samba-winbind-4.15.12+git.535.7750e5c95ef-150300.3.43.1 >  A c"p9|ej?7[ڼ"#_ޚ8kiW]IIW^Fduu{'bk:~y&fIhaY&j樸C:tf|Q%$S@x֐!0n貄)Ӿx`VM\$ܻ=6_rU(R )z 5Jƾe~tS$y[3ʷ3z9ۦZ1ً+| ^L>GN(:cZ<< edib9"pbe0a8cd395b6a18763c8e241f49798e2c34723958813c5a068fdaeb4d176a6ab6f03dae2606c2262a2ec87bfad6a95a02c221bb2c"p9|] K26ӚDlk^;EL͖Y #S~.Ya/ksB ULG5g`>a(W0ʐ5{#N\+8{pLb?bd, : R *07),X z     P8|D9((::8:D9>L:Oz=U@>UH?UP@UXBU`FUtGUHUIVXV$YV4ZV[V\V]W^X bY8cYdZaeZffZilZkuZvZ w^x^Xy^zabbb1bPb`bfbCsamba-winbind4.15.12+git.535.7750e5c95ef150300.3.43.1Winbind Daemon and ToolThis is the winbind-daemon and the wbinfo-tool.c!sheep55 SUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxx86_64# we need this group for squid (ntlmauth) # read access to /var/lib/samba/winbindd_privileged getent group winbind >/dev/null || groupadd -r winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in winbind.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi/sbin/ldconfig if test ${1:-0} -eq 1; then ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-down.d/55-samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-up.d/55-samba-winbindd else for if_case in if-down.d if-up.d; do test -h /etc/sysconfig/network/${if_case}/samba-winbindd || \ continue rm -f /etc/sysconfig/network/${if_case}/samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/${if_case}/55-samba-winbindd done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in winbind.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] && /usr/bin/systemd-tmpfiles --create samba.conf || : PNAME=samba SUBPNAME=-winbind SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable winbind.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop winbind.service ) || : fi/sbin/ldconfig if [ $1 -eq 0 ]; then /usr/sbin/pam-config --delete --winbind if [ -x /usr/sbin/nscd ]; then /usr/sbin/nscd -i passwd /usr/sbin/nscd -i group fi fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in winbind.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart winbind.service ) || : fi fi<r9ȸ%s8K^큤큤AAc c c c c c c cc c c cccc c ,c ,dbd95eb7e0d1e8c973d39fb53be9be46276b21bcacd8b0ae1adeeb63651f6fbea676af835bac5e037fd6f6d9950ea49ff3f39bc693d479069190927c1c53083993a1caa0988f1da58a965d7a954f36d791af7b63f8f4d458a49b7b48dedc79095fbefc8e13245ee39f057129366f33d71f46cfee3e08ee126d4c8ed393985a014a5edb9a603420e216931a3d8f821edd81c97d2ed385a001f1c71c879ede411748c787a47c3127f9c5fdde2848eeac71a06e22cbf997c132d74ada549c086e0defbe0e437e86e85461f4845579889d1eca2d555b90614ba9ebf9dcfcf06838ab9a16eb3e6b8e2bf0b1ee56f8a98e8ed307633badc5f3c02d8a82a4293ea474394fa518b5f7e3ea1fe97dabd9968adcc1f8592bbb8c434fc3e62e1cfc3edd1381b609d6fe9bf04a2530159ff048ec85c3c68097288e06daae5296584231cae6c9d83b47a21a483d6dee97ab2bdc2adafbdcdf0fccdff0bdf9e9bbb3427585a6f2c6b4b0325dd3211474ac785379683cc4e7f17e211327fb9d536c1ff9138de03eservice@@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootwinbindsamba-4.15.12+git.535.7750e5c95ef-150300.3.43.1.src.rpmconfig(samba-winbind)samba-client:/usr/sbin/winbinddsamba-winbindsamba-winbind(x86-64)@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/sbin/ldconfig/sbin/ldconfig/usr/sbin/groupaddconfig(samba-winbind)coreutilslibMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libc.so.6(GLIBC_2.8)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.2()(64bit)libndr.so.2(NDR_0.0.1)(64bit)libndr.so.2(NDR_0.0.4)(64bit)libndr.so.2(NDR_0.2.0)(64bit)libnpa-tstream-samba4.so()(64bit)libnpa-tstream-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2.5)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.14)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.21)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.13)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)libwinbind-client-samba4.so()(64bit)libwinbind-client-samba4.so(SAMBA_4.15.12_GIT.535.7750E5C95EF150300.3.43.1_SUSE_OS15.0_X86_64)(64bit)pam-configrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-clientsamba-winbind-libs4.15.12+git.535.7750e5c95ef-150300.3.43.13.0.4-14.6.0-14.0-15.2-14.15.12+git.535.7750e5c95ef4.15.12+git.535.7750e5c95ef4.14.3cctc5cM@b@b@b@ba@bascabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.denopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comscabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689);- Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254)- Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- CVE-2022-1615: Do not ignore errors in random number generation; (bso#15103); (bsc#1202976); - CVE-2022-32743: Implement validated dnsHostName write rights; (bso#14833); (bsc#1202803);- Fix Use after free when iterating smbd_server_connection->connections after tree disconnect failure; (bso#15128); (bsc#1200102).- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Update to version 4.15.3; (jsc#SLE-23329); + CVE-2021-43566: Symlink race error can allow directory creation outside of the exported share; (bso#13979); (bsc#1139519); + CVE-2021-20316: Symlink race error can allow metadata read and modify outside of the exported share; (bso#14842); (bsc#1191227); - Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- The username map [script] advice from CVE-2020-25717 advisory note has undesired side effects for the local nt token. Fallback to a SID/UID based mapping if the name based lookup fails; (bsc#1192849); (bso#14901).- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899);- CVE-2020-25717: samba: A user on the domain can become root on domain members; (bsc#1192284); (bso#14556). - CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID values; (bsc#1192505); (bso#14564). - CVE-2020-25718: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246);(bso#14558). - CVE-2020-25719: samba: AD DC Username based races when no PAC is given;(bsc#1192247);(bso#14561). - CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues);(bsc#1192283); (bso#14564). - CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215); (bso#14468). - CVE-2021-23192: samba: dcerpc requests don't check all fragments against the first auth_state;(bsc#1192214);(bso#14875).- CVE-2016-2124: don't fallback to non spnego authentication if we require kerberos; (bsc#1014440); (bso#12444).- Update to 4.13.13 * rodc_rwdc test flaps;(bso#14868). * Backport bronze bit fixes, tests, and selftest improvements; (bso#14881). * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642). * Python ldb.msg_diff() memory handling failure;(bso#14836). * "in" operator on ldb.Message is case sensitive;(bso#14845). * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871). * Allow special chars like "@" in samAccountName when generating the salt;(bso#14874). * Fix transit path validation;(bso#12998). * Prepare to operate with MIT krb5 >= 1.20;(bso#14870). * rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645). * Python ldb.msg_diff() memory handling failure;(bso#14836). * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848). - Update to 4.13.12 * Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806). * Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807). * An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817). * Address flapping samba_tool_drs_showrepl test;(bso#14818). * Address flapping dsdb_schema_attributes test;(bso#14819). * An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817). * Fix CTDB flag/status update race conditions(bso#14784). - Update to 4.13.11 * smbd: panic on force-close share during offload write; (bso#14769). * Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731). * smbd: "deadtime" parameter doesn't work anymore;(bso#14783). * net conf list crashes when run as normal user;(bso#14787). * Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607). * Start the SMB encryption as soon as possible;(bso#14793). * Winbind should not start if the socket path for the privileged pipe is too long;(bso#14792).- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/bin/sh/bin/sh/bin/shsamba-gplv3-winbindsheep55 1669996806 4.15.12+git.535.7750e5c95ef-150300.3.43.14.15.12+git.535.7750e5c95ef-150300.3.43.14.15.12+git.535.7750e5c95ef-150300.3.43.14.15.12+git.535.7750e5c95ef samba-winbindpam_winbind.conf55-samba-winbindd55-samba-winbinddsamba-winbinddntlm_authwbinfowinbind.servicercwinbindwinbinddsysconfig.samba-winbindntlm_auth.1.gzwbinfo.1.gzwinbindd.8.gzwinbind.xmlkrb5rcachewinbindd_privileged/etc/logrotate.d//etc/security//etc/sysconfig/network/if-down.d//etc/sysconfig/network/if-up.d//etc/sysconfig/network/scripts//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/fillup-templates//usr/share/man/man1//usr/share/man/man8//usr/share/omc/svcinfo.d//var/cache//var/lib/samba/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:27033/SUSE_SLE-15-SP3_Update/f968e6c693d465d247e96f210be85c5c-samba.SUSE_SLE-15-SP3_Updatecpioxz5x86_64-suse-linux ASCII textemptyBourne-Again shell script, ASCII text executableELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=854097859f16a72d22866749ef5e79ae69b8addd, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=a3ab5749b4c322d5cf8e1a4fe27e6e185bb7780d, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=8cf9b8f391d4cacff8badb4f005552a5356737db, for GNU/Linux 3.2.0, strippedUTF-8 Unicode texttroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)XML 1.0 document, ASCII textdirectory5Q4RRR2RsR9R6RWRRR_RRRoRuRaRcRiR]R}RR!RRRRRR4RmR[RrR R3R8RZRnRhR`RtRRlRR\RbRR^RR1RR|R5RRVRR2RYRWR_RRmRR!R}RRRRRRR[RR RlRRRZR1R^R|RVRXRReRR0R{RyR$RWRqRSRURRwR?RsRGRYR&R]RR7R6RRoRcRR,R.RIRRaR2RRRRRRRR_R}R!R RCRRKRAR*R(RR4RiR=RERQRPROR;RuRMR9RRRRRRRRRkR[R RgRmRNR RR#R'RRfRTRZRhRHR RrR R>R`RxRFR+R-RR:R)RlRbRRRJRBR@RzRjRRR^R%RdR/R\RtRLRRDRR8R3R1RnRRpRvR|RW!!kS?$ 7hvmgzuŞ&>9[kTx-wcC[bH)s ˃8o3w=M2L !F1G5Dަ;4@hNU֊ΔK>I 0(!g(1~0uQ,aeH1gw]`@ Kd=cXibùۉv+J10u羻ՓVA6f3A_[AP ^nׅHEPhs!bY6@lc yv[qm#DCbDNDs\fnaw÷|fo"hb6EAGfQ)Jd)W+p`bzK"M1:(?$Zn}J٧v;NIX`ta`D?Oo]m*r">?%m--LqHSe*R^VES7Y.0G٠sqUPH_f+TnE83n <c%qc$^PLnkO2#YAR넼,nЂ(DQ_YhD0]QѤ|$-vo.۵1/֧ޡd E1蓡4@W[B8$lNw2mľ_@w{xDx2Dn\+yT/rfzS '#!pÐAf/ҡ]?SWlr bYWɈ&dAVTe6ns茠&5ڕtKO`R`y~@;D?b;hGs;T@NY p6a|Scg3kӅiľQ,Vdw{HSx@Nǧe:gO퀇̫FW)ݻqAdߘv֖Q}|DHmr򀓩0B7w8š˪bz($$"tR.=px/w^{MӒ4>dȅ H^I y]) W>eQS{CG -s{qgGu<#[Gמʆ䌄W% HJvąn[ è BM O3_چRcIO[F1DXy~]Q^Q,MwYe^ \oT]WlLbmF6=÷?R+nС금[Z}07jV!KsfGu륓?Z\h`3c䘝0.'\^V{KwDO`YȨ/EǍ\ H=uL[IE_J=lb4S`:-bg:)?s|rwɦyHs8KBܺB > 9`;PΗ!}Oʤw8Z~oC(bGl]h=H<<m2;Q̦I* չ«Й!㨒O3:hܜN!Q`Zv NY~%n9W^hAl],6HVJr0_K VDUb!O//}lT}m^H*4ބfҫ4Sy(|Rf߶%eox@/P*RftGPc[LY*ћh3+pZD/6/X! 18٪5W9꾶*g3 ^ 'vO1bWfi`fE-%^RGz;g2 _@t^hk VpYs9kĩĝЇ"x5mNh0DEGP3LB\"[6.覬5bϡ*lPmJG-=臞2VTZ sn#ielfOTUp_>DQcbdI(8"3T=W#HrvSi³*>" uiI^Tbee P)8J{ӜoAGQ ТTl\r}|z"uz~Q \c 0".7ys _#F)*H|ש s &\tݫ jEJF4򾜯pM/ğҊ;>>?'7ye fyؔWN_c Ƕ}h kY>XoX+{V\b>Ub=`U?1[BLai@F"q쌂3\eZȃQs` "Q^[R.L2mL]3py-=_ V?3mWZhAdv 1χ#7ʧq),f?ܼ _{Faٱ8LpTcսozbLo[m~)[$#u|3=2͠ }YQsܪ"(eWM(pevzKR!F̢ImbYMgordS 7?ʷ ֟~ ,ƚEJ:d5 isዦavp]W9mf" 0+WB <ξt;[JhQ-Z 8XV>yD ݓOP.TXc.cqG5P 9ʃHYedniTv܈KEӕF_<1zYulRf q%XݺK` #@KG:i]H0 ~-XsH<6[m÷3sAB[4_f{kTg=5J>v2dowOD$:=uYANBzom;siXAve+CcQD|ͥi:Տt~jb J$uҭ?`f5qt=u?">2MVcI6VKF^06<\'۳/7,%J>+Զ$,`h֕}c{3xQd7K5~8Kѥֻ4E&{M2bU:\Śe3S4A6b^N4|,37\3%n$!ZZF^İ-Ⳝ@?6l90Cit^ghJo 8]qvUL `Kڤwϵ? a+o9N;mCk\rvr|'N ~lMջ̠1#} ,ttƝ}oUwvM;:g.M.B *NNb}IA^MB?Řu3d{IKf1!#6~ƿL^p,hԼsdԎ/#mL#;dA3$>ݦ!N.۹`ug)PJ Qwf4d0k>kVBהY!Wml\z:@ n}~A*9++=R*gXۯ`^#6(/f l|}EQm2 JDlmțCFUp lqq2H?Th A))&s)$+[3^xck{ P9`G9,rv߶ Ќ@ρ/?2U/-< 6c|*ʦR \LbDH>lZ7XM"c[@x{;%]G\Ԃr3_XI]ikcg7;'pt#F G~ֹ*䕸epux>T!MYe7 55\CS9 XC F'7]9˥<]0QcNv(OR4* P >:HLd{WvY3ϴgf$2f;rVtyQQ l l~cAI}*ˀHS>l/MAvܻmӛEu? Mu U`Gxn<-! #}Fb.R Ά[_Edj"b3.h6#eO&UyusߺԄu%ujp_b+~*?5wz؝DVc. &Fqz" Nvomjt!!Dd1Оw^M3ã[坟sT.,;U30=2y`W-*b㣩uri"r\Ljr?BRۿIbd+Aftk$2vEP-T8(':=b8- Q^`QB^%x?W^I8!bz+PTqK3Mn{S,cA \wjVX8zd"{K͋VDZr?VԼřM^GTp ;+| SRދ@7(u*#~ej {RR9^O߽ m~P[sUNΩ:zs^Y@-%ܷXOaq?s AS.VwdYA_=6 6K2=F`ʵUjKߥ!63nd8Bsb)DF3g??kO`%={;̵<>U:?? 99̌nb4躜 `&0 [z#]Xt' ' t!?%))XtQЀKZ|1py :#z'2:;c'|@]DH H0ix#sSǗuc5J*+BHYv_ YhZt 7G`>&7AS`V]E)p@Dex| El;$\Jc":|@6F nVcVw Npr!Jؐ[!'Oua*R>^b6pHS\} jp\&FII}f b6_BG%1Ci.C8@atlKe'r; Xe)>dh.}j)#vmR3~ j)n. YXaf0*OƑUVI r *s8B?-ߖӵwhuSr^)>=ٝV}%R?mP4 Yp|lf|3*]~ZQ#GvadR4qƔC nDJW(x'5+,'P2Q)m:6l^a?{NF̳t.4DƐqvX}F5` oCn+-̷Hl \$a4qPL垹nQ c*dمvjp( ZᲧOrrbgD=8Omy~'A9r#&'?e~EC'7:šMjࡕlֱM\e^sxO?qqVAxAJ *ۢDSB8/c=_XMt$WwhjXZ[6<:d nwstw?"[ȈeI ZQ~w@%"pV䷲mp ʠZr4#ꆮ0gTI ()=T"W@1%h7[Ac<3kIb ,ԭlrx HtZFRw#Ah-)nnY>.}˽>YE>JL2Rc+Fjb 8 tǛA uT5λ-xdB8_ gG| ONo z7â5o투u|pZiHL$/@AC;4q򷟐T^ 4fo,p]btJ~u9[iݛꊗtF~#|Cۙ ǀxfx;X\x-k~sLca)}(J@ՏRul?12CM QB'ڹr@6 ;?%2W@VI2jJ0;Ꙥ{%KZ/R+ ٻ$l/(laTB"<ݍ2|8):󱀠u tƳ!9;{.KLԄ;QV׆|VK/Mfӆ̝".zfÁQ0i: 6H>nheJc;^ R Q9%b2o EbBOdF;F%rAM}u:ͶIҟ)Tc̪ӏ=KG&n SZvN5 =* O`[:?ڃPƩfTۈ'ns6[ i]rz=b|^!3w^_I[RX1Qc<":ruMDUz::% +ޥFRr#ˆzOt G mmpbn]ve@4e=T&Rj2:Fg = d#\`0 N{u'ddk3 q[[ͲO+ւ ]Oo ?WN}9$*:×V=8"Z[2tJrͶ}Mlkׁ,;q!)7]͹5ˏC2~YN ]Zk-$[MmɪA(~,+e9])C֌P`(i<e '6wEuu`̯o(4<"%!zC/KU ߅m9\*Q.0 p Tv K8x_F9_ʱ _i(oHgT:QQ=R*z/@)n䖎}]0qҜ_bH3M j%RG]dօ6u>EܗnH:@uѴ鐅Z6PWG@LRw9ɘ6 s9va#(՗}t 0{ϛRi4ænc>uJ7T_=(qvJg)D-`s?Gw!(SX* J*cda7%FXQv:!t9q-E9+W&1vqgZms]]TytYFPt@+>RSO%"KHnˊb=݃aeu-E tp5=kl.2jpj*t. pB\=R[]֬2bɝg"]P Xۥ#B9|In)![TYQS0E}Ӭ㹮*S s@ࣉ8鳧mIBmDf Z8jժ]h 't#6+23bFed/Ɔ48ݻl(5^Z:7&*K]%Ӯ+&9lHX0 ZuNDtuJ"akTdR?[f<جpMh^AD]nA =S%ijLڒ`6t뀮*]PjHp~ SBb9_[ d~x>r ~.W,5F KHu@Ay

%Y 5SA] kjXT-0N~ybp{aE9pA |̣e좲8L؋_ .nl» "J8n :ПQrm{"̪\vW=a>|n,ܘ&L&T) wU\:5K/We+rrg\x tACCuWʲ?r`T#Q/=SnP麚dAV03p8vS~Fq N/q+ʸA*_e˨" -kt?R  <) Dxi۾S Rx&ZJE.':SIQ%cW(JU8f̃R&5,`>f=\~"[nÍ#}\5Ş!l Stkl=JWF9$*ҽh=GqH~@Vu=Кox#!|%v#gr~td4Ouu$ *Y%W2<)4y67dǔS*do&5OF}@qï)394gm]y:Gޒ:8)5+m5lnѢ8`'{xy=Dtj⮿U`Kxyxz1fD0Iu||EN)1\l]>roAx-1K9~d =#Pyy:)uYQ&m`; ~Q~iz{q'X=/@&{%LHqZP@[-@)]zg)-q*g .ppN5*/H4&..-]V39f{!CY]18\KXT-nOluhzyzyˢ,ٙblvV!+| 7[xܶnѹ 8piPfim U;oDbhF$D/qPn$27^OJ( IUj$>.Lk .w_9cq=[.Smb 99)! T]A3ME*.q'"RKG,XX/fUJwOWߧ />܎&TȨi4\bA4NXaQ֪ybXi23 FY \67meoV8x1Il4DOQ#tM-} Q)WUg5@u5Bp hY j^ ䷡-u]d7-UxX,leaߎSDK(JyP/q'" CE>TbP%y'B#_wZ ~qru;#o׈xynnt.Jcj`ePݓ?0L> x;+b;!>Lx}#&Gвv]Od`h4KܓпgLn! QདW.y8m`53uҐE"JկC.ҁl*RRMʾ3x fvwPCIQP?bg&kFd0\~''In9޾Zj :SHI̟Y?,q>]jNO} Sb]-#Cp6Qݬ5@ϋn j)rBPN0}g^8E3m\BU DoMVe܏ޯX,2e x"v51@b#&HjNjse0@ oɂ<)%L% '^ᚏTn+`"rwpEC0'pRwUz$0F28lk?xBx.ɬ[7%>Y.T7T 3::)Ps>rfb%?r^v4H`KE+y5UۆcKvP`toO$۫Lxcw^ٯ4-t}e_fT/Ek|a^smʾaZxV ϚRR$Ϭ!ٹFEN㳱F̑ +͜ ڀR0*[1`rm;Rc'=mH=bay6uF i2&gq^VڐM4a}GD iA䖭ɡ)cR{ Z7 WlբF6dvDr2=T'ٲ6{B2!rKvm}bpLu;"<앺=T~r\[jv{N VxZ & 7U D^}5Iq]6ؔN𖢙K0b/dbT-q}"ƌsP ô߹ʵ 3^h0u}S˘/6 cV|WP%mCfM{-G0nT<%vobI9(ߐs7H-|hU9\əv˶R9~ 4`gֵмMu?2](Dy3vdBLY5l[ ԀZyb\Q´{r-䳍&雼5i*1~F?SgdBp{Utotcv(8o9Ƞ޼0((}"@]ҴzB]kO_\y S]< 9+7.vCz1'$&%Lݥ╘5~Y4]\JS *F+'W6';ŜFicd:[ҔzOU]~f;n8Vҕ9zz޽(mfʕ}鋲YR{1_qsvnTO0 ~?(&go_TgÁ^$G3\Y#*z*W_"8UC]J 7|kR 4UKH7ՕW7Κp:t.qEK/8m{Jhnk|q}7“a |ikʺ`@6X94\J]F:]*WT F_i}_\G'<^F]ϟ&=H9cѸ^:J"W3qe]smWzYDH茶36Bbri 9UjW! Xqƹ79Ǧ=Gm54|I ,rBO' qޕDhp=w)es18=,$KNדo .lxLo͐1 h/yiJR;$uAuBEaZԎi^b~O NTT dj1 ~YJxp]qFh'0ĝӷGN{y٘&HiYJNAnW^\@:lb˩ PVBk[iuٌc8a(b6;yYB|wfMȀ(6^J/JwF |7 8+FeU[|:=T_R*Y0gWoN(yl("qzL`󓊯['`Rٽ94v_p'A;  s?&=2u=b: l 3s+^2-8A¨fȠVj_jZ?oy/[O|9cJN ޹4A] 5U-=QA;;Z{}g;:Vr-,86}Xha;yMPBRjF}m]wDXg82P34?zyS b>Kǚy$/\Idiy%Z]E%zڦM %w gз=l-4,mlXѶŃ-='(z2]^1o@:?VҨ3/[t'!w /J#u} kar:DJz%%bߝmYGN+8=\_1֜V1%ϱ}4?wыK!\|xIHi[h2ǭ|{-^̼c!J닱Boaf;c>Kt;k$khpx5n AT;]8ݗ` `5`')VPDWtt!GYMpK|NB[޿A~܄wŀ >}2]hCpL%E18=FQmb(iGJ JX-`oeaפslz pijpk1a'1OczhaĘ)=ӄ\ ǵSuM[)&:q9'mV˘֍3}"C\'ۄM*cD:F"p~{5%Xʦ |4+6L<ГݓG\1ypH9R{4tH q9lj՞Mn_|K''3gN!j B` lŎHrO# Rjx3;!ьXVuk0 _\Xt"{\nYf<A{yfne'o/dzʬpу I< (‚|Sq/ 4|xuqfUXx9[$\kGlo0S?]T8})(rB`hWN0?v5`9y-w5^l٘O5(C\x(l5=>LO$ 3Kt•Ӽv:G^&-ɰ! dQ?@z0o!!aȤ):_@BM%פZs| (o+D}e9JQ8(Jbh}&x9EN3vQKD+m0#DϴtkI_ ?BG&GC+֝+4|' G}?AB H(n[rg喙QFr})ptC`aؓ#eYOn\Md rh:e<5=\pe|Y}k }+p?iL՟kʬԬv]bx*:sPy#rN|@g7J%z<-ہ%i-MC8G3Ut# be]X0D/K:\?p,KD:9 4 S?eCQbj򨔜?6uͱӕr$܉dnVBXyfG5ow&'D <\ P)ܐ寭XPP{; иeHv)*C;g cr̍Ꞧ/=wbR?ΗpC(7v=DU7Ci|גl3V+& 4|.H,fcFŊ*P(K@vu,\@#ꇥ~US߃ sM>K6$Lg΍y@V*\gLf`'簑Vok.-FLMR̤Q& ~^4W7Dx^TFk.=hNU7"MΟig@Jynr| ĺKdE=m/F&[2V =8.8m{B\{Z69: 6\c_Th󏗾QjC oIP$ǯ5`)H4; JUFbtZ'U=o6&Et@gONSq!%Ra0\k^ri>]KnonfcԨ DIU:u8 f("BYbJeIMY.fV\1٦) b/ 䇌|>BsqOF)BBogSZds$Ryb${ulWAұ2gWOpp\v>`$9ٮ/6-fJo +KKv jۧ{mФfYf {"&w N#]SNgmj?wo' g4_a| |-n2v;Y& +#rceZJ43O}on-nT&{Bw^<^`Xb!T)`^^)9U*Edz7', 퓖yYg!VW ":{; ԧc 襮6vDuFUJu4w,=F)o^BT3FQxd"e;{<*n7?rOaO7ʌf~NBMi)Ϋ)AE+HTq /欿\_,B~@c9 $H`Ce1(FI0xoCB'/pS^7R¸嶎qԒkZh9jEfʭ}?іZ5H1Yk>N%)\ʒn>6˒jsڔ%ցA2뎛ݑ_m4Ct HɻB_1|b^Bj=?R Q b3߱- B!v-9&JpP]EFajRmI;1;?"BA|`,6|;r!#SB %(%OVZo}Uv0yT9dY ypN]7Z21DŒz ԹB#wj>>.aByMU~CO}}AI) P ) z+2+CJDy u. ~j׮K?;H]g.X \:ׯ- $sAw#Z] R/'@'8S6P&p۔7x:Dfw2zf(5x0ͱt,t0ѓEV) bP ]c[P bbr.1;nd[[}F<2FwL -cse}Ȉkd9[_+Hn=yCo$`|"z0`Cڿ^j2>Z$Kc [kn-+tyqT(I~eqt#e/ü^L攢} pA3"Q}H' P !@cNr4/n v"Җ0["h#Eh}WIōNVDVe;+h=7cse<)nbh!x`P"뇎-V4TN$_ٽ. HVkk=>FBw 9+'9K_B͖Nh9a_:]lxjN0.@۔ a"'ȆS~ Bw#.9#UCfbMi't_\S`YUw$q7R y=f_; EˉA!DղB3Gυ^Mx +q:)XB_k6z0]\p/,~P,- 1!2[) *#2ɛS?ā4{FSTQ >9WUYcBeVvܜpgIMg=m:0%5G&رe-D6\ 2H9]8L(m!1IFhC*6O|io]̡P2O> &H:wAvXZ. *K|]zY~6/kRaHLD-:)B?󈻯H_y+|;ZmãqѸNy*')UsiQZMT y^ =Cª>k?Rhik#_J>BY2wkgu^`=]30Ohzͷ!i٩b4͉ |t9e熊ID9$7EEbTRAw@tB'\ctlH}"ͱM i!" dx&IBJ}A.>%dY2jQ(sra iΣ5r "F3^B?tO<,f EJD(Rgɿ2Qm[,+!Q$bبɸ81]X=#YKԛ aWkpE8-A5U@"^YZJPa?ܱ397d.y.n9{]3ϐfOO-'Sp!7i|c8̪}IU_bpe]oҨ0;M"ñAP+}/6L}e+uUW >2KkbA){:T+ŵVZPEfD0Ц(9+I|m7Sbeğo&m5FK(6wjNiaaR Nx!Bۆ3Ā/I!XṙN')XpQ?/36^H^2sb&ߗ`Ĝ>.vN6q`3]zcMikʅx^Rר]V056q* /S:<5z"z}<]Q%8/ -Yr`H 'šLp$}/}򑇡Э1~JT8dM:(sA ti>[Ojv \xXkiŕN}#|zE+pS{msؕ`œ33D{smbGTn gL_LBm 0]k&3*G+&w@f\+2Cz yg aK(9! 1!_yZZRlTϑn^W:ZP ͏E2zl}4WP$>w]Z;$pf.h_e0 + qCV x f=p:NqD(sZY}djt!&i22"Gh a{[AhrrأykLaɨE7J7vTdХ(͋¡Qȥ3={%@R="ksW]=&Ъ$[֊ϲ(ĂƁ&'U ֢eث I~ YXLsέ!N@XdHJãYpŞ5j@*ֳA)zBr9bS##Y>T=D2ƺ,I17nB`sMn"M^,/*^sV}\juۼ4{z17LrЋQh@\Aޜ&$aóRCq0Tukk8?YǚCLByLvMZ ʾUg8hS΍pkq2>x6LoH87aDSkz^hwK"w*y?sb}-}<+Wr4sN'=ul:<1v3j>*_Hϝ,H~,"qWVL,Sy+@A*H tɝ: Iw@R y[ P_Ĭ;s &}([dN߰ZFs!>E#[IH`ͪ'wə8*~A&^!ʙ5t:LfcWlz6}R \ӒSR"~\!d3AnElUtx-ߴVUQAye1q-m;*,;mt~ˬrYB| Eݶdty{GEZ[zu{Ijb:ËVpz8KI1+0Qp%̜Ry60S'W($]5̕%]1fz \(=fﶁ;4 M6.KI9+)içPH G)8+ 3&embÞ Y}Opj VGXy< ϥ45AB>k\v7 i*QZ%4x3dg;5s2bl|4nW'@_cL=fz0Ι ͿEWuwkk䛗5BC@}B)Yf9 JYFKO0(jd]f 빴ْGgh T;]wtȪvvŷj^ {yWwbRBNbQ*ӄ":H"/n Eo C, @Լ+u B ^TGJV :\S \cX|Y '. G14 ݉ĜFbvOUTiTRdLefO;%AKE`_CQy|ݺ Tq)KF"/vht`ٳp,M[m+5B[B＝Ld)+5}  1Gתaen5.I(_IbbSJD A%ri2 ?C;ZkeC<+f]Rhd6CO@I-O,O\|Z$ٚ#Ymz֡ 5Ρ޿vb0Z<˵'bhxfFg'99{QndXBf~B{P5`/0;z$b@1GXTSWsFaBIg_s<+ARJZQ+sl/|?fA`FAR*$SóxɈӸN#$„0Hf@|Z=PM.SN2+7\c؊izMR[~%ㅔ2C)Y0#o .,ݮ0+m&+ s%ZGv]Hbs؍ U4y }-9N͊Fm8tm\jߪ;YH$!41.nԳR3TTiat ޻ ܟu84ERypЪrIݓ 9Ålp*lV^BՈ &vAbBy_}=@ٙU@>JSPՠ%jG+ SOQ> ɋI3ț`1cJ!.;E2{#4ʵx(l1I*c5c tT4`5y:Q$8'죒;A1Ûՠ(`*~ Y%:{ +gɧbojaψAR,Vf7= . ^Fߖ'O4B&QznQ6hez ӸJo?]Q:4O aIV|h8?x[Q^H}7nԤƕ?árTqu8"-PtwQd9@9}-1w̅4)[ķKK"XO7~\l%F)CxoI%e]+ v OSRuEWKUŬvX@?1F|k$d!QJ9$/U1}0x(y~agT9fO;Ng4  d,9 m W= >WEQG+oYRhYYkxc S3|12nU~~mp??.j((657C·s&f{e3POvHԉJ-7Ր1.˶,+Hyڦ2rҦJ*xN8%9 g& CV܎hK֨5?X]W3JSEA2}9(ObD""Pav2 S .wv:ld/}>GERo!֣)BY%yhؘMp|RTPYk>_MF [:#7g=p,n1r ;}uDګ/G?5ty(\Ϙg ~6_-vAK**.TKkXZ&=urMwjܯͽ G]| ҘJƴN*Rt},9zRH400QB!jx0dEhuFQXj[w5H$e\$={P=:83d9)UtGx,Wߣ7ܤeÄlli)9X@ZA~8)uuy&7-1#Z=Zb՚:$<{I5qAv^Hƴ;ɞGV+n(aŇ>e ~h+jAҜ*A#;%$ZL-M霶G`:cx4pAFs2 !|kؼ=)@@fǯ)['iO\kĞpA>Qlϲ+{Ұ龪=Gʽ'o5f5n1%Yܾ 0=ܠ3Ef8zՎZ4@^c;bp._}&`%.f YOB[{g)7wDo@]Kr)a{'ʀѓt}LhW*Wb[KEީ"=0|X4cl5_?"|0 R#gj>-S4{pdm}KҪ_K 1SD̄if:zd&b*PBLL-HE1oyܮdwXzیqq" u;TvɪBY6AŦT jg~Nb&t};n˜}XD_T.C^wgVtfZAV+N9R+|$foow|\]h|8m}Te?| Y>,cJz`Ŕ=tje%gaOc>O 5TX]%+@?@ȹLW8wnrtq&xqzgΝWNU/$[:˯FEQx`Y &7-)S՝-͎x>W$[}aFy~,UC/],e5 >iBOSkg=G 02:%!EkO. #T7־bƲS teJAc3DIn*!ueެE-o+$(Çz_RΑ|H]:-?r/;7 x!b?Iq<{ g+)$tO fzzIR/vMry1 D[m+tfm;oY.Ur!I <SmZB0ж#X D4A}PJyPYwTdpJ.[!?(p5ŭˎ)}~%%ɉ#=>uO#51z"ۉ)cQ.޷#xp{=0iohE|/BG VBr#P c/v_p3A Ĉ%)/6RZAggw'92 Kt6Lo#GyujڇS `A)1vԑ/W.!$W.&_T V_5k(4T _dBS c^;{f1qW445 R3ęڪж{3o9ď21́ #T7 *QIK PR4kl6YhcMJI__ԿFYx#,ꌡK[F2sʢH~]=+b5zVgU„D6p WF{) ECt:d/ 4d45 HٓE&,ʨ lkg1ÏZ8p`iY9F+pa5Jꖦ3kr`\m,:_tttXi:\/ [po`.,t!rZzZef3V6dNUB0'{R ҔSgJ,Ez.4_eq+#,Q$1寢}D P_\ PeB@;#.)aO_ڑr>jP,eف$UC [65آl; \{eP-Fd..⧖"U2M>uԦ yWR-)pr1Q2\Sؾ~ g ^>ЍGXa2Z_X)[P;zl[H/`o^Fo4j6;h~V-:"f:pGTࣩXFt#( EZ]7+׽S {SÕHN%FX2qޛ SL$ݳ$o޹<*&(9q iSʕtML[,>J"# ˱Ɠ=LD"c{{eҴt $+#$.O GD%V*!רWmY TV q uBsOܔZ{܉tR ?hkc駹 r'M9NYI] ^gB7*{ r6%Z0r|Զ#lE#U1/hB!֤D_ϖ#Nuh-.9Wo3ZģI{7AJ@uXڅawV߄QqpƯ.){VyDÕc.%_V(}PG_c "ƎS@~F/2%sI( H+*mƼHIeɗx SMOz .>(|/5e-Jc[_'FF6Q-AtDUD~tx4$$.i-pK(|r^%trMN| Cy7lߚ|>A [HΤbHA:wb׎XG.&I8Whl.-:͸*R%xFߣ0ISBd?-)ՕAa=`Ԯg! @3[9׍J+q4Cޜ>֚(Llmu{J %=@s {GJ}M9OO OUHl_5wD mx(\Ymh*-ScoaǽPhgDJ0PN ]\9'DF0̮V-#B]8˧M:5%e7:Ўљ{h!] 9_:&qJ |?df`W8:,ÿ'}hVorjB]}(m12o-!"->ELY-2kb_V&cYs~ XҋE4Ýނ-+`QotkkJ>j HW+.fp38XA, GbI|B?up< Y11E\nZoDwRTneoriRQ!.n8J4j"[ppS8C/s6i R%}w–ӻ֧^!#!<EZ MS\I*~PQPd4,G\QsE3d d>D|Yc1MAleCj㴅)}!]pWPf'd/"5BPv(ӢTFSi}zM7KrFqꝘÐ^+v*.R'`+%MU:2W V;7mIʅJz qMx0VnZ3`V.[κQ8f\GԂRM5B4[1Xmҧɢllב~T3^l'/)+mXf[C%g\  A5Q h\:[O0TÌ Bqp {z:{ݥ,:3$}(#BM\PI3CҲ{$ȘR2|xb`tT&&њK3k9g=b${Q-,XS"zWԙQ-7D E%ڶ?R!pq,pAôWU~c@5 V&?StIZ\m@Ј=+72U#lkξA<ӡ2_HiӢeJxVJ_mBs w> IiBT.3-58 e)hu>M Vp%a@iy R|n񽳑kbēSb]V 1}{ HS+rCV47?hp}}913\?aPJ0%Qu;B+'mT O)Bcn>|}Ws%Ód%eE$E/vS9>5 X5⧎|K i~AV;>κ"f ]nVUjJtqU~*ll3.rԐw G|t'ny@R\:#Wɤ"SA~Q4.ӂeM&P{hput>*߀~fJW6 ei,*S]b 8Ulœ@ߪxf0p[O.m$c\99nRwu&sӸ6`ch֏$y^P ea8ˇ)K5uz6wA Uhp$R!4!8x~a"TԸ([֌@0 [+D:ph&oꩊܳ4/^UbкCRo:"Ԫ4؀AZXhCJb=W%DAV/?--d )>pw< 1-B{QG]Q\ pj8"x YxZ~Z ;;@te`, p GUASCP<ti=L4`ld9nN}-76K %c+BRiH?ʆ=6{8[.^_/P<5K,L[SBH0GҥzJ[V,v4+W0ľ9"|ޠR7[M.B :&kّdvU/\F/_ClYBXVHDK[ Av r_h6 [tK33$X[Xӣ"rDvh5SpwmP.Y'a>MF:ew j$]jKW@8Yr3yXQ6ԵF.tz"r`5p~pW H4خu3QjeCzW4FGUQՉS!s݉PVc+' W܋R(0֋'Az)Kn؊V]}܊d}Ҵ=iVXۜHOAefVe-}5n9%(DI~q#w;p& I>+t`؂o%ΨA9p /u' C]@hKs?SgE8hf )]&$'錖(OS fWnX:8L` `d[oF#tjԿyɽK#wMn7)E}Wz]tL}g5owв2UdϽC&̎OYvԠC&g};&#UP46+">fڛr wK(e1r966uveU7\j&u| ftrV>hk;.;EAaZ6V]@MtHvUI;Pd3tǩ=|hP$͞ڪ)a19?yR11djbXRLo=%o-mdl+WX2Ii_BJtӳ>~=ȥԖ A6[fgX7ӊ8g,\^&27QD"p5gOp `76Ҧ?K'霯'8hUyF Rgc5|.Zrq DdAխ{S( WEu=R&._G 72M;g*EI!JK;ܔ- ڛ"XŸL?9"};ǶteyM9O-o/֍AfO$f}[ioGdAp{Hm!rPT#NT&&:f(wu[C1i(l)rGINqRkJ3g'1,?yHkbPu3Aga},_bn^'_j4^Q nhHW'Ddݼ{٤?$hqd7SNR-O&Xnl $\BW8Akg3Tk&*Q)\ACOP:l5qWfr^VdFz$y|R?/L#$4KE2 ˤ\lYP#fn3 }R3ysUkL¥P[UTq>%ʘ2Xь>4DrY̔(mSyԒ_v Y(xs.a_:MI0[m6Ҕ%jleU5[E/G RS#a{lnfX |O#6w9.+~)'sp!7ӛs#͊i^[2_-8 e],S;2;ܣxҔcrAa67^)Cv-j$p*bwv,=b5ЇiXjfV$l]/P”.gF;61EtI"7$jnpȏ8X^ }Yd3Wʅ^P_ LÂA4Sc-0Lk Nb[x܈hmw]p٦kO}*ﮝ``ԥ'|g0t'R8CS{5Qi'{ڮ5 ^9!24A ?|aQWg$XРjqT3%ۋQic.3z™ UT!.#8k8PαoSH*۫kwЌ eSUb9s 4m?PB' .qEf) 0HsE6޺4T޷1f}#1mv-F},*,Le:c{7CyCY* ƕşz.W0i\ZD8{@_{Ar\5 !xKH6:^xoҩ0],|PѮwHΐkm]ea!=s~)Q '2O迹1 ny$/Xͯ 4H[긵ގm}Ukl scWpzviO-P+Q/*FbW<=Sk~bFӸvέd'sZ^{4;H]TPYH߽Q{u$brY6bIS>$͘% (()DP*2RB({E]խQ~6dP54.kȲ1St0r H3`:h X?s_j:QOjv/R{2x_ ׋Mîv޻jE'@<͗2&T@s{P/&̇8osٰ+bD;S)Y$~_>j|O) Rg id;IEGM(GUAPӚlsz1 ko!5_o ~eӿ,,tkpb&2Qf4C5eM fC1Hp鍰26gxbCbX-w حߜ<0_Y`԰?˰㤘t`Xvh2XA%yIđb0t.}D4Y BkUuJXt9 U>5 * qc*{8.DžI 64Mn᯿ٝԋI-N*fwғ@0zg/mɤW[D]S_A) $$~lISJ}9ITpK`nTvf"׉a[ks:]^|TR^+t@9" avM<>0熀_ԬV\S`n\ϫ0IFq.n)6C)|Ȁj"I$ToWv}KR[&ԁ3Gw^6Gِ/@6TXD%3\^'CjvXTcsa5k]*_?3@Y(^)a[I /sU>M"K::z!z9tR@U+~`hPlpuz 'wI*Pstu6aI2uҀ0eLM2sIbtJM;ultu_3-;=4gcYm4Jtm)&Q8 {ٵ*/*d( 2֖>"f$8d~9T2H*|%+ّ=x (!ESc_Sh:Ve#4Ik/."<;1?b_c| ӿ_D)Ifz6G *Y =[#ɆdWiۂ%7V3G,ok]űf҃ }g ;?qwHMIYFjwCy3  7-1UCaIqL!&}sq+\2.6li0(4,%# G W߅B¾TE4ģjjYx7LM5:6ɼ֫맘ʝفIU \A-AӓF2T=&˾b^M}$B1 qc5s` DY`W`p%E‰u RžA,^d_,L"#4O`[݀NTW(R(=+W!2D(8IMJMq.2r%%nG:gqc1$CxؘMV4͕jO'FCU)Uj NY;%]ڮe-'vu)զKyfxG*=()'2K,V-\~$ &;T !p1˺>>k7/vS/hh n.sr9"%0c/2KU+6>bkЯ}Pː.fl&_^KJ*̈́J9K]wկkb`RM4+-feRuu2Cg̾O7$msj\Fsq\'jPJoH0N)ZcU 9 FI[zu~Z+kmFu< 䚓]5[*U㽄W{x\YԨtpp˗$}? paU>1D 7W c@*DK"4EQƢ=M]aNmnޅIٌ'$Mh PQDHo}^Aݘ,V~|:GT‹p@OMDu_"b'.&t8LG6Av+Ou`1w|>/Љys?e EuPqf;Rne$M`1CS@-wY&C"[1)Z痪-_qmQ*[}yQ't {TLC6";>rN^Phئ\[KcK>X_”Ll돢]Ϋz8)elq*nn#yacQd占UޓűbXZMQ+{?^ L=`> -[mFrSC\rF.12"䈱$c!(d7i1qԸ M !mHeSE&f9>RPuY+wOmc*R~1Wʅ "?M8&OReu=V[ mS ]P0 {c9YWZjTa%4[%b%A1$<ҀѼA5?`yp$Qu1ɞ9^ Sv%0fioUWeK %&&s jaLOy'̥(v9Q|v~7- ?Đa \5p|LLlȑW_ r ,GI|4WH۳Һ.][,.&YJzOFoׅ,2&"@bND >5!Fi[Xew)|__reh4{:4TAr9E16lD32+#v}SM ]RFE~ZfE|ӾRΤMؓo?/2Ǿ\T+2Ճ8ғN䆴P7=CU\ukk[GkTx` ~ht,@CRc<39SB!Q|> _)m>Qf-ZŽ"y|OyPSA97S"Wk+C^x\FB\im'Ԇڰgˠ^~pn[[`S;P1PKWO8uņe &spTjPS; *Zz6>fo:Yfx?ٕBOB6 ]pN,451_<}]"WL/EAEk~T!=ɬ5 O6 d_o~Gq"9,GބQLGMz#&etp 85QMn kޝ 9BM>kUWoKmQ@kI2n$W֓F<@s Ea=NS(3<%<~o䇓jDFl~.(.[=IGZ yU zVApp{Pb;K&Eq?Ҟȼ8϶  eRYf`OxPq׮`Neh@kz:Xhw'G5_!0c?}cUvfH%cpB)=\R£/U `>IY;R#>{fDP1J< YxC`]5m.K˛#JAAUjM(&A [l_xTTfl)[U?طP h=w s*1DwХ|1]ؼi +C}b1 |[_h^:SqĒ.mTUt8-xـ 4MHu-1t I)D*y6]]MS.nXi#uz7{cN7F%2.:he3 \+rhR}ordzk *te *P&_X sGmJu.td=G˂o+A ɩ)%Li푀ie#ݰ ij:-ɁPtVG\˚PoVzYDf]e棃S[_j7v[ gUk[ PK|sƱPzMNK/E"8'WrpyNRPC8*BPiRsޢyYs.~ZR0tv6%7Jb-}BVџX>l!+`M6`4$ɏ]'Fg݈\, R~Ro:rPOb6'f~B#IF0$Q`B 8; +|1m:FT s7`ӤƊ/߸L&wd$kHi VŪcVw(:*NJR, c{&v'CRQjBގx 67Oqi0D/^^믝3*)j1v𘳄辬 ȩ(3r`JIN'_Fwƛ=F] Ni Z3Y:C66JMzET%`Hp ]_>kҧC߻F56RF ᬨiH0 qH? =P5Y9C6ԹGoPk`3o~^&^tzr=.TVۧȭgf=Mt^W}?۾z긮I_,CÖ2 =Yd^Վ Q9C#M[$Lf;ۛԖ .XDtG(YMxu몎'E F NLM$:;BŅԉv$~H[Y8eg`n%,DS|a]Ų^<^ []˺w %zr8?ZX(] ͮ28qpN6Uчq? 3#7qAAfH"cnX <:g \#"zu-C+Xך 9}9&qOG?H@*vP,I`yQ54wH:Ybȱa@lv\e&x />+.{eI%A29I9B~RbU\Ø_r}QiH0~{iK%40v t~q+GQЁ]L S3_e_{Ky^$bܱ @qu$t)uAzwǜ>@Ά_0e\}B,8 (} OH[UF7Mِ ;>`qKs}jAIWk/!CMgj_:ZRAn Wj(CJNJN,߭+H{G&8m\8^ e` FD^bR:ǂ,cת<2y-'V;Ljw@5с/u``] Lܥ 1*iʧ8 Js'EoW&I{=.ȴumO7}R 7,Ky)Ci4 *+zĂzZv<,ukzzAp%=}v41R%':̘Cw߃&,1Y!^"#KR])L)D\e*GS/kggºIh 6wBO[L$[lV_@nTaJ䴛b)fl)ǭ߇QA!7::<H#7Rs;=4Ѕ pPOH1BSZ3GQ)^7a""=بw٢.G$KGodz|%2\=2t p Bg# i|uk1w.^ںR-+10 _}]PUyyVYY ƉW,Su!@F+Fw7kFmڕMjQ &; p_B$Ua/B"PN<.3&rDR ܙR bN$a&DZnS=FYxC;VÖL ?U8VeMwf0K=1ֻ8g c|=}6[YFd&gJ2 [:TcܯŒ4>2*[M~Ț6A-@!TeJA>u lb_.v~keOBLdy$ZR lapݘ` hCkXs"{³\uhhc+ v&Fv': ʕThώk"΄4v&X*anV] >81O&ToCUsL},:KdlW9tY1I-( ZUe6CѬ@^([[P-պcz7ا ?3 zCRw1T,jKx-_<:l`/ol?X u21vaKkoҲŒ$[Ӥu.&mfdQoʆYA d;҉,ᄣd۱p3_n rab|.UF$֫o_o% eMBIyU A Sn&帠 35J(qDLפ ?Q|eݕl+%]0N1q<"P:ܽUJ2neLh.]˻0L}[n[<41@&V؂O#(3V?"|}ₙTOV?{g}ÒLf$nv0`bˌζwDELFoA?gTvI) -,r/FRͅJ\"00|\ L<ϸ^oZz~8j[wkrW_o1~GEc1>#T&CA*Tf~ބ3^ ,:%Xk7;\mEf<3ΪFB12$w‰.ݠ6AZMbc@2S2uR?q~$ --bs[ d Km=MSޯsL\wJ[rGV@pj!e{|y>{R=lߦNܧEVd;!/5F07SXgX0?0dUOAZA*щbȶiUz2v{ܥ*\#jDN)Ar@Q)(sD#![e_D:e$)y:? )*3@oJҤS'λ{v5% 6bwl v$,SPB@=6ٲҵuAÙ3DCdѕ,-ڷ޴",ܦ?NtYɚm@R5\"^ӺX}:8Qs e$<»ϊ&]_s*Ht dž 6VIy ,$ey˪\e^`}H :[x)ő= jhM gz1fR#lTW~V8KRMV:{Y]R3iWب!?XT,F:fz!C}maE-LkT>)u9ygvDf;/lHNV0.y{ "r̓w'WS#GBob*l^rѬ:AthUj~?>-? }g»Ӫc[L < +yIV\s芇!f'/M ](e%(tA0QvطFB߉1Q \[+ʱ72;-@j.NhLbvx@άF@r`vF}-g6ԐA)٢W ;B4 ݒr嘿i>P箂~gw 8UjK,l|*(C:#0}ִ9?@[ *60/v.e_!lEvd[$P?S =YZ|u h;=䯚+:w~(SzS:v/Z(ՙC1M5$S9hfR[Ko@g#dQԲ ="cKd8l舸ygBD"]L2iӜY6-\rzDʸϱHCѝ@Y`'Nx1x\F'B71ۜƒK]S7bShm[m!W%MH޺CCO|_ykz꜖;-RA-5_,JoMypЙ 9V* ϫuI NX;˪-$I&3\MXL  ڼ;QN[_r[C?|CA=;yfX,DynDE&Ty,\D<>dva> J7Q4Ȟ1p.U83Z^mhbŰ>ZoK);1 D,eu)W}.xߎ+SZD}52)Zz nv$W ,"M3L6`*{/d:SIW{=} ({CT^W/rSSTYdV` 0ѷ/̔eEμoR;F ޥͷ.6!Ri^k n^asR4@,=a}Ls[n/k&4) lX%8 yn} Y>>(,I1\Ma>$=E]QP*Kg]*7ۃs7F`o_D|XUX&P&JVuvvTFKi( Y: kEmJ[TC Ef/@9iQ@Bf:`͝#5s֠C ]#N7<6:S2ރHʣHaҙ 'v _)y?KEܜ^Qڲ-7;id)$βO5#Hxj {g~:2F}+c!'egŧ9 9 Cbs)+uB # T'3YE$Ħ p@CKNWc eutz lNZ.3i{@wu< q`m >otl K>9_Sۚ7 @(+Ɂ#㔪[%x,w!̬BU]T5(*`'Cؘ9(;[g"à6IT[(M d],C-}}zJ~`]m=¢K -59C>|Vjͤxeo5 7-`IY4 n |i(π0+EaG,qSR '[P|}~{b^I0QgcѴz*y"ɁqrOBx>p>{YvbySq,nK7 yMpdEp܆ʼnR_hyq]ҝwүi( S0W6ki_IseN󬯐3 Q] ,.1yJȔ$/D>R,GD PIE`Y07%n"ɛ*NFv3@; so(!% 1Ms/_#r0NSBȦ8ɒK$cU3YƿT 8m]`}Z4vWŌi|g+h? iZ@@)b1Lu#2z㾪0F̰A4nMα5,pV1Xs><^h')x]xFBny/`sds[|L姆Z&y~qI<2~GRf8q(vZ=f+ $@{u~aN=ӖfZ]a4<@_t(Pq6btR 8P5j=#lZM%_aibZ<2|U<__Zw'AH&&p.A} 3(75q[*TxJ"n*`T(G(*=zgodȍA` =xq tV \;ac){ (Fc<xYg@;0;JNJѸN.(_nހgyu[?)C ,I4UK,ީ bҏA臑u} cdcuyVPw{n)gS]e| mr):k Rys`m@_U֖N}PG|~?F D|},R $1V 2A |'.rlhBNA»_bG9' "5vH7;)Ş324>s*SAJ 35vzݼQٿS77๕@@UB|ө4(iA6py\.d۟(@%#3 =r ѻd s7*̰6x'j/lkt.lwUjy1),IzA} 沗n"D~ d"K9X7ns`6&$Ep^'z=GzU8G ˁFZKyy|/PG_m_k(Pp=jQA3Y6!pwtoڈguV;~ɔ= '>HyiqNS,45j)>Ě mܠ+%b㞙7!Fu^IÜqhԬ#@Xx8]$~ڈWMPn( cb쬅ɻ&C8f[S@uԖ*M5 ۺGD]Wb{LE\Ȟx`,>r&E6}mģ0Mo"d$|'?*Є)7_BE~{(!CK8SB ~;<^̳ش 悔f՞1ϛ, I8uvFrcVޖ ӳ"a{gC:9֐9Ӝ] ) 9%}x9qPt~DѕL<6Dă= ˵Яb7%ţ&#p/ֵCdц >}AHZuwOAQIxju9X5y~uEqs6j٬VhЫzfVD K*wi~c_vl!YndM`:Oc"[ոro+X>䋫19+'-wX-Ǡ`V(2Némg"kh2QIܚ&< 1:$X;kW%3 y^Mcb5x/H ^yݡZUڻ HکWLQ>P;B ``Ĭc6ՄGQ# `3;]QP8.9V̨B7C&YH{}bKM޹ahEm{;D\IcØmze]ZNT_ O4b9d&W܃t) Ea(Nd 07na r9KEVԇXeq7Ո͟=vGYt+h2A>%+dHC]Ƙ,L1fLyZv2ۄcZO&繠4u3:?[LjK"~̈́O@j㖐JιzU&z]RI`"0Y,u}(sЕwPyj$'%7`i ~{k¯x9\BW :3n,3OէEqMilO'r t%Ygjl4A8]Y. ޗYO S^+兴 ,Ef v6+d}y$[~J)/`)11K2F)M^υkz?œgI$H.\ F6*e)40t EGљzCrM^BmbJA"[h` \  g2~n͖;n,+ļc ;.sߘޒ:Co,^)לʬvb4dm˄Ʈ M/7}M(i"#ڕTJ틥S\B΂|%w@sa3匏G@0Dg4t@=J\|?nk:VAl<}Պد .􌬣ٙPPWX8MD] Z_bO-! o<=f+^~$VF$}\^M!lg vψEq-hbvH%Gϋƒ枪 4H2# @n sq )tAlBav%$rܩŷ>hk*ª|xV֣u(#‰*96Ea3#Uqy ޥ6wʏ r%5 R+UUΤke?``v˹;M$hs95A[(Nd%; ґ V BC5KMńh` 2`Yԑ Yp- 1Wfܦ!Nv&ȚxQ]2nb3؄*˫`=VuŰ'_Nc(iu Ѽk,3aXc>p6.R+NPKP"Px{EJ?-_f q BlG^Ad]:Ի"ӪyZйsޤKP[$3@y=yb_Sc+)|QcR]'S145dsAnޚp&]t"50fJT'Ѱx6z͂P.xB^kL_rѢ4&ߒE,tLB.6Ŭ)~ZsC "f9dvXsCkYL2DV:M="r4o2P$ Nw.hZiu;Nm!J#F׸ Sc@R*ɉ] S!zCU+uudW;yĥuvIb.9fʛ HFW3HH/ AGdt T ]Wwe_x[nr&"tAau5xC #68Y9(vޜZht|5f.똑c檼.K]AV(JbbPR9Z.{ F&s_=ơVijBΈ tH:F7 {T2oUO5?zIc?rqKO[]*g ]K2,:<:50+qC]zWO+Td"ml@B/Gu%pVR,|nW d1WEJ϶y-vHҌ,d(?0k"i7ס*k^ȥ 8u̧zSRF+NF aLY:,ަ(/j vlK+OI6)@8_٤{iiyٖllri_$Hρ:0RP^r1}ᒀxϿa+jlRu%҅hOC; fn$+BB%pQgNUo8=qwcY Z2dw+jڍhʷꋻmSOAߠtw`JJФ ĵA$,t ނCa^w+_`|YsR^{ԌFɜŇf,1m-C/VLγZjvU+U8d7Tmabҙ{/,B$ 钯ҕbf b+3|#lQKaE҄ [=k3vRa|P pQ3aHx`0@zL##IH44.o,BЋ[no3@ \ֱaYۧB? {*v)N$jA~ѣ%+NVQ3'5'rUD 1Bq0˲"ұ~b 8vGIݰ\\@{MF-ʲ;:хb~&7VVKN~@̏ п. bӚ1=l8䍿U:2Ih{jJ{ :̋rt5A[t@Oz-Ip=h'7:^Ո sg%ѳ׺Io~x5v:3%u˃_+q-9`SK@kC;hE/忍%1˙V85 e h!Takq]2.QcY`jsMr۷Ue}%9PQ3Y֝ q<`oFTQM +IcBaR`c675ͭJB J) oy7Jvqߝ PPw2/eA[㌵ge0D1n R*<1/HM֓y#uFU=S~ENSm9ԞH-a$,߈qۘA|QnbP>e,4 ?.4cbll wr-%:ĥkmp)sNbHBIP"vJFȬWu`Hx ߁р 4 I`6Il ±s<}:Ff7/ vt<M?imK;j|&-% YȜ|4 "^#YgPks)WE艅s( 8r]6;9@b6`]?,EƂ$I2ޟUV=}= 'WCSg8x jQaH)-'y qhɹy5J SxtHp]X~9<=(D+P{h>a"3R_Z)YUHcZS'5|0vejCГph(u.O4TؓT?gIJbWr.~L>8C/-IL( A \+XMS|nANަ ^ ?1v}'t fY|BVe̳CFAFJC҄\*nܰH~ 6e",V.l` aVH|I*!D 땐j qVyGi,|: 5s/ʬ1zQ襚VoݩB+%%b˅uќ߃hN*.ě;[G32@sjw5.P 0c9)m,Űy5A.PRvnq1Xק3+5 [+R]*jbbEIU'pe1n6c8Gyqoe f>q4xCFf{dxUFV}V!)mIf؀ytҕ5e5z k9i(=Wo!]Bkpؘ\aBOQ&}w*/f4gltk {Ox5(ECQp@JBTc3)hߊ|#`vdQ>1N+]yCtzPfNx)yl@ڱs6,M?)3B 'Ytz D1w(6uaAו ?mvp9yt.#BZYX& 1( {JRQah\%8!ZDmrTߧ/BhrqKxڎ71og{X[bY"pkZcfgܵ/n;}MLHwOX% s3@b$yLm>nh ʮ)v2~Tb2v).Jv3K5 %lhu1j+ P:RMq>d u O;zU'!U (S%YG=](dB K_No!ٵ*,$=W ~%lE~w7f @\9ܢO:Fnk[Fbe۠#\Sa'A?ʹ=JQ rT7*FUJ#th Žoz^oԖb=#`ZP猵B&GQG[]l@b\"2$%|v#ސhg}ش~  1xۑ^ٺx#X@ 5omy0L(?SsUWδWY[L7dgG`RD~#hs" vRV: 980HxMrBy$3&1>F ŌPqa[eerlerF+(/BMٌs/;?fѧjaWl=ьTKB c?}.;Hkus'}NqhU}@F:)d s=$t@Hy\8HM0z2ab<7[̺}$wy{q w4"gs{xSPdE"ܔ1y Uc}mUbBnvf*&\ߍEɻ:JZ攬ÃqA6gݿxݧ=L3}҃4 v A B{wƶqlTbELS0`# V|Sa` [6oPZ˶ABExζgۅ<+B#$3<&_" R>BP9[w..^:lPFbu(J -mo. d=~h 5,1DEaH"j=pLm< "W s~C)]`@Ǘ=}]xX:el8(MyO6 ?vJ𐙭FD 5vuUp n_CBaD剋}@q?'G=ޚG%=-SmP!Dzl=}Ƙ83 {;1Zz­ϟfR#xk;5-&((@acF! fx. 㪞o=*qX)hlDpF/Nc Wu)0WzNFU09d{B%.ކ3)ʽT6s8]"ć%L[mCF5bAaى@!&=_q0 Z.4$h-'I: sCX T'4Uv-3X䄿6߮mc^BsF>e:8͒ld'ֳ>-v];x S4 5\#ۺ*K)wOq> eL35RQ`A/{;ȸ5knJuf@s.uȌk;5ڴ<\)ʧcQC -P|2RIzӦhˏH@&֨1OnUjr>`PCBXR@HG'=EY 3A@S_W)yf/{FfsV E\)L-17614T9I X&#1G_.Cߗ(8%jc/:&#o`$F}7)}df֓"_?wR)[A HjeU-X Q Ҥ1 IGp3'1)i#(`)滶(Ch¾iX4E2pMip=GÌGFS442P}!ƫbɆ׉}% (㕇ը^F[obWlArf|†Je5p:޾RKD8fNDcќʜ$r ~ƯC<*7R*:)y=ƣw>NY\i &ӬUCb)n "9<@:ZyXi$γxTߺAddpq{+Ò<1E0-6nW4.zRMC lxeMF؋,Z=ÀF[jlzƋFg:6l5Z#!G 臮[F%?;ldgAaЕYwG/:2"r n4)Xs%7KzphD S_#ff8yz{9(J!C\wZ!KM(;Eoq ÅTzvZYԫBa^;luw+Ő3?lִ#pO-![:zEa }:9a,Xu4m&Kv27 1|$s6_y`Pd&B@=`Z3=7 }:TSO7bƖ:nI(e^7tS `DzQS$3/ylPZضFo[nUZ/2TR1 H&!`8-(4/l^ߟԊK/Kd"<"C`L6l_p%hny*9 doN=8O@u}dF Z7de)6G] Z_y tܓ֛D>=%<⪥TԖdؗWQ$ %x\%ן8'WJ=Eo?=4+貴Ye1}?]gezuϖl,~>9'l2ڢϫ;y(?>ó8wb: UhAHn #h/`PlCõGdG?/A)Ze^9!ҡ8ž1`KZnЅ gN__BfJe/F$#g)ZEU0Ma3Ju*0J)cfrHZ; x1qmwPu|na}98۩E(7r-Q?e`C۷6Ig!DvUF+6c(j^qW6MCJYŸq~ iUTlc(t&H:gm9Mҧ0yH<ۯJ9S8H M[_isvn #x^~0 AǒU[ Qw/yպ$$V/5##@~9?*ƪasLnHt{ N3I ϢvF(z Ć{+pe#n?|hy%$f/Z$刯@M?ZrG" 2U-f(Ch0ڀƜyoTt72`D61HU66hӱ_ow_vZ-2l|VdL#T;([`tP]HOa~4,;'43YiWQYrOF8E9D 77 3 P ;PS^R$t_\_) eZf&z^jYR?7oWbpfxܽ{a|RG, yCx[3sMu$)~V*LQ9U,cB=I,*],u2(Y*]j'{|qp^K ŌnmZg[: T0e4!v# 'gc((EZFqf:Gc|iS,c~ML*7P}.Ijnĉu:zܭ(C>zh?gSX̽gY+*=y*Fp髼EǷ.tdZWO^B2673;ޣ$ 5jݶߪ'lY%%^,qAT' 0_;f A7uGLSF*{}R Ήum BJy ͪNsx)r،Rײxڣ0vkT4{gUm1ެ؛ԫkw_e᠍1U3\8lχu8V-J`̪!q К~O* !@ѕ~e{B-2$5Q5o{}<(q*{~c,-|(XmyqN~صu}a]m|=L*QhA.R#[Y܀M2:/[1S<_h~rΞ"[nG]:. ONGZAIDQO1$6_Lߺeni H|8d7 3&aQX "^ bZi +DU:YIOf`20N8W+#k$c?Y+² ٟ_YJMO#whNͰ\~i5=8!RONf .Hְ6TfgBK<]6ꡳhV>>E~d)iNjKO对-ސON2z+0x.2=ḟeX{"BIXxEFA9߶Oe;R1 Csz_i 8<ˀaӂyXeRQ2^5CT;K<^~;MB N0A7Tr .sHƥ"`%wxNfgRڢo*/G$ռ\#8I2ir1n^f+nf`#.LfE;S?}%$u:<|TX2ny . ?bw%%nyԢރ+1%dubcu?dvUsSyRrx(B>./Bdbn&3SvZEb5f7:2. a7ٮm mrS++Pk^51m @1ᡌ2LS`SЉԽ_}ՠP,oAA # ǐ{;_,W竭xf0 Dq;Vv{U?ȝUȒ8-$%yrFt9IQ`HWҖR)un8]`\@'w$6S4Z)&`kBbXhJt- 2ȍ}M3Lۧ6J11aP u{H˟M[FkX I"C3XNiogX_q+l p X-8AQe?/Vi]j[ C>3ڸ:TJ#d;ؔF`22ȬJ~ 0̐XkPyC gKPVNz(ePo>+JAWaa 1;0bgumCrTdmQ'Qѻs_LP"ɀFg"CӺo$5݌ F2~Ÿ \,Q#T {j^}p OOtQ9C>}=]O$Z:뺬D+E P?qߙyBkf O[o,)i ,bˆ;-qu@ r;g  .Z Rğ{I.$zH |Ԟ*T߯şCwH+$x'4eG>7mKWYH_E`{vbɤ{hF㌠c]Fa#v2A\Yt(t:YO]P8γҖ&'O!Lw#&J^5;F [dRpg$D{8ly"b-ZK_D[)u“k7vN\C}w'shrd7*pLF`e(#.q N MW3u]7de<5٪ej$- OMnMFFtJmQ&؈ (:5%}+4(ڨ,* HX)YKbi/ζA㿉{Œ;[ٿi`!%m>4% s~s KO_Wi& 6Puۡ_kIŭC% |/WD0L]Z}lu-d#`b!#©u2.AUKٖ՘a++;v0ul')~; u?^zIWmE[fp!"SX0PoY ϵk% xQon DO>zaj^1EgPmeodn,gQw6w6%u ܮMROTȶup<`%ѦG3(rˏe"UN;LuHdڮ@kLⲑ|/. u,o?m]u?$8[jk0c ^!80誶\u솛.%㦞̓R'v`I]إpk[vI:K fQ0jӪCCkG୊30nVw:8)ƐTÿP܂5J"$|9ǮhY%(]BVȾ w0j 2GR/$|>u%qLiٔJIfNEOUx!4\CYOm{͕N ԇFծxh3_t = pY,I?X&X@jKGMCWFd;kD%I I[3;c:Epm{.(5(ٕ#>VDz֧ h1cTq!ocLθ O i7յKt‚);dwN2FҦǓ Tk~;1yu6EFgy _eKP2 :svU9`@Ŝk#z\ZX ݸ/LZy)v_y᯲I^dk5azH B{e,C󠝃۩[η>jCY}7[֓-13b@$>a<*p]ܤ= °_UC|V~qOGr*dNh P'"OJn\D0T}S񳍓鮥6YZ{Mg Cۣ[s8 &x0GV̇'lIjZNL^"c#fЎ9R, K,$q[ξTԤֳJ~U<0O_Gوo9cXm~TU:I!#g*oT?UOw $+ZnweS7D۝!KFֱ]/[lOvzP)q ۨaGʂkƴmH 7j pK@PDBE%͒z -O 4eR9fa0G1|u ggϣp_ksBsZr2f>܆ $2\I1=4Q+ˆZ`ʰ8kNoc!C鿀V}xRϼ?\u91 dSʲMG$vvp:.&r "7hZg8` 4/7SeǮEGɺ $ ̂ä)2=WH@:x,{m1t|09x#7YxjuΈo刦\N\yӀ @yuxePe2s#Xm# cD!$LљxI"M{˿!T͛Eq?UsJ8u|0_󸍚v/;>d^e9cdHSUfK8]8 K:̚I#P粱÷jPv ӂ1ا,SnV|ѓnNF~FcE5WdcMq/3X *k-L{*'V蔮ByVy-GX. aAZ_;(iAYXH؎6\;Hv*,^.$i~ dE8M; v%Yߜxg(`nTYzu2^BW{;jrrrZx ONCfD"Yf6% tmo^#ԥJ#B_}zؕ%K}SKl* j{5PGv] ׷C}JYug3zpos,vQB 6;Bd+ \'"GMd2=[NuxRF`F/5D/*o+%kn@} S\}s .W|O zcź>P]v90F˨U&❌;%|s u(ӇՈ{Ɲq-rN˨,U&l0?ە-jAESȹg+"t'r%u|dYD5"M:@{ܯMكQi9ԓhۦ{lvtS0 S"Vp]B+C`.Kd ){Cٙ=$fp gLϹ݃~э'N!a3z"R Y߾6s ]f=Fk K>eZ;Y>|oIGVܲfC%'9zb=tZ6LH⥨%GG -F7>!a\a 88za}(־&U۠roKGeWr_:u* q  ֈ " % VdqzXu-ն(3~ހ(iDc|Hz(+p2]Ί5Iɜ]\mj&h@%Z7z@9̢OcI}jmqO-Dm9Xum$iA÷!Տ1`=iABk6 _>)\En =Cndo}ŖAGKY8 uPjs{Vlڰ /Y}4;/_: ՑsH)΀A['olx xX/r=|f"!VnsWG= S<2ZP_Jz-4> i:dȀR">v9훡R>MF`7a;] sC^ wsr,s8l"{I7V$gce7eUy^\rNKN+LǴx$Wt?(v=t-ebħNi!kLi+kz4r&"= 8(jeSj^?ggoKVjyg2g}-8ш7caH!= X"ؑu,ƓYs.=I$g)>! cZdbdKzOLQ-mxYԍ=!lHO#/K%͵CD/cAaUo%._ȭ!LJtU<  w `scuRI$,a e\tr~ 04^~"pI_`edS6F oWf Ity7 m9 A̡>D׿f<gw[_4?0mB! 6Î8^m ,N}LG9.pCS kB[}͌F4@PKef]pEsD' HB G;gSɧ"4OB?Lu1~_oƙ@ǵ^ǖ#ѻ{ ,>Ei2ԺePn>~((ZE1a~,{Ҕ0tǠ)&6 '|׀ǩr"CG9` Cwت%I%aCRPyH91=[6BM.q,}\ [ }uBk ";&ugDj_? (toz9zY}l-l+TC*`=?_`&W8'_ ߐ=pV^k>\3&3RV:ӵmggEbm3S[s5tlKtqA&\9C=tCCt FŠx $\j27N7)/}[#UmLɫ$+WRQJ {8_?`vĨia׃)ӫ\̶ v_h&Ҕ^FRzLs$ tG]CrA V)o+iтø<&@>nL򯁳Lױ,,30w$ab{jx҆:xy=Gy4J2/ԣy 5Ixt=Q@ov&w.BOE_\wLv<{O ^fk%` jx7{6HZJ[91r궸ZZ·VW>PO,pG_ƪiK[ܡIZRqhTb֛MP*Tr4J$%3s2O fλP tjRbq8h];HkVKāz op՟O\4 d <*q풝gToʶ%yܗj/ ^*а䚐wB8ksXu˸!pEi E*QpF!6ȘRUWr4%1h*} p"j!,$E*MeU؊_փOBh!iUZ=l]M=͗ڎ1oTI0thD {9Nl@-DðTiqpX7,o4o0v3O5f-ujU#-=l#cÏ3k5@`dh26j`x(T(z+D("+iB>tómM с<8ÞQ`~_ԭQ:QC/ 5)&MYQFij00D Џ?^Mdd+sBf{v%}X㘥Vdŭ6V1*4tΩ :MqsUviAюlRgH<,>9[1R*~V <ΖF&# m/Fzͼ_GD&>6퍟u5>Z#O0`)Ҟ';z@{; m F3Z=(R2nJ1AZQT8 UOjSr)G̢]orTЏ4i<0P %;-ZaÜMN`F*aGT,wDWO)rcփK-f=jE=[յgrWlLv^:;Lk6/>JH-3Z bLzlB8}MtR̒UF!#QJvʇ7S \c[*SzܞTϼޥ '5!|_X ×Yuq[?ʩYدtf'HѬWA"3=Pdk$=lӳ3B )iP#iʔODЛr&9'ei.L!\)THoU;, dflY]4~l\'[r >l¾"f#;^Lp]k/{ U|yW)Pk9(X*3حUa8`CwH몈 { @#k{"t>J+pLL0z~w˅Ymc*y*$4Fz&YYz{,f4 1F*p|C#v9RB4 W9:uM2UHUw׋dF6!ǽhz :NF!G @e=H~ulgQBH ɀ,"ߢq-Eu7^Al𸣲q}zE@w?#OnԌeL 1tEz%31vC w(~K-6ϯ/7 @tsUJ.qT|6-JY) +T*B͜{.$p.g_G^jT8;>[v.@1nZgҥ0`YVZ%O9 = 1:%H>8%08o#ӿ}wd {cC0-v ɀFl$3 -S(B;B}t~.^, Q0-KkD3y&*ppY##msbvIb?G K0}2$˔F9ݯvΦaOf ,Ეc 5VGm4`8˿ep%"zEq}l<w=)*Pz-(,h8=npj"809BE BrU*M<&h7}1YmГ_4`o(~Aw*ٯX70 eKE|Yo0\~﷧i9#nI~@9vЬ6Lz_hƣԝVz3-O gn;3!)ͤ #J7aצMӁM]\`8I6=ZbK8 4sM[_v+HLnOCܼR)>"l Y/6pLg0\u?_.w^e}K:/W$7i ͒_>OD+.VOBZ!6 bXҗiR鏬fpr)#*Em647֐6\#Iv.5U9$K&-?+*߿Qae/QAr1xT7w|ةHjzUߺ*:ց<#Sѝg <|Y2tux$M#ZFZK9SX9C-]Һ\IɜR'A -{ٴsTO/uߞfuxZZ#>3j2c&+Sya /&dTr[p0tPg<nZ,9: Hj/Btb,zBp@=ע@I'&SQ#_/<|ǩ5؛ XWاu_ߵ8BAGb'F_ H+ ߀Sjn ZJ?ޗXASO"qIbs%̄vc9dj_8D@^<+C}~[L"ߏ򠙂"OWN㒗޸fx`+%]uAQ@~—;$^tGOx"3>8_]鉵0IN^35Z(1$~E]r#{f3HY ݘP4kQmSlmzX5#lن ςEkhy^R?Y.{~Z(jD'32!o,nK%OBGFٵIm,Kܦ"3y8ىP!Iwچ0jjf=_:Azlyf P8@ʾ,'R:&~RbٲH+C%84$޵&ЙAw3&/96Ty(֠'ݖGGҳwʉYub\W _‡u%$j4$cEpI+˾dU INB5;6w2qL-2X)@4[ܜWw j >_Wzl4P{6ymg$tiՔiLYLX1ܤ>8w>hbUʥڙ<}|K4U S ֣/Dd8LjHIܢް,ۙs 7}0z^ږuU5_D3tY27)'C,##*JhNBRXl (u;wќ3&rޔ{i0z"Lo2>黚T)g*x:rVo84VΥ߭4=!䯗lɓÙ3M¬<&0?]P@l$o/.^zC@LQV`;t1aVFW}ҭU='?@eM~-E/r 9_!+d8Zz@]"P+g!ͣ_r:is󒿥ohQ4(da9x9J6wz(Loj.߷ik푇nӿYS" yOeŒ(,q7#|cyܫgR`;)l ܳ[bCv<0~ct1KO^"|Yļ!0/1! ܯ!Q;9pn7FGŒs6#ԁz%rgbn!L]M8hE'oUa+JG+G6Q02q@~^|2AyCeZ5<Ϫ{QYS?E~lBيu"OГ/}f;O WrN,BVi6>-TT\AZGē:3,f fKI3lz™ =)7]e0rm?ۮT=\G$b1UlF }-R[,ԝ$߫pv}^S %!%VStQXR2ZcD㊥kDCg@&8X4kZU8 ?;8ѧ`T%~ΚtJCZm@?UC Y+(􀼴@I IʃYo*qo_4%C-x_;^^D9ްC9}0@۔9_Kvׅ\~op O_kA9$"JoikOT5a[AU$A.GӶ 䢨ݹĉiȞL{ߜ;ncuf,ՑX]Lh[\z9k%h|k LĢ)0СzvhVUcʖGᆽǺDMV:6^nH Pa/0GVu zg&'j &yB XA-Xպ;:zU!/t%F҅)e{ٽqҫ>OlAs7Hu R}"c'֗xTq=cmbWb>A[vϢVr\-/@~7[>?SD8rORa,Tk_#nr3AO~Wna>cK]T^M?9ibIf}4 ^l ,n82jXLFR]Dzy L.9%$ԣC)C5Vx&:gRveUKrA`PEjdq6UO;zjLg /OZQ@%zC r~z3oiDW-(jR &0o;gGL/p]'5Z@ɤ&?5$=}4Jt h+(4†c檮3`.D%aU }WYOPʔFmnQ@'zb- %ʞ +oQ2s<2l:-7y5?N98N\V<(ܬ6א-{pH*Lߺrbb=N{y'rʓ`{Tw+U $R$<'>R(~e{yi|+!ښn; /uKU]ID7ە%ڭ=@ˌ8Fś 1yK!g+Q-Á$+࠙jکb_ h=R햼],_ ١tKPp l83HX -@"(n_χCx>ثHeiS};D)1`OD>f)? &Hǥwpڈ ʘnk%+{u4j5y&>v&3"6y)WW\Q0QJ\!QSR˸L%C% \F}+w` YymQS#~JKy9a7IB5I %&ѳ7BGYb f lR¸ y8ī6NyWim䗚maaƔx ;0dUxu _NXCӉAfЅg _GZg<H)h)VF8຋xE39l5&qzk"7,mGg;Celuno)@L½Cw쒙΍7T8i" $:Cl@ƃ>VwyT|C×FF({(jQ"WyQ=#t-޸5lWsW=VtFS9.n^&-|OW4mͭJ"b?.׃N)XIvbu*;{Mr35xxvM+Y>$x`Bא>Rq(/^~.WC aXKp-+_2Dz\3$j@USPy>@[ʝ}8op(C el؂`HT˪Kj)-KGTE3ՂӖ+$/XkuFw2_Y#QZh80u(V -RcUXU,Y@{[]3C2Bk2cl:pvZx•i,"K4Z15z5(1KX9Cj5eYY~9-c^p$|r&gJ(jp:I*A*o];1.)a(  ^{5ڑJЪGjY;6Y%]H)`#3 2sED%ޒAYqHqb||rؙwO)ܼwfVո BlBL -?PܹX\x_SGa-;G?R4YcQze68KeV XQz@'s KanuO#_l8:\y[?%5{sX5S?IbHW7R`> Dqj+7!ttA"{bN,Q')It ?&yF:Gt67NpbStEJ蔉*Pz;\n\7;=uGs9&J(qqn5oە=baIjFkpܹ` O[-?Y'v55I05`>%\?/!|g}2i/q-[gWjiF#8Nm^)5\0Bj?cB6ܔ{q?C0 Cfa/| ),"!*y~؛ -Lcy{rrpsjmf~C <_.K8{2=`J)sMX&q_B!;-N"T76[H~JfQrsأ=#S#ٜ_ph&dWfQkQ+ayϧ^uyq&u+4.NV<$2)(6FT}2'\b r xed9!-\;< _`*/$ż(M·iHfvx(]萲K?Cf~7\[9NL¤:Zpdr5~'0rywrF6c,F0(E]D r c@Crʱ3lqc4lmYw+Y&r#zaH!*2lff6?9~?3R'2 Ċ9ß0X ꢓX뗚] OyïJ|?5( η=L1u;aP5?Ŏ|sp/)#'T}ZBRob"pHKւd5r!vvUFբ*U'ڬӇ SzL@"/I,:ւR>*<_# :4+\KY*k{5|%Mź +D X EJL`٪ ~퐨qq2taFWNAv4gԷ2埪RjuT4^Zx2F^Y{IԪ4$J h,&/i b\y1MjG*w\zb$I43)^Lk8\stN 7!ҀY2²$ufr_6 )dor%'ц5F1_%0XEq4p!<٨x"ΐTzez` "6l 8H8cwx允 Q̶uC%{7T\~ i]UijZ+yKp0C{Db{Lqj :тM#T3l?l, FСi1ŇhPcB>2i;s6I-:f> I3"SwL׊Iˢc\Ț8?p~Ve=E'CtP(5R4:'T-e/t"pNu=$9D|*5=JTC) XD;SbSsH:6^CS7ev]Xf\7cKY=׶M3)HˁJM$OxARu9)qNNXDto+Az{й2!81ډ=\djIlt_[OaI I -T~|Pb>hfa9)M ?:XV#;8PL6w3Kc )q -BhNUrG+"E+̝x!:€݀^Ev]xoA[ĬEffS>S0Al}dE`Xh5^d.||Ϟq;WGzq{~@%R&t8OǭFY1w覥bo*&R 4Kr3)CЍ)y)|r&6'}wI =h$u=Lq3ѯjzGȳS/q_"&!wA5^tExoDN`Z It-ڙAV<%a:j7Ľ|'f/i3e4uT@&~}4qdM.%9mD}1w.עsUX7_5M<#zב=Ω6zs?be3辯(?oȵDE~'wAcO#E9N*m$a. et<2F$ jzxVq@(d[aesun-NZ?\+?;5I9@ j'wZDM0Kb{}1c%P N9ٯi@}('cKA^A~x103Sq'kr9=bޞQC55M1&GY]K>3"p}Ҙ|U rYQ7+Tzjͧa{3PIܴ=*SqvIIϧ,Lh j,pgR:Ht MMiDXG") L8*Gߘ;]Y]8@6 y;4yM>97&+gA,,slwW\OI5K/<5,> ,LlB07vJF>mn<(&kYٻ?&8e ߸Hϓs)CiU+l{4U6b&kk.E;%Z1j~3Y!.SDрӴ(&Ԟ3:+{;ݛM*9Ϋ$гE qR|FS*WFY[%wp#+#0:hea6Yt-uD,O韘-TwpVN@EzQ?=]_ĒҲ ԬN{pO~9?٥KND+RjbxrZKS,+|ҡAcm)KěkiQa/me7) ,\h|:g(AՊJU0=5Cgғ8Pp4. K0d~s9{O{BɄ2sP.{MNg;YNpUZLIO}% _ԣ01VR.F[PRĐrdiКOuS^§nrtUt@PkթP >4P~n1Ola,6j@P׼IgkmPC ls!\PAyw)fԬ^<xӜohnKoh]IcbY/ D"xׂ>aӄzD@jPXׂ R,F&J+2޵-LCkmzVՉrJ'BQ]iE{" =KUÈc 7ݹCS+'̬F(BbT&e.Koxt*S/uѧ/DNK l'm6D;&#ZcZ? , ͦTtK[v9d,Yy {1RB7ciܜt}9fsPpCiǔ *.Ų#(u$X<ŊZ +V$H'-B; Bo?nNJ>yP EfX#A(*sfl5羅AɋA蚕tw9uOj{H3p6?}_TMV~X Z#GUyLBlBC] ,CwBձ?^Šo\6_g>]O%t Oʮ٧U׫oF{Luyzw2YCéRZ;4mg;YB8X'Tuۭ޶<t@͒"Ƥ> U|DK_&iy>hz^<7sv4:z=LYŷ7P)Hܤ:aqǢy \8Ly>G0: 5[cIÅK k%Xhq ¾(ƃմA*)fS~ٝHY|Hm8ֺ+9u%Or("yc_ @k-^BV 2q63 _Weŋ߻L[}kkfhR(OKe *?Җ7O qy#1D39f:hN uYzk.{.Och5+K$\Խ`H?|%R\gah2"U2:o YpcenH%J-ȗׅFD_eU%~#us!= GHDUυYh?0׏_/C5CoQ/$`+^άu:ΠrCo\Uı"p2G4si"+n#;Zu'.\ZI|+F|AB+me[ luY :ŌXcLn.ɞ0D(F'"Xl*f@(/OпUXǰ}PͪJ*۳*@î5&$+K=ݛfez 2NxB^K)9Y'nZWex>h6l?^c7-cg/dT + FJ:pa}G_A(tPH<(K4. 20dY .Ae<ג;Z" vНH).E3R@/G-ߎ3LzknSi70eAr&UujXWp%C@2pJ0!ě=·%{8Z^ww5#fg݊䌲.˩Tdm^/~.)ʫgsi6At] 'Af%(R 3\V܍, 25֠EڗX~Я5<AB-K?R,"LiEc֡ߙLy-+nJ]وlA44 UMU9l[A v?'|ʧgD~!@]2X~2JB=9];ɣB; i<7rA_bNآ(Ɋ(O'\nt mf'i%ֶ;d:4_W;kB,&G5ai"tG}xp睱#8nu5!+41't-* rz0@L/HzZO7̟ TWuŰqȂ!dDgs"Li\Q( م>`r"tfjodx9 ~@ "´4Lcdq2wRg@v8˵ipxX=bKZMsk>'P~f|s+u ¶E-GllNDGU@ZGUčC(H?62BTRV `nB$6~2H\ڂO!$iZoTCi78lk51r:8'bT{"^#5"ZS/1Ab8B@N8cG;z"V i}wIt=hTCb~,/@0`dLB4fj?Gb>-L)`FWχ 鉐pIJėL] ɿulS[ q[-&svu /|2Jgc^#7 .wH|\_ҸL W&-0)3&re C"t-x$XkʓA6yV®_ϵܻ.^5{!5 *0c1O=4PkUgЩ=8 /}[0Bj <>?o}LQ0"AOi"Y?`\}o 8à m.aO 9(*>1M^!ߏݯVTv9l)p3=\@~Ȏ^eX"2gO`gD-q4y{ K ;8hN[]fi3^NK|?ˡ>]|/4D- +f'G`=a4݆kॄ[7[ Z)"=x62̩0jo1-HG_@#KpbB3Pn$w'qڟ Qcgh?}Z׷P8,ioqlwzv jVMx*f]ћ52~v_icN :'x!]M_ VR~+)vF ;7i{f9pܦfACPu2<%ÉsRiX2nAv⛧UlW^TBbF.Xm@^J3XA__i"ywQ U4Аk4=aFw;ggqZFoDZ+6C fZKN%~&^lnBE ,%KUiU4D\SI'3pD~hOȦj'\h$ S\Zxytn.L#{$l(PROt-߾KE;sUy Yχ:0KH TkCj#A#(uaG"eۨ9j,l4~ KIQE4H8N)^lQBҘןˏDŌvYym<݄F<&˵Ⓨv+$o0廃:LDIkTo^>D@P1o[+ɞ۴u%Q|_n `2#N$+Z+-^k1K-.Niٺdo4{J8Z C5{Y<6M k_Ƣe/MkRPlN2C"C!īǒ#ᕬP^\*盹wqeW H OD(*k6bvQ0O|淖"U*Nw)ׯUP]= IcYӝBU (vɜ ɉI44(40fΖ)cIg]lH bmk'ݨW' }f4VG@wG5n%E=~"M SGSIPIV/Sɴ' MLzTB>| [QT{Pw0sAJF79<د`|MOUyӻHj1;o:BYE/  1T-\16uS-M5YpzWJ+Ir,n\*i2>s۔W$ڔB7WZ4|&?z~j L"L[xZyʥp'ΨߓMo>PZ+1),[d_Z+C(| _웺,įNΪPmZiSۄPaѐgxb'}~z6&dP~4er"7(a$r~5uH`+bأ JǑ߫MݝΙD7u M-'Gڬy[I;[XM{&i*5)=v&k?<:ߗtadKKĈ!^\+BQ=8L%3qbv]v⻈et8pe"ݽE jDp5iLsR,[Vj qsB0f7ǔ6=5QGٌNf ƼӷB[n"Ĝs kU13-W?*-}zʄYMEsRl! Ti!3}ʦZ&G̳Ϛ$h~ ɓ3Ys&?@Qġ^e}pgy@Vt bCtCa֛8{&Q G8DwҧizcXo&$<{/:ƢPxH\96wI ͹RGB꾄tn_ 2Q*M孫k (Qیj"=)z?E;n<;d0l2Vcp 8aLBKlQ[D mCRZPH?q7@ѥIy##ͤR=sF.ԐquA w s 1_h'A Ϝ=gkY}ŎK0,E 9fzE\dR dw`bЎD/vhKOx\{ ?eI1^FR b 6/о&W-Vo}3kpߜ03֯0hA@;n%|%=m٧I`Uځ5FkΆ4`ŷ}'˺ 5ƛ~?IqԎ .T(\%H9C%8{ٍ:;BD:ch<#"CgjA$7<)sHh%1O(M\z'.gO@<#kB >Pc -jgYyI-̠H-Fm )/LR0aҹf̏!vNCꡒ«p=J3NoK\"^u#]=EVQ.E4m#[2]Dw;n[#MQYz>8C7oaϰ;H{օq=7^ی.Asm]xwz-F+Z^`yHjB; O'=,B%RNc5x,|V/Cɾ8*)z=G؎mds$r[:N e z#YܐQO۱zDeEK94Sk k)K[K%n[&akUw ;EP;pPD]ndڕ L?m\lj;JV,VwGD]Kb{zZ_g۪$({,pܔU1t, b6"\ x&:b ]`,P^[`wy6#Jc"W 0n5JMW[;UvS5j Q?눱λml >_ip|\[d8c?T[:钦I?aHbFG S 5pdFF17' @*Њj%dM;woV:;8/-޶HMQZ\@Tv6F=7$H,8L95#vF OR#; K9&V5VeLIzٮTze1p$ q t$^sw-@f섀۞l lJ429ڥ5'fަ :E[!"RnE(vbR:rWҫ6ozxR"a)dWof&bάSIY\} m4WxOQ-r a+d&!ӝՆS+mr%rJ*7ѷ^ֵXfXl[ ҔSg˃.#5$9*3 9׽'a?QBRiPۗ[^L[aMzt6T:YM5&?{ZAODR˰LmoOp#At=X]!{(@LJ&iwPthɃQ7{ܴr4 j,-GZ(?E(?R ^`X6,>ڗgtLw߻d]wʁ*@Qf(6s(7=@3ӣ: ɮ;,_)GR+7jRO|fOϭ3_W$]}bPX1'Oi=7R-T_30s.s[W3׉2PE"7z>;<ޕN% atH,LΦ2AsgħƴCac'})#F2Իa ?SSVrw$Ji n#1yiADM.Kg |zOzڽi1!VL>++3Ղ:4TJR"?N~ bdsӃeKbԃm4$,Ŏ6(l횫gwH?q!vw(YnFz$Q-g=/k.]->Ht!0Ggy"fsF:e>Tթ B8#2,G7,i){0+  zϡ.Q<%CaA /;'XMYFTq`ͭ`w -}i'#a`ADB!|\L>^:r02^˨s=LկFImb"tE*"P_=)+tH֖ 감d}u}tʬ țuJ;$J1I-\GO+]tL: %ZRr(2u(bxX9oyg ѴP] M6Z\a6HCC>N.hh`)"Hj}es5́j=9*t(B$ -J2:RQ$>)WɡuTVoۆyfA/!0{P)N n}ъ)dlߤn;TCCgNW)E!APcKѐʈITqΉ8)8f,~^^LToܼ-Cͼ*^G+Ͳ)ޕ0Y ozy%J.ܳG,cyhGd^fծ8\fA2"Sp+kH#'5,GMGΈEUyCP۲32S׻_lȯǫGlȦ1 X(ev50V2ADƩvEn>1 d |V H3vyNQ^'^ A}É`X@=ǖ~81Fu?zk` k O0ΐŌ5\Z_+dfb)@C.̊lv4AǽpS c,GٝL8\c N~nu, і{3%|g[rzT79Y3:R^//fGbKgt;Ý`.j {@,x:0`WKh^räpO Dj|x>&v]2J0B1 q=r:TS8;6_ògK'Ćz4^MGĔn2l=93kuG^z9R`C_+/ (/!UՀ7G"P1&iyND5J*fjD= @l:83nltC(9MUD$E 'ihyVĕT9`A9C򃹔SqS\RxH*.6Qg< ;$#"Vgp4kL!\)=/ڻIPjX^Vζîݽ+l*9ZUGĖb]9Om|JaLby?Ȗ_UP&TX1f f'^},)t+uzϊ+ЄvC3})i"vKQiiu# $R'Ys};TSboEqrm/A 9!:A*3#a'Ulv0|t\F/54&N%fϻ-eܐ>OЭ!{@K4j-p uIk1OqeKxoX2) Pd*bQ%TUVQo4rx(08q?p>u@1 <܄1MՂj{;B̻4.ݢ㡘I- O n a֌:rlq'Jy“D u߀-/λP'juu2 X[lMw60x\ؙc9sPƊ1;k7*LJ9 5`'+F7rqj{~j1{!_AЖgx2tka+Y`Cf=ow*yi+^MN OU,ʉg@Wu-M Ÿ Wܬd\&e``>M7|n48pagYlfgiLėHVeKoػ}kPh+?㏡sv~p! 7糺b++ BiSKr_2lGZoDTDYaڷɶArw4#^aiY#2I^ToQT?ʮy2h>jCbH⋄x8I4.xL+k`5yDV#qZł~&';^90 Zj+O,nĖnyKXּrHM7P10B"U9޺( qf,5 ,R2h?x#}$YÿH Ҁг2@,]9[/EaDK{(fe%&:Knzּ0{(\W JYcqqLYhJ&_X*WӬp,ZٹLU|N,"V?}aqiscPfC?iM|BglPg Iri.~TѨ1eUoRq1&p̂r9"0yx(zLBcq?2G/)qrcFs,e*yne*("K\/ COtܿx?J&' ˎ[kd g rҘPm!dK& ¢ڕ6+ [jKtšq^9UId;\v'篋(7 ݶ/^嫷O^bkN@ǜ}Hƹ:2R-[*TE[O|h%7(|/:?5OfX54=[/%Zxa`yƧZ}0͸&=Zy߯SHF{|*ME {p// ]Uipj*H0զjw7"&c)& ^saK(#ĉv-Q\l1;7^E:bhԴTgkO&r0 >]j@1DyOloVձK%efZnm2zO8O5HP\76ЋI\Wg(61!^tG3n 9mJ sN9N7Y-t|h7o[K8oW 㥬#l5oe51z;FNnolmJ 5kd.@"VM("dQ9j!uQ턿t5]Tl/ ^WTf  - ҟ{9H\;:k!zͪ[$!Մ|x`M12BN6T7kv? ؽ_6N8e3]쿧D"vf?N@jbm ag0)}5ՙ[ @^GTxD@z"Ҝ.PF+,Lû+H[ud3o/*_kH^9DؐI:޵m _q'TxN.^BY}'*!D_L ؁n->З$Hn.%ax_h]C:`;o)8u#O]ה Pn1%7مaM ]CDm7; ~'B{yU)#P|I]˺r]7Es͢6ªzGr+Lbrk5' n-MPVsI/b3YQcx'7Gm0J1[ko ^E-"B!Ȝ{͵ׅU A64-cf …WzAK4!ŸT'V)WcX\j(x>eOT$"D݀m?pa\#3hAcx~`vCkds%&1OqF]g: (t}}yVHd`NL~0.@@r.P'tkEO xAW Ǯ;*㪹pΊFf(bA#94PROB$:Xx<`8tlKtRfRCŷh0Pvkb,c}tm]Ph,53xcLڡ@io2:V{J}y@ @#N6Z]KZJm ky׵XKw,b2X$X)VZ*4Wq[N|qhAJm# >p"tX_IDIQq?P ̵#  z#W7O4П4Ї+I0~iPy )r@Z@*xS>Tb~h<]MaAzWJ@HmfFU";7_WK塉%q'Lj9)嵗Y*cS5|=s_fkqPz609v ܓX<7r+$}'yM<=;IU* ,R$0=82F8!Ƿ&wFH$n9'Dp kgœڬ|S$s紓!k}U#ʾ(,R, a;?%wsh/&}F(8桲e9»ot5+̅-ګ*wm`Ciz*`1KSzPV+Vtla"{&.DXy+q ß&,b^ekG\dZӚsu%LdZѾ@^f v,yЈbPOo5=#MɈEtȼ7uzgxNYڜED>g NP awTaxMoiRJE﯀_p,`){;b>)Ѯ$umٔ,_cV %&*?٦Hŝ-j:?gAHlR- dg'4=m@]7pGT5W&*(5ǫ_)＄eG %a8Yj:ݼ!G;sCbQõTk/vִ4\-{L{m,t2s"B:NJ&?_]P2/y>όP8='Qzz LjsqZ-Eԫ_6)S5#quK+@3@іˤN $WbL//ODJrOKV|}&'螥QTYdiT~zsזptvgcQn"б C)ꄧ8NkzaH?x)\94lh9ogE^)2?:VTGYlD| 1\B51"(w'/kFN42&hݼ+O 8މkq `/> lm>ײRr Bw*2y9>+`ӛ/#FE*LF8Dd xD! \/qEuߞ@hFe(F,u*b%ƿ+A$flpL߬p["Ͳ)ָ G~wߜA`,icG8uy8lNJ0~0l#{ˊ<̎h?[=CbC3%sdc"vWQPzPĮ5@yTq#֓Q>A~Kji:2 w"V)TG҂cP0x;|0NM[L?r5#!] *hQvqz a$}ίW2LqDKz͗m)G{Li|BG.u!BDw9b݃:py6zVSϬ83glOPKxZ& qɃrb&x7݉eK@@~K|F P< B9-Ӛ E'epv1k> r/~b'o 鐯NS(RZo"/ӵRiȻD%_Iw"&Ljx˚u==AH{BLQ@Eˊʙr2n> Q5;g ߠвdu佃R__ݧܰՓ2p^ÞyuOׇvscvQ!u{TH)7-qo9u6yup IEbWto;FaV8BWF]̈́6&{^brBf"lfhBg\EnEl+aK=dDʰGB *Qrdտ; (|yjfDKF2*n,1H& VovF^DL[7L^ߊ_YMʰDTߚ8:H<_MG Kc\E6RbZsmM?ecVRj@aXf?9y%#O=\Wa'@^)]8|ezacoB4rc~Yb0?,Bf"y[(OO>S: oVozJ;_ ĝ՟o@0+9!,%yp9͚MYǝ:<[뭱@/UnTRR h\FIG#꩖yA gyHnk'ۛ{|r!'o%J|ʧ,9ue@0=ϙ$Yrϸ31Z*M GX'SHF|MBˬ3°RFs HßbyzR7~OVDg9Cx'~.= 8rzoFHR6q<<'K>b92f#̨}*//8˟QCރ͐ϿPsE @5/ 7ms'urEJecO=or.;7MKCA)㰪csH%ǐhf *Ew!-r{ЩqؕZ|]@/3Z1sBES1FXuu7([- CW*ȵf ӫ&~M'/(k 6?zrCf u G@[# 8TOluqdeN^/Vk1BYvFwΨ6b@Ieי5 c^ϺؽYi?uQ߇8)-x^ ݾC&*Q:ԗ_om@9r!gP T=MFoyQIf;%ZA1dHCFnA|o!lx0D 5KMmaR*\kͶk;ɽ~)3TViSB,| ~O#Tqϐ'袞|;˨f.n2$؛1{lm9i_^TI%(,/_qzpG}!Vx9yu2J7˯栣=]E#` ߘ&S1=ce!4 zs M DiG1:z.K5/= Jxi:$V~E>]`>cypVrQY ۯq/@&sv1:Tija+L{q2_C4(󄯾KkʜIo:CiZ:r@E]=Sn|h=֥⇻:]@g&W=Y:;&+ |xҞAO9ﭫѹW:uZW( m;+5(t;G>1hY?". /x4 %It7y_RBN|A؟L ڗPk7p޷?u׊9|YÉd\{uxکHпXB,1he7JT,0$Xσ͕C?w_+jQEP'$W:Ef A>L@(|Sԙ%sc4 FJLyڡwA=󈫱r|^N4.C>)1bꯚI$3HG#2mqGo%l\oVZ#X:cĎ[(ywG鑄 ؊Q=-J3|BP_6=\;De5O]=2X7ص<}3$OGR;&1x&?!ϻOĚ͐bGš'Sp2/G:HbI8 *Vmbgp#1Pע,}>JP68`͏f~$Ykd@[1:NJmcھN{ EȉLXD C:s^GY斎!Z@5TQg>ՁhByJ3=.Vt&C3w3+ j$I8b+`fʹaNo. WpnP(2%!&i_Qio2|??߰jb}gл*)Nr;j%c7QCNo N]y :?dΤ濓iH$uO|nkK9l۝MgiI3s}[+ 3r\$uĵ#H(,#˦R%%E{5âżՒVU(]5IX/D^9yPTu+l'bYzՅEd UaeI|[ t..9 ,S#q“w}$$D n8jYk/Xs,֪5gf\uYPh{$ǑV(B(4F0G̓ג\aߣ;ARI9" 'Sڭgɉ!7.(`!u7 "*pz /:j;8.4 EM z\o?}/sj+MǑo07TbUK-!Mםِw {>| .hWHXpp/0C%vK,u~lθ쉋݂9T8~y?`ЖC Mv4[i:69cد*Xr[B ɜfWHN  1?cz&ܪ1ֿ~Ot_Z([3GqN͑"&I;rшKD u{ߋޢ~:wj:iYl3<Ȋy5TuQn0w?-TZr1mxG>=9੍mrV-oB6 ~.""ZJP+G=&ڦg~OX窔 %"A㉓/-}<W;TuW֍)9%O0گCaBtP}s}w [4^H:pR9|4[bļȿ/JA?gDpͱsnE~*'Es öؼnjEOW`͛Ѡ,,(đ4MS>/qtY@mϸ49Tf-#8բ|t(j}ӈ!DVU˘R$AGq]0R+YabYa@Np(Y|MRulc/P޲*SkIi}Lx G"/nnJdTrGj I۸%D$ЩnJ݉$nrz2roS+FSeZR'=W$}N4{ }<#sSBE#]Zqms t~ӊ 'ՈA0DoYjqg麵ߩG紕7 l/L, t x0:D(SDOyk7KtC߭g, 9w7E |p@ *kY%⽀;eRJŔ{c\wIʞRtH{@* hռvY%-3%t09oѩjW@֧ ^@G@*d^JfJޢԉ=2xM^Y~L_9c\e'a LΏ4Ÿ T elNyzQ,I\)}OPCئ8ҐPZ᪋?|*ۃFNUDʖDuEطX$;գBiK$$>qD2{ 60{)ehtA8fK(N :vԐhP[!Q/[=|TATLPク9@p,O6 򶍑ȪH&Y7I5yr98 lbt c9u8;x'tFw_}v5}:D؎qt3Jɋu &`1I˷U 4,Ýw^SSWqb#v W'ִ?/+A=% W ?Mا1ְP ^a</QnN*׍JeSSfڅ?ꣾf4^q]i:tф}MJ2>!ʳ}#DGs䌒V# 9XZ-z,C:T8K9oSB}4 k.eЬOwp ;O1:dƏ>`:{(k8DH{̏?o.XlU BF೸v_Psg\de\؆5Gw F]hVIc8q l`nAc:v6R|L2eYkLDH!cnv` Q5kbUxպ1-@-[hI)Nx)&RѪ`՞;R00^"8dfr0YS#-7Ъjwb"nHE*ÚR0[wڝv@w^:V$G[ui K7ZY?9.`PhLB ۀf7;R&fSDl$\AQ 2É{{*+XhlxCgYnF f;Ws1Crt^7|x勞j %m?s-dosB J'F )$\#6 9x]T5xm$EśEUKrt:22RTwԔpY5/)H7!1Z&]?Kd跻3Ŝ s8;l[W/*7aer_{[+n~-[(M3~a+ėE}U7I]F B3rC,G 5sҒ\]];GBw"[k_a}=!)Jh{D \|+qMym R*Qƍd})Cn >LSxhra;hup05w)/QHSp s-ƽ7w1 Owo9Q_ y P<"8+nT@; -a#9}M 8tX@NrEҾe+1& Ѱ]]}-w #g* `*1ߐl q_Pڰ7(I1adzN_~ E$g@$~Lx7^]CW4;u:2{ڛv:Y  !pt2kÁ}JS!xQxCtAr@̥8RLCKQU3h۞QWdlW\= Ѱ{a"c:,~+{< #Ay^8]n~v@'}f<6sݫyV0^_Ebgڰf Ӡn qpmMu,RcՓOEV^=]xpĝP)T ?WC\j8}3ӉLxf|^NOՏ%=Lf:Rו+=,/)B$;Д{i/-Yxvn6yOȩ†@|EtܛTSH$ a$%ZSSij7 m`o$ąrٷ9ȡEaeWC@A L㪀[p D5p.!!%M:GDzSP^G0Nc) C5-|`Ahbb%cY,| {9܋ t(1w4ɛ:uMf+_SB?#=..MQY?:/^7#)!6:I7L߱bY/j%ٹCgU3nV#Nr<۱!nw U JS"QW?v<8Gx2z=@H< ՓPkOM=M{n@BSZp_iA&Y=C:!/_ U][aj. G2䷫:MHrĝlxLC:=G O߇~Jô6޷l(_30_l&.\`EJ1K{:p \JAaCSL ĪNu |I(`6V$m eRn>:]@:B(s*+w-;]m z'6hTǛX=-(PXc .).up㝲2$BG܉V>8|҉1w@9 'sE? 8#Xb Me]w'6_=9W D  ~0,zۊ J=jA|Y jHabqadhġ/yq&zƾ=dK(l8(,P, :&`3[cȲ{Ȇ`:gfuw'"ARKu?4D$scNX%dcQ&]h}!!M4r*0/5GBcm(KcdP⣮ǢIyM}" _F}d+O{2پ; 587F*5iBiGe^lOf7o)@4lVc&0xρ'dRӵMOǨ4JkاNUFZ(0 f˳ z,˖r XkL|{#/ ~˅3rpöiq @n5v)4Lݪyגj$ȭWeYp޹n7 !P Y2<.ŹOYn)qoFvdӈ qtm&xm޻tFty\zAEI-F ԑ+c]…S"hzop+AԳ5j'<@}xI[>c?CuFbIKJfYπU#]o|ب4EiHr{~~⎱poEz4Wxf#Y-jry߱(/d~⅃nl5ؖvT2 WsU\Tk'SGf4P%t/Ϫ@1q=ɀbfZhݬi:˕iYHwA6>'fDY]yJn#xkUj`_\$ĤSǼ5Rd5AZ/WFdsW(iIEk[3!>K5EeD*^G8m}#E7Q)=ɢ{O([@%Z:ډDvba(eXzPibAJkk,ApFvT+|!&4:ÓX̲z!D |˼FMAC ƌr.F42u\p0:E(п|w)~o᱊%w4E+*{'џI;#4<E4y#r *t\(p|O(< P?5Fm"#^r0ki9%33uZ\zPU$y1y.問YTQbM$&gGVzS-6TF95=}]*JzjM P!)5v1.Kq gEݩg0Ziі= |;F׳DZlؒ(]>S3θۓ.3꛹/;V@ .T,ZLwoGP*6`A)+<@Fpesc/5 /{Pc$%X* ց`_,v -M@ʬmƣϓ,I*ջP v{ K2 L&J 8pd|.B 1,Ml{),)(yv1N[h܊>2O*/A.&QGh4^^s=<?@GIF8T`ٜGm>de&cJQTCoHչj'A[ª\9QFv3V!Vui@H4=]; MJڎ60m҅{&2-w-) ߔ:fO[ _PG8X:>RPXȁ 3@tk;GF.S VV[y5׊N>:r]cBK'6r<cC#7zgb Hr,ͽ匰/T>{+_ۆeׂ@ 'Fݩ&$73pB%ZY<@h]${ge93C^/ QG^n(1菫A&KkfѿWRcu }?iѾ(݃}qT3lfcp X%Hc`)ef"Ti?'R}7{u~g֯C{u&S X,? 9'L"p#|?X"ދ(]mI+4os-Tso#P߿Fփp ! &Ϳ$Cx7).Xukd\Wc?ljchVfvLyz.؛')?M5dؼZx pѯs7ª"US/R˥)ż2Ng 삵T5sqBbI##f&,:9WM]im⿓7+upDF—Z4͗Xց3|'k+ le{;d? nP/2 fs~ P,XgɘBw' ciI!*0&viƤ}T6\戥'?p)7fj]2QY/#ʚ @`KJЍ2NgG5^<*/?.8J0GQ?V Z^4 OÎ0.j?V '}<>fN4_`":Uq6Z) E{۹X^]Q&bt`G\-xF${R0W *8B5侧=FUʤ"p؃߇' Dimo3Doq=3yڰ$Ε=u<(t`lrщBY6GBB?cCnnf}JjᆍLnΈ|r-RApbG-4cfܯ\[JhS"X$caަ~[EHdB]%oO8ZiFmi/_!*IήrS5_XRe3mܽRi|DZ t쫨J ur~ܘQlu".P35v||f=cp|Dг$ JQo(AP߽KQ@&3W:,L%:6J=E iJp LWcyTrC\BCS0@5,' Tԉ@Hοb~9rf(_q_=,<QYRgH ;=JbrϢ5LC65n'(xLi&tPfͮ.F9y>mdDA=`m*c0>@Zi"O OLCyWmDyך& ,lV-ከ X=cRMJW>̓Vjs1kF 6i*?$I&@\iPk= 둏RXl.KؕUTۈפ o T=>=8N"*^;-,裹;JcMP}tԞ):T<ђ8>-m<'9wrL\IJd }h{q9ɦ#_D n!F,2 zd Tw%BC} ;ܥC4,Wj@a$75!euԲ(p;pjX!`(cͮ%@Ëepn_G33޻O{Qi "yrt.d))qAMz*1LV"dcD UWB.[VEYqIJcxK>t@O+DVZ?|I)'A!>D!EW5rQ Y#Nh7qoc7 "h74R]PvnJ\v亅pA-qU&nʲps o>.sbh,BYW @CLEe- &=p`.nhoEʉ|\:Q0@5:DŽ?!sZdsyGGyUNe-Zw0 *utqtzF+1# W>ҠUu}'0TE2QHUpMƚ۲@WE -j!@zEG{`M߾`]'4gekC(̡~ͣz΄x-W7j|7o=l.yC"_SYRs2-HsNx) 7Z ڸeSCTvE@xq]}X #=Y2WV AKN6i7Yuex2btKl-Ya48s28+L)U˄n܅]A=:6B `,Q =~a_8kES# PŞy+_sf2uarxc$PCp??ċF8ssn>P9S9jRo>r7dT ==? !\L'4hգlO3轄kM`[I)x td oQRXx!\,.'#~bQ?! > xLl欸7nG}}֖M (`t%P>`q^G,ru}CɅGb-u7u56Py$8\e,&bo:XQbz+jWc+4~?})4I]k,+'x±xCSeE3N…ɺd\=ZjS2kv_f. MD r-0'j&`T/>VQmDcm}(gQ}ˆe@֐q뭭B3WI*BJLLNuNu7Dq2쨂Nr);U;1**g2Wn~߮f QʻrFzn2r՝gf09/H8ȪZ%hL!iF\s5'2qdZHg\0@CJ]{0W|gVԅ;)tO ~3};0q@-SH!o=m[?Y6{ ҅חqԞ64ȴ*}zP Z/[1D7kWAcIV's᜙cMm2ϖm?qV, rsjpUӻ#CknVM:0tEE*p|zf"bC*x<ξ$) +.LktKRD,CiB҂+'"s/^,ff4a7>u#:UgV9վR&,ʠ#5$#5E*΃E/DQ)k]e\_kDa+ZŎ| Ʒ3KNGH/9xZI'ώWIl&;PG坔fc!5]`"ģ!~###y5pB Px+T*ٚ66U.Mq7bFێ=u=v#+y5Fy:d1=X AB^WQkQ"ߘݡ{q~9Hї Sqx6ڎ^SOM9DC:f:, !L=aDP/@(r[* 硌hc&tҊZ^A޺žR೛˶64zN[Pq@>+[1PEb] T K?q=c}֑<("eΡS:1"h؇tlMFY.AE*骕.S|`Vw@p8 SSBQdOzjg?FJc rk~'$2Xh\:V:1Z 5wҪPM0%Uq[C=ftp-0ⳗyW3KNlNg:,4Ym?V0r_Ϯ|+Cu25  Ex!cߙzds"1_\ `%e@>(Z)l@ \q)n-fkw*js=xJݰ[پep?F$waeo=&ExckHoɬZWYЗGia֮Y{7yjm*:j4坱n9E0M,Uw5„fy\c֛w<=ZYex0h蚌 CM3Zgح@1F Yr4;_ p"X}}?~VVpUzih~⃼ %FsQA+N=nW.1WЪ22᫞tnhon}(R!\yX0N\xD4̖\TbCI|R'{K b]l\Y=_yr͖j.;īua,=x@"a4鞳a4nO& r58]_$Rt>t K+xP@ؖ1zXwgSC?5c+_u A^3Yj$xD6 v V+T&=_WQV f7s >.eڇ|z MR4it4!Ic)IVoʉxDFVw[ZFz.-HJ%A59R%0 6$67L~qLwrAr:"peT6|;nNf1FmrU)IsDe]fXAERSr#8UUs8i Z`WJe5֩E=&4dsW#L)ǣ- ROE&yD90#Pi:<.jgl -O([KH’H.&-)jWGsu;q0@w:]JhmO_ijf۸S`^CWJ 3w)nӷNB> c2QMb_k%m=-~Vu4b+EKiN5G8:GxUO(ئ8@S>##XCt!q"dy |[3#PLيq-·7T ]?6Ruie^6 ͯB.O"#Y3QwXq~ f`؎qH2fuL%#\؁ށTOCx)H:^ $>4&}Dl_,KX.J>Hf,T߯CEc:DO^F G:;u|w3* HqzBe ԯPta#-d+NF/WF[O4\%-݄,̙&F>(cWxpOYeTڸN^ ZV`Tڹb~ba~+O%$KNNqBsV>ȑ $P}yE=C蜼KJ/iϙ2wY"m',paU"G,n}2Ѥh8F2LXvT66@;~[}z8_6rWD"! aSd -g0/RqIje(&WbJYt7>S*܎2 &jg$HZL8gjlhwy YN˜:D[kDӭ<'M%z-ȝ_uN|$nܵ*XH{K@jlA~K y^u`$ƃ삎ӋyhGibk78m1I`!.MLMJ1Aq(O-J l- ^@jwǶAgl {d? x;H r>9ƫCэDNωR?{K|M$0 e(1Ti|<DG+!\c®YMEmB%%'A UT1*A"e8^NGc u1KA Do},DDђ"W;Jz]훪,kRٍ8u𹆱'ji2 04D՗Imˏޔ!ToZ 5TGVW:Tn4lqif VIyoȓ)^6VK>,.[w'WǤ%J3JSؐU:NWd@HCmTbwnJDx6[%.Vb/C R{.~U(/16RyiPlBr*PRhkB|nb9tte: )g ]A[ UDs8@sX^z9{!DUϪx`^X]9drIوDF8PF;TB {:.cJMy%Gݦ9z]<[#dwF 6}HTXbĤ};{VM]2ŝ7@ *PE4?aG`cZ P/RAhOFN-Lo<^hn r7'8^ۖy@M36@~hjR:TdL"喬._jjsQ<&Y4 tGvΊ n7sK9pTsLC;c }G-0s}oC05'[n0ץrxH|C2)K?a2u8Cc n%bg;ib#W\L2d˘zWpcW -zy9y2YREMZ|ɮBSQ{ lo\:OL?'U,q`0pCJ?BrRKտ]F$.T+`odx}zPFFh(L\U*? [z6M,{ ʁWpjm=?(^K0EK;TpY QB<[a[z&~uEZ $D%s]8$}0&T~IK_4𥁄=A\ &OE9rb?fg)bB)V$2ysǃrf5K훤ͳsN;o鎼7pTR~,7:уuu疑\ IGr~~כh1BRZlR)YhK145b) Eg#?YT"ZJ >т,Ơڳ,߭aMg.K )m 9s6b(1%;?2ث-z1e_70jV!7% O. PY]0Ǚ`bQ> Zao(Kvε%'K(i¿*ϒ35 {*~B)3l1f_V d?CޯtnG&Cw_ : ߑs*i#4LT/?k«7S۲Y81}"#iA wUpmt@]D1ϼKf)2o@‚qLk(I,X%Uc)]j~ʥ&ycudq@`t*81&)g :' ]HHMW6]آT/p=hA(Q敢1JI9rvu#n _-FM.L_l>hJ.U ^QXHU`fK=F>v4^'6 1e$.B1 ̀5x,WqNSvO$::#C*%\A$⃊D)*488)~Әԅ&7 g;%aFۤwis %*hCuo*ϩVniEN$`P؍ Xμm s+mQ+ݯ 2q0ZO=";}TkkA%ut{YQf/?T X:CWQ|yL7'Ւ2?})nvAo:DK=R[ +,Cp]n˚dRg>;vTWHX ni3 9F^ƅٷ@pS۞F9U+`6`('U85 b2EÀ& .&6EFy;K&snRMc @'V{O}Qr޵qz{6+ҍhu D@Q%I<2avΊT>CjX>K ,6Rrܐ ~"P*ї`H;2Sdg^5#.O>c0.5Cp-Π} x$ +Lz'.︐Q7UXK;rR[HϭJL3&ٝ59O~GT{<:-_Vj`ZSX&<#2$X *Iy$ھ_SֺLڗ'A E5a(9U7  8s,"$. @ 9ȸ]%ȕkT"YvH!bG~^P-F铏COK-(:Za eG\ґ p^tfJ=b[08S/9GIS95ߑcvUHk}RsQ ;e2V*6`(@Ҳ;"~(HoqP9֙јT(ڍq&;^ylߪܘG2՟zjjJɌYT!d23h4yQJd},?40?o OHU C7 h-]u~9e$+tORlIeިI f l5t[*L QS20s!X Ho~ TqfG!H&4lQ 2~Z_zڇg`ј3 '|pǂ>̆,2/]FȈI9y:b0p6M(KŻWDQd.F^1\o>8'y<3D۾Qh'4:Nrwň:FPjeƈn֨jzwO*wܨD$ 5 WӖ`1@iV*pIn"vhU߆Ed,̑Q/&L'oJs r?ݓo49^-f(˷͍Xο[Bk& uoőGe xjE; ^PO}΍IܥzՔkb_%Gs%x; b$6:|KGp?[Sށ[;]p7m_`.9s*ҕ\UxFrXSwYXsSٯ)!]E>KA+rsApubZ!G)!{YZtE61JJVk~m;Fl=DY{ ]T,ے3z;g@ ^W`=乺y#D\ht0tw.jUҢ;RňL .ʆ޸6,bC斛B_'=NkPOA|%zua~y5 W !|țyދOF]#b= ]v'1B[E4WoSLqKwiJib*bvJ/O@JprNIsuڰu͑&!nLp):NUѯU;HjTiIhJoQB!VEbRT%-^.uG|KXup >[]ogwC 4rE@̚Vg[,@Ɛ$F~V@׀]&ipK*?g)V3IH䢰qx$ 9*:hit׷2zVh4;yg Pc@ӄzE{(q/ 6dXt ~b:W@fY -Thшy:`XZOp\b. PsZj>b-"j'qu<\z?=ʻw:!M'yN'pω UyjfA|hja8ߨ`W4a1a?'FEcFeeA:#>6<};Ǭitb6[QǨޫ׻09۟rCsT%]kZ:N;w3f=YzO-[sW?8(TO"wʝao i|W}t֛NV5'3cUaσ075l1O &~f /ΰkW,-Z$?DvOݍp8']lVn/ ;*Q8H|D%. Mk쒪Iv;t ε&0IS00rj,>zU> {V:ʛ$'C:1]FiY(: ^`B(BnǴ(tICr(?,'5ӷ+dL)azgYm}W;1MɅWZp}5' 5vBV)Þ|06DŒqSWM'r⠉; tk 2k=#j4,FsN]⅟] S91J<˒[V~BǠcq9p"8hnkqu0n`^DuAcKM 9?V]<&ڊvn S{eS^3-wG6 )-$4#rpPttS'WŘɶVp$J-p1MҘqF0ho59^כMVgf>|ow8ThkEt|y7VL2%}4CK։SșHy Cѣ[qJ.oR* szpVMYR|wUkN`3m*Rb`-/|zȃZ6/eUA&yQw0{H>ы\ xt*߇`Ǥ^.{z>:l^bq5uv~I]IvOd5%L<F uGM?օYg@ŀl^) <pRxG%I;Lv6|$E:soxA*#&0M 'w3%ыP1W|M${+o.@Xpԏ4`qMJ26>xBŇ2k_e4%E7UbX=-hn׬A3U,R+=9 ]pQdt:Xo#e"r'qẟN`,3 $V+J iLӥ?A1{FDu!YBT'Ԫi9h;avb`LWbS:(T|&C0ۨImhj ny>%Fbץv_w M/UIِ6hrȡ2GmEpnQ)ku "(̈́4#N!kȟpB%|܃ыVxS#M2S kM) 'QۅfRGP5f8%bJj`_5oIȓup2GZR95tbpoCF^D0]ܥ=O YHogM JByU.-f=[0D~@>/u1թܗ."LDE$ݢ.1Y(MaoxE&A~|$i ȤJC@=!$!sYP_c*sfAFRɹUswM>o/[?y`,E\aTLVBxXȽ]~<$MWl$~E݅c[#_*Y XOAZwm VĸNMߘ HmڞY}#ӳ<[fZ7 c\Pşl0t>l8,J Ie+;؅DF@;i_Əg0欈"TԩIR,nN~+ڄ-`Å% eHs[oOHƨ೉22?w,8h ٯ;!%7kr"_F%Yvj΃Pms3}"`rp8]I8>ϑj?+Vi0;c2a.[@}ěR> tt̍SM8^rUejM p!tI6_WĀ2Fv'9,}X_\N~&_m3?44q, MlG:58#FHbPD ?C ?MGS ;ӏ>bNˎIoWďT jh8Zeb] SE[噘_}A74~Sd2]y1>rt[~\>,Ͽb> XnѠWרgV_Lujs:(gyAi" <&I #Z"FwE>"+ފ޶7/5Pٻ d T5G7ʴ5Z^J no)-iؠ},x; Wzӝ`;/ ]S٤W`oHh+5Mwwz8Ζ?": eu BS)I0 yt$tWYzCƺmfz'%?}ᑌΌJِN: } 8 l{6V]A5@%Z̧j)(KɗrG.Ez1ܪi(2,l<ҥҊghƟO%FY;gr du2W+ٙ/%ډR1R?_Ds+cBZ e$V14afF}m~ CH妜u~'t@#_Ǎ/4g4\ɐ%a։,[l:}ۤC )7buZh@k1t>NTQ R8} kp](uOCJy3e_ύ\݋|sRޤgS MrDx3WXA[upGQn˿D˜+^7{<.( y^\(&\4d'S'#{;p f(R״C֡Zͯ$ݺ|ux9Y Co4vHp*+| 714/2AkMaI3vludַ.|#/^0br%jI6BJ>wo%zݙ~"5?D 'y;gRb'塍qVq|ͱZymdZsA狆ջmbN|,HPǞJ ZThc2td1AF)Cal6U DW-ԕdY넙C`}/o ߮XvgZpjjE}M`nvwdD^R7ЖCjJ?ا/JS!Xj䛽3yz)áaZ`"[aJ(>>rv|H]j4Ê>Yi5ccM Mɜ@`j0lewY?:`C)7j-(Ƀ ݓŠz6wW!pV}CM)}Vwin{4"9q0mfgAqi v0v{`#*ߑ4Ҿ:`A> iDuI[a)5Jis;rHs/nd=%f}e 5SȝۑO`W1v,qSREؚlvcDoktrş~ۊE N7NoIrFھrtU+4 K=p:m0}L[V1ĦfNITQ1(5$ȒjԵP(F h/1r`ڿ!^t +JGH#ZFar:c7to2LI!a`>D>!Ӝ+6 ).%̑S ,HlFUtXBHJlc9|vnGU ?[Kd{tcs.*F\I7ڭxQv:+Cv8 b/T%Xby&:_?>"MH #.}Ek>/%ԳgD `FOpGG7P(\18ֵr[|lZCbqϒ-:fM0A|dص|r ^r j%[5)m1uv8G ^{N!tw3 K3%+NA[sGI'!h)v#y3_j~n':R,7{+''bl sTEGԠsM%N{ mt! CI &@57Gq΍/}8!9BvT$c MU<.r36 xݞ4?|!Rޙ7^QBFtlz2oR>l`)}Q59򚅝jn t/V)DgdAiJٞ;jk~Ft>[ΌJUYH,b V(ns/`Dgjɓ$B+WTsK#PȎۿ֡q9_؝KaY` `6`*sCfAXh1FGHWNsjV >9Fi͊>(|ؘՊi݋Yrjx>ܺй͍\dR-B:\񐰲7|(N0py6Q$dF6dpsE G *{lq;Heet2m|LRz/HyQ9ڳ lQw>_ǽOf7d)38}r,'frRWgTbCjEFgUaMq3e怏`k2~GHڐnXvprk(W'A\͞:(O\g`]"MKd<S"X"{B5 <-v:#bⴺCKie\=MyytMVTG>zbx3KL2t^2췻u6bq8QAaf p!TډɍY b:¨dN{ k+XjxBlߦ◱Cz@(PƊx[ˑ8MYV$)Ƕ 5pkb*+ ` <ˤ#3Zqdӟ4uR$L㋸PY+H `vGÄA#.X9h}54c#-;43,E-CGz b>Oş8ƴuFna& TK|zG8jDkH3wk瞛 r%cHӥ`byo+v@vliXW%~!tW;1[1l[m,M99.#>Yrz'8rB$ew-9˫%iz_>L^~#K^j#Jowa3,y?AETA"̙๒#mwO cQ)m[ D&(ؔDF&]α\'GfY߲jX;Qibī&?.dFq'_hBՏb.njiBZ4/1>|m= әrͰS|oQN+1/*gv4ydfuӭT9Ÿ́xi3A \ԟ-Wo=Rڧ{j1x9GTo}Ζ12dnIE$4صڔz[eȝ A >?2 >rzR,V=}{АٹOC:BWLr 9 o6|&"W1`wB4e$WʞFѱߍ<Şɔ,c^aع[6c#:yU_TnQ0Lm$t#d%``晴rod ՙLş'ɶ7H@-QsHⱸ#FMK aZFNv2T [r(26VW>{X68 @|K]6`T4 qTfeE+:'xbHޣ/ rv!S3ܡރvXyh=0`3y (>Q1>pMI3#2.da C^8wF?^*T;c +|1sXp٥Qi g@Ɠd/F(16AZ UEv1z(-e"WTT[o M65R/'pf՞Q1p"`@{U jOTL9miz&BLDufeR2>8ÿ!%_.(;CP`~XP;+B8W8 2GIm]lA9>뭀6lf2aGsY )0L g6/Hz6YcZ2|84^Rd:͇):a KkE]nIeszso0LC;*f@" v I0Y8 I(k23I*-4Հvc Lu^SP'zzy..b3> y D9XHmn΄{l 9O0T$J{f17E|~bLWHJXa#Cf޷ 㞃 RH+q0uGmGesǼ,J%cƵȰa?0Bq8.vړ5h@o$Td(!3^ (/Q^KW1ږ!]Q|36mz֫X.!%'kƏj3{R((T1x8-D 5 oPdBNn/ڀRA^!NB ƈ-PQ'"x%K&Q}k,!Q`ҽ?t( x wV x7TpYQ\@#HZv-a n/? 1rFP(S/;PPi.O4,>#h% DXF 7Lk_[LaL0mX*ֳCqr_ T8쳤(东 ݵ  7@߄ŷ]haVHkrmwᴃH~Zýl3S"U۳9Ҝ~I2K|Fv,ivтרng C{;pK\5z}\sg\m3ŻqMQ aIoK8M,2;!`_4'GuTo|%,ֈm\cw zѷ$N1{CvC`s &ug)D`a2Akv-z Z:Ď/HH?@}t] 5MD`H x,#VM aV *(Q~*3cGtHreׄG5LN(eq{$5о/=)!+veuM))HGd.F_.>.)w;c:V6z:,A;f/AHexw:,A@{BmT..:hg ȏݿP֚caΌxC7MB⊕_UVlX0Lz=)/:) UޥFeTB"W\@J-xQB2ޙ4h Ԙ_2"[xypo.Q]*zK]GI&P!}P =ձZtO{oHFTe 掴#K*;^5a חv $5saM')m|O-V ]=:v{%L~'ʧI9ShD b9j/"aN. c?ᬯL&itϺ-mJ]#nZs'Xd?Ǫ6W$_d'ڀ]#Ma߫SM%ѝz'u_g>IUPM.z2%xT*,%6oBΑep>quXO@;W %mF`yi 4'WX j!vdP<3;ߟh`6͑WtSY`J"cQ>4{i.?PZyf3/s!O}D"r_{IYA5+NsoyU6Y`MoOq3͔b׌tL4G%Qb"uƏccIjmDw 0 H Sph*63x*Z(mD&8VQcgtigiFj>b3(hAeK -XsUV 'S$Ja{04ڮ(`&iZFH&Zn4 v$(d.hRG{S 5'۞b:W9xz+"4K*0[,8VY.B>rrx]8ڠQ_h4}[,a 9E픐6FћlڸijNKl(szI항-yի!hעlIs.iX2@Azf py-Tl%" ,"_ڶs{{fxG` Kc`)cޏSε/r4qݛƲxk'LOW){ 4Ǽ*>Y0#5;fz%KhO^E":0nYsy!;CGNh j+p6s5y6Ca{yvFp^xQ̣&S sJQݟIwZ&ZoPFFT"ԓ=!ʸE#B3f6MO{9" J0d1!D٦$me@˖QFM _+:S6q('2B<vBбty{^F) ;5+)le8ƾW0V[9~:n0ey]F0^#Hx ȳ$ˑdv?=RX0ɝxR(4-VQcF%u,>ns}Awg9.qEz(#PwJU/}1msا,Ω7`Vx' u!5(k{*K@K)˯,;k}kT~-ZSJ[AnL_o<ꄳݰ!p6k GIxP/yq3qqBȇg ox@zK'xz0V)MV}&z| >@lRJqxOL{.xrHڇ}cҦU*~s=O?b S^DYZܣQwWy9-؊|֘a`C;`PXq],EZ=ܲX߉NILa!jO*>f£e bwG6URkx_|Bd%d`{Eq}:!+ZVs=9r)Za\=g qYK3!% -4hF= ofx=s.#"=,!Wbc&LRny`ʓF8 (%[%VK[lL~p#qtLv_W׋g7= *\k9x!uD7CHu!8fKD'0ԶS?rcd!C߅l^}1_QS!QOVW`L]zqA^h"- |c] q@m{$ma$]|xל`3DE:Ш}+ 'ŭ$mO}zbP{N`8riZ:hFgf@jhP 1 qX#;_-&88oTThEo[75qcJ$#kbwۏ G6v)9{5Q>TB7 jd|O&iTQҽ3YY*&iueWpn36#@X;PNF,ku,SKS'mBQ783.Ϳ/]qvyOTSi98B[mRHWp2K{:(XX_8換UO񡳣G 2=Z6MF1qdO3lV,EAJUЦ!(2 0&ࣤzQ< SZӅ~1~+eJXnܠnO=%G悤GHtg:{٭ m/vl+h^vJ`:p메CJŝm'8cNW) .ET""΄%KND` "0NbH$KpQ7 cv K)e Qy(Kg%Ѻs%Z@LMyM>>Wۑ}&QZR׶qJ!ރcSM-Jxaafi5R^2 R}^kQq7 +"Im)RXU gZ [x.h1*qRCx{a:}Tx>,OX2"TN1齹858?N3Z/v^?XtVV3V͢|p^>4]AXWp %/If $ h.= )1W],ǹP`v=D^dnLkxLHK)mOOxgoSbO,lq0;HyT|Z ;MgW%߱ް/]B6Nk34(OVOtBe T(_d]:_KxRf.VzS0Hr9Kς=φ[Ys&HFnzò>SY&aT;3q) GKohPd{,hYy.~a!KYلkje /+B6HQyZl}I`kgcWYFĔE%\wDDLPB9pvq;>O 4MCw W:CْqS4G}}szexC7>StT$1ɩFd>g@M<"vZ(m8GC882дO%I!:;ۓKW m/^_AwP<$/)EaU-/7 T,Qc[ ? jp5<,BU'䉝n9 @ib.qxfL$W`nWr s.nQdhwC]ＴM](EY&_Q."\LkLrYHo=ܪ*n[ 9,4Æp#;UaAGh,y@sxE%#8T_'fƸ~jq%}f?w ARBƾd|J Z{4?ay ؙOF!2&؜By,p#2EFW[RIE wqo;ٕ&-n7yMb=vt\p_Iޗaْ#.4bIS봭P` GZ/y*Ma"X}D5t][_UvxeTLY|mBTkH<ޔK\'1̗QjbUH&&r,!$Q̷2TߢU[O剌m4YUx>!#%+m3U4?dRRIjkX"0{] -o:.asD'VF,ԬsmUMTNYnJCb@\04ϸ8:w6%6p_KeuAO1Sի=5!͑ZrYw=}Tb cV)u2<E]xzΠ΋8f ]oQNל(4$~9pHƏLͨ?|7Te]FuW`D+2ʚ^FDE+AF! ty3 ^Q2i<϶ŝA(e>mCgMU4C9Ol8jCZ\tnhNx#2rww HRqJ )T%`\ bPsJf>'[rvʚv_/h/pOG~ o'ڐ>D\" ;KfO+H=fcſLaTD9caLʬe.T.-$!m:VJ["D8D"Z>~FI 'kd=:GXv&cg WŲqw0 jPW#!N$\E~. L [?d7SFA,_ָDU׶Վ"tg+l#%͙JoK|A?\/Z)T7KF1_S=+b1Z/kڄ9;2BN*Cm1nl0¤oɩl5̕XM΍'IWhnE &~k_z&R!ߩ%-f$/G*čLC'Ӗb; ]%ÁF'*5GK x^0Y( dRmc2uw nJ/@l$e~D9At 9_|32ˇJ PJGcz.Y9)1<퐙1As|_,WVZJE;_OC *>\fۤP A/-b%'g8_+/.KK0 vZ9hfOɐЊWѺo\ۜO]-ot@iS=_@5ml@w!ny]Z`Zd,V'@/Oezs1>f(eiu.|d$w8⥈p:P&ZdZǫ|`K)w^Yx7<\o^IۙXaYrЯK> a=IW6%vv-.](Y\j~3ì12%AAWߌW2tUt5˄QcvaNo r?Xgj{*a`T|ct4lʨd)Q 4L$ٯPӸmic}TQ%jr+sAv+F"㾜 njྠI.<熡g(ج [Pa6'A>r@l eB@.aBv7VU,1NR,L\]emY$|fkOR7&2բe5،Sy"7F; ez4HhVa2 c(gvMSX$k(XCZ,$JpDe_??~5z]M#XgBͫToQB2S08LګV=9C͟|萁R OoUuOTω XT #-BCN7JZaBn#`cN_Ĥ$=[uG4sY\5異P"ByYZaxOB[eUX,y 6f>z~6UOL|nџAӁֹ$<(D c`cŤ?{Q*$%Gz% F~|(='Fئ?(QKijV5#GN C!cޔ6X ^o6ׁ 8by) |\:#S%E 魏'c(܆fEm]ΟU'ycI"fmAO,ܠԕ7E lL 3$ ſ.jrg4qoͷ3 ϛtuHwɕ1E4+_˲%8gx񫈄Gn?ly]$c]I5Fw׆suE -18cRlEJfðкZstXm6x֡l}͠]P'? tepu9^i+ZY3CCC| gV8Nڠ5w1 gYU=ɸĘCkjxNԻBJQ ;x֬؎-I9X `T,j{2\Z$l,B[…!0){Nj3W+5 FAj]1q?Cʼ6 E5wD/m*OwHjJd >v(HŜ'grDEQ$~GsnޛB K;]hI1 -@v!S$,6 ,<$SXhwc IBjY:4KVYmW EabC&Zm.Zq~ ia$l _=?W8C/Ywz+S|yEoO˯"> 3[c 6׬zE xñՊ=$"|s22`2Jtm`' ( #zHu ]f:KEPF d*~ӢYVo}0^my7ftTt->GDsѓ{$x`xMYoL0]ҚN٠,vU'LXO]A֣Jz؍b geu1jx=~SLn:#HB- QQ')Np<:*QS~%)l`wbakCt40:Q[0+g ([NJ6>ia}3Bދ޽-gg+W}dn6HX'L&笚+ JI2 $^\A]x@u{߄5k^ЕNEt4}F EޔprVbu%jxKZYpj)Ȼu݃$@ٍcܠj܀NhnIѥOo~E!P^>bĨ1H&GdTD#G? F :vV)Pn+N M;0 i[mچs YFp*9R~Q醽,Ec9Lce;ɅTQI[XVM߷Ca|Ԑ6-@kj1w>,nVpcYU Un~ھIS\_U% 2@7gDpHG5uUEaTd-@y5'R, /RlP/gl%f\F^j~/BtIIٔO>X׎/f'ѧ<4V%*ȲWȒ# d8aQ uTG7Sb!x땭xC }Ga:]Iȶ&#DoU3J@m$fbh~iQ=Sf0 mr8wpګ:a_39*)l;!SXAB ՚ؙ~`~o,͢}M&h &;ЉC DvhH̿HX=mvAq}]~dPEHC;m{>O5܊x1[fT`iF&nwK׆ dՍ-NJ[@&GV3y( =*> o3Ro䠓Vݎ N~Bfur3X: 1hx[wC(&޵/Z1, PX(u\ {qbu.{%uIˁNc0!n]AE6L{x *ݖi}E& $%^AHYt ->2mk-[oȊ>%E[HHqcb*p`oul̒=.C3h[`s23 z t h(7?˼cK!3U"„D<вQ ކN#t-p]i-'PEĨNR]@q Ȩt2aucOzRt+eEDvןKSA, Nqj*#o~@OZNz1^`APvL&@WvAdb*a?\aɾnXlܬ"NAͯ(S 77VٟVh!*!>.W3Ʃ!QѺnG\rGhBU VsM֢*]b{eʘOZb8/йN~&V#;Ʌ<` '?O( 0x9V~| HR7-_ vͣ,n&g4=u3{ʝu/ǰA2 6~:i%E` q3:W wY`!@6`10ΞvkD Ąx.Dz>q&!bBӊ# n]b݃Mi+m\#RDq+_.1S;;CFuf\]bT[^H Q$Wخ43ζPBd)և dL&Q;%7=E({M %6RR[8j' d4|J.5(ad-!WGBGYZz= +ǟѯ'& dZoڼ`WsNP GOiBҹ~7&(9(^dq"I,W*5T-FxOwff2Oc1xfKG@-lOFr<伃"!,d[ c@y6=YKKo?o amv1^Vfl #K HO`c@WTɴ:0$q) lMf}w`m&_]SA6@'Dn{"W>+`>8-˼"JPО+t+ohБf@ YjSβ]R;Zĉ׼%UF܎ZV6E+K6|։w@D*^dg/LIԻ: j ^Cggl뭔ۏǴ6 у0[S` IfO132( }aC]C;sP~2+0!:V4 n bUr;Y VL^8lm/ZGef E9\}CVP,kkRy3ahET;ۋgH+&~)jD))//6mu,j'=P_%]=97\Ff?Oy\Z7+'%ٰԓ %z~mhGϛ.forx=z$ê4zg|?M6E(V3R29|zה-K `W[c G}XYܕޥX$HMExNeR( SEdH=:I*!(Rc{&Ea^VXI}UfpZ1mTyo`lWdڗ?KuzǛT4KBQh6Lf}#} w*o2(B][Wq?N^yQe{3h%D௲~ ^ %wpx)k[:6@tOŐ}t4~%N([ vI!>eԜms=YB+W#|Mc簚0?W<]HЃjըʝLkX&4 <ԥP3{EnI+vX-ԛ:b Fv6h;{?U O*k#fci$v =i&rF)֔)ƊX`kLoAS{9 =O/dݵVl'Z,$em8c3`ItFD_:ER_9 ɻ0M̆]] }4`#η 9g򪇍gCI|CiqTLTŔ`"iMCZB"Ƃͤ0ކېgAɗ& K}[|G*5@(NЉ\Dt[S%hȍ`CؙuThVor*GB8,I0au8ٵ]#va E?@ou;/s'Yo$*gL m-AX,}a4_%gۍ>@,9L8z];'2idNcFxNo%戝vtL 5;W[%szWifК%cze^CiddkA<.eN}ƏjKWw#]jEI IQĿ0g`[ya6+1ڦsk 0%;Zpd|'~2Pj)1? NB-!kȺrE]Vj-7u l0+򭼒ٕxGx1VB (U該bSLÜXvK [oЭ'^pLJYAI1?hE[@c\EMLio&EkjQyTqY^\+ʪ< ܡR-A|CLM6.gI/}~b| ɬݷQvܸJ(i,<^_:6`meDnXsb,U3T/x6E+ex@ vOgb8 ȣ"7 zy{~B DWϹ"͎ж*-mrUvu q4P=o1(sPnɨ [Ky 9ɺPcܽw~(난FL-9~5b`{diVtNgoTwP_KX㇬_B8&Rb$z3B&*^DQtma'rpE3Mb>iq:$fq m[ ,h?A2:/buOKtߣiSqlKasϫkiwX/ҋ;Lֺ|]<\{3xd+T03cDq뻛\cw2z]ӆ]|8')M>^dRYۜ5"uo=0 kJf&#xK}]TG8rі-ְ?d9}VɆ]Ud9!7K\7L4$ZJ:1TǷ޻G?73ƍT&߳ ut2VM ?VN"$'nX q`(N <9tGO~rXhb Ԑ.W8cup1Dj&>- kBCswaR{}ިվxk6'Y .1ZCE`& pHynG3H=Ӗua(p&}[fw&ruڨVq-=e|R -]2Yn8]kj_DEU5<'+wљ{J-*N6rGeYM[ra}*DЁ2 KPWف6 K#*#ms@ i_JiRcŞ%9gI.X|0L{r|)->W<@Lŋv5cT:}<xf ) [a+vZ Ѡ{QD˱6Xbnc:ȜΖ:'c0!K-d ۶]FB9Qj/iTtUtQGpb+ tpѤ@l2J'I˖ݔ9f(~+v}2 -^ 2#zAVX\T&2eX`-X9oJH= 儀c&cL5 (S˅bliIlc1wS,?U}^wR)}WjwMp%rO_1AÏ lfrpQ,5 A± oz9| 8xaD=de'돨x @2wU#go& tԡ h \kuc*g<@Shf ]i61>XΜx3N_߀*]a\)~K٧?e /bN.>lvTx+=ٍzXϻ%\XhXDѡ qf(8Еq s/\ )I\QE2 uՋpE@Lbo`M@"(gY R[S./b.~Q6ރIm&*;]{`qc6G^/8r~8g\HyCHSQ[te>sWl!M\Ew-L.gKc7Pjا|6mWrka3=#ؔD {VZ+#Aҗ{ B,ϟ}"_\t-)RP'0pgJ%*IL4aTVٛQTNƊ&05dVߚyzSLއR7='Ja\Eh$=C>uy<(QUyϡ239)z r:rj-eM43bv!uDYӪ$Cj쪱l:[3.@$pvầYe\| SsuLw!{ߝ̢@Djo˒-b>*}F kj>kVW{ {5#nw?#1H;1ѴZ(|CoP?Q&8?=(Xs;*?xKAgaR,7\t&..͠Sq?Xp8di p\B3 rA'/Ax|hnkwM;Lݻĕ?2N A #_*wU4Ҕ7'ǚӗ>#O(5 ?اǸ`*y,UҶ9BS\w- Wucd njqeI/\?K"l~n,5q_RaaZw'neiޓ@x}V1yQd-蟁 }~qy1 am-kx `Q³ӥp^8beDY~ O@Tn9*7ش5[c{T@͕|t"jpm7䒹}EBJJz?2r;2̘40o'EݾҝA6筦qQдIn\kI񂇭a=*`PMVʃX-MR7څ~.ejQ )L=a;ddn< bHt1G؎/G+&f$ڗRJ'DVڹl~ ~8OSrͳkh8ArAOei͛sΟk1 *ܘ7:9 ԺIK6պH:svRHFg*{&`Ҳ>?V9b!Pf%PzǠ#soR/Q\Nڹ+|jQ}ZDC+iXLDݏ6<%:'-ߟ8Ӝ5]Ro1V=q-C\s_C z|hp,Tfڸys^18 *B$TJՋ;mkmg[ˏ>V&GQ^cR2?v|x_E4l#*Kg%mEUT0PTWNQ$^}Xir{dFJ:R<)Ɂp@]_Y5#2heX_P/{̢W3HcGSNgsb^1T&ƏWtymmsB+looAB+Y/m8ܐd fIh$Y`쫑S3f'џc_! Q|YGOfRo^2t!I[Ma+rľ_/*/︯hkMWwJI-^@m7_x_g"Z,cpϴoW3HOAŐ82fVC`>/'q@bLUe ~̂_nf1rΔCZc͍grJ_zW.s+v%H.B/!&C3o]}TK x1jTjb_9,w@X[xR0 Q(!n6*.RBXڏ?ТRT58LeM* X M.,(L}X<<t I]>xqEh&Ab{#D6eo|o#Cf~h"[e2cٻBG*OdDBXmZf[A6Ewk,u"E[cFj'F47SF+ZW2ќhV ch_)ethe "]א1-`70yTJ^|/.i |k? \^p/:[_T:N)EhJGjz/PAټձE)hf{UB{ K Պ ^rk s{R`3HF9O\df-=63q_CXCYWx -)[>uӴȒv`h5AGmGɢdy*\@K'I6=1[ [NjccsDiRKxjby]>})JV&>0|M^z+S40 bËQSP٘/1vșȊ_"IjWRF=B SF^yXHBP h_H6۱Zsm\Oq0Br(hvt JIXOȃF@%VpݟiŤ)z{qXy j j.w$<0LUl8N⦨eܯɨC8op8Rs@$lѤ[|0c},.V|b5M7Zm%DMi-Kj`Pm /#NhLTMYDؔ!a%adl25" r-@l/V'[ OL]8y>jmȋxVv#dni-p_Rf܊#xЄBy# fHYu$r')~rvs~itPc f|3/ Zk4N,gЧ8+(ļVڇA)_80ѣϺk?L8KqEl ǯnWogE_r];^;TLc` {B^gIĤgЯ}v,|$9нFE>=kFiW9#Po>&Ge'/`ʚI eرJSǦK[%8bW}alujU\^V-yU p9Eկ!=s$>;]aIޝ~GY m *Z ֈgƱc8|˞ZuUJpqݿ;r席UxPTgΈ"̮- H3ݓd1{6J(<v蠌 B rÊx-Fk{eQLN(IQ);] K$̔ȼVObw} gHof .|C:I૫ & 9B^ QL8n' ##&1Yvp*^OrłAHĞT]@ц̶fck;ɇXx^d+(,1SBjp/ L_FqMC*FP\|Z_mdݩX'[XIC}!N+3u:Wq Q.;w;oDcARglmh.tԳMil]a;;zM}),v]cp X~4t`@ՏH<W50tjP)dűO b491%]lMӿYR`7j*v\aG2B!4UlJu[2ƫZzVJ+q&[0a'mEO,c6Y$k $ y=鯿2a:~%l #?P#D.O-"GvТ3x}ҌO<6SsBIn]o2L:9&$MI pW7|JXS&^hF6vXר%x!eGaE|2OdOqk?yd_*#.ZX3O> Neqy<-85Y=^Cxx2;.S{ [=T!%1Pڶ}\i"6KK[YQ vSi7˅b2360 VCQ 6{zjmSKr6sTPrKow'8ML*od+oT|:7+7b?SBEƵav[GCqGp}2ި:>DR}+Qy9xFdc=~w( UJD/@LVv<55Y_>_Kי4Of gp}!%;rZ+ (UR;hG7fU]Y].yuJst9=a ɱEH_}-ƯtLD~>Ù}%Lb a@ < /&@(VvըȬq<":{et}($E|81\xgM䀀 W5~խ&DZzmEzʎg[?7K>{njѫб,a9%d!9(]/|MŊkm[kꈥ3G'( Ln\,|jk8^х`+\6ѫ)eã*K!e, o`KEկ}8.s55㐊;j ލߢ,KUo)H%nLLl\9:\c8uoТY]:&_*3tD[Y7Ro|HVseҀn>@lI=-+A`FAk=|c.HkI;Phi~~2 ?{PiqzlMn27r 7{s+|R~S , ?Ɲw'jϽ0ՠ$v<+|4Zai~'r3$jW{Fl f~ Ntq`eʟr=.~_GR(3 :$v,ixڐw6*CeQ`VLf|FgUDP>GK-fwjm0Dz_g%uxplli9>0?ۜOEkf>wŴI<,>ٺM܃!u_>d%OG"g?^|b'D;eGYptwsި TOȯ~Ɉ?ەWsKv\V5`Lk: ZF1]AKn{&aȵw0Tu@oJ N5 ԇ(6OY0"& ygڮrpKARkj 4Tp8bƓJArjx؋){L'BzmAgW&Y. gcM IȵJ]WNLRvЁʱƏPKqf5 71hgsV<}dZgȕ0_$Nf-wA_".e=څ߂6%c0k5,$8脔D5tS7 iNg+-[55l 6j% 5jJ Z^1J֎gPϖ1ϿjhQ0;IҀaKؑB,A +7o¹mL ׄpٞkb,2/bcg)q^0sGu}*"d*xP&o7p`g.PoFܩ*wESl~;ٺ t0uл\WDE/dH-TT3ԷxB\f죉01~Xu9a8ׄvUx,ǐB4x ;^ʚ>a͋x*~(AS ȷ1N2=;S/> s : Xgy'6T5iEӞTrWk%AuK32e-pR`h,/;8IQW4u4ZR/}=Ȩ)h9ɺe= Ɇy]q0ؠ]7CĚD3]RGH[ˌМ D˴D|!Ѩ"8݆ȤiC!!Vk J dl9_̹5`΢S7wc~BzfLd幈Eay F\C5: {+4+*Pl&x\)qI؇>)c%.GEJ7;8B W(/ 7L̛0.U0|6'~Z%ӐLjVNlAàP! YOȔ鄴>_,jQ\ Ǧ T-9)50:&JhPZrBv!xUSVS b.ײs o`__bakL|V8<fٛrZpeTC)s&¤U(gEF;(jɹS`pN%W}N3u>  *};nh4;0 8KUf @6,qo󅖈{oUz49R NRzJK#s|"b+= #:4kƉ$xeRD hqw^2僈5:J@yLpa;0z_0m'2!; :%(RH k+8cchЃꛔK(o.jsoJ A _/I`N.xȟ_zu+y%;!HR|]I5J]ĭpx8ƭ -R*E皚Ѣkxf"[yysc)%]PБ%ڛb7}f]B:hx˳G{ډ.j]gYs4VN&k\8P υ5;u@O6^rtҁ,GXN9jТyUB"ͼuwEdz#I`ШOM pb_7#kLr * 6] Z25i&l!K܎G·ߴ΋}5RS yP]̦D;#" 1++U574kc`kp Vl'SKhsgIZ20z@lQ7n'|ٳsCO _rĒ3~90 #<<9W旒sR"")\aYXeX8Yݷii8(#tɨ*Yhq-}JudX.:1u9`I`<%Y⵺U,m-2LP^~6 :~fEnZ bة.=)D_&").1G;ATPSyXSbϘ('~HC hDOyWV`4< .$$PrU)w)קź`o+j4-pK=l zQ(Jannb^PG#Er̂Ť9 zcAƆpՍFª?Y_JPnө2ϸ,V^ƚ"4V |7S4u8/'3S]#}ɰݼMqN] ob}mص8DB<뭭ƑМ'8%B8{I^t hT'U#H&VQwFȓT V5۝~%G&P)%pD_/gqYP;G7t0!ӿLЃINՁ4vB-HM2Dc3zsFu\iD07lɧ|DzB/#hf{ŒM!u플s2](YkHUiKAvgXתɌ,`讈-.BUAd0Rx-1E^"e_^NcH|իz"%Va|Gxyva Kؓy*;>Or阖Ɨ]tke"|~L*\ձ*;(?fv[a 8^^ɾ4«:G5&0Q!M@cEH4f#Zb*1pų='5M:3})dtŃY:@o:nrTx):7E>ƒ& L'kQYs>9o6'Uxܢly.`lXOhvSEr=` [Ms!D%<N.E΂h \Ir|H>sCIW?zټz̡v񐣵q=n='҂RNlaj(^rx[)QNKq V߸LpD )I_1J%9,˚d1-AU1PwmxmÞTKg6;%JTuFZ[AwM{ RhZHz0Zu愎:WG Byiu 9QHKfRT$)<+_{f`Ò|yLAMXR \Sͮ1oJ6a͈Scoi~#WGE/6VV[W:K٦G[tk|MpMMnX0ua`_T55AOl "GQ5ũ2[p~h4 T ̴|^{0e{2b dtpw1z~ x0SPBe}&I|~4vh\T9ɶe7ȂG:I tcYɂIu]&-9?;,:Y;kgY3dt@~F\F v֡R<Љ;j"Ph$ rfǽsrL~l˓?3f_R2[z<|9}_}:b2v&wsH0Ch]_B mlQ#3"B kZIǒ$iuexI H&כGN~4s\uɋ:) Spǝ5$<ւFd4sȸvUTF{&-KB#/;J7vpj|Ϸ8Cv{^^{F;URbNȈ\&X 5p.#0@lvEվl?]ez?CBAQ4fIaƛ#sh/2x/F* ^ǜJ؁rԾ(3!9"]e6Wn$Ka~+XĈäm'fxlljSKRѤ g_W`A"; Ѓc, ˬѮf I3/p#iv@{ta9.TѝqTqom16lSEE-jS?Q_wH ]dm٪AUosJUۆ_ˎ^Si0( F%]t۽hAS2Mg%EMm(k E e VdP@}7ju@!Mgrx!0d웞+tΐu¯WcJqrsȚ/Ʊtٚ$}Kn1/`~.+7v~ jG-;+bj*40Gl6¥=wXqd/ ^LYDTm℧T\HZ a_Bd8qQ&5e;LB q FD8 dp#Qjp +;UE}E[Z [XLXˈGU'Wՠ'\dpNޮh%0e7ތn:xodVk˨"@y#~'w@oDI46?<{Fu*x-[W<2:Zgv[D'b4g,H=A!Pv,4} &B~kBV:c_֊]\o#Ur>Ft%4=l&bj&NH Pr;\Ӛ16+=Ɨ~Q҈A0&)c.s RZ5<[!(9vx{ٺ8i6e''T:1xhy Zaџ]\ZC:`XHcӅ4EEAփsǕ.؞F)H՚Z4u! Ps0lm ,_!gMǵT~`"<4r сP?Fn*f o- 16a5O!iT8u *($Rkl0zv Kh-$4h|B} /kc,'E *IKPJ2^AF9ispS] K/!jkXZYY>UaqtKZ([c +8!i])4@+xEޜĨ]pt½iۊ,סY57`U?nQ=_Q$.g1Vn%vQxMJ%.pCo/7(bQV03_Sf-a 87 zQ1[p.HƓ'rT{Zu V!eah_;/ü)n ˛8Ch5,*2qJɹqTT?T03W;Cxze qb6 d6ѺN=B20Mv #-%j4[Q?c;vE6AZ#5X1pX',IO݁9T.] uM\tR՟ @kvFZma5m+ }(3#MO^ٓzKΡ7LZU%iZ9dl9Nx6;Ѻ t\gK9IV0mo1AP+!9q\\ ƿ^W.i j,= Q\'I^$ŵn# '^Yboʼ SKdA+P`bؾ$Gv,[o AYVy&dNxP" eh8tHh[CH@v͋O,~>WPZn6Jлm*3Rܗ9IȘ\CL IH6Xjsޓ=Kӯ.Gp|M teBlg 2<c 4HSb1ԙ-@o?3^U=|& ۗz nz@_k~iT7 H/֤^R/z>ӻtWY8[BZ'X(0jע;LCz&D8m( OB=\d@e"jtN5kW p17BWt<ؙ<6m6RCk- <kt\'ܱ$FaWa5jܯ. f3En6PѲ< ~Y4gi$>f_mH;Zi6=+X$s*Yxiw{n6 id~]Y(nyuT> ų/<}~w?Zܗv @~z5宋˳T;2s2 ]%`h3LRфۑ*"d IsQBm'$'M,W0&n|cO>hV0D- ]##@'=G}LbPF }Y-xemv)5p6Ɔ_r֜) /ֺg:hRuɓB(j Jb?=˶xtŔXgժ0H|8KEAWdK?1`L$O{bsF80Blչ+I/.yR }.:qNmH$jCi,#tN%)R'Ge(?aD *30_y%̋@N7HI |k ؔn&vHp]܉@*)ܵ,.Xo썉FTIL#"܂ ս1:"ɖgn%W4tѹ`)X@6^mR)'=!XF!s>C٨̖B_h$@nrL8|ԗ9-:NAfajǨV}<ɮX<*n5,]mؾtzy2K"Ł%=l6/4a1[ 2Oߓ C\k~/UM/Z#}Y~Av 3Sѽ|D* JȣNLf_zP/ Zfoh Aڳ>{)K =uPĄӠ&/™kn2\\61dl2&8C0>3_R⌁>[:(8A>C£;҆aYp*pW_xh1\;\${B"6UTx vhQ.WkgFMwIj (3;̧. i`&CL\""x$v&ok ~_m^)Ce\쏯<>,L V pT+ZMb=cfd g]=82a3ţNn80e++ݾK\u}{r-'#y#@Jcgl l>_.qN!/u8jĥZ>`:exOfgc" t In!K5NRJp:[e8wyRӻʗNtKF%2xNhq/+C 5 z$XUKr]΀Aa9>׽!0_&.vFڀ|cl 3$nW0*An4{0ݚ-cQͱ޳d!? >"w-qt2kmkxL$MXȓ3QT:Gs7r=W!s# –yZ8]QO gaET7Ϩ\`:fܠ&5}ɷK^B~Ԫ3;XvLgtolї+|Fm"qSgc 5)0( \O9Zݦ너tkx3E`Dy%-RE:lt뺴HeЈ~4-gc*uv {"XYMq>4ކaސ6S`V;4ЏUQ\-BqhC>~[~[u\KB<ĂDSV]q=w =_64͒/;qH~LjYny*{[ygbeEZ&u|rH"T pG|jI?G-SaXE}RoΔ5F5C.W;t& ɼ-tLZ2oNcGas?pJ].x1L!!XY㺌+efWo\3c&6h>v+'e}B8jM} ;i!5a?#:-(LǪF-1M_kKR) 2a [DrܱܔiivM/Ixk@ (/R}Y}jo%[v%czd79kԘF%zvK-V /#iU9UĶfٵH662eU^>%AP|V>\<Xޟ$_lۼբfw9cC.Oe*\-z_}k:)(!͔E?mÿ}BDU1ՇV6<"F 91Z58ٌƷbӗ$~5tk7>^t9qH̀8nB,?Pͦ1 ~uV M=.dߍq V _KBwp(,4zf=@ Îp(jM KUAl(D(š &T`T$ɯ9ESE3'~@mI59FÊx&LAmQZE^B-gy2p2#1y13b;m.m%ļK(:QYa9)&WV-WqU 0FKkF%B?x²Ɏ#=GGVgǴ]"忯6f߳^ AF_W4a%b=X/рFe%~`n8' ) =I@n1\J `?Jv[K0q(cڃSG\3^U=kUPHDS\9nx~Á%qz4d~8ƒW|~{Khx Yn̸G X .*RWƕǜi΁|Mt܏<2 c?MI{<Ri%]HyM]P1ihyx>'<ZQgF =qX] D6lD:oMB =`M$.BJ{ `"Ǹ:mQHnڍk{t} kk7#LqIBzϊ /A|~1T` ۀ\rBF݆;iҒxy JEc!+qs#KQ$tDJ?r`'S*aqY5TFi鴀GcXOAMJ%!c!voؓeB|rO.]%\rxvGZ/-C}]T~hMm.Fiō>h vS L{ERvB[UWlZ;s#}iVPjbלi|E_$dNipMf*#3y]*5KQB4sޑD4!`We˴f\7E!TE. $-XEǨ )V+/}5,{K.O=Bm6;Or |5'>5gFR;-+仩asPQ8-z9&*8zv90!)ǸO.p{[Zl^~f{@R=e q?ZcBf9JB $:Tks1{Z㦭l_ =ߓon#9[*~ʧFRuj@3ʚF h^%3XXsl6͠=dnrZ>}n!J묺Di^shrp620S3|l2&ꛤ2V!%P^ð.dF6xvEG0oUɳ;1~nȯؖcn*ɩ X)O&12Uq״K2W0m7vpFr/*T()'d{[a59N)_@?<;MN(h!Pnsju&K|P%'XN΀!BDPM~d|Z,K,UR;}\FYu _/Sf&9k罺WZab%4CSlg:0Lnu]r!z6G2M`#3.9z>M`g4NwWr ye>/_b/_m&`e뢷'&nsO[g"X 4E/`uUӧˮkhC>_Ү1)q2M-,rpժbbz_L[dzxfu*џJ={۰h83+Nۓ=1fJ|zXm`T$%XsRYmi"tX*a]+\V]V9(hfSmB0P5xd?(b[KK˟7B{dhNKT(%U%Jr D}Vt@q3bw!@5P1An谖}NW07 7wb6Tz!IJk)E?`-RZB&_g28!,lB_ (SۧcQ9>Bk?B'@ֽ0`mNPKBNyPHJ7USG.I/(5Y XaNY]-gKkLD\_)Yq Qv(AT/8 oCe Ӭ;r`r#`Fؽ`i[g v`1E;f~o: oڅC0]'}luʖHC$h:%C78Q)p`2?y|yd>\hPxvy̨ bh! 1TMS[b!@3|@r5sc~/F슕˻@EvM<$KAEKYHhkˡ N o^%7Cޕ` 94l)v{쾾FCɌ:3SgHmP ~nYdsJ ;J;yL@a'*qu.oew˓X\LqC\,y2چ;f$ ̅~YD'bʟ̗L}xC-IożH}Գ/cgq 力wWaRZ&Rw@pܡ C\cYb߈* +1p"w!Em?H9 )݋7a:Z&}WRu,'W;|AEQƇ\ȳ gϵyE4!wx**aM1jZq}6>wP*ow  ,GC/KF$-ei̜׋L-WI!$oР׀h>a w(~Z𕳬Τu$h,?@ͻo>?*ӌTZcce0JPƪdw][w І$Ky'x3?n~+_ˡqKHg2r$FGC ]\dHƿ*/&ʼnjb4u$R*9ϛ>c_|INc%"?GeV;喯DF!;%}٦M o%@)4W9Wf2nM°= < 'sǭk{p#}W :ejY `: ƬźlEZ-+vZ5Nv09&*;WѲ؊ІWF!YQzwx&L}/a?0 ۽chR' =>ɒHṇ򺼒\>Ň{b\X*:d2=ٿjKZ_3qISX&^ZIc,^G.aapA\AԔמ| s La-tr>=j *q20ҘtpGf針rjůV#a|[Dp VeznNy$H`*|E]Sez >S|l3u)cs.D.! T e &hQ8 `tԊ]%s5hSW(72'ƠUAstڌ҄4Jl {TS-Ohk?U'/_mNqzJXܝ:p;^5()i~Eb㓫Mm=%uR{HacGY4_|ELmaoft+^,CO$TD-YɂJ?|p ln9.dL]vL!~ݝZ(K 2KD9sVHO]82=`_YpqDQ~duxdj!Crēw"Nh"i(Y8Q#+*@^ S  $u%h )wXH\6Y-2~P+Yr~t+r\{:u5炍u3a` p0xf[2o[yOF*h{nD#sӑ lO,dX)6J[ӵնSϥZΜ(_'lĺq^ty\R@0_ ?\V[=ncRi{?Q *l&5FCw}7 {b)6aN)}p`WzQބ@7 _7b!!1Ė>{d21!,qQY!ɣRZL 9UthϟU輷+{ȣpħ*?vڛLPZM>Sm}/wKe$31wy3QogVeM8''_O?Qj;9,xL@[ʸm)t1ImC. mՁmLwG8LۯX9<^l fZ$iJ,v?.S/mpD)BӧWg@[Of::u#GqRhi1hј?8 V}a9uq -ŇO66ϖnGCJѓ$m~'4ǿn/@no–q ?e~W}+{{`gЛHoĻ4Q>| tڹ^kˆM0޶NJM aRgk{`!0c%^0.7AJmfFDȉ;Eշ/P{ElQP0['qAirw_xІޜoC eZ ]H`'lmچ'wz[loE5o&x5naSnصjF[|*a Fy )wwXKQ@t/ +PY^.D: xD3q8Кu|o) n˫۬='>Rg4 Lƾ $eNX1H r ;:ed? Yje^)tXaF->$p^Y[o+SFߺK&M{5Q)z3ͳu6巭hW(h3S (I^`oGʕUDmBN(AHo_RPq\le3^fdnm6*.?8P1||9Z~n0uz-N'=.)5E۹aiy[4u@Ae)<[?>J2j !f>V$\R?=U$6)%8y?VsvPT{$ _u_g)ƻܦSB`e$=9ҡ;֬(B>!˓eIsN ÿG1TLf1LAAUe?"a*o.lH_z#F<}ۏ] *N[U8ƩBY{˱AWu",Br.8pds łg27(_ )&uQ1m9*ޅ&Xq4c@0DkO*2<!zja.ϴFϘ^uڻpKbٗɴR±QMjw˴]WHqn!" -0*iv_Pg@ep̂j6];wOa* CTkz-~9:-Lk 8W0: ĉ lvb>{gD[xa .;34Ъu(0upie8r1JS9-rkfD Tc@LlV%F6n-Aʶ H'(\)\fU!a?iXmxq\j̦P:"{e;V6LtG֢Ð wmlR@sF}q"I(q L3ӲC# 'a8j:+ԟ6׎, c[)*<;I[kD=)9̠\Yf}+zJ5#s/$azG(5h12j ,p' "ceU}7mD)KX#򘸭PԈFO/|,[(e*KE_agj>cgE>vgS:,UK"H٭ ,T` O+*l3DmTc#Gh*EsMg T997w'?E/ =塈s}OZYGv7]XGSZ 18Zܣ%m<O먰iW%x+蓴kHY&:wԪ9'[zD"Zzv}R_9k7эy%P+Y.inۡ6tʤl]^$+xq%gq~,X%#?3ԩQWy/CkPr(~yYр0G @Lou>~e϶qZ?%yWze^g8pC-D0D̆0B) 9C`@˜a4*Q_YK lm2$ؕUxjC+ޟ&߉^(oɹ[ %8Djtu24{k_^>S9,E8KL̀_ q? II7LLŽnj*h\ҭ8!4@^m[.;f Rzєd\pDH`s{(,MF0j!i(Ȅz~pv YK@B&=!s8B֍\ ӗS37= ciӅ,sӪI8xTH>O'+3M1TzTk%1X>+~6ę0jޠ~@S8m>$_t@"=%RJ*{j_կ~);F3xpVF\bW^$J,gJo,_O\B8&FdF;,ga*6pMϒ䞺ìڐԨ-]8I;E쥨H{K@: fFdD:v*t_U?ѧ525 w2Ӱ g_(6]龽uM"۸Jٔ,̑l?'aTp Wv#(<";rz8^tk-n e ӦN)hkoMS~V1РH6ddO#kp/u'N&̮ eTA&Y3:i*;B<:RÉXug3*@g Yxcfe^| ۃ`#`T ȝj SܝfjbJ?J+@?YIhݤx:"r3˩4lӈ168"72`spgzWl=7$QV{hQ‚J72aMa&I(B-KNVgZ柮pՓdI uQ1IEp2|,⺨IDǪAG1`^AyhC=} "W/>[ iP*տ٫ - w<.U@PBG]0ўBˀgoR͏G!jfC: q.NzЛMk ہ[~eͣn"1fa.<zah ~ ֵRr*;3 J %(:;@XeW3H2htkωs[hR.5D`/Nj`sT8qD.{maiqDt=gLKO%?<0ؖR1oڹ(Խh* G5Bݻ.K6A+eEXbygXHP.؉52`b`ē} 9X9aqF&ԧQOj&B]<єJ \|nIE5g)>Uߦ M*掯<%jmTYv o43x,nȍVz ,DWbt1\R \7!^V|Ƃ+G g8 I9AX<ѡH5gUC̆dXy K4̫sR19?WV?GQN*H ўʲyڝ{,! 1ÐBny tfNREЀemIS ile( &ʸ!9bn:$& 7~us<+Y"De94N?#G|{HZm-Y3ͪr,845дN.}+y7!'@.z hNCP7R%LWm {o^:{jeZRc8#R!M3AxĠZvL˗\+(䔱y˘BA~?l8=cA#nUçwiKVkE&s5CM 8~r˸V]'4gu +M!!{b>b#mf_:o F_Jq%j)^M6m{!A0~ΒA?KkCWH\FIuP? /c\ڄf ,}o"?t^{i@!BK{Bbn!S"cܴqT;͚BԼFoK|yzqo0>V$g8KKR2f +X} ,ky?z }gx F\ Ɇf${X=ўXw[p+E?O!^Jp]:Bs+2U^ +q!=t >3Z;-9f@ t߹r~>V@Ij;2I'72aAXw@D2_Vflz_)#wftEpT*SUMjbGk =9?ߖCOyFT@L`^zbωpG%Ԛ]ɋJMkm[i2[^/+uyK^75$5c@W12R"12BbN%<ԚGez8 5/ &;ݖ,ƤVeIw-Ro%ix&L_DȦ/pV:>Ic[3'mU^dfRْKCHIX,^aXxIJ\qޕïk>'J@/|J|e$H)^kf/ixCpj'}}R Q(ϮZu]b?h,6a<C3,dh΂ko+@kkqڸ8|a(r:mDqwi.Jq$pvGiCk|EL% }\2:>.e;udRS`g1'>!#Q5S=ο ٔaJ<O)}кi6I;]Ip@Y6[_C2:`DQ%[h˲WI.xs"ʊҷ,!A[ +ۍ#ɢA)_0p}Թ ~=W>t ߍ]M;J 2.s[iԍaaPdwKlX匌>@(Ϻ`~qvtM/أً #xUid]/a禉N\'ު ic5EFsi}~ߣcG:_{ v}z^t&\dͫNW;_G~ST3XSe|kS#\$<b_a.ٳVT"By,$$n\*J!@""v]bM!g4o;?y(uEt4CQ80A vn,=ڣty"a>=P|`aq n9y:B$"{cK GTcM12[D-S)-ˋ ČڹOs[apGP9`}VI^R{SAK0؛PQ$G#B1ݚC`SP?-[!j{jنOшcW^e<`bj}hYGb;0V癢w}02s 典9,6l_ܽb,AЮ.Tz _#VOw4pjJuڼQ2T—F<\6gۥ3|;VI 2=$3\I3.'z S'VxdjbkL\0q)Yt(o]×#'[~Gej9 Tu\Mpc*r!sE3bY(QNϿFӗ.y)JJTV0i*FFj*a&YJ[^7/t@nz |2%u֕WILuꦸn/nw!V2FU%|IGck|-EK[W~C{o$+:8g܂=c u(faV[Muʤ7,N-8a3A,-[sM]z} 0Ts{ߖd ԙhٍ! ^,[Im3bw0 0uk=hu? V볏 m*ƫ_b~O',j9w)ܛېBrk⟮VC0"|5ihdlxJUebb3K sZIzI> J>"n?^!qBxXt4qq-g/)n x[>`DLϟP5`Sտ?RC\N9:EOaW^}pD ;2+\{aג[CJA}8u=kIyAg dGϙU?,bV?rbEhӆwK5S^X/a ZR]?E[ ܗQgr~⋎zņSѸKb?„5IsSy^s2X<၆aI5I w$MSb[ʕ9K RXlsi4SO#s2ZTPn1[ni!}e}z*$3 cM}Җwc =8"Xfb/+SԳCnJ~SZNBrЀ(uQåi1跍;"3ަ7 jt= Y ȓ6j+`hZ4Vb7~hjkq~BRoI(<(zb&cX_U}4W[毼9뒕EClpGwmg_W&[̯ V+b/JҔ׸;9:4#6}z4ZRwgFf*{$9-M/s S~F\PUJrc@0J n#hȓ}|Љ`{dK*"x~? L`scWcrFPჿ⻅Iزd|; }~ws0'c]n ͋2EFYSuVOj5k*]s Oѻ"֯ۖO4k%bp`H %F2ي5>XX@Xq+` 6=vHZ qf$&2:㶾+8mb%lBٔ2DOJzf@9BJWD'$"m^Ƙ 8aTq˜fݠ| nS@63^NB(Mr3o.G7O;L$=/4ucm4+E41C9*7DdJ$kn5z-rBWy%"yVKF~Nle@U$I"4Oӡ#vD΋]Gxg;]H?He!5{ɑ%`7&Og~eZ+Ґ[);۱Lhu4ݾ(f: ~BjVY#fhWtXˑMq0 iSbv:ݩԌ!BѬ" 5pbotٜ*,E`k8x/d{!UAu~=)<~$C%K̾ "S`p@kƛ7K>G:/8&_G싿 C4wl9b[.npBBzSͧ܉Qn\MIGe4x 5eG#$>_i3_+~bwPmƶg>^/~x"cKRͧ?`(v\ٳ v{lF 07*ժhx{|NlR ej @cX *pI4\OltC +Aj;u(ݼ)wY0odPm`(ƢHGwuҌxf˜02*ҒT;`؁y:$+M:/@ ݐ*# \b.Ԝ7$}M3\DOOZ{4՚4e~Ud@yĜH@ahcڲ 5ED1Q~2 8́^k7TxQ RW3 O !SAvQh h(SE"`*JGmMDWHf%D~ {Ŭ_녵yt*8’j,(ʶN!hfJ bOSψ?XQh8ቭۿEs( ;} 6eLH8Xw%X:b/"f7t崯A6Pa=o#Axe;Z 6goǝ r.  8 ~>D<۞>c=7&mn_o|k( M)ꯃ;G>  W7#)tIqy~BC8hTw*oR 5y }6y8Ah>Ed2Z ǞiX7 lbeVYQ x|w$U.뎓|v]Z _kݣN/OBdZaL1ǔm_0#bfOoMߞ{ AQa1Pȗ+2Lqr`b敭zyfS)WN֦sUz9E⎨YOʳiLv )]bzC@Ƌ}lkŘޘWz$fkAbӾi Ru%xد͓|?*sdQ4E]S 5|uƌoMhq|K)e7 oo h}9Á3i%B7T+ WT{Qi>`_]˷xK >ώt"ff 2۳\:!pYSQgېlMWX# )Bc\Ap'qpE7jv/ *`4rPe386b1LWjLjmZaKZK/::)zp] N}2Z+9X!%ivx ӧޏlZұM*. 4W0|dth 6GMqM(?&K1/|:U9S4R{jn.3Q_8`{ oh:f dgyyè73EߞBɑE~;|\¬ +;AcǬs*7^@WcPM&'AΥV}~vJ=n}MF %GH30!h,!@X o)E~z(Z|`Y8#Ŧ9V`vqv0%/{EKTcͤK3)s?+ޝedGU'}|nQ.nlS^XpD)8$C D:n8[w+dH0znIٸXPUKdNmb[Yf& _wuErb`n2.}OHPNnnUtd{rXI!M$@Z{(<+ Fsa7^g\́vDS1,Do9Ϥ6Sсb!:px`/ ŁsF_ R#uTL KfͽuH^^YA4e&!GOҦvGZ\UGwSqA!r}%+=Be8q-&%ƛ[]O18'OWׄ3]AK rcb9vGh(=dV5Tٸۯ2j]V ;tx oVuōq*NNG@wدx8v]@ˉW$l58GFcݲ֌ bNwV|Ӓr{RZy@}R ƍu;-JOۨDh 6A)B?RUiS! 5(rdPTKHкrdn}%LC#ҌG+wA5+)f*GաnGn"|t5cW~S֣hR-= ]:i=$lby'i`h(5`aS<EdTC1+w.\l* k`(wяnrz UxPsyoZE[eܸ60ط$X:q4ƥv/D,I>XOuzRnO`BD?s?mcrx񇯛iEdcИ*F]"H_ i+!6^͹g1E Dn_1N O#: + 16M%:W!rY$ˢ=&ʦGn;z_̨tp񾙐/Oˤ,dfHp#}0Fs+b6!&X+Nu+A'~!SW ;K 8)6RHd{ne۵Je ?EPMq#O/F%@7-%&5^?gݹO%CBo޼f+\ Ϟ=fMz_¢jeYApoT CF}m}C'CjcSTE `" [βB-'gZ;&ZnŤب6PcAA:Jv t];>YdBZNiJ\`Ϭ<)0Ν xKěVddXCbb:v2Ú5xx]#Fk=`-x[&DzǮFGILBIN&Y ]";(n5d*u{igtهڦ&IqqEæ[Y~rIoRPֵUKV?4U:8u.]3P%E<28R"~d~:3r /w[1 &^cM-ʇ:>wn6s0+B[Bz43.҃Gd3 ]Ǜ%c6dE};^%i"7 c)U,F/=GӉ!Ĉjk؊{QcZw rj-D0Vr4Ka.TJ}\pX=B+u֣:Ec'A]bgig , _C{!m!bsWĪW~0LC /=r࿝Hc ;g~4>ZHI{"O4`!HSEWSS[h%` McJ8,[)YY[~lgr;xqB:oJ m6'L6CK@,`$)YD֬԰X3r>Gk܏mE݄6^6 }j#_o%h/'P'1\z`Ԣܫ%$͔?nڒ Ko~nm>*H 3\R}qcT'2b062BIi5h\qX`rvLfku~@n>@ϪƩeMhS3 hJw zyLȝ>:r߸( *\Wqx'J}LKH>!d#h]#bQwsN*z*գ#W>56 pz͏T/9;ܲi-h<1弔 T㹩m,+ )鐬SHGn|@ț %Cvb ^2sxm: i?eeF zo*t]%ev)0s B%2QrƱ$`n[e9|ͦϲ.žW YUbȠ 9 ݰ+-!iWj^]=geۢeHrG ^q\ ^7hoF"M& '?:LjZPa;joPI&l>*oUIC.!wCj}ʪ1ΪKmoǴ- ^v݅ú9/݉ ۠9la9DLꊭ&xzKD?}K=yPXϪ+J?jt;F'uIOȯ>SVP@P*?{lqmWԧv/$'3D46bt7tR 9/&f?0 \B8&1iܬ%>_lSIɁ *_9B.ifDQcNǺ:!mX_ v rI|";DXoC4n4kՌM%TiBL2(. 찪Tn \ ;,orKLփl۶0֧lfxx#jZ!]H<9f`#90vdq(-녦 -5Ǣ%C!ICx4XjΆa.jL ,J\Jw-<*!tk?M뒈L-Cܱb\o_ݍN׫2BEi$B)1kK6 +,([?z2寲t1%IF$P%]2}&l}WL_ g!0JbauD0n3UK}OOF;) Z fSk,yxó;,*Dg "ycmV3T+,J\?)3Su`m0Rs_ZMq#a^Iv:q@s<0E4䤚 يzC~ #3Yr7hS2Č)ho!we,.A$, +( ނq\8E1ĔVP˕*nYV. tUqih+`$}隱fhBr X7z#v YJ:fB`N&Zhr0"E ]%iTEl+ M)IyC ": 4rr%j3Gr'髖:ۥo J%K]dߏ9G%HLxqMX<Ì9)9r0 JM&OV$ DM^dՑBv}zjN/<'(v֬'xf&6M K48ςl$/u΍7wL G|#d9j,z0my$χ{<e )"g$DPmEg>w|uuq )D ûsR}mztFsIGʩ}OCaj/ dd{;j=d{iu~-B!N5,&X:fLE-#Joajv+g&Ȃ×ZFdD/71 wwZnE ]K"P#6bG/ hp s)Wj~ 5~E\aI BcqٓzVjØ>g_hQTv T䏜dVg^Rˢt>"eR}wGm )h" :GRd`&LDfzlCNns嵃羝lݛ9XM|q|iaZyL"8JEGjM*ƙd{mi57?,LXn`;Ow+Lk\AvZ蘁 ,:q" iLF}DJ$ IyІd˻l4dVfC {FtΨ3{ޑD<' հoI릈a3`;&*"נIA+GQ" !&Ƞ8xUFppIQ[42uVZz ٨w3MAR<̢~TˁYImE y(7n}kS~h`C>/O`F&g'».L5$,Mv<_du7K| !'KoHr|Lds0W6 H^vƘed"p/tqh%U<殏@ 0 ָ!ns"r/.1u^Q4?cUv*:O،)wO3|+^ X/Y 1Ʋq3S3QQ!VsV ;>Ҹe[w  Ir4aI] ZrKi+g0eƳ J-" >o -X (%B˒DusQ)D80Kȟ$y) } |tC(ܫԦ&,Q0KӞ՚Uz$/Jte'jZhuvXU"Ed&{Yˣe jNEVY[l5b?7J;"z;:ośg 815; b,CUDb%PĚ*veFxCѤTu%;Oq׹D`t}{%ck C6>[83•0ÔȋDotqa\V+BP-!F0>wy,剓nhQeeL+Eu/%/#/P:ځz5QP`6L;WjT Y ",|T9 ƃ0Or!^(-~Z:`+}Y7_4tqRAwF"חFɈMsmd lCDˠ҃(Y|J q3U!+A8FGnh:d˺ &7Y/G;TIP="KJ2|ڸBw,/лbdp*[jQ E˷>H/2Y¬тDCb:9ຬ.4Lg#i^eUbmǤ t(4NŀN3!%58R9R男n=<3PXg0=I#JZ-As!dڄ!To6$|s@Ȅ [c"wB-uXnCv􇥜= 80]w囈gs:nGn)h$ۃ W'S.)~&Sũa/{J?D;3}`/Ž["pNDo'yb]4s,RxL}m\i[&n>lcHVS!rf>9g j4TUsNwYNj㑩!ȕ)O < ǻGkwCXx+8uqH~q39wДA 5$a],[KA'xo"g_ޛCl?lijӨ$.DžaU7xy?7L3U\ؼ3~#v>V2〈 0jQg3y~EzvlSg ,`}=Ɩ}ىll(_y6^8qM..>iX\S,כlXԁؗKO#{nD=R[@;ၵXCB3S%x#Qo"JYp[ZQj9̲~\MjxLm7p_V.-I0_xh&~᫦(+o%JI$TfP~W$ sզ8'%Ma0&L# R[r&G(p5,d&^:VtJA[M תæ!uo#@e |F62+<}FL%HQ{GkQcRO9nA:O @ˍ/t`ꩴ>WiG  m'R_9:uMG{M7YI``?lC R1ml;Q="XMFDŽ/AK'6_1щoWgfsyƲ{mܤ/jX8$g#$jm]o^@OBDH<#@Åλ/!]O. -K[Ϗ / 'ylشQU2XujLop^=oD({nqE+A IpZIr0.Y*qP_zF鵾WTFw=9˴y^a#A(+AZs$jЈHVmhnWxuЅ~k6mtPq']Og " Mvozk[U.$S#_"IߢH6k,y;~4p +^qSVmUͣHxƵv6V͞,0 8ܤlzjX֑U:P+b鱆fDl9s|2_݈+sZ柄ߐrZ6mHtUQ/4˙ݚ l$閘 3 l|e_G:#5.+֓bUz!v*pҟ@o=X DTK"lb_4!#t?Gض53LV0ZyjuSߪueP@])[k4F;;qkoR-\| )CS1w'RiG+庺#i/0Cj@̅JL_E~]v,Oej%%Pԑi侴0ˎGTJ}V%MIҹj|ӊ)/! h5lV*FO1΍u_ݩHo`Lst?/8IC 7%r"ULT|vDj{W[UWPcR%e2.Jfe'`O7* K)ݛǃլSVYo M_AMTr6g[#W !樆~ BSDNbMq^=&}ZUbqt]-?PtI_ Z]yi2 1Fo G$"h*qXZMUE8?{ԤkniU ڑ_#_j~z젘R%(7"xu,[L AZi/`h:1D̠m>.FyE_p# Žk-(imqdeGDG`WJ}\w9`UcTmI;LZEp:zC& wNakL噃)8w:ءEe t1ԆjDͪ@Cf^ɥ7?Xh3y(>bkdVDM%o)v9$xkC> YhgX ^EԬ^ذBڻgqAŊ5OE0hK4Pű~9 myj%;ȡfzIc$7ǠuiGhx|I:idJ`{) .ͦ;<2t{ΚVGvҐn9 Űd3OR8gGjd5ë ۥu2uqh0[U]-tuD~x8<`g6E38!.*}{ phlHB1<&Ň,T 0ucHHЙ)QI|~,;IYbD5QV:`15!a (r5:6!2&b]e%51GvN0!|6˜+d;/W7{r.rqYl te>kcn-VRt^ԕdyQ}~wH՞MD^KFF"b.lSFb p{OHwY]ҼdCFEUYYYZT"b"]O{Viys?;#ήqj-Xʁ# [xl N23YB%馐Gڨpb*ʦ+z +VfC"LV|NI.0ʀ[ȁ71|NyagjL4 ,Б:5 ?w@1]nz2$u I(  mB#Yy\Kz.و&/:迪|hW}.|l Lz5|r\OC.G ( 5Mq(0oSX3$J8)7GjU"rGQ& t_B%Hb +M.=#Ck]29-#q]i'һAb]EЫ-I- 8#*ȅY9:YIWs)`[]2]t A*$_tHG:TWKV@딥hwq_l !^SQ!luAgCQaXؙ(bUXljUkKF`N/ <2or]7LEt*. GI۩r|hE@C/![Eov#j!wOC6ilD ]+} >]AҺabv7L\uWZTku-(NccCľ)@ )[?m( i6VB>wY|wSr G\ZH۾|PK5Ȏv:\!ʋ'<j.~BkcfNGQ EIk/'х?Ӥ-Q_hbahW]Qa]4Qz}we.n=xBpCqۢ< {wk{ȭt~Ew?oֻ5)FO JHCmk5!ЄM.BD?mA&75}Mj[Jc5#X>Eq/gb˨)-#U(\Whse"jwFm;u76Gu}J5AĞM$A']fFY 8T9ǐe&j)xsgԣvpE «,`i,uKy>.ʐ|voo_0SF;|]֢r%C\oŁ/wOֈN cFe؄܄eym:G; ί|;( ?Sn2up}5r [ (Wڍ-XYYUG Qa ƘL%BtiTxyTBe"xaS!MvВ&6CDښ}u !f26#,J-r**׿*PMb#̈UK_S Z/̔ϲ=]yc`կΗ0 UPS _% k֩c [6G?JJ +W䗲fFG?4)18 6JL'ÚQlF4ivzp#-a? nIPC!Ju,$ڽwJ z'Z=W< ј5E;.u²}8p7}V%\vxQ,ڮ6Y#,6r/ (8B;UdF} G̀U.[ڥR$@P%3 6HJ įxpA5 t:7 g6 1πpdM㤾 Cqѣ,rh7Q)"B\R$5s`(3}'uOF0]KwɶӪ٧B7QWv( @~e ʡ&o/װ6_%z追#q)5ȸ5iՑHI?λ\ɒ.4LU?+KVhE?wmx'/f28TIkcg/~ߍӟA7SwL{-'{A]:)Yd |zgs6sRFoRKBl&D8=_U[|BmQae̘zXOsf+6˩6 +\dpP0<T\rP-5%G/lsY1tQww[Tx3 r }/c*)<0sM> V\ lkEy}wú7(8tj!SD,hw2KxK rN4FD v8gPw̟YfLI }|р- .bv_3@'.עxq]αj-s]ov7hg3sGpp4<99:9C-$5a\j98D3vihy]*tOj^*$C<Ʋ MjLٷߎfpW';"WLR",zxՙCɽh?@[8˯Kzb_ \BPoH~ѽS=g5*jO-'?B, -gg=RIjܔe.>eFxCya961}g{oWvD¤@HcҮ1nr7 'O+ D6۷xɶ#b ׍SI1 jOKF]+(t%#ң^tљ=1)͇O!$tU}2900M9>y@Vu cͱiN}5Jc*.R4?yOȹo%?h/-d|%u.:Q 9 ft4Cw}i/W:EnSؙ&ITV&*.c$.O!xXF֚52g<͋5ͯ:g琽_ .o3κ(ـ3n}[jpt4H?L1؂; 1E@T+^+w"Ķ$̈́F qd3BkQs Ke&Z+$ɔ1 d(]a6NA=߄v?y L1;IAsΛpqNo@, ݄lRS;:TBް>eS<;+ꚶR%gKt@3|Ä{T֤>T/*wH;S3,+8p?mm:! _ O.!-ӟ3r1Jϰ>Hb~iO8 d~ߐ~]Bt|Q_K(Jg]i ƜF>K9o4](0Ϭ4nSZX%QfqݻzNC>(L‡mki_*`tBhsfȽV1TǔrDF9ƚj6V;H~㖽НHFK%VHBiHtq-0:t!F[twmqΞ"}&o/zxT,CNUwztss/$E='̯9+N%ĭYA5b) |^ hVOh0{~$qޅalQ)[fnxB|G QuKnڄ*3JcT"ꝪX TnŤ|u+Eɜ87r!6ni)TG;Smp86zKFeN#:@tx T-TਖȨTqJ1ʬptX.}h"6099&S ӹtHhj5j|ĩcW>&p6*lx'ϤK+Y髩ʘ9F^Ut,]r #ߖ[azV^,dνwAcr$y2rG-Qd&_P rv˪_FVq}HbŁE!N1$Z~ADg$D^^B (rqһqARZNV MK\5a~bw L⛧C$ R @#*&PE4~c:8د`zl BlWndiyc_bwOZ>qd} ~ǎ>I9t3[yVD~}6' KHQ=jl7jbtJ\q,>:SW֭eq|9 w+jPU T{,ғW巻`Zf@J^oTk{S6rU2AÞ,5: +%H9B6i,g:fL8Vp :;i,Ɛ/ɸu7t7v⎎$mOnԉ(3^#| /A= ^&LY9ӢKF?O2ot]*\Ozٸ44)7mbT&ѓ bǪ@Dj+kzf=?iDɹMDUcjӧx'Y#plp_Í)^-G< l#nYPL`ae>t P8')t?Ъ3 Ly%"yrtS{?7ZYajvQىğ|Ҷsùun}HM@24 ;=M~kepq+jhtɩbl Xv{-2krk3/Q!HY{Ztɣ=Zb%xeۉ+b6m#Cf7=d㾤K|>JJۦ2+{R)`Hyh"' @}o#p WND9eY}Q/{U]ƌl^=!vE+ұ%u--cJ$ZDŽb8^ #%io9Ͽ4ra Ew,AZ&^;Njj=jrUXn,Hf<þP׀W]bx7@3▴ _(Ʉذ<1tMiB]􅠀t!֭Ze]1K\*F*ﱢ<rQq7r#iz:! jI֠&MF*q{L(2CtJ-ʖsbKGW 2-=MIh?pj6 ="׵VMKlB́V뉴QC,¨Z]-a ^X?Sk;rlTW 6jȁ1~NJG} aؐh/ъ`bel˨yPI?O^0Bǧu~<d XdžHsϾ64ٿG?e߸{Y@٫C%ط/ +nΚ,jkFtǽi{ly[53rF(鷠194F_YAӧݢ6wӻYf9`i_M TwcR$LbQ>l =th1ENH]=Zr: >8_lgU{ĉ\DB3ލ*P +EH-J-O!H>(G UF&{G"`BѪ`HyFñ"z?kqt7h9;ag͔߀54j1_[wlt^+W>raKRS+HS ?zSG2ӴF;oΒ@RR,}B-DxHݠOk֤ri18 0l|fEX @@PU.Z2wƻ =ɥm1@yΩeuR;QO>kVmu+nui m]h(?jBj4д&x]Cp뼢LzHɐܹ6R\ -ƍTTQM"n9.Kr\jfSf]g:wB\^^C1 w.-jtU 'CFcyOxp VAum]飼Pz5Tk=v4pmWvàZ#wܲ{\{"oehs#fe i޲o.Mq]G#NuTB\Vm]QӃ7y +)\LdMU,hiƤ^'1`{"VTႽ:-3k+ղ 31h,"h^ D_*V\dJl&*+mg-dӁ3H~F} ?ҪuE2^׺h)r弢T/ * 7bc6!m>QGuo>A]6: 6wn}qz<-1fL:i@lg4f2bylw ku^˜7/P@K~QV$ݐih5 eWn5JFq"ZҦ-1'̢*ѯ{()C] [n]fIYԹOݱhL =Y{w:[5FNƴ;a2IOKeVty|X|0W &z?Y.Σ-{_X2@~AKeUWN^x Ѕ! $ $yF9p&~ aŧiA+G !2B'F< D2gtM|D`HL_v TAsTr Ol;BXxHisa o-{$e!ś+h9riW~9h $OXtprz+rߗ=,pQQr l@'.|%d02EeRZx|.qS{cZQF):ݢm@iysz+,ZqdFeP)q8+dN?LrN] 8 X:jSra|>z<;עN;[%dy]YZ;p92c|GQu4ɛLQu4~cj:dZ7;M9#.kBvZ RWpʜ,&ֳ2X@T"cJvyf$Zl'%is8=S,Hv/Na2!d?!%$F?=CҌmVlU>kb$9%jv+7%7)D3~lՇkq6a)L u&.ގ ^WU~RSPgnC@8y&eqōd?/F&Ȁ 4rԗ u`|g)ȣLzkF"Df#8:rdH\9mqJ#h홹{[U]z2++p4%U1Mnk淠qeq!\Ұl@'?J{58-SMfO!Hxm=Sm*9A%i4~v<`6 # [,A̤g2*URaGkwB3*u7EzlVȒcȐ*_[?I*>ΖَPΐ]k$ ucn7 (M︲Xl bBIdm W6ܖSqO5m1y`y'Vv<.Q r#)8OnP['"s!9H3BRXcرb*Ţj0w{wݹ4Q/Ucf1fЙ6O󚗠mn86~s͌V9Ф[=rsT(vwʢlCH4%?]7'M/5<$Kw/#>( j}gFe#0ՍܿX0+uu.$X6(=n$R󬗄rq:̾v1g8Qhi(e|#O[z_+;6w爄jg\ Er ҧu8OJv2+]~Co>Gp_f`Z[5\?9҈oG[ j1mojfFSݾ\Rc4OLIw,͌SKw|FG@F]}Ccב?.|\㧠Q9w2vLdi%d3FHXr2(]-Ϣv3/+)}xZTFhjRoZ=Ԋ*Y(RYĻo!$FOk1a(D;Tׇ7S&:,2* ݄]-q>J5" Bþ ez7CVHRyb5Jm<¿)Bbj :׷18\R=+_ePqE\VFVUP󖡹O>"ƾɧ5(5 ,3m5(cTpe1gffor`3)}R ^fhi 'Z7uU6CSM.)u z^M_C,|XR*A Ue8 LybĶ Ȣ]5Meh?WM37_~~yH;IYװ6X$כCDN g~%ơYHv$TzY|B`BK0 "H֎e,Яe+ѫ.*ZjWe}0,xm0BmCCX{m$f G2GDyd"Hۖ_PLtJ}&ʿ{+7fUߘ:TepIhI$gL}me`oZE9 zؑ4Սojp g$!}ҧU)M%4sy3Bbkga,Ҙ?/ KFB05e,NgĻ ~¹ o3r[Dz\L(ՆLZ=׬㞎✸۾W7ʫxkm)H5pϺUC+R!{މT\<ߥ,hv#Sc_ Ip^"LIa=mG !9,M?pv΢G# 1x.:i9XbW ׾})cutk u!1ֻ|Eه(/$F̹BLFkkoGR ?2 BAoAW(C^|2*ԗCPٙ&n#ߺJ} #z0c$i!/9䲗-f{}$dSEj([|1)d>~\^΄s^JQÚ+Ҳ$K?[/z%_sew |7%f7t&HJ븬f=/'6\A 5u. C3& ~sNxFq~B LV _p?;.Rg Q;UB2ʪVwL.K$o°0U^GްGswtJ繰$uz f5-΀t`3X}tu&HfM~LAh铏mO>FL '_\5˵p 1CM;:J)S~}>A(Ht;➌6O@Ѐo*wOܫ"ܕ!a}{|P\>u*gV iyݮ8b|.XV'@-]bJȳ| TVI`yX)@c \ eFf@dKU/NB5GeaҕvnH0OyNgHK+Kug+뷙=GIZzB1AH5bFrGͳ[" Qz_Ƕ]Ldx_7u(*nRfpRa%:; J@Ekm]"mg$dw%]"{bkY-ٷ꼫t\2oFI2.T]D2siNZ }OLZEqre؈ql6m8;(&.mdh+ƣdS[g|y)yP()6X*p 3MZ_kM%_ʭR 1o=@W\(~ܕ3\dm)[ud)cQIR$u1vB~zTrV_V6rZ MLHWUm3H\&XǁB -P(0tvMAOj(&OAPЅ*p5?b?UN ֬tV%k {Wc/pmѿIV>rr $E)8Hr z8(hyQ) H$aٓ,Oo >> x3&6l0pfQ6N2Y XxD d@הe5֤@7mCs! ISTLv@G"/*Բ+83fW r! t7xg9] 8DKO3acꆩ4k7f8'0fPq-(6SW$!mRjHŸ7AMj+(ogġ%w?uR,kgJbkuZX4u ։PLQ0G|QR T7X?X{Hxsd@ۛDdžL9vJRlr=2m\{HLgh2=iR.f$ g6h^?>t{Ζ216,6l_&%0r4?NC,Jw!Vcv7$ d-=I 9f 4D8aeȐߘ>g YƝ<߰TD*_ [K5ibAgwzU{gS1O8dLgmIҀ[34hޟȻ4j'@)tAW\!O#ԙZ3ZȚ|\:n|(hm(*;ߤpguW\aQZ@)s!d"ӛ*Tu)r'fߐ7q}k,aEZ`K"9aX}pEbs lXuK2% ԰FHע`B&7yG@:TR>%kzcO@!K|Mu|jT`0 \aK2|.8(p̧m<,7Ǚ:Q)Un xf#|+{R.-T= m#@^/PLGG/>!h~zF=9TRVig4uw wX=^SW|iu28lm!NA8n7P'>N8 νWnZ=LDF rᬕN~eEdTfplt 78WQ3aI,ei4܉6fك:ܷQ݃?%,%'ToY4^D:CԄPN*-|pTM礈PnzټYq!8S9{rK}MsQD3.BnQ]eYJ|>O!/ )AK"owdq^? eX NAa ~" |5AAJ/A J{,`j;_J0T M9,<1*R0،2Q--nq,RÉTa(-[E_8! Z )268A$b/iq;xVӵdU$O xEnfU,h^HYoEӅըNK3 [|f-ߘlYnfWS~A1^5i0<D$]P!G0C~$'/f;6kĊtiy}sK$3u%ZZUCKfBzO+D ]e0;M 6&VOQ>}V(gM!i*L'a]}[5k)bˠ!_}n> m#f8C7[,?,l n,}2wNغ\q- JGBZhIptjIQv9@f~s*ze /5^Mb LY:e # HkL_ǎF†:"e T& 2iG)-ǗݛE>rHf$a??%ljp.]8 J5IK,O$|s3RսΑ\ϬsZU;܇KKdXhzcͺ1/+nf[TYTL%|vMr\bD9rcc.I/įj/\HOh+;\x~;鎪=;,EnE _ŔDt.~>n26ώsTs#qw:lCZ@ z/X+ӚNejuRJVP0S{9m-t6;% hM;:榃/?8he?W/m"KG 4"O3&[ t@?V>hK8AH7L Qgdi3W{O(y2^J{־gCNkB (.\mI>bk`_YgF;8RW&s/ EDudiI"Yd*"%khV0g=&lF dyU$J#F 4F( g&$u|hHju{pER~Y%Akh[΂4L4AH? (͈(}dSŵFdE ͖uLc 6Y^k~z.SG$3!vHE+75x"}-kHL vY$RP{lQꔄ}7<nKCsf}J"[ 8sE1'7!^5 qWO'DUn;~QKjp{2{y&s⣬Nvi' GuʕXjeϸyI+<H3@N@.kmm&kEy;}x`B۾Nwf+OF(@?,@iEE$o2"箢TW]'织 57 ʟ$TEYޛޓE0$=I0;jXz3|溰E#έ]kA>}KU4TrH8K !_SCFʸarKY<<Ď{*sπpыbNz4i7RU[Mr\hljB.Y-TODxx؛sGڱjΰR)bÛ kb:A?{'jryAhtYoG흝!b(Kde !2Ыq vA5 ! @Zn.5/.-oH< VdAH'`8GXJKe.6HVݒBk[ t8~ޘs^ǔsEk"D+@#0"r_ +V*D,}iMN_ϔus@W*)q5a>6ah#jky6@.Eۮ۰h]!^. bѥzE(#+Gxod4/wqr{)u!I= Gl"wl9y*吥#mzTT@)>\YjדK:D ʕ{z*t;=7CMx3ٵؘДۢu3&ٝŀe.GCqel'c(٢8cok%Zޓ;>P[܏?[xoGD5® nӌ!XE|Se$T{HgKWn!`f~qGr%|W'zA0/l;ŧHаRI~ˇ̣Iv D~솘V'W90Q!m/]N&@1&=׽͹ =plAQ}?֭u3trӵ{κ4TK}t.My0~0nX!LhY旝Fm&_szFtF ǗZU8k{{% w~Ol5L~pFreO7x*kڽfxr4Cph@I=q Ŧd@FHep \W^Of }oUř+ۢ2l- U%$\}LR+Aq/#KvWWcK=U?F\,Afw~^e2iE\|NƆE'{ZzaAWkj@5n* }0ncD,>쒮c:EB9wO@`~[V `NmdG55*^,weom&xfq/jɩGrX;'$vqK4 r|>$/ /5zE, 7ui\MIgK?] #@,7r.p_߮\Kyy}:`HҩS_Krry`e$m_o;V`n#(]exwN.6&"1+2HկE)l N#2)Bv=B"ҶgFھT|Qi ĹzxFckEj5Lv9 ]d83qض +I(dh(*c>vNɫn!WD[B;a4_<  C长 =E,eƐoP I隵Eay 63ŸI%m4[b7z1o'+_Lϰn4w%^,~$wJ% X3ʪ v?X ҲԂ #u[a{AVTEX?g][5qV[eMG@q|3y9:cN aג/6dۨ<戍%UXR܄' 14=@hNߩXX^ع& pO$}{d!oQliI%kS"dwbɲOʔ6Илz|dRўX8& ;7ڏvth܅^Y>³p%6C=޲GkS9R,+6K5|uwyx_u1Ql4c5LZ^&:yM+09N K6|#eoǑ- v VmuћU0d[9$♖-cS*j1\‘]{%#?XHCE֍ecTѸGjmtʪM_Kq>Ķ{ll ؇V<+٣/GII4AD7dŧ;GJ_yՌnB,­B?aF'+DjVON" dKU$?>4"0z0TbOmņ\:.cBoRKrY5;a[jzNUp ԂX2U3~YǍh12uGw}%e0%^p(Y88'5=yr P^9=YT gL2h'E-Ə5S"@3`!]fN#K]z УVV!NAHęˍ{ )T}y -6^;vP/hhީwD6)}L:5xGYt]2]&Ĩ8 l"dO׎'+՘u Ar l}(<Ub%8UJ E_$DP"\G牀O;s>TϟZXOo!pGFG4eDړO/Ʊ^iP0)zԁ~j6Vbde29Fy{hx'&[$^.#Ł+č&j$H:h U6Ze8H{oltQhO%?j]l-Gͬvg1´, l1! C!8(Z|ߞ.I=#M?&~B{[[>1|2p1ۺ Gr!D 0ݠ}1ަፗq(!gL)w _sjylwq6uSdT;ʲw۫"T$˛O`Ge{k% `[LLz a,jm{ kFfS4%G捘c#] Ch6X;2 y0^ϸÐ<P- ꔃŲLڕ]`8CIzOPW](Qܶ'gDڔPf同>UKAsӫlF'e6'U~M2:8tlϊ׈cۚ/k;eb~ؔ݉e~w@ٞ΋ j+Vit|E'/\{ӣ#'3(ԯgp/1f<8{Rd,soV"7.SnCYDq'P65Npf? 2"{c7\XFZ\}u>Ɩ0R)y_pYA.5wpW"YWK\z>{%0? jm\U`ƴa~r oʭѫib#L١68a% 뇟dPaȗJ,0#ŕynدb^3}P!B6_ ׌Mmel2(pUR]eyQҪ0Õ&+oI@y[Cy{OnPGU4Dk=sػP)7Ta2Fx(AcyTWiDf9tmgG22Jwc5\5dܤ(Bnh %D35+3w:vtqlП<2J&E-uɎ£:/~Wb(EWtEo;$׵kE(?&|a;begH2;quQ9#p4E(d@@M*-@ҽR:fFjF9^"DI'~Ҧ5N<.5Hrm%.LҘʈ&I9T Լ1xJ)gj~vn'i55S{0[iʓ8 eUdݺn*ngUmGt~Jfծ/_ƎI,}W vHwpWpF2S s͹k2O k'YZR8ЙYP) g.ATR#:mdV-?]V<|\OhHϕ9rꆃܥXKx{M:u:d @} ep20Ag6CTAma* (csBe@a]~Jr@RpmJ6w||-RkYQ#49g'hoP1>'WX?"(/v .fq-m*SQicȫ5mt@:q$S;N }pefr_$~Nt;7ZUa{* b LͼŵN#"y?eWǢ8W6P?"\ů噜i4VsnJyieAXSSt)e_ DV<%"/æ$0={lL^0I7R;y0o?⦲ Lw1f8ycp'?`xu-_&MBEsnB[S NIم,ϫ;(kο$)(a^(﵉Xh@fesR=}NK Xx4(KlZBK]j%ɓ|3 .Qv~na@~Cͷxpw - 6(h5F8)񜜹 P ?* =8-FPb`v."'iFCx؜\\[ DR=1ixm`iK:#UEe8J3*'OeOEVƅIZ?γx*:CT05M nqؙe 6wh Bvnݿru;ia| M u…SY\0mVܹ1 )Bjd6xwayGShiv:X7"$IZӉK(14{#I?`cS?=/8w)]\-n$IG %W]›P(3 \1@occԻvrBZ[R[%q6k G;Z)k H4hfKxrVv ݐڽw)s: e ! 4xgj{o?|_[`eٗ %*lbGҒz!bv.7OsRDX.t)}HV5530mv’&Ď' QXM ,'޺=Xoh8y DGxN%atY +$Wy~#<;-0߾h+`A͏aZ#(@ǟ` 'ЛiB*]MU.,9dAIqT(.Eʃe;HV#'Fnvv#nDUcE}ũWnhStsMLkpfպwZTnXq dcuөgRnXJqݱvV{/q΢ir䏧"xM\2 @" [}>-@9^Ѭ[6 k.YwOQϋ>sSR7 諬e/LAS7|`tvxDEj 7v4;R`쬨ȟScGGe8P;q א&e0t Կ#* `mv#?Q ~$9Ác$Sr %[Vk5 3l5WT?rlɠm+R,a12M7Z-Ĝ 8:ʖ|9V%g˦(ƴp^fCu9 ڔWLķ =]s{!17I AX6BI8vVZnpAÁ~=s)m 0n4v;>r }!%(ӒޱopReS`%E8t$^ N_DRSQ^:iV|25鰾ӶzSa #៬djU𷠮@͢ޛĭjۿã1 #ͷJ_NSܔ2#0m-}V;G**וMD5V߼4Zqr"+prQDzܱb$N !"qk:;, Ia8fW.tPRkcxdKrC1τ`7EX?ǩޖ RsgggBZ}N%cZW@L*=d3sL?]q%7zR"_}ɊNF^cJn"dO¬WLɶ)hX ϮǨ+y[]u2r=?[|ۻml3"{Bޖj<߱j)eGi 3TO;dXu H ͙r1EhcQL575. )bi>6) uyk a_n(ЭiIiCtWLQE-y1? S:0=|{Pb$}j*3#~k5v 릡,~}f7GVJ~a&ύr(<ŽI{ pHzN.'Dv"})jAJ Nk'-L?-'۩SBE V}J]c a,` tDޠ ssAM:3)[Tީ0ыj)Qr 2( cgg9U,s[$} 6^O;[x ,2J7aJg|\'M޹ ]ȩC߰x#i?7ˤ_6z8 HlR5"~&ֻ5E^G_}GȚ` E@[ qW6ck(|ZΜs9flͣm$pӞeT<0o?T >!`.S dnjHToǾ#oNac8xY] g2 4I/2ȡ| 7E  w|0Ŗxc̮ā8 QpB(ְz@ < ¿> p[sC񙡗43yc&0 c;FCkyˣ]- -Mq+Ey&N)9jb$8HD~(vOtF9] R@x e>c!Ǫtifq Ը'WM! Uy8S4]XM%&Dۻ,EANV1Э?aUzV-T= I`|IU~)M %,.TɦДt z'Ot>i6R\9yy#n S„HFq?IJ\NUm. iEx4k_ V"%pFf\ &\ȕ7*'ځ%g/c;]Ca:S3P n(gz9F4:lLOZtw:l+CLPo@svAJS! 0U4ovU`f(5L '{#+4X/[\<=hY+-<4 `w;Iݑ;H Q'1~$hblj;mPdLHZnFYɻ{kۮe'ZM̈́ Q?q \Vxl $Sa@.,3VlOt'sG> ^`HNmڶd%2e;']J#U; e[kKP<9u6F̘mg!s.AO8-U7UOiE--!|Wi7+%O/*҄8"򤲵[c] ֿMK">o_G֖_MRFd_gOgt>xuL1iWNDHqHSݥh@w1#5r/ 4v[bWL!FA%3ĸY57mз7C|\G  cѻ<ʅ]?|oH?7<. rZ5sL)*TYzn+ԉrccMϴ19Htb!{U7P[#\Ka Y:>z<t P]pq ۀYKq1n~]P@?rwtV_ m3 TD!("<礛c}mi?1~r6C߈sK!K QFlƌ2Ql:vSqGa{RH!Ky蔵1qKCw5ˇ0Ɇi&AR퟇>}C$b9L'%A; CC60NH]1y ̘<֮L#n?YrCz:w^*8cy:6ԨT'*wp .GpxjF<32 +#!(q(M%{uI(%`t'l$57N۷/xNd sI8aBTٕAFCڛen0&}XTxB 2NT:|UZ~HCrQ7 şP dvT:ych}]vU,wKe4 -i^/D-(?19(`en*gpL?bKH/Q#3фba-F붚/Q,9Q X]1tU悧Y6.cmNLA^U#z̭ ?dJtGL6NBݿ 5ɔxJV3W=]x_>i$?=ȫ*&|^F9mt D|cl^$|voLaSPLQ, y|xr~S'zlwB~p,S]!qxE`7~Jg%=ZW͕1GcK3Kآ;nF'ٕݬ~>.W1*B^S]DoEӀʞܡ+"21SP" t_dDugΫJUlp!֪!鰇|0Ѣ2q\P5 `w Pu%dy(@gtY|W:& 0?[-Dm}|>?50UprY`(kVo_qt-5LWBlj2j8d]pQ w!=I4RkhWhs֭8|Zՠv ҇CQpZ.D-%c8&cFbY7^m=S!JlFe`'[0ɦqJ'Vjh*o5 ,z |Z9yR|\ 2=CALsԏߺ>n)#6=?{];8k]? r#[D%':!OJD@?rJ26|TENGԠMӭ ˕ A l5s$=a64iTYk%!Hna͟fX_)N54rb  ]l 1O|D\mčG?=@ h\<]9X jh)DV$JΙh2X/wgeJZlJ|}[nze)e(eE\]![ Mm)FPFjy:`BhHLVz (?7-wE쌍{)Q$T+W!ei7"Cy/^!j>I' 44i+.6KZ@:r쑪h\Gd$ ʓ@R+gA,>t+P"ђoWX̱av_^"Hn+ VYXzkaP33J >baf(Nr52C'gZ$@o1@s~ƩzPFUy"R 262t{RxIc)ψRezQVg5wna*EF8̘]k4.rKX+n>x *p'+BuG9rTih6ytqZYMt(#Qp-R< )kO 1%ȹupk78fK`dC\E /6/ -FjCg㔀(. m[\™~8A).:l^yQwVH x W>R̰cאౚfёz&=s}D{I  ` ݶ$ A!Ez*_Ag8*ȗf3YVx73J(Agҩf,-ٌVԢP^vP4Q^4^9m/qOZK%o ,} *d$YEMM7Ay.u|Q.RB;8f:B&ɲ96 ~VK/ *E{K\Y8)˟~*|Y}%)f/OT{5 ]ⷔ6GPY8^+դ*/C#Hv4}|H^1%e# .'l6@#/9fAj-w2+C D%;4H %@.W @Hܥf/,~e6C#HX.8?^ozU%;|D;K㳛%I$BW,p/ϟ+8e?[1IAyޢZd[`W˺ݴ:A|ӆ](O苎qd>QPa]"(;s+l;t9wXja <ʃy4fbFQ2^uǽ[*8Ҧhn|{eV|>~͉nYT*!hDuKX ڠ'$3& U^EYO}X>% l0k3Xnhh W>%m:gEiZ"j·bV~ G4s!7vsp2J$L9q_|bh·bJ]%$A=uhG1W^W/lk(W90WrAr-ɏ̫ k6;>-m AFZ|P+5&C(-VDPC}N>U^/%*X)-u2htнp_:L`ϖom7!Vxi6QsļR<]̅U"e:mKf*p Xzi nƤ|DO8 ]Vr͢NPE)e_=teyk;,0%z3|gcXJc YYTO&{VQ5,7fƃ=Hk LJ9hJ) @ NdO5BO Cb$PhpgoKT}4t1hV/z9_7R Ȭ B„ !VF!Ҳ@o !ܶ7"4jA']@j,$Ơt30/y̓#TȘzFy9x,@lʵᴺHN.;Hh^gM/Wj .P nS-f` kƶj9 68Ȅ_U \G{~ѕm-tʎ"iSuGk/^zo%O&ݨC/BRfDxm]0mYaʮKDϡ{kJt+|x&vz1;ğR.U}dD0 0#vr|.BZ'ЙcW@8'#m 9 Q8YϟJʪ|)@<nAB<[ʇYߔ.3^ -\3]L:M0% 7yO_}oMbrEm+{shPHi/6xϜw91L;nʪ/Z8m.c OOH_:8OΠ fp[툜0/oU%n b"Ze-ʡF5S.Ǧ;nˎ UQ=Kg9nչ{L%PWl?ap@VuO~+QY}jG2n+ꖹT(˾e?IB}Dx}z/ldBIު,S"FP*KOCGVNg6SN;<;"&2 x֬y}%I~KsL$sl<;c鱈2ڪ3G' T23hX̌@~#q*-[H3+.CaP{`.@86̅7#$w )Ng"YBG+5@ nn#OHZw #[6z!I̚d/;5ɥxSFBj)An)c96,&ڵ{ 21L2Lڎ(T:yVwn/d\xU~nЗX3uzu ) 4Fަ'TC51ٗn*'8!Kc)"^MRM6()h1S|`rV>oe:qd/Vay Zد[)C:؊O 6 jG}/k瓓!UR%Bqbى%g? U,kh Ќ @a~kj0( !(llXhL} {٪BZ"hr_HHYcSX\~g=pE;X]E@'g$t0=5єMt!1FB~ƢoWLJV'BMZtXW6"sug|o3TUO̜2áfo2nU˼J&爺r`f>WF^i.Q '[>[MȧuӜO4qjxC=e$8a%vp` " kcn91(!=4)MC?~uK ~NRֺYȃ[g0oDΥ@шg] 6Ah.5)n #m׈ʾ̿8軏u+kS]oR+Ƽ@ՇN> TIT^C1BNzEVj۫"|(~"K+]9X[u+JG1"~9}U@;0I=yl2rnFo_Gw\bV= 82P5OK[TD5/S 2񒐌GԘ\Iwm)-hmB t2wI傞d_ԯo7RWMQԠ>KDdD})]()+UWAմs?ʹirg/)h~ zk$t1FEj}KjZM+Cu?>)/éRe2[Gai"54ƙ|2ߘx؇ɪ4`v;8B=E qX߂}~?u%Z}ܕ+kn#T1 |g/D <+B%`s%E+8Z,-tݲTX~ϔAJbG așnw.N`FK[B hwo,GU:0N-yomu˂@Y/::bp?%;nް0xw,R/s|.nfxiϓJt#m`oZ/~G۲&2d!7ؙ'dvD lɣCJƧU8&}!(UL80QhC"rk,T>ZZգ h3~-훂={sf4JKò06,Ǝo%8"u`z߼DajkleGKfsLGum0Tv[:a/7uiҽJ&JKIw<^xzo/Q2q#6GoeIc /d\DFw13>Depú%=6_mȫwqA p06u!xn4R$ܨBOْ'R!|,(a؋.Ri|+}vyM"Kl "{cXM>+43uy=M}+}ڑhEٽPʜ)HfuNVLˆxpĚ"S.rN68]-~9 $Վ-@DeH?=^>\-7'X=j[Yoj24&fI ysw(vv``-yO K`S@J:h/-ʶBw&>nVE)6"7l~oiA) LLY"eu4!k`Mwj5׷Bm!03_S٘_1e5G Us8Wz5YpW.g>[@bs̠qp(m\1ߐlӓ)8TV-7u@rN࢐cKA[іw}sW%_/g 782|ĊOR"n~|,ٿKƙ# >$9*];F8U F'{t~R~ @Zimz>itHsiM{G,?ܗM 2"7My$ѓ=L=C볚z}XႤUy_SQ`GKَ Gy5Ԭ9%yEHǕTYaef*? 6 ׫C^}Zjñ"lKsW7h^:@aTaM&"B0!tyYE3f4w[m&1TQd7f9Ae,d]uW17!Nx1^0-#?/^zq4DJkՀ:3]}ՓOs6̫lgtێ(盆~m2ZҦJAӖIPE\PĶ0N{Ц5`) , 1xVM4)j T ,|4UM BuH#[r&詶5^$}lk3ͩ&5#PZ#ș1eŎo W% ˏPO0@e\b=9ۙAXY=?9sTiGabI')8Symo]"JW1*Q(V/X~ZuWK] Ax?/߾gd)SMyoΎ 7> N@\%ߛC/VҌ~,3ݪฟ&^&̲&/MsA\{!ydd#D4 [l(lPlCqt`?9[j V)PjBm%n"PI3jPi<2m*5ӹ'R]Gw& X*rX4.> v2wuo%<\|Q2": IfN:/}ObeX,͘ZY04D@=T^XEhqn%ZdGn|s1PZjgv20IVE~.DBEzKMKzWEЋEƧw$b ;ńe";LI<$"[PGV [U/gw+s^ zJ]a:RmqC'-tDЪ(u[‹$1hO:,ׄ|`yGq|@GmwL/:CG1ea~O#tU(b2D71x KƱ@/v)"`\^M4,HXOϋ.H\Cԓ&PML5([cMWqo01˹FxUYTwWd|&C)J}ޣ,Y:a7X,Ur ;U%tѴkUw,vKΠJuҿ#!1zNɣhoyEGs=,#X}% sXb0Q7s8As)fjŗ0)P#ޘ#)@_32k(oT " /n<4Xsi/Bq(6x^Dh)QHLg^}œ 38xu`Z潣%; <93~ulgiMn۩ {Bn(/ZBu(g­`l%١0X ƛy=ͩ'J _C03~ٹwJ5L*3BD]1yQ SH# tnH>~>V@QɅo}̕O m}t;7feQ2Ar`fL)u)XTQVH:$ĵ訚(UciA6L+Yŧ\-p%2L5hKDƑS(|.(LI̤nOOUu2,8BZ2`-_9gj_~wlPP{ Z0BzG 6yBPYs"A-X\j${n } HnGg`眹`!l{xmz!z)ڋM/'z+D w/b_{Vn&T&Q䟼ђ{0_E{ hQwөcF?#Ǒ#ʈw%FMbjP~nZ2OA9$ڻe%Ѽz'= ٙtZ:UV҆6ժR+98<D sq;wcvQ@P$X<J& }DrhÁ[*sU45B2xU 'p}(>IR]ؾ_?A_4Я.8i~C,hdEEvG?ybhJõRk\$2ODKb.yPlԠuaF4| O(RMMIg0 @BGpRq_E5H$$\/1<$#̜x+mggiGЈHQ8ԉ ɀhwm $MT< L[r}џ\ D#"c !T?3@ְ{@C為m[Mƾ[| Og\>tRJ8 S6_CĊ!OyаC` "g &`];JyŢ P*v9p,Vz}z%b([m`k]G^A RG%rit3H'{ԓ]"D4 cEocfrx9ЙM(j/=9%`y=@ F*7,@o+8<2xnib$wSA╏i0T W^w=tai?$ ṛ -&#j*!IFkh><f¤ݒNAc ]}~#M3SUyA P%͸ k;z~]kgd;g}=C;lJ ȴI6)#j؊>;QrKf [z, d D/Yi'b0t8b`:$=9,ےWdUxHLIf 0Q"WkY=Tpni~sTǝTXUԎE9VqgX2}ҨӖo8e1e49ŏa}Igv7 CD` ݀+]?ksSb ntF+ΎXLuj>4}?3 6r|!Ƀ>%҈w^q KTHZ;]z֛ݭ\O@8j4mjiJ ^nc(=&^8:[OEN.mgr%C~%Lo; n}tߧ]wLS_l f?Ք.-6=96mLЙbqY*G +y!}٣kGۺ/"J|![4=H6u~Fjs ;h\(=[p(^s)X n3Zto]GY.]jJ6r:oO6;]<ԞVzh-̥2vAu*ќ]b]t܋DS@Py?n.Y6ANDJOk6拡:8c.zV l0ǖ3 36ʼ?J7 's,I1U40uQ<`lED˭ vBUF=eRfy$-$:ߌ/V]*7_S.Ǡ{F/=) 2`8N.L5/q|:uqAsgYyԓy=x ye#=6GHr{IkxӜg^:kHtxx.WU4} $zZL oeo& =}FHE{J>'nb:Ǝ$п8_Rv%u:*"]~*) v E;Q qfX0p,Vh##@ AE2tu̼Se%Vi 5'Z~\Zph+61^ihQw 9xJu/g$S_MO0>V;ya$G|ГU2Bk#=A5ʙ K~e^MMfS  ƇdB͔{ i6O*AibzާQmJLO=B^֤b]h^ɹnŸt^|N'4\eCr :ǩ狄.usvRؠs$ڳ$9YN>,tįv2T?N(v6vIR7Mn8D֏eZ 09N$2 |G?0Zd5!(rgjqH{2U;%\aEҗW!>Z0wQ'mE"ḟ&K Ok0Q1?rcO(bV h83UFz3sOtaf-`uC !Y P`E"K{Ui2xZ՜_O ]޷i:W}s KU,0d! J_v tJmwsdNo~J]=^5Q䕱DwR GG]Vc?lES$܈%2+Tx+T {"[z8FY}q! Sԭ> "H9`ɳ3&8'%6e-oLe?X]~;QOH>.RokSBY7K t@fq} ܻ˞b(t'1M (eqArEq/K',[HgƯ.xSZ7Drige1 ʛƐ/bn=2G<֒?_݉=nv=htfu45jI!6h ؑB>j'54 VHO4*㱹mF,8i"F@n<@ ,i.Er:ƓkC,1 inVnLp󐑹𵬟lӪ#1Sܶ1}E^̗Hz鎩 ڸ)Od)C .&X"YaıLW [zDQwu_l*ED p嫋;mTer%YO뗈 Lrzg܋cfe$ÿ \_jSyRJcn>c ]~@N-sm9l^A!p7QB<>/4!>b͔2!4% A/+&-D&"ZņAzJbBQ8( 9Q2_R|v˾:52 5sh"w1sO®B3RG;N7ޣ(id "$5QX>ssތqU\7=`%IVi_37J3]a(XrNt u((O]izpvv .TF۪(huϤƯϢEnIO9^(G 3*~Zfz;j#ㄟ!2L[\Q1j O>BuKM +#q|A`i IӂעI.@ <8 ˗L8NkSpCw|H- '5UjWDZ $2yK6%jG}OPveW@o8eߩ_j3~𨑹X`mL ?d~gX +&osdZ_ya8#n|PbzYSmWfM$ot,Rהo{kLu#V}`XPC: \Y=W~xo??xkzA@'͒eざy--تJb\`Iu7 Z_In[,)8L|s \U/X^.<C>&gl_}*ⷓbC+94C":Ԕ7n)C;@p.%zaf`HLExRyz=KdX'H^O "Iwnm_-fv\=BO Q/{F ( '~H;IۄIX:XeSO,/Mvڋg2.)>ю(1]JRZB?Csi3SN:ZPR␬0L gxt:sRlZT d&}ruu"\g9Gy!7rvqվ놉28xys[І4T7q^+kSAv!ִ/⨥urKݍK ^)R^ze6~E 4-(*B %D~` JAj3y9)W: =2EZqB.u4u%ϷVOazXd`魿S7D1;c$n0oF?sxXu|) 59YC$kϡqpzED[_Bjws˯z]fV|y<g勺0MO'#owPl 4pȑQZ<&VZV#vVz͹)Bq=DڕB TbPX jNJ_,.o `0Usw Ԩ% RtgxrJ] l `KGΏèmX]9= 8sxN/2Ej7"R}<.Ta1e VN8_C_FF_sZ~[#nsTʏJ#nmLjWMѴ~^Z,Ѷ;'`E)0+Zdǘ I)Nَ#;EP8AWg""%q,.1ޅvX:\vjmEʤǰdۂq=] :!~܄ [P#UAB g7D6eF8W8hNRceއzp4q-^ ]bOД~hr̈&P˒pcTtG6,R7I+>J!h<1t+ MShg37@(6}Ui\[ ]W} ^;$nX+TB:}%rylcn \!.WjAUH~ ecxo܌AtONHN*gh@!aʪS2BbQ|uQV#7| *yǤ%s~Oy^9t eSr:nFL@Q +,X+Ln?GnF:ZnHe f<:jz)U1cWRj qc}e2&l8O/J o%NU$#ĕ+:,^}d>v>uE[Y  /A0[T|`tCL{}_%LP [ 'pKF?q`zH#% 2# ±Y)^-<JI_Y%o.GÈ* KLZ=/&J#CHvU]5OyeܯxQy@~U]öLQ-1=<%{-ʗRH ,!7^4 袰JyoZy2 sUf\qωE_O?}`N ,2wDX> AX6^8 N.'}HQ& gsC}^uBFŻ?ȝUNu'-7k/;\qf=E"#0ma ɕBV1xwBUTm:|x^ֽ~u ٳQ:0ٱqio=Vsdq5o ҹjY % j+/qN^KÉXz~…2ߨ]{g7 Ԑ"׋6;fjӆ*Sw%_y Nkjqt4`M_K:+V.$9] w.OkM`H}Կ?w#DߴUߒϴ?k "'=4;!AwX#,-\N>zbs[>ǤW>ltMg╒\T i:|7,gZi-*pTǿWRk j>D~6 kq̉dA~"[ևm9]w=X&@ V'nQK+˯lv}Owr(cì;޸&iF)z_ZB}L`o(#?"?::z]6cHcͮ-# i,k.ћfl E󄬹eyk))?ȵ&㠚-D+ {Hm?9O&yev/t4װ+J@!*JPe=Bڑ$kIk0`hffKGcU|č)?-: V0 $v_]<1I0c,4Wl/2_/FIVP)(5I;HG,8jE IPVVCݡjE`3ã0|Q{ZI kBrSHuq ~kN^[!}St9{|CG~ы`;sXyfG*HVg%/9N*[e%ږٖB+ꐒo^Ǎ?/ :ئvbxUUF/(Jp M<^6h̊9{jgUY/$8!lMq?}kg L&@ !pyי n3*U55[0 JsApmåơ@<_Tuͷ9P ۃW8c`(s؝)P= ܫdpVãMi :^077(*,R=9nY[:#DX%;*| __ӑ;Gmw iT/יE6, D(b 5"l^+2t;{XTԾB=gLh?i&vPT"c'I&]ǐ 0ijR.[VԵ YF-EN4m9/ggZ-ZPFC@@}O/4wܘe]+wa`ɠHY|v9/ n`g렲O{uA6 :8O(4'&Dj*p#¤LO[ٷJ)75GU#&)@SL?ν뾐NFlHe"(~koNR9:'{JFC_d&vr[}v߹DzTϤ}q(G0-keF$ȝZv"T|I uOBO;X~t>ɡOyq&򬽾 yLx:ѐ֛Y5Oqbe몛fTQe e hyё<FѧcK@|`ܪBD ..ss&imZE?SX7|= aA $c$K.82a/ \'sLZTJpovlp_]ޤ)`a=W9 2EZ_Kjst ɞ!mov L|@I:^vz Y}eE`0ק5:;9*7o~0$E-)X#k;5ehly [KI]||7h֎sB2,sKC5@w80ģɻ ׉5j=!_s=up)G6nh}6{;a{2>(C!ߣ2-6Bݒ8wO̎ @VT>L8)36%;99|sgM뽅Jp-}+=ÆYa HN~WTp,o[͘B1f?E5sritN+p zw=@&` Kf:>dۃ ާi/u BJQ쾋޵nETM 3!6g=VE)$]eXm$ E'[)}, v22疦duv!Թ(e!L/ @n?slVM\<>,< X2׶%@(K qEBk3U1+MHş!~[sY}C3e|9;T2Q&{NxIou0.eGT ~\ݖc6 6M Xz:ro!>ɿ Op- }qåN蕥#T :f¢W@/0"XocSW?f{ﭠA"YzՉ#8bn;ӛTcZ>_gl|Aznׁr"okz]+y̦^a<~}1[عʨhꓱy3%I&fԍ`uV]Ï3]Wk9w›Xd>\h[Ti8(ae9!LM5e/(kjZ ldzdt{kHA#X7o iu2Y9|K!renɘ֙Yd xF\M-tyJ=&i#f""A] XL$b}u"vég\)Tk>Z~dDE焃S 2~D%%v2Y.>9  'h>!uAѹ[ܠDdUf^%׋hb夫o5xk \+-'#D^t,XC#4#i@$$l@[-8I3{z\VD κuTؔ׷zƉ*PtY/$m}. M̷~`J&nks|J_BjŴ?i(&q'44ݙ6Q[0*;F,R*Da>*Nя8"4R -f{S#س =(GΆX}vGs@՘ܷy`p (T٨>Mn3<ܞLG~G.vˑ?1T@ߤr3o!%E*\_]e>^N``M8ET#Z6hCg9\=ase(0⮄ Myͯ5#!kxJz%H_apH]\l93 ?:6'/KG*쾢hQk`#zpf}>\ߪ EǑ}pNg^]tZMM(q DP:RU*8L-ތl(:32䋜fdipP|4t&7C{GWu ֳ74ui$&ΊlWH~۬DK?l& _My]<{A4 H;!ƨ}s(埻Ջ(Qpwa-B2=9Q*g9Il,tt/.?E龖̈H=]0ctm3X-NMg^JIs-[23nEfi'jL+3$*cĢ_B<; {Jp91F]/_Ǎݭ# ψJo,6rtL֊>3U<'i}& 'R{kTD}I= .xJd : E-$S{UǗ "D.B㽦ulDyU$l131c q 1 |WVx&,&}W3Ay^Qm6'&p ͌WPQ0/DSa~^\"tO b'S{^|n)̉EUH04bC3Gԓy, k.s7Êd^uI5``M%P{wZA-Dld/mö%ſBha]"-AS* 8qdC ڪgAF~1bW` sօ?"dz B},ϵ>@^}/r=7~R(R40P_~πr`; ,.>e7Ndqmgƿ 5dzUyhڴ / hN>Yl&;C.w{έa|uPj‚'FxNs&J{7!*a7xKkwBDL 6+pj'V5ȫ`ƿ5a31wG2ޓ*Hp˙EȠ U%L,|ǁJgç[zyxZ&Ҝ î5#d˄ J]c uuէ~IkM Ůq6p-fk7nzy$NSmxWXc_SD:6XV`.@,džnQ]<_R9n+Sǖ**7vn dI(KK *vA.pXf[uÁx:' Z57eyb挷Gt bе9p( oUg/O2F od+1(Ldd!/s hc*s\zzM,N Ҩ_Ŵti\贚E~n߭L%|3#QGrNq/W#2ޏ/=5#BWȏ<1|V`S S#i!/y5렇3BɨrF%ZJQ !b պ'op,"d`bH\A7Iރ %B/GԹK1Q9F 3nM Zs\ZVzo SLDcތTrD!/6ySqKk,>3iXYe&:}PBs0Z;(ǛB9!}[In3Vw~9=R;@,VqmL[؅%e/q*5^TB;eXyX&~Oq]eD61s4du{3Obڶ`q$<3e >}Q'_嗮0+mJTrH|p@im.HqAd@W Y,g^.rn/k|]7PAD~Vj !1y*mE".Z%5FFJ#_ K2^ZhCסZ81z< ՚/h0a5jUC|IQ-HnYaПSC Fpqu;]绮yb.$!*>+_gi =tr{ RsA|䂂+椡S oPB&f b`\R.1 o0!S<;pzn6bլ^:U]ddI|]C.N:~:{͍&a;\®&G!cf_hfǃB~c@si.J3My2{\Ģ^K:` b}2N^o}E?ټoUz "N~mbE+&zkJc.KW6iE٪OőM`3̈́JSqU*mQ@'Q_weƈF>oSjĽ '`Dd;zy2;|:( |}gƙ0HUqx[HLNS6B\qɸ n.nq3%3y_VPIpyU w4*a7/յHydЎ_߈5'FK1fsՄ7Ft!w9V`of c4k@IȔBz-D޲\N.3#(t[Tr?^L_iڋK˝Ec~AG>,-3xhoNү0Ȏ0?Y q>JrU. ħ $f7ᕓq)r̂E` Ӡ6"̦joc{|o΄ m &Tu/\萷gDSR|)jw7beu*~r&q5j vզȅS7;ۗӽWhfbRՓ`#6pX~|Xޤ4`ҷr5ו\(q#C+>Oʪ2'+khb{cTpUO d'r6S@UBL j烿A3*]z~Dl$zb(( J҈ z~f,!2znj-yrT2{Į>a/G`,{k rjF6FxS(IT&p1 o`_Qa V9EX91{>*IU`[:tPdq#xM41!?v[OTH|)T"P9TmYU`l7!=#Fp`S:e_UEBs>v#""ƧH \%(pM|LyFsu3*p];lcEj|"l]]iH I0B0@ɦ&B <9Bds{fQ5|-z8B !+I~o@$)}p0Iϐ6сD #>xjG[CD^.jcqO{ܚG~YBiU :"%90uL)2ZOa25!HiY&ԣ={Ë|ʘsP Dg~_9^pc[ڔƸ9ZW*8*p`? rg[3;=S/``dU(~)% tG9dsi(#9}KL 7Gο0F@~C:@J0̪fw)>q$[!`9/ڏ4)gLGA}j7hΞ6^c+i.c]7V:mr@Q K}Kd &+X/ lmp r1va8P0-O耭7be8ãh|H;"?zv6Nt*Y n+ 4R?’޶_`I."I7\4}Hb&ʏ9<@ܙ.G/5vX_3S;}|m0Q7QCoÇhU&DxM3ݳcjnI{xVs/VH7W Pc X`K6ChHLEɭdOPH `a]O%WJgreJ L   RCkMw$2.Dz oP4/ܨ͂fMW?(^)qNAnY<u;zC V*Vݑ9y^jldZ z7,]1zĽv  Y ).A!1kV?eȝ4瀽:"yƵjytkF!q[ލ٦c܇Xr{zpcGI$[*#ƾnqOzaU{ˈJބakjL,bX`q 'u#}c¨bpCh@PBm4)˯QLTWbj\M'Gɒ#* 㠚%[, 0itGL @ԑ;N/\*ŗBmUR޳הl^6zS5 &LPGVI38!3)5kowM}A%$]7,[P(JdkOBT dv>ÂuQ}ضެ|o1|-Xf YyHn1ݶHk!ˠ*8Piat%& cdi7P=Ӂ_Sş%,;P$G?Э⪽\^& = eռo34'=xeQ۫}(k|~r S3Y y<ڻġE蝳rG#]G48n[ O/WM,ƨ177J;kT-X+FM uZu8SNf&I$^2MKLe {og%cH| - 3!f;CQ+y,v@kh!04o#*i4_k8%»bF=JRߌ*`z"6^.ھƿWH ufiK;[,mWqppqd<ܲNЈ[sŲ:s1'1 S?#eZ V1 *q$v1ShE${ӂr*̜9 Krr4cL b/#׆3 gVmvI%\jv ت*'tǼ{(VM”aŀW8+cśC+@}3L#tJ28KMVԆI>^+4c!^͢.\P%2mJ7-!>Oa@j@Vh_x(O(&݄xS78q~ljGyzr7c.gX &̂t0Y3 BrW^$J ,#C>3h{qŻAMͼ3N>ӷ4Swސ%wc]d% >[7lO6~Wg3<d`e^!܎/-[=oLM#MTZM᛾}4f1ou ^Trq$4VdW?3"وTim& .`hէ$ϱ4ζH7D$fޝ滅Ҏpo#K0z7x(=4mJk{FVRi 8z{>FYb^Zo.E;hc{µLfɞ 4] 53P])tj3@=A/pщ}YQC!6KfM/9Xڳ5mߘ$C+lfjs5Ⱦo:G̬E<{ѝZR?35U/l}X4Nfo~ N&,ΦٝL\ՙ:_n*aS$3 !J+kOzݖEn3q5spS :жcC W|# ^Fgp~],m!6Wq3%iCQюPz4.W@'}tTf̆% \6JǴXHR),dAig m\'#w< <4qtCUCK}%n,s‡j;9 2{?SASw9lrA~%<ͺPY H諸cslW85FzU/ ;ӮN G{sa복=V8%dr\*9(,,~(܎bkQ6T/aIM9k;-MED}5 J"X7=0|DbP!R-(*+&蛧E5C =cv$g{b-䄓n//AR38Lʩi8ɨcەQ Q y58Mr MW: HosmH> @$2ƂT8UeT7RȀZէn=o}-~ r;TT8p/E'P%J2snt6:(ݝCXc 45HuR(|@`W>F }&-$̻*rQ)f~0AFwcU~3cSls< v:fejQ.Y0x]=T_ɟ3|.=jUؓ< ߾|ekQC݆X:Ka;ɖkbbN.J PpuXL{]ԢwjM0"D݄5Un~|Ka^ fBWnK!%(hw7Tqzw16ŀ{Fv7^l &-V XCb < z&TIh;b5H943pIz +mS)Dqj-x 4u]Cz[v& Wv}Ob}aM,6H1*O`'áf>TǼq]L.;];Nʉܳ'w!?(ʡTeGTx,Ԍ@#+AV)f-}m[g6 XWWS=A@PF"WB7Ogը{곽X&5:O}eiMyzȑ'ʋ8 ^& ۔>ivrL@hh E7}ށkᩛaSv6b-.Y$7j"(iz0P >Wq]D;}Jq&]q(@v 2LBkZDS;Nlj==\^é.XNya <̺7$ \NMh[˖vCOmhɹHI"#"Qd8[n? ɀ"j{LXAhpkm6] em|T{1x\xؔErת񻩢7}NhG e@X_[xtrr/s:͂_=]aoIS6M"^υ l vgțWDݙS3sD9i~*',FhS!s85nZe?FE5x*"^Q40hgRcmrowժet`یM1bAxYRA5bđa#\P~,9Gbh>lnGv:hX@ʂ..f[>x :mAr0ྱ5_6KSA-+?w-w0nPZ `Z䤾&iFJjQ TA ' ֩n j±,/uIj,sV`aWn' e8F,XotMtO5v; |o1T0 m4hsp"G8oWh2%fӣi4e$؀$%,)׫D5RaĖEﺃp>ԣXY@W yɁA j DL _"Q<8'#.2XߋR+Ԅ̙:H2Lb.N:G^<_ȫBk"XqǬe3S/D0E b`9W I4Խ;Ԑ$JAn9-6Noo ҙIl]JJ|?G%B`ۆM@2rę!9& ]~4-UÑvԍid^{"̆m,^`{)':B>v8 ИB96'0SIWlSBRR{wuާu 52u~SZu~p?"[ xc81f^Q dx1H#+z<qo<}\,CB{>4c8 Zg_%>-- 5alB(hvT٢=D: 8RJj/urR#I6U$g-,{fNaV79t?sꨨ殂(r$ : pf"xܷ@;Po@+UȾf΁3wV`diD =ͧ+ZPO{am`7g8"O$ǖ1Ee#%>.?5 xKpf( M^L;Y!s^ q [RgxQ0YxFE2/f4n黏<~A%p;5PӖ)Z}:~LޑY0[xr 09Ju?\(/N>ݹHǻ6YWe$9l#Föd|Be_z鱅r=&xmB!; ˥ Z/4ѲGN+Y=\HLQE f4L2kΦSU| TUSQZs͕Y7΄q#at ^+LS[}RG- γig헅&͕ްSE8O '!ޝHj(p$avs`:ؗ aD;NxQES!yKe")մ/L Ш?l "G#Y>> WC,ȳ?-(ϱjT+q`xȞ#Ua(gˤ Gy Daw[9yx}^E)$UQ%`XHV`İ WgHtP9[0@HI87$yqΛS?(G][@|5[erĢZ2ñKe7Gn_zuL Q-rqԧW0>*h[ؔ\>>{ukk0N~4]𷵚0cВ}Viz=|t|_J$D0÷Go`f_+ 5FkJ˃Xi-|q>"_LO\7Y-np u۹47Uhϰf26qܑQLIA[̯U8iS$_,Ɍ8!8b_x^>4 GD@~IC3' Bn7`?^fͭ!RKss'9vzGzHA^uVNށ`\U=v dhx s2z\hgǿғ ֽ3 i\_?e<2['[<{ \6aJL!n9M=:^Vg&Jzc693JSkɞ|hoKJw)$ wsZ?b0$S ķL/uOS$%mTtQv6vS4d Tb/tS0~ӶnaPE?Uh"1ꡠOУ~!k˷qiN|$C/ԏk]q cq9!z[nIfOAc؜~oр0,(Fm8C~GPlW~"/uRiI:|qDجKN2c0`Xg lgw]_hO"`mr(6OTpir_+G4f5 gX`WMD%1ςBoq0~q9[WBv[sM\UCt>I* FiZ]cRS˨: 8 ́|:/?ѽ(7dr}JrƲ?Cl\RByN?`OD]F0YuѾx͢pMI"!+S?!hF\#o*,O," :ry)7@5vd"fha-҉X }{{ Ҵi :W 7c=Y܏y * FcP!tnR3 ~PX6P"7>bK<~nsF~F>t}JwfRņN]qqym )f7a[|<#/INsQ}sPGL. ]i$M+V 1I !Рԥ N|61BJ7]1+$tn@W|L}Ww @+4p[ 5S!(Ç$څ^油toYBJ"?Gv-(7pfٲJ\vf>ܩyZk#ےzhRDdE($5&V#>2P2 d4Icm #Qr<1+#]^N"(d2m),Mpknm-iT,]9n`Vn.]\BQ/dD|ŗoy9%G|7PK92*xŲK23-lEf- }!:Ԁ, -kiZHeo5>#UHЇ(7~ɼTwҁ-2o~ I?Mui8ÎB^Ilػ7#gSbc8"o|1[ZJȲR@QڊGH~mny7<^BvUD*.f@KE)n.(@} VQe ϭHr\ Zu*N^7?M>Lї})g5 ENy`!EůTsLvkrtt&n,5cu΂d[Te,-ሕ3hnnњPE!s%HWBML NXق aqN,HӧXL9nd/[,C$Do$ѐ_X1e8A'\(Dnڦ~ijfc=m߂Ul>NU2(w'$GCŽ^j%X~7Ro{jMh+Eiy>.TxgF^Uos*}J/>{2 l&U1$=vQ9^Ls}Arkv8őJ:#G HC9b1FƬhBnfS> vAKy!z6;2Fi<[8TG h<.{3b R:&4U*SyHSU{Cj`z`: .݊^p8\HtC9+VE|p b?\N 3L+-4ޣ\ nTwxK2b"@PP Ôf;d((9;rc=nf]A8-W}L.^vJlVmKgg .\H7C0`BoQweN$OYDRɀz5g8&+a'0+c* k%LF܌/.D)3})`AeUBF#+[s=cNnړAݦzW-30(K( _eR↼$Girov9o?ЕR -L֓vJeb<[{-B08y#CuMy=b&fsg\>8Krn9(o¨<6>h KJ1#W7q[7#5?'iaWzӜt9dO[mQ`$ݩjHQB܁ko[x\a0@Fk->EcEq@'&e`=㛨Yt e4y L^6kO=;"B!ܐ^N *$-'LAFl yUF*T7:wثd%(?'t&qZ9 ֠.з^9^yRkzx3~.M( q 2_;avCl(z[Z/oPNUWT96}h m.0_ : A,(bZ C2ӊn & orZFT&p-9G!Gtu\ZX (=n&iMɪ"hvuu捷 R]rtR/Te>ҐE͇޿}9R IP* ޿sHg6)UɆK -ڕAφ2ORb.DOW:=JG X ;GfwwrF|RqЩJdE]*9ydc Z~zS BSn$fz'HiY+m}qrULB6ZFءJݸpaȤ䡋FJqʸ8L/ZtM$溸}%X*u q{q&zS1* z4:t$f( E`'#rʷ6WP8j\'ij<Ϯ83΁ yQjD:ޡ<&cuf61:cf밀X:Gj{@cI Ҕy[J^I?=J 1%nFqHV.m&uTWt"(yj,ӈzB!G=O SlcDd$$nwUK6/tUb?gY T7K[`w. ^˩:7_Ypexj;:۰}U*Lxm<_\>\V8lJR:.o ^ᖠSآ-`Nc b1YnEwV WߖY84`řn]/ƪǜI9ul, 8bgjRRlcܰ3ǖ .N'>V$ɛ߆(t-HGCipkikΣ\9ܡ3Q{OQVy7. 6<<^E/z' {M5r@8;|H~C<%;GuxY{Y1#2KŇг:%( ؉dvj?6Q=/Z5#lbIl|QRNo+mo4֞e¸wbK};{ېp3/kE},W&u@c!a HmqO kU1tf/ pFkqhwخ"IfQ%>%ծ~91?-C'וs<3.$!}.B]{@Ni>˦ S>pᆭ%q*D ON[%=遤F)(MO6"u3k%bọP}_蔨 M{:Q$~:7zI-#;}SM ` зEnEs7uSĔn3\ y>wXѧ@*sZJ؎VBC@'As,|PO291j )*B:0tu]͋m*VT3FH0oj@#6cql>oovui62)SW$Axjձ%`s/Og/LODfp*tne0)!Wl59OmU)!{&1LWiDgZxtߪؤ,-JEViŒD!%J|3gbW"w 9DhD|oͅ;oPAZ&eoC=[[A۽]Ze]I/5J˃ &Pw,Lkqi1_X9/=FG0 q,VȺ2ޖeLh 0#'41XiBc`ۣf'~pp`0@J2 ԩF\+>B_+f23UG'-:BMr?oFz/ˑҷ!lRu e4'L pcJT<`"2&q Xzңù1qg9 ݉&wXWUŰm<‹C~ ^NF\h<KhiTGRE[=1®4jeXM| N}mKQX)b/"-Px}\׺eW-cI_ә7iݯtBg#{nGޡ*BB}4xcX˻CM-ɝj˂O.B tqV%2`Uv5y *; \Z̑mAc g m8O4'g rU,IL^g+-T/}MsŒeY7{c˰^J2hxëԁ ~VѾ}Ѐcuzߋb^1?y'P$úVS k29[gGmDT._ rR8p<$ 3ٯr} -arJO cˑĺ]\I2eiq冿Q]h=6Sl"?GX=!pMsp 13V oRTMR$Y .DD7Kimtl!f;p)! FC%f>?-kXn.⁛ Cym D?3 }>V\.9#> 6/X.*ٜ@|=Piao<\KIC B2 ;`H[0( y# Т},[IK[N%;"MyWt8Al/,{6@+%HLh560/; S|R8h}P  cך 0-C%k'\c<ۘ@;;mWl.*2$g睊m|~!i{{+DeY`rJnAfU]v:zP_|c@BGe>)Q,'rr΃[iY $0-k0 6PJ]}̭?',Tf׹Vۚ=z\2lTH'[Uz'c&|ɏC%'1hu+wn;vJ쉇vvXSfgpeV?m})p]Y*Pg픪ce^O$ɌQ1W{QJPVTfQ} _ qI9v #1,I>PP[nn* X6'(JR6ѓɿZ_3![~"tVpi |CkZ]w߿eGчՒ1x-CqXNqSaF0ϴuipZ!,d>W7.fp‰%y#2dӰYzɆ>b6”)w=p } ?n _Vֵqf_KF kȇA  zVw,bA=blz٢;hOWCMl떌",z@o-PMqM]$%n >lA$z=pN0N’S2ރiȃ>CLeMzBœxEEbthYI6\sC8)fQߚ6rs9Bhw`T+spMT-Uz rJz \u"E[U}'+n ;tF A|ZtPQX#=O56Ïyecv@KHs M+kbddCp]I>\g֬j m||NZDc1d!NqWz*b N].k7iu- 0+q%WiD&HŻ( &_$ wͅ,\8*|2R5Q 3a#.vƢL8y `4,)a%H߫ڴ_ݓEk Qy2z rkX[1b*A1Kׯ%1:l7`1ւtsVI1WFx*^#I jTЭ+[mH^J 9Q ܩjĵp cw܅XK]hL,t=]3]أ5ƜV3 \q- @[xĂ|?\BѪE` 8{._B</k}dFU6sb\˼:@EXiqZ`xzcZ >١;scU9Zf$LCǖwN>ܑ2ZiG=8SVBϾ..'?[ EǪ3\D7t$|zc"/z~`r֙xF[}6j㼛5խO e"V$W!WU/Vvέ$Z$S2UB#ƪ^Yx*_Q.3ѽMf {Q h'[&B v _z=?R[SN3(ã=ه9> *dL;07 OqxQ?h h7~(QRzDS+shMEㄓx𺇏\]'K[,Ƹ@/+_ٖ9:k$2O!i)eBZ"^:CY|XJ(`-p515kp-f}}K/ֽI]ᖞaR|S-EЯ6E;|J [V{ nc~f ެtCMi g3ZՈvPV_[b WaQ%C}C+;&!!U)ZxOgD>.ߥnc |݊}mginAh%`ٰbcO rTl!MQ(gN\=7?X9 \ȵЈ *|H[ѷ7H̭KoXn V/DE: !}&51]-:*tz M2I8Cl*}M77R V$U ,yb ^44Ll%k̇ʹ b\h0cf!Iѩv`DLt2=dJ(j3-ql a(.٪ȴ="LPobH>V/SgXf/]oVhX s}z:e|^R;N<0&'D8n|ˠh(yq^y?0UkPIpSBǣWF[Mfy,eRe퍮pu jI*;O9vQe8´͡6ѓB"HSiR 1ePyؑ"]*jr*ܶa" YVN:HI@v Hϴ/eR6?w <1S+]081(/`Sآl5f#xxH8-Tƌ V\TTolΉvj-* ~ @&/Ԏqw$1't)!&?hKCrtY%wli(E/iR*5Zp⫢ 4]ۥOĕRz6K68=Y"E8@)b=#T Y~"PH w).?ŌZrhV*5趹`?I%Z`1ZĻ.&zOlGlRt3rIխ 5_ϤrӵݧXؼ8?je/ {js&{wi?pz3Iorl L_Jp5L509.$"C 4 la /ll;'r`Օy*Gڮp7PQN&%%^O.%'n`V"œ'|UW+D8zlOd/wTrU>mY աKfak3}٬7,ߕ*E\3wGioxkY#oV1A{̫ʸ.@}goC5`#d΅Zms56܆>M7dL]-}Xfe03_HAr̮ED.ϢSh\̒[VZL&@ 񦟌c[Ǩjflwgp1uQ"|Uփ _0'w*'~S#bM:spe%Pz ݝt1fIZKGi`n; b=sm<%3NtL)72j?i\Yڶ=upt_I6>K"LŹMyqyt*Vd|ݥ > =]y3>B__ӽI7q9-享΄{ !mFlOcH- Pضo;ueG؅ܹB: i&0 \YP2sR3&Ji{Tεu?=oF$p8#P>X81}+VڒI$((?(P$D3~b#餋G?1ZVȒ/lzX+ PnW˄",Ri dz@2UG`qx~H漕rݭQՌ#t >ZˢOو;?<)XHGe X7]+=xڇI7CfZ|DXrR2<@k=Uc򢴠 ,h!#g=SL~Zj@|ukcaOd*º6QZI=leZN#)MJp'5 i| +; h3RHkF{ipwWEC"8.gϟn~dsP+XP|['9]N5mz?'&t!]HFՏl2Q'_88qeA-[LT}Yjd2 nٳ _ahY%>b4Kj])xt0 [oH{98C5RHX.P#+=!ߢ: jT%,Զ?? j7  }v_DhL+@;jDf#b ^Os+5?tj˒?Jt^[zFp@H^+OL-L:=dҮѩz\]Mu&\֞fڷ3Rz WiYMnGtj#k))5[o"$Xy'尖HcOMV4Ud/؍1Z|m %!.EdFZ=-S8 =[Ll(PF cj<8xBmD~@|)tj׸A92oZ|*_tyD(A9E;Kor>-eBe__FW?)ÝQ[?e9&w1- *h?ߢ> SXLF$T2ܒx,4 a6nM]e n5km] 6o%t}vFoqFΘ%!4{ܳȪVFA]Wvutgß$~S~KInEQn۴g mݤoE1f ܁$Qkh"nҥer{{%S &دĊ<@XD S''__±»̥ޗN<  :΀\je6TDԱmH*oCF1Fx!`ŞQ#TMD _I~ Ur='Br°Ѱ[94ߓ?&W3 (Hts){7hs Uw)+|N KN(CP(sk~p)Sm-m.)?ǹ:aEZZqs׾Z*1 sU$[ 4?i!Smuf ST']>w(bꗖQ#/4qNYB7EB#پmYR)6]69a_k¥d-!RVYÓbgq%A?ԪAw`C͗mn|'jzzI@TgWT]?:iTk`G6COx~6'ٝ?IƒDG/9_lW6gp8Ő#Im*+cZ mV/~56G.Ro!@4Xg_wS& %!ɚy+"w}$cEҗX;p!t?)Db /':Xb&ʴHN7tq# rTN O ΁=N{t94s0oq`(]f"ջb"$Zck?w{ՖKVæzDaú#Mnn^1.ScKO^π:M,\m-;?&^RXK\5v!KO4RkYIm/ZleU0̨)ޫ>Oчm6&[ln8[R.Չ\vj1󶑂-hho  E4FrvzxнW6c?~n&c<DPWyɧtǨJg朂n?8ؗ%y[cN\Yq+~xbZ HaO($<}:Icq9փ*fGbv7=SIWyȫPG9>zlOBUc~Wמ&ێɪç߹yq5D:=w8\9qY+_6icld1Nq2٪[hV)a|~aV 2475x \" "6 !iՃp\x0Rw"D[ws;6 s(](k]!bm(z` L8̉d<΂Io_>u2KQ.Q@^ß;$5dszYm@YmӪW6FS!Oo^F݆!zփB5 c v#Y+A&-W-@e%doZ'guM%y̳!tVYO0cM*۶wdS0k C7C!i; uD`23`;y:sqe eՒ DYSL-a2鋑mo3K"*-emwiq"Mjs0qs@iYE*fMg?Mv7wU3j  XRL$?u/bw+Z/Jx`ʑɆil8̆`%RB;gF`SZr!;a:܈U3Fe=7D) =ij*J.5?(INȈp (}f>l06+굳Wrb휱AAe6.IwtT< ^'~x"1 HMbWA^RRZnGɣYO"ȸOYJ }VIA^ >v.-OAڷ _5Um`դQ uo-cw6f:I͍xܯPxqBü6%uY):2k$&5G1P((KFO 9:#Ӷ81 2sJ`܀㰛m$1U.\4U4z\n `MMi2Y2 ԫ:NKi3;9Iۋ` AJlI5N=R>bVSMg9l W6kv lץ1&)Wz Ԫ~o*sRY{)'È?љL-i}9844!;~Z !2_-ts$7>_NFm< 71mXt=a{f+OWƦGMBe&,ngыq*s V5cHXBhH|8^vWOU%RA,^̧cuN,YOK = XJVԢ !eZe{CgXORR};iOd )= qF8m*7{k87y 7 R'NO6V>rll\+ttJ.]>R Q-O[N10ʬ=-%_ۋ$Џ:%ES 3#i7 !UPV"+<~U}g@gomE,ƨV*N!stOV$GGƷX[Wp sx[!|nTYe}a^(; DTTm&RkSjOZ" АO))+YÝh~-s Fգ9ՓƨjqL-^>?'ۏHU0C4; ly袶cbrܢU?X."[oQ$\~,A>bS5`[X8ٚ -C:t>M:to+SRX$V%שF:yEiK3YغE8*/֩L NVΨmgxIeiKNP+P+VXm!59`+e`=$h92^H\` MOPY,<u]WƤD?wQP2^F2Ͷ y7,LSN2 Ӵ=F@Kr n1OvJ79T B`hQ' hQ4»60 ]91%jv(`?u;sA{%1ЬTjЊ):=ȷ;)0*Ϳ\N^<&$:D]l@=KDd-Ӭ`E^šeZ][oV2wEYWq{P.Ԉ?ng\ӽK:&c+TŌmM"a8|72;ߜUW,oaτ݉QY=ZNjk,!BfAbfL࣓զ6LGώO`L eʣwMae|k-q3q;[tRٞ:S޼?ROZE8b2x9(`AI_pH(62n/_>1}2삘')Tx9aqk}+r6TGt}W ƣ4 RH~Ѫ',IW _+%w  K]jck{|΀AQS=߼7mKHc@MjTmj޻(p`ěU"iq4zq,d]N2s!IkS4.h@\C+~yW~Cz=ºvԐm.e甘$A аXtٝ~HmݢsC#~$Ȋe| 8G\n[mxho0-Vbló/! hJ&+˷?|t6|_fӈXdeĤ!JnSݲQv:n9THO\aF sp xU eⓥ]4jgruKT%m1XA*QˡE3-ƫHA4b w &s{Q>r X/Tu {O⢓oǪAz͝=Q5oSLf =AI y=h3~jçg(tDQxZ$t*clkPÔGpٲBU@cK-D-*) KRؖNؕjMT i#rLzfM\j PSZFK$掙uAҞ1mWd/LEjETZ̷2MJy)_x .fggP P _+,I<sQ)E:|<u\U+A鲰|Vn)/r@yZϾhݚqh3Џ!8i tu l='.X7S3edWQ{T3ŌG&~+b:>5DsD ^΄Q:̙X'T#E[VuȎD^BZfKa0Zw:!j$;YE,]mh|>.,dƙ[{օDo&u&4# @8nps,:n\b0 ,s| R'&L`woދ2agEh%&RX0u ۈ6Rb^޼M~^ =l'1; ݪLL `IAcJo)G)[ϋ'JK>9nAW|[>sYˆs9 B qQKyWU!7*i1tuKa6]efps ¸{V m}Aa\K_bsQn>{zMpyA' q_JB -gr(iWy UR#@Ot4kI.h6.3WW4IE-L5b[7 nqr(IAt7*1Ň29# WF5Ԭ a% pLu @-A"*}w, ۙAXeׯQ 1*)E+}_;thܽ$d*BC6lŋF< #`j}(8DL(ՐTx]3UօՃ Eaxp"ŋ| *映AfD-0\`t2s'@ft M*{=yϰKt`~wfSu_ = C~a/]v%ƕ&՗ hl V:oőt(*#͌f`=_M*S.}%vQ::pj2m̿x,|q8ƋrVNHvB0ÏI|;o>U%exZm"ݽB3omU[uYhZYXG]Fզ{# T 8|wID c3Φwcתoqac0⺤G`r""IY N">4"ePO[0gmeԂﲮH0vV=D0ʔ:v|31zZ=q5kX1͝pM-]-'Bshc`b[~0LȻ ??(I:u{ S ?5grRzC,S(/ '$pK#D7I] p53d>n:.D#*I@4PgYgU" mA1lu?tŘy]mY_Rs  ="NL|XG hIZTRaP8x9ݕ>՗yd]ߨ}ӡZ (~@8:&jiaY,/Wf"9vQ%'E}ff*ZWfVqAy(!6O(mc6 3l-5+3Qے IO3ib\P$܃1,>l"fιvDIN{n G>4xf 5qShS\ 0&<%x#((mHa%!+5@ Xډ%;vw s.jpHƐN+Q ΥQ!.d5cv,#W1Ю9\|b.P1$F& HvP#.WLvr4Kd{T)i``LWÓ8~/[L1bYRg)cv Uw{ >{l Rt,)oBg:h=E|ɜxX?&!t*A (6[3Tn4Evss̺f+-4}B%: 8{,gpi3; }5rC(_%g7FR9>JuapXٛz~FHj'E!v620>.'@q=[9XlS 1[a)&$( s2OF-̼)8$ɶߥrB.$ [n FdͅG#qcG&-̧B>h;:럆e"pyЮCY~_·O>C3jjʥfE bd3.ⷆkAvd:$Rd3p7%i+lbb:bM GÑUäsn Msonx5GJP#ڷ-M{{K(At ɤ .!n,7D3~Y k&&|~>Br:{ҶB#Rm-YlwOuُ섯۞Χ#tP/hyΔ:m`)_0hcmJn}ԣkiL6<8KTP?T7UryP@RbdiWGՂ9|~+8 ]Qɳ.cgaxqŠ5!ʞ5}-JLGֈpLtӴ>gX܃lDpDsTi1 );㻯8~CsM7aqF\/RF>1#+V@Zŷn@T||H5rXE&qc)ؗ|/?=g*dQM]ׯQy}(CvFk/`2PØK|_/󃶈n0-JFw"=x!j?ns7i"^A4uV ^ ?#C8az씴y0;5X7Tc4I(kMat=_g4l#< Y uc("N&u*Xmyo̟C^OuJm]?Ծ^JfrZ E`HXANQ{g$tGDgLe+J;*ͺj1dY`/TiX++R3 z}GUx1} `SZvJM3- 6e GOb[&KD> (KiD )h\>^JGGʮJ&PɠXHZjQKN՟x|_h]؆ ) yUՃ`rΣJE\"a"0{{#pLQш[SN@]p,#P3l̛wrpa`7?>({V[Tpd,h: =fFm7dV V#BߪF/YeKtG&s4VVQMRulB^WĽuAHXC!*gT=z p/Z!!` uEAq@8!xdAt4Ll]kR>![3/KIf*&m){ $)j});UMouq:hTϭ>BwL~6Z!>j.2yt\y'S<Fz衊ax~)cgPX])~ĠoBDpSOM le@ NǑ>z:ln7>FEȍ4s#q E[mm^VáEjhL=)admj ), :~ \O\k@U|jK@8!bm)-~f3;kfP[`6n˫L XVKe Ms m2;?2௰6}]ygTi,x^bF~BA2rZQ83˖gHv8(UvR{$+ׁX)]Y)d(SdtJ< 3 ˷`hI~e"O UF-!ٸ6JzLYSNI3KY|l&N6StR7nPNtDG_ ^|7F؉HP`X: i*psz}B2OmyݰjY=%ɧ\t#k}=8{W+S.Mt>͇x V/<oloZ۞0L9;̓Tbݾ#^B6osUMBgX^ Su[@!Nku?y_{Y-̀ψ}HӜM%NOjR{u$U󏁲)12gNƯepz0:"jm̶BG4xnnEHNKp $ֺfk剺$*X>/Hxnթ[2x- Ò,\.L{c=_%J$F$3\D)˧*A{4O^ԟ_ __KyܨA_COEgFM$ eP <_ fLkg }7%%;Vsaaɬ~]mgϺO#N>Xɇ YN+fkbOpOMjD4QG0+>8;F&!.ןk"x. K^Mb/whl85_Ce 2<9e2CAlF^j]$ޫZub:c2fOMC %Jو+lITVda  Y3;{a^gv.@@zjM\$d+V('MK6ogD^,0ev f\!5ZY܉!*0Θ5,o#54õYQl2uKm?W$ ҧ5LBHdwgOJ@ZoҤ(deA#5̨NVs p~-$Oa]ɋMjt]oHBcyAEf夘 AkVę"n8˸7ŕ%AO0!̴Zrqϣy4O(pϛDIHv&bQ҈Jn/ xV\^ ?tN ȿ(^nQP;_mюk47SYţC E$gBpnt!Ьֆ~jB0l (gm47m}HCѳ~UMJzJ\5eUSL U/6.]W};s$׋#$&r$ 1b= 01ip c q7~%d1q.Mk3xeF'Q=luX vFW>%vj93W(~];JR^2KrOAh 11?g7_RJJfݠؖ0тbE`*Yu}2[>:15i'lnE!w;,)E6z:5rQ #q #Hbvx4="[+Uڋx0CdçMY?6Zk{;1jPåCu@}ߥbqMFA0J oVuf@8>BEfy Kx C be Ic̯o< Ȋ,%stđJUXrL֘`*hhETdy&L$Y}ԪYq@!sZ8T'ΉjǛxMcC$S3)'s:1̆1{aKe\YѠa!hQ5%W]+zx鄁N| G}M )cڧLX pSWME$:ҳ.4ǎTUOÏvc}5iyaj"4>VM? &j@'E]Na 텼[ݦ\`x[_xdqk"`kP3a2Ҿ @Ϟp\€ m4WD#ےz!)kB$%CkxX.74eYyOW `xH/ < [juk#Z2&J`؉SO4׭ߤ||],o/+;أv KׅٞF)Q,$28F;g0$pv{VǰbK2!rPL3dF0y lf)|94`ࡺ*qx.8Bm~3 􍫰9,Jmv(:¾0TDzz녋!)YK·_qG?cyVGd֮HwPi8> Շf;mc B!ut{Ͼҁz|{9 9jswD];ϓ+F\ӜIguRx6 /t恰hȁSjؐxmu\lc3;LZKBi oWr-!ʩr`v`6(r* >/c ^7j^A̚JƓ/xL@H4Me16_V =^ˊ1^E"X!BǷyϝ$mA!\jKs :cñ) @T=wFɸ!n73Ls'gvn~]5=+Qe=UM\ y]9L}.Wn ж2Տr A%⚅FvGIV'&8'6?k+M@ m ?\#їb0?]|=Fu[N(Z6w?-'vs8yV)*" 7Ӭ(f>jK~L$= v ukڅ}c yHn K$IdX63lw%l{xA8ܽcJIyuTZV'fTlЧddݵ<=UGG!5nX;x32{'bD̰%(i=XspSs|&.$- Vu_.Ggp'dpF-cSrP .Ƀ(!w%Ȱ3%vǭ|[!^>n/הs4?ܞ|BUe;oJ:/h&Y_I&7~!\yBd -)}C{fRIohͩiJ<":Z5> {b%bWɏVB<<]-EoUMsXY87Ybi?Dw*Ԓ'xJʦ%Cx˝I C!վV6|6GKӀ`Τ2|~O--~ŎȊ9FOac; yP\CNm|4l0c%N&%/9Hgq&Ԁ7鋆k' 38 8ӇdLr~W  "*ٵOEѯiAqy8@`zۡb@: ;C8ؙ^I):s~YX! LIn We^(M ^F/QuҏQ19r-8Ǯ2闉]/=vCX 8nwɸQ3$mLk1 7(8n3Ż$0\+j%T7*4ga0A39Ф i-H糴 7;4( wKtTh N:!~BZ~3ܗ}g1(#u&:WܨH %Me=[ 'ksPw$٬%Jn[KpoRT4ѲܭZ;VoNQ%=a-::zZFx J4YSJN>kZ?sĠJUg9i ?pQ;\ނ#/⌜SMه1>/dUzT\LJk5u8"'V=49u ͘}ү!VppDzF7AeGuc 4ts_*6l\hλ/5_9)ӑM#ю@ }ѿM8w?0INhA F=l("S{1] ~m]ja[ 1ވR}3k~"b PȈCg:ݷōRrM :W68 VJߌs>.00_ڪJ'\ (dᒻ6KCVsg[ٴдŒ!CèOF֦PzV;8@ zuXoz:*k_KqlZȄy ώS^جBˀ:hX ĂsD=)ڢV`q>`)3.c!g9aE^!v5H9F&`2 p:s;|_ -:=0,eQ{Hk{3#'uIWz%w(.\Yy7_96̪"뗘'ipF/O<:+,`!ю#Ul%'hC쟅yrlݟ$Y%9Nv%b="W6ù#zyNGΠuHP]McNx:![^FM!FSwfˣ{ew/Cq2NjXEU ~JMԸ7ЋϜ88fJ_@31-c3Ubn6TO3[5O=}p`?:{TX OM !CE>`*G{~t^DWQ7gQ0vLI($Usn&$, ૎z$&BgE$I{c #.-2|YA\_*1pғjl<1W*cPakZ&2e: 4qci an#옮^ðm\ۚӛձ݌MEB%sW:G8F\CohON˃ϔ8D/VҽmXS=nIK}l[Ц[ %B tNBmB7?]Wŏ e8a7V$PP;K8~xw;2y0?a̩U'gY+[-@ ٹ yL v3"IsHC.3G!5DNؙY~Ip푐^+玼eI{nlh$m0^|>"̸I2FM7.H='BKE*[2"0$$Lm^XRPO:֚l$1PEnuB!2J ֯q94.L8%qrRM쉖l*| mmuNY--`x2D eQ[MONNyg[-X.-= lIOy#>^O}3IMO#*)HIZbՈ%s_;sZN1v VٷCƱe;v630U'NO7=ϊe F` H 3O2ՑjyȲ!D3@kd6-#&v0 ?kg9Fc|9DAI bwd/y;^ t^眤/dXz)*\n*mlq!WUخԀ%6d`mgR/dD q>HO*+{,ThxmաmflκԎ U$ ߟ+셫$< _ǖ5 q-^%oWBv"%^9w{Q漽dq:w>P9H՟<66Hjǯj( Jdo}߷j?n5j<3=Ļ<^{&}*c`3tٔd\ ֻJݛJ%dVPi}#YX %Q00m_2d㾅/g49)*5$%J<P֚@!(x7$Ҋ5j)aehovBZف~VٓE ˥3LfMzVi|&.\!i*IF!GMӿL@)gK vl G aVȖj?do".™cbD`eϐo|zp;㟟._* gpfK.,ۖRo5Ĺd 5Y!Hrc&]e׸dr5^ dݕG d_4t_Yqh/}â]*Րs$Nܯ#*!;rf5: 0Gش/kAxwNA8i!t7t{+L4kRGOz@~4r{uK9Ed߆U y{6݁! OМ刖u<2`nunBd47m:_s nuF12hwm&F ::e^`PZ,3c[^0E'NID)G 4x-O4=>i؃cbrx@݈m#&0"Op%h*37=kŬ|-AN.\NQo(7;R9i'nDXN܋ l/>SX5Wȱ 8M 1~/tU&&rV8Fg:wZT%c:dio^W+Ot1o.k Pu}o- 덲R2J9f@x6{}kC m &c'>cCF g!Eՠ891H|`?|Y/;k̮l`Ҏ5̜0Sr,b]^+-@i\rUTDAr9tMM<h#IQ:Є$Ͱ̬袡T\>t+]),,z-Q][d|2熀Q)* OЈ7n>h=};ho;>v6cz<Gک"Pv>8}㉁1K?˩_CrzDslD\fΗ<1 YhN]:8`|mt,rihӶBFڗDEKId$vBS/C A:>NQKJ?FAVZsPAXt"eK /auH<.ʴľTzFdTY>ud{ɔu6(s(][{"h'Td'C`P+-uwirֳ|X pO@>!iktҸ 5Av"-igم [XY^EH-lst/FGu܌;/#" ?) K (*j1Mb!S 1|`t)y^N7rY834Uvv1- @ۏWV_U+z\tӼ(O1%*ac̷Gs%,4<Ԩ<qPMbL *}Fl|ˡ[F-t =%|S88h2J; sR^67>F~גXJwy6!LLG7ϿOnYƔ: ʲߓ"A}$K71ܽ|mGSY\â2t4Y޹Z;Rlcvk}8U SyO&+vÿ5u=S%G 1C/wDv495οjnxJx > {Qek9ԘЀܰ)~u 4]Z.=۫K[6HZ]/ }I=TzQ6.\¦ru,鉵#S8A'A?Zgua)UzGȑv;V\կb1g+ "&d1#<7Nș;œ:)8; [%JAp{+EҢ)eWF"ѫcHi[VboTk~GmHJGSAe3wF%z.<;R'-ّ1P-V_6@)`R\pvOWD(y:'[eb W cKv %[y )ǽT=uiH}m#X*? zëM_r Gs AD^I/BA(,n˫N0E\yup᳢âaCVWߍ 1 HzN3uKsi:G3kYb_n}g>?[pgR|4.+}d NO 9. %/C\qیY%64 meWVMQj&a&&,HWp~bc_lfPqW*p7ū~wq՝C8L?Ж*ZqNV-(FBHTI6\is]"}k\($)2rM$9"nL<鿟Tw@#"Ns~j*|FzAroc-iē%$'3pH>"S_Ut;)k8(ǩ\Nj)MyAuCOX~EnhF6s *ɷ4 ol?ǟ@c?6AΓ.+%,Wt`\|n_'\GyY/'oPT65ڜhm.m0y\-%-GH;ښ|..f-k D׏$ )QuH|z;"㺷޶JIJ0VLɵ P2)UX1(N)4<,M+~NkrǞW:Fm-/"**C~r_ caB*v5-a{/zA[¸H,̬4D:caLJ 8Zu U96vOIG4U_],mo WZ6z4sd6f GB\#=.+b y(%; lw?vީM)nb&gn"Ab&Xɪ<5Q% C, gˈ~D{DM%τd^-ZzV_-}G;{f Uca alc{Q>1>'Cp5@Ԋ"Zւp:9vC_F9q'0jJd:7e.faev\'O"StX1ˣK^-΀La\r s󉭅IK_v'\sR60RLuG6ZHn+ bSOKJM .d{Z?ݭgZ]Q$dX\y\c\zCUo܅ɖt{Y~ @"VbINp^5+LC(ٚN}ȊKFXjpT'|&9(y._"]Dvͮݹ*ZB/!V|lKP>Z{ї=Ρc%U`kȎWyy6V4ծ4e' i8;֨:Q&и4BYHaJLѶM4 ],#S>æ: [7C`!1Ⱥi@J4;25[\)cYunZ hǢ)?1x V=Mqz܀F\?\Q~V Č$DcA8̇4W$Aw.L/(&fCg v Z88lRfxdX?1@>s?Գhn!=ru9J%)2Nu?ݮѷG$F̈́ 3G=Sclo auY8x;-.eU%u"8 A oG Owt6CB\pcA/%M1%rqzbyhfN%@'̹ G yK}]gSM,+\,(/̏!١E6qY"ǀE6[չu\QcIR.1⌙URPX!492I )HB#D:]?y ӧyn:2LDdY6XU) brjyпh Xe5C}E )Pc"b7_C2;(9֓lxhzzJ9IVEo%O.ͤk%_s'\|K \n#*bG`+q̵]g`5RtMVJ)`^H*Ӿf@y15.?l~<4]P@ů3Hyq;?} k*1GAn;0X) ,#ķKh3HdkV 0_m=M:3De}Q p7j-e4--=k ⬁aDlxzwl͠ F]-bMZꊮ^eX$# erѰpDf)vfe&1z רo@pw~rHt3fNצeL,_"lHDk~l4Xc&@+>C0G.RLa\e*a(ЈӔtD2@i.fvOP $TMomՍV{a͖PH'{ _&2I05lR1Et{_Ͳ$d*uM*qHX+Oaif@Z֧v7!Sz 88F(^ rd_3}l\s|mTscو87S;8vo7Z#ei8sZW$pZb/?I@hNrBփB5 +!e48f6*XUIy;@'WB~GQ +Hhm k@MϹکfo']XeJȠ,w%/# ͩlx9|g1EUS$YjU,n m"yoͬ>QeQV;,{~JfXd9G dqAkIXpC"Q98rrn)3HLW!.~N?Ԛ06nzgSKܷdTS4h'S[A)vZzv# "B>bǞҎBO6NZ+0iŎaѝtl"("S?*5<{ݣV|?Spz px,5! N[=e%aEɤ&\C.jD]FMg@X. ĿNN1VqGP0SoKkiJ9eW 5Gpx8݄q&0T潑'ᑔ"3 4~*u[s~4ӁPOzt )u^<0MENc) S<ʚw:H>٨`lENR@ذ{Doo ^!Jҁd 1a 9Z]wD>BhL Uf4#pHkVđ7a(N7uU__zz-ۣ)Nճ`hA bJuNȢn1g9ʻV|`^1}9Dbھ*=(䈓đembC2FYˀ)h6 ,R&D"ű>y7F$S=0J*~:d,!9hD~19lF˖F%1 sBGӵ{#v% 9\י.n>U\Ͻq0:n8dAj_ZO.k]ѭ.!JSG%y)Zi_suMEUt2: Mcu 2bkAb'ZliE qLAr#Vr4!f"P|*Ux"7ps|d9Ǥl| suΞwu#0͇unSR->uyrxH1đjJarr\j~YzN_>wgv+6|5~?әv3lwϮ2R&Уc6[<O1oCz}j pQN_./U߾'g!Vx0DPNn/QR_Ⱦ}jNv^ݴ/??m#v-QV4#<S՗Ai6uu*aJUuzC{ Bh=$6֣dE֗ͻk[Y+^K,@"æڥ?K7z)K$wX),= {oq6 -Ta%cӔbGE+*boTχ(6*C:Xqigu&P,<0L\ S47fR+euUn9U. *yh^Zfw)?f)ul5<_ϹHHLR%rMf?I Ymy ׭@@X9kz -b˔&B v|f,.A|-Rd`+PD{gaU%=ց{R$<7,b zRNP1d:"xF)/} 4*\Qe )B*+\US&.\u4hsߵC)iU*P5H%ƀscNgpL^j4k xMdEaY޻iX z Cx$.if6r!}'Ukd?*ܭ׌MU39UQ"Q@RZ-MrBr[%Bol;'9eH(./I%/TwS.לؐ*ؽ.7bq]0?r}/5yfZeM޹g{3UI 'd['pc8)bD0 b(G9Fd9ݗ]LXL()L/0{T@%DV|fV=T#⚅]b /3d$Z DI5|PYSHbw!(|έmGZ? 2JVU'ƓS\PnVKgam˱{K]԰Uf{@40Dv?%b99E)oflQ^RZP }It[nx4MYnF kI.ηUS3ڴb_*n։cBI&3RQE 6xb\Y"nߑbDU侶>>/bz}:7ݹ;~rr:HAX<˽u9r\uk^U˃XV2?dE{u/dXYqC!~WN(Itnw+ Yg-P "IbvG,B`z$gsYIkP>>t\7OE#hunYtWLxdN^nRΣ۪Q[:OC]K{Ka|i;dE&2य़t_wWv\NH\6$vU/-+qu ol2@"ba!Ġ}yuvnzA0'=<&lys?\,}dxwd) dHygR5"/$z@&M&!=4$C,aL'0zgkgSK+ S |)MLlp)Ƙl_/;a}y1kH􎇎F3]AHVBpi?,.Z燩hjs!c<p\B^?j C$r_*í"yxer6k.H ^g9/M5ɵҊe嘚\Xem3Ҭ)!hM9- M) lyᄫT3&gՇ 3ydVxc%)}b kW9 2Ν8e5d?RRF;U!df#=$xc/WTTg`> y WS%uT9#sQ8f1i9T8^C:;B%C$ZqJc6Ϸ6q6P+n3V h~=GM #!jf Ǣbvmw!ښܻ(h$D wjDA WDыmZ_KH YZ