libsamba-errors0-4.6.7+git.38.90b2cdb4f22-3.1>t  DH`pY^Ǹ/=„r^KgLJ"8Fp(ʓ{ERNl-ձ I0_˖&$$/S >o&Wc)FsPI~Pa 0d.0kT?~@٬W!k@a*h"bV#]&psnh}E˺͗%'lm{8(f mnkff` }y,QE|S.W{ě8Oe|&=cTwc8Ń1801518d1604fa093ae1f1f4ce2c44e43a63629aY^Ǹ/=„#  vXH^3\Il#LW3~+i?~Yg%hsŀ9uh]TJyubfh a 9|/9\&I{ũ`|hr ))uvD4-p>bv!'G_]QpAe\yקz)e;֫`ұP͢.#|Q=ZWƳjg8@u[*z=u{؊NN a5f4><r?rd, 0 N      $ E HLQV $  (;8D9 :9I>o@pFpGp(Hp,Ip0Xp4YpD\p]p^pbpcq.dqeqfqlquqvqwrpxrtyrxzrClibsamba-errors04.6.7+git.38.90b2cdb4f223.1Samba errors handling library Source Timestamp: 3761 Branch: 4.6.7+git.38.90b2cdb4f22Y]cloud101(openSUSE Leap 42.3openSUSEGPL-3.0+http://bugs.opensuse.orgSystem/Librarieshttps://www.samba.org/linuxx86_64(Y]fae961ae3af3778d508a8f336211f26frootrootsamba-4.6.7+git.38.90b2cdb4f22-3.1.src.rpmlibsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1)(64bit)libsamba-errors0libsamba-errors0(x86-64)@@@@@   /sbin/ldconfig/sbin/ldconfiglibc.so.6()(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)rpmlib(CompressedFileNames)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsLzma)3.0.4-14.0-14.4.6-14.11.2Y3YYu@Yg`Yf@Y7Y7Y, @Y"X:@X:@XXsX@X9@X@X@Xg@X,XƉX@XYXe@XX@X@X@XWXAb@X-W Wv@W$W;Wu@W#WW W@W~D@Wj}W_WYZ@WYZ@W=W(W!@WW@V3V3VV'@VՄ@VՄ@VVIV@V`Vl@V@V@V<@V<@V@VjV]VI@VG"@VG"@VG"@VG"@V(V'~@V V7@VBUYU@U@UUAUĝU@UU@Uy@UUrUq@UhTU_@USaT5'@T5'@T3T12T->@T->@T%U@T$T!`T!`T@T@TSS<@SS@S@Sہ@Sہ@Sہ@S@S;@S.S@SSSS@S@SS8@S}SxSg}@ScSZN@SXSO@SM@SM@SG@SG@SG@SG@S:@S:@S5d@S2@S,)S L@SSSS@S@S(S @S S 4@S?S?S?SK@R@Rb@R@RRR@R@RRRRRURURURRR&R@RR=R=RʚRʚRʚRʚRʚRʚRSRR@RjRjRv@RG@RG@RRRRR RiRu@RpRW@RUE@RUE@REs@R:@R6R4OR2@R(r@R%@R!R7R@R@QQQ@QQQQޞ@Qޞ@Qޞ@Qֵ@QQo@QzQQɆ@Q@Q(@Q@Qzl@QdQAQ,Q+R@Q@QQQ@Q@QEQ@Q \Q \PP-P-P9@PPDP[P@PѬ@P @P @PPP}@P+P@PP@PBPBPPP@P@P*P6@Pd@PoPoPoPoP{@Pb@Pb@PWPWPQP,PPP H@P H@PP@OjOjOORORO Ọ@OȮOȮO]@O]@O OE@O!O@OOO@O OoOc+@OaO`@OKp@OB5O>A@O=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2.- Rebase File Server Remote VSS Protocol (FSRVP) server against 4.2.0rc1; (fate#313346).- Backport upstream master fixes for samba-regedit; (bnc#896536).- BuildRequire python-xml on SUSE systems only.- BuildRequire python-xml. - Exclude unwanted texpect binary and libhttp, libsamba-cluster-support, libsamba-debug, and libsocket-blocking shared libs. - Add vfs_fruit and vfs_worm man pages and ndr_dcerpc, smb2_lease_struct, tstream_smbXcli_np, idtree, and idtree_random header files. - Remove nmblookup and smbclient4 binary and nmblookup4 man page.- Update to 4.2.0rc1.- Fix small memory-leak in the background print process; (bnc#899558).- Modify samba-regedit so it displays correctly (related to ncurses). Changed code to use menu sub windows, seems to fix problems with display not refreshing; explicitly BuildRequire ncurses-devel; (bnc#896536).- Exclude unwanted libdnsserver_common and libdfs_server_ad shared libs and the man page of the unused findsmb script.- Skip groups that aren't mapped by idmap_ad; (bso#10824); (bnc#897969).- Update to 4.1.12. + s3: winbindd: On new client connect, prune idle or hung connections older than "winbind request timeout". Add new parameter "winbind request timeout". Please see smb.conf man page for details; (bso#3204); (bnc#872912). + Fix smbd crashes when filename contains non-ascii character; (bso#10716). + s4-rpc: dnsserver: Handle updates of tombstoned dnsNode objects; (bso#10749). + passdb: Fix NT_STATUS_NO_SUCH_GROUP; (bso#9570). + s4:setup/dns_update_list: make use of the new substitution variables; (bso#9831). + build: Fix configure to honour '--without-dmapi'; (bso#10369). + provision: Correctly provision the SOA record minimum TTL; (bso#10466). + s3: Enforce a positive allocation_file_size for non-empty files; (bso#10543). + lib: tevent: make TEVENT_SIG_INCREMENT atomic; (bso#10640). + Make "case sensitive = True" option working with "max protocol = SMB2" or higher in large directories; (bso#10650). + Samba 4 consuming a lot of CPU when re-reading printcap info; (bso#10652). + lib: strings: Simplify strcasecmp; (bso#10716). + Allow netr_ServerReqChallenge() and netr_ServerAuthenticate3() on different connections; (bso#10723). + 'net time': Fix usage and core dump; (bso#10728). + sys_poll_intr: Fix timeout arithmetic; (bso#10731). + s3:idmap: Don't log missing range config if range checking not requested; (bso#10737). + Fix flapping VFS gpfs offline bit; (bso#10741). + s4-rpc: dnsserver: Allow . to be specified for @ record; (bso#10742). + s4-rpc: dnsserver: return DNS_RANK_NS_GLUE recors when explicitly asked for; (bso#10751). + samba: Retain case sensitivity of cifs client; (bso#10755). + lib: Remove unused nstrcpy; (bso#10758). + Fix a memory leak in cli_set_mntpoint(); (bso#10759). + docs: Fix typos in smb.conf (inherit acls); (bso#10761). + libcli/security: Add better detection of SECINFO_[UN]PROTECTED_[D|S]ACL in get_sec_info(); (bso#10773). + s3: smbd: POSIX ACLs. Remove incorrect check for SECINFO_PROTECTED_DACL in incoming security_information flags in posix_get_nt_acl_common(); (bso#10773). + Don't discard result of checking grouptype; (bso#10777). + s3:libsmb: Set a max charge for SMB2 connections; (bso#10778). + smbd: Properly initialize mangle_hash; (bso#10782). + dosmode: Fix FSCTL_SET_SPARSE request validation; (bso#10787). + vfs_dirsort: Fix an off-by-one error that can cause uninitialized memory read; (bso#10794).- Wait for network-online.target to prevent caching of pre-network failures; (bnc#889175).- Use domain name if search by domain SID fails to send SIDHistory lookups to correct idmap backend; (bnc#773464).- Prune idle or hung connections older than "winbind request timeout"; (bso#3204); (bnc#872912).- fix FSCTL_SET_SPARSE request validation; (bso#10787); (bnc#893774).- Remove pre-11.2 patch which by default uses the smbpasswd passdb backend.- build: disable mmap on s390 systems; (bso#10765); (bnc#886193); (bnc#882356).- Create the cups smb backend as sym link pointing to smbspool; (bnc#891220).- Fix winbind service parameter usage; (bnc#890005).- lib/param: change the default for "winbind expand groups" to "0"; (bnc#890008).- Update to 4.1.11. + A malicious browser can send packets that may overwrite the heap of the target nmbd NetBIOS name services daemon; CVE-2014-3560; (bnc#889429).- Fix "net time" segfault; (bso#10728); (bnc#889539).- Update to 4.1.10. + net/doc: Make clear that net vampire is for NT4 domains only; (bso#3263). + dbcheck: Add check and test for various invalid userParameters values; (bso#8077). + s4:dsdb/samldb: Don't allow 'userParameters' to be modified over LDAP for now; (bso#8077). + Simple use case results in "no talloc stackframe around, leaking memory" error; (bso#8449). + s4:dsdb/repl_meta_data: Make sure objectGUID can't be deleted; (bso#9763). + dsdb: Always store and return the userParameters as a array of LE 16-bit values; (bso#10130). + s4:repl_meta_data: fix array assignment in replmd_process_linked_attribute(); (bso#10294). + ldb-samba: fix a memory leak in ldif_canonicalise_objectCategory(); (bso#10469). + dbchecker: Verify and fix broken dn values; (bso#10536). + dsdb: Rename private_data to rootdse_private_data in rootdse; (bso#10582). + s3: libsmbclient: Work around bugs in SLES cifsd and Apple smbx SMB1 servers; (bso#10587). + Fix "PANIC: assert failed at ../source3/smbd/open.c(1582): ret"; (bso#10593). + rid_array used before status checked - segmentation fault due to null pointer dereference; (bso#10627). + Samba won't start on a machine configured with only IPv4; (bso#10653). + msg_channel: Fix a 100% CPU loop; (bso#10663). + s3: smbd: Prevent file truncation on an open that fails with share mode violation; (bso#10671); (bnc#884056). + s3: SMB2: Fix leak of blocking lock records in the database; (bso#10673). + samba-tool: Add --site parameter to provision command; (bso#10674). + smbstatus: Fix an uninitialized variable; (bso#10680). + SMB1 blocking locks can fail notification on unlock, causing client timeout; (bso#10684). + s3: smbd: Locking, fix off-by one calculation in brl_pending_overlap(); (bso#10685). + 'RW2' smbtorture test fails when -N is set to 2 due to the invalid status check in the second client; (bso#10687). + wbcCredentialCache fails if challenge_blob is not first; (bso#10692). + Backport ldb-1.1.17 + changes from master; (bso#10693). + Fix SEGV from improperly formed SUBSTRING/PRESENCE filter; (bso#10693). + ldb: Add a env variable to disable RTLD_DEEPBIND; (bso#10693). + ldb: Do not build libldb-cmdline when using system ldb; (bso#10693). + ldb: Fix 1138330 Dereference null return value, fix CIDs 241329, 240798, 1034791, 1034792 1034910, 1034910); (bso#10693). + ldb: make the successful ldb_transaction_start() message clearer; (bso#10693). + ldb:pyldb: Add some more helper functions for LdbDn; (bso#10693). + ldb: Use of NULL pointer bugfix; (bso#10693). + lib/ldb: Fix compiler warnings; (bso#10693). + pyldb: Decrement ref counters on py_results and quiet warnings; (bso#10693). + s4-openldap: Remove use of talloc_reference in ldb_map_outbound.c; (bso#10693). + dsdb: Return NO_SUCH_OBJECT if a basedn is a deleted object; (bso#10694). + s4:dsdb/extended_dn_in: Don't force DSDB_SEARCH_SHOW_RECYCLED; (bso#10694). + Backport autobuild/selftest fixes from master; (bso#10696). + Backport drs-crackname fixes from master; (bso#10698). + smbd: Avoid double-free in get_print_db_byname; (bso#10699). + Backport access check related fixes from master; (bso#10700). + Backport provision fixes from master; (bso#10703). + s3:smb2_read: let smb2_sendfile_send_data() behave like send_file_readX(); (bso#10706). + s3: Fix missing braces in nfs4_acls.c.- Reduce printer_list.tdb lock contention during printcap update; (bso#10652); (bnc#883870). + Only update the printer share inventory when needed.- Add missing newline to debug message in daemon_ready(); (bnc#865627).- BuildRequire systemd-devel, configure --with-systemd, and modify the service files accordingly on post-12.2 systems; (bso#10517); (bnc#865627).- Prevent file truncation on an open that fails with share mode violation; (bso#10671); (bnc#884056).- Update to 4.1.9. + Fix nmbd denial of service; CVE-2014-0244; (bnc#880962). + Fix segmentation fault in smbd_marshall_dir_entry()'s SMB_FIND_FILE_UNIX handler; CVE-2014-3493; (bnc#883758).- BuildRequire krb5-devel, libiniparser-devel, and python-devel in any case.- BuildRequire libxslt and perl-ExtUtils-MakeMaker and BuildIgnore libtevent on CentOS, Fedora, and RHEL systems.- Update to 4.1.8. + dns: Don't reply to replies; CVE-2014-0239; (bso#10609). + Malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response; CVE-2014-0178; (bso#10549). + s3: smb2: Fix 'xcopy /d' with samba shares; (bso#3124). + Extra ':' in msg for Waf Cross Compile Build System with Cross-answers command; (bso#10151). + s3: nmbd: Reset debug settings after reading config file; (bso#10239). + Fix empty body in if-statement in continue_domain_open_lookup; (bso#10348). + script/autobuild: Make use of '--with-perl-{arch,lib}-install-dir'; (bso#10472). + wafsamba: Fix the installation on FreeBSD; (bso#10472). + Use exit_daemon() to communicate status of startup to systemd; (bso#10517). + Fix adding NetApps; (bso#10524). + s3: lib/util: Fix logic inside set_namearray loops; (bso#10544). + s3: lib/util: set_namearray reads across end of namelist; (bso#10544). + idmap_autorid: Fix failure in reverse lookup if ID is from domain range index #0; (bso#10547). + build: Fix ordering problems with lib-provided and internal RPATHs; (bso#10548). + Fix read of deleted memory in reply_writeclose()'; (bso#10554). + lib-util: Rename memdup to smb_memdup and fix all callers; (bso#10556). + Fix lock order violation and file lost; (bso#10564). + dsdb: Do checks for invalid renames in samldb, before repl_meta_data; (bso#10569). + Fix wildcard unlink to fail if we get an error rather than trying to continue; (bso#10577). + byteorder: Do not assume PowerPC is big-endian; (bso#10590). + printing: Fix purge of all print jobs; (bso#10612).- examples/libsmbclient: avoid some compiler warnings; (bso#10624).- Fix printer job purging; (bso#10612); (bnc#879390).- Update samba-pubkey_6568B7EA.asc which will expire 2016-01-17.- Fix byte-order macros on little endian Power8; (bso#10590); (bnc#871701).- Pass through vfs_btrfs snapshot manipulation requests when "btrfs: manipulate snapshots = no" is configured; (bnc#874180).- Clone the base share security descriptor when exposing a snapshot share; (bnc#874656).- Use appropriate HRESULT return codes; (bnc#875046).- Update to 4.1.7. + Make "force user" work as expected; (bso#9878). + Fix build on AIX with IBM XL C/C++ (gettext detection issues); (bso#9911). + Fix problem with server taking too long to respond to a MSG_PRINTER_DRVUPGRADE message; (bso#9942). + s3-printing: Fix obvious memory leak in printer_list_get_printer(); (bso#9993). + doc: Add "spoolss: architecture" parameter usage; (bso#10188). + Make 'smbclient' support DFS shares with SMB2/3; (bso#10200). + Make (lib)smbclient work with NetApp; (bso#10230). + SessionLogoff on a signed connection with an outstanding notify request crashes smbd; (bso#10344). + dfs: Always call create_conn_struct with root privileges; (bso#10378). + 'net ads search' on high latency networks can return a partial list with no error indication; (bso#10387). + max xmit > 64kb leads to segmentation fault; (bso#10422). + Fix STATUS_NO_MEMORY response from Query File Posix Lock request; (bso#10431). + Increase max netbios name components; (bso#10439). + smbd_server_connection_terminate("CTDB_SRVID_RELEASE_IP") panics from within ctdbd_migrate() with invalid lock_order; (bso#10444). + Fix 'wbinfo -i' with one-way trust; (bso#10458). + samba4 services not binding on IPv6 addresses causing connection delays; (bso#10464). + s3-vfs: Fix stream_depot vfs module on btrfs; (bso#10467). + Don't respond with NXDOMAIN to records that exist with another type; (bso#10471). + pidl: waf should have an option for the dir to install perl files and do not glob; (bso#10472). + s3-spoolssd: Don't register spoolssd if epmd is not running; (bso#10474). + s3-rpc_server: Fix handling of fragmented rpc requests; (bso#10481). + Initial FSRVP rpcclient requests fail with NT_STATUS_PIPE_NOT_AVAILABLE; (bso#10484). + lsa.idl: Define lsa.ForestTrustCollisionInfo and ForestTrustCollisionRecord as public structs; (bso#10504). + Make 'smbreadline' build with readline 6.3; (bso#10506). + smbd: Correctly add remote users into local groups; (bso#10508). + rpcclient FSRVP request UNCs should include a trailing backslash; (bso#10521). + Cleanup messages.tdb record after unclean smbd shutdown; (bso#10534). + s3:rpc_server: Minor refactoring of process_request_pdu().- Create a new DBus connection for every vfs_snapper request, to ensure correct snapper UID detection; (bnc#866354).- Fix "Invalid read" in method reply_writeclose; (bso#10554); (bnc#873658).- Fix minor compiler warnings in snapshot code-path; (bnc#873177).- Remove references to the obsolete samba-krb-printing package and get_printing_ticket binary.- Fix malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response; CVE-2014-0178; (bso#10549); (bnc#872396).- User error strings instead of hex codes where possible for FSRVP errors; (bnc#866927).- Fix remote share shadow copy request UNCs; (bso#10521); (bnc#870957).- Add krb5rcache directory to the winbind package; (bnc#870607). - Cleanup and consolidate the sysconfig and systemd service files.- Extend vfs_snapper man page to cover permissions; (bnc#870570).- Fix RPC server handling of fragmented requests; (bso#10481); (bnc#869707).- Default with the cache and lock directory to the same path to have both non-persistent and persistent data at one location; (bnc#846586).- Depend only on %version with all manual Provides and Requires; (bnc#844307).- Update to 4.1.6. + Password lockout not enforced for SAMR password changes; CVE-2013-4496; (bnc#849224). + smbcacls can remove a file or directory ACL by mistake; CVE-2013-6442; (bnc#855866).- Password lockout not enforced for SAMR password changes; CVE-2013-4496; (bnc#849224).- Call update-apparmor-samba-profile via ExecStartPre too; (bnc#867665).- samba4 smbcalcs --chown | --chgrp dacl regression; CVE-2013-6442; (bnc#855866).- Retry named pipe open requests on STATUS_PIPE_NOT_AVAILABLE; (bso#10484); (bnc#865095).- Propagate snapshot enumeration permissions errors to SMB clients; (bnc#865641).- Properly handle empty 'requires_membership_of' entries in /etc/security/pam_winbind.conf; (bnc#865771).- Fix problem with server taking too long to respond to a MSG_PRINTER_DRVUPGRADE message; (bso#9942); (bnc#863748). - Fix memory leak in printer_list_get_printer(); (bso#9993); (bnc#865561).- Fix stream_depot VFS module on Btrfs; (bso#10467); (bnc#865397).- Use libarchive to provide improved smbclient tarmode functionality; (bso#9667); (bnc#861135).- Depend on %version-%release with all manual Provides and Requires; (bnc#844307).- Update to 4.1.5. + Fix 100% CPU utilization in winbindd when trying to free memory in winbindd_reinit_after_fork; (bso#10358); (bnc#786677). + smbd: Fix memory overwrites; (bso#10415). + s3-winbind: Improve performance of wb_fill_pwent_sid2uid_done(); (bso#2191). + ntlm_auth sometimes returns the wrong username to mod_ntlm_auth_winbind; (bso#10087). + s3: smbpasswd: Fix crashes on invalid input; (bso#10320). + s3: vfs_dirsort module: Allow dirsort to work when multiple simultaneous directories are open; (bso#10406). + Add support for Heimdal's unified krb5 and hdb plugin system, cope with first element in hdb_method having a different name in different heimdal versions and fix INTERNAL ERROR: Signal 11 in the kdc pid; (bso#10418). + vfs_btrfs: Fix incorrect zero length server-side copy request handling; (bso#10424). + s3: modules: streaminfo: As we have no VFS function SMB_VFS_LLISTXATTR we can't cope with a symlink when lp_posix_pathnames() is true; (bso#10429). + smbd: Fix an ancient oplock bug; (bso#10436). + Fix crash bug in smb2_notify code; (bso#10442).- Remove superfluous obsoletes *-64bit in the ifarch ppc64 case; (bnc#437293).- Migrate @GMT token parsing functionality into vfs_snapper; (bnc#863079). + Improve vfs_snapper documentation.- Fix Winbind 100% CPU utilization caused by domain list corruption; (bso#10358); (bnc#786677).- Fix memory overwrite in FSCTL_VALIDATE_NEGOTIATE_INFO handler; (bso#10415); (bnc#862370).- Streamline the vendor suffix handling and add support for SLE 12.- Fix zero length server-side copy request handling; (bso#10424); (bnc#862558).- Set the PID directory to /run/samba on post-12.2 systems.- Make use of the tmpfilesdir macro while calling systemd-tmpfiles.- Make winbindd print the interface version when it gets an INTERFACE_VERSION request; (bnc#726937).- Fix vfs_btrfs build on older platforms with duplicate WRITE_FLUSH definitions; (bnc#860832).- Check for NULL gensec_security in gensec_security_by_auth_type(); (bnc#860809).- Ensure ndr table initialization; (bnc#860648).- Add File Server Remote VSS Protocol (FSRVP) server for SMB share shadow-copies; (fate#313346).- s3-dir: Fix the DOS clients against 64-bit smbd's; (bso#2662). - shadow_copy2: module "Previous Version" not working in Windows 7; (bso#10259). - s3-passdb: Fix string duplication to pointers; (bso#10367). - vfs/glusterfs: in case atime is not passed, set it to the current atime; (bso#10384)- s3: winbindd: Move calling setup_domain_child() into add_trusted_domain(); (bso#10358); (bnc#786677).- Default sysconfig daemon options to -D; (bso#10388); (bnc#857454).- Add /var/cache/samba to the client file list; (bnc#846586).- Really add the WINBINDDOPTIONS sysconfig variable on install; (bnc#857454).- Correct sysconfig variable names by adding the missing D char; (bnc#857454).- Update to 4.1.4. + Fix segfault in smbd; (bso#10284). + Fix SMB2 server panic when a smb2 brlock times out; (bso#10311).- Call stop_on_removal from preun and restart_on_update and insserv_cleanup from postun on pre-12.3 systems only; (bnc#857454).- BuildRequire gamin-devel instead of unmaintained fam-devel package on post-12.1 systems.- smbd: allow updates on directory write times on open handles; (bso#9870). - lib/util: use proper include for struct stat; (bso#10276). - s3:winbindd fix use of uninitialized variables; (bso#10280). - s3-winbindd: Fix DEBUG statement in winbind_msg_offline(); (bso#10285). - s3-lib: Fix %G substitution for domain users in smbd; (bso#10286). - smbd: Always use UCF_PREP_CREATEFILE for filename_convert calls to resolve a path for open; (bso#10297). - smb2_server processing overhead; (bso#10298). - ldb: bad if test in ldb_comparison_fold(); (bso#10305). - Fix AIO with SMB2 and locks; (bso#10310). - smbd: Fix a panic when a smb2 brlock times out; (bso#10311). - vfs_glusterfs: Enable per client log file; (bso#10337).- Add /etc/sysconfig/samba to the main and winbind package; (bnc#857454).- Create /var/run/samba with systemd-tmpfiles on post-12.2 systems; (bnc#856759).- Fix broken rc{nmb,smb,winbind} sym links which should point to the service binary on post-12.2 systems; (bnc#856759).- Add Snapper VFS module for snapshot manipulation; (fate#313347). + dbus-1-devel required at build time.- Add File Server Remote VSS Protocol (FSRVP) client for SMB share shadow-copies; (fate#313345).- Do not BuildRequire perl ExtUtils::MakeMaker and Parse::Yapp as they're part of the minimum build environment.- Update to 4.1.3. + DCE-RPC fragment length field is incorrectly checked; CVE-2013-4408; (bnc#844720). + pam_winbind login without require_membership_of restrictions; CVE-2012-6150; (bnc#853347).- Make use of the full gpg pub key file name including the key ID.- Add transparent file compression support; (fate#316266). + Implement FSCTL_GET_COMPRESSION and FSCTL_SET_COMPRESSION handlers. + Add FILE_ATTRIBUTE_COMPRESSED and FILE_NO_COMPRESSION support. + Extend vfs_btrfs VFS module to utilize get/set compression hooks.- Add support for FSCTL_SRV_COPYCHUNK_WRITE; (fate#314770).- Remove bogus libsmbclient0 package description and cleanup the libsmbclient line from baselibs.conf; (bnc#853021).- BuildRequire systemd on post-12.2 systems.- Update to 4.1.2. + s4-dns: dlz_bind9: Create dns-HOSTNAME account disabled; (bso#9091). + dfs_server: Use dsdb_search_one to catch 0 results as well as NO_SUCH_OBJECT errors; (bso#10052). + Missing talloc_free can leak stackframe in error path; (bso#10187). + Fix memset used with constant zero length parameter; (bso#10190). + s4:dsdb/rootdse: report 'dnsHostName' instead of 'dNSHostName'; (bso#10193). + Make offline logon cache updating for cross child domain group membership; (bso#10194). + nsswitch: Fix short writes in winbind_write_sock; (bso#10195). + RW Deny for a specific user is not overriding RW Allow for a group; (bso#10196). + vfs_glusterfs: Fix excessive debug output from vfs_gluster_open(); (bso#10224). + vfs_glusterfs: Implement proper mashalling/unmarshalling of ACLs; (bso#10224). + VFS plugin was sending the actual size of the volume instead of the total number of block units because of which windows was getting the wrong volume capacity; (bso#10224). + libcli/smb: Fix smb2cli_ioctl*() against Windows 2008; (bso#10232). + xattr: Fix listing EAs on *BSD for non-root users; (bso#10247). + Fix the build of vfs_glusterfs; (bso#10253). + s3-winbindd: Fix cache_traverse_validate_fn failure for NDR cache entries; (bso#10264). + util: Remove 32bit macros breaking strict aliasing; (bso#10269).- Let gpg verify execution condition not fail on non SUSE systems.- Add systemd support for post-12.2 systems.- Allow smbcacls to take a '--propagate-inheritance' flag to indicate that the add, delete, modify and set operations now support automatic propagation of inheritable ACE(s); (FATE#316474).- Unconditionally create the CUPS smb backend sym link pointing to smbspool; (bnc#850656).- Update to 4.1.1. + ACLs are not checked on opening an alternate data stream on a file or directory; CVE-2013-4475; (bso#10229); (bnc#848101). + Private key in key.pem world readable; CVE-2013-4476; (bnc#848103).- Private key in key.pem world readable; CVE-2013-4476; (bnc#848103).- ACLs are not checked on opening an alternate data stream on a file or directory; CVE-2013-4475; (bso#10229); (bnc#848101).- Update to 4.1.0. + pam_winbindd: Support the KEYRING ccache type; (bso#10132). + Fix PAC parsing failure; (bso#10178).- Unify the defattr lines in the pidl, python, test and test-devel files section by removing the optional directory mode.- Verify source tar ball gpg signature.- Update to 4.1.0rc4. + dsdb: Convert the full string from UTF16 to UTF8, including embedded NULLs; (bso#8077). + python-samba-tool fsmo: Do not give an error on a successful role transfer; (bso#9461). + dbwrap_ctdb: Treat empty records as non-existing; (bso#10008). + Raise the level of a debug when unable to open a printer; (bso#10118). + Add "acl allow execute always" parameter; (bso#10134). + vfs_shadow_copy2: Display previous versions correctly over SMB2; (bso#10137). + smbd: Always clean up share modes after hard crash; (bso#10138). + Valid utf8 filenames cause "invalid conversion error" messages; (bso#10139). + libcli/smb: Use SMB1 MID=0 for the initial Negprot; (bso#10144). + Samba SMB2 client code reads the wrong short name length in a directory listing reply; (bso#10145). + libcli/smb: Only check the SMB2 session setup signature if required and valid; (bso#10146). + Better document potential implications of a globally used "valid users"; (bso#10147). + cli_smb2_get_ea_list_path() failed to close file on exit; (bso#10149). + Not all OEM servers support the ALTNAME info level; (bso#10150). + Regression causes replication failure with Windows 2008R2 and deletes Deleted Objects; (bso#10157). + Netbios related samba process consumes 100% CPU; (bso#10158). + Fix POSIX ACL mapping when setting DENY ACE's from Windows; (bso#10162).- Require libndr-standard-devel due to gen_ndr/lsa.h from libpdb-devel.- Add libdcerpc0, libdcerpc-atsvc0, libdcerpc-binding0, libdcerpc-samr0, libgensec0, libndr0, libndr-krb5pac0, libndr-nbt0, libndr-standard0, libpdb0, libregistry0, libsamba-credentials0, libsamba-hostconfig0, libsamba-policy0, libsamba-util0, libsamdb0, libsmbclient-raw0, libsmbconf0, libsmbldap0, and libtevent-util0 to baselibs.conf.- Add or polish the shared library package summaries and descriptions.- Update to 4.1.0rc3. + Fix working on site with Read Only Domain Controller; (bso#5917). + Add man page for vfs_syncops; (bso#7364). + Add man page for vfs_linux_xfs_sgid; (bso#7490). + When replicating DNS for bind9_dlz we need to create the server-DNS account remotely; (bso#9091). + Winbind unable to retrieve user information from AD; (bso#9615). + winbind_lookup_names() fails because of NT_STATUS_CANT_ACCESS_DOMAIN_INFO; (bso#9899). + Build Samba 4.0.x on AIX with IBM XL C/C++; (bso#9911). + Add SMB2 and SMB3 support for smbclient; (bso#9974). + Add man pages for ntdb tools; (bso#10000). + Add man page for samba-regedit tool; (bso#10001). + ::1 added to nameserver on join; (bso#10030). + Fix memory leak in source3/lib/util.c:1493; (bso#10063). + Fix segmentation fault in 'net ads join'; (bso#10073). + Fix variable list in vfs_crossrename man page; (bso#10076). + s3-winbind: Fix a segfault passing NULL to a fstring argument; (bso#10082). + smbd: Fix async echo handler forking; (bso#10086). + MacOSX 10.9 will not follow path-based DFS referrals handed out by Samba; (bso#10097). + Honour output buffer length set by the client for SMB2 GetInfo requests; (bso#10106). + Fix Winbind crashes on DC with trusted AD domains; (bso#10107). + Handle Dropbox (write-only-directory) case correctly in pathname lookup; (bso#10114). + Masks incorrectly applied to UNIX extension permission changes; (bso#10121).- Implement shared library packaging guidelines. - Correct interpackage dependencies; (bso#10129).- Define the source URL differently in the case of a release candidate.- Update to 4.1.0rc2. + Add vfs_btrfs module. + Add support for server-side copy operations via the SMB2 FSCTL_SRV_COPYCHUNK request. + Fix replication with --domain-crictical-only to fill in backlinks; (bso#9029). + Windows 8 Roaming profiles fail; (bso#9678). + Fix crash of winbind after "ls -l /usr/local/samba/var/locks/sysvol"; (bso#9820). + Windows error 0x800700FE when copying files with xattr names containing ":"; (bso#9992). + Do not delete an existing valid credential cache (s3-winbind); (bso#9994). + Fix segfault while reading incomplete session info; (bso#10003). + Missing integer wrap protection in EA list reading can cause server to loop with DOS (CVE-2013-4124); (bso#10010). + Fix a 100% loop at shutdown time (smbd); (bso#10013). + Fix/improve debug options; (bso#10015). + Rename regedit to samba-regedit; (bso#10040). + Remove obsolete swat manpage and references; (bso#10041). + Fix crashes in socket_get_local_addr(); (bso#10042). + Allow to change the default location for Kerberos credential caches; (bso#10043). + Remove a redundant inlined substitution of ACLs; (bso#10045). + nsswitch: Add OPT_KRB5CCNAME to avoid an error message; (bso#10048). + dsdb improvements; (bso#10056). + Linux kernel oplock breaks can miss signals; (bso#10064).- BuildRequire pyldb-devel.- Add libnetapi0 and samba-libs to baselibs.conf.- Update to 4.0.9. + Fix crash of Winbind after "ls -l /usr/local/samba/var/locks/sysvol"; (bso#9820). + s3-lib: Fix segmentation fault while reading incomplete session info; (bso#10003). + smbd: Fix a 100% loop at shutdown time; (bso#10013). + Windows 8 Roaming profiles fail; (bso#9678). + Add UPN enumeration to passdb internal API; (bso#9779). + smbd: Cleanup disonnected durable handles; (bso#9930). + vfs_streams_xattr: Do not attempt to write empty attribute twice; (bso#9970). + Fix Windows error 0x800700FE when copying files with xattr names containing ":"; (bso#9992). + s3-winbind: Do not delete an existing valid credential cache; (bso#9994). + Fix excessive RID allocation; (bso#10014). + Add debugclass for DNS server; (bso#10015). + Fix/improve debug options; (bso#10015). + Allow to change the default location for Kerberos credential caches; (bso#10043). + Linux kernel oplock breaks can miss signals; (bso#10064). + net ads join: Fix segmentation fault in create_local_private_krb5_conf_for_domain; (bso#10073).- Update to 4.0.8. + Samba 3.0.x to 4.0.7 are affected by a denial of service attack on authenticated or guest connections; CVE-2013-4124; (bnc#829969).- Require krb5 and not the non existing krb5-libs package.- Update to 4.1.0rc1. + Directory database replication (AD DC mode) + Server-Side Copy Support + Btrfs Filesystem Integration- BuildRequire perl ExtUtils::MakeMaker and Parse::Yapp. - BuildRequire libxslt, libxslt1, or libxslt-tools depending on SUSE version. - Require perl-base on SUSE systems only.- Adjust group setting of the test-devel subpackage. - Require perl-base from the pidl subpackage.- Remove libdir/samba/ldb after install if we're building Samba without Active Directory Domain Controller support.- Remove unused ccache switch from the spec file.- BuildRequire docbook-xsl-stylesheets and libxslt-tools to build the man pages and add them to the package again.- Build from the package from the top level directory; (bnc#794744). - BuildRequire pytalloc-devel, python-tdb, and python-tevent. - Also use out of tree builds of talloc, tdb, tevent, and ldb for pre-12.1 SUSE systems.- Remove the empty data dir from the doc package filelist. - Explicitly use samba instead of the name macro to define the docbook dir.- Update to 4.0.7. + Fix a core dump with invalid lock order while opening/editing or copying MS files; (bso#9794). + Fix crash bug from search of mail=; (bso#9967). + s3-rpc_server: Ensure we are root when starting and using gensec; (bso#9465). + Add support for MX queries; (bso#9485). + dns: Delete dnsNode objects when they are empty; (bso#9559). + dns: Support larger queries when asking forwarder; (bso#9632). + s3:lib/server_mutex: Open mutex.tdb with CLEAR_IF_FIRST; (bso#9805). + Use of wrong RFC2307 primary group field; (bso#9880). + Check for system libtevent; (bso#9881). + is_printer_published GUID retrieval; (bso#9900). + Doc fixes for 4.0; (bso#9906). + Build fixes for 4.0 found during autoconf or debian packaging work; (bso#9907). + build: Add missing new line to replaced python shebang line; (bso#9909). + PIE builds not supported; (bso#9910). + s4:winbind: Don't leak libnet_context into the main event context; (bso#9929). + Fix a bug of drvupgrade of smbcontrol; (bso#9941). + Check for netbios aliases in ad_get_referrals; (bso#9947). + Fix tevent_poll on 32-bit machines (Coverity ID 989236); (bso#9953). + docs: Avoid mentioning a possibly misleading option; (bso#9964). + Fix build with system Heimdal of samba4kgetcred; (bso#9968).- Use SLE as product prefix for SUSE Linux Enterprise, oS for openSUSE, and OBS for any other operating system to define the vendor string while build.- Remove ldapsmb from the main spec file.- Adjust ldapsmb and nmbstatus man page syntax required by a newer pod2man.- Don't bzip2 the main tar ball, use the upstream gziped one instead.- Explicitly BuildRequire cyrus-sasl-devel, libattr-devel, and libopenssl-devel.- Fix libreplace license ambiguity; (bso#8997); (bnc#765270).- Update to 4.0.6. + Fix crash during Win8 sync; (bso#9822). + Fix segfault when loging in with wrong password from w2k8r2; (bso#9834). + Fix the username map optimization; (bso#9139). + Add support for PFC_FLAG_OBJECT_UUID when parsing packets; (bso#9382). + SMB2 server doesn't support recvfile; (bso#9412). + Fix the build of vfs_notify_fam; (bso#9545). + Fix adding case sensitive spn; (bso#9699). + Properly handle oplock breaks in compound requests; (bso#9722). + Properly handle oplock breaks in compound requests; (bso#9722). + Cache name_to_sid/sid_to_name correctly; (bso#9766). + Fix 'net ads join' when called via stdin; (bso#9767). + Fix segfault for "artificial" conn_structs in vfs_fake_perms; (bso#9775). + vfs_dirsort uses non-stackable calls, dirfd(), malloc instead of talloc and doesn't cope with directories being modified whilst reading; (bso#9777). + Fix panic when running 'smbtorture smb.base'; (bso#9782). + Use specified python for runtime installation of Samba; (bso#9785). + Change '--with-dmapi' to 'default=auto' to match the autoconf build; (bso#9803). + wafsamba: Display the default value in help for SAMBA3_ADD_OPTION; (bso#9804). + wbinfo: Fix segfault in wbinfo_pam_logon; (bso#9807). + Package new dbwrap_tool man page; (bso#9809). + Old DOS SMB CTEMP request uses a non-VFS function to access the filesystem; (bso#9811). + Fix 'map untrusted to domain' with NTLMv2; (bso#9817). + SMB signing and the async echo responder don't work together; (bso#9824). + Fix panic in nt_printer_publish_ads; (bso#9830). + talloc use after free in winbind4; (bso#9832). + Function called in unix_convert() path can overwrite errno; (bso#9833). + Fix NULL pointer dereference in Winbind; (bso#9854). + Fix making LIBNDR_PREG_OBJ; (bso#9868).- Remove disabled and anyhow obsoleted net-report and net_rpc_migrate patches.- Update to 4.0.5. + Fix large reads/writes from some Linux clients; (bso#9706). + Add 'samba-tool dbcheck --reset-well-known-acls'; (bso#9740). + Can't delegate adding computers to domain; (bso#9267). + Fix GNU ld version detection with old gcc releases; (bso#7825). + Never try to map global SAM name; (bso#9039). + Certain xattrs cause Windows error 0x800700FF; (bso#9130). + Samba returns unexpected error on SMB posix open; (bso#9519). + Fix build on AIX; (bso#9557). + libnss-winbindd does not provide pass struct for groups mapped with ID_TYPE_BOTH and vice versa; (bso#9617). + Reauth-capable client fails to access shares on Windows member; (bso#9625). + PIDL: Fix parsing linemarkers in preprocessor output; (bso#9636). + Rename internal subsystem pdb_ldap to pdb_ldapsam; (bso#9639). + Fix the build of vfs_afsacl; (bso#9642). + Fix the build with --fake-kaserver; (bso#9643). + Fix compile of source3/lib/afs.c; (bso#9644). + Make SMB2_GETINFO multi-volume aware; (bso#9646). + idmap_autorid: Fix freeing of non-talloced memory; (bso#9653). + Work around FreeBSD's getaddrinfo() underscore issue; (bso#9656). + 'make test' hangs; (bso#9663). + Fix correct linking of libreplace with cmdline-credentials; (bso#9664). + Fix filtering of link-local addresses; (bso#9666). + Fix crash in 'net rpc join' against a Samba 3.0.33 PDC; (bso#9669). + Samba denies owner Read Control when there is a DENY entry while W2K08 does not; (bso#9674). + Fix several resource (fd) leaks; (bso#9683). + Fix a memory leak in spoolss rpc server; (bso#9685). + Fix a possible buffer overrun in pdb_smbpasswd; (bso#9686). + Fix several possible null pointer dereferences; (bso#9687). + Make sure that domain joins work correctly when the DC disallows NTLM auth; (bso#9689). + Backport tevent changes to bring library to version 0.9.18; (bso#9695). + Remove incomplete samba_dnsupdate IPv6 link-local address check; (bso#9696). + DsReplicaGetInfo fails due to sendto() EMSGSIZE error on UNIX domain socket; (bso#9697). + Fix vfs_catia and update documentation; (bso#9701); (bnc#824833). + Fix build on solaris8: Do not force a specific perl on pod2man; (bso#9703). + Fix nss_winbind name on FreeBSD; (bso#9704). + s4:winbindd: Do not drop the workgroup name in the getgrnam, getgrent and getgrgid calls; (bso#9711). + Set LD_LIBRARY_PATH in install_with_python.sh; (bso#9717). + s4-idmap: Remove requirement that posixAccount or posixGroup be set for rfc2307; (bso#9718). + Allow forcing an override of an old @MODULES record; (bso#9719). + Do not print the admin password during 'samba-tool classicupgrade'; (bso#9720). + Make samba_upgradedns more robust (do not guess addresses when just changing roles); (bso#9721). + Add a tool to migrate latin1 printing tdbs to registry; (bso#9723). + is_encrypted_packet() function incorrectly used inside server; (bso#9724). + upgradeprovision and 'samba-tool dbcheck' patches for 4.0.NEXT; (bso#9725). + Fix NULL pointer dereference; (bso#9727). + DO NOT install samba_upgradeprovision in 4.0.x; (bso#9728). + Fix 'smbcontrol close-share'; (bso#9733). + Fix Winbind separator in upn to username conversion; (bso#9735). + Change to smbd/dir.c code gives significant performance increases on large directory listings; (bso#9736). + PIDL: Build fixes for hosts without CPP (Solaris 11); (bso#9739). + Make sure that we only propogate the INHERITED flag when we are allowed to; (bso#9747). + Remove unneeded fstat system call from hot read path; (bso#9748). + Don't leak the epm_Map policy handle; (bso#9758). + Fix incorrect parsing of SMB2 command codes; (bso#9760). - Update to 4.0.4. + Remove forced set of 'create mask' to 0777; CVE-2013-1863; (bnc#809624).- Fix periodic printcap cache reloads; (bso#9650); (bnc#807334).- No longer use the cifs- or smbfstab named configuration file on post-12.2 systems; (bnc#804822); (bnc#821889).- Shift the smbfs init script nfs dependency from Required to Should.- Fix SMB1 Session Setup AndX handling with a large krb PAC; (bso#9658); (bnc#802031).- Point LD_LIBRARY_PATH to the just-built libraries while calling testparm to generate the default share snippets on pre-12.2 systems.- Explicitly configure --with-ads.- Fix smbclient recursive mget EPERM handling; (bso#9633); (bnc#786350).- Remove superfluous quotation marks while setting the SAMBA_VERSION_VENDOR_SUFFIX string.- Do not restart the smbfs service on pre-11.3 systems during dhcp lease renewal when the IP address remains the same; (bnc#800782).- Update to 4.0.3. + Fix ACL problem with delegation of privileges and deletion of accounts over LDAP interface; add documentation; (bso##8909). + check_password_quality: Handle non-ASCII characters properly; (bso##9105). + Fix 'smbd' panic triggered by unlink after open; (bso##9571). + smbd: Fix memleak in the async echo handler; (bso##9549). + defer_open is triggered multiple times on the same request; (bso#9196). + Add extra attributes for AD printer publishing; (bso#9378). + FSMO seize of naming role fails: NT_STATUS_IO_TIMEOUT; (bso#9461). + Downgrade v4 printer driver requests to v3; (bso#9474). + samba_upgradeprovision: fix the nTSecurityDescriptor on more containers; (bso#9481). + s3:smb2_negprot: set the 'remote_proto' value; (bso#9499). + waf assumes that pythonX.Y-config is a Python script; (bso#9503). + s4:drsuapi: Make sure we report the meta data from the cycle start; (bso#9508). + wafsamba: Use additional xml catalog file; (bso#9512). + samba_dnsupdate: Set KRB5_CONFIG for nsupdate command; (bso#9517). + conn->share_access appears not be be reset between users; (bso#9518). + Remove superfluous bracket in samba.8.xml; (bso#9528). + Fix typo in vfs_tsmsm.8.xml; (bso#9530). + terminate the irpc_servers_byname() result with server_id_set_disconnected(); (bso#9540). + Make use of posix_openpt; (bso#9541). + Fix build of vfs_commit and plug in async pwrite support; (bso#9544). + Fix aio_suspend detection on FreeBSD; (bso#9546). + Correctly detect O_DIRECT; (bso#9548). + sigprocmask does not work on FreeBSD to stop further signals in a signal handler; (bso#9550). + smb.conf(5): Update list of available protocols; (bso#9552). + s4-resolve: Fix parsing of IPv6/AAAA in dns_lookup; (bso#9555). + Fix compilation of Solaris ACL module; (bso#9564). + Adding additional Samba 4.0 DC to W2k8 srv AD domain (in win200 functional level) produces dbcheck errors; (bso#9565). + Add dbwrap_tool.1 manual page; (bso#9568). + Document the command line options in dbwrap_tool(1); (bso#9568). + ntlm_auth(1): Fix format and make examples visible; (bso#9569). + Fix file corruption during SMB1 read by Mac OSX 10.8.2 clients; (bso#9572). + Fix a possible null pointer dereference in spoolss; (bso#9574). + Duplicate flags defined in the winbindd protocol; (bso#9575). + gensec: Allow login without a PAC by default; (bso#9581). + smbd: disk_free: sys_popen() failed" message logged in /var/log/message many times; (bso#9586). + Archive flag is always set on directories; (bso#9587). + ACLs are not inherited to directories for DFS shares; (bso#9588). + Correct meta data in ldb manpages; (bso#9591). + s3-winbind: Fix the build of idmap_ldap; (bso#9595). + Linked attribute handling should be by GUID; (bso#9596). + Fix timeouts of some IRPC calls; (bso#9598). + Use pid,task_id as cluster_id in process_single just like process_prefork; (bso#9598). + Add 'ldbdump' tool; general code and documentation cleanup; (bso#9609). + dsdb: Make secrets_tdb_sync cope with -H secrets.ldb; (bso#9610).- Update to 4.0.2. + Address SWAT security issues CVE-2013-0213 and CVE-2013-0214 which both don't apply to any SUSE Samba post-3.6.10 as it isn't longer built. + Don't build and package static libraries.- Drop separate build-source-timestamp file as it led to a second, incorrect Source Timestamp line.- Add server-side copy support; (fate#314770). + Implement FSCTL_SRV_COPYCHUNK and FSCTL_SRV_REQUEST_RESUME_KEY handlers. + Add vfs_btrfs VFS module for optimized Btrfs clone-range ioctl usage.- Add filter against shlib-policy-name-error for /lib*/libnss_wins.so.2.- Disable SWAT during configure and don't package it any longer.- Remove dangling references to Heimdal from the spec file.- Remove /lib/samba prefix from the localstatedir configure option.- Update to 4.0.1. + Samba 4.0.0 as an AD DC may provide authenticated users with write access to LDAP directory objects; CVE-2013-0172; (bnc#798364).- Add the missing get_printing_ticket binary path while calling the set_permissions macro; (bnc#783375).- Use the version macro while definition of the branch macro.- Remove references to no longer used devel macros.- Update to 4.0.0. + Honor password complexity settings; (bso#9414). + Install SWAT *.msg files with waf; (bso#9415). + Fix netr_ServerPasswordSet2, netr_LogonSamLogon with netlogon AES; (bso#9438). + developer-build: Fix panic when acl_xattr fails with access denied; (bso#9456). + Fix "map username script" with "security=ads" and Winbind; (bso#9457). + Install manpages only if we install the target; (bso#9459). + Respond correctly to FILE_STREAM_INFO requests; (bso#9460). + Users can not be given write permissions any more by default; (bso#9462). + Fix MMC crashes; (bso#9470). + Fix SEGV when using second vfs module; (bso#9471). + Support FIPS mode when building Samba; (bso#9479). + Fix ACL on "cn=partitions,cn=configuration"; (bso#9481).- netr_ServerPasswordSet2, netr_LogonSamLogon with netlogon AES broken; (bso#9438). - s3:auth: fix create_token_from_sid() to not fail in the winbindd case; (bso#9457). - s4:dsdb/acl_read: return the nTSecurityDescriptor attr if the sd_flags control is given; (bso#9470). - Support FIPS mode when building Samba; (bso#9479). - s4:provision: set the correct nTSecurityDescriptor; (bso#9481).- SEGV when using second vfs module; (bso#9471).- Update to 3.6.10. + Respond correctly to FILE_STREAM_INFO requests; (bso#9460). + Fix segfault when "default devmode" is disabled; (bso#9433). + Fix segfaults in "log level = 10" on Solaris; (bso#9390).- s3:smbd:vfs_acl: fix a PANIC when setting an ACL fails with ACCESS_DENIED; (bso#9456). - Install manpages only if we install the target; (bso#9459). - Users can not be given write permissions any more by default; (bso#9462).- Fix MD5 detection in the autoconf build; (bso#9037); (bso#9086); (bso#9094); (bso#9418). - Use work around for 'winbind use default domain' only if it is set; (bso#9367). - Allow smb2.acls torture test to pass against smbd with a POSIX ACLs backend; (bso#9374). - large read requests cause server to issue malformed reply; (bso#9422). - s3-rpc_client: lookup nametype 0x20 in rpc_pipe_open_tcp_port(); (bso#9426). - Fix ncacn_ip_tcp reconnection code for lsa lookups; (bso#9439). - Allow to force DNS updates using net; (bso#9451). - Respond correctly to FILE_STREAM_INFO requests; (bso#9460).- Update to 4.0.0rc6. See WHATSNEW.txt from the samba-doc package.- On uninstall remove winbind from the pam configuration, invalidate the nscd passwd and group cache and only recommend the install of nscd; (bnc#792340).- BuildRequire libnscd-devel once.- Remove obsoleted references to pre-9.4 SUSE systems; (bnc#792294). - Add SUSE version depending pkg-config requires macro; (bnc#792294).- Define library names and use it instead of libldb1, libnetapi0, libsmbclient0, libsmbsharemodes0, libtalloc2, libtdb1, libtevent0, and libwbclient0; (bnc#792294). - Provide and obsolete libsmbsharemodes for post-10.3 SUSE systems.- Don't clutter the spec file diff view; (bnc#783384).- Fix fd leak causing 100% CPU in winbind on certain dc connection failures; (bso#9436); (bnc#786677).- Fix spoolss segfault when default devmode is disabled; (bso#9433); (bnc#791183).- Update to 4.0.0rc5. See WHATSNEW.txt from the samba-doc package.- ACL masks incorrectly applied when setting ACLs; (bso#9236). - s3-kerberos: also try with AES keys, when decrypting tickets; (bso#9272). - lib/replace: replace all *printf function if we replace snprintf; (bso#9390). - lib/addns: don't depend on the order in resp->answers[]; (bso#9402).- s4:torture/smb2: improve the smb2.create.blob tes; (bso#9209). - lib/krb5_wrap: request enc_types in the correct order; (bso#9272). - Fix net ads join message for the dns domain; (bso#9326). - docs-xml: fix use of tag; (bso#9345). - s3-aio_pthread: Optimize aio_pthread_handle_completion; (bso#9359). - s3:winbind: Failover if netlogon pipe is not available; (bso#9386).- Execute the run_permissions macro on pre-11.4 systems and else the set_permission one if available.- Ensure adding the winbind group never can fail.- Create ntadmin group only if it doesn't yet exist.- Update to 3.6.9. + When setting a non-default ACL, don't forget to apply masks to SMB_ACL_USER and SMB_ACL_GROUP entries; (bso#9236). + Winbind can't fetch user or group info from AD via LDAP; (bso#9147). + Fix segfault in smbd if user specified ports out for range; (bso#9218).- quota: Don't force the block size to 512; (bso#3272). - Fix poll replacement to become a msleep replacement; (bso#8107). - Fix wrong test == syntax in configure; (bso#8146). - Fix --with(out)-sendfile-support option handling in autoconf; (bso#8344). - Fix builtin forms order to match Windows again; (bso#8632). - Fix RAW printing for normal users; (bso#8769); (bnc#790741). - Initialise ticket to ensure we do not invalid memory; (bso#8788). - Fix 'net rpc share allowedusers' to work with 2008r2; (bso#8966). - Fix crash on null pam change pw response; (bso#9013). - Connection to outbound trusted domain goes offline; (bso#9016). - Increase debug level for info that the db is empty; (bso#9112). - 'smbclient' can't connect to a Windows 7 server using NTLMv2; (bso#9117). - Winbind can't fetch user or group info from AD via LDAP; (bso#9147). - Open printers with the right access mask; (bso#9154). - Fix makerpms.sh on RHEL; (bso#9165). - Remove non-existent option '-Y' from winbindd manpage; (bso#9171). - Add quota support for gfs2; (bso#9172). - Make SMB2 compound request create/delete_on_close/close work as Windows; (bso#9173). - Empty SPNEGO packet can cause smbd to crash; (bso#9174). - pam_winbind: Match more return codes when wbcGetPwnam has failed; (bso#9177). - Fix crash bug in idmap_hash; (bso#9188); (bnc#788159). - SMB2 Create doesn't return correct MAX ACCESS access mask in blob; (bso#9189). - Fix service control for non-internal services; (bso#9192). - Don't take 'state->te' as indication for "was_deferred"; (bso#9196). - Parse of invalid SMB2 create blob can cause smbd crash; (bso#9209). - Bad ASN.1 NegTokenInit packet can cause invalid free; (bso#9213). - Fix segfault in smbd if user specified ports out for range; (bso#9218). - Signing cannot be disabled for SMB2 by design, so fix the documentation instead; (bso#9222). - Fix NT_STATUS_IO_TIMEOUT during slow import of printers into registry; (bso#9231). - When setting a non-default ACL, don't forget to apply masks to SMB_ACL_USER and SMB_ACL_GROUP entries; (bso#9236). - lib-addns: ensure that allocated buffer are pre set to 0; (bso#9259). - Make tdb robust against shrinking tdbs and improper CLEAR_IF_FIRST restart; (bso#9268). - Add support for reloading systemd services; (bso#9280).- Warn via the smbd log if AppArmor and "wide links" are in use; (bnc#783719).- Do not write the build date into the header of the default smb.conf as this causses superfluous rebuilds of packages depending on samba; (bnc#781601).- Do not prerequire SuSEconfig.permissions as it's already enough and more generic to depend on the permissions package; (bnc#782293).- Update to 3.6.8. + Fix crash bug in smbd caused by a blocking lock followed by close; (bso#9084). + Fix Winbind panic if we couldn't find the domain; (bso#9135).- Backport FSCTL codes and fix segfault in smbstatus from master; (bso#9058). - Fix bad call to memcpy source3/registry/regfio.c; (bso#9065). - "Domain Users" incorrectly added as additional group on domain members; (bso#9066). - Use correct RID for "Domain Guests" primary group; (bso#9067). - Fix crash bug in smbd caused by a blocking lock followed by close; (bso#9084). - Fix smbclient/tarmode panic when connecting to Windows 2000 clients; (bso#9088). - Fix refreshing of Kerberos tickets in Winbind; (bso#9098). - Fix identification of idle clients in Winbind to avoid crashes and NDR parsing errors; (bso#9104). - Fix compilation with newer MIT Kerberos which hides internal symbols; (bso#9111). - Fix flooding the logs with records we don't find in pcap; (bso#9112). - Initialize the print backend after we setup winreg; (bso#9122). - Fix lprng job tracking errors; (bso#9123). - Fix setting of "inherited" bit on inherited ACE's; (bso#9124). - Fix Winbind panic if we couldn't find the domain; (bso#9135). - Make 'smbclient allinfo' show the snapshot list; (bso#9137). - Fix nfs quota support with Linux nfs4 mounts; (bso#9144). - Valid open requests can cause smbd assert due to incorrect oplock handling on delete requests; (bso#9150).- NMB registration for a duplicate workstation fails with registration refuse; (bso#9085); (bnc#770056).- Remove backup files caused by running configure in examples/VFS.- Update to 3.6.7. + Fix resolving our own "Domain Local" groups; (bso#9052); (bnc#779269). + Fix migrating printers while upgrading from 3.5.x; (bso#9026).- Correct documentation of "case sensitive"; (bso#8552). - Printing fails in function cups_job_submit; (bso#8719). - Fix kernel oplocks when uid(file) != uid(process); (bso#8974). - Send correct responses to NT Transact Secondary when no data and no params for the Trans2 calls are set; (bso#8989). - Fix build without ads support; (bso#8996). - Don't turn negative cache entries into valid idmappings; (bso#9002). - Fix posix acl on gpfs; (bso#9003). - Make vfs_gpfs less verbose in get/set_xattr functions; (bso#9022). - Fix migrating printers while upgrading from 3.5.x; (bso#9026). - Fix typo in set_re_uid() call when USE_SETRESUID selected in configure; (bso#9034). - Using asynchronous IO with SMB2 can return NT_STATUS_FILE_CLOSED in error instead ofNT_STATUS_FILE_LOCK_CONFLICT; (bso#9040). - Fix resolving our own "Domain Local" groups; (bso#9052); (bnc#779269). - Fix build against CUPS 1.6; (bso#9055). - Fix bugs in SMB2 credit handling code; (bso#9057). - rpcclient: Fix bad call to data_blob_const; (bso#9062).- Create missing doc directories while install. - Remove no longer existing Manifest file from install. - Don't creat a link to non existend html man pages for swat. - Don't call the no longer existing libsmbclient testsuit while build.- Configure with option --mandir instead --with-mandir. - Remove obsoleted --with-rootsbindir, --with-nmbdsocketdir, and - -with-swatdir configure options.- Update to 4.0.0beta4. See WHATSNEW.txt from the samba-doc package.- BuildRequire gcc, make, and patch; (bnc#771516).- ndr: fix push/pull DATA_BLOB with NDR_NOALIGN; (bso#9026); (bnc#770262).- Fix shell syntax in dhcpcd hook script; (bnc#769957).- Add missing int declaration to the net kdc lookup patch.- Update to 4.0.0beta2. See WHATSNEW.txt from the samba-doc package.- Update to 3.6.6. + Fix possible memory leaks in the Samba master process; (bso#8970). + Fix uninitialized memory read in talloc_free(); (bnc#764577). + Fix joining of XP Pro workstations to 3.6 DCs; (bso#8373); (bnc#787983).- resolve_ads() code can return zero addresses and miss valid DC IP addresses; (bso#8910). - Can't join XP Pro workstations to 3.6.1 DC; (bso#8373); (bnc#787983). - winbind can hang as nbt_getdc() has no timeout; (bso#8953). - Fix crash bug in dns_create_probe when dns_create_update fails; (bso#8627) - s3-pid: Catch with pid filename's change when config file is not smb.conf; (bso#8714). - Possible memory leaks in the main Samba process; (bso#8970). - s3: Fix uninitialized memory read in talloc_free(); (bnc#764577). - Treat exit_server_cleanly() as a "clean" shutdown; (bso#8971). - Avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute(); (bso#8988). - Winzip occasionally can not read files out of an open winzip dialog; (bso#8311). - s3-winbindd: call dump_core_setup after command line option has been parsed; (bso#8975). - Directory group write permission bit is set if unix extensions are enabled; (bso#8972). - s3: remove dependency on automake for "make everything"; (bso#8978). - sd_has_inheritable_components segfaults on an SD that se_access_check accepts; (bso#8811). - smbclient's tarmode insists on listing excluded directories; (bso#8922). - Notify code can miss a ChDir; (bso#8998). - s3:smbd: add a fsp_persistent_id() function; (bso#8995).- Call autogen.sh even on post-12.1 SUSE systems.- Don't call autogen.sh on post-12.1 SUSE and post-14 Fedora systems. - Recompile all IDL in any case.- BuildIgnore libtalloc and libtdb to prevent a package conflict on Fedora systems.- Install talloc.pc only on pre-12.2 and non SUSE systems.- BuildRequire libldb-devel, libtalloc-devel, libtdb-devel, and libtevent-devel on post-12.1 systems.- s3: Fix a segfault with debug level 3 on Solaris; (bso#8861). - s3: wbinfo --lookup-sids "" crashes winbind; (bso#8904). - smbd crashes when deleting directory and veto files are enabled; (bso#8837). - winbind_krb5_locator only returns one IP address; (bso#8897). - Wrong assertion/comparison: Compare value not pointer; (bso#8859). - Inconsistent (with manpage) command-line switch for "help" in smbtree; (bso#8831). - Fix incorrect debug statement. - Setting traverse rights fails to enable directory traversal when acl_xattr in use; (bso#8857). - Syslog broken owing to mistyping of debug_settings.syslog; (bso#8877). - s3/ldap: remove outdated netscape ds 5 schema file; (bso#8869). - s3-docs: fixes several typos; (bso#7938). - s3-VFS: Fix building out-of-tree modules; (bso#8822). - s3-docs: Add hint that setting "profile acls = yes" on normal shares can cause trouble; (bso#7930). - s3-pam_winbind: Fix the build with a newer iniparser library; (bso#8915). - Avoid null dereference in initialize_password_db(); (bso#8920). - s3:registry: implement values_need_update and subkeys_need_update in the smbconf backend. - s3:registry:reg_api: fix reg_queryvalue to not fail when values are modified while it runs. - s4:torture:rpc:spoolss: also initialize driverName before checking it in test_PrinterData_DsSpooler(). - s3:registry: multiple cleanups, fixes, and optimisations. - s3:auth/server_info: the primary rid should be in the groups rid array; (bso#8798). - s3-printing: Add new printers to registry; (bso#8554); (bso#8612); (bso#8748). - Fix the overwriting of errno before use in a DEBUG statement and use the return value from store_acl_blob_fsp rather than ignoring it; (bso#8945). - s3-auth: Don't lookup the system user in pdb; (bso#8944). - s3-passdb: Fix negative SID->uid/gid cache handling; (bso#8952). - Fix typo in pam_winbindd code; (bso#8957). - Fix remove_duplicate_addrs2 previously it could leave zero addresses in the list; (bso#8910). - Slow but responsive DC can lock up winbindd; (bso#8943). - Broken processing of %U with vfs_full_audit when force user is set; (bso#8882).- Disable included build of ldb, talloc, tdb, and tevent on post-12.1 systems. - BuildRequire libldb1-devel, libtalloc2-devel, libtdb1-devel, and libtevent0-devel on post-12.1 systems.- Add PreReq /etc/init.d/nscd to the winbind package; (bnc#759731).- docs-xml: fix default name resolve order; (bso#7564). - s3-aio-fork: Fix a segfault in vfs_aio_fork; (bso#8836). - docs: remove whitespace in example samba.ldif; (bso#8789). - s3-smbd: move print_backend_init() behind init_system_info(); (bso#8845); (bnc#730769). - s3-docs: Prepend '/' to filename argument; (bso#8826).- Update to 3.6.5. - Restrict self granting privileges where security=ads for Samba post-3.3.16; CVE-2012-2111; (bnc#757576).- Remove all precompiled idl output to ensure any pidl changes take effect; (bnc#757080).- Update to 3.6.4. - Samba pre-3.6.4 are affected by a vulnerability that allows remote code exe- cution as the "root" user; PIDL based autogenerated code allows overwriting beyond of allocated array; CVE-2012-1182; (bso#8815); (bnc#752797).- s3-winbindd: Only use SamLogonEx when we can get unencrypted session keys; (bso#8599). - Correctly handle DENY ACEs when privileges apply; (bso#8797).- s3:smb2_server: fix a logic error, we should sign non guest sessions; (bso8749). - Allow vfs_aio_pthread to build as a static module; (bso#8723). - s3:dbwrap_ctdb: return the number of records in db_ctdb_traverse() for persistent dbs; (#bso8527). - s3: segfault in dom_sid_compare(bso#8567). - Honor SeTakeOwnershiPrivilege when client asks for SEC_STD_WRITE_OWNER; (bso#8768). - s3-winbindd: Close netlogon connection if the status returned by the NetrSamLogonEx call is timeout in the pam_auth_crap path; (bso#8771). - s3-winbindd: set the can_do_validation6 also for trusted domain; (bso#8599). - Fix problem when calculating the share security mask, take priviliges into account for the connecting user; (bso#8784).- Fix crash in dcerpc_lsa_lookup_sids_noalloc() with over 1000 groups; (bso#8807); (bnc#751454).- Remove obsoleted Authors lines from spec file for post-11.2 systems.- Make ldapsmb build with Fedora 15 and 16; (bso#8783). - BuildRequire libuuid-devel for post-11.0 and other systems. - Define missing python macros for non SUSE systems. - PreReq to fillup_prereq and insserv_prereq only on SUSE systems. - Always use cifstab instead of smbfstab on non SUSE systems.- Ensure AndX offsets are increasing strictly monotonically in pre-3.4 versions; CVE-2012-0870; (bnc#747934).- Add SERVERID_UNIQUE_ID_NOT_TO_VERIFY; (bso#8760); (bnc#741854).- s3-printing: fix crash in printer_list_set_printer(); (bso#8762); (bnc#746825).- s3:winbindd fix a return code check; (bso#8406).- s3: Add rmdir operation to streams_depot; (bso#8733).- s3:smbd:smb2: fix an assignment-instead-of-check bug conn_snum_used(); (bso#8738); CVE-2013-0454; (bnc#811975).- s3:auth: fill the sids array of the info3 in wbcAuthUserInfo_to_netr_SamInfo3(); (bso#8739).- s3:client: ignore SMBecho errors (the server may not support it); (bso#8139).- Be more strict when using PAM_AUTH API from winbind if Kerberos auth is enabled and don't unintentionally use a bogus domain name; (bso#8734).- smbclient fails with posix large reads; (bso#8727).- Use the smbfs init script on versions pre-11.3, or cifs in later versions; (bnc#744614).- s3: Compile IDL files in autogen, some configure tests need this.- Fixes various deadlocks in if-up.d / if-down.d when running under systemd; (bnc#732395).- Update to 3.6.3. + Fix memory leak in parent smbd on connection; CVE-2012-0817; (bso#8724); (bnc#743986).- Use spdx.org compliant license names for all packages.- Update to 3.6.2. + Make Winbind receive user/group information (bug #8371). + Several SMB2 fixes. + Fix a crash bug in the spoolss code. + Add new contributing FAQ announcing acceptance of corporate (C). + DeletePrinterDriverEx deletes files in use; (bso#4942); (bnc#742504). + Fix cli_write_and_x() against OS/2 print shares; (bso#5326). + Fix 'smbclient tar' for files greater than 8GB on BE machines; (bso#563); (bnc#726145). + Remove pointless use_memory_krb5_ccache; (bso#7465). + Fix perl path; (bso#8176). + Grant credits in async interim responses (SMB2); (bso#8357). + Make Winbind receive user/group information; (bso#8371). + Fix Windows XP clients crashing smbd process every once in a while; (bso#8384); (bnc#731571). + Make VFS op "streaminfo" stackable; (bso#8419). + Add an allocation pool to idmap_autorid; (bso#8444). + Fix SEGFAULT from net registry export on not zero terminated REG_SZ values; (bso#8528). + Make DSO_EXPORTS_CMD more portable; (bso#8531). + readlink() on Linux clients fails if the symlink target is outside of the share; (bso#8541). + smbclient posix_open command fails to return correct info on open file; (bso#8542). + winbind_samlogon_retry_loop ignores logon_parameters flags; (bso#8548). + Fix setting the machine account password; (bso#8550). + Make SMB2 handle compound request headers in the same way as Windows; (bso#8560). + Password change settings not fully observed; (bso#8561). + Fix double free error in talloc; (bso#8562). + Fix alignment in the non-extended-security negprot; (bso#8573). + Add systemd service files; (bso#8575). + Add systemd service files; (bso#8575). + smb2_flush: Don't send uninitialized memory; (bso#8579). + Enable inotify if sys or kernel inotify is available; (bso#8580). + Increase a debug level; (bso#8585). + libsmb: Only align unicode pipe_name; (bso#8586). + Fix marshalling of samr_ChangePasswordUser3; (bso#8591). + Don't limit the number of open dptrs for SMB2; (bso#8592). + Fix a crash bug in cldap_socket_recv_dgram(); (bso#8593). + Make cldap work over IPv6; (bso#8600). + Fix intermittent print job failures caused by character conversion errors; (bso#8606). + Improve configure.in so it can be used outside the Samba source tree; (bso#8607). + Winbind: Don't fail on users without a uid; (bso#8608). + Ensure we correctly calculate reply credits over all returned SMB2 replies; (bso#8614). + Fix migrate printer code; (bso#8618). + Fix crash bug when trying to browse Samba printers; (bso#8623). + libsmb: Don't duplicate Kerberos service tickets; (bso#8628). + POSIX ACE x permission becomes rx following mapping to and from a DACL; (bso#8631). + When returning an ACL without SECINFO_DACL requested, we still set SEC_DESC_DACL_PRESENT in the type field; (bso#8636). + Fix the vfs_commit module; (bso#8639). + Add an update function for Winbind cache; (bso#8643). + vfs_acl_xattr and vfs_acl_tdb modules can fail to add inheritable entries on a directory with no stored ACL; (bso#8644). + Document the "ignore system acls" option of vfs_acl_xattr and vfs_acl_tdb vfs modules; (bso#8652). + Fix deleting a symlink if the symlink target is outside of the share; (bso#8663). + Fix renaming a symlink if the symlink target is outside of the share; (bso#8664). + Fix NT ACL issue; (bso#8673). + Fix buffer overflow issue with AES encryption in samba traffic analyzer; (bso#8674). + Fix Winbind segfault if we can't map the last user; (bso#8678). + recvfile code path using splice() on Linux leaves data in the pipe on short write; (bso#8679). + Try ctdbd_init_connection() as root; (bso#8684). + Packet validation checks can be done before length validation causing uninitialized memory read; (bso#8686). + Fix typo in 'net memberships' usage; (bso#8687). + libads: Fix malloc/talloc mismatch in ads_keytab_verify_ticket(); (bso#8692). + Make DeletePrinterDriverEx remove printer driver files; (bso#8697) (bnc#740810). + Fix major leak with SMB2 in connections.tdb; (bso#8710).- s3-spoolss: Pass the right pointer type; (bso#4942); (bnc#742504).- Use correct license, LGPLv3+ for libwbclient packages.- When returning an ACL without SECINFO_DACL requested, we still set SEC_DESC_DACL_PRESENT in the type field; (bso#8636).- Fix incorrect types in the full_audit VFS module. Add null terminators to audit log enums; (bnc#742885).- Prefix print$ path on driver file deletion; (bso#8697); (bnc#740810). - Fix printer_driver_files_in_use() call ordering; (bso#4942); (bnc#742504).- Buffer overflow issue with AES encryption in samba traffic analyzer; (bso#8674). - NT ACL issue; (bso#8673). - Deleting a symlink fails if the symlink target is outside of the share; (bso#8663). - connections.tdb - major leak with SMB2; (bso#8710).- Renaming a symlink fails if the symlink target is outside of the share; (bso#8664).- Intermittent print job failures caused by character conversion errors; (bso#8606). - ads_keytab_verify_ticket mixes talloc allocation with malloc free; (bso#8692). - libcli/cldap: fix a crash bug in cldap_socket_recv_dgram(); (bso#8593). - s3:lib/ctdbd_conn: try ctdbd_init_connection() as root; (bso#8684). - s3-printing: fix migrate printer code; (bso#8618). - Packet validation checks can be done before length validation causing uninitialized memory read; (bso#8686).- net memberships usage info was wrong; (bso#8687). - s3-libsmb: Don't duplicate kerberos service tickets; (bso#8628). - Recvfile code path using splice() on Linux leaves data in the pipe on short write; (bso#8679). - s3-winbind: Fix segfault if we can't map the last user; (bso#8678). - vfs_acl_xattr and vfs_acl_tdb modules can fail to add inheritable entries on a directory with no stored ACL; (bso#8644). - s3/doc: document the ignore system acls option of vfs_acl_xattr and vfs_acl_tdb; (bso#8652). - Winbind can't receive any user/group information; (bso#8371). - s3-winbind: Add an update function for winbind cache; (bso#8643). - s3: Attempt to fix the vfs_commit module. - POSIX ACE x permission becomes rx following mapping to and from a DACL; (#bso#8631). - s3:libsmb: only align unicode pipe_name; (bso#8586). - s3-winbind: Don't fail on users without a uid; (bso#8608). - Crash when trying to browse samba printers; (bso#8623). - talloc: double free error; (bso#8562). - cldap doesn't work over ipv6; (bso#8600). - s3:libsmb: fix cli_write_and_x() against OS/2 print shares; (bso#5326). - SMB2: not granting credits for all requests in a compound request; (bso#8614). - smb2_flush sends uninitialized memory; (bso#8579). - Password change settings not fully observed; (bso#8561). - s3:smb2_server: grant credits in async interim responses; (bso#8357). - s3:smbd: don't limit the number of open dptrs for smb2; (bso#8592). - samr_ChangePasswordUser3 IDL incorrect; (bso#8591). - idmap_autorid does not have allocation pool; (bso#8444). - Add systemd service files. - s3:libsmb: the workgroup in the non-extended-security negprot is not aligned; (bso#8573). - s3-build: Fix inotify detection; (bso#8580). - SMB2 doesn't handle compound request headers in the same way as Windows; (#bso8560). - Disconnecting clients swamp the logs; (bso#8585). - s3-netlogon: Fix setting the machinge account password; (bso#8550). - winbind_samlogon_retry_loop ignores logon_parameters flags; (#bso8548). - smbclient posix_open command fails to return correct info on open file; (bso#8542). - readlink() on Linux clients fails if the symlink target is outside of the share; (bso#8541). - s3-netapi: remove pointless use_memory_krb5_ccache; (bso#7465). - s3:Makefile: make DSO_EXPORTS_CMD more portable; (bso#8531). - s3:registry: fix the test for a REG_SZ blob possibly being a zero terminated ucs2 string; (bso#8528). - Make VFS op "streaminfo" stackable; (bso#8419).- Fix incorrect perfcount array length calculations; (bnc#739258).- BuildRequire autoconf to avoid implicit dependency for post-11.4 systems.- Remove call to suse_update_config macro for post-11.4 systems.- Use samba.org for the ldapsmb source location.- Fixing libsmbsharemode dependency on ldap and krb5 libs in Makefile; (bnc #729516).- Do not map POSIX execute permission to Windows FILE_READ_ATTRIBUTES; (bso#8631); (bnc#732572).- Add ldap to Should-Start and Stop of the smb init script; (bnc#730046).- Fix smbd srv_spoolss_replycloseprinter() segfault; (bso#8384); (bnc#731571).- Fix pam_winbind.so segfault in pam_sm_authenticate(); (bso#8564).- Fix smbclient >8GB tars on big endian machines; (bso#563); (bnc#726145).- Fix typo in net ads join output; (bnc#713135).- Ignore a potentially missing AppArmor snippet helper script; (bnc#725256).- Update to 3.6.1. + Fix smbd crashes triggered by Windows XP clients; (bso#8384). + Fix a Winbind race leading to 100% CPU load; (bso#8409). + Several SMB2 fixes. + The VFS ACL modules are no longer experimental but production-ready. + Fix 'net ads join -k' when KRB5CCNAME is not set; (bso#7465). + smb_acl_to_posix: ACL is invalid for set (Invalid argument); (bso#7509). + Return error of cli_push when 'put - /some/file' is used; (bso#7551). + Fix usage of cli_errstr(); (bso#7864). + Fix 'widelinks' regression; (bso#8229). + Empty notify servername; (bso#8236). + Add man vfs_aio_fork; (bso#8256). + smb2: smbd logs "Invalid SMB packet: first request: 0x0008" and crashes; (bso#8334). + Add a fallback for missing open&x support in MAC OS/X Lion; (bso#8338). + While migrating forms, don't fail if the form already exists; (bso#8351). + OS/2 sends an unexpected write&x/read&x chain; (bso#8360). + Fix build of vfs_prealloc on SLES8; (bso#8363). + Fix the build of gpfs.c on RHEL 6.0 with gpfs 3.4.0-4; (bso#8364). + Fix the fallback to the deprecated spelling idmap:script; (bso#8368). + Fix vfs_chown_fsp; (bso#8370). + Fix smbd crashes triggered by Windows XP clients; (bso#8384). + Fix smbclient access to NT4 shares; (bso#8385). + Optimize serverid_exists() for Solaris; (bso#8395). + registry/reg_format.c must include includes.h; (bso#8401). + SMB2 server can return requests out-of-order when processing a compound request; (bso#8407). + Fix a Winbind race leading to 100% CPU load; (bso#8409). + Fix "saving as" of MS Office 2007 (Word) documents on Samba shares with SMB2; (bso#8412). + Fix 'getent group' if trusted domains are not reachable; (bso#8420). + Fix infinite loop in ACL module code; (bso#8422). + Fix wrong reply to DHnC (durable handle reconnect); (bso#8428). + Compound SMB2 requests on an IPC connection can corrupt the reply stream; (bso#8429). + Fix segfault in iconv.c; (bso#8433). + NFSv4 DENY ACLs always include SYNCHRONIZE flag - blocking renames; (bso#8442). + Be smarter about setting default permissions when a ACL_USER_OBJ isn't given; (bso#8443). + Check the wct of the incoming SMBnegprot responses; (bso#8452). + Fix smbclient segfaults when dialect option -m is used for legacy dialects; (bso#8453). + Fix uninitialized memory problem in group_sids_to_info3; (bso#8455). + Samba PDC is looking up only primary user group; (bso#8455). + IE9 on Windows 7 cannot download files to samba 3.5.11 share; (bso#8458). + smb2_find uses a hard coded max reply size of 0x10000 instead of smb2_max_trans; (bso#8473). + SMB2 create doesn't cope with an Apple client using NULL blob in create; (bso#8474). + Don't call smbd_terminate_connection in smb2_validate_message_id(); (bso#8476). + Samba asserts when SMB2 client breaks the crediting rules; (bso#8476). + Map to guest can return uninitialized blob of data; (bso#8477). + acl_xattr can free an invalid pointer if no blob is loaded; (bso#8480). + DFS breaks zip file extracting unless "follow symlinks = no" set; (bso#8493). + Remove "experimental" label on VFS ACL modules; (bso#8494). + SMB2_OP_CANCEL requests don't have to be signed; (bso#8503). + smbd doesn't correctly honor the "force create mode" bits from a cifsfs create; (bso#8507). + Read-only handles on SAMR allow SAMR_DOMAIN_ACCESS_CREATE_USER; (bso#8509). + Disallow "." in can_set_delete_on_close(); (bso#8515). + SMB2 create call returns incorrect file allocation size; (bso#8518). + Fix SMB2 SMB2_OP_GETINFO and SMB2_OP_IOCTL parsing requirements; (bso#8520). + Winbind cache timeout expiry test was reversed; (bso#8521).- s3/doc: add man page for aio_fork vfs module.- Fix uninitialized memory problem in group_sids_to_info3; (bso#8455).- s3: Samba PDC is looking up only primary user group; (bso#8455).- Add script to create or update an AppArmor sniplet with permissions for all Samba shares; (bnc#688040).- Add "ldapsam:login cache" parameter to allow explicit disabling of the login cache; (bnc#723261).- Retain the smbd startproc return value for correct startup status reporting. unset was incorrectly being called prior to rc_status; (bnc#723724).- Prevent deadlock in systemd triggered by if-down.d handler on shutdown; (bnc#721598).- smb2_find uses a hard coded max reply size of 0x10000 instead of smb2_max_trans; changed defaults and documentation (bso8473).- Empty CIFS share can be blocked for other clients by deleting it via empty path (DELETE_PENDING until the last client); (bso#8515).- winbindd cache timeout expiry test was reversed; (bso#8521).- Fix SMB2 SMB2_OP_GETINFO and SMB2_OP_IOCTL parsing requirements; (bso#8520).- s3:smb2_create: fix allocation size return value when opening existing files; (bso#8518).- SMB2 create doesn't cope with an Apple client using NULL blob in create; (bso#8474).- NFSv4 DENY ACLs always include SYNCHRONIZE flag - blocking renames; (bso#8442).- s3-docs: Fix bug (bso#7908) and typo.- Return error of cli_push when 'put - /some/file' is used; (bso#7551).- Read-only handles on SAMR allow SAMR_DOMAIN_ACCESS_CREATE_USER; (bso#8509).- smbd doesn't correctly honor the "force create mode" bits from a cifsfs create; (bso#8507).- Default user entry is set to minimal permissions on incoming ACL change with no user specified; (bso#8443).- smb_acl_to_posix: ACL is invalid for set (Invalid argument); (bso#7509).- Handle the SECINFO_LABEL flag in the same was as Win2k3; enable Microsoft Internet Explorer 9 on Windows 7 to download files; (bso#8458).- DFS breaks zip file extracting unless "follow symlinks = no" set; (bso#8493).- s3-docs: Fix typos.- s3:smb2_server: SMB2_OP_CANCEL requests don't have to be signed; (bso#8503).- Remove "experimental" label on VFS ACL modules; (bso#8494).- acl_xattr can free an invalid pointer if no blob is loaded; (bso#8480).- s3-smbd: asserts when SMB2 client breaks the crediting rules; (bso#8476).- s3-libnet: allow to use default krb5 ccache in libnet_Join/libnet_Unjoin; (bso#7465).- smb2_find uses a hard coded max reply size of 0x10000 instead of smb2_max_trans; (bso#8473).- s3-netapi: allow to use default krb5 credential cache for libnetapi users.- s3-docs: document -k switch in net manpage.- Map to guest can return uninitialized blob of data; (bso#8477).- s3-registry: registry/reg_format.c must include includes.h; (bso#8401).- smbclient segfaults when option -m is used for legacy dialects; (bso#8453).- Fix 'widelinks' regression intro'd in 3.2; (bso#8229).- Compound SMB2 requests on an IPC connection can corrupt the reply stream; (bso#8429).- s3-spoolss: Fix bug forms migration; (bso#8351).- s3:libsmb: check the wct of the incoming SMBnegprot responses; (bso#8452).- s3: Do not fork the echo handler for smb2; (bso#8334).- s3-spoolss: Fix bug empty notify servername; (bso#8236).- SMB2 server can return requests out-of-order when processing a compound request; (bso#8407).- Remove smb child crash fix. The issue had been fixed upstream differently.- BuildRequire ctdb-devel version greater than 1.0.105 for post-10.0 systems.- Fix samba duplicates file content on appending. Move posix case semantics out from under the VFS; (bso#6898); (bnc#681208).- Make winbind child reconnect when remote end has closed, fix failing sudo; (bso#7295); (bnc#569721).- Spec file cleanup as suggested by the spec-cleaner tool. + Make all BuildRequires, PreReq, and Provides a separate line. + Use %{buildroot} instead of ${RPM_BUILD_ROOT}. + Use straight commands instead of macros (make, install). + Use -p in post and postun if we only call one command. + Use %{_localstatedir} instead of %{_var} in the filelist. + Remove superfluous AutoReqProv on lines.- Remove %release from all Provides.- Fix segfault in iconv.c which caused a null pointer dereference; (bso#8433).- Use /var/run for the cifs state file in the init script too; (bnc#710304).- Microsoft Word from Microsoft Office 2007 fails to save as on a share with SMB2; (bso#8412).- Use sys_write and sys_read in fork_domain_child to fix a winbind race leading to 100% CPU usage; (bso#8409).- Fix wrong reply to smb2 durable handle reconnect (DHnC) request; (bso#8428).- Fix infinite loop in ACL module code; (bso#8422).- Fix getent group if trusted domains are not reachable; (bso#8420).- smbclient can't access a NT4 share since 3.6.0; (bso#8385).- Optimize serverid_exists() for Solaris; (bso#8395).- talloc: + check block count after references test. + added test suite for talloc_free_children(). + license info erratum in the manpage. + fix typos and better differentiation between versions 1 and 2. + preserve context name on talloc_free_children(). + ensure the sibling linked list remains valid during a free.- vfs_chown_fsp returned in the wrong directory; (bso#8370).- Remove irritating "." targets when recent system libs exist; (bso#8369).- Correctly initialize "idmap config * : script" with NULL; (bso#8368).- Add missing include to suppress compiler warnings; (bso#8365).- Point the chain offset beyond the current request; (bso#8360).- Fix gpfs vfs module build; (bso#8364).- Make vfs_prealloc even build on older systems; (bso#8363).- Do central cli_set_error and return the actual NTSTATUS; (bso#7864).- Add a fallback for missing open&x support in OS/X Lion; (bso#8338).- Update to 3.6.0. + BUG 7462: Make SA_RESETHAND conditional on its existance. + BUG 8303: db_ctdb_send_schedule_for_deletion() is not defined. + BUG 8324: smbclient cannot list directories from a big-endian machine. + BUG 8326: WinXP cannot join a Samba3 domain with a 'even' hostname. + BUG 8327: Fix the reload of the configuration, also reload activated registry shares. + BUG 8328: Cleanup of idmap_tdb2 code. + BUG 8330: Fix NFSv4 ACL merging logic. + BUG 8335: File copy aborts with smb2_validate_message_id: bad message_id. + BUG 8341: Fix segfault in libsmbclient. + BUG 8343: Fix SMB2 crash reading with aio_fork beyond the end of file. + BUG 8347: Fix regression for HP-UX, AIX and OSF. + BUG 8357: Make sure we grant credits on async read/write operations. + BUG 8358: Fix a bug in run_poll_events(). + BUG 8362: Fix build issue on old glibc systems.- Remove references to disabled vscan build.- Add missing define, includes, and initialization to get_printing_ticket.- Use /var/run for the cifs state file; (bnc#710304).- Fix #ifdef CTDB_CONTROL_SCHEDULE_FOR_DELETION issue; (bso#8303).- File copy aborts with smb2_validate_message_id: bad message_id; (bso#8335).- Fix reload of the configuration and also reload activated registry shares; (bso#8327).- WinXP cannot join a Samba3 domain with a 'even' hostname; (bso#8326).- smbclient cannot list directories from a big-endian machine; (bso#8324).- Update to 3.6.0rc3. + BUG 7841: Explicitly pass domain_sid to wbint_LookupRids(). + BUG 7888: Deal with buggy 3.0 based PDCs. + BUG 8083: Fix "inherit owner = yes" with vfs_acl_xattr or vfs_acl_tdb module. + BUG 8102: Do not allow to change file ACLs from normal domusers. + BUG 8102: Do not allow to change file ACLs from normal domusers. + BUG 8193: Add new command 'enumerate_recursive'. + BUG 8195: Make rpc client code working against NT4 servers. + BUG 8211: Fix "inherit owner = yes" when "inherit permissions = yes" is set. + BUG 8213: Fixes in idmap_autorid. + BUG 8214: Fix smbd crash on printer driver upgrade. + BUG 8215: Fix Winbind unix username lookup. + BUG 8216: Make Winbind returning correct results with 'sids2xids'. + BUG 8217: Do not stat-check the share path in 'net conf addshare'. + BUG 8219: Fix SMB Panic from Windows 7 client. + BUG 8224: Fix the build on FreeBSD. + BUG 8226: Use c99 initializers which are supported by old gcc 2.95 compilers. + BUG 8230: Move .nmbd socket directory to non-hidden name PREFIX/var/nmbd. + BUG 8231: Fix crash bug in 'net cache get'. + BUG 8235: Fix smbd crash on startup caused by migrate_printer(). + BUG 8240: Fix Valgrind warnings in winreg/spoolss code. + BUG 8244: Fix copying files larger than 2 GB to a Samba share. + BUG 8247: Fix Coverity ID 2582: FORWARD_NULL. + BUG 8253: Fix Winbind panic if verify_idpool() fails. + BUG 8254: Fix "acl check permissions = no". + BUG 8260: Fix DCERPC responses with fragments larger than 1024 bytes. + BUG 8262: Fix build of vfs_commit. + BUG 8263: Fix build with --with-fake-kaserver or --with-vfs-afsacl. + BUG 8264: Fix Valgrind bugs in svcctl. + BUG 8276: Close all sockets attached to a subnet in close_subnet(). + BUG 8278: Fix smbd panic when CTDB is unhealthy. + BUG 8281: Fix build of examples/VFS/*. + BUG 8286: Fix smbd crash on premature end of smb2 conn. + BUG 8292: Fix a major architectural flaw in the SMB2 server code. + BUG 8293: Fix log file rotating in SMB2. + BUG 8304: Fix uninitialized variable in error path. + BUG 8305: Fix segfault in nmbd when using 'smbtree ...'.. + BUG 8307: brl_close_fnum does not call SMB_VFS_BRL_UNLOCK_WINDOWS on all locks. + BUG 8310: toupper_ascii() is broken on big-endian systems. + BUG 8314: Fix smbd crash with unknown user. + Mark 'time offset' parameter as deprecated.- The Samba Web Administration Tool (SWAT) versions 3.0.x to 3.5.9 are affected by a cross-site scripting vulnerability; CVE-2011-2694; (bso#8289); (bnc#708503).- The Samba Web Administration Tool (SWAT) versions 3.0.x to 3.5.9 are affected by a cross-site request forgery; CVE-2011-2522; (bso#8290); (bnc#705241).- Fixed the DFS referral response for msdfs root; (bnc#703655).- Fix CUPS print job IDs; (bso#7288); (bnc#701257).- Make use of the actual library version as part of the package name on post-11.3 systems only.- Fix winbind internal error; (bso#7636); (bnc#659424).- Improve ctdb vacuuming performance with use of SCHEDULE_FOR_DELETION; (bnc#705170).- Specify nmbdsocketdir at configure time; (bnc#700953).- Build the tdb, talloc, and tevent libraries ahead of anything else.- Update to 3.6.0rc2. + BUG 6911: Fix Kerberos authentication from Vista to Samba. + BUG 8166: Don't lockout users when offline. + BUG 8200: Add support for multiple writeable ldap idmap domains. + BUG 8148: Default to protocol version 2 for SMB Traffic Analyzer. + BUG 7054: Fix X account flag when "pwdlastset" is "0". + BUG 8144: Fix setting timestamp when touching files with CIFS clients. + BUG 8153: Fix setting up getaddrinfo on IPv6-only machines. + BUG 8156: Fix 'net ads join' using the user's Kerberos ticket. + BUG 8157: Fix parsing a cups printcap file. + BUG 8175: Fix smbd deadlock. + BUG 8189: Support shadow copy display over SMB2. + BUG 8197: Winbind does not properly detect when a DC connection is dead. + BUG 8203: Winbind needs to reset the DC connection if an RPC times out.- Make cupsaddsmb fill printers location; (bso#8132); (bnc#698209).- Add "winbind max clients" parameter to remove 200-client limit; (bnc#697461).- Disable logon cache for password lockout consistency when running in a cluster; (bnc#694836).- Fix logon of AD users with many group memberships; (bso#6911); (bnc#657026).- Don't lockout users while offline; (bso#8166); (bnc#692607).- Update to 3.6.0rc1. + BUG 8111: CIFS VFS: Fix unexpected error on SMB posix open. + BUG 8112: POSIX extension opens of a directory are denied with EISDIR. + BUG 8132: Fix filling printers location field when using cups. + Remove fstrings from client struct. + BUGFIX when converting from safe_strcpy to strlcpy. + Fix off-by-one calculations with strlcpy. + Ensure we always write the correct incoming mid into the share mode table entries. + Fix the SMB2 oplock showstopper. + Convert user-specified domain to uppercase in libsmb. + Fix Coverity CID #2302: FORWARD_NULL. + Fix cups_pull_comment_location(). + Fix double free of cups request. + Make cups_pull_comment_location() work again. + Fix potential crash bug in display_print_driver3(). + Properly clean up in pthreadpool_init in case of failure. + Make plaintext session setup async. + Reduce fd load in Winbind children. + Avoid a potential 100% CPU loop in Winbind. + Tune broadcast namequeries for unique names. + Properly deal with exited winbind children. + Fix dup_smb2_vec3. + Fix return check in nss_wins.- Fix to renew the kerberos ticket in samba after expiry; (bnc#669949).- Fix a 100% CPU loop when ctdbd dies during a traverse; (bnc#693945).- Make dhcpcd hook BOOTPROTO check cover dhcp6 too; (bnc#691969).- Handling of large (> 256 bytes) ntlmv2 blobs in winbind; (bnc#529946).- Package static libraries with 0644 permissions.- Add Requires libtalloc-devel to libldb-devel and libtevent-devel.- Rename libldb0 to libldb1 as 1 is the current major version of the library. - Add libldb1 and libtevent0 to baselibs.conf.- Don't call the suse_update_config macro before building lib ldb and tevent.- Update to 3.6.0pre3. + Listen on IPv6 addresses with IPV6_ONLY; (bso#7383). + Fix wrong output in 'smbget'; (bso#8066). + "inherit owner = yes" doesn't interact correctly with vfs_acl_xattr or vfs_acl_tdb module; (bso#8083). + rpccli_samr_chng_pswd_auth_crap segfaults if any input blobs are null; (bso#8088). + setpwent() actually does endpwent() and vice versa on FreeBSD; (bso#8099). + Fix the build of 'smbget' on HP NonStop; (bso#8106). + Fix build of tdb2. + Correctly detect and deny symlinks anywhere in a path (not just the last component) if "follow symlinks = no". + Fix timeout in rpc_pipe_open_tcp_port(). + Fix the build of "--with-profiling-data". + Fix Coverity IDs 986, 1340, 2047, 2299, 2307, 2325, 2335, 2336, 2470, 2471, 2478. + nsswitch: Add 'wbinfo --lookup-sids'. + nsswitch: Add 'wbinfo --sids-to-unix-ids'. + Fix smbd with the async echo responder. + Fix the build of vfs_gpfs.c. + Add a 10-second timeout for the 445 or netbios connection to a DC. + Many pthreadpool fixes. + Fix transaction recovery area for converted tdbs.- Add PreReq permissions to the krb-printing package.- Remove _libdir ldb and tevent from file list. - Explicitly state not to bundle talloc or tdb while ldb and tevent build.- Always use the actual library version as part of the package name. - Exclude shared python modules.- Fix printing from Windows 7 clients; (bso#7567); (bnc#687535).- Update pidl and always compile IDL at build time; (bnc#688810).- Update to 3.6.0pre2. + ID Mapping changes. + Implement SMB2 support. + Add an Endpoint Mapper daemon. + Make "rlimit_max below minimum Windows limit" notification less scary; (bso#6837). + Quota only shown when logged as root; (bso#7080). + Fix printing from Windows 7; (bso#7567). + Retry DNS updates when connection to one nameserver has failed; (bso#7690). + Unlink may unlink wrong file when hardlinks are involved; (bso#7863). + Fix 'nmbd --port'; (bso#7875). + cmd_spoolss_deletedriver() returned without checking all architectures; (bso#7880). + Don't return "-1" on success in 'net rpc vampire keytab'; (bso#7899). + Fix cups pcap reload with no printers; (bso#7915). + Fix bug in chain_reply; (bso#7917). + Fix problems with "kernel oplocks" option set to "no"; (bso#7928). + Fall back for utimes calls; (bso#7940). + Catch lookup_names/sids schannel errors over ncacn_ip_tcp; (bso#7944). + Let winbind try to use samlogon validation level 6; (bso#7945). + Sgid bit lost on folder rename; (bso#7996). + Fix getting username in 'net rap session'; (bso#8009). + Fix inode generation so nautilus can count total dir size correctly; (bso#8010). + Use jenkins hash for str_checksum; (bso#8010). + Add explicit configure option whether or not to enable dmapi support; (bso#8033). + Fix smbclient segfault with Cyrillic netbios names; (bso#8040). + Fix file creation on OS/X; (bso#8042). + Add "--option" to 'testparm'. + Fix crash bug on smbd shutdown when using FOPENDIR(). + Ensure we don't return an incorrect access mask. + Fix bug against the new Mac client. + Fix leak in error path. + Fix error where Windows client spoolss returns WERR_INVALID_DATA. + Fix a segfault in the krb5 locator plugin. + Enable sharesec for registry shares. + Fix memory leak in "security=share" and "force user". + Add "net idmap check", a check and repair tool for the id mapping database. + Add new 'net idmap delete' command. + Fix segfault on missing input file in 'net idmap restore'. + Fix 'net usersidlist' not to skip every other user. + Fix potential crash bug in spoolss_PrinterEnumValues push path. + Internal restructuring. + Don't wipe out all printer drivers when only one should be deleted. + Fix winbindd_dual_pam_auth_samlogon() for NT4 domains. + Fix memory leak in print_cups.c. + Remove duplicate cups response processing code. + Follow force user/group for driver IO. + Initiate pcap reload from parent smbd. + Reload shares after pcap cache fill. + Fix numerous Coverity IDs (2041 and others). + Fix a memory leak in check_sam_security_info3. + Fix a segfault in the nss wrapper when libnss_winbind.so is not loadable. + Make "net sam list [users|workstations]" list only the right things. + Fix a potential memleak in secrets_fetch_trusted_domain_password. + Use the right credentials in check_netlogond_security. + Add support for AF_NETLINK addr notifications. + Fork multiple Winbind children per domain. + Fix a deadlock between smbd and ctdbd. + Add 'wbinfo --dc-info'. + Make "nmbd socket dir" configurable. + Fixed valgrind errors. + Fix a memleak in receive_getdc_response. + Don't grant SEC_STD_DELETE always to the owner of a file. + Fix segfaults on addrchange errors in Winbind. + Allow machine accounts as members in groupdb. + Add IPv6 support for the endpoint mapper. + Free unused memory in the rpc server. + Fix possible segfaults in svcctl server. + Fix possible segfault with client_id in rpc server. + Add a 'svcctl shutdown' function to rpc server. + Fix a resource leak in net_afs. + Fix a resource leak in smbta-util. + Fix possible resource leak in net_usershare. + Fix possible resource leak in 'smbget'. + Fix possible resource leak in 'smbfilter'. + Fix a possible null pointer dereference in smbd. + Ensure we send the direct levelII oplock break to the correct fid. + Fix private libdir and codepages paths. - Add RFC 3454 to the vendor files.- Fix idmap_tdb for big-endian systems such as ppc and s390; (bso#6901); (bnc#675978).- Fix smbclient -M NT_STATUS_PIPE_BROKEN failure; (bso#7635); (bnc#681913).- Replace jobs by _smp_mflags macro while calling make on post-11.4 systems.- Don't crash when publishing a single printer; (bnc#643119).- Carry error status in printer list IPC message, do not refresh printers if cups is unavailable; (bso#7994); (bnc#675478).- Define the libwbclient packages ahead of packages with a different version.- Use %_smp_mflags for parallel building.- Update to 3.5.8. + Fix Winbind crash bug when no DC is available; (bso#7730). + Fix finding users on domain members; (bso#7743). + Fix memory leaks in Winbind; (bso#7879). + Fix printing with Windows 7 clients; (bso#7567). + Fix 'testparm' return code when EOF in encountered in param name; (bso#3185). + Make "rlimit_max below minimum Windows limit" notification less scary; (bso#6837). + Fix "Your Password expires today" message for users of trusted domains; (bso#7066). + Fix maintaining of users' groups via UsrMgr; (bso#7262). + Fix 'net ads dns register' in Windows 2008 R2 domains; (bso#7356). + Raise debug level for "reduce_name: couldn't get realpath" messages; (bso#7409). + Fix updating the time on close in vfs_gpfs; (bso#7498). + Fix "log=>ndr_pull_error" in 'wbinfo -u' and 'wbinfo -g'; (bso#7594). + Handle Windows 9x adddriver calls without config file; (bso#7641). + Fix scalability problem with hundreds of printers; (bso#7656). + Fix memory leak in the netapi routines; (bso#7665). + Store unmodified copies of security descriptors in acl_xattr and acl_tdb modules; (bso#7716). + Fix incorrect unix mode_t caused by invalid client DOS attributes on create; (bso#7733). + Apply appropriate create masks when creating files with "inherit ACLs" set to true; (bso#7734). + Fix "dfree cache time" parameter; (bso#7744). + Fix a getgrent crash with many groups; (bso#7774). + Fix requesting lookups for BUILTIN sids; (bso#7777). + Fix smbd crash caused by expand_msdfs; (bso#7779). + Fix atime limit; (bso#7785). + vfs_scannedonly: Switch from mtime to ctime which is more reliable; (bso#7789). + Fix copying files from a SMB share using Gnome vfs and SMB signing; (bso#7791). + Make Winbind recover from a signing error; (bso#7800). + ACL inheritance cannot be disabled in vfs_acl_xattr/vfs_acl_tdb; (bso#7812). + Fix "force group" with ntlmssp guest session setup; (bso#7817). + vfs_fill_sparse() doesn't use posix_fallocate when strict allocate is on; (bso#7835). + Make WINBINDD_LOOKUPRIDS asking the right domain; (bso#7841). + Make WINBINDD_LOOKUPRIDS returning the domain name; (bso#7842). + Expand the local SAMs aliases; (bso#7843). + ntlm_auth: Support clients which offer a spnego mechs we don't support; (bso#7855). + Fix 'net ads dns register' in cluster setups; (bso#7871). + Fix 'nmbd --port'; (bso#7875). + Make 'rpcclient deldriver' delete drivers for all architectures; (bso#7880). + Fix flaky Winbind against Windows 2008; (bso#7881). + Fix SMB session setups with Kerberos against some closed source SMB servers; (bso#7883). + Fix stale lock in open_file_fchmod(); (bso#7892). + Fix sporadic Winbind panic in rpc query_user_list; (bso#7894). + Don't set SAMR_FIELD_FULL_NAME if we just want to set the account name; (bso#7896). + Don't return "-1" on success in 'net rpc vampire keytab'; (bso#7899). + Fix connections from WinCE; (bso#7917). + Fix opening MS Powerpoint files; (bso#7940). + Fix endless loops caused by inotify; (bso#7942). + Catch lookup_names/sids schannel errors over ncacn_ip_tcp; (bso#7944). + Let Winbind try to use samlogon validation level 6; (bso#7945). + Revalidate the pathname once re-constructed from a root fsp; (bso#7950).- Require a particular library version even if the major version is part of the package name. Using the same major version does not guarantee forward compatibility.- Fix a fd-leak in libwbclient at dlclose-time; (bso#7684); (bnc#668773).- Update to 3.5.7 + Protect against possible denial of service caused by memory corruption; CVE-2011-0719; (bso#7949); (bnc#670431).- Disable separate build of samba-doc for post-11.1 systems.- Protect against possible denial of service caused by memory corruption; CVE-2011-0719; (bso#7949); (bnc#670431).- Increase the log level for missing PIDs on SIGCHLD, printcap child processes are not added to the children PID list; (bnc#666460).- Do not require a particular library version if the major version is part of the package name.- Use the actual version numbers of the ldb, talloc, tdb, and tevent libraries on post-11.3 systems.- Abide by print$ share 'force user' & 'force group' settings when handling AddprinterDriver and DeletePrinterDriver requests; (bso#7921); (bnc#653353).- Remove pcap_cache_loaded asserts from (re)load_printers. pcap_cache_loaded() returns false if the pcap cache contains no printer entries. correct call ordering is already enforced. (bso#7836); (bnc#625936).- No longer force activation of the cifs service on post-11.3 systems. - Add X-UnitedLinux-Default-Enabled to the cifs init script on pre-11.4 systems. - Move the cifs init script nfs dependencies from Required to Should.- Recommend to install samba-krb-printing from samba-winbind on post-10.3 systems; (bnc#661845).- Fix error paths in cups_async_callback(), an empty cups printer list should not be treated as an error; (bnc#661842).- Abide by printcap cache time, reload parent smbd pcap cache on expiry; (bso#7836); (bnc#625936).- Fix race in cups async printer services reload; (bso#7836); (bnc#625936).- Don't tweak with baselibs.conf during %post if not present; (bnc#652620).- Don't make use of baselibs.conf on SUSE Linux Enterprise 10; (bnc#652620).- Don't use --tmpdir as this option isn't known by mktemp of SUSE Linux Enterprise 10; (bnc#652620).- vfs_fill_sparse() doesn't use posix_fallocate when strict allocate is on; (bso#7835).- Replace Requires samba-client by samba-gplv3-client in the gplv3 packages; (bnc#652620).- Fix Dolphin SMB share IO with SMB signing enabled; (bso#7791); (bnc#656112).- Add Conflicts to the samba-gplv3 main, client, doc, krb-printing, winbind, client-gplv2, and doc-gplv2 packages; (bnc#652620).- Add Provides samba-client-gplv2 and samba-doc-gplv2 to pre-3.2 versions; (bnc#652620).- Obsolete samba-client-gplv2 and samba-doc-gplv2; (bnc#652620).- Remove Provides samba-client:/usr/sbin/winbindd from the samba-gplv3-winbind package to avoide an accidental install trigger; (bnc#652620).- Add Provides samba-client to the samba-gplv3-client package; (bnc#652620).- Remove all Obsoletes from the samba-gplv3 packages and only keep the Provides samba; (bnc#652620).- Add fitting Conflicts to all samba-gplv3 packages; (bnc#652620).- Reduce unnecessary ldap round trips and eliminate invalid DN messages; (bnc#654719).- Exclude cifs-mount and ldapsmb from the samba-gplv3 build of SUSE Linux Enterprise 10 SP 3 and 4.- Add the _build_arch at the end of the vendor version suffix.- Provide and Obsolete samba-gplv3 to replace potentially installed packages.- Change package base name to samba-gplv3 for SUSE Linux Enterprise 10 SP 4. - Do not package libsmbclient and libsmbsharemodes.- Update to 3.5.6 + Fix auto printers with registry config; (bso#7280); (bnc#617153). + Fix SPNEGO auth when contacting Win7 system using Microsoft Live Sign-in Assistant; (bso#7577). + Fix 'net idmap restore' setting HWM to avoid duplicates; (bso#7578). + Fix "admin users" when using vfs_acl_xattr; (bso#7581). + Fix using cached credentials in ntlm_auth; (bso#7589). + Fix Winbind offline login; (bso#7590). + Fix Winbind internal error; (bso#7636). + Fix mknod/mkfifo failing with "No such file or directory"; (bso#7651). + Fix smbd changing mode of files on rename; (bso#7693). + Fix crash bug with invalid SPNEGO token; (bso#7694). + Fix smbd panic on invalid NetBIOS session request; (bso#7698). + Fix smbd crash caused by "%D" in "printer admin"; (bso#7541). + Fix 'smbclient -M'; (bso#7635). + Fix scalability problem with hundreds of printers; (bso#7656). + Fix crash bug in rpcclient; (bso#7688). + Fix file corruption when setting Samba "write wache wize"; (bso#7715).- Let startproc wait for nmb, smb and winbind pid files getting created on post-11.1 systems; (bnc#520036).- Include the reviewed french translation for pam_winbind; (bnc#499233).- Fix smbd crash with CUPS printers and no [printers] share defined; (bso#7297); (bnc#637755).- Fix printing from 64-bit windows clients; (bso#6888); (bnc#640870).- Fix baselibs.conf for libtalloc.- Fix buffer overflow in sid_parse() to correctly check the input lengths when reading a binary representation of a Windows Security ID (SID); CVE-2010-3069; (bso#7669); (bnc#637218).- Use cached ntlm password in libsmbclient. Prevent lockouts when kerberos tickets are lost; (bnc#602418); (bnc#606304).- Add a dependency on nfs to the smbfs/ cifs init scripts as they require the en_US locale and /usr might be on NFS.- Complete fix for trusts with Windows 2008R2 DCs.- Fix authentication dialogs when connecting to older systems; (bnc#632055).- Adjust position of conditional ldapsmb %package and %files definition.- Create the /var/run/samba directory on the fly and package it as %ghost.- Fix preexec scripts; (bso#7104); (bnc#632852).- Add missing netapi, smbclient, smbsharemodes, talloc, tevent, and wbclient pkgconfig files and BuildRequire pkgconfig; (bnc#632770).- BuildRequire python-devel for post-9.3 systems.- Only create precompiled headers for post-10.2 systems. - Remove mkinitrd scriptlets.- Add vfs_crossrename man page. - Call make basic and remove conditional proto target. - Increase libtevent version to 0.9.9. - Remove wbc_async header from the file list. - Remove remaining cifs-mount pieces from the spec file.- Fix printers not auto loading with registry config; (bso#7280); (bnc#617153).- Update to 3.6.0pre1. + SMB2 support is fully functional despite managing quota using the Microsoft management tools. + Internal Winbind passdb changes to use samr and lsa rpc pipe to get local user and group information. + The spoolss and the old RAP printing code have been completely overhauled and refactored. + The SMB Traffic Analyzer (SMBTA) VFS module got added.- Intilize workgroup of nmblookup as empty string.- Fix net ads join when using parent domain users; (bso#6364); (bnc#630812).- cifs: do not restart during dhcp lease renewal when IPaddress remains the same; (bnc#573246).- Fix "Too many open files" when trying to access large number of files; (bso#6837); (bnc#619787).- Update to 3.5.4. + Fix smbd crash when sambaLMPassword and sambaNTPassword entries missing from ldap (bug #7448). + Fix init_sam_from_ldap storing group in sid2uid cache (bug #7507). + Allow previous password to be stored and use it to check tickets; (bso#7099). + Make ea data checks identical for trans2open and trans2mkdir; (bso#7188). + Fix editing users' groups via UsrMgr; (bso#7262). + Fix Winbind over IPv6; (bso#7341). + Samba sends "raw" inode number as uniqueid with unix extensions; (bso#7410). + Fix printing large formats; (bso#7423). + Fix spnego returning incorrect mechListMIC string; (bso#7449). + Fix some crash bugs and missing error codes in AddDriver paths; (bso#7459). + Fix crash bug in _samr_QueryUserInfo{2} level 18; (bso#7479). + Fix 'not a string literal' warning in netdomjoin-gui; (bso#7500). + Fix calculation of st_blocks in vfs_streams_xattr; (bso#7503). + Fix numerous build issues; (bso#7504). + Fix session setup from linux kernel cifs clients with "sec=ntlmv2"; (bso#7517).- Remove all provides and obsoletes samba3 from the spec file. Packages with this base name have not been offered as part of a product.- Fix a NULL pointer dereference in smbd of the 3.4 code base; CVE-2010-1635; (bso#7229); (bnc#605935).- Address possible buffer overrun in chain_reply code of pre-3.4 versions; CVE-2010-2063; (bso#7494); (bnc#611927).- Update of the SMB Traffic Analyzer v2 VFS module- Fix trusts with Windows 2008R2 DCs; (bnc#613459); (bnc#599873); (bnc#592198); (bso#6697).- Update to 3.5.3. + Fix MS-DFS functionality; (bso#7339). + Fix a Winbind crash when scanning trusts; (bso#7389). + Fix problems with SIGCHLD handling in Winbind; (bso#7317). + Add replacement for IPV6_V6ONLY on linux systems with broken headers; (bso#7196). + Fix cups encryption setting; (bso#7263). + Fix exporting printers via 'cupsaddsmb' command; (bso#7277). + Fix SMB job IDs in CUPS job names; (bso#7288). + Fix segfault in mount.cifs; (bso#7315). + Make TIME_T_MAX defines consistent; (bso#7352). + Re-fix a bug with smbd serving a windows terminal server; (bso#7357). + Display an error on 'net conf import' failures; (bso#7378). + Fix bitmap leak in dptr_Close; (bso#7384). + Fix rename problems with full_audit VFS module; (bso#7398). + Fix setting of passwords via 'net rpc user password' command; (bso#7417). + Fix 'net rpc printer list' command; (bso#7418). + Rename mod_name to module_name; (bso#7421). - Fix unnecessary traversing winbindd_cache.tdb in SIGHUP handler. - Added EN ISO 216, A0 and A1 to builtin forms; (bso#7423). - Winbind not working over IPv6; (bso#7341).- Honor "interfaces" list in net ad dns register; (bnc#606947).- Exclude the RPM release from the vendor tag for openSUSE Factory; (bnc#604049).- Enable the build of the idmap tdb2 module; (bnc#600822).- BuildRequire keyutils-libs-devel for Fedora and post-RHEL4.- BuildRequire pkg-config for post-10.2 systems and else pkgconfig.- Add "net conf import" error messages; (bso#7378, bnc#598189).- Define cups_lib_dir %{_prefix}/lib/cups for post-11.2 systems; (bnc#575544).- Update to 3.5.2. + Fix smbd segfaults in _netr_SamLogon for clients sending null domain; (bso#7237). + Fix smbd segfaults in "waiting for connections" message; (bso#7251). + Fix an uninitialized variable read in smbd; (bso#7254); (bnc#605935); CVE-2010-1642. + Fix a memleak in Winbind; (bso#7278). + Fix Winbind reconnection to it's own domain; (bso#7295). + Fix segfault if hide files or veto files has no ".AppleDouble"; (bso#1206). + Fix parsing of the gecos field; (bso#5198). + Fix several printing issues; (bso#6727). + Fix valgrind warning; (bso#6814). + Fix race condition in mount.cifs that allows user to replace mountpoint with a symlink; (bso#6853). + Fix bug in vfs_scannedonly rmdir implementation; (bso#7075). + Fix handling of bad server data returns in client rpc_transport; (bso#7159). + Never mark external domains as internal in Winbind; (bso#7170). + Fix access by multi-threaded applications; (bso#7202). + Fix 'net share' command; (bso#7203). + Fix DN parsing name was always null; (bso#7204). + Signals are processed twice in child; (bso#7206). + Fix returning of group members with 'getent group'; (bso#7212). + Fix the build of net_afs.c with --fake-kaserver=yes; (bso#7216). + Make Winbind logs more verbose for troubleshooting; (bso#7225). + Fix a NULL pointer dereference in smbd; CVE-2010-1635; (bso#7229); (bnc#605935). + Fix automatic building of vfs_tsmsm if gpfs and dmapi are present; (bso#7231). + Fix race conditions in CTDB persistent transactions; (bso#7232). + Symlink delete fails but incorrectly reports success to client; (bso#7234). + Fix "printer admin" functionality; (bso#7255). + Fix value-needed calculation in_spoolss_EnumPrinterData(); (bso#7256). + Fix _winreg_QueryValue crash bugs and implement Windows behavior; (bso#7258). + Fix job management commands for CUPS queues; (bso#7269). + Fix smbd segfault if using vfs_acl_tdb; (bso#7283). + Fix core dump in 'ntlm_auth' with "gss-spnego" helper; (bso#7290). + Fix smbd crashes with CUPS printers and no [printers] share defined; (bso#7297). + Fix DOS attribute inconsistency with MS Office; (bso#7310). + Many disconnecting clients render clustered Samba unusuable for some time; (bso#7312). + Make 'net conf addshare' atomic; (bso#7313). + Eliminate race condition in creating/scanning sorted subkeys in the registry backend; (bso#7314). + Winbind possibly segfaults when trying a trusted domain without inbound trust; (bso#7316).- Add SMB Traffic Analyzer v2 VFS module.- Document "wide links" defaults to "no" in the smb.conf man page for versions pre-3.4.6; (bnc#577868).- Fix workgroup enumeration, for client printer and file share selection; (bso#6880); (bnc#586215).- Fix tdb validation for offline auth; (bnc#587014).- Fix "printer admin" functionality; (bso#7255).- An uninitialized variable read could cause an smbd crash; (bso#7254); (bnc#605935); CVE-2010-1642.- Ensure to have a valid talloc stackframe; (bso#7251).- _netr_SamLogon segfaults for clients sending NULL domain; (bso#7237).- Merge missing pam_winbind message translations; (bnc#499233).- Remove cifs-mount subpackage for post-11.2 systems as the tools are now part of the independent cifs-utils package.- Fix join of Windows 2008 domains; (bnc#567013).- Update to 3.5.1 and 3.4.7. + Fix security flaw on Linux platforms if built with libcap support allowing file system access even when permissions should have denied it; CVE-2010-0728; (bso#7222); (bnc#586683).- Fixed libldb.so link in libldb-devel.- Fix argc handling in net_share, making the command "net share" work again; (bso#7203); (bnc#584253).- Update to 3.5.0. + Fix duplicate sam and unix accounts; (bso#7145). + Keep the the correct negotiate_flags on the cli->dc structure; (bso#7160). + Avoid calling cli_alloc_mid twice in cli_smb_req_iov_send; (bso#7166). + Fix 'net ads dns' usage calls; (bso#7181). + Fix uninitialized variable in wkssvc_enumerateusers; (bso#7182).- Update to 3.4.6. + Change parameter "wide links" to default to "no"; it's also incompatible with "unix extensions"; (bso#7104); (bnc#577868). + Fix printing with 64 bit clients (bso#6888). + Fix core dump on 64 bit Linux (bso#7063). + Fix failing of smbd to respond to a read or a write caused by Linux asynchronous IO (aio) (bso#7067). + Fix string buffer overflow causing heap corruption in smbd (bso#7096). + Fix bogus ip address in SWAT; (bso#5885). + Fix vfs_full_audit; (bso#6557). + Use the first "uid" value; (bso#6157). + Fix large paged search with DirX LDAP servers; (bso#6981). + Fix crash bug in 'cifs.upcall'; (bso#6868). + Add cross option to samba_cv_linux_getgrouplist_ok; (bso#7047). + Fix DFS on AIX (maybe others); (bso#7052). + Fix pdb_search crash as non-root user; (bso#7068). + Fix unlocking of accounts from ldap; (bso#7072). + Fix vfs_expand_msdfs; (bso#7081). + Fix results of 'smbclient -L' with a large browse list; (bso#7098). + Normalize "Changing password for" msg IDs and STRs; (bso#7102). + Fix malformed require_membership_of_sid; (bso#7106). + Fix reading of large browselist; (bso#7122). + "mangling method = hash" can crash storing a name containing a '.'; (bso#7154). + Valgrind Conditional jump or move depends on uninitialised value(s) error when "mangling method = hash"; (bso#7155). + Fix listing of printjobs in Windows 7; (bso#7130). + Spoolss getprinterdriver2 level 101 marshalling is bad; (bso#7136). + Make idmap cache persistent for "ldapsam:trusted". + Also fill the memcache with sid<->id mappings in ldapsam_sid_to_id() not only the persistent idmap cache. + Shortcut uid_to_sid when "ldapsam:trusted = yes". + Make pdb_copy_sam_account also copy the group sid. + Shortcut gid_to_sid when "ldapsam:trusted = yes". + Speed up pdb_get_group_sid(). + Try to build the full unix_pw structure with ldapsam:trusted support. + Optimize ldapsam_alias_memberships() and cache ldap searches.- Update to 3.5.0rc3. + Change parameter "wide links" to default to "no"; it's also incompatible with "unix extensions"; (bso#7104); (bnc#577868). + Fix vfs_full_audit; (bso#6557). + Fix crash bug in 'cifs.upcall'; (bso#6868). + Fix duplicate initializer in the rmdir module; (bso#6876). + Fix printing with 64 bit clients; (bso#6888). + Add cross option to samba_cv_linux_getgrouplist_ok; (bso#7047). + Fix core dump on Ubuntu 8.04 64 bit; (bso#7063). + Fix failing of smbd to respond to a read or a write caused by Linux asynchronous IO (aio); (bso#7067). + Fix 'smbget' error status; (bso#7069). + Fix build of 'smbfilter'; (bso#7071). + Fix unlocking of accounts from ldap; (bso#7072). + Cliconnect gets realm wrong with trusted domains; (bso#7079). + Fix vfs_expand_msdfs; (bso#7081). + Fix storing of create time on directories in an EA in new create time code; (bso#7084). + Fix an early release of the global lock that can cause data corruption in libtdb; (bso#7085). + Fix string buffer overflow causing heap corruption in smbd; (bso#7096). + Fix results of 'smbclient -L' with a large browse list; (bso#7098). + Normalize "Changing password for" msg IDs and STRs; (bso#7102). + Fix malformed require_membership_of_sid; (bso#7106). + Add pdb_ldap performance fixes; (bso#7116). + Change ldap filter to what really was intended; (bso#7116). + Add new "nmbd bind explicit broadcast" parameter; (bso#7118). + Fix nmbd problems with socket address; (bso#7118). + Support large browselist; (bso#7119). + Fix reading of large browselist; (bso#7122). + Fix listing of printjobs in Windows 7; (bso#7130). + Owner of file not available with Kerberos; (bso#7139). + Fix IPv4/IPv6 problems; (bso#7140). + Fix get_acl_blob in the acl_tdb VFS module; (bso#7148). + "mangling method = hash" can crash storing a name containing a '.'; (bso#7154). + Valgrind Conditional jump or move depends on uninitialised value(s) error when "mangling method = hash"; (bso#7155). + Fix some wrong newlines in de translation strings.- Take extra care that a mount point of mount.cifs isn't changed during mount and don't allow it to be run as setuid root program; CVE-2010-0787; (bso#6853); (bnc#550002).- Check in mount.cifs for invalid characters in device name and mountpoint; CVE-2010-0547; (brc#562156); (bnc#577925).- Don't invalidate cache for uninitialized domains; (bnc#538923).- Signals are processed twice in child; (bnc#538923).- Allow forced pw change even with min pw age; (bnc#561894).- Change parameter "wide links" to default to "no"; it's also incompatible with "unix extensions"; CVE-2010-0926; (bso#7104); (bnc#577868).- Fix enumerate domain local groups for primary domain; (bnc#573813).- Fix malformed require_membership_of_sid; (bnc#525123); (bso#7106).- Normalize "Changing password for" msg IDs and STRs; (bnc#499233).- Build libtevent and libldb and put them into separate subpackages.- Update to 3.5.0rc2. + The Using Samba HTML book has been removed. + 'net', 'smbclient' and libsmbclient can use logon credentials cached by Winbind; (bso#7062). + New vfs_scannedonly module has been added; (bso#7028). + Check password history before increasing "badPasswordCount"; (bso#4347). + Fix changing of ACLs on writable file with "dos filemode=yes"; (bso#5202). + Restore Samba 3.0.x behavior and use the first "uid" value in pdb_ldap; (bso#6157). + Fix deletion of an object whose parent folder does not have delete rights fails even if the delete right is set on the object in vfs_acl_xattr and vfs_acl_tdb; (bso#6876). + Fix large paged search with DirX LDAP servers; (bso#6981). + Fix a segfault in winbindd_dual_ccache_ntlm_auth(); (bso#7027). + Disable sanity check in NetShareEnum for better compatibility with Windows; (bso#7029). + Fix SMBrmdir error message when deleting a directory fails; (bso#7033). + Fix segfault in vfs_cap; (bso#7034). + Fix 'net rpc getsid' in hardened Windows environments; (bso#7036). + Fix a Winbind segfault in "trusted_domains"; (bso#7037). + Complete and improve some German translation of 'net'; (bso#7039). + Fix compile error with WITH_DNS_UPDATE. Update .po files; (bso#7039). + Fix crash bug in libsmbclient; (bso#7043). + Fix bad (non memory copying) interfaces in smbc_setXXXX calls; (bso#7045). + Fix libsmbclient crash against OpenSolaris CIFS server; (bso#7046). + Lock down some srvsvc calls according to what w2k3 seems to do.- Update to 3.4.5. + Fix memory leak in smbd (bug #7020). + Fix changing of ACLs on writable files with "dos filemode=yes" (bug #5202). + BUG 6642: Fix opening the quota magic file. + BUG 6919: Fix remote quota management. + BUG 7034: Fix internal error caused by vfs_cap. + BUG 7036: Fix 'net rpc getsid' in hardened Windows environments. + BUG 7043: Fix crash bug in "SMBC_parse_path". + BUG 7045: Fix bad (non memory copying) interfaces in smbc_setXXXX calls. + BUG 7046: Fix a crash in libsmbclient used against the OpenSolaris CIFS server.- Free unused memory after a packet got processed; (bso#7020).- Add timeout to rpc call to prevent infinite loop when network is down; (bnc#538923).- Update to 3.5.0rc1. + BUG 6837: Fix "Too many open files" when trying to access large number of files with Windows 7; (bnc#619787). + BUG 6939: Fix long filenames when "mangling method" is set to "hash". + BUG 6991: Create symbol links to shared libraries. + BUG 6992: make test for getgrouplist cacheable. + BUG 7014: Fix Winbind crash when retrieving empty group members. + BUG 7020: Fix smbd using 2G memory. + Ensure dos_mode can return FILE_ATTRIBUTE_NORMAL, then filter the returned attributes by protocol level. + Vector correctly through reply_openerror() (which uses the same logic). + Fix bugs with the full Windows ACL support. + Add a few missing gettext calls to the 'net' command. + Fix up a share type translation and translate some more strings in 'net'. + Allow to call "pdbedit -N description -u user" without specifiyng "-r". + Add spoolss_DriverInfo7. + Fix rpcclient after setprinter IDL fixes. + Use generated krb5.conf in 'net ads testjoin'. + Add some German translations for the 'net' command. + Update mount.cifs man page with nounix option. + Fix _samr_GetAliasMembership for results with 0 rids. + Fix an error case in cli_negprot. + Add a lower-cost alternative to wbinfo -t: wbinfo --ping-dc. + Restore correct timeouts for SMB requests. + Fix a 64-bit error in libsmb. + Replace IS_DOMAIN_OFFLINE by a function in Winbind. + Simplify/cleanup Winbind code. + Fix write behind memory block in libtalloc. + Fix result check for getaddrinfo(). + Add tsocket_address_bsd_sockaddr() and tsocket_address_bsd_from_sockaddr() to tsocket. + Always set tdb->tracefd to -1 to be safe on goto fail in libtdb. + Add TDB_DISALLOW_NESTING and make TDB_ALLOW_NESTING the default behavior. + Fix standalone 'make installdocs'. + Output %p as unsigned in snprintf replacement. + New attempt at TDB transaction nesting allow/disallow. + Remove swig stuff from libtdb. + Reset tdb->fd to -1 in tdb_close() in libtdb. + Change the way mksysms work in libtalloc. + Also build and install tdb manpages from standalone tdb. + Fix infinite loop in NCACN_IP_TCP as there is no timeout. + Make winbindd_cache.c aware of domain offline to avoid unnecessary backend query. + List trusted domains from wcache when domain is offline.- Update to 3.4.4. + Fix interdomain trust relationships with Win2008R2 (bug #6697). + Fix Winbind crashes when queried from nss (bug #6889). + Fix Winbind crash when retrieving empty group members (bug #7014). + Fix "UID range full" error in Winbind (bug #6901). + Fix multiple LDAP servers in "idmap backend" and "idmap alloc backend" (bug #6910). + BUG 4832: Fix iconv checks. + BUG 6338: Do not always display "none" in 'net rpc trustdom list'. + BUG 6851: Add pdbedit --kickoff-time/-K to set the user's kickoff time. + BUG 6828: Fix infinite timeout when byte lock held outside of samba. + BUG 6837: Fix "Too many open files" message when trying to access a large number of files with Windows 7; (bnc#619787). + BUG 6841: Fix "map acl inherit = yes". + BUG 6850: Fix shadow copy display on Windows 7. + BUG 6867: Fix listing of directories with a lot of files. + BUG 6868: Support building with Heimdal we well as with MIT. + BUG 6875: Fix DOS attributes on OS/2 clients. + BUG 6880: Fix listing of workgroup servers in libsmbclient. + BUG 6898: Samba duplicates file content on appending. + BUG 6918: Fix krb5 build problem on Ubuntu karmic. + BUG 6929: Fix build with recent heimdal. + BUG 6939: Fix long filenames with "mangling method = hash". + BUG 6967: Fix 'net ads join' with OU. + BUG 6981: Fix paged search with DirX LDAP server. + BUG 6982: Remove erroneous out of memory error path in lookup_sid. + BUG 6997: Fix _samr_GetAliasMembership for results with 0 rids. + BUG 7005: Fix "mangle method = hash" truncates files with dot "." character. + Fix the build of the winbind krb5 locator plugin. + Fix enumprinter key client and server.- Readjust the _libdir/cups/backend/smb sym link only on uninstall of the samba-krb-printing package; (bnc#568603).- Add BuildRequires to fam-devel; (bnc#564260).- Prevent winbind crash; (bso#7014); (bnc#566119).- Fix processing of open modes in POSIX open; (bnc#530683).- Add baselibs.conf as a source.- Update to 3.5.0pre2. + BUG 2350: Add LDAP Alias Dereferencing support. + BUG 6288: SWAT adds a second share when changing parameters of an existing share. + BUG 6435: Fix minor memory corruption. + BUG 6710: Only install the cifs.upcall man page if CIFSUPCALL_PROGS was set while configure. + BUG 6802: A created folder does not properly inherit permissions from parent in vfs_acl_xattr. + BUG 6837: "Too many open files" when trying to access large number of files from Windows 7; (bnc#619787). + BUG 6860: Fix shared library build on QNX. + BUG 6879: Fix crash in Winbind. + BUG 6929: Fix build with recent heimdal. + BUG 6938 : No hook exists to check creation rights when using acl_xattr module. + BUG 6967: Prevent glibc error on 'net ads join'. + Fix vfs_acl_xattr which was failing to call the NEXT connect function. + Restructure the ACL code. + Refactor reply_rmdir to use handle based code. + Fix the build when no external talloc and tdb are installed. + Fix detection of CTDB headers on systems without system-libtalloc. + Fix several printing issues. + Fix the build on Mac OS X 10.6.2. + Fix net and rpcclient after setprinterdataex changes. + Add full support for level 8 printer drivers. + Add more spoolss architectures to IDL. + Fix enumprinter key client and server. + Fix crash in EnumPrinterDataEx. + Prefer posix_fallocate for doing "strict allocate". + Restore "fake directory create times" as a share parameter. + Fix explicit stat64 support. + Add support for NetWkstaGetInfo 101 and 102. + Add rpcclient wkssvc_enumerateusers. + De-deprecate "write cache size" to prevent its removal without a proper alternative. + Allow more than 1000 users in BUILTIN\Users. + Complete support for NetWkstaGetInfo/NetWkstaEnumUsers. + Fix the build of the example VFS modules. + Fix crash in free_file_list(). + Give the user a chance to change password when password will expire soon.- Store the smbfs service state if enabled and restore it for cifs while upgrade on post-11.2 systems.- Prevent cifstab from being overwritten while upgrade on post-11.2 systems.- Give the user a chance to change password when password will expire soon; (FATE#302414).- Rename smbfs init script to cifs for post-11.2 systems.- Allow Windows 7 to connection to samba domain controllers and member servers; (bnc#551811); (bso#6099); (bso#6100); (bso#6680).- Error on joining windows domain (invalid pointer); (bso#6967); (bnc#553622).- Add PreReq /usr/sbin/groupadd to the winbind package; (bnc#559165). - Simplify the winbind package %pre script and suppress stdout only.- Update to 3.5.0pre1 + Add support for full Windows timestamp resolution. + Experimental implementation of SMB2. + Add encryption support for connections to a CUPS server. + Major windbind asynchronous refactoring. - Remove using_samba from the doc package. - Increase major version of libtalloc to 2.- Fix kerberos refresh chain; (bnc#546162); (bso#6872).- Hardlink duplicate files on post-11.1 systems.- Add BuildArch noarch to samba-doc on post-11.1 systems.- Use full 16byte session key in make_user_info_netlogon_interactive(); (bnc#551811).- Update to 3.4.3. + Fix trust relationships to windows 2008 (2008 r2) (bug #6711). + Fix file corruption using smbclient with NT4 server (bug #6606). + Fix Windows 7 share access (which defaults to NTLMv2) (bug #6680). + BUG 4675: mount.cifs: Do not attempt to update /etc/mtab if it is a symbolic link. + BUG 6529: Offline files conflict with Vista and Office 2003. + BUG 6532: Fix domain enumeration if master browser has space in name. + BUG 6606: Fix file corruption using smbclient with NT4 server. + BUG 6690: Fix wrong error check in profile. + BUG 6703: Allow smbstatus as non-root. + BUG 6704: Fix syntax error in avahi configure test. + BUG 6707: Fix an occasional segfault in config file parsing. + BUG 6710: Adjust regex to match variable names including underscores. + BUG 6711: Fix trust relationships to windows 2008 (2008 r2). + BUG 6726: SIVAL should have been an SVAL. + BUG 6728: BSD needs sys/sysctl.h included to build properly. + BUG 6731: Fix reading beyond the end of a named stream in xattr_streams. + BUG 6735: Don't overwrite password in pam_winbind, subsequent pam modules might use the old password and new password. + BUG 6764: Fix timeval calculation. + BUG 6765: Add a "hidden" parameter "share:fake_fscaps". + BUG 6769: Fix symlink unlink. + BUG 6772: Allow outstanding_aio_calls to be decremented. + BUG 6774: smbd crashes if "aio write behind" is set. + BUG 6776: Fix core dump caused by running overlapping Byte Lock test. + BUG 6781: Fix renaming subfolders in Explorer view. + BUG 6791: Fix linking order in cifs.upcall. + BUG 6793: Fix Winbind crash with "INTERNAL ERROR: Signal 6". + BUG 6793: Fix segfault in winbindd_pam_auth. + BUG 6796: Deleting an event context on shutdown can cause smbd to crash. + BUG 6797: Fix a memleak in libwbclient. + BUG 6804: Fix hpux compiler issue. + BUG 6805: Correctly handle aio_error() and errno. + BUG 6807: Fix a segfault in "net rpc trustdom list" for long domain names. + BUG 6810: Add support for finding alternate credcaches to cifs.upcall. + BUG 6811: Fix reference to freed memory in pam_winbind. + BUG 6815: Fix Windows 2008 R2 SPNEGO negTokenTarg parsing failure. + BUG 6824: Fix avahi activation. + BUG 6826: Don't fail authentication when one or some group of require-membership-of is invalid. + BUG 6828: Fix infinite timeout when byte lock held outside of Samba. + BUG 6829: Fix displaying of multibyte characters in smbclient. + BUG 6840: Fix crash in pam_winbind. + Fix an uninitialized variable. + Only ever handle one event after a select call. + Conditional install of the cifs.upcall man page. + Fix warning occuring when building the manpages.- Let smbclient show special characters properly; (bso#6829); (bnc#544204).- Don't fail authentication when one or some group of require-membership-of is invalid; (bnc#525123); (bso#6826).- Allow winbind to ignore certain domains; (bnc#539506).- Update to 3.4.2. + Fix unresolved home path; CVE-2009-2813; (bso#6763); (bnc#539517). + Fix potential denial of service; CVE-2009-2906; (bso#6768); (bnc#543115). + Fix potential mount.cifs password leaks; CVE-2009-2948; (bnc#542150).- Fix potential denial of service; CVE-2009-2906; (bnc#543115).- Fix potential mount.cifs password leaks; CVE-2009-2948; (bnc#542150).- Fix unresolved home path; CVE-2009-2813; (bnc#539517).- Don't overwrite password in pam_winbind; (bnc#515444).- mods for winbind (when used with squid - ntlm_auth) o winbind adds group 'winbind' o permission 0750,root,winbind LOCKDIR/winbindd_privileged- Merge two fixes from 3.2.8 and 3.3.1. + Adjust regex to match variable names including underscores. + Conditional install of the cifs.upcall man page.- Remove supplements from baselibs.conf while %clean for pre-11.1 systems; (bnc#520579).- Update to 3.4.1. + Fix authentication on member servers without Winbind (bug #6650). + Nautilus fails to copy files from an SMB share (bug #6649). + Fix connections of Win98 clients (bug #6551). + Fix interdomain trusts with Windows 2008 R2 DCs (bug #6697). + Fix Winbind authentication issue (bug #6646). + BUG 5879: Update LDAP schema for Netscape DS 5. + BUG 5886: Fix password change propagation with ldapsam. + BUG 6105: Make linking of cifs.upcall and rpcclient --as-needed safe. + BUG 6222: Default to DRSUAPI replication for net rpc vampire keytab. + BUG 6437: Make open_udp_socket() IPv6 clean. + BUG 6496: MS-DFS cannot follow multibyte char link name in libsmbclient. + BUG 6506: Smbd server doesn't set EAs when a file is overwritten in NT_TRANSACT_CREATE. + BUG 6532: Fix the build with external talloc. + BUG 6538: Cancel all locks that are made before the first failure. + BUG 6560: Fix lookupname. + BUG 6564: SetPrinter fails (panics) as non root. + BUG 6568: Fix _spoolss_GetPrintProcessorDirectory() implementation. + BUG 6585: Fix unqualified "net join". + BUG 6593: Correctly implement SMB_INFO_STANDARD setfileinfo. + BUG 6601: Avoid global fd limits. + BUG 6607: Fix crash bug in spoolss_addprinterex_level_2. + BUG 6611: Fix a valgrind error in chain_reply. + BUG 6615: Fix browsing of DFS when using kerberos in libsmbclient. + BUG 6627: Raise the timeout for lsa_Lookup*() calls from 10 to 35 seconds. + BUG 6650: Fix authentication on member servers without Winbind. + BUG 6651: Fix smbd SIGSEGV when breaking oplocks. + BUG 6655: Fix 'smbcontrol smbd ping'. + BUG 6620: Fix a bug in renames of directories. + BUG 6664: Fix truncation of the session key. + BUG 6673: Fix 'smbpasswd' with "unix password sync = yes". + BUG 6680: Fix authentication failure from Windows 7 when domain joined. + BUG 6688: Fix crash in 'net usershare list'. + BUG 6693: Check we read off the complete event from inotify. + BUG 6700: Use dns domain name when needing to guess server principal.- Update to 3.2.14. + Fix SAMR access checks (e.g. bugs #6089 and #6112). + Fix 'force user' (bug #6291). + Improve Win7 support (bug #6099). + Fix posix ACLs when setting an ACL without explicit ACE for the owner (bug #2346). + BUG 6387: Fix Winbind crash when multiple IDmappings exist in the LDAP directory. + BUG 6509: Use gid (not uid) cache in fetch_gid_from_cache(). + BUG 6089: Fix SAMR access checks. + BUG 6112: Fix SAMR access checks. + BUG 6279: Fix Winbind crash. + BUG 6291: Fix 'force user'. + BUG 6099: Try to fix domain join of Win7 Beta. + BUG 6386: Groupdb mapping fix. + BUG 6421: Fix POSIX read-only open on read-only shares. + BUG 6476: Fix more smbd-zombies in memory. + BUG 6488: acl_group_override() call in posix acls references an uninitialized variable. + BUG 6504: Fix SAMR server for Winbind access. + BUG 6520: Fix time stamps. + BUG 6301: Fix samr_ConnectVersion enum which is 32bit not 16bit. + BUG 6340: Don't segfault when cleartext trustdom pwd could not be retrieved. + BUG 6372: Fix usermanager only displaying 1024 groups and aliases. + BUG 6465: Fix enum_aliasmem in ldb branch. + BUG 6484: Fix searching for users while adding them to groups via Windows usermanager. + BUG 2346: Fix posix ACLs when setting an ACL without explicit ACE for the owner. + BUG 6526: Let parent_dirname() correctly return toplevel filenames. + BUG 6627: Raise the timeout for lsa_Lookup*() calls from 10 to 35 seconds. + BUG 5798: Preserve CFLAGS info in configure. + BUG 6382: Case insensitive access to DFS links broken. + BUG 6481: Don't require "Modify property" perms to unjoin. + BUG 6628: 'smbpasswd -a' uses algorithmic rid base with 'passdb backend = tdbsam'. + BUG 6560: Lookupname failed, cannot find domain when attempt to change password. + Prevent creation of keys containing the '/' character. + Fix join of Windows 7 RC to a Samba3 DC. + Fix bug in processing of open modes in POSIX open. + Fix the negotiate flags. + Protect netlogon_creds_server_step() against NULL creds. + Also handle DirX return codes. + Fix a crash bug if we timeout in net rpc trustdom list. + Add '--request-timeout' option to 'net'. + Fix a race condition in Winbind leading to a panic. + Add workaround for MS KB932762. + 5945: Fix out of memory error with Winbind idmap. + Avoid duplicate ACEs. + Fix profile ACLs in some corner cases. + Zero an uninitialized array.- Unable to browse DFS when using kerberos in libsmbclient; (bnc#528271); (bso#6615).- check in .po files for pam_winbind; (bnc#499233); (bso#6602).- Add ntp and network-remotefs as Should-Start dependency to the winbind init script; (bnc#515629).- Update to 3.0.36. + Fix Winbind crash on 'getent group' (bug #5906). + Excel save operation corrupts file ACLs (bug #4308). + Prevent segmentation fault on joining a very long domain name. + BUG 4308: Excel save operation corrupts file ACLs. + BUG 4370: Clean-up entries in /etc/mtab after unmount. + BUG 4640: Fix guest mounts in mount-cifs. + BUG 5906: Fix Winbind crash on 'getent group'. + BUG 6066: netinet/ip.h present but cannot be compiled on Solaris. + BUG 6099: In order to allow Win7 to connect to a Samba NT style. + BUG 6279: Fix Winbind crash. PDC we set the flags before we know if it's an error or not. + BUG 6085: Fix build of vfs_default. + BUG 6098: When the DNS server is invalid, the ads_find_dc() does not work correctly. + Fix logic error in try_chown. + Correctly use chroot(). + Fix bug in processing of open modes in POSIX open. + Don't install the cifs.upcall binary twice. + Fix mount.cifs handling of -V option. + Prevent segmentation fault on joining a very long domain name. + Don't try and delete a default ACL from a file. + Add workaround for MS KB932762. + Add fakemount (-f) and nomtab (-n) flags to mount.cifs. + Fix a crash during name resolution when log level >= 10 and libc segfaults if printf is passed NULL for a "%s" arg.- Use a conditional suse_version macro in front of the SUSE_ASNEEDED export.- lookupname failed, cannot find domain when attempt to change password; (bnc#520645); (bso#6560).- Don't link with --as-needed flag on post-11.1 systems.- Stop the smbfs service if an interface goes down; (bnc#517768).- Disable build of static libraries on post-11.1 systems; (bnc#509945).- Fix missing zlibs for cifs.upcall and test_shlibs.- Update to 3.4.0. + BUG 6431: Local groups from 3.0 setups no longer found. + BUG 6459: Fix build of pam_smbpass on some distributions. + BUG 6481: 'net ads leave' needs to try account deletion, NetUnjoinDomain not. + BUG 6497: Fix calling of 'test' in configure. + BUG 6498: Add workaround for MS KB932762. + BUG 6499: Fix building of pam_smbpass. + BUG 6509: Use gid (not uid) cache in fetch_gid_from_cache(). + BUG 6512: Fix support for enumerating user forms. + BUG 6514: Improve error message in 'net' when smb.conf is not available. + BUG 6520: Fix time stamps when "unix extensions = yes". + BUG 6521: Fix building tevent_ntstatus without config.h. + BUG 6526: Fix notifies in the share root directory. + BUG 6531: Fix pid file name.- Package /etc/samba/smbpasswd as %ghost on post-11.1 systems.- Fix net ads leave; (bnc#511695).- Supplement pam-32bit/pam-64bit in baselibs.conf (bnc#354164). - Supplement glibc-32bit/glibc-64bit in baselibs.conf (bnc#354164).- Update to 3.2.13, 3.3.6. + In Samba 3.2.0 to 3.2.12 (inclusive), the smbclient commands dealing with file names treat user input as a format string to asprintf. With a maliciously crafted file name smbclient can be made to execute code triggered by the server; CVE-2009-1886; (bnc#513360); (bso#6478).- Update to 3.0.35. + In Samba 3.0.31 to 3.3.5 (inclusive), an uninitialized read of a data value can potentially affect access control when "dos filemode" is set to "yes"; CVE-2009-1888; (bnc#515479).- Uninitialized read of a data value; CVE-2009-1888 (bnc#515479).- Update to 3.4.0rc1. + BUG 4699: Remove pidfile on clean shutdown. + BUG 5456: Fix "net ads testjoin". + BUG 6081: Make it possible to change machine account sids. + BUG 6253: Use correct value for password expiry calculation in pam_winbind. + BUG 6297: Owner of sticky directory cannot delete files created by others. + BUG 6305: Correctly prompt for a password when a username was given. + BUG 6328: Add support for multiple rights to "net sam rights grant/revoke". + BUG 6333: Consolidate create/delete account paths in pdbedit. + BUG 6449: 'net rap user add' crashes without -C option. + BUG 6451: net/libnetapi user rename using wrong access bits. + BUG 6458: Fix uninitialized variable in local_password_change(). + BUG 6465: Fix enumeration of empty aliases. + BUG 6476: Fix smbd-zombies in memory when using [x]inetd. + BUG 6487: Add missing DFS call in trans2 mkdir call. + BUG 6488: acl_group_override() call in posix acls references an uninitialized variable. + Improve pam_winbind documentation. - Install a vendor copy of samba-common.dhcp as dhcpcd-hook-samba-functions.- Samba 3.2.0 - 3.2.12 smbclient commands dealing with file names treat user input as a format string to asprintf; CVE-2009-1886; (bnc#513360).- Fix a bad memleak in vfs_full_audit; (bnc#510035).- Update to 3.3.5. + Fix SAMR and LSA checks (bug #6089, #6289) + Fix posix acls when setting an ACL without explicit ACE for the owner (bug #2346). + Fix joining of Win7 into Samba domain (bug #6099). + Fix joining of Win2000 SP4 clients (bug #6301). + BUG 2346: Fix posix acls when setting an ACL without explicit ACE for the owner. + BUG 5832: Fix build on RHEL when ccache is not available. + BUG 5853: Add keyutils-devel to build requires to fix build on RHEL. + BUG 5897: Fix shutdown script example in the smb.conf manpage. + BUG 6089: Revert the extra SAMR and LSA checks. + BUG 6099: Fix joining of Win7 into Samba domain. + BUG 6157: Fix handling of multi-value attribute "uid". + BUG 6289: Revert the extra SAMR and LSA checks. + BUG 6297: Owner of sticky directory cannot delete files created by others. + BUG 6301: Fix joining of Win2000 SP4 clients. + BUG 6309: Support remote unjoining of Windows 2003 or greater. + BUG 6315: smbd crashes doing vfs_full_audit on IPC$ close event. + BUG 6320: Handle registry config source in file_list. + BUG 6330: Fix DFS on AIX. + BUG 6336: Fix 'net groupmap set' segfault. + BUG 6361: Make --rcfile work in smbget. + BUG 6365: Re-Add the "dropbox" functionality with -wx rights on a directory. + BUG 6372: Fix usermanager only displaying 1024 groups and aliases. + BUG 6382: Fix case insensitive access to DFS links. + BUG 6415: Filter out of range mappings in default idmap config in idmap_tdb. + BUG 6416: Filter out of range mappings in default idmap config in idmap_tdb2. + BUG 6417: Filter out of range mappings in default idmap config in idmap_ldap. + BUG 6441: Fix the compile with --enable-dnssd. + BUG 6449: 'net rap user add' crashes without -C option. + BUG 6465: Fix enumeration of empty aliases (ldb backend). + Prevent infinite include nesting. + Mark registry shares without path unavailable. + Also handle DirX return codes. + Fix Coverity ID 897. + Do not crash in ctdbd_traverse if ctdbd is not around. + Fix a race condition in winbind leading to a panic. + Some man pam_winbind improvements. + Zero an uninitialized array.- Update to 3.2.12. + Fix SAMR and LSA checks (bug #6089, #6289) + Fix posix acls when setting an ACL without explicit ACE for the owner (bug #2346). + Fix "force user" (bug #6291). + Fix Winbind crash (bug #6279). + Fix joining of Win7 into Samba domain (bug #6099). + BUG 2346: Fix posix acls when setting an ACL without explicit ACE for the owner. + BUG 5798: CFLAGS info lost in configure. + BUG 5832: Fix build on RHEL when ccache is not available. + BUG 5835: Add keyutils-devel to build requires. + BUG 5945: Fix out of memory error with Winbind idmap. + BUG 6089: Revert the extra SAMR and LSA checks. + BUG 6099: Fix joining of Win7 into Samba domain. + BUG 6279: Fix Winbind crash. + BUG 6289: Revert the extra SAMR and LSA checks. + BUG 6291: Fix "force user". + BUG 6301: Fix samr_ConnectVersion enum which is 32bit not 16bit. + BUG 6372: Fix usermanager only displaying 1024 groups and aliases. + BUG 6386: Groupdb mapping fix. + BUG 6382: Fix case insensitive access to DFS links. + BUG 6465: Fix enumeration of empty aliases (ldb backend). + Prevent creation of keys containing the '/' character. + Fix bug in processing of open modes in POSIX open. + Protect netlogon_creds_server_step() against NULL creds. + Also handle DirX return codes. + Fix a race condition in winbind leading to a panic. + Fix a crash bug if we timeout in net rpc trustdom list. + Fix profile acls in some corner cases.- Default with passdb backend to smbpasswd for SUSE products older than 11.2.- Explicitly use 'tdbsam' as passdb backend in the default smb.conf file.- Update to 3.4.0pre2. + The default passdb backend has been changed to 'tdbsam'! + Samba4 and Samba3 sources are included in the tarball. + Changed the way smbd handles untrusted domain names given during user authentication. + Various fixes including printer change notificiation for Samba spoolss print servers. + The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog and spoolss) were replaced by autogenerated code based on PIDL. + Samba3 and Samba4 do now share a common tevent library. + The code has been cleaned up and the major basic interfaces are shared with Samba4 now. + An asynchronous API has been added. + Made parameter syntax of the net command more consistent. + BUG 2346: Fix posix ACLs when setting an ACL without explicit ACE for the owner. + BUG 4271: testparm should not print includes. + BUG 4831: Don't call openlog() or closelog() from pam_smbpass. + BUG 5681: Do not limit the number of network interfaces. + BUG 5859: Fix renaming of samr objects failed due to samr setuserinfo access checks. + BUG 6099: Fix NETLOGON credential chain. + BUG 6136: New AFS syscall conventions. + BUG 6157: Fix handling of multi-value attribute "uid". + BUG 6253: Use correct value for password expiry calculation. + BUG 6291: Fix 'force user'. + BUG 6292: Update config.guess from gnu.org. + BUG 6302: Give the VFS a chance to read from 0-byte files. + BUG 6309: Support remote unjoining of Windows 2003 or greater. + BUG 6313: ldapsam_update_sam_account() crashes while doing talloc_free on malloced memory. + BUG 6315: Fix smbd crashes when doing vfs_full_audit on IPC$ close event. + BUG 6320: Handle registry config source in file_list. + BUG 6330: Fix DFS on AIX. + BUG 6336: Fix segfault in 'net groupmap set'. + BUG 6340: Don't segfault when cleartext trustdom pwd could not be retrieved. + BUG 6357: Use Samba default command line arguments in 'net'. + BUG 6359: smbclient -L does not list workgroup for hosts with both IPv4 and IPv6 addresses + BUG 6361: Make --rcfile work in smbget. + BUG 6371: Unsuccessful 'net conf setparm' leaves empty share. + BUG 6372: usermanager only displaying 1024 groups and aliases. + BUG 6387: Fix a crash bug in idmap_ldap_unixids_to_sids. + BUG 6415: Filter out of range mappings in default idmap config (idmap_tdb). + BUG 6416: Filter out of range mappings in default idmap config (idmap_tdb2). + BUG 6417: Filter out of range mappings in default idmap config (idmap_ldap). + Change the way smbd handles untrusted domain names given during user authentication. + Replace the hand-marshalled DCE/RPC services ntsvcs, svcctl, eventlog and spoolss by autogenerated code based on PIDL. + Fix several printing issues and improve support for printer change notificiations. + Add 'net eventlog'. + Add asynchronous API. + Make Samba3 and Samba4 share a tevent library. + Add two new parameters to control how we verify kerberos tickets. + Add 'net rpc service' subcommands 'create' and 'delete'. + Fix the core of the SAMR access functions. + Fix SAMR server for winbindd access. + Add dbwrap_tool - a tdb tool that is CTDB-aware. + Hide "config backend" from swat. + Fix linking with --disable-shared-libs. + Fix issue with missing entries when enumerating directories. + Map NULL domains to our global sam name. + Fix driver upload for Xerox 4110 PS printer driver. + Add "net dom renamecomputer" to rename machines in a domain. + Inspect the correct computername string before enabling/disabling the change button in netdomjoin-gui. + Fix join prompt dialog test in netdomjoin-gui. + Only gray out labels when not root and not connecting to remote machines (netdomjoin-gui). + Allow to switch between workgroups/domains with the same name (netdomjoin-gui). + Add NetShutdownInit and NetShutdownAbort. + Fix samr access checks. + Add a security model to LSA. + Also handle DirX return codes. + Do not crash in ctdbd_traverse if ctdbd is not around. + Fix Coverity ID 897. + Fix a race condition in vfs_aio_fork with gpfs share modes. + Fix bug disclosed by lock8 torture test. + Fix a race condition in winbind leading to a panic. + Detect tight loop in tdb_find(). + Fix chained sesssetupAndX/tconn messages. + Fix strict locking with chained reads. + Fix two bugs in sendfile. + Fix memory leak. + Fix file descriptor leak. + Fallback to the legacy sid_to_(uid|gid) instead of returning NULL. + Always allocate memory in dptr_ReadDirName. + Fix 'net' crash during domain join. + Zero an uninitialized array. + Allow child processes to exit gracefully if we are out of fds.- Enable cifs.upcall on versions newer than SUSE 10.0.- Add BuildRequires to keyutils-devel.- Remove redundant Requires to keyutils-libs for cifs-mount.- Detect tight loop in tdb_find(); (bnc#450974).- Fix lp printing with kerberos; (bnc#476913).- Add BuildRequires to ctdb-devel for systems newer than SUSE 10.0 and all other build targets.- Update to 3.4.0pre1. + Samba4 and Samba3 sources are included in the tarball + Changed the way smbd handles untrusted domain names given during user authentication. + Various fixes including printer change notificiation for Samba spoolss print servers. + The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog and spoolss) were replaced by autogenerated code based on PIDL. + Samba3 and Samba4 do now share a common tevent library. + The code has been cleaned up and the major basic interfaces are shared with Samba4 now. + An asynchronous API has been added. + Change the way smbd handles untrusted domain names given during user authentication. + Replace the hand-marshalled DCE/RPC services ntsvcs, svcctl, eventlog and spoolss by autogenerated code based on PIDL. + Fix several printing issues and improve support for printer change notificiations. + Add 'net eventlog'. + Add asynchronous API. + Make Samba3 and Samba4 share a tevent library. + Add two new parameters to control how we verify kerberos tickets. + Add 'net rpc service' subcommands 'create' and 'delete'. + Make merged build possible. + Move common libraries to the shared lib/ directory.- Update to 3.3.4. + Fix domain logins for WinXP clients pre SP3 (bug #6263). + Fix samr_OpenDomain access checks (bug #6089). + Fix usrmgr.exe creating a user (bug #6243). + BUG 6089: Fix samr_OpenDomain access checks. + BUG 6254: Fix IPv6 PUT/GET errors to an SMB server (3.3) with "msdfs root" set to "yes". + BUG 6279: Fix Winbind crash. + BUG 5329: Add "net rpc service delete/create". + BUG 6238: Make sure wbcLogoffUserParams are properly initialized before freed. + BUG 6263: Fix domain logins for WinXP clients pre SP3. + BUG 6286: Call init function for builtin idmap modules before probing for them as shared modules. + BUG 6243: Fix usrmgr.exe creating a user. + net conf: Save share name as given, not as lower case only. + Prevent creation of registry keys containing the '/' character. + Allow pdbedit to change a user rid/sid. + When doing a cli_ulogoff don't invalidate the cnum, invalidate the vuid. + Don't access a freed structure when logging off and re-using a vuid. + Try to to fix password_expired flag handling. + Make sure to grey out change fields in the netdomjoin-gui when not running as root. + Don't look up local user for remote changes, even when root. + Use procid_str in debug messages for better cluster-debuggability. + Use cluster-aware procid_is_me instead of comparing pids. + Fix smbd crash for close_on_completion. + Fix a memleak in an unlikely error path in change_notify_create(). + Do not use the file system GET_REAL_FILENAME for mangled names. + Fix a crash bug if we timeout in net rpc trustdom list. + Add '--request-timeout' option to net. + In net_conf_import, start a transaction when importing a single share. + Fix writing of roaming profiles with "profile acls" set to "yes".- Update to 3.2.11. + Fix domain logins for WinXP clients pre SP3 (bug #6263). + Fix samr_OpenDomain access checks (bug #6089). + Fix smbd crash for close_on_completion. + BUG 6089: Fix samr_OpenDomain access checks. + BUG 6205: Correct sample smb.conf share configuration. + BUG 6254: Fix IPv6 PUT/GET errors to an SMB server (3.3) with "msdfs root" set to "yes". + BUG 6263: Fix domain logins for WinXP clients pre SP3. + Allow pdbedit to change a user rid/sid. + When doing a cli_ulogoff don't invalidate the cnum, invalidate the vuid. + Fix resume command typo for "printing = vlp". + Fix smbd crash for close_on_completion. + Fix a memleak in an unlikely error path in change_notify_create(). + Don't look up local user for remote changes, even when root.- Don't lookup local user for remote password changes; (bnc#493507).- Update to 3.3.3. + Migrating from 3.0.x to 3.3.x can fail to update passdb.tdb correctly (bug #6195). + Fix serving of files with colons to CIFS/VFS client (bug #6196). + Fix "map readonly" (bug #6186). + BUG 6195: Don't let smbd child processes panic. + Add backend_requires_messaging() method to libsmbconf. + Add methods is_writeable() and wrapper smbconf_is_writeable() to libsmbconf. + Fall back to file backend when no valid backend was found. + Fix a memleak in dbwrap_rbt. + Provide transaction_start|commit|cancel fns for the registry tdb. + Speed up "net conf drop". + Speed up "net conf import". + Add transactions to the libsmbconf API. + Reduce memory usage of "net conf import". + Registry cleanup. + Fix handling of SAMBA_VERSION_VENDOR_PATCH. + Fix build of pam_winbind.so with static linking. + Tidy up some convert_string_internal error cases. + BUG 6224: nmbd waits 5 minutes at startup before checking if it needs to run elections. + Allow DFS client paths to work when POSIX pathnames have been selected. + Try and fix the build farm RAW-STREAMS errors. + Ensure files starting with multiple dots are hidden. + BUG 6102: NetQueryDisplayInformation could return wrong information. + BUG 6193: Avoid messing with sync_context in libnet_samsync_delta(). + Fix notify_printer_status_byname. + Fix Coverity IDs 722, 762, 774, 775, 776. + Fix build on old Heimdal based systems. + Fix compile warning. + Use parentheses in if condition to make negation clear. + Add dirsort module. + BUG 6147: Fix detection of the GNU ld version. + BUG 6097: Fix smbd segfault. + BUG 6130: Don't crash in winbindd_rpc lookup_groupmem() on unmapped members. + BUG 6139: Add missing whitespace in mount.cifs error message. + Fix a malloc/talloc mismatch when cli_initialise() fails. + Fix a valgrind error. + Speed up "net conf list". + Add sorted subkey cache. + Use StrCaseCmp in the dirsort module. + Document the dirsort module. + Disable dns_sd by default. + Add avahi detection to configure. + Add event avahi binding. + Use avahi to register _smb._tcp in smbd. + Fix two memleaks in the encryption code. + Fix a scary "fill_share_mode_lock failed" message. + BUG 6228: Fix SMBC_open_ctx failure due to path resolve failure doesn't set errno. + Don't use reserved words in smbconftort. + Fix smb signing for fragmented trans/trans2/nttrans requests. + Parse_packet can return NULL which is then dereferenced in match_mailslot_name. + Format the header check for netinet/ip.h more nicely. + Missing break in conversion function prevents tdb password database update.- Update to 3.2.10. + BUG #6195: Don't let smbd child processes panic.- BUG 6195: Fix crash on passdb conversion.- Update to 3.2.9. + BUG 5920: The length of the memcpy was calculated wrong. + BUG 6097: Fix smbd segfault. + BUG 6098: Fix ads_find_dc() with "security = domain" when the DNS server is invalid. + BUG 6099: Samba returns incurrate capabilities list. + BUG 6100: Implement _netr_LogonGetCapabilities() with NT_STATUS_NOT_IMPLEMENTED. + BUG 6102: NetQueryDisplayInformation could return wrong information. + BUG 6130: Fix crash in winbindd_rpc lookup_groupmem() on unmapped members. + BUG 6133: Cannot delete non-ACL files on NFSv4 ACL filesystem. + BUG 6161: smbclient corrupts source path in tar mode. + BUG 6193: Avoid messing with sync_context in fetch_database_to_ldif(). + BUG 6196: Unable to serve files with colons to Linux CIFS/VFS client. + BUG 6224: nmbd waits 5 minutes before checking to run elections. + BUG 6228: Fix SMBC_open_ctx failure when path failure doesn't set errno. + Numerous Coverity fixes + Fix double free caused by incorrect talloc_steal usage. + Backport delete semantics of alternate data streams on a file truncate. + Allow set attributes on a stream fnum to redirect to the base filename. + Fix use of streams modules with CIFSFS client. + Fix more POSIX path lstat calls. + Allow DFS client paths to work with POSIX pathnames. + Ensure files starting with multiple dots are hidden. + Fix guest auth when Winbind is running. + Fix memleak in get_remote_printer_publishing_data(). + cifs mount fix for handling -V parameter. + Fix guest mounts. + Clean-up entries in /etc/mtab after unmount. + Add fakemount (-f) and nomtab (-n) flags to mount.cifs. + Enable total anonymization in vfs_smb_traffic_analyzer. + Don't try and delete a default ACL from a file. + Fix remotely adding a share via MMC. + Fix resume handle for _samr_EnumDomainGroups. + Fix a buffer handling bug when adding lots of registry keys. + Fix a O(n^2) algorithm in regdb_fetch_keys(). + Fix a valgrind error / segfault in dns_register_smbd(). + Don't log NDR_PRINT_DEBUG at level 0, this always ends up in syslog. + Fix a malloc/talloc mismatch when cli_initialise() fails. + Fix two memleaks in the encryption code. + Fix "fill_share_mode_lock failed" message. + Add S-1-22-X-Y sids to the local token. + Fix smb signing for fragmented trans/trans2/nttrans requests. + Don't miss an absolute pathname as a kerberos keytab path. + Have nmbd check all available interfaces for WINS before failing. + Initialize the id_map status in idmap_ldap to avoid surprise.- Obsolete change from 2008-03-05 by removing the needless examples cleanup.- Update to 3.3.2. + Fix "force group" (bug #6155). + Fix saving of files on Samba share using MS Office 2007 (bug #6160). + Fix guest authentication in setups with "security = share" and "guest ok = yes" when Winbind is running. + Fix corruptions of source path in tar mode of smbclient (bug #6161). + BUG 6082: Fix renaming and deleting of directories using Windows clients. + BUG 6154: Make ZFS honor admin users. + BUG 6155: Fix "force group". + BUG 6160: Fix saving of files on Samba share using MS Office 2007. + BUG 6161: Fix corruptions of source path in tar mode of smbclient. + Fix some NetBSD warnings. + Fix bug in processing of open modes in POSIX open. + Fix use of streams modules with CIFSFS client. + Ensure ACL modules work with POSIX paths. + Use fsp->posix_open in preference if we have it. + Fix more POSIX path lstat calls. + Fix a bug in message handling for the change notify code. + Fix guest authentication in setups with "security = share" and "guest ok = yes" when Winbind is running. + BUG 4640: Fix guest mounts in mount.cifs. + Fix displaying the version string properly when no other parameters passed in in mount.cifs. + Prefer gssapi header files from subdirectory. + BUG 6176: winbindd -n should disable the winbind idmap cache. + Add a vfs_preopen module to hide fs latencies. + Don't log NDR_PRINT_DEBUG at level 0, this always ends up in syslog. + Fix a valgrind error / segfault in dns_register_smbd(). + Fix build on SLES8. + Decremented by 1 for ntcancel requests. + Fix creation of core files. + Fix first mapping of uids/gids in Winbind. + Initialize the id_map status in idmap_ldap to avoid surprise. + Fix initialization of idmap status.- Only call '%find_lang pam_winbind' in the samba spec file, not samba-doc.- Ignore return value from subshell to fix build./sbin/ldconfig/sbin/ldconfigcloud101 15034198424.6.7+git.38.90b2cdb4f22-3.14.6.7+git.38.90b2cdb4f22-3.1libsamba-errors.so.1/usr/lib64/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -gobs://build.opensuse.org/openSUSE:Maintenance:7167/openSUSE_Leap_42.3_Update/43a98e90f110320a7f757105cb4cd3bb-samba.openSUSE_Leap_42.3_Updatecpiolzma5x86_64-suse-linuxELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=4e26fd0666974cb951748cfac18aee26412c07b3, strippedPPRRRRRО(?@] crv9uii R$\0sfPBON5qBL?L"{NSshSЌ!(L/L &RM4+M φRa $u!i{9HJ- t8691$k5xC$,V\\r~ m$L;q߯:bu{NԤCkL O/LybU^tV(t ͸W >ilCc3elKc0WFu7vOzyl9/Jϱ~S5e4T7(.a? >37xB9aA"dn=3_?{7;P>ĂZv +>3}m^3&ҩ]Մ_-:k") )oҭ)2,(~ErG~¨ʃf `iU oy?hT^ &F,_^T=݂ۮY+ͦt6 {C Db{ -<}z@$﹡#Qn\S@WtZX&yJeqS;J^j7$}}h6Lj ]Q C۽ NnB4@BA%wK" gcHU$zƁתXv7| \QSN4xR\44&P^z<5\\sēAr40׋X2|||:?J]#5ݬ ڣ aAt0\D.͉HI I,\ł Ui@C*AlF<^hIGpDKsK1fW Yp0zq&w0a=30wIL ᾸM7:p&&ݯAXC nYkS#d?Go[AaiqFJHzwJi1KؿC+I`lcc7sta_:6h.ADuF`o/V0)f8 au?-M'"QFOF)wTw@E|3Q|TEm,Rm/LP[qăQi!)UAKPNu[QTZ(R8\^0\>ɼ)Ȃt1d[YN>CҰ4G hnH-xq?ȊXw7Dh\A|,'#ȅ.әH2;XP&@qz[ ~}a_Pr]I](/>3<*q,g v-]k䭣?v᳈eyS|?Y˷[94ɺLD2$?Kcjq]?_jnO\)"IrAP ¡1 MʙYa\‚tymq   (şAc פ/?qRP<~7YcPҐ/<ܜzOMvˡ)+VɉėRW"ng ;\:Vձc4!COD@F㻟8nW!!'">PԠj ! t؃!ͺI{X<84 .F )"Q1d؇Igaw= A[I`Hр M`r̕Ë {3i Kw ie1’-I 8(QVK#G+H{^;Ⓘ`Vtp1)2Voo񪢼4s3~ҍ?*7iO&!\yF$䨾,@,M90Ŭ#1RtjƋvx"-WKr[: ߪ:*,|kZBrpar_B4_,=75 *土X6ES g\5C7/I=Ei:*bmpD Т!/~͡M~*yARvH'f^=⯂5|8DΓUO*Q#>|5<"B55'l2   )p9C/7AE`ùg M7#"pHx^]s) +PZMT2$o|dA̴DUdQмsgB#-%hQcզKQ1iШi55 Ha ||0~?sEHuVZޙ))M&y2[+.R^;F@qgE-(?gCfפ0ݰmҁgKt29b8VFL҄ev٤9/oiGzWt#lutDHB.Q, ԖY!~5Po7OQ:ysE'Mo׹ ((єh 0)dK="놚 _9TNŏ^%'8t {$ RkACHՊ@VʸV ?/GEEi?=^Q!R< gao x"qhJ=铹+%W"-]%w*.S:W_`g8k_=v>Odзx$E s.U5d3TuvX4=^_¼cͱV)Z#P{lXIq YY'lrxS +R0*\5ė0s-ؤk˱cj%obi8@u@vrz3m4TrT62 NA[YKg~6x8YMUԵ?qAZ̠a&1+Y3NT/?XCt^[鎆-)|1^15αD;Ǽ -г.VNXKUKxAJ3!~{\Bo IEn\>rA9H]m϶{8KR[>修imVNÞ3wTe,N2Ha:~JTԫM-f46lH!MҐ$K[8v$IFXQ`}N;4xQZ;IKęcHy<~z)gt_w{'4M5'C ;Q\O^pVȘ+#}xii=I=dPpLV0hXHU8pZa@s?z1_B9b-6Wl{܇Q xafSfGC`WTD[ytusdhKA9DYm-GKx| hc3]/JR__T2Dyw8DZ#-卖+Ȏleu:1k70ycRК+cJp0Aܧ\pyʁRi9WN9  v뿞Z{<dNE>v^k"H8ڦKAf3J ӴIo8X wܟI~^j*l}eVx@N[M[U9# $&9k>hW/GhtY؎ <[rTSw6Z?i%:p=dW !V=%>{˥)V珊?. AOܥVPLHr|RyhnzB.yIX.0aIP(De@ӵN{>cwLV x*NX'CMKyJ ޢ+ďTiSQY *.ΑntԱ1g !?yVߞ;|l(kvZV+ F:u2c[D;EuimalW` #QDM8Yą&Dl2|Vxzd+ppyu;BFo@'(L_!mN/busfP?ޡqSph.3rRE6v~[ mMsw&?]WQS>S\?UN+~nQۗZCKK*;PCBEs$5 8s i,P'8Qɡݐ7*6PP# #m_.-C-u $4iV/.XM8Ր7t#kZ_h`(ۯ̗bs/ 0jAn鞑8% C0Nm;vJ R%kvdD_ .`4H˄3LoUx)¸BGl: ZB ՖwvE9rћkz0F3QYah2oNOyu}<"H$%Zv0qL㹸V-#W; ֮ _7j)@ pA+pѠ|i)G8{DEya)C[Yk.J *^7q>Je]_W$}~7|\fȢ4BF0 ӭ(zծF3'7< %H\vY$ HGaa2(*V޾gP[dzʡfMF3IӤ<Y @5cyxrv}inaze0zDL/w`ngf+IȰWf'̰vtśfcoqXb&դH޷3r]j唯ms'Fy.$Q-h|`=]ð?W4/g'UZmFt th\*:a4|K3SA} Gԇ2ENntʆeoIxI uV +(8oא9#VAw;#Gb8雔FZ'c'(f1..utٍto>05q\9O++d1VD4`\UN0]!f?q,! K.kN3ȦPTzNJ@ZBqc0a]5A LE"Ә\TrUwUf0*d3TH /,xVm-ڏ"qN5MYz1?פ&hQēH2oNO _=ahxT5VF2g]T+32=yZ~CdBwH5D'ο`g89ihȃl&T<]*ho\>ÑW)mvGXVVhp:hoZAS.ͳ䛅 C\y )LRJU At|JG 9H+k`}*ea榙}^+D HzK< Flp >Up7ĪЊfj+ts V[rD>[VDZ|5ZV ;S&IR]!5:%vgD \đYsw?FqΙa]t{k!VM:͇ ںydSbVlgpl[(s4 Xq6RKBu|PI.ķ Zp%Eٻ;ҙAM.峠{$OSGeMmԁ {fmuLwöFDSP$#Wpg=lxqkE4~aߤħl#f!`~#:jwD|S5Ϝ~uĠŔdC!UXx>ܞ>v5/SG^>JC&gWs(Q?Σ լ7iM]+kS/W"n*Vbt~" >a.eoq(%!Q`2NKtO#SOH #e+LtIȹ$R )31I _%zKl vwA؋A_^{:_N]sy ԣL,DR$Q58d&PZRw³ԬI(PMPE;oR `.G̜bbRX,iL5xQkZ벰P$?dRJ x@sH& q=h(5NcAZ7i[ .ɳ!pq 4JeHW\~tS]:Eɤ(+@-/D\)4HP!\j%, z}afR)I{c `_r) |_n Cнқ 0?][xq-{4TG7MG4bwkr |\V%mx@ïQɹNwyx*8pS睡Z6D1{RsԴڱ2xa9~Q6GР'خQ8sчs:n4 l)3٧T7ZfIRH?#ȟn` { z,ߠk3I[~.YDL%w٧˧5DeĈc+UhhZt K  L8D-+5@ j{(}?'Yv^Q SɤՓi2oQU w:^wt4QycN$ Pi/ռC8wsIGbn񼷃Du߮&v`ՌdAʹYɣ7𳫹&RR> p"ޜ$^-: |P%# S܍ SOxգsUD "sNeyk]v$!QintHیDWR- 8vEM|44_l)IJq~9>ڃ՝Yǻ4-6JyP9VcKcؑLLy?_(~;Xc/R^ l^rCk4f ;%bX3pڤv6\Ⳟ+HI8˪W8ИS ^G 5Л w]L6"s\>RX$e=S . StA&+WQcy !gZC<&^;WE@+5舎<^5w[ߜV&a=wMٷ_w:ɇa|%cv_[ް?9^NP"?k'jIb-C'|,O,l &h00AV/qtғ-5mw~)Swj|++X}# g?E掇JDnOrz[MH7sd{qב@IڏEskyw=`g_# ]?p[ mwYB=d?eGtvZ`Ķw8i8zZ2y =y!.\ Q@/XcI[|ozGaXB Hcq 1͘V9`ϕDMy_?X[^>8 k|TΠ/U<9@8j i^ܣ\PS:2E*z|&@TkXyE-Wɹp5ϣ+ ڎ*5]g&a$'xXc-0osv De0 VF`{  "BC e K\Y n]gvJtT &̘**+,.ڥAƏ~ubt$~* FYo(\zuF 7m,o5~hx_F+|}f~0|0MPuj-bc Ց 6؀PzKS mCnB#U:9OyدX0?Nwҷ: NQ#>@ gLֈip|K8[rcT_~pdeN/WzBj@tUF']`NtWvoĸmd"9#,4ØɎ7pmy41Q1}?ȥc1rE5qCTȦ4Xjf6G6{\f\iAQcRmh@"[@%xWoAqtb32A{]^36a5$TƳDt-ИT7Pw|-ėr۫ vƸ1^*ix\F*K="u [?Y2sT 7O6%ѕ;({QS1(8ryYR5(ysfg ӵl[ie_גisDT0["UUd#c*וp"{9>C7&KGʎ5p/:sVܗ4IBsO-Z.JYY{2Mm]sH|;>}V[0TҲ*C;4I8|Ao(sYIvxKiIYݒ7cX\Dcv, j8%;hgjWu[mZy?م/C`*T&4,ec{@]ʲ>x1/n  ]NU[?I~tU礻SoZB6Ib jHF%%Oh*W 9I5(uft.Q_ˋ_..hgwR} PňȯAT@kp >;7q"2?\yU)ף/kX$Vm; xe|S\׳OPu#˖ *+L[nn[86稇p"[@Rӈᄵmoؖ"BV#8\JU,Wkj3#^3Z}'ۤ3FQWoO{]okK'pޫQJ,a@͆pƹJIp^▿mݧ]Mc]2ҧ=) ݴf3dWqa˫r;i֧ >PR!PzBgyVU(T_twX N¡a6iԡGqE>acm{kcӜ`vjGu*EnZ9ޙOr{JJ`7#L]'.ccK@UkXsPrpQwAIncA>]X@H.Zd9>7^(,H23n5Xvq:4h7p!Kp׉Zo ۙ7IL$WY7)I5rfwԈzITH,6L!IPwfܸBX=sʂ|6 x8UQXhBk<8ǟY/b§KrRh6m|ː$dG<r?6ЗaToێu ɒI6WJ{Wk/\v (,"^sȃpݨJt/W7V"''{}yry17w杜M&?%o}ӭnsT8:1"V$_]ZseB2!eԉ~f"uBJd2ci*ոf{dCn ͯ !@h>>QN)k{9ĕ}yǠ󊤃 XN:`/J$N~5eqIBnKF汓 3K3vqkczdqr+`b5q`= wo-98!ch9h/W[GeL;cAD'~d 5G`A>hWLꡉX`* @O)~Z2cbKB}+*T Or&OnI/ޜH"7Q5qLyiB+le^K0۷qUoa` Z&a )/,Fcm+B wJr-$|h IWEijAOJXf-p 5:9C l4ZYK?^x<ˡPF߄/leMFThn$Jt޴,U6Eͳ3-;?P43}=!@ǧwૣ-&٣X~9^_g1cZO +I\(0k`Q SVNӆ`^@%V OwA1+[x:=+Q}#{E#Zu hC7 q ; - 9LL&鈭ncjDYmn߬$Øɩ\ѵf2Ĵ~.^o1Wm͖GRc@qb(58UP| ~:(i9`3O,mѰȽ+1Zy@>D S&t6UrҸ{Tf[Q G3Dؘ{qlO[n/醻3T\JOE6'n̋.5rԷu8[ʊɻN9@-oIg0u ǻߚRo֩.W_AtSf_ّ 28 `ŰV-;l%G߸ kOcĕ^ 6ΟAIl+'z]/^mq$315ŦbE2:Lƻӌ5PNj^UQGp#˺BL O&2Y| S$9yqhv & "ߜHYwܗKM%_qbFq6ɘ?;_$#Ŵj=Vv#eiO7TGe~z[ v9-IS0S!sr9IF2*2u)P$u8 j:-/s VaD8[X\ﳪۢDZGfݳ }#mG;||__et|b;1~c/!xjypM ;뼷bj`t`N25|/MUȌNE(`(gsܑ1vƹhtD*e%o0X[[e40T77P<"F4{]By#&+L`HvsA/EMQKiB#:Z+/á ;ƫ3bBhwmp%v%`TzigUfiV{E9$K 4h!2*Oat"?zwi;Oޖԝ΃Fun.U|s+ב.갰kn/>] w){Q5HPw 0Q,N ēmDp˲d>T f_y"Ҡy ΨB"B~X|.လxrRKHg ~xS~Mo47hUUO~f2njN浮f]wx3=ʼn =@ Iy(svjŲN|7]Gr_~oT:.4싁: |3j x񖗓L&v2@0eZ-oO_~lg`/ߌjYc=!wƵz tfbxFZ:Eg7odK T?=.Fڙh/jװ 7;?r{(xL0=Nh\MZÅe D>$:$> '屑ɄB("R7h) 4ͦ/)\4$Eĝl,m;FW9'CV{\8mV#}R2*)gQ/7rIjo](}O C>`_7K7j+sP'{kItv#)% 32sЦ]m]6$4ZuP?hwZA'f;6epMyb2aTF6d"s7bVXwkEk}bz,|6p"릝?n{S,%xuh(a٫Z.ŝf1nT%@߮N>v5ڮ_~" ~[{Qн^&F&xŧAIQAtȝv%ϤŮ}%}iU t>{D˒E @ 6{ w (gDd3)?vd"fþ\A}(z{j,89H|9=Tʌ!sMÛacן!Zg7R8v1P+Thש]JX~b_sl.YRePiqo_w!B., F3!yG`#T zv@,Ĭ˶_WqzytS5b [ \,jYKA=I A8Jz y5j;99 \j[}{ex<ÛJ*4{8=XD~8Ie>:+9Tr`jPvfhkkmN?fWyI/#m텝+rWV@AlGRJY\R4D2^Iz,*FMU!A]zަt}SA#fލ2Rj;|)GXf"b29\s4CKa&bC!4I'^:zQS@w3}7bWaC29bEiPiܢxnrSWX76 pC|/N`ZNrejI=dprn9*GQ鋤p⦕׉VNOC1Ϙ !Z ;Ϳ^%g/\~n?30ྜZJ'|T㗒zs1 9^bVk0?S`h:CQqϙϰc m]C9\CyUzjMY0k5B֭p=!ʌxtA*cV%d|S*2X̫+lŢDMVY ijFې-a'Ea\ͷf@tR1+X]ߵTM)&ow`!1Wk̲OA6Gf M#tKĦhS^(w|.)>ee _KWF)獨B=.;fdؗt[y=Vdk M(Puگ4O C멛@~^IXiwwluQ`EDnT;F@yOߠaV0H\vZ]nbg&ijYuzk0eb?.Ŷ9ke?gkTx3Hi蓀Av2ǨӴ]--br 0rU/Nkw2@& ]!UzWLx:)9v_]=+[|̑f PJշMϘ:mFϓ'kikꋹ0訢:S3.Vކ+QߡY0Gt\boryh-3mgsaFҝAt[8 f)!4uvoyZGPnGo2i< M`F_9!8ofX~- .FF6 #gx1ЃNK}aR5rGtF`ǵjDKB/[Hʹ yjw ǫoh͙`2:=8e7X fIEEJ:H}v7a1bPԧ(bh}"Ϯhs:_,B/ z^]&I_a)ƝH N~l\}<9rcӈ".ɾv_s@%,x2(uY n.Q{I7RkPbzaX*syƗ;jy'a7a.:L;11,)2ɤK~! ެȻN阯Kbbl)fЛilx13Ŕwۺ5 0RR)Y<|w'a7O. iנcnf8Y|ڐ#;JSYs $}!A]^j / !,U.hv 3[jHSf\FXZq.ROO >`O[\A ߵY>2ڒy+ՙol{b&ƃ5'2MSJL!v}( `k-@`yL+o V\,J^ZpMNeu 7n[u@VC閑F|+kŎ9`x>q9gRLnLLʄU fi\٭p~D[?/{F4`rfnK('Ex ZrѺzmiR4gޑYӦM -zLWOGOۥJtlhBRL\?ksH{TByW&d /z&O 7wM 64> KQe TI("PE -6ȖJjitbn%O~e =-0҇AhmnEVd..K;< vxб?xO 7]rn2ޤttۅRZ C(]Xe8L|>H6;wWZMa!1rEI4X0or2'ДE V|I &/Osȋ҆7S AiN Lqh7T:2z/z#r/$sYEj<̰ؗo9^ahF Ym1ԗ}%c%c+gְX,ψOh BE C9SD͊ ĉ@Y߄rc/bzL>_J_r/eᓺǖn/ok?k5B:(ZU 8>#J5'AqΈTd^r'9eKZx(Vx-x*.cY þoO YH>1gk椤rMb*N)%uӉ<`{5/+>ZMe.FF(Uܘ4|2*"'%Ԙk u}})!M)6IDl3B1/gu03+|w,76i`V`[~!".61IGhb(9HVoZ%|4xݰ @i$ϣ3HGNݬ,&BEH4CLbEZȝ׷<˺Z[z`st YfRհ#OkºL]Ȥ>a .j2)'% .Bg>8=u ꜟŮ!3V:FV@È:`>s*xT[KCLRs nO!+Lk{+THT lB 1DrM|{2gHs]ZMԖt/ WYMwY>o!uMh ˦ݚ9=E4A^|z٤I$mdk {w iAW*-C?q %[rIvfnV|eM[\w&`&8QlͻQ5|Bo%4έԕduO1vIr ~ʡ}x^SqJ juZ!>D3U>{Cۓ܉hCS#s!¿u1!@? >UI~D>$8C|YʒHeu\eLl)nwDuVK;d*:w(*%\FK#pm oEt8mqBoeC/mY٥)%4 $;%P9 1d2x޴2Acc)jl3eɛGsy~z:te%(w6=\@7x=T ~.=2/aCԼQqE % U +bH[Zx02#I0qH>{|35U e3} 4%-ZVLgK({PWMO}rp$! Ci{(I=&'6*^|NYZ7aIމZh_&Q?CM,|o3>ne/,߶u\DeQyɖfc5+X1նXIzmڕ!̥)[6k^Io r5%ҏi"!3N׮@@EȅL7,2#a3*tܖm]![viS֢f8lY1w"S0Om9p@J7B74D-8r/1y)` >Rxc}KTS큪Ƣʝ@_^/.qXP`8K8*,st{_0fRpkh D) Ϯ'؎x$M^aOZ%Y3)ldBhjqh3UǐPm_d}+R y&q`_u-ݶ˛ME@A:Iڽ] Dpd`N$b:78#@\KS] _1oiq^6uzIWf|RRQ^3E03\NG&f9ٙ{x~i2ڋ'k#%D*@0 Uu}U.|ef!U@kSK-lۚVr8D , :WӨ`|CE$Y?ve}T[N,ZMBTSG䴨ԎxBmCL7>$e4\#&| d+8Ą7 մ<{g>* `YKa; R"[dy.1@ғ.#͘Íd2ኋmXS-c~?JE L4߸P[sڝX|2q%Xwכkx^ߓGd6LMՇ̢R>+ȔӐ8F°o +;ш|?[SS2Z#Ҩs ZANNI"=A.Pm)M=j+m{;J~M/yc>t]3aZzm7֊&GyqNcޕv6Cmeaa=]#^M@^#Y~4;Tjl^IϪa5nxdt\9V@].jG{p~f5y$_?$BC5M`2#<{xiϏ0p,1>sٯ8²ހh5ą(e8DX`!Qq \>%/σc 8s1biBz0U"0˘́!oŎBC0Jt GY4: eF*gjVYr<dȒ$%@Tk|4kv+Q ܷ 箂o5Nm9yh ZBOS -mG`JIr1mܩφ =]dGJ3'wr cx?{"|@T2hC90,rBkQ8*}=0 BΊZ 4BJPq$+-cg*P 7Ec~b_༰ˠ>ܴJzdՠ*1˝.^!\#9l=>SIJ8n95469ޢCDNwӾO&ū-B?4|F^1Hmixr&XXF8`nf0|1i N$7J4$zTodRF 1V}޹FI0f]Es˩Ha/ɴYb3EPeYGi@q b, F+5L%{̏]aiify-wթ)ev%I4xDۋ,ͷ!4W,ZX0V U[D4qCpL_H°Diqj\JNj-&"&oC8Γ3X*<ڃCoz"GS x?l=P fꅙm{Ov_GUz4^pCOnnW|xuZOJ^md/*@3Ԝ8"HcZ|\yNTƏrtr&bnq[[|6,+#Khw4H^VC,¡&b0@bPgU9MN%D>&xY8J+WO=ܡ`]梷--tZJPUTq]&k|!EG,:ǹn3tXEf)?^5B\-v)WW.RuǷ$HB6k%Q-{l O4/BƄr~: g??1XȺpUy#+9P@ r |fN*:)&\IX* rƎ+Sq"Xq[.̻QoXl HƠ]i7b \J^ iOLB,3tATbj!1Զ3)eVJR2 x4Wfa0aFIk\ms@q<@[oS"WdO Mwɲ%E7 fֻ-MU +m^dSPxZ5agIdk.nnXĦɨzÏ71edL@%ӕm/-10;PTo.Ƚ~*mTKRcZ.҃Cj8 KY@@i+2ZeiΓ]X.I ɻ z'xv VdO;NVb]viKV,5T^߅#L--;Ɖ? Z!i_6@K!Ky)ӄl7 LV;N-ʓ3hL)b,~*Q =8!@zsE?PN/LxyGEb7K3xsKv7*7ӅqxxuۯjLn dD+9Uy&MyXL8b*D0n/Ҁn4;c+pMN5&ifĪ%l¿)qͲIPټ6ߧGt -qUzëɧ4WS7|=`R(0\ir/MD% Jb?YG|%FMN\h&8)~%WQf\O&0`6sw(]36S୰HѹA6/̫COcc%MPȔMV/3c`oj !`O];N9o Gd;(t=^cPCz?`ѝ~яՀYAt|{K?D;B=/~тϦnsV 0w_'YZm y5C.b4GYiIrXt E|}3ENx'- 41~4f$׃-H[*1-bXT]YR)ܶ[*PDž H5veVQɶieuJR/%/c?{rnYI/{ aE##*?>L%*:fft}RX}xs,a=E4,텠&UcNGp,?(Òz WXF:ߤ1TL\C |ɚ,?ǑpݗDž[ŽÀR.Uc! 7%)6<$`r`CHAǼYdg|X֦+P44`$ZNm/eL*Kr Z[eף.Jh׆vOc{$C5Y 5[^9@,G۝fAS5v bO Wسd[*̶D#-Bɜ҉n0xK0> Xz0i KPj8ƭdJW7<6q/?ov//dDuLY\ `ȅSŔFOS$sL^ eo">.“4T a2z b e߸\"ր*غ .cYܗgR YEMK(2fY3P1W_pcXqTT |6Փ) zYQJ-8 ^b[gCJי*u]MHf$R8Z!SCv~_ilE8?kc[$hafGQ"8m^pKQ~ޞ|#T r !Wr]6Q3 d?=TX\^ܣ#(d`(PpD0wo=іG: V? |Y~8-:.j5J+M&Q顔@{T>J+`TfX #NT=6?~tv"X `;N9iCX#g@J/P1؃C-۰ 3&(*m.Hgz $}ڲ=4_&]q\wvt`gI"`NPXw/-ȿgAY*f<"Dicp[}y74&*Y .sgҥD|U \n-#R^Yuɇ wUaƵ(!V+7MaX"RaC&3ñ,/(m/kgovɖRGCiZ(&519ⰡƮoqZJ)ܪUV'ms)8g 4+tZ?_qUĠRpEd}8z]r,ئ`NA,aRn?`&vMH$I@ȍI+? `hǶstĎzLG{K[\%w4r0vkhF227׮=#{R==}Նd$oRODrӡz[3QhKcўN0qMidґ{ IS5ضwB6A r{_{A[뚚 X8Г: ,(*.4iaG-)SH(7hj  `k[ \=iԑ67=nW[3)U?샦/=R>cBKe2f#cj͜gʵP PT(7TDTU=$AXgU=Zǭn9{6"z_Зs4YhEg]GWJsM@S’<{r .(=u-`0!,}Un rlj `ÂLa9-[m-`7nTQɍ#ǖljBˣ\t0l:9^ "n\[z*~g8V)9=GFb6sD)0EMߌ&oJa|6; -mV2:碼sG=2^ ", VsGȲ>]qb$=C $~ey#ի0pq ?cK i'إV{mI$ .XNP>dg F2H?aױ| qth.I :ߗN\**GWZfwN8Ui %\9JDWzr F%{8| 6DPܛNqW; 4(֐%y'+#~ 9g0la3٪cH9KG@:\|W~zfs^LPS"?w0;W-ih{3o7GB -ODx5~Z\?p-Yݚ;Z,SMg:E=Fd}T?O"J M{z:jGUr-Y ? =>JqUԺT<:v/+%dHSMogK1"c9]!j#a|t?'6|3b]M"\^`;2`]}iqǹќ)>",#6bꕢ1B|sK%:->z Wײߢ]*900246Rz]Lonur.JYMR[m0yYY D#9W]y[Q[ S Q "P3؃EL +6r}S=DGU55]ɕ Oa:#>YbI=1-\{X1xT_#I8YvD|4p+'njcBb~8N}7ԑabC>27]#ᱹ>! jzk_LY@ KD.gUMM25+?r-7 0n}o +R!i]2!$gnչ*F46wS:4_3>]XxJxg&VQH++.I? `:OQ`V`xswJkJN!\H רK`~^0_x$]L—x(@Wt[ɦrfRqˌNjuxe@ĮӘZӼT~I^ eN?]r ^ U]KGn 9mmr䑼v{P[.Ax2\BS.ܺݲ*⎄h@C-?X1TEw:BzΪwkFڿv羬lcbrsz_|Nt?c uFevq|ʋ$8:\xȑ՞Mϊz`_lrtg:Ҩy}5NBa8:W<\6G8;;X}tlƒ ["CcYZ%6.|TFTkH_- 5-^0j,L̈r2m4C-O'#؍.VX׈ k.u6YB+S5efƜ0DH \oQHlYMD.b٩T ~!v`m ^k+>*+CV}*+³?zZhpOL)1}56'쨘$+нKsƱtV(V]+mJؤCE¥qslb!jq0a$zY-{i8%@p~3BD7f5,Y-AHϘG9j`2FoVTNP6=p+#7_t^;J. Ė 7򻶊L݅G+{w#7}&,q峘,LC ¸PO5/#(LK^,ځ0`#s$Faκ@!4guoK.xwr&b}xV P@rCs* fK%Yfk N^Z p<49$.H[TL25gFj~ZOJv$Em$~־nPG' [,"a"kM(o(50W#;8w55KNψDkMhO302 6LEއ%h9(˨bGuHPh&k76WEpIH'\($7&%/)n<¢B ' uKǻF F|{S\<е}hKMYSZS"b]+m\:H@: *Y-7;~E( ²,g5p ܩ*NJ 릸uaLc{;eQ:!)Ces w# Gfn0N0m(ox2 NԔo*V5LD9p/[s~Fr"O᝹A8DeFceqb@3?)]H<2V3RW1@Ӿة7vQ[t\5h|R2k41"31Hcv *a_%^41!ܽ ٹЀ$$&J7f#.GkHKx?ki6g R.>8 Njj VOQZH N#`FL?qPx|J@#Q/!U&^C9PY&'Bi~;맡tX063/+6p5&YfURob+?;L`M ٠~!`Zs2%By. ~Qfչ;:4PE;QhZfY1\j؜?P:s2t˒/G| #C2>+-Ex' BioP;LN[!B }[ R~qRz[Y\ Y5h< H{=$y^3HT|8%t7CkjqSˎ^9C~Y{p|϶b aӈ؁FΑL 7 }*t+ou1EHUG'F-U@8OK `Sھ`_noʝ*vJt 1 aЇp{] 5PP3ֺ Ud‰F2N|ZNi>A.ۺ\yYi4T**3`V—Mz! "5|;C+ݥI`l9#Y,h†Vn;U%19oBW AĽyˀ (Nuf2Yz{ W~ǢnG8.I|(6n |m=vj#"-r2>,_wg;/~nBV$V/,pd,.G溇!ޖ0'3~lUF "By3'p[wRϻ gTe$lq/#n{(.%ҠH0-t~čGՋ{Ǯc NE(MTNewY#*W%hCCm$b~!C]qS P y96o}WvF)qyf[ I@a=TQDaBplB Bm _y82dAK&G~\mM=t.@WD2v$y="BOMlB~w9FE2-Z>oCiۀGƔHփ 88z/T1|< {1-ѝ1Ix`BY<a= 1gv, J5]pv[}y!::쾀o6:Xj~QB xqH o@)3swl ]fṅb;P!a@)29P'@JGX'*.1Ъ.Ro :B8C"` q*=rI555Y ;NsB<ȯ܍NbTgjZ<-E**E;~*AӘv)޽Y?J/QO}g\k?͖[B5Aΰ!q \q%B{5Og :&?eu:օCSlYP 1I\[z+lh[u%N*iZ1Dۘ|UZ[̅!H4nzJ skS(zaAӄת5$CkOO^LXdɟusФwAC=AsPg9'} ;}Χ{D.lN_k(T8>5lv;cZy5`C"hj{Sjg/j+t>fִ>tY?0,=F9: 20MD^"z}6Gø!OGKY!E%Dַ" q3.S,^vsف44/ck;Mˍ?cQ1\ wU ?  ԘUl/,.G?挒1gxyWPxq™9^iG$792a7RgeE32ቝ|i ekpYU̵%c Đݚ%vK8 ]1rakg\%fi= "?3/rإ~ 1K]pu kTk֚`]dO[YmOn!;:)~I|:ی'rC(6@If}'y8ȯ_(8GOҞWoF=E|͊ KN㕑 Kb3 s+5h^?p"Rm¤D3S(գMZ&_g \T;?1ުu\yY,O  $Io'!-bW헑i9{>YJSLo8%AݹAnADOguH ?V)asǯYP(-AtOfb5MFc0yGOv~L<9d8CPC:u6ZDFJr>Rpޣkl(*NGSXƙ0HMs˧!Ka8d Ť8ezDO, z8زTms-ԋ/)3`3gONJ5OE9@|O qMxҡy'['~n`[~vg&028V 3o꽲,е%]md1 ޜjrU;%C@ ʛfM5s4bP5*Hi4ofh-"mov@񑣭h&4`} T-H*4t)ֹF#ׂ\_ .93-s M*lsĒuMўc,SſFVC<8OVR1w7 (婲c]V3e,S-Ht19sbK`iE⌹7wBn9`8"*N煺JR|N'OWk*E@ _`奬A\s9J3YC6f%i"]ϝR k'ڐGs.P pR|fRT8&m!񙴃{ۈP+Fr( $I 34rV HƜ_QDTohq4WŒC1& ,:qMi#0O[3>LFasbM^|%FwSu--m"^&>} ǜtT\^E>,1pН~xAv R*@8a)Q(v^X;7Ddw#N\*n_%ra_{>ݚ0axZx–5ds"GKBoDFHgNc0pa=lz9(6|z"kXۡ9E$u1TeGbO8&'139A>6zjs3+y;ԉP! $}W-v9cOM^&Rk6ב' ;E(q] o\ |)KQ'W,G³e];[Soj*Lƒ‚nApqsbHc֠ Zmz)do66`fK?R* z9TjJAƒ!Z ȩ/tw @cuxGn<X; Yw6DːB@Їڶu<poS=g5BkS]E %%jahG7"6oq/I;K4EJ8%fr ڄ87Q56d=6\߄AI1iR;K E,?u fP<p {^WQ8Q1q@o4r"}LsoI rȤ܁cR[8$>4 )/PAeufZR#h$`b-NT#c%=kp1?3% fuTHp :׃%+VwvU|Yg\Z{t#zq]_ctKm_7fP>[r./p mF9޸ qvqq(FvzmoV.]UwMQdE5T5dJjx9xթeu% '*IonJ v.nXwt;y#֖s[iP?Ŧ 'PY;k-*v'!ܳxB~:~5>r-rKQ3҇ h\Sj(TU㱈LeޮTpl ˷ioUז; {ҡ/ʲʋ}Bo![#f_#{ WC霹OO SbXmzu'#!Sơe HI (rr 7ثoF΁?¥ƿ)y]}/上~2|C@b@sseMϦBܵ.Vw?Ǡt~2WoV1:hdPjX.>u<dݸ7G~m& e䖇,ѳ\᪘ NOfvF[b_cNgV3'"rP?.89_l7ʤA `"gB˴aRh?{)}>ٻӔ8Whq&)>o& a~PγLMbRSe"x R^ș0La㩟#*, PO'"sŷpsMꗭ% J;@ &T!,j]`oMx3(AHwLbFkҡin.55x2pXaߍ2`E=qX^8/>C[PnHy8=5TgF\UDrk=ڡ>AMSA%fJE$wL:\i<+pH87`!tO.%.+y!p`U WCf13 $%ڟ}[w=xkmphTWÝoy.qb~:ڈAs H_wk5,9vRf07IQ[gg%#K ] fsͶ;r] z*+_حqB.St;̫.\?5s~5[|:iܮҩ*mZ2eGʛ<*s2uEA7ȷ 2:*a+5=gQiQ'[Q!:!Q5t[2=dP'+̣4n} i/*@dҼ^IaH)iav>ZM6q&Zulmj}s`fN猽x}]oAxw:+#Ѻ0yڗ}cw re RkN&+O g!]ݍ w"oex9[k9˼D)/T!RXT+ 8[c7]z5aUdlf mEY y!9p1:O)ZOY0 bNM@>>ʼs| \^zj9x- .E9VN_h4BeV0"ۤy,=PtцvTJ]JAO-V#ϵWk4En^γKٱ6oIOw`zXFMAsE3tbpxoOs"DJhVb1>#\¥a!L3E@ NC*c4j)Ga꾽GZY%aOqI$AL@JC6U:~+h7?kjД2S#2O~,3Z1J.^Kr<{3ikAvDU8V:Qhd 揄 b ?-L(b X"qNp3Z0b8}gtYLժeNf0v"IyBg>}^6/G7({>w۝Hy{ΖI-3ϺW A" :ˍvCW%:Rcؚ"jM&pē 擄Y\,lz6L&  VSuwJlb5!a"N=YVٚ"t'7I= 9DY:1CiN%g]WsV+ˀNLcȊNY2C?qQ$GYz35jqaH4-O H5C1̖C‭IMyg:ߐ o}NhBôjfV-ԕI/pTȄ5t6< !v&oyϚ6\&RuI4 gif!.%uQFgZ:\X$k fF4Lc}4: g_7Ʒ۞[fl2`MBsCAҼ"@ ^Mba%dr;V/ +#>]Ym]iˍy zCΧ=S´Oq{ lզ{\ߣD43i 6^h EX}{iEM!yE/[% Mʡ ! A"滯hHmj MZ5݂nY[현#oJfڄG%@f\j!yĉ΃z:KGKz,'\kpvYikzt~rQ-+z➗uY˾uxqDKma)2t2 |G@K;ZO9%X#$R-PZ>)g\-)G }VCO S\ 'F g(gO>F./ĖCFtjWKTij]5 u\CjMzYs p'6g45Z\!l0WC:إR4:ŝ^Uc)nSJ(V])'cij¥&Y.F '\2~X!XK)@1QʽWO;!k?lǙ31:^DX,,E HbW.0N%J zbfy^{B}gځ-N6.kYtř ^ .,}Mm>FNhQ g.H2#Q<\t9k;ZPv1 I/y`SB¢]J;ǁ\cyK7z6Wlm`jKV#97& ٫Uʲf(nke47tqNiБۉ[IT+{ٖ>rkl= 7p`6dBN pӜubP8tgÞ >_8j.=#.1Ry;T6%Cy5ƒnQ^8Ӗ oq)0l_ &8YA mTiT}BP ;7Vf-\e т__{ IEz6HB//VEts@Y  \b^&.mq}r?!|)]_$e> KɌ@BYY&ފ{?.QT&e؛'Z;\0xKrfI,[EBduH軷 4流!meh3׿9 \@zѓzu)BwXA$^࿧ ۫0>6,O`^{53.Ӿ?n;O_t]cG9aL8U. 8J QT\YQXvwz f9q ե\K[ge-t`4[TW ]uJ)8?m 횋9lE&$auclY#)[hyyo*,z^xu::IVqt @GR۬ʸUun~\YtHT~|'*:U1,m"LMʰ@M_tL(yeIbtBjJȕjo_B? 21հe N@G5o Iep7@;R5#; ^/ĭ>#~Jsl.xR|Re?ãI1Dܲ:FT N-WK)uR}hĈRG 奺V-ށTA;a}!Ѹ?~Wv7S5_6M@™ ;^7atݿ(`a\]o]K~I6`ΉGjYz/Ń 3SB1_&8yIʇ `R\ߵV%#M\6?qޫP$lR?$@{艵߫5Z+D)״uD< Ipz{c6B991C9-#~KC7,y]B&ExkU+Qe;I({Ǘ۟b"p$dP w0hly5uUvzKc@ w~A?i:*Ƴɋ[Ќf[Q -TS~A/} ^1,Rbd@v'#a(b=T󰜸| )rGȶtuTst` kX!b &Yzi bFo!`2 yFFZPro:`(B-+>&vR)8in=?'K%l3Ue~.} 'vT_ S< B+R-Y|ݢ,{K@D<.Kͯ_>d DŸ/VKW./ާ.S3d7׾_:N4 Pα5--.)%?[8DWݢ=q%h.Q BsWEU863V6Yxold燂$ӱT<PThib}!G=\bа (!wB!d1f{/YAZ~B0/Yƶ?]+(~Qzĵt@F%õFAF~K$tHorGUۅ FFF)X3aqF:&v1. f4H%Ws/ӷ^c6h*YpN1$9@jz68%(61n4Aj3\[Ńh{ក=/)WR?wpH ZΊ/"KYeJ\b5փL̠d.>਒\P+ =L_SU$N)-4I}< {1bdrZ|woB]"1q NF%1\ Q6H90JrȚv`N!RPZS"FS8S[g4-d^"(4hQ)^Tl95^&ռ e*Hɾ˞vJN-B(0`Sn3qz8F;}1o˖~q`RTGPQXܯ=qa徤&Rw/y"AʬMː`Oӣy﹬]Ep*X nȽT#aA |b `Wcu_}wP qeF[8%&엓g>TJ;ZTTaNPx3c^~GѢvy';Uȩ2V~ )Gn8[֢}"uUTs)N-^ W=UVk4CMS4rNZW-n_Vڑ$>d + E$Z9t`}D}?OaJԔ',K}H/ \{O \zҌ5H­J:3 7J-Ac\tRrěYxcNބ~a_)ƴx6s 0dѿ# ˺0m7EyYJ =Kt1ȌgŰTyZGVwsq)o61I:K_Ք5еnQe~]/ FgJZA_\d*36 s9z0e$q7g9tE Ocim$ ?ݬUFyN%9lIU@̆mպ ʐK<$Y8boG-/%CK, 6ْwT{S%$_X'k&o+;\YךN9OwRjA_nə"gNqYqN.ZPqg,73Y4bqTna3U [Ӹ  .#U=l:uyBڿY4{ԯu 4wC!pE*Ե9mQ>N6QXF 3X9^GxE1Sa aה* ѥ:bW Q/D;V] =5U2Oswv^Kl)lpU5Lewxcj2X|&0IOlRlr.o8+GRNl"0?KRAE~GQDoB$;/QFr90ά3"4d UZV bCY F"{׀`9n;)j%,nK'_Rڥg81Zf)b8(Z?®u˝0 %5)4]IIkX(xKHL_}AwhL 2?d{sGa|}sF^Dcؤ hxB2Uq2R}I #!`}_MbbMj)O-bza{ZɖbNMu?zlE+ZtXYgf;!֤e$;ICӂ9b@FR#)QNu^;)նUjjAsy %BViͼ]qV'Ͳ%eQ-Hbc2 @F>;qa'T-̫Ы*2wJ>3fk!Pu_2ͮ||ݰyS b"yWCb6Kf9taCVj1/Ά @ "XLx_Ϥ=DR9s_?$=P)@|ljU nTf'UjfX⏻dQ:Ld{jO%h5اvPG_(E*fjC}s9tR2tt%]H)V&|8B ϫ@4νCD|r;-Ɨ美8dkp-h_/DSy3Ct#A3G2Єi|*-1\lnV]0I|_}MK^i= X4pKܨZyoHB|2SE)rcTr rJAa{[ZH((qXR>WTc ]fO.deb|e3*Eig1u*`?i;E#SnNt|ut5D-݌Q@RSU妭 x"(DTTO%'GXqv:>+MB6ڒǙpF;1 Wz==cKb1M{MV$TPh{:fIjE`!0UV±0թf-6ZXV0"ڈMņĂ)s-ߠSټ|ҲVxonastH905mfF* YuY:;.< ?9D1sk[]v ~WM} |t0V2<2khp %^DSӰ=,)FalXK0^U> fCF >_>E@I R d!#& ׹e7;9̏b㸖h`#v,>Mk,Z$g|n= ۾N6*7VTa YلKʺuz;3 {)Y,uFw ]{G:|RBhhLMHmBqp'5^*4AQ08QN0; c8}<);pUdg1 85Q:7 rGA");EC{U xйmj!UkG[14[7)͐iןH&혻s('W+!nvu5)pLx 3~ xisEdd2" T r&B#?ɟ.2 BMfW;8xXr.)q][ K3b cfvxc&:iLd8Hh:'n: ɬB1z՞CHx/dM|%ۥWp^o% 5߀<ηDHt97@0^g@8I@hBǍG$1Tp^8@۪M25R&ީ#@c0#꾀[Jp`wgIɧ0xum@S1DNi_ Ed=dwp49!۞\mT-J\0cE]t-4[\ @9D<`W Qא18i;P \QX Z#bλW|]A1fۺA K/@׹J F{h8G7vĶqɂA.> Rǂ^1UZAno%uKeq`cT` O wͼz>W+s㋕Eͫ1RCHHok똰%6ςN +CRER6ܘ̰y3|39n)|= q!จ(5Bx\ ӑ7uzBʚm(B{ ȕzmxLL5FChOlIA+Q7J "ٿ!No%5sw BR Xgڤ`ߜQl]ll䵵?kD8h tʙz:/<ϒP_څU>!6 @_v[NO\Ui'97Z8k4d7ħ8:k+vZ ^jq#_L⧰lGZᦾzqcPBGǬjjwNm´Dȹ/Qg$uwjo@ܫK/v:31%CѯV #nȫZ%~I`#jWLvճӔxݱߵbMDp 6,N'?@'_<[dD*T^!RyrIۓWzE7XƏ6_ Xa7( 鸍"vIfkݯ82YW_tñC*kݴ~ʩn> @4{gPyxg*B $a]^B \dWIKKӋ"I_ 9y MZLL}hM%m=5a!;gbVFwכD9Pa|%k'{/԰E_ߒzr*!hWUJ3 e 5ٌxYmk 0)8@Lʹ{qɤ߁ZV}3g@`,X@_$S7\f[\*'_@vQf6K;7 } sxAʉGk~6>:qr9a[̴P=I* G:LԄtd%k=U[ldM&_Jz߸łf?bxq]$b3O)U(̬klf Vv^+[|l6Y+96e-t>A{M@0s\xbhAIw ;rKD:`2ZLd]Qg /|RjM?Mǥs缏'3رw%Ta#/%Mt|R\g/nV5߭4Nz|4PJFk"%'fסr5c0{@,V^x3O Y2ȌReF3U' YM)KMZgsK,AkY'K$ٯ9*n_a/Dpo}| OGzMj=Ü}Oxp l(ɾɭC=(a;2hr]yQЧwlJ2ږH6b 쯓gtcLJ"CĆ 8 BM`KR* yk*G$w PA&;QS)!43sEE:V pɺ2Xjxz>İH4eCr[ʼnjP=h ɾ5J0߲?=A0~(5@8S> h%LӉ9Gl|@-8N^%h P ~qGuYx60#W;1qc ~J|A(H1" [EE\j7|NsΥ4'j^\91!;-Ģ W^HII$EM3H[t feMI._;=mB̂B _ Lel[-!W҆"|lq4S8!Φ`Ud8F6Qnā%(X9ZT:bQހ%u'Cak[l 7\` d'1ɷ[…i0cЮC <~5ox_5d# |"e[J Ǯ^+m*P& '~&*pvE|Hmәr\?ķ3kIvbb]fփ`A-c!qGU{CwCMWI]שo$^PS yȟG yecl!Ɛ87n1W< hc 2umY磕ŃL`VѾS|vwhpU2irOI@p 9_0 7M/;wIcčs՞tv5tVt-xm #[r-!g.{(!N;'^(^A?w6I`jz> ՃBY1X,.)tpO^6)쨭Mplu@Nnd$? #WĪU8uU5Dc ^'L9]G-G@&y "63@ʛ2*ºznn̘S#v^sGbAt3f~)#\4'pLժdw.6L~t΄N&G@ 2n+oe(A1%3Ƿ@O]hTi0AmZ-?/b q$P҆"}V-(GeIm 4dFA).0h]ؽK`QACSI<oFUMacv95gJ(CC~9 Dz)it(HA) j̔vQu4z25bK;KɗMe8Nxn/@*28!Bf"'XhZ`3dMTgab{ 84ӓ 3#3u'U`<+ob'JBwS3YTWj9,ƺJŽnebJ$F .LM`^9h2֫XI"\dQ:V#y*OkzHNOL1ԯF'XAn ,8#~*cĤ,1PAFKсL͔){~dU 73UdIG%f*/`iNcξ٦eǃY*L4etU?Pg ]0wL}&fQ{XJ[F0NKGS{NQ6i' ILwpW^Q(2|4$$\ǧn|Zׁ ˙h008vr#wC#?P@.[И%y@Aumܾ$p2\iUD9niT>+L?\)mR- g[|eυN6M#*ڰ˪f"(] .7C_z`T[ K:F?3X5ĥ5NOne { ~7wc p&V۫ɽF%h&0u_ȟYYJVq @.ƴ5t6RG,}sOz}; ~a>.̊@7GXk:_t'*mP~-:4|D"xuIFflx`Hδ"m5S*N.͗2fY{|1dB1fV$ 'g[ Un (ν[5v݈ӮTԪC fWze(ŬSCokLXL 2q nl,w&hrO.%r6f;dhLV]Oݝ0&VY3O^2yLT[B0vijiw)NŸxK;,R  2H}Yݹ|0sKB!j.6 }9N^S"#LDo 廅 SF=6s<9u8SG)Xs䋫yֈV ]a# 3o [GbJBr: [LwC ƨD7k+'D*y(Tz iEޞk7ҁwͱ>Cp73|{IgfIN{Ϧ,F&7 :S`F7PNΧxbi7bPxGIq|?ߘQ_F[NS,Q"ycxWPJg+( WU"n-X'rEo45 O`, ]& dgZrI@`.Va )z|αDcDX(jDmkYحH~nvek;$E}Ii6{ P%Ds& CHW5hP?HcHC(fONEj:/y$O˦[ȁTe<֘vy8(v-5]T?o[YeJX:Mcлg Nȱiqp Ŷtrʕn౰i "8//T.xNR[fi00 \.4ROe!ŏGxY/ $Hk7VS޴8ث>pɏrCoN`,,IO>ERVSL47IYrfF{&I pTcrPxVОbT/wۻLsGK }Τv"7(I^A]},J&7o"[V>C]aR:v E >IS:'snj9uIvuwVur6ܮ3)EtH )v|si@=ꑠuG-ڄs:w)p~nKz(8Pv'o-K)qh#-@C|vk5[=1&=hFCQY(z<Ϯ_s0}#]J n& dX[]7(D<'8 3aA0mn=# U:B5'eyF"cmȅsIܸxs+UsDمGN M={_KCgRPv5|Owҡ>"#T9xh:uEc UbDg|+h!@O5 ܣdž`t[Ղ# 8UEA$h+,Y߷b8'çܻ^1:,M==M񥞫p+b2=݀.c;g?c7Ro;sLkN(U4v,sk 8uSX[tE߀y ,|hԲKw]vM ݾm>D H31)<:B8U8kZ'cT8ojf3:͍)2]B$-{n S֮౧!E1W^e8 q70HoFtH`:/A.9FD ('T 7Ng1m Tc dD%vZ`y:FvC_բRLUB9'x!鷙HzS|:Inj`i~dWePEi j7ԕ`otO}mpcGDZӷz߭Zc(٫ՀlN'G@xood䆙HICìzQ1P#{>B>1n(*ѫr6l.pF0O~R{t1@? y bNt":0` (|6ce~DŽKMߣD#Fe r>q3 :U5z t_6ƣxIu}a^كvryF赍ƌkto2B呙\Nm_/fc0|TL_/tg$&uw [jϳTE 57b&RE <Ռ3yepĹgW x}iv#~OQѶY |$2Alv7 ='4N|m(Nje?YXVè#º{Eu5{f#ҒV)u[MO8)|;ͱ=g: RCZ3HZܵ4Sg!%V*9kQ:/;M]UJ1Zx#(eAn H4@B#䥘.'7(߅^fqW:!S]7mp6M)𷁟 ݵ%clhto IzÀ8/ qNnPbZe.9|얞L$(]%/:OQƅ!壩)Òver(!HLNdu>jcͧp\eDL^8/KM4xYǔumʂUdId>aH²*U\%i6&-yenǂzE[uN;ˁ 9d 3}4S0o(AyT [;Ž>30~0lEPPZX|xVw!rEïIOP3dc'F0ǯд:N258芠x)%KpTB[m4YqDzM$]G`}eb]&I~JPzySy5_܉X{Ǫ # EHQk(yx./w<:ɸL89 mU5gxǴQpT mlB-aٝG@{'G<29ҬېYψ8MhQ%Ukm~aPG~fNmXIIg{`jh( ">bFX*~&1z)C5:xN7alh@pzɁ3&BmZ GW,# X&\Ux:36nڿZY_@ F-mښ*Oλιkj}l맏=qP6E^oMܹ:^8=V,/T5SChyHSdZv04 4fX51Y0 g;E;Zx %~~q>> .x/=#q1d⾟*P+g3?LAxk >^ GR*˛{ LƯkXѶ%Bro0Wg"Iy(٧(ʽQr5XS6w\ ?: -1LxYr+-$ϥ%Lka>ӌMfy tTo@+ "e U'as[iw/[p^2 )VOx`[7HtZCڋ%6*ȅZ:/*v2_+$@aP3|[P+AWatˏ^UDf>>gr$TǜI`$L2SHL.JwrZ6vZe~iYYV9-M 5jiFkʠKlswݛ]'e(be# y8=o6 L3XTcl88@#6UURWqo.bTi6:r'kf8:^oy<5xoti:2yʀs)9*dFr>$X*ow7lɣDyBpRsJʀJS*$;cnbWQ(0ĺpBBO`uB_IxVotJt[p~5qc,.檞pmr3ؖ ySTΠǡOoHE Wɔ?hhfDz`!c©*rw$$n \jXb儢R=jʲTVIr^ÃZy3jm%Ƈ-qa GK6PQ礓55Fa|'n+ rldn"-1Cה(Ҏ˝~+u&hqNnޫu%]`:8_vFʭwFԧs49[si',hAS bzfYX `Y޸]z++m4Ju9sckJ)+-(MR9ddLyAVʸIk;SeU:!E?8aN4빝ȭ{WDڌ"E%)޾Oh-}=E"ă 600/s"bGY3wG ;sd6 "= \ZR IjZ@ L^|Oef*Y=G@[{ XIu8/=Rl=yNMa;͂,W j]ixqY '3_eK%n[IM0 A b4exnqP +qodx.&~ac@=gG}<<H+'7+LX_o¯Ho~bw`_, m3M6lYbO;?gvrrgm.͖B3*]Y:S\Q T >QCDZϏf umTxz<lq)F{o@1 X >q> WqMTէxc$TčzSHS6u*lHIЕ:;٭F)nx2kyrbCu5&.k\ݍ{Pe9µ=l_p%Dzy7uBM ``CMNPQgp¢ C~SO27dk O9cСe1c+CSC(MbDeQd>C}"J.o9e)<"/rl* ,q=/ 52@d D3Бıo9 7G1U}Tx\udb61zMH$`ť(1&=6C)#9x2,ɻgpOUf3}ɗ_+XkyR 㪘 B$a< TUAk8ڽȾΥ2朙1ofr=ۺ?:iփp8鍾Ovsp9dŋÇ>ھ>7^̭XC0?&F!'Y z[cjxt԰oAtxO|!Q+G+mս*wӒiFFn"p{p8:ƢϾ"#ց>sUrn:=%Z9<ψ Yp%bIkj-96]vg&_RnKk{!&qO!SMfAl0ˍ `rI@ lq**^QdZbbljn,>-ŴW[ky?y$"#T0'ws j̗zݕ׋QFB% V>J4xki_>E΂ `&.Ԛyqsϑ9nɰ!jaEծ hzDhv.藒0|w ̀-KJ?L)@IE$ N8JݖrX4߸ %ȁ[:@EVc7Vm`;qk~mj:z,]j- Ajs@pUUP^II7B5 4fo(iݓ9Y}<|GimdHXM~'8>.JH8IEq T`XF,VXƂƌĬnXFx7NV\Lr8,~Q9zo) ' Aeލ5h* lBh *wOS ʒuRDG ORk7nl鼚&/XC,y8t2g͋[5of-TPz\,)'|ӛZz-g-H&yPa(7/rvUsn\9C,=KoO[ek"Ȋ8,H<\A,S\Ӵ޲janյ|`?ݵw 4Ű6c#B%Fk);Jo"Xm[27?˿}n8Km;?~;ʪv޻DDZ!O dUu,NH1boI>zѲ5litQ6پrsxkcgmmק7isF̰rukV~uY|5?t`w4M#i R~r蠠i1Ͷ ,X,jKTCBE[<1֐x%\I^ QǧS +D-kGV H:{?9gxa&e… #hmeMREzĺ t.2Y<Ѡ.E'v?{,~2#$᜼#Ey扔[N&PPPM_عjܲt"W ŕ<޼dWݓG X r[cF-L¡w,8c|u39DgW3Αa[,}Zv3[ R-pꦃrr[OukC|ZqBN̏ifFԏUy}6k~ZWiZ2߈Î7&30So\$MƜ5h.{4sPZEe~&]`JNly? >Dsr:=hKaͻ2÷N= eF b{]E(vT01߲3L1H D0q-:.Y(rwI1U},OjNz< L/묢#YX3[{YJ^L?i݄Lu@xf‡/hR\r/c2Jv(!Iרأ!)}&VDndGO…n3<N${D=^ L)H+A_k1NF8p@ɊHN V,E@䫇OBf4$c"<+1&D(Q<(-P_Fo)@aͩ"oY޶SN j:~=c\8SBH%;]_OV̤ގt!tdR}mLd߉fu[/#C@=DjB':6k%F:9r8Gθ 0qO<[Y'ɿJf|3?6466E`B28  (yJáfy;|{oB>,ON.~58"E0Jd;X[dheWM|K՜$V']8 K ٝ2~Qy ۟hatU|ƕdoGƻSV+H[UIF3 ܪggDwYzWoK+p=7+ҧUУ)k3K#lԼTM Ϝb&6gqӠ{N501rgfrn+z٤jI%oҐ^[wm`Dq ?p(^t?'w=ŝVUut'1ȱ)z-FŵYfDrS^ނ8+u'EU-*Afa)7`E &q߭^",[:nzz % q.2|Kg#@ߵy du%Šoomz\)Cqi}9cns\gI_)wJ—?{]6C1,g$T'N|\9gVl>&j1,RR>q([Ir@Zm֙lpEUr#9D%ˢHZ8O+e,ڏ[ 9b1e\, r3“)-L.0zLk>P3O^8Ďh&dhE_SPelݖ0$)[)2ם0Eg I_FcQ'c/U{Yτrņi(WDOLѬJIizQYj|eaexVrb(5 kCV _R:^%=}5)Vfʹ˟;M4^#dÒs Z>՜왼QJ 4`d?rRs ϥ>vpO$·Y>SėY򻲮8l}SfӱYrǝoqxD90ʧtYfBu > 11! pҀ7sp8iz c%<[_oL4'C0/| M>HDq U%x-dT~k%2M#{fXHwJ`^~Yf Y.o?>XbdU]ePxܠM뜨`-,^%~ƘL9~NrGY: 82au4 R{xޑ?f1 "Z¤'hC}TH{ZJ\ꋌVI,RE1]pS#o ZB߃C%՚gqbyCmp. ee%@~8*P.v@GDy6d^?|u4X<.$h VB2'7K%{yWA)EVCkdsɃUe;yW Zi<kѬZۭ`PBw-`{ \ؿ#rIO0#)NC,vvVjmQ;*}ͦhت.}kcK cX$iM@ 9[yCBr6'nGN%sf{Gj--3c#3{BPXF(/e ^Mo*iɾ.MWd 34M+(axqc}RLi7.sX#7-eW;:G6(R%.ğCQf#hj||>a&>XU Cve+H(>05ʈ1MpޝGuأˢkaR~Y&8+8OAhiAU בh)1+؉ &5e`_E]2*%7ձ?؂LO-42$+ QĆ׫$v-Y]˙ZD #1m-.6*56Zy?|I}BYeƁCP@d*.w%c=5]pA5wѳ%c.jKlA +b²+%ES&F0 &]xYW6)=9vVj-UiN|591 J'{GfvB{>4>U $@}HY&mSc0&xC’CKs2%} B|guh$'(Fe;jU׍~ctQQt9U@#7VSRV0HxB'\TV5F-ڋU8$F(M#Pq^{"@g)2|?!\yq1fpALۂ[$ vPrFVu]/Q3%m'NNLx+=8DR(o 2a<*k {c 5/Y.b)=fn|˖q6\&] 1RAm./66˨cmH4.+,|_AB ^RF3{N+% zdKA*ɛJ*l位Wѧ='զDpP4LNpyy͖t<;>!V[i@W^l!~GFN`D]vGMhл=8)c ZЃފRw!v/Nxn!c;("Sm"!xQט}q*!ԤWUzeOF7BG𵉡ΖGfE+ r4`&dDZ}rI6fKƻ7ugmk{ޗOK%EزicgavMG[Wё D(9q_hH" \bR϶錴1[ie{6 +Gp]oϳ޹Z[3@|JN.|սo[AՆQU׈-rNw^:L |E86FEz(L|xlcJމK@Rĩ~ަxΣp"BAAdg57',$B<8הk! XZ D٦)&ZM|)2G|t'Ax?W4IiݬX1vz<}0lw ;JSc-;qjdyLo\3hJ0DA:BH}ƨ?wB\C@#n{kg66B@DEѓ[Dp~\;%)%?F>t28rp-/z7b ?icu:l B4lIp0zw4+>tOtL~~&31 ?d H5#cj={fA$X1"rP1W։x^ܖ o"gބэk\ݛd4&rmo])$%W2!FKB𣅴 vT{ E-9G4C}Q9Upΰr!oI[J5]/fV#t`,_WeAqhg%/?vIK)'Vdt|5km0e_u<10 -q>NAG hi&oqʌpD@.]PA(AҜe,*c΁|uvC!0V>'0Ih!C )aVJr6 e)-sZFUkj6{ PFPCP.ŸL ŵ/`j}wia߈M#dʼnK[;=k ,()'rc|t˅s#&(}謦iMQ~QZXUn>*h`7!+D9 {ni-Wj$;ͳM3w܀#R Wi*m2VQ su_X]7~SA* v< Yap'׿$[SH H/dB|tHo霘qTN9L 1Bw댭\%<L{ 07T\tD#xp]6"E:7irT*fJ.Ldžn4䍙FM|n ڽ*,1t F,d55fhU̓79f=4+r1Wȭ6zR9NwvI6ۿע&KFu*g6Ys90xxjmЭUe}_;^H#,8H0o<#a/.g>ov]<|4u2)D:.ck y`?90إ!ƾ;ˌxRPN`{?XUl9{rqz\޺RalX^Q]#N(?PSݗ )磹%͵Ѵ 'djN[0F18C = nj~R>tC=a_}I2$U"3ݏ~zi= /ߊz*WN>[=. Qk,f(2'[lM_;*Q Qҫ&RH1ּj!X/@Y59w ḯ)A%DCo3zs.ow{pm'C  so70cq˰/C_:<"i]XԀ}Yfn2y!;k1DGBLqE8.@kD<#_jjЅQ_cʸ V7NbV}(l$Y ^ utIs\K-1 NCeU>܉öP0czh_u9,+" V'bcb>~ѣ&/woE"+Ӏg3& *piܞzm3bA/P,&Yu(C[#ÐOd:% >bF3S\Iou7=IuE~Gk'yOGlJު~jh\<479^g:9eKl֎90 ]zv=">Q{`&#qh%LZRTEe#U. P uiN@`/XB\@ͅz7$7)u$o^-\E6޷JwjL eUK#ڀ I7p) lei5 `ǟd^‹]7)k]̵$\SdEthܨIlϬߕk=n!LqI#Dg??L[j7\B_|1,61Rkȵ> & UՅ\v3B!hœgT?b :cIl`Q)`CڇdSgILA7BDq2`^)Sg@[zdMv/2%̕fP})=1#UU6%_\Mrcѧj􁷕.$8ۓݪz 턁AF 軘|/,ANzNHx7EG؆muOюSwM ͳ_bu.1ٙ}E:(^Gj=f@.sјPjʄr>xؓ{Ȑ8Ռ /XidXM^ȷA=!"E˽vOژgaoī;sbԏvcG/<ϔN*R2h ^t &l@nYu5jU`dr_:gnw@C'O&bVRXe-9ֳ \&XQ,| !KŜ]RGc c>D4ELO֛T'3Aq W8V.)nacAQH#3~3_4#e<ÅANZ(v)nmg}ыҥv\zƟaۗ)LT F2G L ;BǬ/YfS̀xfE !S2 _mz׳E aŌp8Ԑ](.:~J1f*ۺCaGyəׇP T"5q΀@p32M'XgѬ)1MWs rW=`6Q 3E;ք#dW\Ғv7k[ʄ(#'8cf+R:N#eO2]Ȓ;EJaqY?nt'jkܨ'ˑbIeo D~3GsyX[Kџqp_35sb%5<~j:Wf'ǺpwH+^h7(*}nr`R"FKjGDo" l?lp@:#r^ʹ:t{b3𤵶tz}J#U odq+"kXݿH nb}.\ ?`Y)rN-2z2H 5>Ќ1Tdnp4SV:iîOʑdvjqCp>4̚M#K.J\bpc Gz [%! )}[;O258u2`'uU %M]C'}{Zc @OJ{#jm﮻)Y&mё {ڑ`N[ACVk W'B75`U_|k}s16s6N3s:vK*V>pKJq oj*f۵!1}'g7v*-fY|_ZeZ\BjFzD_ ]ha!{-Kv/Lo9gZ6^|kl1x 3NSt|)Q;q.d?ʇ&\>ԒhJ r%xdaƀibm2opJWER83vgv.{9f>XM@j8 /Eyo;bȷTpLǢ$/H4a V G 9 #1sZ ld/_t[;Wx (XA\b`iQr,9d}ff5 |dM+ΧSn$ O0`*ӪR7}8[RUN "/-E*Ph[TNwMqKݐ.PK+ B,bo̍uf Kvҁ-)>K&^Fp$ΜxDt_2@Zn/ϊc$FTm!0G6e/HgTK N  P?3$\Eᔍɯth9O;1x9sIHR+U~ؿLr&2 ^R~1\X1vM=դY Tܳz$MGPqn $sZt8{2[pEPnY|a qXO`go]bbhvjk3~wP1A+|(, }(tSڗGe|cװu_cLِkD\ZmDCl -Pzxv|hGVXUe׎OS<%: %YdF8'ZRp[eN <¨őY_Ot&{Q浸4NtlG auXZkF`Uq|qY8¤Bde6F~>%ӜᏙhl@I~-BHm,qT!Ul1zlOƓ!%O0ZBK$.׸ 6Q[P77߻='?4K%0+V`/<2`b,;v0j0r^Jm*[úH3W^16kRøboob8+˓S -E!"^6UT2htbU$eH0*R!1I,[VP+dNj2REeCkW;^қ\-Ƽخ3r1}Y2;u6J920`9 W8.X ΂Na} ]+ƖMld8'>\nS d(NK4|r群A@)51 P|T!t;joѠ 7 ȉFqk^RxD㭝3yQwJFÃnm1ABӼ<(5 CzL[_K( x*,TrIC>#dP`c}Pj.ئ8#G1,gdgm7D*KkEqa?qߊ2x JkDMrXɌ [7\,@:dfהZgTiK%)E,(?i5f A8^jW2cH̃e,S߻YR ,4~c"} 'a1d@msaoٷQ/ᏚYtl.? l2_پoT?r)f2Ȁ69^f 0y8s\e}#~*$$+j1t34F "--p&jw\L^{%вz* kxpX29&0$ R\˷T \ԗ/}͘{/ng0?f [#Ӽj'ǞG*6G)ⵠ(g~$;vo:/✼՟E ŌH%NerB/^=Mҏ2<5eFD1%o4?J5 c^Qmͽ!DfQʤ4(>z.BTƳ # lI?f$q`;u:,4Bo5ݓ~H v9Dr%/FځMp~NX3IԱI? )FO ⽴BW #˗z+)ȄP1s}}{څ+:1J Jf\ Tw FVCVF6K7+P« k %bǒ@-ۻf"N 1Ip8s@@L t$K?u?>#S&h4y囌СW >-pF/G"FѮ+HVЀJڰRߍg蔅ӧVm<OyӟltĻEVVnNv{_פE5 @}5n볦=G~nTF"a@s}KG\ᏋwVKsJ(bYsd2}8P U)7jy[Bqtz~AR~}#2Db*hg^\O$  2]b {.pΈ̋{3np,oޏ YURg !y91qh)@jR:2A7 GN#ۿ bz7Zx:1$d?C}6I h:W1Nr/N~8~S:訽$<ɪ"w ϴdBi`,l^c{j%h(PtB(_Ocpv&ϺsUxʉ E  P`_yO"jΟ(6ջTod8sSLѠ4NA`U% `a" GvիvWOm!<p_gJB}v[?=5%\t0wh-g89(ð+lhO':%#ŨBʶAR3+*zҰ;۳d>$7 Hf~];V#],`t炚7~t͈IK:rxdɲR bO$~8 瓉GA|xr X=YIsCsteJؓHubD|- =tK#kIr>'4'^T.r%2~YOmVE,z8lsK28${SYte= Ƅ@5 *.~Re?O H:>6@u})[YeRVLWw9w bR#We dLL]w<^g}„%Eps+BX+ޑVGƄ h*xVIÃgj vɺrb0{wF?;a$I`*7*rnYjA4dZw& =|ݪhXTſĻIk;s"&@MTZ#Yn]1ҙ-aTˌlFXr|zJxZn/;x~.n J{lnG?>X>yj~n $]@{RNX|_}AgY qGhIϘ%=@P9}i>* X"Z"=-3Bma @mj<2wȎtI}s2ތ[vh0-ڸƁtu_3(OX L8_>KƖgtiΧj|>"߄TD eiHvifg [~@{DS(c{hYe{f>'((AtC|n`&Bmgq}nB>OgԌOxBڿ,셜Xtb6.らPps7CĀy9凜 N5y3uX[Ŏi W5F@$`y`~:o G XVἷP$'ߛPx>0 Vjg&#ȘK !è:?WlqUb~Hb+򗥮QhG\ ,$mu< ܺUr h!SjZMs< F} O)?ǯt~-z?6>q8 ZuR"ua}OzA|C ! )r^- 08xF1K.ū7,}o6N_C&E3Kj#i;@c fFt`Yp!n}"\8pτZsF`xf>E;f;펂jf1d9LhDT\xd%μJd+BڜV5.0^+Ij*|a7-AǑv2E쨱󑡶e~^V+2(˞}Gk=}Xt.抚?a.@RDeMK lN|T'ڹ$-wȅr8L9I}Q]m < @AS %J(_fuGjW: QZ|N07)Ǝ;Ah}L S8sjq81+۞KIѷwG'>ԍzuinGV#%G8{˙KrP)S*JR+Da92J ߮@E1Jmuk#P;J'^S@=|M5^XY%Wlк(>pM?Z)1> mWAGkAd%\ ќPdX򛽪v 8lPuOR)Yw@[?Ui` }X#04vvpDtR8i?ĭ Q 5&vID>DJ &'W_@Τ-Gea Ypn +o0$v]EtNUo?.. 3ЃSh_^ۡ7d'8*V` oʓI!ds^38A,OsA4}|t&A[M+-/+J$G*䝇ɩP?=k*Yb&JIWiS9Ni^O >h_5sQ>oЀ"̱B [tCĤR犬PI~Q/i'+9deS9vDHﹱ*"8_ ,F 4*Ѭ\yj?%C}>;;6SrUv !}9xgNhqo냷&:1+x$s~ip|NŅ >aL4@< ]> wzzPigI+JAaPE8iuPdW1ӌwvVk*eSSg`p0O$p_oqd!G^@.M ;Td}y^2HZGx ʆRl~Gu1=.C)3jt~jlKk<$zՀR:BvUsx(S_mtkp90f꧊DJM3/\_ "̏i`w<@?-%ig%ݼtn7L7a0Ը|YӠ(4t~T8Pc<5`ZtBXs@5&s>ѵ/?+9h&lbf>R)\1h]aا257=BLWEP~ 8QRCV M) "o*i3?%_Z7sއ@P}7^ |LZ%^7p- PYEiE՟F'?C C/^GX^X0p{%m<vdUӹ} :gSpAޛu {&G:YRi$ưVg8,,$b},do ClPL H7S Yr!7bNQ1ͪG%v3w;2l؜RTZ`}OAlXk䫩~B5|a{|~$]{$iN 26?HiiY`gdО23W|co 5*᛫ӹ18Ywnuq tMFAqFF\@QIj"> ٍ7yt!Jh2 L [f%lYKgy>nEh<ݶgl_0Uh2=r (Dⷋʏt@hdOboNlo#%ڸI^"\U,\l^f@/m|pemb 6$+ 6^ч5ķF4 lKr';i醡L ŐS>nJjaÂ$S:sS0F뒙Q̖c#bmf'7 FyQ9RO® ]R{5 _]?Tá|@ǰɆOvt]D,& eZ~25Ar:栃W2Ns(;B2`l/ \TVHلBt\4e#K\vnYn\@+Rw޿XD;g  3W2Jf䴳r5o@}:IS|Dxϸx)DZI|-m$b_Ds@%8 `'x`*5Aiҭ&o v쎔aKԀ~SN(|,>R}ol=~\Z Ic[̬#tnv~e=m0OP"3jl\t.eZ@^FIzזT:#V.*19]FvZ5Tu¨;<Ǻ.Bঢp3J# j+l.wmf/:ޮ;S9WuA9qA|E}/ߚgoŁ%6(Xk"tv<6PC1Yۅǣ%sXZ$p]9Y`lݟnQ^,'?*>3Xdhppn6^2ϪwD9PdqyM٥1z79Y )ø٭Vby65[;)Is+d6>lkŵD Jt ^, ;?$'}qjwq8哿mcd 7DE2 *ᇬ[CP%( HOΙN4d=jwGGY殃Fb#4 q~[2SE:)fR\.eeGhL"ʚVOY%}T/]+8Oȍ 񝾐 R4GOG ziUp׊hhvbKOEyn_ʚcx*իP*Oy!p_l|z쒤 !˜$BA\bR5]1˫@\aIac21:u&M P[{R=4Fݼ [͹u<-1l)_:hq& i{S8M % '2%FMt'9\#+(kRqIUZOSYnbB;boVt˽4-Jl`Dˤ DzyKy D ֬zSR"u:j,/r_pHܵ1 xxopcT5P~ò(X? U<Ɵ;MC/֒ىuŪ-vE*X5ZCإgڃjaTh6qDʘz"thK%s>YJ|tR_rv Cj2GfZ%Q(yuj~ʥ.6Skؓd]~hbD`<ńi$bOQ6(y4µt}_WEӑCM@Τ)e;TqNߒ^˪ЁT~|~tnJUӾx;ХppsُT=(x{GkE, - C.Vmnbݠz#t7V6Ub[]>A3GN!W  j ט M 4ya,xV0[Y& ]ze٥Ա|/U>Ku2G՘Pmb? B-I}5*b/y X8:\+a=3W 7 `c/Ne~v#ٚ^iy~^Xr_p8bpdFK"9߶$tf]ၬJ&f1ij7`y ܥ69MݚW&o_%RZiF)5 4s?= <[^aέrH3&39RMy{f?Y<ׄ|tTdń-xLV{dL^^|=>ڟ~ݝbU_?z73%FQ1Qm>URFv+K!a*p(PKg,7CЈ/^Zh51Tq% , *çL-0o|0Oj7KtUaT€+\HsQ{1) m:I(؟T?ՒހPfK v7_!rvsFGeڴjNPD`vMn=)EtB'= _+\XKn%5by ?0&Zq4el|! I^܅wx@M4Ӹ;Ʃ\ /|TH$8VFs MW39;'2e!$/dٵ -Al*QXfʷs$hʯk.UR #aV7c߸}"58ۇ1g.=$G >j9^t-1KkVEADPRU~[B#ΜC0vpZY\$𤰦 @k\f(ٝ+il<*.b䏜t b9ݗ_#Y鞸Y[}fXJ8XZ~*JFCˣf31ʇۇ¥vE%@{ĭG tø;PE;ЙVo+PzĐ+DgN6 U?Vrb\3n$MJ8Kgf<1ln 9%;}Qض JRP<*[ށUHA4ҊW#}T[(PD К8` \5Օ$؈J쵃Ҿ wmyBj3ءB3?ޡ[?E뢄%*W۩8 _D'Q›XoćQfO9I%K7⤐Rwk̸iIp/Eaw2?ߐ0tB),uq%LEP>;}=؁,J~?z1'y_FY7#u`quPwZVxĐa[pI;luŒ;P'#WJ)'N${ zsǫa'9㪳P#9RnPG6T;qjcdѪ"-YFZ7'7oCd,پ$ֈB y.^@G4?g4Қlz ^c"R;`ZQx;&f݊|gET?Ǣ _d/2sˣ d,^+M[9" bTp='3ˢxbe|Gtq5w}ÂM~ؕ>{vG[ ³k7% %,6ǀ!u)~Vvzw?` ǹ7v7HMΈL_UޘL(oht w9DY! !5ˉ.{d)H$%$Dlwl Tu 2WWG>Veղ!@Pi±&7.JGnCE9(p@K8ttEV*k#c:i"k:-YHb&ҭ/+-D% MG["Fsm5yDyb&sr۶_ f*,25+d00^.V wuEh̵#<RgvZ&N5ATKV=X|ƑrH;O}Q6%ʧ\Ta^ oț"j3t0dy]ƌ$^,(wlvNu1ռCmotgw$ZXk pc!ïmD{)w6vRՋJBeh|$]+ mP8/4[z"oJqΧY;jQ DJxR:jt\o]\ @I jO(, ouY#P`4}+m+Q Z%p8)H#ʗ af|%c{䱀p,Ҽz~"doq (?@>F69}{!2reEj4 鐉%zj=u2yb,Ra9 c@g1*>/?ޜXQ2YX[sf|5'60NsX,aNRgZ G3TEc˝Frq pj5S 4vDž!C5a~#J5ϧW0OA;ka68E$$IrCqj,񊟀#ҔTF̾⿆ c'Md\he!33elG0GsZѵAo᳖G -l<9cXoAZ,D(}s݋: z“yEv@3K' mUw̌jQYVse{I:bx"ct廚sac2*+&{ZXz)wS)ui+E@焺MaHACp/ ^w([*ƥ7e⚷O1H{̹: }}GP$?o>nI *wߢyL @W5$2}tl|_ ZIc~K)"&2St'ҧv5^"m!>Ty=kȭ E?|ێ{#Ǟ>G'B7`k}Ҭ]FaO>* {͙cD\6Oz͓ TtL O?c)-52#opdopa|[ÖMA-w*w/6@HXSMaa`Ccl2cX >^9'!-fg AFk'(Z+>F-&7Vr 䫍:{v ƴ?xUB!e<*Hn 6Iw\5{6Ϛ?7->D(Fp/[J9N=3CIdڃgtmIoaHlFtkL#+ɻRtT&C:ia׀ @O5#LwPESvɂ d=`'>_/*p!9Χ{r$:4@ O|n E=kwҟv>{g71r(tƤw)|=cbnoR|yP2Pva{@VSM ʕJ"KdAF__87| 'gCնF[FEj9rCʟ?9.dVѽN F$qwC-8FJO g9w*WȐ3J#-RaGBVpwJWi8]/c gG=lw#֭51|2d7(s(`6ݻ1 N7^i2Y,vW媌 /6C b6N}pw80ţ}̵xPZqĪ؋^* y(~_?c.kS3 xh"'Ta` /6Xr꾍"sKphf^ӻ{\;zHi%D1' ꬂ #Io̙7{ p2x0)1kՉKͲ@yOItRr1y+)ml)gf8g OvZ57ޅV<Ʋը-æo>9ʥun;!^JC4a XUhR1M&NL/>wHewTGэP[W忹*#@a yIp}`U5 !f.}&'7rgsE硬Eս\atH ~KaU(EqCɻ*)ȼ VGbjvsZ>ќ GxR*{Ӈ~>[~ࣝŭW7!ki:E=I= ¦D#.#~kKGo~M| i;-Ipj\eDҿ`ɱrm^2TtپEgퟔqm?X ]jӞx.Go UZQlq7ུ! Vfю.*o$\z9U'90lysM8 (-$P>XkX*}G`)}mg-<шQW @62~BN;~`/%oh==/bdgnA0{Ni8uQv}-wݎ#nk. ׏(k>svpF_ʯHE($Fxęf"lhI 3"=%~0sMeFQ[a \.N'=нzkn XyW)!Lᚔ|!~WjCt;ԷT LNܜq=kl3:2e[GpKfx@kB:%Zo&5TVPo!BPy&[i%K?en5 7/RC.'򥁨^DΗq ~#B@(1G; (kG2͚'<Ɍ/I ;rƺdh{y'4:ˊZ kN!8soܦYDc8:>~ UdBlPvs{n-jU7Z*}QmJiU>r$8WJ47FǜսyDq ச㯻2CI 8oq 4M<,l!,8VeM}RKhRZ32nݯ v8!& g˼[$ pjuv91rXA (B\ÖȺ2(j/sҒ#5JЕ_6x:Y(˯PjT2E=sғ_"8c{{ЖOa&Yy;,@$;Qk'RM|eKRnj(h;3*9-o_z3AGsC"; ܋k1X:uWT;_2}/`o(Œ|R mR7%5z2y^1$eo<#M46kH-p35;! Co2Xz%](u-W[P֐xfv)3<9ū>֓c.^?o!~yX`uͯ "s `꜊*>*+t |/1JfvfYԌe R_gL]0mxn;5)i͘W،-?XW.9RWtzRA/Ǟ[*_95Hk9NF{"&}.y+&ޡ?x"}G3ܔ_;Ψ=[4LܒG5]YB8`29 yM S[s0,GDl68…UXChUzJki8I)hf/sKrLw@X׾0AuK8ڲ}~(Q<o"zshsh\Zw6ZH#HqRuD"OBF!eZڦ¼D߲fj9sPP`]kt3eT}hoWJ_sr!JkX Jde@a$=RoFx-7d1 em:V2S+xxoWzeb``kǔ/M\n] hSIHqD7+o,:V"c]K34)2,{_CWCL'v!%cP+֥xǠP,pb5j( @|λՍ}f:vGĒhZQy ,t~֝$թت0S"ܖkF7i1 v!að=fwB>9/1|}©_H2^U3,8s=)}9?U/MOYɕ>k_nRE-2O3ɲ#8NWVf@v#F*BQb{SŠ' b_kZf4??@Uɕh*xiBˇz`Q]t#`ƩĔ-rōYj2,r Ҥb3#9Wj0mBGV@h.hރPcweRŶ_($)!]te2@0{hޤAWmAڋ G uvPvB+4Z(v}̯PmifO0!b4ۭ^=нh>yxM|/5{SOf Ogh-zƹ+4M-ckdtUYCW!iGVhJEj?5y3\x,u,Z"T@[ k> YxUw0cmqx+o["X|m&{m@Ai߇0;S w.><85<#4Gw8͙q/ka)0-B;eO5&$B;k=cůg3IJ3 Xf] Si: +⨏BW=4jCQ0>CVl& 2coy!2pЕ{%ae)A5) wxo`toԬ'Q X噠KefMAfGy/}6WϼV kX~@9==NHBUO;0(*Kۅ!s9lV!P mxuuI6b0 s֑ s@@ǎ_7J7"rn!E\.:"j|,fI 4xvdKhOyy$L> *;N k5Yh YVN DYnJ* Mė4-޲A׎hrԑt{8AbHL܋ɱv=sAd cxMK8%Q&D,GA}'X Zb.O8\{)!v QB$CJU0߈@*-]~Tb'O>b,ɰwл2*ut;JhK k%Ot>cO *fXYW~߼Ԧ q;4JNeC+lJG/_%!~rl t,kvSCՁ % _U&pkˎ[+wjꮮz%ME"ɞp\ ȣ[8#? +P2k_Xkƍש~޿(}'@vp^NlrpS$Fظ"el?;$/%[VtۭTDrÀUM)Ŝ1h"oH *\}-h;j+z]>w?gq UB)׹ ,PWƌEYhCݖ1VԟV,Em<0QNLs ·Lt,DYCRw xeqn{5l@/O+lO/{\Pܳr9s"P 2LM۰6U斜"3ħ{Qjo) R\mV8mGp7\tX?۶8M ip@%Nνp j Y#.)ޙb`m:ߑA ,CPK&ʏC]%B7@f?΍&[InV2%?S, u9qZSMM8U_V@()$>ֹ/Ń @r$cu{ #a9A`*|d6ǝ?FC>&ӇT2& )e߅m̆e%|4lQ:~`d_G/#]<[: 7efg'瘐/ݱyݡS d]>/G$Z*/b'rsf}qCu᧤I巕본H;ج!ߞi'*+ 3pAڕC*Qp-Ug{DhvntXRdwC@e@?tQi TEډFR3uGB\ks5OSs, .׆k-MI{~}gMwQ.ۛəݎA֛JzbA JFI L̩3Pݴ|&pm")/`ؓ9K1Fn8k%'$$p;J/BWSF6>W61Md7VebfW??,:xf_:*m}o? O$bd8'!,>MřffGm)Ya@~إEٗtRNV($dcVQ,YmB]90s+5uA~+u$Wn^AxBP0`?xW\ro{,5 cT(h|r$1IrPU{Ч|!0_;VH_))-jPEFvabz/F" +8sP6y$(˛' ŽG:'謹,~; mA%tU'wW. {&-1`EIhep]*(ÐmO/*727ev`_ğN+S-H}!ɮAd%Ż^mWi1:خQn 9 ߡ(sWqaY,3L76D|8MsM\JI&_z%ˣ| ]Eo-ov% 98ݤ$S)Q9nf}兟jO)cwXvCKĖ5]Ai<HH!G1%g(Hkk}41,Ԓ[lv Ebh]1$A꨺TȄf8rT1 l1 t=33rbad!+ SmYT=&+"TFkbS'~[*=TiO\J*c^׹nQDSOXdMSd c\SGyYk %K)g̯VXThymoʏA†wvBT$&YXb&[o.=;o͂ i$³6=]6AZTQ8cU{Kߤ(3&Ose VpT؜'f] lN=65|X@6ݘZj4Z $_Qb!Ka/FQKN]##"6y?v4icϷLݼZ|wOl=M.!AX{&_ + #oF.ӥ .,__)B#e'.IbTE@ W[M5"|`j$$Q1wvUdrs`'N7y*z3eSʭLK> U uJ{8^H_Oҿ 2|Z SDb2C2Bzv|aZ{3NDEKnasڑޛ<&ٗ8_E:J? P R)?1 lU9"P % 7z<3ݙ 䟹lpё~kV:#x:z9؊Mv멩1y;xXJŘ70CY nD*=ih%i Kr?DpLQ␝$I'..+Ή3#ŷ|xYmb&j|ק+B2p,+kxiI +Гl|O!29m@F8 ֩ INjAP輞ۉ0\6Ee+f\:Z: ƌR]e! _aUZ)-']:;K9~!VJ$%wr6WHrNdC="NpMBCQZ:: +Ԁ6Aٵג"42!ڗ@)ښsbǍsO|ڔ -ܶWC\J۪}׽ 2>Z%piXR[Jer-2Ruxbv5ZB0sc~ &rW$V/:-n!459^X+>1N'}C ( .r JF }VIR+(Kg[ypw^%I~eG{hkg Q|kR9Ev*zj+ȓ$,ݤzKǿX0]Co T4BNE Oj{$$hQb*7&:;1G- An/qgZ2Q̳0w^7O԰ ȃڷ"˙M V;7JiW21ψFk!rF!Jc妾dPF|hȞ={mS3jfߴHݞ+k>>X*Kv{y 2ٛ̆"_neHlpff0 i#صyi Xk[o:]{<~2J `XCr1@?_:ހZfnO?.`&QS'K6ĕJE{3*M2@?&+/"ѫy'zNR}(+ [Y;܍{2"Yn} LMa Fߦ;C~.:V]KݸlG߱9k{Ρz3_,\|d7ۈ CnA R%،?95BXD w#܍_>nak1zyƦr8Q&w`V0Ce3XaO:8\{`mK1>LvԠܽP+-p6F,q2rA"񽭨Yt09cbXg{t[@tdkבaKs`n ԟ"_~)R>J )r%CHvB\Bo'^$Q@VK Rk[RAd1=[nMzE;SAhyֈ֍Sxe',BeH UqMxpcf:m爱]aՎBǷgV8ldElvn8_3b"CH+Fƒ]2L` ]N<8ji!&1Bڍ[`:^7zqF Sow ݋.n*!Euyθ0/zp%*Ə2Zӝu"f,OR\OŘ}ΟB 6c CR{%F¯-,<y:!l .ӯ0Bf{`-8$1j.wro4ܭ)^{:7nYT|l b'쏳bx2H:et7C Ofn q<<M_G}pn k[0=jrOa@"BodGٟ-5]Y^|xdALP,_`9IwQnfYڊiOxhەf饉y2eBԉ}2- ̀uc-*uMz_ "C֜ LhZ4S/Z]TKF )S*Ay@mD8 gxsհaPjag`l)]6)Vn<5aܘ q|rR'h}KoFӄOly%"L?05cBKM%[S1!Qt 09J2xoφ2˚ͿvUtm7}78v(K΃fa ]Ä-}m}nzE1YoM2+P!/9&Ԩ K7gG a,ԆDsW:rҥ|GU"ayqBj>7yTkFȄ#S Qg)(iZO7j+xs%nw'M84xr*gQdoa_^ "LG6Zl9T鋾F*)P\ [ikS15F~]@The1 O&m@1cw0Fm+5 BY EaEUc(&H;Q>dW%g~G0رxK1O󦎵7 /!:ԅ 'FrgӥxPX5>J ; *phuS]O'> (:@C#q ۻwt8ƌqM48Ҩ 3b[+(/|:{1Su+FFlʝ4+ߡT79#8r}>>Q$ObP3?zDg,>)=*F|f ]DMo" 'J5-W#yjG`f a'O~<| 8% Tgڛly1>KCZC0X"C?Y&r ]JaSݖ/G4,f)MFExdûCҜw))KІ$N8V~/zJv[poqKr7+`-mFޯA[?V57gЋ62w8yHҖ~+,# -J'cB5,plrЇ'~)iSzm@[9,d <lqT&D=haZV\&gQAd3Hf ihto2!2Πz6 e2Yك- MۏZw_ |#` Tl0;dm`sAuR1+g?ta`E;B3t@IipFтPJ~Jh[ZUu+H>hF/wǡ=NAfSYѿJW x&=+;~OG?.%pz D/`=5JbĖ]B5ITOPR/vA$z:tP8"i{1*p֙Zw#UY%{Ǣ&`eÛVu~gu Nc(&=, TiVm.]C~nX6yq`TvjNr,ħ1[̰qqŲTW.רm+P[z64'rN 8\Ny KIv.3$s6 ϯ,:ߠ_S܆r ք@%oܞ7G%<7t\T4 ✻ȬCl>n+"Dmgwԝc;۴D. h"!o*H޾8+ij/I('[֩yO3vq`qnΓ\*%V݅,^.dlӓ{eBT%q..vLkDw<=G=lH0Fo۲D35HXT-G+ߔ͙+#O~M3\ sc2SB15t䴴 y jM.S\tpqܙd~2q&Oʠ1#e"A n@Sugjha/J>O7woפ@@ķBFә1wD˭'ӕ*ΠA S"{kofp\eV?0@Pq4.1hvϚpaУo0I(qY#P H-'Np(rBsb9z=˶0l / Pru`z!ݡ/`W(ғצ YUb SNѠHʡ9W%-]JOñ|62d22/CPwsOeF-(-$Tl!5 eTW8ؠV0^?~yݢHr(/%{E"j_?/Ψxv'ϽQj4' aK_:VJOK|/sZWj#uE{9-V~4n溮p0f(۠ho۳}koJur \"7>bVgpFq9Va$6b,ݾÉ9 a{ݹ=3:x [E~G! sIOxWn:?Lp~z^Nkgr[Dkf 䊧˕2js\GazU߬er)*4MG-1czYFz]Zfw]e~-ew<jV/,WRweB+ ego"d"|O<fFw 'm"QʉNj s#0v{ukܭ4ƛ'}hśfT3_SoK3~?y,) fkSivJPb\oIU;mn؆"9yidL;MUҤ%Αhu{e.Ah D4g\= 6C\/<}u(1?mV4l3XӚdce4_]Nx^%O"R Kn8iMMtH\%A@&Gi90!C-248>x&eV('qeg =y2F&ohh,AWXWopqw&elTw!_t$QH: gO4dS1dz5' ;o#E1E2 !Kvԇӿ7oE#OyF(q@%a2x.?X7;Vaqt+$ZV~5ԼPM / Y#<J)& /cg Y瘚kxgO(y}/ҫ>wnnw%^Ͳq?/Y#l#Qo_\n<9pz 琢T?$"V[Y{Rtf#FN+$zzo__!h.P[/agm {4nD#&0](aHROjQRv -f dGJu( zD2xeeӃQ1 .pE*XKNw/nR =O),N w=\w-ƹs̵#' |RӘ5NBt]lw1=hR$oN$%0TTq2^@٢:?x2it$e 4I5Zjb٧pL]{3]]aфӚ+<0\]$JkrFneGiV¬ oN*_gc#5ܯi=*fkSSe*Y ڼ:څ(_s]Pm頴U" l/i%vk,en ym  ShiXF!q?iy?^?INt5Z#Z̬mk|D}~ 0$s!\\г306)Jէ%t+mpq(ZڈT }:!,5zdGA xk\$A;FҵWus4=1`K*"&ewc f[A\3:9bПvRnC4\χH2=Y#xnNJz;NFQwE\ܔ U7|V>E;%(`}Dk@Rcj?U9!ٱms›Xfp N zԻK.4/Y9@$^ZbNjY n6.m!T/JשB W#&P~hiVS)>"R?e"|Y/rs[[Y ҕt墵U~_݄xhfeL Q5km|K]AsAe@LEꏃ~&B B.~-d:\'M+bo,UJͅ۹?zXxИ%=߬W6o@IPʼndO#m̐+EqK"9&WHɇ\3A q/9v HW ϙn!V7vY?*rr6MU݇CįeN*Q޶5+dp:x9rL3oN %X\i8ծddԧ{ֱ1MHd_3[okto ˦/^[#Cb0Yl&)TJ"غ):I9H1׹(2OҡT衺O*>9EiTGjr{R]%6-)*'$!ʹ[T /`jz$Qn7$#tfy߁I$Xjc 0Γ,3,#QR" zgvhvGđAг zR'>Mu3+i >T>Ҭ8yq|f#k=EČ]cb' ~,TݹZ9m|E/c g9W'A޼#v-HH.~BCL-)v0 ]iZ ˺uu_ )tXk2z&w27d_JY1)44>U1ځ$ȯ5s/bC~MwN]A2(*ѻ^lMtֱ쳰/qI.B[jmBa)g_mP&9{>ėk.>=}w+y䞍73=}S$Nc-W8Ը$w0/6ڏShپPIn.Ai3=O2of}=?\T[_jڜr@bȟGnU.oy ZY7 LluL8x4boƒQDY[GLdK )5fǰ%Q lfUG41)B-'_ؕOnG y&)8ȇxYP:.#VDx䢦5U:L|$T p*(wìtz⊗[s2# U4LÐ d%ެk(v')}{/*<܎fvz 4I?g&Kg5+˕S:KCŊI RQNgSglmo_]: @BOJ,vė5O~@lf﷭hb[@^OJxJK0NV vn`L)yؼՅm?$1#7a4 !^B+9F@:XcԫnX|cЯv(Zq]w!H< YBbt-VB*mЊ3d ~va R<] 6|gNw ƪ 8$/jʾ0pvn}rJ,"b6H&Z@GE~dXGKo, jh0ا4c(P34AGX1(Ti\ЦA!^l8Yb5v;@*q8GH$m-ASKcN0=tݝSzT(liZjp]ӟVQTd'5:cnC>vsj1jN\P4.p wA;YBW._!GVKAP{`ThL}%Qj *1h=%JTRfX%OXWNCݞ@E4WG-ٯH Z;|z}S}S248CIp;Ί^]!HEZ2^Qی1&5GYvTq n>A!m[Z YiJ';0mve}N!b7;xt 1S0_GhX1e]u&Ony_뎊gV|d6Wݕ4\yU&j{^"ddhR2VyД= =^2̈oӚxreu.Ԑ3Da#?' ю#lْyiR/FpVsq;ކ~}ڰ{D5?U|'XIԁN_BަExeRqᾏ尫dFl"da3޴r S'N!8H?~8<K4i7n(\Ѿ]|o<6W[D@vD,'לDPUfo]Em 6ȪD ioR$ ǵ=LroRdXK=vYKy1_$>;L23Su[@ i=cBE @_ ʓ}|r3 `k2!oJcY'ZɣX=AShZmTŐtRh ,A^o{VJAfZ@@Eto_/h6bR!LY=Ϗ b<{AdlB7YJFaո>܅۩2}ބkЩk©3Ou3l*.43g;EtsM:fy}>TJ"DsE4{SJŅIzg{Pp=wiC=H;'(dTv/ ϰ;uSu t.ObZCo2y!K;6eo]QT8y׼oRRDwm}3dz9ݙ v93odʾlq-'˃%`?QPcupۏ -:kCIUgnB :ޯ L_Xs5vsWǬZ$LЭ:oӶ[qζ@nN }&C0sgY》a,IZ`#HDZYfm@[@'"E}jT=@sOh?sExZ\~6lWܙ* T 7ZCU'!3_BXQ.}loy"v]{>q6BTL p?H͎F599IL%%D~)T) uHț?F+Ϙ΂gOf" /ۢ!^9cIS[l>I!lwvigl;u##{BSZX7͚NefRGd4W}` $KXGѯV]RDV@Oy zckxx@Utv0'|׹yĽ-OYU98 %V=yi@Rk൤8췫=?*jP7DeG 51{f(nb{v4k\–DAwLV]m ?ӸEX봺_f 0cD峛ea3Jv!?D5$zA~6DJ]SD {.. (auSϒ<ȧ @Z~k9́0NVd*=b#1zmdM{aW=x&ϒ =3~Vnي͟C#;|X⦈o&}tW+tOgĺ &w拉y)/3tεk~әf ? m~Τ(.X[Wgv $T-[*|~R;k2B`.YVkâ3Kper^VH t8DCv2sijN'LDe#{;sry\Z{XV5>6:+ 8GtzBH*S(7ܺ:?n6zKZ]xEߧix˂ $D Tyn><cУ"uˆ tf*zAB~劚5k* չFgP̯'W$rU$ u8$^Oq hUdWl4+&ɜeUz=1@y},Hߚn'V+%54Aզ]j{HVE,L! g^~%4-P5w[H,1m8=K Flﱈߍ%flRkݢ?FDǥ} Fh +t`Esi }棾[_-[w l%]S0%q?-gа"xG]e.Avhכ!7 U'Z꥝ iP.c|*'ҫ)FUn>}iOJшB V\Bg[2ۉ1zCX'p Cg0#([~!9>cLglڮ  g!:K8e&8)w(; l e~chvVGz*j tN>Ew~j "ĝ%;2Q9v&&7Iw&N#ԣN]ȨVPKT\ y4e2A8 QSi\s G+sZA?4<ý#3iZlivɕ+Y_!4oyF`bh*׆T_z!{4NK$,-ufmZRG\Oi>l%tu~N]5XUQwHm,(> ۼX] O1 ì Gr{7# Gє\Ox؆5A#*Wr ')Lg*{;~7$Cixz7hLod[kJoވM2BVQ>5Z@ɟчh,\NʀcfeCݫ\+okP"MJ7\$A T&fv2u!(ǺQZ"}ᱨ7y\޹&8Fx| ( F5SОEصdw2 #k *i 3 f S~ȯ0/E'_ -W:aGz0Ol,$olm0J  J$8; C'Hڷ;^<3}ZyaM"Ռ&_R.b _=G`[(Mnc =d~"a$sRngl)'Y':ｔ2[(ITdrIƏ `"ڭi LyJBg.'ba[igtm!܂$?h]Fv5Ϳ[fBH nYHHGs =+Z[ ގ.͑N-4KFufiEIjbSkD@IG%/]gafӋJ%Sy8?xj &b)!¶},l+e ݙűum@xޢ+--k05c|''Qb/$9 ):sA=% 9 z};bW#1CWqIM6 ,!`7sf5|W1Q i[/$<5/gtRtnt|ӡ/<Go\'S/؛S:`ePhcm+& _2C}GSf ;'q ZRp 1o}r ajd "<3_ٴydƳ)soxRpxOzZ>ovag Z9ꦊ?v.)bnॴeExlpwX%@N [KQY4ZPֵYb7K*:c3%7WǓ|JpC dJ-ey O]ol"^ d))vWp5q *V7@s{"(`˄\YbS{GFbK& 3@eJ۷~\\IwVb C,U`Ul&n/ 3k< Xtϻ&>cU$h s,o'3z@oi4 KR# p=%(VR#MֺtzNLgd@/.\KG^1IdqwsqnKst)_iKzfH"z] LKo*!礚]M*r.2BCLfmX13(in&"=ka쇜DŽ\`V{[B~ iTŘ`'݌3,I"Stg9]e̊> F_'ԱzټJ|l6rluI(Rdlgµ҂wj QՋrҌekhZy C[i-o: ,[ Ws9%s˯ʐR!h=͚٠ɶ;(HYen,_T}KZc׹ĻzYVCqkW~!tb`S m".pC: k ~Ib)@khCta,ؽL`9ko(" &@P=+_u?nBfFq­4BfNL7"Ms@_y۴"nD})2hC[í*q0ܓ`/YH퇕\F{v+9@dX`ruSgT\C U7͍tȦ頙7t\@ \sVB$`ߐ¤vS >z%Yy#huzaX~)$Ω6e[zJʢ2v 6z ~@kM2|VqxS~d)%A'm0sKOQӦJm/A̝(U gs>6}$ECC bc$QTLVSޚ'"8|pyog%9.!9/uiEKp\~# @*yڵdb 5T|or3+5S¡)l*e I I)v C:Ov1&+B: 78ǐylMcKj Sٳuj? Ѽ{]+ڗï'^U S۴rԁ2<-]f1/Y7V`7dO,_NTx]8^ <5 OuOENM-5k{\ S j#? ʼnl'3ƗFroI eۻptjj{ -v'W/_<%jI;ɒ2K̻Xsb ObyE'!Ľ~Kt3,z;jo׮Bޞp^X`3ùܽP=|`]aь53Y$4;)% rgD\U5OscU$mT 9HW rObVL'gu77a6>5 m:9]9x#.89nd _(r^q8Og$\@Fwϲ/7ɈֵAR1ey&7@#?5M[)!?^%.͕'85@oɛYM2gsپߍby;Bs2=H?Q|t3a4}!㒱9a?-&^9cd*k1M$klM0V9a[>"BmAzwHRI&@fD Վ'aj" *I9&֭Hͫ=?mxKwڜ??f{u_C4R"p`4*QYJ;3'KQ%9ɚ.{vx"w+~00"ۛ8:TD4IIbG:z^JhpQ}j?@:K-9܈T%Ԁt5j{M/u)#}&ȻO 쨐/^A#It <[HLJٳ2jVu> ܃ЩC{x.4i)Or P~NhW|~fv2KұTNlkR_r  ly,n";J7M+>c}ⵂcBWf,P$CXÜ`DH.[(s*ԩg7'bg}ur*2 \{<0+Á!as:95ŲPI*W@j"糏M&SU!,sz#VмfބaSNr ZMB_^ <5nO (Yu~Y6@ Hd}*4]Aq/GJ$w٬1vnvh1) xC_m;i"a`Vg+k>FXAuz:Gjd`*X$9;vF'8l"ƓFͶ&T&M( wo |M.g#DVL0,۝TA8'cdo'# ?@Я('eD)b$߹"Gr?J>#Ф߅o K&@tLMZ\>Fv1"/OT/g&n=iZvR}$acS])W Z'Q #@ mi_n<=pk8T̜"hpT(Wl&$/8)BAPljٌ%ڝ b.PX:S*r%f|]( E"]%^<򃙩xvi̖:ܖE 4^i!l&GnpM{"<`6SuD仍cA  [YdK ՘VbDiq}P0P]Cu?MY`*īC3=1&p+q*\|~{i6 1 N9=-!98=;k:O ipQ871 $iݡBs:HM2%kΓ)_w졝'ÍmC5kF~G6+ﮙ%o5A|H8 _bʫ,ޏyuu(6s&ƣS8j=(mPrq#{y 2m*)ΖCZZ \tjh_]n&so?RC Z=-7L2zDR>Xӧ Amvb,Pc+%V#zr~[dOg.EUDC]KcN*+uy;M W1) "m! vf\ g3w_ Q})c?uf@9w A*J3}vE}>n:YJr;͔r|9PЩi ! AzmPvα3z L )Ͻ%NPC@v?MCg3ܱ놅}-[/I_M)ZF& jt-bnx9r#A]#ӯ:,`$AhDfEnlՏ: |sFR(eb"8/ )ЁfǁTxc2 V**j9|@QPa.Ƥ}?x朰'O4]lUcr,ނn7q/Xn܋_" _koغ1?@L@T[Ԡt7b_s4)ڍ^vb{N^n@8ⷯRhY1:;37YA6 -*y_92Ka{ڿ {HY^1|Xʯf^sKc͙j#oLΦڇ- Ilpk},@ff60zmj,Nr ]\&5vl[bBJ]~#c["*Ec8ch.9lVD%eisM`c6b`߈>r`pƱUOKL%I5% p#R}˭q-[qvR<ב4Q m_ї#䏆bSt;I2{kZG EYENt:bLzǡۛQeӍ { kL@%-|NO>#?u+(LJy؞% y3 )c qѸ':tN]\v)6lE+Qb2C,R(2J:9dfj Op=b\P&h b-Y[:K(F}2$ 7E.V3.ӋyMV!k@5s1$B7UWD)rK 3M(ԘԒ+iDqQa> [8`"&V1Z b::@_; eMA)/J2:^u ӶĆ dF7a `jk.(f@ߩ M,"/'5U23`]o^.#QneXaDU# zo$Yi&Bj7'fB@;|kLGޅdphCFuTk}0H}Y!?O4>h3ἳ(@nXp~2!>*;-銀9]m)| g@:$#e 8<2T}.S.w,zPOC& *LcA}@yQυ6s^G{GB%L'npN1b2AġՠVH fVٍǻ -d#@leK_ Ch? ہM*pb5]D9hI5VWLveA1oxΓ$FYccL@:\htARv5sHosț+'MXyuec|eI̩6rDʎ܄]+ xYǻOP=RÉ)q =:uf?fiW`i꼮ih.X0}N'>~TyUAB/lԠĨzU]E$n٘-nWl@yg;Xd_rHn6JW5aʷn{JЙΫ:U_~K@' `j{w|[fZO])1IeOj]cm+ǛZ M_+!GJq+. gea#6&e7v3-:l1Žܥ)yK$dDžsI7Tu rIFW9,IEb{=]|8Eod;-cE3F9xEX}dS%;9Jq|^j%<[9d ! &I>5!e- Q]|Ń`b#n :Pˉ/5?JCi}nM א2<"N{pC>;Nl>{kz[ 3x0.e53&wgAV{>Y>lP Gƭ0~pǁ'[2Ed,:qv8U[â't A ˁra;MfѣTv"VlqtTw.xƝءo@f+W4/XtAʶ`) p"i񺽷/f*R[ݨ؟t7c4 Ѽì6c oG23ΠQ0ȱva1c[Łw;r^N10Jk!>- ][* w&rg)i?B,̏Z{ _r\ o2G Cw]\vaQvUMo8^29":$5ZiFJb/Ȼo AUB wzA[TG YD,xLEPÄ߿+jL:4;l]bvRfq̜B>Wn.X3ryul2R0u@m݄^2#K%"@OaEڄn\,{91`dzd#l)no򖎩 ; ߁Z} >1lϯ ,Tq6@Pn煟)w}ҿH[p^AI> eMU.)%>`bU;Tk11Gw%6u ݼmP5o{΍K$qnWΞWQsw_ 9 fFN_ =>  mSքjBK<=fk`Nnjba>ϡ\M p.4m!<Ӭs[ynVP!i>RrJnxow'vl%o94=jj>ʿ}dBQS7mcS!*ޏwD6+2iH&ozqNy/M8s,\o~GB4 !~#]7f*jҷ{Tč H܋1|SԵ^wߏBr?=B&z:Hvq8jMN)#,x4{Օԑc9O| 7/Z1V;7A6]u|i[qlG3i4UtΔsZmB A;,npXQRUE^юA',7~ Z9.͆9sK]w7h#X-]B4[/%UF%b#IܧZ)5u4mu5:79uQ|{ToߢWm#Tkw<o·W~uJ^-Q! Ic?5 2M:yS'hz (oZuf1tݙP?yW1yyq&sQfǹ#@B_b8|S<%@KPzGʷ *f;'fC@HiDx]]̤ea0>N )]A] pV*ӫV#BxH9Mn^*̕3LD EFCJ2|#ϔ #d}i_%H_BH.6VQpTrxP[R˃cz;ɞVLuaMыIYJ}#&q%HG%5ƳuϜv6ayoRy'qqERY w=H4IՊE@ 6NUg}*i's 9ح*w t/*t.!ҿ^z[{3=17~LxԏF{ID?l>w[[>h)bqEKۂ{) ?^Զarx!kʦ(ΆkCV9]W)<\!y`cy7B;`=x[PϺ-N1F-vs&bE%; &qG )8ֹU"O#ˏ@1țX~NzU7F^ jOJs8CYD|ӍE*9Ь;e.$)ɤKa8ricd ^13A^ʗ97;mMx^"^{5Xt'?uymoH~׋ _inwtwd8'cS6:Ĉko- 5z|YtF$^P}\amKB_ܦ 訞.*" >H-"ݼEuEH# =ƀOqٌ4.Hʹ< 0%%ۼ$.*xbRs ˧cՁ}\[g.ؗ&Cº.Cm#ByO. ReNK@숥@hjg1+QGg0W*ؔ{uM`ܥղ'@{y>vd*G!:rJSv^n!1urZxF3oGzv!4YHǯ,"wBf(Ɲ CnOӠ\cNiNm.Fg^ed_5&#w|F =,*R1}vaM4A2no e!L&`bRRZC ەʠ~7`,OO!;Sna~:2S;`LvѪcЦk :H`~-ଈ/.*ݮo5t9IArY8hMc=^\۞1 Bx-%nbخ.t5`7 Ql?g{^xcA2:) N!hÐx`8le >S# ¢E| |L ]a\P;bݶ|~MT?HBArRΝ)/fZ$7X+uBLmCX*ջ:Yƍ@#Q+ßHEm0& ]r%*/OA#} :a@`FRS:.K煒QHt]08_ ~?C/Rrm,DP%$CfJjωzqc$@BDl7[ 9r "1[b&81[D.vD~D֥V]!ng\[gN*SMk3ӣ(/#v~'f>8 ҙA=Yj4< acw*OcrSv@4v6{9V>]3ufmqfkѷ hIxJ@?WeåʠuMv}'6!&1Jp7KSY³5{_@ #͇|yP_0qܹ[65u{{7vٵǍKa d!f7NWďPNb) ô{SLP[S$OLx;wg~(ZwwN<~|X~,n+G_[7TPSdO:MD^Me.r9n_$P. kƧ߯S:74ʯ>m2E͹K/ڈPfX7Kf?*FO\e;Fa~ɏ.TQϋLnZ: tf[ʤo$r<8 h9+Lk:P ƛ%^m *hKTtхt([cHd*ը|ǹC(i~(QZFNDWLy&`CyѾҎC{ul"K'=ߨc {t1~@#[pca4" 8:kv6q۬:Tk?$ĺJxB/c4adc3$*9&I~&ۏPU"^+/^WA(`pUMhI*{f\iO A *W®̠WN\1p M؈JU"y-Zqn4/^`bʸ6?W>vD`,^#Rn¹%wێ6-d =Z<|2H|ts<Ze\W@Hw)T<*\zE s™a۽h$ |W2/BY <GLo9k8e|FVehD5tA`0K-~̨yvMzUe7?w8c(5`GT-\xn̡e;,r 6Y/8E2\ 3iSev-,Yj ~Vָ-&j%G-BCW~ScRZ|PBv.^[_t5 &幈1p$$wkN[>ܑ>.K+('x=1Yc:} ye}5~7JIxz0@,%fla f;(zJE%AJ< fՅG%V3z7lѲ.4t2k\7enbxUs(5&m:(1뭤yM3&o F(h8]o":C9\ pҋV:zH_Fh\G";Qz;&`jmZawE`'K|$ v9@P"VժFC EXDP0=dbQN䴸|[c2m^9gGrSϿ[ [-s&Ts< L7{)#| YgLd%z#ʤ#Zno(m(&).dKGKo&*=$ýU?ܢ\F|2-$ʓՔN%Xtա @c8ұao4J7v*C;\ӧ2! l}r39+YjF6P\}Ô({BpqG{],\X.3<JN3w9Ҝ~#@ʃet=RN2\sgS MK[ l#p^ C@vVL0fЭF]IT<:==b n (5 yPw07ZNb*5.hP (Kc V]MDd`jX;7$4B7K< n+m-c,TjDEr?.O#<CISYG}2Ck$phG s4wf;9+-/ʹoh_"dR4놎p=+)v_|>su›h; q%03{n#?t'bsd% DWPHI!0d/jVEu:muFl1lhvǜ3L2A@"UQwT$9!ד8. 8c"(F<4z9CkGpːſ h2/U;,eNOY5T[+܆^{,QZNYVò#F|KMY'5]jr;y<, e JT_4!h}i$iˠu.FSQ >.2hAL*X7# ðHN( +O 9I{ :q-q|LGaGH!-CKrT?''^#0yCQ ?z\0@ndƁA_k+a-fF^zX( B@ˬ{GTd-qDNFy\%$l?~fk#%6tHP0kQkr fXaϏhŅ yPNcbQBO@cøBc~w#} O;FvѡhȮW&1G:4RmY-=~?-Br%ɐ"|n52W-ҲwO&_ ڑ۶ְXuuCD$otiR:P,f2ch)^hfn3wJ)`,> zN}ו\:L#h^\hSYZ%bov gjt24kLHURDpf=IzE}sN&OH_(ϗx;f;G?.Xư&t@tz&(BY \\nDTs}鶀@3whݫ@_fedqIO(+|_dmK(DsC/y}VO, $sd ѮU=EZjb|nXNhXڣNZ(BxX7*Y|A%QTZ>F{[l,ka`~Ѓ?/r w\)膡8:e)6 ^IFr.8T. HteNz$B>`|Bjt\XAdg?ɌxXLH؞czه 4" ]׮ bLRS\)@l oT3wݣr 4{|[V#ET܇61^Oh/QrqBheKJmI+6/"3@1ᶛƥ|Gjx5 7< q"Iw;VicZVR5}2*~d1en,f4T]@V6=T>iL`nǕ~Ev 5ry{yI<$<2$UT"].]soܱP21W )K֗ `B=4FQPk:HJ =sF;k5U7aJ{HC+`x9v׍ΔThЃlVڰ]TeۏO n.QI 63n_SE>e|Ǧ,3!32f'T%0{VE0I`#h"l9HbhuvvEkb A [ȍG)s2i6j'x{ꤰxϮaD'-#l)=y| yhg~OjAhCXX PDiÌL3Kh~ӝ%mQ'˽a3ʃjSf /x]'P$OD(F;?Jk@0?M!^Ζje`s'?l$Qm*(<;l >%,&kۿ Cfp0w{MNl`1bL4꠪̈́dS l M#=ޑZ^Ȋ%I(%tTȦS$$̐ϖ6Q0cyyBw pt"DA0-#xX\"v2yU.Ӏx;E[,K8BxE:jk): z`flcIAP޹UEfoZmUawO`(z]4Q(Jz7U dX{q]Xeiy?nm}9ey>40`צ*1 Gk*pT4oR#gQSN2մܳ Gj9\ib =KhTTDDګ̻ E(zhYatttb,x޳ICf$1`B)?ioä3 Q]&SQ54% NP)ǘj>\< p*xlX0oyT߁mvޓ-$ϓzeb(K!fSQŽ+;c5ߥ,2H;~ DpN/˾8PnM)@AW 4|BRY⯰jVA' Ɠؐr P聯V,A+5ʣCQ-*hIELH87ogE nE_4pW?_ir_)D4kC̦ 9m^X5#͓cq (~HLV^V[8Q-|~IVDm^hqcwhB0tn;Z,_S^;/Tfy$gt<{0O2P& b/ R|۬7 C` Tk1OO;UVY=w?{"Yxb1&@Ҳgd?Lt쥱,NuV7b2}2M U}&̘7ޮk S5NH@GpT "$>Bb7^Z,kw[kn?!%bV({4N$>cjq *Vuh+wu_6 }gҤ<'a⸞JR3M]"kU*(Y1nF y}UtFRqfcBei&%_GAGYmSBb6Hoݳ'{ɛ΃i1]m:P g%|3m{ X(kEbA:J5Ջ_]zό9O?؄;DCilLgN k+_THbL=/ D{ ;*˯=#K{JGĬ4;w$sSnt/e$)"Dy&Cbh/HC;,eRM<W(2&YrjǛf6QD4?-RWs ^~pe2_OĂs7fFdNOs\m.RjD d+'>g3Ag5k[X7цsK<;ucH_<|BEG[pU99+KШE1ie^enQkS{ vIlTQU"kEgz'bRc.e L<_>hLAL# @5@\fJ &/#l _I˃%5 v1xڳŎ0Rt; ʅ(j8v2}g3sMUJ2,6ʸ=FQC^WE ;IigsKbJ%:!4>z/P%%RƾBʋfg,ރT̹Cr"!zBgU@@WXBh ]4l!%d͞ks&mԎ^i_( b5HUX5_}r2!^~_?ڙ|5Y4IpcY;Fn0At.2 fm6Y ̘9#/ >ZΤ;l[&Ou^xƮlZ X :F,=Deيl8f>#0Q`޳to4ogKd3'HAy#N'-F@p>5Xԝ"fz t @̴}Y`qe軗- 3vyX Pg1cNT|8L\fѷ0u-JGᝠgޒ4!$1-Rq&?[!Ul|40TZ88_Q9=@eB?4҃PXcxXoz)y>cG!s<28'p$ 3T";GVwl&4Yk2Rru9GTTnP 8gjoH;Ya@,LCAaEO!pëGÝc! ˤY"(3RmF~jʹgR; ﹚imi?uTMrKcEre.g5ik̍Wt:h8u%< ,7U^!^賗"t$0]`gN`@ֺ(ܻW - |&?0F-^Aљ^֙2C&_u/4s;}kEfs^5o#Ȗ蓞0'S׌˩ hXc; nR'aiv(m OPfE.',4` uVIybMM OUtP:`RTc?"h'OO\L(ҋ@pޮiR=O.k&O}灧 {:BV)HfRX@E (Aa1Td;lY_?^S_)4܀;,be FsaCLhM>'\>$ ^KܗS`fuT>ž-iN9%NBƞfır18! >.h[AC-ļSٓS*0*@V,' dֱ-ٚH7XCYHv|a8ź5 !W'{uc19gwVƺ5 I#.ƯR\]# H|Aufq5rՆ:\P)GÂ/Oh]bfjT0zWm9Ѯ7UyD$iESos'd!3F߅``ŭQPY.΍L)a˯ coV=E6t![%E"DN\k6GKY|VcH`ѿshJFoy=;vUz`V蔇ܣPH95lC"AlK6kD!aPqMr"&+d]: zF~F{|TP"8z>Y7jN|LYM~ uGeUyRaGyᓝic"** dnG y-rBWK|BW$Z\ZyG[̥B2ĔzИ]$] !ohS;oAzޱi{,B5Ssäli׿GD)֨W;E>. Q·8DZlm*-a`zA꼿NwWl_{YFLhJq\c#zSO~$A1̚N:LGql߹8􊼹_ ئ](Q!.S5"wVɩ8_%>u1캷1{v8mId orWvSC)WX-e۫`&:v3 L[.z2>(xbz;i$Uu0,vP!4It\[trG셆A~Lq Apisf#mHd8Kbl J r)-fq;? g;UIrF)`k7ARѴ_W~ޥULӴKe{lAu 8PC9\Y%;rH xm6 P4G ktZmiD΃ęK(<2;d߶9~0;CXJLaBԗ+̒߸JcGF5(8);qѠp:b i}J[(UJ}":?ѓH%.!2 !Df)ƚ~9/ v U2=TJ,s̞@ $ >Gzu9 qM-w,]=3^Ў>\6 WGD#\!;вc9wm&E}^mq',,i$vΣW|u_yڋ1%I4ོ=2˪Dm ￥<|~~#ʰ&v`YB'*WԫEmU*:$wfj[HD?zB$a&&ob^ZOg4M/-amt .Ic&s_C@7$ɔ!n)b':%`zcm*QFCv]( ,Lf0陒*vBV௷)Ut`)Yϓ띥 f:/5y]kyU:;#Ͷr`a[pCK,P]{j H/pvqI"rxgHċQ d;H wqH8- -[aW)ߺ:0 !JBbZ̤lN; 2>TglGP$|L^I|ɑү^k5!!É'epJǰs,>4Ϝ!/4ɇ[?GXԀ ^I6%[#$.~A>if]@}wdJZTf}J^Mp 6Pődbۜh#lF8}-Zi0C}#)}DUט\34 v!}?X*2HBJ*xxwck SV2c-/m$rS!Ultoܰ=q!j3ǰ'}-kzUbgwףh`" Ӎx<M9Ƃ//hb90)J7@|q[V/p'QV()Hȶ,6e6Sf4+Y&MA?+˧NklRS^= . `kEqFm'_o7>=z&`wZOͪ#i)Ib@)cd^>ulo&عrLRjgU!F݃3Bl7qR%<\Aqkd8l5( 7,SM8!!H[ƕ_9ɽ]3ɺsट`?׽8KO,}sDd/R84OǥpW AO $#Yk_O2AAB^}^#~:z`CᵿM.|uL.C>'#q/`a/4.Tn!PZXQǂȎO]=>CR\_xZiޮ^wr?+F)@;Y١4>pe :ʨe. *q&>! ~~1^bʐzuu;M;:%1[gg\s_X/g%_y5\_BV)3܌%U0S1mc]O~*7R7.{2Rih"?JɄ&!WQFŹ8Ƶ(jo!uf`I6%}ơs:\/oPX% 4J?;\PQR_7Ll#">Gk` {=< (!D^g )fE="h0mΆuwhOT=+C{K;d㯥ԁyɬ]]IqRu ǿ=v%,H,uΥK$!&$})zsٝߺDQ#5+;`1!5J (1k/N=Rk4ͣV7>f1ki}VCO@ Eb!^vA ,::Iɍ7\kw0.yŽˍ hX2P꽉Hrm.Cp6֦ ݶp{i٧ojUH@PQ2>_w:~,6I6McQ:7_L e+^̤#+>0d8q#- m?g8l T7k3 ]Ǟ8t[_ond咬˲,݉|;yM$!Nt2.:ie诜}q0ZӽΦ]q*U4#CWyi1=AӸ7p]+xiZ󲈼4j1Q)D/^BBYGn*Mg}muV2ڪ0{y!X?mс[6&`0B#LGzQ_!؋։(ԓ <({ k.v( 7v0[Y+U0xcis'3CbYT1ZKp- ѵNe6"U;"OmY! '>-*H=BbBw9l#ŶW˧mB=UZyo^MoHY $-lv O@5kSsO:#j9 X@%Cr } ULLܧZB@wh= ]`,ViVXEM @YHGN!d}2 $}:N(eXU!`0KR3e*^LhߦxK|UY"HZSq4VSv5Z4&cF6GiaQO,?A<*z^@Ɏ1Жkksx?g@JDh 8Q!lY~aD+pGt7`|@R"Utv)mڛ"\8!%-a01ϡjD9%/"-817*kw AT(o,b; M8rb7||mA o@ܣLS" W`>vX5wEzoQ e°v)X9Ԯ+ûh hdj&7|mhz 2F7SoE5p!tA1;1?e񺀂I:. {c?%;U[?5yoq&o6nosW}h1\:PY.d\1ϓ"BSL•tH EjoU}|yu]l$UzN"Q2Y.)|< c2(6&k]{?ZM7}W|W 3K?Dja'GMZ۱Mf* Zq ʺ)dkBG D"|B0ʇ@lp0wh :MQ!?i14Q.u~z76)yQCyȞ 4q_p8,5cR@+XQ]s[4!j$s¿q`<˦RkvvFvas )0s>G;`-F X%zyOe$n+}2v'^P%15BViӂ0Of1Z+#P~xt*3+ ^ے-z˙Iz3 H':^lҗn_8D@.%:њx) }Z]sG/ \E*-A# |r#MrZ"ru_*0'>Nijm2N;bdLdAieƚ:9Vbcu!fB^'3xoo]kmT;V* k'NU7sy~$|'3fnx*iz*G{ysѫE0d秵"8873ARYN+ caaI/xl6k涖^wIe( Cobٟ0SG4U㇋!(vGB^CNGTAdro4=&$8%+"(4f}:qmP$/A۔F 4o8DͽOnK[S{M<9 Ź`N19?V<\ hTy.`w9O,sxRbjC5OV[|0Dhq/ =JF p q hǞiGu@hHJmq@B)%K7y(\c 5tJO2<0_9."|&`4dmNpM^ %_ogJa8p\g,"ަ<$/!V;wuvHove6ߡ>I]G(q !eYE'Qs0Ƹ* -;ҤIȼO.} /:;b9 p-}0:;IO =Εb9Q=`0T+xx<˿+9L)UmE멱v;?!4JVc7ۭNLUa,Hl ư?,p&/%)X@-%wA a)Gܥ+$(볿¯.rVnCnCŨA6ϳV'ھh `2-=O#q,Rev8`u+X#s/Ԯ"?1)uIs/p{%o=k8aOʭ:ۏ(-U|no (R:59lӳ:Mj{Wso+0#0Atz*4t?+tS{,3H|8!×-|ٓ,BdC*x59Ÿ(a}oW c 1?zSD)k èo2E&]SӦ"/,0陭^:ߍ#s98(\dBI/́^>\TDFhE$QnNڊ5Xܐ廛dc sRI <+]pq).W`+ qWMe(dPΊ1f1ŽF%AR*SeEZո ිk;X[$rx &L]]=3jX5DTT/atG[|R0}nEcDyp\ED-K ϿK"ݨz"Х; -MiҺהyc+,j~s{ a1V0 IR5,n7Zg [(U%+D Jґpl7~>-Gvfôc>:]} Oxj6MĽhC[&Uen ;Q( < @_B|t@UH/276QHr8?6vy6Qp_[e9l7֞A //NDMW{S@`=׼]CGf >snQINj1o>ߵ&gX+b!QDn՟f bfEe Ŋ27w.PX|LE2!W7E;A/`ET$#n=M*P㚕4; N1I],p3w g^p;_<F>@dȶ a>2BSVOZ ؤuCeND]q㩀ukBL q'k*xkF$ č+]eCMoMʄWL4_MHV%MUDHvG4mR:P'p!D&"Yیw"U͆Z8ݻ 5ALdϡP4V|2 EAn 0{(]hWsX fɼ ~]2O9"l]7{z>BO70 cbvPffܕpΞ>AqvFyj}ln\ 1C3{XNx"8?] Uک&Zͼ]+MϠ,`P2|H}&|)3e-X@D@w<ҏ%ɀʯq! eIaf~E]Lo%ub7@]:rlZmn?%Ѥ fEZ0s)SV"c(єI[]܆>!Pͳ\[ oC)$ikae5\y N\j `puQЩ`ˑ$y1M,QRS]=^Zթ7:um@(,]Ad() `n)8x 3wBE;pȹ@`&}X*B(D{ɀb hA[ XKUөzڈhn?fIy%u%!٧bŞPgXvI·$8AC̓J%#QF Vn>xm1.NؒAs,W ~Cwa"D~=ϫ74cD&U;q| ,KApZ;ۺ$'Y-Q+bԨ?,4Z/J84 1eInֆD7mu8GaiQ0ȕdfo85qlS(Ng&}Тbpn`;;R不9 >ryF?EzydW%Nv#"`Y|q\L&Ԁ-L/BTQ"V1pwN8hx_Q%aC?{\"$}#riVqgZ[pT4* ExgzFx!!hnb}G]8G+LS,5jz-UGaEd+VIKg㛄TB } /*n-UBX ,ҵ[R\ā/# o;Z޻TH//߆f/ Q9!usAZqT-3{~-;JH09>PtfJ6|bV#pL|e^7PZﴎMY͜ȦC_`̘a!MwomuQ#Q ǧ yP0ry*22 _WNx#!Kk,Q b Aj~\:)+/9:^ O,_LbDM:SۀF2 V6?(g"I9,y7KzC.=HV黩acNhrQ\X4ʄkUkj,J (Ѻ|yxUv.+%nHŻ^ѤX\ %oL9 IS ?TN}^XߗTP0τ4IjQʹgF`ǞJ<4=;N_{juv"?w[ձ?$2X*k?| j+"ۍ2hMXn!c1QdhBHS›B:Pf_ҩiֺpsN4>Je=UV7Lu7=Gn#DG@6 u²Q׏B^KZ,h["1ǮY-v|9DseBr6ajyVY*!+1浜s`Ď:NS_4M$p)I#X w)EnWS'sz! ^4nj7]$NyE$P5Y%Ǯ@8B?9C\`JUNzde5=YE|j~ZFsERpu^U\JQ\,|2GK{]QN:q8H&jzLVx=0acW"Wrӵ'_ښ㓛&Ci0EG=!(g=d>ӑa̠ " Ϳz#!aiQu6״`-w `DxJHF-م^pu$g9ء!JaL1-%E: eBxaxVA޷ jV8:b3ơ[J[eR8r7'."uVv8I7uROqz^58EfՌ+%ps{qbkYuʌ*j;`Ns^Oh4pǷY/iԂ+\X~5UUqb+Usʝ(fο?<* lۆu%owY󘐂֐y(8 ƑoQ3k;{xq2Mx6?CC:bVӿ:2t Oͥ֫W8:yEt6ݱ(6r|bh(4Sֳ05EϠWV7.r+;mLIl`UF] DR3X?'޵!;-a|/65L]8UIձo_}"#_E w ).Z2) T/h\JN7g~o A1Ph_6N4R0Ÿ&;8}iA U@h`eʵ>:<{bJ\ʌIc(5)3G2_ÌRG^ƿ1M.'-1qT]@3sm6rcKZ7X6xH]eJ#ؤ3tLԽT ՔЌ{_HJ \/wKp1gaiY[ɇw.Vvr'uWH(/rmhBH$4Jt~j2ڋ-s'sZ^b +B6`GS P{rJta³x-?qm6 px)TFסa `Ҝo.+/FL!&x6񽧒12bsIC}XٝAMGpFNbЏ> @G[-q :hYB]eS3M ( }Cx/rFq HO!Bz7 '*[?n \HCйHnߍx{c.Ș n1hq}J_yUU!qDN wY >k(,m˜ QLi]tWtq^/pT=(A$uոDIry#vI+P:'@Ѻ yc˸5J /abVXFjUl88Ls&yWh;{D䩝C\1)"o Tm~SakXQ\YVIίxHvzյ`,li!S7PG)_D%5",9k3`Z]>D sv HETso5 12Ub,DP秱:-iKtI$Ժyn`7GP,=uLTJ6@p/StˤHLB-}MB$=c!UG=n'3X׹jXmBA/ 'Bo\-O4sFՓ%ENҙiK~:D7>7#W;j9C3V樱SHٙ-D8aExX|u9@ fDI[D5k(FZ@mҀ]3{HQ~U5B=* t563kR$|,}7^Cz {2lfUz&J#+4aJ\X+FEH%)iWN!<Ŧ4KTP"Xk1"4k@uv&E;sR\ѹSdo@ˉ$ 4ct(Fe\Z0p2#Whb1KU+|\-BFg[(Pp" j\vX+Á/je"NPwEC@\t?`N;Ģ[CT7+sZvD0^;/wg8x ˆpL,4PH7jT~?&?M@@ &(69 fͥ/Pi YoQC_VcxZMp;4 jM:/5.&],H[Crץ!O޷3tgnaj%l-J~ L88FێfЮ5)Se-i&0K3L?1r햙e3Ia|>Ƚw+tYM3R\GdЁ睽{}xYsTb:Z G ~{$?1wJQ[E5Bw:nƨP\u2n`s꾗mSND9@` k&66C߈02F;ӰڨctsYTԵ |&6& ~hƒ5,p@L ƾ u+(&tPV 0TW#S]t\|[;N ?lfb-ZuH*toeAD{О(K>'\rɺ.ڲ}!n.TJ݂? 7p-wX4ښ?EkW+@֤-6_ {_Zp3$|w&2:Vq d@?9ސ?؅xC.Ԅt\uwgj~W%ڗRϰ/jF`^<nϾv?Aw) R&ܗЧ YHk]!"9|9Eb$^yI)@|s9 mu7C6y*em6ʇA l:[ͳðT ԝ F*e@"<N̎h\U3MzR\-hzD".oKX󬠅|613qpgU{̇#<ɎZp$\Mqx_Աw4L&VbE0 f8 ^G緄`K$u@Rz#q5{iZ@FVIIƍ"Ks+b|6OVvD`77u8 À L,91vŕ4fhC Pi0̞ UWgNUa =QВQ i& tcC?%*^)&ަQALPt6Ʋ<؋0P31C@>tLh'"(if_N=O4A~0YdbbGJ7z4_ O/:7 v<(]Toas3S?H@BM?U C4 F#踋F vƫ%XT ^>!gl2a.%rJAmI:h&wrUX)mβϱ' .oSDӐ8b4Qe_-I7?^  V^{tmO IG! 1kN۳>lL / 8If3Fq0! v"3G4J_JE?TQpKpz҈­q(c{+u!l>FZ 4@ECL=I $nJNjs t{[*;wmt :"0 گ;I@2Sk-1i3/.eJGS\O;_& }5}/7.inʨt ImxrdpmR"هaː6@[{S/21&JoȺCn6t|AN[cBzwFrE`F 5WmKR!o,DaҒֿgF+es̴zn[HPa ^)/H. mWpm[]# ߅ǫrd]_TAotFu˹-/k5uy*ȺR3q8C/C@*ySIiKxG^Hh޺7d&o i4Y I;þvSW_77$ xl>@p2,9G<ʣ%ދg*fЪ ܣRL`0PVR yν kCܚy4#za9jlVR<3b{$7J)͢1 w`O7O;^_#h/c++a>2-BZL_6ޢ>WH5_ySxk ݳ.WRXEB\S/%FL^8u!?%!F ԧ#|8t9*Ve*)Xm@n5Y>xx<| nF\n7Lepqψ&O9AM39@,='Buc)m`~gFNGY3 ɟjN$Sz[WK "2TW]-@[vB|åͫo"eW[XrTd%XH/luE'\d/.j`=z%W^вy&M($ N?: MHqꗿĮ(16O X̄ 顛w$O@r|;dalkb9lE1uN~r*aĭGfj[#ߢ"DtzO۞؛׺)FÖ́5'-owÚt)\]/S>ݟz8qViNE c9gp>1t[0qV㭤F #8 y[R#2eGsDܢEZc;@ k8?Gw^2*vrY?$f3vQOS%J4,WLNeO* w~`_ <~2#D^ B'ހʇ# Ȩc *Cn*NۜlJrJUˌklipsi UãA$-|ezfVZŭUax6Wngm IM 3*^Z ߔ%EDN!3śNgo!g&7Eiؙr}' Ozb?oYͯ.l4p,ģjk6iHC.G6<@IkYšR3/x:m|뇙)y([lIBl6q9qh|wE:2Lsd\J[ t*`Ef9t4f *q*zr[ (B>DWJ?-mih&|( W0T,QYl53ɤOp:i>"#N,z1[ZJ#%S;2Kɴ:!`T>$f91 Fg!}1Yl~KB6:7jD)JыQ[@2 un$ܡG_Pu GD&VЫU7xavp*=PUMwzEV/Dj-);X+HNF!V*n;M"e=aj $3GZk'N*-mfa]ͣRBg Ɛ S|&4іb4 A+X?g4zOCDSf隲Cq'uSJ=xr>.4pA8m$Sil`ɨ5ٰX.?1H E:dTɌty:"i !W7T+ei2i0n;$\ 7=T3LC-V!Q}#;|Eya@xqʞWyN`̀Əӏ`6gk3E 'MT4T&hbLRq`K7OI۞A̽,x7|-@C!FFtG.`o vTvytHsoT61RCc;Xq(= Da/J]dR5Xm}f}2x,cO_W{>@~ "aسp>?-hv3aa ?`>;FJGXaT5V9"OB| J'xiUB wmv[{)"K3(F,LȏR Em wWD^2eHxR' WkْXJ8 ƯzEIx;.C#ꌘ}.8Ve *X}:&r@g@|,Rݑ @۷o'CGEAnUT_@ۓ|Axf4R2Iv$D# [nJ9+&$̿upY/ֶxuQ/|^k3EС{FL`C+ S Upd SwKΨ%!^JWPC J]&T5k]HᛙIuCn8Ao^W <~ՂtmԺ)PaL]d$BI~ ACq2] g? t*@\a$BKw}BW[uxe(К{ҶQ֛ pdu*cFv,oT}&J&c]^E VgI& x0ffF5: HᆡtPhU'/ת}.%?RՌMZT6QqFY-OI{{챛;@> ,Arl,eKv~K!]d3 hu,|'HM7#ZPlE%Yh'} ^9(pk,쇜?~lпNG#w^N.'?tC?ocNRΡaFR9[ؾ=gSǴyoR'b48V ¡ NGFP8)͸I7cF,]x\֎52[0lsSf&ю& cؠ9zzAݛ1PbxOfڻPG :Օ۸I`4,( ] vߺvmA(TցKl (XQӶFTz$);|mOה !49kUYRO')6< 7wJ~zg?[W1B>s;Ya[XE]fjvNkQp*4J7?Ily1I`.?0ɩl#E_Z?6#פ~ $4Y]\U8 ZQׇS7}d}ggݭZ #(w)y{nTON X:D>mn:~/ (?UQxvE8/J>"ZMW}ְ)Ҭr3C)ޣSNj6R0Qa$b&DЈM{ܲ+~XˁKi®@~7w^FڣO=꽋-Ks5/_~CKozsOz<DG #P2)fMLyNY#/NbE.@!kF#M֯&ƥ#V;w#2f:ޒml?2dp5' s& IYbkݟ1+\c.Y&idD2:oT%Jmzs_uak0a#7߀οӂRqB]dv~v #;yka.#x('7D@Sgk,L1bm%Rqȁ(t3\^ Y@YWm/',+&mzf'6su)h?Cy"EGo}pʑxSfpe[xYݽd~M}o=ϓ{~5ʇ<9#anXa?S1;v<ߞABZt{i Tܬh蓓>šH]B ƫ:vT) ږ:t=˖&-l߇Y≱s'| ہ0яJdM('9$$fr"}cQǎꉼ- \! >]F'~lue7~.cgmb{ivU5Z"=3$`JmFK1H.VÎdlwlݓK~?˚+:^`sHEķ*>ڮ/J&B'P[Y/ܶI"'3++DM.|GIG70 bH1sRAY^ tn oɩ8gc,#&eW4`UIo^#k)o}vڃ'0Wę 2pS<_;~ңޚt4Ɠh!OkS5;cj}`pv޺S.-* Y}tgfӫXԸJnwzc[#G%W)"Τ0Y\:K) ѡlF aYbvPKQQ y\nG6ZK~H B\.aD:eQbq3lC܈˟0=X3_GNGii݈4\pI ~l-Pftd:O֜V0u}{éڼ͍m^9+̉JŶnZ$ֳ!at51"MkbeKVڍ0 U}كhEH"W)"NQIs[afӕ7RU뿰l±H`$er{}j \>qX<:˒0įe:07@XYy|d"%J_e0|jz FHTTYF}ι;8ɟnbK3Fkjv`jؤb@FIs7±_##,L֭?@;D6N2S@s&ܙʦh4`g4Wq|i2LhQ(\/fxI#/=yx,?vp/]u'}X 90Av^'|v|X7m!;0}x=w˱zJVJ`,6uLxF)*>#}af`kU]*z=cnۺZ5>K5tZ@V_QE9 s5;=zxZeYe|:% ]% \ptd#uWގ/.3O$/x~s",m+ `V3!q:t5>WvbZ3h8|raiD}7'eTS|xI/?w8I rB}orzpӪKU* Hx~Xp-, V`g]ckRCвSсyGlbd-,*xbAs?lMa.׌9^%k/ Q(<γ}c(%p^%} H9P<4ޜFUuw~ªAh5YwIɬ% "Ж>/x b)!a" | >nBLGڙnM޷trȀ<E|Csҡ'4+В9)}IpL8[PLܑq^Ap2Al6Ǔ-uzs : /׌?h'wQ)%Yl Ybnsnd($9(g',v򦠰ʌ@ 9 %ӯ.D‰[k@Y1+<`nB U|<٭}lc;|M[*Y~pףf>7 nUdN$wg1:U?ɵ8`3 孴4Oe,Ȝp%T ?:g/Kcve'FԨ8ŷbUM؟tRN ]/ɉ8ʒ*X}uEW{sQa4KL˖ߒչ}@WJ5uskA3FcZAd1~G hϐfU{u-{~n7 ҈\}T(;XsU8ZU,SldbuSuwEH]3Ja,j)"S.!®/{x嚡+`Fӻ<֪wJ6 =i ݀瑂t "=B6 f*Ϟ=D?R'YG\DO |+3ߡR'mb"%51A2]1*j\@ mY'pb G;\?QqWMk/mU']>ǞTjɎz5"$$u,x=LWLf/ﶱhOk^}-3&~ӷ@Mc3vW]/XzԼ`+̶;|Qxl׈ RP)m_*޿ƾ_L bF"r$VӻoJu Cn9Z9—6N!.ݠ^ uSZ;!f;km U>;Xv$ WBTm|!{UR/!3LlFr K+yBS#5,iif5HG4e _R(ptv Fl"0ZJwWXݎFC}!\rzc Sآ}{sΣ̓y?a&SDUN拴k qِJ=GN򍻆fV#aX6Hj1C-bFdוAO#6@i7<!`;!WnU=;;ϡh32':a<4z4u {M4WKC(j>'` _q\QXT;id KSVWH]W@Ts;$U_NTs<>O3g]/>-7!ԴXc0(;+v%{hA |BZ4VO99Xc4lM X,]drw2֦ [$:A^ " : VȬ)"}yf:v< Iit{Q07 r$w 󏅛M\Uvޙlp^^;[ҏl0rOyJ%PPƨW얇_smpJ?VDƏ(cvx+<[Zk.$#6XOd}U!c7|bս!n,Mcld};$ji[" >fX#.#S+U.tR tıus3i춱BDa=)ck6|ʔ-ZH>bmږzP!$\{$h 狂3fň¡Tw~qI02Wu8 6 `lA!K`x.}(t[ `k+E}_+_^#f <Vqo g[,.uXB?c+KggEQ!r+F9RT0F6rjJ,"dso<!%Fk CWꈯw<>Qtp)l;#)¼'&,ںN:ȫ52 ?6v$Y((usF@HF+tA=}b=`SZR 9*vkF`_C;Qx}KfTnEGê%i><2|ȥ x0w$Rc\|`aCQE)e k遐H6"M2`2b3^ʞ$"868Sw i5Q.P -|fޘlbDvMU ) nY;-;@9jdK1FlhzZw;ٔ=_l3^Ր1[{L maSbWۙ2'q%jSú[ Jj[0כ" }[xfX(Ǜbq%yhg"AXF(w#V+^=V 1ЮTXpmLյQRi:4H=ct ?C&8i49ǮnVY?ZИXt;Ƥ;![4|h4j%K1Hgz3k\$-)ݰupʦuS̵nq.<5S05 !F}2cTkΪ$0~u#.dz2.r F& "2z7arb/h~KedNǮecꗗ9 Rz2tf~ڴha1{c"b=XLKl:Ip SZ9I1}S#?h _=C9{w|~?N4!;<PD~ذ*U^+^+h\o[3S6'Lr|;;F8Q=BHUi9(M49S +c;9X_ES"軔`Ilhg8Ot;h+N樳0[$QH^lSdx_R&d7(oɢX TX_T\%N S0*XrJ*ۆ PjQdR{`氤DQ 5f]:S4JTLM-Q)cx> ٘Ԝ1kyyc ޮh8a@|Ik])Me6Qw (j|7xD7酨}r*Fy UfS&|R̤JR(-*xF;`fIf<l@_Z{lqcV鴂E o-q29%Z0eK+nɑ5,,0[,oF E - 8rGG,jLD$( ݱAGD>t.ZЮu Z T.7Od q\n y G=v 4,yI([opneλΟ*5⋙ƺOrqFԻż"]2C<2t_Ԯl3ۦMXRUp#/-,EG;tdJx B%U>b? _Wf5M])&Q5Bb,eZPFKymC]Sv_Ctƒh.< QZ <햍2)C6( {O' Jm&ׇRiuv3BI1-è-dg!zʌ$M=_R`# 3?,#LpWєLQKsqU$g-x VUȆjkg76ajg('% ׎`#?(odWuĥU^HŌD B=Uյ~jEyprhs]"?0x|nWAE(J|تgfka} $\I # \@pȱD0bѩ1CZOz{pC6pND0tI7kO N)&tۢNm(ug`s?yݝSF;apǩ2KG@ȵm ܌hߤn 9glV!ՇQve\퇂[vҕ_}IL.F7f oɞ}ӊ}.@\xBDPi#%0z OdTrp54EmӝOevA̠lF>娀)/ac"~™ZX+FN(EW <5b8&D\a1SĦҧyV$(g$t^ˡx+R$ 40Sg"TItntbt5}7c\~!NGyG{ ~5>?72Sh0 Us0/y0tK p/@`RlMB#,2Ӑ=%yͷ.CB)h8ed_TIA9!4?JajH,Q: T=ޑ4h+Xv*&g.A 4``+L&5²ȴBaSC'*F=:v{ $#~ t]axb@;5rk {yos+>6Zi5̍Bl zHBfs+Z:*!G=:XN<8oνC;}Sd]YZx RQSw6w-FqԕLM. gg]ݵ2 qRf WQ3 tW.>ہĥ.B]e#`A Bm z6-Їz3C\Wau *ު!<Ƕ53+Z]T(퐁-oaa-[;Cx^xFg*_th6EmU`]GDHe}x@"+&BVM'Lp4Q!9ѲqTCYÇ;HװdU1_JJ2WiyՈ 7EQD{)+A\$` ;g7cGI埓\䔲@@b9/etcsbm=iWXȤXO^͒LGȬ"+C#"YǛJ˖oC~fMjoT@]1u3.qLjy08I˻"n s.]Ϧ]*suXV1 3 Fl3<ޠ*eNh4`P`SnYO.&nRn&;q(𣿩_O: WI;rY?7D*m5mKH'(3%ޢkۀXBK͝rk"aEoZ6aX1P ӹb.^&S;, @fhV8VS=[jYzfPw4y}j#8<0#N"W&.I &HB]-(A>y=Gli +Rz`碙. "ʱaԝ?5ws2ya!MH.k1p:/|bt=&`?cvuB&Gkk}Q a{K>|wweH/Sp} FSY|9ar3Ɍbez`OV #] xb֩C#Ў΁\H \0^8.ݍ\}ڵ(ovQ|~7^Ϝgp٨H;кS]#P*ݻCMSPjnhB(HS71R٫_!c0ry^u崾"z<%*\F%4.&R܀/8n sYlʾR ЫO;Ղ-`$ 7ŅZ_Q 蒺~n @pu Nc؂dg˯!փ[[SԠi9N%^PZfi7DD*e'>r͘nK{RĎzv՗!!Hώ ]/hz-,#a&i]  [it9' 5/l7 Ze&W&cgiAjo%c&BΚ̬q878/v0N/fj< /GXJ U #:&Vr\I:!G(х8O iN.w_OKJ fgrF*oĘЉDa_lǽ̏9W 5|sFx x Qc}p|?LʅX.^ xrOQN?7V3b"Seghh46m/&頤.0%F!xN֭9ߴ˙Rd^ I#;"%2t{j/"IiC1!ힳMg) nw]a8RoZ>)㗃~*L8_>ر/H#9BrLH^QSvpʉ|Ԯ Kh|̻p6F ],2J ;!@fJ+MLJz~  7HvЃzKXjlӢ a<4{3VH~R\j!ݶ%t̮#Tw[V}$ v1xFO\2GXb%PtB`W 8#+8N3`R'vXHС)j,Y7qط$ʍn I-'vu׍5VzGB^ }(d1Yv+![2[W3_Aۛ}$ȼ8ڊ[orWH¹e\L(0X_U4b=Wͮn)G e/Ng)ɷuRd~f \|M]+=z4PxaYxA4wXRn4#9FL@14IQxGF{p`ZzSaP eh!-JEǂ>Ox4zqɛ{aSL=KJ(l3yzU"!.@."`g@prpߦ.bAyB8Tg@p^pF{ ʻc,^96(:'_ @/tn >&A7Ka%vCC[7\Ʈ>_K]]9:B'Ȭ 9:{viVmupNݮ%yϠd ;dHgR7}T/{ n,?;y?#awú0K-Q4tO"To[7j)k.}DW_iz"ZTiwIsk܌6%/c ~IP*7i@J f繏{pTP&\ zCx緫 z !ҬC6T !7cI+֛㤡ԉ7a3бQ 'ix\=9r xd6oF ڟ6*Z}9h8ןv^`|YWnKpYtͅ7B$kKp/LSr Jﴊbfeď߿ )\*SQ%_)_/y7i\ mcy:ZWxAgMSI)\ju'B̂3P2߽a  >956P O\w}^>5E)40hS q 3H"'ӴODՁ yrl^C=ܨ G5K%(0C YukahJKdnsi6H7)453ӻ|h,T)~יߖj K?#v#y#fd kzYjLTi9vO C /Uv@B^ u쩕+EկH[w?Lz3Vf8 :N\Sj94c纆(g%@왗oҿ~i!xSyX ؀;Kcmdzzh'ѵ s46-`r[,F!S\_ϔQH, MF8N$5 /ly Ţ={iM1x#L!aϹ )c @Kyglk9 )dVGH4,t`R, 5RyxH;9;$L_q\=;qW%~pXעI"EowY?b^ΞO ҇־~*&+y"qa-#τcG7&GzUX/eد(J߄*nz2[sV2ˤ(S&2G$~m\}q/tךȽ{܎SӺjW8=C F'7`NUJ߽h K_4Qo┠ ˳g diES]e 3h}6hE T$hJ?75Qskf;Zipe%VֹXt&Q<p4kV#"9%WPh~3n{m.i%F|,BFꉷXqiG1_:=Cwu-_1c %SW <)P"ޚMg5+O< %j c1F_ /bSc2:@Aԙ T'?ƕ`shE7D5T-w11afl3L$~8k9gFk} tFdh'ž|wc8q`Īm]{y:w3To_=j[2.+rЋksci>%)sb[$toݟzkG+)JȋUB" 1J{x$˝`[I8-f2/p6|U(ȣJn8=-jhHSC}krdG+,gx!₡^"<JW7t"W :9w\O@S` 2"sƓp3FJb#WQSI%u;\)1L ,1P}b  , ٞBRɐ4C}{Yl$9RL>$~H AFZwqb( sv @]R@~ IJ ZDPբ$3X5}{q"/s!Tc*uT0p5\g4mͧu]Q+1XMDnacmԏSQgr%8]Rrȉ "ڍABʕ>LbbnfS9$WpXUv[,G/rgMyx}L&MĘk BQ:Z?&>?` LgJSg3bڠNzQ {v4ڹ//}y 윟Z|ઁʡS}#v_Ij%%٧K/RR>PsvE! ߧcBۨMu֕VZ-Ƙ*Z8Oy2{oӢ3'g_b<\aG弴INfɨsG8nC =~' 1KQA0!ߧgoOȠRxgW{QT=>)F V"bhg,)AP*ODZL6 ^G(YJ+rC:C<cquL|aOY MTz@lf*¹ 1yR2m|__%WEHL nՒ̓6Ԥ 5 .FDdah}@)]ph[b{4_LkM^Z$ΙW^y]0]@ϑVk:ڑvK$|Am"ܹ݋rĭ )KY$ ekk*V{M[ c->Я_[̔#RUq Mp<:޳~H_[Esj,[ԾwpE2'h!iH9'^P&H=iM*TݗW4$" }A)D|~'ڐ{XCo)0?ڨH~IZ;#TjKfm4Qno!'}$f;`Lįq.cU]@C&'$^UNwd1sDl-*ybnMSBѕç[MPװ~N(B杈lJ)*;M 5,pD6MXhJ =I״EY*. +["G?ळK*㟘(\ؔ1bBw] FUlDKaQhN OZ& =+Z:m.͌ ]p VFNdawbGm~kW^fz!r.U(t{%m%!M~\;Jқ@'Aמ`;2迣U} &:cXk) [r[V%c"R~ۇW(FSfΣt)@TZ%D5^:7Æh^F]%cϕ' T QX9ëG՛`Nivsm5~jZ^[AK;rf m`$d("@2. #`:F[%qwAhˍgnVmnA <잼sML}$bM,8lXJΤ%3S}vJ.í?GŔ%)5FHbɣÚOάEKYºPQ XF!= Jg|$gDPaS7Fp彭=9 .>?C6`:z("ojxkSs/7w\?ۚ4R2ǖM7[cFQ63f&'Vo=P.' e:1 g%ˌhԦA5?ڀ#%YhC~wEEUxVX/F׿SnWۼ#x4hRڷEb>2&KqgQnb@ooC`j^-jJ 4≼1Is62_ z)k/$fwIA5^ԧxQkX{v:#s9,ΏmN׎&M0",#X`qzDW,#fLjmRAq˾4mi)㇁󲆎Pn&z??K,Z=p$jyaũ#j~off+qF=5|Taln98^Xrفp kl0w3s F!k̀&Y~*guSWF}ySJ8?oR/ 9lVz\#pEɺm@pv'ԈlT"~pt?R`iG>#&P>![ay_y׵6n/I wBr6xOfh% $m? =^hBt*6<%"R!۸(%#bIYI epiBIn`i0ED@ W<1RC۝AE;XB1520#laZ:g/;rl@ek)4k8#r+YC%mW:ORZWb x]ҎR*tmoHp~:%.#jKҊ-g7NaWX>dgi脗G)[雊#@TeYwof{RG=n]C(Ez:҉iI %0f$_o. ~}|1 1;`8$bf B{%@T}1cnJYZlDai䊚7Ӡ8'FS!ȕjy LRC`c+8}"^UTNh 'q-}_4]KⳂr{*!Si?b^--ڥ]l΄8پ}ކ)wCE ox`bÛ0 yE X0}ϼ7ś]MsOLxf<f0 ;֦R2*`[ʓAsc)n!Au#u4k1 "u0_:ZD!hVz'dqo!ȲՋÂi$[-KcGkTN5$\WE,4@7}@*vF*v#`x/ozU͆49/c԰>2g.6?p{,'Qҁ@,UݖݠjAؘ?p^ZgIf7N߷gH`UNQ;87t_:ld!`EՂD~( RKO!`aroWZAO1F0|L1RKdoФCq6ѰB ܄TlUϿW.J# B^R*;4r7c: e򅐂F|=Q 5R]JPp#jŃnÞ7z[4-:IhS~l4<ܜ'3o$/ȶ-"ҵM| DƑtfYMs0(ƈ~ +0=&?KtV?הR fe^ro2xR]= t}g)m%`?0;Jq&$( 31 '7kI ct⸱Gsz;5u$x"筯0x'b  p*$c\:lg|/2 dpa[FDG_O=v?Hxӥ ȿ숰L'Ẃhe6 F'cNK7#)1S O&7GiBR|p; 0#MyzxjyL$BBtod~9, py3&Q󧦁ׂ=so3b.Ɉ†gJiע/C+8Kt1L}R&<ㆋD'516-B ŒPp4{sLb^|E%;W]T;e?UD??e9+=+&;?Wqr`Qб}#Kk:wW?hmZv 7(DJjBo6ӏ~O#D&?D6ĎItկ.W٭YȀ'ewȃ,Wc`2([*4+ð tcyX$;F'y7)x!.32@Kӊ2f9 \lAJD KЪK67+n}r[*%h>>:GF^,I[{v;L3F#ff4 t?"OaJv.$Hq"LugJu;A(4ʡ+qꇂL r$gͩAf{ɭ;ȕRZe>yʜ(^;hx#E-S|x5fҕD?rT+j$tA4 46vFLS+ W,;z)_{=lN,6r]%2xMڂ?o)%K`2m=vM2Հ?YF'F_-MˌS|Y9VE*Ο0};Bxc >1/V%2tA!0Ș5171̜ $Fi14zOōj - #3iR5J3cE[n^ӘD2j %2C]*^ tj\PQ}u/;UOgӳy*I]O yNiў$]WKtm';N!$ݏWG3#nx|5g8{J ^ˢO%'ErDlZ-qՖ#C)K x>gߑn Z?]uQ>Fn5fE Fv\4{,yB;yMqp Ļ+!K-#o'TBJT> k&]3bG:7ċ(+[;p55( 8faT _];1q6SX&"X/`G )FrR?4cȾ {b#M;Ͷt $O;1=4,"!̹ vtvZd `Zxwx~OwP 띬'B}F2l} qՒף]I*Uv#SqY4.r7l\a5Q"uQԘ$~,"`(ytqoȑHw.+фY TH9-^*Ƃ6BOH9afp "PI:zZWD Z#7mT#I0VXG$MS@Ua}ǐc 39QN.W,ydNLX؉҅?u)(mڃ0C}\ B5%>͏֢>PBqJRnL-O[E`:qCN7WAĥS dC4ޕ[ˬvU66or)ID~@+#(+ȜT[ȗ;8ScIf hJHՆzTVf1lWpX+C,#p=y#O>jO\Y+==>'윪S7iaC)zIfߩ5Xؔx"jM?FNmϮ "可~E. qUUJ]ǟÇƘl֘OlͤCn&q+1@ nhkC<vo3`AKigQQ=kS>JIZqLjHl㡝R-220~`+lueQ߷CyC9;mtR;HUvȊ=۠$~Kdl9}/<Kkoa0 ?6rB>$(_{/LBYUx>]̭ 4;~aB'=.(WyD~3(=<泴ߖA"Ѯ喕}s8_ќKg;|:gj[jmݔlFnԬЍUU2v_p>jA#Nw$Xfz)IЯ3soyMm=,=a%93ʖyo}Ni%E ,ұKp%spss^gk9{3q<`\aҞ{՘nf5Pn2/5%^a' PfJrwnn%fYQW􈀘[Nd%K{3LFsҁ$ަWhoC'g O*!H#>~|HPp!"ׯUf ^ d͗uiC5nwOT3Eĺ KXWFHênXCr|pHP~F`ݫFu Tikۍh_y;=!aq-@bJcdQsEV/ c"33ZhH#?:n"Zik7@cS+̅wApo]rTs15rrm1;%Hv,yZ06dl0<7ylۗc]\ֽ,"@9I^4!9{d~)+t+V% :[i>B*"ZWuh "Ý4|S=]%hwla_.[@D}B$gGA"811ԗBcK֠ CY8IH0 *HY8UZm|ܛ69z(Z~ݕm¡G OUG 7ҟp$UM j8 !'JUk.zAlmM{;Q>>F6P1`UdJ9ȱm \R*gэρ^Do+x}i{x>b2ܥSk3~9;m ߏdG? T,5Du!:Y;k*4DlٷPu3K \nZFrh:3QUeSN9|TE9[G*h%߽)a}qe]Kyt2ݘ\J0aÛ nW?("قDZާcbA \ 7Y嚦}%%(ȨG~"`X3)CЗ+7x4EMM.Ӡ{ wԧ: ~y+2fc(A7)S07ɛh=k?'X=.bI Pֻg@?v o`k4h /mA< r=* 89U(zƉ 8M((P7&v7o|·(s3}Zh(Szb/9ӥQ %)߾M y%b@`'`=EdXR` (ˏ}ՠ3d%&"|zH&M? ^du~. t.& CAA팢e3gGn&c8d<'a_}ZʃI1?;vFT.G5OyA'QT C]׊P?ױ1xͭ=Y.f9\rR=~c $u39\>o"lQTꘙ)*Ωt)uqVд:ҳ 0RG1m0BY1G7O{M?ZOF0Z xiVCEX5}ڊ6>T3f0|wJ}Yo^:)K,D@Jbj~Rp!Cyk[$gV;hce!]Do/iD5ˋ>GR"\Dy% `Yel.)z)"ػ˼bxr2.jr4%-Ŭ:L!x.<\ Utc# c#`΢ͩ8IVO=AjV;QRZ2Wxb1)Hŵ!;i-)#9bST=ZBcx6Qg*4i.f;fX԰366𫽳.r#,y`#JW1Tg$}!L܆X9P@S*GΝ?&Ÿv-_;SA.áG+Q dpJ,\JDTka˖0sk 8_cJ~_Owc滶T6Am>LW FΉ[D3&$ 3zE9[E \ ] φ 6,j?(#M~#y'rG7Ћ9 Cl}f~<&E1yA8ƾr@Z9Zؓ ]R+)V?VFԧ UŁdxaN@Lip?E(k^D09 B%;L3=Qnz2݈kN86Aͱ $+70p,`I2* S|4)͙kaRpN!dvX'"S^ߒ¥K%.W!K Ԗk5eqUpR`awb;'j0)9tF!xhDe$1A+EV ɸD5x ߙ,%nmrCo8^]#)gM5 ѧBj>+}`D9ȫ4`WY69U;ZbYlt =;\jo#/X0 $VQzgؘ K泾6HUۿBXi-rN !hCI7ڃ6 9~ H*9`4>4CoV_=&P 0m%A_MpV[]Z{βشX.ԭapZcwy`,k5VV#Bj/gh9{ S!]?*Ec@ ');?x~6YF@3i iinj +j q)p @MNjisÿSYɓFaLaBn5yATӭ0c "6Wt(|OjȊmi*}NiP ; yQLuH =6#1x8V^[A P~&Ԁyk6.0G0{TH!%h0gL{eO_gioK(6{F~OtoR6n I=t Us["nGP/GR>_x<֝fad#`NEZW+!m*"6,MXUf㒟7d5ÂfX5'L?9K5oGݾs)ۋ˖hPg!-`78l:]U1JKg&jc>yH*'b:dȤ@ߚ JZ8$Ql[d\9 cV~|3p1o۩ih$j0m6, 9˜<11v ](("&هw4S鿓uILDy"yn6fbdkupeL{p^YcYm`mxs(9+d ݯFQrE*::D26;Fʋ"x.yN^6q ANCQq,< 683 xLeScfInng/~*zV*:ϏXB6hCˍƻJ0@eЄT-XRHGFQL)1(_Y@r)"o#@ ]֌&JTK[1^=-bL_* Nbf͊kfxN< foIX<՛+z" {Ptx;)bUAY&!%KVKo.ƽ1f lC_ˬnp饇O Wwp&, [A0<͐zN}-A\tR;t3=y̼O lX4BItmJ#_v)AåaG!գ&{$UM7%!WNE%kkspg&n`=zz˙Ў?lEXԉ# }眖p+sg:V # FH} 9m,Aol)6:,*ޘȨ)Ҕݵ6)vZY徇pdh(K(|P WOsd/R^%m {'z5 UB' Axq'c4dWdB .k2ތ\6zv:j@qH'JqCj]LM6ƪ2:~J'*Jǁxe4D -k6U{4}lL4fH/iʛؽzJwk[PD露[B}Wc[uՅC:~5A?#vU:;h;N7,SJc]榛-j(g$ԳVMV VkqKf9*it &_zZslS˹ppsTNeD_i%MtEp6s3aNQl:iT#gx V7^4/ N3W2%&}t&[]($4_ㅙк\ X2w qs<Njm P8v_BCړtcDAw7LEȀTJAup Eu)w;v{r #YZ r݀ż5Lە~ a]S PX%āp*~'NA*z =@l QœS,FPtAƷꚠ< )@§e%tQ(wI BhJ^5gicFXzoe(_Oϴ8WTZ,YyoxaZۆD ćp⟟G6Yo)hBű9!dktxt19Y#mESػp`GnHt# ?^i´wJrE282ڃ4wЈsP:9 ľZ9昦/16z\/rZso-ӵm6a zhe%YRdL(./"8$6kxRy T5Q[ ]kШu939vz~^epj὞_C;=Q Aի#x}=x pv_緖&a P@* KpI8AD`wB nV`˖97*JP% a2 4 MW ?Akd 㷅Bck\ߕGUEB45u p*6Fϙ٠W}r[Рx¿.}O64 G~|<]WRaM$'N= @ jW$@xZ,x9F>!8.ɟ ٜ}y)W ,h@x,&"tчRiT /w$v'\c A^!+ԲE*a8Ox tŀ s'[j SGMeA5;s).F=,%6!'mz1UYǧ?̶@J֎gQ2 XIٷĜ $%wZLLqG`!;E4#!2j6BQm2׫ZDy_Jã ` znǚ4ʲ1e5-|J5ZP-5HW)@X:G2*/ƈ_ Qn[ XF}ţ/KZvKJ bQ^Ŵ_NM~m M A 1{|$Xc*Enq[`ζNvyǺ֞ \y)?$RtE)>C7 t w{<~@y򯅂 )ۋ/ϋk5~SʶM'%'煂C f jBmޣfJPN$9˿+fyMn`ccF2T@YV}d_5@V&8I{xB#M&my;Yi) ĔYX.ZɮqBgSKN j ]X &o3ByCzC'pB,۩VHDL~ [ձ%31^3q} "7OMg^nTslF =H7v;sg:sЌ܊@MavG-ϪַY@xDsٺ$^T+9r+:3^TG*kNشXP4JZ#?ixjU58K$:AJ1dWʰgJv٦B&m6[nlK_)wvrV>~ĤK: 1gA Kt 7+zᅵ{o5Zv=b8?HyX_҆ 8`H'4y4 `*8`b%DdY~>DVjX 8Mee9NIkBySŸg0%HR$gRE4#J򤎦BָJ"pZǃPq"e3=־_^Ir4D/J'W{ᓐlɶHh|=/?_/ڑ?2 )μgHԂ}w"hnvXDK{>utZ&ɰhvW=MwzKug@]j6)۫N/nwRa@*:ૣ5)˵[e Ag͍4H|a9*bҲ JtȝU$4Mī'B=ٙL+OʭA3ќrsO`MBe/@6 OY.Wj l@}SPTKڬy]nL;1Ѯ㴳cY;qƟ"Uj~OGu!,a=H6!QUXWğQȨ,$.x64v# s*BQT+SeBH}.8lzU4,_v~i 8˷E(` ,ޛ_L(Gg!=崯#SBy%ZpTdX9cȜ P6w9${,`UN+1c?5o^X!EkHCѽ2P ՐLm[;1}!|}P:dj!SADЀ:|E TLZ{1jevw%.L攋yN -Ӆƒn3q 5VsY1,g`5cc7U:0%܇1Ee}cA{ x,T~q[p+6gK h7|# ZXt>&#ˊ!M-ݗ C:H`M6cNjq=ŭ8po$ /H2( [uym B~cƔ2G @Y|f]yC濿z.) k`cd} o1Ōe{WSTLsAQ.h\_ ?vy(@;!x$uAm| Oz-w ~eM,c3~s&C3.۴(lOC۰#QJ>+ǿFúp(h{2j鐃 .yȖV#MEw VH_SԞ8IO}5L$~ ̖:,?ᾇ !KȼI8֧wۘfn /ҖF4ࠬ!uԛ9A>vSl`wKm-6ȧ_3c9>tQ=x2Yk"u<| ;{.h.Xֆ+1bs27ýL{c{CGZ óW\o4beAqp0~X72dv8y2I[w6(asf~>:+}9G3P1j+Ejz=̃b"d鎕#lW-+'PӸ ڈGT7IfTgMljӹ0{HrU&g"LQ\+8C`YOvY(bvŢ ~Ljt7J~V ?|TrĴNM 8=g “>uBMXP-/ẛ`Atњ0''l@kWj>3og/oRN:+Dm`ٯyyIbJxkQ}?+(^%AR⢰B+vAO!$lߟrAzŕv%5;~D"*\\÷{Խ|v7ZFH|z)_zQQF;v죭<'863~[v4;Auy]{G$L*J9 pH! PoBgR &S/gN9꘸XCai\?SsɊXEw671t)WԹ ,! }"5ZB9L緝;"~ד͑b1wT'3d(e-c|n}wܕ_H2/Sh-J.yg i{n5Tׇ+~NqFY ;o +/W#qx|J8\AOA<!ԕsҀv:v|TY\/~Zx%$V:sVMuzmi"ٜ}ŧXl0FtΠΈB Auf] X݋Etgw5娆_T)-0ӭǼ.onTM5G.FM Ly{.'AfUiŖ`v-8GV[`8d]jx ^/Mǰ/$,2)8X{]k:M.$D -8puW!wtrL$, R !%M̷<+Ɋ [m$2hQ9mHt v˙Sɿ^ SXBnyoT!dFݳ e)"5yTKޛtXa2,yVM'.=6S2m~E8MZ״9-?OJ -P]"]1Adh>.)ߛFa^ j޲_ :'נ*Zosϼ#Cc&YVXJDf413 6U)yRע(]`Pڑmb.ʧ8V2#vQqAVc^QBz8̎O7XOog\n (YadgpA̯=Ԕ&EbZzS ,:&ivM΅VГBA,SPtNh)O[=ty}?eoB(ij;V7.^@蒼5X@(ʫ?y%A4bgޡ4lyk 4;qW " .TF1 \2sç1xGhkzƄ0 xs r>5)\cRV^VψRxs ?H'"ԥM?m.kqDoڀ"4.iפHp|(~{ F\B4}B;Xh!j=MsV !NKTAI/@K4.Qh{PQDB.MM3'arvu"䱗k?}2#s2jExٟ F^ItfuTaې'[w7h-Cg]9V}l7h[!u | Vqoc v(?AS_!6mj+Ÿi*1Pf0#htVֵnLQF~Lp!ńܘhl`(ܮU*IEðM!LMQ4T>$^&Zf>-,ֿ#@gn6@$A*;7I"{qݯZ@zqs5 7SA:t3S^D>䞗f'f2\ ←S|A 9Z 9UG9zxnVYk.𯪜!wSHS 5/k5bcp%G70=%hi/ZHOǓ4tvAϙe#5Fz]{[wdsE` | #|N. eYXࢋFLC?,@T4طߑ}Z^FN溆 Is{7hRyK6qr8` g5B)n1JoE_s`i3xW)۪VJcqBC21:8m|6:j=ϠV&Xk&lca0swҰS> p'W[략hϒRuM%k'ڨ_;B׾G\xFEȠ`ݛ 4֦:R2Q!%|mż\1f;tѧOb"TQ-;0i&3BߢXhh1k(؄In]S<[3ɿݷvv9if)]iOTԺ״(wd^׻<=NH)gt8M@v5[qm-)H g@ h\QcbB`~tƝSIL4)W2tM:+j"VhN754C/ o3k@c0y9="36>_{dDu> ZBSA('k4sSR ^"paoO: +=m+)PRHUP}F(nf6f]G~(7`_DgUnPzDŽvJ c/{bjr=̷G b[3ֹk¨%ָX ! 1_^Q#RgnM|(cBa^s:kGTK3?ȪP8 >Odd$ޖ.Z #n+.'ky}uOX@ ,0FJԢn;; Y|O2"wEK/ 8X٧ZK8]``W$XPUx{ /ɩֈlP5Vw !Z<>i<(y8~^qğB3֗ &fGîx$bufJ~!~8J8xJ6?E,P@Eу4S3^C:BrR R<ĵ?(1 Y[e [2]Iۡy[N[A@aٗ]lZ<|FEu{/]O!|)w|N=x#`"as #e/t寛HUK3:y#Cn@9ՂOB}^+R_J+V$`rEԢ`9hA2hRGqPm`EͶZv2>sᓃD/_|z'tQW6K1H:ZC4VDm4Hm[PHL <iS/pV(F}Աx2wËL TCcWM'P^S!O_q3m<dOgsX̋ovW#1zMy&G3h=Ճ{9_Bzuyg‘j7ef8FNi%vNzSժ-x ?,)-&vH9*Ez_Joټc߀,^^[+?8¹g`2~)qO7 Jr6ư_&'t+C5#b[(w6b7Zwq\׺sjd\+ޮh{F&$vH ے  4J X FVtf?bYeС)iDv b1511>z= ^\@?Il8.PiefKN0` Z*WA1d1E|4#_T׵jC&Az]-hjO5ˉGrt'XW?<`Ǽԍ}_18wv`h|N,Yl'#RmǽMq6zjC[/KKDZOB}E;gSmm38z `*B\h@W6{t +L9~ÜF|s+ Rej͓[UmY21-;{^QGBe$ Q6N_26&8z\ dieϳ(}4BaSU*:pTWt݈>"E)D`eyjV[1sy5$ }dUbuMΊG-^ˇsJƹR gMÐ*9'OR]xp"NX35l#Y)UFt9\@@EqWV|&ۏ<%C?θQ 31KZ%Ƭ{߃:ElRwݗ=<1a.c- Ý|Fū';SPeӔ iZ>)b:Nw’3H3( ցt}#6"{=pVZ eVZaM> 5iWtut^R'E q2vG!̥R;4:mnޅ:Kkʗk*@iq:,cfj&n9 ۄ2̑u2 +%N0Zm}Nx826tJd[P0fF@[$񈙸Ⱥ)lbbы|/(ҸHUȸ ~8*溽Ycvb@9@ `6Ͼu $V%E$uLm}hM0HPc6hЌrb3h"2re{6FA"&>$-N+@ͯ^c!9t,  ^A%e4a,=S;%-hfb0cA)R[Pa5@"pR,y9ٻVO,?pA)B!p4k[%Ð+˄9?ck:Bs>Cg  g($bP/P' v éf 9ۣCopX\.* ;zKk ./A EzQ;hM b0 em2+ .#a=,ϐjpe }ӪՉ"H*z޶;fb ޿!u ů