samba-winbind-4.15.13+git.636.53d93c5b9d6-150400.3.23.1 >  A d!|p9|O %*} q@#bǟSw \YIC*C !eRȂl}I>Jt#c$#ZV~bw. xp*&?jBeOՔto<ś[+ <{zyWq] BB%XQ[5uշ]L,y8hOoQ5FN"zB") :6}3S-ԂWek%%ҫ>>nY |>pLr?rd, : R *07),X z     P8|D9((::8:D 9>l :P" =eF>eN?eV@e^BefFezGeHeIfXf,Yf<Zf[f\f]g ^hbi@cidjiejnfjqljsujvj wnxn`ynzqrr r9rXrhrnrCsamba-winbind4.15.13+git.636.53d93c5b9d6150400.3.23.1Winbind Daemon and ToolThis is the winbind-daemon and the wbinfo-tool.d!Lsheep05SUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Productivity/Networking/Sambahttps://www.samba.org/linuxx86_64# we need this group for squid (ntlmauth) # read access to /var/lib/samba/winbindd_privileged getent group winbind >/dev/null || groupadd -r winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in winbind.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi/sbin/ldconfig if test ${1:-0} -eq 1; then ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-down.d/55-samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/if-up.d/55-samba-winbindd else for if_case in if-down.d if-up.d; do test -h /etc/sysconfig/network/${if_case}/samba-winbindd || \ continue rm -f /etc/sysconfig/network/${if_case}/samba-winbindd ln -fs /etc/sysconfig/network/scripts/samba-winbindd /etc/sysconfig/network/${if_case}/55-samba-winbindd done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in winbind.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi [ -z "${TRANSACTIONAL_UPDATE}" -a -x /usr/bin/systemd-tmpfiles ] && /usr/bin/systemd-tmpfiles --create samba.conf || : PNAME=samba SUBPNAME=-winbind SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable winbind.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop winbind.service ) || : fi/sbin/ldconfig if [ $1 -eq 0 ]; then /usr/sbin/pam-config --delete --winbind if [ -x /usr/sbin/nscd ]; then /usr/sbin/nscd -i passwd /usr/sbin/nscd -i group fi fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in winbind.service ; do sysv_service="${service%.*}" rm "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart winbind.service ) || : fi fi<r9ȸ%8J^큤큤AAd! d! d! d! d! d!d!d!d! d!d! d!d!d!d! d!d!dbd95eb7e0d1e8c973d39fb53be9be46276b21bcacd8b0ae1adeeb63651f6fbea676af835bac5e037fd6f6d9950ea49ff3f39bc693d479069190927c1c53083993a1caa0988f1da58a965d7a954f36d791af7b63f8f4d458a49b7b48dedc7909dc494eebf5621f9f0c007a945579cf91579fd3492ef5bc6fd6ea54c0b9ebc11eced46060987522f2085816a533fd2f6105fd9c4982a9e696ccc0445039adb03948c787a47c3127f9c5fdde2848eeac71a06e22cbf997c132d74ada549c086e0db2064b9d9d5622ec2d9c18b908b167bf35e27bbf3289a04954f9fe1077506c989a16eb3e6b8e2bf0b1ee56f8a98e8ed307633badc5f3c02d8a82a4293ea474391838ee3e84b90bf9f6ca9758f730d52ff979b705ac602bea873eddad470da257145aebc40d5a45423500e4e61cfb96488120424008011a58967d0ca69dd764fb6ade7e1998514d24f6ebb763d17aab67ece7cdbc7b0f5fdfb76e96bb6f0bfe74c6b4b0325dd3211474ac785379683cc4e7f17e211327fb9d536c1ff9138de03eservice@@rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootwinbindsamba-4.15.13+git.636.53d93c5b9d6-150400.3.23.1.src.rpmconfig(samba-winbind)samba-client:/usr/sbin/winbinddsamba-winbindsamba-winbind(x86-64)@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /bin/bash/bin/sh/bin/sh/bin/sh/bin/sh/sbin/ldconfig/sbin/ldconfig/usr/sbin/groupaddconfig(samba-winbind)coreutilslibMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libc.so.6(GLIBC_2.8)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.2()(64bit)libndr.so.2(NDR_0.0.1)(64bit)libndr.so.2(NDR_0.0.4)(64bit)libndr.so.2(NDR_0.2.0)(64bit)libnpa-tstream-samba4.so()(64bit)libnpa-tstream-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2.5)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.14)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.21)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.13)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)libwinbind-client-samba4.so()(64bit)libwinbind-client-samba4.so(SAMBA_4.15.13_GIT.636.53D93C5B9D6150400.3.23.1_SUSE_OS15.0_X86_64)(64bit)pam-configrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)samba-clientsamba-winbind-libs4.15.13+git.636.53d93c5b9d6-150400.3.23.13.0.4-14.6.0-14.0-15.2-14.15.13+git.636.53d93c5b9d64.15.13+git.636.53d93c5b9d64.14.3dJc@cS@ccR@cctc5cM@b@b@b@ba@banopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). - CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). - CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485).- Prevent use after free of messaging_ctdb_fde_ev structs; (bso#15293); (bsc#1207416).- CVE-2022-38023 Additional patches for the PDC role's netlogon server; (bso#15240); (bsc#1206504);- CVE-2021-20251: samba: Bad password count not incremented atomically; (bso#14611); (bsc#1206546).- Update to 4.15.13 * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); (bsc#1205385); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); (bsc#1205386); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); (bsc#1206504); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists- Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689);- Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254)- Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- CVE-2022-1615: Do not ignore errors in random number generation; (bso#15103); (bsc#1202976); - CVE-2022-32743: Implement validated dnsHostName write rights; (bso#14833); (bsc#1202803);- Fix Use after free when iterating smbd_server_connection->connections after tree disconnect failure; (bso#15128); (bsc#1200102).- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- Update to 4.15.3 * Recursive directory delete with veto files is broken in 4.15.0; (bso#14878); * A directory containing dangling symlinks cannot be deleted by SMB2 alone when they are the only entry in the directory; (bso#14879); * SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used uninitialized in rmdir_internals(); (bso#14892); * MaxQueryDuration not honoured in Samba AD DC LDAP; (bso#14694); * The CVE-2020-25717 username map [script] advice has undesired side effects for the local nt token; (bso#14901); (bsc#1192849); * User with multiple spaces (eg FredNurk) become un-deletable; (bso#14902); * Avoid storing NTTIME_THAW (-2) as value on disk; (bso#14127); * smbXsrv_client_global record validation leads to crash if existing record points at non-existing process; (bso#14882); * Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call; (bso#14890); * Samba process doesn't log to logfile; (bso#14897); * set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert; (bso#14907); * Kerberos authentication on standalone server in MIT realm broken; (bso#14922); * Segmentation fault when joining the domain; (bso#14923); * Support for ROLE_IPA_DC is incomplete; (bso#14903); * rpcclient cannot connect to ncacn_ip_tcp services anymore; (bso#14767); * winexe crashes since 4.15.0 after popt parsing; (bso#14893); * net ads status -P broken in a clustered environment; (bso#14908); * Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before smbd_smb2_ioctl_send; (bso#14788); * winbindd doesn't start when "allow trusted domains" is off; (bso#14899); * smbclient login without password using '-N' fails with NT_STATUS_INVALID_PARAMETER on Samba AD DC; (bso#14883); * A schannel client incorrectly detects a downgrade connecting to an AES only server; (bso#14912); * Possible null pointer dereference in winbind; (bso#14921); * Fix -k legacy option for client tools like smbclient, rpcclient, net, etc.; (bso#14846); * Add Debian 11 CI bootstrap support; (bso#14872); * Crash in recycle_unlink_internal(); (bso#14888);- Fix dependency problem upgrading from libndr0 to libndr2 and from libsamba-credentials0 to libsamba-credentials1; (bsc#1192684);- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899); - Update to 4.15.2 * CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication; (bso#12444); (bsc#1014440); * CVE-2020-25717: A user on the domain can become root on domain members; (bso#14556); (bsc#1192284); * CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC; (bso#14558); (bsc#1192246); * CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets; (bso#14561); (bsc#1192247); * CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid); (bso#14557); (bsc#1192505); * CVE-2020-25722: Samba AD DC did not do suffienct access and conformance checking of data stored; (bso#14564); (bsc#1192283); * CVE-2021-3738: Use after free in Samba AD DC RPC server; (bso#14468); (bsc#1192215); * CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability; (bso#14875); (bsc#1192214); - Update to 4.15.1 * vfs_shadow_copy2: core dump in make_relative_path; (bso#14682); * Log clutter from filename_convert_internal; (bso#14685); * MacOSX compilation fixes; (bso#14862); * rodc_rwdc test flaps; (bso#14868); * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal; (bso#14642); * Python ldb.msg_diff() memory handling failure; (bso#14836); * "in" operator on ldb.Message is case sensitive; (bso#14845); * Release LDB 2.4.1 for Samba 4.15.1; (bso#14848); * samldb_krbtgtnumber_available() looks for incorrect string; (bso#14854); * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED; (bso#14871); * Allow special chars like "@" in samAccountName when generating the salt; (bso#14874); * Correctly ignore comments in CTDB public addresses file; (bso#14826); * Fix transit path validation; (bso#12998); * Fix that child winbindd logs to log.winbindd instead of log.wb-; (bso#14852); * SMB3 cancel requests should only include the MID together with AsyncID when AES-128-GMAC is used; (bso#14855); * Prepare to operate with MIT krb5 >= 1.20; (bso#14870); * Heimdal prefers RC4 over AES for machine accounts; (bso#14864);- Enable samba-tool without ad dc.- Adjust spec to use pam macros; (bsc#1191046).- Adjust spec for size * allow some Recommends instead Requires to be configured for cifs-utils, samba-libs-python3 & samba-gpupdate; (bsc#1182847). * remove fam, undocumented and unneeded.- Add missing build dependency on bison when building with the embedded Heimdal Kerberos- Update to 4.15.0 * Removed SMB development dialects SMB2_22, SMB2_24 and SMB3_10 * VFS layer modernized. * Add the ability to set allow/deny lists for zone transfer clients in Bind DLZ plugin * Server multi-channel support no longer experimental * Improved command line user experience, unifying the options in different commands * Winbindd no longer scans trusted domains on startup and will use enterprise principals by default. * The net utility is now able to support the offline domain join feature * New options for 'samba-tool dns zoneoptions' for aging control and to mark old records as static or dynamic * DNS tombstones are now deleted as appropriate and use a consistent timestamp format * The 'samba-tool dns update' command validates and rejects now malformed IPv4 and IPv6 addresses * The 'samba-tool domain backup' command correctly takes out locks against concurrent modification during backup when using the LMDB backend * TruACL support has been removed * NIS support has been removed- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh/bin/sh/bin/sh/bin/shsamba-gplv3-winbindsheep05 1679921740 4.15.13+git.636.53d93c5b9d6-150400.3.23.14.15.13+git.636.53d93c5b9d6-150400.3.23.14.15.13+git.636.53d93c5b9d6-150400.3.23.14.15.13+git.636.53d93c5b9d6 samba-winbindpam_winbind.conf55-samba-winbindd55-samba-winbinddsamba-winbinddntlm_authwbinfowinbind.servicercwinbindwinbinddsysconfig.samba-winbindntlm_auth.1.gzwbinfo.1.gzwinbindd.8.gzwinbind.xmlkrb5rcachewinbindd_privileged/etc/logrotate.d//etc/security//etc/sysconfig/network/if-down.d//etc/sysconfig/network/if-up.d//etc/sysconfig/network/scripts//usr/bin//usr/lib/systemd/system//usr/sbin//usr/share/fillup-templates//usr/share/man/man1//usr/share/man/man8//usr/share/omc/svcinfo.d//var/cache//var/lib/samba/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:27938/SUSE_SLE-15-SP4_Update/2f12d28eecd566408b18037108163da1-samba.SUSE_SLE-15-SP4_Updatecpioxz5x86_64-suse-linux ASCII textemptyBourne-Again shell script, ASCII text executableELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=1008ba55808f240d8fa64d7e838aeacf8fa62fa0, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=fce232482a66f45da710e9bf02db61c6d3957ffd, for GNU/Linux 3.2.0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=402d6a88722ad32b9d75201416b7878dbce0397e, for GNU/Linux 3.2.0, strippedUTF-8 Unicode texttroff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)XML 1.0 document, ASCII textdirectory5Q4RRsR9R6RWRRiRRR_RR4RuR2RaRcR!R]R}RRoRR[RRRRRRmRrR R3R8RZRnRhR`RtRRlRR\RbRR^RR1RR|R5RRVRRRYR2R_R!RWRmR}RRRRRRRR[RR RlRRRZR1R^R|RVRXRRRRyRURWRqR0R$R4RkR?R_RYRsR;R]RR7R6RR*RcR!RRGR.R RIRRaRRRRRRRRAR}RwR RCReR2R,RR(RoRR&R9R=RRQRPROR[RiRuRMRERKR{RRRRRRRRSRgRmRNR RR#R'RRfRTRZRhRHR RrR R>R`RxRFR+R-RR:R)RlRbRRRJRBR@RzRjRRR^R%RdR/R\RtRLRRDRR8R3R1RnRRpRvR|R)p0s2 8(ނi 3dU= Ϣ,wS(>`uBěhjcwC<Vj˩ 0 N"X:A(sːcjnMV<g\`/eɻEwvmv LŴKi V rYENERC"5濮;-VL0y[GO}v6©iI$w[UG鞃(Qfk-vw7+Z>Љgqo3Ա0*ձ-mV.v |`F P 6`8a7[ЂeBY&*,/JWȚ*@:SxSAp%C=!l)vO:ev;oKҲ-\~DGh2]V5wk7M*|?ӷzFtI݇;Tb濾*F̌'~ZJQ 7G?ă/4(h;핛J"TQXUրo]d!{Eۨ#|9:J%exOlBVw7:MI}T#c )ȽB 5 xiA$_eW@r=k&(6Y`J4˵+0K(_Qd̉F!RERe 0gx&DKK=:<;7@p@:?e]4 OD{{mY9LҏzCGk}.?M4-.?qm BX+^-6&P}sΕd<N\SriaN "ba Q#y64hG&DEP+X5*KRo~T*:3Q8GN c[Gm?AY=?fa_t'le ׻Iy.ݚT}'ke*r}TW58&!su fk.ߕ̫ KQB#Yz{`?-7P+-;{q%j%&\<:};yZc߷:`:S~z )@Kx`/:]0Pؖ;A>U2f>Ѣ+aɞ2=3/Hzѣfi:lcw`S2'IFݞ 85b!jjO$pD -hm}Ub`h>L@ej7>o`иe Y2m^R%<{X>\CaVm} }Ҕ|"1 T͠|gddPaN(qq/@F N 脁.'9%=RV[,^_IPmjxlvDTJߨr! Vh sDN yFkZZʣh>w̻ xKW#., cr4k f!ɺGڲ0a2O+M-@Z}/`6r`i19k3Ndl(L2fZ70&ICHb@o'GPEnH:8XTvOQDsj b̗ }Y UzSb'O l# V"l/;L)mr3r 6\p!%:#qCBl28Bfi%2*;aз>NYNd52~b!2sq2űƟ˥SONTzHz0@X;m0YrW`t eJ\K)3> ްK5}@+qCa.YRkaw9u_Ni .zsrVb.,J~Pb2w ڿ=E6 ǓM5DS/FM~*P X_ h<:ɯ3lB}\!#Nj ()m,6xM$VAZi|V)c9bE\03y4G^\P;)+Y1@ ԼM83G dX!hn5|X^hw3%w]B}u,  #NpyqHG}_%Tjǒg?Р v&~x\M`65yG(qzv|Szٍ|SB{*Tn\Uq`!ݹ-s"4b*[ Uod U<㭠, s(lA\f݆s! s}6>l3BrjHzMn;K$2 T p{ bO5& Z4p<]_g!$.K+ kDsӠtk\uoz-{Bd%#o֣zE1/ߠ&}|+#,Dgq+g-&,#xlБJbe18?$TeA5( .bAb7DoGjt8ӃA܌A0?F HX|M^+aw%MNꗆJK{:_czs)7$9u ׹⤄[Qq@{uE0{%{5n\/zd& vPFwF ;f ߤLiNT4~_i, "Qv:Ju` c~7nJ?}l6&*rQǓ29q _SLqkP"WD|4,7+f#5ur<HAdKm|uUr2tD"JZR"R:o#؃J] ر[%z.uwhigܩV.ʃۭZ%5nU.M4#L&ϑbW6b`RV4tigfXSV.A-`٤j157i4Rع$!S ?-Gpx@G% s!J Fi' uXFk+0NPb6&Ε Gۊݛo~W]F_J\[2pZXQR§Cj!Zmag\zzz :ݲlUw#Jn&?x1LSOwR6(yp#چ>|)ϯЋ[upkSכ"Y ۬e)ǹ#<]bj2<^O8"gk겨 Tcڢ:LŵAi>j~3޽Au0Z #+!7ʫB3z녠mkfsPB6VU Mxj3]K͛^ũTsi\Q}i4 Ƞj]eI3_f%n2jpBXH㽐S#*foB9U+7,}TyiڵRg"GWC3Xa~#UbnpS.2rXۭeqxcOs%d,Xw w|ydySL 3$: *90ne ڤudyI"&igbbn=C˥]q>7գ:ۆx>=_x[ W"=zvb8MCG7f~V>с? fM|eHK.qF a?^{;~ 8 Xrze9X@<&6ҸJKY0SKϼ!=}=Āri{B $m\ki7'c!ݩk a -O)!PB4׵}<^&*Y&d&:m\7SceXvv,x(C߿b&F:\TlhJ&]Ta; 1'3F7Kq:m!μ yF.cIJnbfMb+i2o!%aC|5LjATTY0+5[;¢m,C4cxhu*sD!"i;D$?5UvV B q$/PzAՅ%HYVR'$ Hd"h[% h [f/]Ĕ\Yľ۸iN`Q(7edfs@$8_D}ssRWx֖qHSD&PwqKJpۺYQni2 h+ O5 c kJۨMv.8ǙsE+4eY`h}/xq%y v`54ܪ98Tp6ɖ;F'X&xbSF$q<Ǫg"fCAA* A;opsXw釫prO=©myȌ.jV7uRw#";ӽD1thl)EyB9? ?&dCpZJZ0 QJ^pf/? ?~$Ifd% }*TP?HL\_,وc C(jBzT/,;ԣhPMpi2HkG">K AEV QvǴrZ<81 Mt w,!2ǣ<Aih"S~n{ͲzMͲ8)ŴJW.eP4>Wh~ !Ѕ3B@sŠ3QHD9NG H i2/$Q wz#Q^ M~ 2qz,'A{WK&ʪ7R4WA^f a\gSٜqDs54 <T~Vw'"%֛ s B*/y!WwG-zmRT3q &;.34M9z) 5,beJ]QX+`utl4!ܑbBNh0`ߣ&5|Si*L^QzT3J `^ZXBMmh?6=tb׋;O| 0=`c rU.VY*?װ >a;uIbCK]^͆°Ȓ[q(_ *:GӺ +k0MY^_9oͪ>3D -_pK[-;rMxGmpя.I8H+MS(L[(bMٳ}/1ث}}Kh jv7Y(*{C2&o3S>ˁA]? 4; j]IXw{-q[g4SG5C )X4 G ٲ Ub?8j ˝!s5csFէ a4 TYr]^ȄǝOs0 ;F..2vp,e}yr FmTՍ\v)'[\YfL49yjΝ1[h(MHaUc_`S Xo$L.[L`yx/1i[)>q8nr͟@o|wMȮh-Q`e;]JGTwٰyKh7F=`nj?ױaoyHbD|Ml&.^6l|dkܒL6k|Ɖڕ= Qv^xр#b211C0ESx# ]O\՘}Х63I {.jX"dg֠E4gTt\RMosso*+}.Í1|6mp57i?|SĈS `M7w1deg!>Btu䩉T\Ru 9]LPA?%N1"h^5 (V!TN}Mf C̎)ob`?.8 *Jũv\V*ykʭJ8j6]4`O(ʞ]oyӼx3.u BDC|97,+l51`{=Kfھ/c1b8I6q]0NgYh)'o7Eսk\D!r,;ʜ@D',*6d0t4*,77IUI]=##,~2p_l&@XhI# ~~Р)nrF毌=?jTA̫:2:,@.Li*XIwXD>!A3`!fP%L3G=vJPtJo?ߴɤ~Ў%tql|A88Yw:eDu9gĬ>q T(EwqV* !B[bVHyБ_?D( A"X*?L L#3'ƟRX#4`S2[v&=WFJPIF)cz*[;aB׷ zcĴb (cE5<-HNZWekƞ3z0Y+DRQ TmWau!0! !R%cKx#b1R'1 Co3@,3}˓0k^lmi y_&[A]zA3л nQr]b0m.oW>`96a/(S|:fGZBcOEڤ6P圅2@ rBPp^ (I@t?7*AuYvr V@'tg'I$$@S̍,z1[ ]Qʦ3-UͩQ@y&Ѿ?76NF?M5vȷDK\,ۛ"p V$?9K.5Q@Ou[kϼi];{iC!f\;>'Gk&ԈMJ~>*g·u`h"1Q.6H+xRͲſmQ Xæ9Y`;A2.}YBri[,/TgEr*UmܨKXм:FnY%#~_70lƲ J:mU.Cq>;.mhNJ?9W,dPuMHB"džڻ؝K/|5b  yؐf3dJ]@$R)$8ZU-;nJx[SMFSq"9a!:+ʧ`MEKkMd)`X{ K>7JOC;XLO$2`ũ6Y9kڇgcqY:}/٘!h&,٥DOԇ6DSߩ}Ryw>\( $*ahv:42mOeNHG8=צЮBOQcXr:Rn|-k%hW􌅱PUVBU5Ha=R1jي8x,k⺗$f.d47D|U)\OC\D7ݲo/R0ۅjoճ ?af8<$l/_ǚIxcI۠`fXB7 (X\8 O^8.zܳ͹rR`,P@qF`-&k r:g^ $mK/mor+ ǵ<Ȧnr/YPh^uAZ"Aa9%hwx)VQ&.0[YyW.i 4yʈjGcmpbH|e}*VSTm赈gw78w8֗Ì6uU%paX&)iS$j*{AET~s7 8<:5O' `.]ֻRp&QQQ>`E$b  &!{P @04?2ٴgU#6vpk{ik^5Ј00{̥V`CA;|k5y ۜ!n?o1Ш=G {” Dk:N$Rԇ]Ib?ȣ-_oZw_nlilnuYc*>Ul$MGBz$X 7g؏H);\2Sk>?ݙ2d4`T؉/:Ff_ۻnȘ[1n}-=3!$4WϜ+9rEYmVj,K(_ip<y]Bv]6ELv#P-SN\Y/J#t#+c}߰GY=J"Z?ҋpV4}\}ߘ!D9'l%vHQͩߨ rA.~&L")inxq Y)t'*yџ\GfTa9&>9vbogzD7;*8̥(ٮ:q8SLʗZNjXjoItRΆS[Ю6y.)y!MĎ01=z'5N?̣ƏJ%Ըǜ6yfd" ٱL <\~*(PfJ g?09˴,fift)yy;РUK:-dǯfivb,W.K,ͮ57t>rlvًܹ˛3|bHv"&NgA9$䚈Q(Nu*]Z*f+9lYVwk'f+o-^T G9^Z-}G3JF/>Ŷd5L>/0`䑧(JHjp6rxNE[ժ H2$=ۤJkTsvDdpd-Rj͢J醇e.j`pauNǞPU_Gw8`h`jղ:$;.jڌ_hkGQW9v+3x&K$dV08rkȅ& G7XOb[D@C̞ .`$:H ^r't1N@ǖɧ)E!Qe5ݲ:$o/'s=n()4Z ՛ %۝&rCV ߔMt{Óo]U )IRF$/#,*͆ݼb|%Y`u/DDF;uHCK[1m fGtRQ;~їtyR9CGrh1T3rH,ޝ^9Qb2K""¶L{y0wd76~kU0_m}%4H<6ESnZ>fXjqK}iEj!m/mޤ٫5]>b÷aax@hҨbٵ~ q+y(Gz}bc7~l.QHqgQʠxh7-"⃧]`,ťfJ&&~'|5REJ ّ^*Xյ@#`] )!j:}Sf$?J#A3I;.P P76`%>ưTJa)M5&.\1;zlk{pcTR9$ib4TIucFܼW{\&t$=6Yr~bAEcLiXYz$3 >6bXHD ~nZ+b>Gr@zׇۏqM p?g W' 'm⎟S<Ӻ\~i)?7 eu8ǴbPl<KeH ۿNt.@%d-(PC[-ܥEr;+%=➳]^gC ۺ?"8x<=laBik?*:D,2 \;W)Yp2.7%{T m`rndd9 I ٞDqܯ8$^\p 8Ru]O/޶ V؅]#.B,HZ)8%b?[Ss%WBzԜX=PGFe^vܸ!:Zdb]$-kT#9HB3N?>mӝBW7#ӚDBpw'CPRz| u=Y;2WN19y" }䤎߭'daى.Bĺ[a#DS'8.NHYu8߄BݙwKjυUl2m`Gn!]K8z8Z<*cUς [ ̋fjM;q=+e6KO/( !T֢jLm+mFG s9_B%RcpEdMԟRcVX Cb4џ˱J b>pģ( +7r/6y^*ӷk__a{暸O yZK4!Y.ܚ.zN uc9FuŚ%6FKTe.L5ӝ%}մȹd#xi]6]zݹrn'3w:ɻ]?NKʕXE t/ Wl5q[=k%q:lBnFz$)8,g#uSȞ[TEX*v WttP\m'hb$!LYHT**5!ǂU D 4Ԑy4̇?Aap:Z_0X:.k2,)+eܑm^ jnc1UAW<4MKp!(C!)>¹ʢOoM K/r\.rteB# FQقJW܇,~eN#ϫG5Nj[ةb.`̏Xxr*BI[Wt)"MQ.af~Xs.o?˟շ`4 .]ܦXLm vgKZ6+Ukm6;zD)گgBۡ8~ tx#T#ݠr(55CN߽-;? i۾4.Mlmyu.휀-C P,lK(FuTRs(kg"h!Vĸ )7&'GI*۹7`ATyDh:21ʺfn&x~&0M6xp2VSu8N[=6a'Wwi%_RJ.HiA֧Y~hfr36#&H6.7. FgDV,c!ZVX@:9 V(grO[Ʈk;=.OJ ii{I͊*vD5.D_ɕ{Pk57bGP\1@@bVF]n&xO9yEPPiy]ln2I%רֲu}}:FF:>y\o.K+.\!ŵ$ȲM|dx}(lG]A#em]@S(Y#fmENB\(j~-Zt?BYUih7U% -r :V h9#gĄ1 5p Zw~qi<).pd>PPd2)=`dKKSR Xj-^Ou.cQA>y{h~l8**@V.s>[̟Zzft 0LQ{EDW+0%G^W= qǮZ>)oRf#|eUࡸo AKfʵ.OuEc$ϒ^lvܿ^DO5H})e6:!]T1Btz0;S؀ ĉfCǤ%3tp:+TknqO)f3d #j+F)w[u^c!Xb1lj{q 83!Vdr#YPPUKW*H0>zp8()JwAG B2 7BB[=^2d6n?%}z~(;a(JC -_w3gB1M7GG)ȑ.RZ1==؞eJԵHd7'oHbJ/Jn/i7xũĚ8G0Rߊ$XxIMF3@T ܛjxpv`+G""`%ZBڕ3G O=SP1"ay+F0% T| Ii$k+b5}#v(P金8a yr{f2 ' LjIAk%׈ Ew.g^vO%j.K_'on<li$^ɢn14~u:>4v8!L| KwQH{b\%)4躳xr1֘p_2 QʔIRmB]4Eyu`Zj3Cn՛`_4r@mk1‚맵\ S10^GxGdqOAB~l@Pڌ"lAou?}&xpy#2Я@d]Pb<!cu݌ٵVuH K~ܽΊnncR?+{sʺzc 9@FI# (Kai=-^ F,(9൙VzCl! [VoH#dY$g(xzC2 :"@Eѡ(i54e(Bj. ֐[S] iū=@l%_agJ2s^2T_ܜ&4NxՈ~t 4Lψ{SBS7T wFm"y/hf F &Ob}r&hka A"0)Du{@7{.maiEj]JН)Z";8㹨ʴMF7凪_5*ogy&7ÒX+Co-)ʟFJ]?މ_jaӪdgأI&e8|gU-@m30֠u;09vivS*ɍh=<'ټ^ob%-&KT0bˁhƊ.i&ɝ*q"[AmIj0?x&,wo0>=q)I\'^f&gˈF#Vq]L|y7Oi)XbgYlCgdNE1Nɖ UgIl;~WՌX3ؓ=G'M(2i!2ฝ #Q9UϕFNfZ*9ȩL#r啨:K3?0NwpjPDpO!\.zVV)"3dΖ<+Pň(e93:Y2%xPkLIDvtJa8U 7Ȟi#w0F{!~4`nM!-IT!,J\ aweӛ&%YhCs\ ݜev7 6h}vA\-f&6i`$<Ed.,=Py[]%wIHT>5rU fA`?X.3UUWЁp-|:bn}O=: ӧJ+ $k`^)y] _hu_6$ w*sPRX"H>L\:T$O9)ԙA33o!T<$4jfnhHAg]ҳ[ٌ0hQ3v`E1MKwť,5氼' eZ@I?wFB Q_iy^-Jam&«52p6})kT_oiN|i'aX+0>*u>N oL*>u58'?0v맾jAZд*5NT^H㴷t]9\b:>^^!\4B^vbJ|tq-Um'?ZOF!^PX-NZ4$2vMlHk䒉P'iko,*hgʊ27hV2Z]#Ṛק rtW^ ${)_ƞ00[~:`Y~0\r ]GU.6Z“Hu<3av(Z=:̿CV&@Kٰ2CDYb^FC}o27Ouү:qҒU1=$B%fq>(7P &e:0)/^+~*H @bUgsNdh-,(ypB4"Yt%O޸^1|څ>`▂'󓸭xiZ+k~Ti sI/|M8G0 !oeN*3~B2Ay5U8(ߦȰ9?Nl7O?'F$!U,O`ޠ~;Gv3on\_*ݚ=kdHr@vz5 e,~<([޾à(`*D|aok-U <$zD1x %oّT;0P̔lomcִ;>>15ȈR;jhƾ%#˲h&u/0Жyߺf;375,%R ſ$HC(NgpRlg vͼwmmzuBЕTo67)sIq++~o=]V!l`Z$<t`7 *elK؏RDGXo,5@ogukV!aj%Zc;w cLrօhڨ=L2զ(+QImXdƦ6L^RY~9/ohh;&_/zlm2Iq䟙p5L9/4>@M Z6XTrdL^@zXY;՞:09SIK; tuy#nYGI5 SDo_n\Yi|% uËIz1e IO:ӜekH=iUgx<Ht1+2IKPdA,Ģw}oM7PXCD-F:UJwmvguofTkU[}V C!OEԣswΛhYhACZ%Ϙ|ʸ.If?I?9N[TI؄W( l!oo4V6طD}Bc2C1{`p٦9t$VV0]mfVǯAb^Y#iwjٗ\ ̱>1n[v &YH0~7'qӟDyS)1Z_Xg12BXgVƑM//M 2 !dv½> -,ZXʈFr4.Y?!Hj:[!jw4o&?^`tuUc{L&S/+qPl &'<ʗ#UL݉Ѱ]䐃,'7 ~.Ae/'kOқqۮMj6'+"AUB4Zf1"2ۨ"yP8n(tTFyCjqp(v`Lq qDݕmc|'aR8J4/SLAi0Uٗy;6ቸ=E49sr_^JؽC1ւӐ ·&O^ҥ(OѧD= a@쎺k1?#HxoxKsղ .9S|;s>./cmzf;n0Ȯ>H۝MZcřŭ\SGl=6R nU09&CYl,i `3盖H1jN/R祜^0!0E 3,_NZ0Bcu:l<ʷ~'7д+oTZٰq9ƭx,$'Bb^l7Tj&B2SRQ2G2irZ>݌Hjw]`g+k}GtO>pO2E!/9-tڐT.Yي(SZElVD$(\_W0N|yklC<}LsOꔎVwQ.,!wܥ#_<*E- `Nk|\3ػR&;'~z= Rjh,P1ݖΓ9OBK:]nTe G,-qC6q pS=w #59"lm kF~T= М{& VEaU~xr?v=~`K)]|?I9ӊI-]JXDiM}emٝ0dY`w;~Ix3e~ AӍ;maqWn6+ W k~?ˠl< 6v BGEfTQ՛`BN hLy"͈zzwJʴo3.&A7X,.Hd ToV )K(5"o E# n{$o Z䅳$Up=џ>F:2X!%i$]Jh֥:rI&;ԹMϔ&@9)7y_/Xv%agW9&_5od.ryLe#NOh5^Zn!_3䵱cdpJ; HϚ$ZNҞ-~{o`(( 2+~/'צGfYMBǦ&"),ijr8y~| 9oAXbfX5冑IXC d#>Zlvըe7k÷x NE5vc4vyrAmjA0K{ذn$!7tFOo}diOQt h&|TX;Z,>/qm~TZ1Mm$Uy]F:g*oz̲QYp%*6J?>ox-$'l`n;i>KjIX~seOu9L7[K4. |5͝[;,d|}(^Jo3jGV1M΋CC|C[])6σ{EMX js9=P,SC(ؘX"Ôko>QtjKENtK [b]Mpcqӻ-?JA7>-)0u\U ,R} }Kg:N,(#IJ'3JaӘ^l^͘(Ksp;p N ɦUBo:XwcA}' w!Lg\7B3 t0Ί`9ύOKY 0Wsmrh.Y#>_'*B-RU`LZ$}}M>9̼pR.TDhp؛,K  `uY>0T w#Ek̸Ϧ} -ؗ/CN m/Z׳yv)Tc1‡R"8_(Ⱥ )NՃF:<$mԎ q:f D"w`*6`` 'fқ1H /jwtΥ'ɿa2xIgfiByݣR/.GD]d,k ci#i-^X)1O&ri}Skpz?b@mE{P6H̵ .#J.1#:@'ܡ/I(bɻZ%ZH7sPܴ\-@*3OoTFǬ@-ATSQo9ܶla鉴<`̡`;Ƥ:(2kK/Bm0`RbV-X/ @t,jGIZdn:ZbSfXaBI||Ͳ.+q$d="O'GB(?SV ]};gP|HQgԹg)zrٷf lо-0S?J;[xxsf}=`7SП>t+] >->oɪVۋo a:tw1fH죿ЇbBf?_{\!cyIHhȚЭ\/K Qr8 G9\_I (5b̩f (6OF>xdѫYk-$4SwRC*D㯷0!0:Ӗ!Mtص]#1qL=EO[ސ.|uOLk_2Z:lCpp~\T$|)[,M;=7ִE† X#٠g +h߭?}|Aڞef[ `pQl<41ֿopݝՂT2NaGj\*A$u[2ʼ/cKi+}F ?r{u샪Mi-"vLQSa6V꺾30Ci ZەHvoYdwCH\XP페X\# 5%xOti*C1!=Q]s +\X_̋ ቖ2݋%ijvS OH}ϝq[(!"16Ll Å>Wdh .i'ATuZAzz(kX2'޶ N3,~}D3̛L1C>R"*Xl)A.| O-3E%pJ4ύ(A>EJe](yRu;;*t,,eҕ<~Gn}'$ߣ)d0WũO'xw|D? \S5A}YmYWIӾ+1*Qcu sO"3vOj1w\'Ȅ@'#M(f UPGcc<Gk|q51F~G6 %B<dZg@E ZIH}9ڥU?@mhoz|\gZ |8Di[Ł2ɪs`g@4Un TVS8gj`k l[cр'i 8<ږ}:IMs]p2N7*[̗>౾mMcG}t9F_3݂eKfK҈00oW̾|_ :=1m Pw!U,8br:R?ў,Xbd@fwۙ$`Cj3'BW654teX3 EP^3 kJɡk[z/ɑ?F)EvY pʪIA)Ys99gxN#ڝ@5ˈJg1lTHv1'3bYtiT_qG-G`;йAc 9ݚH=w kmV)N' u)Z{,oΟqCt /+l ~t8k0zDpkڽ{TlvhDkd$6 ;pR%~ai?nځ xI9A*VjM}r:Z.ݣcރR=Nj!b7H>u[_]7UByvA7AN yB )Ps5/#>oG~˷M<5̶\@9T.9u]h;J7_=gU#>41pG'L S?ۊ_P\gc&eudm~KVSRlP1ч-LmQA{_매"o!n;:@I%B$NpV146gv6Gjn@j}l\2 Ia$w11+žH3_ZPRǸT2h[\$qPv-N[;lĿ[|SlO*V0%ΫOrp ƍzTFLܽ<^Ea'$*Z3!>9QFy8]w!z31}aA .\Ԧ4﨏E:˛P-UI/l楌6 c:2xll؄;ӅCK^iONG pa"=6!*pbG*\^RB;p}fb+6bDXd/'>THjo 1: &NBGQ$i={wTgDBTۓ` kѷ6MBr5ɺ<^ia-(0@P2k n̮T@[?䷖N'zM^h_n#2*+d% CĮ)O 9VT-2Ovy"+_c?q&IR%U(fook>8Gqt0^"# rŽJy'c<1^4.z+Gs 䳔a đ;{`bG_?LP ,wI,]QV9M!9jY0JRTq&Bhm =KqV{8Vt.>G퍸X{XXmzVmIR]]ڴɔtk1f.o1{T_" Q25*26pc`dC"!k*jG-_S z@M?-E.gw 9-Ƴ*4)&/;-*j{X"v=9~ 3_f3d8(BI,7N{g[>iiO+'/2{0PYK'(/f̖shm U}kXa[~? |͕Nfϊ#:wuanusn\]{{_s9}ޞ$.j_;Amg!ie g.!Զwy 'o0 Lq7e̙'p\miiQArUe4}e!~n"!$^w" ]R| ]׃θ%#U-?Mu0u@zpN-NYϥ;2t'asT*#P` dѤl\f?l⎳i=`vl|&A<z~akYS0w:&f{_JL"Q[ȃ,T;evk8Gߤ Q !POvM'3 XU3mgӚԙq92qYR*9v̼lT&'Fw>AU}M1p&xEx5 /H|9*ZF<[Gpo[@]~rM̉f3-$to) 7 pۻ~5;gVt'n)x_t Ew0hv͐ 3+tk>Ʉ2>rb9DFTjVQu:]_=duB0]tyM6J.ORܥ-F:od;W@K" DOϽXyOC% [ [+\x&MF+&.<ˤNdQ[Z2;b4Z؈q^vkI یrM$+!.$Ŧ3l|aHJn/tӠDƂ' `Bj8^>$D|\r,ߵ-KjDRNJ@>bH73d+7@Z29lk)ʇi)mv̧D#8g㯩]gVP2lEK ns9Ǹwyd$Jh;׏҆U5Y =+^7<)) ) X}}Noe #4]Jnܲ1k] hw4ZB,<آQoCCOl~V4p&yglh HA<]w7 A{3k 8Af,Hy{v u:>R1nhP[Ud1DݱWKuO?&D-zǩG˕my(q \ i9ǖ{Zj %rci1.3SU&T.2 4 =(jq =K 8ӓ:qEK\)ڔ~/nUiD# 8{xH5O>@F"%Vjfj̆Sgt2 1&H,8 +(|@sX>F#3˚$ԏ>i>jXaM *`!.}`&  <=]9&mw׹/v0%a@A}y~Sf~kk1/5Sh yYY`N#)>JFaIt9x続8Te\∰Fy,́x˄Ez- "7leD:5S?/9xOǗ1JB֯*1mqj9k7 12j[oAUf]rWNRKO(!bk> gӱv&GDvyB._&\n~7eIø86ǣU3GtS0܆rS7-Y)>N]I ey9 2ns&xH<b2B̼v{AWvhJYkLaÈ@gz]ZZݴvz }Ďj3 0>JFR:ӿRz&̯ي?ࢳ=\w x'YZ:+^waO~Z%1q/Vo]m"^|8|ҤwY6*GxS̲ MEa,*p4a5BV(s(!Zhi@ŪZKۜYyu~,%n/PEi)ZFZD_5,9*z\R' BA]gܵ.JW^U[ XbLS'_tv&<[R^lu0~ :4KVⲈ@{]N~D; 7 XQH"A(= Y^k|8cTI~pH&^vO7br)^ FC[/[IP&ދa1 ۞zk,+~^`jQķ#Dӌ==Tb!6мmuK뿽]J1 [ppؖK*j^lFS#'wG`Ԫ. 70cjka_dyiA&6+j^[/0r1zaNi:QWwXo7Pt* H+I?.S&ʭ9)Y& uUB Z$լĖA F 5rYv^P%mucMˇ}15L$P+jГWBݾ ykZ6]W7'Sݘ "%4˳HKSdS #c-|$-Dzu* b}Z~3qs @t  ;kSx6 >89.i@ܩ<ꃥXr*rP(Wpڅ~ 0Q0`M[no-ų-s-PTƍk4Vst^z}< pa/ۻƯaؚ64ya\)KS^@/H^lG 9b\V:y牴IdtpY -OdwOd,YQdUxs\nΤT3'~L'0 ]$E}4'G! B$OBFym> uϻ#:w%<2Y+A?|c/I+`rlJ= nv=gjmA(J4dx{JT-B٬LgxN n&yڵV3)kKbr@džs^-}C[יIH*^fADOr QJIV/Iu*a m KddCgVVw~: D̺d7wsGAo"9\@4P<@@4Oy&;=^m&m$*2zWvHhs(sq?bڨw3yk8udIN+DcL?^g]2Ee-F.bVoQ 6FX"J$9Baͩit^ZOܭ1&oeRPt4!Bc"2ZߒG5(rL>)@qbб@RyZi *A`n?@ &|v_1gW,"T]-B~C&'>VOg9YgZjwFPV m^.$c V8/`MB;ȟ0sZ}[x;n P9- y%H>k8׼wHA6kQ "`^[d[xGimΒ4vOXw9$&g-T'Q4`{zG\e1RrLXqc\O|yWx 0v۹&Zv*5aiZ(Y6v̯aZ׻@Osuj:7 p6C~},؋?/ŌDAGs*  #9)`19: ;ccCCKAt WtCLot.D hI+(kr=u/e:@ynT 4ӄy+4Fn&~1IÓwXz}_-@'p']a4a "S4 )et Y5w%8V( x,Ed\yQ𘫘-.e>F΂$O*~\*$Hf[T'-u/R^4S5H ,G^諭~sZEOF?; {1]HNuT5,"!둗knYhei&gfԙTx0o=]1w{JcaʬeCip }H g t$-c08}Z|EȯsJGZ@< Kٛ,G֣Vc 'Qfa*W8 y7\{(vzlL'o,QF^-اCۃ8Ʀ.D讘IԖ4"V`-,oq]s䄉>/aH鹓sjDDrO&XmD^en\2nhK :IAO "ΥMW9 bJ0bk^n5! %?ȣOH.r3AWP;zؾr=yX v*",^ʦm=^I{7@LyY=DFz0b:}*~RFԗ[7^x?yȅitJT1ίS\fFD&Ɉmca'q3j!OQ],Z2S7 ´lj MXvnpu@*K${CA}>il .eeTL;+ZKywݮ^TNl5h'vZ_| UD}>NE|+7.$ :MX ZtHM,S2|kU|oA"x!([P 9E\iiW{߃| x cӴl;J$j,8n}kh'k/ s KT&y hɉ}8%I?HfNbAo"x!L{84D*ᒯ&Y{&= Niå`<#ٹm+2j HY y绛4|b|OxEDU4Yp%Θ:raG=&7m[^?G1(f*ڐ:w?y3# >^|^*zf3&G*Hwo5-`;#Xb?D{V,c #9ˌKGS%6%K[JLvАv|Ԏ*"3k|]kjp+ĩ SV5 RB`FqY٪s5 "zV8ri5 b1z™r vK`"ȶ["BxX%QH /g3?YuSl΄dz9|4a芓2sGW f2p%[&ȿ*¿;DZSsF2XXl:(4[ߊ8kF MYs\fz*und$LSc_؊ʟ ې9K݈Xa\K8<45Y?{~_Iti\w#=yaLT`(t{/^LG;V!MSoC0:5֏dv["F'@}b᎖梏qDEoL ,b1ӎhHS**8a<1 sK3 l/ Hmkߚ%-+ͯ)T8:Ь{qD ӄ&&ȱDa4~$ftD_FtrLK8&mz9H^ڊGᑳeC ]e3-@(M$P(Zr;V0?<.nyH'v'pMn Gs곾m$q_Ahh })ID^Fdvnjd,GGBnXo08`2 g|^&B%s$0X#$ C=`WI"ڞaWj@f2w/eod0,AaCh6kG\^5-߭7q@|@d[ta)*&ӽ".Faj|^$EʺyJ06ʓA ; a>[Lɘ)'.LJ(:dٷrX[y8!L|0OޘeI/Ws{淎/} /q^0[(!\YbozBWnyeY.Qxo5 (. cn8VרB`|eSAȳ_~5#_k m~W R,M(>*1zR醑%;:*ђV`6W6~!ئ\r,W7$yoH, \Ej[VJ4I_B)" \V*1o~ViF8RYJ p*uRzS1&(18@;PmKL!t|J8stQ)?Ӌn5}ޔ[' fۗ C9udڲ9pW.YlLpyMh/FPpF+b4UWI@Õ-$q @?끶E2py Mƌ쇪f9[팔W>VA`B0=noYې_p4' [Y+31~,ŀ%6D i+E+ Z7?2D>71! 0e|ka(#-@q0."sz}c.? b ս]v<(BB\ߪvhrRu;.C*nIu%3Xl׼ R*DԣmKh%{0{lʶC?eR >,&{zU("e`!hcew";#ԅi7Xb̈32Ajq>['xL8e:9yMV(}TL0Ynȣ4bh12 &D~8:AR'YSgmAbk,w4Μ:7?xmtnfKAi=6]Y=^`rn|^w]T%O3}54QrI)s3y.pT+EdeOlL&1ۊg`#6[0 nZLl>*!~1nSm \rXLpl8d=[0jI|APEMRRh' T^z؊ s؎1rs@7V'?q\r;k->C.txӄ3EzI!Z@ñ҉=Yn\N =̭؞,ThW'` Xyf:4/ 0 #jZmufJv/%ݰ*+[NYsM<)r 4trsDﳅ pyqF/U6z.X+ŕ4lF d}/)҆=r>q1 JkTtM^ g%7o7`BHEJKD1"r|x\#t;BUo]5Dr^_kqѫűFÐ5#jEkcҌRkC #O ؝k[NϧE E=X{5}wVTC8.K^AR<.qE}C6n *_Gl w0>>atbMdR{6t{Xt*GHzW_"-)mՑw16ՌRUop ,ޞj_gʌ tlY88< ̇ɕ/QjM/3xyo=GrQsy@-Ջ/|@UfW|ܐ&nR">uQ${ptC)@@ͨ iUԱwOgoLZ#&9,2.FX$vvNr'BO㋏FWE<4y/Oc lyKM1 ` }rJ(B~!.,K{sNʡϔ?0.9S ;C_M9䒭O%F#BۙqCZv"Ҕڙ t6E 1d1[ۿ?H2T;oJ(S"dNvbIŒ]' 9ObdOR/9(Qc(#4P`j!jP ։I}f鑺m7}ɚz|m\ywAj.a!rMfZ2a\`gȐqLADgbyWdX(b⎣5eeM\\EɊVUhHhH"aPKgK${<])d[& ?'i8 W >hHCً0G~jVCc/;%ضQsBFgKr~Ԗ&|YN&;HF}+%`l)){dܴ!/fh-*e A#/4]3ۥ(v/K$ H8s1r&򬣾 h5 UX B>/?=fUGM uMPT &8{dvz=l\`<Vc(# EÚʖat?+ܴ+@KH풹20δɜɟ^BdrјE=ߟ&4͹O⤳c-MW6[۾sTY'6n;ypS !?rlMRĠ'l ɘZ֮EP"f~9,40ߦ{-խ5myA &'ޅ/qI90!?}%Gb|7Wj=z=uKW6*G/IU1kL>zmX> s-ΉƬ} jĝ[S\4Y{vLĄC<.eU"x&ުK# vt 0 KeH4]@?tN |J6Ff\!B *O`4mC("t 0j{P:-tZnb&m득 -NpIhLOҕOVݕÚG!m;|}*;myԵTSI#.Ƭ@߬+!bH|8&R̔u,'>,"0ٸA;j*DQמ DNT1F+D;M7zy^Έ`5rj3OM0"EܶŎoΙfM'ZnxȽQC7e *Ll&KrJoUu(4+D/B(v5/O%T &y)PFt{Qj(\ aꏷ62d]{Gt;㳻^!/a(5,yu/W[sO)宺 dd1$,n!X7LBϢN\iAn. N[*s\˻h I!{a_)3XfHvCm3@ry=s=|Ox k:F艖}k>Zs`=!G,~$ǥ1@p%QF/f_ʻ u"nBVcG gwǖ J0<\0_9hA=Sq3ѿ00M"UH?jN}mNb;4D:1?~`yVk^M|HIFTcј&4!`CSYD9׫joy1 77̓2vy2D-SO⍠rH RaBS̹SPX {Ԅ'43yR"x޲O4ऄk mN@ |`se rcV&hk#)Ќ'\h9Rd3Aq9hի0M+M5bNj[o˻L V5gdm\om%=׾!br1J-[L 3arNIʽ+lˤsA EmsY> G[¦4.iph5gAnT)1vnycBU (kG|e0mj#v]AI,du_Xüc]NtL +eɪKKo;{CIpQ Xqjyn4e`NVghTw,QK L,!D~aꅧsu./[218GP0jTE=olfYwU|@,pQxFx qoM觖i [DB?6"wfLbJ9j~G.ǍI%aʎoDrhėRMotz6OI\NʲPEP+<'q~ag 4d"hR]8#,R1ȝoЙɼYn=~Q_I"ǔ.$_&?b1"oK\Q&fI!T#i|8 &Ή7TS$L#&gE9Yrig @ᖂ/L0_F27')HSf`~6en-#b-JxQ07$rp0HE;${OHԪ:!vPrYMۯe W#y> t T'-ż{-%M{[ Xǣ-4ZM~%!xZ[Hpٴɜz5QDnswu& ²`t%ҌytEʬh nEtm@V HWOȆƊ4HttZ32rnnggHgm8a8s~OuhX4;es{Q6fH`^1ƚU[l\7~RwPMA~Lk7_ |VG,wʒ!9j6q:; E6iRBȤ}_I!eriq/3p˜YFDOa ǀ| \ɺ{qG\JZ c0ܹG{pd1q3vVw 0OmQ8 Uʵ浫?W ~Ļ.b 씿v CJ\m os@s"u+֮dDFne^!#9#-ܖ'O\?T 9 WyH~:J-<~(7smcw:RᭅM7n6:9h˭>Bi*a G?qHō0;VOc7C}9HlR4+\:F)w^ \mLL=rAGHaEbI$i^ojb'`Y>Wy T.pWQTKPU7x"uZ(eh{a"\J+u&C!E 7͍L ^$Pf/׋p{jg FH NrKg2,o,v!UI!+i*bKpUZ ){K# p:׭q8Xs(X/'?`.Lh[>: zjxy9T3m,Gp8tSov$zg7Q&ڍM _FQSʱ &Z[Щu0Qfa_etg(@w4/٥%kJ߆0bk\ᶳxěwqEO┾7@(68F1IC\1{12R c/WdMagH6WWk5|S"dS)TҔH6"JPPUQ%nWk2R + &F7 qcUOb1reC9yg0JoI͎p/(lRRmJZ|J7wtnYyආ.b*УQxݗD0Ͷ|4慙ߵfH*f{h/fp Lm޶qwj'[ 7z_(JubV WYݕadLsK &Ʈh͠_@";(f 6^,tΏw0tϦ+j \, 'QQQT%EȵHP7XF;ڍRfoaEJZaڮ _6 LeUwb 3m^duG`'snVit'irJAbЉfaG(!|EӁL> $= e;ykdEFV>&5IHߝFqDJb%ĵC^R:@ ElQjjVÕҤi#Mi49RBK1QT#x+bWq /8_ _Cj&(" J0y CWE_2C ;[oʝ6-?w܉ޯl&8AkeT \mQʛzڊp>R.`KǸ٭x}<,A23e  gJDpc\98LR}_oIDk߸%C}Sk$h_2`E~f6qKoUh-3t??<9jz;P2Ǎ87 n"71l"'*mEqJS6f,=?_d>_4*vh*v UQ ábcE͏fһ{Z)B7@|-tށD5/`˿ 9JH3tZ锵>u\j# G;[uMݗr6ٔݯ ҵ~|Oi#}bȏ)pVB[,%ky֎ Tɔž,ˏc{+ DPB"{=m]3x#ܫFQRHO\&󢨀K]c:a~ѿ/ǚ9SAwEvPY~ɶk~邺x@MEzW7amJKKPU/FDt^h]±J~z!wmЌ3*frL}C_$79NړU]}~fV6-bv27. ܻˮ(Q{%5zz `n(-lPCS#EêaF{9#R?4fc_3k'NQvyVY\? M!7/G@c)}&%t%}>9?g\b/Bfz&Oӿ0?N)S$U;~LBS;].?_mv*>cBC"߬~ݣ#8bp8 g^9& & ѱywy:Kt. !Ea`(`˒LjDSc~]3< JJ0Qs[INwjˈV(9JNޠˤJN4ݫڠ]:poС-{c j\F54>&Z{D/T":i~m]bhC2؏)S}Rk~ u+&$TF̂YZMba8״X[:bo0}=E6B1!g[al5Z)"D+pȝ(sR?0Zs;6;I9Y̞, lp5WGWoRnȩS>M?zK/v5Rw.Տ>Z; -*3yW(i <K-b(XɲjyA/b% =7?bbqQmƤ756] ɨ.F e^.XaË%:R1]GU3 чI} 4΍yT˰g 蔫U.)VPĉw;P#M`$ <ǞJD"3[uqr9&8ftcAvV8VRg"_%ƃ8Gbo|U-ڊp$tE y{mn !|<?r7q&]W3KӢn ’3@y(giVa[1(r56X-Iߠ=jSlĸ&iCQGH|[,+"n5]\?^ G CbxkZ6ץQN!g} Tک5ɹPCGxV&=7-1C9u\` !ȑN[0 y4ijn|*;muhƒݡ/lgF6WI8ï#znp5.+>N`!2!1J 3fryU:TMsP3%ksh޿p(0$6NJ U8C﹆h͏A2見mJc,͈E&AUC31d (fVPyu6NIn=6D鋇O($>5|)Ҳ`'RӶb!@7Ulovq//ކ8\Q߮JD&7[ÀS ʊE uNLtν)[dWiGRRcoQ)FEk8d c-6GkѵTݳTS( "ƕe?OOe}~#ܪ76,EuD<,.Ds Tr48HN&a$!e{т{DB7~}K/$/.A^7>s_v4AU-Gty=RjK" h=V;> sylZAlz6WUFDZca{.gsdrd.¦ϵ< <UKvy¶%a`|2=#`GVcy{aRyԭE+H.؟ntoiW4y7\FX* VjzZO2&LUٷ|j;"OOyLHZiqi|C &(:v%" 𰸚[CH|ߔA6K*"] ]'͑cRS;_;Q|r_pF);Xtq>kgH7m7;EvC|ҳQOZpɮ3ɉ 9hI㽽m3^K qfḺ5n]|ZTxۃ` Q)Zqf vE]cKǰܟ mmqQP44 ^m꜉wMHW̴۷㔚P}Zd""gIht}~ް q}>|۟bNnrט_Rj~iEq82T+h Nɷ`szeB.\ee׫B˜]>J^/EೌWʭhs?BGw1+Rr~(IJ&&S߻_Ơ.RPuKEb{1;Œ9 @$a8>zM=~ypv[ jDL|r7uSdpSoAϼwedF2K58JtmM.mYsk"E)*aRR.Wx I߾V6n|_Mj^[JG_m]p5AddUȫ Dx|@;cW, (7l`78ͺ0s 9&ao5\[z MJAh[ OYVY ^?L\cӁjF]:[IH[ <ID4)}q ׆Iq\[,C [^a'e=Gn-hx]f/-q T^pFLR;KP&/xot?lI-#PqI xk34s9'z%+\'uE!\'c(bT+3SʉN%׺jIѨ> z~M%1IjIlxQ//U9x8f*+lsP0FA4!t{x'w5"#Y(j{+|.OgMg$YQ HL}.1/=1݂Df)<8] B_"L|JwPi1ov8޲WM"xJ=5{#걕j)  [j5mT/e(Y6P٧JIf0#r/;\0taZ8Ci(k'C]:UۀQ=倞klio{)_P //( ֤x"O!_Xx@%*-hA*En:dd{!TՁ篛o PgzpG1m%]-3%w.a fz32!! Հ@Uzh+PLDԓqcOj> 2Fn{/m_7hs쫧cGgVuxv!58 <t?nn+=<6ӆ1Ou7M)n(;Q&K1Eu5}Oo1*Q ! #^ʂľL\(Bbt=Y`̮T,>Qծ' Bڪ{JP}(|Pcћ7`6OW Q;M0G7(2{p~a4sy=ꔌ(oΛG} a}OӴ&\԰[iM:iUhjX'aXNb}z/q=ԠG8*Qg5jPfD.kUvChEBKK`A;(6ub5A͡k*uLb|&O} ϸFh@-V' x.t%6dT,eլ&湌q.-?_&]ͳl $9P#;o-uNnIC՜vTA{\CVW={wu>^iN G$=ѵ_ ^!K:CƜWc6px=OL!|tsbR|f I LuTsFuZll|8GtY/F@j=6S|DfY͒M2;eȚ{#-qwH!Cz $.,dAsh);w~#9KG{ᧈҧz'kn0 Nՠy$m7.y6eGѣ0lF5fS,[D*%nss㌭ }}E1|  +vnP0@f]nY=Vh+gXb +u XʘR çqYO˔ "3ݝvPzbkJ6wt ~\wj߭Z*iAcPn6(]W%X)'ff׳o8j~,-TLx Uu@%]^a1`"*\Xo&""}rx;Rv=gdAGXhqgn X)L5mZv+)Uos XIt6yـ U9yM & a`bS6' 3!c$m^!`!QNJMW"1Fj^$~9vH.@@6p?@S* GJ:⫿҇k48 shUUϟZy66 Z14JZpvfJ)F*107&G.ܵ(!ɮ_d?#WXTE;z{Fa(7=0"Q}՟{11ӟHu=SF=!7kAʎR~Cm=y+RXƁ#*.K sI79?+>r}&ypvDo>+@NUq]n}џи 9 t6|.tgEfvq#={rToǫuUk =b8[T$|*iUsLken^>'A>xq†bszW1KQv50|p!f a2^ݩVcf|:l=*& PI䩄$6X9EBG#ϲD~VgTk-35Zi! &pYdEM)+#gp`R޶i!@4p+h'fp1s`Sm_w Kf}+ E"Ut%`! 1V]0I5Fw9 esH2Q*#?:ߟ2R^Rlq'}rY+)zFϣ`7~`h-H[E%J$Zi߄+K Emo+Xp Sx(a?^NraA>NxK:aY"8\4Rlid;ˏ9H'ydzXm E,|G;)k5(R5Sdc(:37 yQWwPE []3z~!En׉4>ExU˧}טsC\sO h%Z_T9VXFZQD9rO9%_;/@"CCg%+N2"JA{&] aRslZqYvK:I]5ux ¬ovE":Thk1= *;m휜P/JOٻ2I"b46v%ʕ'n͠f{r)Rbo<%qC< _r˹Bgf}'v%|2W$LÍ[Qv-|kKni5q ?b YWΦCR3A=hU+|Je)},Qo˾{iyD9AA9UFYte̩SyC_gZH%$uݷTG$KU4ӱ{a93?quaC|e&i௠K!AEa1@̒Fu_Z ô6Ԉu-B9-L^BFIf:;&A5un^9,# 5RL58Wފh`._VSP\PF_8O(vQuZc$]@>t@WW{iRR 3 !`qH TcU|ÔJFKb^4(RW[ՀE(sqjͥMCYG! TsKy7[&]@Co2E,,7c_T!O<h~Rl;w q>Dh ׀-!Ũe`e}Prndxu%A1 Y׌p6 so'iܺ$FŸfK.%'τ.09՞>KGgڊgxb?FqJ'/% )awZA9/ -w ?)3̬I9{e!;@J6Ƈ% &;WsofW2㳁;3᎚f8x 6,ט1A1zoV7#d==X_Hͯ ; .cok͙E& Yhqzz`\Ho;s鉫ml{k}ojٜ8Lj$Wi7H4دH˛7#6V ؈ĝmed)֠2 Nn#'~8 }V'ұ79;\ 8KƁaŒK~ >E "9\O"gޔx1Nmmzf Ix1k>jL8zh`HoCSZ EO/rѵtݦhb(cK?W撷R&nZ̸;B[BY#F;G5i\afb1Q5ꈃ]Ļ/rs1G ںCrSi`t/LK}5|S4Ǖ_k ;Gs{CUs4iw p*1 Fo|4Iw6bԐ?9π/R=uP.u&t:_Zv_%b+Ĵgn yp b/,w##$=^ Rl cF yͭΖav`1+zyV4oVg]6]9=LbH?ܳƜ'IzNہO}h#!O߭ѐ92Ƥ_!QT8,N) .~CAb4ps!*_Z4iQ9tO*\mSyc)?*,-~[E)xF&bም(s|Ŀ:.=omy1 -' PV4V;P#r K0RMŊ e-W& C x*Ky49tA@Jm:n ]ҰN|(Bi yaB[GђE !ЖlIry a37[G6"1Hݧw?xw15x5u ?{HԛTʯy[|J'ˍfmzӲYDb|Ge`v~!O27e@KÀY8@FE9޽̽F񆎔-Y`xcC̮U# *PPvxAQiȅo0Kgbbl5(gBKuCfo݂wPo j>>?bG3o OF́I$$#@?p ԠȴfA%tT~Nv1@$suoT!;MAsZ{X{hq܍j%P񰛪Lz0zPS60 Ɠ@>zN-% 6K]H&4fw }Epq6E.16Ldowh㗷5i'?; P wS?\fGŔT(CaXI?*(`#zIdy;T%E i5h jFs]2Sa{q4&^%e6xeZ@fIKپ(qt[ɟyxكmG݉Žh/Alޘ̪ 9;9X o6=MgoOM B0S%^v=z&aZ>¿j@/`͊!JߚRNL(=v? iѺ/9bdA4m񊡬GREf-v+ 6%Iȅ@.$ p85b!V5=) |EԦ)(9alIC>sN_@"' p9rxc`ln{Ym?eCϸܻ]ۼ@U>Wz'6x1'n}s >@o CqMfU{Xgqu&ꢒ ߼@d N6R =0O`~F.y,־H'^6uIBI'KN$,A^j</jDN`-QLG%/^ouv<΀e#'lY}SQHP~Gw.ʧ#bGRĒ#_ 8qդ[zhM܁6S+xJB# lաWt?wPhuNƥ=G~ڏ449C J3;Q.;r]ۓER\AwpfyjyphU3ܸUNVrP}3 |#|鴓,'UPe&B]Y2x5[﬎.;%%p}}Σȴ5֮=eEC=`87TGqո_ ]q\^.=&$N^5Z"o'0Ѷ [p:RK7/Rϲ 槬QkY+__fLҰkV;>t~`4.+A=20L?*~k,m螌߫LeN=Łɂl9)B&/e% sL Bzj: iM Fcȵ=b<2:3KڝB@=v1bkuAzy<| c˷̦O?y'}|g/DMOQ8>nI_45/ґ׷cS< +0_#c4ѨLj|nf *ME#K4:2;h#|FT}@5$.S@Hy[m!hPNPߏ*7 W..sKʫw oٕP $<ٴ9r{6X;-)1}|pWWn޺P 58?/ =_Gc܎giͰ -|mպzp{$gI 1 GERmX1]rEB5heI vl*}уklYtMw*' ׀.x‘W)YyqW%\%^`H`x@;FDki -M͡'mJ (\ yz\ 0= WְMzJHApKokƜ<{YY*V$ ~b>w9ErًN7+rQbMXq3pD-q9G J9~`':txz`.+vDŽq}%հZoZ2S9IJ0z'IUOU0 ;/(㛼u$) !@08rhZܬ֝VuMx5k3l :%mTtR#q_GnhbcK([5Q+P}]yIR8"Hi%k +VBЎvTHeMbR]Qb~-4]ƜQ  r4  1#&:oʓN3ug{"* -XIVSCF[osA#KG1W@|kkZQ0^J/7"`}O5Tӣ+Z'#osJ'9ɾqhmߝ]0qYɻzQiaV3yE>દ *ReX}~hvtM^N,P_b!jP}DʃKq(+Z9Vn*!rwx1cPIo:dbۋcZnPgSgSg)0'@?NY@Ec$cFU ku&궼2> ߜm\ﺸOPtb V!njpXޝv耼#umGoUB(JR 01h=*)-P  UF[%t2W1>yf9L9a p=e`jHsGyh-{> S)uƴ4TSPOϰ,7!;"Q3\+y: 7)o@v*&Rݒ ɶ^!S/x'z):ol;X?_=ut5Y4',C.OcÒ].EOV7*ꇑ/!oLky4 ڠ =2 Ɨpaf]OUor/ЬDXܵ_=JH5s.M>?Cz5'Q}?E|LocJfڴfNK2hhZ=AG3|MlϛPQ4ǿ_aWG  pL: 5[lb{k%p|&ycN*_, QV_oڼT?Ukߍ&!s98,ڽU 'K'ƌkAՏqy㙭\ Tο"F'}TR6ɱ|FP$0$C5&Xd +}HȋaGӍp \ Z&G tqe?Z^TtD H^Q*H0\`N-{~C@x y85IZjoWPa˙u}0hfG:G0"3gvK\bFqJ͟h1z;k Q MD#ՖS&)hM-{Q1iPuw.Me{X.y:]!@&!Q@/:}r=à|VVo:;Ŏ&a=+9ݤ@uD`W*u5 Ul`o`T핥$aS׮)2-+A Xkk+ǞqdmKod pO_0< Aي+R0Fˢ u J߾x~b_+H!Ū6H8<+5P,3QpA2 :̀0و#Y&V8壨tP|d=Rv6+@.d%;:-˰G 1Di_L$,&$H )gINI_p#FbR1W/67%VH>&k=N)`j$upp~ᕭO{`?CԞfDKOɭTBTBScgMck~u`~䕢Ǣ$nӟ^pka2/ItR?)G@Ek,@~ RVrDZDKl*u%wv to6H 'nF6bE\x9v 7$) 5p>.͒wOKC^cveϩumXLYDV4K~euq,6m:C+ ͂~w&zJ3桕MrU+i% _U7a\K|'߂Dt.' ڽE g9(&FPBbU{ 9NJ%gEp{y늻Aj5] I9Xz[U]Ԁ2Wg:H=%ʋ_UrwUsYYO*iH{{ӏַ4wa *⥦HXz9w<&|RŎz܎&ynKdGQɜLI:"lL9IBĮ/avm %(d Ƨ`R9( ?ᢴcbX~y,~@qm](mM-Nc'Nɶa߼ Y#ա3YT%Efdu$&  y EaZֵ=818>@sM˸k)9_a+i8;Q#SOx\sfW #-$OeoA8p Lsv4[Ly>|PORkWa'~-ʄc3G_H>UTL9a3Dԫs&zqmB#,/#VÐkflY2O^{{ZlM|] jγwo]J ӷx 6XD\ r)nyY_Nc1ݕY9@UZXzq̈rB!7,+At.j B"- euQ/!76lZXU”􀯵&w j jF3KTP]2OLp\N^{vo3ҲWڒ|`zQXPW-Kq Z/? 5&,PEe~0#\X|Fbxdy=L9D. "E\jyרH6akS›i9bH-qa]!5bG?Ȁ@}F32=:Q@[JgB]<ALBaQ$lB[>_|cDz޶Mmx+ؗ"j1`h6.xr xm'$'\S- drxN'?d ;?C KH'g<jWJ4Iga5l@K IoQƸ?%> 7zNXW.喇ȨR,?D9`$ /X9qeT%Zf@'xn K}10yX*]+l{!uYIi]: % ;R]r9'ً9wԃ^@\-Y-SrWxۅIN>{ Bf%i>\QiO\σF7iȺ^NFn&!zÞs t|uD/IY5D^8ᒫ仨A|j)/AkK^çΈ&5|n?գ>x @f+.)mQzs8M'OT2ӌE%ëƛ$ JfLfs@ Iڎp攻z0> ~ |eY t`^6jW)DËU.1m GB |Qk\WAιJz4"+j{Y ,@;9YSn_AgNرߍ.9*;K9g s=k9. n쨼b+A=$FH荻S\%WlsjkHr taʶm<=J/"0K~) w[**RH2)u>`My;Ku63̱wsYK_Dv'O +%[9m{?B:3br4;T: |O:}pBw–r"X~M&"Z~(3$ '09R9*!͵y'w:8ђvbYq)eؖ,HkmƎ-ݷˆz ,Q[5LQ7eHXe Nmj/Yt-.sbEv@$3a,֬gB2ݵ9H^x78'gSwT5~;P1TXs0|1{!jyI.2iG37ЦlAD_ou*1ԟ <x魹'"|pP]n?sSJu^O[B\,j2@GL)ؖ:WqȲ@im]i]>^KXg2Pex+ =PM!Pxl8|"]S,FLx\,l. ]Xv1ݪG\zk 3E] "A7W*~m:r\Fiu^!Kvhϧq;pJ$RoI;cS☔(unAPf_: zULv@V ڡfruDrzaM&A3C6<-m?V]9xŔ',k;Euͻ}n*8&a8}°\f6OCӮqp,W_Pq#AgA27=2҉in (h]6Ù/xU&*v:>t v?2WA'UdQ5S'DfgqtsdۅUxo ^ns51S[~ǢQgEf1f'Pcb21`'7(;<+΢%eMi R9@Sό9o(!*jIg6C!4ߏMe0';%ACr΢FddUvs"S mv}:'n?@#, _Ti8a*Q شg9;}X,+=3+=L}GHJپ_>T `Q RрM<7'Ktc_?U#L Tyϐ}ٷ̤Ez y}!K=:;~(f8n I.׀-\P÷{CGc2N@;D}Z j`Rцb Jvkl2?G5mN-hd_wa?,f:#y( ]~`V^ϣl \*GTgf{+N?rďaZ[MnqaifP[ 77b\\΋<@9%UR;˘71hf<_u8҅X!+G^UE̥KZO+BOYp >@|rK#̡nEtՁZsu+\Mhި3x2ڱd{_eq5-򙟚ΐ~2baߛ'9hKLb!q-w8VZsUWϒ5z!ƣ :ᒉA674Y$zYjH++{ii&gQ.3]uuc1ۃy=*Ty"|:Z6@ G䉩zЊq\03p :(fTS@+wZұj_YgN5˫4gfqT; I C,|fݽJ-KN\K \[ݼًy+Q|iúnUPi1qC\}^ġzڜq,5[O*{. )-6#A}r'Gz|št?ѝ. 2])M q+;y9\׳1b_К' Y8sndre8Zk,ϕʑ$^UBb Mf(R颚-S0:-a1 PѮK>ihD<5n/\zP~{'R64g qC 4F̨0N {FǞz,gBX6g޵c2]464L@2Cϲjz ЗՙaXim 7 ?->ޙ%Ox63?%ǐݓl2F/:cYYKVZ/X:hI?e fG`L&B]_Bm.bGCD1)T.x4 =MӲ5[ۢ'%5m_u*BbkWt6Y֫ ۺ<\S{8[gBN$7}!/M{GUع8{|5Oq\U b ^Y }kfXUREJfq}A}t[]ØW\Wq|Ya|+G:W3CG1p$+D0(RS;4*~%ʰpc?Z@2 魪.%f6W9ќIn#v}JΠT {>?۫=>ڗlcfqHǒws}@\-f܈SJKl4q'n-t=> g&;Ft ې]\CwӷuBØz7\NW&{3G.dd-6B 0'qeCiK"mרj &d'sbb)NOp6g@ lahv}GAckXSh)v?ȼFkp-k8 3m[iZy  ,|!ݭAʹmwKb3zruܙ#T$kNUu)$-43^dۏJ$BCCoIW _\>֑5t 3-ۛmвM9/A603 M-~֜ԕrqg ރ_4B0ɯn ~QȪ`E93p1WiF%;@1Y׃wM@ ÀSJUơ,6Y7D2v )3ӵdTWӧP婿/402܏3^ﴅwT<la߲c p#9E|1B}QyD.P]DYt6qeücis/пR`ZPNLpO^#hr(-$sKt8(V0V)# ^zl38 .}/tQx:ؠW6މ2;\=I۳> @, +˕`?0[xbuqbySe!QzSVNrZD5X|s~O)jXxgq( kwO4b /`F=du 5.o':pɫJk<GzDJ$n=31&wEWZ"JEgvASE굱t{ʜ;Z{ !1y0}0st:cR☼aSc, p&KH9K@EI,qCj8qHBU\ 4mX63* kq:ջGxO1#+\Ĉh9OxZ75[xhY޺+Ԙa ^X/57[DtjV^&$`Wv 1ݠe`t޵FBwv@Nܮһ;ĺeѥl5S$3'C~D?_&Ցn;3arRGmO0c"W^[t)CO8H?IBi}Q3}`Z]:[,u7ƌ{$1v0mu%y\{iK &qhzŠ&L5qfҸW hW%w' OYF tBJ>QP*A#lr AcMNжE|^n̷j8d3\8s׏L~wPWt>`Wh8]ty%0ðh |&#~{lp&Q|`[ 5vZm.#HydRW:H^,n,nmƢn#s^*~E Em+܁a*;~N9 O^3꨽ F{2&CU t8NI/tː3rt}҈,HybJmN=G/y: kS %j.covZ lGJ|W݋%ѴoКױ|Xxe\w m,\A~Ӡ¡-zW|˟ -'+H"0/>[>' b&0hI lws.CU+)5)fd8 dꨰ.X3I$>Z+O-I|z-v&f}e;hۊ3(dz 6!6,ZV#80h#}2Q[MelcQRj3 BgS[mieznG+n7aSdѸJeيDQl[sMy2d=za9!D34BavthHJ>vkZGqHu|H"7ۗ .HʎrS;z.3}9'Gy5 Y,1LD+B}OagA+ϬZDH9|c %jml2ix]^h׌Тƺ#;^~ҁ=cXԝ8MɊyF 8.rRg-ht4L-Nw+'2bQ Կ#| n'*/__J dżBvm{oǁ8u66=c pivfB F/)[3v.2z.eo,t\MpEE<ג^CP)]27>Tȵ'cZ΄̛Xc?wZ`WN6:8KuQγll0:EQۯ϶wnu&u֪τ8~TG]=HCUkC>x֩W1گbqw֨yCZi|ta}x2hh CQ6Μ,) M*5. k!EevTϠMee0v^ʌ!Dpw#彐y?0];g= k nt]"?Vб>f v7W/4- %A [:`=\:G'GPdUR1cN&~#c %\VʬoQጨ6e R xo񆘁ה)䭋Vfj;DzeVԎ :dH"E XC| b+)g@:mA R.ȷ:>BڎQ|C S4-8SLaU>.̍T oaë.d_x=n'ֈdp~zq՘y}PfECh\Ͳq߽i-;o} DAw8Vx\?3*( [1$ќ`iM !8HS[29i.HF jaΥ+qV+Т5;IlY@!NԶJ~NƼ=zDQqۍL_(ZϏ>u2,hOaq2D籑ރQmn\D}FL"?V`߬6yڂ\NQe[ %gc"XaaޱM6CZ&͒^9|cmp9 gW#P6󌞉=H9x7f,nR&&WG_Y1m~z$iϹ @cSN{{r/[e't"eZdss&r\]@KNPK-i._ыSq TAtO{H竝[/qLYW 07i؞-+q$r$:Q{}hq%r$f }1!þ(r91 ̀YXqg2O.[o.pwt.rW`Ҟj_u`:"焹<\D5]*F3ݫυTI [LH:CǕ18|U]`7QZtgN0:ưU욠x&ܻۤE'tJ:R [NoRh5d6C"$)׷qZLVNUCŶVm%mPs #NbSx*mYFaI@ )=9ѫs)>%Z9Gh$µLE[INFӧxָB֥DkW9^1JEoqQ40ӾE 0mIv,~: ǂП;{*LhƷWHKȿ{h w8N? q׬`|pAxsSü`{\(L-.a3' F CyDpWzgֳ08}r5(N#"o!h Uik|@OF)MqP{36gnw`|`"O2Xezlljq5 .bJu}r'Q+_+U#-ه|BJi/yiP֍Lh fq!bLٯЈ,\21&+s),{216:]AYPZľY/ MwtX3m-j6x F$ADj1-8m^]t{T_=>+k AC)WwΡvz|=bC]ΔpDGJ^DT3Așx/[]RUHbJ:2cjqm}82'EĽ"p(1b5Da ஛8z7 _4^ct͆6 !l'BҝZc|tbq ؄|Z/V#6\v xa%{m{glH qzzm^+엜*N50sS1\J:,2ʜ/Ƽt*"'鳦h!@S^,G *;/K؃ER4kgU͏jQp.zt.9 8ʌr8i2d 7A< A[(W'cs Mߩo̒9ܭ l{'qN2 RDbvĽ䶇jt7Qxbf,\X 8Kf:UOywh|U޻;aId0D;ƉL}C>64ܐ e#3RZxQ"AQ( p!5B&NCPB`Yo j-X9>,|oq0iY/>[`wՏ\ӀIJ/6WK]E+t`{3Ayz]L%۬q2媆W:(o(ysi<Sg{5lgʿ`&e joJTnh"&y~ER+p!uUpoJ $OwPԒX"ܬPNǥ1Ԋ~NmMXUB6m ;߳ݖ!=l9Xfv:HXb/h<]} JydT u!,:z8bΧ _(I'Bm̭C`H5ry-k:+8+bBCRob5Z͙)pR!4i TT2os,9Tó1o.Q@mByb#mIޅYch8clcî7Wj QWY%}>xr0W@3FѫXIGz$7r h`bR|sҕ@E-T%Ɗa9LAz(/~n3"5cwIf֓ϐ4gBBzl^.dUhk]uk@>(Pz^Zy`KL" .m'm(U.y%'RhfO9tm͂牒{ 0PXB?fvNR ^ߥ)UHGE|[iF͚Yo$ĕ-dORr~a$%X~ȶjdYFug] }_HyO$vIڙ ${CPLj :3gVȧbzu^ eizmk0K4Cܭw}8'1qMt@S$R~T]|~2y*?a)4Ơ\q+ GL%|o()6MJU cB42<|'T!g5$|vXo)blN՗HHg XG/lN m\r)wWrH?@3m[#n|L},>)k._܎]OL4»,7xYYлS+/jI.k̸Sho^9WᾊbbP<"~,m+˿"sAŞbw"SNl9#)7 V~T%vj[Ck|dq~ޣa ]Ѐs'5f~f^]HS % K`P;vJl>x䩵0Tגr+`{+QYPTwcUZ&J-3n7®:C m^3X~۲ FYHc,m70;ΩPz20oNX,hS Cu55HUQYvc9ﲤcCS ֐9CY{S٫k|ζ"Fb{9}BN^+x$;QVl\]k42K{zyڣ z]H%vm{u>ؤ:)fu)>o> ЕN{ՀJR\\[Ьyᨊ`.׫J%O-kjiem}Sx#bR{/l*,e\6ū넩6muDk|@h Q3wה𔲘BEٌz77y}pA4 7B%Zx~>mEl'[ o5i0Q gm(*Tr} s C~S¦;K*`֝'XB J w~ E") uP3.|'K.Z]Wҗ^h-9=frp)e!36j16PqzG7e&&!ؑ5MX0 d tZ׊YM0…oB>׌4)fbnMf2ق'5j'{xB6aˤVQO ]|GGSڌXɕ]LU#GlɠOcΈڏ fl năw} cp#];iț:%:[K iv`9S ބx:Pu(as8O٦AM뮫2XR ཬ+Z33MRI=6I<&Iy$ȭBJ}ˊsRMdl| | 7}uwAI]>b KzlibZ˼RTMZ/$W%ӧJFjI wFUW&ñm!2eMZYVsniȝܻ<]t4$&w !Kf]cώW &@7}9ShXu_?2;H$C@v딟'tYl_Fy&d~oGIG(k27 z7;OڃԓOe6=0A#p8V=5iڶϜX#\響gb]uCȚA%BYkHSqA% ҌtVC*]f:[O\ b6r'‡K~=jF ɄFITxOq!h\(0AY$0Ā;N##7M0ϫk9c&ClT)1gWQ&Z:sͨy%$1kM&KJTUZ~dw![26_ISX\%"dX#1 ?)X٭bޱ}\|p2z['2tXԁGj91ÝKuC&Pxzĵb*fROjDn>d†D̐$I<ӟ? j˥MJ䪠)Ic1ѧR̘_b*gDQ*]),J"+% E3J w:k$)kDO_6NKL Jy3?1v0yҘ! #(Z ^qrO@~@Lj#@֐ 8`g1Hb~R~Mn'+3z*_,r,:3+4bi`~W, ?!{ٚ(q u}4GfƑ1tmQūN;*|: k% g^#iquze>pa~9ÊU3O`4jJ}pE8C ͳ@"ONZ ޖVhSnAɺp _~,PLgҢۛރ }6yd!PjX+$_W,[/R\axOZDn0ISc@?voi'-:f#} }9rS}X3-_xb0~k>Ӗ94ԑ3^?!u~E ŠFk* 挭քm X:/u fy% p,NM2V,qaNjFUX0F ^> T+;"w?{9B ylESԷ}<(hLc |`ag$pThYNXTg#6z'6Q`6~$JOy,A&khے*ADAv_PAsY&[IdeܩiQMhA,nWq53CZZ(W-F}`Bk7PGT;vyP6*7&O>i։|lYe|u _bl?=+->';D (N"H.B߿'Y!ߴ0p%M7G(|oYWwIzʷČuO q{?AoVN )-YS%xta>sQixf "a4E"*8*sS;y}njQ~uorݒPzbvP'\Il k~7[ -[,f567sFEmdQ괲&'S)n}huwC;(_T_7)$5)ɥ#0>-l`)Psa_]OAnqIQ`@>N7q>G!]۾$rU ؾ-BeT3:*ftWH;h/s㑲qVY8>7T5}ɿ:OXwߗhkpm=[6e jTm}\'5Qt)Iu gV l ؿd v;n}&Ҽ(eR:=P;X6F_eQ6K\K͓^} $Xm+J<+^|=S-qY9\66? ~ib]ɅO 16_7ы hyT5(lYP2;u{\vgB4c DQW4܉ [R`fw_U 86:ZE54WYϞcx>&6hF"w{c@?143EQAE'Ah:enE%pN:Fs@$}`U[^HbrvqƤI7?&2;Lg-9o@9/((/ L8+W)1jM r8FOb10cm7x?oEq3( no6+&/_IY5tZ9ũ_Ouᓚt ڈL&G]٣ 9??o.$;p\FzjlD)|US?866x:!榳JnV R C7k:핌/TpfJ.wJ 's ngxL1q+v|\>6{PJs{hJՆ0RV4b/Ƞtju! RdRRQHYG]C-j!#16rm9wf SfDN#c02#;!!35&xa}z+T8$[]w}{g"1YrU .>aT;LoR Oi5YԷU諟K1x' "n Ѻ@&Rj<654hJY| 쌵FYtS')ՠIõ8#h š<-ߤ [q>$xF1uB9| זDQ0-N99RQ'|Qo^آ%~d@YoBzx1b9{ʈpAC5o!;(Da=:B/H_S*N}Yr ?zrې~D-U8mhH_M_vӍcdOϛfMYPծ?Z[pλv~Nۡkˉ1@TM)9?lF"tq1`e,ݸY*-NѰRRe69hI: 3}Ԋj3(}GwŚxKd<QF- |l5#*wge_gtr"Vn•,(Tf/mS@:nxX8-I]Dm9U;>-sf% =tH=&'-Ql9Sტfix]W2IN#&Zɶ҆Qu@@RA(e֬ E\P\`[jx2yrb|r=+ EܬΕ^XD6 wD[M o[wK U} +>`[ǢxD2[rAJUf٫#fNthwg--em{~K7/%Y5>@Y}e#W[A4ٝ=kͼP   %B†FUakm67J`!np*'t積pLr?Aգ_>/h4)Y*axm>&&15_զ\QXL>ߣr6gW&_EFG",{|=Qhgt}FI5.fF!MxwUTֹ.F~&bM]ґ%Defa0]U ı5 UW y^_e' 16]f*KivECmVBEZ56p:9 DC&ߤxmp[aU<5}[zZրK¸YUa)A#Mfʓ)cyF:sC HX{2SԀQ ХcS-R$/J14T{7t'R15iv-}).aՅN~>~NF~5-,ﳘ&½V%KT}zQ@SzCXbpDs52wio.z;z\IMS[gg';Wo 1xP=D^Pw`=.Ǫ}s$$f3~8gXn)JZcC1-Ltm.bh/³Ѥ|ʼֻ *vw-|o~O;٭Ao)J 1/=#xB#D8@r ͫ +ьxʒkA X;hS{lcGj8\\K݂ey0٘>{hQ.C2|vd>ʇn]\3c]PbٷV{pH̱o|A^DٔL "ߺɿផD?m"'ip] WبgO^8~Rbn4@oni2\uW4krNj]j； ,jɫxr^)E%U{{qy(2< B m;_#t>0[$R0gHI`(V{J¸'9wM.hKACXs6sǮ6C l+ڗjcBܑ:O:K#4ǑVxgTe\}=ag@ /w:*C)*HU7vu@,dlږH>9'J=[# 45~c%6M{\ =V z%~0'AQ%[ft5)gK1Z^%K;;YĬ\`0yPJj08ɯVϻC CȈ e,R'uOS%Q, `3#,9Lys됧Ic7NGu@b ۚ n]=S|*S޳oń( A ?,qs"Jk\rCLt+HV'r$ ӕ,|jָ@gz@LᜫKg)uQFQTLMb3[w~W.7ʤM#GPhPU{Y6#%DF˾2[ pRrj'-ROס9W9(d8~T3h>*1zsYnI3W*];*=qӴzMx a;kto_YRRZ%UvmcEy8 =u2M7J zvz*>:wNIH!|{WЁ  -uqi{gnטT@*@> @;二hl?ax {\%ZB`Kiti7@Lb(Exvn5(&ʾA#b=& p&H\m٤O k;d:>7&#U~`5 UGkKi zLX^֏q`+8pv /*5Z Tn3 T?#Df:-PK!IdO-·e\UtV@u} FU\Aܬ kRN6͆g3Ab _Q_[UvQ4NZmlLf`cAXz?цhkc>9qm|ڴ}Ҏ$脁Mh>Q0BcgFeD~w, dinE3[+hH吝46l'+ưq j/ |_[1ܛ ~48qu}"S*s/d醾qb96?rk*:'wP,Y%K-zvi⥂; O+sނpBfP=O'M%gn54SgQdu|G*K_~`bӬ<|7Fz*GqIw5E h#ʎA_I;Fߑ8bveDecB@*v9 OXeTW+?:TO^Vw~ rAU5UH/wq~Uq)P넞!&چPTϣc?l\{/]@o̧x|߯H/A z2ЂIq7 }3\E d&8lFA.ssB N gڨF愮ekd lwΌDŭ@CDЇfеL( Vd: -9vҾ>dȉKo*M[JbGk֌ZCbv f=KU[bDT1MrvҡNxG-2N>HdGހMV>cKJW,@ +`DT)6h E]k}-$zd=GFPIR|Y@wǔr/IdF%Ȅs*9iٸ$Ρ30p+Z+ [f [wwMm+UT~1GmEX(3cN7sm%%CR}xJ1!Ƥ4 *(L]e=:P䀜mk*>鯃Аù8ɬ_j}Eu@feCJq58uuXD̶ټZ6o}X[3[izOaJ柏nb&^sJeFs8MހսD]@wۺĥ$=NG3ቊɥZBeo]Xr1Ϭ ;My!J{w;>)((9I$̙Ƞ_e~CNB{F:^W^-7O6*>fׇrFsCQ&d,ӷSZ.|/#&x^,w2+M %.nt!{z6(_uˏ_ 6aAHI j4Ԙw}ATbT=,lMpI r*$J4IgcS5n:G8uͺrs7λAġWt0nF'mTFi{|&1^ 9 TPqQXnn6Y Ep;G 柞0.A(8xYwB *{9ͫMޛҽ/6G^S=#:]>٤b? ̀2ٸxb!!1_uNMknaǤߗ[18&bu=fXqdj|Fx艟:H`pPLE `ܡJWigA.RsK](fp+`,f~s("DW5UƅNmn"/h߭$Sͼ}9S}%-szV :&Zwd5sLp5o)(wÔ93G?(mgQEjS] ?"4f2xӮo 姢`4\|5MMϽ s &lC>)kHnaq5n7۾íBvZ+>cj6@b|L 0ߜc86;"1AE%H4 `-lBn+,#tZ@Aq1 T!+tcIIPAmɢפnhHӓ~VT$O%("~ 5EH$ \Ob*quWqeHt:,p] 'Z^=uHoA(q0P>8tY/Eؽ P3 b3y'TKχE AmSК:^o|ͻ CNd5CKO**g u,OQC2M \AEa⨶!!*W9f|T6+Ͳ|%>FݍTU wQJHxkh$%YG?{ &H&"C@@:4E*wadE ȕ\y.fo(cvk| 7aԓq2Pń=.HN q;%Cf$SdZLi)UVFyX6}SP{F4d^Flݵ[$EUuUka`ӝ! [I[^/UGܔxYL?GV'k56; 2 4aT b:nvf|IzB[RseL`b]ݩ+rQ(P⚋4M)M1 W3TXmsb; _5]hrei9(KtD9Y䅶ly H q4)6 BqD ? _ޔ"P>D˫{CapZvoө0e$ڶ%E%bPIJK5Cs6.wXܜ[N`n n|Y5WʻՓLЋb~@O,`FWgkL@+Ib#8Ÿ@xn}\cP(ƛBSalNX"+sGJB!ǷQ9єY4Wi\ z"@4|׭ch62и1/o*nQsIOv "`0ZyszC-КonMW;T4/n)| 3Nř kd(F5m|]>ߵ Sy{ X(bOqq 3,"~Mym;/ySTIRCO#%8?pK;K7Q ̕t©AC1tedɇAbod< * alhPyQ GtZH7H +FNj Hs0tV-`JAl u~ܦRi1pLװ5o&Q%:SFw1.욍}Wn q\ T!)C+8ϒ G$B Y&`ZHzS#EKYk1^X =\gL]$x>Hv ) Yf!a*inBrV z01]7N?QziuךOo=~,ȥ gIRǐ6J&cAI>i%Ov~*UAhx"wR_;OoL1m{z_2Wؙ0\ j)d0 "էf`q JU&f|1hic mmkrD'@NV ^롂RyEb8e^ N[|ةqA1Ii+Kh>c৽dwRe']m֘dy; 9nuFI1f%6r\Dd-`k|1+|Y7[xV{^ТʝϪw~uFC]r0=^/ Zh "؀#DJo8vΗV..Кřv35)d}EKvFcayC͠:]֣B&nDהhk~o:0IU`[4F'b%O%Q[wuڸC KI 3vi]ʼYF|PyLÅ1&Ib?j½oE|Q8AF uwόqx5+=0OD?,{GU~ZQF&Xsΰ]#v):ckmY0@j_CR_ٓl|y*mNI6;}ZSiG{`>1Ϲ&LcBvJi;)eN7H%|&;FjGq K%XO,c48hXr躋 zǑM4 ""Z4|6HlHkSH+SwضzBP,nAŠZMvi(f! TI&rMysBvKG!;# s瘬[T}{ZRnUC14?c8K2|ԸE.*An2b ?p@E،5AwKF EgGK6AcG0sm^j+u+ 8HpV|Rl)tDH|bFf(.S6ψy\@W szP+b_q^]'ʬTG5%q)RK\HkUu;19.mHɉöGD]>‡ _s#7&Aㆩ#fT99f hi>|\¶j)R@y*p>_.a&5D&E؆ǘ)*mzY9EZ  Sz!("B= _h&[%|Pp+(`?AK`$T08>zNc1. jI]g.԰wmyqaܡ 8(3][2m ݈rI{M)qiQdGVo\W-R &~j.2ܑ&@U5{~zt{-lWGv.x=?xꡲ ?#+'0c Ka)g* 뛒K1.=k6BO{c;FmF}넛L ٝi\DZW}StZjKwF(ipOLf!;]Cj6.\YJ 5qtЛ#jSz->348dsnI/ݔ"= cch)YrFeJJ~ܴ0X͍ej(t.P8OzE )i*"mϢu*mJhL ?ߟwBCjha)s ¨ܳX:D#(޲|ϡr83-j?z9"GQ\W> OT\U6*b++^Ey[qYܙ(!'jڐ$8"6+e:jx XM! ƤFqaxcҤ)5DIoyģ%0IKvxtyWKJ%kѼ1$ݑGWǨ-^HX/%#CR, 6eHRNqixA[!\k$?rƧb9SH)ql%Se{2l7V5r"uOc~l7V:A&XP$MZ1zo2EiL !tDkEqw;`sۊRmY{V11ǹm3`-N0:UHGgy,l*t-+n'u#A`JD?#:]?F pR8K Girykk(yR3vCUolU?Ҹ>]opHLT)S+<-Lͼ{z~!VjqƞCHk# 򇃐'DElP`vR%Ѳzè"$lVxOyc653tz<  1NwFg c7gjolwdҧ%NQ}V oJ1`&B˩qwXzaط IS? |FcNv9_z:=)T-݉/ڐ`TF݅X&Hq s+5kT'R$1r` H倁} Ձ#ýؒ= JyyMXa:""}0!.$2QhO1<Ţ̴WBU5V)*>Ѣ/ue(KQ&E7A#n!woSW }*7܁ڞL;TTm&S%m0b{ fd%vZbbF 0(S0vɌ, 52*486q?J3PB-{\dᴢtY>Na`}Nٔ9&ķ "τwRYPln4yй 6KRɷ<]q8 >&:wf"U^fVR* (#5/oneIxKʓ5C jQF,C-L$LV#R60祪?3ڌyݚ9&A4Y*7$W׷~-+49Kqo^&%U-f?uwr}%}=-{!^E#3ˆ[7>º* 5eӼ4On\6/0ƼP)J7>r#ts>K ┅4NjtnCܑn͐2 ĀTk36*^wazn~^{*`#5]yFIMi'G c5M- Ų[ _{/R%A<ٌ}E*pmWުZX,PKb$xZwBE%fՋ/ r啋<01K)f^lʧ'kf(~ n!ˀΐBo>XyԦS K.JW1MPL#pEJ 8d;-[Dk3_ c= !kS!^$7hѭt}:314x@5F_P-{#:IY@qD)͚{3m \8"ůZD5B;~yf*w/;eik-0,bˬ8/X\{[;#&2iϷ#|cp)BW'3fĖ]¦ i$zQʕ4Is9h3X[rlsx+mzqR/]Х!)@Se:SSį.'!@Bw,sxR#!|a"I^n!=M +gKZJc|<_V!3w=p Pڷ;'q =}ͻXܜɟr3Ӭ hno-00M׿E8lA*lL׈ݣ.i6(B[*|-< E(bPH~ OSވ rߴ%OͼɊIJZ$AЇ"UZUV|DUwQ>k/FѴ[mS,A{#{5Y@Vu%@]Ĉ c'XVLalvWӌ.3Ka2 wL0 bNozlb1:E3\$?*"'iqyI{Ȝ{ ܑ:DMj֘;EŨ$/@T#>zb CWHb|Vd!6m鴲yhfj<ey<u h;TG^zb9L:l.q`@bդI(8a/-ԴS-t٨_g@bU*\&hf<,{q ]iͩ]LM^- T7rm ҩFԑŸ|mQp'&f#)/|\ CӕЀ4p ITVmŌ;C˹0R!V9ϒ0HOy翇΍P a8w$GQ{$mK!0ҍqX_3Xw%}C6ו,s ښN,@Yno7oȧ(MBLT=B`$摪fFTNu kqv494T*{LJhhBx>5l8s%a A$C`-oZFy LߓLS3I)vNu}[d֩Z]ӟa,iBP n3*dM=S-u=ׅv!& z!ܩ=޼YZj Ork(w- KC Luv}sVZ-aeѢ4 ALa|=w&mi`z$(wƁN\m`JP"@x"_/_9ZI+}2'1-"O~&i*L `G$ ˓$<wUXq#}!ZoQbVܟ]&DXnIM4c̀Avd4{}ċˈ(5 `"O̐EPO*GZcw[hxLGLĤ@`U@LT39 d7l1s|t= ~{׺s6[ W7Z]yA zQ=J1E(vؐj"G󮷞C@4!75R2{ >*Π 7ő# Of;v[0Kz,#|Vmɬ @USXo?QF7Ŷލvz{X挸3L7jSh?UQ 2@e7=0fmgNآu*̢IgL]0JP3qXw3υ;+t}mC ed %Mq g N֍[l@ߡ1_=l\83_P"@O}ި;CM&dz* ̫#jceD3F/n>C=0"gFW*6|4W(屷@\U:[~"jE^`W4 Vbmx /!j8%`w>z,`[#!>`HVnu}XNiKhQFMN>br!NZKW,AFmIa*'$.'B4Κ)S`C o@YW@nej}mDagR/hԜͭ˼R7 A z͗JyEovpF oIυ4{] |M <{֜Q5ܒ B ]w ͩ/z0#x OcĢ5m!V@K "&9k !}3 TS:&t|vL^ IԌzػΆhO(X}̴Hh;1,$s8BpZ(lF8<<~^RŲhɁ ~i@<[a`0-[`\=ŦGr* X "Nn4y=zpN?p}CLB1 AMd ̻: 'n4Bew/kiFDmld)bP )r=怣ۏ^~΁yQwL0d%DW%g8G"^ELWK dtV$n_ 'ۏ(E*=pڝh8ވ6b͍]@q[i~rfύv~xW,Lv55kyZ쪣rc #!cx=݀q<#Y%H:hi9B[XHH TW+ئm;.ZJ e2.IzKv:h/Qd|Tߤ1MN02|BCѶcݙY3OoVH !+Ll&9]c8AnN?փ*~]gv[K4]rI]H ձ*;|Tz[#Oi=9Yp Fp|A.N͒q'Ph> 17:N2Fm3,_H/P_ gU5xB=󣚒(o{)$4ejNITh ]?H %2$]ְ`3: ~sa(`z[4K#+ P-(ΐ5ðϘQrٻ@PٿE1v5l/%Dō^Per̯¯$ԁ ?[e<:bm( .݃10}m"dwoFkH2үss*XPZt'ᥝ1}>*>+.ޖw{/5͒Ԟ`mFZՄ#8&bߏX]^焣U0;`Z3ۛ2F :dy.ZS$+pփR7bKDUmH3ъ-Â̶ؙ)B9[n"H` M|ȱ}ɏCh9Y$ލ"h#KyϯmwM}:z#zԤ5RF,pv#$*pİp&8#*ְSrSjOR- NRz1Q[륔/6 ݝ{'n`{=.UԔcp@ 0N}((X^EGCGJfoI1-Dypf0? Xa`ayGD; OADI1uxwO=Wu{D*HwU’4sv0JS/1gvM,lFPpo=P~`sh^/Yb8&_ "NݓZqc1?`%̣>9sPF-;rīx6[|G2p G7g(0f}X,  *FvAm+iMB Rb0{w+g5Fl#DB"4isII8 :OR9C ?v3oE3IM6.w'A;!$h>Կց)=8}p( (=on=^mw2K5b[hvyb2v]Oi8TozAZHD,# q"3!HM"'`] sXb;(1Z (Y$}TxABeՀ߄`UtYTU.7<>xq#:2(aŋeb7JiPhf,5;ۤ  \ESճVNp0h)b@;^EV>!,j`.࿮ojUcbe )} AhSxVmNJU?BjB jrX y#nə'b;Cw&OۗTM=9A/ }aqbR9՞=zP89d\/#Pe8ğ;(즇~= )feo)0'?{s8Knb[Rk'o7i3}t *'|R}Ծ(Wp0)؉>-xS㴶 ,,u } 8Iᣈ8utu;$ {xTdHnKM@37Cc~%$ʡQHN2ύlʾYՈ )ak 5]Gm]!]dXi*֒x }:5&X? xZ}wli2 U+L9 e$b%;*3$J$ f>1Y̼C#߯fF7ͬWŵ{)0$f\@WH2j cF|q\"',Vȗ8r2- ɱyvQah^VQ1bڵv>ٝV{nUjVr1ZT3d<!TkՕt]04|]BWw!TϾѹUKx/MLڀ,e"۴ WfO=Wk_ PC *yg:\)ټePw~kT^tEb"ܼ, nkٗ>PWOȉ2gZڃX%۴$HI6K[,U],xѦѪlE4>MG|owe2%FtOY7 Xd]hOu\vz)k:;yiQߔ@3R=^Fsy@~Xh:|*uyгr]' OyFwogKJ-9_=]݀MT-}dkPwk\iNs45L2":szʹiIyNr(mFbw$D$U]6 X'g3H13c4 K$tvj|&QhE74̺\%x8SJ9 Vm@"[ xn_cO) {sT ,Mrw.:_Gqϙd!kou oLUYgCUM<lb`k;iJ #{@¯oH(leb0.=2rCD48Aߨ~{!"C%:NgB(K#.Pg:P(tQΘ\r%3z>(!+IC2̙JLSDE4qUx$<1צS>Pe+KF&dFASߡl:*]o"fԾ0ؓȪQyP0t+: (sS}/O)^Կ!QA e .`{꣉xR|P~1[3jJXyfۈAX;m !lHPKut3NM owfhv$G^6u)'D?x334BP`oVno~ hQyzr8J(NZC%ȚNRm%qMin8ב-˟!:ABTN2Cs&}'g ]A:28 RՐ< W! %N^_SgҨɡnUU&[TP;>, n{"ݶzCH*QQ8T9WS"DR1BPՅ9٫{,Fb#V+?A\CZ?C~%ׁ%<擋ˎT/Q vs3T`f~E˲_KDnar[hYF62qW?LhN 9%%3/H\Y -'N1r -~1^]M d?}{1:Kg} $~,%Ԭ^Vܼv5ϲ7@`4prVoAt[l4XwQT\ Q`Yf$-G^GH(:a0yGM# 7cF}"1^W4], 7PLDWb1>ImVxZ3<)$}toi I,l> K:QCe-ݦeA~x!Q%ϰewnIz#O'IsU Ns_W݄.C>q K˞;Sʓ 3XbZ nƃMs|(qt^=LSV8C.j|5eBk?h,`D#`iXH"R""!ZlghZ̘%xD)yF֩,!ͨtN Nk wjz̖ LQ}l `d2"bqIuO#z=s'ӭ#Xwe#푁,E)S|su L/y9j~ޑ#CDಐz" t!z\ޭTm߿Ku/Boy-Ġx[C SKوDF }FQh)*1$./!TK%V^J{fdL\wʦ^@"{B;/H'AD^\bc={H+D>iOm! [Qo\^*m#6nr<(]+{ruI50-:/p[ Z]Wcra{d-ؑ^*T`JknĚk̇eR欪q^8PLƏt {t wzP !d~@:֪g:/'aje l7);+]|ѝ<M᭛c.u5nпp.,spn*g"tuR &,'NhʐB>k*%{Qtu7~ՇpC$xl; չQwM&eJF)t붗MU /,UowHrXۢJiq# KaȣEDoG]o@&/yxir&]o@DmhV})z;{ձnV/yBb?$ԛl+d(uZiHOWf4tlA%aLפd'ş]:HC' ^voMǶc$s[oİ&cY0cvꇫaKI *\ie)$EQ3bY<<]%,~DˌTR8;Y<, RRJېy4als28ތHS%-wl! jOȸ?b r`w7J-le@HhO+ɄP9?h1 0vXx%rI3 (oypU(NL$XR p;/{nZ"wvM$ӵ~/5Tfq r4ulHLƭYgg ťpcRˆݵ|P&>AԠJks' ^q˽agq5'Av ^Zq؉=,$PY *trGh Oo*{P2}ǧ.v{yk{lQ3cU{p^x'e>G=UjPFm^Kg t]ۋ3[VYQ|T^ώ.Xu%uALv7CBF38`;pc{M3LN|)pqr+]4׷dT/$,xՏ٣,r~Iy}?j "p LyKYrƶrj@W(SVR3:oq$kEA]w|` 4كY0ԂymxXH9LSYhy6蘝&Ɔ#-<=w2;Om)8~5#1^eOz`4H@UWǜ1F2(ڛ<кDL#'ڿ+.#zy:\9h"f7x5#>egMM"'YTȅVCC讍BeZMEi> i@AQ#TVgkʰrx2;m :3yvՑly[e8͎8Ƽt{QG'eEYTu(C{ޝXn؇h|*bU{<%w}Ov(fy(Dǭ'\D99D +KuC68Ot.;mS+DN=tXhD OYn7yjZ> & {OqP6\zo@/cқnz_ki֤ 9 kJҕ̠no.Dy_aR҆C{ڤ*NH6pw 2ŗbh_HUt4FQa?$=  iX|Rxq;5 Tu NSc\m57+N]S ZC5^mlhtB(3ѭ.ߟ0! u  8CED1Elթ.@\>9!ٰNN >l~9x_Ԓ qqt\?D$9pM1ӈRa O+[-+r7ъ.,ɢ0<6OeLSղC\hbTBݺZ%&2ulU^7Zf ^bXkm*jeLxJ)#RXPB +*QiߎB|;ITSBB:!9g&=S? $`j">Qc@nr$eF~´bS5p&B$-]~w9,iϤ["J ^ە/eC?#200px\~ʊŗ4,liMw">o:wtrb^Hee(0}ldo8FS^q}CA(vW6EѺZ²X\@ _1uy{uKV(ޕ"yW$Ah\Kv]Ǝ䭡fFfEӹq6O[ wHOM!#/PħCbRwf t"s`:igӡIRn ?YXR ~="p 1{W ,,͵tG&9r 7M^heo}aA|̊S)Z$y8/`b6P&/D_Hr9Y7-Agv>J-FAQ8u޹ rR=UM *T[qZ %TU A: TT:^sEoov|# ٻ 3Bhn+OUW/oP)29q  PTs|-k`ݪ('>Z֕p>vNuFqS8/;8V:A,VwUR^ҀEԤx4a `p~9P/])XF)#7a^YK˨˜E?\j'b%@W|K홣kpYS@=~FS +RƯ]6tj|_>Ɖ3;?j̡(I[q S~j9 mt&S7`A)G~_cNt~^qd?:> w 覝3Աp >: l 뭃_VK}ɨ[1~ryB3Ũ7I/ޛn|ƿBS9k&ju89!ZO$eWX 9T(Ե0Uhi V<4j8Vȍ*7bhq Z=~Щ0Pw< >%iխ>ʟȐZgcIhvʕ:(_ei$Qi0Ct?YO]TDvGF9> -eY(ȍ`J+N:-u)tČ!" a\~. z ?r'ڎ ^5wMAu^Q_rUvsD/*@/Hd'*hKfzS߀Nf~ 3{C,pT}Q; m~J N\w,)\^k|%nѫM@{,#=;~T74v2$ga~%3v $ax]a_ఔچ%1'0 ](Zj~:kn[v1%HV첾N0Ӏxv1OEFYN5aw2nT7=rZ,Z14|% \{VuTvL}dwͯ_ҵLa@tͩ+QADĢ r_, فF^ȴ4/6~.j/e!v Lk'TX_ک9.htwwzއ/&Gfz&\ub&J4ƒYbECzـ#BĶ-r>QQ̺ɄǷP{c]/{h;++ ("Z5 . ywa]ActwkIE*qVZMsk=\Xb^0"OeɰIĻ阕Q`7 RE:":}"ñ1-Ƀ;Eyw^*N<:'&B8kZ ,&X3mN:sNT=Ik1rв@`y.C@V7fguΡO.؝/*5Ƴ˕~0a5=!VR Ml{pN cӳB6t@{%僻hH{.34_/,=~3Cgxfaj+WG쀳.O}|3=2qwB0HN4f0\W{A2Rr.hgv=c~}s# 9?62, a]DFzVslJ^p5VQ\T@,#gU-W5X@= 3"{p|ݩ3b9a,^Y}2t:7宛lCݙ*r~{r2n EUcK#TV@\Y}A+h?n8FLeA1d߁q7zcȂ$ `xXvřbh*r̉zGUnRQ :~[l 8+j\v RX5HiTuiKV'kR-7pqVu24-ŇSTE+\slS?㐶P`sךm yr!nVOvkQD 5wZ走\I=t1D3a?;^g''j s'_%ڀ[ovd*Yƽ n1*79)E*πm2!Buz@4V߾Lt{ 4uSKҍ†Đ?S<.2)%J3dĖHsQᛗDf$l*< [LS@g{,2+%- `jHf' *g$}\ÿ3@T}j.~||fASw7O^XU9=muK[&>KݯYSB`꾖tS%8l#8d<`-/p%AB(xHaP[FG( 힬*PWo&5ם? ݭ3Qp|)EoIH9%CCu쥣 B٫\h봽L&O fG{a) Tb" _tOە"κW.MԱNŔ}DO1"{Qdm\`|:.37J#Hsh#f}؀ޖֆ 0AhNy(?QRK c1Z R?F# $CB*gDɪdYP,_D>17Auh {v!k B޳d'ڷzp7,7>eA<j8]we:ځog-WsCq(*?K-=T8J6Lv 6q9a]6JYoxF|5RqV;[<0F׹3teݪSS&B`kǬP ofn^^; Hgѵ0Wm^(2Qe3u-48XC atR-RVY!',\ Ҥd J\G`HVNEh%נtGמ6*U+!z\o)Uލ qW*8ρ-{/TGaؒoM2 Ck/\pt/} 6H_*&ĨdLTyF4OxIڷ!Yq-¡0+&͵5})P%y+XɨZ+BnJҙ<8PMu%o$tkkROjsT#e) j|G6v)~6=C'\D},-IU+Rx7[vvT!sR^xRUq0q7=䶌;c@k'"ms4+Tja98>3|t~'_nv Iv5kӌ,n 8/(`TܑqU*%WdCe.-Or%YWv:O,2h꺌-}Y pS{~K Iё::L??iVaFah$XQ8&|^zJh\l:UGsSj6wZKd++719җي>O~szB]n Z ǖ/8x3b!}7 A01NPyN\Gl*/Z@0ue=3`1Ew>}$s=ۧ^hV\ZUSpoc̱۟ >#LϷ Fgc3SRSn7 _W.:| ;eJt@R0 ) zggJ8#bZd`ym[ 4P-:XZ^r SaYv)#gW*4ц2\vw ci]!ˮּ}i}zZi$(Em0Cv}wbfMyn <~ :vC,be qjCx#oLʘBm%V{Pt/:dO\ߩDM^_* +y|(Hϡh5:ć+uyu71E[ג * SgPݑF$r -c>G'2UG@;4`~/~b#¸x%>U엃PQ 5ִOq$8Ғh},ue[E!]PVѪRk*Trn#М#P?Tjx<ռVc -VbԚ:GA\!Q14"D5] A{H-4G:$T_z / Y V㝘LVT]{j0*.95,@E=~98M 7яc(`;snmeh,$. tݎP.nxX$5@Mش/[Jh_َv߭'OQO]u&eƻh*Kl,'R0)a&l8  >22 O HkL|iEB1QJVsa$MY)?Tcp Q-˃{x hH|iyKj w^-QUqKwb ?p_"(jnպAbGhc?I(r@٠?vFC&(¹ R$qWx e?!Ey2 \y, 97zm-r "a9RB@]u]Tf%@)J/XoEf1ioOQ3=z| @XRN@b#W5~.յVmI,l\!Z źi'($dsխ:bD>cb*mśn*Zx;=ƆQW8ts܎^[3G!'DXC"V" skV^PY-e`W %xc֧ξk|Q9gѾdCR.&A6 ` Kꫵ*IGSڡ7_ƉVA2#)©3'(O͒Q#k{m>U}h%?MTȞ$eⴸS0<¿ٸq׈ZXGމC 6VL>$y8',ܒ}N?dcmio# r泹1 ļ[ RA_xu^2k] LϽI\NRiն-w8]U* ,i֜"^OzZ J2/Ċ?t'BCcr#N9έ"_wqW;n} ֬ueJ*]B& ^e1]Х0e_גHp-b{ "\,xm;7g՘)&{P$Kp% [hpd4 ƿ` `i Keߕ at˳ ,O=s_|.q0@Y|UMAo M٨bpR^2Zq1 Rk8/Fh*˔%+Pq2FChY>ykq2fԟTUN Nlہ>4~?`3ҭYlc7m]~14M%+yQ_l|j<`֟oJ5z6THDs42- mSC- }0T2?8 6NQeE}g"c$\U%^mJU`@Yʡi%VRCҢmN?NK~yrߐ "hQ$ ]?/73"֥)'mj8d& k_,_Pd {b tj>]*q7яbN&Qa/݆kiǏꊯTu5Y) fⱆh7s['W<]Xk Bئ{wBZTsbPg'TVb瞅{>e{ks#%*cqdǘq76bKccF[4e󹭰C7#=M[DMtZd` 'ܬYBMKثc'RsYvK}RBT+|ҩiYt[מbO4Bݳ>q0?ݨy}hˢڲ)c3yqWʃ縌7bIQ-*Qt Ȟjz79?4ǏUU$g <>542<;5),] wxUuF1i$Vot"Rc)=t'N ̮^~UL9fOjע?:L2YrY0uC+M/' fsLРw5p2^dMQ lzFٱ3&#__uq&H;!?Tƹ nQE5COkӋ|\P2T%ܣv\[LhN}?ػJx5y$Z~Uܒ:OZ/Z*4PM5%wkv6tҦJbEbC/j#X?a0 [^R/ ' N8B ieͿdWʎ.֔qQ"V cwm ww%c8:l' B$L==}j/MhW`yЂ$D\.: n9/ o#UW {KX.hXX_ 'Y\$Z p31 ,ho'H;š nǒHE0v?ln+(<#i ^N]`SnGT \%O4q/͘jx^5[=e4IⵅPٮ5ƕ' Z7^Ё7F,M_(<\ 00'@o&4щ%'?"ŵ&!\ ^m]Z>Jܩ-ͩwX#ւĠ)y"1~# ~נ7\NdkT,7]529HI!uJ :JM'(+D?25}h'݆rs [k7Kh'T1}~jd&_PXӮU_܏<酦|u}mb\p=[&k0[3$ۂ}i9rR`m}`b,[F1 %aUq:Xal$0UxjV.g}~w {B0 je2ԗNzW:t9Aň ~'h*-;6%>Hp T+/Dݵpjk]eL$AlNn68f-'*t6=_3LM8@:M.l:oO?m`4>Jg9R1I쿓XfD}aLc~߭3.hz"qijF[u1f䇀Cn XK߈ ule%OGjʨm^c˘޳Ӫ0^|0o—9n-¿gA |*jFx"EWvaSW/GM> 2,zf[DuNKam#gOٰVY ~˷SGt#嗽-s :E~ҍMLw5ʉ[PWD-])n]ۿ{3C )dxe*l **{vCGHr(w!O A(Z1fU 4_DW4z)8]-Z伻L/U8 b0<8iٞY^&Ee-wbA`)MMsOja#2|n,> ,.{;lN9Ϫ2fg\Qȹzg˚i%|W߂8*ֽi Vˮmef?Kn .vpSM ';XrԏS=gDd¢\z!]@!2 &37" D- ,WVe!h$Ԣ8lsq l?ᄨ'B/;ÄbY5{l3UʚoD@TC |}5]BPGGWgcC>!wJ}ECޔ:fҲlɀaiV0`ƶA*)y0#^p>Vu.dƷqR`d@i1w&p|#Ⱥ7)_Eqyur3Car1='9BJUp(a+~QT#RIТv+iTUp3>䚆f;iԤ^^_2+^L`8H92qY8rBU,it 7±h3̙ \ށ6gԶXJo#/~9`|Qx ANJ:ׂ)uƃd;Nřt)H wJnAM32 ɴ4u/Ωd<=Nɇ]j&SmvcIS-s\bܲ# aXA>9LZaEeBya4F9 HPT 8; KJ…7>$\qqF2 &Ύ[,U_:[8p7GÞDş8`6ǔ5];b=JS.nW.rXvIJd(ʈڲ9S; lvnOp&2p}A=C-EE؝s.L~WinXN3"|&Ŝ4*=S~KVjp#e@(3L3ya=/2R>$q$%f㪙EJzTƃs-{=P6X0wm'Ehjͧ*֥!G;Vi/+,~H 6NS,e.p+ _; 諐f ϒTOϋNf7c m l9 8'pDKfDLTk$ѥUmE wr!y]/8VSoL{,+΍%|V V͔N=-+I\e&zH "&eNqH 90vKl(*"^jd=܄;&c6Dmu/q5~*Ay >I[0]i@{SOEB_{k$„Ew60QSz-qb%ڣ ,3zF͙VR[xGruH^![|D eRp#nE;g}Zy*.Pܯ:RؖnlpD})>pNV] C8bm,(l` 5b[DT65\$L`I$Y);4`D]2cv=sOe߬$#*\Q|M=u6Ɇb/˪`gR((0n+jѴ^6~|oi<3t.&p $^ ^XdiAbg][ L<+5>K`VraXwE[0uN;t``ðM)2 -Bl{FY}DN?:X Ă_WRbm Ӹ/C$ "۰kVcOy\ľeikδemSU2}6CLka~ .nM7!-sw 7=]rUUÂW(Cn?4qOb" 9Љ[IdP僤 4 D@y<Ŵm}"BsyQ5mS&s{ƯK6/U83x-IWa8W9XO9>:S,!9Xr;@HY ;x~ cł$BȤ1}HTM aozMe|3$cVjGգ[U)#=7N$s Oҳ&;a2RfkTEƏT7殨ID͜ 0(ӒFw o1uR>سJY {jƌ$1HF% jvl=LJl1:8C>v(h((Z$ZX<#Y݅F 1[[& AޝM>'m穩+ y% }8^teTZwhddͦGy136g"E yY// oyO"t[f@@177nvJhj& З?TZ.ä~A}ij6q*Z7dĠPAzT-%a~efdq8S<8RV9&R t%E#!M`3. $[A&hKaT _F^Z{zqrv_*Q}bK|O\6\)Pyf&7 \HġۂV'u,5p͇oNOߥMC$bu脞Li{t3[NZxVyN T 3|c8\C1 DoyVѾ&v(n>u^(x"vFK$:x⺆L@;: +3m{z]= g\|ɠiT#` 32ouA!f b^ 5)˗ͳ-_RΙL98Ӌxс3PM1H1l73bmѦ^r[7tX,y"|?YbCN5No9q[o1/K2kFaQD?aRRq ^Zn8UgI-B 3IpRL 1`XU[oZ!^X#˓ _=Dc*;VVa#p ꙹ&k= ۥ 7Z|`[ v EMg2%Va p3ܳ7=%8< Xg|;1#bT%QT ‚-5 ڞ΄(#_>2u%rK\E'멶Cu}ݽ@i5Jd;+FV~zR^Wy0ß,f@fI]z*7=uvf\x;/1]"wԺqY;ßv7_2B EP^T47/So`JraHm@39%H Cv?iR$ u>{Us%ÀujCzXOɰŰfAʕCȲh֯So@͞HjFkL4#44Ʒ5ձu{q(x kޛb" |:dkTx4`GbqPTٱ.,Aơ`AF&|"B}.ѴM #{ӅI7lXՀON$qдIc[Kr `~0|OKuFT3C[d{?Pߔ"2l-m WUƐ;@<ytLj!ɧ [7tu:yh^蔓%)lFXOyoźцjQ B$&/Z5 'k8 ӫ@Bued2dn!3 ,ƿjB>ғifaˮ HR|4qHO q)Hx41vm꓀є3 $( bA]֓;rbM:@$(?ǘԤ EX͵Uo@2öcs܁q4tMx7äɽJM-KLRTkiv_Uz&GSp̬"#3pj/vu|>ipI{J;"`tbpxH9 c'wM][ bT64}b7z55mk R? ER?%HYqWK~vrF7%ܱC312E #hEzYsc<DZ7ʵ;|D ӛ෺W*iD ާ P[wjkl@tgIrHCI-ٙ[a% dݻZ d\fx fdn1x]+ 5(㑵BT20TL=SK߄j21 j̩ GD`}2l .a)^~ P(5 'ٯKNsܙpNyx"Dpq8aָ~9aW@1;>I03 ?I5aVTb`>nP-'VgVlL$L#GRMK`y87J Е5v}7xIeϵYy6ص"aGcUʥDZ7ݿUA:yĒ8mWTT gy̤w8k:|Y1/*'/5AUpH a8eF$H4,g6nFED9Е@S. ?MsR5+Ar [Y2Ϝ}XAT] Spذo4 gV=$j{GRF҄ikz1 Km!Lgn?&|9܉/2 ,**$di$3cPLfnL@[>8FPG><[N)yIOStL0th&b 0YFPRI2^H88ݹ ry5QOP[!g-']=9gG`>ZN1Lxvò7܋̘3P)٬oi$v2wjc3Y.dDwzq% t7e㮻ܔ[/!_zyMHJ! }95zN$ŽtH $mS W9GJG7z<~=g5!#33pV34R]N#IXΆ{:Pv_Ab;>.uV,>@SCB#6rz8CoGF`@kd+iN$\>` PKb:X0~@&&8QzFetoeXyy/Mv; #9@Q5w˷9lMI2 /rq)Kƈ1l֮kA3whA]CݙpPYf]'4 fRm d8;cGBhVPJ$JPI۽sɰu_}p8OEk߿۴iMSi1uכ* ̋#E?  )I<2/j(% \{4WB@2inN^x9D3"nghkF{eUg+==x1oy6~{L\ N9y3 >1O]A X"DfcK-R!u-:vQY;ٶh7go.!Ta|puW0-y=F&};[zvlZœju-#1j@FMq&4Od~MaFNcPX6+X zv¶8񐚥ŋ$ŝ>dAqT+,&tk#ԠP5EyZDr] -&2l3N)"!ct@:C D91{ÒXW3IZ_&ʥ{gnL3od>E!򛅾0WP!e.D }U u כH@|4l uB9{Pu`({@x}%h uVXj AV@yܹg\wj\mDRӄXUlPs1{4쵒0'.to:>jkGԉj%DW?J[荽^{ߞ7AX==n*U.&|Q%aM,H(vᄮ/)JF6˻2r\fPz\T1R⥺ 27zE̐\,&ʿS @i ^h[>GCZRWH%c8X#n/ i|0)ջ ?w?q_RXo'=.Vu_Y^f[Ir%'0jci,W( ZvYfK_] |~ -௘}˛й\!aCAwnf8c +# wȥXvLBL4>5V`i GcNv r Nyq=ᝃw%ccw(Nq-ӪMn 'ۯvQBӯ I|xdxgBUP|ߘ9NA_:By*G5H$g 9pT euFIY zs6}Ś{dž1饻aQZ͋^ !)t2e;'nRZE_ =`:Ьqi~Fh/o?,-[ֹM֫QL_Q*oq*Bx7 unΐ9M8}ɿ ̈́r3Arηt䂎j=>3ñ?Uv9]`5ezcdk:, #M& O <U~]ՒT"mi v]٩ѐߧd56h=B \M8R|*A%:PӴ:CY[u&ޣ0utcLaK^ G 2BIJ8{̕JQ_x+P!\N9U 4dCc3aY3Xw+[-k~svo)];ȥ:$"TB*| wJܣIY|tv]AtxNh M4 \_I_ f'lW1cr('Հ:Gw!iiNbA҆ cӚ5͋פeqT䪲}lI\yw@- $Qß:Qi`?8Yǯ͠g(? ZO|tPf<INﶲP`KسFiwi`tf^^sMdMq'%+s幤a7$Uշv|!ׅ\ת//?E~QU 3njE '-] уVYb<,nmG='zw9#i"r >Qow!e)5⛦cڶ烁,]I@A\-{g:ҿyMi9iuRvt2<6b&kRMC!Efho#_NE'老A:0IN&1{=SSH7,qK:tE: 2*!V S)KfQNI\pIB$yOvWݧQɣ >\IrhXߜNj%U܏"@z(JZvШPFOv>~|q= gKT#s4$9 ЫP F5.q< NDxщ ~82Sa O E/b7mr\uK> W7] ~B MBmVElؓI :$y3|jsxx8Njo6||)@g&3"wG^^z\ȄS#KA8貾H)z |,f![bvͧsnPcBa^= p/YX=8H#|ӡ1OH?4,ʳ9mvX͉j|4n[8 &0>x3e;)w0[cc9٦`XդØJ믅"?ospe}좼@Q8ZLvx`0A󯘥k60fq(,l|P^h# -d05 }dk % FVhS2>)]#Fi |wL@3Y"(|.zE;Fkōxin30k&}k v{6wG/QnхE"iFeQL,ڵ<@2)DO+ gI(na6p9rloǣnvۓ  z 8%XK"s|W=v_Kܼ+)\$eDDh0QO2g_NFĒۦ&r}-Qzpۀl.y_#T6%5pYE//A 9F [`Rwr4ĵ1}J`w.#ioXaa*>FB44Js;Y#!XIdxH`΅vs͢$RS$֝>ڃ'SZ6Ɇ@A1jHYt D#rzoʥ Gfd,"q\.H11(Rxhr.%6T&2ym,}D\F bk"uy? q>h6^%u:iMKgcSۏ B\$8U)1|`Ahp#ZT%z>=_heuY&@t 7cs?%NU)LPXS}vkF!k]A)gP)!}+/6<ϯd~/ز nݘ(~o^l 8pc+׏BY6`<6M~|PYFwL;fIY@nIΈ-FMAx4diaI,Tɬd\ N~э#27g7W WeK4LÅ? ih'Xl~4k:d~gk?padtW[*&9-9VLJw#ܙ>t\}|8*Dur ' g[1~]څ&}mL-T X1lC4p??Hh*kt85lAKZJ=٥[r*o~1R)zJ`@ ݗ=i)sz;_$o8u}eL3Rȴ,̽'"DݢT;kgSAueOaz筫1_"-3bbSiѨ=]ca#}HiHHϝ/( 7,Kz#XsEw1#;5fcTĞVFy[A\BYRk![q -`+us| 6{^=Se 2m1 |EzK}bV~kc) hl /n<*sNy2Ȱ׃1x?e" qN;ݬQȜ{VrRߘ^=;`>TcJ_P?O'UEʲGㅩ_ gPPF,~zqH凙_}Ul U㵁Ll,2XvD*{ N)9] QݴEp v(.#}-m+5W8%w@!Y/?B@zj~Z/ciRaM2:cĦU313CS]@+JNomyA7S+7EQ 3 LC-R,8+jmO+%|m{a MOGDy&¼al0 F}Tţ,Op;eE*XaY1 EȮ\N`(]>9,`T7{^IuQ{{uۃ;uow^i:$_'y?օe2:/VyH'}A1ig~nMO"%seߔW".92d76LyVƽ:tYilt"өUpbgr+mJWM+ӝZН2\!sJa,hM,arD,CI_;ÅvVYA;Oh׾B`vVH[n$A2g]m8\):&Mrjʥ022<8;KHoTm*:ik+SW#R^)Lz Q짙&KWg{DBGd= [hI8b+م+Sϋ,}R"OG5RװEAf{8l%Y[!D7l5|lKY k2)xeӉCceå&ǰHlF|@ i4]@-^:eY|-ia\ZԒ|$=];!t-גes:ĀzAZ,&XYmש}Ur*E.:q!l#>鍾K0HI!(۝\wR 3^xlHv/_Gӛc͏g/֭UANU1d 0ԯhP;;RN~ IM Q0&&o -Κ~ 1s?Y,QXg#˗:GU4a䢰90UlZdYd Eh Fd9֝W@֡S^/s@~ ,V6\=T7UۃD[cBI7}|ߌE'()ᩍÍM cJp?np6ϊNѺWL!hcvq<3D5a:(ƇTkJFQ ꣫Ln jdjP b|! .>H:ӶϞd޵3aVnv^o{TLXȡ8ȗA<3A`ju>2x#Otl_ 9/DOSld@}nzS #, mBbU($Șaڻl^&WŮYTGE<2:"i['Gr|e h޼}(Fo%QLeuYWt,Tu`}'V>9!~ʾfz P7ӏK8B5굪iΑnME=#)Dh4WOԫ'% (LZ>)wW :^h,dZNJ%ػ۸ĸ<?xKIŚ,1mO8!O,X) d:/aʾF#I{.,͊)$_vzT/"5h">p!DF.3jW)P ÄwHR?|?JG2GL^&ssIӻ#'8CJYJt3Yt\va=,z,'w09~aQ &nK@1MApOrAYt 1+[[s?0&J dd{pf6|^f,Ђ}-6O˥˷8+,.ND}l=ft岷`.DfLxݖdQkǥ 1dd@{a|0JrjNsghU,MNkIQzvWˎcAid[xʒbb~tY0%_Ũ ^FS<7ߋ@B}% B$drn}5CU#z>H45'd˄tYVZw)QNjp®#H>>BȗbK2X˹h 6;@rRIQܦ;gf܂|͖r0F5v15 ws#h3fi>6fOt'N~Րz]l>ģorg3 pp6gL IvQW7Pau53|< 6ҁ#7c:(5Lxb>eEȣOuyAL NBh'~'˯n@_U6r YCz%k-3fV.*k|O "=-[~+'f6e<. X$k..FVA;yfsw@s22 kY9hqoIf BxBcdRkӳ~!S?b]<̯ W`vŠt"5 ;_~=8|.]BZ-$Cp d>0β@;+ =3AgoP}O,~i]Rwn~xlSV܀1'Zx; Lqo3ju@O$.=6Bps%w%$jڹJ%؇Zv(q?XJe'l'] .Bxģ28i(m4 We+⡏k/T.1lEB?#_G5ٚUBꃢ9^- qsj׏@V5ރŶlD0xXͤGLgRRhTc\M;t̉kxM\B0h}ԺN-ǪUb3mH,ۊy InݨdE@O`%![_ RWa&m{yC9w~^D1NꝢ׹ccꔒk{c<}$Ո{~Eθ8TsH&~'B]s/^S[@j@!ʹV-sK#EDfUdͷң'm DkhS/ θ$HQ*5  oͳkJ /azC`'һIGdzKO+gZ+P_kɗ=HqV3V/a}I{t0&k 4#1~IDwӹvRb;Sܞz rixHʇF/eulw\f(I>[-}էCڹu{ξ>TQeI[ 틯-e.G jF[v1-ܝXG*U骿 ')\:P8Dڵ{}( /g-0:z$ 4ڮ\Fwo>xu2jZ T}xUJ}k"KKlH17[k9-`@PChW=ĩce%buZ'bⷎg;aT$_v%tvT@k6}0_0Ct{nwfg3.c {w$|i~ժ[<8ܐw hVѢ UNoi*ފ_Non}di6TR.OUklzgyF̑" >lKY~pܦՓ!]!flXL*lv*d)!vN%fab }`Q["@uXA2=c#{Tlҭ(.(:evjW Lq+L={ jb31b"p&??̿עr߽Ruj0zaJDko`@e76K= Wrӡ Njb_ar~FD^ HrU &{/a٘+\RoqE`IYpʡ|f+$ 1K5ʜ-+GтL$ovŝk/ڹ-3TwM1Y`5o_Ut$vжdbsNҥW /XHLNZCt][{52ϖExiէ:k;56o_0^,TO>5#9WbiG60hOkzɭ!༬lP'[SP!y4!7o&\pJGSZC m;ruW񵹻~ʄuY{uYsԦْS?qqkn!H2meB fUeW٪PKk#a4H{W,C GðJz1QT]|cꣴ\ffm447$jen!+\K,YQ"fE3 0ΎGYxa>^L2+ m3 h j6y,8J{>,<GNpAO8r!{kOnB i _n΀tW[TG^(=` Ipkcjp 8(Co]d,@|qDmUv%G :} . 6U}!j1ɎZQVrQ~Ѫ߽S+WrMTʄQ$PUهy @;>8|3e])e6`ke#^F*l:2&r [_{ORB&;I/5ѥn﬘3-"7ߡdr֤T21&SSQC:,6,NcX tz")M9 9W6ոmu@O[8YKMb8@KzmJTKd~Y?59l#0e"R صR[q:*:Wh8k5t3EF79}1>q"-WAO͚Z:Rv\n䔓0,8"4"jQ ns^ g#ET^|pA>7kw煌}c8%-A 0'W,p5|]P3&:] 51nD"c8(2ѐr2'd{==jjr؝jыכ_qIfQx "E6o|<.XMS&42(kfl 8@X(9qLV6 `R08A}I g;䰸hYd| +pIkk4!﫤B8 sI~X@tHۘs+yn?)إhcPeܗf3N_yz\9C=0M ۻdGȧyuUVO=MHDGƃc:o'P'W 'w6`>:b{;U\~"sr6v%#渰uXYI(B>D>I*[ux-A^]40y|#O0#n`9'i?} E<ȡ7G^~&(dp3N60I%ZNl[Z5U :uĤxlsVKy/(8'k-d=KUi?_0*{Rv8PHLaL@Yg0uJ&C8n7M{885\sȍ'zj2ᜭm%z]:| _ ֛#0&ݩl m 1kJ~{Aq&go$X+8ՖIm\ G¶;7l|%D*چCа^"e'*cf,pXӽ 男VD5pē8%jf"!3췉p*YP<hOoY%M)7F@0JsFQiQ /ޭKnQ8]Kܧ}F^nB kaX*DQJu 7 9[ЛQmQ$=,,_V^ i4bf9lΝ4Mcge,N22¶%XZ}݁>߮_(G PV%H.nQ(`- Rx1K|d.CgG=F.=Q*ENZq_|-g8eO@ }v$Y_FŸ|8 z~k5[@A.+!FȔWQI+c^ apk0 4/Z3⫥=t1hDbuocJVT9<,H1KTxdsCL2jƜ dtJڕb^GY J- G.*56 7 Eke$H[)r^W/ihN+z}:"Z tƘ; =kGtPgj++g9oÿ)GKQ;eC9ı:i/>guG/.B7)npNrF:x4/v6y}ճI?n}qJO_Rq1z z;{]?7b[cZߵ F|S!j"l 3`A/F>OCν&:WlɮyO@TM\?T].Ym:cm0w}n2fRX۔Sz\eǏ'GH0[7}w ao,KiT;F@,jگ(|#6J A0:ڊn{V:Gc<4_mתX]WH<5a\5^J\y:V*yc*vHMuf݁CbT) #4~ӡ!z6Q \*}$)ʗhhp;B(SkNx͋s>)_zYQos <J;(lv?ߣ^ػ7;%V{se=6BV)%w ѯШ*HFFXqLq>Wp69sv'Ͻq|^Yй6Hp͹TCj섽پ1  b/F@C|FڐH?xYzc<L~Y&a+}QR2)G@H56'6[h> J+;-pi3=oc=VU#L 1fpWBڸ}T'j)ΙuO'?NMJG.ф5̐%'z' R.zx{(r 1DRM7>r&oiE?@/*;/*z3Bś_XJ[b ؚ{zt+$%dkP)f 2^X0:G*ԶǵlxE3njqd6L oVhf[!w<_Y3S7)Pnb@үre&.8}z+K o 尌WH#+R}m VBL-q/(0^DZxэ=0Q]H9%Zbf`ɲ7:kx3!Mw;&/S90GBcҢM%=x7ӘPB9dۦg#6g& $*Ͼ'ޜ$R|^h[LBU}o{AdĖKa R&1rdtUo9͙:j{Aa4DDKsAٺ?Ҹ赜n9v5:B<ԕ}&|V~l NzkUTJ?X7dkޏ%rZ ,o?zi "JN- G+ &UGWE<A<r@3HS[ÉǞSk`jOqLÜ&A Jx[J '%`~^$~'>vROaqWiMF&V,.[tཎ1 ^>V,IM&󄂞q1'叩m{86Mr5NxJ'2CKhD?e6P橘&"+a=(,I7bVRJQU`hm8;%wЃ^u|%KXk_tFٕU +\ J5D|Ky,{tnw L+ G%SͬIȲwTK.3 ;-кi@7aWb4=ɴ6ϏY>֗`3wFqO)KyŒ .jq),0F`fd%-]y6ZwFGT%5 uB]2J* nUӗ'vG:cTUZlIly8H=׈ƻYauXBAdzQfGܟUww1 Z/k,ZLGX-*PGX GN7+]^XWR͟otE4yp-s yg }-P[A 57lapK؄uPKT32gg$y6#z&Gp'Kp [ "*˓L%xJ9jyJ6@d&w,b\]2@A}%x ϣ29it\rF4Nʝ&bYbBE?ޕiH=Z?SK^%YGe;Om l֣‡X 1уjOCҜ8N\]OD9C{v'm![CK%ɕ`Y{hHOKo5ZJfm:9]BI"dE;ýWF 2 ~UTc2xseʂ$+ҦG*mE*~EYX`PM$BY5PWѫC<_k& Y; 9kزt"pAub G3!-~ٟO"F7#hqS"#L 7RnT|B_xפ@.5 3 Dy$x[5y4z& :3gʎGYH ɝjA&+׶ V<]F6u3v |Kp0z6I#r$r3^tUvNޞ uevfliz۱/fDçN.ި gp]Z?u?Rݎ 5_K5-}9D_{|U?GtX%5͹.x0ΔԦ,8ٶJX.".ZtKNGfN  |yfHTLC&w; F9FU[ԗC-28 N^+^]òiLPPs$Ygz_/AufA+wGˊqD5n75Sjx9y,[,`h&COtLy[=PB=ϩ9-WQ%G^qPR;0ތ!Y8҈Dq̘ʯ|zW+NBׁV?;x'>$/3 0llHn$Y,\|uh{mRj~Џ(zRIq\GMݍBIq O.e;_ęI w "Oǎxpk|m3-BEn:EB-؝v3] #rZ>eY,T' =Hh^{+Ҳ9r h7T7TS0\2 SJ%xRX6]Ìk0@ Nla2NSLV,޼ΒFtR^.3K6#Ly`U.sզPugM_(p_NExA&`3<8(T|1]+X[XbX>A|+&܉? 9_HCNfQa[@/Y{GWC!`/$A># l ')MdfF'@@m[?jM(5h6h{3ԛO^ 3t֌$Y7"X_d! J-KO!6u/y<;@h1TW&Myf~L S܁./4NxHq50 s| ʨ>?$H2] zW*rsMS>Ix1y aY}\9l? W- cCz>Z3"հxCeM˥Pf+GT yߞߗ3,b+sdg^)˶G82=T/g]U0ˀkNqqhtǩG~#=~jAGy͗7I'9*Kq0Fʔdc;<ϯF3ʗ$Ӵ Sjl˄ΨN# g$uƤNw[ y͉Kp8$_:|q\>2FسfJ%ߡwN'"3UrmdF[7kJDAc_6#TTk_9 w6^ٞUE刬wVᥑ^Mִ;z)j!!o)X77a Ų` ~zwll1P/{(` o ɟ("Y95xk:mfv8VÉD0ϖ3-N| 3ˆ5~6M,?u(Ja}2qܖNy찂\:r7$ĝʼn.pɄsۤ8e11.n"b` Q1cXZJQqTo6UTYmTp{5V˜rqܜҳ*M'huF%싫/(AkŎ\(Sv$6-=v eVᙞ4zfY =égV_..+N WO&QPm $bcUh%AU;_˾>q%JrD=K w2zпR,_9Y~Nq];zrtX2pkM a6Xr5#`Օ5|ۊگmj$󬫰sYᜐNqx(BaEKf3 On!emMr{bƠ De]h){U/bNqC3x<3_ Jʱn#Qg@s:u@1R}!X6>عk,Ლs1{J_m%Ü)5;LR%w}z+}XpQFI\ e]xZ ѿ⤆.NAp~oWSvaXz$:ġCVy;6`'mN;8& 8A};Ze&^g5YfUO TBgy;(Yo>n`/4tz t^2Z }j;3B.74"VàZ/Ϡ ZZĘe$+|z-8>kF\H*ƫ ^3(,2@~m(TpEN+`Zړϊ(2mJ8K]s"N~ wjnܮ 3'K avJ~,XN%,zsuJ!S<Y5ݕ}JR298Rwʛ ϯN\?HM}4PYQr[pSE[* M2[Ul{""[H q8V  < ϭ0Q-h(hp0wq=u0&24v<,XTF|}mwKLR DԀ#R7jMX6OBm ;żbJ Y` Jo+7nd!zP^nHIG`B^8[UAi,OmדkjW Qb7'-&zկVnrx1J#fj@BGy_# tԆֈDZH-SޥE{d X497LHO1+<nJٍD`٭͒KB(]l Yd+[<1>={T=1M,#]!JifkR\ԙt7 NMۀ% Y%,o/{18@;IPyFgXdZC]-p_lw|NOk4cz1ʶA;͖خ=U#9I6QCnwjEVxO,bخXݿr1Dӳc9α!t0Hʇ%_cy[YNK7;U)dtn@,POq;Yt|WK;!nܞz0} %4(>b<TǺPV9cE%[X+ SM?Rh!-.j!],ySO'Vfr}EgY*2^|?5v^V ӏ>{IaA3 <]*n)LM}Z;RP2U}6|iޅ@R Bqfs*-_|<T@Wx?' d=49L)pkf.]b%:OxGz VrE`\wg_ѱJkt-Ak4q (#? ƣwשiw ֚AW9ĺal^ɒ4#ʼnB7w'2,9Q3f4Ш~"nWmuR28/!o8D芓`$0>M~6 X"~ lKiR@eDa+&7!zy&;!\ %"n\T$_=Q. U鯆6Nm?»wGP PQ D10 {~n[R8V5z7dD'6WSgghgk#By$Ju_(4-șRDNF?$j.cK\OXg&gH-a0TC}蛌\kFTO`&LgEd^^XD#6%FW)y-oG%%{,:F!“|cBLPy mR Wy3٘5>m4eZhZ`!6/˝4< Vms%&(dǴ;";";9wFtktv9/zi9}:rҖ.<9y'2'WKdaOgojwWc% /qr'p z.>"IYQF ;am Z~z: ܠ@ġf,;ܫ7]2F+'@L^g<'/[q"xKtiBr\ yU@qJzkγ0yar<́[-<{4>iQIJk:J֯m,+3/C/m}Ѫn2\/]jP,B8['MS=kၻ*+Nag!4uȮS#Hv'!8h!&(~A$ϛnᏺւΟ\2#V äX\MB-^wF}3}e3,Ҥq1nYG4.H"b >xqb5Oc^h3nF$rwL.P$8, 0 k7%)vJ=e'2*f}F2B_lϐ\2ltfWf1ٽG ui(7fN1=²‡kB_@ͭPk,*4~np ?Hl1Ԯ0Z' _-i>-Su>zGccNb[L!mr"4*]$|7GPݯa: R|i5b+b@n)6Bimj1L,1sدB!HӟAH~ ꃒȣ61C_妼\6oftvJߎps jb]l@;hu2Ʃ{g4gˡ5&W]}u1\ό~F2~\ O~i| 0t%qqroT+75~Sηk0B`[N*w |k恧˖8<MBLJ%7@kU~t- "֙r*%VN2JMO' }isX ~M<NJzYQs-b_ݤn.yVB}/p̛rqo!GbT_keM=9). g(p Tl  &]'ŋ/{Ȗh\cpMlMpms)$xx/"IӦJMBE'v,xѧT/Bq] -9xS͙xX:&×$7;kRaeA b <8BXL=IEJ=um6] !]5 ON$dhnN}^ &=z߸ 06 GԎaEm;biBԝP_,u7 )a߿::rϿŬpӃ.,y##ZJXd֪7ve8b@yd9ĩ!~oLSWZx|!ú`з_)5nclń2 4&'Q:9:TDT,?H]N{KRE0KM6cd^ZP*:6kҥ^tnAN(^6ɼ;`AV>3N~=V܀*=g6(zБ <1l6oDg֑fZ6ԽQwatA"mf?2Nأ%:ՎbttUnO-|čdډ/atS̉_'gD/n{1tddVgǖ`Z/!4ۘ WoHsA!zv@b*>e&i\z3'[2z#u?_W0yN -Ka誋sQOw<^ufoEĶ.z Zr~+x]'g3#}+32UjvoaztY̟Yi;k(% }L5pfL7'2/ٹ ͘`Bh!;/FdU_, 12dr藇ҟ8:?@EيQ&v9XtВ8 2l--l)?@Zz%5AD#If2,,#ΣX|̉xJb&cMP,!Cqͩ߫3K&"Lܦ1-O>rtexT뜼R^ )NX}0\77BOA9G" 0ڱGѿpoEGyCG1,% ӡ2mMGz?g]ule.dwմlQU f)kI|%tk~/ytY]P@e̖MyaXpBrzbO/# ?)'N7ؽwn/c؁ԵkS-ì||@Y</DT}yOwlAzZیj`Ðmr_*1'm'/j jQEixڧ^dRεr!// ;Y1(:T"GU絟+NfFL' q{c9>u +A`H̸(> QUim}U{W֗z#8*wt OomAIiwx׏J[#r]+dq:KU1 9 lIdFq+ZWanxEQ:-r"+%+ϫZޱ5|>WDً:ߣb޸' |ܛ Zwy"sFQ/ڮc W&.QXa~GI(H )Pb>&s~MUĝY;gBkO5~qH f:d_F#``w$N Tx1ce\6[贪&]<|)Hiގծ7),"-Ԍ<Ob?W;P`;wGjo޳.ahmYv^bw oeF3١ww9DWY5u9hzBJvS%/>_"Hu0}n7)Ns78b ߤLJY;3cqGi. D}й#KɎu6F%#/MjƀtjW\)p Cma{BIAԪQ>nj IxDu"zBWqLJg?+ 4阷XE*hXSIEx=&8 1OYDCXr.6)zUpeݩjK,3j&X- LkLh.1c\!"ZP>7PąWҝ5eҲ`_0o14lRۚǙsb0 s'pID( O6푷F꼾rV_uk H^Zڒ8=UW(Y8N0la3KRtOs:.mK{'2G}|Mx uBZVez?+ŶeVY)bDTj}H[#/` FqZK]/VYl' r)^4THg: @|ft9&e< Pq:7y/,wHJL@wP63 5#3~wW( hdUz|GPzA$^7X6 o>2b0xjrwB D;nϸaOk("rM;@"S!lkr׀(]-LB m6M#8r^ 9SD(>EE !^nљSc.+h&Oh83Ncsolni9f g0I%񇄴E4&[Fu@fN-كjKw^L~Ns}–TT;=lgJtJ,)]WUe ZvvE*1=-L4v)9?أA^UBf{\ǖW}dbP^ESydWa$8|㪸L Q[r27CloԔs<3]JI_K(nK+kJ5Û!\Fp|=_ϸ+_s&I8vaɷdfO6/1,T&_&$tI !MqV9$LKL*9'\Ԓ%JaT2D8pc1d탵<>(PXX0fz(eu}_'ܛ=y6s@^+SXk3 ,I;:!0*N!FQ8Yӽokd2`XlXN6! Aw()|E&i FN(oDbKh e$;n*=An~۞ R[)Aߐ?tQlW89f>`w@zj}Y˃n4paXN :}0\'{(K0VX)NKRU0]IwODfĂHA\dY4M\^PC)[.%C}Ѭ%C S5#n%Es/r2ㆌ#*UzƯgP2 @"@YqK+?EY/Y*u(]ŗA+GeUzbwL|\ְMRahgZjhjIw-blYtQ` &e*mx KnRjT_θi~+bNk@g2O'26+FAlmȗ<"ID?ER&:BPkSSol5H">Ö0T3(B00 ڒѴDιLzO[Yld1nq)KZ2"EvUWLhoАTü@^l(!e`} ?$hj B'8,I;{yXV{kRC=K(8FIRg o[%^ڶ3E8"Q,f%zqq]_ՆYƱ"rqn6}I7loÐcf< Q5 `d@ +/aAx7Keʶ=8*V6uT@Ă.Ud8%܏8v5^J;# ZobJ[Lr ,5\W2{tŷ|`L~V6H$$>[:P[}ee|I .LKt+̰rz#bq\7bf!\)F.bowW5 צ U 61W?X5Tt[Qo:.u y]$d&KmV&#($Kp??.ffr BUJ>ƀe*,g`5&+ʾU]g;&'#ڜr[)ۓUά \^{uNUoqSԀtM@p5\z3_[Z ӕ%.QXأirH5ˇ3]N)%874Č$B=#_fdq 2:˴_$Hn|݇FRz'@%FF*1ea?47mzS/2BL-gj/8,)cMh-ǧ>A1y؈KY+<AkOڜEf8]KmȢ7\<c%,iU֞o+~}G1`0y˗EG mVMyMygRyߤW~zzKɫitT L;E8 eA:Y\pla]uDotPH}XR)Lr]FOS|64$vrK|uwmj?QL?tQ.,1^RLO@ZD'yҿi;,:ҚƱk??2$oZ0Q&N:&* i[C.y/9*wĖC1m%`^  :p~%KlE?OOaIOd lL+VxpRO_szz%0y9UOUw^<kzPٞ%tg`HCxbX喔-L%E5G7漈ՄT>$ϲC#ܭy5fzCK9ԯ7Ӗ#(  k)"ҒsZ9^ w6blA[q1{m՗n; qQꤿ}0P;7@W߃|`1h4^$:?BG^8=sƚ͖oin={EhiON=$7Gt9-ܳ.a/ ik2+֨q®w9e G|R*7GGvݚ8 Rjkq]Mj-jڏ+5U/gt^V aV;蕾 L{FOsI_$soN<3ߵ3]qi@[Qeet&KQ;xC4Gid>ŰEo^DQqy*p&#ӜT9 ԛA2eT:ŋFn Wz:J[#z7bDx:H*`CJM3P^5շqEXoƍŒi :ha{aQƝ`ʆOܣ=0s{ :-if TLs~Cey"̔?r ܩm|FsyM:6cKmS,\uBq~²w⠩b C<׈gwg[8M&k)b"uޘK$Wh@H[̩M/KEI'սuFƝ[F8dm)̕S̗``Ks_,2P"`,юEf$5 Q!\M^@7;Sx$9 ,-BETP͒w:褐sA>fNZǚ*&lpn3|KNmO2ҏ1N%gO$bM,4',@n%ǣVOFwk4C6/{hU[} ߢu>.b6MON*4 Jp'qBҲ wYohf߈6]AT]QSrˆVZ\]=t6ɴ6TWn)q~5u{ l%9Kr7CH8 HZ.<v)H`(?A w̌Tۥ1^OJ+ M6m˧#nƻ>R ڿU_94Z5P@'(8"1Nw.-q ܭiB]`0`]i+]~.xu6;LFk]z2<뷕' C㺐"]25L@| IĠkmLk<rnW'YVet&1N:Y\z sKn #_y}MoP >Lx~' j5|#Ы#4'TF;JKPÄzy s~A\R@䃂NdgIzxq9o!) "/ i? %fYݴHNYT`OGdY"?" (ݒE+"Lz8 yʪYߑnU$I<[=ا;A}ɱy9R1u) ,?5Z&TmSEY"+&@TJϞ"KApV ? V#-{쫷A o*"@虹<&bJXU/ PA Xh{X/S ! ?dk]4XI'!ڰPv:~{m1%n"N/#ώ[rA}8{P8}G!h֞{i]8~9yL{#JQ ]>xtnoDIg`x!V;0#GQi:s2ݹc($K7jUu~㲓 +e"gm"ݠj<h2CGۃa[eX7y!;2[Mb@NL/O~ݰ5K;K(_ aƏXv|ȬڒkH=%/=;&CwN. '@vGw͠4x"9!B횚5<:gd '+FuقbRN9kM^۔'G'x5k^:vtbI\05иB KSMYO _P) C-#يߨ8R',W^c;kTΒq5oIRFBx2=ɸ6V!HO1K0jWac6PW =ZEDk[NnCj|@v"- Rh0}t&I-q,SoÐabp߽I#30U !ύH.hh~PY~z X3(|ޫpFp Qh*ȸvIZnV2:W$Ed j~Vq8F j@cKkєQ xϨG}TKӨл Pk"Skѹk^wU*ZKVǬg@yx zfriryѽk@Wy%%5Vd n( 9C"N ؍K^CEڨ1x0VąQW fjW}26<,*2fŏ{q#'.U Nb s]v/(X|Ol8 )  v0MtƆui~'Ête/ߔ! 5!ԾRΉO* cq8"ЗF6 Vw{[Ǐ(*C' Vabܦklediy-*pxE1, }Dذc.ZME9 rrϡK;?cR46Y g"z*6%e5Y.AIN&Υ֋$J)ZJLﲁlT;*n>d9k#>=pȹ\ USQT3x'/UMh;r[dßII2F2_}EoΪ. ^yb:wNHGe]fWIwƃ@r##4j*) `o\q,@$OS4;j\eO𬿳¤i:i-4tgF"FN'nN.3FTM XNNG3i`ءoFƘ9\ٰ+'&%6oy\zĔ$݁ { l$`&"^*WA 2Rѿ?_2izMEy`9%>N SviBf }q`vw2K/3gQǹ0 #:DM=|r&(Oy;Wb:[2,}M=Qg5i,N).uތ "d?6ÛM9N[cٱd:_6P5Z,).D 4Ɋt[N;8ˇ@R6w2  fM^WaumkgZܦUaU_  $m]HM Dz)p_)tх2ܤͲ0nk,:Rg]B+=x4I>?l{8U7;^4Mt#,KB],A@rkn\# a%5a/}Ҝ؛ȲgMWaƔ%`Wzg0Hj,We6G?,<| I" =Gڧoo iV^BBkw{֩on DY,] =))-Jrr (De9zsJ(o8~xmiH}0ڤ?7AcNU1LieUc@!Ph~PV,*ŠQmS;"JCY0x<10 oZm-7wIY;a82Zlm8? [ kWh(r7y~߼_oe!9YBv-LcެXtoCU6}R NAıT"lƙUG摚1mdna'`7a0g! C:GxkxL=Kl(hSl'M,ر!~Q߈iQNfrՅޤ^w%vke [e~b/u@UG t-YtsMRW)8=4k v$4k"!הKBd~{pb(|%y˯]v9qiOA[΅ .!O7Iq6(+6a2Z.oOB:)8JN_W%x?OuWdN̜@eRA)} {YYb̞ر~+[Z_pB~KAAWgH*v1bDhlTY*гӣoVH(l]`@@ވ\1@dM+@\͹Ih#| %z+56PrAfl;hOBd׎1Jwmh@)^ c'Nɪ඗G:+v Qiė"*+vnv^ 8ъDC>h& 8'QU}ve;~tl?ެ7jD5#"a4AzmHy):!?8k7oLg툪H=Cz`K}if![9("da8ݛ!>ߏ0RxSA!-x@iR{Y4 0+m[cd۵E/cq1;[ -<&&6+6K_4mґRۓXV:]G:kQx֐=w]6{2%歇:>E@'/WB\ i]Y_&w9ʂi_4d_{3ϕ4M,JQ 7T;'CjT ~ö]SzRyP ёݓ+Mr$iAz#6w#use]!/dn }>i=,"-G܄Z15lbM Q͠0J58It߁QfS! ehP!ρ\8,I5#YuO%'iq0ɠ˃ѻ0>0L,mBvqwdiXَMEЙ〛)QV-k}JOFPW_ؾqIdWcZ2iEp:*әxMl~˜|I}Rbe0ZqQT o$YpZف%\Ic5:d꿊yeԑ~;O5|%ʞ> &7NH N>pi 4zYQ+h|—MըA]m gV6 ŌW" Ame^ w7W҇'$$Cû5<:/ZV-IRuJթ<e^Af&1ְ@eSsTbt^1 ~O@a0`7-Hax~ȊaKl IjT b KY} `!^\*V*ٱ/4\!c"Dj1κ=G?Y$Y{ҍKF2_\_\ OW} ooޘ$!eS%Dh|LU:./s~dZNL݄Fx]XūYXf׺  ?uneQaQX?tcA+G,.ӕov 0oAI2:P`4޾!n <(sjri˰Xd, -$4ӗ4 " xGq#%kA~YBrQڌIjZR>=8*U%xC}mJ|{V}p6En =&9hه]NG"UTjJ%- v~WR CtBOODZfIµ0qFNJQL)/7L1n~NIĈ+bأҖ?,x#);6W {mn\L\u3! *R^lSq'Eծ01+Vd4YY?gs"lhZmuV wݞ:>UlGT6o;t?M[p=; vEwUEl܇ S8ʮw 4fI RBEmY`* TbEbO18pKkcw3U{I] k5!+h:\ϭ SjxI}Bp;.% sqk Qw[ʸ 6VU| yVjh.l}xFp@MAiVp%μ&1i@5 >g9s BcD"'Dh5X2ú=+V!߈D&Z|Cfȝ!y,ޱY8Ÿ8 t$|pR9EǷ >^k:5@q/cҷİd<sZyk{*릁J v(W2ZPm+t'˳C)<c_Eo0{ 72ʫ~S '*!S`͌S.YݜWAJi V>"I|bĕ0?=uos!utNIG00}x"<9 J3Qv'y~觯6VDnO֛ܫ$ s3Ǫ2: =Iehp7P bsM(i7\r,!Ь՝/ʯ'ȱFYIXFOث CC+4+N hF>F{p5:9xygAzՎeig~UeYb9ca>cypFa]Q`Tn:Er'u#9$Bw'^?ze-Sȃ"mCkiߡM}ifVLu}Vx8;R&:Us83s6w,wńpzg A̬.S@&~Q]Lɔcm9!b @宛?(%KT# K[84ߺ±YG1[/TN06cW߿,e*3 !jZǸ$̝zW1LZa'4~¤K*A  OPcڭ~ ZO>5Y?nO(^dDm^k]/WUi`;oͯ^&z]jYjcZ#}KC,D"XQQqߐ~b2L{Q`GXZsAu"fgc_ BNMi䣚э8ipqRt]>8avFY > Ͽ옧0|,a_yzsfw[e[D~z軝 H3tg9c'a`]: Oyueܱ/:~R9(u5ڼ'HyɁ9N'hM,3|CBZ{Xn:`ܫk!XAhڍrʃ_20"?ߑv+w\Qӻ_~rCk~]_1RcH_.໎*uLfTȵ΅kG74O`v=쿜JkV/Y(Yœz2//FY@2Bo_?>T`F95;'F %=VYG}3!=yt[ϑ|;CsPj*Ḥ.QݵW^Fʡ% 0f"Y:UUQE:Ģ!8g-- 640$m[B?YE\s8t=IN{< VIQ }]l{mW"7BR|OƪzJ.aÖ1Om/e_>dA3RVX 2 Y!LCLj".Qds&w3x/> %Jm# ze\5ʚK(t1T5|yEİِOtm'bЖBDvDp/4*t-0L_#tT4 !YX@mFZ!Tg}%rW"1;jD,}$kaHm?_$~Rs~WK K7Wރ݄ݍ8߫H#*Gb]8w^MoZuUwX`|*q901]giCq#~n5ieH |:-+Dbʴ/H<_xΙowmaѿH(%RNqtN`?T\˜Y5\F⫰.ɱIzsIʣP}ewDڼMT3?"&&le `M3׺ 6NQ=[a$]unQF C9Rх<býV3sv665I 쒖,t }E܈쁅1olIT2҉ `Zέ{ /n.aMayҭ|@fkr 6f:;/<>_5(@E{unrhԱE7s룱;UZҠ@/Y7e\ +f)1T:z4]Ob;T\3HQ\61o."k:>1/Xgc?Kw/NOfhR) čU7jѠ;]OSrBμspZio3n`${a__i|b?[1?r>=1Lgt8$~m'KjrƠ+b_GwTXx4Fz2̫5(8(@%.J[F02]ީ= Ogu.{qLXT"D GRF>>O{ f 92#^$H:€o֞Z@j_Ȗjzb*;Mgn" ʹiCo4n M͋6`g.dШ‘>b&'t F (x;`$WÕj$Y:)k؛bxpe6^&ft}5Ҵ2=e9@EdU|`t*uEsL f.ڮ׶FPG Ұg*QL`(2>y`=9s< 7jv{QYHMIs^r>ϗӂo,B]_^)hϴhHE=k&G; bݫ0Q`$.d{feCv"Ը G:ޯ"zSd y9ҩ)}1L#KJ)䎹&aͱ~PF7[M\ _R:ӏvkWYp'fD'8O XGմ9;@PCJgEI3\E)d/#DcIqOdM\^̎Nʧf(>T c\.C5Rn שM|]cEkzrIlr^Nlx"D,9m<<M*yHLo[" FxzNzfjV<uLìد<#Hשq=b-i,Bdkp|9&QV/dSəIY{|F?Qga_0=^yơ+nSDطP9OƓX_9bkWz0OQґQZڐ!Xbq| δrǶl`ԍo- =5,: hTJ9s;—"׷}ɍcy;ly+ P{ bvT."aGP S:1YH{4$@B^`X3eR 1Aq`aZe숭47MCxح01"]\z<<+k5uXkh7eXܧk.WPa(yﮦ*gCFLOq%%f%s=ɑ\)A9#dD,𫔋8ڥ鷚VxZkh+s"k(z쟯pF\#4Knrp(Rl񽰋:GQFmǫ0ۏ;!ڣ (/B2ޛ^3 %IU!Vґl{< ~'+V-f}sNf=cP+q8 _s'x[]'lO͞{0*NhqCٶ{2znMh&us1#(:KCYXWo3u{vJlF S/k w$ ^o|iwiؚ9K­%YצH?42`܊́HTuXגՄ)RGd)OL vƘӡwm)wd#m}4A7G DBgT\s3sF{[0ՐRx 9M"ޭ\{a."3uO5'.DcBYj! yCR]QZh'p w`¼tr ,O6GSO0uEՉu8kOĽk XKۜ,m3oEw,1(. o6B KEigV9wċZeVYEoZFP^E Tҧs^֬#rqJaVf1k&<0[CV.kU]˗;(܄fs65y6K#PK%-p3vTiQ͔^[܊Ӯ7FƷ^eԊ Ũ@SDA'9 ;!J}zW$1D^VM Ł;q_-B\-3QAW[*$\$i-wU64<uh|'ֻ́g |p)bW v߫R^ZԒ4#zc'W *i64rR f )qb8[3(*?̈mx߻)NqALSiYfhǍ՟ uXb0Ht8Ӿ0.M=/xށXq:dXZ #jfp!_DsD)eb5&9ɖV'% k{ >ԎL/P+'\82tXzĠa;SZ{^2(SEƗ^RC새IX(uGb& v9> G3 *߾9̶:fJcάӖbS}E;FI=(e D\D_϶9.\:fl ARh cIV@ C48kizU"u:T9&s}` G#zI[ lCZ_x6N &4Zf$I~^=0j3ӻ&2#"[=;` vp Զg 'V1(W-ʬkN5!s"ۂ6U=0ܼdCY} |GՕIF\Lp$nd+ؑ Aki#5<Ҳ"Xfo^ð2 w. mn2"Sn;8eӁfMJQLca_A,!241hEqy^ a#u38Uf>TGazp:2Ŧ]sԨFM&kLJIK">7.V{"0I O^t~]4-"QfHVj@8rќWˁVSI>y5'YthNܰ!|9gN`%)0Ky׏!U8W0Wpj3_8@~8er0MېfUxz),lD_ߥmIzU1OHh^0ȩ"hRb?~U<6dB/NZGriu ؝PnLn^Џ!MOَ`FJoQ-O\ BoGw:_ 04EV1vvZF-=&B&*ϭ>A](!%a)j_ŵpf9C)Jxϛhq?+%䜑Fuvܼy S}~xs' +C<ߥ!%T#K|sN  [-p7YGb QO!S S=:N7y0\ KzF&xn2-ȮN/ >pʂ!AH{2;-`0#C$l oH'ǖ#7=2k">40]}j̣1x4j lpZσ"5cGtA3.MxMQK!ݰ0ϟ o&=-U2h;WM=XV%nTEqo""{>lH?ezJKQh# %?ZZ{.](g'@\:΄ݟOlLr}13MWяr1>n{}-V#Tp.xehgZ!Nmvbt$]lRɍtWOH5o*7ځjE*kt-q$x}{`N@ o۵(jx dnpb' '@DXsg0~G^VHT\-VlzSJkBʫ,+ JeAGf1SFVwb}c79];U7| 9eA~AyӞ{N]Fs[~4V:ۢCul}ȹ76˝lF ‡0i"{g);|Ǖ5Gh> QeעfcSᴆ*WlZ Ah. VؘCPpM)sB6}ϢtaY}Q3o,OM%@ў;Y{ܲol;\Z$qVSW#T!~-Bh5r%beU·ҍ VkE)z\(N~9`|aT*PWOqzaӂE`k*jRHGuG~^sJ񸰬I}k}k!?13kfZRai#n} * =Jŕ-Զ:o1y&d4?;!XnZ (V' 9V%c`_)91 B9Z]TRաm2za8JI5 7a.gȤ!ą7,gQZW$ \Dy޻~;;;h!*]C[C?^߽oHл߯0c8Ubpe|?dz\ɦI!s@I9R =ġ3:+qhS):Dˆ ?bN GnC 0:b!{6/Y$ʽo@ Uv|}Ss$#ǹT;"e#;5(am>QUP<8Jş4u2Jq z1/avF >FD2P r,L窅6>U+Q}XZ9~ QkR ?`8}q ;xXcԾ!Oi Zk;awlÛHtI݂eCJP1ñЏuMr"DKҟvzO/!yR L7>(m#qXƦk>DtS "w7VWE@paa>B#M3黾=(`d- (DMmfߓKϣv P+n} j-֠ Rtsg7%_"K!F{' ,~@FĔ .<38 _! +>vlϦ=jHYҚB.`n7`Vlqg2(1s:pV4 8iEGx|f=M i|.o`|2&b =u th"څɡmPz$8sxW%*'D[g<ﱌ<,8KLo#vG{ |"92O]l8jk~R37$3pnPeZ'0<1kC 8WD(.UO¥Wk"veYM,NΜ@AޝwKB,kmzNgߒF80`Y:p$E}4ii}Iѡ]I$a<]BJX2T+a$ jV$$[VyH_L*/Kjbʳ.d f\YvoX7pog1ʺ WLF}15Q"rms="U4GOɈԇM'N du"5 )#=;m,ٯL![?KO 6ͳ*R)m@e#Oz^fYW_dEnTrjmw-It5QHhK8L*KA#I-v`c%3bD*~3RpQ:ROsX\ҏpHxAk{fsΞcV̉׸'`-(?%)-vV&WɟРJˋ6/MhefӔEO57k[jO@6Nj&_@ ;%wо{թ̄,W;kr?,,u>b3(sOeϩdK]BXh\fah/+ڄu*Z)BpѨ@o(THu~'jN7p $aze#ya5?9Ck| aOF,C͊+w.rWz);;D0+D M(!N.W/x+fw# !Jџ‰ܠ}Y!=E=; DAF[Z#']3fu=F^hrlv;톶dn1R<Vl®i4P5k i+:L>2#>+8qR#۱;m`H;sQ_hZu+tVvNܪ[$#wlt`y 䰛fCßIjB[vϴϓG(j*g!l;H;PqXeN*nb0/$NZbna fO o]{)P=w$qM}/utܶ⁙U-0~gJ"M9?a$nfߕL/tbv5# M΃M"dUmsW zzvm#80?+xok;gzn?K7U@.Wp'䷱&vѾOePWtڏ)TvV?F-lEeLBȜM,En:f>%^.7|6eّQ7O,4/1kaYN:Ngj17wU]ug~r1,;$Eo)l8#tSNˎt6*tJJE9tMB핌,Ō*H"T9dv!]bnu#0!Egm]5I1Bhz3Yu$Rd `y!i6:֛eeb~a<ɾ)΂CkHBaRAs\D>U ~8vH!3Ct'(3ʷFk,x&LQ ѥI;KuSB:gt"kdg-z}p+B.P#d&Y,n\m͘ \-ñ͍ 3ZYV~H㜯@밬kmB[UTڂ_q%.ߡz9&xC`DS78MGr9r~∣3Z}G(z!cj5meO?R\1JMȲlZf~ E=o2.+#PgwݵɨJ^N"7A8Pe$2Zޒ:#ݮtQ $ZQ?^^#sE^BÞ DiUk]"%^VV?| Tˆ)=iI˩)B+ H&Mɦ|t&(]hIw{̄uuϼsZkE邌}v!D!QCS)Rʲ!<,95vkp[yeĝ5뾬/WEWzq=ʠ`=#Y2Nbcl>DTCy$}Wɶvs͡}t(7ig/5sEB,: cL ؾ9y0i\_wG^i_x`) ]NDnPLy~5Fk?1@$ `qpYPZjU"O:=JzO_e,#R݉,',Zj V*Nf4x(RXed?YBva}S#L þ&hwZnO+nWwՂZ]?:+h_tjqzks)F>HvXu 9$+i]> C@uK"S؎^\ oVqLp)niߞP$i^& nORkҥHj| QI3xhWH_#EPq8J'mT|2Oƺ7~-k/; 'hbH&G@:课evb\-]5+C!hݲkjᔷ3eX 7č=qb{iUJUC@F%Lyul4#Ñ^9e 獞}k@Nuc(8ga]b̡3b&'A'ԛv3f ^:lx4хcjw )z^A3mܿi!Qm,e7<68Emes(%BV|tlQ2 ^"H+/+F!&ϐl1<(ᢽYdxQnPR`o&6A:oE068G*&4hR{T' l4` 8T0! ev]OufAkLamaگ) \PQ&{c6,rAZk"2XFuL+JN}Oesw-6%nݝp Y_#ˏx)fzjY]8rjlz )펂'j;VGJaWqA23μ :5_C~%Z 1 M6KN2XP7v3`{8vH8AQ.nisteRY$gIFIgξt; -[8B4\HMt3`cU_K7)4ɻd%YNĜBdg Q `aJz_BHC 6‰=kX2TC<;|ӄA˯mp]=41򡨆|-cIjwЂ%5*ҵm,~&7fjz!^Nof Fq@7G2ȤÍ1 )xNXgrB[けhվR]k|Sb©$iq)FbN.:ڧf8l(Z!*Jz53P$Ë( %󐌋s]9ӂվMNə}6E/ 4ۤT9pF9Z ,~R0K*YDm5gƝ ׄ5.C!ªQ'ˁG+Y::n( 5mߥK_#TKfnIfs+T 'pml z\;vVoiX<3#'Im뀋ubuJ ujxE}~Rr9-^.N,9-! g f Ia2s.njXr&ne?*z.GzzfLԆB)P`ucݼ*bN+֢B;@r40]C7P+BjmT^ۧtQn*>GG7MB?l6 V^B*ˈs}:\>}Z5W_Frw0a)p{=+80YwSCa@Cޜ>ZDqgC.Lh\Q:S}E$"ԞKkAp͑yɴdborO?{ H펛G0s QF+4k) 5r `mo{̓Nt> n v+>\DKf5s"78kEkcIT~TPV3JL' 3*;leڵOcB>Vv?Е^ّW3ss=*ҕ.?%oiMPd #ڪ4=+ 7W)K]Ρ XBEaY30(+%MU"47 #Yi4v1@n3@ ::c!TřчmwKj[0+9Emx4!ᢪ!„/)0P`/MB9A7)L#MѨCXh"Kgg!o:]9s\PcϗD@@[H7дtNblBU:Ư;^}sFC̵b'V$X߈+yߑҦjN!?-!K(ߩu]Q~6y;ô̮ҥwei (;~E\>jB~ZGS(.K; (zš qGЌ۶V "_ [UR'v"^#dm>P6KBIZ%NY)X[D1ml;z!M}d> '< smsAT:1Mft0alT nn[%63KA}4Еr1BP*-bkJ#J93ꣷz+G)0:WIu1NP}n{Cv{jy%Cd"vMVS+1͓{5H: 5Ih5O5i ̾ 2Nj94_0dC>2)M kN)gl8ި%X(j*WgAWnj|PPvUί,>D!6>< v*<; u`l}ꀞgHdvˈ7 ac%}L^CŅ-QWdme6;.X sL)גǾLy2SGIoLUMs< J@=Ud N@gsDy_O+$aBVdG?ǝR/[cdx݈ a5|W x{IR/SnZz #7mVȚׂD2ȇWz5, zn>FJj+&tl}ʛFHtkIS ixIۆŽ$ E:ElSU_tfE Ѓײf'rfN;e״@n1 d*D:>V>v@clJcֈȬKηs= -%Aӣ"7x{ɞ{#H%#mh C-*XQuRv7$ lc,O>h;R!slx / SVXLAçP} rRCk=ZS> ǝ1. w}r? \ 5&Vh֯[1Ƈ$N8^R&c?+Lq&1T8>;$n5gR4%S"6 s,`96`h(>HPlT};5% ++5FnzYKCҕ&>Kȋriڪg/g). wy Ib"y~T۔dn'M 6ȄX8,x6kbY`}{6.? v?5ɘ[9P*#V0Y2h:bYU2n? m=ϿAv 嵳lx~ߣ/.3 t:.TFޡ~ /*Q 8\P#yõ=Θ-v:E?ysψjbfun$$e^#Fre1LK9 ;8g/lbPb$o+eɅ䵪(H\.}*1kg3bǬ˻v6TtI !ROj!놞HCf/V2([Tpj} /sq7rraɽj8v/CAR_P8uH =D¸zǶ9 49C?%WFotȍ F@t`{akSF ==B[{l|99!|+ȅQ5:AbSnG(@v̘\q+b4i*3cY {])90FۯT8 * *}tX ,kq{AfMXu$}:ĨP8ϖs,Gp, u]>|m}jY,BI]K34j `GЫn8k*?~-C-s(߁nE6v jLvPWRjA$t6j_:T˒~ 2o`%JwDEYpZDN{c x!b .3X06QA\QanqڶDH}s/ bl/hl*j<_#b%q9lMU>.Pn'QW2]-T m V52dV1)gJch5"[jݮ>SD;A'woӂE M3חGv*E~g>DXlk*ϣ5dpXqeHO.Ho9~ÜÃӛK~_@]ćncgU qENXq_.5<{GnYy>1R]4`uk5QXe5(t9)urE2+ϭ@Ӭ6_A{:iRɆNl  CYoXϮYa_@ /Dǟpx~YO(DMKS" iQ8C\kVgZb nbI,'w/W-z֝(؅'tzcRrp2X5țil ʆ=T8NH=2n)8Ї\ؼr$;xƒvmb[[ԦeFA\-l'>fqlgW-FB_{ԫqo^-RE1z_VnmkRz(gj H_bvV !aK-lQT2b0.-;S!+'HOc6*6 ~jxpeB,Y51|xiOb 4Nl?y+@5 Y_6X'hF^ōa\?* >6uUBM&R2 k6/4̶PZk+F Ϻ=Jԍs|<ڛp ՚ mX˴}$ac9[ds@#7 `IhU9=S$y k\IKTaWqt"Fz'N_pRqqLFZ[?k|&'"Qc%k Zqn 5y=oOY,(rjQd d*&8]$ qPUҐ UzJ_!4#=))Eo׀& nMt+l15d8,;1x/&hxȉO:W& =pW 럖{ &_Y#7B˜L7 8-2D3,Vͼ`dr M됕d*ocȕ;N.٧ =6 ;=ֈRtjF񻛂ݝ:Q.>j'%rLCQv_^p] \j:@j}[VJ{W>);f(~[_BnG_l5Q!|!#TʵQd;ysɟd%˨Kԭ>Qv"x0vՃ~^*?56rI & ^OAaÔe;Q_2skcu):!T0Dq3b]ƪb{zݝeK_0;0^ϰ^kRtyٓ2F Xø'*ti{;4Ăm4 1vIV_5*}iS`+zsXGNúedw9^\O=8q7!wQI-ɆQ K/+%" ̕)s#C~@ʸ*LB5d.$ #&2hzjm}4ρ5@[}_ 9 tȌb%ܢj8 3j9+(dsj稶4+WUR,͌k41pELb> ,-)дǦ\J=L@ *ٱ[W!=LrbU,5b7nx|[7"VyֹK<`5s:C oyH_C P"\?4IW<-O~B2L`]-0tn)p2tRIё#7H] R$:PϸW$ROW?$}2g?O`%6\.\ɄӈxSMl*6.= p5I(b#?J0h7`=?Ϳ"E\A^zޔ2|ieNfK5Hĥ$59MQaH5A̝VҨA&XI fszf jj8h(DU %qp~HȮʹhŜ ZQ>/U3 ќ5uKyNyPJ暑 9IJUõ#$ M%*N`)ذ/3rIJXtTS5t+@f.۶>a Bܪs,j޲K8l 80U޳fHC 2)?c>JewiX H4x 5;'KOuXY :gҍpVn&f|T 8=싁>=*+Vhpq=9Pk&*[:xE;n 0_C"X~ zE<|xa"hڒPE=[QSBZD W95l"zOSnSȋזk(BE>+6[]i>a1Ib͹t8=W98.QEŭ6gKZHWQ!vㆷ@aӵ]P}VqP=Tt.^P?&Jp͟3PW}"K97Dӯk8t_ioQBT(B:gT (ʷ}sM$Yj?UXMat_fǼ:G`3G ; ]-Tp_` :U4'Uʔlхbׁ$n*Q:gCѵ+@/!X e7&NcV&J Z꿽IgA:k(X>M  6d6pt>.´F!&̼ZF7og+0ɱ Uy>%`- Q6s62X,MgAr\\&lX cFQ4ݐB!S;BqZ(gАb7 f[,t9xF  -$g6%LC7"$qkS|q~>aqܰkn#VOZ'U2\9N*PV!iF =6\(1?mބXmWAyӀWҿ{?'ɀ'B:MOSȄ57+ K_֊ :lN (r_iTgQ@@' z37h)A[fK?þe<2ɑڅզ#M/5+Ed^R)q-ƊNRPͷCEV.j|L_!dũr3-Lw֖ mJ^FIC#`Xz,@*ϮQO zfIsrWm(G{z}& WM=g,PtqAx%sQsU^2bj;ʬ2V6ĕSΑwEEoz_I%4DLr'BնY,>[0 I0Pg1NZK2G_ ؋^,ԇJ eVU?^ :~>-gYFK_3hv?hZ)QJY^ mHc[vxNkDP^bnb8kp 2 d ؽgΕFaws&= g%[&$ao,|chQIJr |!l7\FmZ(^֚VB^PcD4,AN !,'z̀ws!ŘG%᪾s:_/|UB@aa^u+KTBEH9"^@*XI벬MW|JfupVbFڷS27}KOg spG54j6<|k?nDf* 牯XLdO\Ϊaf'p  ߑ}E6ٚPvMId^, dJV bŝ grdlE!=+9BL p˴t[KO1 tL`1fTM6n/gǠE,wfGZ:2{*Y Y q62X YRwӘ5'/{>0s睋8JW[XUCNFeG8I) >M],avj%}DH/!^woih(Ů|u#sApgkލA ς;KʈmΡ9xn7vH$IN G?Z9 i+(>齪O2H (\P HVCؔ[>SEݛN1D=UFMXDV֞ r2K"3"heCtlm72qMr|~%0q~.7~QK XeBtn7dh=Cj\[ҽ1x1rFCgB&;ֵRhrdpbbP =-UCs#Ϫ9Fs63\N7XFMs>BtIv_*nvfa5U >UW‚JyNz[ I1"C2Xv*]GAM 'ZݑffaW/[4yiBK=:Zh)BթXwC|ia#ܵ 5ӇQ:zvh**Ba'F@u /vnm{~"$BQW-*p%<$#B#an*ɤ[5G?ww0P*VK"Md %X@'InǴ8S^b~Α^JZetqR[Zr|IOGZ.G(StRz_6;d}]464(e> iLA!`)́,=Uܚ,Kz_!N^&6 0V;K9MSd^-sj;&NˎYhlx zcbͫڗc/~-8pjCl+já?$Tm܊~OIԟP.?,,Gƚ@ }d)ĞjUb7ن__3=Z`˽R4~9R,13UgLV!=cu Ɲ IJ>I~e *ܿ4MeZف‚X~0h26`̄gFh 5PjxϏs5J}pc){{'jb4ZF y'ͮ3{jp(C*ɽ%Xܤmf(S]|b t)1`0,]田8)#P؋o[]vQq;ï{? }u8~st^BgʴyI6ҹ5qH5>oq>آUsuyD{ ? 3[cU2gn2d\f2}^9{I4WcP|/4Ub` MZ5I6YOtF2x/c`3'1pdG@9h PggJl OLAH6V{n)} 29;hYNcN%);!RȱEL$̑\9Z<] ;htpxm訩pM&E^Q)CEI(2F`@_%~uY9T.9>I|oWuVз/(p!8xaЦb׼k"1eԟ *$B~cqSZ[/ΧQ,T9=eQIudc^1sRf|Y=2Y7 zS٦蘙r=(;}Ymy6@Q";gLҭ 0#~*zWP J{ɈC*3;Yt/|ſQe6h{S$;pM'}Tݑ^q {IayP9c:6& |HP@C׳GK]Q9e;~p5=Ѻt a#sRmv=*ȃ;:/yσA;s R"}ZTtṿǕ5O/.|@Bg&é.n> zx<9CN4ۦ*u !gޫrl>{k"KV(39bD_3N剹!fbd rYG-ENAjA"d2E %j+O-5P #R}7m D d">.ݸW Hv srdԱ%*_)gkg!jh2rѱގK.HTS獲,`mHgo0mO>I?2oҘ /K\Xb(X2%94 JzoźgvSgq;ZY ˩2BN!V*U SVr76} &Xxd1 i'O8?a m'Y,7Z^ )BAqJkX6t8PՂ!g)l?M>dU@Zl>⣾ӷE|cZ\Dw5+K |Ar=|BlB˦`S騹-#J|0]{dq*x&5pnOS'K jµ8p$Xu$X%9x_\,VTDe'n\z#@iytkuQL/;a(n;Iᨮ5cRb~C{[G0/ZZ 4! i8}2J~_BBf3Q$0,ImVX#ڻ ]L\kv}O r @=0E{S@WG#W]4J9h5XW Jv.B$p`E{MsxCW[>qww܄ds~w6R~h&$Nt3 GՏH@,,HMO sLTmCBsaM7F6K o96y濎xScْ;3F/*H M&$ WtJ#q'Ez⚲ ѵEHZkrXoWV1?epSuNx˖8,^6bdfw聍^+wz)r# JR!ݪzʓ7O{j9wy{)/AO4pH/1L(0܇AeE'(K>7X )5w.qpvm])2sa i.I]':op;׳hiM)qOa} JZ,bmTz{~6~gmtOH^H=P~7:6#cPh:C *eҦ vz8>MDmC DM VA^4;3uZ]bSwيRH-Do<ps(Tw{i:5p[004+\L}qKQs߈}|0`mj [V$uOIv:?/]g i&Sg`,z6&u'ZJ?jn' gD&:HEY? eL^PA2CBBqlxZU}w._cI}A6$_P@ 4x1S$j3Wd`JnѝNRHak! KԔ5go^r2j%'7*fdrL9Ty%ا+Zlwbbq f>(zٕF"0(cx-/ꆏ Ό9-Z朘YKHg_aKq*nΚ߬e{GT[,3>pJ\On_=a`9pMAo`8c Jn[(%҇fM-Vvj)ɹJu 5S%zb5WsX² /& <:b=I(ZZ2=brY̑ȳ~fK&#DܹK4ڝXXL|lգNP Qou{퇸ߵSݱ+zj†&_Lɰ'gkdYmX=TF,;1scƸuI2h]d1C pfeezVhB+&u򺠛C7~_ZB̜u(md|x.ݒ2u!uĻG%yG`Hä Q' )2ݥ7eÛP d$\d93as$O5_%azʬfzyxf0-/w^`D]e.+˕&fB?kq/wBT7UfCBٿ_HF\y}VGx- b]p$.Q=D)b j{1ۣ^ Szg"dV^t(\{KQK{0YEMJ!ZO-DlD. o5 5fOCE / "?[Z7;-K,8Oo2yj % =-`ɲ%J#Sz b5O 6|sbWKȹ"g8Ert~ef~乼_mP6<ҁHb#ºW0VVFͣQ1DT's%Pa8wR>vz,vlcrԝ>g^TD0vyID8%sYW_1(װDEYÄM 8 >rYߚ_W DզbG"ϸ.AIH?AU86ZŜPfpTP<0Nsэ"d3e7{ԿO[+#' ahvk[( NL~1.NmKAq.Mc}M-6;ڍym@34t{ZhiW &F& 'j ܵHt$OxXI75:y 'ے1uId;`- -z#\<Ēhk:9!#ÜZMgB=tT#E.){4_Y,I|4 ll$VdrjS5I?4+&kנc Kw79Fһ[4vLH"(iw|:R"i@̅"Dm!e^@b7.)}{ Ge+;;2S+,3[֋>E'(5`qzؔf#Y*)]!1r5!f:X8;fceddaVubm'kcid8(% -~vZ$sC f6Fdj 0zc5zr39 q cb^x ظ16^[e *u|4NE 4O_=i].LXlVNMR'@~L*BX(r9S`ʟJUfqbIya"U]E%Y9rp&|+u\FǔX^<1C0n}?0,lY/ ޑK;XbFj(AMn59d&X'EqF-ib"mZj9`}(}+DSEB,/ Y9cFx54ԞگH31"]и,.I gdSXinρQTPg&uO Yq\?Ϣ “WMFdm'!I+c0S]=&UYKajtr]$4p)97D`"y\ul0Աה.˃t/Ll䁣s# ؘ⭢q@dy@>wB+N,{9uAl.=ʿ##]T"za>HBH#%m-ƽPٮ/ĹvPǃeȺ0s36Q.V~C[XIN'# HĕPP<.MWS-yyX? {|=/e_sz>cB/FP$Uch?, i<ԭ%-HQ t ʝ@(S `iL{;UŃ弑qB܊{gH]ZW;"{hY :$u̚\h^P_`b"# ]H*-O+; &N+珼xBX+S2~m JiRxzCCDf}8a_`D~2߂2%6ዣa7Ye".n/9F:ћX~6,+I7LxwQo?b_EclʋI=S\c>r'-:(۩|V;#AESĭ5{ "^5^L$,MQ6;p F嚍ɊkZ[X/38e])O$PIGL,A[43i J+k`caHta7g]Nl@-VՇeckwڋȇZ;UŘI(%UZh21_;0A[4[|\EAs+ss"6WC(G~AE%<ۮDy&pc^!힬u#!2SXӤrm[>fϩh{) ]ty2 '3!QZtR)@~[iph4&.M-npދc(>F㺘MQwH2J)f~T-E}+~3ʋPa,V҅dA8+B޶m<",|4u/%;rJZJ䰊m.[Gt׹6a#?A?)$zyRM!\2)DzsXB4DUH1m+H :qz=s..Z_IE- 2,>uZNk{6Nތ.l5|JaIo g|gE=`WWP%Ti:YN<|Ƌ~*;.JV@Z9&90 :zΧ7rt|/:dd/lz36ן` dܩo"26Z׌6o/+-l l!N%`JÍ:fa*JԽ-}jʯ,=*Tfb;&Oʂ}}6"2U4zT  :S&t$UȪd8Po=k{r!8 |-<5p#VFT8ԣ \K,VnV]r†rKů 2$$snQ 'x 9:*'8K3&q1t"ljc%b u5H#r-6XŪ ED%_3Y75 7/|xWU>R,{10Hsy"KPXCl>{٤~~'`uL?<ݑ9 IS 歰 O]ZxyVGs'?E'HvC '1i5(e8?^"z?_P?vE_ F])ߴ2*̃ h%YRJ>?2" ی^hhsXKEsƪ6 <:HNq(x*c ;)W+zSٛ u "yPK|􊥊|j,FlS"8L D:PESctT"SBVDr>N~ ^K|Ɠ:u&AJ3X~9?k 9[ W0F=%7VPUD\p`Uu`%*5'qulV |mjF8駁~fzBP>M޼ARԢ#ܛ#F zj.I<νJ po j c5 )̭ݪNr1wvRȏ_r{Iڳ}Ftk9 GÂmSܨl~O0H!>1)qOAHg+qN7U5G C@X*73%a Y{"]9I#ч흂2jg2GlBSQ.=Iᕃ!Hk>k]o *@Zd{; j )$ K38ۑS ;{̃Ef}6]+eSuo#BMѓd=c@OH+J]CDLSBo77,#ae鹆B@"ZiNV75 ۥl&*<-`N, uəL@6z#\!M6H\sՖC.X&jviJ!V5' lL=VW"u' WijbY"%:9U#A#Am5NYH5QO/M"uw\LEDė7wsAYdzMJerz2ČqnBA`Piπ?0$e7(WcxS5r[^,iEXISvJeOD|_|E.Wq~Zq@jI{55JW&[59٭,3C67,H7)Ҽ!k7nƠ{];W'-O j _љZd@ yh GvIFiJ YR(<+=N_|+rM/UcÁQ77^bX ^r.7{2gsr^R嘗4 %:-`g6\c%)>dCә"/Ft7PMJ]tf:oFU(ưj}O[+n8GYђ=jqB-l}0;һ:\\rv[E5IcGlSM`Mi6yܜSpn0Ygbşd'&wofLT ÊXUvFRCn_=Xe]%dil0=$b1lYĀg)c2=q| <ƒ# }WŢann~9uFM =Nld%5M{YU wL* Fq0Kpt2T5LRCEb䌃vԸ_88B op5eZbT=X gf[_U,> _i-"0Gq3_;YG.H|iCa\21SrI0Wo_.Qon(|H'Z]h| ꍳNPKK<ssq+I@@¥%)zAY/.c' )3SIFG18h{:E4cO=%D={ &}LxUWuܢF{Gkf_B%;܀ `?0o=%t%qϜP* ty@GgQ ͛ĬRK [/J?tc}&m`z.{RYg:޷L$5YַR޴\ODh^ dNH wSXCT2^@UNN8; ll˰!YX} "-!xb<@U~5S`дy7Ҡ{5e%h8{ji^w}3jExp ޕg X(eSQ5̭2D4ߙ$Vx$\ S.aH+ %UOF WE,(D| cJ3R )(qF5HhGяT=@?(d8! jx\ő:PvcEU+( Td'!J5T2_o@<' ?GkD[ >Xa)nM m0h;V={ё;kz`F نX#&487Z o'\sƬNY8ϑX8L!)Rn&>e.KJ9Ւ1X3ڝ+3Vâ3w鹞\1 3⤕ ǚ[f.'}О_ !0CQtvHIV-e:nȴFYv' ƒx@ N-߁w[m{1[JiҬ;rp ^.PSjɀZEwp?2x bKC*4zNtP J}xеc:hyGFн-k \v7>qCXzeKW7NʉixlO͉Ё0V %Exn|rGîPa4>UUˠYmdx⨦q}E3d!\ 52Z%OaY@zq8 ޾ i [|h($$e0XKFHɜI|䄕+40F&ޤNO9iASC,n'%a}7=̷Jt.Tr 4!2YE1X7>ߐLkSH"񸾝2KmmIJSȳ-@l" ;{)&L楲T,ݫ ;Jkj(kN}v5ȯ9V8Rz`J%9^PR1RvZ)H)V;R|bmAr1͊s0p)v@psר1 (Su{`D0(W㮭ɽMhLa´xpz%֕ʇ6%e6~$v>C`&7YbX4 /[?P&÷d$A|둴FO_x/ҧ0V0 N~6fE$&ZEKˑ90QK U#n|pۗ{*ÂõiPT{FrS=[OС$ALՅ#xP.;ۇ$o sdh0X[5CUl Jنp1x|P3) 19 $ghu=Րs*0 yiy)O|b48?VQjG51$Ar|fXm3-S_ bgwS u# \M4*Hg㕴BfY&wVieε5÷WT(Z@QP: ;BYQa@S@< X ?uX|{BNs g/Wiym3o /"gÉv`S!JM>dQﵙuuӽz h Gz1v%d< 0= "8кDs PS?|ia~z:t>pK`Չ ̀xV\Z/Q|*^s0&Y o]bx4y2b ZE d˜jk^ E.oO/$mv$[@?aQ|^ħ!j AuxL D<ҩGΜf.FS0D: ϑ(U_>=(LJ.&R;iL68_^}زU \3dSVP&|)} i/I wʾC2D6c?tK: I z/hZY|gf > 8}l7AU{8[Kzϣrڏ=²Њ{w6X"ӢgQ$^Ʋ&PY\$@Z5 `ꁏ^[x-͠/ϗo$HkO߉p_*/9Dz*U i8/̬&ɇϽmG;/F}oK.&C6]ۘ,KbLI4'sf[},2y]qoy\Em@dLY'wmw$;fh[Aً^m`ۿE#n:v2Htt N~Ak9-tiM^p]{T)0a 'vx"h`579T>vz*Xqsaz^m"v.dw!ˀl.WHS& |ۚт}ii%_$TˠjBzrx;UjaER6P ys@>қ(l^.IѯiQ?u4A.2XϾQ Upȳзz_D}+^މGAjP$WoNGI߬<$&y9ING?mD`XS}zrR+Y,v.c@ea9BQG?<'Ez¸Ը~5̹ajyYr.)pRYpqҜo{9қWt:^";6cwgyK:ݗ)p*yot?1n,2tj, rv: 3Gޢ1,2 d*zB9,@mXD>zuX?F{T{/5@<|eI%׌d zf1\KmEQ47:fwI"їS[|n'u{0ȭɆmvn$ IZ A)q]LfO\U?'BAb7R_A'gF,LZ%" / 0k,tZ%Hʿ9sQж"9mz[s?bў2ceYPJ](5蝑\oЮo*svCQobԈO#z}zZY.,R%&|XL9&6rT@ϻ % BjK.a5G[%MTX u/ux+yS _o 6ҵ Ǹt)CQ"tTK` `Ax E/S4,+,=MgL:14Ҿ "]6H[' l؏$Wsio~["#[hRTbnb+]w&&-uAֺ[2R$Nئ(ԁCyh-/ڢ%e! TFDDT9! NZƅ7Ӽb#7 .Fof1"—˰Ҿc^q1.QʒmlcR*vӉeSaMs}& )i؂-hlY'[QV0U~v._-- ~TXkC~:N;عG{G [J,t!Q˶TS3+[F"4j] 3?TdYcϠE]wL`Ad]18 9RZ,a䄽5tmG IМPA)\,Kūmn}HZn4)8!Q[.e>!!S .(.ƘUh4Ph*Z-.tVf-sit7\`KRidl-- 3:z7^#挏$+" SE˘C]7sGpk{=N|kQrŅ8R/aD$"ҚS卯9؊lJ9\rIY$A/SFB*!gORڣW){,Tmv~.K <H ՘$tl+&z֔M󝟈SOi۽A.œcL2L4F벍Z<\\0%M LlCM&|erqD Fʀ N;ɑ%l8Ǧ5DXT\/v%36I,gqD#`,A/CWF1g#~I\B .440p4k}K*KE$g@j5eNY܆oLr ̷c1l *~WދYzzᕷEJ3;_=TU.`-dxG;z%[o==ϥW쬄GG/RtHɏ@77&<3uGJ?B)+}*? dG5X1%VXwgCYbV~61r5t{ld,E<=UBBggǦN{n J |rRKCǛiC9F8vl8WKFr3/^B.|=>̩~ΰhߣ)6M\y+|i'ι t4٪2L`iݑg&:7\&I$}0fYC®zA zB$ >`qmیVٮMCb]/5}#b}(o T2RCl|rhVdw2.d~L ()~?8ˣZGc h~ltҞV.ُEȓ XMqHKRZE497H\*#ˀ^2&U:*I]iS?q!:UNOkW+w~-Q  V "c`I0{;]\1ϭrt1|BFs5b)@u L\GiSG@ԍ俗'Ә}H@!6n.n_x_h͖ #F򵐔d eZohuC\:ᄥu+1z|3MRG4 JBībۿ]G/kvd$<ַ!^ .f-ewcSW‚ BFଖ90aoQ ,9 *~ "I#rT$ d^jU1vÍCC3M dhq6!9'!UR|ןAԘVJ(VX>31/ #Jq:S?'Mb} !=ɌcI4DR0CU0Q{#Q _F,) z3E?T)v8,"`>D9Eݮ%$-/*J~QK~Ǜ+4&]^mB-[)(JfHo 4"%9n1+QO=5|Պ-YW23X\ʂNBlP<1,bsbK#dBMU>AT˚X:IBs:@nNo\g dE *bTx)]W'r]uy0[f1q p_HӼ `h]:.m\*3VEP]d"P 8OB\Zj )yF>w7f{n=Ǜ_.u2 ̥6nR2n|uza6w~ 0 ;/DipiXJws$;uI6m$$p?f*Ώ9w8ؕP$Qr0@2n7M3Ǝ@Q2g[%}%iY Mx甫_s-IDnfadX{ )Lx#EH:^ʦK9r V~/S*( FEV mz@.hWce?bXCr!DnN vJOڧUbwK,쯛,QGR X(\Kgn㮆!Ұtb? w۴&BDAIO5.)y7IDa*'ݬ!(m*XC=>OJqGlwh)0Y0?H_:ܡ>I;Bi@Qčt.a+/Ԅ+)dkI76a6@~ \Ae^R*8NU fi h͸^c\n3퉁1J^9O?`l%pu@ Lh5sNkNd/Ss`Ad[0.I,Bj{Nѹ:4qܙK^;ʤwZ]90Ͼ.xo.o'ߊ r*:hyL%:f=IRqo'"wXF@~E[cx}3&xBu{ 2&+9H2X:&;hli PufjYd$Hw;4)GOV-Bk@):Sٰ0_r:qӅCɪGT7)r3RS#(}DybQP#$A^RO~Wa~-nl 5xO>B.3 x=%H݁ao.,Oō |Dzݭ$hі?'ibifI6C֪-Juxޔ& dq "_W1bg?F/Sx~NtRi_+G)- :?jtA fxLP\[ƾ =2:uec {"e 4ƟKY3+|+ۣCOLJ]gy3%$#`6o"c=tdUn}tz^ uAePpTo7ED 8ȞzG77MF<2#hjPe--sՌ;a񳩗LASAF>8 7Of,#,G1!`Q(BD q7#xߥvFcollyF*H^b֥iDFB𙂷OGʪLNKźJ0)⧇c~L퇹j_k Rc:~'>KGea!S\CJMuZ2&q~[r02+Y %>#*A%n (Ko›gUi0i3\@q8vU"IO0RA"-㪮UrmE6/KŌp9&O>|Y|MZAw] |L*AjY֍BR$v9]1B|"yKזWMWn0Gclec5ml͂2/¦Ij;9KyL^lLy\%ןauH*+3ˬ Q_Ȗ&АP!e"W(@)4 .|(یzr耊]T*mu ]R4{Yb_CTKؙF?ԳF"l-6BmtNŷ?͇j]U wB,vC-X{WpM8 +&}8Y n^$N KM|&UW(!l y:1 Q(wRa"vmNB#.ć8.DOpv/nӶ9y#T7C8١bLy=g.o|fIp-}fq4n&@Un]@xh.w=+C1 meW;RTӽʍ(npGk 4'ae!^j !$+r{}Wls[eRΦ }^ZQRLodzjs#O' i%Ʀ0!бqu0?D4`&Z&(BE cod?3֩1e2 d!P̑}#<묮 $bu\[xR y{|l@ۀc6^dqPzѨve~9)*}8jW;ыċm&K9Ҕw2WK J ~.0sڿC^+?V}@ ̅L0*a^m"Ol$qY]S^q!W^|=u?.EwlKOK c}G &ڈdPMW/s?Vm/esxlPˀZO[[m`ܳPAMmwzWJ+0б Fgw sj#&!qx=$B _2"+>y:}3@``[ax@hw)I3œ/*T ΰw䯑qRAXF+$H }122#Np."އ;v{_=Y4 ح}=*T6+iux`~}m+է?7q3TdYOc\bqw(RDzUUw9-;לl®Lu DmR0p/?`Vc{2d< 1D7(;L:Mu. - ~[Cf7`V v>FOp|.hO@ܚ*6SPwUâ~L^[D(yPrLJkE76,pK!_@v$Sk[kuax57uVn٣yAҥT :n$ wLb9$/8ssrqbˍ?݆[W0AX%㠑)to]YFM#>?AcyZHMOB 1* |vOU}="~6hDI:4lS1)6~%Gx ['̓0fXPx2M_xBwM#@C r:ez- ݣLn}hy =v[.{:)ɨE64{j\|ʥ*k3}߰HD0wMʁ=$U=k9 Ť_A5s<'|8i.CӨ;-d` 5d? ƦB@Tگ*,\pd_fŸR8Y3ҀNvjԸf=΂#ɶv_Avfi>Df~rګ UߏJ)"r:>~UpI0xP?CJ^Doa/37ÅD'EcgˍL#6qpEPX N%%,)`@{ `_ZWorg|Fhp`± %Ժ/b؄r#H)+ "nf[Ǵ3wr b !4&6$㭃DeˁC$QE"#9>ٖ\d*0CRq'9$8 g3eTR귚Px )IWlֺ0/p~`8A"H1IC\R.2:aJ:(=@]ȼ s6H;Ф_ԳF^(730D;+J2atz@JCD[.{t4S4?Vkڇy8L` yqӐ>C0ߠӻgm7 )np|jVC{X/y/=l%@,;H%ug1@қDT Xeh)H]32>.li3vɯ߇wݹًs ):! ?lsoc/^8^:G >}hq@>42Mؘ.o ؠx6(G.f*Y""D_`ѱIgU^k9C"J[‚Kz5y *oWR*6%Q"eCufvIHOu+ƗmݦD L֖%i{ga'/ ƗBdUpHA,Fr_w RlM|GBC?i*h `~*\X YJr%'%zye1=~VXmFn8`⬂TsA/u<&G2WFIs%\ȈeKi%8Fp-i)DZO Ha)mٯL '%Y@>lB*{7*f"5L/weϝ}6r x='Z\CgComk7ܭXxjڕzۦq>q~+pyvh%'#WTW.y;) ҫ;{ \@x ,.3 \N4U~K~=qWw+=,X:1bAM+spԖy|}syĨ|o갅)gCxb9vBQlOV!Qwt(N|~ⶄ7TPkcؗ+Vʀ D:a^- 85\@xk@p8!:Ùp![G:-6av`M; bjM<ʗD 3K)Özl m@Il@-TԹ=;v,h(L0HE XԜeɂ)O5av7;nFPC, 4 Ew2m=7~|dF 3員3<1c:SҟgoE+E@qK/hFqR垹r_ԽY=; Kmդṹ*hy oqPwz3=MDO Z2>} y-`t( UT@U7e&NUtJ$rƿ#fEgI"bM zQzv،  z"RsUYLK aM:BmzP7[5"xxxY $ @a"ՀKf>]0c`'6<Β <Ύ 3b:|*eJ)ltoIg H 4#uUXa" `4lX<J&. V>iHu@~Kw.bs{Pacj ǔ9DƷ g*#N{9$iB9\IU7MM 5 eRq}|x&BmkjDJ*C#l/y6tg ' Ivh 1f#{E:& OYJ3]m-][WVkLX,m mj~Jڸ6|7|HRhy tשIq+A)0`-NiigH4oJ.Brr~tiz'_3͜c|tЍ|xܳ" I,*_Z@mN -rCm;A^.e3-.֗rP&\$F=@N%ŚC?dBn iw%ЬGb$:,A-S۵ o?p}τq^pZpؠM<&JIQ̑00b#& ,$9c|K$5;q)KF91Ӽ9).}o&Opwn=z(ʢoe~jQp尝5ږ[dnngyRE] :;D7#l4p[m+{',d݊uwzgLAt4pv-i+1D3"Β\˜;Ƈ֪u~xV]3 >nGEKybb@*i%mBe^`?fY XHn6Vv F;rfh.Ez0l@` o[,y\*-`ivVubac+Q1­ٛn6ZXgVޘ =ޑ-ؾDxf)##-h:4N9|z<^8b;ujA\&Z}UYgrXf |Gq̮:B猜28‰(;YO@S+M<JV Co=uǭeeAw3*Ajzz:[8#0_$E'u-PlOS}VX ~BPx)"ځOiyGfe򔎟~4d:Ҷ 5ڬ_×r|Mdw`Ǿw\Dj"F{Zm&6*}/ O`^o[~k j9 sHOi΢& s? p|p?LQ6_æZTo 5{&$/G` 5s : gh. ܫU @ØO0=U14zZ?qkAP^sң-PDkA-IXYjHf7BnT¹Uكm#>,f_91Xm€rN45p/|S}hob cW^{IbTMc#ڞ5jdϗt`:'YU- #ϦϪ44KAyBGdhv^'zA#:!y}?W`$`@ܥ{|=͑&0t̰,a*0v%g3;dS39/hI*wN&c%l.wkn/!ym>!x`,8}ˠ@$}x"<@tDluU<~7# HGY[l2#aD嗿1Ny#EI?ےܔ#De$3LYB!+Wav0_zg̽DLbahS9B>31vmGiѵ_n'P?x#+OX,2* p~A1Y|] 'mdq.M/nZXr*M s8YٳXi0rhۨ$kW:% OS:.fhiۈ6\X `DفL,IӂF= P$GAkPb367[Gw!N1NቪvB'=y8zfWf>E]HgN$uz):έQoӶKð7kl׼UÞZB$X) >#@w9Vw[ݖ66'DyD 6&Q1 P,8FVGCMNmᑲu с KwC5#9nN[Þ( S8̀{$Zui n;Sd/ӿmt v׵ڻ";]!3`hчqyNjTNR HEشfjiT\N=`+%c~+!_vp@`/'#; h޾Y3] PC? ZRQ +ʸ81„02a1 p7V zh`{cj{o]Iğ߶h^bZ=tm!d̓txH.TI"a33UxJtDw+5jqR_rxV]3WO'ri y `ԡ>|N~: NXBi@q7#m,AG3*tp &VV3W$jNh|.gwQS?L .Xv=Ao}gpќ5RGU& /@P1̑󻶷OU:LZP2r&%urEyt}] a%VJV+R#jTte%0jIJ[ k/^{ r63W%m?8K'XXd. ~D8n(4[ $թ+eMU$(յ>ʬ f=~z*jzX$eIrQn?ViࡷMuM9%W'$0~Nұf6*RCв<$5GqsUχ?QUxB)$r;Փ$U? (eyƌ탍*q ˩b[~7$(v!/)١ΊYfZ8cﮤnm.nSwX'chً>6)`nn+[` ژ+L]e]Z=XAǣ3ݵ.fGŒ#N']`_V,N`#> mͮ=V?M#Ev*3\)HDƛmf6U(;nn ]'I57- hCܞ&Oa M5W1ϣG6.sqyiSzji!k@|lTMO#[kln50}DL<}3 [Nl1{.+cW'o^G$~+bGē$J\6Zח&OzB[NHaB:<Ø=h վ>3yɇca.MC[}iZGO$JNP{LP:(QEM[űu8ݐxҌzC*IHB789VkO+D:y󴿼Bi9P:)7D4 C 2r| )ӲJЉnA{=d>Ĭꢅw48)hD9 rl3}*Ej8J#^^P'ډ0є=<슆(8~, P ttl27̧9 ][&W} ؙdf%Gh~=EFhUUmIMiQOBST.m`N.:Hٕ]JMm38],Gͺҕ9[JO>ɤ`Ы)15%l z|87 V Up˦FE7uߨ6(.JYOm D:D޳+kG(@Oz=<] Fr[ҙtM"4Y(3ڐzHH5ZŊ ҽ_\Q[TBkH0pvqT2.DD} >e;GyTʅtt CЬL ` OhE&TYqI3 ,4-dPk u"B#|V;NT"fЀI@\mH4 Kƺ,T[oՉskؚ fɳo-FT(D͊\7rO3kP1 |QQ6eՎϝ_o^JJt" &@[8*=X#ѹ'>`!V{ {[ .u(V=Gnr' 2!ADP ( ^$ 5L׼K Wb[ s;jm̑DcxBf-׻t寑\:xa-SF7Q1/[?ZFw`VQ)Xؠm"{7CXT^[ʩyjqegނ]`$QGu!ϲS@=#Ǭa3o&_š1R+Ndk#L9Q]o g⇠E܎цP80 NUMJq"4qaYOoFT.7-3W?nxV(9'ﲬSz,CS>Wg+[Bk?7|RL.영<(uv7p \g|R|kݎVa% mqW>kfֶ  ҰQ hJ ϊYa3cT1ubj[gXشȼ Ba`W~z&a4WNhg,4gIw?r=#;0cw -Z &%,7('O |յYTz]TK,H`734-dɋQ)"Po?iȦX4dg^"O8䠜aWvC|j,pw^b%6p?ŪzHһMZtcsp ܪ)ɰ3\7JBsՖb_H4k>V9z) C~݄oWP^lzSSnF~'!9H/9ߑZFR6X]řߑ)kv//lD<roӠ^)%1,2;kI7J8f-kcjl@(]*pݬ@LNJ5 ;ߢK`8tZMjs|ح~Ip6Œŵm*=jo폐W9F!"}WBl+kFogU3 wEFuaD߀e|:?f*A(2SLO/*^ SY=2P $ !kpr,J+]UeƸ6EC?oTm弄G6UDX l4zU G(*!cn{4>Ϋ"Ͻ!$xʜN_!:7|^< '+JZ g|_c ^1DepTi(qō҇ٷ_}Z}\~5nf]nkXK* ԍ_.Gn2s @ϟgB3`vw,B>ȿ1OJsIk} 'Ky8.Uhu,>@Dh(8z+TY|ր*z3))Бq< wU9x7N&Oc ,SMrTD'6ݜRo ǒExn@~ēы:9Nv]]1zPf@0QC. ̶zOJUb*;5{Qh jg"O~:QMm U׵ϿrA؝lf]EDŽwUXڱޅs^칦YU`3Ne}va3 ]z&}@zo>z+ KګR{ު~Edfu D^߮/TGp*:*l-C /\BFL=jMY~H4(bZ>Pյ{4)ι/ nӡK$QgT)폚tMW aUTkmO>nNMVyDHV%U@i?YA &^j/O[|, 1u_ɘ :A-"RK#`M U]Pt$iq!7HQ@cdVc݉'F,Q4|M䄬~eǨSEPs״L1e $tOL-`/3#|'-?Wxׄ4Ow q=ޅg1ƐKh$5 2_1ǀ:rԉ|WD"tu-1m;\UWTt9a; iW 6Q}9n`S)q(UuZu:8A>]; DfJ4Ugx,>d8lFl͖'MQ wG05?Β*|D?6$뎔>.s ) @ &(Qx7ӫVZLm](+Ǟ>@RѹH,,RUVYG1ZϷLMTck`$c;AxlwOFE tN@-m0-T{=u,m+ @|rxDyHrDQp& 'B !CUJA}wH9F-FQvжJNGNt0W}M!_a695)CZg5cX q䱠{Ngv򐌷 q^4*3&B8Q!qp5جSZV#f^gz2C'i PQOBEbsg"nXzZB)֦h*ĽMvHq~yL~,"͉"5al7Ƙ'틡쁧{Ü_qquR3XNsg9JCgnÓ~]|`md$1yrP~3O\g9FCuBP'uZE! `<##;ץ/~Tbfw@$`ɄTt͡;F3F8dp: x}p E*wV Zx߮q](ԖD ~ħ؟w/t$J33j|י9%|g%j>nx&ҧL8* 5@<]0rfmsOo^2ھYyTŒRjY!^\0F)ydQҩQrkAY&@#jH;TOʽa.ẍ~g#{sR`R*H Z ݇n6,lsh7V>Zi8՚ rcW#N_w(ߙfsAϑILO VBEiCic+Ht9Lv5)k%K,Qrœt:0CmXP؋"TFd&ũO?;Cт%3$m%ǥFKy`.? i9ú(vm"$)6 k; wO['ӻm5J%ꄽ4&E.Ăr1 <:8H2V1ja]d9-+Ao3lUyb3zƬM}l8"UmMPUS 5AeaI>YYՋ|q';,PCNFrn?<0+Dg4kiC_gK i0w;dHFuc[>(pFXb a^&SRw vI%YLs[͜SR RΒ'bEbQxwH+É#ti/*ۢ-/DYv]"w!5 }2۔ )ʦӝԣf,^r>Qƾ7Z2[{p`ghzn4ߓ#wV#QDcӰ;v]GU9af*К熎{)hMi l$GhGer?VmH]^URxd}MO+"–y~r-eڡ!^6J}vB-]n \+34i\kT´ܧ#/]hTgqF}LB9&- mO;^nU6i!Amwmm d 6ߞjcpS1)*o0\31\iH_UĐ)':Y"nzc)sM,:wo7 QįqlWp\O'gv9$,E!d!7,l0mR.{$I6j c[ؒo&c$ǥ+p5rM>+lOևB-EMWG{ʖ1BUc'&31+Uϝ&M$%E(m۠xXr8HLg{)e]'TeRQ8тƚMe䕲xOM W+^'HXwc<6%م+ vxB+'NWc+HMԢBLY9G[0bMߣo G#J٫dϫPxaPJoMu^ZP78 bEL:F-LÃy1پWD|gl_2K# }N9e@Eg UK>6 xYf& CbB j%8 a (]$ ?tb +G'TjD^AA5!xBLM ^S vc*j-wkj[ ~q)?5gi_Tj:a/FP.BBA09dm!QDL@x섦q# a- u]<r2,g?_$W $ yL*RgP1ccoC4E»o^h XS2̫y 2 Ńҿ<&Ad>km4Pa׃+=;쁇w $En[,cAjsa"-G(EҪ%8f1"F l/CDŽMb5RkÑ!~iiz),/{m`Wx1 ;^Y'lH*2$Q](Lqh4CxפXsy!h93!&A:#|6βG%֜$NjW@TBm2Xdn$^!nިNݞ-v!|mTN>Զכȥ{l뙩)&1´\b@Z,ؒ'A@a6= "_vERlRD[P|; k6aeSgG.yCV*TFO.ŠɰDXTHrJW[rec )̇kVuDjO:::V}‘Ӌב G.(DjNd9oc1oD i~a,ON T2Dō+Кg&(Y?-2a<҆16X;tی 8Q;yOu/>qO/oNQZ,RϘlG Rf8aeRr2 B*@BO͌<:ZF@@6˨&~IDmXn F v1bS_TinMؔ[V,1bSHRX,,#:>k]0@I'YO~pQOX<y<ڏY/lשwg_H D\qqub}r-ҭ{ٛ(|< 8-c7΃WU~kߓ wl} ЊI2CBq;қ19w^͊bZ$Pl<]`YrU_3af^Fu:PTXxMoY-L4_ g|NYBЅ' 鲡BxW BfBj>2^r} ~$E"Up23;) F  IIv#1Tqx_Hxqp޾tޑdp&iu`b3|_OI4pb8Sl1ξ)߈Y u b_Y.&N}GP鵯˾{H[mQbkɍ yr0@kMe˞?2N(aM^01` b Pq/Ia)rjSZ~ɬ^KݗOv26^NȆhG-@f5M`J_SHY$18펁geT*ZW?(h[aU*8< k0}Bi 6iKUSjx KIJbFp)QX|':a8!QL ǡ}kkO7hدX/Il&\+(.~Nz5a刕)=^V!쳌2fo>?7#y]LAU;]c?ȵj`˼,#N^co>B3!Jx Ӑ_h --D'ADj n9A 7Oi5/)=J6FȈq}@X ?),IEUakc͍5s$2w%TeׅGp6]N }"l㊷tг8u}M71› 0cP0I}Ժk{U)N.t7=:c6t–sgvzfU𶀑u+>F)͚Њ }rR|ƒiV^q_4z v8HC7!^nz S8 .:Uǯz SFŦ6"e Mc @,AA > Rحs&ޏܣc0?f&QӒ' ʭ<S1t8:VT"Hi z@V9e1j`&VJIrGPWI`{NCV_Y2'?/5b5Ŀ*:(VVG]W>}8,j8̏Fl~l Bv JʃDg}lC&m_W^x :"aƀU_t(}4NK\ wrv L"zuGmބ#;+?}Rbj'g%6hٸ]<>UM!SA{#U'C)٩vOY#ּ{͞*4f0'k3Ć{HinBE\6+2Ҿxg8xeȦҜ.t\ܙ )4ʥF c;V}^3kP&4١̱aJd'$%c₅HP a=b#iuj4,;C8C)z$Eڦ`ч?, S+\n?܃J`0lg]sFt<}ƴ0{B0s3uɛ\N]ƹ۩oOzl80/5% b)}b 8 q\D{*Včfi6H5 (i_:9I> 8`P;y Z<}á]@atD@wA ;yٺ"}i/j.?7 y`0Z>@3E UJ+%T ԯtM`ƛHaTmRq#-QC!~ M}aoF"!yYVO` !#LCpFPaI!X!ED6($j(VaA"Ŕ+=6ss17_J'y1ZXIbLI¼1?[inEZ3@D~ @1QF˨t],K> kLj,=0P>zw`,x4)Z(?M'nV[-pYT`&oBt'qz~o`O*b4྾9:j.U&.O /dXN ]`(aDj>AWހJhWu>2`aq/=`愎Rԝc˹D]E'U8\tm'MpXw䨑뼈u NGhU(+JETUC0].[7J\ܫma7>4Hʉn4Gɓ3PЧ?姹nYi3QitM]=8Y8pY2픟@Q<Pץr+KvZtZȽjϗ7ܤuдj b (oyfAQ5Q.}KO].~e#K"^:Dad-zd@m0M "+X(1*TH#(֪i760A}wۡ&ez슺wyI8i+/t|2 j4POWL:{'#:%)wbK7/'t& Wj xZqD.8?3DuIm,BM*QN4l$װ0\ 9J'940H.k6_5g\Ɍו?kJ.u<~:/%E4ְ)j>& NDһm IH} M>ʥ xlRTݩZr:" 'UWa&T R#'Rܳ/=N{L $'~>k|;TnzUu -dve{4קJ6[ =CiHcg N {"e)O\QiL>\{pa4PFuAD[^G!}7P|J9x^_xNjBL,mB~~ 5:zdS{j(WDI_E_O{El=IBqY]apouo9ku)HwEmPNbdJA_O:Is<-K f^}r}Hv!+y ?p)˷%]pP^q?4ߓgJ;ɘ6~-C&4 3w=wEi"->]">1kO-S+c j<|bEb3:[1@dOqoz|j@j^G 9u;0'{`XwYJm/ %i+@!^؊|KϺN4U$1Jj9KmSyA>5lFtL4X[Yܐ}#M% `kl$>AAr S<{\p^L]1"M:}4ʨu3|&Az’ee B ABC8 )Glv3Fe0DI},f(EqtnN[0w :Oz]fث_3X'Pgsjf36գ7/R+ݮ-c=)5!pHfku1ko{Yo+?gzQj"4,9y dML/Ӌh3h(+ {ӽ\;V=l.+RX/thu,u[`IKnUq# xI¸JAȌo3?h GT=Ԩao?ㅗP![`үsȄ Q5:f熫!DGRƬҋ3%ǦG|Pa4}dFGH8yzMOCSY>qJ_dtЁ~~B #͵ 2tt7d6U B=AnIQYΨ0+:8lP„;{5`j5kZlgEجd@ 6vu!GQ5yŀDl &%+0vҴ"#ՀNǮ>qN;ɯ 4^-I9a5BpYX1xak9:B~[DřN:x $u!rV6Lb)4ר>Y{GGlIr_Ʀ~w2^:-=8f'E-* GC~aߡ;yyjX# (*Ѡ:_=`qvV_Fi>&D?սdID^EnE*D N4$F: q=?Anh9qN*M(WvcJ1%6`Iq; /`dmgŏ K : PB s|ayH!SJ&N(3O̓-m鏤@My:]RQ׀1ce~sG)$,l{[_6G7;ڲヲ٫uUY۫*lvYEl _+`@}4.֨H:)ka%3Ym\abEX&7N{粃IkUg~W5hC@ށU[F c]n>"`tT9aP:͟Pbψmp]vd7,1kc\y,A>S|/9y |b+ r}u 4ho F閏~!"anx#L/԰Ks;X;VnMo͊1gQ@Y%@{БX YB f9{*>>1=QGWN.źkEN~UBt8hZۮz|\GTdOt/Kr.){sz!iIX{f(]T V@]E8dԌ?{q`vhyNTIĵ[%ۆ{^'zɃ`"` U4fEx|L>~*45?v&5%ݗϴ}_+c; iX,j yNz\$P>$ 7qb>޶JPYHQ53"" N7n 2R_dL U.n냁Wq@`DBneD&jGxy=lBw`O]ofR؈G`|&41parR̒ޞ4>!Y6 T,c6%y2kȳ+GH~^E4PKؑkBi0\ffzڃ2Ϙvbn_kx ]qy9?bL} %{hYx݂ir1ZzrNWjTj`KN+.h9]bTlҫ)kkIMzNt@9[鐟8݉Y$(f&VU~ࢴKvf1wucI:f^@X1*;+suiL[1rL0+i&}mգ y=zhO1XP[6 إiH8{Th6#|oxHȞ:\ ƿV*<)TjwCD ߗ>t7zoQ_-qΉKuR, $Oh>N^ INm_d ӬiŻlC-[;bi"Qz+ G-O4S5)'`/ Y{óqQ w/G- 5|}fܙA| ܘLA`l7Eˀc/eBן'Zץ{ad;6.a8!Y]g|c6Gxkq ={1=QeP)U=;jaEHV$W42lHf?:4eV?gPC.9%knvvQٍJɁ\i=F\r*ʗ/#.-ݝJe|4bxcpJ, 3~ L 9ȋɆ'+ED޳c\W_GuT ?+ְ$2 ՘ɀunf\Ԝ(fo8Z2Q<+*8 b׉(/:XLꁹ([RH;]w6BƜ3أ/`Mxnf[yq,=.Иx+"6MLr>!lZ|O4αRVgܱx*ss&| " kΫ<)]0iZ )AvZe'%*dҜ/od2 f,s/.m Ye6څ0[dhwMO*_-cv Mz^KY~ܱQ eu[|-6J`@Ƈj>zH R h{QڲDvr,6kJhF'X9~q7d ϋ B9 3=т%dNy 9нΛ1{/wŜ q+3áaCM&-9MlPf8 eXIyArK}Y~pYķxĨ#'=X=MҡV#g|Eh72sItDqghyy:jq,05_+ v GaT-:<;aM#9$EIKqT=Շ(\*6eehn `A8^vG;)̆IV{ZqP}y=Znn<8%~ Ao#1*G=Y>:o--9 گ;5w >q5?OtQ@0d>9gF t-pVE4 [k?co% ?<(S6waoTw_4 ȓ}~E0iW'ZlB^zNa)+'@>-(V]#K?"=~12Q 27+cA7AZ͖䎦$ R;mC{ˆ3PH(pdIf@ !T Pzv%yxea mk^,EZ/-U47Tر(Ċ!sDRx؉ h0r~.#; VU{OjN܏\B{ӵoRD{b@+$p1٬NsH핫9d%b1"X["&rۋU7Js0ɰ%Eo<)qnb+W/xf k hݯPxD ,,‘ZbKĴAld7\5|{<ܷ1G{APM$Ć\p% 9h)$ؑ1C"Y`TFJ]DB20*ȵĔD1qn*C#p9/a\ϧ%V䦖~k ,q }ȓ.iO{|:A=v*NįSa,uӚ2ܝ*:7_Ȇ$'od$|zy{>#taYm|jzL $|$LӴ)`ujQas"}Slb"HoD9|3se̱)#თF)HwgIkRy*zX}p1{fm ]J\Bq"$<tz Asd)Q)#QyMSCrΚ"n=Kɍmh/NqxړPj h.Vp1; M//åcY?PrWG? &kݐcH:)fߖEPMEq4GmscqBXrRoMdn萵#gJ\A0kŇOUzX~ M$XߘՐ7u-t~1n=J%V ҦwY@eA\t`.Qt\*7CAVI=v]UJap'&wnjAkr؀l#9mȜ, C%UKܬPS#rI8$SdH3~=jC;h^-p*2.ӕV} w2ܻ0ZYjʬ~?-%Q0)pu>ïU3,tiLÿe :C uH=}0ZZ3Mc^ҤI\ " D5^SZTIh;i!>:u;׀V8YP~\a2 {}*$AhuB<7,lTGޥ;#_1>w aS|`3v9Zڎhg;:Fd<_2F_n-S1 T_cN@`Ok@r%fOʂ4l>Ա N$۶~OuàrtB]tH%#ey z]#30Fh8U "mζ[_NGo4؁|h!^щ Jm~W,/Jݍ@. qիXvTف8J4e҄u*,TbfF^\d\м~wSFրN FI渝) ͵Ed>]]LAY|v9U_ O+}^eNwndSWY1#y+ƐG.9 ueO/p4?ao3k-lťO=fu8,NOޣw>r2OMZ\'7]Fc .U0K9:ZN6޼bZ~re7H-smKN_MVܺ%Uwtp\Jw~hp71)SS44nh/yCqzBlGjYj4\"S,E[Z&E([z@F<!&I۟ 5;lL od1`C,a9{W`+ c L¹w].;"~Neh:lP;_i"F».WF!v$H7{udm[l%͈䊮uOmpaPkC;vL|>u_zRwh t/ ىuv^~F5x7E!t :ɚSi#hMJ9.%jC 7xO;e&ՐH䐜QĮ} ׎6PC6i$?˷- Zd:C*,Ƭ]a Q^+:N2M5Ii 1&|T4mAq6R/ͣB5nȨN2L7AJCDQfr\oӛ2 c'hqKtp HS;vzYD4ɗy'бж>sԌ ɛ49Ur0fAtןyLygs^Jaͪzzw7#x\_ OQ {# "P9Tڛ (*rw4f@Z4w_Y߂.s;wf8)&zi1tJm7Y63!'4{c腝LnpX3;v엥X>aVy)W6|u?؜9Ea^藟B޸CT'`64y/~SyDo`D-kUgT5P"}6lh aq_mb33Q;)fV>MD0yС?Tt-rVeƴjƭ#u_$A߂J&T8.Pky/H6OKo31!0mhgPsP-T(g4a2mmRe^0V JP5KM^ʁ5[3m+d݂ۜ;u_~;m4f@K hX'7z/R &,})J*!0܏:-DY5ǤY-&+v0j:5MoU{?b$Zq,vCӕ.ޙJB$Ǩ[ qؕv)p8M߶zî2hUZ3y2x'$Ẹ:$BK}"CNk)ɂtie>E[Z% aח oЈX8/LAm`*KXsޗ\'Ycp7_vܥo L!$[B ]m0{<fn j{JD茜 e`!kqwKq (ȱtCIR(3/ւ} ;IE49}Ͳ-& d[jdz4FiьSQCqkN N  :-"B~BmXˑ.@7TO/J)(TRxY7y:Yө]oMfyaHDA^ό6頼JwOJ毉DFsvOCŝdXrF4K ߈^>8Z;[j 'sA-<zR֘oM=j:mnZbnZ̤4Za+y,+!H.?- ("UJNUqswGZsfQkwD{qA7Z?o@6ͫA܌vA@spy,vZϻ nqOFn&QgΔײkӋ鱯ͻlE[kl}*8 6`NqVjBM#LR9G3X>Cs+AOz*ǔ[&9WC,C2avca4:v ,&PHg{ b^|5xp tYWy7$̥9Pk%rW2VciEITɺHکh!&s e%ۼxNdl0X'$Z>Pjx((> xfnIVJ(Ģ'=zt~,5rA =t1٢I]+;-)+PxNX1-)ZrԂS* ydǁBjFy$dV"NI BZQ& ТHp"뻦O H,4{c/QjAeU65/\E ѐ Po8 HaQho1z) RpEM>\!0 j0̳!(R!3@JS7n ˹G,]jl$j.(AΝ=3LF]2|ea1?69!?AJHFiÌ7DDHٛ:) ç5wJ\d~B_*5]#V[Ol(s nތy9?0hD| ֧=bܘvadvG/meئ&浙z{:he(?b^bABv"̅tuvW zR T< ٗ-߳ӛiXOfJ98s:_w9?h&ָD|>ظ&9Y/*9K+D++g{kŐgM"ޫy;3 rም[0F$Ϩ[}]v0#ao64Wީ|wxi>$35Y-O v :d%lH^1c)Dz7h>5pQRqXZ9_^W?gc2^>Ogw\i"b8`a浆C[J cy`_g- )A9ܠsTNJ}W%m$ F.2O;iσKUY XTUoO~IA{D #r  sc 72FpyĊkͽܙMl߸`9Ea$mA95n8 $?k 9!S_LD"'|MO Ⱪֵ#nƥ0O1n>:_7M^yNCbakFgO;~A Ԗ:XY[ĵ`|.'IJtɱ6ĥ̔DQk.1_6H9hv4Z{o:Kg5GXzWٖ*;Ձ~4~Ʋ6r*"p {66+LbT_mb3ӆC7%#+3~S{WE[D0JJ>qNj؇}G?#)\o;&z+~K@wGzaxL>k c3T}&*D\mYYޢ0 +& UI66@(bqP[X.RaRѹ{,S̞m |i'kr:뷇Rae56LYxhB-hxΟgY/{m& IGJ_@iKҚM ub{Vzō>P`vLG+:(+@ҽrEUEB݀E)uG&C yxJ e隿hM-h߯U5|vT.k,x ʖCm/%ĸ4( re!Hщ_FA|woV%)1R[s8DU+Z`c~]|jp'l1SPl8IIQt<ѯU#J/scaNi$q;+5vDbصl,֔ɝ))V瞳#VrZ Ev`4\`֤_` s0quX-|ܢ95Jx~bO|4ՠ6 Nyy jŝ,ч<$idF",Dj9"8ܶކwm=s_̦u-r@M !$U21pZD" 3[>ȮңQdaQ&<+3Y kQ~o&7doBIPYVks?j&pkg3I"c=C֣ _xI>=_G* d}_svRg9%tu.2&Z7IEIAz\쳃JfDBK]~JcE][^Lx nc7KkX[})<Ǧ1CFi$&E kGC K @SvEI ug1I(e( +Ӏ3ћ霖3ҾSUM:ܥ8vku_%r\1c+3 q߻lVsumm #=SۭEd`ZPŤ@RB K38\YKL'0> 9Y8DIUFO` ^!OWwàe/^J3QߨdcUNh6`lU [pZ{@Iߨi+_ly1D4B$^X˪FZe@̒=?2Qm n( o̓bGce& 8!-HAefFZV 41W؟K[d[u]<3!8ԄT9wq`^"H5-"XzfWu%F.fOJk+ eVӱa+zq&UmB0N}(IuOf/*wb*U@qm%ӧ'l | YJ#--|#"C-t-cJ9u uH7|GGPi9Ca!PW%آt1)kK*4-יlс(1󜀉 Z'[nj0hAzPXG͢4'@hG|JdRZN!֜x^^sԚ9:آ:;YA=HAҦgEk AceFzhb{ kkn`I^e@sqn,--$nD-M)uSG/ԩdL%¥M|5o"Frp(72`0)C@6gԮuᛳ|YQ/C`q)Ns*E[S;xr17ͣj sCq)B|ϩUn7B ~9@Pq gL k 5f#/TayQ+`#-0EmDu&SjPv`l2L|\Tg<5l/3y[OGu, y^ʘzI5 O`LwtȻM0I͆IxrA̼/;0o:*jV^ȸYcty0W zN!O/4(u#!8s]B£_#k:qRaSC7vm Kt5N*F&EiKMTvoZz-V` OD#8p*%v ݓ 'nE3OnJ*l~cOk\u C14!*s(5LKt6⚞bhyQcl~rH^VyRECwMLE1 $J7¦`8v8wm+>׹f# q{ hooثSIeu_[L}4r$tF`geCFYܟбEDl0i*PQ7JA<؄9"T9vkJ RT4=/ g߂/qu쒃ip8T%(w)5pZwl* dIFIO)\Hq"31 #3FFqmp= D[Nk>\b+PS՛ [/H,,-^mgԄ A/wap'8x *2̺[aeh*g3.ͱ&k3>ۚПk } &A8XP|7JR+$ET2&d~>(/E3J,V 3C i f?ᵓSG9oaZl'y* / .r: NDnf]4C=g8xH~a ؜7M!OAɴp;8tpK0;c(@p3?"@8.[G//ӥvғn]6BT1htFDln!b.c/ϙ3;םb'`'=a֒EnChaHgD'ףݏ!segޞ`A60 -[`P>IvY{TꈊV7:?vʁ1rZK8^cY1sRn]- iYA s/13-^d%ڐ+]W~EgC \0@WZ.h?q9u0R& 0F$6EhϝyԲ,Ɏ^ׁe[5}]X?P%4 JBQ# k nG`N^t2Or-k|pV-e]/@˵Pj@Tp[&4a>D]J!ߵf,$A+uB>׵uһyäʾ+5yaQ k&OAОI]cD3(6=%ksިd4r†h5i)".w|>BF|vxK~{&.uUG$ @vïQk;/ozN֟ %El<^w!:->ܖ$eNnA9 \gqvEv:i%:)';%.gW^1_Ϭ$M>؋R:ě\-ie\.fyRFdD ڸQN)?VD1WF4j ys<=go Au_+2}:1C@'X:_5prFQ p~^nwb#3/Isk`ՎHa'Ujc9b;uF>^acc1}VI}/BUt~rv:<\_gHH\[&cFz kBMKΝ#e)C]>N= t 7 }D04)fay ss.Hd(|ɤŴ;ǵ$W2 pN^{tYiP(ʄ1*-Y7;F\'<%t/hU[D7[ŰU Q3V4ahѽ9~p$4?/ewXG|̼xi% yfj^<^C1[vd tD BUFu|P18gw+ Iz(#^rgnѱ;| (Mqڑg[I(xJk;i4ϓvk[o%^k\uq]BGG_0)ˏf-B ]'B.Zz#7~PC4:ŧ{-H=I7719Wk%xe x[6Jce Z=$Y#/~Mόb45]ur=g-H^^׃v0S<ǵtEu_bg#x]Fⶵ0"iix| bfk{$G~ا2ZSHfREC+`c AP(&ʊPvxnP/Z|[s0TSlޛa;vx-Za@Ouڍ?gF)N } gѐz\ `|4<Ǩd>P >k *2ޥ^ƹb,i@F88h%40175nL+[-r,m!jfB3il\>I˙لY:=HS 7;xvG3A~@Y,asCekЀΩGegEOc$x!ɷ)xZuDi 0:)>U@m2Vv,;&o3鲀QA=y;ϻN!@vMDžG%6?z\'ea+XoZX O/z()\E+8ˉb|E}gDzWy S?FogB媙8U>B a&(ALO_kDꂿѬٲ PΖZt~ 6naq)W߱)Ө-RqcmٯE9Ք}wC(g[< d0:\4`/TGNOK.<-o Jy>/@X&N4OWs/q/GWI0) $ B%Pa1$7!֙"hev;Q}Wj?2!8"j U]|rנD)hmg|_s2hҹz -(ѫP_pMZ S{\x|{o}N&"nH~9rjƖf[W [W.VAL9l͆ e5;`~RL>Ph=ȟ =1L4`v$4`XT~3j|<  /a4&S7S,"-q?.uFi4 cXЪJp,0"kN9)~'L@!3;>sykm|KV`L9A¿ z*:0ըfBS5P [*t=0U5RY!piʡ#׬V ?NI -hET0 Տra1qJ޸k('lDž'̭%`<~WNX3Նd+bفQ,R&lkIN/KXt]=Z`fo Ɣd&9x0RUW?3]+wA"b9{`/}mS!lB;7%z5[xڕ,KW* 0̪LXHQ_Yѓ?qz[዗h/T='Jy7rR7Y|2sJYY8wFc~)"+6hCeDDֿo@\48 |]32DF3FmtDX0;> Ӎm>2a,~ᦇc|'JJHeWq@W6HXoůi:տU>`| lҀf#9~YZlZN'@w %E۽G]}hEbq  %Qӧ..c#kS}bv$*E[6*eA­$ INAl9TX ==Bۜ{ sVϡdsrw_X0{~ȿ:R,f~-&& ~s#qLXpQP3ў;I;(YKA#yCr6`f 5,s7xBF;a(tݎ72ǵnNSC+Ħur}cL~n0-+ 0C]<b)Zs@or$EA靼4Ʀ\nLj#fd*4۞=2Vfeωjt3x,Ir:t1Ǥdy^rbٺS2kux'9Fɔ a#%~r ʎCE[#{R%'fF$C~Ǥ+q|6H̸b^d{+tT`MfK."pC2.ۥt%#ZSyfIDK|ӇnRЕ3[s[Ӛ]gZGBoo0A3d.x"eFJ'h+`?p^!I##L)41XMݣ"`D,5gĭ}NqȇdD5K hr2f˿8/fC[ʖX)Ҕ41 #//?̻4փ2KIs}#g!~e P@+׭}y -tLիQyʱdَ}+R\#*$c\./7$odՊ@YxF)a`mF|7qE$,cn|DZ']chw@RQ=`K/{bO4Q*L*m&ql -qitқ؏rg}F`{0[DG'9L]qK܀4*9!Tǟ-cSXbKHxpX*ggW=`nOI.Zǂf9KuZU6tX)Њ Qhޅ5gEsSqk2%I6)sda%m0*fsh|V q9'YrF?Ҋ= Ɂfwy Ec&.7}|xd|QrYt &B\~0̾!L$SR9RNص6ܚ [-W'ƦQHqBna b d |9.b;oayNr mr w!T?VcǨ~+) -Tr回`TzAAO˂^f7EM&X(эoW8*LMɰzCxdkzVsWd1_ĂOh.h/0obq>9قe1B0as+`5d|sߐdE=y[Џ> zuyy^ jy!3wTjXt>+>, ZΫ̳?3V:LH"7nPҜl"gYaK]jxV0]*i 5&4rDDdMq!D|$Qb=l64 [^*4mk^R\8Nn(w]ƃj櫙h. Qu2J]a /D NGHO20<]!hw?OlG[(e H]yQ// L`!"5 ՖxaY'3m2'܈eW[FG7BA6b N[EdBpIٞo%1AL M:%Ӻ.>%2'NƙT+Zv"Ͷ#&K}J@t;h]Z\NuRQ%oɇ )"DD 4vH9$-Z BZx4CƻX zhYtN^)5Kн FrغW'(Yu9 1G|Q|V/$>cDYhp~GEО˩ًXׁsa%,>jLi-RwKp%(P۳6\$*[͈|sc>w@8p M)V+#!_oG8~S#f6U8-h%N.Jܗ+kQ@DssPBTf?}S]FNc&P-3q!# c8feMLD /ggc7bZ{lwupZ)gK t?#f~A屿't-j2/-c}Z[[b `]l*u9@V9Ʈ,?տ%QA 𾛕]ljk`Gsd]ȵ$<~ߘ aF@qs!)|nε֥\'iՃYES18DZ@iGsIwp,>6++c3wt; mB6;P^\c9p Dy %B*^ o3>ԎrfAUF K sɽٗX7AEn<LB מ(Fb&[~ ed_=ߥ87ܣଇ"QN(iնN%6A<}[ShYcc4MV]_Aw)I{ZCthɩ_VyYbm'f~a/6<Ë?]0ɩ_nz6Tm+,b&ޣ8/p](Fƻc֯u򛢉0h@ـD"MBmg!T|o (lÊ&Ol籛cAI]hX4Hy/r/bڻFh WpJW"9Eh׮n2H^KKM{4$C!c]gcn9K<Wv~VHѷw}'^*ҞDgpK"PG1pk g)>rY)ntFBnkRTt'out,UMM ҧƝNh 3LWVLjE{^'\\FfZjE΋Qt T?ގSr?0 n=+" R &Zs"m(}N-Nn2[: 9BةpuQΊ̨og@$Ly7 nIƆ匪vhvUCf30x UiѼyl{>[yI;&SU?C-1^bbtըfZ(D5SIj+QC̖aq/tyb)U;`QSa 'S2{; >K/KZ2\y`[JL{\~s@T~]|C 9|Wx֚Z_4Buϸ&?\~M)5\S2lr"?'o0GBK!h0j[lX]js&~OaǤ{3_t4܃C`Zi,o-޸O#;*Vow]Wo1=5 ],65x̣X]TG JwlM1U*1'7tg@8Sd$^ERlhDAH/^!?+gN^ҠKILd=^Y*..F:I925ϕL6RJ3 ~U,u b ߆Ece;4`à];no_(HIc ŬcX=֖ދH~;&dЎ,T+TFeCՉYCWl3R1g#hK,k ɣNMHXzOM>0B15JS?$*J%]; G:6%e۫" $d4cb^::WOHGyk x*TQxD|An~oWy:>/| 1{c+m\@O`ĄwA/ qHTǙ'oSp-c5:^9DF7$%,~NC%<+nHkroAh nAVmGPٜz wvj@)PU fqAWk't#QM'ʻ^t[[!iҘCXH- n蓼n#n1k[fVBjւP¬xmp!PCp6y;PN89syz4_)o-v1ہ P 1Bg.\ߣ{eq?YcA슱E9,zr-7?$ñhṔY"zp򵏯c)ɗ)\- >C.Blqx(/ OE~Vj[dGؑQP(W+!IVS7n7ç9VմtmiÛa4PGSD[k0R=H$%X]R_[W ˨*` 4‚-'MyrIh$4R\).r!;#:r9p51/!Љu^O$k-)ɲ<,Vp@y\-"% )K[>*Rwk:cI~G B |cS t\` )f1"fт׊=NKnt;(ߵ&NYئ<ۊBXdHCİRCm3jxv I !1y[9'\S͢w\Kc|DP7q?L fR5=.h1;b[2/bg`W l!m{Lr{O{c@p߳Yذ6 9Rc(9tHE?Ym b^Di& [_se?K4 Խ 9bmIrpzpd63c5FDN_i NmQ+CrTɈd5P*X:삢/u!ӾmWtQ+ ;ZWƖI-5o3l{t;=mEKzV*=Too ԟANEQF;r~"G b5ĞT#hh4g*>+ s싅d-mR*P kV@`Vp=lD*6ƪ?gBk܏8$K{D1 j}I`6Ma8fmhoޫ%dp\LaV/iFS# ms^Z9[$hB gT &:lE֕ia?H b;ʵ%wCtDUI.K2Lwվ k"1|zzpo5[mQm%CO\?\]lS.;ƺM8}6q U eV\Un@Ud]+CV hEeؙw΁"lpIsq`õ\pMR=ަo6> / EX-bG,Tt] doMBSI #]83Y t#t#w|No!Oge+~G胡sO gwx\*bXGL[f,)Gjl6pa148|`%=`ۮ>!#+i>T; $LfчGԬ/}Ɔ-C(mh^OND΄riyiH>`T )W[9OIJlA#qg<B6hwb ;},m'2XAUfQU6Y@[vU%6]IJUm?=3-)xbfp)b7uS$T66^hc)<5Ź k+8춓cw_{Cgwհݟ@`UW78O; -#`[Q'vS=u 擄$:nVQr0~̕)>l3pPv6zj2VXۉ/ %8aQJl׷1,u}x+\_ep'{a!YJ*O Q'vŧ:-.뵒1w$$uVW 6ItˇrjD6V4e.=K4$Ơ|yEחο X u#GrvVy9hsqB%b~=M>MPfYy]J)^3ca"T!y^:rJ/SֲD 6ֶ.G,Lt:6]-Ҟ/T bBH[;\' m<-~uq9!o71`UT(2alF帽Uc4Nr Ի#0{J"P*֟›Nν! *0#==MLj_>b:~q[=)*nd$>ebB G2)Wj d>_;3(9 L">1<NP^ 8[ Ţ 'O?3BεPO- &̹a Z$mU|曈c->wuw%Gůu!s2M=ԝ%_ecӔTQJ))w41F%_V>v^Ҿ.,樘 fcʋ|ȰOdZLEA`&(x@̩fUs:-rOT[9cmVG&`qBXn/S}Gf ODqT5C< (}_6yPh-}-8Vc{/+ᾓWOx<2k,w`ֈ Ըa 䟥cR"g^L+2\o q㘜4\ځF~9hmB+Ӄ]?t*Qu/\%tb l 9%p G6V^fd@H'FI!}aPA{  8>/BPM;iv$ӿ[ B;f5w`[ V bpʁS wr- IVwnkYmgqàRcNi0dZQ?As. v} 'ijoxCɔH%\p8"IҚ> m vx])(epL6s9Ҙoxtݘ\D93fhTs#uJ9237䪁a*?^CДyYW%3wkÁ.!t?}]_ږn^zH[2}vet2vS*ҰzL?oA_~ ((FL C9PcF1AczY},q vX0v[n*`ga(0ޕU'Ƌ:9^#?Aw2ӟ Ⱦ -?0`IVpy(K)%_ bԑ]bKޝ1QǤ%'0h{p4*{ O-%dWWI°gGtBi頊-)I1'UIۜ/5 ڂ:eV٢5iIOydV8CZ pZ5؆"+N.);΋vrnI7n ZXHxw|_ iXM.僸bL  mպ'ɿ6hKqDկ<{9~G3sD1S`m~ èĺ\e+rPm5*&z/h ' >'mhtm7`jCg\Di9ڴQlt4 auqR<أbNr&Ґfyנ٠)kH.i'H[C|B>̄:c(˼EO DxI+⪝^}!CF9/҆& %MK%vI"d4P#Jqmb7B]>dV[p3$fjQD,J!iIw gw 6ےj>M(i4ȈGe'+r#y㽴Qe[3g֯2^ƙ`1eVΖUR.e-N> N^_DԶg:HtQLn*dJ Y9I);\FDtOUnN Bsolgbw>>w^}<\ ZV 6W*.URha]Y^c|d~*!*GmDЎB 8m us6w]Ū;⩟<f/! n} r5/E&Q0$QS?HqkUi#]i}RCl Ikn#VpaH(ZP(hm.WE BLkʄ&yX"X9LB7]%pEQJ! I7#'7 A-ui3CN 6*)tَY”@o`YILP @h E^z=%7%*{'1ea/&TZs{ŤvQ:y .~S\0~}1`~hu4TlWgoV*~2pC8T~ߒ> ?$&kR(t6+ 9uFqI^5KY&(iu_1d\ξb4cxI[.iQ,t:Qey>ظO44hKWCCƟ΃n} RU.\mepڍ-3ktZۂ_*+S> '2WN}̉}lr0K=Z/S#d `650H[<3yxfoR*Z&b=`0>t$HaG[Jx^ /+sn;u 0f%rއR3|=yLF+ 9ρe?ҽޡ4 Om;S~76$'\5{ cKa0w}OEKGh嘖s^n РdH,{{Wf9BùJ5[ 1 8e0l/$AC7/I0PBKHnֽS: 0OG:lQ[f*}a3[SȲe1w#%/eYm*J%i3,WܘA 7g+b\S"h }[HL;`G.4 HIlx>qE͙5={N0<$I/M녦ޥ39_ga'@aoRkW]4Dd83Ę$Ĉ2Y3?%\DCjk\>#sf[R98KMtc' .0^imH5hg;c MKqWPLD\'(NEy ⼎kBReC@OۆXh0x$6n'.45 !/'$$I'k F+-)v!gH ]6ݲi]!LHlh3nY"q4|_5ELQӖCEl<_/FT=%pȁ&G4[/ߐo2Gs,U&B};b~ӄ$u0t yJd&[;TQ6Mk&ԲMȄ*P01)6J:!18F윅9.Xg荫aUGR ev'dAHε`4զF 46'Ap3wuȵ?6<7 5+*4鬘\k[33z\Q봷-at aV922K3xDB50VStQ'#lqw-,PDDJ Os'aIGk*XwȢeD*$]i>1s6?zmЙ @[%[[ffvfbpm[ o-DԦFeryO ]g.la89 P'Lh#]wfetMuWixT4mGjWxVR kWE24|ed !o-( 5GV23$$&bzqZ|798n"bC>w{Z≞Aqg6 gD/jȯ+PQ,c.&h]c˪D^v6uYQ&Gd&&^Ue:L k:n{`JΦȊ5XPѵo'#,% ] ^J5"BQ:i$>h!VN F 9H0[n̒Ln-XE"5&%V>W2S|鐌? Hy4iQЫd%1wo JŭO_̥'Փ p )tvQ:K6"7&pFeQb:Sbһ{FL>b@mB>-Q}Ci=N3wtFT(A:Mޖ`̬\O~N1- >,Z\83~̢p*%:шB;)ϗfXo^m{Iß;JWLCFVN {Ðqh{ K94>!76+>*4Kwe#h}W!U_S l"8a]xUV^t{`U I֋mPw~^A/x\88zB@WzD1v<3t|[$v2+z<>*$o{Yɘ42gܝgS_dd[S v<wEhk/4 To*Gam7oXӷvc+k^Y,἞D<HN-cg;W9yZ'S9\lF-ε+@uGǹeA4S4i8=Ph49%f $ B.>7PyșO|ギa ]Z5V|.dzIœ-%5Ϝ\"O u!SVIPG;̒mzLiGu'?3AUq4f,1*ipYkޅI[7<8դV"gM/~;}ط] K,F>m6 2 cE|n.5ۏ n/ϹOp*txzrEwgxKÎxEZ{z'&+CEdHf'i֖dY5Z^.st^)kh J4:mqƢ3>QSCD P>3!K)5k:3=]/L/ElE5hbezb|^&V6Ը''T~Z,wY7K.c`M}Ara]q+Dg/ .1)`ZMZ :r z>C8T`&J OY*@sl,fFFY䌄+4ddE+bEu@Eg2C} Btԙz~>$@Zz \Nq0??.xm`{L!>=Hvf-$xķ%r!|P$ϝ͌W+?=NWN[G_We< :I[3`~ra]͚K;>)~PV([p <}D\ƙ$8KӰ-)nGp'upA,%Io:h:V }T$ s l0:XգJ `kn:CP4w`E8uk SiBs@.sﶶ3m;b7}XǢ;>lͤ{pߞU( ǣ rjKpSKxvF~Xm>=tVW\YC:6F-+}]iMi E# "Ƽ]?1hC 8YiNujkg}~j1t ]ނp|^k6 SM34mNJ U( 6 u)P{Tie Y`Ivt-4QbO,/_\ ZM%A+U+ùL*eC>/]:.F_ .f.ġ-`Vjʏd/KEqVPOז,1P5%.4J'"[a ;x;zs{ d0׆PQQ1eJRpz*g2ksmxXeeR<67+Nf8E j!H ܱeəgX~T}wkZԒOJ:"'kT9Y2'!L?;* IK4>ӿaAuykb+=&-S`W8 Z]2q:C>}a$= a$-_>Jd/Ƕi։j 9WkUğnph"Sܿ+u4A0ղv&ޙ^>ͨ@$ܭumxʜc LD8 b\Q|TWb7DL`Bl^U2T[x2)4WG:J"f@AD+I}i8Ixh]z.Fʿ5Tѯ`Έ@ b[rØ{Ƨ$^1L#1]͈{P/#sY,) Inj{up1e:H 4yL ] Zlƶ4,N;YN9ڬ<6yv@v&%2 )`Giy\eBE}0Op8K!A5d9x:T{' # :v/p?-t2\Z 3ctM~te5sagOoQ8!yU[YNIyh {gõmw*=Eϗ[*U< ۺL;8qshA ^f[6.bᇡ8:Bl,ʀ$^Id3C 8žRY'(Sa^kF<@֗ϰ[7xՅ.ʒ2rAit3λ|vf&wEiʾdtmyQaesԻ`(M1:}<+lmX*G5^3^,[?Q3퉿JZY%s$(xRZ 2)q~_M ;c qy+|,GÕR|6|PN5vvU_U7D]6.hC +'Sue 3]> QJBRB%P/ln| IU<7;*FM^{c1~*CKV$EK =H\gS40d(B>P "*Di*X8.(_6FR|s2cbqRO > -~zp+*[(Ux)`ġ b@Ѱ)8 ."(Ɨ}hz7e k4VkWΦ;o2)vfmQ:dplK֝ѹAk:6C=ʭlLR̳*BvfX [-\<,<}ܝ?^`G!ڊ-lx]}2QD9!CS(xI&rMMcRب<~jnM's:pO#%FBA(OS0 \M$XmPkP)ys zw*q!LkTb ݀V8Hje.|S}L[hvr?<(PRݏAVM_?:A ͳ5in+Bl-GGMy qN|i믪{?oS@Lc5]ETEXhS\4:'.q z:yȞPe?Sk;䩃;TiQc2缗Xd}ą5_VƣPڅ?L+[\?0?LǴ2FԒ`N.q%;_;a F0_ ` ,iG3fҐйQH2*Lͤ.6"*:(&2iSmYZX7R-?Оyʏs*s2 ȁeŜ* P p|xϏwb-Nb2{e8JҀݑ{i4vRUgm,X*Lw%ʷLbO._J{!.cyK$ <<L<1bbO_t]~>>*x\LQ$W%?CR`yʏ0OtJk(Rݕ^ʜ[3' )vĚfB*ۤj2)d }׺v<޲>Um?\|,15!TnrBU12gy09 Ͷ$k_߭߀O=?ͽpεvyRr:0 X*!I:]  w%44j篭S~ʗQ.K&ub2i n9 z#~̧-oI:CodY4K{ Jnmmy\TU㳶?`ިGK1|b?.#RFC T@T.m5bIDk*@Z>r麙ȅEm_;{)rN,ʳf PL%z_ZRZisclSqdF&n`NaSU|PRmt( Yn.P.RsӬS^L\ÝRor.`#V?+e;鐔vP>p`x>ݸiR.2+ahp<V'da*:0[>b RiT"COZ]# Gn QSm!woMү{%A )鍫jb 8͂{vn+=`I:f KzbgP֬MFWyJ 2ߢv4U,XW"E(xz@ɴ%du$_{q".Ʌ! ~(PO(MNkm`ihI P*t5{#.Gdܢ|^K:ő ceV)~l3X9 b,?RV[W@%t`HnvCR3WRSv ?N*DA0i';V%|_*(^eSi7"-ރMs`FmS3D<6 %x"gٖ"=5h]>P`?6Ut'Q wfA<#C{ mBd7 /hwy'侸"`p c["ϋldC1"245Sji>M]i4ղwYJG(-íu8s%[}Yb&q =vAէ.*Xn1\.BCݙ4j"np%ǓX?񴒁2R!çj`恙 =N˨&XRh#e#XVqy}*OPOZf ))N+͞-{rOhq~"X;Xv ^ۉY`\}am婡"'TMq)B8uYZ²sL*dJo_.X"VWQY!܀[2OO_:rfO`^Nu'&-{ $vG*Xsq:qONzHaRt@w@IBH<@iڞd_NMX/ a. s~kw >ːkCs~abBNbۈ@1SV:E0tſؕqrZ₞KPvnGFJQpQ@l.+83ڿ O}|Qee景RWVzjI0?T)x|1:am%~xDEm>L^k?# b?9-<\uXÍ_ 2S/S[2gXNT'z6 ~q8ӟ:E~R;$!$`㛜/R3hXd3/bXj۸wSp=}ntt/)y wg-~S;"S9wR€glȮ#ŌGrzU6ȞnOiQ (&5.*d&?v*|Z67iQUa }_}x~. jJG]OoA XoLjp}acbO'8QvFn ,# L<}&֊fG$cwp8= NLq@. 3^N3&x ].%YGLx-Q1TkA"έ',6<޿AˆKa{GOBz6,Uo44_`$TVɺGKLLy!Q-xH&Q! vNSs XK2[]ύ^c?k۱Rﾟ:(\L)r[k Šf0 w+m^~mOX5OށO|8~KMעdQ/ָ׵5\ ]٫@+0VZYE صm脇yx#ev6>;I//] {a-3ï*r֢ng[Ю쯈S/PӻEzz67(PjCPC]4طf׃a媌~g g5/`JW"$`g#8+4qA;'ql c ;I5obnm#d{Ll-Ì$ `y] ,{.Kl{œ5uʭѽUdZ8.ӦLb{=LxmYب'|9+#_K~@L lP=7oZx>CnOrT0`p{hl f  ^C=Q4&q0@M\n:_]zzcHc8-{͜ JJ 8޷ ̊߱]IJ ۳nTC,LoŊԼ+XCm^5e nų# ͦY!hVj?U\55`ߕ?'RC/a%,бԡ*go Taߎ¬^) ,~ -chPĔ~"^=kf 7lݥ7ë7J9AbǴS |(#Ƌkî%֕BkQ;O<ϡo֑0T xFAWijcjgaNł=[bJ[oO9|j.>HZE^tQy2vϰqX]nЙ~s)`ՊI\&ҏo,+jjʧÿGf,ʷF4-!@\_b(\6ܠ#J`ֶթY~s$RT8idx~hYōt-.PW F5N N=a`gr_+,1*7gBZّ/ $ IFTN(m5 I _GQj 5)ȍ)j= @t@jTXhe>ӔDyf9tKUw *kGݚ5ͲZ$n;8O"h59 L7/UjH^eLK$W.BI2,ŞRiX7?:6O< 4f9oLi\^ư1ƇKTMMBࢄŃ g;XϷ ;$vdh}QfDK0dE:0 ş$qۓ )4 np$a qփG^Sʇ!a-/Q铬ȬH¾zW45_7i2t J81<;w.c N{6:;PZ#cg3םl=E/@TSڬBADnV6)l3]ڟ0 Lpף K 3RZ D`vґJs<}36q;tEAJIE +fG(XOTPVNmLr_zFnrwǼmdeD[m%  &4VT %w^pZ⫾+7.+@Kަ'/ipgdO6ddʌodf DożQF Vf돲MC+:wa5jC*66es|\% -&?fED4;>&eq8WLaj0AHmn!vXʲXIl* ZQR+nHc 5-11"C+!'M҆eGl?mD4m?2JXҹ_qqU[MlE==H nW!CG}rELF˔䜤]qTH Q"(ɮ|! pIiYa-P9bAWdl'NST׫Hmp+ȮMhlZ#kPһeĸLx19CgڱRxonPu|& g_1NWyp!vYwos oogJTUX Chrw{j66VD*vi7t}hCAۼ+##C \,ZKwRK"zӉ6L\9FB6r rUȐ<#iizs[~%~u> 1po :uW3TCI>槠;Wf@1!s#b1s0׈HPp] \ǓLMp*:#gzF|;fWlE`0YE7?j[ܜ*!*WNkXˊYˆ@#iͫ =Y? Ym{%6v UDG{y,fvPPr_)ۣQ\Qe{`<Ġ>`;څ$\|G0sc8˨oR5un.qo<.Q2>(q'B,@ӡQCAZt,}0>Jϳlz dg{7 ޭI AcN" %u0QyFҲJwBO~R $qݮ{s: 'v&Pa^l 19'#tlF+@rF\ǖxIEԣ×%rN)s,bK+Il Xg]Dؙ+wѻRp"B-~cj7ɥRUHԼv$x7i%qql{;w tbߜ,@`#cV=!'S,) HfBn=zzvZI6n-XJsTyρ#* -:V#@oJإuz;'>q-D4&lxImOPݎdZfq .@LLGeD ,nBussOgWH8Pдa IatDi]FXJѻ[)McER]b3v9'hF-8ߢ5CĝٶA-G" :k/YB47O@gvbif)It ܋0Iq! (.ts_i֋CnYσ1Hĥl+A:ݞ!\,2?l2Ŀ\ڢꔡݳm2o*Z(J3- "x 8~<;5_B*.w)Q!f'[!|j  <\wokOm"WכZJhZeco%l&|t Γ @l\N_1Pϝxр"FH=}5˗]Ju!ڡViChS[FCe 'M @w"ӬգPƔKSc-ջxΠGf@yT U#6y h^~Q0u⪿e6ȹA튅luG_23grFRD魓GX13L1oU4,F0hg+n*lCG0WX4a_۫gdu9XKc;9n1Q@711_%1f~h]td#ݘgҢpUsyriw}Qx?Łh9&Uq-]FP1gyL%9wڳe5?ZCw̨9NW#9̆$ $L>>u =t+jhQB . &PK||=^$7o l_~Dvaqf `Bo)=ab: teH;6^0Ba# \fq 0rtE&%0{SZki`EՉ5B<铵;]Mdً?-5e}w4#:4Ўf gtk@p HKW2{a4*`y֮-)bvv{f#!R8>1-a}X+o;wi\Ѹo Lf=~3A|`lnm GݖbC0 "gwQ3{U>R2pC&{jhP!FGpm4ps5yRiA4Do˶y츋.5S@9 \/8[*8ΰ _ξXܣq! G&bK;wbƒ$J!5!k&`x&FdQ{v/}mɜ'ŒY?8L oXV]⅃ .|] TkG8"g?q- *4<):a) H$,sw#$NV ҟ?Ztf~uwY7|_F3z$R}WGvIqb puPQ]+諸Y臋|Żqo f"\J^a+[62g8쇺_ŢoGHb^{)- Fmqs;6_Z (ZܣYެ&8 ]}9\8#NDb@"Na驜:-XdB YД>#Mq(`7QcdM§V'9Y%VAQl^VPMҍOдn?pקf$ԫah!@Ĭ 6@Rنl bviq4c/Ͱt#[(|[[({p ߑ;SNϬo%ɏ?}_]i@z%Ȩ ΝS͂<.tc ;:ݧВPk[=(bK1s]&u;Q ]$xM TV_N|LKx*H.sFRBX0{ UAer2s`> cA , 膭Nc'E\'Dtǚ?51 9TI?%6dTAG_{5vD}@ԏqO0 o z`XHB ӑ$(+m"eL߅jId+p⿧#dm`qH63=祒}~"mfԌ3 n N/M%1Zr1#ETxh Os$$5 ~,{֟Ժ:jͼ~RI"Ryq"m}g²MC##,~t+-Pbك27COJS{}aÈu:Tfpb=o߂6g:"/eah?Eƨ!yMV>FzF}*"F!Ƃ9an)Ma_q\n[IpWmX>^^ԥ˓PUl6}"+Ĉ< 5?,rM#IhJ~) J ;1S7(]}LƅbB5Qvu$ /UiL qs+lRGuY>}X<%C>/sU3WiMGNExL |S!t]{ه7u!L7 M]gU9?B;u 6\>mK4_ugaPO#k(/{b[k_1īAL?ッ(ټu!9͇4Pw3ynwMܞhl:;x@vAL"^t:`[.>,, ݘ쾑pA*㍲帶%;̔&Q]JQaZNL°cBs Va!"¥‚ Ӣm8w(ꚲlJ,f!alPYN#wS͍-Û򥘔OJ X A2&\:23hB!ZxiBEdwe.T#fax^.T($IWs=zrk+kr e=NG Am~W[sChp->dkPܯ>cHW Z*xWcv~ gېsq@~Y?iޠ'=Cաw]q%3J0(+X8|:pXу.Sh,X_ AUlSzw.g>oȤ=@ގNyݖ{qߗ/iV30JP[ݹ^q=KU>˼SJ GE*]fk ۡ$  8h|vHqfNPxr>|Xo|0cA֫GЂ$LSM?M\[p;6 9f:fYi>n*)#ZAIueFݷ HARr7W?;w@BKEcMeg3罹osA#FFwY"f{@ʖc}tVؒ#H\Uȯ=$/'F$}-b8n?FzͤqP6`79#"Z@g1Syw>(//]gsBGj*|lbآq @+qf*a9/v# (4a!Ws?D$1)U.5HE@ZӪMoPaDf_ kKNOkPgP{8H,Ÿu>;;&u7a0`YprD;ObM(SÁ/\τ ׬E-24oSDtBsWAu5]Ôo[ĘhA\%F $0/5/rbfH_2=-2վ_sͭEVֲ>ͶU!9n{ɜsEH52Dmt-*3Ȳ{x9Ȇ(3݇X_-J-v}`/iV=_xQ&fkόPYCP88Rk^$t|ΜQ&n_R9y&|IX@%j%)dYsQ`s)NFȋ} X ΃YKh?/!pMLkJfQLڔnk27)+E,+.KJy[]p#6 |{a]HB\{¥"_6UpIEJ4hyd7{Kl\%`=)j?ϻ᎔9DHQ WtuIW;Eu׷w3JkPa`;MQo.Tvmb>> e˜muF@e֒VVt2jcfVL"5~B1%R axuJh aʹ םG. mUN ZO-G{F..ظ¶pxh'*@W6M-IVk(1 =`;@pDKSA*B/[^~v'OwDnF7um ᨎ4#k|GGK.tijWN$~>q2GI?p%"98 Sc˞9͘:o) 8$h>ze™"-!a-Z0 W=BgLoR{lqZJM~-v|ShCf:-rM9pr/B-,3g_8f(FWKxLՠ=#/:RFBoiDH:+U5T]E!z"GXMa3{aIJ4}觰m%\6I`hшRHnaʞ^U>},r[^3I Uοi+`4iƄ}IFwwV(HV^)*1p tgl JQ%{@BG n'7 bNJ~eqwkxg1Pf񊑯*7y#mTkJV|Hqvk/zY#QqMJTEB i4N .X_-qаV9Nk齹P~Dޢ&Q9i=05j&E4HJ@*6bzs+e|)-׉e}7f>-U~&H$%?5?@g`HƸV#]cɍ3bmvb^tdjw)㉣Q)-&&×%yrLo],,G(KmCH.^4'BbR\o_]~%3?@0OGH,]5sla~=vrƓ!T|⣂7@4/wBr5R߰ #(հT <㘗HyjKgkRO+$@|.xBI'Uɶt9n%97ٲVgfu g6m=@A$ [LeͬI5+mT΢探NRh/Wh qp,ٛZ{ SC>|LF 2ƕIu% YWڂ@[J&Fg::%eqŵt4zUjj($;.85 YM _&+sm\}"jD( EK%T5G"kFQ OOE Ų'IOe#ir'6⮹ `}-^~ԽQ 6<IZ.,=2>/9J_SWJ;ܖ5Ilâ*1v^nok+C2dZll+6Mو5&ugtGىֽ/(B0&RyQ/+N1^[no\ 't45 " L LqZ`|Pż5L@3O%8Iͳ/^xyn1] l!7C q"%n`N8v`4pĘ:Ʒ sxx=H$ɛg 21g.)Xd/|;|}dMa%~箉6-$NyHOOPgQ?]tퟩmV܇|ef>kr[ep :¤R (I{.˿Cv7>uŸKPUgȶ ,Bvb؂^8ƥ0RTDq!\!M}3‚ߢ <ϦX?{+ 2XwGx:omllLaz/9,GOh?aj(jP#[]~0jc8zZOV˖=GRDE"᾿Yߔ[HGF( WW;m@ XfB U3w cIgrhWbiԯG-zZ.Dd lf̓0,-vL+|Jٛ}Ah_qoH#b홖H۟(PvRܰ9`|OJgho:ڂ1L:޴fJN졭9_Z+A,q'?s%"Fp-!Hvdsw69G-+c(QT-MrWn=ЧO,B|i/?#@{M,jqhYYVQFLv9kW~eprۧf7>f.s$3>].SM[e $-*Rj^r&S|SpW/6؟zi ';s<RR _ .''Xg)Y߃`5 pXjHʮ*xEw<%6ؒК |1D4j ,AIE}x@1^Rّ2ϓ8sA4r HHH[_rF/WjE]! z(=vz_^֤5WFϽqUI %'Ch_chj<`l #aeOF4lg9uE9 "A{lu&<;;.-#g_$f{x%[e׬!K,["m|>>Zg-0MXQ$9=,?i jviȢo-.to!c=i>{ CYB_a)Q8uP>DKXg}ͦ^)D1KY[[<U*?8730.)`ଢg83{cڽG~rD3ǀM鎎53d+wؙ.\y)y-O ԡoGwǭN%&FR ,+eoLU>b^cjt}bu%~,wk:ICij8|-m*šTOO9'XY?*8&cVq#`17 S1>B_?Q>kTO#bj;Hoч >aSl}K_U$&BRR xe>(;oaͮAk 3Nb/c;0c'tY8n!۔wІTM>&;*`rSHvnpuuzd=MmEIO3ai~9ʳTmdZW渧^3h/Ee +d* ?HBNohฺ=b=h!~=īy| 6*`Kk_?3 r͞o%ܗJ?M&Gy3k.[P0y3V+KKEʟ0X Xs;_o4IA=62쟭]ȯ }~L霧z|ۍn@nj,0 N2p_7V|+놗\́]*-N,2=]2IiB=jL} !߬9SP&9'B͕'>#Ju+~Hbd%^N1y.,yaBW)-7+_g5#29"ӼU8CAz$]rg-Kv4aḭe,"/%=[1cÖkOe\YS2w8?%9i&WUbx uXm?gs/騍4ܶ$: So!j(e $aW\Dt `6SI+oR㻥Rjӫq\n W-=BAȅ+) vP'HW .|Uq]B5 uS8C H>]ZM]➆ia|Q~ gy ?,M}3Z&ڙѵ !4H@QZk ef8dGm$&=3N֎7]OW9P\=`YC8|A 8s*O's$-ͯ%ֻ%(Jץ"ǫ{ςEѩ@aVFyH7aRVWTW<2f[I3e ۟ee]W"JGq|:?idڣ"z@y0+'k. U/tyl w^2<3jdRqčIvӹ-yRҷ,2jLK&9pb<@}'0ANwl7k {1OƮ9SByAIROٜބE $EirB((QiGSe碑.qY>T΂uSbrD&h.|?J(l YnI'YZ=sb;hܱZxiIqnxrxj6K['voɎk! ⫸@I7MOrdͬ2܊PeXBoQ Z*)=n|,QPu?W8Yb6_sp$O!%i#f. >,@`ԭDeL{`!OnX/PQ"E;ҹiՀ@5,7+Z)yCA~ۀ1k;BIpJ"enwHd". ~KAV{3#AuWQKCm64=4r_ϨWQXs%7#ͻ7zZSZQ噴Yԋ2i|C+hxsi!M(]9J| cA)"8t11csi:@"\kʿGS`a7z+95;&LK4l3`k\`-zXBhSLjZfXLqwWgẵk _g$6wtY(VVҒg 18Ӝ_ǻ[)"Z]T˾d\$6/(L˓ňj0uY*YoY= ߎDb4=wFb^P@ƕ9t~0~(sOIء.yl@OAQM1= Ȇ35gWaMјcf0 $fc5G&l~f/ OYATeszRjYU~.E !7W@\S(Ρ ڜ>$B4t߬-%jJ?risbű\K.\4Zhs /@3~מb);|Y@^<ԇ+4SÏE˸ Biǀ {:*qrcYp0`L::)cWwb%2H^;m#[ DZj2j@DjE (lRr{66||%e$ox@,/g9È4V?FEnO`,2E(ȫcy:R^r 苘dW೜6!ؾP3)}E*0GHFZIp4*F8rX#Pt/ U"Q@5vE0'J$96$l$"lYbc$tCgť\L4 N ^O sOxr/:"|/f1wBX_@p>t|f.ř8T!yal C favUj!2 ϡ l^gfki5ћpM=P).7% 4DA[3qn%KeR+ݩ翞~iX75]&)ܟmwo{Ĭih"UKІ*mˋ]} _)~PY^vP-BzT2^Ꜵ1ꁊ aIZ xĎR|,/Ȥܗlx='jf7@F)I6o[x{6#CdePbQ^Ɋ:Y0i!սoZc eS4zi.#\ÓWnA1䰩3R:U(#؄yP~ܴ0 \//G o AX(k |~zg:<Fl8:5l^ݙsAY))Lu9`!x &j}w~9s:F ޭ3Ϊ^R򿡙߉֢Ig|HLjx/Bgls Ws쉨5 W^}c DY+aV /!."8@ IkwUKqxxl4:b;zq=31G¿ =a"SYU7獏H=iYF-Nր2E!LL2h?׬`+QK Z'l"Im#G|&9S&ڛSq/%B[O. ^xPSky"Z{o^0 c`@#aH*Wdso~QO8@tBXF+h1h7>5LեG g6 nzsG$ l!ns^G5C"aifA(0+M5(=#a *VV*{ n$fCHBc:+}nu"`EX:^C eG_7UǷ|/wY3>q* pR0MV Jd5 (?d)PDŽAĐSb|L*x[=8{Ri(3.3#'I.3V)rJ# k0>+JCv(8ɪ8"q@R{j>d+w:=Gt!_:tx $ph1jAZ,wrᚗ%xl˳4Rx ߡͭZ}x!Ξ2|/E*e淕̾4Hެ;in9L_eeͯXL f 1u(ަ@ՠ-vv*WTT`Q+{'v x)Ѧ(iΒn~[ϒMJ~߈m flM3 ~7 gAT gMD j5eCe[%.g JuBC0>M]fۭ,rW }IHWz'yOBXwnΪd3K{9qΫS^Dtޚcwӫ0Vg6B4zeOZcW,Ek'&&΢JhN[m ЩwBN#|nu pPVsYwr}BEMCe2Z0BhŸ-=WJfBVP|%o'ua"gßU37Q0)%5Ώ/nwh"NMִ:E;ʻ۽_i adL:ꈗ!2HsjIFcwTOnjO4N+RblK rTҏ7  6 Fh‘^,RKx+*tGgi% E}c@)(:rd[`"7 T:!zTxVrLIJ*/6Ԅy%^) lD R v𼒡'ɨ1lkԼm l 63tRR˝Q&ۜkGD1AIR}] m:T:45J+Q%\ԺjRSNMxGHyXҿasaJLa}h"92EC 7lX3_~Or-(ۜ7VW4%2UG=^#~3}?t! IuyP*Δ@p´33OWH PT"JLli}ۈK3BBTۋ !‰;5c}Uæv%E-8a1a~})FPٽfಃq=UUûCpG::x&.~cO m#b8EKޯKez P=H1)a2bks|9e|0 S ^X0̣f!)bMwJnۅ ȗS8cOg98ͮI>t+NyD~J7:C)uqX}b**2eMÜ^..^"-@ 2+5KVJ$`7DaWpcZxte=Ϫ ;U)QJ? CMl=9_EU?rDwcZOLq6H- o 1ZިX:0 )>zj&8YE=> v Q>{꛲q4|pǹo_K 󠐭ǣKP8]& &M6R_qɒ2Vw-\t9X?^i(m{R-MPP24{!WԃoFTYOo+AE;! ;󧲹8{m66 0F%J5KKuz`nd)*,볔xn߾JVjO61/AU}ϗ̸|(NU՜S&OQhU ,`Hn^a+%dtG|5/n%F}gW}\QpeyNC> ["/P!TbX4Tudk1t^u  u'$2 d^ӿÙ.B$}QA,tj8vX00-A3Zդظ>1CE !VwPޕ(3k1j?e||`VɃ4\hm)#]&+הV9!*7-8f~Q!edbg]hMx,Nrpґkx͕ E$K (ş1\-l"W[dfv3тф['wٲgE7)B>RIR"R7A?rdZen. '*)q2+a $"F&xoҎ 01@Wc+ݾMZ3 )=LNj|(] fRBa4z2fj> !`?h2J7VLW zdx& 37Pc\v!@b72V字 dFˆVv,C(] +ީ|Ƿk`׾nRu0Mkkmp ҝO3sC; ^ٜBsWI#GQn+76F{ꊕAhs#5K$Hc0k61r4k˿SP1Bu?np9 ֠K<~ 9gR)%j0S`-&\qM j ˬdjNq: F>W6^YZ}/{# xn6y{IVw fkP%?NTp}Y gvFrYJ&/ŵ}\pid`,ĭ G@U9*Mı<)04(8#S]!}Wź;O9BXM!\@]E+/Їɚ:g^O6)Řð;6&Pa 2pX0OT)WLQ fu{w~u|sPJ/2' T`._C+VD)#mD#43,s#Bt7vp0C X¶o|qr o~ m ,g!<O/Ӯ+Z`7+8cs5fUV/_wҢJQwm> bun,%ky9bǿd,t[ fRοk@W蚧U:'{,o踅޵ܷ+ k{{ 9~ Fr4J"O*G/ScͬQ̛v%~a-go]v9} >d4@d ٕ`-42 MN4o⠆FTnm k0RMJqgǮ588NkW@1xx^SmVH`I z4H@#v&%Y:bb[XΪq7PTu2.LAܮϋu3X_r2. Q߬+.G#[g {Pn^1CmBHd|NJI-inuٯv+ +[|ǘfԼ̠q "w ˴4sv;lrf8Z΃~ l<4DMv.UzyEiGBRIł4HJf6Il: -؇u+z"_v󢂏Dy[5ڷ%z$^^Z#.hLAӈV.#J P8xA taʧq%ѱ?}~]|3ڸ DQ2|MtΞ/f-Oǚ3Iv$Ģ9BYl 4jsIt%6l8e@ZBcY95ӧP\7&Nf)/qx-6i>HsgVOlL(V|f|./dd8ꦛ/:F?e{4|=[Xҷv@[ێx\3V kAvt)f~*;͍0+ubOF3ߺqޏ66H)KaC2:⦎I4~LJF«aXy+\Ɍ참TcΎ |jR:*E&|wf*&㟲 Afh'|i"ukM"QLP(RJzaCv>EXwQda4X_ku9,15.#߈F4&NƬT/!]NZ9\jwtsɖO5i jzAING~x9Qy.|yWiˌ@ʧ.1cN LwPn(@J .,!1{,-VH !jj]tLe,E 5cbZ+pb5is"8u$?;&xfzZLŰI0;s$",BZB5[#pZ0EQn4%MaJ]̑Sygs Aj>jmLa1㜉.>%Ɠ! ~쌞 hߗ3?&(4#F}}ؒX KUT7T')zL]6Y,Q3gA0>5U2 -!n>Gǀ۠׆$829Wh_vZ^fr)|%~AMƫÿ3驅̜Gk(>_؍|8U)|+;nW0fs({"gd7_P&AkZQb|;43LK)r@YNZ+{rh(Gt$HL0׽1 ESER,H# f{.6֥C .X;Z7y&y֛Cu@B6\<0/t3KBh '5FHW1 y/my*aXpm[؂_LC~ Ty@[]-!.GXE27PȒpJSbX_#}`ߐ|[eeZ0ܢȐ]9J!ZSdWWz:= ]I;Uz{`N3 ڑ78Йve@ ^|pϟ"bSfRZ2E- kdAlbO)Kk,ae/e3OժT]pϒwfPPL~h [_jkNU;JGx0Dĕsh`@RV6`A>ьZW?Zx#U?'~*AIűM`xN\9eb<KٌMhAq 0튂 j-^@E7k[!/'/hoT"bU~$SBDThp \fUvyu#וzYAWE>ny 0)jP^Djut.H,]O<>6G)  U \ɼns9&]xH"D a-($QZ\PKLi@SLQF]xvB )o(LOp7?JE ^ ]n8ؽmI R'ޫo^W(kj7y>@ fn_>ҦZE]D$_ۂo5@Gm ^yΧ ¥}Xφl@Tr7D?Աx<ݬcCg꩗MLbmMGU5UbýD?cLbfC8b^yKV:qW =Rź:[ssMXktHܲ:ͪse^ ho&Okx7i,oJ }Qi=0p!t@Fexޛ:G;Feg$/njz|a|%ܺ$Y 1t>jMC8hя)f8B4E݌3,nFV6Fyy't(z԰3L;^z`(Ǝ7w d[!@^0l6®x*:"T3Cm%RͪVY<2o${?7"E'M ]@=w N#.>+d3K袿 VVD/;OiYג##(L*k^JFfysSJEʰ'A4xK[ ^e~@`?P0+0CM+@[sz$YmDeKỲ^zՒc}TjԤ 39)|C͑'Aq(+NwhBRKq|gr"txdO_7ih |B ?,m KחD@Z$ 63nK/ӆF~$U8}퀫0w4:[[{ڗi`jVcK/_k} Doؔvbdr51/ T+oFfٺyfOdváR6KfJ`/1~m֙Rlf^BDƔkX<GQDn_Mp-axKGK:4jBŖr 1Y0 \8A$ k^@i~@{߳S 7w6j7O6{W}Fok{TQ||cM[4{)ڼa݅jFHt2ĺ}1~BkULjn$IYr݆8泱(ؖ/|̨oooe[!Z|0:?W":9e\BuR?b)X>S*gDCU Fuec$^ 5Q-#`\.ؘ9ʠԲE;}S*&zx@gZr7<+JM}ZCM_M2m}Zyy9b̔^W:(hdZM Ds}??@XJ}O RߦAo[8>Dqyzw^n幗vmZOZZ,x@VC⥖ƾ*)(v5Ou5>hZ{,қ|D gUJ2rkOjz{u8U:QL,ӇN.53Ӊz9ke2GOM>(SA5ĆkA}P 9xj J"9{7QAo?ob&v룽Fc'DDa,xII4+e' 5O yi[GvqϬuguUlmŒ@ ^?H!_ SA-`B-=&͇btX~ L=N`cD< 2s6+}-K\j=K}z/dQ?⨧;38c=in$eEб/B-<3k.>[~ξI+B7?{;K$DzP奩EK'9ń6hI4X<1*X nX*|cǿjyL~RGI9)&t3f COw%\Z@)&/:}a%KqP~7tZp7ĺ 䥪@]1M$9͈ AX"svGg H@NJi{o?j4:eb#voEW?.oGʆHK E.0kjzZ4sӁ8P Pw JB BjgɁCc,ǚrڮܔ/4}v^G9OoHӐ1PU8uq&σDX5)2#PQ= Q"&P6с +Z3Pg`p%0Y)6,놟{Q0dMxe\6l%pfob{ծY5_)UG iUVd!4ťW߶qqK[l:z[nUan^؍, MyCAn.\hV-x#}U7mΧ;X(p {qdpqO]`W5VtT7~ ՜xyQ6c`LcNK>Fע3cA*xiv$/u%) ;_tzuA:;oUv>h킹φrl\4R!_!0? Qs]5Xg=M;rò-@Q}=U­0VAm~"ťtX׆ !]m7O^LNvXv(bҠCRp#Jt"hWHzAx\+26?1X8~0 LYs>qu4ӖB"h̰Ξ~K9hVfb|]Ks4pxUVz7՜o!싶ҍvuKlAHTlHRi'q*.QN7Y`.|h&"U" #&qKlEu e@P\JdEF5AUCllM|/_p0&zq`#Df2#*p[Lal'9uË< ADW(_@> ZuiIjZ˪O!4v+_/(-c1"?y˰d;Uq$%q/g//aņMg0-q?T;uiM p_1{ikh1a6݇s/ v0)Y`tA X9jL#r \TwyU R6c$q-jKD+;<&y3=u;Dɋ#{.j[ l v^/x3-?@3?h]:X\=  w+'Ȑؤe.G1 JIP`?ELvȭ#,&}1[Hx7^{H`6xz$aP3vQ{[o1/}4tT5A](uNPC@ )(N?j oq11Oݯ?dZ|ܔehM4't?W:"7`@cs.V Ť\}&/θRPk_u64THq2ֽ9o [$:0l n :I\b Hlrݕ3D@>U6 I wO? Kf S(yh]EjXyE_p+9e>ΌӀ7CC2Y3C:)|L:x%1R–ujmȖ]%i\j`hL 0F,R3xW0Vw`cEp!kHsf$5ۘQw]{,SWXs~53 [8Sּ%f-elD ' ^1赉H<=L 2F-etm=UGW I ]m77L(K yw`ce%~_qy5:XdiUur* j> B"V8: sbKpIeE2럣~(>nD6bYgZ|?T3W0'j.B:EpM&vg`wcs\`W\SmDaڮ`O!L?Q2^p:+#Q5}}fD{!qwPmE쓅05AFo{,׼M^FҤs?U^>S];F0Y^R̶_w9k!ПKQcq攼%j5r/!6Hsi]D@Ma4]!t %HdN]ON5;Hqv4bO"Laݢlۑz"0| =|+3Y?rnbA 07dOsN-?fhG_Qswky@%[{31.=ŕ%! A?bQb6Ct;b!''ť΅ag!k`pnH,(td9*xnd˫F|4$xu,i_m-JpyJbNK7k:7hU3!T~v߶[y&VYza $bFr;ZXVAlLr9ʟLܣVj'F Ԩ07튥 {&04c7׊XǺ^5udX/z⬽n4rh#`8*##'b\9 Y`J佄]~ﶕ[nTb) 㸏!>;ҦB?=L4|حEifF0^giHzwhƞ84BoՃmLc鰍1zآVw+]k *BE'RCJ EIqId w]"!˧L9糖8ȤbɿWT\*ej\էӨ@Uc蒀%3F ީ^].$ȄQ G޿prj>7 "֝#M,^҃<`'1W#H+XN⩘/>oQ+d O-C>onG Dac\"k\ xF*C_--nhOOCbqNx7/31#1&c@ @0* 70*&bvxW~3(z^p drg~yQ}s<c )7;x ֆfS3j7x z:RH}QV9rXJ0DM]Rm9ˋ;KBn@kIaq -!32q)+>&Clzp 0S&+wY9׭3mE9Q>hYawb6-p~oY}G?4#mE?5L/0?e72HͯlFƠMMxs֐*U~l&9[D円 {1UHn ̍ynI4Q7"73qH{yUKe%(j3.s̱Lŗ)z}3`Ќk&صM9vڲt2 1,}a$Ãq@9Wh#)Ine tvTxR;+ЏEwvuUo6F,vp Mjfqg\V^w0@ިô =zɽf)WU*?#*)V5sJ^FbƷ y-J`G1xHGŰz{ްQL\sDcN/-9A( /7嫻%wb76Z||=wlK@b@ćIE_1_RW[J!Lo);qF-y7K kjE/Tr>eyO뢌Ty:Rd[_1YHOl9I\3jױ?Mf?=bet>עJ iёaɕid-#4"y4iĠ1xݟ &?3֞soiw8e4#yx6/ C${׀+1u{ueP*a:dx;?2 >g ӾH*!@ 7i)~[4djX)sԛ"nT1qo28ӹoǂjLb9+( 5%U؁0'|i k?fzKٖ9+禍يY`0o$5F fH~3╝&U!);9P'6:A4^a]-<0sp.U>Jj*bbaDRVk)X2Kb@!䳕E߿<.3G'va^t5{Rkh:*9 8Ѣ=۳hj<0)u{K+0p9Y. ?@N[9\J0#vOW^S r=<,U\5 'H[9iKg 6ʢѲt=zz7EF@+CS'!F?Ar#>Cqw vώ59L;Oժ:[ߦ ;Wwv"sF$(uH4j*?lhq|{T:8nij[XqN-t2vˏlD:&G`mk&T<Ͱ(FsofkC<>J7_gh ɯaϑjl쪆.Fܖ:mEn7M jىG+KB_J+U 6F:Ld\KWMեYōl(s}"l/Ŀ[$6r\?Lw.0mc) {ř#w`'Tz)o75.BXk,qteǼ,Þe=~V5g 﫤zCh)#(d!qʙ% hGԳE?t=:rgF^u ͨAV0fqNLn8&JʋQ( l~:͜oi TI/^3$#m| }W%ʌ{1ZÕcNՓߌVwB8N8 QDEQA[][/&V}3rd"@{Ab#;r\\ӯ%ߘncfΟr^>'[}#!/928xC 7͖'= cQ»C%(!=pHd,9#9=LC@w]=*vx1,ijx9Q`KexASe8FК/ !̄mӀKN#c)0$@K^x2Y(i L^]-ZH:_&`u5/$[B4/Ҡl!UxV wkuwg(cӄ γN\YP$$~eSBx|芖U]s聯1b%*u]fZ{=bf[ KEVuM哹 Sev$; `E)2|CXlE?#-UZo8D&9\il5oC USh?oEpL1zZiSj(:FgwRH9".pb9՗uOk`$#!E{Cg*u)ςS4T˞LG{w %9h9O:Uq(So(&h+{'|2]Ӑ+qQWFSKS=&@CC~SGFem7;[]%GVP:*p"Ha =gi3ܳlE'X,x=ӷ^OL86`2T&, m;sw2g}agC#>[xXE=OHFVV=!] ߱L~B!" xde%cbPW:wM=ʦhOTTZأ!een_W3H[bj܆9\Y&gRʅi6fl伦/X5㟠&ō} (2򂛗0J o]ȏע%Fe;ct0:2rAhLj@'QVfRز\_R{#lrShNxH+7):GʾM8MI Gm ):j0dCZ> ˆɚI>::Ceky`Ow؁%ɔ!s+]i.9Rpx.:+d^X~ ri}b&M|Vm1{Z諚7o'лRBu>B ߄z9Q۶8W|V40Ҥ͵2x5Ȓ)ا>I01N]x#܇⡐D~oj')궠P]'{9i+ۓlV>Iȑҩbuת[ȾOA'$\;AQ H\vs?~kH֛q@Ry,#?#:CNԬ!ݚtx2Cgay0:j<|TMw8?)D߿%88W{9 g%_FEбˣ5YcR#b^1Bm*oHXN,Qr;[ 1o_.ptcZâ9l$$Ugܱ?1?M c7C+r)`>v3y%V~GS?A![,<ʉGW/5G( h[ TːYO1tg6*# O2v;^F+t~YcN>~6D]L]FU&DP|3ȜE.4ov]5gY΂;jMK]h  YZ