samba-winbind-4.15.8+git.527.8d0c05d313e-150400.3.16.11 >  A ce7=p9|`$UOǁcuy_5|2v$q1whwwL,d|/x"IsLӒ^x.rw!} ,Jb0|GpA&I%9} &W - +`gb ߴ/,#,HR8Z>aWx4SߝP=r!ldqj"jy~-.K8Tf/O92TxU3j:EIM+sMbLk 7b832d99796adb74174170bd90e6135a4bd3879ddbf6cf04a762b78020f7dc3bd29eff5a629c6f0168db9fdf26686264cda46f5d0ce7=p9|~sckayC |?Co,^BɌmM`[\^={_Lモ~r:f4g]}CP*Uy§ p e.Z2;"2)jkαjJ}Alil`~Xc"̈Lk|ͽc6QP0>޺|̹xOaTI%NC~pLb?bd+ : R .4<.1\ ~    T<88(9899=:O*=U.>U6?U>@UFBUNFUbGUxHUIVXVYV$ZV[V\V]W^WbY(cYdZQeZVfZYlZ[uZpvZ w^x^Ty^zaaabb4bDbJbCsamba-winbind4.15.8+git.527.8d0c05d313e150400.3.16.11Winbind Daemon and ToolThis is the winbind-daemon and the wbinfo-tool.ce3ibs-arm-4lSUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxaarch64# we need this group for squid (ntlmauth) # read access to /var/lib/samba/winbindd_privileged getent group winbind >/dev/null || groupadd -r winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in winbind.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi/sbin/ldconfig if test ${1:-0} -eq 1; then ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-down.d/55-samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-up.d/55-samba-winbindd else for if_case in if-down.d if-up.d; do test -h /etc/sysconfig/network/${if_case}/samba-winbindd || \ continue rm -f /etc/sysconfig/network/${if_case}/samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/${if_case}/55-samba-winbindd done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in winbind.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] && /usr/bin/systemd-tmpfiles --create samba.conf || : PNAME=samba SUBPNAME=-winbind SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable winbind.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop winbind.service ) || : fi/sbin/ldconfig if [ $1 -eq 0 ]; then /usr/sbin/pam-config --delete --winbind if [ -x /usr/sbin/nscd ]; then /usr/sbin/nscd -i passwd /usr/sbin/nscd -i group fi fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in winbind.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart winbind.service ) || : fi fi<rX%0I^큤큤AAce2zce2zce2zce2zce2zce2ce2ce.ce2yce2ce2yce1Ece1Ice1Ice2yce1ce1dbd95eb7e0d1e8c973d39fb53be9be46276b21bcacd8b0ae1adeeb63651f6fbea676af835bac5e037fd6f6d9950ea49ff3f39bc693d479069190927c1c53083993a1caa0988f1da58a965d7a954f36d791af7b63f8f4d458a49b7b48dedc7909d8f35cf10269ebfc1c0ee02e2c62fd7ec915796d409c93a3335d2909bc1ea6cbd7d6b7edd6816a762a7acab19d519dfb9f912bc09de377c588df209e9a49f01d48c787a47c3127f9c5fdde2848eeac71a06e22cbf997c132d74ada549c086e0da01e6a77208201061d82fad70389397ca9adfc1bfa541bb2756d89b8468ac7ae9a16eb3e6b8e2bf0b1ee56f8a98e8ed307633badc5f3c02d8a82a4293ea47439533615855f7d24e696ee976422bcf8fc46b43368390932cc5e0a55ab77173374c4e8d6832374730134be3d74da0597486915fd3a0e12ba0faed75ec1e07a3b4a041ccfe90467c954c6ff17fc03623cbef02ac6ee02dbf8c0deed79a713fe0c20c6b4b0325dd3211474ac785379683cc4e7f17e211327fb9d536c1ff9138de03eservice@@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootwinbindsamba-4.15.8+git.527.8d0c05d313e-150400.3.16.11.src.rpmconfig(samba-winbind)samba-client:/usr/sbin/winbinddsamba-winbindsamba-winbind(aarch-64)@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/sbin/ldconfig/sbin/ldconfig/usr/sbin/groupaddconfig(samba-winbind)coreutilsld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.2()(64bit)libndr.so.2(NDR_0.0.1)(64bit)libndr.so.2(NDR_0.0.4)(64bit)libndr.so.2(NDR_0.2.0)(64bit)libnpa-tstream-samba4.so()(64bit)libnpa-tstream-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.14)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.21)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.13)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)libwinbind-client-samba4.so()(64bit)libwinbind-client-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_AARCH64)(64bit)pam-configrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-clientsamba-winbind-libs4.15.8+git.527.8d0c05d313e-150400.3.16.113.0.4-14.6.0-14.0-15.2-14.15.8+git.527.8d0c05d313e4.15.8+git.527.8d0c05d313e4.14.3cM@b@b@b@ba@bascabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- CVE-2022-1615: Do not ignore errors in random number generation; (bso#15103); (bsc#1202976); - CVE-2022-32743: Implement validated dnsHostName write rights; (bso#14833); (bsc#1202803);- Fix Use after free when iterating smbd_server_connection->connections after tree disconnect failure; (bso#15128); (bsc#1200102).- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- Update to 4.15.3 * Recursive directory delete with veto files is broken in 4.15.0; (bso#14878); * A directory containing dangling symlinks cannot be deleted by SMB2 alone when they are the only entry in the directory; (bso#14879); * SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used uninitialized in rmdir_internals(); (bso#14892); * MaxQueryDuration not honoured in Samba AD DC LDAP; (bso#14694); * The CVE-2020-25717 username map [script] advice has undesired side effects for the local nt token; (bso#14901); (bsc#1192849); * User with multiple spaces (eg FredNurk) become un-deletable; (bso#14902); * Avoid storing NTTIME_THAW (-2) as value on disk; (bso#14127); * smbXsrv_client_global record validation leads to crash if existing record points at non-existing process; (bso#14882); * Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call; (bso#14890); * Samba process doesn't log to logfile; (bso#14897); * set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert; (bso#14907); * Kerberos authentication on standalone server in MIT realm broken; (bso#14922); * Segmentation fault when joining the domain; (bso#14923); * Support for ROLE_IPA_DC is incomplete; (bso#14903); * rpcclient cannot connect to ncacn_ip_tcp services anymore; (bso#14767); * winexe crashes since 4.15.0 after popt parsing; (bso#14893); * net ads status -P broken in a clustered environment; (bso#14908); * Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before smbd_smb2_ioctl_send; (bso#14788); * winbindd doesn't start when "allow trusted domains" is off; (bso#14899); * smbclient login without password using '-N' fails with NT_STATUS_INVALID_PARAMETER on Samba AD DC; (bso#14883); * A schannel client incorrectly detects a downgrade connecting to an AES only server; (bso#14912); * Possible null pointer dereference in winbind; (bso#14921); * Fix -k legacy option for client tools like smbclient, rpcclient, net, etc.; (bso#14846); * Add Debian 11 CI bootstrap support; (bso#14872); * Crash in recycle_unlink_internal(); (bso#14888);- Fix dependency problem upgrading from libndr0 to libndr2 and from libsamba-credentials0 to libsamba-credentials1; (bsc#1192684);- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899); - Update to 4.15.2 * CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication; (bso#12444); (bsc#1014440); * CVE-2020-25717: A user on the domain can become root on domain members; (bso#14556); (bsc#1192284); * CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC; (bso#14558); (bsc#1192246); * CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets; (bso#14561); (bsc#1192247); * CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid); (bso#14557); (bsc#1192505); * CVE-2020-25722: Samba AD DC did not do suffienct access and conformance checking of data stored; (bso#14564); (bsc#1192283); * CVE-2021-3738: Use after free in Samba AD DC RPC server; (bso#14468); (bsc#1192215); * CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability; (bso#14875); (bsc#1192214); - Update to 4.15.1 * vfs_shadow_copy2: core dump in make_relative_path; (bso#14682); * Log clutter from filename_convert_internal; (bso#14685); * MacOSX compilation fixes; (bso#14862); * rodc_rwdc test flaps; (bso#14868); * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal; (bso#14642); * Python ldb.msg_diff() memory handling failure; (bso#14836); * "in" operator on ldb.Message is case sensitive; (bso#14845); * Release LDB 2.4.1 for Samba 4.15.1; (bso#14848); * samldb_krbtgtnumber_available() looks for incorrect string; (bso#14854); * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED; (bso#14871); * Allow special chars like "@" in samAccountName when generating the salt; (bso#14874); * Correctly ignore comments in CTDB public addresses file; (bso#14826); * Fix transit path validation; (bso#12998); * Fix that child winbindd logs to log.winbindd instead of log.wb-; (bso#14852); * SMB3 cancel requests should only include the MID together with AsyncID when AES-128-GMAC is used; (bso#14855); * Prepare to operate with MIT krb5 >= 1.20; (bso#14870); * Heimdal prefers RC4 over AES for machine accounts; (bso#14864);- Enable samba-tool without ad dc.- Adjust spec to use pam macros; (bsc#1191046).- Adjust spec for size * allow some Recommends instead Requires to be configured for cifs-utils, samba-libs-python3 & samba-gpupdate; (bsc#1182847). * remove fam, undocumented and unneeded.- Add missing build dependency on bison when building with the embedded Heimdal Kerberos- Update to 4.15.0 * Removed SMB development dialects SMB2_22, SMB2_24 and SMB3_10 * VFS layer modernized. * Add the ability to set allow/deny lists for zone transfer clients in Bind DLZ plugin * Server multi-channel support no longer experimental * Improved command line user experience, unifying the options in different commands * Winbindd no longer scans trusted domains on startup and will use enterprise principals by default. * The net utility is now able to support the offline domain join feature * New options for 'samba-tool dns zoneoptions' for aging control and to mark old records as static or dynamic * DNS tombstones are now deleted as appropriate and use a consistent timestamp format * The 'samba-tool dns update' command validates and rejects now malformed IPv4 and IPv6 addresses * The 'samba-tool domain backup' command correctly takes out locks against concurrent modification during backup when using the LMDB backend * TruACL support has been removed * NIS support has been removed- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/bin/sh/bin/sh/bin/shsamba-gplv3-winbindibs-arm-4 1667576593 4.15.8+git.527.8d0c05d313e-150400.3.16.114.15.8+git.527.8d0c05d313e-150400.3.16.114.15.8+git.527.8d0c05d313e-150400.3.16.114.15.8+git.527.8d0c05d313e samba-winbindpam_winbind.conf55-samba-winbindd55-samba-winbinddsamba-winbinddntlm_authwbinfowinbind.servicercwinbindwinbinddsysconfig.samba-winbindntlm_auth.1.gzwbinfo.1.gzwinbindd.8.gzwinbind.xmlkrb5rcachewinbindd_privileged/etc/logrotate.d//etc/security//etc/sysconfig/network/if-down.d//etc/sysconfig/network/if-up.d//etc/sysconfig/network/scripts//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/fillup-templates//usr/share/man/man1//usr/share/man/man8//usr/share/omc/svcinfo.d//var/cache//var/lib/samba/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:26478/SUSE_SLE-15-SP4_Update/a963c9aaf700de2f5fe7eb5160d56d19-samba.SUSE_SLE-15-SP4_Updatecpioxz5aarch64-suse-linux ASCII textemptyBourne-Again shell script, ASCII text executableELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=5d9c80501c1c61bf81fce5a51b6f55878e869a3e, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=76b71a287ef9b4d54576b8449e49a3985d4157d8, for GNU/Linux 3.7.0, strippedELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=17c00674438117e3a0f0918c5d0a9ab5a54974ee, for GNU/Linux 3.7.0, strippedUTF-8 Unicode texttroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)XML 1.0 document, ASCII textdirectory3O2RR RoR[RR2RWRSReRRR.RkRR}R5RqR]R_RRYR0RyRRRiRnRR/R4RVRjRdR\RpR|RhRRXR^RRZRR-RRxR1R~RRRR R R[RWRRSRRURR.RiRyRRRRRRRhRRRVR-RZRxRRRTRR R R RwR,RRaRmR;R?RSRERR[RORQR.RAR"RRuRRYR3R2R RkRsR{R_RCRgR}R*RRoR]RRRRRRRR0RyR&RR5R$R7RGRRWR9RR=RR(RMRLRKReRqRIRURRcRiRJR RRR#RRbRPRVRdRDRRnRR:R\RtRBR'R)R|R6R%RhR^RNRFR>RԙڐYUy NUX8Ŭv^6fKw<>r@k^42hJu"IY9Vc#* _Y&I|WKt怢sIO1}+pUš^9\&~_ލG?h F>:+T̋ALK3\^_%TRuHLBHy>ANPY1xxtT %o'ȝJ@9#-Ć&JՕ\~U+5>t*q;Qί#TSQw S;:Flc5a2{꩸U&B$H3B1'EH]_P]" E͛s?-޷s]; *̀&yw 'b:* RPMdP.^ ֪pL5y,2GtbXk;C3*ٚR&/@/Z6 m{ @DhR8K-nAz_G%v= ƞD@|Ȱ%ʰ!%> Xh`l? !$.*ֿ!( NU/zePeike|NI^_&맨#=I C$#"=ېx%O?)eZzm@{B+)S*z|}FjAd w[!_ i`FxR';=st&A AF1DM^3QrTi4[+ 5 L(kH6NUS߭Fxk͑:{j =k,?TP&Mܢvb^$B8""jlx͛jwal;PuBzXelF}E Fk%gRd_Y.4p'qe#ڏz¿Kݰqhgx\L]8, F'-ŷ+Xsiƅ4JG.cAZhs@ vHѵ Wf=T%pƮc JU/TjTA՝:nWԥ*'EJ`dVV@qݪ֭ؠhP);u훎 q) ?sX.K=ӤU)JR}w<&11p;3$^rQAaX8WBA6̅wa/1(6(Ę΅s3O"%c&ޘTeKVVu;Im7:4/|I(XZT ~be?dӟqYbbEWLy5(c+zL'j\ѴZ/h<пf>tn ȏ CL.hV护Wn )M)/(y RVF(/A HKD}FH} $՗O].gd诖D P2TWu3+l3:XGKw1$pA\|dir6SJo A^)^UiY1!%uH}֫r+‘GV{kJCwb-~(W,O\;%~q87R6j[\u>IȲ;}nm6! %hf7kֶӅ@#ׯ8%/HL.; ء۴=YScK:ޖ'զJl44]ǝasr=X־8 mq<='!V֌kP6Ϯ{4{,{~嫎XqW+6Jxڦ-Olx@\SfI.UEEW@%*IS@{^-0'*m'0-=x*hqu%_Ȯغ .^/+@#WXeg? /VqP#k֫DsuK}ښye),{؟C .rHXf9Х @ 5BHcG z+6/TMB?Vw`SUܽ5虋'VWdL(EnP{"ze>`mVk rި4ҙ-uߵdJ< r}0`02"ĽV='+ BO*- {=FSjHYvvRiWMWF J绳W8WX&}|;^PxF>fq)ѺKNwp"n-u3~r&SV[7p9$K"j 2sQ*Vܠ6qquylš~n4-#,%$¾WY6nRƄ:IYoWG-a.>ldSCgMmv )aaprĦ~.&z)@oYHFlVOӚP۞:OriQ>nR'l/&[kT!RlPҚj\/8W`mL^,(tHj8D7|qmĆoQRa⽀;ݺJGx]x]S |_,/O8ѷ'*d4u֍ IN/LRp=U N!`~Q]rF)CIC"ԇ%yp?7w ;#K'|&$xq#T&v]KٸOhã.0 ?YV؇ހVgw2lg/Fm`k* q>}TW.7U}Xsc'{,} k[u5bxngWza<7Q%-[: -C)LIɸZ)3}-Ox}9*Hqj6œQE,, |ȼ T nU5$>Q!"3PLJJ/to^#3x Z-0֧̿=]OuQ"Kma[(?tr%qIwJc8OZtxB ?kSB/ЖƪwZ#痃in؜t ] $@Y Ԭ)|y-* AL>;鏉.y@x}[N33\K:je-v=$.=I#4ã%,+pYxjcs<0a"؞ГJʑ:F&y{<?;DƄ[@%cdp|Lmh}P>G֛MH 9{ ؅,]hQd`HBGB9Oc>/] :!44J(@їQ!oD%$QVo2_Q$.p#){2r itsyC _$5~ai;zir,O8-TQle[aAPb"A.C˓[2P]jz_ ŝ c6OÅ(|@uꏽ! zGH"ѿwUKtAid0?LzZթ'FRU' U!wx|F@aaIө;o J>T/qZQ؜,|Ud q* (1/ˍ\ϭw>1"-ΰ.eT,ﳯSJ:3)0H[\sldF¡g q?a|EuoLuN6^W Q7WKS"^2zV8+&%g:b/2RcǾ`+g)AtwGRp dK@.UmU(6;`:,Bh|3dŃ[y`6#qO\p ,)8t:Td kȪ:hW *+g!ew/aoNdژE yz~?8>eFe)vLVV㪝5}HE!_c' RGYqѝ4:Z5t"j)=alR$>I7:փ¢U'ef Xg'Os) +`ph1N1&蚽Bbt|>t[Ш@ `JZ&'kcqށԛCmP~1HD0[FB* fK54i_d rsS.<]U #Ԅ|LP B?oEd^+1%?]Lϩp&ab'jfN=0j#'0Jdi2ZE\wfq;x7V 4tb s I`#\P.#Y{6(Nގ&W*۸XH*1͗ʷ3eO_;s̒J%.52wgWϟAtX% $$BѡB.^gd<ŗkUo$ӷh^Ҋ7mKOc)+Hؠ/)yO+ 1QA+2 UC~Z`_oe 2`[ˍMnj{I${"! L;yX4>OGWaK]5;X<$70߼y=p (9JS@&fTS1nTs[X^]d+}%iM6ŋMI٦1 &+>*A]MϜ3RYMBNMC.3wCѩ1rJq3E &e|`K Қ1 U);y8P_ή.܉]鵥܊(̘tܘK5&zY SDMkܫճ҅VRv b :N`bYOW_PxfX/T6hlNǵպaX=a M,ŭQY$7iƟDylZw]wGXá-:QjA4q%q-P\p/`B}/76mRʆOD~rn0}W K΃z&XSoLP{ClfJeS@ V5@1)ijg@H~*T.ꦸXhWމ$/ Lˌ 1N)lu4ѰpH>֣Z4` n&A4`x5nn9z5zFVJ8(zӒBj;IwmMP*[Uu5[2gt J CQ҉l d͇8:p">l#4{jQ@/f-Op $g3"0Y\e )2ċs YI?ɤq/R ٭-Su/Aӹ$~*^?$yl  6)J8`F)˧X[3d:+ s߳y &>vT;o&^A d=o"9-ժrx.pE࠸6PةE1I IehE&N}LxDB=' 2O 9؊ o @(. 8Z3XP(1 /7!A mSC2YLOb"lZin4uqdL8ظj (#1`]ͯ.")<,cmC"WEGJ[__مb́u5 ;nٓ^]C*r9F&~ %(ow0Ko PH |xuȪwJ-[v*+s$3xmo%05<2}v?a4 = {TA)͹Hs[h`↪tgP\,9T{> *Q$8WZ@dxÕV1$q|lvQpLc`yM~ D-8OoWPϬ5v. '%D8Z=֍TWPpч]+QL .^蜆6MSc>Wf+:Ǿ:g|\)X|[0׹gA@~O*7PRZ'戱'\0G$WsKةҴB`]K  5 /K*zqP | %v TEQqƠ͟9oM8i8E'T5P O HF.77y/=4|6>SM|\uSh[L*<~`xB:%M EЃ2pIħLa.~+K'~]La,'X}Ӈ#Z)i'W76p-u:iQp;*[:!5AUJs0P'BZƑkl;ƘmPu$ T->|uaqFgTL ŌdbCj@f6q̞`LRT$3G/!Jm ZkU%CKR+ .da}_vа&hs?(v `|TVW4moP:@(OsZK%];(D1{VQ (A``a%W5J)p [p["r/@_jorU*b5aPAiWx={+t>Vǻ8YO700!bHJ-gꞪj?8Xy_ M @·?HY5,*n8d0Ȅ , ?FreHa.EX *Gj}q??]+ĹHJYcO2m*aRR y;АÜK7 z'"\Dm%v$jok7b3:\I -;=[g#벽U8>S{0蹁 sy8JDLɜ0@u^Z޲5d]w# um!J*چl)Aή $Bu DWϟѼxrs)g+0z h;U掬,0^ mD/Uvp2bps<vw[Za {ּ[)&Y "1g& L{Y@ΰq:@}uͰsU"|W;_יHT{ekG[Ĕ/:Ns-yNL;оDDLcviE}teǩ:nB~0n#16@ѯF.G1ęMxb.S+dwMA}B.ob`~BZ%"DC܅\y|:idS AeJwas[K4`k)~һUDGһekQH4kTh]ܺ-Oi+}1-ʐ;JB*￤'jv1&u$?Tdy.3RLНs8c}pLTn R Ή >\ګ>[5BNFYC=w؆|8^*鞼M}yh;[c}F8sL:dϓqZ\~͉J8gvUrT#eJr C`Ղg9EyIyn4\?A(SBہk bѠY49NHW &Cas]G4L/H0<+qԖ u"aN `{|K`{7gkAXWy(*S=˼Jau?و^wdj"wCo7+ 0ߤx<w<-\i~+-οȓRqH fA)wMW7wG/0[Y].Hi-t/ GH\҄TԞ.Q[!FOƠ]/?M.#߮[ \5"INuU?(Q P%RҲ݊ H-ADuQY?`dN8vJXxl}ԅ;~ؤ3;EXl_(S!5nlf~܊o>uFhA偦}KN0m VٜY5\7CM3M&$Hdon5 ~բd#dLR=Tߨ~y-Y_H9Ry6Jds.˅Sw@N%:mon ccC}] *p@xbg5,5B{ŧ;+IBc9*]P|px;NL3 f9B:|L_ړtt6e#V+VX1|}2sk2~6X] gr.OXCgAYP.OeFA=.cc KZƉ{ ujWp%r"VMt `t;j}y`Z@n;`xfX${"\9}=W `ښA Ͽl}pl~d C޳{kZ 2W &6bP8o52!2sa"jB8ʹ$YE\jp4ɁBǗB?hQJq/VC؈V&.nnT^Y-<ڳA7K2n 1_|rRe{꫋g8`\р9:bO&:!QJ< uf!z#D4΅.5]g>0qRk=qÙaThAc[]ҟ T:eVDܷ]+׵텎^PUKG]L4SN> ; ~C;ZR,b<^opG)zm"Rdb3KUaBo/ףqD"W*R[&x Miոe%0h JEENkPWJ$CYT0FhD}&yෆ2Ml#!fp,|S0Nv@"%!%MYv=(?כNwG4nbR_瑱DTY3UYb g I2YLXfY$m9"@SB׫@˔@ghn؅[<޽ ]J\sA:e ER5+Ǯy8"h`뢚-Bs\0 %~1&U0^.:CkdAl#hq+ 3閐}z}᠄~O˪PlS+c[+#t V[d%fdGyP["Σch)`EvHI\%<9T̲睫YIԈľ&wF0ĩd>j(d^ZޏJVҮ7z} MEv]I!m,c:g z$m@15cpE&:l'KWCg3q^qbEGy{9J\k&*&7JI#bO u=5ZLx紂qmmoF &V, NUKN\#l8YV,A&w?oPF!iV0{p'7S;?\.#Pbbc|E2% wSd⿻#c8#ݯ@jV2Ut"5 ccX ! }U5ꬼ ɆIlVd;H.5͢lE*1P 耛՘%qJ;!aé{y3^[PʿDh՘L>)kr;XЏ0y2dRןRo 9b\&䱾 L_L/›EQ"v/|Ҥ<ҹBTY5£ڤ$7gkyi ^J mnA I~E:cBd(j^IJF= Kj+J*]绛VDR:@qx?O0wټ|=csLx!Ė#G ­$&q]=ر7v=%uB\Uouj̕#V y`}7H']w߁U䰒W?剣-xX@; pU٘X§#MJdž3O~$Lo6sn$9V>_p!v n,_6>_Aj5F ]ÄlMXUMTߏmZsAL6ZuNΒ;Ne\j&gJ_.|@d'T b,(BIBD ] 4G@ yY4+ V+$g/o؀9iy)T먋<ʀٟ~1ӊX$\TiX\ji +TˬUG)A#s7".AZ`GМo?)']4C<?FtCOa~-@↧uR A\aVyD 8Oz(Z3@,^؅t. 34kdkSiPw([0̷^t_Wa%]ULV3h,rjNZ F>6`d0,qϗ zhP2Ujڨԑ;_ 6Edz᷽ɉ"cgdj7&D:5]CJL5ё:tû_JUIcHn52|wXV,ࠓa"Ǎf6>Jd Jt4U/njof, }a,tV¯2 }VPWK#:#w05lI Sd8o _Xv1F=;O(R7hȒ$87bZ!HEd2oMY~jsQ9ttLӪs:d8!Ac{kp+Y sVjrY7 y|;| @@N}3ѤyOZ.PF\_[ pDl\R"nV7nQIS jqzВj.-BP< |; Y)(U"He-E{tȤ\{90'\c9prLe?X>~3W4_%PKUy7P?-*2J*^j,]1DqWkt}+IUabOQx4AdZw7d)͵~( m7ta66|TC?a!;'LR_a bjBu[Z/z%mXv_! I`0V[Wi>ڕ;nABj|2l Ѐ(=Ug]}lԤ2Tt g~6hՔg6ۿrBy6[@,N WY[.db/j>u"_G&.|"N̜vj&-\JR fgDHr#R- Ƶ7ꗼ}y]$هV 7I|&Kn` 'PPzi'*75a)H]#gABǗ[#qVc0 .x٢kEDl@~Z?7;݆,h׌Z}@nOAP$A *.M_ʸkdƽd5ߑʤRA>rE¯]q#*b<\-zoks:I8U*f(jZAqu~R! O! GTzup#ĵGa$vC0%PΓK2yc,ki+y=Jl&TsDt:``QUh;Ŧf2yQ/[mXkh-P/2#~,sύ?`p'+\rxC}V9DkpˁYH%j2XiD&$zuK N#LwLnܜʵ*>vBgc?~([I b6y{CQ[Н &+Q#W؂ p5+6F13+-^l|gcrXZܮ˚ecƷ]xx"ćwZ -~DĮ`/Bs5<{'r+oBOv9\K76D>F R蒙-'!"5MSpy?.zf?< !?TJ)VڏIY1 Ͷ6g{ Nl!"ݮi$җs{D n0s藋Y\a(+}|@2P? -/^-N  A#3 Mzگs5\t$TL vt@-QQFg[xÉTt 1ojg[A/1 O Y=Q('q8tC8PZ䶈sx{"ImGb(K#,:J`66D"`yUxe{>a7N#l-^D߰rWI{ N$*#8q=̊UE$A&>]5A0BPN[.fk[p(o eLQCYNaիZ<Je MYKcZl͉:"uz ]540PpeV!1_ m<3JA ^To;(" 8z;)+չE=M4ךS31L/ H:;/ Wì !Q:v>ѩ)cžubkun..XW*LC iFkk*@nJlmI68q9jQEHeG|LTc=%͡C]f)-^U}ynĨfwjMVBH Qrz;~ò(>CZr5 # ۺ@8l%)Qg}k a1^4'd( Xsq4Í3( =^e-&IjIBT"7v:aUxoZⵖяh9[ {Q]VOg6 ;ΉtdM4Q]ftR$Q0x `ǜ l1/C'J ,z7\x*TwB]2OuޥBc%k~T#SVK R˔7&vkbkVrR+:fhQى}b%N*- m"lYUɃ!15w`ɶp_oqfbQKE]e?}oCoX)4I:z!cYpVYW",s4jKvd>_E[X+L 4S?|6ȓg7UyQ$e"ʷ-SS j[oPh Nt-bt~{9g0{2>皩>) lOYu&M3ofx:;Ӑv*(mEfDk3&e^. S*Ɇ ݱSra`L$W7(k|Xں!{12O\ x41{QCvht Fq!yEID/gi7lg 7 Q=tTt#_7I(&ǝyb7iS39uc5ѥpVDE{&IwJX%b5416ы0(Eڙ'$C}8bNW6 IhVyW,u].2H; 4J!$Yb_eK_Jdye0͂^:4Y E)M.m[:(Wm?,6Vj;pyPbqa!Rh ^|$A^a[vd3 P; @*>}onzhFWB̈́>C[(}>X(P  ߖ]w&3_FޛɒNҚl.Zi&_0ZB-6&H짞n;Rsy.gĂ5m8s2k8jv_Sx9AKو{?>mFƃoyp\wU٢*/jF.FEf.ME28k p.%us#PYP} rhx/ɯ 1knw?3} oЖȕ{ ;TʞmT2VK˯{\"\Ѱ}[f svs LDo iE\•)Rّu甋E.W)6y5=iu@MqZpۑCmE~uP>(֎WamB&+ Cv1 6!#Tq]0P#%z(ał\84 A(KRB?M12o^4nhp.eD45}ӲpNgИh OH!*~yt2%~fcsπҒ/~1GR ?hYz*53/Pm2 q1N0{X/dzCF-DCmvg3DG͛Qӵlg"U˒e6*~|l-RkRj͟2d9|Ai]K̻]/]a!L  @V\{Ѐn6[LC8s®+&?֖ q#y|Ek}[]\ ށMg bc~*1F$-~0c8#aN"G>?S(eUzih>}腻PnM<cuN"c1fg#,vTAq,Rsj6 Jts{'x#J4 qwOיehHڶG#L^I\EoFTɕOt+"F/v+UV:5v6ZU_"+A=6¯ ݡ`hv~d''yY䴀Awne./`)I{G2FR涬Z6U3 wCV L[ϱ5w@r2t]J7`w'oh'neb&G+J .cZʑ?<*V[r) K͍=@.[CR6_f%kl5ځ]aCKz2,  l}f ~wbWa{do/?:֕W'56Œ}rJ`@'xc[ 4/pEh2 (ޢ6W.m;>q_) c>ࢸڂQ˼Kgܯ ƾퟝ@@ҜL})ݬa9hUg_2< Z!jL?Hضq!0gJ7 b!_ rCͻn ĠvRk3 OTi/sQ*BR.΁N67ױS2<yt8]BC93α1n'lwAm%0FPQ^Yz/tHfX.LMr 粬Exqa…?8ܟoBha'1BO@| sKwi#,’πTM2Em$x XE8-O5/$FPT\4#lߒ׷eF+H\ ]lo5Aؠ>ѵWl2).C?;7Y>6w$j 0F*[ s8%Yp{ņ6"T^ /p`¡JU9(p&8`B,2 DxFJC+@`\}MM_R#a }<0B1T=.;&I"BPb.dH A.nxǤG.[Exwݽ4]ZHY1Bhd.si:JBk{Sx7nkm@*c"X,p 33/d0el#m.yFlеJ ˜? >QoU\EThÅ7$#l=dH2$mrm1;4e7 119hipf.2,Vg?HL>?}p$"iq9!q7!$YcMItw:xbeʺٗB4QB6BHlW-|h`YadyaeqnqM|M)t /۞8V3M}kFGed%`\pG 0A?Wmqlwl8ң]!dRFr=4ߖhF^ŧ~; 5()2c3=z>o{qvLMJGH!d#֢;Rg&Ea jHC[7?Hmo"WS P#CwȆ~o^}zY I))sL'H,\(ߤr_D q~)cl#jJۜA !?)IBd9f n63Q] A.?z*]=2`H@nHU̱#;yM;GAZhM"RF^>[BMuՉj0L%6\VQNw/@Y1^(glEBXb9qR2!G~*#v| $-q K[Mv15!/,61*rNN]7FNOx6N,w#se#L%˜[.2AgKׇ7B6Zt7D|] JQS{HS:Ǯ\,F)b6WǞԏV,J_(á)"#J'I-Y~@L8YOwWڥf,,r'g|J No wfK!CĕVHgwH8 R->/?AxV@fBe̫̥D4?8&4osh*l0?q]05:am"wM|;}7'lr.i;P[=x׿>=E9*g2HI24 %FHeA?U0SdeN7W7aZY.n{8ͪ? u\Augi$&VjdS/kbP+]B`/Z^geͨٙ@e{:WaRkxŻ jb^li&6{*}CJ`(0UH{Nϛ}wƓ8$|#}FWAjl''eazF uW}IkND ^aY?gTż {'a˖/#lH R9|Zfmu3m(*X67#J㿽_7eE,^7C6yNdW2r$A~K7*\it->`kιOJ4Ѷ C~l{(`J\C!Y iiNr oum,0 3hnlpa ۈvCgޚM"Nq~&/2q#wW ϑeR{-v7xBMsJl-apHĚqzC4qƮ|{˼ M8%Q*< .'d8>tRl3mp,^-cG+gyG6?"/8\BtH|/q݅]wVH㟽_VZZbJ֕X?u<sElCQbd)(Ma1KnNkU" 2!MGDbL'XW⬀-[1van( /Z\ثgBȯgv󑍘X<=ES"Wreٖ*6DYӢ7qǫ뱙¬\drH/*c68n D7,~N 8E@?] a+1;1憧%63R'l©dI5HV%%S#y+5p7Y@X9{m>OsM?N tУ0e4P[?IkB?Uw=b]z?6BEeQ"}% _%\47\/ND8mƈnRw Qe+pd.xr#܉&A:l&: vsl``"}Oh/jp.Wt>|X>o\]9qhTlc9dUCo[=(=IOK^$PuwF$[JJ=eWr}^ǧt(S@K1SDg$ea}3@z1ړd<7B(C[ XIFYC<3?+0* h z Ѿm@IȈ/j|hZEA\uyܭ{@/>)[V \\-P~7A>/d%̖eeʘΗr/WMz)"5=HQ+nsǷEYlABˠ}|\t?`6,WvEɖ'bDXo\`gyi J]voT[5 ŸYk*hi26F1J`(VVK}|L(MXЍHk=]k|J2'37tvބb b{u2澸@pG(h%:M:g1*x8#}(C&$ f#IP5ς'`=Q/BnәiD8A:Wv/ꎦt@`g/2WԑZjڐ&y>eƱ O`*J3R^t(0}I7]s Xѐ^A2 >+rKT=쾎גㅲFxQynY4fޡК8A{-vVNhR@bSw&ݱ%({YX2`=KNvμnDf@r:%QBKS8tӦVz-[P=@mNLC҉ky~}; Կ{fN%ev 6+4T*)W-5]YUXЏ,P0bE1iB b#mMJ՗',"#r=+DWȇ[λk]"@ъ!WC[cܩ"~b ЧLMMY2p"@6[YXoꎸϵ!xJ-O(!U\p `ڔRfD ~?[x5IB[ O 8x{͊&+=V ]Igs4/D.0"BN6gd&HFZ M*L (JYYZ:fC;Lw|1ZG pA FvɷyE{AOE$zIkmBiicsXX#O0П ῞TcUCYSQ܉V7Yfu*QiB"?R(Ol;emD8eeؤn4ElDzS4yd%C+*n=8 ]H?nJrU|x{Eǿ>Lb z00ΣC^^+H{8.8!< WK r^j;T"7JH_/t^SO&-%ȫsvj4>HY,.5 u@7l3C$ b=^wm'I.=wrfrb%uLAh}V_ *U}RH1d}#A?)}+f0%{3xe A?i,j,6fHH+~ks}idod'&[`JE} I;,eld[i n\t܈ُo0;UWج7ģ~| m"!"!Y)$^/ďx[LXF !jݥOnsN0Uq>R] ^r9~ x1~;P`Mn/ee#k֩Vp7ijm6od. },Sl,WvFgSͱ"wII.mJiaǃ,ʄf Nɶ \߭CJ) |RɈ[#`]SC~.kE?0bvf7qjPgˠ="M-o1r8ɍ%rsgފEܧFE}2d?>Y%;;Gx*HXZ؇lxҦ H!f(`cb yupɂekZ|aɅ iLj4 k7 n5Q/RYU:( P@"~A|=+Ij4_u=c /!!}*$oqBtKC|t^]1z+cWuFP)Oa7woYʛ!iN*ͪY4$?5[4μu<5OsD{_%XZ'ҥ f MW'cL ũSAA"ڳoHµtZ&e+~mpW<{hu8\@llN}yhS?uydMCY YǣM+*rOe~/ni 58` ԈWv'[-*@Ӳ6 OA9֠\{cq?P8qN=2 bIZ.s5g|lc>VM\p,2Co|xAzBmVmm ] ￴cOot-ʴk+꿱ΧC'30ƃO1Đp&6@lC:mlU{$02hSдQW,-jOUm{`YD,`iP{[~vuO8b@[*=ܻIGHظ",4QL7~t$AaxNCBwtJW<8[2HC(Hj p[=n3?oXH3TXX4~sY/emئ=O~+у3ţ3-5NꈣC| N\gFmJ! ]  ;t>ϮёBAx6B t,f.ŷCtƛ$bLF؂G .ܯ9[mfEO$N"Tp>7Xj19x~)񦯱8p/JMXbxz)Zu;Ͳ1ժ[;[#֎K2C~H|vJk[ O`-Ϻ;5 Es6}x%;J@{"_}HRJ'`@ ({'`1Ec|4 Jͤ>@IP,){JM{zB%x%*qZDv1ֳ~ytGmO;89vUKWֳV;iҕo,+O#=v1Lʩ@rCE]''nj3-V ]e.c";R}. xMiW~" =ij:NiThpAagO.EcU}r Ao}h8wEtSWN [L*za`L͈O 2Hja i"f4T;1q7:#\U/H܃s4W~YIJu{6hZ j82ȴӨf0[OoAW1th~?:P(?nKqU9>_ !*9~3Mbgob(Oơq}k"vjw)|ކs9)A{:4.(I,x%΢ uGI?@!  ]_ !֫+8R.Y=ok9-'ϲ?LJ[sBuxt7o[D˒)dxT] F)xIW8p:BViDT,xŒ{ŧueNvԠX+ٗ.^=Xբf=J#o)(?8qnh 0ߜ3/aDm0a1L]vZ`:%.t*"`O8]^éŬ5xWѷMy`n~#AoTIɿFz ZЩ$(Y[Tksk ז[G;s+\Lx?uп)zԊN/V:>;ƺHPM/CʢĠY*#P\~drƹGN\:l>1Y&3[~~I@  '!؆cm龒F/z?b=3.rd^['<v8N4n$]l?mKTc1Ƥw~3u36$6[Q7U[Ӛ*eG,IĞ`}$B29SL _o[e\ N%IS J{gk*L k~UדKg#ດ2m)'ی/(gZVV[@f1isW5d,-H"pl "x+ZgG9*~=Ni Ⱥ(T )n &UI$lAbG. 30\:ɲM =If[|f^L?qllO\!}pS2J0l:{#s@|7w" kVP'{2ſƈ/~+HF?3-UHqNLDEl@._A%wPx."a9{*RW럼 O'kST@R@'@K.ȇ|M/, zCx$ QjA>^v2sW7x~e )H|Չ3fSc+OĚ3pOMC ObtMՏ mʄg 3+ۮ퉵PF=Aֳmf1&f'! Z 5:3\P/uXL( D3BWGt/jB|lSS&^/iVUC!4O'64a-6x :DL~!&L!=wӻNb`goy`9`:SfƐ^p֏$(XM>~Ӝ\_0D<],3Wf Nq$S0CyAyt|Ȩ9/;'w"b>r'W0ZZvA?0r#Nv;j!ms u. :PJϐ?=c;y2&ŗ,TҸ%m;@;.CM3$.P9%]Fu\5weyPh?qc8{IpI?OXBAReĘ\C5/ $ 5|+bٖW‥&MKMDڮ}&lڿ@zO[^3d{ "1 *'+P$U16kxtƃ9V@+W&T(Q﵇60v_;F3SYQ'D[xe\:J1 r!#@TV*fupB9ZwQ}B&7(E;6khb*͵a= G!V\ ޟW=diSO}%z_ S?Ű htyFaq` 83dص_mo)E,bouBP4 S!{J$Zi1! /Xۂ ֨@!$<"QSN`] dvڝСP8m 2Uzz5 ̋O3qKna6pVe5k@x(NZ| ~>s HX4{N^!=ؑL N527gvR?Rm3H765|;m&.n۰`bM"KG=@QT"yњu.9~akjH\ߕ[튜*g%U8\'55T.؞Q]`|0@Kʱ)k?pBiv YseSR-;~^fz@$'j}nnTl΀ȏnȜ,JjF{k\o"IGjj K<1$A\B67Fe ?uDNv˜G,i EqJ]Dzdġ̿jH<—qu!@UxMmza\)ar<إD7P.jP5Ip#Cݲ] :槣* CANlC W+W.å@YW\>Q{cǘ2x s?We~ 8)d ~kKwnK3XӸP3;!WIZ`(Dk>]~v tjv"@Ԃ m6i䃧-btJ0xC 5)頻IpS7{u P*{Z7jCk'qP_TI'S EcaA)׷Iv7>7X&5h6^iB8`l iHj<7~` *rx#'c$K>szT {YS0 SC$>A}m Fs),1zJ#{F&3q&["b9ȳY JM[HÇ` o[p ܒI¦ܰ,pU]dI EO7aݠjLᶜ:spc99Z[?shq#<x!\BLa2(plqJpΩ*[SSk !-{\ЕgHoz'Q 5325uP9%V]jEB>Ld'`9:QEoxLUPw\r sgwup(> =kA"7b;’λmjק>mGiB.wDW#'Q?.p!).2ԲV_"itq[7<" rYl1>Y" hmළq[b}ص$?@yă3:o'JW0n:Ovp0b%0sm |U[y ҁ\G1cS$@8(HlD )jQVxhiۏK]C q#P\aȹdQP,8|`k 9+EΎHiט!`Py_$i9sgBX+/r|ӆTR*jsIk#~ވk"ݎL/\):O.Zg$f!`uٺ-dH)L@cIOϳ]x!KL,Zu*^H2%A NjX"U*Y xf:Pb GPKsY$\}m)-ZZ9bJ&TUo@x3!(_'WUw;aMO':F4=ȯ oݯqqHU@f8R-e)wD"r36Ju6Y 2RxpUw`,t/]’ 7)8622oXy_ݟp>?&pH#vfZLX78caAak23ѝԥroٶnQwbt\(t3Ƀ36hAZ~E qGyW Z@tn֖-e)>I t9:?.("i\ >SR4AϺ1ńzqٽ'iFI{(TC@ 8&}%M=m aXj~ MَdP06 B\2ۋ$diYQMᦥMa8TTF2RqܗT(,v;[>@i.e*\DZe$ϲ? |sR\p|>oyk0<b^>vaxѲ_;|MɵA=HFM)gBg5GDi3(B* _k~L+V"ֿ6tlm'Uqk"{`˩}7[ˇ7m ADg,IK3(܊X>oAg_ɮH[ͣ,)|G My]aʯNFZkZ! lӆfHvQryBOq7,?8ʷ[aTAd+TwℴֿT>tp fyyI {9\]oރ%ma}TN8oy^Zz`Hi~֬eOX3ilB\QEqbzU5aBO7W_nG61V+!E^)Oѹm 7C PL'YqeX(g$",ej @Rʷ1%8S#I<=D|Tvm_$4>n$`Vm;(;H1w5e b]΍8^eJɻ) E(Cc}+%hI"aj(#.L/_R[Ǧ2:y{SM|ˌ[r{Jw)Zd[јzɕNhzN^ƓϙLps/@A $m:]-%zhR;eZ!)qv[tPn@ m"Z @;3.ux&O`3ƔW4-g,KPj|LH3.+U8pu,W.zWXk5|~ò-\;@Rl8L7[{Gp@2I)(6OPF)mؠR[uOk u {RP|P`6gJef/862x'mgi>z/LqdM#ToL+mi"P葖6`XW)R4|fͮ?0e,d)mHxKvd"8jܝn@EU -Nte"Ғ09tq#J٨^^|֮>#9ko>"Xq5ixܶ?؂*$mQw,tI5A+[e!zriu=0[W,6TIpNu, GYf{~ o8>gMOG:A!ȜτܹRHn׌ )kõr7Ť(Izm;f%t"H-KcVw%ӌV ڋg8@;to ȵ5N #|M]5 90"۾uh?sd6T8L7L<b=.ӋHv[+YԸXS6xDZ6r+iZ~KE^ģ7nI%BQԌ M G%1ǥAE0yہU{٪L[p Rf_1<ޝrL=L* )n\KwESsDi=p׋"A&,{v3,s_M?sHn~2f4Cb$?\Ç0$¦ןBgK}`~g /͍"$tʄhUI'OkӑBc>ѥ_oMم/NrN,+񂰪8=4o~B^rB!2mg@!Lf3$}2lE N'y;~>fM]=`%?X6%0FĄl%Bi8e;F<f9ug@WWZd;9@ )i/U90 .r8q 7dc9ߔ žƂŧWuNq_.=t5j@Ҧzh9ΓySַbDl`3m qcN;i&pشfgh]E-Mgx+ `ߝNF3L1uS %mO *#"1Tئۄ7͓_lfJj)+\"&^ڠX?6VM*DwB:D.h  9dteOboo~=? mCgyBEطI$>6o9MBSNTo; x!`h4=2J|v='`{ aئII9.6{C,g>5yjn r;`_a[%ԟJ$C/<{k8JxYc۔+#cKːR$":c༆ _9.GF u/v!UBalSҭ ,_nX0L͡Q>n!i;]ttϡ4!Hwp{x" g'MB[8yD>SY!I$~8D <" ZnlՉݐdyPNI>THDWajWxS$GH$QCƚlTNWUU+uvh8Sy ̔op׿D.N"'oeXHV(pif!׆IjY;_߂e /L%#ʪt4po->0P j\ xPv%+ 7OWvrl͑_e4$,Ã*4xī~rJ(bӻU4wm8(Mg{Nta`IMFE ʄ7{P2{J\m`|ň8Jߓ;^qivtO+k# KL2Hiw&p΁Lv9s=~HZe2BMӴe;\UE7[ٰȠ_i}Pc VZ06ǃAw cw{Lrn_9hlJ \m8$Wᭅqu⠍,ǝ?e fGEJԅOwwF@*p/ ~tUQ9gMЯj3̊o=r+KdE֘t$@tH`.iW!Uqa}q-+63P3*+Ukf7oN855-WuG`']3jxixT#e0Vg$d!_ z" 3׬u嘇07%1%B>4p~?Wj2?1'ٓF 9>X.piȏJbز\"9X%?vkgBi-UmASw?"<_DoM^3 oL𱠚OOH!I1W ƙ_t5|N |"# XBÏB $RyV(]|Q_f_mm~$>Mɵ'F:Ҵ"X_Sl%Y»>! O(XBZ!,T,254Rk)ӦKrOSY Zyqjv,DL!.wՁ_5VGP`NnC3d9{fwˎZ {떶x˖94C@/ע(;R&Zy!R u[ یO"xydw"Nz;6K"a]zO;ErҖ𸁺zumzPOBCO^k^t:bD/„AmNFؙ<Dt4DUxP(̦O6[`c ˿9=78Wn,FՎOn֌×8p {#WE^m ԕOυbMtX ꕊ~.\E#-6ݮiPX.YO[|wdAnƐQ|,ig1P]%HdD>DiUQ/dh7"jAEnrKL66U{`5IJُ7P˺G_^ϝ?$ZMph?xYCF-_r`?g.L"*ksWpl#ih+- !ōFz%*U2<[,5[óЁЬZlS{0¥8ԜygQ /!,*F,EDFGmjn.$fl: U;9wb6)$w>fWr~-1"7\傃7VŵyO@+\s^)_,8$k~~s|2JVmG"P(CHfnFa{--Z[#ma\ѳv6#l_AkJM%Ux9x |>,mfHkiG0 T TjihkG;Ȟ-σyg㖵&uZ~rǵO4ޠrvRHMq+Q` _oxڢ$wJJb=G7J-)!ٿ B3o]ᤱb\qyɵ2]%bV7uFsc>@g!PS?`v4T0Mo_.!QH;wIⱶ8\OAf4XƈGy^w"Y)$CQ d-1pW[йS  CU'^z\8@sϣ EdH\ݞ1q>ً k$"QhlX1ηV/ji<R=\!Ox=Z@*~4ӡsx0tDnl;_q !o&}L UyVF51$f'y5QQc?wz;mQZ1k`\LLqj M xNcg<ȱ/.rBA鲵SNGjGT@S2S@OϤ2\xD"RrN 塻7d*~YOX"AQܜ+Ȏn TdCCݼ6«YJqրugVmX^㘾QU-諃o2zIfGQ@i¦1=Le wT=ʓݱS81ߎvFɯɧ>\vLQsONĉ457p/eֻNGȠһDR-j a U,@aV&jHcR jk7.p@)$}Ծ)ۃ';zi[^]!0"yQI۰ f5'Ng5@e5zhI'R~͞s7MuNxF%D3_[9ƢK KWDg+JWQyE Oe'yY_0̄]lM#n\>띣K_K"haC(G^|57l4̀[mAC}R{G̼4K2yA8$&mgu,A/i+u{><)>RX!e {18T3Ot-lM-i)jNܚDw#lUoL=4K40QwYMAjUAi,*d\o_7cy "UM\/$}as'C=bbH‚<:45= yyB-{=γI&0y"i1/`ESl~@=]պc&I0 efԕ +Mu:-47ߴr ]Oc+blXFh2WUfCE.I%Phv=0mpi j:e^f1 Van>2k09'$̴^_/"is)5ŤQ"m:w,Gn0f^0еƾVEu@rCM V]MW/{;,uv Wھ9My6=QRK^י|\B5Q*zKm}Oid<aI$%温OD;Vݧje\XA(f0>'<*n*~nydD>!h`1Vh!nDCqg) |W}~I{☑l6#*hB6,_dX؃ۅzpߡhoR Yr2Ū}<܋A:0BB20 [L 8/k`S~yT[xTA;+O%M.L>:@v))2xZ_ɛ[_삇uPP GP!>༿ۙIv 紓xgq2MP :͝2}i[ 3NxJy'=*O].BT!V k@})UzR8sTj{?0aD&2Wg7:e| с͠mC>fplV2Եcv 0=T?>͸7Wt䎾&U.8,yQ<;;vo/RDrU_C^&?|9&)\5Z/M$PpnB;M,ȫjw3 | &_:afUŀ?h~ |d]+[Bo=gˢ4p2"&wns)ttZl$?W`#yS B|="I%-ņV_3cFW%5ؾ\?ج>̮pu[f43>'Z;:7PQ'U+FO0q3H:$Iws{x⊦e3H([(uVҢR)[J 抈 βTcq,іQ,7+$FlTm>qWN kT@욾26n[^0_EưlteUR 9~Eм[3e9x8kmmd䆒]AombhgZo|a.]x6'-suLvi?SDr;aScV_ߞWw "/#=1Q"Sj:[27qOdh҂_9O- [ w[gDpE.)HZ>.2 DηSq^J]a-ƏgK[iƾKDN{-cډ AWa9/xl4myw)a.;"k/ j!EKb^$2>w䗪.+2e-F ˩&&o8x Jav|e?$cVxSRn\vA9G14˞JA]4(!Y:r .vʚ#ByB)ne8 jh;^\1 $ꇃl>$̊7×Hڼ=s+x=BXDov@ ͵Ɗ10z8"ZD my;tF.,bbFgjF": 0Wty?$b^צfg*N0eA|]ک q-!"4߶M ]))w\2QZۼ`,Ÿc;25 Um 4TE]u6ďh"|ccqm]e =Ȳ5UױpA"zz]JYG/7ak@aOhC W^8{uϠ;mi*öTdV'FoRGd 4+ ƥQNb4 !q- fO;]d{rƧDMo&c ـ`/18mT}y+$9m5b22YӨd u sa8#n,:s@Sz2?{fW^Г֤h|46}ikY6̈́R-6*4.D :(z?1GϚWۉiz@e#b<(>ʷ¼VkFxLy WB y&45m҄U'YKMkc5KۏT+o܋vLx~j*tN ?6jp7t _s*P& np DdC!E)U{oEYL^_I59EͦMr{\",ыOΝSQ~J~Rbg1LmmtTW@w6REۗWumĭRi \SvjYI}P>UMUmTR 8RU[ V>9Ȁΰ'ZxX{Tr4iu߸ӝkkV.]cQUODŽYk Li(>D&fI *[zlsPQ={HfŞ, k@f,0kkO =_ [*gLнۂeՄ$Ox z芒) j<7uhP%' |j)9JJHٜ{M](W{~j(Z+ Uwe/GL3afH<# %?xˋ.=߶|Z/r]TZh1*():}$<=&bMQ{vcԜ-9~bFȫt+= 7i/)j|ES*U"wCE ).Yut.^b'&~wk8-  -HmYPa/D> ۦB!gm,nȉ5s?#c{XG ޜ:p)q ="eVy% SF'ίI᣷U}Z/imn +eM|ľ;eܷڗ$8DŤçͼI0E޶sDLxAӋo"r:e\/ w{L @` cU;[`PTq;Ehk~ssA,394 7HLuO㹹$ɉ,8ZT昢"sBNO2BtlYLw+{,{Qbdo{+x%؊$0\~T3 }*fl\9یl)͛^8V {Z5ϒNgR=͡2iژ"qs@#)5pl$ @Хz.$/|~Uj+6@oT"-Wp?KQedfP GQObaV҂ݥ_J VO][hMFQo'GwǠu;]N80;4`DgOUkEӸqIjP-MnHGŒZ& OӬAl7ѥwŐb_~oC*y2S׌ķh4*+G@?սyv~ <5Ӎidcv*ԝ]dODQޭb= ,h,堊Ҭ.vyt `"Er(dh?@vSqa*tYl< A>Z2lt:P Dk_x%"6Э~Z#]0Zp ~@{:Grq{O\o-6ϑd'ևM Iwp3K3Y[-!?aǜyhwl~ ֙CTTRfJiDsYv)IH爅̦#c+ƼнƏ#̐(ũGͮK(6*-sweI6TF?e?= U0VNd"YxDA10 ;$e?ht.A̗LUQ s̪eh|m? 53'jm'pP&19KIudQExTaV3 %;2ZxשLÍ;d}<^\f&n#xpX d rB]^%Z,0]Q?N^5Q_67q$喆^zhH> +0bsL-5X{&*Oj𛜱c-O VKFeX<3T ؔ6T\dHD>"#).n%)uw<%E{h~bw@g^g!])=`|s0gZzfhnd{1 0׀%wxEЀ\S:?JJZMʮ-g.T&iW'}Lj3/ Gm`'%ي5&h)3%qbDzBkZmluv5n2;mEգߔܧ~A!Gil.!b~C]_eQJᆩn-FROo l*Yh繡> >HBfK"yԺ|&O>R2%GUR#ĊϾ1P{v4M&F!A qcJlbiP6?4OM"l%:Jsf臻Muz*RxACm3uUu]d$J}SD۹\A_z tW^fE DM v_;-yv/:1Q`$䶴˹S/̑{{mz١?@);hR"Vdaf3UC]C;㤣 ;5`@VxpUQ9[}"~Tjxu]<1ZI{QDȃ{GI;:y0COˁO޸õ|rHe[Y<`ʅ"XBR-bgДh^(XR 0╛?͸U;%@-{𸎲w|Wެ"*6VR9$uwq#~=ݍJr2YB-9=Z/p 'QήrZQsβJ`35D*&{F (>bND(?z c;-J!|@ A*s ෱ӝ%&2GwhD:*G6Qu;0,^C4u&!Vǁ ca|"Y ,mIg^.!x\LrqP5{>>w.NΔ6xSd4dFS.7Ԍ[Ko*R9ٓ3;^7ZO?-Y},i"mfvS/>GD*ns&jG! pOV;T..Xp=1WR_>:yIV3cJaLP#}8kڎy1?42G/V"mFd#Rb\:W';Aa4ȃ?M6Ь3_ 6iQB̨_z4;peԶ6l^~>H![g-aWsɷϣqTa$\S/`VVC1"J:iY+`3&r8[I3wo eT B0>I4hc لD3-6{1SfvPU(aM}b%ҴȠB!ĭϲ\Jidܢ5QVDjɝ']O8)'LJ`[(j^-dhH@?5Ko'P'@tB'sBRoa5(8q4<u+TfV6m2OSWq@"Yc7KJC"=Nzs5"W}%f})r0nqfMfkx,4z5{ծ;q0>KYQƾt}n84p|v"RVE0.RO8;K yK[?Z@R*/B(:wRD.!m%~[lr:m.ۼk}jҳ(կ(ې>nQG{e4:0y'L5(wvT]{jȭ-BGyfߊ؟٢I9bDGi*O+Lׅޱ-k SN?屌龖n>N^ !Be?]>I /:T%63S7EF %ڙVd=| 1^4_"|F\Eb=QEuu~;@'}Ef-2xVR Ќhv}h o'%W`IAGϯ>#Oe̋m\4d`".%q͓W'nl}$+f;"zk|+m>RspL٥AVp*MUArwJT>XJosf1G}v.A(Z;E$OV!]=.:n5~N0ךPA.#_'+,֎:=ECrJQ: 5bBV-5.1)մ\E >yN2Xa@m-5zĂ`j日bIӪ9؍kH.dr6)V9g"eO*ղolKx48 I`/TuB_1WSayX|@KN)~gM;@p^OIn ݱ)%9 98 ?Iͻ!qJ$R$dE@vI?XR^([W3]փ'8xAd񮕋9xcK wmb1?Z[:2}7}O}U`R1e_ð9>8sL;ZO<jVyߝM$Ј[fbgQWio?Z s* ǹNo"XOJN?hׂdV2EtGaਸE$. fO%9gb+!3gE =0U,RUK |𼟳2 ; CͧYլNTAvtoVoi#lXƆ I=&|꧖]kә@ ҖcKL*E_4Qt;4A~יYt,~tJnSf5)?G&}ؚ'7b2y'mq6;t Hbcl2& F![_͗ہ\`/V:A&N#DbA@*dȊݱ˽Rq,pe5ErjEu XDp/͞iAehc^ ~>rڡZ6#-9[Of _4Q ziM4#Ɖ6Lwgw duUjEuUZۥlMピl,'yRʱl\?oTp9ƗQz L7 j,30h鐝mc-`rew^>Vq o@:MіuR;9nPF13ZkEj]2x2砀QN5 3yL"6vI4OpgmVn%} GWX >Epӽ%=F@j `U5AErM,t'ƩNP΀ ǫTH-y*->t*X@Uhb@6t}q L<:3 X@zɖkP|h xԁpa.h]wqIm/VUh~zeS:X lϞϦ~d.f:7ͨZWwvYm˸燞MMu.G֋Z09 ! 4==s5Bw6j%sw-qN2`É偞u I&̚ !@%>PHBzۛ®`_lx%5pRU<0YEaUfCC0,h-x-j/7dGԔiqcFcvK_ىAT p-S%dtB{rr,B|UkN!i@?Y8\igk5flKwNafK?MIvT坤Q6!԰|U8 vfPgyw4 'lAbunKuim`W}O#/?}̜)x V..v#Q rOdO9}Ovr,LR֡=g1 Ȋ<['HqL9,I+bcaN ́Ҩ/lDMq r74kN&$xp8VBq2f_ȜF Lg]ZaR$2mͭ4^AZOm~r؞S_"1n]. a0O`8Tj8Lxj k|f;BuX NbPn+$%<>yQ˧ p`? ˻ZS7SU~DpKqBV}r6bn+=J'D*#Ջi}{=LW5zʭO+t64'7ryMфMUAM+h2#zkJZ$F c7w+ ٧aY dT h)b iXPľSPK&M \ ȤƔSUKhϫd7(]~m= Uu9$7,x[FX:b),.zcCK8mW:0/IQ:~moCa9NJݿfTR^KhJ4N sqӨkqQd_DNs ^Z}D*ɾPtV"Ί6Gu\ PA*Kc)vEDk_?-E692|$!ZU%!ߨ&ij?|m:.jyb= :m" BMtܻMn=;IJ:{[Yj+_5<?YN]4@h,ǁe"#`YWYTaz>iMIųtmhևuf@؞( fhmޥ Wt̅p8۵,*ļbxdtyBo)S0Bb7x$ةpJrjl~gdnW@i!)@@Q`-^F嘭, vF'I~zHKQd0>M܀½ 23i,K*yQ:Pװ+oᙵg.L-Q2.,Rṷ}RwEEg;D1lٕȓ^ܖASh?گ#fvT3UdmD,PMvu`ܸ2C@w﹤J ݬaA D;׊1Vzbz K: fvogN4/"P,y 9ͺ@j.ow&{y=s_@#;g% EΕ}""#䝬RFmS* L{ν^0tnN($ RoQ!X\@4Ǵ+]=Q59rnjÎugOsGqV]PV c~4]\7Љ泈2J64|yV9qqxW[]}j6DMy6dm(ZIМ82מ\Gw樗3U,+|rXX, w:5%=3NX}n;*N @@DÐ2¢L3Fxne6jPmw86NzfDre%r3I΀s]#BC׋w!Y".~qHjo /uL k>.=(o=Km9ۃOW`YIx. ٮZ\tn|Zak; (`>a[>* XRms'y>T`9!([^@ .`vr|\+m~`[~EH>~y/^>z0k,@_Z uIQy5nNssKFYKo]c drQ*F~e Nn`c**XJ(D"E]eB RZ*P_}\JWUXU@bEec (PtKKY<=:(Ð u$ݳm02i,g娢Y#^PZca}܋,b7a.vjROV }7J +?&7ie܁ +˘E{d$5 F~+bp5 ! I]VM_1dP(&PbZ(ykKç}& a &+Bj),&ks0}IRLB~줫`^_7{ؿS`A{;Ù͜^ { ?I_[-6nޱV'߽FEH.'M<]?gLvڌ3I;:zN&jCaM.֣5-n#=LNyL0juT?hό]~/3J xag_+ms1 V/L!*pu֑٬ii\aV.E5X惈ޕdnE)ѪWRz ͻ: "$J9=5+yPQt?#@\HC-J6e5Xb{ajЌa2&.aCI"{;BgkuNMvw2j.ba``1'c+ wAH/J@i!*Vι4uݧ@v9'.W* ۫2%+\U&1%Ctʬ oʖtiJ`RLJfg@/LVjm_9>̧+{ 2&Hc1y$Gz9m!M*i 3m-@{e[;OG|RM jBcV KVzG$qil.:Ywb:AqNJ|3[0_U'YBbu1=.ݩH]IH@jE8만mLX ~+N X%?Ě3ʟ Kjs0W=C?`t'W cz!o>n!};kDfM_\> e=]L"o !XOcC>x;<#~\#t NsVNE[ AU{~>OF83)-.]dgruN.$(5s~!>Rq)7+C.!O-\>e fd䔱sD2uV0 ^Fg`P;vp;?IXVY\80eA;*,v H+Xܚ vd2Doï<`$3C:hoOz- fe]>%iqg6+#.-c±[n*SbS=m>}Էo|S8ɾ@j?>\f,(`O_xpc7}>mam bِ2kL6m!pY#Rz§R+/_x8 эl(PN/EBxMX%25*ҀR^3Ĉ+G,GfuGtƴg쪤NIX̬fI~͂XeQ0֤Xg7T0l̬IEF\řM/pBJ\|+CwQ椒%EۂXxyT1V) j,+YI0>E8ܼPs8l`G.Mx;yی"Ή{6voV!7c,Ó mL-ƾVkwqZUB(˙# !0V`=/U5%adK)/ža NiExPɾ d25 »}O2dl"A~K;1xu.=pm`g8W4arbE;L6\rx:;WQ8]!YFYtY(<`h jgLr~Al}(=abu:S $ 8wXhs3p=Sz  iK1*7Rr?aJ-Жiic=IPſi&fW "f-ՄJ(a4h-z}^i5zg2ʺ kPmIjr$~ ts@&*rV5 ~b;4 i)sJMc\Ag"I|%a5p]i_ !CPzŬek-޽BGNKȜ/-x/?v b[:[ ;>QZ'd]Z ij? j,,t 5ʾ!e(ʫ=O$P0ZMj8g`Iѕ#o}YϩTjړmW2=Qghs ICtj;DW @Q ^G[-_՝zt"dS%&Mnl6{{P񀋫X!R EQ p :bng ,eaDٰ![h\B, RWk Eqs=1ҽ>3UY`THrO7ЯYή pQx^JA(g|P xjM37\FEDJ>)ۅɊղ?`:rNŭj,(^;l'KQx|cIs:.iaa#ٿV*`}ωe68Rod.F(6Ou3|$)R-Y }Oδḫbٟ?1j!?m!#!)OKLHƌ {`B@=pڨOlH.֝1Qu><1h3Z(CғZd ^/\IeЁ_Zbm& KXxhzA#. A5<)F t" 1Ai'0{#t_>3̢֝(gɭ.JKyYpoawcUMAF+͞dd"|v/ t5Ơ5;lث<̄P7ђ x FscҗvXp)-*."o9BwORLr7Gfh|YV𮳷y$FOY1a/1v) ]:ྌ->Oٝ _Ɗk9g6\k=sN49iW-0>;q$GYCTi )6V33O"(Nv*SPl[2B6VU!7\shgG9|j[X4{y,LZV"a+ݻ;[*=֡Ѫpo?i[ʚKd M2a*J[ >hq7쇞ȢDjm&|3+Lja'MXˉV:.cKxFa;ۆ1X?]ޖm0,juFjrsf8ZTꯤ/ZԺ40ڋ]}Bc0;3uׇ c[=~NSi_z~%_r[@oPPMmuZ;r7 x_C f) ؽQXnk/م2C.bcYM9R8b 0QN#ͯ$vt'L}2jۏ=K+yEXLt3 0K9n:2\ K^@w!A~9E1#JL0dQ[+PGcL &LxF .V8JTX 5{"YeŸzki3BE?_CRaEɄ3ܤh]P&?OqjER[? F˼sM98W5C:1"_ X_:A3wyĜiX$C;O^nT$GTgKnBK_3IӿN6!(@ZMߌNT؎jmو {^.,%҄ ɲڳ9jC!DVbdy'Gy eu&H] A7oA ئu=&_8@fIk 5kOGP:,aƴ ֗AT|̵:a+)$D砺i)>ǡt`{8`w/ q%Ԗ6zzŠcz}"D1F@E ȼF9_TՑkOn~2[ p]cNH$vᰃM WL/`*iщUuf/C 85luNHX;ygu m 1JҪu0 y 8 q>f_\@R%'^yL苉 '.]K VrA4^UjSEj22) ۱iJ>U%/,,4]if -fE1g !^QՆp.aЖCw7HzÂS _Oi 5s Z g;o * H`+D &=&#d:+P Y@gw5*T J ︮=Un&ksM"r%)y}bA$b,PLM&hº.(vYu eq_ a ?ڴVy+s^T>O7(jmzup-g-[Й] '_zׁ(3y RbR aEi? `jM79WA^ o1_/rwlq7(nS.JR8g# $tQc*,\M)"9D K N LD=jy_C~[J7ηdcM +S~Y;/3>@\Qɾ^8ⰱ٪eP*kKT\f}[ tȵzq;Ĩ՗qoo3'W=k7TAmS͂~x|%^gWlDO|ORFH6* ^ΪHD߽"GsvRGM@ f[xB-6i X쎂$ 7y’`Ky =,pWG X@4 >/xj%}#cM \u=i͞"QQ0!3|t"1H?a{g؈]03[Ms޳Ȑh;yur*V\*Kޅg s7.:FN*@:s#(97A'}qXd*8nMu!s'ITw.. ~r%C[sg*V1O{g}KyUdF1+sSֻxKi~C[ Bۅ}jn<>c!4_\۲`7Д3-" |h=8ms`8=B~"GS 2{}GC M?;Y6Ch$ eZ8W*X9La.5P׿ܹ j)b]4QCVJ1Iתa~M͏!+= WgdC'@DiPW`; Jt^o;yESw$N"~\]*iSbQ3ͤ=Ph/$ P5>PX':t2[*.>s=44]ߞ?JKtUQpkzqY|l1H}G|T#}J; ~A/ hh}ouTgs O2IĹf4jdnN{OI%WR^#gC1FYX[0&0U0 _6045Ld '7.#%1biy&U".yhvF yS("`ݏ̝͠[FM]&B ~*K@*j&&>I_$kL- U݂.Su"vvS*ƘjϭH! h/h5h<ɡRHV:$iU}[pVB'Hv'$< h{KByܖ)y`uPۥbu>5ywn1ӺBÝ-{P{%1- }hBRzHZInIP5~+ ?/]Uzt.@9!)ٓb汩*zf aKq㸋G0p9_)!FLKm..b)_1ِ2=jK #1ێPl{: s^KL OQ\2b툶8r=Ip*t H(U KB8P0[+~mDE+~R5SPǼ-MNv-pYܵ8/l)XD`WP`LFlua!imcY%=FR2N8iCmfgKsRFw(Oj~_*#r:4 i8'vEΰn |NًӼQ8qc朰'|_7QF[@|UX>wt#&(_lt*3@xylR,eH/dJ&Ɔ 6 !@GG 6ڨZCد*$T~Dhrפ@"ekΓ)1}3}3Nsy1uzߎp+b0׽ U)JӦ<[C%l*R'L@i>ՠ$IZ&y\"v[Ґ˜0٨H\|W[zFx*FƯ~T')ٍ=mENZRȺE+!vskw J>Ou.. -e<+2ʼnkwɣ?БHU WIJ}| I߁58x" a.gH>BV#6%_!SaXs)onۮUqx53JPg %.+GJAX.넣on p\g"(^yGNfG)rKC ,5L^=}IZr`{(MhP-?1gFMq̰ h?.Kg7R){ӟe DEuNmWdb4.cHY\enQ1bʧ{ imܗ%RdNhW&nF hSo_cw] Cbq>(tEMҀ2k?WHq{!nT wx,T&9k/0/N=Θ1uioQex(Z?^'45pܮnfq+nPXJq\;gx4E0E.D=j,tG 'Y |% J-K@Zze.&W2[N}(,쳖@G|ۚ2 zä+&¬o߂;d6Y_Jd/y3 mr)ebqQ!>H+{ʲlO;|P[M8TO*S%O!%q%&~u]0R? \'a7و>B\pOZhxl0 v0#|# )ӹ!JoRjs$H+HIXkU.+D^.--4Ěq81'V OUHbJ,>)ippA̪ЎrUwqv/ZwTM^p4;g>-B'\+\KE@8R`r"R!SwݮlS"A,m5,>ӧ;tS 16cw͜Zdtfp]3-0la~wQWwQcBt9<<ohF;f~}!N@NаhIR޵. lܮ*Sv*PqZ =zڷ28XcڎxII@vAOqxa!4T`ً51Dl Vg msхUSm@0Es_cWal0P wEw֚t3zDML;0)tr5eঅ Xb̠˦,C?3[5ə'Ntp54!j {WSl$ؘQ$߿]K?YFϴʕ=TյݑwL]4/=H-:COLAB Ï30(ϛC%6+ o-K5Ȋϴ >jX!N%|4%!/IZ;Γɦ=-JU.6C19ܑcn EJj^a \I%h}П#y[+-dNpqIuW,'Un2lRy-Wj[-Sgwg>g=pmu..wV˨הC1⚑)86z$C4ڨQE7pTypѮnۜEu(vTpZ*y#2e vp̔k^=:|e0!zM=ACߋex%$Ԏ!Cci.ܱPx'N|HbȜ_H)2 jʧ_+ SlԶGY&@Le$0R͋P ^_o=vqnو#<_@.KUKtp-]KF|y&#hm4识rP@*/2"俬g9v?6\!$#\֑ٶA;GUBd67t)/~+Ec?Rmke WHJS3!-C.aă5#U?X;WK@j~opV9>X[r#<%qYHnt4Z!t8UlFs[-_xB| maڤH5Gjv+^J:*{j-ɑHqpyԐ8ԟQ݃GR`Lp sWy4ʪyF)f}QBLl h$*r~7VWob&i ֣j04ٖ|/"~ì " I3}l -'ubryej4/xJ5窿NȬ 6Cdv:/ Ӕ\_X 0ORUgUw@H.2)PBEgV3Ki1#LoOvj.wwY&e!LHs*KFY|Kh<&t(/%9|" ^=1d2"[=ǻIkNM&-ݲjFfYҀ:d?ax56=asBw2S{;@ӢA&L-P}V?r(暩o}@祿O=>ܦy|w35@c&>Ƈw\磎4צ(hC ޚ1A_!d$'GgFHҪt;96fyI\[ܩ>u  <fx~Ga#a)" $G_c5xNFG{>:֗EkݢgP/_4%LSPuu['B2Ѵw%[xMg]*OP(rݢ oheĻFQܠ*0Z\sYBGu@k˦[J?a|W唒+0Abhxl6^X}Or>Sihհՙ&,|"; 9>L2K vO.%yg_K`h}_̽v0<Rr{$M?.9_閁˚ФxLܲ hO+t~RO6D#fWr O:UB2>G)NPoHb;2{LύNAe\@>|!`M#K?f E,xv@Gw y0kITU)"Vб!=A:[R/uCӚDqf. gj!~.TPshEAIV]4fvenmn03+]>'ѱ=o>g2%,ܽ +\e>XQ豈MBs>R.V"M( p^~nwևqd8t2l$%~S2̾CW0a451Bm yE)f h%wr'vrO|!芺O^[f{?*Ę?q lo9ckCCE$C|t4QWiZt\Xb\6| S-+E}&?xf+2aDŽ\ /98&؎ёf  #֟;,~N2v<(Pݖ?grƚ⅊5оwV"/ț6~hM  Dix?ny[fC6*Yv_wvۊ&'I"S썡h -9 _6` N+ȑ@ ӄi!j%lw%(Z|iN}Šh%ӛ ytfgJŦ`/Mz-8j4ɳ7 ~$QoݙK)VEk#Snw+FPO!}/:r滄)Ni@'^>h !v|;]$5)Jٻo)8Olg\$8Ş[:L@fscYcUH#%|D:|CjH T]n?l^%F知|řX֥Е13yUE AC[:j [RKٗ¹8 :G.00he5P,Lt8" ۴@04݂ZpzZ#֜S~?= ă;4ջRox4hwh>WpKk#X'șTH/N34t@8nku*LOC4h` G%5?֤v"fŌAjtiI Wge tZ,po;6S.I!ҥ[-!2% XݔI 9(lfv ϩ'y?P'0!G\ތ,( !'se {e!*u#>_3Ƹ ,X5.Eq'ꈀrWA- "M*h 3`7xmfҔj/r m vÿl?~h:@o^sKvf<. XPHʭP{3h++\1R&/J/4S[;=;>GpEUGWTšCUɔ9d>lovoSl,3ILt:N1yZt[xyZ(ßgYZ4`ٳ6~: AVI V22PE@1f/򡬀=PUFI:y{whMIx]^, Ĭ];g1ϊȂh9wI<< x㲩# !xJVs߬cdqĄbn :/qL?^ȌP.uEb 2%rqԠ{:cC&tt$ōIK tc3A ,3})FTQ"Vp|_5DEI_/+Z.e K̳:0z)b1T )  pczkӞr4D?[n/Yn7Чic>kg 7ӗ*jkz#^6,%-:?bYb[d(jNm :XJ/f-TI{VK_3ei.ur ^ ;;<ŒoܜS> m/"#n=ZE(mb?fQMJz\޵N901 |ocq~8JPl E#l|J!:itT';}@ cN1W7BqTZj ^e:JP#DVXB +P[nMF=z0z xE?p5 _\j-/wݓ\krRzGvjPΘmC񅠂c2g6c)h%&E<E$DI/cs͍l?!e#DѐFSw{V*Cqꥸa wAU(6%^Z y$:QDN)mjF]39~;6qoC}K}Tu\QqoÝVBJP5WЫ%^@h4@u gJ@ͮ,qX%]-})Sӻq;h pK6̕Nq;>-5-ŤdL ZZ!G*'+3XDlZFqLDgqK*k]{:xnK;p `f18tS'InPI.+pJZZu:KӇ;Yo3Unm,ְRB=[xʍP+]*Y4?Y+fԵ>|Iv⯂OǾ$8^?  zA%3.E E V1ӼRjJ0Uq+l2)Xj<ӸyksP:&ahkFĈkMH>&(s]ۦQJ8G]`öӛhE5ggкB2)Rz>@{>G/Ⰵi +qa o/ս1v|矲))Nd3BZ^V `탛qψhnB)15I$,m i2FDٔZC~mMV^7&Є4 )F|hphI7ؗb mhɮ)/pb>Zg@%pe:1R֏)ň&H#TK VZcm;Ól%rQG1 /I},@huCX^h@&I??H2ObH<# Ts6):2KU "@'?ONt#H w0$|L, m|ĬEABU)>Af̳SȃXpguIX[sp61tHjU6. dt*jόmY x/{*vP/ 2irDӝnڻO2/bG%vZi,uV`&x {~L{';?|npZ8`?`pcX?d}OH=̄WִZa>(N>X1 *?JYYfé#؎*cc3=^]mM^Yd6r<_#2ASH>s^%ş=x,ԶqjTr%ӽ5f_ 2?c7of#Ƭe)TU$Ko/kd?X/C+Qrrpesu YыaY BTf .21@ $ @cvC&8@l͒횞 7` >2~얈ώho"('v)*'/Bg g$CSڣ?gz.- ڇ[_2wr@7m>d)ǣြ0u{#ABĎB޴§%xz{~ R>_Znӣ;c/#dэXp3Q 2[l{ʞ}:?K)ڮjNF>_pߕ=nCע] >vsW>I RK ;Yd1К2vX핊ZRWTP$ɆW V@Um ?aG8W{#%'ýA@hʗꪽo-fG[iwo)Tͅ֐(--]u?#XZ',nveP׋=@kc{T>OR`i2y%'&1u?>YJivlURxL%s_E5~ Mmmܺ8eF<)Bѫ]^Q =Y査덱Fs:bL)] 96/G=Al[r;*>';ZŒ*9M}rF7"9Nq擎{dH 3[v޵F"Z17 [Jy,OOl@(T1',@Bj=m/MOH9"e"t{ZQ3 _vbP i_]K-d*?ױx"Tං!SP@ah4qRyt(ZLӴA PDxّ+x،-$ |bh=_Ɇ!:фI2=km,x,Am,aŸ۰X?AoUN\$րrJ79 %*̡ /CKWfFpğ藱ړ@> 4.faFuo$j]M[llHn{Щl(RZM +EK5\E}_z5 S"M><@IZO@ Be L:E~*  + /(\ME*J;:c(#(1)n}x';\ {9QNe7v#6F',pDX+R9 (~ kKI a qA2bAN2X556o!H}c)5 ~kzgm!됑9OHzNNNF(qS !Qei\wB'9 &gFDQm"&_A-ȋq2sL&4AmMk^׉E^B;C/NI>}i h4 W&y7%3"PF7leqT$j֘l%ƬF<,i(̉ơ>;̯ ! ̚*44HVȤmDA Yb迡aȇ%3 QbQc'} X hK|UfB3}сd:Vl@ugC`uq(u`iW鴃RW;@W [bgĶe22‚umI˽ N#b8g͸ظҏZa%ƧV%lY?U[2nυIEA7O86O"?Ug}خ[iK޹Lp;".-\\2:!r3k{ш iY!Au$ڠNn ]:ZuGyBey9SƹKG &K:RWם~q5^" j2rRDcP43_tvRvX;= e~$~L8) ?*Yy"9͡SsDMl$v% mݑ{J 53A2OF@=ɲH܁=w`"PZF? 9iռîsFD"RRJ% Fwi40Wu׿̺=G8HP]45N[Ɨ&7巁zXȖ L$ 9/iWkUReKVoD08a* w3Ɩ#)Nq.8Ȑ~JE O -d( [f4 zTJzeK߀H,Ď 4["}k::D OC~C&ң(82?&tuo<5&)6Һ@|1| #KKz ߟ#$JU顓F_+s?]]b *nGZTWMjm3^w;Ke宽A=8f" D_b@ FcJ@8ฌ1VSD|Lɖ|~7G{aMvoۍak[s(>v2NhT MA]QAM{=uPr!m7O")/ { $eXwܬ ڬKY`0Q;/3~̴Jz䁻sVR9r#PI?,Brp)a~XNNՍ4BNEeTBM걽GxkQՀ/jK; SB4nֱI}nFbBZ(C"mbS/[s#uK 3F^7X޸Meq2RGA$Jt*jLY~|V$FJIꙴLZ?b0FSjqlJKQ~2E/{JV3,mmo*,ːQ`c}*B[Thqk$ſsїĽ@mZYQIJ}cfj^Vڅ͠D[NpEJs{އv0C-(6${czԁ0# O>w;e[Ċ'0-mLn]>Mq HPSB[.UV%%8R9.cE8MHbwmzYQ Ё0ćK!! JzDϯ@/f3z,f1(44oy5]%wי+:3ꇦk^*W F ~0?(s`MӷE޿g yBQ9E}ToTn}"dL˜[7X0aNgq>lQҴoh!UH_Q\Xu4>BkwMf=!S1#T*0sӍe-Z]+sƷYAueŻY Q,(rYD:kOӀ e*ܴcrn(XDl9@ sQU\WgHd`1 >N}&4B_6ӹ6[S.rOF̌={FaieɊ,UsR[ѯfvXq&(ʨǹf'g޿(s3,İNqmi_:%%y Uao>R#o2Q!#@ _=͜_=۠<1W, k\vJCe`.)'}YcX]w4l(A(QƔjeּ{a3f##6ȷ&viSU#:?+ TjDLv4_~>?QiGw(A*?b[lÆ91iO{=3C/@}N>XDm]2z0fFR-k)әs3.ռŒk }xFO{jS55,L6δ-nq=xW?ťB\ P)Ae.ke=TSx éLJB_\VP'L2|N(snsd"v4Z?FHP=򐮒jӽ2VQ<]d?`Jzîψ,=(r8gAj7D{ޔ;?fDJ6DVW]"P1HOpYL&d)"AdPm_fb;jSGo\-hxe(š1WGPਤr[wHN뤧M< ѐSrm% tJ6 C矺H\zxF L!z?x3 ={ynL7*2;]4۞Wdž)bnq&C'$ h5C/lk`ȓ<"_gYDmɭ_h`π琙W 5$ q|j{ 6>z9K6{Uo&h [/O>R\Q!K%$"c~z h4~hFtXoc3šw˂\9HIɮ,GDi8?寙Дn#ۖ2kD'ZV c(鈔5uƳ^KEzJBp>_ȜYŒV[c2H:j\uw얃}ϋ|bfIth'oNQ,zWI{%Mdt^}]XnrlkRy1jH">WS]CT"l,{=r~=Q 48]~;,.n}RY*=<+d%ӓe}l2?5_Zhzz-S b?rϘR  MsLU/j P(,[Y P?Z="oS*#|՗k (`2 u`ƶ>O$Sc7?z#LM#ګlG T/LêϜJ 7z}|Rt ZXi$B<R4x")z%UTj۱R%R71Vث3RT+k.QJ~~n]HHDJp]z>QsU7 ^edA|oDT'9g@J0ʙyLt㙯-bC)6h5n0`gyu@8SS8GNE:vxCNQVU:FG.R99)}kBp]#P, ϣ%}xUk_`BLw-OXR"S. 扴MU:cb"F)aS"1"86A:gLl7*3L'z4^u9yEiq0=wZ7j}Gʋ>gspuB'`ǝs^hź[>pw)`kJEa•UyExUcb25r% bn } i7ڞ=4o;KӇ z{0$zr `fGm߅Ylwg# +u)9(z&7"0m N\-ޙiDXΰ#3P:$GeoW;s!٠yiF"<ԝ䋯I2m&6f=umfmgNxS~2Uq-m?aTTKm9#0g .ܤ 3G?f[il"'N =R*%&ePW0fHH {w`$y>lĐ7~ ݠQNAQB=05#djsWM ݰqɪn KabO4\,4i9rӷb/,s19!=MWH4@"ePgO  v$+Jm<bMe%3۱LsT?ΟscA hH} EgϽ]Leܸ%oKZiƼ0'i.KyS#o (ruI('!VIʑz{%]ف4A.\'qTͨ2VEU# z)( ?鉅+[($Ռ ڔ3X 1WC,k]Yƙ g,L%?;z؟N7-\Mx*?"k ꎺ#_JiI,X=:pRlU?xѵ, #b7-טն>%?;uv%e߄s@#*lGz z1MOndz`?e$\6 1Hh*Ĩj~^XVTAe.吅EkucZq9|3<}M< gY\CRNj_Oh}>5Ǵ]hdhws} 3ur=vb6w9x~ ?I#o6ګ~\G|> UDZ<5Ǚ?ֺj.br<وB*\ =R_r@p䏃VU 㟇9 t:I⏍$\_F>~ot?TSYt=U"e .ш,LK33x71<9*+dbcNց? tm=̜΋wkYp \> cR/^ƿkج!zkMˊe6 g{+Os8y`W$&5 5v<=[C JOH8ep`!nE!x~㶻SoHAISAI,77|`i@ :oDiW'G܈jgQ܁!ZcAh'<Р;q?=-mqU0Wd5sb@wQ?Ԉ~zKGf,(QQkΏZĊLU)mgd&җ6XlI?..*lp=FTYRK*9ȠYLMԂc8BYm DqnG\_w'ƪs2@=Zu4:z)ZXO&-|wM(Z+]syA 6iE ݻI bpA Kɽ+z`sv쯵q-߉6/3GVE)M"Zhk1l@C/'>#+´ 2gU{j qj>ݽNz#Cï Q%<<ԕuWlye] ʖbuxLI;[b-*R0pP%@+L3UKes~!;r2(il_OaJ-ғ6&9 D1/@4ҶN{ӥJ-j$!lv50AdX.=ܶnvR"5 -"ڏT"+/1\Hި z`FOvgؙ3YݫNkP|*]ukc{e ݎż)Kr^o>DZZZ mgqBH_b|%nXaT{6&#)}*hbMmnꊵ/ $+|v(} c(+8WE^b}He(u{@Sky䦍߯pФ gmy/7 |֌fO.>- 2Ma&jGe)GV=tbYҥUǎP" 3 e p ? çTV=>*ϻ?7!@⁕Ζ+sI+[xӨr'ir"':0}#`1{>i(8;ZeiʫZѫ`橆}* gT0uCFͥ`:8q\Yѻ@0114^ޔ>|lZCa1X^Xrj&fWLp0b>kIq롉 )Noly}{-DbKZ`JgUu]}Rg<2P^mqko,W|J"w-ʕ<VsE!~6H!nqU_$}AXN6)!:xA1%ԅ>UL'G#=hh.>js2Ad ~ ~ϸ 8U`$/ۙ%HDB+I\V A"?&)Kˡ>幯QVSTi<%JKլh݊:LJ銫frLu_mo 5uh S0\Ouyp_0X΁w{dGEG`( # m)Քz*w#fV)0cR\Jd ҽ ww[Ρ~ Mq&,@{aTP)RIki|OgՕl{gb΋ԯkwSp jEvB6t6 'z_Ō.';"BOXz'!ZA1>Yx9yU|HlKcݾ(eJ'8[9zĐNu4,_7eZ-Yoq-9&Fقt>j&#KBa6HR0mnt ۻjO9^4 hoߏ Pxs>ݘ~ ~1"+T0jnT50&]l_3tx;.AKSԜbL!KHrxryQHbx2aV|BBG '~tn3xW9?a>J+:Jޚ`zո 6ړ#Hbwf4`'ejpo=6`爽˔}uf)k1prԂtۨz1^>v{#$&!$Aؼs8%1O#4%mZd3)жBWy3V 5]vސd@0\Hr~L;x%!|-Gf֮$b+j);xi0KJr0f1g;wo|B{J7GLـU((>suJEA+TO`U:s˖2qV@k|3 /4N #"[ޑ|C~4|ծx&j]X͹/rA' #VZ-I%9=(גZh͂ϖtE}^6e Sk K.֯ZM3 1 bv7HϷfHWЍc닾$:C\Ԧ>2vV2_We0C/蛻ǞG&i}`6$$n6Jh[$>ywW}h/qr#h$yp~~*Pl?&-Cwq=9!>ۡ^^DrHKs~n,sc9,Rjf„n肚+bTX@T Rveαg|>W./HQ$f}LSrϟKu"-^s% eFt5qd01 d_wE̊9d[ A:܏BEHC2AoW~JYTr%A}8o}WcV /7X 5l/(Og=ʯ<{[yG@ի%Q)IwLjlV8q\%i+g6'3l(6ADoU~::ӉAύ k1:1|/%9Ȇ!o9V1l7@*-^IK}Ձe 1s)_6/>',S>nK?hXV{IA1y"EJA|۲eR.<~$% DU*#G/s;cpUM8Tؚ{xHPfX}%M*,rOJg7.473饦/ni ݔ X<L_Bh[l9d$O*l6@Vp8K7a DǞzۡ2!{Z؏#NGvYȊYNt'/!kU"q'2gcB+14]^A0D7G^[ bL×CaJ_8tCYB1[BӪ5jku9* (IXE!RA>@]LxcI$1"270)śW΄gMe@-ʾ26;^t(}EbцBziTydhlat5Rk:76ՐJ/YSHX_.L-Z:!Dp2pF¢dB~A"K귱:hmJ\hTaf E5Ƣ0 1+2'2f̷L[W!&p}bcd6"(s=ю 5P v /7fQ3h͸eG.MCo(H; Ftx?ll]¯.).B#[<1zrQB7d<>܇-Z}p#^7s߄b>*5ߎZx6": J&֛J|K7FmoE Q_% {rwdܿoH q'ק^ F}c)Q\硥GL(vc]τG!4w5O[dXSTjtE7$7OL8u@#0b[eC.f+(z %pbMlH`A?(n4{VY-a;<2F[eth1+ *kB2 3Z Ü۲e 9hl2*d97]Q)L"/k?&dc\;1ۤIKb転'q 2Frpdpinއ" G,mV*yO]'&akU˾q̫>wigsA'E;tvc"A? վ;20x*V]B!v!jaq(39Si;baʠ@`DkNEJ3e:L'7ҭ%WؙI];$H<0s()|r\a(4*<,UЋssKa:V/3B\ Nv-p7 2>c8[ ?9{T ,=bb{cqeH)};j\>WlHݦOl iJw_Eu(g'x3nұȃCna4y$j DFN-*s5RP*o%VtHUSatRY&p=OY/:pbi>4EDe 2E@ۆ2`E-t:sK%N9`|$ <p";ӄ'#$[!:UsaDJ_sgBm4;I i!g$T/h)M |XGa.hm`6< LYՊ'[N./~U \z J¨;z, w5OOY@Rl lbB6@N^m$چeyXaH  B<]KH 6㼵lofq8q\N<Z̓/v"1-5Կ)9'2A$^Gӯ̥XǴ@h,7DFe 70󑧲} rU!ue{u#A%]*U}kM}9}tl%s <i$괻sx0@PJϽsB#gR6XmŬu~aCY/6ߒ 7J'CpF,/\~y 5ԡj3ao|+F"5jM{Ug y3;!+su T:DR3-Y frpʰ]Fi#Ri8ۄIguͻ1$8O%%nP+JΎds}^o')| o1򰍞UyN&Օ_ȏ=Į B)ω0m"0Ue kCu7al/>Z #((ח?}(HObXE檋2e0Qk=dj=iuSo44JXؐ*ƹYrqdُ80 \9ӴƟHCܤ:-RXK}vp]pfO܁u#cӤ`ңc r?~-%8\d!Y۸;S g$Aj]Y\n Hs݇t{ 7D:qi6 & %Tӥ:|nL q*rj!PSU;<e#!ϩg4>zzwg Sj9!/M&DX+@fd)8Xemr5%ƩK9 riG?v{[pWSsIIj4c}Osd.-$rbrR)50k.y$n{HA^G ةOSFauRMڶjeoeύ&Ҭ2?Py> =Z WF"7ƿޞdCDxRe*m4l~zh!t;nz+x'd`z&FRݏ@DROM HBPT‚rEn vո8AN@ %?d]+?33Xܯ%"t3x)&=ef2)TA+uHOXiI.5a&d u#5*1 Ê)/QGzB[u)MPՏb${wP轾ŗ=Rjo2-Vm+ Ty;:5z^Xs{ujbQa"cez%khi$?zġμł/bkLf|{䜹H7*>e-)L;FJk@~TNZtL%99egXCJjWr;Mo-C4nˡ@:!! xZ.ݚMf r RTh[s7fhP RikZӟyrQzD! 7O^ @\l8 o]hA0~3 mqKIĎ!kDn}Tm{},#^D-#K.WTՀ\Ldn"b ͌1tc4֟|q]Ef _cc^fYg 1BoLvy ^a*qM1Kn(VgO=F>ӪjB6G⨡ƲDLnW4Ɠ'VDd7o L54&7H| y) ȂG:9{ 1]! k 2m%Iˑľ?f`+k.&Ofur~z5}͟)E̍;da;2!N 4عY[qn,˥ֈeaLlO?SÜ#$/Kj:L)^m7:@xIvamp7?zު6F־g^M(t63QdCh7gÕ 6PAx8TG=?9x`V G4>.Fw]wsɶW ?ߞ7іCCxe^MSVsoL5 ʣ8ӕp13O$2ĉnnlkQ~wvV <}&@-1Raoc= de}]U,26C>J(XYt-T%wW}utQsb)A5;>iDѺאb =D?Ip Zm2Ԋx5&[pL@śrw(S| imHgo77U*\>ax^Oo, hF8 ?}pEZ]MjPi Q&t]"6pi'm2[8!*ztXR !h}iG0e/'rIvA듰mMMQDnȥL+Uvt^ajo (Z @gCCk8X=I[Tqp;gq'a7eNv3J-~Dg@k~;^2vH@6g 5P^ )d67yq+H!lϷ"sV٢|SG+iy0o 웢N [ѩYkJO7ld\ uݤYNxѧp~Hn\MXwpRbl2O<Ν޻՝X RFԥ>cױO(!SεjX;WQnV=e9d߹o}o^d4c; `*ȩ.: >}l]7-rVK5r 'THdz A%tI$#QYk_iU{Lr* (G[M-P' =Bmd$no$3_+,K҂`{s܈EH0vh7bTRXO #r_@%G܋~%K65 PU|hԏ,eAC> yk,!$p7wE/ :,}_"&28yXK,L0}}!q *- ֕ȸZY Q:%x-r׍‚|6*3d(Bz|'nܦpU]TEsGaj aݸ9ME3]$EY$ֆSp'Ǿ.e%Yf7#q _ %?JVnF>̟H {IanyJ4yҟ/(SWBzR0tt A<1X?c?,qg}$E90'>wDSq$NyysO귘ZODRQ?f<,!̺ 9w){)秤mUWސ?įG^箔4Nާ1gBP{|ædi~8~TYʎO-U`Y8YfvD&ĻI3q/Do~$v|!}ȉ16]F_P Z)z!Z !ýe Ce0^Z;7بv #ny p!n8kK7ҍ@~1{bw^Nyte#B 6~,Q^RaD0tD nR`Fnvne&ʕ'JCqDiI'7 :M$( bO潝f:QK9BDWI+C3Z~mnJԓ?vsq՜8F 5'0 +n2M:a c#R3st;$-Ǖ'(I&:MD]te7|Y'vt +Xvl 3J@_;if_1pP4ߌvBW3#EIE.(ߞѰ^ L݌|k.}@d \:2ӑĊXKP"mgpKϧ7 drQC~k2BH4~ZػだQTJ͛)7ѫ|m͛b0 C&˱B6MA,Y J|pa}h.G,mKf~cWG*j /U\g;ߣwE\-UCL#4Hd^2ּ J3*iv |th}1e@*\H@sF$#$:EoNo)"ld̂F-eufɚE1M$P' w[Jm^ EpӀ59l"a~23(?nr r XUAa_r3mU7Zɗg-5\7y]+,*x.[ o3: shʛ+FO76Cu[|۱^oa7{oӱ Jb_Ɗg]%j7bFoF4#;?q/r{ϕ{_ۨAn'%2@j}2o/q.7GADc)goY4&39Sr`g-r $|ub"j *RĞ94Ҷ{`0EPHI;Ӆe 0RCIlgw@MԊ,*.ЂY2u$Iu.6[.S%\"t5cYzq^g8&m9GY,&y[xkA+5lbS8܋Ps1d 05e2YXxn^zý(q8 ug:͛32ı%]\uc!9'Ev1I=vyPR[1ID/ᄓʜ"yo4VtҀ;jG<&~ FO%ɽH9ϵ-DS@LriGs !fSֳbD=͘t*^%YD (>.H3%+7r0-\E>WȦ4!bJhi xET1~C.fr{svJPJN0 e|3Fl"]fAsUқ砊I]|BƏD2qX$Ϯ"k}/5VH0* cQNO`"@q11pIL;4i%30J5'Ү~#{}pr _Vg3mm`eJ/Q`AgWlS#Gn?8(GV}uG*Tˆ Bݷ`%wC0- ~L FDBYKc׆>_3*hB>YlQRӧҠֿ&6ٌAaV&TeQR H=1<*`\"ijHe-lͬ{ߢ' jDnj4L&avjxG2aKhN7b|qZRfEIp%uWF}2+zc(I)7ڀy"&&ƦZ 21v[Vij@ڭ<+9FNw[I9k#^kL-?d Eq&~5w%zcŘ$E2erA}>k+M?~Hެ#3qKQX)~B962x w!K*ȃ9:oNGP5Jt5.5=-{Z0&eK6D)B@ p`9= o|ƌ"ԣ7:dVeI_^~|N]") D~c5$mg<Lg,F+`+YbbYn#up_NbƢWQf$k oczB.y[&?YӔvG2r$(nQ!5. tfgL]WB[!)=ߵu-s'd;'rD߰;|#7ECO4UqIM22Y-(TJw// GIiߘ>MZ>OXQΗGilJ5NzJ,Px u8L$_Y7(yu *=:nطIp@&j*6{<!TmH[ r2!ΏGTrr#U9O+ŏA)$vJ3dA:Z1D{&o~f>}KNZwc= %C6dK}QEB?a=8rHus`ȑq*43?KBHG16YVf[r8yr_bf)Apuo+膍@vg<1j@QV=a߶$˴`{#Rm남^fuPMU T:raQcG7C2[ W, R=SP]I@"_hޡJ韦3J A>C?)j|P hb{7>?0WěX pVAQ-%=2Zn~}ZuNԃkK"#nL;"Ҩ_\ ]}HU]ӥzP?6VI^:rLU" e"vXrCߎ)NU#D',q9)=PL_ @J@ #1͵ڒGvh` +gZz$!$7=/[뮹7S- #S I(m~G齤U4kU%رo&5.}N0{VYA9הV/W!db`` &_f8 ɽ8{xj??.Rdx\&`ڹ SHE{~ơ3U'ZK2@wm:d.@,ꁱpBd45{g'qPxD'F VψJMg&1g4o&W'4ɑk"| [kC[XP&q`x+f׻lE^n2@Zm;@Y^O2Alݢݧ0*l*cmn6\N=f`a¯0|B98S@j;̵6-] 2 ﮤ ÙNL:'5LE #7:.TbfMau7Go8VVnˡbERTNqį+FݶF:n tF"CgtLek߇T=U 3rP6# B[==}&NWNҍKU:n&N,6 6۹+BżüQ 0pCB ܃&+7t!:Ƒ(C.F *vwInYՈiO v?>ƜKVa$miArub]m-Y`x9#=.̓Mq_ݼNzwqcȲpR D˓LM7x;oъT: (^Y %2 ;v`:-Qe(ȏW#+c LA R֘=Fi~qH np F.%)I6D _31fO{)Rg@Ƈ ;et{`+4UZ|jg<{Jᢩ~V>j&BaUC%}6"aƱ45+T'd2HbGt,2Q {& &3{j(Epsg:LP+IW|aP-b3zgnـq8H< V**i=Ϻ)6Mg,S#nvE<">}]obAVeMW-}RDsOQ ^ \i7X),O0 (`Y|~lΡDySR0UoxL-sh{S4 ;އeyj߆qEg1KM_zfwJ -: YBf}3CA4F}E#}#ӼiDjM@{ap:lhV̪B$aoUqmp^.ޞ[56⏶+qc%&k\>w D9CC8s7}Hh uZLI@ke?`%ʽoDcCnkh>0J)OEPӿ+%N"RQ/r7/A MNYm!Xܰ~]\hg $:D+^Ӣ@Ks [=ٶ37oB1>u8>'\>G n" 9|"U柈HMi6ۅ|-!LX'O5aIR7sC{>5A7{st f!1,&N|PcXffSC CJe%u$ۇq#)k|bK&~j~,N f}@5h6jGMGhuSJH7iAΈ8U}Nb)ʤ'aAmb'~ ڼʲ_MWb-HbA3xE_,  Kt  fbN#|ByZ]+4ڭ8SzT7/mBm~I`Xr$wQ5N݂*v w;:cF//H9clx zF6c>}3^r]6}Jc2/H;:#zM]a߱G8C8ήc Owg[a(T v :Ot܆H,'f~=9FY /F*kA>%\aH#>],ڠkքf p:jJ rfe)ҋa|Oh/j&cSJZq"J8o;/]IjGM(?gB2zoHT3A|"8pM[? fg0tuBn<Y.\Y b\|zjžN'T׳}Ɲ ]:X6*I^ByhF e ^o5 4uA"1:}g~8QԜnІѰG@4m1n1GŌ!%Y#2*QT*!f~ɼ{Mn\705c05jUU]~?+۳M;7ß|/}W® b FkIIk=c0!hh`*P ٧Oޤ :uk1 :JIbm?e kz0:B\g82 -$CW\-R,#K5Hwrf놧0>N /3*Ir9ĺqt1O_aFaPo' ]AlUے`/ j-O;E(1M5CM1[Sds\a5j&qPrxwpg.獀)Ҍ* f>8?FH\6vd yQ$vSSB/ >?-$O Hߟ&p|jizM]?zCewŲ^{h;<8c@e:AH~IquZ,ص9ܻ.wKJÐ3rWd=gbQxpL;)1F>"n. i/Ny-F;Ooj)I2=˓+#ʺ=ޓ!^#%u+dvdl1ˆN3 h8CWn̼w\,x3 1"虽`5(%.g #umQ-'Zڿ$mVkÎ.)\Ewid?ݝH/4dbdTfD " +mzxNXYN^@Po[p 8?0oؾ=FVڧɟ/Ey=i@n+G?:/!.&:2;R"VNL8qh(ywjG#Xdg뾔F/TW@VMkή<9s9VhK?U ׯɡ7Bm WΟɻ*^]2B@aAd԰Iό79!0J5ZbFre`)zw,bx<͎UI@g_h*&H{@3ý>D|mN0OGR Y1L-,D H]:o˭E⿵w6#9{}EĿ噳|!X "? 7G[@sT)ټADҦQ^f%Y9/{wzLS3S*]yo1>(& 9N~|ђooZx,6HWiܵ- ߔpSiJ<éjHY͸'n^ZbV-;o?5z)84+h}nVÀE]%:DxOFF`AiÛ&`uvr, j&ɣ4}@<0hXot$9νs_g/eMi"|[w^+b+ᮌպXz X{s)F%E# a{ Qoy65pfY@hiRG{T)scxA41ZῑkxpחpƬKc.8r! .Y{畷_*hxd\ dhœ0JmRyVm_k3k =4  sf w=q#ĝɝُOҩtֆIEO@鑃 @RЍZ`(ji3gg1>5Dh?g rouOsymUGj,:HÇAi 윍,͟!v>k)d{(Ć )LDgZ>dV[./HkK5jPFr2{q&vjP/w8q-u9 0"S5*?- e#D`sTHŶR4bj`; +ZI؍QD|gQ;tv0= ۗAܛs Ou5>XtE0f[, `ђ;B +")0B(0ϵOmOWөqf-f4'nq짷Ah]LCAfq?XZqнTN M jsu/g9TDQZI&}*6v3NեkUSH@]zcAY%EG=ޏwP]U}W_`$ qeDBLS5^\q![lq+ , J[U6q=c6]Aշ)ڼxźG5l4:ӿId*O$P!rGP҃/x.LDT0EufBAFXcs8Dq] r=mS}Đ>pլ-c~)6z] VG})tdlz_-E /xnV8CeRfς<^<5ChvĬ5D fSΆ P4N{)Q̣(?guһ!)_ NcywXHLN,U*&]JHfY_l.H/j[\yd_`y}nYeHޑ9/d6Ia%ť+)ҡY&Nܬd$:`!~JTN̆'zw:8NI@yNT_+BۖI`Zw0`ķڥp5MA̺*U'_Y%y^c#(*g&;SCnJ0Ru'u;v1y(TlAcyeh "4 5 gķŬq EtDz|a|ޏ#7'CP8wّd{{,}T@s̰&ptMlF]  w afR9@Hm84o~+>;\޻bYlN3XyqZ,뿰-쏩 5 q'K;mBWd%% sD\zx2WKDe`;YQz_Y>t"?S~:48X uDP  sfh\86ڋ11:wE<7ͼ`mRTwIaPcngܔLtW-%r+],d5 +7;`cއ7W(yq'&xvO-' pH({K"uj.xnTh}rT=L~m_Ba#X]/}o{hDQ&$2>BzHFX084ULS:MBj9Ru!@<3XyTW !]f᫮"6- "2f3,@ͱN5fB!T>_+ 3ceC  pHqoID`9]oPպDCJm'91R~Ҁ)ݏ4r9[6V|՜RdCJNm 6CWs#l$k U.n>9g.4Tp l7&  Uu)h˷'NN9)$=kմA)Db۹{m|,K91SVknZ7H@|.c?Ѱd#on2.$MjA@o< L|\_)NO)hSE GW/!YOC|n) foI' Ep=BQfhkMD2y)Ր I'DcvTkeW3 P2>V$h2|HF\Kۮ@aǨUUN|K*7;a2rvC{)\VofNޞtwA-{>$SYhxM2+w7e'q:!U5I#u~v/(]BI^| %)̦V폠OIߑhnrz9эXҌ}}vWt[V2a>tD0}3Ƴar9 x,bfS}&ɓ]`AauXqU .K}h>uPNs>=RzPwf+댳Npc]潙gPφm ]CpTL'!o֠dY ސg%0q1 {((tE 6~ (a_tuBIJ_ٟ߇G'}VBQWإTڢɔY.dXc+1ƊFˬž%JJi ;!svׂc5 ^}jչ>h1A>054KT@^t76圵_>OMI=J+bJI :2)xo~! ~aHKuƛ u:Sj=A9Wz,쌛BHIWO_":B^q;"k`Cڷ-Bd)Z+yFw>i2 dF1Y#V۬P|'wzS"ʘWjq`DqJr ( h=S hOGl"7Rj(P𛢘?nj rKD=aθ)/"m"wQt_fvwf'?jsBkH/г߫+-P"V7s{pgª5ڰ;^l ė<aur  E ^gy>Ү79d ?榿r8[\ɣu9mE"t;nj#0Xk` jK )`-N>x@1n@ L(4%#$e;E'hU+`u\xK/<ַ1&u܄y]_m)X&bƻ8<8mԦ)/pGlD.` _DΏMA;:xN? #=+ULGT e3|FɭlO8I`E<*r}ܫ $56xF(YH*^ xסV4!&";:I!Pk>yχ@J =Vjm7O&n%Yg~4 Tخ56D&NҏR(M4;ʁӊBx q .IN!$hBH5uF$O$ԎٔĹZ}Ms%H0vkH[V"We N=Žb b"8Ǜ BPS oWYh\F o)uȮgZi-|q|dVs#&ʆm2\qCc. rb6F5;F-#e΍ 3~{BPkî|c}6CV*&V(L]KZ*ܑy EkZ1^x2-P+bН&&u? cWR E ܽU4щwfľ1ȶUAW$ԅ{G3fhu)`6b ,n'J؃xb-$D>:>c×T<-MSC}a6ƃAw4}Dv]WtYFZ tWΓA[yCYS}< e;C4Zt;ֵE_DR7,)+.KȄ0E<&Pއc.4C5am&u`yo@KHT.8K,yuPLD̩")9O+mkI=B#D~^L1I21V훤~1seMj1Њ-T<`${kH'1ew3E(?f$&65-)Dk@~+|SXծ}]j~3wUսf .[Lr RlGFߍ`-\}9dRj2 sM4֟F[d)s>bZmUd[r䄐 Y ɍUdx{$B1Dսٴx|IFGZM[T5TFqz(uC aPx y/jH>J/[H.J`T@-)$]9"dÌOfԻs(/WτYj̛gVy6BD -2EnLj;@2-|s* ю6403e%9?5+d?љ ~mT {IKjU(.*\^4dbt! cَ70x_[ Y&ߎ*^4 fbt {soewοεxmW7O"} m\? .lJx'ߐn4ዩ O*xhlR'lmr9+x;|`\^8>5 5L}pqa4UM8 Xyb=vjU-dG@+ 4Up(K><_i˗= [\1#^l5Uhl}7m @hXubГfQ2+qѫQ>:A/-q^\]4u`>Ô/ &.Įj4S>5:saP`c| Q7{̶/埕_jCt77+ٸwjnÈ+]ؓ)ŀB8V]B с%K' :eʼ2-3liY2Z. Uye+s;W~،c!с >Rzp>]`MT*K7LE*ºʨf>F>hL$A6:}ḟUX9 | ȝ<?TL}f=kj2hzhXj!4 zNUk JFԥa4i`8}jHQKmէf4Ypc*(O1k`6ӜJo DtfZħZ2TGPV_XT,S ;vtˍ(:{,c pӶWM'zpZGc2aĚϢH:VDЂ֜I^Mcl:4aqPxYU,-.)KS@~!Lau$9SPoidK಄ce'ʱjdOYMGRĆbB= 犁D(|h__ 1f~wc^=j0smR(+ev?XVe?] Fw\DVND ozMO%AfaInHOPʼn .|8ՉĠqP?`H{:DR+9i ٢b_=T+Qw9~X3thAxE%+KMا0 Ff_$D$w_||8Fޑsf1C^J٬ eE6֏dSakhW9SYou]yRx^PG4lI0DiçwZqI'Tu)lCj](YL"jjj92VŔiQ}VE~ p`:"Փ}Gc#cU"ݧxԞ˕98S0w0۹ bJdLK~]N$іiոfI>䩒skC+ A&d-tƀEH3/pP'^ғ lAsVħ.oUB3%I -!j 7ϔymY܁Od;qpn}jNou&;CI@(ɋr6ZmQʥa;LVZxNRTXP7)|sWBT.m@tuO{Y"?p_S"dHCQnjWCḤ '~cl'Sj&y" mwˉadoOU;o1ҸRnB)Ńۙ>=۔AeSE(wCΐ j z$DbjP璘#Js$DTAQ0I=>Q \Icf`$wf܄_]1c^YJzzkB~A%w 09M!-o]B?5T{8C֕&Ja9-u5v)Zjzؐ`xU(Ai32so 9N+ʹkAMV=)Poh#(!+wOFA-YFvù Ȩ-g8;Ws. y( ظKД_mj ԺV={~0B\;jp+̐A'@$W \0sQR!Pxê7b'DzLj_I%@ g,Ej}FŒ2X~`.j6!<\8`etֆƿK{\{Ϣ=n4UV-M .m];m}چBt$31DKb!z/>Qv9=Gk J F0z68Iw^ɎWbʼf+jjKMu|Ip!\b\9a od ޲1 aKs93dnvks Y=fW %Nl]r܁ U%K}7(~R,&V6!cb ܷB uMf (JB ˂%wιt5;@C B4QK,pd;.|ZM>5=Z##A@ι)^E\f(23!!Hz7?_ckݑ$Teɡ u1<%'f oNzp,yUVf]G'(}+8y X>1dVwLYml~|&W<[滻VN NNd 0e.U3UVkW0Nhj4R|G}s~Cay់eU}R:;}[Z0>nU|A.qW6JK>)%j-ϖCb%*e}$>{˘Q/%2KGdr5zMj7&Yt)p!Ipd!}*)M4^T MVPAellbuv-'~k qR&rdpԕ3]H5 ZOMqv&Bv8ycBtR4/1UYa3+{GX(zI/aּ;1q֬eʟX\>xXq",73*0b,1qhf'>?_uiK#=:бX) [; ôKQp #qu#d~х0a5[V2?EujP, PT_]OG礪;{ޕʭ9 MB8Uߙ8; zr.5 0zįEܰB/]!~빩lQ˕;׻PFAY3'jP:E0g4%{VM^ܑ6?6!(WY+iV)qB\f<߆X DVyuGL'M5;atvP0ksڈRA&;hyxQy;$aВux7#}xc +-˰Z>ehpɠož7>A釭|DΆF <+ \Qw3#R'ب/c 8_)dn(;U,[67A弌Kk㭪vp zKO_o]t{4)u1h=)3hXy8}nJԅ[8NP ï vig#EENEADvPGWI?ל5_Sm+l*XBjfb #OzOkDZPH7ԯVꔚ|34eι_TmQoNC=H"Wc9>zrݒYTwn}˝ot :v)8*chjԀe~%"i<` fɽ`2^V}=F,,Anl^oNZDGk!L{ $xHM'9 M;߈q{(z)MKE`Ik4"ewzDB =.^[<"RN W(wPgb'$ERf)f7ߍa^?Y-9_[ d(=%YMFz~<$8viޣphfwW:n#1&Ӕ]*@9!W8_^ T[X]R}T2-Qwȸ{xH>! ;=lv> <տc"E ԗ M6n qSuh%hW<(&']>Br2bPw.ƁѹZuButYI/iU5yYk y}o sy4x5_8X u-JP>,{[n鬪N*}%@>zOxCIF+{~&!{PI獘,VC7[V֬iBxS"<:$w^K惒 6n;᭘Q+,0 ͵ӫQ\c;u,!:4zG $2*E:nPoj3 ׹h~;VlҦ)QDj1 ':'68%>4k t1VdZO̺W QLχY*U4]*.AJ"ˮRћ-^`ӝUsS`Qw&NVb$Rj5`64玽U)'j j7(zZƒQ| v E$qɧ&R~iQ"~? d#jķ*"^jU{H W;7,q~__\ I%agBw$kMvN/)ZqǕ!HH)јɌD_ՆMAA)~[4ءhc@=x} DQ* Ԏ ʞ,:E|StpEKK`;m(0:X\w1T1u]Z&}x~mA;)7"pq#1C'<`e}{:94FH: O[Z/ܐ$dt{>.f^9./ME$,bܽ&0:zT7ᰩ hL7߮De}BBg2n=\ƇKImcqme>(Wf 5)$Yǔc!lj1k0yFtFL3N%R{Y6)^gM8:a ]J9F:b$)%2;T07" AGʛ 3U _ {.M% n~ _#_X8?":y p e8`A')\N9c LrJ!nHJpUH V ч}vfSC7 4q8eJj:U埓It8yY `?(ER ;*`RA<q cE_͠ ?\{wĹ zn&_?a0e\~d4w| ՅO-A .GTq:"+Iwg%~+y > =LSf37 a-;t;# pO*Bz(S+'TwRUMUv/?H}ƙqN *8zȍ~' N95!p,~GB3xy0pEBEһ!QtnH l \k:;wzgʫ b^QN3_/p;Zj7>;M9sfWQ78?ŀED3%^$tV܄Z nc*Fpsvrk:9&]}i^G@z0$M6OU7k>b~PDO{UOΨƨH$Mp/S&&?-VRD'(9uL!Rj 4;EOGKYmHPRҖ#9']} lΗohRvn~o9Hǭuiq৓u]_CRE("SC'}C劉6YRV6$hytFw9e?wX;]H2ump1^`,6~D9lzg"[%HAZ=TE'0&O7 H wUN$<VK◯;]s!i3G6KOrk *(Hao׌BvȒ`Meߵ9y"&?,as⮊_bA4>N8GJǞWX cWkwijlͅ4$$jRDqb?sci`gHĻeZ7r޿fk^ JB6`D=|hC\ӵSlÆJߗ$PG<]̸!WX%mL-a'9[e1"Vs^K>XVR# ؞3Nʊmx2} Cn'>"wbR1(71PDR "yԢ2qP6ڧB4XN4W ϰ z JʕϦxbVAhT" ܥh!SՃQ^;C[_GqJz/}q-rq7&cy*^ST`eA"lQbw 46 jXC>!@5Cxv9 __E@NM2 Lgٞ1X@3H,ΣP#|ЅqA-_rrb<;^k>.ޜLc9EPN5S>A4cgyUK+d9|Fw ?{o7eR% 7_|s^߈ԥI h/oRe^SOjٓ Bӭk~3ϊ9+V=z"'͍K|M:>WQLx/ <ї Q}}'3-aD!/wOl?<}>d>$) Z'W 'aSã>@jQOY J}AtFYEuq5n/N՚&k2o~[ syn dg{xDK5ɏv3ʗ&V5b܀+d*f…f{G@W/ ,n60a\ѕ7OqEKBpMj=8ԕ>D9jOYaެzw?MM1a$|UV,4=^mD _ 7ĊH'UF]g zw`Y:O -Wh~q\n$U<Г e((ʍ_ιw$D K[bҥ(,UǓo7{\YAwsJP K0;jnRg_U?^ygfGb@kI㟩lXQG4a v;RQD9=> "͍AZcCгLJ.)봜 6iJseXg9'DcElU;YOp{ц Ub;mTHh {8(b%F͢ډzQS4A6CpOC7 $E OdEj^w\$tFv⒅BZ`O3*tm8w ( D&C,SU%| m JNB9׻0>+̼u˘&q"L-CӱNx(du yF A9>ԇ *l)6Ϻ|e5E0gѱYv%#?whBV9uĩ wv ۞}d9m_PNnd-zs5UdNl~or.v:Jz/Aʠa 1ʻ8V>dF"$:#v2HP0N56):T{k-L f_8oH=;5aqqק͠4y0iɹ2jϔ86 Z"8[r̺-[OW8g=PGWtĠzrSQd[]BL fKlKZOHCt5{υ9,m8]s^xãVre !K⊾?!lPR])5Ow^Fq*)ɈV Lip#j][Jas4\J^{P=FunЛn%nU =0$-dVii0s>|KSYag1klVqY5#LT d ALb.d$}\0ATӂ[б$d(e)2ph=‚]f*дsYd%+MpȟKΙW}:A-гxj!<"ы6 gf=qdǶEZ"_cZTPMΝc22-x"7)HĞ5LS6;LdUri)aS5QGߝVY>@| 75Wa?*׀V&OVQO&c +z9⠕ f" eoJyp/ش7\05чt/S`ZdPޮ,P⽢lk~dB4DY QGI [eUɩ8:ڴ7iHXT骻ѿg&J k9PN t+^*/Q]_.m?D-!KʄB2r{{75T \F>Rzr2("HwɤלO~BG$}^l S'C^Vg9ŸTcheXNR252R"ߨIQm.0GM<-b)f΄53rԷtIdS e"#)h@ KzJHƧJU~_ |w:z>EXn%cyF^\W ^S$DS >%pqfqISrEfBp m~} = =tW@>0 skqdzʨ!9LB ^,L[GRId/_;s"z6C*rDjdAa`G+fy/H )Ĩ2z!Z©EIIkyVz^M@FL l|iGz)J k>ȧ(@Vi2 |rrAOSɲxlŅ77J z^\R= íRDdo0B(S#/nuh$1ݬ†(^+/MRmsݑ2'|hL F 옘4PORbINᎰ d V]prxU=qODzrrz"`pΓ,IO|tg`^6ۍU.FA]'+pˢNkG4sf# W,D':cds먵O4C5˲rR/!Aw -jcEc X^gHYrg0vqNFCs?c:R=ş̆kUy鳊/WR/1fґ yjϦ(ʻn=1SZqz!/yBE HE"wtoϼ}kjo+\"=J.QX ïZcjg30KGHֹy+yy2gQ=QQ73%k`]PSȱZ~_^aJaM}8*r~r~9)?vlg!# žXW@29LASzjxtQOaqΨ RN:5hEi` NJ[ǼK]AT#t <W ֋v7zUtPP(!OHar ̰'ä{ :&c tBe:XVI|Oq}fka%XE #I͠KJIcSj_Ot' 9T_?h.^S鯥x'[]Qn7/ W8"bJt,Qz[7r*9Si+qYRpd-a gPXaz&s&C0ݤ}*0P4WŰ?/y;9^r5Ciugnr`[xʄd% ].UP3C@X;,9=t^>NWNUGSj?vL鴟ŢrYU~?xʼm'R'.jEͅve 24 T+gv)6) [D,7=Pr^߯D7ůQ c2>gko而;V̟tf?Mg*@؜3]WLK|8Jrk4p+c= e1(=`Q@y>)0oKh PV%j]^a| bW|cD{"`#xϮɘ˺qdM(5q k&lӱo,@YBqbx&QOE*;>byK? fbrT<ķSZ4],dאQv P-VT@dn-8f:>@/\lw=Qye(Pnŵ4]mlsfw%`J1Ǽ2&Ԋ,uH@{$(C̪(3alJl62TNh3hQs%(CQy<tQo{;i3<80%HiDHL+C汜%Hlfkb: c4aʓL^(Uj݄!kkmqĎj($#;Uc6z9Ӵza{O$Iv=Eu[g MaJgy Uk?Id46! 4K Q 3@je!O"n|8'CKh,k^jDvKg~0T 4!vlCzhL, \9qh'|.#~ECÚĸڶi|# zɔ J6LtDH2㌂m҄$mOYC/PP Kv*[]t}mM0bvpxHC-9i!9rXgz0-ԘOIBOLSk^W#tAPzl.ЪJ[zIXBb+ INᇫ@]XϜ*Uq. y[TNJ+aI8#F\M\AE@'jՃxP+rئB'XSIU>FCY?OϾq yrn՘ʑ}i 쀱%[d%][Hw>,Yz߄*%P&5LˑRKE0O"6xD#a< ,lh{!GӖѦitH9"`̶tbtz'mbxQrb:^n=UF.H<. z|\O)|? @uز{~-BGM=buLrJ}^RE @,(L?@|lֆyq0Ec+uA᭏V|n|uL b#G(EM.I30F5ɓO2J ?)0`T qE$I"hŌABnͼPD6 vw ޏ?<=tTlu@f9]h3nbgH=@ ywog_-߉ߧaf^ 6ʥp/=> /0l>u rTWx~~υ^%? "R 8E(ʁޤnѳ$0ҖF_mSl 3 6?V\cY,!w(1#01\2諱 r"]"3PTC{{<# S(BB ˵~&Kϒ= ⃕mDw]<$@G b^3?k~uZA4|؁Rʌ6?J6I]YE[XwSk]P*ö _xQWݺ '>'XX@[k3HB" {@(- igmES7ےveyU. SY*>iq:lqϑOC< 7~1c> ol|O:aV%S7jy4X]"a)xg#3po InѾ!z:~g'yid6aHBHs ^&FEq &߸Ifl~u$At91EG|rL+* #q>wFJ \Ċݿ|+30`Wp'!}r;tl N7I̊F+[+ [ K#n4h@'7UkޝXB sFJ91xzcqSXT"vίdydF +Yg[1v\ziD], JVg ?t?Ԧ{A$iSܯJpJ3f1sjXsys@Ѹ|i&lF9_N5,ͩ+S3 @#jvYiZ_Mx-̋bpNwo k_pJEΣr_6V. Fupm Gz$iKϦiYֽ@WF^1e$%X7-UD? /i^{-qw{{1C92^O:, l"TGqO_(q @U3 dsF~{[Bo.9Ʃ^a"]y.*+-3MOzyj O6Lʣ3&},k8w{F1 .5 d>;/dtu:slN}:R*yoP^^jV{{{D/䳪SL-u%=nnEܘmx[Z%rq/[06]_yXMIy(^N CqP\ Џ$+VUۏ+?Ӏ)qMDj @Oxj}J|4n,g{BuR]swMEIR@#A0\g}Swd&`Q^JҟKcWDM9PvHl. ! Lq:U{;*dIОvR@`t &:t;/)%mcvr ]J2Q.īu!(kҤ`*hGi%Z΄"²I19W6hOp!JsքrqVtͥvOZϞl`Ct\H5 3]*eխJH^r'B)ߨf&\kO3oѳj:dbό5ڷ7L>V4xsFpl5^/Cʎ3w\1ebQx?-7tCPj[{13Ábղ+hWbơ9IXz xR_kx!=:ڵxTALdՖ i ?S g)ebt(%Z ؜YUƔ*S֔[?ZB,Dfۇ7qb%:?KnȄ3o=(NSvf]{ke  *-']3Q#ycpȁDO wbH,#DZt҈NkA_w9-n1SU;k46tx'ć ŹQ(T` sDϬWW_ձp ӭ V5:vdKPlJ7yٞ']DR!H&`< }z˓pʹq1.FܗGI#-4 ꝲ=.{L8M8JƢjw[vc2fIWiFhK"F1tHSO IB5/-X#["9W-L0Y̳x[ Pϛy`z1 \pK'kNdϰ5zש6"t6(^,YɟzG̟KF_qlYi6$ eC1lԟ\#pp.I_Tĉn"x%vW1۩FɊ} oqLRUy+lP ODƽRS>09znZGF*x'%NF3Ej! ,(JΒ|I=h´Ai}L؜5 @QKXI%M?>Cݐom>~̞lo0<芯Psu ¨h5&@>&#EYL)aJ&x*-A,P돑|oʆn\SȊ0JwTB<ږe  n}@(5k@B}V\~R L!]*8RFu:&+LX‘Gk֭/á$YQ/J@33J@n'OD1"~#~R,k4uAD /8<kER0s[||oBt쭫6w5zi%"DILUtGcSS^j *Ss|PḾnOk[x>V衴gx3OC:)Yji^Hִ53pcXۘU>pzH:ĺRwdkLsy~7}V5 yQapVoa-S<8[N DA K<.oR!%@"Tx:R OMwwjK: h}:)޺5reISƆAJIxFcNyv*G%,ey|~JC{j`@ b @!@O#OՇY:fńf~ezOk+pXܸ;E "Y`ƺlU*%Zt|*GGTyBGOSgvZ"tAGr!(u)ipѺQSeP'Me4H\ܫS' 'yق-b}/Bt \ͻ$ B`]U%¸ƎY5HO*=qOgV??,w𩝬ѶtJ3D$./"gbW M@W Oфa3͛J54ӣvHp)u6!]@?JϞ}n-[Ӷ/;ZOZL)lPH[9af<6 c4-e+Yaa/mkǛuHcڜ+KU\ug(gew(_& k+K K'`t#@C gǽsc_isw#ժ*$aЄꖔIʖd5)ֻ|8#(}ʕZFO?w6 Ų]^Sڰw+M` K[ʀR, ˿װh /Vc5^rKBށڂ%V@Q1 hFZkMW}H0ͧOP虡-MYyQ0 0`+ ?`a<BIYWHoD 0tnd0ll4iš3̏P]p7Z%k7w͸5V\&TMJ N9 KBDG("փ$yKG_tK4['1t,{nSpQpm@Bv/CΠ}y4JsZs`ZւŹ ˒l9M]EɍY^v9JJVS,n.,5 aiWV qCo9eSSK} wQVE@C 񿺨!(pȩst~u f8=jExaك1Jl mê,ܛ1᳞%LmZRC4Vjj!羖҅ p>բت9EF٤ݑgl\M#M[m15irM@̐-(ɌY2Ӹ4%5g9# M{ 2pa&3F*j(tE?5{~Ja_(J d!1SMMS%0 f/*X9=߾5,0hZy!Ne/qSj*!}谘fmZ&Yt{C\Q\N]=Vۏ%}^i?9ـ~}:}Oܬy FM4F%i {V_o#ؓ JpA'Օ>QPWS\vbJ!TΥ[(C]nǓzK1阖-о*{BWE!xHhFVJ~@{^!K+ZKkFd֢BI|1 @D3iTY+?vt`|"oh,_WOnH%rڽrwק(_{ nD2!!9/EZwtmZU /5R|@=g3(eq,{aӚQgifS:+Rơ=tg+܆ P–@/a`NI}/. #kj .o_оxXo>U+)/D65xPM-?C$gf͐DZ@\k Ϋ7HQJ8>Q=P;()j[*03V>DA9JkTo؂RKLBߪro HKh (t{ gPsg~ JӘ1f)%J4L_UjE t?eZ_e9q-=ٕd j5/HXc#F"uNŬ^3步YV0AlZ,FG1N{aZBGSaCqo¥)q>`g#$f&bI~ v7Qe: ͢#ˉI֭P#€reGj&07Xe[ȩg24B*E:NyH"X9z;2Z>Tk߽+We~4Ni3VsGv{ިdEi%T/Jxbx n;4"qQdB/;Zh܇ !dU7d T2҅HBGj3,' Bѷ>@? Yu„[ʃzGǬQ#z#]q8a7l$tQ@4\(}}+#@gkgXMo@Иi+%x9p*18coVD&>^M&Rg0Ǵt?qDCLy\SGmQ!xΝG&jNASB,s]n>$%isF?$8TC6|UpA*6< BS&\MPq\n~WcHd&,H MD cL=#o*{2Qa65F'S뽉4z˞߄HێtW ~Nz&c\3eQsWjEh-p͈/uΡ"jHoy)%ͩj":~;nYH c~X (b_0||o@ HL|C${.5Iك| Nc*E&1Q.@$?\c V8ƖhVۗmEZ i>?LG@s9pÌ5<ޥP _R ^@u iu̵* ᝌN\G7")d^G"Ӣý3s>Rz}\b5sh ps?R@۹iʪj@} jfK7{{*J5P XFgοCeCMk&BLG|$ @mruxݧ)$OEG7>:PgU7IljQ~)3*RҜ\jAE (mƤ('V:Ql@I 8[b /yNV|ESؕ9NDQ/e'MWp蒖!k,UXScS-K5PKS\5"1HqGU6V9KR'(6-*e!˛s9W}M-V \]:[qZZ[ %=XTȐ}z Yd:zAzI䬡2v)\~=nt85gKO0Y)s_}T!%9X9ɬ  P8>!KM'7RǕft$.NdA 쮡8H_pF0n/?WH;KV3c@GكU["%qZYQmO6̻<P 525© {))ihca5? q -+Oweާ .d3#[KU <%Rc#t4& Udy+ x.rToEav߬F)9:-F9\"ˆgbP0ŨQ,+LًuTq5Ǥ9 ʘ+Ғ;dTنDBҧ^KW")n7N"ql]ހVQVW7`2S7uT17,1Hĸl'2ю@!-!׊|I/}D-6Фou5s!nWAs+f b8L] ɞ P1\N0e8,MZ#y@`)d'{,|z9.Q[O}tna!dh'h;9W fd$]$A&Ի1Sj]8Z!`@=?1ztzlr@7C uϡ;YqǩՍ@I(`Ϙ,4yf< w! $-U  TlL{گ7xSd͡uٯkO+BaefıPýΎ:qŦEj;Z4WCHK|kO@4!Kjbnܨxg νk=m8аeAɲY~"t#`|3Uh}S<74 z)"&JgiM'd_oC@ k+)ۄ/M ~=X "C@3rUHD땨!}ӟ2ru _h|Hv@F^@e"Z1~NW` ^e yR,3S(~[+)tpa$em3" r|ld 67n{YnD Yݗ;qbxBCalu.Iw}=QZv%g*tKBUoctY[2MJhf1i7%|h|`^6ǥcCb//QfZb430G`R@2Y-R7f -oq_2a̞_WPw[-3Jܗc{ fа\*M$tf7]qRNk|a$y]k5>U+[#QnI׿;AF'ؑʎ䯊E Oxq7d0B6Ŭ2,oK) iSͨmʥ=Q?ɫ&p3wYORz3I_$D*7z!yMtPJZVEj؇}=cuG&kcVEe~)nh)u ;D,=>>Y$IGTIű`oAu2,ex$2COOid5,޹OE1u'qo'ahcKI{LƞP T\Ć&bJN7ʺ6}QQhQ0} Nܗ9WRqkn'Gw|'V[A.BQ͋ )g`KF%Pp-h9K EH8d_zEnC\]="LAHp!iۨ1b'aS@x$iWsGZVij=XGvt{Ie3Hi` ȩG $Fh2[yȐfImc ֱe=nx^f NAskLоT:Ou=U w{KM#{EqwRY>&eɠAγ 8Jm Щmq\cztдea}<QD]]gnL]y_b1V3J$~7X!] 7Dms~ 鑢 nO?YOFv,Vp5ӢH^ĚУam.vἬW'KKwJ{Vt ˚+Xu?5nM(2VܴåRt/}#Vrfg=vx߆<5t驍duS ql1\~ =I{Nf";>)`Qxy8(b ֿ'ٜk)sM,ࢳ$rvvxA0Xw6NJ^!;;u7dO1,_p [>NB ܋7uֶ}btT My}U/TbCSYKv- }I 77P=c\9.A<1L潴ɀ9`)xrhGSx0t|&Yy0|_8\qKTxV>j$hg|jfpc46Dž~(v uGEO9up1V0]~xεs 3 :9h/-=l.*\F֨zYk(cbeGCr>xQ#};HlA3u5l{X[ d2C2djzΫ!'\= i$ktFvgp樑}hl"w,h7&q WogV$xlrX+*6^`xJGm 79vM%ZA؉q1cPŒw㴬ym}  {pJ8:NHkG7aSt{f`ÿ' >bAˎ$R$c#ֲ4*e;͸Eˍ)kW˚D B!$ - .v=> #'hÐ@=ڤsn= 07NL!?fFYa%*j&nk&IpXzAC4xDHk1~ " ^8/ß`:Wh-I`#N)> ~0zH&idQ 7ܕEWI id:`L=p?B,q;ucb(|?⸡\R 8\oA¯{Yhnȑ`淯Q7(A,g Qy/b5 O'PŀucAɵ 1v+LRE c_  y3IsI,K'GyYq>L f2pۙRg3@du X]b3\OplR[yhLuե`QrjnYm;FρSaE-~<z  @&/]>%s!b09K>YQQhԐ^DkVy+ pDrQ7SŴчW IJH#itFxGsNI|d;];'m <L@OzB:E"G_HWϗv$57J4(䴤Qp{ab)v UA .Wӂ4 TNLyUtƪc҇[N1kXϠNB7{'$B|0 7Q nS(-q]/,QoZ0Wf/I8=~rBs"s2 UҏkxdV!w _KiU܄Z}HIKp:L -mfzr/KrGzt*x&bgJ Aw&9q`dVst|wS!{L^XEVcY|?QS˷x&>(dѮwЮu>aͤǷ?͔Bl/cp /RO#q+>g@@Xp2՝+ .J 9?E#Uk?ٱ֒ta<zuEkV>}֯B_+RvD0NN] ٫> %ݍ\0a<1Pv$TdxK?`(7R%uFΉGd k:$'`94bmaC[z7b0) A6)y)1}Y>7U1j-a&N6k w;NU;7}/߃ô{&! UDC-$pgBE"㛋=x¼[7E]Q)y&+F~鏓.D3(ݨ=0>4)re WlIՖ31OxOrQ*_r?SݵkS<?D_Pڒ'~.E$eK]~̼6C˚O"Y#V@rǢWt:V%4:  VsJyyTe"i>:Q3:jVl$C,ہE,.^PγIY&*s1ٛne&8ăi'Wx8e)#؏7)oJFh'4teqvb{r?o/9b'"kQżl-2{%7m6ZQ5wv|M7(cuA:ml4h ktt~c#aӠJh/穹bu֢U)DdL.P+It(~ڛ,Ä#eZrL πjB|3gU#g^ՎpdXx'Y8ڀSsJ>xS ;SޯQ/)zAM#rKn[{Dh? vE}`J^Q9_Hq7 o[[Kc OK34nǪUf[~`9S EQŠ}Lzmnv.$-T S "2/f?PujzSaԸʒ!rW-.Uu6פ7:DY!_-Gx_B05{6gzu(J5f'v/{PehPQ_ƍا qSY4 3{?cg ?5{H| -Z,6R]X++cÃxnnܞkPnXbNQ ɚ:s2m01_ϐDewwdo|4yt ?b E3ܵm>|pLȖGT2W`MzJ? p|bيEp'qXlMwl kꟴ6PL1ࢸgbm).6q\Zp` :,l>R϶yo"XVm=db?c5h8|NiX%慹[>CsF Z})㽧*Dk}|pN`lP "9:yAWa5}6N 1CRfָ1B71e#5oѡ{~{ƴ`LD/`C(eW)c#7X7;{boACK J—TDUV2T iLe]rc}MIt/F1OJkGPxu@oЖ:* 1lY@8lv"[/f;FZGclTd¬hΞP3x}ޑJ)lMsZaOJH/ڹ?:I QE|**f.a("2|ݹbK/K+sS
$:rjUym~k]n%%Iq4IUܖShiC~^FrK` {mxkVnH#A]WG]  D5 \n5IM5 ~X#0B|\T_v: \}ahL}fc(*ǬCFDJW4FMO S^;?0醂{JQgQ7r'ynԲP pPy?d"g2>ؚE"u%f#D0jEF̃PZQVdM W&JCj&YY1SX0Ac_dԵ6D,IND֋̰YiDY#r[>s Gm?ReU굌z̊̕zKz B\!(a^ZvLlȢ^]9Cf#h7 `tՑB~ aӲc0BlG=nDl/Fڈ}>Nj3b:t|(*o%Ps7= B0Sn ӰȤB#xƾ8qZN{3TxV⾗ 2$Vdn6AtuX)`9qwOE0 궾-#bYF[XηA#]G1eU[X{T{nzc`S-BxtNE.oaO-%XjȷҴ.fAngNZtGG|77nr#\ "B"&3t2:tԪ ́w'E~SdO4fT ;5n ;}B9|R{~B]ܳhqiOl 6hT&(i"wֹc񌒅CZ\v]7"8(@V9V>ўo2ޏS!ڣkuH+rʠ_Gnҩѝ /s]`[a1]'1N!pJҟՈwq?;^_xvJ:?G 8]L-!m:\lJşVR@vk'bAGh>&l$y =hyl=^{U2@`=kGd`_JZN;ƙEmByC]: /E뷁8zWi@Vv3@~d S={)6M *6Aӧ/n^q0)2H'v!+lfdz,0T@N3Bpʝv@X~ {Ώ˴}y_ QŪn/jE-$-7iHOW׸O>#䙚-ZtE_Yn VOwLkߋU^@~yCqSL{Z880`}X|2+a^ZY7J:;$^ 12V2FtX 4 +$= #i.TѫvWT3AN۳_ͪҫOt ֥b,!*䃴<ԻL1垓?\Dw|+tlS// 2@HʜoGLx2|+bȾ #o*STyQծ-i7{#{7j3 {d6ѿχB>.rYB 1.& Dm퇴g/n?k.1[/H7tiԡNl@ kєϯC)GOdvw@Yz3G*hiAOhUdc07; h%S2|^uzgk5lfqd>ФɳS#N-j3^0 ͐eRߛAt505_>n^6䖢uHf F%Z0ȴ ߑPE)uD!=`wyxwPudQ066JCrYPϹ*>,F8OPejB,Fz=yD]lcO4dxS?U!Lb0ڷ1Jb3\L 6Z> )-lt^twSU|yE JO#D߹R6hl4peRn$$ VuuHjH z}dn"W {2% 3vyh. zoT?qP_!uY`)_P+^-VqPxc>]#n1q'ol{sDGp.[@ 3pK1$>?q%҃мX9BҒ84⽋Ӧ%44\aU4:OL>W Ӹ}si-5:̧m!:_3im;|.[\E=k~F_n32J).JmD.8B#*1sTVS 2ջA̽޽*X$8ܘRI/XUR*FVtHh#\S)}]NyA?'otRXLc 2&S€ի}Pn uUlPyIP^rkMQ2"[ {2+9oVdn0uѝmK1UX(Hvѱ\֊.Vћ87+;kH7Z127@8Xd2b,#*Q4o{/knN%zڗ!U;h aHU_^ͤ|ηtzkha7 MtDgfM|)Ĝh&l7J&!3 ~HpoThɑ>vRݯǼYE흷zl1P dv& VKY i]jyC1ƿdym[F"ށu0t_O wafH~W!ņ3ZR}z6"߀:9S/| v<ه$0UBy'bD4a?>k3mciK0sU"9+vן͖>>z"ZT7!,l}cP}l}oг&4ֲn< +Jl }) NxÙ}Em0j\j%П NK뙱v$VdOrՆf)xJug0.VyQS~b ivV95oe-? x 5m6{>kdZwH w=.?e;Umz"6ܺe 1UJvM6/˅4'A85z2Lf37Ǵ)2~a9Qog7,kUWGF?o~@kĪ@K q:|5 `]pIiΘh{ ߙQk@ߩNT,`6M~ Kc:oHX? 0::d*k9/GzD_Y0zf|iQ{ nmto>نEiBpV;x [*WIyW[Ԋ˷|_kQYA:C[g8D+CM]=i [HB0%b١`6S,Jet-' ѳ.G I0ª|9ʾ+9/bs@t2 Lg[niL5llKO٥tpw{?du?\-UϾ)OC=<3g*{"5:QY{{IN=u+􅼫?F(/tCy{X|89سDgֻfu)Β&>f6]?r{kVצ )@ CKf=Vٸ"?oI`~8|<.h_;t;^Zbʿ;{TP#(UW=1&Eҳ `w);N X%}%qa&tyTfo C/h!;i/ T m"6,2u2"LA0IQqUQTn+*.N!ĦHJQ @#.Awt^ #P"V,ǟ'JҌjN?7a4|{5c PeZմ9A@7ѨӍ |zT%h>M?ltͥ%_Skz``w&֥C@#Y#awj4=cɰdQ]n/;fVXxۚo֥ǰ8YgR!_6}" qCr0`\ [B:͡1Gb>]':m=n_rd+}CWi4i&:0M4 ,2yegCCؗSд7քUV8IqRR϶";OB"n(W^A3;߸U%{Dn1/{N752yMH~/;9[. +;nV.hv[] wHPZ6Celd0;slÀZXrӍ%*NM?7X痿MmM iGWҎr7ҭ-O Ǽpw<մ̷Zzi$)ӧMKE7ZqvpҾEK0("#~u+OdD Ө<}4XB Zqt$&7LX-w `'fyM- 6_\­Y6,(1.b\\ s7Gzmrϟ" QܠbQM{JEHJojP {޴,deIXS<>0Ϙ _k|1Ԧv Z|W&6Ȥ[|`kϷ"1ߓm/}%%9ҺYίzE"Bd}ƹ%l&w07Md^6C,SaHެ.k8jǎD)RR9ط8)5 'Y)98@S<F#Rϔ.T; \P:jƫ֩ ŝc,1.Wp|" ՆRjSFb'U )YiU(P ]"޺~th>݈CQ1rFJ7H.60;7vi>/m+VEѓ$XK'7WB|Ԃm'$G!ƕPÜH÷.mcV"I\.8nӥp{'ny/6ӭ\zft3ϼ3*os6*KB>d SҞRlqx]A:5/DM,c,>9Y15yE6E_zM(?su=~< GzRݽ h>L@f|yuʞtmqf^ڠERyqyzny9h0vөt*&՜HapMjwn 4xc| Atƒ 3 X,o̝ S0ꛗä[deCu:Q~{6k$ A|:G^+l.."[ō&EDUM5->抚>v1Z(;P~e\V/v `3x^`v1/37*p U%$ .oǯ 3hs%²;=x7J #SA'Ԑ,14`? ;.繭<:-p 3@qeLΧ|Ey] Wv >2$vb@Yf=Pm6aRpr]ç&LBNC <*J*D6 '?af8{. ?Qj "!P,ZWNp% -;V/`5^, cھs/^}%5b$̼gmUh)9Ѩ RjT[@J@)#eQ{4M-|"N+( 76Gɖg#Y!+&UfjHRGfj34>Pԑg`nuv£ת ZOggzSJE.%AJ~QH^ucG{UYsuh i?{P7jVr'<6w|y5rHi%ϴ(Hـ&n%FZ8#r6[ŸDi9D7?,թyfGBhE`|Z[W&lFŧ{c|K<'ź5 =R8{:%E ~BGg{,bY8͐X@Ѣj8L~oyTHZH:RWɚNcz`2>Q,"OË=~+ 3yN + `ts^Qu:ǕxK h Z- LVQ_ HSg[&myM`u1,(af)!0BbM[ ɯge0?7I;mt-*"Hff@vd"[;Qp3)9ےJtj_uU>YFw+9H;{@&5=k{ C4’i&cv/WT4'fW8N ߣԨ r@po"7:sr,P;lsMM*}Ok)q;o<%@ :!as2:zkd@JIwFPpjnt4/txv#RI`Jh -d^x購MJc6$~ -0LNSq̃i01?\ =c.n&5#KK;KU)]IjQn`7tnGhI̖N_i#G9 Q .! 0I[P*"i7݄xvB|3_$BS FQz tX|Z|3x!p@K2 H<1Kf8Kk0@F,70;`T|jΆ0D>v^xw"@q$`%HFe~ 1PM\A(]".3W/x'`=C> dK(@HC!Xa ĪGsUpl:r*{ڻ(Q/X.0*4H @5'9̗pZVof 0ō0:v*TVObLt3{u"sOt#;q?vδ U=aC V ~雸u|h帾T)!"u4wۈ0~D$&"$LpCܗ$BީۆZ[׿a(%U0BۤR6u^XYfjot_Y]̶'YԞֺq̱%;JuX>@k'xRr$}fP@㚛XӦ:a AQ}ԱW"Zoۈ_:+wMMtE C>-`<5 s'o ޠY&p}6m<5טzY-z@Y*eKkO6~U1 M& d8l;Tޏ<[*XClSle5 :\Ⴎm:D _M҃gH2:xjSbk}R1yoު+ N$@ H7 {mean.Dl"e N#J|G=pҕ̷l.zk 0 SCslEPtiJ"GQK"pɭ ztN u!)ԪUu4 (fGbN(:EXU]&3<+%z [AГ:bS7g&M W?`=e4 +;)eYLǷi?,֫B_:L=薉ەaKlۛ %'lOɓ.ElaKkrޚ -)z0%fM7eȧp(/N[z9# P?="!\t6A'l_ Quw'a~ *k ZtA2\) D`l2}6΅D(U@;c]/:p\YV0cXܠꅶ|VTk_65離 6!A\/=a~CiY㳹[ߜd$ķ3l^Bp;1C0c1&G,BpNRN{(­F~}>wa9BmY 犯MfZEYb]xO:풮:͙9oi⺁=>h3UToLԸ~V?W 2~tZd%~J S Aat̵GǤ,˒5H*y'nn"un$x;^wH-<{z ~,|V'mDL$Wil#ql5`|ncDZc{Y0٨&y)Ӛ jzZU<G!zPȹ*$EG%\0cRFQ)XdgG 7Qf|Tw* ۰R!5呥%O+?=՛ \'$s/<تϻn$89+0lEGL~9orұxTDLv<4*۩Z ()QXׄ 3gߎYuBǩbvOPEE_& 'CfKޙ |W{u+0\[z *d&Ka`PMA,+ }xƔb6o Q;bZ^Ew1d⏖C:/y: E6տ`r+=B^T>F刂 P^TҲML >6!^ZyK!:괁HmWTV:wq)W?o^HILxYBDo(gҌFjEvRslcRՁ%;N:jA&zpo[C],$2n._):tbpȧce ?a,Fc6`L.{e4RHM?> R59Ȩh`Yf󰘷y~Ғmh ,}&9z: *X=86 eLvjyq~Jmg|{%0%U R+*Xɤ'ӏ0=#iN6֩fE&YY%kxV$-jX Ui\IpޢXh F&y z'wn^ۖ(ԈXCqȆ!kLc݇~Bk2EA鎅-uƨ4fH =c8m xy73q;T~@Lx3RD0@+`D E/9'/9ID4x_} A]#$$Ϙ=!3=0F%` ƖŬEIVNf i%;ٯDTlUSѲ:;x%nkk2@ Ylc^Q`W#޷X|PYM3e3aUy 9ĞqKl:-I3yCS>Ig5vls?/CQ \<6J~,۲M6wRWJ27ɍU=8YUp-_yR*S8wMҊ|.71÷)5YH"NEWv{$ % M$j }o_O UpԾ@l|izq?~&!uCy&xtk' w i: ׈*̥`oUGy:p&09zj^azƈZ1PlqQ5W;Z⋈4%a6R i..k4s^W>0[G] DL7aV4{i!\ݙ VPY"S,l(}?DZ+RF)~Ρrs56 ns렮@êd_5Gl@9\AU85=Ƙ;[D:*#=,TiגH_$Ӟ:{.0@25övH ևK=BɿcwP jfIyji9n"9Շְ,~O[|R5_檡 I-vM=EXj)izuB@Wؐ%E]D3~4̰֋dع=" YsN!ۣ7:-?= v5qduj6┱W♾)ZC܂lD?5ȧ&kA ú $$nC2|ҵT%qM؊ !%YUF4L;-px) Хxk,H Oaz87k+}sʾ\ÚC qhLOT~9gv[?do˶SC+7JI/6&QEUczpm}J"h,c#u V A"Ņ-?G8GqC:^ŹaH{fEk=\>/Yy%hEdl |0[Pc(CZ}bycq!?'̴j, 2 fEpIδ@ W}OtsNy~u4X,3#aI'4G;bd]-mWґгߎu2 .۰x`ҙ2O4¶P,D# S~څI3 )FӓBxFn7-O(ۀ?G{4'U3۶}- M|Pk6~ye9U@P7XS%AR4= )h'y 8O<녻1&`Wsa@ǨIV*!i7צii gB3J8ƅٹi8k,@j IRd7edJg!qn?2%@igN5e[xAo1#;.LN +x$VŠ,uGwRCV^g/ն~qy6|{q6Rf-!Eӭtˌ%J +GiJѾ +:, Θis^{CtDG 攐CM1K/`:Gnmy1Z2n锈[$}V?=Jb邏Z*Unߞ "CI.6jXqxI*btN%+=QCߗOF̀^@,ܑ~[ C(wQcHMyrX'C[#'UR fپPXxP gq6Qx AF7vxBOy#nК.9 15(*\bLe+ RGwnTq!QTU(湟QƤ&hqlLlp (E>"=f7Dc8Lϕ*&WsFNu\|hvIjfܲ6eU[|͡f@h&&nUE?qo,R?GR =AHb‘0SQB0K[(YP7z,73(64"s/ZJ9NEßcm ;֪9pJyQSu~eоn`נ ސ Ƈ0_wV7b68F/)")}O\9_F:m81BZ @\ifY`UxWg)nw ^ܙzteT8! s;0qBHg&UUַ_FSBOo*R< 56F87<K1XY-yk$l&M2X<=B'@tI+tN^"1BUP9;!w bP t6rkV/͞6#u{q@y./*J<&$!Ĺateכtn˱92:0B.I v rcޤ&~ĿbMxmHnߠ;."RIܡm"OC$J ҏj=76M|Ȋu(@rػ*T3b&}kaި@D7al" aĦZAy޳4w$<;05ƍC1 2!H1}?@oZ%3kdAe~%Q6TMOv>%̨LvͿsiZo8N^ծJA7eS?6R3HE(=w=/u`HH[28GjbXh\G uCC-+]Ts݂HْNٳG))5=\ethias̩_V|e\ &]RV1jqj­ҺQ@Q~eǁ1 ΋G?\ӄ|IB{ H eW'~P\|4+4di!(WtI #WwY^{A!46^l! $N+2ȶ3u XB4Iѵz|'H>V+ N_K6ܼT85',~ UҶ=JcDQݣ&1"` a5~x_xaƂR2:*&t1^tWz]=B$^o}Ì;L=I]l5h  m.*z#‹=R8m-,eM+rCgb2 &ěUxپh>}̐?O*:Tyj@t^ SFӱ7iZGZzMUQ}-P5E`>s'`ЍMjyѯ>鼗k@yqmvJ mv:`m 2@t<*kxu96atOw6$v>iDZ$8{>KMJtj^|4LWj!ynonAZsP)kC_i\I8cj՘ XdeLpfwjR^P)"M(IC_VD\V9B]?o&pg^oZb,-k0u/R70C_zeoCiR^Pz<;N6؍KJ^0}oY]BܵɾaW2V7ogSp`#DZ7d&UW,uBk\* ~X`lFD;ľzuVq+^r޾MXuSL >0Ol-&YX<&ZaoJA5i)1^-~ty W0۳uqVI-x^8Z+m~ O,0%x8$H3/abt5sC؜%u$ky;{4>ҹeֽЏ3t[̢EM"0_>97[]^ev΃:*kb?ӝ~wЈ^7H>SnE^+hyҬ&<п<͌ 3%{IWFxNqRbM2Xlg28ǗAx6x#;h7j Zljo^U=! `\!F̯`E'֏)Qsmd;.D\WXq}*2ho⺀Q t|.Kdb̛3\̦5Da`,30081-GL_) wS0._ ه@@`#WtH&9;X'. BM=TD h&cm1VSX=CO ӷ9bOmK,Z:HDB3[K"7͓m<ը uPe6`}rgjI5c^TkޕȌijk寡fAI.|XZC<_^\&zx{w2vUiov]E1 FjMYEE`ag(&*_O"@7xGZ#!fU]W0]qFvKa\V#7Hhtulq%b&UD^GںAH@FL:Ry] IuXVlqTGQURXglہ.sr$b~۾ :I 7<4ɇLxG1y6d!<|{@FYp0ۺ]z'@=B0p^Q9cSB6Yt q*KOnzw0HhM8g 0gr ヨlΉde.R. ]I0Ŗ%+d>U  p@,x[H,9ڭIbi\r=ufj9\IE/d6-:Oky$*piӁC.{?p0A`P 3T%H5> 5t Ibƿ!!LG&]J~R{1_~@J7Af6JTٺ7uv G=yGWæ~>NU30 {/:%i[:(W͆ N`DVwt4޳#L,q8'WT5ɪlfw\ǼH}B[n2OE/fE+H 0]j| /?Cyq8E c[v:e Ο.%uY ټ;3Jf#}[Ցx{?f UJSS$ MuP'm0Qe1^4(,2?e΃ɪf/je=V@Q|P@.F˜epLƧ6~i+2Jգk@̃mt4ca` k+ܼ+n폑!uw4`gϼvΑ#3Rd8YҨdݾ'6r7B)tikxR_Xbԕ9, Tޣ? mAۛw!ܮBrՖXV<:rKJx>l3 :ufPmաGǗT> zX5ȅԖO Y.v>ꬮ.s0~]aEbB$aU//Ii&"^:avl[zHx߫=/F@H,pui*n/YXLn*,Ci:l矒_9đEOs"ssn Xhh1%|+ZMNѮ/=;ԋtHS;r6h&ܻ?@^b%J9m̾m".BT*ECΰi񋈪#9ڤy[C%UUZvf_+E]N2Q(nhEw>8 9%K64su ^9KERjF5^Iҙ鼕<+?]>M,z?5|w5o]|Β{02":0 ;!6 h7ZCD"<"'ds 3+U+$t/M cy~Ze@!lk-C= ۤeSy\$Y6#I3>bOd2L-^ {hEA&KPaڋoX_fJ $_ـiDp"yw=ɉ%L*%h}\YutCYi\(mqCw8fqB.##`KbUir9Sӵdr^]q=:6EkQ3 }[v3 2vX H<@}.׭ X_|]7K`'*Hdq~d C{Jzc@_(oT\\ r |쇰\q<̪X>Hq84,jp+aFerޥ8bt%oƒ.Ø?[N3y&d%} ΀Y.^$ɻځ RXqNZM7,ܡ%5t@?\bOܵdDC?5xe"$)e5e+,$Fs6"}\@zEF.`67 k}u`'1 XK7 ;0!?z: B&ox^d|rTuV~Aٳ 륧NY$dL{=^FŧlذL&WP{6F{ho6'l^%G>ˠtW h|1 g2YB!UbɩwWU9ֽ8$mmk7yI}AI5hv,n1S‘d.y᪎Wz{~A,2v\W4I VxEay{:}+<&O'+j.-Nm՗-xɮM5G [/Ԯ,ilpԄ}ƢOm^Q{gKqPVCNqfAh$4!2; k`RK_9F:J& |nK_#UTN)ݟX2J_KSl5(iVaQҨ7.@1/ $\M݂A_4j`%dlo[Nņ3GG♚ֵx%cPs_ cP\ 6S}cg#oL( .JNeg9ѕSw1 } cuZNF -{!> ߻ άb ?9x!`ShM3Yg TuV1C7EYh|> sl~Z%HT>r w]OM7ׄ<Dq{7ԣǻwjJ%pOuB:?3HWxDz?*!-n;\XF/y@Z[4!'v{˚^:ol5%QiQd2i_TXA:AJ|b:2"wbW#oRfTѵe*JybOB L=|hs##ȎzyML|Şr\1G5~wgN:`b3'gۛ W!4؂U*ót׍FU3=DEm"x4 iH-iOH9;"`;pΣb)$a1t5sm|΂^Mkc"2+17 -k I΢w ,nS$~1GGwVZo:c+1|3ӊtO׊,v"f+V ֠ DKmӌ<''=Lj0bP'"q,\[;ߩf&Iv?ЭG&&"sdA1[ YΕ{4Ճ2U PqyH[2RZŌ?YhxCp%~(Hj)])8XBܟhaqb -8n/QPQ}M[ /H ˢ$hث#8FF".x[Z ̶!}]걹  U"rXejB}nGRR0{ T!ɕdoe rة w^z6sGPiSՁtVdr+/-RXR{jaJ)|_ ui|F=@wol,'+aI|x;ٚ g݊ PUK2E+YmR!6YR3hpaB: 5E-lsxh?AUr`ZT%Jo&N)Sh#D{DpƢ2q> 9Mjxp}l.f:_%bSrU_Vn[-=Rb{f+8ըu?#0Ҿ'y)Kغ݉ݮz -'jOF_#;4T8L,_e-<Ї9j%+Cd@Ok*Agۍ*恣ڔny\eO ˟ Lwc| /JϗH7$Җ]})سCI?%/kcÒ M"@,(k_cIvm:6\AKgfIO=~%E-hJ43'Y?tAԛՈឫ`cjX 9#dciW gvAJqWP >9CH&o} /`н2G@1I^Aτ ˦.(!Nb}N͏ 5a,꥖6z-hqy+iz bRC+ o2sd _>hȨ>rĸ)j2z:wg* A(]g7=J@%4yQ-|O7u98U=pۤBO*D}XY3>^.36҃J Jk&4&\֢iv|+}xI20H(mDDG|3-2w{gUWh툮`X_,0+nrɷADgf2 w_ƕr;e7gWZ.$t 7خZɿ6hɏ1vvd%}O`5g&Dȩy&^%>sT~&c1zTkلNXhYQ$2qh-YUmp' [GTGV،&A$w 0%DBD>jk7֖YZ5O`oDj|鿱𲢟ň4K?*ou?xpזb<:2j U/я?Br }; ^=q]t~:D`b>=7fC~]!] 6&,-yҗ <Ө@k5ƧW޼l]{b>u:6 zu%$J-Ձ+/LzIA-6{xg=$DIqqlk EL3%֖DT/綞@D✢=?;2&*U ւ`1>8PRJ%)]R`=2$\#L ڨy\]ZW( Vz%mUL` vOiHe_[] -sJD[e~܃;ۯN;C)eb¡}QWY/EeW2I8CԎ$fɬKX(z|XKF+j|CsZ *1Cn\2m3򑑪+Jpd> 09 X1(p|y/DNP'j.kw['@3H~Q ^=FKUgHzzSw)JpybN7;7+#U"U(EѨf|QkBp׆k^ "!+< QJcD|>6GU)3 xr~"ދoNXQq~!*-}Ujxt'.^LegP(Qe=ʉл>n7"Ҽ^Á 𽊄 j|6H?}\o R=)*o|y.jLVIm"}tS^ ZEP€n?M ΰ-Lvmye^̋ _G/ v@:*夰/zgkW|vETEa37r-qw;lLӿNN:u=Gf. j4,@&)=Qj& U^ial caΈ*©ӏD~0]n}!w@򮆜P>ռ2ʢ6xjO\|Ӯm{.Xk4 !<;4@2ˋWso:o%#UGb^o0<&/'[64- hդw~hZx>ϒv+d%U/q&| viLtӰъ|gUpS} aE.H;y7z F),|}RwKR~XU1R6˺yr6e΃B-K0F9%.q2ح>*A^\xT{Pe2q=I7;w$Ov܂MZIԤO]_9J}ED_RIEk΃0-Q;4-.z_K(jJV$U]cD56=\bRw8V)~ iAuF`yF'P{KIoՄ5\k$POIDeGg( Gzȅ~ֲV f>hp"Pmǽ$O괴ι$-2-:&Accznr96Fj53bS'{kdT %o]l,IrInsboNᱫ]?J.- !;}&``)5R>1xos6&(FL.x2Chm祿(0VM1 eNrg ́"ZɾTQ؉pn_2aGrnIrk ψ.ڒ RD*ILD3~C1h/ĸqT(7ཁA,?S# )L;{!VwnҚjSǜn̸~Vc&"wn7#[P-+;̶v0}H}'N}:zƳsFrBfI3Ɏ@D̅wb1+5:2FSA~r5ǒ'{GtoB(2 ^ 5V(s5M/Ɵ*cCM%4#s. {O`r֪MXCE;dAcUC.mL "Xm6'Ar}5 yL.V, t!8nT{lT}9A0V'%\ S܃W3mb:gBOB7u 5e|Eh'lZꟄC_hx?3.yM,7*뉇  *% Q0HL}h9y#~ ,{eu%hM-*sDNaF|n%#qMP\bt 5)oh(112]6Cd.pzjNaSTjM,D4à'*qe\`e70ʸ, Nb҈µnZu+{]uu#\b ̕#$.HCi2pF锞-88WH8"Zb(uAܭ:ù5Zh7$uaDfإT)f(bvrIQ 8`7̇O?d8[lr~?m.}&wqF[ǯ+AQdgd蕐 h|ij׊1hLl^zf~>u^[q1 s4؂5E:ޛ\sW& 8.ݰlڗ,y Q(2]1g uwO>֘*;m]OTN>0[}v5gVU{ w+,tQ_cʂiA`qJ 0L 'D@#T+b/,[9V2]YB;M '>< =)k(y$qը ;3Z$ }M)^8u`T9T4tdfN4X<%,MˑhƷ>gt 9&y!/>Ke=+UF#Qfs ?HSZ[LaQ E {_ꔼj|toˋs8)Shy+#>)Zs[?#%:wH<p}00̀mPWF|K` :/?zH>ǎ fE?/9 G>U +K䁁]ғŝ'W]KZeػ={7)+mi$J@L,o16-ƂzW3?cYsT x :^&om0sXxJtF&cYN3~E[(Gǟ -(JCJe\p[p.Ku fqMXoZ)j4d0E.߯m*Z+@9SsW:_K(_v;X {TTMa K< _:nu0Չ@=є,nG:%^qX%gнyIHQo*ۧ| +aΆ *\$YO= i^,Ut\[bE ɳVȑ-M|_"X]&%S\srI̽`5T0<+sAs<κTVk! 1@-,D}T$ؼ8V3=owk "c״TN|RX쁇.Eh4B!Ո {L{fLƅQ{3 v*eƙ g.I\[_az .>M$}L1<QkVP_v$"k B€0,5LZυ`?9ʹ3zyZUND[.pJ@MV8Ri+$OxW6 VhYs6D@mo"tF8',v#5bAgֈ"OIF)1 c!?^GB!?hn|#23.}Hrrc8žare&ql,[Y1s!mGMBL3mMYl!XSKmsW-C+PjA'(_a^sjּǁOM< ._* HCtGHB-l5äbgeBj4ud?s _(y)a6N%iBU&8|5:vK/:JobA~<,sYK{߹_L`R,)'Qa87%! rV}2e żXG\<,\;32)9\ǃ0CjErȇ M73}.]e>Q$R爮r]C9t2uܿȣyK#_̠PF7 O "1m4-b`#)1PZ D*&槝3|8 &?_8{pGaU.y/5Ն/Bq c"D(ty+9!`•GkAX$ɒා iq=`/}+qu>C ڲ U Qx7Jm<#'\ H!R$<_:>)zU.5/}볏Mu9{9UscAvPV{drFpEzGZU6pG@/ Bx)RzY֢,@ HTp:X\ʩ,4}JpM3flKpT% #}m LLpŮc r,&qZk`P7b&9"DZ (~p{ZǠ1/5_K=Tj&6Xpox/m(_9K뉶u b1nxIUuowN1gׂ :zrvF =~,za^I-G,eTX:vӊcMV!=]xk4,}ZjG]9wk8Cd?*+9{+C'޺X1;=1BV hk(qHN( ^h `᚛+[Լ,FgaW,]̬ӊ۪a64tH`۷AAeԔ^d-uJ6nDY%M ot&Je6X.NDbDr4)6m`q n'%FZU'f'@F|F-0 .]L-tÐ*Ӷ&&⌊˥ÍgP ej}Wݭ̇+H *s)N6ankGSX lrOaul[qo+#)Pal2 C ÷tO@ᴬ%dáE;nGC(`Sc ]fp뾼t䮂om% E%xDx-ND5%;GKDV1ͨf;l&hsWh# )UV*B vn_س|LKbT†mJI7&O#j\ I\W Pv x5m I*ِ&/ *p.):> ףˬE`V.0cjR5OTIz(գ',69iLJjK8ņTx`Jo $3.,H}W+UqDn+ВZ%g-kOAb-S7 !hgۄc(I5I4hqPQQ&\}\mՌ k'!yMA3BR!Zը=2_Bұ׵,Dy%\OO]ZH>饥 COzq5l@gBVx}_6!$6s兺FWFCG)kynw0b{5XoKU_8Vgv B:M'Z/&`ԕanՠsg@SR8S7C)8|hÂ~ɭ^a+˘w.:NqOfӋ][/I*0{G~nA ~9El t4DDp<[)Mzt~2dˁ}ɦ$zVG?&=>ͨӷט,JMoW ,Pdg#b()_G+<&קػarbHc!%/Cuvqy{]O6!nr >%!!3|g!L fDijNj}MK4`Td߾^y;ŝ![xQ!? en.tI'hWMةxkC\9΃gI!G^Rr_lcF|O? t9\ $ 4 ۊhw4qKev`>i L>gWQOОPUTr -{JK'83щtb9?p2-M5flZ|r縻Rv'ߍBON< y%DheuYPu5x~9-.dA\:NgUܧڰpoxyܷ.J߄_U8J /2;"I::gah&|)zk_Uϛ$]:=Rg\j0qRr@//~!o6~s<+$ So7 =/;(@lxd~xwX@_دu!.6RO\gB%ehWPd߳ãָgsW:(G2=7<ꌽ|,T*;Y|iM#@զ,=kUUEtI*PkkɯpYUF>=J*%,A4>ۧ_Z>RpCHxSyȏg0tA5,+m{.*ǤUr~ j@†mBT~l0tnu%۰XS~ut5m' D.}9*!J/{l|f!k].ߵ+P.k7UuuNO|L}<_S(-Mw!__ K|۷ vKw+_!~Bd@k?b:9{/{/6G%qx+Q"=Kv'P,B:F|;Q-']0ԓ}{ZiNHTS / ﳌt~c;HzT+VÚO Z$u_Gm$**r@ ~oS ^i#K=xNJ k QpA99\"E(Օhs5FCO9H0G { #K|?_{ e`?aDeE;1ǖ9o`~!GׅgyN 'ϧ^`}WDhWc D^> #L358acnμt mX;#u|.H޴/ԑ+| ad $,9+P]rÝ ְ 7*:S+i2q8/pTTOo_Fދ, IϻAlk-V $=\$m\XXrZ8exxdlQ,{gZSҋr{Hqa?CgԴB{$ڠ_O9e*FDzr8 DT<"]Ke0^hit8ֶ>yHb LBs ԤybTԯV*1=\EwyL?S ])) ) a篾TTD33To7u c TUjZ:e 3x;?rO]ICZ!kxaCa9ƿ"3Jmg^N?OTQZ4YD)A܁\2z`Mqڷ9z{H8, aijxz:mX@&6E_2 ԗE\~ϼX@cO|*׉&2Xu'4@q)tJ+aqEMfғW ^q;ð:hM0>toU'C{iS|Eqq T 7?h/cn}f\cp$i$ṧuŝM`bh%`/PHj0# μ^R-R޵i]hU5xDŁ{qzyuDȾyr'^ I<0P[<.[ }/Ē_M+B$8b,BЦ6+KNY1{^LlWZѻhdj֤4â!&LW]sv j5ZΩoTKZϒ42M}3Ξ;?ٯ\v2O EW7L>eHeN6WҬ4H1As"iLn|ɢp׻Y ;P:Luʹy&ѐ\Uɹ/0QqͩbX&ERD@> x[*3 +Z=vRvborCǸQw 5k}U|qf$GMh[lA"G1YByE"*0pW'( V wFVyF̜Yq5}ΆnhiM@>%Ӹ~Z5iM=Tt8Ś!bEwToW Ļ0.&H#7Mv °wPr-~آ[ՕC E#E:ŏ۴)U ^8Ӣ_Y:LlM]뛣M i}Tw,I6QU [ 7ܢ='sﭡت/Ylʠ$g&O閫a~m}V-0I_G_ ]nr%]-+-G@W jmݿ| 4Lҙ/ 륶Sq( 'j{m8'"<#n5yaT/K$7'XPSI85_㺕iKqs;Bf^8!|mtbϣL)aQ?3Ʒ@ll| k)u2a;;t86^/q ŏ$ >T)P@.[CM$֐;IkR>>-YQCfW3M_;(`0ހ-0%R#X.-7e+Sxϝ6g~w4 C CQϰ~/~1Un$y8:tD+Ahor0.Ǟs!Pa]4/;::CL&l  |Zj2lyBY3sDXiҍ}LSMfOfխpL8œ,*bac_WKr:c+iX;˨]*Mշ^tl _32C-/;vP}ΞKЇ%@).yR4oYb{ Xil:8sòȊml+zpJ=å'1ӥI%?8 83{UR|3Gf FY}սP\2 fQ[Q` L3$dVt)qwpG}XGM9fJ:s Rs;SY7{K;UR?k,,(m};79sbC/i`Z[]$IC $>)7m U&f0uJ'sm*6U4oxodzC6W*Ng M/[K%Q .jG '_BW m7\_"5D2pÔV=N8=h \Ȋ^{'}4N'$k Siѷ;im^D?e|R7$1+7®jAfE)T#1IL/ 9ܼ2NnIM 9TFbCNi9į"LD`kIQ^Mn|o#Hgg(^4-|cMH"'-^Fٺt.?僚TMV= &3|wKdA4+$| GǗ {f&i8o cJNWɿ[HbR|Ӓ- PO5SF&G W"oXȦ.k tdk~"l'?@JZ]Psg^]v<|5y4{z%قDK$/ԊcRBu~Knt%4=´JLc'ifyT:+;Q;'}( CxfP],8^+ a8g(T L_ڟ蜓j&`g[V0|rvJQ)A3E->%s`]/,Xˆ2^wlۮm9>4vHMA#J¡KʞWg4%AwpոE}{jldd|qکu :NZ>C0|u5Ejbik_r{_BX|.J$ju0u46e~a;0G*ͺ'0S=Tx! Hᅲ7sN/f-rak + eo* =ɟB~#==h{Ү.1ʐMkS"3zQ\';q[㐆oJ"=kG_G_P涿7d*Fղ5l>wXGۦr1/wW֟|*(Ii- qC_{o |eod&MT.Y#}v%>kk8?u-/G.K2w`-SWRZ *"]2!>J?SglOn֡R=l!e+n]D΂;p|NRd9]])7<k!XP8Py_<vBVտ0Tyr>R\H*/fl ^8,+1 sR_ϋ h>e/AT5&&4Ѕ>U:]@Z}?%נYֿ(Y.F:$X49s4,![½XO{p6&54y qLhޓఊ(^5UA:NE]ʀO)e.6\,na%̸l'eՕNWސ_ >V{KX'$=q>Y_۽" t`ހ,F(RC˃\w!-Gթg[僟_^6=i?zߝ 9pV 9a MBtEWߪ$"*-,bjEδ#0jM[u8)-=OzI `(q.h8$u]#&@P+{ s ˃ARfgeWLPY3~oݭ E)0_ ȏC{zF.ca.N <0,K\vJ<Ƃ_*\l‚@hK^[3g9l@-Xҏ[;n>&LWCSz_lbE»%,CRN ц cZS%CTQKv|y6'ng- 21hlr-*+X7n8/Z붽GP ~8,~`I7e"/am`M\ G 3emgte?_m4(o?J,+plz 6w},D]*V ĽրhK,#YVbf@$MYR(5e`H՜#Րu`'zSmY*w (1NΕ[rPpUdeʅև.ft)z%SƲZ{>Ep:lHP;K ]Щ*"vezyK #&69;JS:XŸ9q"Z@KZ#; ta^J]c^ϑhU08F>+IXE $|0N{-B%q7ΈөM.x9Q0G.x/Y^i 8> $m9 >DCR-z uzWƔ;ogG;_w聀m9XBwuߏ]\|0&ӑXg`W?b Z:[e g|uœIfld#H?g#.G1ZgGX nܢ #$dvR}K8n4@$3<5)ywiVCAI'D B-Rr2q;$kHӬ]6QWl[{D\m1giؘŦh<⍲Rg\̡҅ ӪiJC𻾎7/ l(7OD>QbnZU)Hvn:~c`"!ℴjNK5-:{M2vBa-dɥRGp2 WPwA:iNWvFB2Ã:(E; UH Ō,Pzl]|J}`AX&-ʧQMۢ=pbA}Qĥ-{S_v&qtjר]܉~yui@2yVI9'CMg>,"iHS+uNY"Pl;h(F5zٿa,#~ +G]!Pinضݗ^fGb{:a%nb;Wr  C d g}-PF#d#blmp8]u/~:lmʙ~erΕPDZUtVE<ϐ~]WptYUQ{p YٟX͞X>>'lQrpЙH7ҔtWLTt$|Fho4枸Qm.b\}NėV*+rH1А+/,13"&c;Ab-EVrذx9m7 G[P鞣\T:T#s|sN 5Ii>nM 7ǶJ+ViC|(w\;%Ve129橻W0Nbk77DK&z57,[Hё%s~I?Fx O^#MɾCsfkm_!v̮ 㧅Wm`ɀ2.~̉M>֩l%x"­[^Yn/,Qʒ:*Vqq,{ ԯ`\1!R:/1Befsϐi1?uߚ곍錠--1YJ"wMG/mz#*L SQ^p"nx aD)nIg#,X Sj=DŽkNlT 4|5^ojzS4) ]uXG B9p8oKX/.~$L ]2 Zqplef%o ӏ_h>+ )8\2 jÝ6;7[.Y\6xtJ)9缼sbEdl6^(ڿɹ찕턹?hu 84 QGR D*G8Y~3::ԎM^װL=kL aяBlj6^-T䰵(3\Bv II6DE\,7&zƑD< ޚT=؈^> #Ort#k0G R:ew&f7Q8v8yViP-6#L<-]Mm%w+xKj#'<|4uX$oqc1hQ7o1}fL 85 5uʦY|[0 Sa{ǚ\S:7/E4f|#EW6=]{B3Z". 8~6||q* :Hm\m0%wyAhLindQ4vTY#P>*[](q)r sw֎'5|@rb֦Ek"ftmj_'r4l%^ۄ{ڏ D)xt)VY+ 4J_4R5a zM2y!U-PDʃv] tbx` (Yhuf`OiW%ˡr *VwRו̳#1^"T?I#_sJuƌ ?M,%7FECW333"J#g5/8eRC6~5 xF\ ƟC_eR&[ LN.*c>rX O+)F-S>h\ŵ.VR Y"T_>?qWGcA%6a)=s-wSs wQ} ! uDl\j?>lԄ½?w,~Œ}Uc"G|[v"&pCTO;yeM8o =뚈Lm ]AqaD,/WDAXg>O֜Z< 1ngH̠FQˡ]+Mȹ/"J"܅%+WhAzۀJDGw#G[4'}]Xh9E1^3HIPu|{9B?ߊnP" ޅlql^I6>;jLUx8 -qFq`y8L8oAb v_km;]ӿ0>bڡW{OHc(Lޣt0N vC!f\pыˆDʨw7SR{e%14nf})y8!p]$yG ؒ.IŠB8^4͗=Bd Hqd/Y?< ˤcx}X/הaW:ٜ>B#eb|Oee㌬|-G!Y兮ˆh'eґoMljfl * D?֕8 1rЇD `tWc j+8 &˿Eam9&M {zf{ 0?XČ{0&hOXIgm'ȡ =vi0lmY=,XZhl3??'v8؟O-aLMF?6Qq\UbP9t9<56̠c*K c}L6άsrDyR8̷4=x4]xyEirX~* o^Z.^n˪ d5'饍A3ʯ: ؚDa֎bO;b*4h2$0dv 9@H_zmlYIJ%> 0S?W1xlX6v^g}+#(wbň wNE.+!Ӝ. Y{W| L=BLw3{旣 C :B*f7X`g· 8!/O'}9i#JA ۄPiG$VE•9`4d BT%ٶq&ʊYN1@A!YW$8#ϝ4eWȱ| wY"ꎫBP4UxBaJ%ۺ;f#>ٰh4,.vϔLT7!&UI˝^.Xpoqm_ JEB~^xf+@젞't_jA9sxj7MWӹxCIS]mQpwGhqx? m0`>$q~Ifuz )~vtu`$%NϞYz!0k IOލ–z1'0L!#Ic#o %#wN{f}ڙz:7>6%_53[]5 2 <܅{ tK^|)f߿gr` I"LqDzS@9MlE0-R" SjEnZpoJ! kRдJHֱPO֧+?j(紝:gV6Ƕu2|*&f+UOj]-ػȻ>99mL J`e, cH:2cumHg>2ҍi85{9$ [.f ц܋Z0fqi4*u8;wmbƺt@Ty/clVJ; @WDg`Ry\7w$Ꜯ-jG~QQhvDoa5 'R}IrBMD?cJ5mhJǟ{T;am$jR|愴:Io XPFJa}ar}*.0OYaд/ +up7:KbP7g,DH d +!o(RM+2KG^|k*BM.XY몥QzCJlXgSnæLπ0@n6.I^A/>{Hrzq2mh4F=Q2BKqݏvQ,PH"`wjiҧՒ+~hk=ϊ~qetnPFj<16u3[T3|)<{.-@d[|늞y?a7@у/X'$T5p$U`lrT4WH4jl$n=V:ſ/7@ұ MNq_6 [Q 9B5if k-\$OT/FHnp%ե^c}f-ׄbw|G_s0t)ږai)GJȁnJN&HO)/iWΕ,gXl$@b6Ou$8~md02mSpeO;In9zY;9ojon25$QD=Y,o#_P*֡5l9+D "A;B7aez\g,Mmpcl+eؿ2Ky)TIU^h¶M }XL~CfDf5~\Lz*Gfi;U,vN"i:Qړ慛x)j.<ߨWHH'Sd bT-ca09Qnw#S9~۾}Њ2t)}[;XrZ{-h^>$O}9& k#zk˵i~RtG5 }N6#0xmy]R0Z"}7g읻Tq8}> )u!("Of_hd"G]ˉ5!{=?:!)zy_&r 4Rk,2ɆD$5rt*j@OY: `>Vrmc@\L|p}ѻibַlQ -_X2D.G, &48*I,nxwZnG}II1ȏMBVul%Zz^ɫ<E֚-zA"&_`C5)hV? ;TH5}d+;|oV)ٰ8a$mUcĜxW@8N S:߯[}uraş (/M2Nsڕn0a-P HAʁR (3FwWOH|]5ĩh@F ܛ_Æ,qa]z4Q6 ~F0> M*p8-i6OFYbz i3N k;XG2#OhiƽaI~r6*0<6PSf%Jʺ8Hjp'-fOf$b=x].{-mԊ#w$jD}21^8p,F7qȣX\T4Y(S⌦vC uV! RUo}T^?xbحkn`Q9.u H[؍&)K!BzsWR8(UGSjӮQ OD>qºM9<΁L#(DN 0Ye |P$^'pp ޚw:>_=-#wx;k_eaq]G{&6.u#/`qr¤D# _\+ݳh$Zt' Xw0,ctyCxbq8F ؍? `DX\&'ĕ=g"Ia>bζ YCNY~$#a:xBq Fհ !d}VJ'צ1x̌΋P|}1 _CBUp1U]_vÌc"=0`@=wΆ(#xj:t;G'Ԍu}gaL޻ʔ!?9Ȃ4=823Jf:`[':+ύ"E>gUh{$5db|1%!ث>1$#9=2GS唚3&cCBRYYJ~e ЃBKrlVEFbpdi9DwBo6adyXrVi i1_5!KR~A_xW' IWYڏDI3uޟ20qESR;g0;5X#[Sr61E3ܞ(k l3ߦ`*ݯw鴏\Qltcx l Z{. ōgx-%zрsЙ64`#}BjFӂhН3-wTg<= F5R"֗D˅W7{0V `+XTs "< ]$uKnI$׺2yxCZM=gՌ2"WuRzKQB9ؼ[Vk$lvk3% +4(=C(l|+>uscnk 7ds$ n,XH~݉="CnPb֨V{vLۥp%fYg:in}=C"h\ m4dy&z.#Nܾ`v>nˀk\-SV_e-wU2k,/u@/^!!"IY=*9(~$i>z\z!K]?zFXŔGQCàJWWy?\vWfaܠa[x Ћl3"cKOs,岘ZLO?c.N ` $e;7> m&T \XKP\GgH@V+8DxNesSܓ%_v{K ۧȾ*cQ_ͮ.˟Zs{ӟMS =uxJITYXG-8BcWn@K@ZkN{SMYQ1yQ*BWظi}r]EH}Veq'NL3 pFIL^6X/5:ɜYּ4^f[ca7G|0|o;E[o/^/ӟ͉j-  9eMy! <-\0sfEf0^ifL}p32pyr-_'{^xJ.HljUmZJ-uV*4M WV:>U)^:1"ݥ@/!,[EMjo14,d72咦?>Ē%ٲpCֹM4 Ӭi-fDoh1" ysPĿyY\xiݷ+ }gw(STItv1iʈU-P<:"[VTྷ V1B[(\궤GU].q |.C_1H&]p :XXdҀqB "]@j\Dz(ܷ:y]gؤBT+ r ie|^Jv.b{Pu{G} ۣQ|G1gSC嫥L8$ )\ny(]uY)}rZ *ez|u[ @D/gĢhš 0=&+WT~ cb՞Y QUfLI(J1g:d_žIAS ]^d_D6clpO@{7 (bU؎ %x!($_&։o%z7g)*L`C#teAEٳ460jakBYĹ@Q"WkPMOob!Ĉ!C ,IC44ك[ b?)WpjYP$bdeE;>}OLyII.f9 E:jcj@Zjc6j4E~&qU"}ߌU®!l | H qfM*pMXz[e2\M=p„iE{"rF;Qp/;sҜ2)D!c<J!ץjPx3ր*+IwnmH2}tYC-s8E^ƃKH잝˅X1UAژM4d86q'dT2ZZ1,DU"3@jYʶ O7?ԱA] xR _{ga"X-Zv~$S2/?0b݌Ņ HhGJmYkm]|k-b h % l,7D0N9"ט1RڅzB2o/y^jg+r#y:v]YV8gt_QO2we9c$/jM6JQcnDK XAyE͈joÁ8H ]ڬC;CQ7X=ZC\20l3 ԟhU&K$n47ȥ‡pн aABދ\XM@\ kHuJ9؎WjiE- %Ϯn6?`AF&ti7gu E8;1| @ʜٖfMe~gyi1ضieB 4P?gr7⺩> V]?Ƃr慦%`07E 4x ! Ω<&ȝKo*dF18칤8'5"#H F[*? ɏixK!Lcc 3CR1tm 93ԦV(*rV+H)&Inhµ/_ܟFdA-d:flV<{YD)U79ۼ%UKiB|=̮7>巫sj 3V6}^Ö͒Fh't\9͏? _J_-"g%7(~ E*_ftA08i${x,o!&?@ٸȮ­Vkg@-JU*␿SYQ XNKR;QiS-tFn ֦[K#ަSl"0$+zqOCzv]!bX#:VC++&  :MC)`*%*C SܔYI3oĐTTRvNJV_(/h W:{ٺ͇mH[}YD=:n:zuOS/m=ܖa {&(2M<NIbn}r|Y*.P/ohEHui(Ie]1XBCۑ2\4>Y2bc$k{&ʔ"ZNPRځkN:$ orulGB3sIyUk 4[Qٰ A$KSf y}Oan*̰t e pAq?mAQ}0w K*81 7oe[ZHlr˪Q((?*5&KeoӓkZTRq8k[8c],cIhG4%1f[xS.K ps:9@BוG/3py)noש7F$ %e^M{JªE6KԂޮ6k=CK'lK[Ml㼙Pxq,]u#61`!8KXB |7MU5ϼ3+DPmA4T5VߓQ ~¯KdƕmĤvh/§ 8$fo9$ sOfWs߳!KQ,&a T64) ~-p"z,{ZR9_̞+.;tͽ5ۄCV_,rOMFc}y9 ^ɩ)LO`6($Jʥɭu?:(5h5&V Y슀q6C!Y=B 6R.\8peh"ڸfĮe뾄5`s+ 5c ~jj>`ǡי z e mpV<ڮJYG;OLzdmGUpeW vc~OnFipz-: eWQYJ`.'i"^N{ ~Hh:a%>?Rx"_Ȅcg"q;dԛ۾zxxZjӃ7? dԗI֟H_H4?31xxx;ﵚr{clBH5<(6Z<\*H[X}Ss#ytQ|!~Ws{z Bo뽮>s181{YX=$6@yQ _>R}G h K_c40(1]~E]Q@C|Los%.d:45 TCυ燛h,0= \/rΑ:`1vJxp~J ӺE5A`;m#v"Qc0ʪg#HX{<Ү{KJ2W >ՈKT,*UrU~[dM[xB31F%IcTH#!"҄*4 a~3jBuT?2D߫cc&^Q[,v3z VL$( jЬ~.Qd 0dhJ]9d5mfY9r (RӞOv|{Ut|µ6U1IJm^Lx-\=%S{@O#tLv_C-B2J_邌wחRLG9 ]8+b+plrM!8TCG/z$DHP5[W Hm̬d\4aOPp|yU b$ #&HNϖt/g;])0ow~7W]ĸ'zE&K0, c?Ni{:nj諀~/)phAߢ,Wq" iQr>4:PןC+ ,^ƛZ,BoDӈ'06NR? &aW,> ٙ&rUk]f,sX2LW^ID+ pɗ؅Ke)( BKULfЄJE^wė{Gz_\f2FAHdQ9#55y"YHTz賰?Qf\7TPr3XK!i! ЗJ0b[}Qi\zzAK*sѴ~ҕa>i̡*e,[60>ͧfp* ܌eB|k1;]lgd3u3tV']dAB1֑4L35\hl]r fć+~YH[nAO@sֺJf"Pv4J1 H` "۬C@{ lz1{*{7LkD\QlVa 7DN9j,4Ž`y~%d0T\UX ]I>Ҹ}{3QN|~y%8Ox57wy. E;n" h(օWE) <ٛ"$Xd;ۢe±" IL_MW+\P'J"L{1 +lFsNo]@,J"GwJe9rJטKi<קfdPHwnI'!\He @j.YQzʐ5LvYzR&yקo%Ӂ= zFꪱZrtK9|\"kk^K@QC]R8/֏ѺU)x]8ܜ|\`fE ]S&ԿYnfτ&k; lUcEa29+`θ׈&d K7@ ZӈR2k:_+8ZR߅yrlH~+v訥$Ƣ׫Ff=mܐ,ZbJ|==z/ $;yjueGY VHuO BԆv'#B rRtap#؜ӠS%La2$sUKK:4W OswrƘdҗDAm"U MGcS]z^8*2]n ~ѓoQwPvE, z Xl?^e"Jo;e4.006gk( C5&nוYU-{f2qaŨ3z^ѽ|J/:WfI2O,*f+ve\8DI+@y1=`Np. 3S&qd\UO@L]=~>zĤ7% 7/ 'qq֝|q$D*M Nr03EG@ )@GRB!\l';QMqbݦUÇfdxggTwC|\9_}pS:%uodi27 LH) #uV+8a;"C'M7% WO|7} MByAVQMrȋ۫d p?Ba>A960ܙ-'IjF9/1v2>zo{呚 5/Hk̶? SӬh kC 7h䪆a:1T^XGT#DWI[3tø?r4oE]pq"(-~9V{ZuT:B(LMѻم @ph¼\oϗJ/wp 2֢AAn%6ۺ@o!MStjw6{6?+&:t4emTFD/E4~ ^2?JAf&>)7@-0嚢;*OQH[1&]Ͱ q}STzyVqÈ7!^iuP6HO=*љ3vָCqETD h1Q2y<`L׃3/vqi?Fγ^sHq4Is96X5i9fi#Lzι;+48< ǟ"EomHPT'Y[hws(μI]kF@݊9&쭿So͆!0w5PĶ!Z.yqWԛV \Aw`>Y7Ŗ}\*qg/&},yGtE̟jB[|PH"=L %YoQ({"J CQu<&@QuصpDA/S&}|Q=~G4~T|^ATahWC1EQn|c-8vQ(Yl|)-}vf{ IKOٹ\;xVgxU!y<~lWEYBJUko7=.GefzA*F9 CB@- UĒ/q]ٽ?_|1_i'Ѕ܁ƺ+Uŭ8,;IJՁr'¾?H7ag0 ᡴQ ]uʪ(I7f*֐@1EkVZB_'ԝM̽~Z`}z]V&Z 򧶵dM;,2M@I={.:V=H_Y\+i/1ͧc,n;zjOE5~Sd<2D$j&Z`cZ{g%\F6 =A ?Ҷ-- !yuCû^\nЮ^ӇqrY{#dj*QZf3tĕƓ_h46> JAL;I407 NSEO)G`2A,|n1v[t0*`(2ٺp֌لVërb9cƗ2c0{cܢ<v^1"|RbiI|B!FKi|pPG5Sd1R~;Ϭ7T=Ri4 m9]zS>l55NkBPd5}S;ղ(H8/4x=d㵏9Q\@IU^sސ+^H^z  k6npej| ljA3"{5Jne\xk?۲# OsJH/$ ix"Zw@bJ\Wg۷0ͱj{k;;LC{iC[diB>4AWCo[7 cll7=}TYZ5sF`+Y=y"&,moVBQU8خ .,A]X!.f4䀃^X}+t ;u[<"!6YE+[ ٖne8{`t 7dCZjN`?Jyqz $+bdQ^q[N0H]T"^>V,?nun[<7ew8׮җ%@.?zxǹ5d^x Do,$omvA_$ڞk胺#)xpf4+nD\;xQfOʏw`ߞ%#Y)zN83DH*awe!)Hw:k#ȬRiro.:oaFAaҖ >Rzl]H'ow}%R>#ڲ@8L+hB=Ba}D{YuBcA*b[-t oUnRiR?I쒳8zy-nםKOkm`agz#|B4Pϋ i)~0ۻ<v~-g蠼9s(0k\7.84GҢ:b*b,S5uENờx%;$0zn c޷yoԬPDE@I*!'0'I6d0L`~Y<dH5$ R*z@Qd^,+ -tLKawi?a@a{񯃗rgЅ)8wFn]hKiPc"*PP]^],w.W R oV$T+hB0LSO۰uӄ>9$*\2F,ӇʠSm@.fVP`]B -D5%,d ;R(xN yX4Ml cm݌{~>ρȋf56#m@w[o9,5…uUS#76y6?yu#4K`LzN,4&cT)S=bE6c $|ΛX?*ZQkrfo>hF32"hXu^B HX?wgp#MJ- +0=54t!cgɑ Z6~Sw;کE8-8GX[Sc0؇#2'? 0? 2j`eЏ1$'Fsy(T;Kšz?Qw|ň¦`j_hϘdze 6qჲħCg342 N7lfnOkDe̬6R~Cxdrh 9wRs usC4be_8a#Gcܛ t"u.EO֒e[y_TW{tX v|7jWmy8k}>H|:"e !`4 mѸń,k//סIQ?UnН|$Q7ߎ1rK&|\&"ܛB6^*u*TqM)Zz$5gTl❹A!;`‡Uɵxbq(ZȆ bpj,v@BӚ2{)g\z%6VE^̩f 5ʝ.w9j2XϥYc 8M9'6E1Wpe0p+IN1/cZTWv%Ŕ&uD$Ep0 y 1J7'Ls"jZwh?tç+eg0|׈G5ڇcD/'urxA)<)nK0r<ŧTe` JÄх'?;F &rAlyթe(RoS+r/,ļ )3ga )7e+221R*c+-(`G䞹ׇbGr2ledzLRHOCh HBJ8Ҁ\ݧyx_@+ ʃ:!Skfؾ,#m>1Z/Hxl@49bkH-$pnmUxAqn[DkH LX!q[mBg~rG0ksf4A];lcf|[v uۨdˣ_sF'z蟓stL"OY]CڡW&1L(K_q^>fVF@0z(aeƘDlJDx3v:IF4DO=wF//,t~򣝬tg"d3gM]\’"{PԛVouj,J:a"y .8-Fe5/*X!jv,К\>3 4H9$2p;F7[4He9 Ys ,b Z(nj;oo#8̰FnƖf?GMjfJ?ݫQI%7'#TS%-M L칮ZϚ.%9N.SmE3e2錡^IcQm$"<(f$tkq3A1tl U9R9 GS}u>|$E=t?c6MD~Zm^[yirqG̠+}XTju Q=Y*$XߦPn U~M&hgi~/J-خ);ƌI`E#:P2V޾3hdPp X8ϸɗ3-[+~B{4kk3֯}кTU$`2I)zGmz޴-<>hdӐd4l3~4yuUvu60adψ@+V#[d%F0{/B;EmbOVTkA^Oǯ:uA+S{Op6axw}xD%9m|66DX%W\]Q^*i~/.*}n"WYi<dž꾋qYݴOSNm>S Ƭ T' Ѻ"%>mP _)d3Y,; mWh9Yc⣵`HYs ̺jk2$Vrڡ֔uo"iѝ"L Aұ@&FDuͭӈ5Y{ypA jq8 ~F)<PК/MHӀo[0 UDtY khxBjG3;x|Oܕ]ؖYP++#}F$^tldGlܡ޺o\ j cIXWlֱ'X}yd)#ZԌhV.hAƳIr,#z@ض+z9/plga kp1[xB+ d^Aa{JX\Y6m@'f|njMp]@2U"Fh:F"m~Vʑ3CgՓ|G=Sqϡ79XNV3(F4~'[صtE`2^M#`Fh@j2l҄>ti} p~WF\k;wUu܉SBމPjwצ'&&ɍ{x?'q7āKe fpCE)@qnA1'd|pmR#>;`=+xeAQ_OK:#@rh T]N $#q# vr `47{nِNM"%UIQ뵰^;F+ ]RUߊu>r*_lE^&*(RFG`hw`֨5+){NG8hAȫ@Jnj 'qkV܄{IN' }8 IΦb;! Ug!l~2Wv.{V+ae_Qari Ft""LBxS71+!ߊd5~_Aj=Z%s=|2B0E{ss}taapv~ M2A+ 739Q;(Fv="%n`Bb} SXPKOdBFubӠ Cl_ (‸.8G]V Y<cAJoDΐߗ? N][JL 6Ք,0AI*| ~ar_0*9 Wʿ*zԹT^6CSVxBW̄?F=-A:@l F(Y ؖ1 %_Ѫjfs +r .!Tv6&MU3Zȡ/Gq]AךbF}TiyT;MvTH^#|sqYT. ~IzRT J134M?41p>9Oc*zqW_eqjIhe3kݒdIĝ !4qo<`a -wU}MjkM+]żnk^dC+UI\8[< Kw29IjH]ʙ~Gt4PWPLE:P3)Z(%vU"ݽ*=QbcNiaa#qS7۶FHgXd`A/ hbVݺx}R*chErԅQ !5>6f.(܅iɻ)pڎ\P S,n_(и{ޮ$H\Hqj#C:NǁM}_ķ$ !&f?ua_^z*V|847߿Ep(Εs)Q໱]v0>1ZY4>@Lw~nh@;t(}B:-oԆx̡2 !, I̝5Iw3 (uST$0* u@|؛ڬG@q=zщzp=*PI~'v#J@1B^>YJVu]O ?.G ۄE"f~&m Cbt ZZξ-߇0k28N`OzuNQ2 ;%t' 荬!Nw $q>(1n:eL`F"VXwȌ!7ӱ{GȊ4-]2 HJJ=p9]TBQNO<@dtngK]۲jR+6`'c IcȿLw a]K`*t2C-AjCG# v.zHB _Ԛ irJ2ިJD}G$n4ґ># jtҖ^uĩh(݆^5Z7%4e].]u-wfa͟y';͒Qڂǵ"s"RGj0bb\à7l0±$Q^S721ubnw8q QPcdM${`% lGDXTᶁPV.&<9s>oڃsi|UuL}]C@%̛7=8킍5lu U<6aQsTz3x./̳~o0R=@PkMIp{Búp}1em%d\Cᖁ*mPq3Ff2f#IA M{ KvQ猚I-|L0JN,_z6agԎV`IT lѕ^i"i>1jI8N|HGU,χ<8/ 3E,qI>{Ԑh)nA.z`h;bdDfo a A\(ӑ3#dŒ!DSMVX΃%-hg;asL{ɰeIOiaӓи X*Rs !AB4n 8=ep<퉅D&w4{EZStP$ MKaKlw56$v /}*Z;dlՋU{!pQd"0`TB,Տ>WjLX9iE;|hu SeƳ1@ѝ%Ѭ.tfj@KnZ(QEEIfGt7r[^]&Q&\!Oώޟd!$3Uʣڹڱsj%X dmCL]| 5Ta5+%Oј=4*YLޚW +Ȍ`U$쏆 1v@ͪ[ĭuk*H#)r·!.#{D:8U"Bc%ⳃu7*WK9C9PH4͗8FnJkSD̨7Orp)7`6v1 <-jsk?W&Io<,QN뢆I"HPYb65_ bsQN$Ho_"zÊf9'̒SC(<{m$~-lJ>[½dTr `0^){ _o;' {x_8V ʖbXEQ8+R幥&K}zqkK(3&Gu9EÞg/N^&Iv,d28դ Ŕ֫~tyy֡swxO-Lί1vڂ:4$&{ubDs+:h\RR|rţK9{):?5wXEw(H`V8jEZ}xRZVgxh EV> ٓXoW6kAyfkq> |z 76'#$FӔPCϦ >]btܼ>tOzD't(R6];ӽ b7͋Zq@[xYٳHLQ-ڋlbcb֩\a2Cva2Rp7sTNˍ F9S5Zpg*uFT#0Ѳ)uѤ&<@O ҽ…}6ﭨZzkN$z=D2?8_7|F({7?7,d|年Xe9/@!qR@J)%|B ͽK:BZt&o{!цпMftJ^,E~-n=H R 0o39-_HM*gWѩ=KVܦ*Sճ %vMdX&"UzAm>-o32pс~ҙHPn\@V3Lo!H0 zE5x^DG,Iah^?~w)YE+91ɴ'WT[grtvCUQ1 ̜hF2e $jzP`I[IL* ۇ1h>c<&jM)>v> Բh8x4ﯩܦ+t0fwkj-k l]=? yvhʙ{8=7!֫ تN0Q-eG𿸬ք_`TF|`G (l{dθ6h爢LҲ C` Oʍy -|w^Z|kwcyrdP 4)hGD҃WK jXfkE*#\,vhʸ@RV.$VƏdؒ@>~A7qUWv,p@<ӆǷNu4l5\AQ$Om0?gk^"+F(boM\wclIr!y~ g.d-pk}s#zupx;‰"8&p(\9eDeiLCIbu`IrƵ_=  =I5g_C>"G8V@D(ac;YjHTnj+8x+Z:ڤ?ToRuiI O"R)ڰ/-1QdQD'b` mw. 5 #@!v_*HCVVNS{5,6=Y73-^8UDz͍'N#XmQZd :K?Uc% QCw}m"kT6Vԍ c=6iOF*+pr;v((jY͵߅]#2fB|@sAک뱷r%? ˰\0UEv?eO%1"}*VPk)5Eє =$.6Pu(՘_C] ?l{f.?4dzRG;Ә*oNԯzVC03H|H/xҕRU+$1m08++'FYlUl Voi\zf3@x"hi*|2$W> SzETJe6!xËiF N$ r…WCF0J`0HPPF(5m MW\S! ,FZ?aG7!B-~9uaWqts{k1Cr0fT*cz2HدW]㈊ikۆ9b#EA I% ]Ai=v,KUC926+ "F]˶Q<"{n"ڣr!oo6Kro9(Ox)-'QUDph#XMjTz&yA7~[zF=*ӄYFò JKz2lB \wE"8v,kN%=8Ű]_՗l 2'!9\/2\FtI1nc'8m/˹{gtP/ؗӠŽq"^ś{hcV “RoCoFƀ5媰.c8WԐbĊ;iQ?H0pQC)sLXaOq.T&ڕfZbsRp)]Sp3wۭǬx6t#鍒"H%V+~Y$s 3cHVZZmq;TbQxY m =k(/dJ'=MgZL.%9T5$f:J7B*$21SNL*EAN0hHnT9otY?կ\ cUKGyEN>ڢ;nt+c<.[wTpåd1Y"eRiAQn,Y.jg[ܽ!;P~,}AQ>Uz^IXPqЎU.R|%ۍqI")6u٪-?h9yNh &c +0 ^xckx^~Z5y=9嶟}5闌˃KЩr%1&~ŕHm'dh6u':<^iKE4"%X#['xo4i3E]y’^ܖwr^ŸvYpCw[ޕ1_0z) Av %jjCLvM`nF!>ww?#ymdY5^F7eO">nGZ?q)ͪW$%S_0qn=ͣr/0q7c| Fe Z䊑5,T A7,<]/؎Lu]Vp') kP=SxXkU !|:[w O?j y#<Si|\Gbn5t6́.!tWRޜFи~T\̡m:Nj˒"zPC^1ޛ>ѫPl#h6p?Nnoq5O-_@ۛ0j<)hd M/f~w20Gx[xDwaP 0[k)'ǎ/ L3_cI;VJWvb`' +\C෶2]z=!RT䢾N㯌lD㎝`ߌG>XQ Bs%'emBLaxĔ:72cj,Q)**P14"ޗa/( I[[Rg}_Q/k# i>:z؜;VDM\҈NY^ n >V6A!u(Or;N~T"a?&+p i؈Zʐs@Z\ [Y'ʖ( GKq^i\!Å(~ZSCE,N`Sy m8L2f2GFƋ{ ]d`gpٚ<:ΙPwi5~AXqde?Y.ջ iq[aזtBGOW܈`%}p}j_}?]̧sqc|[mC6Tヹ_K Ec$eU|3{ [mE09DzOx?֏ ُ= ƵTY?SC;F8!"Ell")'lfZkxĆ<澀/x˾i'CrAf;ai|"IP%1// =SLⵀ' %f-̭qUŔuQ7b'v>?&&9DlXCǯ?vEw z9sỷ?dDYg-*jMd1{Gu#ؖ N) Q5lв-NLl`RWF仺iywL?IE֗͜& 99JJԻee K#ڞDP :{G ١'E@T.?C@#0+\OUdgHJ~xm#Of)c I#pNt>r߹x1:@@(P ownŠ:fBٳ`b[Vz@YxP`q|{>߹ԷsVYLC#YR+ndz>p4تz`>X3|V"-JxI1um%E1SK=T8,@OlDMϢ,yle\ 'Fؒ&sA4_)W_r;9SD ;a~3=g s0Z}9[]"eO)I%"-6B/fG栒}(X 3vUc/mAwS]I> zܪyWe$Wؽ CR[n%!kj_(u Cf}]\hm{ HS댕LxW:X[Gc[X#:l#קt=-1K-晙ӈۇ%h)~C~{z)mG{iZYdɎ"es S0jcPKk\k'*(s-V1>R|iLGT#d$^io &3ИY7w!n3ʫz@XkC5tի~)DAN$K;N$Tb*N>UmN,1ZLSnKRuj6║=kMTwS> h_)0DKt*cݿ' \?GS`TP)(N4׍^$sMKq$D5'ce;pA/I:ęiS2hIƆ8TM%Bڭ-zWIGb ㍯]s0Tf/ElyVx^i\hA3*צt#\}XW=TjWsUdPPpT< Tdr6h tJF  ӦĤmK{<Ŕ-;2:è1|J쓾¤ĖE+r|]!̰gm?[RXcF5DZScI|6g _"Fr4eUӋz!79iz\Ytߦz m=0K5aZhK*&W W֓/Ɗ<͌ ֱiwt():PV 5\ήdʌ*) Mcqf9j)c?dcNީʔ.W>ۖkV+qnCaxڼԿzA p.f?!-lՈwm[!G_8:tk)kӊWjp߲*m"Ep5Ҽ(*+惷>"f6 l6sme^xpNg̽>IH0P,Z dbBUTz^D\Cf Y%uCO:f7+|XmgCoeSP 16>hҝULΏAi^ߡ_%F~,2eо΁`7690uǜJ۶=QLV7IsG"~#`Uy~(S,qB@q*S߲‰޻\G3n_eIIOJY,iLx)a^H/y}V`%cɤ#] "-Hkfq[(K;h-p`\,*:̣-ԥ-dOx=}IIqnKPڂQ!vIu֮`݀m+qOti2{U:L+/>^Gh;#W˯!֨}W]};얡|q:J3ݮhKķg8:!M8TN U&\goya6ӗ숴YIw=VF_\7_)Aem?*I*<0To7A CɿO`AOpLщ:&U9E Ts ypW>1^plMݏo]C'C!=ٱGO4(&W؎/3/V9`vJB ӆ~)YbD0QT*v͊< 1P\[2 n0Cߞ l\DFؤN|yV2_ĝ&m"ve@+IzIfe4(85e%+yq)_cB~77jޥ|2CHa)~iz별 KKm`,}rANmO瘠Ȗbm4/eJ}J̔D0Gat5S>S˞rߑctPQ 4uaS ܻB+ßYHCl~8΂8|Q\l{]%stcKOH"73[fE@h>A^(w%G?ShUs醢"eʱq'݃?!r'UuH4K0BMZ+#6oxD4ABi[Z$: tLŁX)m4sc!ƆZ;\e^^ukKrr}qT`!N.@䬕}2tL┥D˵vBWӂ+M @y)Ώ0Ċ\IPZ1Sy% 6cS2Hｓ7T=O:Vp"nz>-щh9|jb7Ţ~'-ʎq9sԾN}qOiesXWWµaLD mj5|j]wvF,TOa}8nO6.N ~HnH1~_R8wc8EvJ5i8.b-c_ݳ"Le5");PgQqc%l|ydEU!@'JzanJF޽ŧHv{1MiN>$[Ƃ=INt8n/)کHvʧA}Ljw pSUk[ZԠ L~}rkRюM%QDs]"À(H (A'2_XGX̟y)luj^~]p`[KIZ3El],Iu5M/=mг̯GTAwA"8-gDï!GUn2.tJbmjpvr1ȍmĤyRtK#9ҽD8-S ݻiiF\V7 ]##$ϫs?vsWL^J8rmxVvcY\hDmɅ| i$u`Cmp/WSݪK dJk)g7!M-=&K׊>8Q a&%R$zrhIӼ :_$w$aҨ@Tz\:dJ'+`ۃό~E0ߎHUS6HPfM$!j7 UA5JP" 4> O,YY omo# 9B$`wvZBu_Rtc'FUXhӰ5BR-ose ̎޷zr;ltu ߚO}|_,6ۡ._B%-qUHA1k~b&ؽ(8vbY_aS9KPNT%3*Y8\kӑB0v jOh2[ƛ}aK') VBb P۷[5 Ӏ,U<JDTeD{絸dFOqwϭ|l]QhPKQ7S"ed8~]7șWcV  5!.MUĄiӿe^* =mPE@w@ GZ+"##@\l\jʈǿeV~.){qAFz?9Iw^ۋ9Ȳi9e tj^ Gu.$-Gi[JaW5aQh=Vf1s&p:'W3v KiVlz n-3fMNMfqD|wd SW'#%*N;eajn+Z\.}Ҭ_7^l)ܚy ˎ`QXIR+.,av.nvQ X8%e1u4ۨTʦT"i@5p Ԏ\v]T?}/fw0fawt >)uRIPr\q]3j֧Vƕh@:pX "ji=\c`$Um[i(/_Ir$hwmX$[.j3 o}9i Q$`g! yH.mo`k@iM}hS!L:yQ#Ib>t>2̡D@m#sEIk2u`7&Az݆H.r4ik+ˑL΅ȋ#x79Izt?34Z7(gyɵU묰5Rեe@SZ1SaEvTP+NqJo*w?F{ B?=NfEn"#LQ+"' %n4 (A: 7uGϚeQ&w>kclGاV6/NHcݏ]>d4/g_?B݂\ SŅˇ-DZ]H Fb7xXR<{ P'㯴oRέ_Z2lB־-$,8+m0n ~wC+!ҀڈP]%p2yF%bU{h q8[m8/vx `o9^(epj(pUUͬvt6D8V`>+}?&R,[ܜL| a^Х6ENHah51/t׻X bY ?'9/ W[{EXܤ= ~0_YLLRoaIA6T 4="qx?O~6&G(ikɭFVU>AifpB|3| qB=]p8rdmF #v^Fi 8Ρ>_L"d X_irμ!BMz~6o`!4nSQe<#\r| #dxT9q/dp"Ls=$Gv I3~e5ʤEt y&DS̶ BH`vQŗ,տ$7v妚>tg1 MWH+9~dL3+bCtlSZ3 M&j2k7״:#u׸̽ԝ,079l-WY4U%æ#AZ%p e D'v2׽{dh)YdiSCe)0T~*p$B:M>ѩ띧1pw//x)r6UYZc2ȯK[ (]J٦||g^.F_>ri6˭u e! ue9|ܙa}%XmX0[_y5 EM-AdV+H@5+L%M@muaD{&VYJSBg* me#M:lk7Zzxϯ3`ɀuH doo9 ׶هm6*ڌc!bq+V+lPʲGrx4~I>[P-N{t44FtSs2XC܂ӟ.Xݟj!-!*-'.6dSzsm:YS97@ikBRj. M`Q^FoQR5HJsay#ȵHҭ/-2+h U/ *s\1@pIY"4<TWZ8G5Džկ`.%L|gRȵ1`ΚUqO=tc]7!4aiZ:#,7\/4&{x][ݘ?oW,ȩ(t4,CΥ6+W95'l7F:IGDS'9g_^C?Q}G;[s?M/'ͩ1n<5ƮDŽ1Ƹ]+8$Bזb c/Yǭ%i&h`(y%֊q0QaG~Wzrd0zfCu ɕ9I.SÀr-{hhlFk2=Lk8}'Gz QxU2`usp05t [8۾D˞өMuUxI/at+EdLBf ҈Y%`C>3[WCzb :""XdO8$HQ% ̠p?Ԉ)V:Ad7mF84! h@32Ou4_!%?&}y\+ ̮.0AL ? F1{ 4?Y&a)sBE>ubVAzUM cγy?dR l`ka> ޢ.߾Sh\G0+$r<φx4ށ j V}^r"]XSe-?J 5ЀDVKcn|ȈU׎cd#Lc~ ]C+1+[Qk[7ܛN9S2* : oiK?SmJ9/VK# @G ׉Aۙ~5mH!P$X}_ro~tϻQ5P!ͧ%E߁[Vs)JO[ojaqzFsE,@^ U6,iްclÑ&QFwd,,Y!vG =y']}᪪bo4Y}S-t94v((g>>oI\qoV߂u">u0+]S1s #AjTR"&pHWHLER9[?_b+8K)9tа<-J"8o69vjC?f6J(uK5yZY6|8и̭iT#8cM4͵n vQI =7OC\<)`kşA=ہJkx^^e(c!RIDƹ DE1Njr=n$a"oob];0[YiMfLT&[`//%],}%Mn:ꦟIԽT4_ZyiHԣL .Ӱ;΅cD \Sy GcA;_(Ll;w)q&F%V: 2IM< 4ϗL.tP%ta i/ل[B3'Ż\Ta_} ~|5#4 nݩf1ݷ&O*&cpLAs6L/ju}sɒ<K}acX8'6hmtSI6b\[k-%QlTr1K q1+V`<+I| 7H"P"ʎR%Di@crlBA%;D&;LjD*amiOwjd;1i0PIM)b3viV{}r^yeחTh26=_^4>x꜄Vǎ:r= $<ݍzѨz<‘yu[YZ&!))Z%=)V}h33h#'zN( R, Dhڒ+F"(1Z$qœ8/c@*.EK}x\"}t#<9c)P][ɬ!;elػ+Y%\fhܡ/U.fi4a)h~^Dͬt6~ŒgNIMBn'M؀tSo w7ԜA¡^8%[1fܡ+hXd2 9 yǼ; 1p0UQxC,5Z6_cUF'X;u`9")R&qAU&Ù:oM8wlw4`0 ՒM>7ĜY%eLp߮H}dNIf @oe\ïu҃r6 bvozݣ4h&g+<[ #5bE`!e#W$GM9pT=3YƔ&ZRpor3d^9]{*̞EӅd9v5]͂1 -5ԬiPρ?Cknر':DAcIjnUoņO(堐|6{?~ "_=Z>"g' `y~Ϊ_ " =֘{u-TƌݤetX33v_<%q]+r:m=Rt<F2ГC[$܋|crA\JD22Q@&?-u@sFȕaH@CqE᡼S6$:=}`TC(YDY {*Fȏ4m"#n7&?DM.8uk\_ ӜI"Ru|G5/';x+c?슩q+L 钕- "FckEpwZxpبcbeu`,JDjHe۵~^z5q)[  W}3\4caEVA֝v:v?z\dPBN泈 ӻg&VKܚUk9 F{mcmToѬlOgAW0]R)G/BpiQb=-WbzEȨ9M%aɾHzPi]j(=Q L e-c% LfŽOP_ h5/}44UUۘCc'͆QMFė؆Ȟbq-| Hݻۄ};?ܬ|:>O۹ #Y]ailhꯁ`mFDDn˜VŘ8bCObs(3\ SD~=tLAy24S+?)Y't3>ZΈ,4Fw y%xt#K]Yǀ3ƺvTg9b%h>tiEE6⹤ {8coO6h%^93  3 !km.vp96|2P.D"fmD 4rx2f``E"Riv}?O\yQf,5XY`8jpݽr+35ϖX6-A(]mh\"}ɉݱPA.ܿ Z,Eᨡzwp1-ݸ(Dd.']韻sx}- 5w2R1UpOOu'2yPN}j$(3aD`gMsQXs ݫAC ЪsB}7ljAvaC˫yMnrG wk>#Ԧ8W֠֫7qTga¤ ;?S$C^Z!~Y&Ҙc`3ҢQ Rb; qO/p=[T#"EUM.έ5:%8V0G2G0p UmBuC)Զ/ߞspX0,+U۷FPdܟ өJnq[ζI"1;h?e 0Xb*\$MA2Q]'\ˏ<GGݮ=$xn \rdANMal#dݏgC*~uZ 'a6aۧ I̟$ 7%Fc%m8Qt̲ovYt"\܄@`urBI9p@@Є%+s kS:ͅ)kePZЩp6:+V9yVoll7jnՍH fHDw4!" r6et)}ekΣ˦5".;q1 a@`H҆ 2jOߏA,tA?Zfъ;{ U 0Xa"j(Gf7dY7@/AY BmHGe_b|ۚW`h|;ST(T#cyG˭))Tɍ]JvpKۏbяu)h9O&("<;X5e[R&E>MF[B,9ش,vXW~om2 (*.FW[[N l !y@׃هS0XS) 18D)ٓ97$+|,Oaʊq`{-aBľS8%mZ=0=r5)cv֫Jl43^kR9ulX&%Wc"9Ay\ <6='t.6)8lg-G~QBG I0g>4ZWt|}>k eWܹ^1iT#*V?d\~@K -LĈţ',7"" L^g`@Mֱi֯K2h@a~{ کZ*ü|S/kJ3{&QJfʲPi,J'.=<Uʎ(\TT y}>qvVozq!帿$QGHIeMkF7KLyئ+psdZ̩` vf-w3?5Yw<%ôaysKͲ6"dnwxe2 z¢\ %>qj 1ֳ+Id#N'#-^z ?1/,DE51πX1')%Ӡwړ=m!]f:HuB}czB^\,ZcBmr+d9}HSŦf26!z[<#J@sTk󒅲~a%me8ߧCK 喇㯗 hgvz6n믴7lG:T ە]5:J[j]*?D \ͭYvQl`(Znٰ.+6ֵx\8M_^sKzͳ&ԁrɆH^YA7CRH"g|{C^Tbϯvrd6{L!.:Kݓi;WdCO\[2%Tn3׸Zwғ9(Z0zoa` Ɓٻ9;[Gu{o̪4^(q#L;>moB_~{m'EekHd97HmLeGPYDBkvW i^:i9cCr;3n TPK~56CZMBX:H:U\DJ2+I,Tzf8B!5c{D-/(LƙX2/'&T5jΚ^|&]d/-kNr2j-'B1Oɻ/[BзoZ,d#7tMKDrb\ |-< N*bGk _wlJg=A6h)]@;in]"no{Q܁Ww&oy2N%UNP{|`Mhvagm\`  Yq56V?$){9A TARSryT h|MW@_=CFg*»+QBVpR,U|Y*Vޱ9dTaؖ|" 4U,(T~*#wCV$k7^MŚW)Gr\]y'?\5L!)| /[5?3@mK胔䙃Da2Y^$B5T\Bͺ1b9j#{Mi&뫿"Wső2^Y+<άR!As*<&mݢ.>tA~äF~ײKFE}Aٮ'.U瀢*€ͷo3̷J95 M06lY`S\|ǜTES3njϪ%r*;4 !jk,'^f"u=5ƱþwE>eksr*YjIoSl@PzW㻄uf9cuFɼr:qEL \˸mk)ͤM ph5*節|[,ޕnFCdxY~}g;,Eτ6wU{0@3*YFGV$Ջ$# R V<,Sx~o6;s!`Y>0oXxБ׷*;: yOk#6u*.ԅ!>G~B `{7\Xy'_sɨ#c7A?Q<>Yɹ%TEahPoL `̔'%7t=F(yFA {X`HIa{ҞDżA!ݮol1p߫c9+!ƹqO:2> QqAeK;d*s-k;<[U56xg|@OJLu^ =\Po̭%R?wJjO kUpqck1?_hʗFy@Gƒ?1HyUEA7O/ɼuLDa8HLV^Aʶ_54ΔĢ}cEgқ*zGF@́aTv#4l!&Fp%:vWːm6wn`AjĊ*lzz+B G~Ⱥ1ǹn8>; x /+&#PO90s+/n}*E7Cce]DD3 2[q-+ ;~AИg!$ù<)ߵQӑFV ,BeJ~܃0NS]QcBh3S\"`4z(XSoJ?5ǣQL=J |_D9_2kb51N̷X>rh,~SO>N9 }lj)6_)(d 7&E ^ phP߇FxlQ%{Pi1V-pf#lyu蓽RX($H*lݞm1%[OЂFoFa DY!hYj H<0y5=w,D e▔_ 4%uq;6 Lhf$ uAt-/8?y'epH:4`V=^jk=:Mgi?F/(x-;pnA RbaiWAd򷇄Z}>|񆳣HW5#F_cqyWmH Krux]N78R4s| U<+—:@ <9h9Ny ǯoIK(C9BD\ FaI/dg9N"Mkʣ1g>hJ;Smfe@Xn#&r`u v6']!d|q^kM3a`0dxjr?hj 2Z#ޜd-ufI``]] ~~u=O=`L?Bm߉ym4.Cf¯,%ˀT@$d+O+¦2eu0)6_xsKQ'FdP\Z4'B OݥjsMGY>8I91FC{jBg^ЋLa}sXcc3\С❟E[zo{W& qQ3M=v?_n+,sb]yᬤ1Df25YW!JCOHRy~ |_7ql@maП,"+埅ub܋soU#8ڶʺ= rWoA0~#8hｫ8YF7YSE9UX]PuٓP1xeQ2/$o~;|5M6'xcm1.I2p#/Q㴢1VW3IEPTXV(k,ÓE СV#@o!hd_@ŧǼmۂC`o /R曓EIg93{?fl"޻e}w"pʛOzW*攄ı;e뚵K<ap89 Lä5߅B(> RW/Q*~lzQpL/P㮝Z ùAxc A I1z[~=vVd}SPV,!=EϛfCsG@B_Q҄3P?$s5'HVk@aMSH{@emWl_`}Mw-{FՅ D!X{+64I|7TͲ NüzS 6[б<-oM+LRˮbוsC8K74AX@ |A51~m-~F-eEزlDZ؋8"|[Wм쫥YsSMA[V]질t:6l²Lti q?K;G^m;|^ f.)CU>Q1PFZ7[C(I~fvW b'Б[ q{m(x\ג'}K)j֊YytY}ɸp5P ?*;q:8l`Kw@հbi(O({i ;} $s͛ɌӐH6|_+tl)ͰTdIIVSB[}ZF3`΂>0->uv,)ZڸUwV^R,gܒ>%LtwkǜRgu.}B=Vo9mwqĒ^ I W$.,c[HÚLpE-*pvW]Dq~v/4oӤĆjt2Eu-ǫb1.z<(KlT,D3 f*vf8mDHdUGPW_򤘊j{rE-e{9ω$Uga18:Fr ~ SSMCoX;OE-!! 4tJ|+,(09>V|z]Z˿[Bw`f=U8W/7;&|dS+t0ֶ&W$duw佣hu&"+%{ _HIC3bV w\y7 ķJh/*T"6MK;d%o,V\3[aH|.BF ;DB`jrݧwҒd H{(iv2-vZ"UaL.P>Js^&]W-5 $-&EV ⢼31L)Uv[&-rp-y,]1 ^ʷ BIy+LoVfߜQT+Pkr=C*kG(TxMFIMND8A#Xa t<&x.wׄqJoy `̚B˕r79}㕔hޒH)P'jdOIapr5Z$)x"N~F齚s)5u'~% M'sYĎj$C %M)?bkeON7߻skS B-!Lh:ŽiI"p85de19D)l`ΐ6C}a{ÓD7L?p2AAذm=H̓~j?-|"_?Z)6$~$["јܯ jDJ%K[]|ķ鰗BB' Jw\vjKU~4" 'V8)`3TA/y p#:VwH:*] vTm!߰cנL9dm(tX%k^)[Mmũ%౾Vp1K{JpĈNͅ5dB4l P%UW%-j^ES`뛱G2$@PAj .l#ky.%e-ʶmӬ̻dp1 |6f}F"v O oaI`L4nSr5xV <O/a߸c q~#.Uz[ =V2yg -7xlt;5e@ڻ!9R,0oX}:핗TC3XКtn'+FT8 sZC$0+ H,b8ld"9*u DL09h+2ڂ]yo~PDEWY&ec+շt<YO̫+VQ$ uUªB >x< U饄w-!`Daԍla y%Sn7z!V1R[HٲS]sT7EQ<2PzFBOObn'ޯP,}S`$9v .*= ~D{X8y~Քx&ʸټJ][= L5,K`>lp~Cкy 9$P;5m)Xo 8x6 gP1>kߍmH8[]??:$G*{y"Pp_`R_ ӓm$݁ "kc W3ߴgpv_VvN%n v ڦ}!0*k1,JB." ahoO<6A!qbe8^WJ.C'mekŠ م: hu*52Aڈ1:.I!Y&#{̯̚Z};S;HvqhgUaN΄C>:HumgyI'QZ`܊,?kd]=Hu[ipH bS7bϟ3҂8Ht٬uwn|qj׭ዓvShٟx'9`(m.3 jO-o$5}H^G:F*AKר#YG˗#bfo,nUU4\IO_;qmT tR˺ 9~-pR(U7}WЌfOByjr`hwdn jXYDPmJ$+ zcwOFS6VZlDv_fG?;ھǧ |'M8sò*|.Ɣ#Yb:&;zt[w,tVq> TL$itO[mH/K%xKҒV[l؆v}GX"OۿCKQ*b$zHjU$~pF1!'%j6~qfIA?:A"28oE30wO6ICcb:Ł#%frlshuY>+.u1814fRELKo<5qS R#/b>lƋJ +5)/8WvaNW8'm|7Q+ xM6Tji"1g`t?nVEj$.-S!}Q_fpfǭ7O9Y`qݸ3{6֕FYX,G7 c3YƑ<\L%emjj8V;<%流z"B_j/39pǩv\T5ʅx"_pTR6rȖ)Pঈ0Qc| ƸGa Kөr~ꖱ0_:L_Ƭ0a4z~(zJaB<>yg)SZm({) Tu@w>fyKvH-,8ksN>S枇V3r;7.J{1h|~xÕs=kADj?U,6IȦID͂u[ tύ_a#8XƲhiRnҜ4wVbѧTRɊ*K=(*YS}@>B(y{O; ͮ"=빌AFVP#L{,,0#ʑ>уgbynj Dxf mPۖȜ3*:;dȳhi%;oX6k^ M&>_.Ko\0sk5C E!2 6HwOg8bX~-AAS-L9^(E%P4֖V(A Xe]/1iOJ‡ₜSIeq堮s -W$FAWe\0Zʯ8CuI0gZ .f7 ylpψ- 0`Q^gtWt^J{m %f0D} n^Tc?XS:n'[Z#W;` g!$1(,&EQb"_fzw/ҍgg>_rxjۇ?|hd)>Q`V~ecNk6ZoHn,kJc~ LHɕ ׭Do-i7kTJ[ii{D q&% h`h ѦxY>a3-1mkmSr7;psZW Bu{D2*gil#/!PE'a覊qժy%;d6<0j-f/_@jnDZøF ~vU\778Jy 1&3Iqz '0jih~ Mߣ|D JbBS'rA";3e[Qz6" l3%K.TaJp8Lʾ ^|@޹D?^ ;g K^#ԯƍ@6Yj(S>|jaJXTj7[8r{(.[޺fDS=2G@Qa+e֝[.=:תd'@bp(v.0XʷRU)gcYWb+CG%!U* &oNyOXo+kvw_0K̝*pj ]6`@ pb~ lu@ 0PG*(R얍rD✤𧁳AB$ 1|sHT71|?`> 2CRR|,f Xlj?CsK>g|͜ixªf=GVWqJ1%pgm@:4ByZ/wUhuAmOLQgNOZ'aZԪi۬<lN2rSL-U ="?sХ, *ލ@E5*E ;MhM9(7h0 dr:Bf1/)# QOn)_qΈon&UD*0uYrejS"Keك|uR[wc'-Bb;XZ9t_EΠl"?󕹇T峞X-4A\Ě5S j_I=GʆZY"p`59mVk/&<˜clɡ*їtvB_r/l 99lI;gsܨ% &֙㊀jBTMK8u|cp)gl7=$O@G~閱sv+e Ĭ<:a˻L 0軖z+°l ڟTa:D:ҿKhebT[ 4VcyH.j r dxaԦ"8(J{l}Uw,>a<;AK tI{^s %sgìFA瞯*9BÄ́$þHV[XZ-k4!:j`Τ.8+~2߀C^…lgy$mZ:W]X }/@oPY 'K\3 u|P { lF+yݜԛ(Nt xD;rqZ N6A-R @uouAĎ\X!|VO$$ϥAm%awŜC{_IImr8j6b3T2i|m}Qdߗ܌Y!N>6zc3O wٜ[M|l9f )ہpO,8x< 5PҌ_ IbO7W3D4RNS8o,Eָ.Bׯ`%5VfdK>ʅ߮nn="bq~/|.}i_#?yk"&9rMGiAp%wUU+礜f1uN9xI*#xVjj) CCyጢ j&1.jUlxVW,s,:.n l-Mߠ7$$OyT5l~VLśBI td&pN S$_>nxvqz9$y$t=/!EA~HUld oXMS2VG4 fNE@H @COw ۝Nbsy#__& Qpn%F=ew3JUořo7?QmK?dsw~IwdP:&k 5ƺݩeD6thMk g6|WY:VJJEk=-vrV 8gЪ:rG"d=-m]% ya: D#n*' *z61i% ܍H<:Ltv80植DGO7] =\- 04)''R|Fw>i$EmX>)䗀bdȲ[")Y~ > _oαXr˲.eQFvu>ÝytMo)liE`Ư#ztl|t%\Xc2|T.4џR@HI# ^*7ЯʡNpBWE;dhC2}۾:RW7TDq6yzN|bq.Y7 kЎUnV[sc]x Ba$n#{oHmu/w2t>pBwMa{fEc%؜&|8[JqVHWJMo^^y.:ƌ|JZڱDZSpq?ULl=s$lbXxe ƟSӯޠB-nRR&7X2Ί5mC-Q5Рb*.G+ǯX+xro古aP^;~e%4sWNgӝ_ϰ&rEW,;ښGGP!>Q R5* A }r h6}] 6TSl- '0MR_O塔"$5 ȳ MqIs.IxEUfuN-Hpr]I}%ZR-#̣-v|9݊@G_ž+eXj_j300j8CԷ˜U7d'T%>` ~L^в֢vJmpWZǩPkHw!te){f3[UZ8Y>_D_. vui !ie* Q8X"p??rw$%$L[^_0gyi:3.T ]a>YY±ti|kq((@Q[7^086Ld)I}[r9O 3 m];^)S)ܜaxZFA52 ƂNWܔ#4ۮ㌮q4v58qId NJLIu=YY5~Lb^ve;)V{ƝX+z _JK=N x2\@;vAz9`cK7lb_>,]* 3 1stKcILoWuWPbcxi";Tիw(1c7p!V#?0 6ON(Ț nʫ͟@{f<PYew-T?K.D/3&ԩ:kEDQI(H;\NV(eB 63֘ zy([5pĖoZ}fۙOypQ<&):_RJQCRIEӪ6&|@Q l | *󖮱u*raLr[9oI4ҩN@9lUsS5q0\U!+ց7 p}}\EBv4G$=S<3R\h/т)ܗ}-5GPk_x,]:a_y9^}DF@ƒSNYJ%&Z]!M`H}lXE 0Ml@ :{ -'J"S?}k4bQta}NhH_qa8qX#6f#iP4.//;D^"JV$<|->.$掔QG3`*'͋@'y M5>٧0[qNkU!j]hv1=~ qҶ!L~p7N WOG` IL,!g3F'/"#2dV1ԺLa&옲13ZRjEڃV8v`)~BNP`B`8WW*2q L60պ4t'dI!#_)M{C@Ċh ݛ)Ȇ7Z'?ר9!\‰}uN$OƠHr֓yW.%PYn^lvZ}}yW)A@F’@x>Z"Ԫa ^KMw/CMEqERreWqs &~(د2_Ul!pt(;J[-}.*`B#hrZ [DR^‡ڼʼnN_650:ͲKyu)K)œF)ߞ~A'j; ^:RX>X&! EBo<$}׊؝O戦ؔN*eaeזּJ8`DRSoʏtDo^ib(E2<ȯۆeA#YH'~ۯ.QGs8ݮ~|cQK% *5kr3NWB+(e+1}<Ѓx#"]eG[B"~1F9?kNWvfxW;9=uXJۓNetX}}V}-$PHTqlV*&o/NOV] Hvg+#klC4@q"kˆ@ dSǒH 9:H>A]*6kȐ4"<-{kE/ g̰M(-XlAc:x]~/ԝWjCǛwJ&|g ژ(FjjOln1ʘ$T#-6Ńs=kgμF4#Wn!I. JԑPZw+UizƟib=y W6.@ydLLz{}#ÙiHڍ(5vWq]?A}\F%qp͍tSV4 KkByf/ˢa[v/ 3h``)Av8Aet>%yǃS$yD#Ļ"(3*{6ψDn]Oo`r$r T%=C c#Q YzW8FQJj͓껃!RM f*QJ H3PPqqc{.Ն,J&Anu=PK&ZD5ZnjPKTUu%hoBDRr69fHշSmN1iwy:诩-Z bGŠ"rJrĵT_qkK>~u6}5Ox0lqNėۡLuSowKAAf5ȼ)ΚœW)>"rǞ\. lw3uWO'aZA摎J;cERZWXZoeK^]#sĉI5"ܜ:NC1fpp|,;E q6k&}Ed/aYFJ惖d |MN?b?5w'D _.x*fW};c rzڜz1Mۣa Cd~9dKp(5|YU+Vv#\/O?YAzr/߅Rܮ,nwL{؊/eQ@; ?P荕uZWuE>qDC%Jf5SqtK[b E:}isFOVd^{;0?!u^-ARb=a3=,l,YSv[_C;-=ogX&75m}S|YuU!*=4ޣOfl^egV){鎛 9$qBu9fN/cQ~O9Qf}+ vtZJȁ y0HEՠO ^7|#E`@,Tk)rL4`M3.ک!Tĥݦ%:ջ{^r2ȆPMuss'x\񱺨8?x|\BWLB5\ TfxDɬq'1-@EF7_V<%G0 Da$"';5-LyJߏQH~"?GF[S6_5efmEPVCo~63=SQ:CϤt@w B3Gu{U%X[cȅYh*A:8<--Z:]Őetz[>͖', HVR9pikRXJ\pplz";3i,A{{Z*=Ppx#`h2f^=ZXcXwv4{APp= 3*v\aNDsFu`.%\\!MF@Hh'']`"Sise7ԛkA4X֡羚P&AkiaG\FGRsz|K`f &_uǻx/.A U0?~̟}¹ǥ:=OT7+tn)z1I׽k~.a6ج)/mOMF@e ~*WD+ Ltxsa|PI0R7RQap3&Yt,Ts~lrz:9~T>2{pHpí3F=hu̼ yIژ,rc]à}W G3&Yq*_&)"Mv1.EݎLƻy%{CmR5[$Yw U3EF'R8Zeњ'> 8p\1[[)Dd}ђ/#a-DyKD 5$+upHvEZB;s2I7|#rZ t# )"jȰ=LCݒXS9Aʇ>GE'D?{k9^WT0!D)#&%1?.hma%*!0Du:j{LUbTFzWt Ojg?I19m Ѓ=XX NKv a갶ם_v+rw-D#| rTH;HIT ]ƻ6?t*wE-qsE 'Q^s,G`)C%5,]oE |TIP "w| 5$S Ymiܛ'DE+uǴ XZq<5 ̲z&n1%UV喲iV`|R&f%4@IcD|47miH^R&GoM67DǗm4<]AmoU|r0*1fRƣ |pEc f3un`zgiռmo[5 ϕ6u}J/ʈKewXD9&P<)#m+ ]/pEkd`>0.zff>OrɄ=FDϔ kuMa1ߴ akX,g7| FW hg=~H:&nq i?CO7$O}5U~S9wy4mG;Jxye\u[ CK/R.6txFG̯|UpҒU g!iJ(|͏kmCHȚ@(> ƪ: QyW/Yyu N'S ydws^1*qBN原hѺ+W/5 xO#v| &#]㻭lmXZJ,/|WJs0Uo(SOl(b Y͛6Ήiʮi T#[C`FӉB62ҒP&9r+Y3;&Eta l'kTmfቴlNbH]s!/ "tP0~DpփS5.tf4X䈠v+P;-w&J4h}ꘔ&2A>V^q_, L=j%:8WS)r4<΍ "1#ز*IvB2B@LFՈg$؃(y / @N]7u7.RmaԈnߕս?x _P0txG'Ͱ#zu"ݒ0^UJ+2ª6%NʥI8 #؃B:>J?h[fRy9-s$oZkZ, \ YQS2k>cI˩\:/Nt*>o0!bJ,y-yU1~NÃgvs,Hz|KA\ߋ ݌sy!e٤/2 't䗼w L[覸kn+!P ezk#̪OJψg+^ˡMo7:T  .-X$X( $~-#oY. 0NIh4/p0?qf8u[ͽcӥ%j@r'zISzrK[t"d]F5gj%JOe$aԌT.ths̚%imu]$` ҕ8}2BU͂7K1;W(V ɒ6{c&V.cw*3׈ vSd̎+Noz[ ЧLg,)_Ue:SJPe<&|Pd}w }+G݇ /J(#Q6y&prϯY/r]GfyhX UMmG;穏ו~a,XjxQ2!7K5ׯd(}]RO/%b̫.I-.%l{UGe"JȊL hp/6WA͵=AЛyrBdL3AjXS$:I-mguBvncdNm7ΚE)8|J ,Is4RG4WbQipl{sqCϽ#)&Uz|#ӼJO(Rd>R2[VҽET0ڗO# 62K@i+C:QEX_ 5y9v'1xd 8',a|܉sQ3θ'BeDHFَ:?I)`j#r%//+^f'7R}6Xd4|39,nYPlB#@ψ1 WP>l͡yw"N|MBHqZ9C;Dló(2?E\Xg&L 5oҌLG@qk~~\iˍtȳf L(B Hy8p[vŇ ; kRG1<'i0nj5-s1HhKeIBacO牆o3 VgN,-IwEUhBQA+UX=W!FZ»[;J,~ϡ}$#wSEN ZhH>GT23!0KoW7^Vcb~zظr~mPTq?#D'j}ɛ63&qC/9Y~>k $!c8)}v|3ۍU)ѤI1Dvսr-CYKU+H.42dԁd@-p`=5 /EUIw0΍;Rlyu+<>/K{^vdTf;Z%dEN~?r(77 ,s1WK9u}Զ+뭺6 :q&xPNU=w#+ڙ;LdY2lCr>HR/c53Jmn}j-h~HiBoe2v, [@ᥳf9o_*}tA_V@x[rQFLTA072x%гVk JE9Y HzpcˋX``X@r0|kӆ@^/hvLAsTS!δkcZ>ۜďo%Ejx(pC@#ԟXGsQgɭi.V$v}=,J>@5 N:E~Hl4CdžcQiéJ+yצg>&ٍzwKjj+ lK 3e#.qۊ+zHvԋ؀cvwmrˑNhqkVp_-", gr 0Mj[yUf^p9WF}On&0~5P)/JK1Xee9atjͥGr,v_dia^\գi|$ R"zzqj[&75 -.9d8kp hhYA:E{}dl `1#tZAbMZE@:e0%zST:r.ۜLyPet!dm-'4~hCXn8`Ư޸ h}gopᢤ>pfkw9xP!"q[x9n3υqٺT|ft<3pց+dG%i.v,D*gFD]޲+۱ rG@m%{:0zBGFcN8rmT xH^%x ,Z|J%˿2jdEf¡f:)q*G[*}x .eAyv_CFN@f]/yCa9CqK.yX߿V20f3p8d)8b!^o*ͻU >x4,]=FgfO.)E =%<) Һͥ*qG_I|8jļ70H1a#Nș^ ^-X+ #] zJz5O /brwڔeϮ|C M@2Ff|^_42SD 6_= bN<,dD42dJ6C*+Hp׫%BxvYkgw0o@1n%}X%̀)vz3Kʤu$=s "f3sFxέUR uBΏ-"ۡgL ;NR_Wv\F߆/mF.)P."J>ir}/ A7(MhpqN,ΆWs$6o Ǖe!@1J"L7Z֢/#r\u𣐆T3llXNn(Ejm^v+ 2,̂/nFtTƣÓBs 4*OOC:(+yx 'Bb4_/g5gMSf[`jdm:D“ih%G4Ww=AIO.󒽫.}76Vc}+n3;bZbl;Tm &f\"~hr[uWhA`vi+$mWAoj !QyZ)FJW{ ^N &Ew#tVHew:8V:P_EpQ R#9p饵9/{!>tuqb3 i.=N$q~@SGh`{JO h"Jm #S3lҝ`@n]n3dS @Xt&P$Ha}j.D)ʎ,1C9HR3f ۟/IJw-{eXlpq6(_^T„vX( lVŲePeԁ.J?g[jhrruES1, mYKns9i7Hzr'6yiwxb @ ~ &jWI6,+dvs,0V2ߑrjxepv`}X;9dcuU/ۚwvrHPg0YRw~%,Ga#h-;^ű6cҫCIZ5;:vl|C8LjGlEӭQMl.Ĭ\PaNRkK}KR%ˣJiP=uBpe> Ҟ'b_`sQ9K ?Z5{Ziws6g ܊Hc!5 /it&,,5@x<7kCìI|D1TXuhRV2=Ic5"ŶN!Ge ϗ ~*L\`ߍ{^9^i5opCe.XU/'eq#7/ BXc9i.yo 0n^-w ytC==~q1ky.^6 kn4o(x8u$߼Z9 ,qSfqt5.PPHk՗[S\'-Zn2M`sB^Wd&?mBFl0U۬lº+x}M*ǂqE BtqM>e+w"Ǭ4vUBROg7ϮrZG1;1^皏ֹ+(GwOHQDܿ-S E436V*n'4r?i PGQ/F 4$#̿DgEI&Hm?[[:6/G$bT8Pzm%!dʀGYr@`[HuBzJ 9hit,RVBBH?T5 d 8T L[!,Cd^54d< &kF)"Uv.kV>Z 5O|3{n. 31n[{{t 'usYޙH,?ޭЍ]j)и I`n#!buFҵ:{PbM# 4n ay l3JQk8He7T N^c* ^j o%{/PkTG\\UJyR{깎m&ȥFNU-p-}Mހ-=4x_AR5wD$k2;lXu(lǨi],w < ~Ŀk-\nukزXh^M#uMqE^jUe&njȤ=I]RR ~)fZӎ="XuE'EqpMbE}#l :|ѕP_=FOANuBOZ-%qɘ@-@M@awx6DtBq3>uIMu_"!ϵ :K- i4 ly\.{^G;=߹u!v/ܴ׉(ħj4g7+s;y\e4RSӋ ~~`vYlbfƐ"RA?Jb̄!*f8w\k;tӏK0tJY`>ls>fqsnk\lKc,k| Ԃ>S΍eXݫ'j(QMF;1lr#CY/,m `CJ* baL12bXb)c:ْ}.cXT 46C[8b83+t!HkXډ 'F@)4焖޻M@**Y9/Ր%e6B&c zZaHBoZ/ ."2o(FM߆vS#32#&YLE< IYdQsٝ! cJ. ̢C~3>irC\xoGgJ` &1ƅQ+T^v1g<= ,&Kȯmi$kWjd~yFϗ1Bap~y@Ö:a!aoqh_m51tB]ůPVeBffʍj^Ta'5r3r; ˘6)^ i/NSK&,`3ZAHt6UIlE%$'9ydЩWE$63C9P`<nfߔ8| oxuꀁcr.O̘Uns@{MvmoӬkZ [ TJ5dȝzH$@_#9W*z '떭Ѣb̈́Xs y߰!@%7jtzVp܌1Y Z'{ 1^+,mj"< ! ~Q7Г.oPgjmVbj>S@pr]D$yC6tԵO?z˶i\BA nS 6[hڌE^ݷ;;ڔ6'Dl%X\ɡJ "<(odlb$:zVpi=F|J齩K1LC51vHB6J6lUJ&aEa(7'ήaiB[jGxG90?hcЩw셾 gl 뱥vB J?#E"+D  y)L$ ˊτDq ۓdm9q&PYwM|x{z71r'/~ŜN/X[ XV9PMބLL?jNƍv,h(bcKv#)EwcS c2R0n3ecc^H&҃x C.'~giH-i1B~d'084 %2 6[FRH:&R[4#TP:Jt5@~] C&FCz5XmrNR'Xj ~P)N-ȝ[zЇ#GDpE]TjPU3ÉqSيYϫ>JۙO|& =" ?D(j锹 P54k:n }ytKn0.e,_;F 9WQOw|TDEB:**KS:TٌQm+ณ]PbJ 1d1'# "r'j/לK  GZ#N. 5F 3VZ*#˜ ݼAI} YP^{qu'sn]=|ݠsZ+}b\\iR(S@LU,*B؎ؖ_xXAp7 /R]Me׆G'TKac;N{)$3Q}21j&KOrT~dZFC4nejb{.&Ux\#d G‰zJ+bE˩z;o}%%6\Z:GUA{,Wº:͔0>b"3=pPx׻+RX (u  9# U~ݝ!T|J ]` +5gsK|~qli/eOs90J7r"2 <:\P8׏z,ъr="IbW5 m7ujA!ɿh ?ެs 8)XxD [+c]4WLьTKaOO;$fA6.PunտvNxjIɜ}FS"_o[Hi>e׽M:eo膩(}":sl:iZL_O+ 4a>ӁTh],%/%L޲w-8n޿42f&5+烶2L~^se3@?|,AͶ'1pw/o7*}b8Vt% zYG׽iD5 ]W(#ßc3'55Ĥ7 +pkd(=V>JxyT}"^g~6G%Ek-#[4r o/YZr")K*C'x2v5|x[##Q6<÷DD^ 2^^dj$^ѩAեoXM,Sa2UF Ls>"IMlrmR%j,aU8v{x*;*N|RHJZ61% #sQC4%d #VvJ2s=3cܯ}dl7q*]o?𖱎q|kM L7pEOH^ʆ0J⠘>CHIX 7  }trG0VD!MZ"jhso΀U D>2*@J2&",Ip"?Q6 x[ [ߖ)c ܮ=}=Q C3x./' )pìfN5^䄬=j l{7MRԣ7ja\..:<//K}%HY6ڭ8y ιP`eDuiqsᓋïXIYQ&siR#ykQ7hGC33_. e&4f.L I\(m & =WD>%;-l%"za3ûRhӇ}Sp0<yț:(ԁu#j(꧳֩Z=օ샚A|-Nxv]DID*ltI٭K8-$ 7?^k\~Js݃)4M-y?@Er F9ϴ#y#~{Sذc}Kj4at&% Z`zi18gzIwh$+/xlI|ٍl!]g?.ʓ{G"2&4dmuY#YM Ay轌x'هn!^wp:.zgƘ!kgy6q 7:p4'nMAKx= !Rn.?d6=^؋ Eh(3췈Ƴ7u*UX`֗g<MԨfcޔU3lǢ;ktppMD )<S<uipQT'-9yr,oiVc !AփǴOPM5k ?1LQްhJMYx|i|r}JC?~;L@~Xm 1/ה&=~XE}ȉ uK%d,d{A$0NBpMT,O2Ͳ)\.c;2;yxC eB* ]M,5R6  )U GT<t2H +JhJbO]^ F6BpKitTV!fklՉRV$Pd?{ʮnqn7nB{[-jޏGCOU0RTeMcuO?yc6UWq3ekU'IhA;=Ɛ_ $ůɶV7kn(çNDY?2i{KV*wn2XH]b\`rއ4/ܝY̧¹|tf~q*hJܦ`-!twO!Cx;:$t'k!8}һ550+cJ]lnǰm9=/|fљ"] sT(_PIzzDA l/zT(;za+0 9+.ȧ6>@@[U t9+p ;qߒG1TE `!ӆ,= | c- X[9|9\gS"_؀t!)B?Yq j髅W0 Cv16\!ZJ'qM1{a(u&LÕcmX&u #BȂ Gc'#5Q9#Rʁqq߱%9 )8YŇ^3TM$Đt5 B ʂ0KrӵϡBz~ ]+Ub3J[ А//Ƴl#W_C.t!IۇC&$Bo(+_RFV,%U>c@mZ8Վ70dpm=&CsHKuY2<{C"5hB:,>+(oSD!2/I03C̠}3P199t g}۵laՑ>UFu>0Anln@ gӆnP֌ݒG u.kd׊P䜦-Q,o&74a%?ηv*Xv(I^O5O?T4߽3J%՟?uZ|8ښr coFD6dit >匿PR*TaA/]Tȝn^ ).9JDl\&k) r7\Y"vXFۚIe:Ȣn 4 Ob QL-#/Ż0ȥϪ D*.WAoK=ss))9cVc>iNjÓiۖ{#/9uԪBc9ruGOOIT.Eh֞D VM'<&(@D6`$MG(/d|`3+à%j]t2fK&gA ήa@/%`",Au9P XTA{U w=D.Y1TwʦI[nbFm@o5[l3WU3U#<瘛S靜yl@wg64nM0 B7pА+@.пLc ˞ldf)ɉKh'~'侲8Na X|jf45݊T;}vֲD-D,Xi2. <bYҗdQ8h,@1 q{i25N<؏` E!RO y<9bf =oe[(mb3?r|t)܎B>bVv%%j ّ5ʭqMW!,溝ԍ;9|b~X̰M*D_) B/<VϒG퀊~Ø kb\ |˛-I`+]7pG&05."\99KDDN^c[ܾqꤖ:?L`b4U~^ _D&t0mf#'[kȉDey#UΣZ@L.b&A,S\y3+٧|3&>vcV_f/'ܘ).OOaݖE V:85 Q;zvlK]M0Cn^NGSȖZR1|ǎ;RX5Qz'A^A>A4=1Q761p fVvoUB.E,{LiBl Qk^劔Q{v$6MSهHc7AfHG:ixg)aіu_Gl&5HD>&rr J;z>yF'eom0Ũ M˒6@UyOtIdA:#kSY Ddv-ݛ"BW!Dx ی;'? /&~ ϡؔB*n* PFKS?~#U&]çycΌVEbL|f^I yT Ӆqyf~}rވ}?~pzD޷wxI ]Arq]%[!p}$.̐O yxVU0Vjr@|iv-_p'+;"eIR}O ֐P4pS3ȄF 6ETzV8hˑ;VV.z҈v@2sVn*JOm*\F1 rS[Ge}N.lMH&7l* f!__?Y:.QX?=ęN49ę]E쀵0G0:\o/Ϭ:6rC#*^Ʋr0ne,?^i@@JϢ5;C^1ASe]mT%MSVU%ڍ!x7 NL@-7ҮUQ.?pIm \3?EHa,D)AQbu#84!B+t Z*Y .Ex'_tўpʶ `:Aױ%cb9rH|cތn ־ h:})>:xaN:C`ш*}yʲA9'N \4er&=M7x)sb= ar~ꣅ1BpD[&Nf`oA#ZyA揘xC Lr'v2dh}F怯XL Y#mF^lds۶#Q&-7(5/s/Y?E)M6tBц$S;WTvA"WW_)a-qb޹a~Ma ץYѯ / Cj+bP 'HU[hZ@gJm)h,$!( V񋔻{;R5 w-n-Ц԰wyeg(BKRT%kB8qz↼/ǭ9CL&/Lco"9">3-lN )0qcss?qʁBR | &s$>(9g${⇼jS`qjVWwj $koiA_H~ϤR,""_k cȒktLqO26iiumk&{Z&[h/̏ -zlCh$rGH-fCo!KQSv˚j OcBY =x挭C u=T;oS-t H=ʦ0pym!fHRB @Z*r4V<9&{V&ťa\JMsٖ몹@ H'q'WMnQAfwwk4.jsq-`AN6j `rdEqG΅#G2wr 1dW;)mEYa`=J6)x =IM{yAdIsZ"y역rFErOob(˱a űcFwpWXQVoPZRBKQ{'AQ\eAc;L&TC_(W!=k{0~i.'dF> _d`; b R&`ڳ3e3E6 /du4j|l011$͑lDGtx{rL!%mc@Qk#--uoT/ҙKBUhv5(y/eYMì(]].3KM DuDOZ=g!m$.8GR-N.*fk2SQ i՚a,MK{H^)ۧu Q2CuYt5瀊WypPYZRؒa]uCֳO|="d*&._2*zcuYiV楇AП/NBqp24۷+ ˀm3Qosfp]m\xm_[%D&b@2t3O%/Ij.;Ͱy-;WKK)jebX'D~5jޢR.}lv Rxo:#M&KܿЁHQg\Ϯ -ɽqp1[ > j 3~*W09} m:ZxbG[6DADB?}r4\,)Hj-Fv<.;$(='K$!gSS(+C.E(CߝuXۧp {-S9!qsRL4պ)8'F73[86Jm_ lVǵϲF1/kHdp 4W=:k1O"@{Ѧ&Ptnv1y;p<{|b;{@B\V1D@vbDIp879W&aہp7]lYtDŠH&4 Pp{}%ЭQ7qb#͖Ejڎ]uܡ/wyk֞y%xvRag6*V-iw NkwzÂ#3AM}1ydkNȵ N ꀰY*Ha$I*Yn!0[@N)12%,CI,:_ɳH]L!d DEGNk:O8<4*CrI DdƘQ+`$;tC{tx`QqGdҰڍ?~( 6٫LѫX ܠ=,|N6{F%R,~jC,x!ޅ`-ƨuR!DׯT@ 2ƒɺ>p~kTeW`hH{HU_2zalQb%"{RSr_HkuNi:ST hg}I @Zb*cÖANCtn bX>hkдA+tѫdmxyd9A`:CsƶͮFG(Al1aPӂgB-e+I@Ht~;aef>m[;$HHu xC?`qY0)yl|2ǁxqcb׆I^ Y8z+DBZMN+#^iq p]Ď~SE9>Z[m״=Ȏi󁻶$QRVj=ḖWs{@,oY\`m1 Ps-Q1wpw~4"_L ڵͳVZ0#ݚth[, |v1aRf15#22*ϸݾu4jr:KP8^h6 b75(o8 P}$7_e!rI ރ 2>D@8bdN, xصQANϡ]1ZiD$[}p1ٯ:j ~n42c2jPv6pO+(~Mp+SAK/kQMgz Vpu/ e>و_Q/{×6hzEz|Z:8SL,YRd6G9BΛkmSBNXA&VmHex"kjhZkjbL>!=yn+xcDb)p;NtK"i%v#*L{DVCgZ#jC%CK)񏘵g\v]$㛪'j¨g4D%ǂh!ڡx* j F2C{Yi9ܮOd\LFTXc@dC=?f-ʥ`Y 2.\J%,go[]ŜW W`ɸH}oqumKI?S{-x}6;-!xiN\5c[YX[!y%H` ei&lu?MirꑍFB8Rشn\~o+տ[1XPX+aBnٲxzyKUP&x|9,+n1 XZ,lvd1'}DG\0Aޚ|(*-' o{W%lR\ \CVKjd%{ޔƎh_Mk9g/thaw~8C- ȤF^ Bbv;}L(D/+pŸCWЫ=o3C}rԪ2T}kI5ʋQG*Yy96պMsmyȂSMރ_uF8vH*m1n/"i.zpvqͿ)/RZa뭀ݖGE+viqµ`x QFea3<36}͙yviN}[#+H|g+vňய"UkZ\6m@VܜMcZr,z^h> :(wkD\5LJ-)hf#!^֝9eva'Jcxy>gnO >yUjUܡODTiAꍋʊ{ʍaӞGɉ[+PnjmeO_ۉ(e9ySal+jSa2,j-;^+~0]*_-M8R!3V1@;Y9v:hX{H!!6ǺFATPX0φ4YU%g_b$ RB>zb)~3%\*<=R88 I/WZ,a50w"@<^es ڏj$W&}8ڮ,H.&09egfV4(b0E-ArNP .|Tm*M㒉%lěL@a6 :)M:7@pT@~]~s3-`. Glum+IۋU?fv J IDrƾyboBʪ݄$Hib7ly;/JǛ,%dچgi >2ȁѪ,|?#'IBЩH=<]u t v4aI]OUPgDǻAȴ[u 1ЮBeiυ_۫҄3琙k23>DI?,vg)N?5kyu?j'ްSE67SݣXR!}ܨF*޺Nwd^"4|#ָsH&8Lq$;B ߁IUւn<ۨ%"0LM+_Q Y=sH@:$FIXT\/=(?G)wjAAœz,!fi-go><(q!д* G( DP4RHKc^(?=X"#NzH%2"6NO>1lh*G IOI8$L1Ǭ،mg6eJ9f\9;$0j5Av0Aӟ?z'4'b}+\/]t1!I4eu4\TP .ҝP|J"C3U|7a>#X[k&L Kn"co2n>ŲUnd5}njMA%'__۴8?6-B-#ey>hք?~bfTnjnxt]Zjo+CA.ۃ +㏖l )uRMƃtz1y0e-#K#qΪznf9%5(X BF@.@Y@D[sI/M(֠Gf:1>DÈ֊;33z[4h{ pv6a-7cNXEDq1`VOfd ^7t i 2 i(3݄stA?Vǃ-IilQ#;u!Ë8dv~ꁾאLːj**n+xY!;'0Gϩzd" KUOuMbH#grkRbSGBm`lZ Qr8bvw}Զn6I`^0ij9 Koc 7]͓08^ET ڊbS\'P6}#h/$kø^G"@6bb\f, sZ>8-IUX)^ĐE'ݼޣbR|f? Iqe&r"iSc҈ jYيp$Oݿ\ Pe8R;C@>4 Vazh0py@jT.iv `I{6;gdcFV҈qRIjpew[ iIɵ#*J2y3$s{VDVG~W)6k;1P -8-Fp˯ ^,Gtp2Br0T IHjb. - Ps<5F8\[D({Aڪٷ_u{EqO&8;o$m1}<גGt6N!>Zg֫df@=cF#zd*H]PȟTu|Z>ocnu;ƮHLr k}LGEޑ&3YU!m$`ĸ q#8(sK644[nP&gu9<Q'$#CRƪBh552%\;ήݿ\x 6>^5qoӕj0lR#QriMةM|vFKջU>J:cKDz \_fAκ,*+ *[+ŽMrShod;:Kh`iAxm~j ੸RY. n;:7 R*!ɴe^W(7 ٍ3?сmv X} jtj>NE-#i-ȲFYYkGTT,{,8љ)OXRsos[~ᅬ ρXG`!e5ѸߔdN 8dR9ϝ4b8FSiy-8[v.scWc QwQ92:xPp 1\I= Vrk>bT%j5v.3}idIy~]ez {D0Ց%F{۬2YLIlp%È!3vnl@ bBȯ$ a(IY + hEΙs0Dp|Bjjw:ƴ[T9ȗ;gfDAi[Ebs|[2ȐkVAHs;W/!mv(!O+X2UPӖdR5p77g>T??U#xi7H%!)mO?Q>6=9绡q @ΐ,&Ѵfs=oGQ4BZ-*JߩĪ/zhj CQ;J5op"e3_E'o}fnP@|Nb,zS]$ogK8n̦~W5dHJv\#v z-j1U0'"rL- QTD4֯QXԛ+aГBPHW|^&b_WF'pħ)^lE@]C+Ϳ@UHz( hMyVڇ.#+9'G: g!ḰRxoq$\A68h\{z248o{Ӟ#\MKZ0ҩ9c.{` -2d;ekekۼ~8tn? 6CRXG~:Q" ﵙ H3gDpw^ErLj]nMU zı7<224aY,M=47 th<_{llU`(ߵ&ԡ:\isx=^b246Sʰ lg[@y'A-{ Jv(FRK[5:$v7kY:{N0Ƨ/prb3aYJ q`Rhx 7XABlx~%dHioQ  ܰ 73HEk$_`鴮{zr%ry9T pb7:t-_sSȜjy)3J4 B1ڭŸg5 %?\a4_֣~A(h 6ń8۝aơF#Ul|M08Kux,pu{9i5zZ6( `ϐ$cF'Nv$r'5lfk1еȇFKc9*kRd%U6X&j2[j9 (>=AJ^?B.B%ճPoBD¥(! @Rz&#`eHV nQeAU->8(nL,L⒇%Kcpq%!\kD]jsԔ )YHO aa1̪f=_?SP ©9?^#%TҰ 3 6Acy4Hw$Rm Ok [4v=X_'~{ȑh~01Y%#y,-!ZϳM=ivv;Ǩw?FWjNQn.sy61qO0iDQ;Υ%lHx*lyy=XO!z>wƧNƪ*u>"[P'!g :]9O-ޡzE<ҿR˟f&-r16x TuJ*>qN~_acHvh:0~E:(DTAY ߋڂ{B}>"x&;8I]9Nrz&j-D0.J? zQŅ2d~d]RvH|UwZ b?K;՚bE,W!؃D|H%ήoTPo˜Wju#f͆f=}iM  !H7fȵ,I{Vk J> -rR̐zvPNX=AgǗ"S_J=\[LR$~h)hիw+ ]P(ݷy3e)gJ} jpf .-y2Aۤ5bzkwt67%|ɸ_EG#sa3#]-nyItYi@+dZ%M!FcoVsA&s[s{03 n a Tm@nމѩ:2/=#+Rj+NU:!3*#85ҹL >KT|ÜDiX:|H+.p^qB B@YjO|hCIݣ4i{B Зk>mGyQ^$hz`E=:E_%S[cKRH7s!KQ= $iܺaP$犿Лr/v9D[be3TLl(U"<2u\)CE,H`Hd32]<TCuuAv3!j X9mƃ(>ʱ-0@Mb[# Nfޓeٙ)1Jbp i|f(\|ko)I^~Ղra}2R0J̓yaySEb@K]/wN%IJqZ8NA^rJvm 1eC.B/kW#sXKǶ %|k+~$\Nd:1LF;^E~@]#0Vv+أ8[^bB j)^zAЃL >ʜqg۱_y΃Z)Fy( ! }\4'=:hط1S~N32S,GWXB/\IYp-417rKזU򂃾'mȸ6hA˝;Twfz:]e [KIAM)WۻQMQD ۄF1ܮsL7Q7 ҋaWs(}vBE^+m'a"Gm!en:3-HwKR9U:9f*'m0R{f{ii׌FyGxֱG!Y~@>nZ=.Bm_(}n}ъwU gU|\)3\ )"fr1m2p1gzW2n>);ٰI \Ѳѳ|uߕO܅l'hx88˩y91>2Aln%IPy@N +*}jW h{Z4xz%Q;~4Wî up; .gc0mJt uQxp{zOa0WMLoGP"0Rp(fUl_RG-z4'".j:El~+UjUUw>no$D694tґ2t\$0'i{V"$~^xmsb7Zwz2䧧idB*M'hp!9㠮2&ǻ`~ڴ ji0 qߟ8SU+ 2ܗ!PDžS Ř[sM|({i&"i$csfQnYB%9z;4H j?ZTCĺ}'IBW@JB3+@ I'C s+l1Cľ q3Mk [yɮ_Xj^/0j^ײ吳$8uGDu)sM$_$pEkI0'UG`%0 gJN v(ѴlDA~,MCu}s4M yO!kk%Wc%'cX[:q< W&Y0;)h9QX7?{#h‚ÜUȂ<2m^VexN2ܒwխZEG3wy2viZ@r̓0sذe|ǔ3 yvnNuڎ9\}whׇ1D&LvJVr,)RC Oʦ#;˜>Sb_T&F_pMm| \`{+#/}/EU#b^e ;Z1:38dME*:Pe cLNN/ _ՁV`,Y7# #3/m̔F* ,׫ny+"?e=X؅,R04=4\iŘyv>y`Ue%u(dD 9'm$`^bJ}³w֡@7.#$_| u@90Ԙ@|^jef`"d/IcY 0r&:au_lr "#^Un u 3>:Clŗ唀mo1?ν{?woL\y羯iOb7Ⱥ ;; $"cQqjGVdL[ :)߶R铚qKw=Y*z J`6?_ bϑ` aQ{[)f|^p)?ۤHHtX27_ىhj򶰔ߊш x)偃zw D< qtKAJ(@Z R]~O3 6wGghv27w>-)=;G;iZo}G)Cn_3 Z2fp& HP S:_e2S;9-~ tx18[h,o}`LI#z):SuuƅD4&ȁ`ia25 :NYW)Z8-{ΕȔЈĈk*DF.~BHS+ش@^.x+ 8mV֦'VS]THTHFwy~w*h1t"kTCBɇ[R HmJMIqNm$Hfmռe}-/)z5R26(I̷4|uы?59p!C02q~dѽ:C{@n95*_)\ _rPC ]|0xkXګoG6@-O\J w5R]5}13=e quf2S #K*Fj_(^Mj mW ⼏ck\9^x ܧ8g mnw@bpӰ)6MP@$)NV1@]BJ jP2m6Ƒ]w|ONpzY G9X)CǍqaq f?<~[\Nw8lvi2*(aЋ`s NJ. R=\206'%Khv(re3pt(dn?튻I֬{X-w h_v 7זؼEjLnRBs1]\-;a(-(fhTs;PQB4bsԀ~UXJ̦mE;ЏFTl?F#4*7L4meuėwYތ\t6YL_L~-TwRJ>jXr-T 34;}EHCƌq g v@o0*Ʋ>7hbsx )=銶IFeYҙyT.}VW)|i[jBVPiRoOdKIA-qV]/Hp6)4Vys!0V@B!?2a/u# jFX!P$qeW2(]4NCX&)Yq%#_BmCPU\+7amO[ WA>v67(E rÉ0IMf.jg4zz6Ӑqf k8xGsN4z6[|ܟY0n5X:4"z^fc2RiC}dQ|qv?9N̤FkB>H{7CIsشԁ%ckFtOb] Ґt_7 i wof;s|vAϵڠT1fvئU"C=fc"!ծbDmAt͔@*(JoLm!bDRyHP_>zC޿S2_ʸS@!^6 7+cc .UHA];%_}ch0ENqC5T-_nYnԠ q Z5jaL`~$2-¥!\p!ǀYw:m-Ej|xLq!asB- ["[/k">#>VZct-! rwȎg\Yid!SH_Eu }O8"~iXRO2[[t3 <諤hj#?{d蟕YS)vy#z+#p\ˤfiNp1|K^aG dy`v7s@LlDUZh\Hyސ_T-m}k-<=|#/edP06< {d~@fyO\!=ο3dd&l81/O% $.a:q9ոU]'Hlg1@1-O [NoEdF?^da!9<7pR$"]SRԯ]|p3 66ir*Te(.g>sT;ϣS ,I٤ŚJ#v#1Wc?*X^PP&/mIGD#vMWu 1`HE$I>|Q~ɪngh/azfKa@v}֛r4  hݷ7UCP.6=J"=|lEѕSex d ֍ܫiYf* 9D½ߌD9hQLNgO+SBܨLm>X.x{W@^JyO}K/( =b>kG6&n`Îwik%:` ąT΍~$(jre@%2`߃$IAFnx |FDF)QL?͎CSwȀ X B`5fqϣX7T $>dF?$$ nyvߪU"+OI5}fY,o0*<~K^?{H=;Q,s>QݭV-w՗so ~ 1T$8s( U5gN=a rWqE/ x0m{N@zsGCrnDpaBP|Sg8'L])^.^KFU5lFq.-oMzN.{$H]оfT( ݝl>h/9oD.6!j8H<$ n*L=I)նP +&QEKAjWKǴQc3[6v]2wE,1#;O?L< LZ/Opllz$)k1u*GQQ.t;ZKr^+RPQ~ݺsax;/bM/C3t 8i`vDPͯVWm {!Khkm1 s `F ]^@0t=nbլbJ"Ѷ>q37P16b~g<~\daR&&k}T=~Bq'qmbCT&Ѣ$˯@8ˏƨ4p13Jx,>18}
    _ P$+MvC'46]g-j*#%L 3)2>wt}i1f?֖3t_UD[ֶp|@ >CCd 'ɩxG)Q]H¿9<`J&~X<.љ{=' 5@{g+LlӦ%E1$*fGZlJ׷j 9St+}ș[L$:Q._'ۚI)x$[lYTGAN4IV.^z+Fr]EjeJ1}+C<کܜ/V\ˀ΋"E;6Ұar1FwbG6Dq?M!ɠՔ}rjKKBa>u޴CJ ᫓PV/8 Ʒʆ8G>h}${eku0{kV>|PK4O,7{VPէAQq\;a4Q[a\pű'\kU 0viߣ~ )_"I恁qs0Su7Dـ&TTR@i>/ gF*9yCa|}0'!zlWj)u0t8[6omR*܆ xK,$O(M~M2S~L;{ f#LETvjfs+u ]L:;Z D>aG2GJoəmSr[3~Ԯ)A1XD &gPaJ::`U@-% cIzHE v_K.Gs[ȖxZ_F*+b/So#Qm I#0i_V;X7Z|W-JkuҜ-_7[gucYDy\e5{G)9.܃M~80hgm8rI󁠋}$Rnxb'{-O-& CW bF"O@zH/ԛZb=fh<\" ״'tӵ!v7o?oĈK]Pښw`jB"ֹ;򜾌)%]-wTZfŭyu<)9#sGO`pm;put4s_'!~+!|ԧ_4[Bn5H8vP睅bLɱ+wR4e+b3K3.[!1['2v}`W~|V16픜9﹋drp/㰞+4#Bf@Zd.ZSg*%m͂%W2X'bm>I췙䃠(Sa1ބaP|Lj 97avq~n t(=w > MIqٿ۵8 {ƿ`vXu-:y&[x A扜'( ̏37Lͨu!_g_\ iN2P޲zlOαqM&7&r\#z W9 +YHFt-8{A'|zvڑndptB*ԩh^YtQcvYw Rf 9Z0X.Lވ|]*d+oìg-n]V>@TO^xs`gလ&SoEcd &}&lڦJ|)|ռ9TN» ~'3UV񔠱 #NE%Z2#M:8X`YWj*j7AiO$q 'Y}:;6ٓvL4v te~k$3bR֟P cq\fĢJٱ'{? ERv;Z2v b -\m0DtCo1zyƮ=a1>*=dF/dDf@3Tv.u6!Ԉ~1066K\V'ne6ݎ\"ۀ ?½(eO:Ͳ3: <=)B8rXCdN8 $](.c&xx^) |pNn#:0&^,V)DA@ϴA_C#^CB^_uܛdaEh@O#&w2MxC z1:*{W?O5ӬTX_Pe{enݥn.K=sIzΓFBSJm+ i m2 iB1sع{Qq5C34+{Ӓj. ix1cBCJX@1L1U/ ."}[lCI82B,ՠԿ,B\B/f˗$a)贈W%^s:q@UfxK+&v?n M?ܲBLHYA{V(V:g"W6&Z׋_Jmo*8x}~M_QJ H,߁P!ED8gݔR~(ʦYv F΁QJt/m3]l.{s/2G +0п0fo)}si8㌰A~0$=h;ʍ.duAZܦ{]RB,O& &.(<<$xgc)NsPi">p40AcpхT܌eΤFD$Fߦ9[UYxyZ`"R"I}ePnLB_Y}c.7İR39D spzFbX4ȹ`,|qmINMM(F)u=^,ȉFСUzft-&oI ]Zlnn 1TI':ͦHɏޡ{T%.ciCNG}ǝDHM[YxȔDQE7) %5Y$t;~qtOI *Qu\7JeOK"Rcaa\(%@&)d}tӱ*k `*Ø95!dͅ2~s5ݏ7>NU pxCwr#Vrَ9kk$S>Srh,A<,P,Chs" LR۝n@~nkogGSpU/ݫ3ş 瑋b[0>ڝ`~}vLU!]'qȆ N;*֙e,ba[uÒ%&C,^F7./[=uIvtoY!4p]S s 7?b ټ+:WٍÎAʢ" '~ru?^*(gp.E|5GE7 \úw=^AZ{|n@m\Mk+L pk\ \@>J\}-l4`< 9[Yסu)W(iXc{@˕$ y1ɦ6 @UTBfqvwn<f7U$ rt/w.PЯ^yq){r|P֣&6:8kϡr=v`32tot^V{iSM'CV! ۛ2(H'%inD"|M.O)$x{ DU?9c3-:>R*y>b`0tbl̅NaKUy([T|QXCˮ}GڿÁ[WL5 ,_z)l,FuYNpUmY ?P4a=;oP0~ CȨZt[gUA0qLN=~{XiZdP U$6YDŽ-&-Mgkר-675Q7.^ >2u)$^aK0K%> COh/cm]˓VH vl sؼJf &scNal ʗ&uF^ Ւ#f&^bW*~~q}^Eنp|uw"Bx-ߢBqe9q{|#SqQLKbBƭ5ԋW'paWC!ѐ=m<8~p"(\ڸͽGuۭ 8HلZ_gQ`&|JgY-Vʼnwi ml6۔M:tV yŘ˶G;B\? ]j0kEpɁ/$:#7\ՖŚ=p["&io @568BmS]ԥ9&Df/@@iEI( ⇝Gc!gS utFiQh%ey{cZTN F"1 3s`I[ċտYw|>~1CYj]%B :1RQ!6)kV#jʏ$-}쮕>ffTP0a7^[ G2_ 虈9ik_VsD}] /,>$KٱCRGŚhNsf3P4&.ad<ؚ0 bf[ʪҢ_ xuN$Z ˮ{6!Q2aUky@96 g;8wH\!p:3TOmʒhSEG`ҟ'!VW0Y]Я;*Ns҉ B|w&m Isl>P0Y (lo[ Y"G6E;bR@o[z lt0 xߧwYx;s-% 8ePif@k<" N:xPB@P5ԍGaqcQFOU^VwFWɚ?in4 PS% 3zN"sG~)eE5Uwd)Sرh$Hgp,Xy2Uܲfht曨QhoRSސ(-`ݨMʗ4V0Ɯ2 ?d@rMC#^|؃އ/;F [U\L%s@1AC`%aGbGE<_|]<'p“Y!>AljnTZsF0>sGd-5$XishnJ7ę}v2%V(ǫDH W :r-uJW-|=qʕ'$cP}r€`х7$Ipm*4U>Rv,:=}QWH.-*B}1QD\"@(x̷J{~̼MSoRuO8+'u:R&/-$mXN=TkGEٰ7d qH9-ٿ3. 6E弮+T}kn <CSHk 3Hp1&Ž8ȸ7Q[_">1 ##b(Kpe=1E'vE)E (SV$?o4ntT@^SWo6-ӆz&Ϙ|b?43( x? 6:GE[UmHw39:UJj6dhUQT!Pryu^m˲6->!c<7/#"{  ҄iņUZ]f]oTVE"["KrN)њ,YoYOڥ!7LE @KG#FX_N@ZY^̲w~ y& JV2XU=VYuUkq֨^L&|L6hܗ>{Lx R)F,Wk*,ߴÚXo$GP5C;OFRqkJYA2@y +9?Ì2HH$\BWvawfPQfnqUE]"H7Bner3dOlnۭE oa.T,dWN8SFrvMlY )q}z={]l* mbY}ht$/OzY{B[Zbk_A8NVwHQ b(oS΍FM@ 7Docm c:bA ՟G@+SQ2gH=F Mj5d-+yWNKI@e<:WWȽ(/= x?FXʃ ꩤ";W bmv~SIccʞ`ȴlMqخ=nU 44gK紽186gtu40 JuwE_? Wxi,ẀH@GnrAP?ȭUVĝi^7UY2vb';뇈2u޷]jᆱkD%G ֎Kzz2<ߠ!)yb~Wc:~09P:R3h' sXFk)u3"t\m=gpHgSjhN\W|z6ARƴhXoHnkH҆b\E+Pz#_6rGTB\SdatCՂ٬kS[fر ٖ=2$v0VmN E҂vvlmaLI~ 4C]t)Ig#$ʼ*Ngz|[+jόfՅ(EB"Yd86NhY$0(e!IMMɯM!v Y'r(:?lcBi'(KR8u Lgxg˾/'Ă@)tporT>$n}C;6Ҥ(erhcD"eV}8TA϶ uW$c_ SJG-yE!-\oZ%f{\X6 Lk/ʮcPBd3ʔ.6¡-[$Ӏz2 6u2 B/}4SV⑂A;'~d+/Q4~;S:F\|hG0tzTs'PlmAzɅ"}le@Kzg="grbR4Z=2`^(:6G OIV%ny!`ZVjMftI:ʔ bJ纠cNRRxj>)N8tWYa +E1Ք:[g1~HnQ0BרG%jY;]պ;} f$:nY0ԇ:r 6ʑ XTv̥45qx=r ON k=P}>g>{_ }(ĭa{FLRsJ"W#䧻&B{w?Kqȕn3!蕨xC{ȈTw8-+ і[h969;&|ɚˎ߸4~ ̘Nw>QxT$'4pA羋Gx@Epiݷx0w0}";4_ #ٗށBL/oT*ޫKSyD.8`b[xj*y=F2ԕ{5ѿfA3ΛK1 k\hvb*@tm8RYjJ6 v{|d7Rbh7eDhhtwpU[3xe8o{7*OaUT3 GfC1ɧO J2: ./Vou}>k?2r`7%]aM!_&"a0"0\k[pX.Qu)H? 2&l6̋%I(;&q0S=7\on3qP^BPY*R\ˀ c^D(X$\t4F5iX ${ =~|sô&?:(Ƅ4gWz:8OCxx 2jA]A^46׊.{+TQZk}mz=l+ Dڶ~9j,K 6 툤VG:άd5snw%ӺJ!t0Mv4=V8\7F r"T,Xljӥ2bUR e|Nbmn+k59K=npWo2-cXޓK1ؘe՞Ő5fT`N>g8qΝ\s| B8oŅ(k ژP[(O M:rS@ފ`&kBxyR8.nQCKv!}mkfF>mr_3^V<}( J " JǭHv8`AA̬twGr]ٗ}MUsY6\6Jr zINXnobW9ERP)/£c8H!QCuFҹ͋qH;L4^xϛ%-; G+-*Ɔz#ap}Ȅ,uR5lýSIRܓ][(M}cDT#YkdNCPT@qcϡPlyFm؞ 6&S1!K*o4z#uP/ y!ŞCsNt"9guP4LXr{lhU1=ц WHN s;@X^:`5?ٮ}FpK%Y*7զIśت* bƗ\5@JMu>zƜl|zaV= |K~d2,/ Oz؛ &fȺ&`wh޲Rl8ݯV*ʾ5W3&]1VHgY^JM h/iSv{c߮CTފaJ 00ut˚!DF7_.Z 6-z*j2i*,id/ ~8F^4\p128v S+D)(#s"4?')Yy7dFÕJve=*͑$ge:/ЄNRAMLEw댍1JkG"/ fA'Rx)Z!Q{֮vȱ9I J{ցFY~ Ч#:@8ع#s=8RKO33lDo&޶n!;`Z59?`AMtpCba~b`\p!h/[=l.}. 3U5믛 WG=V'V7<2/TUw"W2 8:s F*p]uI/)J .c™,?؊ŜS5V-a{).. Fge|߿9| J*xAWȈrn$8 ]Vʤi( 졭`OE4ϵf V\5l]-2s˭=Z>>볣oY8j^f6ϑe6><9pѶ+ wOMA'~1` Mը !"e6=۩w߹^bw0Q*3KOrvQ\v(/DF.6zb'L[>ذ.Hz)Ւ%Ѝ3 "’F q*3[ai[^' Dr"mABƶ@‹ CyϪ-N.^NY7Cxf'ҔM JPm>'^-'|L&؃1T㬝. /R|S@ޥ cX4AvZ$~ /S˯ݭbZcEd96Έj+˺eB99<@xf!r4-" . "E穕ZJb؅.گ3^s<f!O 3;:o6}~h̾mG<< M+Ԥ_\ϊ>k;1QU ="E٤i sJ^fi2V^3eWvi / %;|e @CK~~ r'DYAiiQBNxT%Ɛ)$Oy{5RPBg{;~x|7˚BAseW}κOtW)m}CƷN`=Efȩq t)_*0Ƞ6m&;Xʹcy8)lD0,ܴ@%yOvB@FY3WF5nщGb8c F ?<ܲ ak#I~C?2 3,<޿@-P$o$Z ~oҹ#kࣿQ3'YT\nyt<.%~h0LX0G:5ρ@ HJߔeqiAOY{nhҀlLx `oF"`/N֊,CG #`$ /L5\%7\]JC9 E* ^ ^q!Ǵ,>I MVf谐QA> ,ìf56x~'2|u|&F,Ъxu"a2$jJ KR!Z ȝ;2>ħ@-곌Ϲ` hUGCLinD~NDW߼kVNZqSS?NGfS(۸i9~NNvGԁkK;ԭ 2h^܄oè˅ E`E0BKcP*%H0mn"SHu *I*h캲sWΗ.KW嗝pǐf G16ׅǎWYI 3K \ \u-J[ c TZyT:L\#La|J:Qu^$㥿]RØĆ?} 褑 }ZigBP`R>:ys5$}[ #*uRQ0\ OKxוI2̎LoG6WE/`XQ.r+"Z#>Z_J&u˖?smiHk',=G6Ǻ'v%;}Nk@gю*k9ވM,~03̘VueֵR*(->;4Ϊ?,"̸o.tCO0vp-oD٫!K>'xΑ&hDfƝHjׁ~ce-A)TziH-P;gqN _አg#1GY%Ӭwe t'Ic kI JAl(ҷJH3/sSzgkjC/22}xiU x]~H [:VW1 !t>(V)ԋD&BM(viEԡ;%g_E's$7Hp>\SwZ>=-7/sl4޻%\iT;FzvdX#Y3qDSn ljZYa硔|e =~'o9Eȋ-()mrz;4*7?NU^K_}^V}+Rb{`{Z_ g~*+ѾgX9iHaZC]L]M' r(WU ӊG@M I+n[$D?>24\2|N[W>+.ޒ[%*"~S  <-Y qFY BdF&raymO7رԆw@b')tm.pj#SI wԤ:z ;ĝ c~?*OJ?4FCu,+R}2p0.'=5QRqREλ{@@*DP Ȕ-4-bu}`?^IENph.6ϵ۳6XM7q hxМGaKBWPAʫl"_%(',VK:-: ﰴCp[612ۦ?|$sw؋e?n0?iF}"EDF,SU(ݵ](@ݷ=n+WǛ%x>"PEH:LKvzX5~ Hy@﵀$%XO{[àaafg!)LE@)ky{E^S&;J9 cEQC\#QN 9;ܞr }|q',4b)8󰕫.L 1$`ϝNъHH>TH~/+4Pg 7[9l_ҖJ>ﵘc$(uw|Դ[]Rd %& ^g0 .ꀏ;rp` t;/XC]%/e,CSM&DS_)5SմxZ/; YXt'TY-HW'=,P[|~?"&d#dN̘G@I*ph%[9&nWAqf}v~NXNqN.R4fcA,V' %Lk4&ؗܪ G;o`edQ`xMn hIͷ":uT$QaMJB?;M<~A틈$} L6{(T,B IZ45ҟ|;|a8B`zԬP׺{!} i N _J7/]ScϝvgG c5 IJ~]WAX0_n>px}!Dn̽=ߎ~9)#M zV:hl a3$oxfҢaҎ׾_MT3KY_uαFeb-$xā+tT :|Si I*A >&ZSMϫ.TSl1<$87YhG|7p7 ES'RRҴ7B݂O$XHp+9&շ;2A:+pM9|[.1&m3Q/)/PMJ/#ջ3Se|>`3)%Q+F  :ȸ4jOIehXbS"}}X׺e;=(MIx6~Wizg )}D$@d5O >P3xaD!\B KM,3%KqkI2t=觻9ߑvQ=X3E']f1_1GV.Ac H75?~?Jj@FPueԈvYH4"5bzJ񿚱ǐeEL7-V?E4i`$!mݵέ-WH*vB[Fx!C3z#v9ipډ&Ww`m'iS4 feƂڽQS0 #]ypy} hdńmSa~Q#\"u, &o?a*\L DsqzLD&g,5(԰K7{-Z˸OB>(9i!=8*+ҙ[S؝;E_?(bGWT&TV(eYuBd. pΘ?'[ρdvZir:O&m39sT#h Ĝ Ǭv8(.l?i]{\&5gv!i=ngGqqkcFQy*H7ulK}B*kD|SZLxq)*(l^9Bst ;ɎP_2$*JGO6Jv wksgY!Sk,8ZpT jbgoy$O*(Aόec=b+E*k& GRQ [ڹ; 6wq+7#CX'X?l.ZD3U2;@YH8? YYJ`.ӺA-c@oO4]r_C1m]߬Bv ٻuD] >xmnX}2ACIye)31Ab+ aǯ3B iBI,Βci'iݳ9 `|o?t#%}觞D>&N68gQ#)_sLF YPYž[7^x<9pA c7c5ɩ҂ЍJչ5b>>BѦ{ǘ0'j<#YN\#\w| %9pd˩7偨;F 0Z Й1%LNz3q Q'd<&>1+IS.c:P .0*@ yǙ'`=LMQqf833 fӱf*G0.f^26䛥]w?}jΒ9Ѧ{Ac_'cx:~?byaX""ӷMFtn{WLDQk dezs*6?ɇ[yh *ZܳSx)͒i@HֵurI&ɳ%hNAC#I).;[$wDiϱZf]hg:2`[15z\@N|GfE4|B uNǭNs1.|La2,*T d dI=]r 8α -Bȴ\+c@yv"9yQw5r< uLˢcwfL1r>"AEiw<6.qz݀A2Tf>W]3٫眑?թT_J\ 6-{k7գ~P~\;]kI92M孢)t}#(Л9_cPj ,Nr-[e F|X{gG2~k̛ Іҽٌ 7?O٤L`!17jڷIэ(HeR{ph""ehcQ*RgQSb֚- BgF4:eF5R!LG0k7)=R|HV䏡bEHT@Գ(~, 0g9{tΐBAk =.̅YS3݁@>Ų4[q8D/Svqm`dbzRR&VI/)S 4JжLmӑ~3{TҲ q;hD-p} zJTvGm/!J۫vHʬEp'着١bDG-!,M"_l4n,$:>UH*Oٛ,G:-JAA-bc JNS88unpkW ?^#AQb6JؾE-E+t ]թ7~pr=>Uqvk&\N H,xͱeg!lFH9`Snw> #fC4`]e뵛9Bl/,yO c N FdI~H3x.\~WSUvI6b$(CVs;p8߭)Oޣa\ܳrSGdA?s!>`Q`rgU8u]S7yZP#. %4pK܏sC5W>[Y[~B:x Q092IUݣkXLle#2ڪQ _3Hwʽz,Hăl[~ pLҰ>~ ZMaG; kY^ϸ b߈J xDHNpTB*`Y"yj#`v(w`( ^:aw.l-+R@!3y rx Lb55\ Á,V>a<_0K 鉗s6[cԥH鷻yA8 ޡqNpa1QpB'Xۮeۅw' 7i⾕T U_P4Æ~ٱsAk2ʪYO9yЗp\%A)ꄺK-Wm5ǠI6C(V45{r\6#"5[.GeBx8g˞+dd,cN/\>RC%椠X\k 8z~lyC΄6Y<>􆯙 jt֤3_xRi'Đl~ϸ)լINӬv+ .cZ)~jSF7\|cR<6a:{͸:vz 8 V#C?>B6UAu AVAs&NNwu¤1 %r. zFy۫ QRٛK l"]^NA V1 㡤"do\ȯC3pl7 >Ø5npN8+l)tŵL ]5qt~Sc|3hH.4yY65LƆG܁7j0"㥀CBwhk( @瓋Kl~;eؕՓ1/==p;p2f6 oeu]]@#IQ1F0Q'?@մ ݶn5u&K;nQ4^LņMg fJE[1ҖQI%ђP ]eUJ:QZ  YZ