samba-dsdb-modules-4.13.10+git.236.0517d0e6bdf-3.7.12 >  A aytp9|lEBYu8n3Lzf/*T+v2{jj&$K :5 LйXmvm²W2ћF< 57=u*`XUR<Oiƒ$ޝNp>pA5(?5d1 8 J 3JPV-L- - - - !- P----uu(:u((8(9,:;>@FG-H|-I0-X`Yh\-]d-^ %b ;c d de if ll nu -v 4-w%-x&8-y&sz44445Csamba-dsdb-modules4.13.10+git.236.0517d0e6bdf3.7.12Samba LDB modulesThis package contains plugins which add Active Directory features to the LDB library.ayrs390zp393SUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxs390xln -sf /usr/lib64/samba/ldb /usr/lib64/ldb/samba /sbin/ldconfigW7Gw'gGWW''7Xh7G'7GG7Y@'8Wi@G'''77GG'ayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqayqc90b112adfc864fa433a0c67ebb4bc24f9e5d49ffc9014ce4efb98bb7f177bde28de3fdd0743dbdd450ba05b1192ac13e7ca2f5882fb516b1e2f52f2b961c4d388dbf6485321b71ed7569e837b59b6dcadd0ea5b88f5b6e527624f92b542969285a2e9b6529be5cf1ab276482684d4b46b31a1bb883c5e4a1aee744a5b4cea09cfe4e14d9df6373305b98368e756503f34308c30ceafac9945c931134c5de7ce60ce662fbf17313c2c762355b973b102976d7cfa21a970c0575ad7b1592509cbeb5fe085514eeb06d198eaa741df8960d3232809e8a94336d68dfbb1e7333276ef1a0193588dd55bc198e5bf45b987cd08ab2ce424660e080d055b083537fe0daea896681f0b32d31aa8dcc4f56cc63f6aa53e838e6fd49a4ddd3911bb395c76d06b134574b4c1dd421ca250fb852061d39576fd8e16749a255d1a001b831a2b9b83026fc57727cb3cd84e317c038733ac0837b0477db25561dfe91ff16e66556bc55b1f0a916d119db48f08b6191be9222d0fe8f58a11b5b37366e42bdb3ef230c672b6fa8df77584fe09781127796ad68e447daeab3fd3936e6d836f266ebaa486ed146cae41d843bb70e4a149de7d6b6475a6c7e1e7f01cb8cda89c37da8235059b4419dc68c622976c2081111b5fd377e5388fadf6b01d5f2d726d71c7cc5790d251ed51145282ed5eba3ca6dafab35b8e7c72f97fff5e2046bbba61391b98c55e471041f82d3db009e3908cacc8dd87df06f1c2f8461b81ea7d361dce24cf35fd7a7dfeff7acc92e8c01c02737a724741b6897b9abd1d34b41fcf7b92865f124be1a5b1e1ca6cdfe21429827689c6d12421af64df19afa03581fd591b0ea8b755b1ceca219a5b7b6b9ce77f64d2102dd5632a3be43d9ec74b31832695aefd488dc787683f3ca2df79deda00bab06e8039a527d803d27ba5140e2074b653b9157c750577baeaeb2976b01258953c01604354d00b5fb98570c7c1204e743c87ab8d517831f45fd196c3f0b20fb6780f50841c69bf3f05540d9cfdbf5db40a12f43776dc04fc08812be74b4b47d616a6d7f56f2546911bfab0fa81b9c65dcc13e104ee888d23c26cd31d68f1c04c533caaff3af6b2add5cd271beff127ba64984978d8a9b4af449c9478b8484118191d6761916473033cfbc0a4d845dcf9d204c1e8f62b4f6e8fc908acfb17f89977529a01343bcb34bac8fd2aaa3e867c18e243a1ab80aa97183ec3e302a79f00217b58ab3a21126c1e3f1d0477219e21fb7153047a398b76d6fb7fb05ba2f85c6d9931af95acb44eb29f803c8fa36660d11867be974b40dc8bae8c491114286c929ba8353c876df3983aaa838c84f7beab0f51ef30caf4d2227b0b777585c042c37fb405293646cedc98dc8cae90539cf5597f4574877f9509124f96b0f1415a79a99606a33897ad0175a8522864fdb2293be8a94bdec69f7b5b1cd515deb1d69c17836f01fb11a1c631a1fc7eba496ae6e2aa9c26b133e4d6527b699f6f07fc694834cff121b65065bdc4259c2a5b044525d99a21c8fcae8424e66c5133693294a2f242966fe020b64af6e1bd80215eda9074a26c655d03c3547137414f5e043f1adb7fb4b9a70697d674d2fc14e8e77fba2765d8e3eb3cebf2995d1de05d32c23e398c8854c614fbf861424aee588a6d214b9152d8c9c461ac801c150ce12d499f3bd55e40a545704592d963931d22e8d3f79de9d1680c6560a0758047a3698e9e2a18d1784f3bcd0af90981893962f1c4d40debfbbe8edb7bb080e978c6216f346eb88fab88fffa5e385ed89d7a3d30c23dfacfeab7f397c8860cf363057013af9c489df0df62cf53ea00566a5a9412117e2eb43a1ecab02203c717f2acea28dba08302e1c268bd0a18ee4dc1617cd37dd3469c5ce25e539f2a81f74dc5ed40d7a350d9866eabfd70b83148c9b3394e946548f6dc698ec125296eb9df70cb32aa93800c9b337f56d9a2442939fa9e9062f67cfc5358c1428e668a9e4830c014094cb8018ec7ccec3c66f125573afedarootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootsamba-4.13.10+git.236.0517d0e6bdf-3.7.12.src.rpmsamba-dsdb-modulessamba-dsdb-modules(s390-64)@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/sh/sbin/ldconfig/sbin/ldconfig/sbin/ldconfiglibMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libcli-cldap-samba4.so()(64bit)libcli-cldap-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libcrypt.so.1()(64bit)libcrypt.so.1(XCRYPT_2.0)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdsdb-module-samba4.so()(64bit)libdsdb-module-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libevents-samba4.so()(64bit)libevents-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgpgme.so.11()(64bit)libgpgme.so.11(GPGME_1.0)(64bit)libgpgme.so.11(GPGME_1.1)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libldb.so.2()(64bit)libldb.so.2(LDB_0.9.10)(64bit)libldb.so.2(LDB_0.9.12)(64bit)libldb.so.2(LDB_0.9.15)(64bit)libldb.so.2(LDB_0.9.16)(64bit)libldb.so.2(LDB_0.9.19)(64bit)libldb.so.2(LDB_0.9.22)(64bit)libldb.so.2(LDB_0.9.23)(64bit)libldb.so.2(LDB_0.9.24)(64bit)libldb.so.2(LDB_1.1.0)(64bit)libldb.so.2(LDB_1.1.2)(64bit)libldb.so.2(LDB_1.1.30)(64bit)libldb.so.2(LDB_1.1.6)(64bit)libldb.so.2(LDB_1.2.0)(64bit)libldb.so.2(LDB_1.2.2)(64bit)libldb.so.2(LDB_2.0.5)(64bit)libldb2libldbsamba-samba4.so()(64bit)libldbsamba-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libndr.so.1()(64bit)libndr.so.1(NDR_0.0.1)(64bit)libndr.so.1(NDR_0.0.4)(64bit)libndr.so.1(NDR_0.0.8)(64bit)libndr.so.1(NDR_0.2.0)(64bit)libnetif-samba4.so()(64bit)libnetif-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libsamba-credentials.so.0()(64bit)libsamba-credentials.so.0(SAMBA_CREDENTIALS_0.0.1)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libsmbpasswdparser-samba4.so()(64bit)libsmbpasswdparser-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb-wrap-samba4.so()(64bit)libtdb-wrap-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtdb.so.1(TDB_1.3.14)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtime-basic-samba4.so()(64bit)libtime-basic-samba4.so(SAMBA_4.13.10_GIT.236.0517D0E6BDF3.7.12_SUSE_OS15.0_S390X)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-ldb-ldap2.2.13.0.4-14.6.0-14.0-15.2-14.13.10+git.236.0517d0e6bdf4.14.3a9@a`v@`a@`<@`@___i_@_|\@_{ _l@_i@_d@__ @^@^^2^2^^1^^Y^J@^2@^&^&]]]])]@]@]]@]nU]nU]i]e@]_@]J@]B@] #]:\ڭ\\@\@\ \N\e\e\}@\o@\\\\\4\ @[[@[[%@[@[ @[[t[#@[[Q@[Q@[\[[[{[z@[r@[ @[WZZZZZZ`@Z@Z@ZZ@ZZ}@Z'Z@ZOZ@Z ,@Z@YY@Yo@Yo@Yo@Y@Y3YYu@Yg`Yf@Y7Y7Y, @Y"X:@X:@XXsX@X9@X@X@Xg@X,XƉX@XYXe@XX@X@X@XWXAb@X-W Wv@W$W;Wu@W#WW W@W~D@Wj}W_WYZ@WYZ@W=W(W!@WW@V3V3VV'@VՄ@VՄ@VVIV@V`Vl@V@V@V<@V<@V@VjV]VI@VG"@VG"@VG"@VG"@V(V'~@V V7@VBUYU@U@UUAUĝU@UU@Uy@UUrUq@UhTU_@USascabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/sbin/ldconfigs390zp39 1635349010  !"#$%&'()*+,-4.13.10+git.236.0517d0e6bdf-3.7.124.13.10+git.236.0517d0e6bdf-3.7.12acl.soaclread.soanr.soaudit_log.socount_attrs.sodescriptor.sodirsync.sodns_notify.sodsdb_notification.soencrypted_secrets.soextended_dn_in.soextended_dn_out.soextended_dn_store.sogroup_audit_log.soinstancetype.solazy_commit.solinked_attributes.sonew_partition.soobjectclass.soobjectclass_attrs.soobjectguid.sooperational.sopaged_results.sopartition.sopassword_hash.soranged_results.sorepl_meta_data.soresolve_oids.sorootdse.sosamba3sam.sosamba3sid.sosamba_dsdb.sosamba_secrets.sosamldb.soschema_data.soschema_load.sosecrets_tdb_sync.soshow_deleted.sosubtree_delete.sosubtree_rename.sotombstone_reanimate.sounique_object_sids.soupdate_keytab.sovlv.sowins_ldb.so/usr/lib64/samba/ldb/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:21237/SUSE_SLE-15-SP3_Update/d2f98d8ef4313516f89dded66bd0b145-samba.SUSE_SLE-15-SP3_Updatecpioxz5s390x-suse-linux  !"#$%&'()*+,ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=8cb8ba04b30278497867d6bbb71388d7eff954c1, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=76c83a354e05bc8b5d87ea7821b3dbb076d2a418, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=84bcb09c48c159b86cb84263d46cf0678badf5aa, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=5a977cb480ca31bccc81fedd883de6f93a831c2b, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=5fd7dba19419de6ce0dda8d2f8a7fdf5a1ccc1e2, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=53f4790bfe666077018731800b44cc0bb4c093ef, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=07e0f1413ad3a747d442050b0ae86e2dedee6d2d, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=6be174c69e1b04111ac3e95c8a31d6ee39538ed9, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=ae967ff6363802702069b8b46b0999bd0f7fc25f, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=e3c0fad08f1099d43cd4b72682919449851acb68, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=cf9570e5495b68e8166b859f9198723e8e7af6be, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=2a4ccecadefdb577f7e113841f5f617af40ab7b9, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=aa8af65fce7ddfdc5ed145382a5de64b8c6624e9, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=a2fba175ed9cd0165fa493945cdd598d33d4caeb, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=73d0bbb84d229922ce0d94de25e303317716b512, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=167ffb72757eac2d3161b932086ced89aac817de, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=772fc040ae0118f2f14a99c5e7bbad7fb5f99aa3, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=76308bfcde3574e8c942c863637aff7ed95c6f56, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=77e45263aad6513564bf9269d3116d6c5366ae9d, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=093639d9c4cfffb657908284e0dc1ac1171f3f27, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=30a1cf02d92689220b9319227f041010ee201572, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=abd9b2a5e98024e0f6c1610c297d3293c8486e6f, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=ff4e7c18f5c35112c2fa99a94de1a178c08a5d72, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=97854ba60a1f51e940c704f425d31b33e44422f0, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=5acde197043f11b0d34c5df62327dcfdda94b7da, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=62fc012e7acacefdad495dd349a8cbea57b8c1c7, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=9860856e8b941f3f996a3c86ea3cb1f73a917a02, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=7e8edba61d4f52497586a249cee9b524f5323df8, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=251135f0e311807ef412d144a57a9f5dc14a5690, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=499e57b2d598062aa6903833d74df72ff5c8170e, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=02bf88433e54ecce0e3b03752a8dd982ce647e4f, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=929f77671418dfa07b7bf73e39c6b200d5794ae8, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=938a8f4fe54a2455bde03b71a21a9527c936cef6, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=5815c57da8ef97ba2c3292a4fdda14bec985eebe, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=096588d79ef979cc5599ccebeefd99a3a69f1915, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=f54acae92988bf237b5546d5c866082e644cd01b, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=d136fed5e31d4cf12f9eeae60e7d80ca643518f0, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=128dae479f0343b94d86a948c4ac1e026763e80c, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=efa311bd4dcbcb68271acf5ae78c5683ff8fe7bb, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=4f065505324f91c01fbec2fb7a2f8ddb0fa9e00a, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=6b6da8c7dc93b05abf5a957a0d064cc80dadda63, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=24f07b6867446f3d7c13129754644c783888f9c3, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=f2d3a98316aa2ceeb7c66e035e71bd707349ac2e, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=b00480883871f345b6982531aa8386fccdd584a4, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, BuildID[sha1]=c3ed1cb5ed2d1c3a0ea13d0577b0f86b70866731, stripped7C`p4>F\hy@Ly ):J[h    7 % - !  RRRR?R,RVR\RdR R RER^R*R0R.RRR[R+RDR]RQRR>RUR)RcR-RR?RRRERVRXR\R^RdR R RR1R6R7R0R.RRWRDR]R>RUR[RQRcR-RRdR\R?R.R0R R R[R>RcR-RRZRRXRRR\RVR R RERFRTRRdRR0R.RRYRQR[RDRWRRSRURRcR-RRfRRRVRdRhR0R.R R RURQReRgRcR-RR?R\RRR R RERFRdRXR^R/R5R0R.RRDRRWR[R]R>RQRcR-RRARRR?R\RdRR R RER^R6R0R.RRDR]R>R@R[RQRcR-RR?RVRCRHRRRkRmRTRRdRR R R0R.RRRRBRDRRjRURSR>RQRlRcR-RR\R^RRdR R R0R.RR]R[RcR-RRERLRNR%RdRR R RAR\R0R.RR[RMRDR@RKRcR-R$RRR^R?RdR R R7R4R0R1R.RR]R>RcR-RR\RERRdR?R^R R R7R0R.RDRR[R]R>RcR-RRR\RdR?RXR^R R R4R0R1R.RR[RWR]R>RcR-RRZR\RVRRR R RXRRdRRR0R.R^RRYRQR]R[RWRRURRcR-RR^RR R R0R.RR]R-RRR R R0R.RR-RR\RERRRdR?R^RR R R;R3R0R.RRDR]R>R[RQRcR-RRdR^RRR R R0R.R]RQRcR-RRRdR?R\R R R^R0R1R.RR[R]R>RcR-RRdRR\R?R R R0R1R.RR[R>RcR-RRERdRR^R.R0R R RDRR]RcR-RR?RARRRERTRXR R RdR\R^R0R.RRR]R[RDRWR@RQR>RSRcR-RRFRERdR R R0R3R.RDRcR-RR?RRRLRVRfRdR R R RRiRhR\RRUR[ReRQRKRcRgR-RRRRXR*RoRTR#RRVR,R R R RRRERNRRRLR%R^RARRdR0R.R(R'R\RRR@RMRRDRRSR+RURWRR]R[RQR"RnR$R)RRKR&RRcR-RRdR R R R0R.RcRKR-RRRRNRVRTR?RXRAR R RdR\R^R3R;R4R/R9R0R.RGRFRERRDRRWR@RMRSR[R]R>RURQRcR-RR\R?RdR.R0R R R[R>RcR-RR?RCRRRRkRXR\RZRmRRTRRdR R RHRER^RVRR1R8R0R.RRRRBRWRDR[R]RRYRjRURRSR R>RQRlRcR-RRbRdRER\R3R.R R RXRDRWRaR[RcR-RR^RdRRVR.R0R R RR]RURcR-RR?RdRR\R R R:R.R0R2RR[R>RcR-RRdR R R0R.R2RcR-RKRRRRLRRERVR#RdR R RXR!R\R?R1R0R.R^RRRDRWR]R>RUR[RR RQR"RKRcR-RRRR^RTRdR R R0R.R?R]R>RSRQRcR-RRVRRR R R\RfRdRhR0R:R.R?RRR>RUR[ReRQRcRgR-RRR^RRdR`R.R0R R RR_RR]RcR-RRdR\RR R R0R.RR[RcR-RRdRR R R0R.RRcR-RRRdR R R0R.RRcR-RRdRR?R!R^R R R/R0R.RR]R R>RcR-RRXR\R^RdRR R R0R.RR]RWR[RcR-RRRdRRPR\R.R0R R RRR[RORRcR-RRFR^RdR R R0R3R.R]RDRcR-RRVRJRdR.R R RIRURcR-Rm]PN}qgutf-8ee8c629e7b5c3e4c12ca3675ffc6bed6e757b75aacbb420390f71ae25a183da3?7zXZ !t/^] crv9w&mA3 E[ʛh>.J #tžPʍE r\*ߤrx^yOS6tO:vcF5+ΟPE@OXzZiY:&eýPx2[ 8_.:A0&S@gڦ|:Izk hY:rMvC+%(f]d/&/!Aĥ.,P`7 QIY0F؊ -R8`M]~#sbw zaGNG"E~F@;ݖIOh.*WT!@#-' Pk\P* lC>bey\wcu8M|z Y_CC/qlaZϟC 뾟k@pf@ ՟y.nI:Ǫ^P4 /+ yGdwW +y{jIy%c&[4Kk>镬T3U>!-; @M( 9zvj'}~D GOקYы[ZՖ- 4(ˆ{թ24 @w﹵*d\CkXۧ?4U͹^ ŀK A.3 |ё%ޠ]9nt؁"N6ӥ ,۞ l໑EĖYA{>#`x3n۲RܢGzsfO2@x5/.pf 2B؟%_QRDn(Z0{`M2K+{]D/}׮1;mԵ.kI1\o5k0ˀ2Uf:sPŕTFRԄK4={= /:0[ύqƔ@tڱ7+ /ZqkЈ429S;Nr:˽\- Ycr,9ߍWe}7&Po6orت)þ`\,eFcx&‘pDVԕT C|H QBjLPXQ7ћ9Ry;p!!Iћ CfwaI5c:[A4V.HCL슠#Y 775\a1䠫F7魿!KYl4aw{ (Q37ψg=uČF{6=yTgYBx  CbJ܌3.b^U0ע.RdbD,dLv@_<{ D_diݢfWQ2GzV}v=};z+lE gpXQfSViY7;e=?aPgrgyJ( Of0^aE"lytϪ=vKgQ}}Qm6HR=Y4hGmbK*U`Ts!H5{+^!Q`nERm+~G]oASfwAw)\0͌ \%+G;)iVIK0Fx#hc0+=9K*qt@tiq碓U߷h׸7 X͢dJb؄nxf,k~tBZSU*azЇ0VKŚ(R=ewkk6Jca*po*ƛEi3lutfx99?:!G7ȌGܞ̬^ۉ߆Gʅ;sыzfЭd虦 Uq${vZYJ?c b}.ItvP:AJr !+';KaM9ሀM VtW~Zu&kͲ:Njƭ4])oz"gs T@VbM8ӄ&L~C}X-v">Dρ RLf͆eE?e/qo}pal"$GL0nr?n+j gU!p !k|4dKDk;B]d_oGSgUǐ)'zgIg*?~ n&R\b1ZNee oy3P!*s7%(%z^OjosU 8^MXPʾGmJx;nn@'ߏ'E"E*i9LnB͢QjHn0ӛ2jNVU9'v~慓A+f܀bP5!lJ/VO dQeܝ3 (0fSelr)|xNHi{L1T?G0|9UTI/aSqFhNC\)/F;|oМ0we%j-MuC<qleHظ$bstF5ڎWjRcCV<V8;- ʆWGNu'tnTfFy/ .Y"xL8"{sHHƐ*[k'J:㜫P|$ʀ;Yy^ҊXf]hqr(\c-`9>›ګ. ~=qk+H:|cw?!$}nbnŒu ׎ACD0vNUpƃ\6r)qkBfX9z"X]F(A?P|{SV8x=D#fxl`1uݞ%Uf2͕$`KTE&?Tuj* _e,,oQAX7R.ܨm;i(6ziVޜy9Lsq߾^v]ԕ:aJ^5 ~Cؖ'chz`fx(M*HT*KbOC5B9 B#Յ/r`=Vx8Ф0Zo+d>ݐ=%7q65 5L/r.>6LK]Vlj2?ۚ-t |h⨭ǘ>PRۚm֡_sBB Yb|Z:t0NEY^4ql_NɍeڣT. {͊5e#dɷ+'ڳ!`͚lT(^ؒ4D! z,Ʌ-Br_KOյcQP{ȏdc(^F@:r9Yw<^LEPțtW">pޮxeжb@vx TmkA5u99RvamiIl:HN |t4̢3@(Nmӥ믥RJ-Oxl$_73燎E2cEqƙ%<NFU(u_c,?{2l*smmS'890R6{@{NyCә ^ڍxZ"av|ⴐo-oo4Hܰ~oO/G]'ιǽYȅ;mw6=RīicTܵXr*+{ !b%=jtX"+>tȨWR]HR ,}MO#3] 70իwu.k3gUeC0oo|kIG/2 ALLmkU+q՟ɕ!gmVXf/?ZsFI:-|o\L,&vIӹ[#AGW˻I &D'|Q {̶FIUnp׳|\^D/F NNuP~=,7\spOT# vĺ  JaqS<ӦUxVְnw]5' ' klţ74$\BÒKA:9rϖjU STݹ0'[EoDxNV.* ="S=^NL] Mx(rSa?9bK_&c5n2祽{#*&,9u F9m ^ڵ~H#S=3RWe`B> >xnʯhUbZm lvBZuQԩj7|1ؑ.TlK6_%to2?NT#$^z٧li _w=b]Ҧj׳1"ʿce>9kxV?BH!ehٛ98t⤂ZǧH)-kOcKQ[n܉5:E9H+dԜHXKpDx A0t綿5=6^iq0HgIh>.붔GG2KWma&WJH,꾺AYA;_Ic&ߟҾ㘫ZX?&kD<(ۍ4D0E!LNE0٭hC2Y vgyuZ"i5 #|4R  %~%gFZlK T`ʟo2G F;I:EJ`ue0ʜrvWܦB$_W+3;Sjd3[QYPiX! F/X~pސ WmV=ުta bx,Ǜy26J A2_/Ϟ(iPdI.4>lF=qdRٱ:L*1 =66>B%18E0٭,9OC~ګ5L,8!w-jr* 3G5f}=H z&ي'SA Lq|+?|cNEnWq ɪӛ9qO}/$p *H1 as2ӏMݠK'"Nd5@-«C|bƓ^Y me=΋Mˉ7}?A9q)\3{&1v'N lz^kvϓ\dߣ*>Z 7xvg-3HooT~mxΆs&O&R8Lj/hulzu_ˆ& ^hdA9tcn_?NH%̠#@gذZSff,@iA9+}~;q I)7/9%jK0\y]4^H)fʬ+ҵ$Fڻ6QNN[("Ȗ]":N x,["1C]UӢzSyH/EP+$9ywƀX S7km:`iI3#sǖM>_8?ګ!o$|MT dMDlߛGzX«X!kcVlR~ȯUskrzF ߣ|H'apJ*qu2݊NrC`nĽi5} #aZ!N|d)j,&}:{,]JΪKaeZ_m>07p pg. NHTѽ/E&޸@݄p!ChftAŇ~wRlK(Kv_B^'@c)͠;L{4/rH`98R2MǠI?#-YT5@p>81@|X&YGK~Nj-'K*fˏdt:ޣ7l΃`)J.:+  eDȆ) "qKvK 'LotW?l}CPszg+򇈓J,$xЊ!M0j+mP e_(5j%l{ >FeZ$e?7A4] FwYQ3NqvOqmsE{v>ʾ?f#P܎RXl#Zjv(ZЀʝJv/CY}0>#joLŬ5;f7]*v$ _>b#gwgvdZ)9+kKP8͸;P֖򑵀̇A_Fh0 ԁaalC+OM q͑h V~I%JB]ED's`SP&7du:Σ:?/(PoKsYz;=o/6(;H I׬5!z-E{6Ok=qi0S9_՛!_ISVu<ቅ5Jo0٣)'dL!5UnWGYځZbuۺVp5e3]IWF{,fYUk!+n\EfGe'9zSgJ[ӂi0G5YJ8/)" 6'LuA=SM S3|>EHszΏœQѪo8Ǽ{7bN|PC޴X O^6ߍ|9QT n8@&+H)ɱޤk pk~bc{_e~yjN%c뇌N^{ݬz'M6~<lTW v n\O0+:LY9TTs_ʼnE|d>_[/0A2-D9Y\7 #IwFT0|YQm1 \p\8m?ZdTğtYp x)$3E TvfN|tD*9 b1tE:sL 1NɜmeKX{ᯪ{bWWPfi: ik1*Aզ9W-CvW|]jdZ{ZfpvQ4;Jsr#miu`MrM~C^ ?yK>;\8]j_axg@83`-ؚ $@ᏺgΙɤGr-vhnjsҖѨچ&{a,"nq)e+93^`vHԘsOw.^rSL0+aVkB^l%MK$kMoƝ\:‹^K^agWi>|P'"\Kh*dvZƖ!dD62k-c3桾/P Ņ?}il :#10lu;wKey[~Ox~pZnyک|嵩wvihθ-X$zZJ-2p_c Lj%E<lΝ00#pjJx0zsh@FC3hԔ[WKGz#1;$xul Thbcvw+ u14;Λ2B|̃`o N.mrP4/N˞';:}u h  Kk.07?_͎D.Jl xF\p}B =5\I!^],v?x'tIpXNToj~Z 6R [nn~Y-tFcV1; p}[/ DDz^R~B/l?*^UŴخdQ Y#-IT Q=y[8N]Uw/D+iq՗`mvX,S#U $[ٵ$_Qw4Zo&ۻea,Ihtc0kI ub,i_`X$p=^dpں4Wv !<{{_ɥ~Aֵk[4Ez.0op K+1bQa/EK4gϠt#@o`k ت 6fGb ʔTFW/Z,8Uݰʹ[qwGoZ>۝m8w5紡6K3U> ̧zP5!kdL H< jNH~2i)27?w|=+#r6>E#G BSZj[$|Do4b_¼E~vrG3:>Z:Ib$݈p &W biGGWf/V?+.JWY φ^6B֯ 錰RF)o)i@*4u2(ڋ4jو6 ;l6}V>FB=6 +!l1'1ĝ915 M"١C֓c>=3V ,}ǰ DD0òwROAK \dm`kͿpžhmƣi1y83 Df޼PW1墦`{”>E?oS-ٝ x6,\xv9~Ru~&p<tg~7u8Ќ2z,P}!h"Y$ z:{ix{KL ;44-KDBxn_-vGq /Qb޳ivڋՁ+2%E1 |Ar "Ы^zzergCQD\N؉}ẗ́8ĀSoͩǦgap:17pM ~ ߧ$G'˖+嬝q]l˺o\qXIjGx.sjY Y?$vRjJ]4Y,Skch/-ayʳ=x_CC/:43p&үfI_e )+ϰ޻⩼ vB͝XhfšͺW@{;rAH8"C[5p9vZ'03/&qڣ-5={ AWm..UN0@fWJ)գ3L F+ޕx(Ʊ< F?`S,oa`Qa]^hB/-M@ߔ&.Ǝ[@0LY}W{]Qe< !dJ`kzcb4>lsX%`ˆ`[z$2I1BK$cJ` M`ϩ$ހv!|p45"_DR)Vz"6A?|&ŷaNs.sCv0yMkCyrSH:Nt(@Δʻ?=S uv[IhaYhM;'_z`B~]uL$ϱFp( my_/*t'6Y =:]yfd KWeOއa>^vw*!Z&iRswHS%"LjjPb6꾜Rȅ;+K?hתy,`Wν $BOh@ ^$갈& ) 8 AzXpEHnlVgЎC:$ 3R#M=y1\aeZȚ[ *Sޫ-|DOW1.̪Sd(X nր+9:D*=G[ 3KCl6&:od%mINN8 hfxl/Xraud՛𮒦C'q<~X*؟a{$/KҲhrvh9)Q "XtTqS*ԣ W &.`A:[YrdE>ԁz=@?prH:zQx_{i,?791 p:K^G}lsoh7lXTCDۦ\G e70Ǥf8 ki? )!B}l'c y~GԚ*FE(%v\!ju֯R0hm!N[Y0<6ú,ݨ(ҿo5[»:YG֚?4-\(|{7H!q3 UV<2c7R=~/rS%Xob?kUob4EMkΞ*.ܠu1mdm;iãTik,;-p/( 6v^Y#a})|̛i.j3UFLqP!V|MÃ=Z>}֯Epdj\G&  R o?@oA'҃ޥ ?v:[J*ӄƃ{ Jιnr= @{I1j] 2."xi˷<Ϫ:h˾j .hSJ..s>58wZR_ƘG85S(5 |a.tgSg53P׼\hЗvdCciBri}KŻ$+]H꓍QߌDq8LyxPwa@ZaTYbKe.5m-B}mLiVoYx!L4 \c&JeHC_^v}"a`NA]RDI//7q{0oZ|N0&RHJ[gOh;A:JMj*G9]1 d- RIclL<+Y&6W;m|Q_}S-YK3+`zۅ ;Qfyشx۱Cv+8u {&J$!Ux꛻ܬ(peh|ڍKxMw@_7.y;DնRn{8 !;_"+!cJ-.+A?.!(݋JU?g?r!4kz-mH>lSL)&P‹S\/ڪqS'.T )٧P 1%~ǧRs^e ҞFĠmDo\WßE<ܒ3WTĢ&p)"jν_i 9.9t[=K罓ЕZ[f1LwckQ$ޞ-*c$-&r\=}KEnض=`38fnR Iij ;wvLc;V9ﮒ5Jv:ReI 8;}~?|Aki MsMCw,~A 8"" _"#hdi m&prHEMYP6&' %XIヴT/*r4jٗ"NŦ"aɱa@=,lZTJz2Y~ kgҏN}\B!)<#>OՏxu"bx~U͚H{I0%;]xsapG~5€P ͎, T֫&RVx q<{d8ӻrhS,11Xfr9OҽjP|U ҎaI|Nn̼f5xuBzVsD Vրcx_Jt<&OFz\l#crvj~)R#ӣ}~h]>4'DkNۂ~j N 6ϪP q)P[om*ͥM[2γ5x{(83ɫ"VZb@CG[eTZ**:d[ Tt2Hf$dH'tx`J .x5 `#.VzWč"RNa0JJ T 4ܐr ޡ܊T0N)cIA!>u˾ ٳGV/c9JWEг~B7_ }kkoؾl 5D UsEH*UyTO&ތ|$)9Px0* ׷ s^}.Wl \Uv_gNG_m.0Q\nUΤQw$/O RՕ {mipJDZQbZL;ubչn5~ A缵+I45RF yC!j\*KvbDܿ;޽3ѻ@s_T_c)dGrw˳bdLkϝI+I3UHٌ{k5KelK "}BXA%vUn嗻Dt!Eϒ`konh#Xu?oMk& Iߴma-G {hң7~~ ;+Oiy6Hާ&:j}4QCyrEz~`_Y8F}Lvs鷘sSkMλ*CGvVh5YyT#E~H2)EwG'BUPU>ixZM4t"&O8i,%^5S|s? H]z ƒx_Y·^`,R>̑>6aFpΊ*^UX8b̚:VEQL _yr9TF[)UE!SXgC`KnyKV)sůB*ܽ8mS[cRW8T(ZR zl]V?/Ò8 BFrk\lcT#`nz:NJbגZb=}S&|lyՋl|& |\Ji!Gwo+2iV(V˻Y8· b e=`s 6Bd6b-/  ";:͐6ai ՞y#b ~/T;EPFIr\N,%B|59v>[F"g5)7Q؇;Rm>ȥnR-HQb$G]9ɥPrh5n8slL5zRe@D|5z@7WKЏoHw9\C0^6o[r?ӫ%ʋx!B̺y:~BaY[_Y,G6.){_ EÑ&,tр.\/#ڨnyÞ4Nna, *P^XFio-7* H i4>`D= <\p 6LB#CSG|m6OZW,@t谮lq'EYYJp0|ʕ"np>i@s^Ň.=ZB!sU Ä@Lq |T\U0Z ̠l e8edllTw3ESI[DzRLӨ*~hX1k ucحW B?/Wa|hTāEVIJٜ'Yt=?HA.B nxvbGL]JR}1٫b.yAY+DfX4Gd|?l 6+emnvRe8yqYJ<ިǸ wLՓa w{x9۩ui -Md~mJ,OqV)[6Nz莮'[ѴxX?J~\(Qx%pEA/k ssxF5KgDY1,&Qc\gqp;r7po[wNB>8Dmnđ ( 7k'n A.[t`c4A;B Ȯwӹ.',(J V/d$rK*O?F (+&$dp h?1J]EAn傟&:W\<]ɴh"y!ڔ­Z^){ʣ&~VV:vFV)K a158Vqz (dF+@D(2*fqC&~ʷ ;(mL}BkةF|\E(FiXPՖ&s#f~=RNX/99oo.슑Cj@A(HM? K5ߚ bh()X-8*%כo<)}z,->+niSŧkmlJdXnSq^Oit~XU+O&O ˿:gAFAOhU v ~QV,Jam",5y hՑx~U=n 6 x'즓 C?D89?5vomՕV)ZP1[DS \8-f?&e4E[LWgBW9ʡp(SX, chLI4u2J+ׁW*4E퇯Њ{ ]/AKK[>.Ro80sEb2ǑlC"5[5%GA1o qw{@-Vl5 5Ԯ5ǿ?ln@D_ճ++g%?]3pzT_Q@-6Ç{l-ZE+i;٘|[&#Zj=I$B'IτOWinPJo$V >#,˞2*':7;ׄR1F`Z5!cg32=5>Q [ pRĄ&ԏTlhrD }P(q=F(.'k dx@xxX xK+YmEboRY״+pwPE@m#.jПpATǴ4WvJd<{Qyl>b 0nLVyXM?ppJh.HOǽx Ϥ)z~9/BhK_^[9<,]uȣ6c9b0E0U,d=LmyՌNJpWeiR.lF/,ױa2N'Jh*ī#ML ` Җ|lelW˘Qp\|%ϭ)d@'y3mV7D{țK>D7Zݫ! Ƭrwri:_:_;n,J]c_NFf 3rR]嬅):DVd~ tl%O|_dIyY_6]\_N'~yOi*&y#]aע}MIpʊcd!_s1EZZ59QpV5#D>hC4*j$!0h>`_k) = ܕ_׊:Kgf/ .߮.N݂Zga8jh)*oOJϕO0}ێ4u[}VG#X! Q-=+e\Ibi&:0O#50$ݴ יmbLaV:emx3SɹcR&Cբ Sgj/`>nQ^bszcگ,,Ļr+l=: Lt4M_z$urW yX BӎUT:m=,֍+SS)NR].fv{4LfqGgI'4 繖З9[1z#%8sA=XoL?:OX*򐘐e(K Y-dL%NǿF}Һc5pB63.~VeyGerlx/a"{o\8BGl܂a:pLZwȎ*9o-"s'Dw v0ɷַ5+3H^H;q!;KGHib`bȝkK)ƒ\7agQ>)zB= }kg~@+o2U><\Ρ2|H'=I("42  },Jx}h7&n4zcEd,u猸2$GEOi yy]v"T0渚|jJ~yjrǦv4NA\rgPE͞NGF 9ڄۖV!U5Uպ`wi@Jػ-p#o.h INT ށ\Ī7r}·eLM`zr&1$vGыk9`TyX;!P2i*w) W9yCo6 ̏ =q_&$tp*jOo`0_TLI kbl{ϳTMawM>ԼνWI~?Ma/ z\.rK+7^Z :\ =}V=y!ʭ: !O0sM1ZX7Ԙ#1UY~ro.C4IS3qX-yD·Qn\tch0Q’j TƫLLۉ\+ѝ)A'wDQkpC# @L⠗4/ JjՈ-3hz+f9[ӕF:FŁX)S$"R C@WZ$KJz FoY\!ǸP&%uH>œ fM{,v&?-\S V[N_9yc.2yGȔ_{M\=Q^21/$ #-L|R>TMt:@g^6s8A{S(?<.'ZjVPg 9&UGoN2P[c>ZY Ո%18 (˧bua6J}.'`|矎x3`q"t#:M}#P,;6}.)(>}K29NwzzAI=aGrGE gf"s ű3oô'jivjJf<% ]/϶83ח.mNJ%|/Ԅ!7'B?BĖ.ѵ@{٬~⋳`2DV $_Cwd[{CŸ!"h''+gwuFGE@ዾ.XS0(`4C#iP5eBR օ~* IU?px K坓Ȍ:guBּ /F!D]X{DikJλd7  :Ȉ(;@GB'ъb Y4sR"ha"r{a5^i\BSnKxۛ0VBzR:Vڏjg+M1TgVEdcwtwݵ,߷1@b>|qGK`{dz;V1ՒѵJ;[E|a#q҈6&k+$lmźG]aJò,rI#6a7&/gÊߥ紿 @P!mc(Aa1 ɻ@ރ-Z͚[ZC͵v?cmZW##@@7oD)\Wv Nvqs;'k{xZ_R0tHVbzbGn=-L[6dEbW(xa>(Õ@Eꝉ_PBX3)U8$459c8 S0u"_x;!g,ǴÆ^` bjcrjZ6''b%\,$jK7C^?,xx\u>^?tF[l/~p۞ԇ+ pΣ[şt <\yG \O3̌Z} %߆~yLmí<ÞW|M+*[=)H Rx"Pi;/O&Tq~ 3L#- 7t@꡺vn#H6I5J%q ib\;=/(ǟ ȻQa#V<ڲ|)!揹ƺ -{)a6-kG~Ѣ$QPLB4$) HKfA)5~<JJOFnɪ#皅i؁v#lܒXU{&E})5WU_vcg t$jg%ݠ垉圻yGOdmNÏxh|vQ,q\hM Q_s z^ Xkɨs zSM2rs [,3_u?.78蓀es9ԇ߰,򮰯 1Xk0 帼(wWA_5%BPLc"grVqf \6C\z4SHYq:%@ޮ\x=A/4L;^̡+-s"LZ𔍉 g2ڥA(C#$ؚ/Hؾ"ɳv{j\joJ t*Ɠ'oH\|HeM;+ 7R0R%9{-v>LP 4% dߣ){IJY;xzf?˖Ҿ7 rs}F]8mpl BîKzjni;3*Ǵ 9Yyӫ 0U0f$ō7nm.vOcL2r)`:HW sKO*M\a Ɉ Pv%ݑnӔ]e Z"#q 4C {C4KqBo_J' *콨K^/}KH"ڻV#| H;AG~WB\e*XB[Kscȫ|1`foE` BC/t=xÞa厸a8~ l@1<1J[ӭF4x#6;<9ǩhGo2 G=ZuZ8dڷq793Уҫ+Xt/bLH(CZyi<ﴐ[~_ڱBgQt:R_w&:,}m6e)VԁzK3) ꨝJ)x]2*0~.Z')]9$%D{0;H>i+Z]Z1"Gn4:ƍLPYReM,qtG_gljo4W¨iuriuv={YC'h`i֜~tzfΠ:GA-\ hj&ܔY_ psNR ΋~gAN(}FԬN3svX1`_3.zһ9 /%b6 F SksO*-̣hv"YMW(72:*U\Ӻ;,\(:I5:S`C wtuDן/fʌg2@~7܉~k:w7`zo9rixC^PX?ဈ0o[Oz[bQg癭EmI;~]\ 7V< bCSێ\{};SAB~5.Bt4勢oaw. ^Jlp0(ԏ;))nc4/EA8,#HnLS !L'ߵv{[3\XgWqej"e7TF+XAezE3X.h 5s\<E*&*ߒj*?(ԣ;(AOEcו"o N4vH`ↈ8ۉ/2猀L9fck ǀ覀"i6WpVoLfˬ<{v57-J*T>JjpN=ԑ 7M-S ۮϼ`C6͂˖sK І1={7<9%):b "/7mB1OgK,6axT?).?>7u_U d讁.g`q̊{n8Z`܃"Ρ8M+hr%kN*m)ZTsj%ҧ5Lܛmj) J&06DdC gӇ<0˜.54oBmdW}E)ߒ}`B)s2rQdT";$>􉬀xP.0\uAd@$~Bdi~sA*:j&R;QuziF@eoAL%K _Sog.s8l?9 oĢOd,n-*`ms"Xb)*,zK6^['U[ V^Msfu ).Q?R=7P˽vtF^dܚbsq! )pc»HI;# 1 M;$y<3|>+%٤% cϹ`Gp`V\Ī^Oa2Z/!Ó5)Nvcw7M>c?pET+n"[tX*@}"xK=Z{M .JD}z1j}=-_Tޱ!8%|3H]Y){b2df ^o뒸eW `Vɰ>#`B/QgQdX.̌aRbp0h]У?H?x jI2Y/*@'BfWH+ӓz'z&1[jHASo^c|ܭO :'u )N? çxmK޳_"70ZLs0>BΘQ 0i#mf&g]Ly+ Eo)] 70?gL8v.LY=PLn;!3GTr MVdӄ=I u?u\'5F`x&-%09< Kuޜ*f$1tk @cu捆ӻyas&ZWcg⦃sU*W̉wǜ6y7]_ \%)ΊnlδxxI\ŕY{k3G!+9.Rj^W$Fn z&ψnUAq2` پ9o4 mm }goe\wc…@{u=Q @1 '%Ll3ȰC=bDʽZA8ڧ9fQ "!K̻g~9%bz۶D8^t?i9QTBkƈ%*sc )Nd0qkOJM_ӖpLB-IUx}b3qz Pmۿb20\Y΂[YͺHcݔxj={YdG*"?Z2AH$ʟlťJf2VTOR@7{*)yAۘOb,vHKMacpvxGfa8Y" ( RzUmf68:N$hAJ675Q+/F+?= x;xE1J{}g5*f#ƺAC.7] + &⁳l1.\ iM^5;;>> ]>`7cO MޡvSرM5 ש p3)ͷ-B;D֨جPfڬz2E6e:Bә2!F#Gڃ: ԐA- >\@6Su(0"9a34zeͯ-&2gGpRA=LCƒ'PIa};̥3`=0Ƕi 6HIWn3@@.je*DY֢$/"Rʾ(gcqG'%εz  kft@Z"l[-d ]iWD(b뭠wA)N)'TةQr㻱P6g| b<>H崙:#;y#7}q@.OW,FΆ™#iC+$^TIؖ𔍕OG䆡;T* [ |p{|4Dg #zn$X'RyNF"*%" _'z7+&^ϟh. Q(;ZL.-Z9TNqP8ӥt@+B簄m҆){󋈱$C&v`} UaK;ÑVVa\%[Y㝺ʳZ|qui8SP7xnոqvUNiD#Ma!5TRǦ괍7.A:MR<+Lٶ{ہ+`'8hw9Fn"T6?Ij.fK3#*0ƶՈkrc'"Djp"i8IVCHVb4h=bHmRU[VoR =1*eHQcA9/.C'Pe]ǒ |C vҀ'=d~Fb&*7X]FY/jnt3NpvIr[bU򀄊FĶoQ`G{w/P1wm6U3_:E ջFucU x'T-CkU#Û d( 71*inNģ+ig鉖&v۫6E)7a^iցͷ^<^]fp`w'D|E;1P v _]d_t*yjCԩbSvC,*eQV19$!줱e 4qlnDzla8*豝؜dg'NIzsN*$)&˕kBq(`H῕<݇JZ;1OAk1/8'lݨw~sO,{),8)wR"y|MvP嗼wpsm.(fjljQwHCh+q}o]!EKFr&CT䊯l&F ̞*u+>yiHH~-0[*Oa#里u#3)^i.0䝱Y {XIΛ ԹcN>/OAAlIe$Ye #$a߬a|sY]#9= 4t#&"x̫G<k40kݿ"$ I'5~ɀG{_ZC[eES@4f"cs̳HVI|ZEc@pW]E(@bP-CPڃ%=MmOc\o"_9\^J54?Vf{t'-I3/!AOW㭥=..+4gӃD- g;fhN %THe/#N25^ɥ#Dw}PIgC%0H4EI4ׇ":Jv[f:ۢ 8~a?=i*;H =iW)I|< bDǵPal(0a.XxsvK]a99''ǖ`\\r6n9v UT_r8ԠoKlMӝ>#Dk=yr~l%E7NṎp51i=e :UCSe(h.UQ*uns{\Պm39 !j(QN Ԓi'hCfݘWn/UW )ك$,54`3 9G3jF|^J>;jƬhdY1.AGoݡӨ,7"/# fB;3c"ne HbS`D2$ V6}yduvҞdH20+5= ޛ 2_ g 6 4x)޷Pmk>Lm_8>cE!Z(SF%e<ϬJZknF(g+4 69uOu=:"$`[[o}֟l7b5EٴCσdYC|w3oJKc5 `li)j Z煣YxM*/pKuH1Hf#:+(lLr;ZPDx`:Jr%n. L2m@WTY#?9m=nZfF֖S*"v]m  k! O+V̥ l2L3)MRZ,^¢Mͽ\5HwEN*q.,:H^ؙkd>X^+JʦM-čFw*RFӤJx>[KtD*kS2}>֟y>F?fÃ!e0R6mD1%uiJ?1,98oxPOf Ng_a? QhS,`jX RESBqptFT 76[|N =oGsV3ڇM;# ,b\=n6OaV.u1CuO^ƐvG|q IR7Uc|=_?7<i]` < Ce ԛK̼*OcCX'>U[`pJ^Qk&X!jB?4}M^zK6h.`+^) 4KO=) ! $zIHŘz?5$x͈,M1vٰߏ>%2~Y HN`o-wS7S8pۖ@4]DFL@5ϖ)LC~9ae7ڀrFnЏ~̿$ @TD=sxt~iWg<銬Β^+#MK\=XN ¥![MT@ٔ n +Ry 3sRifHj|Ih./}ۘ;o~c+[Ͻ^ ֒-&ݶ: DJ6]~s8WE ZQkG71k:E/ZbR8.{ADI\sXxShãXf۾Z7PQ= FX [sI F)cۢ%??v Gc:׃(xUWk6nJ~-LYLm3n%I!wM1bN5My*+U߅ƧL z3<"NiTy2IUG)ˁyVhŧ`ubp9*V `5*RE]䂞?<@X9'",E$dMQOC2عۨd@`=!*h+m!ʨTQlD?6ʷw܊Iƀ̄u*DR4V`K+E?T^ yiQ E2T=暡EՐ $<,nEd^]G ^*u߰Wt*~YΗjqF Pj3'f;92t[/w"N6-#Լ:!F]EE:NDg d\\Q)hMr½? J{ٓ{);;Eɢ;.{xc$Y4EsƒLn B9 oKDy '!dFvAMt:_Ilߌv.:"ot}#x&nܢܗ> 7֮44d(uq~`p6hVWrzP,^Q=Y1(w f90p[ Q'x7E5<1쟆G8E]=epѲaMz_v s!9kB^f̹m2oou39[[}%[kMK CT0['$@hylw L&n4'iYڄ8DX36]!dSb\jH ~-1WU蔷SK}R(N D~hp q&SE@NeV\lUrDKOzVKx) KpcsuĻU*d-𠱗ױ*oz0/|\7#iOJ ?O_xʋ`S1s]$[?SjM l9,/hSE.dMg%r1YFݼ=ݐqj4I)թy"UnD1SUED߹~ ع)3`[wv\YϺ ,ALAI|MAm'R~^NTp"R_p_Q q8%EP+fF^ֆu'6NFWb|YX11U uvu"YhǍNgL_[6^P|ud.ó*WMaysp1\Dg0yЈK6@\.*]LXȢ3=tL^cb'(;]-ENMr43_>]Ue Zk>QiWaC+`mXL2!wY{;dbFh&U0lF,ab@Sli@gX,q 'tEǽ3)Q_·ES}r;ѠOE Ѓj+I~j=SVOZ"ź5}G;ȧ,](=:<"Z opk.>ˈޠwPb#^|x?Lpày<= kZ(?̞`kId Oǀ1 H;V@iEi#ȟw1[ ygJw`0ŮەlL;7O=9BKN/6[RUg qg, F'`^ +~āz=VQȚsaTN4(倓U0+ ӄڨˀX#Nt"g[J>b_e0*! "GqGU Gմ>E [ E[+8E_msۄ?)NyY1lE_%jΔ5a?F\17@uAo-_탫2^PKW@u@V4x ykUXf.Rݴ9Uܟ!G`d .fܥ'_L`7K8]&~cƤ=R+[񸌺;8;z ĵ6 7cFM 볙T]sbҘ@PW  *Eb?~q8j2,$69m:f>bm-[=VTyeSߩ"`CqzUNt]r3~HBa 5 "8Vx ]Ѿ70_h3Ͱu"ͤĦ6a765ٜ\q>C ^G}t'8(&׈8Ts%j+S AO1BaaK{' sbɍ2o.8U*͝ASN e~Ɨ mYóX_'Ǝ r.]U~QS;/Dc8@.煦zԧg>`Irp)%o5Ob# Y.x Ld=î ? ff94:Gr ٳ0>D@]ʹOovJ3m5T*[& \bs " >1P "oT* ;"jKTX&9 L*i1kqCHT}&\޳d;uz9w\"*p>~9՘ͥNT^@Rڮ9`3J @a5ak*\[gm$MS-%ScP_'0fΗZHOҖ*|-)gxsO޳w :S!#ܻHyn5P) Og׹n'A KƬ[E)zm [O@vRgFG-?%t@сEͺ$$qMEj+bSF}ʓMOp]2uz>GK,q G :OBFulK9?uH#Y椅FetEXC]@e~=ʴעx?6W;bFTz KjǨ }TK}5a~rR-J\B晘W@֟{/̚#Ǹ rK> CF߼r1߻b\Q jaMԖ~|"9'>h&߬[v :^9*`s2qM| Un=p.3~4Tt&FuްC̀rj4}xup }ge\&]]^E di.Z9W=,fo>kY킫jಬq%]z K!ci\~J̏>ܠJX;qlП~5-) z i$e(haP^!6iԾ Ax>NwF/~/!H*58+[48Fv-n'-PԒw[]n,QD)n㴑 5'7Xp V0+ć]6q蝺2ԫtv8)<_ Hq&+yAeNt>"0Cm%i!Ulz%dxhJTc:8B逊&$ў<@+7Ю:G8($6l 4Yg0gSS5\)y&]j'<0T'220o4IY;*pў9 pOJ|zLG'Oe<{1:B0\.3씘CL= SL5[uXtaXtP2FܗGCM]mcg}rϠbRLf -,`2)=7wp!Gǖᅿ=hj'%>FOՏcb:Ncܺa+(n|xh&C^붶*;jE9ݎ`eik!)ct(ZPԛc!z-j Q)19>\i'x&X0qbt{puGηw.J%;~uH}\os,]lE߲]0^\u+sY@[3iҰ~^o\UYw E`rM%mOms^쏩/Wl,; 3Լ&nN*cl\ lmXFNQĹ"6!,ZS)ǂWz[ƁhPЂCJEj R`[e1EQǻJ9}d 8SICԘ .J ӾX8xB+e 1 2B@pM1mM,S޸kn6#HM:c'4"kQj lv:4S]nNhL-,G劅G3߃¢Kax^K)c鮩Iof/#ȠX'ϒ]Mc+bL7+2J&K)|t&PAwILasM$0XtK/:f|InӋj|])/M E'FдUz7p=Ls=xޏb qO ζļBQnU{'V9$*ZfN2VB4Dfwxǘ,ȎsS]iSl򃍹q24Nd; oO紣OIs$+j? G+(7žs%1ә8f2+Z 4~wN5}Ր9 $H#;T!r3OOp~| WtmC4p21݇T! lHnѵa]}@GT'/=cipDˣƾ5oTYus!xm@>E_5/q驒 rX('myek7s.!f"Z҄PwrY*Øc`UO&Խ%V'Q yqҖnֲBlzUU]}}Mc6ޢoNaOTx)JՂTX.:v]&Ѧ'gyMǰ!fƫ$oJ;:N!>`53; bG)Mcč*l3R ;VBM fšxA43 B-G@پ5]}p܇FmzqFhרUY}\0ǒIJF08 N!IgG\1hۡA0NW{ex/ 8%OJ2Vᬞp=Q/؈h1O!gKo˘oZ'@ԐrzCUB?pŽ@jE<|hrgɟ5)PAY M=37qz#`Gh>qr6 HMP 6}P.:l([ƴܛNx8An[Z&R@KC˔fA|j',-Lޱ19: MJ#ķҵI5n6WS@VJM0_Ox7;ȽQ2i;+/3b&G\<-#_,79y7ٸ.T!bUٞ ~fk~!cUuUDrCR  \Qa'cfs<=;R(ԳM<O*?LwTm-uCIKj7tSJWjׇ*x"PE# 8po:h)nOY_SL,+(0Ii$m#J/4[1jX#9&PwڨX'ȏDF8iO1׭#h ZYB Ǒ@^ܨ?6k9t$KH<|N"wpNb 19՘zj.}U=c wi q)]&<ܠn},yCzgZGê8cL@N8upK۵.@r7-[Z` s*r։W| K,@"+,GUq@,.tLM Z[Nڀ7$Gv!ܸW-kp0(8FG W_bʟ'-IfNu^$'Gh\NF0TV{L^lQyf6,9`c`4gҴ'^zNJ̝W|NI԰Tv b&i ?-`y㪾['XGK<\-(ÜGàK6ŋjDm/BR9eCRYVAYgO7h56ǧPGm|>gJHxל yN@*-wV$wc\x]P:r724B DXJ'>^_1X+X"{pz{NC +UE(_C6r^$&%'z.!fnblp 405PB:hYVXӟĚݛu+pr~$= #\E]O3(ڪ 8(QHbpi=FJ &nўSN67el5 3Io^r2vg9 "%әFsH7Shez3/Iz@daq`r2jOuDpXdIN9ӥٶϻuLl? oְxR9&;M35ںVd{:byH *84 l~yD&6J~R,-n7}~[T9!("Sׂ[! ÅFaZ/_J빒6k)XJB\z$vӚ(\fJhpD:F^c _z ax>؎/B&3̫j}PcZ 4@KQf U*N3 =1|F:"qm\3ܔ].).2TZd!kN?hk\tև&nT?Tr=!8̓(X[Z/(4ގ0m9[/ ~#7zڗ 諭CJ9]ʀ0˦zAN<:TB j>ݖ+UEa1}rgV i4(ͯr?c8U!'ܕ5-PcHzHRpH'V?_#{AcEd}xê_[] qm 1";FG=ӧP+m`B27duX3B\c1gOq|pD`!LʐmpH6J {HLEw֝g-DgP0Ɩo9Ϲjke85F(ll\*մ"S{GMO24f`uvT<5Ձ[bKap@{mndB4޴f]qN U4'BLaudToW @5?WUx%g-x16rT)K=47t~CC 6CE*IJ|+Y!VZo~K9lD̍~,qAi̼QD$u,ˋ:uM` 35/O7Mr<͜L*{ S[[ହ\j–0%VPsL{=@0"ոᶬ,ggrn6#1Y :q:PϬ<,oL j/;ک8AaPȞkFпND/deE(L"`xR6=nS['wn#z-hSZbwĶ|Vx$pH /W\:n=1fԖ"Q[I\).WQ|h Xϩ_tL]W`I[FݧўZ:FӦ1@XڅޤĈk&/ghrS$  ;/>Up[u`q } M>. =PŁV facgj٘DfUimm4kx| ]7aH0wAWu!A!"}!5س*vv5..4Ɉ%B52M9{(圅 }25yNu E63utKurΘYK_(| /nwmo+4;4 >?C Ѻ((Zwsh'p1lET7cpbbg?s5.t =~ջn>v ^@>F~&f^vviDo%_"Ϧc`$,ƹl3rvu3/*)RR]3 µ;UZɍu,R8 鼽@~dm|@~z7w&_ʣ,1hЃ!ѥjz8 FmG@4C5E(upA\BHku6fK[d[ԬpJw/އkLɴr~f('i|`\\kc([.)>M')m)إ?[$w+P8CVxXc AL Cl ;|*flNOIݞUdc8J gc=sB|C)N4igGG1nIs?m4զ?o?dG7 !a7vި9`yp**5?oXwBZGF{sP̵.vsäCաKMmUi<7A%]L(K Tb>ֲ`@bԀ_GOO҄?E/3DÉA~ h NSHoϮhJgi lúXOr{hkm72/f'D{'%9Y|{2C)Aq2HRޡ=PlRmf'f.Z8H!d_:8*5vt$>c-JdR-HZ~g,}'-k`H9GQQ t'9+u='HqN^lVOum>뫃Bφxms=o4`W AW(Ӓ|#! '4`}U&#RGy)IC #jSKFuk*YI+u /X)+Q-8jkDS1;V%EErmKQjMnwOL ]sGM2OlUnBmal˹Ff6UkZ2ڤbexIy1`fpHt);2J蹍jT,>CE}e=d#!@#.L4Y?׊HIĴ!lC'O'7Hkb>Qj&::EuZJhi{ t8I ;󪡹D9)/@,̀@V1Kba-$w5j)LIJRhkJdA'` |d[sw ANoa E0ZxE|^f/A4̣0cFx.,"UIP+S o\r'"ƱnVN<%^Xsjƚݾ-EdӧoLaU\eZYqfGT-8%VPhaE}؞s 1 ӔdCw"LЕlk(}+dpfϾ;!$?x]@;P>(2 y՝ eQP,%&"߄uuCy HXq-2A\(-@!<񫍛%[t.X"8S2'H3 +[<)6ֻk볱l -mАf@Ha2j -u~rOq8:=F¦pRҿVꆪS_sJv 0@RΫ)NH9J#L̻Ōjy#I~ڻ-FƑx9C:Ҭέ8CĊ\5{ OM~4=| `ɀx lbk*3U(P8?/>  I+83ޱR°enܚZ,P4 /ם➍\x7YͫBIZO~[ڀѴi]5n9ceqC,c;iȕ )\RGw]x7-nȴSf=t{QT<1}90גKߟHu3qJy`&U+{-|CI ذ;׬d.7Ⱥ{UVlUjeJs7WS* \ "x+l4laنT k!:{NZ.@=~Wasxz6XU1,f[U 9Ȃo7}S-IK'/ m뙵8A /*$թ.1II [.#hfGS^̟2%w2ވߕeoj?bU^Qt8xOʴETzɲ S,yV ͂KmŪfGwɋ|Yq9džU&H`S@-4^f1A%-x7فG `+/a:8+e>c^h,梊8{S^:Fx#oҍ&j;7IQ$Zܿ5jb'̷ `.idnPbC`ɶȳݟvQdZ pq>!;0 yX M~ԕj:ӑ:BL_2F%U6k]znGL<|^o HkЎ/}6Q^PtωK0Lċ+ W->n2HǷ:@Vž7(XK6gZ'o|3:4Boʪ]H8G4r6R OC,âBUHNbaNX<Ʊ@Dⶦu:f>lK#αW$4N-W6&c͵N)ve񥥧O`&ycJ |W xL}jpwpڢٶ[Z>*Ҟnt_E~2H"aY=eLPȸ@V__ʰ2B F?Uo1T>mqSP$lZ]]]EVpZ=1b CqЪx'̢ -oOBfiE3\i3>Eѥh~>*meAGumUGP,c ULzUXؼ@OK '`O{d gÏ,>^+_ sLU p: 'z(w}2 ( ƞoӰ{ ;B~|L&?S-n'u~ _z'NONp0{i:ھD ac_],.TOZ(kCWCk-l>=#uR10~",P{&kd:o\٦RH?CZq V*>F{,lX6݂ 0u-jR5Op5k++LqlPss>Lص9;dD!쑓K?(s;* .F be"QJ$!٢w^&=ME鱎C4o_H›K(b.Fыr0S:^#4/ffeӤCk*+osquEtMO Uy8ZuRvGgַwL(glѿ XelV}:$Bޖg6N<"<\LUq8^69.P]T] 2UZVG׼kmȉijȤR;cNpnzD}UnO`} /ٌ<NLۑ}q< &I56э:T-nݎJĸeCZ0s k !a?3Լ}Y]1i%a~Rb<$K&0dqTĔGD:W}]U$ц>LU8HsbҕxCBB9^4ה(BXW VrU++WrQٽNk1WYtYʕ2C1I$%نn#v5/ެJ2>Xr4vsWiW9_7?{߉xrFoNˆ~*$SKA?r͠}T֓)X%jFZ޽>-9 q" ~KvB"&e uWW(s jf:R }c?gi`Y$<}ZOA3ܱo@+2D;5Z7rL0-*m0nuha>GuZ* М# S@t;%h&wԿ|ɶÁQV1=?3ӿ7H/+$Ѵo+-6z5KЯKxl`|%`|β ƀ`rƉ#ӎq\~d(܈.r!*>) E9ިav9jZ}b;%I箏7S秷U<|p'WKrĕ:ܰwc! \>A6]2$GĀUQ-.69E7ЊE@1~'5\ƛ-oCGSABI2l!_8=.gЌj螑+cJDdFkTeB2IфA=W D[I>ס~Q!T |!,XJwkQoQ nxm羒'!ݮ"==d% [Lg!IV]sjvI=am!8̇A@{8rVau RpT8eA$ڬ:"( F`[D"E YCn}`KF4pK&j0$Ҩr#]P\/KaΔ Gy-d_BB:>I`R`loS zRJynIy夔h(7XQҠwaaM(3zkp?tĝ,=<"z4Ry@E ./سL17̕(~o_kMKRˆᚸWXK9i?6h| F!-$O? 3|V JEjtPq`@@Y(eN2Q yaͧK Lz( iRbQ%"\Cm.:<ɧkkKނaQEૺ݇bb 43] zɩTWU@"3&< l3K3" z ǢsuY ik_YšFCMk`ÐK{5j̿4qU|RdO%缜4 "KmL WCN Z`5&O`|.}%J}{-k;杕hj9n䍤ݝ3uq x%!ٸm L3@.iB2[3 o|\Qb{{'nfKS$;a1k H[(a5AC PSh-7\c74WX#i1(f<_'_~//.<_yU"W{=Z8%<kY"wz$p2Q~BAsq ,TϺv 'h%fr3k7@!0QΌy6Č<,e0p򝵗o3Pi|2; `]i`f4<27 X|"ei?f[#CHc:lk"l6@Q EYm/j`;dB9H+۾J \L\\U\\<&*揀~;w\MG5I9kuYu鵕۠bu, Sשl8AuuMtK xe#K`tC7"(׻$Y$s%|O.H{(3ȉSH%/m"Za}C"fC*пO6}лRiB$y=')F}[y_lLZ=DlE)ϓ\x R|XBcOz5ޠ3ajFn.S> UrS;vX`{eX σoXUeݴDz[//&<:αᱺ Г)"ұ}b=yQ/ R. ùbc&(>L$6}_E9UCA5(-p6%qq׊T޶ˇ~Pes&1@>Ŧfӂ=xzy:xfĄEY[ӈ`g\ae)miG-9&'ƠQW9+LIvR%!cc^ ޭq'O?#%fN^"'L}WaW%y^LII(u:<^ YN ^5y}U~EG+T/K|{*H@Y!v+CcuE$AqzNb l0 c=*4jE%0>,Vl\rўkhsɤ2yˡ=Bj6ֽmhHvOkbZ킼; \Ϻ6(U:'؇.&P/R|L&P.)pFx6hnX;˒ e͝dzRnlNOxC{"Fm:a\H%Ο!|@O6?NY=Pg.F&C((GlJ k֜۲5ݤlCJ3Ug{abm)[ECm.!nX4S LcTj\2sR)4-NrBB);mu O-Ξvms.h0Søu|3I܅. H|_ + G$] 0r>wmO!@7mD*8l?q%\s&͜d[4 cX&: 9QmIU=/[n~Wq3kYnC״ڰ>kE*T|&/L{>`1k2=:szc e(QmZ/NJ/8e}~&]׫TDK&F2SË_9lLLkKK`9FW*g ^Bճ`#:3558pE8V ׫e #rʋjC&FXPCY7"B=%bބ[PEkٷ߫ `݋̈́لL5LW¡)+m0ӈZE?.aNf2_i_ v8_ď%vS.dHv5*$P-D4e<&V%Kb5!.=!Sz4sƙfme6XdJqfD~rY:o,;{(wIiAy}ͅgԺLAxX;}Pϭ[; x` P=[\۫#6N=nI`r2}|nFi],y)sU7e㭚^pی&Ni MYt4-4O i!! :5>vkn5`)k׬t{\ECaa߹^>zB{OHj86f_o[Nv+ŧѥDəH^|$x O8G'#IHk܇(M.`‚O !`__kXI7,tʥT֏0 ³IRt:"l(uڌiSXL*߬26_JmΙ"Q7{m1W1q6[)Zt| eI#˷{sl]IJkuUEVCc?M.^S"CKvk@^ af2)8C|T% ѭKDMέx;婿+N$نJsn}'n.& o١픊V7.}`'U_%urzyz~1Ͳ{ccg%c b $w,/x Cd~CUl8Bz<ۅA sm/gRCSdqc$xϺR<;(ac%svvq"]fkc6s2,,hQgWƄvJ9!;jw]<okhIN"p t&a 6`r&)U ys/ZRE.]蝷"ޜ !,ι!,rvod;Ͼl]䫽x9 rou~o I7 3dt7[kG%qFRˍydJߨt3zL1zW O7$M@(R'=i҈z5G|t So^x)H‰L}zCSDmYշW[ƥecVn4!|ZLA(p<}f.H-2i7l! X-b!-{.< F6U(NV%,yQ].W!LI8`W7[OJ`EMMUS[H7^{OIqD*XJ&'xm l04e?nq a+<kƭR5 tdol#/*L;wC SOJB-!jD\PhGJK4Njju"g[9!L >?W-NpX,_ *!_vI-W?R^[:ɮ^xG,v!'R7'kȒ znEfi_qr ңE1ŋXM)sO_:) ]Sd2T#ybXʙGJc9QXB>W"K/7c(F'Db ?b!:A]MZr YOxXezg{biX*?&zS9!4c>xK,o`7R͉=L8tk~-5M{)+J.xJtu0l;ˋt_85[ڏ*b2/? f]0g~n& n 5<z k.I,-\rN"$X&##WӁe '6A%>毗_M+-Mܧp-pcRJTk쭶@9AF 49X{RW4h4\+8~U09 X>9h`ŔE,k>DEǵפˤBH^`B7't OϱP_[/EuIC9YĹUݫ`ӜիvUb$l#{mt-¶ |@h}erZ?Έax NSKԢ_Ҝk?z9o5JzB5$˗q** Dkl96l$ \fsp6}&>,gl4#{y//pIvTjKaCc~Q]VOE]$ڼ='HA `ZUqEry>Kѩ1U Ay3${T.81Q# tIxɻz÷NqWV䋼}1W,T;|Gitwu"dZZFs6AT3}P6wIrծimapIaͭR7 !ztC!UeakM!:V(XW"T4tMuϦeK*H{>TV4P$[PrWp '_w %ok hQ/ꢔ,;JA^DZC4.=I ÖFij𜟔1m&Mw]SVw%TZA- 3u[(x b17y?bLje5Ts)`/u#PڢDž/gZSjw&4pI/gQ밖ӗ1ِ}1Vonzpx1U'wh# 5Ex@vi ~wǁ\! 6{ԺxWL3a7"*Y 'DhV]nXPR0zr[z,_QN^'H0oR]F5_"xpP5@ {XXdt{rjAF웈&^9Sx@k:i;h4=#1MP#@< wMVH,ȃ.3z,E,">nPTc?#62 -gq>c_u70.!5~)dȵIۂϸUV`[Y^,o9B"0% $! -Y4PDj/;k.XZY.S2QKsI*:4K8=D_a+=˳xDgdjjQV7X*]-qqvn1)WtVXaX<.4lE52mv[J΂ H0 1Jă9#M{!vb8?4ɚ/# KRk i0VMP|u9|~@`/yX jZ4sm!da.=0~?l5porA(w*Cqi7Lw;\jz.AI%•-.OE9߄޲ơ˜s#&(X?NA/jR*X\vǸkU ¢HZ|4 &Y~w N ݓuYO܈A _JXϧo}A&QqgBA]g\*XW&֥, /5˂3K+GmT!b Vc5ꛋAD(Fxˤx:m?cT۞;}.6ܺf5&"JMGF.Y?oQ;FT,Z8jpg_ds=vn#5UBs=f^-?^P/fSe c 7V]%tr7G={bR/*kI[ #ҍ3m.?!+vB/Ǹ7<@Fe[qF+-':Vu'y!C{>%tmfJ3sQ&,Yc\2Ov$RmQco&oLE#GQov7 ؟ -cZE+V-W! ި/|bw^]JҥhYcڂ/7i#s}sP^UF2<$BnOI{YAFeu|#W@psCJ$+ATZ&bCTQ Ԟ$qZ4e+TK F&xPB6;s ˷CVbR*pJLEWJ]Bk6zgh7`φ[g'GQ\cq h-O6,>]6*6 F`c~gW3mv?Tʴ8o[4% ZօKD./whC@nMc3D$5gG_F|Ei-l1!=ҾU3 nZpUIn_he.m1v 쀡B[BP>UL] ;.rmǍ]mNTȏ_H17}Vĉ6FҸcppī~_;Bd3brQRE*;@K3tGE^r*_%1 r>DHMi(fzn-47^g_J޳Ekk&sUzK=iBF*e5pӯd h 6teF\5LۚB.Mi Պ){#59b z[|qde'z3P$!^$/;/ iVD^q4bՃ*#_5C6z_cВ<7Kr!jw[LG:9a}5%g0DCxN5{ (Ycx%""1ʼoLlc7ʖD;jj˹5ZX?]NF| vY{.a;Cnx*z%K0eŤ0|JADtzÏ1W]dʧ3cn4􉣕m*<̷<`'y"jB茬ա | L5loxωG&qO+8x{e}0&J|nƳjqbӠ"9vzbi ,O"(nd?#}@$+.8V*rY܊9td uh+I:ǐ_j-Ir+!؞yH=Ă/4O&m 24,ȇ W)P $ޛ'M>N_NauAp=ah,\dH^K,؃:IO5M@$0Ɏ<* ij5Z<k~ـB6LUz}&]]̰fZn@XH@BT+_<,جjO Sϸ8cلNO.tf,vR^+6>I%n~y7M])E['uko*yyS 20HGm7tpDsm8/*[ l-[/'F&d]J*{PfAՇC.buN0"˳vZ-D0T6bX}7 *G}2kT WTv|I2+8u Sb3?}T@&3u ,,S6m6sm1lg `A\~/ߺA8O m]._U+l?ΙJ/OW>#^K&˲q.Ϧ؍}}g=l9(gQTv='Ա6$w_Pt3`T%HN]^G['ÿ^vMa4'CTmv?~‰҉cت٫FZc%C-osQⲦ1Ϻ!|1(379Rh*߭n'RJ#H>#'af~`%]cEmY_yGQE}J c>-B}C6O)fOpar8ô% <Aܾg~P4KiȢfpKj E'Â!xI@2ao)ϖa\hO1X9R)$7|kx&33~H#+J[~y C[IՁ'nC7 R@9]=-qA*kj}ݝj@4jx+b23"87R>8vB@Rh=Q v 3-3{N2UJKUڿ|b #ኔ%>>\5M_nޤ0#?{gS>%SPB,6}+)V@spkqiyϋz,_kv}:}8OqmK__^o*Oƞ(Sx;"Z̍J LqpWV)#{oϻ`':bU,')'*SB>Evמ]σ ݢ(bjV yl\s#{Q rQ 3` wݯnZ[N iP&OI8a}pY@r"`<ũ}՛N< 'y4; l'Z_GwL%2tjewtU9˖ה^,qSo5Vr ^XZȶe>nq^[`ֿ oޓH56lK`+? 6fnCLA<Lޤ ZtZ$y Pnõ17{L:}8׎Cx)v|yܔ5" ЪĺJ0[UMixU6t܍22+3Hv)oʇ )%im;=Cڿ:62huV99>pQefǩ'Ip8w|4C#*`<VI/rt_>` oJ@ lchg.‹UfI{1{ o--yws-V,HVIHsTYF$9hYf-EKϻTr13~M̿MHJG~aRĉK6:7gn~>T-+ֈM$R>/jd`例I9<ϡdf\&zo#^$\G5dYJ1xKj#fhҤ# UQGRMIB0sWLr.kvrNE89 ӼJF×=˔V5 mӞMۊ+oc>Xw4֮f#L$ȅ7brZ5M]508hWflC%fJ5/Zp nt3״H/MA**}e)z!->n)y@ɷ1(wXEXK+Eh fץkm|)pm>)Fæe3R;~-y*ߢsT`/{2:+,EjQ>Wx`aOP8R3gu)Aheq vbw]a-VNl{f#?Z*ղI"ѼGw‘ڿSͽ΅j# Uo)![$l :" )ѩd+vw^exí\)/_(b0N-F̒rVԅ#20YQ*7$PoE6^zn`7`1UT!+;9/OCM.p҂Zƽ儂P7 DT|(^Gٕƚq>b #}t 7qOeAw0u (\l.9sM*>m-2~t?qV35<+"Ѕkr.;L=Q\x:8 d=["ٗJuPEkX4mon Uĉ{bst;tzTIX6O 7|HCm `%ˡ"ڙ45zet&9_(1Ӓ:ؼ33څf+W^{=M-t7} pwV\P^Լr,JN#]L#ħq7ɤ|Ea^xÊG\xa1 B D, qCBlSys9W(W<037DؐO,v_ߏ@cvT0%ce6!FZlrM*xˏ[$8|SYGBxH' a Q}䟺|Ac5ԩWO+RhHdĉb,n?Ij0.yPсޝ(8Xp>BJ2pІtW"+H-d#Q͚7A; D:;;[f](U2UhyMڅXYƦ@k6z|ڦ-^ @q2^$>c5g|J)-nɜ1&ilRa4)-e(q e)FQO&+"WI{[LՎP{ U<<ٻ%fP1}G aFX$"Z5ȕ yjGe¼D<ɾOE]vmGU&18:׍d2EO(-dDT#VC2nn3 ]G~x ̣MV>{zp d'5bi~xD}%$=Q+ >Ոwve:L૎ x&F>`_ II )\&y!(8Z$(]pg? ck <##ڡMSȟOY'jTR!Q\F~ JXa 0N I:]V:7o\iQS4#7CTYOK4m$]2l`У;zRH)E6b

2'fK<|F< }<e-ukWb `ƍT ~PE\lfs2QNITR.wcMSWnZcpE1̰Zk6qLl??q?Eqc@xL rB\38+%fg ]ebm4^ȫP(ß8fĂ/w}-s'M>`xӡ:9oOC_ P©(lQf o<֒2:3WPI1 E!@F)8fN/UhyjX ^ST9c~6`';&LLA(4ԁhiOFuxFǎbz5{ ]zYJ#T΀>*po$-X' _!(%+&LTHr\>+&SvgYU:LhLLAݼ#,y);Ɋlbc k: ]"|4r.n*!n̜O}xeA%P7?s&^A|q-+$YZZjg!8NK9`GM)ƮҽKȀ9bܽluy ЛJ4M 3)yY<3 ^KsbS["# 0w{c|w5tܺN=b&0`~[3y?y]AZ ņ6 Uhej"i|WZTY^".$'"#MS0WQ?¹n<,a(!aqW%`'j2^#_u`K#?qTysY6Ey6E!@9w̓R|=.e;Z7e!Tp"x'J_p?4/ Vx`d(y6爟_SpSڧIõ_ )nhIQr;Ó(U}CA~X߹% תYwFWXxs\- :/CQ~b񈘠Ha emp!(R3CnESO+0ؖ(Pr ّe5}$01o Րl5]jK ޹K;#gs;h窗«kM[Xy/5`uJ *:6P*lMx~O)(2&'XQ_S~{KsP{ wQJkVpp~(_+IlUf)?_NI!,{WUg8isPE5؍^mgJf/pUȰ=y5l;Oo@=ZFCtp/FB> jy!`qkt9j7Q41~y>s'H$Y4s+}z9SQ^*K˦{-P ~蝮MaTПmKp;X6MEWy^X?ΝY<ΙF9jSC[g{-ۂL"*1ϬF$"2]Ed?tm9v$PoDڸy|^ր´)M} Ocͳij$ ,2А7cOɴ- C6V"_t`b?\•ͤiΫ\'r '+XydiRQہ)VRuKsdk(eդ{MτGo x6܉'M:ƣ-6kਃ , ڌg\8_'3#Z%8*]=W^{ J Ј: "sʮDV@'"=Vu2[*H Z8_ ap2:%" zWк! .?Tw}.KJG73/h9+oL|#ib\S:9 OSP);2wcj5Eʜ_5aq; ZGyf&$2=u C+t+U"n `Tń$Pb\'J]kn 癡>6cp wl(u4vˤȥ. zы>c3Yt k*ɦ(H:Cî7 |ō$u+|0p'ŀwhpg3*fY5$wc3l' `dTč՚(Й$qP5Ū>8ۍϾrVWa'd% zT{Q>7D՘`jrp'1MRȖl JKcfsnC?P7"cYMlݵVw1Ԭ0N.:rF/}_ة7\>LW$oWA!_ҙ C>6"NYe#,Sgu?qe^(Jnmv_`q} 9~$<'?r+o =1\fC-Z$NZVl'%yl0xMCTdj$k=WM,-qߚ.s7.}G}d! sz'Մp[d=lbtt@zNog*$ c< S7|O8c9 l&z̺0!0,1D amĊWP֢(É%# ѿ3u]W\lZ%kmi .? )]]0xJ'(0W.ЇH Ô;L6Sww[jp r _ׁW͔J3Nʘ AORge3NuMWv3Wy$^{ݧ/Z`]$=ݖ㷨KG7WeeXu[s> 8Trx[a`0 @ST.61XVP }5S"1Z&2Z'XК5,Y9Dd7H Uv M}jǧv>n~ր0;~c1|&Ii˧qQq*gu(ɉ'ƂayF7_]fS?̪͝K ǥXxEWp&mAGZc*/ d>$ry9a$(XBF.O;qGI~ZtGٴ`ʹq ]U+ _4n kAf,f N=? >jnd9մRpoUΖ8ۧhRbdcg}.\j87(3Q6DuA+m<Vf*d?v=B2+UbSs" 5̈;=ɈzFFZePum$ʏfbpS|Tfᦍt U!rOB a;46qme2saFVBvl'SI5 o3QP;R i9nINy^#OtY $ f 4k!~)|ڄ󜈠=my6 ="RJ7`]2;ua!~lN5:*/>r ŞgX?`!@x )&\wTc~MjPw|>r'I~H)& Ɠ?}qN_6f;'} SI"pmGЮ{"(4X(/Τd]eSxyMPՠL- ZrO_uuӡr踓j;~s9FehvUJ%|)Ax3ӻIW[KЇrr^=\@8HrBEcO;w2TWtkY̍cv\%BnȅO/{^4A٧͜nΙ"7G9tBgX¨ &-?,fdY6)+_c[ŲߵG:&PZt4kaҦ fu2s|7z9xgw.ڼ`E}2ZІvZ(ATtQ,Kz8P)F"=IbB'&*<$sVKl׳q51fa! ֹQ'-'ER xg )v2eAeQ֔1€sJ-.wvk`tQSn01j~qG]6>e{~dђ/u0b7 ciηlEpkSJ+{J'FYlޠ)ۂx?+5F# #1> BЙ%6yOxy!^= b m]\?ŌLJN0Uiko`>1Tl6b&0IU:Dn*V9]A2A:ԽdQkZ̮ i𧫳ߤ;ݘI-aFUh';X/):Qc&aBtxB,QViW5T\dņd2X8JE 6`yd^aCWnI \q(\+ M%8N(O&?xjh3&"Mhz*?l ]UX4M,b f]&#ҍ'__USsw/M Ç m yo%_M_"kv? Ht𱒲r_j$mZq*Ky&qoj qUy@d47KHrtfDqdK]m=WMy9 S^hR3*t3ilqpDuάxqsflَomOM v;iU~ k mGy8K5ehPuW&WQGDȳ<\Ԭ?x4S$NYl. b9,RmLz6z,NQ)KP]Gbf^v S_enmwz֨66֍G`&0cm,<;XP%`\[#J#Ei[AZ'/Zn|l`km! Ӻ\`nCζKY wWcd-\UEyPk*_Kِ~^~щ#|賰Z-|OxyqE* +D܋"Q аv2lH(%A+kB[.ꃉ-1!${ށs8f?=v'%`Zygo Qq&UW%UKޔ!؆TFѦ~GO 'lӦ4՜Q.&('3V-޹oH|mR:$|F!% eSDx}hy}#x⌥'JsCJS;ڸ KLzD/Ma0 GBTF=5RSNz;] - H#1WEa$qSӬ0#@io@+F.lowspytk&U?"܉WcvI7۷򡈈)K"? ||]oS a$ }x)wZɰ (d)N,#QA ooŁ؟ ;!RtCyݠFQD5.bg? Ha~!^y ݃~ǒ Tw%xA$F33(^2wrPn=[>vA>>AQ+n|߸\zjKKZt>P?x쵢`tD>RARڟׯhFzgK%-rG0\r{z(<*M$*> pW1̓ת-\tqy>}s#}&RO_ 1͟iAFw;XqY6PQLBH.u-P PݐZ]HB2c 5@Sy%|˟QaCdnS/91Јq+[E# ROTxm  WOZ*ޕa+ݐ,`53Vyq_5GL BNIj'4M5qB#'&wzcg?bt\X5'oy~t*MY'7vMY38O[Xˎ&9 ` !henV)_#Ӫ;/ BQ8`_Dyc6ne1%OoSڝ6ľ.wܿ#T]~r=@CO^YZ p~`iGw~Kp| ,U'>( FG6Y<R/\Y=trIut|T۬#?J,0*PAK>>;Ďo=ܩyA/ęyc"^*l` 511VbъPGb ;=dZO`o҅,QWXWWb]# Ӆ7Zؖ.z%7/%]kf"}ne ʕuDPFdPԆE4<Ŝ6F9m%{ސ׻@n^5CY ՠ]Y+F% tm.J~Q3|\ /hIU G>%kCS2W-?pڡ"g]T6G6M l\NL5 9#ֻ߼j@0?Fb0]ڝAAeӑm:yylQ,8b#lƭ:nR,E:e whwtɸ5\4%E`y+If)14yJ`'MXFX,vd{rcޣ^+UHFjYٵW\]Z+#F~5#[u݄ȼe2k:uT>?5HБ}lRe% c9@3z ֨BDk+"SxuqE^ܣ w7P;[Gn'2!K C>bF#p#Q[3jJe;wbܾm{{CFh" CDkΞ}B ț̼]z[lyghM&Jv@}S[o*La^]´"7Sm1 1փV÷#ڝkPI[rA2{P#(5u'Q'lQdc@:PRjޑ^v'%$ņ?ڽ0E3-j]XOtg$/#sr*ۼ{r%I Z17jPłQy; l߅MDoAS|hCcGE(}O{-@^4kԛ< \yV70qKp6Y)Pl(}Ru=(祐$͙u4/ #Ej|U(I4$1Z᷆x@Ӡ^Z/'OIr^/Kcc175a'4`6 NPm(x T6|qW}ߦ)n1=euy| `Jw3iᑤ !Z/`OPC }$$ڥszXT {iJ \KR< ?a;@Z ! oOP%ylZ:bc˺\"8C1\1ΐ ז^ R|,J|'PuS"#G:~BWRjWQ=ׅ[lV谽uP[ Plɢ ^IVL=>D\1qTWMtB8QƎ-ΕQӌbW޾e)f\ o;ƃDo߭四lyoб0x (e ~& 5#mNh9of!U0_L2G9w<:TYUً:вϡ*-m=1y#*33hw2ļ#'< ^;A5wLMMVC-hrk SxWݗ4h R@>tJ +L@sX!}Y3.. $- *Iq0ѻweȉ㽪Éb;/uHK` sGMjPJm ^b/)?x)ơ[!=~S&( 3]{L/)3F;ćnV:uT5QJtzbj/a^$} R8 8d&OYdA"\`RSKlZ7XKo9I>tޕ*oN N oh' S3AHMH\)m؅;^yZ+HUj2V#r5v+8 NScN !hf-c@n@HNzao-$gn0(wCd1>PP O,f.s%z+_{emN`G~гB9V}̔~ )w}8&3/=5cfLkp;Iuf[=DS<#%\pϛ]P<[H%8{>M D* dk7eOT'Ɯ8\|/v-5I{x㚓Rls/lFaQzJ@IMH.͇zӐ*eQt t}CP"ӕ^ǔ ntO؛ +63.X4{9—wx?LvsJ2FD(v;#M2Z 9P SIge=[>1-X)yjUFƾPleŌB;kl"njJA0!) F>uF`* >@hbԀG~xoҜգrsĶ?o6->Rt8᫫SеEmOfzٔ1`I5q`+ȹ" ,났9 S̋pU#)3鹤m=U=I- z7p2}ÌDStwB -]&Ԉ~/-P>߷\85ıBVhf%;U4Pty.5:0/OLȞjqV{Bv:ke>##_y#vrlȬΉIm p}M<&x.\8Odu=K-"REhˍԌf!i0uޤY1Z}R9w'F Om'ku!(" v?p}OI;N Xn`l_VS6f H_!8@=V~Z^PAߦfc:0W(iGpk?7!",J+oO/ZU)>\26",m;, ؈'#vh\x,=2m-cN1<0'8ͬ4vvӑOi@8^` sDy7m8;k`꿠V'Юu)z2 Kk< P9ҍڡM l8HSm!cH+ͱ׈d⇷6_ ˧yUXv='gZ d9 c}!:5ˮX1'W,%ڈ׀* pnn^LۏQ,Ic(F?/B%^oh +2fS* A`Ct*0dӳnNl[vB6W+\/d]'^esiL%zLF UN wDЉRx@ծw@ExIkhֆO Xw[1O=6vKSS6'RO$ik_ p*+}}vt',%.? aȨ0` RbF+czr\ +i˧o ˝h2PhZ\O"K._&:ѡ?>MPỪ2qk7Ģޠ`"5qDَ4Ь}ýq1k+-d)ȁ蓾2Cgo "mȁeCYl~ؿ8^ai|ZV~5a 2 O6ʆ+̅m"$١Dтwɤe*LY60DcTw"&,ϰMg6Mv|积\m){]ި=M0NU $Ba0e4rɽėr )"y4{»WՌ*mpSe:Z|3TU$|uz?8@_{Y XDFyOz'Jh`ifHY9Q>f.bF?:L~ fV aZ9ZU&Lg9FIxb֗ l,nQ@c/-<(gLNׂѷcs|Vz_€}tIv6cPzC(Ț VFC6mYwtnYGjȑcjct+vnk|RE)T:C8 &v q &%*ϼ?cc5-Fk,P˖W%L+ n&ju hHZʬ_i8bc7uq?;h.{HsgZBOPePP_PD /ܚ{+odw`P)7{EݷLQX#}0I~pkG&ȆE |Q Vd7F$Cf'Rr=tK" K4Kj,vpF#(yq/Zej̭ $Qeoj>*+Mh?Ҙ@HQ:w?3M 6㌔kژii8GP&]9 nMX`[vDZ"o@cZWmh'k{AII|TZ 8834z!BO#[ cA51F TF¶ٱp~f3iIx zWȋmyyGAfha_F+'/tZWEpI%e7_3jǤH+)k3UNAɼmt"[7 ѻbcoN%+`(Hx+X.JlQ˼HttK}6/umi ,ҠwYzA~SF |cկ(S.moȄ6xf.YX &Mlo`Ey拋Ѕ ICZɄF' |բE]Րx96/9;Nj̎J/pUZu5m tW$+N~!^S,TSy&9$ @UsƉ |x:b]m4>qM0)+xNѤCl1$AY05vRЮ nWlD8-m ]Me;{2~(||#90$~jQ\cPR4r3qΆOж9Ektx %E\w I䛺sT $_EȱtA@=0ue#Qָ&>g]'atX)9H֝ \ r0ne[5p"K&?&XPv*t L~ ?5$r^T a" a~K!CƉgYb ,.m S? tfy׮5d]|a@BNjUd7'g Y ×_f*|iP&!eʴxS~q Ɇ50L*O :^P\3&as(Utܵ0Lq<օbM% aHh;v7%SUss'npN"|?îjp7 YᨶL^?ѴOcyC5{yyG?`$KwB"ZCuBQ"Qv%,3:z`RL1۬Wx 9|)b=@w/QpnZ@E.TZM?/%Pmboss: QsHX/kbri, 5 Ģhr&UٰI>_oB_HT'kvb2{7&L;\TJYZ7q_qy(l3{9~&V䘛wYe;Shrγb{o(=Pbи*61TtqSv:UQLMyNk3`q`m;CЫJo_*mr{glt4&b YߩݍYLfLE+țjq7Kj;ȝn{:]GjC;}t-βd/.==OQ(۵K Z0t0X6k`q[1VnϹ+ȿ1н i,W+[H`<C:q}62zMSo㡱 OCt#y>N1 |n=3'ij-4+T>26ɵd,"Hf#VYj[)-T\>)BC<_a{jP-C-5p E< psbK;Nj Ed k@pVoؔ.42 sC==YЖd9䋫 KdER5ѪG/MQW-԰5w^;0%3)bw*`SCkC. {VAAJO<=gD&,yEI>ʇj&L6pt'7Q0aUd:a7&oK{$ pe%.D%2tr206SL=ˀ"tv9|F|It,3 i66jv:a̢cU:C jI`Frۗ@3\e{eZZi2ACSrV+)<ϋv-7ur!L|a\<a"TUpѹNaH̷ݮOq}WXT*S* GbxW-oLbqkTV(Ȥ3Keܡ N^jWYO ^z2 ]<_=…~{WRVP‚˂V CJj;pn3pWfBSȜ9/ )qrq"$>|}Z ȗQίv"ܥ} Be7'R+}CUS(oK %֧ 4gCbnʎOmWo!jb1+æ+4ACBNcEp|vuOoٸ4 q}NM9/W{y 㑦~`ӗj0S)1ϭR'?]$Okٯ6cA|y6@ߍ3HΊcIr.z/Y/#|o0SYت&2N5/ b3θ {wGx8oy1h 7x!4?lam]h ƢL%@Y  {tC ǞFѧgK 9.2[acFE`1 P/Jq**FiUӓ2cSn8g WZ?W#[!s1s̆%fSȨjGUZ \F,'F.J} 믂#2A,^3TtBss@;Q[TX˙,hw#K($#%;bF+:Z4(X5bY%R/] jvWGK~YݙC=RbyMQ'j5TKߢNW3$]9W †N?ˑ2fGQȄ*So[܆ډv_ĺn,~Y"fR"W0}~%(7G-)WkA|pQ(Z)EB7g*ӡKkM"w#''ٺ]:u?] ot#rWr‘ Qs=j·hߔ &uw Y;勬6\)E㿮u>@3soGT[n3ߌoH;@}Z ifz}ufVAu==>룼~qHJ[덛4Ċ@М[4S_P=N>;PuTx' m˄Tv ю^Cz:a6X`=: )P_2侮(p !dO6&΁#.b̕1N:xvń|ʶ.un|rM(A,Oa }a6RjgP# o%z!_ *ňvBj8 u=* c`%VaG yU6'HgwVVFeAimwTPXڳW&Iݐ};0o)$u/_Khɠj3JGR ]3m6U$`L80a5iuFݭjJd(0u`8<ȁe!ȕ&9tՔ9:Q +_֩El#yːPHqaҺsF7r?΂U0fC0k^9SmWI ;ɯ28 qAa5 0_0t6dF)ԓhk}j p>]<>CkVd 2In-vYp-럜\ (S*+4a)M1i\{Bv7f1AƔ#4D{ GrP8L$1FNG:  >!cKAs"A0۹(q]<qӠVriF˰ it#8WUK$iuPdY&'2=[)U!十brϖQgP@ꔨI1"/?*i!k!s+\nU2_X'`>CdO7\uO-66~2;ZdP[_ݕ^(>D`y㖿t ݳFtATI}>1wRp,3X#;މ&0k 1jٰ''lNDEM =A&^pBa=ŏ+3 {:cGKhD2ϦR -GҺܘƎ'+ݠ@A$ajUI< U2hod;*W^FW*Vømxx𑕖yDsmk$@ @># Yuvb2>-#Y張Θ=`gDբ*|:o[,;QeMF%ʘ6lwhc*apȾ XZᗡ`vݒdFE(}B70dLU8QZk'l />] O5qH':Ob iH 5֓ޣ.9I}ŝfqF4Twsa%_&046IH:##:Y/^W{dj xQr@3:j>n"8J#F=* T4 g~8Gc6c&̹tun/41bu' q*km /HO'x@?^纏qIBbSԋDŽ>..{*JqٮXljvP0E\4 Pu<$;ď=z14`v6[[Y߄n4>Lg!^<7֋~SG߁%f)ݔ Vo`W2rd?#=];91٧ݵ@6.EgeF7W*S[x`~~@_ӷ'v$vyIioL( VTD_SW~8o{QƂ>j񗳋&^tWE |]~*5Rʎ̠s yb Cբa|Q1wvyJԞV^*]X:o:'f6:ْ3}A΢KںW|#c/yZ3wQbYln613"nuƈg|ϊh[Gmi N@c*>=P/S\5#HHsUfͶlSIkVH͆W3w _kS\rAݳȖ:8?M۷F[RAZJH!5oĤ|^t(* s0윮<ֶI=4)Ռ0_@3>*Rq^M@јp9FqՐɿ>-:|H} ոT3<SMs"?qwN*˴Y䢺;6_?YG%6燷kuìr>ro`᧗]d.s˘,QsYLy %D]_&I5Ն33*K _xaOH)M 4Ɍ 4Bގ *Q S]=)f()PAb痺>>b"}񔍚DDgV^6l1JT˦Zm¼bsE/N29'< &4x[K4\aN?>q^{k/~APpJfٶ^^ytP G@'Fnb'p#ފc JK5&{'J{8x*dI)#]/!r?*ŠD](VZMB jp.-Z )(0ff0 (-FtO*_*GVP:DPZ[{S*H!iǍj}_7dxm l$ &2X:wx$ׯԞ+<\ Pjip gd+챵L) wh:Nx5^I@*wˢˏClA.Lҟ͖*6<92<9! KWXQ%CH%ٛzs:ln˴7Zoӯ3*$0U `e}e,شAEjYR^R (imCŰwDXthETQ͠!}yy&*PK |)К$_vn sp9}CTF00Pc+%U;)14k]DL_|?B *XojS 0E]qS2Ďs׻A@3 msz<:v8!y?ʢY$xV`(^}vIaJt)[W7!#<տ99˛SȠup,%;~[ VNiW]_0#+H g, =|a! u}\h۲-!!`  ^*lրɍ͌4AL77}m'=9]qɚ[[Fq9seV g\C{htv<^I<n'g*;AܙPFo&Sݙ;Y,ՙ Ut>;& -fETdV&vJq,Zqwަ;X7zKj?3 [BѤ!n=TTŌ8ú"ȨqsCmqקָ жQD-\8$I%S[_(I~%qn;\Xb:-tTYMK݁+ptߪ(Ia+6Cȅ.:1uK6C􉌓.rc QRGD,vC( ;P"lhE2X#AÕ}HP:8[[9:p WGn\J65O&%F Vc~XqV_JEY$I9q#)"BfW.ؽF_8x4*#g/k* ⛶<s^(Ѷj(Z]4ER!vW$R/h͟/%/4$$rrbSp?w1EnCU4竄zx4`$aKC<*&ߍe-gK/pM MEHdREʉF~m&rKdLM}1BUx_#6GXeP^z@PQq@N)L[ !D*+9٪WY^44s䚊on\$0& XS)ƾ; 'Qwj*9cͲ-΋zې _>]^)/@(S= -##ѴΥF ̧ OV-a)!ڕ^HC~[N*\i%HzQh8IMjh\#0dj$1\4O=kg@xDTܝߥ& ($ֻDti#rz7HwxEe1[,%r=#PEV]P5sE^= ;pĴ/cx0.f~ q@E8=G"ך%vg`m4kyn7)yp07,,H񞬅_SooPmA?66lKyuz ĹR`7*e< զL;C(( RDoݣR#(V, YǾV[ڌ 8]t< &~nr"X5Xxh7eտ~s]'oMˡhF*UGs+{?%V#I[d3t3@M;jeZ8|3tͳXKl!벥.ʠZɦtf0$&tjhʺߦZJj!.MF8>s^)c_Y讪SoOnLahȇ-L8eQuѝ`+[_Dm~Ag `1K%j#6oPoe@M M`P%)._ 'Kª֕<~X!+%+L3AVqh8bu܇f_)#*o8J6|ϺjXK!]2,x:#J~uƋx$.Ot]d^8gnsN>ɱ -: TFli;BNP/>)bFn ; ;1}/ű"RO5^9PդѺK~# ¼S, U4q$灩K,cfCUXk2ۋ'7`êO]0Q2ۮvLeG"{is[Ғwî>M <\&k3bn5ğ[4,a`͵t$ά\|NBr٬Z|Z?@o*QY@_a+خgVl40g[dZ g9T㍭<`r$h!w^B2j;(ϗMƆ՘0OŸ-mo`Mخ R5 yXr xuhS@>\P-rLyۧ`%fϪԛW;.v+9wYeˀ"//2ʋOۺǯ+%~>mGͶ/d<|Pxs;Şx6.U^QKŮ=6:[3/ 4>XDgg0٪cF;y2Xoq~{:z$k1OE<@0Ul N8۬tD6Av k:/0j,2b̉ Qq8lq JzԅvIvQwfԌQ,}^'"1FwH" je AYedGD8H}|RoCf!+3 {"/` W(K}ppu'7D΃qx͎UTlmY^ iFĸp}뵱F*N/,o_ y-`|숷SF$ɧdc5J]ǟ,ѳ(At8eӢSI 2ۈ~@I@^F̀aN ]Ra~#v^ˢHH WB=D;}b+ɿ3~ 㽽velhbzBZe̩0F:uJ U(^ųH m9Ġa`mw>.1qva~ 0*zC^z0a_G[^>D s"5!$2wGƻ*8x mQѓԽaD48Æ&&9֧E!9sv)OV"=02;Kn\Jx꒞;M<7૒WGyX;BY5{T&%7tOy< WכEueN{9h~((:.貃%Ρ#J#?ɏ2K [)OIEf]Rkڴ \W3 r_$f>y9_+٩4bT_KV ]zӋ5OTE -ߕE.ER([QrE3*R/х![pw@A-- Z[w8] H#@BX Fba Fm^4n^EC*\`egz.GZ< t*|mS"@#<Ik6+]|xS0BN@=}[@ҍQURA 2Ҥ/.(:>jFV_#pts`y`0@dX2s|aTPYPwR?bZ^xO 4rm@Rhzk &3oRQIU-[ޚV^ 8ђH6V NNCp C?z2mp!v)nECw}w1 /՗TH8Ƨ~x8Ɍ6~#ҦP,VkF|`<`C\=H5a堤(%:7ȟow(af6~0.$.~uc}g_"Vx41C a9'&1 t:D ݅#v7Y \\ɚ 3GGTňgm T E o/ @ P;u&/U?ʥ аvV|f~6(_n^SO/~%VXKT8$ݣ20vDsg}XG.Q! y:όx_>T@+ 1:A]M=]bz+0(42r8K ŪD[c}Ȩ*5MmRRuAq<,Լ4TV|#DFv@4@>Px"ɨCl'uŵiΪ0FUдc\EaU;0Q+N2V]}){>dI>|}(BUl̍HfHT@c^/t-Rܺy̚8}%Tm=TǐFArj((SI5!> ,UkPc]?Not ݜhck #L`}/"Nr=#?s~4 XX=,x+*a\KroBX343R/7Zʈ9~ԥv6W@qyڭZjBj}X>SkʔV@*+}ߛ]l'rx}JS X".6t !N⛏UG'%0膊&a&4PǵH;NA7.C'Qq;O8b-T/ c!@2sK7,-x (~PiL[µ)xq*O~ת-t sn'O-]_c~: pHL{$b) Ns6DEskd @Ă0 ],n>DSm94&-4ӡ|ǻ$pbI6 (cjdr_I=1ɝ6)UꙟB;c*N(mS'٥7vw-.} 5΋9{y*AzGnT6n;VFدG !o,fI|e42Lłr,2$5c%Kr.!{AÆ!,]\tC1)vNUWǘ|zS`vQfA{%3"&ӌL7ދ,hJ8vCL+ Y/ 0߶fj9Ip+vVk$tX(01s^bņ0bDעROrsc(jv҉Z*pO҃"_pmb@E5g (ѩښÄM@܏>עD\׉Y4] /grNI7t2dA>wǟneO s\!?Gyg"ޭ~"Q$OڇO(t53LUlB0bYF/j]2j$f-_mXTTWwN6)3I撘k!me/_ܓ?DN]2ԯCecnvˆڠ?rAv@opҞlC@QoA-ZjPeDK?vu[!%+@?]ZubnH8vP. ﮳_4g맀mCxEMxL0[-d]ˌҡ<v5.MGrPMF* "tNh=/E"5׸z'j \y1*-~NުpF?~Fo*y^`A_WeJ@Ӄ`t+u!gp%'p!ԟV[iUYx3K!yBtjmT c o Vo?p~l8iMk$8I`C{YR^4zv!6اZ`=2ܙaw+K !Ɏ}ҼC=+UAeW(0 󆯩eV^68!Z`>wjϘ`gcɉ 9Y"~q R{܎mG|#GBvtd|gRYTKկcF ] F&5bhҬjaη/HaM=LW,v*i( 5w\f\JB[240+eyC}{y*p R%TX5|4== _qr_T[3dL9c-Re`Osn5S-L 񎩋x7L4߲FoL݁kˈH,c]Iov?s~9cPЕf/vNjoiot:KC7+Mx_65:ՎNh't.ϒ>gY~l {7u!'T~=4a|lwVS Kµ|ZʸsAt$F<)ͅR,diT(2WApn`c0#%G^sJ1)@rv9ȍ,7O" 5l;u"lI,u }'$ t?U]%>S[Ata%,װn~&0# \l;= k#I@BzbK'%P]biG\xBd:َqv+Dp$ .0SL1F' W֣h}b6UO1,F嗏iX|M, M]q-ľr䇇8ةH f0p wLPOx-m AÁ}ܼ TܔB(uq (^ rH%K)1.]XsRabkH*^h̘KEfC)BY7ҁYzY~(;qv`3&6Ϲmv\TcPݭCX2I4c@ͭtm% hE޲gŽ*o7-eöiyJ7B&w'oaX/!ј$_l?,l醼uL Jxb_}Nb~=1W#ϸ[h!Ց'?g²z%܀_+2 Xb<}Rܫ3 S/ /0? epxW₶,hi@I }{qKpP'Q֠w~!![#GN9RфS2 |59ʚrn$>ћ3-lt" wc͈3D0Ŀsh ~IӇ6V[6}޺Zsju9Mx=< p'򓢱lldrloh86ci~P!O6|c];!Y*~ARf>s0 ]F~}"Wt0-]FFЬ/oD]p][EāߥzmN@SH'DIFO^y yR.!ql3 MUS/Z+A@7 Q3cU =}XȅV[D' jƆ@[}x4v*Oo6ЌzBTLmVOx53U*Zݐv@W80("Jtcty)_R+|R8tI$^04GƤJG\ֵ1K2+OR+ntg<@ ~+^vԇ/>Z[syye2/ܐGmH8`*i'XIo-Of}1./kshdW Zq;ls|Og(([<;kR^OE?ҔL̺0"K'k7S NLI8q/*n)X/m"Un济~;T!ѮːW?c/sNro|t4<~+al[8a wlD@4iȨ#Mgp2%*B߀Y1&F!WekB8C Ej3dgF(U{n![&V:w/n4a5N޳@ 92^?f2 8eHfq&/hp -hmWω׍is):(^{1OIe[eKņccB@]o{0*BlI@SPpQ\jfcyDn_ŧKsw_$W)辢P- Uп?,ʞjn'hHy<6|s]C %SZr ]~f}N<βq)<y Dr'kkCpG$PJu; H!Uٖ-۬|ę\0ْ}rx4"Y)ѫzyùQ&mt|!qb!9^$Lyx.jN{UFֹVp= V@{A=L*YIQ#z*[V9z1#VY'*Qpk`Qۗm؛RydtO7E  3sA \n%p>n9YHlܹm'>kkf:YKR͎bI5wb0T0ƛ9lz0o8 k'c/wyy􊸤j!|u?aPij' ю{ë2R\duF\B3GL6BO*]p[-d&*:=#g$ U!JV/tz/b%NZkXb8>cTui0@$U٧(vOp™ՙ^ ᢥN4MϪ*r\(!ɳ2_X<5Ε,Vq)&1bޡE#L6c]okqRot`65.vC)k1e^cm_UP6! Ro:tP|++e^.RC&HȿyV.&ug^ 6E dz* qLʣ4nai>aHV4 uH VT KuEu?JDb,b**C#;'wV엦҅?߻M ?*\F'#dCX&2 zki9 J۲$t0Oő~kc8̹@>p,P'I #wA Ĥ!pk `"ٺR٦&ձ[ DL89NPcpH.e0!x;+Oӿv<TׄM(T&yO5k=Pb_)EUr4vb꒎ὦHB:X,[o_r]S>V֪뻑!/3(ED`/Ǿ|T֣qa }yZP7 "oE9:i0WуIGƱ,L.cLݫC-ۻ0-SB" `Vv L[%h-èo:MvNW„d9-\CtFl{Gȸ]bN/c3?ip8ݲ㲤m|]#w,<Ҕ&Dux?+>wo6@^7&vV̻Ty>q"4ƃJֶI*^@VT&>n WWxU<%A- }JRl-9s$UU˪;1v WSnfEx!#Ntl"!+^|hP<܉U]% j^1jH9f? qOgO@j•7.׊ZDIx5څ9.ҟحYXo4vhhm̜?LYrf=u2JӠWFE9(nR85Mw#R!Яb{[r@5dWX+gX7e~S mjjIU7Xǁ~Vds ֖QGM#C~v,d:HYꓚ3dnaOqz:g;ᱥP7C2TT[V>Yәz(%{ u~#KF@ )b@0\lbQѓE͆1` Gv\vd@Xr' 6^˘m[;nh"p*vJ!)wH46D*D.|_5p0Ht9kl)3_`!u"v\awfLDJ>4b`uR~w`8R'ycS!RsI1CPO0dJRB_|ZOYvd9APu.ŊIL18o֐YjI$1-t;fH/U2Sݰ=i)i 7u'J5mUPpPX2KNZ M.Tb#pq!(׎]|3:eHYsp|s>Qj&ŁNxNs} [u~~Jl&1o_nN>Z8LhΫi1Zw76zes-kR|s8к~YIl=qGG}G9Kz$fZsf:/ y9YI(`]5 ;& ac$*5)NnWR|['{֯~qj?MڦGqC]{0K~u ]Țg!s]<% ٟ"lv'vi8i_d'uÒ5 !e_|'2ܘD.AдF;[yZr)7+>`&nѓQ0[@ wW?e$.gk:$;A}SzS{wfy.tI Dp+ $^(=8zorMAUyrho/*@QGkU<[3),ۜy7d ,-2 Gb k,Kd YTlY^H1xôko]~HJiy;Ž_hvM3KF?xvLp{T.IaS 6Ot,J(]nɖpSa,nrL%a=S.d7aO,geFLASA&y!ϦBlpZw4@RtCǔ[Kڷ౞p(x}sC1C XZ>}QP eAL# .828S7Jioc0 ' [T  }i1._,Qy*oe(']*dlO][2Eú-^*od <3! 堭!]1*RpP2^ŚSIg/A9lXo͒2QShm)]M;;>H nC t&:vSwCk.#re0[R(o2uޜ%]zϪLcbݲͭԹyJtJe@ 'T\PRj~1zLs}᧑EWMrĜN i2MI J[($Ӏ[ %2o r鶮*SmvLb[EMdeP GOZ@ kE/KPdpfZE[PP/2}-:ݣd|25 /By}VVPؒ½[%×f»wBzvP 3D%>y zkcF=::Nu݌BI:_ږ{Xa/WrpT"\d,KMsk-|cfO0n6Y~γ3*gY @*HrHyxgJLO0c( ,3~;Xf5e)A"D"^r7]rV}dM0Ed ϓ_c)y2W+jL% VZ=J:&q'- RTh9q쇆M{}v0 (9=Xn rvk/#h1<`\~yTaZldIh-0JYEq= ޶^ MKG7_Vx2=1}YkIp3 fi9RzY_5JL{brQI! L3 C`ླྀG(vƒ۲-$^-'zhrK/\8eUiDFڨ>:J|*\ZS1r UǗQt^őpj19:Y +P>12G@_+lr9^.[ P=ң%mx@7(\: \j8B 'Tc!8 -4~tSb>,QGY\[d5:'ύg{JB:~OCPh?5HOG :rUZ7MiQpU@_4#eut.EcQJlS"f}YB${Aʷnp4&Jah٢pD>zD1OƍbQ9O1gJ֊1ڕ\-8~peu!)/U!܃•p)eǜS=_!0wtB`3y PG~"1cH.Fz)iΒ\eeo蘊^]Y-O6;6-h [k(dzŶ;:Vb.F&ǘ!<%w#b֢3Pa̔ҭD ul>c %*bgO*DEQnKڛX<חSV ,@Ng" kBMoE=QF lv{MlӒ'|&>b0>pju[$C60T;}Ì@'HulDX|: 3,lAu|$!nLvDlٜDd•ǟ8d/wGv{C0ɠ:+T J+ ao*-a`IHE 1^LЃ-lVkϢBr0‘x3PHii'| XPVmtl1ic?mVg#8aOV/!ŕ&ɔ+֛Fy~¡2RUd8-XQ)rU.EcVHuZT(<} }ϖ,Fg 70/ : 3Fy<|hQa0|:ak\Ҟ^u߉2;ZSnI7x>~zdҖlғO3 -:w_N bx8]Bֺ eIIS C5}rꪾqAb "!S퓑t4 r] Jy?r"Im7uw* daE:'OLL Nؼ,fd \&ypö6 .z_p.#LXP<{_a/zOޡ&{R}XeD_~/=Y:&܊j}67ZXP;BpCxX$Of'('tPB@Npdí.Ic!b HR6KrL|? {5Q6'ng@MfcӜ}GR,pY'X2c V ߪj)joLtuy/Fz sho0Ӎ,IB*QNR q!l)yp,f^S&i] >yE;ّ8ijd[j8\6+"͇Q0) 2m.uTDD'F0+j{[/J7opH$G_z,{5OţJ7D\|a li瘈@r߂C ajzblfe),QxShߧ!+U!вZ7W6+ܺJ#zXnlG;6'0{AԬI_ݝգ)I;/1^OJU Q}P)UqmhW2u0&x]̃}\iCrN/Ohз=<;Mo\lۘt @veL,S޸ sI`0}h^d% 4 ZcFN 9۬78Q g%JƨG9JLd‚z;I < }X(OWkݱf]￲Ԥ')APrZɛM%Dq<*֡ruk"a%3`GQtڙsby\jQVFCU >k^#5A?y-qߏ$KGTwJ}\垅띪N&,iݐ0^F1XEvAR maQO$^(D1> j2GF3**)+C7Fo-[zDa٪7=RwJ ]~ EuY \ ffauG=M憎!3^3"P}{3'_m+#tIm 7n{N3Py]t?l/H+\#qjmtӖeic&6*c\0'?szΔG&p$LUp8/ %~y^Sĭ2QFQtAZ4Gt}țͨНvkW\@Ĩ+ieYB^t3^)ouq,zyeG[Gg wE6K>b%#ɇZ[6b!?y_o%h;泣Xe;ݪR-xP]+6֟./ԎvQͮM逗Bd( |mO)o~.z,^[0D[ӵ  aMk+G\-dbmZ4# қO/DOF_[/֦1d Mu#xr֤5_Jkdnx&S wA.\utmEr uc fG+l1kmƙS ZBg G0ġ_T %4̀tawi UCv a/Rx@ۧy9J.&;RSx!z/ⶰ-,GĆ)fGw2y>p%1`$$c'} rItmW?kt~k+M"4O"4VaV?"DLV[q.]!\#B!6%ݐVVw,;#5Q[2Zx f`oy?xve;7ȋ%7i~6nX~ح_d!RL d1 Mή}eqR 5$~)#3t_^ݖVb 0SoJ>A$MgLYc!uyDAҾ65I9?)o"W;/B&Xk=Z؁ᬅDxPVDf|FkV[ +_fUieNX?nB6MX@ghc*; xR{N8%}cؿsG84JABg;is+R 3k=8OqPXD+-]F8wy9rv4ppiGP_)&hhGryOg<Ӛk i/aI~4.ڒN,pO};)~穩'\J` ؾlm"p9Sfc&RέTc:3 <$kBŀKHNt  KM(ñd@&~Z,zR"7PG^mՋ|.ΆFPb>wD2 ffqK"EK.;.2a !7jiiA1Kqw)KjtstXIBzJ,"Ȟas?Ya`wϊ=`}e>3*!%bma./Y!ՄoV_oNsZH.\wD:YQWo!E}`Ky qblصytN__F{̖V3m.iwAKmt}ǕN JiǷ'Be*]0=o ӌiC V*aڀ0@Z[{N)Ղ/w*(dd8~sTqtw0U#}u2NoyS ous>T}ە}24}VDu/6 'B=R 5_[ݠJ p|Q4^fԼ?ze@7/c̜Qy MBN%W_s3+Ymn2ڎg\J'W@y:yᨚrfqT>MeIOD%c#kpy>(^")Vn? V=wWEnUS2sWxĕe|#QuGr ;H =h{~8!gK*BQVvRg_9Kjk}ʹnKhc16C(]GyUKQTF 5bJ(DZp4jR`^d!h ΋Ӌ9_JǑ_W NQƧń&99JΪ,ȌS+@t>ٜ nz{αOU~;C|G@PڕL΢lHv!K Rx:*>N>=ߤts%Hww#@ulR ]r@6}eb=bü-P*1rM}WҶ=DL)͑^@酆vkK]!*..S,k̝֌"9=ꩅ+,Vԏ$zxn{rQէ`6LPWD$yG*Q7# cIGwSPD{DE(=,2B)*w'dx(~$m-w2 c$M?\Sŕ+E Di4F ,< :9 !W3 _@W,3L+^ Q1x_J,rՄ%O1J'wİF^ګN;GW]e\"yM mX.Ky]#.Gs!weXA,35Qy'v°ZJ' hmkvʊ*K.mma|Us!8P>Ted[![wHVVZ`f{T(㟃/ |D._N+ƪϫOgYIbyq}B9fid>tT1 I54ǰ%{۽68˛jL+uNmԘɸ'4-u<0&dFi _o/kRuluZMM޸K$ }"YNfCC/q(a Q5>/x>N"8/z`}}B\QV yfq_撱vg^~,@TlwKunM?caK_ÅB]mMT4zIşE;0i)J0&<}>18 F刚/̛py.8;M HBXԲ> ӷgV!&͔mIܤ.SzBb9JPh~OCX.tB  l?wd ;:ƀƁFޘA`NHߧ_-27 <G;:2N>G8Ot/joP9Y'jGqo<3 qj(Q-\c=^F90h65;x!>6oGB~ҭ+S-˕yZ ۖIpIM" %[87]F=L1f0U髄C f#C?H jpNzb~a6\ac3͟Fwo]3zQD2{(EI`Wo(wqG(ِžS f<%d%UO:4_ [ur_&&?ƨ1ޕJ/ B@Y BY")8R]?oV٩ MNa(z!#KNo [/٧#l2Eٚ[H8KmG&jND9dMHR\G2@v^_g?W _ 13` F )`Y:2k[F08iۻXAdBx^C'[ d ̬%9af6A>yHH¯f1F{ 6ۨ }f0<͞Pw g<%bEx~H][$'Ä8B a1o7+@9ad G7&*njU$kʕ 2AۛFe'I=t\blltRһ-8\gq8}@ yzaNV1ƻs8l3dB$5M"n%3Ƣtf|o:Qćٙ@}X-PAڒro $}l7sCy`8Ĕe9 Guzdexxݤ.ȅU*E碦a6039c"gkD VA9;+g&ڣhe4&B^~~&,WSZi!=BWЍjV$$l;2#Mon3JiҴPTb67 JC8l}\ix.0/D/1a  G5s S3 TshYc\LY>uVls&dPj+Mecpk=4~=Sx,uQwC37l#3ZB,TeK,MFJEX8rj>F7#pD g._ Z+:m8~)/4 {o-W&E(4PܻyYTH3^9:ޱkYzXȥݔ<ikc )& mr5E;ުw;)c*t3 ?k{5s>6n&˻}yzZ'Zֻ4Y8Yz C=t3H,1x j`JsJ=Y)ZOiBvNP)r' t &Du N MNV2xZ@܅j~cN<9X B@&]4{F6J*Пew]?:#z"E-nP<ǥ%ԇltnl=sv:PWy_x;:4ט]>. "a(܇ody=ʿuSԣ@4Hv}iT>g>S $wvUl6 P^ !/V4?tT$L& &{s&ntq R @eQӲ̴͉dzuC7j13 paǭh=+˻0v9Ba h@DxKBGIPD6NAzHQFD:)sw:`D#v S90 ъx PMƧ/K.VV zGƦYR9ݙUMdTqJ+vJf_z/bBlȍc o"N/ b\6"]t~j¥΂*e ׊N][9:'6mzIJ6}GN?z?]#%7K;jXԄY8Xi\sVpf.XU1f!`M%4`ZO&#- NpI[q$RP!f{ΐQEvp8Y>?$AK'vQhwi΁Z :P DelBߜA~h~Af~ RcH{ nDoVTȹ؇E_" @c0F'Ll3i紀= fU6 )\m,ɚYzCBYV9 3Fi8hn2w,hxB9nH,qcS{Vp-Rup m}cYĨϕr./lt'$m89B̨X PqևaVZ$`[m)ȦUt[#=bh yD ~ܪ$f?u\޵lZ&7'D]G.Ytdr#*ձa oZ$yaf|Wqu X =GA,DNy=T:p }UjF5b56.hh&1u9-8MfL~]2]]'i/ͷDž8(v+|ƤN6&l\t2L`̪խu|wsXgIŢnRn`@x~r9#N.D-(y ~g1١^u):P!FY҆҉ųQ7 ՊZ奈M~WjiOtDB9"#v]xTsyԮkUJlS}<ݝVH@FhqӇyqߙ,-"q1'etCWKoA;j#/rfV2_fsZ %gF_ywdvMJBBp5++rO8Ȉ۱rUTb7Ek{$Sb0fkxMw[%K&)ʺi<"jzK=r4u3q &ꊍeZ霓4+%]0#ͅ>[ʠcK@mo{E %v9Dz׭>KaS5}Ncw.ڴ#b3DyJnB I['')b ޮkdrWb/Ild%EU2nU[SboWUgm_I+Rk$v}3 Q#MOjQJ2X/jSݲu-HeٽΰVip/ŽP܈/WNm -3 kUToű0L[{"Շ:wWXJbm5OosID--G5+uŞG3@ʴVE/]os@s-fxJKlc$ ZQ+6E,n.J !cQnln(:$/&8eF7*:6 |aI.hFQ:) ᱉dQ3UWeh3®I ?YmWɳx.*X93S|\jc[E[;|A1%gӇeٌ}tqbyB=<܏bOApg<9IѮ 6*^0ɬ2$Db 7*[/h.{cR0pQO7/2Z]M݊kzDm~tɳu=oHXΰ/ӝUXY&`Q+5ol/Aly[D|h?ۏ2s&[XfE > o&?~\$=\`vMCpLٟE2^jV֠ɾřQHq\_`Б]k\%a|6p!ǩ*͋ |-;7Y"}V" F (՗?<|iR;h$ RKN-EL.^O0CC'"V ˒ce/Pa&yZzd$epvna H&iGˈp)|p@a_>4Y_y!&Ad맻نo'Cx:̗ͬgbA\,lJm 9x;!}i7LF]k!dqK_=$|V^8R@lC a hCPVt 4o^X `:1*z8c?i^~ }2oq c Wji!N`}el0aHlSi':ꫥ#_PwW$%cu/BaK=c{|.B/W6"1]hy=>]e*wXa&s?R/[|KCF]>ld\; aλK MKp: 9Ad- ` DK=w"A|She 3Z$.T~l>?c-elKۍ<ƉwO_3GDF}u$!d.Ujٗtz{b@|}I*= UJ<܎vA ݑcR;;rX܏'~=eP9 #uCG+ЕOA(+}V@v(Fsі犺^o%!'PeX]5yBM]\Ǒu\.|hUչ`bFGr,t%o$ÆtC%MsB .B̦FHW "t//SD/QhzqJe}/nG/e寮pqrI #>J&Punl DETvl5'¶3dw/>aZgn9xb »L&>x?ǙɏX[N#`%.Vdyo!fLҦmjC_%cMnٟ1A< Bddz4r0>2Pر =!F767?Ay)TA$L8I+s,{jCbG4~jt|$+DgfAllGl.0\B> ~ui#ʗ[vďL$Bً';0 +)턛A5Y~t s" B&ޣ(׃jfwɏG C dԛǧ 4ZSBQ0&JK=2?`ʍs\) -vz[1%с 4&i3(vcxѼm+Pa7b¼0{p[˄>hrxR1qp8 -ݜKd~VJ1oƳwC$Q&@6 &񾧿$->#`eC]ң^=*׼*4gжkl+=_ypLQ [@!eN>4HԅC @u'6>{ k|0(1<^p-p.fqE +5q֏ bcת)CLOXGYD"!$zuš"ʐrHvlAIK ,P֧4hP6anj 966QXjVvk"XcI$aщp>?[=kfTQzݟz%V u"f^VwPZ PK7 qu6rK @$22I@O,` ą#+nk(WCv@HV}bt_oFCWP߱!#XMdWi7r"]t<'n$̋pV}8@0EHeˑ {#V_Jv*i1@'Jk $D_ Pם6T-S)V odKܟWV LAw`jE є6ݒqhL:wrmev,-;ذƆmҳYf:@3WLK1͚ml:|M丕εA3Ĵ+IXvj?w ?[cfTW3W;ndI`D!+?koONa!Vl,Rkk)\:z{ouɐF\<ĸ;_b5-y=77 fd*[Cjkӿ$Zt㐝/EoKZz"1Go~aTwy )ṹxXc2D+CT$wLVFtiX'rcO;:SlL|P]OO K}c6WZbyKf8 ލ̐s92IXĶC8Y"D.`=u_l  ݨCvQN"!9ǒ5PG9 FNa4^ѮH|ޯ@W[ M/-jæsSⷝ|Hˏi·vW\ GiBTϢ J,6dp's\Tr^NW6*MoC߫`+ vb*IS |LĴԉ1PW 6줭q+Q ]3eJZk\xsv&>"cމ9xI&`TdPVdO D \f@t츘"1$zď'$$"Apҁk׽ xv2֧25U3)'n3?C;LhA}$_LSKE%ɯN- 2?Cǿ/TTmtJxWhb}qi.7u@`B *Y_}ov \fӔ'7v zut!>)ߣ1cm r*ReM|JVR#„$K=FF6/LwT@ Ȁ95CiI&.iȍ\$f$C%,5{94I?1UGM9z,.9{aRdI%X'Tof.s6?@\~)yfS|6 xBˆhȾnM"*raΨR$O`7gSR\ʊ 9Y(Ep"ɳ44Y[Jh*ƽ!]!N#'Gpb]j\z_Dk߆aʪm'gDR{  ";9gݠ׳.LQmpʂiSaDЗK%f`S/b\^ࣚ{%ܓ*>t0<alV6:$pOAO$nxBV#8Y aI8:AZTT4sam8čsFV~6`bHu?vYn\/w]&33bi1t"%=*]|,WZF\9${$QW]zdUZn(HIK41Yjk4Bs0򙯦7t&LVqGѢ{̭Q)ښ{) -\˄#*ҁoQufj kFdqH&I &>4Rioc2w8б7Itۺ_ EEJ"ON-M/,PB7=ls>#z(tFQ_Rm7%D0EoeT~8Y ܇/Q/|oHK[i}{̵!Sѭ`{YÔXg [k)*Bv&YBMR9X`C>GXq[Ga#m~57%6]`6VeOgU/ JG 9O+Щ2ݭ9TGDI1(W Hq JnP3p _qTV@KH]#|SE#fm=G2M{ejOSx| ,}(ZW'Sx:g) 1 +yEW`T% @z;.Nh辷R$vH >C6 Г5*`{0,BnF\8ԹVJR,g{zU:yf@\e G{2ʇ P[0ap^=yHKY؄%+ wVAOz?-3@9TkDXiBڌ/}hj>zI.˖O{be-RvviUŔ.4[kC=SA7zP:p`ٿ(AM=LBB{}mDq3T,e)KN{OgFfp3л H%MmYRkA⚝w(#_:NYkV_. s\}p9AuVr{qk%Ł YwDszˣUy?xp}9+MNS /cj㬟xlx=la|vwH $~Nw NjL~S!"u5 L=!_0X4eRV]DT/Wfsz7@ÑRgP'ׂ'dG3N~v_܃O^z들3,5aa/8Ll;אKh/$GC*U_A@ԗ WZA9HX$7`k4؃- }iL.RƱnZȜxkw,79Q4rxA0N#KX`h%WJ,! C^,}_dxEoNH,ix`v+,un~H*բڌ#X$]g F>}ǰ0\gX2; %U>{,ӄ}?t1R məo8R'K57.W^f/W7N;k*nI;/蝀aD 4K|3q=!`Hf,:aSz2PeI%YzrQ+|K Ɓ#LtE[Ⱦ E+&^$l5MPqҨAS3]g2F0)h\㪮,qotΏv Fz7=iDnTB* yKi8;ՐP9ݢPUX>MAh z6嵘WTݔ.^H! E1yiZ#8rqyVlIf?WUL*}᠈qbzdQ,!V{\ ;ܩl:`h2' +O J.Q{a rTBN+tVD> xOH[[K뗕$EݷdG>&he{AD:wu A%`O$WCЭ3E͇cz`-X7h*!y!(9EcTqo<4 cn 9;qmفG!+R! ;nGA1 nL#'Mk(ͧa'tGiJ)eE诘\z4 0l.˙d,>IJ¡:xKQr}!oV+KvV _ٜev.c'-qsEDnO 2+!Ƽy͠YA|U:k^$q_g!Ze[b0f:$KH0,YsC)oad): &u>֫ߓDuԫ <:4AǛ*`L /kzE^p]7߂ t3m4He7 #!tGт*tLp`ׯTdUJ`w Ϋ{PsF<%{WQw}yz"twF omNl5Q?~90#)apK7]K?t i|N,=D^:OW<%TQ@bEpG{foU#ߺbX+yD2FBéˬ|VVyFrjLDy ,9*H!;Ɛ DxکD`uW_vI໸ }v(n5z0 3&rYE J9٣ McAx V]+a#(uk{p EH̤ W6a%2f}ȾBo o{\eF I9vD̈́L?@5Lx`x^>2JqeGGi;y/r"VT 8Rǐ7ł8=}wc~Z&k`h3x)aFP3z*軷t/K*,nL6|@ 8&%DCQ :ݬ#=f>+U{pln˒6wF%C- ƕHCDc˵s6뵙ܤ n_iG-rI.i-qtRtQ˒E>j%*Vf8gP@f#!hW мEXyP";hj"~!7l8l&' ä+ dJG$Y^??Wh(bN@C*%$DZ#cacO!u"}Ai $!XŠ/G(KAgMn 'kuep7:-ƭ3C} ԥ48E VFޚ3ףUԼ?k VR#'6U,s\hU=rjpxky.)<&$6Vt(luP?F T))G)Ә;樿YkkUQw FODFqʠЕ ܖ"6DIHձOgPUl5 YzD.nFKE,!e`_%azq?2򣍖+cR8_mDo[ ߬3!mq>05R*Tȿ>Kbھzg>u t*g6L] hKJ'&Nz^w`Jݫ P$h.i))gDԆoS`:ic+96D'Ѭ_:"~$Of`D #K+$Ⱦ \"dtϕM9)?˃:TV<fy4\Zg>n|ޘ˩()!{0}0 TVYԉW/6RCW %Ņ=pYZt``7+ 6}ԢW!+y.kXI rQa8=m=Ɍ; gU+Sz&H%GsbH FZ:*W0#fD̸]EHq ;9W@%ED#k e_W+Fm(GAOyݔni1~2J DA57#.~Dʝw=FAgh`ki7^4S٧Ç Fe@a7sQ6%2OJ6}ICWl ibT"Ha GEu_Q,#1y )JXo{&J``qeM k;,$xF$gJy:8c8`yG'y~ V'Sq |s qq)[NF;y^4'EJ 9Gif/a/zw#\[^ 4iS 0 F<=pȱN&3>EJȹrv~O [G9W۹cB: C:JzZ S4l=ʽhc W=[[ϋ4 hynSNӪ̠Y<ڇ?DžJ=A4|"xR1B1nfED%eg O U&PI`fzvY2Oך)Ci87tHMEAl ]JOvQ~Y r7<ljJ}v+Fv;-,G܌{kYdd{6Ęy-TRJrvȫ8V;׹RA J" k6>|ڼԂXdgh+|u)@;Y l0g`PV)ŀu>%iQ/Ε@2 uqݵbgN]BV?q3TdGeY[i o|4Т`sF ɯQ29Jxd8~H[Ru>&?8}zQݶ{KtJ̭a"wv2Tli :dMmI}z2Mxv[߶ (:|V(7F%I'qI&{0RhbIi#Q)/2\ˆƀ]'㒆#i(ds!ԺZ]&R-}=ݡcg+;SAb~zpsBݱ /I ҟGJVl *cu1-## L4X |Q*#V $GJblN.}Z֊RWE[ 1b|FWk7bQIYEZ"M'V2{m6M_B\#MAROPo)+?=\fS{4Uhམ28 ?_LV >1x9*Z jӺř_֠~>7+M6e`VUqxvUO;:fbA%$>Rܵ!|ﱅQ I^}$.eUa֭!s$1_[uŢӵ'ݣ1$!9 ]FFCcim9ߧMj8bObu*?z1&iD9`=Z- (F U-^h]_M[KlRq%ML;OzX.3wڞB!l'X/(33=;$AGӞE!+8 's|['&BD4HfkU}S3KaR{BMh<NFNLZÚ^c3A2#fjĨ ,#V0v1tQIz`Ƌoդs܏W90*?}8hxjR`zvp5K-2Lo{}*52W,GLgZN݆" Ծ́)}n586Ifw𐺆K4.O'(^4M _4l_^s'eD/F2)<؝lM8ʖ&6ޯ.h fmtPCukE6ͧ6JBKHXcj*wo nLGNlfߔXZՇxܱW&ϕ'N1%'M?%>sXq+6σC_4FʵJ͒PkdNE}~]cbђ#պF݌tYkI!)e?<{.V:Ny?{QMJmFƺp '۾D|d= /I'ߍ}ɒK~ZnbRC*D2'jӶBEԡ:4950wOv"'+c4 g87;LDJ[iodw\yH,/ݒ]U;Vz̍(B( !`,k2DJ-]ӡڶTוּ{n~P,UPLYBv ń/ U7"q 4oDk rR ǨI!ƉKr~yвzۡ^Z8#S\H:%*Otg>,pA0] H~R8fq6nX{^rF J\gfcE$xxt!Oj5ζT~dI[|yw^GmV$y\62Re`,ZyU] qۇwkZ{` 91=3B9b¤%0FՁ dsihT(C(ޡ?73" ^&I F%O.O8}S6);dD[IC&NLJrj:Sjޒ*l< Q=jTZrs)%=|ZMcV!Ҷ[=_?9z$?_4\:&{=d.!Vyϯe,+yaFa1t܎4Xռsy<ūe\;gE1Q`=_Xl+0 ei$%(dkpUEB Q_Uspt_/_ԋ_ys+Ww\A.}G(#)P9YaueUNaQ53vμk|U`OPs^APzTx<10+,s6nWL=䘛-uyPVi$R(+(Õ^J=f pvvRGcz/m.-2?kP6d(IK'fT_{oG`lqkM_ DXA@nޭ[UuRNtM]š5n|vleR95rz8k.NgR`yݚ=C lsR@|`mɏ,3p2sjmW*dvÕ MGK뀕WѲ l泺eoG|n7JnoϽދDEWh&8t.SKy6< jeL $22vTǂ睧+ϗXFϭiV OJ#s3\ҍnЊx Bf%^WR (4*l#wξ>ӑo9w}B"-1MyR1F˞̔ .;*zB2|qԗI2WяW[Zt-kЍ?xl=֬O,vVd]*H4]CZ@WîIs{X㓮9UIvJ%z<OB;7 scV 9#FL㍄fK:% yY,9cVrS\RNpm#l~ ZfcV `c [\B~)ry]q셎KJ<jYJIз$=8+ektK[3GrX+d *bxSNhi~CXrUos]fg/>Z=R|Hu. nڒVpeLcLɁJ,EJd!RHcbI#x"haru0=o1T-H Gs7uR'a Z5]f3!4^Eg~uM:Ƭхh7ࣙ_iDNm`&]mW9Sxxc&ҷ}VZ3_-~V̼ɇ@ Ao~kRY=P{yћCv^oOKTK)m3ÚoDYi2ZEpWO^:43fYwL?aX}bweov< _ua$LޘEewx"k3iUۈFLýO,oyfK5<.VpkJt.zQAG޺/I-د3 +}HeTxYLWl Δ: uP阄JUٖyP7͓[ҹIŽ!}FtKvktT*VY b fEԚ/9Za Hn1PQCU@}"x &}v&$jo~ ZL|i-`e 0''y~A)ݿIfQI#;~j|A2rmW!Nmus꿊CW(Ƹ|* gN3)V!BAXgY!18tw4Gf?%P2zd-n,D%K\!RþǷr}\7b9H1jnZ(CJ-3uc-m,]p^j rj1;E`_+W>Od_dV&A}`*?3w|/ .:> NVMLgZQ( >8xzw}kD)Bu6WA۷=Ыin|`0|h#Odj2q(mWMM ;b7׷6Q)g`usdlx[B<}Y矡?9/4ObĽoτ'~퀛K.AK':WsgAxRN=g_]HUL 6+6O*`85QS2W>=R LhMܤ@D.Z7u$Eɢ3&7C#}qhh,Yi5uyAZ\s5(G gn#vޫ݁T%\G7KфrtQ@|Qnup ,^f^?IwXp/ɛj)Yy_(H}+Fn{tV/+IS7tV|j7 -Nm]\#!ΦbN"53ba@6x.rEH,ΥIco5ѕ:3ϝ#I7Rnpo^`f{cNJ]\!aOq͊ҺѴV f_SG(jT~Elٿi^,j1I3K y[0ٷd}Č:hjگM>sAģ[a!{cfs ATC:E:^ =\{#{/a勚l"'B68cRpҊȰFfԑ{' 36ce2$Wc!- ڂjPs%1nT>s: [YHW Wy6.R,L=R,E 664"2DsH(2Ex5utka< zr`wW[E?=FFNNb^rq[ Dx|uxlкFL? $beTEPjo:UO3t& wҕix~ ^̿sK<>5$I 8Fh  ĄW~Ĩâ6lχDNe0Ԟ}8 ͨKsv΅ 2`Q1`)nj}|+~afAQ1/.֧ naCdXΞLp#7@8AI Y7 p,6bKul/{mK#>QnXK*cVMMQc^TCڳ1"vRQ!܆M])hʂLpۥ|[;c8_Z> pǒ+oUcA4t`$@fbPP93){f| (Ǜ\8 M}$yzrp3!̈FocgGoU\AEm—Ca r/z^(/V1>yKѽLK4b[I}WRgg)k^a&ϐgۥ^ s1$6iGV!NC?NDP9q4L0G]Cô(,g1JA~vq%̃vt>7!kZ췕@:E Ju~PŠȲTXU0&řۖbb*V7Lj8i]q|bhVv{)ҳQ[V("EN৚Y_)I8wA!nOl}w2, ǹqw;H\!- 2"?[5۽E HEunCמǾ5c-!_TT^0 8(4~|jl+<٨ΐJ0jPbcqy;-^{Fw}" /:$4cۆ0y ׾Q~ aA1 {> 0TS4D̏[&3I )h8Tq)̵+>ù&{Hr$A+$f-HKݙ'y[#}8"y_ۮVA~Fl#<ͯң㴠.Lkjy ߊ*|poXk_l&Yo{Ӽ-ԭג)q]c3sf8CXۼ;ݛ0Cz|ɔÁ/3`ݻnZ.r]M*mfF-ă&9OMҷL}7`q_0X(slwK&xܶ$UՃ=An 6$ Gi[I8/Lu:2Bъb\$%&.py! EIpY} +Fb7*zE68$Au+hN$1 7/wXIEk]D?¦s5rb"prw 1^cbtZvi̸fЌ.<̜:l&D SR&9* M *F:7'ПbUzwpN#V}~;ݛi"H-_V/ޭ <8ѧ7?=1ߞDžO0 er`n?roY~ AwY4_חsoURL!}ޅU/bM)75Nh`إRĢW/Uqh $+ GQpwR?8ЅF#NԐo8Ga t}S#| 4Z퓒v˻ElrpHMR#Vή .3$f4ݼvY3y3aM_wL|P4"3:%{$2uuAzl5f3_YT"84 D6 (k۸d!L[RRصE&@omdׯL7E6~FM0Sg^rS #ԫOIv,pM.k^VOL=k ŰQؓШ-^5$'ļgJouRGƱzyhЫdQV& rAANoN87_a?G?-+\ؽ+מ.S4}=S|^ [c!Y:"xC: D7[l, J<PB c"4LIꓰ.<,yFs[exX@$9WB}IaI og+E$b"*15oȓq:<5Zz V?E0MΌv}mp8`+,sy b2R&r<' t `leD.޸k+51%Bp>?NZ\[D^C>}TPp(sa "p|rJއ=uP!EB .Q 7*?-!{c˂OM]i`8% AZf0jdJ:6Yd]k_{/=W i95 >^|mFh0^(" :4λVɎ^FOVd')jqa:EJ!hdMYlU? GCݡmV,6)@A%0 rjk~k 81~o"H zZĤɼFҽpXE;u)oA7bM[zFx?Jb YQnvpB8U ݬ?s3zM1:h= jf5R 0 .mFݫg }N_Kޛ)۬NqY%ENiMJ~]ut5yx,G$ c.?oCg)oxR6T "b<WO771Dc^*\b 83vأDAGIM;k6:M+pP%SR颕j*ZrJ@F$؆f/- RXGnn.ah3,<֐ZN ;"@3x6 z4*Z9{WCNH 5\eB җ>c Źeҟ x9Ҍ"sTE6WQهeN֝F.8q(+& 2x-g)xi>#;o\C0D/gخ)*QA_q@RD  2鰛Z%Ô#'fydFH,|1R]@L6ԏm(Kl"([9P!7Q2׀}B"08u7RѠS)j>:QEwI#zS8H D(tTgJUv$y|nRB{_4/2 UHNGwFdT(h8[<f;BMOs<7ԱP%V,tR{r ѩv2jc@Ԃ8lDIvmeـ(?/[5IѪ_hL.I N(5X*eNlC> .g(06. q@WBlߪoq;A.!XLw %됡zL_OlR~{z$0hYvY|"|AqY Dp,C)lx]@2c=ܵ4d8 >E}c*t-=H?3MI@yͱtsgA;oД 4y#ĤޘFa%~@H.D[PMpw>\@ onr"a@{]6+_6ңg2`Y jyP_&i -XĞ<ûo0G(F*qBMr4@͂V[a>_դ%Fbc-~hd{<' T*EuV0~W1N+Ѵ{0; 1 [!G.{=q%wzl"C;'Q_]sL;/60"!4j/5~w"i,}Hp*xAml6` 5N78V'-z$NR7f eISӦUa͂+<5M-ZM#[40\.~+(lz.i_/k:BJ ~Q@No(ʁ®H 2%iOO -G3XǁaU~ -1,..T]HLmuTbGs*Ad4/b/f2 e8#p 3MCU4.lsUE$?Gb[WukGb-Ŕs;섇a+TFb0+|ajzj}x$0Z+Ѩ<-'ݠ{ !~K9~ <=28sBbu'`:Ԫ*QZ"Q%۵djPƲ 1T7z;cdF@ ʑcRohIO}^^Tk5PmEǥd7m-i:zo@hf̴:o>i+t<쾈ChPť18nnʪc(ڟmRdلNZ=F$@7{Qli_2y +^xJ*Fy>y cq1kMm7P/bS%`]sYƮEPxL9] @f:7=mKNR}co?(wPEX„3jBp_&H(>c\.y m#)g]&2mm( $`n˵J"ޤ̶9,?` :~!?r,Y3t ȓX)tа޸Wek8l \R9Ҍ[^QSnq> oc/N(yn"eӠ0QX!/>ZA*%hpl0{M?>,ǣ2X [A1~ƊFP%>7 汉٘C;Yzg`4~ñ<7Ռu9eaaq_&Cn nXQp*-wBMJOxjAY5 v[f-R ?+5F6;I)Mf|BxLY>0/Wx¼S cz?C&oSCFa;m vcsݩX$Tiv-" nR\@)yghke3b&m< U&/dh bz֤|DY0&+X 4[;|(؍Z,w*C'70$}~Mf2ŪУK0ڵ34Rl+39_ycHKuBMj >+,B+/#ns2|qz{l 'LVMRm/X1SӰU^hª} 98nx+JJvyuLY҄P \ *_"tY~\Sj O[kuw Z1NrhhH`x%$5/sAݘc؟ȃ\@Y3@ wǥ]wc|1,aE**?SAwh@"JCMjm-)ΪKt=xJBƓE!LzZ9V K%p7$AE s2|^6O[1*B-4VY.b8C݁4nE. L8P"77NW/pq uѼ =4y+$jnp_sʰVVi|#asjI5x%5hh_{rt>m]UᘜdQK1~YaɐE7;T԰2ko=6'%C+p&֫#2޸-V둀dҠ ygVHu2B/pfH;_6(A9PV&ÎO硩jԎ_-wzմeR6X_ uqq *u-"X}a|ȫEḼ{W0*V8MJC - wAw$*wb=, +æ.X2&=főNÁ:4n+lvI'1]^*8)͑OخMlۼB`YќL/Ab+cE2W 2Nfd/쒕zXͶBB7Ӓ.\n/TIl/TFQ5-)IE![ 'ybQ+0AG'u bfHriaa mRr9ߤ.'B`_(Ƥ2pӓn_0g+o=<}^Zu;d %G>s/@rQm-',&<=4{ jG pނ?Zwv Y][gSqiwݰLNdeMz2| c yǏh1 { 4^p&Y-} 򩑸(;I)qڼ$Ҫ3k)#`WkůtO>~\"l<ͲgTb-e4qI/#iL=d:٠[:,)y`ClWp`z.;}Ub(5L(H ,5_ 893rtKyG3zSr7(_=29LyR \͢!EZhGM"$5y3p?vM+J~%S`";~}½r1 ('> [~PpkiNP fU?%|ĚHɕW7;IYN0F4p^ό yrM`jLxBrTpEK0g@{UEv!bN:[2$ xm'i {yOOQ|mU?g? )7 `(d_)f Te OXtK&ѹ흙УPr]営lHŵpp{Vk&تIA/ ^>U]5 bd[w+B([mN6&śJlPøBur!@J _v{q 5+hG~m˶Gkx3xF)SR0nV?>9dh<ZxVB86rڋUo?a&0TuR"$mDZ{=XhZ@!,IyR,jAfb!ܾMmr aa bqLulETq`@23s{tߊ_s1ш v]UxXtWlس1^O/!g '{W) 6A0JOF?Zu8F:1{~<}~Kq ߇ɫ#8͵E{˥hāЖ(*Yls wa%coa+]:lpQeҿ$W !d3W T6~7Cuvݗ8}j8^2?Lq+ڎvxI9V޸|%Զ ޲ܖȂۨуzv`:gm1<ӻ#9WaYΜXj^63JLgd 2OY)Kr#0$L T*0AYZFJ|8=Λ.d׷?¸YV./!?qnգ V1N@xĩd?1D&s;m.;"$1.x˘ᔷH+4DV*phj4.d9'S ˀ7Pa^֛P wzm}~s[ZRݵ ?h>%Jo~--߄cp -6\pT_Wb|)/1i4/wK%GP.X 3 ^lX0P;iв8:ٜ,S[. e277 -lQ E{LI/Cld%7'Mj؟b{SIO%um[~3p iɾo nj,FkM~v]MyL, e2?Mr=k0 .}\Rֆ\둸y}x;-'O8h{]Fwv]AuRlb@?\qPVֳ= Lz6`r4\7 YOnh!:Ԩ;J 5eM_b=ƴ(-E ZVzmЙ{^;]crA(K<"fgV%9⽡3/kdlo= JmWפ ҪxZWsV pZk=5 rOŠ9ZR G9%U*˚ΦK7vO␶T_%O撉)" I ~ G^K@L<[DʜsȮD>c}YAPFm[)It}8I/*E9]slV` Vc 9aO\'K+Չ{宧RG-)h!n,3}}̂yfaY)I ќt?bwg!ե%Had3wP`d#bj\+U}V(w|{'soIq+bK9:HEX-BEwMH:Uu(5ZVW}Ew<0 8H"C9pBDWeBza}3y kqA4` u<+{7{ޯe"GݤZ0i̼b-Lex4b<Ƈmϟj_հ0&$xXBL4a3$m|bǝ#=k{8"bZXg9b[Cz+\Jz4%P?j2kJ ٖ;aM35G&LN#5 Yܞ!G{{U ؚ1&V{$tȞ#׿M{)$~m@ܻuffF1 'R3I杦r:]Kgj3nQ"i~8pn~ *(&ȜYql[Ƙm5zOYn,ӗݟ`dY6YQО9,τr\W$vDdS{.~kߟm/w l,Ԭem_pjuwk}~LW ݿ#ug(9 :MBoHI'wr)Y~4er Rt\:Y;RqqΣO2T R¤ѣ9.)Ydo%ъscUC>+tϥSK| a4).)TzD.RT-gVІQޠc)On"V&|){.=GI?㸓+oˏuluEm6 U'w!3Xӱ4M$qHwgY[V).Bt;Kj?^!>NBw Udw:P,8^%ss}<`G؎#ֿ51jks-x~oj&|'@؅e*J(r(׷h&pXUK*@x(cL/u@YybpԆ9`*̊m>aGxA3cOo@b(19䗑_TG&t>j2P*ݺI$ JB <ru!T@PT9(7$gN,}}:U&Nr fGpKǦ 0wp;j|5R\1M>[e#c?V'=홐G7&*R^`봣:%\]\87ĭˁz&ݕaO =p$(g'Azܬq1ESRݱ$LRw\, " $0.7 } |+QQ;92lG1 }3dUO# zc(z>Npt+Nw> ֟‚,1`(+R'S#@}RS4-vr8Ӗ>)ǒ]9AJẠ:]6h9xamLA|{ ^p6,IF2*b a=E5 BLi1/Qmq c9ikTmm Q# \auϹy-5 oivZlgavoN,ƴyg? oj3k=l@\$bz@(^#-~uݒQ_SA^4G0oXa6RynيoD 5f0ZݢnsL`A8Υ{{#1ARww|WT ),&#A 6wܸ4᳧UG)vmOMYW@ &Yk3{ #dV `%[kz \5,rpڵcXI,"f2 z $)I0XmU?^RWzSU"HB:ݣ?ePsTURv#PyK/Ĵ` brNY #V2:CbzAύv}vt6~p`9ң5%J"mok0EG z1y٠0ҎʁCG<0B;y ֨["'r}-ރww~Al*gS$.?H[}_~m"/>MYC7-Y";4Z"k0˰) 3PoK;$kRt|Эϑ42)/M!֏ я?Ac!F $.z$2-˼_nBPN 4Z]?N9} o8Q dfnUB/oyypzŮA^~tЊW 7 d5wG=vE˴1Ֆ= 4r?(y+uyߚ ki\&m_>E^b7zt/9]'uC+ |EsRXgOa>xn=gRJt+ 1sQ .Q?ENWT/['Nm /T'4qK,.f'ag )^DBgѼ+"jі5QUP@N;kg(ű%OD>؞mQ+̿I3ݮrQP\>"M';eknszt55[{nXˏ*.7$=\Gp2L+MMmvK$˼s3&Juhm43'<MW Ja/(3En~bp,G5>*qT:g3J.!_-9؄7>FJ+Poh8M0} F ̮s5Dbcs\(kժԩw\L7Ӆ\NarhRcVI 0,t=,f} [t'Pc_䜂{?Y1k SSU'6h[% ¸e~Q^3[\K;zʗ=H/rDjZShfP~i}Ғz_7muTLr!q^$  Fd-cKS{g/Djj*GώBQD"_o/mSژԡ&l9:@y4lq}s*3>&T9a|!?gHȱvWznQ lb"K$ugA ƌ$wWt %cOH۸rsX,ĉGF7:H2JF%8j ߭ ' u6;<^ ` 74&(ܻ]P2-pJ {1Vܟ\i%5h⎟9iIhRX ;TT)T<Ȳ_}Ǥ`$©8HݞZUxT5;q4W%(ϭp3pcr 2V9G'8\|>E5MvKO&\dt Ô9Y d'k0O=`HɆAvEAƼ2D1@JkS; jRރ9>]_Ffkj&J>]H/Z1zMß^DZJ>!Jc iF"|1Q2;{PXyaGڋM9Ql).KB1C5~˹_7 Ngّ،^}M"ˀ@neW]/>/µ6$9 ("'ѷT;Y( X<y6Dtq K=zTիB7V!j4QnhN~QUTjA ގwrUTT9i樮[MhBځMэMPm_z dz$w~{zzPY]ITW^BK'[㛊-MT10i旊GX G4,ͿbPmϩM1ݐKn >]8*Rdy^z"͎%bJW ͼ HELLƱF etO7e´6ow :&!- U,Hh"GCg4-ބ"?s}WZ+۳9BVB=şcr%-hX;j.󿛩G\yf`Vʛ9i2# ۍl茠H}wދTj4[b.oS?JuwHPOW;U&iiT6f:1dĞtd^:/!gBl,bPd{ C<e@k%; DQs ;dmQ,}/쎛X0f=aAc2L1JrXjT{jJ4{86vĺ9sŒF3 -^'&TI9 }x3^kDM O*izF|fƀOCcqO9;,Nkibg((o]ti"6uGagW9>"wN+}R?X1Hrϊ.4IRQ QBGE'C*SG̠WAҶF,f tdwS&P]q.w2lkc=ft0 * )~}Ċ=@E(v~kcre^JX+1VWr ^R@lx͕r̈<"qv #~BvD3m?kNWl а+Yf7R QyJUaKECa*dYEv5>RC%?0ӲXlO9i3Ѵ+ʶEW{ԅx_!IS_eZj/СZ &z}u4ů@)Q7CQI=PWLirAr̔}{ {^C`!Ρ͈>U6޲mZ88ݫ[L ڴa^CH/''O'={_rBҔPH\9ʙy.ckƿ]k4@nr /A/SD;z^1\c#˴QgU*?{;}J.Yl&E'Yjf/X2pyP 's!.Lo @ еߝ C j0Őؐ)&KF)g_K 1ޓ%i%w!_땃."19vHP|Gu'ZFC$?wcA] }&PT0˳}f FϡEMTI٩Y&vwuޛPUR:Ħz-5 {Ή@ZS ~9kjUZ~x¿hhٛ$}hh&SX):32TZY&ZH=Ty-gw}B#NVո0rkڛ1M>(>5D3sg7hdaLE0\jldgk-R "2O<&qLkqjR.̅|mS@RLM[s/f_.<OOU44V fCcwUQLYU9sT;SɯưYk~s$,]0{\#+lh5Fs! h[Okǹn3& @*1Bk+_*qO[;-W*QU*Gf/ ݏV ,`޽D01GpuIUzvBس1}(xlN] 20%P~~åfi%f57rʱ|J jc֤)ykR$(]RpkSqQd4D#` eU!~Ql_mMJ# 2v3C ʰO&Dk/۴O.ݍpԖ)O]^@N lDHHobp%-@iXo},Y@t s%=U񋢚2IY:ƾ)9͈o6/HfJA$,0a ֵpBQ$Z{u·x*PiFǥ(W@7>EMr[pTZ29喁f4EL_GHs .'|l MX%kmo:擎[hZݢ1W6fѢdWRm2\+QߧWgreZ mJ+x#ș0JDtAǗ,0[+UP=sS!j@2Rq/\U\,8:#N!@jEWU6]3H,ƅȆ+`zL&fx`<7wq{܄o8LvmSFuv2 + k'TƓ. ݰܞqXs BBnP_jx3]ȏǃotvz0v/A -7D>b?4u0ieKΤ^?2W dj:yult0ًe^6\x9)$ TBH7NV@K,?M_ k ']Y1#X5ƇU!$G?8]Mǩboz2 m]+y0vm`A7hfxR?BPgB}[G†`C_Yv2W1W!5v:OS emR[qU`[#Aqx6ޅ2qU_ bHw1}Tk3LL >ط18%,cw^&ۂf {& Ӂ!zBrM5# SLvxgG"I1JC#O>(cݣ6J8_՞?(7{~u'/, =pZmCC?xѥ:xm0cڮ8uR:lQN-;htD"1gtQ4 ’gS1? b{ǵ@9HbkEԍ` r"M4qC.]ӰrY<9Iq|,A!Ǩ7v)'k,Z΀4p8)/= Xp_%̃lfa'k)TNg4ָLUGᢌo)JOC!! _ Im|Joi+MiiO{lcKbC`2*D^˪1OFs j넺XRO5\kv\ ]]`ݟIߡ֍#a[!;X >q0˃w|H'6%G8C2It&GV/4D[P<:iz/E[ ZsQr]{֖!;)~8FXH`7VS۱KNZH;MXrY 7%(BU . 2<ێ]h*I&*LP-@qNm 5ƖhT_f$Q!dUft|wQdԞx-C-\~d|p,D ^z#Fzœ\ۿC|"aR5e8Qh eObEWS4*P~I\⨖9R'/<\pFAy"ADP^YT²j벫 xjj˘'XO"i 3`\ 4D3yZE^CgG*AqC(7+a3&$b"17c P X#GgVԻ'9*8e bpO'xJخw,b^0ĸ¾;c &X$x򪸕iħ`.z>'H%nDs.$)e uv ɧR*jl{/7W ,#^qldK(Dp= F5.*\LX`ffқ79q .U ncXG (ca}1o6 0r֛V.zi9(oy5q?PhqItBTq |ONEu=Dh&tEw<i`-\sܚM7XD-s!L+U1 `D"F{憯:,tw&o7d\[hP$:+Ş|(Ao ]UmF%ӹ "ƇA%T7Y3k7uH.C57{'Z˲fXh6ڼeUolJ;)ϫr̷Rv8{/[gTQ'eIװEWOQ.v.RKΚP-ۖˆFyl,DL)I,YJn$HufFk %)$2&2b_~Ym{ C[մ $r[ފ:ȋUҌwAPo.43Dq^O(]!Kyze8#͜F愚Dž V16CZl~1]wyA觺 ;޳ϲtFb凌J fke1X1. ~6+A#>LZ{ x\X/!!TEuH*a{o!yۚ*BL`yܰNa#Gx4bsS1tW ~4RM6yBdneN8]/~ S{K_3QsY_]d)rആ %>zv:r*v@*aďb:{Xjo9x3n΀yy{C }XΚY%sśSQ(+{•ِGV ؙ̎eq#C_l;s5VmT^1hC5glK.̷;=J}>N ϮX+sW6Ta#/6xHÕ}i%%/d|۪u/g۝ Lw BytLwmwDѰ0N,Ioiv]Zo\P&vB 7R-stVzMIvcɃ:eHE5K5!WA=ҽBŐq65C}Ȩ2-S],Él]M<D`,|ҷD} N b4rm`] qB:RaԾg&ȵѷ@1VFe*4ZjJQiyܝ_\č'RH;#(oqn´1y;PJwECn.V )d c-N2ע56mou.{o7'sX 7.n59S+e֤kfS*^][nPCLz :3#Ԑ# Zas[͸U-E+LAk%[k2PܿibG(MA]VyrR廛P<aL1 O 74nds6Jtu%xSȵwuPAb-H1g2ئ2"o5N)և, ;|7S#4mpz/C%ưi;iY?lmq6?e SjXsJg~(<ԋsH{M p2+ȯO 'ܴ"jEz!R$^+ u~Yoά2ػoЏZ_3/ '>. -Š49懌Κ89Ԧ m7 u}fƋ(M} #4Ј>~JgҪuOD˘^weO VmpZm3EQݝ62At2D*hC6mN:yt{VX&!T/p=;tÃ+G&dILkFz~~V*,E/Lk|6Op ij)hRn%;VqEa(85ޝ}"-Y2 R5jԙsWLEڃew:I؛g /4 ġZ6'OG"f1}|K[ǧMh^ zߋE:T ܿY:+^dԇj̺i0k-ʄfȒYIr&8;qFŷH8WR(=O[/߰c?7J~uB{|(ŕ CUwTL"x ZڸJ%Ij ;3Vo2NpTǣN^JS v[ Ppj $ 1=19m<&_7 K駺]uu5 ~J*FzRQ^Y*Ӻ/yn !lo ]-Qrgi\A_Vxn1md(_ҦG)?{Yp[DEL 0oxk,^ Eє`Cq(C ևٶ1N[5@yUXu1ܦ{>v8n Z ytem=C*yl 9;/8Y \Q,?oX((HBas/h*wţ7^!JH*DQ ʹAY^HZ$$pu_^Cߦ_qkUi.x.ɔLlCv Ɉ*]5E٢϶-{z'y+.:C*/꟮$S]^u:,Em&{eA5jK1мhTS!#E.萢&UoJN:`^Sx1EO%"Ut#؎No]}W}^A^PI·mbnS.9QSyVɱ|Ȱ!xSBT>6/ -Wb矆])bGGtd\ 0({ B.*Jv ѓ9,Γ}Dah{#&Z9RiJ\^B S ;ru[*i!afR&4x4M4m/%ؚԋItЪGbq[U(g㛻8B PBLJ a]^fMSOtY X"dz#P6f`5}7-M l*ZJI2Nze=% *9֢jZrw&ļ xX"`d:oﳅ)@JJl$;9%]H̦ܲm;,p(A0as;wiAȓ^"ź9 m3eHx[t eypܫK5xky9q7He5XF )k’CL'ŵzpڤ'`@ОU~F~") 7YEIR5ke:# PE+U\'B9[j\pÿPUA5S _K+񂖥w&}I.v&W)ӟ{XnC$7$A#< `idҰ'Sr2F/{\S!;@A`c?T*7 ]t[E!e3j^e]'f6 ӏfQ+Ɲ1͝uh":'íSˋwW--O na۵^(D0\,TeU|S~}h\ 96ՃT3ruQm,s ;+(/cC 3-G֢I ~&->9:~_.>F|ܳ]K5IbW pyJa&k{NGL|lda#`Ӟt12M)L>ν?8;VQ0HP ׿O_^fNіɘ>:|HI/qٜĔ@R ;r_JtϒhSъ|Ls>REXQXB*n8e6OyθLJ=V=}CjEsv{i*z/N{>鸇1ʺW鰼df|"F,GKrh'wk# DH?Ѵޫ,@ЁPB;=\w]A!HYhy@մuqdu@s}7OO#սg{,V}ʰذC~=ӽ뚡Tؽ95 tە5tg~ B:ԧ ۂ U/ndWSfbaV-$x7땳5pɢi0[uRilP9TWS0+JSTrӻK[ 5M5W:thf#l]Y@P M312fK{6V]cZvb :/472rukr [;_;_2""`Q{PSlm +.x.&5ƹzQ_]uLW~^h ("7 :*FA gqS8zZW&n#|Y&Y7;IZL/J(|gy/Fԏ@g1ĢLڔ}|Ȭ/$ UDL!X#y6\nimuB_8TR=йq ~g#H*@ҫieB+2I1 e眊%b:&{Şސ h|&$*G[|LTXU]] `P? ˜y6|&a+ PV{98' x\C._;c5SNdR=ZrJ\u;`yn^KdbES}R; KbjdG5zAwHSTn[5465_X3HgkE2OҎ+,]$OkheLYCkS?DY~l@CS!V܅|gJ_eQn@v1 |J~wxAG2ĤQeoj?-+H1Ƀe8"QaXf8%bgzjC 0 &Jm.PŽ.Z[G!k]2O5MU{s.0]]M8@~ K7mȑQr_脙mu ?W/<kұa~Dms kB,`3o; ^9T,9)OՉF$nOVNHWE+za D#bF76$B`kJm9,GP)^L6OJ>;hy\b> 2N 1O)ǯ IE bH䧑+"7ƥθԂ=1h8_f('Dڠs۽tL5@tĕ@p؊:4'ϙ* STųSA{8=fRfZPeEC>NȽaf:\1XP#8 2@t 5%$-sHKFJXY hnkY"[H.8:.`C҃F(B&"}[*Z@TqX7>\2:D'@0IҰ-h֣{$;~>2bJV4!^Sei<3."HdjfS}K:i`9!JU,ZoB]N5{MMndY0IʥAYٱL a6Ȏm,70Je܏USzP k{<5Q RqJY3_3MnꘛڥXʟ"r<;YX|~Z&ůx^*2Kz 4g6 SWقBԵOK@8PG xsVm &`kzg3"ʡrN/I:_:Ud,idxv =@j4rxYP#zb?J9Z|`dON)Wôi)QN.Z2P}"op̄h;)SHOQ9%Qn3vŃRV`mA<8+X7>vupJ2E޸go\|H2d7cM#W)PWr| iTW َI9}` 8(52}P4/A|ۏW %%h} ߮,o_Q2Ǽ><ۏʬܐ @oޤLz%HMblRBGQ~i6Z2'&JDw/LYlZȎYFwVq&f ;Á]-{KH'u&u a%8W,W_/i~4DKLzͱ4 reBȄŔ.Aix) S*ogwK4YDnklrf~3$VSR &݆y2~5bv Z>` =|bMV-x/**aH{_P! 4e}7ȋ_=c9jN%q5lp̀F%[T[5in|A^h@W$h}l}wNh7<67SA$g)g~UKT߄0x*08{YjZƑKwy]%gwu):S}zڟѺ~g<E4?0jQ_*8[IiT ctƽ b^B6ڏH?1K:1==|]ek˼B@(e_haSЩݰF[%~g9sJc8?ͭe/ "Lkt3QD)5,9|o?s;cK׈h?3Jxə umKKGɕn0%6@s}TuxցWvzHp7hWratSӄ6]P9Xhgy/#f0`!|'S6_jբLJ P<(>(kQ.\ֿ)#jV| */q/QjҏsOԅ}pbܬL?R}Ó/g ¨gP< :ҮຣV@ߗ,ud=>*ޠ{هU~}~՗6+svE!]ϖLR4DC_X 5#ϻ@$j!.56[fU߷U #h-<v .߾-ݙQ@jTi*ꮍ{~d M|AMn;p!?&tM  Se+N|7q/KObfȷ&6:[8}+~b*n$:E4K*A?ɓ wDk-ݨEݼnm!kor2oB{,Ń%Tȿl{#yKT6 ~&AĮ]+,RN)L4: ly<7m?iN@ 5QءnswNPoTn$x9DD-v(eW݈!̫GτvVdX Uiw'?1ƲW7q¿gE,de }0?|6zôU [+.IyX]$i۔-"1!?QrPW>dNmCC~)P-0 ESpD_#N(t\-B0@ۦv5cvM2-#FK!Q1I|4VZ>s:Ebh%\һ<޳J@ D#mv!c{ǒaU)]ztT7]L [S[$%PƠRDR@J2CZyކ|o/83Gݼ|Měv+XͥD#kL 3LN'}bB6]kTB z}n([(3)e_bTu<T!t˱ݳeSOr/0asAd@GnXbx q$}T(KF_ nBG 1C\[bPiLq}ƏsǸ/qI&hr%esDVhk$] kS/I7dԹKʙ] SX{iL(lљ?hkir϶Z?psb"BSߪ8`a SzݟO s+_ NX<סG+x.z~yQu?a˼%^'37D|=naGA\~)B2I=u~V\N'_^C6P/H$1uKhsd6N눚__` :ʏӑ"e%\[=UC>ؠ 2XvceQ֐0BɤYiL~5WkFe&W;VRjlyDI qR5=-wղ٨lT4-(O-JD45H߻=#T,^AE@萃'#1%L l> >?H~8y08xsUl<%wI߾:V+EeP\,ƚ' H-[ ʏ c4 PxpW֔ח5jŷ%4u\s`dJNU\VSx]> I7q}1zކkK8m]0dVg> /x ><k Z [zhc*Ҍ\}ml?|*Z$C!\]^uGW^ r?xMMa@mqs-iJ[)zdh ๨/H`lPu/ ]7AkoӚڱW#Z|x|5[L,Pt5v~~; TT/G;_fG/ .ZE2= Jp_VR<)zb%[ Ka&FfF'&~ewG*L.吠]j$o؟<|MR{Hy`Q̍piFt~;o'c@"@֧ ;g RٷmSƻv !v@pYBgph19/[( I:~AMߪ[D t7"r>Q(Q:afքcZ IJlP58s)uA?P G*%=v8RwS`LJnQWG):&+G˗GOtA8V_l搫xhw֑qqU+ȄT${xf@U愀$\pEJI]R@솪ԘVGaip ;B40?[uNQR'G %-7F4VuMƖD@@f LvÊKtD]'Y-[?ktjB'^B#(?fX%2t ,k Oy)Ve.L@lM͘P8Sc4(gyb$b TMI ,p%z}5n֞4Nl6ñ)rAi yP=mQA0\G$Iϊf}G DеUze܁7^ GA1@6?A8;6qz):h3}<(R<=ovK"Y c [\&%uԶDm&/W8tñm y\@6IɑޛKj'Y$#*LL)`U11O'A]IK6ED,qǃ"l KU%hfq[ s@BUŮm*bw+4w)#+r=oZ_ -Ĝgkf>R,;V'L۵+:4d:]$TpEkCdo*rWWeZ㹹D[lܴV?/ri~Oӵ Fg-5D[TЖ3D-ҏZ:ճ%t>d=I;M\ p-iw9/xD Vy/3VNAHͱRFh;ia0=Y21N6z5Rog1yЧaIb&yj=a)}_`~`(3 YQॏ/«'R @HHg_2voV `! %DFU5eaȋAݧo6.)L*ufpc)&Ut)3 "MUׁifdnhr ͢Őah5,xmtj=/;3Q_&__fᘵu|Gi'$UWJYo9@"9nW[9|Ǐ7 7a/EK4i M 18,9NY\fGZdzk`i( cz,Ԛpw''*:+YwYe4)ac(j0xww4ɝ7&8 ՚ޞ ']1A=J-}q1o`_%;=~eP] (% s3ӵ[5*n܉頝 YXLHz.I\J 29J#Pu{`9z,[o:@)W[tͳK) '˳'Hfar@!ʳ:1W IKB?Pgm9zk1,?XytjW_*TÙ ?IJXأÎ~Y=- by*3R>'(2 #p;د@yh=βVe& ?;OJծPӜ!58((7E LEA#~|bQe $ei2 jeXD\R~mX0, B $gҟ02i/ FB ]ۖlA`i%q{lbzEX*| Isg#.(զ*oM1tdW¦iƱ< 5vOk@~9؊JZBJEo_99KKKӆ ñ%\a%2`Y>`}a yCGkF-|4Z1=s.Y⠋aT!r "q?CHx_Cytꐆ@P PaZ45.RjAr9Ly3V6y0-wF_EyWE/olΕ v.bmp;epauu=|^{bVFfRƤ6q,+r( Gid6%εF-*4(hW`XGb`i~R/;1JVnFVZr.h4vD\٘1E$1?|V >tZޠw1Ɠ_o%ۢu &*ݳw/04EL$Y=?ToA4/R^Cgh D8aۃ{#ЯboƌP+=|,kێ<|Fy>*? Dgxt򛑗LYY rUw >H]u(jh܇B.pE{BsY6t UmGT?8g >p7QW%;tZ,@:;\5`A˪ƭ볇ۡtP# 믒aj4(ŕEdpD6(ٷ^MҹIMy0 36̰sDyO4c@5h&01*Yo!xoPfܰF& lֿMMvðuP)B9a(G}!6~šmV)2N?/Zs22=^1AN0v_-7G SN*@P~@hcU5oq8!\Ls8,E>t>Y0Bzg=8I#;x8tPtyȟlIpTu:a4'aI@:BoKI ppyVS͘ĺQ X dqB,rI} V I2%h7acoϻjt(:, ^-V J܁:,LqAV'Yt.d;7/+^5k| AmcMJ)%wkȊZ%OrV4!DӫdbV4fl>c|oݠhfhւ˔j̦DP;]_.1Ni"g~)˶k>B.'dM/:&f9 Ƒ1x|7ș)B'[̵{e`Fue^ug0NR`@t,ܤKok?)i 4e_g 5>!3|:x1M: AqWo§'&++\a۟xVei"rEC`Yh kc6\:;Irr*j 7CǘW3ki{9Ut{\6T#H1 x1!20Y!Mq/Pl$Q'isw\OD c//i 9ay7WOO3JfHiJ3A,b$etE"q1-;(=rAFd\!]a)ώ#*tQd! A9r06Ecua&a+\o5O K;8N]*%6[uG%-r欕3IC=&;)ǺAHXiV +G@oV^`e'o ])Zs5U7nbI ǨiEǸߢA+}V Zakݛ 34o60~_F,lD#ؙT&#6ہm˥- |3* u_4Wc<'_$&j$%bg_TN!A^.1EnDʨA9ܤ=r|byoV2zh;%vnX{i@ -*_&푽ͤO͊dsk輅MoSr| txArK*K+/g9YLjƾUY\ȥ}*QۏSnZ0q}+Mh<*R/#)`@f#ʾ-Wfp q6&0hI׿EJRYRxI}'YdEJZ:rT16ց<@X>E-k1-bcM)oP^&X!L=C\܆k6UUr>BZ@ܹ:@I͟9)kƩߛP`ɏ&%7q_N5e~TY䳭bŨtra5.s^ڤT]^idFR3]N7TtD./p FY23n G w da0Q\ TrOXpomAi\LbZUO\΍:Lt )%;oDΒ0.,YQ佢qҌ[rgH_G!mF^8ZGj\ոYaV@BB+|Eە^1(%@|y/{*3w,D38X i'2Hgv,~N1X*j4YWXhӵ(dLⱦcYn!hKԬGAOOrρ0+J=U@7xnjZn#P s#VBvEee8f'XbB?@;qULY1[[`2OAɶ\Ak.SxNMp<#CSh^UꪃK6"͉5dޞzFH3DmfZr!85c*ƥ3(uQbE`kZIBCe27C{P8b/08 ?5:e{C.[9ֱ(Vm0xR3$"W VAD`[WaK"vr~O%3ypFV]tLr,-hs\mSkx׌0@n̻?29@74&? pI); ϽṢv:rmDPJc# xJEHcYƈ*[5BAYئ\HG?j(7zTcDQtBe@tS/mrL^ [:lnQP1 FL 5$x<3bcÍw,:v P4]-ϑkZNb`ZW_`]0T_bD?˯Z70 `(=`~ݮwPN,'*LW~b.ϩ.} F{/!eQZ]mxzɀ|j+0E>QvxꖭG;2Z|9 Me;p30ץy5 R`0\~R?$TrD7x=KV4U -^Q+㪩LL)Xǫ&E g=ffc`G1,4H>Y5j 5^ώz:CFhvl}lWLqȏD.p gR|dM H쮯{B`ߚbX$G+GI l\<jB-0Ud;(nXʪf~o5}q@&3>e&6E .^28é~ݍwch0FWp z4>Wvo_%׾߈ H굹 =C>ť6g53.4k#|bcO@Dv 'h&"WiQ;wg)c)L A|V N7ٷ= >w5Z[8oof=u*ikk5 s%T >圫M}6NP{jVpO繮 P/Ʋ9gɈ;QR`:]w ߷t*%x0G2(q^C U##yɱ mG]M+ ܨ\@ Na-j݄¾a/T~VuaV8bZ܃O4N`u -[P 0L86,4qLp*C?uD#K7BiAI_V׉#4 :496%O OJJ[^ uK,Oz"l3̍յasYm =.{OaxD1uyNfa*YnA7bmx@X :|D i _>x7AXi1] HMMNs.VAmc5GXj\PsAl _}Xjļ-@[:_u#0"덒Dދ8=~sl 湝[qԒm Оmr}3DSRqz ;zsZٔ?nX N";]rPe{jͩFM`HRNT2kJ5ԣ2nV8H Ppϰ40|efQJ5'S`8aL ršĥh'[4>{)k6ok|eI]4<&G4˅fΚ3#F\V%7pnk^隒;S9D̦=41,5($ %il:%T^nN5.O@ǹ]T ~pu A ]xy7,ht>~3YZ]%"V3Ki KԲqnP)=<SHH #5wW829jc;a Qe>^0.w9:'1$XULXi|Y(Fcw;b!P\ 䴭;0z_n` w/*ݮǨ (; 8] $)ayIue+]p^7_t(gGׇ]4Bgex̿ѿU@QB| la j{h1ٻ#9JKK/{D&KR6:o[yƺjI'нRb;b4D hQ(;3rJYOLEX;G:g\):*6s"dj p D3rN{k;}Q"eP'jٖ*8v{ml:Gg|.uhu:gIoh10,y dz+BZ>T42k ^Wljv0ChAgn-kxH#ƅ BZ2%#Vyf[_5x-\)L^vFrPl㙌GYzʅ[O@k}; otK9hIMaq+`ticxȏCus t X{ֶJ&!LҮT,Ԑ teڭAlNI`~ d^|֙adH>ʭ^0T a?q AԞs>Z **d mNڲjq2od!Ćt.wG"({Hjb*gj@+&gOXّ@wP )Z w,L&I"a U!,Xj%dr>_-C@( VvVbg熆 1Yi3WM212[`?rmgѲAQ$Z(fJhc+ x{T1/ͮg< K|:DMɧ]8Vk-ハT!u SXD+\SA@K]\9kT$p 7Knq ?*|!B&u#z‡Hf?li> d1= 8E25`!fo_)wfHY0 _Q]S~'M!ܖI7'ίhάpUN:<.+%3-7Iݶn K 6u3 tqUMţΓ.W}`hOɲϫFw `qYBc9Lp9eLl݈ni6tHx滵zN wZ 7Taa P-˪ZftG?Нq=ejwobb~~gNs}]zx=ӛ* [U̔ ozsDQ{t_7H͝NժA(Ttl~ D*~H@Oq$;Nw >-gEL p1+vT8$ԗ]_Zz8/"mcZ ыV:O(R_kq.ۣcNt]M,tBާo/uM{uje[ zžUQ&pe)Yh-A P$рϙ'E՜[lmW`Af e[{P,Bմ*3ҏÃ1Vٍw/TS@X)2@yOY.%1F\'Ir)+/ *),#k i5 w'ӿ l;1w5 |3T\ b] o{M&s* yTyxS7;5xzUQU"Q;y%vJ GFrז5Fsaf9$h\YgE5Rdʧhj=MaiKk㞳#;3`sTw#v}XF54?d`Ufޖ2V8a^fʸ(>kAaVrK|$VBOim|Z+?rb14SB\t+a7|5 Em~\q${%'2^~aSx(!m˕g%U]!O`DN0D F<% B"tksФ1ȇ5i\`[× ¬<`mL蚣$ʁ' "nٱz5J&Uq"uZ ?;GH*?a| 5) LcV2h:Cʰ'8%ɩ${4?ۉ2z}u ZJ @ap1^ArLOz׌nM5-gxzk^~Cr-Tsr8ɬ:8HӼ!w~W!޻BN$]ߕxpwm/TץΖ)]Bylnj7`|.Si~ rWD(eo,R5ž E$la*ކ-*u=ͿSlAz@ W}Q_Xw3TGQoW酚](5u&mݣAOXz2g/f P0:z?'e-W4|G#1lɏ@QKkPخy>5Ϡk8:\j\>`ofl0`t^U>G6Ko8WȣOJ|jN:QD$xƒY ) Y3|@n}`L퐌BY;b6'#[{dP›/gvxfBI$%>^6P>\ĚhRh{|dz0@FhxVϠ"[Wqb]w6xjzϣ~ ƣ@0 B m` uE'w~5җ$HhM& gb "ⳑv)*d2Q>w>D4֣ ]biJ{w?{^4Qu>O+t9ȏ 8aݥGI|RSq+?s=Ftٓ nv͠/9)#BK`FMYx=;4~O d%uB*r{2v!SR `(x y2|8h}邅&eS5̋U.i&+3@FFpn?)@L& 9a|n ^iF'&Awm+(/R& B'n's/];L'/V'NȈ́?DրδO.֦Q)D牲?62/QCG\LKz5<;5L86|6Z\6x!6H7>VhXIy $ꪍᖶ~G"XVr1(9` y N DMޞ5-0#6,x [$ӗڸw,ccM\a:`3^Bv$;sk =-&QqBM—2 MJGnX#!8dANF'fs;FlUd2UgOd |L#μ#UQ`?@RɭtKXt00-U1 U~DäԐP-Z 1M$k `35 >ϛ5am qUgʕ>,jO30DטHpQűy\Z6~+סΈ R.|kHroq)CEb'ҏSt6|"EdR@J-uGST`B`r--R;u}Lb3\k|xH&3C'M^u<-{* ɱ;,pӠ/Y.3 6.NWm6]W4 h!7(_W [ 2ʞsemHw.[):AZOKahԧ$u :H7כ/B?2~}Q1(ʕ4oJQG MvXţЎ1Vp8Tʬ#-ЯvGM$͑|pj:q#adZSev7j(Nqg(&'Z9jj KhӞzF~v]Ȧ (2ZMGo3~s%S(v$UrnX H1`y?JsיKkBl8!2؍ ݞ*1X )亭IԖ8{mʤzM|eB)kL'!L w@I4>/W/F M)l6]y{7a=k~;KFشjlv-ʗw,>Cc^?D&Y]rvi*b1`dTVh-0pq#؁rhF3pD^mm)`^c1#++ в)stnyKs\tgÙmTeci ΐ Miٗ<)8kg-q\ a.S;~TAn fU Hjy2 X $Ow7?P׮FdM+ dUYoShI%bQgCNR)&7cj6U|- jlt#G^eTceiUj4]}Ai22 5P9WYZHjŃ#6[i)o(>zhC-@w'(qEym2]Kp;jDD"e70Ql{c X,%ߡGy1"rs 11qXI/ /L N4&4dh{XIAJ(!-ӥKYKN5 ,2a4xt<υWQ?~ޮj]h6@vfdtQOb":κFRԬ|o\~4. 1Y\5v+SAR7?&]#E )kR|PuǭUUL4]dL]C$g{Iubi;}y< }돼H(ЇsRj,I%"p% L5V~Qfja"ڡW(CxN\ǽ"WTnEMcjHcy] +GK#d5ќzPRgW8jn16 F2I`@KXŔH  j&tSOm}g,>r/2됧:۞O DBr F4#*3^"~$ :]Y8+ϛԍAaz 4``јkeA*&{*kg6$aMn'o20ʅ]Ѭ.vJWĐmD SS)O,376a#mgM=1BЕ,i@gE[}3ScN{UBw1iEY =fND 09Xu5/rk+.X1FKs)y>8A-J豓o9&7>7R(gMcd2F;g  KdCw4v5]^1%Kfaqt8Kr@O*7t6MhgSI29-qW7Nj"5Gʶ5.eK TXwhD9mF tpw[+OyC!s%+`o/v\u $Y)0տ^]1zmos z]ol|Itلsfħ}POojϿ?x8Hs ttvLlp>f܎0A?Ng-ri87BA_n{0K0oE&cIgkL$HGO*vWH*Ѝ8jˏUS;%vD1,bW\_n"S7I^|݂*˕|-]J)k?}skB \)cj}Hp }0L_iɂ"萝&[?}DiS jSY6?w.A ڊ KJ[D?y?fmlź4 ssX0LzsĚ4K#;b @7_%Atz39MCxmq*0-CS%!l5,h*s->af^owN&q@L$D쐟\S>s1u: .u&v JN@GTM\ 0E+/jd5bL]5*-UAWݡˮf^ٞY8O 1~ܽιjq͹Ⱥŵ/+?m`E'aPbMkd*< F;EZY(yb&[-KBMniv G +G.H#6ţ<f!7R07VWy{ 7i8*<#.?뮒~e s,$9:xe;*ño|En%;L<ՈI`cFo^r殆Y$HC=i"zy[0U#kՇؚ6"zQf3GYkW*/n|6lr'] bjysY܊ d)V~ i8UNW#WJ"J?MD>kN+ki@kOLJdӅ c+rv$C{ ?wam<:Rҗ)X$BUe"+Ffh 2T:7NZ&U6CiZ ;[iG5xۓƍC1Tm85N#)Th7CL~7UL5)ttX*"TW&a~B,SxcvV dC$f3 Zԋ⡔Sa1džP]7j#S[5; #B}>\."A)88}7:n T}: ,o>p26$4ZXkqWYTJȇ]`Û/Yp[U퓽 4z#m$!#k>iVi fCI,Б-Y;9u$CIl #izҮ!^&# ._R*-ai0O_mbU35[{_*ՋmzG0=y WBiXkso~M Iyo->nY8r8CÔ(rpȵ ~̿~~`99;̸0SYDyB'wϔP͚p7mb[)mHx tdr5ެFt6z2abRg*5Y!>/q8G3LKa`MԈʙlp%z%>՚bq% zOBqbHZ FRC dgH^vN(w~HK6~ŏ9O˳+k_Hu{Ҟq*1H0ONJm'A5UzO7+Dakn u}$H+*iqK`Zfa~7\ Xh%Kz"Zwy0QϞ!^M+6`%UaKy+f RYWie&\t#swJL䒟{Y@Xdv ̰J,.ה, P,zF~x}j-]5FGG罋[NR e]X/9@_^^_ $ZX30tzp򜣁qʕ ,Tz< e߫|Wc}+d5C٭z}HS1? atZE"xb8R[y6?9&BCOiKۈ3>"{iӿFQH֪HlLs6|qgE]hMksZ:w:mMIQL9j{2wRnkӪޗzw^TD>VˮUYonl+o=~-X]Œ9%Ao:$X/?|TZ Nh(K<;D2 |o[ bVdWtȎRlX}or0.C:l}r] eVon60HC6sh}F֤iχ{//km5_A!\RCk<Xh^ɔ2<>:jNED unX徒݀!W~Gm0\r2 p*g*R$ӧW:ߟпcI?4ٷl?U[)T=䟤=>)|*Wv2&c{AŴh)51چ%u)6竈!|~2Ki} x𖣝Iɪ3;GQh Ps/BE̷,+)e'y:A\|x9x3ui[zoI3NRa)V+ #5 lu o13ҔD(Sj{0 )(66Hpj1y9aL&OT]"32uw#?>F;eqy!s.͆*pv=o I7.uN @_{oHWf{w$N+;) ȾN..``H!R%w/[05.@7R/p(ޭPҷڌ`EV0q ?z7rWw bcdb&wP )xPaׂ_k$PxA~0Xri=v0bTX Cf SlO%'8nV8XR'FVN6t),۷wz~ \16:̛[=uQ2i+ac3az:y6S# _\3"SdЖ_Jn])Fm-~jY lElqځsȉpk3&'XCD5DQ/\pf7_Ic%n1O1>*?bQRh8:2q$v$;&uQRb;_i eћ"dM]\~'q`Cqٴc@J }W:6Ax#ɊJ;[ 9o+U ۂBqOurry|zn'V^݆Unc>kט; kI|b_"ꖍSy39ӖװI*ݝ*+_2LB59elYOn7qn$Z׋P'7]GC\s`C32Z+tl1eifk/~}Eb;Q`R{ g~24wڟEhjۑb/ h]k2/[^#6,Cv%B`ëBt"/ zmEc˕{Oĥja-wSzãY7  ^ð{f Wk3I ۅ@Oɲ?["(} 7cS̠ "0_>y]T:U_,p!J]t~sq;LHv)%)dia?W}%=tfSE O}VHc}`,.h7iC޸X|<<TiqN.F=[M RO(rwԬ.rɪՈ}Q >HO|c9)ub &~ ѣvêXP`v\C/}j C|Ѽhyos/C@qաxU:~nA174l\e#C ÆDŽ،pƃiͺl1985gEFFLTnK=B$b6JM %*gtԟm9S]}ƾkV58Z8phGJpAz4S7 *aOJzi6/Z%z.V_FfG$d& k-IW( (ԍP9 mi >hQQ{6U٢r]֓\C-z ESlNscymΟ<4ȼJ94__C@Z')\BzP0ĉ!UeBM3X97| ζszb]u$Q m=y t[70_dq@,Id: έs%T}v] [pmzu:j,~VdYhai!LJqPi3+s'=s: vy6dwq UoFm;|HRB~)2ܳVjƦ`yx$-x]X|l82Q cf5dLjcSwa^\~ȥ}ݩ#ZϾAv"dCg RUEϙԗYcEL`zIu(M,F:RSFYz :JMaA%drS>^͝ ;?]+] ᳝9خ4>vųGDA#IJ](#<+H2_3< 7^ `.nX'f1/o&\E3KKng6 gw53H6}wɌDlYy R.IVVF%0I 6I3Dm%yx/3{M1 s|xWmϴU| C|k^OB7Dh@_PILET q8PbĒ]0W$Ļ2ʠƢzdͻ"10~ך~2L08|Ȗ!((ۭ} !sJeWZWI]vE Y6{@cß !ƨzƝIP`<-@>ȹE[%{+?|D*hNxv|66e]111[O C;kpµ@5EQ pֳ~em@?)ITγ gT!FƻO&5{t7W'2i׳JeG i`(?y[P  wG4x ߅[e2Nr8EpWݮ!Mil(à^xwy` X݄`_ sj/tm60U~oG!lˈ0˶W&?.ȟ hx_éovThs6b209)\ϥ;rݐr@EZiHc^snX)R8A%|=gxtFxL׼_N\ BLK.$~5[{O3RnS`Y5)F!+RGvj̟A9Kul$p$eb/49y>IVjr3`RI}hL;ۦ(pTA }5+(ƯW+3~S N_#%k,a颞uju3 pz8q9K1{"硼C0[7 U,Zb&NKǁbO)~$o ;}S^c7isuu(|5CSli_0iO#$0be-f_?ܫB&]D7c0đ-RK/؟\҂MXPgH)3.|sJL|,04&&ZaK-ݰi1 QzM4BjN{q UTCkoQYVA@t# J9_`Р͠.LKx9Y UKqAr&ayÊzɱHֲ'm],tvB#sȉcL/ ]_ WܙQ٘Hw# 9b[+OXܿ~+F a۲4"5B*ZLⶬсѧhQV C=ΐu":~ώ^sߠ7H+3UGpUkbeͽ갿@,[W"JUא +e49[GcDg喱*f%0ЃĤc~ vԋj`G*xؼ!mqxcxwi08YIaBB<7Z|Κ>|,Փyųaꬊ1fGMOu]tjƺ})փʘJ9bTtjw=_cQl5P'8X +m ϿGfO=EX5rf"4TM < (u-J4,˨<уI-\gv5,%*c{S6,ߒPy Dw{?s-ɴ1`(3-U#S"ZV{jV5,oxw(7"<ѱ7Ksېh:p:ow樝FzM|Quڝ=QH`?7J`Åri'{>AjpŚmg̱fdhSjyÂ%|3aokG̉/(صO |t1hBl7a~ :8bն= Yl|mY]!z\g?FЇS܉)7$CQmcTa!r5QFތ{a90L6jAV)Ż4iJ@f˾fxa`Qx!̴d)I|zYI.Ss1˛}>1*acB ȫypa1E@ưLGdqC? 9RgJn+)cznQB j8E,uO2W9iYnlv ՂYn W)لZC4~Z8D5,WBQu}UJw`*wsb-BwN:y7=o{J?>+SR20-6hP9IOdqGĉ=ԁV %X[- * _WBaCH$Iirkp*jzG$Qv6g N84 1jj3q7WBLaWTv:[!ͱ_2$a4o6Nv/L;Np?E< lYw#c;["('\_ٚµ|@ZЧ!M1rK_&(S%0J:y$B p.e3AM.#ԇ29~_n_h1xt|p߮g͟& &j,z$JZUo9Fsy* Tekh:yVRF#yZp_sga\CŚ1dKQ`y:[Krn#$O ֪A-<(ōW_ dYRG~b iɫ\²d6$Nm'lXE%"oR}f oMfwJ5M>WCTr8mB1;@0:&l{$Oq@k(H9v'5V/RwoDqӋHO6|KA{w4 j.#?VnGH$M jյ sqj@K&Kr; =0!?83 y|v^r:łZ\Hzz Jt p_ o"edzMEZMEԕ18AjS'a_U~THR1V xt&yCV|耑Msu*Hqy6m 0f^@ ,z׉PoŚqvx@ё-r-q|}rtل^3PV{K;@o"5McoڕEH)Ǿ2^Wvz<R 0f 1E$pSC(?2΂K3ܶ [_? ~;'t SN*gxR"t[M:յ5WT) #FFkr8hu 㿭ϵ^:U}&Q@ւMSz J]bO WE5}aTNFh@jý LؽkUԺ٠ĚHgPΎH2jFSzT#^u^](\qt$,`XOU%A~2I8Kh;-I൏An>7 J,izGҐW YmO>kB"cnh.=k`ÃA^~f^A]8Ip$$^c8{ MQ2 bhi?}s}nďϣZRZn {3uq-fȍ'wAj0e܂ԃ=2ݲ'8V O8J!u9:DVk-z*R? d߱Mɿsn^σrzVAsfmPP)6Jp.'j=s}[1m묞IݱaWx>䪻vDW^x-#XޣS' _[dCif:}sF\vLhVP.^>'eRYV 4hő#:QM8E*CA]c”?T}ЛDMoZiiQ>d KK`-hdhzwӔkC:4:-D& }oږ4+\p; )m.P>ǏZo-V2( v:6 ö}Ǟ@zθ_x=KtÌ=a ۉ6ĥ?%xBuEVN`5kGsL0@̣eJ.쭵y9FGp'Јy:ȧ=CGp˔aP YOQݕ1ä&"b -uoߏ47|aN;Y:"ţ l<͐vz7gp/nUIHB5eζorw6 NA4G<ٰ<~͘S.o*9tQۜeGU>\6Jo=C]UpEh@܊Q##OWWJ% =#j[s#D= PHINj x"ԡlFvm!OEg4 Lg@cYo$W xLR}R';Ih*9uZȴD-ѥ=jf(>Rnػ\L$OSUi(܈2~Q8~\756oܸ*+ h,Ů ,Q09줅P?ЉR{d[ͥu`q7tkC)OQMB9"g+T67f)N]A $[KL*T7{ jf5TȒ_iLj"& jE`wIb`3U̸wu6~qM|9-%z %|d,O_e~>776r @O]8>vO6?r.bUhl-Kw;Q1Tn1gCIͩ:%5((+GS NƧ4LvPKGBwNwނǀz{#J ǿ!- /kQyR\P#tǝ'Ve&iKDdfP*]Oѩ8Fp ZEl@l,3mC,w3{1MnuwVۛ##tQw̒3Y8lJݹ4g!5Nq_ӿޞ5Ii-DyzT6ED#ӟSD;X*^A|;KSSFWf Tx\,7*<i6-D-pfOPϜmɩ><d-;ؖR4)tpwc6~^\I6tcB4H%Wza/NqU-|ݯ +67qx eGOJ#KNTx_`J57=0>8n{tV6ɭ\3a"+nۆE1{DЖ»;3l dkw r5GM.1ڀPӬp%ԸOnPYQ3l;m, RIb뉿~m?X% D E2@QhC&VCQe`; kse1/O?2_|6LǶ?*=`Nu9&:$G"~&A^ʫk^$sCح0!]b&Dӷ UEL6S]ݔwgTgD&ۜFLI˳f+=0fxLba`(2&+"fjjCUNIw?RO#goq<<3}KlMmB_ V[8X3# Wr;rU/@y7/"bgmz&o8\gYV59iR=S 7*0+q[Ē,T !~9h'k@DOD:`KYȅn:P:o'F]TOy8JvA|#녨v-3N_s p~4D͕WUuME'hI-QV@5zmo􁺷RoNgMu9sy$%Z%3"lktv;siIJ\ |RlC<Պժ~ jW nQ5p-CfpXn%y;Zg1R7PެekE@}Ge[ni*V( :Y;\3:h${;k9hʹ4>2ƞm@K)mLJ$J -x-Z1|ÃFĕ%-C ē .h4,~qA 0IvI.W71`ZCV`]?9ͶoY 󥦩N1w$Z+t#e{BUhu7ݮd"Ty/ t|>C`Zps^޳nѝi#3u+^_UelGnkGM=>ag,z*\)8ɽ [(Uvo/'xhiS삵-gd0dB[&.;cg`ߧD1 P;/ 9^r:۸V`4&"Mp |$#"6[vjH7A=$5_duz(>]ϻblZ3t)M׆̓'Yf'}?҃9DvxE' xTP?l!M^}=dKL5ԥ*3:n*6yz<[l! b/)[0XfYJAt/{M,֯Ui$FÊN}Ɲ$lsQ-%L#+2"z[ \+Ek!~P#?ȨrgH4g:9A*K(VU'->ҖLf"- a7,;ؒs_(٤*v\g̽Idaڦ z I 8A 3@"<,XxPepw]ͦξV}fE߀f'cc5M]TGbYUn.TӸ4ֆO&,ܬ;s{$V?a(#M;L!$5q^Tn?-1zs:JTPB<$"ILm:)pb i)"# s7gM.!BU |qd5țbHWFI :rh"t;/i@qx;%zyoZd&>Qů-vշnDm5ڣ,q?PAc,VacTfşxތP՛6 WNXkV@݇mF''2h`z(_ |U߷YȭR)l&Z, SP>{HAYt1Zj@]߮Mwem(0WW^gkx%kL +mr `k "Y"|Q+@rFhS7b2" {kw@|7aW.u`gvnЋB]y/$gԂO]Ude jb YF$]DzC"i]n37(Jǁ.&ÍOWb,5ʟ4*Xf=uȱ媽vHN~ʑaqm^'햇,PT&SrL:m܅9U*ăUuU y1N0*ʏc/ +H0:kKZ.ecׁZ*V4s`^Z &R@0<ռ]x`Q1H;~ ; irPChx tvZ[dwHe=If4FͪKWTn{(Մb@(hPp\n_[mT ``~bV.?^劜Nl4ڽ(}IvVOHS7i5 epqf^>#sb_م̦:<ƄgIs%hi50OW"~"d/ AyFS&[]1uPG쉬mkoǽp_cz褎NuOZmis)"aF^'SvAq"#%5=j2k˦ $MjO_LcvU%@;7WHjPشIL.S{ .W>&.L^d뻁iI0ԩzeCLE9"#5UX"yPM.{!$V'~dԯ_17ޱ ;+>2k/yj~2$XL?) ʝ"JdsHEN|"{ۘ䈊L85m|6ͦRrɒ\(q>e9f،Ce MN_p!C~ζƆuXt$mؽ[_5E%wȈ9ז``\&ZY9j0j[\\5t'52#t+i˅#v+CHo$Z !4@'P(Jh(49q?[t08qvKnK&> jS,e-e SAW3좬5ɩE[4zuWz¿O@ 0Iu"|/ lUaPL{CMsJ|#\]K^e ܊n# tXC6 d%Sj#0$1[VZC\k/Mxl#(Cn tcwq$Y'U1=>ijɶs`q9j=΍l8N/<_Nt2_G"FysVLZY.|DkTmApz_GJr`oKmNm>龌t'eL<7Ԉ i=@eK6 ە~4UHr`~O +}p[71|ZlĥrY(,t )uKYPMy'i`ts{*d~N(M^ݟlt/w:ia+gbO#n"|OonԄBChmk #H _Pw}$ Aar{q=[f]D_+Ǻbj']W=ЌT8n:XĈI!U}kK+,7FɮSy1tU +YFhve \]GsU:xQI~ۊH֪d~nW4qd} Q85, K澹, bLߊfb^L ܹTCbA-{4 Z iP>~7:t" 3[p3K,@Y|W|V`7ᚇsSnQgO_NY k0ی@mUʻ3sȁzɰ&fT$NqRˉG s\,R"Qg\2}y-͸ nڵ"}[SH P_W( ]ݼ+l[d*x(,cx#H}y5} *Q󍋙\&=$b3WVyqwZt!#j[!flK0ePaAsb?z"rqIm@Ps%eī+DY]E.g Ez7P؈yG|)$^G4*'l.HB;nŀvfA| 7xTn~*lkP:p{ 3+ 'm7AJ9\E;MP)篁1}Zڻm"rQ\.YmKڗ@yn FtSg7>%.&&os<r6_/Vk<NtmlYk~b$CՌO1nYMz^fN6HІNL8\+դH(QuǶ!IKhP0ItR!qbR OZ2wjM/Mͅ'2sX= =/H+#ډڣ Q.q`4% *8m0' c]f!8IHف5CS=(UCs3jL3M(yLw's25xv ) A?7Q`9 g;fP⼴, SDTb|an$fx,Q.ߡsO:]ߗh!ĩ= (`["$/}k`qNpo?nVJwz*Ýn$Ж I-8|n2v{&x !-8-DžD>0 U'ے"f; OVU` U-YSIt/@㠭6CڢI<.PB?ဲU+l khFv2W e($JWQ pK'>/:m#j i>Ԋj~CYsrS%HJ[zLb_*D0 =g/Ծd?  ނ^ۘ+т#P\p:ő=r >\?ʙWa39|uE~VJKN'b'}WwmNQ:}? (aD[^WCoH*\;} "@7ټ禱)+K 6P#y ](_x5"ÂP˶zYmwWnu\dVWt{IZ 6zr%:-|)mUϗ괻G xX?p',hHmmciZ6q!ҙ3dbݥ9X(T ;-V<4NzŠѭUƫ0u2brS]:X2D"z(#Qxk4|gC|/2ժvr\[4dbR$yI+va(zq@dR6-nop {@9s>jӆcWzFfvz3[^9N65Z'@ĻD9bHF!-8@2ݖikvF.g!FFۃ&p0ye[hd2 ^q/ H%"ӱH]W6>+@mlJ(T۩$~1?<Q0Uz&y?Cӿ7 ss@sD`nOm7o,4?;`,]v1l,N)>aƍX,ņ;+w?SU'C([e!T'Z|&K][tn2&qu-UD(bf݁`-һg LQ ֘1z-$8X}ǖ`B|StgܴSP?ֹΰ ś#͋D9D\Rl XgwRiK;&f jEfdLs߁ #gxރF9 BYҷ"ʝAJU/YbJ!Hl=%J"凄LR~L0uw]EPP?*g}F?Dt 3{ [?b౼@Frq\mb&ƚ u%$P$88Ӂ8aƭӤ`#e÷P#?>4AuIR^{I21~\9h,L$' *Gy#3E&|Ki?Qy=VZyl"VWf4~Sۊg^eϧ^М尰zޑ O q-l~B[2&X 9F84 W;L~W XvI0}<,+,܌a=" dw![ [Zd\wCRQ;,BybsfW댞+VnLHZ??5s!a.$ca74AOڢ}8bPh]Anc֥A]_G_$ܰqH5fqZdRVy78xJ9a3~ۿ>0!OĮvux^0Xq,-{gDKL49m{J(/F]V^6Ug0*񨋮{'U[ޜnى}MOOZɅlI`8"Pm6M4Ox5;*fme3bD^ې$*!; U@!^qItL@LJ<ټx*ղ"?'84,kG&5+-eR ΰ_vcϮU|k9'eb!1+k+c5;f].g^5ȇxkIfVy9B ^ea٬g 9h^G+e =BRnI0x5ʈ;mtgwّ%iulH{b*P~F]}6;xݖm ZiFWҴd0R/ɖч|F-Б|+_dQN[Zj}EA՜>y܊ oPVT:],8zx6>෽å1wHDFi,F ,+jN'¡LNߦD\gogU" JjUL3$ "eַ-Jk;Lޱ3&5?g+_8S18C^ϼjQy K;X&1XQ{,5J:{`/5lET/R`;+~+Ab vAW vFt"wq_\0"L eZ]s74)Z$)Fj0\JCwAcF#ejr!<8dْR#rO@ Ǩ!I&eB2;Y`^٤aKM* 9w| K+hZJ 58Č/3|:k[83X%;4n>~.#5Y\pBH(yLܛ l/b'E"m̤O0cGJ<&y5.Ʈs] ,#CܞzP0bV)~R tr/qH<`|(FˎK[85?Ti=n_O[}0N1II `-l,J4^$::Z Ddf6Nb2}7LBї8.Yq-OJ0NoQ8(-A Qux,ZA9b;V"o}#~WT:KzE$뗍2;Xl>(qLiZ)^hLB+'KFmC<x"%-Y?!c"yjP\ĵ-k@.6\m,6=MuTyW~(l.V4[I{e>fYT8BQ2(G22exJGPL-OM"aV)^Q/@$'<8=,*bC! ^|Sf~1*I;͔W.WiRH_/,W~ (#~ԏ/Cy4QC?ֺXF}#Wi~zczvarUnꂡ::S'GK6 G } m߃KW,k،~a9o7.̌wۃszT6s+ZL_K;iqݭzl?ފdJVŤAH-OC-0*IZIsYk+BZ YJAȕԫT VP0^3UF||0s!Ef йl 8`+ 68ct #Ч.΂W#,xAm* _JX_3 |t +I$g2=dUbf'_S`h*R_n}[Y9$b~fs@ՑY . }DqП@O7 F~0!k0 b6ڎo [8dI)_Uk!:bbF˻v5L 1z_NT'umhbv]$~q8kT#p'1'C f(; vx%t󐥤 Ұm8^C*s wК("<}JO,%kc ES\lOۊ[*GiH "6 o 85 /&c  Lms\ wܰ88َegXua.b8eKUᕃu6Ƃ7P%TvF0KBxzcZ)BnZнԬBo48߲: H E`W7'cRSA&? ԙ{=z_[ CԮkN9Dx: )_QnG^0JXZ8myh:Z Lٍt(<򝊕HHn06f ߴ"Ny=xB!wAߣe߱\ >W H/r9^׻`6bP@gd~Fpw#ޤ~y_eؐf|ǐ:n>}"L|uk\~ơ8Yze crw97z@@5!#^w΢ }<{M[䝶L `Z3b[HM9ypg Ryp+%4?t(N߿ᙴ3Pzr-ҭ+ ѷAqv{| -p#^A"L+vA!n<0bOWͰ>/ ~mA'|_X)Mo?6+y.Tqwc5N2ʐN ۻdZ|EtF^N3D;!HwxMQ(:K-kNxm*q` lj5X /Aޱ!.65ZvBUD# u\g[ԣp %ٮoy+ވoN>2 :m ȸs— ,%dI2]3aMJҡA[/q?D命I.|bnbI =?BBu:TZ*I 3|*l 4ݽ <sp1& ]^HV#NKMoϺDD4poN,goNNۜ1Ϗ5%y7my_3.H|^Kߕ0! V:}W C7-yGxD6Cky.]< `Pw{*9#Y<"\k#sYl2ো@NhO C|;Dlt;"J򃁛(Kٔ$+(2T1oNEgQNJ8>3P[=v~|7ՄcNf&1}94ZᵊK<8ށ!sjGu _$k'(Z<9<䧨奖 8yےOx=G+8N.Glʮ `7x7PV͉(ޙzc9& oL'˷, qNJٟoo⋎O+{|{t+/ӳw[!%mh[L2:zݷ*׍ Ar1>)ΤZ+br(+kr9983œthKbT ꊀaWUA+5]!oK~tKb>>f`-wq2lwܾ9dI*S z8/"AG!43f"\lڬN(~LhCҼ{Vj%^Uo#'_39 v)D?z;/pyO?Pb[MvT<%%W0q&IՔxcùe?_¯j&0]- /T9&?cV8d{ $ <ȑFHCmŴe7ɭz(5PuGPiT?^Cx:KyFDхR0"5 dud0ļUzÁMfަ)rHy[p*ebUjqS F3\3aۦ К_PQZ>0wXaQmm߂ *oxC+ ri%'<808FX?ʝLC=F sǞX|  ؁0|V(bYѦ:ʬ[ɂESB[mޫlܢ XT4ncp;P.g&f ~¼UEKT+ZT}h MiM טVrpyRa/QJ1hɒӕ*a:y:2H 7.kZT! tYs#\G#+].# xy4CF9Ƌ6m&;灖: |jOtx>vQ:c+ucs:ߦl^Q0 >E yO O KKX<:7n!zϚqⷰ"RdW 3vGp}\c;bR,-̓.xawrlIRwRpD"ĽvPv_K3B"PJ6N)&1`_ 8ƚg$p"񙓛e +$iQmhT%d4YUku^LJ1t/ҽK{;<~ӗ0Ua쳱R_w<""īm[;ǿNjriWٳF#22c)_^oi6҇@A]-ߢ9DS-27Xyit(ō)s  kx[.*o@[d=)u*/a7m.E2>G ,Pnnm"$OF2.NaݺV쉲[Ku9% w5X`c ߓqSԘ}q)֯vcz-b-nT[Vfmν&rc !g%5٭w2`R"|y$ b.U ʳW3}ڀwT2:ժ>Ӕ_HFՄRHg~j餩F94x>hvawf3\]|Dđl q y`?f3cN[EUbt5$iU*+3ʰҏ7W~Y84.[$b<@'ܑ;L\Dd5V@=aVRO2PL&ud:LPC'C?E#AXWS^g`7 GPWXcb1k{8##Wqe§_Eu~~2 }B4+~FƶF!a[Þ -W PMI5>Ǣ`} X!cةO5PmrcG ݳC \"m?kw"`w~A ?qXu Q#)Kn.CU b9oN-Tɪ Pfi-RC}$ on$+UlRВhTy sù$qlPc1+<nOIķ2C Х0dUg` V@rb.tI;V8mՙ唝 E^EEqz-(ELcJSeՔ`0:L#55 >G&5; j:zg0i@U/$/5 bUG1W%:ouTv}ꓞM~>Pº.wWqqپ•xvz$\k h[Y;:CY!6_\KB-5bH\xR iZ$- "b>[s wYopiQjA|勜q6{ ){9Ԓ%ꖦP͛/sɗ۵wR8cP >L\]Kg_r ϬHT+ QhJ"^B)8!P|](w=}";5\3z18XwNCk؎`4 Ϟ)e##Ӄzf69bͧ0`!qy< q`<7l2+TkbRby︰NY%ŵQ9SExōS&H}ḩ7ߚjB ypJGu kx(v.㤛 dg= 1Mp ]PO'5(m݋ hY,F9;Mw係at֒ ʔ! qf[!v౳xxEbAt"]0k{4r[GP^JoJ5h^OC1h/'P4{dZ?)%Lbsxov:lB-`*bxCGe5S0u hp@mȹ_ h8GIR%yh*^CPmni+1T<غ]JyIvpF4FyfU=ŭ&We.íD ED?_ɬQN,H".@?V*pt<Еme7Eu@f a" pωda)ʺ̪ԯhc Ao<\v~k/vXMoCn:QBW/Fp лf|;kr/HD9|bb_p]Q'MƢ@N^`;<'ηN(9k%2=2į: +٫z CvA=ؔe+lpOԔ/ Sal];>uYFfN* E" A{~1[.# rV}ln^6WvRr`g%FE^7-z[H1_eB b;&ʧO-,A *i91FS8D%~taÈ6Ģ~X~˞5sg~ Cn 1žo8U71o͸kn#%0 #gl=S=᦮%xf(L_f]\Ͻ IPy:6~ׅݑjȄ;gcU%:S[VqRM2Rg)t0"y{M%?"O9Śmƕa#Nuw֛q<>V d|h1V#wegڜN]%Pwo. UB.A`{Ԝ V¹K=M6dB44ɑSHxYo!f#@%$ƎĴ~ZP7 A21/6!j^vk$g awpTYwМY2Ñ6!uFεH3쀕jO@ck1nͣA "{ p3sY6p'f3IX G+Nz?9-Z Wu 44f[{ 1KS(Du:U+1=TS-6m2DZ6x~iIj3ݒtaf;|A= ǣ1q_?wGIG DxwD^ &U7 bذujf^9 ZAޜI)*ӌfR %@EE=?߆T;ō7̛Ld+XAǗnFeJB-E7& /\RI U kr<>v0ؾ@zjEO3zz?|@: U߾xQnJǂ?޿OB$1ֆ(H`w`2)颖\v5C!F.~lz%B -AHa^,9 ߏkNdY1Qm%Ln-A+( ~nh̼kmgA߹I vL Дۘ &jUN]a[yF+$y|J{$ yX=TVɴ|zjҹ4/bjjdM(kg͂d'ȼKzRaF5JC:3lm5< C7F03pWqB\յR FN?Ϋqmqߨ^MCѰd؃z9Q1cdktA/-F6tV=Y_W#ث?%^v`]7)s@qCTG7 2}fsvK`(IS7/zD+H) 0l3;Pͪb~s @2|Y6~Mμi W'ua/vMЯ~ P Pu ^7^*OCsUBl)-@iKQZ7$-^"QnY`Ht좁k033Xϲeqk4Eת=opIũ +rjĤ RzXnkka/:azZRX!m_DWڷ_ $1􏇚慯 V{!5'B`PF短W,L~MCbHIDF2]V=ϝHa5L{l*-1dg)2].7VM2[okSe%9Fc;5Ђw>YD5t4m_Ng`8U z Ǒa"G=%p})Nw9Cn0t5ͼ,vL k8sq?Ax;j#W1CdsR3s&n6&/Ik ~oogOI>5P\BK>mq{PU$x^QC=tm*^u%- kE'{u2Usϟ{)MB| xB㧽fltq==^OI4MDeQ+GӖk6t,bysqdHxٸ9n%3[#NhLleNϭ%⯢sSޘ}1~-0V<%Z>bm3uD X%]~ 㩡lI1.YBd*`?_mQA[#B,lOS>3iKj]ׄ YS ]瀗!7>4Lg XZ9Ac:'4fh <'^U$Fly, 1UZ-J[>V}Dvũ1? ªrwڽ.)& ka-# a] P~i =LSpX$OnV tlzu0N[4/}5m&9D:/RNCÔi!iO*1"?u~}2dg;o;9C7<9lS w 2;َYI4{?m}ܝM Uk$EuEpO7H T\u-̤:HuaJ[LDžfTlcE%bxPoůEzyL*+kBnp2b> "Bk+F<O[E3Ts*+TvF>f]U%bv|ِ.w*NK 0ܽsn㰈-;8?R"ۈ2x<"l*rvIVAhqvesAjS!殎1 3 }d!y& !C+4NӖg]SI?*<~WDԙ MjxIE)Eµ=ڄ<t/v*CJ:v!jkt]Li] ,r'R)StJ۾{ӏ%#X&bm-`HlC=KޢBf%2]qu@ 2]1@Uߜa+Ó&ꉷ4cEҾV K,G?qTˣ05XO'<`K"^H^?1p/=XyO12,[ۨ7:@ew,"EvL+ȴpKjOS[DZvBf>R o t5)p]Ҭ0XR~zueaQ8g,0W~#U'CUUoYzD=+ӆdAM=I̺S ,!0%jcK)j\g & w7e׽ SW 4eDiZ)eBCߊ1fC Y .)UKL|xUڹ=]mgpR۸>f#6*2 "Hr2Cɧ|'ȼiYYwV*+^9 rS{ׅ^̟ætao緒@7d!IdW:4FJ 7 g[8|Wk5/xmWNN'Ā cg"mP7u ޙ}x>|ҏ7#?簬3~$-ƕX=ĘzU 3(}CLj85kĎ!( 10xk2V$% a MzSe)}!|VKVD݉P{ 3,lQ6n'OŁ&DzTnwO~eh;5?Yz"PN ftLz?Bй֮,2'4 CI/W ZDUv sPd1k\is7bpQG\ biVnl(3k(fD6l%4]+qjHL/w#yQ2izmLk?Pq`CRTĤF&baT̰'kIZJ{g0kHm& CK74ȁ =G<֓lZfe݀}vANoXjvk ~! '[;/5*w +ZyYRds0BfY'w|^^*clQ|{˭~R1J\@mfxQU(Cؔ 5|6FP" /:4a,?e_[//g<?Sx0qCLNE3~V},2M+бr/@& c#1܇rN$5PCq+I&$]^<,i~UhŚ0/ mܠLvr?fT"+G>Fmؖ!!DQǶίr_KI lޣBrAy+w :+ {gG9\[yc_uK׵@˹[:ЃwEBo C5gb=-kNO۶6|ЂD^&[_o<ޚ&+ ˢ0 -qw BU,ue`7Nk7[kEf/BԳh+Oj)(_iY9r,5kgEPĞ/Pco+j˩Q[5?;o@nRz6]c/:8m[A.Gh}Cs95܊3YL|%:[)R})2o3BUy)j[1ˏ|/W&WTxކO  yFG4W쀿_T<7)̔BS7xuDYDLsugj6ŗ-.#0|>+ ͦ \z'N;/ڢ=dS0$a+qƽ{{S)۞&\ ߙ~D'U}Ӑ> :48-cr V9prɻ>MمObvKt/`eҔ~ö R+97:ܜAej="US],A\ס))~73|4&] p٤ l7OwG|6 $s>N9?μKg;ƽX=a6A$Gyk7̤VYKg~vL@ֆml:N ?І@{@ Zk쯶ьkWtR:}cb$UD{ ٜ4?NTc`Wx8*|c-<[^ 2r 1A$>&'׋2)\9+xN {o8 .eIU1ckjVDpc4\1w q5[X7I'Iֽ9jR7g6aIb=)#b_I N\ 1X`i&4T~6cfg#}x^.Чg6VzC(ޙz |ꢓ(d2?+sƂXX~ֶ ͓#'9!aZ;J{aqڳX5]Cmk>16eka`;QUZx0f`&z<۲o8{]ro#՘3AEu#`y1\6]߾1Sk9ߖI׳I)pީD'шL]{# EMj,WX&tɴ6DL GC,#hmku?a3o~꧂RX|D'R@83rԿjkWer\}, vT{&Ӗc̺nN߱W}Z>.>`\?%XvVGޑFnG| CyB8/.9ZcS .GׇV3czDf3><`^*%,Zyɧ9l*_j_5@bSW9Ua{GF5CJҢh# I |Cz)*U\dnHD3V{Uw,j]de+m[vCg)A&JA:m[M|έ}arR(.TN3;q7YC]W̾^wN[H=>#K$g>Ə:+=#ߺŇ-{mNt[qנ1Hv\b4{/Vtj,El^imP $_=g[5@C"o :+cǑ{s |8/Lܼ9A j8hiʄ,2 {l8h/\ \:~JL\ʃb0+)8 $s_ `YB[m3W*2 ïzJ^o2r@75a%AƐꋰSyyt*0Tiݭ"覗㗐%Nj)$Aʒtl}ĒerEP~nb ,'CdIZ(:/RRbk e9߫/7y n&`2M#ɟ !_J r%DFP鰠y9!b+ɐ(9yO 3<"(%Dsƞ?VSJȽ]>9:gH;9)A$ 3{ҟ>BlkJQ@YG!H,߽KL({ǾQ15InȻT9u2s<:0ޣsNM6b@Xph È4$v>t-07UvehYX3iwۅWn~:VOXKP_:f8~s53Nsׁj98Y:xāG8_aC࡙^@3s Ll.t+ *eFO"ْK8ܛ #;7Ok?#ATnec(