openscap-utils-1.3.5-3.6.1 >  A agp9|e{BVz`PPanvåcު[dX  L-δh%jHV;ڡ Q ? ʍ1P.0i ;EJ8Dhcq A} &4UJ p11<=Kf Xe-Z.mc@f@nP$Hh+t(c-p9b94af6dc8228da489daae9200d21608252199b6626305d16fe867fd4c53ea270f03832d81764860018396a64abb0e8f38c2fe75rTagp9|4h3 ꧵jKؐYaʪo99&۸4E:Od6"ȋ(ͮLK&jX;S1`t,n n;;&5-ߗyƮ:;b6ucDH9C'ElZu.iɑS/ň|^ДEm٘>G|qbzwvhgؚ{(UI/cN3 hUh 7 #(/4m?"vLaVtH%m.x>pF,?d  0  '-3W   L  z    [ |K8`H(8/9H/:/=T>\?d@lFtGHI@XXY`\x]^bcd eflu(v wx(yzCopenscap-utils1.3.53.6.1Openscap utilitiesThe openscap-utils package contains various utilities based on openscap library.ags390zp33SUSE Linux Enterprise 15SUSE LLC LGPL-2.1-or-laterhttps://www.suse.com/System/Monitoringhttps://www.open-scap.org/linuxs390x if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in oscap-scan.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in oscap-scan.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable oscap-scan.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop oscap-scan.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in oscap-scan.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart oscap-scan.service ) || : fi fiH P; /'Rˁ큤A큤`agV```agT```agTagV`ag`agT````````2a38a20b37795feb3d83ca971791742e3fdc3fa6a13cd9ee3b67d3f4561c201717038495d5d4dbc0e3975e93a637d7755d7e499e5acd2f7e4e2dc2e7fba30c3bed54695a9b70f513c554f01999f4a6a55ae2986154b9d26c4e05823c64ef80c00809e29fa1c7c33e35c57379962e96e4dc38813c253bb54fbb333d627665666673385d11262550a7b1c665991419b53cdb491208bc03b25e1b914f834c55a48c0b328389d2ffc3b2b8e782216a31d589d14c3d966b5d76e0079a5ffa87752d882431ef7ba3264c0c0ced4d2ce779544a3f34f7fa2192dd6404da922ccd6b444cbebdeeec653a40c114909265d5386a29f1e4afa71bcaa632bbaba01b21ff90db24c7db43e1a984f84bd67c986c9c28ec99963be13f3a6fbe2bc58291ef8377dc92372ceaa10c867c308439081dca611a93e2069078cf81aae562a6a5238dadd28b6080b26f7430a8688f761af93e373185f02c801452a6e2fac919d9fbc593efe8135d3ba56802f925980aa66cbffd7841bd10e92888a927bc058ae1bfea23d0de3ebe1fd0cd236487ebd6e476311cc700b53f2fabb20cd4da634bd94e9521c8f1090cfaa6dc15d52ce84af9ca759af21e153034213d4ca817ddf353c2b77c8dfbea23214a33fe3561603ea2db357b39b56904e61441f9d18af1e24450ca47dd4d806c77c65560e602bc236887cd94db8e29717ee158cb3c22c9e0e554dfbd3363836dbe1c88996d343786749b5e116c07c6af6c5d8950523c4b2a4ef0ad98cda55f5d40f06414dca02e2c1c70e750d9b1cffa18e9b038a27874813b6e70df610523e68e60c4b1d6986f3c8f2a2e1c9d07e383cab7b2a780147901e464751667ac8cff9f2bdfe3ede51307587361c2d9fc7c0f691b77e395a2e343b9bcf24ec5d01d832962fb3e4051d51724d9213cffe08c8884aefaa31d700cee7d9cee3fe2servicerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootopenscap-1.3.5-3.6.1.src.rpmopenscap-utilsopenscap-utils(s390-64)@ @ @@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/usr/bin/envcoreutilsdiffutilsfillupgreplibc.so.6()(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.4)(64bit)libopenscap.so.25()(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2)(64bit)openscaprpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)systemdsystemdsystemdsystemd1.3.5-3.6.13.0.4-14.6.0-14.0-15.2-14.14.1aG``r`__/@_Q_w@^^{G^@^^]:\@\[@[[@[ @Z@Z1@Z1@ZZ@Z Z Y@X@XXoX2XW@V@V%@V`.V@Vf@UmUUF U#T@T}T|X@Ty@steven.kowalik@suse.comrfrohl@suse.comrfrohl@suse.comrfrohl@suse.commeissner@suse.commeissner@suse.commeissner@suse.comrfrohl@suse.commeissner@suse.comchristophe@krop.frmeissner@suse.commeissner@suse.commeissner@suse.comrfrohl@suse.comrfrohl@suse.combjorn.lie@gmail.comrfrohl@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comjengelh@inai.demeissner@suse.commeissner@suse.comrbrown@suse.commeissner@suse.commeissner@suse.commeissner@suse.comjengelh@inai.demeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.commeissner@suse.comledest@gmail.com- Since upstream has moved to Python 3, switch the BuildRequires from python-devel to python3-devel.- Add definition for tumbleweed to openscap-opensuse-cpe.patch (boo#1186735)- add old patches - slightly renamed; cpe are needed (boo#1186735) * openscap-opensuse-cpe.patch * openscap-suse-cpe.patch- openscap 1.3.5 * New features - Made schematron-based validation enabled by default for validate command of oval and xccdf modules - Added SCAP 1.3 source data stream Schematron - Added XML Signature Validation - Added --enforce-signature option for eval, guide, and fix modules - Added entity support (OVAL/yamlfilecontent) - Allowed to clamp mtime to SOURCE_DATE_EPOCH - Added severity and role attributes - Added support for requires/conflicts elements of the Rule and Group (XCCDF) - Added Kubernetes remediation to HTML report * Maintenance, bug fix - Fixed CMake warnings - Made 'gpfs', 'proc' and 'sysfs' filesystems non-local - Fixed handling of '--arg=val'-styled common options - Documented used environment variables - Updated man page and help texts - Added --skip-validation option synonym for --skip-valid - Fixed behavior of StateType operator - Fixed some of the coverity warnings - Ignoring namespace in XPath expressions - Fixed how oval_probe_ext_eval checks absence of the response from the probe (obtrusive data warning) - Described SWID tags detection - Improved documentation about --stig-viewer option - File probe behaviour fixed (symlink traversal now behaves as defined by OVAL) - Fixed multiple segfaults and broken test in --stig-viewer feature - Added dpkg version comparison algorithm - Pluged some memory leaks - Fixed TestResult/benchmark/@href attribute - Fixed memory allocation - Fixed field names for cases where key selection section is followed by a set section (probes/yamfilecontent) - Changing hard coded libperl path in favor of FindPerlLibs method - Check local filesystems when using 'filepath' element - dropped, because not needed anymore: * 0001-Fix-memory-allocation.patch * openscap-new-suse.patch * openscap-leap-cpe-15.12.patch- 0001-Fix-memory-allocation.patch: fixed a crash during oscap oval eval- openscap-leap-cpe-15.12.patch: add CPE dict entries for openSUSE Leap 15.1 and 15.2- add dbus-1-devel buildrequires to enable systemd tests (bsc#1178301)- openscap 1.3.4 * New features - Add support for FreeBSD - Make use of HTTP header content-encoding: gzip if available - Improved yamlfilecontent: updated yaml-filter, extend the schema and probe to be able to work with a set of values in maps * Maintenance, bug fixes - A lot of memory leaks have been plugged - Refactored rpmverifyfile probe and fixed memory leak - Fixed SEGFAULT caused by recursive and circular dependencies between OVAL definitions - Fixed DOM representation of the profile platform - Test suit: better portability, more granularity in results, inclusion of memory-related tests - Compatibility with uClibc - Local and remote file system detection method was improved - Make the report a valid HTML5 document- openscap 1.3.3. Notable improvements in this release: - a Python script that can be used for CLI tailoring (autotailor) (thank you, Matěj Týč); - timezone for XCCDF TestResult start and end time (thank you, Jan Černý); - new yamlfilecontent independent probe (draft implementation), see the proposal https://github.com/OVAL-Community/OVAL/issues/91 for additional information. There are other changes as well, here is the list: - Introduced `urn:xccdf:fix:script:kubernetes` fix type in XCCDF; - Added ability to generate `machineconfig` fix; - Detect ambiguous scan target (utils/oscap-podman); - Fixed #170: The rpmverifyfile probe can't verify files from '/bin' directory; - The data system_info probe return for offline and online modes is consistent and actual; - Prevent crashes when complicated regexes are executed in textfilecontent58 probe; - Fixed #1512: Severity refinement lost in generated guide; - Fixed #1453: Pointer lost in Swig API; - Evaluation Characteristics of the XCCDF report are now consistent with OVAL entities; from system_info probe; - Fixed filepath pattern matching in offline mode in textfilecontent58 probe; - Fixed infinite recursion in systemdunitdependency probe; - Fixed the case when CMake couldn't find libacl or xattr.h. - dropped 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch: upstream- Add upstream patch to fix the scap-workbench build: * 0001-Do-not-use-C-keyword-operator-as-a-function-paramete.patch- switch back to official release - openscap 1.3.2 - the test suite and build scripts were improved to support Debian 10 - offline mode has received some love with a set of dedicated tests and various fixes in OVAL probes; - the oscap-docker wrapper is no longer dependent on Atomic - Python binding are now more robust - HTML reports and guides, generated by the scanner, are now more accessible for non-visual rendering agents - Support of multi-check rules has been improved across the whole workflow There are other changes as well, here is the list: * New features - Offline mode support for environmentvariable58 probe - The oscap-docker wrapper is available without Atomic + Maintenance, bug fixes - Improved support of multi-check rules (report, remediations, console output) - Improved HTML report look and feel, including printed version - Less clutter in verbose mode output; some warnings and errors demoted to verbose mode levels - Probe rpmverifyfile uses and returns canonical paths - Improved a11y of HTML reports and guides - Fixes and improvements for SWIG Python bindings - #1403 fixed: Scanner would not apply remediation for multicheck rules (verbosity) - Fixed URL link mechanism for Red Hat Errata - New STIG Viewer URI: public.cyber.mil - Probe selinuxsecuritycontext would not check if SELinux is enabled - Scanner would provide information about unsupported OVAL objects - Added more tests for offline mode (probes, remediation) - #528 fixed: Eval SCE script when /tmp is in mode noexec - #1173, RHBZ#1603347 fixed: Double chdir/chroot in probe rpmverifypackage- temporary openscap 1.3.1 git snapshot - make it build with new RPM (bsc#1160720)- use distribution-release instead of dummy-release- openscap 1.3.1 - New features - Support for SCAP 1.3 Source Datastreams (evaluating, XML schemas, validation) - Introduced `oscap-podman` -- a tool for SCAP evaluation of Podman images and containers - Tailoring files are included in ARF result files - OVAL details are always shown in HTML report, users do not have to provide `--oval-results` on command line - HTML report displays OVAL test details also for OVAL tests included from other OVAL definitions using `extend_definition` - OVAL test IDs are shown in HTML report - Rule IDs are shown in HTML guide - Added `block_size` in Linux `partition_state` defined in OVAL 5.11.2 - Added `oscap_wrapper` that can be used to comfortably execute custom compiled oscap tool - Maintenance and bug fixes for a complete list please see https://github.com/OpenSCAP/openscap/releases/tag/1.3.1 - removed patches accepted upstream: rpmverifyfile_unittest.patch rpmverify_unittest.patch sysctl_unittest.patch test_probes_rpmverifypackage-disable-epoch-test.patch xinetd_probe.patch- obsolete removed packages: openscap-engine-sce and openscap-extra-probes- Drop gconf2-devel BuildRequires: It is not mandatory, so lets build without this obsolete package. - Add pkgconfig(glib-2.0) and pkgconfig(gobject-2.0) BuildRequires: They are also optional, but not obsolete, and previously pulled in via gconf2-devel dependency, so lets build support for them.- openscap-1.3.0 - New features - Introduced a virtual '(all)' profile selecting all rules - Verbose mode is a global option in all modules - Added Microsoft Windows CPEs - oscap-ssh can supply SSH options into an environment variable - Maintenance - Removed SEXP parser - Added Fedora 30 CPE - Fixed many Coverity defects (memory leaks etc.) - SCE builds are enabled by default - Moved many low-level functions out of public API - Removed unused and dead code - Updated manual pages - Numerous small fixes - xinetd_probe.patch: fix trailing whitespace in config - test_probes_rpmverifypackage-disable-epoch-test.patch: fix rpmverifypackage unit test - sysctl_unittest.patch: fix sysctl unit test - rpmverifyfile_unittest.patch: fix rpmverifyfile unit test - rpmverify_unittest.patch: fix rpmverify unit test - openscap-xattr.patch: removed, included by upstream- openscap-xattr.patch: build against new libattr- scap-yast2sec-xccdf.xml: remove platform cpe match, as it is impossible to match both opensuse and sles or official suse_linux_enterprise_server names at once. (bsc#1091040)- openscap-1.2.17 - New features - HTML Guide user experience improvements - New options in HTML report "Group By" menu - oscap-ssh supports --oval-results (issue #863) - Maintenance - Support comparing state record elements with item - Updated Bash completion - Make Bash role headers consistent with --help output - Fixed problems reported by Coverity (issue #909) - Fixed CVE schema to support 4 to 7 digits CVEs - Fix output of generated bash role missing fix message - Fix oscap-docker to clean up temporary image (RHBZ #1454637) - Fix Ansible remediations generation - Add a newline between ids in xccdf info (issue #968) - Fix unknown subtype handling in oval_subtype_parse (issue #986) - Outsourced the pthreads feature check and setup - Speed up in debug mode - Refactored the Python handling in build scripts - Prevent reading from host in offline mode (issue #1001) - Many probes use OWN offline mode - Improve offline mode logic in OVAL probes - Do not use chroot in system_info probe - Prevent a segfault in oscap_seterr on Solaris - Out of tree build is possible - Use chroot for RPM probes in offline mode - PEP8 accepts lines up to 99 characters - New configure parameter --with-oscap-temp-dir (issue #1016) - Fixed OVAL record elements namespace and SEXP conversion - Removed '\r' characters from help output (issue #1023) - Full Python 3 compatibility - Removed basic Python implementation of oval_probes.c - Added support for Travis CI and Sonar Cloud - Minor fixes inspired by Sonar Cloud - Added Fedora 29 CPE - New tests in upstream test suite (offline mode, Ansible, etc.)- openscap-new-suse.patch: handle SLE15 and openSUSE Leap 42.3 and 15.0 (bsc#1091040)- Replace old $RPM_* shell vars.- replace oscap-scan.init by oscap-scan.service, add a /usr/bin/oscap-scan helper tool for this. (bsc#1083115)- disable scap-as-rpm binary to avoid python2 dependency. (bsc#1082135)- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- openscap-productid-cvrf.patch: add a --productid selector for "oscap cvrf" as upstream does not detect the system yet. (might go away)- openscap-1.2.16 - New features - oscap can generate output that is compatible with STIG Viewer. - CVRF parsing and export has been implemented. - oscap info command has been expanded. - The AIX platform is supported. - Many documentation improvements. - Numerous other improvements of existing features. - Maintenance - Huge cross-platform improvements. - Memory leaks fixed (RHBZ#1485876). - SELinux fixes. - Many coverity fixes. - Numerous other bugfixes. - buildrequire procps-devel- openscap-1.2.15 / 25-08-2017 - New features - short profile names can be used instead of long IDs - new option --rule allows to evaluate only a single rule - new option --fix-type in "oscap xccdf generate fix" allows choosing remediation script type without typing long URL - "oscap info" shows profile titles - OVAL details in HTML report are easier to read - HTML report is smaller because unselected rules are removed - HTML report supports NIST 800-171 and CJIS - remediation scripts contain headers with useful information - remediation scripts report progress when they run - basic support for Oracle Linux (CPEs, runlevels) - remediation scripts can be generated from datastreams that contain multiple XCCDF benchmarks (issue #772) - basic support for OVAL 5.11.2 (only schemas, no features) - enabled offline RPM database in rpminfo probe (issue #778) - added Fedora 28 CPE - Maintenance - fixed oscap-docker with Docker >= 2.0 (issue #794) - fixed behavior of sysctl probe to be consistent with sysctl tool - fixed generating remediation scripts (issue #723, #773) - severity of tailored rules is not discarded (issue #739) - fixed errors in RPM probes initialization - oscap-docker shows all warnings reported by oscap (issue #713) - small improvements in verbose mode - standard C operations are used instead of custom OpenSCAP operations - fixed compiler warnings - fixed missing header files - fixed resource leaks (issue #715) - fixed pkgconfig file (RHBZ #1414777) - refactoring - documentation fixes and improvements- Remove line-trailing whitespace from last changelog entry. - Rename %soname to %sover to better reflect its use. - Replace unnecessary %__-type macro indirections.- openscap-1.2.14 / 21-03-2017 - New features - Detailed information about ARF files in 'oscap info' (issue #664) - XSLT template creating XCCDF files from OVAL files - Generating remediation scripts from ARF - Significant improvements of User Manual (issue #249, #513) - HTML report UX improvements (issue #601, #620, #622, #655) - Warnings are shown by default - Verbose mode is available in 'xccdf remediate' module (issue #520) - Added Fedora 26, Fedora 27 and OpenSUSE 42.2 CPEs (issue #698) - Support for Anaconda remediation in HTML report - Maintenance - Fixed CPE dictionary to identify RHEVH as RHEL7 (RHBZ #1420038) - Fixed systemd probes crashes inside containers (RHBZ #1431186, issue #700) - Added a warning on non-existing XCCDF Benchmarks (issue #614) - Fixed output on terminals with white background (RHBZ #1365911, issue #512) - Error handling in oscap-vm (RHBZ #1391754) - Fixed SCE stderr stalling (RHBZ #1420811) - Fixed Android OVAL schema (issue #279) - Fixed absolute filepath parsing in OVAL (RHBZ #1312831, #1312824) - Fixes based on Coverity scan report (issue #581, #634, #681) - Fixed duplicated error messages (issue #707) - Fixed XCCDF score calculation (issue #617) - Fixed segmentation faults in RPM probes (RHBZ #1414303, #1414312) - Fixed failing DataStream build if "@" is in filepath - Fixed missing header in result-oriented Ansible remediations - Memory leak and resource leak fixes (issue #635, #636) - New upstream tests - Many minor fixes and improvements- openscap-1.2.13 / 05-01-2017 - Maintenance - we always build system_info OVAL probe, fixed configure output accordingly - warn when the user requests to generate an ARF from XCCDF 1.1 - fixed a segfault when loading an OVAL file with invalid family attribute - added --thin-results CLI override to oscap xccdf eval - added --without-syschar CLI override to oscap xccdf eval - fixed a segfault when freeing xccdf_policy of the default profile - removed ARF schematron workaround when there are no applicable checks - fixed verbose output in oscap xccdf generate fix - do not filter fix by applicability when generating remediations from results - fixed memory leaks, resource leaks and other minor issues- openscap-1.2.12 / 21-11-2016 - New features - separated stdout and stderr in SCE results and HTML report - HTML reports contain [ref] links for rules and groups - Maintenance - fixed ARF errors reported by the SCAPval tool - fixed CVE parsing (issue #550) - fixed namespace of ARF vocabulary according to NIST SP800-126 errata - fixed exporting OVAL Windows namespaces - fixed injecting xccdf:check-content-ref references in ARF results - fixed oscap-docker incompliance reporting (issue #475, RHBZ #1387248) - fixed oscap-docker man page (RHBZ #1387166) - fixed memory leaks and resource leaks - small fixes and refactoring, test suite fixes- openscap-1.2.11 / 14-10-2016 - New features - huge speed-up of generating HTML reports and guides - support remote datastream components (issue #526) - support tailoring of external datastreams - various attributes of remediation scripts are now shown in HTML report (issue #541) - new option generating OVAL results without system characteristics - remediation scripts in HTML report are now collapsed - support for extracting Ansible playbooks - enabled fetching remote resources in OVAL module - added Wind River Linux CPE - Maintenance - updated jQuery and bootstrap libraries in HTML reports - extended, improved and updated user manual - fixed issues with proxy in oscap-docker (RHBZ #1351952) - fixed a bug in OVAL arithmetic function - fixed a segmentation fault (issue #529) - fixed results of XCCDF rules with @role="unscored" (issue #525) - fixed invalid characters in OVAL results (issue #468) - fixed a segmentation fault in tailoring (RHBZ #1367896) - updated SUSE 11 CPE - fixed many memory issues - large refactoring of datastream module - new tests in upstream test suite - various small fixes and improvements - openscap-1.2.10 / 29-06-2016 - New features - support --benchmark-id when running `oscap xccdf generate guide` - added CPE support for OpenSUSE 42.1 - Maintenance - oscap-docker fixed to be source compatible with both Python 2 and 3 - fixed offline mode in rpmverifypackage probe - fixed scanning of non-RHEL containers in oscap-docker (issue #427) - fixed regression in loading a datastream session (RHBZ #1250072) - fixed missing SCE results in XCCDF reports (issue #394) - fixed a segmentation fault (issue #370) - fix error message when OVAL generator element is missing (issue #345) - fixed failing rpminfo probe - fixed compilation on RHEL5 (issue #393) - new tests in upstream test suite - test suite is able to run on Fedora 24 - fixed remediation scripts appearance in HTML guides (issue #460) - fixed autoconf build - small fixes, refactoring, small documentation improvements- openscap 1.2.9 release - New features - oscap-chroot - a tool for offline scanning of filesystems mounted at arbitrary paths - enabled offline scanning in many probes - support for SCE in data streams - many improvements of verbose mode - verbose messages can be written on stderr - runlevel probe supports SUSE systems - new upstream tests - Maintenance - a lot of refactoring - fixes in various tests - OCILs are correctly placed in datastreams (issue #364) - oscap-vm can work with fusermount when guestunmount is not available - fixed oscap-docker HTTP communication issues (issue #304) - fixed oscap-docker tracebacks (issue #303, #317) - fixed container mounting in oscap-docker (issue #329) - added Fedora 25 CPE - only non-empty profiles are built (rhbz#1256879, rhbz#1302230) - fixed compiler errors on RHEL5 and SLES11 - fixed sorting of groups in HTML report (issue #342) - fixed version/@time and version/@update in XCCDF Benchmark - fixed CPE definitions to work also in offline mode - fixed sysctl probe (issue #258) - fixed manual page for oscap-ssh (rhbz#1299969) - updated user manuals and manual pages - updated .gitignore - dropped fix-missing-include.dif, not needed anymore- enable the SCE (script checking engine) packaged in "openscap-engine-sce" subpackage. - enable the CCE (Common Configuration Enumeration)- openscap 1.2.8 release - Maintenance - textfilecontent54_probe does not produce false positives on non-UTF files (rhbz #1285757) - fixed oscap-docker - small improvements in verbose mode - oscap info module shows information about tailoring files - fixed build with CCE (issue #264) - fixed XCCDF score computation (issue #272) - fixed segmentation fault in variable probe (issue #277) - fixed broken support for OVAL directives - fixed bash completion - plugged memory leaks - fixed fresh static analysis (coverity) findings - fixed shellcheck warnings - new tests - refactoring in datastream module - many small bugfixes and typo fixes- openscap 1.2.7 release - New features - OVAL 5.11.1 fully supported - oscap-vm - tool for offline scanning of virtual machines - verbose mode - added SLED, SLES and OpenSUSE CPE names - show profile description in HTML report and guide - group rules by PCI DSS identifier in HTML report - preliminary support for Ansible Playbooks within xccdf:fix - added "How to contribute" and "Versioning" documents - Maintenance - using bziped RHSA documents in oscap-docker - fixed errors of sysctl probe - fixed skip-valid option (issue #203) - fixed segmentation faults in SCE content reporting (issue #231) - fixed tracebacks of scap-as-rpm - fixed invalid memory reads in rpmverifyfile probe (issue #212) - updated README and user manual - many small bugfixes and new tests - openscap-new-inventory.patch: upstreamed - fix-missing-include.dif: refreshed, 1 hunk upstream- openscap-new-inventory.patch: find out the CPE ids of SUSE Linux Enterprise and openSUSE versions.- openscap 1.2.6 release - New features - introduced OpenSCAP user manual - improved OVAL 5.11.1 support - added OVAL 5.11.1 XSD schemas and schematrons - support for core/platform schema versions - support for check_existence attribute in state entities - support for CIM datetime format - amended behavior of mask attribute - added support for remote .xml.bz2 files (use with --fetch-remote-resources) - rewrote oscap-docker to python, deeper integration with Atomic Host - introduced CPE name for Fedora 24 to the internal dictionary - HTML report & guide - results can be grouped by according to various aspects - printing supported (interactive elements are now hidden when printing) - table of content now shows only selected items (rule & groups) - references to RHSA are presented as links to website (rhbz#1243808) - Maintenance - scap-as-rpm can now build source rpm packages (srpms) (trac#469) - scap-as-rpm now supports python3 - refactored oval processing into oval_session structure - many smaller bugfixes and new tests - new openscap-docker subpackage- openscap-1.2.5 update - maintenance - smaller bugfixes - plugged memory leaks - fixed fresh static analysis (coverity) findings - fixed shellcheck warnings - fixes for Solaris platform- openscap-1.2.4 update - new features - OVAL 5.11 support 99.8% completed! - new symlink probe introduced - new process58 test capabilities - added possible_value support for external variables - added possible_restriction support for external variables - improved IP address comparisons - Added Scientific Linux CPEs - Added oscap-docker tool - Created man-page for oscap-ssh - HTML changes - improved visibility of selected XCCDF profile in guides and reports - render rule-result/message contents in reports - maintenance - Tests now pass on ppc64 little endian arch (rhbz#1215220) - partition probe now supports remount, bind and move mount options - Patched NIST OVAL-5.11 schemas to be backward compatible with OVAL-5.10 (rhbz#1220262) - fixed scap-as-rpm to work with vintage python (2.6) - better error reporting when a probe dies (i.e. due to OOM killer) - dropped selinux policy from upstream (rhbz#1209969) - fix segfault on invalid selectors (rhbz#1220944) - solaris support patches: file-system zones, systeminfo improvements - many smaller fixes and new tests- openscap-1.2.3 update - new features - oscap-ssh -- handy utility to run remote scan over ssh - glob_to_regexp OVAL function added - HTML changes - show rationale elements - show fixtext elements - show Benchmark's front-matter, description and notices - show warnings for Groups and Rules - improved handling of multiple fixes within a single Rule - scroll evaluation characteristic if they overflow - maintenance - OVAL 5.11 schema fixes - Coverity and memory leak fixes - skip transient files when traversing /proc (trac#457)- openscap-1.2.2 update - new features - OVAL 5.11 support turned on by default - included OVAL 5.11 schematron rules - DataStream can now contain OVAL 5.11 - `oscap ds sds-compose` now supports --skip-valid parameter - HTML report changes - Notably increased level of OVAL details - Table of contents is now generated for HTML guides - maitenance - rhbz#1182242, rhbz#1159289 - @var_check & @var_ref exporting - solaris build fixes - xccdf:fix/instance processing fixes - improved (none) epoch processing in rpm probe - environmentvariable58 now emits warning messages when appropriate - offline mode improvements - other bugfixes- openscap-1.2.1 update - API changes - 5.11 schemas updated (from RC1 to gold) - oscap_source_new_from_memory can take bzip2ed content - HTML report changes - severity bar is now reversed (left-to-right) - maintenance - rhbz#1165139 - fix probe cancelation - dozen of bugfixes- openscap-1.2.0 update - new features - native support of bzip2ed SCAP files (file extension needs to be '.xml.bz2') - improved performance on huge XML documents, especially DataStreams - minimized use of temp files to absolute minimum - added OVAL-5.11 release candidate schemas - API changes - overall 50 new symbols added to public API - introduced oscap_source abstraction for input files - further info: http://isimluk.livejournal.com/4859.html - all the parsers converted to use oscap_source abstraction - introduced ds_sds_session, high level API for playing with Source DataStreams - introduced cpe_session, abstraction to approach multiple CPE resources - introduced ds_rds_session, high level API for playing with Result DataStreams (ARF files) - deprecated dozens of API calls dependent on filepath - introduced API for waivers (xccdf:override) and modification of ARF - initial support for waivers in HTML Report - dozens of small improvements - maintenance - dozens of small fixes - dozens of memory leaks (whole test suite is now leak free) - updated gnulib - openscap-1.1.0-fix-bashisms.patch: upstreamed- openscap-1.1.1 update - Hint towards `oscap info` when profile is not found in oscap tool - HTML report changes: - Source OVAL results from ARF if available - Highlight notchecked rules, treat them as rules that need attention - HTML guide changes: - Variable Substitution improvements - Show benchmark title - Show info about selected profile - Avoid cdf12:notice, show only its contents - bugfixes: - improved handling of fqdn in XCCDF - memory leaks - static analysis fixes- fix bashism in oscap-scan.cron script - add patches: * openscap-1.1.0-fix-bashisms.patch/bin/sh/bin/sh/bin/sh/bin/shs390zp33 1634198257 1.3.5-3.6.11.3.5-3.6.1autotailoroscaposcap-chrootoscap-podmanoscap-run-sce-scriptoscap-scanoscap-sshoscap-vmscap-as-rpmoscap-scan.servicercoscap-scanoscapopenscap-utilsoscap-scan.cronsysconfig.oscap-scanautotailor.8.gzoscap-chroot.8.gzoscap-docker.8.gzoscap-podman.8.gzoscap-ssh.8.gzoscap-vm.8.gzoscap.8.gzscap-as-rpm.8.gz/usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/bash-completion/completions//usr/share/doc/packages//usr/share/doc/packages/openscap-utils//usr/share/fillup-templates//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:21511/SUSE_SLE-15-SP2_Update/dc793089a2ff7282f351943a10d83594-openscap.SUSE_SLE-15-SP2_Updatecpioxz5s390x-suse-linux Python script, UTF-8 Unicode text executableELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=eac7ba5a135ef4898558e2855e46ab944346fd0c, for GNU/Linux 3.2.0, strippedBourne-Again shell script, ASCII text executablePython script, ASCII text executableASCII textASCII text, with very long linesdirectoryPOSIX shell script, ASCII text executabletroff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix)HTML document, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix) RRR R R RR RRRRRRRҦoaD?KY]WNC"Nr(=Db)osp@}ͯx7Í {eNăUi9}M_I qhR/c5 Ok)ɘ1s1~iBZ4wWe (+zIJcI7r wh̆ OU)Z%c _͋4M SX͹bWJC5A9 -î=c7l~7p-8e/mީ1.)m Ɍ7BB 'Ʀv%Jpb{Ym!fOi'|/Z\>/͘)P`g+^ҧ\p`eqV"`!-I)f㝀y#2G,8>Y-vvr=YyƇ5FgF|4 'j:9¬m3WŰFH _! dUoK y.,rdT'y[ު 8 `l:iف/@ca4=T A,PyP"TL@¢ {VpM4mhhNR!MYmr&c6 R*,[h=GЖ ͝!fGCsoH߳h{aYBH惓D=XXvi荭љw:XR\(BM{dD[M#Yg]*Z,acy.啹kmx`-p# q6E 꽪ãXC2'ӼBK1KoTHiN-i6ejǸ* QDhSB9|Q=b:]5yp7zi}=_E v)|[_˭'yYnZgh|lN3T1O˹Dž%VDS{'w߯ yԊ*̓!sDiX&`eGoc7}S0&/G9qvvS$kþ#ͨZV]G |ƿ|y l衤]lf℞`=w]icf4&%B0ߣuēzT>~ᔫ2Ԅs8#tX6\ g$ W~$8뜀Z8DvgC|$ Q&U8 'FQJ.N~Q+V0T_A^u1d>o:c.Nj!ݽo]~^_2qJ{Qܗ0x=id᯲ۂR)18v^2sU59Qdz#*,4T?2٨ CPs߳Y3c%L Ys~C_rY} ׮QJ$(mPVZF@ysGAN,Fw}U0aRv;}"AEcE1"K=ӹu"h9ąoY`Dzw~$B+Q3ݹ#'^|=KuYT6(#1c%?C-OV:?Do*H|ӚP|}0ɚ.)Pwsj]vvG6·{u(ΕuY 'Oe'8sQ6˞LI[2JB< 䮉}t=/߰zP /Aε@KF<teZ+YD$ V&2h5NX_5[:GNCq`Z=TWiP0?J[iMy҈:vUj^jK:rMj.:Z9fbgpCHVjk1V"S0j=V8i2Dޒ9dlnxbJ2VWߡ'h)\ހ#j@@Ö4Fnn<ɜ糸,h[,d̏x  OgBNQCPm N*ZdD3I/|;g8ƲP 6q;ʻ'^>g) Z2쫟dъ{aOXw8nΟ|h$a92i\/HUu 1H?bT"?>lB;8>7`nw22IRǚQ!xġoQN< Ѐ'o>A3$ga+ ɘX5 ̓s|EҰ8 ԚHD8rd&WWۨ/I/z}%&4#fUJTw3)Uvf<!LK&QdPhyeH~ tf ߈&X`9q)B=̝*ZWGvlU%PV_Ȭʿs$S 0A{ ^1Au5kO7ߕk{kNWh_ă(%ȾNrx:f w JDiYuicpd'ņH1Qs졈먁H5vvW H18:`xJЙ|xa(TӇ+97紭1oI("kBZn=x *$:ו#⹦T[ԙbCDI:@TղZ~Ə0%NJ< %B6y($ۥ d|.tH!H]r~BX {Bh6%5grU`X{z/F_6d;p";t)-u0 iT6R_u6* A{"FC6кtnjj->~$(9VC)[ÁUik8cq/b-pळI7!w}`A2fNq#@.}\"g?IfG ?_=b?7u ),nh9LGkC??t +XI.[ f6)鸨0{􃲐ԺzE!(вʃe/hZ.O*v`NI.iL]5j#QAށ_E?fME_ֈgc@7.\Ke R,p!'7ay%oEuc!j^^vwhQbw%u< _.2P<E5 AӃL514j P(0e0ߧ:2[5[5NE)CiK\v<^~"a7q!#Us0CZI!j ɡks1CF#aRڶ}\@&Z=6(D$ ~E؟[Y4GƏ]C/j6[U<${r4ɝLK+2w)O'}۽z gw'w}K9EFd*|}[OQ"Q^GQ;M,~vLfXq(9kXZa)vA#jƋ Bm{'ؔX@8+f|ArEjlzC 5:/$gTN}I#e7EqT ԡ}J(kKBNHv1"mw`QsTwb}F,hwa*EVW¾P-umkNRBdLlkc)ʞ6wG#@0]hr/X_3EVi_N)FM{ 5+|J=dz'LBEc 땚9?Xh!UiP݋#N!W⹽Rݚe'FJU!ge\S4Ck(h[-8Gp Qb;mX EtRc//dR(YQPmuBqxx~ [.; 6wӍ'{΂Y"?iwa)hkI!IЄ[W>J퓕?g,Yi"-:oԲÈ)&l* 6|1̄4x K.;}!WbM_r%I,WXjalIurƯvM8HM-Lbʙ}(I^tC+S rd>rSGCUv8/0HF#i]% 5>?sy[L0ebHc߷[ߕYa9c&jFQ8O[,!qZH?:4çgfүwb⏗yGHàR2\2>$EN3G{#i{t@`:./5Kp=R&]QCua)<Q b)R0+_uFߋ.OMMXmaw=>V!d$[VpFP:N0Sd7If7@;_#xHG iEg"klWkb賳}T *Y@RS!ߤ"r%'Ԍ o gZ.ůu`2~}{޽ 85?(<ڰ]mLT%zI)^rށMFq*8j $k4ƧE&h{1.Ucufxox" 8Aon/{w1bNb8[Z8%1J)8Bo{#̉o41 jKyzhC"l|~D/󀶿p7Ϸ'Xڤ~\ wt\HiV9rW_mbFYV{: `C8Evk0Xa^Ӟ̨'Cl󠞀'4[lc`=Ҿi.e[u{ϴ^%vpZא Js,w~ƣ֡{vgm^d @j2} "%&E925{KqJR K;S7n'TSCVt7gPamg #ؠ-hL |$<9Qܿ1xoO7UkϾMC&%^?_d1V 'e==Ҋd'#a&9S1mr0?T |CNȕ۪Ii= M%[MZ113Yk l-IfQ%F@N^:X_ NKjsK* }0Q' t[^BYG )D\wڋ̶1m(scJ6-+MZ0JՙU'({6+]meHe8ivziWi.\e,y^{(nGr-oQt2p|'EH6O>7h0'6TCս06&4 1XȰwЍ2LWȘpຣyEL7"X9+TI^PEr7XK*sC_H>@k@kwLdt7]ث]H#!lEҗkQ.'3iB]TiHjv udo'lzekeqhG\'{ބ֔ *_PfMG Z1K#8Y)DcI|MӰC(mͲ.h'a*+(gAAzB @do-G"*4M% b.>(_4ʹ4CN;ѐ玜IMz& RX_x9mߴqF/]C?1Fnae>rPjW'!21nBMH^aBVzuZV])*ZXWaYT{<~,HBA YQ&ڦSe4m ;.KWy1<݅1yd9$^9&Zz& 9G"l ǩcO\?`d#@wXcUY7]2o6.`j8o v1xZ: `/-NЗ5x8cP`Tcؽӯ{_=)dټdir!,T1KplpNn f{mI݊~@PRDXIW%מ`WpQ\zz).W`KXR :! >z_Vr 2ѐS]+1,/2U7˽ݖg^"ZP?lj3P?2rl¨lUA?m[X'+"(ComW0S4%ujX+9>A4&IzG\fOrיcr$+x)HAm'1^v_иI(29tW?vyQ.TƨD\??~ՎI(aC9 8EV移6O H'+HP;O\a]#xQ/á'jN<1 = #Q # XcOJ kȤ!#jM`WGfl4Y<9iiv'J_(N켈8ܿ5TΏ{'ܸY[aO4SS3`AdLһ8[--⬃KRl|t$;vC ދnJnL uϹTo`2.9vhjYz4}\̩PoѣxGȲ46|tYSx7u\!=D T>TWT-$J![tǘEv g>8,s2I=87њO`nωOd@!e4A)72+sgL]3Cv$Sq1l'qs?6{<`ibK{⸉iw[a;t)+J:3B8`kRVGB-'b0+mAGHU&O{؏DS5gYnix掠mvIBO1taqBUâC(ho эgC~ XL9/.ʂZ54vdYej$RE>#=\Huʫ﹞V+lŨ)jHX1[,/ H1_7mj"LD Nu1 ?qd5 S  S yhH}ǸrW颫I1 Eh%G$=k{3str=`;`N+ ;r&4~0ui۫=Kyu4M\įX*ZkWH`RXS#/Y=bZy`HѦzKAT *βsGJq"DI"B/ 0tXP(X0“I^O'kX3\hߡ X8~YG =Z(%g:7YOFE^9jr)+_Ö j7+. Y€Czy*ڃTdiE&nᒻIi%э?ɯ+=\~L 5bU/I:Ѣeag(glVw1ThU g/O*liԽhڀb_UUI ,L; &?z_xQbSb5;SK'`P&K:3.Iʒ@:AÞfz*"8QI* 8 6f}>`XqIuC,XW "*CgМ@pGo6ru'okzY?bB, ȑg;Yu'%gܨB1kDJ32zcNmv bj('4m vC_Mv a'4ńf .aSdLq[tMɦeΚXnI:5^TA>a+:.dcgBHcH\]zJZ/NϜwҿĉMGp!s¾)kYVB'5rW{~#G<W쇫Z1/g+vqkqz jaXlL=`)5 #>/Яm*0'pr-cxPշǑg=t-7AṕB "MaE}r"V=>#̣Lo=YsBc#Xe@qOְH=89C\!(#"y_̺ 7 .0յ@byli^o?}* /Eʈ!ifeƤ܋2>Q'+qY|3!?wIlTF^Xo=P 2v"FH*V˦/vyNwZ?Gsj=˃m0b-CREAq٠SEZ3ۤ3n)6N%6qQPHoRn&{1\9&N",K xtoG. G?g+bc"$Exq@E/ S?ף8Gw3s#$ZNGQ(n.Ux_r r8,o Uy6Bk׳?h~E_8퇶?cV;/q)p~B[CW:L0R]W^I]g(;L,G%-r,6}µwg20Rˇbn`!P!m ?d2p*_:A^Ȧ¦L%Sc䄟j}3Q?ҷq =4nY,6>kzg>8 {qD#Zϫ/רpxL4fxTxΨu**fj6  %R3\:lR\~=k! 55T_yp֞TDOO1Y!; |GWS4V~Z{7+3x@Xh˶˻!+;P&PsĖa#(%CR˞7 mҚ]g?#ҝI& lPD&gn9? *J !x;>9G9o}Hœz|L"zPF_ݭG~YJ*˜D?oMrS ZSf~fL<UXͽ)V w38WFgD+dIM^ØqIƖle"jEv8s鸠f.ֳ AfR]!"z6nʮ% qj} ղ?+4*&fM8x?cZ:$cgY&֊ЁRfhxnaR H>ƮĽ/[5%j !or7Γlnlm69! F 1X']$ Fi|KXX 2KC aNkJت=R3vNA<*[[4 #xl-}8}\ 3,l Dj}dC5~u9z%Ea8WJBxGNͬ˟f;JT>ؾ$oi6_F3ҁeSOj'^"'I=F@TD3!qitU-n$>Ͳ.e„8eCB"QL^ OrU'#0?AOw&j8/ͅWܐng刪t\\uc(L?*? 0m!84rѻ:Az7C}/Gx/ %Ip>,0!I VY@Ijb^+ W⻼HGMٔPNNt.v!=O f.aTn.`hb-<`fCHzQj͔|S)𖠉d5'T:8e=p[tXp ي.FJn% ڂ'Cħcl:=Y/-zԀ{ƃo{S~lW"nYrX(ޯ#F\bs7 `G}QEa4 5,+]y秫0)p=kJt'Vy2=]pa DiUJY uFթ'JFiiiJښWlը~c#)hbB5{Ls\C̷V'\2^WS.NawܶoDuKK~. ˧3 8TyI\,ms@!q=bnyo$| 8ENr@\j,(7wL;4Jedpv5C3 ҿٴnTJx'WaNG[Mm% !1P:DDo3X4{W4N3IjFy,Ee:O3W%RT Mپ(54ӎOjAQSvr;д~ujd_2/pXŠj<ƢSwG6f$-WQlv*ϊhiы\h#J/ zB%ƄVcPbb|o;x@?!-3@W ī^Hpvұ$<'}L"]9w9j5[h\8i`H.l"Ή%gahQCmjUl ԇ }ꞡxviNC]@nئ`d!Dg&ap&¹EN= ؇ P]<5PXեqKirOxBHme Ewo޲gdIRjXPuSk(d~zfvKN~ץkITgb:Իũ!up@sX5?rꋶD9O IsD~*xͰVRT}bxj{K q#9 5_Q,%LeĕM8ٸ4ŏ["o;s̤-!JU@%ӁF*M=*-{J rr,?cbZl%KAvK߱.CIʐUhmht#5̵-wHAe].r Rxe?B, p.[E*butr—ٿ*xXڭe27HJDW*W!//q><] ywo$* @ ug$o!X=t.X<@k-lJ~-w-(NyOga|/ UP9ZlkSqzJ1<~@8 屎_أu+mq3i8v^N3#0 ֒g,Yץ׆!QUKr{2:x;iFb`oJFxO(p7g:;eC8}E!FU^hR䗟C&G1!Xx` ۬%#ַ#@}B; 4fe/Ӣ=BRp* Г7GQ7x#ҹSx LYXeji2͈8VM Q%_nmN@z Z_+_Tx&my`oDIΝ#E Jޣ]ԥ=}D,v&Rwvp@_D6Ӫv]ʪFBh.P}7-1 a9W`*,/ȳȕVyQ%gRw ddoAS3>*a혀6~i.bv 8ڌ\.zYer y^N4?aPn>]2E'1O$}BQc MNطhC{sw⏧Q ;})Qh:=&#Ew}Cp q5;ҹÌ0*7EzOfY~.6=^MU9#坢y0 g ڭׁ^ 7oWoc_OIT=Y\K_2Zzq^sՌ |iDr_Ʈ铫؏=NҜu$TWsbu0zX ;^:_ߞCLs~p4eq^SL'otB, cnIС4 ̙ UdUR+ťY^+ Һ >zUcX{=BPG= 2żDg]#+Mc?Z1S^&gKqCv[^{=xL.U/w?$цIeCF@LfanֈwGmn<!fMԊ;WZz~<OqKA@weLL?RkQe7]Ü0 |')B6I1XԿ:PD()M) 9^Z#]f\H)';>)͡n)ٷ}U^yҬHpcN&%όBSF E|V?o8n‡%8_[.(,Ak'qr~9V\ey1s均&2aZ# ,-h/-zޔ$5J0z]2S?/ͦrckGQJv.#΂RQ;?\ }c۽McBk|6 PR=B_mbRD_h>FVgfR)jk|Cpm#}#/6A_C鍴ݽCpNRQ$`brRfY  Xh׻שG3GxK2~ 'R;v j9ܱ/z]='-}W9c%)w'6{ AlB*`eiH 62L8C'_h= @!s5o'o_'lt/GCų(>p%x 3㸲GhGKFT}o)3cn$W}GDH*0 ecƵ A;PjG3󻀽~aϬӹJM=B?K1ql $r(^h[m3dMaaɄ,|.1=]CAK#4 rK.0$|aiG<-u"LTIyژ~+K24" AkǚGD 8_S;|+^46_QzNd:h{+`*We AE$5D/)I AXUsl`5Ʈ'1)C1aG%1BÐ ,1vɍ5.@),-'7?f\NE)p3Wrl/SN[~~Lp3`zL'E/i;4p]H"7ka-S Jb,yOJkPIִ$m(q(Y9S63`kר9-q?okR|*ufL"P\CӴoj ށyሗ+;B53Ncvx@݉0|Bo8YM̺iUg_lՒm0i3Փɧ8d1z4W@5^.g`9DGώ0P<)AE)6ɮ.fSLwU07{v ҷ5:g/Лo86Wha;wj0Pƍ Wb4Jfx6诶%4ݸν䑮<ϡ*sШ?W0)oTmG|9Q.o2*\ Zc%Pdj@ܪzTF̋ptX[`~rd\FDvL6Cňe}1bTt|&dgs~`dI=̈W4ʦJ}(ۓۤYWa=7K$tl+k5=~b"DJo^ V?➰Ec - F7,":CBڔpI{ۄ(Ool"/sHׅ#b1E|v4ph_ pL>]nmD+Rbj/; rl`^bJ6= 2zK""LQKϻL.jc,[˰-3U/L HmHZ\ӨOȺ4Q!EΜ"'p](3ܦ-m^S w{;_V2yԊ0x"2%TU;£Ęȹ{;C`b'V16 ݪ], GeVeG:jFc/ oѿ(tG%Tr\̒o&QȇU@d}JN'(ʞ)4Е@{¾Bc(u*Mo~ݞ*sԚ.]P\wГ^"b ӲvApgL6[]vͧ* [i|&{oǡ&s)椙ḰRe8ZIDCaR7}(E9}|zS&}0"x.u,I"*o}OORNHUa]$Uk0Jl0$o5*]KCa \:N9I)GR i0\{=EٽngI*Ib/I[f#$;+l1לf)C((أKq/4]) `=Uzq|Bڶ<k͚ә@, ;2яTa 3,=ą4ע]KxCq'cލ_(ȓ `uC`}+q!;NJ8;h!z9:E [.U^+ŏ6;_&X xZ& y4փ9OݜaJaiIRr5;ȣn8ޓe̩Mi.߆epCzDž r97oGJ@(a%3cLur= #:W.}}w˞i}~alt(t`+k:wLسW$C$AQ!(eF݌^8zȳfnĎ䏛b:|_8O]4/ʓ4|:hcXvԑhD+3ñ?dKtRXCʱےXP@ƓLD|cX}Qglxcr;(*O%-</_; IH`Y8JE>B;Ot@ۉ2kLHhvd97ZnẎߝeE҇QoeU[ق!1R خBd}}7>35g [k/Ny)Be/7作oHo]622M,d}g=ؔ+T՞YlN0;"*_t}.ّq8vД3]?#+8P2M]_as@Wڈah6K'(؎̲k}|2ocKp!m~hs{ICi9N%6o{EC&ӄmlO+L|1p8` LZFSg {L"#=b [ݘ(Khg<UĪO?ݲPCmSb/01'4LFܩ:6S|Ke܌a쥧Ԑ0!pxi4~K8zJv`W'TKoc{ ܓuv OA-%IT˷:cxgB#4Й5=wNsE3+٪ 5(Ç\(vu12'5+quLL*/)_HallE_,+1{Lba=ei!g~#/aOyd˭VR[FLOV5ISčh%E/Sݚ)- HvRQ)-'Ӯ5/ Zg84?$^:,CE tPv]ʁ_JJ|^,Ј36QcqT 4cw-k}&'4;IWodS|"elmЗ%D_CxZO t5WL 罹6MVAIېK;gYtuՆk1gXElz*5돡(d\DlLf \6e0>SuYlqvh3jƀ宮M<ӛb:˵zh2h]`z2;/w3Ax%<=Q% )ʏQPoUIV}QKQw?ԮiԯrQ ZkQ#V44GKOF cD KzҞ?D:v(Xt@Eom#}M!)Nù%mB2t$&NT}2/h>K&Xt/#Y)]K/$FdcPѦ-i*ytߔk9&:%IbT OKbYCmQRg/Ou'ORCQ[zw΁ L6!K6x'i|U'G/? 䞈͋ m=Yd 6N>@*rzΞbg""LO`ٖF,/$IjtD Mo+頤$:ryX@]%mﰻwCI-yMm;Ch5UvoQy]iC/fD:;&@`_>ďZbTeG)7ŃЗ,a"Ӵ wZp1>ؠbsNEeLǠzN7'E{旲Ԭp'JR;(\&ϕ~Y uuڃЋs *?LeYZ *? in$c1[og"9Y$kQ/]aU8]cXFSU#50&C.L0]>E޾m/;f,xRcPW7=XuZhȷ-7WV?,ҳZ*KI V"L$r r_eQ.I${P]AjٚP^LٟL1LťqPe0@?G?5)٪h"0:J5A&xlys힊1xg8' @nYdC~oQР-O &C":hū@,:5)L{7݉|ޘYn=uߣiK0=!I߅IvTb/ ݰ.S1.> FM )?WO,-? IvWT $(,[ɯ&3֪6X:`1J'C׍?*/H |hg0~u::yB,x-mV4/bi?TΪ,GLUؒx+!3n`ki=)/:=n ҮA2z֖e.s1!'6)-\jG^`G+$U\N^qJ׷~@V>3XC~t}*2<3PJt/!;{" ԐbWH%a|<4BE#8ɤ -;”w` RPE?5)Njl r 0hy$SU]r!U"96,Ka}^&4)רtuY\fw[΅Vwoq 6ҳ]Kn#1w/I\C8w ;H)cG y2~.RM]5“Ѓ;!S:l1TE(B(~*6ǯ9zTrvcPtoctji^hYIܫiTk7LfɉpE7$Ɠ0cELfdiʁ# Hi(oEHxmUaB@L$w*d8.h Os87EL $LAޗyPr9)^}'OgzD\|':jܘBb!]GSRSg쓞" oYdCKD|>x9j\dg}îpc*0'Xp|p^+ /PxUw^ݜ$8|8 M94):0e֯-#8:G36fwMa]iI[snV1U8K\BN3~NEDNF{ڟ0NSU3lx$؇Bс%߸"V \>K{l`FIe#cnR2F^n1Ƌ^n:;$𵳏e%[dңj_O)s}Vě{u$N-&賯=8*Vu vfIMM׹!fS^tVHvcvZ -qᏰGɸ4zy@5$ƥƁmVAAܥUHpȏ9I¨7[]$HMl^abb&*oɐGa 48wy 4EY0u[d{c_Ɓl@OeuBԭ%*mY~uBKވ\6PSIyEi 8fHhCYz PR[ qdJ+TNQͅnYĎ]v[b;zL]cJ}Aڪ$Z*'r Q&_{ v&׆&)u%WtR~Sлf*2oͷvpR+K R?<͟Ͷ, 5QzHJWk^.O45+ 8PjFo)UKn_ =Iol%b{?ETl3Lab:=~Sp1qo}O,,%^H|"4JCLbM %HdFF: Vuf t≛}s'E)q;8>*LyH;)(yl7:SaR1␶J•<I4N7ɄeȊw໡TN{)} a1d34+-EvLܚ؏-VSsS2"z w%<2 +"*V^tgS?:~/@s(ki$@cdѳ"@ye-i7v'sV8(v"奸T(P⾀1fv R*feڬ(Htcƿ8[0М$ l>?->?h&4#tyIԐCZW2Eajm[Ci b! dA$UJ%-]K {)"+䕿lϻ3]d,ȗQbҶ t oJMz3Vc(AkVKW3'8.c$K aZE!.wF[7^f a(0-"P=0> 6CI}t*p., $pORi6%kvxGO5>?lEDp@c|y;.w նo2,Rxy?R?_I2~8BDP18Pay6["3C]_!TФ.PPY%I([<𷥒-UtP*kK Л3:)|=*w TZFq*x` *Wl%faeĄ,9#5LHCwjR x}VEvbxq1a'諷roHwtyh$8Az?MibҺ:ĝ($ I5|!p'vΡ?M3M{(tgbR׻ic0S6c۵9Ev* fn9?پr%>mϽVƭꔽe~nߝ3 .a!k,6jii"duC+[WB9v 4:2ߚ<>|B v D 7|rrx#f7j3cG_qӳA ~=~j Z'Tb07T4Te \kG\+B<5R0qL5$-WE=(yN*l.\cjR?/j(sOG@) Wꦧ-+s]׿>FX`6! ZV'ڛv=Wɲ5J.~TLl MՊsBr|U&.XPjx}TL`HBDc F%Rj>ZFݴ d"4أ V{L%~&ؑ/;O;ֹB<ۭ82:R}eAf :)a2uՓuA& ~ HTFu'nlLh/W*o(#3 WO׺sLnw,d\ Ӈ1Ւvi`F-I9UIRV+Eskn8Iy_pogP51S.f48Nj|7Ϗ.NTSAPb ~ ݞo24 h#rG#ANnXsAHo:k&όAG1<7_#lTdž20zaJHDTϕ&tzT.VI(ݛmOl}BRQc~,watyUSr· bJK} b{!hs짥PVߕt[Z6Hd:C2*FE{(eLy+~Y4RcHUo)Pk\eS+]z)>ݚk E6>JeT p^sgDUێHcyLKj'+zODq3$"yQ6SܕLx H4ʔ"3҉ /?x?żTs g6Pm#!Q"ҿ)+Ktt-XL.pJtG3 Dfuږ ﵼhS=zձb^v瓑SmмuQ$dT/֣ػG(s&~ 2o#:PJd{^fWB3m]2]% .R9}S \!YzU)KBOz9l>ƹKv;ni92-B#l̘c `.pĎa"nb& a%/0hE̊}(]}V%E Θ Ƶ*;m9T|b1BgtO?`>K뜒pA☂yq׮jSP2PvܚcBk ?9=d_ѐJSP30 6x-o*q4;{B* DxjQ%N2޾_ ɀNn4:K*i>8Lfo`}Qd P`cq1yc&T ]CGcEi{Z6 =DxOAxŏLM Ab5Cr=+ڥ@9 qKj2x0UUӺ-Oʸ6< (tw] qL.0X>8FƀV a-|<-!ӵ Px餢W6.8P~#YChyb1Ջ>94K(,ݤ"My2t ѥl7GIv =-l1VLQ/R( LonbZN xjbÍmP}= E?mF% A-&~ ,Dv ;?'ͽ+|@2nY\ճlb $OJ5oʷEp>.Hj(]g4*j:\zR;4i!J;gJϩ)v\)[uY)b߿0 Fl)Z6 BBmBҀ^*T@x"[sTglgzq%h$5rc'x3zw'_;zըLES*f˵K!a< 8r,FGiwIϋý Qȡ Xvșy)~>p.8>fKX%$AnĬgg CD06Mgis + ֆd 3TLavGx1+AqC } re0DUZLWe%pN؂~"8Ŋ@uߕ : [ %C|M|wSuJp>^(%,z7v=Ij[lw~HnO6?qvnX4X0c,Ԫ|/cuhqV9zE izw-$*@†RO]4Hos|3°-[54^% +D}3FÖ9z"ѰX}p&Dk xf I`Nqü،leL\c/ОO"S^E`~EUa)!? ǒ ~jQX'gewOi+#p1Snh2GM{BYKxڣTot%-ZUzR%T-w ʠ'̛EtH[!l٧6,NÑB@V.""~sr *Е&M#5 FPePGD~=m-JWseQT`y>K_HP&\_o oC}:\VȊTr::74q, aب8z+|Yȏg52c5]¸M<ώ9H+(@E3ITzfÌ|%OAc[4|7_t6Ь7ū8|yUݱTƤm7xx77h_O6p4 0%,?{p)D:ƺSFø:#Ŭ6gi0,$|>:%B[B(:|T!?ƗpU7R{Op6 !-Է:.nBQn6fXpYX;OEjUjdRIdL+Y-C((V6a( P:.}rB.q1-j5FRN_:s=mDM6ri (oOd y=v (>dެRLL`HT(!{?׫Sv"M<=eD"!32֒`9P !؎ JU*Ė4RII:8鑛}Y;U{7 +CF]0渹sJNjfM gz U}t&V NVǪΒCCѶ8^p7?FIIed5AKOw/ç\638^*3{^'t<;UO!WAoÿkbs΂) 2deѲ8Kz,~4B뉣x%+=f᣺bh=๕G;48hYhM|oY/w5$h*:: W@MM>Лv}O=#vKA{t[ދxH?Z]dߴArök/Y/;+xaPܠ2~ٲ6mN 5K" EŽQDR>{U[6WfHXy&4VZyұL] 7"N:Kmvmʌ#TV;C?ͬX!w}c5?_)Uڝt>Eh9Y}YߐyM4þA">CF<`@z{ILViV8P[ Vxlhi0 QS]WSX^!>rJvq  $~ԙN1DAfT';F\&+AhZMg"Cvb+%}A3C]8Ԝ0D"z5 u21t+UO]!my`v 'wpSj5֯e*JӵT=rޓX<ѵtupȜ8 i5HN جJgq}Y mnׅkCH2WR~O̜q/Q7oudirY0u4y昬Hz*. E-DQenk̫6aRWܘu em 딾 bPgLdԢ% )}ưp׎4dx92+(dGbYf¹Ng;Ӷ&n4Nw(^UR;N@}Moe41w!߄@ 9C_9C!B'xȃU0i ?amQ6b M^q-AC]I@Y2PxOM +{eP*h9~q޾ʻd2bQ4#Snj11dY<ĢDdHyO//#I7$w'-m&lo94u[ x4S_o}*NGQE < ~.cW"v\jp>9Hn>/#VwwQ^q6z@$E='rGǦde v5^q:ǖX6q9FX;ӯ)AiQUji/:՘Gͤu (ɲa* οF iz2BW^2_hnH{\m 껡E:FtNg曊AJ !T&\G&[jD{Ѧȉ='Kah:L \aMM@1M3z&HUh䀎Ƙ>4^ƥ ø,?"iT(cXUMBbl Rk1AIaCdoYhI|j}w1xHV)^"V1gy˚f35} Ր$?O٠^d0A}~'Ԃ.\YDz">\Nd3)A E3=,BZ'?Jё/( im fCW%FYCJjIXPqNsw6s\24:]=&P^ L%1$+J/}4A+{gyu:p %p(2,pmdƣ܁ofD}F0\(z n ,+~6mXVq>"=JvckD0 Mu>mk@Wf&־dVn"PӾ Y^d%]P8oj w۶ٜH]wZrfN̏^^fD.&?ԭة76?-Ӄ5J5W-)) ǃbS^6D&._˫'dy{ Қҏ$l`.ν!=zMM>$397Fзm)(jĖ)LVS4aezID>Žc2?t;2'rkO {߃} z:;g=Pq!07KnIPO(E9i*}~օ(ufa'U6~dsa(/c bu\GLR4m$uyYہ٧1DQpSE=Jk !O S{̌Ĩ*bl1b~ }HkHF~3dl։gu4"jPҧѣi^e]ѽŕ4cuSǂjd$֝/!CngVNAvrph8J&5wNoθDUzs`qL QK*ldg[äVy)f~X9~#Χ6,Y@*7wU4{D6N8WwPnGmez^Tӆ 3^/N9W]IaQ,-j-?F h'Y# 5yb`G›#I^AЂ42X-f㒷yB^Iu"t&[LJ6Z͡f+H*ĭ,Wn铬d po7WD :;3Wq?OtzΕcL5.Ǜ+fS+ZWRb(w2&g~#2XK8c{ΰΎYRx5g10|3GR1lN|qMXL`2a9|)7b8=Ld?)F&Xs@9n_ ߇t}?s{.v0[<]'Lpq59dՆi邜4MҪiSA,{ZnUDC RfP* . P o3r+A3)9Ո6j DxfaY!F3"`Hetu< ?#%/Oj(hJ;-(EIGX@ PPuOx U'n:q'^|2#X0*- ~ɰwi8 νb`y.as~N l [GVnN/cQl 0լ/ `#jX$3-;0 $F *lZ*5/bRQ5" r U"dY;|(@`X-xlA-)$K1Wr3MyN 1 [{cIsMCTq`3Ks :LaWJ3*PE*F'lR IWX_ڀF1emzMct⮢up{j5'K+!;:n7q,ptFA -#Bީ8bX؈slR*vrT?0KH"F[50W TF>kRc!ֵ3}| $4K,vLM'AXt  tFf!9UZr|}Q4L&γFk lҽ6b[o>lβE'쁶6ўE|]ܯ $WHT&RE3p&׹+7a>?!V&Yobu{z,eŨ+L)ezi ɎqDrBu`9na$r`E[>cap%1M y26Cz4:r,IBł3/ [L'BP3YBl݃^43; 3{ 07Sq6%q%̏A35(q2 BTs>OӅMOE+fE58ڪ›(Օv" 0Sns:2t;j@ntZd/ڣWhbujS'4 &R:I *>ӰLSwRTɄ,dtzCpsLm =TTYœdK8~яQ8 y@YbHPV6d~e Gn+tx] ;MKL|qCFQྩ)7/F0~hCe*o@Lom7?cLc;%fGD72BY PJiQy/q̫x6e_t. :rni(*SY qc,b3ǑN Sgz[Fn9@wne ]"$A"?-ym~2hOX`e,CI _aUt_gA!]]xZ(בeO4\ZHJG'  ҄1[ eۄ=3(ar4'tB"{OrEه[Tf6SwY0K'7!,s!*դXM(Tx3[Ϲ)h N4=А\mD=%jɍ*zӀQ&||iXc Ocmy *ڜҨt"!CTcs{UbFx3h^F!`CX(}6Q! ~xB#+5y6Q!@8Yanr 2 Mݜ$z/$D>V2'Y|Lf Yp۷j4-d@ȋR?d퀘!t)IWB+!SL.JFPk"Nx'nθ3i6'"7߼o%J (@M12Z]0! Jbuq\Dl㓨3"aƐoFac7chV], p=!4,2bmt| Ykb7V&Cxs+P'3A/8sAX3i5ds>AG|O@Qz}5vQP@{0Y8s#YӢrNh<d5:~)PQǨfyLˌSɹAP{[14^%56ipi(ooyõ͵S9OgG֗S𴳚U{c蝥C NmdE sԒL tλu-^Xl!T$H '#֛g΅ETIxW.qROEFLF}8HcCb!fV$猀V+v=]1e ^j͸; kc9ld޺K$("Eӑ\KF.wknsu "PWsk'4O+2E ^R V WJ3ag1$;ĽQۙ*{@2&exöӴQƴw,ߨ3bX,2}ϙPshc7 bit-UEeJ6R]i75['Y3fe 6tIC\HH\ОS4hc2+}}B(߃(CgC >idGVK+۴{߳FE}E) 2$*}@v\[8e7$4vW8زD5h@'BMms 7o~gĞ% {T׆;œRq[ ė 9Vj-˜ERZ0=ň$m:|AiCO@IL*?yCU*!푀0"$7)nA8JR(o'`.a%:&=M=u4'_êzaSQ'"‰[@e|u" .~9%9j6n)r4ѣI2udްLMT'c {GcQݮM$W>\&ڽX"@#޿,6fH"N~k@w)1J&/ >͒jG,q !gg/ 838$=--OfX20] ǍKör8:qa;SP%<iԲ`'2{~Q1qmoءK&Z^:,ِZRAtgX\?TJ@Uw7qFE2`; [+ 9L8Klt5= n$08:I*DAԍ8slgeլI'W j"*&SHޮ"ob4i~PyQP\YZ"ˀzw@!ОaF6 rb_Z:V۴KVHNɹngaH|ч剘"7iQ/vef֖_-&*G ou%근J0rʜ|yvQJ2VkbPH_Dh$д=PT(4^]2ei8 zX'G z??7डzE Uj6*8^dyu@]hO{RH}HЉ6x^F 5#`Je~0Տcj IؕV;Kgq ]8sPMM(m~zBȲ<5^)oU\ 7XϢV,?/S}Yjx-M)8fV݇/%VYQsZH6xW3w> 1L8t'ˊà|8J:t9̝ϵ*:l!$rMcg?;d)!2L)?N }f]z;$i|jeu5I hSے:KQu[R@ lz=Q[*E*}nS,oWoǀJ KۑY+f3q4:٘**}q$7tw)_ΒCj/kc)\3; *(S-NteP#-|\E&$d`MZya@fC}0MԱ?0Ԙa~qna=K:'`@#wO%>G[Ojw$Z?,1L%g0LkzОCi\2yZESE}.~ )ELY[#5΂(NH ٽyftF)IOY2f0z=`f EtA2ORcIˌ)B%[skeN6d#H<X;ឤ/byVm'V !&쳫{x@+7\ JLaєDB'bp*)JO4Z6a7zMbک{6۵͋## T5&w+3r}wIj.=HY;!=\: [:X7H(t]|*0/N:MSKX'>C'Jxi`?n'FX|7p.Qhb @e %N:Ef/]eeLs/!WI֞~WtfQT߳8[u;$ʸՂ3#ܣ|;'߿,[^hSY>J[+̡6P?ke}1Ӣ*e}iQnR)1*%ƞm?Wذ {0k'ޠflËq q.l!{9{|'́g^`?ɨ\]h> =f-[ِb$='X(܂[PP6 8)Sw2z2|[9|ݢgnx|yB"tG{S9*j)L r.}Ǒ(Cг%ZKe! Ȭ>{/М }:@kI·$LDn_і?ǪccX\T[Ġ 1&3 eT MCu:q =F9f: -r~$z#MBQQ;(9vp$ ]eت@n=l -É>["a-ucHTQُk۳P厷S.n3n9%F%JYAL>BDUe4%>[owo`ЮT*NY] ʆW/TlK`b88WyiL^zeP-D0&|!R㗉UBwov?ݭEl=dS& #s$RAlo&$-ϽIBI뎅wwnۍP,5YSnвپwI^'bM-cUtʵa<BPE e Jf+vtZ${96h73t~u9~ndyTTkӚ )Se]=H dkӔqOC/rxЍQ5)*mfqQ.瀿Sꠥ%_HTt26D≿ l[Eεqem6=I=I6oW\rNN'snxm.Lk|#*;k]|'fYTA%FJFX:0Ǭ}"·Xf-u`^B)烾SO}`f a=Ra@w;;l=ˢpicb-w 8 魈 jl(`zX VezF0ux'ͳ_)7DZvv,c@zݽ8-{<;T3߃XXn' l@ '%{8p^ QɡB_|!1\4{%+G4 ݬ- oVn+wV1)E9f)H^(gEx-K2ba例4`Q A+6R6֐|¥6wc7caYX r$^[Bزc8ޯϒ/%lP.C{h!H GMc87wefLq>< 40ӅngdPǷ09mO "ٳD-CMp'PY+BA#hY&zRch*24wS2{!غȁ7ϺuYP4 #- 0V='ՠWqQsTKގDy87d^[y3 e"14~wV`RN?+lۼ4a*W*v wRǗk(n)#&G8FuXHA1a+jף%]a|kHFi O6-|R~so,CR7l9.zdJ]C >Qylu6t61w:Ð*&ad!׺&&B>4AÃy$Ggϵj$d%qUi!9wv`#|Z}YZְ?AGA[qGS쁸hH\ʳ(eG߷ùCrc*&{ r -@o4 EJi~0f0pt3C_e6q?,5m`)\fXSEZPs%٥:R\d:_6Gi5ޢj5FKu\٪s%P@̣Ł/1 `MXOBu:8=~^ >1;/ql\h4,&6i/T#.1T1BcG=5[7yhPA$q vtr㶛+>5I8LI$6>==̎ڌeơ1MڧEk]Mwqʌ~y! g5xZLIgmBO+ {evV7;qjəȢgH_3nkqSGo(-=.6jMt*X&a٦z "=?pxM!#fa"ZD>XcbdHy,@8r˟e5oN![ףBΨx# e*bU,qi`J`P?1%`Z|4$]C/tPK'MpVd\^EK(60|8Xǰ8DlPM<ɞ5Pnb'MOʈ/NQD+uiȒMrشlQ؅VLŽ.EX:+ԩz34Mv`y"$_ H=F *Z_'#$%fUyBօ74| m>/ Bv+Ւ+Ҥ˺%!9LMOHzEM5 ƯJsCɝߍ =qbN|WZ#pv2"ҖV%iƲQj%*ܲEi]6q/| cQL߷#,#1[԰jzPqZCwٚIqVf6ip@NHKM/D|حayO?yBEFl]R*#OބཕNrA[Ϋ38878eN1@x@X s:Yt}b2 1 +`gx;vy&%\쎙~TZGw>;:43^$P84/*?9b,773ӫh&@dF~d5El)Z5e#V΀z$8$=Gm`0:F|Ip]IeFm5G)^2,qIGaGhXۦ4xgV61 >)v8i(ƗYvr1Ib(#Ry@{nɨvQ}/mRVdCI{ Eubx{l҄Vs$K-<^~w'قKA}\H) "51n?Eh@uI!AgXؿOEjKD!{7q$FkW{-k_l9ퟦ̚Zx~l XBe-O|rX^e~UW+ߺw{+yC%(5&`{5>6#dYU8uK.$L,?| LCݡފtl] R)6WQܕ?z?*DF!jS$iF,$k|HtoY'=C<|ɱUdndQPgA ץj8Z%jP98z Dx'> w =s p h]I|^Xveh6j_mʐi1+1lU(EU;<N 8 A 8\y O>A-եn ?2=/G k$l䊚F2V#Vp 5Ě!yD.Kd=qD[rjl_,!uOf^l lgJDy0l]6,M4V/`ԀE/#pb>:7yd)jZp_HOᛣ ʁ 4t3i-ű(dv.F~s~5gZը!a(Pz{uXg/DϷR>8wƑ ۱Oq?4Rafv5m::$;CdaM__ 㦋q^(}8BQˣ:yA)К C(<5MFN?ā Oײ&AŇb!  +N>l#]+l/z&#., SSULB{cCZV2=kpXv`&͡j K{݇l1BLVa*`?vתT|5c*Jz(>2 ) %xmQ>2a7yDzl)1zEHfǡHSʹ]mWx uΤH 9/{qሰZ͠Kv߄Զ_&~y-Hb4ȭ6R$B3˸23f7D@<\,8C/MN`kVO"uhqf=MP4Vt5037kN,54S<5p,qCrզi$S{ȤNEORB le\7Mthʙ- YeU%cBCvKS om:-:a6Ⱦ*`eǀ?LEgEVc|T[h`U%q:HhCǿ|cYD4MkPMW4(El';W,dr)Bu!33ʲ ,bΒFRd윭!Ɖ\ɄQ#T3MtL}$5$纊*AGhDݦ>3*"/fXc#/a9ʁe_V (!i#)O{}0dd~ʧdA;g'"@.&KaґQ}GVogn%=*^e0R-Kr)IHVrfJ[tz],!WgKO6;i: k tiv%V(-Г"C4ѷ3Ub` 6'_L^#( t6 4 G Z۶ YZ