samba-winbind-4.15.13+git.710.7032820fcd-150400.3.34.2 >  A ep9|<`AB^qlLCd >Af|WN)w)]譇HЧH1Sxst6ί%HwWC %}̇ kotm씣Ir&&q|4-@_CleAI89&5jsGqp -Xu*S`)е5.'e) jAlVPV9bn4766659852f4257001ceac1fb264a07952bbdac4df9d800a6d5203008d85cb49cfba05a6817119c0bb10b837f6ce5eca173f5d09ep9|>"X w;+g2Ψc|F w( 0Nk( o NZ žQnɨx28+L rIänl1BRm_[F$f LYG/"76ٷDf!bj0ѶɁc̡bN8 DCк4I:ml|$3_.D:sfՅ8嗢ρ4a"w4**95BL#u>pLv?vd+ 9 Q .4<.1`     X<88(9899>:P=ix>i?i@iBiFiGiHjIjLXj`YjpZj[j\k ]kP^lBbmpcndnenfnlnunvn wrXxryrzvv,v0v]v|vvvCsamba-winbind4.15.13+git.710.7032820fcd150400.3.34.2Winbind Daemon and ToolThis is the winbind-daemon and the wbinfo-tool.eh04-armsrv1lSUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxaarch64# we need this group for squid (ntlmauth) # read access to /var/lib/samba/winbindd_privileged getent group winbind >/dev/null || groupadd -r winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in winbind.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi/sbin/ldconfig if test ${1:-0} -eq 1; then ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-down.d/55-samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-up.d/55-samba-winbindd else for if_case in if-down.d if-up.d; do test -h /etc/sysconfig/network/${if_case}/samba-winbindd || \ continue rm -f /etc/sysconfig/network/${if_case}/samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/${if_case}/55-samba-winbindd done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in winbind.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] && /usr/bin/systemd-tmpfiles --create samba.conf || : PNAME=samba SUBPNAME=-winbind SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable winbind.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop winbind.service ) || : fi/sbin/ldconfig if [ $1 -eq 0 ]; then /usr/sbin/pam-config --delete --winbind if [ -x /usr/sbin/nscd ]; then /usr/sbin/nscd -i passwd /usr/sbin/nscd -i group fi fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in winbind.service ; do sysv_service="${service%.*}" rm -f "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart winbind.service ) || : fi fi<rX%0G^큤큤AAeeeeeeeeeeeeeeee7e7dbd95eb7e0d1e8c973d39fb53be9be46276b21bcacd8b0ae1adeeb63651f6fbea676af835bac5e037fd6f6d9950ea49ff3f39bc693d479069190927c1c53083993a1caa0988f1da58a965d7a954f36d791af7b63f8f4d458a49b7b48dedc79096ce17a4b26f037f385f44fd2adc679c56ce05a1612640f3a12d338a41496823cbdbfcb632fcbb5736d172298c1ae05da590d0de9246c21a92e7b3ca95013904d48c787a47c3127f9c5fdde2848eeac71a06e22cbf997c132d74ada549c086e0dce4a8bfec6a1db15a33fe3c6072b1020b6ccca2bf455dcd3a10058530d9340359a16eb3e6b8e2bf0b1ee56f8a98e8ed307633badc5f3c02d8a82a4293ea474394ac77d9e83d19f4b9d422ef787af85b3e0aa48a888253bf89b8c61eb21fa200696435ec1adcb9b07efb274b37bb8ec9fdc96ee4f9e595cadea51d32700fa5c3fd9a7d14636105f395c6bd8620dc3e6b2af9e08f8d1dae7bf6606f6169e283541c6b4b0325dd3211474ac785379683cc4e7f17e211327fb9d536c1ff9138de03eservice@@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootwinbindsamba-4.15.13+git.710.7032820fcd-150400.3.34.2.src.rpmconfig(samba-winbind)samba-client:/usr/sbin/winbinddsamba-winbindsamba-winbind(aarch-64)@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/sbin/ldconfig/sbin/ldconfig/usr/sbin/groupaddconfig(samba-winbind)coreutilsld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.2()(64bit)libndr.so.2(NDR_0.0.1)(64bit)libndr.so.2(NDR_0.0.4)(64bit)libndr.so.2(NDR_0.2.0)(64bit)libnpa-tstream-samba4.so()(64bit)libnpa-tstream-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.14)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.21)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.13)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)libwinbind-client-samba4.so()(64bit)libwinbind-client-samba4.so(SAMBA_4.15.13_GIT.710.7032820FCD150400.3.34.2_SUSE_OS15.0_AARCH64)(64bit)pam-configrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-clientsamba-winbind-libs4.15.13+git.710.7032820fcd-150400.3.34.23.0.4-14.6.0-14.0-15.2-14.15.13+git.710.7032820fcd4.15.13+git.710.7032820fcd4.14.3e[J@e@d.@d-@d@dJc@cS@ccR@cctc5cM@b@b@b@ba@bascabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- Add "net offlinejoin composeodj" command; (bsc#1214076);- CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424).- Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940);- secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384).- CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171).- CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). - CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). - CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485).- Prevent use after free of messaging_ctdb_fde_ev structs; (bso#15293); (bsc#1207416).- CVE-2022-38023 Additional patches for the PDC role's netlogon server; (bso#15240); (bsc#1206504);- CVE-2021-20251: samba: Bad password count not incremented atomically; (bso#14611); (bsc#1206546).- Update to 4.15.13 * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); (bsc#1205385); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); (bsc#1205386); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); (bsc#1206504); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists- Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689);- Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254)- Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- CVE-2022-1615: Do not ignore errors in random number generation; (bso#15103); (bsc#1202976); - CVE-2022-32743: Implement validated dnsHostName write rights; (bso#14833); (bsc#1202803);- Fix Use after free when iterating smbd_server_connection->connections after tree disconnect failure; (bso#15128); (bsc#1200102).- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- Update to 4.15.3 * Recursive directory delete with veto files is broken in 4.15.0; (bso#14878); * A directory containing dangling symlinks cannot be deleted by SMB2 alone when they are the only entry in the directory; (bso#14879); * SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used uninitialized in rmdir_internals(); (bso#14892); * MaxQueryDuration not honoured in Samba AD DC LDAP; (bso#14694); * The CVE-2020-25717 username map [script] advice has undesired side effects for the local nt token; (bso#14901); (bsc#1192849); * User with multiple spaces (eg FredNurk) become un-deletable; (bso#14902); * Avoid storing NTTIME_THAW (-2) as value on disk; (bso#14127); * smbXsrv_client_global record validation leads to crash if existing record points at non-existing process; (bso#14882); * Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call; (bso#14890); * Samba process doesn't log to logfile; (bso#14897); * set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert; (bso#14907); * Kerberos authentication on standalone server in MIT realm broken; (bso#14922); * Segmentation fault when joining the domain; (bso#14923); * Support for ROLE_IPA_DC is incomplete; (bso#14903); * rpcclient cannot connect to ncacn_ip_tcp services anymore; (bso#14767); * winexe crashes since 4.15.0 after popt parsing; (bso#14893); * net ads status -P broken in a clustered environment; (bso#14908); * Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before smbd_smb2_ioctl_send; (bso#14788); * winbindd doesn't start when "allow trusted domains" is off; (bso#14899); * smbclient login without password using '-N' fails with NT_STATUS_INVALID_PARAMETER on Samba AD DC; (bso#14883); * A schannel client incorrectly detects a downgrade connecting to an AES only server; (bso#14912); * Possible null pointer dereference in winbind; (bso#14921); * Fix -k legacy option for client tools like smbclient, rpcclient, net, etc.; (bso#14846); * Add Debian 11 CI bootstrap support; (bso#14872); * Crash in recycle_unlink_internal(); (bso#14888);- Fix dependency problem upgrading from libndr0 to libndr2 and from libsamba-credentials0 to libsamba-credentials1; (bsc#1192684);- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899); - Update to 4.15.2 * CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication; (bso#12444); (bsc#1014440); * CVE-2020-25717: A user on the domain can become root on domain members; (bso#14556); (bsc#1192284); * CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC; (bso#14558); (bsc#1192246); * CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets; (bso#14561); (bsc#1192247); * CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid); (bso#14557); (bsc#1192505); * CVE-2020-25722: Samba AD DC did not do suffienct access and conformance checking of data stored; (bso#14564); (bsc#1192283); * CVE-2021-3738: Use after free in Samba AD DC RPC server; (bso#14468); (bsc#1192215); * CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability; (bso#14875); (bsc#1192214); - Update to 4.15.1 * vfs_shadow_copy2: core dump in make_relative_path; (bso#14682); * Log clutter from filename_convert_internal; (bso#14685); * MacOSX compilation fixes; (bso#14862); * rodc_rwdc test flaps; (bso#14868); * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal; (bso#14642); * Python ldb.msg_diff() memory handling failure; (bso#14836); * "in" operator on ldb.Message is case sensitive; (bso#14845); * Release LDB 2.4.1 for Samba 4.15.1; (bso#14848); * samldb_krbtgtnumber_available() looks for incorrect string; (bso#14854); * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED; (bso#14871); * Allow special chars like "@" in samAccountName when generating the salt; (bso#14874); * Correctly ignore comments in CTDB public addresses file; (bso#14826); * Fix transit path validation; (bso#12998); * Fix that child winbindd logs to log.winbindd instead of log.wb-; (bso#14852); * SMB3 cancel requests should only include the MID together with AsyncID when AES-128-GMAC is used; (bso#14855); * Prepare to operate with MIT krb5 >= 1.20; (bso#14870); * Heimdal prefers RC4 over AES for machine accounts; (bso#14864);- Enable samba-tool without ad dc.- Adjust spec to use pam macros; (bsc#1191046).- Adjust spec for size * allow some Recommends instead Requires to be configured for cifs-utils, samba-libs-python3 & samba-gpupdate; (bsc#1182847). * remove fam, undocumented and unneeded.- Add missing build dependency on bison when building with the embedded Heimdal Kerberos- Update to 4.15.0 * Removed SMB development dialects SMB2_22, SMB2_24 and SMB3_10 * VFS layer modernized. * Add the ability to set allow/deny lists for zone transfer clients in Bind DLZ plugin * Server multi-channel support no longer experimental * Improved command line user experience, unifying the options in different commands * Winbindd no longer scans trusted domains on startup and will use enterprise principals by default. * The net utility is now able to support the offline domain join feature * New options for 'samba-tool dns zoneoptions' for aging control and to mark old records as static or dynamic * DNS tombstones are now deleted as appropriate and use a consistent timestamp format * The 'samba-tool dns update' command validates and rejects now malformed IPv4 and IPv6 addresses * The 'samba-tool domain backup' command correctly takes out locks against concurrent modification during backup when using the LMDB backend * TruACL support has been removed * NIS support has been removed- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/bin/sh/bin/sh/bin/shsamba-gplv3-winbindh04-armsrv1 1703082665 4.15.13+git.710.7032820fcd-150400.3.34.24.15.13+git.710.7032820fcd-150400.3.34.24.15.13+git.710.7032820fcd-150400.3.34.24.15.13+git.710.7032820fcd samba-winbindpam_winbind.conf55-samba-winbindd55-samba-winbinddsamba-winbinddntlm_authwbinfowinbind.servicercwinbindwinbinddsysconfig.samba-winbindntlm_auth.1.gzwbinfo.1.gzwinbindd.8.gzwinbind.xmlkrb5rcachewinbindd_privileged/etc/logrotate.d//etc/security//etc/sysconfig/network/if-down.d//etc/sysconfig/network/if-up.d//etc/sysconfig/network/scripts//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/fillup-templates//usr/share/man/man1//usr/share/man/man8//usr/share/omc/svcinfo.d//var/cache//var/lib/samba/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:31907/SUSE_SLE-15-SP4_Update/625f171e9af34d04e78337ab8ddad37d-samba.SUSE_SLE-15-SP4_Updatecpioxz5aarch64-suse-linux ASCII textemptyBourne-Again shell script, ASCII text executableELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=80c528fabdf33dbb45472807dab86b9aa9a21bd6, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=22f6642b54c28f1d7bcb0d5521aa91faae3ba073, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=5e26e52463922cd6a218d24e237182494ec8e975, for GNU/Linux 3.7.0, strippedUTF-8 Unicode texttroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)XML 1.0 document, ASCII textdirectory3O2RR RR2R5RoRSRkRWRRRReR.R}R0RqR]R_RYRRyR[RRRiRnRR/R4RVRjRdR\RpR|RhRRXR^RRZRR-RRxR1R~RRRR R RRSRR.RURWRRiRyRRRRR[RRRhRRRVR-RZRxRRRTRR R,R R;R RmRSRERRsRaRQRWR"R0RRoRAR=R.RYR3R2RR{R_RR}RR*R?RGR]RwRRRRRRRRyRkR[RR(R$ROR&RR9RRCRRReRuRMRLRKRqRIR5R RURcRgRiR7RJR RRR#RRbRPRVRdRDRRnRR:R\RtRBR'R)R|R6R%RhR^RNRFR>R+f0G{<ںՅí[` FC#N>,_s3/`7k`S "C7P@hF+'ΑjZ:DV7yh?:B⥱HEkt&i 2BF^P` ym#Yԇlj:D\2o 'K j9pT_/$*Od/`x&m'ީ>M^щk,rL3ߺ ZMy$ 8hɖj4DgT Ut%}4D]VUhzx]UZS)ɧL3)S\P#cs WM 1Z;.LՋ#c/iU.: 8X0bjl~H#IBwCep3ϦpH5 ӥ.ad&{Q5 E7y1->69c:58ڂ&Ɇ@r}!͚b#9 c=Xaè'*zSg)z>T VRwn(%R1ET Mƭق6^dWma}wQʤvk/jK#Qݕ mc՗BnzHw/LG[xz/`7:[㎱s5mn&Q^d@ץ}b)$SliolNL>&;mwP4)`۔Mxdn:\I>3;(hjWEv&-ۆb3-eUU_9apEwe&}gPɉcWL˝Mשh_@{ 5܁ݶ%!dasFJyrYh }֍lI.Y/Aj:q| VQgN @í"웋h蹭hmgHB0CFV7Znf~Uo-b|i^ Q.C\'r+z.3G 5ƿH|h[Kn!@(/GbKp شlf<$9};> SiJҦDl]9l+ekxH[;C8*4Y+q*1T$_EZ%BAC>?ۋJp (P\'+D~~3u~<:s|A䩆76Im_XK@G?+p] kjn:&[è_1젃@KK =Տ2l-t]5qeJa[IRu?$Y1iPl:]k^n)蒮gWr:uxMШ( FiA4CMWMLnjm ]sPL/v}HX8۾s*yC&/wŞϲ9e*dAHLvƁ2 rKxq AQ;>m+Y`-UۍA0/?KVH\D&sփ>1*ɨ$Lasn5HE;a+]n|uvxgRM4'nCue{wc6>W#OEH.1cCo4[ ٖaȔA&C!!&6o!.PzeJMhvԔOjA {Q"yf}MJ/I.Q7 X1/2 Txoq>5=8aM~%M{9]4amdMkL/E Nbワ+8}k~5*f Pޤ> XQ0YK1o88LttR'RCQXlbN$:26hp}:Nم`KIsusSCn g]pƈi7 MQ$LJĤ7'6#p݅%9S"%^OwS^J]u\X~0={W"-4i@o`^(ph|k^؅^,_]J/Wdh3Wsy "3B8Mx^{ֳd$.3 ǪVf^.Q??cDlqt>!FzQq)M#=#= `+,!q|fYvfbnVnHɃn.,NRqCrzC3[H2 w=Bg][F̘&})ϫ)K$vX4Վptwh_ƺ^磏/H %8pj&*AccJ" C>X~#!fn_Ym%X\8>?\.0Pvb#58{SIgZ4'لtêr=Z4-V PeO6:(e)uvU-a5ዞ2\Cy',` y AΉ^u9'u/3alw1X@5߆owPfLK"'{}!+7݆UJO=뺜t!UU&m;C9sՌ\^Ymw'V/]I s̗XN=`jg+Ja k=M 5ُwA mŰ1["Ĭe N#mAiN494([w ŒQ?G06貈1  U WRvmZO-SӶL$B$x|ͦ~p'1=4>!?z8C H}uj+%3QDhpVoGP20MHW"[nQ?Y}bIw}>629ͤ2\V 76EJX-J!'C6μh_r\bbUV8E?h&CnYǝ(0_8!(43^Z8(|qrFjųLoaP5!A7ADpT bu Q]!5FJ.l<:!U K&=6~;&a^GK Y_{TrFc]*8'oʓIF(df]D Kشd4r6*.+鿵ӧcEwG@xf 0VD̻)mˇRiZX<8)<*btWųɞ̯SxSl:+.pKc㰂LPgjAx 5D듿WwL.|HWN_~ Sri(DŽZpc>B A"Ìz&A`=(uYFZWZQ& 5&B=RZǩGV l& iƒJ0:()-cϔ5MQ8aʌsQz5Qs|SO ;NDŽ:XT;,Djԃ[%܅萏98C6bεDGfTNv9$,@UGrPZ>hLKP}]ӓRM@ ᶌYx6!@&MAun23LIrX+,eHٶ94Dh HVH-<(EM) nGT(x=7lpFdTF#@<0qpybs{}CGBa_M0Ɯ# %EGlL?* iQCG=`$XVk Azb ul"mw?tUEw~u0!PKK 6Ɋ^Rq) aP$J]9la8#~&˵bdK$'a2eGE}uC0d24NEXx4 l2hI?g_Aecw:h:r6E)Ãmys`(:ĈF;Hi Ġ"<ӗ"d\"jJ-7ԗ*Hþ5xe]ąWFqmJ;F5@ &wڹ#Mc¢@,6ƪ%Ϸa%1' Ո sw,F%Jˢ@uG]O/WnS`o04K a%QSDifp(K* pXGa(]d\XU[;҃RwR/P%+stW6$c*Pq۠26p*ڙ|wKQy-6zR䒚Iց#־KgDqRDC)=wxߧN"qҗ|hud0:#b--Af-Dlޗ n y-9M i]:i>'OvQꛞ` k/Zqw:㷿"g.[sLW򔯇zs ])(|?ޏ.eQ:Vx%ʆ39%š4u=ϓo}mL  *`!5Ck)#B 8uilܰwSZWS~6챴@a+6?apυTڧ6W×qz?`!%K#D[?wX{4*lYVb5s %P$\ގl/|JKȂ_>gǚJpdBS[[GOX-w_ "TvV كafXoSdYC;]Ob5&[|P*wJXuNbKdm${&${7X^LI =4J)k_o˯2w%o}G`dbC(]ZJm&?ͱs4ȇ zdYm١z'rEȴGWFx+swV5LȜ8e_1o/ga8 FzK h#?a>"Wٯ]K)h<^N·7o2:J}$INkM[&ʁȥA/) &JmDl(JSbk"<&. kv%4>{:"dz»@8IkX" B$Άb23wURZ9LGέځae *S ZZOcIG?(XP|XVd9 h_Lv6ŦAuZ[jÉY+Hа",xd )jdցY䧒_I18TaLZ^5IGW9vlVYXֺe# pSJ"7u{~_qپ fTh7߽[>AU?&~Wj4V)EҏRju&4Vwv{2%M4%hԅIR=OVaخC(p6\ isv@YY/qcEvG;j7WlMl4ǰcŨy[@P%үD:yϛ*i(`^-ը) 0 0-9['3깓D{ܘ=E{kpwģVvlo JI՛H,.j!GV=Q-9`y<=7=sh覇źZ(:prqB؍NP毑,5l5:yKY\ cO H{Dm6Jm'T^#%ͭ:$]_9MEl߰'W8y^tAy vb_{cf1(Is|,]y4!>J}κxN+78'% }vq6sr@ ]K; .7N2-Gr+`V\6^ܧ3oXzv_fчd6G:Pi]E22&|5+nX=>IZPP0%pRVe?m'T(ޛa쌑5@0yGS2ߤ ShD;B>A6*#e^k)՚ rs]7[fgs8O,K1Uw'ty(~b3:e-vaN$2,R\xGYlS-ӈJ䛨KM T{T'guU4yiT3Y7=E,0q.Nw|&b[Ǎu7mniAp݀wuFֆX@1θd JzI ;{`0Ƙ뵗hR6a#|JaEfsoʽnT 8lQo/4\AJ #b=V#f .(\"LPtMDl/n>d~}]V _hkc[ ƪΙ=(=?cG]$!9i\6R2|:BʧYY{}ni/JVQ$]G}BDkFMYlƨBiΞ*)lʈ>0\d"<(*nRqNdI_8!Wgk0$7f`34wkɣVp;(T'1xslW8xmٽo#rr=TȨL=EƸCM+د3ذYB0^[~$r<^]p}{ Je&Uՙp{" 󩮔o?2ՇàkԐ$ 2w|34ccТE!1C1c~#9dvg!AX*4@QOieu0fO4Y=o< u 3=`Q0C;&Sњ5j(ruԇdTImWy D ,Q2UGDٚnAb{$C/T":뗐6KuzbߟGU|Jg۵Xr!̞R̹|"0d"> *z3D&N5~9uQZUPà-]VtdW mwyD"ĦvMip :Ԟt6 ?xű@ rw1ſIx}>ˇl cQ-\i:#o`Ss!h3:(VW3f]r 0ŀ$4(gvO?L K7d@_̛TWJ45)}-@|"ן8ܜ!඼dO纐MQWۓ̄$`}KKP3zw${ )%V)   o)@  S NrQq<:m8;^QptU+,">6,=WLp;q&5hXjmזٕu0{REe5ީ,G҄0@]tO>(E'͟~9w\)% @:T<<杌 : Kj$v V6O uەeuZ݀8A_n}<@akYjIG8 5:e0$Z٨ qJ!eJ}&$HouIRr}\}U?fRQ.rv7/w3.xB$"]kULMs}J7evpm.YC8`16,L#[I3u붮[u?xly=*Cy(1zU Nyf<.V]?€BiL#zEp`"ހ$L uVorU-8 v:%f{v"jkG_vQ+3|zrTbJϡGF|Üdұt6{ G>Z,,rw,`QεXhz1 󱠯FkΩl`%"KXib{%UN ףm5ctIm: :>xnݚ?/|d=km>wyBն7wm5<b-mBxfLtTwE|LΗόYRCP`{e]:32ɯ'PX#w^,hV'AP淓#?ֻr¹醴x@QŬsk}gt=Ki| li9 bI)EoJR<DlCk69;BZy0c$rv|&9,ĭ9lMYBAé̽',P`\rO Ϫ%ՠ̐{{>?)}n$FGA 1t)h-lY,440ҏzqscUTȪQAQ̖I)QA>M] V PI :<;G9iOCxxP*>k' $DAy-jOy8嶸 lEَe3@!_JL?J?s>fogod8CQ.Id LA7{KKġMzL= 5}Aˈ8^ pl+.Ps4*D_/Ȱi'  YhX腜)"ĥ=~P(⿓mz$keȉ݌llH+#xqӐY-Mճn70˾b.:׎gEIϾ/ӕ=F"0^+i2,?szq7"st)RVpU-slcz;Iqpm] *21avkEnEqKO/8Xe/f!p,yH&rEYmHhG>H,ůh2-iOAK@1=s@>Q|q'[T]Ag]k2#naBja9NOfǍqZGG)wGG,C3V8z&>qC/g5{J>qi".q ʯS/ܼzLO=\b G~srlm-p#fUZrJuCDkG1( (9.3+y&f= ^M h_pLy:7^j*A/j2Z& eA}"aCڊq: {;a&_-5g gO0ÃgGP2ɤ2Yj ӵjZWe[(W$ z;^y"P#`NZo8@\nyu1{!</A'$wYΡl(m\V}3HT"g A#ŷ:q&_!6-I='HʿC7R{'s|trx'$>G ]T_X q2eXMw!P|ZH,0ڋ~. oy N!*.bK A©wu+#qL9 ӦczQ1EHj><d *9OYIijI@ϱ8]Ogk4TzEH5ˎ3 lciP  D}❎09Ż̔dBE0EC+5lNT_unSGb(j?娧6Gu Eh?6s_? ]"l]׌2n'1!.Ug_3)%"~w( 9w[p Q:?!!Q)УM]>𴚩ʕRWU_t5>cq`u GCnh?ROjΫTL<; =3P+eYW= MDt #MLvT_3YPlYkȹZpN ߶>\Cψ7]̹-;;F%xG|e=FGGM/xm;J$8Tݑ cp9P $GEZ^28 ~ ;60m*M>zȽd? D ol6pUrX1eOe(K.OƂ.+6(2xC\3:9}܌D rJrU7\wRFfy㩷+lp.&5~y{ĮbzO5h @q$XL]7ѯJ3u#Mv~lr:_[?~3c UF˾iCpɷ|+yEX *-]C!+5))AvEFv m\OU5w 3GOd\d(bLWziNJD!A,.^ ~i[kG4%(J|᥄m;_tS--,||֝t{v1fp^e$U]t9oa X^ SS,ۥ=Xv44>exh-D xH*T7 q/O+Ì GbAĴEí}-4H .Ljݥ!l(="+ǷKC z*m#ӁvNOpk\_,|ϟo~mZa1QObp0jtLǃ'rW޹_:UA^ ~jυdp2ײ83㪜/顬p*5O'TPLQnMrЌd@3FxܶZ3~s"Q֢.ʟqcyf'F֊(̆8Vt$zu,t"teoרa5Xў+'/}ҭ;VT sK^"h$ByHG%' VZ$4R׋L[\;xA8.v g飌(^Ni!7NplQ0fyȶͿI[۝Z{^Nd0H&|*Mng?+rPmH#:1 cc v^ƙ$! "a:?kls1ZD3}6. pm;1l]xw逶TkdɂӚ/qZL'&:P56.ߒ=XR"Z?Ly|X$n n3{ /rwjO .L(sV|% bͦQy݊hu@Jv s\zAK /[+mh}klwi8c7#'HKcZ$I;_Fz~qD;~~,#q25^57QŎ[Mty׋Po- U+\qʶ5\q4\[Js,[ZLrPjAK5s 8TfC{awhIڥDԷ{=?\d9n#q=9BM{ N;[`8N%8v/߯82pmD {9\偈F]z/A*Xq\">lvئ-Y>3j~E&%&C=I2',V!Vj;MXu. X}ە3?*ʊ#T &8˖|plTFVHkYEG L5k[G`NkB0O:$#jՎv a;h /\PgKcLN뫹E8}y0}f/|ؤ.MQ@LWiwH~0rCti^~w:aGz_+qND`F M._M1fXjW Miʜ:lЪ6yiQYζQAy @+$d'Nav RWWbW3lRL9F· UM,B>NCyS4_ 4\j=w5ݪ5z]x<UAe:T kh,/MK$.&N/I:%Ra|~ޑӋSv~UUx$@K(V<1719D^^q'c *4جT;%b<?v'ܪX&;yjyn>.9d2BИ7%"}Ak D-<%[<3Y^}/Nn9u(N7XzE`n`q5nn%xO$Taag Ag@!^?&Z/0p I·\(SՑl4ϛHwYS?΁@6Q@X/̺j\xZ m%WgyDNՑWL3њk0qXW#j YXb& ȹG~&5o{$h.ZO ܟOz ^򄐅|ںVXp8[X:NH-/;kдPo#v҃Bگ@'0zm_:KA2]Wa'_fyg,|4h1C5Y$F0!Ѿou(.xL麴՝(cz0Vx|HxLIhS&6EG5\ƧLtDZcUMҼτ;nG4{|,Ɣ_0]Y_j%=vW?{sz1MLIX>ظ)aiadۿs⋃S1`x/lsavMĤg>>(BЎ70qhY+փ2ljk?c}\{WvI*wΗST& $?{(LE*?~42QPonҢ 偬xY>/ Fyl7&u:d*̃[nsp.X;눉ʊ0[W<~=":,bȶM?h) A˽ۥWfŝ.Yqf5h.ߢ12X͸ĬF@vz\(ؾw}i21K 'LW@4rF?{ ."=-Ml,d濡?9] W`:n$n)NO~ \=SQX}',>ihUw,MAhKFl(-)92;]4 Tf#HL1Ol#t^ sS+L*8'J*7@?`)GM15ŗ+C~A |i-EzT;7ǻ_EBɜ"W/[ΨERmgh4c.8A-[;o AT 0l|:Ac%: ccoSBEIL=  `4_:raY ^d10 Zjh{, y)7l NF6{rokfY :\&UGrmVM5iK\ FaZmx|.ܿ2b%Gڵ&ai92mg?N q3جWW~1WPױ!ձBG1?OmTnIK a!Mn̟!7QJ!xExB]$ 7%.5T^-Xw;w c 쫤J"M. fEAXn>m0?a Ԕ"Ԍ]i [O`45  y,,$X+hG` W[:g H+ɼD  SaXrS&,o+E|sQ&t[?ےAAJ9q8kJ~jοm7<]٪ӹұCڊ(Iz)<RoʌXEjZԹ.@n.I.f`6e pc쫵0b;|n 4@T4g ))N4iE"&o T4uw7wpoUx9' U =zov q)VU՘)D7ד>Nm b1۟~N:F%)E''t^Lb%9L?Mf]fM`[j}aᩳn\,Ӗ9ahCR] yX#vZ燲Og u6jΔ|56q^ SVᵦ7DJKM6μja^Մx!NR6u3 ke6L-X2Hiݳ '7hDQw߳;e -Pt {M JL5+^jI]rbP^/ZlzVU*& ,s@XGCJ'Do&PEEKTyaй0ͳ)ܾg!^#a{0bb1=7V7"6.fʹᡮ1-y5V즵[Bɩ42me^do7X/?w|ؑ&G#AcLXO&Aksʖo ŎA~ o\h`ZLc IqL VoxQ&pjWS[Y^6KD?-K;.' juf'B]3Ŝ95naChV!ѱ}Y(<;:qě:Pۛ_B:SA;c?,0_ T%̝T0Ώ7Cd]F>]5{+"{CJSgC9AɤޛGOܢ'JD'+J~wͦY|ebB> Pa0Щ 'PWӯ|U3FlbG8.u guX|юlnڪivn[S*,:8qTdޮ/~W8o9M6~,3DϠ2M? +<~J`KE7?g_޾z{u&xIІ}i" ͉ #3l4v6jibY㲡MuҬ2D%% )bJa^J?ެ .Y!3(J ZC(nYx¨ Q} o͖u;%i}&jl͉(pmp]lPSE\H(`$_1ey. XI]_t;Xvf(R<Jlq.m{EwlxCSn/hah`榆6A4#?" O V^{Fo;|vLoj9e~t pfӏ^3a%+su@GơTdǯoWϿ,fY*ܔ@E%4{ 㱉"UhLlpQxd1BxLR/2H悲rkϭ+&H3@VnM"jwO+=4sӥAeO 8*/6A vr ЪNPVuЛީksnF q-E(K=Z.$rCپ_9k019-~rSD(-G`j&e6K1gȾdžd\Jsxch;P7fSTn/d,ÿfP ׻%;sc5\ҀYtl-lz_!¼5; `Sr"Y}蔞/h0%ad^A;EAS,z4ORyԴmb|BiN@eg߉v3{'N. >*P+ F#4(kQ#~iW8uVe$$Bch%%r1M- 7{(t.#Ŗ[w6NmFzh_ѽFhbw/%r[K($cH]dga GQGG,"䵼Zi=ލʻIv $h ^Kh6CnYR(2*؆p"݁mgI\sէN4=z"}H.3f@<n}T% #mXQ@,J8CnC38;;{FIY8atOջQNOGYEڽ|;e+ҩu#+UF**g,5Q\JE`C#exY9Xf ej:RʀXzDW`y%9Jه2Q[Rw5[Le%hPck](6{NJf3 f{/m#:OJ6xf9DdKv,Qj:XJR^/@9*7Y^^O^.NI^agbhGsF-I@4o4j"F*{نWPQL[ƺޒ-wXDhg0c Dn sY;Z:qK562^<-uz,pHTÛTMRM_4kb*&lj1ށk! R')?#X$?'U<>瀻; v2+Rfnu}_ͼy#:b&I`#Jb^?>|Ü_^_Yvsq!U @{C@댧b`-b+dT~ օ)5tۘ HHj{d/)SI.jS} mȇR]L+ ס7o8_gyb ʨ86-C}ӤF-5{0oYBE*6 k4%Y<6d݆RJ@uKrUo@Dv`Ub[1l7ȝ>V|༡-im7n"@UCVVp<'|G~l!CmE \2E 7/elvҨ <9\_y϶ܥ<]rfBC7+5y{{I`s/0ͥ>M;cҾPͳR ozGA[!ûb&m1>jFgA*i%|ma:sYY0w%K;:JSo}(Wbܲ %\XJZ>SӇ=f3]KP5hTf>e'}|YW綾/гT]s~lR|lf8u"y/*ط bvznI$$y6?U[Rέ R1YW/׳[` 6`q**`1][֑76 wܵ;!Bw!Z;؜Jlwx#8j)"2f0:>3S w9ߠ,10 ֈ>zE& Ft3Yvz͡y0cY0|53Bjb #6q(Wn?Y̴7d㺍f DN"NNϺp0#mK})}nX/yG Se_%idm4+b?@ ]BӁ6id+%-^TM*i8K#^ry&rsŠ/bTd tmS;q~ʬMHK}MkM;&ԇlF}qX\~C/5]-0 Cn82oe+; MTc 4kLOie ބ4( HY?+9R%7/t#ޮY*mwVt /-#NQv-b ":sULQjw5o'bx_N֖ G@s'g5YfrȻ­f%,Kkь &jd.x'I8Χ,ld[<ɹBMb#LJo\ayإ*\P3/ 0@IE0L9? ڞK&8 QN/w\‰"*ԛz S54Pz*ͭ/i/v¨I]J+" P LD8&ھy pD呥Rrs\lNi;'hݑJiMzM&7݁OS==j P=!dU UwDf e31[0"Җ_F7HI@ Yxr5<toI@_}gBV= 6a0lh9p1P;mJ !MqTT=*=48wmq@m"ϏlK:Cm6I)&)dC\OISaPݑoۈ43c!,ȥ7Q:aJWo`<ZhHE^zOG';0 \ Km4۲cݥ+Ugs(IzԵ |hM-%ZK Ge LiE.2Q>.]%ؾ?vK܎:nm(2^(A&"y?>A 8QUgf^bAC̔3xC_&kkwV!G+~3cU?m۪T06̇LJG"LpKpGٗsm7֗I鬥-wUnEj?_ GC`@c|E!Gۜݘra;̝re*te +TE`ƒ}6JI[LgJ-+㉨;i $;9 :/ H|e*!ףW"ڞQ#|+WSz6 Vvu\M~M9ѫ|q6om;\A&#>&cT9ĵL҅/_"|F m8(p*#{U>އ1*7_,(P\h:[AWł͊h#xrnr^]B y_yC8.ΰ>ҥp"?t6|b`˕0}0ŘzqR>1H%-P<+lmlz,}L jSͅf[32/ po//o[z씠>6$o[nEa=tYg׎2bHxuA9sWec7FؤmnBk~D5.xW1{׭qs zxy.+%C|At\ V R (DnHR5TT l _"{~Oƒ\AIR)bg=$ٌLuP E@wGYLJm,Иh0.7 52u40u`)*E%2 }$`]&<,?-fN/(Ưָ)t~IɉPb0LN-ߧP9x}cTp"G\pOuФb E\! 3u=Bof=6A4B((Gt[KB8P>(M|ula"-=*IkpMch84nV'S'qH@U@SrSG2&c|Ddm 8HPh$\U0Rw놵Ҁ&Z'Wmqq@dzw+IQawy;>c X}2nv;d6hu%3 xs]GF"\ח^S*7?6mo"'q 8&=O9/Ћ9󅄤 SPtl%S8⿕Is`Yak&mP0ј3ЅON̽ܧ8l%2rv$.QcCƩ\4֥= 3#*5yHF:G!we`Zd8L14Ok;};q]/IL^ԩHΤT@!Td3 $x~pAs5NhY2B ?paf|j (WLNϭ ^M1[rx k S`څ&]DZ1xS|EwNjY^iaǰ؜2Ts'q"QQDe#lWY0Yz|zKv9P}wavibJu3II:s-17qſKйp1 SLEy̏ԥ}tPh_G>]4!A۴w^VBtߥC}nʨ L4X ;Ş>o-,̈́=l^bKZ@JUn@OHxYX0((%nO:nT&S y6sVc>"yN^ S<Ϸߚ:/R'Ϋ]ݣmOH0TF8B99{ZN0X8]DD9_>gKaK[$@CR'ͧ*R~}a`u6d@%UVJ*(RK RԽB',`ͭc՗w;AL{|O9d[ /\ c&biH9um)//7׀Y1!c1y JQS`awD`~ArβԪM1u#&##Fd_Duө`\Cq,$hɅ UP 9U48_85;I(G­vW 2хgx7QBG|ߏoSՂn=eR4~Vj;N؟h WT6LYa69nL sE: !q ▌SX5PB"*y`x1εlyCzi}3Hwמ˄!,'|O;])^; :3) վjq$hwUdTweZ_`8"w|r^?Z8 zjvg-<,AGsOS)$+EXiv n999uH U7ukubHjsK끢Nnm1kݨhv+asv92u輌 !#Y#lO>Xe߰Atw`?>WD c$Ë˄~نP'z9nvqX@XʏEf:?iáoV%ڦޙ ɮƋ0[/V+,m.xPPIf` A$a@~֎Klw̻Z}g{7k'ug]1_kZNkK:&.0+'&x&һ'g``PƢgC?atް, j{RfX)p'89Բ"d'Oji۶ CZĶ".Tc| +䣮-`= bg*ƕ!.2Cgf/+=s?Z؝ f&Vv_hU5ڗ8# Tf{B{=yۖ4\3фeC*ˆc'd?OM'3moj j-e,JeUo-$/^3{ᖥe6<"”k}Rڣ~CtQz8Dž{g Rx\;ucOTS.][̞OHĐXp LޢvVr4I}#$xʺ?,6eps4 -e2 _emde2ֆ,J(:yc4nj^lP_\*F ҈J 75H۔B}#3 *?4}.NQ*ZLA4eWZsXFܡȮ}S1_TJ<~\ZbP&m .+K|H.4()ijΏ#}P @O.DSy2%)jᴴ* Fc5pÏsͧYF^GOöS2YAѺλdm>e(Ab[xyw7/sm. 4n2Vtʖ\M&!8@0 GY:h:/(Pag,ʼn0v'78*'uZi'>ΚC}e%J- kWP9}Fkzԑqb!If̻rP:sP\KBVWaQFKin[9v4 a7ÐF4Au2mGU:PpC]8 mH`ƒ9/ivLY oD#g㲻TG_gG_òq"DiXˢg8(bhډ7u F9'cT[ȖƬk's2*t960eZj7}~^\[~" i2a K<)ݜ[dR ݑeͰUs#e6Co#2M㽘B#lY~njJuK.sM-" hX@ef1kت2E>Ε #28p`G3~y&鞌9% P"sFg&t3rPQKZPD%}P5 &pq Pi yH`U38tyiDe>CK.:qaWh9x1ivu3+{ׄRgxJgX @+t/Զ.v8ٙ`g^ə7F@`j#׳ $0T0힨bj=e|dV[ |mr|/촐L7*քXm]`^*Q˂=o`KyMnmd w[$ otPo8z‘wH  ϶XjEUǮh}U úgJ\ xj4y"JäU!y+kRn ERoAX.l#Ax9#}3kĤ7u ~qFTKˍ$( E“a<Zԇ18HʕV6m`*c'AGڂ!RrYH2.g&/e<+dY+;7ϤϲKݖ/+K|jH?ٝjR{~R;H=gML|]>,0>!8S8R A?-ki"0/zJ\;]G q#; ZN˵XX`o% ΋ct%R 2^O`.zi%js}Q k2ZD@c"i/_ y*ֳʧ]=Tn%q7u!j0ϒ?vb4嬎 .FԾX.[띏"'+פY/d g,N5ѧvwhWWpJz cNPW*Ǧ@Xr[9_zh!FǨx'胕T:sGO H!qz8bSi:| #;%tGpAVBvEW)>)d'̟зКڧS8l=/xKګO[Z:@!IG`X!$ighlqk4ɔN͉Cc:~=mgm3fgh% ECP lyyPwzW)(iILmO:NP62XV7BA(XG"3·6PLۏca˙{xr4Oq:-lEvUF $ޭ#IjAWx H[(U/M+; H1n;Xdu 7>CԊXD0үdv\| 9wZAͪTMↅsǞصe_+vood ڇ~LJ5b廕s em.IGhR9N֏ tჽr%أ:F)y"k緆oTpap3VPm}6uAt7!qQ/8X樶{5Ю$ɐoEO{]'F=jZ4LWK bg$ rT\ g4|f &eުhyY̘=Zz\$2|%44G3uV)ؔ!3=' p4,?:nGDb_s-$\= Im2SK㫚sb4WmQhsH蘼b<*d=!m"f7AT& Mk٬acVnLOnt?c)oo`zdcV~]#Mu^OHzl+LH]~TeR~H,+ULkz4Ç C1G)pr]BO3ep0s",Yy!F8?hZAp>=2w!<۩(p8:̗92+ȷeĔ#o"5YAAӋ\RF 痌c O5Sy4hLa.sag FQȑb5O0D(v>A6pna^e9*jtLO#iW5bf뱽vv LQT,/YaRY$ )uft+冽O(JRU@/gdPH񤕊f4|u^(D8=+ꊤXBHoڟ'UK 4l2F:KۀI'pq&]}5[{26N#.=j9؃xRE\9 e bt@qT^p88"4<#NUlHCe?;pPW9n6?uHWLja^8m`!`N6YQ>e ALr+a/0=<`]"a.%.94g ;w':P'1Q|6^5~ǹה3pVTZBu~sT =ъ#OK3m8H+V6,l޸rl fszCq1mRׂ2\0QM )d$ `}*bfi*l=0I%m|?Q|P>cI &6;vwC{ =ocڈXʛEZqhQyx-Ϟ^n}P 8uoM9c*6닇axkIt]sȞ2K#|R[$d++=3379 8aAUP !`ǦCl8-b7h#ȣlaqDP!Nm}Em)9cH8H bFH[K[#JF$_ Rj3L=?a?$S"b= !Ot1`3B΂~Αr|B_&D/At?5;:B6pw>+FrsErAH-v艐<&|akN$(\&KSHZ. Yu:PD;4s;}~0&UAAgV0<*jլFh+iG‡q֡8-4#/Q1D2}Lr;wz2n}eCRyOu T}M5 {S#֩v?x<[\*%5B r9[֫lwǐTۏ[tW %U~ 4:Q]!m*# & DKcucr Wv$E$ly @SXdXf_tESq~=4vv$jɒq,Z7XTז:"v:i>wG;Ȭu;&0Ä(Ҫ+yb`-P-_cH*yȚڛV>',2İ&1Hj .d]h- ѪH,'S|ܥ A*1*n6 Dq9+*H?HR\ lZw^4St F3A }:^-e: U_C3\,?$抳r;=of`xU}ϗk#\Bx CWlCHGY~IIu>Dd $*bed Ȍam=vHɖ.a2 `kjd=&GWpS&B.tۮcY nlxzRpv<&zmnHNIH̍n{~Nx%u$39X9 r:(k S[3ؐ܈ Ȑm vtޖk_`b)ߜ Ƽd." kp:܊us/x=O~~udD+A/T Z9CBYOڏ~n]:X2Y`+4Y5*kz; }f>,Kd4JTV4,덠s>BmP{iFESvW(#rO @axcekHZ*-iLO֯'>' (^%)GvKRan58JkW;I*SPu4ltR%jds3$/?C}-JoRҒY~=sѧ܈xD MH*h{xR@W\}?:Q-%򹋵Ɗ=z퍴dG|j?ףBS5",(3vypRJmHrd}!:@gwRJwg3/`Rk^ s_`tsD(*claY2pRт8?ٸe,Q= H34 SfJ D1(:}_yj/W4D5osL ī %ͮKJ Qo;<򉂍PĵrpJ?>tF'Q^8hh<ϥ(?ZQVr@/!. .qyRuaY,a1KQl:4 C,~ǵ`nƳ1y_#d8qlEux*7yWJ;dog!7ߘJ}D`oG`Kmm{ &aS͖lq?&*4s/w5"7@03mVDa%\TAb$CnxZM cM/m='\cxKaTsj H~)Fo F/9er{Ȣ*eiv_pG޺D@츏C}}V{G)"y}C=^`fC4_-,0R _6O!/8{0svi.U.~t9`G, tfƓlPOWNTEY>`Lhh uMmIג #3Tr!/,$}]PW M\vL "kכUxrz` S&gdzl+.JlN2a;b`qud. !Jq>Z<h5XyWWUk\ѣK/aVI#F)`',س,y;oqbms1$zPTap >K ?_M1S0?[+fO/9WՊ?z9cw @+Ẽo`'YP8r *ft@_kvb+[U3~붩6aɹ!\h[`Nwbݢe<(Wiv;#+jBg]R$m0N.jv%]8q+8̾DW,eʍIƋ7N~ Y.tнQ`RB R^/J-~d 0C燶GR/KFt_NTA "3,0tvBNtPVbN-VsES y'4D%5`<@>l"dgA@rϊt+l;歡 &4-[j4H[ل#"&s5 ,g+3D JzI"ŴKl8T&rStP3k{6^4*E:ysfZs!mVu-CAY*q!jV1 m-3(V+5>R'wmPu4|'V4ff]qx'FNNXF{OLJZ @#6 ! 8="'Lɧofj4ij8*m];Z u,<~=nCL%Bg#!A04>%h>2BTI[.O)b~)ٸ QƘc8pmYz#_UZ?[e\ߊUT#PIoJxB9yo*d#ֆY0hL1Jh+t`ܯRh./!.{ ћ:[(K5b1vwjr6 `E\~v1zS⾚AD,<Pl"Nɖ*,Jl}yWZis\Xׂ̢kG缾h4θ I.?il>Jbw 2I 6~^ ^]sf;cRD"lr:YKy6c{&g 8*Ʊab594p4Ex18ꌨm:" F7u&`i^`piGP[c JSsns$'XJ>6UPt$::iTi`vȹ(Kyc ia'Qְ]#-؇D)N![;ix͗Gk "2_Cks>@MpmzP]zj;Ul<[ݯFNFyHΨC@%ւH|#x@H5E%g ]9LK9:\ˏωˮNoTM5ᖤXeEHOk8+8s\95pO. ܬFu?5v\?rb+PT tywr=yj}ӧvܶptHWJtDR%{m"s*5d`iG_lRYGv6e`!,~ƟRejF[sW*:Gc{B 6 uV ܅?mjcG #(&d୓A5ijnk_ N{TZ?pyͰ7wk6,hɝqi#r|qe?sqKC7RkeS\yuNazgGhs9 wzylX 0xJ p~!hBJ/.. 6}4_6i,JH)_HO2=X5F I$Id>k6!vr")h֗b!S畼mnJ-ǬIN#yM74Dqn4 + .ZmrrJ""2qwʳvSϻȟ^/Y@.R@ǿg[݊8iKwe]Mmz+S#¬3/E@ȓ[}I蓦|80vTAw7HԍM\!*KU0'rhXZ"h4#(T2wZ΀ll0bfQwfJ2P Eˠ{ۛ>`¦8!ke !) +nhmC6Sc{0Oԇk})&;-qnݎXWPMyGl="ɍ:G Vxx -+d,Y"I@8 :;=ڄc, kNjg>Fz-Znc-ɯRcPUD?Rh^Uu#TO>5`ԟ@k)e%hRwm lI+ѱ܅3T*\՝?:މ\/0q:7]_H3A R2琫:|P+x_PAF)1.5_ $Lz4ӌ|g)Msckq&KC_a)/ eMU~=^MXMQ^klpq%axi ^Qm`f+R b5E5`Lza6Po 9򇟈:a,WOĵH;_vֺ )sj&=zP! }u:'n5vvY_D!'eҊnP*F2G J\;W=rƹwnǢkټk$G؈=z\@],}A jK٩=)p#r Ky}-#NΊd3F]]t+XCJ(b.qɥlxIfiaNju[|.Q>B}DQ[=# f7ӣO&ٮάN/?T>*lxX~rz*eш<\F$/Ү+(8Xyzpj9,Ycd)9rܷwI|o74jۿd\uʚ)|Q/u(jšLwdpu}u тbH*4舣P$M9ZQzR6dngtu <tGLڍ.UkzYc^]d}# k/IcJB];jP _wRNHQέ64%*DHQFTtp96<"̲^=1͡eM˨Fi'@ RSQps̗+\c/ϸB 5XL-O=8{q\dz័3 /!<'S4XH>:E~qxdd w>_-E.#Y옥Q'j&eEp>ӤCb,ԘeN㗂Y8h !r򠄔B/[:9̇''VpX\%:P;(|ڗ2R7hI~cJagS씓YyN.SA_4]`?7<Eޠj>Y0%8\@E)޳oM]Zm$Svva g#U_^{14vQ}7< cg,ة'0>\Fsnqag>n3>UBfqI\;,6 TY \Qr];;n%xH 1ɍ#;#*e:WK 04fT7_1+}\eU?8le1˼=/l͚"&_#HW^KtYt٦wL}vЎ1v]@YI64 @>PkL(MoEm 1T /|8Y KKYRVC;Շ>KQ!#w^V'M6;3 u.ȣ|0Nkڽ,E{"@C5ENAbXu7ig{n/yL=<"f \MN j%X4yQځ[j5޶MՉ{_u(쌢ʮ%@̶{ Tzt-2m&qE`kzo_[rBzֆ)Cn;qW"$֡P9uz}2ӏtMŲg3[b0c goL2tc*sWo8gb8Gp/mxNbxUum[:a|Z*Z.1s-a-<8BfZ 8 [p=/,s&o BRtifR1ɗFi}E  w /Wo1X13GAY(sV ɇp-^U"|C325p2GS]( WO0}ҩ&47jr\eiEVG0N^:\^DxpxEI4VlR v%cc(h/C"|Nd ;me% ];] jݮhN^iQWYI^bUDMCĮb)Nf4 8ǸpjJIy,c{׽ Z e6ZB"MR&ͺ!oc̡兏տ )Ee&iBQYd*|;^`YB.Ʀy2#S"ިQWME͒' L֨wK~FzgCm__#ρZR2[wy4˕Qw:ŕ7+RohsM"VѬ[Cõ?7>cG6x7!sAY[85urU.|Dtm.}i5 } ka {*q xQC8r*ɭoUT  {DboL }*_I Ev 02G5Z5*9Du¾}#á]Q*m[ڇET(¨aEcN ra&RL-F` isq$dso^tpFKnMhPu-s*[ # j:yΠ_$iV,ͬ铺z @t[56߃r)db+{6DaHVsը1#%^PPKyu {A~ǷWCdघu؂fWp{~]G/҅#ƾ[K s{|;OSZY.xmt{Vh3Rh7L[瘿LDMtuݴ?av:XCw/<þ;<j;p;5CoF?aǡ֦`k"F%~KQrYL(y%z{|^y'^,fl@[GLB'@08oD hT]tnJ`%+mmo M^g V޶^ #`#3j&t'V'A$-  Y)@CIDU>e[r9iK#qkfRf}~ly\Щp kv݀aaU0n0<(1xȆ*"=EՖbd`sכD>>lxalvM:#Y؋lՈ# $Ї RП$1⻚6C))(dR܋? nrAä^P [H: \3:oMc8/mnv :}qvH X'OUJ3R:!_J[ Ȳ+2Ԋ*\[3Yőqb{>v_{_u:_]lFvd(д&l-9_4h)?f¶(^Zӭ|nrHrM*& xZcJk&F5/W` KDS_]gbZ@;y ;b/d.g(ߢLx䊣3LւU[O@Hdާ^FtS@"%9i%=M(Pxݠ]q:~tcVm(Cf\ ǀ2hg8%diPΖ?oW?S,ӆs>s߅:&Q3 d;72Qږh85+BNE.{Û/h5R2'V2'V#>6|-F[5^3@%EP>* Ozނ ,0tK&?r@X:|sKUz8QQ-6xg^3g;M(ǤP#+˦1 T̀h&dD%=l+\k=MJAťEIݲbHpͪE3RG~ /̞-!~.d'9 A姈pa]s`mȅq ~o~4E0Ύ )[/`Hh5I1eE>V=ǘ׵|^s%:9pEd.N3uv/ "/F’MaI8{ CcEX |J{fhɂqaiwYd3AˌН7RnazG[\)5#XM̻f2 Q35^m +'8sT0(0G_R X=.VPŒE^f D g.%^Yo_G %9kSC(jJ"[pL#OIvȖ#ۮUvp `+/쵋h6Dhԃf^"r(D,~>x_zSl9 xsXƽb;./R+@nV%i.7˶|VV8Z^Ucr_ᇊ6;ìiO؉uUz^8Ka)41_[퐣`?IkݥD^xR׹@"S VU$ws ;cs1߁XVmm/ zvۨ]漢]m(VqIi\eݐ1@:1k eI1f 4F 0E!Woq AeUW~]Z$zLd^a]ڤ$Ín #Bu P0V ݪ͡ xFOL%إFWx?h^tmհ~ΜPgNg'OV#H'LS@gbY;L~f}oKqJ[$ݴ9isF`Li@"Te$ Pg\R#_cR| :{@Ga2֮nVԑg!5&|`dEI/CG0w:wJY?/ȶT8XbVu+OP8.K;(";HCM^6 ?͖G|VV"X̆Mƺ+Ɔ_vD6~=%пRe7qAG|ep: J'gUVVK|9Q#osd@bF^f`@Wʛ^  'PG|C5 -n0$RZz|3$7%aF,PgBe>}(T D'8+@X͹C2#:\zxȄ Kv栀Tf18l@7v.5o*w֪ )ժRnr싼CrE ^t:|bxg[ZMa~?)@榄A ^᳣50ϋg%xZXYo8'h22MFO7vB+S@{{ERf' 5ߣE!xZ7 b 6uГ=-Q,6i4j#(JoXVQwB@ckKMzBX742IIMG6^4 R%vN*(̮B 3U qlm[Gf%!bE$9x}|{`hEv5k\|tPا#53q+n'gAe5oe1'ƅ \KlO.{yrl_o. u_}g VKӴ5߱:""<ǟv>% C̟82`7r1EP{#^W&I)j4] ŠlB)( J9Qse`cDkPVӁ˛_5%i;s]3QOH&Fe\orcx`'6u o%-pd?j4Ԡ*|~WƉ}Fl͓ t-0&Ϥ'6^Đv]dXdY(޼1L|\/*$jB!,`ŀ] pGJsMw8JږeJ 9J87|n-W"lSn%:yhQ~ЩWUDѵ?O5|;PhgVȌ_7+pQ!\P w 3g=S+-nz;aO&U:.og{*bd?V&Chrۥ}Q h00ΈS!e%0ɐ5*S ōG? P" ٣Y ss#$H1rXNs~P,^s2|0)6BHX:A$A ;w'qJ_r:LLkh;8Ղ=uWCI`<;OHtcٰ#r-J(rUb#Rd|e%ckKarY[$kNf޶fzk$N\RJ|؃Zb xM+0N= Řh3{|Ykixr^_$FF?G?T*D+[5():@)ܺs&券j?p3?gԁ|M x Jֹ1uX\ʹ=&+jG愳JejDe@n|=OI / Kr,GKzxa} bPCoJA`IlSrga 9Q|^ y)i߰f'A3U=:#S@$_@apbs2鏎};Ǝ'kB":2y2f SM*fP w'E/]`p9zOm'UiؙT^Dz`Kz3JMI mfH#Ҽ,E\Xq>K6,y#"L!a⩹悊1^2L8O8WAIi&x$Ow;(bj/I}3KJQ4&ػV{ŏQdsĠQ6RW-<x_vFi@)MLeT2jeh#-LӑVhsZtN@Gؠc\>u ;uz&=2_c%`XLEE=y&4bNޮ>O^#pxYrkPԟ1]*Kxh0@@IÈ֢EI05eeQZ5(;Zf|XtU/?Mi#Ř35zEfڏr., Ӻ|7}}sewW՜CD|p*ux50|k٠ǁ<+:+p 7ֳ r;W0FfjMZ  q2aT^bD:=MvKVZCzquY_U(ٴʿu~'FMplhʾҮ[0O[(B~I4 zBN9kI 7Dr_ x[q0W.5Z]p D̲뤏ZCPmdXI/'ş}x,+Ĩ{ 1eW="mw(j"f{ V/O;}̼B{@ሑنQ5jeI̴CeEWf[\E̕y`yp8|R = ?PFE񴕧3לh ŘV  :cŮk}djA}漞hPL+e`VC 3AF؛"tBCҤc"Sq {K ۦɉ4ׁڋ(ɞNJu]S|-|Z}Aj qLtugNW(9-67 vI?8d?^&J%J|o౮E> Ek4C* (IEt硪)pq4TCW:K@镑X: "`/M]DRфQ[  !z0H{X=&zW{A#'y9S8Ȋk7hF. mKBI5$W{ ۷?;d?cY'ByhWl} QE!U/]}/g'gkB#>(XA^3+ozbo#zQT9eM7S>X2iׂoQ C?B˗%SvlAamMP[H0̓:k~o/T\.SmJYb@u>{hvUiZ\gSG9F}TU"h{]0tW@cf8yW72T#AE`eN5YrVZAqÕA+;mKݢW Z#1 "A֌FUkφzqM~] usqIoTaPT LG:hu"iXF]mf\M~4Xgs G:]aP}4N!(PJPuYWH*[$q ljoNKSakz`W`|#,;B LǪLQkˎqKϹ0xۍXKp+:uKev4#ۚ(*AiyLFVQXls%X#'vYi/|$ B w h$Gkة.٬P&reYI"=&V<Ǚɥ0W2AҲJ=nP]z/1c8xYl5 Y9&4*q! RMvyW'y?vզmn^`"8Zʔqi (MHDR'ˊDj:ajˢܿ u;"}g9 Qpi Þ} >OP\϶/Y3GS˹hi^X]zXZ()c͛dTE""q.v釡@ r1\lV)$& z:N-a"_MwVcH ᵎ|FvZ^)s&q=hI/#F|/96@8WYH0[kx%ݺ,gFmLfL{KS'|G;zZz.VpWod24Qheش-"nv g-5j18 S@倸\ |#9AZ 󯾱q䶁j};M–\y9d[H-0.kH sl-U)Ce"XOV3_`tYDEa7;!K+0.׬ߎXQ[U,dbFMXࢻ vVNXfaxB-džМ4jfMx^ezg)rN;V|]DX(EC3f֧{(<]i ԝ͆m@NI-zBmm'[k'@òӕ2jܞ2> .9pb5-D7Dl4z?kmݹu'ټtᕢjzu%g (7,S:5NHyd/{z)0%KsN/]kI `k#Krs#vs_K "Lؚ}p>WX}W0lU|rPI_S_>} hrr2EGF=bsxWAsYNiKc]ɲQC\ S??+нދα2JogTH䓋\dYLyVBT;]֊1/ {b2'TvOֺ$qFQհ2؍";+$uɵi`HIcD}` bli_m1e{ہ[x_ 嵊v'wM!)e5U:vDP%ٟuD=t}85OjLTDB*Pü:zcDsiiؼr؎f*b@5*![/ ^[vWRTb*EyUG@GimB~0iPmS2hu]|:'IovĦقCwYW46Um [:FfTډOBj Fdo !^LpBA>mS9;-Aʼj|I'բ-`gdz_ >89+uhFͱ{Br󈃰(Z@QJb?2ځcvĵvE]%"bPU]ມ"9G>&MΟZq|F)xPO`.y(Jז0~=$C-oRˑ6Gb~rR3i:GwIauiܛRJNrMIvz]bK\Cwz$\E}o22$k;\E"O:9"Knwjc[ T (ɇ s2ZJSi.L{@*=A`.s}Osi Z4#ũKe:{[v)jZ^މ69lrpj(iZBnPjψ"dP:֮UG*;Vo0"11[ɡEO-tYQAo}v%&2M62w i#t\"\q;n$3-kkk٤Nڴ]5(H^Tz9?ΩÒD,g;fy [Ltτ"uB*?Ndv87,WE#>\P ͪmL!uI!F88LwWM?Oԇl ]uP6e2W};B DгOӰjLkC _c NE)ΊwiAGSR&C&^ +^k|~f D>[#,?4Ļxdt'n>%L~ֲ4gy:t17&igS2<bwح=À:UeC; vk-H nCq$@^٤beb<Ѷs]W ~pOP1~j\2Zv ۤMIOIhdi_`I$1M{|D/ĉkqضJ#.HUnb;@3#=WN% A`a+^CZX*x嚚{.p Vnx%8eiUGI+L9=D;mxG<[ٕ̣BBpED1<8s?, ʩjll%S:d3HɡTLaD%ìp63=:RDh;^MDI* C[{Gݭ-QC &v, lx3$}֭|Pj֌Y=&0V:W/4_bkKH=Yfv ( qcdo;XWpD>#g~|O{L7sԛ AiF߹`TzI7sRӇ@UgQଇ?epuNCBo/ 8jE:^_\٭9BA1?dl S[Ȣ'Ğ]K~.`a(5yꖐ1m:R2:=$1A2ȼ'.,L)2 p ^ĶlgR-w[kT}iZ8Z{¢M'Aui~[nhĺ#f` =G,b7r>-HwPWwt=`> zޚ}7DIy(lɒ{eX* $ݎٙziX`e *LsA) W8ۿPl熫*/* lqCX;0; 7k9oO"6n1=T`uBڣseR^$O:+-56nT̕a@++*Q3@͟lm]+xz5Ξ .=reRݒUSVc^|gR)77ςZW~fm˓$a[-gsk9_1Md>?#|첔@8 ՋZOC.84YH 5~^3}G <ԏ*]l"hf5y].N#҈9]e=r~7ȮHD1nroDq./ͳxJ!9f\3Zjj)rhs+,T?fFMrIO7 o8=Q`|,o.>Pwg;-s1ŏnv6xzjW KQ޹Qй`kT{ͱ(BL1fVz/Lt&ľGn !ZA_8cwZ$JϷGL{v,GI_9mȡ/{z;yƿV6;lDix~AfIIՉM_N/3}19%r17LyEi%b S3=O.QpQx[qo=pfYHao=ƺ.]ty?>&g~ {j[qⷣ*7T ȡ6N&4fk&_E7N%G-Pס僙Ї Sn0F>Z TzjBC-QUom|]?4YK͹9͛kS'׫krEͫ)m˛C]씜Q\Gns+Ɲ[hR>Bغ 5V2T[lIVLBIʨM|kww} x_1yԜF lƶvdA/WRؑ߅.` ii 7N#2b[E]]"BxKfGѦiS pV >F:u{lP&EUSdڢ=IFNK'J[%^?nRST"5ΩSsx-֠QƆ2aPq8D1W\-BIFݘt h@wlT@ZٳR\3Si1FTp w)mo4a"zE:HMQzv^<7SgYB,OJ>ͻ'\x]FǮCT5f.1 跑{>vRy("Js5V!;Z`Z$x89o4#*`g:;ݺ 5w ajahSH ǦX5UtikpQOnobB>gV|P;Eq{0Eu)ee5Y싋(ɂFLf͗y,Y,A+q~Yr3HOŻn$PqB2# U}|Le߂0Im7.=ި[C`Qn5-J{=12< }XAe-L☜F5tϙwWj)FEcn \"Gۏ*gk.=Ni K(2,LD.[Td)鏙5(XBMRg+^EZ=@q0p. ^Ng;~F!A"U"F+?t0؂]i+0DPZ/V-PSvȌ^$s(->-qۏ7nzY E@*ʿh͹%ٽ;bA[1L4CD|pk+(5(V\@w9IDcB=eZT JfYhm h&8!\⮆#U[mg Ǫ,:tMMF%^2f% ҞLRYJcspUN@܉WAA(F$s:i"NT9VcSӒOCqkSlC;TB q q?~7uӺAFj '"A0d]q e{-+5$Wg{S*fE=֩k@]Hl'vlD(3dnw-)[{ۧQ $|AUz Y0jR kGZP8 b# 䮡~"' uEg}NgY\B\ d|f* K'ŧ2ʽd 2۽3}V8 6s`;(Z}ZԠJ:гB+1CZ.!+?mg·}RaON-l:ȢY{SL9]9^nxjHC?K㲿eĉ9ꤹ19鲓.#|LAy bЬ=]3!ɓ>I`Zo:XR56s?ʃ;-sDe;0&fX}gEU›3u@2JIVe] >/G^XއKx]e-sFhwQKst K("陵qOY9῱Y:rөKNv;XNem}0e/q\uFS(]l:# xۡl"rgaG=m<F[S&i6[>IM \ 8K{Z d"BT2YI.uh D"Eu$Tj-WX^7'9 c(4QS!C Ou_0 Wplz$Kzl p.: [ig5hp*d(,Aq#\NIU װ|vÛNa|XN%kxك'%ՖTGes(,Dz H& ;Pbϑ[ܑ-QG!v0soKBUP'?TrUpKۻդהy6}G;?/ V3@L0ae0yc}1˲s"՝iORf] Kx)7Pv|V߬ {{{e7Բq̽;8>GH :vnioЊ^q3tLPרs1;+05ԼhgӀ^d%sl'Z:.8m`״*Nx\IX"rb7u8 f/,4n+G/"_2,vj_CL&2 "h>1V8B=(/6Wd=̥,?.\P{l"-#pRU[O#M4Sr.M{u<9MfNMCHl ӀDz6@$D®gS][>b jC;z_8zwe_p L<5IŀXw"5=Jn$9qG:}_p> qb^@a/4"@G2|w4(:-}9s<"1OAτ{`~/]9m}ye=޵M(!3@B0`Z^5zNBMiYKCݦ8mcL|T/r9b"4S7u[+rUs_4[c]yV#+f&zC,UljPtؒw;b,$XNa+)a*0w6twwgs4sj`MϧXḍ5^>Xx=?xw+M#8Grưv^=?ֹr(_zBƇ>onWJc%FwN]l//5/(_K*M0M%X vn^fDKJmpȧq%/#c$ؖQ d+ΠmY3hc GI?W]ZOПW(q;C]FʆȮ%S$@kU&6vK`Nû\W^Gqד$iLar%}Vw̟hX%fώa0Uf ߉K*s@,nWW'.t(*WFIa\0@wL|%^7Qqt{q1YY/=CBO(DH W aL i*!n5D; e*w^3ʽOSu-$n""=ӥZb<&@ nW_K0e_J桚H6`_94$ߣF1p$n@NG in6,R\[Kq3r_O83xgN#:)a?,TM^ıV r]O3+r8eg#oY:鈰5/u:1wf&XQbJWHp1'˨1 ٪#E,_c^>*Ԛ4x1l缫ikb3 Id b֧^R##pXE9@KI8ÐX%gum= 9gk$=~` MH1^(~_u(7Y]mCp$ 1CƙHmp1;>G hW!M*bQ!XI;Zޚ4܏omcʛ%tko6d"(:ڶd?V×Ll t }&w'o~'>N% ;Q puVH dys0Ms^lpZR<Nse șPU>dx IW4_|I cvB4n)'eSpßVpo_!dPSG 虺V*R$B"QQ!{kIVTvcrX DͤfwxC}?3AfZ0P7#:U ͷvh)ѣ=|5)NsxTE>g/\l'kuYS ָ|,YYCq=aAg0`LTu_f3r \홟jw\ևOh Ua@ A0LvW=YM^TJPI_7l{-0]0+4ʪQk'ߢP,yߤm蘅I?Gnh"d|Z"FZ{`Ǧq՝/߶ӭS5Fvn3]3}0\oԯJkpEQNCqUQc<30M$*fHyV#6!$1g2MGؒdHvFp q6'f sm:ǖ%srdZ(v}^=.^i7}}Jw`"*gZ h䶤Y!UR+*;mc]1)sR1"Ij$j:Ixݝ@TyU xmVS> کuk< {3xIp85FѓKqlQ?Z>P=!ϡ7Gvt(@P"-ݰtfFnϋ v{+AoaCzL\'* fFIT}6c;5>8r1B IʡGbF< GA"$y+,}D^٨r(K l̘)bR EMCfV @٣D`BJnh|=SGݹ[")9~(9%b>xX7JЀ,ِ p-Y2d'j /crw1ه.(N⪳{c*6xBZ? #AEDiKQDK,#:I :!wz&H3'& oA !Jw =DӰ6>d[/*E%M%ywG*aH>{WTvq-"(,k#MykIԑΉ?u)lE H^(&)Gk|*_Ʋ(PAeύ!cF{*W+{j[r05*l?ZRG|#Șu y`?!Fnx*p;[0tcd$c0err [>BriڏڇDˢ|n_0:]׎ٜC[ ]|}n@\2ϲ llCk k7؃&`qEi7bv_W{7™zcz1^ 8ZY:#梂1hcPӝjys9B/U~DkSѵIX)N,Ko5čbs n`v` b"oCɐ̩G%s,\ uЗ"FsȼDK!f7hkj"CO5Mtw!ƞ 2Ţ<>s埉[3x]El1J XbypyIZ/L [ջ?;ȔKoN" q3.#fJt >)!S K?l` t @k r'&BXADD2bKzT0dtJ};{ѱb*F8],5wګ@~E2?*/g."qD"EPÂrbRƊ ua{tV˵ĄVg |xIϽ♂Ü?* BIEJۯ<^ln+ۘfIn[2GN hI"@'`qf sNSSڍH}}W"kIgJgO/584 [}9nNR ѣȲ-~Lt6$t<Н1ߊhVOtƮ2tp<iꏺdzg4}jQ˜=i9^1ӟɩ% ET[\rfS~;s|N J\>^@Yg{%70b2vZۂMك㻮ZTEEzRu!I+CG%(Kme&H5QârG]F|wI`$ .SRW,r;wOzQ}Q7R0⯭33 ?6iwPKR\?xg cSd%r~TLu*5]|U"q|ͱ&]ՅܝCcbE4פÓ3n`I{zp}Q[gnǸ64zXĥI46!C0pY'|R8xnՆss̩EEUGdб93ֽ42F[w`?WuU)r8?H\v;Uޥ]-՘H%YP8uUe#ӂR2,5 `Х{^M4wreFLc fMp}~kxak3p+Yyb$+THt6uwi6MMBUP䀸KRY:}6y& DRK5?)N$-ӓҁ~CHMG)y2g#7h4b=D4j @PT \H7F4 {4$F[Ad$~maM~~BHdy8! ^2sn߅vn#*\|m3w"IEH̾{SCӒ b bȌ |œ.,fA }Q9v)z̵~q埈'ƀVKZ苋ĚĞ}2*m đ#<5gl.!J<#n|Vj&Y)mfhʻ\`],3RG.iU@MM ?kz ;X@tKbxr^'V zl傍cn5bm}F%R dzoAQލS`!(w)n:ȻQId0[;DiJ_8Ju̫-ҋ@c(RZx*^P'UQlDw, cm!HT+,~pWbj:az Y.2*D1vTyKj [aKiP]J)R5$%>؂D!,n%m7Bɐ{S&ƅWI@JqGg۲$h0?IDi$WG\H$Po^am+Q7!QiDR NUn;E!~CU4zG;`3vT!q9rL[g3:#h-7⢉53=R{ >7& (zKJr+"#m±#n{&<'I!{'Q%,<ǀm+тoEV˳FI;_Ձmvz ؏K~IF3/;aM|nh43 trgͅ:| ^Jue:ȫe@RQ&ݜS$ }0f(<3P%,575VDR-~ӧ1җV+$Ii3KE>V8;,joQD=oyX;wlk{> vH룬`ExR-+Og䷿קL\9c^_bMzXPTYE}D\!ctlLdMm=3Eݲvʵ˯EH<< OvoGRTy[\>] Vi~P,';f >8:-6AsJjG彸mc;P1yջzrI @"΍YߗHqq 6IV Tʣ^jԱ z7xPxo׬yM}7-!a'.{_1ّП Y>*£ - <)DD!R{xDЍBn(\LZLszVCF@oۨ[Gs/LS_Z(YwF4 r 9֥fKEs>9 nHUbB$X0$i}'$qӾoP,`X?;voe1iֳx + iT Z[a >Ҕw`"OH#?$C_n䠹oeWrcWLs3Ռ]!Jc;7G :f<)`(uh6s5E4iC6~(gzDٹj^}SK5O3">{ oTE6$?įR:y&l>})c݅3I'AoNzεƼ:]イSLy+\gmAu{JS1]=t̍]ͷv[uR:3Uu27oo`I#*@W*| 9[%O[δ, R(ǢF}?X&.dQጃ&YšPŬY e;~N$YFC(Pp|Vu#q>@ UY, t |xLRFȨF8 i¶m{ڴsc}2g9OD;K9% T ]"Hi%d[qȳ*ٲ 3A`ߘ'OS@Uc?<]xH>pAP jVL(? ðU9M<0eAvEwJ-|z7(}xi7:%^9m\( [~Ip,)~IOH幙\!sa\JP.ѵn53뼈'#{F<}{:ФgPdC_P_bh ,aUGvZ<+23lQ5= [E-mf8)4ء[Ev((hX洭<~q# whU^b5g \/.ďżϥe4 %]$|5)SSb#~m:2oM֛)oY7NZ4}:69lPSk$E rµ GDf y\Sd5b843=l^'<$/9~Mqg rg%^H*GBZz`u1I[ 2si(!aPQ+of: }y#C%Q˄vϔ]?{,1e%!ԧC^@8[Lc4ܷ{ӑ& uCkM |^92[ܹ$7Ƕtũ29{ԣ^8Mږs|$5|O[_<.:GrJ^٦yAf,bZc:5.4eHPȍC`(i> Ͽw6?yEU~LKvUPSpm)G?/3oF$b/&F rhn!= }9aI{Snftt~R+@qZi{!?H(A \ڲBs~=[P%|Jeȳ} C+AlaD@Br7W CoCF)NN)>`?5n\&q˰th|a6Sx~Nt܌U iC3L\&NfXh%5'ήʚ V-駂ڝ \TnX3阢r2ׯ%E.΁bkF.ϧ!+jr9ӗy$fb'aٚpo?23H~H"¹E_pk;+ \G/rgj#qҷ`5@V^c:W MS'};@,pƎ6_AKJATKxnE~Ig*\u2\h-ʹK7SjTdʵùl& L|L10h{65zSẌ́R& wO|u +,<- D_åuUA?&C.% E4DixkDHn:nUеzJ p~lFqG( jFx}7;HVS wU x[gE7]y KIÓ"M{w{@dI2aym1=.t^UW?xhKɈ/- Mzາ Ӡ3]5>y&G})o2̢# ]􇀄N2['\9Cf`8TYBIL`VMdQOoPKe#/x$'}FY̋:0Y$|rF*}P?[+:cf8)}wvQ9Dj :X_opC0F;;G&gQաL{8|ӀK=WG#M2ķ|6ɛJKp4$ʄ[|jYmv⳷ VkRp>#\^ aʼnĆ>30Vs`]@J4WDjcf@~˿87@ĒƳu~30J! DW̑\(s(rDyn@ZD"8cmq 3xWnqST2Ǒj0!^i7AbuQH?` $) krY|Ԙ*ul3cY_?-Y(Slg]iO|E;%}N1^*G=^KFl-<'C(@=CCOAUՇ̘(9}3^iIDr>)`yؑ+,ʺխx0H*1̠r&ij|amaELpȳ2E!F͋Rnj{똆{R jic4TmBڸ7=Na` Kb3`KUNy,a|4MQ> n1.'9(wɪ->in ;;S<>) t/YݎVP4;;>OwEu7+u /jʨ%)*TKs!bg<g=zq%3_1 ŕ==lX{;)  Z¼ĔZtdM[nƒӬ;%63iJy SLk;j'hKRr݀L)eU iHFtry҆z1g, w^omKSK]R5'2Ð44Sz!\8׳MZi`lַFNʼV뀷S޴-,ùȱ),hxo?]f} nXG%bk.#$. "@1KS.򾠔l nj^.+d? (+aa0iu[[RTb뺘td.ǼE_rx!A`ƥ;t.ІPV; Ll(Z7 1`cz ;ail Rwa'F`zvshQMH2Kch.9ձr3-ᯮs|}vѮ8Rb&G̫9 #B|\bvSat.$$gcJ{@\ 71,h:Rs7ttl">@3ġB?Q[V`iኣ ]]wQI&4;_%lrq0 c0QBIS9 4L *hecom4١΁wof 7/?<Rjɧˎ{-m E q+ыβKU؃ ufVھ0 ދ_ɩQ%j` Hc bs?CrZt}Vm@Kh)j[̻48E9| {]c6wdj'o4 80 13lyҷXSmñxh+ vi|3D!@L`>;Wm: tpdzHdL!ezCa Izr6iJjcύƬBOp\Μ“3̧J PK8ڬ4.Zݗ"+#@CFtvUF+#T=p"Hh|ܔZSmm@M2*Ge_5˥>FDM/D^nPA=:=ɭny><5 ^bsȆ' $[yD_"eH2Mk>XL  ^F\Cvgr|CC`~Ok1;Ԧ5H96e `Q+ '_7\0) mh!v=J!0Gd[kAUcPZZ5irQ7MZ"o d78f aLf'"'>Lq"F۬)^`CE Kd"ny[>UoLD;¢3Qt~("@*,#]-5x1 ?fn&v<5Qd_sMN SCM;AW?y|XA.Qzh lWc 1$)  &D RfEo\Yc,'NL|e<>q8pK덆Qgd/mm~0dFTكpu}}b[Ůcd+ תyf5i)Ϣt"Zz|;kE pWidGc$EcH^\77s0u"I"$|$ʷ5)R"]ݷZx[3X9m7putP |o(KI˥u6CgﭡJ7(_*Fށ7/+^ ;dP? qlT줁.!\P) 2Hiod-T+5.wChhN%^A`֎ߋ7kX FcPߴ8_Z:뀝69R80=Nd].7tz\Xr,(+>Ǡw]ٍHጜD5VaΡiErq&tػXn2MVz #/KQ4hVنYT  v-jJ=)R*A҉lUDwiM1q%B-tqTd{9]o(ֿKSТK\]0| D`ޢ,I6hX^1幊?^nƕGf)Z6/3oq@>g|4_]2*7n-crKDCVYiFz_`2޴M% a^u#=dGO,Uw0Ez5鑱~W?L5t`Jn} ޒ6ѫ[ÛL7ĉ:/&ꐘFO0 ~eAEOO뱺D."[,q۬p{c8moe<@# m sb(4%_E>/z-F騘K.*:VBp-"p<A&^aRex)nG櫅" ?ݯ[C %]3P?Nը-UyQ ,!ȜZw{OΩ#=pe,I`HoS']uf0UbܫNEM._*!Cmևg%˒^D!kޗ0{*߷br)e~@N⟅@)UC\K=&w< bzƜ:~LO_ ~n_6e+nO +z)QBꗣ7YML{e8բ0\gT=}W%g\2`w6m?N]V J ־lܜc#D|D[-Sl=B$ uy iɀ!Ct2T/*l=E_"as< +:7nR+6.KEZ>r\bjs ZUpgU;~976q8Ga 3LֶSx'PtN\6!B_}X] ax"4!(M#Z?jQweܼYNJk Ʋ|JϡJts;VꗲЎՍT2qbQ T`)h@`l ]ԖpCCKR/1AՇa"xVeCbςA#\İ  =K<}Eqb⺲KIBnZR$rc*V׎rE>!&?P|QpKmpp'lW\e[hnAeU s__QMV]펌Ǔ ӹ#lj/鶾0 cIK-1t ݡˡdlo&+n=۱`Ux rס-l˖F mk]ѯ^DbdY2zӺAMpCZ c^\7t G;Fᑯ 5اڗ ߿meMY] O kdj+ЅJ-g,50􏾧=1ԡ4ܦᏺSn[k&_ `ɢCn!"p||Ԇ@ҲAc4fn6JI&x6ҼBj#ϧUNQ=c &sE|?=Jo&S*^FW|[;Q\UTSVDmogvEu" 4{sb4 cW=jDגn<l,E{ Sb/g!( wLJ$MO9&Bo(VYE~Iޱl( !7ݴv`I_|es!>zB-gtCZ|b9\~#&)\phl_09b4K ?2[۩mz: 6 FSb%Xqn:l!c7TL~ⲫYy|!|\m,]2-ov}g8G GG*,L{Y|wx-~%Q-I9h\h6.řiD{c٣WJTLv2ޏ{ )SUi~/k֩G( ´]˴W=M1&-v nw@z!9#o[jegh"<}GG7KPB\'޹&r|b|2878W 쎇(PK)E0bXuF2*}"@^FB mf%lh`SoXT]]}LCIˇu}קZ7is҆ I 0DmB%fHWd-ONE e9TJ bAa>7QϪV 1m47eʍS['=)"68~NnSs/|P7:RvJ;uqZZ n^חbħ`K?@G//b115n{]r^PԻ'72j2k!{g3dHŴo&)? %&$SMCf[UKƌ-4l4%?:*2cSD+By&~djm}TlPkд䠜S5Ë_lOb">V_"(&W^0eF BU"ɖ/:e_5 [|~v;#'m-3A gO ,s@LH\#q4p;eSGLQkM} @AW_4k6q"hcY6xd'`u~{CC4/o.k/qLFI :syd$^rbt;ѷE,{'$56Rdoysn+6jv8jm\4 ('~ -KF\NRZ);ª[enl$lpoKL5܍h$iGV &ʼʺ;gFf̃(<2MEkMzʻH;3n=yqq,+H9?*(KTs$5iz8O;鑾KT$'ޝO>H%tqQIiYbP+=G,?{ b$,u6Q-SgXYuaZ߹ Dr|B_1J]q*ù\<Xv 0CПs=L^ۑ҂=2%gjX[pZwAL zl7)FRxCQ^Q{ Q|o8ggRU}L!dx)S( 2WcglqhgCQ8|1wF: #] <=ًo)2p{G UjjS_"`Kהs9:'٤sWD`٨,k8x/4(8eo1PKy٫E1MA5[TFξ YՂ"m7HPNt'OK Ԝ\ox鹗(Wlʡc6BJxu䎳n49{ 8Xg2MH)j[kwtSIc Q r\.֫/FlJ7{\mGvDXjHc90?-4[{> ވY;I~e [uqq_|!!YB38?#/u!y 1zGS> AX =uYRa؇.8tF΃jcRg7s}+פT|4G%G6ag_N|76uD}㓞O%"o[E'f S\qa,q%Dn tқ綔<ȪNB\^9llO"S@h"B;Β]ZޭP򮙑N,ϫD-pgtg+7-ۭU.7²Y+ǿ.p/noi_#6'sD^aP˻*,tPx)43N%0"&g2|g Yٝ\ȾB[abTb␚lO0ÂGNuDdib (ڞۏ2DڊCKxiO-`qN TszyxDB  mQ d0Wqa@>iTʚ6)󄆄$.ck5?h6$kFn(s:$h -?, /$C,0<%\`0\jl!ygf 9p>%LX TXcnOWo-\ߦHT$MytB OLP 5ܩ"kԣƍMI?92ϩdCjOA OϺct7VW>vhژnC +O|h4}㆓t#$bR8!Շ_2K">k?jW ezO/ufB2BNMj/Ֆ*% 6.W-!~$&tPN՝ mWzVc<Y:1\:]A8wjDL/m5 BpȨ T\x$c)t㴧ߚ5ÈRV읜Xxk؋ay d⼡Oٔj?6͑qV{+?9Vc)`Q@̀|glX]B[VFo.[):Z搢%0 ޸mmH!:*e}lv[7 YBH|'œg;4 Q(.tO +L +0k!¡A9/;EkG@ P9x࢐mL.k$~,:~Тsx׼9"2u>]JOxzyeO |0R'R{yOeMs$X?dKx_ !b i%7NReUS*[|"k)7KUu圆LemQ,ƒln id + אNxEf`iLrx!TS‘ke@0W|-Y'os)8/QCPd]Ģ>Iz2s2˜rK6zSt~Y F#'V.T6LgO-4h!Nϸم'ŗ$d&Óh8,QEyֻ)?s`c=B V,&}JJJAȰ!Wj_s@FVe5]Y/Pu &?*Iz;XO2 42cb֫yˮ׋1U z]&n3v׺-Г/%9ϓK?fAT3Xa8b1mЬJ’gM`]H)Uy G8N|TVm(E^N9 kO丛MFj v40Pġo\v^y>ήT4A/N匳uXQ3hNRo3Uq/ irAo:|ɝEԐq-d6$ p9"KO|w8w ̫"Nza>>CGIb*}'FjG?,>|l2UwW Ϙ"CyavM?OsF_ZgtHUy"RK>"$Ѹb:Rx%m9s5nibFF1?ّwQKo%)Fݸz)2 ?cqڸ(^55.Iё"J-ǚv޽\ψPs !/3+W+Wca/ &w+!U`-k5e}1@]9k@(6-Vu7(K7Rc!)@3"wdbk S #AŒq[PdܩYjcET٨ o"EA;VHnCP)qسyv<֞/U޵_=0[,V`+7hw1AGeil- OFg0dz%Zh'lKNj灁*gU۴#B$-nŠ=JaWmXDpmzǢlUn Oh*~:5-oAR^q/,AtK~+RoVl}ru}sB |h{A};k?>%@fRY{KN,pCXWʝg{0~3G^< >׫E&ezcVg[jSv1Wxlc_qot2A'kNˎq.Z%bg*?151 IGSz&N)Dy}A+^o_h?[|3Za0 icC{ag]# ΄'s*T)؟ \֞vQ\R wLLI'6]ED!5U+}߯~ ?M$5#x';#I S/ܯiT̨}vj34X_! [teqDa%r[J/y1Zk"Yx̹˚=\KJ-9 Rh!GB FvJ"ppW-] C&cx5\&6U- lRo0(w;{Γbh 8~F9&P*p8m7tjpeQ-!}sqpjZ2 $t`™*.}>kS&^df]%Nn~qR%qQ3 JAk5ΜAFTҊ] fHm?sӃpFdM1Q)tsJ9BY~s 놯'@JBa2+@/.Q`>Gc/+ q:>wzLXł >]$9hi:ʙzI(5O˵{Nײrpݴ郝af"Ò#n΅þ#ndj dg~oMHHj43S;Kh52փjz?_^e10F*lF̾\O0^Y"m(<-0\G=QBV1*,9dq53.x ażcvSwϮ0t׺x9 +8jqoULpOl#Z7rcdBwˣUiQ͟ƶ ҡ2˄ ?۷;F \3ULJ 08,;:ɱYH!%[:~q<9̆i&::c oAc0F2+ bivM&dK=7APtٲ>ItORs SfzV6^ֹI3U)s */-=5S,a ;j=(}%7PE~"]Nn=ձhX;OVr7sq ]Jق#uҥ+9K:oSNTl @3k-~3V/ǯ孵jB(/X%D*]-{eƔXf Վ'2U]ΫdSs h}onNM_GBBjm'H_[!c%oӴЄKkm_:wd]łz)LҚߪҥ˹LNE[(@#8/r_f^C''QՓfÎ6k߂%6!͑|^]"2'3q.Eϡ KT (nrkTѷzLhTI\K~J%R.TMdM#Pv=|ucպ ;bՄj/GĜU$lXZӇ U+&{|\ᘫ8TBCv1Mt (Pc BjPtr \}pEIֹcœ/(KS8Z &Bbt:%NH T`=xSsҙpknn0wpY6ůM&kdHlVrntZ)zC1XE]D١t/H<Utڻ>ɪC#ăV#e̻ǘų %+q{lt(~0z͏W+<6h>ҔK?YZUj>}>R t?µXN3]Y((1}?IW%aW4VK5jю%PiIa)ڂgݽQ=#-|fVR ʔvA7ύN~{O0W]<& ֠PAr|z j%'Iw=K79W|p}nd25;Fi@'eլw?aO м5\J̝ aSK C u( LeLܭCG$%L{$8sx:fX$Bqři6u:3*= u_\p2fas+>3P6 z1;<wY'Kmҝ[>FM0NMEEL8L];nt):*m^&O<'92)1wq?qڣo%.` T1&&n'\ʔlL2YlJJ-1G#Δl=Q"&dꠘ謢Mܯj^Aj+Vok\;/pƸa ^b7Ӵ\a3CgN2Y겊c˝U)pݚBjٿݨAsS^ T% ,Fuhž %ȆT=FkG\>Iun "_UN%Ɣ_Uputs)?ˉVCb@- ;`VL\LfOcEUЩߏ7"7a3A?gaE'nrjf{Et!0eBF_|~sXr|٢6 %ͯdw@qsU*>㳇VzL]'@4kKQg31pm~ 0gBdtmB'=f^)0EܞZO4K\e Y71`OH3%G䛄5ό?Bl~oV%G9Kq ׆ ? a漽::E>5{Mp]ynU^xN1W`dq?Yy[7Zn-69~{H *DAʢ {j(z 9P{r=_#+eݣ%wdv/DWǵ4|MI>15@<{NirqNbGFQg*:oՓ'Pˊ M.q:Wۓil<<Ixp[qKߪGI0cOJvD# QuSh)4qM2?+CVzvkw}~k ѭf<yA]^R\Nq7CB+"MMe>>e ^$S *gh\c5JOvBPfܤ]u$.3PF:p@$g]*kג9^K#zIrьٌ⬲:`5>h?$ψUbdG6 Nn*hw&v| l Ԧk ed2dT&ý^P+g{X܂qh)+;a{#x-="09,ET${]bϯ ;;xߪLmIԨUG2.y*.=yjh*| Z'j:qةҤNyyh17~a/sC?ߒ!Cfɮi u#4ll?fe#3€f"z:S\*sA*at}tr~KSZ_^:# "['*e= Qflwz{rU1˕Sk+K@2n_bs%*r:s{F֏^ ċjA*)}ix:XO~qфo|`S;)ǀ-tp .YfQLޚ3 ǻ%jSUv4+؍FBq!rWUF3Za\gN9ES> btWa(_!GԀuݧL+6kx4|M5X, !k8^̘3=_g4 AXޛEٹN_|"-y ji)]0.mJm [<5vUcvZ:Ld2>_yiwA$:{Py)3tR"EHHͷO6La;* '\ܺp D^Ӌv'0mc__S]&sw4)!`k+2ebi6?:$:E ƾ@4W@[PbӒXM_a{]4/IRm dPuFT>c7cj r @BoֆrP@mr+^SnlpIR;ΗP™z>MK$U}{Ұ?f\Š_͚oοL@% /iGb*4 tr.Ai ^_6Ym͚ $=cLE;ЎMۂ4Dq!IByȋʬRl·u&>f&oS_ O_)c8)4\jݎFv/nA 8li"Ya]u{;-^zUH } j{3 Á8xC)'O X05d|;\9gm]@PamkÊKo"0cZE}O((|7YKZ~hԓZ<f$.u0~+Z~w#%ԾF{7l){TQԷ.">z~/1F-?%)iJjbt@ 1)gBHU1tPwp<8zj[kDۘbz6q}0Fu#bi6{`7kWzRv,nq־֞mNʫcC`1=EP&:>;QbkYԍV+|Y[PX(θ )h&{OgRP<>4E/Lgr {B'/La#Cz0cX 2[gax1?=M`^6q*,m({@,pKو6Tyc,-10!}yalgnK@,%#ؠX(ðsPicԾ%#Idr9Qŀ}8tv0.q)Ugzt]>5 *nWyp'|= [QQ%v&e G@HZg9<\7e$5U< lV)yN wANBH"vFYbZo܈ Z26܄: k4R fF[YPY&1io!8/ChiS#{lܽuG\rR}ި1} DFa,U^Q>lU1eΧi)j0B 9BQkf$ܜ%O/ֺ] ҇b3n߭$?&-ض .q\@ [}W Hj4xSGaisXJg8dG ˧)XWCK]U E5|Pe;5_/eӇ 5qLwS} EƕrILg0ϧq[Q~[W08|.0ס+v'VQ]K|0X+\UvG~x@)^w񤗒|[Fm$K<B QP'p7'3{/鸰lC\FjOW)mFo\"dlC6%{=8T΃[}O2}S:D͖fy Nb3<,VX8z<&,k&>dIG.wLYʤuƤmj!1=)p+%ިL~lDN}fLV/B)~^Yn'D)83y7GnqVN,1z6:RoUά7W1<"Gww(}uݪ?CaAk=-i?]jxKpT StM>;,VAԔ{͆KpcUGW]ܿ.09ZkK-@Kxoh@Քn7 >-] ڎ6D<{ؕKH?F0&q.`/O%{X :"`yĴ@@=59׌=Uơx"¡Q,~Zgc>JT|R/E* @t饱1mMܽF``mA8˦(%k / vW_Lw_JIcI.~ތCKKtcfW*ܦ"Fai;3:pJC zZ>y})d/%kk͕[Licu!Ex4~c80tb ӻ_neH$pYGU[>X1}^B/v0^< e=_޾--ΩQuX,IhF\ϵG@6K1V8C[*zο?Ks weGfo%fq ߿ncv;>gݥz%2kt7y+Bw:fC.R"J^ 4z7 =5xõ_ĺv*8$8mf)*⢉!I̭ /%ICYcm[6ٰq^-0soI 43:}׌5%-PJ^d~DNH!*uPފݛ'eSS% 0'Wg8鹄آ+YNn%F{a 0c$UO^t6-{U LZ{.BG^ @x^>UD&i=q7lIOmf;nj)4b%&ecI{A<;XL1b4;Co+fqp`/%}&r!Wk{i 3a"K$R?Ab44DC;M!yJ W9@[3ͻ :@.C/_g.Izrd4? čx *ged7Rg^շlFG 럑s̗?b@O?w 'bbmOor:̶z--xh)6h'Z<٦U8[TШ8Uh@ro߯Pm7T&%X ऊүWnk0rB8S!paPG$ MMGeӮE3ۘ2#4Lqm菿QOM'XFau iڪ 5zOB ț#PNuU.ʄ\z >]{\dez810yжy}^k}D]/ڌH0zݪ7tjG"r @Z.QBoǖ[kB;*oQ&@H01*4YK=uxv2`3{W_:_z,{*vR[LE fq$1ꎿ0lWս - 5)hH~5Q]o%H&pn~+WbJ:* `)}$+.4Y[8DY]J6CntG NB8{fKV7dN|$]-_i<1U7Jhrab$/ϭg%m@&K>GmVA9|'eoٵOcT"7q3Bv 'O#l}^&QhE.eqфl%.Q2dJ 97}I€=_yYO)%>0`O"f<\"bO-\Oey[W<,Mm-(&#' ptECv\ϠrYts:vTB_0{2D{-3E TZA"͚!~~nxcaj)[1? 3ݡnzOm *03҇"61JK7YWc=@ձo>۵_sFP$n s&UqȖeaf/噉4\z2ă-Z^uK3?Gk;_> E*J%EկLa6m<9 0hR+Lo5xȖ31v/`JҺ!!( ͓IjGhV1_uX/x q 7 eL)ˉŮ%0 8͏d iwőA5漬8 M*WLQhQPEuNd J:asm54VFy\C4/;`֣Ȭ1ÀYnĎHyNK+NSzGD?qBX}s' iS;X[>7P2Xu{s$1A:*.+^| v&\_HW|}eQ:ӏb bֱH.Q@\Le1{-ó"^¶;>qϜNᔛ6`#B(*oHss?5@>y mΏ6=ofz{)#VŲH\Mκ[ eV-tpGrAI^b<ꥻT,87Z{Pg:UySp@4M53E%6i+ a&Cq(1 y"-p6!x1&^C%v64vwG(TUё`B2DnMD.k@eU:?(yкWI"LRbqdTҧ6ФGUiֺ+j #o;ËN%P;.c1 yڤa+Vو]ˮgA L/O<2Ξwz27\39a?5rB1k|z4m4/oV+&64GCJ}W 7uMHq3jErRuIf 919$Z ;>ZlR ^ymGS@jKZ9֥*$2fQw178;*6Z>#P)DX"+k3l;_,W3;=I"`hj1^Ngᬃtు3 I~\*0-(B`d=(WYvSFȒg 1~r'2C-NȍK[ŸMځ /A^N|0鿷MCYGq./߷"VC CWPX{iQ2Rvb\֤FsmFW{aA*ɨ l ̲Sj^vS yف[+ 28$\1}z)hH,+;/K2hxD/rw!ա5.3YJ\o~mC i<{)61OY[=-8:̙==`bhHp/I׼5U0D ($jm~,5ۀ˥m*>O~gZzs#j5yYiF O$ DPiWCI+Çza}z?+ƽQD2ix 7?uFƼ3in1t zW?XLٺ5އz3+0hngA=|A a )g}Q\ʼn*_"ECشGUfVy7Y%S KXj#WH.*F(6Pg101!2&жobU,BhH z܈'C}yvH͚?û=b/+f@ˈu,aQ _p,ｧ֋' l&Ik}bZYK\ܛJs3.H~COߏt5K!R^::1;s`kȑjǟ[z p&E;L{&LgCB!ϲnT f~NÅ?Ɣ1RBE*^N_h쀳jΥ4뽜w%,$lg7w̠x6=8C3 !rEÂdy262-p!~pѮp4_SD)C#Ds f20UHJmS>`(vjmnWn)-X`beƿIع>)Q ?}%Ceˑ|/ i *]Ԍ+ aglTua6`-J >, ޶KI 0Q~ŝ4yR!77Up\T޻&ie[ԫpH7&_F䄢`FCB[IC,ha kK,P,B7T=&Qt] t>Oð o٣+ގmPN[SM>>p^1TtԉvNhv fif-oE,$1Yx ̪'Ccs{˘FF*o=)XNN+03Yk0>쿗 pd-BPwl9Z0hi׊ؒ%JX*bZ МkK3WbuyN{kQG\#o$ hR=桁tg|TX;`^|.Ch{9݉_{A(I#x<0sJEDRѠ+wԱ%XzC"c}Zܠ<8!ԃ:A|k %HڙvޠoUOBsukS&>={o[;5. ׈l 9MQr:R)EwD$ur* 6* ~\}ݾKH߼-q;`Q`E#;@9‘YYL!5$ӔF碪y|ЎJVE0'^';0亱 O=&f+I,SVLI5\DS+ hM譽Simj$ɲ'ex٩0xҖ3re?C:Zik_yp , a45, ;o׃`L~bVԋ-FK'F]0u>6ybD Q ]#_A"{!<Ա#0ԍzH}fְ L3gK6_0/ Oj-`lx},q'TBD a0y#1fIt`!?րͩvX[~fYb AT^#<˕T8)¶rF^@lB_,:3_Z3%nZ`J`O3;L6#66gdĸ|-~1{O+>gZPMԜ@t8F.~F =R_6$a9Ƞ h3lV(FWHm?عg\d ש:t;a[]'o׫'$"H`oMS-́--z~ \/X1E[/]WSy gBK:)COCRW$Ǟ8*'Cĕ)b& [uOr'Nv'5#.(uziE ~az$P|[t>*fsD^4 |“nbx7%EY8u/:Xc@Y:bv ;7`1+͂7 ":]A WJr`ؗ~rW A%3$F*^XbL~^1qUg\I?*dG ëƓ܈)ݪY{JzfDy #E SI؉FWDڌhaHZLvF@cf粸 +{\!IA\][ezvțrfzv]!CQhf|X`W2fh>:P_o#yL\^'gz*r>G5&dQtAtqwrX n>έ>. [µld6^m8fޱhP yu{ܤt(N=yFd||WD9F/P :x nU]_ e'zgziU'+=I_.+kF ݸ24!T`{⧴T-QxAαYRΓg2|j ѫBBܙm % Zىc]d'15qG#<hkM[0B7[m4YKAaZ G#IuA互 bāR(ϦQ`T`w^/p_-8J%NnՌa]30"#QZ10Sx诔kxflfTu5 m{d^I,!rm!o?j `h`e5K KKt2q儭ٿS>"+& (!t6~'J"r~ ȮPl!% UmNb Ɋhe˲*ν =ē$,u0}tT~bC $]Ht͈"PX`+w›ž!vGmD0%~e%E̾Ri'Ѭ^3 q4 <WAnFMswfO#)l %koB. (F 11hē@ Ky1͖O?7&(G=/tPuWAk$11ɬ4!w,iJ܏I+^}cdl=WPj)Yc Y_:(T&z7wԁt0wa~ aEj8Rbڃڬz@CkK*D}gUXyjp;1g/xԊI]̏O9ZL7O.SA $[U@4j/s;|c2zY@P%5J. 8Pvmᴥt7DtJ%7o@5ʧK2˵5 YkA#jLu2~$h7F#IJ\SĴBZ =?((vp<hE^s4-)W5>}1+ֻ7< ks.< aϳsfڣ=]$T6"q/Y{o h&t ,f5qkH8Iũ ĵHϥs_ ߠAb$ް#EÁH-qUJ :ܫBʹܒK.]˕=-2ʖP*- 0E(/ > £#GUs%st%$2s,:7ylyZ;+&kP%=^uUBJ73R|e戫PK0E\앹Ã:nb=w@w=L,>ĕv;7$tu$B=Y0!ܘ~EY`D|֛l/ѭY?|%U N:TrLp=~:Dm9wh"4H.vD44s)z(g J{Hʆ٩0u0Fk%6d)fex17pnZڍ5?11.x 8DZj 5TAan+k&g/5/d1ʰᢔ(\Fہvl|`f5S[;+/)1$ 2#wkWqL*8u 'A ^h=gQcqkBvJqʙoڅg:K4"qV^#875%5A '얘l$(vN@{Řmsї`SB}t `#aTtJ.ΊyItQ*pK#0e5(ZGxGpG ʡ:CXo1ܢ0 qDr<s-{+DzNUZğfc9hH_b!h"-_faO#1Q(Tw4y|y;oo`zyuWtzrY첑<:Ez~6.žoǼqSZ2`0qSh919BN &k Xf+d(5UVCҔ\&[Fb)2Ia܉:&##Nt}'S$+IeCKdzVnfse[1W> 46Y3{5SᦆKpO с, Rx3:JHl1k42/Td0\7\{8k$pnZ;;7`g6vZ4!eCm ,  Wrn}uZ 2W,Dc\[N>$hFPg@nOobRVߪ ۿ9\2ҫђȘkݧ\aq/ dLׅ]H%jZ%G1V]};~^62"{vA{ Zۙ+q=mI#I@Mxkt?&vf;eW<&mJҲcҫ-Ak՜ԛT ݞw&VҲeDWiYH8 zFw?#@@nB߾ >Sݸ|3 è1 :xqc0.]8" ox+>=ZLc}&c~{ԁ3]Az$K&Zmn,,VuUC җTH1(*:Wړ^vI=xhNC ؓv#E?f |-b˩k@ۀk``)vVtKrRތD%Sujey uCMk߼濜Jo2o@ʋH"BHPׅEh'ؑn!_#cE2ʞ1H"oDԾ,2 h%gwߏaq779.}}S&(-L0B6H7T&aks gS(2xN.Xp{{rՓYa=&iH%BR)]qD<+U_ ޙ3`ynQL I/Syp’`^n»,/1)R&Ldhx^Mr1h$3U!irjD dqDUs |^| F?N7{E]/O,ىtr`"r)k86 S!Fp,+bLxs3EJT"vm= |T8ٙ$ A%.BuiѨ~T}F֦Э:F?{)Q'lV0jkZUlm\9壩0br qMPqĂҀ=hONT.f:p'7f*疩 …!!t*_xhb;2 MA |[SM z-_>GN QDON{,yd(KMʇ.<Smq"8AR|Sh+62H$pIXJˡ zY5 bIӼ`D`Hldcf=:xɂ4Ϛk ncR؉j;$- .JwgzRk t} $ԗ{w-ο 2/3(Y:zJ,;r(2)GeZA2NϡJ@6 ҡg-24m5,cdQdrUl6n_RYqqBR<9^6.LaxQߨdw 7$0b֧U}&3N+.U4lV<#P0?]Ou!W*|88Ø]ϫn _9}KtYюjd50 0!:jלWQOV6xC/<EGEJ;UU ͑+Q!>톃gݖD;}?(Nv\)kPxa[WlLyȐ  _KhK$ o/!3Xڪ7"_ڸ=iF?,DںJ8h |a\j6uAkIeUk{EeNj=z;[%m=dFT ?_|R l#|{V];7q ʧ✢_TyvҖe(#DjzYhub`XTULR{"檎}͂7W8u9"IE!,K /'}ȣ" gKb<"yoC2ԏ[ێ522hSܙ9|"9l"68GD}֝PaLL>P}ToLDT0vPuOUCH]7 js^h$ l̓%|b8TaD/BnJ$y]`YRؾ_MJFKA(_Qcٺz09~kZcKʮjX[w<(lɳER[;\EU:.)<5#3[w$*Mizq6x<ހ2n}.^~dw_;pc)E<_gE3,s6<`1@!G6cDܚ?QK(5FҌ=b\Jԇn^\As['ߵ#G}XGDo h x]{#o`<`)K%ڥb[B _II=;shax_WVk%ϊ7X{Ry`aΰy䜶b׭%0^YʈҢV2=*9/yM562DN0ʲhWqY1Uy!l0k&M)TIMPPU?ŇWC: <fBdM8Ѷwޙ!j'c8|Q@q@k\6=͎WSQÛN^j٬2؎a6rNu]tKۉLBHMMyU_*9UCs~GGN̥DoS+2p~1V?g.B8Y :{nh@|!p醈 2r|lUZN0Vk@"a>䣦nhbT.EI@iՉ&i7Wi87nYB%g2ϞdMefO<)k1+T . %@6.%—-/Dch@;JWgoRUk)%,$c$͋._!&x#B98`*K ]:7]e2xֵ k`rnGo*Z\7hDkKr]1.)S`Y_Efթv;w42mHSod8A+U9Gy|+:1=0 _G,6Gx.g߰5{D:ßNC/VZ)`^q]ܕ~zs62D#ίH*cgYn,j!DiQL2Q)ʾz琔96Ď[04=|hIsE|Kqi 33L;mH^qoKЬ/U;#-( 'KkO\!OporvdB=Oj>O5Yׯ2b6_by զ9xB; ȍQ6žd{]dgdBVp˄]IR(*^vہ6doLK+*d$f> C?PSмv՟EOXvh 8:?C`Вf!cb2NXiQ^=?Yk;^ॱ[boʚd$>RDZ:qWvR~HO2B\[0KF]gAL…5-+9DD){2gvQC\,oJKWU6bShEhc8P1QLYtb@^ 5LnÞ?-,. Whÿ1aYo_V4pZ4"g Ar`q$X[N2&BS*vPlHQHJJD;0݉@ ^; 1 +ݚ '<8(2QVj6uk]5+@G"7̦xOČ~)<11^>]kn~-āԬ]oWʃ)^YᡧTPK _F%`١ ,ΛKd*{ucl 55Տ[}Rߩ GPER>ߦey~CLlC>|FP}gmd %%ф658J&ѣ JeF;=,(R]7[ښ4x&G|x@3;/BOQ `g QJ0%-"WFdQ@ǣ05}g#̌9%Z0 .p{[$QejlCcHwoSu4UoÎAM_DxÐ$:wW#eߢ/c:7u8IIԞlWn(V;tkM"bͦs6)b*&4hɃKp6ysvǻk .iS,ᓍ&,MyH3`ꖋӵX)藲T  ۣgذA:rnUT.!r#z$r /G`kc}pDbY'8ǣ)f!IdY |tY׼8wˁ!v\R/)?z9S|=aN]F#C~\Jb>XqRC_ Y 8") D@'x<7~PHj}Հq*ޖ&Ԟ Q`zg"x3w(eb_^S&<@a4d(  89qnZlFq5/ENOchR5^C=ŕm)%I6qWdTx6r]NPI=VTygwK5ceUA4:҃=_!F j%F ^%gcx/XY!Bp;gdʺ#h9n"% @nkw[ njBtmrctn-L !8| OB{|/7̍eJA.jӨzo;o92 EH?O'9OUywln}{Qnj"lR7%Oy]vB]1u{g?bOjy૖SN01z_m}Sׁ{߿G>3vX>zQuIiOa奀cͰɨň+ۨKY<(XHEv=gc}Ei~Ui;7Fٿ8HBBnv /Sv j4AJ*QICIQb&eAȁP0#Tf]8R'>$m]q[왁DTGY0a|| #x3$?C+z}2e+"FmzON~u=Bv/:9R 8׮hKp. ħBGxc[kH [SD;5kY$(58;qsWBON﮾̙ݮ8;Q dlFXzw^L+9(|+t6 ÛuwLX6`s.[<159A~ 5I˛A9JwCWҨ]n:Sݪ5l $j Gޤ8]&{G#v צ;+ f 6p)"Ӡ4!]o 6jg(KCÞ}AKcC(D0`Q=F[&{kL6:tP6/Đ`^"_u༧.P{\~h^:IGwFŇND::xX49ӹZhˆA=|4p#c}2%{PA%UGfSʃc {&fL0?|""6`v0Vnoms2QƂX7tA87al)NĐ(w?WDŽ@7zlmk4d5Ƹټ!OݼgTJD ~t 'Ync5&Eԥf=rm!}$ &&EV 4PJj;k8:]9B",#vOYkpHrHZF(WhbvT!6kã%t0f@ )NӄG@|wsSD[ڕsZxp9<5ep4\9?$ 2q;8_Ήn5+,hP y^ә[B~ ̳*3eH\qGW;`5m;NV`m*3O,![eغfb3S x($4"F8/9&nq /]r }&_1m]⟡]3%jՆKYY(]8ِ2sVS<@s⻟Hym쳵÷"Pʛ;7poދ&s8mN ĥSKԨk}a)AgQRTfpLOsj.RG8"0TS]m<ä0c=kqEXS=HMnUto#JȂR~=qC\Ɲ39}EPBkbK|ߗ/Gn%[04&[&ɂ-ky 3ࡗ/{&?/hUV=PDYYTc$<8_,9^ōv7(v4YBBpopYEN޴Iǐq%aFΑx ìݶ(Kh#~^1OS##0:W =PY|e#i1-$E<*dq Ӷ Owm"A)d*kQ{ucWN h=l{T|7ЇS+5 _Ʋ1[W4N8;UJl'jT{ [zswlC)P-82V+Vx9B,q^>#%eM㏛?K|+Kf>!H>~DvYP AA_F#&G$]/|k/XDk$NC_rc_qg$(h\brOO,.L'h( Q[cFwrѲ.s|x("sϬGSl =@hF[.g ǚQ;tCET4HRk送+9۝هOSy|s-Gtʈٔ5$l§:#f)O#m`2F1I!L^[M^SnBA ÷)jsL#>uhCrZCHГ дSo ~c\픟m_ht2na,&>q ӮRϊyNb7ѵEXccq7 dpO XK\"piր2$8-} Q:%XQڢl`L#^L*m"tᄔ䆠f+ڕ>e4ToPf%; {nƘ33x^w<~" 9gN "w7خwyIb,ZW{d2 ?ANjM8cj?o1@0n Yҁ;Y"6j9韇@k%J ~-|R|fG_P%B۪Y"R:[|vxH3cb㒋RW *e;*%4R_ o}EȦ{ԑ7C:3lKcFZJ 4[#;cPUe'ӯeFa^usz@ZED([ gmS \/"f_k*h찢E BdWwA٣CX3WU@EtS 6o|(8ƚ@^-2<\9Y_'qzS=aEBT4 IG{rlٝӺ ;PQ=K8Nmd g|bF. 2Ƨ9LwZE*':*{oI!\k29*]5?}w [i\pMuQϐ;'2zsRKudCɶfCvdq>ueFsfp%{R 8 ' #؈4SyVH_S=߇Q˓t٠{_/tf"j m!]lTJh3UQza.[,?H,@Q0;S''x@di 0Nn2?㬛vA&3sv!S@kxcϠ.~]xX;.I׏N n x\G=6E'U,zFy|Ω@8OhwzLF`eLGꅼΝn0gm_wP/eJ ^ "uwc u :&E[:b47&/"/о9;,L O^)qd% e`Fڛu=;4역w;~^A9h83dfq|ZĠZ!`Kn =MTf坂FqM\6\ml%*-$Jy4ϫ= w>ҺN҉W:7Elv߀U/mh> *-1h ~*@NFˬq͙kFڶb%b(1sM)Ny g G (ℯ?Q e^aX]T ]V? XɳoS5{C:Zpp9mku0`4v<dP#6xUH9g 4b[G^-jc5 O Fzo /[pىaFSShYqqҧ{f4߆9JfB&$JbA>S|}?eůa*xApPz'tÝ# [Rh~/zUm!)>8elm:8S}$נS6PmDbǞ T$QR1IjpBX* c*j3*{[Oݲ]zR3%|XTΥh\I\r7z+vS|c:75,8Q$O{5}G1\@-Xl_J͡P\H*5`nfBrvٺL\љ@Br U.g&? Si (<&#eCIunN~6%6)&Úũԩf,GgCQe49?gK?:͏ªK:< [ʕ!;BEXNOϴ?ꤳa!x~we;~cnj"%򸙓 %]vmgn `4hࠨ$!ޛyuW S%s~Eړ 3؟!s=No2V%|w8F7dhZpV18vl JTI-ܑ*봨? PIȾ8FW%hRG+'F}S¹9Ռ;m+C} X4CAoղG wCht6qNR;`]ꈓn\]vQGK'6/E^B0#:jHk{ݣį׍aޗr \9~<:%@jc-AlJ@ğ \|}bP$L"\7n~ SZ0n#op]+9xe*޿z  PkmZt0zԯ{iyc @UoT )"(~r:c1`祓xҵzac}>8l+VVӜOˆ **S:4' u-$|>W_Dԉo6i<:7ZNzh C̬P)%nyZ }S,-e۪auS:51B}6?E(eK<]W]ZW.|mp0}MI ,vsBBرd 稖@9lY[Z*#7g?}]Z8z ^§MHqMR/_PVp+` _݅O&O+§*6WWeUnj:CώVys[$g|#2c|GQD9He=eϤ;l~;G bL9ccĠyb ϛD܄ R#Q#"U8IY큻/07^d޾DZJ' IFb| 9q[C!oD. Y3I'Eզa[GpC,#,4Fzxvta$.ꁔ,mC|)W\v*vLR[ BP,r, ۤUԩC*>I)F|r j"c?ඩ=50.}%;+ S̖HM!-iZyN>2P:s=XN`DEe8)sH> bYzC>P+8{@;p烙vXvyGdv7uQQ{-::Q ,$ӭQM}Wfr4Sɞg8Y}ݑj(Z#l%ɘ$",6ޔ͝ATpdxV1iN==4?C+jtW{)r- O_HRv5a+9 XW28P+:<-F_\ U04Z0nL0oFm,śZ3ZG_l,{;" itS!&I$ûʺ!kRY8]dUGRVUaSs!g)1SջPت| |8I68S`K vyՐʆB FiYep}<5fWLJny{dԾ`Zњk AwyXobǏ9^ Hv78 0>kC`!)L=CߙA-+*9I.vb } YE9.yuj'G?I;mcg2*{Mߣvk0+ṿ*Wާ" _}IH WWKL?sogq|A33iPtfP}~\l/w fa6\ToW.OBgZ|ЉI-+?`¥ ?3C;avKlJj항<[.nY `ڎTpGQ%e-dn"S^pڕGџ>ELKmqK^O# 6N _}ncYwb&+~^Fڋ>+Qu +v*.8 ᅳN_FÙP,}nY{08K[`Fuaζ)Zp{# t7'q|-3z@3WEA3z5d']o~0N@->m}Qmet$lbP0`G?(0@q)P[+;~۔y-6bM (k5^`DsMK< DS|Cӥm%ivo3eK_$zMԸ>`3fQ_ 9~W>Kn{V/IX'{-oU4PӍdfBÓG'!C&+>ꙇ]:pZc挪ig z2'gK|> Po@abXB5yairDҁL֫v1Wluc+Se1U(8;hys{ĺ g0V V/d-y&?+\vq,GTYVƪ[#gB5^=KG~-2䇎}%|ۛ .,e[w:>=& gf(Ntj੓NW83G*u1ǎK[MN̵@!U54vRQU g훓 bQ+yCvj+#k^/D/վSy =HH{f@'C"BOÒ2%崍j{:]*1fnā _{ŵ'Jl.v-٪`PEdm )J+~k6tǥcu#rTh9 .0 s#roYsն6ȁffH㫢A9 *;sc}QR)DnI޲*/c}'i$W,c$^#uEX 6V%MU #-g3a$LߑF5>@<14ݏ*}m!3jBԩ?V1:p8NEqWIԊȗ@ߪx3!yTNZ7\|("-@ .{{ۤ4fCAq8 /8aBt2q0KL%@)ϩj{kA1rLIw=ٱҧށ`VAf:OYbd,vbE2,D5M-?7Xd\p%,b Vg<-NP鄄-S6:ǪtaY ȇX.7Z0蟫"H[HhWA}GBP-PE&]2 J Yt3lkMI|AU=w]<YEn:^F8#aڴ\> MʷEP;8y 9䯋_36$NHꟙ^vH{Y6ԸE&3ЏIс=dnvЩ!{VB.S D(vul:+ ۞S83 8 i[{ tp7|i $C??|.A˯'k*S B,$0eZ @7Hio2xݪʐкH/&D6ʕTk}M\ rh%ToER"QuF5N9B8]"^FzoQ>`bH+]\"( MW [)i_}w-C'cVKSH:n`dM}mvDL7~J/mm~z2p򤆢Bp𤢢s9kQW3J9^"?/ .@Wbe|jBʯ)2k.V.u d¦Ϊ^wiI\Оz+4EY@ZI"+W(hZ'rm)=E Lx ԜajȦ)`tu8I$XۊjN>m+<(9X &&XŻB5D7ym܍)em{5N`ް^@EQ5Kw=r$6@6)^j y/ ;+}H`e`~}Ѫ$s!%\u(h7wů8fxzq~39Y2`}p ziMȩ3]9ٰ-#d6S.96!oكS.ܐ61&ꥉp ܖw_YI788 ";RLWj" f2 pji~+dH Кv!mQ5$h[(+\5Ԓ. F1(J4|fwg ϥ1RB M$et}{5MA +r87*"Lg6--eC'pZXρ7裃WRqg a΍SaF_Q@m 2c;,V.RoS*it7͔t:L{ܞm }U3oA?+Uhp Dㄪeു" ["g$jtUf|Ν*۾ qΝ"Bh,dQ ܚr#SX/㓷-t E-%6pw/rx cB)8L`HfF }Y>`G`RT&릝M^N(d2'!' :N{}TNK_a-mYu; n[AN[ZpIb>0Hm)юvk?0'Y6`mWFAK"ZI0Qx0/Chx2>pcɲ k)Tpi nPQqDljiD \Uhea>(;kR*.J̼Ò(G?^vu7L*j@|74\\"t!+DGoQbDUZohd J RlO-8${zw/ R#I1M 5l+֚)X7*}?O%nRP'iu5Fвm*XQoB86j2)B`>|CŽ6p:dULoH$N#AqHnK2a~Iȋ _h_V:BJbh#gN^ͩ^E6,^PHG/8%av1Iک7ǿ:\~JՓ6\t8%a}xzٙ`5e9LDLA"M4bRoL_;˗%%̌{H׿~"$)LW&[Ul-9f]!7Qt%چ|15wdPuwCE>:̫`ϴ>7ȅd?{5azR3pq vsˡ@I'+_Y<]Zُ ۨ_,ϱ~rR}O2"l4YM98dz6|E@xFJqR ,(؎6lb_7=J2fy,Ec[@Jd! L PЪ6%eFɵkqI %6Om(SP.Rr/b[):TcDGMv?ՙ2\I/Y &o/ubCdIL{e- jq>rMt)o8iR2% W,ن\w_;i[[]}x9rk+u}JxшّO`(&!5yx.ݶowݕ|i֡sZ5[pt(+RM䩊f$BҮdbah_.s,B΀O'ݕG}Pc$/'TgftfdJL'Lh[3O?:ӺSgt-NvwbNFw魆`-Lu- !-(&V!"B7V\YB2gI@- H蜣M Iߗ.N*QU(A&~O39'@K筃Bpb7]-p"Rn=EJTk{!F>^ھ0X^JmW_"$:<>$Gv3HX1V {) AIb7TH#[%uk^2jA Rn\ 4(fE"#)QY$nO ݂=9[ s )mBs[)Wq#J5ɉh6y>$9sQ.9 :o5ڮ6?*\q-RU_y -q g3ַQZ/DX6:;@t @=Iln vQEnbC=d z/rlq& Ӟ6\޻=|.!_jȼwS}-"ac[}alR*!uOp0sX^%eK<)p)<ÃQG㭖DFZnlh&{CD$%^o]F}.3C*NWؖ~: ?,T<~u8,$י1kPYZD_F+9&lO~{,p MGfa彊F6)C BhF9Iphnj3/9̹2/Lh60wsyIR"-J|v024I=\0q ʠQvHȮ zR6@;R6)EV_8/Y$Yt5<"oQա2M2[[Eb"0Jvo9Ztr1;EճC:¬˘ܹxSU\c[b9ǵu7 ||:gŅ*8P.Axm7gTiRNbiB4 |>Clp= ƍ.A^+У ug{nzs*xG1 X 0^蛙ֶe<6:_%%nD5Ƨ"ܚCTRoDa[FS7~?I1Z:ǚ+Zȍj}}Q-:TD +uL%Toсm _/"Z vTca 4/qGDh$5xi҉2`B BB;9_4{A~uf]ڑ&}#{p /<> JUɌ i74i'5/L6{.>R4Vl,"Fϙ jZOINX'+?D$l!RWvNI!D=NF:"772=قKLz:䃎7,Z:,DXCܨ褵{-!"  _k 4;_<ޮ` wiS s-#UFȑג0+AcO\Im T^bpe|'}d6 I `wpS.+,kS ~֜ _6WNn5)mQ"a)$m8~a0c_xZZe]GhQ$Nld%TQ}M "64pգ&!Ka9. 6`v2cͮq2!ĚNSc[WP&w$[Y&"yLI@P(au G\ͷ:QEBV5cOپ @8a є;`b+c操2mV-3YTPȼ ҕRmU.p1J-h>:H@ci#sO &GCawH(;3)J& T W$9EhLDZU# SkVfde`UdhŴ[>R/9zZ/A.4z%8ygxP;yWm %ӎ)JNi6,d'[~# ^f gi*an5t!2;Rvjc1 ߍ^~yd'_W r~ӹ @JA6:-uK*y9(;u{>Yؼ 9kkTd'f`UhiQP$D&?nt+ʼn6G3^v$ɗJ),@ " I]*8?²f{ow*3˪r P)4E4 vKp"anJ553f?aT4+X?C) D?dV&|cZYdφcϻ@ wr?b\1Q'Cmwv]GH}`0PzL\ f+ X`s[dOnqA{DIב'шcG蓎Ϩ Q6zOFDQ@{ihJFcI>=6$Դ"cu<%ab`$ zF{Cn;81{gfs?`,&xЀ$I("zZdL:em3hu|\UCH^ƪN<]]/C᣶Q'f{!%THcOf!柳_ϒQjlvZ8mwՓ_W0|mVR5jru.롷ZtOGeL_^UGK-28P17u+juw%=T6!CbA`R&L%N3Z}OUd֏H冨zSS܃EҀI%z9uՀxq@G/;%޺Y;ωD  d^/kF]?S.0v׳Wy@$c}&rw08uNwq`P~K3aJO0Qmvn!$y:姃S<+8:3r3Ь#܊t7&_ $6DkwpC=dqЋt OA/IZ%_lS#Fiկ)cUC|-jTaqT%V~v>XKYyQ>0.:tڑ)@Wj$e5.E#DE[Q6Y5?hIbxV$>ԿA~inPZRN a a&Yy*Nlȯ4!y>+߶5p򫠒``8a2eGErTa '\~[`2<`Eܒ#7䢦F#2Lff yeR^d#_}=E1HOU/32Nj[Yfu4P*_DìbX>tvk!p7Ns)H/*_ap{tqYPތ.Qbƍn졔XOar9@2@~tGAPd~"u> kUӪ,uBq3YM!P/Su'{,Xf 4.F.2lZ%A34ET%9qp\~J J5gjL-'&mOf˽JCFIݺq SLz' It5Mt5=i9'wKS\fhfsPphz+fkvWo>c!v$k6oMk(ax|7pt|31D_sx@CJT%fz荨ЛEz;J 'V6/J*Uc{.֋2ڬ?d+W@񥸗dØ5Qn̨4cKVd#NՂ@CY L"@9TҵTśi"\ZMFd]'=[aT B :ļwh+Fgɍ;Ik0Xc25>4$FPXna\zzRO `*AG;vŀ$eޜA8n#:Pko @+ <B|tǪITC d荕[|q]KS+=eCs'vTIi#LQF1WLsV 4V_3t&qj;Z97Mu RE0rqۢs ׭: ּ {R@mP2ݚ oZ#'n&Ui!b e/Gƒçe-B.?vU>`тf72t7.|$&A%")r?9X_x!\@g|Hٙ.S!ZG5_8XMq@:y[^j?a!Znv3̻6;;CA[{e3TOnD6Ow RSy˳xTv yN4$98 tј6?pG(:=8xL!d]tꂣ.Tsξa|z~E,H~Ӭ@|u||%Stm 1<-@|@~f_1 P=Empw'i|'iƈ0vVO9\AmDQCJ&O1\aԨѩlq@ DH9o ZV 8S{+wN*Cّ=*hQe'4)QP(Y0a,sސl2|[rgT. bN8QMШ7[m`= ۝n˫?[6iҹSpxE,QG5&곬f*Bi{ƼttWba{%9$ *7Qa[XD$RXW`fk~:f 9b]jjC|+o~HϹp/TobAD&aóLjA"v{RX6>Nc/[EyD"4R%A#/sÀ"}gߡ`.hES6ؼN N$-ζ>ٽrhy;K \#y=P.MFwD7YJCO}4'e[R/I|+o:o ҏ|yݻoxmU_euL8^}?r@Ͳ q7R{==r־8`h2d*(}nk߾FxuZuN^OxJBgle&(cfHʼlxUtaSi~m" uӄ@ [IMo=M  zm2XDUX\fRkۓa3j0~3l+q1$+ 3PN@!y1 6`ޤ (q(uꟜ8y!XGF`22ly_3;|SN^v(P­e M:?q~"WG"W V/B!qO)UU Kްh=[@YbIc#wbt*KVGZ;[J"rn/Sw/&Ovzˬ@BiX.˯POo| ZF_b5lG? `K s v;9uiyFZBG+r<*΅` 1A+jJ]3APcrp^.ЎT;LJ 连(:w[l'C K$E c~OL*i97Zg8pA-wabSkhczm@*I$ .7ɡz qԅ/^ғwYV5zZR' otd͗ gڟ[\-* gy 9O'GHqf^ r>Y´j! ? sv \7DO ' .!:? ڎG&1{=ủ+fnd:SYʁE&U gV$I= KFkؠ>Vs Z9f؟ɳa5#cFXt>t'B0 :>ޗdD8}|ppM$9tۦ%̠Tǿu[ҕHXrT$-T{ _ޖ,t;J~j}ՂWA (*@MV^eYZSQfI 8=!f6 O}Gele5FܧfCu4ZerGix&I$HzTI*٠\!~BT`Bg'pha\0-K{pe bvmuWATbX PXts.ISnˠHD`ОP_ X:Ǹz7k5k/+A/|(kSif@PH"1o1CJ0Yױ#_D&nCb 2&PIuX\5D8D9*eJ6pZ8D3|&˫xAVObQRje.ႍ$hg,ʉO(N%UA콪jыq=>⧄?̓^@ .*z{6d T ϹYMO7"],<׷k,px"t˩ N#zW|Z+ؕp>F1gԇZ@̵7);e}׉E 6xIJLԴǍ "%&e(0@ACj9T8&aUHw&N'6 ~;tO:GF$DawfV$:׋K , x̩.dqbc09OSk ^As )8?>/c &p!*3{FX<)׹_Joc~ZAoofjRGLa-Eݺ<޷N/MHe1  v(D#'_OhVU]vDFFl|PGҌ/r`ZCUz>^4IZJ)PB-M+$f0wFSJOh5P삊עlS%&{K#( Cx_4,F,y\j5?"[=b~?9Zvb4d}' ΃X%!TD J?!i:Mj"]\.[[lc]4{[}JｕN{i-c6Tz;f>AbgD>Ft$(M~TO˘OjۚkAhO]lqkx-޺*C㵳cٶw#۱F|e*ހۜ}):ѫ[O|:]3! …4m^VB׶P0 Ur'>v+:5 3EfR1/ >axnJX'SQUSO^<F|`P6ACwaCt!EVsK? AmTLNعg81瞩#e/W謴x#t0/)c@/jJ)ALpݬ~sGyTK4ؿڧ̈́I+Z U~F"׆%ۻ nү ~8X\ˉ{=!2L\uuM;ayQ5D%._qG'z|!ݨNBYު<ھ`uHyTOvVY/-}`?VJnv1v+`Y0 ѰSLK-Nu\94;0>XM[֦\arq'LЅʁDTeT2hJRsG6F[YdEݟX9SMTPrɎ5Zw.6'yccO0 0d#?zUG3_n %KP|n/㸲,l{ A!-G27%ZIM5 oWxzHp4b5/C:z /de2stt.@؃&?7'ɉ*,q֡BY 0n:te 'p2; qst"[3[нZ7RN c0=/lB@uJCҌ>E<򳟒Nl&tjY|^X GO5 [H׽[7,a*W VNSGc}jl|. 3+|WUpxtZ.S]>!n‹K @yO/^M,I[\d+lQ͘a? BW-}s3goރlcYm+ !/x~=xe "7!|%}t,uSQCз gߍ!eӑhWvM|}pRLW:* fMI OV}xIJR`Jʃ2_Oe<=e;%@-4̫ af@tͰn>ubQ[6sc?wɽXGVuD ! Pbt\rO$ӄ/=Jِstɪ$"ءRJ?h9]v#~"ẈQNP2aN@@͢o$n8.S e":Zm}z4Ҷ]$=Cw΂uq=G꺻ewE*ꠀl 囓dMa֑M9/ հPw?i/!TrX5Ox(Sx27/$X 孱;jk5 fk}X&O1XJ)Sl*:bqɶ_Ě%*dL ļ[lm2J__J >5@:¼IcQl%L}vU?L,7l,lŸJ؟FD=Wb74`xL|lIJA/&-hv'_{$({_"Fx&WvS~gtq:CۛXeVA32zD.}&Bh #Wx(ݍ&zei5 vApcGeR_]}Xº.mYk2V+q1tW'o^s ̮BJЃc5ȳWẄÞZy^.}$ %w@)u!Pq@ov\\uOmA;YɷலZ5Aő^$LcB  &NWt̚KGVw%ޛQze 0ޭ7DID"- e\r)$5+ߠdP0̃ cJ~,8l 47ĝc4+35*${ 7=2Hy~E^аZS,^5kqTg1#+hs,=f~1KϚT:DHbՄ28iL,,$z-< r -kHۃڣ}v8ZAq\;f{5JfE'JjG;,&V:a!jpudk{_j{~͢f@)y3 *<,MDKXoip6hW%dHLt-N>j?4nQ{m'SF ]L#xTdO$#D3696فzྤЈ[rQtiB[SA)9 LntPuԟ`%*k _mz$ƿL $b{ՃR$qSnpLVD-\*c_*[r6Փ`nV&9TBρ ܽD}J 1pL>AxJxTcl9g އ#UDr@%0Y',Fƥ- U\a8,5\S>Ȱe(I-mHS"ϮbَD{IY3WidGŇ&'V LwB nn_8lѥp?82"L6+>橝.$7yBUӉ>C/&o4j3d.mUm&o}+.J"z:(Q մyGVbtfX<5"Vvo٘ J^vȈx+A?34Ĺ&rwYn`l2?*/5ϦThӲ[9 ?!dMfW5w1Q5ƽI~y T'~H[l!6op[{du$"0[Mb "X0oI%{rCp Nuifn^PZogR`wqԵ,;"^"g&J#JFWC_bXJ1-Hi2b/TǍez58b=bF-0|?i#P %=:Zs, '<`ar;A0 EDF.KΚިv\ EULho5m=ou% \Uxn W&uBT]7Ǿ8&'kd")]C?'{ y grᲃBIzYR'x,m ̯ u051m~Ow}2M&7=3b<: i.5T*GNUY>G=L=ҁd0=k U19 -OrwSrJD]1 \WhνiX➉j*͒6g: 3J<1|e4λ$/o 6gI ǒwl]==ǙP )M>jzhgoJZ>d,6hV 88;vRH74^s܎MG[elP톻GbȁR} E8%$aNZG sdP9IDSL3=,Ð|b\$^&,M6[JH,Œ4l`tU43 No{fA3"SB̺ΙPIP[n!%*-RڏZWB~BOɹUG=kJmu(MePJ|$yK= u$2 9eK$؎*wbzK̞~"i IBT2K1tZ2ex|Q9@yLrn=-6@%*Ϛav 95sʘ=dF"H~tIl>yO4 . *X+hv:ROo5h{A'Pڭ3ލ 55oLIbgԭ7ƃ-Ji˭./kTF7fA<+Kg|a6EyƊ^-D1L|!@ ];b. 8*z@Si\GtCQ:A%l 15W.='`%*|lUQі 3GҳO9. ]*Pػ hV8 j.myyZ {J<ţ=~(_jV~Lc(@kmhbU *dB8"з#薝L_rV!.M]v5"&EŎR7o$I@6M (ĸ[p%{f>KKc Y£#N`p@Qb !Uz>#ݗ |k PG".jZ˩-S/u*4]}‚[c6_GX?@ƍ~jSE ba{NY|nU2'13arF+VA7KTFr>,Hf %}6 2 Vbm&^8UMx"fՏz }qzet6% %dUo(%<#j )kd¿i+5-IEtj?ƻPB*a NWU'z|FIr:E,.n` Z+@#\6nB0MKq_nR^6Sx'X B {\8qJRq>/wh 69@K eu "2 P#|Nz[ Usª>%9sl:BV7J|B 8V߬ ; >d7|:Cm֬Uj^uNE4XJ$$_FV8@x?cPI,u%QgRq|$ x) =|GeSFU#4{aߐw|ôpB54!/ iV H%t]'9ҿpl?g"Kbd$P6p=.UdChJq\Zꊽ b5)nv*NNuߡ1'{^r@2 ;=~=۲pMX «'ܛpy])!7u 4oIXʔ$ij=E1omZ2Κ6łXPٟ\A41DU8:ՒR}aV]4ʀR*d}Q:TŇP 7~\t6DHA ݐ:FavRaLyrÑVHڶ~YDݰ!li]ی:5Vh0^GVBTeMU@}%5D~h|73HD!rEsD7?k'w+03 {@2.v^FcTLM  d8m!m7:6KXϡ4m?fc>f@J行# tΐ1djc w%'0qH3Sc1& ;mYxm&c-X`Aϐڻoc_Cl9pXM6u[PD-|i H;z2,m%H+U+xv}1׏|G!VLPT]埞wuPq.X"!ܗK+NLz.w" aHG653r/8`K og[BPZ1-@N+ګ]r뵁ݾKVwz QwE }#V2ȳa$ݵ9NکpN h(?uhІi{K2Z5~M(@8@zʺڒio4y/0s˧gDXHP&KW~gJ0i${[nQNe þoRMHۥ K  j9ϽDP? LjzCרǝoWPn)#,)4qP#_5xe3#f8NAZ6"^!s&PWi+n m'k(C3‚˫?Zo XL_>C^ CPcxǨ_.֚!*:d|gI{Cw1\ KJL f5w).⸎k?xWj~Ax G~ c}J\=XJEjZ!J? DF8$;myc/a ud%\Pf?"x@ qC9oV x[ =^Ad#?X_>Ւ&e3M{)qiVK#9d uy51D0 xqBk=gHvz ȑ||bt/Ss5 Qv={$ءABPu4\vF{)EIbdoZ^H;yjK6[o}[7U>E?AM'>goAVq"W?Nt|oPBA^We`M;&Cw9#ٞ,k &i *C ?>ȀĐuVBGKtBO?#tjԠ+)a1=.${"6"BlZ|CDEwM-ra~Vr Ct+-HXU)A`ĩYuz i!?+]M?wF ւ/ λp36g0`x@ Chqڨme +w"ȕhՉ&]e#y yfq3.=O`>bSզ AF%߆*]VPg#=w&$~ȻX{3*!/.lDY8p*3S=a b/ *pZ QϾb:5=j.xLy)F #Vj_Ң9`+gfe1!k`x4jXsY3G/rH䎬E̒coW/@*s2/{ n_*Zng='rϚs@N|ˀzs&>)G焵˿1|ɠ;1'0/h}mQUlMfHqhpQ%.Puu!gY]Hce`$7, D^Asʎi&ɖs5oP/^&d|5j`D|eb<}Ak!,i]{{0,^d0ߗރnfE.zB?"jʍ#CxEV$97x-XT-ےRY`h>ȝ "mc  h|̴O 6&3Hޣ0ܙ@.OWVFHSMHG &_Z9k )F7UEF-Kl|44rtcx+@ɯ8FE>Ja,յEI=C6]&ͼ):$+FޠoR!UsdžX[CW ΞjݷFcD'>B\ SnPJP\gZE=dCE )6O Zc| 4 o: r&xT>O_M\ȉсiXhEUIldz)R::l"|P2x$w(Jח>B+=+ҷ:/Hn%4ѽGpxV[a6yJJq7 S+;Xve^< PCF=#nOkʼo-0Ǐ:zFUIJ&p!l"ateK5NX4졾KQӣ[ i_  A[$)72hPE,&1p,dUZK}'_L]Püt #-2v nejD#m~Mya\= 6r%u*3HKbkTEb$GEZ"ٕ-햷#B}#&08BPkLtˌf#y> _rHMX*j~l8~|TI(I}}cuT%1LK1]at#볹@ŪY>]:EQD+@d_eZ Q[W#zlʵFVAw7iR Lstodo0J.6 A顰tˏ¹E# \Z~ .I,]Q9)d041'gjn*[_vd~Ιp~뻱ȡWHRN™C (ER9 @a.8d+/ 5x <7շ6 $Yr'ǗΣ?1;宕\BTŃ-UW+֬6N_-mXLɡs9ȃ)6pz45J"qEk{ CzfX!w tӜKy L;30 }frowfU2%45h&RgZNYG>t*Ҙu8=dOP)WX#4;gVw:WQW+F~y2W<-\? +PBC$ʇy^+ڔxx%̬{[ZĹy*WK(>ڔ sݢ-Y+tb#vLe+ClI-ΓF,Hˍ{+ T"X z?/r(y޷{axSC pd+s_y{!yl|9y'ߋ o㿩&uU)r2n\ᮉz*VIZ1h_%%T|1OW]j!&@ 7)4nQǺ8NLvwE;, &gΌpc!\k 'efS\87!1Mk5_z3l^qUՙ.L/X ,PwtaJ$xР;rY̸߳BHoOZy֎/o|ftMnFSi"'ѯoT#(V4E%,f;p*WYEsrsBrJYG3ue PBI̫ }E`4cdkK0 Tʯ+lE/# ya_P&k@ )P}e_KK4y':mޠm5 qpN~a MaMM0o5<(*6)hg+?qOPl5>&%j_aꪧ^Cy(ѥj,F;WwQ`0i@C? ! m4ŜUi- 69 @}b\vg;$sM]75<:$;1H]KBz9㷑S_=Pk8S,N{mtw-Z9jOmǯЃ._cg: xg^7dgϬ) h`S&Y]P 3qlP ) ~AW2y{^ S5Hf7 uN]ⱋ_Oۡ]Tiokx7s^99w7Zd !>M<ΡЫ\U[sZKxxV+l_E3' 7ֱ{7RZPSkߧ \obW糡 ׅN$z.oH\U+<5UK:K^yXy$f♞}%{*"FǂaU&[sl_Q_-3&{eb2~?S2FG;uXQZ|Ӂ3A/} n\ e؁b×qQwks Ġ>I,5NIPQ 0vn.쥱5o{k=QT6i XΣ=7X0%6c_iK[uP˥55@5`>]c`t}x\P6X{B@lR:NBRsVGR!Gjb)@EӪ;AwUcZ* x|5ը.JI Hm=jXbE M|jfJhJ52"*Ġl`^olHM]_ ӢGP>SyI+AN&_TMDz:2γ]f(?GbH]pF0|u]5O |rgJ 2JG.LRtz~M$4qzpEKo@N_+9K(q' :`7HOީ<|E~m>J3`guF0!xb{gRoiw}!۸=e_2$c)jSΝjf(]c}˵d77^"bXU+8qI^Ul'`E&<0RFFjʁ}(d,/ukc0sV&s(%SJ0 s?}͛vgPr?pG0U iFA~mAkB,&/.&{51*/- [Fv)UTmA-LB0։U\|Ι53zll;%tY=NRƚZdP}ގ9G"BmGr!B?04>,v %Vshb15?2ةicD=Ɓ01>a'ERF8,|!eny^I>A>Ͷ&ɺk !9o& ;U!P0OzH<*@ӭCC6;'.Yڍ 800&_V`~yt Ŭyoz;Hmt!e*6^$ C̄'Ԏ{üXfT1LI>!>:%GQqx6S qZQ=l EE_QF( R  ^\L7p|SZz[2Qg7.EO# Y{*5T_}je-Z ї#Bth0#wɉ~Xdҳ;&vp۷VZPO."T@pޕVneWvuh”'cY,*ʀ3%]B楟e˧"nOBfzx/t#h} $:i:H4>26p&읡՜4cя,렭iY]Y/ж}c3* x& ի^F${TToxC#uz8 +40nZcxG@CԂރ<)vb]aٺ$B^f J=[\Lɳξ5*U*^tGXq6J!V]tgL'x{YR:&6k ˄*QH6MsҎT23 D>bikD[oFP=k}-I/]1Jqa#X%2twՐ9L YyTTч-K9.!޷7v7Œ3.0,I?LUsws]|MYC- )9?1ü˜Fd)|6b,UBrfH aʭϩܜ0 M cy?,@b|^G/Z۰z'G܊Zk}y9\HR 1(ʽ9 !`z.,3Ǝ`=F$?2X=uTeL ic?9_"tN#3[u:r)U9J u@˕)TW֭MTIeS|/L,eΑG~<Ԥ8C*W=e]U2,!6ueBM>7>+0h?ͼe`XM]Y2L1pbWJ"H2A?^pQڢR|L_0[U$o8/qBD7v͋%X\E5f\kfc#[GWk*KQ7<2hL1}A N`KE(-,pZL[ g-;ّQhR3Gm'1@eϳ;Uig"-2> e=;֦X%:r (?z|f|Y6]gPK OKK @>1Db~>>ۘ*MI?x :#2OR371X/^Sb? +_}?ӳe9>>$ Ë̬́u:eq!=:XYE!\q!.5mfM;ո8OըkdJD^FJugJVG޵FBe 7/nԮgΓ8D!Lj-~[sJ~o]hmđ~Kn9`$5\YӼ럌wlh >~?ƨƙo,s46Ȋ:p~]Mz;jRV, H㠗-ˡ;zMLEH**4FUruȡ:Zэc;lqDHd⹼1OoFi7TɎON &<]*х?MVEIԀsg/.ҍw06m"TTurTڱ?54mza7gÜt3ȣ|if6FtpƎ %iaԃdJGBkeEo0BgJ^DQbx8tӤj&пjQ{%Zʩ@OSK?lY?UI`)qy8C'2ut-Tlĝs0E7ۋ\o]#Hi69Qt7 `6h1x( %QYbo3A{ ץnJ`&=B,VpR1[2b`ͦgd㖞%z˭%ЎL$Eɩ݀&:l(N>ҲuLo<}ɶt^GI Cg{u0R'rGuD"D·*V\k74#H%62kǠD ypvG*1tqڡcLڴyh]>;+A ۊ%Ed=8ꓭwO~?>;L|JNE 1W% :Zڨ.ULgu$EZ{09x<%S#z$#8W`,s4Gd:0̽y%__|(P6Hnd,xLr$ߊ$Qaa -Ⱦ9rkw/AthLG U;Ν|U[=Y^FQO"ZHD7e%v uʼpU&3|R*+?xM7=Jz`^0T׿z'Y@:Զ.&-s)ΉN\~ݱ<h35MY , MI*7kLMS Pl=-[!NGD4y ٢.vUfj4jKC~): Dîx1֜#> V& kܚCPW,QYuHyA0T׷Š5H6.c EsIԪx(T䁀W? (*0x̔XʊG?ڛ6,da0:޷yOH*7lzdY:4i 4iblrPcY)]dبֽ=})O(DW ڧO!":=#}!a(5Ӵ@&m $&:JV*-  ҡon!+!T.L^!~8@ M>(cR5PLYf4~Pٻ9Et܆R);(^1@iix[ n.Nsޠ43@Iq3@C^s&,_h(| pa5٘dr38(qU;l!vPpWn[~% e2 cƇOaEJ8_O=Euʏ5+TEV&J ƇMd;m ˆ|$PrwOe!Sv;IhSXY %*/9P~ R|?|8syE,q#|ձ:ߩ&T~QXfdw/ڟU{/n^_I):ݾJ4ΝQ/(p!O$Mkq]9gai&!w tdi ~U ccs 1B-93Ы_9[ >|lַ ڼH2cʧ)aB"+.6.ϮUOD cHщiA|(C:MyO rd_R! a40R?ڥ]`j:I~p^W۾.;0"Զ+6g+zsv 2tn_:޻8GRyX+z; ~pDIγݥEu0=u*B zZtr tpq3\_G2$y&9xqgj[v# GޮT({D67]@o{`†(>| kdEW53u@khLCHeD`v{f8-&K$0) $"3,i<*!gw o0 SO"G>kgK,p1kbrþpP%;.+^zel$pFNl,};Mm:!_,L.T Mi<N;4xe\VqyqJ~ccCǝr"kU=iҶ$9a,{13 cjm*;ǹ9tDk?Q v񹿐J {k(?qТb^ACyM\+Ho dZpy29KpU0.! >_q޹Aw3 ٞeda 8gkibN:Drhd efjeZ[+IgҸ=Wk|d>xH"o= r.a0pfPmHnX  ò޷uQUMH ؐhڜ UH2+X&9؎KhKvɄ,󴊀x[ʹH 3>#0~M{(/ XA{{G2!R/ k6wQv_py(cjyX.CA6k@1 (pT[{l>|ZsuwaU ~p2Ҽ }OS`*t1JAHK ebW:' Ҫxe4gOln`LKWi >Li(.)4'S8rQeY,cNptP"F2`I 9rwy*Ӟa e٢ 9[%:@$rJ.##yI(\\O}j[]Ow0OkCТTsA'fyX!T(*c]{PdLv,3MX D'T2͙ᜨpУNә OJ#)#@Jh4gvk~ Q]"`J<8̩=m_~xˑçvȜ^< gzPSXFX!T^[Է7 NHJO`o U΅1kTA*6 O'܄~KP^}ݭ|ɛ U-M8'`̳y]ѫ[잭"XD@&R1׀X-?w.Dϸ`yrI] TyAʅecb{g:X|nZ3łUEö$zo`Rz1Žk+@1{h' dV)VwEQoeM~>HO K}Z~H<}Ua=g׬b Z'jO@8rIT{|UX]0ٗd|녘E*r0F(/g.8XIO6L_wBf2W8]J,]&0'ni8 h, Ⱥ\5lRkAlK!#0ӵi7=eU8qHY|8ڬ)_2mޏ`t8(nBi& þ>KiIeAEaw50,Jy=&Zg| ra8³[m%<rL?K!Lu] % [zj5{s`+C Ljr"T2(|x5=F BqB] b93͎EoRѾ>U۫7FI̴b}d'K!INk2eQ(Kɭ {8VN +}4Cz7#(BFɂym"'.: V\Iko'{t1H>-Ѥh omvWJ~?X/pK۽Pxr`|3T:(([%w/={>*xz$;zb =0vV{7O}ZA!kx=]Duw6&ܞTALtZ9fGUW0PlCZ>$^WXm7$0V& 2G%n;(p@R'MB) Nl}1+ϼD$Di鏖_;PkZBa%A~5B3݂;KV$QvBmj,H3?YEua,p=8vd$2Wro"BE='@]n(%g2ѐtˍf(`)?WVy?JejN›z']-L?Wh8 3gxUPq|Ip"߉簴A#uHRΚCh>h4&p*b ^6DL#SU9 a+@[tܦ/.tI;3s{UH-a<,:IS?ZwCRQS` Z%=q % EB*C|Xr!a(׆BaD=S8#2!>޴&o epJo:Jh{v z!6S:@C\jR~J\ryDv0 wŷ?C4ߢlhnV鏋ώfH /%C3I0;C1(7T;4Emht$Of"ĄY꯫fhfiAv)2e1z}GeWw mR)da1#j, ׬b-쒩rR[ sR~=ϓJ" ńP Tz{J|+)0AUE@a懬KPqE5f#)%C\ ^`ƫYq-VSAϋUsgUOa$hr=x%#RyZsg'g s;KnxC reG:ەp4PCipvSzRj7]\%ӛދ*:B[ JAvO4dg^|M 5bS;02cT#A^eĥR1MmbA>(~m+1u)1sL$Nm|=v "î@2 | ("JG;j{HDckz/7Ůy@UpdDzᄆϟ1~./??p\pWb<F"A@< ;Dp8﵌/Ha*,'S;2d]\9tX%ݲ`U3A9/u F ?rTVB0veŠQ+ͻS6;~_%lW:>f᏾ʪ\}1KPb .C9-K{+ڞ.ĺx%DZ\@#qӣs aZZ+s&ڣ-zz2{KL>/m5W}p^1BdԱ ?,drKgnP܁kTcQ%Dpw,N޸(F-DܕMܡVw]F+պ sɖ/KK˽7F 1j;+ɖPJawAav="_ڣ 1U[e} iۺ=[0Q\1X'P'C؄ DWa%Gń'$91VZy7T&TJk$G.MSQ ĕ R1%sGR]DꙓQrIKO΍=G(ۨ?0ve]Z5z?ͲLMwe~Um9SoocבX.r|,LA;յ2cfh'_!ŒQyރPMzbVpeD;A [IO788gch>sW/ev8"_i|^C PE)x2"W ! ^Y>[戱:ثkPɅS[@ͅ=Qgyl˭?1QO ͌۶`ҨGy'jKb?ٰzICƠ$VN|K1v[4ڕZD:cV@lxI=gahᰇ6 JZ6~4.Ȼ }o[73ٴ1u\o˧L]G 6@셅hf-෗lP{vH؄_,o4@  i΁Lw؂j#~! Лh4Opq<8aax"LZj҅G5AUV*Kf`1ul |#i didxM:*M_v TDH^+s"5 #J.t]@>^۞7djĭڀQuRW$+<6-g : 0{U^t)ΙKcճ tAwլ"uK6#^Us` ț l3a_F5Wq/!\D*}C|_^oDZ SҹFek xD3EG<%UC>K!0]y˩ 8s*ÔLHm2>{<;_H˓TmA;&l,7|~zRE#uBnXmNZo/7LK9c$ꝔZ) cC&4vΣП{ږ^&E +&F$i\k44 (ŊSuﮖA ƂyΙ| VeJf ?GFG!߭_ 5=j>,_$ZNJ\ˍ17+'Fow]&Cd;g~羹D+W- } h/$$6h.m7P/̾eƕK~`b0זwmYY{ j@OĨEذ:Pq._q~/LA(ݥ\<7Y$h*3h\)eW8H V&VhHxQP/]VQFQT1vG b I0v%/2q*5R E9abʼnK^qDџ UpʦGu]La\=. ǡj*`UG/n;-ŅoES`* B_O9klQN .d{1gӇpT2_"# [/~fE<7@'MWO!lT,F37i&\DI_][K]J]g@*1J۔`mՑ+ ̇*PMQagQ?ZHanoTm>2Bu':Y/A4=PW' #l?䐶fSSA٦vwirZOtl#Q`n+@OA+s @lUJq L 4OTӓܧQDGNcc +Kj1M)hEF>^?}FDQ5[&#DŽ/ݳ2/ko~}ذ@'u{k- ntN5o(( JCč?-cA^ z)<IGVjH}.ݙ1\E-#5.!WmT9ȩ=o87bsשJyN;X4=` 'pQw5^0jJ.9}@hjBNߛ8Ge9b5~ '; sis_gNC}y}}S!~,P]/9݃>-:>S&]P"ͅw1E4@KE"4Vs$uu. <2fLזLWf X|U ]y QD5/.+Ti'(%+4nqBtԅՓvURr0 .(bGpv3H՗srH^tSp:$U+ld8ϧU$8BZқyEHFpkNex"GJ/t 8|*WtY:u;;@K4y/˻;O{ay,' oK妷,-=lH6&ˎT^.J]EXy۶߱5; b7s1AݠȮp!k*FPL ioE*%ǩWRslx3myj+ q& hb,JX<ӗM^$7UTv(=YN"hnA=@ `Eisf,ĆN̜Ls^[3a˸Or; *TZUY @JŎ:BV?_ϰN8!U%M8s&^B^wm\33A$gE`ׅ`!k ʗI16[,[(Q͍֖C~x‹=vA"j?Cp8h@OvQKM+Cca76xY8Ir:< ^-TX5 E(Nnq"jY)n"N\Gb¬ %K{wߎ0+o d._195p휨%@Ѕ+2(Bs˿՛y-$}sgT6@h^}ZAvldŰSEpuV\x&!`gRkԅُJ3^6vx\\:?DD zaP|]|HΛiQd]~2 ^صۗMS((2[北9]q݂#Wܱ=-1A6IoDh6!T SnUYH,ˢdh`VA|az/R2H3*r=gCлкu0lu? ) %odrl'iﾂAeYWe)OeWc¦"5֚(x*#F-9ѵM-Zr om|jNI#M_bxaӗ\l*UeD![,0wJR 4" R N[B7k<]u$ */$Ez:6 ITqٌuDEjM#Xqs/:3MՀ֗gA*CR{Kb[ucJ;${l2yeO-I$~09 +51:viVI %_ .81%b5>J]$kPJ/$f<+{Go?LoG0Q%D7 7GqPOƩ=>zm~pFR_Tnp?Y.>WjZ[9 ,@JQdKǿ9˫kn@r(K1.db+&щ>/ZBDOƠcJǰVx=$VS2mҢ3AG,ɼ-˓g0 RчRs'`kZgLmPr},[ƅ`]pu65{oxxO| ߕK̻ȳQGe?VvZ/ND*M7)ItB&TͼXN)_92t[w|b`sŏK.>$bNwhpqouYJ>N3א[gs1f`^Q}(RE*KyoGޏx%s tã&+Xv>`tALܪKK)kXlZYۿ3MpIi~Bxx(ӉdzıPB*(vSKPPQOUaڞ)?ο\Xe\ZFKtldub@{YlzB&b'H4»tR˵2N T;p7QDς+$hc ]4'Җ#ML{uOHCu^2W`^ToƩ.ρ$tYַ-*F(qMbqy:吴'gFD0DN~?STY"15&{) B}E0Oر3p%fR߁`r7o)aEhX݁|!L+Awn>*[v{Ujzx6+UlMۣ V y#q#av&bN":eEdKɨF5K:=כJ(BMXY1f\:9,FYCB k G@n_؆B)iac(7|] T )7mfu!5K۵},g ۟&Ě,@=P%$_$,Dx?ӆ5 ̝J7HPTv+a&`hhkXtJKŭn >" 1THBNb ,mEF4^Er`̘+h"؇ޘrPI!4Կw#zev/69hǚe :3\cG)5T4=bd]~9̹ ϻXЍ*-Y:Q!?i0N ۓW}p9^"ݜwѳ.PcjL>i8ǻWjWdj,QR E*EpsojU# WOScZYI] `SESʨQĥU2vf\Zk!^Ã4HoS3o= V:/ڒ89o:/JsukYp̀u[!y>C`J_DE"b36O}-B`˙nډIz+Ԝ:11#zeʿb?{Tk]-=C޶ ? nqlvw˳WGѐ :ֲ 'pK]*qNYlP= rHa0x,֑IJ 9ѝyqJ7Um̘ZG3rSY}x e.㖺5FU4t@n'\)%rO<0Vp#Sl_k~EĊT!ѪyLkHy/912y!c\{y ̞8 J噀#/6sN>Q,Pd;KT9dT. uʵSbX%Ѻ2\n'biY/:}>ޟμ[%;6ccLE*5~Twа >W$VgrK~{%SWR[hmb2;V@Ll̵NJHژt %ܯU/Z xO; /( \7@*ǑK\# Kۃm!>Cݣٙ}Q U?qGq/nǿbMÌwr+,? ^|dG[7$?6W^Ygvy,L[ 9J#6rh˛]͑::yʯJ?H%t|w M5.N$.m|-8CzjXTnK?r5&c>t㸑yb$珴@C oXV4nTZw.៻* !n:NqO;LV ȥ\/)<0%3dgWN@M]:;b]R=+Cbbl)j,: #LP1i:D<:L88<5칤NXq-MʏzQvjヴEOcjcyFBLzeGJlL(72d'# rwVf?B!!1gor=UvYF}z5T;?RI fհ~{._W|onBEr{΃OPl D[Խ7۔te,sZt۲ȕĎ1йX^fE <}̻-7G/KHi2G<ͤ/ϒuY8+h^ن;g)Qb&&@ yaӶHT0baYc#|Nj-~J[x<) %/ { G?QgW~52;h>kMs  &?`6UH0>X;u^-Tx1`m"LQ yUqQëוNjɗ׷F$x!"ȫ/6p{"w'bc Q+إl"EK{@Ȗ6{A7D>H$$?_"(5TMC<3PH KW9>K?:O*}+p`t~:1a/;wۚi*|ӲD‰/j:0rhg5#䖊;f zBc&ne[7-wV{N -T}=ڻ[4BOY[xqyᰨVC[!Ư-&^7)g+.2̵A[,2ϞeiVV*p1JŁ=p]X17D!8=#5qȝs׃ Oy]I\a+Gp]=<վx)voGq`DAW"Nm<7~K TX?IQSlr3 0~MЀo}}xzD??dh %٨ \'TN&KNY?ռ%8ZI+eerb\ "b7^/Ma&vċdZ"$-Nvg';@@ve;hRr('L|kzN^HC,\s+m6AX6`UB0*\Y\ FU0lu$}};vGt~D[0|hD3r'nra`D}ң%Nɉ>O:]du-N0-70P9n~؛رkWmZF%w5"?#bȼ;W|E w Ǟ5i։HNƀ3N_ouV,Iq>Ġֆ#&)?EW&Qr<򰄏< ֞ʕy)h|ŃƮW݀ tX>H_9P*B5q:ӒzeP Ml`RN Hiv&k0ud 0;wQ1b%_P ƆwjVn/ |s xHᛘz׮&8~c28*=2̈́3އهqb/8v_!sElwbj Q!J0~ٙ- JQah=(i3c8Ų c|Px}t m-kxha ’~8Bq|g/yne 8ԏJ +--v5HH#x$ !c1 ̥t|k"DUFg"yC_<1.V=-8]Wc9&V^7 33}3۷|!._vFu,zcēKyC DUSp})5Cf[IZ_ƢB;)D'i+&eRF6~]|'- տf. =UoJľ`|btynf5֔;W(`;wތo Dl~F7Ro&*lqzOr7+LPٯG@yф۞F~fCIF3)\j$׭©3m1.mv[2G0wr(^8LnW9<7ߚ[ڢ«d'eFAU~  YYg`;ͺRm=Skc+7Q|HI ,/`@JotQ0ظ VFy,m{f2/ p2n|R6Q&k#,i.-(Dw:2jR7 SEU˟V@b&ɠ#TB#RZR%c)WCeH3.޽7n S-RTV+Z8j8٭}5ԉ}&Zq&ȗ4yG2KGL 5d9Q\y۵a4Z-}3 G!dL($ʈcEs\VרxΡsI&(>)݆30sL*uPpm~Mdέ=&* |4aiV*i/H;7TaxJTm7)|0@R " }danz4! x^j55RHFU$}޿B_e}rhWqy;( ЛT~u%{ڳY_7svH-<+“f0%$5C үYJͫz]s;]}ںWKc0pb*g}|1FBcJXFg /ReM({ b,{S~#j5՘|';c~5>/Q5.D#TaX|=yXPÎ*%x0_;;g:\ID܉"q*:b#ow W4@p:!/U u8<>li}f<ș;LhU|n\^#9!R8N:Er ѨauF%c{AxljWG5IFӊQX%c~74I3{zF1XN_AZ~"g_O$B?M@y]xA`> SJ| GgtWL=.&߷H|[w'ϕH0>2MU]ZB Xнe1  ] ,͎ll~d֓F;-IQqwLtdZ̜[ՐV0IRA?~cܤ C(r\0^HE헤'NI.`!%;yPwB-3kQgK^ R5\Xa[ipdS^YU[> ą3( '"M)Ylݑ XRhAB=~(\7lWtpIA t\q#fK1SEt79\)r`fETدNB/X{"7*hnhބ5"B7.p8w>;50Mpv*^Zy!?Hc4÷.ˁK u}`trΪnzY4||uZjR[;yr Yйd]8O s PÀb> n5q^YDD4ֿ4.1s5QުZ!ap?!u[pMm.`)=xkd?mBc6,?5C×,|Ż."vq\+gbzB PK&Vع,Q2op +JsS(>][ͮY3| AX3F11nw|<]R1itk x! [Tf3EIJ$O"ؐWc1gfT07Zh826$x3v'V̫(vY Nh}uI }G} DŽ(~% NWeN:]J) TY=*2tZxé0tX/dЎ8- f]z98XTTݝB>.5 ɀ3mfJߵ=<ۘ:?|b_x]( =dClpJ ykeI+u2Z,"4gd%ZoruEdR֪)j\Sb3 e'$ΎA3j`c,tv 'kP;M?"-Q-vWf _ 2 1|:}@bHyS% $4T$Brs}63ZN!?oVg=4hg9Ĉ#@f` #;UG A|7T|\0/W[ P|Pej9̏鱁/ e_;㰁P57S@,?Sg' -76oTS 8q% >z{z8G;a}+h }\OTm!7i+G?fDb!(|V^ 2Nq),OlZ۪R3@ m=U hvwuV& 8,%0+њl}4=z} mئ,C `hp[YD#UX|BBZfjݏTB.(v ¶~Ӥ_d'H21k܈AfBx¬a]k|?Dbxud_O|/>#USެAȓ\MQ7wh`6'w%.S3 Bl M8@S9ػqj4pLsntpQ&;GV- vB)Ã.GGh̞Ő"y%L*YFNvl^ZCxtJ(Xa` ? (h#Ye?QGH4Dv=/+kWqUH/7!81(AߓE[掻U  5+fI(pzngp"-@|FhfO?sGĦ}wnV4:6v7ߌά 'I 'c&hF b&N]<Q#=8@lrRЭ\#VF;&8pIP'8 6G^{)l {u} :n:ܞYDEJ^l ^q ͢ibG}kP3Y#?ir0V3a,vUu5äA-ܯ졵[A?y/ SԒ eO917AH@庋,qmmDB_IϯC&B>*1wTd &x=._a S *X@U^gxBc2,v;tn%C7nN$bZY>LC%JS,h"_Mtؐ0%yx:uNB|d~xmb'tfyT|lznAKS|fP25G&c'*: bIt_|ϕBF8">YI-܌aHk[ϰR~"{m;牮TXk=諗B;wKgYEnczX;W Y<"j/FwhNF]׍=nk2ޛ"C#ȥHeS< ^/QeGjMY dPgȮ+w+IL.5Rg~4WʨٿR%2M~U}@-/{.fSz)pd8lqza~]e/UuA|fnts.ɳB<ǽı pFgGOQ߫v%ZB"'wE#6?8NS?j%|Y [E8@N 68Xh+EAc;{zTx:kM37KW<Wamio9K`5~ή{qBy(VMus=0[uұYAbBl#Q̒뀟ejc.z0ȸeJcKiusi=T`Sɯ=R! c{)3t̺ j @Y8(ƩL3%j|ӑ@Fw@Hjy߉96T9h0oZ`1]E=FbuiVu̽l/Dflͼ-0Qrp2#Qf-% p>,[{Iq\E$fk10 (8 )] 褸?D-pf$pCq}~+°r)(k8vS#!INo2Ra%JŢ [[Vo~$-*fSHމe1pQ"0oD,h|x mD]Y-,. 00.;JZfy@ZE}}. kҋOhJߺfZ^dΡWuPRa ;Ouqзs?Vs޳qK(-CcZF sFAXk%'v7*adNgiBmB} L 5{w*J7ĹZeo.(!AQ /Y6 0"fC0쮺UE 70~'~9.2 ml{ eTWgE=fw(Ͼgߌ0D G`Wd:4)82+uK:fr `k=!.#1Bbb6JZʑԪhb}eqx96~J%~vdWؿ^19{ȗ/^`}ꀃGjq{Vrv_;R93(hGZ/hbNuaeeEC#C#LrWλZ6T%2K}W`xbUd̡j\-&3+uw/SLɧрy1*xؿ.m cJv!&A|x j$?^y)-"X\ܲ5Wن-Ktq}OV;ƷW-c_VFGdivF@(ʹ}Ζ(tv/E7"E!@3uц"k'gR`ymߙQ]זEiOxΐu}hcZlQ'YKfQZ;M;ҌSB#Ku8]J>/8*+8C+槖#dFqꪟ\|?jM41A]q\`PxŊͼ]J"~UeFA=8*IsmuCxGֿ9x7wqZxEOҎ@l=9ՇV^i+SwkjşAs WI3O~UUڶsҋ0n{œq>@(r:/ Lz穙OEC;|\TejG\]gwoƓY.6&<ѥ8'JۦpRtMq{M8> DʅD8 E$РKb5JӈGqXk! gdV ZR5;tXܳ5 K{`PcٯHnxD%Ǭ.bs1V1Բ;ƍ)+ze'zL&K__Қx'u[HsѺ s/h1FWOx - g}I tΖ6~364QS~PNu- c(Sn]&|'8ז6>:SX%ua2d3Q9`\\w%Z WYk6GhGL-gtFgg58@\i*=9JQӯ_`sVH9C%k,_:K<$/K5jȈEUa$clza]`kNĠP6jj1rdUJr>2,:.QԈ7%7dSx$|tVxLcN|칇{3RhzGb|7_5_oa)I*Voy9?+ph/|ͱ.Iۍ'`Xk N9&$~W1y^\~%'] Ω^w!Sgӭoݿ[.ϫĞTkܤJ DAI\:N3s; TbV&ԝ] x;kR]\c Cf\ynš!d007\ϳ ɽZ E>NS;| a͘`/$*:UZ(bRPolk3nRL@DiAm{~帾8/qf`R qrzBm}7F<8 X[2/}UvLe\ɩ{uWUzCMnQ;0a?vE_wND#gW5s$*ZSS3:b75GP 3SOԒ[F 8&d@zt߉ￄuN|%Prsdz"iXVIE@,ѻ8wbx6 a@P+8@Tv \þfp>.J VRh_hU.[\c ſ NH;:z,Wpm'˫Sԙ[D#TӇ g cKA4U}X^TGÅPk>\ro $M&Kh},8sJ8,{Cmip$%I>o8{OaqO& ɶ30{m0 ƀcwu|-;0͚w iBAKNtњ&RgO"[-}RywgJC nݐ啌o5L}ti@es붘0«xCc#){o$$h;/*y~\U)¼+嗘xGhC*C{m)s-_h䞫%}.dZuxӻ0U`DS z*J§Yvb$y{K(ve}qo+ICM6IXcmڴv! AL4^[h]K|3 PC^t`7PDm8W-[z3akI^ E"3bd49M_>IŚ,| >ouV w fjN:r[#v_~Ͻ9:KEndS&Q)_3U0y hUzí辆II; ܴ3:%{/Z?MB*2tKٽd,Abqڵ|R q$Lh{v$C+* 12xF6l*LtI" qi_GޚV5xt vùIM iǗǗ&G)wk]JhaK7=g 2 :{QSJ'  F`.^ȶDb:鸇f#Po :MeGO{>R4Lr@ g;OtkE^e1њ8s)iMI͉7nWW"oIuR64B:L(z8*iEEoꚛK25ƿY[kH(h@Aj(S4 okNBS?E:kɵ:Dog⥸F /N|! ^&&ٴ[ IV>,#FAE{(44SgEG6tאAmvvgpF;kls|䏢T g߈y"|?"I.v=⯀)kSN]V_5hAtn:n [,MF,OJ7P㻙oE-0)jϬۤ3EX+YI-zl;oAblW?%쇝`c|]]{4qq< iUP,>G=(1[}0piRLȖ6{6FعKP' ?Ђo6)GnOk7kd; 6qğe=$طl12jk%И&i&9tb.3;腔m<{ |_K TA~FmEЯA ̒ޙq7%1(#Zeɋu`Wjvb` OО;"f|i_&cG" hǧqMG냷)!z9Ur敶OMY ;x d,C@_cc^@z֘4Qཏ+c8В:NwFa4 y"jH\drϯ>eghbDco|촰M^_vf3)_R-'TYo=F -* L8Չ`dgPzvL )5ϲ 0y 0;F[@ cg*,ef4>jFW$1q7p„17 'n'vqq%KJ|az߸r͟$,4|F6p5$fD:>7S^rvΆTDΖ]jZc[K.]i,Q0ѮD}3z Q#fNt:p~{l%pSFRYE,|0l^  ~=1(Εi÷Qh- I?rQ 0s^=p.,31;؀G%6Evnjfōc{)\FZ<~.H8Ό/%AFi"Cʴ]&sqN4咵|l sqIW%jk)f[k^9=otS> RϜ_|]6 bO|'5Vf2 3&!ZYt~̥\֦&OAp-$*1hRc!Ʈwy[DM Bi游QQRm]^P/1/,h9#kt}U>&$>J쮠*e\}.6qŦ캻fI _#Q1}$d13o_!mU n<1)w.7C^Tj+#&KDHVVVKG68?OkFn%;,I3J{r,p.Yw aHaV]+/ ޾Qh+,`|OT#Ϻ \]0^5mor38; J!ӎY:U,*h՟+ tBFP%&iPq'躛*Ed8jrPH= |LB\7:]%!jQh(09dR 2^:X7/&bË.rG u2-<uC`c戗JJcy "nm7#jI)^.Zk\D&OfxoyуfXcklYɼ͜Ʀy V& u;#X?kU :gzecWIpʶ2kfq@lð~er|f<K陮sanaMN= w)O_[/)8BhRpe^qe q،V+8هA<,0nBḉ[:ey<=ḍ <6eQػ<wʟFԏ~xmI4'6O wvG,SZSo2Viqgҍ& )ΔEr(hy1 bTϾ %gĻZ38͞lݬ4zRXZp96 ugc>M8r$Ppoʝ8R񇿬Tѱa!c* o+O_ҍJv@ R?;_RW?$  Vym:Np$ܢW>k[@U9U̟8T6kiW e%<5Q}o{G\u,p!$oM'˺RnwCeN "~fu$ABI.Q=c?۹L[ÜkMO3sӕ?yTv b}+Zh>]Nƺ9}&rvbzjLPwflG/cy¢H9[2N_)Mwq% 2Tfjܬl~e9ۭK.n$Ny?xS-Wֱ6B+a`;PfmNكl 1$5[Ⱦ* \m#;ڥhJjv՚-N?y(AQxX2pb9\$mC=G`uH-?@gA$J[%]px]@;_lxM' ,!#0< 8nnC%/m8I(AjKڙW6;'19uu!NFL0kڄ3 >dCyݵ;eu׷F) 6D^|>{̻!JxZUp$tz+łim±P+.?^HE*oiR@*kC[T~Y.q:'b nއmQ:{$ǀQ嘥~!+I=qIJBSQ?\<놓MwAf淊8(O3 R7Ah ;bKm ##Z|Y}G#EuDXyFzǸ>nv*P4DR^"‹r 4SG]Գܞx0jJ^"tHgZ{bQOzoOhFI(Y9>\'\W f]JVqB GW]?{m!rT՟@Tx"SzRQnSp=ngHM o ߎruw2*-1vѻz~G $>u"wb5Srµ$Z{K#| -pY׵[i8/X9Vbc%=$3n1p:E+c9~LD-lu6-uqBMAH* h:- y$xZ !OL}DIuJecC@fZPJ 3~|V<T[YZV|hjR BH֠ϓv7[^$]bD#la6cEڔ|/cuYY-cuV+Q9]+=(xOCX'ɭEo!*)+Js/ nRr]7KEJ6&Kוb5{IgK9ed:rqKRW9I4TK:MK]C2=h\|8F0OX UK`dxrzN*@ $!g{X<( '.$'s^wMEja;T-:ȁ5+Q}#iՀil?&cQkF|+B>J9tɃiȺ㯕MtۑC5%Iu;zR^ӽbPq//F}UuVu1+ ps||.UQGi9q u*yf;3 B.Eχ(j%WERC'u۬! OY&_ Uc  6ޯy_,ЪS C [3o8`ϜB .x/y_6%KC˺f]ؐpÐ"9U)8`eͮ^pyɓIJ }Z*R=i ~tsOfCqAKˣrVL&X:"VˌV 3K3#F-s}h`~I?'H!o,$7bFc+(w(5OԮa:0)~Kd*04ғ㤎Ho]w*,S$yM] 9 Yn~,+p}Lv_54 ݅I%pfɓlW+5,CsU⏷D05$ 1倣]ѤU~ !% #J l@9aAzIdH/L n5HÅ NN=/Kp3GU[ՁHPγ=pAL@yZ3]C6o ^v!*(ee%O5jp-<#xΰ4>jI'az/o}; ƛ0#(^DwSaZsˎ\۾Bm݌i_ofH"PF`ݶ9żU~Ax=Q [{colOcf(KhB?? AZM7d|8 GCʧ,)$f$H1"g!K_ͦA:ldn=d/O7heW/MD],pM(AA4ԅU2YQ]f~1,Ŵje:tS(6kQJk6kSs]oTsT: gň")>,'>U)Tx31%w"P%:Al=(6 ǴDɌK%O{VGmfZ[_4j]q \LjoݍDހbH~=xMuoxE4U;2ڄ~~b*`KkK<ӲT%n0Pu4EQ)>8Fj9"_)>4czA&n[I߆(4^C ;(Ov+7ˤ5Cqȕ&2`w*vTV7QeI2uVYJy#eyU5 ez)0`D[!*]>h</ * ch?"BH457AVYeY͆JHad2,YUk]wlEh(3;GXz-nR^܎0g~`=>u"YH=dMrd2 JpofS>m;ug+ԣ:O GⲶ`,A͎=5nkd3Şrxq,*B~fʈkƴhf")퇨U\?_"/@ŜHϿBbnI4~dN`6QeMPuBVw؍" M_vD\+X3 Ȧ:} A^ f|vKVPBX6 ːRfp^dSPT- 愄? 26Ғj?҉C ӄ=pdh1'-1;j'l*HM:ڨQZ31)eUķoЉAgM2o0${L?4Ȗ"a_;SEMY&=mGu8WI??=rC;1`]8zTo Њvs-i _ "/Uc[Bc,$LaRMW|0E =!F"҂sĨ0K `Ҿlm"v%Dօ+hG'sXsAŀ9=8獝71=s]r#guDDDr* F}r">Fa9 6..< +/(Y+GPuNCQSB~֬_ :(%q0WwsX'M!}{o 6@Q)~d>.~cuP@WHrÿat G6pI8C<\$k 1$w3WF|U8NFAS_n6B\J@.ԍ⦘N(np A!-U^l(B<͍6o[U{#K>9P c+Uݱ'lc~*Ci҄)תzLyաhyl9j=s8Ґ ;bGbMW.ioGqjf3*hc3B,/n`&`In矌lw_܁6F_Ϙqewn b7A3zfOuX:`Sg!!Nv5%ό(`*M2 }57"@ΗiV??X?$ZFoAkiLht R)c`5z~,fjlG"6zz|J]JֱS-L1Բ>&?UYZ`!@0f2Ŕ` ږ/[a=mBDLJKꙩUmxݠ$ވSV7k_^ZWt|AY?rO7s#=hsE<o0c-16>t_o{.K,f4*V`S,;! l2NQ>oo|q܋[0V7?-饎t7Tg6SzSv`] N|$̓QўNAX˦2 }cs"-RRoLvh yK9s-MVn9gQu@}%v468p[ڠ-gEYSz|ؒU$k6c|Z29$;_)刿]HxR5J`6P\;TR(㻰5tJ>Qq-?/c9Ɠ$_.F"܀1 j*53|U\&y+:Fb{<\eKb ]$˯w}#j{ bH9Vn3x*%bH7RP)Gۚ*M@N -I)qRfǒck`p=xwPTWg EHq:<feMR=J`qt+MueqspHsxAW]TGg"պ 3Ygz;>Qg\uس\SeIm4Qh&O+[F`ދIIF~`$WL2%\ Bfb-LC,^pU= ]z(R~_.'r4gLK5COQŀ(O 42Viո`Hy,)>s?暮J*hB0P*2fA1eIY>zRbTq{_D,Um^/cJXo^rK 'x Vd{?NtiZ s4ąNOx g̋kRY8?"I,`2bf`x>&3Ҡ\ŖnI#8~0WleiAY`Q?*]q~o!J/e~sz@*NJUlj6I,%j3 v(tBX<\׶O;9LeE@ 8Oj{F|]~9H pZWL1>ƿF|ʷNKy()D7hW ;#XD!Yz ٙ,ᡡ ?Χq#R=UXVv^EftY~i4!n$ eP(@toĂI9A1y/$rx|zdP3@[P)Wf$.+b j(I|_t?2i A,?r.rrVSrX>؀\Џ.\:uhWr ͫc N4yңs[ꀴÓoGMБb&v##b$y0ğP"`6!J 6+nK=c!6fDbc=@-sRs1j֤N|N(8߳ њOb=`Tū뱵ۛl eht,D8 nW6y-_qI淾;ޖ~ubr[XxЊ G&>aU  l&C&3FYi%QS05;< ߱aBLpLNHHt3'6s ]o ԗ~Vr(ȹ/A6Q I&_ =Wsq-V LM-NWUj?ޜZ #Mґ BXO\%k}F"M,|ɗ5:h꾔:B M6|pC6>?U>Zw@lAb#]G(ˣf*O 9ouCh:D1`i ̾<dmNh_>O}h%>nۭ2X(̩-0\%xfd} \E-@ty@g&f:*;YX`~58%i8 ~Ev#}fV<4}e Ll7n}$-)feqMMȋm@ShJ^bV_Mm/7C S ˃cH~` kȌj@hTHI ;%r#ސHR`( 2_χt٘l KqMޢQPHĽoTcf"E<\vW4?%HJ(ŗܸѯ\Yn'\@Q+Gk;]-U1WB ц;a YrZqH^BW~*6ILqb!؇s,>:3PGB =[1>칾B?U&sHBџOdf^#,#. ;Q/ ߨBjs.iVy&Y;s"bȜvP hUq͎b(w/7ޗ$rbԅB'_ >lmJzR Uoӄ{ȚN|?Th0RVȦ n{cB ٗBbbՈ.}<[qڳfTny]wͼFjYlʋ3 cymaKV'~zD2'2sNb3Hu7.kEUrD|8|jwiy :}򾵡^[Jw?\Y/c5QivIṃt| ?5pD3(]ٰZ{Zi(IEikڤ18Z*stqts\}u)ME޸/:dIReQ{ri D,u8tbc(P&gxkM7^W?Z RNK?q}nII? |[%tdHx-΀ U*{/IF_c* ax*Ra߄|]"Ka"/T6e tlCDŽ8.hZ3* rk$]pKAPEoH6C@9>Q"/@`rX')>` ,Õ Fdq}UiN8?L%m…p=e;{ |5qh.g Fcx6N$Ux'lj?M>Aͷ醕_5I$@ -a歋 1mhu `(Rc{,#0X\: N۴!#@u0x;Jeٮcz:4c3 /9Ani/x, (!ԇQ?ך=F%̥Y*Im|2ۏe_QCwHnys˖D.reŏ)9Yh{|>$cż7_diK㊋$_酆ߍ1d/ŀK}8cYlW'2GXmy|K36C}Q&[[Af|!l^S\qh߫۷Alשy^V4lG,ZE)+ Q!w.}7Eܫ6='D 9;k8wAa?rߎ-=gmD_4qSs(b6hQV W|b1xxǙe.l~a$ijCz Te4K7t֎S F\}X9öSJ B| Gk1څmU eg*+WPU=ȳ< Йe Vlo4ͩ&xc9!~o=.e\"Еl֞p:o[6A';0!:#q{8tKݛ#AIysEPH /֖lZ.:G֒_Fgjaƚ~@/!s3ny+,wɷvj_(SZ\UjYSVM +Ҩ[at+ԾiL/7VNĐme`5r2 S}N:vԵLUhc BGt1z?Jdh쫗?=\r(>d= 9~0)[f[AHt#+C)rӷ~$dJD >'k|Ck ͦ7T"xGJgbUά*bN9-&KukX9uJB4]1xt, Y+ 0< G7y.rڼ0j3 RjxIyago)5'(7{I>[n~Tj4Hc0 7j{5SNz`C>Dgmxd>_+:{mU:@%4Խ 6)/2p2+3˼=JiY^w0>0ϧ ,m8צL)@BSMn~oOLFJ`E{ cR p;_\ts-9v~ݻPѶfZ튺*ƶ{Hv˔3n#xᒡj  j9"cqLHɵ6sq- {@#ne*o1+q'~=T1cui1C`oO6s퐆99O aO\5 =mgTa0 1|DoW`;֫&+D_k(Guj sX5R(x/ޝLi^6y|u$&e,ّq/{ 1WtN嵦=!Nq~i R Ǥe[-%Sք?_bjVino4yL2Ma;QvfUḯ+7oszkOo'gpqN owdUㅌ7`W|[EzHUa iFA>Z%ProO[dbQ!m-AuE^[ ļA~'#[L(MdiuqXӗT 9JM:8c^ liMb;*wc^.wwKNc\t}^*)F*KLhIyb( X%W&^pUԍJ}ʯ U Q3:'j?GE[A 4,۲ ߵUlvͭV&룎joZx7ت}'a1sN $_Q]+\O?1;9fG_ψ9$W1 6.9Zui_P۞@?kˮYEuEmڦ^-߅*Pr%4`8B .́}Pb0Zީ!8^Do&_qښ怹;;~.]E ET,dhLug!0)ӌ "Lv]{ca˾F)3ںptu#àF/ϸgʠjPv\~kC($C/B;%`Y,49e`V %jO! "ۃϞ_q \fH_Z%U9  P.Jǘ:m}|T8kɀa8eq`U~ l sKz(V-(.q)_rNK1 Mʒgo"1J(86Œ50T+19MY%\r X[h`6)Id5'l%g_.Fj`=QKMBՆЅz-F-gs@@Nڂ}Pֶ\d}>CCbǢ:Њ a` t4V @?d3CS$ Srjp3_`xL!dP VB|oee,Z;αоFb lG!+1yPM7娚~ib}/MF_;khST[aJ-&PXGBI-n&x: XmQDe#˙)RȐCFx}>HyNBȏ>%P&CXqJ@'뛊Pbwm*mĖUt!#x@VJ"쁛cޠШ y`ݛj"3"J FR?yiIVƸGIG;Qvʟs jqrxfd`:L '&6xu_hhuo :#T?/m 4x1GU&uKR<Ea+3=P`pnʫ[Q"G wʃ5àC _%d[%.ۣ[ -rN/Ij}&tޤ\֠4u^;#Y^rGL/yyn/b&Dy Ez?=?9rAZ=7o' AvҔ3C hG"eti)f@h]Ѧ$tҰF5]ouÈpgYb kN̓! B)a8m4?<-=T>3pVF6 PawiI7=`$xr)S jn SIwZ>4^%PId0X5KdQeI5J";]2I+HIJ $g] ] v_$f:Bp>ps~mIĎ#7sutlJpcj7*An":E .ig*Q_S8XCb)Cؓ gE 08u`qv)Gb**OP),&Aζ ]My<6Ef63R?P|Sl)7H Ɗh8ܢZ{`CuszAp[:ows+St-go kHn_rm \r`/d7+ <]i^4]cXvy2)% fBCXڰK1Aw@٦)z֋! O*)05l> u56{|plkK,?Gt˻;6[O"D)]UD;u]v% vw>~0PڤHECgOǑ`LGFlI?ҽF4"mMu^&ơY% qYVvu>Y$KHF$`dZ4m0;F0^La2<o_ fqv:ŷA4NP sKc:*[&R*U4tL]0;!?.cs~U(YgݳS MoS;$`Pt1X9 H0y3[84 XX7ttlYDxP2:`(;#}- !ʗ2P},xgFLrqmx#}9M>#eYEnE֕_E=:$ RZD񈚞"jԒ K2-tWlȺ*z?rhgE2eai$gma˻d%٠bnu;Hַaϳ@CtF ``ZƍfyLFz9QV}3( Ù|SXOPKګ"TD!$cM] R&"%ҥuS0YxϝpN3r~Vn#3IKL?5n7{Vh(Fcl uCESE=ME <囲jcpY@ Y@7rDB8>ye2Aѵ~ڜKld!ȭY^CP\E7u2iD1ja٪@[v0 ] Ɓ^vE-[TYx&*Z'G0p`JoNYLrdUwg,̿{1)@YVR4=)qOD:|a*{1I=ʅmuTӏIW5dr㭜訉ƔQyoR9+2W_|<7^B̒}U)ptaxC9D8byWp>+;aOn/7.(͞oBFP)'U^4p -IJV+!oml&BD;p';ʐ'(rG=MP%{At[\!1XZx|OοCPVೌ3 pe H RճIR|]u6mKZNc/PS7S, j0rK{z*!:$caaXrK);[Ϟ"bm[ Љ&13H#BS[=&jM$ 'P3y;K jb:ksH(1 X+MU@:.8.-eJR㢩śfKH!C(0IjEoO"m>:޻qEgz0> RyكZU.OZ @jۤ}m/p:OI, HxF8ZwF (LW J\AʎBGD W]&\ !8Fd\}Ө7%6L;)fPtY6ݑ6vBu9LB|WIϥ\ex-iEo1.WWn]^b\1 {$nsZC9qQ{b,dGԜsLz4fnYTqJ3&/zd&$׸,5I)2FN"%0ֱ SijaY| (8Roq&5#h(uo3Fߓ!"!汪 Sٖ"[g2 VYx$Cycڒ.ؼ*l٪+Cr 8ɲe. |JNCp%ԇ~;dl|7'|8YmcjK?'%੶9(Ԧ0`EpbZ&*z#p@zY܍=X1LH^Pvq7fN2Ûp֓!(l&NGP47k;97mj,JlUBٱ[g@X pIE| M>ilxvezSG<ςu+!WeLa_VڦJr vb(8.xXmV#hSórB3A#IjlMo~DF(Qj-nTh΂ԭ?I5Q5oH͝^EЂvpOSϖQ /h;;)ɝdpf=iW$C3bf&O;K=JJCܼ&v-ن\D\\I҈} ͆ܣuL~Xg#O+j8 !˥k8by3GGK2ݞCzɄa%=_,V;+h]@CY&Re4VKfs,:2wʊtji0f<___juWX&!^ZF1S]>wP&MuJlvae!~6"6;{Ohۗһx6ng CGLѸO%llwI-Cʎ*q[$pQ2?S(@V;ɧdfC?q?)~o@n͆ʖ'l1gZvŲ~ϙ3#^W%GyҮ`ōbxM" r H(A$W .͡U0 @E;L&} ^LzY)x׏U2 Ѕ5dAMbvzj:1>;(Cr8IԾIFw=xIGSq9x5HE9C &fmݗ ]+c@Dqt-WkƊYtrP&p- {@΄LҨ?&BJ߯b4Akn2}޻qRҖٱτKmXqv6R`4D$ﭜhtnkT$.됺'l&5N q>AܱVEkH>q ˷a5 ġB|.sX*!(v[YT=-c!eU x5VU$N"N8&#uYT)KҲL桬3Ɏݰa (єr/^+d1h6)kWѼzcmT$|X\g<UD7l/OeCwuۤ,KX-(8@WǧI $J] O^NO/lˠ|]_5a HTB6)J':-*'-j?cjMa9$t ;+9{9ká0?!"."CZq@%;.5Yc>">lהqHO/yq .~<dSf-,alA4<"oW͗ RX١&8tغ|gG_nAC*䞝CMnμRFz>}>JKpp1inuByF6ٓ<3*ϡ|PTVyKlKQ!\0װfH߂T&w+):!?mu/v(w`x w)ũكiTC@t.~z?9Gܔ0:hxȘݰ0m2ո&$~C^A3[~It P$/7/K3F@ƼjѹͩEf6uԜ>坎)3 uD Z) /@h̾ի|{7)h*$ǥ2ʷd2;y ytVÎ'JLYjt=;#]9Fġ](EOƵ]8Ǹdn2LN2{[z?$%0W ҃ ;QbtaQE #i>`HmTUaSp=OsM̑B"@PҋKtlUxqi*MpѺ|. &D5˨svqCwi/7z ߉/CÚ(e|NF]4C#wpǐw$z O'3Q^,d;Z䦛kg"BȈ1l X)W >g'E|~l:MZ%>MhQ^5zg)F̅cTC< չ 'xИs⡘vdH=`o| ~TCo>ZuW2)|⪸8dDM^2 =6=4ngԂ,@ .$)5-Mzi]ٺ> 08X -7Lasἓ2DlrWߺW ʡZ=uEjG@q00;-Á{ϋw̒,DFCkp-,!A|oͦ#V=PYWY<Ի.a ǽ)#bz|-}u4TbJP3;Â\Vd]q+|jeumU`]rȟ>7 h 9ʘ7k|qA]e I_JZc_U(Xu߫SJk{on !њu⌬N8I^ kjv&(1dxK(S& LLxMU׆bPšءK,!wO6ESm;I t< ^7sк"LF jɸ{~)oZ>G&F>kC NЎ^֎j"X&)8t ]cfֆ`&7!Ă;Zjtr yprDG`$s.%Bt 36X$y_zxzܭ ЭE4,M.qCWlʵ#/v@h3@D &o&_/d/YJ'мF_wCd_7[Gy ֳhf{s5 ֶ@kډ@w#{}=XK*3Bj2!/QdNUo՗hU$;ַl">j0l xl(H#lgKٱ 7_>.r(\zffrYO 37V)E-؅]ik v47Ҋ3+}p󘬬4]+*MsnY!Z(JPhF/lv8 WO#4R_{qx7*b&6@̻b e Jj`<}ko ZQ+2@E,`o'w gkm'CNO9w߶Du{@eB3JwXXӵ8/.뎤¶c-Z^i[2*NWKP"6,{~R1[ezۣ 6^Uኽ2]y= )Wd,(FAHcP12B)wC/Uu낻 R{uiQ-zr},h iek~7``f܃ِ`щ-)C}z k#w]G#!HOg/siI#}+M)\LHnwY)IΡobr3$LRf" 9!=z8=[,{-\pt 'dǹ26>5 pvEӁ0gy{`ggɍ\; bH>2@EY4 GWL\" UӖEM,{8|rO s{DȞ ,Kex5ZR@nPnY!*s׍;d2Vi2@*qaz:>=#/| _/9>q4$ ua!ѥdUg%&+BTO/$A$-\DŽg٤N0 mo2̈d%Z`@W(K<{w:8:(.uҎs+@Dhۚv36  Ŵ4bhN4B5"di 7r[‘78|ﲨh<+k/T`~sO\bhg8x-2:$z}dGBu 0,Mh ]ۑo`FQIVy|>^WE^BY.iRNCDAW=RC'ѫMCxÊ KIAu5 #zTL7e<4Am}l)DE3Xn-#JWM-+Ψ5 g4C| [dvR~OF#w;/Ednp8Oo^8VIݖ5P h%[G3ʩJ)J\Kub50GK/#ƒoѩ&%ȽQ'fn:KME,6agGnX'x g $ B/KrWEndaC"$krf6 K})!bt9M@8NO|N(c_%jRWOJ⽣?Wu'GߒK;8UW^2.fЫ&)(y. t5" Mxfф[^@H",Lлr]\j!yt$'۷Aah:Kz/ř9sATo&b%\|W$k]ۦFLdb®]5+ϖh=2fJ=-bqO4rj6buD2ޓ$6XpD.Yrb) l ?0KuCh)8|Z,oaJ@.sP.b*LᵝZGkTQd9r5A/@w谅1\-yM`+z\3|gLGR,I*]2Χk3'`1sIQҁ)cUdb7DI87/Xx&ՄCwDa]Oix-;Vt02 J4=&SƏ -Lr eQ~̞I5vá~~VLK7OVvKY7>&ư3c?Ȇp Ttqvm0 ;`'HOé n9^A!wT*x)/^50k2iZdVd^/5QW3{Ec/:iGr^9w}B'jw2ڮ]GM7kwY4 UUZ/Q 6P"1p )x|] ~;{8"yZ`8T~f`n͋v`@728fFB8~bVLm=^[=p9Nf]/٫΅EC=]uꐇ@[j' )Tl&CrkWCZb$CﭚNgڴT<]P7:"9ӈVKܫk_ I2MF0*VdO TP'A%Ɔ!qkĽ2m+d2vY?H9g){jvjX\xJHU |:t(MswIbe%&j)6kӗy Wm ѵ>4XZG`RN9̜Nнw)eXJ͌H׌ [AYuqEf IqYE5*aSҪ ~xf+*Cj v#ԩS'!?B-w ӏ!Q!+%_%[ʨ/-?(f{jv ]rl~wihtW=fBÞU~3siV e{>eVB<.f^=p2R>@ ч{"yQbv1eGn{JT=ϛ"a`P%gqѭu~ݶyH%\.8:GnwJ-̴i]!]sQߑF}Tvj=4J%:e39Gb+\E4rS{ߠZVfU3TӔ?i+Db Wp5BM֧Uj=@.jv,dq;Nq wbϣo+íA,6h~9gIT^bRԚ6M6t{i;-%ux1o2HAՆ؋󚎁\z|r|ǝzC1f 18tY?^ }NVxӐC~bʇo'j%#U#5 "[$)|nmA!LaP=MZUl m{5(1Co!$z[Tp<%o)IMBAZbK#GRmߐy"X~|RV"04s)r'R58ak{ͰdKK+rr?@ ϭId 7J;(1uOwy-/wNHY04fz4vnBڟ nѢX8H趪z8߈iK"foF7c,ZWJemGp1HǬp(IYa2 l#]?@>cLof گdqD5zOsi#(qU Cҫ#lPG4.Lu` JD&cQ2Q"T#+@ RH׿a4mMm,Dmo>HQ%p*( &%SX&}.$lUEoM큟c)t =X]E}5ӽ?N&\9}6Ș7Dƥh#2+VkymH``E/"r=>~dP°\oķw A|hU_ F"sPRâ&[IG嫜CH>dv׃-Od&@1Q4hGI%ˊN@xhr7kJ']Ӊ=HKYFKwM*ՋᗯЀv/ڠ'9>0^M3?h^eXOOsnQXl;1:A#iEԥ.cJDϕJ]Qlu|ա]^T_*p2/K-*^J15wJM86"X S97!%ZrVja1kEo4a8X]݋ulhm?ɡ "AK*&Yp+( (R;KL&nm/L\&kqC![F]$qKtHxWxv[Bq&aBUlXO/ЭW8zp 4S34mSBnsLV#YRj!%%&\F/z=[S$v6(L`4Uv!.V'1X= ٥l1ٚ.+ŮpOZ9"@se^TD8Aۗ-;|zo~U .NXRQ h z{sHLTZVR>gcm}7,hHp=6k\Zչ}pks؁^Jל Jx]E~V RI>P>Q4:s0#A h/w3,á;N f5 i*dO[RE-?#X^IFˑ0qdE-Xx筃 ¼Hc1\ۀoWiMA 6GN}J=5Dq\xc|AC0~yµESةSt]@%E0[/VK,^+MIk:˓Hu-'4gZbaQPUp}K7))Z0nlG[x0UO,2յk;_Tߑp'IxGw|fzy{)F_wx,$ ZF dYP^?qyf3 5cAXWAOTDOVX[# 1c$㌊\2q^y[^|n^7 `.E da {jqWê2\)^w;0+£2ʥI^@z8zڋ]MOcӭlu9߫pG@qqT\XxChh.hM.h'ªfts|wNq0 ÛԨy~xmeZnZv{/.ag;кG!'Q-CF_q=cAΝ6ӍZAE¹ q+>K$d?&U[t|=AKhhd}XSgTȷTIS[6=Пu1=pUerUUxKiH.(ݴpe.">F~>5|{3 dOiG\32m)]2U7tk%[Cj`ɔr|a{rsU|[|50rwKDpnuud2ʼ.quࠁ}!uHg}͖"BjG#K~Q@/s*u:j_ɨ2/;zFMy $bSUQ~ƞpc*`r0($Q) 7E M&qnl'*%3;fNAq2 r-j۲N.@1M@BOGK3X7Srl!]<]I>v1~K4m!3[hF. J3[õ}  4ࢣDk =Sr5rMY~PDj8 h 37A_X?7:_0 7tK s71-psH~|(=(n""~oL K⇬hgB4,8UXf"j4)Ao;߼,D/__:&c<Ǜo1q%!|DLV#ElkPwbH'="M P}.m.k ߝurZ(ʹW/R+~[鲜je{Q_oOpF([?Nܠ{b ^AKC  }%ֻHR80?ų=9Cʟg:l k=FmjsgQp$&ZK*GZofxu[6amN}P@+y?e|L/voJ#h3 Y(DK}(dTGLrn[#n}u|ymԛJTGFήy؍ZzS40R'@88y7 S;gtf,⛹Īxw8P+?ĴD|ѭ`b'5Oǟ؉0o! JJJ9ŠD F( 3ZqV-: Fs&xj:[&ugV XPc0 CO+m(& \UɈ?9%FuIm6ļc FeTMK JN;zpt(+!>,_y[~$Ȯya5+m*]*GO-u;Vrj+#:@0t`y~PJ; O&\ښ}IPl 0n3Y-!mrl;0vbUdg=q7>URmJCH֨k3;W@Om 1,<"k$M%[(Y? (G q}S4ň=4fHr(c_4"y`v$ \*Ї(oxĶ楫_kT,f̡0}U(b@(#km-1 ui[TqL&.iя9F^`#Ê ˶u23CN)|$s8;%؃S2|~3+)`Ga=yB-_.BZ–5NQt*WeԇͿA;Gnń@60O6LjSS;Zc1bjL6g-=RAf2so x1e++\yB];,9XM< 'T*]ȍ`N#whpZlY pFᒗ_Kc`\ kt b򼘲 В'_) AŹA8L_O(ŔͭV"}Am;5۟}r8wwl?w}1?_{Ot• |)4fVPxȡۅƚ@>wrڶk+~nyr"b:/>zvq~ - hw^s/8kk1qQ= e(Vlb +ڔB2b+HRl*jdaAhC]>\-…-Wb4V` (8ykIQE{lcϠCE!BpB7~^vx{=>)ҙ׺4:Ti<6!.Çs”!^ǟԨμ~17cywwr'Xd@OY+5~h#Apd_;uU,БS0u^w[BlbˆPSW2R;?PE{۵~ _"/=N2xSFJlHDkj!dH5n%eA.|.-~)j,jU!PD@kP}sIɿ Yj}!3y%| p8 t s8ynX B.SǤjL!_GOJMn:Qx\_)x` $)#ZqЖ81rׅ\4|W lQPfV Gs0ZrEw Z'_}L|S<-!2J_JrГiR[rg24Ut eo+hrdˍ"Iw0e3j4v+Hvpp-`EG:TlTO|$B/ ;q9!u4ku |sыpMsԱ5"F$B?ыqPtsDPm@[7ҐK"Ԟua$R 1ǹNG Ŵ %'dF\Jcn? t?* 4X81}p1OǼ[LN ߞoX^w%]; ^=,ќiUF:BbOYiQZWEo* Lj\p%('QCG\.;!(jc?BfAI-6Dp4Nd"֡@bcU_|h4"DٟtŗTo'} wvpqx5&Cm|0VelaJ ~H6桥>,,|rA> 3 e%Aխ0Dez4TӾZ='XZݏ濥g{0{^@wOJ g L_Q?T eX# Hygb]؅}-Cѧ?e/X]=N\xF?L]"#:y973nfp{&]NN~)@W P=KUSV):ز᥀H@fJ7PWW^+Vu+łq:,2$jnl5js}RI L{LSh&z頥@f%>̂dS3A?G9SP̉ݝ:W;75<3֎)Z?&K<ÌټF9մ!KLyK w*IRN?wu!Re@q (SG3r*J!ed!=E}ѰN0tkPf'>)v ;"i2]ڠC(e#W>\_{[qbˬQ&HFVa$,v-֍TWX4smZ2)|5,P@^2K : cٳo]SbJf~n(Z!ގ"1񢍦pp3ч DO4};œv0l(dg[wdIzai)a%oPw:h"+uї*K s;&3&'jS(=7P#K![K;})֖7{jEସnB#BX%I&#@F4g3nDrap)hNS-Raȱ#uDN,X$]ٔXqcG?xZcOqkC;+ oP{^!T&'Y$^v*+tT R')>{%D&$4n?eHUXtAߥGߕzF Mf=""1{kM"qV|4b:&_. ew_!kP@B T)&< ᧴PNn O"[[w߮F#K0x,8^L-kl&ɋ;[13YHZѶ mO 'F2xuk=˫7D|iL!9-N3052n97l}}߹`1>@[GHz9p<7N)~#ud;}60~>k✂%)y3ha>FcJ>SӡV{YK.y`R[5i\i޶^V%C>rǾ2jl2s]T<[ I7`&(Y j[tמ{[dMbT>J.X 9fh\x2vwQwQ '4lȔ ZVll[vE8^v;[l>oYdU_3ƇNv XIKD2VJ~4c4u6p/''9DmH(#ʿ9۲-ȑ #fMpN4֤.Hd\ܽkN> bڀxnG;g=)z*"Wj*ܘ =(`oK ީcz׭ȭ"Qkˏ_1Ef5giK^tS_x0Ȗ[jwq6/d琉љ: $e8Q3^Hbs)a[0Ps]YNޏo ]:LI|/'v v`*vL68zVPfvca^ydڤEao>W[25,LV8uٯ}%F,G|x;I)ҖUp7cG]F(EDF9/*d{LN gs笺j"w`O̱Z. }b[gVDùNR#ĊTWk$ 팜BE dJAWZ-јUKߵwܻF勌 Gc*/mcU<+%7`fVػ2ryW2ZQP)1iq+vү xᎿ-V3Bf`WpgUzD%.,&P!U K+@=&sί۱:-,LF$O1&Xq 8"X'Lmj(2UWL_qzܴe9MZoQB꿼=Z4'"XoVB&.r#b|?.6W] kidAddW§Յ aT_{6u%KU-2~Sp\k[D@pZOL:",֙M'$!V$5? oW:sIq5-/俾m?:öd❈yrJSQW݋:7џ*y2_[9|L)O;I,=$54j3ؼ>:Eh7;(jӛAUڭY\u ~Bˉ8Q9Ad=w“lG &jgA_Pe5(Z|B;71Gٳ"wIBsAoRR#0 [*E{s{98K ZN ͇6#)W8TixSd=J^(,Q"FP@C;("S@~埭E}<E]O\A AZ)Ąhx0r:Q+8}K+ pWW_fF[7*Fn% TY[a2UNm}Fd?^xDG DVR$)yPtTMɂsnx qyꈛ!S`ٲ@S9C[ZzfuV X{N8A}>hDn!wY'2֩ԫG%+|KׁƿzT&/YJҲˆ-j >:>&ߺ8 OEmL\A ഒ1+T7#!N 7Ush{SGe"# fbG (WZ vV/ >ߨ:,Xeh H;h;JLm۔̧"kBI7,m_Lt :Lb9Ie98ұβMwIH[ayCm7#=̔HSON6 | ӝݞYǕc*k&)!~Hq(Q <.I6W,d#6C )Q1qn"lt2M\HYfd-'eab+o{yz:ⶏRQă x cHÊ8.]LCٙ Ƀr;b/N|/@_&j⠆Yexa}' Mt [ЁcLxd=f!PJF -}8H{6]+.|0DVt"舺2(#^?c7mWU-Ix7{K34`'i xI`Ec!(^9P/MޥfBZIB:*NNKQdnp?Lзx+pX۪ҭ 5j}YN%K@L9n6"J4xM-uc(u%ncGEgL`zc' s.cll,U|3KIyVhOk+F0]<s?4b1 F4ě\8֢#۵N@'BsbE{NG7V3eᶙXf;.s3e:&8K.^ v %(IL ٌ["*<\;qR؎4d dc,dq <ے Q  ^EYOV;BMu S*N4-X Rwj0c1rA\bY҃$K R-ޯװ%vI6vѾ7WC@eXZF#_:k\bX zy/iuڴߘ@[Gk]Ol?JȰmV2mbt'zCW'!!/&"ysԑD^l+Ώ9wx^5sqps%ήHw7)EڻБ"}t7sgbLi|E)T; ;qZG.&L!߰L |G(O,D#3?I#ynF̝Q76OӣK_޿q(b-{j g3E'& 欒~Oy ڒ<^BO΅%sPQ,@byo6{ BJ+OPpjLV툻]P~QÞOӦ~c< A Ӛ)>duiF5wPN $ƕ*m=/GBAr˼@wD-H5^,c9$jg N3-Qo ڻ@62f֘ <`!Y{]U'E.a(‡ []]l[j,d>TnQ%60r'y J>KN5NDKo'*Z/K2ڴg\ۄyG*` /s?6({+-6*\yIc  .zI^ժTZY0I z [O UMɵX)|{GjLu^S]嘔ircdƽV<1-O\PBIJu^rEMv{ "%-rtzFtE\,-(χ }FA4dg! P˵$:L;}x΢ KBoP,y} ϐECUAbrr]OxNB~.QGm^:L7w $k5qH ?=ia'Ɯ7I\t?T{gnP;-xD,]2KGbQa?OΧ=| o/؜6xxRoDΏR@AM&tmh+6m%"죔kp`oؕ.~LK&Y˵II1,Du{(t:$l?hcĜ.gjH"ݠAΏR툥H Q:po .±3u,LjvsΎSm:G-`l}a`W\Ryϛ\nOKt0$ݯ@!ϠDVaAِ636TQ y 9q\H.ĕب~\i}NH1(2Ǎ)>9t6oC r17aUrH#+UW`YGm]NѤk`GrV XJ9t=*#!S<+J̺ Yh] !_z_y.H{JFQjȅ}+a( [*e7uR]PF*>[D~(0ja A&~;2.d! j՝D6Z z9T_Rɘ+}[&ЫaWm5$VraVN6 ׏7&btpGyJ[A']}uc; j2q2l8\.0YD黙kv3IXDـ`Xiu 5LBo6З#iz&_ݙYֲ+f>TX}Ol"M-IqEE|O ڋE(=բNo"z#wT煯҈R&p<%,|3m֍_rX_mmyDӒ6S <OA]9s W@`$.^ 6Ǜ`oC^RaŁԮӢNC?h~ on ̗p\s 5{I$T|T hE9v} ŏٯrm̋X7Uk6GzO 4Y $ ;yow3tN/_ϷNXm=\dN&H_gV*B.Zw:pMPxaIL̈́ */]w39riG6IY6M}zflg:W`2k`n>0l׽S8pMlssIDRL_Xjm[y)g+G1?w8_1Cᅟ%\1+ko7P2lΕ$^+WYS#`qվ-L.ih{6Qpq~0*_IcK>,K RRFY"[`H'# ud.L @"hx}<ē nDT[xC(=yX{6sk+%&U-mO1C?w9G`Ka`ű89 -g>W~MO a 1nYj!3(3E/1* BjbݛS΋#9`V~ \EHXZ!_ _!{P.7kbsڬ]nIR54Hxx8o]:P$a/EѰP~;֩~D]f}&jkG~Tޙ-Uiq{q:'직PF@"^+Tv`ޮboM ôݶhX=9[7X5BB96kMK73O|l1 E$_QL^#7&` ݱ2X]?z(KUjD+P-1sWv\ G)ɋ%Gfd.{_.k*_V,( ퟙ` t1h=d͵}psQtT@f 5 fl}Csv]F'zSjHyOy% s.Ք8.N선=XhYD)ߪ,'9`?y+tcFkKC ]_|SvhvG\apwFyل4*HI@fN$ t7al<9[]}: <amPd7i g'}'&쟂#Oc=RLPsi40qVG~Օ:Pg,'Dݲ׎X}?L=&Tml!tQ}?RFϸ;o榅~G{kQٷ9(ӑfBMe&%2r֣dÈ5_bOА.kDY40'خW&o xlyCJ&GHnt16ros7m2Ey.QcDiZumzIk8A1At1>RiVNwV F!75\^$׻kǛ zBOS1jxk_cLxlѤ |Nʺ 6:eTn ڍp,A.Yf O.GU>Q$OZtbAǤ G=(wojxTG,btp-@f_;)ь h_ۉkܞ|Ёb&`ҵ?eŏҘLm Ia1211V4 5=78Ҳb)V<1P?6a%X+HVc o8򫆱hMݛ_M0yDz߉Tw XQ]*} tU f<*cw ş ( h?1ԩ|Qg?ԘqnfP]ܘ$9 t=XGxMvp#\EсCHߧ+aX1?ϑ~ـEħb@r7Cl5'X[؆eޥUcR"enk'+mAAg$h֞5q -}w]-t,~ ɝt?4sk#r -X4cROM~lNj@ 3UHZ\ΗO̤DM3-z#ژ!e<_o ixș,y"QۗlTLiث̇kTkZ) d u4Uac"V>ތ\ӛWާ}#ꮠl3KdЎȣ܋8pRV,6v|ren?\8Zű.iZ."|>, N\QsHjL̯@us9 )yxe'藨^3zR :YU?p P?*=wN`zCT?E2~RkXrpٲ\ԛ,tdphEgU+Eo_ 't<^8r8G>.뢙WHsA}Mv-S8ӋG?x$c1y Ԕ`XFDBTcXFαCjWYxg:RFʤBcIYBU BMLCkvzeaezF-k5}PcckoD`t"+h2Z* x鰁V3'M =+b? KJI`YVbќx,(]WV%DKq,,hh_*nvQjo_u=9TޚF /+mx2b<ǔiS{/]HA# pDnI?@+AwtJ:Y6& =[3uB}Aep @N.drーrHb~uyFxבV%7G!< aZ-W0x.0ؚ:83Cm p.(|>BضN}<+%yDBe+E0Xz+#{0_DĬGزms~7Jeh5/$Ԑ חTK1IVU,PP""h^'5W$O9ULר P`BT=Ǵ%FBOv<CYD7;x-T1ҿV|P;K2]dO-ʼn߫ +6UesPg:WZB:rGh[g'Y.Yy͒+[%/S2Œ ,e8RբhDxZd fܦP|sKЏ4( )~nMSw?bAV{w Ad48[GP2q k&&u(Qb+0BA2ӌ灆Vf|X|!ɔcHR$oۓ(|F((c1YZeˤ =R):~8(֘G_`vZE@> j~a=)+k`Ta-ݭm|:dg;ž&ʾl"mŢ"v׾+uh\_:@;SR4D`_)E?;BEZ%?9WO+Y].au"ɓ gW,l5 A.ЯtmKF'3(Ga?gʘ BgM$K{ imQ!s-GŃKv/LKE@/#\8&SCD$\JvQhM@f-Feh/_]}.w&j+ݕ R9"P/7gC+Oc kX#hd:=50GM']c4[aS\AIXBScK-nq1,7vՠr*SWc%p%)T;LB]#3%\+9 asS@A?E *屐\G]\25t[)ߟ[pKKH`vС(Hէoy|jwO%|*6]lHzXkψirg!ʼz˄Dm9|lՖA(GWxuyQi3k;s<4f> /ėtZ<A䥸9PdV|ggB5K3^#MRi{Q3O^f g=ggLu^()ʿIt볭8CXwcO#w %WȨ=r6"Q U:Q_`,mvZCֶ'm>Ycq#𕏶Db$Y "`'|1mIf&㛥pǶb^2S.aBEINJcDo E0L^қw˜i-J%&1N,,7u '};5y`&B s϶s܋ƣXȍij0>>4qj1ӳU Iڦ`\Id!ÕNRd=G= "&+2`j|o<{YƯV] x_L M{,:eO!zA`]be?d2@V2l$a]g4=~s=v(lLB@ q0 %q[ivBD8u'_4/KaSh<ֽ+-,6뭁\eqcv s3WnA6e{Ф:؎mje&¤BI;-=~ 4 ܟe3moK>d{ ˙ajMYݻ^%ZC;[<ŋP$;FqMյ.ni:!0w&Z~ܣPU‚?]G5BT^DzOrci`!LNʳ])2ר"G4h(y wQ;앴a^i{,`_"2T'}:7Y[qw$\k\Jx>Ĉc#]-3L [,΄{ԇ;]-.vsGTSW4})|=nMLw #CHkQGR3',:lmK2/iJыicA̡hσ:x-dj ]oXLع+[mc*,JM#jLD>{tڰ)5%`"rd$U2ns ?9h֔9"9Pap:vh3h N$VM.GG  wv `Z_?W(QG'_)ǪJ zܚf\}tzT"mxIGoPk4 \.F@Z!āL<>`?H]c`*K%Dpǯ :14tЙہ"l//1 }\KuO ˍ;PV2bQ6=a+kt$VBn)B][淟!/`\fu/OX2d+,7C ݸ{jF#Zӷ9 '&xm˃EV>tQjddPkQniUXVdY +YOҚbF6_vJ3+FP,M6#|9]9K$x:g*1LH\`\:a֣{eݲ"t!M8FJg4EIw489e8lj%UiWPYtݞv3_(?zWG?I~d-eȞ~Iƥn@~!K;mUtM:dTu0'Ϫq&(YK $ЦbCO=2 #`p,v&4Q-kt .%3:46;paz\.`=[+3Oz'WF/d.NUsF$K'eX&a{h9򥘩1vS&gR. t6mt/}Yk,HUw"u:Ql` Xb%(WYHm P);iS]^̾_mX; ]"|P@}X Q-ׄ:ubcQDrYV>ۢvh>-DHh}tL6UAy5%+!kdDo !l۸(n4<P`JDZ.mJj=Q(J? lst`A7ٚM`zI9`rm>R:K4ENO Fc\Đ6I'L,.RzYMw٩8ɮ"v|gY cCLMYnB>NŌb]Er+k X'7jdS}L6Y2l=SPO@ПOo (=n(O0";ugRW\r/Ro5z*XZ"rhb) j_jĹ:dYȞ`a+mˣr-iaJ*nDiud{lxŢݪ@>tcq_$GY&1(3K?hN ;;*!;2 6@bV(zL}zyW\8[6ƨ85R5RtޭozY|:JY=smtמ1o4å'w0\S4ҧ߲s3$ysS4mr8 WمPZ&N\ *׌*S'd =t495hLt1ۓ{\HioNZ8)ΙGʔ(ʎCk3ntJe3e=ͫxj?cesqF`d w?-)!|b{8` Є%oډ 9*0׻"aLX#3eEEE25[gҫrzq"t2e,|oX'e;K!OB Ac2@XV0xpsn,Q1LSIee @but{U6 ]MY*6.GQK7\bT2 Tg@ )U@dA. G"] hu j*ٹHR#bS6Shsb9R=TП>rݲ]pwh-{mR.oz׷҆Ve2)-"R]Wz V $lI75 ZJݷrGJi$UqHtꑋ-p 8D T?F`L̕+s<DpzQB [kz7;eKO0o"D&}"Eޑ_EC(6#NzH, - ^/vwj03k. /8vq I,|Iaǂ{,Ւr2axf܅5FCXF5w[Ҕn .1CDs|ȴ'*g7^%dM?z?+Mi+X1`(amf,W}&[q6̶rDf.ʐ/ҟmZC71=aMG [dcA c>$eAy|7D9ѓl}kL"ݔf~#O*1֗G/M։+oY*!`^%7yT4*MYO,h3r;. Aa@yրOt";Ge J _=A'~ [IT Vph$aL[G epXz,LqJTNu>q@:}*LU~|0>bђUIjFi":/I.j^r,Q\ VlrCgX>aZZJԄgʁkE=r ISك,LȚJ$nɟdi"n?햦Wk[ObbeܾS,}?.٘ˎ䡚Rpop9 onc-P9pZÐRn~ be2=U+콏}Vơp[*CD!) `LZ[~ y֭"*cX  uEZB1('$\up7aB=.-AXq"ɽC(?R`7qqc,s\^|p/=Kn tj̷Uma]LDn,I)ȸ< eSkүz{YN8ċ+(! BƏbT}27j8o屰:I35S:v$\1ؽCN`HU+m۱GZ1?ɎQ *at"PbENfͳL GVuRg߳cB;k&ꅞvG )f$cGhWB0csb!I_!}}AUTJP9N<6u`˨i1u7ԙvljjj]v8dkj]dcW/_1f{wܡN18ˍ:F$G]lJanxw .4mv, A U]%1'V.Y Z5DrD@ 68p= Fv S1̊ X=i|lMPxkݘƑl1okcr̶q#62h'?(JbɵtB8m58>2e#EkF d9Λ\27QT2PTu͊~TYю/7嗒QsĸMZhmc"w%$oppw 3lj G < 1Bz+ΘIGSX 7GEټ6Ufv?5 gU&i fK]&Uv\HW jeS73UꈻE}b!{]DjoTCmK !O_Uƅ?A1kc(l3X5 E1ү NmG7J[>xҊ^ϛá]̞5JR8rj5Z:XIe*TֵJ>UX̻U/’g,:zqL,57ƣ _J¬8e2c)i0M )mm4LBɅ0 @l84[vVRP=T?G1U^trM$Q҆$Aoyz+Fyg1;ؾn %{KC_/ 1 }д à K gDӯY,ؒlX/ `EN|Lt_آ^ܱ$yƧ&|83I+`X:%$">%n?fjrmXxʠ3#,tȮ!jXT/EJa!X+=kt38lNY2 ?%P\e*e'yjkd,6sHm*X8=۾c+]،hrY [X Vت>s?[O[ZKa$Qek j ݳ5iV]xJh St ozώGeVb8L֗9!E]j-9@qCD[3{4a@!6Ĩ#'̴|FQ}0· U*{ٖQOG]]~3`pw}FrSµ rN)~}8ZOߥUcH x߾\PO%nGp*I> \ LU!;Gϲ,j *9&NWi .2Ưv•PNp0cxk MtCYaLWP([[DcdRp|:\VH2CDnCBx* 6-=f~` ܪj.5=]U8S}d%|2: qp{K4D`ȯbBDsQqո)*EFZyQmpl^kHu s?'"(nYQe KbX< g?}%%U1rQSb|TL|{85f爻 4n7]bsf_݌wOO2Q rW}ا_-;$xqѻ`q\Rk$3tEƂ31) 8FKHXBKVU qQ7{&@M|Z#1p+ᒒE*qDp.jvQu](;HxdW%j_]}[1L6Ed, 4 cs.RULH1,jc0~,/e,%Zci}pP)CU\s]LZpJ85vcu؋0.nA}SySPRGC9CARwqpTÿbUTZb6?H~/~SG=8Y.(ݼ[/8 k4ڇ6ꥴMWF?sd=1.MHgs) zg-!ǿ=m n9k9Ǥ}!kW}QګHnPMf|t {;{\B( a<z9̱L_'mѐ)9!OF{k>Y;xoZwk'h=%.˪,k!\ Ij; `:l_Ν< .d,0# ![xuzWܿR"t\J.N};lU$gX/iBm4rA&<1wZ[0MsgΧe\^6=vLq rmm}7CڱTguMvu?~62# m*>cyyoкQRuz*M9W[zWF:ɣ01F[C]%r]sM%dS-q-͆t"ź?",e6Ca@U|0xSE5$ 'Դ4s &tP &=!ъM~,{%g!*@hC5f_Vqv$"^2D{ލ }6S %<p!M֮3P2CثztW:j v#,}1\DadDfG\|`Ī]@ Q*(/zXKhjaY79[-/vkG9M!կ(6C]?Se"u8XbOH\Ռ@F]^}Y|1ABSFPCTՎF&ޅ=;_~LTb X3Y8F[1G\nLr|R.V[y z81Thӿ 2ŚaM:ZuCǙaz\Vy"3Ջ0ƹdR4b-*-C$T|m5+q Znp|(x3&Oٞ'"R, CumIi#:wUՑݤ4}'\6)]LʬծvظrJ^u9~hKT.I z eXı26 ,{\hωgLWbƚCw[ KrUZ6=YqdfM67>ɮ3XCbb Z^z$~Y6>j"А\?5Kѕڽl:%c/@=4jĻEۜGF o2֑E=SsT| 8?lU2LtN1QxZgI x/%٦v\-,yLlamJ0ȍ__kBXvݸí]tTATZRK6WK[(apn {qI>mH?z9><~',ѫUoŷܟ oNqD]M3nwFUe%| FP $Vă4`& A;շ~FqlM Gd'5h@1*Η%lMPI7 2+$H/ʙ!BЅĆ{ʳМj`rW!)߯lJpe_ |ޗg8JgsG',_ }3Xj{^ER(!Y:6<oθ0`"#Ixgy8̴ I]_Z @sאDe|7#i='PC(J0.oVt-K&O,$4E>]r`nԻ6}ј/,:I$#3% S&ڰ me~-?KE sGEX]!0{6!'..9T m)G r 8Rق1B Ig1Gzq:1k@ raP1 2kw+^N!!_/\rbyYtrCL%ȍ;blso cn5\'Hf)cR]'cKcՂ1Jlpe^Pa!sZ(FM3Nrl2>8ã3 1I384o<*8mX LEW`({=K-0>%0BgݘtHG"ؖ8 Yx6HCh ߰ _ /4掃9MCPyYe~|RNהW \/_3/WV'&dy@zdP\\Qwٮ]5K4I6HUЙ[~[A 5*HB֌H-C֒n}hIôz[M=FZO?KMıR֑_+ҏRU.-L~@K TDC[]89TCCRoVeSv6[lv AE$h0[r Ր=95 N;56la'>Lf#Rys{ :JYt4̽ZdHik+D0i_]D i0qkQ t6“J3ͭb8h/&BsDԑ\ `? :؝W-S]`WZwߖGρ喁?<"oV4Se G+zkAht[5 ٱt9%GrbډOQY2CQ~" VcY{!~Y#%Jmw܃Uʐe4nk5ZۣzRDJcCx48j'jT bm& Ň֑.ljX+ÿ O7釰Kdn* Jt`$6 w)Ga-زg#QMwƍb_g߲ĦB5h%4U^3ŠWbᥣlgEgD+}t;6cI_ptFuÿ} nᵪy`yhdv݄:= 2Eskڥq? ҲT2B P2w@Hk}w&t{gP󩩼7rrCD/xXviB ߕhS,]F1,"UM)Bm K,!F(j!3D@ufc[u-* Mkxț.sqC|Ɩ,&1HkchmH\1X å Q{Ҭyc9zY{GDcQB!r4tx&5,owP`XQ6Wiѻ} Y5kؑL~Ś'{~\H'Q t3?Š+w% ^WqD#R. ֖! ^yj#[1@2'O%lS8;~O{ohüSM%kӁC_-Pd~: :9Q7>oGRky^=CH8EVBRQEmtw!#tzsT-H ݜ\a_fܦ 4{'DHQUq 8Z9,)7c,YnL,7Cc1{6ci'RQMkIM| 2*,a÷ǐb_B #O}@>꓍cf,:H6*ז`s?zY0K>p,/V4L$\3L@RUL1:+RkAP8H+ww鑮Y@3!} 5\"bO=\%kl!Nfg/^g[DIyḰ8qy&p(@8C|mT~(l̕wFi5HdY>kܛ=҆')e P-ܷ4'ء8CGAjoN%o*mt>6;ml1[oVeBXuJ/uKb ,~9QASHBkvW\~u^"rͮ}G/Qmq8 xl <r !W@^&(wxJgXj%Ī9=:-^f(d= QPޒC<< 3cx*aJ9@M!OS8Ik!"%!$Lg>a"Kbeq#VjEIRKk@AǾI폼>!]TvVwQ/4]?>J%[ )i1͑dsy tbijc)h=) e' _^x!1ʕڞq\ؕg}(q: N(Thzܡ\BYkP$IHCPNX|+hʇU֑UT 2̲5~8("ٹ0<50qB;IB {iW@>YLjg)* *_֡O,wiZ3b4}N?BkW֙L\^ql2ZZ'LCPF@ Xh gڕN]nωFL dj85Gl4Y ϸFֿѰxuTQmAO`CdnkYcFe O{T>ަ+/y؏Fxvyje-d n}˔-cbwW V-scz9eJ~=]4h(C^ǒ#o&1]KG2 tU `i-Be̖q@#9U !!VfgTiŢVqൽ^B؟tN"C2WBTXl}xG D1xyNL.-c"’K]5rP-L`nơf`͇xcF;(wa9l,\m_)ME,2T4C$DҸs~ؕVa&*O1hOE ΂aߩCE3"/Z&ճ&)gE#isY䙥ñ-58\Hz-n\3[9]>l*{,,ۯh$|"NA\ic y>p4_hWW#n -dփ0lS= oIDU\eϹ =6Ec[p}F+HkC]Gas|%툣Q#QN%ퟲuL>6S?+[LI/sghIMa=+ts8+yVoX!L'4L#w+_ر|IEf28 ݦ#ɫ׃6MdG! \EE="vYTGgJkAe B&3%CDEV+Fͮ  1CҠK}oЌ8LdI(e(ľҢ;F2ًIdB#|=\m̧x$֣r[qw&p0OŶosCRq aItҭ>B,c؊fI|Kʙ`/n&)=r_KWSec?H#p^!.Md˸cӨpeJAVdGHkSbo ?jR1{C<Z vzF?lXeSX#I|M)9QǔZ ^VsEbiRXո'r*W{d$ף\*ٕyGUo?iDvM3DEZ2]`uz؃YȔ)b{_tqف[pё[!+l!MLoU?ؑIzRtg K\LhMɛw<#, 1|*o,kTGw&RUZ;d1Eҕΐ>}Qq>!RoRA"L>whM6wNַ)̠\ <u8/u~L@C9.; /TBL xEn%ѰIH˭<3%q"dA^hȳ]jtz"Ko j0-H`~S|l?5He-i.ocVSo.s#bբΥ=hX2oym<%N(rٜB4b^Ge k N9 T/š W(\K[кTи}-m_T&T&>o6S) <英 Pí@?#$"Ƌ߻ 3?iu 1NE)˃\kkƼhsNPK J/n+s,8qѫOe0]-#iv]fsi6(\W45' v5˘?F oIwW ^1hC9}SQ܃d0T.ˠׯ=a>w%yzo0V&1bD4@w|3^uӍ7 e**%3"7յZӟ58lsI/U@TW^gq޻2Rq!g S~",PB@-kOŠ 0ih\8qPkxEl'p_qЙ1x&:o0 E֩wD%vU#\,y+}Ή:wF.BpڒL+ƶO)C`iHJ%#ya |~m#hǃgbh ,V`2.9> *|uX9wY"e0+g8r{0ů?8piLF,NKi(7vwI<-4jbz4)>:Ό]T< y*[捗RN< {3iõ>]L]]?P=a[Ҭiѣ7'h ue%@aj\̨}, ֬ }U:DM[*_ċKs7 ҬMT.׋Sӱm.@#y/UNWDKixЕ%ֹ߰"ξZc-\ d#ѥ A1]I9ãY>M1r$7*i~ HMATz нܷ` Jǫ돻Am$l mX V,:hugJw@zA2Fv\Y/cmEz~_$SYg}),)DV*d–wl)uV`;Ee5a*6=^Dڙ s(p2,3[Y}iWpj5L2`5UB\kK\t}"2TKD"E$׬ ce:S3& -鼔ކa=ru [/"Qݺ?ŝ\<L߈tIs/faz?dtt=#x8 Yn(ht>_\Tp%  O6`dF4}Gk?2"-kvFZK&rq(bh7s¨ %GJ\+{˪MYԍ E9@ow<޾|a%θaϖQTs21KZL.c*KT_Vg<5b?Ic 0MS&NBj3'|kLt`3Y-Ɯ@Eh=ovAQ]O9pGBdWͺoJ_슫z6{RxjO 8dN*;հ`AŦw븂&S8@fog4Gn )ES`e6gxL1]}֠@J=qsdVߎAA41yA+|gLQ {g!Tؙq2j@7#w3" QՏjuߜL㻺"fPPd#łm3ք'Vi8={4MME=>g1$4#Y㊎RCkV1b;!e}qbwE$?f*󯓾'fJqcUȓ2mlv#t;{Qgio*So]xQ5t{PY]vUP0R{swƟKA=iHVM^aTVE&,ղvx!:;˺ :q ^X oM١Pe:Tҥ Hq_*m _ s]W29tƢ;q]?87׋ KXRB V^.mOQ /6hK0]< $ZW{pAA#V|Fv/B)PP*?H DQJ u/ԣછʑ5 ˯mkeG{=s{>qלj~诗ܲ^~)seoŽ:qsNRYcj@()lsEsFW2)o8k'_B }} d+îv);Mu3q'\oC mw>XECσ5`qxڵ\e[#}lo,5k.hv(U&XinXab-ȕ'70?7oÖ' N(C9߼{=',,pv v36߉wϵ~Kڧ/y5,HO W5t$ $AWBGY OI7xY$Ÿ܁̃)"kH*ztGDq-BEԔO\dyIAaS}aj܄-VǛ i*{1  ǂW%)iIU"~%bR ʑL`}\5#9~XXmNauum+l4 -x= JZ_~DM ?,cD‹%$ A3G]ߧ]5Laa}VCj#kE!B2d4Ld_~)0jEo pE˔ҧ`R@H?}0>7gj,l>YZeNt` 8MkPZXyEAkWOj 淇P6ФJ$ŴnF/_* XFg!Y{.r lüi'GrlI[+7!բ7)?Gڇ1 ݴł*;T6^_09Y3Nь{q&BPBh ,W9Q%F< -.0;behW;/0 9ki\yna\3Rm ? {.j|rlX] B CvmVSX+N <}ptq>u (L鸵K&3WiЯWV@?#ԩ@iVyQž$5dgUBȸSR뱎]v6H
2;y)8wF Ll] e67ە$`A(5Mc\8$J/Bk|؋/ +ȷ- XccĚz,!B0me@*3 -AĥpÛ毄^%C ~J!|!p_#ۢ9Lzq8^ƱE2<24ō Ci a_UѮ5xIyN/qZ7l31LaK:# a$([ Piw4])CbI.]._kDZfCEAzkKVFLn|XE ųxV+ 'u ƭ<5zM0jQ?(/eiO;#j7%Eh- ;rJ~t- =оwUqfjCwC+ p]P*@֤c=ȐӅ @~LΛOWݷ9mWϹf1𔯡% ¨ޘ2J>q(̮cC׸`_UU }{blKѲO!$-C%j|*Ӄw/#9"+0'|]Ys3W։{;:I1SK08O]!K8$zI9 O7LE##]a4:Nǿ[\׮/b[B)q/SŃMwB-DpG w/`˒81i ZOrŏ=Vh|]y0mm~ٌćY&xTz ؽ X&=:Ae+LZ\M>v/5NN]"A!{4X&'ZM3$=Uk\I],1"kQHğޫn=ԉAOCz~Le5nIWX;X:@=6]~c!/%IꆘxZOq*wK߇˱>.,+Jg',! `}h} #0 Mޑa'e@'=^M&=n}o0%h=l0~~0*wI(b)ڀbK6x6S^n bk:X2Rl2=rzy8Rv s,#ԇй몸HOS-C֞m^6X%Qw5?ɦڏJ߃n,_`WR}F+4q;9e 7-O3hqأ ץu|K;ý0GD-Ӑӷ<"-,拙0ִ}A¹ǫIFԖڝ*$4֘~1M@<\?A]#8|*mwuz}RJ=S=/sv- _4" \C]NT{M^,<-T(2}fEhq+ *.G ,3^)سvSlۮ; ɂpCD%n(9!֞ Zi "f{M1Pyw}Fp /10h@'c7N4&BW[S`Z.WRlqq!.P:"`LzbCܥWi߶G9>'b^=:( +ȱ,2ZÏP6Lqg͈T>ҐS&ە f\,e6̛L)(ڿ\(灷+5،^P=Rۮ5 CtA $}:څ* v8㉒`!"?zA*&`ĝ,6ܙѓ7H˷#- 1.Ibi DDs+i#1yw}b"u- ط\kMWo۞R";L&B魒Jb E`(I9-8H\̡MlR,]EJl~ |rܔǹV*y2~ɀ`_0#^a:mTc ^إ0x FSl̨y) 2]xؠ;M-wtsM瀘P`4ջU nSrنNe&Ji ߑNju%4j9IEzV4Vc{ :U>ه߫#P-ͶԊqɘ ֛ BjPtceKd3Z6պ{Sِк@)kI4̀5Q-m2)q3~6}ZQ# ޝ8X",#f>~\Ҕf:>ﲓw0=E^ZY6-8'R$o}\=QS-c\ F0m]u4I/ռgfY]ad^rІm3% 3YQX5㗊ƌ\*[d/^Vjy xBrʹ`UʶYp `(1>Ȯ.o5a[(܅P|xcQ|4|  z%g^LXZ2TPc.xE{T $d5[ `b[ &t+%`˓mH*ϘBbmi\UѤE˚%qS 5"wC(Z+ez^N}(-[T^^&n!(+JIܖCñfSS%^u{㆗.S#¶g8zł2S^wWـhGgwӼ [aN)&JQl1EVES8ckZFi`t>i^CxK\}M ؛T(Ѥo n &If>=Pb<[u\xV N`&! {;@ޭQ!D֮Si^T l@7QRjC"Ǭj~L%ZQ xitY7wȾ\"JUtC~ CuKR}rgf Ibvc&'5*GeMQbPk6=y?)̓BY܋uR1NdtkE4|kpMAfM'X?sF6P=.fER|Ea&5,K,ܟ? q0xSҗ=[XM&Ԙkg ōKy׉ 6Gd,FHXv; ϕInYvJ*%ͻ!k[_@.!P;bFwӫ/*8; =*3m,e=$=7V ɉ|KVn bPX|$ݠ,?:|pkPG:~f^Mu:,OgN @%ǭGdגTt86 Twhgxϲj5ln쳴0rp83t~u-k, +H% 9$ŋH d#=kv9/JyɎlu-V@ArM|05te%OmI$ApX@(f1[,9w ,]pp0j -XX FkVY*˺VM7#Y1@,11ciCi'ηfNBY) u(2Fq|i\}e<1;ב sbVZ@^?\s"G;}\0`+T .htDC.A͘/^zVvxne[+ltJk LAN.>KuҡvAd 028?:uQMĮ% 髛>٦WT;KƗHS 8{#8Pjv CX6[l\K+8&3,cL.8J?K]+횺u=gn`Rj*G_"ޡHhx.$ǎ+ =:gP=a|ſsiEmڼlXASa8zǘ2_i=@^"gNH9I 8acs|3}f 'I%HZ1q0x ma6ل =؞~ :SvB3ڧ=`6 35"KjW<4Mh],$bTo߰ƏzCg17= bUxa^ї q՜ vkYFlNdNr op`O͏)=fi7'6"p'x oI~5҄W]by~]IPNp,FgMza'sjK- )v7eGQŽnjDS[*;=?97A  Tf?CjW)0Lv$@3y4i̊Yl?W2)(zdcJo]Irul-ђ@hާ.KB#vM5䝍N\)mBϑ">]L+0UM$ [Y[/ps بS:rcZ7BbX}/hI[`\6 Oi(f3WDè4Jh16VP]5D1yE2 5g8t pg-V7 OûgYѸŰy#2p/_pH%qDli6xbX]M 1Rh7yԱWw"Kˤo? |rg#Ro5?mhMg].9.{MfB^2@x]h$6?Eu%x\icWS}IΒTbNIkIq=,ZZS$oN)C擔) TڮF0ԑNPߦ3d 1_jkfBې,! ]L!8 ĴQwjo9AW´wUyh9F1bطMb@{LJl2 ҭe':8Ҍ|Yo)A?8"ӐW 5Ȉ3 )[ٝTu}mlsQ:a>Z<>|AozG'm Bsm ҢN/8eVx)n+|)G=Lʤ1CAWrMB&,c <$S>py3_ G1eK HU{JX!ACD3Ybu>VM!^_2l@ʞ*5NHߥ"Gg8Vp7J* s16: v{>8s@"ܩ Jl!pJTgv[ \9t%b^;gۭ*!Mm0 ?P; SfϗvY}m "LK@m4E Ќٚ}zH>>{ԣH2W/#93ſr+-AMqG@ȏ8b5:5xNt2 0vT|b v^Fxl[M*xkL\4/ks]Cd*t#yhPº6BZvv1.i_&)M6aO: 8'Ū<*]Vϊa7_cTmӝ؟α §[jֳօ`vǫŌptc`N+VMWV(֖tscmwS֫VC(h̹Joi.?Nb,եҎd_2a1,Oah1Ga!*XċWTsӬ` `h XG ;MEc[~ӊ 5M#Q@Xf#?al*yhq:7#zq3Z bAŃ_Q(_LRjYb]2곤ԝznPݠ"rgpC8h{fz<4:lA샎j7C[0@Α1÷TgNg[ĶR^_8u:CɖeUxԪ"O32x9{A܂ GHPIўBu6H5Lxw1("蹕dp"3I.&٦n$;ʀl nGkMtK]I.f+mtAl76 ?=NAw`NŐ26'nohvzi*?yOѻ NuV@ɖ2=y"e 8rD:t8K,_tN(#(+ngkb6@xiwJVsL# <|8*8P9, q[WqҨ]H Ɯ3K,gW ly*xx1yC$~B*N%E䯣q--]+EYn)<{f)TL#ӻ\h$G\?*ߞ.o>@֡\m0*Guhe_oRA[S|s}Nƴ,ar_Los^ɌD_3 0Bd2NkR1АXy$GHV=`?` +|Ww\xyGDۙ>)l͋*x5˕-`Si -dd:m%#6\zJ)ƒ]{mS-SV-'P^Mg_@/˔ V8!K ߝAO&VNCg:%늽{oƃ ^:\ВyVT;Q8]q-Ku ~c.Aԇ%QbgAF!RfK9'#v]aՒ7DH.#9-zV>tXWf#5jnT.DNBAIVkk6R9(#2bhFeРn`Qy50ayP+l}?ߤP\]OY;ڄKYJڇ N*lGrښj*Tci $Xel78vH@}e:9#kmI$ _1seU [~گS> #͒!Lf#w<Ʋd)rV's q~ńCIِsʋiwM-kk t X+(' W˞S޲# xhar3Gq/[w80ݔ@{_ڻm6sEBFԶZn1 ZUygVLE(C̶V06:/,͕AqFfW< Ĥ,|#fA *WAe02A/=Y`[͵X -:\U}wPz3%M"E^) +Z6:F$v%wv/]4$xWp{US,G: 슽lpz,>6GU+|Eznr zzaǦ- 'd (V"M3X fsGLZy!6)ԊK) _ Jrk RFş &bR޷P$cL\OVBNnFv_M\C_bN5m0 Ysw'S :KnA L}hreIuw>`{8O Q:B#&f.\yf[i+2BJW>gN07CeTUJ96tORS1c%Qzrsj;!q8pw1,TJ2"!yK/{v랊eO$0@C8:jljۓI⓸˯_-bPge9y~9,;ʰGTnlLΡ2w I1bVYJ=\OzO뭘60O6\%V`Y;U_/%Nm`=J}퍽ĥ8;rF1y$N;ge:y^df5S9.µr.Wϱb;+Aǧ>I$n>Fo2 )+~4Hl+(7f|< [>F1e_ ;#/eH?c(UuaJUoa~\aZTi~iQw=Nڷw%gM8y%Bg 邦lhǝ3c| kubD&ՠ"cywc|xsbb7 <Ӊp'@GS҉\ֆMND>ԧ*f;KЄz^*k*o@mIn4 A=rBv:MVkOf_ g\Zujݨwq@O t%fKC5}''uEKcz8pReL)v3 rFuq}Roo|Ak"&ͣC]v6-<5]pZڸ$#7 c%wD@B~'1^?*j V05ӴT48שH5sX1/inaͽL<J ;}<#A5X%GhcZgkjBԻx²W\ѐGEsNptՍv_(m,2dL:ߐk8y+hWM9[%H!,Z)*P?I~[[S;:L!J_qr~|N9DՑ7U/"k6BI ۰L Ze_:S%iwE$/iDTNyJ9ŀ,yTv,)FOȻ uQ2*qUj>|z~3>Qq .dY<(vju -SyT+e$ xea7MZy;ӽ1 ثhEt$+~'kʤYs[+{5$d&FlXsѭ|vYm!ϤHB9͑ՖYBJ0`=?ѶOU2fyH8\@cg rvbExb3[iy*VED8P(n}4Wj''Ri$xGe= Yk-/H=3bTPPRAh9]o?L+PڛUF&͜7 Ьl6Ḧn-v?xB_QSh<}UI!?6ȜBЪ-Je]U&fSt[VRy5L,Q7yR+ێ<>KCUωG^A{lf<0hZ;u<ղ6KUg^Z/htּGjšuil4 E"6;ؽ" $) mYmg cs87i9ZO#z zMUhڹz^{I]܎WXi9zp16'[i ƥ͆μ5KK2!ި\8߳'6MxU[{EP fpXƷzwYOϴt\ #z\^fjr9/#B/7|)3|g&Wbf_[.BuuɎF ]?-~8{p&@V`؊y_^'Uv0.$+ zi*7NƫÉU|L`p0)r` 8oU}6Va_,ߤ|-aWsZXsC@)艂30(k}H UR2pj=ûE ҍ{DKGza ZFTʈ-8M-'%z Xw`M/^_${3B$}I~w}>߉mJ>c`.Ar6vRrCH{p> ^H:\Z0"3Msv'Q"YS.I +(k \ ?Y7?&+9 ޘ;N++Zw]-#O56;;c,N U&H)NN_`V5JG79Id_wr<'t|DB$]t N;^?YZ*+RB5*\)cpR#ZׯGjI/j; *Y4K<ik8`3/kԱlH=J C.:J(DRCEڨ`!]gRMQk$-*RѮlw ɱHM@JV1Yď"ʷ۵ۅ&IZ7Z +%<{v2JáiC&)Gwg6g.͸ …~\ia[N!J#ėwqY<^bKy׆Ka#7S(QEIi oư$Xs=~ѯy}/ZDRƷ օ~O&eB} i11:"M~]^)nF:4 f4۾Ie "#u $Zhuflc-J63V% (y{@&0phM5Mr7nY*k;<.#n TR6+Els_522n8&0h%:_' 篋T@P~t*!XV>[IO"yrAmşUEmƦK*b7/!/uXpI@Z4Ü&46q#xxFU@&YxH(`<0ޫk\p#-uR/.͈53)imH|`d S˺G ٣$M&wvz3.BWr/l2J|(PaB>k0mQ<s:~7jFFޓB< 2cӭ?3\D_52~}7<bTȴZą<l6@vk[Sxri[sU ƒ^ML{ڜg)[M2&$<_LN4 nxBt$PpAKhه֎X` ܤ h9uVcLt ~c<~$p$a)b;sԂ'X`2 xc1uAt^$7ZaL T1QVZ}VN!D0b\ pSȡ]_ʠ@H̝{j>å>pr#t^W/*K1{mW2hF! -R 6jNR*dfno a (*p0pݏ!oD#[ќ "U}_끌ڮux`54νMr7.c1VQ^2 wsP(hjo.q"K (FjSyݵ( E`!=qrR}p6*ҜiBe4%Ha_9AoI9L1G4֟PKJ2uՓj$ff"kP=9qV^1=֋osa޷N&Z4' ՛3p󩺃 ݵp!!j)hj,JȆ?!7Rnﳧ 1;QRn?JI0e*?dC, =nm5&fBbG2UK[ْW}h1ySIeDvg>ުe=pp|pc"򀶈`Cq@BgAJ92>Pgv&Z֨g*: *K쀔4wW[L販"M8;և%Ur[lXekL-BF=`M( T^ ehϢ"Ȗu;inhoϥb_\ϕHƩeD=]8shCs[ (T*rM/ L/ozV׊`'9}?jzٱI1(;Q͜ u"`Dq k}p?F!'8U"_3wV#) ,eBQN0Au`9?!F! tD4j_eqչj“Ƌ`>s`l}e+hBE'f@Cpq0TRNYD,2+@qYJmyrW%jYL60 F':~8my̜]DӰeRFNĴc6۝S'U_'NCJδjx&[>?8͸!t+PC\kKn͇98}vX3,ޙLriR jOߡ,p4n~R6tYηΝߟJx,kK 'rd8_dԗHQuͩ:)pCU̶G ~HɭKl>jWaqp!tY0~abbtp #kdD/Ii Jvu@ qcqŀS)oGnxGTϳYp ,%Q"^na[4:,}2)mΊ#Ott׮H]EUl)?5Szٽ0khE\^rTjf-sOv4 Ƞt}d?Mą;M.%W0(t dsOp.w仒r>OH6Y:pԆ/E8|yU#M3);2׏wNKȓ[c|loÝ!0_ C]so:+̡{ mtgך9к*zzqsAE" B%k0WJqS7i6!ds$|UC$,:af@>)q}*Y$X U %XklL-&` p* aYCijDL0_ ,񝚧O>"߫:^MfhuRzMoyQ$4.5wViP}Lgޞ;e[[<:U^ HIC*7psso{ g=o k* ;St? Ld/3UQ!nEt7:aӰKbX;4CL0Zi_ӌe!V25]T73=.ᬏrN*-D}hBsIs4IF>yP"t6TZ0FSr!bW)b9 ̶sD'AN(2п(0\ \Sv`SuDn Z)" o^hV)r<0TBOAA>YpsFzل~o4.Fl4xp阋}@GA-*;ٺˀpNݐ̰eRp .O_ϋ3y hS}qϗBR"}up=\? 2lgym/wPU8ԑjfGWh(2R/!PNwPyCpP^lb L?{"B[>f(F)j_ 8a4#dË2pR:ď)ƪ/>gw>& uG_gC͉dy'#)G b]ܾ-!]~,)`r߬uY8l}/K e+/dfPGCy5@ vAvBf lD8z1|èXam#H? +_Y5]jdpi.5,\)<*Kmv}|xZ'DJh%<|SDJf!zwPj$1nJV K"tt}r RDs0DTa j_!1>"e󐅜 UN~5w+< >yCI F'SWc]8TLTFKXYRP3p!|Wnz!];)h3f -E O(>YK*oQ$zSkcȉSEBxqN!ިs[\9\ƦB2Xzz$q彗f4x_9Nf* 9Tk^)ôżk[<(f'\cӫ XpB@"aNS[(§GKsGSПKċ(n8p˝zuSulJۼ6(QeZ/j/<+(1"к1kŲuEolPU ?u0VK37ìuI&PKd\HK*pjzJDd(u6c;,}Jcx񀽾k0$\5gc4ƌ䨙dg؆󘃓K#K`!hUJfG}?ϽC&nkf{~HHIѲpV>T[N7t0V&l$p$O`2,&mS^ʇ6԰NX(yrR45ژ\[S$fq:<ƝZ.O51%YݹqdX'rfTNKpz7[|:l c;~!>ؔHLm~XgW{I4柫6lv2\V3Z5U\T0G~[ ƫzM[98DdCN>ϑr蟿΄gGv>V3)Yw q%ŗ'#et}nOg{/Rʀ|w ^Fyq!h]u7%0)zfUu{[8验ABaYdy!tw 9.Xko/DBCG}3<̦&Vn%vtDNDN*\#NJx9_'@gY}_x$å|N"IC@װ+[ָS#b L"qH^U@S7ٟ@cuKqаFkSCվ_jE#gxAG&>1d[^chҠëW[ot[@D@F)9߇ v-0 ZuHcbhׇ7B7([VrPXV˾H' 9$ȵw}ϣ ~Y+/"A~FUνW'mRͫ\`v3%~BcJ ?hxfVQӗFSƴė3e6 :5oMT7nV`o_)R( Uy<&J;kC `&=k <\O3rN!)O2+'3/' J9D~n/'9+J*Q(0dR!)}"i7UF`˂HZMPOo|c5*] ѐ+jG͈ϬQzOLedN$j 9%{ OmLPӦs>Q8.]kWI-%-t{:>u .aP%扃 OUC<:P3p+yjJQ), K 7_ ;hk*8Vic2SOg`2#ƣS N#Ck[IYRX֎"(wO9(fnhMU%4yo(5࠱ʛڍ+|'xBI9z"TraAM{ ^ݰZ: hVu[YCeriࡵrcPG@vs*yWd^xED2]P15~5{[<2n2@@yuX؟aЃ2WzY *Wl c;zLDBq{*QȞe"pD3_~!);"Ȅ;MRkt.ؓ|y){k53A͛FX5#G_Έ)E(@S!͋c"X4gPFo'Vq4w*Kh/ݨk8-d{MvGLfgR0C$h[ALiBrӊAH1KW'i p ӏKX@բūJ' #کF?& !IHuvheOXm0̍^NWm<~T&ݸdZmjE'Qγc7 } #LEW/!}wZ\78\q $rug}qNe*虽`V04Ko1)xP/N=b!б#,(#ϨPt5w{zs.RYۅ 9_Mb!KttV7Q;l%^KV = 1f&eez̪fwٺQN&սʟ)oWp9o/*2=*bvq8"`~K  <\$G2w'8ɓ1+<] Art1tL:ΗiQ-p3ՖGyY꽤(.e\tzؗPI~+h׺,d͵(L~1a@цP&xN IM1 9Qԕ(yo)#j 6T[{HE^c3J<̭f3T_hi$#¼*tc*ׅH|.Y`i hY-`~cS àUNJhjvfot#aKJ_3}Fn.?:tM`خ YG٥0UH_F@W+Äĉ6 27l֓ŷRkOyG̻ZeeN/eEs D0Rqd-4F׽}|Cl ).p8C(_ =䕵gJ&u24%_Z~k4zTHKXf^r6;$ D7LK#Q /ch-~2"}oQșOYSfhCR7b,zzͻfNfQS),PZPh(ԋ^8`b35kV0l)Ylђջv &W'>F39((!*9!TXHBߗ{"Vn)t.@%$I(L{ziRbKX댒Rŗ+li+t-'OI8ǐ l 9T_BCj,߽_eu.L#E|(y׏,2Jj\؅nJT -*'$돟 O'Կ 3D8vCIHWip?dFbk}d^٥ (h,CT#|Su-" VAq2 -~?/A0Y&%'p˙F!0x'_[5Ů,3ֲ?eo p''$@{ CK0DOia*6m"͜_I9Vh\|rh;R&1_~ɽM lݎE~ #zI=JT@k-)"0{< b3\Z u.;A&-!?g>?24ֶ Fe.zdRHs[V"g|fT,H=XJ+0~}1E祊D!c;N82 J?DXc2Z`ecn6(ڟXYi89щPnI9U[LBgZ r$0^f p 뢈y _a'tkaNg~. | v7%>i͊O^ n@d];G,eH_ 0kHs؄ԝYV@Ji+O>Av,T04ӣc8 ' |!̝iVڽNe*Q9୸أ6mW]]Ch^9C4BM6~=>'cw4SNڦ5Q ׺}c8Y,ojWDx{jJ.(0Q8B(2S!~騌*ހDnŌEbGȍޞ'bţy6 _aI/Ig &Z)D)ȥ4ku,-DJnsAw=ү2"t|̌z ae[2c^.u"5˻%n, -׎t"PU̪kD*_ϵ"AҀy~>ⲽO_Q1X*1ڳSA!mΣ=议xN`+ƝQ6ŶDq9^st "}7C#md7LsQ+TDϤWF : *6TJVtpw[d6D/@ewӝ[K]>Yu /θeȾyCIap-ޕܻ"gT9[}" EӔázd(kIsSZR4xyajNߛcH]7U%XQLjhk<?HO/2g#AX=;}-Q Y,lf&Vh>3$eT]wGqVw x yY*QZl _2ʆȯx 㬛REѕuCGKE a+: {Tw/T[QW~Kso hqz뻒MT?`ſJ=ő"=ebtd+YO9x#vn=< c^ mCJ<Աa_(Ne=ÒΠ%rgZ.+ ^W:}ZMg~T4kX<+nsԕu*F^}BnėcAU4[s \jN~$`y3K~U"^KHp4P_lWO\rh?jzDcY+F;{ht_%[6[R%'/IjދoK0N@ s@2gޔseiHZCy-B eXqB%+[;4uYe<\H~ &<~hs^19;&Xiw)}NV' PrШ~iuSru@G_enzi5TVv12;v4 HI^䴑 0Vυ{ɼӦ s#'At/X_;S p?~tr=2x]XnPwC4=NW~$ơ}kRl&ג@9z5K68hD&y4w.hg4;\cVG 7/P܋+/9_Ml̪EOS^d/bGңIbchTY@KC MQ˰% u>!F,4%`@^c`7þs 2ف//g02 D]e=\aKf|`*od%J/b3( bmҘ*U,G1ڈ<8v6-}pzr@(& PmkS?/Þ5443ʣ XwݮPko˄>7SթWJAQ'LˠgIٿ5fx9߃8h7,VNP<'i."JnQjVriM ~5Z__OW-g <Hi)ތG($|qm^t]ȤՂfT$ˤwVn!]k\Js'~mfћr0.>x SsBOL @V:Q5~m@i+|fhpR+|Z*ќ Hb C, f昷Ll}/]4Q;2ڲbp4a ]ICQ_NC70ėgP -$gz{D lAj*D/#i˺['΂l\xQwt)oY̒E&n]9e;f6uA/\<O5Zr&Qm57N/WmG  oI-3H]P-Xbx;-:F:7Jgg V59QPXGx}Ӈuk6("C姖_Bjii:M]ՍC:T_-ۄñ[~A9/H{^6\>Vҟ#mFuxwp'%oͿ#2ݡ>sY3+~~B?й:9_֪&T3@;OfR9Nr]Dpn:5"]{YI̺gJm<,.fQڴprkt;fxQ"s\WFx#+̑_\ o3& %?*J VEnE2%[]*8;%c{C B( % <)]UInr&-xcATx)iM h>5t&NBI8<tҸI1a'4R= cHkG ~=c8^MsK{_lDż&_ 0хq} Yf3ظX(LuO&T'5Ao357f?Ww5PZs]YJS^Oe#JW4R 5YrEӠ^s: |B"[ T?B@_񤶝$g~:^(2x=oNLiC6RĊ H|@CP(CӪ3I's>gbYq}u#Q3J }Zq4!cqlԟ1n(q%kMSBFPNM;|̩hO$0fm.+ +ʃ'+lpi}HyQ!9"R*kp/prL,@`Ha "KeT+P }.b<3ʷUxzVuQ3/"d4xpU.U<5zQx* xω&7|8'& + uK-t]oMJxd#ݓk@1 te`IYI*fsuhOEnC#mO*JGYi+zr5%AB%4 縩QXJ"*UVNţ8s!\q3? oR%N>V7pKA0 o.' ^rZG*4&'i%T^< h!ݽjՙ!JFc (XkpZb.? n㜩s2ftlwH°B$l7"Ͱw+ϥ LYr۟tWo u`>X$LTO 5{l,} ԥ}w39ld[|Q ΞzdF,]_c7crӶ :sqU޽SA3nk muCCe,DKyu9BmţB3c !ٹ߽JUjTohWEӃݘկԬJÚVg \ h+NA?ĥDBjNG^?os'2İXb]E'^P ?)~[wN e̽ت^nt́f;7@DZ$ Ep+f& U説<\VJ3[ۼt(4@feK\Ynɒ9ywz ow睰}BދGSl#,AZ#bqO̳ /_)e!C"Cn(YSͶ^:T_O{'\<] vW:Q3 |\=s=xљJ9I V>x)<nzk9hڷahbTVXRN9)MlrC Igrˡ 3Y' SGUue~7tS{tBrx^iRm)쥘yn(SiO?~ {OHU~Yzmnx;LVR`&L) @0yQXȚ!)x엕k1ZPT֓f.+du~:4Q5?jXA]U &{Rpbk+[UwHg~_c,#[MC@thF}rc M | a;L ~nvP(Pj<~BJ[J~Y]CҘ? _@Ӆ㒕* YO?zKOF3{a.aFv Dq?L2ސc:Y0*`41m2r ݯE:#B 5XWjZKG+yKrXF3*U;X5|SyoEڢ0Ė )d36 Y,yBCX **BIq'էzg*8(yW eI1=a.'x)J*ր-q`\dCē4!])wZ5V"΅d'H":D6atF)b°?gp.^Ț<Wމ& Ԁ`Y&1M2wZy ,$sQ-4YrlCg b=F_b~vghaY̐3vxHAˀH&.7HC?p r&;ٹozHr?)SW(/\{+o ]mf Yu_\\hH~/\Gy>O[3U5e vg,M5:#)~_[-M9eyHXvbQH.(^{&Lw b}4!fFZ ˊ!ϭ!xH`{V6b=+[ؠAԿ; t w]V9 Ȯ Qt5灛$B@RL I jWBرs}]B7wf0,ۮ#f] 5DӁze2Ty'zToV'>ׯdlHPMRNq2ys[x ńPKy mܷaMBؚ\puxs@@RTDܩ[S4UݷDhɃC)%VjTQh+"mCnoZB]k(@Jn{8.\:f!zþ6Gh-`sȞ|H-MLwKRUbgCm~Cn?QF*^}lXʅDgΆŊG.5? Nom*h!I&䚄gc2{5x$ NbF>X~eeHnG_ fu۸q! oJ"Is<9;"( e+:d җ"Vz9UQVXZ}<ϡoXsh_HҲ֍?IU`'T.=A&S[Eo-O_U0v(U8MX>0*檄h>O-O s\H*z}!L<˗DR[NME #J5"ey4Pe/գݜ4_,~OF)2WY?.-Gr嵔t߀DK<_HgQ=r0fÌOMms泗X5%"7Rbv̎Ϗb 6H]n9RUR!6(z3&cIu=@(x5p.tCRm hkjoƩ--#xyo8#tJ)G@fLZ8@Յ7 iFfYI)hDY$c< C-TmTB u.;0;yD; A- $=UJ6JhŽc4ʦsSA8uT/~4}*VbyI* {Kq"7"sռJaLGSf8{{V uQ >iȎ-)_"|O_wCTX#|Le~N~kΧ: ӈϯj羐/yhc,?f <"y1"ğ 3;H$&86RS'|%LK9r쇙tiɄuN y?\d8Y ޕtVp07~ڇi"u _9ՖZʓ@%lZU'(=/QsݐK:-GW&|2_hi 6yV"Rسg鶲pqVNJ-h\ H2oUv"buR yzFM@͊]A+=$J'I/ 簋ήkq;(Ѯ?fT1v7!:[yae44A1\'Y@Wq~ -wk;NΞPY* a}3=ŔAt/ .EBτRwՆ?2#hI쫡ݍ:CKDWOd~kYz6.ro?\0yv {CY0%ي<һ> I=#Ԏ KTva'6o/ e2_d$@yvm$)QdũjK$$چj xwׁo*ߔ{RȍtDV u&&Q&^n*]P{@#3/T+ ^<`)0F܉ޘ.41.7I&r[7OJ"lPzğf#GTSl5r5 ћПHuϳ~4nnk"@F}3Kp&Lbxf2U&V@Ge^JA NA<*׵֥:;]禾XwS*/q$$bMBORPq,(kt(ˎjoe #2&Mp*lԑ6l," ,|/;LBؚ'}N>FsNbg{(g@4Ir4k1? uڹEkѿ+do'}z-K`.G6Z?K:O F %ln|,]#J S:a M#=O([5دw S+Md|8t\ |zK'/1hH\5wB;:2H$禥tkg^ 1A Z]̡k9Xك%dIE"/ H Tb&DK0l K2x钛vX nGm4O=}aP1}ms c{+U.ץbюRmϔ-~;k:#63N 'v/@oH'4XfZtB7NWp973'sccz˭,`@ b`iqLT`8R&8]8#n:!Gh8p M¡EiIl[ DÂ5_p/Do6).9Xu-e5~E%L7,"Cms7Nf;x Y*x*65NKlDL<) )M?t1?b^cKZQokQMf9S_n1|(>LX"4ksdA^~%";thn7j%Toah\lOAϗl-TаVԾ蔍?F\tbCYJ0m3'L !Z6ODX0*ݿ5Q>懾 ,,)6qwYC[;='fK,N灕X[ ς,9U`nucyR8pe{MUD cs6E%X9ٙkTyݜ/- +iJkj/%;nҜ GƹpNu S0YibZPXƓrAby7k`I Ӂ.lc|^?a:(*RJ NWN"xUYjn 4%?ɣQHXƮ'#'ߞ(']jd~*-zLcweDv@۞Qc ^Ngs*JSQGZlmה~jQJ4^R#AS?6o_RD/݉pˁ`S,J T0 8 pJyDbm2vA@ўB~&zz5π_3I@ B8F Hwn$ڨ"䵁5Z04JmsrjkMk^^->K*~cIX9$aMmbD4/TBy0l-*տnjч#7k7`Wٔ?n&xotǚԤϷs.-6lS W9PuZ,b9QNR  }#fZ觍QюW>F11@G~|R^&`La>Edv]DR_'Y!4m {|Xh\2rh܃Y ٴ>n $%<aEΙhyH} 6,}kxE-JͬKGDc,: s /uc8@qTnכN:ac (vLڃ*™b,/ݻܕ8G:*LV^ bcB\tyjƟ]}.y[C^j3-4d"-nQ%r+V4Z_HxxUv"<1^ɑmncoeN J{]a$NLrK_TTaбk1D?(_먨C,Vwj{sD+!"(Ê+ؓxģ7;H႞I&z# &1`bA|m5i<Zvҧ8{tn).#w'#7%LO/a{6k Ϭ==Y,@)1[,&bD–7Q`}˗t>S(;5ob=6F/wu;VÝП"oPD'EF@:E$+)jk8ьhTdFQdxNV(i߻;ߪO{ 4D>Cx# Pmʢk42 ]/GD1F`[z y\nSt]}H0ir~X[Vq8^}A$4b[[rx 0s8*|ptGW`80R5hy.x2>k*IV{8uNwWc"^9,?7I^];$g+6_"sswdvgH N9՗E! -_)g gyag8QA?Ѻɏ5&Р)눌2İ{2K-惑?U>r{cFkw܋Ee0<_8sES@Y>XT"T!cC]Fy47SXs/$THx2\lٓ>Ƅ4;,TN{xDb2k61$9H-2iT2a}']z kkva"-cWz*(Uo*jgwtcfșq|I;N=F* ><=+5fxpQp^kDI6 MQDR?#ğㅷfr4[& ;~xRoP5N48eK4#N5Vkoq^z2"[t|8HH7S-x$]7IF"&ic܂F3GͥrH Ǝa?5\mk5H#`]Cy:ۈ!TR JZ.ShkE`뫀@*%]nSZsX;BݙݫF!%قLRٱ W؜BRh-בubBǣl6oZ;lDZhvoz_QaPCoBR-QNn(Tcq1 ^Ӳ.-8 Eb&쑢 ۈY[e&.TzNi3/)1ZcN<M6 l0dpD 3& xM^w!nvףKm \aw[RnF7Un H\>dlF D+a_>& ^1 _ݞ5[. 0 b^7 b㘎np!ٔ0$c?N-sNңk GH73f |gwn;f QiVN)rSIʒ(:AZwFC@J7'hT7tf?ipq kPGrޙ^ܒk(1e"-fv/@aۨKl*CzMJ;3CQ;UbKpV*jB]\ݜ7y-zWϙ)kGoB:Zvo/Tlt-jG%ψF33c?2dE}9Hܹ׊h8zjEJS^GB&[=K][TXNc,rOJđGTpW"cy7pO&'o #]^ݚt(s5޾O m%6Gf.<tw)LFh{ZjG? XD Ծ5U%>'RǠ/ xRe$}`c,Ӵ@AK( %tŜ*ri (S(e\@w? 5Ha+g,ҌApX80/v;n]´24F$w7N{*w^ހX.g`.*qm^2׌PwU8sϟwD&k\FꋸЏSک`.{h@V\ORɐ5)74{i8M*M2FPG;\}'ZIF1fG 8G|̪za4 'mٜIcKow(\>4%. G⠭oM΃00z,ѵUoLHbj_gV fU@26 YmRqZi)P74HO |A~Y$e7ѱak ./17=)2W b,&zF:0R$F<"n\T}P͒N=Xd= 4mI(" ճu;-[WP ccU"r;PT!vF%IPw5zs8pa(]||RǞ$T-SS?UF/6~"6#)wr{^6oMYE0.S[-J- LEoY A\C}%zx֓ ڤV"U3oG*NVXpk'w 𠼃^_ZD7V֡6"xwA:/ n Ft2hHaв5Os:|(Z=i}Ll6)@0ls$?

Ea~uBG ^@VNM{Zl.5DGE.ezqn`pafN=j#bs͑1v}<Fߗv=ẖ˪[Tm,pB?s:$bTG652ޟ^}+j9I:G>˷J"ar|bR*90o”dՃY+ZR65(\lBF9R|2m $y{7{HZj(J ;!~ɾ' rH >x9WNDO5i^0aHrD3's}*Mi b@!CCra|lGʝEbZڛ/jX34rL?_Chyb]Qw1 ~G870:h<Yi'&jo` ee4ސU9ܷ~|#B^(VR&brϹHEv Zp|YݽS]Ś,:2Ovh>ZDJ5[TaY(&Ճu-0eGν~WbC(IZh̪莾-X+ݧ˪I5+zڊ@5zOǛ y`r,UaYa-Ab+IϽXҐafO5KmnxU#q)qx^ ּ)KS?Yt;ޯ9Vyc,Xm)i ZzNY4e[W- u\B& Z׎]m՘":-6so8)*F#*wa=| ė3,HP(0uEQ1tpGɵ֜=n_IiFd46ǿ#M8U!*&)F8]W1,ߋzBJшP ^@Pog$j`Y- TAZuf\+cs< 0Q3MGbϝ38ojؐRϯKUs*6It?4Xj3P6dȕ-φ/xu&"sgXk0iqKIh3jZwOc#t \cB1 HTamLײFucӼ2r׈ߤ-鴒u~;I!sDӜS{r$G;*H I_Wǎ]^}^_=\mI4%_Uα*DbBA#rVr#n[s%/]DitOV[sҤ@C>_UkK6%YF[o+TecϸX;Xt-58ڔٳ Ҡ/?bG1ď땄v: RiWSlZy}o $7LZcy7-&%߸ cgٌw(i+r .srwAcX0cWyBwk2ch'z   Ee hd! i3dc5.*W]Հ:g#ޜ0`p]&Rwql{2]rMgsթ7KKV3K8}N8w:S$z|iG!FIKԈ"q'К(>ƐH٫Ԓش?bs7TGLw6Q qW L5@M*\V2)xEfJfF!0J^?Jnrl ?4p0 %pJA!#7s /y;p(H\/IRIk4vM;}XB(t>ۼrIRL"k0/-˖MZށ{lcDo"( R$|~-H+>*>`2ԅ,y)<*OM$cp,Nuv sJao8<Rѣ&vWШNrm0}&A1(xQ!7G^n1bev ,*:m$%# UnQ4DoQ6tٟF#% To t]2\%Pk3?)((aQ/cwz+I̖q;(>=ɚi1e$~D}w׌l& e vyKxy>gQ-STetK/kq(7?qGK"qs7#ZxPveʴ@h`Q|.s u"nMq>C?Փ?dCGts5K mf4~PsYVQ9ȵ'{5q6pH.\弋4v.'9 [a0?i|P橏bҪ>PluSzs5M>[`#EN-"PAC5SQa,=fuM&oO U/B7jVF?Ge)ݳh N!XNOS6\]N-Q%f]q:qWװt6i: Pg 6 07EB*D)>?!-yψS-R !C Y?dzD]nXvOQkAץF)fBd~2/s<powR{w3$E e!∣-9TQi~Y$BS=@z SrZY{;bȟ)k.oo&(}PGp*5$efRw4e($&Eaa~.qMXdX.h){1cļUx aB-Բ#<-*ޖ*B7f!ʳTRz`Hgg}ȱ ۿVSQo9cw@ޏh|ʬ\UۃkBn+Z8^#bNwG,T1oH5m<ĜdÝ7".{|Fdͺ$=D rLa.`X7|%e/n1pU9Pe\7rd*ϥtk*)d s4谀BO&,APkN#$\va 8"p^esx+ 5&l#b/NP(:-^Qȗ |\Sii_@/SDVAj;( ú7-#BcAK`m%1XW-JG1luߍ,.T.X ôx~0g_QRXu&џBML"Ϸd,l%^fn)y?ytڊ Fjc_fF^-nWt"U_0z)2[/bՉͳt ɭJ\wĭ>T0 &rLkKwxND|\KY쳑E#B>=Lș0^\Q|֥/u6gt2@ eHݯ\MYmNV[fn( #c;3:&Od'Ƈu98Nz.xIʧpf{s[PndX}(ߖ#EUL`NqBnީl\KyՔ?kqp)5yeJa)BFx2=8%XQ|R[9g2-!m颷 SR/ ] :4G3x׿Edv|t97HAhv߽/Y됞ٲ|ҏH@ˌA1fFQUzBlSbr̾LXP0|+(ySL?_ FۗE>S=l^仴ĈΠ L-!ߌodO6_Uf9=kܛ+)OhEɽhi0SSugRD8*b1n]=R ?r`brއ;5*ˉi*zȔDzaNrD*rIi ]RuZbg?&&nړbuSRC/:JN -0M^E½9pLVww&ݸF8Ӓ÷9BY<;e~rk4k:Ť^澩jYAm ?-X]uGV-_M.?l@&ǜdVgKV-"[ wưM4b*7;Dr}V84q7Pu#\،1;}FGŵB 'OUh Ԩ,g+ q&}NAskzڂ8J}G',fHH _gK7^|(_t]n27EcXhQSz[VY aZl (?qkEV;~oc`?Gm\/3gR4 Cl/w^*pNlĚMSSNjQF|.PBzqb#SJ|K7mSrѶx;~pJ汅PpH=f{;_|`Vٝ ,x/ GuB6;6i| 2Q=Qȳ&.Q"=27Zf<|.?v 6UL[oܤM+H$1@e#iԟُWH1$$c-1 Lػ\l/!"wfjEi<w5iya*]ScYao/X*ơuG %'"ݬ/X&FpL닑YVȉ1@tS)_ ambS&HQ)w/n7tJv7IC7%96ۨy^e"Mő}͘.qZɯ1RHSlLueA_xriGkz>0J" 0hQ@_8ϢH9b!4G]rwB`C/OuƋip TIL#cuYޛ5yUxij:+BEF:hZ!# MA,z=w2:*5/buP[sȪౚ"]ZOg4!^S/$*VGdK5W`.gNv${j 3}܊_g9tq& RFPb`$EM&!.p8FҳCQ7582caziwPL ObzdE9[.vaj,m<ŢH*Ӵ,"rfS/ wByo4("]kn*]nb}(#E5eGx.𳪽JDoLBW,0M0/h <{?AK@BkCǍ3KG6cC)Ҥ#-ISgS z,YorDe JTߒPKA>Benqݞ#fq= dCTzJ_-$×~Bpks@N GS9Pfx[;,J%%d08wR7bW|SG(߮kP*C8;QK=\:J c>KA4jQӇe㛋r%O·a9 Qc'.7Ƃ$mZ,2YhxQku)!phۭX%1Lmvٯ9lNuAz *zr3 kg}`a5; EA5Pr/fGQe$Ԧ>nKYt~Rcyس-j-0y]z!Ǧ c71MLrа9DF۝ 4zhJBNك;J% `C %_mlsvC01& _w,gce5Yݱw hpA{t Jhd>{.x( ц" ɆdžMHe-BQK&bwT)*<\M^#xW$m\C{Κ+iR:ZY&$|Z_68ҁH2@z&W#r'r~3("kcXXW&C'Ol1M^ݕ/>>|a:GέIIsq{!׀+QT4j~gF=Wq)$s"/Ʉ #+;Q ʢ'r=P gL@1tBOݣR|[,3B]zQ,,нr?3H^;^oqv\f'N88)?vS{fa ,.q֖&[9k%Gk gqU,+{ dY;@%m2%},Ieip"NmYD9ө(߅^=< _K&cP|tOE/2ׅk{rДƹHqMI,HRXHl\3oSq׃ !3 |b=v0*$"G.W CZ :M~/L6 MY7sJ3/(mn<.`Irژgz-̱ ˎz@ͥ̃PF$hl%ZƆ )_K/ TI͖fo,oRS* ]ޟTӨ'HW.Wtk07[oBD!soN+/jU$SC4[BL7A\̜4s.=?|TP|K8eQQR-i]!0jڇ;N껈!p,˼uKn,Qmf0k]jbH)s#E M($+ g+ƀm_vc*vm@ZuЭ?]/!d1۞eȲRk _BQ0@Br@[r"H><#ZCw0ka;/hJu\DW[SD?\Le>(NFlx3J[@c*.>iM* 5\3'xQD?4wϽ۝fη54搥x 6~ͅi pKAoԨ{+$#vٽl̗řҫf6BJvI>> K}gVpM֜w")Tq_6W>`āfʵ& 8*O#0QZ7?̾x<Ii֗HuXE{;ˆmN{l4ؼLo-|[J(fB1ridދQyev3ÆL >U_Pʲ~1:$L˜rh[@PZ+=g7f/G.ػn׉F<'J*K^b@r|+F),6W^FRQf%,yjŤq Vx2;i՜' ϷQŤAe_0L!E3K*a.3wxVִȤ)YY&)hCWa<$kA' #C˥jS ;~+|wOF81yʸ|P8F'7`D|{,e#o>Zt>__RJba:#e^7e̓3pYخog7BĒ˵#I .ɛiYXɾn &KPCȯHC C $t3zc$LgWL7KAURcQWzQpPY;82RB`D@Ye] %6lpX9#c>7p^jYjoPW Nc恁GDÜ!H^A:&)?4[2.`HQ/ lDg<U|^a}p0B2rv=9V^~,U Zӹ";hc r9``d.#%fB"Z>^ Z,4jVS 3Xt,2'dn !\/lP{ QV1JyX;ֱn^fWxm/n 6,Et{KP]4%8?G^ Z$(DB WS𰂤zvm= E)jT_>D_ O)z'Y1ܭ0;f _j->x YOQp=Z| GlYe],^e sf}2ɄT*L 6&Z/ ,_W4}<*FK`G&nA=ntDhކh6>bjX3s'@kglhzb厺+_#~Pr4G< uHի`8m "~ݱTxht+u}P3!2@11L|><$%pHxZi/DENo1Yޜ[=DOR`k~b藃9V^s^iØn5u{hYkt$ħh8ؿ.%14 +f#Z*iY0Bsw!NAG ԝ1i1/iLKWa'8-eil5#+;םMݰjFV _'B8ݮ5Ëv0 W%d%Lۣ\hag )zҽmgdt1cGʉJ$r8վL.EG4D==E# )f49Jg@ g.Ƅ$ R٧xys%`Ka6]@~ 5"I]8uj]}ĆWgm՜bT 4PI|g0MDO۷c4 eЬH| " Vʁ7ܼ 噩uM W5VW/h)֩K#O}=A~RTdb^$l/. W!mfp7L4E1A] "~w̅(B9O/Ay1%5JV揔u͡(=gFdZg*$ѣ-B({.ٖ <JyJE:jޢ啞LgI7iSoINvk̕iio\֘)hghzΡgH/1RH:gs\cm]Z?9b$jU^.̲J/J{)_N.*"cZL1^CX~= q(FPKVm kLL# ѵ-9v %UafՐIK]9Y<*I~Z}`|xdԠ3BĒEOԯbјy:TJ4sf ,.f uؽB1ULә~#;cJ%Y٧Dv+ļR~'Ϙ&L"_>0y`?*EF TeN/BR/[d۴tey%:8̄s+EO'``R!򯊰V<4b;*,d߭B5R՝ԯ^`&=WBdٶy)X^qUQ\%Фo6r\"}y5.=rS~j6u/.3I'^"Nj-dH]ik6_aYН3LY |UyHb{̈́J<0eMђףǡ j՝DtCux%OatSLÍ|aL Q neUPl-ap4RH~uCU+<8KD>h- cfޔ!FYZ,UR E6.Eu%})ѳ`4+cڨE 9{!qDkFܩI.3 M#@7صOIpt%TDk2 z*)D=A>I5EZLb! XƧx5S\UϧJ-Ք?j4LGd}watߴ" jKCZ6' No(d96pn 7iiXǁckNkQEix@p<vgڡU@ZH1"\oUGLM`eN(t$H/ys[KBRNBu#1E:Ex6Tl#FJיwtWR1 G"ٚ&R{ˣB [!jer7Oѡ<:pvZpu4B>E͵y|gԊP ?}%؞NkB5nr E-$?Vaд<x![VK }A˵X>u[2t ^kSa'9% GRc`rA831vK:݄CB |7X8r@Scl57v*,GT!刡.Fkh AWR|`0J*Mkb֓j\al>v1rjΠP0 C+iBVpQC7ȖU]Z)ZЄnYq \)e*l_]qk(i?("ǎ %,` ٶ$*#-(:*#ի5^ʾ}-qBVBGX&_wtaM"74tNw!lKRqE,Hxo層  X ( jiԳ۩{CVx#;y&vi(,i> ,xH=7JϦ \$ m&î,o=v}:|ӨXi_K44hnRH-6#?9QvK"u)zdk6UwmT\uش|jLCQ9]k!v%⃆VC׫4L˙%{31)e'X>(@3 Y)@ \)ƯQY/V f_{{3,`Q d漀:6-/(mQBvr0e\%i ~' IaH^RKp/R:6=D$*RaQ"=9 {PaO:C|O-N~ ,ӦxeiCɍg'0I]:=hHzQ+uϛ-H+o=QT,{}̢tK[ӹJ7jyG8+f+sf{IN7pOJtX]8'^:H4{ ݿS[|# T\r(ZaHT ʅKf\_] p>ݪQ8G6^#Oy[KꩅOTs 6(b¬qZ ;y̘ 6[01pSMZcNc||Wz?T;h6d #jũE)M$1Jc>6و,FD8V3EitI[NsMR,&v6+)~v7R&%xλEvˍFQ:D5_ŒG. r$"(xp%ݩZ %DiJqmZQi?!$hM93Ԋ١EjO̪34·#;:.E(t5+m[]$[QԶ YZ