samba-winbind-4.15.8+git.527.8d0c05d313e-150400.3.16.11 >  A ce7p9|"HrA#t-1q 8Y6K oQiyY+;y0%VV=1tKp-|v#W{'F#L5z'6Ԍ,zK<8]9_zV]5 8MxMg_7ɓ/P6iD}P}?<nETPh7GPZ(_ w}T*=]o"> 8dcef30998ae0883a878ff15ace53dad97f3afbfda517284e06bf4b23e215cd69ae49c451544dd808e684097e8f71784d4420423hhce7p9|o4̕St\ I콡\>pLb?bd+ : R .4:,/\ ~    T<H9(:8:9> :ON=UR>UZ?Ub@UjBUrFUGUHUIV$XV8YVHZV[V\V]W,^XbYLcYdZueZzfZ}lZuZvZ w^x^Ly^zaaabb8bHbNbCsamba-winbind4.15.8+git.527.8d0c05d313e150400.3.16.11Winbind Daemon and ToolThis is the winbind-daemon and the wbinfo-tool.ce4s390zp34|SUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxs390x# we need this group for squid (ntlmauth) # read access to /var/lib/samba/winbindd_privileged getent group winbind >/dev/null || groupadd -r winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in winbind.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi/sbin/ldconfig if test ${1:-0} -eq 1; then ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-down.d/55-samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-up.d/55-samba-winbindd else for if_case in if-down.d if-up.d; do test -h /etc/sysconfig/network/${if_case}/samba-winbindd || \ continue rm -f /etc/sysconfig/network/${if_case}/samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/${if_case}/55-samba-winbindd done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in winbind.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] && /usr/bin/systemd-tmpfiles --create samba.conf || : PNAME=samba SUBPNAME=-winbind SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable winbind.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop winbind.service ) || : fi/sbin/ldconfig if [ $1 -eq 0 ]; then /usr/sbin/pam-config --delete --winbind if [ -x /usr/sbin/nscd ]; then /usr/sbin/nscd -i passwd /usr/sbin/nscd -i group fi fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in winbind.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart winbind.service ) || : fi fi<rHX%"0I^큤큤AAce4 ce4 ce4 ce4 ce4 ce4ce4ce/Yce4 ce4"ce4 ce2ce2ce2ce4 ce3ce3dbd95eb7e0d1e8c973d39fb53be9be46276b21bcacd8b0ae1adeeb63651f6fbea676af835bac5e037fd6f6d9950ea49ff3f39bc693d479069190927c1c53083993a1caa0988f1da58a965d7a954f36d791af7b63f8f4d458a49b7b48dedc7909bb4884945e7018b1b5a1ff3fc4f7399a84f771de0788420f43e566702605b1357bb3f8ba5ec807f7c7bc8f2ecc0ee13716b3440077da1820140943876d1844f148c787a47c3127f9c5fdde2848eeac71a06e22cbf997c132d74ada549c086e0d0c4fdc953b3c3cbcfb25a3c39f3a5badb986bc5841787cb3dce64cbba80312529a16eb3e6b8e2bf0b1ee56f8a98e8ed307633badc5f3c02d8a82a4293ea47439bcce644b68107a51d4581cfc5a5a4d3b5498d952ff6bc7f34a5f84d8e2ca143ae8f3c934fbbfb1c63b14a9139f549cd7ec83a4f4685c589f37c64f98b3e06227ef57d778c0a9d214f9ead23104fd70ea60381dbbb49f1fe039c12aa5ecc1cc7ec6b4b0325dd3211474ac785379683cc4e7f17e211327fb9d536c1ff9138de03eservice@@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootwinbindsamba-4.15.8+git.527.8d0c05d313e-150400.3.16.11.src.rpmconfig(samba-winbind)samba-client:/usr/sbin/winbinddsamba-winbindsamba-winbind(s390-64)@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/sbin/ldconfig/sbin/ldconfig/usr/sbin/groupaddconfig(samba-winbind)coreutilslibMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.2.1)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libc.so.6(GLIBC_2.8)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.2()(64bit)libndr.so.2(NDR_0.0.1)(64bit)libndr.so.2(NDR_0.0.4)(64bit)libndr.so.2(NDR_0.2.0)(64bit)libnpa-tstream-samba4.so()(64bit)libnpa-tstream-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.14)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.21)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.13)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)libwinbind-client-samba4.so()(64bit)libwinbind-client-samba4.so(SAMBA_4.15.8_GIT.527.8D0C05D313E150400.3.16.11_SUSE_OS15.0_S390X)(64bit)pam-configrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-clientsamba-winbind-libs4.15.8+git.527.8d0c05d313e-150400.3.16.113.0.4-14.6.0-14.0-15.2-14.15.8+git.527.8d0c05d313e4.15.8+git.527.8d0c05d313e4.14.3cM@b@b@b@ba@bascabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- CVE-2022-1615: Do not ignore errors in random number generation; (bso#15103); (bsc#1202976); - CVE-2022-32743: Implement validated dnsHostName write rights; (bso#14833); (bsc#1202803);- Fix Use after free when iterating smbd_server_connection->connections after tree disconnect failure; (bso#15128); (bsc#1200102).- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- Update to 4.15.3 * Recursive directory delete with veto files is broken in 4.15.0; (bso#14878); * A directory containing dangling symlinks cannot be deleted by SMB2 alone when they are the only entry in the directory; (bso#14879); * SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used uninitialized in rmdir_internals(); (bso#14892); * MaxQueryDuration not honoured in Samba AD DC LDAP; (bso#14694); * The CVE-2020-25717 username map [script] advice has undesired side effects for the local nt token; (bso#14901); (bsc#1192849); * User with multiple spaces (eg FredNurk) become un-deletable; (bso#14902); * Avoid storing NTTIME_THAW (-2) as value on disk; (bso#14127); * smbXsrv_client_global record validation leads to crash if existing record points at non-existing process; (bso#14882); * Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call; (bso#14890); * Samba process doesn't log to logfile; (bso#14897); * set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert; (bso#14907); * Kerberos authentication on standalone server in MIT realm broken; (bso#14922); * Segmentation fault when joining the domain; (bso#14923); * Support for ROLE_IPA_DC is incomplete; (bso#14903); * rpcclient cannot connect to ncacn_ip_tcp services anymore; (bso#14767); * winexe crashes since 4.15.0 after popt parsing; (bso#14893); * net ads status -P broken in a clustered environment; (bso#14908); * Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before smbd_smb2_ioctl_send; (bso#14788); * winbindd doesn't start when "allow trusted domains" is off; (bso#14899); * smbclient login without password using '-N' fails with NT_STATUS_INVALID_PARAMETER on Samba AD DC; (bso#14883); * A schannel client incorrectly detects a downgrade connecting to an AES only server; (bso#14912); * Possible null pointer dereference in winbind; (bso#14921); * Fix -k legacy option for client tools like smbclient, rpcclient, net, etc.; (bso#14846); * Add Debian 11 CI bootstrap support; (bso#14872); * Crash in recycle_unlink_internal(); (bso#14888);- Fix dependency problem upgrading from libndr0 to libndr2 and from libsamba-credentials0 to libsamba-credentials1; (bsc#1192684);- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899); - Update to 4.15.2 * CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication; (bso#12444); (bsc#1014440); * CVE-2020-25717: A user on the domain can become root on domain members; (bso#14556); (bsc#1192284); * CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC; (bso#14558); (bsc#1192246); * CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets; (bso#14561); (bsc#1192247); * CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid); (bso#14557); (bsc#1192505); * CVE-2020-25722: Samba AD DC did not do suffienct access and conformance checking of data stored; (bso#14564); (bsc#1192283); * CVE-2021-3738: Use after free in Samba AD DC RPC server; (bso#14468); (bsc#1192215); * CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability; (bso#14875); (bsc#1192214); - Update to 4.15.1 * vfs_shadow_copy2: core dump in make_relative_path; (bso#14682); * Log clutter from filename_convert_internal; (bso#14685); * MacOSX compilation fixes; (bso#14862); * rodc_rwdc test flaps; (bso#14868); * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal; (bso#14642); * Python ldb.msg_diff() memory handling failure; (bso#14836); * "in" operator on ldb.Message is case sensitive; (bso#14845); * Release LDB 2.4.1 for Samba 4.15.1; (bso#14848); * samldb_krbtgtnumber_available() looks for incorrect string; (bso#14854); * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED; (bso#14871); * Allow special chars like "@" in samAccountName when generating the salt; (bso#14874); * Correctly ignore comments in CTDB public addresses file; (bso#14826); * Fix transit path validation; (bso#12998); * Fix that child winbindd logs to log.winbindd instead of log.wb-; (bso#14852); * SMB3 cancel requests should only include the MID together with AsyncID when AES-128-GMAC is used; (bso#14855); * Prepare to operate with MIT krb5 >= 1.20; (bso#14870); * Heimdal prefers RC4 over AES for machine accounts; (bso#14864);- Enable samba-tool without ad dc.- Adjust spec to use pam macros; (bsc#1191046).- Adjust spec for size * allow some Recommends instead Requires to be configured for cifs-utils, samba-libs-python3 & samba-gpupdate; (bsc#1182847). * remove fam, undocumented and unneeded.- Add missing build dependency on bison when building with the embedded Heimdal Kerberos- Update to 4.15.0 * Removed SMB development dialects SMB2_22, SMB2_24 and SMB3_10 * VFS layer modernized. * Add the ability to set allow/deny lists for zone transfer clients in Bind DLZ plugin * Server multi-channel support no longer experimental * Improved command line user experience, unifying the options in different commands * Winbindd no longer scans trusted domains on startup and will use enterprise principals by default. * The net utility is now able to support the offline domain join feature * New options for 'samba-tool dns zoneoptions' for aging control and to mark old records as static or dynamic * DNS tombstones are now deleted as appropriate and use a consistent timestamp format * The 'samba-tool dns update' command validates and rejects now malformed IPv4 and IPv6 addresses * The 'samba-tool domain backup' command correctly takes out locks against concurrent modification during backup when using the LMDB backend * TruACL support has been removed * NIS support has been removed- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/bin/sh/bin/sh/bin/shsamba-gplv3-winbinds390zp34 1667576981 4.15.8+git.527.8d0c05d313e-150400.3.16.114.15.8+git.527.8d0c05d313e-150400.3.16.114.15.8+git.527.8d0c05d313e-150400.3.16.114.15.8+git.527.8d0c05d313e samba-winbindpam_winbind.conf55-samba-winbindd55-samba-winbinddsamba-winbinddntlm_authwbinfowinbind.servicercwinbindwinbinddsysconfig.samba-winbindntlm_auth.1.gzwbinfo.1.gzwinbindd.8.gzwinbind.xmlkrb5rcachewinbindd_privileged/etc/logrotate.d//etc/security//etc/sysconfig/network/if-down.d//etc/sysconfig/network/if-up.d//etc/sysconfig/network/scripts//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/fillup-templates//usr/share/man/man1//usr/share/man/man8//usr/share/omc/svcinfo.d//var/cache//var/lib/samba/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:26478/SUSE_SLE-15-SP4_Update/a963c9aaf700de2f5fe7eb5160d56d19-samba.SUSE_SLE-15-SP4_Updatecpioxz5s390x-suse-linux ASCII textemptyBourne-Again shell script, ASCII text executableELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=c37d0dea70e2e38359d20f4750f386210658918d, for GNU/Linux 3.2.0, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=d4990631397ffa8b86db6ae906877754b29f5095, for GNU/Linux 3.2.0, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=e5b4ab8288aa43ae2cf8c1f2a4cd318c32b75994, for GNU/Linux 3.2.0, strippedUTF-8 Unicode texttroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)XML 1.0 document, ASCII textdirectory4O3RRR2R[R9R6RWRRRsRRoRRuRaRcR]RiR_R}RRRRR!RmR4RRrR R3R8RZRnRhR`RtRRlRR\RbRR^RR1RR|R5RRVRR2R!R[RWRYRRmR}RRR_RRRRRR RlRRRZR1R^R|RVRXRR0RRWRSR4RRRRsRYRwReR RUR[RER]RkR7R6R$RRRcRIR*RR&R.R?R{RaR_RRRRRRRRiRoR}R9RCRKRqR,R(R2R;RyRARR R=R!RRRRRRRQRPRORGRuRMRgRRmRNR RR#R'RRfRTRZRhRHR RrR R>R`RxRFR+R-RR:R)RlRbRRRJRBR@RzRjRRR^R%RdR/R\RtRLRRDRR8R3R1RnRRpRvR|RtE !P/3v>ii.-ku/3B8ҏiƫb&r=DՈ -WR.6!_-Gߦas' 71!2SL`pZAn@j:P8}NOf+J:C eH1yNkf"hXz ?&Tߝ2q b¶ɍ30 *9ϙz8vacDeQ9FNd hpݏbUxͩJdk=cUmNR p1O2j׳7Gwk=D>4dEAY:h E^`xEz4EKe'diۀh#UlC"_1V ;BF s]@gɹ$hjRA 0*/v]ܤC o61>rYbJrS^XK_ ,` JcX5ӕds q" HẄH$h<:wdafC P9/6KjB%ݿV( !Xe=P`bG lʸp0˻qߣ)ly3:]\NPӰf(8"g\6HJ^DӣurQOg" hfq2y4ZORߏ<6@ϑ]f7kI~z0|_F20F!~(8(98ixr}: gEogi]JyUمѾuڛ x|/?"1=MؕebH[B~26pÎh l6ލ@=tOf&pc40 _XJQq,c?&"2s790T(l[A-J;%=, \iK8H Y<feC(Pce&N;iRlbywn"-!71;x}gKBH 5lr6AXLP+dvayE5֙c3䙚-˄tt#i%ޙƧϥ`|]347LқyL2>%kvy/!Nj&tWp7[OF' Cg!W+4@Q xYFiѮ[X76nѦ N$+]v 6:$ nQ9WzEGE?[QC\2%AX,9CvKCU{hphȷdTJ 5} jAME\v4@oV߮pB{Ͼ@Y_DJ4/ 襑UxY荗!{qѷ%kߖHsV.nBPacGpn ?BbƂEBL|ݮ-cx OjY`wNzM$l-}waxba=L=EbÃg|zdm$Q;zgPT;CK4 nhSr_g~ӷi%M\w:@5 (mׂY85'H6+$vʕŽ!eLzwzY#Uю3^ -* hcb5ڊ[QʚJ._!U#(azθ.Zg*K OZwǰ-S1:;^$M{D#Ifu; 0jAB?Ԋ[CIⱔTzUG3IaY n^ײ}ȸ5p`b8@cP+o#Ш7 u֧M"Vgւwfnjg8d(H!#$Nk&ȟNl:Xs~1n6'1E(C׫ d_ K}T(ӍØA?B!ҕTx. Yڸp4K CK1ԩ!yH#^\-=xte(HC lT<4JB/ =Xp(Ld)}aX/qшҼȄR!=˙(o͵pub7C&aOm,IGk=E+Dk469;-v͒ hq+NSx qc\SOSt*mwۊCfh [_R;8)P!vezH_RW0ב26_W۔Nt':f0@'mG[CG}# !SvKjGr~`3-z2"n6zW@6E1P+JIoʫz?C.t6A&K=<DIORQ'H"ڜNv惗 6>~MGMq_T!8Jo#Z\b /i[-t􁞽vצLkoh}Y~̪ `p7xŞ|?r5畲07t{5v?"~)LxSbYڋWLn h I,c$Y=ED8 hӶ?yjv,6'<4e =x8/E%Aa< q283P6U#`1@5 :ryY7ElATՍV'(3G3AXQne.RM '809EJbҨB~920Dɕ:Vu|,N)rקG"qgt;fan?nh\mO_)Iׁ$(GqM*Xpбu}{ g#Ai#yqV<ӏ,P|kaB\5k=7cTkbyWsP›]ۆymA),(E%;cB IlDzp-U:0}Uh Eۯ S`gceUZ0<6URwnCƶ܏v} ``9NLA)jza E`iQ*^"J/,5zᛛ>bIC!>47DZ{&Ej>m=>9$e47]z&ۓS\"t-{OQ0rrYΝB_ V Fv9zΐ:wnvj @ύM9( y(cH@6VwϺT-1K"Xr[SY4ۖh) %1?oHRMe*Tt\AyAct 4fH6W|%&49@)qHa/8r^cz+$y I+mn* sG9, i0SGfK л] ([,6LwP}O31ɩFM Dgא?W^ Ik#<*u}P b!.T~f+  $be=\c/'/3},]dFօ75mҨ.~ca2V oK')0}@(k!(좾 ӮTx|S~#!zqw VGӤ8iV+UwiUF"FXGbK)u9{,Z8i Nc^=ngrd {B FyZϷwEmDѯYKt 4)!%'aE)%lE<Qz|UaV0/)W?]ֳWQ\s:E2l QNH|8ބoa;J2sۮq+V9*;7lG CƴiE~sY G>'p W `\А. >CL '8_DZ2[>z/h&E&ޕB /ܽ2F]+Fvl_| ,Q])[jqg&H0Nt:e0 mYoFc+PW@}l 9"+X4e`x <;0O!-^^JJZ@);}c@ P0!;-mS-21\5S]y|\7utlײ-0v9iuUw}W=Plp7G>*q1ߍENjp-iG3sI9TXҋGT+bb[9+ $5 a \fC7YI;.Ö́xGܘ?A|o.-63Wa9/%Cָ4 JsԆ 5H2 l^H6bN euIs/[yCp|puB)]A`/Ig7d񷥮6BϛAT)`gN-ErGMv妦]K7m?Ӑ>68Δ15~r[1d+fAG4")Y0GRg;I%aE|K:[ĩ/K 9D*VɪJF>drUK43+Ul!M_2Gxn vua*FmL~x81% WxN17U4cd Uc2^Uyć^soKttҿHYѺR P0s"NLw7R]O݋_ ؖ]O|:L+έ |@}8wiHVӫ% 􂴘V탇 D+GUn3Kvy I=tu34:׆3~֑[%qT\oBS\ vB_iָL$(J{5 T?sQ" p ?"+=mzK>O aVI[4E<"@q%C_f>p 'T[ݲh(ꛪw1 vZXz"=|jP\anpJ#F"#ѬiW1F:n˵,mޞ)誏1*P[D %zOZ498aȣR6k-p#DjnMalywd'ߧP"-ķVoB]7oDDg&i[ \: J6IɎ?^;f7z e<}ͧ E*QGdA 8\̚rP5ȳ࢓̯jڤH)xh;"ްPdkAhri}$n\/rdIv~=L%G{?s1U|Sz-荝\h+>{nіbR'D׻v5lw-`DNhRK0ș=VL~rPExto;#ȗI`1z+}lLB08@UqbqJXqSJ&=mr$͸ټy ;bs;f>z%x5l^%5F'xŊ}̺Z8U=YTȯĿƹ@RvƘÉ&Av.j'O0׌ Azѱ2ŨIO-=+AXxΤ0z<8Ih&8;Y:]hyheX ©H1N偞0&Z qpb8iݓg;ܭSoyǍO jV_2.2 QL{/Mxؕ5G1{&}odQn[=ߖO1ՠZ-!]I^HCќ,QR2}L7vTekCa7K;3|2rY|hjvG-kɇj1ץ~@|{eM%ғ$-l%)Jߙq} 2(y?KHŰtT^yBz=tN\ a'3PtdwgMj#@!_hS9pï̕M-tԓZ* Ni,9mW`%qjT 8l;wR[L[1l&C OmfmČ;yhm7U~`7O^NԵά_#Y/`+)ڊʭ` K9XKWw29.6Ä(0=)z*-P0"7I/y;Q+6uN}3:;U =Mm R*ǢW3H0I$_DBK;iRSgNU>2 W$cp`2mzd$ _H旜 אX<>ް%i08=F8J"Fxf ėɖHܡnst{x<HA&:pZdU⥒)'#O,tk5jUUx(:#559vӕϮU2S{/ppT;Iڠĕi|}M{.QVk]OKfmWPZjrbZ({erg$ԝx-7ڂfHΡϴǟEvGFa.U|I@Oy'\|c麮A*άĖm)I.Rmj.xUZ/:u)^\' "ϿgV.V~(;#оsI1(ʲ?c`euz}eN-ā^^QX)n:rucα X5B~\udgR/hjr*HL2q"E$p*G0) (< ,5Ղ#7ɛ8p-0<֪Q{9WA?rYh{sS*D]m/\3 LAX'F W\K&U0gPtvy6浧S5GSBk3kFL%ٸF26o%#x\ӾjX>ii(;ARy]Z ݫ3MUt' u|v| [Z`+=K POa]Za`1j6p;mx_ _hhp3Vwj. Swz>io6Hal9 Qw}wgl.v#8Fc|SWawѣ}vRg３Xm0^8>$؆Z)p92#ٱ"V|֍w՝*`΢M-+:\(Gi (+kLȘA^%@XcEbs*Zh{]T%4 U^8|/ &Uɓ DI<~+@cv"wŵK*Svu9\"O~g\݇Bk#{E#V0G"A_]\TV{&R2R 9BR~[B8|pwY 0=oAMƹ]`B#͹Wӛ^'d2jIo z-ѳpFP.2L!a0"^ ,m=uGH5x{(D(lB_sHuyt2bn繃9C{tgOWFb i\H>0ݞV.N̈OZv?$ޗ>KN0zsv$S5k(Ug#z3rhR!]GWHwrĄ2 Kgޗ9S3?OdѰs4u0*HA[0ݨ)`LM0T`њ3f8IX)O!g)x}4ba$&d&<9ޞet>š݁ehkcyx|!+H"DA@u;(AƢ4?"{aKOׁ=b0;g(^yQyzZZyZ e;XgkK$LO!]$ VA\Lgp0&ϵ;XDĹ^EC!ZG+Q6(eOwG*OC#x]Gʲ&#2*SrTf<OOZfG" Rn+0(劎0 @Ć JR&!Q%: v&]KNK̭yM}S Q16Rw /ZӠNَ7'taL*[)_Lڒ [⬸}/T=ݫigD77ʓ:(5 ?|>KLAKC`֖L=b~nK]]?[$Bj9F~QtsI霘#B4M7m5P1Yr,~|.p K {|dXƬ]Q=)y=˃zAqhn #+1\7]'﨡UaC^ Sa"O&S ޢW)?9a_Xާ4ZwFMhA1:kϐ'1ge|'5=LT(_FWz_+ehC2t V)}j;!Ztv' , ObZ#ٴu!i8db``NdEh|9-1ef$u~Se8griB+d9TiV#Gp %:Z-ķy 6F O9^:)/"t%\XhwYQɛLHo/Xyq`Y-OJC7~+.l=L㎯4q'f)b.˻69DRBڙ2xсc7kVl #68 Hȑ =yj/'iDLЬ$tRL@}]otp3:(+V 3U" 2gq(cbcgJ]l4ՅQ7`aו軪!qD9BۯMzڳtvk y@})1Z}xL44z ybUk0{ئַD‼&{>di1]UvgxyI`ddW?._6Ņϟ}4cd'>Ůq7ˮ! _J%>.4㡯u4*EUV"aČ2o̒Yת{C-I&m<4t1mogQmO #Bd v"{tei{D3+1~Ƙ;ptO&}:/ttn(?M'X͸䔤QZnfP$Q:Mע=W2|0aEB=7oug?$oDdmL硡+*zNp5eBlG&=08D5NL`0iXg7]kFbZjЋ; s"[z*1hY/{=F5 ^tLVb%<X6e5O,ޱɷ}gjA!@!CEqK9Uy^Rߩ){Ճ(tDGfCJ.ה>J`'ք3c/) q1tf?loWJjӑ|9|?sKtB^ ww:{HVg 7D%x:T}"Aب>ɽ}!:+1H:@\y!tTP@Ε"d%DXhMe<1d) Ǝ:do$hM:ց`d } X Vs cUA( %2]q@Ҁf^tTC3c641_#@0a .bZծs2f[ڰ!> X6{9X#ԣ2cMz}ObLԖę'].+u){UcjZk| Ҧjc?+hjx³;/hVceŬcf1OoV,in]?1ʆQcG=Wm$% g*HEg"߃^R)[+5mo z~bzAC%Kq+(#[p0[ jB.b/ $‡KTѶN$ EfCmS8Z"#AN fl,2AyNw#+z){:Sť0|'S}gR_?9 oG^dރ@H=d<;0&\_+jo+yrgV#s1P7:9Ni͌29r-%Uǒ8>0pEeXS^D rII-+> ?yq@œ_:)=jp?[6iGP6;XGfVT=1o@57#{,Et(l&^вr&ڦgjP>㒛E L^̄gNΤK94odu!隲Gv'm:NSx`{d μrxh.Ip!(.m {;N~zV@ݱ! VSof,L c:eTIZX\dP8ܜRI U0Ga5=,B\ 7zһg,,.k)zaXlMrY~b: yȳ-訷7=>-! MxJs<6.WkxzMf8 =|^#Q+o#YTÜrO\|?= ބGX)=-*ONȎy dkYd6XKS]B; EBΤd+篑T%'!Tz(do@}UQضrAN#'' 1F-N٬42Ǥ{HTFCMkW JYwMm09U_dBnoS6ޔ4 Hn^yvQ{e3ٛNk-:La/nO8Sb<.3t3 Ak1/& ; C68݌^e#7anPaF^.*x Xqkt!R*誘ڋjZW_|%iql C4?KXCw3\D<ζP@71znHo i1> NTB !̈́пd^h[!iJ]wdIDϩM꙳Jf{(4í$h*T|~һV$WuW->#}zח/N* tV'>7'^ݝ(D!gOx"*٫gy*% S6#49['?, V'a_22(,Ip݈hY q?F*ȸTz+@nV@(AxuTeO,i#fTVYJh&CLw-Vym[Yfe_7;)fb#X ƌzV:NKx=@ڰsS"=_ bF8Y=뻤TYR ep$ID3FGIMז2Xp) U gDI.q]uO:`@Ԃ=LqAl6ʰi oH@:_xiЪ+_`^##g1z>6.߀|7a_o; b ͳGdµCTrح y  jPW"gxˌ\Ѱwh>zB"5o?,%cuա ŠH4˿,'8a_?^ߟ"` =n*^ GaJ@:azgi_&[-(B:>-8aQ< q)K/bR5j+§{t+|Ҷ`Gz&L.4gv'v(Qm|D ,Nswp)؛2%M.x3$?:(hqʗ8wA#R^lw'$N!Zds{yj8R;Lɷ=+AA3W<=(29jG{&$ɴ릎- pG,ώfx\MLw /{HpWy07~VNxѯkPuf|a=&B[aoIϷV<&0a}ydepw-pAk׏I ?S j}Bx,sL1Ụ)2y.ZHsm?՘~m,@"[]J>^w=܂aK8!Щi%9wcbj5i()(q+*Qۊ(|7ChD<ᴪk_Uwьb;49P5sGiG) / E{eKŃٟwerM=9w\0– >#rCcMr2>ڗЃ:y4=yȺz:{Pu\ 'ϐ_+lcLal ֙!#5f3[ ݧu)g!04E&@W僵.zNPJ7-23 :sI[\%`v@  ]&'c&)"{n ;0R)FBRBC}f 'LYacXԍ3&2|@|zJ95O%Z"5c vu\~W{ ϱYۃk&c<{!<obI5s֝o*?r89 ^G6z=6sv<n4 =^% MfTBh'[mnܦgG+~\ֺJT$ Q!v_iXPEr&0EqrKj?q ͪ{A ` <`jܕH܀D|mdl9K4$ 8v+>p9ԨBx9[%,Wî9$ ;C1`ۚǨtC#E@XFHaX:PvRMaiCje;F4Hcv1ˤ PPM} 0;w] -boY5&6? Eͷ@ H}e FFG; !6rN3Gt 4=w3)K,lDSiTCA vm zS(Sʎ֧Mm OH s )"04GYO* 2=`ҙ(A~Jj;dQ͸QqEEԽ/AObNp-uzOL߽I0G1{]֍/|xwmP6o. b<1ĖF4IB$Yu,RF.vZh;]΅ qNP}!q~ Dž-:CV} (XNCPb6Ĉ^^暑Zi9g֛٨f2x촀|r!l7(fQ@ _B!z&!LFuOK kjv8 0) QWpxco pi~ mג7s] Csp ӳ',D!77umυb&>qLlM2f W{Jf U@+J/ G:2;UG(N/B`mit^E;ݛj$ tK\>~ M,o+E^|ޢ/,Spl(ڎcu/4iO_9h_ ;҄ɗG<-o7xl c8;eb;vIEc84) /P$B_W_ ҕ:|$ LŚRlH H9,s QSg&9`PO pBE<>F*yFUӝ/*ڤ+69Fdji $ʤ>V"_߻0߻Bޅʚ؞ȔLJQOZ *\-Ī+;x8\Agܞg)$QoK}\zB20fe\֮ 3*%f5<&M(Ꞡ!1̐!VX ]>i^&joT3mzw$gzb->xmPn N37FʿĮ7đP9W0f l@ۑGCUudtꏅ>"2K,T,h8]`$_] 3 ]u39@ + A^ >ejNZ}9lsH\ ڏ8^M27wHaTI lR%m3*~]}>K)+CDOSV ٵʱy ) 9/ D}]12oji_5X']l:,a xw{0>)kv8i0QtC_3&5|` g!׎%SqiCKMe/اKsQ$'dEhtc{߳m'ҨѺeuVzЩtIr%N4%"2"z5JK %'.NƤЁe=4i ~jgWEֽF {Ew8V!/ | w%`aPq<̿h!0܌ ^?Va 2G zKm āL %8[xy :]F%A5g=*a9ap);? tYakScN̟Ĭ[S?4Q^Ml+jkT NmU #]Cݫm-yH;=|j _|3mf  q0"2~X5}6-CO=7ܧxPM ś"zuYmԫ+=-hW y"LfQO:yH^P˓(;^՘Hr&rԯ%tԾ`bՇ~3gVթmn+4~(dfiH*]ra$ykѩf.x9M  wz]d6:pcA4f0'/ipDlHor7s vw?:Lup1^F4RYw3wHRJ.4L%~><.S': pzY9[.͠_K -ve Lja}Jji[|9\vYŖRw_9RQ&ɶ$(a'D)ur~.`I-jQ2xZy j!n7۞p$lCUgES06N^KX_˧)_2r@*Ljj-.({mGgS1_3$Hq_0^h'sQl^O@ "Нʗ60{-źE>ұ2Bx3s>K,N.{TR*/64qڴf/pzEmvCeMkPY> &2kixא}_(sO,iESj S, ~>vя)g}A>}7#MD[iԾZ}1cbubN#kXK}kK$7Y 7X9¥̒c7 I7wE,3"cp+H2eQH+97MwRpk5ip9W5;Ԑ3wh˜\iS ;)f#ٜ,LMCH\0Yk;ל%,Eq7PR %(7 q)1 C`xp;*dOv;_u%r3F_$xyA\ KB~@NKJ EoYHD3ˤYwܰI+n `w vKcٲ.(Ό@&ANX^V(U<=cGhMhe& զ  q`U ' HU\!̪X%Jyc,:&mڔ_<`pbCRm1q^+byȀJGҏ0,b;-#1WP;P=MfT?QhWv>C-rW |~TZuIDy3ʅU}b͠+Wb)qv‡P3ar!˷aUp,$ؚkpiaٺtL%}N:{GZrvMbjJ +#0%2=dDvK,F]JQ[2Gr_};G+.EQIyCe|-:R祠D) qtc[ܾ+WPcު8i9,H5; \O@ԢGi?2׀ʁrdܗ~.Z {v<x== dKJ#\^$}6k6OahwNFLZ'^oK~, a^ ,3gt<w ? G&Q+&+0>(jMc3aIV;l&c{K.>2L}X}k7VS+]c7- 8$9%Q4H64RWWCr0_|G>T@KlM{/ >WiYaͶ0@t0G$ɕ2~% tp?;Q$k,Wz@'ƨ X&SȀ&)p0^qdgzo\fCg4/d\ D%ZmL>x$3Ih' D3wd3BmNϡgeƺ~cTfJ~FjQ#9_(hBUm+;RNO c׳ %.˜_0Z?V~JgNXs]lRCc?-tʔ a7F )%dF3*l'jK>釡c,2RH/B#ýG ^ SLmWQ(E$n=J_򊝕8OLBۣ<5n=O9Oܑ ЀbŦ}D9moA\O~h])V2pbCUIKn$'t\HO8 .:20z<G9qK#& +D}T+yT-u;L:_2Ά8zU^#'YFыYvg(L|6ވTSG>賉T8/SP"JtO2Ycc?A\t}`P_M,\D0n ,_z\kt+N:ZF;X^9 ,\C L&z"|$snx,vm])S @$ִ Ohh rZ3]ԉ>~ʻXuV "M&5 m\@G-7RRH bkވ`+WsbFvFINWU5_aCѤY=L8,wCjӫw5H<+Rj'? 3ׁח'N95tp4R`KoMfdtsla i9)ߖr:xNL)cto}s>jO0CsqCޗ;}Db:@~R1&E\2XƷ'\CVc'mN܍3Z<rȝ'ၜĝY@5<4E%廻v]|4gt1]>{43N1 ${Om՜"!;DW|p':{j͆x|jG6 _TP`!x1ڴP.N{nQ֗uQ/\([*|5#(iYSpTΐsXðpzte"ndm@H~}Dskv ~3 F|Qs#]3@x *$O{CHMf3ОZ/6u@kԬ8P-Y&cN&IIbXywԾr}p-j;kj\Ip|NAa_,%n&/(rWR4{`}7^PɯK~j%hUz_?pvٛb:{|<atY?WaM5UzuGfTR*4,VA@}7iw<;Kh~w!t_xؕE*@ b&ॲեijʓAQ%}^y `T]Vld 9O`+Ƃ~*ǹ2%d Ugƻu_~+]51Q<3_FӚީ\'ҮAR!?^L7"o/]`0v ‰^~O{|)űf#-XtOAMjr-'&葅F]igJFZ;[? CUpGfpG4dX9ob7*%2I[ϻnޔkX/o < 0hyMwйLڬTSQN+"R72h] ^w+ZS 1B g~Y`Ev8l8iX9N h 1ھSC.37]0bֹE?V"y\hǤ>vF쿀@.#E4AR#\%='r˕<;)׋/sGxk7U@P+)0MXKn/Z# K,ª^l bFd@OHGiuӜd^̍[+v`K8D4𙠷С*It>)uJG+fPҜ:Nx F-D̎_G~wV<.=[Ԡ nWד|'bEjǑ[D) =[H?Y I<=p[=3iTp#ɝ!-T)|~-.qؠY3l#&@B_LXXnE2d5ȭ} 3 'Yqfc i\l@ۊf;9K "vg{*sT$nj8,sE~ܳB o d/ xŲ[cD*.zS%@lj@e?c:Qy'c{ ӗyVA,=EJ9IHA:JZ0\ Ya <u5fqk0n ݕo}М7I ջv<{4)>YQ?S}&A@T0Ug?BB-&- k/TmaYy#w9h f}"#=##6!qU_vupuY K".ͦGND-wxqa !+{h1corƅ;|V҇O&Cgp/N*x"*u' 8 xM=;\7>c"J&IhK7@ ^L:+#!p{ %UuQNQ7džh+ 9FH{Npk8^( N=:Yf;4T72 7zA4yjzDHaHF3JU? vj1TNLA_YrRnh\Y%YކgŸ𽔏.xF<({Aja,lC4)3ozxvܸE=E .m[m /ctk'71CMP3fV?Q}38fj!ʶHa1x ޗ6qxw g6l}遶tL8C'G?AvZ|a:-mkX!O8Ǻ& bplGp[ ݉C|̤M PLA%(-vC/{{/B )N{i|ϑkK}.*>t^C^L|Xڀ[ q"( NQ[ʭKcwZ\()dXU 8W^jN1"i62J oIhb艷{,">fRLe `+>N{lBNX| ` *o| @2E#Lr"bXE:@S=nuh.}W ؄HqõF\jfq])e 0ɤ8> tZl_M^ ldLڠtu. 1R* bwtO:;.3\Cۅ\_/j'7+dNa֣ ÆRf"zA6 4'MxJ021"t[vI/P\66ϝk(ઓşAEp}`4Ot#מ m<GS N|+eE0v㙞LѰ"(V1/(He}]?WV%$ ޾Bjд!90K~z5Fi 2 &Rg$Nɫ[0CͼMMR$M:yU"kF 󘽎)rFG7 }G" .xg, QAβ\ G\p*k,̹9gUSI*ƓbBqFpeQy-&IQhlhU%0H(hI(HC"e7d9z'8Ea8c_YW?H2Ĉ !"N2j4z>RiF[t>cI*Lsbm3KDZzҩ`4y[%uVV<>?Q4ᓽXQ 9؝RP*G}h9>smh P-e$ky<ލg\6сel 7#?i/V(,1Jj*Ic.z۬f@ok1B;RġA#XG1IJrBB;Lܣ hPBsFB1UsZ;4ۭ3:=Ue$CUY<9y_s0}@C&ܭJ TRW񱁓-8%K_'R]RvX-Y:m`$?N{ @jE>x掹WDu]|Ψ}*C ?Lƶ_++j-)h]\/=[dƁ@e5GB;$}S-Ԟ8"mQptedTx.lJhm%5X fِH ώcU"{RRXSmb `VdBہvKaXbؒ/ݢ4-Q5\Cl?9 }@$@u{sA9,0>ڦ!r܇ ݗd5Z8gdT}EH7,_:.v2l/& Iid3ɚ޶YĕZ~>S0 12zϯ\w+ ?LJ?ӗJksi!R ׾b {L@wR=ƨ詝Hde t\Zエ32"0,&dS8Q lO_ B\ Jpjܪ5S;.]6n tΦmE*( `WV)]#Gq8g\sIKcsȚ; A Hw}8[|ELU+E(Nݢr ޘic=9ghhx!4.`nм#[! 1䔈0]Q"%8L=+ 5CzH@*$> 7V/9?SkD*yK [4i@Khɉ%ԃ4 jYz=[PHmflUGt.Êpō>cYFRw%K\~kA c ^ߺXu!e>V bKY`I%&/AtːZL;iծUO[糆!Ce[ Cr n6|UbK;+nS;;ܣot?htiI]0tt".ѡ҉f@X6U=Axaǐ(7KZ bo W9pҧϋo#wG`/$cpϱ8=zAYO"/Xkc/mPcJ q,Y3e]?$qXу i}!d}T*ٝ\q~jvj}zb(v{`D K;۹12#f`ɔ69y)>Fbd%ˌ=fRu'R\ۍhJv\rrbE+9?<_ly0+4ʀ&qCj)H@(SHz%zKL6fO!`Te2Wr6ߓZHB=jAͩ+b<#8ɢBMp+\C5WJN [mnwg֠qHo^L˚xf)'xf_ֺመ$42?;QJĕy7u!}L.3FhcX~jde #&wK1[0szX(EC^O{Ou44҂P+vmn};]wC GUB2=3^釋 dMҲ>3H Msw8;*#F2THɿ:EJ5Qh!^Ql8 W6ݽfCT,0 7Tu[ dW>8/X1lXjrX[mY6C*`W(>M0`(ribGҜM5 [8y8ʚb(#QO˂w%&32&!sܹ$s˜hb7Z!ZSinpMC sgM=raDض4XT㝶&GG^Gm0tco)FA5)T;S?OJ8I=T?]%b> B5~BGd&}T=z)j&P"#~z 3s`AӊX-Ds/ξ$̝_}Z[Ϻ"9 }HIF:?c}Gkfn"N)2]t 9)>ЄCB:{_eіz|1ܳ-0V$Ll`~ݾ$0 < mRr%7Pca*{/ڞweYֹ; 1>Mf_<߳seg ձPg>3MU<_2*}Zw5H(2>eagLs({[O?m9RV-ݲ~cUY[v`ԫNݐ{&]h[VUl eGǁ46Ag#8կ7n7^_'`BO/ ֗bIAмGc ,R{)2% ]9+Դloa\s4@$=ߥ8bGqIV)r`>@IsF7Ǥzn$at/ QD%&\sޢ}@*pʁ`BfsLh+,ȥVzhH=QsijMdp n >S6D\O~4)9$qu8~x)af dDTԸo*i*˚oqGԚ'C"`GH{Vni55b!|LxvDDC.9s\:Iz͕#FsU ҝ(DP4swYǒ IɦOnhM\ZbagoZ?>=r5N?5|u`sx(4!y 1ͬ/2{f[)g%5 wR%4,V6wj8pԿRE5Be~E{yB j\={ B AC(̈́o2wHy >OWKsJo}.lp/jWpX,~1*Tw>3+mؤ+uQ;_t }?hSp(u'3.}_X:NtUsylW&Q /xud2BJ5++jfLq RAĩk:k_: jSceKz$AΞaA/4r9̟]+t±MnIz3C5%)zzq[jW7ʍ\~{R/W_ &z% CjO0MaoCݑn=2L=p wh~/VVIqDd5u 2{򙤴-fd%.֞KǗȗsص{nJ J{!j;\dђ/h?aߊ{qs_=V{ѓ 6h|V䎳|nZ9ڕ1٭SlD*N{z1ngir]wo\BRޒ6^<$H-I/Vg6[2f_k\1+By6,2T9oVLF-Kɨ7J-ʹ;N|&Mh $Q*'p'o ;_{Pk.X]HcZoEwEX-}+ n(rսW7FK?̚#jSNw+{"!y(4美 Sy!FYϴ3Q-bKZI_UixE$a/wXKb'*|xP&DN{k"_N!m=ρL-^Tsr`ŭ eHԉIno:dnii_֧#|KT {2Ѣ|P&rlIeYs1cd]i*ɩ].z']P408,}97c+CԮ1|.7Y|y?1_Jx).Fs6/8ь$ѓMdiGZ/pDsPp\1B <  z z1%w7wp_'D7xaģen,HXGKIJbQ_ВOU-J+*@#QI0}1!ڄ!޾ӲR_,hKRҨP&4MTB$ίd =`١uV8Ugmq>py4&eTI5f[n!2+2m$jbg[NJ(κ[[hV #B h)JIdY9@߾+Aܥ#|fGk=lK%|."TW;@ߏD#rں85 T쥔+~Eݥ~0t箼g;׷C88f& H)qiXkmM$c{MFScwt){pʣ =*ϙ7ܝ,PE^zrƒe^'[raS=[ L}OOXVy;RAV=( 62GE!hgyY  ~ hG L~%B`mYGi1mp=mV]RM +6FAQO.rG=S F.yt:> 9N#}=»jGusd4jgE7@e={MV*ax]EN6ng q􌄲f=\ !SL%mbޕ;HMzQvEQ[YؐNz4D^>=̕Y?5|י[d.L qlgz#q&V."I;)Nw2*OIPu02j1&3C!uZtЍ/(U >KKs 1^jȮ~F#5z1cdL]4ŨۊYJ \!rl3/Ă;B#X?J_~. Z*lèLw:J&Ad goΜJf f*;SïX*D.aj2 G,xu,pI4@ba43~{(aGZ)%jTa\v Myk&M0ޚiETG0z^z4 oON}:ȘA[w o˷}NڞH!䓅r4d]ڀ &"~uaZīҵ:WcKվs88>&d%fhjf~3)4M>hV>ZEHIX8v'裨+0-i#QI~Zcug$Vu@Vg7ᣍ?ЧsLKm7@>={dϴX1D4{a0bKPLڅU]Zz3E6*2&;N%PvSP8jKT* %D/Дu? r w~f=H)qj2UC,̩Ha8 :V,KըOU-eUQd],wYL?!ljZvaXY /sbUopf_=w0'{z'hI~f{^-'k°pZ&LNQ?I6 2-L6/f'R,qT߶X# z/J |o ,1:HWQu2\@q$2 "Bx}Ż e._3'J[`S걯նQ?-'xd}ϞPy; g;bBHS̗ۙeG݋@jM`w)Cpٜ )qKofEU9zCR g>"XmQgIeKj@:8՜|YSY UKmAc P`5H뷖UFtL(}ό/5@S_c2t=!9XzA*_0SCK q0PBr.}fc]=@^)θ0S,gA7[5Ck/`YL<==$WpMlAyx]o|AŭU::P |do,:ĥS;mExl9*$t 9ߦil5?VkLY lKq[#Jxr4<~y1J i ΆL~u]!iGibN.ApAjnMM*WZ 6S*n5>6X gz&)Z=Ll62%VkrOP>a%̐ pts;q/Jv\#[ n1T>$m\CJVt!sX-: Wi#% ՆmP9>_IY[5fd0I2oܠhrP߻8ReHy_@m9jO les7iMGAfՙ^E HR2 >褼œ:ZzD@Iq)mx(Ѝ'dc%{إh֐MW1ͬ0Է@KFx)HL ?OGF )o ~KFh۹!KV!u?SjFAEvQT­ ٺmy= C@4pIߍ3B4~pH@2˖IDD]^[qd &\󘐒 ch^t̀venIa8r^ qm=y=-DpkvѾ0oO3-J~t^="H)4%F6Lrė,w,%w~㥭>lDn\:#Ѐ·_U4^Ya<,FKP5VBC"?CڀTZ0:`TtsPlkZ*g<QӰ[P$T4H4)ծЦnkAI~ԎOWi/$dB 8`vr\]$*S7[ul)6ɘw.t' ""}$xN ])gc|/c 8 rOX> *#8c&4\SMì0Q(RY/0)iILZ8FLep>ɋ5b$0d F &瘏P?Ys \軡goKTyi_4ډv1{ kTl.2!KMտ&3% FAE˼r}b(/UL͇qUFd?OYҢgSh!|;eɶ5p{8W86/LNBEG42uc.;9vrqD"Iy EmW"-9gv?)q%1`c)/!cy]2mVo"pR(`.a|JR'^6­JXِKnOƓz@001wGŢL [FOAvFYݰҷxnsfLvK<Zzpk~2&c sA',ýg9&?Ufy'S4oT`7$6AY:edfv;Kd=b,a#T'6cNeqi\sw샾}^PB]̗\Q: 'VXfZ:|_Vs$ j-T$* ]93Ϸv&ٔ!!ޢG漨d 70=xQEe0cO|,,k1r"Ґ `osf\l+7ԜB8u t-,.Ƚ׶a&Afj4MD9]Ot6%ђT p  RJb]@nqg=Cwq6jmc'ʷ.SaFjAŵ^^yjʗ8ĂWE+O-Ƅ'_~bϖܠܤ_e7D`5 bHhQǎO>vAv}*i2M sw8Ub`h  -i΅P 5S–\Nkξ:nAa$B2ڎƸ('=jNݧIJ!SEׇQ>ZtPϽ@GK<dJ9FJ$%|*V-| ›|fX2P6EOdp)EznԹGldmb`^>鎳IiMŹf&hoy7\k-`Μ  3͡'ȣ:BkV3$Cb(;Xz f>E'Qd=˖g u$[J)qOĉX%טd=JbԤs=Db;HX<]bvF6tl?Gcխ7Eǿ- 27$߁cS{Zm`TiXQFҔ,iQ,&n|+ԖŁ4~,ʐ#u! ͬ^ oGop 幻ZGPHJ'k>-GgЛE?GJL!܏^W~$"oWͩ⳾P_ML}IheJ 2i7 ft; (yX΀2iΤˊkD8J=EKyDvfMmVJ7Ɉ_2]Dvw|GY0)kS UZJIW~nR)ȴb((upTAg_$OsOJ@Qgū&~P܈ISjFv^W𸲺sZszק$ůjPcޫ />~frtģ0?L8rl>!eI€ARaH圀En{|3*=#b. )s`|y3]7'O:YgP,kRddo<؟ǡo;5c̥ q7궷l<ܜ])c]x ' "VN(m+Ӷ#}F8[V8u5YwW{VLfc'O:?{sJYmWď֟!iʘTot)>w 95Ү#]54i9DX(-&X6ߊ|wJB1:So+v rLR P/?m[q~ 9F93##l}ܨЪw$c Z;15peNLv o3R$Ǿb[itdU<ޭQ+^j_ LWC "hKPqz?t1 pA^{ [|Ӱ,@LQ=Fލ@(\bm֒FAi{gQ:ڲKUSs^9,^F So:%|u~ Kk{ye,Mp'uE4:<":XmL2_ç6TR _!׺x@)n#Y gJx|=! 4%f\Cy. j;}LFB401 :G}bc֡gPCpGEU'Jkl>l@Z-fH(`k,:ax,(k?i VM"p ŤC̺8R.ΛC9|tfY]c |:HxmM u% |7'@w'q jݭ>qv3+YE{5stJҖ8)Y:w$[#tKh @kjW;Nw.k85 KYƐon`\"m8-9@Ai*&:uBm|03/#56/1?u̓ !L1n3Γ-z pS5UWS:I|=hFs%W]8;JC? IqiR&D#~֏{ 6k/%u CU>szKT(TRT^ge}^'8l\$.Uo@Sn%'MҀ+S_" {2  X[l$Jp* Ow]r@& [ݲ_kkny-D%^3c+-r[oeIC<;e˸Yn,#y =ՂH[ tLXNBDo2,oAh$!icy2݉}Z|b2Z|o" DU/ 7~> =yo*N6fqo|\O}UhCL N2A ]rkN{JSylhW/cje8]5~ EX7 P }tL$ѹ0ŠpK3C JyfZkx_ś:|%NE`-I~iLe&%w|?VM;&B*Ƞ .!߅Tùӿ(g1nB8q&8kHeW=HÖ~ߊŞ!ѬawdN3r0 9Pe@RF9K$]ŜC㲪6]rqCicPԣ6t?Rce|ǡLOEXwLM8șg%0DZ "azɲ\7r80e0',$$uNšo}9k<"f6 =ۧU~,nnHv_ny7"!IhVhp:#0-BQlyVQْ'E:bt#Ђ;@Ze5yܟ4Ŧ,# "D_It_XF ]A ҥ {C< IWA_T8Ј g#)JSͿCz=3ԡDB|K_=6q(08d<[AcD`A 6X@}XdSdz|@|%V %x54a:)oyhCϕ|9{c"U 'GVWؤ?3niT%IK~qD'ߛzRpN-h륄bucmj[g>޹்¨[ZS<4b;6.;`^TO'(㯺.TLwf(hț;쏴npI۲uQ(/W4oTƥ$qU0D_[y.;u1<zMZ)M,5t̀qLMXߪD"z8RʭDr#e9RX].㔨]D>9H%c:)?h|WʯX דBd͚}LYΗKGbCf6~[.4/IpgmlnㆀKFJ$9* Ot/p0wf%u˩IJ%!Q fT' )8XZ&l菒t x0 Y\e GZs@b;Y8~:,Lִ%L"OfN$KeѭZ>r$T-eVcQ%Bd}ُdT35dg6iSabD  :NdP?f= HR9\:Is /I2DV{܅}GJes9JjK4o@N[6G=I?Ik˙CJ 'p< < N8R`M2\n{Dhf\ϰm;\,z>j28U5(ѭ7,Cܯt^.pj [*pknA'ќmGhl}Ġ| ^[:06Xt"'goTk sѤx[lSu  o}Ő,@beu;4G i10Vˬ3.f o;nEfîD:+:L!֠^VN|upho zqItD޾~iLero)hYub9 8d#DHfI_hW vjOz>Ӽ9 Bxw'&`a+FUH٬wS/4/)WZ ‰Scϋ$X>R91[?#kԆd-Ls?.3]ԃ)Ʒx,E=օ~S xq5Jey0˫ NjbA*w!G0t&ZA [++>]KF7\ 6<'BPQRp;D"[J$W0DP7|6W8:toW6/"?GeӁH0tR3æUOui\ j $̛MQW(7`e:r< }PY<ϊˊaqUw"69颳*3)`I_0VY nY)Ff$Iߪt)B0j.^f+;ZQz'j=긻q[0QA$gS574гj tΕYLzGylY,?*+5M^?dQt_ց-Sâ ym0e2T8xՏ.MkO;l0DK@ nDEf7-M VT.{m)D'txz_>qFMf ;ݍe(}҆N< i1+YCÒ0;T{[mʾ?q6ܘmED/Hy-NiXU]ORpPG I}w^*-3K:Nɪh~0-Y7;QjX/ &7YhBp TGƌtg8`G';U8򡪎HvENFCQ N_? } Ng o8-YСA^#@p [KP0*G!wt♬;FO C{#$ PJs8ɗz Bw(i~bmc^B olұ :-M,b ^N+m.vE||n$eb/n NFW=|r֘vF=_ԏ8ֲv ֏C׀~֟`DSPk-S #U_Nm F)s 8,t 1~RPNv$xǐ[HU gQ8񰗫tEj-#+uqǩ~mc"6AloC {``I"-,d&VW{ߕo v',~v(obN`W|vBopkKw@"F04oQ]T6!?M49v+޾j ~W"W2T́5_XҼ$%SCKww\ĐxbO4m"""@5ӀZ(AVj4%3!mh}eD7A؄O~0Gw' 8l@ϱʏZ$-4PVLՎ:䮄y`u%B7\%z$?|˨!:G֮),R#R#".JvVy7 z,2Ahiy-!IKR}P&:aBsrӶ,WgQ݌,l/^#XCp z/ Uٜ5 lB;<9/@䵦;k'pg^pC|")dpO8Iei' MHjFFI1pnڪ[9':{n@*j@JVƞ#ln=˻ %ʼnj>DYVn2^gd-te{"[AA+zcsMˮ upt7Y+ưX Z`h5plTDsEUL^ҮL!;'uR ӢLƈ=a+iokDK/.A\TnP(D~$',4'Jsz`}J#J&2sYZ. }7>S걌U+0_f9䀦m86҉ m|ÂuaHFx.2#,D*2dNf=ohǎS+O~ G~qi36±A9932 )'%[A҅AcVfhD.8 5wreR_ F 4ศ cb>N͊VkS5Vci}ؕOϸ<2\6pvdqޢHic/x ٦AV.Y q26<> vT3tLS>y^dKzÙAd?f?;1CLQh5rHTQjX3c%{I]Y+{8.sٖ F4YT?3.&M0\\+Wt^6.P{ ~lw4T(EZfc_2N > 1s \nQ+^^/< Nv-/K}Ɵ`.4Y7F!sߡïޟF>N]%.?0o{DIjs۳hdM܇ډՒIK&J5soX2Wbb,&c!cS*C_8D\1:eߏftC}lVEHzCsoylQ](}_1o+E u|"rH%,ks2"sSjL8?p\UUr"GmP-RX;.EJ#FȜ@ې.3d.N(J#Rw=/;L {z#z.@iqȑUv` S ;|zMDLk@Ȗdkٚ<a sOU1~m s71 RԓqAc>݉ŏM<7Z&2Ef "l~! > Ҕ2K0 2HS?Z W>Jq یn%o VhmW+8형w_.TuԪ* 61ÀT0V)K;1x%;e0iA%8v3;w{y =oY8p3# bE:U|f69IvWSRkd>at?x$N֩GѐI2ᪿD!5!s[%g'sbOq:~(vV;5Np$ &@ Յ_ıSgzdς$O֮kሕNG|DTIJ۠Z,>5Z?&Mǭ06g`@RJviTCk'qT-!2+ڰ2 V7Oq3*Ըrҝ>,$)sҭWt kbO/s/}~jz% $%w^eRIZyF,tw),xA L #r|J9,Bx!Aeod#mFAL,?Tr%b Kq(˾czoQ{sXi8*s&>!osCnco1_u%%u@v16s`n1z4g9|]57$#}ӟF")/"L˜shVH|6sX#C wg(m[spQv%<58cC±~9uRqe%g&&A׸%#SWq^x8r 9-qa .^_}~8Ie"qz8RۮEd)hۏ8aiۥ;hy]md~rJ F,l6 O wjgJ gA۱y,򘦘^"r%zq<u¿x@\4zoT!]S\\o:# f/C䞽tb@/)BH9tX/aĎJS7h3*/&{K~WF}yLW)6X>*?KUoJE: $7'n%,D"Ē,عkʧD+AB7O>==U2)L? Fzވ9 /[ }{EH&TRښeVeR?+?JY1Oڪ9}s#OYm,A®CJdNBeci`.[Bqz7Oqں7G :5Q$ {B-4oȆhtEBVcy28C"c'6,zG/]Kq=9ȟ!*W:^0!yAIƩK7}<( ?DaY+.+*JRaY;P3> \bAo;eK) n8>+ i:fW'eɍb+7ee߅bQoeCeATnT%5gROc|9%_D2Olђ%*΅+Hx'K lH./Gbw]J9( R'g$-we<T6pJ'#O-N|: BmynDx?I a, 3(:E^b[݅+ +!=]9s[~OD li%zv:Y;Ӵ]w]NeiB8K)Ҟ2Hpy md1?=u1(T({5 UMzUO $8BIu ,tsi|$yxLg"v<@Mg͚S[fYD':̷~>oÛqI]#% YF 'M@'.9;סxӔGxjk'f#0ᐗ&pCXx ; #Gy8Hs y3k"RwPmpF%g,JZ[2+ŸDs/dp ,8ԄyFZ@rUxůIe<Ҕ2E֣}xotcC[>|"\VۋX *$d[G(w} EERe}面 Zi+*mqfO} Xm.wv:"և-sӐφ mFga≝;&)W%<2* 0˾$uv򴗗f c_*f/27UqMeqAݦ]\͓@<'k4ĵV :*'Z~'Y4oS'74p9J]$00:F7:`k+iǝB5ώ< F})M~0.t9R >c-]:X}en[&VYlXw3%?qSU>0(S6BEm u0>tmo^b"m5ZL(QP]#l}]I\C(`UhZ*A3YI5D3IA+l v}EVdeTr`vgAR C5V@0&HC,qQP?+PRzf氭Vr\jjjSSܐs 9#F"9EQ) %컯iF%.0_gpO9z& h(C&Bdh6)H|>\oa C$x6XIѨ Y"a5!H m8FJգQeF,)99f9!̜S _r'6vPؘ-|oaz>SGcpE$ݳ,r(b({1v@ZӃL)~7+V(NH>hmANtH79F^$p̗%0g 8=n]k9k;Ow?ՈHguXY1erhFF5Aw@B]6f9mGzv!(NKpD[ n}~HhEYQK%"c^; '2*R[KB>ņɁYQƬB#jyH mXR6dLAi',9qDB__tG:>`@A?4)CkE&kj% 5R}^cAXYR5plo=' )$)\XG1.Bm#ҙu[z_j_1ȪADp )E4Ysr9j6nž́̆zY0Lb6oØU/0q8ɒpY@޴\;rxrd5UQ\N}pz0ፈtvҌp]F Z[S(p eC Ԃj$g73 h UÐ@jSU1i -kKZ*hxT:9 =4wZY5~FHM6COj1`,!um%dkw'hʖ̉H9\37]Z(hDj9oC*ex]ƾ!c?_Pk]cJO`,o$rC& @-9e=<nY.$}IG!d?m.[=OR$3c;o8r7g#^y!6}DNumJ]IHsN *C3D鱝&E8na|cIOq*4yi/y? Nc< EیX"%؂GKOPԥ׶IƅӞbtHHk; 3 T_o^屮w3^swqjdW0QY1fyn}.5Rs'a\583͒^h̏pª(4D2A;n%=tsqQb"W7^#!+Dl^jx2”ML9m:nE̖b)$:Dj҈tQ8\UZZ+SOW?i65XHE);_fo}lNgF5QE)|d*%.:Ftr@D0sZ(bd g-j`>2j EWHdVf3d{qWXtshTz:\k}AȀ]DjTc(lhXK7AO$DA XTqNN{'jjH)2ǣp ^|AGYRУDA;u[oz zsϏ!jUg%R]CdHE<' }9L)K*qE#Z4¤%n+D\40gӗqnXg§S4Wo_0j51#O=9}M~0sJT|n:I(` =8gzvqx$y&\J@BaQ@<%ˈDrr2C?XWDv{OŻ4!olȯKT}'_&1x*[Y=A;Xb ]GcAKTr,{zv(gH oE TЯZe+hzs0fkO,jM^պڳ-]SG I .A)D 4:yݍ5DinS\Z7^ tW* {,T7xzIJKt-s&pvܡ6Ҋ˝o~Au'ʒHi~p ͹m՚ $FyRgK#Q& 7JX,]`.혚'WV_NJ CT-u7GPqkgՖ صb"hd|GoHH P$u14+u% ntr~Ph8{wpx=;S[o~0&D̬Bx&cF W.Q}|czta1iI(,S EJ @7$1 goJH(+ OoDғ(rJ{PI*Э\K0?TLwvA!$å&qv7a{_e#<6O)Zn0yI%v;HRWFQ}Rl*^wu4EBrXF/yMӜâr#hυ1kT3pW8  EDqv<-/,WqQЯ ύt/Wqo{ZqK@BA՗jVI@rG׎|%MS Sؾ@\`xy]JanQnd{1)ª8?Ķ[#{yݞثdD8];EPˮc3juMXr:J{ñ1F ӗr;$堅qE g@=(:o~l;~돫F)4+4PJfS!Z  <c"pkk狴_L%L=C(&1;rex#fWziz:#k6kqrqec|sz۱kE-0TAm]?7Y(B`hN/vlR;aJ  SDw.+Rޒ5tX$t(UqIWZ$%J>&~MGKC;=ajkYlU;0Mצ;a)#;0X*ieeh'oo%Zm_҄3PNԍAf/F91iDR9*1a{I&ՙ3B;j42^S2Xу/YK2o;~ʀ˴GL~])Y%*S'4am Vl-gl$)6UM $s0=P͒OS'E~Ǵ2&Z T)E^xDi;v:/R_ $, -X`L*c=z+sVV%|֮o+EG%{=.=Z6̏1p{DS$I:J-rf7r3]# |70`un.ݦ$fܮud4NIj)lUL!ncՅj9ϩlsǖ2sC[v-%8%-0Wಬ 3'Ug't-h]< 6 vVg,+B'=hO7=»`c6ɣšP۾q _c*~Ofܤ_fWD6Ga(YEqb+Q[e%g=aћ/05%k[hT~Y{m'ܪ F|[wǔIV(UN oWlY]ei?dnͿT_chUc1qtےZ9{5v^>;7,ށ؂MY^4\XiO.ǡY92"5CvAr0w}ZRa|(b4cA]UqWJaB@K>C!/H'{Ln-/>*#:L!t|2a јrת-ωZ V~v]RX\7MnRD}BxBʀ̕Ov|GpPDB\Яf=Ҩ57Nzٷ2Gr)믐{ vzJ&g3>7%yɴXM~^_&,in?*}Z9Pp#.\Bmi"ƘTi),P#-Y#=~,5j\j.:! Cdtߗ|sLˊn2R3ad#*:}M_(}~o!r7I(Jor/zXD#QzJ~tm|]gj!_\YMq~O* ;z3^}I-aVL~K04!QEDJ~`Ș^$78eգ6>\ zZʺ e "~t ipdrsKOmXkf8u tcdᕝqWD[hHaF5CG.ދlcMh|*ye,_65r{`-Bv2J"*n}85VWYԦ8刮8x\Z$31Yٷ"xdMؚ߭]8>N=SUjYneSlVշ =!v=AXE^~ܳWXd~IVPdض̜q^h6aP=HX׾_+6`sE*iL)# `v9~cxeB)c?J33FL֌ J]jNwf1Qo;bdNv l ÂuԻjX UxhZ~fD?\h+a myTK@ KyÜwj+K`4SE|h=ܐ|vu$K!L8k1)6xo=(⼃ZltĻā~.s{ "^p]UGxT9zPZPN䦈LThũ%v|Cbt77VI*c no uxXjIo?4_YQU(O3".h%xvp)۹xYC̫ppTPKoE\^7*j ӆ2rVu7#aBJ-;5ٿP2n}S^;UهWUPA?x2nIJo9k Wn/X$_H52j%R^Yv5!B)x!}yN~,ǀ@:">@L4|U7qarK3t,߬Q o1MDhђRկ:&/v\7biR_xϡE7Oe Z]H`@>KNX=rEr0 ~l<{q&59 5 Qů {FnDsKcOR&vknitpw`Gݱ0dڴe(JEhԇ~_{< ~0/tδ~b<섧#gMؐ[ݻr1U3İR"H mƗ{93V$q%[Wzʦ?ȃAJU\\؎É pEI9ruKa 7`QC׀!U/ KdccI;.%k`,5s<7Fd,| ?¢ڣw%|j\u[gG^TB G}'.FJ;Ǯ1M3<_-{i|i/6~&%/!O ʪ2d$yMLq_‘EGIYؐ8֘ |BzvN|S1M8_} ոg8M.>u Mem3ޮ 㗵zveNT/j+(rәp5nJw|X +uY@97NuMymǥi!_0~ŷHh d㾑ev-@|'M-bƜ"b@-?}m7?Wt".IF . 2XƩ7uϬ'1W4 `_~HFɶeiUs&{j֞1:g0(&~2-lU=wy ڶF4 GzkTE`k{M}7+aaW׊?\< Ɩm*XjD3fs>@ֲO,G,%["#abT&Cxdn:H=ՄqUsZ6S$\2uY.kΎ>A%/9ٚB썤4_}%*۔j/KS=]!JztqM^-}di>_H k} 8O*>l%M 3ry-R8;s Sl7(\m!q:ph1U҅w-Ut"m^-(Qk?vfφ,z릜0GφvqT|flǒpÚ,X_4=kdfl˦x8)^>vWz>Z`ohHw~T1 ٣j TV&W OkFU6D'9^T-%biHn/-xOG+I7K.xVZ} ? T> a}!yw6{o@cz: f:c1ACt>đ{A2 y }r[("(Gߦ!g&ŷԨZqv'Л*lF¸M@T "˪ $0uWϳØ|yEuRjl4B=&ш h$7M{(ۚ` 2ܵ*CiS6ivl/ghY02PnCg +ri:B,U{7a R>'e nDR#@0'Ee$W7 $o!Cdk"d>\~F(SNhEbrV˔Q#t+OZ,uN?? r{gRЌ$·Vdc>k&P7 5!4!o\ zwxd}D!`А W&m V܈0ٔ:SJ-]„[1r]@ *ӄ[e%vFj=/TtIdE\etW7l:DH#{ɴ<i@3`5oS/cnD sK{JE[2Y f=\y\u~zW] E~K.R,`w`أHJBD{N8S̪UR)V6>axx|5B'+ GrN5!~ԭ8ee'h%%l;H:vxsZ]C</!O67u3j1;WӛSJ;a2/Ɉ($_&4LP$notdڦA<~3C8G3{~^/oEr.+l:FP5@3e$' URvA(`B^|@>b'v(5ﻌݥʂS!/}V7≜:wEj ؘU"}g񛆚*v"Rg/-|4~ /G̐)[3?R*qI7pzɻwR >|vJC+CŽ^M/],7|a1Tc;e XljߞoA62f2\X6O>G=|SdA [^HDƐJ?XEf*H1LU _AaCJ__,/m;ZhqCyq>KS<j5 Ϣd`m6'fHM~ā9MJfʊ! 2N@j ĖRT.~O+^c +_f,ϸai `} 0GOjF3yzCxgc5K 2_ -ڵD Z:L̓Jff?7`4,MLC'VQ\z.AHcQFD,Zn˫SBN l>$Ď)]q^a$dRdo7ݯ ,+_pDv0R<ա#ځi4*/O8Yd>(/?h^p<|D託t0P{W8d$@NԚW g!}>lbL!cX.419 `nl8hBr.DVX Zĭ>b%#`VGܥ hn4Sg)$%-W>)Ã@mkɶ E5JԥMbw<98nSq.n3F]\~_ ǔ"r? 0=c)ZLOC&QzYlutw:n$8xkoYs%KQf@ [bٕDZзFyݹy`~@AqWys6GRso *EW7p&jF-ś%Ň#<SW2z'DcXq1`AFfml?M~ߔX:qZ^dPP٩Z[ሁ;<%i>s_3+ʜW?h^tmw29}:g$%3uބ8xc]ݐ^\v7d|uaA@D*|x<2VlXݘLH n0W|JaKzN"yS'N+"oXYLI>Ye*|N*C/lNrPɌm\JJP0Zg jR6p2ȉdxC՛l!7|܃rz +ߓϳ!āS <ÃkrŬ} b<~i;z5 ?yPM 0 WIAY[㓀e L"XR}4Ohs kTOt͆?(0ӷn|zstS5}Gu[E@:v {ao,j^Be;]HZF5[BUC$A z4T h\ٹ$ElWC= ʷĂ7 AVC% V=<ֱ@[pK)yN!skf5KaoKUV*,`X+Y$Q'PX[h2 -J#n 2u0VxϓOA`yccdR^v@?/wH$(_$'e|.G0lLR⊃%T?F4$i; j&mF ?N/{mCG7UjK-l&h]]S)K34 &f_{LLϪ|up}PJzE;i*1a93j5#O dQ5%ȁ npF H=lynLx^} EdLvf|uɅ\Ah?`4${^9ǩǂ81H펞|krA`#C #'53 B'tτ_u60FLiZ#fj1KVyv9*8Q^6bTᙶ5q8CrDz)Z}k_nu,EF6D EtۯRWK#T"ZzFSd6,}e9Ol*]Ea :^a8۩kCOhЈ`[D+.jmD+.xuˬ`LKsh/;*ʷA Q7 tcz j/8 >Dlrmwi#n5T(gK V.,uPƠq٧HkquLۑS|,黵 xū!a܇ҽ #z+tϝ5Yk+zˊpܰ="B;3Fبٓ;?1Yq:[iIkPjJU:mݟ-S17'|>U9#`KIƕžA K, g6# UZ7/3m(<7 U9&sltWW6h-15v+!k]{5K-<0e펰ӡrVqalN_ ~/:w~ ƠLy6[bKK.%7 \&ځC?d%XüdY):lqiiv}Wcy= @HJ=U.fߗK\vyu=I@w|fCl}M7_oNApëAEE΍,1;Sa^b[0]S=4"ҿj}.Ub E䥲r ڌA En/Ǽ)U-^U^]ڋL]@Qc!߮ʸ7$\[mSyĪ^e KH@}`uהa5T*wEqK ܳOIu^A!>ț9hpttۚ6zEm?N=w0s}e g? kK#V0[Wh?.1{z)/psr_|OwRH@dg߷(݄7+ӄGX4:`֥wRTF\VrEƒ$,SwmuP3F&O0HgGAg!G㼰*3oscMn9eHtffk:~jV>!7&5&?cօ `P O=%wOo]P?|tg (zL`u4"L=1`hG8AraO+]322,`UK*YY0w`W%@^C`&!eE.E!\ʲ3cv#7Lҩg:ߵ&jA|xjLx߸,p~Ga oR G[X}S:s1vq._b"0)_A(A/𕩼T>K b[ЍSpSJk:oRk\b;v@B"OԽ예bĄ`ӧ\V V{8JS8p#h׫); ?X@}L&CIϣ `3,f?GPݚBIT9/W,&2+e}ͻgvCMQ@\b/͝F[)Mcg{SA;P`Kq#PuAȚGa*QWWv/+#Z@p)i6N(MH%WH83"b;B%"en1X.~p׹ff~ikJ38P{D0L -/~w%ܕ׉z_ѭwkuodG{܇WML՛,Ѕi<,Ï`a>x%݅CEz]i%ZtWSeJFIc'^|XG?O$}.9Qi@ j<Ψl]-wڭŴ+ؚ^fv*22yrL΄́rP{PA-Nj/swiDީ90G69OUz>jlty9cZD,cʙ gΞ p2eD9 OwHR'fP9nV ]c[YDxcJ#Eh5%i9>T@/nNt$dlSMq]bu0yrJFd bghpzN H_=ɀZ7vO!EbW+6"[AKv\zاt0TiT'yl?SQARLN[ - M`}#0Q6&4kyxUaHБߡd<蕟T4q51ю~ζ DM'yo)bl*.'nj/܆kc~'m7<"dG+{,U_~ig^OfuIֶEY#|={r(ˠ};U1<,ςsA^D H7Mxg0IEKV $HR'>QBeX}rXW*~bZxٙ~'|VaFdmա*JV`ٟD2ۈs J`!\ֳEp.nKMAtVts])"T\FWbF1 ~A+ѣP_ ^90K߁O- =YmVi_:2A/ 6;3rzQ$KvÏ^RQ^^Ku MɦO_I)1e/~f qﴨА y% W6q$5_k)™-?.ToC@*ԑ7gjKv.p~9ܥW$V'?RwF89@/ ;Vvp& l {ӸW輼  ;zіU(!]htqj=ĊSj7EYSJ[SsG9~25} ?W/^-Ž8fkT%ފM!ĕ1rT~A`Y{Y;|Nkʹ,FQGEfKA+>je; e 9-E␏Qɇi{Br78!dN٪?TVGw~(?;h[1d'-s:s~hDE:#e詿*3H@7 XK¦Da]rqmJ'%Tf-3J^sް.F^# xYF-M9TYpZЎ~wNQcRzM7yQN#$"+whQ?ʹE şM. Yq/쀖P JxObeheĨJrImԹ6va+]tNOGx1<6a,Nԉ}P[x>dV~`6~9:> "8h@acB<ːԘq*(1FWfK8Zra x51yb8L>|w-agJ tpu/^q ^RY*ԋV9bC"2N{^i3^Ap,.*֦_`CƲC9mb+,Z=ݛ5ҋvl>T8ݎKCn9@RT0xѳ"F}3h#e&.0)]οxJ?O h\=;x]5FvZ4j# l}Z61%ƍMd(Ug qםmvEPR*6h9[$xn-[s3?w.+?8{|-^t>NHv^LL4fKd)Zi Yv6 nhn v^y--77jNZ%n])CḮҢc<}{6'ҲW02y{psquq(SYhm0Dᴼ C.$"pnr ń Fj"2G*MBlr<];I\n_nѧ§8%vl[ /$W#>m91I۷W> PRPWUdq) #>[>; @|ų7 iU/@]:e_РdsK oPJJxujˠ}DXc 0㜥V*Uv|[Vqu8 8R1_\Ϭ8+fXx0rTg3]xoLY ߴDٝO&<4SO%! b7/ ~Ʋ[3SK̍0A.L BAN$vd49ă8(W! ͚!*pgeKҾ'X1Pt]Fx55[RM4`]jߝ)S)kax(UJGVJ¤әgi}缆I*T/TdOm >G.hKS|5#K׋r iP6|4]!HAF Pz-Kx(󖨻kp;M ҹk%=E.9^ǝT5c (HJ9 ߂Gs[nB y\X<=zÕlld@—K+iPc./< J#]؊$<{{pGt>p<6qL,XzwJ8ÄF:9ɖ@{'G&p/-SƞmK= PQe fA&QQQx2me_&b}2֭wtX=Wegq鈹:5]FY Nൣ婭G "~ ju) [WKueR( y"S밖V*S:reoF9chJqiV ]YRA$[ {C)E~"$|vDlӓ/-KV)r3ikg@{9!|3f8vݶ!)h{BdTE\;Mtj!5'^2(K>w3h+Ng+#{2X/c!to}Jt:N; M٨P9j '+.Zp _dm9f,@^ZeMNi5ZVEؾhke,z]b"'^QEa [(b]yS\43'F}bПEoM٘U Ԟ"J7Y}ӭ9$xc( QTN&WƢo%_CE?P(`sb"^?8W {&;C݂ކu tlFИB[~S|$=[ب oυ8!ZFrNB!xr Wy|"'e$Hڞ*x綥l{tA@;js0\lC&y\)m| yxxEz޴c|'?V'~8?p;\^[_Yy tZ9@G WlV:6i%NB;.t>&Lk_~wfX: n`Hak*%oriyZ_c##s}Qk=_ܬNBg@sqتѐ0E VD?g}WJ O\栢c倊ly`nO1dy-Y\E?iñyQq$d& OVXZy%ٿrGŜ< {VӐRCaنGG|qjXv[՘6OWqmscj&GqAՏHz>6ho4Ӟv/[ŸQ)WgqH]m{l]ޫ#X>צZy{= Hɼ!y/3G=/ĎIfo)o;^R[NˏҜn_T7W6 @𸩖 S&F2(MW4N^n)ە{ Y^=ܬ2C,bG q m8k7/Q-lH)16x9zoKt0zhzZ'6ҏz1N]jbhYصHq1E^WjX !qh{Nij`HDE\L9ܽWu0m7ןC`7Uch͖ <@DJgԣ@ w(ݒ|^Qd,{rou#"GGb5VJw1)wWH:xrCy> צMpܵUZy[G4  g>t/S?4Xh!S%x24ΣvԑaZf޷|N{˜1ӇI^Ƥ5 Ȼ"ۡmxђ v\mT4F!1Ѥ=54Sҫ,b4TJHq+a ֣ˠa:RM5>0 Ώm^XQB | 6PII7oR- -HDf/ g_ ݫfY'ZNJ'4 .Uar{iLvjgY0Fv#iHé w\ܞ 5(ᄶ5cB޶ kټb¹;4"7mgy -UslgpBD4\w}Ro0CyhjæD` mQ)ry-PSnHXQ넥2#Ǻv54ayrl? fH^ujgqVw?ȱe92z$'S6s6!5 O`80Si~M WWcV?l l>غ=?Hj\(:ߒ6MGxkXt<`e}7)ϐ-2V<φa/ V`3uxEM7ɞh"̒YC">BOՍƔU3rUFh8Ac.5CҧGrM@:Yi6cB+|5  R?I7Yqyl{,[+t/U/]c=-tnh\N#QT B Rw+"6c|3j2{FFә˧a2pZYC 67SZg;$UsR +Mj[!4ݏiL[ //"<%p S5"Ҙms &MեE[N\)7;{}]>x `:&Guff[ i}ऎ,p}S2\| 7_gzL'*h8RO}𪗫 fo+*6eD]2Dq?$`JYjx*cHAX? N&xwHAj$$yY[qW2{ ~"@ thblR`wIݙ!AQekRt-ٰ̿Y CeLf 4$kjlʯ46v῁' Bi0"!Y)%l`5uӘUthZ?V,* r$.Hl쒯7nUD6xEVٜlO٩.\zsGlSp0Ǒr1 RX;1 I/2RNR[-CQ6q%;H;Ykx[7C;FʗhȆf,ۭ'"Q{yЋƯ=lo4VH vMx.U#DN0tnθݮb%Mt7uH+ga-?q[ ?I:)AީvlX2,"P)s̫7` V/Hc8lJEQ 5jjy D{jKa[g,qHCG,JEoJeFFTͭm Co Z5Z!7L&wV/}pİ#ZNng4<2Oiŋ{'m[IwX9:~,æPH:!,QDrxt8嘯r.IH:Nni;dBl\WD)PU0$eYYP.qeq_ZwzaRYI(OYȐ+T\Y-%2wCMu@UұC &%˽;ìWȼW:Pnw#DR砤ZctW`AALm,Uu^]#}W4wv7W3U}qu^6Ƀ6-:峋W-sCXsOE{&\%ޭʷVCBxVRSc6٭!Ĩj763x Y>B1m$(M.tTD l 16"~n",;D)pI gH`^iqxQ0o]&2zDik|?9/qtf(lG5+Յ;ZeA9j7!)1!͘6W>hElHMPd GM[t844_ 9tʴQ}_w^ZŒ_X@l괙idC>}X:?x&011"7I8Q]ږeZlE+_j&B eG4uͲąH'R8l= }XH]꭛d?Pjthv\)23'*}Y1<,4}loHK.Y#؜L*>K%:NV5rCL9xI^LO*) @HM<C}B*j1rMU20Hl^$o+_iJda- H5ux?uhB?}Cp` UƕդFd*o>6a8+VcF 8w5vW;0lzٴl,ӺY)78 }p8lLWJسGğaxZނf0 5>Fa n7vV"Nhw}0gcYuTkƷ;TK'u+U@e>`SA߈ ܵIXF;SkU*oTdaɷFp +Sz*riPoT>"`&ި@cPv|5NDm8ho`O/^&r*'&#zêќۃgLQR*RBr v:Ys +B৙T2f& eԦ6L>K)7 e*2>8_?JdDnX"36é@{e*]eiŅav_'] M?- i7(B\v xeA?z?p)_RVBq&MB$'H(埊h^1Io#(^_l(,ЀJYK<9@p^)*@}n\qjc#/&yp6OS!AޜV~*XFYUQӪS}~$a 'o `[Cix1"j]h^ ;O~ro?h(t/M19$2,qBrZ+{ [mEH͒e~5l$p#uI'b1?-o ,Tw!5Wn.}ᣴ/*ϓЯqO%ך+3 RJz'q88ٷ26lC<˃pLPnkx_]7zm58pg cg4ʑl+F3V쫠 0}FQƋ^+tQW1K[)Zu"dQ\0c~ ;)=n:P?$+B'mP|^Ic S+JcFN7T4iʚSŻqHP )5ݦVD5`66NbÔ/ț9LISkȗ]j &A%iu1MS܆ٮť`gheƶm0p@$S%^Qʅ=\/ѥ'5c'='?$>*48t DЗr&ύ$|wE}}rdzKxfU?xAQTN0M i/B0 E( KP0A pcb#kL7t}-]e#g܃9՘yp5j(rפWa洽$eﻝ7ܺ,]bChHM.߾QvH(0G܆)ǃX%^CJb?9Zv˹["zGtVd*?bQ_+4MW7V,U@O`O틬WHmmAkRӯ,=DI5?냆}ram 'w%y6l[3J%vtaSi>X7β{&bRE3\l? Rf 6 ,NKb,aH ^ubI2U:˼lT,>g 38LnnrFpDa!"뉠:4j3Ys˞D2ckO7+qH/ڇc*uٲfzO.E/n)y[G d3 q]JI.et rc t$ŶGV+iOx mۗP%Z`*yd!)Of*#W hDhNJ.̯UPN7ndcvQt*HA U2HN⌒12xN^> !38cw7x^{y9N^q@3d14v6X_ yy/"B24{8E} cTWX®ѳ!^Z٢r_Uz.z+.mIѕGr5Pcو@g4w}F$tofdCyl \^Qđ0 d?Q6lO[^OpK{9˽tDM1ڕ8=7˼F[픒X%+N9Olxr{~db7 ҂ RAkI%'hL5ƮB;ⲨC/aMP_ũf]ߊf1QqpqdDfs?ΔNO:pnED+eO11)iS(OvnhTN E)AVLNmGr4jJ0Y:^-e_362no"#f13>$V=#ơjg$KO:Kt[@#D+Um9ҁ{rXPPz2eb(TIS bt&qTg"(gY̛n c0Uwy#7oCtp@5%{DLdhg wmhbrJDb)~۔ڇ55~zW,Lassou N>(2<ᰬRGL4ãwa~"{Wsw  4go"^)9SpڤۧDݸ&,[_wvR\vJq_*7ʢ{j< ErHi @6˔3oD0B'li@t1ReS76wkRŘEA84%n%GnT< EuvL|OOD._;$DЉĶ .qm P[(8];rO(br`Ҕq@pϚqFzc>ݏa- >2؋u8S(ob{@r|eShױ!f1QՏAyFAmNԬ>8;2%`O%12 ~+"ruqmM ]7#=t8qWNMf8il:}bTMʨ}'ž), 6H˂9GGR_v*\l]r?ʤSnXm]!87#Ɔ%<䏪:Z vr?ȶF*۸,݈l65%LBm8Kt5xՈ3%<εY=r2QjOͯf5zo4;) 9%T"XM-qfgt} - 2vu,>SKDt~VQJ$K|[rM8m_F7(N}FXGqЮ- ZLmkt?R6NjW1X/g*ұwUZ/6Z~U's2Lղ܇5yK"0IG(ϝZ챸.^ FW6Ylly]i8&`Rx=@_y6~iR1K 1Qǁ!2`\uS7 (CtV qn/ 06^[+tߒT.Fa-qU-Q%ApDŽ HHý@ B5*s"|1!lC#$[2]fe=e 7E]_"09FX` +Ei:jվERRo}LO2YY:p/ԉB,i{4S$$s0ķLQg羚-2/vv`B HLfr siT}U-@:*`a)va^?v}ִT{i ি 5T{h Z>&qz+x 4: !(Dj*"r)8f2fxfW5d^2gu4W vW*T. #-,|Ϲ9bZ살="uc1ȗQiBT9wIZ!WIqjPkxt6ư|"#>HRBBXSKHT^2VPhPe҄AH^u{. ɾ{KF,% QXV/*%Q6-.KA8pzIS =“-¼ 0}痁ڽxv] j3T>3]93Go5(,TxN'ۡm#P!;V^gґ777XL9a]z)7z h>C$?RIfCyq.y4àKJ[u9Ehmo+ddvFQq!o2*t_F|2%̉EzK-;&aoTSV,ᛱ- #nO*Ԅe,ѹxմ-A$u|ֳ㈒O"$"΁aW [Eu;\6JGo)crrWdt"Oy1&rGʪ$RyN1\zaV9_sVF:7d܎{ la&s+"E*rG4h Eh~,g\1C!F RP%+ƘyzתDe>L읤SDA}`5 _*j̨7PCq;,~nB%EY<\7"O c s{I; Ļo[kQB+<ҝ_Nc{)օ*F(r#|Lnv(ܞWx3:/-{P"AJC4KxkkӾ-羧sIrt nXpV~B&YKzFj2M`O@ 꺣d*'|E]g6B|1onڃ֐*3y'6)8.TIn0z5Y8kGGgD"mkvLkoHU)0Q08QjAѥ vJzznOc`a.bW+n9~RVb} ;]vI'1:{s&lzcln֮i,|I =Z}q{H8|ȇ%$sv ]1@\<1~ E'yyӕ26aڮK ;p};׮j:i@ $HLٌSyf8%e?R^)T̓Tj GL#V)'2)D5s]H)B:FVFH[syaZF0.k^ 0p'"Ob=5p‡pĔч_Z/⌧Hw0&F7YjڼbwX, \ b_x*:[uldJ֕l/Gϝ6.pT3?Z2NH"ŕb֫{B;oBtZNg&uih2^%pQp l} D'y:C26}͹^ibt\DLeb@K+.p9ۋL& ƒeS)\fUy=UI9:pl\qSnq~?T(S&;7n_^p>J)ԨbwYADžLDk5 yͯT-Kû@q]|~Ic*3y l* ]B2z5FAN=Hx8ocx0hޯݕuIAM 11IDyd;$ Mˋ}BwFlH Ґs[o& [d6 Ugl, :Bdp1늅^1[hÔ]: {s1HcE[TzzR!@.踟wNnffeP/M"L$`U, ,źO/rWe%X`pڟjXa4G=~HAZFw2ШH6~zEq#&ղ!.4&ͷRhM߭ kuv@ds-}{RN7DJ\mX/\NA$]&7Ue2l6g|7w_RyV~#! XNaFDrƘ ⡾ c –iI^;DlNU 6񑀻oHߍ j>Aze d2*6UN0S(W'ƤˎXs;U)-Fe޸ugHK(ýq¤E^sJ !'+ggy lI7t mé|gBQR"0aiʳlpDB#Za9+’_E/5!ǪW0+#C'8]s#&A%ԛ"e 3M!b =4P=@J7lKæ1:)4Zp"fo5 |;`B$. -ƣmڤؾI hvĭr^ޭ835ڭPru{]d[@p-({P+E67j~Pd4۫˛KӾEޏ3K9!(kԐմ,` +aWy g1IdzRfꢁ1eLLZ~+^z2B9Ll=V!cϿfQM Ŭ2?(_:r=2 3D|RFo(1,8s^f=O>|8D%O(C"Če r;(?ipo1M:˿ t?NRE\ I/8a?l}an[(rAX[TRLRXbaI*~k*$g`dn87怙oEfB5e~9?HjG˝;BJӟI^42='Z,Xe+c%yYy_kLa8N?EN mƄrJ1ϜaД47 ɖ8ӂ[N3֤ iR$Ҫf Ōȸ꘬Zq2aIfg|-tgllX=g cT;O͂&H)̗Lh-ћDANZR_irZepL Fa޻M[)gӰ^.svU\*/Lqrxߊ60vit+|*4mk)UK$|* f?פ^7Ztkw]{!{e"t lJ0hͬc1*]s1 s+*QJ}d2'*Q@J56*fb XT&^1Jػ0TbRt}ﶵ_eT#čԬ2iＥX#GAŚ$ӡcrжQMvQB6::yWs6՛]UGOiv[x`+CE5ԩqvzq`zA ~^~ aHS›Of@ DBQ &*3)m9F>yrˀ V6HAq\T>߻nJ(!Ng HOXl-cHo>zd~ i(BkmW6K+FR$*S& W%d v- sL λz!9c3gdh acWh2kM׾j7 ̶[ ?go x̴t ?Ry W_5n`b {J7JHHV~ESq k.d} 7;rW("eD$'z3:##BPw$@6-uߔd"5}hS-Vo=}2]Uڣ^ܹG묫mfR83J~ A1ɦj>2x3I\; uS5@Qx^! 1yuB% 2 üP3gbߠ]G|>oq$pܳDo1Au]S7ٟ nWUb҂U]LۛE} aGfD HX c}Mo0X~'ePCfc`ؽyGB=Gy_XGٱ,4TII?)" h_|fʓqߋ]hUّz&=`(3)!Z}K䊳w-&I{~W1$go%kķxXWP^ksM`#ku`Yr*FcmƠ0}Qǖݻ=C\c:/]TX!m[2 |J\eG(/w -鈔@i_i^ucgV/ D*mJxXS-t(Eag3M%i{r4O!STNy=dJ̎b)J= GY<| :`NA߾ )fW*pCWc 23C=ڍ)^a|b} +#Ћtrw"HH:5eEzq8qK).'~?ڥ~~FɴMȴใS `KI$~PJg(dwKbq>K2șl#/pL݈[WOPއTB1-_l<(%QW|8Mf4vp_!&t!YGU}AXf#:Hn ouG#"k'kp?? qم I1ư䷺0l&0cPelo-H;k|"Q&ATp&.*%zO.Xz ½ S E5S&PßBN՛,s76̳OV{hu^z}%6|3IV >C=MҺ l-lDK#aYӨZ@IfP8{%'*Q)ys)[Ҽ\&ޣ75JkJR>,8BnS|I6M>Kٱq ˇIuu}NKX'U>k0ʍ(ul1Fs -:L'IjqS98!V|mo ıw^`.w[4gZ#Ws [ɒ&gڌtoa=HDxl7ZָqMKᴁ!~N_.v+̊ E\g3OXzhql"把Xst@`o3l;mk!" S^ %n8BXT(:fẓZq ZB뭊ʈl1X $&h.6yӭ\?8 P9 ^T3+yO,q-_܌ڕG^t+z#`ȅ ZE ;#.YW'5/`D2KSKX岬 _˖ЗGiMfΕ0m׷3G _pl }ld}~':oQ;\ë[U.5Y4hB~Kn俍6!:"SYJRܹnpfF" 9;&c{AŜG+H31J]s`X|9A_o֢1 O40X /#|x!ܽnV b.&MuwpO)e\ F XY߇3u0mI k_ oYlsޗ^uEl C٥3E RDHBTgCg8h3!#ovfdr)jAP{ bҢ|oF=T`{ 5cL1"F+֝ iܥ+$GI/P, 4PLo,>r$o-ί󷊊A'2m^bN$@R#::ju_%Q3.lpiďY,T99$CevZfs 5%BkQ*&Cnd,|԰&hW[4A/cy&y(LQ |;^ Ifּ^vݫuh ~cЕKÙ Rș<߄e6BY#9EC4A޿~ Bx>KM4G˔WC%i<LZo!T-RY0qz^9fq5&]û$\c Ǐw %. g':+vܮ<>XΦ7BIbiؐ#cG,.?U f! Ҍ8kI蕸k8(j>+w!I%$4Y -24] J>iXXz 'Τ^eKt0\5QIW*sɖ'ZQغ*>t-T E(9ߚQ: i+m)OYfRwbR>K="x\۴ ͺ!mփ/2)AYl>^i4Fp}J't `)J}A5fezb)|2࿠L Og?YDog?;hO N |4 DW\œ@obn\iP2RPFߌ5+`[s4}º·)d?f60"`~Oxv@~|P36f]ԊhcʉJD!_k uɻ,K.ZO8h{a2ܫ1T- }V3OuaAUaw1Xĺc0KPPZ8yıb,]h]>~ xo#-:[.[|23*y,w|0 o=m>05rG|M 2}Z`ڟ;?heVt":˝h~c}GC¥ (OiҺ k tx mn5hAd*ڐӰ.~ X,w](L̓ ]X-A(e/xYt:dq6m_YKb-Rވ6iG;I\Dn])H1SiɊa-d|[n<,NSzK>;OH(wվװ,BW_Loͻy7gb6kEw)aT吴k7[ұOP$ %L8@;*Ni𿔈lEN2-p|~0z{Wm~DR~bqg *VD/zl^8AfB}paoO;a #d`N|g'EcX!膅%)Dy1, 61),a _"i|➇]X%<51ָq2\'8"PUS71f 6Og4䥸"zw45A$xf.e EQxY߸x6=:| ZF QXuY(WP&1,}=6Gu) &jdT/@ 8(BsSe^i_ c~:@H rSD~nnc^p3'3ek|N{Jْ T;B qJ^´rB,8ݚU>HAɞŲE%`ȩVl5.C YΘ/Suv!ԃ3 * 0AlMG gpbDGZ i|4SDכ#`sНTt#ܘ&~5ĻfBҀh[Nhr16 ){G uhyKBݽ%ſgOJX"i1#`vmqgVpkKsIxP8Yƨ9!,킕^wsvJa5i>gQ l>HX.#KFw| y_pd}xX*|cٴ[۬N~JjC8%!{XXV~Spr F^q-H0Z;::8k Ɣgƍl0>:.V^0ˮxOX-Uu$@Y*:}FZ zPY2ߥ &my*RV.s : dC [*XB`8nGV:g208j?O8@]B"9 Zל*Iq<jxK )K]¿Okظ~u/}THש"^(m\ok,(C% H}7|d{V]j kKAp$ dUuT@ew5!7lhP~.>fή)Zl>(B~XY/?vPUe Tz‘:r(ϐ/1 V "D"[7ݚX( d10XRTNplAք&E-3ɇX >`ŭ&{je2ؠ9"lpg{p)gemCP#IΫ1@}2 SQ|a@+-}wQëR[>;seA] ~B4;>|}3o $y~0@]:WeH"=Md %=DQ˅7-ZC ]*ZA5c'AM`B"6$8"]TZ ;U3y/d6Z70k% +G9r5.Tu/"`/ϝ~iPߡb|~s0U{&ULnyP$@o(] κ/)*\Gml:ߦ6KIMr X2ᘛUkc lWqP#$R9vkQ_Y5V iJ ''ڙDی wG8#`˘k&8{.m&) c^0g3M.ۊ7'(*` .=4Rf2QdZ0Fr0ӲBKzzcfƍD񃮅of .y* "j^zs4CHFTn0;i1 N0)el=reZA\y h82VnOp!ƌ |Ӳq$̺oߔ}gE^#*Vg9?;iFP{ )_k3ꊫ,&>HMJ^NK6'вs7:S\rel~mP8* Mb {YH{9#DM6"xh YᣱGtJ" coA;n4Q< \Kn+\yR3xPNRTfH SúE?u<~[NYfXSY'9ԄRh4{nQ NcQheKJ?s'࣪wm ~>h *g< |(:e/JJZ( M]便!ݠܷW e#$U+ƨD@q{gWS p,AIP(<ɊyDZ aqw@j)8cZJOp?00 n-M1- yrԖ/jU1,p\4i":̨dB8 4]YuBM, *,,@!= <Ր,ŽOz~f*5. 5jIڸx`,>žG0e-nE\`GBqw_Ta}|.Pk'~CK>T$ \W#EAz8q̓ngpHS(2a |dJ)xԛf?15c ͆o$ M7| ;l*a>Kwi65$rE+BiNs  Հ-*BoW{ jvr9"vS^.(du!P-:G[$$C"ؚGC)چDoǶpN'B՞vtĸN쐞Wwjrrf  } ;Dj*Z["F6vw{?CO+]9YUN=:=$(xvi{w&!8Ŵ-IP%gt, ѣIAhWhe=QbQY4%i? NzSk%Ə(ȋwS!88_s2{3:k 4tRb$H` {ϳfA9*4S[;;mOu* DsVSDEw3 |G=!""ՐOd֍]jܓ?cpqdGQw/,R.Ȑ,&@Tݢb;P9p[# [[$&#N4ٴV78ͭ֞F`&8j;CY݄oj|C&lS/{SJtټOR,aH3Jq W>EW9.?sz7J(_pmt"0WdRʺԝoGъR[|2a lZʕvyut՝o/EWy >Nx0r,?F(V<9K$ \#-q\i0(6s(?F!<&+ӖZOD'V -$vO*[` 1BEJ= Xہ\r*y(oQj`ASjaչ${d@YCHF w? U7)͠By%F h|* a,VLp:1_;8^ Z]:>f~Կ|3 ],7Wa=z}w>ӃBH>E#ԡ={ ~t7.7p/ϻ1р©c&3{-מ d dU!r9}ã07RF bWv#h9\Sap2V'EBJzO ]g&Uf}g[<} Bpwsg](L;|[y0 ;+Ø)Lwؔ=]~ H"q*:(4MS]knK^2U.Q+_űz+]Ps䖙GP8 $*?@|ȊTO|1ʴLmSc-a#Zӹ-uQ$!l25( _ms1ӋP0XqaEؖNi?Icɵ)ޭl9X[hO`Q\Η S֘ysOEL&ڴ$LKeEh]ZA݌2!U Bsnf#R]%࡭~ >er"UtcWi͞zpx.-D[i]+D{&m_4'Zz$(^SA"Ɗ/"wrɪI]g' 8k/pQoc|u/ìTƹzV.磐pqqSa '&='r(*z.7{7٫a- FvɃpUïo0b}Uݔb EGMdQFeB4ZZ=2Mq' h%$GVY#dMsl'Ә.Pͩcn@ɴ]V&H\|&qz}!QGZ>Sav6O<|~Ÿ弢h?+jq8,1n.y1VCxFKʏ;.VH!r+0M9y@i{ yڙ |[ĕ5OֻZhdyZbf G*_vL51,61& VoEWӠ߷W^f'D%`Tqz@rm={dL%0TV8R6(LoV <C!ʥ/ak3n77űd< 0lE !ۈdY5E]yՈn;kY*w .s#Q?/=yYwϧOpHjYL]tQRe۾4x5mPwocJ0v+66>:ygT@!B]מB8P*l㮿]$g[8`}M=}KJGD+X*ɿϔ:9QWyKߞ=Ǣ̆wAH1l^UF])e+-QsZ&aSaO@VL[)iO=BM[¢ 𨕁d^Gl{?q tEv>[@l͉ԔI̞?,C1xVTYfWQ׊R? - $|B~MRDl'܋wV[[8Pw뗠TOtqOͦ}n7T3EEb)$X0ʖ*J%İ[Hᾈ!Dl߭K im2xwGt_w21@;_6^K%H6 5Fӭ޺@$2rMpZ)0ƪwiWl&tG#s3:|0wƔMyCr\cGi EDd U22}K)vd j9TXl)CD3 Em@G':~W2 #D8x; `Ӑ'rݜdwJ=Xٯ \Z䎤7|I5/&/i~5@ZI:vxԊ bBs)qmU;=KNWH*i|O,Rq:_?;LߚJ=0ڟ\@=,[۹?rրg5wR*ِ7/ d1Cv.CJʐ)$.qAvmԂz1,[FHS@X_O TZhlT#+b|UTY?? =_sn倢yl$TauP"Dյk8 NG ۼ9y+Q812h,+ '78&ZiԪ1a˫ OaD JqƊcwf81QI2TLbZ[sGp9'd}6n3QZ7yaEMF79rǔW'bwv.Pj/jƄ 0>ys2ȀZJ^J,7{ܫlj"_><=)7güy#.7o:dV`xLnʵ sE5o[6}Ƈ6%$։zTW=Zvu&pgXƨxcE8Qj1jej 3 [+M2G4?e[,׃N.EyRIU,uNAw +r;,QV q 19x:""t<^(Ӂz?忘}$ّ$XG9͐je=ZH vI!d"@%~ݲ{p;ҠDz-4Y]]wr=af$0@Lч`5k}\%&0UmA$fN>eJL#2ͿE+_9$L{'  OH?kJ0a{1ߖ7Й$sGtѯfg^EYE] 碢zE "&`8 LNT=6{\VMFʺ$"{͋CXmhSoΓO ]ᚹJ˻#ؖ7?΁]O˳Ma>Vn{r_s(2 ]6ZNdsP3]fKQ ⹕C6İD* d`K'S+3%88;,(UJm2K nGO퀍 \O HDbygZ^UO3\Q=Mi_vomgGv[mQɎSw2]&Aw}qA@^ ;oTuCLJ)T0`~YC3'YYH:v>Q(&:~X禀Xr!ad;.< ZOY C.L"oAwFdor Х>S| My6]G'ۜs r zjJxPXp{cP@'i%{q{*Do4d *&+f{u͐b!pr?jڒ>m!ĻtcbAR@'$na5vm5U!0BBԡKQܱ+Y`/kWէgsQU@r  i}z| LeyAh j!iA#e?tB4Twf~H+"Q88a`wtv'wV?ӋI |+5F._emK:OH-g&}GoLfYw k{{UcE#M Z}kKqC.4na(8y1$:xDQQK^)\2޾E>J3aZ=/hc|P=S=Z>`w5b%`n5#U=8AM2(,Uy5t_ L78 nGCZb%Af&p*0/!BXllLm IFjv$&'k CudLNkw0¼LA+2qi뜶$VRbHi:"+᳂H,c<k`;~xil4m^w$Ѽ5%\*6I]`u"&#DcD0%Lriq]ؘPCJ+>L}vD'jBȤ*9?=1˫f%0wG %R4 r_I(tvRP.Ri7Gﳻ~\UXLwlz5\OU,:unXػ]F[9!I>z7xÏ˯/pfIOQN% ;hM 2/ #jRΒ &̈́[D ls(~9hb7Tu}Ĉ(Ee//i?K=,tShz'X)=!VBs_H瀞@yP 9JOlv3~`h+GDbԐo@N`".C@Q-$ }}-?z6;cR8(/l$+/$[7jj1MEBؘl&z Vs:Cw! #vV K֌&H٦Lct5:"a<<Mӕwկ Ip_h'gy2. YX%mK"ebdB>C[vMf lZlLCIGS?X>b4'{hc1kyRJ5Y؍xj !i!W?6Tn6]"{'Qdu!S{ iԦT"cd6<\'~j ?$ogǑ.8DSCX(Y>j8YD KG:zuyU?=+aLxP)ɶ]LT8GlgбELs@Ҕ cCL!\^#>l 4E.Gb'؍s<6ҖBEOk4D]RB!BQ?mtmUEEӑacR<8lOW҈Ez3!5߀1T(~c$yWA݂LaP>1}4}-.DÞ9;xP}[L9&h*q҇h]F1q`R= aWsBRߍp. m&H-&jQִF`" D§Y5FJ-S(Kfi!6S۬vYQO`QI(b@yESblz%6Y?$6;quJ.X !i W oXQfq/Nz `r m/=,Ad!\\N#gޞFqpڵ`8<ȥ O!]~ whu5s ?; f ZPuK y"h"_a8pwZo)vZ95u-āt}sdEb-Y1!fOMA,.@<uh, *\:UagD>OY 4n9TFDF_g+z2 $=əWIz Y_ CZN g')>1ZɔܥXд>zzmDUZRBOsg _bž-IT+M-[LH)-ISQ!IWKS)w Uts(]V<*7zA>#1ȹ7l4+&8Qi4-(m+3%xJCUEv#{yڥ2ZkU>?!0S=g-yZ 4X*Bɒ/ 9S*^= |ֽ06Eۇ s'b&3somƬ:]4{ rcPTɣ\ܜ\Y#wXs_{ ΔM.x ]4Bl1>\'e91R@3 , NhWe{46!η"dHxb[?~;N&elwɅT)T)qNU<6vLj@8@=l$KHf mTjeȔZ9qf/phڛ5b J *G4.ᶃ3˹[ ֯!fJV0𚹣®>1M {y:]PG"Rc0i;Y5d H o&8=^$ex.ŁXn(& /eoޒfweژB+5`E8Ha!Ff@~iJ0yLk54<=Fsx1/1/vn%W8b3*鸇K4eڟ2V%GJ$0W욀Zd2!`%ٝ#rۜ䴒A쿯b?PIB&r.9S:'z9"'Mf#rmyXgm}@tt5Fd3O%,Y!>9^ d̕Iy%%_눙 {X-NL"Զ7;7%gtZ?ma( 9TdUMv%K̩ Eki 7b/?.f7`F[uJ:I/Gl;޾W?@"M=f5R-X|wAUmOḧ [Ϲ>78octr戗ZRL$ ʰELiJ$W;MG"lDz{^E8Kٛ7>|iD ma!AVIZW7О1I 8g,#: 607t;oošͲ  p p2jo pO֜) RRs"jG/ ')^H)hIOQ :$"委XJw@n{Gj;JJR`ku$iRb xTǏḚP"KM8)Z6ɮGPTvՄjNf5@DEoD|o`s9j-=y/[V{WK{Uα^GRr=8#v|A+Mg3X>SMN}>/U(S??=D;vc;ڜP1ъT㯴[wucF8glj1~:&U%h{NfG-(yNĂTy0VmPU0C3;fEgV՟:uNĔvmOgn4W1fxSC6?9ze3L $H!z*"@!um|IeqV[nԅOdNV)U(osj7(wz6Hڪ}a-ɖga!| yrCaSwXvŗ)+H%Ijp 4m)f:)75BfvbP hoO#6X>aU{ǦIjΖG~uN`lmD'/F"ω.n WTL@,+!&(DA'lGuݹ 6!~")P/]%˨xLp8!@\жn4k!ѫzO%>ƉDx|Oco ި fC>$PaQ^>hUBl2ǔ.uƳ9j=9;-wrI'h\#u9/U'X8\{.BSjnY!sCAڐIoQM\{-r c<@wm!w? @J|$~#U;ty{NE.6l;5Z  ->у/5>"o$_ T Cd%.PϢ8B94Ee@!d98nWgI.2o1>زu/:;aeЏբko%q /~>;~v ۼ0OJ6R.SW#*?mYA[SA>>2 ct'v$dr[QEIε8ۃ l QiRi:QpeMwfKc1Sc!:'s2yi/h@J'N!@?i32Cֲ&mЙbꃥVewۿ:Ij3d{#ir=YB`I;wc=ڥ0!9߲|C0Sk%Xgqyou b\@h?M8Fv/e8aeȊOL75g$踂m|>j\߄ca},uwNǭܣKd[rlI WܩsE]k0QxWKp{zr)ehaBO#TJz lYKxd}6C&U/q(yyK';NUS#9>VC<8fP"7+Ә5QT.. ]ξudN>։=K+E,Mj[Yx=@quC ;5iͣ>4AՇeRmYwhrt]5Tm2e>5SSR7=@; tT7C|MMFGJzB~͎G,)|6 _tuѬw Xv"m7! Gʠ,|g3,MUmKKA @j?"Z$מD!h`> 7^ppΏ*B0[*uTK(?ӿ2֧ѿc.Bxڵ/BE(! UR6;aˎg͓䪶 fWi |%ɼ[:[jf%hluOd'׫+ +;!B$t穀!TJ3R?wj43'kxn5*2lmSzmyC:DIv 3] {3ԁG#Tm7nYz@?[I2tZ# ~XWYyUi=;+vgQh3ڋӾ7̳4t$"hV`!WwMirAl#*$5=NXV6WjM~M`2_gG׉F` q}.y$h6L֛@|X %𞶩8j"J|^y&ooʘHmihY?,W TnYecjNwo9`+ciP35Lf3%GY(ARگARtcO)2Hl,3l9uJ?zn3n0DQᩝ|*Ŵ;4hNjHE1A0"kϧ ݌ρgy$Gޟ][l^5`ɞ[ZU$Ve'/lfBmRCId+6a[n{C,tAD F轔[QEx3; &<֟FIx%c`)Cwܛv_4)tŷ g3'LlWKAo  S/} X[StQb[ wjH O,UpZ1q@^q^4$/`“ 19v^2VD . R!9~QPxf*3OqmNDߦWBeސMWr|t>.~*ceG9?ֱgMDesj}k㑱<̭:ݵyB3U`ΖayTH@s)4r" 2ķy{kSh9>d`L\J{-Yq(u\T A J\Bgt`Jݟ;H!k)\]5kMԢgzKT{TnMSy=h%/9MA;ba @B$`ca"xNF$ߴQOGˇl!+[ ey!A=<Ba\RÇ 3d*g ȶi>jwGCyk9{:fD\aaf̆3N q"CGGH4"@F\Y>[Qc^iELfU7pt{>]7OK dO]UCH.lRCt1Dz`}1Q7dJ;pHH_5*n?ue~@MunS}ȑ)x^u.`HUA['G)RnAM۳0r'^ ,:J(QA72;v j,c M[s&p͗\Ϋs+v.ƃe@|ZHs nK|: 1VA`F)+CqWy1nMNr!X|ŠȍTvWklx5X 0Kf4nt_L,i:/`KV%(3xe`H\٘ %1`7:<ڶ`$R߷81ʂ0Tez^#ZR+)=erH$lW[ZﶇVT\|^1`"\|Y??Dy#{:ZRI9*r~uC#k$xK$tUӘv`E԰ٵ#6 o/*Db+bX' RX_'yMmook03ԟ@_3זC}S<*lkg dTJ?痳8)ɗF Q^8c_5럶4 ғ{jJ80\3q|o\0ff++^FW$̯&BLϜvߜՌގ9UrD䩍D(@6DT6 Vu$PZv(gmlYyB_M OKs\8@4-&=oV@ ҥpHL$*#?nsC6{-ˮu<*=e7KPl~U"?vb^䡟,MA{uIoB B뼒IJvYthȱfag&^|̒+*<)JlP&g>9(@4̰5`psG~\sصpߴ1*8@#巕pJ!WOQܠIJ|O*I{7%=Zu]<<Ӎ^! w xT9j@e,y"AZSg7`s["ǣ%`pV[w tިTΈ0X8JFv`W4GʺmMmcGfH@E(Y=^}NmB@Gd#rz242rg,kؗ43$Gl2"BHkzi9"2ɀ{dcsDQʸlHsSaRջTQ%R68F *o w(![B*"UܿO ڠ BAv&-bq?C4?ƫP=!k aj fC"T@x#C1K{cC&uT0\1=k}d-ͺqpshp-(ny_iԣD^4Ap{ǍLaח)Tz x B&b[朧.n%UF+ zĞUbڎn,)Lp7ig6j59aBLA*Rf a}LS&Мi,Eb1>h]M'ȽV;|a]$6[wHOPů-w8JM~}3HFǒ5,>cIOO FVj*+Ln4ֶ{NZhb u?g ]US_k3cCV9Lgk3cJAU.Hy~uJˤi ꯙH1w>x#JCiK'@?랑$;3,zdkqoc+d\>M%+w$Px Q}>̪K\gn[?ԟs)Ž 'LWV+i̤ ̬Rm 硤-I@TΕk_cW3Bh|T.ANGW,T‡?pS4y~׃<[ǜeN:q"[KK3V8/ށHE п'#D+d}xt_hI_tCo_!+l!c>-~eq`Bd1\/!8}ߺfB>  jIUR-cS""=Wt]dBCLҫ͏nlG.(B4#qh Mn}RӨfVvoO~wCa"Fcn[~GoM o!l0>2i9CX1X`bxez5Tn/G#]3؉I@WZfOcad}BoZg3vFj[>MȏVh? 7§T_Y' ȾUu^(n׬]53֞kX~JdN:d ol󯓢H J'1*r6s&o" #b*7Ӟ0AfwEjx4k,N8P/z)pRJ:;xaߛx'D,g6i{缓k8wgܞ"nO C`a0S"ݷ Z 3k)r nbE$ΐ<0\,?Z x.I9lƮW?{V\>ɇ8y䎞у\MS6~V08>O$yI>_*]paJ; o}t&ݢf#RL08+c"HWu,z}W5~cdD#iF˴* Zcgb;|ը'LOH\6a̴QO`/P}nza#.jꉦZv\Y) r2tN*oD]& ë)$,w}n\{E_qXt *.<]rIզ,nysUhCt;LɔMfh~'_{]$%rb_~ hL$Ѯ)!Y c'Y'0v߂5ˤhOmݸڀEIuFd l:(guvt^ э8Y=j+Br1e+tT]s97tNEU`A@C+BY3( ET-գ;ؓ:$bo݆+,_5z/Aڎ:h%X>^ߞI iǕCu6AtJz|dJ(vۚ)E.LʕaJ$/k@*YP#vh+kԈ?{>rc(6:xNFE] Lq tx؇Xpoulǐ u#d {$WJGa?3f RFL/ͷ< ̎ ѵ'q`bqfU&oM beS(yGq25vyL_]Mʅ_.p"Uy*(*c{T<Una@x51[a3H]M FhKZ8DܸxBVQr^M:IGPSU @t9A1 @uVWexawRO [4?BjdL _N[d)pQƵz7 aCssl.mAP9-,91Bg!x⊝sms>3܅p]@}~}\w(!;zS0(&1?|ro(hbj3XxB hhjp\n΅gLkQUƄ Rlnm2lZY+E )\+kBN% 5TwH;I )WXRhĶ䭋hΟot=:S#!?^Oggt_`?̳^vyU2_NSLW|>DEUҨm H`!yHϯQwVROƩ<-"o*%C{'01WV5MHF*w]S"Y+hgıxY8hFoM ?Z/rVc*a;gR4-:~ʲy56ڱ2b NkqXC3C+QsgPՊ 7JSHEEa}P@13u [MX4Wc *Ѳ6*t# ; ;,FhmoIÀNF!wd \-ž' $o_Jp.m>4-!';a>'6Y]$'~On3# Ԡ57Ԑׁɬ;d~BB lKgɋKE,ƏG4nHN<%xSSؔZC-Y2HN \8C_AK<1"6EG{i|׋frM$gL'1"!rفrhA 6 W%suLsmf(܌J͖uE%bxT`wGǙ(!Ɇ<1ͯvU)tZǔ Mje(ṳn?$E\?(>'&^{ZTFuݡN=D@l7&QFE9 |Bg?hB@X4:"hA5lcj2cm`B)ӃK 5hiP)xV`znsNw냄iaj]eI5I%8$צ/Y=7[XwաRnż$23S]YְAjaSQXЇ:PBm(n 9̞PaTt_vH`%Zܓ|5={''aURDZ?M,wezlQӐ n5mM]= .2} 6 'CV$E<"e>p,$B! S >NW oO|qn,p-d2zI}w8ָ.kp)uÖH0B׎aWFҮi`J`WG)jG S̻hW>Yc?g+pqbT{PlD&u@p󻃵BӉgAۡ=d4͊~Qp ~aG2[ E@ψ~- ᚩw'Qi@Cup9]r|a/ h{B gFJK0ewF*FơNCڱ4![tμ#*ԉ,v* }^A♣<5gEI@+C I^8PJJUJb9KWD!²+/QTu!"[ kE28Wc91˝;8Z}J؆zo^(w~ŸѮ4!&_Qmع=Vm¬ <xx|"H1 {0 ֜Uf#:ʎR%paM UK\kL cUȷV"#M:('6\5fAZ?z#RO !S"T~!7Y M]t90i]o{xrmpZta5ˀftp"q W7QY4`*B?pO=r07ڷ򁴌>-n:\$h}ᵩK|g9d3qri֊lUs ?ځm* in+UCIɪLyiaL1s@RH-7oϻX~7oVNF"iaobap=?@z8#UKQaNůK;gY'iZ6.2J:O Xq`BY=_㐐8^,s e%Ǝ 8\vʦ 5sϨŋ7$TD{?Fʕ'53D/] 7y(rn[36M@> MoF_H`itR/<1[mh׏U%0VWR `Gj?t~.Q%SpMSUL/ 2xb3@L|R|rrrʬ&7(}<ch@n⼠-ۮLj)72Sݲ` =#Vb=Uj5ufIPZApIUyB`KA ѝ21f%(\]t侗 dL'S %)1fQ )8˪lD&/Һ|~߼Hs?%ޅ 4hB 0gBss((a. b䡥57Fh`I/pD\ |%# z('8Za[sj0!xzDa3@~VK_\ZRe1X ) >IcP=yT]ݵkk}|c~Lbj$g(moS/DWPR!A Hg<7CV*dFrx_5kQ 2J>1.e>ieGr!qRaA?^?_ɥuK|z g9BlFuC|{kWJ= qT$l0-p)xL:rLp=sƯQ>͒'~6U]BPfcw9JzDV#|N4P&ͫj< yM"c>R-ѓ/Ro'Ljܖ<kK.mg'f} ɋz lG.OK.`Y~ё`R]`%`&?@geTAM&w煼ɱ2%r1fk!mrͅF}[#:9> fׯ|6#DEt` ?d=53'u19_%2uR:9SD{f&-S=JG2';0Gz/z9*ɽkA@]lV*HWH.MO m( pÔy 1/ =!BdGO\wr& Q0m߷څ~]` 3aD'yaAaS:o\rP[BŗSwZC_ sMv+3ZAC4Ox M[hR$◳Ry9$9UL&DIpm=H$=0ȳ$cX׏ *$坐]R6I"iMY~;5;$\#W{C$"Ψ2R[gp~b݂lz+ '+.~ yUp&=PbHɁ H>vBPFX2Ks9Z&mT4@ˇtZͧfN@r{A*܉aӾ6FETѣajce=HifqztnF6m(<͟~ҝUN(eٖRٰ"W(zL+w1}ɡXQR?^:/j6揶1f1ɝt{ST 'rQvF溩`آc&1;Ct#FUj_/D\S/%Ƌ+#9{M I 9nY YJ>湩33g2ٚ0n|%ɪ/Wn}LҢ_ioZEW (?^͔삇js7 yaP fA{Y(^{o_^TV"3zVܳLek $) E{p2qÊ~nd}]􅡶|?t8d,>7V`YKgD;sH_!-pp. \ftYy/mLu kJF0Bm 5Gr*rzH~<5@Fa>=BDt[A*D#[R_3[\Aw`8ktUd3`\:Evٰ|Wף9hCeO,#lZĘ^!nȀS5,݊\IBhz9ݶ4Bѧ.$4r@>6{w:+؞$IxF`(eHm?@D~P6J/3 MU%zx e>ȅbF[lquRL|;o _kkއL}j6txc;!=M[jG`lޫX&-iР4!ue>l{?%'Jdd[Rq.G0f ̟ ߉mՅǒ5PR 5{C3 e~F2-2/jI#)p ]U?}0Ug}L5LR1tkv^l: :;G&nIdfX6{e0zQ7G*v/V{},)7@5aURŲ>AѸ` @VQ4dnT+ߌ́ Y,FVa/wEX w-&ih \ө:&.*U6TUWC):u'7!c(QJPv!G0'>6 6r q=je3f%>w JAo/+ ܻmS'"<=P6K%zRVRSv9zq&rxQHU˫u$.NNߏ,mx%7Hr=b49XaϜ&oT 1UV5Nfumqna9#[i ,¶]e0RYV8QxHe6L*c۲A/X|@sԠ&r`4! ƏUla2k$[/`#w{~{1L}ɋw854wb-M %q4Y$}Ou ~23qŶȜ10?e^\0.W-}UAd/ lZvп}bёu_8+5f*^\.$P;M\/{*[Skdfx*d A\RͿkzF#9+U wh(b=6jjSxj"йhNEaiD%8EAn=]*V:A>|⎷D QhVN1lk~U3lN~+"-ر*EQA~r^3Eu)pEcV@o0y bK&AiƠMLnb}ͅߛN]ӽt"'!,đ˃SQ=091:x/8:9\ ҙ.zaȚH]3(z'=*~S) -$Ѐfx8">81?g8$04@Y:;\$Z=E]$;%>GN~aDB^1ZܙwJP]:q?z2\7h\y*1$ZտFE7H,HXD:(ś3 k-#]Bmޏvαk'fk$ÝP`:ZUPJ]h`ab1w=: U#h`A 7HsВp9]Zd+$a @CGIpE j _ne/jgǕ\BMJ "@lBoyfO-$FOӠ[_YBe^c5j_Btl}><)L~>k&H70VYvC~; R=*xJĺMj|N?R(UAf 3VipuXh=ǐ4*>NsG5!!.$B&lgJ$M3W[CBV 'Gģ]rw^v 5 unucҀo6]hO|Xĩ!"]b[pae`.s4VrW ,m&W26z ]Ms)fVnWp?5CR;t7t,_j$>H{< Tfd O~kv>K#q? ZX*egw͗n^pGER`yJx dgRC1Kf(f%%$Jk ;sr-< wf:-tֵd^:u cDş^J@O}1?JdV!rA#U {ϦC;ޭG K 6蓮顁!5z~-\i5R-W3[#+B2]b~.LzĒ'xHjwM~ˆ \ @g?qQ) ֗TՎHW{B#ptGD)Ȯ$E1ɶ 8GdϚD@7d ׏ ebg@@gԗ#5/;] SE-i^njSLDyLR?`X}oa*l~yJXa'L ;ys,F*P9wpo#,ĺb´>Í9Z>N8-咧<$& ~lp6Qyǣ6|opT$!L6"Z zqS \*-J$`9(Gל j>5N <\|R5^"/@&ڹSs74i8L NeBV&p^))W_YA}~b~jt_gq>MlGȩ2pN]g)9dk 򖩃+|iqB!="r Wn1+'0!fr5%Mѹ<;Oa9,='VM9zDi3q8D!Y`z*AB`g,%R]p&msƓ_ӧM-7.(#]D-6X WZ l%5ur1ۢ7i) Ynd Q٘\ H]}/skC/"Tp#t=g}MKtT$5͂ɛx*Oi'd[T4.B֏+@|e-N6ˀ&g@i07=%975^\!/4~YCSa9A=8W$|MӐ ],b;@ߐOPUCRfXۄ|=R.8S' @Nm!;qEOs}eI³A3vGۆ2jLGiBύxAP}rPSJ%oR=y?QaDW!|'''fs` n0]ɦLDmWhXb]i]rܹAPpj15v,Z!N+$+ [xKM-}nV^$:׎}%$iql2tFNW:@=x3=ӵ>zzD^@Bɜ vJ/ׂ|#{UMENR6ƛ6MtN}^A@xw>صb=1tI1~ A*s +$5UQ?%u!^jʕ%[po;! ^rcXC2#5_d\LE^q~:;>?ya]S+IxYeZ5Hmٚ7'pkFȿoo%Zt:8uᣤHxcĹ3)D#ScۈӈQM.!}TT8F]A^65tB 1cλb0?{. }iKaiz裞kCoe(I=b}@h8icm P9۶ɇFVkɂR5 q6Hn:N$*y5:[`x*H߭ȲfF;nF3AxRV00ʍ^Ƕ ,L]3u_BhδztS^nsQ:)=6ef4PdX$Q6zk_KKG#,mG,='vwމƳdNC-M5ؠסG6>~ $PǬ/2u!0Gk3?ϭR-GF~]27{Prޥ2JKk@

-sCIo5dW1=JN@TfH'%5)hkafE.d_T3qX(  @y  rq mCL] ֲ<_5 _nmVhI皋UFvey `QE)+ Rx~Jnzvτ%J;*ex+8[[v>){=6TmI U$C8lh50t-8%7C^kl5<1d?d>o 5YtGID\~ob0s|d Hcn{!aIoםx$B+3P3A} zQ4pmKQUNRG GnAN &X/6N+=✫j y4z W[rӮ@4c*JUE$K$uw@~%d+73d}V,LN;1Eջ,4d{a[Jg Tn`y4 ʑ~eڣcST)TNb$,(LuBIH6$|dV?Grs8hXcSNq{G&8l/Vq"aVlINkNjEZfuϧ1A%$aQߺ;9Q_D9Zqf~Tޠ/Ա+lp5+֥dB.zJ̊$gOӗAͼBD9#ȳ$o|7ۆ\XAݑ1!;ϙ}I85pE4-z$ ll/r;h9_+F=AYG0Bmv|g>ż9e5uszwM cSJ- \]$ƣl:{E?U#RCCBojgQ^¤tUEh'CHeu0uf2ZRż4hXv@6Ǻf#.jsf,I4.~fŽKke.zjhθTSYi Win BOXh e3,3QKl!K h:SIT"c$&?"_MQC+8}Қ uv٢:IBGJs7zf_a/'ok(̏Z*侀"4XP DG}x:MϟBɂGDmI{KWZmJ0 3S42_TCJđ d0͑{Gdh6VZ[CU)r{鹤C{t-z3#8gC@vj'y :-nǖP9D5ʪ y9MM7o04)5T,OiՋ;xra0dlF[sP55VMj0sj. IJz]w1 joƦI',zHж6<(h%k#DyP j==;{WޥwayW0Ҹo'͐gdˣ/[=PV l'ee7]9=wXDܽ7+gbO۰ 1BKP#>ܛP#k.eCvNV>oc %GBqyqǨKEG'^>j(;PZJG Q3cC4rlh\ȋ {yju]z?O񼻊>u2=Uk#+ :3Mz@'TaD\@Jvo*,ԩyy Z;{M ?H}fIDӺz'~b/47߈wt U~v,/@3fDbyYT23Lq^t} 5F7d.LOjQ -Fs$V%63-EsGٺ~Yk8 Dz/v÷ Pe_=rWZZFjM@_(*l{]w3O3uї$-ߺ "w#D9,a8({u[%vb b~%ȑ!hLWPHNCH7Z4 ēS+V{`Ld8O ]^ gҪr׮X rwU1X36@ZG/}tU,O9oC>=؃HZ9yƈ ɖЁ*t %E$?J͉Zj-cqvfw{“ }6OV^'8U!V:,/pb=~cb6 P8+my J_ F{2;o6lwJ>h-F8?#v= ߔ:f*"݂\d\a[Qz婽LiGu$4[$?B: 3, Q~6'? kh]`F]tW[mX;n=)55t1Tk{?*9kG0Hjímd@ZRvӭ1il}U&ljNzVţ#)lO\:6f珡SGӯdžI5f*Jl1PkP4pC GY΁Wr2΃G >FnxNfm88xFPx~J2w)]qN#׀YsWz_?acf3oF:A蝥WW"-~,fT׼Ln⚸1T0{176\`X*EvJQS_wD%"=1TYk'8J8x){Q 6.&F:@ |7UEA2(h/'uPưXcN+t,̩ 4o|bM*?kX78|DjCr1+ZȨt=]\a26_䩛H3lC9dv ~z$1 Abs9Y-O#KI%SZB(&8)T1 ={/$+C 2%q]9#Z_lM>FI|4T#5QWWٲ4D`#cMq`=oSgM,G2kxPq813ppIlmZzk%e/=^T l_@`mDȢ-IȄCc7pޞۓfoUVKМX3=\DMzQktsر\v.&%7Վwɸ~~j ) YsE.)L?PbHeFrT6ԠѰǘ:c"Ea)ތ3'#\4 f{lwP? oRP4K? "ne~91 ^i8K}p)-s6/g^%Ex#KK@`2;,T+ZQնGC9hqۮm,Qo6fn󸇣b믨 (Jj;f.ҕX9eqs>J6Fk ,UhC.Ts0HĽnpQ%) "M*oI܇x|Gm{BĻDזZilZgI|ŋ2 o%(`LGoҸdz0g* 9{m2̰eܙDmx Kl/15,庐@2Wc[o)Ct(utĴFBXQq ֱ-U2saVlDp8m NgZ_R(۱H@JGTtSSm %!#LUʐx(fK%B lѭgKB|]%M@fJM]#n8#Nm oGi S1 X+DZ762~dՓfw!tL4%*=H+p&|}G My;7pr@ . aL1F$phA!NmCC'xfe%l;Kp27-FC솂٥k%jbGxPJh񖴩k\n#;\^"EdA/)AGk8+/lquI<]s'gTbXzPPGKw!8ة*PVff)-0܉B3qA2OR*iݟi;lxwoϔfHP14eypTv+MFӰ2. ijyį].9FJrT*or, 5G; |Hl>RJQŞlU sXjWS~"aU2&;dxR$ w )s[2{(:n&%hv^}: 0 J}m՟buj9ڢNct+`E"kq~˸ %=tYNVwGk nڱ^hV~㦪#LbwHOW vijy%3IDW2#!^UE'./7}NI_o5.1L7w U_fj)[uy$|0](6AN/2FI- [c8,E5q#jgD{@5:ko뷨6MDBc>I^j:t =êQ.aS'A dn+GyْԴ5:|Jń`H5b#% /ǗS4@Wz:Pv:$KsNO8G _0da*P%$nc FZg.~ZIbYQuf VzsSsD>o__H +֫{ƿ]u! pvCØ4~O[$% ;{\] qYT֟E[$ {d%۸()uջH ݇c zW˽{j_~>lT !Gt#̇[9EPR }ˉrKi oiםO?GoMZ]i(<164TtV ]Y W nB#w!>X)b@1S"Ė*EfU\| MϷQ Wa!+u*ڲmJ%mZM\Z_e4Pwr{U.جmjFnS)$V[KQGg-/㶄oGbo)fZ;x+XhJxpcd͍t X<8c'>#*-ioחSYhd}!0:!Mnz!v*傅xmȳ(QH\86%D M?,6kpO{Xiux…7:slI+@xoYERL* hޖZ6,Th){,|RLhzyKBuc 즄_pkZQi{!Aŭo  *7Ry?RtjlS3_yu4o=|wk{{>C~ӗ0oS(2t1>>6XVf㻨[  49| \=qf#*R.,PyY\ep _]}xki`u<[ 9ZQSdJjpBz+"`-2٤N=3Hs[0qW4BaP\j^[ǐC) Rպ >. "K/%K-LUiO@:pӖM}(헒@ZhaG.CT;)Bbjg.ˈcX=h#jKV" 8q2xVLu{͵%TUlVA@{~'i6p4-w%9<&A/6yQKyAwo R~R̆_o|Oq;5gĻs,Ub,i}]!M;빓K + _n,c j9Z(uXv'|Hi͆JoFm!xoMD)D1:N8natw ҭ[Ȥq=!;M%⇍}c[h__80PcD6㝃Z8X-$QD75$ǚ/cMZ~S$ q=xw濖~@duٝ+q7D~t?cmݷcFFʆ=bJ鴇NmFVUzwcbvA;\7Ȥҙ2 o ",Žɫ'f goo :NXvE`/@u ܉4y !H >%PYFlYR[h\&-n1Ui/)]6YEhOX( '|]/S nI3xWUp狘z#F^+e-#Y蜣7c]^PgRA+S֮lf\j&3E mZġ Yn{GP}ЎM9C)цg=6U^fbxy,N/LJNaqMjo\dqNN'=ӯ\⦏[6Q?jv%?cYM*\-b:Tg Y0-{!׏4B 2'+JP4CLQ.j˱X'da+BAQ/$P8y#(O"a1I5vfŞ汒*B)ݜEx1ް:߷֊EӋ˚Jǿ>[JQi[X GHڏywGf;b]K-koo%NØXc+9*XYi:i/R/`$ J7D!|EI_4ܑf\+IS rd[3NsU˭eU 뉍b%A߫JIu'iZk bz$> '$n5`j ϡN!T=˵/y]☩G40s67rv!')2Af/оY,n# KنxD] D ? etS 4waBHP>3phu Pw>52N]TK-CO?XgUf+K[Y֫DK>f3c)y~L,U E ~@UL%!"Uk[H%V}>@vF0Xx/mFF# ŗgOl1ʅzi̳#x8|e n} R2bKuOmDKo/AN&gP?q\8х5\= dz%7ǤA]4vfgTt.qqAqbց{AK,eT/F]n+Q+sa,1Z/wlآi{$6ښwR!;Z>ŕstLvKP),Q*`GE?7Lexu5J|C+=g%d_Wkiu=0*|BykÃɳ#WŢq䯝1f#H1&\rwN~J!$;9kr)!T8U2ZKBk*j=i#r`[=s+e()I3=B a:ngˎhUiK5|SoȪ@Z<T=o`3p۬ ͺa/{~9|MEYKD#y&[ko 0?٬RT(R6SgP6eOH&Ѽ`GWŅCD-+ mUݺYU")\H;$&#X\MS & _ l1rޝd A.#諭  |{;(de$#wu'д;5OwCAm]}3ڦ(60aξzqy~GZs$E. '8m&L=`{%XAe n"J/_ӼBb%tWYO GOUR-2ߩIKFm+)D ~ 2j-OPsFqB&c>r׼{%fؓThkse1%qI֌YBzNM- YE+=60ˡk ]h?nxq-];"SM9#K"❩ `^OC0RI$v6 h6imy;͢ BU۽BZ9;ER$gNB7aQgT|Z2:Ԍ~GXK{hHyh~ƛAFVQ%Qq>ZѲ'=1}RwGA'/dGd9C|S!`=^Z}aV0->+,f 1%sNP ߹%Jײoe vO^@5o %xi6PVuRXbJM]/E<"  G sy)z}+V۪h<:ui-Cq< s>֜!S@TdYrJoz Xs\)d↓rP~-'aap $IP[lw´M 0nD]y|UebwEYU >\ NP,fmy@pB4 \DYe.ܚT _e9 Nzsyy9bJG/}\=LBo(=h\%95"\pXSV=ȷEu^)"%xP،XСMss,@R$KP ٺ).5P=h(›ߧM =mx<5$[ʻ0>e Ss ֠sX"ګ[B7rxKAl*Pu/:UIS+2GjW1=m+P$-(HgهrU(Ev  SyV ;Ex5mکY.tYr?Sp_V܍`[&_eN@ok p @pڈ_Ȱv]F}3O!FT27s`RH-PȧLD4w,9bv UT_+EqG4IW"Z:4Yy5ujBԉ:t8X*p9q~E nHfﻺt},G6$>1[% q+ *ƲRݗ_F6QďA ȿih!e LZ3t}E.lb=PrC&8Le͈ietRADDL<1ڄuWYwc܌N6k<ZĴ?iTLAK,h$? <ѭ*[MNPky3# r:r3pQ+ŧ¸5NB~Lz&(E\9+RD37"#KTf-3"i:t$IlO,I%@Ԓ+Pٶue ]ii[:6QU9aD:JL+ Wl(uMz  ʗxw&z&dW#Rb|`Jq ?jʐ=Ũ@{f.b>}ɭO 8[aYWGB\qjr54ҏmHqC'X\ܫ^^ċ3j>d&ɎWq Xh'@"ѿҞ;)?q5 HrH[IiKeLeclu;L,U%h#_>7XR?)!^oJ8"sP /dI)Lb3|)ZI|'ڱ\!V*QRJdlA3Fc8?O#~v|>؈><^I_mEKܬ$N]z?#Ls!<W4D-\ࣅt9cy[9)%X]swZU~BϷ2%|cI)E~Ā6"iz՗?:^[_OaI) .# r)ՠݵGL^vM^ȸ -^#ԙ1ef J}f$! 'oP 0T$ `GZ Vu7 CN=Ϯ7ڣ >H~S%BReKǶjI)֮B{Eo mOqJp.0:6-lC (BWQ[xo~Rs ),' ('SV(Rʾe=&7/E\.z{t/ E[Õ--3L** {n&htEO%EhaPcPzEVynN[j!`QQء1ں-ޢ::d7u蝙bܾ';Q)yx!CS228GKxA6۸0!^8 Y7 Ȋd+Z!O&ֲ">ӛwL %KL\7E!3r*@YHCV2"TF[Q5: ݗZ[*DI,% cq7ض/[` ϥF}9*d@ ߦMh&8 H#铹d{*GSP1#NKŵ$]Y?XAŧ6;qRV<,OȪ(y ܌fTxCi4WLY?<25gH $/?%O?$jYNșbsӢ<" lgxժiA5.d g bjNQ)E>N,ߓl ,[q2n\u/5 f<m1*`vjͤS;r F㿥:fT7Ѕ*w;wMSĔ?+{Hh[||76)߳7G=`[b0]#gzsT rKف,ă v2pIH$O'rDp9U)\am6ᄷ/.3 lbĥT1T ꥕Qb]/;y "ٱZW@Z h gԸ}4D}yupC/9aflg _ "d`Y~Z7Ec~iIOBjG2kj 28rrXE?}\0I*JqX P [#Cnk>?)_' ³%i`o 8fW2P;h=X4Q.sa]|9|g&$@E{i5|t?ȹu<N_EYG18(!V|o"2zvxH,SuKuIS+^ HJݯEzo3;/PBD}VzWK_JzTR%Jf; G`Ӳ bKNX G|b##U=Oh iJ1,Ulx4pM ҕ]N۶COq8 ^Hλ8[z,ZZ#bT9CK0(œ:N'X84LN?BGd/Xu_E׺Цmy0&_+؇ jgK-7:ܟT,{iv[*$. wlɁqD-v;{?צּ< 5~ w].G@*P|] ?(`I%{)Z1QHIJаH^1A6w>ۀvhE8WAmp/Z iϊom0,2~%Ь+3~GgЕCaJnOU9 ZP3bAxPMIġ!Ņ%XΛo )ZC(δ|pu3g0:Nda읒JƒuD;1t *IpN V2x"}Ar6ٱٕLΗdb,6y d6L!]_'ھV֪߭`Iq밥i 2jIV2^m) %4`Vǜ)S1q&OFgv -,DV//)@~f`&A%;r"s_ hu _ƭoE.:>G 7ǿN>aÒg?C#W굹ZHg/!&ct}WTi<"@i FB^'LkrXb%dOñWM*{< #v=nq_Pnu] )䨔Q8 CŚotS|EܯA6jjOalu>n-z];ܨ/Y;h"ģ$8&DA%>ORQcUgх ڶ$,ӷMw(c8˔hbܢzWYy9'cϼZ2䎹.'Ai"_˽.eaTx_"<D}}~O5/W7ҹXXL?|D*.ncFdScq,h>zapQ6|ge|d*td-;"{:S򎁡?ɻ:De:ql9`@$OO%=oL/&K @!z^(z wLS[1cQҮX1>h?}\ =ܽpI*^W`bW 2d}r6 ٲ殉ݰpƄ'O栐EBU:İBWvA;4Ʃ.};Нcv\Ǹ-}m{ F,Iډ&L8?ݥ~Z&^v CbiCg0Kz0 Pj{s9`\K"m d;i?;Eu!JIt&YӮ@7-'Rn@5;R?63H!#SVNa‚946^#$Pyhwj`T.UwɰRm%0.>CΒbUXEUL3PpO>7uEL!c}3xД;(K;8/ .ӝx A |Mr%_#rb< nlS@^AxIh {BC6f9kGčw6T4OL.]<~\:gTx@:GXEA y-:7aM@<(-(T]/0ehc>[߻ *$vEUJ {p,,eYLq̠U.nj{aW UN`0J≻-f'!:ݒr Va\d_73 ]LQe ll0!:P#q/#b$bĽ6^s#c/J:OK1KUBPHv)xԏy;I9Nи 4a-y)~tUdojͅظZ4 O( M8{2;bU;!g-Xr݋}PR2B@jg~$J>ڙ+oz_ <{[dbeW3;/Ur.t70#"Fsl04A\6{ɺL h1;1uԖOT< ϕ(WǦ3a!EH$xዮl揥h?L үko=&34t=pDSkôz>#8h |童:) v{xb}NܹW$&N/$)6[Qy9s ׶6bYA04D4(U Vl }ssC陙+7u3Ν"xf9CCW1Reۚʔ6^Q":yJدܿS 0:kDJ31F̟t8yizא'2>Zݤr,Y W!8PxMO&J`r؄m}ԺDb4vuaP*CVF:ܷSMpP얋6M&3JiV-q_x:aCIW'_cvORsY>K@sB{o/TgOU P9Q R:ٰߦSTgL\JSfpD-r}<ߴx ^Gcp&o@7k*&Mf $'޸Иs[kgGg(AЫ% ID,oȚXj_uQN h1h֐ a1Jp>G)P&EyWd"# ñ)uڏ WgT{֗(b(B_Hn_9^d=9Уg;2FFS->< ^>KvGyu|-.++wF"\ZLNc8D=(& [V6c,t_Ֆy +QuIJl )rPhc:&1c6qs9TP7C ="Z-ز)N͘aT[KXoج6~H~ǷjI ǔcf|144Rmyb]D@yR+G痲abV kYC;PpG>oozglT0^VO"YaJ颰0bJ~r#oKD1@;;㍨?T+} KEo] e FdLeR_f$crn _l37ǟ0FoUr56 W_lq-:QBQRmd'2wkDA'FtOvpd{D_/r1G},Șͦ2{/#Oi < 1Ⱌ:.X)y#C=SPURЭ\rb !MT Eqً"m!61| + aNt΢6E_ygPx>;=y!^($l hb( S.."jGB"Dwn>@-a9yF۱!jByf|%fu]M,i[d-`C o{Qo*ґm;7}a^=C~0&@كL/ba6/n@+DhPQ, {NwX_)  OR*Fc,bfKPOvz=f/SA1Z <=`XޕItEܜ`D8:47$ Os ЎCޮO]_;Lx %'l'h"< V~~ =@JӘߟ3 n@ӌ5@֬5ZQ4_8WF׀4CD$6ʆ'Rzf&\{rgEG/nUZںYVNXmNֶ=*}tvvPB|/9ĥ\7A|읈\Ƌ=LYj2à~_EyXMO|_yw;-0S[_eCM*ĸcN~Sp4.jR3 \(.(,k'GF_;Ry>+T>1 C:}7\~dƬ` G |-jnLH"Ԣ'%0V[L.ۀ@QpzDAoi&&cԶhХg[ /Ut#ė4G=YA3T2zHM5p }qPc|t"p^ a L#POxOnA#{*Jh0G{*K(񆪫f=2lX(B\dnw\ 1~Nu((Yr1CZJm@Sw@1˄*ԷͤفT #zm7H.v$=ꉳ%'47렆rD[h)TIila2!ڻ oMItad\W[Hl)v%DQΚg6(~+vnկ/OG;᜶ZbfSAE*߄ÿ 6@RgBD.G/'݇aldiljGƴΡq_ZB &K296visaRqfQݐI mgo^cC:4xm{󶴦׉E扊ƥGݻLO*97,?aG<YOyf%NGdk?ӄ!扈n7P4CFk[PYsX a\l(hV,1dݵXWm8fxGw[RW6QS@_rP;r"gyItu=@Hi:=!P~@x Y_vV'9Q;j\UcU.+lsH uiA[O?%h>L=|귝^M0_DHή1<3뀢fiPv40WZH̅R օUbtl9ި_2?_rAvyp\38 b@:C=JTa{f/=k zRmecggHV_^h(M 1$`~.N[O.)JQpc!;HJWT NHmOi.؍FfɻO(7O0[*!НXYh!Yݑ3uVt 5_Lghxܪ n݇> ̴Dh'~xdSd^/WW>G1܋nwХ7YCuWzk+  Ş´RFInvzȐNV=xwm2Stp©ԭR[\t@mk/Cnȹ˼&Ӷ!,A2q3êTbrBU>pOvuYXHIʙSZZn4ӈ j?2rK;buʹIq-v|MLM1ht'd%oxOj¬`#[̓;\i"^BlK> pKϜH-[+ ']Foda5,.Tq|萅ź6fNfEzr@B|ݡ[W.*xu.ލ۫3Lp~TY hGܒ'?U;lD7.sr*o7܀³]UNa'N_#*d6(nMJ-1([?+$;WlG`<V;OpqN45ҦGcbjmKuE-=^glm|EzkѨR!-~#N*^Wm3Tm>{}\n7 2QQ]Ja<d`?scZz1ͥ*D$M:\9RY^HфkK-Wg]Я+erw`}U<͠OPkpU-ރb!l,*Ue'2R <[.uN@"1\(nQSqcdp_~#*;'o69&"$?{i6Y ~ ~5.Us C0B̒w% 1p>_dl@9WZ!=7sǽ~vn[nW_P͙RO9k{``rD2|WG,,R KZ⒏vҝ7V.#1p柙'!z?ƟEƥtwL\^Xa49s`6S8 #Zb6HagllGdoJ4BBvZCؑrqeJ%^ؙ,_\/?=2x1@ f37ÊLn{`#AYmyFV؀^皻AHS# zns\۷h[?Uy3 b= nM|$@C@7Mx0*6 .ABFSP&|酂>MG7qs ^ 155ۆΠ竂joZR2zV Qy9Ռ1$bI޽DLUaZϽm,r,8$v O?(,ڭg; 9;օh}2pigmg#]9`/+_P驒E e`z1LG037Z LmjdK8qƒc>1=~;0; ~WaS(&/!ϝR V62MKM>!ƿmw)1F`ٓf s))} kucM`)JGKg܈]ޤ?Ur_ 5[beh(( gCOTGAϙ)21I=?#oQlۈ?2\xz A19rJ ܎_)qOBor\3͔$bk':9"١4 ȢUm-ÀN]2J 0şN> jKq{R`*Tc06@A .E; @UCߩrw)&a KA"j׷399 ےP2Cf(Eś0?8x?NX񳴺eKRmd5G3BHhm^9ɓFLJYf@;_PHսf@U1 Z/B` ى }ilnO6}D@g4Q;9Qݍ)O]V@ TW)^j5 lrT''üQJ2MM-2NpK \l*edd3R{&+0qWL>atўϝl 1PkT8e2SxfR@ ](P*#]n#҃}s^~ . x )ܙgE%w5ܹg "] chraa[R[BN{ ʙ}Moվq!]B!ДJ]^g2Di65Xqqy_gfamw ˓>9g8܎; naf=A!֙',=7T5v,/JXn>݁JF @1Qq@8,9[P`OO7әX:O.vKf5j[ sre, &CNTavu6ra& j[H[v gD[!zxr^Rri.oLKɬo’˽Dq/wO?ij:SAC2Tt&-dGi0yyb|][PRWpd8tW=Y Ëe~ouR, ͕OHH-ʸGLN$0N :=g>~pp<nDZ.m%b % t-2#K_|+[va e/֗!<1veT]Oq6U9\ݢA[0?kZZ>@"Զ PuW껫2͋Qx1ԂC¤.(V"Փz/e;d &o#o/̓>F}LɁ _H&:5}sG6B3-hГ50Cь.hS=R9 FZ%Wo&=~ƙ,u3#k2U#]H"ѓ7?Y,Khu V))eT}ڶ~" JFT'rFVgި_oʵSb,.nss! H]'E)˓n,8y6^+tQ+s4:~.&YTL3ˎrq]c;5gW. X!/}VJ'I5y8Wr>2I)8.%ī״(BzMTdGSJy&=qt*;م:|'v ' MsfX4\pzC*-`4jK zp sKoiq:A#)5yY*tw.õ1L|+/سVp""Cd%,SW49ͷžډuگkM[KHie=㗁ϐ?1u ;sA)}Zظ%$X^1̝B0J F#ۮWOZ5(&kيAetK,@ri|Vq1SJ܍ID] @Q֒A)q>%_ixf=\= vڟpOQ5wup 5lBhN'.7(bJ6u~9F]"3N!1/>r}Q`?7 Vh S$*W9,ƩNu]'[eFg9y ,~9|;,9j4kAoC#q\:)b%6ˆ?ZǨTL{r:24^;N@ SBC2]$_Tf8$ >}Έ?R%f$q’^VCQqp&4.L[BMtU$3NƚTZ2|tExa fhSl9,a,*On !>l0`B9f/xpH§P͞/n+_0O T u Sd ݫ V-⥷D`da _* o`DۧggW 6O~3d(&hʴpxy"JnI-twF0њԨ%A ?Bt|=ЖSy/dvꘕ,c x[ 5Q?~|n'fQ/_-FLvhYma ORW,CR #WpEM㦍_˦LiCi(eYӿñ ՜-JJRx Ho3=K؇ Z ;;? TЊvq+jݾz|Ϯʓ6y}Aa$.lȼkƭ9FJ9G7~@]ZS`xZ^3">H|qX?Xг͝x+&[09?lN۶Du `7xL)aJ7çWj<ܔ,  h׾(e$ {:j@2Ygz MZѽkRUmbP2$mFc('H VаY#ƁU},o.X" bdZ7d& Gf s93}9iVd*{pҸ5O')ÒW"[}Z~n@@8E̡jſ- G2o [ҕ#E<- p;t+%N#}qc( ۞l5a!D7<-=7AT?xgfB2f9` |uH'a] F1ΙfMs 샇AJn^ ̱}34*TÍ/V>R M^1qPˀ_V~} ]%f@C`\>^&ޱJM-2&˫etFRaL2_@Me> ߡAou:zLRU`tg!Fю};ޢǾ!8Xl\_G=Rs^0gWs0Mx]Mbx:;("Hz J,#}'}Sq[b9;FV(\:puOZ`@ɳULJ⣟Jbq5?d-·J-8ߛ_(B!Q╈?=^  'Ay7p>ͨPE,I;@BK`G~r^ $pryW]|~c%0Tcֿ 7h_UeG PA +5Q>/Œ& bi͠Z#x>w늚Q9qd*ht Sfk+%U:˛*,)rb_Uc>gLE%!1TࢉM`Ϙ1'd^.0w㦏:9-%ԯ>$mc1b' {Lh#zhf@bQ l5]0%S.k+f)h qΞ@AĖox::'%]V{ ޠf"$J(;~f!G: JxV݉á͠(kW]?'ɇaBUgCݍ-'k-q+1S:^\ j XL4b{t& ݡ0wB0&ayH.Ms^)Z²Ma L:B=5 ;Tgb:N߉c3n$q-@>QD.F43L$_HfZO֖d36wf54hνiSJHH^2۝YxD\fi|IY ('h|"~fQK "VF%ӾJ1TkլÛ`%! HgMʸ< +c`"qBYZq[֕i&GK32GB+)kaC=A~h6WcE2Xʸ+*sxыJdBTayI;6c=a| u8T}1ԁ!E@s8@B>R:b`a$lo=3qAO̹?)r{q-p3&mrJ#(?O[Vۚ/:^o9M&$ϔXQSNZ#)C{L弴qňq;~ )㷐n%{MX!F2ؾ2);{7Rhb4x &-4!F L*̒~;d6S`0"FG#cFYlcV'$*7 LoPb/ S n_}Qpv]/`Yqv4%CH-kdLŘhf~h  ?@ltԟ,2@79hA Zhky1S|ė?-k0b]_H$Iգƃ pPmv$۽p.$siٴV;vgqX5]i|$/P⦬Vf8όz@Y/Yq@;"]f=b_с;LP*]g RWZTJCuHtE98i' '0֞TrwX/x7u=/;Z];l*8}Pn¼UڂZ}/JӾ[Mc(sD=ao)ؒZwg0RXE-e7uŠ}ǤaКߢƳK~FK;*fzS9`f3 :d{@7H6WjtRdu{ 8ZnJf"VYw?t5U9ok!b'd}SlPeyY>K뱞VMd]+ ⓺pXwP2"y %"zpN?력yK=YcB]@ΉC >7&WX[jr4,n{a ՖSx6|l.!íw͕J-r}bCL!ҔMB뱮c #bXeaĴk*qQoYw}]!MFBJ=TÕ ?{(>3ǾR/:%bZ`#("XrW+:t !+7QxpIԸߓ/ܛP{0Im05\?X8M& $x-mof)<28zzrg~6w;2`uZ?kY Dʤ?$ NE:ldy0ЈjmU)_bE ᇇۛkMbO8;=Xo33":$\l.2%e7=sNU+SrZ9.>DTkKഈ.R3)/bܫ}=-l'$6DH$pq\%&Y;~ ((Xr#D+%uGvu]YL|^s|Xۃ2W1@R]/`MʷAuWi{LNҗN XH˚4r31k.K=V8 ߁Z@_VS=td?F^SKsO^Sь KvH( JkNR,m'+,fPD^~᭍B[4EVC_Hǂjh煰/g_Û{CeJš(Җd$hɬSEm3&ԸGq]B'OD@ )6|n:n>,&9U2\zk$o{-n%vjTb)rR&шj:џ ie\ٽ} ˀ3| plyL {2h5 ad!y;jsywVF+s~=ٹReE* /<ˀ?}KooTQQ:ڐ M;t>,lFDHF4.m2O& 076k"pۚ\`|b ]%8GJ2*_2PDh)1DV~M`=Y(Ҝm [jo84WEŘ/` ,K)?1D&aw6s2g?JUs;-!40f¬,#zUl)q>lh4\ug qFk6 AZO9'$nw4֜f{5eP*3wgH5]{K^~7a棼rM O`!B#k؈ծh=sAa VdžAAݹٷ&(#d祘g2M:#u^+_qy ^P%K@'_n ':@ BM޲Q侶}X5'Ѥz?xǕ[Z$j" - -֘OXȃO#)F9Յ2',Π*`V꼑2yq˙|]ToEzp9/7 Ő}U_wJ3iLAyTzOeG0Nžãq壄.Hp~w\m,tVQzk9& ^Vͤ涀S/|! Xw9/ {n^Z5*gWjQm [J! .Ce@FAax8 p#qW-g]d#8z]s5o/ֆ.NjT->&:[1DW#o#38@AP &Rį*jjZQB6GYKB8vlQt&(frhOė./+2qbc;b`-ê1;ZnMȾt6Pp@j໥IXbeCn䝄 c  Xۺ An,)_aŬ/CX*b 0# &ho,e;`S6 33%GG?Fꤊ))z&G~U2]hdxd˲ Lȭg7:t5q!NY_ѰY 5*޶j}>2)@a\!q^obFfn|F?Y7ˀĊfL<>n,k^2Vֆ.$75H'h^4ij{C" *ײr8 _Fp>QfLE)Sz$4xކx-- V3Sm\V[ʜ}Ǯʉn=olԗcWYw8z}4qW1Zw_~r-+6 3[tuΑ{B`=!܆9xD΂XJpAna,,,4_9ckT#Ŵ1WЫYbC,Ԉpx=ɝʋ *thCUWA$#^Fأ3sVX%-ê$qk՝ןüݑBFʷYYŧNjY)qݰjNʾ2o, X-yB{&054\. U!  p珗\*pu W M=J4~U7*1^xC1b\y~:j/'P?G2[SY›'Pu5R%^4o);5ȉMen>r!YW4 (7L̐2X%?Y;`d~cOVI,^ .½ms!/ K9 #1^W:BɎ<ˬycfz Uc-2(JYb2} @6d.VNR :GݰuLb* z;xwTA;q7;^A;3k)nu@줃2U~-P,]hg鉶J,hvEXq>9𵧥BJ бU ov:LNgCg8l,{BanŧRτ 9pndFrЫXxM2ù4|SY:m$J;Rd\ }=k[5ѤZXcMxZ~׎|3yhB61 ^]H _Ғ ͓n~*y9f"͎O i>TF}pq.qLXMXcXB="L;<΢Ն n74y$>h5怫1Z0$ ZoRT=2}M%UR,:bIHo7MݠzdLb1 )ǙQI % glMpk8 5'r 4)e}bLM"Tݿ|3s$[u @x,*RM!t-Ha+1jyz\)5b-@DSY5Xr$'_p NE j2+{PhH8ןw'?!W*9vl,# QE#;(P[HgV mVR$찈kmHjU~Cm6pN26Q9mʡakE>',,}@az9n0H429`D43#U \IBk5b2K\!-#}x85V6* )/LZ d)'1%rnG#JOT.VIdB[E_O'ǔ5$bwymKe^5mtgkꤷ`䐽h} TcUC1IJߜ]3^mG멣1|}p%7OdQh0} |#w˼mt3^0< [WAzEUӊ4i`>1Q {i29WjUlH~?7B"n4#Ŕ}m྆ewotv-Z|nS '& V fpx}K^ [Oʐw-8S@e2 ͇fi> Tl0[-dдx%R{bxlE抐hF " q‹ho%#1仪sr#<6aXN1>2w a)%ӱXj SRc7Ǖ$W؇V1#¿,I_l9L1W|bcn@Z%q0̔9Cc˶FQ(mN׋!GU;^;{[Ć *P&M,S_ǽc}. !&dRa6'TO\Ԓ' u C0"A qZQQLꫫQ8 to6q8D(\xoW.*(葕~ԑ^)`G-gn;ƙ@dNVPN@Yn/ΰ % ˸Hƀ\ࡿT4z@6սx**9U(a[4<=`-J5.%ֻSf'y, C % KIanLJf6E++-%Wn9~+?Sf7,V" Hc Dc!1je¥H|Iڝ- x \R=ۛT4)b3[Qփ2,,T8 7 qI ݷ]M&APSEވU>Rn/;N"ެ4-EV5g]1!hƗR{߃e?<&>[PQ(dZ$vUǩ)=rϛhA874u| l 0G脗 QҞ0IvZ;sdfޫlMO% 4JCsʬBy۬ I[}^Gl7#=,m:nRKԋ+kl'ҳ\nɺ6J/kumK2;h5ʒ%>Kӕ1}֓I[iu8g4KS8睦u8𖞗a-xdƘ 3HP.hX4$"eFߥa9'fB>Mu{Frqi,L 55J+vn]HƍMi6^ݷ vMs6ݜ6' $8!_TREc1LB*II0jaZLVw`?W j=7?%%BsfBos`a4 =YvC%Y(S" x7T phm\9jvL{ȀrEtpun9k˵.36#rk}sC绥{(k'tn7$ hjg^rj)!"KzU>bZ 3L&}ϾG 5]{AS=U -:8$]^D7ZPlyN|'~3H(KK1pbN^32[ }m<]i}lON)-m݇NC-N'6$Y2wjQ6J'UJʙ$!2̿P_`J"X bL}bc0r!k!fb~. +BgMښ3b%|Þ0Df#?'XoB>9\yq Iªf;h:yl(ܠ^ ,`N#Y$Y>:vW]Zؓ=tdϰ}Ni:(ηW뼰 BGdE+=& ;۝ &'⮸xXM9Zأ&q[8`c be5"J3+''w:"2<,dԺ"_uHt\$ϛ68g]&5ыDÓސ( wP_$eh|orQG@ONA(q%^UUko*%Uwa="@90Gg]<АwGFvHobWS O1=.r,820{ yP~WcU Kf|©Ȓբ#a='|~iap(+ ڭ.AB A!i;c=㿍 "}>N`3 ku=z<$v!\2ID0_B劗.ڬl$W!ud+qEi,pUNM<.\qšMRmv lna[i]Q^NZƸѥӇ7z=_BO :#Dx{Uxt\8ePM7X3r]yi%#Q& )ʆyLNѼ;C ܦ#t*8d.omJ`Ӷ#煃g(tX1DbRuegYc88FbrQ> D tsertf*T\4 qπJs09~@;МO,70)>^Rt Sp&E[Op520@^ Rz<6^WOm惎I#^xE+i!*!kKF :˾9ߣ VTwxM=Rɚp`s{Cuyܤ,F3GR. Kb>7A)w-NQx3^Z 7 ׹]H}E10>88 &@n'[Xa ϶z3S\>eZ$ ;D7ʖ$l4Wo1:q. ND둱CO/H,ml$,MN-Њyo }d{ d4Ue+h-h);maPzS+T;v)M+i"rYʃ!R|C$/H'bnJhB(GrtKʧ.2K!`CKiR @ *ۛIQ5|U9}YF@NDd mfyzaKan<ڪ+c.֧ |XTh"s@L_& ($fO9}酈~B'IwI3rx-iU@ P >$OA%cFzDM)cx(v.׮TQe~A"AO.\S^H `lаN0mҺώq _f4rr2m+1 :h`S~Z!u{}\΁,/R;1&̠m/$5?-`$ܒS㣉NH1=18{@A h1?fDڣ9+`keӱ &uJka%51]? jVڂޱ0q31 ̇ 2j+ozW7fG@̕>Mi/q8˻%BQc#7=.C2P".alfi~'Fvp? * 7ZR/Qc44@'{ ]˚U{`E3F{b\1K/|3AЌ.& ,;mbSPCu3>LZ1q2Uy4^ Evq0$-&2ƵiJC >Aw0qoZzz߈QWT=,]!;v%R7ٛl8$+Ab 4o.MW_I뙢G&`v3vm;TAajy0Yqjjｯ!u"< ;B*AR5xc eǻe?fni:ew]hS!""{V=pJSQ] Ourǹu}$|{3Y h̋m]3?&_h-^.\jVY'E?{c,gB ^R׭N_X _(0J25 p..dE=K"^&_*&2ձ]?'|Tן o˶[!u V7Q@SnkŸi+{gwG)G˺u`P(;"!ڋͅ`nYݚ*}u Xo@pD:="L>4R3ή˿+htlCEqfG?Zvd<;qLr yC/Ncv%loOལcjZ*/j'dEvN&{;b\};c}m$npӭM^U[<#\}Dp"@L3CESfDk7oe:&)F!U9?ޑJ✞uaO.39,)Փvuۡ_&-E(f_f ~ڨS*vM. x* ^X3K`Kp_ ֣w\AN[ y/g7e\D xkz *<Qwgfk.D4՘pxlj.;C4p&L x$0m GlӺhch]~WE_QF::z"{5/o nL):t6NViסA96 &鹠XzCN/u䋼#/Xv&~0&F02>B yS5LK0ryCbCd/54U/A4a7&f0vƸZv -3=_. uvĢn8=9]9Nlp,]XEj=kPL'!Wb%GN|l0/W8B '$VQmoZ׻$˄t3 ^H=-FvAc ĕn\R-0]M)on ,zQ;sbQfiQdXd35pzZCPs_r%K­kQqG!˻U1 ʇ1C۽:kH=*ACy۩$&EYK_oO<I{Mޖ>qWj>(]ws&5X q]۽1H9O]/vA{OIxHu~}#"}WҌ/i+oc &RU!m^2$K CJͽ .RL9Qd#ԻX SrfjSuQHË5x]/݋*n[<4UEU-# "n$Z.& m.kAm˞@*7em1JHJ9yyB:,txk98JMX{U|wƇVk 8,mDYkElDoӁܳVvcͮXnpulmmu.+Vt* d+(F{עnRG"KZ[y%>\W{)fۤn4p[qw!@/!\JKyY1H^f Ĕ,>u1|h-]VH{XO+򄼠 ?/u 啐W?jX?>DbNFxp&s)d_YPIeLBJ>m )5V՟%Թ>ǵ2r)ז|6.V\g;Iu' p{ͦ[[O\BGr!q B*nu1X 02Y#ȨwZy\n` Ih|ṽ ~W2aVe4HS5 ^21owڼ2&MշƉ &rfL_u,&&[۲ gpF.d]o݂dOv*Bv/@}OAޢ |S5c$HM@N IcݥHԘ*#r|{W)!X*XZv7/MdE""$:[ۆA.!h7Md؉I)hEmAF]p^~&Z#ұ Yn3viUm\N_s1>O8λT8WtYa#DVB0$Qtb 6qߑľ'ҹN.=jgQ3G"J}M %3 #ev=x" ]N@O pzrα2I$87eRwڛf Wu15/' njFĉ^USF7~ xg ]s*Fڤ<5o[!DB +Aqh,g%-Ɣ)bUh82M#׋^5 TӓE降oںgqelb8̃ `?*U%Ws`2ng>+F]/aYז"o_&4`ձE F}'i U&FmB-סp)evS_ͽacjC޼YJwN lUql>O*0Ӑ5ǁ!/@"zE ^NՂpAxsPrIXVqcm22g,.~rZͿwDs̰H%^2gَk%ӜݼErLbBb<hVDEQgn xSsaGS>dzQR؉G#m ӵ(8Q!9$G9&R]v؟Ұј(YU!y?a K3\2df[\KEUm` Rqq ɺ$QvrZ VA' 7,,fvwL_QY-@d;ČfQ1Kkn֧M49:ϭ$f* au@4D ;9D4;>D *OX(怸[K.k iVI_i*|8E¢4AÅ&Yb JÙAy,G8X<޳UA@}ԘxB,?aK2}m ir1|+TS. נ!I`L:6͂yX]UOYUXL%S8Nr9CF7^ ȊBFWv?T;ߵQ,[NvάŬ%WGIҠN?l!E_IioMM?mOq-8t!n#;j7:M 9 UDLyH/ƈ%g=jk$ž3? FqxO{&,>?:^ F{aP9=֢o 4߰knj}k0eZY0< b[ɳnDvQQy\wbsK\v*7eB1:0QL 0IBKdOu79@5 VB+dP nBtQyc+n&3znN*Ulۛ_Y㚠V6O96Âaa/3pYh71DJ__A16Noq4mBcՑTP2s=BtKA#gWE>BwR*@|aVe'5P2 }| OK8 V[x8s! 3Lu%*_2U ǥPKnx#/(ul8J*Ms%"tUŏ7"{ENEme{EN=9CP"x&s/tXj>H׵ȢOG TCH!w3#b*۞zw빗lG& du[j [M%8gp|++ Z[Kc&CK'57_'H>cbhP*_1Y_G(A(K}m?|`M H_TH ^"GSZztֶۭ:Mfd[p>BSox`]C">.4Q&{ztΣ+k2U_(D1YNn} wpǎm %& Plf5mo(#53Jk"ϷPBȧ t.2B:tNU>ŘJ.QrUA:0;`fx NU!a+]UU>tqá M@=RlCO>;M֫1,2Yè?d}"7WC{Lrbq@4i4J]mu1PYC4 cdE}L 9 Hg"YLVwp&I}j QCݡcJTL;E/qv6i}V[f(@?JG_PuهJ4˳<Zq(8 ,!g4֬3IwdLv 8+N&?>"xCaJY~H W3Y{ פ*b'Xy}A~sz\qG+jc_-'㚳Zk2t-kG"Hg/aК`9c$ Z\``RUxuq@ExQnWcb;,I~ó@ws3g̯JPhۖJmwз:hQҜsdK7Yo^XÆ䫾pc$PTaƔgTKƃ׺.쾘V^_=Nne ]m C A&ȓàKk+ tw]4Fyx2BrjH»?x N^g^2-^ 忔(ʰ. V/7ǠVaoM`Gds˞ pTRyM#gKzͤ &v1r&G<|xC9t&=CsnQO.G;m$ZM J# MW1g<R"!yx*~]}Zb&76JhJl4ݸe|Yg^ǀ4@N{^.?#"Rnˬ@;; oO-B7dF|%s> 4}ս,`PfCQ[|f$K?+5b[ʍ% eu_ bxB`ͲOi^IU#OWH<`mй?\8qvDש+,BbpYL~m6EBFm -5FNͳHƒ$df rpʳPE~(ZRT벋ui=TB7((L?="2/:kmPM7 $]rٞā8 -BȊHzLbV"v~ j DX҅Cf T-C΂5P 9C|~&qnK{*4"4ɿ7f?ʺ+nnFm#֍K 9WK~:h 2Ū}V뺤'$#ߠƻ11z^vnD̙?C.$Eo!/-spLMGlT1DVuy _y!|O~ Mry2LJ4S^60]̚=6Ij6?Y:o1A%o0zM @ˌ3Sn}(M$_JFR`~ܵ{t.A/Vʦ"l+?!L 253XBH\St-08 tKM)đ0t/4|+^OTXHw%GֆEƹjZ棈Q'BPxdc\Uٺ3G\+779~ 8~XK 7y2ȈVɃ좱Zu(ym%!j#O*')(Xh~a٪qo' uJ)Jflo.C nuY)%k>__TNŜ3kMIћrۜgMۨ-H5 UէGO*N hb2,v)ڤRRbuղ`c]._K~7o 3P.:?:{t G=İxǬn=} >"얱e{Y^G bC~ML|%_o$uަA7' Y;i:ؐm(a,WB˞KgoPf:'Sؑd'kP].NkVYjogi'9 Vk6 fXC:bwjqxI @tnX0XP?=3G ~ڪ@Gr ?8H hW*^L ]UIPw!l=b+sՑr!cR"kPެqDb9w@ۈԖQ%oI@&U+!߄i|l;udߦKڥxj#L`+g#{aRK7F5uHߥPa3}yWRL/8wb>GVh,hx0 $e2NQ>=YLPq@HW+KR@$"Bu*JA<1y EHmӋ =#%.uR˟UfA)Q X2 F?ݗ,[ar4s<=?@I ?Ǿi#+=fCK\MRqBKRELWzaA;曟QZ#M~G;蜁delb5-$|0B- NjIVFE{9l8̄@:04GpX?ɏin+MLeDNC(!fK-VG-$ %t~IIdg_oVQnddj ii a :ZiDHh ,&D_dmVer9Gb *J"@&?u6K~9X1KHUj2K|R0 ٙoLOc#`JZdC})Xmy\f([9B˒7 Q_SIPdpK98y__`!l YX;jYaCA#߿dŹͳsjOf,1+RҀ[\I.E'VEzjf\xVTIZ.0>OH*P][~\MχZHdl ܕ"e¾Fa Г0,t1ʻe+٢.{&UӘ4[ 6PQW`{QwSK e 1!4N3+GhÀwSzVӿY~tHs1h]?&⺙kZkIb}cQKFӠ~œE5+3 &07z2( 4za(>膅Q/.^ZwAw%e/c [CSB^1W.%fg%ధ{S`Qh0i.\N )؍h!G6sdgNMP[‹ePݔ!,[ܶ iי̻,B5_rWYtƈ8g_9z؊l"(DN G%;Φ+ņ*3@O$%3~F.'g'T"d-oZƬ::]1UNZ7F+QJZTaXݔDm IjLx%@jb~]O<6pZ!3*s9cPuKPCq}K^/<9]d"-,0-nj<ݠ0{E+|h3@dMo 1pH{L e13x9Qdy7`'Z:Dci挨 N9J.tj#3Mc3xKM]2|c([ >+a4i`7$ 4+J18o1V.Z]_Z@&W>1/d 7=ƢGX^<_I;Xy5Hh~˽(Jy6bS*AԋOa2nva= 5n4{$C4 E2W\e̎y5#cGSs$0˔+qXjkcCp>U$9QP*:s%rl:}!_D_zZX](Ȣ+`LTAj y,A'L]{D;[E&V8&R`rv$L?; N_pN=r +VT%|/_F)E[K~;] ;x1J656d|wrAbw0HVc8"P rI3FBw -;E{qSVA|ȼ# rjB|xGG~’e(n^t2:i)4gH8gٕ"xcDQO˪8Jj]λ`U{m;_GЯ1,Z(E0P dRI3wfWer^nrF6-(.wMLw&oC6s;ym7qt嫪e|y'rEerY̟!Z yVgMM9&q4Zj.S b9DrkMK, FGS"-)r<ڳ"uדP- 0D1_|dZ b~&Tf@ 콑J);f``V&6d$ Uz=fmF5\)X[wprn43SJ1bTzo[_VDJL٠TuW}1[0#Ok{Z$G9zZ4'yqvG+e }/o}7cg0%Cs4EǺ5KkEK3ZHG9d7p 3o]pjAj7VOI$75`: W8ㅩgCQ~(C:x<]`9چ3ӔS,VfsY!%VL}W>u_MndS " ԲW1kAD!(hx'*@3 u-o"ͅA:rB-??ēnATA?F3Ib^-nԊ?Q &FgRy&lݭ*(:u``eGڡ j>1i;Fܗl9 Ovr:݄}9k.Х/I$)ʎ '%opQ-6;&HZj3czhQZQn 1bL;lq0X y/j8y})lWX5$15E~2;A'v‡YBpE'}qd*tJ-w+@}M䳷+ 3G 3-#eX#kpyƬ>y f?#lPf5/e#w_Ӻ)t^˳a@9SʬՐS$?ރ{ L لʥ  aSd:3cH}9,}lUn';Oid -6.sj~kI1[Oϳv1Q%,QE\WW 2<)[u[ f)+T<ɸ-PKcFcbbaj `<,k<&*2kG*BXGҢ&~FUy<1r=qː&bgHqFLL$LMeDTƅ!D0x M1 ',vj?Ҍ8)G'ŸzUta'j}1}XA+N6t%4n݅(IcW]͌48(&l`HNɊ d iɵ,d8'+^1mρ&-okjӛ4=53y$MW`xqϷ{Bk:^7e2(c3J) @Mh%L:^ٴb c~M y?E0\g´x=by¦7)g H7c ʎ Wrw i-ъ6G!lXQT=+?mX=jZ|a{[Z kp) ϕ93Jڽ'W!'^;MzLTYQC^rSXЦr]mƿSqFyA_#C{ѾߺTY U'p # Dd*; )KT~$27#*9߃op.$Ax:bS9@O2:ˣo5wv$CW,eGKxC,$޳(.5! Ef:f\/嫃%RC+l,:,H|>Lj۫P3DFxNLuV/j%U8}Bj\ДMH iU~/_fk3GXb7|X=v fK2їGWxJ'D"wgPNQKL ԃuPO5+" AK`$)W Iպtf"V{v$L_hļD#Nh_ O8gkVA Ttt^kwf{[mOiIqQ=ym'C`o䘂مq\F;W':A4ikquq5Ni..BC&F dbz/'$s%-a"U^`c/:DƱrx9UIV9whQګB[ /Y(䡀 3D{#XFw)hr'$xESqwƺ lB#udUba_n 64fAkݣ.[!gN~ k._D=)~j}' Sj1D,Jlى#N:lNqzQ>7Y01φԴ,8}iT"%,lN{HzKo{ϏƜ58ccbP깈Mo:В捆 QHXֈlSHGޚHtNhhŊl>tJ%/E#\ Z)6͜+ z%ݪaŮ`rWTOpPF:=c;L堗yrXUlEjS*6Nrvab<6a S3MM4v mYEPs:ͺ4K|#s}9oM:L޺*F%?C\MWW"TK{ >taĆ?ؒ, Oʋ[m Kw%ʞ-ԧbu;4ƧhE 4#9mvF8BBs:`MQh||h ͥ^Jj4wsƁi;:4|]؎MO4 eWLU풝.o1u*88@.n̜0]VpZMk?4o!Y)~gȲ(+R$DLg} !B/1qcQA .DŒުMPYC_KTUHnAS=xX˄6숝N2'w';;?N׋ d+v*-Zؤ7(lhqȊ0㇭VaVx_{,ӈP/*kw\|,xtfRlZ*sz/H)tXkvzxz+&@7hdPX(`ZD5k _xze@>mgggp/%ʎC߫%m a ş4pIGMP7jԮjèQ*VVt?4_LZl(vBb|N!aJ{$ήh xx[c2Xy9kP |'#*PY:H0N#muNݻ]L YI<@˴inDgeљE aɔ;pCo$W;"y7XtaPyԾW&tSəi 6S-¯ˮ.,}goܩLl1aZs6b=4;qnw{?iJڶ|7RI L,) Od]A#w'bukA6mEWt{(}w6-| V@2pGxɪ6`>1݄lRwT⾨DdRŸͬ;& uJ! rJ{:zp{4ѸX=Zl댋,xYE0E2nv͖uVD(S%՜B U:HWf<A2r!$`dTs][HXqx\P)k G!<~Ͻ0DvO1|B(m&Qݞ )T5KRR=[Dh /l:g,&) yRZl jmXy8zԀג@붥P\,Z~/qŇG *\鲚~5濱PEȘ +*_{<^$Rd|l:лT#*Me<[fG}=_Pm{q:Wrʫ܅~qI53aK iI֑a:~'z q~Pf߇J.Hed}T߹FYt+YW̺?򅺭ZFNDJ'%U7.6w: mx[p@P9?3zlKo /TGE|r<LNIBNб;T_d~e+taFp|<EtZS\B3ZRQِ5rw%*;:ytQx>p2\/dWw##Exޜ7Wt޹(8B r:2O{D"*3R{A8^ͯxF-i[n1IWx[ȢyU&9>#gX :=4isGmyS6lN; y=%8%稑ƗߵJF@SQb07vkY}J fm;\7C>d2Hcv v^Q x5QMQ˳KkުLtUV.DlSdVqC(Hڱ\Mb 2`>X-Tg{jz M9-p xzKk"H l[lU)`D|bJؤP(^0g ~ޛJlTiQBFj7;4m{'m;ۥBXw.@ 3{U+J%#W'j{{۶9!h-1 .-RA_JU2_Xϫ}H`0gKOl;DÔL_o6]=o+1xz (2~g7aOn}>8No,Jeo0Ֆ^`Kijl`-(42"ݗ96U w؜47Q5r\~?=OХ陫x>rxIa]@{_zFzΘ:IաPZ֤ (;29#F 3vе]a,,U墿q2[.}͋I;oԓF\œ6&Nqөi SN)[[eJ!c'2"s۷e̊z_@i!o+izFdt$ce%hS(N?SAFP‡PEŌuXa8?]" ZiOq aKRSzyjfv)NbI"\[-EIprRԶbim$mxTшs*lIrtHZ'ADSёno9Adz mP1S:'܈gةQ1Բ r3 F#,O I_}ujBNw)h T\T}ՉZy30Q,8ŏxd/x"DgƖ3Yo t+c!ƲEobV4l.C89RwOSG4}s-hAr0q^K)yYt_[ؔe2ɛO_ƁXSs[Xl4mM~Idgz<K`ZRli4u_\l]z5 E.Jy0 nE;QNs-D6p)'w**H+4ݯvWԍ ʷ>OF+<ͦGou',u4Ơ~=8)AOe{Pm(0&P/ 3iRD¢(m}}ZYJ\% veҲ@s6Hqx>?gA8&iJV2 L#* ?h 9|M_[&6ͫe9 Ŧ8@BP(+\teG(Ţz#":rvg%|E̹6q|ck+oC:?D%^Rgnz Ges֛fF& xPxCn@i=#/bED >Vd P$( 3L\#;͍f$pÛZATRLx-hvR`Org%֚JқFtpئ؃Ke[ݎG aՉy`d][5O!h(`hdA '/*a2xN`5g>4fc̴!8uTx .Ŝ7ݍ@H-dL x+X`hAT ztq NZ/~z4Iv}%9sH<-^c-B^f*,=>SF"ev'bptimjsЃ: vY Dѩ\B f22O{;.-P5m_4$QVzN7¶i mI.bi;5ށFF$M$[ jp4Lj1,ӶW_Fcќ^~DтϨ`-ѽp,->_τk Ȣ` #l<_3؁`^R.^6~?. *DCX=P@28mnLY*CMZfQGMS [Kڏؖ qEPGm=w7 It֐ G j+!L/"#R*ixBo2Wxyyv r 7;JDYL69OcO+:G( i+n:cWAM|=Ef;cA.Oտ" [ԅy-Б*5gT Jh㒮nzTaTOly6|7̂+Ԅ)7`8ri36cX iWyڂA !>|ʒ6#wH2"5sI1d%~' [p)aE&M"N'`QWO GC'az7!HQ2u z&C Y S` x:—5džu~]@ & 3I΃X#^ʼnah(bܕ%MJ j|1 .OUHd,s8>)d3J9-IZ$iNvC 5l}A6t9ޕrhPB:pIlAfݎ@n9̒)K}hȕ i'  MH=#5F=߳ o3iv@!/:c]/' LeW>dipSjfyobk )%1DiD8Zo,|Iq {+B͏qrJdiu}&\'gm WG]6 꺋 Wi}iRC/"'-CFU{ )AǢgxCO]rޔ#˺' FK.p#Vk zdٖɿ w3 '2Ѫy|lSq_\c[aN`7}VT|7ƓE)%Cy'[(UЏHbڭg2KX!!foD,9ek%+3&ł5B݌P$[PՋC]S絙\UVЋzqk/ML* m~7+E7tb*5\-Z*o<ۊsXsUMD+)̗fBv閑 w7.<.o 2Pk T<Д5MkU,3t`oIFi_J)HԱW:^Qyh!uWv&n=by6q_*c{JK{3 ݩMZf#-NB;jA{o!V(KW-`,!1ہ|- RCt, Z05ci֙Jʑ@'ԧSҀX L=A7͎{%`ᚸhIj.fVc+Bo2vbnK]Oe>9?)8H@۽Eua:xv65I߅`S.O IGJQGu@8L3f"j&ȜkJP&e7pi)^~͗V{^iםDS?Px3d K(q?Vd74y[LU#޲#ܮqSś9m[T"=r?JXԇ\]uAaD2*^>G|+BRZsZȚ)G9AQuGMjqv1;Gg^F`O)!O1xԺiO`VGPDNw 䋸8\[Y3rICK#64?҉"F`;n ;$lJ\; Jg@AM3`x@.^uLa xIsQ a[F#UQhRز&vR_M;՚`lgoc}<2H7}_v]O_CێC@Y Xr91^2b MW֟Vr:t*0zycXl+N&||b }g>T!zwŚ3L.i u.H# z3" N?ٜO`i]PJr4ˡCS@18jBDeUӉr\[t̽}WSӔ(ioZ]102(_ ?Pt?)Ɋ9ʻaׅom¢ji 3S:!& .5y#soܸ5︑;MkϜӭdc/FܤNdtɕQOf$+,yC >KqE9ƀ FUHK1wՂ.u$@CfڡWCw`Taf"jeW\哮DGGwn71Hbb(>; ;យٱ#;9ylzI&ՏH/PkDI݈XccNd$.,l(ӚFijmGJQEdNg0fX6ec DA̧dzo<5*%%mTxhd|EO>bi!ؗ!$!i:֖HG;B;v8>D lQxlt]F?dTigWGASO|`r:K RݣxYqa!Z+(>K[EI",P./ues̹?K_-d=JjlpGêF m:Bk*6{r\D.볋YD_^k|M~;3SU;o`|=Ă$Ѐ:QwW"'3m`J dBlomWxA_*9G3!)mϘ!)bDN:D\C>B5<թ~oheO!=lV7{Sjv^$.ٺf(.3΃E^ _9L%⮈D'Yhݶ dQE|fɤpe7j:uMXaT.&Z"郯t~ E}^$ Ι%ג6  |[ 47Xdڳ14'cUhS<j=_D˩R2j8ж.:=RV}P;5Eѡr>*$ "WN,r :2),1K"^+?R:ziM#cy‘}kh<\]) _II#I k!Q)\T]=)ꙭOWNG,i +~x W= [emmɋ'K{e3%``jw6gl.G! TUD! G'j@E)4xm3@Ez1]Tk Q4H`ʭ0sEȳGSG&, # p-Lr \(B)]]R҉m+0L奉M_=? K-jYKۘG f}؝Gy gwSBujmb1J Wj ݘxF_TbOZQo zoMᛦ [6WF 6/ i ̾ [XzB{Yj6 Hu'0.[mH'-yua d =<0bujwx}]!6jwZaЙ-[ڒ]c [!Y.ڊ*J\u#(;Gitd, :ˀ=u6qm%,A}ڧTG 1俺o <9(G#IOqBV DW?hN_B3{=yweKTOeu8sqJrL~`C4p[4>a>0_#=ڒxq!$3 QV !B0)rEFh$_=L`d:*8y8H9uoL Wf3v=@ }eNKuPhla#7b}cG4$@N RD 0ߵs8"bx:8K|IKSbx`3L0uLC6٩5z~˸74IlCm4CQ7bW:m8+ b>$L*o-no*#H:? }vLT@Ք+UnMo>w-tլrWF7#2ςC6Q;V),pQŒ[jIT1{ȵFXQ|BM0[2>H,KSaa&1hokJ-5RSm8w9̾Wo)&;e~A+t=$!~UR8).WT0Rd$ZH&"<]rҤN !) ,9`iIˠJSLzӯ(RosP_,v$7vG|^LO6+nI@B]+D/:eORvND Q=GF{I1E^♒`]ʟ.?a<$WQta N;LG6>T--^{kcϤ rqBЁ6CJagBHC).oyx`MWpRNB UxS/ nS^JC 0+dDx0z"[kxq}Ra=vx^4=_F>*Rmi[Z8BsE,0: .AECJ6@d#Gj ˎ܊+ib"xy(|B v8ޅ.~BXz;oX6i%!IBY1< |=lb/ 0GִuuaqaݯksThb.Ga+c,5f&|Ǵ=IGA VKk#SF T .GzJ :ff/~-bq*nf!S6*,%Ư {Ɋ:IQ18+c @?Ó9n՗ KQ1EX$@b`?=i+Ό Drh치mtjEmJQMr^c@СƏ7 ,b.t&. ʏc*u3~Ve k%_uES{sgT=Q&`jWAƫ;,dzQ:]pÙ_yv&E EaLGAE?E??NjԼz'+v\Zrg]B4( whqgsqA>IJ X< 9 a&# L( E.=68J zXJ4A hq- * SJ6u S:yf Ae?¡ 2N-~WyL7?Yv, _7<>-#NhvOy؁G`ψc Cs),_=;|!ůX!5E*n½"-%KؔzDSAѴ4qbUW1љ&"n C]3ȡ%sިh.'EDOABXcm]ۓG4ҋ65]]|#Ag =u3t\.K!@ iu? qAzTK0*L#lQ_8aL`RQcF!4u35fP'bY -k 6w,fS-1 c_5$9YEͨ"͡ UXz"z}Rg> {f(']55f9,YCzm>}`(_UE[1R ukT I:h -KI!;pfŬMՎSNz1(W>41h-$ o#ar5cCp@/Bg~bԪFʱSA}}h*MWumhG?Q$%G,luyYQ<6#mkI@Ңʌݤ~i'm1F¬XZ1zȨ-'}>x#һƶu/]-a5(1[_oV*8B(!*N9txuhWrx\`^XIo g09$T ՝ Sы$:1^t ]6=DA"bc_ܟYqOntۂixtlD aؘ 5E-gӅs@a-Z\* 9^I@&kskAeIǕlXpmu>j؝߲a#F+VmK/Sݫh/t`U'^)SPkgJ+t"UyK`#] /}(?L]-k҈3lCK%ƓEtەboi9O@ شՃJb6NعF5oVBy޿A$5,3OBnPHP3 M&aoT_dTPWٛ'=J)$#S]ÍR%rKNjL}(]cGpq% Ag0ZjcIֶeӍLWƳJQby0oڊicekӢrlO׸B]9ﺤ+,L".gQA6Ӭ+W_0YiacG/[FemjṳAU3uK+=#rNP&{,45t 1ѩ}CTi(;3Z. I^UwUo6-Oq{/og91w=WI%dx17'O 2oZXĶ!D'm+_}`x=}鍈=q$; j-kLc}oڥ*,hЪt/` K! 3w"LKɑA^w>yia%΂%*D]`vZ)@.D?MsY 6Rُ7 8x'?w< !kQ78j:@pH ΏS/o?: dыK 1(?әۀy3  v86?X*Ip wHj^ #b\b[w7Yum=,*mKeYs,CCNT$oCL qЃ@DTH?LR'*)\?G~௹hlBhtIPHDm1PT+l<ftS'z;őQL ɲP6ɽE'SUCb{:m4'͞EuwfbYktL2ҧ2Qe!kdLj8\3Xp\J06@S}6,[۞}"ld&{Y9 a'@gAH\!;r7`k P)>2o7E{aˈ됾N4rw%_>$!C4{Tߕs:k=|ZI惨曮e3[p˂=,:P~Ç?|w꾳RsVFbޓ,/t|~22\6TBْ*ncntBҟ*6U`䬲^uűxGWj&L r8k eC)IFMyB:7­\o{3M8tAI26:[ r/-͚FM!q9wHOd@˛W7@-E'0;7K)2QG0×ϱRDZF%I;7D&hpj)qM+EKǗ"scྒྷQ%޼ ܑ"ɠ? 3ynK.}!U"x,｝ljiE?Dwhs}e׽AT+`t"%s XS~S1~͘.{_,edC ,Hy>q>,z=UUA1~pU*VEmኑA&bËpJT@%d'p%S ,+\T0HH flUjXE{d8@=bb]˿z1(ȇčV0~y)[%'<ͤ*g/R ] ,8֧nzAȭs?Sz2 d*)U T]G?l:Z6)Px5o1X& )%gm@dj%nÂbJ.6 XYwQ]p Sbj\c^9Ia¥4UvEĂd5; kҸY y" Fjb+UDǔF?Ж,%ʞMk,v7QS܍= %#҈,ɭUϔ.I^GsqU% 73#`^EUOtlቮSMA! vS ǠŔ`VK+o<]v>K&A+d]rBUKe2ذBpS{YnЀfCOfG٧}0Q}(vO RV-qS"4Z~\ 4095O߷g_^Eݞ [p3Bvv7:@D)ռe_OE^|3hr -5ę •yS ,3a7t&fIhT}p2Bĩx@F`CMX3%uJq-r1zz5&iq~4gzWx{)`e%BXoRYqJKוl6g8i*hyT ̖12?7~9MMSj|$C}.˙v ӌdp~}_~C}4Ѧ&Ǹ`% _CHb:wC(r: z#!_\'i޻2H}ADѺ#=@blOwj' E}&U6 ~GJ+Lqu +,HnՍQxׁ=+qR2^Tm"O%Zftʾ7ރ[;pCb.Hyj1V|F S7Ti%T"Sy1N4w >@?mrz)'*^'q&W xYޜxRp}M`& \O[!pl(QʁݎUᓤ !Vg( L_[op%krp1ҳtT&%GsǨWZؔzMVL9,m ~am*`ߜ> h'ONqbƩ!wAKT )$kP ?JZO6VGtEc+oJw5)݅AbsnM"ʢr#v5QHp0Es(orc` { =Gp^-JNU\s> pAb=괋AIy|l!aw|EQ3{h 2$= >7xD|?ʻr6mqmvvTe^go~0PgRlWY1{odBIlbi #\{hcj6X`7#)#IpŖSm~ba5~x>gK׮%'p7YeG&<ߣ)w _iyL U=eAAϟ1ӿQ7LnuWgGhO(:Jg}n~bj*Da(ʂ%v% 74Λ>HA; B{}: ۬{1M?-Yz^- 3{tz"[ѯ ._"ɐi chЗPE3ty&ccqqÃ-`>G7Z4տ: }WQ׹7݌;ޒ#B@Dץ⬝ǹ06}[+fS0I֓h_wV%7Q9q#K+]F`*m]P*[FR6N_|oP_!rUwnKe>P#Q᱇{Bҙh:fa?y?w\?>>!E)}R.FDɲE&o#DbFLGvЖyWVYhKɷ*`_gФ*}ݺDΪ%ӅO WvP|AeMϙutV߲jk(6M]-Y_z+gܗgWKш󥪂F M6.R.hCd<5f#+[˻6m1md= KE1L@vymb>$\ Wa| pvC\ 7g?&Ŝ-`tLt}qMyKQV٘Fy45gK FU24{*S)hy9UCpƲing`K䃊r~zHTI,V3JK#b_"Ds'qK_D_ɉmn\s6UlnҍdU\7L4Ns)|X'*ܹ$T@U52j6:n(a6ސ !v]c-kLKgf i+]k6F/&kb߽u_dp9?iʟxXH'>/Lu4OW`H-jwN]2-Фo筛Qs6˖wКazgg&iϴ-wMίβH>/[f;coOw]jqRfkY I#Ǻ1# PZ@R!\6_ 2,Go51%T-b>U)A6gf8qGwT#qP^5JM ^Fg&[~f侀2Ns,de>>w)n:-AG(կt^NS?iE]koX`G RMk,Jb]Ӌ#]X/%ESS0ݍp=Մpe(T\-BKYd̏F` (b͹ < ðY-3"Ve3kj`zwg}]#ƅ{iO_&"'e;loJ@f1(F\bҿ53Tnߘka  ߑM.0Iיg1[O.S惘ǫkC0؛1. tRҍ`1=1d~U;$뚫i ptx7h4oQ>\fQdbk˼?Ъ]x!0}ux yѽiWm{SjTM:9z:2ʿFyX!Hoco7x " W)("BbCq4\R|8̮͢եܱeTN_ȭ&ɫ/xC&Pۓ)O"],˚v#s<cγ ]ֲDK}۹`Jw5VwswRn)_zBsJ ,[~{^ʮ`rzd@i^o*fU9XzvEP2_+]AfDB: *:O`fqřC湬(v&i-мe4C9{ }"O K}Z& :j| @! Ѵ" [ S3!򣖕kZP_X@*{{D$0k-Z6։)Co[[IEA^jPG6-GLq~/5%V۠69ȧd^>+b|EvHfu8]TB{6wp-ND'e_K`2 Gh4Y|pPD:T3+MEIz^HR#!SSw.bj^'ʉt)]:A%K͘IP)*x *IqD[5#8Yo\𻊤؛}cx}LŏWSɉcs2=:J D)yl5|QCg9<ʚ|ޥeYa@`~0]|gIMHmuFQ]3.c7!xkWj _C`@B <Pzr;bb[㉴PPl9Hn1JyipdRXt8@$Ns5sl׎xL:pgQ7* > 2ܐldf?>V[EcSNdxR4 ;W_.M.ݏ d\pNsCߺ80!|S#FD0h骝o T\'5B~5HlQpƪ'`\4nyLEsӊAW8gq>c}"n8IdurIAH\\|՟4և>egQ;|ՃX8=r%n=xjɸ ]dߠۅ7lT@O@-aҗfX&mn8]պsK7 xZ5#c 1kk|5ٝ!{K9ISyLC'KppˍX*\G|qȰr}xD)CSWܺzh!Pm\7mݚ:1]_ OZǧ:>"ܵ"i26D1= ґS^WZYN/MoZ&0r 8zdƲs.R@hoguZTD `HGe1h~oXH`̪jb g'<6H?^"䠂?d2:-pr8.rOs3%OPaU07|uz8fvlPwi,։!&_K?9р "i #,mV%߿{gl8J%`Gl@]ڮx nE{f#\oO.ǞÙPd> ׻fVa]6dy3aOet#ǼÊ4VlBqyYq'L H>ߦ]S;k|վ)*t@2j랜(hXhߦtЂ,%hfw"-| yޞp50L3԰= [-;+]!%>MhNZ=~y y:Z^Ks̎tV :{W+gy}J+MǪ:[D Z6i %Aic53sgV6Wկϫf«qz]P6`3tt Cy΁*⺁AW}Nj淟PV>w{L% n-H?;*(Tn7LUϐGCq̥L[)Ƞ T3̽U[٣-K6 z׸᧞@Gi𻬀k#(v)j]U=n{0@lR洃O;nx27VU}ݑ"~:I<`=WX\+O(~Q+立ɽewGB%\.PIĂ=ObJ<ʭ Cj1gK)ҭhwrkI'S ,;{9O;F+lG4lO%b4RhsoGBt\-o~sYglH6ܯ%73aX-KbȐ9$&]'8./1əFæpOR $lt\ Ã~.ADO v)="wŵF=iv^$d=av$)[;4[c@.s%|PK M(Pf7 Ӧ\W/WrgOͲEW)hHB L6!*i&fs9p(Z  s*O-\2ގ/3V"H-(۬/?+-ћ#>xuu!rUz"*=gTWk1Vn_nuuM/Vjz^-ξxF0a8nPZ< oe2o!!WR3˓̃0pM}ߋ8O(#N ]<.t0YQ>AJ`Xgd j)Yt2\Ⱥ6h.̔VޣW ^Mahq$9Ɏ(;\ꮍ8C)hb)EM`*hV-'A>єOOؖ}PkxefHJ ^Y9Pe`-H_25g*oM]8Hx])KJa9{ok+Sv-h# RbvDFq,f] S&cX7O:Da՛v r(|3+JDrv99>ߡRrp\9ԇ^fciZрtju nتғ>{34\{ 7hڿ{:<+PІM1?B&^/ײG_d{0(OV2G2{:g?fd+&nk6.z6Qe۰PCW]H=!HP`+2 UW 6'KcPBmk99i,|kT?T,B7-}Z.4xL?M8wQ8)\ I }A54$V؏O1.a~Ծ¯h m&qTPsd@֦yUKŅqQs T,|gT:~{y$F; <%}x(~wϸK"_pE-.![K|79%<@;2 ]O@'[ޥ2~1n&)  xp?zvL^8%o#WٷEi{pc.m[*L#&srz ]5ƜqT"N$o\ogXӁ~2J)' 99f}t l W8XF5,lBkLU0VBne 9ԙ/CT<؍׹sT6G90ۀ ˞G!h=>+ui]&/vk7$c%::}VJgh O \Ri >oͥq-0 \`TՇt4]Ox+w4(Nl8FpJPL64\[dMɇZ紞ȑT esHa3&3f~ qe>':Q}95I#1Rtr(l֜ ϫx4,"œbGJ:CP&Ez? aY^"ajwvn?s@Vqi1Y|Np0wsRRSTml^+xVVJ0b_.`%o v_M,"g8<'ET)c_;޿6qUR:U6Q-L!$w?q1m IEͼK:$X7|srLr?Tnd3 0o-z .3:nSsqMmsS^vֆ]\fASYJ-5oU"p[g~Pda}/9Ҏ‰.I`mnF?mC^ktȓN@6sE 9jDHKX 4ڏxgj '] 6dR(R~ffHIxΘ4BA LY E cҌ$K@+C4 }Hw6p6OjV!vEA?we2Q2 .G ^n IRT҂aՎiiOIK)Ɵ x5)2iK7Y=u`iOsq1kUdSY%L2xZ u߼B$I\3t2x[n:i\gI$[a©{j1CR L` ?F%Ul2LӹJ| u*%0TyN`9 0 s%evp( lEp?_)N@:C PDn?P_$8̇ڧ2&+l.[[nZ;(hXGx>OvDk'~q9ŌYA "p[MV B ,|1@GݷP) l1sU\zR(kB7Ϋߕ my`Q}ew oaӵφXMm{v$ymޥA~/}i`BT;+AK :z `2dc .索p5_2٤cv4fͺqqJh5=*RU!)(yŠ32-C55@4P{}R PIhT_g= r1Z3`i"rll0!PؗP_?:'*c|5pD\dD&y̆VY2?"nҫ_h1ˊɇcۣb<*{~<qqp=hh Zrl |=hȗVbI+ мF<5 ~5+ll -aE:?`2 E JAk[tFga-VHhV*R:;ڃ@Oֈ5@ 4lFVn;/.Y~d#!D"V'G=aH5{MlA8:>vkdמ2}{Z+gPjCF]k#   U5K^)Yhn1 ޸:Qk:'z|zby@3ȖT|2b)ƅ7kZd[+\^%!N{+7¤Ctbv=e@ǩ)3 K G#;++kԱ hDp)īBP*Y=Y=K󊯞%YH NvS CKjmP,i;#͛@{cC_%Uh1l\Q*CBЂ~v/~1>ST(b9Ji<8j1&Xov\Zs]#('ԔA`SXս 'Г/p@Y:Kã.Hbb.[N<M‡qI^Sz{MO~"F:,`=!vjRr^ȹW_d'K( 1A1v$#%YIFgI-?)V+x`̓d%I^p E|rt;md>En$6K,;w³-P_yaI74rl:zX,u$!F T1X, +Ǧf3$Y5 `$$Ș7zkmQ;ob ?>fkS6Rm-87H%QZ"lhfFMuϟf]Z/jM)ڦdb|܎/Hy8 ˩w}Az0<)sD͞ƀ7V8κlUg_ kI$.F0 vT&CW%xRt. ,2:9\60H-#K˃k.+.xaDndrO(a;03HKٷ;b t8a|#Ty`Xȸmӧ C 'hA+(Z㖸e!]HlȫƑTSɹ c"?c"TČ}Jһ4l0?k]2/|Spމ+i2PB){d1v/nýփ3H|\ȗG +tct-Jrk R+? wnh^Q0ݡjW5b_q j8!PHZYi/͂wД`3(@(JWaژՑq{O8vy'ҏzڕ',F4T6MhۓrZFC >qs>AzZFIdK;%Y6ِWdcx̫RG $d?34Ä(5d84fi+[GZ2b4(jͼDNHj]KνktNI B®x5^}Ee>w1{uMD.y)8<@.ՁR$4I6Wx jzpRCɲ5X$^\ Ny;J&Wܬ|?x@=j$(`goez-S"f`?Wb3iv0~fݱ|r6+iBЍkBCw؜yf\v{)4eVc|agJU6IzUoGsی-|JcAƪeZ6c50|T7k䷹5 nl(Fur{IgƄ]ҳGq^~S.K =x%/.7+}?ࡵG&씉%ss+QJM#zptbdpAIIB`2OìaRroM (f|IEZc%9Hj u!YW,/7)؄xZ*dzd-8XꦑA? r3g`R~<_gC}<44uУ8>bP>&GvuKo%VVѠ!}_ApṢ3)7l tit4dΕ"sR+P< Ӱ݅) WV7|:7:aRXgr>W>h0>6|ZƜ.!d8 B-Z}$o "06|8 ;bda(Z"^@ow6wJ#0YH]Iks~Fs3'l>ҷvCw#!z f2BRiGv74ペTt;z!8J2/)yR r$| 6n{˚+YA ';x8iJox4/o > ΒJG#])zHVA<&$LU[w1T*Vm%)ԓF%b1?Q,S o! n|N´H 뺲 ֈ c5NDաWIA9@e@EB뱫i:p[҅Oms-5 D`.O/&;4 wl=Xao7x%騡wUC as?ӏ]Y@7PEa;)hZN0X3#Ad|{oKN; OVK: ^ 8_`zJaۜX#ܽagB.7>#^DS&tl3qkz 2cQ=M1!y-Ah( NS&kC+3/Ȝ@RS= *`!zN@E:WҽʋN,`#8HuIԗon]ssasv.﵆Gw47Vso͹]Le4*c-Xo $2`U| 1iqZצx#/< e!`hrNYAS`Ef•^h[E,`my1w4,ySr}TtPώ"bUmC]&,ת7609$zF_־kb*C!iF4=Օetxn\I1겎J$J\c."x! ZDR6 }XF L!ʪYЉa_KqVJؠ zg(L]/֐|WV0{yn)B>iTݏˊky9Yّz^FSzߖr.y$%'>tl6։P.c(vs&p6h)/1<KVdMr-Ee[Oކ1*̟E3\oCTPQ(Cch[ܢaLCZŔNp& ZwPx,-[LRilT_//FFƟJҰf`s\eJ=rfIp %[ pB"&K PeBx[g}zөda܈5-'y8 >Z4!Zܱ= j!RVKycG_,ߎ&ퟴw)P`#ImR\Ny,= `YQU+ɍ#۬(=as3Y+&* Tn>5|^_|  '`HYAZ I$ep?}|)S2?.W<%~ׯ1:uXE0KO_ҋ"m=P`NԢK3d?ׄ}]p..Dac8bkwjZ|i[(L@}_%WyHtսg3o@xP{E-M = EA*8k;yOF.N\(n3&g W?` *e^s]$XVk/{x;N4@}_q,%96y[J=ѝG64 ?kVm'piYUQ3c7O"RiIkI]}\ؓT6|!D`K-W?h}r:};Qأ&sV(TXp4Z T8JQW5b!lNX $cHd֧꺆 ۚ D4cgxrLFP8S4bHܸ8 s.=!vW|7`)O;żZ&XEpV<_6>JEU~PmnqV$9T<7V/ug>^$$Ӿ=DXRdͅU/kieïio;|3R\u"yUHU5-ʓ]O;HZ)c{.g 2k ecNu6PöZT b*.S9@Zj|1r;uݳ%Hfϩycy]+ uk*ҫe4%FGfoCFx +O~7rBhIɩvk!Dz{;/R+b}>(qޒ~g I1 ׇL Ѣ.u̥ iܰ W."pa{?&N@eL{pLisS8؁Jl^+4@OdB/Ac(gڰ4{`=]GqA`Of}!15CpfG1"« =($$<M #QrWX ѝ| )eVŗ*eb$R J#D,iϯDXEҕ)e"/'K¾K$Ff.Vk5@*x5@Sh5ē[ ׳5#˒BycHAtDA3*aV [dH[>DtgY$1~!,; 'Z@tG`l]GInY7M-&_ m@?KVE^@`OSxlsiu;=j,a@/[3U,,q8iH$Lh­'iU->-O ?:>GeHy91dݔ@{pw}cj_~Saw6A~{I<6% sWDɇ)6`id"֙S=sܛ|pznBQŇѩܞcWㅴ9seR!0jKM 8~0<)+"-v4/˃*AOrauaw0?b(Mʸ2lt<gg]C}:܅8 VȭJqTcx=兓uMD0Bw :PNߣpXy1ss|dF42oiH3g4zWnNBMe]0daqRoㄸm]JCsޖ fp B9=>~܂H|1/p6ZR'3b|,3ZE]غԒS6k١}Sl]s(M wĴ獽TR?竘2ph`5oStR&}jpdLKX(4T,3{0)-_'I LkpL-fWt?H*v xahF8g"Yjz" Zs$x,u2͞5<=~_fw1kM)^i1e,V)V$ߏM׀u9-P~Csd۽ cF D{Xo}5h0m$ݤ:UViK*'>}I, [ܻv<"=_h,zqɈ'VgX[꣰O>vI'Ri[ |λa  P4wGj4F;T`Ik9t߂ ]VǤHdNK =ig~D<ah>f9AmCn>'ہP,3gFE>ȳRS!gQe8-5u3^bF5j4Pf6]8즿ŭvl}nk v6]66A@<|4(MF{uAVTu8 e -wZxT[[u`gBTia[ PFG2eB*ˆMEq(/0?qN{ —?~R KjLyuJsqyhm9F}O7 jdC ڏZ̪"4{KcQ+%=[Nx!R*1v i&R&;dhh ?0._œ,#!jʆV+8˽䷲qiu q(O pBri6yUs *4D=n [/KIO0V>@:N 鮍X- ͠>\ͨ瓥]' zJX*xJHzAv(KK@`G4 0M{Y)~<&]J &p`=Z; @+?)['qpPc,;$[{ڜjD?Q'O_5 @MxSa}A𙶞Zk/Kd"&]v_Pˍh AZr*2Wdφ1jLxU0-1Ａ!@$eSϘ zb併=(4볈ҝD! ;e1C\.#'КDfBG[dV~=u$A^ni+3# `%k2~ S@.7I/>:JjjtR(ۤmNQL 3Qz}pbkAGd^,-{zfئg)s\•U2 ٸrq)p%. #dqryٞ8fj^c#X5QJ3&WUrxOX*ˬ|EѠ(co4 {ZzWAEJsB -J< } yFh147YqY=[mšfm)6!㓗&wQ/9 `ڕM w"!SZy0 P?gx КQ#Q5Ԭ2v ު2cxFkI- ZօwW$3i@Mzo!b"IʀRI>NɢEJ\rtYk# H7bэRVNx5߸paXb4?X1 -'-~_Cоյ#`l4úNwLUw-5' f\bKbX%\5iL~ {nML;ud}!%GrQ[ZΤSɲl%ьk^Kll/ܮ$mCk,&3%R ݈ƟX{[,gVvn|5 'if3Vcފ{HǛU`} @Akb5H?!1]k 8QnieՇϙGGKFq;e.!r -[][zc$CEWo$֒*+]kP!ܔ>@[rAlwQI{8Ak(:H=i$4c!L/xrSH[z4px4lkG}x~F r1?^{*Ry 5c؃>K;W6KaEk _{ܤF&Uk0ar.W`齽m& !z@qIaWEwMGȏGH0'[ /n)5 VXQOIzga1Vc yF,K!`DByhдk!/,1|?"?Q.Peƨ/P+Aлeo4@j]!JĨ\Co,2k k+Lj6˃G(C+K0"؛NB4}bHK>&} XWx 3=N髧۫S,f1hT/HCDL(NJuuVu ;,4,gby :So{/{Kpl;2#M ]d2ӗ}`(ru r)F5hj NLIY)v{nfup]'1fSFi*(# _Pk]LHPkob(>?KSgqB./ @Ygje9<@2VqcDk$ZF@^SIСD;Sgh~)A/fm"5|>\\[昡bNת^w`{w{, qJ9:oCWؽ5]S؎G7@{nFx%BVДadے $*8ƞx+hk hӴ '^fYg9TɽS8ΆYRMe6]X*:s܊1;|NSkNX񓶢BAMl[ݏLXر$Dy^MΚpAGaBzt)R6ƞh1a9HbZR[tT]y8l;7x/)>^ta)UE30HkBk7»WU1,qΓlJunQJ l2Hw0,Lзnj.L0i"u \|ziJK}1`.**S'ۃiNK/nBJ,?W^S2uT85dЂ5'K7$x Hۻ5*G`stp\frR/`oG{n>[18N_FWi/0"WiLW] ~/LZVj6]eSdJU. {VTEnj#|4ǹv'YI׮2jXV`gHq]OgJIwќ[`0&4DL)GòPڤ jnWCʉ6b`%p51ۃ3L Ҽ+ פtvкȑWĢR*V?~y"RAJrqS}¥:*b,ń_PU(7m&=}GLwT e;,ɪ56P2 Xov8m~\a⽾_vlj׿ >gLeDsBD|rn1}xbcW B8#4&'XI&[ͯ8' |!gi aߥnje{,<C(^SᜎH̪A{Ӣ9)Zc G{-8QWnY>9( c=J[F , $omLPHF~xi#DY>6'" vjI8fP"#hY:^fŞl0*qj'/G@(?AO*ŗ*67kIm%[+v ,jte3A-խq/c 78D)F+" VpɏT )eI 6C\JMSu5ƍ*; 8̈́,^?'涒!W3da8ک_0uk`!gi3S :)x{Ugl9ieUWŋ܈ʬrّu 1.1Lke5I J[1@ `IDc7r9 *L)ą'#g2 kN-;8LMWy&Aʔ.kl24--4Q$$b@@" W$ͭ4vu@B1tI;&ouF!xE1ߋDn '.j@j"tNZ7a sՂ'绩`I7t$? [X GOF0$hTg |߈f)~5ɭPc]mdT/ѤO"0H)0EJ=Ѣ߫r-^97lsg?q֟&,{9&Fu6ZR $unП ǃ)m <'l>${!֘KΒl$T(M=Oű-+^bzۉI"PԃZٹ(Jh!H[@oPfmc۳sƍRF5>b!%QB8 .fRS[*)d[=W\> |nH߻|ɍ2yHnb"5pnQEe (}l}~mWuO+7g]r?G)saLH3[Ʒ~| +#'cOQ r 熆 {r>uWN[28:"5{>U;Slj' ⏚4Nl7cAw8V:6:=䬇հ. *D ]_ jC^u 'ԲLז05+IDH,<9/TMBb(Wc>T MGLYmx3$-bnHeBs>!oάWgvo6@q[0áS4mL$=g$4<ˈ<$reBP)yt Cu_M*8RA#8<\(٠a&.l1E)%Q %̪h8i<}UQ?bD<nSag^ՙ8ĥ\QsE>‚vQFHk޼HP9E0r$jUP~"\q C7DImDTÈR=qMwc^2ݶX"{DVʨIZd/;Թ̕ cj BgS7L R0ʨN$cj 59Lu1I,n2@نoL/8S f.,edOlE4n%bFvGn9+|k&8vc j6Nπ4;l|V_|<%m/U1b&KT"4!Qԫݸʓ6x~t<@yYo[U c94C}_*U-~X6 B1ػ/h]>r(ǜ!PBWބq(~-ZVpz+>C ۯUDgH}^A~So2aS?O[(CRP+byFiVe^,.쪖LJx]$GDȨ1H9ۭx*pCg?v΀Û!L 6NʏhT?jKTr9r,Nn岡;VJ CCsN!‰VF;vNϬñiQeJ:dN2+Ős&"ڑ~blCK͔*茭5tWwN,J/t^]P ̀M}S()crZE6hrMp4y;u;_Ra(>g?v +E 'yNտ9JW“ZBviدّYK[B@3Y1>kzxRn$WB]% 7>1mXv,ppy0s k^|r\ropl [ė dNvGFPBA+U\u>|!b9:)_e@՝Ntrϵ4NC2ykԫCoI9ѵ15m\R. i& =gW, ^ 8"ow DD$ sts[r~?1AUhMHi+6R4u;-P+0e!S9zt f̈́.ФZ0FΫB0tީ? GSv0ݝ/MngJ^1n?o}w Uu8:x c:.'TJ䜙g] n51²\!+c:t:1}L8Ĵ{hy8wwzwl^F[W(qJ{ܨT-kUidӫ ] -WVCUPpD ȍ9F[BR+l)-lhVUIsl,궋{HQ *Z,-]WwsmŲ:^WoXFŐ6\-qlAmdw38f؞)f0h:Wr RJ|\7j3iIie|$(X<@ӺRb(w B403d ,Wה]r[AQ"KCdA桿#jO]U~Uީの=v;ͳvf%[röYѓf*ɿEy|(F4}ģ?c&H1)U 0Ж^ ٭m5N5- iCa!P @M*8CKC/OG=`ud$5l?m%k5*+uYM܋<{cAe6Y'^u<Ԩ ݆mJ:SYj]r߸A45 YI*uP].lKI!90[S=C|d) c1^M"x[6F $٪r `?K$ULX2,fZTE:2V3Zgo%IaA= ~C&W+;5)bPX 1@AxG`*p yC,=0RMYG AeU&3b'SPP?:N &n2:EAKˤi4fk) M0g}.M̬^d搔ǙD{/9F7OΜ+A l~`HZSƛ̰:*| [A`sNW$oJ3͙8wܡ72zSQ[0 hM/z `Th QV-xT8XmRlU ީ~MSw 0 |vgn0!A3{XKo/(CjrU?i_Ш .佀"ZCBi.*,'3O2;wҨLsa@2Vz9]j/|T(D2~YŰ"GyaMML*æ5S.M0tudtS<_):̟ZO)нw&Ū>ÉR gE7K)BެI '#J}^|#[aL^ XʐfƵ1D* .O3K96 8]YZ>b^ݚOGn[8>/!+뻞k@}>SD"xH#/s'hAk`SޘV͂H 1{+8Fpcª4eø(֤҆w҇z/vk>GRgB<[r>_A`{dԈf7l `$׸+&cĝ!SL;h~YxKН'?|#8lاmXX"uq3MNĠOKa9o&LF7ɫHBۻE=#L쭀8\-;kj  2;FId|8c>oTu*&8}̕=trn=? JW^S<Ҝp\\g"&B%-3wZ-2a`9U̝Dz$VTdljZb5.pG?x!DVe\z=Q>DO I7HSUSw,&`SZp0SZ^nxގ[=Zmc9&G_ Y2V[(YX*_Lc,B4̡d%PK6jQa.]?1BZL@+SN~茏H4[aօ67Rg$<8fpr$H[;R5P-g i~n*% ѭ]3W-IEy ֘0t @\(8^T\@~P}7":e)1 f$uKM·E)߸nNɯؕ- k$nY|B(l7ͩ-(Lf/lt?y=Ԑ\5v= ]ofƥ18ѝȼGz>mv]['lzV;2A$}YcVh=owdJz@jpKiVbF0ppϜɔaJOqUt6|U< |F5Z OK|M#V+mT]`Z`LdklndoI V pSPvUEE'} : FWf ꃞ^TlQĘy'LiZ{g.1t"%`eF"hk{^,7ǁ k@b&_t`,=xO/h"\ҺfY Wv~2-MA>켹(pre^32P/ >=|HN3Y3;^^IkIiӋ*c$ s4 IO[gғkpGh YJcq gc`Կ?j"C#9Kך_={nlzx0NFl̿h_!Fn,$(Xj2 E'*P;P So藜Zd.u#BӾ@"|N!j-CёeAO:l\ZIo">G>"v ּo_IǬcԐq^tJd'A=,o\_G6q)$-/`GfnnS!.nKdXf~th-hd6֎kr:j`Yk,9V)53  7S@6yG0k-#Q1Si3B4OIRoYiBĤGϟm:S]e ddӔwMYOZt*}㴚 PW^E|Y +qz% ZHB; ĖG3!*C䕆Am 9`W>#i؂ PXvTA +w9l >)e]+m"_x^U\:]yo|ٚ&9zixwŜk_O׽t,4&~]<VK9S{m9Cy4ȨǜFLx# ߕ~ f 2x%/ 0j\q HS$^r`MHY~Z/qo{7r_n|/%z#-+: 'yZYE#AC^T$ ~0D)}-h>!Jf1Sa`%+ )ɯ [ܯF:,Z q#p@Qʅ3~{10ZUE[zfh$ҭ`/x:1 G-h8n_]1)ɇ(9ڭOR i/5I/߻ҡ%GB!MDm-gZU[>Vl.gmx$,!LF"D`wnSc]!sz)h(Kq",BF%<_<_׹ąhN=[Xt4]R“ T29<%ظ*vH;F~I@*.xXaSYe&nálOW_>8 >FKlbJJrp>9 \@j\PB 5Î$ѯƀRɺً:qiRT>-sƊ+03Rj2q\@m. OC "hy N,wqjD8:rԒG>AhhaME)0<2B]O؍rilJ;lQ >Fu-/ q9SCLY>MHVB,x,9 B9N"\C-"@Awg]*nZ oY=:mosb12UOI,3^祰WM4U x-Guđel|X?M`,EVެ ӛ5 ɭY(՞R}dzMyOۦfi嬽aO6qsFfD\sA9Bׄ9do3߽LBƎ&9\*A,^&@3X q׹kò'X 9Yڭl5\|pөI Akt|mt޻Taᄄ9 8vd#^:’Ȁ@3QAcmˢ|Ԩ#Lʩ%${VDX㲼XHsZd'&vgnd#MQ5( ~:%i m YHq+A\m/"p2LA;M.B3`91᭚~6 65Ce? _5߾ @ j7*X h**z R^3aAs=rZ?+0zd\DH$-Z2 !5.|R o7hmooK +fB[ пޫ5mx^MM[Ʒ媽7hD؃?0#h#2>H$aI9'Sq7?$4PBEUj1%X N & ?ҕ])Āl+U1En>B 6|e%ݘmUS\H|Hch2FD2WUH-/LE;sL:)b|jw@0i0w^[,T)0GѦՀE2oig7@@X 5hX/гĎA}./zia5+MSp7h2*ZO48hlWmFɍ"gR/϶ihcttA_Ĺ, zo7- Ӵ֝ۡL,sIIKKiWblb|!"Nmy `s2C4S2ڝ y!b,(f7O`Qj6 i%#V6a7–Ps,z};{lź3(mQr eFpKU**XqJnK2lEQ&X#EE*N ŷgH,4N_ϦmNw>7u MN dXr>'sp5XfGl}{mn!' Ϯذb<*c"8!X"Z;"CS7e26dn*52 3W7=M2I Eք+9n8%H˦KΕK[䅩O|6B0Kq>7|lιCIu[*@`(t4kJi]jQeg AsLz]\11 QlKֽ)g`mRfZ=9k==9U6eWSr$.w⹧^t8 *3h`m ?Q=u UfcRWuaϧDf2xϴ"9ܽ!8АQk[3b;LI㊇lW\.PH:t̿jE{r/w.cݡ/a Ip5Iy"V` Jʅ`B@$k #ےb,]#7!QTԠZ&_~qT͞"*ݿz9EFXX'v"΅-<›jJKM(!{i_?ӗt 0&{Q;deamhR61F)' h#Cq J^;FQh{ikxV'F ?kcU:..Mr + ٹmmˬl>\?$ O˱k3ŠpZND(7enDabʍJh`᰽0p\VֈIe4e}c [Xɷh+9 ץkNJ#9柺 j!È?J.pxMܖЩZ/:Qe4yeAkcki) ' Q@IFQU5f72 Q˃;Ě2EDrx)Ko+C l0I[##t-HQu0m?Z5m~S7BB32קԪ= XR% ,acP@'3OU{hQ5&$kj4@bӢ(mtɈwE#cDThλV\W^0M$e+8tmp>1Ұju@diSFp~Qb{\>WN]3h("_~dŏK駖MD8dPЉ m8afDt!4crtR0c 'r:^W1b:ͩ'& 1~AgPPjw7N5 v V ˆQ&LX/5Oh.A^-! Nzih_$\@7I,b4 r+DK%B@eݧ| Zz44*`p([׼in7AF|iut[h^jLel|ӫCrR &.+20)^UG$t:l.͎3L{AjCh9:|{ ^}晿_!w%sGh_OAT9ˏ>zEcPC_@ x4_Ҿzryaޗl-KPʒ,;þ+¥c61G`UO=Cx_Q`z2{+"h4C`V~6U ~iYJ#:W%8\Nϣ] s=jmqWtD~)ztOtvodⴚT'-8>&cjJLIݠ%8DȜup;Î%'D>."['wH,;Ƶ(M qp{GM(tM#vr:GJ>,Le\ZpFŸ.?ޠЙqH&} ؚLۙDb?O4yZ vp b"}jn@`yNBd=򴖰}-"}2ͪG$?01S ק{@WVYDXh ;M2sB[h*$S c;ٶ9.^!5)[mS(eM5NOr~c V#߉([څ'z4 xl&=%R NOT{_V$X_4Y}L I~;tbF#%gHiltlGUc3 wG~TNfswkN_6C԰eA!}s8& ,hM .600Dı@k'G pm AA'u- p|MԉބBi2ml1TLؐϪmUvd[Xht.< @@~Dʗaih'q&ٍ%Kv|p $zi5`"zѸ6SRR>S@,x[xu%&l8:4d£k}:4hogy[M|u{hy,f~.'="vϦJ০Qs6Z>:IXʩnߝn]ہrҽtv-(F&F-^ۆZ;.汾chȉ-ZnCL!cAt#|lO_~0Iջp+Kġ gtQ.^1co3.9_蹩 [>i_ 0Jh6zw_{Z; Sx %?X!2,,!9Yh R 6SױJK.(B84LO̠`@'hSc4u:+ pˊ :4[Z*g`4Bش+Ndfy=lʻZ@T0٥mJ>)+ۮ>FU g Y8؉*lÒ4ceDY.ζN|} ׎N'Nxr>zVCO[y`ʴ50ɏXڶ Vrr0`58Ѱ|ԫ*o} Eq}p+'F{Om;X W?0 ocq*Y·tk~QPbTb_6eu&CL(KMIzŔYz%s[),?Ro42'`}.JE(`W1Sm cn*^hpc'DEqE^쮠sQUt.Y "=.H3` ߒ_ћ6e>;"9*!P/r ƋTHKQ 5,&Ǣ*#jޯkٔ}YS)1o-Ǥ4c]J6L#vaEQ+IHÁ+괒 Ɯh\ˈǛ&en\~P$zʕ32LfM.Lvۯh'Ǝa1[C:9sW1r&cӈJ?v^RD4I۰G븦jz32g \Pn')"VnrRw,ZIb,flCgIśO4#ָǕ7Jwm4GUU㓲|b@!Bvio~ς'n<=h^LZBJ!ՈHD0HIUn 5FNln 궡fJ[q2KD֜I>czjn`:LB*{| W5nZfCKϭ).gl=L&VLZ40w':O(jI֌8IMךr,2^`MA5M< tHjyYчā5(jBY:b|x!_NxQ5۾ =Os$I?I; "4PJ|BC~k_~F?ei0*)7*Thݷ`U /1d9vSI"YKE`xAt-Jo0V/ Y<\"=C$ ښj'c\sKw1g'Za>U]~fsK?c KҔٶ* RfZ!v>\"(is4_5Lv.Ρ?sh0T(Uq8ƷATcկNBģPD@SӴ]Hbk+vsi~aMǾOQQ Z7X|LzmT[OU$oԸvK> K (Za+^9eU{P0$BsaqybÚos A̛g0?"Gb$mKR4 l@)IX(,كԖ&:#tL(;M*žg(_<ېa^6Y"KGꖧ/|%taiʹrDEwza9Xթ KS?29 !o a."d,'²ž -cLY9Y<f&>jdp[,\YJܽ]yr5X揙zX8 C=Ss8Wk*+j .Ibw=t(φBXy/;1/kM9qI4q1#\2f?L dTp.'ېog&Zd\j& ;Eu.~SņHp)cªe%E8a҅Ң$wGR,1A%k_y<_ښ 3`HjT^nK Pj`eX_h1 UqkDϏ9V\Tp VgZ8k܃oH1P̧fߺ}`UPG'|ZZfⴏe)?Oگ.CTq;!PA E ۖ]z˔>qvJq &-toLnc4ZR3ZS#*9[]#-vi8,K*t Ӌ&@5KU W_`aa+!S 's+3恃!uJ3^h% +D=q]0%rt&mR'P քp~|az $2Kő=EY"_uڛ7n7,|5dRR֬[S?mS  v roo(`oGZ=h ccbaw ]bAZV݁d M9E(cYJV(VA2n zOD{fm}ztkPA懛D wm--I.!xѥzP# soa[-qhQ+MHDpDE͞!*,];.sUD.2$ ]L=t xiFb*^ؤB6oOV,3SkZoђSil9M݉sH-tG1G#-_ }g= ޯ|j F wG(QV71a yC-=%ksx4JBE<儜r y;n:#Vh~'lr7D7Q|Cc喕g#"q1/H[qP燅1'M@;b{g YA=XW 9OQZ"ް2arEXܑ9E~&Xxe2T<2xꝜl,poKX/ g_mpxƝkǫM,únaEo^n|/?0lY?q2ɏ&^M fkogCިƁg?c|-Yv@Y-Q~ac::w=g⡤$-$K0pIǬ]304,CXT>m?bL)5"ڠq+%1^zI6VjJx9a|ɇлЬe #t]bNo " LFkg78Bkږ Bn&s6j,r|e罼=vǶP/9^/0XnF r~"6{Ymf>dڨa(_ +A<"N.|x_&U[4vI t%F3iJ(b1 "A1 `<=R GPɺuD:"{ց`(: f5hGumxj6]4<,G!A: nj.ET"Q[Qscp:{|8 RseIӢ$v֌NdY' y߰vBd_JL DI@d'sG;G{aso%t2%{P(U\80ב%w"9ӺCqZWߡVE'FĘI_ g0lg9\Imol ^S`M92 1傃:; C\AKd#G8-[nz[>y;+9G]U=$iE:%hy\(ǒC'iv%lY}J&-SַN$ݓLf;*Wáz (>~K̵@\F:2جoW_I z0Nr gr>t=430Bg]FC﵅qJc_n?ymȟsǹ1d/KN3H<B4*uj'Q8 epG swXxSyJ(FeVnbR2HPB64R4YD5n-E1w]0b7i(vh/xLj#kOuX9\5dh*$F{L]7M22’Rx)$Or ޫKo  2 Ti;8Ek㉏wC4@R`;h:1X@ _lA0f12= z% ѓw*7*^ty^}_?-(鏨@y%{_ x xxҁ&gzΗWLIq9,&ȵcac49 @"ʯGly%73=SZ:?gJv`}QM%&IH1?otg^9ܽLFX=X@+R0wFu+1E3@Ylٳ&&?0  ;7p{7 iZW\5:0jd;yJ獤DP*s=>Xp;Ra6W[ʓ(zAX&P[qZ#R[z$<φsuxgsȝL鵟O@“IӅ;]e-72y9.ą(v#2Y> jpdDžUR`jvC1'zw+llȾ Eg}K;/򋈴D+0cHdWσx.BwFyϫ;;aRaZ#MJ5v(4{ۯӢxYsbK[*ݡ }d#0R>`3 lbaiuag+u †k(,޽Q,'| ݹ,G"*2/L${|)W=_lz_ cjR9 # m^bbRk`]**$_wX"e&-@Y_.4SQ7f?iŏ%׺xQeE%hCJsg3!ЅHHm`Ᏼ\BFp H ,2EEI @tELaW8! `҆n~xv`@Fv =|W2q Na$7[ipvhWi2qMȰD): Fƀi#bBrWcg"z|Wv!*< l:HylPy||Wfyzd)jOʼ& ! |9%dPB4r+hF?vV 9r1'| ‹uS@і*-Qƞ H\T8>O5ɑoPn.k"Kv|Pu sEpzGq{[4AwP&ӝg!_2 LwZêᮏ2Pfk"o +{0E/ۿNL˅^|ΙkrG3?VEġ9flJU èdw_.[;-A/u?RSrx >飁AJfϢ[`|7ӣ@`zq`9jRP@<ʇ]L#w?$c| "Hcʊ ,#rי(>&Jh7ڹ l܍&b"}2sW: Lz'Z<4!(8v'Я.\\)dC!ʘC%?O9R1C/u%LɽDgեvq]ؚ: cd&QvΓ1!b'LbY֒zŜ.W5 Er5 R_jIiԗh{Ij&x}*UyAH_0Μ>pҐKM*;wbJDGS T+P'ETsG*C TCiOV zoF\`HbQ釦RO*wٜpwj^ Z*=SIkK'~-r 0)Z{?}sM WtxOƌZ9:"/ rVگҳ .SX?8'uk}f$R5S6EfU38UShp@s{jsZ. cBwn#H> G%Z}}FK] !ʇ @ybѭPJ/b eRbY~1(7c`~!-Y3f7n6~2㽍"/Q_u>hU@ @ YL\)W|SVbTiom<Z9KJjĺzUac ]; ڼ0%d,\u- Tzߙ77 q,'-QؐS&a%TU,tEf ~O4KœqEaƐRSc^R=GߩQ{V'f+.`l]W>;.VGc9Sh- ApgTy{GLwԼnBzF %j?k1ȳYѲ40sR\׶G!@ZX`^*s8zΐ߫@->U~'%ѐ YRf>'fiKW;p>e4<Zli,~XW5pd" v,%0,F؆t%*؁?t8eI+GHPAehgGbE*d=HN e 48 ;ͽ+-4Z 2W`HIY4ͽO~g~5' VK++/EЌGaQٖ d:҂w&xaaʷ5x`YD4Y xҐZ~SOx,/D;rfY-+?Ck:ӔQm\f"& Cۛ1\ ,%Ul^@[{EPooI2{mupZ/.1(Z%Ui}CV1B<>-\T:^ EJBD((m]gKKeğjL::)ff@i\ Uz@l?mR D1[dZԍꓢs/6͛NnV%v/KD.Y<iQ-#{h 4t $<].&tߎ:8꺬^H eXЕb{mFȄ+|O>vmCE *P'4AShs3b^*&`&d2xTPvVϸYrs‡5-[ QBR&] x9 ӕ*S:gI=#Eh&Fr6|Ak-, *Gn3_.7ʚo[b`I!{zaINk3X6Da68Qh-dUj$;>(^;-?: 'Z$qlmlhN:>*(kO}r-Bu7J&>R`[V> +e=!i|^ġc8LDu{MpRG1\YL B*P]Xy^=qGq$Kw {Ntx/K4cOxk?R[߽P3SxK5~H W[̼1SɃ`[&YD& %RJ:qׁh&h4h^x!P$;3Ebp~ O[[A?h[luk*tZ]ѡá. ^B/oh:y1>3]٪ Ykp JsLԊBܝ2J`=N΃ 5)v`3GQOϨp!iC$xsAIkKRzg`qxI9݄r0IoJ6\BG1&nXn 'CޘN){\t>K>책fIV#GJvdE)bnhmsAI4铋D+<1?P w['V*Oګv$(0R*XM6PJ: 5`@=__U3﫮geӾ-@?86_+3莎vɞhAJ5c H$ӈ ,7XOq)|b0KP+LӤ'u\[#dəsBQg/Uj檵t2t}Y›L~wj_0 1,ZDDq(`M -3Rwȯk7Dz_'9=׼ :6` /[4v.morj׀brj.^b1?M؄"wm0ӊ!dO3ԕ؎%k^ VګϏ8^ 7!ӑj_m0!\h`,lzbgRJdOO5p +@_! (&eC$Sb!xB?%GkiS%!iIJli)^>|TJ7-5D9 C !AS@WN̯5:rL#E{Zc/o&IU4X^ĉ{%`ՇY{cTڛ+ _2[#1ۑ**p+/~eJJ޹*d:}q(<6u|$,Ij@o驸Rs\>)9B Fčrw @Az֘j>T lc/a7ձ7iדTI#u}ƳkgY $67'鍡̲[VW T;6Cst_!<=flLo["?Kjc7^&Gdi$ I/3HNij-|84ѺEEK?Ocg)M{\`?$ g]^l+{$Ֆ0Y\viho! e>vt^]>o_^lt%߭IDxHeWJ:Y3st72u#6}"?B{|!;p͒ں&8  *JL, "%u=fT?o LsPLlM É8VYhp=m =z04i}Өٝ1_+EHY7qW,oʫXsߚb76ic.{hխߗ. rUfeOR#|b^v+\d?Z,ڧ|BW窎Ym4h5gQhrE^ґv7 2&مGZF*oL# e1c&i& ht:fp⏨` }A"Et{qE3fu((R%m[JxEL-U%P_g_KRzYș|G-񸛿@x0 K'nTN~xz ~nL^bITaG05/U,+׬@VhQG Tarb٘ؽXt2谹Eɍimič&GZ1.-=6;ϙytdןc`ky5 Mi^w(yp%;ë븿? [ı t@EҒӚV=6WSX+!$SD2.?k(nk80( v5R|dU X(g Jc @j آ"%O鞽KeooN$[ǚ9,7t쟵K"qѺRsI,y \c6K3 #׬zTylК.rlhĐ sC`R܈(kwŠUVTi8ۈUP`S$ybSvRWވ_1:NwS.l giGW .KdTw Z_Y3&iXT>{+%mi:+\t'NPQ|{zL~*8lj$k|K v/E(O]ŒDk kLc)j| ,Q{ݤ-"}tHF~MJc DRw(9uA hyw/ӥN^Vw1Y,1&1ÄˊL۟>K\ɖ`4;Ԍp^TڃS+c!~w!ΫE'p̀tYA,OBVva0̭e ͦ B-WU ?rEKrX9Y]VUޟBJ=ʀPn|%:+ߣAiZ3Qns"#1j{r hz7ĕR3kviO7zvh@3̅ouFwG0CzuXsouBޥC%GHDgr]J3 e@WlK]0w\%+x̅fw7]:ż#8a̻ڜ.\=?#Fi a lXzf,ZLZ^]k" tz߃'hbA$ۘn 3߸*ݾJIu4#T+`P@]Pq1x+U/tsK,e3?}7 8|d`|\*~y}7CXR{ǚzCX/s]';E )ߔo~H)fmq悵ɴnQSMao gm0:^?N<p w i*=fi XJů=uU:Ws?F6/r#;$+4?j8ApE܊Wʰ&tS9Qz~y =X4pz*-8Xk%c4 U>WguۖX2?CF֚‰ O;hk%~[_ndJVzCdz"H( bo{(@gf{_-ϩ.jMV!xo&p](qV*$hUth1rޫmX*R #^-)[kJgT rjH4m!P]8s!ƬRN|,w0|# GBt1^*ݯi[:Rڨe)Y)n5(E BSp$K7q̘۠)7h~ӗdjKY&,㥬Ԏr =o#Z@Z#ٿs/w ˏ# ;u]!Z7hMc@ gFWfB~0i-0CD,x5s54e: Ȧ=^|H}Nӏj:8kQHjf2f}jUc`,mv_IDΡVϞYر'иIť8RQmz4 aJ+dр,3˲(щTt8DF)Z죔}W1j+LiȀ|`rc_H&sֳ*mZ+hWqӱ'AnH_٧""GugUqa8(L udxk&R^> zk _T/%0ïLn^2%*:a@Tl! `vLЅ%j*풣n*ÄZ(}ۄ^%7yz >VlY.7QxqXK:Z\˜d1j$4GO.GU:*'V@ݼ%Rk1[RՎ-]K2,3}4 Dop?UHSOGQD/pa$”^ZۚSM{:DDr`H%~[ǔ>gCx}D<*mJ){vG 7q_ii*T534,̣zu/’w#u1I4lw ]gԕcܿb ᄓO#{?Q#_wX,O2kO5*xCGkRYY5h898Z׸!] H"kwFGJpQxG[ ?G{#֢w&hmNpf”,:n㋗Wsa%BoWY⽏73[[#m.2]DB'Y/Aͬ>M)$&K4&~1ҬnthH[2ԓd<1Lfa cF0X/dX1|z̜e|"Xˡf8/L߀-2hv>zgX˚E">7~`'U\)d(9ԃD\ZPu$Hp )e'OavUpf64qV.GSe:6&-h}#T =3PϚ=/#Y:Sz|a|=qnLvzYUt~A:K9 >,3YÖשL+ڙUVٻ(damy܍ɬ>YC ;$ƺ"\D~u ]Z3ɥB C5 o>d(m2lX/}@+Hpi(S^<fKw>)C[-jXF?yTb6ɕNw0=|!H"è]J.!kX>&Cl6KDGotuxzw˴XKݬ5XE_p|X9"ʝvGAeGzfdCk7~[`Sr}-pP\!6r1I[IE.^ r(fB[b7uY$Q>S>ZU·$͘УG.nz-pW, DXԍ?fc)m+"gByy1SHP]Uٮ|HP)H"h%{.lm 5̼؂J@y9dx6n^aJ$quKhh2H\yǤ]35) o:`gL(_{zlh>wrܣ.r4l<PԸGY  eg||B~E}p[ :dX,JN6 CbB6?UXIEΎg?.Q/}oIjgf&9١J<ڔ])(Oŏs=5 $Mb37a"9@GڵA #~ H|YQ̿)VLbCu2zXrz{ho~nrtL NE1Z%Ѯ|WG m'uJx|t^{:suM}u d PB~<ġ'C JdȲ_e7i5չ,c۵13!Iza;$fI$|@Zuͫ+M{p,¦vi,Kc*jRaS)Bfb4`#eQHRωlu6z8xF7bd=4 \*]ۤxDhK/2^X[%B\-tWd؎(ʆiHɭ joѓ)ǡ1c,ݬ/=8Zk^:i{ҹaYǬL1J~4[IDy`;ljϰrMW馱^V &H@&Z( N rMe"plVCNo7R_iy@l)}drF`R|\#z69 &#.cέN 8_f [W*eT1b&7jCԲcxIt>9\Ck9,Ÿ]K+gϝ(~,/g* ݭ4`wζ;ilD]d5A,A|ac{|= 1"(fONM Ir0ЎtЎ!}~-3<n#F dGBPRElcU\ #u>y#MJ*C30x'"[l~.<+#|^$# v0$Μb@L [t+nXJ!,$(uz}>ֽe14 ia1S/4;"]bfsH /v*ޛʺ=$?z!joΜ~Y}Vzo8՛_ጸ/ So hMi}s^cBʥz3a:c'1%λ$z}䈛C뀞IAU. D5ߢ=N{PvW6:+` (ɳ;kO6'\w91A^MNfᑵ24qqA 8Et+InF.HцPog, NiKa 9or43?0;*s6c6 G=}fgtnwg_,4G{89+LEǥljAKX;5'L]h0 ?fQ^uvq"+L,5/RI~O /Ѣs@PluGN#o}Bbڃʴ$O=TF{ q},}2KtŒFxk0d 1﷟}GwNpL`qti'jzZVR/9&oVON9;L=G_B]i,FeDQ>=)o+TR?;$LCw5c~  ϸ.d4c k'}}+[[KǑ,\\Vi\L'kǰPH3T*kru\cDsnRAGA<'fEiҨ<¨{_@0-;fdg%Xm'm;:%&51w&3#𞓼Pbr'()l3w2-_TI H:Y272sw^D}c۱5l y3昖+FhMaAz6p^OrY!HMCƼA{J/KLeU?|nE|忺Q GIǾ4*뼜1֚ۗ G qĀ ǍWfʆ!O !;fé\6`UY|I~l7Äe6zݘʄ3j 0!x=gt V`'(O3t'P)RrR^P.t'itevK.DػCYLX j2ۊ搴*v g^KL=c^ʃ Wh`<XeKpWԢ8[ٴ:RSgvrypPQ~mᒐT 4{lESU ]EP>1h]ˬ('MLۗT ~$COUB %S!zzּ 3a jD觋 _QQaW|Tnz(-NT isp5<_8 EqH9V=nmQf[t:U.eYX̜u XD=wyIyHz_/37N/q=%R9R<1\h"hA*QDQ2.; ^T\պ:EN!f-+Am]; 7n *͡Bb9ؗ㤀 '$m0#KAJW?:E b;LefIC=zB1|qJ[av:*?8=z.ćM$s-l- N|cZ"NMa"(<+^+Yl)]E*4*e@(G8 ?ѓpGJTo]xg#ZgSDICNCH*If\FT'O8IFV?KMQ6o)vC^MSUrbUtG@:r!GD2d{xlըh{| m/S2}hMNȠndC E z.:[fUa `OBO  fc(J0АBi1<(b=S9}sCVZ6Odĺa@\e&BjTՑ6$qnhT}7ɥ5DR-#ɍ!*Hk#ARSz_g‘ޔz/ _"ڋꁩ_n|۟'1cqI7Ewc&fʞ26@TG)nn (io79'2H,FZח? D$NIShZzˇܧQ(nU xzQ D6]E[QU7?5mI?@>kHJ:G^9TRBLo|bS:C&pˇdy8gܲ[Yg]Vcm/9 ^,MdhJX*-<ޞcwDA:%}ѽ>+<wk21W*wِdI8ڱ%ujgc?%z 8Ф!DC}1߰|`ϊ& VZN0RNY))dǂM[ܩkRmE;!yB.[ϿS\X;j<;/4ܷ!?aw}SHdS(=: ~``2ԗ'(gh~+ +{HZ/(;I` QS/HojY?2 (a4ղn w&@~9/*T~$v<9 kļϴp{^:KAPROd+mD̠w,Iݳ3_iOW[Q'i]EJ9sgc s8S/a*HH* -J O Z,zw.qߧ\xoQAk<&C9o'ː^HV~j |%@FEջ^hhν`,~${ #rїUi"ܜZ׎2Dd9F M/lJ+ϊ5:aMS0`m#LpaN_|/Cҕiq{Ny<(zf/c-cM5{I >Wk`6yf1^X>D)K @ vmhal 6Ÿ7d)s(>t ~%`K;MlM&!c+ȁd@@CڒÅ9FJ{W<:[gTVR.o_1 3㤩-+)G] †nr/b3 b«^@%#_j_)D;j0\:a[)XիL^;NG$oI8"Z _yh j j1VBuv7)EZ7Q $"Htj&@@0ֶ֢|'|3Z;*W^tThZE(4O\<[FVOv+9c q>WsuEI&)?Lcyq PT}:NS6.MCGQz>8s EQBOZ92ObЦU䌘1&|͜^nCnPS 0@tҲU@$!{?Oit!K-^hM\CHmS~E }N)*=تŸ,]d;īzB0Xy.ߢ~~3(mdt;4 o##?pzCkDhQ:L#%z":b.IzNNt:` 8^`\s6L560&GdQY5`I3qKZm1C|!@D:3Y 㬩pN9 Xn:{I$O"t/õi ,=@lYQɇFfml^k$덜w[ b,1 |aϛ֧fͰy,X (ҝuN $ևz$#U$11xr)VB9}u7._\a9^|sa2_ W=MIZF-C*Y漅*sih)m‘Fd/H bUŔcEjh t0b`Ehc)/WĀbVP%Rͨ=(XUݓ .(Sm= .'iʚߚ?R@BfG&Nc`!ʶ 4uvjEJmHKbA:eTO )r`{epw$%7%gweB&khjAnFa0i ڒ׿3w,2B?zS#RِdGԯ6@sj&ctP)hv!$93+wHzkŚJ 05Dwt2i;${hNĨKY5MmƑ=uIBfW$qK}oQp\`ik)ջev{6>fjXDI#O*p$4SХab_z'ɦ=N琽̰^aԳ/ެ'=$@BCzQ#@L Y a4tIZ.^KúV}XX; 3}ֳI{!2pQ$Lj޷/W:ͤeD|#"6md?R؆UfUDrXD=cMb)!|DžK#&);>fUetŚ_ o6Eצ2ɴ4 H>z€a+I$(>{@>J _ wqO[PuTYP\f|ץ0iE\h`JJe]i#6dq5!࿯P#0^ʣ y<˔O%_!U>?>jH  [ybe,m n]kujWpF4xv!ֵC/u߼݅4w}nG5`!"6Y1߉b:y}w=ǍooLxMH.2# B!iib!!:InGBꟀ4i:]B:SgNfcj*Uk,k~KfmZ*ùkTҐK?sJD3jN}o^mH$`,B5\I7aɨx'N:>npM@C83 ѦV\/ cY:m9cd-efٺ!yʜF 0\]Muv֥ڱan9PIlq-+?蛈pٗYYOylCEiϪ d5r-KrZҰַ7#3@t@VqAn3L'?* ׋VshȨy]PIn:hZzFcCC|' iDWm-%۬X'jåJ^/T]8J$b߸qk,Y"bQcrGS~Csa10 #*ͳ[iG0eRwoxTJ5A) )LɳKwY+~"pr(ږe ͠tvoaӭNʜ(E0'44ld ^U`.2̓ e[iJ64oy)s {ÕI 9DsBL 3`47pdJ [lA\ZM (GyIvL:}D\dCo7cAbN-HB)Odkk54O*yn&2֦akfhPv%|r8XV\A@L-WTD-!`@:v7b'[Y5s()8ńv5 ԛ Uˑ+dT!s ػ^ c[|S9C̺1`^C}m7n?JJuco-#u&]զv4Y$tL_|Qh%M$:9@ru"G0)L U sEi;"ky*pMz(hWG>2H" 0\}f@Gܕ,HxoW)@wpڣT7Э:m PW<:搾kׂ-$`1%lkWX*h0SkD^Ȍ:- r( !TH/J,YqDB41N O-DjDAք8v 9JK̓ԝxGGi 30,;zXF{ I3U[ ⿦mvِKBoqgNn"+W4{ԪvHꃷ4:Qħ݁X8rbp"^VkTjYe95s]l!Á3>Qo/Z"ITXXg(`n^'/|i1ʓݞws̤%@bmqn5P5;ƣ%t̽>&kZ~X[o_ (co-#4fWrϢ6'9S?uT1m&|[i«ݕ]q7){8gv7wQgih-:2}oX B%.2`{tBLEE]$y1S^hPZQOn(# $h *7 h}>@ 9'|%GnL76Owg5p~rP +c's$2qԄ\/}>S݈ cjxm忐G }g_fX,Φl_CވYr Ӭ1*9RЙwˬ mkBXX.[Wg$ r{}<.×kzP.yIZuG1$9d(:)=4#"h\qlx~mt9]͗xpuB;Np.mYV>-n86m~`Zy/N d !o$^|}ʨ>lꠍ5TpXuRìΠcLx5fdmFc9B?@Xu<+ke* zGg=07,gsatT%r U=`:knճUIRuP2tc,x|aл14+2 YE4dUoo]eyF ;"π #~DTAN72xq'v؅2b4O4'x\K<ߏyvb"ǥEޖؤPoZ&i2\YFՖӼu7 =0I;=ZPu"T6N(K,Um /n&>"Ss nGxE g#:z!f睛%Zô)m1R鮍2 + cxb)w~17 1E!|ց_7k]? vK[SV 9Sı= ܞhq.n־Ma\5hOΌsG!CM/6r#r@>=?&.&AOLCcla!HGb7TF_VQI(b\b= ,O۫RO%>d>;^p-b;.1[(=/hYXV@iRnwZ?Ie ucAo`\Jb*胛c!SN:'}FrS@h{tBMiI+Cq;iUT^mC%\Ocv1c:(fi&jwY[t *U3Șf^UUua[ 9_F%F*GQׄ]HRm\j󥽿;؝Ec\^`:d}Yq~_cIba&♧>~t8CB76be,7[ҪxV^Uo)Sc"';cu*!&x ۝}gEVr%$o'$^AhDzù4R˹пm냂Cj&a9w+!O5 =<~#"(b >.e\Cɒ!gi97v >9~ɚZ쪚0g{+"c|EF:GS}cYN#.HFo}_9M6>LCPQF^M"L8\ YS7D/э$!~tR|K'CB, UWhֵ㦵3;C\t^R 7}yi;1=^%ϞPs(=LT\*p(v""qﱴ6bp)ΐQ#$vGX0;"jW_I \#8$|#BhN:,ߑ$yA98xrI T;GJ/L1;2 ڕ'SG<㨚ֿpw0L2w"O5KX"}N1͙ Ǹ8/DvC;{tx.!./M<9_w43`pQ=s.c̛ڥ3zcVv D}GxI`ӂ{,Pf%kWy#y)Tl*MgӶN|Ȯԫtw!A= *HmK ]wˆ}Ea\:I@U;oeswq.= d=)?j<=ƞdQ+"Fl`9qlLf  - C#fcWbuu%x=FC:%Wf\rCQH^F*q/X|McFLgcE1lT^8ރp~|p>iNDg:ZD@wbc8ktz9ä4RuB@su 4 }BEūE+Ruɴe@B @鶔T;RUjC2gӍl6;}XB՘^;{aJ}KO[N_ٮmA #TCy/NKxQ"寥c|WO1INJ kQY^K[RjdCօaflov+!Vn1-"pCb|G9-=Y!\T6r!mlQDJ$n"BkcB79=j〷ϗZ Ocsltc~J4L#^B3e`qFn•,+4ڣ1|̼D0FtYZ[uXt*{X.vvy=DPFGʵ!g{mXJ m35(m`*i #7_AHU.S< <Όs=$YBԓ@ENߦxC6-9dJ lu0"sWU1M)$px.yhH>m2Ӑxn]Ԍai|O'R9/6WhޯG<\u0'E9ղ <,};WF,]*#rp [`~\mI7%\UD 5 ӆuItɦ'ۏ"<u=suUxf':nqL2,%U.WYV?Odz\#Df{;FSC"/-.NNjB ͹bs׭6J,eT pQ27#P .~ ?6( y!ilCї_g,GQ._VԦՐYLsIP7 b ruvTr|$g$cQ-٨Vx KFQ6*߄<}k켅.=?h=nW*6+ҔmPOkcev}GAw:b|XBu6B`%\ds끒ePpO"4FOB(dkJ՛{iPmv SA R+[!S(/5C4&pxiֲٜ+ҫF@[Ŧ]dJR0|| c=]|iuCNL0|^y⤍\ge?ܖ0-hޅZ8C0kX6 5be`mX8^@(Jݍʣq֫Xdaۼ.۷"`!1٥5ͳӦ\?Bɟ4YU@Կ[1{QM+9,(/3RG.Qw[%:tfڃt m ޺rbp"|]Js>5D鰱,DRR]-ws_U5/g%owGCs[ny٭^TԝDLjEKb<ۤ$K:F^lO<Ǽ=L?Cԝ0Xw#0Ds~OOt%#pPBMOG :m?¡؛Ee3'C{H KdJ|3ĵIJZK~OkTP]xfb#"LèOȾ4UUTĕ-Xp5: VX saM05xX|; M>_`X Dz b~^o\g{m|:׻.Hﲱub>{kTq]XA2e@ 4ҙާap`RZNU]sF߬O#Z: O)f{Sv5oO=k8R rNgtfHSƨ:PpJ .!#ִF5%BYn~\aaI)=(Kpί!\ޯ6Rq%@֬}X9w@߾ϒЙ"rwqĦ[b\P7&e @a Z0N_X qmmfkUWA3]-#Z^(s|h.! 5SU$*\x rHsBVl%3-LQj'-wV=:y>z&$&/-R};˻"acGM@b%r? j Jְ(#2_kF|RLʳ'To!||WShJ|xj.^ܶUfB[ꌊnhh)B&({ug\hsWgBL€% sSCWuhUHXJفۯLdl~}v_y Qт FG&o 5/ae,!:2ىgw֨Ci"='XN/۟2 8NI· ƃ)A2E1&\jk ,_jru@쏪P6~`GDۦ_VXO`.(ndF S-equhxqDQjU;o IW/m4u=W lBϭ?}dsvsL{7"@^yQ:|N˺6+7 28 D2?5n[w#K~Sp"h<2AMF ݾݤXkBIn 6e1͢+Z?,c^&cC:[rR3%l &d6Op"u6J1  HVr)(m] A@MW䶇za7 b | *x9M',v>uT\֫-i*dN|pig O犰3W<6NX<~󊻡:7-\DUPHj6mrwy)EYE'7Դ&\.覡[H;$Q#K5L&;q:-YlVQe8Fǚi&`MpzJ>.LiOQ^WLDj>* }cVVrAĻԽpT9ꇦ*BӠ|Dh,ɂ2lKW