samba-winbind-4.15.13+git.691.3d3cea0641-150400.3.31.1 >  A eڏp9|RSfKG 28\ȹj ;#IL]XFT.z8 3-`l C:"sx7`Ϛ"^W8_?5YYoS4MPz DG @Egꔎj<+V'ߚ#IaxU|IakcmRƶݕvk8J6` g 0U!q)MPHNrg4?c)h^E:Պ+M/#a5% o a{p4q5'c0a41d3795daac1ac681a69df7719a1cc446bbe4e10e3757b65496d7eed7695e52c2d75cd8ddd9d95b4a30efba8f62e9e00b3894 eڏp9|%+ .<q< Kj]lU?]d flW1s\Esm'q/;iΖp XQj1ޠ/_kz*a2xVd >^ϳ nJԸ] |XXpxɹ&V[p Kdջ!(d9SYW"bmMx ZQ&ϊ}+ѯ=drĖ/~ڭ>pLv?vd+ 9 Q .4:,/\ ~    T8|D8(9899>$:P=iH>iP?iX@i`BihFi|GiHiIjXj,Yj<Zj[j\j]k^lbm<cmdneenjfnmlnounvn wqxr<yrzuuuv v(v8v>vCsamba-winbind4.15.13+git.691.3d3cea0641150400.3.31.1Winbind Daemon and ToolThis is the winbind-daemon and the wbinfo-tool.e;s390zl37|SUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxs390x# we need this group for squid (ntlmauth) # read access to /var/lib/samba/winbindd_privileged getent group winbind >/dev/null || groupadd -r winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in winbind.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi/sbin/ldconfig if test ${1:-0} -eq 1; then ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-down.d/55-samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-up.d/55-samba-winbindd else for if_case in if-down.d if-up.d; do test -h /etc/sysconfig/network/${if_case}/samba-winbindd || \ continue rm -f /etc/sysconfig/network/${if_case}/samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/${if_case}/55-samba-winbindd done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in winbind.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] && /usr/bin/systemd-tmpfiles --create samba.conf || : PNAME=samba SUBPNAME=-winbind SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable winbind.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop winbind.service ) || : fi/sbin/ldconfig if [ $1 -eq 0 ]; then /usr/sbin/pam-config --delete --winbind if [ -x /usr/sbin/nscd ]; then /usr/sbin/nscd -i passwd /usr/sbin/nscd -i group fi fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in winbind.service ; do sysv_service="${service%.*}" rm -f "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart winbind.service ) || : fi fi<rHX%"0E^큤큤AAeeeeeeeeeeeeعeغeػeeedbd95eb7e0d1e8c973d39fb53be9be46276b21bcacd8b0ae1adeeb63651f6fbea676af835bac5e037fd6f6d9950ea49ff3f39bc693d479069190927c1c53083993a1caa0988f1da58a965d7a954f36d791af7b63f8f4d458a49b7b48dedc79094eb89351a2f59d94d0255a128b93ae195c8acfbf17f978954f86c6fc5b0e200ff04a75b0a077bf7aedf8c7a6b9b85d7c00990d6b9b4bdf39ba6a774f964a798048c787a47c3127f9c5fdde2848eeac71a06e22cbf997c132d74ada549c086e0d5253e71cf832417b1fdc270a7cb024f15de0d2d059cbb612e6cbaa90a7ef65589a16eb3e6b8e2bf0b1ee56f8a98e8ed307633badc5f3c02d8a82a4293ea47439e5aa904f5d7b09453ef3a52e38439ea2ced05166b32a58db5cb41b9f48d20dff2c85e84573445d0e3f007b22e7fd2d834697ac2752c0919f9574228d99f619cb69e47a32da9aa0f167124aa04eb2bf59aa0dbc95777ae4484ff5328d5d1a795cc6b4b0325dd3211474ac785379683cc4e7f17e211327fb9d536c1ff9138de03eservice@@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootwinbindsamba-4.15.13+git.691.3d3cea0641-150400.3.31.1.src.rpmconfig(samba-winbind)samba-client:/usr/sbin/winbinddsamba-winbindsamba-winbind(s390-64)@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/sbin/ldconfig/sbin/ldconfig/usr/sbin/groupaddconfig(samba-winbind)coreutilslibMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.2.1)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libc.so.6(GLIBC_2.8)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.2()(64bit)libndr.so.2(NDR_0.0.1)(64bit)libndr.so.2(NDR_0.0.4)(64bit)libndr.so.2(NDR_0.2.0)(64bit)libnpa-tstream-samba4.so()(64bit)libnpa-tstream-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.14)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.21)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.13)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)libwinbind-client-samba4.so()(64bit)libwinbind-client-samba4.so(SAMBA_4.15.13_GIT.691.3D3CEA0641150400.3.31.1_SUSE_OS15.0_S390X)(64bit)pam-configrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-clientsamba-winbind-libs4.15.13+git.691.3d3cea0641-150400.3.31.13.0.4-14.6.0-14.0-15.2-14.15.13+git.691.3d3cea06414.15.13+git.691.3d3cea06414.14.3e@d.@d-@d@dJc@cS@ccR@cctc5cM@b@b@b@ba@bascabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424).- Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940);- secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384).- CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171).- CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). - CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). - CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485).- Prevent use after free of messaging_ctdb_fde_ev structs; (bso#15293); (bsc#1207416).- CVE-2022-38023 Additional patches for the PDC role's netlogon server; (bso#15240); (bsc#1206504);- CVE-2021-20251: samba: Bad password count not incremented atomically; (bso#14611); (bsc#1206546).- Update to 4.15.13 * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); (bsc#1205385); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); (bsc#1205386); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); (bsc#1206504); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists- Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689);- Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254)- Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- CVE-2022-1615: Do not ignore errors in random number generation; (bso#15103); (bsc#1202976); - CVE-2022-32743: Implement validated dnsHostName write rights; (bso#14833); (bsc#1202803);- Fix Use after free when iterating smbd_server_connection->connections after tree disconnect failure; (bso#15128); (bsc#1200102).- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- Update to 4.15.3 * Recursive directory delete with veto files is broken in 4.15.0; (bso#14878); * A directory containing dangling symlinks cannot be deleted by SMB2 alone when they are the only entry in the directory; (bso#14879); * SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used uninitialized in rmdir_internals(); (bso#14892); * MaxQueryDuration not honoured in Samba AD DC LDAP; (bso#14694); * The CVE-2020-25717 username map [script] advice has undesired side effects for the local nt token; (bso#14901); (bsc#1192849); * User with multiple spaces (eg FredNurk) become un-deletable; (bso#14902); * Avoid storing NTTIME_THAW (-2) as value on disk; (bso#14127); * smbXsrv_client_global record validation leads to crash if existing record points at non-existing process; (bso#14882); * Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call; (bso#14890); * Samba process doesn't log to logfile; (bso#14897); * set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert; (bso#14907); * Kerberos authentication on standalone server in MIT realm broken; (bso#14922); * Segmentation fault when joining the domain; (bso#14923); * Support for ROLE_IPA_DC is incomplete; (bso#14903); * rpcclient cannot connect to ncacn_ip_tcp services anymore; (bso#14767); * winexe crashes since 4.15.0 after popt parsing; (bso#14893); * net ads status -P broken in a clustered environment; (bso#14908); * Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before smbd_smb2_ioctl_send; (bso#14788); * winbindd doesn't start when "allow trusted domains" is off; (bso#14899); * smbclient login without password using '-N' fails with NT_STATUS_INVALID_PARAMETER on Samba AD DC; (bso#14883); * A schannel client incorrectly detects a downgrade connecting to an AES only server; (bso#14912); * Possible null pointer dereference in winbind; (bso#14921); * Fix -k legacy option for client tools like smbclient, rpcclient, net, etc.; (bso#14846); * Add Debian 11 CI bootstrap support; (bso#14872); * Crash in recycle_unlink_internal(); (bso#14888);- Fix dependency problem upgrading from libndr0 to libndr2 and from libsamba-credentials0 to libsamba-credentials1; (bsc#1192684);- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899); - Update to 4.15.2 * CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication; (bso#12444); (bsc#1014440); * CVE-2020-25717: A user on the domain can become root on domain members; (bso#14556); (bsc#1192284); * CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC; (bso#14558); (bsc#1192246); * CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets; (bso#14561); (bsc#1192247); * CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid); (bso#14557); (bsc#1192505); * CVE-2020-25722: Samba AD DC did not do suffienct access and conformance checking of data stored; (bso#14564); (bsc#1192283); * CVE-2021-3738: Use after free in Samba AD DC RPC server; (bso#14468); (bsc#1192215); * CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability; (bso#14875); (bsc#1192214); - Update to 4.15.1 * vfs_shadow_copy2: core dump in make_relative_path; (bso#14682); * Log clutter from filename_convert_internal; (bso#14685); * MacOSX compilation fixes; (bso#14862); * rodc_rwdc test flaps; (bso#14868); * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal; (bso#14642); * Python ldb.msg_diff() memory handling failure; (bso#14836); * "in" operator on ldb.Message is case sensitive; (bso#14845); * Release LDB 2.4.1 for Samba 4.15.1; (bso#14848); * samldb_krbtgtnumber_available() looks for incorrect string; (bso#14854); * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED; (bso#14871); * Allow special chars like "@" in samAccountName when generating the salt; (bso#14874); * Correctly ignore comments in CTDB public addresses file; (bso#14826); * Fix transit path validation; (bso#12998); * Fix that child winbindd logs to log.winbindd instead of log.wb-; (bso#14852); * SMB3 cancel requests should only include the MID together with AsyncID when AES-128-GMAC is used; (bso#14855); * Prepare to operate with MIT krb5 >= 1.20; (bso#14870); * Heimdal prefers RC4 over AES for machine accounts; (bso#14864);- Enable samba-tool without ad dc.- Adjust spec to use pam macros; (bsc#1191046).- Adjust spec for size * allow some Recommends instead Requires to be configured for cifs-utils, samba-libs-python3 & samba-gpupdate; (bsc#1182847). * remove fam, undocumented and unneeded.- Add missing build dependency on bison when building with the embedded Heimdal Kerberos- Update to 4.15.0 * Removed SMB development dialects SMB2_22, SMB2_24 and SMB3_10 * VFS layer modernized. * Add the ability to set allow/deny lists for zone transfer clients in Bind DLZ plugin * Server multi-channel support no longer experimental * Improved command line user experience, unifying the options in different commands * Winbindd no longer scans trusted domains on startup and will use enterprise principals by default. * The net utility is now able to support the offline domain join feature * New options for 'samba-tool dns zoneoptions' for aging control and to mark old records as static or dynamic * DNS tombstones are now deleted as appropriate and use a consistent timestamp format * The 'samba-tool dns update' command validates and rejects now malformed IPv4 and IPv6 addresses * The 'samba-tool domain backup' command correctly takes out locks against concurrent modification during backup when using the LMDB backend * TruACL support has been removed * NIS support has been removed- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/bin/sh/bin/sh/bin/shsamba-gplv3-winbinds390zl37 1696520507 4.15.13+git.691.3d3cea0641-150400.3.31.14.15.13+git.691.3d3cea0641-150400.3.31.14.15.13+git.691.3d3cea0641-150400.3.31.14.15.13+git.691.3d3cea0641 samba-winbindpam_winbind.conf55-samba-winbindd55-samba-winbinddsamba-winbinddntlm_authwbinfowinbind.servicercwinbindwinbinddsysconfig.samba-winbindntlm_auth.1.gzwbinfo.1.gzwinbindd.8.gzwinbind.xmlkrb5rcachewinbindd_privileged/etc/logrotate.d//etc/security//etc/sysconfig/network/if-down.d//etc/sysconfig/network/if-up.d//etc/sysconfig/network/scripts//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/fillup-templates//usr/share/man/man1//usr/share/man/man8//usr/share/omc/svcinfo.d//var/cache//var/lib/samba/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:30951/SUSE_SLE-15-SP4_Update/8d00899bedf509e14240222c35afbb11-samba.SUSE_SLE-15-SP4_Updatecpioxz5s390x-suse-linux ASCII textemptyBourne-Again shell script, ASCII text executableELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=3f227f0c1920436ac46804d9bda7ee7f5587e859, for GNU/Linux 3.2.0, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=f97f20826473b9c8c5a6cc15a44d63fdcbca484f, for GNU/Linux 3.2.0, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=1c55361acddb03f1921b16820ae72e7db2855b36, for GNU/Linux 3.2.0, strippedUTF-8 Unicode texttroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)XML 1.0 document, ASCII textdirectory4O3RR9RsR6RWRRRiRRRR_RR!RuRaRcR]R2RoR[R}R4RRRRRmRrR R3R8RZRnRhR`RtRRlRR\RbRR^RR1RR|R5RRVRR!RWRYR2RRRmR_R}RRR[RRRRR RlRRRZR1R^R|RVRXRRRqRRWRyRIR?RUR{RCRYR$RwRAR R_ReR!R]R7R6RRRcRR.RSR R2RaRoRRRRRRRRR;R}RGR4RER9RiR(RRRkR*R&R=RKRRRRRRR,RQRPROR0RuRMRsRRgRmR[RNR RR#R'RRfRTRZRhRHR RrR R>R`RxRFR+R-RR:R)RlRbRRRJRBR@RzRjRRR^R%RdR/R\RtRLRRDRR8R3R1RnRRpRvR|RA;iޓZW~@RowF`XY&h&bq ;Js>hcn" ɕ4JP^ym WEW o<<&;7?xSf+Stb#<+{h-nK sʯ=-0])$ f-v`I[4OK#rƓU>tx`rOݎе>B,Lڷʂ;o(XQ:+rq5 hOa?1F$ Zaﰰh>2en߀MUQpLa95"g|Y. _tJ|9zTA%H߈߫_A[ 54YJiU rd@~% ^zi2՘@"qjz0y(i=Os_c CK>{nxJm8f'M7Nj W1y !HB0Hq /r @&OJgAhgʚ,h Ij,m+)z-Kj+肘U¯lWCpU%@!ɷG(hؽAα iiksO.5k*݄ qϭlZ.XT+PiHt" cLG!:12o$ܔq/[wXkoIvWXI%2݌ WS'T ҹYR@V)]Cm8'|Wj9t77Wch7 &k]M9FED>aGOȈP*D\aC2TX&T{rLM;!$yG J]Q_e1E-LcУM"ْvo:0%T5T6CO0?%\&F)a`cf 1Z/l5#qk}B5%}1\j{;g[ S-qj!t⪫5ږ^u3'yP@5۷hO(ɆƂfMJ@c/ 9L)!p;Y!i?q9u1@ES?Ūd$~SdIU; yeSth&tDhI=/{!&K]U>5j%o%*΀|eL#@*fkxo`ܐe7[l0Nڲ1fːd4^8 8N9,܂XZldHwM3epԢ".bZ;ɛQS&]-$҂ <{'C*݃QԂ=>pGF"f]`mu w ۪JyV?I;P!9<]j:e@z9{W!j(.}DQơVW(KN§Ц9 laÑ%/F/nlaνiLi8PVNKĖu<м>B{ІW~vo\;{jHe5~I N#)Q0U;5~4*U>Rq{L70ݚ)O8%(eHۉ8A5GgxY/ V9QSZ#߇#)Xepى: W+.]vlZ>E |sBiyа+E0S 2q+Ir}\~/z[9"0FO32KhZ:U(Gd9J:nK疻4ⴠ{?eI#HWYH!CùPs&oC b _im*ߨ@1Xv] ow!\g?~Ѩv=a$֏N|yʢ"pb]cYiA* 6ٕ\(rޫ٨𖏲(Nl&?ҨQ Qߥ_\CS~jæcWD{ѻhP?b㽘Tl#ۀTuh{$ҦqLN߲2&JK>yɘԶ\#٥w^bB#1v[\" &&lۙϛ63xQG 1I[^;BG-# &iw#xB"u)Qc6d䄌R8UѧD݃t1h|:3ȱ;LČ0J MNl:]9j|#^TH̽ܟZ(ޙcR7:U7vb*ڢaq-i4A[5 vG:rھyNr뢛6c$㼂,;QlZ[)Ms-M^+ơ?Yu#_Iɷ4> ) Jr7\lIPj\Doy"$ 6zZTC@(.I͕;y"t&7~( WRƩ-,mi$3>y9 m>ٟ_4pHeV;ڇ%s>.):Ikgj (4?8AEٓ/84Y⅑G.F3ߧÍ|o+Nσz )yVTon;I`uId_E]'D.?Ok^K إ0q$eʕ1R2O"vw2:@oڎjZ`aKPǝ7EysxϦ7x~{mgH0wgU$$MqL{S³ "P= ?! VԂxvg4<|xb$_uP0OSzTq'v* WOM:Ofʕm bYx3X$f`,/Y]f" wneeS/p@REѫFrؿr~+B βww;>4S? s HD*3' QuxX1Fͫ&Tnb*슌R1K.]QbSm1ZE:ћҌ qie< #>*`ڋ:<}Ҽ5wTA gj&K6Ǫ*6_TEɦ]x !:ҵ}IhPaqb~HK儗6岕Ovbύ2 }NLFL/SWiDWyTӽऺUK%(<`@Pm /KCLJ7ƺweIjT$z6(Ho{&ҭ1~ ia !f% ӛФ.QF8\s⚸v-'kb%^g;i@ݠD"Vx{(V-CݑEZhtSW>- z#vnP,# F{=>~x>C25Lri@ \>RaUe9Xk(^[xJe>WhwoM]% #9׌bn>!Q/I;Y&8[/"<2(2^D?Iplj9 %;/Ty H. 8{8ve3ӥyC͎](\8Un 1RPW{9O'\FXV-@ i=?nƼ4BӮk0Njr/yhf0YOzj߽mnfO rpJzsեC+i{Iw|R;MU'Bvx  's4C2?`[6̠<ȌU !9/Iv<3`H% qS,6;hWh [9Wlj/&Df X-UHrY<$8b~%̤ QeWNgqZUt=VKRiOfMb܇=9ܿĈ6mI z3yD۠jcyh˲.@Yp<+'+~tۅ)WkE˔m}խA]/3[@t@{eTp)&Aט*}v˔1QX/H2#K#\A$@Ϸ[D$Y-M F m xiPQ(-^d7fRy~$hGp"5C$Et}vB{sE6#ͳJ廐U o tJRU$G6I_p1'-k1p0!m!W>ct7RTޙx~8x_a43Цo9/*F u_ [F/ ݈[ęـW`0y r7P0X7ZPC}c]yTR d{t5(ULvL~PSw$ujN F'wZ/qQ.>$۪rU\ۦq}C'^PM WR@>XMYMz߲zO1Jd}ԉ&6$RNj׿jҠ`UweF9l`*jF^xj^xlY`:bu]mW CAjOPd.CϢyFᐤ;kZJ`vm|VZi/{ *oc&.a dA5C 35_uhA,} f}z5D˔$J͘>y?Նʪ$Ta|2a{\?͝" oa"]it"~]} X+9*5hsz_]M yܩI>bV޴/Rs 4 VwSS™u3vh/pagnm+k>\`qv aOx5Ӻ}l¼ ;e񪛵$x6{B@.Cx0 $p/n Ombo]H(k I$ xg&a81p8{ ێG 7+3(uzt4VW5L*|]Yՙpc2*0_FuŬEJ?yq%m)b=u;^F Z2nQIUjB#;9(]D*KSzTO;]׀_.ڇ[L'MzJ^g.p8XQεF bC٩zS|\WxE@rZkTlK S ˚3=Z-tfSeYhܵKdɍOoqA}\ o(]˜74\oLpriL5YU B"I,xs_zld_xyCPn ݇!sw+(qMVX7ҕ<6C?;B%O $sy­zTE ʋ%*'?db]M¼p9>ԨWTz7xGo!@DTW5+8 EFjFug;:ɚt7mN^U6ivl{i+#@^Jg1vo-D0C-BԷXqa >#CFqgt~g0 NX_ȹxQ H?t֏~)[\#^F^CoTvffEN4>_S;iLFo; n=Դ=+ܠ,_o a tG8`Yr 3se b"Vױg3 $TR-'jDV|8,, W3/@SJ'~{_G-T,*A Sdj>g^6izNYXX+)z^J<dOFk 9NtqΘ8TU1ք!Gvp ,dHG{ֈXʨ#qITOC8с׫GvTk,R=%Ku{ jR n\J9v$l{!*,.b%KԁGH'#5Z{@4JJ"#&y`9>x7rcSaK:V JpSYGf⏋fBSp%Rm}(Ӵ^Á)Dڛp0SXM*7#aW+?`,rjkzT1KEO@2Dr!@|dr@J->kt<@CIH hr-F&e!ij(*JjWσhzG" 58M>k@"Iz 2[ϳ0qtVi᰿+IfaVGtspgB<,ϱ7v1Vury+aBv'qUM|<)Di3fKq` I0>׎lv-yf=@ÀG %okjǧF]iM_!m㌡O`!3@Xie!H|6S~zAr8ōB'BKKc߼'dBhD_nxeϦ@ _EqвG}?pYx,չD |O,(V-jE oA$NOMR=(ZP~37 rIa3^!nlE Ɋ| [D'~CIe6X;1n^)2LfMoA<_+ *=~$W'3M_p t<`ii6 ^Xޝ!9r'\7DD^}U|C1, ;j؊t1N -$*o}'*fsE5շ%vDp&7[5UuGFBZJ1Pҡl71d߳5qlx@Qw')E >ettcF`M/j1[IT|_i1D&OΦԧ(}!(ުQ"=u,˫όa/$oCj$׉8gxmb6[aUҳOXS(x#!%~2z,'"4}k" WY"aA$$G n2?az۝-ݘynDJQe>֖ :vU`]3AL5m[ HC /&> 矺qzi;6 F?Ǹ0DkjoaPZaAjw*&i}~\;m 5&ok쏭bGƈACR*i k۔%Ap,+X-U_SHh~b,NOgͺFTr?m/[y}DffR&E5مF]F3kz`'~OsBGY+^Jtp5TLn"a1cŽ1лȶ*U7Kw.Kg50A,-y[c GbZ\K:JA(=oÖSD}/E\_wR (.-M~,ZN٦Mp5!A%gh5uV Ih|qsN=Yhr1K XQx&_E0خ3pr_S0DrubʧOI QГh($ȩp02I=k=kgw;t+(oLl36Y8K%`lsmOο)ȟ['@g׬>_(Bw2L0guhF(K2ġ2Pږ7 3-feH6CM MKbozU+G"YLWbsx$޲ /0`!He$gp r z0AQ˕v̟}!V ʰ+.cy9Կ|Ud4 6pc|C Z+ Wp|3}`-IӖFyADAqdH7@7D5E/6%KŎMڲ+oJWRunR 9^ȦfƐS'cSSXtqGuCf DY[ya5u>yNnS6gOˎ0] 2H\z\bˎpO1$W6'*Ҵcze?+`W^\#BRʫ_XkK1>Q!!.b33F. %.M6|V"L?uv/y&;LXgsu#&dze43Qjc:B,GqVXΝIzgD/V"M?2M,'h}1cz0~./lKa:iqc;k껭L;xD Iz ][Rڨ56KM8b#N2 7ҷۣEA{<"ie˂"pEuƎ9oژւΉ`U=a{3d [-ٷwm(?n*P9+W -) b!&͖$H(_*GQֲ,JC{V{wb bobJ>1*-Wzg|Z9h4P,Ãl8Sws0lj694hʙע)e~@iVzvս &fkxs;@S0U,cP#HIe(ťwz+;vjWB%S023ܸWF hQݯjCb[y݉tBco,N[m?{KY3Qf0k 8M键$9ϼ)Zqk7I O>tB;%pj>f۝.h!v|6g1;w|;aXݤ=1&RQ(vQrXnBgc>%VXbc=xp*9OkaHuFVm-'/;k6ɺ=*$,kz$},Ph-k}3->Lrs2[C2!ʉM.dLEЌ~Kq:|r| 9 {XC}j/rb|:Cцpp+-e>l6+DQN|ͳ&a"\( jKm7y %IƋ; o#a)]-ch=$@/h:/O ̬5t:ґ3UjlfN2}+|Zk*ַ&$e@Baч.jF%=8)evw?$V"P=b9'6$:pdY)\ s|_J5Fci ^ )jx@%17uP1W yreb~N˨ `7˥K?w>92z[ ?}9$7l 8g7A/`!fl>ɚv|87 ] n@+)~&㇣D >yo?vB)ϸҟggSKf txy2@ŧ UsbL EN0R֋< NXDՐ}ZGxO: y^11!#?)CC|1"6*%x|xLp뱵Or0>7>ڮ5=hhV מ7-P4ɚ Ttx0VwG [U%l. v9R sCSv\ר}– a_M}}0dKVS+imAWQ>ؕ}̴LVhAAExԭJn1]Q~ƆJNK>ޚu&zi 9>->0<-Bx >|`&$3ӂA^S$0`P4F0+W.6묂6p  zWZ[X ~>}`v4GxV9h'R\N})$Bbherw_b;9 zƫByB"YIhE=N4BALnF .w_:|% IU=ab>.psOĀIwqijq#ʖ㲿-}sE*ݤU>su۰sr&P$gzò=(+y IR||CL T 9_c_.W>EKO?]ScS" h8x؇NiN}uӬ^(df [?Pz[f$tIip51l1D=PG' yUxcV ;-Xt{9+J|ɼ\NˍOv4a:7gs0̽K+\'y3rc譤7n씝VO01H!O v>\HLs6&p9N'?I*kz؂_L҅NVjW\Tl\ ㍇Yd9w1%_97|Q4J(KH_i1$^_y[`$W|>N};$g]2zmj賂7nEKvywz oY>R}iubJ:{<֬T I@nmF$8hPM.r^ zC-q%RK.|3|__])ZE3ArvOL3L<#>,c:ePm):A m=h=-=ܑGF&AwDS| dƒTw wZ6E_طAg8椫i8a/{8s߇;Y"F܄~C 1OYj[u2vrr,mF/PaJc?!+b*u5bm4;Aɞ]1].-l]SAFHqS7=Gsizo0h2Mԏ%!2T[TUvNhDccCs %Iz9!v sFKΤ -}?0 6-[.ݒ֪QА/`[ ņjJ:QKc %/M0+n2p$pqLќhQ52*SwC{l\ Z:}+n^ÇBp□ V2 N\)gfavQ@D{ޢ{t4/dF641t_x( vhvŦ c0*2 @Z21έ\˴8ukj GPkߣŔ|ǝn#}*ӖZƐvN򯟈%ʐzyNڑJt~G0zO.THY5h]B{%XDBu3c<]Rj.aVUU׋4"q NM³6nwe'I"hwB/óL4lEH_Ӭ՟=bsQ(i G&\{[})Jj!3dC«m5SjW߱+W)oǼ~@KP$ONThs _~hM{5h;#r"2BJ0g%U!>̝9ť%6$]_wK߻7k/TvnAbg>S&J/B{ T;H~B*/+Nx"$qQҐG$G¨2>fluk"Ȓ+]fMVΑ([HgC  j+9?>svř+4>M%c= WYhlYYׁzOVTӂb d24Ð f%N)m:C{k7SʂQyP~wQLÐ͵kR38ۚ-&$Rٷz(]|6cv:abKTv(TuStwr o+f#C ])E՛ J}%XW1h8HIr7) 3?|-4l9C}fM\c% +hˆ/[fۺ[V-} Jlr4$JXYGt V8hՐðNWfM-qU²;]Ox8a};MdUMR1XyOOlmiŇ8d%""1qQ9,uCпtD/Vf\L37{^Vg~WQ69KzY?iq7ɛ6.>tbA͑C xڃ}ݫD_5x$e>͛k3%+IF叹nF4\ 5FWO3-,RD„5$DEĝ!$pdsrk/e"B8 :;AX <˅J[ޭZЊ|rJ;?~Qym7 y)2AjJDIZZK3Bb,\pGkpxiC.煒ޛ?ib,p4ǍW]x Al:2;' pRd''いJZ]˿)zǔ\NI[НP|Ao ױl _ۭ) +Rr ag=Lzh6m иe뙂636F[sh r ńp5iNFő(CH0 /qsG-୉2u, ^P˕uܒl@ћfF3Uc:7&@ ׯsP wߑ/9n Pc v SZltNc+7|R s;1ax5"w܎}Mi 051|'mp#U4vW-A1LO~p+x?ts-{E zz("qLL;Vnĝ 2ðN1qgX-+R@_ }eddFذjyEqGءBZ؂*jtdCWkzĕQ"Y=Q\@er~hv .VV$krr@U/TSA(]*(XQ rdj;uu,Ow𝜇LMx92E ~6*G&Bw}p'"OMޝ#@wq}RvN6l;(CI + ˇWIe&% l8y-U~{}4 *Zz0y{dϓ,mZ?+ao̲%acG/١[03Rc```!7c~|i K>G)o\P{%܀1])=y[hn yHhL~┢0:y6qwnr^TXo`6BOBg0>m\燼!~4Gj%m%}]Qxn PA1E'"ۨa+(T7$`k|0?!{v A8fRCĖMPmIyg,~sce4=&܎ɤrtJwXƄk|1/%}$`I7to?V]Y )V˿oDz~[ YXxg l]Y`>E6FlwBRȮdh|cGV+QeP5y=`Q۟Ҝ^V%ieU{po-e^m=bTgVMrbMc:x q8`cJ} aɭeJTf/=Vp!c90~F9{;4uM&JE!5&cQ.ߚ8rn'҅)RVq6>=U vdfB6S&F969szj0_ԮI(Y%"B l4G`{囥~3jiK9WSmL2U'sKǹ7ܭD֛gO` : T\u3Q_7RPyj-@]Mp{T荆m<.e{~kK (Cjy%~3Kɲ^F,!5"E)Tϵ;M"-1QR ad$]BQ8;2B֡> +:pRa Hr(Sm1Ⱦ]2r1kBbESO{;LXD*F(>W_+']-@aKǍdz0՚|i2I)1ߺNP'`ู2cA{i_gQuEr6G;(Jď1y/~@*-YpnMObZBvC+ zi)(1Vwo0 $;]I5ar:)iXәj 됎6Cj(nlajEcKj~2R_mA.DQ[gR `w.>;έEr}̓Uj8+.5gH.>Iw̙OݲV.q!B|h3=ՂF6m|TQA䈮j<0$Be\ ~hJҐT2v,? d0hYS#n5A`%|Yš/.)*E2@hV_VpfcA!ҫ[_N bC"qPbD\,rZX|ip4%%lM51 y*vΎa8D{=u(t&nV Z:g[=Oq &?c4N)ڏ0NXo.q)vgUFOs_06p[&y*(un#Kr5Ɉ?XΚR6CN>5vąxǥ-znS 4cf1#-V<E3cuhVes x d뿴L,er $W8-b+婰˓ c \Lbo@ bH;/(eaj:(7]ƓxL˅[pA+^ !7D&[[oDLMsp˥ {R|㠘f/,USfH Kb~_iDPcGWUؤg/)OU&b^x Gji\sBe`ѐh۶^ _ϙİ֙x WT.;ct kݞ?zr|Vg]}͖n}Ö,̆M jnFȁnJr"h\*=Ḡ/ę4ej@ݫ2^ @ vi@Cٮ7sD\AUeBFPFcR:6a"`q?lB'8w% m.,F7`֤ʡ;A1P gM1`fȈ|1]G^gd[R!3͉3cUtD,xf"K}h@'Tsc(Z~dz[lc@ y|%,=mV>Iqc-j :%"SΖCû<ƢgRYHpH|\Įh3&sCu1~>Skrv:Pzs#jtQO=%$@o0eTPjv ]߹#V+>gHҾ?棥rZod4N| 8~/6^O2a92Cq rqӗG} Cg, Z!RŝSnA*R\F\}~m=E_>u**p9%}4 e3Ǟ}٩s5(nR+}~"a~VxL&m hg~ 9Hn|KwH'_s 7pIZN&ȉV{Vt!tQ Q0}S]ь; Gh.|ug; `Pjg#_JubT-1I+AOsTg0O}IWl'{W: )L99գ4 ܲ_Q)z= 6wƦmYy$uYLtVjXМq³- A̳!nu`,g PN[0߆K/8`+FzVLl9rvia#e5CV xRfNk&:$M(-M5IV^S=NMs8'fCI5dv gG͔*uR~qhsL=tx+}U[ wLl겄mhp qVy]::P +=Υ=ӣн02 '(RvPhЍ Xq8R4$iF~GF+HM)'d=_v3ϓʉّbi2e}d 㱚У}1pۢ_Fh#ϐmEl{y $OR@YjJ?ljC6pxq]%<,W"Z"Ú*lqtPbϐd'®9y5"^`IQTRO޹<ȉH@+}(U,wZ/|!)~ ;]s%3rv۟LxT*Miva܊'ޮlHZ"s]i-#B潮A)pWmmh<5/. \8lߌ*ޅ*S7)~A!$cQ.>BwH[_}i p0HЗcr@w#MmXla?ZUOQ|*ioԟ+YS6D,>}éekN~bwi+q._zF_[7HV+~\0`mRmtDXl*NF m*k9o);z `*=zドeBhj:0}+1v@ko"( 'IǗ!D%J@ì5t02r>!;M:%4a\tWe\DgJ\f;vT)|]\9D :)]8淧ϛ"ZcGQ(JsNGjMyR]hcN %,zeÀ=2LM1"hC~坥}4^Lhlv8;0x"z߇9r8ogOo`/)w`J^cs{W4:S*qы8{Z%M"E5MiNyCSCUol3.cTc ;K^h=6A4z%@e$iGlW ;O:EH=Y41P 1^8BM\M97bBzgTz,yId"f//ʎ8MHm!"D</v4qq HO]Pt_u+#B()ހ3%q{@XZ8NY`SzzNV2$)L[vW¬N{d䫘H-5"1ƿ(ΰLM.s`lϴIEWfdn1x ANW M[*A)47'B T#:.R=_,lW'3;[  ]c<(Zwn~mբ%L D4l,A}B  s4)VaaP_ڱ|Z݋=cGR8P9Ͼzqp~RzGEunz5oE?`ﭦ[ƖX0hoQ\F_꽥Gj&{qc`ǶW7 Qo*_F0sW(fdQrFsLZ"ŤI.hϫ^qI\3m؄+jg)+VKXzY/v L!CXH9Sn%,>Ʉ9ѶQ=?1 YPF$pSM~M]q+*- e7 D6w#^Y Z\79wu,rHK|<@ ._5:=J1u2m1D3F{odz/y\ޗ J纂>Բt|5q+>ty*O~.NA4(qSz:NUXy/NPoO)C2z%ɐ7UǺs<˒Cö;"RkLܻ pޙnI~vUtX@jeVf%OJ-6/ݽ4wJ  o  #m*\: bV;y2-$5N'1TYBS~!0Ρzj$V3N9 (Ϣoy]،Ժ2nBJhx,$*g%i9y"SxS2.<GݸC{^a1Ӻgڛ[;@WxB`",J}MhiD2KN_ՉT*Y=يSy# d{nsd9/6z8vULASn7g{-]x5{S?#S'!rT*PbG)D7_i6H‽_-eah;. yհ/  (@8`-"*&Y6qvi"Zb8菱Ė6oE߰9rv1}@fvH`κ~A? JYc,~f 䕀E_š`ޗMvje~dvԐ1,E=jfyAJVܫu=o(7t?@x,D.翌P{nC?l%ȅU*lWR3_!銨Z<!\D+=:3^ Y `zL:xU$N|Z;;= ɛmL$FbTho@8zw\o1_OkVVFA*xnFc;%^VY')zX¤n4..<=*oEqErpv)dqINPsfI8?UȲ)z,I:6邳`eX!,R:o{'9cj{O;qfdNu1|W"Y9 7` B ~VY`ԍE͋0n`` r ztZ[o#yQ'9napOBJ/(7_ XYTC,R.g[2 oIwJ}U~|:z3-L@Ky]w(GŰy49a = @Pˡ[!ČQ/WQ&tiԠ ^tq-?O@^4? {y'8' vjf;=8~eɮ$yP鹖d d@!66s;ⱋ^ ʷ vifL~3{9j{4Uz dŸ=?^X[?/30GioB `x=Z5T2 .#TK0$@ ܸ;qu]"ghx-Tl]m)!1( F#3O?š '&uhp˚u*+TU~#R\u|\#A|@:=0%GxP|LTl4"'*\CLYqbܒi&›hxL|=a2دUþHX^u1qp";] <ٶB!J?> tNR_ Irɸu#FtE.{:c}X떲a|ްG*+eXhhxV1X ny:džPr/ ~ ̎!jj,$^q:K>nkAP~q:sv+zA>6Kh i#*|ﮂ Ϙ@Sq!ˇ>J4wu4BJ^I+狤u0 ;|cs}noTu*8ȯ:655[#*`GW@.X(J,>FʡwbKN P:|3˦OxKʄb#dI) GF.ǖF;Z*QMRSmKxWbTm0Hx\M_K+ڌs= j0=+D5K{.FIW  7|b2ծp A,<xG:bdRx8FEzb7T?\ vmDs`2jէ7,fCbw7s2k 293>A* ٦&jF.3`"뭭fAaR$3@Uz7;^Q)O< Qū2yJ)aYRzL˕7/Bى Aw`Q[8;wΈTeƢ@ϗTF6@W[#~%Z iBwi QmX>JK׏ }1y>5(".uP9;@xȢ22gox"wD4NMm%xƨƷpr1rXfֹyqL[InL4 ZQP ;U?cO <=Zפ>/k'о'T 2UG%#V&\F#>!+~@^Y~~t:բgLj:RBYޜN[.0CϽ|'UX^'"(VSy-N1RŨ]:OS0p׎VD7gO2T4T(aBe4">)E-hu*w^{]개~߆m4C}hyq⥰O^TzNq\W`~-HEvTwCmǢqk,ՅQ,^Q jk=}3UWic_t }ST۽wX%=: F XwGx/0Z"nyWGiǟ Eyq"R k/cX_?lpoZΫãoe(zFD 8Imom |WR&7Vd6Ev^W@Yg &C$`{ +HήLχW G{a]luKw;xJeD9dž >*ikbշٹp]}uH@g}׌MC 'yk6`.J." l(t󬙳1s[̬6䏵 7ak!~tż\WBtw+@Hd?# 筜W1=,~>,P.n4 FRqZ,.|2VB C36UUhZ}[E;)WZթW0HsYsɬէye`amdlNsM/Ez "@'{|r$2$mk5Ԁf~g(ȼK?I4g-̅;LpX Fғt,Iv oLN(I_6Sj7=[`"OXEq3UƉEFS*H4H;+v&Jz;!I*;ZJ&-2gc bx4I,ύ܍e6QelX~XR6ڐ|qqk EqD?-/ln #$("nSC0.,h8 ntN&hSz,nT.Gm7]aJMD@4@Srݛuu''XW~le;{Uxl~/+FrA,鑤3FƬdScW|ѧdw1Zqnq|1A#=z?ʭ-'0%xg>lɹK$hszgUHsu>Gټ'9ݞd{qڤ9g= ]MXqMQdS*@:,#( q+!*H"APzqqиC} I W*Kb8  ߌ4U*}nFC[(?"zd9[Bv3F-l*nSw~e*KXgM46uEZy{TgEar{{|YtjjG6~M34 6[٤3׊9+W-bHڜ%~J;v/ݣ}6bzv;_]t97ݹ ypȓ[EsC3D]~ǧң_`~޾js<8j+@aFۑsG nSB ycS$KT$ϺAqV3Eth@nl!k^??-IӀG? k:5Cñr\^ O X8E0MPDɌهpH /hmrߥ5KCPeh2LJFK8!. -$1@Q9)T@4ySwS3Ҿ0 Zȑ%bOŨH tX] g)NYݸ>Q_ MKŘf8 iV{'*n<=eC8YxN{z-_D"l[ ,-"0bcR5F z3X[%uM g'9m|03ai3v*Y5(W6i' 0vY tv>G+pO,I;ay{'횢'?@ L17(2^xu՗68RiG&˟jA;eN A6&S [deGI+'ܓ &ql{$?&[eeheKtGK-L"hbV1m7a8TLnoҷ5^Vug{e:PCrF_svyApntaiRwHj SQRถ˫_n%:loc +.&uɴT| l]֕gCu/֠$G%k-OJk.y2Aw]c_1m f7"JB@ >/]&B4fakN meZ|p_D$f`. NV%n_r7-nYCe1mCU㬷[8xѦ_Ip,% ʢ92u(2[w_MXe2Eڴ\oy_K`wV+U&7Bެ hA+ Z`L$y5=ƷAcJh+r[2LQ*rɩ:ĿXPs^ Q[#~qz^x)c1 mb2Umso"+)٧McЇ)b 7Ql&9_xIH o5Э? "V٤l4~(G!&~`_}.ty!\Jl-XMRj,Bl1VD GyX Yf1:BAȦf_nPMy!lþcBms 5RHAr.{wEU4Ѩvx߇Qe!ʿx_(^Q@Wrc{u-OW<2XċPY 7JFuo=J?8.k1,u"VRpCЪ([Ӽ ?Q;UhKՀwML.bsA2v9ʙxz>2q v&nynLv|{m%n^\/0yc67:Z*l;Os7G th<ƀ''ǾrI}?iAL˳8n "U5 MS"Bivؙ;մ&ۅ+UK|E?Q.vT=-}8aܑ#GWHD)1(TB8뺜~jx{#84bs ()PKdL4ST4mgNxkc{*0\t}dٸ.FxdZ-US:LW= y7s<ʌI6z+9:VӚ2GnLmg %M6~=5Ivb=ŞlyXFҕgVڐJ\ 0H±ӓ-rHZڃsz ( +lE0)(z+*CrPـOkɣ:>H1Uo5E%K ;%(qud09ZhfZl]Flc-N^C-ǀ`Ix,jXrV]Og}7 n+ @{Es!ԞFÍfZI5!)b}@9]WT{ЄGFY*rL Z( G.rcW:r>x>P}U8;:址gJ3t'TF݌0I'-_j;6Nf0H/2ٳt)J26t&O5W4!kV(SQyeό0K*۬Q.OP18pB`I/?S)Kv3JĔE8l#;ՉF5 >ݍ(OWyKO5Oc h&>aZ7J,)E7@nV_fSo;֤;b#tɩIBn=Hp#)3[;_08id작5YG` Ժ:coYS ό@m*-%j7iꋛDn$=wic=q3fnxYy.| a$ޱB%PDϵ={=d[vrWLѭ؆\;R}+t͒u.KJFX*[_qu!u'uMi# XyVP~/'@Mk=K;1(A%FI۪ )JdoQ8{vv3[SP¯|.2ix8o@qi>P}E9#ò$E: 28os/Y5>xPGSd qрgR•[%J'xt$oD3/)y/go7YGړITj<TqhV4]񽯩۠ȹ*P|l }3BUf{1Vw n#HJ3F\vJMHd9ժҚ ZPg2-u#@Hޝ+:F{Pa'f["˔(;MVB7:t8R DTG[?A/cL*kD{7BP\ k/o6/P!-T*Ap:yU 5#8ڐ@ļQ OE7^oo$8`!DMT{ :K51RQ k SV! əMYQՙH͆_>|u/j\vjk {l(0~oJ. Yp /KY5”D oMZ,mۜ< #sZMtRjLYWO<"t9ܞl k;"A7t,'?AJ{3/-@#=3Y a)j r]hUyx/])'p|rhxA6g Nc .i!`=:ܾwס|[5 ʵg+QtL5;ʔ9ӥ] 7"91U_yi*ZlI΃ %b)\|!a XAfATչπ_dc]v vH/`pTea%~ۉ& !Ǧs%CNFqTXQ4ԢcOc;Г-pJŚ.sgU4w6uV.K"qkMO1;B/kXhWm[ +il`ھ9 L}g ŁW#'tM \r[17c͸\e ,vHH2+W#Jݜ:SYE yzCLպx.h)bx\Q4rѤV޸ {Sk=dA*Ix,aF HZʹ,-nktC#TjeF\I !/m<bI 4[ũT=Zj\qя'=ԒQнtc k(õyJ=xި_nŪc>ਦko@j(#)"i]YfVUh Z*U`5ͪؗ%~R-`F<,j~=ފ .8Qj-E|82R:T)팠DPLgfl 6zX9xorU<|w:ܜ]‡^ ?38!4L*gُm~H4tAsQ2X#z9`uQ,Dݯuw}vM= 0 .lt꣦9ѩ ">LNyfM6A6@S{ڬJ!@:;)(U>{g yP.)6!с'5en%xo7Wq#ћqR\Lǖ"ZY`mR#c؟e:('w@2 v'84"h͒_hrΡgχit`ufkɻNՌ64E?Y],RxU;eM.d-NoRCyo?LIp "u`1yfsi<ۆ !'!OŭӜS15+%9xJ%#a$C@i:" N_=ĩ 毞 +EdIHZJJ%n uPz .`2T\TK h1gq6+H1uJ!!ыJ}܇$۾"Yu;{q-#eŀJViԁBϕ`Q3);KX.,5Pxz 4CI0T7'z$ld=- fqRܵ!J}D6.XsNx<f+񮇒\B1=0t76CGh+MzpQ;6G8tp̙xK)xn]vAܡk)q M OhKɹ^YXVQzCmvDϵH'G,eQ\R,FqL*Ѱ oyg4"Eٺix}N.W<}| Z*ƾ-DUbP-Gp{<\O1}b̃mC+M٨Lj}9BgnG_5\BV!>$VиBA(Ik 5D LWH-qR-z\%_G4ofBfΥ>3L  rKWRq'>ryjV^<qpB7}A%ICq?צQW"4f}PGߖzH98xhƹ[E'.1\#>6av8$,ȌPp>pD/ yY\;(6Z}I&;vٮWV{Y?-N.upub-:@u\XpY3~v_$"H-eaڶAh^&9 ! s4QٕV\^ Dڴ0ߏkݵTM.Zct6g56aPΣ) ~g/`&3Pe\_|zZrt=z…B6BmP2I55^߇W/E P_abLz 0j'uD dF]ҳK~Z+9glP`A|t15V:d I}k1"I>.n<|2 iRg]ƓUݻ. /dI!wʆ`4-RSm;؜RAǖt:&ePUGďA|wn m-Vm88V 4 ڔ՛ɇbI&b_CYZ& ?LP"R, S7bR'Ju.[Qj 4Fs>YUWgP5] aE%]P\(' Y̮0 Dߚ&n},+AP {*`U/OԮcT0r+s{Pt)Lsp%eB1:OLS~E W(5*KB/3nB^D$жOO5"p]k%UNVq~ F(w= K5w:@ڹVHbroq5rkDƨ*4)~,vJu,L(xy8t** ۯkOAJ,sOZzy<;4SVZis9(Ztz|5El5bWHGQ|y_" C7Cÿ!vQph-sQ3ިiWg(&bJW| lӘʤN2y}KGI`Ǩ\eWXKԪD1:Gc4 ր <#3)Z 2+VuQ ʌei]lt' "!jy5fF92Iݯ>F|D=aW$$ӿ=h4I-6%Dx{y!i>CK)$1un?sw$-7Y]ItA*h?l&5ʇTYv3ɺF=TsU 8D8-58eIə>U{]HAϿF次I qa[XY9E+>Jn.B| #Ukט2SWQa yE^&1;ܿ+2?鲈RRjxh}֐3BSyA-_; >`AOV!QJaLj7+P0Yb5;>O(ծ;/?:z-m€}8 ";wIXel(4a%(Eۤb¶<mi9YA6lv>+a_% LPZV$+("NIsܨA.él ,LPD)&-Kڱ/ rfKåZ|Ʌ;rS;ƺI=1Q%jBCPnSrf)$;v/dk)kǥ_uޜnVp:VD96Ε *ZR92,aa;f怤 u?޲X0fgxǗgV$(u*`2q!qHAlaoI&3Mj~,;,.^1Q}u]1IKfl6R>rbA.<nBdWD(es?DdU)']MB*s$hS"06m߂yՕ$V 択bU̞BCєv ApS{+~8^!) [408lfW.& ۰UuYWHW9ޚn0=`?1b)*3x[VE=Qٖ[C85&BV%9v]Ϝ 'Ø6Q7@`i0Tфd/:mq( dفOHhU ՆYDBNp&> +.]! |;7ԟEďj6o?\~ߴ:,g֞T-X/ Py^H޾$P]G_Vdrq$i!!٤ ~SaSp}ٻƼiw˶zM0l .95T]i9d-6_F7ٌ'md:+ő/ߝ؝]Ftt(g4("Q=L<ЫRҡI779k[DŌ4l|;.0}D`ԌR9cRIafS7910;;wbVR6"đg60;VT\UY"F z;S]7z6Z4V&{;qIf'GFQI?qkQ[?;_/lNtD۝7훼c!MUڤS_h,gB!inӞ{mo}:4"W5I#]+T/)5]8`(ԩ>iL@Ha RgqM|kQ Wo:G+H^O3BG+yБp.VL@έVO98 &Ϫb]Pm,bCl>"i f~ ,w!.]mf& #Im obշ\O[]ʜP |(EiG5hhVhL) !&6HA̅mۉ -&X$lHIh_H{f>= wQEM[Qtuw! D#?.&Zn"I렜:9gRqR(LL{m`i!e;|O/9 6@v%DieJo,f`Vzd'Q/tiïJP*ڌӌ+"SR$abBG!~iEGlvmb@]M3l<ߣ`AAcXWD()xE/J2Ekn ˣ{kŶ >)e;c/16|7P5#r^OlVAB[FGeǤYE0C K2;:8+@ ]R٘E1\OS+7KRy_]*<ǥ~hEU$X/*Qb%UJ -!XӑJ{b`%^Dw]9JgdW?s!(G$ {nPm`>6?>d2"$xh6Vgs *`FA4T]9 "Td ]~ 8V3^ hrD\kbBGOE6K_Q2ja|[VϞk aqUk4\ͿU4"+S !wzr;y ёhG>fYDRt.xsH~+<[P7'8.4^mj y[ߟkڋqi@sէ-O_(9>\N\6Mf%H%JeШoٝp&3Xo.@QlMF}&Ax衖8o!.FJ|.s%AdY$ZgiKfHy''針=9jڅG<<'zrU;vwf[(-m^wDQ|nkuR2L: dž"U/7Э3 ;0-zNU>uLǻ G+)z[&!cE_?Y'9V O*#|y;OfK'bu¢45|,CŁc9JmPɏ y_Op=ޫ*ZS>N;GVoQޚGGi@K.~ H.A.|vw+2Fk$>}#inKYWl4.>{4^M sż hdqI&#\DZ"t 벍QfeI}[j ET~ìϳϬoAA+ZK LN4ݤRw &PUI2`F1^|2 AdA4[^fS1@׵lWy*kSΚs 9}-ZAeݿn*˲MYYa8L1S R\@a{k8` ero{m;JOոTʆOaVb]=1Y-cipʁt`PKMeGS.$l! {ZNT }! O4CEGٿOwxAxnhP1Vfyq2>yqYo`l5n9+qNI-1MJ1Z'K3$:\a0Be)k7_π&!SM_1wz^C<2 "KM}H KDO,Yʱ bU'5Dr!v$ %>>" !i~9^=-=Z`/V'/ nYGS"\2h4Eg /zFf~46r]g8rX/Vz+mcCA'nz43yW1فBr> M=ogTdWZtLwu ~ 6 _%lR:m'nჰg[z^w]olG0TJeIث.Rl܁mN0RZ˺VMpTVaR7/lxb/N#@ĭA>kHj|#+1k,|O G%o50R}%(OLFvh7q;p:UD/.":7 +Ea2P!:4oэA$2j\R11ivةԦ1>#ObxK+7!Iq㩫~#ԩ7dW3/i$N{ƨn " h(`2{̣Kt{%{6pp &RTu~f!ޠJ~Dce:!6<$>rVBOJTQiMy|DiH˦rCռnF-!_N9%QqB06fвbckk&53heE, ^""5`eF}`$xmxyPo1?{pi N95l|dp-̃  q %apje q[Z<#!LΧ+5>l&,gd[kR`@1[MF;qR8Zc8GqFodÇ 3nl#麜.[dG@"fLϞONm%o7@qc k8R/85ɘC'MCkg7R#:gxH< 6oUbh$7c!|KpUE~~t&6q;FjyAo BXOyYXJb%B.B1Q5+x^5diM݀>AR'g.JM *1;F0N ]4/I-vʒx*VAT΢-Nk抵c"?yyFAL#ĥaYje1wݓ[_,$g|ΤvHBO&+XU`U IҭhhUhl愣 kL"N8_"HԬͲ%sF2WGZL g`*s?Ξ+k,3tWjb("w7$>N: |_5D˗ۏ*>ђ@y+$ymbgQf,]*w|E7S򱺬ihtԡ1K'&.r,&y\?7w`VQm yhqK16jG8=qv.F^?AZBWnY0_q3LEDA9cvRZ,R{c-M/MV/$OaWz."8&kz/&xH}B ide =>-yP^$2k "7+bֱF4c,)Z@C [xC xGpי]⵹w<2q$zW[\WYJ(cIJۀiga!kޑNu|Û.|K&v7a|&ȲW~vodF'⸼d8GΌV1t̻ok6R6vIU 9gbl\RVSAM4%ej+0cT٠yFZ٩ե'΂VA#p̫n(4JʽИ ^|?PpAЩy:ʘm:sR*5;gQ.~\@4ΐYߵ1 ]RL{Yur `` ː5Ec*kEzxffhkMd6nȱsHScRwdt3X*{ktn-{\P8mW7ڡµ2QّYQ*yQͯ&>}` Qmy(+\Xig1C!EN2]XIT,/DHl%;ӂrbI@g"??^.,yѓx4&- x :G 2m4OF!d2V3K*9yWS㊿u-M\Y3Q Pv&{&jkoc硴4+Ak'DF'StRJȓ۞|Y=koؔ75_ Z]FdO9Uijo<`0nHlj ^ 6KF>6Tyۖz .ׅsw*фz鷡f^`Ҏ3k wK\=\n YSkATkSIDOcS*~C^tϑ~"q|*G]2忌L'SYIJب)VZ Mgnu =ma/W<2NSy|SloOvr}-?#KtGpϚ.#Vv=fOeۘCeͯX(HбOɟgB`/@ ;RH55WAhXm mQY);HE\bp(1ۏaxA"%A[_=!SӺLN BZ1̡]tF=)Úv^Jt6MTT>Rc;k$[M7))?>B9!*(vqu+Oϵ6%TݷG$c+Ws 00 Cؼy( *ra=?#LJ%0αB%Q.R"WhI:rg>On8)Ĕd)Vb6!xߎc8 g[dCD@8c4ȐNM SD#,eh#)^Gj ؏w\m_q/L> yl>N/N̷,1eXO(\dȕ9=Ϙ)r gjkNTmi*yk]ԎIcsL**Uzx-ҏae97n)@B]$7Ih>d6(<O'-\VkvUHBN%n=Ofuwmd_ |fIoP'J`F=sW C"Lz'2nFNŒ5(n. s eHvp*@C4E)UvGӔѢ<߿,%r+Y);omhbJl1BvH).ɰⴁ2Vzr_)  ?cIդ*W6E&.}5[>zQ\H[S*T/<M֝tW:f&KcIjbJ> rqW}AI+2Q0P|0cTPdH(,DD;&=]E& S&xFxTsm:uIm8U\p @p k9l/ 5W 2/V.pOri?H:e}B|Zlnrrݬ_LWi^ﷄu6v@)uŨ`$ .+V wSqwz)6:iGXc\>dX^42D,ޝ`m`6m(uƜF׿3Iorl{W̯c_I-kv$x*S=u2å9VLNy.l|q7_(>[) *RmGUU7 FdY=`KU(2E~HgmX4$tpvsRBc$"] M# jp* "p΢B"X*w9FE< W<3 č}`~0K ЙzB8ZFbYߍC#NIw$v}c8[4P\X!:|o00|kF%O˲,zsX%D1H q|+ ?8AeߑXT Nf漌]Uu %*9Pw /6GŁSpCYR1vXRvΚ}ώ!j('߳o$ga {2|+Mma%$#\&/ye[ï`Qor:Rr ֽ}j9?jiz7?Ґjޤ̅qCspa; {k?za-Jqb{1۪x҅KNb.55a 'Ren4$|-[k Bhf1!HD˾.UVa7hoyaK!${+j[q`nv* 瓞8pwu:UVNLd箅>UHB/2L`\:#bJ8(E8;̭P'Hp1o\yg?0C`\=QÑASem.:Bg:4nFZuJ)3ruBhi{>l>"C!%OP+ oW'%RUfɣ~1/evc㿔`i(_G ifѠi4DW\r:6MfGW5;[et/NԙMQ+ xQ@1±ly(֠6_P ^qǶ  30cǽktdjd(Eߠpޮ8͵6s$\4X! GAқs< :,nat ;DO@=۱>G|+4GC@9İ o:xAY ߑ?ŮwڣDŽ'1!arF45 qaلdtX [f"?xa.3&e$#MR[ BEqbnGJ^s7R e/{I@"! :"mEhDAz{g0;yʙD9d϶WOI,=یüwMj-!hV'_$5Z:1Ms1o50 @"gK$c 1ajwۀʼфE@2_G7d9nFpEƈ~XzZ Ůh'zz<$znzBh@ "b>9-kGFC|ݖۥ<<ګNjf{ln2@? `4@nRlz 0| X7[{1!XPpe&<` zѪ˚ CESpa{vUO,c\FHye5 ka$P E#KUhJme{RC^;.1duc3e; ϥ˴2vC|ڑI>g&#B/58W R0Ï?ZtKb)O:>2"Mo w D~g+9؝fS+QotGcn((%d9~{C$z >˞AH3 ͔Rͧ-mf0~#upӤ$3B}^NE !~c',x"wQ٢fQ7{7BG8JiPOΌ4UNdH[A ՞Xc%lhH c}(Ǡ^CL{'ǚ(P %lU%pyۼnq:l gEa36 떛yPd4-&Tt 0 X[$)R}4sRJ:1c,ݤ%D^7bj5'Rt *' B0k`M SQ^0e覽/}?A %޽Tw\DH" $s =}I/r/0/̖ogՊ~έD QLA8ZEH:ٹ gĕqF$[H3:j S02>C:SIP%Vs!01V Ҍ%@`wަ}˿Zɹ$lݹNm՗B[2cU\&\3c\vWV#]N3e6!mO"iIُ`<6F̴.CP÷ɁIA}DWrYva*BCxk><#߼fX Y]ެ7O|:F1`&~#*kC&ALӫ0"7&w->z",rGTьd +ciq\ WT J?pƕ{gHco?"Vs ѕU|D.}Q %sqTZ\hMܧU#8E # E1>6Sw* Sz T.G0^_bbb)dJa=d"[]:ӏ<:y"j`N+z:*hW݄- ٗ>0Х'6yTٕv]lgAQ|nF 9҉e^?s"uv/~7 ʒҜoHG\jSO릠lO*9V_:fڶ $K#͡q;\x0 #)X;'!}RS^}{k\9L랥NۇNJE"4'&j~Fs3ƙ3)S*6I0qVj&+9񷖇jhJ#rRwt/>|Gc}4as7=*!,jV"#Ei'Y:TDLR}(턂AaȤ!of#;4.GS6( $Aje`&wy{YˠE+wkGO׀@U 2`[훅h DpT~-TΩ\e"=Rb/u2ѿ?&5Y-xل 5γ#upP H (x1HF霭"!|ҤEg5Dƅ$w r97\ZdR) F觕ǁS55[bM\F->7@+p4l1Mj]BD0gZxRB ò?쵏?K[.`eGJ*I;o0}iH.qRc-(&$p00hoӊ®0rj_T2MF,ZGY ?Nތ ;OqP؆,) tI͈f+☩ Z'>6?B΄lY}vSO wW<¯*h1T]|YI^dg'JZj>Wl#{jLrxLDsS|#$COG($ 'w73jOZ^*0;PBVs4 EbԝlM&Sةtfvs3 r-CyRB5 8_dZW ؄rV2i,bq'K; X=7HbbGg3ߴN;Ĉ&v@,{}T2rN&~җ jh2poO (ĸ!CڜQ_a?F2ѳNL*8qByS#Tx8+`^,+EwIG2< b6 $M ޳5yi傣E8,6Jt{{q;g| <[<\ s7f1 4I0tY`iAWJCߘnn+Gض,:Aq4ο'o2M[k-hv5`^xCi]B(U91^7Q{)֓adjQ&ѴGe |z .~˱Lˠ5N J(3UP{4[vK*JͣIvi>T /d|;}#Uf_( 7N[Bxё_h .yA&@ M-އpO̺,"oHSt?]n˭%^# -Ż;1UcPGCZ;o51#Go#PRU?B;Thzmxx(D.:lx-x{TVOr+T"ܥC ab 1C3\rg)D_KC9Hl#f % gxм0G27Q5p?H?o=u ߰ ;%N6N7eC TE@͉\"dQAQ*A6J?vOIG$I\ 8kWn x+r)o]*F{'Gb{.BV3NIb*B %M*LdHF DM{xWٞm#4G]Fxib``5|R2+WӜXiT XZl_ q^$Hp/<;܃Nuy)2^!'[dY/qIqXY5=6c@"wksupF~1z ~ X&4d)x2.5V J'E9~zb"bQ5T^z3L|fp HyC`-R8(5 E1Of{xLgC$/*! bY#b\,.eν|ˌ2 ^K~.zK`0R{F$[k[W4ͩR )#[v=X Fuײ0"'7dJyi_'ɒ|uNlz#Bg@-qk!@+g7]õJN wju|;1a2t9}(DEň3e2nXerQr>conN!S$X#{T( ^| .H!c dž&5 cНn_$v 1x^]Ns\rzӊsy?@ɪ}z:\(x}ͣ$&DT\#p.%Qq`\]b@JnMjL}nN֨ZvO,s'|oە0( v(Y[#!tv;F_ʖ=Y/.NxaX|u]wne.#&}\-v|Msڇ-gZӑ )GZdsKsHERzJ;|8 Cٽ-_0 my̡)Jv<ڿ"D \8&߮ZM^Aٱ$W;ԥm:x1sٺq*ދ۹|~:BJו!EՏ 'u_Zbs!0%b^]=u=ϲ u,gUkoo@9<:O=m~ٚ=¤1i-)vBRls4M}aů-M ֖~B(7wԸ`h`Vf?8>[Oo _;꼇OOb4Ů&g>gL{㵽x|]G8脦5 s,ПSYVf6b&j(dW樑M0@Ɖ V ͦg\xY0pk:6,c iّ5˛sFp~v}[ۃmV& 옴g|_瑏Hl+EРw~6@Y՜elc6ZlsؔyΓdgM=2lyVvPt΋e:ŃЮ{Ql:cS ]0'c|#K 6K{HL𶨻&#J6CZ"a38CݺWVÇ;T€> DМGyjѰg<7@6Im9 ݍۆ>_D#wMr!ZJ N}Ɖfl)YI:c )rnĜ?WdV] rnYH޹|:Nn鸏?}eS DY;͛ȜOK7X^^h YZz(F3wV#H5M❐)0m>)mtzEM~Q[@s*lFPaun+}57a Cj:%X6]}49k6.*x.L)d?8i;F~ S=vxp>x W}@;%:!Ғ+ zwng9s?_b̊N__yۺELSmsn$J^CyYh\mq:)٘s꘱Y;?ap/6AB _8_KhV5-NKpNePᐱJp2E"䠾e.ìMШT!eqrj~*0i*.Lk%2M#t ݕM0@`ox)|JM%;uHTdK /W[~Q6bo:n@a;-8Fb?l`fϡBι oj+u0Hd@nq ~WՒ2$#GB`[Kn~x*{`vzpWpW! 3k*h(ች:̜czfRZ0UUIl6ﲺpFkTFL$j] xcruM!*L? `61@SgGN7|lEO:mWP^)38ܕs ZtaѬqM.x&N [V ;k`aʸU}V A(\<\LK[kui3C7 =ɾXfd5qFÊ4[|zσMb2:Y_Q"8Ǽ܎ ч Ş>$1k6 =-cW2'RG}~$t#Ȱ+*A7pֆ7p@GBolQ0LT83.|r#xd뿏q#3!_b`V }s٭%NAK/h?gƤ.@R;HB< +Wxibo-;P^A>} PfYnm$zxᣑ,z cJ'%Dj Z`+|! 9M4#X,X<3rn^$!GQc]Ĥ\#JxͣE+Iԋ,e4܋ܚ+ǀB}#"7G/VIi5I'BiwҙFǠvY7Fvqpk{L1KJLoNuxq0=Jk쬍Irz0!;v<^͹IQ9D3 רOX׍O ,ZJp6OkHuHxPF,RP]~*ҽNuzvk`twuҩKC%s5&@ ^ ‚D3o&Zeh*\n~.K^{+(iuCUQ͐N,ۺHoZG9nʐw%&etx~z쓹p5>_nrxc 7rb$c⃾)` $p۾l$14K3n,UiF/l3x u|)Ԧ󆊋& ^l:R+5/|f,.?{~/؉0ז D? 3 ֈKd\?z /Kwg^@hv oR22@t7Ɓv͹ZqY1[Xr+Ýu8[ ?c^wP0j볗f6 ݛ%oo,BX<K؍|k&!ƈ_[) u[ u?ܥQ@dm{~ݹph҆o|{ۂ}@8 :ϐ&7˞ r@O1.C?,ţ< n.u jD2+?kS,Q:2L)G4<Č~)-}OѬ5`-RjO PbI 9jH\(ٺ&k11nT}R{ڿ0y@4e^_gV1і.\d ?[Ʉ'A6DAbu=u(KHn(:/-)OjLl֡0,ƀ+'(7邟] _JgK`O80gwK)b-N(]L 5N-LJ斏qW!9,{x0 ٧dVR4r[aifLjTV`ֳ) `wb< '҅\_ ΄ɼ*(_iv8|/J>Ik2(skrg' 6qZj; l :6Y. hMD@ʉHDoԭ^?Bb$e#u1#9cѼ̜1 ˊӱs|8X#ߋY1yN65\~6G~^'+ZI[sQێ^KF{,){L=X@^%M y\=|*zsr286T ]QKz &+WFu誀#T5 e$ \[ չMABȐ)V- ɳ68q@ ?jP຃=9D B:ridzOP~@}GFccZHC5?C3ɦ[N FAu~<›aei-7(<}⺗ Eo|=y e˪sf*:0R^SP>V𳼽-aaȧL(0< 6(WmV"H:4!U7M0uYY9jopìτy2gA (wˁQ8q9z^gh6I  bY=̪&NFa<X4qמg O'8yw|m2;,᠔:9Vs>o ?2Xe]x_U#GW&F;0O0mBg9u|d`!,?ψ2Nt 4 v`m67# L ōK['gj9"(*]ilſ8 p #LsN nQj!YVI_oG>Ҕฯc-\N5H L\=)8bR}A;ޱybV7{Y04YA6xayu%(g-03!^k/I"Bq((X<@3' r>z <a2l/7lhP ?8F~Qdwct8T*ic&nȀZEoo9@*0OnlJ ol 1Lu?-$UtM,,=vmyCtژBE9[apO֘">jK %b@2[: mXn}4رK+,\LX֪d#o^mtYGO,dUo$*wMbgMx{]a`c*&#hW]#GSF6QД8W;.1C& ЈGQFfHD=/Ӫ_Z1 xVrSݸxr Y~r27$FGp _c<03h2Fؙf`S,wsoy%4Xqblx2w@";1$7\YӺHiI'| NFqR:nzl5?h[>3\;hZ'#D`v "pA(z-r :§ǩuinokϱEYsU%>rA~[n>%m7Kc'A Q%Q3}WiiUKqEƣއs=Vw p|d iѺdGHSNED^ȉjx%hM8XI^ɥB> 蚣w@\Kn|oQYXȘ",vz V2w|rў~t~<`jkC-B d3]2ɵi]W+e4hQ7ΰil2 fX*G.@$c֩8= Rb6lBţ:>4ߞ VRe1:K8ф,`s}Wٝ MPvr'qqӨU'X}hJҿs6v|L]~/N#'H]|Ls_OB UtiCFi+P})oC+ @Z I8:YW6D(*wk"P&p/E?_?4J#Ԋ' yQ5\xUxnL5OʌtGNm pL& u[7țkWYet| 8d:S,ϋ穢aAƗ[V P̋15b_F}4[ ':4 Qa17<yE*_\kIhmp˰ G4~&cP#h+OBUB:8RAjwadͣ .^|w.mBnjE~a~_cWqF!h0.N`آ́zD+XI")SECJ(s%n?ILϥ˄nQÅ؂Fx(?'l7 K8t8 !jCo}Inٳewbbhٚg;3}{3 =V(ee3y皯s'UY7ql "]6[J +yFpGI‚d*A;\>Ζ/03 P>翶X>#w[j* nhqY"~Ԉ>x*X f<; }Ƴ}@`vDLܐI1p-TUt6MxU0*eBFי~36Ib&`E92Wt[~OC),"Z%mGq]jVՆI][Sp˩q8侧W|D1zXjֶG<;ZvFHc>z".q^c³'꓉hcwT]A(GeͺIlkE؁!A|$u?t'2q.d;us>ٵqݷ={K3J5?b #[%ޑ-}:Uu$3<lCWxg_/geב6`Kz= hWXVk GggIhSD(ScU%ޟe'ά%.4`~Kb\ |eaBtʨ~mgL|ol'}#L"@wt])hYTsa1_QOǗRC3N=,Ysvt#_;VjZ|ZŜV)Myѩ>54j-@~P0Dzש>+j<Ћ؉DB:˗0Ww0PʬO|j_9g}G<6i/7({L`76y`lq۞u;LnyՅJӎX3K<ɹ/ΏlaC췡+T~=aB=?ۤծczs[a USB `yJB}d}m1#k$t` HO&V?!%ynMtL^VKL# ɻ"PLԔKJx ]Sn:#<DIgDax@_RE_}eTƗ%91he.inl+]߂Id%YKo)B#ֵ= (y棧9{/*\t+\bd7`x]9rI='׌%b}Pg?{0S'oFΎj0)ީ'n(s_wczvɬX-9uT9hkvqGk} .Wz qI)L$UN1ˎ"2"N!MPTWql_DHW,\3 $`QKTMX2 ++4u0 3u Ԏ`Ypo}K-hX|8Sd{ rXKk޷hmSAYGїQֲ"CQ[Җ ns"W$A1ό \'ML1Dx)'[2aF"HlvGsqı[Gk镩;rIk3\2? BH^4(7oR,hNO zQ6x?\"A/"S, @\K8 9kYIS[ fO BpH~Udqզ0D%f)'Ԑ;^[J $?u1q@nFLb-ZrZN&yC$"[8f1$2InбlтZ!(im & *ԓaP GjFnCUvK{,ǴV2i4!<ᤘx#> xM|xyV'Ľ3+ĊX6q>Wc < [Wy8S1{fSJ8'jUz]:C@] ֌ QU!Cg6"vۆ3?S\rA44e9PE&~{S& ŨG[*&Fn\5)ދ”T`{| uaDupXׂkߐ:G|$U)zov2z4C5pAJܶeX=͋Q.a#1꟤vWu']@տqlk!p㣹^4 FSӒ}͢*gNs8=`}N THa~ _:# P3jCs=;Bܴȑwx5(~xxB* 5x?`ᵳW.ߍ u#h,+]&wj:v-@[:Ps~*06ҙ%oF =ڞ s&0kg~ ͞M&,{oRYIl0'"&>q]f)5$?*M^#|'啵 IZR^Zl7@[~%E>{p/,qIŽ?1QOf9OL[.JP0"=woWRrOfI8D6*Rs(xc ",4(!)sߔC4+V:za弃}M K62MŹʨЎ % S\;yUi~yw7՛3Wa3 ӕ8X ľAzo[eHoKf2LH!jm柑hkC_p;rio1(Kæ/xx@-nU2ˉ է Gwj$7n8p{_0"s4fB[u0uy (3$%`R&=`cf6_'^rPD[qOL(p>FG8ۀy~F!i(y0?*gNaE2/uҢ9`vE` E=dNWJyEM Mg=Nc]4O!aP ťRvS!ŮҷEwr٤P;ۜW41܅-بٕ<5$#qSYJIcA>k_>xcr;"Twm_R9`n&[Y=ߠ+4 FA={D3 9Bo^k3^&LNQ6n[}h1"3nh)[?ec:HWK90e܈)vxyM8ȱ|HKܵaq1Ķ7ӧ8>+;8Ν^K`StOyS#((_r r8EK 8 Kgma tp.'I I6^%]AZ|)z%qEp 8)GTpmٟouT,ij7&XZ"R|y xZHk9;>g₞ӠAu E)RIJ!P(C%MBZ%كn 4@F֩> 8+<#WPڜ96L~0 ilnbVtϜɸ݃ڥ 62p>',1- 0^`c7d-Us['=%aZzN=Du5/6WDV,hk%i?341J즶s7aIdew> mwP.k͔LAVO!1NRY3v\ijG]êBƨUۙ]^h<_$xrƀZÀ&$JRXX77շ^)G͗iRJ/̌Y_#Oar.QQ)8diK]ԼgƦE>qU?큧jׇO~C,o&Hn;R.g4M&daI2!5Fj@[Jqιu9٧/_5!^ `!Mps!DM[g{)Qj!t4;vYX0Ftp׈IZ@N;;\e}Ϟ cG.`Hſ{}I-,>L* R.q*?h8%-EP)0aW|k =9|2wiq:qYzojʱ=t{Ti{hzY ]k%& k0BsfnigÏUn=a? !0p3(sfDR+nq少*@ں%LP pQL+;iaJ>":qaZz3KQEH9Tqd ⛾ZF0\hMpmITXo7*0i瘘U(WZN[?8@&}DN>Pޒ.|<'72'Qq'as4H׊1]+a:rLM`ʯ>N  jGŠMA! F.!(O8bDH=3ff_΀d9|BqeF3$|!M2mYcdTwu;몴9_E?s+H7 iy};j"i-hD!>$0~<\tGź\SzbKF%ZF%t@*L {rmbc~U)3|-1S / LeOky>=TXÅoBs|Sf/0^@MҊZ躍ei/dkpEʚwVPB|{d$Vbal 4 ]lłKkMV;sRL虦p&{eSOH|ѲVľxq*,1Rw׶/v1i'Z_h{e0θ%6jvVwYʒ)OrTbY6g|{!_2Y;@|B ~zί_yyŞΟ"zؑ9/]>%d93{b=d|Q=; 5r%NJiI4WqzvHHK: sJ{B9#tTZ wNl4宷yfmxuG[;t+!vXPʟϸclkA%2RII-iQ.p}WRP]$kg.h#)+5꿹ma̓ @D) m/ġ+nc63aژM#<1~S#Q$jVa^ou ~\#@5*H<8BTex?Ɨ%hYx*;ڻ 0MN&!GG{3xoZĊ|4Un(_hc˽nc9V=*lҍ@JAo'ҵQKKj$&d%}PYH7owPzCӫ%K_Oms%'o]F>eª=fȺ ^1x&x*i'D mف;cJ kik ;4!dvXR 7[G3ϙ=klB\J-}p2Օtɯز3(~'$@t[>.g7EU|/b ^Ǚ8LxC*?Ļ+Fp|}f9=j-,y԰:+1]yH/oNL~tA 8,<Ts9$m:6ҖʴF-hJD̝[=-Ą |Ou A;lb>p)*&sL,rFqw4,z?FiD;V5a5Ȉ(?g>z1(a OY!apJ~ ں7 Jw{Q4 !?krr0g h&_)yQ#"zJW^|nrv\ ŘLTgiP8t͎?zkB>u/P֖.#"hȗsgJVvM=hc70h# femo[|KE ewR(4[]>+)+ tWx1j[~lcLHMkxʘp<&ʻӫU](#{D~ŭ1˰FzS""GU9xg@5g\O!}9 0Ÿx(8_ ԗt (/wUPzU.w&(LLEZzk=eZaX|IvҰyK91Y 5GK;.ܛ1)w+р/ Rx/tK&uolN5:e -p2So٫L܇5U:%1fѺ;[id,QKNyQ[J}h[J1Xy`ZB+Ш~m`2 0x6JR{#^G %9d\Gh4 6B7e۽6i.$K oʎi^V hJ Dųm*x,)CHΏ{d%" لIy]v\ 31@gﺼTJJv]53eJ}ƽ(`C52uX>6VT 挀X9%ZZx)&3-f0KAi)QVD,9k~M@ZGS(/߬M?eyh֜qҐg][>,ǻ]߻R0uL`2-J^c>AXrg+ɨg:z<N%V+OnjQ3|!}EMح_BIq"b-#O%&߈CeUe9Px[]:0!ګ/IniGLR?fnx6M+$ 1`[PR=L}}U ׵76["dʼ ֫ t;ߵi\1kzT]gakRn:d}[e?7]2D\I5P3 /[/M0UBQ(a͍bq42eӪer5j˱(ԗD $g݉rpW艄 g*V Ts7"}!5T$usRďbj! /^vE)˴]Z[ o=x1k3apbv#pnj\TrOF•d;$z< 6hFymϒc. |z|*}(>tg;ޒ(Y?9Ȫ7g)b" `a*U͔bTtdEɟ{X(xRyɹA'G1N>Zy8FK"w'c0I7C)gǟ 4HY^TtWE gbB^U9 [uoAcƐ> "[E`ƾ-Η(Uz&hO-Sx=]ע>0*aRsF@q=r׈2|<Û?6LS&8`Kk&,*ii fr,;ruQ؉?eMO媌2y.d*3Rکr9y +sxzw\9n6ɸG\\\5p0!x2mM ayΌ;@mz?[ chJ۷B,4ory1GvȍWm,{i=$D-Q Qx$[r9kf^6}GY]"VdCm'Q'5-n99"ڷ/zȅ 0HM'R)iv6a%U%G#3-*5ɋ 1?w+_47 [Sui{ʩOU!Å l9Iq">~G I;gygFuyuU6{E/4w5"զxyy~zQ;ڳsocӴ<6-3|ty4P37Az9;QYZEg!H(EZ޹@+ݳ(i`M&o^_|$t +a%m,v1)&:6)y4ȑB8, ~fFy7pPЁ›7Muf<#HjR 6LkTuEa!H+Ha]L!=fD9 r+kѽ۹30Ϡ *w@1N!R%lt?SN<:j&lꩃꍾ|uUB3KDs0z ,Oq>7qCDfodXߣO#^y.-fNލ^m1jEp HhdߋFD̮w;6 J+}Nפ7@3)` ~ x8Xs!.72⠵[I|-bX .K}Mf ]\+DTE5q O ܭk.mZ5qL.8$6؈ٜ}gy$4,%^ %j 5s'3Dl@i-<*kޕ:;\ۓ>i}PQ,k?e Tpe1s Լɒ;p'O 1 eE_uFrs* n$:k|s+ LSZgCă FEB>J=58RBiѿy0\9|KYP fG!ZHsj*z] c6#ڶ*ҏÂ^ot[+B5S9t$WtQ'׎9 a; GK&{ opWcYU5GziG$YK4F?ad2Q}!|EK9[MZ/˙.yS^X2׈n5Quf]NЁV|#b藽FX 2Z^{LL[n7|rt#!: \,[C3\`Ql(R˞ې&A }90T5vK\ڹK| ˩:"oRݴF+麫H[%V-yp4UAu`߷ryJh ğ|FjgyWe== XLLp2!I-4#n j(yY(R)3%~?OpGН畉* =KtL!UKR^ Rkzƶ1 lpW>R^IJ>t<Ր, ^}Յ"_Dߘ2s~rLm4<nKlovhL"SNčBz֝$SbAM r UX,IzIԤ}86:fmxK}G7<u0]9Tr!a[7 1~lY1uQ{R?,Z7mZ#@ӪoQ,2Fa}PZɎ.Ta[0ېujm:|w6Z Wd12%^0D'{Dc ,h0L=Ko%ɻ&h@5⯿DlLvEY8ј8=q`sj>o¬7\勘ω r?jWy7NvL&S/׹;%H9,zb[Pt檊Ǚ'M=1i x\f*Ů_".롼sXJ=Yviȼ~!hGݑ|޼"_#u).Jr̸.@-^Yۈ),&@qSȦ@:sBˮyMN/ =T1X"^y>D[p!@æ)(G[P37&UF7bO3UR՛6 . PVGWSl&3 EJwDTIXNxzpPaXuJnWb+b0A$ZIr$_H<]櫎5'I\3QnIʚ6MGqYr\J,xO? OYPhO$ׇ Jrr"- fD93<6Z KysIzb!RXUW2,!hq?7|@f̋\~Lu ))@[^3gٜ9/*QwD[bZj i!i;cD)vŲBxH"r>A=Aɔ>\I9_j'lqp~:u; yFyk)4vGx+yx/2eYN"&"RYfSl+ެ7# GѓnEb-CYVN\%?-?W: }Qw}RHIT[> P pp@<'q'&X="2xdSJ=Z]}k]F/lxqx+ק/(8Z֝hԯ4 -RNo/ȻNS {Wo7(/;O]:؜h~?uhhčz 4"O2luIV@SFM`p](4cQ}r.%j1+.!5a"f]_Q']%W3FSq*TqA_J)A! S+Fo[M0Vx7!̱nX8!F϶ YtOŒYTrP%gOixЊ舸h롪&tgA$TLI9gt2ׄݝN lZ(n+&(ݺe6A eO_Bſ1v+T=M<+qUZ-eBTg$+Ʋ |pz#8ĥ3 K/g},ܤFC/";0X>t=eMexV5n.5)ث:/,/ s3N|! 9Nm#X[޿̔r>&TT.POQ&և)~{݃@ɟٲq9R5vd7Β!Xׯ>@-A rPٍ;^ (C^yVaY@ <(.}ݢ qw=ÖA?{@RE*Fs6) 0υ'6: @T(cG 3kX+}'VSFк!"w~Bc̚7Jd@<2#$6#Caz{&ۺ 6x-ŝMv2Dṉ8柯⊩>wZh'$}}W,TCTaAKX?Q,^OSO7Gph:TQqG  ݏ5pPU2ye@sWx?Pz$уI^T}KDRUyG-+<@CP7Qt!A0`u1\g+}@a,-_>mL9͆Ht/u:C 6  (v_dʄ w0t_h^yA \fF]ֆh"n_ CtN< g4®]ho0 :]G`"צ6t٨Ʋ<8E$&K PA>HHKW /EKb_H&'Ac?{ ,*džk9'sR#(q,B%8 FN1)V&QݘqN~ܷfvہCf[f-_c%lkI7hIec1sjA@ X#n`/; 2Vu"u0Vĝ:9ChU=9xF 2_VjJݾK4oWcmdžLdž]|7qJ$sK.QpޡC-M:>Rj!|p*Z. 1&W%;²bl+vMCoD bh3(m{aA2*И[85[o/PO\VQ] Am|jIn^ JLA7A^{Fӡ㷙djΥ׹_¼MbëKRdbO1{}m*fٹo= :jH'tm3VZȷq10hocLw\]2bLԜtb~BN rf]eSX) !NAO5TYs;Y v)Q&zeϻ4Hrŀrs0+Fe.ԠuK;P_C$g4}KH2EaSY^2tHDHcU7>X/Q*TAPXAi7FyONX 46{EU}d@3&X`F}Wjj-\4,W(48] 7]gTJ{a37"eku,%K@% 2A*j '-(FRq t"߯!;ƴXD [tOLlYo_Ȏ72sW~ZBx?[/2 + Ro+(-S׉T omHD(i $`/'~7+aw8|fm֜1ӊ&Qgzʪ ٓ~a籙W55r:zJ t=&4 [#֯&q/>ύR]8;hl֩+H11\fu̙k5~5owBޗe%xtI]Q$ŋ M/+dd~b=(NbMҤ&N&ai} ؼ JcD VW̎Eck)"_>-ͭ[F8h[/}а:ƽBkޅb7rֲs# 90~WҍR* 7I`jkiC?瑋i1X%θ>Q=#{^dMQ&}4ˑuګY hˡgHqGmڀucpwuqʉcH<>SteK Ȧ÷) %~P5;YZ>)2|A;3n. Zj9流_M:ggEDM+R̦ lvʫ_ AOU IPWr[b2w3+6kE@lF?}Xc:x,<6NG{^p  R?N0Ayڗ]њo|uD/þƳ%Sfbܨ/*~Pd#z^קt'L!RpYXN m/)\X[ɉSG堪w8GyQ|(RG]87F^ܫz $em`˛t|(X;G~UHeq" Fyt۩ r`GpݳF#oPPh^&sԽ;r^^I3dqXIèk166gď0h- ({C~I9pBrj-m) "]rj8zx"4q)lV9UwcÕ soq\/~pBQ" W ^˫*xPʮS73^_8F''U)wjz\fV4Z&O_pT=!rW3|!,>`1+;ka | ~kD](6*SNJYeU,ԠU@hv"cFBY}j}a쐻\ kkK.3z:@$O+.,F<ui\Bff٪HSUXSC\=JL8$*Mta ? i E4I3dO;6ŭ:{y:(u|]L2_v&66Py X@4A_?ݹaԏyZK>r,<&&8dγ\  c>0V8KGpZ,`7jI2튎Ջ&Xæ69rBءWWK: vY--TIomiyxn4{|~0%2e:`yB'$ERH2KN(T=DTglӪ u6'*lP5Cnحs_H2w+y,v+&o~es ζOf4|aZiZ uHq´/@bv4*py9î}6FK$`˞_hxi+9~' $:ůwߠil2H &ʧ*1#YL" CjUkdF^Y[ǯ")~\426\wJ,hPKδAr[3X}E/u$a(׀ϖn۟vO^r!b&`Qۗ|]o`N& nV!L迃1-6m}+sȒ[F? };ϤU N'2fcqKo?8}mՁ){FxWo %JF"^Mj!pb;_nftL XFX6@sEIi.&:Js&kĊo(wR_FuAHfIA$@Tf@8h%a3J!P;Āfʈe%#X݂5mdտg.%7N'5eӔHT[(sgҽF(]Joh23;sɚ٠|K!]E+#iu#lf.r{Ͼ|f-,):*>"A|!9"1Ci0ź?^^6ڸ MJSL  CIPm{IQl y0 V F.^Ȩps[LGV>$BK19/ v%)*={ƮZh.MerqӡH%tw>k3E$32%Η2oI̯+SZ?ᚎǭ?H8([BbMzCSDJNư ɹ|U.ɍǽ@'5wAlg7h"D@CV\k]\u걚#$3d%PW{ZY.+>mB`?5X@NUcagÌ`>J*h> 5M*MW@zgVP%HnXJۤuK܄P?导$)b>&aHq w9nӨvx2]:j06lzf.:Qp➐&U| @lH*+TEx-@4Տ*!I+Ze,~ā5\U2&QO r"98 єEbޙ7p2Y=&f[ZQI1- K25Kח_:CV転ƽ>e(hyɂn~@4&Sxƚu:nϕanZw0*“ ox;aԻ@-*Vr,Ke)89z T`ɸϥ0h܆VGfME+> ?(>TAY_箓SԁMODоX^0U9˖ΪHP"(E3z[\i y,ȗnnвH7|(G"h?VXXղEGԯu#;bACɳQ^3 |9V  ? ^UIdӒ6T=~v_@P~tIX:d#2\B_vUv𡅪$${o(lI<^m%@"+_bEGg05U&C%>gc;*&ALcy0Ν()VYw"qK*<[7 e;+.,ϣ} lE_޵&e׿p_ JA\Q.gism' zMP٫*B 1~(iV_F jqu'пc@ܡ-χ\?A5I.ƣX3$UHo -0aor2&C-[AzN0#gEsǞS wNHޠe`["tY$V]sPҾ @Yh[fsS#LQ`=$aj`2M* ) D~9`.&TwK2S(ӛPċtpfIbUwYu&}TMs,Lr;LuwZm %s KjP6XN.Y6 7M@';#|d W%>0uXv]ǗVdAP#0|3N@J^%ʵ^*d8v<\c5#Rca{5KO Bu],^(`Pz/va FN>k FNx+$*w~.{ 7:Œ(:*R+ZmH./#)ʴߚ$ f[cҷR C3^hna~1VDw2Q剐+C/9ofrJdJ;Pmk>⪕4P'( >zϷetTN,g Wd<-ok,֔Ord :(Bnny%:;A{>Hu٤xz'I1!uaU%N,cha!u>vDՏ*%u~W3Z7=k\% (|/d2N>N끜aO=Vܯ;1">4iaVOo} JiQJZ@m ,c 7k7J13D1KyZXk!,6JmPRڭ"fN4m]` +YhG]Ej${O9b#tD)&BG_tըFUcm?-Ο&F"Xŝn}w<&w$ӥ0\ȄZYA=LA]2H^kueW+t KoQmil5#E޺IhS&r*:h^̾=qyJ.i6 hk\9G/jG w; x#>ҝE3UvzC2u8M!CUr_6/˅?31bxx7#YץdSH|#&#Bm.[ʆy"Waz9},]&I4Dr)ickrł<x5YFRu8CJrsz8D"N^&\/EI+>A*S0y㖁~@:֫x1g2o|6)Z.jCniW]h[6 Y2醦^C9B}/z\淪$a(p/t_KaUN?붐9 ~5^(xJ+*Ob+%8{(WtomIN]([S DZ~^ *1PeW?iD`3^J@p#x@rʖS7+|Y[mpkYg9"61wE8}ql?\5;p= Jx'/dÕ"uK@- &LŃA*ѝII"|oi=ZT?e3誏z+*v{"ds4 C+&,d3\ TD譱J17V]|5~?VkIϊs.`_eg_a!+C6H#KOpd-1hkG*.L-/!Ͷ'&VV>[)敮_fhZ{dTreg!1,,F[Fo1r gAx D_,! kKPPvI4ʭ6AQRҶ b z֤!=|ր`[ /az&)Fs)}?θ8X4j0;Ldj5B?P J~YvT@J<mgYߵ`AangPP_B=dCz%UV6Sv86Y<|E4"?@q·2&(88M\֐bwas :m]+5P淓?i!4&.~`=H1(V i4TfKfgpP(@Z5JfhIw% V7YLX٭sȱ'H2*HeL^C&Ppy6C=]/ /22M gۛVބC@?/ $w~3cˑKn©%+,δ'힚ir|n=^cO#߀E\Ȭ5~"TAYz|4ĊL|sp;YPDY"7U:rT tᠭ d5,Z* Zh!㭛P_VEi| 1@|+z\/Nv_7)BGZ>~XPJAQw-sJ͞W[uL:?A꟠ro{,R~{~ew\>NU,8SpI^6wwA0PȄ$Y Ů9e tyLiGK>αgL[lWfK@(WV ï.!cL0ڸx_t:bhTQt}m =M@^#mQY =ݞy}e~ ec9 Rr\(b21/+ҥԄ%7iW!zEA Q.AO#RYEB#6 KSZzi(/MM{:oAbvQ3Wr6=#&~!aom# 2#2؅oןt&0{urtP$;zR&iciᜆ?a4-;˛J$Q%R @54?g{{% ᤆA L^+0`k^x´+xf!7`eыvzN AA+YVHR)O.'w^j2Yш/8ZdLQHY<1?'x&ْLyR LH%0]g$tL2҃)hQ*1#`hFC%AD)Jw6~v Wf&qمӶ 4c<<%+Zf1v5&.PD yPq$*G@)SĬn5J 2)+ 9%JF(Hg$a cBSh,؛cG Ԇ4Kp"ʵ60)"iٍ]G%jmm?Z!Y_Ǟ>M`a=Vӄ 軽(Ƅ2E\HK}r'ۺc@ҬIFD,IPn|(D+)IQ [ۄ ϏFk,lJMiHҵFs碙1{)+T"y6B]˚/YiaL >4oJZ\=|&ebK, $279}e:QQXx,$>ʔ[WtSDnaAѾLm!Cd = ;n'>I]b6:s񠎿y+ ra0HwkOω>xbm-ee:Su1xp*\OF`oV4dQGJm g@a ?[ѐi&HsU $yKerGC ~oJU}KI=c?V:7y)98]4:7f{'ȼfSTvznzdXyd5FvC5e; ˠ%E75ٱ?^V&e./sH!rro%ɯi1KcxX_$2~#=*,''4MMzfyՑy svdVrOnU O J,M<5PUڝ_2G)i`U6)J:pS[]2rf 5MxQ 's'<LiXDT g>C hL] iyPHK'uu A|Y5n hc?wh8P'}GcD&bLT\ 9h^ 7_&+9=b h)JGej/{["Z7iz_jm!t;">g8l~bWHmOegI`m2~dTp:W&ݐ!"AbA$'[<27:K~n^ר(WH\?9[SkXuI~Dg)m0Z CCQgW0cOɼbͤ+k+ސg_%["^?b-t~쪁!:6ϕ}&? 1?_No9c%}Ur ]2祾9x|ǁjY +}\B!!!p{ZD>+S+-}!SJ۰vЄB:<+h %?}2|ijC2ő6:wƆu|/t02I9⸂I?q/͆gxXQ_zr XB-bh( I&tTq=+J%'iy٤YbB+e0dLh=51ad25hhݔgK JѼGERV`rܟAGPwdX`zTȘxJtL%[Cm^?5Tk6exQJTZ7@\IG&l*$E>KL S "MVXd(.DRA/9y6[0q@h=Q^PM0:2m-j}Yƃ(ÒyR6*v%!́ 1f~on$>c! Q,cAZ݁\5,C9TAa7MlTQ^/)uVfoc*~ͺ¹n.*bRm_NmK"~žOGp_g}S\g?XCSSyx2Kmߐv̀6nABNZoQ8ܽefԨ^ gqЀF9𗢅_!"^u`wʔda9@˟hσ`A:3M|*5x&iseťmt@[Bƣ]kjx4ީOg|U ``U 24&A -jxC Jcuq-Rj p@V95zsK硿|8S  +ဴrXeEei#||<}|YG&[vv#3hrjk1iǬ"y<n(1M]Og0C%i;v/CzXSt r"$-4 %C\y 6PeH_.(--v HnW1gxqļ [Zz_JaAt\ֆ)aDjwbUs;s`vTY|,?!_Bgj`c*hGp{X\|s,6a.qYoj,I9( L1z31`fkjŀ7+~Q(aE|j TC%ZQ^ے )#~iA5p\\ĸ%&f9#Bk47QxXYP,@ ;yb _eIߡguD-!O5wQx.=&O#.],G$DEUbIɩɑe ^L<ʳ߹J f'!/NPmJm-G`evؒC7!3\ʖAuQO2¬Pe|̳xWGs}W 2}nx[9̔-͔5&`#UJN}puy/0 ^`dg@Hp!c C7 Vl"*R<Os"rSuvשE^f_اyG1zMpGNjo#_vDp zjյp~b#pT$'GZhqI{+IT[tZQ-*C}%Kտ, ǥ!!Cx6+̍CSv>jzS t+RAVPܬ>6`Z2 |򶇐:M1*=2Jd\vWGqcü:{AOئ@nbfغLs%X@VȐAxrh΢q "N56C)z\F*S zZKQU c'&n\$ΊK益[_AZ36EW Azׇ ЭnL>AJ+񮄭7<3S>gl^~a_d7m 8-P=87c s>\!6dA_\TYڰ/{ 4E4ŏה#`;7SaX߂rТ$BIf} h˗,}}\r|ozmrtOc(fJN3ݤۂSm͛4g[X;1/K#5kU2oV\F)UwH L!e"Gҕ]]@ ?JK( {}:[0[ӱJLs! :Oנ~V\WGscYF>+XUK)+Km1eLhe0ɛiYڸ`!švf[ϓ1IE90J59G0"N{i`l0#RB2P mKZ'Le~i !H@aa6fLy Fڍ,a7*NsKDs -io+*\,Cm hS `Ǯ؂ŏTw2; #'TvzoG mgtF?-}uR3/nh43%# P>MIzz XJ`: Q)]Ne#UA;sOh2.Po8?[4S!1nbرN|FǬOPD4@ W{@xcqȇk 8= [D|O@&FaK Olܘ #q/)Oׄqh]#RGy uJ2o;'C i)L92:=T̉ߖ&q~XbAfӊ1b|XLiNM{+&ۺ] -<+P_!#Ԥ˂=u_Bҧ"4MbaxQ˾[.\' "ieFP9 mK{,תq~,SDAlp LYmsԅG0EP+dŀ<V-9K`PL$j;2"P_XY,LxzH3of>P $%͑1"QbDq9 !/?;ҴM{ 3Z~]3𒶝Pꥊ`cr~c4GVmJ} TJ%+gW!x 5ĎkHYez t&6o5VWA ˜l"]91-άaBLKQf}:v%oTc~dfsh&ԖéH^.İ7 { ǢOtN(P"#c&s/09u&|tvN|pPKH+GNzre׼Wy`6. K-QwT@D0j$%hGۺI5I% dSkR4c{'`-^q%M4 g& p &cgNhԍ+$0z-*•_ܣ"@_MϮ.3ٸTʓ aȬ/GNp B&GX2Ht#]BFPW J5LHi{/*lnҐs࿟3l2UZ8&"jq{ g;T}積sakpCq "ЃqMa_r|^gbfQk1u߭LS09G\SF\`XvF2K~&Cdy{9bS6q.N{a[?Û׎&_٢M>VұC@)NJi_w U0BΆiT,l3 0IrH@)lYOոKr3H leNe/?-CBIf},-A ȨE5?;@=-ujU)]>\=TlDUdZ,' uPU%Wr037#G+Աr&޴%3D,Au+wpzݚ69WTg ҇'GI$,=(4 xrWmd!>kB M VcQ:lQ|cgݟB|8F Lsшdi^Șj;ς̥\d'QByHy5G}O""j 34zׅ~ˍ"/[M[a%B^Cz_̵ %f+Ј0!ҧ63ML2v?Aş Ѷֲ4pP~j<:yo k0i)/y>Kaa 8,՛0i ^ ⽸vCz-hq:ڨ:xYJ׋qi|k#AmM&Osq0a1v~%!ˣpC ZBehRGZ A< Q-4Hy1lΑ['5Ƨ2{|/Up\c׃pom:?ſ0 huFxRmmCuˉBudw'񵡙c؉3D |#q%baa^+ԥ[Gdi$vum—lRxHRÛNGeY%8̫߿ v66W5V qLxvt M`1|)0lp%:) d똓bǷ-`D c)H Q&UD~2AL\bek2"`i[V fT >WS%nhMeR2FBtnKS#CmDYn^m}albڬ<}tTM,HRZ |ޡ]4؍SO!"0vllF?a,%G8FGܶ+y;DCah\=CNGJD;L?fF"*!3H3]MYOw?_X)=LlbmRbWkb!X@0V;clK}k^dΒKmԪX럂CN0GƘeWHL6𹆈kbuԻg,J*V"춐9ӐwB.ϣg=(ۉsST|YQ@7K{^KjYOMɃ:f[8skoFF.fN4N961uk۽ӆVgo6bn-ަ#(Mt>FS8)5}O' rQ,*[}DLݳ9Θ|, .;Ep]+lb FiBSv2Xi!]LґIu{)W~>UZ7kN227ܷk:+D.̫~67hQj#4Mg^Ip AoZkȧ2bVH1W]xЫg&#tv9*e0z/\n w/YU~?J\(_MrbtP[ݶ}4qJ=4U/!VQ'dW/! f꽅W$Ssޱ׮Ҕ}LG)&3qF \$iIF9DU,I9>gj-gyG9jQVƀQ'RB[P`rG.)7sns%i7t$G/ Z 2 >!zțu/ĶiiF$ yu_ t? )%Ĕ2"t =Z顗bN{UtafvMemai_dxmw&np]Uu|%6tv"^YVkM5Hj]GՍLV=KϥxB@aln_ evQŸ́/ )rHЖDGl 2r4b>c!qu+H(Cq;eP؝,,XoWEsmq>c8rƿ%zS"/3ϺAP ;(&#rCSpF E-d^Hc9_?O-h]OK5$ṿ73 O fUʍVOd;' ^q$1 C} yěۓ-Y'V }Gݍ(bCCר̿s}Ȑc5K i8嵾p.Hf/'+"_ C։xaQ5[%dfGY O[E0wS-"lllwI}ǧ1# kd`0nʞ,DȏϣJ>#d ($m ܋- 롅Ë+v~d8yÓ(ƅ!8 嘚XgCXSVaP:P_ӎf ٯn"~P|"[㕑ltc};]=Ϛ]g禋>$>p :T&-%McU<Yk2?Dw$v([ű[Ac][k͘^Av^d"){iw'!ML&ȳcx帅Dpk<ң0k~y]p(PG=CE-*;]`'AIBꍪbN&O7~391-Z՗#@Zת @YU  }wt ^/qzx;c6xy<:FfA ]x$ZҽM>`;#$2{DͿD3eW#l &ؗd4:WsT,6Oԋ0c/.3$Dē ¨HZd_پE/)dD0 &|_G/0U;tJgה dFv\3;l@ />sܘ^E!̿1q)ȍݬw$#%0\= 7qxlh &Gڶ%kϿa@eUNw,‡ATG?L"toyɆ\nZ%N GPgr7ґ &.cn_^qVI&2+_!0Q@/-3tq%L{N6rX["43s!Мn[Gd8r6(}!Q5?xgm$Z{yi9X9HE1;]nzp ˅ }]cTg7De%?#Ik]o(tHҕ(t O&F !Y 7p)9 œo6 {j~"1Fɏ@[VpIxcws, O;Ck6- jh;_YϑL\y{% 5IĀ}ժ[PwHOCQ:r^ttm%EimxH^Sau)в ήɋ!*+u5=`'|E!ҒlT5׋AUpײ/6+AF| 1\&w,_;.v̠U>(QiuMM0aݬ0ᎃq8gN.ȴͤ6aT,nȦJ[Xo $e?ߋMCWpK8e:R5x0a3)A;@\t095E]BTt%_Х ^8VȅN'Fl#-edd,05́/goa-S+Ƣ,{^HAWT,3پy jo!:Ƭ_e.a!.D_!M J4oGŴ;اf -*i>4 !ٷS&،]%f#o?ɍs=O0'Iv^W7X TmkS:vhr˽jTZ+A)`d/إosJq@5~oZ|F-3eg^j?>DsͿTJsy2!hߎDW ^.j,~!l &ZAMDԑ-:kݽ4iLJCB&Ql{v4k=_v6pDQKtTFDZـA°7]WUT?ED 6g-eƳRd%brlW+BS\9"zyV[3FS8FM~L_(ЕފR&`V"mTxd!֫6Vdv@@XƩ*Q bО>/McGq_.@HN{1!xX2绢:̟?Mc:5 amR^_q" L*}䉂-fk:g~ƭ+0RPfلFD˖ș o-cA`h)}qꕁ(Z`|H^0Փ61%d?G-`5'G袻Tupɴ 'V5zKur@Mݭjll!x6MM˝I4׸wt:99@NiaBa_~,徉8ƜQ]~.Y5j\D"e! ",勺@җԨ ̂F2v9!?>$D@'`hG2 8Ra+5?_ciZ?b*[T :ߩB Ǖt[`hٹTP|T0a}ʭ1/rX`j0j<2lȗI WLI(Q-Uڅ}=\*^}k HDw"A+ϊx|.N]8 Nl< |ocM $ThGir=&/eB5 O/jl$dHkz 1[m"fVaITEB7[^+ dK'FM K-f4Lo6 &/qT?{cGTBY"4TN7Rmnp96L5MA[G.La _lٳI$2 ; E[.l54k3J-H(H ^M ^9ypt44s t5rě{]U)a&LJZ{ FL %G%rY%i6%e$3Pcw~S1W98i]'m$P\ic5sɅ!OȱcPG"f ]yܜ{^*Σ+@@CDs6zo`\kE{["B^I0M VԨ.ΤB.K3l$6ie|Z!Lt 󌇠 O,uFMvea?_PI)Ǣ7WpNïZ,zj2X(އFpT8p53m!Rj5O~͎Xj9PӘ$KFԹiu NQ`/h\/Z9cd1B+S*X'uICd5ol5uo̹r E=i#8"A#{$Re/knA8Q꜇CjFEq3 Hd˴V3(^ZmmHzXqVυ0kPiK7L~ԣz^!#Z[Q6eObbyzoeۗctLjJY={egMd}^ k@gΡ(nVtCWoy{HB`ě+c|?SPbvn=$7pϤƈn-;vÒtCB@|[Ua=ֳ.ި/!(^R3R.VSU?"G1b\6>K+z9=R5jX޹rŨgz{f朵Xȫrh=BVvEv 3QFʿfꑀI+~2.b5,2gl}ѡ8U3# +9{U+N@aqS'rH1eVaHmʣB8G =|Q=^;3'R,sBAE*S+iX2sMipnB:>SfUze3ͿmN@(d=itW/ai/Qv΍`"B.4aA} { <X[طosaMJ8vfH՘5(Kƥ~T*TLZI(m݃~Q˽%v@MBք;R"9l_9aΕɣF 1U;ds%UQ몊{u]L~(ǤD*|!W_$fo,ۜ5wuz T-DeRX @9tjw&ׯebQmRu͸pϩ:a/_v ۧt@D&yv7D;}8.ИfbzdWzvK:"𸚦\C/w)O#y\%8Z>U@j/s=BNA1Iգ;+=KBI.‡ߋ L4ș6ƵgϢ^ǩt20eS"ΆW֌xW;PWu0(H2ȺNy4M^zRw{Grܤo+"eӻp,JBFuow/2`/|"׍#YߐWz,SA巊VS:! Ur(!JIlK`.׌X8JڃU?h$7K$i;͋Sqktrث̭ߋV 6NAc/ʎ*I%%V"ů$ʹNMh C';wٶ+i)Yj ˯w5]Γ\ F kUH19?r JK# +'Y'R9V 4CۘΆ;{3ތe_DzvjܙqYH/A^C_2.uoF?x3剅B+k5 3AhKI? x9 _?e= !dbIGq1U'I\M9 JȆvw/ W)zÇw.;cЪNA@+ vQ0iw9q^Ks;v=jd*cib ȍ,4r.{Dcl(S9XE4D*O&΢0<x*8 x%;.X)/zUhz,x-G?roog ct.2@p:^tQd.ߖ~/5KxG}ьTd0?3+"LlyYwuJ/?sDHjFAYpzw]qGsтCMfpxBUy'ׅIM6fuѰOB$خ\{biMi0ͅ6ED'Q |C[j~($ϥ6{K:ֺ.Ӑ@_C%V/׭3FEm|yzqMQ%~*Ȏ:bUp0G_Pp.+gϡ$#q6h,"dRzfn <7QTD2(uY&YkQxW .+ƕ -E'_ T?- k]:!Y ދg}m2ec={͓S5},0镠RDLU;k R |~zIwyy+yp[ݵ_G^>_lγ(DF fYtxnş8S(6|:b'|mFr|v&9Ӡ#H,&\S譐 Kjp}Fv2a ~杇UuWuhֺhx9k3O}^9cvZQtS(}p۫-T 5xD95_n*B.Xשm p؋_WYP[sΦ[ybXdPE1O舂 A MWsؖгf2]Lk^Jc˵ZNFfh 0.M!-4^G\A"΅j{zürdg12'6  ;`;][_y~ -=ڴ ǯD+72,Tw>Lӑ2m8B-P'ka핿xM 2P֚Jf. Ġd\.軉@ 7aZ=R_ͳUyD)sp'䥆GtnD${<{ zf#z1*`}|[_IN25YOE ~%3~tT^j':\իd$**x"(bv~^tGO\T#CGr$@gyƓ_Ro:-`5 Ҽ b5zXՍLRϏx\oQmz4ȅA(8 ĨoNl')uj*]`Ln#daw@Pu{A HRC/r=5*S/K.mҊi;2¥vA+XR)D9aD2qE2+-`O"[Wtw|Bf Ym8p:S/T 4YT~l~SKgu"js<orH՛p2 A~pI5h8"%}eY3.~f&/_dP~I{  .ݐ=ԻQt s5F5JeI<ku";xQOmQ܄ jJnWW|͂7iCza9o] Γs'RA9RG#[M[YRm]:fTNmқ&52]&|.iw`4o>~zGr$~/}] ygl/RP]oue?J&xQB;PZfkeDq}do19d:ǒJ->|`Fמˉ. ɮ-*]П} Gd OF\cG JV bh07`cMRۇ>2EG(寵◔`pCE Eݾ&{-"#D19Ri+4mFԸ-j9kCHwf۹C]>7 BZ`?SN'ϪHS {W;ωGԕ׽wgÔKH+BA|l{IwnyN?=vwf s XX K]~Pħ( \1}+Vo2w*z |e6O/A^v -U6):"T*v*_kM%ߕ;J fb$f H !GvGs) k7Yr8`FSZ^:Oma-]9ھE5+Ό9N8Wu9owpM/>%gt_.!VU,n} HmA1W%LFvV$MV<<'yuԌ4 -Mև1RG+kFիBqO$H ˽t7"rtHO g9ح!|2N eA~K]LȂ.#,=D3=^{0w5*X[&ÚϽUy7F R* QmH@(aRk$H?7$|FW_=Öa!-p(5ŭ ŐTL놦y.XM1FMr˽t^DcHH>8J<?2q`x6'fT3.$p(h8h)%er$J[)v}@:WCvZD4bM{a_,X_>`ޚ0 OC*)^I%rMm%8r6QCR;7JlU)uW Cs-f8/"B[Z3ڿ~a[ _ ;TK PIHߡ du pѽ<=+Tmk1&lyePsJ'|n+ËrDH]*/SeRχ3sGiXd!>ƽ`G^Oh !gR*Պ>w𲒜 ;H"֠y@~=_K㱖EOdYpM⧄1SC.kRL Yd1{cwCA9oh|{;5uA+K̥rNm&?)3y*:;5d3hvR>A"?$q5Ȗu$I<<p Mgc岧Tjϕo]J=(a4zGAZZX:~7,kU_MS>+JUuD Q_dro-AG*YB$Y;>r}#zjC{Bߛ.T_($Ͷjl!APWZ/+M+bfH-N~0 |:(M6_H%jx jDp&ܜ1G1IB]1E\w,7`ɳ ehL^3ZAsf i4œV&),gY!Au;c/%58^H=ObtEL#D1qsdTw\HZ =vugk +c(8)4Zo8v^OU ?Tg& ê)?7\oFS+=\x1Y'"E uSui}Bz#i >GqBM,X.1 `Wm1fż8 Iܳr*yg[[/redy)$4Ś7ÜԪTtXj_4v.gRU(NJksC_| WYJzxC CPOe@))۸˝9\cBj_R`M Ӧ-aQ\ 2|[/"ǨCq{7wuMj QHldlct!X0,VzEFDDץjQBn9KkR#B֧!>ijb2Kر3QqWg1c7\PVHE&ZVbP)5(lAyʁ|)2t/V?;1g?[YV w* T/%*\WyZ/'!&vK&'4&퓛Gns^@nFc_$br̛.ʠՏ4Y]Zڿ.d j@p(<ͪ<䔖*{$yt t*6e-P^g=mbIlcq"0h9"q\`6K9C\5 WpP41~L{vK'UtχV{fӥ] $3w =0MWQt`y4gЬx6gRvI9]{er), "v{> Fi~TG *&'Z{F&.TQI+}9ZN<)[y8AwV3J8QRxCnvVJn!/7`<i}`I:*3bZ /,ZUsiHqkc5& ^8MU㦏kDcEY@GЮG!B2lp6;w~vmvr TDV^~wo9xO :S$a*HǼu w* +.);[S線Oy mIGuIcȴiN <tAXa463мw` 7h]n|ش#b[{[{~W“l:3p# aeδx # 1mF06>!h9XeTB i{,!Hs7)3]q&jsxanI~C?0FX&aI Ga_Է1MX] JADްOw)|SLLʢ3ϖ%C8`A&UJ׆n N~kQsDзB;6@!Z E0̲Rx|902gV!t ߏ~᜺Ti'WTr2o ED;sL41dt_AJUuwވ/Zr˱@X iHAK8Y,V?)Aς?\q$Xy'Ƿ$8湐O0yz=N)62ȉ8Gƫ'a |8!b;Y堞<6XɩPsD!d)&ڍ[M!#2sd; U0 ?ƯD#^F`0F9JS)Hcn3s[vro Aw*˙(nWЧe j5xWh،:TM_xJpS;[lhpsrˎrL슫I犃o~oCUJz?(7 O_s0deE%.m{[p4B+?ظ[eZ7N SpASJpp/Im5a&FJ6؎CO&mӪ9U0R/ zo,,jq%O@9{wtx27/e4' aJ>awgaO odR1Lk9?JKN`Gprß<拯6I)s`m6=}B("ZYi  '{֥YT\J^Fߖ FvZ/z%,eZc1RsԂÝP]c4d~ѓo#lueԨ_5CI@ƶ)< zp>kigX(lE -?MVK\<͕[VK_|lH<{6/fWei.n k8LIǶ`d:W]G?vW> ʟᎹFtzt:^FE*MzVlw(46qW˒9W/Gqt(1rhRb$.0T5HV +O=#S%d($UtѰ; +͘[{v%]¸ͯ>0r/bjIX˞ |a~e ;~-B$[p FrUu`}6ޟhSD ! (FĈ<?*"'zŜ/T`;/;>s%D- TeNW2B^_X@)y,plOv_qr'O\P]ݰ-QI3X/ΦЦͻV֚Za]"R3=+g8~h.WKZ&|& ^7bn9 z(jnq ,ǴDk7 qkhU6?"m sʎӭT1<ԃ0ʫI]ԯ'=NoJVY>lKJx?{y$s)Bݽ DTV4.9oՄ lJ(6pSQ$h 0hL^bm2-bܿ4ܮ2.h;\Cp9l[_i<̠'u7e Ӓ0Pͭ1.8 ޲zF# al[\,%ڳk0\Ž۵T~,[RIJBMN bS識 vJ= b`h:R:$TBzPͼł_dR4Am!uNtp!SJ g+!r++ƅ^%Ώl@^T!$[=h}^!",+Xy >*=M?Cf&f^fdl빰[ .Fۅ/z-π]Z;WFUdC`̹quϤcos]Iѡgˀ'(:%h{%HK}.]O˰{PbM1Gz$HzBދBW[Y7VGS-//EѺ}4!33FR9w); |Fvz!+,a/zNja]Vo"KRYk̞q5 ČKHhoeGkEְdx;?m:c(CA}^ /J FFG^E x 78sem[l$|z͗;@¶Q0I4ϔ 'Sk+{ /HM#OrHWUJ+S"wbQ/v8ߛi60[.vX-x>Ő1O{{NoaY$J6 )*tsb<,Qjhg㤲LFO3%I"7C`= @aVvOZVb- @N.MJ$QpeDL%.5nIeHtji,LKGĦy^W p ڌɂ;ic9R7}@5%3F^_I3O\OۻL2YiH!VB6$QySxV?g|'$@zm=+DRڵ/SYL+iD K)=v .,\A4q;q渕6˜+iQ2[5s0uAzcA~EAݹ[a擩\ ?B>z6~ɑu7unKVm GYP^r뀑VEϵipvEɺ+\M4-ҵ6AvþFw-laOݰVgzqbiG Bl=bCp02SVtnFe[ATrX@i Akt۷=ÃLZ )y>}Bߣ8AtH4n?D*(?';շoC?YNPg5aK{O6@f&Ep>s<.]&X'F]oG@pj}ۘ\X}z7Uc8N$F9栎«2;qbн|/Zn@$]ΚM nbOaZn߈%EaLC7FsDž(LA9*MM.Bhcai]c a1}oٔw{@Nws$N)TtagYUK  "a.qcj]هQM1)vzxpo4dC17^HawS}o9DY4C-=8 Q4/P\ Ƶy[CC_o4^0$>Q r8{mz,VU7뿛v̱S`G9zč1?OAH9b^f}5J~Tρ/*/Ir)h oQ"̿_Nb/"Ρ%YdpE?bj#lWS:0yЈМEQ)[.+ˎCsxG}!Z,[a!='}U(:Y, He`yi#1TG…g4J\l~[}(-G#Kqx>1Ԋ^;VTA58AGW{pqΤ εb>$p/(Gᮌ-j#K8@u/EzB!9ͨCx]li)ԢrKt2?xRTP[g@cO;AA/K"Uy拪VB %eDo9'`꿅{%(t^|*R N۹FgٶҠz|wAoKA EFbPȃ~E{z5lz ^W%]h ;U7$]n~{1B=I jnq_oB=&)0_Fv4 Ȫn'}!n'<(FLJvi[!!o_sgjEQa+PKYL 1G#jBSo="\xK FlJ73Uk&'\C!t `js/OxM/3:b_jjwkUmAp?gz mu]#R%mRaZxiI<>]|T՞~oxF0 K]GMlI<Ԓ[a0v)MZ~`ʂj)Pe'Bf"4G/mrh.I5& G貙$iЇqE0oޱI)%Eޕr }"'5"}q?CJz=.1e£~?G54F4z v#`ը1]@ނ,6ãCӮJ=&;з0  ]#ϔ.GAjv e Ծ.RƧEԲHsR:+O– 7-^RO|3)e ^ތYw¢aUXge]Jtv4MzU B-f7؄7K%\Fq3W2N$|1RYl0Ci:a}19ǿO﹦q(:0ɞX>@-3%G2J@)4e|N~' 7[qls{-Ao.ߚ ))F М_"O"U#B 8Q[-/EJQ:>ɴ2fzsX51C?;ycǠ*#(+57ܤ}5|VGR ͵dϝ!1tAVQ΅FOv7F ҂plb7Ci&6򲝆”`Hmʟ@ļWCf5E󚲎1HGh$tsF~R|7 ;Kҗ2)QngNJj/z&s+('kS\"l"M0QFL׸cD_nrH/P ףژltn.V~)0s^ Unww'Y _Cj')po —vʋ~B?:n݄K6u>$Hdg^Nu{,(,~tf~HȊ||.9n5X86:EKJ$#uK6uWUusح.pa#si ܿPCy xFCqS4~M&/U!JFS`vAԐQX+ku[JD7;#lpL[R&ۅyz 3EMZ6 va[xyRu+Y*їoPyѽw:~X誓H˅bh @T16GmtieS',. Mr ]cll c,mJ^pd:Ƞ\i8e/VJ4&%H(`.~, `PsM1 MƎ|:`<'xuGdJQpө7%R>(dǒ69[H=p|x.%Ik1~p$Tb׷_,">PSS+]ݢKψTIITz_ +ڦysoYxWiϋlh]l,#nSaߍ?&IYwlC0.<ܺOA[aФ4KDq}YfIDfFu]=c؋]+aV9CrQ`+Vx9=ቢ3{ܚ>g[&yk$BN#p+y)3YɅi[Q/)Ӳcı)[~3LfIKж1!M拰m9WbS{(l^9Y|]/;| /8h5מ_ʞe4nu~ QI1mZ4fA.Kbc):␮FY\7\bCYX(GHcEgEXy=v*S}”fDJ Sȵi}kN^^+K=YZnJܥDC99ɱSTRzNo1OQKw*IoN΅ɵ :0bZWCU#lE ̏ Z7M dbQ;FG$B?0,]E\lnG Cx2ܾ1j˱hc%gH.a巸aL$SSC]*o+S>wS0!f(#C G=0H.OoC;W/Eltiks+ I*Hi0E\C3(\ixҝW irp$]y+D2ɩE"bQ5G>$kd^Cq=L`կ=7Gbe&7{/ˇe;6Q1;`_\0п; J-v%t5ҁk'd"pYt|`Ê Sf \.2ZR0wqltoߓG30{I nH)F9wb,c/P!exg.:b@1z[ޓ=*yK#P+2ZwQ eb>. ].>qM:0JĂҬYǔ{"'ufB!m51l1"i] DӖ.LA/ncίDzΓ?K ;5b E5 ЏïZ˒UNd$ٯrkLѭ[U/0! +sBn%^ |A|٠ĸ:u[$O|eCUL?ڬ2ο`Va 6~u8ktꡮgF5]!kǤ<__c(Sކ_j)?(r|ϻ^ UKCD.SyF|S CoD'(?%4 V{@Џd43cN'b#;*pKHu^+vU=0Yw4Nzt%Pm%r0EYBVW// +8b>.QGâXa,/}#gy|-u41 |<- ~#h:fCth⪙X5cȲ7yhlݴncL* & WYPcC:[@/#oTO)[~8wJ&_ԁK8g\I}lf۠ӑgF(N Uv:h +?1va"#.nG-D˥ [?kmp׍b|g# s,s%6npQ~2TR䎦e82-\<3o(6k65S µ}%&8"1Ѷ^dZ(DiÐ~@Tv_(ҩwPu_3c͆&!%0jݏ?sLрmꓓVfk:1%F⥧J=qeZ~SBtw`Pi*e2Ǎf MGa2̖ŕ 89ŮrTdM u|(?0XDȹ6sTЉ8?3z4 Y.;vw,rbr.L؝BMwPL4*j\ŅBVO9cɊkj2Vk 8D{!i٩ʐYY5B,@tAeѴzr`q l9;y[r4t78<$KD5<}}sh @5xCE1XA<6@&| ZI&: ?ςb;ņ/Y;Re,x]Xl|_T +Xtc}Gٴ2W}VԲKGRaX>dp,^ciA[%"m唨߽W%s,fp e$e˜= .~;?jA߆a*b3;n# oEo618w)>͑ASDwBζ.*ry0zcb yG c Um|$* d"04DYʬG`FRIq},N85ƇNe4 A~mY%7IG(շCt]?s)6<Ńɵ0Mϥ& au$\Lf/g 1Iɇ{34&Wm3pu7? ~V۶\ef`eZn5 ?(K>Sa윈($.ŘW&5e Lf')vj2mR..h%HY./!\@*KoV56 Rw <'-SOn>oyIߗRŸjُ4ebf 0kK9 ۑn]QqAL+15kO: rxG| ܼ`;y{ Sq "w>}(beajhѭMմ8e'"cS1 +>(H@XW:µ1$z*.(J kHFii\'ؽV=R4eUI&~E2qNQiUUQ!MZ] !ԧ"IAy㸴?A^ ӠsAK`m:3E8O!/T -֒g)mz0ByiF9hwcCʨ:"!舀Z.}UW-dᔌl! +Qj,>O+ْK䗜ha.%s\񼴃<8:-igz h.sв%Sřlh 8~ksӝ2t*Wܐط{ =23Gs>@|Ir naMOyԁLE]C=gUC?z6,lk|H2Vy~2RC+&#iLScAc)DseT2?s1r9cÓ t䈌7I.n=*x]'1pP_mS6Tx d{^U&wJW ʔչY[m1XR@CHC`G{LNblY~![/(0V-f &n;L懹~SHU!ŢA=>`h{}w#u@V0 i[N4pQ^M @ZbBXQg\;,;֩=>nn+NK6,ڕj:=1% yji?A]%:,*:/h!T{xI4[' I"&qN*C&{eO'=;f>U$((#Y>JVniV¦3-3 GLQ2a7߿!EJ?7r|ͫX "s>Qo8e1RS&'nN6FO喧bS<@I9W{We|JUn>Y^[8 |$ ,E2-M%)bz2D۶#9{ۤvLNLy36rabTS y Q=the PP0X`G+U@r{` dzj7.wUaOz& ?qe뜃vNaP)Vm=,W*$6nœm9Ϝ-L%;qĒP "Yrcz4`1Aݭ9aBg/$,j;!š4 Gb2ls#Τz|jou3r čD7XCF*GDH»>K/@1e!82!jؗ+|r ;l7XKSܡ&W>0!pP3]HygOB** JI"اwe> %,E)en?4g M+5=٤^䟵׊C-ԨX繩.DaM4qTbc$]7azBC"w1W,nXpoɆ8$,54"b J@jS=Xyjk;>B*_wCFmnjM}sW6TPIT ($]@lvvѺH9!b&au}PwK>& KhSCC'w1؂!;Hh.YSEzjT:EVL]4vݞhZ&Z5 I C#S.|6 zB/ٗ= oB[JQ,#cxo^u5 6d9ۗDp3v: n =YBy$oLdMmɼj-VN ЇgQdB0Q~Fhg5,N0,{]Ny)Uv ڗOGk! 70}R ܹuBe>ࡌIrsʀ3߶EWOHpo!xg5k(FS.d9_Q{<GƅgNJXS3ڞ):D;Ȯ?Cܙ %j1)vH8x?!ÿe#FSkx~uMgQn5Rkh\\RM I?x;8Єn S3&bAAellT?[Q3a|]r&wm)Ơ5B hA"^;2Úg}b 8~|~ozL8C'cybp jm^a k'RTl._&wړ+T%0;LN!1@0uāVxޙ~dQ3:9QyP@3".Eɘ"ofk)L0b%׌HS\2%sKGl@Pb#g'E[1&ЁCb>5BCɕoM뾛6A^;zO)v.{OshB=QXa꛸3c1 :]u ;Q3I*wLpbtXjyևĵTM?sѓd;Wu4-Mo%:9W YE:K)EfUGEMS1ɥzV\nl} g:0g·Ywo Ƨ0dvĂ=:LD?yhQb'N&*:$DŽimJ q(7d4J]ULҏj 00J>~ ݂v^Ԭu@]?Й?qk$@lMTLovYBdn1*r8^c%CؐfjFD5a͆ rRTD5oB@ C>ynr+]D)b$[Gs׸KqyzF!"QnKSj篮Rk =ۈGBHi"EtnśozqiV; R 命ҏ%AI^;*l5| J~ hR.; $ZONxP dqK1kP(ra`ǝ+F2Q1:"ȲC^Csu )"ij+JBErQwу7f[ۥOPF!w]طP]B4Vv7b}5P<u4h׌};M`R K}rT[H84"o+E!9L+5=p$.iHz>p`\טN'Zc,2"s%jEghM3vG N-_-BURo=B+iWw_`(;o"B,L&DJnb x s{EQ\lnbX5W> bEUp0c!4qW$oVH V 2ʈ)}-q6̶ F~`Iķ74kuF˳W*^)"@_@KH̑vѧ܊"\Y.V5 ^cSk8,<.|Q@0f [+U W#խvj+cXFi. BEÖ'ΠСr}⋲}3˛o}6gt$^0|CA x{#I}4BF &'lH~A&̐{Q2A$v؋ gVxC#G-|+6]Ja9X>>%)=|AM$.#I'-ilnrۂsxUYP.7D%l1ݚ5~$3(8EAIgzXŕyCALc9yz34,(8ZךߌH&YS T 勚& ;7=!TסTdz XQ#d&W )t$ͭ.θ+HhΝ8°Y U<;&qs׺-1XsJ\keYG ՙȵ 54qO4ig)Ѹw^XZHTkO*xl "qYOMX1 t:gt(t[BnEW :3X984#o#,\+Ar)ns+2vlm qܬ4wUw$[٥# @xS5VTZӷ3-< pT1,`]Sz_>Stuv{?sBՊf02(dxi|$7ąz dOiT@(~w) &fpQrnS_ҙU3ecFڎ)Հ?DrZ\*HI&NIv vRy s*@t'Q;IFJns(`[.|bM)}EܑY b؋\-m`e7 !GTM{غ!+n `scf~\;g&x)_O;!3bU׫{ޫXHNlQpg3,m#8g2gl#@fV46&w=#-"W 3@2KtT26ֻ ?٤k«. H~Yړ٣r:f@vC10;3unIԇI[`L N9- cPTIJ:dvX w_sVEZxxƞMyۯڠ%c"V)> iX1⪻)q,R ;Ŏ~ž539_9@@48wHϣTMpГp!HNS.$+hj iբŻy7QJr2;G& SV 'l{<CǑLiBoq%Eb& LPT@U{Y>%Jy]")(:bj@%gD2'Y8՞K] f5[aR$VĵQꆰC 50%|NFnG{Et?{ 8@t"`_._KPΡz WdtEgƩػ/D/ebFHhW)$̾Tܒ]"LU8o]9FXOsɦ<Ή ưdҴOJJ~zc_1U&IN^#x֢F3f"V_U KU%}!dkx[xWk =t,QC,lw~`;g.@_lFl< PZGD,mAyﺿO@ZNroڅny5R'lӽx8K('+JX,to9?ٺv 2=(5A}+hZ ،ysBe |^Ӊ|3}k|n`hXNVpD,u=D8-oZpk'ak=p[˅s6 q;#۟=NԈ_%fxӈ~pLA.FYkf@ߤn=X0ͶR6QKB]fx+_Y,8:K h5r'->*FGy"k'6G$88 Fa?\JduOu},)+6dc!:wm)*6n+"+Ձp 8}T%[l>F2+(UjK?$IZ@2Vxn;gqc(Jajpf_7H*9V}d0VҞPEĭDC`ʟp;p-,mͱw\ '>H@gTO)12u CN`=ӆMὑ 6L!FebBoQ4;AWcB]k׷aSev.琵*ԣb*z"V< ;ƹ<0er"g1rb,t IY MN""a~WB- ɂ=tw笨6}Z&! У)(^w8U CrAm1? tc\9]zyr.JWE\mݘ\U\'nu_o!rZX!o*8?6rM(Rlq4bK*B y?tי AOJpuGm~G^x2Lݜt$2Z7" "l$rfnŵ{ﶉ칯<ꐜ@ݫUE9dMwgZDO>)6ߴ8aJc:QVaQ;mTdso7#w씼FseJR`c0|ձI=gp('2/,Pv>R1Dg5(2D+񓯚\ #Dxrl$nC˖Iq2ˡ C,4"k vlBvFۊqGrY:'pZRt9Cf dvy q:p6*++ϊ>:}pfx 3 t6S ~>C(IДW "UA1>";VulMp"mW0VX5gXYv>`ÀSslv[*x`suhzwsFx~؂`ًqO&/wX?QoƆ ,qTbJF~%$\$dPu.#Q$*5_M7%z=-cÔ;C&h-8S>zcQ ~@,'79C^p2@`}n'c#]$by;^%})RW?gTzMZX%4ei'ò-WOf ctWj4>y[tb]=(r]X&91 OJE֜h t_z!䯳4_EI)mܿu]N$v$+R玷,/5F_`ǯM+xʋ0o,M@d[.jd~$?| V 3N=gH<މu̱(yyvg3XV /(uE3n bg gή/\O09;nUey֓{HYǫKT\͙=F4[jW칺`@uT9`tp; knHU)}dѹ&,PK6R(cLJl( w,q(JLVusy'b:<],pcpy  oӕq"<D΄eP#oek>dw7Xx)ɞ= syTſ>vlgţ1J}KYuJϔ pE?mwbxeIBO[07a'j bIuSFHA)p Cyȟ5Kfukq3wbL0Au&e $MIt,=´?}h83(yb$YcD2֓& RE@.J|5̓E]gNzaCz6%,߫/pMHFa;L u@YlA@!&Ǫwj-+0]m]ٹ@iE5sT˫)v撡eIϳuG6.A:mע5@O? S\;\`n}zVW`L&{fv;p m^?G#Dc2JAq;SUFn+.J/>xN{sNdʕКs+s&yv=axO a + :w>/Ex Yz2ahwe ,@ jMj$)0c\#FyGޚVT逧uWj&oΎI+-MYPc]E(/K `70Kj7@g&p\ɴp;۞N-w(dh}Te3Bs'jiun62ؔ{'lj}D!렮I& s' IUAG\O!'* TM,SeM*yiL™:DG%Mʨm^drӀlf%m݀Cr"]XU0ts5Ћ"Y| A/8TWALSݗeEl *m*RpYc%2=*+&T;(ғ{w۾sY8wY: ̐j.sK4Uɴܠ$Y*@T/h0!\_JқAZȠo#>gdFØO.tAwS9춖~je4xo8čIkco9'NYmu j$F] SUi)؋ܱMEX}"Q-.*7}d<'x8iS?e)܉ͿuvwՂqH?2Y`?ْ f ^pM2~<:!wfRMSJ琴DDKR $R2kn Er:?[PL9 Wbs7G\5܎Z#ԍ]:eZg#IR;rm5cRʫ fwX)[N,2c[| 1Lm%P@SCqOvAbcd&cod*w֐q6C[xQ|{6]4Ի.@!}l )hR۩hz:#i_MF>"AHd[C:智|Aˀ@hfˇwrtEUv6Y P>ۛs[ĞE Up&Q˄bS9' `ՊRzمV,m^Kf6}ݛ7ڎ^pQh~Bs8S5@z{yY 1z/i aj( 3V),׆!جiC2~.E]ZӍj"d*s4?_|N=x쿃I\m.g(n2m.%}[H'ƙ_PjHģ㼩.o\*2`sKO/{<< BU_GLauLRQ5PM|E{ yʃW7x;YkO:UDh+OnOn'*\]eΫq{>k`X}^GbQA:ۢCH;l]RZc"%aHc=-{!o\n&E`=r焯-<]cGx寁nfh" ^`IU e P MdVlǸO⾌0AlknxpL@q T k}?NZs !y8-FL4.:}uSsz$(ux4Orn^z9YpwAt:h[5vHӅd A&rȍD:$oiTvr{at~1APgrag O;HW.GWV5KkV QR;(~C\  {#/1Bi:sQ^8QjrIE)bk*;xˍU6/q Zz7W, Yo( ;OΫj oK_u}h!L6-zܻC*gPdJ˿㤻XA_ ]6%5&nŋ m.fmrs7v]mr9Y %"Мh70iwCV+7H@#c=yBBsq&b: a=Ž)}[p~yF9x$ΐ|S1b.vMu1SAR=.Ҿ0d%8|y) 8ho̾NUvVōFis4iM+)`TKW3T>c Mvj!djrQ8+3m A 腦4%-{ Z}AWӽQÁjHd qGVZ[4?SJDzflԓށd/p<V2X >ty]cJmzBe` ʥB3$4ϳEoiV7Ok(dk"$lx1C o"#dSQ +YuL.8!Jʬz^Vw^Oڮ^Aawʛ*1c˶;qEf!!"K ? ~a+# l)/0 GIcpFOlŶٰtZFI37^87LX!)Oe }0y+ќȾ0&N<1H}W^D /eëBEzRǫWѨ7{ZX1@Kð&(X!ɽX ? Th1=.OSX'E]tPUzgxN{5ep1;1b5sÞP?:((ŕmB^0u3DS13˭3zwZXE[ غ+"94]E.8 WEA0*{TLdl;o/&S/wQ_O{|{| Əe[G%wyPDJM}$f,3 5 Oʆ@X6XU%+v2BNf;ox sA$4S(VFe,ʍ_krҵI/ԡڹss|`|\#fZ78/ݍ}E⛳7x^O4F /GZyOzWKql.͆kQsІ`3'McTPX `^7v~ds ܤ)WZs8IpMKҌXh)&9y]Ĺ!~!*u ?КLcˌw1P uf O<<blڹK``׀j 8p\c\̚Iz=[MeaFn_m$kg-xPKD;q a*pԊ"IxD,)H1\sɱϼ겨RO/R'0]2<um2_1͆1@2]C^)d*/cyN#$^HRřL\~i*DUG-d~yw$OhN ,i5NשĹg9S>\΀yhj:o֫3bZ1Ǭ?}?^u7䁧C͍+5o%U"*q;t `|Q~W.|o Ӱ|2abпޒ`i`6(Ouu BWslAkVl;5l;QAk]EN x(NQ ^29|2elyNEm.c4*Z:O$br5H#h ʕ|⓽'*:4.hR$MC%ɾ2$nRqkr"NS -^]Q Se~+((gz@_| q&Ք"( r?J<v!cV{_I&(N$7ǩ^WoK?>WFBƃ7B>䈗`KLd}ٜqӞjqdncWT0Sof ǚAv^IX(cŧi }x[[~{b [şJ>|DOJ F(s{W^~#UC>dc8h7( =,8L'DW_WNAhcA2w?W/pO@j7'xvFq hãK~F?5 1=oOV:eOwҢ Gy/+Nq6I\wF+I" b|QB$ +s(gdZ32TpRXVݼӫYx`V`k@U ޯ&(':^5 &$r,_мʎZ(ftҳyps*8g^OFsRmyʍ@ԭr8xw.nzc!(`p}I6);Mw.#G^2` M2 'W=_VYW;~TE'fֶWh|!q!Ydž_ݼ=r~d,v IYv4$ċ! sl}5q7g-9dQ0d,qYly~<E8C9jIv0di؄:L|ԟN3)+%5㯤,_FJ猼.H!QHnEHc % 6.mNtcUhP,=bxrH yd26LNaDR#8SԪC6b[ <'.XR4ݡ)\m̰Hq!fE8pM-Mcҕf+^z qɵwe7\[9LugXAa;f>j+|Fs (~ک813H;%Ǣgkbߔzf xc=e*⨝̎]džMj6X,(F|@+Dv ]\_ w||f$пqKm1ef[Ld񷹃0Y\^h"eǔha~NpPD5[J,R#~}YU*&˜ye֝(T@;Ev{UaUF*aef ^h1A ["*N‡7¾i&NN2%ԯ2pu,7S:}Bx9bEp`D;O*LZcNLk7 .BX>s--)%SX+=*:M2T<(=ԅbKAݍYȰHp2[<}OLkgZtPT~bĂ._R۵=:TTJ iDbtFY,2a(2͚`jU亥S>RAjq4*JJ@`iH|?'nlY藛%^H8  g[&r?Ig<,]%A LEB!T՗(̕3F2{ 3"1h[#o+r.sYy<'1,d[5EU\7E_Hh^^=b`|O[5JG׹4iN?r P/Nj$ԙoFax r19*;~c3h81*3ԄBu犻Ku 3`Yc2q[mdy GhtM-{֢+o¦$qK ,ۏ1ʽUjMx0 ՜(Փ`ӑ/@M)1?f[caW GxءD'- DUĉ[9"3Jf@r=0aW_. ,ܼTbR`8"?%ЄL;{l#Rl%k_胘O9K0q>&m&r]ԯJIf׳B[Ǜ/#vhr0!MBؙ5|gxDhgd.!qLRZ-+gU^9Hu9miAb6^Ll<,Q;.}5˨кvu8EM]tErSno |Ȼ!vW[6*7X7]27)8HK?Ή-bs2Kg^L=K1K%lM#[mDҌJޣ+PZ]~m2*+՛ZOO/qG9-%Ub4Aܢwu] $K-*pHǩ)͘{=.ͦ ~wAX|V"_sPq-L C+g$Cy18ϗҐmoĵ;E45pJ5cEw %0{"ɪHW-ºIO^o;U/ 4_.C_k!Nm.&St}fw C͆I vg_xKs[H&;M $}KXaCy_2Z2ci ^ȒWx/-F N _(vUZ%5ZtE6WZ.kMg kf hӘG|]v9ӲO4`ule0ӄ $ Z5ٍ.N6E9ٻCsm FKMn1VQCqݲTjuĎX-%m9)CWڼr`}=ډ',+!sCE=G~6;6]ej^Zd@kY3Oݝ]KZz7b2oKx?vBZ!o=vůq½~-$\_!!IgQ C8\x`-sSZR/F&]&Ե3m_D EiVLE`!l݄eDS7Цz+Ae M|7cҨfKajUҶң2omJhXm7W'q/U*T)0AĤ 1xZ7VUЉO⌆@]hs.H1'4ͮ/L u0C#]_YL疝ہ;.קcpB5>rS 8˸IܢvRIgG.!c@S9i_./LF'E(#1y稄ݏ1L:]U`\WrJ<=,e\i^POa$P%KAi }\ͧ,(svksI%R=e?s)#p RTED?e+ZN08)M{;M<+ZId1Ԟm ¢ >u,$;S#CܻJ^a[`y"BʌHb@b=6wh=:BT@:1x`J 'aW< aJVIM%E_\YzAVea9*4syR2>CffavA>h7s&7kJ}=GT+J%`$I`x'gIba(j "SMT֬5}@0ܜ .؜jy@Ez VY\Dv1:-'rF6ڶ:jԿmdy3'û~@S<2QVx[ެD蓌v0%"4YG6. NB [{(_w! 3=wРaCmxjc~1󃞃 lzߤ9ӆMrۂdx O]F1u/@z SWߛY@:Pu|`̒dz5/~ tmz2H m2^B@'__Nc~0R3AhCwI>P][pKFհڑ)I+ "i죡6t!>N'zFړ`!!4j`ב_~πK 5sR=8Kщ$m*dVCNM>yA:\M[qYDsp 7zLoUB݌#XIxXb%GDǤY(IV $+c#V +)24Z:Gۧl*:>$9T'=PFtg}]5i a% )OUg so^{M?c)_#q$7ِRJ!;w*od\Q `;ΐK@)#`坽jpzYL3%ޖrfZ5en$1A`]M8 ~\MN,;͘iY3U@-Y&)DnrBB]orbK>9A7 ?F{nE[F__pTVB6y`FVȄUM;{hmHhOZ~sUssfe!BA ocVS&A&dӴڅU?ўz5J;}<^Ep-3KG_(}0O$9OI.d\wi&l+'K'OUS"x sbE7C| uX=5PʜSB5-4Lp%~6Oh,Btu_u;2CΝ9a((F>˲*׊&#LF ޵82tmO}4ݑUOI5xԼ7*c1A)n?3tDZhW/&hJFk- phT.r)SOS6Oi*CG^f1A5. H-=oUfH8nāƧku)5t zzέ C6D]}e4qڽsbEȄ nLdCb XGyC)^{8h!50 f_ RӰ{/[%^ո=Fʎ!h/V.IZD>Meh?B4W8/54Ocؕ-N`srN*7k[ $ 2\(j5^5GsOa$hܺ mٍ:cJb'vhV=XӖOWD07H-X"G>Q+zr=^r: oo⯰䩯GLOT=gTЊdjɽ.Vhh޿oзp s5kg`K L3%Ѳ34<g@!BX60>S:e 8p1r| G=ƌ(›(@ \fL:B‹E?[qUB%u+zyp*=PZ&%8GڌB.~/҆k+}iemPm?<}I{Tya2RLjt[[nO)!T+RoƷp`J^IY8dPHڱD.8ӜεӃo8(+BՑ,w nC`^KFg/QOrݥse\9 D,Z(Usmz&Oti<U?WI^zަ6zK\q \9ɩLnK"')U@} h/_JG׹g05XNo#d̅h\6)o⹃Ƽd8, 4_F6ZIJ׷s1~yKMi<|nMb1'IÜJojYb4}~Ʀ1i8dzsA(3 U~AsmNp5)Td^>X=kv  5R އ]~wP+F z&*lPE@.J˪KP$J{\ b]8Ⱦ#+V|#]vT}KCA}3z4sǤp fv'q`#cDV/z`F`[|{l׶v)9D`<ߐ"$ay8BX]zzT݇2nӵ|!\D]ɯ±w^rA"h!12Ǩ R O6Xp|Y b yv˖<+P= 9&8(pz.9"1ɮ^#Qs\5]3B!;ľLN+|&Jc$K4xCo16>qk,{BVN N69toyx,P“`y_4q9\cjW-TL[R!pPud1'Y;ԩ%|Bȸ?UeʽH} ̶$][ijխKƄQVxxe: 2\vP1cd{όn3PF>7K9!gx ݭ3 P҅L;^^u q6ho~@!>uي{vNyeA"'80)5yI"齐DFě8-*ye`_~08 {6tdG?8Á9|)k̲$jtF%?A7F3;q 4_sS_}'ތ-ʯiS;ck7p[Mo]/ci4P~z ,;R?(ӯȒ4uhM ؿW HXZgo׿ 0/~+}cKc߀w8aLIYņzy%b rʱ(@?h5Jv#vjPTSB+,[~27aNSY2nZ5*#R6&0$+A hvG9GKF[hOhG1I& b|4"Pd 9 }6Sr,Kki!`9"MS99UQq\G+ntcvl@$du7P ̹'ws H 'x;0.&?sWA&IIڐ-tJz;f>g/ W|# O9鱻πP/3ZPSgZn$d`ӿpqھƩ`Z0c-H?~|4n{/O2z|2zptQRG-g5Gkȉ! O]>^굣ЏJ XnK9)2xVvSLIgUdɛ_${7V9qr" V*|7 D %RNLb&d2#>4]*/hnARۍ.7.Q.Z6U[ ⾲: oR*YJ R۶],=\8Lha;8}(ՂoKWbحj)_ kD*K-iGF.Vnxf_;ҳr Gɴ$^E.`Gaƚ3FPd8ȖV X&J]bd͜RT;-쀶>2c{f dh -$n{Yi)K"=5i ުEAǴ{.-4THgϲ vLVHjdxwS]p5n^<#G3 גII,C#݄2X:g<]7 ~&p|I/}zPhexOÃ¥eKy~#̻!hHkjMz Q9x~(DHrGcu@/X~h6C1RPyV,خQ_#ysc7lj`ŹG;PhЛ m5 Ga`?$Pܗbs<"`(^30jPI8ERUu$G5ŏcquA-ށe{0בX6є2a`dgwo`w2Ng=m bP%kf~<?8L8_!2?|5f܄ X:wJwT0I:F| c(ϡ[*%5fv?;mDE t@KgܣvJvDn"[0EMقĎ6-B3'XwlLỵXv% yK)ی%t׀ %$gU0ټ*['F A:k(KFz)a5 =RMLWRٛMϞZ r1wn(*z fNȡ3]09 9!]_+TޟwXPjفe_ԡ(< n.g`L7Nh^0\k#SzW8 x];s2|uBIӵ2]tW;7x㤟5jF ^}/d ChI rkO{.7V h)} #8;'x5(1$b:6É īm ' ZH]Fٶ-krBYj0@$΁ے* ء΄'C h4IlRԍpP]gXȓcv.j^ S% eJp"TarKilce|\S7 p9o 0rP'HF Xsy%׋%rヷB*n~ ?K}Y7R9Ri~ݧ]e DvVNYRMC\}G{_3-HT( ;E,Me*O3vajBfMfJ+7WZx"75 Oz)TӨXO<+ w P,kǪc8;FP"WjdӒ|,06>}6 9a|E{'1;Y y\*_l<#GxiMᢅ2_ߟ{ZOoM @* ^)??UjyȰ!UBC .Vkkz¹t牊JSb. M%0dL%Y0740"`AHBBLl=2?*"(d%6f:3.dNγ+[Ej8xF}2 *'O%8"f(7*ܩфUT;DTHU@-k\ ,\],*g/PMNVHr0T!7;Xc`6a׈MV"(H8i$<]tD<K*=?SA=QWv2-څufQ& (}7eTN *|SK/OR=pg6G66*9 ݒߟ" ,pYc~5UE*"ş 7'⯶~8NKQ. iL>:[p8ny`kѨ*?5q~%㨗'./SއWi= ꟏&z LѹGݒ۴N^|LVjIkݜ(O@mFR64r7Z7߾|yYO|bd;ψ'͡B|l:*/x:-F/XS1եQ^tg_?eW`|2MV9`bĦ{3bE"\w=JtgPq{$M"]_P?vtRg|qso+XM[C&QQo韏SQH@eIS`rܡAv*;^YK ;xen55tǤfy/V ~ZDW8" * FvN`9酹sB rW: N72: '>9irڝ\Jv-$%a?T:w .IN~Dy͜ìS:QJ~8j"Jw A6g;y;1-/L 2?rK5=sTz ̞S1zxwAM8^KA. m"UK%D(oײxf-ˬ/v~ts(bSЃ/f<<}_=j ^w5 FLy(ʴ)k-!B-AmXH;JE0a ӎortA)*UJlY=9#GG|B ]u!z/8<1ɵwh(A$BL('5ǩI<0@?ZAƍ`*rwgЬ56s)+ J!dϻ+ڈP= w޶by U!d)ClBPBhJ+xا RDzN"9|K _2l G:QpO(so.ic~u:fi7 K`oN .OT=*^K:7OgM6!Ao.Ѕn}5`Zd7r_)NeXdR,4 X%A3-hjd4o v(2rBײ$S%ң@T 6 XJAyKLEK!9ǯ*V)M}bJJm]TM a[I#uOAP" i3 uТ+k^Vb<5C|&A/Ȁ޸LUf;Jk6g4I|D?C=6 c)Zu0L`/BQק?xz~zu"ˠ*N1q$w2x8^>ĝZn: qفخn zIL: LJ;Jq2!qG [}9Յ'#T=44 ?(5Kp$ޤ>6mi=l9t\YFJ?!|AJ}+D2)\-D,ߢt~d/$/mɾ7 c8 Hgs⒲%tO0nJ9a#8l9ʮKv^04 "s1V<`Twja~젭xz n׌Z3Oc#i϶7DQs}DIĭoҕK ޻)QZU0A;4MPFʷ/F,/4  ޯ3 oUU8Lu,E?0Kk?>$D dPREODN] j; 5{0a'%wt-HwH9 Smpx N{ }q É Nz j7,E6!;>(. 4ui4mn_t|WTU//|y2K*R.ڤP1ʑb̳Y, Isb~r j1fZs ,Z Lh Xnjvcx{1zpM` ({EFEu"QsmQ [T_},˜17X$Wr`!]ے) M"ٕڷ!˧|2nЬ >|( `{SyM5d{N6߁b`6wj^_ 4o"VvZtl}D}͝wg}RA,8 ;̏!2a3 :->) qH~ sI1 $KR 7O8I}#my\I+d #ӿw"^N9."A\YOik-6̉ v\Y(7o< ˥LlcR#\!Z`Wmή3O+[q^0:hvpkܰg-O/נf}v1ohr"i8'>j]JDTTx$ogG7 K0[SxNj+{+˻/T< L2M2$\bx/V+"8?قLj5;G^斲ĜpJR_P!TK@ űo*йhn-EXOw09IN0hc!sU?Uy?]a[]Zinj6\3&zvڟuO|c SixE~N82wN4.ʷ[;ވK$M~пgP C!4&T>EB 5,}m>a4d,_|qC`2M65ʘI 2DwhMe% 5;VQ$_dJ!TN8O؄-߃`+s61l㜓ztofkۋʊ-+ O>;ݞLY{26u邗ܦ}Qi0F Z,keUw̙0վEQvX"Xq}fivf)͘G nʻ5O遘|m1G$G~'JC)5fi\iω܆KUa)z=Uݰq؋dkr)}ž>0  H:#☦_`4Q1PēnL{r?HdNkxsj^C!8I|hD>~VF8v_=M@ZT!W,x,z$in9UQ(?-Nm dp1΃(7*ʻ o)ᮻ5'Nƞ`׬ͤ>C/7V{S9ZW&ae̎S1쓨?y Qw1|BsI(=Y~DnϼYT6h:N KڲͶž' K ȵi5qc' qecUSs-;9/fc7z0|=}:_љY''y=`pci6/Y%%W^7a#בݫ:cg1bqgxDEd)3Ho}hWl3%poK|ή%#HKF\'w**ŽMHa5Mph4rsz<,t_Y@UɿpO>+8߬ Gd?)a,Wcw a6 ]ҕ޵\۸Mo7J2ꃬ8f-?Q}3Zcr< ZO='`fF~"g2^0e>ǘ&1,ɌLBh}c P?!uuP>S# \|&ao_B[?3%z,w!ӹ)Lψ[.6ggooodɹȟ|^וڙޯ0%;5Ʀfz0O &>pWB/J廬d%B6X >76˧)p OTpY9;ɐ4ev׾.MUz,[d~=vaҧBZ[[.&n'l8{r9n9čjˁPJ$}PJ_xux |aRDgsB(HB=8 h%z} `"]J9gT [`8Ao֕qڜ}OJДP^^Wh[()vE|{ x9!lǒ 2INIS`qZ&ULE yEXw|> mM<&!_im.JHTnxܡg?A+~b3bhFy U&l.GXTu{c'FWO-0\E7{C1X=ti =eB.ޒv>PHIyT(H] tNkå u\R$ b(|K8&FnVHZ0Bn@qؔ9\GF :d$ d+̍^veR o0R2!>;}̹Q+ql=sW?孧/](,:֯$3@1Q袳ZQ'lS[ h2`RUHGti)s2VrxƖ)WĊP& Z_,Ï0Q+5S-e8"2܈=ItR8>Q#Vciݨy9C3qJ_l@GEZ!2IGʙv8cu'kFvB"tuXwxUyw?m+. k"mc6 l0>?|q$#Ly⇋aÅUHHYq1xFH;M-Yғ=う{Ka¸FeSXM%u\8^g1̄^r]eKYZp }-}PipPJ-!eYHCTӥ`]ZtjNP ͩ3RhMZs+Ns_e jb1D7n+pL +w__א"ʨrrI#1z,=7oڭWBJЧ"8s!\W9Qd=`ftG^k*03y=.H1(j@=B`oܞj?D:ҍ}KS#mgt`lQſx)tz *;ގbFtS9z PP󡉧:mUc&T>E9mU쩦,%:ʱ6}5y=٪s3νl1qN\Pyr)u?s#C9e ?B0/L.\kndq{Ezlq ȃ549Viխ(4@USC i_)^߷=15_pf>=L;&$J5/ucX"ԩ\VK8oaҁ@qBK-yם߷/$(h*hjzYLJO+#~+P0 20W-ϵ5X* Z. ,$f_Ό('(zJ)7oW>}8wnFʞ/eПI])}װV~TG,+.ͺ ~_MSܸ?K l2DЋk^LΜM= z۩t(}H&o"пAYI`.倝ֻ6]ƤEA_\ܪj''CyU퐁3p:0tu#]wM[yY _Q{fu' #m.Pp IfJTG2 LG{fzV1"=|r@_AV&Td=ԃK/s|It;uxD [ؙ*e|t_=P>73TjAPGGSC=Ձ8Ow/s5lf{Y_WhY:0Q^7FZm@Z]'6~8i nS|b=@C\xxIj:VL,*Mךu$E|B>5sԔ+(鼰/E*#&ؓb!6\>8H88H9~05 |zJR( Zni{(;h(fQ0نŃnϯFqjTϪ(B:/~^h3~ҔZ(b?OH~lDєB7+W ?ѿm2`܄]UDƥ;Oig-Ez*7T,EH-rY^ܓ=E6{G(ΊF!iJpET~Ȭwk'> bDqpt6vEiQsdi}Jo1g0O> a/IyZ#Wk?Y-𡴆"^TKLH`- G8r+8dʛ]T4 VW9XȷA!eʼinXJg:)ʖ2vHORۃɞ@?0gf'i%R.p2`e%,"I_>6٧=G)}h:|}'d>y/Y HCEΰ,;&k΄% b[@N$7_ д,UG}Eax$z2Mȱ2boEWeS!Y^UUf98P^/KB `1 3"7A;&Y47+ڃ% E q3 nW^i?n SV0,QR潭ZramVe]kc,H͛2 kΒ[`rBwh;;#ɯ@<-&O/;LS}Lo:xAԟcvE*S'$´m;]xJȞX?c2&7 řnsS;iț- 4]C9Lk)2O(m5A<*&ݸW*x/z\w}R-P "ކ0.R 8IonmV M54rgfgjvPr7*'$_.S1K&6|-XbL%4,6TknR݉UrV8DGHi*$Rҕ"rDol]*-0T`jdRux :hK^[݇d< ʼn!itqNs*ȕCȒxV| 2 ewOm-p1)[{'d4_,:UC+!=iE$͠&ue,&̢ΝFˑG:95ݭ)~]^Xf7|/o+ly^:ӜJ*ǯ:Z#1ʄN@I4UUF>HwDL$gmW/[6%WeeX%;7\z7@ɢd̔KyJ p}`k@nŲp`#w#0祴!GψQ~+E<(y3T\!UڊN [Y9tm$.^*9(D=2zDKtw-4-oD?BipDqaY;蛨M% +80lqi)?pkݗ9Z2. YoAdt̨Xc1$?Rw7 A'ٛm,^x8"qW7O+ K-i*Q}Qu͵c _<0{aCxA TSưbAAqC0!1{Ӕ tiTːݿʏ,Tt_ygX/jGn?Xb-U?^6W$ r'E!EJ%ۖ; | g%܃¿> { {PA"Ooރξ lJmC8 ŖMUFUl:1h3Cfi:Aœ[*278~ I1ڋ(-0dur.5(égbIᑫ"lii8Zdщpyߠ҆&htL1 R)_tmдe@6 deV(os*6xå\J.$! V,y-}ׁvY1A|\?s*3dnZxɕқ.{MO ap|\ybA!mǽW*]h);8yr)Υp|z/F88ҚCT$kS,,**s2@ .7q@: >JˍF- mg8Ni*} OkRw lHNgHX!>Gyk;[3$YՂ.&ےlm:w{r6Bէi7=1 a[{,D^*6]U}>|e>aPП#mf+{\^>FHtLw?:@aoD Kv 35% o{,C_kz,f(RHIFb4ڇoOnwaXvCε[HSj ߿~WK@:"c'⇃Q}Yr}s#|tӓC@>CJ#ZHΣE-_: ɑ xP@-mǔ/)UO(ył:أD[yg0-/& jur xPZ?ֹJ˦oga|mdEqFVwf5DC LwKdavWzz@3Apf>{^~L3]pPPu!躈c䩵U*ھ#y e\<w0"I}GJa7ћ# wh !@M[2W2kA_V^*:uMladKn#aZ9 4T+Bkpy@* 31G^T ]&5-S!͕Rq߃b>{ -E2iDj9ǏJ(:ˑ!qS-Vhi}6(B\14#whtBI 7*26 &T]g |;J@cȬ@+͝'Ar{:B'ģHrb-%XM rR?:Z.t԰! n&N1 0V6t/c*zd [&\: fApd'﷡U9骊~1 KJPRg8dy ,w ,dVW] ( ozǝ~MV\zځ 40fg$p@_n0o389Pޯ^vsf Nc\FR.iB-*tٻ=yhac>CƥTݍ4,ԖК֮En,iKqYS')_p] H5  yưVۿ8t!w%:" 5p6d(0Vr88Щj9 ZBpAGK&x"?T(Ci=U|&4 GX \TтjPm" ?25}0ᚬ,%oogS_ r):Yeh'MU%ln3NS,^7vy$[Op!'+Q$n#d>̆ѧn)(/iWyLaP̏YX `]v5jf0U4W0>Q7aXp^5, S@զ;6!zkc{=].0,B51_uyL*<__L. z)kㅳ_RN!8kczC ʤ&ZiE>sCDje{$E$&bވ7H"DL 2\*gH/ks 6a tX8umZD1{kI|">h|q8X4]tY6`/Nu`,/:ǠJVROqNnI+eTH }(C?kD4`t:?k^U 2Ҏ21AIU7&F4iy$3M[5juLHC3)O_*fu ُt9'i> m |L  car&8[+4P}<, ;0TV=!e%*Jb({{G|/-Oj*g,}FgO; ;([{cAG`QzP:)i} HB^|\et=Y읽hSm^"cpcB:ݤc!}wx $xSg#яQ 3n{OYm2S jqf.Y}>97L2GYԍTC ߡfcSS Uƨ&Hnuyk臰sGQy`l3˚rђdW0bt ̿.TAB ~MG]E[?C8p-!\}))]*EAeD{E(W>p}\l^˖ֿ=܋g [)ZC D/ڦE$?&›cêyH.}<0g=0 =YK5sek%ynU#NS_pU1?#P &H@悆q: o%' <``7 lu8?(%j]wX['6 ȶR vn9L~T*%]]dRrFXr(P? p]# @k$KkRl+d)fqV q7;& Mn{uE<gi#s= o:v;P϶0]H|Eծ`$و&󐐳1Cf9x|@6TvuN &H,'&< ̼ޮE5R皖ba!,9{Fl4M1R2qL G"+dϦbk:ԋ s$IB {QLm#.@,S*Ls,(=q8Sdς&ЛSAFuN)#4 ?a!R4|SpO[YnG̐5J Tu~r_##t1/#pNEΓRz;\,-Og8jj{;Y׉,ۤ woP( XzJƗ&8~&YHuHQ :ط\bը3]Ÿ(2%baUr̦QYU)njGswm;wƌA 'X#opO7+2y2 C-SetDu>Jӛv9FZ`{? r;\OY ,%Q 9:ZTSyp Q,_zOdN O1<ďws>-`THz| bV: DZGD+M?b`Nbfpm HpO{z7A(UhEiA$ݪPFoVe029FDpR 8SvX<Js)e},t n玗҇^C*L:>Eӎn(&2]_7J{J$Ņ /zfXM-sc~Ҩ8'pa׎|M%NK2 Rp~${o˩{UEB;) pFg0Y{`R9kA-j ǢbD.S>CU W!O-IٌH^`*T_UM1u3[׀c|V [I#p&D)+D) iDžڏw+#IQK0B4@Y sPc9$[.`Ys,)(+He{^ܒ,'BY g"xVaUC#z XUuߑ@;j%STIlƥnjMy*zٞK]SO,LJdPn@׉~paPCL$INVWk ߉ԠFBk^#ƛNIbMJ?j!> Q.O?TzDyd/gU˴l{Lo%ctL.:DN+J`ƙmzv+jS.o~)6e je{q#GM=d/Bv*?U0\r3{2? vCP # T] =3DEt_ְ$ U^g{pk1,RE.xр9Yqq)/]6VeI.pEOv䖡cu,g.ng?5X7Ҁgx#]҉[$.F5}`oX[T# >% /:[KqaX⁄(,#7yxvy@T%9j٧_֟@ v>kwFi`&rd"Se0>H[ N3:lZX15G xfX1Ey!_Ո-0;hw8|1w7,_4w qQFf Q}hǧ6|Ҫ ˑ:OL%1`\˘Pwy GcL 3f q K3KIQRϴJ<>b4|RTOu%bv[p*`y쉄r:4&M=Jh =BE@+~0y*FE֪x6Đn_!ܮcYE%! mo彡g?9bl{a^ 0Sq}QbOXz3!0:`OW"t7k=;i"2~ȒD.BO<&%b WpsG9ac8i/̂RKfT'+3<Bٌt',"qA*aDs33`h"8"AҴ\oFO{m 9[X$ rBQamD7&c{xbL&K-i]P=YlC0Hf^W%>}mMPW8 Ӵy7zG~)V~s39çte50aC#5Ip3NN֯Ud_9^5>F, Taݵ->I?X{~V:D_1ٲ1ejIZjc`zVolF% &{3ؖfӦIa=Km˃m~LzaEÇ-}pv6-M?o4ɏIͨkV25:*9gdp+@g68}Xxs㴞JS= H`Kv߈/HŏH"Ū49\ [j 8gbMé sK;fNk z?Lĉ,^R;Mx;U+Pc"UYBONB)ᮍ;1VTmCѪp^$Mz`\+$/? 䬅UQk|ۙi.Yuvέ+^;EdvS7` p \6N/w(Fz;Xv(#ͰvIyzu-@%D^ qz+IG74U&HT,zȩ r45nP+2pM28G.o0))Z`3wbgZ[+0ۇ#Μf5"56e*dO,cKPnuXp OvJz$s$.ء)"s5 ku6G>IwtIwe$43FUUvR =Kb㾼Lf! +ē{12{Lu9=c21CEb/ Luj e7J5ޖCd⭙= @;&cH^R­ )- |SPgc=VNsZ8h|4],+rS'qC-a=*;/N"Q8}b$lC=BbaY\a1ႅE`zS>"ۆ- :vM;Rb&!%VV,e:'L4¡s9wM% \`"1LngZuj57mJV@-C*[l|` | =_~)L4ȩueBHm_uNZ;OU}l'ByH7Q:>E)n]UsO#2 5֞"I9Glrpj:ĢAVK3k} ZbA\kFLV/ء%k(p+ RZ)DrQ8ˋRh#N<0xb`#t1JnʴS C5|mq@|-ƣ ݗѻ{NIȻgJWSq.ͤFwiwLm|&YWm7vAVܷ^AWЅr:]J$z@dž`࡬Q3Ďu_2 a>,3Do_gnz%  4aSW0l8#$-#6b,̵։D= 2B,:x5S\e"yP ?}Yԉ0 `aSѣH{Eخv-0A&i=¸afA |<kQhqMI>,fAcFnȽB|l-i1J'Z@-]TМу \~Eˠ]`Zn1YɛWơb ;+R:k! e2R߁; O>y ,f.nXmPj &{ˀ9ޢƬHߘbZÞioG_cN yAp)Y/v+*dhH,i aȊwB%bb\Ǟ*@q&>KE#pѓ!ڄ ܽȟ"BL۝鰸&M}MMWC$|Lq;wT#e T!-.! AҒ`&l͛rT:sr$i{-h8b8ֻ s T%л$*7$l/jƓΉT  SPzKߞVX$Ih`i4Z[1BFբ6jB f:DTzSKv2;~3_UQ7tzTS-NT>Ex ؊UeG"d|.~\{(te>}7SZ-)jT%s=&XXC{JflYC^<CѼVݑ9?C US73@ ņmٽV?}vufQioC k50VC^ l_I"eQa1L5>ل32}{n WXB'%&Daw/79<$蘍byUV Vv0uu@&r$|gwlC7dKH6u Wo9Tjl[̮ 㲱PجX(۞dX  ??_3LHL7@(ѾN>Hw~U&$کMCC|͋p"W?jZeܾ!{{zZ+CB&/wcK-;x6ÙY%*ί_j5vޘ7@qGѸۼn`aٹH6|SD1m, OS˻b,1!3IVy:7t8EN{LTwvv^+>@W7twtF BsAKhm ӈ+Ѐt8$R8MIV6{liw0.;CE3rz= ;^O$g,&1$n<\ŭ UpGZGqѽ@GSh80J2NoxTc=kg]bbs cD]583E Van1fw 1!ݨ~0_A^ףxÃ4GP(ӄ ceRb槺+~'"R@q^yUuj716co51(iʠ5*>??4'GL+h$*"yc~ 5%O`ݒA;Ȥ(L߄ρAךP$65Wp7b%XWN¿NMp6Jn$rv \ut'a֗v=!Ыy1Ii=-\m滋6Ype ֽ<%8O!9(X;kjdvK8v0J<CdxՙeEy ʀ&q.1;ZPS 11,$6#T2I_oYw_R*eqzn D,H{{N2Xze[ 5nPk&]AF3 So~lq5r3x(SZOWݤ̀uL '"E|k7񳿠|o !1UϫgξQH ly<9翚y8C:zpCؼ6LFܤJ{5&!6FCjD7l -Ŋ ƝCޥhHf*tzKVyR.Я `6" ^Em5 xoFÀ-%YzAkyo뮝ߦK_gq`aD1oF'!0Vs+ؚMfGm+Oa{  }MRe/g!xaÆ6YRrX]XiAF;;|,Y!wdEtW T=YQI-hIgqxjYBS8}i6G a•Yc뉵]Zc 8:` 03dIc\Jצg}*-å+?~*k\Iέ:KmPCD"SI.BIū5=&%3S*qFD)Jm!e+?5pɃ| JiFǶ#+ɚDR e'nC|/R@sT\ZdtZayY~bvb@~@@i;UC@ņe&9*Dۢx2ji'sPqr9djfk:,ay2#r'* I){+ $!5sK;y0< :ΏGZWEm>޽QK6YQg$E٢X$xsWP>0b . f Gԁ"4 OwTT߲`kL2;׆7P2PAYXD,%^ U%bf0 RVtX&~{ =:\ZOM:S;%_dZlPMTͭ}7GލC\|qyO`+#`DS)hwFW#'dYIL8!gC5z/w @9oN4tZg@€ Vv[ΓZyG\,#40D`!jlM_.N:)?jO3cv\C|?`A!QϨ:6b{vUE2F)h'!z Y0(#붤m,\ g _4i:]-)={ = gik8SpA3/ҰRVd"x oeLv%s)H7fK1vk%M "=&JP<&;MmU*25+o 935陲Chyr1Xay+;RsCxJv92Lc5ő%#ŦiJXRa0H4OK_U9FV~ VyB(:!(HL铲+|^@\4Gu"_"\ gtnwy7I&KrdEn)\y@7M\.Xz) b>-oByad8(tFϳ3;MX{3~gVJgLfY. {٭5L=@Cee 28Knimd/~}Os5!PfKF[]L\lpʈ7`Aϯ5Y{7M2"]+TCcM#Nf#H(k"%J)-6(xGh_%C6we ~e뜄Fo#1 # BcaSm܋Z@, ƨ&m'"k*$uJ=~#H տplAx1CgvgnL :!bug:L;$t$(nO@+-jzX7ÜK(@Op(tac+uwܬUЗ% %gFͯ.@GEShfrf"P9TkT7 BpYQc'O+o[yzMCA^$k2O]Q؄cm_{05E8'T} cdUM(G/E.>[|3]!K: 8Ń`]~g T&.wV22 /C|/n%ӧ{8Q#?SY]̏x &fs(7hޤ?Nvu \A/oѧͿl]N+KE?\(mo*etamg#-I:(MJ]?lJ" ӑe: 7BwVpǴz|T&6_0M $J6Ni 5*JsY7 !}H[=_ݯպ|]bd)s%` f7=i7Ky'M7 І6Z*#:Q̻> ta.c{Ϡ8FUZ}u$e h_-$I|hSS=uuPԑ{ l ߵ͌Htc0*j{i%žFiS:BA( EEp5h#/h:Y(vRePRѴ丶-Н[׍%79p4F8Zߒ~d΁Psҫ]\/(ɘȋ,0a@/A?ϖmX~K| I93iTT- O@;3,L.!(\v=( !5CwE;MאݛiLxQ\@ͷ뮸o @ Fhg!s:EQn¡ 7QK;K=}S&z}l4=rUdY) ]oH5Bb,pO19Ld0]HCMGu^WD@{``Z̲o떅s˲ Ovy2~V=B:BS8&Gi]oӏSޖ/w/850mvU@sH-ŏj V8sʺy,!e>P?%*)4(W&eG%2F*ŗpx"e\D< &ͮ8e7XmA.JHQY<8繝ElS4ReO°ٞa j T%r_@OHY1VtKUmp͵ӰH5ᨅ0nfaKN^vi6 p0X㸌=5KeSdS!5޺ќ %^%1ђ6b=$VM)1д4ľsl/8T:Y 4,I{8<+Xǝ=j\19ZS<$thWJycECnRrL?NOⅨ7 ﾽ`fp]DD&)V%-rLAרqȃpQZ?~?ubmѪ1 ҅8+"*y}1>yw*{A/q;ɐhC橦vEď銪\g 2k%釪:k2owRX%=E( 4F|Y: !ɋ"YKZ"j8 I!*;Wgrvmo *.ҭz0يOV (qTՃ _ p~MGV-:7LG6 NZqCzcJ;e# wDJVnol{]WQ[CWlfVbTXJ7{&\]tƒ C^$m]^PGc`M Kʭq'r|#,u; A:.P1!gL˔!CPN37J.Eeݼozb&'VjI=mM/*k}r8MP?ʗI")C2Hg@qaƠ,H۩(фfrVEcӺ2?=~w妝'u?;{²/_afr4Wtqg31d 1AGA"<_]AYxPBv16Es%2#^ȧTD]Bnqb`Iy.?i~ƕ[y^{J(BƋtW,쮔Lf)HnA7 'C jd.J['5M8>/ɾJI< '<27sf^&AvthuXםI)~izd%1NIx/BVFDvȳvr|I`,@5fkQuǎ5ҋ 9d5HX^C Y+yiH/ϨFf6AKꢃ%f990YOqf~katnqkpD'l M3у MGlvwɪHEhM;!(D+1+Jc7ghUF[FxP)2S^t4U#Xu."Qk3i1*2?WR9ןzsҬ_~aX=?.m.[O-dNoaCXFh^&x ^L(\:W C|bZ(44dz")rGc "ݿI~KG40)|J$b ikb:Atmc EB(&\mnlG|lgÍhPM0X@Ze<ʜ4?^Kf߃9BL 崋 6ZsI$tw̐y,(U~Jsc1'Yt J\y}Dh.F|7 kP0m奘V?mnڵhb4kd=k&c|ۋ)RMU=t3>eOhf\U wDQƻG]e׌6E0ԋ"xY1 satx)7;[p \sd _%.Yz?`EߪGTTN!Q &\vs++ڲj=v$B/y 5As|Tɩ@^ Aqzd9a@ľ ˣWA'ja5g`j+^ ˏZRΟIĸ*L,qjs9>@䢷zLit e Xaz~k3KA,IJ?e߷.XMjP8ުV.:uҤaHc9t&z6mO.1 i>?GfX4li?:IB%x§,r.e qߙJ?N[ėVz,u Cʎ? Zvv'SEZ+ kztRS֨)B/1+!X%*٤iKVp49B)^?Z_Q2B!91 & #^oߎT}='0' g3/)T _J5Ŭ.EnUgj8m\̤ \Y#Z+t`n;0nBpdڢxH >F h7\hbFG C,ű{fhщttEUčwF-\D^v ti: kP };=/&+to6ԖJ(DoBD_c|=Q9DrD[5qIHztuO)!n%lHSuey\(eb7*ڛ |8TDD_ޟ[~]{aeIi7X@0i?}\ HlL8e8@_>#QQv;` |P;A-|K]-Tq1΂:*ߏj;8wx"ЏCb.J!U:cTTqf ?%l0 &D$GH+OЧdZ&H0 ߉L?7FS51 t3Vv".N3#V.s>au_umRZkVAW۱f+^{+ӐC8)fSb]FBŝqIh3Sζycbm0Fs,rQ MwSyTnpH/{2aGQ6#D ׳z0M&?|ƢmȏҨEG[JymryeI9-i7%yܠz:_K.6 *_+#Dw_x@+DeTʧJFm~*C;A(sٓ$2]Iǵ r>rf1Z_8T_)YP_3F ;s*Hq*ek*3;)Ӯt']&B$"6Б R7OHwW*!Y,$xiPTVqz7ByH>'`nD'Ǝ G9@ӊ%Q $d!M[m fCyfKOxL BY'LQ^rј= b.Lb(X?4ɜ4 7?DLwsI4e`{#ƒ)BbHht], B1Ez GP=AІ <-Mӻڨƫ!Yh? 7-(!ʧڸܒ}_zNvgw>(:Ƒ>)tl3EY%u=P6Ҍ<@ { "z|ج)sF2p;'TTdNı?\8A̚-$zUdY!\"+ccC34PkްJp̌p„۳>r_g/D7۶asg V4G2\oVJ g-P2wg~=aL2/<[` eٱF>(8)yiDjuk YkTBgE۴ ە #ofhS&P/ɹ}Eg8E-L^s1ATQaձc1x*wFOfpCUFJ0#<)j ƊFr/+?o"`% >d#9镹"IR~RJ%Sm252"ho׻{_ћ=TgeݝrhϚ'in"M-BAlE0 s0E{_ғ|LiWc :'Q7 Rr$Sn@Gݧr2Ci =f}uKKtRoښs>~s>N!9ΗVj>ܢR1W#oV{?H?}sŕ9 hac|mvx(UTXZEFuLJP  4:`syn*ZKй>cTVmn0A) 9y?CLn[, `gvd"`TQI%ǔN y2=hݘ^KE uR*3P|FB\T¢I7*1!aξ7[%k ?.R)J%xLe0ر"n8#쩏_C (-x1q>YPms*:nu\ .W>RcgyI{N/O#$$~ZEB|bs##0 `mMj :0-&Z*Jԁ$Au gD RdFUC K靳)\TrKUVuosX@k.~OjP wY;_8ozRuE0E٨DmJ3\`_-ݑi!if.Ё8vMmO4-ϼ-pU^\WzN$L9o*=o7r- >0t#5zQ2;#X+ @7U&U⦒}HL?:F@$Yp5"w[F-ipHmDq_v2 Q ;e*E @3q |1 8S~hO MŧGk]kDMA~Sj v{ 28PBDrcYf]90f Kה= |JZߘtA |K̭ĀAY,3@j8jSt E]&5x\ WZgۦj=U5I;%| 9i  Z1RXͽ$j-` Φ1X *:k1d G +`ҢEG }!mQ͕ kکA~ef!oXP_2K` 'Wi&RBDRNd1#n62f>?zF

PX{beOWrl9z Z<%_ $Yپ&@԰&l{^'L}C>TV[(]1]A$ƞx@˺emavNJܽ~P AAEPhj "RؼV|LF!A ˵֊jmvAv+*Ce6,Z8Q$ڂҐ쳉S܄E؉Wk5@vYR!a* b߄8ӘGj͉}ViTgX.s5ڋC.'U<Aq%}t6dEEW? rzkn{D&*c:ۋek[ՍnlQ9Wnf`tHT\HrFw 1=- @z MH:e d>L#?Jw#Tuf7 Tx!'|?']#6q澖WC2`Oጿc)aO*<%*"](8q 1lSТ`l{u`&CrX~; uFFI%R _h3œu2u̢Y 9CFS2i@['\_VIrs-ܦkR"vQ7PN $5(Q!7~d p P'4-5`6!znYvF mvhc/#}v03N]h} ׵7oN0o nZlz8ob(ҽ㓐/fJCi>c[!|^KFTA ;&*\ $Kͦ !r uxd3$f~z(w7C6P->R߿0.,H=(Z!S1#UUV5*%hhvptC.`\TZPCb c0]ɰ5-A"E|z_E=djHes5CVb;w > #Aʴ8XqӿW9WUGxj5.x/&#v~Z5+aNVv{0Q41F^wB`Ċ&ҧ{[*3ϙZgc&@EX v{ : _#pܱȞLp.?MP_Ni['Z[$H3w&,(:_` S{0wzjV|4V=(@0Memj"q>ǔKRdjj5e!zgQhw>OI& # 2[VxϗwЮN/m,}q::;RnLκ7vDX[`L) OU.]U-|W7Nׁ @ިԇN@7vә =N[Ӽ'.}as$F^ae}uɺ+)Hakeјz"V;yDWhk'sxz;ԁL=L8@LE}_坯gsa@#i 96#Hy.K 05J0,E+CDn4,|*ݢTʞhr--PHTf5![ =S! dt&N@pIȮ3> '*JuMQ-ͅ&Φ VIzISXx5I+ @Na !"fV3ag-A@cˈ`BźȮr,Ajd{O4l_:(>cP;Mx p-iiMRHWds1a;ՙW)yY8ޛޠ-3V*Zij7POၥK 2=]`}쒙Qo3 eg멙{ 'Sg'{~{H<-;%Jف%j&8ԚS`3ONc5 yZU:Mǐ,HXb_t SkׄI(F=vdw_-t\Ȏ/pFIN3-DqqjpԨ2PTW$XA;h4-@_.mSFFW|9*D/myA-GEo,9 >E"o sn-Kd+12*k\Aws?7qS|p!sM-J$&Nn\~zh 4|o.˫c Z2}QV؀+rx Wq|JHP||aU=BUغ!c|F;Ÿ]I>%Kq>>6ݿ3زR8OjHC3>UX-ɜʹD>hm#޺"s"wN-ʝR@6Y ܂:u҉EFI+BC xm ȥ ޚh33.χ\~2-u^ d*J L6ts 戵 Z2vaKQb0&RVݪE*`!qHcɰChm&}ޠ> <} wITYÜ4Fm _*^I+ȫch*oٳГC`{tvP0oJ0Ӿ/"{uV{lklX/ Y.J(cqY)R;B-x`Ţ$Uˎ⦶́45/dW"1-0|TUjٺVS&asg1FgX(fRR _ي{ZM_6c()-ƀxyg]MtLEkM1iĔZ_ů9!] ҎB EFtXuIxvv+7bՅ#JΜ!0ap/C:W12| f;,@e6s[6Ӹ#ǠIejߎr'oWKcƸ`SDdn(Qu⾾4V4Co#'ƛL4 i$ݵd=ɪr_}$jR i9.kX!&%zJ,Tp9^=u&%2.]تZ#!UG&V?.;R$ Z#k=.Aplik/ K tR"6p^ZH9cH/U+TW )Вcbx'&|U[nh` +Nѝ_5_/_|]8,ҵ‚3"Q徽zkı|`U­;fی3:3}=)ۅx N3ښȍbc*K1/{ Il̸ʘ85^U0p]^7C| KL.9Nwň]/%BLQɭJs;cQ3P<`-3{y0'h%P\.).߽`* c>y,^6]oOC6{6lՈ1tTjI-Me5$2ː~;AxU9g\I{gaiŽM hA^Ӹgw渝ry*g^aڗgH5]O4z$XweA·LV(ע?'VaHbɯF8憔E޹9\h3Q8I@~^8<^cCt3\FsE2 ɸl\)n0&G @{=jurط* ܵ[213#J(ō5`nBuh8#6at7[i`|'98}lҲ:,uҪ˸kJHVqhdcgģ_C];>=yT&c< h~n)#bU3WPAW`cDۇFt@eC[UsjO>%,B7n6 Ƽ"xKG<#d-6hP/o `مi[?^X1?Y|迳=])U>u'VT_(އJ@F ؊̹a, RoZcnp 8+#D@|By$`gsW o>5hS:GhHo_Akv붬ES89VP<)h⇎Z8BfyJz .Iv[xXdܢs_g*بuCwYxv1+7X,4fȤgF 5>*ѕg՚Zr-X/OTIt,`v;7iggـ$#7€[?(tZnyoRal 43ZֈL=' `iv7jXGsTy( 5Ξ_`gi{SЦ` \&4Oˍ-Bq򽒐e|Os1g:lZ<C_iU; ԭ:?B{EV)kA;UCHJK𵶾kƑ,ؿo\j 7F y?{N_`;MREF}d~\e\UK~{$|/Q#ށ7Ò(^z#ެ8v*WL5πo> 93ٕ&eS(㭤  <-aƷv 4|WPWז@+_ j՚~V#`=R NcdNc{v Uqt)aS,ys|܅C/l|Js*|g%A8e&[87YM6RO*r27ryQ'XJ]%r=w>tnOdE@$L+O9wjwyo'c W*:{}Ȏ԰V1> -H4,'p]a'N`"i-ۈ!WGWr ZO.t Zj8.ˀ#4%Ǥ(lYx},L[ivMAu羐R(B-ؾ& PEnjm6G^%Һ)qb{6YIM]:pÊ 4cZO+"hy\WKNt{WUf<?AIٙҳ$SNֈ~;UE%u8R1\ȗrRԨ Uw/~ZIP?7n3-~3#ɺ|{4-<[6"n0A2}T^dbJ!CCs1c8r:%c_Or9`8) _# X,4ݖt f2Zm_lmJ2Pl5u6Ʃj7dSY풘ޝ +@] &^ 7n:ڗivfkE2wt^SV۫ށl\,Rx*ѩN+\]e~E+cTLt0|NMa n~nr r1`? G&Rr>:"3lQVr/G-K;5-GG÷E*+|p9UhUgL$zq-PBBMUjdYڶNa"&^a-z߿7|͎9)C MyV7q\yxnsmFVD*϶#X+L|=&4R^K:5 9vʗK$3hTH6T4]XyǗUꨔuE3/W:Q[N0oTgmAוq@ #׷gYV\BY憶70Bw47쭾rmdH"msFͪRmr^-vH-mi견e>gqI *pr'kT|pgQ KMEXݐ-ݐ|`=.~ \D(`e#m4n=!%!H'>53V¿Dt@;:a8{^Xuq16s6KL143YRw(ּcf!y"k?v d'( H$3wT.3Sm Ny%L=C:=^PQX]a]Ggel 8ukRԸɁOd/%)"RVTq28ϋoUUO^<0CI0{v }m W")WDFPXH]Z"Xϼ7'r*Y^%m\b\0upUG [hC|#=X3]X[$ îR]H9aˣ:fT ʪQ|h{Uly\`ڪ JzŠbmO "̒ y.V*I'17{8-U9 1n5>$mCאg]#aiP׀x=Eq߰e ػ aFcASSʐ1^=`3"(ԋpZI*UI<OC҉j'GOsH%<-ߋ~G t)сOhLKabo;<]^7V'|1f߲oRz41{n#0B1E&fyB`|~KNJZ2<=`цhS-ȓL̜JȊRQ;3S1`8YpJJ*\w י'3PzSUAd>oOTuT/{d;e8V&X JyDJߏ{޲N !NVGz=Pک~ >%4nb+=-V,l\n`CڊD\ zM$[PT,$&bqDl辮#pJĆu]VхMJBx~]wrg %0:]&wk2Iڈ5Z:y!L'rBGYyD%f_Ue'g#) - ^p" Joၩ/w||H;gFֆ(X3M۴,rn> M0IՃ_J~?H6%ͧ혲 kkOsΤ{D*)%[ZY_>pU2 JFGia (1-!q[;ENpL $_P[T6rB*Qܫ{]R"#F ճ]|XZl1#iL>zMJ:e‘-ؗ5-Wܱ_"#c=qia.MVcb4sKQY$2!R6.d.>>3+wR9Ѷk@mk e]3xdMׂ{[hB_q$>>Zs_@|:8km:9fIP*FeTi?V4My@6V* 2-`<ޞ[i=ʅ`K4ؾE|VM$e_MgMn͖`l1((- 7*2Q FWbt2 >cjM"?Q|GBK/=(<ØQW8R~ @,Y_N{~yg5xZC1B_*2,_e;OW+{%tQ01"߈[HFxuU9 A:DRǘO|z!Y`@BzY+Db;XAZF'&>`7JTo.N._9JI 9 Ua¿_ `z\K)Z~K9DGaXav@dnõrћT[W9÷2͋\^$z'O}j|cuM~r Z _I.4 Wl!+Q:(ӖvyZ ; X48ӼF;lb )yXC6`0Ei"ض;FX  ۜ!4i\-_O$%f_Im~6RY:xH-yb}}Mu*t.!טn0-ѷn93*bA`:xJ3_5fCPZ>vp`k$jGYc윍IoDŧw{yo г7 wqth}q(QP/wsY_r^1?/$oVMלbK۶S=ۿJ 8-Gϊ_Z~-_/0ivO_ɷ3ߗ墘gPם-i|4~:Z{"ɪi]^D?|YZQm_Ȱ¬Iuۣdk̑4ΎZZqU\G\ѩ*ב`&PtɰtA߬TThYiqaE 4a(Q0H Gg 2|OtM>BAC^wM.Osf L:A馊ʘmڶMB'2Xy$zho>?Y=\jfj0ND(fSᢢ˩Ox3I'ω 2[xxo]Ɍ{^w tiVƖޡp&R^c|۹ NJGbͥI)^dUΝO$p=fߢQI+>zwa>PpQyk./!}{)(hF 8c%*څ[.bq1m]$mmf-5 laq B`C9k)X_2KdFLJL/@p,jl-__oO~rb6T!ސعRW'X}F0kv=*<?ls Vf#} b&IS\$\ZԙNPm'uv(X+$vN5!4 7 WP)r+!] V㓊ƫA]xF4*Umht]/0K`[, |Ք[P˳ ĎxYw(ٶʎ5~JnGA pFͯ Hcȶr$:RtN,v|&-#j$sq)ؙ p8_1oF>*NۦxJ(2|pRR y lp^6ujx$KZHF  }R;@s(꥜5P G5}oW zaUk-; lY8)!ע RO? %0fRjleq}mʷ7L6 }d"GkxJ!3X |;38=OF`>AAEձJpdu^Ħh} c0 k긠Ƚl,|>坧6'[Rc6kA@,q8~5/bIڽ [v gtŇeh \_XV?шQ٭ u՚$>5$Iڤ+{?%gEO:pPݫ^&ZH]Z!~3FM1b~AtCcSD㤴_լ'l͞}GC4V=~W&k!3XU=8Ccthe|:O {H_P?h?lb[YۘWEo!ŭp;Ҩ`Fa0Fm20/ﱜĥൈ##F ڗ^̓CxuUlX8ĕ}xvfޤeBLB( RA=Mv{Z=K9+OFزAo3O, Ĉwc "Zw(929b3bãi1-B.h2KbTn,A|;k59TB\%fʹTX#lQQGA~`:c^ҭUi/vQT<:Ys9JsfmMgdTI 93Şʮ^mh2tD qE]TZrb8U Ȭa._oݬ}h_|:1uX1>x!qi,]\ʣiM͌t;c0һIW=J IΆaYK5it~ aR眗N &LQtL\? Egxys톌j5nU:1\^-wD{ҥ播 @‘ur^{lq 64gR߷e4)Yg_(rjuY?h|OJU$՟]CocFhB˒s, [3$hmޖR=6 dTgvrȽѰXy Litz 5w|aۼMc)@iRY B% m}#I6ޡX.`W Nh%T^5vo*&,94~i(pp¤ΝLܲ-u:.Ws _輨 ~mۄ.j%AZN'MQJo\YjI~ؔ.P޴uB:@w mĮ_[2'HpHLF4J%\x''8~F5auS 5xRb3- Ո剰/ 3x$1jɜ%]%Ի srѺrY\EMobeQH7}ʛc׋1%si4_ +/@;SRdNm9#ݟc_goPxjyi{a_m'/_uYGB\ PqGi:q(]T$ -zRR20<? da:iHu/EW&)*,2忇q֭OM"'7,.V#f= ֘ {Ȇ҂".EЌ&DjQ@7i]<>샺ΐ1fNR~U\%C=8vܮ}A{#RSKSɁ\أuc|F+JS_=SMH<]| ,FZfAVV*4FLNчM%W`HvyԓiruAǓ$LĘY+葬Ѕ:)Վi( uP%/LwAq3yɵ'apeݮdžWG$@P*<'2徑>rECe@$m埂Ҡh\#\.:R"J}g0VZV 6 ͥjAJ2@#)& чb_"́ 95vكpڴtmI3n!$2YQpϏZ84o苷l(t..amɤ^ea>\} ,؍7OPUC\ÅU)L.)6LcQHmLUd`sa{ढ़-n, Lp[ĭ0S|Nq%OZی֗SJuxGYA}UrъErKD.S܊">khtO '",CjCè0>U3B8B3pN+3h{9wھ5[tM2gkȍKu5)k^NwLЮGΥ=I֢|"SQ(rݢSԣ4fmKTrIGz': VhÜKL>&Ym,hHr~^a@t[DI`UQ}}"FL){ z)oS#v^ii$Qs{+ª Ă/iZ؏VE^N\]mzf>} M d 61Qru+;^==& ZjTX#pTх('=ރsSAB0(» lD@= o&fO_|n|փⁱ8,#2 ͻNwlqg =\;Bts)m,qo"]W>;'/y#bǑkᰌSIZ2G }9ës]qtOw0 _ٺLK^0GsCvom-,:eJQ!X߸t)=/@8 WPT 9UJ o62`Al=ٍVAόY7Pٲ >9a "b4#:7yRcDHT}4f!M@%9]uV\L$9ڐ]=uD {`B `!#3XϮ"~36AoMPgASq,-qwuYn>zR"WqPŨ{U6QN'h{eK@'{5%;4?ԞJB RSɏ ',q]R_#F 6n }aR2gFkC2ÅRc$%I/ѨiOfm^׾nAcýHq&f%<~`Ngv"_[u$:=TFuoj&͚!62+,f|Sf߷;'9Ju/TbkG;[krߘfa*-N  pg%#gVzB=]XG 6n'ҾJ厨b/c_̂Sٱ*je-Sڮkore!)`HfBnڌ/f^O*k s7xI5oz]s7VP2NUm>, {@C-NAdx~hzsxuXO6mUgtdy71wmu">3R-[wkk@2iU_OE=탂U"r~AS#<_\3VpntR f)|`*.S>%s=8=($6G$R0sYdt`Ak3 xVUӿKsӿIEʷ>|FIe1X[P+wq_E 9p/~}(LRS%䌞$ ;T$Sh]!Ƒ|֪^>"D:E툎 ΍6զn/K;TSle !cY|̍!#Yp)Т$FڄzuKA6ek-a9z9<tИ. c|8\m@|IͶO9{AeG.G-9᝼%v-9J>MʶZp&|\ʸE ;6zy &;{ېlf)}|bj,;e:b]<ˉ[CjK&*4ɓu|k(e|y$(y eƍ|fp,DQ/X42R vs6 'APF9k u<-m9PzkobFҸxQS=Q,΋@:_T UlXsZ0 K]Dań W<7/0SDG]*66ŠJyJ[a#UJþ+b._AiUc~t.Y𬤓r:MJj#ύSMY9¼!( ghpd <%-Q UuK!-~zץ,'u6B]yHЫ2hf-rSSMq:Ny.FnZ8NAn?Ι;x%-׊ E+ڶ,\ bӊ$4))O37[b0/YHo r>u4Xd0OKFWHEye a=9XE^!I+Gx#*"eY|򉄩33\J/'?䌻韭%c cgrAUϠh|;!Br[g7!!CU6@L&Anٲ`)2\4wɓswg$Pc2Ȧ9,u;j+Ȝ{Kp>bX@wx6J9kk]撢K `q*Kn(IyZ/Pa8ոa p&bG!pH;Yi)INEy܆v7L%&nJ][,OI.>ү%Fte7pZF3Z QĬEj.0QֽcWgk}Wt>6~idr/"Ou2XRp2<8/O4K js!ð~(D>HGzw2ΑTp%2{RmecKRq[q~N8t%!3NQQ~)e5G422L#iǍʙ ]Yu4`}* $h@Hj6u7zCIK"i\ԮH E|cGUah*M sZn;pn[SzlT@!elP˧8㠅cg8[Sn <aˉDfy%cˌkvK 1o.*筱C&ӿoyqz K}n4 fDƽvˠָAP~(amLJ޼О mMZ1' UN%IA?rvȌf1^:ue3g̴{8;Y>""@\' {9&.~{IqwTڋ d1Kj.M=xUS6Cz}}vrc2tET9&0A3\wuAO#$B䙋)g71TzʂXgڡ i c z*s2FBBԦIyP`Zh1]I]?Yf!U`rrݓzCPrն7q|Ufj,;%L_20׾WJVNB-%7W4=:󄪡BfXc o utKcio2.%,K~@\QWH8|9'IID5,H9h@f㜧 6.bêWDS{9ýAMg ե~#RX`d-Iܶ{wRɿQp|IJAr_;?Պ~ſva>Oa[YE]|Ab9k{)iؕ&&܈3fԀg/ ۗc7(x$*Ց+!9ݤ:M&hGBZ͑;v]sF㲸YIr]hת)N,SIo`"7vJZw ~\M U-^ @"o˚!gHA8xPw/^|+FoY*} -!g: ) e]sݰ9Of q,j>,uPHujmBC-8H^Gヷ9=_"9QTc bD^bi$U}|d"}aD5QM}&?HLTb# Q ڇ0}k>sgo?{r~NGkc7M`gAp+T7!Af]fanV"0{iؚNd;KwSV YcWdO;MV/x9ټq<zC6Ǻ8/5A B1-<㣯SwZ{1vyt 3% q]/=[ʸ٣5v^{Ys<ږ.;=Mj'ң?|s#RpQfE|yw\>#ڤ<ջJ9㔥P'?K.E⪹ѻ؅38(f0*+㒲/X۱6TjqLHGhyҷNqܨ|qυ m/R"M^YJ?-OAkjOInU&ʳuњGRPX%)leͭo!)X  7U_'s^P6n@ ]c_U$uT]>(_ m%](a؆X`rڼ 0,%X^#:hyYD#?­IX5-#Jut&R0{~8tƁ\ %`R⺬*ےa#MX@\Gvonũ  ozpgF6"kt ${X; ӗCddzE׻L$HK9\x",7j?D7k5R7Ü, ˷r0WR b0%7!FͻI;wŭ%3OT$~ w3PV~F ]+v]9+ۈ͋ݠlk$lے8]4ςnQbiD;k>%&5 yh6LtcLQ:hC8`e4Rc#LV[PݎIً׆Zt!M5gKP Q,W.ꨜ0"~U]ƾy,΢AdTitĎ] s^D BZr8h ahW? =ы.R=Y6cĨ*hȄ*&MQ1U$t6ҫ ]0Ka>Ȟ!K @'P\%)~fҎȎX eW[),1/-5Ut+7K!^})=P*cfr)9AlP_3Uq砢+CK KYjܵ=mql-Мv5׭@F}7/Xs8xj>`u5ym BL᱇`dDS=3.w.gb:"kX ^QRq6yEH|S 6P/m^68GkV"gnߙ#zZӋ)]Wwʵ}\h4$4&Jhh3̸m.oWg䓪 Wu< V) wLm#͗Q⣯b&;pHgcT`7?<]-#NͥŢ8C|zץZu0K 4)*;"tIHL6 KTT 9\BILՍ{/ł۸/lfHۧ< 40ڥ nVUG9 { NńT%"WgFvkE-Ιw~umѠdtg _ʈ,!bNVqFʏ1ϡ-%i)c&WwUb[-ƴAPh>_,2%WT{Ad:M &V#E*DJ+VP:6K%#8H! #L4m & ^ӡ@TZrAS~D(̮F3qr0QK7q6Ps14Rt&gg|ŕfR=_`#,YQqP M{1X7"vdӦ6 xQV7xPeyHSn;$UDž2IiL_47J76FRAqFE]T?H?)HyK۟4/eʂ M>DI F\GOP=9VBӭOdΨ@s^ dRHlkdX)W(zM>jJ ^,wy;9)zPff.Ywh_in5vEieɢrZ,ͼG6gnLG{v֓Jc{Qyv D$%0ո^n}w.uh iSFn hGvz>71 I-%n0`_\J'c6x2+wY=z4:wk>MI2=FIm.a^/wJ`{H0CcgEpϗU<'4IoWʷ ꘅ4ʈgՄ+u0^Y\d5z^Uܽӿhc8ܫO~c^¤c?Y'Tٶ-/>~"CGFcߔrxs[:,bWb\|q%^Z嚙nZ,͂2Xn7X8BC ǒ[d,eJ   Y[#og NcPz'5Cb,.do5nL;_^ʽN:byA8e6m_5/Rp)8e3zA٨0;Pxf 躙֕_н_6&; $:?ǺHsRMS T.Դ s}솘mtFbDsPy7z(Yړ܇ w.m!>֒ uj$ VEBcngY\A'յg^ @)奥F"A@ V\&fְ)O"pGGؼS) x$9Y!梘#Oy0jM#J2hYz%C!E_e{3WmЀ|j9JU6(/4" ԎBk$ȁ1-5A> <'Neo."g f:a4h)w"-p9ixz9 Λ@~Rt?H,5وHCVѕcGk/w- zzWl^t}LSB gZ~"g_(kX)L0 S &:_a8f#$;EIw"ocp! n0:{xЖc@+aeQr+͢@#?wӕ!Kɜsyo-ơ"mz߫~C HY\N9/R-s>Qa!QJBV9XNx5SsÓA+.lNBr뗾AE9FTB@8+XQ!beXqFb6nՠYd {FåJRc o20j DհɀZ' 6H"y`I#q\0"O>Bqkj7ou!Of-8]8w[{րsl*؈ӷ| ~ٞNe%2iA,Ea^Xp24n*<\c_̗'3#bR1иL`?VQ6i7K )TȊ̥-4~A"7{k╪/+O>6WMH|-ajH{ 5Y,:kX)@HE g iĪi1CmDs0K.4~Crޥam{Zf Jϝt<2"~>7ٱ@ JcUL"ܪ?{=iiTgR&G^ϥF`,nY}ieZ\Wn7-FR$x VF s5~{ |ׅPޢeR۾o[B(Ԧj9͜Ԙl;];82/xݫF!_O|] 䝶~Bm*wM bxE9$3iӂGԻT9[%TEt[|G^EYKܩY'X FH1|z NM_>ϊ'@뽕D#] :Gd0E/HZ*Szz* U`ZxjY1V XO^ KP”bꔧ6.c,f.ɧt M2+4TK$eCKZ PvIaxeEN4B6 _c~NCwDzo"b5 8c-uWI /ķQ!/YXY==Rf҃ϢtC{V+i+aiǿFq\=bAO 7AF18N|3˄) Siq(Q36W;'}(Δ8Cj[>̞>F3wF,#z B-b}&.@MO5td>_%MĄaɱ@a&Bf͌G~} ҏzBV'&*,=-IJ1<$r3XN/m1dFP}E%<~Țc]-EEK%lyÁ䁭ڿԯ13EKLz NJ:w bLrǷ)x94 z 3~\t$JqpUS }wNއ t aҁy) JD ,BʹㇸCh6q^wqSxi?e䒽X0"›n-Zrt\F6NEpD<+s|[Hܧ81L@(#?Ѕ j+-wotuJG<JAB?;u N,A#< ?כ&=<{<ˋ0솢S<62"PO\o݁E_ _ߤ; D[}~?$ WuXgXx`%} E}0d,Yǰb&p4d?:\w>j-z,vf}"PittDK[pi|d\5dFVƔAgJKJ=*&ҽ_Nd5>Q1N yEᭌ2'-߹8hl>}vBBvVN쌽K"Fz6@z+79j`FD0PGbIoVg$^\3GX, g^ޓ?~%0Cx xd"/Zxt.o9j2]0X,arOrhOmrv ڢT}_jeFiA2kz&[o(LߧAiq7=jh#CC{E Ä09гӞ!b;^`[6%EE)j:I#|T"r[$Tci6$'*=>rr])Ԗλ )h;: SAT>F!t"aMA| r)6\$[ 6dLEFVB}FR.yC"DB\zwo O EX3ܬhMK"%*Cy3,A TS Z:%RЈjȱ@?[LTϽROcAÙBN.nw̠NCW.h@Suz!uZSEy:L 0sƊ+oC:#QZF. QjgUv H~@eXU_|qVn=Jd@9Nw|@y7ݮ?3hfę<MwDvBCƸĤ +{4f //S @}9EU' W8~Cdt/M\RUz:q$esk0D@J5]]ZabMb] >DWkvI8E,+uu_ p0tAu/:2]/Į&u^O --`'mL>mTjzRJh091AQ#pAJ V|t/v`(M'C@i#$ꔥ f|iCLe" H. ̈́=$[`1ЖdD0e7M:DܷDUmZ n9n ]vn]nRTVRa>wuUsHkib䢁{R@ :*05ߦMHyV kY =$[h ?>0(0؟٘ T˓tѶ:3gqhZV{~}zD:Աߕn{d#0,*UfVJ\$T:kHFuMHɮf-{aJz m{;M`BH»`$+;Oed+[|% j~ 4 mpC'YmakyTBYU) |+u3쑀m)Kդ:R _垡{q 1nۃ4" HU(fgciHo IRr |@jIU7& 'Fa7*5 D )=:; + *`{.Ct_n`[Zhvw74OH#^7 vYA^g i˂ P\ W&B<3!0ld xXgag*maN.+jOy/PZtjE PRK`&XqVM?/p?Cc 6Ed:ǎjQ$pXH:C|]Mc'uAXN3b:Q-d # HVS.,jgZD ?SdTL$I|[mFuRZ˨ۗud 1f m{Җ[Y8;VeG(<ݠW #=-1ܓje)܆(H24A]Nƶ+.z(U f#<` < ZʰMR tޚ++bLv`c ;2Z=M jE0Lt S, B mtagl`1$cZ~D_.emޡtWzے>M?~fvfw]MuQ_CJ MMz0^'!SL+`]G0Y m}ZQo^0C@60SSi0U%j}~@Ċ9fdfPC;q1νdSd}PZ[՝.\7IU.iӚ;^Pֶi~`Of=_ ܳkW3"=짽.Z[~SeX+dæSɒjթ/ږQ}ĝtD:X 5U _- VT=ѝ%8kZtsCY~ fx9v5vh9h[WoZO?2"po>'͟r\Ug>xJYM!*JVl88.QpM/社Yf`tb]<ōy&tWq1CI/e}urnpKtO{=iAD{pAz~z,_EM v O3GHWUѺA;CF<:*O%1&ɮ%m\kuRH#?_#@L!nLPj5#?AG&=mdWBSU5 AE3̛0ː :e[?2# Eۊ$NJ*ZgjFVA)8x5!Cs.'*rr>V%"`qdam O 3Ϗ)7rkaZ!?#Bx7tPG- Y8RuХҩVNKW.M2w$-fh0# Qn_~R"x! NV|DIl dGqY32>̔0As˗0w x%./l.˺t ZC:9P6Fyvwn݈5dB˚źVzNj&%tËJ6?E4qZZ*e(DM쯃pTBx.tChǶ!SLw+ޞ$]+Rcq˾mv:x:kXohn:&,/ .:KL}xg*Ԋg1)y'bO97!Z:5\Ҥm~TZ4b랰k|!ώ"!;޺p!^Uڿc8 ML=8 7$>,ú6J l;1| mGy)udfevkfbN׏]7ao㖎؎'L3Nb `#&b1ߙx3؊l.MX`Bb$4:{ [M؉<3͂ܿX\2/!bK9=L/JH%GOuĀ(;y`I9ܜb\G((B)xDgZ!PA*SnVS8 }c8??9Ыl &^ٗGH.<Պ+g3t\'˿)VA+ `pp$9s륖z8n9cK0jhuCK#(L@(BCk:7N& 0h:`#},|os@ 4vL>?skYo;|ǬS JHzzQg?.:ܜ4UZE"+;auts>#/5uٷ5eĉTG;b$( y:{";Fqdf A0=b Y);*7  ]8H94B?}l:Yu<=Y ĠYZ *O"sf;FE/s[XU憘 sukqKT ]5wTh1i"~:tv{k u%=ffYPc = <`Q\:/`鴾%}:CG?̍^D 6eqF] e>I/@̀L(OzթģFk['\bNqkɇ2ˍ0L c~e&W]7838^q ºDABGWJ/Mvv4B6U#;^\&_3ҡ$>.7: 1IɔCڼipc}ںkF~eLq_d\)]_|,tH{Cpkޏ@{6M+Nl< TN qU7[a2]V%>2PSSB,ʯw^@3l8^ m?LM>m e#xt߬pZPQǚ )E͉ߊۦBlr{Tb!oBaϖIgG]15NVa0](G+-L3Wcdn"Ը,†@^ qr_wk@`f긐WƳnQ]2N :BZ\tA]X(L8YuP_'y+>mbbN))&Wͧbi6VGХlgOIcQrzVOO*;d|/$6uҥkCfIj|Ԇՠ=J[.6CP,dFkV@r̗S|BbMLPpDdUasn~'@^^^pZN#SҴ(jHQC Ue)pLS;#QzgW1+q+(s99fu #OFb)'*-G`,ZpFW*n8?Xhx͐E9uY>qpPXXQ{b_&JTkIژ tX2eSy5Q+ 7edg OUr7@ Tb3 Tqۼ$N뎭*ѸQ2,h\Q[!yHzE]KƊtާ\Biy)+[[)NS8LU[A7Veŝu&ԏ(^)lBN-9E>nm߶'#޽լuuq6b(x]f LO/et\ k\(_("!VNl Ce֓=Cy.hF6($Pi%LARc.!>0՚+&L2 Q1?dԎ(emAl ?W%+'(n.Uo!!<;x5kn%,nfZJkq+Y[^K,mXn+4|C82Z1-s+^sڀ|6rwVI[(Rܸhǥ)*Vü*7)Ì*_˿SYYL15 J83TM[7ߙIjf? _{Nz'|"9bk`'%b6.,L3K>l7 WSag.9LrSKG0J~л#NNy{byJ~a4@yzF(L!- J ]n+(_?A\~A2H@|M`x n0%=kmvYNx o :Q;mdHAz?JvHWrG}{޲b7sˬh~-9Ŝ򎼒_WeȅWvvxk7aIRݯ2tK)SҦb>54+JY=}+%cpU{)P;,\ΜW>JcLJnfꋰU~wmAsM'S-fXIj&ozaE{wHU~8ls~vơ}lSډW_]^|Q:O"LLGK81XFTs Pb'&՘5 FZV}4+!,'Y6|NO}~Flk_!+ 7-2gS6*9qu{m"=ltIb2!ԔLv%!t/Yσ^~=(rM![2 FJ|1"D(\H佉D3v, qE^36en[vF8/J4KZUY%ɶ/l8}.vB)SXfchc "LA /`ơaKozfһK0bI U3\V{&@eiT&:# c`b ] wO2BZNb}?;53ߜ'Xl:wl0d #{HPZj.ֶ< esuG6$.!""Iퟞ1촮G;wL V k&2b!w&}Wv1myT{Gʹp\#6@u$ӞZnهHsfZMT *yӷ{]ot~"[ս%3ӻF* kjEi6ǜLԾMfւ9.}gmOH7=(tB1AtDe.D|PRvh@Jp:Ƈ5gl$М6A;Կ܃Y@myxk1ksUk|U fdrFkrvr=5N|CC*w#^8kȶP/gͤZMuʐh7r/NWBs  -%>]L?A8& }U)f%^;=7$\ AGVә+o>`i] 2J'~IZo&Fr~fU\+z7}oٔxݙs{stD [Q⻢;<֧Y%VHrmTIs<7xv}S> :&^1djuAAn,,e*+e IOYYhl>q_@V uZߒ.Z@R-s|_W |!I Sn=Y6D0tlC( Vw2LLvxJJVǓ;_ K$Ke"d]`qC^,wNz}t"YL~Nop܎WKe,hneu{CQAwkp9")_՝{Yd3:o*:;lL㎸-2/v*.y"P>)|!&v0mTIyGƔyt asn\#2㲠: l' 84p{y ,и|O:jY`Y+;yѴ5/_Y4BUYo6GfN >-4nzׯ~NIYAOΏ*. zʹ9F 1﹑}=:=R?8ua܎̻5Q~;:;/S7$" F m:Zmvب3EY`1L;6V $%ha]Rɤfیط/.܏^K7& ji0c~t9ΝO#Տӷ$"Kkrf|3>-{i,Ɣ nhosKشU<X6T*KNQwy1(ris$lf8v%G&@?4 M@ ǞKqbլ+~Iଃn!,7] -37q-9+C$ÅDHn2omqBT/ṳt{5IDK3jB@q+: ^܋VAxBG_&L&SȰJ?[̜$xkA[xh~{y[FnI9up:Ij9n PVDwB~|UR!~F) B0-WW"k mԇ܋h/bԈofDܫ3)fUA= 4_}A 4mAi;y\gg?76юMˇĒ#|$c8]6㳆 (bn0ŌݦݱrW4MxOͧY9uCG+8~mC#c(^`KhY扊;\ {3G*[F+|Vh{'񆕨iy+C_Y@,և{}oO|*n.!F/aӨ \ wo3KPE|M"SʑZ>{Mak I>Y/Qϰ?QA7> QQ\+iͺyewPBIh(xDM  C2ᗎ߿/y&2)7ҁw{-;UH#H_bU夑͵@WCǡT/slrSEҌesИ2;؋y$]' "Yio5ct)rg  -񨾄ðZSEw@\لb>E#&XEcGmǰĐ54xjhwg-g1"y"z =|fU/w6`BW$huQ1" I)8hG t#̳AeV3c W NPaG_q@=ӪBf:PY F Mu8@{!I[4䥄D;5> ߤ'H-PEʴ& Z i*¨AQLAdtP&BBwP(OO Vz7W\[8 ^ol:ֺ)$-Pse'BD78I˱*%> 4dZ&Z:<e8uP~\?AE. 8q[?u1 WHbO~mzg]$@י p,Y&ڇS||< 07(lDJ6ٜ˦ي>X3{0DF{E^!^Zf 3ٸ4L=%Bv~("WSI HequϥB2]DZ]Է&ywRz0E T\p޿ChG _C(!$sXk6Xz qߵfa1"') 6}yWq]5jAToY/3LVoXYUv, Ŷ8XKJٿ٧wtl_4|5IHg? hʓuf*s]@#ڊgW/'4Xx`B'||׮sĶ hd7Wv{ m;B vV-~V@ GRs7geDžAhBB?`i桭 :W9{w s2ȦsCe_ F= XjZ;h-Gjə,~ƴwz'JfQhN(uvDI ,k֭tuTvhB5Al4'Nk0e!T_ kS g3i4f#OMI 6UI>e)/,ȓd3cg2n=jb)c\2M5Q7obi[y *54sҖ%K#)U \. dTI.>u)a7/>$y4$ *ѣf ה&+{*dIϤ1Ѝ l(dLxzG ɫ)@:TgbM.3~]YËݙi<1'Sy{KB|sCOc2:.?a`vFڌI 9hE~udP^FrSt=+MnP%`|$/qohQW~F!̪mrUFqK` rQySER:%,HmtmjqUi'O㥋boWQO,Q&Ud!x;+Dэ]]=:x?p,T]9ѕ[:rc=5DA#њ,Jk/4Đyϵ+Cr_&p NE@plp&5Ҏ ]5BhXV/;+8.~;R&dT)T>`!Oʕ4讃]ޤ6yճr)A q<[=oB;-1f1Wu4WL,`SPK 1r iVMF#O!*.I6eL[ Zkm|Ż.4kqXdMn}˻W$+HoQ9^^aXdR|Jڻ;}9oCj1AJD˶{i>iy)U VNJᐘg/uuB/6"جc\Z ~#o9DŽỹЛ#{-҅,t+z!i7V{"6G"EMX@n$GisƔf[fJG!2߀)ƚR\ތѣ@?P2Ϩ&T%VJ)+A$d\sDhQ"E YꘚL%sAUmx$o*IT,A37UlJT_ÌYJ^>q٭ Hbz@.+," 1NSv\F^ehC#K 4u%X[K+Kmp;~ߵ)]wf!~jx~ANUh¦i+IPv=Z;+NJ)H2l(⃃C2w,ފdv'<"/%i3n]6=_vHs|^R=aaTwlR`fib+"%LjuBף;DV,eI-R=loz9-DZ'=6ly>a^&B:wԩh%EMS΍R a<. l"RP€HɄ<b ~pǯ`Q P!iq[l92*ѴnWc\As-sB$ 6pYYea^ӟx\]C H#9.d#K3w%6D90Ă;Qo>## !>~D9iGa?A)wXC=5CJцpjbsܹdg>[_Co2(*َg75P61?# D ]dVG5H5썄oePˏBfPYgO"SPMZ`3=! Ei="};+8m= υmrɥoc`F\ؚ9?nʧSQ-["xF5RB Y?E"h2qgHf٧6d{h2Zng0FI_0@t0q6L(Fn'[;AZh9°TPMTgwE@Px: %P*Z5FT?U[^B s 1E9^y@bT;T:2۩t0'{Wȿ-/A /xԄCͮ{k;kOxc9}BU(~0n_%񎦆 V(R<.9 &p]Hr̎e#Z`^8C4`q O:DxA&ٻfavuѧ`(m̽T=j SX]㹷\6~ZR5HXֽq+C5hŞ#u*v=fUi͏$fB&(@0rk_na `s7,H,ӵHXS}O^^R*[OPB.c:;༷< _V_:#S휗pXN뙫x/OaNZHa^C!bDUt'T|j=? $]FQxUҽ Ɨl{ClCf=PDP\!Λ7eYW")$ԏr¸ D\;NM|R׍Y½3qǧR#2b7Q}؞biaeM}|IQS~d3Ovbc$MCEx zJ[?N )3݇ Xt&6AZ:2e(Uh-w$\uo~oI+$ AԖX9Nрh$y,T\ckz4r@Vl;ۆ ^'xzz݅.-qKthaHټEG[8Pl'IXtvv) zLp~MauI6s٦'Z=U#6{%c/҉c8QP:V_S_fu<3N@)kQds%iVz?ѼPc$NѲ x6szYqd!Kp C,Ƭ ٸU'XoIHse0KW^CP{̿vboqUK}~|QxU(*Hl+v-SjŁS!!Op9)ػSrDWs(VKQx)F XY ʼ,XP[z&̵ACkjۡl-ZqϪbȎV3>,jŵ;|vD_I$^N8@M̎*=s%pktvaQFO ٬qf{+mu WsF⇔ww(QH*/m.>>=09\cȎx =#^~M4t V2 eDO[wȸ$yW(pTa(f1r+#YhgIo,c oz$eG od#/.rJ)%-X#>;&XY{] <Ƅm'oYqy~29CE&ҞRN"q 5%C$E35 $ .~؇ՙ7&U9{Brk!{Fs6 -t\ի1b#P%`!ka.n+GR06 w_M٪H~N#1 yÜv:3}BB΁Բ@bWM*?`a4/ptFEPy-QÐ61L]'7:=e߱[3I^||33S iro?&yň>Q_w"JTy z9S?&ֹCZ?}`sK񰘦*|XH!kkfH?Mcr?74alI!k!/kAW~uOZZu.%d&l BǤ˘>SMslkF/m2n!Kn ~CŚW jK0t.¢境=!?L1%'n˖Nq / -b,t~3W?ҹK?b,\7!-EW͏]"Kt8ը!m雗W\%mCeNDkӇ/|m0U2OX2TvuB?d[5ը+ }*m+)6ph ol< FY휼4 ~Jy^uQ,?1V<˓N”|>|#f ҌuT%74U?tg6)%%M( R.N U1W:~R_3veG4T ]<&s`DF3$e1bT81-J}>,2ƌwި ὇(hn4^ݻ% mN\|"`! ^}'+g\Y+cv>>.7vWkˌ5TDcF:xv酎9>47qMy5h9b=5!М*)3Ub-8 C0+L0Ga%-{@*GǃwQ&BߏID"j:揥w h"`&ϭ`Djp D8i`iXdKH2I9SFπ' ?. IsaqhID[GX Ƃ4B'.`ˎ օC~ MˆeSіhQ1wymq >U N^`` {I{|z@qCaqly=b|ege1ՌvhL"wu}]+i.zG6s8=UQAz? \:t==Y=Q-<H .eN2U?*7}TVŕ2Mp]9Pc ?,K'\BE:(s6Xc5`>mP^  {L$IaM )n=>{dVi5T+1T+hbP'ZBz6Bj#%œ3,Uwt\?|@omd]itcaG sfD؎ܫ_ߧUqD Ka9eWRAA;W"ղxv؟KߎBI ڍ5PM=U5 t}Gl0u޺'XL\Ýk{J(VSV:tK Z8v-:}:O0J4=pepgQؔ`ہtn"}lo./#΋wu sdQZa,S.)BSEr1 $Tzxl%Ձ!:ϐtN^524(1'fE;"Gpd;ʰԏ x I뛨i#v{%aX~)?gs[l*"%CQp;.0T9+ް6AzZ^<FӹO^]`5*U;yGٮu߁.oǁ&aPt9JJnwvT.oIQP 5 qtr<ۆPΰxj5~'=CJIo&:-(ַ`=fo%j7BQaLLHLYV͟>j۸WvrA~ٞ!rCz@xW4{6 Q o^zӣNX\n4Fh0up.r(]Wl]΢xHCpZ"o͘4WnWA`NC 8x;902m 8U"tiJUv =fϱKj ZT(D8 mȬ)-#ų0OC>OP_]cw0ه}@='>uq 9W+ vii/6gaGxMQ.ϤM>4䴌VH^d:Z<8Enn .+3W`-elkᎢ̽Tš8Vʹ[gjo|٧H`eG+w\:{Ye |H|dnJs0D )U})Ï'Ι:j[/J}.y)N1Gy^9mbCr0k%Ϙ?\+vvaE|v#J(b'$TwuWo~9f':XrL(fnZݚE&y7}۱Xݺ𸆄pd^amwrdW$ŜyoJ/zͪiF 0Yzf(<4S0ѺDo!FWqd/'Ȇ -Usޏb$OYwdfI0wA7@ĞM,֎q;W{Mxdli`;'Ro QěPi*FvXfO0|.iAnFX?"cZr{o\" ہ LNq^ltǫL)YWhV\s?٨X#F,bR5DqtUrөui keP@$xn; MAIBn[aϺ Rm:idC)묻f6EݿvA8:_k(T ҂\k|Dx=@6Yt({ºo>~DzҤ&)jCOCV;TS) 5 yW|l㫝!!v) sµ uW#iC42'ѺUfjD6z2g/}P{~l`mL0vW%k ÇB7lSy.x) 63[p[wf0f 9No]$2enh`qmLҵ睸R\Lye=ߛشe62ln+Ei1scaR{ʣj~p$i*H,!tb5[pDjAȕWgYZ 0D%Z(ǣ0B2@OhXN_x̉W 찜a؊>Y)tAZ;$7R*\^?;ʲ ! ow@Y-MEf,qSm٤tLsa" .C*~TN@Dri/5bҔH)ihƈ7glY 8\mK~d¢wPK2b8<6|ֲ!" bOhA "ΰ؆mbQIZ =aij˺Dz:/|GO ~z35[mnDW_{W+쿇(=b@ޫ4 p5^欳hZtu!l9:IGN&<;U# nz& L\zC.9`1fD=#"YvM*5^ ^拻 6/2I)XO,|af8d6QJX"D'>RvԜxbWNN_ۈ 5ql!cԣS[$>9Zb5{1hcv~oV"Cz[V@)̴N B-$+ a ,,ca?-{@QV}t?_z>ct@*i_R9 x|eq0Ugr1~po֍qI3$K &v_Ee8U,>& %h2iU֤d "Wˀ%;"/Z4jGT=C8kg9%ô Vk5?[QԸMfIBn;kP; mbvmZ;X!YМOԳ2ZMISp=Vzv]-=o7]0 5م\tV)4؆g. zZZS;¯\ @IH%bHss7Fg'4hQӐ#1Skн:Ӭm#; O9~#^t>e9 .)Zf^4Q$wz8z1S`V]BġAǗF@H~dDžIR߸gG]0NdL9ڀ9Oa\|؅dfǴ@Ǡ+4G:.Nv[JKRԂ\,} Fxl"Q= thWXw ]XPΛE 1@8i)-P=L&hKTwo4z,tRi@Fiӝ]%Iuk$X()? *z)E7V4&Y#ݕ,ljmvᘶDRrjdU K/NC7 9xm\ @Hbnǫ\<KPg U62e%Wf;Pz÷˖HZ:׶hՙȽV<KRʏL5D(; #v=*ґ"%7=68KИ`ksT5$^;x@~kFھ{3I$uؿ; ZإP"[]ȃ}XPn*pn0j! 1TTV~ I VThnFlì}(RP6cQ|$OsV $*ZWw<>E]RVBm[E~+ XR,}-xaTy1VE1g!p恎@y/k+l9J cWO7t_[N8wS>v؝T㤪)tGߔ_S^>Z>2Dm3'r.A&ld"bRRޟKbӇPL<j}K;i1wa4[G[SR+@m  ^FM. *c=.6rH2!yVjj#kUJKtJfX2Lǚȅ%*G5l89l8"tOGEK_ !4Lnikn71{Og@*%;HJ7oPe RV9ǟ:jqOdzNT8[S]}m-x.6xUtp}[NhfAq I|4)?H>qWHz h`*VQfPv/ y;w9G vw' zY~_C185Fw|?!Cf՚),nj%$`yK,`X̑0E s}%V~Ѳ0.AkTr{Rj | O?+=DGi۰pdD`ª yICV p Pm|"N6@ d|QφӏL"$XOu`uݤշ R%@ѯOa™877A͊p`kdwg;UyHCހJ*+[$۠mоk遖)X}!Rgy e䅊`lHt;WyE CQd ^QG'93bVCҍ D֙૾M2׹ܹrkI&i3O% Wz#ΝPX5 Y.jt*@`?"5ARu\nlCJq eesS|ʯYk٩i&rmy aY݇pb5tq*vg@.L b7/C?HCQhA aG Bð(dĻ842Zax|Q5+lgR&QcGB3jF1 c·r15_?4涓ֿ(富(Not"1__PLKFPųL-٨105U"Jڈ 5<+NJb&qQ[2}5-t} 3- 8&8$9pY7!PuH*5E˅YAHƟMr,uOZG}BKŻӎD5lکrn +WtsgRSyQ)#'dizɘŪ,uwJ!B6N#LAwPJþl#W&ijae1`;q[2%+jDՏ?ObVȡ}  `4@hIϡ\H|0l չ|;?DM;e ;AV*Qlvtgԋ KN5HOx4ņbX-NޜD^ăSٱgy7~vugZ~֏쑶uUR¾Aj攽= #44 |} Լ m}7ee/ @P2LװM4]7 vBiRu<;àRW Μ Zm'&WdȰjVb=A-!ZD_.Od5l &@̼j-t82Xm,bmgS:¥UAqm2GcRo^֛-W1EŌM}Y90ʽ*.Zğ-&Okͮ5aYe.ܚ^-vDpo3v V- NI$6dQ[J~N)Mqɵ ¹fu2;$q5Vdyd6O'YKג+1ǏŨmk%6ݔ:{@2ioUc[i,}9ۥ`?bk s~K?WKrHde@nN6E6}T܋̆+ː֝]mk $R,Qmx~'ܾ,ʺ=ü26/4P3 A~@_zF?SI/,.ZM2 .T<>{Ya_K˖Zj3(MB&*o0b ֳ҃!-!ҳ4ixG֚R<'..$є݂Ѕr-'.sh֙tgW7M6cL"5YH 0wRGK`9 w6R*%摋 c0#ƸGPݝfTo$,b;/|Pi.hnChKJH?gښ?^s~9PQhT |mv@+h=G5?35+՗W̪N 0|d1t%)tCuo{\+*8 le6p zG'x]>U*d;ʧM@nOI fwh˨*RUc%6cazZH,0B.1}0Vz8 !oM?h[$zc+_2gj i1EƱ*I_i愷vLIz{ϽR9st+QBoSooqB⤤y_(Ð|Fَك eTO9bB^;}?ø8U5${ob۔b>otOaxdd4} /aP Ɓo'ZS̛!E_=rȮ$}7cN}"@q'`2VС? vk29"ţ??һJـif&ױ#=x"ִ`ze;%]U?uP\!; d͟L̯Q̓sYɒ}5\dc˭7K7M^EuszfR+DR o?B !B #gf217 !4CَK,;@>R6;ʿXSEz ,mzRy Q0ũ9eja*:=pc_Ũ9RER}H&,%{tLfJ񭋭d GD5TBL|Ć~YbǘnQ6]c7%Ii ;ǭyiCU+ c]f^epS1HtՆH[Hz118F8sM FpXpxϯ ~2KHB~K8/\v 7[Roi;~K%h,XP C 5VHAP ?scx*ͭT6HZ_cF&kGJQE_qjLm+ID&؀Y%G-&s\!|8ÿY}>(FeՁT+p\'4&qKUZzWp-e?@6:Qx)FJS[ԑz,ҬӯXcmcnzYv2?VJęȰsѐVE^/9X'iH*Cђaj:/^K<oRzV?CRȾ /1=K'6!$Ϊgț1, {x]#WxDX e} ,aH1z5j%aSAT1pN؝\I`O8]Z(=:Ƶ[r=N.m#CKW;&N~eK+b#֐26L׬=ޑ˚0@w ڲ1N`Q탤0z|M17a^ /ԼeH\}JHC NU*0-YDjx;V{Η̬Œu4(@P,ts FÒ'öűhF6Ir2;pX26=Q*O'.y:~<-1Do0p zTC2t]XkNL2 nPR$ <Mlߜe|c_ݴFGhK,১'QNIv`l1D#tņn:%FdJ"<'ߞ+U+p2sQȫX˙pY-i{ۺGjG@jw wM suoRYIJLo|>m)YMJߒR#v|GW-Op'"Y9Fv-hxZ=i;~he囸y`283z^ҨMNU4P8":_mْo|}zy9X1' wc~[950e`MoYI+Խ2zB3xH쯄dvpm+4iCysZw|jm 4LXԹuչ]}ŭi^?E>>l:MޤA[֦E|gM;w1qu&beoɝdkv1V[+c r$.E\a=&؎qML%a~J!ׅK3:6!Q b-ej)`LJVbL{8?H[:zm<+'zsAղ50 [` Ll\Npm$d0g+!t(#a7Ua9I{myVPVLnK@IrcQQC*@ɵTErӱe8ivBTErڋx7RUǽl~ml -'$LXv7+7h$cZBcPsب$Okb (8Ro0 aaŽzo }@0_/S*drK`\kJ+Y-.3TYHO77Yp1kN,tL.zެ"68!c.)@ڿi; %@ 'X歓8Ɩ#&~w9c̘ [1_#i?yAA6k^nul@K Lp#ƅ(^]=,~X{mR] BsE4u'v;ys"-٫<J\p=PV"nc6ifeq*5P6$xLv&|j +z5?.+PPzs{`LAbv!o@;-i^y|U E\ŮfW l%z]АSL 6-K7cW@UCⰻo2;)jƿnÖw 9: Q|(gSyL^$.!@ ~s?88O~T p3Lt[tt0kw-Ut69J8@UGբnO(A7J9?!0?)j(Jbŷ`I#?TgcD*t(DjL9,gFo<iҵ%."R[U)TPQ*kkߍ Vxp~gԂ2ʀJE$hO m嗃 ~tv֖RM)1>~9/٣py^:ǥ2$bxTހfyU<?t:fڮ!⹿v7JM-!7!9E Y>*1X  [ԛV$ؒ bqWbJQ!D}/7(J0PѵpX^g`-mb~$1H2-tVt÷8MOA41}74BNiNL}i3_J!EP.{7ǑAh/ د %h?[9sjOn%L 9kLd؁uP I O5$gr<evL@訹2IK=YE8'QkWa?UK   9uv4A%l_|8()S )k\ Q-xz 7yQѦ-|>YAȭfȚX*bJws2,ŃF=2c߾'t=q2@ 5(.6lÌd$tm`< n34yXõJAbqr+rk˱+N@::b^Hpwjlj 1m 8Zm|'&jJ^&|ms5\i%6Vg1]DJ\Nj@zG7HR # i| ھ >8 d=|LeçR;7I"Iw)xy;)?Udz8Y.N~{m 75=/^x9f\-`*y# R@QEyn2|/@5!ȉ7vVan.ޏEɅv [T3=t-y m9*:$ ]\[X dM\GUZ0p0 .PĐLW ʔx7=ˤhg{!LS ǹn8ghݸ^N\Y CUvH4LJ:5B|U.-o=0<r7z/<yyWt8%~Tн`;3 ˌ@RC\6i15 Q+9tI|]'4: ͉M9ƒ @wa a hWq#Ƭ(B﮹Z:hhO *R;V-ŏKJ|^O$9!NNjoAYHt?Cfw9`}E[_܃z{ &?I]y$ DB[a9y#MkiX`(D~fz( y:H/0ㄶ~P }H-M-WyD\&ejOȩ-} (֎)enR !}l׮].zTp}}1j,꺨}2s'f]SO@Ќ&h>XbBVlk :Ѻk뻈,\Ȟ$-C:crF7O"&r֎/fdF`J#HAGc[xyc%ꀜs7ŔG /z8kHۅnѹ$9ƚdLm G3s,^q8Na J3ۂ(Nۈ!`w+Գp "h4?ȩHoH;t:wR X͙0%۠y\ū3I(Dr@c'Z˷U0}˱% IH0,ؠ")Pn1v3r ЂF%>Qp{? QȢB^1#8hAC !jv {R1S`Ļg[=&fІU˹Z:LwV2gAA40i>h"؅L6=b<>mZ&d;<,C:@>e||2<57xkD'8c\GE&d[z0]A6Nl0$@^)(`'3+go2=@Ye``hp^ff9<^6TsUh-K n8{wbi쒠kB[D)]E7e )JBM؛lgT d}Be -}KSSk0V+#'xmT3{x/4].\!S"@,aS"V] $56Zi rJ-bJ],y$QLՔۙ!t.wgHsH֟ _|%AL"9mx%|`0I볡q]af 3zE\Dw{d8MVʡޯl|"zs 9lIh\ jmgy!Rgz$(gSz)#P:ooh`Oh%>᭬f:x3kBV+9&aJƯvH|xe\a$XΎHBOöթtCq0-ZaNi$o^G\GzQ˚j)asF/sFZרHB2]9R;az4~f uR~b8wUVj=!//jiApۿ1H#l& Gr*S/0%"~X7@t&Ex7'W3ݯzƼGL/@[(tGJ깒= ;nDpnS_F`Ҫ ژkH#R( k hxgڹt.qvϑ`°c̰y ص}j^gV({ޫMd=ӻnHj@PkP(g􎕢;i!ĺTm`[᫟Cy|ԭ9 u"Bl|{ǃq1]a*J#Z:kϓP2iM¶fzShK?9jLRy-wm}wX@ȾTu# OfR@t*3S$rY flbe+n2/4Eвmb"|ؓqYy-@B Iy32~{ t '_ n̼`FAB}J%|K΀HNRϱ>W[#|:[fs7wnR /샪 dKc&n@J L-/(UhF&gyLv2+uU^-=E8\mpL!nBhmY=x,pKTrQ|6o[zܜt=B1& ,onR齎bmǷ9z]3FF Z9AW1VUјQ9LTjΏZ`yEn ;{Ϙ-/ X ӧa^  #tY LX[h 18~Yޔ,Ti??kCмe_ZVhp cȫ, >f5KnR'ljo{cz~Ob*gɆ;sX{Z4<J ;,UcA,\bnFg@NS޴,i<0K$@c)!90Izf9RHƻN.4ڕ-t:}hSWЇ^iC97\G~ Jh8ld[X$̶z=πF%!3;W+ֺfb/Y:>D!=^8s+zDiaG[^t!ΏU#,{&7ViCнWN'W!-";͐ m.iZԼ6 9@.j>|j(_]c* 9HaD6DP8TAzc_pX:zMLlL86' # ,Cn΁VzpzHhث4ucY*08 `ڲ|Z q7ljB l!O#.MSs4;N`];];13m't$zT;>6G-lb4J͜ti&pN+;& ú{1軬p;So[=RSd$*F> s O>mT.}˩:]!y}B܈.%q2#*קlzŦ6yeVWkM3'CT5'O>sX Ry[jfJP=:o@8WIgѣNQ".vO#cY*b :ګ`;37oM;LOba}c GҍWlfJlOPZT |Hw$k7SeT@n)hf !_ʖڥ$XF'&+&N*a6ǃOU U4@tɒeԸ%~7sژ,Ԕ4`dng,Xbrݿ? nօD55!z-ܤ){3CLyuc}\ڮ l1=:ѹn~x_3$0jMqgZXEXr("ZUb5[:A[|FV6M{ خ=9ZqJ h[ @. ?نsB Xj&y5+"NX/`V3[J҆p4@Sݭ8v9&ɀzN =9ղP{[)e<lХ DC >SuBf 6P , 6T>mZ(ug\6p,&l{a^f&8S„ܤ@!Ƙ{y!ÎT&c҉4Z>uOF*d˿4G͛F+%1:\GJ~>`@bu\`Tkc;dzzgoQ6XK'T.NjE(7 1Q(R<"a>7Ɔߩ׻P;1oN%WЀ9I7}u~P"7Ϻ4OQ]"vDh'ROeGxOCq=z5dO.#bg%pJ](: M>.ykvc` /{ Ɛm!gs_! z=ʈ0.Jk}laI_:s_xMߵp爊,+o51Ħ~L*X;M ylp*Q\Ou\܏ %bj+pf7֏ch1kOUj˺}%`PB,ɋyqzmձAM]ԋ;%mK4n ©]8 sZUAPI s`un7CgĬN'JtZpJc<%IU z48bovz2!y\&nBҿSK\ 9jqVد n̳*s}}A*|'zt L*jnd s&NW{̈°2eZ .F1X3&at:~$ñ+ f恵\uuHә-R/y~!( O:-nRjCfP_G݀PXZ8_Kް cFΌ;qd{7k{˩3!rg Z[} 13 a5ČڲmG:MkC,[Pv(PiYЇiR>tpzcà 瘣T^ev=h:{.  dmeq63O}nsgFq:%0) ;^e9@8`<#r, m-]Ak  QU ""C)獱Pb=]ˇgF`PœEʿCejDlCƞ䩥(6%T< @Nem0'۸6S{vI,*-)_LػعU J^s J-,%;NZ!Zt 7(@w$=ۋ0W&x%:;5, [<Qǡ욎[:FNDL╸)~.WQwS-P yP7y)pԹO}dyJj`^63逌 | ?J31.If6ѲߙWMi,8pBqBݖ;Cm|nJA8Fr߻GZg91HwDeabG E&2jSG9 3TP(B%޷nL5]MS1 JOf9Zl}@ҁF}:&б+ENm vzt5PSh?ߍ_lSV47ᖁ*߷ѽ#a+US)Avѻ@"sHȕ "'mGcwk0U^Y^Sf1@0X+U|O13L\9;[ZF|[W5KMɨ5/wEm.U!kA >IG "jT.e1QjMDRp7jvם pM#@aTfp4<@@N-C>8IvךX{F,hl"~G7uJݒؤ3IC=,ij_r3‡ 1}/\\ 0#1Mr= ]I~n nV((?Q)J] -KC 3 tbX8@j5M2bIЯ _"kn!?.=7 ڰhh@ڍysQPknOkDkEԚ5Fk+ z)N&5qcFps\4y} #БGqC>əN㫹FH3$W]Dw<m_~ۜIg51D~Ki;zb&-v&ջоxD΄jCer '+(et]M,* [/9tzS6]bE1cS/ KdY.QW]6~|"yWCBm_a-?%)x{a SE\-,H!8Ik, LrZIgo1m ׮s# Ue΀~Ur! R 8Ty`jDFp,J,A #AuC 9XjeB[(zLFcwESMe>[n(T ēX)+ ĚZAyԚuw}!>`b0 jVAya~JXBcrTj\ O6cx4ɥm2(W`j}J̵Ew(݋8&Ԝ8~9[<6)nODȗ$ʄ@v îׅȧf7mCGo?CC) F 6w[u["r9%&#c\3t0tE5K(HLS]K"C׉itpxEn4C" Jt"f ,0Դӣp6f2 .cpfҫR"J*LJX̗jUF1ǯ5^Ѭt@΄kurС~-듘ȑl Atn. =s .N*ՓDcQ;&i%їuoz`$h|A,| Zalj̑kM1^I̫>orIʖ,0\ V!Y?yc[5` 6LNQ/=[6VEmNakrHn`aAF%@SjO'AvVAF켞i>0\}g{'1#qd&8(BFurr `m׷MGWXN R^D:OLJu,ndI9WGh앲vBGԄEcE:W\L>cRp* ,-^_Ak&eC2p8m@ d5!-jj38fu)kUC< Re񡑏w%2O yQ/'[ $Z 7xh=S'sj=Dݠt}ʶ÷YE,j3R{6Ɓ.CL.vQ#p8VFB9"7% %pfx=UgL-­U?[S@z҅-#r+H8xM2TiAn^~N+45\=!a[0]G|5M<|0^Ho306wN\Ӛ>v)Ed(ayCǢBOKZq: P=6Mu؍jH~!POY>7q[iO&їR,@hjԣ?~eoqzILBLyDL>W1USU XD /2|׮ 7yn늨yt E)K,at%Mh.XSAd,@W9zW* Z/z슭;zcRfP*3u2Ux êg.$S=}76f j/":K- >}#ъ4Qt4sb 䦝6^m4D z q?FܕRPˍ*똷{[56 =Ɇ*4-%%qƝxU! đV=Zdmr"+ӯgWwff{\G>Md0RIX)h|]مfI B`c!t{&G^S)ڣ|`bm:1s+O'z+͓@_TQi9˖)9dade>W|uQ;٥UH_sn] 4xt5/ X2_;L$fR?8͝a/$y~zrb< wMJ#ܺOkNSjO'PjA}9c%{kt{TyQGT:mH43*^u$rnd|͂ 9%ޖ` RZ@q3 Xx>RsDv fs}v/Nd|8l]m>;&wr~`Rw}roW^f!St.) c9 K:oޔJ,UFFI؍MõϕA T͔x- [L3S5dR2Ρ^F>}@!C{ r\agqu9~PfcYEq ᷼nўMpG Euwa.M>y)US,z74wEmM†䕺Z 27ǵe;z 7Vtaõ6t7[Yuz3闃; ᩐ*<_,IcxOV}"ￊ(N 8NX|ϳdS2zz__垲_\Il}W'.eDOP ʵ,{c$Be=6V{U!)R }gd'aAit)%KPVxlq]OB|"LהxjQ:ޔCn@8#ygi/puwd$bvR_/j4ۺ8Eΐt"猄: tx|X)cm:8L~5)c>\{w[1V 5+(i^XtITV:>X Q+!+6B%ׂ >|_R Euozf$gTdʂ͗Bq8^04FeY] J4lcn>ZE$zNЦv|=٫;ĝilOrmXqҋ~81 -'>*k4f(xߊ%8<]:T:a%9}Rhn"Π&E8%"]h}j\J3H?jжHKA+;&%`o`lC W@nS ȱZNSvD7uںb9<VTNMC@)@K-6q Rqb1)>霓lmh~aH 1o78Z)JNm\@]|t>5as*f9XINiFo\꾁#nFtA@u%ClLbBZ̆}]0Wk@gS(t<MC.:Y!f,BH=D)8YWE/`^D[떴L,7&ݨo )o!>NGUk2⋓1(@gIK汃&ǂ=hva f.Ҍ'*<|b~L?\̗2=nv[[ڝH|\sФ cguث('NrixtoXD|%&}eŚbkrh]cܱ)yv *3jM$+X_ʿLVQ< vlKH !2XBa7װ6ǵC: zY qW̵(E1w>Edbf'd[xSNW'2^dqnF$@&<2K1Z -ž0*~wXǨW.9/XWJm\1uүAnMߋѽ!DοQ7n1vn1}䴾X6ɜ2Xޝ.V F ]ECZκ̀b\BX|qkcEpUTXLeW_z ˭Ryzkz'b~Ԡ(uwg2\n6{"λ1mENu]bk8ȴAg\Vžћ+JW*gF& i՚2Tl?U?&v֔2F, jijfܫxO0le?O$ J7nZx*  zu!a*7I8&#(A/~G95"WIkGj9~yer_يh'$Tbu]2 u!p-љ]4 P'F+)o+<糛7E]{Y)|4hl هFs#Ci 8Y'A/@d7]F=wvd4 97+).fw#\VGU 355Tdž2ckQ)_8N_m-]V M.]0D0H&k͸P86-U.Z%V9K7qB#_~'̟08p2!040IU]c4_VfHki LrAO,[oevc«VPuPB#xQ 8淝+`hb#3RõX 0@gY7дzBG r}Y @*4ռ#Ixѵ*h٬$n[&ϧ+Cb=dF~؛C84E<X-0_Pvp[4?V4Z|p6ąk]n){'y'[6 "׸g36"%ᬄ`1v<3?]{\{*v_9d_H-,(4|q5KbUK`Hj'ԤbAr KiŘy^0Sx%["}qKZ}h~8)eN%6p*]WS]l# )9gb]"dG'B0"WGo$T &()Aע#eͮ[oߙmF y@ԗ#D c"Gy!.<fw!mOkʝX3ϗ < ).R vS R_E)lwjHɋ`꘍z{+P4󐈼M p\G[=:e\bsط\/a8Xծ*⤽Ɔ"Jى-k"2'd܊u1?Gf$bģ+־m}G^0)IIkg[= 6m}F6|͆/ yG3kxP;>SD(Mt,f̠ȫn(@Eu&DZ#tuϲ$jÉc_%pâ2\⛙DyW[Y0˂L),k[Y(cU'mjpjd1ΛsȠڦ~#3b[)>Ll㪑S%jV/)#ԏia@#rCWA`1}yaܳ0XcTj`Tzt7lT7raOۏh qG۠y\!BPUknAW9*.f\.i& ȟ%U8 Pwa=Z)M3zh{ֱTm4<& :Z+LL-CPw^ܡ8c>ZZ/[~uh -D%P?:HBXnEuU&ֽv׹[H'SF;$/hvAZ cYI<"ƲeYQ䂎$A7l%9| nE6tTjXe V(n!E@rܚֳP]~rr- 2?Ԩ8VWerD]Xq]-?\(:I^XH3֠]Ou<=,h-#UqQLÝYA_t6cx5n #uȧSp&vߟ5eG Qz>wK֛]9?wo(հT;Zߙj}MMQY+^QF'{ZrީXaFǕP~*f_kb0Fgvjb<6]Ld\FIJG>Jhq9x^5>r3ENP3 3'dR۽V9 *4WBQS3]<6 S&q c?ASH(ğOa"O009~Zb%E%铀:I:y`er:5_/QƆʷ@;&Cjc{$?B/vaȌ> @n˻g/WeO(n?D5;XgBեayE3vLde1YB M2Ca| !ԕ6Esz(&^! 麺HȠ~CxI{Zx`Em@6Tt^0 %DLav ˵A6ؑc1@V8!`e w' aKKSxYJ)-:iM.X8s(}rb!0YMӸ &qhi;n?bw!c֜LR랡~*12&Z9L5^7W'B(*h> ¬BKpI[uLERII7fnJ{<&ݥuK6۽N#KϸE.fڲ[fF< 7$1m"3@bܦ*.%vPD7M0Y,(,8"@qt,ENד[@*LIOKt c44C2tt3 d{E|65VM vTBY뱤&|snD,,|-RrLJ=y^BW6A@;Y}Zô[ ZWFřt7VSk{QJj>"9LJ?ٞɡ^{{eG[uJVWąpfEf4- 0?*RiE0-ʨ4rW,n C+2_ss{A+a(Q4c%}.R:ُnT } F28HQ,MoǍVvdx}u3r7N>W:#BIOw&)3o F?%͵>9-S.9PzL7JDA+34I=h Ey$!i ,ʌ$Mh~J@%_ɺQC n Xv)H팿;Hmb !fl1vڸLNIG_FpCD;|1{⿥Wr79Ro\)^ERnc$SfׅcC _#Ob_/[zDiZ%D?NAmO1 6溜`N:RoAg!ѥKm@u|"I·?_nr@ 렑kl.ݣMkyC뻺S"=Ib3l0|*Ɉ7!0El'?X5'@$WA!#pcP,&4$qHmld+tLh2 9牏 !y)NpBN%)#C/t-hVU~G3G Rs-BPkHb`)!T9S@W@u- ͼuⱥ(~wB_֛bhf/ C],)9oNbfVR|>CJy`5 `اkM[.1sPvء~09fy!%*pұ? Ð2](/ъʐ=VGde׻oMB (칧+ |,?@_ͧū {ѦؒOsfXj@aA vu3H E\yw'VV#y4~$ A6nlʶ.P&{ {yL|N%M~w0s0ob'MzfWU> A\HyE"@U$Wzx ~tضp(-`ҵ)tlOTxsDQʸs _> lHSF^]R/"VC Nȴ4?FF?Kׅї]jyL@&*[(Pbp_?{K Ҭ2H!;5Ly` oM '>g%8fI^& 'aiJ6%eOgf\+kMc$T+1":Qkç6 [Rwe#Nv—"V<,woJE/ZUi9@fD EME Ny([p,&4hJ_+5DyH={oUCu2!2ӧH5$^L͓)m Vg@| H[ cr=Bdͬ /4s^qgZs`e)USj}/<}0-+;zxش*6LQ@D. Ëcr)K[4kbb'*S! 5_Y)֖a+5'FDS~2#Ԋ&>ry8Ф ,2ST|2JWAԖ zf"yK^=YhT]z< aFSŮyOSCgfvbDO:(277EM@)c"]$1*Z^9PPz%^FG-[RFABo$QX]mWg=B2+! ԍRR.`Wz/@`Pe.'dtY =m2p"P>9'h0p9߂#8]"_ZU$F`ET{Ά~|~ 4`.uW [OΓ BVN2ĩ4ȴep}GMt;埓RΨR#QUF85:-fi; D\ ^[V2j McSAf,дc2Urnӄr^9"nPI}GB0+.ٚe=zd ]/)̦!`",3"eJ\SíB:̗t=Y ӝz\rId]GG czVj  uUTzOvŲK\ H!6`Jv'UۆtD6Z Ʃ&rB}GlV yKԱgrwGj=Q| ,5Ф:AEa'O "*vm0e@0fĀV7oRgZP_D/5̟y/\x'PCQ}2TU\'e&'dm3ef^_ lAsZV}dnÞ;aS|Nxr9("iF5j/WHmo]qD2s)V $SR67'ٖ<9F< 6`L}׷T"~ HG/_OHE"ߡE8vonLw(]ą)m)CeiiHRE 4MP kNPnU%:Y;.|0ѳYvWLjEBZ}wEۓٶ|QwJΙV~aU;IXHY(מn36p=tN_}~99Nlt^8Љ`mWZL֕<x摐8Q=.h,dg|c7kNBNDmݏ,te+qTQ(Ӭ=oG\'jNr>' M-EgZ1Nֱv$L9BWϱqBMRԢ_?p =mccؤ/|AKqPzSfqP:G%2Vٷ*F~8fB?oW@ <ŬiL{Wv|@lB_gDG|&e@n2pdMy~&XY(0:uDh,ܿ= J4 X:zՁ,! l_KO)h"d>T;18o6E+u4P\-'Y6-ɆyGOuάT-q)4Cdlv*g.O={6!W6 `.blWBQNXsEBOCd4ҡ׸w?NF.%qۡߘ_pފFA抎  Ac -kFơ7f]"גK.>5s|2`rTŲh0z-r:'$K |̤Q Et>Q`uޤNdVZ a<>Nq *4Vbw֌C`d5m=:k[oe.72# گR${椆5;eJb`bqQs7Jډ8 /PeE lωXxHtdwR-N;o%(@+*J3 Oj85e"%Ŏ rv[ AC]Ib:ʮΊ7<u}jc'-;h?c3N rd#a؟i(=,t52ϝ-l 0VLxms9ϭܬc浐DN#"Tb;VWUT._{V.!P 2A9+Rf*e )1Mtv(QiNHx,dВܽ :82v>L+Mʣɰ}atEwWSiAxq,(kaO0\}+\$>#iQ;:2DuEEݬx gDyڵ J5clKkVUʋo:3 V!г,VxowǑ}5p=/( ~%]n-$;gmmC~Ho\8u(s[LqTt.y??ҜF m9y}>Cb"RZ(mxس"!t4Y@fwNqj$9I0PAvxO`:ز4lx3hkyOHuEs]I4앞d4dO 8F;tIzr^6Q]Ŕ] YZZI~ءplqn l-`Ulx |$on YU:- 0P ߥ=vnO׌c-Gc9. q 9X35L xtpcmxJD_WB**]iPY3q#,-@'+{9BQŚɚ߉@?TbX:-Qa^̥ ET/X|`n?.SQ\/fh0Y c1B_EYt|65 0g2]Jz>/Ҏ$э+>:zt5EG7V w jHBT/5S`mԎJ i NEN0fHN$Qpq ~C(v}9,W-gdVv ,7~uhqS v\St\ԨMP?ZdMF5K ,*R[#pP}{D$֩ Ɓß^\L."p# Fg;:?HKs `hDݷi |r{kPNQ] :4oLsj̊+ ,_VC ZH)aB/ j2^\XjP[k5IQ ۣdٍZ,oGQ?Bn G!^"é^U鴅R %ߧBSpIn=ML'05-_2CU"l`lR͢e*A\R(,{)*ZOlҠfd#sϘ-,馷ˎkPh>v~rjh+G-Aч`X:})z\sKl˻3pRI iIZ,mg#|לHgiOf!/0[Bp\%tk4y)Hސܘ::`sxܛk<""nn X;l$;Ώu,m*GGUU!a/7:ٕC46m0JC!t 'd:n $5P檦 TvII^_zӮKί52죷uw.kGz9iTsfgmrĊoPȉ+k/BrSDrC^+ i0[|Y7Ȣj8 M& }[WQÁ1qf:,9T,}/SWޚWuQq 7 f825Op{$:~!^:)+<Bl|#- uЧ$uwyC|fYHGw\ޮwlNxNMoz:_f((3QࠂXU@jlFo袹|{t/$(}o}@T4Gb%5qf)zZb>}ԍxy,Y(lV+0]?tdVOtY@+ 86EĘL0}Ȫ 1+ۖ&/sr֟~)MG@0CC44n1zvu]9;λom3Y$MT%~y(|NEyMhNG<CUIlG,/=Jn lc XGS}3[K-`rl=˓6o:6tV $?lRJ g]P$2s$xȇprYڜ1sv@,dcXoOF+9_ca`en]F`fX=MøL1%vLz1WLi6 TĦȪ9IF/ arQZ9_itD:*HWl&鏡u@Ki0@rFr_VOvVUCQg$,STz,fj(/6"E& V{S+ "(<H'vs9 V ٖd[E4hkY,: b"T`7h֏-oA=VVFÀcW M E챠+g:fsvw++̃~T* $sUbi0CvY.{0'XLػoSvt_b0 8i'JHO=a'6x%7rBI"3 *[ VzR<. gDy#8eaҞ3@G Q5^9aeFC:PFz /]S2vqh0|H8hbf+JI+bq` hsz}<}b[쟷(+ 72[/]$"^^?ZB8Xf~.e"qzc_$nndGu\0ŽH]w/ؑ(!'tVsrd&k[ڛfذ HOL/AXpJ Qf"'!Lhށcpfh` YӠL6` >JYi(s9%Ӟ]QET`MюQa,Ey M}Ӆw#Q$;Q4CLmaXOUOm΅;#Xҧ9P@ iJ}̪/Mo]pT]XSHOj!ʒoXU! hf,J(l M֖`^VUgV’4ؐz_:,W 0B}RES:6bRҤ3s+TQeg6nJXM,I%#WDJΰ=씣Mcv xsIe>8^ifyIF&窷P3H`#` /1J#{M>N r3>J~"(w{33ʺ{5*jdWB^! е('x#5ۈPIG"D(riDױjq7 H qWU#?! PQ-B\&R ݾ3'h.-689XMkVj<:XeeNc(̜hYZvx8p)yt FMi#Y@'ŀGt |(Jt:.<|IĒPT8u$\ϸA/|^%P:' p`E #"eםL۳9XK71}:ft GM4'5ڽjm%f#)O ?DKD S<>jkaoOzylY9jmS,:=ăζJ$d8Y4y֑A16w=Z{%51Zt~49ű$,n*3L)wd8O}'8Gf۳SJ^+*0k"k{sTQud91F[X!hi0':FcyTeA ]Ѫl$"v`1)w&4^DBtDwPHV8q4D͡3hk4TBCyaqrʉMH ?W`HHbP_y]YG@Uʦ͉N8]̧w ->s8:t4*'D+' UF 78|.vUyCYq՞r#Ob[ fM3c<ŝM μ9$6f",W`_ӗ6wۉH22'5:Q}G|Ā`촅]ϞB %;rM$K6a፝qJ۶`E'pJUF3@Dc>u*Ʒd3z5ݿ5!$}>Wi50{$DZ[Vz`   "9F8$T7Joq`"κnѳ ?anjm)hɳ`ELˍ8u$41M=e<~c͝ )(fh-che:[pܺV^`)Dg2j-{0#D)mkˎǨ!7Y.7MMT[ eڨ$ɇmZ<%!EgsgU!vaL]1)%:7}Ůdc#$AQ盞a*6A8ֲsC+ |ڮ`{7zepN>Tll)֖Zؤ4)>I^8ycRepfOw[лV% WE_dgw+npd(E9=>4wwH QkG#ĈE60,;'zG8/2Dំ y5[U^%|/ȣ }WdZ/WpVAτ"EUG,ԫQW%l@v{~g~?=,aPJ,X9#AGh빐i4nY9cz`#INu+DvS_unc('vKEq R3GnS@!.r<ՖtG&}kF߮wm W&_ V[ -byx x#to(j&VM8B6=E 0(CGx0v^@0$b&E]vKYޜؠSv=tPg\7}Hwt(uv@AH>m4ztiN-& f~ |l#V[bX!irC)EQ:E`3$CҎUzdv+` Lvۚ&It_mdZx?T?l7[;GTGgmiJB\B( Yj2c1(s"w  |mt*P:-o9yNU !?E\Zi$xŬ &nTIX>|p$-.`iK]PP\!k э]K1ty5o=)y }@qd&5~'Nz-pFViClSe-=UC})vrM Ѡ2W~Y1'LDm>=ޞq7 $L̦Ѐ+ sC-+GԀ-گG@w֦G< 0QK3V({#*_SFQ˶oԚ{uk[Dv\4%6tV͏bXt}mQY,昹4%,Eb2?q(A; 2E&ziOrhsae1Ʃ8U&o  *az KeRh<xN)q)V|@+ƃ3UEA0gh as^5MmYO_w~NAer6C"[vq#TO3?1<&p^4Y}{P@qQ 1wF?=*< iˍo;mmsO\\'vnS/V.gF5)E_LwS.v1LMm^Dz`|j~G`:F)#o)ef !7u2.9b5fyYou(Z.S9@yle?0nJ+ݐf,X-fB̎ .U:h:3WsJGHO.m6Uxx uW_YU1 Og89=)M*_G4l3GR<~_ϾXoQ{]K\>)Ɖh@-G;Ö, pZ%]n3@k v+uDZU/-M 2U{52￳ /jW4$Û E6|"MO U8 d+x%(~+o-'1O Ҫ?]YÚa1,r`A!m+( U̙@ p4aʕ?pY(-A\KEqP6*]RT3N*mu7Yo $1Hɟym[K|w}Cwƹ%S`cgi /r ZufŹ7H8EU]&0MhS1D>1F}{?8.'z>Oh#v>UPo.{gaCn󍷪η:DͱfV6/)"&RE3d$xIzob ݓ;b׭Lr I6Zڰ[c넴sЫ81ON%uy@`*/;Gm6wb x"ͣ5*[;A}zȉQh7Љ ]@=9plT_'ø1V߲bU-2ӑ،R>C53e`wA7tGiZ%K:Xmn*V }GufGAFU\:^2/4Q]rlp̮FGƵJshÜŹ&WA^8WsfG((5:XGCYEh#D5740U$!m؍tKE|ai$ ,z ] ]V(&_W]f";CM6^VgCP|hbun8=]Pg%rK]fBwU({,CѼ$8-;g X mժ2f Cn i Z4FQ#K`k6ۭ̌|>\7°z>zPmD&u*dOUڃ Wʃԟ@`'|癟ubO8<gMCTo /cbvGҏȚTIeis' Q#l?:dOIj vGij!}E%p;e%%ĵXWح2"د+3yU=3J)!EՀ%: NWP*3jஃkiiخ|za[v:9:6Zf@G&8p )B)wTXHvTus2@Q"V?m:'|;0[JprQɿ5o)O;Qz\FB `5цPE:@8%.%iibr0 FNJm gBŷx`3]L7z[AgFh Uh!m#6\7Yys'>%IQ-׀8 ]rq YJ"zo-aoΔA9zct:irBah->EU78 \%D:;E(N$Ryo3aV%Aց%ψJ[(1MDz-6blv"Q[)6tJg::5"S s&e2 g:#-O#8'h|*d,* Q(Sj ʇ5p~j]|=o6~]BU@>uAvAؔR߶5>2Oԯ{gCvQ$D`]~LuKRIcr$4Πq| 6l?#dqGZF]QھL!\oS5܅>nz`Vqw]-o4q7s e%7T Lj&G{ǧɤF#q;-%lz#e}:c5YKJB9 ) kiU