samba-winbind-4.15.13+git.591.ab36624310c-150400.3.19.1 >  A cm]p9|in2| 0f׀etN< ^@y?n8bv qNNtZ8u(Jg*m@:qWW^$%X v"Sao(iD5jF-%|u:Bjg|1wʎK?I4+8Iz*H*7K&ȿ?d-L<ՃXwЌ6^\dBld:1* HQ1 cO;ThE^_܃D|1e696601a793c364d3633bf7bb875ecd01c26a34ac3035d8f66cc22feecded6463754a83f9f500c546105320bb5e76d42c79596c{`cm]p9|vۥdYN<>&U0:a󆊌`!)dd;C b[`mkYEϊ)\o1SoUWj-^ǠKVBCF Qx_ׯT?p@q3[X@:`ha2-\oC jVַ2IDl~lNۭtopvk{L ,s-1zBQH>i0LyoF=>pLp?pxd, : R .4:,/\ ~    T<H9(:8:9><:O=c5>c=?cE@cMBcUFciGcHcIdXdYd,Zd[d\d]e^fbg0cgdhYeh^fhalhcuhtvh wkxl0yltzoooopp,p2ptCsamba-winbind4.15.13+git.591.ab36624310c150400.3.19.1Winbind Daemon and ToolThis is the winbind-daemon and the wbinfo-tool.cls390zp35|SUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxs390x# we need this group for squid (ntlmauth) # read access to /var/lib/samba/winbindd_privileged getent group winbind >/dev/null || groupadd -r winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in winbind.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi/sbin/ldconfig if test ${1:-0} -eq 1; then ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-down.d/55-samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-up.d/55-samba-winbindd else for if_case in if-down.d if-up.d; do test -h /etc/sysconfig/network/${if_case}/samba-winbindd || \ continue rm -f /etc/sysconfig/network/${if_case}/samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/${if_case}/55-samba-winbindd done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in winbind.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] && /usr/bin/systemd-tmpfiles --create samba.conf || : PNAME=samba SUBPNAME=-winbind SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable winbind.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop winbind.service ) || : fi/sbin/ldconfig if [ $1 -eq 0 ]; then /usr/sbin/pam-config --delete --winbind if [ -x /usr/sbin/nscd ]; then /usr/sbin/nscd -i passwd /usr/sbin/nscd -i group fi fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in winbind.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart winbind.service ) || : fi fi<rHX%"0H^큤큤AAclpclpclpclpclpcltcltcjclpclwclpckckckclpcl cl dbd95eb7e0d1e8c973d39fb53be9be46276b21bcacd8b0ae1adeeb63651f6fbea676af835bac5e037fd6f6d9950ea49ff3f39bc693d479069190927c1c53083993a1caa0988f1da58a965d7a954f36d791af7b63f8f4d458a49b7b48dedc7909c5d837e1dfcaf8a17daec85c79fb8e433bfaf5912a0821c7829f3af082a3d2dd3023eff2d1353d34da18a6cf7991109b02d30cc99a3555686a3d2cec61cc762e48c787a47c3127f9c5fdde2848eeac71a06e22cbf997c132d74ada549c086e0d4d6f996c14982275976bf27ee386e3e456a10ec9df209e6740788edae80a64ce9a16eb3e6b8e2bf0b1ee56f8a98e8ed307633badc5f3c02d8a82a4293ea47439f9c04cf2ec03d3b174d7de509012ec921bfeaa95ca20b65ab05424b802d88e7ef988b54dc9ae13ef3cc2f69782b94d544d036d80db8dacea5b1c8dbc09630a631b71143ed8f12824b359ee2cac95f72bb8fa058be643cc368c8d04021d36eed3c6b4b0325dd3211474ac785379683cc4e7f17e211327fb9d536c1ff9138de03eservice@@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootwinbindsamba-4.15.13+git.591.ab36624310c-150400.3.19.1.src.rpmconfig(samba-winbind)samba-client:/usr/sbin/winbinddsamba-winbindsamba-winbind(s390-64)@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/sbin/ldconfig/sbin/ldconfig/usr/sbin/groupaddconfig(samba-winbind)coreutilslibMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.2.1)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libc.so.6(GLIBC_2.8)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.2()(64bit)libndr.so.2(NDR_0.0.1)(64bit)libndr.so.2(NDR_0.0.4)(64bit)libndr.so.2(NDR_0.2.0)(64bit)libnpa-tstream-samba4.so()(64bit)libnpa-tstream-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.14)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.21)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.13)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)libwinbind-client-samba4.so()(64bit)libwinbind-client-samba4.so(SAMBA_4.15.13_GIT.591.AB36624310C150400.3.19.1_SUSE_OS15.0_S390X)(64bit)pam-configrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-clientsamba-winbind-libs4.15.13+git.591.ab36624310c-150400.3.19.13.0.4-14.6.0-14.0-15.2-14.15.13+git.591.ab36624310c4.15.13+git.591.ab36624310c4.14.3cS@ccR@cctc5cM@b@b@b@ba@bascabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- CVE-2022-38023 Additional patches for the PDC role's netlogon server; (bso#15240); (bsc#1206504);- CVE-2021-20251: samba: Bad password count not incremented atomically; (bso#14611); (bsc#1206546).- Update to 4.15.13 * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); (bsc#1205385); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); (bsc#1205386); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); (bsc#1206504); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists- Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689);- Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254)- Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- CVE-2022-1615: Do not ignore errors in random number generation; (bso#15103); (bsc#1202976); - CVE-2022-32743: Implement validated dnsHostName write rights; (bso#14833); (bsc#1202803);- Fix Use after free when iterating smbd_server_connection->connections after tree disconnect failure; (bso#15128); (bsc#1200102).- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- Update to 4.15.3 * Recursive directory delete with veto files is broken in 4.15.0; (bso#14878); * A directory containing dangling symlinks cannot be deleted by SMB2 alone when they are the only entry in the directory; (bso#14879); * SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used uninitialized in rmdir_internals(); (bso#14892); * MaxQueryDuration not honoured in Samba AD DC LDAP; (bso#14694); * The CVE-2020-25717 username map [script] advice has undesired side effects for the local nt token; (bso#14901); (bsc#1192849); * User with multiple spaces (eg FredNurk) become un-deletable; (bso#14902); * Avoid storing NTTIME_THAW (-2) as value on disk; (bso#14127); * smbXsrv_client_global record validation leads to crash if existing record points at non-existing process; (bso#14882); * Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call; (bso#14890); * Samba process doesn't log to logfile; (bso#14897); * set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert; (bso#14907); * Kerberos authentication on standalone server in MIT realm broken; (bso#14922); * Segmentation fault when joining the domain; (bso#14923); * Support for ROLE_IPA_DC is incomplete; (bso#14903); * rpcclient cannot connect to ncacn_ip_tcp services anymore; (bso#14767); * winexe crashes since 4.15.0 after popt parsing; (bso#14893); * net ads status -P broken in a clustered environment; (bso#14908); * Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before smbd_smb2_ioctl_send; (bso#14788); * winbindd doesn't start when "allow trusted domains" is off; (bso#14899); * smbclient login without password using '-N' fails with NT_STATUS_INVALID_PARAMETER on Samba AD DC; (bso#14883); * A schannel client incorrectly detects a downgrade connecting to an AES only server; (bso#14912); * Possible null pointer dereference in winbind; (bso#14921); * Fix -k legacy option for client tools like smbclient, rpcclient, net, etc.; (bso#14846); * Add Debian 11 CI bootstrap support; (bso#14872); * Crash in recycle_unlink_internal(); (bso#14888);- Fix dependency problem upgrading from libndr0 to libndr2 and from libsamba-credentials0 to libsamba-credentials1; (bsc#1192684);- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899); - Update to 4.15.2 * CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication; (bso#12444); (bsc#1014440); * CVE-2020-25717: A user on the domain can become root on domain members; (bso#14556); (bsc#1192284); * CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC; (bso#14558); (bsc#1192246); * CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets; (bso#14561); (bsc#1192247); * CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid); (bso#14557); (bsc#1192505); * CVE-2020-25722: Samba AD DC did not do suffienct access and conformance checking of data stored; (bso#14564); (bsc#1192283); * CVE-2021-3738: Use after free in Samba AD DC RPC server; (bso#14468); (bsc#1192215); * CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability; (bso#14875); (bsc#1192214); - Update to 4.15.1 * vfs_shadow_copy2: core dump in make_relative_path; (bso#14682); * Log clutter from filename_convert_internal; (bso#14685); * MacOSX compilation fixes; (bso#14862); * rodc_rwdc test flaps; (bso#14868); * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal; (bso#14642); * Python ldb.msg_diff() memory handling failure; (bso#14836); * "in" operator on ldb.Message is case sensitive; (bso#14845); * Release LDB 2.4.1 for Samba 4.15.1; (bso#14848); * samldb_krbtgtnumber_available() looks for incorrect string; (bso#14854); * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED; (bso#14871); * Allow special chars like "@" in samAccountName when generating the salt; (bso#14874); * Correctly ignore comments in CTDB public addresses file; (bso#14826); * Fix transit path validation; (bso#12998); * Fix that child winbindd logs to log.winbindd instead of log.wb-; (bso#14852); * SMB3 cancel requests should only include the MID together with AsyncID when AES-128-GMAC is used; (bso#14855); * Prepare to operate with MIT krb5 >= 1.20; (bso#14870); * Heimdal prefers RC4 over AES for machine accounts; (bso#14864);- Enable samba-tool without ad dc.- Adjust spec to use pam macros; (bsc#1191046).- Adjust spec for size * allow some Recommends instead Requires to be configured for cifs-utils, samba-libs-python3 & samba-gpupdate; (bsc#1182847). * remove fam, undocumented and unneeded.- Add missing build dependency on bison when building with the embedded Heimdal Kerberos- Update to 4.15.0 * Removed SMB development dialects SMB2_22, SMB2_24 and SMB3_10 * VFS layer modernized. * Add the ability to set allow/deny lists for zone transfer clients in Bind DLZ plugin * Server multi-channel support no longer experimental * Improved command line user experience, unifying the options in different commands * Winbindd no longer scans trusted domains on startup and will use enterprise principals by default. * The net utility is now able to support the offline domain join feature * New options for 'samba-tool dns zoneoptions' for aging control and to mark old records as static or dynamic * DNS tombstones are now deleted as appropriate and use a consistent timestamp format * The 'samba-tool dns update' command validates and rejects now malformed IPv4 and IPv6 addresses * The 'samba-tool domain backup' command correctly takes out locks against concurrent modification during backup when using the LMDB backend * TruACL support has been removed * NIS support has been removed- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/bin/sh/bin/sh/bin/shsamba-gplv3-winbinds390zp35 1673948315 4.15.13+git.591.ab36624310c-150400.3.19.14.15.13+git.591.ab36624310c-150400.3.19.14.15.13+git.591.ab36624310c-150400.3.19.14.15.13+git.591.ab36624310c samba-winbindpam_winbind.conf55-samba-winbindd55-samba-winbinddsamba-winbinddntlm_authwbinfowinbind.servicercwinbindwinbinddsysconfig.samba-winbindntlm_auth.1.gzwbinfo.1.gzwinbindd.8.gzwinbind.xmlkrb5rcachewinbindd_privileged/etc/logrotate.d//etc/security//etc/sysconfig/network/if-down.d//etc/sysconfig/network/if-up.d//etc/sysconfig/network/scripts//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/fillup-templates//usr/share/man/man1//usr/share/man/man8//usr/share/omc/svcinfo.d//var/cache//var/lib/samba/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:27433/SUSE_SLE-15-SP4_Update/d131a1ece5f5f825caaa77fdc3bce37d-samba.SUSE_SLE-15-SP4_Updatecpioxz5s390x-suse-linux ASCII textemptyBourne-Again shell script, ASCII text executableELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=eb8c938e1f73424748ac5d7984aaa72d862de0a0, for GNU/Linux 3.2.0, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=04d12bfd5b10c03ff53d118c2b5df61c42590818, for GNU/Linux 3.2.0, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=b8cf93282265d43ec21b58da79237ec721d050d3, for GNU/Linux 3.2.0, strippedUTF-8 Unicode texttroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)XML 1.0 document, ASCII textdirectory4O3RRsR6RoRRWRiR_R[RRR2RRRuRaRcRR]R!R}R9RRRRR4RmRrR R3R8RZRnRhR`RtRRlRR\RbRR^RR1RR|R5RRVRR!RWRYR_R2R[RmRR}RRRRRRRR RlRRRZR1R^R|RVRXRRqReR{RRWR_RoR?RIR&RYR2R0R;RRCR]R7R6RsRRRARwRcRRKR R$R.RER[R RURaRRRRRRRR!RR}RSRyR,R(R9RR=RRRRRRRRiRQRPRORGR4R*RuRMRRgRkRmRNR RR#R'RRfRTRZRhRHR RrR R>R`RxRFR+R-RR:R)RlRbRRRJRBR@RzRjRRR^R%RdR/R\RtRLRRDRR8R3R1RnRRpRvR|Rl)ysn=McU*y XI}sCKʬ$!gzLR3)yfSNPGl$/Rdž4s8<d(xMBe-(1:}FӇvp2z^jǃ`2R]Q}$9؏lt=YSOJk) vOQO88'Yt c߸ ܹK"tČHg=0N`3 ҝY{NΕ5OBtzfHii>D" 9G.,΃ʃnU^؀dĤP=lWpuXAPIH͂~GjD";` =vӧݔ6/q\8\#U)iͷRQ4 8\A>:쮯;;L*ir%-DJa ]~\whNBv'Az4p+wV9Rnd3 `;(ҦDS|S#r |hq.TDnyG%I8MYqO1;*l%$? оlʈ>}go0; >& yjpzng-\eؤ!VdG &=a ϙt|˕u0^eJWy\+[]<&,=dzc&.{V~ƐHp n1>LCc"@ ZQj^i @qMhOqJ~Rn$6XܧY]p<~5I*%Dop .w6> f;/4X%>o 0,^b"_xb9Hd@5 ߎC.tN̷mu`˲Qw{@G͗X9os:*K,^ ڡ~8TMfO"hJGdR GjG WAgO]2ji{ ؼGҢV" ,%MqE2'^bdB*oO{>ߙEG3. #̥s#|ֶC(|И*,YYSW*&UUe1,-z/ݯ\2VJCEkBHDj u:] %k㕪 t*HOJ&XmjHdds{CZJnRٱGh:HZZ'5.'NGWwG3#/^"A`k4x%pb1U8x nf{ջ H00vpPn-w$LN6 /zv\;#_be)YSwxXq ϓ[TbHk<2j!ufMiA^lճEJ>ܵ1"ZB#ka '5ܮ^W~bUV*T|=`AwdC3[yLt/ך:a{-S+g[T/Gҷ0~M܎N~WMf>Bf K/R7e)NAF%JO_3AIƕRf\b|_497ƚ*'ECЮy/o $=.+r ?,JHk/ 0-zhol ^Rٜ>ͅk;vWܖb8ZN;<so\q#i#q)AҎ Bԅ7E<5ܻsk7: OzY( 28͏& &] Wε`7 #zN:Gw S]% +A»3iTJg= nBvlpU8jw-VͫM=L6|^098,R ߉IGA8~}tlj pԫ2P+hi,<(JRUzvQj>ċ[ ab4ڼfq >veP19rXppMZxۋЧ3P$}4\W}Y5@@Z *_vL.4e~VH{OY.Rngi! JkPJ3ZݟM(f%G}='^"@=Qk;V6G )CMbK݁ƓRc%rhQ7|-44}|.bq}ᥓS{f_bt9̏/ gUݟԹ&)}!*S7fk70% q!u?*pBP2b^x3&尘px켣mYX]8w!&cS.hl.0W_վ% T.V[j{R5=.܆VL>V4oV7bhR9_tŮ : eA|V9n9[,0rP1bo 9:EZ|'ݰ[鿗تKYTN񁮚uH\@ǁϷiVQ{) B 瘑l*(ad[uxH]kRQ B@|rOQ&QylEYʙY-3Tk\MOnl+ՈW/glS'x\|J}ǗCWBE>;x"sKst /azz.%HWzzݹuXͼn6[tE&g`Q,ʏ)-p^naME$$A kOeX0}''^ U+YrwnC~;:2JѮ<S^A-8@_mQOц@t_>m)RǕJG @gm Zu. le+C|qh10;◊JR&a3$$Π`o(ny-PjW_OMG#]%_C~| lb^ PbSHܢjPpHP`/"J(&rrb H,72smh#WyxxnQ?*cm_A$:rei ̠}[)_3/4[_&6GƬˣR&OY7e4lh$&֢C}޽rW~A Ư`Tըis)bT,yبGtiT@ܴ(؝;V4Q?#*(ʸќJzS$%g!9L 颿!Єj;7@OPUo[KJ3rra[?zg+g=Ty,".L]㔢:H^ٹ_8NehIFHGg~U)@fZ_7sm[H@ \j zjp4(y*z9nJh&tuhrB=m?c*å7F)a4nt:j@piw^#81xD=XmgU>`qj%Ch"(*"Oh-1:)+?C@LNb:'jJ~REKPk;?fT. S!"r<*ak` [K4 Q\ %HRFC$-$bP>u8C-sWr1Mr<Lc&SPݖWg?m7~ PdΘС :A 2N P fDlEoΝ$:"."n\zUK]ͰzeK_;1t^LVwz+mqSzÐM{-r9{>*?9#|rB&;I!ulx<y Lv]VŲ"TT̥#^>٣Pnس-0tj +-xx*{L8iY'TVHR ͠XEsWSɣ+eW …v!jE'B_@ ?h},HgYbdy%YZZߑOŊQ}|JdW0䃴+^@`c+שTl2+H@%Dn)Ŗ 0iB; )~aȑ{flee̞!}fUƖH[He"RPt<Z[eQ;|Aݛ셩s2%SNFFm 25moaz6Xnfr4W]O^ζ r8;DY܇UU8Iflrbz1,uS +>Xu|4 T>RNky?mֳ3A z~Ex1s0O\f0 4N4 Pp5?eݨ| 18$fJ`xT8ZbLwˌ?G1y{2-NYU$ìPN()xO=#X}kXki,z"), Zka4#ص!"z7c g j`%9/V o1\e E}%f?IVo.[*N˔ց5AywNk,%tr^48X8Ddre⸣RuQ<ڭlh> V :p #$ϲ#  Im]OMq*2:9˟ԣ`|}ȭoASM,'kGc ,h'( m0xV BlЉwW&..}uƷNgrۜϚ3jj*.~{Q}'V Y+]##,s@N.`=(ih'T&,*Ɛrj-ů,{o ظt\Zݘ;PPDe?F@O! Ϟ9;@ n$2bjۉiG$١`uH  }Gp2k᫪MYmc `Rbô"tltXgN| @~6bPvX`/ 7}}r !R` CkzhdȇpZCYSn {wnE%-,|a 9x-hmHd"pKV<5P-BN),)}Ig!we+ R|L3|mu`B+VU!yu M }{#8l@Skc[Sq `#C1Lq5,L cY fz/ F .P2)i0PA7uU feWKR06A* _&TGA8O;mpGP&,f( 3xa ̣m823F?a!RQ&s eOtT r֭RR1CF:к3t&d2e0\4+6|y ٓM8)ˉhrx3hA54[=kbJY~l2'!-wQYpi\>2űz\a|I֘c'I-.ی>8gSLwn6h@H ,eS߮+=>8~vxƳhP{A <{^jWM=g1A~>* x;O',)h|]t}J-W=Fz6D p$lXz8iC '7ʣ!; 6 ϩ+?]svmRy~SdH k~)I{Ian = L kmWDbGhc *J3y6c1ry1 Mhi2nphʬxI;Sc_:̞y+ բOo4EQ5)52JFMݱIbö4eh?01Xk}:@D<@{b *3t]ٮ*=M-#=88Jl IZx۔tAi FDrlqÐotI9.ȴ,A+,REunS>=\1J95n?*L.׽X@k,,$ePSG*m]Q5x*x(Vn'.@euqȻ*|Q^P6rTh#}@ѹ0CƳs&9*v_ȡS(2pI8&&π #v~4Qqq[,F(RN*Oz,6KQ(<[Dt%9_*AS*iU~ǥ`Шo5. Yן,PPlvZfdXU|,C\[Y& lσ`ͩcH5[-}=`&W5Xa`TItUjul&@P:*NV_hMH:K5#trl;|ּɇ=KL\iGe1bh~}HIKXw[YgA.&'7CHјg;?|jlm{V$JU5QA)s;_" L~)4 #jT*`rڂ2Atwn+J}U+jxz>YғU9.Q-u꼷 [>4df- &ḅmOd:ԢP:^eSAiPcFaFO{ 6G:.#m{??r,vv8Ok(W`ir74P4f0DrS'z1Q@hBjVH&,L"-#Ik*.Y\nd6OmUO_{s] 5ѿĖ8_1IJU=\QtHJ^bdr7{>L0M+*U* e د6(od3/^zXViGhJ,׫zȔuS4d%w4Y6]W;{cT>>փnZpRwqGr`dJe aCVʹ~|ҌWЖ :‰*B}_kBC/ XFUc̗ wWoGaT#nhi]wҶP$cN_NqIHgm #9+X=ؙvkkY3u٩cQXd$*:b9ʚ<a !od+BYe{ڿ&G& N*Vrܑt{cb&M#['O5,5cLu;M5kEHc#2U 4bz!g)pe-O+Po67 iOeR IP'wZ Q@p=/(l~q<W*$kF΄+0)>sbdZϏ]7J>}p5UpJ =2T}X@}t]ї!ݮkE}(TِxL LWg]F)&1AuPnb(<΃Fl_aFߞ 8[ #U-PΒ{׽YOQJ zMfG6&"p;o vHFvjJ&$a5 5.Gc嘪k Lu£ c {z ],^Ğp1!:lpIX86a(쑝oԓ6r7uN#DŽ,]˻%h9"&s!=ՙQWvsdGU%TQ9#Jtдʠ&r25f5+@ W`TН5iHzx<٧П5D%~ޤ&LpHZGt2pt/|C^i@lbK'_?m!wѮiuQbl=E/"#ሁ럏O !%9Ñ"&p昈d'$i}f 8~B$tk9r¼/dzLg) 3?CHFɝUc@H'd0#gTda6`l_ϛy7H{qzDPR>{7{IlHvXs]Gԕc<15`fUTJeLҢQ_*laCkw0F:p/8CZ$Y Aޣ2/6ÞAf{**h2l읷ʂudo{uv3{C mjF>{r rAnB/ T,謁<9([Dq?Q N/)D7iU%ψkxKUz~Z›NnMS*j^tƫJko*=Ž:W9 ;/UB|7,5~WZd" o`_:Щn,%O΢+ǻK?߯7U‰ .aP?56XpIq!@OI郉R:#TX1^;s rHbuT3nL"j ]bѵzO.ZbJXXc&U\R#cl Weח߸=lsËzç't[:}wzMs^3NID^tR7qCqUJJ\%iMcrw]E5BŐ,YԼ;x!ez[Sk10IaSwe~+a,pLTe{ -dqw(%<'qfgA"-φ BA4X i݌϶j8r-q;iF\!7Hf<,;QfP^O.Ađh!M0G8$)+K C P 'e<)f H祬bP- `-1[}:QY>.C:#UG:Cyڤt:H ʺgcnO5=($ÐV`Cl e:9?/ Cj5wqΝpc3q$$r z(pwd>w)cݗuLU ( jhLz=狀90Ua/'9C<%s9Sc3BJth'!94X=jgUpC0ZfTۤkٶ`H f9 8k( ^({3n |߃"aXv&VΊ9 53ϯdv4urɁg biCdVm\Y4! Nܴ Vۙe"vȎ\v|Avk[QӌNaXi8poŠM%#mכ闾օ5m'3D_$ \LB}^~ȯu.;y[6p9b9 _{ ZN4gȰ h hۭe-L}Nx}_~YYr$`yj[{LU_.WC&?tMK-^W#(\DsCi5OY,zL#<5U,.%ʔӯmFf2r/LZٵ]v %;3ݳiV=(<7685FZnfeo)1cFm +>1tg:@o(0Q 'fn+c-F>V;-`Wdb;3J]JO] \1ke1->Q/$_O'?:q޷J@`|Ly71=&@.7>@ rF<# )YtTm׏t#%\$s=H ˷E [o`ၮAzÍ:ܢ&hyar2x_?k6pkGE \V VOſ Arf4)dtA_(]G&bg$P>6Q/oPub`nJ dUCrBhLCTZSk (2 P$|2A ޟzUk5XBJ_S?,~B(őLgԂ_# UGLVMN#@~P3Ct6%'V.׭:Br)_ۅ!/y _ ^(hxk@]ܧ)*x7Ǟ#͡ ]cZWs"j; BxQD Aho4FGYoɰ30RN$pV5/e;ḅ\'2ZnyƓAG#y F܅7 xq5P2bpO@梘zREQ_fZSD(m3R)(Q*淿M:KD~. B={T>QCcǝfAFA @!z|fshOO5]1Ha90++0/6o-KA%v)d"1ŖZbBSUnAh0K#l+owj@hȤyk&׈C7,ɂj@[76qXʒ9?+ *V_gCU,&lhᒭ?T.h柾ꌛ5ReCeèEr^6#1 =ѳ)d]^v܇-CbxoU'L# |r1PyrM dMw3p k+Tn֡cYUH$hi.*o7+[%\ o녽q4df2D)L{nNNU~N*v-6Pg1gT;)l0&M&E?96+&[&/W65U ͿPaWOC >XڢnzɗҴVD=\~#2^FElM 8Wzb9%>{ֿPbª8wh \_UWb `vYfgDbo#dzNc9-{!R8W^?|$k xd"4Nq辟O$LrXGD/sNT<%o ҷuC9?vdXMv~#s},r5? Jd3Ɲr,\0ಒC{V-aQњ/S׋ߪy./J v*V<פ.fxF]^`ǬQ!b PjsihԊgLNjgtpKR1.8}C(UUƆksnBr/gE`#i۾TXba\|%|@r lЧ3jS7L 8)NZI#&u8Uh{ rPaaWg>燆@N|g2"U[&9/6$_(wr,){SJg>p}`Ue_ 2vB:hNjw]4ˌ7 K;8Ըv~F&/=tf(A7a`a[+̣p]IGB#($u2Aj1z6 Eܚh lJvu5kcyJ fvq`盳CN׆#3MeV0=mH05h.+u5.mqk$*jEOm\!T(e98C.`5(86]˽}aa?ː2_gi X*}a/,l)0*+g`%6$k{21E *NWl%Kqrܧ#?2SwkrqK[g`*qK kCyns*r정t_FUަp+p T\@GF*6&*"oΘ@k/Ek sZG*ϸD,[rmxhXrMŘR"KYM )̥:kk rWV#ckxpy# G~sk2 kgҾ /￡cOvF priyD7wC.92r<0By i.ƸwG#-aEb](02y%݄M= <>DjG`g#e_8u:{ kp`qr;OP+ڍ7)Hܸ1qdtz=1܁ <~Á&zf5K̆`s5S@ mNBZ0T(%:Ӥlfm{]Ak*iU?Yly3H&3Y y R .5zKW?hOSp_v}`7u_ +"yR}`##̅m.+Y2Q>)-#ԍ|Ly~ҧ~!WXu\]bv 9}Ox)*6٦,gZ)*|FTd-x!"Lq<F1˸ ?qbJL ]xE((uڮkt@o6G(o00˩{נrFl.ZRq૷wSYY {An3T{9e*ʎJ~]`Gl`>0@࢑,.`-gcF<7I{]>(mf6e~h:9hm ᦺ׽&`OAuKPUјu2&m@kˍ+pOÙb'֨ߠ.P*V˻bN;I$ȩi$ 2RR<ݬ*5YFo1UAw ?Kl2RƂ%f6in0o/GO EJE.B$ZVaS F; 9{>Dvm'@h% b]w{}5|ٸ**g#5bx+]z w NNkGm,d'a#  cG-)6z{_ o2HA -n޽r*@}A8-6Fk 'lĄ}Ro5d߼Fy؏0pCsB':>p#PBmMu>Ibߒ˶[v&U}tBԚɒ=AAr6S mV]J"Wi m(VRX^n5C62#;cQˤRI;^MOiRHR_Ɵ%:ECZx [=Ӵ18EͧxoHpmDWx  cEbQ ^^UQp/ǿWդ$jCH4>l{ &L鹋nNQW$(N#b _R!a|D'^F ,9>:ZEK{+7hh Yd;ڼf;4ɠ]8?W)^Mzsh Ts 7m-i27I餎>2̟xjt仐L{R}ӛ0nѝ3B9ΐ^QSGEv?$(QA!<G޲y0( g%VqdH}[{9\Q :LsOQV 5iDlzBW/& %üI}]#L葦@+-?X>`X2{FPO@+6i*9iaKÿ>B?*up덎IIعfb{9\ɐaD[6E7v9(-7ASw(af-i_S -E$ȨE_;h=#;+»*M U(]U%Z|bH"#R1 OeϦߝ`tB#f; +&Bʚn|3T7˵vS ^`t?6yn4#'An- sZw4/`/!@:Oܴ[4 aӱw[|BW1Z8o&\cKex]g2)[ ѿFѼ_eTTg-N (ǁgrǂ`.SCH1KѴVk=7kG-CN SaX{>sm p}XJÍs.Fmjk{N?SWȷ֡B?Dm^n(U|H܉es;1/FFH1PPg}-z @-Gi JCU\#(XM׉aR`o}OMUin'm\Ȅv2|Ύ]ɖd¢ˬ `_4w:eFm=Wm<IM'eڽu-nRNǀA}4ݧwbk,ӧzr|JLU^mHh3q)"o{KvdA#`~ Gej%(r@6;빊dY6!/$UׇGxMRlLG$yHMKs3FhTf{1ҍ935Ȇ^b!u) svK֍Fqx(AH=dR'0.VqLbF]l0"^xQwbu&bz)Ka2 B$wZj4?aߑ5D&,)ҥ/f2VF|#dEjg]i[daPF~ wYQYl/ƫ0R ׍! WG'IX,u(u{:3$!x{*G5+GAHä?.S5mRkٗj ]JX(_>$^&]x?a[\W0ߟ0 y` W*]e`{P6I&/C4R,L [%8 :s˼-^.sVsZ27:\mnhȜ˪7iw=+קKi8h {w?lO|N=shɹ:C+/= QhG8=VSe1/&#&Œ i>ftC2ߟ֡;)WcQ Ox+C8N#+ |wYI%Ns/xÖ)7RF*=xh7)>ۃv݅[:^G,ͽ\)oSܡT4B?B2K4OL[oQFu qSPY4xPziI>a$}6>T(JJZ`EviDElC b>Yy lwǍ}u{jhV[|B '$15K5`(VkRZc5'HE sMyk0QF[:6WSo\v ,*3 TȜC LjYL>Sc ;XL oέz8t!rEF)ˢ/4b(] G^A4)<@;8Kb9GzF2 }o5z r:?4d&/6PUܲ`Ht:pp9*RFFH`}N5mW{^:zT$! zmPdH͋kWnj%6fJ#}fK]5#?dc: X2nJ^!~EPI&Fٷ艊V-jDL3 Bijk`Y~],Ff!P9HXlm<͌11K(#xDͪɺ=~3K'i ܤ \В2)h AweJfۖd;·𸅷&:*;+J 0-Zun+'aGlM `x1WmN=>O&xIe&Hz`R璍h;TxA:c㍑egFZ-^Ii=j2o38R-$^2/Jz7<ڿ<>9! 1s2hx:r$]D";̯|a(ʕQ?Ѹ5u*To`MYuһ٣GHx;\;Q8P{ÁXj;~:vt,/!%S5. 慫vVy?瞩;QÀ'(Nr /Ц]g3Q<U,+Gb8U;:jŊ{l6<7 C aBo@.s30z WKT̖^А&֬gGIn{q8 Bs欲t -Wi8{_lY8BBr^nA[U,]#ݝxF4 +]%IU4凜h:FWJ&]WKipT*QeK3jŐ5F?%~5IcA.3ݍ5̐<^.çDEIMv h*\7}sq?"qƚrSo5_zcxe;*TH^vWM);=򞦥B[ea8tLh:\UC#&F3vlL2J>;ܰ/ [lCmpWk6w{ZE+sz\z !qVTvY h=g1]|C1/tTʷ,~1O",Ilh5@ҍşX=9NMO'}y2_Nx=[y!rOCrֱzR)cdo`*er{+s%.ҡUup / i Pr9HG$*u8Nԥ"9ǻԢ>;3rEw;tgW,H@%ֹS 3 jDu|.ʛ +Jm : @۟yh-og]]IDzl&V3!s^7[/~"]ɮzCU*[z r!TN)- S!yy%E!lZ@:8UyQy3bh>)`Z 2uoY|1~X+-˴!VY5jS5ּ^_Oj{1ϝ+|J;h<>Y1 rl)Cٙ|y9L% ~r yT ##^=/N殏X=%].Nk%$F* bo~c՞I- [~*d)UzT*Jtw;q8xQtivsiyL/wYo [o O;m`:CVdAAU~23m^?[;)6^CV'2VKޘzwb?mJGM 0/1QaW>}cemkJ5յ4Qm6^؀-VAh}LJ3|؜8mTdcGB1vyWJf &0H,s٭H(W dB;x$LoG?( ,8ތi[IB'`Ǟ1M{6 ^ #ѕ}WMd%uXLe7hrrx-3@X92x O/4AbоLrl+t RcUSNNܝ@AsڨP[FYL xcixAH hTH- X1eG)shE4ٔH:c䡘˒bfz/,gf-II('ui3\f}l8iWc<[yjܓH>eYB  BO_۸6=ՀF#:Ƞ$!ڬVeAzܧIGAN>c7!$ aH;PjnjpE8Eڠ%F2J*s[0/!*]{BՌG.uq0PDE Cxfl'R䵘A5X]6!S}A7 zƗ1jA2ii3}7^bIeˬЙoiFy^0[z ?Jnt߸b{9l+LXU2^n̆ 莰H¢tXӚvNFr\[Ti׸4P|dbz3Kn5VYg|?Z]qIfxAt˫S.D1N`g X&9ˆ oKJLJҔ4&Ǫ3 ZY?V bD|+]j]7ej .94tw\V3?Ii?b2 lG 8/޹X%(RrOr1?"6>eo a@:& QVlA}K*F5+߽$h:C"J_P2{=Mk0e^ :'4mW*aH1 J^I3s2NN0X:cuF/V6q*+*@Y~º,T\MFhE\ HmM cˬ90,b9PT,]ՙ=3a"q_7UV, ݍUZDuP+HL8j%*\ZeYƠY˗)/sQ YD+`t=l1$~TBSv 96-!Hg- <80k^9`{`hk|5fL6 daf*T-{ujڀ9VQ܄$}):9:7nú|c>̐N6C#gAh?T_ub&|Q^Nط9$:Unr/>W%4ww.o.`DqyƆ Abөl҉QyF~D`Wڄlgo=ʔq{`lcD_ܭ`}d3۠ ~6Ϗn!c?/K]x^W[qܡ QrD`p7/;9y&7d.7zE133Jnl_] ;"(.60e3˾G U? @Lל ]Nv2[o*$61Ɉ=u {'*&%-Ft@[&J;*RaO s"D׏ hGϚnDZy׽'m@:v*SkŰgi)"yd/ hdnh]*{ZVp\+[QcDK*M'"]:]Ϟ p@`,qV&` Vdv4n=խ*g(vg#_1S:$} ]>PN|a`:N' =FGS f7F0siOp9{NJ!:u+'eTe.K7Ͽa#ByGe4,1^Ld4S6[pBn]KG ǖdppŹl4/t\ n[U~:+\T !شxEeag'mL,Tt #RlH"1">3!LuLrGMnTR^X"K\t2wDv9 d2>b YZW2{֢CʺC2gOS\_jb `h3/hqjV/m*jA.gBSn"ߥm| '_c)棍sHUM Ζ\~oYM&K)J-ݨk3U\&P>ZVԤ;Uae19J/רݑW18ª9h-w?hw 7,+})6V5w&H!t1_ξk֡6ދ <fx ݤqˣ7}PmIzp̞H l=zFW_Oˌ~H\]Vw6g)4}\ZCSgE4ߥ[(nO@Qد3)ϓm9nt|Eff q& l~E<^O=9,uT> 1jGri~ߦY)` q Pky -@OH30V>R!s)KɨR\Lٗ%5Kߑ'|>R1;n dfGw3CC|<1,|G`dcT<+!'up[dB񃭡=f@.;2, )&N VʶX\yРfji`D7\slm|uڹ{s* o%K|>^v6B*-cD>gh4@Tk`-BPԤHU. $NKv'>/BbDO?q!9XAx(fQF7;EOi"o߳hch?l@U@U\zb{2{7bvi%.h 2Đ? TX֟(+`oo Ԩ} I೎ep.dX/j #\YJSzF1j3&6kݗgvM!9F5Eܒ_Qjr/ۿ&ZҼmtjH.Gv}J;5T&;5N$<̈Rj}2ժ{(:kj,;!') 1&L$O?y V  >DtyߜZIvkjiGǪr0C9db-pLBZ AF=n tՒ^JIO"S |%{[*.t#DEfF`KoG+zPvg ĕ=R sd1;gEXIԳ>i8[j qS{M[号do7W K> JrOBJqA6Z#1Vб~A [GjAp !x=70po9u$,{OLJ9nKx$J t=V/+D]vO|B$4jA?TbjJU-E Wxؐ0W1^chG:8DAù*V{譪&hU>1[o__{>1-S:1ƜgbT޾VwRY.;547ʐhWM}QyvdGqc +;t733Z9O,+dFݫRƵf94-nn%*MEWg](c^TA+HCЀwǀ uBG73/ nB0zQ2eE&$1걒)b -{Dҙ'%2G}!WA}1V_Pd[Ay7ȑHݪq%tv5:dv2$EЊue_x"[K]s!]l\%DӢ;r e}d8ֈ1kTjxK"'?ߊ;\T+8D,Uny#YŦb 6B߲U?6^(K ׂ z^=YΏc0h=(zLZV5I"1Y(]c'ppS']H_CZH8촨( DIuc'=PVRg54h9Nț -gL9 u6Q)`ߡ×[ox Zr0qu2ICd!e>abx-i&Eo@|%.A,&pI&7:[*($Y_HZx> t,FaEEج,6Pu?@;OZf<U=TK<cyqS-^ǰ0@jd5 RS[K6Eُ5TM>vUyГIlNYqpl$sΡ]tӻO>a:&S(Թ9Enk̲7Wj4!$pDظ/x{av6 +G_7 |d]ұa,b xJ,E1S%3?IU_o;ꫢ).TB;[`՟I2eM h9g_/YN08a,I6C;.NE >X04l(xZ_tfj ibz'Ưu 5{jN]81~qp'^FWZ ZDa/H < &MՏlS >V).,Mvt5MҜp+b'ANʰFgV O! +D,USN`})8Ufzoc /$l)FGgB|d$J{,)q-Pmc$jD9 K>H,jaXܭ0ﭲ\(^@Jcc61/Vr鎄)&6xm(H@U"Uf,dG.q=2!!CYY#Iʲ]q_qf A:WfVE K({XZ[{"Y\Ŏ/V#&LIA2q~s55 zדªF T]>m#L.Z6+X炏$v8xH KXJUDg5XIs ҀB,h`d)!w 3y f-IdjAo56s>7Yn7P01eeMcG;U9PJ>>LbeisƤ0(l|gɜQ{oJ.x1PgCroB'vnv D`dK:@ǚ q_2Lɏ'6o Mn2ԍ'z'Q#/#y&kND(= ; D׮$XQ\< } h)0U|@LԧV$F1߶Z5/|?Un4<ɵ\dk2|pD u2@XVbE\< (ψ1ө MA8F FS@u䯴)َ4\ <@]HQ,)T'0Dc͖=DlBԔ7 n^M0 '"<ZI~26J֟'Ӭl7LITzpvyn TÉ+hҶPV܎![H!zı;q$9rtA)%:E5rm@S]X?kc)Va@\{mMEnItjQW߽a)'~Q/pA?*㗕 cn]~#slvtNX[pGnjۿΣ0BT M/C=vCyՕVU .ͭ^۬nKPV A.~vIBT/˙w%ŒpWH_7 ZC\ʔ]7Yd{g@r U` >%'RvQ16XKZWNxC\ۏ6O*= $`% iSOKi'u_z4S֬}/ -=io Fp_d0g u{,{ţpchǶ3䫖jֺ_Kg eDKQiiL[H.+@J^Y[R}=^IFМ1ʏL۹EW h 3:!%PmF6yF( G.'D/_ XKԭ:t%M[ 2ʰMޏSWmW:7ީp6]d!kH15Prna|D MYj`*CyTG!0>AԽKҩVCy; J(ʭ+YFJTnΝ]>ݨ Y3/\ VKT :G7o{}{e{.yě$@[vBy<5DLQފ$4*e8W ew<k"(Uhk Q5P;hĀ)[co|N Q*EI?sǻ3bÂ&BU< ҆Pqvs,1 WqVǟ.`18"F'&%k 5 HVXB!#Q1λò0W a1Pc)fÿ,GϮ&n&/lL|ޟbzbLBn=}sh~-J+3-E[h0aff1VOI&~eG"+5tq$P)"NtwZs[|y^]>,ڇ@8.yiMF{d<|~e3S!@,ؘN E,19-k>ݍd91XKxATթ?~a#Ty)߅}.s,ۥ@6̞M_Kn)pYPkh/\@S뒩NM緷+;VwHHe˦"n؛ _I.rOjMvFH~`@nu,Dy/YNq /t ݼOpfZ)ř K+lWBgAbN%߳ %XKy=Ho]9רzqJ}|W*p)yU˴WH9lwN~SF.H`kH^)B8u>,OkR;ᒻHUܔAH9"FٿuI)i(]%Y<:o|!h2 }qcd97W *=}ѨEh#_;sI>JPg|Fp9c!I}ԄʱE b8 + xNVcw+y4C n}(~:dlcGrET^w['5f)K0EX=0-p?=JK>"a3Sk|eîNR4gmw}HO0.e ,fF>,I(A]=c钸Oa FmF&^Ի*3E s~p?HT<֠9У~eR'!ϕ-W ꠷^ؐեg TeYSx W~]Uoh{m ѼKs_!*LNEgXy{: FT[r WSt+ ZU͔(^\O5atz-Q/Q\Tpm( ̾,#w)PfJ]ez^]ܩDyrckYwT F]E |@0GxEC/%㆟Da0.ʗqz7bD " Þ%q% 7\ň D'"gb"}1q^ L:G~\ub%* S92kX~6{[UIwϙk&04ctѮsDpJ9 Wg9cw2M٬)5 :zÿˉf.ʍʔ%R~JڰEuU/*0x;(ۍF2t,Эahl&lA}el-԰QEfkU?. e++ЂbgV= 6fb&y+o)C8\@^vS͐w0oZ2{K! ȗ{ !Q=Pn1"`^ 2%)ck}zJsҼ4=mxs+ Fwp-^}߸,P%BE3 5ғν85?yk0])n X' K1NnΩ@mNv*bxrlޣy%ch?.%J%xY[Gl:[A|+  Ka[%F_w;~"d $aw3n,+>$ՀVsF3h1p\g_[ݫ!w5h5Ma5 5Nd(xˤQDzK6 T&/uD Kn=`,t%9ӅS'pLLW_U|T8K"&d\MfAK/HK#ZzxvkU2AMeLn׵ ݳ y%&BW`uԵȘ%L]o9DLڮ K(GuC]ruʐ9 +_P?bbV<2p4ևaӗO#%掷CU끓h2#uhO,zQ[٦?2Za+ǩ#Z~Jwׁ˂lJ*b|H>c~Dq>՚K+5$+t-tP>43\i=|z}<ǪO'OBQ6G S HgPI!0Q.<:~nGa\T7h3:FzRķLvnv>L˗TN n!܇ /&ővzрt ^ıߌlg1Fe?)lD1?F}5}iDvU'{;٭d8IK*M`C(PE; 0Z88LQ JO Pb5:s&ڪf0Rwնsw$E=S-a"8豙iRΓ@âeyy-WL'niɷ+.:Ȼt0[p|mD#. 2-$ΪF"\Qg;'r_ Š[oG9֐f$ci]@:t3ɫ?WbG~A8(&.jHA ZOh•|En*)ƫg& S[qqɭ}kMP9bV$eE̚*&2247 b(j̈́ɵf,_B]b!fq~ù'!1 ѯnzyOxS$ &M!G- 4伉m,h[T'_oEќ q¼0v,O>ϧ" xU7KM}7GwYlW?9pJrݾ(& ȟO vV{p k4ދ[*kؕ4dWCQ nq˞13x0K;.0^B#F-7΁tunR6ub~ltt/<~vVL҃mӮ /bh]~ $ݷ#yTi?jbg%]թmn7D,C q=f'QT2[ ,W&AjS6e)͖eg5]db p Yk)-#ْN Bjlߚtv\VK_Q`s€ọs}:{ye)ؿ샨 2FF\ܠZ<,l |dh#j4E &*M@xbXͷhn4ڛ@r³/' I} n 32.?m"h!wpcaToɱMdۢ\'S'L^y这X$7 RNN~VhwjIrߤ'aD3ίCw6(̌9PoJͲaԨg|1R7z3QxK5Qc>רnkr blU `޶]ՖVEb> Md?1>*ξƧAGV7@E\6QBq `8 %fzTl褶ѹ0A2%&ROeG'C@lV{զG9D׸&DE.iG¥D$aEG=b,Wb GqI4 w2Ck$<+'~4#phr̓&K"[1O* #>vw&U> [VgMx;pV?ف_E5~Upkv'NGwꭵ!JO6iyJ?nFuUjj:3N+%!0gMb0!,w~ %:syi "I/Y o.j&7s|$ mepw\7|ϔrwU+m= [H%W e"߹g-OoJ CmGgBɇ|)/L='&F]uMĸ>sgcDv 71G_(/ځqZFwVh(].i0j!jKqw;ԥ B!:JA*=\S'瑂UX]_ˮHd[&^dϠ=IXQ h%09 'P[nC[Mmdu,Dphj6Y:{ho%BQQ*%ה$BLqh]~ ѨMV~hWT-}^#l. '_IӁ`6|i8Vy&QWcLs}tMvy[^ +b+'1KuL~+SOȹK1 ս?umDXҬS ̨13 k\O^DMؙK)%iJ6mDXqS۴pc"߯a촹fCKv{O]mޚ0>VwvuR ZaF1/kr6x Q3_kcJDD/o ƒ籐fE0@l5Rp+KgI$T\LΥvx^`^?<*iUݟZEAy3# (y<)ak2zK̭3,UH|rQI?8.:κզޏ{ȱ9H+\xs+Ot5=a4ά8 @.P-c|綣sΩo~bgA̕B*%nbmҬ _TF t 2'y4I0u- brSg8Oޢa}6~`$CQE9+b OeG$f-R"4z^6OOCa1Đ%LQqJNٿLPăR2Z{JAJsP}.nV/U‰X`KU3Ȇ39}A3:W ]f*qCoI#q0ދQK^n #Ѥ8FNZRD F7*vfγLɑ!֌ KhzPvP ǩroy>̾"gętD'B~x|G;?W y/@{K@#Q 0Byh:޽h#Mqi*OyG)-kK+PӖO\SCq!wv`d\ѬeߠN>Ub+JOt\ &hnhx8zZ$پz/J8ѢEVCۡPj׊/`p {ڣNr`lI\muS$_&ê@d{B3HX0[JjuXi)PErl>ZBRm,]j&䩘rRuv{X~YI\Z`^*$˞4IuKҤ_зOӃ-֘2&W?=AcIfxhKdb{+W$T>NC Y|nO|KZoi=M=DϸI8%Tq.ؔ ̊Ujι7'&Ҟ yΆXzhcNBp(b$:12~ҩg=9 $KRvH8Z,M8BPx$a-`{m1;`u~%d"T*WxD7F0O L3ShI XOu0Vp1$ ֩qť.GVK^@, u=c_kCF 5t)1]@ŎBi:9G&0 @ i]mv:UU3x&Su1.F~栞q'5$6ǎUvXb:6aoi{~e5Dj 2F\U`C5y=ӧJEN^o P4"i%ԤY:гIbl w[ `6NPl1p:;38W &% ݁G߳ˢQEGLT:C4!.z* YjF_cQNw9+^YblK;[µu :˜=*N.Փ#!+N\bx3I?oղק;ҨDF!SGWk54"rR  >zkKI%o2c d ~JDR$VzYB9 GUֳ=Z؈*rwdKX͏MЃ{q pԙ C؆7p/|(Ʃ9C-Z#O&Wo8 Ʊ,.zF[qnY@{ȁ'߮= bCME>}l ш/-**ҍCzoZ.1)sd~Ch#-~[qQg/ OxTK|5tu>~5rJm'.~_*x v&Vj CL-zE[!c]]0RԕNuTss E?=Rz'[.É ( 1UW(>=ǜ@Mכ(k {oKI![uׅͦ^5U<l %~>y2dn x'Dm|_.Zow}|́,b)2IР4B{ZbY+Xe M6oRcTʫS\Ēyft}a{[VMhIS2qTphM+cĢg=ȝQ6 9nhid1[qpvl;̸j 8P3T9%I3|o+KY0?XY̓8IcM UR*TP7QYW@yTҼj3GSm+ x?,-'K:|'9FtV$.Z{b=DyHC^RRw{%9.8abRh9ٗ_(2Tچԇ_ʳΆĶ~ahdb+NcPܿ^N\=mI@AKAiiSh 15ƀKg|u%Ck>Ue#ic66u+ ͹:z:?A(0L)o@5#2a4b|eQ Sa3Ax\;$ǤaF![Q[JW_}^*Ti*+y:(ˌEQz07*d/!ΥL/1}(ڄB3H9{7 rMRwB/㱃GOpѥB^\Cf7i YNT0NFӾ`ehTl@`>_mhAbͺn[ʒ1=uTa >fhQ:tFk;|P[:snn7ID9UC0Fp!Cw󼩈.Bi p٠zu7=r!mehv46ML-CE$vHD̓fll++*Ӧ؉_td*0HO1=ϋeRE@]XZa_ xȖBJlk`"!ʆQT(Cw9DW= Rưb{k# +mgwTR _ Bߝ?}$yQh7]N(& h]8˯m1'ZJYj@*Z"e44Vɓsp*,47?㹯Ne'wyRf*߅Yh/.+PnN,Fg]}CaW(K(uȜ,ac/3MO J@$knҖ<&|IwH"#o#h*]Loz+=0vΈ6j9Ѯ;Txo/\[F #U0!KtlW,|@?9H KV ޗz2-/Sz/ܙ k a OǟFfpEɮQC1̇C+( mj[)R/i~{i?Yc1&痬-9Cj0%qJ( OV[&6-G){PEY39.o*<7GȐޙT)B];^%:Pb_w)K.I͞_b<}hD-@2bwZ-?!Q|Yư>(T>3*~# 4SE :/7 ;q m_Jƙs! xol yh`H& ':. CeyD<aK{XCDc<2 $ bqs.X C Zzt's?Tݝⓤ;okI0d3)ͰDH¸l/#SuZL5M/JcYZHG`_ G<~n *Hv^ E8?:>S߉}6Ra{#:HZ.ʾv@-uXk"l@kTm͊[F951XS;t8~KȟE]ƩXսS]FuU/XP/4%[ P nA~ { 1|#<>pљ'7e<4$I3NނZX}{ Jw͎ນu3*#+}PHò'0@vʑ\lc5QT X$ZXCn =by*?C%rA+[h#-, tׇQaA/X\7 ubË$L ryJM1sFFdbbP%)7A*>ϖI8dlLXz나'&snA'#(mit%y0JUNw1T"Q?Cbm8'IUc#aH:dCc'i ʍ6I1{YV$!)o[(|̙5@~7G%'; E8䑇 wWe.$t*g#O)+& oןGbzM}h~,߼ajWlh‡bM(\%n=)\^4: wKcgd`R62Vr+j?+-a4; NK>@[jQP7&_u8[L3xOy?M@ca&C]Aj݇%H2i$Imx@>3Y[a$U /Cp۽}M)m(' tSiut[Z"!RM}Br,w(>g]No* n<﷩@A`[<&< ėY:jR܊ w:RAߔMrsO75v'*b'ln=Ј53F˟qmXңO|W-xw9㷵oSkұjcO细ȶ&r3OVey^U"_)c]S빑N{;YvoDr;6GP"O$tfy p0>6msI^-U @5HO3.*(RYqjъ / Q֪1ve/q?V]kжm-yᯁڟGk߼Ȭ³+Ńq ѝ58 6Ul`:jr_Ièк2ws2w[䎔瞷&T#&X/,`uk03Q0mt#)Roj\n>Ԭ}IXn ׭!\a½/g>=~WktamN c 6E(RI)nffЯ{7 5E1"x]a]> WWr$F}@W2ޭ}2mD~f#q);W_]Aw&'j2dHVa #kZ,jEax) x7ѧT#qGQ:Ue}2kMA|ΡM¶WҐב,gYC4 [%jmiYcG^^rh!z/ռ^{=`Mvt%8#KVhoHPcz_=j~%f` l~`fi1$0rnr7TNhl]hp"~JAU}&>i V[3=;*OȎ\.Xߠ nJ$sdg$; ~G+p<+y{hƀষ4`ֆi^t,#dƧjH @H 4N<yUk{0YTvlvaf_n@Zs6{m?+ 4 В^5nhLq݄覄K |>7=8Y L<)B{>'|tmB;|y|n4>Hl9Mu0#d evw~_voARE#)+`0,xGڄMRWj'r2D%RI͞ߊ5_R) 1ߚ8r M~s#'84SfN%"·y^ʫǝ!WЄ* B%k_ŸѭiI_faW& pu8[~݇35 Ϡ)ӒGk-l:K3JGfSkL"y^UB#RHXd=h0,S0݁g뭌 p,ǣߐmZ ;ca{`:`??RגنjPT}(`WȌ/jgoT"}W{-6dA9&ЎˏPA'K|$^lƟ 26Κ&~Fr L,o_ѢkC 0擁gp0'&UZЃ},CWPy8/LbleFO uKݕ(ڞxxmhmp%^Cl%7=O\}tp-}5soÔz#7#V J z5dG8(ӴV Pl?!̾l }f#=]؝W,ܢ}ʔO%k≝xQbhd4p;9ByW|ųOf ({cI%(X {lZ?pKFh~Ѕ>ǧnGnDHhG%ު}SH5=*P DQ'Ht˸YaAedf2 d0pKoh7 MQq\SLZkz Gl=R< T_s'BTk<)ͿC0grK4V:HS[H;Gmcw"yY^SR2 z"p՝L~i\1#.Ų87 ~­%i ky,0-C9DwU+BEE,Awϛ:0|^32D"/BX /2|2 ܰX@EXK:mrezK"5:枻}f\5;hy3dւM:h+-C(r̜<F3 IHڕ6e^t }͠]f8FeƐ.;؝ =jθlxwڰJNU0^NL;1 ?7"{0#W3dҞŁhސ=X%2` LC*LOQM`dEiS(ba؁aKj!oCnYT5j-nWB zs huGp=e) c)2]2=C?N(Yw-nMM!h jA$̊m˝Rn@xȐroǤѮs &ɎKNJߩ`ru''&I Y<4i. svo*@\r8Yqw|~^׿(:~{D<6CN؞M{w3돯va%}C]2I0Ihb>]\0 eأpG&/EPzEr3*51f+]4 w@ZbNg )ň3BO\6ת+:k`{HjL-*8"&:%TRDdf-AE&>g9`3kx1l3q-k%@a=6|31-zN6Dgľ,@C!{C4 LQ~ʮkI'u j)EΆxB55g×# 9j y:(Q [U 2Wch'M!pFzh{O=NIb؅XtF ~gՑ/d>APb^] /)Oa27bJZuդ>V!3we=㙝MM2uqCD.CWBڮ:F}#&Fg8'j4PPtqoysNuL]#4'q4SvO "8|ȻZ2DԴ)_] ?H A$׀Ӫ7#CMᮯ"f˺H {A6ǴfAܞe{sҬ]K,Dz/PpF30 }:t,]=^g5hP;>7SCH}*H?QQItaNzr䬱ط8X!ֈ0 sZ<渉tۺ}uHJ㜗s|nEvO,.@Jnzaۚ< ;]j`^sM(Lwn{~xӐ#N-GMтJ[yL={D@ЗJ 2o]`fTb,qX',)~;TB3#cm㉀IraԆ@eSDD)v>%bd$Xvp6ɗ=a_}V8ןgBV'(7ZR7UK{ΈljFҵR_m&.tcjx>uIsF0™o| DLє/2\ !Z|M/K٧G|6<߾& Memn~/YtҔ|QVtۮuҀEGח"էau=ƍ}u`|w#Gٽwj "\Eʶ[ wjmR~layK6e w@6DJMiaJ){}X{ Y:c*H(:ʩbg)B*tjrit ZZyD6LH+Ѹbvʘ3"8Ë~R❩)%L>-ٕ#zX+BUH NKj>&dԤJ©O3v}~t'c.a%Q8E5E{@V+`ώxխuôhpP/ ceʥ '#$4)=~u۶:O[;g̒Ëe- 6b/`e|.8)AGm v Է͆3M]('ZC %ca^"x=4Wln`1R$-!.h `&{38_+x`ʯ.&y!,n٠_gJ:oy4#[v-`ǎs/:NQ%ʾg6Je0 MQ t|dP܋ܞHE{}:+~t6XrQ܉+@f^j~?ͧ+ +vjkMcS/Jtjճ)a92SNu?$ݠ:B\5F8G/(thAW)x뎾:yEm,%@l:|܎Lw J.Ϯ{Giajs\sd3#, +4TޏUj|렺ܝ8 |蜮TqcLL{Zۂ$?H m)V` ~fcZ U#zu{1 ?lK˴ :_ D3 ]pgf?}ћۻ8E\kP0_)bw .u[C' #y"-Xncֶh$ Im;śJg_8`M?Vm҂`\"r)L-BxH`6.Jq4 _wѕ.Ӛkkk]t] (r"DjMA~, xexE.Eg칓0.L!X̱8 l?B%*PS0rS>!̱AžBSP'7(g UrFhrxzgc B`ܹEg/`?l*.T>W1c.fH3Ž;_-›:]_),8H(%øI( s |xYOֳgu_!-"!~V?mn&^ `4F$ktHhS sbE}R Ըg|> 1F o+&Tz6&`a:,3U#$A"O ʼnMyhe|ÈC9$Â֔=(nU"r|1i!ǧ/ʶDe/Hr2? K0D)|xoc늻1˔!xo"pq('(uOyx/3=9='ex_vI|:+u Y:;gfi#륮3^3ˍ-=$=:+z)S&Ҫ9ykMJ\EnH.ĺ9RH}ML`* m;z*=I[Ɏ݀O& Ն 'MIum{SMLp(߉ pC;lPx O j9kc1x: _Bi+I.8` lj\sĚB$l3kzPnԎUDq!޼9N|^+2kLhiW{ FBL=榙Ɵ 竝eOÈzi٠ˎqj.Fn"Ğ2 λ5<.;St\ՋK-W2t?`k-…?H jIxx\Mb QbgSd鲾 |jGH^FYDL#v/etӼ5%:dn~Jg]Y9>F ]m!/0YrH|`L㯣E#Ng`/ ojNƩ0nEtH3º,OUǗ>C&ڊS$RW~Uɘv?v^vY|(k[krmoӂXj#Sk退FF^苿E3Ƿ$~YSv eql~a$wb]dĘ>3K0J)kTL?BB<mfĪl EQEOV~hzT`VA罼t! |NSŐObn!^%Mk(8m1usLxqoT"r )JuLf^zv{@JW0j5lA*3"Ȍ (J;Ϙo+,Kd@x=_NUv-qlڷjʭ?Պɭ}]c#NcVJ\0}c<(%FŠYǏr79 !A?n- zt?@dV8"#Bs"K@Q\.vI0.S33,ׁvm@28\ @Wίn~u5EބpɻCn F1{ Y5=Mr8|msnR4>G,뛋Yݫ#YJ/?;$mcpm|b1nz=iO MH"n-<#DRFщC!VJ}aW]fT ua=2}렂hht}7r_;T;bl4iF7q~NmL#k~61R}%ȢAԜ8+ݲq~>(\&O(] Y&\}n0QS>b.cu˂/]c "ؽ4Lo2zZ*K4 g8ۘΓf< J҉[I AdܛA`uKi,}|i@t+yZS7}Q0hЄK/%k˫Ǥ029ܦKI&:dv=θc ?]TG 'mO= .lC#IMJS*[Nۤf/;n1P‹Su + I}B1벐y5fzTR"*e k~{V!9h-hՋHBZ*hP#]*ㆧy6q9j"]W宐j:/GvcŚ  ƹn_;vgŚ[ b?&zR]9hh>;evAq|a& ؎v`ōmRh#0یV3 MuC}F=,c Uy ҭZ:'Z.( Zc\w]@3 sR;Nư&(<49b3; Q[(TzKOX-Z(KFGk=Dz]))li7'ljC;|.۪a/ɐ]ʋ{\wρ)zm5W9P2.-hE&NL ]'%B%YhrE/vyodjS.\²U8'ij(-#d_JKITniOEF{UA~ [TkC8ҰuY/zh\r.0"5'$:iݕJE#rqc2|Wh.JSvhPQv޻:!keFė,ف\ΟkZO{ :I8 HX.Pl;q`d^FzF'{ 27Tf`(7 v!e1Ng_lT9wD&R6Eʖ,3X\MC7u~¬e,G;`X!Rshvlj)H k-| QS)&=D,ՌĈD2Be A>VV_*Ϟ>ֲ߈&w@{5VvXGGv2 HsYlXrc'Aa;2& IûIe iC*'#Q+9Fjx*d;D+Uђ۱y B u^w 4WY1|= s&!AjNQC=|Ŕ]m n~L[I0xV˪8*V7a,i t{ːKVIɀ\f޴ixLXۧVz6|#c$4ks1EX%jm![j93\H:q c7D;$%T;g@fȋ?,-YB L6SW]aW',J52-7jKp/ 4Y(=2Q}4PiRZ9UX@BAF>$쁠Z5$6Dy_ːaTn۴2gF 0*)kb+%D0 Z`90r R?;M˩m}Pvӛ1jUlp510LHE4hb_=h@,Al5xIX@\i$N_gbTyr~ pC!5^me`4 N#yxEܮs_%!Q$z!,#qCL%+]lhfuޛΆ|D)H,!E0?a)@zt/ T'<9완`v2!f y' ]7€He!ȅ^- >b<yڢ'OwPUh{H`MW8д@o( ONjZ 餝@z`3چuK!hZqG0!e=ej8ehp[Sbh3*| rƒh7Ԟ&n] rMH\c"[M8(K;@EV# jP8W2mgĘsAX_2:xO} M^uG& +!`AQh0inBkD3їEhf%emz(.# K+Q lWx\\Zs}+Sgy!HsUm$`pA!&Gg>9 |PkDf֕B35b(4Fp2|aR9.53G\N(o>k8ӈrmF63qdTY42i6Ǵ\ f*=6/R!GMlƈLe> _6b BqU/L)l_Hpɧ${zw : "UL)O!OHG tzw7Z,Wvy  gsKq$3 늾) B\]0nGܗ<MEdM-/{kDHEx9L'TMiT£,.?@_FR^*n@nEVݞ1/6Ew=w^~BM^Vkt6U~9B&b(cFv9H)D,W3N01kE$p4')?=+SdDіL#4{dQ-mM4'E<%Ũ#N5Y_#+W1/zIip+qW^9_ BsT,^Z1R*1LP5~Icuh;PoP'vD-jaZf-f/5W`Y>d:Kn_SGGV~Jx 韖&bi눘Ѡ<,]V 9 k|ajb`4N@JCdc:H9WEÚ i"syD{g(ޘUE?:1̯FPyfWǴp]%+ o1Va0:|[s4swMf y8@CU:AOLQ`\v_\:{]LcAyQ7MBƮm|™s>EXTt2{WƇau8Mr;,aAQ^ ^20ƾ}UQwu5YN91);Y$Ԟcv. [w(xQqN{2oU{o5 "CE%~Ϭ<_% K\KWcPhܮv0oNũr|/܎ !G~JǏm]nYNKKLYRPJnDG,: Wظݚ0voe 10Lu|BIM<k26'{:{|F,zБTA{tőmalCE_GR'<}g/埲o~v nMPQY _= (dDN?Nq+f)ZᶩmZ#]ZyxNEYaMK+ezy: @D174tI[o (*a8w]:{Vq]u+f1*[˜TG|5Azi ђv#]Mb)Ǫ4y2ڋC|('X7eRZBL{+".cSd ?Y׋Z5;M^'W]%Њe9Bp^B-|َ/ HbiZ`X3`8'cQzDFvS23<k fx @I O,M.uډ`7}o&Wd@V@NVSNKtF+ P0 HtnZe9 !Q #4EZrkŮ,2s/ ݻ1\ay}9"-L'4?TU<c-}Ǖd&:y)epi[HĆj(<+9W$&c(LX՝gC%yY9Ϫ?4$j6h-a\)kݯ =DORW9kXmZuTNGHu= \O&f538qyŒ"9 T)mkzCoB(JnފSi4Lw4E( H*R'kJ7ArU|E CIcډ,r giDNX<A |F'_#qO(^PVX.3i<2iVZ7,>Rd,f=3U o` 770϶Yw쬻~Ѓ}!jƪ(%\Ay_V;WIꀙCEnۋúFnrGiKUxS <>0x Dnd=J#~lijmS; ă߰b/b h\(c huA]@5p,#=̍V~|^큞_ 0)5 $g9/ Z=m4N@h*$.B]*? kf!12/o*OVL$/E t'm*ߎ=P Y ]0[u?y#a\iIK $c AA! i9 &Qq}ca7h&t3 З }kni:"H |i"+ T\Z`|kA$F˖jFWncnmqtXYe%UUTċO hx* n*EI<:U_ma3#hToKef,A당X!&;>Q~9MHF:lp\c RoklͰIF~[#}IuQ$8Uݔ)K-p8˥z7m6YQ8!$2HGS S`]TCqAA~S#jBПM{OLg1QcV.6v=.S>HxG.dG`{SlJwAt趡EFD*UkБNו8'd͙˯4rlaRۅnR5hմ;ϐy! k`l3>\`NWYLZ"ṄJC' SB^W]Yx~',..jn-bӤ6mqBX^p=VU`'y(;Z ]F)©QБQV{A+a-f[Q#ܘiC BdqA@$k?J 5kJ4c3{A65+QųiѫXRv8\PmaTB%=asJޥ02MjhBLbڜTC ZPRK ~Īap9bKnP/USwO1 YTdɠ@`7;괲}FrN^ђKbʺ"<ك;1jA 1>I hΪdU3VvGjl _6t<~Bt6œyWk;?.zߠz } X. ߮q:Lj*w5s9GxQk^ 7X)Nv J3$eT@IZ~F&DžkkZc(ɯQlO)=a Kq4%H5;` #rC~޻c[Ԅ(|Fɑd&4:r /ܖ%Il _(r w{C4#ũbu|IZ|7َ{n?E3}*C2y'Ѻeg =Sqq~}:Nin>^߇ՎO>bBFڵԀFBWw]uo }\n fbbշ<n=@wI=>8kX&CRej3ħ~m[)c`G|?H05l_yR0}u5q_#GĥRRn"Uo373C*g@ԥծػ|'IX0n{G[8f6ծ! gٺpu:vn,V*] ܃׏|gyiV3zZ  .ovGL'`BkPWRHVpHv6Dlw"aj N޶{lM-݇([ ?)6xI$frK o^7F6H EQfɭA^썅/\ D|Z}=:]@4qg=%mS5jv;Z` azzIe-%КY\/sCqYVπ55dbi.WUBOڃ!siu/,?Z#C1ڌPM/>V7?Bw\n@OJm<Zg{.ŵ$hhpϕ_ʄ ~ +w5#~h M-_Cax:vMЂEa! $_;IJ{! ayԚE5f\@mu0-Ϥ&1}_k:Fΐ;"*x$}AԲs~6?0̲h\}?.^_:g ̯Ki0=E9bgH  V:쨂 84 dew k~ހyuUCԟ_+BNStAq_ecbD?ϕ{>U ܗ\[^Q~ K-~gjx]Z;f%j2MdaM)]wrjy֌EEσ1{XOGke!wqSP)?4њzr!4 Qp-J|-`Zuo-=BrJ =¢1#+Ϊ/Rޅ.AGށ0yq~8`O*sb "y#tUpY(,78l#s&xVu~ J(?tWZm4Q&zR<oa 8(SoVU*E*A̞/%*,#PoZ٩0  XgqA滐7 W=袨F/1H]3]qAKʵGZGH9 @n,ܤ-(98YG|ˠ݅4[+M|̒F+][p:m;|[3%UH FdN(%*IcaD>pM7=-u>`0ķw5PB=08PB@ov͌QcDO%OA<⮡)tV;γ"Eԁ^VM"aW[2,5M4ι<Oqj[V?V'`ʍv'LwCˬNHP7PoG!sf2*=aF]ٕ&kR9 5a*hG+s]㗰fAhCPyCk _G#Q*d,~Gǒ,J8i81y,]*L8+CIϵYq }{$ܐ]1Dr%A[HŲߒnWFOLOX@[m*p>yL<^SMqџzh hhF~峒_+bm]cok4=DbVN|w8aLH@#KL#ѷv:kFB yG%C+^/fllU\($[a5 #ȁ%CY(32A(]D;:#oy9AfN ġV ;>.]V50cGԳ7%ar5&;/hYⱪWNiBVő>?؋~RnɜnGSEN8J*w.udl|\Tf~qE}Gl?RD+&鏜_!QPݸ%ҫdJѕ7ڥV! Fzo›-@uH29iōǮ8?џ:mXNE_Y~7Z]GOxln]bH#֪ (Io4֥]vD[ի8zZx>% AxAr%.2ϊb|b YЈ8ܡ${Q}neiA!FXukC(?\iv:vУ$$@֛H8X9_A< 3| 4( Z%pk2-o}w42B).]_ Z 8B_+GƖܞeNf( wdbpQ TZwFXBsgRg\cM阨9˸H(@;ry&owUJNTiw;<"%YiN14%S ltP<]_I;(LM| kXX_< d/D\/k>Hp~-e-FBHj=#e$'M#11D)vk}h*q]ӷPkT(/JnҠFl񞟟9at#_t֝a4IB~y MN&rváYX{6^N|{U0'!9N( xIT>N:&/Ɍo7):,:<2ѩ}2=uԍ=>B}az #FDLqfLnt0pMuR ύAw~Xp"DT2~+2 ;%(#Q- 1u{CQN+`rDvr+']$!]ώG!8-YX` ADtQLy=Xl,bRևE_bq6:n;R)G?6}mtmd2PWvBe~{5 V^nU7tw;y$`75zF. 'B@O ]] ls2 ^@"eDd]hJRfg#6Q: w"@%ӶNk 4[^볕41 |=@L;qv)ڔ}#޺3/wNEa_)\r1عW D]\u(Y 54e^?bgo5QGV]Tӽ%NF4rilD[2" :cj{zR Mݝ,B`nq~a0ujIś }:؞嶻5bHDaCWG#3^AɃٸ. L`$Sx CdȂTZ6^d.@\(fR. 'a5in (܍fp^d'.Z`imuj=kj,B s8 cFTTϯM, JTb4^xI,uXDwI._^bӾgPi(nژ';ǺJaW: ^6́MZe`FxWO&ơ2a<d@L(*]rؤ_jG_|SJtK 4\C^C IJ$u9~'bu:ڎ- UV2Cd/UxCa.nkvfW1Ksuo~ ˼.v1#|uk2fK~@] Gh8{x@DZu@S!<*xhαl#O}7 Ka\#[<&wNCBVՏLHSEČWb& 4 aN0ճo- ?M 7&]*n ^bQ聁ܟȾ'&S8FYFw:tG `3!!| / J|C+J6Mz? (摘L+\a'_0t7FvŹ6 dgNH#ż˓L( n*LOY6;tɬ52 prv M,SUfMM> eg@@ɱ?`Z7UH,[, e4J_:a׻%<juhVK݆ މR.C?j [cVKEͅʠG5f(OLK6``%tW"Qr|yߍ6؀4AP0$PUWub;x CfE]n{f I.K_;qlcq`A7?:57ėēfN#ɖKxyU R7+=ΉQx8NF䡬Oz$ Ypc@+wBG_7Wq,NNw6Kem;L=@B*i`3!,'BY y.]-NNڍ#@ۙסB)KWw )=۟5.V&{Ŕ&4-ͰG*yz7hh.oԣE)X}X0B%$*X7Ze `ȏ>U9YκHԡ% h\.j>AZ7- ˶U._hpӻ՞D̤ wg%X¬d2!v4ΫSWMZi$L)˨A!jW+<|lb oGR2q @>H GN~fnXVwPA4n\mhHI{߳,v 62TNVBw[%"Dcu0@۩ZyQW~|V1%Z,t6P T[6GƢ@U[dǣ}'-KDsЇޭQ%a[u%Gܖ&k2 (ޑtҎj 1 I5&:!0slpͪ!ȋ_]1G(USjpTو=i+붐F@D<_RW28va) Pv(?Ζrd:ueB' R/h$BXT\/OsB^Hgqys&* 0/) {?/[l4|<3X[,EE=v; q5U tM"y%Z}FfK 3xTCRI$,BY9\AׁDzÞjJ-g=ͧ1R,h&9ш)oQ`:Ö!?!IRCɅjF;Oa4wy|AoC} (3""X@V`˞wGAFnQigA hqanoUV0G҃v3A1K)`YͲY& /50cL)Q 1bO^f3J1U2xԞ]_a?Ktm޲![/?GR 93WheŜm ]JG6BV,nIջ{[x[rUyLߤm^Y֡%'.y;gݰwXkݛuq6 v}£҉͒Y؍%8k%f ~=R_;erq-efB{}5hEhoϵ) zw۽e*wd-[!G#S]_cŷ?zSmn/iQ#ы`a X572C){i٬Xk*ų~\07,q-p$ ^8\=TJC+[֪ۀ ׇܲY6d{ɊAkDSmiYS4fFzObhv>'KbY?b=7WR),*OG<&ŝpr*nPR]}l*48m8wln[So}#dg NL 8z.WlϹzJ$S'1ђ1|DAk[9E'FD|.i)ADQ6|))~@*ҦAhMqaԖQnB*̅ g=rvI ~]8wg*~z*`G ?1^< G|J_76?dz' XDءOM>Co]@jm_-B0Wr~Sf<0BY ڣl.՗r}/8Ʉ۟TY C[>#ܺJ.;5ppR^rl7/kf.Ѣ_TY 3 F0jI[uUv}2I5b{3yM.ڬ'HsDՓ 7gil,=&05ݱF;#vcx,=Ү= Mh0kÁB uՑfms kwnozp`xj ex#'n,[b^ڝxpօN$!YR2u-# ͺp]P&QҤC\kY1 xRK697tVHy>bs8f7eF%ڣ T&C+OU~C3Ieߒ, ,.;6[U&!߻._yHh2%6ʍaZ/@N q3^p#?}2օ$+;αToUr:ԕFvHJ:"U j:#[kz;f߶=dh GC[(^R}IM[/`У<'jxA'ؐyoHOJ? q/f<.]Hnh%㰇^_,..,A$)j"q}$^/v )>T0;W'5'yʂ+Wi"X$eՊ43ϥ8gTk}LZ?1|^Me 'gV0*+ӘR{鲭t5 z\ږ-"D -(^_p=dG=ǟkPXwܩ2CP?ܯc-KE.b0ȀD !*ۜnLRV߄v[CT t^d/EhlCQ1 tITZW;* uCCߐ?L.24횼w2ҟ.;etnqy% K)*g8L ;6~6܏GB%zڀ+~ @ճVgƩ& fHܱP?Tn1` CA[DYK,]$,>L».A8p=\Uw fޤ6 m WLʖWAit{Ԯ֑km6ֱ1,;DLq )9[Ln-]-+|UZ }$ $~=ݢx0&͋܉4,y!߷ԘšBtjV1hA2qPU~ûp$흴ʸ@S͂RiV,gB:ξb^ߜ, CuX{NO=LNU,j Kɋ]aRd_##yk:k}375MlH;}8W3VD78@d}SƠrͭLb%kwX@L7b0/1MW\X(]aiĞ=*1Q\+gu44+0ӢȰtEPDu()eρW Yad}OɄ̭K&Բ154TqoA؀xc⫉}n.3B[IĴW~;=pdTg߸9v0;F]+SAL)aߏ^4. O fFp 3B0)\4Fll^ ǕaM1g4X+IGIF*˹c99`BZy6׿ S KTO 3YKgcd[ak}@skr/j)z%28yU?ue#uku=\XZ5?Z_VؔԪ$Kqʭ54v0Q<>( HcP ۜK-L1iEt+ȿ24:"6m޵A%(c` d=cB?jgM>?+S8H~CKtqT:A&wDkUS6`6SW$<#ׄU ye] ]1Aꠑ(4I ("W}M 9HeÙO6 MDiʀK/P̈́nЈC4dذ@`iGŧaOB)=׽R+y=SnހN.oW\3G+z'Rљ'v <'b&MBT'. ؁(ѳ*#0銪0ҊG+ma<ܢ1SO$ApyȨOx1tJr "dŐU#l;7 iF=ک{siK@F#6(b2ԩZ*$qjF%IըJäB_/`uVx`;uq BSRmޜ+ bs)`^nQKi>'Y]T[WkV\rsԹ2zp`߁>_k' ]p͟n ˆgJwh+4m.x'Loyz0]F$) §$e!e7z^.p4{Y0MZd [O^ƸxUd `&ӈq&$=)q}b;;xXJu_ix~a3O\,̘0r4}D'Rg1Ǘ+w_gY-`\ >>WM9tE}B|rMZ㓧-`<`%|e/˪y~.%ſ>OGn&QlͷO>I ~Snaʖ[ElmwV]$uFXu, ZD<1kGy7NDm#TúP>cw/zq^ۄ4i2[Ntts!1i= R3xAC*j{z>+0璥#G@\UCƽp~zw^Iw1\_Aܨמ: qo$}HgV_l1b9 V &}][="0\~Ըida raD3|fӷ^PN9sd'H*2݇y|Dͤho>kZgMB\vJjIJCЬin˜tՓciQxf%sG{_|:KH~_˜%Cld,8Ԡ-0{s 0= tժk{ ,!/F@߮j='V:x2l*o(\'pqPmLi; 3=2W♲фj3Ja *ILYp'`T_^T @պ_×$4Ow/U;Jă@Ϳ60@ϫq.n^Tw+'LfS"0*v>ʐ1Fv!N]M2 )PO١ 9l>d5 &Uf4@sZL\#s!? F=TvIBKO%%Mk"S#M15gēG'XHάan``sډ64go4u'+,j-4-dP-]6g2l+hvN_{?WHQ̄wKm;O(ɈSl$I#]6#寮@6(ˬlNx@6X ]&m:mz^c ELa@;劮\ R* Nw|IgiA#M"{( F }0}ٚRG% cw]W{{LTQ٢VIQ֠xdoE`wKЉH~'es}1/-ok}uhzVozߜt]AJ"l0]Yw4 =G =¯p5}z>$|@y΅lYkʨab蔉\S!= פo^R'|~+{O ̅5CF|0qQIvҳ˿u!젃RZL:\R*eWD$3WGOsAx6",3ًCrF_TƧcz :c%3?9.RL<!eJ~Ap C}&D߬D6YiKy+J$ tXwRVj),^jϕhy*`ؼJltvXѕ|"4qЋ-!a1? O/p\l R34gS%vWӞ$8qo<9!\Zc9ю%0 ӌnm?ZPkᤲ#BhJr-hr;ÐT‚7crFgI_Z7^7s͕N>Zh& levgn}듍NcviñUNڭJ}rXA=񛣲Wd vN"7p(6۔'50[c&L x77S'Q/\+l. qd$y)=)&O.aOg|'JP)L5n$߆2,=!<܅m[ɤ.pp謼-kIO٦/b83Q=MiiubE$(!{֠Z/r|uB(Pc 4Tl2.uZNDW@ǽ>m '.)S&11-!=e6P@_z9Gc5/{^֩{ ^m㞅9N(YJ"șNP'D/~I"١ea(d$v ֯֔Ů䪩⽋"zhI3J@/Bgq@?x>>bpDa{[gӋW.K0_n=bT*mdo6}M["J/wkgOlм g>cҠP!DL(Wମ#C}=0XdՈb?pyޠJ^`u,'O(WP9y2Kj@I6ƾGyߒp ڐs^fNKt{-b3Qe9?֤'mȣnhPNxEJkkiY*lȅ .0hfw6T**?_XqXL>Dj/1]c)*1|hu$JC7n*ge=x.Uo1ThT5FY.͔ס}fk*7mjFs܂}@a`:%]Ecyې!LboXCNx2WuSoӁI*7*uM'D#I#pB4?Rx'o82>>ST|ǩ%/q6ء{@mKLk#i-WU&\"YҺ-20̤q:f_;=:dOjJO;Td!nuJ2:Ux [terq '0"ѢPvYf@#$><96k>U 1.~O~\HĮ5"&?%7R?]Кoz!a>`$@}SKl'6Bq揄NExӮ+g=̿eXio*bD0jW:u{d]3ђ:D`2OZl ՊBh8"8e10֯\1l PȪ\Xd}dS-U4*=̽elpWIÏUr2eBPM-^,|Ul୧?E q|#EZsN_u\M=)5 kϗQ} h5lx'VX"AoI'\A آ5)6w ɁN3k6 (8f:ů]\(ףԳ{t[p@1@J"c-(yc3hiiK 0gyMc0;*.B4>mU\]ۤʤ=.'ל`F?;8-3*_*2d q#\:l# 'jQLrP;yOlbyuJz0y<6W]5'aG m];ڠ"ٟ5a/Ng2AXaxx(!3(N!1 ,:]"Fw,߀CT('X{ &ep=n[ sDƎ jG?>2BmsԺ<;_(N 9W:C/iD7) #fSJCoH?溳T1aT.ICa <&\+;_c"۱̄ XKB9F)` cvjY4 VK٫,8=+=dֺ1%QJ >!$b{Do?T6 "5 @ȣAGs}Pys=j|(٫eG_1I=d:lj ]tiE;bpDtT}gyzVwV%a@ '8~9ghk7l亵x=O\q¤:BۃYŽfP͗"qw,xh=(f_(HmX~E]RR:Ϫ5 0  G9D^^kpk!V b>,#KB{b ~ZMPJ.M;rxXr᝴$m6U/Ɲ?Uo ڹw<(IvH+aK`HB#^"ũg)Ϡ=߭2/(zBkZ hMI}n0U}67Jl ťڸ9W }$u"=xr0WqٮObhd8l9j s1 C !!m!sQr'zxLOcx+sS#{`49O;ێ 5-2"8+ɚF:}=w3RyJKpom[b\O4G)´ÅC :/bhP1 Mt.gϗzɉIӽvs`G-6E -{>%Ζpo vRC>7xZƕ RCDY7K wهjp􂆥8Fl"ٔ,E=Op-~Ejks!h;w]IX`'`L7aeoq)ÝNc3Itvs<9YClĘhSnr*j]FIfpENXaGal%+Ǟ7{Bw:7-x=%i M#| /C`S@n%(Q!ve6PJ)$\2ޏ0$o'3t@6@w6Z{j$VpTD%*2[g ,sH`p&Y%K̬&εͪss+'xGmWkt>Y G%Wf#'muh2VE1˗ %?w`n$]՝ У4z ɺQmloa5HWsojQ~O]d`>};ڈծaۥ;=ܡw9N;${`,LHH*dFDNlI`쑙#: pTV} 'C[5h{68fփoWM!dy-^.KH@|[,--b =Knֶ@<0kyEM/Εj^KDneкJkQ܌Z]znyű!0-Xf)U}AP"oK&o-cICuonClAnb V{GıG,Dc |=[Z9{7oD{x,ߩR3SX׃%]> C:cll`;E`KXA yެ<("! bufugӬ(qEGh\:{"j Vފ'E3,5=i7\VG~/SiHq"k7( GVؑ5_ 7[ĭ~C)}mc9~b q%i6y!%@$Ljp o̔E:" M2AHA^Z{dtۧ %YM;qLfy| T|_Cb SȔe<,0a"} wz&`W䃻"XH{*`<_ߧcdF6f*9hyě-k[xt'C>\kVF4UbfF~M@p߫N (2 HhA*hSgn(zZ{Q31u?`#4(*f%l1z&y0 ^}_b@OEwqdyc~9!ipλ}!nu-b=F{WEklgFyq髠 :(W?W͑ 'fKzLԀuƀѣ6}U0ՓqSZFQ2)䃬J!fW‰@&+ΠX^IxykuQTLX31~W'Ct#OD||R쐭=/!*H]hخYL_ΣrdI62!IQz!7i|[alZD3޺e`q?Q_;1T. s֛\iKQJ`~+UUxdL1?ա)ඵT?cZ[dv& {|Hޝ,5O#WlM> ,]ÍW~U>Vv -KTʫLǓTB#κfKg!*9 |phh+>ӫJ{i )=Ue]uOMIhO-ŕyQ=2Hxf=Rê'kwXWS&pERB׃Okcdغ%B>q[[,p2 ^f `$^zEly<'yw&:2P;%oWF_ h(SKƉ<:*Wln):yxC`4~oP0Y;#J*w(OXѺ?1+N~"Yd?%ws (cZl2~Jk n P͒)ض+踵zbξGF |0'UšyZw`}.P\Q{]qHFOAJ^`!7vpb:$HAY $jx:or}UFn'QmDf+ jS2o%w9$ɟC<\ +V{<ݿ@F-C}嚫:Y } 9]1!۽#`#)ەJ[$rM/9B M'ii%FAg|XW˚ʢ}Ni?EM'v'ZVv˿ 7ƒٓ0ސT-7J<@ߕ]'j{WSt]4릩`i\SDghKYNPA:t\?2xWFXxi<}a7;Ih] SS]F&Q =:;Y,ocsϰgz~-'⇌d x83#Q'[RrhG%.9R!r>q27CRČM=[zS +]w ֯Wg`j凫jgA/Q}se95g}YwB&TBN{l"=Qi?F ʘ :.LѳNCeu6!Y(b\QЖ# t܅15D}‘LpY5x*+]> T zl s fGP$&*,&exjx G:+4 >:Rڛ3ޮ5KumRA#ݟ]M_:iZ\][aec_:rE8/3dĖ!g P"-pPxTn?۔zԕv3d(^Z"ᆼ=} _!؆]pk͙3וI) kc=}^FO>~}q =c Mt):ר ν戞4.-Ŏy,R"šH*9݆DӡfcG&rhaK~bQۦ/m>1 y \1;JM kt2noFBPYP/sj\XFk|34@ՙ'B}(xB72 |$ 7ey Ha5NN AZ R\\ R*7*jr ՝=i?x7̸  y6L\!p:s1A}R[߄%Ma&LJ]Ps/3RSj2It/VrVi.&={!*0vٚETy)-sbX =8huW +0?XWzUmuJjJ2ڝJ څn@NBe<5;j A>tYʼyLr\Z*NUaĸz{qh^袘^t O*1HZS`8C KE/-Uyd15^!TVDRD`v,qLܚ3bRniP"y/#ڦjP^\1_Οe*cpK0Kd( DQ c'-k{Y^3 !O6Q"@QPtcł;m$oǗ2<7Loئ9P&cR&E@kk\k?¡ll %RZ'XrP_ Tk-1Mt~^޴9by"Q CDn[< w5 ?%4` P^ ?Z=֙w'Z͊5+O.l!`ϗ'JQv'C:iMJQ%_]W8pOAQ+ 4XN;S-7q΀fꤰKdZqQ>S2JАygGRdU#|a0!J@#LkueFUP/Gvɏ蜟KݬC)Ve?IbMG4=^}>R XD;ض/81d0K #&t5D47'XP]J[I~LJa$KEKfȗu_K,"pTƚXJjtC`#aYH!Le8VZ ur8R2-XCҤVuâ) ~&($=m㤴 H'Ip[ d)? cE$ο~;Vq/ՖqXltt;!>FYJ8^!ՃN77 pd!|!`\|&+SU|:v^|NޮBP-ʹ~)QܕlZL[շ C>P` }?ɶG#9%?4S~Z_!/5S+ulealO?:[`t-bF!\ӎ눁=>Ǝ $eՖs4LK}=2aU,)eZ}O*niٓ+̩zǁM6`*Zp#ny4Oj>WX# !+:`dauio2%(8V]g'H2Pyҿ$uz#pZu{+f'X|j"|ȵgR1%,$}F[Sm*s嗈Eƃ5 e~oI}pOzd-FQe#WפJZ翘An ߹Dյĝr!]3*ou腄и]L5BMcc`.>4g8a1ksG<8ˤ`_?t &AbNuJН]ٵ9V,* 4[n` j_?d:WWB׉RDprwlBl ^!Vf8c6TGC;.=ˋOݒDRJ9m#U\uPD 43NdWإHe 1]ܼ9< z¾3T- "E ю>9+h9Rt<_,;wB`gu4$>_}6&BY9U7ITm žA=Ŧ\|빨_Ս:i8>:`ǾqȠY'$-L7`~[gC^+YvmntE>C)JWBPd,Xӊ56sSyQy E>_ۍlA榑 8BB+3{a?x یl+Bg;~B6qU~=glHxB=)כRy}]Gⴷ9:i@}_pEmv-gIRSqCIsCuBvdw4m aB~蜆ûHx>hYd׮KUU;hXRA~p(Ѿ2 9^򶉣bd!Nm#vj` (K lmb/SCo D1+竷vsņ΅ہ{{MG+Xꁚ$*o!tC ΌzDecm|ZJ3-b^0|5š/,eBT#I["UQ^S=GIsQ6җ"õ^ b]Ob/џ%8Nag>$a3yH+vY$'P/nkhq(8'l4JK[Le[XnfpƹC7Ӏa]!GPT!vUW9~{fd| I#{j M2r0?f"nmEc_#XojUX؇okWp`!@n~Σj~Ehެ\# =Z?Omg !oD)}X~)b LZy @"7xMzaW|hP𠒉}੨>)fΪ^kN RɄwt 㪹@ɴ1NbUk+Y?VcbΑqZ.-' Z"?uhU޷QؔC!?_[*䮩2m\}uV($**+#$|IA+Rq֙n\9fBPnc 8xQ4w|-)U |!P9oy}bmRM0:G%|e<ɦZ|(hH0so!c#:J d! ?S^ H ٠yvU!F\5xP 2C43|1Ϫ3 nB Qd_{ c/NUun.PqL9WC7K`^C >3݈X"yvN3s("rǫ-Ko̊#cZI&tىr~(|t;#IRO= v{'.9͓gQ;Q'!5Oڷ7r&wgjE1VpE3 Xsd>L9CO]͚̈́;`An#>@̰S?ńWcVWWGb-$7i1ba=dYU=P4`*/pz~A<bb0S;""ܖ XACq R'9&j2Qw}GymYx~*xve2d ǧl;4\?x b%c of&w#U$]wy9U `}4T$Fkg0?=#=*,l=cDȧ-ɥ%ކnw7J|r7Egh{ܒr;k/Eչ'&Oily$odXgX@@mtp&EMi~99 F@!#)Bb`NP>歫QՑh{ďVٴshU -* v1p$ _77>&&UE z8/E:̐)8 e'QxĹ =+< DMQw.EvT?==P5ȒC*_9 @{Ңdž9l}LX۩o k1LBGdvj|9OVNKt)@{Osw#pNtcBSG i\d>_%Ba { M׊V୶ű$QL jaVzp>Ι_8Nҙ##"sh+bxÊuӧfEa!ŀMH#^~l&~Z;KijF2_\Sq͕w]=NJ mE '&nAL9 4ɳ](C7B4sq.a GV-)q; (%s%7zQpz!=KlRt;W!ճ J3Pԑs޿)4U7^(wƕR|F'_+4^}3['߃0坂N,3I RȔhx6cI%_l~֐D%0]_q? teWE1OL%2f92 K ¨ZqbޫndK垵 9H;蒠 c.6Q,\%j@()JfRWچck/Jв=8} E0[ti8ɼFrʐl Rݳk7GA_S̑BY(ۡşcZ-Eܘ7ޓC&G%E1O{C?o_?"йoZS}ؤmG/wW4a'F@dV`'ʧ` 1OzQ">"o uΔyyjuy;c#_%FY+)a[/m66^dvdhY[a~kǣD.cR/qŷ: ?/쇸j~T}NzhFs]M@#0ۊh[>iDeokZ. }S]@.Nj 8?2d0.6ڣ|ۖҚ,?`4vhO{DDOʴo3cgشd t!E lP/CW^eH(a+zJk @$&pAхi):M8EE(`uOWZɼ!uhzkn$`Fڄbw8n;t$4{U%4>)iΠp)8B!VJPHUEh$Yy1'L ~u]ub̧H|L?!+uD.ўζi<1S/N5'WUm8AIrBJ9E,1Gkmk~/O.NpRGpCCƓ꛿|Jߚg*]M|i:Y:A{]/{՟^^$p6n;5:Q`G$5b1ɔ0iw2L$('0C'fq vu6Kmh凇"7l8Mܗcs?8*H4pt~joikKEyVb5Crüd2*cG`V5Mj_x.HE#a2Ua><zҳ^kPyS L|%M Zֲm<$$KhsuE, c S6 ájCW((me|xG@MI|n6TJr!&F)+zvi~uR58w.?Y7U+ yO5L\ɦxgnaU-MslJ˕ |IJe%aCkRaVG H(ψMGhi2 S,?g$l 3OJM[Wl42ZN/P$`k˰ 6/3v!j'$wKl]_XWf~zmCT;D*D|vT46z*A/#[o\zc>;sVUi_\x/*W643RB#yǩ|&Q=&ggW0lb>kinG hQdY ׉ROWۍ)ꨳm@#cSE"B Pjľ\>rʢo GJ hcmU98tb~TkjoAm^׍ d,$- HNƃWقB= N:4kˈ{gSҿ)l/: aGVx.G^Y|i79oH+ bm-:@U9IЬXK>rg|->6PN__bw/ԵylRRt@}2S(٠X~QM ,Z4cԞ/g-倴7-I :ϖH;}'Q1LZrSByzi%QUٟ >ֹLU%Q'@,IZJm R Ŗ#xr;rp=)6 HUj jzi5)n#+nq‘j*l&IʐVkQ:l'kaP)rGg|6`^s:(ꈵPK+/IvaL0=l8%fǑwQ+JS4l+2"S>s=5u>Z"CFKq2|OuԻF%č#xLy*ڏ̹ė`&@$ԬPac,qsr$r=j B1V ]SӦn@7ӏ3F]K:b,{WBX.]gE䧇'C$(N:Xu  ~ϪN,7|H0B T1@g<RY$ytRB lL"K[<! ]WdJQw- 1eg+T_C\HGSo T;4*#?kmws!8]LXԎRYF[nKD&Q^e^++ֹCVVcI*XqkĤ١5Y۝*qA{'=WMDYT'=ߕr&!I)cU_3xίTXL!*q'-+מȸ3ڵ)TLP ~^d𢇃 p.&HW2e>OG9Wת $1ԭnPqF7[ 5~\b-ӑE)7W N߾DOIɥ~;Ho&CSj#Utk_Hu@ N+I{{ŦEӉׅ-ɭ;PBc%5 LM[Ԅؽr6,#{JB^r|g*9<1TIe̤J]dx\!W6TErC$Q;`.\y~Tnw2͏:{˙킀ot7)3)#Rm>K%yQNQPj6&.B4\"^ rNl}t2QW 2gy(}(HHB120|xŰZygWCD4=žpta{)%~hg[:<䙛1'{1TvU3"Qex T$b ڄ"Y@NԞC +.IP4VC EO'0"a29"߼2x3)0:}x!?e<Ԁ k1ihzm=8@AvG۠,x% .u0`)-Ż6n!Ye͆ݾ!䀋TrYզlJh_ՒqzӚ)H*.fӰc`Xh6Z%nd0&&AFW HpՈ#V1vStvH1dM0;!!P++瀲BOj%B\v B/+ChO~_ך GౝvOZ=6 EA3zQ*NO}7 3M55ml2z5R%;LZDH7+tn-8. -XU=,1#ʘط]sM=R c<`TqDu] WI 0S76;zy}T^1P HQImKƭHwj0>D'wqB}Qȡg nOF#{^U87bb!?.'6eGq ;j\]!bMjeTB&VqC쥍=/<~j镊ʓ+}ވbeTs=ҏsأyVDR,vwSE%j ;dVS |8w J'f;p0~:ݨՑ݊ tN" 0BRhf;t]W4d a:EOd|@ӥ!YW0>#+on_Z=+l !Z&l#is%Gd6 ᰌ8o~JXֽ% Y(y]IJ!,8+1pj SQ2-NSQau܂G7{^ :CkٹP9lSz8LѸ}V7f`ȈX l#{ 'izCk5nZn[a{5g)[ qHH|<.ELK| ez.`}ܖo1vq߳AW{6Q5 ,IPJ +FoJ}g⧫\:ͣ2Jzjpc3B\A˷$i!. JҐtml2 ǖD֧"LG)4k%;(Z|-n=G8l7ˠpAE ;^s7Xs@"|'<(yR7v]M"cQ>}T 5Ok`D Z^3Y ^nYkI³t04t,^c`QwS{̘N(Vү"FD(qX_GCF6zv8}08͂N[uM%=1gfP{R/~iq=pߣ/5H`˶eo V"o%C-.lbvKfc2lc`z;qo\A CZhv82cS2?MpHzY~€bSaQn5dzȦ,?\E_='2L ҵKsR,f/ ?A̖a:uk7MU:)y"j~5E3ão]] Oi` I53xլ_n7@}=R:3qݏ^bolAu Ylۅ=Ugu-Ğ8%4ŖfȆFPƌ,zX V@H<)lů̀V(եب%Ǹ/{<$ߏ{|8߳.m^_[3$A j4ݻ4s8$o9[grX<8N! U%{eƾycqqKoRD`F@0KL$C\FY}%䐻>|*³ItZZӆ\`HZ#VsUq}ᇏ0gjpbՖCe5b~:D$40>h3bV_&Zndc_hu4 F6R-\Hn]!?kl0U l`J AR-$x4A䌛׆pN1K-tUm5-)J9T-ʋQ^=#-SyRpiDӄLOZ=>3d@,أlVfHӛd,#dyLUĚ0iW!K%~Z)ǐvt0`גq5Q{c,(m+.t(>!6!VQ .8_5Yw80&uO)f >wz?)7f 86}TOnCƏTL{!zWZ0-p^ǧ!TI[kfy[ RX+x~m?]Z$0ͿY_eNjPu>ˉ +Tjv|9[Pk6o,.[0iV̬my87 ~5PqenGlI[:K'=^ P0}.>B]# ?[UXT^4|J6bÉĶ3EI̳WyW8FƃEQ~ mpC3$m3AmMЕqNrO^]sud]LTao1w?4uzJ)Gb ꔮ}TIٴVM󏤮_obP`f7r= tF6gם.9w~a(sH 52=ZF`u0C4\XY(C:N_ baV&TWt7R^jpT+-W:%;K/y"F*Pڽ4 ;h]lf6Lag Jd$bv O_?&5G+E{$1.m3@%/UcO 8{f۰e#nT~LC*9A?2sj-AsT'zDu-p"&f :{$)`UPQ)O<qxGQ; , F!ccbDzL5( t&n #hNQ#ZPd##,H8.'0ƳcmNfH4]"9mA?Gg7C6u^rre-#T6  ?͇?t /N7qWڹYp9Gr #eߣЮwM"-NH10qNq>Z5: ,y"ެ]@!3 ,ȍHyg hEi$4H$ѻU}kw17+|?pz?hjlq HxPB>hLPq0}hp gҫ703ߍO]FtmK Oo?d']y&\ԙ}ޙWahMB0!&2IVr!:k~rN®GЗؽhTp; b)\ۥ/G'1 \ 6a0e 1b{q^0 Zր dBd>hai'T,D߅Gw?ǟp/bm#Ҝ+4H }~Y[)JT#Th#cl '8E& aJN6*o]tM64 ztDnԶ&$8xh#G% ؑs- %QkdPXsA%h1+/ʩ(+ bSaʅ~xS=me @4[fč@u i7HZ<+ԣZ5 pRތxT,m6XܿpSЏ jl qӕhǟjd2KkP2`=I o8 -F T/;qw#4dǎ Vڙ&R%Rꞛ52\tuL`@x[UޛowgW,ȁߑ gj@z_:zMO~O=N˙zUnrG#⦽j~"7s!5b}=.HQ>!3'a4)GXZ2_VOecE6KtP:~ܩIlKK8|_x꧸>jz^l7TlQy2|e1N`VVGfݧ:/ An4s5z %e-/〞 `G2/>Qywa8[ /]gT#c3I:6i<6|wsк!Cw(`|#YDUEc*bf !mtotG}V6j'KG~Qy/6ee:%B@":X6?z Q.WE) L\p>](B9fw-]0 m ]xwL!jn"U4֘t^3h%W.1w} 7?U}~pϔuYG᪁F;*fi{܆'TeܛS_D=GY΍$kNKRs5:f=T\,J?9#;P.8=Lp+HI& @, 8&>2n];t=Q %fK% [ST 5|rXU.؟&p#t:~ OU;᮴uм ژxkHYpɕ|,/Yh9@mèE;w 6zMi+tXP-x{@|+_N7f$'DۿP( S6k0Tb yڑ~WU.1Qt-mR)n6xLZҍaDK-ӹK =bۢϧ1:_R(̻X[J]L ).Cue퓎2 bT2dwgU6ɤx}pu~iPl*',&-_έ sk'zs JǍVZ<|$װ(6!*$-2\L( ?'ڏBO ]-fAF[AB]^`JEaSAG51.6(m';!UHr~{Yoڒ/ԅ{qȝzW.mvyZ ~e^(±!yppPضhMPC4DͪQ3-yDUS"6f`+] iSQ|`wgطlqʸ&vި>9-7@fEDX7 RbGؕ``E0xˁ|[C>̥l ;󷜀tG̖p\do<[B])_8Gϱ(!|^!S2\7]p&N+zUIV1fȾ!<+_rbw`@W_L9Fu"_Zcnybы~d 5: ~ycJ?16/]mbho%2g(xԵ/̽TKr+ut΢+[:9H\$O}:."ž 2h]9;e6hb@y:|!~CQ05>Payӵ_xÈs_^"x* T. +pn*pd`r5W0O\uHV7:]lcp'"W4F#+<:NpIÅkGԒZ3JiFr؁d y]m#o?\!Kn꥖]1Y+NыJ X;#Jt?OЯɝ V}nj7E=2ZMM7\a Hq,W S"6LڒȣFMo923OX::7T_3vv}V؟B]GZeUbBYkb<EVE*FOBQ.QX?}?Ui.2τJ? !e ~aA8As7xq)XW%t]٭(JmpBqҊȮ0}dzRhC2^|dCW&G0xL$ \Eog2@-Ʉmj2 &av%#,"(SoalҰf) Z4էW(h:U;˂ 9b `o/}o{BP-e?x[wfiI]%+7$ĥ֓ ^<^_ ;,ߝF[>"C!6J y,~dwx۫35?5ՑjQQt>v)zo|#+ k5@M^4%s;9\¥f"ʼnO0*KNNpf*#_X` ҡU‹Ȇ=ɾU =1pZ?އÝyO VX/S(jȫ6A`uφveݑ1?r]K ;qrgO۽ c;Ρ{Q՚\_zo͛ǚ0cDEassiԛ*qz݃+ެlaB)PFx}اUIfxvxBJj>reeߤ7wQc9 ǪrjSE ezyU,X52J ̄nio܄?@~SYکʕ`?QD8g'1T[r:|FUD /څHs2#LFQ#/H0شF)k.^Jٱpoƙ `o9Rt/6)\) d܏v˟)(FP}l7qIN~>jk/A^̮,%'ͪK/[pzOvAB17i*hBpW $FxwuHͱ g>p+`*;N4QyW^TH\qѵ;bշ..iEqv 1C1lb1,Aä!I0}P'~_jg ?N.5 ]Y^8 xF*iCbpE/< IDڋ{'B.\1̦Sezc T69~~en@/)ں (Qfv`kǫĆX`߽36~0tnL\~o{q7fRȢԗ)})ިGtTlWۺ`W::CG4\cΥۡΕ$qy* (VtR'{,H<sOf/Gr LzQy (SͲY(o/N:` ARD$, $Yx" WbT&׋Vf7|S{/}&iy8d/K>U~&_T퉱 96hfۃ݇ygҜ/?Nb>,ى\pO|m]*[ !Wǂ˟P?9@ưr%&ϭ`ZJ%=^feGOs J94 Ӿ֋|"uqϫw 3і`jIbnhQCqѼWTΐ@y)1)*l $QPZxˢ*.AS> 5A4/- \Am\M-QY/t\eBz`,Õx'k|+gpGdRlЍ ?1{e"7wiEZz*.C'!kGg>Hp ,Ѡz(Cg})^:]>Xf|Bjua ~, 7!h##ۡS&Q*_ˌ^8E[M1a4M|!Z cVbYԛ6"n~39]`\־ܴJ:^ s^@jOGA7T&z;_g4P/}I^rM"J; lҲs.@dOjFQr1MU<7W:H|Uv yYitY|cp>fպ4o$mAmJdFK.Ė m(`G{Ss7㷟Y/ +ؠI]{<q=gۙNuBOEoE^L,KEM>3:\AփTxָlcVznQ-ga<ӱ2vB"k9bRg$r/,`>HBچgU~+ 2H^qw 퐕]>'1(Vvfat'.EٍS4^smxi![̝U-w;d`;ű'-kl%CB2P#GA4ޤeAqjiwqk~*9w[x2q+O6]@hv UJ'}敆ÃV3CZ 1vm.UߡS y -5 J˷=T_n >%^qjqE 3j{V6ƓQe"#{8dެX?1h)aVRϬ'Q5YxWu+:6$'Dx]z#&;m a`3qݐ;̡[crn!NvIQ{uTI0Zb u,B=ʍ\~$᥂4q-mua3о 7%k H$NP`ᛨܭTx =x?E\Y /!T_ٟ["6ibOO>:)Rwx;㍺]Kq=+KOݿDQq4ď= @ޛ/fq|9"L{@"r\M[PhgPznjŎX؜@*/B J,tk9Dÿ~Y "C|I%;7 WND(M;*" 'QjseSٹ :^/W[cH',|OӠ!J]&,WX<smWk)>5Mk*1i~=ϔk@v=yQZ>Ȏ_]{UELgU?`aF$ʒ '5skO 6:Ѽ|2%'p4OVS+vkx,clx{Zw:E'˥ڍZ|/YV5,!Ѷ ;:)i8bر*}/6%+N״rY"XQi l J D-%&phZ l&c$=wW9m@|SM6Z$#Wd͎w{ JVz|]s;]EiőEn}'<@,xo hNaK&n kontG3~=PXB7)2XܬQ=8uK}|$Ml`6٬ (|Ib*A8H(8K(IcχgNE趙ERlɡ=.mQ)`,Gڦ&L._~`DenLF~V-'fղo@/1Xb~˘SAÃ9X|<3Q*Who&L&D&Cb3@m-簡?"Gњ,& ScF-ɟ~ܚzB+ϮUv67"ӭ-m Ap?\{cA,Va,QyW )U拪ӡkE][0htȢ;i*UEqHa hq! |_RF~MD0aCVG]l=k?0ITr)O .ugaYv16dK~tDA[ݮTkXi~Nc/Kdm$?"թ%s$չ@!U+܃;Y?P^4B *<ۑ5e&2;osb]4nBۜ^ 1hW) 8. D}(M7+FL<\gzP_n/odv\S 9)˦PP¸-.SJݣ]eYu:%Ei5rS )}#Ao .nHFM++||)zK+?.cfV(Rߔ10}R5nlojjRs[`nsUK6_qR;XiL'w08u'o0)[\eie:0{ ({a}(6ЬYɴ;dfu(R @; 9zҺ9i2]DB~(u}pJ']TX;qҎۙqE O. ᶞr!"ɪZz/nUpƅ.+mlԊAdf b~o y0ޮ`B7$oʝQsS1bIu v@{.9VXM( n+`+?5Txv*~jJ#%<'`6ށB;;plDMͼ;)~!^jv;(J!s5lRƉ+:!ye6:NBrYuB"q8weBro?oqkĂz0A'ogE7Ti_RP <H j^:xJ8%#e`=<7l *vXJ%"bԕcZ(G@՞U A-7]^;/*ۃ/Yipu8I,LJ)ØV98vQΚwi~U eTi+]"db?tYNruZh}j5crB#Vw_He\w LLiā'5dSYV}%s;υ{ZM>Cjh>-B1ݱX+}1&wk9ҽuZi(LNhc]<a(t {/$MVHMt7`4u %u"a1,:[7k4XK/΀zrPf>URO&ٛ:ѻ$ T07O$Il|/ {3) PK.b1ۃHo-į>O3^~Ț{GyC ,*nQyE숴0R+9V)sk×_~R7PK~.  dyChIS4LB|g@Pm0 ؜9n3IF[0~ Nu%nbQ}0^f݀Å>w95Rs[ ,v9Nj 墾}\m&ddfD= i)qqbm5Nه]qu݈zW%/F[-VP4Ѽmjj\Vēuyj7i \[[x| eƊl aMV j"&2nHGzd~Sep,B콬u &Eg9~ʀrNUt8EKa&t5)}wRXeY'S-ܮ@2 ogv$[}k)|(9qF?涗(n Du+qDR*R%Hs $5+1j f,xRc8P !@iBMEyciEx3qWmהH_o{%8L9YlRr0 ta3N)"G*d9>mv|P%>XLjj<~h$pU{ ԝ+)8- Y8У;JU& >s=;2sR *a[vXVB%82q#wI&*nh0g#!|S޸K${>ZaWT5<` WyhKyT<~*GgmMA$ ZvXNΐ jXŒ֗fO G V-'5`>4677 Do qU1z3ޝ)hv0Q\H+Q~)_NeI;[Czp'@(G[Ah+j BwR.  *UmvSPOm!aI%gaKW#z=+{}\rv\C^Z`Q%>lɞ?B[̗+M"%ӫm2D+h X,iD"Y"\''qIpCbvq:8k"Fh+"?ӓY7q9kMaqĦR+v*㱎sd\U$,ɀ?[-UwMK8-řÙ(.V0xf;wp `iFjN;m̧ު1A{ /%N(@H fC-"GȐI\cL*"rStMN Ch/"1f2vrK+sxOM¦YQQ1J 8@JAe#}Z3S̄A\B1z6wygtDOCE X`u?3p:z bc\Oy"Htޡ&e._J GY|b7T]I<` -u 4婒S"z[qWp?OSZZuR\-;˽߶ТՌrĸ05mA$?eA/,?P؜iVjnǁx2+_s g誋e )PfXNlSE[O70O`񙥂 ;U$+x}`EyT9w;g,^ -?Hq ¸eGLL58%d%~7\ΪUp񮧑NJJ}D[/#[ >mjj^{"9i &+W0|KuR#0x*$|. 3"XQY_нߗ/" Ӧ%z*G'I~`H֙,㈋hnydnwy#rv"džHߏ-O?wmN"-s_N=iX=ԹN)l5p"ѻ:zN6"QoWE=鉒v,l{0SpbŸ$&"sS(UԵ#hH>R/fO%X\AQ!DIZFYm<!5K/6mPt;\:7H;FyԬ8E%YCh>& wƂ1Rc|J-5<=Ii>~6FG', C5=D0LL`Wwf3- !pCʫƱiY[U7W1ݭ^-KBLZmB^4^(ѱm~sgceRIpp a䘬oCb7ϲSrB B Y-wF䍛Y\(ˈ0T>Xoo) jc,ZQv wjQbg#AC컱 U Nj*{ ޣvp92xFLq8XRn2<H 8 |V'[=xV'I1h*ok6ܱFt4%>aWpHru,opwar{~W]Uq&>V|šNt[3=ѕ?:,϶~~An%Vv^U7mޏ5XF7ȤiimC x~RpMLQ^ '$Ú>Ϻ}2SUkyAlU{w`=rTIÍ&ט-U<+c1n՜%Bm17tbMkQaһ3ngͻW#``Fu:iK<$9 .#GcEDg/jbE[2,E_-&-&K{®܆e+bh-Er=6,V6o7H.%,9Ꞌk0Z'W}ܐ|LG ז/Z/e gp=ԟXaw!!/*M6V`#)_ӛ2&! _VpbWmV]9qWa,O8M}LtqdbMgmAۇȞ!xrW>K h+J(zsxl RN 7pSTk@gg>X#-֑1t||L]k<\=kN@qt?c<*aa(ViHX^)mCS,Cx3 s \Q$$'Ua=Vqt/BC vC-I(NL9iuoC=8PfP)m Zkva<2~*NZ3D>r#Oi,m̈́U[ h5zNaX;'kw8DV4D6V.b}'.%?@\q6DCK8(u)60_s9btPLpu˸雇׉34Vg`Z(풻 K" \3PwyBۏQrٟ&ukw,| uBdfi5~E tqڤ&W;]U,;j;1{V5kT8Cs Cʦje0\u&-2n_myKr+1jD/|2'T`"N*$!YXF]?,f}@kR(a"J}؛D᪇-BrM}?8T1-ZY)جO0S()V l~~oI_W[ZR,6a2-d^gb!L&2`˙є@b`eV2osn vA>EW ?|-[;FrAbiH#-ĩOD~ἧ}'p#hVuTFOG^2@,Z3'9^?Tq R1%`isNԅpqHTH =iKP^Zdf2,=y6di}ї!Sx҂9WÉn3ѓ( kȜLӘ+ϭF_@[d83+HM 2~G)QeB:ğmW@U3˰Zb8W]A+nqcg;;[uYIfVY,q{ O}gb/nEzspBd5K]@SNf|[ĕLؕ٥t=NK`.K:p&wD%\F+.F,oy@yl%{T=W2!(-;eUlؾ(g1]d lܷ4Ś1s> xc]jRFF.HpM!!ŗ4~ja7sKSkPM{͹[ۧ88h7xn[L.W6rۍ;5Yp!T`,KX[hcM 9b~Dtzםd!Ց/ O`(vtvȦ!'6Nb6֊#'YPhXP hoFﲆeH~7HݜiQܽ*?8#2~$}Kdペ2 j[wl5kc$k-]1^$4j|:`yVܞ{$0FB {vՇK!<5YF#sF-L !YΖ9'Y-bN=SLlu-<;Rc^![+N㇪p9=,+34¯0eN 8]y?L2T'fop̮1(ZLEg% 9>k52Erv>.m&lZJu+ OB/^Tƈ:3m w* ,bEBUB/ȏl oF;Ȓ^+wd0+7Z!{~Ӝlda,Mif{MY9Ơ-)ه["/,Cy' 4 =Bb/Nc.٦oYTk 8> ki0XDzQ.X4!9ѥ>ܘgoĢHDDEV*Fu)6]?R!f7>5 G~ط9.C 5h-_UjN!N)P]+LRp,d&X# Wx#3=s:ɯz .`87|ksTV2PR%*[Ɇrygt!fa|9eͩ-J껟h8xD'ڧR75r7)g"^VcQ9KȮsBQ>Wهw~55Yvr ט3*ۨM "!5BVhЪfn;ؽz#lidYvkt[:cNJBRGBd$k7*uG`o2[ucD@U;c$T2?lYL PABU!9m)#mC#} ˨cBD&=' epwaQ{ N-zw&Mm-giI3KkwupFT[g$QWr M %f]Nf)a&d<;aXP.d$}WP\ya- u>- JJ+KJB\Vz0:Mtͼcr %n;223#ֆ<4|e|8%ƺ _qW<~gl!ڇ28Weqo}jI+|PEѰ*y^ _`-A^d|fuxILݙ+W*oy:r6K&J l ,'=X2n:L3>9 p0Z 7]A Ŭ ,7}ǟ e8Z@տy"(mt3Ięɒ24xCڠbn! ԥ5T}I(ݠe.˩@t_ ]j*$/vs#%2M\ߞp`57\XDYښ)u&< W{Y]cօ\֧o]Vq;TG"ɶ.kWk@a n'ɷYbõL\M-䚣ܶ0&k.yAgfz4Wu}m*Fv̆JDox\TtK+@{5|yqqcͬ XB:/W'A#!@d`g#e%sp-`Lol g?n۶Qo&g } aVaoRafٔEI=0XH4S3)bBPU*5Nr>$8EkUh E{#2ް  ,F1cqU 妞te \wryc!QWD%A s j{KP$Z?!j0ALJ㉦I3ߨE`3`{ QO9P&KnU 7E$ӣӵGtVm J\ ݋޼hkar 4l$gDwp^HEw)|ߗW^G]U"n#l\9X~w#p+n5qZeu;Q#pϧp+ɯJ:W`Y[NiO̟|z%W|VA9CZ)dbDt b58.i᧳ |&= ȁgr y,#UKTSR~j FMYȾ+-VM1__\Qu"$>J8{\eQEl E wEq9bǢMmx|̽2y0/e. ľ7EsM,X# O6+YW]q s&:ޚ}]"FJ&]B&"Wh$LC=v3mq-!_ eGO-s#@g(¿֕,GK'HQ: APAU莉Y;%pҎs0EkX|FL;Mpu-5-t9؊9zu2k@e1^GQ8|G܈kHyT:msݖ/2Lb;b"#2 5V8jPMF,Ć9v,#2n%mvj<(:;}=%05ؕD9sbqlw \ێ j`*VEW>˲曀8L|%FZ?Q,T'#*. R_"OǗaX-O_v0^4SdX i9ԛү˳4fD$P[aft!H܆YWGmT̑b ѻ/ 9{?z;S?4CL]hxPAϠbdIZG:Ag}^qp[t&S?eW_ȝؕl'nLBQFSAT @YyG0~x%!,Wd6a[ʼn,&\? ڪ a/\uޓ,#:]?|L&>HU@2ҕ7%H\M㊎h2q>9~CPuy` o*VtEAi(MhzxnBW14"^#)G! AY׮k~1:J3ۗ@ $:C_udR'\"u[ԬG܊A5[ؤSBRAEl˟}-gѥx.U6R[WAPH^_&}LdYYI? Z 6/Tr1xx7A7GIU77z'lڪQ&+bD=UO;3t/ܷKt>jvt((VF#BB퐖tMZ%Y_s=o*CxoD`̣6KԈI5YCqx@rHZ~_K`"bfEwhAvT-w Vg?w1C?k2F#rq#8V'&HPJCf7 Y޳`Ys2()ڪ!(RA%r-*z\ٽ $8*T8¹T(п{I ==IeE-ٚ fo:.]乯d_=n^fE| x%Qm|j8g=sLpM6ibd2# 3{1`?7bFk=e3w?o֐; >5!ؑbj߄A:j^ӳa%7-b2Ɂylzo3[J'K!vJUG)߬Oj0]}7~iXEFURKhm,5-_{ <=eP'k!o hB '9yUtK.9۳8qm >ts ɨe1&Wq!,ba=Ո H`SkToQp<: :Oq c̝T25[!{CU˜㣟#OW1@ەCL6ؓZL bб{1 G`=ڃD캔uN)8=8Ĝ2zi5V ! Ҝ1*eaW tW'p. Ha*efkh&!LlP&Sz W(ղǖ0c摛c0_b?|8#+U=;h>Kh2zڿp!{Xnd!ʗw0lL1'g KhB:MǐY[]; `$e%ϓ7Hڱ|Ԏ!`%ygwQQE+Xn%!CߊI,j8m?AȹS%k]bXU'hhwIxYrȳ}+yMp9;TMlW$_ Vm7QMМ"ЀՄ.66<Bq]^8,-m^oD\}nťMLMCkdJQ*c%hgI&OBM# Af&kjnFR{E>| [2e`+l|mLpZ 9\PsZӍhZ݃*:9Xoފ icTA +`](&fSAC/g5I RX0?fhiiTz)~PGӴanGa0՛jz,$,nײ0;G)>@Հ2lk1.Ƿo[`%<+%d+# ,ԇecm%el?yJghzK'uU.]yu< UV'&JpC9-^\P2Q G..6K;ꄚH0yUd-,L:ĺow-pLϹ~.BQ 92O{wJ{{N̗¾k0jǗ+qY'%:=B+}.ҝĮ- 1ExYRq)!=뙕˾e!SW˴1JL.v: (}ɗFF6FG)u52ֻ6̢e'J G5,Ni􂔍N\BVz0EP54 ohh2W#5e` C& >k܄E?uBdhtTIF̵r-rdЩzaRX˛_ MpKŏEC*)8Qu|,TJ53PEj!HȒ2;#z 8_ыi1apY>%7k#3N9W`M!󴦕hUò2Yڇw,u x)=*5j)GbŃm݃0u$$/+l$R8Y<Ç3[ixF*U2Uܴ0\9xSX>`9or؂г^wF(rP Jv|RJHi'kRڐPRk"axEaf(9eiN8=q4 ߶uЅ4 7&jF/͔K~#W^+ 'Qd^@uӳ;MO2ֆ | > >qc`C=Gc僺p ,D";Qk lc' 2B1xmDpH̨;er֩(EZe e7[TCPAI`$1 Onjd(_CXQCu\*׫pZ]K:2 h]*K`:1>"P~ }" Pv6 j/,oqCG :77gJmHtm`c 8Oxm"o`ߺ-|]*Ӱʮ,Tk8l7͇s֏ڳyaŢIroup^r%VlrD/]5f )BM%yA.P.o@d>_sqS^N)疤id h+dm Ahy ; {Dl(ʬpŻ/|gmy _¼f&vNmr fQ:IƜLx(}wj4n=K % ~ ('#J0"*0c{ER~YaCiwNKսPɋQ U{@";1|.iѓ%;Q᣼(gfw)$u4kL| lΈǴ._ 53U_!O<+}a=Rd{21@J|~ezU)HmFަ]fLfn}:1O&pQ8RoK7.^&~('mZNdhmF}M˼sNh.{Ld%s$;2StebS<@ I ¡(\8?7TW\8Ux0L&SZ#XfxlG\Z`ʾŴp5B]+0=, 4)Hޑ@zx kq4>6x9?qlMvژ$zx[۴l|?]D ICbq]>\ X\ŧ_.FyכUΜC^gdγs D?CN_[s!L۳V/LҗZ8V>6gVq ƩebG7G!/9nt>O]YIal N֞p019E k5{d 8~i'\QU{iYK@[g{fU †rS6pn?EOޑP$ͺqotyQ\I܁)VL`4VG]Q`gA/g_s?l*QG>bv+Wf#g2OND-@Ou92q3pߜCbp9$ Dx3$9f,5sPAɲi"4Lo&FY0Ocos8j 簟U.,6;(|qmsZ`@X`8UszA?LD uB:ӈ~e%*$&}֚] +{bsW8kD/C fЫwbl=9NjQ֥] ~|?E "Ps˱ zxD?"Q<ܐnC7cD.?^!Y'9$hؒ\a)Kh?\CLR\SIB9);&* omO9SrPx^tj6;1ߺe=T@܌]NԿzl1-X#ƅDȘζo D4^ z)˓|Uyt!>('4& 5pLJ~syή+Ku|mj-K!y&cЂR/BUo3T֭طd.f):$n5Fe2$ krV =@9ȿ.,S7jλqiB@_9Cop"U>.0wX{5ibzh hU@cqt~mg]A40ZGzz79K:`A'3N&NEҁ 4(#PC=DFU[78nc%-9T1jL! (y~-xz~|@EߡKQa؊%cCol3ߛX!q~H:L$#DM.8Yg>1e*`+=q~"tfX.D4Ǽ@rQXgeGhE.uL8Q)jOp]ZqEE?j@S1FVӺ  7 q87wR7t @q('z j)Do!_ʓǨiȭ P曂yP/~@O AZ1`$v ZG%m{~z!eRM{rj 8AO8d K|1.2S?.*l|g[5ߗ >COwd3U( ,ܺuۏUU;fx글={_zsL izy{"KgY F@X$H`*s m,40B O+m? Q9Ջ**Qg-3xT[i5^s&.f%544,@3l?5/#t6&UM.V ̩\G~3|GAk(W!|m b9;wWԗ#㔶Q!.vzM<@ 7,Q%,,ԿNc鹥JmFB5ؙ_,j4 ώ3FCsKs՝Lz-/'Mѕ= }uRmܸLp'&>#iʼnWCVfr&fH^ہBGskG:t0cPTY 27r.np}oCﲅT|L }/x'z)V_,M V_eݤmogQ[m+h$gNt$'ƞg}|4RYB~ p!dXe6bZO~{JHv^  jaD$tF le0 D=h 3YC4uW;Z'8|gagӍEte%eh`+_n59iS}x8ya۷qεأ) 5Ϛcb&g_ajݭ6^KU~%Tݱ#nw髨unF"Ǩ'o Fp0Itwgh4LGM$eMKvF;{ ?*]hJghcq^=R7[sT syx*HWJO3"RunavSZlFCXq \l& \^qP_QZ٘xwԹ1R\MOɟ/ HH6s 5J*j_A6$߷B;Sã1bFLWё;Y$|,a js|G|mbr6@ق72 D$Ӻ|ƍ"W.D__~nT[WcY fn?xNw\(xQ%J»" BaWCzY,\^aPv <nj Pm/AM-xrum닟lSo<2P r`0~8=gȋ&<ӀN /tNeNHTYo.]y~nqGJHfJ0юdMmDk}Q&!^:~p, ;&<[!|a#eE^1>IyF Y%nݤQbQ6RyŽUVGQI R#bPs0_` k?p C3A,#C|w B4Q0y.yVï=W Ժ:꺄9PaYX2mT1 oP&s^<}͈8"p벻6&,B hQ`{$ÃvפI{Ö m_'l /Ǡ]VZGwÑ%) v4 q]p0 ,OOpo-e#qr Cĉ`ZPZ\Ŝ,R>~Y| c SgSgOY9>>xc7B$vÃybC[Y ]Z]k$VfϷyxh;U(Nc_(I~>߹R}cbWԞN:]D?&ŝ);zۋmC-y&!a)L 3UU؃)nlMT79}W7[a|I D'3\sD5:6iRN QK4sg-p~k- n.F #֢[o^3CʢȘ\htja*1WqQ7UՂξnOa!Bsc9;c3 ܯ|vYoX*],DmX=0G0ʹT@@ T'D?k& :Q$#ǯ}ZoQU-,ؙΫ湥 ruE>Jd+>Q11apVdk[]4!̝W׌fxjeFLOfw%h>@ƨ c~`sIԵ!SWO:y%)@ׇPZ8xʾstC9G || ThfBp.%[M&K ׺Fy/8]CPiB70lT7&Q-7}*mu 赺?& +0!YMqUSN4&FJ@AXi4|*Q5F4)ۆC#8 !Dk$ iXUS9:rsty -:S,zmhxNIe> _d>8}p_&yni/t s?M,g/>D`> ,쌼”m;'UGSFpqoֆOxDŽU WS,vgYʓ~ƝGo;2ɇUYD"<9 [e3S%9P"kbn}=zfYfz_hp'^@<Ҧ;36貲gu m hzǎACxLCm5 nqWbN"_o94RH4/ #PUϼ P{G(\cmIRPڶqw(XzB4ozV"M~?R/JϴNu$l;[hN_](h7WeG.3|-]tM·.xcb_oύ뮠 ibϝd!d7{'TŇi>yT3 gOi$o4RL3Ѡܼ[~G.'kKN㑳xx4^l< Y.?Lৌ,2)[ۙMys,y@j7ft(W>~iBOY5sָA⹄@Dm@KC8׷hfcĠ0 i`?iBpv]g%g$amYf6i:g Ќrlߧh函.)~+:X.0n0 +ɔ7O if'޼濸S]u9 aa`4ߙogb2],(UGeir,œ86܀ pىU>OZ߫f 3R-X.EOkʻ yhό=Ⱥ|@9rXu[l1 y`9} C 4!>W8sEp b3WK4%N+Uݹ0 NWP΃8RJH&ǛҬ~cII ²<0<,_%ZR|ѣZESK h1iy'˻Ħ8MfKt;VSr &5Ft.M:02|wI1xy=!PlOD'mͣg?Nt޾qwNP5Bsĝ_Iі|\~1_c KC;x3jRaC2o"+EgqrΜK'ރ(3Mk4~āqgBZu=";4JԮVn%VU<z\LUA.c3}CXa}>ZH6.ur6h2EUD<ދ8gw#>/R:v\/ I \!'-%'YqWb"u[pX3SxWXl7.ԩ $%=5|O&A+{paҠ@tc+ni`6fNa}V飫oS{&J@B61 !zx Z\ ۪p9&(" H1E9@h->R]5Oե_T׮y^|f3Q8j4! DIpwݠcClLz3@#u7ٺ?{@)̞i%6S f,V7M(BliZu;IkJG`4Ƈ9EjeHib&]P^lEy!rӖp-[@/˳% 8Ϋ|Sgeʼ =XEo[z^&ѽ#s&Rf^ ð1`nK=~)ItRx =㦱+-zWg|a (3|Q#GC˾2j$|h./Kpw::Π N^j$M(R>Q^0lBS _CzGȠ6ܓ+ޙM—fzW(3Wk- "0 1^ӛ$32hK{@7f^Dz"uҼF iPAZ"?9GRl`Hl 8%c,O\HGc=䇞[F αאƌq `yx\5k#/A~[S.˥ Yst-@4 .w0%Gw(s"Q0li tnGmiۈ o}SlOF ҤCY5h|86X;XD /:HvX3XFN) ~ηޘ j&ޞ 8 D:^)LcA-yj4ɣSt( U_SupMlɮ|#d 9 H8NQm񲰦h#swuH$$pqfqݯڭb馴#G 1񰡧I1.' ݖ7̆wlA (生{.S2&VN]j@LȽ3w]'њ9:d1m}6@YG@yw!oNTЈ9"q>ԍdfbGU̫(7p=s틛ӊCǵG9o_qEsa[!,*50f+j]`LS.;.O?qQta}ߦK1]=wm!|(κp5g EI~g,GY zty{Lp ̎os0S|&h{>)+`G;vr @<{z){=TjX/z18ICAj,<=)F) x.JB@qn0G[c057eG|Pi_ñ~oag곛"T9r-Oݝ iR-b_MdĚ=N/ͱaNGaSo{Q[I+喇; X#@dw}"k=L5Cin<5Pk,M \LH`ү;f6`MJIFrY+^ӟVxV;B"T<f1(IAtf!- U*$~%F9t'GѯDs 3:$X. ?#%IϲJT4ӱQScn[sobɏX۸y:|f}`}ơc2x].áHCkU&ү~,A3 <F~9&.!QTrEEՆQ<9>!i]"ǺBo*ET^s\$(c MknH8h|YEّ{Z Q @6Q-&~* vO#Nz1vuQZY/Osp.>M ɼ[z h0@r fK=x5uW+v*my=NbaMa  z["FGK﷕wr+T(^4R]^R]QcKUjS;*(W-k3xteI ɡԾ[ ˘ad*,n`hâOF*GW<c(!ѭA՞CVC<=K,`4hnArn,/IQvHОqnZ_te)dZU ͓Sa?4`Ag )JoXLjq?t S˞Z]﹄y OZ3x䶵:Fz92q!cmˑrY,P\Fah.I^)IvpA7 'vD>'m;iRӾ"OTlK4ɚfrN/gD14H{r }]b;KoME.Q*Z.K]WCtڶRW7DJ}@ "&"FaJ&M&Infp S%w#a%HGF|uM=#x/ ֲ}w2>fkqYe{tKey"95mߺA6x5P?`PύĽ%enKdf Б8M!`c 2uWh@+ kD҆ ` bGI 4D1{z8Z!J{sʔA_jIl1WvUnQ1ͬTƥ@}Wrvl/r4] IHHmkdߋ|RPR3d+AZ2BHҿ$L/s_"&7<#]iR2'1NR2fLvHJ1ODWR˖ϡYڀLĨ1PJ-eFvRvgTTY<[=Z QLh{eo@QY DV_:MdH0dP?Z^Q{TI0 9잏(•[KS4Ըc67遲HvY Y/+ y|4%H$&w:e=ȜPiP,~ћ+S c5~u0{-@ Kb1_ J.>1T' '*>=(%,&tHsZ /'3!G5c'(#RB!nG7]Ѫu>}Ma~Gyp"w?(2Ouϟ8bõU6#{Z"@;:ӦT@'SŽg-aܘd!=}g]@tAf.!S3E46a| S5J*5cEh.[Ip&I>7- )50r:RcR-I}`ĂJ'@%1F9hs)8C 8XD0 (!kJPBCޱF|=O>g{o]^ ҫ:-Cj G#^t ;ˀA VL+Y7NHz\+K&UgY,W _M94K)Ko}aJL2>Os6BeV:>yLƺfroA!ytZfh wr&I\nx>l$iIe}F@˴9koa$Q|`dxdN`=q)"hNݳdlceJPJB@dk6GSUc2ܕ(h:CW ԭ9ؤ`y@9~NӮOGK"5ER )l:} 2esHr&Q^@H'N)Vvw҃B Gd-3)*يO2D1o»$Hx"`=,m-nK| @ WVV8U1{Gj1. ¸üPeŹ y>1uc웑qH\&]Ep2 J@ h=eylxC1LYur>g)H<nwX'wÛ>xƋ?ZEXL5TgfxIMLIHu:bN}QH#w?MfIOZjZ]1?g޶PSŗJde]R; -ni 8KiMEllɟ0UV9ʎC([q0x_K^)'X*m-.Gw>_"Y'|*/Ѫv,NshxonNgж WL.k9Gs "W_Zsv7u,YVX{|{_Rݿ{ Q'_E}S5>>#x.a}0 ?SRmQFa5RB`mqR:5z^-W=0 <ԩe$& п%ڿvq:@Ǡ7 fWZ7iO>[L:swZ*x=ь]g> DSKoVwHKRM2+%iÄ~Z ɞn[ɾ*"%qS/AsUW{M$SvgJ,8aCeEYf\Wlm~-d^`|y1ycJj̡g8֢SQmZ)~YKnsP)nuѫs|p޹ngx2xwZvx-p18=قso0m=\ษ!4YrLj]"&]K7 fGt@><4Am ]Ρz Si6ٺUջDsɞ]=|/c 5=^9 Q3ts`3ȧB!mN,"VQpPihAgEd:]s][X(wKg+Ho='XwxnGviη];%zgVK|EN Lk&ʥ0$@[#y*"e }wWyYA/ _3mog:\I?-1]"SK9F]ܴ~C)/8K)nXz,z~PD4k;)lT.w! 2,+K@9; P"YGUldX2$)q&P[?nQaxKr(U^cC*x)޷QDZxA"̍HI xzZWg'TV&6 *Yee 8pqEFk$vCe&_]_r-tK~?'":P]6]q)LH2Yă.`.-BΦ5 *Wqozl'?)Yxĩ 1*xImҴ^wآu@S6C% :77?RBo;(@XRZ@%@F N,|^x-P~ϰ |sPeuy38)Rǟ&@Q#h@~„EWQ4[uLvZ`'V z㖠Xr5'kΔRjtJwҕc1TH;ڥ /jhSi#n\hHz'8'yȉ}krtyi aȀM v 0ւ_}qKjǔ;yoIuuHPoD"+:3oqOB?nzR/HӖ`[p$E1k@Si_Nӱ0 Hovh[cst7җS{7_YD[B[N}m{>8jԈU&u7*ծU7+P%]sl:G˺◦Gd-\{W4d>oΡqx>2TcSl$+6M.L"17<  t݋ \n}#VMe8zsvES43`Zmf$r*E3e"=#lb/|'l%g{4-C$%TC7 OEpd`_,I+у%_jeF#I3(Qґ!>XH2Oـ7!W̱( Ѓ6Hױ|S'ٚ=EvëyroE<gVnk}CAW4 ٪-8wiYSV ] "|ŁGydOkeX=(f]3&/?IW!)6V%لU}-[tUp7k2tT}|w [*K&Aej+w!_Pˣ=f+gmuHYd9'PK_t"fd)qulP:!}:t@u%ԝWZ3&Vmc5HkJTڴ-Vw&0T7M'KP[fpOTzET!^M5Yi;| ~#"z*& a?8$C|N\ݺU2+d Xےف8p1OsAxXы&tX)sW:{$8T Ni]6E֙|Pw*6}b%Q)I(g1ʃrșG_%{aEh7#ꀵ[X G\=Z a\lP%{jDrqpjw@ wn]h4$ҭlVּi\ Q)IOnYv?+!.˅DQ;t W$c[p=kV֫Į4ErO*mp)w!w$}[x;4{J SpdV!j88 e9Kg)tճK-ґ\0S HX'7!g/Px{Zuah%ajr$atOq'R"fLֶ]b:O8 ^L/Nɷq;ۧG޲m `2FO}йC!YU4?y =yǡemAˊۥ8cy]Wվ^ɰjlIc9 P-p<2#zJ-wܬ*}נux3"6졊杀-$U_d[PؓNz]ȃx ޹jiwAQOƄ xڏ4@jY ?NYkm >U$t+^EڸRP CZCį#'-5 &wB;p5ѹ7Ey5,ZLM2f,t{Њm6D:|W njEZg`9%Ʃ}ISxKZ37KV (i.Cyء֊LH,u/oFԎ'DFרg (q5 |G *pn{!+磥܈Ayrg]dںtV);TFe6EKy6VR5CyPR+jZrWLSA+$хdʽԘŹ/^™3z+ŏ5sނAnS"l -m|3&vpӧ8@9"yպ6ۈ~Ѳxɢy({('̵!\j1 Ng+ιd2f/,wVY30U\Oɻj>m-EMTqXǎ`oEH)e:6X!u+ۈKGڟo2wWH ^L^q0MﯺڤҧY'mZ)v:{yDKGLƓS[8V>rl*X+NH5%0`>JL(mg!5[f!?֥l}6kC<C| ~/vOBy7 I&fXhA Fܱ$ ##`Rf328_?nV$GeU"U(*FWZO../%]CԲn^ kJM"ƙ11'pG`Lp gAk9q殖AP!LDK|CUqvFcA%Y/ͼSJ1Nn0i9&$)E,z $(!ӾBB@rz'645#^ecfNIg+:a?@c{:}0]s5z' t֣%ayv<(EݎC+\2%N mPMS"A^@+ 0B7>ڑXDV>&:0} _A z@EHhY~Ѱgn]:f69;yhn UGs}S^0c=|mIq~Pf ʦ۬/!I Z5Zs:W4:ź0K]1xM @ q3=.}w0yU-gN;j/&V\-~5kC,  3wԮJ7pbO}صay"걌\sG;8*#Z;NvrmK/²wxP1%R'#p>FpW94PV9n^-Me_xsaݨD `T0-8Vבs{đdىK 3CDj@B%\p[rjiZ;VO3dN 7s^JP=_fJe ;iOo摱%vdE"M-q~Sr-厐&ܬ/ C6:nQ;uwJWwjũΞyG S}/H? L׊k(GlA.ڻqn? üd0OƋj6*Zi=}TouψPMJ%vmFQ`HM:\~Z^'$,ӀYy)ol&p#m8D 0%8٫:Mk rAX(Kfr`퓗vuHn}@ AX_=C}+oΣaWҧ>MXe^NK- wi Hi1~,2i \QC},b>{C)è1"M8?n%pKҵIg`mL-TX#j;)Kq@OXaPbjMhu\E(6GHJ*w5R1ant_Ժs2Mఉ,khf7W0 sDIOp'T߄T~_8rN줹QÁmP<]壓-'P[^kd/': ˶5J|kHmNÄ-5_5D5DMim႒Qr#8E==Be5oD&sZ6u?myhݖDa+2 j+}t\2nMb66nE/7u$*5Z6GU,俒cAyW5LlY>bNjHQJ@78;xy%L5Wu20  zzStv0 v zVJ;1\8jg a3.o T eځn9 .L zI荓9Vlo\E"?ñ"6Y{ġȼz{G3V_Fu DxF]: tԢs(܄O9+(BTU^Wi6$ X^L 9 Rq4gRlW9DβL;`FTC*6lE[iW OA%\ֻ6?~;Q;{fj C's<ǺQ/0^toJ*^ޮo$%+䉧IOgz^"Q+p![KXNA-iGdp(t)营l)qL!Ey{,#>_v8f\?ҺO\5,]sSտbJS  :SkdQ=us׍ k;v"Dz_R5PMne5s'i6 [fHGZBؚO]6VHV@R4ƏT+`dL@1x"&EV#6,_+9@^+1mfj^Km=CL5##y !Nv (Lմd[7h7CTR.i[sv`<o7·ئݬge7L#g}ۜ

e-")WH!.:|v90vnP]|~ JwjCF#$feü8s(e ,؋ 25D-eه] |{%[e+I2m|pa(`UVn5ڹ7\I0VAyپ'[|4ۯY@^iBz+&Y~m\t)-dkNmwX+qaEpAb9/\td&Mo0y̛];#'án~c#+b?ʧ }6%*AQ!pNR s)vD>4eZzCVmXik/;?r3Z*+$L^A+A4>K6d"gh1?.Mq^HmE<A8wKKx" $JTlĩn N?YhUbWjZ˟/wZህQPHPٔw#;NF>ݩ'J#P\pbZ6oH(1ɷH^nOIeAew>G݌kȇtGv[?i຦SPpEăHzf1?*ejVvƗЧlYZ"cAvs}%i֕#><F=ɟhH).O(lG["e:~s 1%/жre`-  =,.R #ǔ~0^pYI_-s \D@* ZVWĄ#9~(l"Sq&><=)| u-LCJUԺ]d15BoGw"K{ x3a' >{ϒMu ^H#쥐rغUaԌ[? 4N7""h`us/:~EK-97 :!Xs?Ƃ1n! H@MO'ƹ0e5 (w_7$(ڼm=x]2>^eNSdVt 葰vhU/M e6f0ף QNux!7\qқ'A9#B dU^]/0]C2b?udńQmEguV&PHϵnqu^۬8CpP_# 5B"U܆̿x^u+},ي8喩*hL"m)J:@x#q(*x)h1-ܟNT,' [y&ˀV<5Ck6_Y9렝_k$h&.j MGMy:d[SK R)ns=Wcc B߱/t$_i=#Vˌ}5bԠia!] #rr{܋WY`h\*K_3!s[erR9{'=ZnZ6uSg[YT_(I 3T=WSK;S At5=MzZX}1, vt;UeeinG8M~ml<+P_|zzXeY~~K3*ݿCoѿbdhҤ7t*}^vy_n#^eQ ` uti4)@L86puIan5xd::QD{u[URE0ss{` OMl('qbϏ4>i81*T<=24'jRjV8|)bN\:2S޿ z}n(;{fDv*x(5 }3ruQ :Hjҙ͵& q26}igTDadTQ (8G$w51샖Ni{X4m&%9;90I5Js. +z X=4*Ӯׇi\S8o 纨W/5ȃ~?\mMT9);*aL,傳 Mat=Sf6[CYh3%%x^8 j5Ш3>CAp m5uc3%^,+UPMum|F8|~7| (o ]8%%=MSr<ҡckmskpľ9 b_VR↱+>A;@ug XJvnI}LV^he%=o=V`]PR;f&q<58:;􃲝 +T/I6kkvxj~g:]5﷞D̵ϖ~_LT7M{4ww7jerPȤyٞ`a,9TrLU.WpkhD ׸B%VKΙ\1whr$Aj0 LvY-yHA#L' a{2Z'|II;E>mXez(UVn$x.3uʞj9y g6Sm5E{f qN)$iVyqYD]rwb/lk2${NY^cOgu7/?k2Vo^1>0:/=X Iz"٪nOK~ZNv߯Xc 7(7%ðAag4OWks7(*Xw}-\yM3V3]MEpy PVv~}rO;Ml|F7.Q7c.nK n-$U;_ [&2xJ])q@θVd&{**nm) N|X5MPpPU [Οx;k:IyU-C|"]r"?,\>)F?+txD#ӂj[9ge }'U2 Ǝ0HpSQ H)E6Q'[RzĽ*KWmbv7 ۨE:Ԡ(.(ꔪzG -Y3 BXz2/? Di8Lԣ4ޮ!` XAdSOܻR~6nDICZD4pJB(w!e6j"|p1jqDq9lkNc):+E =761dqvvS6HTeBeotG'| K㮷¤**Lb2>!B9I}|e=ID Fb>z yk03&cmͮs 6oăϔP*ZhPy&#n&W}5HWq  H81f @4x;>mşTV~Wvʈi Yo&^猣[vqܦ}x F*@k܂ś`3pSx[ۅ\ r1uu4ǃŪg-1yWS#g֦I.g# 5Ieǔ ;3j;!5hfnmo좄mF=&`>\98Obp kA oI+UGJF[\D qM*QkT ?0KgɌ^tp7Q^ W8IEIt庞bl0@NcPQpo,?HOۜi4OqO\[v{KEºXb ktq∜,x9$rδ:o~1S I^9%32(@[ f,&8<3byW:ۥE)ֱJ9c?r*A |*_ [`4*@1k*eŅMǙȘJIdB‚p>qL|x?jw&nzm6pp hx!}EG,o=R(=.eȔ4vscP` IV8LҰ*q {{NWB凸88eOg\XʿyFb1\դ-4C^#҃_3ֶF5:I}уCO8VO κAkahfdr-Wl! <2|Ж6^$o%aەAQ1*.9@ Vv&b8f>e#lȊl3 4LTP]ΫV`l$ČKZgrP@;5Te?{BFxݳsȍs?$є '+a1rʬ\VrlBdžPfdn̯ ==eo9 *1!n~ʮC0/-?{ڠ$"K/ՁHOGP貣\ڑ0bCzk(O/L5]U:˲_tφG: ŧN\8b,3.,8 %Gu?%~}h$b2tZ!l`($(#oB*= HMcZ8i Xm_i~  `*\G'vf߶NT<+sXm.)H,7 ,%@;t!I t`ª¤U1Kid&\2AB99عe1Gt.踏_n[WRv5QZx+W. y[e^|( ju>U>+p}cY 6oB?'8%^HPFnh"`Gocݔb|䫫6O|J(0@a|…{8+Ɲc_ISq\C1Gɠe" %mOxڡ ̍n zo,\W.Ă_R)9i53x價*=]go6_u"xL0PP*ux(hdb$%xWx[S0?<vɢl10t`{.a^13V bXc<[ErK-ԾFu>xkbX5)_9N[X$v1 $ǾOW|<\*սȽOO/ؐDJ\).2%c9Tjbёf ڤIX0Lz'i?I" I}@qv;cC9qnp0*߄vԩXc!6(eM9wzwr&^n*ZAw\Utң”^/4 )#6ըo*S';{n.[%)_8}O'kϭ'IGKwlp>d/5 +..8B,dapDˈsH5/V68g53Fi?zHnk"aL'{;9箥+#Lw>"Cf"m\@T fk!PL G$|co6~:,5FW6>+iT9! &4 2<+`_FٷB ,*##c+xE` AE#xpQU :S=vT)AE:R2"8v>{>8txTMK~v()b uWuO b} vBrs험F^uj;I7"P`UM}:\ɻfDcv~~&AFKx^EgYy>-*3SԚ?G+Q(/06{O ,ꍮ t ZL'1wYѦ"`-AQwԟsnb{z=6W<Bd}V7k$GMHR{ ɝ%$s׀@Q%X>]h9ot~C@w]06W^=+a֌&Q0 DK!u>M >bbf~Ι3ԑ jʛN&,~N9g 7wNj_{A><_e`;ږp7"? &8:t5|RjtAN$m_x a"q86LK :]PЄ6ji,q ${p+UV累8:G7sG)=pNtHU\/ǟ HuFTIc"HGؚ3Kh + Ev=tH F7( @rvSR9But_`GSTQ}3 \d^4&5 sSRz\O"8 0ڿc (%337VVNS6 Bz7ܣI!3R[Gn$Dkb (Tfelو\ x!S'_/%Xm֦Mh? ‚ 9}l#ï1AxHn[aSU_6qd۽㦼e}qbBeZXA\(* PxgFRņ%@!svUdך.mJ|qBJ@@$ae*,Z 0g)up[+$rΙ_(aJI8ӳ XGh_7Y`֏o-D"rViMޢCwt?-&D^l±e M^"sYkkŖl Yg[wEfD0Xd(_e@^k$oXhyv#sNI#>XL"[ۇ^G:D,Cw. YeD]Tierav*X?{10hw] L}  ,EOۙ 33:hϲ=U1>O׊{P{zw4̡O ?"x?aeb9*Bw Ym)Z !;?hgKХ%9:-ϹvQvOכFR{7<˂=[s= ͹KteRZ[ϧP4Ro$U"9 ~q4ԧdCև2UbF݀,C ʌdcF΋ךn6C{Ԧ;3 %L1߃=,Yfȴ7'He "4Y(ZP;o^K*i#R3+T.W#5g ȻdNN&8i0GY/(}\ يnX.qsfyFq{E$ DkqȎD5\ %&6y.+|ݩQb6 |2=Д9< D ?E`j{W չ&0DQ^Ľ- $[;?F~zɑ~F`7mGEqIh KC>"YЗVQW,&,;Wl‡^~=W>_Yi'76;34`! |{;'N#lY)>`5M_MڄtUfmTQ-RL7;ykf8ĂxDg|Bn0D;\:q!3X,5x@΋K+xRu. ;<3,RJC6#jea$*<,wwR=%p~:ClW?@gn<|N-䬄~0ɤ,n*h>ALi crQ.NC>6L/aAy9HA42 F j2yhV]Mɪu\Po7L4<_72YD.3gӴ#Q_u=ÿQQ/_P`44]܋cuvioY !G5h f98ڣZZ/',o'Bǵ5v2ѼOX?iuT }ϹX"+lh<(/d"ib  CᣟͳSb~jU1[ݘ ^=I~;)]}.{#4(,qUODCH6,ON)FF[˶L5fl`X %\iѹ{Fp=Ů%}dPf鶫q#| åmm"UZ3ZP]lggʑuH uw|67# ExZ&f&Ҥ5aoN|p.jӄMSG-o7]-RlUE֡H D̽[&\iD$ł۔1@mbsD`'zFVі`N{Gh~7#jn;rMn.Ax+舾hξ(A*FNz%P'>TaC#yUqЅ!h%jsaS#V-B 0p䠵f&q?6sudYr6]*1JMP eH";õϫxou±IJWJgj siO 1([߱RjG//6ˮVq6kк+"lۦl[5:1*ٷʢ6*8}v֖:An6 PMdCG$ F qU}3M<-gk55i l`Ic?{lp3PqpBq0:`0 ij55SR+Fd,~Ls՞ès$)|-}hTуR :?hy ?` `#Gs AO R.";HEa*wx^VȺgΫoM?gT)̳Ϥ~F1=ժLa ¶=,4Si zOR;WqljscZ2m/'R{< ,5]:+l%X`Ŧ6gn n`<` o32RE.d|qӭ54Y&9AR)T"c1R:SO{#v 엙Rgas8VVȠwYJTH듊x+:/tvꟂ8@:B kʭ8m*Gb.Nh'Jㄆw*5*Ixۆ WI\uwWKX9/>{azăBㅜᗩK(k|~P$.?DEг'PaҶ㘰 uVߓ/$`C0oo ? Af/PH?j9p_"]|hubbٶ,wڮ0EMXn hBṆ4P<'-XZX0W;; .2,9Y vtcZ}! xR CY&4I=4 * )MH3&"v*OSoCGPrX+H: Qp(N %lL.v6{AQ*",r? hyISWCX9ÛlR`þi2,70ӮZv y1pX)7wԜlH㝘7R Bc4dyE~COn$dP BYYZ}d e/-Rڸp?WŠ0UA""i*4OnwCڕ&u>!`Rȵ~ XE?; $ʰ9!z!-hYeջ6cWW QEPt;kO ;_)3jf䶌 /K j|g}У0I|I]Nkb*..(kU гl/f{J l!>):]6ZE8vJW,e IH>MiYngF}pTn@ӁVEukj6XUHQkr\.e^㙘16E9qj5g}H]a1(G=L:@!nTj!ދRir+WԮ,fMZ.t6I2hIL`*7=_ȠO U^`j3o\JX179!dq`d'M`O WrU ˓;E)ܾS<ƷHjTa([1G@g|,h}tGDlR~,Qsd`rb`&~Ej #{ȗSo@x̜C>b="]im4Lh)Rsk? ż)pȿɊ!&iE8w4нGOW'uU0m{ˢ׌6h;NB[_$=ǒ+u>L^@WbCN8:oU ܘޅQ"`W!60T{km1)QEAt* P2vgMX1.ugHa,H%3R Â)?+87(XK9pG4~!zuhڲ]l-.ⳉ1SODZEXj.g.CIn*b U>UWRoІ3}>[Jɫ9(;;\5:l6tCS2w: m(RɗTWdĸ ! mz s5{?UiyiĒtp;UE!WQ.S9~^ݮEJis1NU9x`G7j| 2P?qȳ{~T LN&|KFb^;( j5&bO=ku1"׀cWO;$f7`AE/HS' s=W0b p塓vq}k#h`8;s8б(HkW])㶐9TUuuς>ܒ^8z L;I%.hz#'O5pƧ?KtPLхm3wВe?9daVs*!][?aࣷ8hCtz'pwPhlZ-!'l֭+3("j:PjF IWǤJVRe"!;ěr|8r']|]M"!)( ? uV1(0m'kת᫛iu+0+k>qxO`W)*H޿&uV+G;FE31k?c,"e Hpo<e, "-(<dw߀uN{Otj.s6vTUMI{ڦ_7dRKgz{(=,/L',g3 ͺ=55i!hOɬlQ51!7zsj:(K:F@H:^uKWX}gڞjL1H<]Dz* ^sE%E(U֡%G.!DKu~??s@ lBVgϛ6~X%{ ɇZ ?>b8y<͵ p @-X9Uf,BQa>d򻷏ewq%uy\tYW^A: ЍBloL[᫾.F$آUzX^* NY H`2r|3@=Nx+!ܝY5R?Í\?SJN5+rrw;i{`j,tutQ;B2z~=&fg/o?[2BC 4Xc gہB55rx]K@=DcJPC߹*ea_7XGٰh%F0#gZ~9jbHWmY@l|&@jq}E n|T SXKxH.G`,8*Êi2K$\\C"=yqQP[B\:ǙeeQ[vJrǚZ$t܁U{@Vߴ}sɣk3R~6$fh1gŁzKs'uẃgCLxp77y\5m.Vn%N خ9*;ScGп/г@7(@nlhv>U|1wE̽UoLr T~ġ ]v? 8;D {Z}U4#R^01zι z}G(&-'hوlER֛ͭȽy@jx c?^x74c 7a(%J?b!6q4SOlFe<{FYnreFpӼM{~Kb\ހ㖸3[FA`^L'H RplXBwŒJbd2v6G0BSaplT#"L.rfx&* Kct+z5,.o;75d&KBb>*[^8Bx+lRpIP+)}%8&ˑ/ܫa! d Lgi÷>)iϱ3tA3 B܏$>vK8هaRho4٦[_V}@"6[H-2w~6 y؏E$'r'ii]{]jMo`C4`f*hE]_Ǯ4ztcp@4pS]X6 k/Qй~sC"3qex ypOrhHL 8I\vX_*cvH0Wt=UY{Em`Թ(ki!Jٷۊ#>U)/;D 0bgoGQ'-M+|pn4~rtG:Cfu3dd`v?Q/CAM~bZBnOn2h6!;gPa۟nj]SFrb s޵tԟTQtNB5fZmi<WN a'0[FԤ&/[7q$H1s^&zbEJŘ8[0cfYxtd,a #+X#,*G\a`7NBT$Ӫ%Z/]vBkUY~oq8񞔋};jZ!j? [)Q>nTtqT*旀 t+8|c!U3Ȝt| x$P}ٍ\l)IvlmCL1!HLJs8f84.1`¡S!M[Չa:ՒR6pр"d4W=n5)oV>|#p` ž+Ui0"H _ 'NM: K_5R|7D:CBxM<5qx%@qO-vU"7VSsÚ,ZHp[ X_. ']W-?o,B*(baUpUL$5(er [s|zoYojeJxBc{*elZS]ܱkZRogq0-AL( {b^K7[te¿ ۙ4NgM K^W5X #&߂=NQNSLe&Xe\}1a'{G U#uǝ&u⼿"C?ƪ{AK(xw-)YRV~Y2 4a: xlqiKv4R]g4&tJN1ep'cR6I/?f{ ͭl(gB6|?D vSzj!6%Wd5SU%ޢ%nڤ FŇPa<;:Ϋ9(;A8{$~NpUcƽe}Σ]NX'J#AmY戻'1UנFh%j}d6&GG_lfs51MgupO3rw^ccXJQ(B'`aN:hw*p"Zg`[(t3pLvN$IA}F/s]^6›{mD:UXsW.,}fAc2WɽJo::I!G՚^s86_li\םH;sW5A)qL 2\L{ v;|nolqXwY1R;%tDY]Hz ~Nhh}< FrxR\gDWOaTm-1Nty1Ʊ;]7HXgGj$z(1<f'=]~?@ɮ?yBaqПѳ7[z8qHpwfc-$tU`V摺3FZ=f/84Kk"[!JL4# N >+>h? +Yt%S_-$e448%5rxx7g&RY,öki AS2y9}I-IfFO=r 51(͒Uy/Mn, …/ɼ_ PP×TG29=|!9Cq(qxI-:P"3QiGKS=tSޒEpK!4xg`eh7O_[7BzR./֢>fb ,1HZV~H2(ǟ H)zI7Om; pt%pesj>1_;SGg\#DX6j^0$`ī"[fkIOr0.ZA!|LI0kq[a58EX_E)Av`{ܒgH|zc{*]jM2GDs84LoKCFV8TOEB{lUE&\PLiL- >:wx#0 9iڷ olm>p뱰\rEľyr$wC&Sj]_EUD4u7"̼]{BTlQ1-lf#C7{;j(X(IG8(l7()n4rr4(e+*TD? gSះZk=ftx(پIhkJˢe@j'rJz&ݹDr,roqy4fH RA 6_OI!g+-P./7.ݶH' o i ߻ ǃL5CN_=7NCpXH߳:T8˛ Lfu0 D'2C&FeI֬6Hɀ|n!50"nȨ"uni ,XANhټa;7􋵉d)C2Xn&ӳS0Fy/Qi)l 'A^M:ZϤ!;q h`po&I4]L,lrS>oMrLi*߽m[wm+{R스[հVke!f)徆3"=ѹMt /G@paw;x-T_Zͅ}tU +CO7 QM ky`F@- `بw5Ր =0^n f䩡fMLgy8`>lfԃUBf%Xĝ0=P QZ|ևoR>/?y`=vD*vDb>߿l %,Գ|Bk߷,NdA%6\ͳ cO׵̎p[Okx5Tu`+zϻpc .Rpͣa:W)ͨ5;.L0\ {$WQ\{ܶha>82A lWM,(t-ZAhyA)%9oVVeE`"[(I WU5P]fHO+2GTeǣS(D9, loeesQ`BW ?JGl"B={A9!e LmrYG4wȨ֩0f5j`v`䅹T(h7I~oFQճ(=4^1}OYYGӀ7!7HTow~a.T,o-xTfz<;iOg"$hF2׳2J5k,0,i\1~!O+{ Xmtw`[ol2 /f(%ؑ7Km1irɄj$aƯKRr\_p# A ;njL58ߟ/eY$ Z 7!fll)99C:"JL;+,:&lĝiGòLt5"fD-a˿xN)b(,a]yv#!H@ܦvB<,ȋj:u!5%D^8"Q^%Oy!`+;p~8N$̪$`|.?);sjk)\ +YXDl&מ# g/ t0 _Tb?`@L֜93$ .(^vf;vk'9z;fɝ P̼gEyΙ+ShXU2Tg9F/zxߑE/wSnz6N–>?hK;67 1]9)ʵ^w.VN잜뉊YU Z't5Hh%dghThap_ӌT.J}=W btД7:@!N&* ɷ^l>Yio"E"?%g;2h|A szߢ'FF7+Xr= YaܰRx=ȼ9V +hW;k󣖓EO[.8k:(l,ˮP^x?C#P5X|+xځlрS@IJU3@YpHj&H=:C] ǡ3 6^i} 'ͨl꟟xo 7:WqVL%m խGNRXyz0#cӘ )(;BW m!x:'6kIm!s3^BJ)@Ս/}N଍pv kӕAwUk[wkE+zdhϳD7 GcĊ=<-^umIGh&ÉMſg,hnY{: w?E ROnW8W3oh?xZGexs\UfpAh @H(=[AluVPu2vL" <̙+f@7@]nCc+D}RBKz,] &5^&u/ǢסXT|ʈ!m)CS>7 ÿizD|ۨ:b"5c恲/թN8y2*9L+,]3o++8&TèЛa1@jԏY7d/@D_ J7UW"ttlk*׫ P1_Xh=A^qD_! 6~HJg FFW V+Ge(?+%g.!_h;@smEMF^ xԛBz9>iG& 17dRPgEu=WaG);O*VXVN~[~Mjt eЌ27);# @_#=: 6zBŔKx%@4v^Jm>h.P\9VDf}[\_MQ$B`89sÂhMm@ g `$/ y➽桧&ZZlZ FGa{ QV\ήdOtϧw"]V)M|p!H;i`:@* KXkN4n%uD*E3uz=(v=ZO!]x?X O^4.N!^"C!Pl#7c WR<CшjiP pW3wsfBDx;|f++)&aa]̉+Pl3(p܋܂`u1 fJr^3%_~d;>{ Pw7Eg95V^4]`z;}W5o)l; OYi3BsesFF*tFЕ@U!\n^zE>/*3,A$^f&v"Xbv#t7wZ7Ba}ǽ#>HHB8w7ƉMCjHЮRz42EOU;7 _4Bg5tC9Gnf0 E(CN 0 %LK4$&ΫpD$~RDźj G9YϛYOT;DՏ}۬yp=)e1ǟ܆@~0Y'D`,^pU0M.vkMp30ez1J)sjBvlTn.TUݑgYEቌ_aGprVfX|޹$%? dQ#EERNɫi~4t-3IDPbk׿FIa8y& Y8IoM68>bgQ| ךCU"iFB{R%0؈;\V{d妽H G E_RTC"|9K;>D%<UJ9.a EZԿTQo)F\'jj52C̚8U<<:6QL+=:3b Z+?X1]06$~i!Ԉa&)\=s $߿LQ)e!Zk!I GB.ćtv7`,KX-2+rRbts]+J >!+2,lF4XvV9!?,"o΋!g!aNn.t3AexTP䕽1M]H k &%!|`z:s/_0Gy5L@&OqNu>Dw0 J=[yKl&'o! FɫOK2h=ʊ/^5DrfR>\ghtUצ% %?Ӭ;4;:}R$lxsժb&=ad$T< )f>N:ڸ:jQ WY/ p4x+WXjA_Ϥ}0yxmw*@>t#ZVXfN\ aعPzHq(;h%ih D?>䳢[K0EVM^N\ֲJ#2E&oE YQ$)F=4!0G(1R-[<bD 3O% )$%z}w8@#rBh[xy_}K Kd|퀶?9B2N0-,7"xĶN QxgZS+j"tv*쪻dq152?ํuSm3]\|76-z%2*oOg M~Ƿ+tD )Z-?GF/p7Ll9-b#Lb' Bvomn1}fnkr1VW|F$?Vʁ:st 1Y+L+i.e'E7D>ɟrZZ4*v$}CbVh lmH9+`M P1͈ǯ!dw 6 "/y),L>} |V8mo2hy3^$L 1Tr!!!i^t Y'IL\% - D[ru*TMJ:ԍ஻eℙOQGw/>`$Q ? Kv!.jï‹ m 0gk*iYF%qz#; A]Y8n?*2*!8R/z3l+F喥풵?kfiua5 /ùz9P .$IA;8'衫|  t} cO: HFe w1'ؤnV'(Į?x/Üo?$Ia9aƛS#ψX sq gq"bCO|/k# @"_wH$ipfo@U(C+,qFm\j~?!HCq#N46~){M1w*㗡j^Q: yw'~0#C;^<'"(@b``JLނX,Τk!N_ՓV]6Տw2"P *`lDsB \V.:Vc;sP >8⢹uPk꥜)MOmj x/8dM9f'YJ)5- 5iE ;2 #<e\؇kRLǁoX$.a"dzGMhvǗ D[Íw'Q #-SaD(YO4hxI ߰-7}͏,ֿ^̉En{HfF7,'?UY0ie0#w)\M?x#  uݎ k I٢ǫ/qfP )+}>T zp[ >UXPXuɋ2 *~ P32ZLTҥgig>M \Bn{_ $JA@]Cny{hkђ~ m*PgI͘9^aY6yހIƵߢQ<g.K<5T}'9~RzufrAc>s3sz1$SLfGEQ[5{ - `0g1L٢_>CpgYX]UX]0P7q:a|+H5非,C]܌@㓓[TG9pj -4W# |p s'\EXRlLv\wt=ｩSOU̸dȀ*\"W4񹠬S)*ݮݸz3A3 pNVROJrsi!&c=:EPGxܐMXxxd3mVK g2Tu]S^k. z˲dxDoKgQ2If[!NB;tI])-; /H^O]@IXF3olMvbY'xx=LVeQqA=Ȏ 럭{^.@OjYic|5XGmKK)ԟJ$n|/ 59&;\_瑳rV+ $P iIm˱{ȽcbOx˩U+  iq_$zozmĉagV|(EJ"{a+㦼F3 ̚=栆wo&c {.9L"a:B&FN t"ZzH[M-7g\; 8ص㷙8Vs{p D^٬ux'^KƯM9Ϝi·ZlV cD1uX f| 잠NfSvDɱr !FcbΥ}v579iZ&CL2xGl^C4ɷ치NLVj-Sm:e/ "ayDz+,Lf{K?6I)8G`5 @,J[NDA!YdR5m3(vqC2a^bާ=})\⣞m 2aV@ CX3R]U:4!#k@;S"r#hF*ntUyسQ^ʯCnݤ|j<-ٌQj Sb\MhEao16?jPnS,Yr;W!&Mo@ c0LӋ`!jF߰~IdGKLH5c'HTzwBuYAi!* /"G>ZUFnݔBvlD9i_p] Ӿo|MS{3]{b7,U\~A ď@#s4u*=['iCE fQ볪 p Bu+A$dIe${m|z 1:3BN7\6tIZQ N gW' ^*skR8!t$8R)!1AMu"nWy -Л)Ű9bYT/U /Wx^fkP 5ꦄNGdi%ѥp{y_So8JTud?:b}H6vN<%Q3B .qSQ&g5G6gGƳ{Nҗr` L*DHAWƨU2LmS7D;ɻHD68'3>etXm4ο*B!qb [r e뭛R 8`q{+[ q0"kIJ98>7"['6uHFĥp9i)cU d5\} o Xd=:a ]>",|І鵑wK %L]p[iG НwӨrA!3&,-*\ ުBu(ϫ 9("Tg#!6@qű.~9Tn B𭩣@ D% ebU1mxwd2.hARmK:QK͍-V$vPu]+7ͽ.Nݼhg7)׃7ĮPz^`kAxqPFy\Ro7 y >Sߛ9~ 0V%Ki(I'+aiu3=r*M\k:vOWB5A b-IGw,E< <rqTәK@T ;}($8qBm]cE6H.>Zʉ(0h3p~!cKWt$Fs3ɮ/g4y2 415 n=FvL1#f۾NV ]7qԔrNjvJ\J5u.e5n['ꦮ:q^PfVʭ'I܄[M`nRεdD)1P5h)Vo \7p&5jDPh~L&nxʾ)C[@\oCLlƋ"Nλ%awq 1(M ǻr>; xC ÈTY` YP@L! -#o}.S&j<zZAniJKjI2nh҄, ]f:}ЎVҗn7Rl~3 r@Hr>?8 A?r[Ϊ]c6jB%m&SOKZa\F$=iy jOAdSSjob6n7(AėUb6?r·:~S,6=$FCaegO}TmPR$E`g(`w8A轅5! ]kXiDDZWw*#2s^w%1=PO{V 7TQJqH#RsY{&m*[rF|P㌙7jc<嶷~5_igD'prK86{E{`gU XBwwbZ@{ۃmpv2Jn{"Ig^񕺘@&Uݰf?v3N >?- 4xw"k= JĊQ7^Kbd:aױmq`q/"ty[v_h1V8cm;8,)}/M>>>bL+d_hk./혊O2zȻ/\ڦg@[׽ANGP ԾM 9!h+K+BKv 3]KMg[q??Yyi]?Mr.D=ny3foCv2E=24=̘Qb}9֭pQoBS6)&9q;A~,A`b1978,S59a2xZ9["l-_kD6N|0FpLy8Id>&UY6:VQvkumEߴ )&,ǶYo>i`TDE{W H;;m ?MY0$fA豼Z:@H#mI?[0@İ 1n\̛zHGdGM$?S֢5X'#M6{hku.Е7b- W P(2E{Uu5^nJDp'lGIIRJn\Js14?PvݖR- } ~`,@c{C$Jl@V#]M6v_osh>\VɫJjgg~ `!a Bh$j }Z% 1c:R+Ut?xIsb͒9*.Y+&G+˙v>[^Q,LXxP3$ML|p>yهhWS: oiќ}{˧EƔ *F6xH;Z݁g ޴1~NM Gm fss 27kl}?).?٧zXkgs5e NYg=^ru)Z/r؝*.vn=D4XQ%s)VCaYU\tPunm(`Jm; '& A2rJڦ~ʰ'WW, 8d,Mq82{ao_@]Q̏P/cߒxpaRָ;g_֕)l,t4ymM]}iZ)OW`΁]CxԨ;|DɿT1Dfa}/_r=猛J&/ff- <(X.T$gzk; ~G _8,Ep|_JL`'z¢Ż[CAa=q[%,}3n7;;ӎN$FK;Gsҽ,=rl/BhC7j (9TZv>{wv6B=q+15g{A@JѢP\'%w)8=DjAF]Z/ĔADg^hN='i_Lg[!Kh0~P0YE*AO4m$`!H}Ԕ RUJ/d"Qz7~T *bOfO}EӣR864, ѩ ka[ۯNDHhs"" HGm}8n ahfe̋?D`¨QA0ye/D*u9Sj$hFcT> 2lnc4Y\eԟQDY)x#Hts뷅 Jz9~s'PRgR[쉣]@;c{D^GJ<#T:"3C+RƐZJiM RlV\rs>Y~\g? 6]ClK5{zp}ލ+%rafd|NOl"M9#H vhG?n>A25ѓp'm3H$чx0izО\C-XPK qrRv%PDrdyw ˶BN8ҍqt|x0'C|z gP=# 둔_ x$ %Q{Qx<{5LI5Gp]X*1?"?ƞ<`^\ "'s6amA2KwHx"Gޓe޻_ʷ;X3l9,WDD hmWVE L&_jQ'kJm P=̅ u'~ .zA̳G~2vux~ f+t+zN}[D"~%Nw1`6C2?? e89$M|]c-VKVvۀ頸vfB,:yD̩{bK-HW2>.5FŪ*A*VCf/zrEc{z;RTiyNU:u)5ah v<8v2T;镘0N\N-B<3ƨB{X5T8[}!FEJY}e{-SȀ= jKд2L8C3hƄ,Cl[NSÇ 8kja:6CXȐ apo₾siFSq^uo`4,g{4ͮD=frŁ#S::UH,e?tS)ga0"1+ޝ_Gwy4bC:go!Bop3Т^ "HET9ٗktE b_D[ oV ~ !"9R`/@=(lG*PqIqyM.-p`;'犎с{V^nAKD Υޝ5 uJDOþI,N'z #PQjOG(k]8K}/UWO-/Aw%ʚLj}sһD,1Ѯab{ S2ylRCv*S7Xe),Y5_F9r {)+EFgcLv9MY" >˃]҂߉\õ٪2:|'iȄBb?U`($TAoq+!޶E -4[ݠww( Ta8n*lSQNmKKfDF3[i+}'25ISv ]졖L £@G$D:Q V<کw *[O'40CvtsNfކVmSLp"1x˝maC#u`AJY(Cغ?y\R*Bl),l4O!YJUlp뙬 |MfZ yV}:8<ӠQv4r2 4U nam PA)2{F/V#Im_IpWKgv#MZXPS_ B%' p0 pk pǩQ/٧.5S.&qg&N4> սXKzM}bpL1{MU35C='JyR LGq Ÿ$#^:@&dvȤS2Øɝ,Lu2FO'#8 -VxpՇ6SxkS Q9fQY"]@p6.NTFjΘg0S'(~<[j]pJkA1H5^1TeFtxlnF/IcѼ46U#zA jj{H]3) )PZ{7^9W9B;/@e۟!ʿOu]B25h4 T4+A ldQJ2uXҵB}WX mm rY-w}Vy Hi8p4G@6YІz;W`m&.NxRW1WV|7|)f&xg >TikYz\j¸UW4yRN.҉{lw줺ʿa@|h}fʷt"v ԕuPW0JW'%)mSg).a-u$| `UȦ]WܲQ#F$͹id,}ivmtēB1nf"jeޟ DOiSQ7sqJ1)kiOy1E"RM(g,J=VPB.U\yB8܍Ov>d?齰1ev5IYe tӡb9&K]kCLPC=:s#=X. ?>.B ~N%ZJ 󄸝`z%yNk%&=k_a^\Νg'T} Ȭ"pY(5Η~#FEPx:ѻ viRMgoxSD7ɩ ح@,V{sA/XxW˖%Sn:>փ\30ةK=TϷF݆*²mˇ"SLʀu~cm 葠U6F6L2F/ L *~.7=[!^g0Ҕk3z,=*`Wn%b9>APnepAAyGLTxa^k2|X^ D><~.ˎj:;u3bKnu.6TL eYgW)ϸ^UxS&'UFۖ ֥|Ar*BXTdB>*,%?TN)hI=>},"׋Ÿj'柡uB?ªyVc] ₌2lsװGgcBd9aZ-;}]ML YUz͐ >i[A  n_#S\  a:-opQFbBP:ƬݴLsQZSg2?J:MwɆH hk>vz$]"d2rd"^s ù"ZQy+VGNa+EAes=wz`V2"Qӊ*̜)ݵ|)% I5kg@Dxcj CJ3lKǢiL>xVma} Ev1E+,%{rj`ոDu2N83(te-K6^%!|-z\ buffD4Otuˆ) XكM !a6 eGUPg!iAT X ': 8_Q=; <]5lkuLNVҮu&hM6] K(?O#a SugGQ$+b f,v3Zot.U!Ԧ3.(?c7]ƻ=tL@q Ip%<9(j}? xOUOTqDԌ &|[EHeMuwTB]GCK== 8HNO+A>:bMͬ~Op@oc!8ecq[i^9 ]DUV_c* fZ0z9?׭2?X2v鈜PӋaOɦ!q-ajmMzp\k:cȲiVKkyt Erѽ+ 4KzZWp`nCwQ9FɛCTm`׽{ms#YunBdif?US)c_ՔC?Y39#=1CI5ƹKے}jqPYF+YzDp#$)JiVV`F 5L sE |7N`<)璯BMMwʕRKJ" 2fQ>Y /*snWrտJR#3 j:xJR sӻhm-rDo^[kR>@UN1$ŰDe\g(# M{f(fջt+gB*$N\"8}W8Ϋm*G6>##r{rG!R.Dɣ?Dhm$6{خ&oHKP|*3MZT:γ(Gjp6U~Gy&ogȊ.#qbp,-~:Z\)ƮAU~|̨y]KF{1s glR\,CyM(.A|Abm&s/EY>C)~bWm sFV/d'f٨w2=Cls6oj3<]t?iWs~vr[ -L{`Wԝ甤з'xo]']kQ xTGOA$-IQPXI]w-><){T?yu p-oDCotUɇ x&`CoNz=!O7qgՃnp4F.4(LGFK35%[H`/pˡ-P(kPfY<ވ'l=y^MS(9끡ǭvi>*csԊ_zMg\;cbN p%g%1 gofj~CL*U~DP֦͊ J,f$95*pCИ"_ӴCv3(+*ݐ-SPLNwHϯ5J/ X|.ҕ/OA('DQBPub(Kl"5ZN[Q{+Z76u7 9 1XosEhRrԀ7(b1yN.49!^ڐd 6me=eiI Fds=a?rjlz9ĝV Q"Re>S=dv'Vrg_#yޭ.An >]P'lJJRMRFhub,/O !I 'jvh]w{ -^s]Nyb~Lk2 d (@c%*1~.mGݟ0X86I[7X|sCCHx0eQ5c-ظz8딑G^ br;~@B03i(? T?t=:ѭCFiB,VZG@熇mԝq숄l#2F&QyG[mm !"Z8e=by?$ЂGU!Cz37B7%I19Bm iAX 3!*` C>U-117K9]K/7}M!] -Vjkݪ-;Gp0X`IT%  ou+xGjH>̥¼ҕYe}eV20 <@b+lq\aB>wlIvZ{~ 6 \Xiu/Vhx 4x( =oH 9[ݣά (q?څo;K03YLo&E{i)I<ҘK" mk9 J=3wx+L#1md!P1 gX3]i}ɾrS^+E 's5cd߃M-^n;5X#俯6/Nt3{'VMSUHο |U/y Py_-+"?/o%G4W!RLP8=Pux*KNs9k'oMjz"SxɪalD{|O+DsD#O_dqF/ڔ);'w81ʇh#4o5n8%$<([uI9(!n48/{XMV"޼a ʜC=:?uO_˟sws/mo}慣ю BZJyfBBdĝk>+`MԟdًdV 2 I?͐ V7(O\5߸bW.ɸI[[Ċ`W*m-kيBW Y5o GB- Ԥ."cq4զHO>2 (5.r 1 mU/4SHXT}!+D\A5+Z+&BG]swx3e^BQlXtxϰ[Ƶcz`@>Vv*$쳪U5;+# 9 =SۢuBz} "%qiC]x1Jl]Y5쮜%G2<[Y"B+OҺ "cѰ^܍4Ua N t`$HvED۞fB o.si# 2ҔCDўt>:][BVΥ\-J~9yl%"\!a譚@c./pIG#ZZ`ʽD6h+qm3Ɖm\C tG#H#X۝ R:taSq#3Ԣ)҈bYY`&TEATpn#R-FSE^TPهJ3YhSUƫF96&>^B :Z`k~Z38( +7GW^ (/[%ݯh:f~M [5T%0X6@ XH+iN/AOxzZeՔ.OP=0>E8&T徯W_Zb[Q[ lrui&r_[G*s"yT9511"N;IiƟfMPZ c ^b8Rg{CDF:lݹނʦ* qԤaAKC_r/:,꺄%y)VB\J(.M{nFM( M[͚wALWn^k¡(U ^*yS]CO6ȜH%)`RDP\%9޽a=B @Q>;n1c{*%~D5ce\ ꆓtRm =,zmaˬ/di+ti;BAU7 .Dcә}t3Z5"J$/>C-P%Whre,_T)G:Ͳ#Bgz2 d5p4vȞ6 .x+%Պc0z" 懟sP'ǿ$ x ZFwvM_ Y*<8iх}PFJ|V@+%;To]b󫛈6p-$sJg;4Y@蘬[֜~?d}+?q_Z?+W ,9M*T4fZ͐8bAv0\=+V`y;8AN\ {*a<Ȭaa³⒔f 3O /&`ȁh/n9ӅdLH5|4>+Ѧ.qV&%q^N\f8-WU&>mKHXι0N18֊r>=?s:Sy74"欒&%4?2OP70{O (.^eX Fe(m{dmI 4LUX-:@AQvvJ=n }Ծ糮x8ÿN 6s AapX-C>o v1H r<Jm:J r>cn7RV{fNsumC ֢; ͎#wth,uBe<Ō' Wf}Cv$1>0&1\_xf8 ]/CXqZLs$Xma '[O(o@'\Zyg'P  #27o}pyoɲ4bDDL1pCAX`Ql?k( a[۽I#qvD8=LG|cy|L8F&]M,/VTiUUaț=T"phB.$zQXUwRr 11~)t>ȅYc;EW %eA*ZXtuwnFC>D:ҡ:*[[V>nϫ޻SLC 1aR4uRgěagz!K]kh 9,I~f/; ȚCJ)GCH#WqH h`&J@`tJ 67GL|&~ f.FO@hQvxTHDH7ҊHW$w>]>ȅH͘GnsH̰` (֍d3L}FP]TBjfab~+a?jdᅘNDy !Aj`]t.A_+vЍnMkm T&ca NVU:GWL G;ƺ_iwur "!i[ \ JA0Vof֤!( V}ݝ3[W)'kӦʙȫL%<^L>^9%(DC^UU8tϗV\T.L^` H‡9ω NƲhzͶ ҤސxS օ~h QL3`g)hR2cYF E52+'H|wށ 4+5/~_!u@ȬCz簠 Γ* rkAf6AŁGbu'L[̭l ޻kXKyxqw,kC:Q ~4/}뻷Aݭt|U67s00Y+=Sϙ9&Ac(m; +s@8ņC um\<Fyth"W ZX<[rnxPYJI@)3`K 0P~ߞPB5n8 8KheATxЧ ~]D8l\؍Lߦ ~(gJB9ŵlXi`8fp=BObi5 |`}؍ z3 Coի?}8,Uj>9q>\yAh (-i3DLeE8 Pj쏌=ߍ+M5BjAY \ }ptM-梹DF~&]yM2賜4ɜC~DIdȥqYhOduw,j$VG2Li0FMss'RX#z( Xx8z>7Rf Y}?>n\y!~=K׍ۦ&t1#?+ ॴ4\JqgR02  -D;uT-v+&i놷A&:g4q$ةak3CL>!ǻlYNi9;q/\hN M-[m8l#w-AiqF$DB"VT ޒs.ܚ*F>P(q~u̻Jsz'CVI.MaK?ȀXo Kny~l>X* !П9jl@b*56R4gQo4ᚉsIqgI'+Z'j05)xs;kw):ֶSJV,٩ JOmW' VZd @<}vUxjÕ2tVIʩPb0v.HšcJk8,eYG`P2;٪#sIDYZ [Z̚YS+֊ujtHv6``fGs4Iӱ³g;KoGiSny]r }jZNʫPDvtʅ΋pɡZ`g_eƈ6S7 MK=yF +㕖#P/P ܱy-%B3T(l,o!6_ Cm3;ԯ)k0!@"zֵC3VŘck߈cg!chgH3"-qKg *X)r+ȴ_ګʁɴwL[7^a _E)v 7/|%١"h0#Z;`zc(MGPZpr36$VcoQlۍBQ-k1~Z4zDeU|A0$[T}@?+G$p>cI*MUܞ]Pu}iZK6b2"V[>V` gBCl9KδZ=Z8Di8|08!FWՇ4\coNÊkZs5<8Lmk Ύu-s70WvG񍊲%ɴKQi`#?a[#u2nW~"PL2s>\t6%"|[xҥ *Է'?? fݗAHii͒=k7ћr_+O KzFJP%=W+ [W@aj[؆/a.ʒ_h٘`0_ErơTG2D+iHi*5Lb$=54sWrkRR@駻~$l\rlo8 XIpl\8d5pZ,FSgf=I3+xZ׶WYQrA p 9:z=>۽Ars#g&f\&{<1S50׍֤|(YoPyG!K}+\e1}Ju2&xZ,Iwi&!#p¸;y2bsB:7TVٲ8Ț66d{&AQݗMs\+ZaTfAbX+]2`%C(-!PZ JxceI(z,8cO=8tuh|c*VPAWE9")O)(j!!A\I2cAׅ|!W-ql7[ ±zN5rw•׌Q?W])qPTh 7QQj6RVfe;c#?=4n&Ur2I]G i3V U{ 0#M~xW,9> ܻG4{ /aF9e"453UZą,vDԃB _z&XbϯAZ^w^?UT)0^"k}B_p&4DN:}$mY}cґL4CiqP *>7֓$+隙B~t%j8\B4@>p,XU)8KmO3]{g@2f]i>:DYn?=QIƝS &oHc?? X)ƕ?!+ gO`ӷ^-n5ؤd/ԊJ0º rr'KEld -U\]߿ A Y#7V,Ǯb\'cCt ti˸兤:[5҂ 1Ԏf2Y,7F]K(s7ׅх; E?uFg׀H '?KO+6/ 9u w>5WС}謑8We{:<@ QT_fTmz=:i^gSܭtֵ˅>o1i" POI}+g {;VX/S{dx.~mr9,Lmߦ[73,lD29Vc@&ow`j;:͒"cHNMYRC{^yCFz'ˠ/"+}}/#r_eSrz%6&)cZ 8dHc $h\5F3+>fzpT/ЭaQ+N Cղv|_/ixeسn3:G%?I*:8$`TZGe==p+}c) V~UgƯgnLjܹ!ytyď؂I_9&[[h̓,?{E,'ZW $JWJ$1tT>W~xЊVJO|CN=!6V@}Y#~iK̮]ڙ)߹`!!]K ܂:|c H"d`ycGS*`c"PO*1S[7RQ.'"D̘cC8rT [qkfjӴkm7u0U2Clf<ȏ7TJJbƞႢ_(%; (cRX~&oj5I0D++rc+GZb:wFp\]YmeW(?PzOBqps$쩵 ˯R}[W8CJ9`U˛1ku25 ߢeqȖ7aVWx # _'ޱAք\ͤs@/o_Íf}mdsbi*|}2, ;~%qEnŧW0 \ GWIȀvNyN#t~>+síLbeFd#xyGXTF (褪B(yo73E_ a { 6U.Ϗ q5k a%%Zicكğ? T:"T!,sNFZzMڡK w&bԐ5%ZmЙ&5Rh_M.eck$E y,7V7XP2gna bE}"ou[hB1:1$:&DWԕ&y~Eɇ_VO2ԙݮb н,bٛˬ%P{ZDh?ޑPz7J"ǧ(ޮ'M3*\^qD7_(FEp?g*aI?lY+۔_,<bFN~Cd: vudMO^6rj6~@.Ee|6b_g?Jx>&f34!W}r& +p]khzrw`Hr%?s牢PQ{ Oʿ4 W(udfU7罦I(T_h䯻ȱ\L5I\j8, YT @6ވ)yaSSʎ1Ly.G*RFЊQ6$#lH;3yGWQ7kt-KmWu0 ;r0"$v c#  ?Gq!6+|oZaYb;6WΟ?ȥ'Ϛ5%t5B uBvnfy>Z(ѬXQ! 2 YYxHΩסdYNe}x:\*#O,eDZY>0OS *KJXir>"|ck'Ί" >Ύ{2M7ivG p/b:U3P˗cʖ7x97u@k0KV#=[i0ev|kr?LX>bC$99x?|SON5JGKvIMǠuhB@q 'U(2]bwb^/XGݗ?֮}1VdNd+BO.6V# -RJU ?T6<:v Xl/!N%`ۑͬ}x:܊Eb(td?*|XB -afUlG&*X`vfTx__r,=WnXqΉMK8Hp#i;7ޒ!~" :V+ DqLORG9*Y8fy%S[9g3T|=NSuoƪ1~텭Cm ӊP]RևXA^c).CJ߬z u_R^hw'EC3\FV=_;Za4V;9>$lϘz#-$L4F *M:H05m=uPHq&G޵R1}fz_i,MYcMf!A .&$~M^`@B q=fX\f>!pEJ!fk&쓛z^=nt 9ܰ_)UhWM[Y k,Ȩ,} di%mz?& }J(L>`AXD^wjlw$`|ДtİG!c:9]hgv,Ӭ!5T1ǔHPсO LB.00MhfW(9s*TG{ 1gvdGELᴹ_$cS0L!q]XQI>XpyV[e+8R&};)qp蘿J50S z+Xd:b1sPE1iJ&:F@(/Tsi,tU/Ȋ Tܿ[wCP8?g4^}tު ͱn@oϬ#SG7! 6kno =p;%, ߈䇣-vU &,9?Z%OCdAl*8:Xr)ۅoGRep:MdNm/#=ּ  8zg~. hcٔi i'M;' W@A(n*cǬ[[@"(2Mp*@Z; `iEx]!fV 2 E1bdi6($s&[ tV3QNu< Z̎Nn#WNv\K(tU ;uIjY>˜, X2 ,\eV*x~)8WֽbYQZjYӽcPwJām̫l: 'v  ZJ$u\TctZAplX *]T7NhS7HE7rp:0K21 ^63`>64h湱!LI'lR4 fx3yƷ(Z9џn: x]bcj:*Pi꾑7VKy~M2ۼ$@c5a_df R/rGkM=y#S9s$>FC8XeI`D ]~L%6XƘzLDչWz~Wݤl+h,Nj\LIEs^ `v͂sFC`oZ*%cO,E-i|MZ uJ=!.0[zV `jN9 ج.p*SsS{O|q*f TUY:UVv[ʝ,F\_l1S&֠sg,wª%9pFu{bvH[ƕuAd]3W þaqJk#)WO\`5H),REvFGJ2 %\-T.% L"F݁ tOP9NheD~X`C"_WŒK%AŷwQSB?aDCe^542>B0WQ=6^!?xv;6dn4 b_L`N,p&I*z {>'9t wKU*]QjކГ69X&4xI^ LJݗ 49! j<^ ̓dk'Cz^ύ(,Ǎ痞ԋ k5QS?`khhs^w2M]<_a*ׯT;(QR`k!ǀv4 ֫Aғ,^x`nd@VP: x!c)o8rs^+W,"vhs H[QnsMsB6\vrwn@?P)4A")59 v-s|-CmCQ']/ywS$Jt)S.2? E~MnA#ehXQ%g7 J(JXiK? pI1GK 'a)_𙉧g.W@"s $?:5}pLV}1jTNꡈEpiO(<߁:H6[%`kh.-,1@ZeCJoy#z58PE0D_;*8zJK%Yo+1v/cSoօ/dwuHh4HvR_C1fU k~!/8KAV\NQ,en@Br1I"~6ꆩ d[ 9e:™ybqX^3-0K팱6-זEVN-UQl{lPnFLJ4f'Bb9a oP3]SXS5Ըlo ?+2DBlg. ؒ%3D Q.N{\g8)q/wUGՃ`?)p*@8iwI ^FaE|"h6֧>'aB~T!:0ԩ]/Wxh/؏vdWwa 2E J6VK7&`/y{U2cK (6sY: ʁ3"7h-&=<^Le5[q+iQ#Zz!&)<# ɿ"J~s;/ ת,JvQޮyIGMCNlzچouczցr#6PWUjg4\menrU>;=Ir]bD{ tLqUY:W/Iy 7 y mC%voyrJɅ7na!n z@me;Q~}o`y(TޗhahImtI%x8Y!!*3F_H~VJ-pG<X)M5` \GXTkbHu7$k $s$攽n$ՒWMf#\bdʟMGdVk<[y\攤${[M* -[A7fE*4- )ӊk?rnݎv<]{aq"nZ32$}i`eU&{'HCQUފ"Ik) W~ {~?[lhƂ #6w,!}ˠz!=Jw"M0qgJr}N\47’%]-^ &|e33XVZ}hlM Y.N0Pk R{~ љ9..^ UTQ:fm@ǷtNS}\{@dYK'0sKg5[{S(wߌ 6PB(U0XZNבCгg-K.rW\B5և2j7N#$^As`B}!Hb~'6'\ bAx[s5%ơ栀mQǠWT#1[yj bBc'_fBZmX]C*_36uA{B* YpƑ4ѽq)* ɲIv%@|V &bz0GCI-lD^ T|~IҶ>6d`ɭ[-ΊC;T9(o\Qo綱IO3*_ woe~N 2̟/jt;D9@-޿e_@!DWhу'Ϻ5 j3pyxE\UΔb]eR_X#M@DMb_K%ru }e7YmA !ykxxmt]-v1[鷮"ޑsEy~KU=o!Z,o %E_5Ζi-rY„*@ݫY\$/!g xUXG%S׫M`Wr miINen]GmG#H\DJh%}sGLPڕ;r[HEY7W=FF!_P>1b`w9jCI* d̆q5mȮқ}cr#LwK t84Wm]cLiĚ,ʅ! Ulٓ FhPw: ڧ8/xE-jPT5K7 ۤ?[j,a q2~7@DD@҄?=t ecЭ2{RD9'M/ evsXACQ)=u U]9٢ԅ+L'G1d-a&Fh!?EJ^ sy`\x AgQ" 'ĥxwvvL[}COhGJL +,:h4g_^؄# ֪>1h#D^r20s*0]B}QBԀSyP `ք#DAUDA4(zce=K=ׂ a[~Czh,mpP*yjXit +K̼$ߤ[7m3rb[#i;ST^pBCwC1OZ-)S{&:qq+P? Uv8~RyUI 4hyFwov8N'^*`LoWiiE|3SyAnp&}l:@I$C@q8$1=X㊛ EYH8L^ Ni֝]9xN- =Kꤦ="6%q꿗ŕj{8NZ81F:nԡ%j X{Um'>+qá$5[BUn1X٦K.mQk#6 6[ool~zO=:/áau& _?"?j&ƴGIgqpۈ rat| d4ΗRsDu<^m# @:@&l7XO~},"ZE]6Boj my_K_ LA4>Q X,6Q~=rby*I P0(CXuocADl26[ܙ ;{{l[U Y: ~$7bhK1611AKx^ED! e@.QŁb o)ڽ^n4WN|olYr1V6sD6@{5+I7Rrk4K[ _&wdCdO4)4܂+kxݮ7; .[vcWu% #];rFHktVY[@5a?* п>w7O$E\DZm+*bRK36EIA0Q-qPuZz+ך~g+ʟU,hl@tdy"&⹘pma%Zgb$"Ƅ@bΓ;4$ЕwaYaS8!y@xA,$0\D A0+J7n GvQyZ\:啋; aOxzk'Vib8Aq>ү,.ǟD&# ئcx@:gBVZIJ#%IIl<$+q\[sھT&nt;b1ТZ'X( E%,Kql?-0f38U/LTdV0w^}|: U?t6 A.K`*qXXiRȃ-桚N}+PaH|ˈ`VwR;w {Z@. ӟ0+~P~i3PVfjߕ%b<pus+-+c8 AJ,+ׯ l- {HPC&y :~+2mi1 _cw>jиb=LעU$[QVQ; Xyv҇7QpBvtͬG rYd zPNL 49e'D1CA3e~(5dpLu IfKLX@Eᛰ)Fn9jImrtr}*[},((/)n!cVhc>^K$ٵb!*6 z􂧋|h!if hX O5W`\X`#ګQ >VgY({z"`0ZuL -$dU=Tw 𞶋ENY0Rm Au{͢u9ţ? Ɛ31aFw-GٰGv GlMD8 Ƅi%@!UõS0r9\6B`hb YsHҹDDPF$)픀qewf0Pm﹅kvBE4SP3T1*OH q{Z7S usk!ɯx%ۻO@6 lL덻IECƇSO9/60-pgYCr}|| ]/ۤ3=2E\t{L&|Kc:<*Eg4CfA ?CTFl5͕x=&/feDcBڛ ~U{LE1V!:&y2&Ek- Kxfv!"Ǥ߰lG.Zβѻ\Kzq3Z'&Z}i*jT1S1[%==Pܟ9E9Kj"椏N5?aCS:,xg%ҍ`>C1Y{\3oOpyMC>ltry݉W=H|J[';6l3or Co*͖{EAS_* =w=t}  5)@$OLkqhxf)ѱ0[C(@zJ1gӭs8rZsE :wSW`DxWJ5U)<51Iojv8;F؛ [DS6Hy{;B&83Ah~èAaR*O?O+*Y50;έ->سD m砬V%P8[3ԴL A ?lj${ \ຝO ʻu߇q0`0) Pe3s`YӅj2>b1>WhRx!xZ7IdY$ȴ@biK3"n̠[Ei|a= uψ t#:ĥ7-T_Lg 4\£-l儨WAʐ{ڕQ\dKziz?WlFVc(oϰqS< W&@~SR1&hPJ{fKuT,o}u6FFΟ*t{\vRPX9^ln)ufju駊(vu]=B;OKFlva/Yhy z5p:KU^}A3rerCdpc(Á{Y=ү$nDf E⯱+=fgmeǂ=b">G-G{z{&GNݥTjTY4A՘0~tӘ>H̍^26\ڛRR<,j aE@y$A/{ ?⭚eRh~r p\6MN.J6˃5i5[7\^bp۶iwgqKTҋMbّ~]vpW!CqcSB|hC_< ݢpCĭ;ۛY.wrLڑ)Ң!'hg^OnQEY Ļl'sV 5ٔkNNI FW<ls}|mX&9XObJm5W=܌e~{8 |2!ݘ!G*-`V*;tp!6U:!fᯇkGd;oOv ATCovt'a#iYOP w›dڿ;! ,wʥy:8YJJ'w-͍hyc_E0z3[Ja]ܢ$1 OkDhM Q|`E& b {u^'6>냾q}mh3I3.庇l\GkK+7p[eMsC$ V>+ Āh 7[H[YO!1Q0o`Ҥ~ަ# "Ua8?A9 /=]gkNZ8+EF;聚|0k$st_0{1X;A~0@b%sY(DiDPԘ 8y5\1IxH-cR>EECv`++-B}mdv TqdR3BIL/`p6&P2q.WP{|5A:!3IS_>Qhj2Fs>$jql{I(OAbs$GӲuf , ߠ̑+Ac ,f1(s4In^ &?wx*얰XvHۉ7)$g8Vi1)J8,#E%*)Y9\2eU;!?H7J =0#P!2cO8N}>󢢊,]rwiGI|#],M<<ޟI꿓t,JGiJ  ùETdnd%LB \ (сtdb޸6nRpa1,Z,Jzӥ=k^ <(~+ 2>EtMkb3UX\ڐ!+Q~3qCC|\:m@Mi`~۞C-`3/X_HKBǹx8/A(ĞNA}u g5#&Ɵ2(S[Xõ.i 뺽4;O?.i%`76K?]=vjO%g7F>?j|+ׯ KZ2,:ͅOf;4h%ҎԨ #uFI9TЧ}g(g&[H&g}_}( ΍H&ުU l])ޟzDž柇ӎjox&Wߦ\ܓh]_zUZad}{ö^צO"_pݙҺ`.<%CgL\63uT =[$1r&@]pϵ@;{Y//93iBƒV5'CH;T,C -bP=Q'Ysn3Ftj ϋwdl dvè`=<|Kl|:m+R;µ'>f"~ m G^=pP /@wkRiL?Ou0?Vm]ٴ(k&nLGʒ0AYR@vwnO }og-[g,YUfo߾=AOb3!^]ϲ/y:v4Ǘ/1/~rbV0$ KyOQM;ԇm~#c r|UDka. XJ%iL aVڱgo()|ᆽ煇izjo0+O(w=jP.h~nZVW69p >\{s{ѵp[•Fh[tK J"NX.ӅN6@ @Oxȃ- pԏR0_+F b/[C!YU }JJOnI>!_"J(}l~OUE 0ʮ0gr㖫ᗒt;{~۵/>Zhπٖ (],D!喳t?vT8ϩiWfum71/Mwm13=O <`Xany6$hu[B{L:>IWv!P"ڇgՕ@B^~ bs\获i+'=̫Ȝ twǎ*hr]p b+L`0oaf twAMsF&L ]--,E8rOL8! c9Vdafc|߫DQ|CmL g=%v&H@4l`氾p S y?-4$ Մ=oFv*QBwd9vC CjL|6O+Fm#'QTJ,g™l8PܮbUXԦt?Kݳ_9J۳0TהSNK_8bg>P޻BУci?V~'3n[ȡ`6R3Ɩ^Rn2mh<&/,2h( MM|8lfkx̙XNܴ #zHI;{b$svUrQf@4XsDh6zi1΂.An] B[ S*lۆU؏u'H\+gΨZT.#KVAX;܏BB ]9ux- Xfl 6Xk~5]_ t6 ݜ/|!C|-eOdm;](k[浱ҏ{R`FYmC$]}i.$(2 g0%4<(}X:v!-';\ypj!xzig8AȸMm/Z3PAj%^ͳ @(Z oK{#<73۴6j$4G(v F_83 έa4<&9E?{G5 tp[T4 R#_f%=?@FDlS/r od+0؛Ą!vq椇Y sg?ht&U(;뀃̆w+/ @ YuiiL4KA@NQ`8i"6}XJ]ZLv#jdfEP頬r"ޭesf5He*0`kzPK* ,_@*XYsR w%DVBA{9_p2R`l^[b0L4@&|/#܎Ŧ1Eօ#E-._&Za~^2/ Z*qLJzfi!~n3ALǷ?2]βX|}'b :1ƍNy+uy]PkV}]TW of1 ؔG(Q^lWBH`{68/L,8nQG_tL'w4TڨؑyGڢ@`4,=P 8ޟ!&QBћFNVM}>{_"-'ljgj4JM3 RїTT k- wyXRyqⓞT\܋4{yM<]+?kn?44=Ej8ܪh<^G (4ǭXp2yX.-m[1g4>_w>гQ롱*@D  .4km.nl4U6OaIh<0]U{NU{W88#nihGg>B _r×Ü2"n)`(J'F`Q+5M0[秣iօT|X1ɬ9 /8cg>P1j8|lm6AcGh;ÇvF8S*ֿ.1Q@+!y^5RYsxE0 sƹJ%q$U> c"Ab H1'*sWI,Y]X/,|:&Hq9'u} 7 Ǩ]cƛ0 U_?zZtD(O@H IOF,@{};WX J-,WI#Vc^.?_JvF=bF_;yupsT4l1@>hW!ӊ=ZVpc t)Vaˋ:1Y3Z˟4-Rr|\V]~\WYV<1Ұ]rC(Wb~( }iҠqpuiv:G4j-wPpTWV?' R&晱'Z2] NWa?zd LaQ@n|}Q+mF\pP,㙏)>y:1Ldжd5(UJ>8Vit4́<Tƹj'}dPD zT J~.Q;8G7ݿs1:v)^?̤96 *;:DZ^ 'm 8D mRUTdtġmyx̱[:W0h CnnYoxJʧ(a"Emzgk&#f qU ~`V]FX4.{XmuMRݟ?71QZp5vyl*ZRpWw:1PW*GcDOA\1X,~qoǑLj*HmH,X7:Y44e? J8q)`ӸK1^aޑ,#=i3.j,y<'#!!ybѢŜ XjeHI/Qcr嫍zqN);SMPc,j/FXu)V|W}@#m$Ifu'ֳ|9uQ"N=SQfxyȺk>5w10gMG3t\DPYge˻cf}ǡtRgC*{Y]urdsz#>%\o +{t +obO6/#ZliFv w$4Lp=9$ ^f>w< ]d}y%f5m?vL7r f, "r9{a:_%Pvh.{lUk-2BZ9Hؾ~q»\ə/ SVGZ.{*L]>tHno?UpO'Pz}kJi.X2myUSp4HiG j!022-/c,H˙/;PL(AucAt*ƶg"_}nwCXT("QTH̺fdM!VYwbI dBN~RP*8#(ޒnJ?!?^H&p4 _9PEvFVJ(;vRn..#0wkƆIEeRȾjRcyPsZj^>}Q %s0ϴ3c.U?Jl.Yx4z[\D~\C`\V+7B}wVu#ϪCM3D-24~1ALZ̆x޵tYdlw(!\AsȲNوp^|ϐ~~k+Vc Z\h+s)/ER!ƧE(=W\k18nl-.sDCV(YM2\Kh޼U;̅4A\La(#HgtSmV{*ͭ/s} (1BG#ER<}ec%w"$aتf1q9sJm*֠0{PQZP6m2i5%VsI^,1X,1PWK14U-NV{8we_4R.v \K2ݕkĸFٔ*IjVzCݱD-mɋ?d1ÄcWiĆǂ?=#{88cw )p0ֵ1 δ#u&$/œҿ$v,Ա=gw 77vW. 9^Lz^+1}O٘_`K -ݱx$4Y>ۼcӇ,I#R)z 5+Rosd\0L_ԟ쏕<]s/rbv[UwLd=fu}"o Žg9:I9ˌR8s?)O4D9-ŻT)ܰTNf\V9M4qtJ<6ĘX^mq^c"<TyBe br۷ʚZg;>;=݇t{rP8x [p2{E]SҠjqWYnvu7$5\32&V)36>oJhj<.4ahURɶ=xá.kԛS:KHMɈ?&t켞@ƌ-/-En+xyTӪގ[dCfWp*{z @!rMk{VNBRٱGUNv_XXt%.b+ W1J4{5BX&&rYө|OZ o_>{έ9}|5j,`k,<ϐmLS;Q~im.co:~iXU*%P)].56*Q4{wCrwB=EmI ,o 2 pPA/L)qN;G#G)D&ml\@#_ |tJ1F_ pX{~]d9 ,2d+W^L}{^\&aXJ4#= A!г[͈xr6kr˜QJR"cy ר* oG!/l<1SVQPBFRƯv渄%A*ǹg1+3NW.  \YJdhr>ڦܩ_箜$pKEXn Ux&+)?:h>C rm#B)h}궎px@SͮD]VY_Ճ`K}eG)&X,5$]\,fe Y|:۩ z.AH,uI c*Cޝ*Fz{t}׏H%VR& J]&p$>6|ΠJ&7lIr6C=ςٟ@XH^ygsJ.ؒ_?k9gK$K>h|LcʨNt9 ir#[R=:]i1zij&`F֚Bپ?m4<$V~OjɒXܶ%\\v= K_cmxuBiJ-]@ GCC1Sč% ?~<=Z{ᑮH"daPT[H& 8R)|4tos8 hB،㷛&t%,#9V"hnwE+tW'L̴2aσ ETbW mbA ʞpd@ѭL 4Q-><+%5  ѪJASzeU@t[ Fb<|5r)O? a-"!zD0&ֱ\eW7!E}ŽxiοY{x΂Г'pQqJףIr3(MtaNr![?v D$̻kWUXQ@&-Sc戊qZ?zJa*wy%UY^7gܴxhvEjORdR '3 !q 0&ym 7co 4A7-FIOz OP64L]m@x6:C¾ Azn#'$)pqr?i8_X!Cơ1rbN_!e2|q3tT+0nbӥܟ1%{ kt]ƃhХDߜ+BpsNF9TS:H0;uGڑ04VQZ$2=St $/>u}0Ps+d]h[bV[ u5ZjwU}0. 1yDΰAKG;U΃~:-le8m)3+wb`DRy.y- ?wRUxZZڱ6qHA|/ TbO?)@F!_-ZRS^Dnt wK_N'}i b *N\1ܛ@Ƙ7< ͋\56c[&{9OX[:7˫t~AƜ)vϻkV~IdTh'HĚߠ؃xyZuBflfc2tM&ԙ6|uA/~VۤV6 ܨm &WYWQ0q[:fo> (΋LTYj1b%%# q՜e@OUA˘G(6'P=|>6j,$PU+&$&Q-./ŸBoxgo5.SJ A"^I|>QpGyл}BXf]}uY݀w&H$^yP&Ă4'`w [tNzp`f6 ZXZ =" +/ʏwOfǦ"Qx&PR4]uSuA ċ܉+5(nTf5B^;K58nɻX7'qE +<\RsmHsX>h.lhY4cln*Kqf{/V%-!@LL =[(3Z@kgг9b5_9B?ЉUM5+l UPq91n1LCE8h^|3s?ֈz_U@%Rm t0 ҈qC:)=XAn-뮻oACLLH Hk<cruŸ(蛦 ǞEK)䇼o}ҚLAW+JOiχ J: VԩC1wp4ܬ p .βHg}#$Iz_):i };t(KC>pg1Ifciayx>a~֜Bbl0jJ vL/$\n^4Fg[s:*}%^n4\sl|1zgkyĹMO) a:JXHK,R1rw}߻ =L0ltP(- Ujbwnks P8EBʎZ]Xa̲L V2E%{Z asw_obP,b@";7<D%B!c.X_YRq;qᄞ2:$XU@hc>dT2yb{!(fBPf@̾?P|ɨ7rAE&`iKﳭg@N>Jk1[м}FmE". c:*"2c!|قI4 C쟃nG5jp|wtSSj5R; #!gt 5_Ajdm\9{>deQEHK =y9ETr P޸ۯ[ئ#+B q,1=?BО;x?'N1nk쥺- *{90oa(tі|7Dn #E &j{fQUH93\/_ݦhmqe 0 ?{$ I>{T/+heU*jp 8{ ĘĪzeJbR12~{[Pvǭ<1C`y\*}Hs?}+27P-do7-auT)L\V n}ΟU}w@I*KP0U(O046I귣ۘ(_p-K`r 9ϐ֡mgiݜ l&+l  tOʱ0hn3,CK( [H*S)xpu{P8$M@eE$OQ x)Nߗ)9<M[{NvT29n]&V0D.vxP7; )n5Р-)y "-]\x+yCG$B;^ ~RtN标}#?2xb]ڵEwHiT.QoYXC<Ν  JBnW, l@hm'x@49墬3h8s,ۻ%!`iEV{$i82$YƷ* W% zLʀw|ɭ osF?=CR< WYvTMaW9U )VNN$,+^ڞ<*IILA 6&ٵ;c?ܛ5]m. 1GS-`b  p]tԫJ\~C)}}JbQde]Y:3X|`Ɋ.v͍氂`৳Lλk5*0 /θJdj0 Q'#?ē /T]j5TD}X/1gY$} "1A5f / X]/81=+LժNvuCPGWݞmRli-y| "yKBb1cV5 rjy#I J \=\QNN2b07}jgSd *)Y%VI$/9o.|+IpHCt-* V1.{% eDc2-6ˏ uZYO[0M~|t.}]h\s#<N('I9>tApEHR-8%d0,y -59S6,Dk˃ :nG2k8@qBZpI26g55EK `JW~)%W׵k?)7lߧk0H[՟f PM+ߔ8I ㍁;]㏈Җ,-c 6L4*>J1]sRA㺥0Zh12N&exh/?Dgr֣R?-"FIy*]R 5onRjP Hm1"zSjzI*Q!`-ewp]-kC)8Xp>ZXZt^KeuN()7\[4H!FI#z`boSp|4FfI*GLV"?'(ˆLޔ~t`|o^7(MN&X[87)~T:%΀M#2،};CXhB]Rɂy+rp};PTn`6pÑeڿ"iU!׳ AFk󠰉먷7jL{ rde yG;o^WR)$;$'On1iϡ0n2,(E&:1*uP1oDJ[E1+w+˜1EMWqF-R@3X (ýX g ?3C|ITUϨi$UyRM0,5Lɳbn1ڑnSmsZOғc]Zc62ƶع74Sp?ڳȫb xPJnm܍ o-Ê!z8Q=72)v]**Zo 5j,>EYr?puw;OC#Sܝ4BUe a <*}«Wg uQM/ux~(뱨DΔ;7RvaM󹑓[Ww s4[L2|w58ӵާƛm1@g"t׬icwDUܽ!~L 82ֲJ҄=N+/:v%jP]@p4X':Щ⁌S;{^/ H?"Xʛ3m `㌋&D9o ZJgܗ {ap6Ȃ1a_Ip'DՑ7svFSp\W۴ PJm9ofU+%p@fFˋF .yco_fjo,ՙJ@W[j **?`"UBX~`BeGzq'2+ƽ95LkJeoI۠CNg̑kjo>}-zd8ņ׉rb*ex2H%'ٛnKς]eR 9H:K+NO҃8y> #/4zAݮ`bi& e>f*>vZPN0$+'Y_@7Wt %6`Un5rj "CZEP'kyzK^#^ U'ϖ.%{ɠpz?9@K:~ D`f.D̂if^wdd[z{2pfrVl f9/#03F%C*lpj"Lf' jV+\B.O9׭f sA ZImO֪"5GZ|eIT|Ai٘NO.Uu*ig."R u۰9,Nr J̨cL"C!eأVrXW5Sہ ]?N[M'MeΪ63lgд8V~f%7"At5e-YQ3keF4@+4C9؀8PJK#COps@=:jG:sg ؓtK%C@D#Tf$f(+fKM,kw[֚]PZ!,B^|~*xǵuGũRL3%D(0:¾(O R̡%a^D\gT'dv{j92"kƪȢN54*N@BMcD-vrfbXq0v–ʠ7EqàaC3ݓpiK@^Պ/M6╙R7@I9Hթ~_J; @VMȲ;NVTMovЖ+j's(谗SghkHkУ2EGw@O7&9-_&=9FMbF"q23ezS2w(bsq {I)S~˜Ӎ y N"w 擉;.mPDj1] wiuxJ«f'w㉪켃[n#_4chPgkPln꼐l$Za%ðD=0Y@!”J2[Mܔ*.J1kJO 4AZ^,+"{2a[O4 W:*,!ǣR7&lM,R\ħȲfcmHcA䅕r~@$[; b$YG; e ۸#2mG~hqۈI 7&mxdA&{CP j CD&|r?s~[o[@Lb#NѪwOMKA~L. }x4E~}qD)4NG ItsE|Mųa2AciW-g0c7 xt PGdTw&\︽KUYa`Ljo4\ RT0iI;:E_Y]~s2L&ek-4m)AY~3d#.pRU'mvp@uB|Lg_٭!Y!f0 ӧRϐ6Ecl8!z"x143R~j(NQg5YZc"Y3^pۮ)8`zO?:N-b;UfBdޣu뫹)VEҲ娂$;շՌ/\ y }UZ#}bKn,)lL~iCJuj->=o0@#%<۸ *mfs҈ wϲ& 'cix 1a۴M:RsW>TK1@J2wS$0w(MV13?l5R=ZbzJLd&ڝRַSn?w_IM/K^1*\tԩ=:ҳ=uS0pk41b3lGv"BEkۃU= W(NXLCB2cx:XcI#ΨhT;A?U&ghC*t'T8x /@R{Z hm Z1u+/@LbKXkU&J;SRP><CA? X_C#MBo<j5-d놿0&|x%T@ k>"*@ vBp=1^萮 ȴC6?Ƴ}Uد"4"[x:spuQQ#(T kgV2ym蜏;( :5ZBO9m/jH|A5;`4.$IT nHyY Eho3港TxB+FtTQ||dt| % "SF'"!|8]Y4O7lxe\*Lp4.?4ϙ3jW܋u"Ob!M5wTxܟbKR^dTu;:&_,BgdћuٿP73SWUu!Wtu<Do@,"y+f*]]OTESY/ 4k@ !649 kQNcbE1 ߇|qC|<`[F&{cUFσ4,4VCc@&"=pN % !y(FGɊQgF;ǛKaBQ@4EC; h*S‹IȵE`<>Xf߲ U I TF du _Qt@<)Xq1mG +*ykݶ_z[*5i~r~_kDsFcU !|ºcP e͎zR0^EOu]%~zY-~1w>H*AP}iqlE|{#>ImZvg$SvT':KAMF|s-pw0p 'Z30*zhȑʟ\?MŨZkȘaU- w:J<.%vjr Bj@dm%5 yV |-|:xzFL6sӀܔSc2/h1r#;o$ yy 'ko]3IW[ VA$D|  Y|l.r>PBl>\l% V+mPyL1V`6g~\GD{8߾q7PCW4Rt^m^B WX]JeUߚ5R1li^+_w,I3] M2 s{P ˜J{kA"m|>ql\ fO< j $#g$JͤZ_ԔA4ތ^tQo*$% Lf1Fx’ӽ6nl&G*ei72TCwhB hEGCD|0" 2?JlO.z6` L EZTxmE&kd9KPѝd)s߆LcqSuq[iGTESsVJ}⫣`D`^Vusij8"peGH~W=rC4-Íg3b7D!c((.ќ0ӓ_fV[p(bP|̸Y,7dHaR5 [#;y)'y2u/r~|CICW̦FEM8egŦL]|a {۹F*h2!8oDSYbQʰ"&([Ƅ # jګ ?<嶨9מBx,m4q ؙo]Rݎ ,?6,)udk.IQ2>ǠƏ.~v,9WyUzqU}k%ԝ$7VHvZvM"_Q0$1/߄P*+g!d&ك[MmLoNi Npŏm]/T9;O  "#%ꦈBd'֤N?g0ⱒ06*' w|ujݠZZyZ^"bu[ 1XՆr!u݊(x - `Dw>W?9'&3$y, ;:m,&c-ngJ1X/#T X߅?YqZh7?e -Ps+}hZ܆ָ[[^%/ "g]@?b!m5DVB8&|z61C'IUV ,=@L#GCA/]4z+h!/}O^0>gqs`q8 B\Oϑ=)˲FWW2]P{0itL^Dgs6Ug1V=*4X< kDsߩ)Ņsx#bQSU_MlլKC}c5D}}gHs%{5~#V[XX\v݆UWg?48WswR"{=>.Z!,$Scz viA4_Eb8ȏ| \{C`3~j]yY 4q2M|H/D!l{1|=U}W#l?bQE;_>N;5>LɀdX D@t9;' ީ蔁o.u: K8:QۄnxL?5C; mt㨺w5͉cX2ft>wnÊbiЈeа ǔuedrir KB0.Hw~N=;T'NP|D1Mud{tPm}3PY -Bs0[Ɔ>yb9il1YϦSQ.]F؜ρx1q!;rEꬁpblnOj^AMy%&(>&GԔmtvf3O+Q F@Iy>28qU O6bFNbPD( 4L#aG~TfH∝7Z&5W-T5a/¼뭩좘zGNɺ#6 hҼÂ%V%_Y-vNq]3ohI_ x5&һl[##4G_4K KhNB r7qnD఼9Q#?[m럫)QI(~&p6yÉ:Ѥs}TUD= $`"ZHwVc Eh{+GaHsܮBhy%{>agI+Ram)a며1X9w׋f2u6Y6 b+ws'CB[ZKI?X}"HdWfGo?D\s7TA;+52=n*t:6+ֵFQ&1g;Y~tTPڴ-%H>N`'!_yiC a՛ \$L'MeaXGQ~f9yA]9!b?57tD9RV51YH45 hAEqi QOԅg"M~ Q/b|1ܩRai- H\IU\Mn[(8D)~ebw,;F}1g<' ԤuaYs"{^*?ǓD1+bN 6*BYBú1qb t2hHdltXeU8a煳 I$巫13x´6fyvoݎچf*Q/ gc򅒕o+a<@z;28?75?ʁ &V i?E+!9ˀX}T@%_0th7) AZmQ\zlҨT#Y6}z./ bLZ*LcK]|V\ 9Mᡘ)2p[=ǀ"j@QHHpN)JvH970`3,PXБ'">_k: ,;KT]k"7v*^W8 RDR Pw@ -8<đ*\* ttSx0L swBaG T@r \ktKxibӶ/ODLU%=XTKg$u-zoXʴJ;T'xG~rbpx 6}H>xϻ#]"td+69hJi5v&sL_1>T}BщcR*yGJdr#{MtΉyVg{x9ǨZڰh.ZUF%ZGGv% j/ U^0mӨG#A{_AJGP^4v(iP}.&̊GT+##V뾴11i!Nv2Η`#.|~Pi0NHˡ$Vʳfz2EڮgX!x< r\b/kDGtp}B8MF_ɞ <3!H5Xz0Es?s첥e ^XCG!Z@B2l.m5#rӇsNeV|-"Ey`7B^ıo05}EmУeHG~0r*+ )s(hx -%:?v,)o4Mug͹\3< Tj-B|Ѳ}P N6`b@k2?r"úd1vRvFҀ3"ڕ㯲f,W%eoqiu8OԴ[u.|Aj,n%ʟԸXv:`s}#ܚ铇+ONE xתs)|c'9E㌯y/&MER_kJql$8Ok*KJ1j5,1NB$tĻ|̽7c( &q#*mv-gsTN|` sX~{ZT:ez> YiGo Sl] o(B{(*aX~ &YwJE5n]b@i*x^ 1Q;Ol^ n9MtfޫaT~0XџGi˄"Efo%GL巯 Svz1)A? R.RCI_[>G *i ŜU4BkբN68upص!-(0̧L}D vL>ogEG.WvmV]f2 c.N$6iauh 1ڒG3T3҉ o8ڴF5O*0F7ӡ+"_65WfCWvdM#AW"05`AĿ&h0Dote ׭^wۯN 0Hƒ'wŦ{L;;rNadk&7e{L9WGUO^`֥uc+zcIl.lWT쁷7v:/t,1YBi-bj[ژQ!ly}gbd`ΘZ\KV&o$ IxIOvJvfgw1+XWg A28Լ^gH!1,~ %@K:E*b6Wb"FWjXD2d >7W:!As _[&s@(~(OPJqN+ONQhY2Sz^qyK Xb)NFbD&4{lo14폥ᳫyd>K6-^l ZE?t]*}dWYK^[ہ+LfU2ż}.j70im\-Ge k4R1Q~ Cg׮&(6W -_ŝ:5K jHIi;zAK+]rHE[vE1w һ9oUo/||(FOkV՛?G-3IRlT\vˎ0[8Мaj4ݐ?jV?>1\ V:n(m~sԘ6aA VQ`ap)Nt| 7@4Y4K%/:bu8e[ }?+7}Ɇ+<y>v/ jw7k5`s aCtj o3Ljz|OYbNor'8Wƽe&^}V(=R-; pM6vw kw'.͚3DT /ץȀy/nTWyxR@]%oXV588[ƃP2;+vdsL}$4q70zZꜬpot$)H}=' <+Бj n3,^v~_L^mdzGe<.32,3FF_cM|Yr%4D/U>PDxF OX+WLgDTfUе}Zbaw h:̈2 6BJ: qp#x*ؙ )csŸH!%@LZKc7e-\7,ƽQ+6Q#ljǖ2.ݬΑ"Cj/wa@"cZØOl^1xJ,:(gNzW)kP(iu|N.h{ աNZHRoa;{_CUVׯ+Ua$ v/ W +.lu-IEՅ+a6%3뫑a~Dg7u#idNɏs ċ ,+Fr%_1fgGmD'c4d<ɯ+^}`Gv^Z_e(ݔ5Å.mӘx25TZK[@* [k:@iU{5la[Yo !is0isj5`Q/5t ~59 ^17<ϨImZlŒ^[]-μ\16yKcr#Gi:!HlU<(`']P6[9@IP?;eV =dN^0;+ SZA?*F騒}i/@%ĹQD]YP)9IF:Л?{Q⌙eBd,j׈jP@dPa=),:=qUMBev8nunB*| [ ۍPNlc+GUj"t-t;L .3-DiD+1գ lR[[& ؍ C/)}/ND܅)c^.8#D ?!{C=W~ j7l8/a1rn\kCL,y/3Dd/= Ehrk|teT 8r Xғ5TgXf HܥڔEF!AJw"+]'N$)Z{w$$}]ȹ*LRIpYIC=F>٘ע?IPS4onNh’)޵-̏N HKj=Z|[شxujsgjWDuDŹ  t>yLPG4x3+h4L8\n!a^̐ȝFF?2{E:鋎Ar B qgIߐϸ_훲VU0΢ B&h RjaDd6K~ap׮q#)Nf07ڷ}VT78co0į[EO4X蜱H7&+a8 vx$13m5ߵ~z+>py-#ģe{ ]p"?W/Ua~xL-*M⋺br}x.zќVCğ^|r!(M4)BNדaem[!S:Pbo t`şItidhhuft=+G`+q")Et)w(X=z2JFuEυ dDW)`~YMRMP>w~iȓ-, hZ(gvh;{o' ӵ}ehGrveG~ 5}nٝx%*dhQk >KFf|"brP9;}mP9xDlcGBJhm%sޱf,^t8Xvl|TUtn"*]ykjɛދ*HZU^DTK^K%榵Iab]Ka+2rI+M@~Ή##0\1[!PXڕ!hNLs@77A1~|d?JØ;*دeU5ĮDI}1/HJJAAS֙e;897= 5g| ӯ9Vsڙ}Z#U1AcOq{1Sϻ`TCM~ j𞂆,z! r킬p!VzE^SS()m뛆s8,(. d24J]?r|4jE[3 #NK3Cs ML}ᴉl[[L;[~gJפcJ<'ޮBc StPkCpz߂ јɏSurs/fe)e |ZDn$N P s]7 zwzV&xc Ji`)z zQ&]J#rkZ.v\mc;3Ob\5Ituo?jaXGz/. #lã1t`X((4 =缜<5Ϭ=xSV;~\;'"$ @$dOar}`#S3> OrB?1Ϗ(R)tt|p 1tgVq;_z@*[Z@mzОGH{UaXwHYK2U|&`bк_|4fETk/j~'n0kOWvdrhЙU}e fl)?$!xtHy[Lpy,հ)hqx$a jO DT[P]n[^5i`fW'Clho,Kif/VI)T%VIv0+7h4/3M פI00UѸ2Z_\C |m9PI8J6DG乸bdc %_eO" ڂ?MN<|\!ϾEyk&WL2 ZKT_>3y4ǶۈIxMKSj/ʘOkL噇~ycl $}wE&opu DF룠)pWUk/:V* ) 76ʦyH:KK&[%nΌ{Iy%t-"Za&i[a-t`墯;ntĿ+!9;Vǀ5۬Z>DM1c>KɼFPb[+&铝,Áoǻ["#ݧ Q~PX )AӽBg2FSmo|w9|5о d >Ƭ]4{BE].- S~".ĹGldJE~2jH|EH&)# DeOiT Zλ~`2.5W>7Nqm<,ßQJb>b9wFI<}ݕC"t3} ϳ6f[5KюTs簷F>4T<7*bUpb1yQ^Wk\lcj uX>?0[^5O3`6;236Y?z@~~_W{p YxE vG¡L|Fb%zs;F 2 ɂRRe&ݳ^书Hÿ( J[E#Kfβ7_0@ ƒkMdXo,KC~lLk]8?-؝icuf}+qSJdۋi/1_ hX? BEb؛R6sRꐜ8 G:R2{4ҡ80`eERAQr$ Xy~r4:tccaX^`DTNO5|.%%c;F60E8M*v}%>4oO"$/|;P?C:iV%9Hgi"+SV4'/`0W-2jyxh8dzE `QPSNXa%xLB2WO4!<כS o?4"|i2_ԵU2MTS1RBpՑ_: ey(:- EU]k>Hٿ|f%kScկ0+(it ,n$ *O5\ln/er-:#!$<8z H|P APfϵ^_٠q ZK Zn>`+݈ީo Wk5NA'$[ G_뙡 D?|ϸ8U{:D@FNCdiM+!y?lRGɃ,|ޣDos R 3|̽V%[_͕h00; t+ڭuqp%W Б11ҕͼIJ&^K%pls4Yy@*kRbF| !=iǡj2,⾹I <%oY 9D5f`]#g{3 @.Zuެ:.> ѽK/r %>-FVLL>}1xea*yIS+}\¿_5Pl ˖^Xg qCtXv@=vfEs'e!J6JW8֥7r2p\O̵( 1Jq0\)w3#kFuGA$9IN-B#K浼x[.kDc@TȢbaw kQnhfo6cOë`D̾$| spw%^ e ;nڽiE}c*QgR,=PU!:6h`Nc.Z;ɝNq ԙOp(h Ne@g\-+}Ӫ;տX5MI4'ɵӁsŀ9jŀQ:-<>,tq Xl/x'W[+T^|[Ed ƠYVolɠϔO 0(I0?[O[Z[9@dz3dXý8e!#)/U$(j m&s|?fz FKv /xdA+Rx;8g4j2hyh@BB\9ꭻV]E$yti1v}IO-0,uAOߩ n&Bަc 8e-L-ȈcGzuoX囲ud\WwCV4 atux"T4}@GAFI¬37]M9S#^FQE&т>d|2 rϹ"2㳙Qf GhLc?? DzksHdeBࡺn\nl\|?zP:xzޛj^Jܜ3pdWlGXaRr@*w OwWwA W..}Vd.W H$Z \r'mhs~&@) r*ղD=4M6kνR7Ɩn,A;(4LڻSS s~No81$>ӱ̛-1#fdǀ4IE!ȥSuN]S %ݨpŤp>f8($CbH8NZ]EwesMgޯ2*2,1[o?ڠ_OJ(sFzgkPLE" RQh ؝}|ۙ$xGmނ6a z/^u MM'A>B=RSewdDQ3nxߢ^F]KTf*s6~Z'`m{FQ}tXDBd#\}۪[eP u(U= Ӯ5)Ga %aKp>k޶tgHfFKdS4[* Eh*ya@!޽`ưHq?Mx; ykjzPa3`!|$JuLԪ0SmA3fg#NoP"Rp _;U5DgKO巘._T>Ah!GsCԽpv(=ieX%T?z26Mrh vBdڵY1oe]Tо%yVce hqT_SSz϶q `+J+9{|jb#)X "Jw$"=0V"n)͢l&&*YXr"M.'+ Bw/;bA,'[B4zepqbHkmUrn[5L0OY̋Kуlz7d4%Kґ?csSbNH2(/xM9kYJ(vw g8-^c,oʼ}07jϗNH·bjR E`{ndU iK?`3*R׎cNP"pT@u<"W_EȕbҌNDs׸ ˽{3Q -䤤N k*&n%sv~k %ޠ)kFVK1ȅD~ I0 !;`s'7_tHBkAPl>wS#O2K8o a&)S2Dwwiu \nNrFvAA[9ʷNRCmzz ҧ(ikڻ"*y ߁x ۖ;짴2M:Eē5BWC^!qOs 8RHJx< 0 !j 2Y;|}: :S*W`mXQ7{H=,:?T%!iETW((4v!ϭgZС6^ Ex'tȢOHP`yC ~'ac^3I{N3ڏޝ/ŝJqIc>^=ҕKN@]\28[iM?į^}w|&yk춶#\eʺ`G8X(!"4aZ^"AzEFR-X4 ^DA3/C3J&~?i2`?əp&l3 TZѰ^Pz|f)OI52}\4%Wl;G`4d "L @3?Xߌ0#tخOWFe W6 NzZRhI#S&'(@꫻ʳ;+KCI8<;RRaZGɗXaB/? ҦC;NGj6LskVڄ|Pt+l7:&Z)} ?d{$:aË}O_; ƗN讛(6z3#ztZ L} hl X v #dAUI/T̘~di!Am2IF\ol6-t#k=fBB~Nsa:tuc} L.8d)NDgZ>%>+dOdБcJZVSa6tU*$ 3O4}:*o|i3!'%3|~n4_C  1|t`34mz.,WKJOE t\=gNj 8Re Ml'KDȀ {zkڑ@)UUuWnV7ݔŶX`i@*]L3]u=1j nRPӞïu64¯(PշP˥sꏀƟ ebT_xK(g*M\ͮ4_?(#"kȳ2$Y"qqM~EGZ>[.SW[jJً>@Ye;HEh.c8)EmR#,[(b1UIO<|~6 (C[ @|RXjʌ : >g4dLR|pm(_F:b{~ ,yra]}uߕ3L&*{,9d}GZ=`a(8& =YeUYV*:}@_(!5~w%egVuz0KStܙwhŘ^rXd]l$hXgoW?I^&8fQpqxYәm[+ WjD&q\B{ƲE-r9&ٝ)p`jvVjwTabf,bSRChK6oOڑpne,mZg,扣F8--3V$N?6N 9Jk/^1fJ+rdAtPhtNZi6F4$ǿ547p\dҀ*^D;M;P^$'/];Qi SR/{pۚ˃WMA0ׁE@dT mܡwD73d{9~HUo@5K, u"V!,ʓFMOp!{Pgth</}ͷҢUb3446V%iƈ26exQB8e8Y\p(*v v]# .s%*J:K2|=T%?hQx$bgV.H5k'w#?dH*ܣSE|7*PAO$!b?Uv8EHX@GL6 P^[W^T at^?rסd'$%v~?w8GgwC_jn)O \M4*v)rnE]K"h/([q-N)B).)D^p:RԘNR\S@`[ :Zzbm|"uzJ |M{vS 24Eg` )HVVJmG,[5ߕ]['>ǩU8:p,Qx}ԓ|$˪ȋ@(dwҽTD2~; F Nuv*%FQL,L —oհ ZeqKg,g7XsXJbC_n0a0󳑂k D"Wɬ@(9%sd_Ww V 0|6'#J@11.P` $40 -$ȕ >r8+WU|.[F:ЕDV>xG. *Tu$G=+x&q 5I\p>p|za W4&N,o%1lAt?+ŋy3nƐn+lY|=b_p;EY!ocw.X(ԓy&/|.ǜEy̓Z&esm֑97}%C3h[W'pMb˂.6m*@/M_e_$&.:,ӦYƮӛ_u[""36⫖oOZӐgJ]9&Uf oa $vjVČ .}h9$:ں$Iae=`M4 $3bquy:RFKjgR;Ze$fs5e n* xb ߈]9ۃ &jZ /)7@<A-f>"nwt8ߋEmCR7 *"M 3"̟qo rd=*ꡧW/   )CXh`H$Cf+QG~ˮUykaWMfKu(ã9 m[ֵͪ>OК寳ϞrN&49pQ |a,Ҡ,p[.L礞B+/|l\QQ;X"@pT}G0֭tGz7%Q^~uSs GI )mSC Z!iY^> 1{XըTATuw)W[b)KҔڅex̊ 6f>=FRO_җ0ng>Q%(L9޸$$qzt`Fj"6|U e2& Ґ( wlEtPh=?}FITmti J9i\a ,ZӥsÎ݊*W$D8<<+pSkM33G| Z}b9]\d#(觅/ 17P~׌;L^S\32ۏ!E%qlqM>,. NXb+ˉ (@p_Zʵ;SNV]A `%%sŧCRGĵ`ʢ)ȵ",)-며e ;/gMrxQxNQ{c&=*ت7',No(K@r0&65"cޤsm~-u 6`jEov]hyP_޴ʆ6hԘMz&g;HC #6OLL2;y2_\cUCB)ɤ"fI!jxHYH25U"nbԣd.uU+y, ui!k>4AXpQ0/]iX&P<@xiH7uivl@vE$Vy5f>}ZY;Ǵ5!OeLO"[n☦iEEAp?? J(aRt͈ LU@߿Zݳ'<9E*謮#X=A#٥7^+c@]-_0)҃ѷ74i/o;G~S#;U34(%Œs=>δ5İC5_TS&-bs&p*fvs ~.̱!M: uN\@]QGU oKdf{Kտ,It挟w`r35LuʅН٩piVT'..OѫN3R8lDo\*,@mS3>y6XdCGU0[+ w Cά5ύ+4Y:ړ}v>{d )DM\z3PaWBI/x7EV#Y#  %2n;y;N7G{uybCxυs מJ1<U%2| }7s}ϐQl@j?J zwqYL\x!c}V+ZNdG8-o D^٩*$OfGLT/rh)#@3Th|hʃʱ}hMc+RΠ[צ?!R0-B9*P} lU{ܽBd7 j(# a/Nh0coVD}xlB.= +ᬽ(=_Tȸ$@E+sֶY!#в 7Ϗ|7+6%g[!D-fK LKqgOE%3耾Ĉ1xOȣ0TNĿePC ZXz7ʅ|{jep _aLCm?h|,PHHry>y-/~U&NyU=-QܨFuzG e}Cp[uZO~$n[JOC}x,̟YQB:#_/T+Z,xE#S?r-H۹d1B8Mlt9݉QĔ&FYNǵcH2Bwi+KR!i#8 ;ϣyL _>vסBKr+.-Zb Nmk0:&{W7'zhÌGND߆gtU!(zja5wӦ5eQn '3OC쳴o4ޯk;?@gܧK[ ,Iu?-bEcÛwMh6h7vԵϵIXƵf/3j)9 84w`9ah&]E *%'Bs| ;EuJq霟sP"MpKGE'/CX'ݴ Zݎ}̣㓾 34~UI%h嬂#?c'dzlRw/X>`4(k@CٌB E6 6x>n,R}T`'K[<ݑTkajJ(:J :GpP5ma Pl{﷙XwX2 \h?R3xocͿˎh["|6@u'|=bWjU0+v{PD$jZYד[2-ͅwl#\~>ƟYU~ULҜG>o VyB} Ev-dX:[֔goN:.q"P"V8Pno̪yN< 9#.Zo}Qt -kNk<9ky*s2؁6=uƟe^F2_Τ 7{1#gUbb{,/Z/oOm5 gXJG ѥ~#x+@L^*oII,#2a$t~ dZVW3 &@fY$fka[Kș2!:ɢLE=W֧؛{(Oڻ=kn9 (rTw!\2vڐ Qz-UE+FG>Y4R`B$UFbcZ 9x^mbrC{_=sI<-9 XHjꟳE7LH_uh .}b3F誓Twfɴ|-g!?hْH[NBZúqyFw{a\BJNv5QTl!ύN* +Ϛ肞=V74#ȶY_vdz]dˢ#0Ws1#K|TVxwƑKqщhV9bMy^i)ﶃ]nW7)lFK3YSZ&;3a '`P2Ce8RGjnc}$:BjCtS,P¥iЁO}-*mV HNeDGRK82ザ^$H]{!/Ai-+SuX{Z>Ƣ]RwLH 5I h%y5*f24y-k=6@  UmV5zHCNn*Uc Hkq1C뉁j34JOoߎ:d| ,|\t$z9Ǽlp^%zY]NBl\e*sk>ZYI&o1r뫨ωC'A*h?.!VYy,`H'Ũ%( Zln0/+0 .8SoS7e(|WZl6h&:RKIRy#6k9clɕ(-sc;]ϽwhKcLV9^ ^ o\ @_Kǃv9b*.8hDy;L!k }Ré%4ʛNW˚G>OǨmpkIՒ >) I~⽏9ih$kSN͌5(.+%|~פ~F8y؇\jGFٕqĦg QHlt<0C4qzGE7* ɯ >3hfՑbB#(<0XtȊ_C;UCgj]&,YʙbCS 4^@nRPC+ J_/vzhD\zP Vyxh-gUR7 H'gYB%b,V&`U8l?#7݃qv"L7a <[<[8 QC=JUF́#s"[nȁ\xvgK<Y^Z74hjݬ8.׷G#x?b#^dOקQdB6%hlN:jP&D iϷ1 J*cZř1CFc8i}21zȼa`gKPsLvTg`a EF@iL&^>oMfNx " mj Wb韓µ$,c8L:EH&7!3W}OG Aٹys7BlU=ѮrāZfҤ a6(Gj'!alrry`Y{ ͝P7koȊE-G+s?FQse%Ng "(Bw_d($00op**)SM(yم=e;(7RIЊ}Ʊ7.I4^#Ij8L59Z/$v\_R3Z.x8!<I Vϵ;{2}ٿN݁km|LŐ#0">DQ&9g'A}^ӗhPb,SYŕ|oV[e. sy@)7b=b9b cLQ'Yh-3""N Qi99`["Jp+8e㊂y$^̑kk*%v!4 "25jV/a<"`=oX'CzrO3r?b&P\=̍Ɠ#o߿ȅs*1; c/fQӾJTK{l2+.|EjKAN10sJXH7 z_R!ZOG&ոe`Rrtl]-r咩uuwтL?\YLNl,‘Cw'-^Jp|s9e\C/:tm}ɯVGiG.(:վC',ypI:a"&en4Dc X\;Wb< wh(~jfA.[ثAOe]+xo&)#pL7xqԇp-"n z󢯓oe(I4Ј7}L|'F%vM-,&DK[EEΦxpl+&lIf`aZphmًG!([ʟ(dŵѝ[\fdCg W%w(|d޻K߰Z9$kB ~ d1 |ó,IӉG(s܈—{eO[wv 5{YX6]q|ێ$P8 .Cs%(fҝ SVjp+_E1|;,hcuJx@wmhscJ tKi B{TY]aձYIb5>}Vr6M' (/t`®ܴ9KwV"7!2 Co> WĦ0ŮhVTeZ'b ]&Ykr![94,ņ}̭D [˧'nKxa;53dA@7kB^ҁA;W-= 2Bq8dJjP4 `yɞr1EǍK#D~{N[l cɘI܍Ob>O ? _;˴[d /x` hHu1`oWXyqsOKVes]r (HѓQ 0Dn)243#4VN,|S5*̩!^ umK (0Ȱ nH}%(Q)D%4ʞ k;7Bxgb[S)3G*FkM; !'F &s@ A3[$H nM$"BGFn[x{2/Åj-[kC7-H8nbe 2|T&Af ĈTr)e9pθAYlQ*Z$Z ?wn$i.u{$/34Vm9|+< pH 3鐍f^G!(N|b;'mҩXM=tDaLRI:]ɞu#Z2ğ6Π=2je12 dA_x; lZI cLiJʄҿ5jeI+*9 9 Snʪ2 hZU)+Ze@f 98v];[<]ZJuĝ qb qD$Q~~ ĞTwAcE]k LTV"h7!8V zIۈt N[^7ϟf&~LtȩoB&/&=fKcʺ̽*s a-~jFw׮ױUK:JDBfU=x U$ϐO%Cm&0E-)&My&y}өrDW_4>Woy?lTlO>mw}AJaLAߙ{1jgl6Cc:j?FR#2 au$rwF΢x9tsU:4vNPqj'H2k0\O@H`)^"̨lݍ뇩(f2B}_)7~}GrG2j6I %_*˩E;[.'ÛJ}$ӫ3Ao W@9bo㧕LzrѮ'%]j<-}`59Ȯ}au~l;kE ,jrB} {/A裨 4wC/g χ?h{K& To:t"}tI&sC`8:Ic+l6*QNbYho7? z?1ˣD侖u5[SC j*&ȉ4@ch,?0bW$Up!(](@x^ƹߓR%TIx XG.Z/у@.i2+z_!1t6yDt%>F{Dso*m#pss|8=N.DWWW^138m niĴPl&' tm;n8bl{E g m dմ?|G =+j|+c{ECZ:"ma睬T%$) mؑ})rX j|&X/Q FwFh&}$m+b3t OOuae]Q MTx̻"{ZwT-*r.D=i;2L ,'係 w^n^[n @(ѡNcfY0I&`5 WlTe+#Ny A *Vi&0O]2mĞN(^N,f& Rj(L)ّ?Wtf#K:/7/I7SAPeQKh;[%C6b8ſ9^W#-,,XVr&+:ypFS4Ak6uIR ^,Nswڀ[mԯvo{+0Q6̛ ?7%W񁈤\yԩwFG9 U`UuŰo{Dg3biT "Y|#\4aLXı]+$?;&4CO7Պ`vr|ȻF RuAL晛`,NvҷPVm`9tD|mm_ p^3@dz[ߎz/ L0b,Sᰋ+0Qϫ2):xy=70SѦ_ l SM2 Cq"οV}I93zYo?vpUgg3UmG0Ӂ9meW5WVX~mug)v [tiDo*Qo/%$ѫ喜hJqP+;W}B{߄2w>2rly.|Q_HcF#ݕ<20oh[u〠n[X49 <Íz/93se)A5ⶂG ,`?ǚخ`]w7?D|+yngDϣ9) &\aqC/+oZ86{S`2(cn#H຃}6nTЖ&tͧD}YUFqxqH~{Ԝ ,CIv})C:^Wbg}Rhҥ%fjgd7hѐ_%t0h4T:JUCvS'eS."rm&ՊPeZ>V3]ﯼ ⁏?|Y7{^|s+<dYxk"4A #RoQNP^$+9괃ٵfsNٯ~3$vwI?U%v*6lYqG^'z oⲂg)r6m7'_I9)H0:؛iǹiel_%n3'LzFL;*fϋxx ;f⥼ `:Y! [g!G׮!+۩ I5y!~0"{_?)S fl\fמ~620]'q>'xN?u޷_9vC0 8VgKf-7e@Vvj8R:@L{|q87#08mvC30EL~ p؏uJHA49V=PZ.eA-կU]*[!mS#1*O}m{$F^S]3QjWt(q4oQIs^R}988gCF+{>Z춵 01 PR vl`*I|Oÿj=ӇȲe5c(~?GstԿSOөf? o@I7!]F.g=ǖ5yX:;֢O+e l rŎ95r(>9WVc>&/ZD&2+y9$6nɾrk"|K3/E@N<9=)Tf6_ԛoĿibw:e`5?kFљS=j1vo, F(KC+U^z}2%КqY.Pkqr옉(K'֡kP/e7]y+嵌r׿c,硓 O}ȎĚz ~9g]w=::!Kh>vG pDz5e;4[$L"o. qu& ,ҬT"*ꥈN3P3VmsU3`dWlO j!r}'U=^//%i|@jqroCt 4:ZCrh+=[,Yi&}V&W< C!6K>L乎Vlb^2=RJM}Cb]վQӱL_靖wS{ss{\Jݍ۝jpCx,&x BErz=WZɏߊ yy2d#1ʓDO0\Q!+' tsѸJbc{n΂MRxqEt(WF{LUrFvژaX |Ea8. AAo~12#{zۓłf8@4)Nu Ԧ@i,#-nwL v@J!wmȶ;V= Edb7"yYyCC':aoa\fxZllyJ"_ ܈  \O1F҉>E@~mD*K[H*Uh)MdItNN&rΎ.~)^Z%@VLKcu k{BKe mKʐϵeJ1C:>F@R@o;`d݊k)Y tkx_ͽ%{R0T5srB%rf`r=F5+xā6Fg ^DKQxFzU)̢>&pɹ<0X3=աG n #]ra/.z,_X`&{}hY&#f_F}Z $zߴ|Je#al&e#+{Byދ'Z(+r!8I6Zv?ڠa7c9`AlksFɲ Zl9JmX6͍kT1^&[{t3+K,(+#HTʭI)K"Q\vxIw_3I=]&5oyF}ڷʹ 2u`x~>|q,y,m \ ,6ȅHY]" [Tit#UGmMull >:  gܚC2`6:-\O%8@U `c9N,ŊS B,8`pc%qk0u2YMOyz()(-,W8..ǁ*2Z سɛ3m8PFy~y[pR-saF^ eԞN PۅejDJzj4Yq.JC{Lֵp *^V'dpFfkRnP|o^ Y*rIJUk+>ʓ`ݎܓI <{㄀R9{LM^ R N <(ˁ!&w%]8!z<ƫ$X!4]ٗtϹuބ M~ 58m؁6KPoDc^n^sMӴ k[ek-l nROz,x0>"űUo5 -7.PA #ٱ/oЏX)!K^|=# /ABك5Ƌx/-oʼnW:7mkSn(Q !~1Dchw* \*EvY'eE;q[׫!A8='`-Dҭ#ɲ4~9:(/;b5uq-4m?BYI,::Pt^ 0|url@/Ar&ܯO#(C&ҩ۾QSYQPA|ÿfygfgy8I-}:Uȍymwʄv+.6疮3cw8>izKEx΍ i|{wf4Ϙ12 I8]*e-A 9Xa&Eɚ̆qfR̬|KdmgӁ&ߛF>]]7=ijD_|/WuLag l2SdK@3OR=a r|_3̨ b?7IC0ܾzf=5P*i4tD[z``!\{)iȈRԋa =2*IqE)-F -(T^@>vn/Ť eڶ `rf,(_c0V-S-\EY [t!%12(;"ne:$CZ,~x5' +ͩ;ntFd^f2%12 C#1Ռ=SOl-{!_s lv_* 聹7A.9K7'ʖ ,%u#y'۫_{M`٢I)T#.}~>G5 K2~֗+YXτ]К}͝@ĥJA䯅㙢r$;2D $ ,SjM5 'Q_5+,Jb#bZ:9P|*ty% ;9gG %^yqK%͋3?!G%kYg; 92@6A)aHS:^?_-3%c1Q~X!4|礷xbj–7( A;.Z.Wl;$ du.<jdK+Q{7#GЏe#cfnxN&p$?0!G6\ t[Pxǿ 2`2Pu+fĮ @I5!<;E6̿'ɛ c/EVM3R'G@E_zMz [! wc&ղsONPܲš1 VLeLc߹QIYHmzu'~z'gܣc#X7}] gBY*K"v+c TZ:37Oƺ8*pQJZ0%7g:=.oD:~KK/4*T÷?兮 "@*35JR)9\LS@ u^ :InDs,%~F=u# Hŋɀ%cjtaBAhɇ @)*̠;}io+S5#v ag*[pƂ2 ?uJ9z\Ч>,Z(Igw2l_}{k-w^Aŧ}:23.2~%S=x2[h5zEO4LH)-b(> BjuU_"иV@ٞ ' ޝ\N*ŽxǸ MMi 󅟓Ԭ/Zg5DyK$кG;`=g-82T;:Ʊjڔ D\4W2#߬j**w;'VL|21Hţ=8*Y nWǀCF`#5Q\wjnl;ʥ=KgF$lGC 6JPI"`S e F\X\'V0^Vɫʖr%H|tZx䉤0Hxc%m[T*Jcg g j%83b=c\=o:539rM!8 = dh1]/K]bH+o2)W߽+S~j1k~l %"uQ; R)zy4T A1XtNlNN:A>D7l<5peNPGJ3~RJ- D6Ig^į_y'B)uy(~jQyc×67-ќbk ]s1 "4my8u)&i/{2TvEk>*_8yX(dVP?WdsxX#sΉ8s] @XW> $9'^vU QG]/!+`S@>^=axwd `NRLxX2K 9eE&Ir(58U$%L}QСZ-yqX&YxI^K⩝ TݞϷN-NR2@2TOifPzo9&n5S4 PF_>0׶ԣS_W"}.gCWT}9rj5M]9#cD48O03/0c2QTb׸=ù onJM4¤6懴9lRd#Qz4Th~AUk1sتrz\1Ut؟rwJӗ+.gy)>Ȯz6s%ʾwϕ97Eik~G{Ir}sclǫhBfU<!R X eKl>12P5Ӱ7FSmm fե^pA$d*U7Ұ^,z(q1MS3d7X<"XLěo8.Z8f\Xvkḏ DYd?QTvºEzd}\S, 2i4/g`/@3{P#Z`P/MwٔTLBgn\KLRDlvt1_ dx^Fj5x9UHd1뾑 a< NhѰS[;D c@_ {i |-(BNHAgPm7QM7= EI6_NDZ4][ޠ&ݾUg1+M Բ!օr:^i-8%)a"n^=9wYPm RrjgWȘ l%qfySkWYU>Z8,OTV+-c[CR#1Jړ8EzCZgځVo ?(}p׊P"&BL =V6GCnȻǫz/bi\)`j 1c|toFpװJL܆i)TN'Г>Lf0/J,hwO\xogZ q-Ƀ"8~i`]?=Ut,6 _wͻ\8!&gaqJh~WBE$2?ԓ=ŲD(r0eP0mK髖ww<94A܅;LE]c[f[5HJ:}>B6"c4P~BjnF?IJAx fJjkeqIiES : R[%C1(>Z^p(A],>Ұe;Sml7r.Y+'1yMYhL3"$G']NBkdwX XCXkNhx%,I_wuV*\Q֑ (B{BV Y'n`u%֗=-|F5S?>g$sNmE-T`Y13BȤ"+Ic>!wk>ǒ*a 7ԝ4%l~3,nŠti"T <ѯ=}3*U\Gf07%jlY$8a&7pIJpF5K;:uJr!|kE{*XJ.G';{zJASJ OqΔ)to>))/166(k5& 1`^J!7O=}8h`&N0F[!h465(ee c9"CO1r+-w:SD7t:T6jW(qUe&6A?|>w h9`ƳBI/x{#^VdA[*P(^{CZkgBh{Ѽ\h\km+dբ rK=YE40gtKӛɲto诎na{W$cF7}sr0 "\~D%67[?dV4'<(ԃ+ ~jawZ@KO W\oԔvNwe!Y2ΦH6yK;I_y_$XI, ޮ;)Rc67KH"(W:hБ#Y/ k p`7d~OXޤ7 +(H=:WVˍc# 1EF(MoGut4S )B|I08-s`>vRe"joH8P4O- C2+]ԯ'yN)ӝ7Һ{OmdczÎMKFGl O\ RVQVit_-Ǟ@DA<;Pv}V$hɠ8Ƨ[pHez5\NJ+*2F&r_gGPՀ|!dH/IV:Ϲ"Ds-{cP$[Ѫi3JaD)iA§Dm(knWykA>Mq(JV=,+8|ȁ`;52Η }l*82 A\4|I0O\VBv}#CΒ\lwv?M @jaW)k*8 WqP8u<.A5]u@;C?&^ux׭fVk h>ԇNthT&d p)X3 @f=`f1Q{$^U'@bA 5LFʛ fRRI7a q]b,AmPB}_A%ll0=b5LZ#Z$ٵx8SQ14Ӻ=/tNN{Cxo!? l9nZ%Iݦsu wg8WDEX<:V m -Ӄګ뜜IDO<QZ w)$$i+a Sd6|4Uy5iWнz?ZOw,\]C//L!Sd[$ Oc}7IFP3& ]b x>OIL͆Ebb"``o7 %k)d,JO<9ѬZ4[F3(yHJo."Z'TC؛YK afvEQV楥~ Jwhx A7zZrپ`;@"3g7k$0&5iv0\j*aL7oq&ؘELHA'.ankqS9(Cp3\=!'ȼT=u'[&v]ͮd]&@Z@RJ2Fɮh8f,3b6B+%$. :69='Fz _gy#j OmeGk#LC$[!{^ mubLw y pӾ9m xV'37wn!G0/ҏV7̆{Ks6xn >1L&tp/Њ<T$mXy"_^$B]&."4pO̊J+niDlb12/3>ɃT df(D1ܺJjQ@L ۗUtHsxODp呥߄*^GfMBvh.[5Ci՛:,|c/vK8fC,7V@(1z{c@x:A4Gf#mX̎EJ7Of[gUD5grXKda8nmVVn*(J%gSC%-Ϡ:xAkTv|+NoJ!cUAjrOϽ˟=#Q~Hs$8|1F]˵?o5Že?}$SD`+S,CU9ƦG֓Ynq_xwQX&p+Dꉓ_CxvE# EtG)˲NJ }ia &Fʠ'Wuv-(4-s&DbT/Phr8T_(WfzӍdE_i]TYX>浟?1?xv v]+D:ծwGRpx(K3گFQTػG2sC'((z\4om47y>"!Ô(獓i(oSvŶH߆ykMO'p𻟃ӭn&E!AqyJ?ohOtp?Nw,.ϙq}٦ ҏD,@"gcoVmq3WƟ+Ʌ`J exڷR5cRLJ|o" 4j,!8Dc\Acx;W1@nbmR<9)<S/+{bBW [u6rEm)%yvW㸾.׉_JH*ȿItzfŽԝzCk{?uqmL+ )9:vfL\V Ȯu@?DǎS!cgF;&qsk J x F/]"~):yҚ%&35V.U˱ !'EjzsNJj1g8{;An̩A&Up~:-ch&p᪙ȵIJ2]*z{ ^?go)P4aTdZޜ"gG;*nweȋI\`,M5fy\z,õ 9GEUW9tUB_{ӣXBC1[xSP7\T ~qXOiC(O>͉qe0u7MGÔ$k‰v`=ô.a>ٿA8ҥ* H*nkdT26f(&MqM~kzoم:P_Єjt/شQ5Z;@7QPۖgl y)ߦ08O."a^PFd/M\4 kd8;Î#'h q5GUK[d,]2kk(m18$ku wǿ~OdЊVUvu4V4BVg~术vĦʕ@1!j}* z͘= S`=.Jųn{2閲E'iSuUT#~JA7c$0dyHIBUY!5)gwD]?R/RSRq&;U٭FaM o40mb(F"Y0rki?w1s::bi ;#!%[#[ڏ4x${!Pʧ^R(5irIRkvߺfNOxFx(X)RH8#>!ā4 }Ȓj_b]`<>qX&tػHV{!RF\%z &Uvr@3( a(,6}o唩rv-]#VY3ml'_ T14VR=8¬e>^zxg1H?>Q;f*0+<9OIV FMiM1sP@;,Y⯍_Ό> ITU.<8tWGcL&#Z2?`rU+0Mw3Kˡb<ɱW.}W0ز)rI94:SW}a~| \E9W,n篜 \8¤jq}t[  Sody+@6,xSE彾{o&lfUd<RՈUSث#ӊI<7dd:\" -3 Զ9]}WFRԂIƔ|V>[I, å[i:3fb6ûeHT_ 30ZM{=Oi+4ZM-5 H' ,}TrRQK v{\ʼn .NVGϕw5:DF1=xME%TRr`d&&Ʌ*EZ-T;D=ʳUPxBDD )9.ub-c۷8I}1ԉ.VJmn;UUEhVo͜Xߞ+x/!1Z3VfQN'ڥ M!Z4ll@<*P#"ɪmy$9CBPh `D{MvFoF)\孊ϳ"|}CG~.b:}܅P]:u܉j!kN)7fyyj(*:i!ksVD7|ԣl@W]$q͇,+O({ JYLBe\uV1~j-<{iFx) LmҮN+9$γ 1lAߋ[ߘXRw>_dJ3ץEʔ#ϰlA˅I,*E\Ҩfձ2xbe8č ;8I/>oS.UpMS3F㺯C&m뇕Ze!~bmp=񔰙TP|\[n"L/"?Y$WO4OcIT/XM1N]`iXMKs^7i{ smG5^{ʵV*^Zkf>*tpp (ee0k:qk\?t׈Q=87,àAX*@l6CfE&0'34cvy c=*?V Sk9HCAF<#?xXB.Wq3 W Lhc%{#zdt ryxce;(.`kݫ,L/ɮTI t߉A8]ݍ'-<(Hd,Cړyo(iO;MP6}*31B;t2ToŒh]Ny0}aMεq^h}vT}F2[0jI-^)P9̳2}w۴eI.,߬ ޓ+WMgT4sҏ]w8ws4ꓥfTCCD }A#0erOݨ7rWm8o+paM#+ ( nd/PYϸRz9pMkirl.=tze#] p1V3~鳙(G1AzڐW{0v-J𤤩]>Q[f5,&ǭMY=9,&}%HaA^i0t;ޅtOI~_%+R{9@ʭ+e,G\hEY7pĺqp[.np =TtFW85 ̒OZSW[MnrNFy5ZRV, 8+N X&H ,yWF_B;m!d}uRk z-_zBһ7P~ܶğwf9D"G"e7Cܲ"s0TB(Ҝu=e9K[_L1#rʗK3HLJ`Q%.a+$՚'Y4S{5}f7񑛛g|[IL֎_}怕3WiJ _i ;1 i>0@񲋬`_;ʮ8ȌGP,z־8% T8ZC3LW@ ~᫽6V'_[P8 yNh'O:&}ً1l; M$kѾI l?4ɽd)R Qnj.BH] x|ȈXkLoi+%9Qs'o5PBA[MhU)B1Y'rpLeCճ'(W vލvp``~@ᳱϵ=..;Esz7 ̭WX䊴: ތV:^<>2?MXLveyunLt5+%i6ew%߷e4/S=Veր&|+F~U"]);cl?߅m MϺ!{YRX5keNw :ɨ~M֧J=En3e <(@V|nF6.e㑫:5ύ[vGBhUh{=#Mtcw>lʝޏ5 M8qwvK&% ɩ_`T?Η('r4OD=;V (K#]"U0A)೫Xj&}v 8 ZLJ >6$f8}_6-Z9z^ߚ^.r#WKW65͞}x0$ZX>TϜH7/ B`lje()lS}`(#treg\ɣ~t;mr2E[ۊ\|4ucn|5& -E00")uh/6N8?uefqLJml/-ϨF1!nY4:A70;7^%uSj0Sۃ  kiέRT |<_yG`(DA_Kǹq&H4"CK[|#9!^V@b*zpwJ@DXŽoqVu3~"cP}VȀVU $ʤ^~İVS؝G8b9zb{Ww$82~݊mÌփ)z[y[},O"],Pzl9ڪΤ%–d ڤ5z(7 uTDJnzvllW?(wOU>mk/D }X\4l?XS4 ?EöZn|`pɚ4 Xg!p$48 x݆$A7εհq) w}ܗgo|}So q|N [5u7}>ƒUAfr3AGƇ}pkYJC\m!rsd6"-Cڈ}ycn=Dqv" Ni⡧X !Pz(IEB,?i ^ Q5)>k%L4 jPу\ov| -pS{>Oq 6:?ѭm[P#+ &ka*˦r̗%;⬑|z*Tr ,ΙW}C/J:zqC?ke,𚫮?@ 02r[MD3"*硠֕ 7z*r_6uL][ {_a# :}g.1|tcVk1pp$nr>yea@;Q!Kg[A]OvcuJ$ !DC^-D nRΞ_iG`~jh'}DI(5׀SwT iOIԏTTVV_sj$^ᒾ@WP(w1av)g!~4V GB85p4W)2o}LqgxQអϸ\6E' X"=R rr/K\=pxzȽ+Q$}A Aơn*؛HY}/7Occ~p!y+nwK7e|NMhbh?]@iPhgȻ]uC6#EQi11kZw eBmpbA>`NDkQI[O ,VrD.2!3SڒDL#f/7Û3oA ˸Qz/6ONuTt:ڭ`!T S{ ou}`_d0 }0严vՐVhYíkvnH D)L'KAye$\<J"͋Ȅ#SgPLК@4j:f~jug%B]/tY0^ZBEJҮlo+ܞv!{\ O$jgf뮌˳ӳ;]eX.ŘSd}p-y0t);s21xH4r-MТ_8{4M巰hӎKԦ1))j v6Gr0/lꜙ @y"l}4\H@}{3{N9̋xT-=/z{xd8PrPN*|@V#~4W%`齟WKRC|r.M-.fk{lY 8Ū %{Ia>:D cϷ1 &M/j&t//m@ 0:AiV-.ؕtIq͗,_:@68/ 'C ѱXPnae E;]H!&HaN!,:)J)KP{HBFhp˯ Nhޤ,_w2J];Q҇DǰbV ڂ'!~xBǜR7z\D&;9Ak|NVVEE1GEoB|t4r5=XO ?LS8;^5Z3HM' ap9fb! W(;Җ?0$^S&V__,.%S"YFѮG@n\ڃ{`HjB+>4R =12'?.҇w?:[g izgOvZ]!Լa] B&&+xpAt"j ^=#\޿Z52qXps`0Cr)uߍGbCÙPS:,XŌ~3;ݒ clG< -dLi/Q^`-ݹ[2;%b =`RZ=$ŋ yBoi۹ .`J@y" RpQMwBu-TdHG>+~k[X&OFɁ_QQF {뛕|^a~Fj GZM/k1K152 g:;ܢq]}2Q~=\='w "%vyϭuY7aG GnYHŠU/ylMcBm0!:gGoqd78۳V's["'A$ʅ,37¶ԴDdkYҮ9NgB]~,P(o?jVڦs4 elOgeHŭzCR6^FU&@Oʉr3kD#U(1(a"U U?Nc4s>ӎxxZIfF,p' rs^O20If>$Lure> 5kG,{=^[QuڶoK s ->*Hc HJ:9]%zPv6J%,d2SW\t4GP ^*aHe*ۙf%t?.+ߐ; 4C ڬ8 G"Eguf.Nʪh-`,<5ʷ̣%Cdq~Kp!/ٶe{S VC"*/uLBU?scvW+~0yu= ,f`sdpE7zSx~)Ԅ ~VdfY:Vٝn ( 'w4a,#G@V#߲ƍLO{0)M8FpP$i?A- iz&۟.iN 9yXzUș*w*}VfO2J.\Hul u&nje#<ΠH{dǒա3$q#13mQ-"$pc"#ف˴(c&qjIGÇܦy .Ϛ==cJFr<8JFxZ yY Cx'd& IE2FR)a6A#OuIWbxndeWGdW YP1+v ,uZ?W0  饲1D NMctSԜ~ibY!u㮸`ϑ{r˸v48;);vtOצgev;1 h)@ՇjC;|NLydD-Hef@tenpֱ3WHgNj#Jif}`>}Sri'KjՌ#8qQ!KM&֌g-b`="Vr),jsmXݾ;6dbk,RvD_wnN>w465h*I,k}r;hpA f˹@y5F+ yr=} <! 5WdTNhؼ"D z8߁@F, Asܗ.ٲF¸GD2N""i}忖NBnTEN?,Y\⽴.8W1Th¯u3\ A!O̾%Zq_iG&cZ<) Do։a [ڷGV*Xk-GJ(K<ӯ(oY{Wq^T]AuI_⃪/ 18pQX"E[@DkHQ:׮s#⌁B Hv:.H漥+W>lx!s%ܴ("$Dn=&Mob%hcEMr]Z];R6tZ@q*IulaP8JRuyAJ'KN i͘60SFQaE^Q휦 7V()^(7v6J'D 0cd/ba(Pt *2LjVWύ7xfkiU0c#TUUWDd1TCv)@+iNxn .^W7[)} K5IfbnWZxA VQ1>9} ]wyDAeY{eKTPTq19ӓXދW2{vaD3o)-MGmF w:NwSOvǝubuV1.vpm5`e6G:M!Cj\\R E+gLV5 DleTHĔnUdF.$JgdS&A|rl%'R uİG$k6i|E?I4>Ŭ-ZT?DD^!W+N/M@$*B_DB#=~ҝUaR+(f+Y*,Է*+b(AK4&WGaJS7.2GWb}w qmќ ecX8mGCV7DE_b̙*y+ xd\k$U؆CMv)9x]ȒpD~\uZY!I*G` {İY%M49W3aݥ2ׄ|) A{-童_o\D CA>9#X 9ڗj`GqdR|Mt3q7G`=o`-[t;rpa>\֢&gQDϩ䍠e)j0-ɻ |3) o=V{rWBXM>Ըx/ǰ,saGwNz^Y{HNX,!xKӼaj3l4߷iUgm-4mK oe_6e߰Ă{(\W/vi8HIC^ъD@oBN\)?31f@6% :9h簾[ c>2k:.'5s\[WNNVMPK^T=x.Ts%%e7 0L/ ,S/ 5w]T+ْ*/Nl*bR@&*/aN3DlOjOAG) f@y'zoؙJQ5cbaQV1OADR[ YI2z[ܞjz&;GlWL Jqm[f^(xOY;Ļ.H$e}tT,_{pI 2hB59bC4+Is!.cd%d|97~n3MjR<Y6{I8PHQ~}LuL;3(! ҃}<*{L*a\JKr^M:oxsm fi˚k{,$-=a鈻ya:~]TzהA^W6di F`8C2EKMRaH@_-VQo)e(x#9= i4fn^q]gD$7C. "8iJaS(a}MHOݿwuf9mAm`:ON#%0&wGKe0R7-;|Y|e*;c+{/i[(sxcr/Ćb2vlJR<`oߑ1ՐƮ[d/[(Hi4L{3iݥ2|PMìBHABw(}V7ƭ}Ա2׳5qUD:7WL|--q܇9Ai2u$WV0bG*")SP20C6niF2_Emz4mczssM2?w,Se$Rb}~a"\$=ŎƐV,51cEϒ;:QD1Ny#u'DmˍOvR),n!rƬxCWwnu +w)vPO,i_tV]9,F}&D"xqvŜz0Rz%lE3>*F_DCaWѹ o( O;IGv@SsRh+Dc={ Z#II&P:'F2 Ez-? Us6#iArY&V~n@ڻ7\YC)w?QD͠8׏((! %lk- &+-2 fc@V=4P9}OpV]">G_ږCQ9xjү2-7_dw L*fʀ܎U=Yl A@ѱz;=IiY|gL{yp 7'ʏc7<"ᡛ[^:"<7Ԗz8Gۦ+Jϣ͎`b/f/,ѩU]ɉ·x(G l ^-c4mxA%xQO\**@RU"O\G[%/g%yOzgvc|yY~Zv{ *)2^6&/?;`)"3{x/sw 4yTnӘKQA~$$ e_2xiC4 (U@{ mܭkt4x/(Gkx(S"XԱECn;$Ա i3=Iը:ZxZ?C)/% ,Ⱦ߆x S-"ۡʏ*Xa'D3xc=_TڑpH-2q"Հ"8;ES#y|nY= (s]dq{;Ǘ5M5p t8<wjl>*ZFĩfi`"-1C$ZQm#N3 PE.ߋ*F qH[^)'x\lQ)Ӑ$ ֖62rhqnn^5^dVId5*0DM?ta9[fR [10 cN;nFW=_[t'} |0T~|Nq s]3Q5V)Va`Gd]3E[,*>`*t5]L[%72 qLy ,JTJt%S=fӸ 릾Ͷ,h>#;{*ϒ@+IK8E?`='=f%V:jwY7,^: }a-8zq!jQ8Džzޛ+f>Zp6FuJ9Bp=+~׃ mB!/s[DLN6<ӊ*m/9 U)Of WZa' 'ׁxWT80h?ckQwYLjÜۅcIԩp6σ ++p`r Y#)F Y66IPuldrJ:,cY]㌜Z_^zTzғM`Lr&]+.‚iQmc9Y0TPkAk)BS .7ȽQf" fḔ"lF "cjK,KEhc-ƭ[yZR"p.:oRgR 'O=+G߇ىoG/y)J8?SO(Y?ՙ}.xd.=KjAciCj"NA|d\ oKiڔ7 hFa7U(Tjb$Qր=ԪZmS?>t{8^@dܯq4T@跾OdZ0$ =;y9IM^mlbj=M9x*f2C'G8g%5%B7Sܭ_/ۤ7|+ ЮZ}lFDұJQo-HVs5w6&լlhXU 01-T+o-$ZYڟ`OyG*1Ղ˻xr˖͍ ]<%4A1sk~@ȡ-C )̄lf}dq;ATt@l89Rȟ\zYA{妄[gNONdVubS-ܽY iڀA-JbB"z_ S=KUjqFےn-!DY^h.  Iv?II*ui J7jpg_M?3Q!,WZxDZ]T;C&DΫ9'pHfC,"7L )'ڨ< I/>Xprh15x5efg.|5]xZQef_gP5]tCgi)<9>wUۺf ĵ*c5b=M'yԈ9$0z/m?k3p-H8aM6% U#K/,6o Hn%PbcOI8Mؿ)?kjv Õ;u ^{pW,171ٞCwݯHU c{ vXL!.+*Dߘjjʙ@OaLT2G'bT(R >5"w;pT! -o[O=|$40:El,bэ(Tc(QL[:AMi۱j_ہ̛LOgl!1 C(Q{s|3bC+խ0SSuHGv+=~5SP h1M~8u1 H6o;$I6;»!vjPB; 9f(k79PTsfԲ`w%Ҡ$uL\SmVnG,ڻ\a#PZ@$vXiڢ#W<J?1)~kJO\_[ e!`QM ofHQxX ˾4>Gx{XY ߓGgHQ)!Ep KOx*T<=44kaH{} _SD.:!bqm5FswjN&05Aoe^N3mx 4sm%4 oKWћz =r)'n 0ߔ`gģ΄/xQ4ޅY$kp1D.AIZsבּXC/w+F|u٤bxǑ;%] R+S6T* ]Y_z*lLS?2@M<Ύ OmI8cc/M&juTVaRڡ&NkoPÒڋ-^1[_w2 gנטP\̎itvͣp_17^پPPOd&W?~CL޲Lpu/4 \/a O"+OP.OX=ichDRͽpZТ:WP,H2gcu/*mY%4rɶQj|)7Nי)isP SDy&}AI0"c\ӳSӉW~-]M mR#<X?#H`t8\]T D.dnGq/G7q?qG.W41ܔh5I1S 8|8"1֗]'(Q09@ ܇}oE1+сӣmJ_.І>ylT/>FyJ0c2RvGOP.}~iFOٱVgJ7TgDk^YgcGm' [iVNz<($>H? V z:q2 UЁI\p]%͸#M8{bGA";_ ^9JlB&6W밅5,y_L_}-jl $DTjՖ~նviz*jko6رcںgF_<_@hx;1 1.=]8j&DNaa^-#hʬ`mރ9F\GP{M9؜:!DP\HHe톾t"g],&y%3W5dqc#"8 ސ_B dSDpf@P 8+L 6;B ;73Wl1մ^%9v?I; vX![+c)MO$jO='\sSv5(G5]طluӢ\YRd@ ;>Har_WtsvAW(YbR\ǥ.=9};-B8X%X} }W2UcnSxrzʉ,oeVE^[YN8L^g &;奪?{2ɚYN"*ё͚kzk.k|i2.'B-Ge `2W]sp9 }}`h',61!}Ҋ0_X9UuzL ҝ-k'^N9KZ&% d|ګ~-r{6!;{AauYک՝W{icװA@gW* 2etMS8cc!l<^бaL>L:X {k̐~M]oX+6pOư_g'.b'~ 0~nGNV`>O+YACY|HtZ87BA!|oQc[|('Ge@:(?, =RW zXM\S1~9ܙ~`:ߞ/W ~*d# KؠiڽVF8y^B\v!#b1!B&j49(%&%;x]3J]ԅ Et ?:%iE%{p9 . 0vUBY̴4G ~8{|k @d;p/ew6@-—FidHX (΋Z#˙#D#B DM/L Rn][ }]xǵr!5Umhy>;΄ T[T\2\Yͤ_ +)Z'~emM cXGzKQ_v.uR~墑.fl3@PI3f2"5>C-8;K&P9249=/?F%"~%q|ʖIh1; RڅlB\1iC,\gya:mmhHse2MQ< qۖAsg[݅!.:ʅf-{)߫U+dDKZt#AhT?t!跘9CUtzT 엱KK- Sޫ!=|&wAԾV{RJk5+Se߁Xdbl&(==8I] $2hh,I"ٻ["]Go1B^(Ξa JBuyc_m}mI2ә˘ Sfu+ { 䕅wV L4aqh*Y oxҢn"|Gj!P1w@ЗdZc5YJ?;megٿ$|pLV(Ny]]zjLzKqt~̰PBo*J輆bGаPBK B;+h3W.J% Lz~=ȨTd|-$$nwMu&F9F^\nzZn%|ĶyPFUQ@ͪڮIĹ`持*g:X$GoޝQUXJS͎,o9)jl4>'X|})T'Am뢴Z]qr"6*Vpwθ~:_eHL۽ɠl骙#(?~rMjVZšmeUG/綇( CL' qҠ*ǝd3f*iLH9FM ]x2@ c \rEqP.[fG6=ⱚ 𡇾\"=W[E$; bz_ׁT&/*J8HV4}n"HԆ]Xh^ ^5GM@MaK"'yS5LTjn5q{"mT U0\S*ڬJRe@>w#TxXX{abm1hfSϺJ9j)@>nLx5/h.zT3OK  2`?ECʯF-M<_)fd֤\M$=hVp$t c|_ߣmЎA#d Q"@E#k3j*+bev_n WOi8 y L1T7yO( OdxK#*vI*QMUKq #j|i0NHӲB\?/R98ԳhLo!Ëinq!tf"宆P9>6HmUruHn%׽nAS޹X+'T]?2!ݲk 쭺3x'X}C<+Lp ~[=kwCfoZ1D~f<0Nl0'LEe#2iABJAn#'[kA_/GyލTw/D$ p0>K.*`BzL韕+fp>tBE+\rX%zɔ55\5ڔ1Wo]NdҰջfS{l}J3y#cBAyGϊ ;ҏ"pI>.Ush!̟HA+!x|y֚5''?mϐ>Ҋ?p\ jKRPFYCqb^=>؝Y~%D_FY~Sk5:],q^,o03m"Ȥ}gqܱRN]i YZ