samba-winbind-4.15.8+git.500.d5910280cc7-150400.3.11.1 >  A bpp9|g#v Ѫ~a'+U_@-HAjuvY,^f!W92 z^9&AvӾD ^N+Ix&zb!ClܷMcȂB.#!_29aZJޤU4574591be2d92157bdcab32ac08533832c8a9d2f098378727ec87c5765b6565896ea0eca20e58167181f454348bae5e9ea747d7clbpp9|k9$1%^ Bs X_V2'\|#qtZL&u2F#M_):I%Zo@- z8%.,{ _:߮}E ɧ?<@gL_ t!`{@7`)+׷=$P9\*!nۀc' V+AaQ*Q@ܕˡHhݥ0wzkۯ#<'a>pLa?`d+ 9 Q .4:,/\ ~    T8|D8(9899=:N=S>S?S@SBSFSGTHTDITXTYTZU([U,\UH]U^V~bWcXUdXeXfXlXuXvY4 w\hx\y\z`8`H`L`y````Csamba-winbind4.15.8+git.500.d5910280cc7150400.3.11.1Winbind Daemon and ToolThis is the winbind-daemon and the wbinfo-tool.bos390zp34|SUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxs390x# we need this group for squid (ntlmauth) # read access to /var/lib/samba/winbindd_privileged getent group winbind >/dev/null || groupadd -r winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in winbind.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi/sbin/ldconfig if test ${1:-0} -eq 1; then ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-down.d/55-samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-up.d/55-samba-winbindd else for if_case in if-down.d if-up.d; do test -h /etc/sysconfig/network/${if_case}/samba-winbindd || \ continue rm -f /etc/sysconfig/network/${if_case}/samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/${if_case}/55-samba-winbindd done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in winbind.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] && /usr/bin/systemd-tmpfiles --create samba.conf || : PNAME=samba SUBPNAME=-winbind SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable winbind.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop winbind.service ) || : fi/sbin/ldconfig if [ $1 -eq 0 ]; then /usr/sbin/pam-config --delete --winbind if [ -x /usr/sbin/nscd ]; then /usr/sbin/nscd -i passwd /usr/sbin/nscd -i group fi fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in winbind.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart winbind.service ) || : fi fi<rHX%"0H^큤큤AAbnbnbnbnbnbnbnbl#bnbnbnbmbmbmbnbn"bn"dbd95eb7e0d1e8c973d39fb53be9be46276b21bcacd8b0ae1adeeb63651f6fbea676af835bac5e037fd6f6d9950ea49ff3f39bc693d479069190927c1c53083993a1caa0988f1da58a965d7a954f36d791af7b63f8f4d458a49b7b48dedc7909ed7990557a01308e2bd7042f9ca5dad43999183bd182e5cfaf3c1c9a8976fd4bce016682312fd0e6ac9dfd6b06b7abc1f8e01bc047e72c03b346604c7f56536248c787a47c3127f9c5fdde2848eeac71a06e22cbf997c132d74ada549c086e0de314f82498b1e4e2394db285aa1f1624ba8ce9a9f74695f81c3d315d6c581ce69a16eb3e6b8e2bf0b1ee56f8a98e8ed307633badc5f3c02d8a82a4293ea474397a96af250152c09885215f5f4b69f8557b5ef40afd980f81b87ded0713847b78a24bc05e20c1b5f58fc24589e8d16f8ac39b3faaca39ab5fb3f595d02a6a9385de2612f67d36e6b0668318733b30f5af28ccb0687b81586b7c7d1d5d68ab06e9c6b4b0325dd3211474ac785379683cc4e7f17e211327fb9d536c1ff9138de03eservice@@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootwinbindsamba-4.15.8+git.500.d5910280cc7-150400.3.11.1.src.rpmconfig(samba-winbind)samba-client:/usr/sbin/winbinddsamba-winbindsamba-winbind(s390-64)@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/sbin/ldconfig/sbin/ldconfig/usr/sbin/groupaddconfig(samba-winbind)coreutilslibMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.2.1)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libc.so.6(GLIBC_2.8)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.2()(64bit)libndr.so.2(NDR_0.0.1)(64bit)libndr.so.2(NDR_0.0.4)(64bit)libndr.so.2(NDR_0.2.0)(64bit)libnpa-tstream-samba4.so()(64bit)libnpa-tstream-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.14)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.21)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.13)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)libwinbind-client-samba4.so()(64bit)libwinbind-client-samba4.so(SAMBA_4.15.8_GIT.500.D5910280CC7150400.3.11.1_SUSE_OS15.0_S390X)(64bit)pam-configrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-clientsamba-winbind-libs4.15.8+git.500.d5910280cc7-150400.3.11.13.0.4-14.6.0-14.0-15.2-14.15.8+git.500.d5910280cc74.15.8+git.500.d5910280cc74.14.3b@b@ba@banopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- Update to 4.15.3 * Recursive directory delete with veto files is broken in 4.15.0; (bso#14878); * A directory containing dangling symlinks cannot be deleted by SMB2 alone when they are the only entry in the directory; (bso#14879); * SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used uninitialized in rmdir_internals(); (bso#14892); * MaxQueryDuration not honoured in Samba AD DC LDAP; (bso#14694); * The CVE-2020-25717 username map [script] advice has undesired side effects for the local nt token; (bso#14901); (bsc#1192849); * User with multiple spaces (eg FredNurk) become un-deletable; (bso#14902); * Avoid storing NTTIME_THAW (-2) as value on disk; (bso#14127); * smbXsrv_client_global record validation leads to crash if existing record points at non-existing process; (bso#14882); * Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call; (bso#14890); * Samba process doesn't log to logfile; (bso#14897); * set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert; (bso#14907); * Kerberos authentication on standalone server in MIT realm broken; (bso#14922); * Segmentation fault when joining the domain; (bso#14923); * Support for ROLE_IPA_DC is incomplete; (bso#14903); * rpcclient cannot connect to ncacn_ip_tcp services anymore; (bso#14767); * winexe crashes since 4.15.0 after popt parsing; (bso#14893); * net ads status -P broken in a clustered environment; (bso#14908); * Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before smbd_smb2_ioctl_send; (bso#14788); * winbindd doesn't start when "allow trusted domains" is off; (bso#14899); * smbclient login without password using '-N' fails with NT_STATUS_INVALID_PARAMETER on Samba AD DC; (bso#14883); * A schannel client incorrectly detects a downgrade connecting to an AES only server; (bso#14912); * Possible null pointer dereference in winbind; (bso#14921); * Fix -k legacy option for client tools like smbclient, rpcclient, net, etc.; (bso#14846); * Add Debian 11 CI bootstrap support; (bso#14872); * Crash in recycle_unlink_internal(); (bso#14888);- Fix dependency problem upgrading from libndr0 to libndr2 and from libsamba-credentials0 to libsamba-credentials1; (bsc#1192684);- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899); - Update to 4.15.2 * CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication; (bso#12444); (bsc#1014440); * CVE-2020-25717: A user on the domain can become root on domain members; (bso#14556); (bsc#1192284); * CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC; (bso#14558); (bsc#1192246); * CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets; (bso#14561); (bsc#1192247); * CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid); (bso#14557); (bsc#1192505); * CVE-2020-25722: Samba AD DC did not do suffienct access and conformance checking of data stored; (bso#14564); (bsc#1192283); * CVE-2021-3738: Use after free in Samba AD DC RPC server; (bso#14468); (bsc#1192215); * CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability; (bso#14875); (bsc#1192214); - Update to 4.15.1 * vfs_shadow_copy2: core dump in make_relative_path; (bso#14682); * Log clutter from filename_convert_internal; (bso#14685); * MacOSX compilation fixes; (bso#14862); * rodc_rwdc test flaps; (bso#14868); * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal; (bso#14642); * Python ldb.msg_diff() memory handling failure; (bso#14836); * "in" operator on ldb.Message is case sensitive; (bso#14845); * Release LDB 2.4.1 for Samba 4.15.1; (bso#14848); * samldb_krbtgtnumber_available() looks for incorrect string; (bso#14854); * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED; (bso#14871); * Allow special chars like "@" in samAccountName when generating the salt; (bso#14874); * Correctly ignore comments in CTDB public addresses file; (bso#14826); * Fix transit path validation; (bso#12998); * Fix that child winbindd logs to log.winbindd instead of log.wb-; (bso#14852); * SMB3 cancel requests should only include the MID together with AsyncID when AES-128-GMAC is used; (bso#14855); * Prepare to operate with MIT krb5 >= 1.20; (bso#14870); * Heimdal prefers RC4 over AES for machine accounts; (bso#14864);- Enable samba-tool without ad dc.- Adjust spec to use pam macros; (bsc#1191046).- Adjust spec for size * allow some Recommends instead Requires to be configured for cifs-utils, samba-libs-python3 & samba-gpupdate; (bsc#1182847). * remove fam, undocumented and unneeded.- Add missing build dependency on bison when building with the embedded Heimdal Kerberos- Update to 4.15.0 * Removed SMB development dialects SMB2_22, SMB2_24 and SMB3_10 * VFS layer modernized. * Add the ability to set allow/deny lists for zone transfer clients in Bind DLZ plugin * Server multi-channel support no longer experimental * Improved command line user experience, unifying the options in different commands * Winbindd no longer scans trusted domains on startup and will use enterprise principals by default. * The net utility is now able to support the offline domain join feature * New options for 'samba-tool dns zoneoptions' for aging control and to mark old records as static or dynamic * DNS tombstones are now deleted as appropriate and use a consistent timestamp format * The 'samba-tool dns update' command validates and rejects now malformed IPv4 and IPv6 addresses * The 'samba-tool domain backup' command correctly takes out locks against concurrent modification during backup when using the LMDB backend * TruACL support has been removed * NIS support has been removed- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/bin/sh/bin/sh/bin/shsamba-gplv3-winbinds390zp34 1658744578 4.15.8+git.500.d5910280cc7-150400.3.11.14.15.8+git.500.d5910280cc7-150400.3.11.14.15.8+git.500.d5910280cc7-150400.3.11.14.15.8+git.500.d5910280cc7 samba-winbindpam_winbind.conf55-samba-winbindd55-samba-winbinddsamba-winbinddntlm_authwbinfowinbind.servicercwinbindwinbinddsysconfig.samba-winbindntlm_auth.1.gzwbinfo.1.gzwinbindd.8.gzwinbind.xmlkrb5rcachewinbindd_privileged/etc/logrotate.d//etc/security//etc/sysconfig/network/if-down.d//etc/sysconfig/network/if-up.d//etc/sysconfig/network/scripts//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/fillup-templates//usr/share/man/man1//usr/share/man/man8//usr/share/omc/svcinfo.d//var/cache//var/lib/samba/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:25017/SUSE_SLE-15-SP4_Update/a5f316dea5f06e3771d2e9522c42f892-samba.SUSE_SLE-15-SP4_Updatecpioxz5s390x-suse-linux ASCII textemptyBourne-Again shell script, ASCII text executableELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=bb4059df5521104b6620bd7e7c97a6ff85fc85ba, for GNU/Linux 3.2.0, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=6ef08892031d3c31edb2cf2eeaf7db0ea8d918b7, for GNU/Linux 3.2.0, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=468c41c86105413ac1d214267195815df8940161, for GNU/Linux 3.2.0, strippedUTF-8 Unicode texttroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)XML 1.0 document, ASCII textdirectory4O3RR9R[R6RsR2RoRWRRRRRR4RuRaR!RcR]RiR_R}RRRRRmRRrR R3R8RZRnRhR`RtRRlRR\RbRR^RR1RR|R5RRVRRR[R2RWRYRmR}R!RRR_RRRRRR RlRRRZR1R^R|RVRXRR0RURRyRwR{R2RWRqRR?RYRoRIR&R4R]R7R6RARR!RcR*RRER.RRsRGRaR;RRRRRRRR_R R$RiR}R[RR9RCR,R(RR=R RRRRRRReRQRPRORuRMRKRRSRkRRgRmRNR RR#R'RRfRTRZRhRHR RrR R>R`RxRFR+R-RR:R)RlRbRRRJRBR@RzRjRRR^R%RdR/R\RtRLRRDRR8R3R1RnRRpRvR|R[j&y+mZ$nT@f2{X0@fni~ SiS*OP}w@:OUSgFяá~D:|F6d ʉVo> TiOqZx{$Pnݸ( |4݄_Q+lvP9'av*Bx)蓮:aD0) "Z9B]ko3]GB'WRyvF`2=%sXd0}xKy%9 h8w/Ó5]\胹`s2(45ʬ)l|C&6{5>׻:8n4}c^ +(F;JCgpq諌NOǺX>]eQ?ӣkoC/rIU8|],h*_%:5Is'O0˃o(1@U?yP*$, )Β %Y~ ˠ)6dPNip֬qN]WIRTRD1Q?-bᅀUI/,̯Ӽz=47RZ\% ә18|x2v/(W*1Nz''8ͨӒlÞv2K+NJ82#[`]Kzr\Q.:1 v7"UGl*g;bz'VX݉:/ѓ&zPma+b KgO #}F+} <=[zIWnx9 tgn9C?voM]&b IX6:#5K}'(! k]!Ua׉i j4-"Y/-P} 624h`˰Ξ!4|nO{7 G[ak :oܛ-{ܣc\HD[>at ,/}}v0K4Y\ ΄pnJY<S6ocޭO(AN:۶mB&FP:̻t&GE ?( x*Uۂh/+i<1kH0!zϥjm1%\$7|Z=5:D!@ׅNW>1Gl@yæÃNf1{?JgɩO%6z:ז͠ ɤT2$f0R;\תPtE0†X4[r\+;x׬DU^:<:=ZxЦ,&N۱%g=9>TǣύjwszWWMqWɨml‹aU2dk+ L%BRL=(B*v߷rW"eG]6uNx(Iɷ!YU=&ݨV }lQe- Na:e*Ipհ249ԶzS1@)L}~o |6~UCa+ U5 :m`gH.%#f]yRfg^k}k%į3ݿ/9E̯t  (?ňHMɹA=F'y =!S6?':9:;=] Ä+i@Y_G~}+(ؓa&gܓ2͸fj\:b+X?MkPQEDKP1(%q^_)7=~P^PpiPʖϲ/Kӣ>دhqV(O 8盤e#aHՕk~3Iς|gcįzUkjUWf#s!QG73Uά"IqkosP2W\5PhR07_ܼK `]@myؼ9ۦUXp0G;%RQnp&ڄ :^(E\tN̢4AF6&;Tn/0v$@uAT7PkYc5RQ: LJTYc3aj CwcOiè̓S7N?cӓXN ȴ.ܺ7Mj4we9f YRֽ 8@=W-7B%7Ǝ=) ;$IN9B;Sn[c:m{H@1:̂E}G\֙U~7>*3,Q4Htςpdh&3>[S=s0ZfYyu<]0lZqC4~ /7R"1O^%NFh| 4,nZy ,>fo;M `i*T6v M"{z0v5ꋃ% H.s' S;wĵɥ&&Bx Uo(ȆW7⿍&N[3/_a8n?AtgJXЕqrmA~m]#QjOcnm|} C;τc-:>N[q5 (JSd%OI3 moj./G/4ׂ[7H䳞^@YNk\K1oKQhCgڢ]SX(PZ/fazb&7H~qN /˯)u%Q_][Wj΢R:w% H~T1< U 1΍IT:LF?LvRh\tj]lG~nsu3q%R>7N_AyVx3@LQjcn'9KQq;ãO<j46Z%H eF3OҼ({_O6DҲ1 &}UZ ~$33+D 8ֆ p{_gX%$y/g_rDZ5AeZC߆Y)!4_wl?׍cB&nN"IRMLES_S̳4Q-îH4 'OEyj|Ϟ1ӄ2)]| >O+2!"钅M%`"r;xS.J|XP^Mc jbB4+w7y-T[D WAQJh=J#)|ye!hʾ$s3ыgs PRp#8'c:WBtbR/*K҅_IXg{_KYnY݆TmjHeḷ[oϚڑocz u2xxw4я$m0YKޒgg{yL Aq, XNUl6CQLPo'Ld=7t|{!$BsTtؠy| l!E ![aXϢklmub+;(zCKxÍA^7#8Q*-`⇡wS5<DFN"q~liNc~6.f2c++F< ')(i}ēٱSij"iY/mO:1s@C,`#H!y 6CI*u=!OL6 2M'S*N?0.a6Hmz ;*aU qIygAFgBeeU !vW†{Bqļr"W $h:. mb<(e#Q^!4[VOtmEn_K3G6T5T"k#p-Ax&E){^N1gop] ZHxFM4PTF IF+M\V ;kns#]CLX08hڔ}U %Ag?oSʧ"[H dll2eoѝWYM4oEXILC.(RBueoy+coRudg:"8*1sv3h@NEi&ݫgvz8^tJ57%,}iXGkq˹(7˦Y?ՀK(vj'Bꂈz'c0CB(!d6>~Li=_zp¬ Ι h Pf,gyPy]U潍x#lhqH$Qpz0'^{m-9s9h^7{w.-u60Lv+fڍ@VW3KB=yZm, !(<ׅ%+c[ԼiNA~~|g}\D)(" T_b*eWК˓ ]&$Ok l^Bi.B EKӾX|u.;{onǴ6Jͥ]hwBN, ,L MdܵD!i@qjtyąrC8t8!gS @&<اYzvRa @˲f\0JxJgqZB2фi {ା?dxW{в\4XFqqʯ߫*1 $$g\qy  hIk3r1Vy*sWV$R Ŵ!i&)1"tRgTba"H7>EɎv!_i1nM."2YR2-H5ԾYI"pj΢^Cа`DaCRy$І2/J C,ZlSQ_rP1t[xw,3+([5E+/ZXXyn|,¸-p~>!ǽyli=SRlQl=% n46]D78dbPyf"ð'?silbӓm=pin)ep!C~ C(eg_ {Y^"rs1C#8uPpk$hj:.GÕTk]URU@/Y~ճ_9f@8!bWxM{9qdRa͏",F/%]7/plm9٫iܮVsf[Q0He_cvh(Ĥy *$J t:;֒yJɉQT_ـYtrӸYP쀻;\Y "R\1 R>p<9'Ǽ•@ޏlu`X-ZC~~lKM%~iNjczUPnRT5=-(%=&;q\pft2GP +x{b]A3ղ7r@`ZEyڸ{{=$&iY,YU kHVt 2dW9hYq ּGY ːk8U΂H0n!qˣqUS_IOj}2[nVqqPݯAV?(sW*kb@~^Iv84w\|Xx8ͦiQevei{lBb 8 qZlS}e^ü6[H{j ',,oٚNSP=^C<-,ϼid.4zb& X65kU%b8}AkAt>.8ƎfJA)X~l#L_Iԡ&h6x3 $=8U+>/.ќtdߨN=[EgWN,-Klvr5l^Wp{ 5.Hȇ)2YCՠ[^;biApxZ"r9niB-/ ^˛a;^fd(wNҭ|G$d8/HJv (쐤ғNi-%=Mh:ֵc'y[g/r:ʵ2iT5&Sp KӦG_D< x^fr "^Nʳx^7 ?~kB] .K3>4O#S)=Gvt+(~~ 5bud3;\Q3Yfu0;_J_ZK2XZ[tl$q ;0kb"2L L0u3&桔EPo*?_nQWPt}y?"V3Ciuw`U*VgX3!n;VUĠt <\ޤrYx!6x0l3*pݠpJ,Ԉ"޻+}9F\N4)N"@gDǮV2X4iBJ u\ȑHyRsfȄ q9[+9REbȡP N#a𡡵>!.qTgΪCC-͛<߱ߺV*ANdi]F;~ kLn{%zˈ/ȦgַPZOa>ƍTۓgu /6^vx@:~AL"L,7@jHK۩Im|mD9l=C^*Æ tgCAy;߇ؿ;r:Y1[zIpeCwd lOLdLz(lNA#ch̎Evhm/ XQٲF.'9zٺVV u!#aa|Rv0&ggx\qRia)情_Zз9ؙXK(EZQD?-:p{ͪLi9(wGH Mb-Ͼ֚L4+e-?ѬPȿx4u"M0&|qʾEPAʾ9E|fS_#ʯ.}:"Ekӑpm|O9ٔgTUJ"ZeOˆZ}v{wmH}6URO'O)Ai q̓nJ$ }L -v:$M^}u%|/'H K'_\zkGYm;S(f~ڪ\S@XAv5|. 8aq԰"*z"J68pd [^ ](A}LI-hIwZq ɃlIU&*ogbo@VXшPʹ5Ɉq<((n햍M5:.Rb r^h=m 9TwhI$e/cBMA-` H3OhyZ@tbK‘ŚMCS$ϯ|e2hNO/On6ArTPŗ)ӷ.~VYvǟśr;*sb.C(qZ7VT}eߍ x!͡) c 1tIW (/X; "f4wd0)oDSl>[3$\4ea̼?3?ѝ@>pn[).Ye _?A|QЖ"٠LmDply/P"xrMWJ@A2d4xO,U_mZ 9(}vQ '1@'(i0E8TRÚ 8N!)'=/t. o+=",x}*߃z :Y39&)Dlt'u`c8V߶x?IIѪ7 43}@,G Wt MIt5ExS=4_q; .`م3scآ7q,>иp+N';$^kOqgD IC {Ͱ4\L{7l!^CM]_}a3 V2O͂5i @vkU猭x6@ A1og6)k6&UaI P_ܵOo<켟$6eU9u0b5Ia˴1FlfcH]9Uv#9606sQtNu\]b8ж\NɒE㲉AFe đwvI57{E8 k[ $EqD'2ߝ+buozgNTMl-\\r=`d,z }Bh U~ FwK~_*f&@["|N yŋBAx U*A1hy-Zo lsy$qubKJ_"_$t512 CYfO j_m""6o"۔/8n*٧d#}N`h5va;l7`#X:71Ut~:AuN|*T ^*7M',D<r qY IJ!nf@T DvB:DŸ!mu0Ëepz;flOR`dpg_K2_zP)5^.ǙlP$R-MI5S.YΐOEU,b#ipX X3׾hP=6}*?*w|Oջ{6J.cT`Azd^5Qk1LpY~eq:vJ{)3ᖻ %Y΀$8(k|hfpO_Pk]%$Af (>_]TY< -Qe6  s09.H@YÌ 8ͳr>}&.WbO`JwTP"!/7iqV3)3Ί<̵h99&z<,rA_0O7Dz@;3w]$|B"/"U,@ ڱ9p)4@Fe|jVFxm3H)7qg3^:XOpNLifaGD,\_ ~vGڥDE{E]7t;MKcu+Mh v=~I ~& fU2 [Tj ihHS֙> q KI5 3 (r|N,lXEP0~pBLa)(xhھjLgNS pάP4 s̥zE{]wD̜fDٿo|f]Z Z [֬$@Z!򅩭Z]CԺ` EfӤe`"*-[/[)'8"I(cxӛSL3"~W b8}5*h"XCBܫT6029$Mief~w%A?V35K֫g˫t8x#9}~)$0rY!ܾVEt/Kz>E>{`H5$Q' C,&"=0" % L^0a0?''OV%tA  HaEZs&8 k=>]Au,faw u}s3GnPF{:Z'%f+ovTkr)R8ۊmg\%4<$ Wє-LҾ'x\mscI5EU eǺ<^=&By 넴wB?geAk?#H}Pct5}R8`ehz _vD+w!V#VT3b ~J].s^#$XP"l4i+i3dEU[ LeuO XR*F}сŖJ,g`I^gV *<@N:8>%@< NvoC"+/|Z@MnӪ- {S SpKKz^I`QD%Vߜ"N,~nnR|WҴ7m F|MhTv_h m̊5K$ǂuz(8^[ZmKEl,vF>VW`n0)jFf `dy3^,fNyoꉷS^u(KVJ ӑ 8?Wı:z~Z'|.mN5=-3ņʍv3I)by^e\)Bdr /vXO9W\r =DqM}JK:xy1߮=v >S} $,bU0ח(m֞n.[=-wj(OBn/:zuբUV.6yՒ\QPmVs3R%f=3<(I[VKy?=g5mnU ^m_.횄ApAPIjj2u"SfuN0 ׸ϑG_s d;^Իɹϗ\Krܩ \50PqHMҭH"d0H"@^V-t+?v6̓J׵&OVuNQ*c%r+}uO6 rĹkދ k(oNj bnF_҄`-LB%Uc%rh=wZXuIJ8QiA̔ߟB9~{J$!D%|1"K%tOѬ>>wB-4Wii9z0%G ɹ$ g\ص{B)Ku w)ażÏ]G*U:SŇ<=d#4 ?kNN_nuҰX{eY2hV %l`p"Y8B^xMכ65(ۛ>"U۹4دj=%T-7Gκ7iS]4&+@$(r2^`́2>ȑbw۷._`V=+G$!;91U}\%;awud 5,H ᥨP]C]#75|@/+_{C{N- e  Y~@kExLr+7um8i{3AabxWB1TXQf̙H@+'gk#gn|Sq$F+@ίVxwG\5E7x_,`쓹,֖p+`ՄL%E-Clkń/t1{R&wI:/&\\6dwt#r_`= _YmFܥ !?V$k VeJT{*:s>a{ܴP`RMzDϣZK7 BRo*ѡ`xk)[ y]&}6<)beMyh,w~o&TNy,̦ nfفƇeh0d,0'ܡnS~{G_u\f=>{.&C&iidH8P^}B0p{J>Nf2o .1wH듲kktsׄKw$v= aɧa\JyśPҍ{ew]wM'JD5+a(+T|b1GF$ P$|9jha*Gu8jxn*SX%o,42zl> /F6i Gݢ|68aųa Ol~x>Y. ?gNg_;m)AUdMJIԳ52;BajG"8 Q?t_DXj dcnhBWrYNi#M1sz! uP R# |Ǿ%GQ%bm$<LZagOmMDo ƃE;4*P\(ISmAjd {+*P|}q*Yч|N}w=:ט;ɍȷ9`񭹹ΧJK%J"M_.4$Q[Sp?_ CM =YG 28|z%PKM"BȢ}bv Ÿ²א8kbA ~48xtWߌqΪ1̇a6r (;^a";i<@1iSxU54 Vs؏Y * <:4يqm1!G7?l&T"NS M#T7 }brY&]z?N8 PNqi, jZO}K@jό}fPysBc:C>0[?yŵ-+/WIo0V3x蛸p%Ii]1 WC25=YLn{wh{rEiX}i[N7= [~F.nj5KjWDk:dsL6Bwm}ʉ?N7QPDF_<,=Zϐڎ0D`f?j>{5)r0jc&İMP!R*.9d[izTm[WX H9΅\rQҤ;c 2Fǃ\A %c~m3@U%:WHS)@7C+8HIW@ÏOx9QU8O=V vy 7 $MycH|f#& cFv5V2aVUti%rf F|rcyYWp"^ e_-1&b&yZ@i5;1 mY\yC!Ttsl_Z -6cWz2#,z5HDm9ݘvucrQm`Ga,3~NA~aAe 2pj`2%џBk@\1~PW܍YG>4 O5c_NMi 51;N $UiB X@la~+#'\C]G* q &wis?ړ(Yi6?DS$d8vI̐a>?\Xl_ TIHJ\1>.,񻍺rഢb:Wk%KħU}N0N<3+صw %_ssj5Ql4pM:3Y0XamjA8võ˂Kм<3h&oW`w 'Q c%J3k9Ǿ4S4E 2rg)l*V*-|qAb}Ɛw6Ԁ4IHxn`;͊ӫvNh!x8s:HN%y׻l27ݟB_r4˻4 C Xz]PtJSBH{K WfeyGS=Qo$/PZ_s $ 0M [s\|S,`O("zJNy A>Z2 %msċ Lrf9uuQ׆{͘ `O?6r?#beo<)K-fQ 5f TTE"qvw`l݇v;ኟUFwgU3sf9vzb5eoil\ xwGw4gg~G₂+u$"٦d'~T; 7z;\'rk o3Mm4A jl( K5]D4T#rk~uuBVmZSC{NAUz`m⦬RtRM֌ϥmLZdd&-&NX#EoNRe ά))ܚS=܊ߌB%!P}vrsDi&w pIONr8HqWSike[WF7l݈ZW t~3V4PddŇ֏߈Q>9ød;x-㶥nN#˔}a埊989r}U&~XM cظm5U8ff5!u^C B=ep Xeˣ@8QCc {Vlnoi۪ͤtn"*um@서 ﻎGDn/n6y;EI"_۰ s$1+L:W = J' ϕZ} /eA(^XDїwo]ܟmS|Xh_~㍇@'m ZE i-.OѫP a ֮/HfsZROm>Ǥ]GƸ.Qr+n{NXn*A6e 4+C Ɇ;z;-;O4RμK|uZz0+l3ͩf#4ߨ&)Ij>iHڈݠ=?Gndj0i|?3Wf;UG׬}\%X7N@Qr?/yR p!'*<hbwaCOyYsz`Q!+LeJnu'PP LJ@%?@KDOv,c~y=JXzܬ$Ixm]!0"{Rl}s8A~sk&6[ O-5YW\_-Vm^UӴ7{QAt$';Sĉ4 ߱mQ?dM#6uyf[ٓ&$ #oYw_G,GID"&oFu4K/"',#Hej'»LW^"g> WLL^O6=Da$eŘlYx~dGx/\cuvjoO?vs'{ec$0T&Կ#̂OWL6t\b1Y:{QKF#ԜsN\YY")"kF~Y!a!2Ir#]NSO5+dGw-F$%z*1pB/YxN,l0&3E Zι*| yxą;Ͷf_ Kwm Wݝ\Čفx5VqUܪCΠZ!oK1L.V,EAV_£96kNVs/K@.0ڀ\熶 #ď F8E${0,fY|wS_ !RZ RP9ly$6H(5P t7IIXgxS"kg!#˽pͺ .A ^;5k S(s3+M qÌXg4Pߞ]ޖBAD? jt%` T{f (π R{o5tv 0m fL~ L$ "0 7+UT[W`=ٖL>5Io/Xz*jͻ {hN;8ox9KYbhPy l&LǎOh9hr`-4ԂT%pE`W$C|;kd4@Sg%ڀ(xB Xpfy翟[{RuGjwKEh͡bgגV + F}HDJ>Tћ!k&{&bRRpP Jۖ~1na'\kjױPw_{JWo`e sALN(< 7($} bp֪a6?-hK6㝣8!N/!e'?@#BIn5@d[`-w>U4 oS,`V-7]]88FNjUprM4CVJ9f,G/DiD'(j$h^ZW|8熤/q_E3Ys U$ҟemąݑ}{p{_ cs "k*8#3|" ɲ>Z peUXp<T@L<#5ɩmƎ!T:M7.hUڋ5$[{f^K%Z xȯњ` 3BH=MG{[Ǣ<W8g';a.d H%]!VcHuTΒe^#)T6U8L-*Wz*KbwuOW3 sYKp 9& `qT5دk4HAAzogY”,`seIg6ti'Fw|"0}yvM^c X/ZM0+ { yдk :CuJ7섇Vd^Kbb ^\l]cUocJy!x[&Μa.m,2c-+:څkpkBCc!NrLuN1={X隟4DSd#@v y8Smv{|j۳iܡs=[ J0s5`͢M'92g>ЍNwQ4s3]'WQЈ&{$be=clլTD϶eXcڭF(7z]B$W2fuk~OB=jaы&9AQ7r7>!h]fZf{'$ XtvWo,'k[NȣrMà>/21G Ԯ-A(vÒ2簦+^6Ľ\V[d*1'pg74Ɉ?gCFɝ(ުaϞ:;pC/"AԤ5FBc31z [dgJ6@G`Uӹ݂1m,7&{A1ujcfaٽeIqkW; [8 [H4 L{tQ鲛Μ[ei$'ZIH(VvXDIj-$䋍d8u([F DFuXu}Ӎ7oQ; [%-LFc!LUn$H;'ԟ|k(cTRj0O}{OsiؗZy}kM?*[ ]Ri"h!\!QL`p9ZOj,͓Xo3u1 wgx8cc"a:F9h*$֞%Dd-&Kap nQTl7B5| >}zEE4k>}h-#5}q tR|`'Vm?nM0xҀU[E ˂" ۈ߲^vprkIN#fB{x[j ;;y9i@0OVj \O^$wXE׿ӽ``1}H 񝆵w/`EU1ThGTg* zN㻁YB% d'/Fkŵ^!,YGc;J?C" _~ײ\=uԊgĖy5j|-v8o)麝Q@І{.ŭUiXwwnm`87'Gsg6|XYF 莺~ )yh8P!% R\2VB#LQ&}rg.J 9BB,Q be3|8AV㫂cs2|b8?[Z,MkhStLL>|/ow^op!KT9b'Hܽ߃tw7U< їv|@+$PtK &L5(Wt 24T*ս`)moNz6Q 1Z.(`{n V_)1![ R9]A-,(;ģ#MC(_N/r[%Cߺzֳ!+hm谮}h5t6(&Jf92sP4/.-VyRVĬ)tPHGM%zoא}$t_ ꇣd/D"$9Ɍ[D=-=?l '3."@8lʥ#nTr2|6\G0-֜Xg&YMCTrZ&N΢ɲj5(*D9 m^ O<8yxĥyry.@lX_VЇZ>#16ufd3IAt0sq١l(d~Rꯌjs#QO|˥t>m0('IAv4as+C vO3OZq"YH{;j2뀒-^:.~Vr6s *F KW@Ds3*_>Kޛr=> I*ԝh7}EySC(s+>`y3JD~@ J؇{@Hb*$n I0q< Pqvv/nC|7~D[v,ߺ82l<.L.&kť(J%'NU]E~g60]#ujW,/ =uCڏpE Wvz&2^"[$t?YcEyy+ΔojBPO1Κ`js1rՖg!!-=2biրುV;m(&znN7 vlP {@f *}N#Zc<Ġ[G]#h@اL|zխJO[rWLa:=B`o(ʨՂ!ۯi r矿d]m \F0H[%ᙫ]|^^vzxtqX)g/k]v2l;~:?RpC)L9soo*H9X=D*˵ȱ@&#k?=Ok"aæm+?~Rvo1>vjx~^F*FHy/5ّy{8!Kp$KXhOnn1N66w+klYG/AOAcȹ-TZr@VH@ i?y]꨷2mJ}F=χwF5γ25-: vW WO.B^/ipff"I:;pS]n[|LnDA)>ɡe8ժ˘H$ϑ㔞lї;Q#xc"Xxsa oh}JH:h2: IsA LFkפH,# f+6{>) sP&.@ Ei7-)W]wclui;q;_C\JWfUĻORc[]&=XH,+2=H(Txz$1C!_\SH] JCJe޽+裪[|elK+(J2@R044 D0Hӄ%I°i`cE;6_ˠU4Z}:M@dë9gcРՕD{:Fo<Tyd6эRާؒH3%:1QZP`ǚv2"Xeǣ4w?>U ƴ(lOɃ]Zj0Fwyׇ#Xa&mxܽf:b%jW!;~ۄ@A`Q* ;H.G?f.a JjFE მW/4B"/;kم*򶯉 LLq{mL9a*pRܢTPSjsZƽYaOpSJnD q'`cH;~ ܧRd C/xg͈ jYCiFPrQom9#g \v'#X;xi[T}k@҄o@((=ӲI`*1Jzp]+( `*PrJV wP!µWmkjR#sI`,2U{g]*mv103\=<7SZń 5@s ŽO`vٕr<A(ػWzꍛx ^]O9?3_Q6fGqD1)5^?+(H{H'zFNxfۻ'ǃt'om Nj6mD7;#܆|Zizk+UiBF'TNzpoP;rk:s@XQ#Oai);M099ޞa™2WO[Fȕ9uv/&VӈqӌïA"Rb@娑|8J\ `p9=}k"OAmiK7Gl3/aLسJet6a}Fy0ĺ8q4g#D|]߶0O<7CT@3 Ľ 5>xs#dl{8$y)aم#[]ʷ՚Bf )gVvmEaDžs¨{V6 "2BE/(/ G@&W$ζPy*q~sG B=~e$ψ8Z1bK82TWRȽB[\TYhޛM+76wl**Xأr%aMZtٖk;Ms컗ɑ£˜|Z34|$It9%1S-ń$$ZA\鴦v9I?H%-:WUZH-цa8 !]EK㆗?SE -SrE'!e{ꈺ!f_k&V_5R;lVRŇM@t+ g,U $">6=Q.Dm2Дg"4QqRHNKfN×̏ m9)-Z4M^C ݩ t:ImULAjCSLL*mɴz >H&s^Ol;6]lOG%(:V'(:Û:f,7~K9GV^XiOEvg%~"SiZI(ЅTƤv7N,eGzLY\Ȕ>"Yniף#jqUӘVa+}Q?O`rw|4d-HPw,kgZ 9 s2fV=:biVXá ϳˁQX  A 4*k?h\ƟۇsY{y87p>짪N6 Fׁ,6VOej8ǣDfQB[_qh\ؑ5326i^)]yFG^JrvûJ`L MzB깏Ь1FI&zS^FSJ2l*%Cvs Cc OԳ/}vzs0H[K"yE< lEa7 4N/-7Ymz.sEVrDA?-Vmɒz4lx0lfŀ\)8Nl{n?3@8eL">D2gy^Ѐ1(YF[ ?FSF8B/Π\m\%V8(\&L ̟djPRu['u5 I&OOz xZyb2wx#W MExՑk[vKF&HX]3(1mx4m9*%)7bi CKLDJLȸۇmfێtƖ}KbgoX45DY!],6}Q~k-oYQ } d֊ *0)MMe\L5"}{ Yh 1UAȈr;[jw($pikhz)*MLy z>J†i֦G9Y?-25z^m1X,gZ݆镸TDc! AOUT$5-?[nKeH|VScI-r+>p3uW(Uc$$Soai Y4)̰-YQDN;[I4:NQPX5t祚od*mdGr@AG}+ާcMD%ކ~s0`2yCL%'z?}xi88 x |94,\?ȇ%[v$-d9A0#'ftwx Ř2 eeU(]e;=qN^MbW} b7nY$UH5BU4vƽ DWh:2=C`IvgwH0&W?@ {y&KNJOE|͐F)R{䧾Be> 6d*0eq q۪I9ɨ["c-H'DZ[ec+kd)V H[[&oJ YUۭ;FYV˖HYEbYQv[#Pwp"=Zۭ`@V,2P-pmK's +@N9.gEx>CwoER%'7 #zbL-Yۤ)qx!MDBh:Fvwzі`kwtJϛ0gl [{qhUvufיZ\o[rуjn[f.$;m@(=D7QcHf;o2oʭQTIB(=HV*N>a2e!EiLUU>+x'ܬޢ&'[$WCB+ P(#mUutK&tݻ,Z q.ժހ@z|EʧܶzYrNA㙝V4~$xr0e.Cۤ(==n}B-kKC#@Y,IM. ˜6b='čB}Udf o`86QKqO@K*]M{=aT$5_ )gT(}#g/!ԇ Uʏ^$"DgC"GQ4wtkYCDybUYpM RpF @ٱAeYD_RǂxWL+sOlEwr}fwZӃ0^5BzWU!(݁ɫ Lj=RTnKwwJA4t3DH4 r23Rd tL[q//;׵di'^3HwfP[8CLV װIo޷<~T]\Sk # M 7,m 'K}@ nm5.zp\rk9lN\CIE԰nxǂpiJ>|q >IbX2&zMl? 'I\7P^R+a=ħK'rå̂H>ĞXb ͳ\P^ -j#`2hZFRE5fN+riK6_}Z^QTm 6FH6ŭvdKz˜Td6O&#VnrN/mæĿemR#NطqCF͜+gk$*!>'FڸTx:u11'EM=5 z \Jv@ɮIaq~!Qf1 , kTW7QilQg/uP7]wF'xF~DoڷغAɼ8ٳ:rK…5P7+o/ZzlAWc2K* ty(v% 癷ffI8@b({ڻ^$.Q%A{d}9DύVj4(fWuD9:ʎAS:N7"6aE䰰|q!r_%_)! CK\"$#0eaJ8E1yNP6Q^>Z=:kC90*Ŋ Y)x?P E|=ț&fWbE=ϱ@2?m{'#V)w#}ab0ou,K,Hw2]1@\,q3YC3 r!U$ G{_><+Rסm]7Y[ `Sersxr | D{*97֚%zM~"c{M vay`moѲ8u{Riq< i"}mJ4`YNǤTy0n~8(8-enF.np[î7BplzQQN64+}\N{< Bs4թbHK&9$|Va*QAg^!̈XsCBvg׋}t*(#U#89fDP(Q֟SBДBx9Q o*G5*mqU&E.AJYa4P4WrM$`=(Ң 2Ti.( 3CWQxŇ F2[/ZO>G$)J1Kqƅ6ox}GfN[/k tuˍ[}% (!l"G6i|zϳXQ_1Y-O(LƝ_Mqj$ 6׭c+<#]V^s(hxOjf>4fYX <^v^DP ;x[x6U,q3qL/ =s)џiLJ3wM޶Vok2"ƉZPMXKU˲ i%Y>&[7}acg-9߰@x F`?(#ye(>\jZfct)l(Z+&6ҏ~e$!E1A=,L jy+wa5U '5.K>!Ƽ*Eqyĝ~ȉkGpM9J͜XZAVx5JI=@+H)ffY46SGkA8'E=tS2 _3Y,V L  + 9~Ge>WUyHLV¦D6ԺHnn̽Ar[P` Y|>[xj4G=_F%1XQ -Yܷãѯ4㽏׍&u *V(LH,d\ KN`AEz*YnDvv.잦x]D:+Yޱ~#\ˁl-DO?RBe.S9"ŋO^o0ئ&E [p:-MԩhSG!ʀC{`:^W>٠ FUOB{޲-ɻܚ UHExU#GlRG76nEJZyQE7#ǭnȗߤqnZnZgyj Ǩ[!N ;FPP90[C*Fj_Puj>0юEw:݅6U|uv~C.79ʘL(^) cpru?vP/{0>(zr~.zY,(]uSuJYS|jʟh["u +cgEy{=ttJ1 l^]~5WUnp[pXv:ڠUmmaGwbz3i}4B[M Qp )?I+RodshtMxa&gK2͛:92F;ƓiPa $;hUќ,)KŋiyE1ȹA| gVQ~>YD~Mעr*sGdf,VYa԰nwSP*;dnh^?G˙ynEVEc^.DO: ObStn J :pf-ݲӋ]`F.cFa٫(5uA~eQzvQ`# 㺹 5',p$& Ɖ9쵛~4lIX5{ %! el#'3*F #VYni5^BK.}s'-FZyud4ZxQ%"B߸jHhܷBNb 1_ؙN=•IKkkUh?b9}^N0!`4ogMSPϦz0uJ/S' 4υ6j$-Hfn%mF0-QҋmC?`wix g;LM;2mj lws}- ohz 50J6t;r{8g*}8ɻ0?dA>:qdjЩ:cl{ ?U=2 w~wYg`9f5Ek&W)ܾ2TO:$ׄGÖqT]9Q)(92ygwLaۨ$ jzaBݫ9޺"$f&-WvJ6Mh"[]_wK,؊Mz?H}v }Dö.<&H  p4ujPp%P/ob%=@Y>ewAK3걐5$ht5͊n9iՌx(b!$J! N< aEx]sb._s~У}ח> `ib-]~o>x3r[v[іd<7Fܣӂ9O<~`İ>oܿM%N%Se٣'I{7sAQ'wވjl ="`raً]jǷiR N G$B8abU*DՉ/zCw1n1h3Φ}'eϮ7CV(*ޕ JEf_ ϭP E+T#GO4e%IK55!&}}SA*-qIڇ}x WRo+8p9Ak,̼'ߴϙ}1i/E^zx{bPo-ZxoȎ$4eE%h Mayn4  %EU a2ȃ\dɠVGëIG.y/t1 d홪zS(&lRFa,Y dTiͽfsN?'+UƧ}/H8yHnA?'w<@݆4?Tbb(Љ{) d{dtx>a`XljͶdԚ @7/&5bh@{f/8 *ip<3) gJ=St mȸpJԆBv$ `@qdC*5^mA[u1,m羄5W S;bT9h䑐XБW۞ Xi6zHa= V>yJ݊itL 6߬AϒЏ)ZMk|yvK 1U^htJLab^gt~V3c|Ԧ}!xk N#AUwL3,Ǿ2w36@CAA{Ay{L(zoihȁpNZ-o鶏Zr)8 6Fx^lKjɓbI͡'XkbaP8{(J?`\C0IhSWVE|{ t?\.KJ輨Wλ.y">B,I80g :bK@Lɬix:zFW~AQ?5-*F!3ͷg_Ǔ^$IWi.n ].VBKō6F,C%ٔ/:]Hjls\ <KE5+ZiU *Gҏzcބyae/›>"3Z< SHN3΀+d>j< 70eaAYgw y\jyyi1븥hf$ɢOǐTV-l6fI 1IGe#^FbmЪ@XdO&NA. :JtXp8HoʞOH?E|iUq/GiN১9?""yХs2aQ c^T RPk_',]a'%+g#p1ܓyB~֘+ݕt* ʼJ `˷kT!/O3kgS ܷwtr\$Z{3hyaGMTAg84mƶ{/~͌ ›؟؊*z@.ϠwQVJx Wm /&艍#}C5 b|] Ǻr`knJ۴A]ju,p2ziol/2Rw2FIi$52+ԀIڗJlҘs3<$@o= )eeEpwl(:NQti%<]?c5R6}T '͵F¹FbVՁP7=d޺M ܙi'>+4D_, [VNqr:+ 0V(pR]xe-ZV|b6([D XqlK7F޳v=$haO+K q$4Qbu:MaubmT?b܍mÎ{MZ ;(96=-'$4_ [viOT,X}{%l_he:eY#D>0a@'K5ꖦ?KA*N|q "ks_;l#WxM>4Ink1R|>ҩ.0QECɜ[zaT]eIatGߨn> Y f 5qԿ~gƻ=>=t Q:cBS^w}rmba5'O'r~`֖7J}o;#-,dVgCRTfʘw1]S ʃM14Nqv1^U7 ܛc)cy%v$puɺ#F1_nN6Nrs4*jJc;vMHS4έ;5gi31gT]&rhꔍ9r/i>,^zoި{PAZgB5aq^k6!IG0҇Y0e^"U6;\rae} :61\w]>BM]vofQONo8?C}2׸܈sn;E S]Qa@}! G32գaX*>IęɛktM?ySxVo5h=N|/!ͦcH4~Vrԝβϗ',E=dYe à,s^oS,NL@P,}>vC?)  ^LqE~ŸMY{W?}Al?5:R,}]D[*9Wb)'yOo^DvzAJ;9. ('Q-l(j`1`DYǧ+MȐe*x@Ms(Ǥ$ӈ(5,0ZG (U`h`.MycEvhTƁ Aa5$S[tb|TZJ'c]jO> %1=dN6H6ܠ^SZ]Zpuh~ΠkR5*<% Ş#I:$HR4qC<}VҾcC[[*=p[riuv@*Kăq'9r$cE+*ȀEɮTihz},[Y\\Ǡ][a(gWw\6I&H`Sd+WeOChV{?ZUˏ@VEMulGDcS(ǟnRyH5T%js:FFC1"PwW3J14d[ o@Jo0JT̵<>+)36ƵQ`xsda\>yyW8M =,ǃ82Y!1|F쉾S]Ed(݄S T 4AR!s⊬҃L4r.;~r۪ sE]2E޶f9zk/}'?P'/9CVȻ2uĶٕ D۴se>9ɨ6S7hSThÿqnb\/7Y\a֊vR2/Ht_uW wfJ[upbGLyP7ӝ.OYrT!͐5@'.(ƕ3ժ`(Qs2,B`rZp?DIY zb @ڃ03zǪL܈>CoL7duRBSg_~;=Q=V19AȆR䮋xnSCPMcy a7]OnJ+/";~3Emu3.rrq-  R˹L7PZtߩ$[|dDg'@A*䯭 .ʚNBRB!̙Nܘ#Qq嶵@#]:GӸ/|^ptzLRX]'w*t}1* 8AZ{$nqP9o+_.@f9x "=e,2J4s nF *hq$nK[:_74L&41l =bڭL}ֵU)~: 0.裦ʞJ`LͣScX 8EF->{~_A'OJM\2c%] ^H?"k=h+?W®1D BAC>n#}c#P40HO|.ى!2#OՈ"LݛG/UvqvWQ!>o?wg9tɗZH50h op*^U^vn.U{d[s&0 RsK|!BcA2FCd@ji0pu21@$yiP;A~0lx~g&7 J,}rMH0Ѵ6ٗI|lOPJ&HZ.V4I>TEqZUX"o F4iv%mKU7H`ppjS_a@ӆr_Ri*$Sx%(bʆ7ڬc?v{ikS֤- b=.rMj*췂`e6f`RB8xε1G%L+rS/$ƄO6XL(Q,~F*ew0zPY#G;K ` #_;XB vT4Y X:r\Ԯf($2ugzjQqGLa>Zʁ۱~uzӹO6 bS{ţZ:4 =vcԈ\E3Ghߞ ~> n ;$oR%-F[NJ x\ _֊+ƀg3B`O@ecTda=D ү {Q8,YAxl1dj KE0hSc!^Tx}ݙ8iT,}8挳ẅF_ s7G9l!wa8f>9Ri6BX)줥7^AU4 Ŀv`c jP%shACb BBk?qk)UU;^EpCv:aR7Z >mtj9)0sLR {8x:YrV춍^m[>d[ٷXf<:*iy_eHP _cX k]| Z$c8T)>Z8 [:-sFGK!6r 7AR Hjp)W|}&.x$ُQ zC+d#A VYe=a9Aq/&JGCd";g&2kΎ@[( kmJ!t|]>=Qy W37[u 6I+)Ũ)9~GJnG% At?Ƒ+}/VEIj1 [{O \>:`D.]bL^rHɍ' hΠʓ:o/>rC6/hARpx|qlpCp3 Ҵ&Vr]LԜ[ 7LSYL8fnp!U+duer'^TE͊3vtM˄W` QX>)fbIh!Ԟ|Rj{3 :"~=+b/'KpJ"Y4c/cBS<xQK zz #1{L Oz+GTد5KvPAJ"Z+CvC/KBY whH- <;_,^}ٺ27t7N-==8^~Ƈ0LPB!煉DblU4E[-"`at t IJ1$2X-(=S[נp z,cfġ>Ʈmy!mF "ÕT sfZ|qtNySę`,n64Ko=]#w("'¿sw!碉0e.,+9DZ3C߈Q`5s ֱfST M'- NrtʃP}z& Kqè; +j4^ðM9Dy(Ɉ*nGZlJB^<9CP* 憕H1)u r5BaZ3>zwn/Q6=PԚGs,8>޷bqzs)$gpg}`xmE,|%-/a@!2Ɏ1|_m(KA 7|7,ġ}M뤅 ,ؠH񎳭H'e ]`C-/! Pcs:򦠉a5f{,M֯kNjyUZ<ifPܙI;#{{9;J{M9y({*T4!_7k~-]'Hqx;ǀXe  OP'W;! >i3И%K[җNRw)g*6$YWZ!0wE*w8'f` ը5z|FE3މKv;Nj(Y*f= w+9;P*GOOۡ&s "Ł *@k%% g ~.v'j(I(w>Ѳdp=GTz`yy"\ܹ(yN Ǻ"ʬ'-:st3$ n"׭\Kԓ@gv2hVjsZ1B1ƀ]-7?ˌ("B&~Ȑ36^Zk]Y_2jky[5u+U0r@>9h R- I>6&)K85zjbJݻ6z&_N:p-S2'q00u(^*?7uՈ?ϸ`Ư1a(¶w3p J'p*22cTrb c^W80UUIv6cg|a[܃iꩧƃ1~,Ğhu-s2m{I#e#y`ؗQfD ̈-S9;P*h0]BR2ؤhS"zW+~.0e?U:Yܤ &= Dp>e<-b #孞pddքv=郛-ZV>6ݤ|^N_x&h~%i"J钾),&U _mR[W%@֋Zv\Ec"]_^7z6V(8S@*ib5Wr7Mg Oւ8|'/e8j-*zwBBmpm>Ցn67;3WYb*Tn1"1/ +&>+ԉJa'N5 u}O(#ji="(KVkgƭXێ^t2rx>UMQRXinĭƁ qqۦѝA՝Rsfk/$k#Ȍ1[H CP3|c?u,!0afƒSZcȖ|d'T8,]Iqҙ@J~cquH)9l>i': vuC7MsN?c!*md_:݃zs1(~VdfÔqgӌݚk#(20mȫW|&xIm'T23=ҵV zQSyT0 &NUt$`_{W_bU*oBY>B*[ |uW cs |vࣁd].c " >~Cd'ZWA*@+i4Wzɹ4onPdAg ¸8ǝ0++|bWfsOT%bDWIԑj&qg$?9u:gISk#Ǽ'Y9 BMBdk_jHZK; cQLP.vI7m( DtQC,c q{g82لpt_eMbঅV3cS~QATn$PU>cs݌O$FА\G:~ "E5 qH}QAbkt 8čs#=l20,/u]#~5anwHloP(B>kV_e-GNl6kVa8u;gхǑCKwX rY4q@.,vsFD)@oHE_8۞pV޻Ŷ Πv'&4e؀btg4\DV_f dهք?}Jy:w_bqa[ )B;&t q"i _Dd 5s.8G\8wrSAܰ4+fI7eK:ȲԕGOa WX4ߜF?˜ϝ1iȄn'9+<Ɗ̫@Ic;Qojv_9c7yxb*k?8ųpB> ^zܩc NvbP7jm.uu"}Q٬X DlIۺXmpx<AOߖ,':M}\ZO:$KdZFI'ۿS5OnEvXyW$c Z8\Qla']K.ga 0@ {2#毰1!n_G6.;;8^d BIix&ԠWj%uPZ~A8p$#3hih1$q/D{^a0 JFCwV%J$6J;'nҤL 69nljb+F &@-8M;Nf1PkF̐u`4[1Q,ԨKq|(1jT]6j7sfHmb1JglzbčL=7 .gDZ!L\9AV"zfT-2³ Y_p?\Ы>7Qg}uz@"K8ng3L` !V'įghKOV뱃8%s6r@D[OdGt<\c=BZ Ɔ2Ek$XbHܥ"amGؒ7#,DvUQ.Eq3ݯJn`={ogaS;];T[w#Hbq9&TM;:kیC tv+,W} cu#+/oO6V*g,5;yA1w5ZbjmZ7r {`9Щv)#Ԧ>/'L,Jjѻ=)#[Y[NfMP߳mB Yz;H]piu yY][9ߓ!ߡكNEv= H1Oߍr=WW:H.78،x,c(Ymw|ےvFDQ `ߒzo-56raZj/ۦ4O%4M J?+[!L Zq3"xيqNVZ&/W-_e/;>*C0TL9or4z]e8Cgtq2C p$%}9Ƽ =:} ?8O m:9o~>,W?œZT4M;D fkiO&\x]zdn>ɵ$4EW|'4%Z&e'A%=fXjY; Mn~˯vtz񲦉W-HcToKF 5LhJݰHgR05^j#MQߑ|n+aPLXbbF`wV_ @CD)YF5e\e ո ,s m꣨SLT˜@eԯ\MȨ]JcP%Haaj"L/n+tVKf,7C1DgkgΆj"chM6ߏ/oT\ųhCaERpt 89H~QVO> 2ڏC8~e-Fw\-BbQ9"a\ZpX0,C֠p i@m Y?@@n~~HC(~D*dl5gY@ZgqgH;@匽{B5n&`I?8+4Yy%ؖ>r&CRT,4je\l9*vV&mx2ABv H9}t!N$"o0! WBU]o$~i`_NÕ7- rbն` "v;s-O]Q譱-m ??|[D2SmC]Tt1i- #:l,:kw.#~SpY3j>lKy܏Z`;qA08BgVdt#/}&&33YdJXpݡ\8zWJE`oԣ⮰?R],Uڭٻ+VYޅ?9mLO9d.6AAN{^Y8bsr(f1oЫBj<#.(ø,Q2vH$NyENsKL λ\DH_6㬥S"qgC-D {Ś*{&Sz4}ǻ95ll?@5Jܾr?e\%ȵx$Sgm!oc}*YslДC3ab- L \iBo `wgpQF~ף?+ϔ0?rOWkdGVgb!07;^\bŽȄ+nf[@`|eMXzbFxYk6ċ H 2t﶐] O "KK:{D BZ>&JD]a{Z3Ɨ`uOZ~/'ąhZЀ.;'zE!u7+rrto n~L!an.ka(9[pT~Im)F7H}<0ꆤ>7>!e3ӒV(̱cbMyL2;sט,v0xd:)`9_P4ahɕV7JHz&iM*ʒ"U4 Skrhm*Pdc(!V@{0 [ۚ'VgjV\sjNÝ <ӫ'UCBԂ쒦X K* 94dDh?sR=ػC!M"5c(yIc.S}tjux"CĶ(/$KdA?};Ioe.aAu)Lz) )$6'lvViڙόxY aϠ c{~t7#qM 0r> Wٯ~3`*%kıDK5MFU8#~ w9YjQKdž_e|8a8I~N73c{q|L HDd0$`)p@7 ?÷ ¯ߪyEo2D+0ӏq李<$u_.p)qgW14o_6ևvkb [ @b$1S]=1zY$ ~=vfb#:{T?~I}}*3'yϴdP>xp]x @r/LYQ{iOُ7\`pMRXbW}A0Yh6ہwgb騽"l4Cn%_RTdfGN_ey??_+#qbmj>J(!MdRRM.; ^|3*S i5/JnaL0g\d5%pUhj!Y}AD¢T¿Ez9uC)( fD`pip+dr.#5, Q7~=Hߚ4/ $ $l1&'Μ=FAtUZH#yc-->;*[=zHqei_~avbD6̟IK3Tx'kJI!')у A<֦}!Ոz ƸK):DsѠLL)o8^\x34d(i;]Aߋf 峷Tkpb]4z`ZrYQf5eyȬיqThBݱ ;9­kΔ4 PEZ?ت-So`NU`{t 86s1/wxxw 4a`dLTzR7 F*r;@^YB!DakO-/[Yd.\f?5՟믷L\8f^- 8RQc[%ݛ{y0i$=" ڰP )[BI7q7o+yw@ [f?loI-Ԡc0yE;~5{@mI&CI7н208#|pog盙i)s<猆^H1U*fB3l Ra[QT j͘[-\%cA"eD LA1@EkԂ{XiHorɟ)8SX֨4{/jy:5]";=ZsxR y}ڼ >VćG*M^9DK#88 BL)%re%c\"5&)R"m/o@X!9%&_$s1QVM4UOIUh|l5o*(P| FdO.'hn1-j" Ix:t63RY=?:d@OxO$?oq5IV֝D!Ʈ֗p/L !Q֯8}R5AKwVS[.]'_3*ã ``GV8YTKǺm |]>XyRG_#\U/퇀0 4gb!|nF|d,YLfJmH{rO[)\Tξ(x%r" Z,C7 A _==8YAltLj@_w3} ab=MB xY9](,/mi$Tם1 qtfPr!jjRw  Γ2HYo4)OrP>hxFzoe)Ҿ)"4_"iq:3$W~JgF&OrB-+g/"[uJH_U 7_zgN}bi#i. ߉TƯq0:p䇫`C{g^5r)dxbC!DNƜ`n1jծŮߟ"J)3Fq} _0=C,WJ+V~kMV\l2qku1V!(y\hD+6d,㕿݆r-|$ޟϮ6feޣTyTW!kdpjy:9ÂXIFFL;llNx"fsE#m"G[wSX[>"r^д~j^eK4S~VkC'>w0t~D=g,m|JB{+-T A=^Vr4U,'܁b,Q[}:$@&w*|uOj :{n^$qұN # M!hABH/rXc-KiuNİ J{[΀&X)@cIG%k= xrҲ;OuI؏劉_ABH9hza?⑥̉cCnQ E}3ef$> PM<+CV.cmN$F$==Txl}h"AK`5J&.\5jb- w &%qlL#Fè7S#WqΉ0`7KȤOK0T3[*Rd9d& #!X݈VC19PM߿S!յn%Q=3 +UVZ1Y"߹=W_vz!lT#h& \o[dJE`-noQQA}ɞm< s2DĽϤ_B>bқt yRϣ鞒? ΞB8.MO{{8ח;j/LA%\ti+"@/(.WD +x=Š|V1eT v4 H'3 s'8 'CZ\_CtV{a<(qAmm$Ѹ))7oJy?Sd(s/X:hbR? %%0(QU˺6. ش6<ϙ4nRāֲ-̲č*ꪖ, l];c`_&!i >;$mn+kHȥzWK^_P_RÛtqr>Qoe\FRMƼ k[q*3N,'+f7#e# ֨-@UP'n[Z8i 钶%6:@Hڒչh6qyP݋^yCw\I:tDW ᕙӕj7M(avUlۻ}}t #Fs_%x2QKMX}kV@ώHB4L(*E.,EҨlDym[yFpO)/A0G/~XN`(lrl Ep۸X<+ó)h)$p;0#jn[Cٓ^#X -&JPn*?|%CFq̋~LJ^*kec3s byů ]RJ"D{G> '#g#Gû=Jx$8nWWyq7(ms÷r}{m?޽W Rn)C9 MX䌫ܟ"r~6ҁ1bw{; YCw6$S]ܰ8 @0"Q{vA qwAIBJʒe %b:ܜFԑj6'p?yE+OvfAc&sa!nۀkjVg]0%6%Tg@MZkH6ŝ?9@d BOI(+vj\A^Qk?dC7Rn\*2 R__*kJ@cQyč"ET6duGɰ72DJC/nQEo _A3k“.8B^X6f5͸ՍBFH8CXVnV{+#<5ЦL良;԰?Dyoy5>NiLX` _?L/~?TOVYJ IG==C&qC-6GdiwBY~K3,#t~.#RZjǙ)˾/d],=&ifbbU+ѩ58Ԕ.(߫pF1"4K4-oIQ:ʧ$PVIe'B^vT{OhUcnF8EO8(S nx)JNQ"oeדu{"LQn,!z(E'k%y$(ֺS[3 +p S|')r Na$J/iBx"6PLiȷ:- m={ ?C#jFo)4 w`%.ts QcE=E=t2c̅h%A\8УMzY^oL)?̏hW-fW`ueza"9!vY}z 8?5z ZĻA> % ҠZ-r, 8wW~ q 2ޔX!0ET6ݙ4VfmVAkwZzx1OL'ߡh@S.wI︣kxw{C(3j7Y.u}O_W-9tHPÙij`/v"5[{<@_@b/9!zl&Z4Oi~,z-RRpy[uŅq'aT+^Ύp?(d-*YyS7֣*5 jWا /?Bz|+gm"ƽח1j `0Vwv4?F=ˏCGP1[aXX UKl zGd8W`m?ft+W4L[*9'Γ!HP~qq/o9pΉݮy x:<0 ]vV{ +s{lӒESE+stdg9b=0c%vN$O}D`1r=-~&tO6B(=`]2R]O8V3|<&lf3I|i-,cfAtg/*݀(!H>燝8ST3!%Q jqSCNRKO"x,Me z4)%.e{-O) JΟ(=g '&tKBu::;%PL֘4Zuv-/ &]]Q> .[g#5 aP蹰5{‚"vt@{AyO(Fsepʄ2 *mRK\0{uDɓ |:駹 z*Wc98,N{Ε_ߩacNel_o ݡKk(_'}К\5a;Ҩ 1h7EwiUxB8'ˡH%VS2L d -`@3Ӑ!>@QŪupt~Fo0q:vQcUY#8Yxb}iҢ(XL4Mꫤ:AB*5[wTA&2I=e9t?KMrwf;b!GWK׳^BngVVuBea7t2RwvLbHٰ?`F0Sf!ǐ٠ɿrndqua;k1 ='JylJ?9'Z,FϩRgwD]ƹ@av?adƁE#%Ǡ2{#] j_ <[ q̒><.@byX(rV+CgG[;DCMV7 X۱w<٥_^ sUƜ;i'*4dW [9&YPѵq&uv;MPӜw4’"qT.nPc@kT0&h2hnTk!h~%”/_M7==(w1aW73\/s!-vīTd, FJD2|CDn'HѓLRvGgIHssh'WēRT:osϧ+v =K.]Oxa0J~vRA:;%B0?f= 1CZ>Hpws.DnER6 Mr(q97^($6I?b5f?2+gU>{LWPw{39{$iCH:/δ\u>9g3:&nE2 CO(k8jPbÌx*t&\gz{9w1zs*|6 a'^U|l`vc5I<]ϗ#QMɰ, 9Ig6\t>AY4ϻ`r;ʪ"{0;9S4)9DL~D +M[̪j KA7 5a< aI+L2UM|Bqh15QS1fT ϼ@<!}}3ARs3:2胔W MG;9 (5C Ō]mDcAEJ>t,HUJdMa 0Zp٧- V> HQb"oDi/U0Bf=S}ؽd:\"BбHkLJեL 8QpUd>p"5?L[4f si b9$8HA\z-^.XaAI`{ݦg/2'$ T%s@v_j4fbDE;hizξ<E´w|ceʮv/_B^c yɭ*],% Ic}h/9kC>z`mwq}B foSt#0R~*$էmsEN!;'$M-f,s;& dv="Sp5݄<$p և=>ePE`50+M]0TnגbmwljP6RN1Xt@qD U:OQ,UQƭ6Up7R;cqDFk>Z'U5EQo R/5>CM..W9GDӄe klkTaf?50H1w6;-У[0/Li^C֤p&PVk<|TsS/|qfLL7yҹ,qvJ*V̍CAiSH鑋29.}6z=S6xw2P xN "la楸,{c:xl8;s "ުG$Ob}]2ĥWX} S<@3-b+bNٽ^ň?V.UA`P1J0ؔvx+aݩ-wo\,*XDJB4P G R%:5a6iC mf8 LTӜGPgZ.Wnڒ31B8C *{zVDJ a62L|! Qjhjao)K. ^&f(oٽ6. ]SqJe$\h@tv<]%|uVqn@kce{%YA!x wtC}aH'h$}u"os+CWp_[^sGęVd7Fp1Ɖ@!fjM- >],!$¯= j?B=T:{<9QHY5 ECr.o^$P]fG &hLˤl%M0K}1&e;ea Toyk1=X5UjXn Z1F&8&\KN0x*BX-7tEZ!_%sYM@zd`WwOy4OF;4Ҭn`n X0VK+ ΁9E晖NF捱-@_RةJvm } [jj'âiB"`[V4xNOh"ݤWNsYYZK 02Etlb nHN 7r(P\k"8Y^OWs H/WI.^B)4~)J ĻUȀ+W86yT\ uhe6],LGNβ0=IT7UwN0ʒ*\p#Ķ(|zzа;H˚`[%@X32`qߗ1 lT7mO1${/0z PzW nǶ#1ѲU"|fTo0{vKiK=TVw٦1x):||G{X48]}Z;5yk7h9V;c-Qza$9YM~0/ߨmvݐ ׯAe7Y4T JۣH G\$EdΙ Ycy м/[vdP g$g~2\}ōևcF5El]U|ɝmg:(8atB+C=Nxx9cfrnxΥ%Ig/kjH ZDO=c%Z;_@adS%Y-'o^ژ_]Z7h21qT%+uC5p -3bS/@]ʚ%Ng"@JEmy fR6dE|gсXp}ٝ kb>BU^p췏Ep[zgDv!Tڜrݾaa؝ۿ˭Tpc{K& ȉpvItv)Ć8D=l(wNAݽ<'YĂrC>=&kQVN.89qzk# 5o [m6DGW6=;Pm.zma?n 0H}X`){I%AIAyI/﹄,t@(:H]_Ocjۆ/4dOܸs jۺb/fRި`cDo7T ٬|S#sy֯8ziJIn$_Gd{ 4N~mA,MxI'q\[.ДƩAa*_MKal5sת`pyV[mZad)kGq$hWeI0o)[3ЁVd=[ {>)Ax;G,!G}t5ߥ4HlLe'F^',;zD :C-)O@=&zϪE Q' y\5 uY%0V=fH&b1W5bGuO&R jR0מ "sI̘s mF-J]M%*!ve)~aDh)0̟ %c+ڠo`ׁ 1~h1Gըa\όNlXB @bvbέ?[8=޶.0k@^zdҹqdװ{KWy}BKc}x'cMppdEa-yCp}1lFR h c3,AڥAq5z-řOCQ"fPN9`p (\BkqH)kFG\: L+%G4Xi lWԶ/Y+.e|GMOhnS%; A\WW$rJ C:Њ C /KQ. ̐,v\%yvN; CyHPE3qk}J!x5󈬅 ?yd[R)e]*LzC^$cۏR:?+fes,_#d6Mk/>~6RO}Z׀i$yʦd {D')5] 6lr\+#v mAṮ(9A<ݤwII5I9PQ0f5T47?YbWoMDj6DZ+m?UBf5ˈVIӍۃ?JDQ,$0{]X}XJ*ێ}Ed18܊s$ؔJQzڈ6}C'XAOiYIAAdRGVYZT._>^.Axs3 Գ;ȏ hYoU筗bKH >b}%"34Br%'9=BS%YI>TXdd0 , wF 4OQqk:Ml!L/:PQ., ?} 3W#CZ_̇`pEU[ղ."}KK_= ¼wVʬvL:ТjNݰ Bwp5.`N%5naU u,TBo;<y[N,y[eS4ЗDXA93I<9Yfo\[Z]"ABfѐ@ﲿzZAb@2 DfM&hxaآ769kInM7C(w7iKݮWdցt3޳{5=F 5۠^i| <{G;w80k(T2k##)6AVQ$y;\VIN= 9RiD#ti_do9-ԍw@&LĤRY3 KOCyCCf&GcHgb)t݇/w&6!G}/!^6&a^˹" ,#ne5gMtxlߐ4*%qrF5^+PڰAbyXH X VGc`L:k#)' LPř>fIs`8tpU޽rA@8&uEY<^#!l7OsC0\.fip|hki (I0En!ՍaU ^ q ~ #| R_,Ѽ٘{m+ 1h]&6K 4ZX/v]PM~2nU$L9LjO@F_nP9WK0.,$>X/^?,%GY¤5'KǟqM!C_-Ĭ f7@{q*%RЖy,pR=68EiBZ>m-tIs {Fj(c|hcZww&-mLSW2SK?eӗ?X ~ae$;ZsDѹHd`,\Mp:%/iWM */8LռLgwb4'刈_ EGʷ#o.iS'3MVӴ7(4;oɭ{9rBCcy?9X*C)sgʳQ??IaID/ bwTqg{':qw@圣x$}>[=bšØKHtg?Ow?8<[>*?dhzՈ)]`^{+-HKtlWmo9rW]k2!X㠊aAٜpP(rzIêXw/!cBSɘz?/~?/=%I< FaVDjz~_P;i>5߼"Q5Wo8jugs#x Gt "R:ڏ,fsm5ȸ0& 5byy*YU/T7 1HmD*'(x ܽ'\A LC @`<]]d@{?>{^yNB07-MW<͡叢/ j0|ĽW9)O*QxwfQRJńLT(8h2 9IO@"NQ{yADi9, xa`9xc wÊ1}܊l2iA"%&1BH7¾W-"X* t\L DDsv%;BM61(:.1 m\CBzto8kx%Ep䎱ww88z _j/SNn6v#Q4Y8eq(Ђ7=֖o$OGp`(Et\s3jL|tD9I 'oNc<`=JfM]+"πrF}NA#cYr\n7OO31a!Ї⼂`o4#m$ дfærqw,G잁.z@bp'NS#nPOlq v.7 Ii~X禔u;p@A: / '[ڒaDUj৑sä_*/v o5cto`71*,,}?z|=g.Ϋ֓E8; F#=uh~¢ѷjGᛮ|dؾb1jV! J%vWx&G9^Eb{[J\9HƖIBxO1p} \%K+bjhbՐ![AJ.ܽeP|eH*ol2j߰ @ a&wB}\v<wWZr.U{m kbc se= 6A#*ޡ|"0/gXؤVc`FH'hkLa<$sj:P )U~hԤ UaH*^J 4Aq8..ʞ\[B9f%.5u},DdT#R' M5Q3[~+{Wxw*g1lő"˩ OZ>e?..n/w]( >3xqZb?Eפ9+h::s'%EkyZȄ}lz D ܚkq 0~W VYvW jWwA3~st&x_'ջP"AM0cЅ ߃57`ҹXZ33 r@̹ۤsj?l܈SqXASQqʻ@E$AOVEs_( 3;r?^ Ob_hN&BJYiKr1s / 8 6<W;bRzˋ=`E]`Z7dO{_Zr2{6 "TusvZKX(1ۦY`Jdo;!KՔj] pcҨG?yDKScK qX<38xaw_ƻ3H-rfȥ`Z},zuԻ=^l6^]1a&[5-xgчﻌoi97l^\g.JʒjEʭ94Y< }Üv%4tB0f._, (C^VC|PR j&$9&iyUe`--^KA>λRcOhX?W#{l$D҃%ƹᏰS5;cjwQ:-F] E>32eװPb܄ց];S݋(4\+wW͋!pCM WNyY0Z2BrbEO`_ثb5 n|CWP*O= ۶{?$3钧Jy1#X0vX:tl15`ȤBlD̸/tڙϞ>z'SU5c7.98Mq-\ExՓ @YJ#Y:] 2R?j9lRyQhYZ.^8d)ը*['Bl7oVM/@'|8()$GN 5ѪP̭4h\uo@kGm ;,Cmbd"}罏LѪvSur- 6ʮ+̭@]'O>|E2z;FG<XcTbcă[doqĎSWo-_b6: ɥUavH;{yiV 1 z704{T`͝߈a^{É[|HB_$a) *%}9y%L+9ܠ.V4q[@+vٺV}Ȃ CXv1wB>z|ޡ#፸=,ܸm{$#ׄs&zMæ ء,q^RޛcZIՋ)(c)`Z3ibm NJ#g6S'mHs|ë\M+Yɞ5`%V&7d`ӎSl ":4sl&Pb1o/y &RJZʹQi2:ϳrQ90@EN cV T*us\H`Peaq$d<rRTL)XG=Gv7#;eUcLQ8h!霧w3=YMeǼ6V>cLqP훽0IЯSBݶ}6m=iP5l̳#) s gJōPTֆ?aYm zt7>V͘8ӈ+cIK ֖*ajsaɄn-g2{4.KHP nT{MX7|c#beRA㡣z\ՙrO/ *-ӥ^ڟ,JܭϩYEo#O5Ș* F(1.2eekv75-g1SQ`j }CYnƊ9\7(=#C#K+CDeV۵xO܂*s  ҅49+7 ss *yïAӈd8#>= _kl*0c<Ė*/ X;| %% ͋eks }4H ztLi j%<2^;Oyki\Pҋũ JU# q\XxhȔ}*Tڹ CjM[q@2+卛/Q}LwmjflWZFP(8 mD;M"\ǒ+K7_|LnR~ΎraP\ʓ2 4/K G?.O6ܞ)3ï(/ A_}]S+ uxS0÷FhҾk%jET>ݱE~eEEx0I+Y peG'zϡ- @ebN^31L@E*V5[G/qlZ'ON6P}\mf-pZ}|NizB\(3sKWʼnkP⤿W_&[|~Ct;Jԇ i^jؾ$ZֺFyfl/.BY@ kIe(eO}]?';?u_9X?Xp*"?JLО)`Ւ4_YoIb{keэ`Ly~9\AG$3<",S߭f F'a?%oȤfSopkcUcwjҰs^5[e\)?'ix0nU>=Kz}.:0qaf,@LX -po-cM=!u s6iyLrCXAF;{(kf. o`w9g?Ģ79zkB2~Dbe~_JD~6^193%X]l-lpG@&UC+;ΌQXR[ϺǴl;f'kL Qg$ޜ}+dLufmߋ0Uzruט]QUcn=֮]s0kkɟl2c1 kB?`q!=HN+? o,Eg o~Jwe&{33%5`XUkO-V- $*~fzvA$aD{|g3Gl50Z 4D~-UmCt-l'p B^!C}Q. qVD2rH؂^;F \zWWdc@Bե|btʡ NxXf/Tck 9dφ<\m}cNxXf}nH^8§d#KRHvr 7J"{DbohGԜaEH45ᘒ{, :&ζ~ uj2<2IHv/!3u/;IGM=T'2[,t͐273*2O'|a D:AS6$#=8HFA;)#Q V.9Ôsy[_U8>Rуu 8>*_kI)3QHξq萰 )rEd?I0Eyw/:@݋KXk$1r:7$VL5'|q +|ugPx1w{IE٦0g9r[ns`*_ۻFR&x=38Ig6Gm2wkO7>صY,E?LH'X `w~a0ÔfkLai!Z'6I09Ez,32pjP14q3L /IA܊z ޡ^H>[ΑFe`whbvB  =( H^rueu#`>*$HPUF%emh:u +_)=›㠚*}j[0!һC+'Q]<̡>w#bi\VXR˻vPu; >grg-T brHUr=n޲ť|~m(eaL6W,#.KEe~xϴ 'n]U]8;nLDQlWKm*SR8?I XK{n=nc6fvt{lKs} Lnc\ij 'ZVu\P<7WG '~F_OeV5-+9f>秳rw 56iZ3L,(Rta00YҏN{9]Jx'f'UvFaY*t PNb챸 oDh/jT^ZÁtrלtO)#Ԉ})Iy&dSRCa*dVO Qp,hi#c(R^W#&pg^"s:f9&9E[$S-Fޯл>v<~yl=Uv8& OC"<đx)Wl7D?^9"EzbBPql]r΀kPx/ Nt (u[uIrjmi|JmT'93޶#.WWulB Z{rI}_؜5ؾ2q6ʌIl8;9v#`^q<SXCEpr%0 4Ye~|B {E2Ņ]'ig'Dbުv(vzq-÷HZT iܲ~a\U֣FMqsūj ~U#)-'@vSMux׿$/*b8men },Cѕ4>_]1!Sbx90ˈjU/ŀWC%"X:1uR$k)хٜvoh6 9a-hgR,+o;/g;02,=}àBl$C͹MmTin@ ]tC6 8Oat%óץXD(3mEq<>'sB,bL+ gzCP_UEYa+ym&\&$]^[Λu̙~oڮg#*cV!GN<&|ch phlZ4ih(-E%MyG^7` {#"!Q2,Z<9G i3͡ Gച}3Zb9 _ Df 7 K~ɱcrRH mBJn;0 4UO.,MTPGn6B[dBcf0CL.AJQ-_)f&_wDГ0p H^L ?MDh)CYǙb/܇n/#7u8^.%qܼE]6ܙ5W^[Pv?b<]?ݼ iJ:J8ci e%noWY楎:QWC\ to;3(WRup,pYva 16`ƼzmOeK cG4HpE~߯8ѵ¡I"meoifXz |n}XTj_' 1 Hln"IUCyS(5wEFj>usN島ly#}`yYr1[[`Ϛ.43̐=|JE`)*Fxb oCANWY\:?q{ڦ&HjrIt:o,( K; KѸպ4aA2l {0Qe~L>b($rc(,޶F {:.(UKؗ3\7N`ZDOrQaĹ!&Y1d6ʨe_LӼ:/_ђ1.\.ɘVAۛld/+5kԐmR~,W\b&K{Mnx%Ą9xX6}4ߡVvŎ5] 0!nx%Tt8!udqv-%5E1UTeRxho&- JrǯK`Yڋ^Md */Ѳ;-꣭ћqg*F1y8#9#'Tmi,bW/Վ8`jlhhzg!8KK  4J tk TDzn*%=V|B9>Fhۋ_8xA>Y'Ċ1MA +Dhf9:gVSt, zy-#4<(ƅ@W,(%Q&a}`7-vl/۰O3J7\g<: iOe*>J63S|Kh-wFĠ)/8-Lyꩬbj2=2X:柪=;L2kVܧǤz[M>G(=K k @촩 jIH`iB⻸ є_jgN! NJB7ŽSgZ -D!3/ͩ ĤtƳW3"N:?d6R':>-} *&tkg_tQ.s|mMܭJ;4SJJʈ!ֽ:rUh ذE7R7c] nB Ë.E #a,/(>@HPAZJAB5+"OU;sK›sw iKt=hfY' 4pt7i/9Pf@\OGBmꭦw~a ̇Zr>+]2 O! N̤\_Ov.߿V}\[QI_'u^s#[IEM, 峫yFKW8m-TJbw$rIn*5!}=hIIvZǾO$DNKh;&;SDx}_ ]dfOjiS1"H.7~n4Mݠo#7=[ѩ*%ObԏU1` kNin0$#i 1B$EI/ox "u<29$ˡaj,h, 5a[N~]L>lH%|dz== sMLYJ*0I,-Y#lA*tOY `)I>B~ }4V$J uoκ6 TI@6*T#$?+ų~~p u$'pI}kulj~r&@jLnhd4$^T+av?]rJ_JpzvmޱeXk)\ɍN|SM˵T1i5ٓ,'Mmgj$Cć(#mg?eZ8M{{ 0߮ &?.M=ftVY63 <:= EM$=u!b-g+fJ>]ȰAkXonu3+V]͢M;v^H y͌{9zV*MZ: dN ;ZQ9A=$c€df-Jmݱr&Ƣ#JXT* 'uD5Ԓ0m(iѸS2CbSV^b$YHq(X̖ LqcT6J)+CI$WqQpi&#]zA +7Rn争$0/77SSs#+G{*l.=jvY{M 3 \D>2[M`f)"`ud Pys@옙Whq^q;CEu@Jy2rF5F|w;ye㭱 3LANMJqS;A!]2(/^axϼ]_l]?EvS7M=U5lq'뚮!GR&\Z3X/ pZh=:Nxݺ>DAiCx;97WQTn`{P@|ɪ:.pYGt`!:rUɅ+Y Zޔ:5{=H0网Zn,j@=j""n9+z !Sc2vpGjե&N(v3ŎfUؿj tX*pԖdˁhM#؏Zufi)0BzÅ͒H[>A Y0S,ke9}զYn=s8?FaMg2A8h+'}?ζSMX uky_g+tFRY l>8v}fTz6?<əR)_bHUzaa:]6[;t.Nʙ5.{с 1LQX$Wd\g8jBV ;fkh"#.l|}9P-jL*LαkCu@n-4:l%i{L@ 8Ӌn}иИ#*.1QU)2Gm aG/,Qזּu0YZ{|wisů!nm)1qa$;[ DZƕ*%1(~ $\3#ug~:2{<$' "p?bXf|L wY&NX/ڬ[%٘HgW!|2,?@( 9r zo'WOüMWT1ZnQUE=Y$FǸ!t yW >uAMӥ,pTP_£ݽ4M*4+4 d=,t>gKKr~ѭ`w>C&*4zۢ=4pR'89[R:F"9Ug}7y|w"AsrKb$eS-d|!`\'jW!8(&cS.4NJqD&?|rbNS?3B@G<)ޝT;lXXiZͭY;srZ%'㎡];R;#29 QKl&\@iۖ4>2|4͕Q~Xx+B4H'Nk068Y;Z *ڲX=v~e~Թ4=Qأc Fi1YyftWD5 ٶ!M-!Ҙ&Ƚ %&;tPdzԅfk|iø!,=]>jq~~£f{(+?I'1[PFؒ9ip5i] =/jedB'gtDFL%N ~AS^+ @)NtّmШWI颣59od߱-Jc&{d`[ҬZ;hlԋȨB'0^bs᭚5# `Zqk_'-Li +FqlöƩ~yIntX"wg#W(BjF#QEtH)&⻩%'t8cȄrPo˜Ûd,SPz_!Po6M8SV7?{/h1ew AUN' Q[sgeIy(=%u_ AxWP$޺^M z*ӱh6 ұT%"5j1 3 kl],]μS<ŭGVm3\Ja`Yiv}IjfĨ;: JJKTZ*DWsvԈq<`c>Ó]O"faW kVdA`S0Z*+?q3[Ddpna?3Sgo9so۞PW0iY 8s(>e~g$%G,#!!s{Kz_ $iўw_&W7#˖|LvED\+kIg+b %@wۮy_,CK Fˡ`g<J= #/LLpuׄhF2(X'jIe i^.Gy>FFR4]=-O݊?aFSةSӝ"XB*.{mkuy9l`?LnjkO$Yx~Ēg:Z(&Wr6eScHgTh섻-Z}@87GrD,(KT8dXj PGE-u}im:uRJԩ]Ҵ1Y:j_=Rۊƃm9SB'vm%Ir|-O볎{)յ?&/lV}m%nlkI3֑{g17vЏ f_Z[OhP( Go^Ν6KOuJ{Y('<IA}w<9{eh3yU_^8Lfz?&Sr%x&|ۃ}D T#am( < ioɗC<;h΃7Yx6@]t|x=Anlymc /Y4^9JLrhvQc%3c(Dy.'w*߆iR<Ո򡹴wDtKiSq*KL?kGgئ/(L! '鿭#didiw:q#-Ht >eJz00'H'3w -=lH̓l@Nx9p> yC8jls݁)|ɅbWq)C0*:My/9`v}5ƹw{cbBrTV,s+Vϳp.Of|aA0m#*t碭6WD^prcY`ҥ=P1x^K+ڋRc̀fI5sV@xXWi۞c 疼7}bLudyGP\C*Lδ/ 3-)ې ǐalm HFnsj%F||E :)?C{N\ Өd=vy;9:wb&M5ݤT༏V(y4ry5Iip5'S(@N[SO߯Eȋ| /[I`E0G'n۴8QiVEěc$f.z2Q6EN$ e |㑉uA(}M^7fg=(Gꞣ{½*/5J5|=HdQg6QfX(U[7%aC)]" DIC>؅EuP4\jr L49D^j-huQXDkAe(-ő[ (TH}#u$N(_Z#]E׶{#xS)|jV!<,,We``{e{-^Uk 36 FB~8FI̴weJZ4eB3)cLVp /o0-$_-Ǐ50[@ܖΔ&2ܝ&XXJF-i# poR`z.pz.mWT(xMc`['ӟUٰ%VR7k2Iv|K+Ne^TG<ζ nL r{RN.Xgx'ΘroVOf{w o@P)xwj"<@zҭ&/[?,O$aߦ(E88ODbwAf}LX^;X|akQcOIZ݆Y~B? pWMOSXqѓsSw;"^('X[+GC3mm= $Jql H !Ηhwʫ-|O R$7LU<oЗm5x̰ɦ:g)o ;),; ]-k~ZKHڨHWl }dl[L9• 4u.@U(% 1%$fj;܄)z|0D_AF~[5T>@;f;tXj EUG6D@&Ti[5|Mtn4sggm}M:%%Ydm5p,JKxZA\I{MˆfB<7ruEcPoӳ܁fQ&i2)4rw#1maBUwQ:{q(K=KΓQ˳{3M MOza<^,g1:ftv$xg~ X9 6ɦHLp`e iiQWs+5c1mϪe%9x="AT_•S{#6јo JcLjKWޢj"Hy[̤>J0k7>XwG&i$GEY:YD?{ 6"3/9 d aYpu=X;S{ń{VV2)apI|JGI*Y7B|G8B^D|6fw@%V (U#zlc: ` * R*C&+iuZ:tsy;pDtq͠FGU&4E,ڪB[FA}d'F^ZkU4^ԨlQ@.Ҿe-~ x\<߾{1cDwت"Z[c0;L]m=PWA?GheP#,qUHQ&kg1δ]l9=~h.Hh싥 "^`J((V| fjU\n*hO^9kjk M{™-r<>X zVS+5kGYn5u4 XA`f:x?L@cW"YN L!\{zQL(yAȳ VM BH* Rj4l[ғu+4G 8(rrFܪy)rnU`&Jŕw5$s+IT,[YL7JW ~"VlRuݦٓ|VQ} ./\&y`a`vd +dd0jz>N[< [ru91.}ɧ!6|uSsnCv=18'w$$1pjC"^{b[Һ$(jRE"Pwn *"ٳ^8-3; 0W#ƜzωębP6*^fFk3q zӱCJ)bԅhz^ue^28i9dmSȍ6X4*K'ox yyb4jw>]M`SsŠ\`xг˜HP=%t'a$ V*ظkm!brpVSzyd Fk${@C +H38U.E25OV9)z8/:UTPCnd ؐFGwJ^ڂ$'{k$k)4Z_[96d tϩ_q[b5 (.gąOgć(gR @ï*.?k >-ז4(uaY-rVݰ5gg"VFoSYMiZҿsVJZbi%erհHMk1&2x mX`|D-` 4R0!vPJR`R"XK!h{&H E !>Ev z3GK&⹏Ī!Sc#64KQo2ܣXUJB+?\ cm.&?DAT`>~S)} aeg^T;ǻ_.F|鷉z':,ꄫOT& r 9 Z tqx 2R@ulf[*. UIkS%r0ax [Ľ;]U@17uetfliFWUR6-Hns{mQ`x/uYb(sbyuwH&~HL%#OP?Ӱk?Ig;J;败n\$_&C&e&*c.ޭ;Ḧ́HnQǦSTe: )E4̵?iVݗ?o w$(G7{ͥ:O,wQ1;񍕈 GeUx迀.رBkuíxZ*] mƫ"/y`N6>ԧ[HIaMBwTRV0˙ wOq+@4H%ɜǑRu8ͅɻknF%G:] F՛k|Ht#*N/:@$"t@xP( m)} k0Y9I4qk~vīPVƒT L! ]6VvUd-~D<-~[LzhLRj~ V"42+`-sˆg~`5zy-{jpO9m^2;`v!6e/gT[^儕p'r;GW`%ljUal NɐֲO0pV>IR*n,38Xad Q!FٝܩxxV@*[b9"}﷚< r(oݿ2ft[sjS-6Y̬G!g-Ml 0xRnR!6R" Q,/b&vJʞ* .NK RgVRΩu? z95xEUK)5(۩,n>cI=$y#aϹ'}9PpJ^/wH(SM8jJ|gV]}Y~j*h%X?b?4Udͩcjp \3o9 "w!MD|*TKf#s F ڟJ[)%Mm}Dҿݦ;V4a,Иx>*'{N\|$gv*[)'=o;PÒ~.fG]@9hMC[ Yw~A(?Rtѳ7}&95l%G +HMU{XSEW !N]` LH6X}qA,YDE &3 kGѣȤܠ?'fmQvܓF\#-#/gG @AM~M,V\RW'J1tOD_xَ i[e֠ +l@*v4.x=~ۦJ"5&5H;UCz8wl{T\8|.)t,S,V0iZ0F <&Uum>bZ: ͯJ*6s59X!^$ʓ*fPɽǖ>!KEeLcj"jHSc}7e&DB3UEk9""ն$bBtm8W\0õEmUi \o|QVx%U1ůBroYB`98*2kW'%-k6',U AnDתo:BApr7A/GKav"V*5<Ƈv5D<fqtdԗof30R_7a/q?5n1Fs,T?ͰVboSeP>k759kŻ68㡳 em.)S==+Ylx-Lh4ʻ S]\BS+(fvFaq(jCP %g9V Rs^gFah3NQ쑴ϓ K\<rat&㇏ CM8<ybmnfJʀ5]՝1!34{c٦"zE0M!TLϛΤ旐8²b %ׯ0 6n9mm;߼! RFtƨs^2K"+5P:%$!(S{'j4ڇpI+'WeF ÞHͿRRIaeVN(LaTU4׽+x EFcR1rE;#;*S%^"~8DE\ѓdzW$\)uf?΃ӡ|g\wU$z|No \4F"H. ͓LJS3{`&?@X%;1Gbx MqXߑB/\jplD+݉\L_s,dљj TCR7: tʞrǴ\Ez1*\RNoUdCC+[=8pP@m+@ƛEW(M"Q(C2GԽΊ"8B*KųϗYr{YP;V9eM@kK!`/s)B~! |*Je"9㕗@UhKډ zFl$Ga)$.|t8|SnISˡm 2|c6kq[/"o+< p*UЎf"فC5z^8'9G BeASI'W-TEu_߸))58 ?;\G[zD%*G8i2`JY0 D sYnH56Ac;KFK:17L"8S(Ct7ɃU>|Ln_yXlMPB0B] $iV{w72٨cytːl=Li37;Bn ]D*T,Z?`!HfM_KbAē7R@X9bHa9CcJp: 6^Y^Ima9)P]4'&?F˩ ]̱yΐ|95PѾZڳy| )($B+s+NHӼ*֜r>Ǵ Ä râˎöO-q)QRF]:áSo;ɉҘӭr+$K5M'K4 yCZ ISU^_nidږ+F|n /\% }\@@ݖ#}RE^!EXW C+PBSL9=*.yQ C{K {7U(_vSAÕ1Ɓ{F0mXbuN'`tΪI}@wSW䨡ck,{|(KuLA *@%r-)UɕSpc^0 54?]c"S])O8Drz)w%RyWRj'^r *%B#-m$O+JꌈyNOv`#F _ӎVR唒u&o (9m#)J8ӎ^KxYƎ !z t^2rZua5tʰ8ⱳ,BKH8 =.ҰQH-|F5^{YOW)]gvw]a}/8^jb{.V AY2[k7^. n5 JG.5lP:,p SE:p{[9C'PUEe\8YHC*ڒsd0\ ,X,/ L[Bs]>pU $jԉڇ<#^'xJ RS` u $zӔ$uEAaw݆Qٺ4NMvCӜ)u;0o`PW&98 OJqBDX}'; <*Kc-d!IھNrFVLQvB:N\wWP Zzʞlgڂl=84F vwekR7Oo~9Jue-'#Mz c=8w8,i<% #v&nRx׽ JǺ,P>rC~(|=D vMt"4(%x~W4er^w`1.=3|ɯo:څdpo#2o}þ@KDʖR*עj߅$oU-cAr;g֯w;(@ Ko,I|C3b`tńnIQO .QnL WXݔ /Πz͢$k*Ulo1.b_*ugSuU"` 8bϯk7׎SR].">#q|~Գz=XΓPFhDC"ؚ}f?w}4L Q{{QR ?} E4lFs2clI~uע4~[8!Ɓg3I=4~jtk% 6̲}8EɾX-0/MEOw7M˜uKeERss,0;KtklZqx0T߂"K/c6D[Z-&gNT,z= ˖~(.uGZYIctgr %X z; AU_Ϲްd$jh>:J3[co tq ԣ~}I[⁳Osfu^icGˑ&!v_dޢ O<ܨbCcoaRQB;.puUf){Q!5VφKGQmayMt慲|$#"7 Hy]t9l"S1jj2JFw S؅He%t 9UD~w+|u]K%O2\:A5| A3.'á7"83ٟDbdl*ow> ʺꯡR챾o`Xf׎Vмq^2fKGSvExX|>2|_PQcC4HƖ _ΖO#rHCKN⡔Q+Jl \U_.V;[~?Ͻ'ڛR*,&çoͩiI+k!C<^Y`[[%k&_h3GL8QU}^CQHd lD,z!"Mex:76cՀ@a7^ޭ~WLل䖤c)m_jג[(H|6Ӽ.^X|xzKTLk~dga!: q=h]kyg7cճ%m[few3>5[nB@B,&8Fm 'Dm+0+*?yѱ*mqs2UEUH)T5JS=Gu[@혒0y*3"vϏ;;IFu `L_*:Cf=\kQWɐ#pUIt-}cߕjM=]^G~!_M83#D0|hmjuh45.:^=XtOሗf-(TV4k-8C;("dܹ{o`cbT  tAWZϓl=\OS+[ ACOhTM%-4_֘R܋gbgv0[6<7b_jwG tT*vĩ Bˆ-ϬU"lL:$푡`}"ZpUlZ NdjOcl@ɺ,g>uw`C*8K_%y`'\It^B 3M6mVIRZH3&>rO\+#bU';[GXU2/䉁wdLBv7w%ëu ly/d-*1d<[ET=w@*w3`8%3RUqhN`\Gz0Ϥ-RߖUkߴ]TqG鵛:TctPfέ.hhDR،,ىb&BfmJ/'W@IapNH [E4Z`!д~7 zܙ39X*NzڔffDB;vw-/Fg!yA.PNf~ne΋h$9s"\W[cPExr -WL!IzXn_Y9L$(.!d"I4`ݠ6xKAyj ǒ2CPrո75>/P׬x%xQ`X>sp%9szd(B4nG PVߵm:@Me@Sw*(n J* 4qćd(Xs3 {[4b ;EW`bG2>Qf cdȫDogX.[e?1kX?IҖĶwqG@49GS+҇h9x`YU*ulP | 8< {wɬ)ցڎh?6HoR+7 Q 1qLl|Ÿe2hy)%)rŇV5kWI#y #=,̋;b~jCKKehS׺ #46/^EAIw:y-SCqirQv'Ӛ+WI&@Kj / L%?yz $VD8_ӞǫA;D|~նWƗtiأqz_vӵ{*՛GNZ rEfA^SبϤ팾5}:`uطh[<3˗Yep'N|,ݗ 40V خ73"^_d( *Røv߭ p鋪(@oGb8muFL<{Yt߾3??֓?G0JG `).3HkҺ,FwX]WW4bJu&&a#pt%Zg9BH5]jkN5a<3 E߮ԺLTE;'m.U2.oMԹ~OA/7 piWPS+;a9 ,fÉ 8G~&V#&Xl;Kc0܂?br|?Ӛ`lZǟ|^k>" knmGʈx<[~VrTHP$T/!S|PgRA؛p&I.pYaU]&ĸ[ d}c Ͻ27 [$o1Y;QL9_Ej?~.t Ao;+oAxqW;Ѭ D*g 娮(QWLX3Tówi6st"nߕf@ƼEFc#.K lu(-3jÎK  de >Xe1J*:DSF2_ߺEC6FW4 amb . Ru6(H|=Ә=t0Z6QCcs{Vh$&ގ̠f+_-y\.vIF_X*/%itFG Y2$4jnA Ћ62SN9'[sÑ=νKqJJp=Xfv]:\?䰜I:5f*> 6 r WFpڌle]]4 }BlE5''o^^WB .dB[:{k̂i\WOIAQr䂪;kW-IUdq, @z8 Nj4:xA'q\0Cyt.x M68J7$f-~pgsrq-qK@L2H#"kIUUnur3JzN/ddi')E?ʹl,y>c֓ş&3L;8  `kXOHs4ɖ:H5r[D ՘-Eޓc$-=50[ _)7SN3Z̗xcoDi_eټGV =DRP&wNa ;XHJ`\ح "r K Yԋ"fU C=v9ܕekHNݵHwVSk@bsx4#3 8KwޭV.xX~ ᛔ,@Pd^ܨo@˳y0!-.?K?﫨+`';kֻSB:-%+.WuPleEҋC=|h?ǪF˥ˬYiFP"yqe@.oHQ:FÆ]/ܯ8a OoMRv<9ކWj-hdǼ.3Qg) e.N89@FYpށl*_QFh?? Y-wư+=ˣ3zM-0G w촘[t=SdC,߄ESR1[.އYo}1c'4c Ûɭgq!No_d"h?)-䦪+JD~B c2O :4.4 2+օ`Asz?/T-0DӰ2tdtݨL /B8n賧jG=ϟokOnxNq8B\֥.w}h43M/ﲷ,N.rsqv 'jkiBt~J8񜖇u ``*n]R<JiRRvt^*:/:sc ̂R%?9K?#Z )QB*Gdn1إ}#0U5#O  Ff<-elm^1W!]`!p;HMHtw{ S|R`|i<\ʞMmjޏ6GMڪi6QMKcJ@nn=J(DȫPBe24בZdM3L\= k]"f5ș"_ )M,+#!4RX1 opCb}Ԑth0 a*Y_+gsx:ķ?7,i @n/]3WK;a܌[}赲1%V(\4Ay!6ED_]n3; _]-Ğ|жG\ )dVe# 6WVp9r562xw2/݈Þf4vr­ڏP(kbWDN? p%E}Jw%/wzu#P/}<{*ÜI&Ryۜc\bo-\'v߱5VfF!DpOLj@k#+%>ZɃ:hYF36Znps82qXk, ak򌞨5%s6%Te&%#iE םSPv%o |tΑ< K[QLgQhŻ0/d mZ l)X~ U+W5Yrv}*]@ E4Gy[|j5J wɽѕ~Y7zmIe9x$qz Gn >|n8}Y1dRv!v'o#X1{hkӺH&N'?'K>IJE1z_-?r i[ lOvAIARs(&Dp?[zb9P7x%8\Bj w,'u;dNmLg^3[ykx*-fbd[Ϥ(Q%eaȵ B}}ĬwD(SMQIJ䵒XOÜuy_OZ6Y;`˽8Ln6p|R8z:fS*:FA}2;ۦzuDCOωAdhq5rnOxRU Q`%ȋ=lI!vMHDBC\$"PEwfakد Iݱ-ŝY`?4?eB˳-]7Ez⌹N?6#jitW\Z'?q򢹺G@ %ˋORSK#jp5:*m+\˰lsU{<\(ߙ $&sFmj$|KK:AnM * jhOKb`'慹C1OK|%.H2D'6*G>Xqҝ;R6*jP |&ng&/y$昣MENqHHrǏhdt+t -9rKq >Ei-FR]L"`WLgL']m@4X7K,Tj2 xsx| H&nS@GZ#Dk?Tpxo@HP >BW:ʑX3i*Zj!T*楖i EeҶc8F8^]8=cVq3IީCC?⫅AfWp8 81q \"}悋(Oklzaw'e^}!8x33\Oޗ>B/CRfm. ~ 2/%+4r]yTrf'՝NA^9.hsl ‚Y/XqW ͸KFBۋYfHI4a{]@%OxUȽ0WvҐ=>4 XKoa'l7z#uSVHvfS6 ARF:%Zn^/Emi٧js*ohB$3I@;@)NG;@fg-aG1o8H[S Xg2~>紘x%&XR7'wʹj~k8[T\2 06E4lg/Tb1.8[_fj x=S{ƘB)b@U|4 {o-BK]ZV ;mAbƮEqjC‹tv 37, Z23e?1&lYrXNjz]ˑ|/S@|"gspP|/ZE2a-C_ gSBBYՃjUUmC |ulxd{39S/XSlj%!=g@Zcn<80ŀ}J25vFg p1S\ODWLFMl[@NMK2|;2|"_LdB *_Y_zx78*ReFdoI)9%ZbmNϫQzj'|h\Щ^da.Q/0o@'o$)m>17+ub2`lr>6V+ɸ]2; 3mlgtԜs#G011]H@YnCeL+Shk,]hBu3{oW-YkMg/3"V^'s]KUDNMqe S")@~ݗAeʷpZ9o1N GU Wwqe,fȦ5uDs Hwa9JA:ed,ޠ2Хo57`s/2 >X*n: XM䞍+:":L6nlQ- fx|ChKP?yp9YFeòA3H+#Balr;pZ᭐n?֞5~!={vT3e}U&LX׽X\K[=Vk$q Ѭ0)*2QL_ܜ(ZXv6X8K;k_CMN(w$-BNmL\[wJȅx&>ܞ2g%|ZXvކ}HFj.)2h0;mh2 $6|M^c[uɻK{.#$vӀRֻCr.(-7X+Ճ)p%?Lbmޥȗqڒ$eI5|ͣ (5g:]"trJYM3\zrbk Y.=w^PM7BUf_-7Og;7A#FςY`ǽ/ĵ)rܸqG})$\ S8K]6i`4!gC톪 8 go*4|: x, Q ]2F(/b ֖{ur$깾Bmhik΂-?_XK$uPC)RDIe7a?`IPiYS1e 5$mۂ斁_͒A? C9, 25t)0ԋ-Aw }-ڷUl֪plkQRT{fY)9NτM( rm7!BS){+0e_VkzZ"rľ} MP QA=TnYѼPo!s(Y/w<+Lk9unšUU0YwzaTBi/:.t# p̢{<̮`gSDV3.^˼ٞ^m ]Q?B!M/{#UįG(:(b󾵕oH{O$odcb{> "WؽGH?[e6b7K78#{'g/hal , K Re%62S^tu2Z#7@RMuLfϊco5Hx"Xwy -T$G<MMm9TH7\Z 0&>*G\p,Z>$%PRp@ĸ_~_#Ժn(llK<[z7'+Ps_M5d#C:{rZ|> {cn]Lqh2tlXB1'Z>7(M'F|OZH{|y6tS9[iƕ{ A{v}v܉t؅y0bzP%h셾Do3!&0Gi] G05O(-19v>+d)rBG`kl>$g mBtT3C67x& 2cR-J*<5މ:n sMa.=FM sMOXqi%#G@lʘ0zDR>nhw52N܍Bdzu$`JڰDtWHX-̠&b[hƳJT- MG]lܑ[ktqT C蚶HKwq~huy'xؾ={kcAԼ2íH}цkW=L䟛ңLbX1ha_Wݳ6Jp'o1]BRLglJFHgaVfJ.Y9cVN u&SNӜ~ffׇ4eK_xom"7=#@b[) 3 $ô߶pN{tCGVe|d.^T/- m.ݸuC*M,u.ųpP3M^0Tن2sShŸK^TH3L~\&)%jF?UPGUہu1MRVM<]Ȳ3&HKfbJgE$e =(G櫓kV/D%@$<e|PbD(jg"8SYVorWn$ϊP:`gkDƠv,{x>62%x:əif-Bf}Je %@Ip~"]ʝg2LzAOq lW})R&fYKZtar7xSkd_C .>q,%]eU0O)FnyaC6̱#7Ulwo~#(BzMe=KM9md=Q'קӤ_CMB''yQSgCBB秦|ڭcBUOPQ%Djw`I$׽aHɷ~,+%*G{uW ^'^y e[# ԉLkj㨯z07߹ ȟ q>En bv`)#ؐ NOǐKM;C Ǘ<%*o릜``X<%-ӖGJW0VAG2۴#Hhl537gД ,vrؠP L__{tutso _bWQ)U>2jӣ,oEˏ&KQvW| Q"^Ci$rm"QF#?mU*O` y\ ~%߿\m[xmts[۟8>ZhV7bM@ӂċaY͠3B{IW7*8W$;AȁOcH[9Y\!}{"CV{ bWH٧ EZ=yă;@n1RΦG$G/ ʣ@$= ޕ4$' U}'͒v-k=%UGrd9BdPaqع!g!n/>9CeU^n<9q9>6#̌f?At)/m(Ԫ8rۯT:?ykB x4]M.@zϨ,9ci߾%u/quv1uAַHr6%XTW2/+=(zSڀiD/&d*n9 &3^GRn }e] 5Cۓ9`T:`D][Qqp)/:ߛI˅NZ; {(y UDT}v9cܐ24URBC%u7A[l *b2{bf7_ѽ/_qWn'eF("!ˑSC`V}ZsgзfǹK9V`7͍?!b 그 _yxOlr}[$v-O]+l/O L#k@k>kعUY٦,DZȬ G >XW_ zH]TZB{`ug/$68:po7{&rCtL3n=47v:x' [ylZl\yl`vb(¹fʪϖjs,L)H>ƿfK ԛ~!u~62XohMR)ְgo)E@E'lUη -}rޜpM 8y占jj۟*+^!9 d_tVfBm܂.IhG8|\b]ƐKtإ+5psqF$O>.ez]$@vEO LI^i=Mz,pМoA6 7kzf%VZh)E?ufp38` CWN&B%0JS2]Y3ЛhDX#ؖJ8J;D 4d^CyUdIBЌŋ=N 4u (b m]8&=BݭI{ɇ2x +%4Ҏ u.P rmѲ@ EPNau%9AT+WczVصk`D9KBSEv5pza ״j݆J+6՞Xt!ŁH'<( 8G~.*e ;B76W!k76v{/nyE)C+sF@k`vk?Fa>`<8kJ 7gx¶\?=fX{zS*@ǔ>,t(xfC2&$J{59Ív> g*4˜ĕnԔ6l\_7)X&Yjb֥h *}kKo֦inٙyLeGV>tp5Ow:hSU_K<).J&*JOO5ͽbR-:r}[1*">*dhKP_ 6obC9ow~H4f©ҵ'mV*u^[ ۺz<2U6'E]"-;HO?H=MQr*\,"~=IxDLjG l!TʡLOEܜ:B/qmͪCs_HPu?P| Po!7V "^ 8R;.x+gm[,byHQ.PNxW>F0@M.e`z}Bֻ̅s;c4|{Lfh:[VLT\bt:{@4~=%vCTftشF1%p%AI'l|GDVgq9/6մ Z)HXO1qA}(G[=ͽSôqa/W%ܖO.Z oCՍN^kew)46.xbȍ2aƯ#) ŐsȔ}KOB)٠Ô=V͑ hB[n!ֲz[~l? E1\^)q|&t2"a L K ԙI~otPeK_Ō:[#A+wi{7]J~p:C\K]V1ث`!筓s@W 6PE.?p_?J/$ǥʌO@JNZ4Њe`n]6ZePbs*k@Wkt!Fe}̩6+3_CUI<*fupNM %*g(q#*aٽ|xH&";b/E)[Ф/~ Bl_82[)ElTB)$2@Tvmj|ޖ+рS>jA=|YyY9 ڨLũUqޡa-`L*YoA0yu:@e k:WMV`|8 wh4lq2?B}*LNo^hV8IP+!\]~~ݷ(P IZRD0XkoB{UU]U4w0\UP.m/^$ֈk^m(6`s³GPྚ;>ء"[55l}%Մ`Ŏ:91pD)/++]ڡ Emc]Uֿ :eb|v`yh?{Q3meK, N褻lfc(798]V=n~xvT㺁D ;RlbH,ϯ%^]:a?TF28'iJ`ɷĜQ9NbZZ.44a]iF.ߩ I5YG-K ~tõ_GM VNdޢ?(-ͳRήJ8hl!rɓy+RcAwK'4{mnYFT0N&g F}:4m9̛wK<@>R$41**I\wg[93]UA?4#~ܲ&1Bےb܊* 3{LQ%[CK*{ϪhgmL O O<7mRA;NcelQgVjR.:ʱdjTHn6̮傀zd"|l;íoiZf SV'6&%@")SKV VD)"Ɂٝßk&W?И,ӌ7c_:SsG#߼#l·Wg N Aў;V& 7L@z5.$RINgi𧮱[|Xj#D^J2$z%+K!+V r0@:[x*H5 Y5@lY܍1م-s6;1o"Gߵ,9ew\IZ؅nteHֵvO3K} ցpBv![s/LɺF@>wrT+bo?88 s21} *HhchP3 XuМYƅ{ab:R WV̤May6uWgCmjwk~!~ ?aT qZX8Q5.irgXꔲn<,QwT4x=)hp J,.Wm?buШul6GT ;6P0ԙޤCmՋTXcW83h#XDD7L|%bi (ur&Uxܤ򦖀񨸔+[Iqaj1=+y:gY&+)Sbz~̑%9䢼05I}g\k;3o4HtzBF+ +y,(YuwY܇G/yi(!L}4ߊˇ$KtEGiW e.%0J}'j"mTAw H}sy=-*n6)Xafl7*#Cwž#ۂG(Z^@A!TE)p[=aROjd^zBvw0i6hw2t ,!ߓ4_*lG'ɊQ},3G~{SZӒKdW<j+bs!!"bXUW/c9|R6-VqKy+Lea'5}t }[oѲV#? '1HYKo̙-l>ZoF)2c9͍ހ$@Q|f:*-@I!`boȜF&[ ΜPٶ;]EX&[eϧS?X.G7.U# )ޓe, kvg0[|Y}E%ܡ`Q0̍U"L~pJ5hA=Lx 5\/ۂ;`Y\K¼Vࣛpn]k3lFй`r[Z9ЅN%[W C"cgJ ǧHb"O-Iގ;gx'Wm$'F[{L ЦH dE(#PnKMJW N}z79ߝҩ3ILO7Vn)| VB:KgqhI$z# y.#@%p &JSoFDtr?GGũtݞժw^jy4# e-Qjo`,_E ػ~ð8DT7_q6c q}-iH!zn20A/ݮZO(/YfF`$$}Tp< كaTulj 6W]jd]ւ`ڞ7}ހZchi9]|b(;c#^CџPKMktێw&5*˲#/q#L$@(Blo_yxNqVqq(e7\^ᚐ]y~jκ3,7 o(9>D0 dҠLj8WOU^ FLl//<[yO?eSn 5߇`wi{y?ד7#JTq;eLpPVE֖ iX.\U OR a6ݕ8N@ in=!3qny-Rkp߁p ͎{LuF8*LTne35C *HUK0 vў\J۵qr~֖Ҡ#:J"jŕ)XpHS!ZX`)ϷK9UW|W K z'#W%Q2; ՜|!]h{OиpLwT&Ʉl͜n\^=gȚUUz\kt\Y ޾mS(MA̛Kߢ̨uLuk $AaHNh6 kn}bSBc8&Ud'yQϚ*eil $ksOԍo^[}m0rt}XԃH{Cl({)6\C۫XDmG--$2}o/vf<%rx+;.{hS)HF3KOF#p7mTtg~J%čIFWbl(GdI#dIK>"R6A1w-{ӽ3ROF T`&k84EޡTDDk$bn"(F\*`Ui ɔ bW&ᱳgjw`W$X ^Ч1݀Pb_<8$8jk൲h雄DBA֥sUY-P>}Vk )Eu'9O\6XLI:so7/a'#\3E DpP@6⒰Ε p,0@xyk7-&Vc1erѤYi:S qlO+Hy\ẙuVbܹS%}!%PiٺW+1l2wpR2J;|0V@~͑~`^QEq&< R`V6E֢C.)SYɶ^ ٟ='4gNF8)a=AH6,SdT:To'b|iù15?NӿAڟqGpP_aD#GN݅᮴“Ō=VЧ% C>H7ŵA'=ޘ| TJ̃c=WQ97q*}mȕ}ggbxHC+jKÇticA1Eg X>]Zᤈ,dY0&1EIx\dy]FW\t)1ȰpOD+89!^ɘL,BA0)/Te<ݚ]_f>Kۿ{Dzcg;)h\\fV(b`}0-Rfܶ\Y<$wFS͟KI]Ý\tv4\zNPi_ 'KIl!WGI7U $o>v=L{h0|M^ɄjҜm K'4cw2%;31˴!^Oz[6QOgF+ +] oZ5(:Fe{U8͂yYWR<.k b ۺru_[~.ek&FѯߒyGn(j_T׭֑<>w~Xۢtr !5gYJa[ڋz͹c-I-z}3̻V.dFE5˜ҦQkqtA17w~Äq4h(D?l*kU%Lqo0&o1wJ%u‚S q15R#2͓ٕsz_<'&$' a+ j}{:k;Sb;gIy`wx$xT}:V]ļo f=X,Hv0L6((g+ZuƔLrO@9,MZq͗K>Hп8;HCͨ8&1a&O*N&]FT}Fxo=Nǐl}Y"~}oX?VAyza"0!끽wo3 )aW vp~IZځ1&^ c~%n'>6 Aڕ- #%r甼UdIߓHB x{<ڇa?ih.F 7eA4G~ףMnq{ Z{taIk]^!.ZOo O7{.G＊YYlPvL(WĀ[N4 =`o(ʟHuXæb}V$Q.^T/]:u HY͆a?A*puN+6 209qVdtbǑ Ejue+:icU2NyI7Z<7=sIH--xBzOBCɅK!}J}G8Cɣ~2fWq_>R> ̑嫴xSbUs?`RS֚/7d :u=闠?)ɊF#ɠAy'*2<_˺*i^Hkk4_p婬 aïwH>-7'k!G|[v;j t)hpnK'q>p˃vJO8,WSʹn$S=yS` ~nӤڙ@jAdIi17>5Ey;dG~L6:x  BZ_)I)t ZN}1Ƅy̜xiSg&WDMVb(Ϋ:˳(X?fLL:}Wne'd}'络d%asźj+9Ki'/JЯlX{O!:~bw frE>\?#{ &6>#C+~ހ7NTe~k9XO ^ ^Y4}1 O&aE㕀AJyDovbMP9h뢾nsøIɊ9::Հs`ɿyypNLʒY(w-+J/lኡj'3NݝBi8a$).N80 ȦTC.FK96l ȪFL1 *U|*dNBmsOF Bs~!55nmUԗ֖X~kf8g=X>6> DBCTnof}j1vH2[zũz̲xF3=UMk 8]S/^ kid:3r@ "-NI,uʁ2LEܜe%bh=$呑'~;W|gYaEN 4D'nP vpkF^k 9Y(b$+̡eė%Tke7 `*5_n},::'r26]@vC!Szpf֐CZ#QrMAIB< yZQG7e 7kXwR"{ۜN5`M'9Ry.t/CV|0z0YY2i>NdI1dWt\Ss%k5vI'S;H0 LZ~t<-߯$3bLyuv-+ɋN GYܘZAFAk 䚃@w}D9`:17hy42 HW;z^v~!k7,8тeسHAvdS|%}>@?y &S3p?1ڋ3W%4YEmejHJ!̲q~ GǺ2yϲSQUL26uA6>Y{36u*F%]{p@e1J BPH]zgC} P!VSTaV Q γ]+{4x9RǑmg:cNjh?ѿ>)JYyu+dz6j0`(qE&sVgʣEQe7,5Dn 1{]fc;EzxӔ$n40]Պq)VKh-̱pؔIKR)q+06`]+^~baj΢fd&ӆ6_?AHkHUBK#"5RPIXS!}E5"M&xseWybR>Wy-z9C/fa6d$d$E4R>?Ȓ4V"}{u KNc ,ɉf {7}TDl}KM[#!hL_Y-GE%6XϠcA :ai+Qh\0F&̎t`F( +l&u )CQLkᤈҷY3͸` KWA$PE`lS9 KY+rY1viyS_R-oŘ{yh<66|gaFHu%jg&3zî9*q~+{H0a/FDR=`!@p'GrrD&PqN;J~CGĠ>Mʊ$a]4fKb1lXLݷÊHv:n5r >HyMW22~PFd2^ Oq~gҕ㶬D@Yo3uԵőGcF_ WrI8V5%o~C _T;8#p! rM1N0 ʛ\ QsḒSjBucrw+(@|26 ;i,ĴD =ACy BRKXl<]0x.n<{@يAl}"bӀk(If,8/Ut5O;(,[3[c3mu$Şo]15;aȞ_@:["e #Zs;HlL=-oJ^=bm!竓 <IdMA'VEXg. ISlмC2(܋ЊBMӿEuǚYO>kU(х)Z נͼe!I1F[Kkߵ:jGӔ$aIեnSc%sato-KuWR#B  F`a' 'yױckOV-W]ܛWÓ-͚ v_lwW0\6ЍawPl2nt [|qBjM͞Z'Y+uW~!{,-t2ճklXCJ;,t+k@n})cRVfE#2د>x T[ G)X7\eZM<ߓm6}ͨ ߗ^zmvR9f4;x&9!IEjN@ل[gWF~z:VW{Z"Oex6αQLϷgHܱ]7xL(@Z-,ѵ3-%~HOTsOS’T#L@+pNά?u3ue8T%& l4EpQ,Nw@̞DXEm2+a ((T|NC=-x4 %pф d9T ga@>+D3~ Zcץ/\7}rȫy0ƿ=#d ~%@!r3vlE-H7qT``Ғ~VeE.bf 鯀z8n 7@J|*= JO[EjQg! ~uoVhR_:bcQz]$ܒ^aVb’ yDq'rC1Cf~yȓ@g 1 qdfX[KOKݗԙ3 .Aa5WGWӶF^RWd+K:{y|i#sX_p|"SuDr"Ll'wЊ.ӖN4*kh4ii MN#}m+ W<`̛-ԥ?KahAmD10"]ޥ̽T:N!R V[2{'s[d4~s4 3lvC[w: OWp-āP#|M־n_<Ua[a |~! p\gfMxhV T= +s? *\Td| >, h\r|ٚBAžRGqI ̏bB*2`X\U;c\+fk ]ʲcIUV4j&r8dXg0@Ṅ|phL@B| ܰXJ\HDuUIwÈ #eGNq92;|.#DTW Ʋ2<{=4Q\5FGq3ˠqw*'꛽Y7q2@v؉i;cvI%> :77gBb1UR1יG(s1NA-k=wCCP,"2-io^Pn_LR}(9R6!J8E\*qg-w՞KR֘)ھ/>.(p q0-΀%8@'C9.(p鬋YG櫺VdrB͚?#{5G np;gLzjD< &ǻj+L}Oءƅ#Zg|"֕jQj`:WCܴcZ"Y^B`|z{;wU.$&!ᬝ3zҗ=oԨ~Slb2bI`;=e7f%Io" $Mq%-Ωjrˆj۸/s.B#[me9#v8>}As%AdZ%i&N\Ŝk}pQF2P6U\R.IVW-y͊D 1v9-YJW4,$3>$!YdvlCEW4'sϻpju!2;c3#@A{H" ,^cp)iAj"{eO00\kȟ[~$Ue w!2JY]dn=5GB'sαk@ܸ/_bJ&3!m,y|̻+ve˵>C'(E f &̃[02x"ޏH=k!1/2EM3Ng EF_U7EeN]G%{!* 97#6I-inLbK[z`)sl7gOмhr*xb4G{TNZ[d\+=r5 X3uD)zSs67MAi1DK`̺.NI7qEcC4dt}qVG8#3w#h O6QhW qIxg}, zdjXpg{_v5$Ul$"l+ak^y*Zu(}Б'B1_ ty, Vp+4, 6]uBO`?@ozEVs)"WiΫʳXKudSZ_P%-ԯNsr3w5=Ae4iH45Ҹ<</vSBپ%]^_f}=+#d?-ٵ4`8hW=SjăAvYeM4U,M%$ڤVh|n2Ltb E8Ho*L\~M$(knXΚe.}juOѷX>RmVceJF(ZqgWUۍַ8j:ָ)Qudd,dFD W$aOsD&0\뭫Lzuv귂-9hns2S9£^CQ Mw 2+ N.) xp :DͶժ&A"\N)㱝̞ ' ;D=O5BЙ/yk%Iyې7k&'n9(nd_:pgڃE&[d'9|"*4x%+XC 7TK{wxC}!ucOd9b>[wӇ >B,&ܗ>LtHSSzl8=;MC|УH";'u6"؉HR6^uEu}mnj2S>s.)mD~D$.Mi1 v^ǵS@Sl fmMH5 a>@H Kf7m]2jnWO uh![^Q ߗ%PĚdW<&FcڲpzcL? Vm^HTo/ 5r|.&bP(\}`ġzz9Lv%7M'Ta{ﮈ?y,)2VGЬqu#dqƔiXRh6>mE|=eNȣ)3CL. ^Xw]ewFuk!9&ӰclBLE֯)o*_X}L`%RcdZƬwtZkbԤ$W=t6sc!}y=nqXJJxjQ*$ Ƣqy}VZ8Zey1#Lc9КE#\( G;Z\|@uov({ȗB\ pɗgգV  ~ Qi AoXn+j#g7܄χXfe|!5R$Xu$(ki~ B(z%Ekqp֡*`[R0BQ`rRn5e'l4C8$J&K:Gc;aTɕgZ˫^G{l4N:ǬwZ)װ>IL Ԏ۝dH'nfk|~T k"׀DdUO= jeDlA]c\C w7_7!9LwK#ڐ3cW;P5bC Md,pMA釬V||1 i0iG<*rb w4>J1u;6Hܜ/G]^kT)흂Q0[kivue{X ]7iJ\btw@xnCg鷔MNnD䚾!- =@g)#ӡn&^{'|jYiQe1B$$wMHp:k#}i^YԆ `e4u[|/\e)弗qKm 쉇vԁE`,&RXk(F/k{b]{]B[x ?qS+4q楒(x=:P"sg8,?gJ{% 8V sHO/N:5|a="^4m49,PdGyhv5nϚ,)y`3|C1.,6s$+ӳƒuįKR!\<e~DBx  uA-ilhog1Q|WղHM7m5Sl Ƙ[`F ҋBJ(+T̀4bC>:C|wZ y; FgᏑԱ >-n"ݲc⛩yCT|Qb樊ouwr }uݚR&8YD7WTXXPy1'Ҟ>QAaȋn^C26d AtHì`?<=.B!3FJB K?fl'%#,q@oa[J–^oKaid$S? oj&%jN-i[2M7N\#'H%ر@TRAH ۾9BI`AY3wʘ b{ uswnt>ϵ6Za#smHC gfXJ=5Zҁ{3", ]_SBII$ߴW)OKiq~{ .ZNNf_Fq7:rB3m̷Z\3KRMSG!4 l-BV)]Cl}Hq=n-L-菂 +"xq[-8Haы-fbG'+Z7.Ko;̓RΏ!P!\W-?Gz%4IqAìZѱH@W6؈^Ap[׈MnzFFtZ8GTIgr;۶0@:!XG9Ҋcg3uSpQf^#q,BuaЯdc yX-Bq1 *)L1m:e6SYq Gb\g>ۘMb<Q6CGIa萓q~WXD^TM.4\@Q#N܎լ AOqsvX 0-B:CRm]]n U.Tm;bZr'(RoL%˜a0-go*<;.lH'.BB7E$bE6 WRφeB8Zۢʘ- e``ѹ&fbPN stT$*Sיr㖝}̱bM5?¥w hCfC=ҁ d zE@߁MQ##a^L Z~7>=I JfALҴJ@UtssGA- m!7CSXZ>wBgA1o"}mmA"֞f!2Ѥ '*Ff3]7"OeA1XǍ%31| ]?lDqNn,qo LgH␬VsI{La47DxE)] #]-;"'sk[UQQҬ2oi=/t\o_mJ(oH5`Jv0nѡ?p<ØZ9Hl$`x_ml+RZ: %@T~ƒ(KYbJ}]Fp:ۙ+QN:vSǧnW%÷8d+N 4≻QB9s(r4MlS: ֨XN !dwc٠ZZxt  u^l"o;#Lp3Ս_/`m`0ut2k!߫P6ڐ$1X!>.@l3$"}Yq 5Pg&9CQFܦl* q5X\%aH<It3#it vz9{!)uBA|˜.X >#2 *9 > ,ʮ`⟰ Z}g<|m0[;d@ݬc_̀˚ׂg򝴺[xjK_Y*6'Y%Q9]GE+Q;_a^e|C: fqZSc7v|l' E*'kX=«r0>KM<fhךƅ)ï6Jl/+}_vY/dUQqZIV]0֠ (ͣ]ZJA*,"dLM/z\hn7&Whĝ~X"i7 I? ͨh :5epdy^T+LUƩ6kD%Aҋg.vH摥c\ RBDj0KVX:I­LJWY-eOUgEX%Y\ANYiN81V8T'Z欻HS 1s e~6iGM^y߯Ͼv\ܟ\ctU{ luΒ< %~v.=Е Z};Z(馢[vU;5&hi*SYc2KaF\nhxg ‚\/ 4)dWb U_rrLRdVإg3twړm%1Q^;~t!z!S\>YԼiF[ޓjfonk[}0 Ud`W~x@R}OЄh/8l D^s\%$)K;k۠^ +ܝHdьNP zdSYpX)u!z 1QlMfy^@iqVs {2߂b :Й6 8#F8/(8/:AƆW],6QebUyݦz2?^WsqI=MB؞Z|8'_:Vy#Cn\Gd*$s8B7@l0U!QW$6Xfh'OS=5j_o$|GC)I2̳Q?QWJgmĐ)YoE|n/gG&X)N1e3JJnjdCpRߕY$~ ~ EDB|}9KIXĄo9#}ﻡұ`Al>լ<:P>ZuʯKr]Z{GĩnyA_ Gl2 WPw62ʡK'z~Ё1r+pf* n28xD큸-.m(xc#$g~OKrOh'%$ uxWèvIZUKP8 ,<V {Åj BC jWZ]~2ɡ6J*Qu joh5<]rGg[W/hp) RWV*|Y\-X>P,9Kdʛ)M ٣m).WN9+8ng97ir7{%v+*=y<̄|*e{߽Z)&,1(@ FNPf]=+-ʄj9;LS0w\ DI O PG\@֩Q}CR9. @ʘCg~ |ot8Ư͛ ^Iܡ(]۰C)I 89 'K34"9G.w]{l vDZ0k/G 矷'uil$k Aa~)@uO;'_.LϽqCX6^Vfr?W;*;6(0zi?NPDq.daC=q1rJ6\P6 ,|sY'S' k,c<\G{Tnyea.B'gmC{y22Ot;::[i٬CxoiPܿ׋$6yZZY 6IRb=cE/╳G. O ~HμkQm2+6hvYCmK슄w]%T!F[N'f Kr{dx7RzST[(6-YG _[Gz\o Gs06 f} :6q=;[K6EjO/sF&+}B.r!BnpcIېDpU ltؚf,V$6o:؇KʰCD!Pes4{T6/$9pi{iASq!n2!JV[s¿NWѰXӡ5_tpRdUO|}kۦ3Kn^J>^/P}̅ %Q+Z$R-Wa*;QDx\f %Q"D|YM]n.ějAD3ـQΞ\97d?? S 3/WI@t c)PJ&}-j$V!nbߚa#Au/BvUw_tJ> vBWcxVޜ["X8Z*idQάq},t6MpQ&\؛qYq8k4=m:0Q֓f-"=go.'k{HTUf !1CSΐ Kn\ʋjoK|1#i+Ld[O.{>n=Ƙ9ؑ_JcGmXqA2d,R֢bu$f2x{/W{̋$~;Y]mJpwrc{]v\RPzIc_JGP#JV)Z.}R2 ; ~(:SAnrWuXkS:F܍,51_c4 3گ'# Y?Yg6\Ba!M͌fc.򛸊\mW6p5TS "5im#8$= ǰ>5zC=IhξGZW,4hu_(!=ls+ј&.V8.h V%mOV\Mƶ$vaR}UDF;NL򛾇Q~ TDĸK7YA9E= xJYm19`ChbĂ8`k%*%z*#|drEs~k/^X\Srd(W vmo6$bh8ԘV E[Qh'?o>*N+fzzwu~f$q6>ن*qJK{L]X~Еڵf\4Y8͖_*3 Hd#r9d\0^nAp\WN4~D' SwXRgθc(Co-N'ns_NRRϻDE HKM@ !&n (dCOg(A+rsV(mj.ɂoD&V؝0bh]}ko dT:Xw[}ǺW.!Ǧ=$㿊0:e Bd-O3ݏ'VopSi ]u@-g9mDĂTCi,'y#Ⱦ, .gС-{ l7txLLðWBlx{M䑑smuLo?lltzayF{[#+ӒKn1 .` QdK*lvNE0AU~&-[V]qN~-(ܹFxsrkHOAFRYm䠼I ijI.\}dD`GR Ԯ'5kf ,|KvZfw /{359 4hʝ `VmbeR3C׆ƀ*. UbqNSgӢ S!1bVN0btyz00c21X_ A`5]=r:q"F,D 2k0zU[i=ĒN56vRbyma? PydHWi*z/`PK$ R-j{_]Zqg Y~u,,ڥӀ@T)L# gCY- t !È~#}:ǯs#JxDLTZφ䤮bm5|8=&bS#M vw.@Tp} Jlhrޟ" s]p[_bMx/EDŽ++ V>-vb)Xĸe\Y1`Gkm~un䛉UЫֺ%MNi=zN8olmdDM0PAYDS+߹bu*,&$8adڔ]A7oQ9',+wl'Q9/ӱ6J"l](ZۂZxr C@woy9G WoTL_Ϭh;)F'meP3d+j`ź鰌k& :z&*(xVk ^NOg3RG}87r;>Ю b6(v J\qdP-=Fi]?c5RA$/91U+T+Fj쵴 p NRVUAVEլ5{/=C,W:A^D|6o &vBA'G71ÙaԸV8X]tƷ߆acskH(ߔ:BD/2秛:LuP:@&YmK.kPUH`7564ϛ;5Vn32c$Dv |\g5R,=``ԀV`AS~S,@A}GhIeZ n&PuI官1efP 8F%0L0OgSG6`p0`*/;POeCoE@ X8]%4I"\5BB`"L.*Œ$,)3g]"j q&+tNp=F$XEE_Z9 NwM̒D*p *{'8s_G*yZ#}:n *BhuzVHd2|j/?l̍ҩZY~͵EhM#˼=,@,®"*݀=-̍Džd,U2L2k퍩]׸kf#ͪ~w@v@-{w_&vj\4|F蠗/CdX7F LJp/mS= 9ƻ@OTV*H#H9}zU47FOZX$F1*>n. }ԼERٛAeސzGMExdIжz >ٴ2-(N 覀ܞxJ0dLf`͔ɨyiSHxV*'72]a"2u(rH748QpSj:%"$ { T굼a ;T[JEufaϤ\Zn؀6ZvW7⛵ݑU6㯫*:VJ™҂0χLOP(eu\ZGaQ[Kѻy#];#%8Ac J'zݠI;X\^DQ4tSWwQUdT*"{2O'~py_>w:`(n ~|}qJO4o㸷K?ڍ',j81C@pjϏGmf#&!g']jK^uq\xBN "!L (51>ʞck^FN@sbXvC&+㩶EG#Ga<|._E ȱQU߂6Q]p">9a~1>#CwA`t5 i #NM`$,9Ȣ@kԭrYrY-nD i-{hlLM/"PԘ@i rA\F`84i~V+°@-CC;"ҴZ^k ڮPQo46I" SjᚡbsXNPrƤ=>zO_B1ˠ7rڋ ^܈:y@x.Op%NJi+4'>oR%[ ҕ%|jh j ׅG/%`;<ɒ_Ɠ )Q!Xav*+CssKWq/n {c58~LwS !`AyNzy$%HB]f1C>XP!QAťt9TlP/O\ndUs,s͸QphT#̓:cqwd݊&ЮKh s P12&}°Op<&:x# [ג&ךES jlbr=l_ۨ}`,AE 0xn4ȠnTOL+t+r'odTppJ/-Ь;Gç:~LU?k,l&X-gTŀ !^Gjs6v+TqU g_Dk#1Η}b_Y^YEߒ.#vҮ˥US'bOKZb[ܖ(SL `ΌX]j} ZSÚY@Zː'LcƑ/-OK;A?jq\w[xP0THq\,Vbf!0嶜;BhIff ha8%jًⰾzQ3\Jd@/RpD)sy~sL+C[=YiwB#!D=py? Aa%?/sXH=0/bXUO}!J%JEGB廒ԉa~Kmt];ʸA3(m~ |l ǧL^Ȣjo"Wm"cG|eLW4q9Zjų Ǣ)ob85o+u;p,Y (fمNMϋ[]bsQ@ - kaZ$tigdP|?*QCSZE+]2,Fv:[3<5`o HybIhȘi w%P~^y!֯\! xWd~Ly:3q,@k'S藷Vt,x3*3Yf0' ݜx x6okѰ&P@R<' !"1 r~QW` BXu"lek{Y"fEYx[! kk.O/^5qR{d>nK0ɐy6T:>(WG CĄȭ k";ܣe vW3lw@?U]YM/Z_ޘj@K7e4IUe۳C-A}pPpOnᣭ ȆgR,~qT@P/bxjVAZJ򒿨ƻqiz=dљ]ݎBm"G'w &d}G^2`v3 eEc~En`Hr}h3AaeyQW[𹈜'm_UDgoj}'\Icl,ghBt(X@mcNSQU[nYЄ2N^0$kPwRëG yi Ȉ(-҄,S>-G&^ƋOc?jD:D;VVREbF03yLU~wҴ$'!ovV޴U7:7I+`vDR|y\7 WH^ ԠsRC0}ӕ Zg70hD: vjN|zJ^qKj5LD\hjA:Cu_]) ~C$̵5cmG{7xE+_H)vd~$@/&n} ,Y wn]\{v}:ߢ3Z"ke=5?D|e5D-lHn AZ,2Bc[6Nㇶ3ޞ_B*Sy!x{rm+ n%ù|Ee%=M^'wYk#LZAPQa"Nbrco(|T |\{A CbCD>Z;v̦09lPISy Ҁ+>wT/m `ZӴsFsyJߥĵ`-B*u֟f>p|tR>DQa/U/Ja/aH26/y yDə^P?Uco^;($!U2.-~tf{smTfVD^D#P#F3.YSw`:'} x2IGsg+wX.T8u|M'hV=Nv]m$!lIyz; _3qYV<v&} ֍Y旤:h/Z3Ǿu-zWQܷ:t*De+a\D0}]*oSQmf]p8(2rr fb$r`U΃&tk:Db)%1]n;2S8cbq{zJ2q(ɤX*=dQ HI;AAjbAxZVD[5Ψ~9ј[h1lO;d8$?LtGZvoÉ.oCi{vTH' nC+8V2|u <(7de$!!kR%O+ji߇6.YRkl/5Nox}SeW,Y99l.wя`۾DGx>hF u`\9"` ξאR>x@y"3 eIym]-^hf;77W Q1UFꗬZvVA4g@45XaUL"%K8|͓7݅$Q9[Iʰ '8PUP=/84ozF1)QS3 Roe5ZIV) Tip|ۙ w"}û]R"Y˓ZBJ?cx)<g {N 6A(jgȄikuRA^5-'߸Xv2Rh \6*HQTS;GS7N2 8-qkJv%%1/0:@?W?j< L̾@-'J5ـ AYT2|gGה!գJ.3,Dة)鹟B-~)("f޼FUBޖ/:փju`X W@t¢`!kGa[e@@RE"(Dvڀ<(~~y9:RNC0|kegp/βs$}6ڋ %`[^UXF \p؍bXlS'[[m:}bK@Ozt/mЀ?` ry]z5V@:FLċj韈t&X)Nޮ{㊋f!`+26yZY6j+EFNٌ6v[i [^mj`@MV; e +a_|) OHńe}AB9q)@E |蚄 G* uTКԇ[I 4ߤBwe;e}@_6 Q r78=J$% L<} |Μ>RGx/(݄ڨcB0D'Qڧ6O?x+"ڿq8\E\@ħN7@b9Fk䃲fD-U `` q419UXm,(C?^xi*tfpYzpݾd%}Y,byhD@F>ݯ뛬 л dm,(K'=j,oV\SXlE|P{SiQ%RoOf]_dM̯ŏLY=ఄmeSmR`ux8-;{:+:I0OȬ3Dd˘ö́s{s\4یp{YVTͭ4qvyG朐)J_GgߥшLHv3 7s6lـ*4=kg ePܙ8;.,WٞI'S8'6>YdC KcnU1>dT!6=9Y> q :tX82NŜ:r{:Ly*Hvc(oy  (G@"Noׯ9 w\yz(NK"Q6^6{2`WdB6V߳=Ak4QݢuG7m qĢL}^/$򡵤q*Uڭ<%gbg\#6D ' v.!'SҗJ)G|.=MBlzmIzn*9/cy mr>ҕ:Qi\._Zpk(. 'YΛJ҉xߏI̧>s*Ku U}R;Yx9_O /3is~3meA},JFcjPh,53-D?u7lj(YVb ӄVuы"8ۃM#:`>7[֑@C,솏=UGl$ um! Q s{41`BAm2r`@Hn:;|HqOrK{(˳w)PH{efDo\@s>h,d ޶Co+V~)Y:_! 0`2[Or7Ml2Cɟ0[sάؔqꘊl@Q^Y2rUjS08mƴ,a{rϿ;bSŤW_i݃Rc. v| ][- :12$7k%sp^U7':f\ضC),AVLB-*N" Vdֈ7ΛXc8k;R!LzByЗ;6òr;(8 o~N(<&ynϻ@G`Gw۬7:DjcBŌE 5CIJMw]Պ"ĺ(T'z!CpE ab pel꤄s !ӶX#S/8.t"FoV]gR'C } zASRDQ` Ź]ջ *Ȭ֖t歓L]ѱ>d74"+ӑA/gP-_#8o߆f'%bsrsn %Fc -[ڠ"țiD7(s&AÐ6c?rq߯2,[C.h; d+iB};aBz6Ն[~{?\$KAM'\%Į=ԵD]h4Dܬ;*˂F4>.zH4|n<~|#\09(JdOꎝ1Q\mL觲Pϐb> E?~?C[H]BR͙h%s/f3GЌ_ ,mYlfHyx?>GF#, y Sd#h%iN!~kd4ܞ6w|s3)gvHHA=\l7Mgrk; O?,7%Z mɌ% e4л~C|l/*|#)YܾHa]~dEd$` h6Mzj+R롅*ˠ/1KXnLٶk7HL AvsX>x!u[U[ TvybCZm =-C;J$M577pS++;5#%_5Y*_x="myx ]¥tNLJx vSS:]"kBs7<[ҭ|Bl:4pӹm_PgRV\症.x9=p!i͔0=ea^4F 66k cFC*OU~X6>UlY8i&xj5̱S(lV{Hc hX-u%Ͷs=dEn2pp}^xYh/3_烽1у ǎ JbĦ)(cJd1 W_ٙYќkT_Q v a5ٕ|'G]%BgF2Ђ̓`n?]~Fӡ)ݣȁvߙs;þ}V|N!\V{'9w k!) Ux|x *mh+ʠkSZjjOߚJ4h}S}G : )z:]6pnlLY:>ڣFAe q̥7vkr=C$s Q N3duݪy/)q˅TQ{U7?wowq+@ ɉ1RDzo/ybl'dP‹> VM1I%=JF6So i/SzѸ+BXk0mlz,=آ{"A30LsڍBls\āz%\fm?*vo =?ƲQ|M*j,`v9*5:(84/d{dNcќnjwZ7\Qe0& ~ ÞaLXu ݩ3Ƥ)4w pS"'ʋO g[LhKaH,䃙gaJ I WJv`4[Bxco ip "k~( `jt4z}uXqP-L8|nn!Su#rIamV#TD{SO"P=w^GK'r(s!/bIX`y2DƊ~lb/ix B=zwѵ>?%KD?ᦢelMkڻ< Ҵ6i3ݞܧ^u`AGee(LNIFb.WW$<Rkא0[JT9ٗVhpב,Г碱.hnKl| /D!;krϬ`,XҘrxRҿz"%羞T[AJKYۈs_m- m} Ba&)wSzÑGaH9nW{h2df?Mm r7I>ɥ2VG֛7m`BO m)ΤZS@0#}TV|ȥ} |7ydSLɸOJ)4կLcNt9C!#.d$6؉3Jǐ^$4cih {UlJp2$@}Xr6`Р`l[Fj]Lkd! F?`4HĤ·D:Jd,|rz@R @b (T[%5+3/>an ?[-kCBu&t>sf$Qod^x)Cs.x2 q,c@c;2D8g1<}@pۧu~ Q.B8b|/4n=1;ݞ*婣(\t!,g]:!Hodx?q^FS5d95 k0O]Hxeix܉҉S)2d$}(kˍ#Y TEubœ&s}rLAd9$HQqaa&]&1^9&Q.?g2! y$5tN/T)y.9!~eEao0A0{ga֞Qd';AS1N.u͑x̞'6B+ń:{W՜42br1*e`LhPlbήlun= &Rjх1+~ Qq[xETZ0J*é%ԃJ[F@Y@e+o2$z~z߇eeϫL`0b5sS(}`t~?l>3cP6Ƙn^yv߆NwJF`U^i8U w#TM'h݀G|bSSԎ1PjRceYݽ 6XHX,ZX=O[TV=0%{ :kמ]I/x>.5VP%4œinf~q\KIRM#}Q_%,>!Cxz+ X~Q ȷ&EU"# yݭ<Y%/6 cJ"bLoq#͠&C*)ܖi%Y3h] 4GIx GU S|0Pv.&VX,v^IeIQYz$/v;"頊*-YJW>,jSRx2(j 5(AD݃OzerֶD|M{5M^MyNrbS "rc!~WsK`|QZC"5%^- ]/]BhȸQ ~:gqc.XFQLWD❛;Ӆ tTJnՓ=]E`uZ3VV(m-6Iq'ZC+8 3-_RV%/Rdl09"@H37厈\ ikZ#B\ȕI.ǓcyyQ: ~*XWJpZeT2 j hgN&T !v"]LǼ"Øo;E:k&yA%n;0D("S0xP1i dqnw߂៽ڜ $}CSS͗|P.|7!k^deJ^I䅅 ˹hUF ssI@+' /E.os#{6 \L(ouqNd],@tD+-ڥ]̮["U# e"|fﶕ9E^|xG $EHJl pxNh]Nh-|۵TsE -'8P/ 7#k:\,6f*isEn肆-hDA 򕖒BMω@Yۤx=IϜ^*oEO?V]kÑMUړ9vd9&0`s[ł&@t>\X¥ӌ͌֋':-QPj!<#N6ڻMkxg4p <iqX9~V Bhv '7!yn+݁uv!Pc@^5'?< M` 눣Hڠ_oΙ.%wpF.c }U>]tI18H>"10la`Ti& _İ.Jѽel*I0N٥:$z7EI)l=2e>*Fv̚:K?vP=wB8ss%:~0PŦ N0=RUz)e`.|IBi/hC+̵Pܭl&1>OG0- U?w9䢰vh$ [5:":OVUxdH5 3&H7Π\~gPu*SU%.?lxfsCӦ.oY3z ):%^@KՀ84h_ʊMgq$I$L+};Dk$kA4CZ26xȼC7Ms%]%ݻ6? ;xbH8" \1Nv)k=rR/>X<{b ޜ>k-zI SQ.d3`o^'`"RD R˄Ll\&`Zi*TB M 2d9ɥy5d $d^6tC0Θc *4 Fb7ZeAğNoɇd:ډwb= y#ڕ!򚄎 wX<0W3˷> ;~V]c1iqftR\Rۣ`za\Rz8 |uZ6 _ B)Ciϳ&PϦp"ܺo45[J. C}8 {1(c9p-v9pt+,j``/槳b#fA@)jL}(hF ^[W+Rޠرb>(/bIst^D`W,t!SGY4O.Iǡip'P\!?Ml_[y r010! 49lEI~ksRX#D(' ?%FB83Olx'nGR !sus'8ăC*-/ :msM|0F\!6У{ I?sh͜; )LџgYlyuue= kwʛ)s%x{ 9fjcB.̀*~20 ⥉+>rjj" 6{z|*hKdHaSL⫟0NC`r};&fzdS%ј69'IA}^FT3Kqb#*ws&X*ש>$jpG\/)H½y8{]f*;!W|[ ȥ1 )%lKUI4 KqC"g+dϐd2vR#bɃRMug}H:TUh! !(t~.q9Q&eZKi O>b?t)(5\API(7xV"GN&s9͏Hx3E뭃? Cōܴ8W~P1;{Dӑ6UVC]'cjuFU ׫E$P-NzQ݆q؝ K-tSЛ>4ErGR6D L,RZu1OoG%ҩY2RKy1N$ *+ϒvퟹHRnOѲ-֊蝽 zȩ3ӥ] { =hr}a}J i-WS\U\]qIקmmXZ8`U 7%|Qm2MuIp;Ý{S<|*?ܧBV6&՜. z+:6G$7ibSuL bz;jjQJP;kς%1ci敳M(R?ЧP{} ^Z7E~i rq3tr9XQ}z-)3CI鉨E u*S,/2dpwoZGcēM;`Z.mJèwd ]އocNaPTYw;qv X='y UȀ1^w<#6L&=exK ;P*"WlЩuyF &s  zB !cp~Y# Z%ف))unk[Bgӏqv6=ss}OOa@dqhYp]l}Hu0଄Щ Kr.hgGdSyR ~| lpׯ -=H HD8H@!OSg…wwz ވoɧoQsg옃UrܪlC d}Zz'BJɺ97@AwFӶd̸r fiB۟HE3*GEODȒJTl &=ҹTm!>/]qp3jBT"z$[E/fٟ75΀R#~#q q:J.Y xIaK5|Cpo_\l+C:k&<1nc:ʹr7󍍴Y8y}%kXJL1fH1! BZ]>Zu~ԥЀԘez@EwRXE?`ށN)w**fN-ɋ>] 7\ \BzI(-и 8(F, "*ٜOR(s7ӽ4ܮכVYا0/,8uUˇ{.XLc>(!:XJ0_sF6º+jdt(^\gIBgp+5txI(*6KpɽkY<Ћb,E"ķr7< 'm(3JyxsY8gPmO*;ѥ1Ur?mxLnpOWVXeDЮK+wDr,-E4ZDSe-┭ "Pw0 ^p35?8aKi r.7 ?@aLu!yų=V>|%;/vE&W`w `ava/3S@`ʛֹgQtlHpH3cRA (U4r$>&Q pK9vjkMt-%0ыvT-`x4;uМefg& b5[_$;YWd9FG=ުܫ5Y 8MIu3!v{(8A_`r&\[ZEB‡Iq$b Gd H.<3xR{r{K󻺱@Bk(w~9ZX { l369 ? gx~/$ߏ`cȢC4ajHTj6=T]'#H#sŽ4\ P5xa94r &A&t_kf(2 eҙuf ]=hG.%^{VA}kn(ܳgvEaW6<`GI0L%#yĺWh"/*f]ڼ^iq$:oahM. Gc(2myd`W,OAPr!N]RW @ U%D=<ԯ8fQ%M : 7O ^x/$xFfvfKm/z;'H?I:/0x&@)18sR̾]Ѷ W6` ֟8~V*3CM7'!fa +P~$ r+7،Nj18pDe[~T +%1?^I)9~*nu.aGa+h" k>qo.[:pYGhYH|6c}4ϭ C2dm/t##bu]+ciZmo-UT&BQ" \ kG@MT1h@ pW͡ 1w[u|T$ zɽ5u0Ǯ$jrî5/#|H Jvw[Qfk ˛`9 5j.C F \qWj?h(\UWGgKmm L(3PSxfJ7WN=@8. 5RF,^FX)6W6h^ʜ/=B'r' ?nuwk=ը" )̨msc! XKD/#"%M=5 Hhp.U4R0-(r,욨qWqmZCe['! D<|,Y*w[ZŞo`DuQƤمWu0$p$)%rd)QWɮ&EnDr>`FP( `{{g17%G7)$Zn-@tRA(kJt@e6RodV1A>j۫|7]3틴a)gP[v`~Vwd?9#Ò5<͖SG}:(;'C 6(d ޤv#KTbhmQoڞS&)F$Ehr}LETQm|cM(F.&<`̾{SN# #PZ)UbNdez5N,QY ÝObL8Ѳ ,>a@ #:Dl^_:t] >%㔙j2Sz-4$W-<cёWj AoPG.U_KC\ vbشL%;}9-,v)kX@Ȕ}`;W+'JoΎ_ax^w\r~PIIu5 _s \*A*+\H ε!1iR!"~%79uPki3\z%(wԺ]scy;HNac^ө_/3urmqk?D!PԌH/ř ɬlŰⱁI[\D|mNLp=nv,. ]3ř$̏K0H2 #!3&caR 4"m_ k[M>{&c0ӝTN4,2 \ŔWf2+T( yu^0u-gUp9gci$xYXk#H#٨L&]@(in3JNkb7^SZ6tj -Z͸Qk$뽝"ө,B<%;zm/6"y-Q+b6탎m(1?Lj zu-Fc DT;`iTqG-&, ON W׭{HMcZ"¢{@s~ؓii5/a^Vi43〧Jb|Vyn' IA,&V6m+ R_v/ؕZs~??Qx^Kq3vf|4gs|[Pm@ M59f*^w<&w YNkG*1Q BK^`ïIq \Оi_q=-V9s몘R JvSpR11McYkNX x;_+-DA`J$WxShg4hHA` 3@6=,hbDmFGTj RY=Cf;.W8[0KYOg('͗03t^LOY?\Z};}lVCSq i&0S{{`ZG~F@do $ǮڒT o΍\lQ+O/OB/}$J$s{@ J8U|2ȼ{t7Qy Ewjeu  ܺ%a]B[uRαB5j%ZZKl9u^:͜ Z՘QUݏv@l- o'k6.I,&eZ}n^$ueK'??莔"( P"A -2 *O)Ҿl*ni8<%Rqb3[^~ A0uᾸ#/ǧ?]xН#zؤ3u>\?>0-!PٍtqJP;AΪ9n8LP M#tz|`T:Z}"N^]PqXtmG\ԤBW4 OkOzþ>@6hLXu"jI= -|3P;Q^fsK[ݎҕhktSFm"r43]^T_&bhȜ{zZ3t5sK)PSj^PxyQ!=)]G+o'Q +"V"Ntl =[LrP9D ʞNBqضVjNMt(4 6^&Y2A^] x.W$6ËJ8d"qr9RS_v 7FpAs꼀=d8H`9iC7: lsǖ*cH2Bڭ7wO629[9{8Wy-HPL.uTH{K3g>b*NX)e`w[^F8pkzOy)D*w5y?O5{FHh"UD7Mu&wObF%̜zٽtlqr\;f 8e1H^Z_ ygv\voek'\=\دyftg빽λ oeݣ@gS6UuED?^>kזz?.kr5CmP)#LCGFզ'LI r՗U'[NB@{!c6+G뛀.7nx[;?e(S0Cv=VUȬs ds-L)r}t&>Azh`ٸ洄Xy5sw`F49þ}"y:4ѹ5roX&{/vT:' zh|)"LJM[܆Ky+enMH~ ?r_Mr&U襂A/3Y}gcM++9\K.s8[ĿpLmz{?A(Eӱ2mwy:bvʆ& sY(ʫĜ:)eUf.Q3Wi BϨQc:-XLIU%9-Riu*'ix3maPJ.O`njx3ĉ*ىucu`{`6YJm2IrZU"fOlRaV)1m!jo.RլO},0֩À@p1֢2~cI#T9b[/ofv(/mCNuO Tsr~&\Ro _:>z?Ϟl B[`Beٞ+a.6;TmDF8W+]uO! :YY}oݘ@%x57&fiUb*F/ԗ8+xJ]Ab4a3Rw;clQ\KUV̉"ÐdDp͞r7 qD`oP`¥$me\ns.@J']$IOz!ҷhTtMFeRO6&:@3w7OzXqM$bتtr(9'W,?5lN.Vu226{N2q@|,r&!  Oೄ)7 arm<=lq(%GL JCR-ϸuenύsմֲ%*RnPk@rT=i2+œqgXN nm lV{>lNQ:×~5em=NT_d{yۈ6؀#@m~ze9wbp a368xDx8ON -:!dM")Y(`_xȹB1|6nKT K1n]+ zFN_ *BljXOZޥ[XȢXmj SŶBľ'h)DmǣAjtZT>K^9'V@P#!@P'[SLvF,K%ކY1 l]j;ui%TJ7$ OpiaBU/N3+.+W*Z2l&_% :H\ȓ#hTറW[+b^bKdS+0*RNe|*KEk4倡Fa{  z2_>)k›}R""0C|L6JMKdJۀ?вDq`GBIA5oKm+1O܋^ I%s`tIuG,->[y,4_4)fM$fH\ cvS)Ǎ܃kq1(3Xdeͅ|>ZnQթ$^j_!N%nϊ}rq. MQ)oWXj,Kd*&!,ڿj80%OL*'9ZX i߹eB H\atI:oybe+<($/%ÿ?Aj z{rh,M4lN\:+<< s; J-bdϷdnWQ 7(QK3]Ҹ D{ez_)!hYstdTLsj"z)&"ʝ&\z6@q//L?Q&Jk+uJ%U 4$o/jќAV0<4+#ӓEqr>idTȨN2doVӬXэ]ʄ̛𶃏~5jRI rл+iEwa"}Q+* 6!mi;z?ȤE'[~݅z#KEr5Mm;]&by J{3juzԕ Q_Ӄ]3DΖݙ=~@ a.lWb_u8$?"/c}&(p0YҘ+,SLE% >d Vn.I1-=N6 a7\p$@!z+ CkG2U[w%F~t]Gfw/M[.\Bp(Ah5!88Wj:6VYICQ a=ؔ%eALV+Qrt"{{00϶-y?*2O01c[gUGOFI { k~vNB#ԣŸ-/u>=H_lG2'bqgjTJ0gMDH9>lYgƒ#հ:&&/[>uL^(( U5,ˌ㎲po%Բmus`_0'NuӉZwݦQIRbİ{0*U;gwޤy5R>8OՈZZS<26EZW`$Xá RwhG2aW] xw:,C}5àz-Eћe4g__*r3帖1zhi&yV^S;|cqC cɺTُRg5\Դάy^ȐM@$_ P59hքqZ|Q ~:{L$t; [Y+)gʴ3]b>Zn"F?nÂ9CCn*d?9w )QSʪa[K1^<Vjя %Je{o졠^6ājnw!#]I*'ʲ\Αzɍݤcs=-mYFPM[cW+9,)H)^7~4I 0\)4=D%+S h&J+\EϠ&Kv>.u= .j$CMK7&3g]Yuߛ?qCvPq5CTաS T@7iK9>9/5%lx!@oWRoCӺU:sk}VYldJ0#vS5QH# 'ίNf!: rjq zjyy1,k0wKӧr)XRô'rx=~+|DyVkIAC1>d}uEĠUu'a,p4@4x$`[utqpp9)UbF (ajG?7%azY4y?ߛC0O(P~V")s I΃ʶeAWsu0._H)n,'ĆC4xɽoKN5inovA=N*雃YD)@[jfִFT"=Wc5+~LUTΫK5S-UnJ`7|5s[u߸ZlEaP2f>`+̭{P4^5t^S,UA:@ ہ;i }E1UpM>fP%E$@yLZT0qet+xZ`6u@azo+o!?.RT+')уܗNORuXZ2^L/Kaͧ4.MLO! ~7Л"_8r?z@ d*JnbVKP.DuĴޏL%l&Ra׸9KE#+4h4NvҎ3ՎѱV5'I.ȴW8vŕNq#$:;b|tteyJd"Y26ud;vSY\)/ଝ@z@$6lطm gxԈ\_mh{l R2; Sk%imղ1!h!2>k O^tF Zя8lfrO{y@bqo@0KL.RODm*pWmKt0f+;9w[i. Ts9n4,6)9 KhҡΜ|sAuf Un?Snjм@X6piiyR`ޜ@,Tځ8f4 PHUs%Sx0n$WL&NHlmY|+ /B1sq"N7Unb'gpӭͻ&nt"?hhDhL%X\WLE8N|l?ySGӀT 9vV{8f8XNC8㐈 F[6-7rGcQxB`ÿ\K!F  |(鰁>e6 *H)o>JmlPVz2Z)"D6η L* iT-..QaA3дQ/:`@Gθ1y6f:Ww{l7SHV*nݽuY0&bÕ3ٽa@*`؝f:g3a#Mۚ=[DWa}b>-؜n-RNaԎJFi)ڑ@m(RbpO~ f7ԥ, AN1 Vɝ /l gWH\b́2HO ?`{ ġ{M&, X]DLw ucjX#hlL8N maňwԩYNţ7 FX qhҘsM`OCgܓF n:K11@C )<$\4[H7ӬU+l-lbXv}F+rB]哶GJ9!VgRP民@hqd˙ ER~*&& jlRP:յs))sU"/܌=Qqn B vZ`o0]7\Q "%R8i?Џh5Hp&]/F$9+ƢVdH& -gyR?t"X;=YDğ|'[Sڇq(KSRW]غvj.x(PE>4| Zqgp].`itKJHY@)fwLf2n ɋO2&ҔփT'HmoݢRIaĉp; 7_17-sfR6\+ 7stg\)WPu2 ՂEaޗX^Rr6ǠHawU:9J=^U3^DW34 (#N dOq` ARӊ1>􈱲!adH|; h =[mu^݊-]9~Dk}kcMxP]=ti/D*C=U==5bӴw.LnM_؁,DRW'MسOhp~txk4M^jϘKnȌ YM+Xj^4 'oi{Qd=ϴWK$yD><̜nhd!=23tlǔ2oh<մ.3s3~|+F`TƠM:N`!4r /( "̓!;bEqM ߝ Db2e^ؑ^oo/cz= :D]'O4Flb*滲f Q|V*ȱ^q?a_/Unz+J~ +9Fag' h"nu\SErh]FGJgg9SaXbT}bt`l"E?LyF0UXp1QfNv ĕrgAig&:FNgF7Y?솷C [ :u0?_-1ϝn7ew!hHoa+,/f=jsLY܉G0_\~F;h]`LtS4{]U\ ޑ/Bs~n4>3.yEd%ԱHtIP#5I+.-UќA!s"V|>R8飇Y:DF_1r5zƻ013@q';m2%RF /D~-N-r2c DIrbJĺUQM\t]*KmOF77(-SfC`쥴D(&CV:l?_v3d Sjҳn ۴ cޮkZMQN.%+$*(7jA z{-aϱ>Aa:*j1:|IwY7=sg?5<['nu)s"k-@Vp6ދ/&+l^?˞L|]U⳥O^$ţꃶa {'S_w[9r:TÈ`x/Gď)li[ApEvybkZJ` {}lRJ*PPֲ҈?D#|̲)5aArWFXI8Ȳx 3[Pp'J `q:p:uuSkC9 ,nQB_bl-S*cm5Z]W{v%v3@l" 7՞1TM3r5EZD"{7E#31`% ȼ8܆\r }-*Ujh=7v+糯S[ CgjB4kW]!qNJv@1n2 `RvʍpTtdQM H]1WVzq2![TrOTV9䤽`g쮝%auʁ;(H8H W6|tFwnJml6;T} C|DhB?GM VX<G:e>31-/;2 S-7o%fr߾!BHϻQ"0P'à3_BN45 wajT B$0SY[/ʩ2<\j\lpqn%]j|}&o7/Y#*QȬ:x̖R:h{uE QZA- # 9 R.Gis:o1|9j".5̲3fFUY3cI`x5&lL2齀 M (>DwPBřȎA R7%"K+#Vb6?yH9?y@E)G\hkeOS }Yfqyg(p[[RKc*0X[IF5J~r d]ܦۖQYGGE)=ރkI/r0NTR\c6:#5C^*8ca(mw%Ң>ɫ-;5U+w;!eYjT6Dʖ^b &DNJ9 T- ||װi~RaCbg xK@qɤ)yE,Vqqu"j|\AdqfR/? N,j|ݭJyt"/#̀|tl:}PK| .ݿW1q=%+o[T g\q~R5UI#w&$j 8ploVnWڔLnŀ cJ3#:pS1ʦ2"G9ij[#,N $w[ֲv A5 4JrО`[i)s wpsB\A빦VQjS-PضWzgjp#Jr*?~ʸuCsO6qjzBkFu05Nf Qr$UiK u RtK*X>_RpJ[Ѻhһƻ]1.?THPmZ%|l="[VAb.D&uoH\lzgCQYD/ej 5!M<nHV+\ngF1P݇(LޮHh^w,Sd="}YXrk<;Ҙ "/p/?I}۹)ȯr2Y/srȮhǡ|U~Ybon+X`AIm/]Ov+yI֖1U{h+ 9] (PEnj-i,+W2E%ng]wݨǕeL(8^진,G2\-b"6̦]4 oL%8XAӥq^O)ᑛJs;lLB:I`΃9KZ˄3D QO4YA%$*)\ͨx3|cUhE8U8Ƅ&q}@ԯNbwj' HqQN/3o/PU5uκ9"p).&} f/:gx )g8To]wPMݚUbɗz|Y'O ]yf04lŋbFCN͚>fUA*/kN-U0Cl8gϹGY-W"ċÙ 4C9$⎱b1unr mw1/"gPWI,ť3?RS0]BocA&ρ JHF}~v+,,5΅SD!t7ȟaKtfV>޻1 qY5dԫ  pYNז+lՖVWn}QxgMG\K^:/,$Tl2(({JC[EYqE*iå ZN\Z O%WuS|lg.92@a>T8Bٷ-ߟ21t-nZ#S]Ga,? G1S«F¬ .aJe'׼zAq_vq 327=)$&fda+Swv~U'YjGg,U"1<.c(x=@Kj1'.=Zo DB>4F5WIc7)\'W]Abs_'7aohL60^1M*idA{RttG~صi)/ n1>\"G]S).ϞQ+o"9g m?X&4Y2KP r('XK@!MR"zHֻ Z&OE.F@݈yd\/ &%paz#Ocၹ᫙KpO /#I#`#iɑ|hI3xZ9f{\7y,kۯMdKE̗utܡފp?1[3t6Ow0,2-0:BVvΗo'f3jN*"󒱬VyN^:WuqWnӸNRa]Ո^|')`Sg>=xs*Gǩ2rpSЂ4 z3x(F#o l9k1Ϩѧq S!f:=B3^t `NCП5o/Ef AH1̒.g8~/E=c֕G.R\4B򻨊u$.dQ,ꨐa4kg /(s4yڛ^TL7 4d%fR?k l072%`׆'[5n8co:zSA߀M* 8/AÌh#zR1XЁB}gn|O Ѿ}y=WSRDѠ{Ӝ5A:,J˗W}~?ϖD%Kq WOxw`j7աs3XF's0/\vrw<NrV;NlE}=62ǵvT'1E҃\V^舘? V>P)-3-G:DcJ6{jpe$ȷALǕ7:$N>O:8~?2uK@'rglOHRo2!s5#<Ш0d>}j+?3qg1vo͜b`߈-vڒ֝'*ϭ'ESH !vxbE CBIIH'K cކ`4E b|{C:vjCsNс<#?erf|u8V'l3a+~ih0ͥ^'ƺ_Wkt饀4!=IGxHcAUzCa\{;\lpCvdnYdN<3aajgU .=7"ZW<d $՞6_Vsq V%ch*9Iy;L)M*\Em W@ey f^pG; ϵjI nh|% ~ \Lb%d {[4&c Qv՚<湮@{ZaAr{胗y]|^Z_8z=߁)eǞC LdFFt/7B*Mq"0K,>4f6v?ٳ*DcrA.8Tt~(b3Ehԟ֠Ȍ[+fc yMDfz՞)4I{&J%Q(nY% P|%μ RS+mؐ^!{ӶϚP|~ /MuXg[@Ltf iu!3z|xj&`U |Z)4#O*ց>5`؇"N~(Bpx,6K_uwB^Vc5TmXNB`LjHRĖF~ d-kPNvO6+!p$ }hbʼYғȹ/*2!Qswk ZE/`OؘC} ~?ql/]w9JD;] *j%K2-Q[,*R/D) ]Ӗ]sA~aa\-%c+cԅ;A;bR*(H}iGo6Y]fK"-k$䎴5y>N|Exu:ݹV9ܱAs^H dOҌoJTԏ% ,5yq&q3Zu pm/5TI*43P΄WbvGP~-\qji  W;v4?qe,Z,YBt$Sc,\o%vXCEiݺ]2^u>?vݺi&>be }*mi)6p@z"G?j+ֲ$flF5uߪ5WI[AK)*`%zف0Xl,=xqNsm8I]xS1,<ی@Ft!o#@R3]D\Mb8 cibO0aIV"֧Pa@\cOV#\^oͪ*I rX6..$nupMQ~+FPdmARZ %nϹ9.ld&%Jsd@Ж;IYoZ~V7%iې(匄\'K t=qjunsc y#X(IRǐ˗;؅JId AzB~E;, h'h}ƺݳrPsYqvd P]u@Z/kѥ"bfg([B >cImOwlng`V/I:i;mG$:ӭg >ڡ^:> WCRX?mZ`c &p ՏD{ՃfX1tD/ʉ@hߢy''"ω'S[+bFaY7:s@!8է\H颂?2cN42].[$ 0QS7?ʮ0/Lڲ+#ȉFDVJ7/Y3kz@!N=s)aTOtȉ@ni]J~ ,!v0Kzi}\f5--py: *T~c`f^o&P] ˒unӌUB/5&wy{Xz=ުUJ PڒΫP3!-Gz麗*x16U;(@V[TmRӀЖ-r?r/]|08ak;t]E\H-Hw X|6d禼Tt­PryUFyY ZWXrʓs%3'B^W»mþX|Ud(&Bz0POb<i 71(lV@N.xDQJZ(~[PkK$>_ݮ$4 87o ֍n^tF=-wxNBTg߄)/oG(zQ>8])gB Ta`fPd*5(^9(>Jw yNIJnpn]}מ]8wm BWkNn^XBM B 6 r R˼ aGzs?,i^E`Re:Fs|}ZE rD$Eay$a7l:\;-D.2c]1rzW+c[ڗP !82lpr04Q'>|ɬEE3U`(p%p)p7s {}ڦY_ogވDB0XwqVcexs2kUy.X |!{>_: wɯF%K6]K{>$^ =ov@(IjN/~< @ O>.g-XӤκkq)P B&ZZtcžo¤B ^7)Nq|Eb[4 On /Xmϓݯjd?w" 7lm=uiHNoI;R6^ԖnRزqB8BNqvj0B3s״-'~h[#FEӅ2c&pE~),Rk1 1Y78x62 3'W ?[|2F䕍e̾S1B> IȏOMdZ I]V?2KŬ 'M|) ,..̛s7Ϭ |¨;_ S~/@>p ՊB61Rސbyd '"\'?,ƹt%:Cen~vBv}5bʬe_ͣ"R SO_<=845)@+I"oYf\ p4+NOͶ8y! %y$2H8ӅCP)Ca>XO`ڜL9èS`KO{zt\$ ];Cs#֜I&2 we"t/g1tiK a%<ku ȔIm_͚Xi6ٶ%1ޯCi?w"*_7̴&6Ux+'9C J.XCkUBks/L9+Ygƒ;R}Cz̿gyr, ɉW2Bv9ʷPI2p'5#&y44/,qij`V]p\4>Je:c=1šh7O5UUш௺|mm>>}=?Yif=A4vcJ2 p{tJ?20mn0xǰF9,AMSBT˜~©$Pux:M+I`<0L{EƖpK bG4" LkliulC;K&I xEAԭh_LT:ϧC,?ȏEeCI!yR:+<9L7d$u1NZNUX_j$s${^ژ8s1Ay= ߓ$ͼ5A8\Zx/84 2#~5 T7U((״0"ݯ3Vd7ѽ Q|jQXT c m3(4LŴ9*SoPV)8G"w:N0BҪ$7-qއ ?뙚J^5iO|8k;s[&[,|;ŕB/ ZΪOcu ׳XdmPb%BGx6ᓌPA&CulѫaUʹ6;w < ytxf4Ǣas{/1 b4@rQ퓦TkC[;8zJivirZO Hf6[('1EvADüLݏ2+p#o]aZ׌Kt16 :Ɵ!ݓJWk g,m0e  ?=mU';>-Jݏ ۨ0[t꽨:KIlFz)ɲ55CYmbK3/}=F E9lCaDUWut#ooV# l a OPubFZ[qĂ%1)o*2<nry:&j\~ЦhPxF r=< W?]\_Ai #ƀDQXv&n;*7M4'MՂ!,s!4TDbhBd=Ňm&W#=N߂2{޶o^A#;u~!* Gb9jOzjúKaC:e/v +r;-3RSxMBIKގ҆/3&ihTfb詢ৃ15WGdI3*8ucfL?rd"8N\:} z.WB%˯PjG]BH5~ ew/qךig%e,R6/ᄵ̞&A_ $@7Hvv-pFpp"!yh' ; C#;i[֪sn;^2(мx4iѷea<.2P{PVO|I@UU\Gc5!`GMvwIm"I Zx0>`zA'}9ԴNM= hf1b:Dl91{.^~DYQ.u};,uz#挴1GxtHЮLZ]_%"6vl^eݮ$l)kL` W KTr$Jk2JqSb+:g@hۭN|W"  E$E D *Vp?|DNyRLK 0m"Ajzh@=Sx3K{V>Op:<^㺌88İc~%tмqJgeZ ?YfdU2oE *KLRݬi^ʼ]&E>޺QH |`T"&dE/No<f8sY~mU::R@YCM(%YW}KeȉՐ[j8"'NxCJ!uGM!{dۭmr0GTէb+ df l 3ro>p[heVf\q}p5qz\HXu}Ҕm+rҶg#$[Ta H]9R2_?qt䑒ȹKɁ6}XJyٍ'VIX\51f#TL"5=e3*K0]߫6!ݔ񜸇|zEN`ڨBȣqI15AL*xKd>w{%WL3DuUH Մ캻ayjJ)5aq~a'dgW6!Z.8L{Qg͟;c.'m>>&lpACiOO 3su2(=}@Opgi7B7nzq飜󁙯SoܹvfIpy*4ӡ%Gك v>Xeܖ2UtrkѨXݷ|i[;T)K$p]5eC}V1媠>[>|,@X JTN'=-0R 'kԤYQ)B]:qG<}WK8lE)'T .lg僠;f׵J#0À$Z"d"E5jcy|ry: 1t?&CP|*^R Xl?R˻IyvQ;kh2̓G{dF{T>(<{#) ߱g(`Oi8(N/`a鏪EM$7$Rxc'jaV23Vp7~z0 pD,xm@ Q\RtϛEz"<{,6mt1KZHsF JDa!L, P"%z /9Gkuڙ9wiB!#vX Ȝ;]$NT _\Q|BCD\-S&QҵNs85tfcaAO? ر'v>ƙZ4hG HYem9׈86TV3OVTW$9R2$,;W@Ibd\T_-B5)9SR_\qby7T?3[y1?l?(; h`Z81Հ#["/x j"hw䣆;z:bua%x\vfxf*HB-\t1Ŭ%7CD G %YM3 og)Ma7Ux? 7FZqT}4ä hͻ&X[ܛmX ZA l=6kX/6ʪ;+k%lE㬩^pͰÛl}3$Wa ɡOƫCt%cnws׮FO"A&&'yo3w z}G[R*ղi9I:<`ub`6J$ǹcT h\}%SmZN[`wq3fN؇v^g1<.RhL I MVDSCt6aZ<L.oUR\d𽴾!9ּW56鈚j%>5ј2!Y;1Ig2 z^OLk5mfG7#ʱݗ݃%Q&C[$6c|ߑ .p LňoS莟UF0A|],Ǭػ&REfvadn` ^iurޓ++>-CC%iLlPhMy7C1ܐ?聞uMU@w pw[JR30đk[{9;S77T/݋o;S#N fyB p\LOdk3,684+$ =P€פ1Qk/4w - "W.+_B)̣YYZ<ky`POA(J M ]T|=~]V$]H| Gp3q%N#~qڮlEbb[t(qx /s)IRu%m;5ԗ.8T1I"ב&n`]_R ']f#򪨸k$@dz($#Ύ/P9GAC +ϟlX*gڂS@qnSG#o_SeZgWTq"!""CJ;R|Ϙ ΋ob`L7=*: +sHQQ<^o㏶RM|-Au?DŽϏ/x Wt $ $TnW$u~n Kl^ t}+2-}'E . ,>filL B1Zl av `$+Sw(Fbsv Z_l2SmR|r1*OXa>q)RCrM .C>$+s3tj(s PMG7~Y4|^#.vT~DY'k="h!.߳J!U1("}V8d:]ecuM #71B~]B〲C1˘_-}h#6q{fi@m' /<˩9B>EJ_DD%0x hjL(~2]Lk)Ű 5^\dD>ߢ?u.b#Kzq!mc J<#3at=W-YP( Ih:bG[L%yL RrNrd>STV́--GТnʅM>qG"tke[tkhYNjIn!vX:w,:3o0:jVΘ<)Pz?woIPCJ :ćd5 ۫P5u8cMI;wp wSƳۭdQ~5"1$N 1lY.bm~L{h r\.ox&ȿI^Q cmMK# o+tC>RA; dSP㴼vuL5չ@Ɋ_S'$@] 0:ΰO;$? IjEɔHF hy)y-,o4 <b>!Jj5LB% ,>dw Ҁ7Kܩ8cG&`߸lViQo%Ր^K@F@{6גc'c1MR<|!,~A"۲pWdnqhybPjLwfZ#Z4,+q+Qw=cZGD~eavNѐ TM [S5~$99.h+Ž aZJ{*؈PyN*7Do&"$ꑘ#uOm-Kr&là- 磐ƣܠgQhƫK#5r^=!SeH7+qm?_rq$D(DsFHCET_**n/e ,YXPΔ[4_S n 9=v| )tYxBg$?14l-d≙xzRj ,Ptbhmݹdu+e& K|и[.|1jߣ+ק%ӥH;O0+My2_d"q.>O9BǤDn?9 *VEF>L ;7 nj' %=Qj}<FZE){=ܽݙq﷣_@$MnI1caïvñ_w:$!rtН``cZV®sBѿKcH{DA$u.PI3 ph$5& @iP$]7'u ׭m\tndz=?gB=P荙Pcy I`xDuR 13ơ bĎډ&aꯓݖ soN91_[fo0ApvHw)ż=6T6 ˫΁/.V7䐚rw33/UTyp2JKoʕhyԩ%2ԴB?#i)na,hZp Wj NI#C MH[HQަ./y^0!xj![enkfќ cw "ԷѣbW __R{;+^jw&1tܱA,Gkbt{\ 'ɒSy纟C$'GKWAQ0-ܫ+KS~'b }  ^UwkJxl{X}8\>w8 mnqE&j4L7}05P"^;6waPm xfG/ @!Q-nqy/tNlAu5e7ŀcVG7W{R0 ؞_1$ ZMPiMõtWfj߷-H !mJy ;Ŝ H>z p|0 *t7$vfqiY=}WACSLri9 .]_KgjMt{S^;qá>`Ļ쭋R옶IG\ )5'GX=3VCo@.$OG9ɳ܎fGC:iաN]OsR*U$iyNY0LI]JU8#*@WKM z팭*!Y9뀻$zW'1BPq9cog[R};WΌ9'I~ _ Gqǫ%+n/Y& NB.kGsP9$,O)q]: ΐ}ƻR5cD}T[<ׄ?a\],SG m>X"bLd:Y;[g:)t urk|8U*[#}s}lFGL,DG4OJBvр?pQA0o_NxKp.6-ݖVfIϗQ'O$E ؜踾 'W ' -y~ )BIp- $a/o?;s<l>a1h݊+ܠZ1,<&/L^2; _25L@oF<plA#r'x#Hzm(Wx֮sx!ޝ EAGDחGseQ]P6Ĵ@>=T}ogOϭ2sic2' 2AE0^Q;8h)l&k`z@#m\GDG%v!nPH-.џz{ĶB>%KpƎG&ItSpyYQRpD\ҹX!x,u6$W "W7i9v BkHZ|`X|OBãzX"\ x,{ M_~>TBc'yO*KrsȻ| v.^)'b4}UB@z1R# tR S @8z[ac !s\WYdT* # *4mtwf=^-n"jQe@{BI m(n(Y=J,5l&i$UؔK g.PJnQ [xt uPIU$K#SX 5cg73pP䝤t^Wl,"zjׁ锨 =yw>~N",b"@_Q}jI1hɿc+|k] kVInᰆ(jg?W) ZLxQJQem0(=70&GAp< Zڽ~%EJ=T~—И,Z b'PɃ>pʲ@p<)4q)1Oq$2x킏i ȪIUﴕS|FSdqLܢgyS[P.yO<:yʉ_nx!km|'?_6$e/2U^mpe筤NMNղsAuO+BuےVbqɛkJFVI3J;t8|?]6VB2z EYctbRH5"Jd 35ctDŽ GU0)o:j$#ҁ&3{]ԜJ ^0<>2qSATz gu omӐ_j"ԀĐ)O(8] t d(hN`r˷pkP0FDY;:qS/ ^tUbP 1LݛE*k }(gq5yi+BuAF / 3nya:4Q 0{]Cˣl?69zw =]?xW&t\̖ gB0"{|_CJ2:mh'YH(P%ey6fch(f )EW'47o?e`$Q-bܹɧ(1VЄc%U0, DUEtf{/H}s*n @\aӮ$ƫd)'= ~i: jS!R jy-xDN xDpY$C[o@'6RTy,#si4-i[@m E'aܕ$K|Ph̝SD;W~ b. 9bz͞AQv8E3b%VKŬRӼںź=0IT + @ LGU/z GEyK0XiZ˓ptEm$Cle$Q 2#fĤvd'esU5 X ;|:вBۧ7w΋`z*{QiDjjܔ?ac h*BvO~ \.;*0bPT"Dn"E9Şvn6Tz ={"Kn?hԎg0X7$Z[pTYϞ].;hnI%w_)$T 3N+NeT:~ ۠OaYXg%)Z"\% ŢW]qsَ:ZX/cQ3Ek 8=2_s*r2 ;!Rk_ٲ;͆M+J䝁;yfEE d 7F5^?a9c\>͞YmɎL!~w7Y<w<<1ݜ+CJn#cA]0tH45.*_gp5d0u ]/UZ|Sk[oY o/:^ =+,,1&3kV|^Fѝ=AGyy1pE~U4Sh=Zx D~dInzEޘVU@_ɥ{8w3 3Pu?ݒ-BAy0 0 TE@h&'.2Grw]w៞A|A08sb=/7[?SJ:{d49Nm3?֌=B $ DV9zr|'UGa* I³%PM&F)3>'4܏= 6/fvuTL-Dse_8UP@g(>em5$/j9H+`9>]ךfuKͣ[ӚF c !sCRYڢ 2Mv#=AO5&Xu; yz2c}^ "f\Jv'^,9[赾''fdowUd_.<3^ZنMO$o1Q0rܐX 'ߜ1QZ~yqWAœLRY8Oieբ^a{Qx?HH/1ܵ ǦkCى񺉔ez`(?:;4:$.wJ:EZ$pW0f X,K #~ =I߷)wo\~WMH{`Z0FÙm| d2mPv9fYI䠺}JQFfՓ8œ5àL{w8RDþ LLmX('>= B߃i,S Z!$QlĘ !*#LpځoRx>knF8n_;5TyU\%bos1CZ`4Cu ᲡZ;k|N #`,۱w3bgl/ {&SdV0} -OcLP"C)[A8J̥ /i,DV:HYoQH]LoUŖ1ۀe~Bcc >b⇷1z"+y >zTm([N x(݌`ZDZ2۴I?³<Ƿ h b7./L&CyQ|Ӏ# !cJ')잫^PYK:r)K _|M!9s:PwqǠId`#Ii YNB,!a#nbgQN>cWY'nOzj/TyV R_,:gdoFɎWY{'],3`UaCs yy)Isl{j2M .c&#:~6n @J.Ͳ5sce첕i&_+I e{c$6L`DǗh%9ܙR'Z"5<c?f l0Ie~eTIF2 {>+ ȆG*>@oQA)^cW,oN h>RV>?qx"I1R#x^H _ǧ;D d~% &u2Svf8Iz/j~FgРzʵW]7Xg48o} ` rZ!YX]4免_N(cQbjj0!TD3b`9FsDB5C\'j#fWk+Mj?1<;PIaL%} MoʕX~%?ϸM +-wgYd›IQlX{AjZq~~H!v%)0V&cp+JaL'q& Gp@MW'.Jۋ N=;7'O*E%,E~cuPt& | gť]tzNQEܛdOL`u7ӗuQ1j&DLD9]V%tagd#[ovKV4x|Ƨsr5Ϥ:jz|/)[X @ K pj4ِ)b9{,5J̄ʿ" S /j`b 7Ɂ$, >߰\ DX8|k᧳7r,/'/EOܷ9gϗǤv/ &4XMeY/Zu|/Y_cѵF`z'ဍw  d$3ҸlJcF{&/x'U~ešR.IXB~ gvR,+y[?Tڦa<ֶ[ TF;[O .%F r3I7q]כߘTC;DPaPn&#lK@x52ta/X=ܪӥv'$I=J,G($)Tx Bb$2¦g=lފzm`6s4Uu`xX>0Ia8)Sm`:X鶋ex]4SF}b%Z4\[!񈓋di[ !A0y&~&ӈIE 9yy2%c?vf'g-٭P']L@3؜$c(1ZFS=Ǡ VR<b#/x~݃*%ORؿr×=AtY\TY/˘׃c-#>n LѾn! owum L`Ɨf#u/MP?ڔhO;'#?YI˼CN 2HQ<2M{z"k8fn@JvU];vmEQ5-*¼tGb޵?S۾3j! MI< o=e;AHIA>jK16䆽taD)&#ߥ!˃KPY%{ُ|jϕL_-H~!L"?2fU2soKiKҸ:1`cl*qmɨUBFy 6, g)0y@{㵔NÚ^IGҩFeܔ$Dz[cm bXt 8:|D+iѼvvuaU,&K Ib7|Lr翟~΂~h6OZ&†O{+Z?6ő@Fhqݦ3n 6s3:@# YpZsTpґfH$ݧ ϵΐ\6 //p) }0fF=PE_V;e8TZƨ!jJLI nJl#g Q7$$S|R |wfPX$܄=l&l7J|q'_*CAl9g0hQ$0g\- ǓWdzѠa ( bM`ZX;E۶r@~M/1x"z6+QbQ%zEwaɒw1a>\P%J .FqJ65ݗW!\46dUtq7{6Qb4v:unY-L@uZƔ/87+k4 JS2r͸@y²p,i+Pv3+fz8Ė) ePxV}己4C'[nd7#W@lm TI); Y ӏ!f7T& bv>b[9_á5XvGw0?,a%r Eצ7Epp& Iy jp@ eyJ5h|{ +1Kn dALw,i&§%qX9cJ'1WWJ}-U,AmϥIߊ|#Fm+w-x1ˑ>Z,O6e0TD%+ΥCM QcM rDkbUD5[jXEf6q PGGs|j,jaٻyD#^yaIi}a8L.T`3Q/4{C&UU؎R:&/Nr; -@u+B[|112B#^3]Kڮ黮$!Naw$k4#~ pR}~glXSJ$f/*:ٟ-x -}#[knO#u9ty1CU\~γ\{[/qr*n~;8Px:\:n*կP߸9؜V#9).K41S[WA;͝ Ws}Ls2uTFkr{bS1'FP]daRc2N6'cÙ-wnCSknՔq FB]-™a@K;Q4#z5C3=ANն8`+1~z5^_AkNE(뫻8R:΁T|Tf8ɳeFOЀtބlځ<-ty-dF APỿdMAqa&H!G% h{RF=||kپZqBt6 ䷝f!&9hmDs$)Eݹc!T(tX F׷ks!(f3'm1ZiyxyQ}6 7Gٌ"?MeBDju YEE D[QL-.wՓLT:5UblbswJz6z/9x58.v9Hi9oօMF꼹ɯƨ=2*p;zьuyfVD ЕϪ/:coKm( n/˫^.1jl`{ٙMR#VhR6Qy l9)|uzX<\(YG׭ 2h9 `Mq~9qnT IⓏ)feH2LPprsdcުnrU6G48q~o|X qH`w7 mh.TIjo$%թW+KUwvp8PN/@ 1&tjuN5E//cIj a-H.!@(SqWkd/R.rܮ`SYKUDM=_啯$|6͒,FPQUcW YdI2ۧФP̕\hCNTB 0PF]W9OSĽhCKD2btB.z#Jeb5Z++UCЛVpgH\9sX -&ض:!Co8xm*.) 2?_/H'tI91Yp kdhm@;/ йA<: sYk_uXakW3IN0 ag^`[ٙHB^HXMWi7Ey. (_ 0fq]6 a[]\"mn^`8maB%;q'(\\ V5 3xLY)<ϼ95ZST(SjQ6^ ^~ei|Fsޞ*Uig[^ r~n&,,$f_#~|j^csVT3OVF@'׳"3yKQN[6$&jsخZ$쌛E\X=uK \|EWɠvbN`=6AL`ULJy}G=pmNseOˣ=3\Gcleڊ$aFw˳(sͩe0@YeYBLnGuY i au5ԭ$wY|.ё)Osx7i mAv3Dpj59G+ЇxjnWEP= ʢNRAro*YKm3@|g{5)WLJ)UPa!Req٧rP{-T7k^{|9Z)>nv˒F5ҳcCʲ'!mk/8 \|h"9a؜`bnЬh1m*>rw $)>R %{3ڵ)e8mKU|NbFp/RtR{ I/"Jh h!KI>v+á,A22$Q?'WgkML0Z7dtۭ4+[9ҡJ;OC귴ʇ.z؂ 0 :S+xbu /d)@2yd=1i`>vswxȂT9S"eb 7|6{tfl!mN0UHՄMݮz4%k -T0tηBT90W9a}=3ͪRgtjӻIX fpK`{n%a2⏗ӭ;@<6R7͈bG mf"4[cYߜmS8x_M$ n/ϫWNƁE+NĊbeӏ*'kp=_Cl*i#'>6:#nqּ+zx~nM/G&X*ʘE' 0o2u5zȜp S5Ck80*,ǟ@^YqSVךrރ1 .HBTE"8m-2fn*L+<_Fus94i'g˔%57+Y5e1ao$H޸gfyo~SK3iҼA ƃ4 F"l<ΉG5;"!KP=*7);$$i^-t/hݵU]޴~煐krF>ngN\KB>Aq_xd2F[,xcߟxS7fnj)FB6e2!a^!:7¸*zHB NȖ~j"EQ޳a4(Dx*4}Z"*zhA$RfY_\+ jq^G>آS-ң 1HUGSe/d1_u;o%Y p-awkz-B^3&q0_x[#j+٣v;KlqԂ>R@crշkqFI$Ju ܻ!fP3 +T \p&۝$;v 43ٛw.L*Z#=<Ț+kO5I8K;U< @_kCaCaG;0,/'"KblNtb9U9vh nThVϠѳ"ڢ!]5 {" !Wwa&2E,cd+ւz}%\cY B xyFjr crU{wOQZ&E6\-бJ 1gvH,0C;b[۷qUb0ڿ0S h Te+K>;I&r;6WE<7QKaX$9}:c-4ot<=<0⩥Ӗ=vV(ux.i'S/@tƼqe0hZy2j%<[H"ER 05b휽Sl~(7u}ZP3U( ?%Й%_I&\!k~8 4Ěc[5+%ffO_f$2RheП b{g, +J2-=8@yynr5D= G҃4lb[܀ Lh\tSyW>u+Iv d׭<~'W bPmNbFCQ[ ä o+eZ5e._@2mX[qʨ!卝p<"\Lv\^mYH);X,PYC?o7$z/\=RlzޙU:PMQR Ԡ~~739R6Dv5Eh6Ɏ8YQdG.f8؍^ķM$vV2 kMqƦ| 6!SG!2|}~v ,ZaZҌ͍v?<ΏFV`ɀU8͖0 *:jJ{\v"|Jn5dDjP_2F/8~-;RRj(^`:V@̤~`YzSr+g]FT h6^PT!HT'Uf%`_+^5sk.sx:rSQ"O|/mP`IvXS ӽUʀ}8vPܗ.ehZp5+]`Y%ޏc{߁o-n_"nb$4q7=!vY9v_ڿ fI$qF+/K}cjiۃ2Q؜Ħ$ܺ^f:{ҭj+Xz[qg`I u%*D,D{kzd"tFMǠJ@#RE7#Q +ńvUa啌⧭ʟ)k~Bb{8w '؇x1$FAMsc䙭;?.L׊#RZ ywc [pD[Q0^ o,x+Q8~~ ]brUa6H_zCBPHk+Lhf~[ LsYcoTl8OL-HRd4r(v4 xF_'3r +Nâ-~"S> #gH %9 9W_E0TQcE5wQ=oCO&ܚLrj.UrBA 0V(tV2DA/ pI]I׿ 30u8_3 V64y4 b5_4ToZoBb=cszYZƀ$cpB5'4"/ O|GGFSo뢆k5 k*i|!J/\ ; $O|ĻE0&; "CfgO8*2R[#L_A]2{< )g4L޻4)es?(QEhRq 8=ypu i8nmC6Bx I`=ۦ^9$Oڥ p؁"ܽM~P8] jCNjh{H^rx(b`&LYǙƬ IoO=ߩywO 藛>#+H*_2i0"]rAoi}e&M±:5\׏g΂Ymyp5dvG?3{ WU`(5|*"6|n~,1zj ]/{V{@,O KޤAh5>ѴSg.]=[(-˝GY,݅&N@A {SrӺ >!~t:.vQ^z!(0[.Eյ=Ǻ֞p81_@霚+\o.,d}N 4p 'L+ 'ua,vP -(I/taQ7Wĵ,W2Gn$t~dArE]xoN5T96˰ޚ`ݮsH`e^lK 61{Iq9'WP_sl&jq6Xp%G,Gxx_5Vd.ey'%dl /ĺ-\,`r`۾EGվ(whDJ#H>Oq2G%5š[q7=MvDD -[Hma}t{ r9|eA`yһ"Q~ QE_uX:3e]>] ޢ[A,+ڻbkwphղ蔫 F: ʹ`ڂn-A%LEI4݃P56l$ܾ "~M5jTOAxA[cf;+Y?rޮ~-mOTG[r_/Sj^Py5~L( ]ݞ ~\VuXݍkYCVi Ι Zy5m`D6-4LG3GoOW^~8\jϚN@7$t_vf侰 G#%'O!5<'~ @BM 3('M԰ťˑޟrl ԢQ"Ag$5F*MhG' ͸,H I׽a~d@B&{Og(v]n~hъr,ݮpJ8o\ߡ.Vχ~{r3p_Gd!֝4?펕@R/~wJܲj![Օ { \nU&;$ˤ^$ <52zH,HħZzddd|Y$KPt?~N|L&sC΍шk0AvD÷x̙[n4Y8L]KbÅIú4fէh&\]B.#ih"jT*gũ[BÉ +kpӏwC}ػc "@/ )%n#dצ.?_j<5䆲[Wz|KH!ff{9FYұ>T@Zj-\&[G=7.Yūn9O"焋V, o_+OvbG^(WdWOOo%G! l ?#]`?y [L;& 6:=t " 'e!~ajzOqҜF9mzEZ҃( Q<cn|&ֲwysRTw*t7X;WpF7LdZ,Rnt~W!Ӕ@j랇W]yKI^q%{d_@t %r Sa" WɎYC|k. kT^խZ;e8_s8$zP-kzD[ ? K}l txAłWvrLg PW3i>~}I֐o&C47d׏ zσ"Ochr|iPH6 C9E}gD6qeF'w-kCu+JBJzzEmm'Lh!ߍ(z W&4( q{K>"4(K{H k>Qs{Z0KgI&}?$?'Z{/{?h<띺їQY|?Q{*25 J̓{[poDrs5oWP \=<|hVIhsR\%̠žN^&_'>WfLEDא&. g}pOHor-Du[d՞zT@FIKVnvԁfckMV]cp&@P!ǏvwF]˘8qɶoF۫2H/.BkާnJz=e17da lp$`lM]DhPԓ@ʮ7ڌsLZcȊ1s:Uf%_J%Cc :|tJǀs=`p/X&o?REUx1{hL%QnaH!g8B~bZ/!$01ΣcIRvڊhN"J>lZu;i&pX1z .T0R"SwnfMӸ/Q/ T4^y4%p> v~w#_X+r ~߸L vxgJr5w Zf7\]{|uqp_2Ćx>eȄ\SK*"o +rgb )IaVift'M>U-Sg{.̓Q$^~ogl7chk7OTtCuܹ.?^b\m^fV1"AF R"'`Buǘ2Jjl:-eC?U_*!}T/ͩYbZ`S>4boWL}mr7ˌpd y93{u q7]Z|s,ijj]sv Sv5ulPD0(m`{:MbʃEߏkaժ\?NL Yf wfxJ eoq2Zރ(BܵU~9X#8<'0Mo!J gX=зmcYBG@Xj9Rz:^Qޙ_O;,5n+b}sԮDDte%P]Z oCb^RԼ j6ĕ.(/  0"UVv6)Z^Uξ4~}_Ui#UIRK)ГlD,UgZ6tH&?gR?WdGs|!+}=[׌#ܨ? W$HSkn+2z` IQb,qy$F0 aw`G`NCXDPGXEۀզ}u!p7x-tbdf%_X ^?4w[VTg7_aV"TYB|ga\N^J(D[ʢ&Zv!uG\K~zE1fϦ$ס K^7d;L•1y1n[AR_6A.94( jk0 ql&^4CVehxeq)׳}16AW ?[>zQvxzmwES* _'9Ia/V9o^[?SPW;*n#˪+ 7y:Ւ.rBN4{ZEY<`/f7ϠWo}^$.ChkE@o2)迕u kRW{dsנּ9Y&Sɟ©4+ fľ@[Nqh_b8Ω#ߝGCBXn( I"u.Cս_a AO:k>?m Sa@[@ {mšM (PJWɻP'"cŇ2rT{ىWWJSپA_ q5}*8hDH@vW,)kA4oV5X@Vy+&T=q[>)M,X6I.fZ\GM%n1[ܐ 򣙶pazzn/B\975Je2@$El82e7:Y] J(rMUNRZ\(.tv2UM3Rɔ9=!vݤGCVB⌕mh.K.yl=H]wX S`D CjH<\je%! 9Ye|t6514{J^x`HXШ̑& E hڼ])2J=兺i_nu q襦}C>k*fm._(-0o޸ڤ2ĩvK_U80- e5]M9)ܟ/_BrWFW:#na$z)4HxtyiYuOh8凎s'6NHn$'CïYR 8G+8n$$L${y]t٧sҔF Ff#ZGX`OBq{t'h%"p)'"'=f BiUYۤ5H64#H~=>(>+d(x%B) myq{*FBL!$oGn%0T40  ahџ 3NzN;COjR^×4ۨ&f Bp:$V25Lp|NC'K.•D_>Pc:NcM7U==x,-W%⨝ǽMEȑÐiUޯ+@MW,&^J"}kkFӒu rJ+|  C' aH ȯF[Mo_F#eb"Ok`ա]2Y13M`=^׵msunS%B!Q{R9 * ~(5gc IOB֪L O#OwtsxޕfnCC/ YSC!dtGt Re|;Wݮwe@[wt"uR0bff1RQԱ5M<4]h@Q*gP,7 ʙ4%b OsV1Dgj1}o$lk"*|f]8CC-lr^[tg_3"A[CwSqh]Q3 IE9BRg$&\:}XjKwP;nb?V3_}$&[ OJ5d 2S7iM문`:as=\C/~װf( n>4ֵ Ǥ,-tU݉; 1MYYǯOPre.=+ QK#"]"(iъzOCf_M,DXŝ~a;b׻insb?ɶBV8 73Y|K !X}D<'˳K/fpo9_),ݣd>z]UBlsdIP0em*S@Й/0;X.lE(ӣ_-aJ[ Tr7j8\BOnή%7T}֠zŗW?M DqgKPO.}{ȃ%p5зG`v~_:7KzIn Z=ځ(D K+PYoB6tVyYJT*AS|) 2L7H̛IZc*#V !|P8" )ޑf1UƟ{2Alt9/ȎXUC;i> ѹ3]I$OXE thr]8|`[JfhdVI~x)\Z,ffŤvyEhq3,#sZ\IՎ[JHذ³!: !6 u?$7-Ǩ?vCBRglClj[ *ƓK67&1>O0ny֥@SZ|''v"4#zP_f} A1ÕRV6j1fpȸ _ w&"ܭ41Kzݓd0@L$iX{3ݽ$Op|qFX&#g_y0* fmXij+ 9/ʓTn bKauhj0 r*w[b8ymfϥY"NdKɍA6cE8sy*t' *XuOXdpX& 3𢏼Xߝ{kqI抦70r-K{d.35)a(c#\"+^iæART0_PKVjTq @kc . >mђ:ìtƳ,%n|SmBTSU1<Zo><}ldj(Jd_n_ srʵ|5H_!V81+`nL}s<`paiuj]DLX] x,e=^_HԞGhEk)2 G^=B@FF'vZ:hFztZ#Q:?_øğ`0;0O+̪07g a%vxur9BXOWiR~̓78VF96A8|9XiDSʓ5BZj="oa!ǧL䴤)&1.G [#J"UmFG<h;:_6EΤ@`V߻"(F` *X2v^CI:Y֜ـG#Ri|֥]Z =qtڍbiP=Dd9 )RI_/#)S`C ϗXzovޮCs ˾#!Nm"4ֽnbJ"- sKy73\3^9E> AZ)pW>{4~mݣ=OEYrqcy@c/O,ՕJI^XRG"|ogd>0m+q(Yv٫Y6;RػǯLe|2=Á:. fx&AdDH/;iDs_<_R~M?ͮN?0͏:h[gyԲw#Vf%0}:29xܝmZ5aIx&PNa+\H%Zwkկ-еb=H(q;G}D*rφ' 1 NcWߓ/R\𮹞z`5%{zL+#\f cq8Aqp|yo \[Z0w!LMYrv+m׉j΋Ou/x}ϙW53 f<` jn3[B懷 ̓ Ywr+%yds=|QV)NtFx ]՘9#Md8LIQ7qO2l "Y[TɄkmx1e5gcp@?.ж͎˷or fI3oBq+_? gݫszQQ:klN|`5Čf B2^rhb{}c2@OEK~!(ksUrkM%u֨tQuECBIw(Դσ[ fkrMvRr%1}7sMD9|_F{ic{WO>?b*mg@WZv߁wLa _&.~=sZ7ex״Q|TNZQaW&-̜^3}^yY޴|^BNխZÈ%7uñS^C!&Ta{/h7;!v6&j\!$F٢ONk6nc Tyfv J6m^$y*ڻh|a EZl6 i$wSDx5YhSh͟Xxa7/.4}{V9e }*׋ _L glNs= ?7|GH:{iI8m56&!u6@H9uSJJQOM{Э'|$ynZ,sjU046 ~2$3:C9<$:P8⯠lԺl ͘q`x fxlv!f_*<"Ot|ݿ :V,'&meh࣭['`<bM$2ݵÉ$W$?&;I^ѮDm1r 1zAM:sk\`3 C*Flg}oPS78T85y 0o0YB{P cQ)Y ! ?qNĪ|\\c T))xq Rfەi!LYqID }LkDiJuĨȅ"lh)]) ܥ ʼnM-WF >"0b{* z)&Qބ:#&Dtp%iA1H?5 S'a29DobJdfr ս"T!Qx?~vTq& _LeMel1za0lUc; x S5ѬLi be!0w%ΫvN,Mڡi-5{uT첪 2,2:~Eve6`]v y.*HwuA'.w)x.bJYtgKX?Fשw: eAdM ׋,R+Fo >;xd<{My;gUNTr(dU \إlx *̖,oYW:ޠ`Сw%Uq)2q&P36)'70 IW~LB}f U)K="\)#qLY 5Jn@9~Ǵ{oYǬν,;$0~r ԁ?<0M3o!#/b5=ZhC0cAz(>ңpYap(;bZ1epz## 4c-`.m%W3Ѥsf#fP̼2(V}wӨ"5WdLQ nnit!G}x Y"YIR^WU2͇uhhC. zs_l`d^);W-Ms$)~K\Oބy7o6.mTOP jaUBzS_.} ]$8*tPwIt oQ :$VER_~ piʂcr WZrEXD4u8h•@ bۅ歍W6DC.¢ uR34a MK /6(ԡNWȋϑފ>yrԊKTSA 2#B*J{f.j=c kؾD:r8U+^[~q0C(VM8<:ȠW6hzue[ `sfCbts|y~֡g)~ TWW tfRd*9 `4"aZ1,M^sZd &q.oaN+9~" b[zv ~~:Q^:GXqVbw PmVNs^hRmx= H9q/JD Vc o:0ƎJ0Z̯"A?Is r8<6?)W1{F` eU;-ms7? KzS%AvE'+R0sy#AmsHT.z=ՓaF"Gl ZXѤ xe2}퀟'돱d2mXdP!{B\ \Wr+PJz/gfmLxr2n{ϊBr"d`BM7/䁜ot^#~oRnS>0=zp" /( .펻`1ob6Y46Oj"T驝RTt ɻ.HR"~~xrU*HLz\ѓa;xM[xhN-f/Xhhy۶c MAݭGȇO">zY)N݊1SI:5E-;x}VsuiXƏ 9*0^e L)џa{JEDtl!XQ[kqx Jӂ?Ty9cǘz#Щs#B#AY2Qv \:]tQv6aVX Am6v&+n,?a*:g&&{P C#ЃCH 17I$A>\BV%=RHBQޤRszŽEbLL#HY)5]{5F..z#`~NU4^k(;?ORyޗ. ǜ_vkXJ(g*02[f=صS۱p&sޣ65)l5@ƂсW<` ÇE|R7(kY0ȫLjj L46 T`2v (ElYΟ.:1n[\ C5fEZ7GV*p⓸sP< EF:דu{νwљ ޴~ʵ>Q=P:g;PsBo- i{u8kbFQkf޶62LyR>$}$e2c`- lN8}NP q:5DFGO$Yp~<8GMґf"S_w y Q%Dx;>tNQMD I_I >^"mMAɳF>qNk9f0=d윮6Ż%"vAŏyƈ\s Q/bgj z 6̫o3 ƨ^S 9@3%K6l+Bd `/OP߮Q`,A%] wTٜi'TSg^ t%t~:۽i0hڠmWRtɒǨ8d%AߩOs#iuI%犹tf7~cR3Sa歉܃F3[8Lz<b`5LPYhzIiz&C&\Ř22dīP^t7}YU%c#VSº%zgX o$r x*QwՅ7squTt+-zo'd+$|c!U 4C\ZbzF8}y 3* «Hx/gSwX* Q("{}[(PS2G?iQ 0'ek82CP׃nr ȗ)^V>%nQhpx߭u% :1ns+k\VNw:EloNQx %K5@mo+ !"?/ah|qWwQ0d-PoN ywzJ-w(Ku Nt,Gݓ +E4US&!>*i+x/zac~4X Jx~H؅Am8=SF/[,/+i]=N:0 yYqQ 2 eٻb7Լ[L k&Ӝ_E;/ #:3^2&ڀTez\{"~ =s.}m_5ˊIK<W~r૰9TB/N_W^QwAai<=wL1fdHQ{۹y)aQ[[D3=v%bpW޴Z8w;qE6Z>PYykg B(pt)ZVT6SToγB^/] ~rU%lj#7֗ցIy}Mrܒw'߇+l14J 9P=y[/7Ke礴hå#P d>^4Jj-4HzXX,]c 7K2ƳcCdJn ߿=9gxic=W=O}10pPUa⹤vI ԙ,_T[̓/~ikJ`P-E6|~Vӭ'M ]bylۿ"eٯsGD}^aADH-2`'Ws0l@\OHґ& 0.Lԑ@wl&fm-ouet.4"6ϑ4EdJsNg εBE,b\ Hג l&Яv!s*۱gV%dgͦkN-u9R[kخx%/}Xz pNL!(DkKw XKXHgNK1m'ʺ q%9q>Yү!t).bzks*uT1r2'V3h12|J=Q %YRJV 좭{Lzw>-ungX鎢<],qV%ɇb(~mIIU=6 mKm50 deP r^ uCvɢ`6aH_$+>l_2bOilǠŬrg'ìpU@JgKW˞5Tдϯ xmm~--9_lvϙ(ۡ=, U/)} YR# yhiT͟1XYfAe$/.W2<ݬ 'mmkϩ^mRV/zB^ CA(RڴQ~|e[s?ZiqƻGFn< [&4;^}.=dMl2,\slv7Px)2Z}S1yD醵f(\%O>XMTPDoB/}q-L=ZU;ima<;g2ě4NȤ3GSeFsWp4L-+ƥɥ 93MK FA 3 p˲o6AwxfibNj}.x;|+1KL{i{T̋:W͈wLߥo@H؍G"w<9_N *-b]s>̜0~Ǭ 687j~Չ[= %"g;8Pҗ7]d0rdJtO|TRHUn蝗.e PPhjѷ fOL)Jth ^ۍ#Ë֯>)|QGKr B[WP߭>Y)lIԾדRe$pJ6!K-utCVzr@խGYӎFed~M;1]SKLߺ=&]f(@Ĵ?/HV. 2HhWNkP@Y U4s0 _Nߗhm@U)DAlM;SR50K'^/}[$K3"Ee @C'w&G!wIwU:#>Y"?Q ]>x(.X~Z9cbL Ȑs]g OaNc[ǀJe-AS&!+(f ̐:u=rĪLiFh9#!Ԛk[~ #W #XђԆb4oG{KVG:,9U0>l'4Z =PVvP6y[S1Mt1;kweIhsH%!<C҄(qY{m/^,N{J$*=g fk3$~J|'ߡiYϵuYdYO1ItPX/vM jkDv}Y嬃T?\ߔ™rǯę6:FJ:{c. pzjQKg@#>=q~vގ==w0y|R'%zUf4`Z8:#B_m6ASAN)j{L9S,⻕QPo=s @ -$|Kd*N[ H< Zg>ܵzpL @չ8}y>Bd;DN/TalL)ܔq8'j{U&2Jà [''X/>j. FSi("Vag#IGCsɷrt.QvO4r"(; 6/G|+cwkXk/mtWFU`o@,ZɅVmj/.cm.yΎT; c$oRj7Gq.u!5J.fNB>\^oTP=)iY J˛;p9\r)z34ń#*U:XfѲp;0;7j~K2v= a-%V25?g@6sY"zxwex}VI))Pv_lTMJVziXXQe7i^"!aRaP'B&r=+Qz voQ@C݃oW ! VdccPǜUyCa C8]hP K9PqsRזMN4V[L۾ }ܕZI'F|WI Z NdFjwoorἡxM`A6z!Y)fdcj 9.w Ŝ}ة“7{0RYvaUh_}?snoa}6tyH2]bo,~Vb.2 ޝw*U+ ||(4![/K᫪=l Ϙ hAuID1Q̚U1v9A7hw+MsA8(b“B9c[BK/ 4 x1m.:.!R]hШE;ҥ$?4dpUcvi-dXͅP _G g&#&xe‚nbs֚ј$e!_ ("F|`r||C(Thj4'{bUlSH5V5GoiY& tк~Ov\h6pURDԓZ>gkP;|bsd Z4PѼh T.xʟhz nl>RqQK +mGF⛴:yLb+eJ?qx(HuG_R?q)+ ^_d :_n޶}Ub߽!'VM`(GnLwaAi/ =>7,ЮԳBA 1 z-2pl7@P!ȻK=zlY C,!-9 m*a∼ô)]帇;pWuXc=X~=2C G?Ue M?"`)|{PN^GOEyU9GTf/PD%&DG+Zmrȭp4:QgXod8HY꠶PJikD;hZC~g|;rǍpRxW|~X ,BUzvEC0fM9^9<˂赫d]*|,S iKRiK ^!OehUB;.<UԇOXقʪ5j+qEu1$dhכ)pox"Rv LldEQbV& .C}]LgԷ^,Qڢ C~ xTA֡t R|G(qa'!R=nFуvN 6aHʼQa zƷuvbp]+Ϛ(<dk] ۈmsg^H@yVw> U/4R}dz0YBSԦ5j!ǧwq0Uvamx7 #YgN5Qe 6.ևNvi2ū MDi(Z ?IrS-|(sF܆y*s*?4M_5Y݅θ_n *<9꿗۟Nq:qIO+ xTJbδ!ǂ oHʇ\>~H>&\:l#bn.н3h l.gWuiC8xƼ~vj)0,_~:z@qBQs^'F8ߖem˛pZI"໿@^a:J_GsSmn <;ΣWE\ZigD+棇r4L']l (pNC֖v%mVW$Lq1s|lo__ڹ nIփ{-!e$gyae]B>9j(f. 4C,Wi-Aw UD\pA6+fC/^dMD9OePV}0|ej*BxtoI{WSEQxK=&gXydW7{&9 0A:>{{V1(ݜRDWp>R9H%bd l?e:<cu45~u×^;+ %mB0Q<ۅ:n sdB *wp9) "ؕ9tV(ocԡ Ke쌆i w?#}~^]z@n(h#:YA.DΗ@SJ8˩0ܚ_؁,<)fkm$U_b*㥢S KfuxR_d`c{[i :\K08>.663T9TJ2@H~<㇑1]t='r%}T'Q gH4p {1)XBApW37Ԏz磋L:~5(RqcZ$.XYot IfQek,\_"'l v)VcK> >KAS8ᙬaF1k=gPn Tpc{//Ii1Z>"Lwv~ 1*d4?;/oβuNg*H_sz \$<*.Е?}nMlܴTBhp"emcx4njO:WpX8tHt#TZԛ-XbME2go[%Mn" AӺvQz%<X!'8>m[‘veכ&F5TvnG\H$T&14kXeD]H^-}˒ s]wuЭBpO U0 WO&6p9x,:5}oa6{D !NyO^C)3h{QVR!&z;(3iu1dN˲L۠R7Q;!l#@BYDkpqd[I:Քp#1^*V] BMI68A.SA@~fA>O,+MtV&gDԞ^i3i#J=? 7[󓐌!8E)胠VC R.m_*V6.HR8fX&Brcjl&jA/9;u[}ቾy *ƾER$06]Rzש%1,9 ˃uJ)=cvS)f? - ȑ=`f7X᨜{L?p  >xMz*z*CKcxc,~Oȶ%"ĥvqse7b~sd# ~8h!h9YKSw1P{,ǦHKC(wnVvn A+@ f5xh,q0dr5<ײ-"}ݞ@Q0BRw3T?@-7_״RV v 4r Iuܣ <&@Ģ(+ߣkXB ]# x9fFG(3ånX(:jUd_Z3{8uzT*8Ekn~:*iO[49_E(b&GMNRuX!Q9hJ"r_W}T+~\GR@gmeJ|gX+Uׇ}CGc>:nM;ɠs>>s8zjvl. Fgs 8!Q`7Ԁ'htT("p!?a KbNå27V{/Α 5:YJ@LdHUp~q옜h AmP@M#~.g]# x*1<@.>򚧓C 1nϽA]犹qB%O*!~0!"j,ۃ_46hbڱV|`" )if !I{`_<5Tz̰'3lұ!,&=R CSJY_O*TQ t`x4N )WC52.7l$ؚkxaѢMR)+G 0<`pTs8Mh =m{FwT.w8/R4 X~D_O^G0[!T<9a+Wr'/?Бw1{nɹvZJ$OPvk^Х'GBdڿz]^x2El/ykEIL?yY?$o^T"Կ|d*Q C` dzD} a"{Y!^;CU0jb7$Q# \#_D׮j\5Ά^L6PU޸a1RXLmC 7?5&V*Ls%JЧmP~AtOf=5j7})|- =\h:uu,`eCtIIii&!C IG&x{0 ӑW9M\ QΫJXy|1QPk//rww636o'Pǩ+/&^En貵; -g7{{P,d^|,[7eI$L'_dqNJH¯s|eFɃ [_}Ң)kr2m tH-1p$)KQz^&3^ڞ~A=Qk=ghMU%zUD8h/pCYBҐVUy'l]gf3Ln8#:ra`gm :r՛lo+Lp@"8ůbȢnQN͖D s#R<K["৴rU?vd)rͱ߈\F9K)RC6JߜևiH;&6#}_O%D)#ojN*ΜkI󠝧}:I pws 纨5Mwg9[Õt8dV]a^t5tHvc+MVNsXMܹe _}u,Z.>nLѪ;7Ʌ}I6%I+-69b^31`LZh~o{ 9$PU&'R@2IO*܈Xū|LB6Q %& ',0f_1,`4iE/cwl Y}d]Uz0+$/Lܱ{RR&elvÏ[ Q Wimt=J29k^ "5_ Eus,^+t`I]r\^%Xee[ h B#SFڱZG4aDDްfǦ QD47_wD#({EäfE'J z@Nh8Ř/5A: )˚[xx,tXEܐL3G.H\AYPGeM+>~]_EU3 ݻkI$NB6 lhZ9Kj,ZTk Q%+돾;¢!O bW'7$^{  쭘_}7Sc *}Ꝗh"^␐42׃2Vo=u5Vǵ7Ƥ=Oax$ HZ3D^'9/zA^b` ѕq\^Bd(k[Ӊ qx1M(,|Q|ڥUF3^!@;x~CL-(FVEĈa&՘oi.@2--35uKw@ ";ՙbq"rLu^ϪC$6AM]rk-?8O' rF̆a'X:'R^._ۏk]4܎}L ,|e\> hS\n 2Zb8BXZ(7Ikks|Ѣ6+Oqr:|=~q6ۖF*Z״R,ae*l!I|3)?bW 6k>6KHKu ;p VkRDp i)įwzL,o~b0j9|J)FW&{6U!!2 P˯;ķ5<*w7}kg 95.>ІMo,߇W K#y;\Ҟ5YAZ¸oca.0hgP_X f9lNrb+WRtW^H~s?=ɘO@hNPix}{@PY6Xu$!Zb(v'CS%˾6f^/0a>1r}LuC1YLmd<?w}|}'g mNڅ7թ%l$c`b9hh?jvL>Rx~ar(O"~wv A ;V1H5"\oicb5_ 5+;HCCM޵PHc7;ؿC);$fybtMC܋G.7JU~M *6Qp.;7s8.ոyT0Muvc)oCi(r+ 3Uw3C+icu@|[f 4ϒA`}h4ZFƢ6BE RVځbb lH(CN$ISW,#@w&*[t][It"Vx d/"f8|rc-iDMiRιBm i2@j.Q)+,Y)( rM7@:5s,<[%9&gWy mԖ1xEPHsW>ɋ΁ibܚ ZP*+^2AVG߬(Т? k#3CA' pڨhO5 A996.B"NJ%SxAI/[.Oo$&?L7X)[ 2po9ƒ.^״%R1̓Y-N*j%Y,5Bu "f6=/=v!Q,zafM} d i7~b}6`^ϻng3rxA\H9fU42޺t+~O7l'\Jk?A E$JG%XQJNDbTzpN(9brqf2^W"Fpl\ b#Rtf XBh\Z,/B$xkIW݀qPL\ӲdV6I| G~ T|ߌhr<(Aðhv-h/1 0x~t [;}C2.^aA{^v6p)<6q!VP騖IO@ϸe J<P[j0+ɹgsS6{&(;H;#D&ǔ MGO]cftNzZ%>_q/DS53,:+fOb( ƪ'j8. ߼JI ngWB\]!K>lﳨ6#6w L@?VĂU\`9LqkG]IQߨŀv,+ 0`n-ѴǸ^3Y\*z7@9,qִ#Eb.-/nXdF(}G)p^c/z=bl{ t4ybs/X!Ts ryr EtLHVaԫ6.ξ?l/w@%ӕȎ9:e*YwoE'`-]WKxicj6˝eV [50CV8uC, `@F<6izu.uAԄPﮪfS-w摌&ڛLz!,q US#wU*v+'/{rOT;XʔUT.p#=~ڃy63F~3vz6>U=kxTJH*鵍&&ux>jPHAa-ҞUϬ;+ic!|g^c6ClONVLi8(Η=|,!G(%Ff-[2P84%z|%y[ ܻ;}i|}`B< W('~Y}Babuj,ܽ%H΁Zv|n*B"Grl}4<+V(EߜCFR; [h&D[ւ: e$-JObt2Ӿ/p( =s'K' #6K7_\_$`y|븱"/ãy݋,,QD#B6JG~Vbz`q!@U{Y@ EC6_0-CHaiVВB4KgӟwxkOΦ1}rКhQ[W}Jy=;T7|Ӗ7Q;G9u:篎b߸oּט.AI\ P85-w򨳆Ea.Dm=q$xD~+|p]Ǟ~=,Y'S&{ qWu3_b>TU*1p Z{7Q3~46i\c$i5Pm*{ ?vy}qpWĴyo!cKRWű`Iifs>:궥u IRh3!;=CN$i#7gH|!s*:nm磑BB-5E|x"g";s_Q>lkOHJOHՊYu|t=ng`m|8)`ؚ -mF*5IMr4݉kԅT}fmua A"IHg1[Ha?.L`pahjyj|'qk}壬/WEP!LT|BHv`+f-SWE %eBU6;#%mDZajoaK'Lß)̀Ses׊|cF+%3Ť!efwR(W#/HɀZQ~L8$Q]~5J 84 V߼FV5x|d1]- h_XMDmQ rA+y;C+obdY+#9(ffv)]3+>$-,f@cs2 Z [ޭ!nIǾ%7vIII@fn因!Y1koT6/e\{N7|8J:n78?FXrMB#aƶ}37QP5U4oSFx=ҙ<geBlé-e&pYI8ʩ(o!N3(_7T(1LVu lt6Ʉ՞malmދM`yт .SG NdpWbYȊvPJJL׆Cǭ}0rbW- X7҈iwN4Z#cl="wBے]†}>`v6/d!l%N -g4jtj|OW5aG|ⲏ>J&q},xugtrv5L 5Ya&; 3Z6쨸Vf" :GDe>4^5' xLDf(F:A0bQoR@e!ojcw}K”ף5zC (~O,XOb?"5{\7B,Y?5t,^Jt$Qf18#rEv!!Bq1H+SbX,ysMT75Xf؍Ar VR 69XPGyoP|m੡a3ja暍X(D'rQَ΍{L=mN(21Jϊ֕qa~$M l4W .,zigCC[I$d%[a 3y\qL!EwV+*^$xV6.N[ê MύT&;ݩ0@#r%AЫ!m^XhkR˱QU_ i>wV84o[=71vpD^ &flO7!2AOw Dy &._cX@%{!$D$[@PuȞ^8{tfͤ D=tO=m}R꣍Ds0;f[Su]~п H1% $yaR~sp4gѯ#U\OJݯ ?#M~Qc7RD-h\Jiލ*-39^nL ۮv(PL!> A@\rM%`/ < P*O Ǔ6KYHu}M.hMɧUgKOr=JFmS2_;Eج!v iȯڲ~ ޓ!E%SZGH7?bxHҫFFn5B>CK_̿~^e]:A,\Y3D]u= C; ]Q2.#Df:eGD}?pZ.#D%cV5`q6 hg.maqϏ9Z-]*" *04{['^P L7)eI=_T|}"֪>RL= Y\وiK ߓJ[c$A0 E$dr E^hʯB``ܦ )Yiʍ|gO!Wѻ;i$bgx RKs,:~[wB`ذմJFi1lT*S?ƦY!Zo?ة$0IY>L=`W $嫭1=)#}6 @G ;8Z5Sϛ|6t Q?,oߙx}mBH tց_Gܻ3~ێ'IJL<$Aj; J[c > %m$joΥ\AÔ %$Uj_3rN&2oI}T3I_{#wBQ}lH\~%pzKK cA?[R`ͽ|2mWmeн&g>]nz{`{92'FX|8c(OxrO3۵mIL.+r(JONqLg ><gRBV vѝ8 4Gv#Jۘ%?fߺѺl-HA\9a[;D)Ё]t+57RT7H ·+|4vKR0߾[y[YLEzbC9OhSAA*\ ^='^1ug<$g!(P0 D 5pS;щ bJ PR8ԱѩM*',0טddrL2|с6Z-W#ˢgri~YL:5.Akm-{Yrp%f5Kg/sg< =#H׹ G-n4 DR.z?;`GKwMI(x xy(.a}]IF?F-4uQp펣_n>_otoG"o t~S2GYFQX8;sM5_n8ޱ ]I&]l_8ͯA4.AZsyf4:_ 'lEgg9O(X r$!8GL^{Vx.`tڟͨ] "wfM3@̋|)薚KaXW}1a\h ?>;V92 OMF9+PH|ؒ&|F*o!Y`,0f =Y}hXuX(yaXI:9oO:UV@7ȯ僾 4ueҸuQZmĔ_ ٪ n+۹_VUN&Lh7sW^a(ծc9[\+u%7MZ޼wAnb`:آD;2,1k* l$QG=M额#M.'68qwz^ZJTF?5-RBZ+j lHՌ^E#ﰬN0&xxJ0=<'"lB:z,P@-RqGO a#E; #ޞ]hQ cjB3L/gVHKl8\JC^nרyNo/& P[ٸ&+*h>IDY*€хL70hª;F9(=4] zѾ'[N}u0+KمF Wl0.\ba'gӘi?k.;}z j j *$ w+%?9VBNnN6i=xޖ~Ua L=y;IQ"}]V_(!T0_⒅"F߭X#٦aoJeqϱ G ,OGvm7>SA. @IkJKDsHVp P43˫lua^Q ?_ʸ +kYsnQbt5Sڗ"򅃿~m#hp@4O\^Lݻ MZNfA| [Lw CrGO8S qJn,o=MEB'[N5;')  Z^JKZ|S]6bЂD̝rb+9dӘ..oՌ缂nOr\MCkǛ *p_,F*66W_bGw|͛  d֤cV!O2P!@a͛ NP;=2NZOȾTqm_-;j5 CP{ˤM7lAZFqZC/BwIr0Eq Iӕ m#^q]IqZ-LZB$2wgsQ6Xp~9Iu(U {(#Dez]BnʦC{_*ٜ#U |ᇷP^!>i.F#i'ըX-EW1Qy׻e:YL-*U$P36a+xto)p^x;B+b/t>CB1Y*~K4Dgi˺jsSEjPݓG?c!I΄.Pe@sFē~ C|,=PcNg$xAb?r*-[4tt;%2,%>χK쥫!60u|Tcڄy?"ĂZd[@93WlP STtawΉG%>Z$N5C쮃@{6n0Ot v<]{ gen+Ζ@%y͐uuuG[ڜ_7ɛ7]؅*[05oIRLq*b܄h?Ei R^Ye;U &QNZ64JnmOb-0ecy ;<,JLԱ Ƒ Jm/~]* SW.#Wm[R5R 0±Ʃ5Ɍ`ŵ&WLk0őMD|j1:(%R7\ GcޮHr]$7 Hf??dKfD2!,]zUƥizw&z (X>BPF~ N78'e%aJ$zaI*HטBpjg~Ҁ6>{R1!iOR ͷӻ cmcp>*+ 9jY?U ߍ0Y3*"MbT' Bop_†|&3= buҙRz蝐|[0sȓ7u#%}fyքZ qTΞmV 5Ӷ[?s/3nLRewZ-Y)1GAjIBRtSlHY[ ns13v,ʪ'TBTSp礳J[f,fnPLRJ(giG AUIv9E&٧SRJr,zDAa႘MVM:8ZAiPd1{VgVb̵:͚z,_0w9l.5P.WLTg2q|Um5U6YpAT&\[^d:?Z93&ufT`GoM@`eH="7Tc砯H0DL,h5]0RY1Vϳ@k+ӹO$p~Or{*F`&p՞\.vGV^k'R[> ~:bxk~8M?Hod 6EO`PnUY9E}kc@|ʥ&E;"KNWcN^q6BDZ&oڙ/H[Qk[:?u=oA&!`QA b RD`E?D MUE9 Hj:p\C QxNCnWF6qpdܑ S 8F"PM?F;kc$i|;A@~7RҟL4,#gGx$gX{f^"Eh;'r>qp QF g& ~a)'_߷@X`r©г+22Z#W(=[ց|n_1۬fPW~c| +bVMߵ>0`L*ۿ֯ؼ BbE ELZT'%hN'Ụ̃dY.55vxbrwTx-gKE6ێ=WAْxPAr#S BMu<\׹y{#s|Şe\r/@OC34@Ȃd{3ςM ҆țIMq20(YC5= ɧUN y<0wʧ < Ѿ`7EVv]׷QvjXNLulp8j4G^7'$ 8֭oN>wV'5l*f՟ jS|PS6K<6Sszb:G:k[PQ'QS|Nn|D)/Ztƿ |{rFr?;Ԉ5w|o1CwB\qyfsEҮEO9NHBQB\bMݽýipLnpr\.5<4/XIN=Uy*r*&aDg6fT0 =[_8B>)~ӡK47 Yq \Ӭ|:@RE+p̛e}<P<r )Mrl I}YU\x+IcE~U1QjD$IusRDdU9#Uh(Vg͜*B;(]N(/:}RIM\@%RϳdK5wM |3na>=SYp{64~*[?ԃ#\*E ^2eH* wi|Wٿ*Ͻx~ܦBb2~LgP[ /ΝPюy26D`DA?̪@6͆}>)i*=w; LB!% y'-~:EXK5d@[n&纓dic^0'rVJ`#\)L7 ф//^H%WxȊ`rqY(}#h8X0gE9N13LX붚=V8OcX . {\qKor!Ҝ2UEY%€aWƱ>ZHF;u@P! wIq6f둞I>M* C|,|DbǙQ^j SFg5-prr M4; B:۝f2.k̷g. x#c$ 3g'Z`Bw)<օ}}_y. dww{%%Ph Q)DSКPY8ʂ9 '( V03f[SSRZW=kz6"hBJ>jSphAل Q_30Ftoۅs꓌kfXI}ɡ^%id)ncQI_;.W*u=j!#=Rg,uZM~6&ɓEL p Ǖz(CkMW%sxggP Wi-"h5nQǫ݂Zc\Cٸ=k<^VgAkϤ;SSDLG =!ef:w5փ% l.pͧn1wbKȯ42]C%lt|L}rFrڭh$͉zYeDi+kw=B LlK"䕑%V)y<=J@c73MN~I\D([7P PpO 5>8˯;WA%шjb_kH+|SԇĂ86c #8k rBѤ쏍4b >>!{]`Q|8 \\NsŰMxyIУCI'cx`mꩪrI =fbpTkQ}٨Z @GUN&}_0!R5Q?J1"*Q8!n =%h2~<6T^LC:ߋ,3xYAgb6߽K.MV< lQ',bw")4n0ۤ UC,b<%Xb )eɓf+ Fr\ Ab8q3ψbV ̰2hts<$˺c^fXg`3vkHpUñۼkvzX <<{zs:9 +x}:?}r f!{]Jl˽qK,v@G)X.]R|,o__OO+oDCcS4=|/|HyKGV5/y4<~ɑs&S|R'InfKhNIij`Νy{U a k%,7MԮӉKʽ6 ,- ?s6 MT|qrf9ęf?F٘"cdΧT؜+MnрYT*'@- x&S|ɏ&c` %Cizbvh@}g'Iޭѻ,Y޵]JWR'礳C.O1:jdԆEW=F )xiP6sjUBAՠs}:vK34P+%P(Lu]L"'\ef&]fZ{MݥA[oGӓ]4M./ 4ߚňmQ?l)/_Ǭ ^c,w}\. uŎ@#JxX ѱqV0vxyBmiʖwNwh~\[qp)e'"Tȼ$HM\J?@{&oD]!n%QWZxF_,pd=r)!0OsźA97g:DH GR3>ߚR@.(>_zE=Ol[\F2مRё'Zg M%E@ ՈDu?p0$zEת HNA2ߵg\|Cڃsg,2F;rS=ϣ:-5#Kע~XLЉ7Y?M4IeR]A7h=vROOYF-(=v&|V1+[u TrBu`q SGa|S<ֻb$> :zVԇȇ؏6Ww?)[^`كM6R eiKl=';+~kS O`k'C@~Rnk=2[}]Zrvpu1!Ҏpطu x{xZ-윗wlp9`w`ǻMY,xGmгQ~%.W.OC4q`0*0tvQj KU1{f׵>},Ϗkyo8-;޸e'N# /u$#ͣb"bVզSTO5_Ѿk ~##]ʘF >Q"v8Ǽi>g˳؃PP{nީ*?qbQV ?&&q&~4%R* h̍dsڿ9P>tyhl&o)9:kTIx&#V=+b(qKlK>L',iqBמbuj OY dxz⇫XpD#Oaܵ]-j$))[H;KELWdBl5He--cL&#>l0`!I42z5p+LpnEv2OGyo4(n9 縚ffj r&5j84#~ðL5P b[ט=F:__=kʢC M T^B+q|B ZS뫏Le`DD13Qv+h4!CMS[.&H:$2yHsV2Aiu bh\0q_f5WYTT*X 4# Ƕ X:K6H'$:)ArTL}ЀD1<+xoWz*`L[a0Ƴ5㫒"W>cU/c^ ϥ31 Ʋ%uzܟJ_E%qLS$OSvÇ -I]da_]o2? @rX8 CI)'0(IW-h/:ɶDN+CS4GyY  uоA㕻cgꑅB1)3m _H疻ꇡr`mxEǚf]y,9NyJ ?y F(ejź| ݀Մ;6}̗tVyQwL4qJ7m&f"Qw ׎fLkmP`@W=# R(h*,Q`cblAV&z/i>DLZ%-H"'ct .Ó,~4[}(N7oi.ɉkVSjNABsd/o[%17۩4Kg? 5'^ZAN[䝃S#{tiy;HڝVɑ(lY%u8:U3 m\Z"ITZmyj1F}M-SW饕G5(-w J_<#ss*/Rq@w:u%֝hP]m p$yMs\4F1&5oZ{*N|QHNbMtGx K$R+q_L"z2oS-qEď;RDŞBQ#&1qKH,hDɞC ;.3a-Y4oʣH[֗J-Igu׌:6.ke!f9 alMb~Cmȁ""4@*\YL~ՅR(+neY#GTKZ]A~[E6D^|ۃVޞQZ@Ѫ6>5#l%*:w!\FqFE@g<3w沝Ji dS5tqOIC=cuDvh&cpԃK?чM;͵{5۟Zٍcmf_÷ܲ ]_Mwʕ{u8sdW9iÀ$㙦R[~Ti"){aOk&`D:Ѯ-T'v ӗƂ`wŹmuLJuwDȊ!ͦ~Њ zYv CMb//q5#`ﱗ?.DDNȷO xEW0x|E}0) ռ43F'ðZ!t7׊zSsJ$mI ?nZ|."H/5CdI 3x3 {bI,FҎ+2Fh\1C$PQSzNYa9g'4 ^>.626_k1mO@v^c݈α_jQvh8Eřx3_~\aQvRiJ~f3. <--eMK5[ HV=^rRu{v2TԷvJ3[Yur9˾Q|F=lщVh\_ M,hjb(a?Zfdh.|s u7s&,O^%g{Fs 58Ev P|n9KMdx1>8)#AC/F1?ip6qE¹⺐%*]"C`^25UII2+`LI'xғh%͒WA׼0ws+s o(t 8vN|MqM8+Fa~My@K|\X.CS35zh{# XJgܴn >"* C 6LfTݙNZYr7jm#OgWDj^tKm5,I@UAڐK{A1 T6Fsӹ<51et}7=f9^"[Qٍ%݁PhFۦSíX$ 9"^ZnqfݬifםO0;f*^ȮjA{-C.#M֫R!tJrTTWhmM'\??ε/:!uO i֫|81lݨAv3mO-?EI5\%;*\dP/bwVqET󸚔gJkI.*IjL!l q_ت)NK6poC䫻SFT>g0 1`~+BF(ů ??dObr)q:3 恀^hDZj=W[bʰn(85ٶժݵ-|6?a"7;PUT1TA⅟ 9Vy"HòwƴR P\ݡ4.ci'?!Q &V^"{dC¾ԓ]X3Qа(2y:"ѴR}XX{vMK.@ ziijM{XX@oXȓvlg,$Y*{IJE!~>m6κGf53mqs;@#}@ a 67OxnސkWXᄊk?58F_NS>eA"P.}g.k2t4eraK'2cSpR.WR@/ Ms}&|z(qDܰ8p[J:K+LX*>/Lg#n{Hfmm-ƪ猔҂! ]C1:L*>ۄRW sglhv9vnR1"ɳ&3kJa ;79=Vbeqz;o.uPz^(<;P~#-ZxZ 8@~&rmʥF2ow%a"!f/$} Zq ?^ z"/O4n_Wh;]Hl\"OF䄊ouV؊Ⱥܮi")*xޱܱDU%\si2E0{^Z{!R[xcˌg8yôIG?q&H{!vmmv)~٨6\9³$2yuPU1*s}(FfK^V E '3nD"-荨O\8;s2fyPWrE$kcҭYH1a+ M+Pq8 2v-<С4P8ڶ'ڂ1z`:pԨ*JFJ^(Iqh!(hGĤWuW бn=1O[sV&rh4 l(dRr"s]H tc&zêlɣiI+iA̞>E9h=VˉfᆬA$#jr}ib5cR0MY4zB@v㺋Z I008}~fg "Z&51(Fl'0>c|vCR"v)>XyZkQM! p^)L ROn@4h] ]WE#[f:2HE,<*WAI,] F Ԩw>;ocq"hS٤ںE;xr7))g5M6LIWWU,l?9ޟj**\xVq1# Q 7]ӭAryM^D)[Uc"D:F0Sh =6QQۡ:FHn(L+!nߊT̷Nz5oѮAȯOj[Zw-J,5=֩ԫG0鷿(smϨ&ӈ,%TϕL`@֋D{ v]Zm rR"羥1ldJ$.G җĄ{xd8dW⛮WX"QW/8 %&)iW{=DV^YJ%;sqk*N𐚞pJQ׵hK;.;咥RH-^F~X#>4,8è.~rJPJmOs/5!r+Im½ y 5&Wzϴԧh+0's;O1PlA v5x%Ԫ}a= 4F䕇'5*; 8r:Iˑ;UP|}iRrn[MrcP2̅ѩ۽w7(#Z9tXJ·qY\,ԧv,pF9GAs5I.6әC\a=&|EF2=V:`mN x`=>b/p鯩5o{B(*iyJV)+j\GHGAXhN?8(f+Pϖ CD0{),`?C0e&),l VLAqtٯYY B}c)CgKBcW$J*pW*qWZ/PY(,Z~~BB́iRp:!䷻vI@n͹@A%=^pr=ܬ >+=]*{veyы@A$=X RiSE%6Ž4 Ǭ`5?f~4M}Hke,w-A=V?è䩳%;q `8T ,a{H&Qy|HYA<)9$Sނ7 6vB(Zt#3K6✹g~ѣt ! (fYc^t\"2@Xf [flaoCk63*7*=-^nLhݭ"nna41"Α_;%6K$RMI+[L~lus+C޴-`p[, ]r1J6NE;"t{^p.#bK!~썘׃G21!v= b@Ԓ 8kYFw^â|r3eIMV\&x:;;eg ,7PAwkѣj r#1j(?&h{*"j;kf[oj"tK"ŚsPb(<%R9ڋ#y?Ji+0_쇜* G} :_Ǽs,'řn$g"gd46%Ɠ@KDl2)lِ#Yo1ʆ†F0U}1C=g4#ZMTw}Uqy}ŒGzZdZ|jpi8]hThK jAICGҁ5s]@=oRvFPwبo%Sq q N.9KwN3:$80o˥#7=ڑ7k ՖI[?~;[U5~cRL6r Q]Iu*p[,!Y&ocʥirO4:R=tC8M(!P ^Ƞ;@8g+-J#5P6̧l#42-N4i»D;I|˱4^+#Q]^kiL ]g|.]rWU>wɳVQG&#to0&S(deoar oԈNWG>Al!f..:wxdc֎!AcwGnw!A"q7<0SEx/&`.p'&θ%@(h1Tq ^޶[hp&(؆ځOb8 Xޥo#ݿ9;ldu 9' npv.IʡwW߯ҹ!>Ѡ1wf}+(Z')JPRɃѭiD i_cBܠ=J$ H>U,B)y'w޷nCYͥ ѾAJ.e/uho2\K 44ybk@݃!ѯk t-sV>,6_h"}sez Ԗ (JW06 gaB/,@bg7"ˉmJ(˸ߪxVd?h)0F$APc>Zs\Z6;@.?Ѕ -C TPF~:-Y2Ȏlu`(e uub [HbHcD-8dN. 9wދxUiN&MMZp`N)]dTCmK(r;2ymBj"? МH_gxW dg oRm֚TGSvDN4)ߥLׯ(\|g8m>)ɜsB\Lj 7`ސrvMץL26)OS@dDm*W~0)o]*_rO)I-Y{P9쩉M5SJ.6@k>j8AB(# 7k|P}Lr5]v=H\AVAaf?|% "# $qä0ҙ"fI]-et+x䴩 b*/Sq .TC>?蹤rԡȨ]Ll>Q PTMlreRRCv:ط*6V0*eT+bI%Tg&OSpkXuvSzWɫw[i/MG ۢbo@haeF..KAḬ\ pitAOyMpN'PSMytX  &.JȈݿtD*+~T>^+xҿf1-i2Lq75d=_,230)^:Y7C~,}lD&`@:VC] enc )ZWwA0o'&P`;k2(`A(K:dtObz =M$L9+xHj b՞Fk:/`ڭ؍g ijإI\hRx[|i\q$I Q"I'\W3BlY?$?X H] #M*L wC;#$hz6(f 5)۲^ԑdNj,m\GEX7HS8&@|J4oQS?xѶ/7Lt4YK0ӈ{j3NeйsN͘.o""5=CX8 hB/` F7/Y:h뛍Q_9{C;e =yčR_c1ܜob 0߇vX}^b](%rήZb6VL2;1N/1=')]IX04Rq=eLOuj@OM$gq+`0XgX-Rm87umZAv&#[_.*PSv۷.jC? 0Cu#Ծ'cNMV7dд\0Y(i1"csH[GΊ-:V8I ?bRE?9֯ndKeKep|BoM[ÿpT]V 0։dBFj>hԴs{纡ARl}"Dm:/`ą?-⢮Ӑ%"&D&Y/ .c5F:M |N<TdS3@e5 sAςt< }'yӲ.:.Ц>}kmP^|JԬhAGW"(;>m7o`uE4!r?HQ~; (Wb} *T>4e%7Px5$wJ_5&8t@zBk+G(@'c'?_ W/,<MZך8J@LVpZTVmJ~CڐRfϳj{+%Yp$K l_:2B辻fI)9or N'k"6+s7Wd%1:?e'pNPԈ 3t/SVxِI9`,,6dY=baIsYסİdD=^ \gyd+>>( p.ɽk}7tM@ҁHG`3Tl:B9[K̺Zf­&eza.,(bd{JI߆Y;OsNnsjik\V| Jzѫ\mf _?GFenKe_@W* ȉ*bTNc{"@Ki>>AAh%Gޠ21!Q2Zѯ ʞ9k #іh*jʕ .UV8k៊'m=\=*OB Կz)Tuj 5LDZoZ[0U4f+0pT*Gq} /ykM`RIo6TuނbpKiKID:-ͽV+ƞűk@yhR*~ X?t4\2]n^~tY>+>RPd_dQcGXTUOSX 6J15M7 < 'bl۱U\,hCR "i:<}n\Mq<{M: 2b-.r hUrk+i/3EӾ@|J nTF'X떺lW; &BqRi|Q#:>ҔZtNPkg÷4`HJZU,P;"J\ABٙG]_xpt7L^ ߓbD T#Y+6HVRT! ^/:HQnʋRof1{ ͩؼ!`&/3v:^s)|0`JqJ=.G,-Y[TVGO2 [1 |r3?p}oҔۿf* ?㹵!W+߶Zc+q4LFhqpz-Cmz”>PhL.rLv3G 1T:-{Hh3@jP]NHmު߭<`?ֶ.NGo'7x"A0bt(DjC̓GP lB$5n޲n8-ǭx[ eJv$t'yD:*o2U|k'a]8pnP{*X f_>#̵@dD2ف`|v?\瑹L?J/Rb):Z߭|)kDQ{UA/jIK軰"EPKIsC@f ZAٷbZzۘKl~@B2ixk,۬3 ҵ2\z`Vւ "փj8NY"Lڨa^Мj AE4 o'< /)تۉCP|І5 n(IBdWN4{PߗF-cy*K9J4O@Nm4icn+{jsFIJ괴8@FZ['cþ{H9-4I//{V{-;Ɗp o-{v|YFNqv~ m9ΝFд_XAt4I{ Nj"%4 S[O΋c* mf(GrR~.EH63/tNH{qKmL;J o6ٞ?xGBF,%thU=+ؑ@g,BZGKƗL>>1_3M^l Ĺ#陵8gZC!B>Q[sMlN|AbF&ō{]5Imegz\I~"p)_ȴ$ІeaS.c}˥wj݁|Keu^   D*;23*j?K'W;BToj鎲U,2r [al;H4W G1ؠA͓OdA̞Wf8 /MR9gh\!QZP }صڈ"%} Lam? b%WLM}JDMtIqv[KO'綾fy{?>*o({Ɠ)R|yŢ'D9f%g߭"%gR&2X:6 VS;M 8Y}ܖeS3Qc \݆𽓀(\ZȎ7ڰ Ó`~k3-,>>c712[rCA'VPz0Ɏovv.H?1]MyP-[ BWD"E.ijV\]!n=aeIFZk'Z#HKD,8\mcppVeFڡF"QaVWqV=J҆ CbSYi376J|"}qo/6$VץuF?*J W/p_cRsI@^*S<ЬDig+ܜ֣mr9u)0-s=pcȦ'k<)6ɿ-{A:f-ƨLҙ^HAhktkxijnZ?Rl$߁(O@z>EmSޕQlsժŝlsa|-E߲%Ƅ֯Ceeu65,?c [ǮmUh\2sÐf9 sm>bY/8U-ta*cI0,绣 B\:_Mihkžx 2WY2TjK f~: B }©6#Ȯ"34}Q&`:]նOPKNF:? # @Do`E.`3f,p'. %b|{WbvL';=ȫdObY%hZT?MtV}~~Ц"(KHKLKCanh'Rs'CuLrY1Vjxb̈4ۂ@BJ?,7WBqbM*X.55UXQu+sӶ8J77mƦBCWUs `[MV7aI8+ i-8,ǫfcIxA{8&}j} Hrg?Cnoڏ޼x׷ AIx^ʳ*>^sc2K>{2ɝ>z\\^E2&n<z#y.E*;I i"*yNz}!x'rc \d;^"/qj^Sf`Q?:l IԱ٘K82 ,TW;Y.\gLb|la:E77Vm]aOQ ~b{NZeȺW#)?GIqR+BĻJլFױ6J2+=UyJk$d't~һ,橶 å;VmT O6ptv`G>Zwqi+lV/[#[OڒTVSÈ~9v<{4A9/إށAqmR9TDT-m*LO2 5͋ZCC~BKL@Ur75مrF!G0ϗrQkwjCxel`Hk',x*_ J-i/(x|)XȘjcw+>UorU17wnSg*8|Ʋ8 ;͆Q$Oz}u޿a䗳H;pė 'Jbչ|`o()ѐjS&%/jZ^RRmk8gvs7bFg4뮕0d;Z FP;->4t;z4>F_=W_=2oȚwS@ueFl&~*'nu]3((06K 9E?&ȧ4zWJxl"]?żԜ|:n4\3Bdc@Ն,IzC%0c3DQST $>*N̟F5[/&31w$+piTXelT&aI~_ht{`>>Qa=gSܞ%1X?kR p,i8vHAf@ħ7/[hc_HuPD&>8;J ,ehK U{q6S@!np "=U` _ j EM84wYA/*It/E\ֻ1 #ɐ>;.)0~pXE$LYD<.`dm Ά_+mWG >v8f 26kmf\0 M& &5 e˺KԝCl^.Ɏ T(g1>2C^ JgzگJ"X' bq.E.EھĤ[-1ؿtsCeݦ7Fμ? Hof*%wt1L"GqOkq P:/ݐ_M ].|]>LH1paA =9:JML5w6إiͰ? *f9n'&XJs=h|SyW0`2'UDs#v$A|%cBH ,5:᥮ XkE ȷ`0g4cFZrbj+@wk:Ȼ[2 B-&c;;<,Zj!w$|zh2JCƛ ^pie\NB-ZBU" p?v6pH~ ]! |5KALK_ U(-:yuՙ^7<2l_P|L@ͽl .- ;R k%[݆dD2T( ԄH Ez.$(*Y8K~rKw@TLi9/Z2b:O}e}u]p3LiZí Pl#&Z}Ϩ]3} ۄ=E&2x奐0jtM,b^dj"xGҾBܩ&tW]w[ `(p^q6tq/كdd'Hw>Ha`G]mtҍ^ہHdEjLMg!L![?į̅L$mRu5+D6\kbځg3I]o_BogN`vޫVեmH+ݑׂՊ|_,2\4OHێRH)י-VФ7FVKxF,}1C f؈H‘[bB 8d;B "gsL\JRE1dpGGwGY>ad0%>J=s_XƄ WGo!Al :&N@ (|E1aUgrf}#?:k^W 핐Iڀ&.ӊ)8ݹi><( opDtkm;*ZE@FҎW_1xHBwN9VD*~h],q ~ m~2R1< 9]w1É M}y =g?] }1;-_ ]=M_ 6H9A&qA OIpiQl3&mfZQӵb)+ i.ud@CRiݴI+hfK=fZ]VmҿpN``O4Az{M"mSR 0L]+BKډ˾b/IdH-U-F:.5%kvV5Wz'I.ɩTgHxo~Ƨ=ݔq5(7y/|\ ;8_fVv؊G/s9!r+~>=-0OPYNs5-ʮujo5t_=G.DV]#׮7bN81 c?oB9%lFR^>TngHQ wjw,p6$t>Eݢ`H yj1gTٕإUF]FĎ /UqFӼpK<BH{JMbʈ&Y#-"G,^'Xe+d -l0"/M]m #2Ct#WAlm"-LBP-B>N_59%%{ hf$ދb끫U!#䒊,{)q R`aBbA njT"!^seBf%KV6,Ѥ9M!i 0,@Q%'T'Ō`Si1?!p, ٫. "XjaΌFy9Z/ŝ.suk3*C-:xRٱ{,r%>GP_@OVC5X#REѷ6̅=%jV6z)~cF2|_jHy։pGPt" 6J<:UmJl4YupXk46p)(5ޝ|6DM|,&&GY|`$~k^VD ~`臢r\c(B& z:\ :RҒ9n3Z{s*B~4Ӏ`J1Y+\br8+ cAL -+1- Ы#70.=U6!򙟫.f@vQ梽td#*دlU{ҐCnE ^( Eͧ3 -A4eitWr.p8,!(`G;Ndl#43¤dSܾf0O-I#cc  Ѭƣb-ue72,Iܩ+pzEdP¾$AԺsG`iwt~@% 4bjJJ,\it:(~MbjCݛ fIz֊Gp~N 7 _*BB:I&!Јѭ=OPlzq0y)L&Qe֧wd%=4'NTo<9TǨ4as-m0ɋ]._u?[;ZM"}oWǠnPc6ŝ<݈KnؙκznӫYY$&[5VJR06ɖa]i`wd;'QhuwY*Z*<e<phEណ=yWE(./9^"e|mQGS%:51<|< }϶Q1rHyڝ?s}yjlOO"ӑ$|=íG[ pbɕ%AV]U;t~rlaP \ns$ʓQDZB1ŹkEΐo+WpGK!65(g ƈ~B{ЫX0rye2"Eym 0N^8ӖM1f +PR,ia֌G'N }rHV@rl|fYJ2TWT@-9 #0^1~~5) P$dKS3*fzO5_N.@1Ty#n1HTw=S@C/M甆fXB4딑ݣa*`N|A?|drefjvM2G[rnd\?\)c}tU0D=vAO!3Fy(* ,&\ ͙YHӨMv C,iQE)KcW 9nl"W71j?zJ|BGoD|UIQB Y}nQEj> w1AHhnщ_'ݨ wdՄaZzB 9ho V<:1y\ZW%x$gP v;A0={\ŋ+ڒbb}7H9O\H- q0l7D8Ab"Fn5c\߻mF1ZxihNHݜuPs v,zs=By;2f&ۂX/C. T+_ry)5l 9wCҭc#8BVy/)3!Ϲ8*+~`gK_` -֒ `?(:fELޅ𵶥~Sl6﯃'MZmB0p^)o Yd|GMxڂ~\N;ʪw& 3H]~@^@t8|qMELM$0kAޞ |" 2^5uJңkNvNj%~vmEc z#J4@ {Ư겪yHq E0SRehe™$:!G/7hlU`M,{زvO.&;){PŌ ɿs`V+=!}CWHyrs!d@H"gh%70!$QSQ4ACTGNtSк|3]uJI&Of<~: :3jS\jYX8؁"1S7 2BW(o$0TF4*|߅L WW~f  pdO+ ಹ'0#,k?$X?W`;׆be.:6UEpҔitWWzve3}E[ 8C+ssY:3ZLy9tcк|3N 㗥qjN)Ղfi4{K3<~P˵1/g஭ Jq6<|Pnw:汁?y<*1/aT /Z!ncy3txӚ綌yJgݢ~54bF= N&ݷR쐽0hWEl(8O@8~]9CVh'-@>_hik1'|B sR\_Z=;v ը?&!,kؿ﷧SL`Y_ x4?8-o1ZgRx) 0w5b }9=Oz_e`<z;GJQɦ8.{ˢ[e8(vyHtI\j:P$"& a;FdX p \䭄XBFf- ٲIa*MrY8$>-wTˇi>WݣB;2 [G~/zwݤaHdwԻ5փiHfUm>{;z.O8Zt^AyFShlT&k#H[s}vz?[⤺'[Wkks/?/F]TeLfwK6%mnvD$}X `7s&ץ}nr?ʽE Rxv*)GA 9wbfiu=l糰1%>.9(tu`YI5nZ|d&=7]9rpMfv#EWmMZ7IOGNd#}dn0E\V`0T|@ 0~r@,#̻ %VYkDɖ:v3-|QdOW|Y4їF2\pk&EeH%΅;jeJwϾ]ߗuJcظ-%qHY¦)PKUP^'wsƸ9$hn s &.v!?DDTNTl&a ҈Oq J/3G;.kOf1U(Ӈ Av">QjXo.܂̂G^ԁjhxT"X_N?vPrjqܣQ ?CJ arBC]AǺ$~1 M,WlI-PСM5@;x[Ce7uG& 38B\(>=˨!30%r" MM{,Л2 Qܿ)͐!YbGʬ M$ %qydy-7QlKyhh0Oy0QM/$\ fE7&J7D 9Xd>yrCR"1sgȚm}C/z _w\+*z[y>>ˉ|7nor{߮yէߋ90"ޣbCvE`OD&FIhpȶc4tyn}f[;w+*~$}<; OSy%6`(& LbC%򀮼OIT+V{l<n~o5pÚZW$in\-> &p%5\>r;5G]~"TS!ϡp$K N(Z~4uxek菲z ]iLZ\0QX/OxMi uUKԵ-7 D25D{R3%%)Sf -G|Q%i:^Ntü Ctwӥ 6ZH:TF h216ZP mT.xy̳F?aݰD&8$j8ȺA( E`yITq9Ŧ:x-;ttd@#JHb 6-0dy$~scsxk :yiobR׵*o^6APBfRNfۢ{-t^l:!t \_#l*Lz|R|²ΕvBeP@[ 5X.GɃ:T5D)̯`. ;8f` G枓4=p>ѯ+iS/ /#;OW-.cEۜ׸ `HEbKF$EN%/ mUFneZg57 ?vƭf罒b`^PauA5 ЩT`Њrx׌8Pvx4 # -c7`F^E?a Yw_|~peJvإB%1!QZ$ IQqY&xӉ=4Pk驶2Jq"H⫸cfۖ.Uc$Cn ϸI]ĹgMIvHzvux,Ԉ[ʛ |gI=bvDڨ(.(q15OI- 掷عo.K=ᩃcJͼzX}f1.1[jt\+ݚJ1ߟ_)0B0"ڞدŶm3\z2JzY?fV @=rq.ѿ28}P_n+!$ SG GBrw8&f|jy@ݛ{s͐{Ui2<S'L ._v;d $: ޮYY78^S{[l<(@nlbm FSHߧ}"IpT۪:$A~љo}(;#)9vj!<>#iDw܄luZ76Dh  ʾ?z*[yKS*_E 3Ye۵{:ۚ0|)ߌsvmiqf!`ds +ܒY#ɇUvV\ HwQ]qpRF'(5 YuF$5^$ 5SS@ L~p#y7Ps-4+N{)7 x{ZBbFO˙3 t;Vq!3 24 "n+>Vou cLlF, OvZHvƅpnP!rrq g/I|gj݃[ڶup H\#/Lbg@Y,ua'Xx#aE;Uc܎*aɛ$?o^;c p[U @t}_y/Mg/ue LlY r;3kܻo1b4\iukZfMMM8&,@ͬtXy&b/xAfw i!'JX-Ȏ \Hݶpܼx 4yLWDpo1%&2*HX0~ںEL Xh*NWJ.]haώ_ۄo1a찴qw!gCj!{[Bk@p gI+%eq}6IF 2ҝ 5ShxةDŽ"ԕo)9#׆7s2 c}ήh9/ B śTCnj]e2&;! $>Q}5oy\*$mʑxx@j;HO3rMl ogQfyL4(,;)fiٰ l,.גxN, P3 )?uނk+ jdhraaͷR ӡ#3^s%33࣊ڲemC0u_Xs: f83x1QYo'ڪ:>Kݷ[GP?tXjAKMs#q Vu1}Iҧ7|alĥ@JNuj:}BfVIdu w'&s|ˆPKOWeILJ8]3ϘX;/uo{ @~IW ~:r#?09rl_4.lQGiaؾ@`蘟VxQnIK$PzPn3:]u2;o|͊q!2>0db4Dߖ\> 0 4f!u)Q9{cNGV,:tw؏BO˒ҚEz;34!M +(l-tx[:e_l_u3rҌ΂(Aes]cy߇I(Р?[+ c!x-P9. ީ0OLzS@̐8'0' 55pɹ.H0%qLON*EbZn RW꙽"1]ӹΪ(:OF$X&% cy@[:~󈀭nt(r@\vub<šxobaۭVuװ dI)t8φhX 7, 5,gP yzQz^kSR6`Kkߧ+"g[oUN@{[HJ}C 9Y,rt n4Ֆ֣Ů$Q7ٖ9\=eꑡIwے? EE<-)vC_w%GYTowOd=M^X*U1H'^9"Pi{7)c =B FaS$#V"l'2mvԧkwД-`):ÿ$ 0̜OCQJ74jnO?bM/kf*4w/`8' F? F@ bI^tr[t.s|}oxFärc!̓!+_j?2\c# I*qCXZF+sI<I-)E޺]00pA4f~C\p _/Km !IL@A_pnq/މ~]9/dC?W0v='eEiGEl3S$x q\"qD WjC j"tdAOœ"ȔPqb62x׶+}!`6z}0Uڊ`RЫyu9{$p4o(q,Yd,<:PXh:˴?|vyKYLn,zJKYG L@izfnD.}zYT RsfdLjgZ_^H~Í6@<͆V޻ά,qev^,ܯh_UM;KR4)-qsp};s;C\;͡lj+ggfMd,Mdyz3_D]/b):J^ŏ˄?Me*sNh0yN.e?naO>g|w2 0 $d. d(ʉf~kEcx/zR'믑5W%7);5 i(V)4Qn~#C^G|w†Pk :cW&=z_ٓWi5_~Jc\avy|h+D\8*"M_dԙ9Vp72$Vl1sXcDhW!KiDTg ͒ [PDm&}Oh0_\-(jM3ߟFr5y~.65$2+OW?z GrasJN\3Oړ~DHxd.S:oA44Cr&jݵ%J#}wǭqrqZ)N"܉\ؖKۤ9_6EHݥ4PID|_p(^vD+ҢaNm6 ⋷d& n@p'V0'<$@MeoD(Tly*^Sy|!SW%xV#hIb/t@ bVt>6fKX:uaЬE8*3΍BY^fDZh㯎eSTihc'mu :`Tb<Ȗj`KHz%?HeWF4n޳r0Lb>zYHgŜ4"jR b,F 턆)i`b'DέZǫ~oi|j:Fl&n_P)bLX`|$(:bM(r@ڶC+{js2*tp}*h{h! nXrBN)Zc8f[p4:z6o6! D[ՉF60O?[W$ypG\v-|[w+^rso9 `|\2Wr+yiP]*e+2) юO=玴\i}_GQe7:-Nѝ^ / Cw!^ " ~~R.VC:pxw;} jya-}(.5u.T{u] y1+mx?+XoФYX4y%SҌX ^8Fz>F%]!ל!wyWWURo hYaZra2N[|2*,ze޿ɒ^xu9=ݏ(v| 1@1MT:тJ (EaTn>D5jȎ5Hh5]TlPڻ֞f!<(!Z|3MHC7a 2cPZbw hS72Pv/2Ey~: { | )&Ks>0mc\J$m&09O2X|;lآ Neމ6v'p݈mEs~b Dے7 _[7xXF#n|m@. LUM#@P KP1"}q3}3xmh L!)<6=rMQ+wyE: $b$8RBF~T @pGk'a(˽29ȂFHn|s,5M0cw'g@5\ jzijuḬ F|Klva#ITJ!S9_@Cr)aÈqe KڗB~]*VwG؄:ټ3 ðKTsBo 5m`TR I!ޯt/4DqFNb{8hkN>sb_Ez?~;V|qѷ!9q) M8>!_ߴW%Pn=|D.*+lߒ#9Ԩp_{8 ˅u6Pf^I0u}9c 93QIml5Tr_~Ngk^ʽgB]G׎]szTZRQb`TmEN4p-sqy$r.sya c9Oa2OeE47`-=׉Z*T![vf͗T5񻱦c?:q2^w j-BH;HZҸ? 8Vj7riB{'Rč)>qj6^ D:?@ `9f D˴0|d|AGXBZ0n 7d3Px/Q_z"uIp3)dAcp:sOx_mfp%\,ѩk%|*Mv\۽h(6]%/6x2CS4lIħoNy2 7?B;;&]_jߓ7䭾m}(8zHN.O|9yEp͜y5oXhnRrܠJ=Oc/J?QVOcynu-4 hL1`ŹDS|`QE(Wn,cᒏ2c7gٿ{<"E}%M\s.LX.&4ݨZ:0,c*qn A\O I􄅶'gI2*–Tg^GG=$=l.DUЊ)tjy 7M̟CNQ1K23k1b>HN`KJR2ķ4 {{);[w.W7TgDEږl`qMR{N6k-SQe|IOTrrf/'*,Ta d"3Н=VT*7Lz֡buZ-O(spYZbKIğF SIC4Wd^@mHXϽh<@L۲C qkkZU/^藉L@GRv[W"nE_>~]_q\U;_ȎfP'Jk,Y-'#[C%uE΃]tD@?"pP n`xv#rإ=F+ TLͪ!f]c8tV/Cc@;U5pcn1GdibsF790o!:Ov @/ kv}[%&"XM `֞ʁZB쫷 xaǑz ECpU*[݋iycl )TSTƬX2uq8q"|+8gqĞonZN;!G%MDɘv+^kP ́Toyկګ5Y뤹 o'B7ci6(PR"CHX5i/l&Sg:www^C\I#Q",DDȶL(h=&[Yl+3r I:3 'ts@ הBlGm@xj!Nۆ%*F|E(:^@z˩Z "`2BegNSis@(R8w&F-]Ͷ3+mBA'~UK | w&v=M}vcJ{ h98E&QY5D$KV'RͺbDazMcyr,9t$REeԭZ0ɬ]wx4Qhޕ/>77/vbp?'TPLD47|AZa#gK<"xa@'b=>Q]!K楗&B@YVÆ>\钭[+4ds| 3,FJy*, yɕGKsaDfUcܐPGH)ׂ QALPi83q`@Y4gßugPU@3ȯ TUӷC>PZP ; GFmϯxtxS1}1&3u4;lI-u~\CD1gi _a+s(]ӳFEW.Bc;o?aw`vFMv[7wr'S dV`cFHi?i SU1,0tuI.L9޿#,`5(2br_C7q!*!b4I ./2Q4GV@8Q6b2!:zlcPm~|l oFrP;8ׂ<ᕑxWq?*YA]?a[!N32 ٶA*5HK 6E\#eh/;C<"lʩ}J 1p_'ՃJ9 X6XArZ_N*# >0:>k: Mș*u6JuZϿWX|ʈo+HcVz y\df_O\0'CKy4"J$*z*ʴp͠Y(OMvĻ-FYsUi,4\w?t65ϊZy-Ev,VF8w?E< :fl ­hT4wv ܓoT߱} a $o꯺M*7<Xo1D1)'9fީ^pv|3ЏFdd7 h?^!†p 2~Η-‘e ] X\+X.=꟡ 0^Xfήc_162dk> t>W+B]޾Mw49G*i2ú_ND=D+mHj "9AR""g:I {ڂ%\\tux<j(LqFw]*$,a