(*zdpéE b:aqM%*4,Ӈ5}dz5ò#~P0)JV By:2Lu SYU,ێx z mu @ K&  1{)r/2 LM`/mz6yaO16@P@4mfېFld= Ỏϣ2tZ*Y}M7<U{x1zkѸÝN8oV_ Ӯ9pZйvs]kI_V@"]5#3GFm*oA!j5m߾6HK̎͋1W٤5 g$=CsWe[PX"RWȲػb>]oe>YPl )ƇqS:c e&Ncr'HV84 {Hq$dܽ፛"am']9˺_pQfu/dޡjxkXc&@'o-OУ$T/YaVSHblCrOz!pKF.ֽ$KX<2Sdaҍ~3Ui#S$1ˤE#ޮ;uګ@RáLTd0<̻{:2M)mRtAmC mʓc8( ] 6cj.9MroDfGn~[m8a:U" DÆ?%-71mr:.nea|9Ƃl--sc9&x\Wʯ4skݿOB/!Qj~@m%LꗮAjc1Br,;6kR v?̻)V;pk1q`ͪ{w|g޿5C3*;x^Irfgc<*JQNҤJ,X“d)Ÿ?ۿ3ӌ&GGGn8 .β8ۑ uAyBO0qJD-WAKfҿ~kB9zŤmİ7#o>/ؑ^bW:4Qp?|d",L|9³7wE2<1#IIMSP=+;uD<] 1|>F4YÁs˴t%̝EpV=ZKܧa) (XYmX]^:r̙Dmh=7Wr ,4&j_ &oS֧W+Z%Lҹ2G \jFJvrL.Ծ`wZ-pjC@haͼ!v(4vjm!fH.nVyd:νv}/8sutF L>tOf!c"綟է#-BȎL>!>WDIh(^4 xt|Ƞ #WB@[I#W) -9EROv1 R[jÌ>W)FC,,˛ (AJ9La ՈK)vk2 dy"୼d8X uމ~\a)1n }nL= CR ]r cI~rm1C6(14)G:(L)5nifVxL0ef[Җ@m>ӕyU'u7)J| \?i)ڿe3tbs?:kt6 'e2\_8."|:gj=G,K1dP@*Q@EbjT?t9lqC;kP5^iuE+q` e)&#d^=@K>[oH+V}A@X8pR4i00yQt̗Cgq̣.EyG x@qØ:w.з~nC7Oοv qG49V1d}NdP;j梯p;:5b"y^GRr\L `쁽DaeVQB ,ꐶ[RPkDA~oU%>՘Z(:98 &TL f)?qOsQ#@y7zbH-JHw SUITf6J+nC%<'&h[gmSn݃K暥1o7Q>Dztt(^H,B4}^̪IE΁I|eQh{qļhJjg)L|N&+UA @ɡmK9]>v<11`ަą+!ɁT[@k;C}0< ]@+5fmEe y_=;}>T#G2};{G֑`I&ʠauϾa]OBsoq^#JQe?uޗ`Dt ]rFzvx=c5|dLG{{|t:~[qN/ea"8V̹Q,Ig$ -Aƽ9HboQ Ԫ By/AJ_p ejQaEcPW03 j4~ntrQ{`eu Vs JRWEi )c;BLp%LA*4%X@X?h@(j_)YjK 9Sjjx լb{sy0nD=^xQXA4sO;Lt/8sz`2$HLXrNŴjtϋNj8mJK"I&#}A#bCTEuQ6|1l0 מrD7 30<$7 mU" xxc x"Yz@Wy^  &^uf }d"8#=ɟlqخ,g^9$G&R(iéRKOANvǻD-l3$N&Is b%rÓ;q7D$l8SIub;Kfa|z%J?EAn"ȓuZjgFsɘǷ &ԙPEoF`}1jj^(pYe:S*y:nX^^^jFO4'wA; ua+Q/L#6ԤxUR+"6`.Q.O48pߕ;) )Ur vk۲W?y:fb=ѮQʞ<۽׻+*d01b=\W r0CPl"7ՑD+G#uY}dyM(7ƨ=GSEj}n#|8oSwbt^ODԡOhNLތY=n&㒑Bf/6}n]5MiDъ@ @d!JZKx/o2~4Z"B6vQY/QEIT}F α? 3B9s"=r ߄QRcߡn Pܷ_Bs-: Bd)]--I : A^gV@hU^"̆9q0ƭ^ϔI( ξ?˹Z[ʉ !UR^AH}p!Gkbu!N<뉖)ݑ1vT <zq|%io.xb`rO_F]K0/$w=--k #L w;;j\JsHLf~uS{~BS{HTt(We.]n#OKBF7 ,UCD:qο\/(b4$#c{Gu,`r?Eԁ/Pº:a9񦗡Q2Hi[ D6!1?/DM~Dg*p pX^v-FB8)ZWWgֲ.taB"(/DW"$swտFJ @SgW2=0gTp:8e/<?@cT_;S܇`Ŵٞ=GS{ӰeUۖJ*[B160 !M1C|\06IS嘱={%S1 ?1ގv^H G 6'5!.kr>j`fo:%be@VY Fk 99O M妿VpM6^ĝHq(@ ^D8(a5 z) N!59yꃑM+n}1(\#čq(P_5{:P )oMĢNTEF:x)a^)€Pm"p^WB !Yյ!LiRd#꼧!%[  rfxNغ330,ԼYCgMeXu{) #]WГތ@&8u?lb/ [Zop6X[ٌҟ".bp/tͫ{o]+h0YnbM_(Ë3jQ 귚+QUc(-ZTJz:`T̫{! -!O!b9yJm&훎˪OZ%I1pXwnzd5MBlOxiGMp"3Թ|㯎J0r݊;nk6^زzT^|O=jI8Vi_AI b֗Rk|B1w St4.PDec,VD78t~@7WL㮙mA"s];-{tOn,\h $"ks-&2eY`+0k(@C&PΪH MĀmU`V) }ZD=]J$e+! #/P"´FЗM(Z| V?Z$Z+#[O #3L8ǝ>Ĵ.dc-"wUY)Y1 iɫd"X%W`: 32Qvh?b(byHKa[eEHI1\km?bB y]Oaޔ3r2+$ ]xZ!~L$1 L8Dڇo(\?zXڕon?u< nr_G/J *N:Th :J V$G K 5InZsMaX/Ч (D5pTfdo6ڝ\D}vvu,[$DS&ۂ杠u$6C,yG=_UnHm/`4Lf Ds'yd߰\I{fg/65p $2Dnzk6囜eW)\Ij͜eNv(]%RP-P4]MQFmk ˹Nuee;WWC|~%Iɶ) 锍C_8w&(()͢-Of@ Cz({d*չ#RɊf.5:E v J wds%t}S9Ld^y[R[g9ws1xr$ev}9,{ Yn[9]sE`cQyfq#:B( FO,anWj.vP u7ySVy/M󷸧7LjP3W2ȐmP7UqE-"ɯtd ;|?ԙZEmu;ਘ2T(0Y~^ {kZ>ŷG&µ0 u p^ ^ғ>6UdlMYЫ+t(tb `"ZO+qDxzR?+O Yj(1e @2K[(b*ǽWf~- RrWA۴0 ^cK5 x## h ?{:j2 ؼ C^ }Q'7P"P xqlgzT|28ۧ:bʠ@R C/—.QkK#ȵA޾ImMnw漤W-'bs1+|}>9t&֊=aX5s BCl"[Y?ir%o!;7FWBB0O4_Dvh і 5<=WbB&62F:h[~V<lq[KY"iHv⋮1eV@%QJ첀QOPy %Z!ŃDD8&z>~ tLaZj8K2ϭU=k(a &-טOV15-R¬2Ċ 8Gw~IXzaީT79K"-e_ %FR3^v7{: |=TbUwd~W6wWB l4u\-y|Ć*#&*Z/`;E ΋˯[?WgP1F$&hu&oz52 A?|ϒ=P7w!@|pS+w)`KPNhJ"7DMyn9{AUrd\[bY e;׎6ԬCP6):Kgo6IwfIГ:WnZR3mE%7lB 9+sQfdF@[= ^6BUoٿi!j3rycn 'v_}G¥jF[t0 ~1 PIy6Z {ܙ1? vP %%V_Iy܂nҭxVjޝ2|ZdJS5-WYh K᷄*د0V._HOĽ{Mɰkyd/[yU噸pI&ҳ&a='SZ(n|aR\3uJ_ZMs,X$ǃ>m”~zx ][`AFURJ _.ݴ=l.aI*#8D $sHz=([#%#an֦ㅮk*,%O;?ņ/W()Ĕbص[+o^OcɘVEdeف?+iE3)ev(m/v@NY 5pE }7kഡfiP3^AmN5pTfqFmRCwpI/eJNiAk(蟦h@M(М’ċxCj>L6*=vŲ7ZΫ&w#TdW!ԑY/O^FMʼl|N%49Z˳7Ե񏜉 զGmiDŽ@^kQ7Opf`R+B[{b`b'T ɭqELtnQ;?clpc߰a țgvOaU{S3￢?<})KW rS댢 \,^7浈6WH7t%j3Κ䏡Q:D hh>  U1+@T6R*29Ÿ.Tg\% 8]$X IsOl1 ]YE"Kn U{V#nsb18(ǐZX}ܓq!VHۊ*b&SSBlMeIFwSB|!p+S*;:7f4SgJcYdZmĵJu> Os츋fO퐿ybۥ 6ɶ)^\.SX -cVSگÛ!M[qR+Nurs.ԍ\ȳYO*@=~Y[H VFUkI*0\KKuTk]P32R_Z9 /3bRJRV"w4[,!/Dfπ(F2],Ak0q@^yJ2?a33yyVbWnr:VNp6(toSti#U=NTW]I%M.TA&`PRayw?*_Қ{|f—lL%zESPNY )zPZI<ݪEY,ǖ0:e{#twk3p$q,zЯj*eIݐJ}X,nl>dTJ@w;eZE^ӽ$iM<+gBЪq(f{I)O3N-UWU7hq@/l@zicsװRuJ6F>I]kK aw<W=>d rc]9L.BTA]?CfvX6\!S az{GЃF)":ˀɭdHrsRB_{[k0zpkom[̀"fkeFV0j".$t,U.z[Ԍ2$5N]mF{dq! y7ŭrFffғru*P/^zZ{:l!ۺNM`V!T7&A 3n#jmw Zcկ5uf&ޜ FqO1ݏtC;4%@V^Q=i-L]2k!2*JFRY]=@KT*>z)Ak f2BD 9qOAy/4 kiV0[Y}l^K{GfL_ f ?H0FɅOӾ *|RX\w>NMLc ;=Vjd~4 Q]Cs!{ 36G˘+Yf1oLJZ,Uo[;R) at vr 5 w0 >]se\ic[eG w{;w轩צWVJ~DV"-HSQޭ`N^Ua H5H6-zc/eQ{n9 ;Ӽȫb;+LB `{er&[KcYf2ÕKc+'bܤ8%_zM`d]aR=%PqNbUbh 䚣:|v?5QtߜhoN.'숏Nom~ndMqwNXfC9% la7ʨp )_0!3 QQ(ƫ@Nᮘy'lu{b4܏h!-Tj仗n3aV}@y5X$YGϑ! !fӖb"UA*'(啁o TMZ۸gY>k~}C"/wn~ǐC,aVt6,VgcYOz.^%5.b)o9)AC8 Va9H"$V4׽s8GO P a /<8[YCC,FZ;J#d3TlWy]wT'̀x1"ʃvj4ERa N%7גu]{b]=8\XB4C\}vPy|ҡkW5/ I8~]?jl:"(2xS/5J #c-ԉأ;%o'k+D8"-ȏvq])ie~1ۙ `t-p@%lBTx`6*@ [+=>TZz؅[y/Ifm[a9>C_!\oYJ`~U""=!.=8/t_98Boz~ݚ̔r6-]Y{ rύQ{xU4[Eqܲ3F9JԈe/U`HPdet&mY8Zfw3X`j5s=e=[oy+?I91{Ϗo!}q{Uª9R7g2?P~djM.@Z_aŔ!xN|n s+=[MsHAn3x_{e|gxBsIb D EQ`i=Gi$#GM \ F&Z2IA݅9q#SDڶaNށiC]YHVύ0TlqNΉˆlRDu4)a/T #cmN>'Ij J+7@={5: ۦ_5R JO x2aFLBM3 2O$'7Vھg:xUcd]W~Č3+C.gLOfZEh )0#fd] >޿hzsOz)xVnH7|yS=g{h׭~]w4fff۲Pi3oD#6 ( WۂMʉPϽ"atWdvlܰ>BH5pFx& T+򸰨N2T|K|/Y+t5sfl%kCɉgGzFGz<,& 7@112 H qj4ڷ%p[?^ zpJ?/L@쾁 ԜWB_+_&0' C]ч`@d#񦰆ِ8d`TҊ|1%ܳ X;1b۹Όٙ"+8=$~_BmU {2C\IH̞ iM;^9H/ *QVSDKl͐bh@`b,to݀L,pmD7a`;۔"+[J$J  1{X\#"}< e>Yb K Okq=Ƴ GO 1c-G/0}̇bJAef35Ϥ !C-P x@'Ht:.UH6HqȎ\XrN$" &()[ uduܜs^Ø"%H`EKu74_w N(n,e1ٻ @8J$j/_t}J_W N>l>dkURFED;^e0fhg׮zx}H1dV*s#jN!W\42r√{#%KH"yD_*y&_TnX_˹S$|зuN`ZU5UF/^±hJ.'GEI~#[Ĉl?O+HSE7Y_;q&Ǡ7g` L4F"W*`_kρԛ7f 9 XmWj>KpNQ)c`7L-H-¸TyVoobFbgRϾoS*1.wH^ lXtmF~MLQ̉v3X8`ޱt,ye,W∬WC+*c#}p£h?czۉo3c&)g.=^c1f(p͓\ );u\&iHb(k`AN]dᷙ/֯sڅҼl6~V方g; Wa g:T*ȴJG߲6^­_B9n+J8T0ۛ}$Mf7|&3t?Kd1ʛI7 1=H8{"'/?"9*ɪ%Hw[5WtS@/>nY`9WwQJr#,jӤ0CĜr?7t>(4! Mz PwVS%nJU'q9_gؔV:sHާŴ^-f}ጳu=7j\qf{I\ukإE,!p)5E񻄻v3J<6rcC [Kр감AT[ـx~ HC6}#S*с '#.)#vKbs0Bppmi*~—#m}PzE/1d}>53O+eKxxf0Ʊb?YeO!R2į !FMl*7KڞKi[r/R?d1[bإv?4VdVp}d3>]n绊 Ip¹!RKAԭW)wΜɁ Zcg4+[?U+ EQl?]+oS3:4"cRSŘ'vؗ=eX8]u)Z|尩_78ǿc@k&hwQD'h;V^R$yj&y? G5fضX_6[ DOz& G1joKt& +D,tJ{ 'H=Iw'H&)~!*,ÐO+ӪbJlh~Ⱦ$,CW p\gAKgCF S9] LoY@IPG"<ڈ4@"ȂzeX~=S:CIÐfcl-d״)4k;reobd SL+Hbemy;(_=}.q9j  pjaRFX_ri0_v:"Aqn8{mP <\45/&beI*H/$jOwGZm^u?<:>4ZYSOkY4iJxoZ #Jp{o6PABQ-_8rRc%l{}eu<ж<[vN>a9rK>Ac3I|!1;yuXe:?[oZ?x/6tQٳRjZW 8LNcbUh q>$PE$lr| w°,|X,4:2"t:J g&R>ʚ+ܭ qzꎩ.w-kWOp9ﰂ`s(5(!VqM0o†vduȼy)ok}X"`.ab '{wWى>Ҕmɖ0X6`z ݟ[I%s~€_K\EƤ/X X04Ҷ~r@!`)m[.hqP3:\M8QźSXOecuf#Zg/7;P:;#Z==@\c^e'<"S:][ 1L vrH|5+,o$9G҅OG9DDXuםV1}/p,g}x1N'U0&My!pP pa_F/zm&wń|.90_?_;F`tZ| 8Q bvP6-,{6(ӱ~M06 9h{vx#-Iʚ5]Ǔ_? 2>ҟ$Op=֤ԏZ!JhU\9$V}_}tE*0t5xE]CTKT0q4U7gi"$2UqD}-WtWz;2tL+Ih)ͭ_ŃЛ=iuNhw=!~C䓿)Ahq.U\zԝpKa.VSd")UyGŸѵѯXVsHw帇DN6פkwH:z+wC K(FλI2jnl&O7.x%?(O vM _H MC_\EyiLc*>@JؾiD+NB7|?X[g=%*4kŬA~9ĔpfUx7&;J>b!kd >ß }eb^Dδ^2 fJ_"mr ^ͷjXJ8~b,?f[s[=w^s!źFld]I j؆}IR؂:]S bPR@DPh^ԕv\}_y* 鄿g3__&B.!Uyqڏ{f;63Kʋo9:tnr8`F :{0~YzIqRmvp|2; b)}@ Lv&}(~0ljj 4GYq,ܵgρQQJrnC\Qqw;`ħټX썗cϽj'V %!>%9]aP7ϟ KQc& @m.Nj|(>[.urR*hFSXͷY&Q)O6w/ʲI{-i]"NK퉔cQzYRH\{$1EvwaEg%WZiuQj-4 w*Um9Xy+cP A(YpMJKAeؽ4V)3r%1r1QDqB|"ԦTrV>wJ$uWhDPS=}}^_>_jJzLBмE._,6W%UHh9dCgOZatb>x^` FatM+߶'CaA2~PAWoڢ3lYk#Ӂ>p_؈~I2g )LjXb?W!"<.oe}sPy_<@tuDw"N^J;e$S1P;^K#tw;XbN[m8L4.;:q iDZMo&c.ЉֶJPx[3`O0q8EHa`)U}:*"y=`iR !W@S*ބQm3dQftk6׆=m=c&܌BXkA[Aae x('``G11)ΩӘ`ϑ W^ۺ,-rVL dH;u;nMK\Zߎ 0l s>)UcM;f^/Aoi;EJ N .)Q}nh?'| r]ZE?@t{ٯ(! Lc^<0S# a0{ =cLqI\F%-ylu {MoCIwI2DF. l-~ }Um:MiQ-ycaf&qӅ3xҟJ!Lh֐Rq1osZu*g_V.k6ooN>fyC~ѸasW{e'_Fc);vr]sv ECRFVmL"Ch!.zK_cL(V)k;U_\YPD(/B"+"~0>8S%!CcF9%~y]"Pp%w"?눗8i|p" Äȿ,ɜaMGμ?4Psp2O MOPSl`^0m$rc`nӬ!7Qd772(Py|`hlڠQk7Q?|{r;&g.*z)D Uvs?ݯ'k)Ak7 2%L#y d,Z7yQ]J>tZ%X2 )jQ%\*xg SKQy}w?`{dat/~ږ9IV 93()k'#G?zd0&Q1\)(W ðNay%`~խ%dZR$1H+#EPq>-؈-6a٬U$OA8;=LpF&l 9+媇 Gu}Yy[\k4 Sh Bv֬XDK_zp.rdjF;3\4?cgvB?Bo%Vt`R!FxsshQޔ3􀢑-p 6iUtjz\MP6o09L&cdPڊ!^X?Ic]/a; Ϲ=B"1qZv 2KN5=ᵩPzAk!cWӾ-U0W;Ь7Ƿ|A-ЕG%f!hi V% -Ga_rBq2XyvN)4hE8"gVjW#leS54C[U>(*|JIr$ Tz 4)=+/":0w'$6@ N h} ( y2yP"n[8&p/.Sg cEn݅?n]ԈB5#}jvP55}V' V@)VG2=?

~.8?Hk[N~־ߥ|:uf ^9ޮyYAWM",6҃8]҂`/׺osI^><j]utkj85-ן%c{2u>] )eVx1(ՖEuf#@+$tx$O]`v}c瞃\.Dje'5!/,͗9FӣŻ"]xЈ)`~m*fSٓ.ׄuC~Y!ds[mS OVPezo3|Q&ݙ/oHX[IOAw%3xg^4Y)i'ƏχMZѝV)8 8VX|;RK}P-5āRW8lH}KcatS$՟5W eY. l|nI :SX*>$ݬB쑪 PR~8wm[yB_%a/ a5.S^݇U@dҁٕni!~=z^5뤨҈3- `v`q/_%\(ݒ-~asR %W.3HOQ#Aa"*ruUyvJb+!FPPgz %R"y SlJ]ªe'a:51y^Wl\)?Yjf0v3fLz꫑ɈW.%#f>BTN@%D%Vhs*XPlA h=+?EnÐ)=p^%b@=tw~(ޑ[3[H!* _:0eGs$8m5%J^00 [Jl5WS F4=1`kK>{CNj^.Cj|7e '$M`ű8u!8I/JxaVb[C0Xp "5jgdbǗlz̢;3USpl9^Eï0/p`@͇ٙ8"튱#J3o~$܅0 =p&)d. \mALwh Cm0F \-VH%2gǨt[p78Щu+O}>_&<dԐ*f{Ĺ1S&si~ogke5R3cf3=F=P9lV1ŐN[[ݮ+{3xaS?0h]7p\SEGEr*&]WgFVpGΊF Oì~Phi`Iל&w$7+ l1\ Hu؛ٻq).]`\x84kۋD;~ ljrFS_oHY"]AjtD@ix6@GNV[W[~, V8Mھ!m1, 3z^NϦ1#b^ʲS}R+EJ\,oZ7C"5ASpv~z"w>YZL7"VѮ[3E&xGȲdRs2dv2S801Z;zguyrʞ>v}xp܏NQ2շgH vY͢WDVYR>< iĐ8h<ܿr0z*am3Oȍ"$) "[*RSX L e6]sٖ} 꾄fmw?Z( O /{!β;Cy>c̀ա|J|jon=v٬V$e jE,6SCe4AS1UF*Y>h2M<ћo|;gzWY"U;mr[UmiRy,`EoZl2V6 _7;p+5VZW]ѦO*өxg༤9=8*j}]O?!0Ca/lj|g{ZI\ʖ[- #V@1ү/)m.m)GO@Ud3d~Fcf d,c&{t貪w&, v rvD}YS|>K̻>mZF; G.!  cIO(WEzo~twi6fcT qN|R1,g8`[T+/oMxQʢ\bEY75K)j89jGD)DmM#g\W, u2 =d+sO7gQ7>oBۺLJ<%o,C'o| \g!ҁCg0 #R;ds u[  YBj+G+iNI j<~l ϵȮΨ?o&j鯲{J4 Ij%1eMșZGA1Gs V,`{_ط 3b%P޽9M`.O}殈|iWLn]d2V _zsL_JrЭp2E2o5z V9#H!zsdU $ e0;H9rc˧ayYɣscc!r:_MUj\9:^柎:=(驀#K&ʍ[=zK})޹~we/>|VT[ &Je cyщKw[5xW`bu K^ Uuz~CҪ.cJT߰m5TXk, Pk`!Z`$ Y`,xCf, &nXԷ^n-<OмAh `Kv}gۅ >*氃;d-`ZT^%gr{0x H;:*YߟM}ۈ, %+VNK*2_8yk׽ٵ T3#БK⧥I(2 , ^q>&Prkz sHwAA(7Y\Se~"t%deo8P_x>U߼?P_Ns2@IӗC,xǩ- YgY`'Zd)פg!$Fo!r=>N̂*uj3`󣷾"5Q'8j`ASb]OҴ`x |Fq~htuzҪQä/+Z[5]*cH-6d|yy!4P4\WO6 Fu43>3Fw>g&XΐZ)*ɦu&%!Dtxa xMRi4[?'uW):L`ر6kĴRD"0a=ɦn+_x"g3jJk7ɟ#W/lq l1;p3.tղtz},-!6lP&i&p k،,Z4)tEۮ)1l74B l`evW66w+Wb64j>ww3j殽Xa"շ:h< 6,vhy2Ug(Z`)\ 2BF6u\K/X DnϪ^{Cs)D`-u,0n4*02{lB]-JpP/ #](kD(}'^68oNyϯ㤲V>pAѡ1*6q-4( Oakog@  /Uluj 2Ww+5'+{SQ8#UʺmB,M *FMHT&I՝$9Vd8GN WLa߱">ZNea\Ըܤ+ 7V±! -׭ˈv~?IE?D"y#y:GF>9Y=U)9tO9uq?rqAv?KD{Jě&R~8q^;kjzk;,Q%(+Ϧ]0~zɬ갑TNk8wUmz痿؏`WJO2-c_P ۊNofRW^[a 8y՜ {l M$d\1b|rZP Ӟ [r[@6dKa0nQr蹹ӂ-XP,ہ}`Ao\GX{\B)9P|9mzleOb@T".u"[w{ J:">\. ɽk/D{+| x_w~.w_͢~5"'FBM|4-vME'߬ՇL7'8mnDՒnp*+M-1+ DM8Gۏ@yLzyJǺt:6ELqK>.aCiCkoH)~w/Es0,+j.>=m&As`k %BIFk1w7v9&RM6 VWЯ9 XD(Lu @y)k3]?ށŹ:5) ,WifhJKD_Ua ̝cNhw$qAQeBs\9Ԗ-.p3`]cgr's"C`tr9I1c؜R탯k{X XY1uӻ'q]9B.+zz¨mvc|ڶmq&h[T^UޛH>AP'k(fc<{?jf_# c*Ui#i@6`# m&!8s"Wa]qE1E'C0I .NG.f M 7{Z\[c*e:SPTUX{,:,(3YVO²OGȅR i*:t&;EJjHAYC8_O W<ӹN O= }דIe׿lQV\k+oSS1 iq鑞zz_׳JOiT5w i36+PX/ȑ5x<ْ)~ͮܦe[z<MzkWp)!N+Q|,X+cq^OIנi!ݒst0Q3Է+,vHĶ *`0!̓X_1w-eiЊ&`*ԦfynE2Z0eع)1q} ͭy˙GH~+bjY0KSIoShJ{{a:LJP!ߧT`ivM;2 w[+"LЯr%{aZ ߅un5N#nq (J3ޡPǙHifMk9 E',W/!Bg/դX^tM#kL5 [^E/Y_qK KQTx Jt^^ސ>ࡆU^Psg+<$ ^O@lZnAO33o2#ކw'Z=E9'k* B- 6ם _ &kjTJvv5$Y̓QK @&!R`}#ߓKQ_؇Q*& ).'1z⯀Z0\eZ!v2z8N')Ft_<-@xg" .X޻BE M/XݝfV͔ 8]u߉2:WuX[)YΗ~f zSy3CKD+Vř †bOSJ%0 Ui\\ # s]{9_<"Xb0 qlٙ5_Uny9@1tnG?KQO޶QH3\ 2 x7 Bwֲg|:}G_sr \i pf|湓5ITm9cJ}%dT$+!1rNXK*K@Ǖ2LNp_ MK]&4:UZ߈M2ݞ,#o }rJjhXXhjhGk@t+R6#RŪ,7WimzMբP3+^09>tK n6rm?PSJTAc宐+GW'=7%忽;0'ݭ'0- L :9]?Y٠cjmpLpkma5IPEpKɱ96Y&`%ʥ+`ۤ[-_0igG"M(f;M=<&?T~(_G\.Txnh:&'r];fmA2n@ݥۊ6;CV_P*rhոY+Q[H\m#>0k1ȔkHa9f .7{^̺7(%6]{zݗm*ER-|I~؉`"-+\Tr.x `A㨱?ͧ;#^!602G$n-R-fhR]a65ek,Q;Db,j ޡEzRgl]"*[/UKۻ+*w9җ5DԕXH2PM3 K\f i.i8BJ#^cWB2o/ aP$Q;%D0fH$oMXPa[ q'aץ=e뗿Tj9 +z-խN1ׯ\hA'1_ܯ)|g*tgcJǙvKB#v2CX,Za*`& })rYoץL\|3 j@T~Se xpLD~hi@ ]zh9yk#Q wtAVP̝y* %[+4xŽ.) N ÷U¹ϰ!U˅ڊBs jOq'+0@pG]?|5|Z-NJr8a8c*zu`:%QM݊)'F?]FoaR73yb,32RvV%Yat%j$0 VS ䷾wR-喹~)Fڔp{3AL3k?}M ӭYы:'<)M!&6w q nc:Dgp 40:˽CT ~9pm/p8 {w'2muk줃@Cqa>jSyR[ԣp!x.2/ :Da!sK誤j]r 8;HܱJ$ߏr_?aG"KH;M :n!Lu˟W[ -GAԪAu0pijo <4ˏgq)մrUR)cM:mP0S/蘂ZNgL %^}m0%%i^:sl:"]vBWL/;?3+–'Dwt)"0}*@zj~;oѡ)M{$FA<=;vJy7xkz@0[Wgp>\ݩ , Ymu@AlbzhɎ|ըdTC*qԔl-4}8$ `*3"8yfe8^e&RJѲ룰N^?j)_}G[F@v!gΏ fٙd>s$T՗SQ> #׊ 3(ԻtHEnP#2_ 5ku}xL@ ;C^)~*~C K:z N5r:v>b8crP*2^‚ ߙhlVQ+<ڞ &xAwM@WHZ;R"Nɯ7Ft!W> !_E$ڋA3|x2Gk%]ZXUTq30x^6H2: R:&s4}%p:KrM$딺uOwc!>G b8L U8VZ><C@3JltU#]?^F!Qw48cZMW~a B|ͺq& " #+e TwS GtPc^OVW(\/7= 2=6lkڝ(#4äuX2nH,nUK6e߰,UW:@_E]$L4Ou жSWlƇ2 5r+?|1E"^he~qc{2l{ʧkYJ8|y`RZT1+Z`$1J8As2[v"p_6]h%#Rˢᤘ6j@Ֆl,dѺ3-X"cTcK%%~pH&TTEj<_XΓ)6#{-zgFw,'p|s`LjFh4;t*J 5%*pƿXj{e\߰s׍\~jI-]? J"Ej: p9þ \ dBUJy hN(C\Mk0l" K5J%M{{ D7[a5UEɑ;;Jlt oVG:$2u'x$B ~%;|;/T fߖ+  u>;3zwsAYqCBgnv-+E/Ӎ\1Jwz,D֖'E~h 9UfpYz3uΘRa-xtzT a\J?3MeLѾ~&@HY1WR|Ri^x)Ku鐞Q9_d3;eg@d3ǏyD>20`IA&xaKt 7*o4kxVq\AFM6 #R'`FIz=AOP=+FgK?z6[סD 5P#a*bUIk˓dោcN!f4쥄 "4I ~D|:' =~V Ӥ$THgHRݰa+xJcTbuG$*\ ;Wh̗`yȚFx&j'JD؝d*\yU5T$ </u $!pP*~:` \ 1>3>Nz'UVsa{ G-_MTwT 7OǃT,wbTpY>ak0J{{H5mΜ[5uy==l ϊ}{k7[F>n̯j?qH>Id):CNym[YBz|"GxGÇ*3\?!c3>6+?p:)ƍYjDՀǟ$ny}:I^':-~FƄ Q/r(\]W=iD*5^~4{tgVn@P"+-OsE$qb?Gqꐌև(奀{<~!Fp8AvSJm,TuBm'5Yery3@y 5E @G$n n~+TBY-wX;ZsTp[*|D # cE$W.P&pur%TqA1a7 6<e& &8.^ N&M s% |.Y-++X.dP|}5Vu+K;CB`Ip1LcqKneG$ ^}!I zCRYO|/-$v6z ;`-h!Ap5Qߒ#C!Uj!c:dM wQI3뱙y癅iA9ę$Ե˽1_dUf 4(mce B4&ǻ<)߻Ր?\S2;<`O!~GP?w?Za?.ӱYY¨J@v?'Cv*#ׯa㾯l;5d43l*y ^h仆&":9-lSsdX*k#uk"ʰ2}h!PBt4NFgD< JgŵѣBP覴JX(zߪ摒ν鞐h_U*8ʙ]S8p0mv!8 lASPZ>P_D$#+}}pYl8 O;1s=OȽHAs~4)!rɠСS>%fSQtӂץ|^!9, ![C3fhD0ݒqj~_BKسiXɛrځcZQgH| cW y'TfC 7:,Y O.ai%@o}7U0P bX372E8&f23i_= S**/=%x ձA@I +.}LbIC&|֣cS #aLxfEBD{Knmha[uP)+d$sYG&39F*-.a߅ ڴA9؁2UsJ]2aO^w irl[3xOQbCsn܆1Nq+,sLL&F{Lz[9Io7:YI?K^Hxk4I9iD]FRg#~Go &-<׌LYѡߟv">: `3:1͗U%?kwF Q:M.-Ue]dXg/L{Be_ >&驪o(LհtS.-cIXB. P[RH* X尫@uИF2c qJFjTl>4EwCee: bcIICSh[&Βsp%f >h;J|D#ɵ<i:qӟ;esF-5>3,5/NK*rq8Bo:8($ퟥ&HHP7J#>㉵l5jNyB`:Y!/N[ 1&_S>I/0 myFrj D9N<ÖAcO3^-]'MzQ]ahVvV!0]. ԟS/![ز;: 6il{m?t`1b14zYo!Xh2놌/63N4~I8=SM@uBIso'd_68Kҥ]oN+9 J%~,pU'[kF% `B}n`H@cEDBXs7n;QeI*bϧ 9ֿĖ/Ji'n'1edy@0kxV/ /6'x tk lX_KոMhdC#]  Jz~ rNޜ0lpKN4-={{+tETu-Ho?b:FasŢMXqax2U 3F٪Whuo-h2D8 vcͤn ;gd^@#T13<`ҕԶ_2̚GKd:f2Uǯ<2)o-D#@OQVɣE͎`;3k[5.Ewm_6^,f{Q mT/ud;jۿ~>Ga~z*2ve/VRڨBh6 LvᶳtOá] `%x&퍴/Dގf\ [v'C?d?&=-*չT5ɷg{b'D]#ǤzEƕ<3Bmf$]@[]ݟV5,s#9+eaދ(ǫ2ơ<:G@ {Zsⵃa%H® R7^8(G40A߃Wg(M_]6gF{unQ%XLWwbԁ5%AGW67Nuba"aLQ &n]k`9.P+IքBR5nzdn5vvC` 3 tej6[FQS@sxYJD!SofJ5ЂFI.'g;>֨pi4džF֑l(]%בȲ‘~ 7p?ﺮ;& u3 L,1:#HkJ:jh5'9{2`<9~@'!3{/jڥqC#*F t)2:8c>bOc 4a/4>F0/Ʃ\M>em|l~ :gخ(".`za$<$=:k(%'?1?PI[QG[M\+[5ecRu@+;8hD{*7*S,vnrjh2j6)|b5`&1Y챊C<ӧJ~/D̏\늩*!)52[wKNP..~*g2G=8^x=F)͖_M g=&#}ixZ< piqGŒ<{[\_k[) 4D9m繺7ҘcRCL9`(ƞOi# ,¾kO{zli?V$|,K(o+5PجQUQ^y k5э+RB4 c_` @V 5]7'蜻(T7q&:Db縚F+h{FjprKj^~swDP;PdNʹ-=b#0hOU?0 Hĩ6]skJTyZ<X=6 `s)q/jgT;<@(,d8CHlw[,&C q[åE"\Q'UC03k_ޡ$B?CU2ƯLn%nΒt%BswCUb)gܮMzЗVv؄gq~fy3~tK`Vf\cd~]ؘFD}85lЖ`Mad8S rl/5nؘJQaV֫3NQ7Q3 #_q3{5@-ZHo PU0{ADU8 MJ,Q8ퟓcLJT N~3-ICvF zF B3Lp 4#Ct{&?:Z#] Klݱd P41:Ldڥcu!6ىYY Nq )~\le=tZܖXy !)'A$cD9oDcxg7jV.Ǿ[/Wp^MJrEkS: ֯d₲CZB|j+T+N֙/xD0! |sx宂N VStb)x_M ա(4,-bTQƫ\X6sҎ)m/:S]0CؿJyt΃Ox~xD}ev|j<&8g/b)Q7"Zp[khBwA.MpPAkOh4"pf:Y&#ipj JKALK S5jzC- wsZnuNGp@Dɑ*o9A 'M"U_eA6k]t1q{%~/j\1ZF[m)ٸ+7 ,1{MLjxA Δ$>!yvH$)MpU6nrx@s-ItobjYO(h{@h ]$GQƴO߬pm.ꭞwp}25g6W( n[n{x"/8܅绕fn<6C/^_c#iMVQa:_tGVІ)|O,~ux mGQo~\rҷƁF/L 9z?-9˳["X K~Kl&0d6߾.bi>jfB<ݑy+GWեȏ* Y>绒\1m(@Y.$- p+B! 7٭S|jfaC~ Þ΃-aabpYzyW>F_c").B. dx_H@>ȹG T8S ʶYRr^{-tuƒ+h~n!F^gEBm5BvKv. < E, &+-Str)r;ٰ5Q&  `{d!H&vH'U;mϪq0 ~$fg`O9V-F2MEi=ԈYե(.6^߯hТd; +QNpGp}ɢuuӡ[x V5q^hͳk*ltӉGINd.- tLu тz^;b V xNY0v 'MYZ5Oڟg6>%X,,PkD:̈́J]8K2#Pv67/} YSY{~c$ 'x􃺻 dBEi5̻3Yj }ZMFܤ׭J%@ Yrm(x c_f>%=ɫa])+j)DCԪ= 3Ȉq1s=+K8ltm} /5=r;X>ͽPHg<;p dTFĪ*tأ]W(30p_88,9-P%Yt*5q#OE:٪g̻N=Ww'&{#I}w Jbl=Cⱏ^¬yϭ~tU_r6xlиPG*oN3VkNԷ9o1Hh`gXHA3eT@8+ מץ?TMW#A^U76C@U%0SB|W1XAC`53|8h{=R)ޝkeEeѦB#*Z )!'˾EůMQ)υoS^v)-!SVgĝ_zC.QW%,+17e;^ UGl$ +\N,A/P_-3Ɂb"WShI5nƃFRTA*;vHʮ%asc+2 ,z]-'+D BWuw1N26ol1ggf'TVExT0APk=M\ UeZ nO^ڬG_C{,-Es7Yz& j`E.2s%@2e-vfPb%Ӹ)j. {Rz Z@nBת,I岂z|ю dpn2qq8vA$قW^DhtkvDh|/ėr<9`WbJ?tZL"K#Ey엲 eU+(' alu_ȉ h(C3%j8oIY_y)3@ODQl֑_VSKڍTMvEX=k=n.{xt؇Ic ݞ8@9E`dSeN)\5 T0eXQl5Hi)cʶ:I҉5i.w_N$aq͖€b=iCp/14{,g9O)5Lf6er7ꜤT`F,9A+^D.IYX"::(-1[RĿA7e躥G Z 'IUMXLff-5c4>OwnOD1p%VRY],P<ƢZ!5\g!s\*L=jCl/1c̡5=lg۹8eO$F Wn'TA.Qhp*F}DoeҀCwKFŸu%dD#*fY4ga`3gPW)o|<3͍_cޚ j[9ᵒ/ joVV /&҄0kKKݧ7]v^g)kE<¨y2O;$ږBB\[߄j9jWtƧ6f+*@O!%BlJHu@8WVn AՕkd n"gb#@<i0*RwJ7=`X #cLpdDe2r` m'HZޗj{`ytAeqH I6ԅ+;^̏i|~2 hl2s߾{;c5|$Ə ''rrѶе8(^#D\7JLEruƢ ~ ko s̠ =S @jKOSʃZɧvSVB^;FM`{?ơ&+3v]#XГ c@R/KȿV by컌6$u'K7`FnfUFᑚ<+Q@+aǮO3Sc҅qg3[Pي q5 '秿x]XIߞ?k=z1W/F+J^%`bd[q[)׊ob;پa~*?iz_@qSMoUa䨬KF95yt7)q f/&5@|t<ů?>9Y8hOJ5I;ub =B tEY1^U:}Jg2PfjĨ ]Vq dnٱu._p2wH G[i?/Oz+FKJNuX5,*n͑=,.Lx3[7RRb`* ΀AY[kp K#&'mbz 3i6SEϘ6He-TM2/FfJwNߖOoRjAwVhXEL#J|&_UtaCR%AncO+Ԩm>hc.'!VeYp3˃CxTDgrc47mzPa/S @&o0Y7֨^N3}:ˋCW9ylܼXnH' ~IQKW/#gct ђ/&i@LFɟ9~P+ԅYN+%AAHW4* B9[e[zk^GZD{x+ws=3vyx}(&VRY5{US.ۊc;jL?{"T^sinWY񟺣Ld!$jyKآj, V@N4Ȥ7\zy$ C;^0OeyVXwl2ǭEtP '>,`BTb-(mx՞|o'zDibtb3Pɤ~jhu`$(-/v{ A،S. Uy8c @2OR:. i+1g4bgC3MUvޕl K~l4'7+~{鐨s g-%T9/.FI2Cq_ J\T4T=pro|EW bh쩤ST+ {Z _*t_"!;;)VP:H:j?II3].]/g:~. ތ\aX$Sd],({Z4azgrZr([Uy2"x˶_/أw;/˯R };qA)6WY hx!^eCv,ybq襙~Û}{7J+8f"w=9+ZeػxD~EOdq1P-f!ˠj+ϗ2)ҶziܥCQ pu"^nF{>8q=Hk)EEٱ_8?7* %HxugCR.c9#QZ.z_Kuִ _nvlG+kxN'z^bB88,kڰhLRԧK> iՈмg3nY>Ҩl\trsd}\S*72p)f^̫Rھ7Ͳ$+&ipt}Gˀ1h-|3F+!20 9_X|9^[at!{'jY\e(?4V|HlDeGEQc)+NFJ2\=AxHy,A9|ª%#ZO,6n[Ogh@LaO7`G~bc iXL1WpK*(Mj5Z#8&0b؟cvZ8hW'{2N @jnăcH& yW&ȋ.Hom[[mB$)ZcoY\y%Mf`cI8ST&=hJğ/Bw Ӓwh6h)nA.:n9m+mz|38z~:LW(qg${e{XIuYnߜdsCȮzpEלp'%~BApbK餏uWb8udU'ԁķrHTMoL> e79YװkmVU>`#Y$ V3ݤZ֧pU NӃ*>[<5*/?n~;HVfi0dOS\vaSp]1k 4 G UX 0 6 x,'~13]Ro*_;$?c8DGVl⸟ ]#7X,<Dv:h<qd{Ce`DإBDä|9nF*LXcl|y\s(MNIߢ˕!E32k;i=gvXMCǹSI}GMEmsCpki^vt+O'qgLL'X^Y|6 G!s捂CHw]`mnxEuӦWXFPMIi(i.{dmCe,bE-N5fc) &8&5t Lͳo 22 X +M Hu=GhVg+N |t"A7;W4J>,nDvӯǼ2cY+?y9hUуCbX=Ua9_bi޺lOGVMeSerb!ү#U(u!9xA8+D]ple-: PT/1^HI3蒊`( N^FoPVX G,-Kӭ6#3>uRA0ڀ8ϛu17īc.\QսD[o=`n@&;äwl *Ͱ=9> "M` :wж1;@E;R`R%G$FasIv`yp{Ico-0[7>P *4M"GĹCR)*4k=ke: YS+3'@=f*0Y1f0YAb>,5}\NʋrZMWoV.ߨ^Q%X翞z) ¨tNs(U:e>OSАep'U2D6˙Դ-?c؆T@x#s/L+A/{[L.i쌺l]Dcy2n#P+@?zA,߭@Cy2L幑ӎZz\,3H};1V Bv]q_Cݐ]rU SxSW*c}Y )7Ye8*"N6j 00+m=hhf_ Rx LU4Oyh bduS'0MdMQA$[ .;)<-\ױ}~k#QN e},w vTz:ִp@]!C*6}zyiL;Eka8!z^CX::%B_ +4F6CV?!*ۡ ތA': S%6F~-O7X 7Km!@nā=" C oVp:)E퀊no_&x-S#iϑ$׈?ub]#Set6</j˲0?&+5߸롼nP;(yXI\ nqa"muR~r88v5!߫1 ð'-9BWw2 β^{<2T_BwɑӪX , Mak܏`C\U\<4I]@ɻhD qtѥ|O,o+B{%J4x@ O /KFui|3jYG$McfqRGk~ 7 dgkQi\}F+E54$,m_.1l#p!G3ao|%!_c&b88c$oy{^Yَ˿w.hBױp}CG4@5~=a! $nE߳ėyߥȀҽ 4-o6sXPE;GsbǔK?KN=0WpEs C`Û*4$qqv%(Rr2!ܫX59+O NaxPm캱~[p˹4&#rc^rEV<67жxo_.l 5/lXX2UY ) 3cu!/{ Ly۸`/aKElY1) U90N!k:Jtq^"_QpTŹ_j?.Ȃ x@;`,"pqD%`zl-8<.;|-joqgs^sl?Sg\ OJp%\#JcPsvʇǗ-'5rΡrP-͵g[U޶ZF#ÐV:,VkS}(qW"UONuX!~C vBw_&5>&⭺_ٷ5?| 'wڦ;;J[?ȁ@*2[fI.-װb!iI'RT }vs XװnYLS/S{R,[w4YCf[*xPPj͠;x9׍XIK OUX+$;53Meks~G>2K lS0I 'PRLr]raVfKZrPH0~+s)C\8T"ʦj \p>N@(`>o&0@bh=Iw"qg*A4760Bbo<ʲ BգةvL_[2G]7ׅU 4pBo'$cX' TV"k>'s1ɹG2 j Q5Nsh]$hm܊L'Hi̦˃\JFP S!uU4cf԰ݑap߼3vCSIK\\jZO-1JyzTh͔`S y Չ_\~- C&XlInu@n+n%! y>.zш+gK leC/f\}dGP[ӝM`ٷ$ɟ׼s'. v{ ]}`%i| [ۨcѷ%vVo<= (Q+Bpǩ$/P.f@l*}>Bbuj{Mkzc' E/Ǣ~! |k*X[#h٫J*@-)wڠ@^DeՂªCU$θ)WL`+JK`=7D|J>݋s톾>/`d񣜤ÁHβUbcoibh2Y@V2^̉ m9ulj{$kF90ژJ;6S R!5wŦ !|1ȯR1]p3 GH<`oeȅ3Ih/"$䇄Xs:ڃYqjRG &6Z)Ho2JX yRD 1 7RBz[te@qՁ㣷i fKk#WD"0..Yl>2.sK07 b'(CH0+C>kFOM="y9qn; ' RcE}B %%P5qq"B_z6P[u@sO؞`c1W8,h]ApHoL -=|\^C$Ya=}{NjQtU45UnӌM*w1\ScXN:E&Gbr,xTj1h,s"SpO{`"mĂ% )NZmq}5 {,ୁkVRz_tSkEDTM<l;xoja3:|s !~^M=̽O X A΋Dot5HO=1ǎ-5 Kl_e{eamr<'c_Ԝ?f4QĞ%:| rR?}])%6沯)D*b,8NJy:{/9 IOÞeo]Z{H>Z < _Kջ atD LEtFR֪d?C IpƂֱGLEr8 a8g{.~xw ^s.22/flM,aS.pdlYž5zʤM M$4 v 5WTVRz1X[y%q1 Ӄ%-SmoXbWm:ʱJOz9;Bm.%_u 7_2h/2 4nG>)caXjo CW )N.Uo9.׀m"H:5(N6Usz%l>-7#k&i<2uhV3)dbܦcǺݑ"zLj38 pЃhjP>4>%Cou4(Dr飥C\.93;}8^N*rB^WA׉4z  e2'Ie":x5P[ɪKe~Ա"&c3ddsXMO|kSRO^9~3nSvm L]&@ (ݪ瘐6oz$R[hDǸ/꬜EN^d&A$TxK@f9dEsoW佀g_mH -<@A9f+uએ.|lI1zqOi/w,{uQmu*Zh%twj,'Vhc"d-VTwjkӯcRZ3x,p#7@'AKE;bsX43d3K)7;5Ӌ8{VCg> glث%uF6؋cz WZ,%Jvkb0"CÄE 13gr)5휒J#TXY@MO164h>Cc l+ D~NCP8Ӄ jSqi cQw78ٹ . 3S~va~LO:O֛ZZnBDӠHBQ{2at"M\[@B2BNޛYz!"be.TQ  #a1d(1BJ,-b@;\j fWq[2JH7YF-? {}(yl1 $'(Vz49/=rh$~ C..Wm[ֶF{=Zxac'd`^K$_ey>fGՓ 4B$8tpCXpt5ؿ~7o{I6yNqGJa[]7 HɶJ&y&e?,lQȬeͶVx9Th-iۉǠJIX"k7L ÎcWS3i(z+X 0%H9C4n`_%E $CVA{ AnTs%bWwBC:{|A'- "[ֶQpbM;ݸf3bά]Qa( EĒ4P Fvk Q Jfg#w-LYE#dƈ  i-VL}EM~nPw_@tRL<ѿ~jbLwH[#( BQ?͏ d4Ys ~UhwfʭX&xz.)꺧u`>r09=7lwT5Eީb4ȹ!S{-*4f-V^(l^g Fvi} s&BNM[}UXă'OϽf~b:EIQ1}xcUFg}+W-cw!T*d&+1mrJŠ6C|- .mg/,ILAkvKF7f̴'"Pj-x}#£5k8H'~mtF|6/~y(kG\8>+h4O}_AK*퀋%z=Yؕ"4'`"'1_"> "8:ɿE`uƮPX>1{Bx̊}3'qb(u&t(B kqty!ӑ8s]n%`*hNBزD>RF-+'X_Oua$bmA"uB,q%hLg8T/U9P~@ĭ;7:qG56[]C%pk}1m5!}޽L6 T_/[4['d<0ʥ&|Le WDeT?Y`TҝMۮoRJ7amPD%k\DfqMReU4#6rƁ̪:Y*h&q6NB"oÒFf~r :<Z#>Zf yS8'n {'az\*V|io9aֳD4^2=4-RT7FC- \ssF`[ `K. @Iu<6$1ju1H}<%yRd4aER%< RRX).|X0 ;r(1(o2VHgbEdUMGu u6'| ҍ~F)]W5l+=~iua5b#9I.OLdSlصsy9<*DI̿B$C EC}_vLSHOx+w ^ V Hfu2DطzU/S+'eY9+aY~.!XMSj;Dw1 ZK7Qϻg3Ma_1XzoH5<* *폯6ڽ FI8Bb?'ghi#f BrK`dx\U&ʖ g1HENgsh(f s%"#>ƾA2V6鍵(jL/=,%x rFݸ.CSaìXGel;k@$ Rz ;-2wK 0J]ԅ96$⯤Fz$rP;]TI{f 0bG4msoI .QRM ĵN·re| 5nFe9^Mv)FKJub F,UbZ2s'`o$ 黼Euw ś-BT4&X;i:ᢏ=< riuNtJl=ݹxu_ fǟ][`?Dwy|=XOޱbԳ`$cduBn\ۑ%4%IaBqNGMU'PhۓWqa,zf4qU*=N:|(3QuZ9*lsuF:Lo(Y7Εv 4'ZcXCks3&F.h)8(q\D qEki,xI9#Ѱ nTZ¼Be+@lɦGި|ݎpO{Փg~AFK߾rۃs>' 7T?=wC@cˢ-Db*sE&[a4UQ;Ed8wp8zCx3G=渷sczq++֑GE=Qjԕ3S>#ItA,Z+@;ulyi"9HlkS*6 k+QI3bE벵֫mTV* |pdֳY_API>Rluz;R{՘2Cٍb$V)b1\? ̂<{YYȑ@m@\Aﰞ0! ]FJ**3rinh,w}}@l2=aW `N?3eP99IO^TA*^{岥P@=b\3`Ƴc8SL GNYӣzCJaZa|̱)qq@H o?z:h4 Ɇ=kT(4Fކ$V$nqtƧ>=HE; Cz@cO&Y'5Yr>hUnp -!#Aw2gVG|L׽lc;/Nr{D>&BaK&T;oj^Lڸz|6XD)v0T-ZvK^EVg'-[#Mf.+:@BѐyK,ߋݮ8сY\ ╆hiIsqhꈹ v/nClzïl9~`$76M |/a n[IȌ\y*Uf 16 EҲ»Z=Mz7XR='ycBfiJ{5?P7ʵuTlhL +šYxO'i-%N<,j\Y겨Qr*c=#,cтC wT. >Be0Cwm˺eXKuۭ`n 0[f:XI6 ]7疚Er̔Ë9qB+r!F@Op%,s|x}-2m~rؘiPDwEɤ?=_y5B3ȞFYLhKuV ݺ,n5{f[0"z@05BLХ=N&[hTBswRh vڍ'Aj5?r] Xcb T/t0o<)k zWυ7àz/ ^b֍TfecVNECN+-xNRGAk%vG!a냙(H7Ao/4wo ҸmҤ'΄NU.8J4n(~0[cVͪ)|.|ٺ<1Dmؒx~ð!~Vd2۵[sۏ<1-ѳ:uJmQAȇmI&"`rlQiBƣQsB> #ҼȖL'Um KSLJ@ 'i(n L|BSGAֺ+Ͽ`[\U oh=0ms)}""8_hYݪc}Ύ^3?Mw)Y: 9$GJvlm3%f~A+HF8!C?wW K0_cgE4R|9%8/qMt=ԯ(]WS97{PڎUV?wQAH*Q_E~t'\RV!kU.?*(^sMX::IVُh~91i9J&痩8rD1zzi6SOLJ v!,{qC̐>P4H \"}G%P}U+!qT3`LFɩx E&'$ҿ@¸`3ڌјIHv&gvvZo->NpYQI}~o'u4D~E*g`M[`sa'RSt]D}x"1]18HWuV&%yu'c7yYFRIsʉ;&vo-R!F,[N@Wug+M ^'+|q݅*bC3,d;n$`Ά췵 `YOP&aDo=d s~[7Hb 3aRuOh #Z?0V.gy"IE|J)eZ y$cF~T5 T)Ug ^ovAH>F77/JkTp)@a}P67xmI=wE~Kz}n?Rih[bf_~P0LFr`IDS*Ik ]+P`HR+1AHwᅪz\E.Yig‰TX2yU &++A(&א33~!G&i^c Tb7&8-JvV3̞̏%!B~K1 &=>,)DZ#8+/-%w-w.5'IG`g\[΢7UvX;z~US&)]-”C3Ns7Mi[' !w2P9c[/ePNCEF#;b 19q5 R-X EmF&_+&z.'c}5@&wOsu4biA,a=w3lZlUQA&lM ys߯T]Qvt;DwSo؜nť w%"RD>ݎEވ>זTm#:\bq%ڒ+vfHzڕow5W}!~ug[Ε ;OŋR-aŲ8zk&@ ѿ:A^[mzxE"I˺5;̮W1+dZ-WAq/U4 /Om=D@LdD!/tjOV諓[+@1킛 yjKV PfOᓄdXVց7V BSyLy 84,CB e^u&8 g)¿t8y18ˍV')g\y.y`Dq9qKk(~6$]G;%Ho*b[50;g>cj~f{ Z`wf X )KM[;Ɍs" Q_wyG'qv)şJ=04c ű`2r3-??2k֠3QH犆T%+[U !{9-\G~?47$, ۓ5V?Gؾusd%/pVSbWZY\*m{QEKLCv/1 8Br"*ky bMN'QӨSp(a-ʲg}@{ ߵ)5WN!sdB>>b]H>DGOb0SՈ9ｑK$7m5M$t yTK5R2c,#wz,_'oAsE1Bj>|v|DK[͚"n6ieWPY7#~beh1mAs8a6Zc5[ r/Qlʗ3`))5?;a-~3o/#!$7QugV(kf}'E`Jx-9Ԧۍ`[D\J䈀b=!G! XkuKMygHiʍ BV/^65@Bp(51!܏`4a~ի3iQDnīVPzcKgR_@9[ pKE%6fT  Ļ 籽H"LtdA/ZZ~#{!|4[dÚ'KqAnpNB}ߗKUx|:Kȇc$MȈ'VMO4 6;r{*Ra"d sg£Q g~ra$!2Sz DU@KFiy^0$|^}G%'{ ix9qNa| FI4p۹PNR]3Vt5!s68&/d ek!JnspT%[StAPVnmխ]_z[Id ށHso^Je۾e_, S[! ~H=Om?p+S C*$Լs-1I9 /"=`h wR׉>Ε>`낗 ઽحX Ҕ{N .’`P "e]$ٵCѺbQ_3RVIV>ݥWJa=9rIYWVbsf Ɲ)@KU,MI3JOTvyiQ<½\NkOՅ(u&C݃̆e6*,* ED|MR'n"{Tz5.}UgbK~c&p8o yv?,zvI2Qغu|43 $'t>,DtFDehU/TZ tZDOH?U^ R$^9m6eZERXV*j(,&)5m!!6 =)Y%a۞|cy ^-kxZ QC-j+"ϺMO*뺵"^~4p9ٓ"6w!6(K\'Cgr,63#7`!=IV}r€JA>k^O+}Jvr1ã}v ߋB B=1*G%ghØz7Q{1riSƕ( hr-,bǑW_-hWҒ+ͻH=oX|+ndy>]YP+.z].9w܁V?OQ1ת >)/kTg)aEyDI3K z06Rgљ_e]E|-Ȉ.J¡Ԓц̵dʙ+8c ")QU<ⴋ-ZJ}wK֧`~#]Kd'yRvg?%$!nSd6AV 3f99ek-K e> ɖ}Ԇ#j'̕K ͷ78\FPY#( lx>ۣ" MȆ^\jl?_pݔMh8%I'lji'+%$7 "h{F)5&=I{Psgyr)›|63ځ< p}ݺFU8NG* BNCᳬ=&<nK0mއ+rdW,ٓ/EKN%&'1@@6\<OZŃPQmMO_}ath!'QԂmzBP96qlAd,JRk%?z9ԝHWztS RM<3G_\1?T-M-B7Jm4,`hA?sU'4hn3[J&sZ6q+'u@Ĝ$v9,}^3/w1'KEKI8Ւ"M(:֧XK?wgbv!ժsl98=kelh%TTWӺH(b65G&VD[\ff$*ЮAhJRH1u;@1Tɸ$ן|.{yKvid8SQ~kL6fn y=SŁGhR4O 1^M<1{S?a lnu4Xn/"W)| Y7tSAD]hOq쌽Ma2Bѯe0H~=^JF HKE('Lq3M)[@X!G@KvjJ,46addEB+̟Jؤ -nο`:gjnET78֞0HBQ_D} \97⊵0!is{: է3\I({2o !dxҰ9{|0oK~~=:hh~' 0=h8f* Lv0OzJ4 w3*+9]Yf/ڜ8{>k FRD$S<Áeg |797,Nf, )}':q?4 MT7Y>s\n/w*[b6Y r2-SGg*~ KsreCUDAs^K,ƭ~VpD3FW/We*|oh#/'ܨZQ[H:?<ӱC[C$)+'SyW9oWN?Sr1"xm ;\ ~_DW J0@ .h{ ¶1^ NTbX oCAJrS~$O '.6m+ M}!kF q㉜'2ɑ| b{/\Ǽ$M&J'> қ<e`ovQz.I|A AJZ(KVT%V|{qSnYN }G@LIáHǚ]6rRn'l|tís rmRQ&l0 اUo9BqZ'հ3:{u8<1PǺHF J dlZ×9B-( :wRUBIu#,nF4DcxeZG{dv8ԣi^ƅy4@8ҖA ~@M ꘨_~6q{B䋲 b i!Nz:yl:Hjא{U >Q < ((qW9q?M᫹ȵ>vpaS(1-c߾y{/%4{1&]"O5pӫֶȍ% M;u㺹3[`ƿ! j =}Ƴ卫+ަXţcݫ`~J '"D"rmUKI%[GUZ~а@iЊU8h؂ ]#y ' z&eL($s랶#jkGJ~L;.>>NLTi!4 džJ:52e $b 濓i3&fh^KQۍ.ak2";zV%+lJAH {t Wʹ^y|j%:hYèhFVXoDyMU:BuݢXeXL&c5')3w٥uRoL۷*7Du*_D1@yM~N Oa+M>AA#996"#{m۰1,5隙[dT53\pSzUR &FZE.?޶dd^]V^3zg$hI@Na{CIRXms|&B{ M ŊO^D_0ȣ4s$X'[5pL_M$mzl46Uu% 3%~$2a $ )2r)7^$lSqN]J.NIJ] sgMZeuJ^)",r j(BnAZkkQvF~q-n &M>ׁvwUN0!li3@tZoӢ#GB1T6}3BH2>sqY$eүD[қLq+z-\Pʤg ̜{D]-Pϥ3=j6{ /BB o /iʔz"EeRhu/r_ۀS)BF*n|S΍%_WB -:Ft[==]2jm'({*wݤW_HR;  `ީ:)RkR_W$ō*9`8Rt2pU}Fye&!)l:}4/OZp^/3'o2WDh( l"ȓMR6~;:p)ջk4 @>/"*Pw/]R}f[PK@bFVxv˕>,⋘\( X wl-}2ZI?SLlxgyv<>.vH1ߋL1h.lv+%/vP|['5Jk^p^rK,>8ojxM#0?$(gXY$̈A*j#5L*4.@ bqe#HAWy/$^רa7Ca!jЉ`(k'Oϛ{sB!.< 89"O68:ˀ%44`aB1EѼ3"|{ۆ;$w ) )1B7e(*)Ncy,9}uwy;-o1J*97HY7i  >#SU%*HE|(-%)A̳4XUo(= !x8=hRK>AeWk lژ?EqK2 \R6N6'UKiRrJ 勐 @PK * H +Sވ\+XgFl8D 3ON3I IMg&}1_678qy 0[:R1UTK*+(}zRxO n( Ӣ%&d>]^G;C,N^ S  o W{gdCF'|6I ^U?X#d6~1[b&dO?+.cFqQ݌｝2\E@qӧ9Q/_SCu@kG bpwaK nd {#|oybȃJ.M҃"_e=M 8}W$M଑ 5h rW KG\3rI<vE“UVh58nj͕Y^5`sWAf koCID.=ȅ v4A|<ᝫ8+njx#N NTӰɠFkG%唞ba%v%uOntAkgU*"x7z bJ&nT$ .E\zE ~jQ0 Cqzn$ V|qVm +-Z&j_5]q{0kGYe77ds͙BCvqַ`A\1Bn+7#<ٻ[!fl)WWtVtǭ@7Xj<]R.rjB2c0<*? ʖ:k^.ɉ'=m Pއu5h9_:ܡzAMplY!KRPWu{@Cߣ'MOH#ZxyP*; qQtC'e%_ېiD} +h Ac׻aʜťY)MoXX4{'Cn>̬UĢș# B,,RX:,r/Ũ7p5fm<#d_?GwRΣ]q^bQ.ɐپvo@!<XEx:GdPG\:u@5RW S_ l3%ŽtG ^D#sH%$.G:C5sy1o'X~IUDHøռ藉G5+fuwqB?li.^eosMz;]EdI#˰!lx-/a_EljCPG(%`^]I]ú7Z^E5:͌Y=-3XvNU_Lf |C$7KșK o[ѺnŠ4BSu{A9B6g5c6z@ҚLMqzv# ޙ+>]G1x6eBb-烐JL5έ)؏2h>zB>>.o_+"赤AZV/= |/1ԑi".1czMȌzIJ%M@=b46^$v9&FgaqI^{d< ٙQNl$ iwoq]E!ݼ7v,AĔy x,2 ~s_Q =Y^l([J¤}Ev}"~"/s $*,IF%(9J]`6F[C&Ew*nӢ(|]8 IL%3s$cш@y:)h<"`qNێ.OsL?`1l=4fS=YHDr!Vr҈;NO1c;9tGD7[T*o5?vpB!ZDDzxL)h+E ;bd,,O2Qb v`-n0vLBH =eڒ5V{Ąpd;Dl9)'OsF2X3hMu 0x?FO{3MA4axY3d =or&%sĠCJ3s! %˯~ҝ9,6 mmӴ+"5y}#r}h .pfow4PQb7( --H1I K_oQ8׽LEyeE^zU&u1`qCoFj*)|6 r')q6GA&[y/΁Q d>_5YID;\Q!oOO*âf >b~sp_tŔK:TCA-n2@#5ڛw}㷓Q81zRnxa?>iz;ņWlPY)Ћ[. Q):$Y.D]@ƴ%021pyuS0U }.4plYfWeAWN}(m!Ig1p-b|C2&z4_?tXpk E`nI?*У+~ 7Vci (I[3ѐ!tX#uqeu 0z߯L͡SX@*s&׾ޒ*YW.5R42W=VjGz<؍akĹUƭ+ߠzAr12L" ۷52dޫ=7 n<}0X|n4GWTjQG tpRv/9c; _#2M ;}SXކo郫aHd]AE Ah8v4%ɬl_[ ,)yaJ74dD2WfP1:UXl Z7 0ˋ=6! 嗷p#p֧aF0!܌&hkivFt$l`.Y ` ?~/S{2KW{tgUTlXK=]'/r:Xc:;$2ܙ&HiD% X}iʄH4f9䱽&v4!$5I0n.> ;_lBaHQr2Y:fO<Co1|-ӛ8x"(HRZ"BN@otҸe.\;ϬH+G՞LXyxY]+gCf\H16Y[Ӵ}gW'Tp맆$kcqWZeкTҩsBlhN7\&"R%+~$劉 Bz |RvR?>t^\~UXH5 \ro?Y3ΎG B(r;}0qtu>qov:3^pXY*a^7wZĤDL,{5 ~HUաFy"鏸_QZ"4?Ef@I@!{>}FqTAKęLll*ӐŝK4AQc7z=TN辿<7h[_7 !@'d1`2J!WdAk-lvL{B8{P~|sb3F`NqiFbjC&lO3Aܨ~R&(7"E9N}^Un =3 dy0 f :tq>cǩ={KsX!k#/C"ؾ0 N$k$INpF?VI$9O|CZjRXnp5ŲġؙzF eÜȎ?#LMDKzL×qUgI$\V 7,@UP2(sW#ʱj%jXs>ΈjYT`,WE$~LlrВD,($ʂ Ag# '߿̀.OH 7}rgi+!$m$4,K@Ï ~sb84Jk92=jHt*ޡb$Li pЕ+W tn1)+^uH۔S9*39T)Qi zfKt 7\Y=8K>-ה)P.o Amt=v!@@w UP@((ň)XV"EF Ы> :eb-VP=OٙC&;( vuعT$"8gHz{qL%~umY]$K*CoRфT7ai|:9%QN8J57bA? /HHf罘ᓲxa6{IE՚v8O!r|kʡbQG0V#cqu Myx J畮#M0G`ns_A}LH>fw8_E%G {m3^ԲPh$YB)yyߋQ5VrcQ uJ '"`ЁDGгG؀ފK:vޜqtאV/\b2S`;6۠դ$gG f{j PiOc #cQU  OF Pjڑ}1=Uq"ͤoȧ_S=>,L)q' y;?=bޥgncɊƼ֬e 9d*aR"3a۰c٤qgя^ԅ~l~F3A./_-!j zHlQ.~zݏJe as6g׈ ֤x j bbr{bKiz¼xjZ^Ð& ?sW$ɚg6 g!gٱSWՈ$~8*SAW d8<Ǫ207O3biє}hVlumHm=_K D|Xaf#6EoU{iy^Tߘz#MY>ؔ*r$Jv|0p';'wS @ SͥSٶPXb$q2X0[V=Bi7VMaHHj~H@cznɷ"KVZT{HNe[ik J (LHb$zP8 7IAj8Glb_RpUC*}Iqb|> r/ 2S௡%7,gTW 7ۯwYտ?YRء.2uϞD80Zb]SaK}Tn9h`Ө:!R~Ucis͏vȔ * jlbڼp>Yae?(9I>>O׻a@jl9:RMY nFM9H:D ]S&Q?ZO pVC챁,U_?#oՊR.qwį19mF`"Dek[}8pB/Pb4VR-,~-V{җ3%N|~<[53w@: %jm# ݟcwRyfVyG(BjZnڄmNIS̳)J-9h&0G-9d@YScX!7V Qɚq+ndmYL1#¹h8Gl΅;Vmrÿ$jv1ry[~  [bfN77Rd#g@Rb8f4u):,XW@H* H-j Ip9E6!\_,JO*=I/2=aeH t@"[o@3e>JP?Z jKL{&h&B*b9#ml.Opk8/:gOngQr|)ta?10yG *i.P;/.N3`Hn 84TFḋHWĺ Mu5[&.ay]G 4ΌP@pҍW]N\$dKj*whG3mnLu1D Q7F";;Wp.TA.'וA &0c5m}u` B}t9PN׼Bk0zJ  ފxG/MH\ avkuSS.1U ֟~&yКs|7!hMw {XE⻷D#xcɆǖ?W2-_7ip-`cD:Ya ݳUdYSc|,J1@@蜇uE@dbt9V@SG<}6,cE,{& Ʀ׷B.Y5Vi4G4o4 1+HE\:㖛&ZP_ҷsve,-ㅩ]=ܴ5cr8QdlUV={XD0 T"8ڬƄ,r]hU.lYUZR_VBe1߱,Ǡ> u.eD:%yg܀V`4Xg| ̛-\]FZ PyFB@ˣ OZGgBjĺ M$4y>Y-B_瀷罭~8cE\`&E$f;VM2J[C̻B3 $=ŒYH+ӊ̤jz -<>'Z_ *DFÉtj@='{wE-GŻ%)m7+49* oK mkᰟTd;5HTt&Pq?rƩz*!ZY6R#7\ [b}^kTR9R!齠JxFԙt0ߢԜr&}b *|ځjc欩+}J.&t ߫ '"nTQ_uF}HV|E t!J<9G\y5#jWhp4ֆAGsf㹖q m n6ԓR67F#FyQ{ɐkLZ|/5#ꦠt;5G[.Ƥp!/ϣ|tp ;m4xFs'WaCĘuNl{ڧm@4(6 4Sm <5e׮ ­-~JT4ɷow #Ϛ~sw?EXeU/vq,sLfLoq^@GPqAA!)o}k2(>9QS"AB 0%wveq$\Y=(J! K [ '2Hh0Z,u'+t[|bS ]mUP-adE:uN`j;Nh'PP̎_AUa䳀sA:Ahcn3t/R ^z1[Kx"IJ}h~'9EA[8|E¨d2@ Xd ; Dq&UA٧]1ʣQ9DF?*6' QEwׂǶH> f%uƬgy{!]?&bh\>3e 1c>;o*;ިUOdY/}%rQH.I_Xʞ|G>Yyao%fs)-Rp*GAO|Zm<غX'A.&HusxaLpbZLL@ :&Ȭ 4mnz/w#}[-ڒ$Ό4Mw MJbȅ˶'On al/a颵4qijlKxBǜJB}G=E79 g _4\tYu]!wX{0}5&h. ?V&ARxUFfIe f}m˷*d(VO-n~H/PgP(!ceI`M2 E@lEcuN2X! &طBXq?9Om?.q 82#ᬶZvsӞJ7~89,d{ʗQ9Gc`ECR8A‡i:ʨ\3}jW |PP{s$Y[|;Wړ|bT %vmA^UD2@ˆe<njM_jC"ޯҪ-S2 grG8iv<% jp/?E`hA{U,Ci= ³;4sc.<UI"@fHRnL[~! 9}  P,зneJC%U)}z`دyD *p %@-U p.a\M42W!ɉ7BOU ߒףo{CpdP FD$Xn S|C6mm|Ez>,+$[+,X ĺ[F k J2DU zY)ArVeE†T[Uՙ􃝉*FN{5ݔ2go1v-1ח˿: II##hs~r؀A {gՃljSdM9PC*~dg ?""Evb %cjHC}eǧȸݡV?}h]?$)3!Yj ğ9E|a'*tA;OfYr!ѻ.euє^ kA҉i`¼a7 BtN|~OÂ1Hu9+_ڷqd7KAg(} E9mPҚ.ySUho(߳P/-i!k^ Ǡ6 2)ȿӖK<<|jc\oSDN;Y0- :}"%zG>UM+Dn(Tal)wѤ,-G=wpCCPfnm# tWPD~g2YQeI_y5R?:܃z,^VN9*ت8X;bJX(ᓫ{3W)fPY勷_F{l7f:x"PrM{\i )Qξ)6Xkkb44Qfㄨhzeqi^"(zI9%4LZ*M0!d)M}l?vhEk?+oG ܩT/΃jhНTOg)n̰۞Ei^(b*Grle܎BFs`pSoFr6TLjbrA= tU]45ܺc _i}yOŸyREF <=Q" 3'>m!H5aN:i8 DD s٧5 _oIthM!j.~ uNJ&ʞ~RA6sqth+c9qTOڕc1G>;Uv$:j| A>!jY"#Z:܃QWڷQ>wq_*pׯdxެR`t瀪iPH$*W{z>؊M_FV61Ցtq/ym: $H-y~`%uMARݡK#PMg%OzAl&' &njL,fg4<2`_X4ioG(MG5ZI^$?"_FoШ!1vaC:nr@Tn3P?<{rpUc?נM}g)8=msVp"K==6%eQZaLG慆粹-W &0Vr* [K]6xVПMrt3u}oaT &h^ :bt,A_jktTET:lo<@JWMu_5Rzb:mVo[ k{L_߮F툿 mؽ~K{!%طV ʐ|=~J7QpLjc%^YLQh|R?f3 @pR`prָv]Pp%\I/יّ?:^) `&؈pz&㳄d%iiV *_IYw1 QI4C vK[lnT!txPIB(&9jyjND76\2&rt4j i+$c/t>}͡^O^,q [/L !x w:Y&foD;m$ ·P~QZMʁM]@ہnҤKWctG@bT`i%Bp#k@]liz,^oI5n_I:a~a! 7] , c~|ZB.S 5F&޿vmܤ%ħAx+' I?#? mӖ}ײ~$[ YR ZԌ HWdѩ&e;xE>=_kEж2v=Gm*Ք* 0I3m|WLĶ*ɯ3{n\ĥў:RF ;- ;iDL dR4+SAI8O/$[4 2k DV[ڃe[q2ꇻpC\jGwk`n fLL cn#&u zy<UWc{^B4znҩ ec5eZa (ЖZ7kי0çL{c'Դb~"MS%}߸~ < n$񊇧}F`(|tqb}ы+H1l&dhznr'G+4Kk|vEL2Y0WN5:ex|2oҐi z;ɸOj-hU(݌ޥ_E8. lYy_iQ~aDx{`7bb &ScifJs}H䦒yr'z[k/:$@Vk3[66 %MdaH/ 2mn|IlX{FDŒ#TUJA^W̠R9HAF95zA|LGO-uHM^5ږ3yh^cfd_sWsT+>8FbgĦ,zXᴆt`(\-3\cP *}֭Y[+hلj&Wݕ5':`!=`"C&Wyڇ B錜xօ{'&S` C!fz !w%KR 'kӞp]pIe 64o6Dstg{5{߬`:p%ns6f/Jm*>XvhQ-P]sB,X?4|5$pԖ:KӖ{4<049Yuy?#mCH3[q2"goTSr+,?Hb""-Mt;%C际z::!7%$AƪwLtAvB]*sencWV< 3.klȮֳzT QHpB^g5Ns܈K k伉XHb3[(v,fKADOzjXpq*oj` $lZTHDP<}&6;"_J? g`QX8?6/p^ȻC}So=X| *^eMQ9tEh H'dj e 5oX#8%8-كѹtC}*r_Dmw:vݬO~t:Y&a⩹ixH<~ط.T=Da6^HW \FSUCwMۖ]u>GzbJX4Dw\4Li'yю_*ٯ66`CƑ.3vu) E! 0GGuMvÃU-gw4ޗ[#EGyƆd]Q' Iι̑rWæRȜw{!Dͨ$Aw8Ы<țnۭJTAELm{H^vh ]Z2>&`<=b2 !I4\&}S4y[ԩ'#cĜNwƅ0K*iv*HgZۦrMj%vRMNC=£yg]#͋5ci$4F̩#$C-WPXb> 8-4(NE IjNࠍ9;0m+uḝ~>| utG*w;blgx\;ܲޡv& h?ma#yС=c2:a07 W"I3!p(~sGJLшs`h![U~$+Zw)E>iAT; LӨ](H OS*:faAɹ>H@vܯ&m;pvm=zD^o Iau Jbe!eo 1R`X w:D!iF?:ՙ4HUMF9R;gQW6X.Tp_p'/M.W3Ɩ[1~fVf|,QyǕsȏZ d=\[LO@yCκ4ħ(uR\]xo&F8_.A^Q$H3i( G ڊ֩6Mm-hu`@]W/ECh- 1qUe*EIb̷bGrohWF8Ţ$4T0س)C͑9Q)Ӝ&5"- bPoy:)*`(2i´ڜ[3B{$q.@ U͘,6Xt)2+@YtY6 A>0KyaZXUO}\^ZOj!&IrNe5#d\")AR7ftS!Bwc1P>8N8.J$4,R;2L zf농kD6 3YtTO˫ ˢ:*GQ݆K@?!CvqiM x- @B۱|=؆sfJNc||1:n|h3崘bPѠE&0y#{ =R\E$JS#UcIC+ӻkN*~-Q.`/ ?L'}7rno Ew3x(FgdwD5E!f*S1Q|>:d*-Hߥ^w&N]GF! ,:T`bpFd*"gưS渴Sҭ{І$a7)ܒjqbCӔ}Wh9Jn@  f7Uqbre"z4R/Y"v9neI=e4Y* s- *Cz77ߋhl'*1}9pE[26&`Bmt]."&5ke%zO4~.R^)iӮ E|@R"2Y8ȫF[A͒: ?& ?#>`OIUsOC<~_ 0> >|^w"GӾ)RsH( ; Q"ֿbMonHuVS,J7XM?VLTE1*|:1F).fx U e L rvGƁİ;XxL<(VY[/ml!"b-Pe%cd<,"Wj\T*M=PHJAO"Mۄ)$%v6pYM5&0aQ!Qd̺h*]f(E%0\=܆5Y2jRL>gM1MJhihFMr7pQ) ¾dGӰi,<(u+Ӿg|TP#?u T <*>s˰SuzmGJ:3VtM0VVPHpțgDKU0:n̼lvXaO_1_[Dxw~誶 jrE!%r`2I_~LCRjWjƧ![Ѫwy%7ˉV\İ F%[g~lG?2~9H]gá9b85W t>r V42ʳ?Z4 3%b!5< ږҼO;SvUp7O*ڻ9NR!{;M#՚ i`Z;N$٠i9 ws֚Bo{R7PKӧ~$<3՚ޝ dgV )\ SE<.R7 \N`ǝ(XrDPʨ$6f8oI HjCp Vc쟠sF`Inz;W`S-(VGS: ZE LB&~ VPX ~LD9T użMJVj30zPRGH҄]m~M|Y7GןD?*AA{?k'`Yţ\TK@[ST[zFy#tqz򮐰7?J%8gA"H.Ѷ|4r&tL\NO_9zyⶅٙWXv(VB팝a-&"f 4)1%0(;}\nSTJTpQ+窏83ۍ49 s[¿W.ucH`9!\Nvq8e33XK^~[yC'$cѨ\q*x  j:tXA?OgR#kFctz@VK3ƨ[ ,MG *y'%2WpӾc -" ޓϟx/E臬IwfKP0[~OIfi,k0w-'_zƇ("8zB,Xy8QqTf~&LD6Jpm׿,0cn) YeBj%]mOW3xt D22uZ/zli^\k.؛b.GW_$;|@4[ f򣞺dB3N=y'iYИ lLÞZ bbu($kE4wǁK©-O3 IoML: ց>t,J M#A R$ :. IQo|U`[[ 'VNJu*6F /xBqBlH5 GYN!oz(iF|`+^?!#Y}zvr,Z @mg6ǃ tzyAd_(*저]3ͤnD pO7 ߴn|y5-8-jmY3p).@`dR$ #]rZMl"IS{W ]6mT6^隬nr#Sl^ ĝH?woG`8uypG8a) d_[Ռ+#b)|D %l9Wy^(}|o1;`qxXJjZ}:/#lF~ 4оdr/odăd}WKu3"hj `CS>_s? c: _ţ9FoQyWYqk L%X[ճvvC\&lټUf:f`vp/9)N?c7A t"([ЋsӲN*ۃ]EZB-JKS/䧁(? uhw;NД:#NP,JlsE0)ZFĨyQ49 <^JÃ%H2-)Be6}=z |z@yG_ѓH>'s6!yem6׶㦖9e"e!GԦm0p3vPNBY-8ijm s~b10}b߁0)ǩ,9my8BfSbX`E+3uB(4S1eAakcrҗ&Qm!IhwVI( {TFB1@E vJ^hLQ)Vsڪ 6Bs{M]ra+*xX%9ٗZ7yL&$|DUH30džv`vtAN0kkHkAk`m헂1c@KE~Q^(h#}ho&APōԹե(+Pi݈ZI\`&TF /zϋ-pBzq\˜]r lq|ە]aDz:7]fA~PRXv |X (1wI_{B1#uǀC i#͈wԃ vX5}+ѪI9>s XADW,‰_;[%ۉdWʚEה3!VݲTDT^zJQ[՞t%xv<0/ȑ!FRJGqBg ,syiraVьuXhQQR1=jtqN>]=ȴ`BLǮ6~̏!5FpϷgY~Bh g=|n2g.AI/2)8tNqp }M#-җ9@n<ܽxɑw)oQd(w D2S6B$Z-tq׍N%kkD]*u/٭L[Qԡ‡QMĚ W@"dB^wf<]*=)%(2`ڥ.?Җ~Jo08::aoZn{/BΆ<#50X4d~n'&@hP(3: CpSD Y(H hҡnN[b+:4 ПlݚWgJO~0`}n:z:Q%R{ӻIEĬ' ^ zudhdl/_@9m[@'ªh'FCFK}(xk2z =*yBp7q q=Ub%g)/]l&@oequg^:A|/ 5ʔs|A|C%VpZ|Ta @y;푷rߡ"Rh܈\$Ӱ}lޗNUpp+ԕ *9o S[NˬBj{eDkh%^O.xMF4+AZu)%Q )aVY^'u iUl]+U\* :&E"6r~nDCrM8ZV,$ 0tX|'j&^qyHQT1?5  9 P\h,x"%1 Q+ԡcθMh0X)fH2Н7>FIk{:S4<)0aUעH*/R Q `lSUѴO|D,M2M*fb|䒨;{d_,셠+秇{ƹa=YH?UJu>[FFhm97Q2EudQ\Nyjb(ݢF*4ܿcA,of"o, !ڐXaЊ4GK.i* AC6J#Rp6f<@]B!&g;]ta yڝ'nͤfs E/A༿i/wnԗGh-bI8$ZGp W];B0n-ʚD ̰S>\r>x"o/lw)Vu-Η^^?9zL''LH}~zv? :uCr*-4BgfA)0}  b$ۏ8W晛eq|4*MZ£*θKx2ޅ-FL! 65U$ZJRG Q)*L7v=xl2 d0KDyai\g]Э |_ <ܺ*(d%ԣ^ڵŌverIRO&5t7/ k+%H(`N1O+ê`Fi۴Ykip,1Ɩ,ϸ\H!z%~}նlXXC&u ''Jrru <̷Ecvzr}\%V z&W  ɕaP}4t-\,:h/D$fk&Fhf೿A<\I~d  ~T5rTShM-\50$Wr?5Q]Nu7X`B'fh}h2wjPEvd]PD?r 'P;ӄ|Ki`ÙfbNJoHrz;O%De% Nl{thɈF dgÛ[9p{ͻpu-ٹ>Ǥ+/K-=mge%lB~’+Am`A<=۪ȷt0km{Җz/z0y:p;p,NC:Yv&G$]9Bv»+,-k>U2q:Ҙ*zmk|i5[ثv6.|葒orhQ4bsWws2%L*1nC癙uF= %Cۄfcӕ6- a.Akw?qj2Hv;t 6MLo.X)%J|S V9Wg'dmhAՈv<9-JxA6xtI?j"dh[mԉk6T,Q+ y`D 'PI}<țPGp-.q=aJolB;`vqp@K/I'H/3tzS.ƌVqr*ux~:`(>4gK{WVzYy_ӳ&9l']_&M*,PFf)hR&Qò71H0RJsFmB`O{_Ky)7~ k츮1i!ZB`MEt ם!f{ ((.:6@Yk_&1 W,;)vs}7(F/(R**+)"_7P6Ւ ueqM2;Kn N^$I $P(&aX rChc: 67ᷪLWTw֖As>!kxƶqqkLz7[>f5@h|jeYlheZ)N|C u.*j'oѸj3v^1Q^M+\lzUVEdss7R,#?rBWHw]~ddNְ]|LGf,LNC}׸<·$Yi7ٿ/- Ag JD_'BWa$+q]mfa 0N*_qS4 c7h\$+M))sIW`BkV-]Ihz~C;x 흅*+9P S#z$܌"¼W8Uۖ1Kh;f+ѡ"vΖ eQb^XPM (dCdi=Z%Ít6N8`iK*&Sr u: ޻Y_n@YٽC2@LWdrεENB)A~Qɓ(?6)06uo"x Rk51nkU5|| eɲP '6g㠯Z4IEVK ^R={ $TIzgtC](I*8e9Xp? Wl|K܂/*g)/ N׎NnفHIz\/줹0GRb`E.dAx3~,fRfX q^ ^1%̚1[EQ("_\d ~j9ֈ}p ܆u'/ H0M-t&kui3䌛'wgi" \b \8Sݒ8:<dl!]9cUA/tB1 )V*9_55i-^;7CAqI[g9r&?gi z聑تyzɓl?JDME;ױP <ŶIU xڳ$evVSs' MgX}!1HMXer6Tp,v#HwDSx"uT;'Yu L~00?E@m. I`";݌]dJ4ivWqW6i-}cF *JdJȌ7Onzץ%|^)R+~b[لh *L.)*=BtEYߩb̯83!lBK#N.±{3l>\$2!7±MAjPHjET.)EhoQI3T#QKWR-FUn׊>\ٿɕ/NࡹXAhyEu/u/ڬZ"\{_Pu~m* ESˈ..ӷo./F f?3"S Z|O33K ;]t7{žc%TsŽ`@q#vŚ⟆+g =2@ȄI*Dr}>HH:chub]"~ y2* *U5p#&F ~_9޽s_@=Neu\d[ETTU{S*oFT쐂d1H *ԍ2_o/:}Ղ8u=|Bz)?NSqhO\v`YAMr&͒* Ȝ/8{3Qғ\L'%/zAd270G.$5hpL{V%( o 8)L ˋe{6?|)a;&](L(SeT^Thx#WHsX#[B>9?Cx;_=Y`m#3OY`"m+o4_a`7#ȑE*C~}fs^tAtz1#KaE}~Aʱ$Q/Q? ri2-MPy*=H5qSXIQ_}R%̵aU\_bÐl\Hyf nE#VXL*9$+:뽆 ⩩ރz^8 ː8 `G 24_ϒHL~a іY᭬HԖוy-6V6TqXDif$K(5[4HC_`މ#ʹAd= Rz3.FK=ms-6zRQ$.j]MV4 BݕloƵ~*iR6Ơ&MyW:5zp;NJT>$m jW7dNS(A.~U;.TaZ|(bZ޳ًdfC@R~>)^_YExx'Na7WجCh ηC}*:XK,ݍ{&JToMg*7G2:x^vt >KRHI-6C@T/&CSsp3OE\W7|†e ٥#7c[(2rp kO+˕Yug(<PC3shYN1??΂% 7- p!W.Aˑ Hij#N="_v2z|HCZ8ĈЋa)Kf58tiwY0b~ VN[uqg 6Ffq#c|f뵚eNxy NԢA#O8yi)sp%"Q)ejx\ht 5`><ͅ_Ǟ i|…L#1L{uI阣ٔz<CnjrH;n8yeCS…b=ط;R1N/gRsUvYFgk p8kVJ }9>R˛woHfN-Wu>cȿiUu81Z+6^YH : YͩQ,^ Z,>Ɂ+1I S4j+z?5t/sn T]5D9ylL5 cMRhg)Q 7'5m64Èч>G ^dy'__JτpoCa+%NqIY KUR8¶4!ă5e NjF'c,Qɞ5WciVx/K*SF*s;Pi0 9/, ]zOtqOwEh2$Et[ֳh1 xۭ;%0*Ab'}afdpiQ멍B\9n(oj4ݵ2d/P5t$m^Eatt%%9<<Ԡiݘ> TU-㊖Hk.md9h?~k@[ɾ5&ĄA~\s")GP-0~A(B1:LȈX AmѣhV#,e-ZzP5@wWۇ/FH8&SZhcw+ՒE֌/^~x [ 54#L|C;%-ak #ɭAh*<ֲ&ET:fy yuN>b Mp\dC|:X̄&I\NW9_m!^}a~+|\p42;2O-(8,"8'alCG]NݲEeڞ 3Kؿ6"N ڝBdj_vX/r NiKZE;'6#Ws@Kfg+G;&KWG4X0˸ҵme--/kS˞يd;j&F n8_tEhutIoZ%=}t(W{7n},W` a0zEyMyW@mA!XVF ?#Ejvà柹V" jHVgp$ *dƇͫX|qcx7: %֪bzQK1[*[@s8ך<2iLf)hlˠa,J u J@^t܊yRiqܖpLЎOYGV@T\GJeQM&; 7UU VHXR^6lINX%.}7v8 mRIM _ lvML n<.ϻw_nrkQ+i+:OZ"*ʔfZ,gFR"q9ѽţl`dK{'Vok`No{47oi|Byw]Ш˚9B;Mf'j\2&C``>~sU_~ƟJ T YpgKOC Զ *?f,ZAk)-~:3 ,k ^ZIkϧ{TdܛJo0 #e?D{6H-'vNl?Q]סDYA8C%z_ cs R7G"0*'v=7Ԛ!VP"6VFl;E9CjF6^L~; G0c?}F$lӭ Ȇڃ~duf#NysXrhWgjDpf ٫mV˖1{Z}&Rg|rV,.Y*@e0z/dd~;f~O!,z-0,Z/q&-Z޼H:{/K*Jk>bx@YSyh` X3G|;LcΏ5ғG/txaJcV5+t^E @e(mnk #x ~@Xeɱ`IuրpK ~'lҧX[P(cV6?pu7 +w^Z~js-Fh3#6. ]&'y2XqQV:Qn?ٕ6 MRecp\c.g~C%u04Z+ CJ>TMBRly@KCHrX3coW疶0[JY8.VE\]s$V_e٨װI=㷋l7Va?q|'XlzcLfz-)mb03b;oSvzX[4 /kb{Rg`#F>WχGm+ohKc/9+=3ܢ,HT+"6N<EJ`]%IWyP|{FI٠ 7S;_U8Fvre Oe\zÁwԘ]fe~槹n:+ r$XRߗAx$|<29@"įaj|?DxAy$M4ONƕ!)6o>/]_;5KGC[Z%IqjԼO0hJ]g=E n6llSwA*̎<_Gbn}d;/|bk[Õ.୴֣"@I&cEM ' Y] Qb4qL,GeöQṴrMJ`n̠>ɵ,wOpo2 yԻ%hg5\Q t>{zMsJ'-V CuRvzqSxN"XiyNDq[KE(kI0HM<ڠˑˏk5s4KƘb!c7Tr:7=vy1dV)2{(Au}=?G,\gK܅;Jiq3 ~z< XS*$~ meU:(), /3Sɸn?wVCKW+{_#*{tK1Xo #Lΐ3u4YYD&<]3`zK=|L99X?D tF$8j^\N5RB9wǟn4QCҩddꋇ?+3Q5j69?%A;ϖ=t c0"ʋ+~m[KtBs h'ܐ>\Os갧V녚1o++}n,d/$6pcn6A܂{R:IMN\}^X!d?`s!. lOߗ$ )SZL! ;XO-"_w .e 5"c@N"tp!u{_Z pm kJ;· T k)@{ SboZ:&Zp' u +5]XHI:~pVoW8x2 s_2jPw-G/?S L(" z0CV&y@3i =aSKlϨ5 #ap:BJ!Wki7 :E ›'{M]Ӻ{`QT}چZDlgHȸzp1xA>QW4Wv89S.] CNEuJcF?qk4'yϥqJ6 8KX r<a>YOOqн~-/ xkE(. 2<Ɩ`2]B Z1*12fO#Q(bLG]d eyĸ9mJh7~.hi @r90m sa#`>k^f"0X+@iw_0R0pIljS2x=6!s7jo+ꅡFE /!y 2Di8)Q3V20.rwr_2pb>:C{FաaO6!pw=XK23O,W%:t7E7BSg% C$'p'C-tB]R?<^[?_7H56HS;kS/;ҿג6*g(A"y*kkE0]54X(L( PpJ.)ސX&bum]g@Q- mBHǜ|f:s['I(Ǚ7:ͲޠbI.m<}lc`Wm=&xyw@gj UI{[' U"+,٭r+bA\g/|yewc/&vJNSkBp OBxX8 y|r :U썤݆ȘVZ]'y0qEu.Fz%u,Ѕ4{LRv+m2%!h8naB鳁{ ¥uMsG\muj^XMWNFo%Ywf~U{B%IXwewejWg,hI M@ւyL͒ʚLfMHo/yB:Y:fhk+?PQ^ U2(ú FS߯qT\ vLj`Uha[nvQFv|0Hc}9Zs8)5: D=C{ıwѶ-_|RQBW)g3VxsU7]Dn>VYķ LC%MAygMDA'3Lz;'ͰP7(NP53 yޜ(+(u`=?!XGd;cP%(aGP.!T+-&sfæ7)ߝ,:byI1Hy(6|W SCu3Lr{[Ïq096דBl'JƋ<[Z?1lb2M OAj|8MY͋_h/2?U ͮ '{: $㟩}&:|uNO춢 ф&a, m0 ?H-/=+'|>'+jm)@':,[)2/ͽ|%C 5c҉ RC~ů^g\ + ; զfE#=4A0i/Ab:i ݝX:LMkKKYr:6gȟc{8 ;^Mᷕ:X2d4RxIi;6 [߇qwNIG9T5ze(en&#;sI2 AG>mn|ՍB?qMUDqt8qT6}X^De[+ۢE6/-4TfLz v"ݷK_HaQ,S'|wt D\4 T|h,&(W_< +hPڞ}' s0Ik޵n17-ɡ5O5ͪcnqYȟYӨ&KڦAY*+{30ʻ:_(F%'>3D({];ٽ܁cM TwuH{ )bd &I> {*^+A> 'N ݒ'&0p45I1h<0:o/ʆ\crwg E,`"7دpx miC%bslNAĹZNE0\9 7¯D oUT:[Yg%ĥHy4t]ⲭ_ƒٺȧoJo~נ ͿJv"[0Q'w7t\rt$Zl^d7|B+[qc QZ[c2J&HUmJq7%aQ-{9Ck\h*\*(Q0q E ښBKYpb5r#f$pՅo<!nL3Ugft|bWϫʞy(琘JʓTxV&0~G}[nLYG6Q DUm?djS b;!g_JN*{xbLS(8*͞AvrX-ss6?/Fbt8~o @dORM P5H3îZ 7Zzmoi)PZ]9>2nCK2E]p Bͅw͓ IG)k\xqCLImyP)7MͲ >=!+( _Jx,G-ESѴ-B769K{TC솦̰X1ぉϘ A0OIhl\Asf$n`.e%YITthzH7mMyǴbL-N1CͲU35=.Ac'$Y J9WRI7,C}MH4p_L1E~Q0 hKQzU;~_C)"~m' lTwn>r@%TRjR}-\A4(V$WW \=Bѹi BtmYHm'uULPq Pd:hiPBYP=;7l+殣r : L? ҂>aNbv0hzOɔƦ:_y}K4A2k"; ?7ZveYcyPGOӍ \# :6\¬+WqCWS vӰ)^FvmœhxDd(LR>oJ $#VZu$֚K9gRfliΗH ?z.T!3  ]"}G}6I*'wt;DmDHoMpᯑ9Fu ZT4W Y'(V,һ(pʣgȡQ[7Y ?)xTO JFьe6m+}GZxz(5o/YAejv}T+;4Asq5Hl!ViDg @HҘ`a,G[[gHjSz_#ޠKhSJ`q?K$nd}ʁTz+yyjk}k?wF xP[zv_罗HcRWJ'LCfR`a : 8V}[|f*3+4MttRض—lKݸIoO,x]Gz$+ Sy[{i"& ,Kp>bW"y ݔ4GM׭0Ztbq'7Cõ F V!梡!0vg k}һwEN?!za^ivM5`WHji+ f#SWڈ9ٝKub7XSrQ !wIq8UyG5Oa-+e)qGM"q4"z~/pta7+eC@!i\O5E_NaeƆ[aos㿨tJQ01?|dʂ ΃ql9Mnzoaq.XeMD`N?~[u5r(@k!$Njt|{\m}hT\PFQ6( ϝ1Cpk'd?}Yx[2M?BCDQ0"ӳW?m+hZ{nFqL:FXd>]Mw:OMrL7򩃗VO)a_ q% qm/շ%`,I>2YXMr!؞MǕk;iSo =MTQ#vEMq<q.Acu 5ҽP(;5Ӱ%`X犦YlrdTan;mtVV9g%?-!vgUYNƾ)՜I8b>\EArrh(=@X*&a)3~A4jљ^BFw)L1}qhM`:A Tn@u%ߖ=49T`*wlMIՉEG6O_ )zk= &p8DġR$bxn4MZ:&ڟ"ܨX3.DT̈S[?+DFA([U2W0xp,GKxUjVy-kd#JAڅ166.7;qBP#WdY ep: U~I6~LUe9ښ)6`Gu`xe| gqe޶Ĥ蒺Ar=3c?Co4 3_ 6U>+j b$aC ^?Nou1`*L* /qqp/%n6o֠;KW &_MehG[bOjc؁Z)]LR/"^ý粨90R4fU{):Xf;7~scS$c{s~;zV ܛbJPjfch?1o?# W^ԀP(SuV>N2?&0f#`Oeq*~.&:f5鲘w&JnRv9,q{=|VX[iwgUU`=ڤ:](iY1`uڡo*ezhdc[ _UE߫26%=cUq>i|ѥ!%jqNwb[ Ǫ'h+6ȾB$VtW s'5G"Բ?-H~wF[!P%&[#yÃN*oAMM RIu߽ןđ*$ὺu)5e^l|e?,JeSG>}B3a PXSL_)Z_9|X t̼>zh#¨$)iXj1J/Q>*Y;DP(-r8Րo|yO7^1Xa  ɽj@]na2Wew{Tɏ3nC2!gUpBTvJ]4uHXxxvڛ׵e (-$J:%ew 0  W?>& + d\Af`ȵ-骨.Gd#}v?T\$8Z<]vQosKfu("yŖzŃipEhw'̫ƓL&G:]3LΫۗ֬+/HیQU/^S_G?eke[ "{(0IvwxeЬ7xzxGhZbZyK:4$}G# ԏӨb <ݶ~%cRo4r,] g򐱦Ubp׸]2 KqoƇ}D66'1vh~Bn# ϕݽz-\N 9ԥN?"M=A |`XbIk'7ߙzx5^FZQ΅?$VIDd8*B;a1pP»nR懭= cMǢGJQ~G+SQ{L@<*%)%cAeQ<Ԋ-s5'Fɸ4M#栈$B]0~+BZJWA݋ I]]\SlEYsJF bڱYfoܣϯ50%C\b/ihf!$P|Q `Uk^R)9LcU*y"eN *t;pCr8o`YN1I1n]]\QlY8 2ThËoW, kX-`X+%7k_&}EXxq <&L}x6 7`DVU_3R!HG-oF+_? [8i@M!ۇ558Ax9֍޿M6X lЗȋ~ Wv֣vs l&@dkr~l)_kDo 6|82Gks3/h{ǩgE㗘~ׇ.SWn~Ȍrs5/SKO&fp<-cf\l-r- ~E*ҝ" 6YᖢVeO%udOJaHguKR"ߐa ttWI 5pьo4@Q|KsTbD_G%=yB Z@PjʘkBP׉7z¬;[U=<4W&zbwC0L ~ia8Q=<8o.BK2j[`#*k?L <_~(눔. Lʬp:G/id*=c$+BM93ӮlA80El(}B?'aU4S7넘tsfu&6% $Fxk u qA.Pf '6%zH着}t#*wh- L9Dp̦L[TN/bC#ۃmP-fK&@2f̿Y`xYI&m7Š h$C IӁp(f_4A\w67M0MIODWa'c䜪*)n7D8YYzZuM뾜d}Uw<8}\1,e5W2O`PIPJ nBaF'D7pq4ҤjqDFHȟ2㰀:ke LikXvsȵb$ld+&^7Gl.x&  M P9Q%Ciy*|L~^6l]+|A9yKZs\ˏV=,`JIiLE@%ė-lPґĈtIAUakQ>:/oɀ*DVV~KVOB{ξHB1&)֜äjc48'Dߓi9zt\]ݝ qx(? d!rȸlL*S6|$N73~`?[6)IP[SJM` 5 7?fYifLv0)D Ji-.#BV1O\+/SdrrU#ȚqucdO;:!7w> Kj>&93!&euAIeҼ`,ifQclsg|Cn 4ʎپtTc|AЏLWmɧ9lis|9F u=Qʿ5 [maes4H3VMcU߯S VD>Lأ:+E #bM" |E6KR2F0D)@Xf0/NbRSOIׂFǗ7.tSJɹ+KŪy^(KSSHP^R9,]<6wu(Eq : Ӧ'mKwjN0gQ;_|ugBSr(aD7K_w]/1SS)N9iPQ zNZt`;AT:, J9Jei,D.e7}t'>X&ITs4Fǐ ͐s,y ;cvWI$-~YY0!D|*4C2Ħo0ű)@Ҙ‰z@_C%Adn' /+I)"HB!#D3 3A_;-mPr0)Cd0c]}a^ރJ!+ J\iyA]ϰ8U:?[Rz_e r ΕB8J1D/=TqмqJخ2]LR&3nQֆ^Hw)j/ϫ*| AvV-ETS_ip{:LSb)( xX|KO]`)H3Ց5uDJqP X֦10!躟t~BW[*t\[Z% XTv[?MaPg,RlkM!\̷ `DZf~m?je;(wP@@p]ȼ[5*ڤR,=ȭEpICO8I$:z0_OԎ_ٔQx#ԨdϨ(#t(؈n8K ׹)Lg T#_iө Zm_Dw2p0Eͷh ̤*>7U\DFU)[,ZJe|gǛy5vOs@[E2Rx6ХV t&b=*'N;E]N*A^U}"hd^ <"iu у-.vs}0*lm'ǁc]ZVBAq k~ͱQo({䒕w7C4M.`Iuz' bR`NWۄ';z4Ȓ\wfR9R;'C$;Njd.Wta=+?qcm=A EX`Y3H\/A޵ݤZ;Y\d{tPkNo,<7P7կYlq 㑑2iӃ 1njrBfMg1wih%l€(0_4ْ]I px)M {+"`K'0bARE6_K .11K eX!ҽ3,h@X"j;4(Ω^]i "w t<{0e.;ψ1#+)ˉ#AOv ~'JqAs@(T&/p)Qg+)ՌMsyu.vf h.=,t&dq$qw" T}wWѤl f`^PHY@n'2,lݼ3&v7q=1ZTpGJ2[ٚuj/j; Q{ $J̔n-ς)i)Dtd ,Ybf e+֜$ Д_ќ-"?W=a*ߤEUGނQL,%@ޯ0"eʉܕ.v3½ԉ{Fᤑv*|~cos]i!>Q4?u211Sx<)o{͘cdXWٗm;VysZL\;x:"uf9 j(u d12zlؙ3*hO:nOu`)?[a^`Z<.Gmb P-X׉"?ôT X}F9iq3K_=98e)V|ݑ31xմmוk\O7I7x.4K+ ])!Wq56m+K,&ylz S֜ԩEB^~C؈w!ڮBxedl^}CWEm 4*%'$l~K"-h҂ X +aճGڀa׈+9ЌAmm3wHTu60W}L14ޏ 'w8vk :7 oQV,!Oy UA ߣcxFA?8oAI0֕"Z d =58)q~;@PDѪi2.:g"Fm_ AӸɆalo†Ej刪(jg L)hsMZNrmq2!$϶SX-"  |T %Ir Ô>aݙ'[4(gWK?j9M2Bvx0}:r~%*YuIb<[[F$Jpb9 <vşWT9Y`N Y.K"u&dY30lŌhT<4|R҂pMLl>||rE5aCdJ|T8 s#,0Wϝ!<7&TϨD^ c"M7@m{9 w`Q,8*RC;OR+ݹ!:=cG< ,aFٱZJ`D)Y煖8] jV ])eۃƼWd4|q.{8^!Xex;D#'Aק _M &!zMhֵ>HoXIuNC,ϓAT p{ u-D?*:mrCB 1z5/ c v_\LJE.G}}ʞӊY^.E2 'xѡgCÕRI1PU!Էr Ѯ!™&|U˻ z>H\i+. N&Ԙo<jV-9g 5r 2k/[[}v%Ԗ2^&jhShD9;ӎ en.@RhFaj s&-өs#Kz=VpCȗ+ߑ׳gx6KyH>oOE}"7VSNr`Z=ayA#(> iu>@4>mL!ҽVK@Nn )z|h[c7p]7XhՃa1M%FSP1_Q$OE F YTu閄/^_VKQ)*#X ⽘Ty!&_0A Cc-ϸ4sC͐~tZG&dGK[=L КV@J&}w9Xwg37['q{[ :ksCXįK>_ CzbN , Y7EKOގ&=ubS6-mx(Sm> %n2o3*/X~i:O# n7t1.'2{КމyӫWG:GR:{3Ndc֫Z O5wPXWweXKr~ԕ.@T5 3lg*dk{= 7BYgYOgLFZO?=߫25)Vc5a&נ?9nlbRj fV9/i6$vr _(bGk#e^T<?4!0TPW-yqtkxMdk6pB.GC!\E02s34 I(p92n MoVt\"pAk->)P[Mx: }P OBƄ !=ĪN,MN:+ֶ102=ս송5)zf *z{%+p/XQC.?bOw3-Kba$XFuR 8.2v<&N ʮ(yA`=,1_~Z;G MRFfx7G\ US5f&#;`'>2g1/w $8hoX_.([Ґ3>p_;}ށ۵9W'LG"E`U-K))Z0Ggl*~emv`g'f -Z|@҄)N1A GAE_}BSDw};}s7BWT䁓kKdӏ-Lp՜)JOi;}@FcM_ɓ<+#'1 Ey| "/k&C M~{n&]Bfu6a+i]r|Z< ,_O>;x-oX]3(5Oc˝ y/,\nSFd&`qDO 2IR~9 7]Ѭl4O?Rpcj/el-#؜UI/_^3@iaň%GGĀ2 1 4|)q8ۣ} `"-s!q oJ4\5p\9fB/Ԑ輱-b~Mϛڅ%G=~pUX΢fHg_yK@#x%'w*Լ-voݑmj|dq/֜  6d"5"L;,#mXn~LU7C[#ZZVCoA_AN2|º?"$U~7u([~lcyfYA}PS;\4UVrfRA׌V/=]*$ Rͅ< >*:=*RmDʛ^̲W;G! o|?@Pkw1EZmgF5t엙\ .]= x9<}=`?Z)ql'2ZTGwv֍YgGj hQ,WO%}?t*T͚@hOd 0AN|8vBeCjsGrHTbtq^S_һ0Vxņ Bhk&Icv\f2'4200 &XiPȾ6@6~̝# Zѿ%{Yz&qDE0RSVl 솏Wh=9+е|s%C3-ɦ2 ߇۱Cff8Fɡ-]iu|Tf t?)AHg@b]lv^Z$3)rsH8!ҶyȒ1S1=6QLi`;=퇤WKֿ23-s ו 3kd)$3؈ * װ,vz` `xMLymcDm#tKwlfUp F{,rQ!$o|i.ͬAЛB/7:QƉllHC!1ÿg2Q9]P1F!?\*K1&;v5ժ/:yw ٤! })j1V)'÷ }N?w/]qp n| {22՗Q)O4&RXw^?cL@:aύTUoܸOL&;"+FetK)H ޖ)W>F#YygR0K ?G"x)HSF;l7wP>)-,%(Y7|IQǽwb$tp!jIxЭfN -'#g{Sj[ |[šA.[J~PхTZأʝUVo&PG+2F+?gSpvVQ [1Ǚ"v fjK͈o#c.SM잏VXmrHqaK㾉X5L?NіS Vsh=5{Va ELy3Te`:%m`ϸ7( erG>.OF9u( L wRX) be )uH,~!{?)ӡ(A6i}{yn,oư*\L11,Bɲ5 %;zb8L@ev7с?{ Έu`k'TG*f.W|UsG3lR#&=Hh6͗.w|L>r*%-z+WKOi~l/Yv+hʩi-~Id; ԽdH&=:##m#g~fׇSa"IDm, C$?}JqPz C ~[je^;;E& ;Rx{A;$B ~՞gi}g1KtϣKAyl$BZˮd]g]w:5J+&, fIh}AJ1\#v.M a?unc.>'0$^)r> 4VKv׹n~"BpI1b>e 8tZ&԰,'C.ȞГ$#_o1k1;Op2?0-}JiX /a1#(5Lz}xB6&^,1 IZ=@i5&a nzۄGdO.}2wtBtК7b?]6-CiN?h^4.XmKz]h‹0Gi6[_]6[X7m@\No]$cҤ}fj[, GRAџTY7bGJR;('BQ`ؽ-NE]2#4)#|C5#$}_@{8zrC 1mh+dMABa'+͜ut)c>YbSKb9K4IaȊ"<VE@IWCNZ0ᄹ釛t ʌW/Vz} d%꫼8ZcENl%?{*b!i.) x5tBz O:enb+ (/0ٕybB5ZR+JtL2926,;2\WuPRT^Bt@WmK%A{h7K +:ğ -anxPt^Q:"[ƽ7=45t}k xۤ,Y2ELe&fKψ>.~Bt̗wAR,Wr 0P`6˚h49D6@0F"Jj/Nu{ͥэ1w 2;{BS$S9k$ ~L<مz[ka6^ 2/ 5﭅%acRUZo6NJiƼ#;8V{c-PPUԧ&}ȈޮB>p ST~ omK6Nf Ƶ!\^~{RC]8mw^!!0pá$m4-@ȅIo||!1Nq ݇:?us O5Kٜ:Fӈ*0N[lg갶|ƺ6pSj\}w(|u:&`-ir`87ñ~I]+$]5ţʩ|9ͦ S6?:mSQd{X̀~bqWTJoՖ~W0 tX*ASHR0DF}L9x-,bRhBwtxd2s\UvҍGi5kjd0'hĺb/G4: > 7L@ZR%Of>̏dI5}z߂UVb-hu1{j+NLM0ƭsudsZ+l`y~(< PUr[sޅ0ݗT54% ѻ 71]8:TK1* {knI @oYCї>Jy~xjc c/h4#TQF횗Z\Ewtn=5y+&ShWkIzZ갚 0#MkJM'{vОa24jz{ZDЖ@[]U>6+sQ~4(W^:bDE.N@=5zfiث]C~Ke ؝7=Sfs~|~y!&Aձ-VL3v'gUfB.#Pm5xF,H!)0wN©1mv1~T$VSK秕[ gS{0[yh YfT73 @ǿ H(6=a"?R#?p4\* Жɜ='[Rqyc&7[ٱi_/m(OJ3N]Qؾkm" 3m,*+؋PB$/![ ɼUe6N ww3sutx>aJ)B0g'/5ҝQ~H~_s8:x0KH%+a ķX_N]n r*,๣*gTUؚ+2h_-~"p%C)opKS=&SpӶVc&4-cݠU4w0 %]ys~^"P)h 7J5~LHGEGyJ!L75_.2L\JO@,K{D zLV걇m@aA\4pn{)5?Y9fQ`;RVj)Kmxnԭ3N|bQ~4M Vѓ-i$}"I/BE+'Htݕg[aTb@!jNoﶿ  _ѹ?)Ϫ!zo{K?P)tUuQa/akWJv _|&h}8dN[JK#ūs[]Գf<۶ZCoKIcϚr~%M_" _?PTaLs> =APX!9VI8<k!X<5#t}Lљxs][P#rΓ'=K2[2RcPvuy_}ϓ|5ٮ 󲇴GnIxG0-M5ZՀfrh#'zjx/-d=*St Cۛod\u0@>rҪ{3Cą}k/hU>Zj;Ws4:[$*mhϮy/"~V=O!lQ)4*u:e)ef̗"ȋ.DOAH9A׸㾳l7gI!?1JwTD*,4ˊq'j}$eH'Cލ'd;WJ/ dS'g}1[(x",75JOh@M,R=)T:VvYo!$e7ͅ4&#(縿 ಟ*fpx7/|͐bONCF} ŸQ01Aj_5c9(($*mjWd(ԏZ>o-f{c/pjpDD+^34OXPl??^8,Tuشp,bfil)4mzϕ쩝;{q jF0+j/hlULo\'_O^W)o*us&6M%[8>VBL.J_,WEȿmT:)Pg^gD _d\2>e vIew<؀R+JH8^߯ea|VR:af灷\ݼ-Od@re$D`ԭl4ƦB.2-B5U̽ހl[}umʞиXf6ܓِ)sPI,®V?o'L`lIZɾČS qWuaekp[`c+oBMN ba`z]Ax.|EaBrҏ;Mm3-_ 3i-9>E<%-8q'͵gy=K< rrĹgYjj~v`Hn٧Ȏ*ho5m}*M: T-WeJ-9~:X4:wXv8H/al3*ˢPY^>]k?RKJ5j4P4tPMGs5Gic1d"6T~a¤VW4y.G48@7*Cx?U 4Șy׵38('$8UO׉? Wɒu(kqE鰒'wz2OI~k!ܘ-BdM.zu_$T!4Zk:aF%#K Bb@hXVAp0#5nZOn@c=54q1jQQ2~H(Hb߲P q_.G4$eD:)OmHW1Һظǀ NzˇZI;72M X pcn|<ݠiSo/t2IM8\hvoo\[ GKN{I&:%(.+%=@iI0BBd9;_.ƹLӠj58#f]Ui7DE]AOP3+!(9V;yH ċ aW'd6V4!KF=mw -oYIx_EёBڇnGNF:ihmqL:#x}.ĺ|R:ZעGAQæ.Ɨ /M;^л*l[R}"]ttX7 l՘4CQ.|bK.\LTu)~O~鲦:,MP#!!+_h:/ ]̠(Tٟ#B0x{T;ڰhIWc4s= +mެW teZ6܍$:c?n#S$@s!!Bxsy9Ƈ탂^8+@TOᎈU0ۃUmgؓmǵ6v*.s)ޓJ|]&\Dc;́NUW>ܜm]1SifC U|dF&^SAx X gD2xK"үsd}t0PT08n x3h4)1A)?!լI1ilVN-+3.e0TeW@ &(oavan52?Jcrg>##A[ l41B"GlK㏸~J(L$8OxŚY!k#q~ NV8\2yhdzoM,XAWՏЩI=FT0]ri֩N9󽗑2qĖ⽉wWv;3X,EV~O5Sq A R۠<M6ydA,:?y:RغNYD& O,<P 7vTN*ګ`@*[X;x|4*ޘ5qi Rosxʾ+u+$+Q8" 9gіlOLqxU+ϥU 2re3,uU'i]J'xzR|,5з@r/ +J~{oz.[\ѸF9/XL3D_\*o'C"BQƝ#^񻛃uuOdFAp368QT<]q4o$JG.=%0N[I1|3^CYnJL[0`!^~bh]b)- LF-u82jDg _BjVH'<)='׫\_]'J2P1>}9_i-ꮷbhO`0O"ߙ<sΓ|z^ k8zN\&{PUIGZ }uԶ(:9,!~e@u:: , $샳$+Ԣ Ǜws^1fx*ڟ\ϭfRμA;}¯|sxeQb-k?p#3K k+otO>wܻ7I7DDO}6]fAI/}WHZ4EV(JGYR.@$b`|Wt"+pkT w J,$Q!A t,VUJ2Jލyo-@уֶ"h bXn#=\85t9 NW|??,kI N\h` ke4Zƴkug%,w$$Vw NS3&QAq3T$)Vxq$)@/gh l0ۛ8઄3DvIAM}wч!~-P ~!9^CTNA9BaU;gVHdDeY# ,'؇lktXe%/\Qi.پ|^4h=I ~̯u stsc\- 7΋̱ PR/v.߉j(2KO]ewF /peە`LyA̾?lӜ]Vu\agI@$e.;i"'q9lwYvnD0^BpKWH6 !u,b0DXЦ,$Y5"#3IsMtm)A>at= ʝxqtmz|TUP`pGXʛ?øbY4߇LC?rZ@[ vp"jT:y9yYQG{X̍XYup0~,%!j.NI^vuuKtPsmSw;`iRAWGtsT8K[/Iу; 3_=惄$'_w%vHvrN1qoYWGҝW3_X"|KIz$qam2lu:jp}Wշ硭M@LͰK{umtvsR_<;DzUZϝJ6a4 ݪ83bb!p`κбf&$S*O }0 vob -tW0-~Ka wChmƩ.|yN1(.qns_`Q֏J}ti/LڧD?\j u Cr$Om\j,@u NqD 6)U:z"PBOgLdCfqxdFcl/6B:Mڧ9Dpl+S{ D=ݱuk΅Kֹ̲([)ֈ'_JU7aNr9g;I2y"JrI(uNHضVSPڰmM܋ 4{@Ќ]X _Dy h*Ym8n. ٱͦX?A(wPԈ[/r/Q,=)UAQ2q/+)m 2J\W{AJ\xϖ37I& ܸT&ȓU6OشHzpv =;,l[%j KFs<@ӨdLQ 3|BԄ9$A4"=5%窰}?'f7)C mI'CPGy"'Uuv\g$7Ao°T7|~o sͰ] }IRl֧K03 gP8/%kRbpB' |j)egXfߨv~)K fv_R& V#Vz1bB~\O{PK,D].1c~<"϶r0}";gp'H8guhQ,"[ىTm"cN<;-nczEvCe^oB;3`*o973a,ҫ`3u8c 4ty<7O 2nӣj􈶕ߠTRښ^z )2^u'l\?MR *68ɬx{Ia]K}=N)̶s{c;/:-ụQZVj,N6s}`Q qx#inWUrw{REQ/-C }ص$>X#.\o7y_JVV6K$?c>3lANҺ|m&G!|Zyy<oZT((gԫ }FƮ6A| ϠA)_/]Oj?i-pN*=mCBd/[yal)9&S(` ᩈ"#'#adqE tI\7/5:W*rD]ݻbwwD;șզ%S&mzfo[:rB (5-;R.S[[ c/+s {8+ TR+ )x&m=BIٜ`ڐ.w#]} cmsϘ)k~%$&2lƝ{RKČ/!*ᄛw.i])z3'^U׏wW% s߆+L`h@_]TxS%tv^jjN s]JQ˨V`]Kp|"~\`q}ۀXPXu2jE4?V!lu}v鞋XP\+2|[42U['leJu?Kp{RZL!OXa,_J 1z$̊.iҲ%7Ck!O\jBY8sUfld>3ً$!ɾ3[ۢ#qֺI^]M&?QʧׯF,54#2ا{qصiZ!h>4sbő0񑇦6Hœ#r&NUz "_R bwwFokpf{%! |T :Q~ =%!,z˅eloՠ+.bhdUlt:ri[% 5 gJiFM êXI).t:+M~`G+ؑ  g yZ{tԳ< nj+B]15T#S _ۆXXQb-C5 Fn7u<#3@S=ߦ m:|\ Ru7 <9Nh| 궋(O.v6Q!Y{r8jξX /ΞܦU8Is,d`{.Mu&,X?åEwt$f$4M!;RB@}F3BO#wUYF7qs4U}gC2L41 R]ɗ /}OR( 7W3kf}P8ռftHhӴdTGM"Q8ku9Xˠ.Aw.``;ヺtLFN.Eo쨘xFL4SJ;'Bյ~̀tVS۟dB/޸'NhSoC\AȦckdBmo^$jdwַAʊ#A J@$*b$пX7 Na+bqt5z)@Nb`aB6m"An]ˆ?W<3͒`Uzd6V~` 0&AH|Y4g[3b2:\ToťLi?^Y 5Ѯ7 Y8;{ڀט8޿ũed̎e2%a^X ؿIMϱw0bQ ^D7{kD^)qrt݉0uUTs-]4ܦ]rϣ?ui?1ibO׹Hjcj:6c< K﫝T N=Ty03 2DJO4ºq^,4+=4v45Eȇ]0]y=aG~@L m]gbzuxZ^9)h<# U,T=;\M~b*}UӛsU}vgƗ>ok}8a F_]C/g1{;銉{ l&_WcUOAp~Y S">%*Ga֭Ʈ\T?/M}%|9\xK^p4^W<%y{B׳ڎM8[EmU+V%? $ HsW$e i'ˤЇ/gf A3 Mz`K{7/ aĀ2  8KT`^[5TX (AxV[G3~\ =lM4j)X/+G AD_V(\3OL2 iU #C'[wtu)~3|J.d塈#{iܹЛ28$rBl§t9pFkF%*B=k6)$ CN[}$]6"!?QKWO:^czB_$.H.þ`ˉ H(HA}Z(gȤ6uP%o&g2y݀?vbCq~{C!Ĺ(!lD'PJS9i~C !@IřE+F[m8͗Z]>OŞ HdKw|*'~/(&t |MWY+jz9Ӳ:cU 9&{i H([wg1QN[1*~>=ŒVivN˅1X:Ӣ-RN:2LP=ylR/PG̃misCXqQvWZl}+u@s[tX棊> </(̭>!3$ DFi̮> ^}{YξlPK "SbϼXON{8x&zmcCgU0KO,~ x|#ǣSHq-_uTVreM\ `Q|c ^-'eL[ovðnF(VGЯ6P$,Iכ&*ΐZ蓣 ?s4QoMn!fR ."a{~qbhΠmí<)t{7[W8!͡jkX ; `to NOX)594fIOvD"0YϹK=9&ڟ#Z2fMz6ȧe:=a]"|ϴj,Ҫ SO?h$ֽ@?ILsk͋DE5C n~N|6<٪]8 2,v,ýG4DG[woD>eQPBҕŶ , M6-С{Jʝ<[Z_>nSU$wS>+iL7UڹrB$xE؁A=Fէ|A\=<IO>SִRʂM=rZ߱ڬEf xY-L!䰒z{q,5}ݝ+ʡV?Ro鈜T&UÖ:C P@oqA\G'KbRl:NZv13ɕ4 -y< {lo޾ĕkois=xdav.݄1ub(*C~(b;޴˔#OKͪS?Y!:(SdcDi̙pfR;KvlP^MOH@;O3\l+ʎXL=HL5_΁\Ȉ=^}+,0uO +<1fgҬf5} %1'r(kT2ZگluD 6&xO^HR~~Љ GQs0׼6]MHI ,6G*K¹vOYP(Y=e+Ԩf!'R~&q?V[n*s&ר*do|zObSmޑɽN? h Sѯp t:/wBMhnҙMs&U?~&pp:T(s ]0[ߪ3Yd\N9mMJDZkwj6%LV -&p$HYнcSfu40`<~i*+~ݱ + Bb"kV5,9D.酀 oȄc } ޣVCW2HVI~TTr)d{{|#JF族BSр.VN^e杵9s{>}Zgww@hQ^H?."dy섆L:L5 gz09>-]Vͦotpa:cNIaA+&3( 1g&^ [l+vj©|#FGnHn3q/Mq~Nƺ"PO=BڋCDp`XnyTH{VqAo _BP!zJSPD{2Uh8qO^];&.l5T4SX'ɧxoheH_ !|-s=Th2Vu9@ģ'rqVTy &~˟ R\=9G΅6S zÇhrgJoѤeKsOC ]6 -({h򨥫ES W?Ǚ~w`.)v@{cc]Z(>jv)"Qxno=a U E@ }9{z@L:W@ un#3LkD.tLzk9¨#i+~'*VZ7^CjL ʠw%_r!;DT =rX0vpɭ Wfxt$>j3OBQ4?3Ha;/xÉ]0 @@eg cpu)"$ 9c*ps G~/UL=QC,-qik+}g$}þ< YN+f8btO賕p's֠i*Cّ3(% 0%UqΧ.HH7dC ^{IBX">v/$Y)O]b:oO\N 6edOاk%[ݭgN<>"p-!D8Lq gy͋I^Q?0~v@ ,Ud@ڮ{<{O>zޔCGiuˈ^M2b9wR3=ܿer~piLf\`ð'k2R=)zR^67 5.X/& G +<·=#R~-[ /CB OWS4.hxGVi ލ:89%@=Fhv0'ͽq}*Z=![o$ڝTL›aFE~9BWɹۢmfbmPT^Mګ<&g" "8'_/J!e-$<\5K=a&h 2Q*JbEp] ,t@`y"nm5 1-c ն8 @w]9(cpl E?Y X"<TjVv)rm%Yȋ}8>dt02qbUE'þtizA OB/\pR|UU%γe|*;]%9 ⼧>wSn). XFqs+TO[c4̄|w{FUbKuB,xf/;'iֿ&12dHEMŽY¶'.\@cZ$(rAAX\6*'T0bFA>?gCCeJ)ϭ҃usnnSr C ®>gdz'CFGՅǹ FX91Fj?UWē?!eU]?s^z80z2JT3Rt۬mMӉoi? K8qsbBSŌ['LqjA pStqSϮϜGBೋx1ͶQGM/k`th1L2tsQl"CAĚP';8]s@(D?Bx/A.p>/YpC`O;v}Ċ<+>> ǒ -w4l/ 'XpI' }i5(Euu *7 2yɤL[MZI x?`[6:|! 8 k= )lƀ3rԦJ?/qAm'>q@,T,üB^ /IuwTQ\RR{GLؔ  Z3M+>mEs[,d;eP obe(q~ k[z>F.$2@1hIJESu[[kq_F9yɵs- \#2Ѻcf,,GZx1ƧEϯ>?/nmbpYsZJOg)\פ{iܫ'M*S6O9#eʿ_:.nchۮ<Ҥfi62!3٭[9EY;3z% /gO tZ!2F^9G "=!Qwۧ\!L :/ Gۛ͸;A3vCc՚$;y1&9`fAt ';w ۍ1L>Α)F5dsvQ8x uR-XV+^<ΚJ_ i&yZ1׷| gG}'ސo^`/ LWA}/S:o+5Ҙ]'JԘk2Ҵ9¤^i.<=I+h(TW]_j7CLɕwX^5H_uE&dj3jcaD8Ie{ +i=aԤ*㾌&=a{ڌ㈒HVqb K`ߌ:3l^BBKr"3P'ԭoIͬ4p5a as'Z mmB `ڕ< u6AUݕFmgU/Ga Ҹ)GE%&fp|HXɝav{9@N92m)aAg3gC>dn|oJpܨ}@ bZ̘ VJE*RaٟޤYSULu[jeʠYb\J%[qzvXҍ3Q2be [Pc3f{JI,E"WMz2# MД{N]ך HI)M :pd9a)0mv2\hS:!OolO;RhOSǖpd!'.f^#lx5Zy?T&U ݞ'[y $m2#5.V)8^xgЧbEqsGy:D)rU*"8|]/!Y=vN/|ۘ*l[8իʹXZ܂fG "qrL;Wf)7yB[ƘLLpA< bM0yX`-j%ڼTqڝoOK@ǰUVC=3<7`ѹ'Y7j Wct!Ր~/b6ip+28ɱJ7w[޹$a\.([@,*B<SDutF< UCԷ\ hSn*?m:o̞84Hkp穻hc2(- OϣHe=ƙ qN7(WLq4|Q-;PkxaVl_MO5T.O\>,UM0ck ۳[Ukpr|JDTGz-Gnʉ+) Gؐn;~t Va%':+EEs-88K-*x~_ ߛiIcM%{u>u#9,O'+Gn>UfՖjBtꚟ*M n s0V~5f={ރ_bF8nB1|`ZlbΟHB=n~@ I,.Yk%G&cDardٳ$>ު)L@RΣOLB-J GeO|t2qwwE""0W"qPCGឧTE,e׷lB1x"o 4}785PP5 6}+(CBd6JGw%{f*ӫ!_c GAty| lwMv0Kp2.صًD ysعw;RyC,KI|ԫr8ŠuNҗl 9ٛea0a=/ݏ޻R c:D β~\zkE˘t9kEu(hByQӯ!!rW _ݐчUW]P[^:o81֓ESR05_nٔVw38aDBIe!nWnǜ@.Ltla|(mZg͖̋3Aï:BeF1`hΜb&aykGp#n6/ɟ`0}T`=x.*߳ƎOP腳]C}ynYX}Q64Ȍc[ fq fң▮Ajfh_q#$Ymg{.ImttpV $4kt(WW,i- `|Ҫ 6=}TVvK@4 <[۩?u 79 ?ah4ܹm?xLͳ/wǂ7=rGu&wHKyAgU 6k{~&FcTwdN43P Ax@lS$ܵWZGS'PU 3wx"DC<4ȭ(2[Qȑd)7R} 0 =}e ).37*͔Wqt8~1>8S@1Pٴ2R DHDr_ܟ1?alNNni+(C0\kX[ lɞ`b2q+Ede^V'zYv;NR}OA>/o x.q>nOW":Ư8vq=4捖*}N?q1>-$4>uQ'MQ EBzPp\UFm_NّSwe$hWZ.VZo רh 4K)Hp$$.{=onlI.رo}Ŀ& IٰjQG 6MosaBoݯ? .O 3% y%rZ{AL]L$)DtmCqx,=XiRb*+#]@kg%_ Z,?!5$&_OnW||)oJCFW^=9œʸ+qɹI^P{9Ò$8@D/6$;y 5¶LUBQ]uqi Xai21HOo38ƋŒRn@BNl",LX['_o9eA{=k1o|zOXf-Ysrފ50pSax5`d(I $SA{r_M{i`=ڌr6^8B(OȢIqFcKRNç9ޫ~CO_WW=Z!?xH٣H0_G3ZWMDȫ47v n_ ڤk$d! IvLm,T%"gCpyKW5$u]Uw;aiZא_Liyؙ|죧_#62?[ުBKbmvf3zZ% %z*~lnu jFk1aDeBG9o󈧎0UMfaOۖ:ErZdx6#{>N$ޮl:Q[.<[ E3)ў }$@S[VhҤikatnaL92V'DV2XϫRHm5 [~G nSaEXaJ!=_gpTz0u2rZoy8a:!6<^E`*O{) C`5RMPML$| $y_'{rSc9|r ;^;>ԄɜǝhgqP2f֭.qn*β,2 p _fV;XJa&@$S~l `rR%ԮDpkC Bx~&a%EM8蹹bkio>|l-U%zl4å\£4B0eeHI$=yo$SZlgbϘCh/l*3j['uыPY*q8ϵX MƸѣ4GV nuEZ3F8Zoޫ4ii% ;CQTtxlW\_VFNFŮNU^$y' J޾*]iSHj8U?e+$G>YcAO4/Bc,r:8Z &{W7A9  )_/ͼoѿV/Nm:|pQ!ßB!52ǂwC)g=_z䊪%9qќ FJN('Y;@.K='2t6Le_ 2g@2֐gIl۫ltKCޥmQc3J^ %GLni=f% `{C|-#5,G!OHkbIW{0H,lrw.MfFCζxnt , oʎRQ-yA^a4ZesPe㓕RcJ!y`xpZAHKk.oi38htv̡H\v8S)亿$.A޺ XhVDtDzvUیy|jh=}Xr N,e,< jr(Dv"YՉ`+*y+dϢr=T|Ȑl7U3>f?{-^AaA<{^̓G't\Z478Wnx]E<pH Ȱuq'bTw70Ff lm&,ljK:k'Ba8azpI>. $k[S8idg0K3չ J`JX'.0$;]\ y0|XP>j'/AN/PL `/ {6|'SF&/Jkr)3-Z|&e۴w MG*ov5AFؕ)'f4w)pE@h})Hħv&4aAuEnm_9@PQ]k[2\,唺h|3, ;O&OǔV>- UcNR7 E6\)CFZ qMH%^TrB\HLwU oૣ7 .˰+wvSS8rLּa XwQE {n4&zNx߭>kb6OCxGM2.G9-$ (y >jԎ \qZ⭗Upg)+c Vϲ:_^E\_vFp"rfcYīOA5T _] Ƀw᥊n ogҟY_At yL 1C?MI7]_Ř ៗmE˱`/=q鎲gHZ~nF*Y-Foؙn,Bq+ nV*ME6MIgO=s 8d͞v)1,Br@ DX0\,AJ'udn3hV҉2 u1W{ g;}vuw)O,tSVODKo'F=%yd(CŒvNnֵ UO  Ҹ^t}t<[Ft4B8Siaz) [5P b6u8_2T*^ Yr _ouT%/\DW'\r~N|AR35y|v# _h}V1y۪فE %dٰvU o{oqyN)b ;5:k"p.{"U6 Dݰ\j9 jΩu)~雴pvTJkȄoe4 g.@<[7)5@. o^e/JHq`¾PHi>vyFԝKdǹ;L7QEsFr;oWc9oH^u|P-]sIqu!@eLsR&'Fa pX7Lf}44rJ`˲__辀wtpǘ0P-F ) ?Y(6S=(ʆη<]4|B߲bcAIqȒpp@#4CX8e#H:aw`tc؉N6/W[vLzmAWuZޮY<$ {Ml`}nppL ËJi=?wE:wj7}d3fh5"cb5@W'@5Hzg@񑼶rUDn(ܰ}ºk,쏖`Ȳ~`7/ݤ/j[]eFD !vpEkBCk@sj%~cHMm.bP_ lB6 +^SXABi\ Q\_<9)/*Q-wf^&LK\?mfs8!؇ƦV Vlb.Sż׻քb}J}! h̪-C(Z-# s%px;s_'wc{eҸ;k rߨP2CCӀs%L%&wpc5cvc = L눜yO`ѕmˍ 7 #TʶhюId63& yQS!5 s~_W{u2e&22_0\2VMķ4=χy?P\ƃzD/JAqaN6Ș{ }A|1.+\) 76b~U#;TOhNqԯ/R˷ Z#ͤRKl}_|VB[ q"jVw=KƘ{ 2J0 I3 F#1)63Z4ͨ!zNrHMn+HSot6[&/ ,ā)z%+w$J3my| ?3RW-ȯH$c!Hg;Ƽ* ^QR>myVlp vc1Y<*"d'=ٱhR}ݷT1h*`_fJE֤ƶwv77D11e@&33JكI8eŜAs ЮB(-]/vbt3Ltjkw*#u =LC'̘mbԔ#. 7Zї @=ؚ?$ BNoW8gx768UQg;QeoDDSWa k)jMw.ib[&IT)z]ɎB¸r: 9C\;PYB7est/˼3.(V2\ pz;Au@/΁,d”f6eWGn *7~PI=p۵ċjGex 5WEoj# F,$[M$9&u8r|'IϩUc:v?rzZ7>M=T^Htb'-jVzSr>GɨH0)J9 sr4:hizAO+=itz8l1`Twrۢ^AKf% }vJHo!pu(7FD)خG>Ybo Eセ2$ːY>Q? FAXPٹMx@ xq`?S Ϯ?rnl? <3$`;wD\TXr?Whc(v"t)K} ޻Gc >v#XG+#%7<~PslJAgȈupT W.Ti9E[?{AէD!-V9U'ݑ^kg9[V?"sɉmE(yݱ唐<`gnI?XXNk]Qo F̿gFn.Kn !$8LУWrl hq@6`k1$ztL &Jڕj0~/zu{Nv^pc_I!R+H_N5S5AD$T_+%Ù& ,N-ZGkQ܄nB+䠧Ӌ^܈a!&_A]ťԿ'FLn\ѯ?)&9Wj,F1HIߨqܱ"6u0`w-u[^;z68zvyG \ hyػhp[,.YbQwᘅy}6ԧ'xvpvDO UXj,/RMT'1$f(C)|1v-EYCuu:)P_FQM+2$Xag[k4up$ߢݬniKJA(s.qSun/<.e4yG`t9e@.H##5uC"M QLEg\xܕY] fl4}<~C/XoRX*DgW)/yf[5dKJwjU،BTZ4p2!^jW oqhhr?"5엸ZHedDGŕL [!Zo %*tn<:)/ `rlo#;8BlYs8 ѥ Գdxѡ+w<7)_x]_ h19@q+ZjWDp*]'D*r擄!7̲Ka+:L:z-+&e3zV~|[$ju~~I+`B3GG':01gHeϷ?z$<^Y;*n$>> $Z%aj`EލKa;e)(M蒭e7uÖ ,J9Lyܶ%qW02{IJd0izhmQUSXToq[γʗ&LΰdRz(f3'A-)}̆6Լ}9]Ou A-,J{s7^iwsIkyF tM (2P]\.f&3' gY%[W=V$8*/`)|hHZ%G9hBם~1O%8) [/H;:AũT(HWŨhS5aͮ=xuđs*K]:aE6MeD,L D` TRWE`zw=r>vYYx3;ɗ MȽWE0J_n$>f mWTe3ΜQf^bh3;ҠJCS!S"x1BiMy~-F w>-H֨m-`ƾNJ)5 hף rq6̽@Kpj:VgWhY'ⴼ-{mڵE׆-2pj2m\jn0=oUMf]P'_oNCgYx"qܝ[FU̒B*@p.O$=IHô(;?{-^cFEQ)&,CO-u qf"@vtѐoY~ײd F-vr>KԚSA‹{&XU{>,xH@:"CG۶i!:45p GYibGїz R*E82h`,"N$ ő)06Z"1J?*/?J`.._}=pPOK$v$&V"Z X)8y/(3vXmw>{E)8gjcc_>*[ħe8=789>"8OR_oVI־,L6hV6COj7KF]Ѻs2 1)5YE0dMe*@?,&(zܜGq[C:\Zmd /Uo< 2)ҖQ8CcJFنUdpP[}NO3pe%vLxrHFZѽL?pс%!PbZnx]iGL,h˿s,b_cŎoD3"+2f6›30 IU IXtș77qNBGInH>"r:yĬq"ލ^pOwoQ9:RǘV5`럩bVu(({W 8Vk_0 pə?Z uL-&7/EDA%';+DF9+Q(=]I7Ű=/vSklBYZHAB tЛ)jQ9DpWƶfޅV".^)- 3cl.0l(ɞpҗLc}MQ)-Otωb嘋bPw4l'?[Ld45-×C#%\ 7Kp!:^ܗT 3ni >5|(hrU/fQD@FJHw4psc=;=D&VL|:ٟf/coYkٱ|vU8LMtt( a~œ=N'5 -?ִTL LI).Fsh ʲemYpEFn&Omnpg=nZ/˒( OА&s6va;" $i'xΔmվMJ 'FAA4Z+b#4^ԩ#P)|Qb>!{UPc~1! SZ3蹍_1mԗ{4,v,qpv' 5HuAsӖՒFk%EXb|UpjDP~DZ։#/TX=N`}ѫO C/=\fa/k v8@w{,ˀOV1p[A|i6#K̗3Д]8|%:% lRF#muN,(;C(2b1S~?A 9UmZ4ljxv-)!V/EVÍw*i;kP>m,6?BЍ#Tg~gG]XïDYʹna&'C/D>JQުhztb-ѿQ2j14;]?SxtZa#`k:.t90Yt zB\[ /C)bc L 1/W K*#YHF 4@ې[2Kа0-h` kGB 37!< (nG+_pD ds@˹-LJN\k\mgMl ,-}I4'g? 2{j?e4E8X^(x ذ?-Lz_` @]q̂~Z*OZ#C>˫AbcuȻ™_Bsa scﺊW-M0_uu]/Jޖ^x̟͂o!5(]_0_b#˻/[Ϛvf&.:n)0N `ˆolA=,%|<}0p$T;!ˆxD=uGk&MoS'm>MJ"I-e~۽A-A,3R۫J-hY1o1*o߫ PĄ%kEn.6%SMݥUn"<M-!MV$qGޥ t-(/ltnL)]5bоNOѷW'6MB?p KtL`=͌ XnW07 0.1>'&_RmӅc=g昺 cHAd$KǏSi)&p>T?o"1<ԧ.䰧s;1qK\u|y;D'*F6# @=BĽ~05=BRpJe}U4x|IJHwWZ;Xv&_";Ixګ`\(|3@/Tb/x@mfF\J4P9=pu&bul./kn.:ȏ5r/aYKA06i{Jr +RNk FIqųohTHNr `@ ) eK婅]~Ԋ$~-8f0A> "g8%Z%_;$D Ft/@^ơ?mcE%_Uù?sBMK/ ߥ~ C7]Bf`&fHKߓ! "[TrAKt#<$t9_rwhjgy_\KDFۉ|YLi`# ]v"╭[ċUEy&BʋHN=2nHtM:\tٸ@"1)DJ.MPFgi0񼆬9jQ j?)h_tZ/W+9]i Gǭ&Lܲnd{61T6VޔI;I ) )J&yr%)%`ݟ _*s\mp:&UM/~&{7U7x>C5Roi.IxgqmL㩄?Gay/qJ"j:1kf԰E3!$7$KjZ*NG |[j$іy`S m;2kWX&$՚:Z!صt2?6Eֶm0z>XKagani'eL/1% CS4VQgjh/Z8@7 8 drh,=`A_ӜwD6KDi1}Ődqdѹ_ IkH;5[u=7o:߫8?9UaFgJ; &o"ݗ5XᮄYw$ QW& 9]a8L,7_ZHo2/ѵAiNfճva"YBXlY[e԰bGKWy웣PWWHqi<%l=Yq/7okZ:4= 8˪!z6$˥M&* 4s[BlV,يjU؎ǜⴤIh̀j0Rjm?t;v+XCs3{|A׭ zj8]+#^,=+08T}܀V*A%~${N6f+0eUc'CB-:8?)b\]"t{ssOX Q?h ^X*TF /dL7*xw_yz7NX7(霯}1 n\-)=IJ(JUAp4;bԅ9  `!|N' v.Wl}JKeoj:p ڱEd#X0-]ܢD3)?h`q6tu'as=5:b5en߉0Q&Hxv?It2d;:5fyv1he% WmjPO4Ďe*کxXѶ/$ɡ%l{Hל`O *[*ԔD3TM'Epr6(2pD|˨K M9߼=O'>_LϷrTe4q57_H6ؾWf+V|rp "/o͚ƬUW*iOTqsJղ.J:Z*^H \ Z l焄Ɯww{| 摤~^J jBb˼<5SqWΣv$򙰄0mi"7r wd%k>r}X?1U>M=AD_%S»%jli=zwa.o~sIjնFOH0j&GK}a\{2My_h'-jK8Uf΁cq[=E<o<̨5l0gs\jgkIT{Z-> =x󒲹jX-!u# @8]x,Th0*jrva5IruT@F 9/OR?DdBƭ$a.WBC>gTxCe}%lK)RבWTX6 ?;}7('l ~I"]``Roe`vz$6<oLLɉb/̓-g: L$X}hvVQ >Alfߞ)߮1VA~tFvl{ؓE{e=U7k;~TwBiws=Hlo71 f5J@ I4ژ`U`5XȺL] (ׄ~am6AUT"oC9cCՠ69ׄ6 eW{7F8²HY#7ѻY;>KX]j$0 /A5ޱ򁀬 `[:dH3O[L1J}!anspZ(S" =!ue>z-e޶KhYIN DE4Fp)PW8VJ{21qVV,r xyRԪ??$)|5r-ᇋ-Ԑ11-OkjM۸Gg|uvvw_Y{MQ@{ =`15{KƅT6St5J:pO$Aۏ2;{v%\/g@km-I:Dv X\X߮qJm?+@NɈo~JJȁ7Wsw.$w~@+mdӉSZʊ2dK:꺼Lc][J igքH'E?Y xEkEUmQFNkҰKBkLVĞG/x} f rU:yάFۯy5f'A6dcŢ-5_ v qHs5O.Xl6(HN9t7B)܎-PGJǃ|fĊ%!^K%X̭]aB"Q..g5yXZ}fr/+#S~H7s2y@=7 I0ϗw+PzarJsN370y.#ϐoG]ȫ'ݷo0 FL4E?R<$.3U h!::-ܢa4Y ##oGFJ(FSfdK^ZB IR]׺L:4?X(eڥ ] -k;蜙> &ÌW \_>f=MZѽ[M! t+>Ȟg,i  4[MGYmx^C>5`dqmxܨye&ƴa87efF.2a$DQ2WCp-3e"mЯ""=&߾d*V#Q``ϸ7|] <(?Tkyٞ<ƴ7Wk!YWT#m[;$&"g?] FyX~+e8z?08jءS`F7ɐkjlE𿸌/; RˡCT1F.P/dJFaf9qB U!!Ӓb_N|3[l/fZ4])h;`n{}UZ$U4YXo jkzFc~ hI:q_ )M |A?[* t=+aYQPpc#cMraR$YZ6L[ T ,<P&H8cl*(u/X7Q:Mͮ>e#>ta.]]3)9B"\c@q{j_/T,vVaV|piMhǾ1,xFʼ4&6;RyC]*{n2_A'NJI~l015錧m|ɖ!mߙ NroD4z  ~n"~']QhmBNUe -%Dy0WJ#hFo &',Σ˫OČ`pSMa/pxy{8] )"qf옵 ' ]Ţ(8B<Ǎ  -^G*&/P ia 瑶TZDDW}6WHFr~҇kE{4W?irI F \ .o`\{`oxo 񾩁R9o8f> LkCyoҵ.>Xd&AZEܚ m17\anI|I[/-ͲJӚg/R7L0mI&wZOcid/(^EHA4{'$žEO5.+heg|([$FUEl0bk8Je#k<%Zީ-";~'ٍWg o t <&⃹ċ1fYsGcr &39_*S`l•jI݊VO 6:-EֶsYӬw1X2@ P&^)խL8@f(k[4[ŋRXqɊ1(GhޠY[=7>y :"Tׇ(,} 'hu!Z&KTۉ# CmŠIÉra7YS°Eȯ`waAl~x{W`*zp17NC^s#Z;tgζVKjX5"?dqWùL.uFu90h#Eǧ? 69ӫ quНj*7=Cs t;/K#RM\BAZyע+h!wadɹ: jo8R ׻2:`Ը)b]oKjWdచUf'uf@֦MT,ApYҁxS|obծvy &>cQޠU,/P{LWIe >BLJ|sk *|vo5U#ʞ.cK{=~F]g=љ0 y;$k yk}>B "ɠWR6Zӹ5,+EfCF>֜! 򞆸s}ٜe8g1C'0/Ì#҉ 4C([Ӝo=VtY@bx ΀{R-nk+:PDM׼a^再K*q}g%so޲{J!|$=w8)FyB* tjvlO$$3)r E|gMcxw \Glף$`XlZOoR4H6i?šdBiĦ zd&#~e=lg>;oPԵ1 vB "f6QA9- pW)%G,<ѲٝHk,T? `>IWT1GjI.6.vwޏ21sʏʎΦ]hw^`sz&4<}`;L{[C_>ㆁ#+MgmJuC"3 17u3fg&S04w,579w:b.RiO)MJu!16&'i#MGמva|thRlO4+33ӣۦxC^ajq)RmW&HՌ:(;h;XGJ3L#/pȁѕM*BOf)Ea(u|} }KK][H}[s>*o>2|f3;ŗ(|pv!o0JTk~Z[/1pZ{>3 x|ҋf3=1aƢq4 G9Ju;TU)էj JDBx0޽/?F]SرMҘ)% (<Ť (.k(|-7 tf/L`hnCӼ0 ców2Fd 9nuk2D΃(7p7q\ވc'v~1x~NbP#̅:>+f0Ӝ\KaO[`}u<-yLG8Iw 66N3{GT<ϙ1b5m`7̈HEjY32V)A,ĭ)C5(61C!")oSfm>@ Z%`%_ڭi<,߰Rҡ k7hCftе3u-L c0Fo.M>Bӓ\aqpA G͞bߚjGlٜ7 F4R,W˰jX6гtx\\`ܦQPp`0@ otM6쫦ɓ~\0c\uy#A#N '~JKOIbQ"׋# c!£[)ZWi[RZ`, Bm֚^a k4yCZKe!;axcӵ)80i҅|ܪӾ3S8 ' j`M(m/TPrO EY0:W@&UU ^ V4Z2%.ĔP3?̆Iۿt1nNXatNW}L}ze.+Z(zڧ-i@ɴ#Rn:AI'hs[) snTdcU eBHTȇ"E $'D-|a 쪿2fW `ae#J$j^ \8J.ػ*[<$h Bia.c{vE~2|D.w٢ەg9D<>F8֓4'K~Ei/p`*-[Z5zڭBdIdP8l"7v(Ÿ5mtdۡԶ:ȍ˦N4HR~%ojϣC%#pQHD r1 8GSTݵcl$"FΎ;Cx/^䬞MWk vgS+V@߲T"Y5R>}(nfS`I98VקTNp[Aqxk`1}}+*͗ˬDvrN2  n都q*/&E0@jSi`RQ PF.۴n2kyKֽ?ݐfÍWLނOř4n O,{HeY$o@<˦jB%w;V͘J)b=#CBzn5{ AUt `ʀg6i/I>2c&<KEK֡ttrdHLmH!{.`|^nzY$ZJ{KGdX(]՚ƭEPLE:6OK:W& {yNq0uȖx`BbҜefoH)L/{U罣$HKqCV7a ~o 8gpIH/@8VZ<0Q,g!= 14²(PnEК;A(-RɤEC$_o!m F;yh@Y= j{׻= xd:7ݭ}O 0㛝=9@/<84(y|&{g|XvRvzJ:֯>h.UV3~Iѻe[ܼ索4i;W}Hݎ?'#}ן 52Q~)cS8L96@Tе^P&=?gq:%bA|ې<$_JT5Pn[w:@\Ƈ g%5sr&0Xc6aPJC4S)rFo]!~,L׻5b!Zn{O: ,)uo1 'g\WZ{ms˦z#RLmOfט%x]+tQSp|,/rf%j U2aSAlCt k-%fʌ3w)qd2MGYw_.C4+jnUɋ.E;|ߛG!鶭|cRԙaf!'R"Λ&wqPk;KxT~m|(Erc'"4] Xede5a Jnđ:wQ!E{QގWkR6tFzeqV. o27P-Ў$T>gL%n t`i^%H{7ƎW!i.&vE.?,ú] ^&,IQVBQ6+dt@9?έCǿ!uQHZ c[^mPUx03 {iȐw ?0?kO#`WΝuq x ݜ(P3ƨ PeoFv)uBEo{_c4HOĨU@̧64[ͅzhdKƃeJ]c5iy)zIQ!z3m1݉MC{]tx>S3~/@/'Q}OW 2;XES˸H#&o[BE/A/(Ԥ\ꑳ#Mu$1Q*,J7'[ةnW-"ZvBzUOYIX2vϥx-+KV ]i`MN"%XuId|hnoޕ-w,cůI%OwĐ%dd읠4 jk.&s]ŊgP b21ܕ\ODL {ָ6jLjIV:6?'ϝ%s \C^(: ޕUU~z6MtDTR'Vvdd,Cm2sAC|ϒk+c&@$|, opG1TIw)- خy#ݟ},ľZ]8) m$ ԙiZ7$AfdL)JQ~iE}ۊ12ٮl3S>w1 6,`~@ i0ܭ>>wfy5W!} oh4k%.4icPG]G!cLC:C6xmaۗEy[r}QRBV8ؔ׵p-n4xUh3f+S ~)`]^L[m PSu6 6JV^{qB.NV3Cs#w'- FV<Ѳ/n*}4eʯLz-ŸS!Þf]^ֳuMȝ:iT )4Ji*#]vT @[eNiUg;sGZ+NUMɕ E鈒Dz7~Vk4,1eEHLT⊷ژR}VhmcZP'_DŽ(Ȝzt'5I" T)UQ@9cw%/` q]HT.rIôw|f%CGG,nc &7NFBS(D~KYv)]uB H3D$PH-9kXL,jÏ#R +|uE)vZ&az,^IT!WշTC# k$k j&w@ǝ`ha- .4~ 6*tu&&~;Sh31ۻvx {>=QEr3̜g5yn'fgu Mك5Tf}4 Ҕg0|*~ٌ(UrF!khK!%%1 y/ |:odg-~ŕ;}eT%~qy~x -%K 'N16.4C͑4,'ĔG"Ql1V.]P_\ yqge-tf:Bhj>LUhֽ=" BxUMQ`M>}E/I=ya#X 6Шo4xcW^/ Iﻗ*2w7F{fO1N5 CVr] );W&tU^0(dk::@b+.*m}x 3o_>)ö>=eCB,5l\aX*RN|Z.YPA(#Aj8>.d7S&fzGbL9x:'Yaڧմ_LmsZۿwݢ}_eCۗLy4;yA4zsQ(8a%Ju.cv?L Z+bivkbch3bTgו;8 7 iJjv.b=s]/r!r"JxHf#d(7f3QT}jc4 ]o#Ѱx5/uaBK`oe/%ϳ=67Ȧ5pYv/)ܦ+Qң |k<3+ K`Y]>Pn: L'6N|TO{"cyW&d"=WIKiTڃbk&Q-[2'$7~a~ a':6$:fH~BUi;u 6b B(X/OI}?~ lV޽&LQaL26ܡklysGID<|ZjeL4k+fWvAue*} l*#W]fOXpZ~ )Of|e(B?k1=ԁ[$`|np?9dtDSכc #Wjd-lYC4f1AL;茦)x*J<iCa(LBd nnJ؇X| _V0<" 1t"r&5{_.؂߬p҂IXM?G]Qy$rz\!?tN\of؊"88o |B3ϻ+Cj~I_z)WכI` nCx|ݴn’|Lya -xZ^@Mͳe8XFM/,HͳFGAVKb}| TRM~/2,YmоQb #,r<.XU_t%2Q9).S Ѣ *7ٌ5Hq q16<յ(UNX*V +VKB4/sɖ87!I^f)>=;N3)9 2(ş-0o*&%RIj4%K=-}ZYxiiSG]lR*Ѷ~/%%uqW^<+OܧZYԨuܾ;H!LN tyz1. W$xrmKq:\StSD)0X#Mm]z )w\3'ξމ{,e]g֚r7VG/Ȕ?(Pl>vtj@8״ װSF`I_p&,1GV maX^@><ϕ .ʑB̞̤DETmMk'@R MOy my"oc#Ӛ**Tz٘rQ*$1S .-3&FHP7ʉ~\o.\8=/<UinW) YB)r+S\n]|8Bmqr| `a/ 7. ׾/jMؕVg+*GYoSiZamy7Z{I6&4S׺ =-@ E=/֋NNf0>PӌKO%PGGV 'hyxӻ;RA~^cBR}Fp`񠑘B_C[}p:N\oYBۮgf2.Aq?٤Mjrl~Bg<)R:Yg e랔82 t_2u< {`d θ\ØEY)]S$CƷ3^N+{gV,wqG*be,]N gKx@!5c[`S<>%igĦ\)ҊP፰\W.[ 5` АcJQIB( ~d,G vˌ/̬Vk۪Rl7 ԥ Q/W{SK]Y%ϐʀA*Q7ԗю}:$xֈ]h+4@~խu `&3GPRI0Q4x j|'7zzyo~y3R/6+C Gy)gBFpg*ߊnҷ1a7(01MM*ff:C~pM_[6 P A .- &Y.B}(HspbaRǷKeH(gdKct+H|&(^vO6(n>quKN(8l֪5z6.^HW&sږhHLQ uLE2P&xƦ9e ~o <6N*ӃԴ0j"aNBm󵜘b`2KM;x-WL¾C}DX[VW-1-9HmZHcuPe̢V0΋xklˈ]B۪TʭLC0YrᮅDffAu*VLcwJ}-b>:(s66d/tc50o|jMt%6ty)$h ~zDajէ3tS@O3ñ{.(igʀ*(%,O Iv7r2l/r/e8RV^*AP\͒u f@{iypgD#{1٫BYcx^ѽid ڸI&2%QI2 Kt/L1UÇpi_J+VH'%wt`AK+jn|RIfZqo9iK| Xv#_:B97\Z*AqjV?zH1Pӟ%!7dqZ9@9X-pax~)~2(kdrBL 8L!Zb2eGg-9>y%~Of,0| !r0`(ͺ'_,%_1 'e:GDpnyB!Hr/ i~֏}-Wi)--SYM=(4o#OwwnS,Cj:ا6iF߿u<lbTVrhkTF"Z^R}ϥiUoEs3 LJ䙹\?IT0P[rL ,+Ԓ`+nbcH⢌mS=aNrZ Pj b!|wBj"VN+3>yC=%?A :sQ/)m>H9#J [P-Jgm"Kmo]B֊ ѺA>Ը9\RJ;J<>"g4ؕ:sk#{zrӹcaNWFjKsH~,30s*i2qkIFc ipo1Y EH47:G^LPk(#SmVƈ}Y{K ѺkCnX?d䚔)VK-w0yWau?3Kn8J *]pcT06:eboDJYNsb_'o3^}K=TtmHzo&כ;Wo?gsf]B~gC giaDo=&pӌs%.iЂkjd_ϐ!子6h5D"=&BlezƐH2R[J9ھE4"AK+HJ]d1"BvݔC.uDKӭ_M< ܗMك )K[;r3aׯ|Vnb)3ؾ& yd²\ oO[wUNKXƏ@֌knWC:U6w55T j?2_K7$CFO{7jsiDCuU(帊2:h) =|+WkV]ܴk_\-HߧٰelHU`ZLz ofp/[{nqw_z5 nhRbޟI#nw]p9hO@bgvCTQGQS PV̤THUtXIҲ5B 0Jnz b6KM%ep8"ժI,qzC<l/{T-NҠB,Fx .$5Q|nMbYK<"GwՍ qm#~,N&s̳)jz}{%{Ѳ|#(S-dϖNm f25j}0a|Z<) JRf2_m7˲%;slN+S^W.~o~[[ʖюbCX"U4uc '!yvA-3L} eP8GX%jg<]_gAp›ہr!`HUN\79VJBg{AXOȒwsQA*$ׇrj .m_[ljP?Z1hUD?2A=3}o zkAz{"Ub.:oRv8ACӄa4Ry37 :2̟͎&?9…R 4<rDc>/<%5aa]=t\B`⛝jR(n]ZsT!p Z-4@*½-M#?.Oիϵ^u~A5ڳP(TZ,7׽iCÉP)rRr5@2 Ń˧aoIV-ѧej+5Jn t69 AX~@p >ϝOy˩Nۻf}(saV'nC 0olH\syU ʃw3*~v, LR;?*| W;wqu mlkm̤ٶ#yudh C ּ˙ 3KY\Y3Quh^zejݼN~` mS֞sF lsw:?7p¾'|U'NWJkRۖ-=?owOsc\}#ԍa>x5)HeP0 g?l,gfL' v:1[~hBc;6DhҤ*W}7*P ֗s(8XVo[lmlrN97 sggr<#ZN2~Ȑс鸗xT7_%C097)8;n#VE9 u(>'a@!p0 ΅Q/zөXu ݉*\P%GHĊsHȽ^[CjuˡS4p%=JAu@lڸLh{1ɔڢ"`9+{…2 $WU6SI=_60MC6г HX-p6 5֯*W4au>FDʀl]55crkr$v<9FC訫0~/hmhctz#TV D1hF|ɟ Hr5XV|C_ƕMVM{+\hйes?>PhRFcdv;Xh4YgTC{qٹf-Φ9,m _llÖ}K_GѸ9[$g}{ߖy b3wXd-*|Ih3Zg'lAc`q ֎ـZp`DJb6ϭ0v!4=k%k ] R'4C=^(}DG')R5Uo: G(-!Kq#C/qgOϊ\%"ߟ_\@pbS`y*wɆY*;0!lS&y?W99d>#T8UJ_7ҕ>؏`5op4r\F.9{ gPV-yC7{-+!sV35WMghOr$JR:%QipO'T;:7uC>(ZrJ)'a}NN{";Ҋ9mE5o#fhZrQ+W-Jխ,6ټ]_H¦vvΒ [O i*B[џfv@a5'q>Q2'>s`m2/2ͨ(~#KJ(T"M~0AEF]4iwZsBj wc;G'/nRSfqp`o|N@m`i{OTMM ig"Z%Ze9(W!1(* wt0)𢒏 m|,0D2+OP1viiV\A}ƝʨC7O ?_2kFzs͛<$vg9.wO&ȩ샨5vUl'b%_Q)pO 8gqTKmeA&s,zj2Xfoڍkw|kR=30Lr4Em"^׻& M| aШխ9%I0&V~:, OrڰQcHq)<Y8i*3/fbCVQʏH|Syh86$cZ и V~^|`%A3˸n3l#l0'v68)4B1QBąQ-; @~22gPm[VBK.rNoW<^ە] VpC$*=ET|عC^B*ȃ;#!xXͻ_m:4Cы—B2;MBM̸ږUҌ#6'UdfWuyO'J}'æm(V \ɛ}"}W"LPjؒ*m}m 0W7LU;Cs!:=μL[qH--xX+eg3emP12pϪ&MD4 37 Qm926KYúۡg@0t#WSe IY&;i3\j'~9s+5[]UF8`yĕm#s$(q(m1IH싴6(,W.4grl?L(p fϕ]WS%EB~<% rRݼzc?L erHţ`3rO G4׌ !d+*F;xI|CW78+Zl{c 2 c6ݵ!ix" k(důcԠO!#K 0)@\ ɓ|Q`Hwċ\Qj&hva=>R[;:c'$mz.&k¡d .D?QGK0hz#dO 6Q"O@ш:Zka7U :kBMuA;P&qɥGک xɪY=Pc:7>osTʼ=8g D%BJ-)Cl.v "S4^&HU* پbeQݵxư-䥸1zޗ(?@:,;*%mUp&IЬܺ.5| T0XdN9&)QbcA%^szÜׂmcEKK:t~s~'պ}ůDpzm0cWK8ZpZ ^!< ͘BZ&tZ2b,\($3Jt. -;漿Qm;\` 1zp8\6ͩ` H7 |`Vh1.?)ki WQ-H¦Pm!dN5Kg cޅJWkyso9^Tn Y*7{ߖ22ĚMZ6mgcHڕ7Zg[GWG7@ODb|9-N*l XֱF5Ķ%u$F[Ɋ(=gkbz5 t/∭+(IχG~縴W1QA#+VwrYǶ*rpDJ@KV8nf0A~rER rp~[hnrk!r';;/jފ:1]vbn+hjHW@l̯5W%mTѦ':ŏ)w)}}XLFIJSHI%WtJu69I`Wn̩$Ńt5XkF|"!<ȏr:maц x@̈́t5R:!ƼowMX XhjVʩkU[DQBIQ0UXg74=[W> m'}蝒v/}_\ƻyNdFq"bwh9Shi sm'S)ܱ8giS/#OUThnN D 7unSSG~-P P*[d#$P=)MXw6!5qt p3rƔQߓx})TALSɷ lIu HX[w6hJe(cLBר)hvFs4"9ARYYg.Zl}wI'|];c!iJCђCKzL_Sٺt O%, yxߪf˵*ńQfCqNp=U8ic-u[p\sf@-ͻ1.P5ACl3rM?F:-至>?nq`Yb#Z;^.j'؎Y!2$SQxYU?i 0ܲa+hn^W.ĤN# aȭ ̉vm5G~qPLBY&}q|ǝ&S= Avoޔ|t 2kFXsQsR* )A4/RI Lr "D=l϶g+PhOՐ8PT]珸T2M, br|[_K&YB~ck~L kUW_]Ċv+4RbwpHwvEҹ1ņ8y@qPE67B\tz5}=OФfr85q)ro3p`7QwbsYJ' Of}P Dozu,tA~(jYT$]T04xw",ewiTah0ebؽ tg /0 _[y f*ȴ ,?Fx.j 'cngLG+A}bAE o^¢@̢X87TYnQ+1zSŒGBV+!1kz3o%;1?qֱ "%l 07qMR!豸 |->M…yOAp% Lbփ7/ے]D}f@=.# Yirщ#ahUr*i)uEO1!/G-o =qPwc[N%} UYy`"^rtey}!_ȰHH՗G><'bCtO搌m!ܱ0>MhP*t-xY(3|CoҞd}s'"'D/r3||PVBr b>xaHam~:cc +3՘WY+YFɲ]-؇ũ/z+G>'s$`{E3')Tc\mL˹#i7YT3;fo|n:pIZԞ70?ȨL͓dNeyJgH͠RbƩ$pG_8̘b.0D6N*юJogw ,ȨrXyA^6/ւE F,*,U?ڹ r1T4ɉ/Ma'(σ3gk6|0JlTz]g3M^!m>䍁 b4L}EedEQf1aW@9o 2ݺ+ց_ 2!Ll.{ s>Ԡ81Y~SS(9褒 0.;t:̖xo?6P/(5)5Gsw@zc}i)t4#coM'%F'*T-o]s=/ 溢t8dMhQnXhKll]+cC/yZ=>F(]FNرp& 8j!(h~KǃóMJU/'D /p0=Лٟ_MSpv?j ~8X 8,cdO[-etP 3=Jy)Ŕ3Ȧtʛ \ᚍ~eQMI~Q#h6<=cq&(p$T, °Y6{-ٝR&|%`t ~լ4$51C.bB4H  䝃uu-C>c̛"o:%CB) gy3(jjJ0PC48IrxwێJ$P2Qh*VEBHLf>aaY6ۉ\P6o$ ܪ\#wwJY֯o(&1JomQcED:#-h1 eI^!y+h, 'I LM͏\6ojϣ삃lt7^Rsd=.P}݀`Œ?eGvI$Jcv[:B\M<29ڌ'(5l{q-oBtywF6O?3 -dDP<_3柣h瞔 fO;lDV_שSNM.فoZ"o}|X۝lqh' r==G=8rz+BuXJ. 2={&PK? =<˓DɿoQ#60ze lӉDб>ÑZ=v|zp`щʋ, 82'*T>ԟ4`R~$fDwB+Jp ;)gPѹ@7ErLWXarL@^Ԭެ r~nH`CRW u/y!G*QY+AwC?PrZy-?+-*փ?c楺%B7f_ R}##aYvưFbUtbZ3[ȵyKoP9ZK6&9Q_]JO~@XRηF0e4ZCݒ U Y]*ɒ* 0 >{I/} k%D4`_[|.^UUݸ";ž&%X nd/&z0ޢ? 2Ǫf#}JMrp:yTce eKS$y nj,f,({tg s1cFEK;˻W՝d#9siʳ@d̬wtb x*RXakGL|q׳ἳS @  fgՖA/Pa?g K>/ YPP>,M`\/s (z5Khex H&:8L.%$3ʤoP'w ;4$XO/;eۓ8`xM:#MS2#&W}jj GY?֩ ` NM4QJwFbADcw#=K7:B)aуNla wyf,(7o/ ;3ϲAw!ppIdlvQ|}Jr]lEq^n;!dYVnD|ia|0U)fzB*SdVB\Xm߶j l$ƍDoRߘb_#IcYk2 V:K59gܙ7\r-QL]'WWv4Stӯmi*eV-51k',szm<|:CiOI ְ?Vhwynҿ5NϾv}P ]^$"*'r=NׅیQ#Aelt(NԼ2 թ#؋/+B6^Hx2M讬z*n4z@T^,Pcvk0p <#;W -7 tCRGc NIN>#7T#7_8D.K%y@{ѯڜ:ڴ}t K&qĹbQtz,BףNjDs+vV*-+\}Jɂr_DIK|:'|3)6?ҁ +3mSҢnzaNC_bPZJ9aH&h]Od|S>x`MvaZ5 99y>=/`G"fc]s(Fy9BV\rV Δ***+xV+gvqc8]&N\c<šOEB܇jЯ0>Őp&6uxFd]|ycLlqP=jnJ$=u(9p<Ѧ˱j<>˗y8lhoe 63Dvh'fz (\xaCN/$Q0 e0Taj I}p0#⿮WQ9_IF2()\Edg*}&ǽ}t .39^J腳O-|$(G@2KzS,!cPe{|Gٵ[ja5"U%>N\)6ch~񠿁iS3nV7:+ -M؎HJdh$3f^'f1m?žg*hN(Lݭ $0fDCB t}f6J lZR<Sjcl?r=oHOsZ93Na\4WRK3Ϫ ׇsߚE>7$wt3\gQk/֟ /Ը3J+Z&# $2oV`hƷĽxӌ1hzvjl_8 IU!iVhkČDXlaFpTV#$Q`C^"[DFpΰӭ:ƗQ\;E,OT'PڳǮoؚI_O!D='Ouʣ%;EyRՅ^ %){G~rHy9=m&tMd&u=0pš"+!so.+Ce42"12q•*cP$~yyܦ9b t\=Oc@>*bz:.!z J'vqz7O{q8G<ǤÏ+ٔjd.~-U"`4!ttjgAcϑ?1%v#Mm%G+W_yŦ?G޺ 4c#VP) W>38KҌjEb95&ڠ(T^u$ ],phݏ{vY2 ,ܐ>yK*ddbZNz^Ow@?,vlu͓`2V- _j}sT23$Txs56-e/XTx`ѤNK^ډHnl>=Gs_&^,)`9.j6zVQyGJRny/ˑ-\ϹWS9zT 4T {;i6vfŀAo7@{BO;a QV|Ϝ :ºp@nx[ɈPTP  <"$tXa^xc}9{WgQ'__%`wQ@ ݶ8,PBR"5H:ڧ׶\? 6hOYOìxh#>^J7tՂ[Vþ`J/G6mݟ;?#L/ GJ_I :VzMӘ %ue‚1Ip1eįfBJ`1{"M)8x.qtImC}R C}L8yrǴ"2R9TeۯDIbglȠn+H:S^R(g8J5^!G*馅]T<17gS"m|h M? HPc~Fdl[(h K UA3ObbAԭ-$8c79 Z-/%0(K<mUlp{WE%|%u(@2 gɌo`G̈́*tVsuBNqnfV7alJ@iK4P5%Y]FA%N>j gl MEf Jdt]ظo4KtdWah&Z:"A5/s6t"t~7ʪWV{9b+ݏ]R~:@QH@Α&1Mcx!N<\4gJ=K5TMF͂ 1P 1O""zݴOQ .C97[>I1Ȣ<녞_Eng/d>z;kl.tW#mhהT;gr~QuNeY؍dzBKBTzh!TB-Iۂ*hˮp%=%uʬu ˆ.wNL@߁ԏI6i*p偧]ΕqQ=-~y{Z^mL 㮪bÒܖ DnW4!WNk/qFq~'2c25$D Yd4ϔODy ɹ]Ql/83i 7-зGIaޫy-,D^.Y*̠!̍G$7m E*$?XF,̐-U'$$D2Ϟn7Oi<[[1rH) 闖+{,N0?VJه`ʡhߦ@4ytɣMA~A G' *T@ܾ4FN۬}/ [9mh|ZR8\/'#ƄQ'Ցn,YL\q 1zFHkl瓀*pl-bxưyu>L'W 鄟0MZ$߷Ӥ{`#D6BN]&Bj^C?#s|~` b-`%ӵŒh[kia`Xb޷A46م9$|L9|HjY%`fDܽw yM?[z3sP[3(eM1@J_]X#^:3:rH;<*- JF{y?գi# [u.B*{c y-=ΕkVJiB$zFFUzK([gosdu]4VLE dk_ټ{yD ЮcB f=B-dy5ߠ98.0e-y>2eO= \.) x~鲷M -ZU%Pt[ٟ}Y >!5ׅun:͊Ons z8;t;Ou ")&ZWjH꼨n3Egc<`nO,=!O(BJ.x=w/VQS".ӗh Rs~&^=WdSfts/#!g-/vc|qX'Jm`\ȀkTw:>!?s-Nٳ)-"~*;]76W)5Sd5'Tj ~G݊'NZ`2@& O77'tTgzYɣ5TsQvGE.p SD8vm= #'@m9E}$+ެu/?RjG4h)➴)YfD3]+qt`G*\6A볝u6w%/sze+bժ^lD hy8T;۝oJeKs$ 3ggۙtfY481S:/] =F I/ҟ^!Gnt)Ex4UKf/7/]a>qRG9KQ$%M),WВ+9> d! W4)4YLoW%6r OkI4 AKo$D|"Jӄ2ŖHXu^XN_Iw|94ڣ0 Μ& [dJljYťV5v31KQd Ko9`5 A~p76^pd1zйQ*c)9@b<ï%9~ʾ΄Q1]];82}b\WW.Sw4m&PXGM~޸vCZ?blҿ"}^W{T>Yei؉XbEX<2P=K$_~4!ϐ`q7|oR͂LMN*/_Ry]hպ %s&@]L+W$9]{f\߱(1@ E !zSTTTf6"t=Q0||GӎD>. 0+NjY_Z*>F~hj->?eU"mq18_&$Rndp9Op7ei!(JvkE$!DG\;~ ]ʎ#"]i6,0aThl3$;Q7}/84IT=!fVefscm[g9q D(CH&"1#c6jZ+G.4DGr_" F̐*Y6הOKLL9'ԄEa}>DQ}s>D2a9CiLFAc7A't:* d^"|MQ,x3LiL+O 2} N7W?0xw5bKVVLG5uQʘ}ɚa`2M 7z6r hf_hw 8J:k21;"_|G}4^ ].c?NB>$ j9jeֺr'ImUAc<fTuoeXq"d.i؎J?B^̻ȧ]r77yylxma2ۤ6r@ᛞv@>gT Š` 2?H R]S }WA'hcѱ8qZUU|0 88YJсf ѓQ%NMHm0?@^&j8qC% 6ޭMUK˚oޙZԕDQ6q[p 9Y`IezP^jcR NShf؄'_](K<dd%;PhEHJs 1"3 [O3ֆA\Cx18:>0E8UɶP*61USOirj[.jBD`eY8No$rtoME t>]10SyshhW<d̷DPK C9ԧ^K鍬T?E;"2}-,8o\" \z[7vd$a~M:cl51ʵ0/eT*T`F~ |$dN{MxJC|73Ѿ޽[ItC>`* |j ?GUݻ̅L+ Q?Y~ աk0<Å@nB&"@OlND1A1$9wNuۙs Zʉzߝqo.sB9νOi#zU -xa؏3om$OzE%Yd_TbPy#QК Vt.C pZ\H2zI&5C~)@`lSKU^n(j0sU̦9tN5zcY1$9wOD+wԎj5tm5C DŽDn'{Iv\uGC(t[(PQhl*͘I^y:,h`~ he2`_#r%@>$@T ÇDOC#aq$;=Xh/Wf#h_nla?Zl53TC$i`C죬)tڃ^P="i)fe v׆ sܭ?6ؓ+9Cw65,_ \wJu%ѮmJ~ )T1Ns<=xzh=˽+-[c)"dof/m9;smiZ+~*ٽLk.&\Ba`4In :Rm*FUݓ/*K)jAުeߚƋsm2{-?Nf51wG$"يI iĤ WJ6vaAgPOʣ =~R,'6J_u›4߃SR| Rn0 A]/%$jArT71{4y |b0{ˮ5frȔZs象\/hcK҅ ᄎHIb1Zb_=QSEyA =E d=<|t϶3C]١v}|qU L<(w.v)nGnFǼy6<m;z%wxsV0UHiK?Aż^K;iOCT{IGisWH_ jr:qce/Ӡ$ʰu'e~,oF0eiǕkQۢ0EwǖfA:͜WȚ ;} 9!#]HlϚgF4ϻl"4Mn#٪f!j3/X9i} +Qg<=Q63#nI7x%"tR" }-$VKVkRk@<  Gh!a±Ftfڹd _^w(`fA2X VW̤'9[ZE~Vb@9%˙xC\w JjnӰY\^_0K(PkӰ;ar=PqJA}ǻhc<ڥ^Z?mjS1j))WVg6أ"u8k2/¥aߞd|q~3osUPR$4XO-O<*͉pQ4g.zR _KZQtRȔ}~AwL \c[^ ^#NE|tg'V5gx~? [y ZIU:+l*R؀'̭CZ2"_ >De/rށ{(SiBg gf!~DD3a0nt=g3sArI&?k|9TI՛gFŋL_OK 6$(Y]DZnl$i'Hb$,qz< a;Knw芛ϕ|ѨR0~#FSw<þi-m`D!B@3 q%*x.̂2NW.8Wdحh͢:E_4m{U⟟cDF_"O-I=f 5̲žIdOY3?|?ʪ2`5t~۾Lv{:۟K*bX dL$BwݡPjXJnK|CkM+q/%|ͮ"XoUKm.#vG_8_/)Z:z [:ltEYbąc[hM xpm`4Z3Ruhi ]/tGlR)^Nlyc]%ۖ,eؾ}r2[aQjP7{7o i[gÀ6mUįO9!m=sB;[<'?.o:#k ~MUv's!}c^glmѣKȆ{_(<\W2:48t/#fnT ^`e"9~bKF*7d)<{T)Yߜ*Y=4*Kz%+xDx%ʩ7@ Y_ppvxSe|婧R`:}}^Ōo!ԇ*V'-$āCCț]AbrJ_Ĝ&#WI]C^;ҽ 'jg鞟6q'EXYWO~[4\"F Z="}-ViRM@^<ʱڝP +8#or} IUYpqڲ aթTds*@MY!&LjtI%9"D0r\W^Ę !Dȉ\4#XZ{7O/*TΊUMW-odV̰xJT昘6d|isH5 FÄq|4W*s moғ=Gv=B|~2#yGquI̟Y~?4vN gLϣObqXUC2 m~=(B5MYu꣤yX^.O*B} Bμc"😥B|c&ȏ#s Sd,QW0ƠތkT/sT]S-,4 LyEay ɲ. 3ظ\Ue'j{K:K;LvS+\hWEFumrFϿIz(T\4ɿG-`,YtJHb–#!f,uЋS;޷PҪUw+햺V縄iY0/2^?糠oD`$&فˣAH ms1[2%5-'SWc,vi]O7jL(DD~-~y{ 3[lSi[XaƙeUs8d]j9ncЙM!n-&:@u!.E9"8w̡Tx j6@ٝ d]oY=}18 @m5~ ^R|yꆉd8U ?Cx$ XPFX L ?<~]ljͨȱ)BUe-d|L}pTz+v^ :7-<W[ zFHPJjBFATUTulbRgq!!WP;',9(p@.wh$*7Y_tXyK)ٰ.%BF_ӣɢV<"MCY]^6Xg:Sx.6riyniPLsA@\N|a[x*omc0_^G]ӊ&½o8;K6[;/e=rP\^gEݧ+6yA105&90GUȔsl6zkPx>{a%-6cdB8 niqqqf,\ &T!I6gM axbrLa),i5Aaz쓯^gRyT.ZOEܱ!A_T/}m'4;I.S#u&b{bBCl:׺f= ?wu3Sp)B8 ap3]WkEÀKSϗۋxձ.]ʟ _T9\a zpL 5 Hc'dD%4 ;ί!VE-KRty7;8"w.=5~/|wLH *]ikJRրm_5Q㝲!bխլCĖxShܫMPIl_+')[sЧ=3oTo3rb*x"x[}m :`bz #e5( !v5=UÍٕPP$E]iUZ1OUz/{N9KtCL}1f\cDODZh;wa9yV=_>=RoS$]ߥ1[rSpmAcX%&REW. (kDO;aR>LOyFa+h,?JyCg {gRow06xu`}RCH08s7(x+*uihG1ZK%wcן7ב%@=a~_$V !ː MѪaJb1=Z?.8DQjCpL-1rS g7p9Mz}̭3 B*-D8  @,~SnG]cVmo;cR#ӬpYxTkj\X!-\ߨRm-Zdb٠)g7~3w/p.]~gW ]5?2U x.(:w%&xHP9śԦ% 5qdVT9ݣ]#{FAe"P֏!$-ƴ*7Q> Տv]7dIU^_G/w*j5v1 N YCwd dX쨢Hefeso/cwZO|@~%]0QHpIf*en/*uap0cHoGF4M^8D Ry? SQ4'K)*T$x.+i8.'Sil26* UtZ Н>ܬ{ B?Q}Bu,26GFW(KQ\ hSl48$xa<6ܑd U SI x *pn ƭ@62m5 ୰V􋔧BH@EGzT+Y0FG w? da{rHմui0nz夨O{M&<9wbgIDf]*އPO/]-XތĄm99&n}An%C` Xl ; Ugʼ,^}ҦHmuz D_r5AI'8vD}7vl Q+z-b8NXpbj (B XR syYYF\,,[B7>ZU'f֛cj?NMWIFylc]09!,.+M,4[Anum +UYF4htfV$84Dy,;CjT#um}EsNﯼ)I6fa:iQO^4`[XiN1Æޞ7CpgԼ J~s)i]:X1PXO,\Q)w!k FsZ̈́5vVS=J`Pq(z}' #[#]C-A%Z*wd"/!O>][4D0H3AeE!v~ ~ KZ-5*=2'xӻ A.;5ΊHqZ2lLpHrrW@>"y ?'(<ԯ)A^:R={yf/-^a_+}tg ܩ]m,X&ė_}Pr_a#\KqGtY"6IֈM9\R=4X v犃H8`T6U*y]Qu!!pXWܠ#PKINk1m qB jf& 1bG.~E[sdiaI=0=pܒ3-P6)\;v2>JHփ@IaJRW^NVzL>j =53[н9Dj\KQHFoHRAy 1 D0Ձed4] IJYNNs{ù1.ǦQI5cMB$Q%vLH^-5ARA З O:.nt1IϛI#D7([er_+6Mr%4yZRLF3U6<xE h--(W _=Je. ?jBMԿۧ6ć NߵOF}H.*Q=3&'0qGUrTZ 07lGZW}/ć5 P8 tY4䵋GZTk+V}Ȩl:T?l=<)IuM]B!?2er 6\+Fmnv6SOO }&CA (Is GNҵ,n* u'$iuFɤ4rb;YKw+'{#lH{*UKg-gt/ A(91R ,}ޜ%LC wT?KTj_R;gKz?nQ,5B:ߵZh5B'E]#6 '9x};O "j_=]=KN//$fߥ-) pv~_9UY$oRݒy,C¶d#@ÜD2y_&>-flh*b@)r1ߥF" DfvSGsJ g(NnDC|hZ+t!{G8zX4#0Z^XorzJ !,9_'7;;Woü%)T,|{9= lxvu "T`TCnQ}jS,aC5R8q%Uw7i|PۉApD|nRqbw̘`alXI2X@ymlИCj#{wC{8]KA3`^)sc5G_#9п /6f'%=phL Ȩ^Kd1pԌË]45)y8C(qBh`^)NWBkf3!J4fpE.xNe$iTyv$M*E١ 9֞nU5]XLW@_MfZ5ע ?~TV~< ǣWV_m29r ~h@b(uvA7Њ<=nvpkO|Z9pFI7=p]UP7FbFD 'Hi!Rƃԓ^|"i 2lf45-иu?֌N ՕXTVh#.G 6N˃ߋ& 1$gLoSV4锑Exc ,-g%RAr__zڏķ |ߘJ eh8ȧe>|ǘ,b(:B(vnއ&B$nB ` ,5 8l}`-CrBfEMQdz/\~&FaBFNOhSCcyLYLWN'?h?X/?AmT>Gyn@lp;bP/<lÑnu&,L"W~&$j A,yQ_s[n#nOpĸxBB@%@º\OXC`Yum+k 'ӿUOu sgri[[} cFit #alZE]2\%MS:h t\lzv#d?2`7KO$\kZ M93oOO+ƊvԧW]]յxjؘ8Ȝ-غYDe>)QT~TUe񻔋ۗнm~~=J`Ŕbk&!JLYٯzcSJ<[+!2{ߨ{"nQ1VzX;_ 5fI;VhsrϧYx AӱNCATgk( %"8$+YAV.j.sc.ON`iک0/v6 sf%aO MUr snx.Ҹ0Vr7_vA倵6\ĝ6RG0}759S! 3u|u@T ZwuufFhήȐ,N`wN[uJ:nfĻVJUhz Wp.l+-@@Ⓗ e]i'_\S BWrL a_ks=UhM Y~XvlTe]P H~G0M?#]]ik 8=CK_žB>R[}`PihQtxΪ'@7PDGTBLSWvDvPa lС|ʹE-UU]rA-7&kv{蔖u66ej ڜе _[-rTFuV>btd+?I+ Cg<=|@aCO^;<2SLN/oLm3k7D_K[~_s+r,P&[e:," cxSg)r4N\(O•F)Ӫ+wz=߈ gA2Ձ8\!3t\(~A<*5^n8BJ{8&5l5huZDq¦Yեg0=V)a {2FNjU$[y>`W,FC)C?G(y66^wNa5]M_RG)"Lg#3h')7ߍظߚ Mq٪.eȵT#!z"@n+qt=>@12F~eMkB0U>f^󙤵lz 7 ppiw vhoM?![x$׍(2wR[l+vh;ߌOVkӕ/a,} <ԃx;AA꩷ljT$o'mMY؃]" ,m`p3=i1?|YG%Qe)j0C^̗_r9|х])OR ZvҤmgS5!Sh w)'u!ܲ-իa=uo"sSМ &@w7X=q5pc++# }t3.K-64ۑ||{RKvE:BVWokK=e*4dH4sN ]JʻPbY ԰eW>iz(v@?mڼX+eкMdeRxq ׍3%[E;%mT7%L@!la/ÇJ\i }Ѷσ4~ ԥRy^|:wl/ZSr?}fq ?#=㗤-O*?%y#Adr 08{G)1É/>1/]^NU>oQCwnI1rƍ&As^[pnN\IYׅedQeAJֶL x8☘7罗<+~'qB$䱋A5^7k\|̛~o7þ?n>[v(RZX_?yUa+o'N$yMDb̓ZnUCG:(_&XbJh1ҮH] oJ>jISi5I%#30XCe$σd1) R[նtՖXTۓk 2K\MElF͚Abό*Fo;"0:(:É)|nI||$A⌫l??Mf롽a!7-ގ 1/X\7aoL k[sTjXS6zr/?SFyv^HEg yȃ@MqfS'Wz!hwSwG>&#''Iz"t]JđOŝ ֪L0X.@KШj0 ^X- ])qmE~V-BMѭ\ʭ hVݟMݍ봱xn hkr79]A^fbJAr )IK6qƇx]_]XlT雧.q"  SkD(]^-Gcs<)ŏީ?i挃$Eq~+ -2Hdd.tr;Z:[^D)F2uVU ӇWigBj nZﺺŭLmaVBA<6<]ؕsAi=r:E]>sPwae*)2t$Pf n%0(^v[5HVskTĆ1:o[mUSӖ?XM ]),Wʶ!iMT;n+%7'*{` B8Zװuac||y]HU,a= kX,ဢe1Ē]B3 \t:}L:;WEX3Ct2$.ë@U^b8#|?`n(f;_cT]=J2{B)(r "&k @K .(u# Uo %|ӑ7L~eBum ȉ t pLjzʲi\o.~MZ/cSm8>]Dԥ%;ZuHd?CRavlO$q5$G̽J;-̑KdA~T`hxzuո$$5I]HD=ϔvZEIJ#fu1*jn VC\"-2s%ɍ+iYbgg':5 XVn*W=KZ2?*x`#\ &*+f)13=,{0Gz:qD`O:\] 3HF*#l{zU NnpD]`R`z S>VÊVBYCeSaM%gS&a*jph5~WԻ%wax6kkoX3 lbTzJzef)Z Ǵ̀vd(>U̢H>s.ݚ`eŕUI\x ٶME6G!bm0 U 6_GCHnSOط_ƀ􎬈0&Q U_a1~~aLFa='ե܅,^:B)L nVWqK s[kIGgnN$3) =tW Wral$ 3GŜ JKWVz%di;kFg!̰dC+N8}Y& VRF/C{ VJN ޷⛗gg6»U:D*<$NTa}sW#J@Mtˋ}.nay4;dBZ$@cϻ2ke䍪?wvɏRLC-56:^nb뢷 &rBRljNa i͡L3vmNy՚:_$꺭Yd#!vΕikGd]E.m oB]KLDd/֮c!tr}Ze|IE ;`9K:1n]pH>27t$mԴag-\6b/[P`a8ANjril5Vqq7THKkhJŕ.v]C-x/OOe7ԮH'78mx\4$u4f`N,7ѻh|3Kfv{"l(J @L2]mV^z45ُa]h1 HI q+& `r%>6//\A[OKi4QE'D8ohb2͑u%; NDhqO:%jM[;fJ?`(cy{(lO]:G6icZZ,zb i}C3@hcߠ}ֻpViKNJ YAU[0ybnF$ϥ΍lQG3|pPScBTvSSy%[~]s젻 w]HANPؤ[YS_O µ6!}Ʋq [C BڧL|_7i_Aǁ,=$Uw&埯0[7-06=;|VsUQ!svn 4d3RRi\0U.Eψ3%| 4U;kS/+E3noB- _)ݐzoꇞ;`t²IDO?*JD-U8m5U|J9,xը>he.gw)} *|DΉYJMY5uuMT д02$'xfJFKc]" g1Ilg`*># PI/ .fZ;t 4cs 'a9 mMHf%d` 5ZT)"rL*c2o:J Dh {9Ӗ* 3];of6aHbc~'hJ}# ^FQ'zh[hq@͘2L',^{:fY2d+rF7:crda1%7-GBi-rw$1pmBQ@y㮁.n@-ܗZ)f\{ݏ Ihƛ~|۵&vi8|MRvA Ԯ @%hy_#ev6m{Ss]Vu׫X) ܱݎZ;45P`MMu]e`Q)$Y'W_&_]?&|q"=܎A]5+$[{4\.o)3} []/orfpsu6OEqHͿ=X9Zǔ6΄rGFG]`#x"0lP}M[ Ɨ kg`g_KuN1l[3bO ^iE_Ƶ,o' 3UalYrr+(q-s0ͷAr~R+Dܰ@uf?GSe B)R8t@FԩG%t̲j6 q|IF5G/䉎u!ϊicܦEOSނ6T{]yR&RVYۉK!{wapoUb=4`{untíEiXd.sW:Dzeس;"5NsD\o<ζY8:Z|#S=0D7d&+LE <]k['6UϏm}nw(*Q/0WF$AQoNA7z5ģt`ΈsڧJ0*!cW#bed"rfE *ΞWJ9'ՌaR1/{0rX?SJY~}[hAd^{Ԝ1RZi<SY_+0VwSa䗃fy7m5VJĺod-X9%f`X5k盂c񍪎+ @I3 ;SVG !\rrzvB9zHzܱ7C^R\Eӹh=ZqhUckΒ<7j1Jw3HJgJT8E(S#I P@zأ b)~0Ӧ6@W$wVpjYP`ʭM\G$Sp݋a3M2yP'ZZPySʖfz͗YWC\6T;%+.e2o7{qx(i2ԑ(6G3v*['i+$aP^hh~V6«[m; 7XS4MN;)Ix'pHt.Е16NGk©"G42- U#jlaޗ=v@Nt3!$g.fvGDɴ/XuyjJIN4/bsL Y+X)"Y#7l?NC/ >tW5/u7V1= 6`N(=UK[l}ɚ(2SL_.khzs8f*\ԉ&^?lVmOLPPH`N+Q_:{=sOBX XxxP3=єsEݼaA*^z>7}.h9ƥl@-RHY;p!Rbwz,y +={.JﯛYU*C_=c@=.'M5 i_4ҎeUH;bzЋ~`p)v]#JBsFKV_{\d^|{:K$v@Gx&Q|P)(K`Č|Ed@UPaiNEk=8v~9 ~a'aKn5,|9ݱPOXVvs:S  uwɗ Z 8-ty&"CwkWĞ4f, ~W\W>^p25F]O%x32}(`$p7tc\Ԇ'3!&F =(}"c5AdtߋN7{{QE xfzd$5#`PR4T+3N7'1zۨU& B2[up*-]{6"a$o =ke0J0U%Nt"7G^DSr}P7 mLbпrKM!T92r;LSy>jlרt1oO=;Np"Žr2iLJ&FO߱eݝ^f~-p%aw$wJ%R/`PCI{`%v#Q:Q/!T g5͜Oh$ *I~85TZ~"­^!tkڨP ;vA[m/S*'s_n }jlgiO(d=å?YؕӼzBD6kl[qwxdZLeDf?[\T~1(OU*)~W:&eolZ+/{2v]ҜvmHo(_7qcQ5 `h;lT*XIϡC'Lz$ @7h$skatw-%F 0}t0 $,?VL'`u:ґ+M6>: ⍤[,Ωjѱ2i|7w'0 ߶>00[g~VK(*?5>(a8b^>}<(7Ֆݽ]Y\@h=UyCLDŔ VLEɷe YʠbWjhW5{]EG5_=v]'4CtIvG p roUĀV^EM,-XDM{UWDS՝w)3])CA=p`*AKt"ddI7:sAɍ.Ca 7_\U >&xg:1W9U?jPƑJeSƟiF+`Ӝ rͷK۪}c6-Y9)M] |Bo4yJ{X!!"x_' T-QD[i8u1 U'LU?/o׷-/ρ hoywe~]{ZPXDնeػ^<뻐3I>NBjs%:& 8u/[;6ɜlyFwKa|ϑq0\|[;=T18qAi3*c\Y%-I-@g~pG䯪Ɣ`F =Őe1'˩9f*ϕ Ŗ @qY(h厲l>؉X7$ ?2c$1C0x/V Fc9d#wxYJsO-5o:SwאFi"@uƶ&]|&hF~aB ]#iI55 ]eF"?acdkZ_nGhٯsx 'ltY܍bIqݢz&<2g8IYw:`d߻ ZE5^aŽo6-1A%*J=RL+iHgFAҴ_oQ3Bу}pʉ554ٱR6v&"VE+ V]lޜG얅ϐb&'$D3W}lq;@[\dNxJ96,h*FU:WrI v bNqÀ/!OkH%AW ~}@f Lkwg҂+i hᦷڹʶ{Mxp8ʙq?$~`/&Ù@u3`Ew=6>X5=T(ió\%ly! _p(ʙc[pA2mLQņgV#FMILCRvLI C 㩆[yH(&Z6٦{AŃDL%.y{EB0_G\\%rX~ZtYnzu`@uGa21Ԡ57[=RpRZi#؁GeN+8 -%ZG+K,e1ƌY% ov 8N3wR"[C6 EV\Џ_W`!l!2`8WHv@6#Z|Ki=4ǃnB4C@˕o?)|9y 640 =ܿ!8m3͍%Tr}?@ uoL+R+SLrI8nK `päovc3:m qL?*m/c~ɑMwYR U΍+[A~g-]Q XF]p,#+a {"#(''8 Y(7EZ~ )q_EJn̬֗c჻^`3``:sh+#FHL뙣6/D;&:\aۑ}{kIJ(`"$[t Em=NĖ9L,*VIH "W^ՍYvP^ԋ %[YSkwu_Ӝ|u|grP{>jk ag)!Dw}0҉ =M]u }K #I(ʱQxAQGD1YLdc$\=#lwtߎwpقR5O0u;CG`_vø9[BF_P.(Ѷ%T]eS刿3c|"E]awQ?w3= W^4ERnRF^}@SD  Vq@QL"ʋEitUp;y^Id\t6\r,BًWB8VIk2ǎW=V>st{*NꞭ!xlڭ)8I`vվ91qe} DTd\ᇝ`ٕ\RδfĊQ"ߦ][V_/v'~5uk9F$sWnU mjFp1F.~ >&$k9p e ů.9ؗT`4'}]YKK;k)k5mdJf7ͩl-#| kZ\]WW4H7ɋL؀bR!>)]2=]%_5͙C{{ 6T2SGۓ_5TNP8ʯO2jx#c"Sga1]{f?}b%Ue]4ݦ4NXyRe}S^T-(=KPlum."?H\m\yUjQBipHdr8k@o)9>cNΛVIy~ qBY]C 1` \8О؉S3bV#c"ʝXw4"`f8[,}~`+UUgZΧ2vm?={YJ8m/Gu(+6zVk2yڙ `o+S&oi*S ;R{{kHEvSo%9,na G& fvaDB;6 !G?~ *?r8\|=} H> ڄ0H{uEԂze'<_&-VOE ƹv[h!qtB^^TpSNCGTH.$S(ͯ!hi|tiwUR*@]*:B$(=$IRl"ϊcOxXwIݺ36!/PLQN. tg|sÄ5y+idz-oD'9|wBfVDޤ^.}P_ {0p~?Hև7<:-Ӂ䒭|fG.5Y'WN4zy(yG週/xͻFJYxV/9K ˆAod\*D?w/t؉"ԭ8,,<*d̒oK },V iGirBrCƑ+|{5 )f7O+5{Rsl8ZNTJi/B?a_>(@MZ.R~91v+^0%YSQ88T2<˞{?qT 'ADٟrG2]L4lm&~ΔLw&KL;g FPд{C?4u4h@ԝ}S@S3}L+F[u~qצX=κ灐?@!mCʟ$qrWŌC-QXL!1|Ļ]\^땬!lAI2x} }F3'Y؀HdUPUzu™8rmJ"8.'[Z @UEfr~rM9XkmUq:{l+rtcDCI )f-6tH_ ss)E# (4ݸE߈YJJ2 ^CR MqA#>BOQT7MTgb@Yf#Á湢ñO#-vP:e≯ '#wE۵>qtP<4J@^u{Sl {[s›Nds0hN*}:^$PrNRY95PCbcOEݳ,]Tk ߃SG}jE`E撟%.\$ge)1*gBlʇz)W>;s.xG<*~_Q M>NeocEyCRޖw&~9jl蛏(!v zS`irEՏgo&0vG`VI>lXQ$|;>m,p}BMD/; I)u+ռؠuC& Lz٬pD2wi:R[#6pqP̔*&-m܌_ VTao87re!+A/";?E9Y,ns? l>q +TҰQ+-J7?͖4%+>`.:ͣp%>!Lm!$ɥm[E4Q ?JD6g JL+wUTD^$ʾq&}1mK{.P&=cht$Tl Ď )xxj$ΠCzQ E9f$.E\ܱ"jqz)O- z@ `Hp ޚXmW9_6{tN#/9Uݪ㵴D١[{?q Got(T"m%ZNu%#:if'Ӥ5 O2Y'3!Γ.A.~נ-We]t5` ة|[ce6_{¾ U iQW?w3OΉ Pjb6iU^ \75ILa-)$M;#@H"L£ g:Z@{L+Lu!xXN2VF"oN`BSEG-؄|S&B+'[8FKێ|>Q !/H L} d:igtJ,&+kB᠆59l)2URS\yewת󨰓u_aMA`ay,G%EG v MmڎRgcNw/؂0ҩ؍XnT xU qsohFu?vzEhfdž|2YIsK5L/q7`m )ݝ;bT9Nn/AW}lIO$M&AtsQ"gW18:}bDM:RPd{uY/׬?'rP.7'B/ш3；Բ3hE* ~_ )XcRw€oª~qMà]Qǽz?0T܉`ҤSǑ !tJSΟHx`#-B#ԨkxX ؋Y)󟔸d%E3Z4TV_"+$h"З73{kƒ|\Gny/[ٮu=}@;@ÚF/ jK<_Ezdᅶg5..+s-OfZrՊ7pv55~fl*6=tL|t6(&7UTmwWq~'.BI/qV;}F2Eiz *l&XH6TBT/fIKˀx_ LN='W9pބO|(uE^cz<~?u\LCaFoEta',  ng8p1}s0D3B\]ч:C>\ڝ5zѲA9aiGƝNY^)*: $ ~aOl *ga8C4n+Iirժ&'㫢}ݽsKw^X"y υc"&c0D;X ۨl(E 4÷Hbm;Ѯ7J{WqQ$A*n,m͙! \#~F?wh '2`ZL܌ٷpۆ ]C%*~{?T @tvgʕ*G b.Q,faS5v_e @MJJ&^e߬+s{u"mе7M!yKLqf13#ӹEEN-W& 82a]{^2$=. U {R'Z Sdc !AK~يC=|rND=ե0mn"ِ%6]VBS==,񀈄`KϢ*ߥyηq|Ml޵ w@- |c@QU{zw?vǎD.y!8pdi9K\b⊄?z.*Uf`1ji 7ׇ~ɷu`7Qƃ Ճ Ly@V=!)Yʧ_*Jήa3PУqWL1 6NDU뛜T2H$?Dډr& h:;j CVmbYi&0ZSQ<ΉDx`iޫF`p p ^ڙz$i?há5q < L6džBpBA?ӡw2tSlKӱm1{u\dz{JkP)㬤Rq1[r=5]ލτerU {zV~,b&8rN3|a**ەmդɘWLjXPOo\{$9D2 f[&m\p9 c?_|~GO9nA,//ޚtdbC|Hh'^^eH w8}C͡O@#z//䨾Ndjr*ಚ,Fx,AUlAYŖ2Z6xDs'4DY\?կX+l0ľ% jFoͲ~c`֣D0Q.S7gF]|GwMsV?8$pW L^L4nl!s>S Y_=+=uF˦GuzGrvmڐBY􁩐ea?L]"Rʰwh[LJ_ϼ"8:"!KvBAPÛ495Ln4[eBfW8^6bN̼%ĄҫUyߐ;#/淕^fzB4iI~+7ZYHOK([D*φD+J4ǵ\R"8SrIKuʖB/~tЄΤ?QVVeHAbe7 ~D$&e~BZ|.T T( r51&wL r͸oEWֶ¸@LD qGci/=-C[cap#b Њh:QuRIbH6~ *^(&QmG '}M!FyZOI qoyш0Vf+1[oxѰ\_rmVa ǭ^NF>l̍+`<|YL+.Wn-x-Yjǰ,DBk5j6,6f`hjWxA5;/Few)ܥ3 FX1`ޫc#ԇWbRzw[,]|DQ+ѿ Mh,.HyP(X=wjEz{&.w{X bu$Cws)<6nJg28eVPEF133ʃ SOKmſ ҁn(qIJNꨕc&-)~ ({U=eAAEr({t˩%G6lx s`P9 lNAZ=@}yoֵ ^AW]֚9 n;#6W <(_ӼY7ikTÆUwk[G@iN\lR'Pp3Y.+;?`F9 Gs&=r~ɝ%%T\#rp FY~SLQ}a=ډ.>]R'oE27G;Fk!]y*D1-X'ڮ7ڕOЌy@ 3tl \G{+>ʂW*6KsGRg{a> . [GjBul@:g|j"{Jmz~|'O;s^yM47  b0ӅL`rZ[2ƻ':-5뽤9@oz&Uk{Xc_bʹ&{*.,Tw ? eKRhF*z;K. I-EC~Dk1%3'[w5v`Hhld\00}oOaU0|ӕ͙ }9z6Sf #Q'?awɖ`#ޕ-9\)zSIJf%cX⠕٣5aY&v2lD^޴:آqMh3 σz O{VEG7gcoW>svٙW(170H$^F+C3`^m[ ?Or{4UpESѦU ++gxzT[;?+z2۱Ӊ,,{ga~B'i^yӟ]QeҨ}S~j򚤼۔*۞ؖJː}spNIep&>LH*W$3 DJ vImBj~H!7IJOWHMҹ 406g n]2\U%ʹ;H@F z%>rA$;O뾼U`nX"I/nN{ׯx )!\ LF#C2THhnRAu#6-إ8H#)GI0^3~4/PQF9Jc+ +(75Vo{* M;:<:R/5|Hf=krQfM mp w¶mY`(ƻ!*6m}hy2銛h'V}g.Ɲ%ȹ'ײ_Yr.ڣH@F X$;ӧ]:ix,j:)Ϟ3G”,plk3.u"3粹>PUp].^Ʊ>ELk6잫&ńl2\Im/SoFysީFD9Zm72DD Lj-JUt!E1ouL d{s)JLg*Po9Tzejo%P*R Άop;g0&ٮ_ _9f7TZ&*7LwHmK<|w ;4ozoy$JygBPVo[+V!}CԦj3? X8\BJ$5=[j_>s쳰ȝ_"'Ea:u+g>q3 ̙Xv^ [~~[h!+ɩY6Sx+[Pw(D7\y(KJ,.݅)Б4gʩ؉l)3GQ@vܖ&3^}L'oC>bc+xi !RyHpSk6fHmm]QZbs|+Hf* Ա]LvX&8@*ؕ=[my>p?y,~O#mճs 䀺v UmD{t]N\ͭJ>gdYt*&/̋ҹd/@KehGq`$ jW)֖qF3~dMMYr fl?ڠig|0#eK' EMqa 1 R :ӅmAem=F D U0(vty''Aګ&U 0[l4IU\LOWJ -Gײ.3#~Vu0@F-Og? ɮJ ul0<S h6'HUҟWKп]m0CTqN^ =TT{$s}_|q҈+\ {꿿VG8YޝYLs9VNrY7`ܵ}xΊ%M AQ3ˡo\i+Tk2Q.9xb>~3Q_apCd|Qڳn{gQ{{#}lZV?y UR+8 5$N*^G%Sg[l2Fb ִJ\n%f[?!=g]x59xVcR5G>c܌G-S3Yg (i!P_r7˩yu$Z6m% /[v dz #P 1{]Z0q}+S٨r'g! -kp&ɧ>G`:"!lD.z_ ^NR嘜]e~ķ@=r &q?g I{c!;y.fਫ਼`&1pMhY0ѸgM ,B"$i'#.iҖ8 ѲGc\rYb2iȳNɊ%5k9lQ qXA(Ny=O{75,}{RW5.Kus@GG}>=E=+ʁYj{7:FJ?v&x+F@ٌ)+vN^F^C\h1yV>kn4,ރku*1'*6hl3uCe@IF)[,S!Y{E9 Xp33#kw/"Qtģ0(l6񏒥;r9P䜆$MZDN 9` (;3VK;Z++rF,KB6孚sQ)IXo=黶̰3 :P̢%X%.9lؗ&8XEp!utj0%vGEDkg4 SP$ΒD`DИ'϶ҙ2&Z|WiW'f%Gv!A ջ. /N6/gY+M<8TRސ lXm^ _OYQ8 NkꭹÎ?02\)K8mG- Wzv.`"gP˫% *Rcm+櫃˥Rr9GP(qMk$Fث(TS#0T#JW/E(H};j1a2zW*.%n͞n6|⎦g"\=8'LPѡnyhURu_4aljIw #~&$6Jo w+a[x%9/?D{$۵;(4i<- @e7͆m@r{:0tXT,XB ^ D.Eſggj&7FO1Suw"4P̬svF;uJAHx(C Hzw)E-Lw^_y>֘رGTퟤ|m>1'U$UK5? .y'"A _>džB_ን*HEazұ4 Ӄ--&W(3uRi+#75ӞkPl% nw}j[ ;'L9Bu0-kLC[kڮ]$cRn@fٵ+xnO/5t?Jlh䯱?զeP+3p3^f2W\yòir< Ӎ%0rE+jgQ$w^cmwӳg).GEZ( \!pN i8 ʘPkQ 뫺3we >=xuj$Tτ{Z 2x&yE^}ʎR|CCrI`y/4ƟKNi F-g ae}k|˺'_=I~7^H4\3}WC`Zq~{Hy,b)WWYʬI#T4CHlcJc)& M4?fWxV8EM}{Yfk^`)Ț^~.ٹNӱqB+; k[*`U :|e?]R\K-!~6X刲N5ZiMQM_vS+ͷ8`{aVp h+kB:>ͲhMsT5Yi0J+".E䊐LYR&sz+DWV67v'nEe⹑ROf'ƙ \i&UbK ᩚ^IpRLlt_Rmw>G\_ 4D5$*I#-/kAw=t@b#ޒ7~y6t2cSx%,?Ph&a PTKOmN#z" C1ic>gNR"YRNe/J|,3( vp˾Uʐ=nHHr~/J@vE2f8,lXb wZH]T:+Q"Nn# d X F$˞Z r)pDǕ=ID2 |o|!iN.CɞԖ(|Fخ~}d "zˣZ*c0pEf˟ZʘdbzF`ht .[G@yɦH:/Kn/Y9"X!#)m'rGv!BNZ$@ќйUcS%QҺO t[K,e4)LT+l Ȓ5KP"ٲ<1m(jF`9-dziژf]&3E `vjN֩>Od5!5p<;o H2];LIc ,M _ڂy%d|x`;+~2`46.15l!0 .aDN#2,b3{LB17 .m$pKsAsyzVgqªf2gqEFl|D#^2>vI>nm`T򝗹d-U —ֺ P80Z^3>P!LKCb^7p.Ӗ1=5ɓˡ4cȪj ;d$bZMryͻ='20r _X >~k#V&k4l-+~ݎs厜,P(tC>e[关.`- 'SZXoASh uo.q^YE]д01/D!3=T|Ʋx?dar6Hoxt7pUA5Ħ=pY-'II3V͖7%V2.5š21|hCQ:ͮ(m!Y/ZvŖ9 dEf%Jtf%N[2 z# ˏiKޛ5Iz;r%YfeYQ&mj!9m] o{f$UU=P{ 0yB"Z1e˺!-HS p4zRkiB`.l˙mDjͫ :h|rM\bDOa3c\Pu*P@lUc=fa>րI\'qU ʶ(}yJz]L[. _>sl(sL*ڶd<_smoBiT8Wh;ϳ]C ~= 03^aQ=hy!v!uh*j B ǟs`,!d} |;T> L9Sލo 8eb)%lfٗ+ }̰e{>:Er%R gy$gu&" MtDeq ?,<u粦a+/ Ж*eD+[ݿgiP*sigK} XG"0K'ؤ#JNC1dxh3J>A:=Q\jK-:R 3SZB ~Cs)o/*^셯P Q`$ĶȎtd¬%u0ƏbƳB7VbF_@9*yxD_)DZ3:mpT2N69m#kə r̺T;D^ؔ &էUے.qo%YM Xc3ΙSByx՜iT *t2މ>oˬ(5Vcd6r[-+>ۢjpBc2'68<מ&m{| 0=\Z05EX NXy&(_jΖ |e[ne*vgR,#Lƫ[x2&rD1ZIVNɸoOƽW{uA44 !f}Gv64 m듰"\Ybnd;M:zT8`f^.JXRa9n(83K.Hza-NGgۨ}3sqy~ rutvvNdEU>Ÿ.s⓱2itRGq#/; 2U0DلZ";kMlH!u8w#2O]v E5YOS;( X[O| et& G{vp^v]+!k -5ӾWt eRt(g|z#N5/ܽssTLퟯh'Wp`(aAF䊗{A"_3y(q5t\a g˖?{a)H SyRe4qUUk2"OPOtOqK5T>% bD'6(! *0ǞlSw sVK0]F=B7:CpEXU4r ]Lևu*.iنC>ȣm `yA߽c!SސʋЉ,2pGWls$CCU*g="3:&xyry*i}_j3c.1G|k*/^UFC.1^GmK{`a [(?0c|5yȞ  M@J$+jCs8,@ Ī:8nv#<0eRGP+WDPԕYV5i#˓< {r:=::PrLFi1j֤/8]e2Z0@_iP9cKӱ-Y+&;4uz1kήt=CC:u=Ha A'D !?tRhF.+A=P>2?t_lOCH6ݜBhc(G?r4N&hAuUPFN=+TZƐ~!oK6j )!vI꤇%Ax?O7/&4}:yKZ ʁk1.ָ#Ba`qD=ixh$NPC=t߭fEB1r+qH cԛ?۱bU6IveJ^ѐ7Y({ Ug +iJlzS%)Xj=RqRӂH6|OU٠+mъ3Y o1:fw#ssj@dzϸJ0z)ɳ#\'_r /[( vZI]{gjC:;)~}<74 yb|$I,Eڞ߹ W-_aa%6e{ns 2N4Fvh]zp]׭haHHi-irYv <#| c DH٦6vÏ1Ǎ󵅃9D/^1 ~j,hUFm3mTP* R!nH9>jcq eF i$="![&  -I{e%QnJwDĚ~&HQT0 <"}JwU*;WÅ|5y32r#,0&z {8j<@:ex87*B[QЬ08?/d->CBj%3tc[^WP}D?gk3ԗgJRm*PueE_'hX$ 0-c=ZU<SW#e,̋wUM/uq(3O" ߠE:/+qV҂^Z֛Q.>EK*}avcb:, %;Q.RU!-;2|>A߳Nj',^(qq/8D0|BV)u9Mw;L>'pl뷛 2n䰒34gGܓAHn\#fy]Twc.**L~Cצ QQ#B@Z%ߦ,Ó~߽B8QnL 1$6?7WdU* sK; AOZ5v\ѯ!=!&[\pbEPErbJtcx<{$Vpw-Md֒mU>W y\eɏ洱xՀ@ G @9FLEAYD.ʯDF͵biP,af[S#g[ip֭ 돡jFWOiiAX ?N(]o#nuhՌ'6㖉+GD}lBlaFy82o![奱\;(Y&NXMi?kXBZ4.;f9 {Yf:ի[ ֋Rnwc wOIpK#;h4mcnH ;>;lُoM}nvE$Wۆ ѼVV&7ԩ햰r Qff:}fcq1%){i] N[2?TXi$2_>J&J3ag)NŒ'4HZ 3kVVZ5F!9Djį+HL5nr8wnޔV1*Y(L>m݅? !mͅUt!hiec$/x''Y)9 0W\ ݈sl ɽL,!$3M}Xqr/ iLJj@{$gӎ[)ЏS< -GkVuϿ%0n"`;oi$'dL`)|fV*R@z?ùL`',@[*G0V-Nt6y-@ Բ۝{ޙ]˞RHOvQNAc0b _|(L6ȃEjBYRc*2+qK!-#$-XLasN@ U> dp(_a6U% f-'J)zA jh*:6$׺Ӆ A;2qp"^ĉ1>~~CtI9(d0̟k7QVY", f"4d)lņ.ZTyYxG O,6RABf瓞C gY /6g]cPa4Ŕjh^Gڬ;SEEcKxx ._l5j1Bk&XBsUCSB : Ti^0UzرBGc%dfU\KI֞|e$",l12` W!OF;GGqZxO(Hf_>^9Qa{Rxwqb'`0ΒKŠQ<3>W<9iw*S$;DbFa w8nB|V L O)D_SO=)25Q[ !'ġ1], 5s2{AIsqAᰚIqlM^Ccw\LekwN&% iOm`,4NF 69=8HK $TH߭~FbM=;k2Y\0.k}H So mp(;)[r 7} gYfј2o:4\(FcfJ))9zf3Las7De'yrš`hȺJ yd(@›>QdPM+e(uvV.ivOd EFޱ l6"D*DW&2aa.V\7pBqSa)cTNM9> b.T~V5-*Q ?j rs:rG܆Դ S7Uϳ\(  n|fLڐ1 4eJD&},ڢ['ipf0etm5@&Ŋ4O6GoJ -+ɞ"L(*墩 0rz5<+.l;ueS!,9\QDfsNUiHV|b4F&HKJ%em?QBh#`UZt4bׇx 3$i-N-C5 9q *N"ZPcNLxO""dg6-fX6 ﹴ$jj^jSN=p}y yH :qϧ:_<H "T7̅f82mG?R,]0jáWwv/D$]v,%{[Pb7pUU i im=G+?]ߨX !5MjN#dzD *sJ(BwkMa sQIhˆ{@ua"qίDb$'Wۮzȴwy\sbCg6*~8 +A$ ٗddb"j 1^P%fJFMrVC YKr ~Pfߣ`Og1t2?y #zG&>y29#7=D"d5aHNbcZ:"P+D4[fYK* _"tz{L?z(麊%K /]8Bjnya6B`xgdt |ZQ`5cu#sJmXgWI3b%]c3S\qKPPIz<kF8"$([٢!J#0vsKnq XYE~|M5m͍j$F"%::O(1T=&0eTFA/ ,g7 CjfT &J/&PxO# F~a2lMC@֫tal٣iSP**uS֏.#,GF Eν k%餐jOLf܈TfR H,jǓ8t'M4 xXfxT3!i8)ՉO}Q2PLswZjy|虏xj-5|o.񕴹}"=/qFY]n Rur$ٸl_nk by~DŽfJ#NTlAb020 (.&KYX0j5a3Sn؀ E)\1X^Ileq^+qo\4=H9,4ԟ:Ndmx +Az4x0PSaՄR]>[xӍNm\(N0y+vŎbW-)(@aIǂ[EsvwHʾs‰/sp#RgK˕Qފ՗.S/rNӡRAyU6IM3:։sEZ ͰKjb*DCR]Mb݂Dbꁠ j:pK#mښ7!On'͆}iP T D Sd![\ك$C>ԯ?=k4.kQ KZM◒b\taK4K q*fH2UVؚBunEF>9h+ُ^bԤ.2;!a #E ~E*ϛfԞe7>PPl;\ayB[ DW.Ğk4z&W W]k=n7,Ѷ՟x: qFCz-:D@خ X9[ek3W06ZHW~$.1u]3Yՠst#^_쪝 mتáY.בs jX{|'K~32/*Ot;ؘF%p'j{R։;p?p<,q-v}YdR05ȣzLjH{"y]JVjwګozȖp0DUME-4T %J]x H;H*bdaoWp 炟]R jTJ40Y/Y,ӗs[][muU^Oar`}*]yt .ߍ5PhyZ6#IY6[1@.C۩7nKn<_SAZu|"c31 OcK+3wsF< d"b@Pw}phӀ5R-ě,/ЩF QQun EBB̸mͅ"[Rr8*g_8AĮnسZ;7ϖ0m P4mIBKG#cMŵPPu%R_Z,i8[w]רh:R[m#]i,Z֫Uc٣-4׫d]T_}T-| &TӬdx/fqE'쨑X$N;IXQAD-Ǝ<<}(epPǖ\;0ZB:gyuw{X\S}/G-rL]XY[ iu pY Ù%wǞzϋFF&Fw,CZ^E.*>  fTgtv,[Gۙia]+9Nvˎcwґ$5h^q+Bd.Ȋ?$"~x3GYzC,!y (Br8q'kEO`{XEZLhO;:~eV@@Bnm%~;0,~>|.)c/ě-ۻAΩmr.5YjJώ0 R™Үo*s;~rFC¨s`}@LAqh,"hTC 6I~*>zĦ&<{p uir1tF0jk4bn3?pCؠޙr ESQ׶ҹRΰL&xn3` W؊ةAD}c _Jޚ Jv,PR~pWL s! ePtl)ÆG̈́UUMIIPPMcB.9 n-? 4Nb%Oзw]}Ew)YiVuEM/ľt!sWW E,gmI0P'+V8D,a~NV{4^R{ UxOɡ5eX ˽Z[5d Ei}~XBT|L_>T?=!D0#'f΋$g2Pjg]9-&[!$t.p/UJG S6!3t$ [NY}aL+^g, BzTACIM(eoSQkΌ.H޾7:zwVkxXi&ȑr5TV`~=6ѡ͌ø_c0FG!Y\Z^S_=xxӫjB'I6;3cgt!E1:Wzݮ;C4Tyh_{F ̯i `UcT]oL"C%]{\g\3zʺ1Dtk+W@B" [2[9:99m M"1b.Y|l"[o<D(tG-֖Y\%\اHq ;*z!5aj;8䊡滨Q9%U Z`:8݊ja}/@saR>Og}+y{)@yX_S)-ttY\ (YP3YXm@7r *{GâVC`@dQМpI%ijCk4 w"%A0ӢlOҙ('^LsȀJxJ_[Uʍ<ݗ]%kĎ%BR])m7T۳ōW(`='V,s wWj2 ! v)eS8IGхĈvܦ`lJo CodYZ #$x3)O嘛xCwrbD ~0"|+Z|U#Gd&:Q#q$H 9~lJS?t*)dR3?1%eh=W"7 H@YnmUVUF>eKZpLkr>Ns`)K`7jvǃhoE<-3m2cRd,JCFZ}aS3r4k/هlGBC+f,lcL2XbR^1=5 Cf>uYT$M?nĨ y5!PL %tUt9L 3bJ>~ p_GsDO^nD덢'N_VVźqӄ(5[$?3JcsT_'ɋv9aho̟ri8 c̡E_kQRk̍i!3m)2ɯq.yik:6X ԛ$9)peIh@mu3AzoА{^9ASOG? *׻(a|7_ l,.]-OBaecڄva™R짘rƷ̨"7 V˻Ii:C evX;4 Zm` zu8ݬk[XJwtig]'M K鲝N$C'P#6TI9#c^Di@ 7Iû'n2ǔYXG:A.`#e~>"a&G}vC*?M\W_a~BR|Jl!uic`C*`e}CɐWC|M (# Իf:sBz#v#]-*u,r ݬ!Cq[L 甼w(.}Y+qs烌d°Bx%85KU_y+a ]'{TTK}ʋG'9maÆH{FDFG6}|0Ĭ5m/'gZƵ:fD"'e^Ѕ)ZDttfQ?KogYԕVBK9GɈgDCuюA|L'cLItpdܝfՠ}zUs(N%Szyᜑy =F6-ugɄ lHP1}ߎNsTue,&GaMdŰH!fēYFFqzOaϔ/Uux65Mzzȿw}jAcrITbpX[żOYL@qʮ"9`H*5me'(ׄiv#z YDS}a ')D60]K]cWnc9E3"EIz_bj,HǾk- 08u6ՊEN 0E!4Q~ʓtŻUO(X)Fi\Cƺ^^$]@wAI鞆^Νhպwce$AM? 4;:+@7nώ29րEM@fbh{bz`%WvALuB795,IS ,ض۫eTiTSt0AIE,=k4Z:#u{% l [y@s F> >zke\+h']K57꾻Sk1ιŪrz`-" 7s;,%\"NX+W2 ei3nJjb#.^TzLd p<ک.kg͜]F.0HL@GQ5ʩgU?{m>;S|Ʌ9n=<kŰb'0ni]F؞QrŌ$'TZ`h Ojr(]A ~XNV4_50tMqaf9+jYr d#ZpAp1G̦kVl y4yڬ@һ۷Bg F?R¼Ft֟Y^J}KVYN\߃<1އkQ@ Hݏ3cEUg0!Ĥ쯴H\"uK :;mA3;?b/`xD$(A,AX 4_ "jRmAB>ܛ1Hs4EtZR^-wq{P:qJq dkCη܁As:Vz2#:wr 4ʏsŵ+@EWV_l1y6u}o6f 22[GkBJECVUaКZ֬)/>Xbg:L@TSCXy:Ϫ.& Vn-.b=I>ҏ"lkN P` A +)gE4.`TٓHF蟒:Բu/kOyjlhIB; @t UH3q^Q Œ?qz&S -iYċ;CP3rz/HKIa9:X⧶: #xmgĂA4E9hUԦiP!_fW\Z0kƋB;Bvgw`.JB0( #]TUޯ]Ѭ )9͐!Yr[01'". IjƔTVsp9#g8u0Ea{nĉIdJochsSh[CfcFM<2t6 zb]t'p&i{ 3}L= r(e7C]vbZŎr؍_*-sݢ1XF"rxEQ!9_ΟګYUkiEzkqhg2 8mF1]:f YyWi 00;\,0N464}XZDՏ2cOI~uQʯ3=a{fob27bRms]ýV2Ynj•k lRpwrACBxfƥuVZ(\f7ۃ]s۸@I5W u@)l$Еv,'FȖ17(XY@O=~9$7d rg0'Y %嶩ɼR/azVU|/1CO:9>k(ʴa."D:zo,u&1Ϯ& :vs^,gqȜ' X;ci0:Ԋ.ϓ1!eg1nG[On.Ay㼡]ߛ8r&}( >PcOA*.l@ǿAIWA;eIV/8wwcM/ R2أ/J<'-)WF;,OVf&PQa{2=Aş_2޾q?(/;FeҦh0ɡ,Ce\n+!c?Ʋ F~ꙤNT##`FN/vy*[ĂmQ;uJ/XMttF݂oß*IR u81~ ,GYVX_ ][vJI`7@pa|,#6'|g>RgP"7ҾIGhaT. gL0KnH}P* \Ѡb]k.`p]ba79n`~,!xwHO! n"w??7C))I4>^jIY04fJաmQi|k=8Fb^, }R!Pb#[nֳcͭ=dۓe1T[^$,)ag@.pl J`qلy~B~҇N`A48*>I- g8Nt 0aӢ״lYy-]vcHmiXODMun2l&<3m[IxZBEex`NRX0ؤ힬PR]bX~հ">',;kN=^nCV $O 9 Z=ϘY6ueVChܷ!J*V+ʑ 94vWΐ c9<0Pyڇh Ǖ~Uf٫*nylQ8r_g1xv@/֫ }?(뮾BxZVՋSTf菸lTx징96ـEO70<5bZ؀B1/^ (%Mjh#ᗨ(HgP$= c!_1} z*q1A4fBu̎O1[u @3g3nN R5 Dҿ8Hf bܿD]!àN!W!U7jW; Ն0LlpS ̻+[IC͕kBH}0fR1l}ĄoF i0AgJfc*ji %BϵTY<5:y[c%Άûu¯ObZ ~YrHӈKAWK ^1"ڼu "c$"s hKt(3r\u\\b3ĜIWsn 8"<`z A@L*p `MzZ 85[ɦ ol1Q$K Ű~8y]*E}P\V>`%Ag( 1-R8uf)#v5w4Qc\0㊅bFg\[rwݯ*bo_9Jh=]9 UI9 Y o jm褞IEUqrMu,r=h"Zq@WGZ^s]1D%kP9 lj@z ǵfsw^\ wݤw3\];77Ԍ m1NִB;CN6D 33`~}zUeho$c+>%6 S7 ^}jsnϘhHZB<\{;S̞FOe3 $a(^.^w<1׶GfKuƐΎ Unb1_]jf$6:j9';0{kx U\fPxgA S=1bxQ0$#xd8JH^fEv)'C ߮*"$jo)V3)#p B(v/i(-)dI^oiTt <{1}} o W+#eAA` u:x[ 5TBkImۃENcusnƓTa,Jzsxc"uj߆~e>Yw>6,͂nG9kXѼq@FՆJ^ 'FNzg|dj6R;Mǣi]`wA!59 )heֹȧhƧ?&hcY@&m i ; `VRXW*Ģ)6Sqy(7&+@|Z©*%r~tu~u%vN`W Z ⏑1Y<^vbNsIxZ߷o6Dreܙ/.ش+i`<Asn{97!FA! /D$'Zczى3eB{VIbʳY3wb_{168vNigD#7@Q}IGRDB2m&L1ђ#qIļ%&lһp 8%Bdтw.K<ХVw/r2 1"Y9Oi%5R.W/׏E;&)Ze(q8N=a[ex8|SoM2B%i+L/r}6;9I4!x i id`9DPTׅ.vEQ5xݗ{=j'.K0>xۿY1 s+/j 3=)`wQq+u]4  2X9bk`lj> Rl4O N}`_ǒ_{dF:-7cq%{"a'9^#Em8D B-l&K"S9̾.7˥defU4_!xL!jwOU\c?]?j-_v 2-'c:$hۣc Jw%yCTlYVmx$FF2t DK[(IK惿l)Du?r"9֊3VxbC#pC_꛽( S.=DroTicMIPxU\v(/Lے{e]En!( #_2yO iUf8lW*;|5g`F[f_lʅ$-b*C :oGBٟe FAۑ\,Sq܂j⽍67LU'hGCAPHzm<\D?]҉+L6SZz6882GJ<*{BmNE#uYv: 9-^!dfj[g]}#C&r>uc/_ bZsy;P,Fi(ǴSOm7}:Ru1*LK3}R: [ZO_=MzXTK7/K_[ܼh e@)$oy^ aXQ9|*9X5ME`brlȔaC;KʌC[ 2X8G杦P!H{p4tcF*B|&[Lǁ&Qls18!wEg2 kV<a+-ߟD^b-\hRR.w LrV6>/{ II9¢DZ6PCQʆ/'[k]uن !oc4_ЅKz4(:P65AԙXܭ7痭w[b#rI6خm5Nz5É~Cc[^M,q'Z FP"AaWS', ޫJ$O)oH XN]ٕ\_ sM7'/8%BNBğ|1]uM?ʌ*3{}2`3:o+9Y6:LFx>y{=Kn1KjD\9pH0F^|PpJ0X3AފZ\QB;^k#cwځ'*Jwo8Tt5S#.CTAiL 8i3ĥ&E-5jBU'#$+$xɏ sgΚ+2 GNq=c ].ſ5Or~ƯD]-s7/ܴ1aV='[VR/aQ# T-mNܕ|EX?̾qCJ>[R DUC0nT,w d>n= a-']Dnhb;Jĕ0Aɾ4U2KH޳|? mn;t)AhWZ34 wcE}m}+~TqIwO9lzma!|Lz)ob|LBQÒD3lZ֎|r ̢zw|y:d~y)^QqQ:.,R&E{DZWADŽVDJR@O΋fֱRIy"/ ZT3i0Z%QÓ3+tdɳ2:$(sC=b`D=U樧ÃN,dqVLҫ$haH [r[!Z]nQUs!;^yFP8NpAE݃ @~Љʂ#-A8NuQafVρk%rs2Y6#'z(Ц/'= ~`v16Ms~x`LA3CB(n`R>Z|0>24w=4S #bRm" TL̃k˧cGy`6a\[_}:c-ari>Uπ^ve7 <D=0Βί}v>M=e$e%ucf^wm?.+x Uphk]9 7Fv׽K??ZC׌U)L)U} v94Zf|{劇7XD.t(nGŒkK J64@,0V̢)L!8 l=uocGNOZ6bĆX[bΟt&EƂual܋ďLh _(xmӛbvӉ=`y[*#(#MD@2*jr&"7gzl7UclOM 0 z1Q'gì? NY0t%s~0WvΫ@J\ n3$TB*4{q!|j$8zElc(6.AS9Fx0SDzRׂ3~DCʼW=UB9}[^İ(ZJ)X;h%zENfJ; kRY̕&E2 Ik&qszjI!È%G?܀?VC&0TlEx]`:#݀ՑGЩ}! GExOjlKX~qIB>x@YIeTQxW}anBz«庎`=BR?~%lGI8RE +?q1a9E_-$:C y(\O2,>JzK4qǮy,Z߆O3Qi4sS1o<}Ɏ/հeAVˀ)*Dxy]c ] $hI %'2&ME:! !/e%mŤJZfBf}hy+G p ~2Z<@z-PInpWבϻDҤʋs Vf{q _/^.sټ3eom;wo#kUZ?f%H#lQbu$sVW w\(H>E۳$J"5/5t]G.2jwsIS-E[s@\%CLG^t]&J6Т'pXXz?c%%}8̉'$p^Оʎ,Bڀ*J*Bp*ۼg ҡTopU@+.+)Ϫِ8M#N)@mVw{t>JJ)biѳj)wfZT7Av WȀ5^ :~j4dC9g U[5t u)ll؃VdIHˬefMgo DS U6S9k'zVf ]*٭Og˴bHI7e*a~ӗTڲ=ސ̇3OK29#~AJz]|4a IR:MlHӜVX}9W10&aŬ$Ym_ O6d7;718_3zPAݚμ@eٖ$5Wygh5-{ T:Q$ɳqp=*L)Q;+3jBih(p;R/h Φ '4u,3IC|2-FCMUq^ -$.{ͱb:҄<5LW$1O:$;S[?ŕnRY5xaW ^P>^@qU㸡] ΃s$L>Gq|Xۨ%A$xgod* J4$`s)ȎnS0EI9v$> eQ1}x`SOhP^"Y .<` Ad^#Ur&bݼ'@Gx` ^?!yxy[v2"~X^b%1<ꞑ%]BB8lpC.k68AdYzآ]g;hٽsAt;Zbˣ%bg|>s5~<`y'\9Tz:&⩝+vfek?-J?JUYYww4J^WQi}q-eV]~̊ ':bDkTO" ,KAr J (lJ2ԡ؛>uJgia{^B)o<#;tU?r%W_$ 0aʺ_XBZ}qMw o|{Aʳj `FLF'gTRHr' OI3l:LO#X>^ }:fg]N! 3Za32n@?l7 Zgy_YG~_gבZЯ[l 8DDgZeί }+`w!qϕgZUJ2DҷC Im$!rSX>lSY#df+ Olm:: es3#w-p:lª ic?NςW hL`X/WI)2Q3=G4# ;^~#μ~Ŵ`"_xț9]lT_+D)JXAhɒYDr2"! Z[_`Ls[)\V|5E:siVy𐌢 H1ɏH)j. +9orRkDoǥ0Pi–8,0:dY7d9efLR.jfxlMP=,^hZB^"<S3j[ໆJ5dJ%~7#$U eVd=~\r* ꉼzaBOD[P֖D_]p9Ee,2a7+J |= A+;Fh5z^rx2 n҄,~+ioל局d7SxS BfYױJtݜK&p"0XobѸ4NI+IN-O_%cXAFz+-[ޫN_s5_es_tv0JOr#؈kuP<&Sh,P.dXYwcVM?#԰é7zGq=|6|?jCX>ݰ& aq9gdt[b0 < "Ky]LEc I, 칙!'JK&k+A)+HOmw7Ϝg5=kQ7t eQ ^)O"獚P=P*JeTuRH/}pR%2ӯ8.Mq) A ] CGN 9E8#ͿAG)YwY#ԗ5%\BXߧ< 4ఞ)jQjMjx )Iv#ԨYFA $ DMzh]; xjXQYU|SGIy%Cu$[`WvTc/CY\)uyԛxu |Lk@g|ݎbW΅-쎘W0LZ]d"^j8t˖KEx{&X{cl-}>(8_Π_ 8Fq!!@PX>?Iar-D k {1K _cԢ_ EֵfZEnC•x|Z8gL5E8\&|G0`_V/K"qO{M9ƃ_F̟JAa|j S3!qa:UHC,:biqLdr$+“a/S kz^ej͐# =?w%xusI`T"6a@g@B]lue/pWM38i(V"d 9RhS\ zh8%zhcB5]P0yS)ޫ;d<櫜 f/8 Wa)aY:;V_!L48([Oc:-?D`m}f+x1KZyl-" E=ϝfB\XfԘ OATdNp>M)]y1 ۹uhr8R0=;!![g܂Gĺ)mǀIk؎Rޥ7zUcX;8p; 爖!vKdLE+dW hLcXRm~=n7i?"*W3\96{܊VR3}K?$5I~*3"_KHJsB$R= }/WrɟhrcDpJ+A@H#6Oiw o7ꡕRR;#uke7|I† iQuHQ~ B:h{_N#-/yV2"ir-N'rL@841zِ" ߸5P-710U Obu/AP/iCry/7 ,Ql~R{ œ=֯MWz㥽aroYKkA[!l0 &ɖALAoz:DlVlQ 4C7*.t?|C394eqc/ݠODց^ cT FRHǝVD@#pW{#$|+8A޹=Y?g!"uX.9ɵ^i}kWQO!\H+W8 ^LeL%5Sϗ OBj W;oC B{+M,Nޞ @iYHܳJ ;(@FSVc]5f$wj1 c4/B!(/N$Ja5u>HA#B1_3c?BbJOi_1~xc!U(sZ <{ F1lDkt] ֻ.&,\[=ި{ijI5&ȏg7}J9k8K%x{G?f0»FDW'ЗxZ=RZq аyL! 5n8STcG\Hԇic*"8rRBjgЂn7AY9#:0pLriwh[+TϟY%9o=Sjr^_k!XKǥKUofxDP!~ OB7ޘR V1<& /' ,JoG/D#!fI4 =y0<x^vY$&u5UboIβc4bJ М OTs4 KuKNr5׿sIfNrpʨ;X E2gBI_e] 4Glq[6slL?ێiڏY\wZ8˦XIPz#P& ylœlm? o5G .u}V QβtG3 KoCP -o擮d> ѽ {>ڕ:<]Nk>9dwS.(1Yc}:n玜=nMZ 3})Kر?hJ[ndeѪ;yc؀lM <9;(:XC9「yi̷k:cjsf1Ӯlo_J&}eM,_;jF NȓniD\FI(P\ݡGLT(e9:=.Vn3[Np64>%= 76@V#S#̅8G/ܔp K,ȯ7h:5 k9~OJ} %&MF!lB1o56biY:$iƉ\=ɿS|vesXoȝ uMb/v1hc&3زdU4|tES)e>|$LED@c}Yݸ\-v%0o,5FNÄ;enCߊ ${dD/FW(&=2GiѣrW?\{/Y T?Y$'GϞƐ\`yPiRDSR(a)kEn/9%2_勒Kyޗy%>pcש IEŧo)w'ֺlt00L|[%ut ~x=bzZE|}B:K`H]YW1"Ԑ?H'<+Qucv(u{i)*u WSLf }If\1z;0/V'}hӥ `lz8Yu(= hSYx$s(\iJRB{OʊW%.;JEr0g9'=(v /LhS"_Kb~^?!ۮXSXT/b$kK -s݌R"uu5c皓s{٭=|3?@,ĺZ߭(GDse])AQDFۜ pqdRg_Vl9-{$ \{/ЩrMJ044 *xU PN&)7LY邴D~Gr+mԺ\Gq^ڦ-gz E|'ZƦr:0&1q҆όҋpxyG?96"Z16?Am!LnH_QjĭpQ*=ǽٛtP;{W2B CZ'~JCw ԦS=3ERvʻJY#9*)UGZ!ҥ6t|WB}#ot!zpǓm?+T} h jefpW5Έ/D\.koݏO=5&|KY`6,pw^H.n=Bn=MbA Mêd]^%EE]$$0,9?%%+W_m"PxqKձ:10zDKIbN|3佴pa 2R8[7:40:d6Z'l^ MYzMQ쇟L} d*Ug/ k{y;㊕<]$;^}S*i:bK.7' -6zlyxqVZ'8v\\APAb&-(s/$8|!Wz7^> s) ͗7<`dÁDž*~Nid~kfw!u@9RQpu+pn )蹈k1(B$"s8%YhE6G2.$r  ڝnM_;dpGxG&;T6#}+TGM'%9f|@9k 2Æ@c4_Wh ە_ydJXyOJ3N}qfO߈ɞLC9tf{΂K6hׅ\ V FE8fjHI_ِGs9, ;X݋! wp EE%)1D&ŢIU3áa+Q =+?^NRRHm1c(Z*_Ijr\έM rЬn0t3"_^_gBطH PPq6 %PN=V> 9{X;-*>>U{Is\1)]WiM Z?wH䡾,~PלFmm =Ysk%3 fWz)tQY (н3KM!在nv%zYwWnݰMP,37U1)Vn> XP6p60Jk 'NTgBpNƾsW MEWUPJn;ĺh&uh ^J2G#؄n[k(E|QØa H2oRR;A+ XިmE|A؏5Vdmz78&g/4U%P?G:`Dn4/aؽXK04;0o6?cטcm?ٜ4οotb77ݑ/?ҶicfeTQ|\k g\BǾh@5 x%=na36: 6}eYG.^[x䫿"v*sc+PEk”xu:y;~V088/tL @.ixZ8ˬiNF; l.24ZjKT2ELzkmmb8QD](T:~׭%5_@|PCotk[?zzfh~~Xv'm\Jn42^{/ 58-V4}?G 2(іA :7AD:{sM2 io?+ں{[0} U[3JJ$LLô`Lۼfam%Ꝗ  Ԟl{_v3.k?>)7gQWo`Wǚtl~m#".ySe2fŘ_ Dj΁KŖ5%~,/F4!es]%L_"i(F>ҡ,ȱ+h;{q10pZ[1o=OGD N _kmD7j:nX€P>(Fq;0Gܧ3ψ ( oNћx 9/zr I30Lt6RW,_w/dzb1)W} b/y4XUWBZ xK0[+7̙[=Q t KZe3-P$'-*AvbT, Ͻ{:*}ocܦYt?H E/4[|E>9,rbߴG'!C;~:ϺÕH!uQ_ExGcqƾ@ gtX?=&aPK$[%MC_c(%o,;G @ai &ٵQ&q”$QmyG [1;Iψ!'t76I'cr ط+ZB sYl2Px R1FD ?.  }5{(Ȉ3qs?Kr-kflZL@- IVX "S?*`DdZgUO!gf4R(GȮ޴>9\J0̀1oJ 5т Z>r($Rfw1K(K4 Zpω/P)YHzTwwEK:~G#`_}*m؝kT8&[]^( |֠;h{³x Pv }}RoxYZ9q赿%.~°A ;vgC+w;Ggl nղ';V1Зɤ"rAFeU%1) ݹ$|G) $y&*;;D0zXoY|xEҕ,Nx* fo|DES] ;J%?rr(m5;n> >h,ɺH_Aob A7k S(Yұq`ǒswM֭&YL3GK TX=i"ǏI tm>M8[0XM3.5;XؑEd)><(d aF>G US&StN+tj~M(_&7- TP%5c!%*}zEQ;6Y#ك4nip_+nL^510K#]g MhP[r Eg6^wA93 rB=οf:7mh= NT*}= $ʅ8X*-A>N! AƗG5>mMyلg >3((GUH]^;r!W4>0vnaLwOC˯C1Lْa&;XW<1U ,7CbXdU? 7hŜ K$f0I+9ճAo\p IfTu/.xg/ҙ|#ص ͌<cZ_%_*#qorR RMa7#|쾃Y㋱dW*jqpbs4_D=BGȋU)Fȝh&`)T7 2fQ㣹agrBA Vmw]}ⶒf+ϨkvFL%"Tv~I mdpItHgd;"XAsT /*=W'/B-vQ ,'\o!#}a_(<ε-9L'\;@>b\eоV/zKmwyLSnA3PM|7,S\C(*` %x.qǗSƠBH_, .Ъ{zWzBy%yV@ 2 l` Wdtd4)*E7^8I8I_0,)HdSESMK}ݴꙹ)< =;E1ѾI賠>mm=mV,nL35cThR UL]ID%0Xb]+&Qk [9Q=h|сcՈ|Hr¢6F6E_xm2H+ r~AVl:).tK$wM.mytv[t ߨyBGZud^!z1ڧ(#g+5Yin5MA!.8{9b`[8ƒ-za#gܻؒCJP=kr# *AYK`TClvUb"`3 J߯Rsh>5L, xg vHU fڼ}7V 7 F= E4m>>z6h>W5ͼMx7|&&w5C]۟Lt`,ہ+og1DW>vPhrF+. i#m'oX;M9(%QP_ݞ'W'u9'{$TXqXq>kG}s֛HS͕AM:aOxp$i̊`YCj|p>7 'dnmDcTǎV:in7K1I$,YpB-h{ 6ˍ̮5\G%K('-~PIMv#P_2m3hez{ךq, -1E79&dwSb`q/qQ m"pX5Ek8o\#upkF )QkF`LuN.q chLoߑBJLtJ<>=R7ꖖ,T݀Q; YZ