pki-ca-10.5.18-25.el7_9> H HtxHFd_ ?*}}F &ZCz-q_+`Fd_ ?*}}(C=i+)j >1q]v&>8H?8d   E         $ B H Pii i i <i p%i rixPi]iji08 \  (A8H9:ÓGiHiILiXY\i]ti^Ubޥd<eAfDlFt`iuiv wixi4Cpki-ca10.5.1825.el7_9Certificate System - Certificate AuthorityThe Certificate Authority (CA) is a required PKI subsystem which issues, renews, revokes, and publishes certificates as well as compiling and publishing Certificate Revocation Lists (CRLs). The Certificate Authority can be configured as a self-signing Certificate Authority, where it is the root CA, or it can act as a subordinate CA, where it obtains its own signing certificate from a public CA. This package is one of the top-level java-based Tomcat PKI subsystems provided by the PKI Core used by the Certificate System. ================================== || ABOUT "CERTIFICATE SYSTEM" || ================================== Certificate System (CS) is an enterprise software system designed to manage enterprise Public Key Infrastructure (PKI) deployments. PKI Core contains ALL top-level java-based Tomcat PKI components: * pki-symkey * pki-base * pki-base-python2 (alias for pki-base) * pki-base-python3 * pki-base-java * pki-tools * pki-server * pki-ca * pki-kra * pki-ocsp * pki-tks * pki-tps * pki-javadoc which comprise the following corresponding PKI subsystems: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) Python clients need only install the pki-base package. This package contains the python REST client packages and the client upgrade framework. Java clients should install the pki-base-java package. This package contains the legacy and REST Java client packages. These clients should also consider installing the pki-tools package, which contain native and Java-based PKI tools and utilities. Certificate Server instances require the fundamental classes and modules in pki-base and pki-base-java, as well as the utilities in pki-tools. The main server classes are in pki-server, with subsystem specific Java classes and resources in pki-ca, pki-kra, pki-ocsp etc. Finally, if Certificate System is being deployed as an individual or set of standalone rather than embedded server(s)/service(s), it is strongly recommended (though not explicitly required) to include at least one PKI Theme package: * dogtag-pki-theme (Dogtag Certificate System deployments) * dogtag-pki-server-theme * redhat-pki-server-theme (Red Hat Certificate System deployments) * redhat-pki-server-theme * customized pki theme (Customized Certificate System deployments) * -pki-server-theme NOTE: As a convenience for standalone deployments, top-level meta packages may be provided which bind a particular theme to these certificate server packages.dHsl7.fnal.gov%'CScientific LinuxScientific LinuxGPLv2Scientific LinuxSystem Environment/Daemonshttp://pki.fedoraproject.org/linuxnoarch=mL+1l[#tR#1J6 _ S }F}F+ g%~~[G7(b)[J2 O,", +Bf PEGl]P'n,1{{% *S*L$,kI,A,:+A+3&u9 ;#%##"vSy "`./9/]   Q q >#E/#+{B/'m)H nrtknvpyi  *L*?5%C%c*m;c=O? 9%9RU][  T \71 0VCCF6CQ& "Y"\><bc q-  dF r- ~-d>Ed,g>aB 1"?%I7Px]%A큤AA큤AA큤A큤AA큤A큤AAA큤A큤AAA큤A큤A큤A큤A큤A큤A큤A큤dHC^2dH:dH*dH*dGydH*dH*^2^2^2^2dGv^2^2dGvdGv^2^2^2^2^2^2^2^2^2^2dGw^2dGv^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2dH*^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2dH*dH*^2^2^2^2^2^2dGv^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2dGvdGvdGv^2^2^2dGv^2^2^2^2^2^2^2^2^2^2^2dGwdGvdGv^2^2^2dGv^2^2^2^2^2^2^2^2^2^2^2^2^2^2dGv^2^2^2dH*^2dH*dH*dH*^2^2dH*^2^2^2dH*dH*dH*dH*dH*dH*dH*dH*dH*^2^2dH+^2dH*^2^2^2^2^2^2^2dH+^2^2dH*^2^2^2^2^2^2^2dH*^2^2^2^2^2^2dGv^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2dGv^2^2^2^2^2dH*^2^2^2^2^2^2^2dH*^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2dGv^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2dH*^2^2^2^2dH*^2^2^2^2^2^2^2dGv^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2d6bf5823021651d1cb53350adcf4bb818ac77768f5cbc43898ad06af1036b00e1458b28734a567f4a774d647adce94f20133f3c013cbb560120d812e090150878cc4d68b9f6f2d9f12bb1756fbb9bdfb34fa89f0930187032b271315665728150c582ecd379d442745e4dc6ecdb90cddabb88b8105da6d2a3afcaf947850c0fc11a3352de540f4e0681ebceae86ef8e7e17c4f8c0f90d500629111f5d265f25386fa50072f26ec25460e3bd969ef5200c3454c02dc9d2a1e84fc0cc57eeb3835e785c0a3c0f8351c3e3c8dc0d0cc2d164241ab800c121fd3c40147d63cb5139f276451224c5d8227f40359f7d5367ab5c27bffa0d734cb4a25ee3b31b8ca77da5a1829bf1b3c216ae4c9d4ee066772bc7f5afca577935c229d9bfdf80d75cb7d0aeb78397f439d16d5b530d8b81c119af865c0898e02a33b17d28d0bc57ae9c85df163a6cc55b9c0e1f32f2a347d19c5f9eb02f3bd07cbef7dd25c8d86e3bb718ce6ab10819891d1d8fde23cd1c90b6a065c008b7f7fb43733aaba5693b054182a158a8f0949c10819f646d42e8cb710ebd844362d97695eec5a6a523c9718a1aed1ca83010bd139dcbfc328398007d959d275a78df0c0208c207e960ea669ca55436dc0723559afae54e63e48d826c2ee0ffd98b3233b8c132be6ea1540cde549ab16a5ee0b53ca839bcc06b9c268ac7be7c8186aa4392ce0c663460c019e4cead500b0c90a7da7bbb8602f999170020f81dcfa03d16a4a4d9caf259911676449f0101595c93b29c3402277811f70fa75237715687fc5dcdcab36f7a7c8dd72da64a1f054f16eb1ae49493bbcbfa138127db6a09fc946014a1d137d40ca2d5c27ed767345475519c0b68cc96bd20f23cb2045c3829dcc72c67a4f1a133a7d155ec67643ebfdcec431c7d61966510fefc3e691ff14a09438257c5c23fe66d54bb14050386b6df46fef8e6214e41579d09c780d19d242741f29c2809ef973cefe0cdc0a0a32d688202334a77982bb2d63244aa5b8570dab545db1c29342b3895a2024c52fe492fc10e9af7a7f3dc2f08daed6d3f5bc13ce0c8bdda30b85f0c69a57b7994670aca2abb02cec14f3334dc5a887b85bbe03e19202a045111343c40a9d68f40546ce9caca6b76801039b97b1a2c53cb0975fd3f31dac9584a8a955704363832241c679cd009399b6934aeedec0b3755f83bc09a35cd5a292cf19b7525e0bffd207c4c5b122b085f9129e0470df5c37cc534df4e30ec140a9406a2850767d3c20dc56e7c6f0ba342130b0160dd473330845cc80f17f5ea872d0fd5031d37b0ad740db9a30932ac53203a46c4e4fa701f891d74fc185fcb8989f45d28cbcace48ed94b1a6cf7171f5ebe150102c2cde343df5b89acab2c2a6c29b9a04d448b089c45226bb2cf6dad3cdf581c3af18a90d6b911ccb66c7b2179a7a75fd1bca75eac7d894fd5cd1ea75a0ed89170c0d4d1580016ef8436ecf4e619543752303a3f673928e2839845976001deaec22af953bacd3b72fe5c49443a185a898c26d1e3ccc9375d6256e77b91817081f349ed0b5115ce58d43c2720c3473e5e4475b616597e5ca45e6e816149748a4c7fd6443ed8c585e675afec1f5317959ac93f9de3ac67f7ec677ec54d3e5cda612b21511aefd19e338c7f06a05c29006d6be1f16dfc4891efbc5f8b12d38381041f75aeef95dda09a3c728bac964a8660a1bdde4c0aefb36f1162726bb551a958e9ff0de0333133702e0312e1bbe8c64c60f940b149f3278ebe2f7040e9224cb5d49ad2e896b807877864ae209975fdba39fe55d9dabe5730b830109f5d6bad9227eea0387e9b425cbdf52e9aecb5044ddf44ec05cd32ac643ab96fbbac60177722f9b65e9e88234e89c434a691e079069d37b318051ba08e5401817cf220661cea7c9468dd5bf0c862f246b1d80f21c7a69acf0b3197a11d03adcc3a6bb604040047d335ffa81c8f548aa273a4d3cd67272590ff8bdf5c4ce6641c36030342b5a32395173e93bde51a9085c5df4d300bd66a4eaea68a3aeaa6f2afb66d32d060f4b66364eb137323057b41e15317cadeac4d6d5acb20866e54fee85799bcd373e3e1730fca6964bccf10e8013d3a17e47f96dbedbe367692626e7e482a595b66f3d8d166cf030208d11fe66ab03a23c2932ba6e2290c7c90da1fa7a23214b457d24fb03da037cdb5760e7a8d0cc402d5062ce39edcbc0f3951007855b1ed95d532e0d4ad8e3d9067a9ce3338346fc111b62ba6e2290c7c90da1fa7a23214b457d24fb03da037cdb5760e7a8d0cc402d5062ce39edcbc0f3951007855b1ed95d532e0d4ad8e3d9067a9ce3338346fc111b6b14b9f7733adbd8910b925566c7031f9ef5d4047f50445ada7a0120693e441254ceb0cc6142fd93688a16af692f0ea833fccab83ff002b27becc311ae4c26c91b3e83dd6fd1336b0e2e1a1826f21a57a176e053a043aa8c0c6f2321dbbaa6f144ceb0cc6142fd93688a16af692f0ea833fccab83ff002b27becc311ae4c26c91369297a91044bae9d61a8f61046e54fa9059a66f2c5c4bcbca9fa651f4c5e605ceadedbe484214d4af828832b12d046b1c3fabd6dd2c6e92edbd7c299c963a01a6e93e3ebfd7fd88da8c1b24ea4476e495b9ecae27c557ab8c7ecc8914601f8fa66fcdca8b12389353b0dcc4d49ab89737b638a4156e04ae83b7fd7ed195da17e97415f495943ae49ce5674e09006caf13a8afd978884edc44157639fcef3a6e5dd07496ebe2d7f236624fe4ff9ea4654e533cd6f136e276f185bc4ee75cc6a63208f569c98c16c37c2fb2e287b55027ecaf16ea80449fed310725854dd848504358d4fe7948b0d5cf868fe9304a7c564127640a6e2aeac5c3a536beb0f30fba963740e1b6bd2aff4d69dac938811dbdb5d5a49c12b1eae220c314482006e9b14803e10fa13c8dfd44cb429d356a3603c079b3100651e429f5bb76d57d8b42d1dfd602c67136a59e64f6e463f78538691537a4d855d1034cf133218defd3a3c286ef3b2ddd73eb2a8e12cea6e1f6adadca373fa81c0f7c414e705ea46f3818ea8aef2e39c84cf8dc8f0af8abb56834c98fe36820ae871266d08e5018aeb4dcc521c9c398e166d3c99707aa883a5619dacfb98c3ce7fedc2a8702e188ebcd349e519f65778c5af41e0d14e2de103ab29f00cb99e1904b3bde1395ec5fde92c1390815093c1c33be89fbf3192f503fa8ed572a7d3719461befe87107a42e962d4adc3b45978f03f3b8724c1b89e36ea16e26e494b65e240c4dbd77198021abfeaaa80f6e67824852390447027d20f4455701d32e17ca30d2bc02a145d5dc335c5dd2484024db29aa2029e29e5c87372d20e5d57bdc9eba046ba525571e512a8d55ff6c74db2c9f816beb79eaa11ca44d91ebbad302da7e0e139aa99c867201d7cb2b5b83fec0eff7472964122f5fdb491916fed8ce15b3d179a90dddae767695d7f153f1da2cc4da0c4aebb58a3e85d0ff03fbddd02a9c8f28532f28fa8729aebc24e02c5ae1bbc67962f899866ad4aeff14c6d9097ef74a62b0db13c62b3b948b1910f6e156c5d656b3d8ae6e21f777e1a1dff4def65a9fb7493202db1cb41721801405498a15b16d373fbb8fd98ade8bc0c64e734d9b60caa3b7b41fdc8ab76318617a98a8a72661aa99baaed16b2a895766d878506c808d142b9c564fd9f90bf9f7423c5bcceb5aa7338ce528d057e1a55770f4f47a6d160f464bdd2e5a9a15b6df37a15ad28ff8bd1d1e379fa22a0a58b1462d1cb2bf6f91c0428442b261eaedf631f22563c6975207fa0651d350c9aac2064c636dbfd059a1c001014a7a57fb30afe2e8161acff9850a5bec7b0249448891df209ced0b38cae1dfe11790a5bef1eeff08a5beed53ce599b88479fd2a598a73e9e386c42d10c44eb6312f27403dc03ebb5131110972dc559286d504459480c6f30bc1fae30805cfeecf5a44424819425d088599d31c38f93071a8f888325055d9fd241c86a3a158a7d4ec5d403a32df2ecc86fe1aa69338a4a6e06d2d643e34acba65ea5c001f851daf5dffef55a1765bf7f3b0ca4bef450a8f796238b36fb8489460501bf94e91f1dcf5fafc74904a2f68124a9f013f60bf839a93264f7fa1eabe952c15f22a6e370963c902ca978def728703aab9cb9f2fb3b48731fbfe760a43a258c3785c84ca4be21fb50b0842fb84ed2c8445b5cf38f87865bf1d65ef7a597c15178cf7904e805547fd53ed053101f654722a90c7c718612cbb600f0e746904cca639c083ad44adc61d3b7602633f62681a0543a4576518efdf11838e94dd637e9b7f48a5c9b4e2303ff44b354cf3d8d22c802cfadfe0dd0334aca848e8984b34e92b9f696828891e4f016817ea2689a5402bc8f4f2cb96354c9c14c3bd20214668cfca82e0f1f4c7b29cf0a9749962f5364222fac9a330306af9dd905f0024aa5a1e1561a663ec16fd58a28b0619fa2cbac29eceee05b20b01097185ab19ae9d807e384a743387d27fc0a8d6d897676617cb203cbb3d413ebd6c093c27b4e3b4e86280b85d928dd21640e98a6fbff04f6d46220c0bb33a1dac4f66ef82fbb59b77d20640a54d8533590ec3bcd1a15d8f8190a27a687e0f9743e5422b91e23cd3670c0084032a94a645dc7b21e0b39090e6c6f6097d5b8708db4223a9313a6215b2e5fca1c539d4e5e3477fd81e23e2db0b4c4e33b16d4d2323e17dffb0656c598561f9d91ec04eee8f89ee8bb42b031bfd0f2aac1342aa2a5ab324f8f6181711d9172bef5dec9b4e1b2d5cfe69aa5aebb84a5a1637aec3ecd0ec88ca2eda7fb5f6bb3e067bacd789eeb5b9868e47eaeef88ac42301d77271667035e5ef559c4f00eb3e29f8dd363c43a4df10efd9412fb5f45b5c9837a9e149d0888593569c4969f51efcd61ea6abc2164637a032954351b16d51241c0c5803f12712b5043db034b4fe6ec928d6b57dea17970f7e3a0258e8c04d0a0156c19446f69062dd069ee1967bd929eb643811c199c1d988747ba4d5689f9167fd42a8ed07039e28dbccc4b744f4cccd469e8f3bbc3d5350d5b2c15101c9869718d0e248a6261a34300f064a0011daf7a7b97fcd57215b937380865f10faa16912e9cf7fcc6c8001ed5ccf7c35889765811a449166c80fc6b7b677207fb040d9f7de00541f77aa74747b96a8c199e368a40ae7f8cf803c974c90bab10ec4d6af8bb034bb857d35e21f13a766f242a999b72ec4530ecb668be6082ed25f15b4b50df28164dd762843030bb98e81eb93b3d1cdbb8674ec4c8dfb3f600b90367bec83498d9724204d8e54b448583d870a563a74d08f05f45fc39626de7e17f2b9dc8ad6ac85e7b3d443767e183cd06212dcab461069d6b7456f1a7305335ec03066f3ea46f1d707a59830dd326fb2f2135f687984bb909cae523b0d8fc8aa095e59c31e5b1a1ab748de837cc47f311083b3ca72933082f4a4fcf0258b724d8be2bd7c26a70a7ee57686804b4008d4855be3d7fe7337ae43a49225c416f3a0fc11bcc7e6d5089bd03ce69902e13ed9208464a6a1d9f7d81d4795a672195815118e2584314098a023c3f249c95fe0173d9cac292db36550a3fbfaad2e31234046232cc077308a08e1780507c2549caaa07960a3bffd988c966ca03b37de84c114081aa4b31fdb94c7e07b8c00e726c312cc833e259dfe0ae3aabae0cce1d133c3004203650fb5a0a17375f1c598dcfe22d7b8fb04299ffcff251bac5ce33e8319ce83dd0bb7d21aeb387e17803d3e8db9ae1018fee9b3f1400bb8f3b28b996b1bc599f09f56dfbcbf564def419d90fdc71eb17056a10a6cf49b1f62522a0f22ea1b12339ed6fb418b2e1fe1a30902aaa70226c4d7821ad58abf7b6d60a2b580a27813648843f4d34dc3120f48da361bab625d830ff8bc6c8ad5a793937f191b8679bc73170aeb5dca7109bfcba14a1e08eddd916dc62f4a693d3e8e45599d04f399102439436bceb4377f909c3f66c59877a083a5fda7898d9e0ac8b3e9e81887ed077758d05473cfcddae2508d7d2c77bae9dd2feb5d5c28b7f1a2d3a7036822329fec825a2f7d4b33352e9bdb5c8a670821dc6938a8185acf80285dd9c95a0bb6eb9c601b49660105d08784c52aa8ac453ce9e2faecddceadc43c59f45f0363e516facbebbf4f9dd59c307f5d04cc31587a7ee46977c98daf2a1507401550a16ef1ad2fa8a713ee85fbcea3e746220fbd9f31057112ff4f210054a6054984c3a7bd25be3d41744abdc2ddd9b3191783d460dd792439ca7f920cb7781404a4e41afaed4c27eb4788b4c3560fe15098927b159c3e26fa0212e2996d1e54db9a388eb07c1e94be78beceaa6ff0d36e3d5162f7dab7ad023de47293cb877ab808de670f28d2bd6499dbb2d357d43afc7cd23d86b4bdf3aa6974895bdc3bb4a3908363d61c0de2c934c1d47ea19483de74591876aab55f72cf4dfe9c88969bbd762c45a42b91b1396ad011b51fd338882a6ab602315cb7bff682ca2f5a26424d7ab5ce178c5b9e9a25d855ffc52e1b5dbc957142da46ab2e7ed49d41f75099bbb3998283617c5f590304ec64602cfb558ee28a6627008f27dd6e39d2940ed9ca211b2e9933622b08eb4dc4ae264f33952affdb1a2230e2ae72a904bc8e884cdc3e881037753f8918497e4ba574e2ff864e763a606fec3c2c42d5dafe7ee2df815e74f2bf84431f262525b45dbdbac0117eb16da3dbe25589ba27fdb16be3f624c580af8dd2e8136bef1bcf4019b9e820f9fee1ca9617df39135b857b478484f1606a9e54287223c2e6e8d0ef28e085d5d813a55de04b13112a80b9e97ef0a3492fd9c2bf504887110842ee75e18c114a2f01707be3862f88641212046222c357f82ddad68d899645f30b9a0e3411d9fc2f25ae2d5277a8ed29d19043a3b0fe056eb8d8c9a6ae446a00170d442f2ecc7c888dda6869747fe8e98d26730ff60f728d0e080cf63e44ec0bc72932c375894c729bda2b364a1272612c2005dcad021f513cc99590d3eddcbd0943208feb340699371199f997cf783a220f9ebf0c577f5211d831d28470392d0197189f131ca1a02c4ed8f581a131ab78fed3c28ba57a9b787edccc00ef37affcc97ec2533c8c7da5fe36aebe0ec8dd591db70d50dda2f299e8275406d7a9bf51b0658585a85feedae530189b95f4ccbedef04351ee61678ac468a29a45259542db3f0064ece7bc6c142a5c837a3f1dc88f8cc2e6060172097715954ec0ec652be99031c4992cd6f36eee6c911a9ab190ad2b2d7035c3b6210bcad1b5bd0d61ca737bf71e916f427c8d31608979a229f9453b1a59f1d9745792e11756f8bade632479f283837a0631512f8e5bccfd1c96626614cda4cd142db5f002bafe95c0be41773d65be80d2e4893087bba63a5f40732a33fabdfe321b102c6ac91cb5a71f653bed7ff0363414697b7188d9bb18c6f876290819145fa62b01487d8d336ef7432108a27ff2dcd1c2a1f928d33de86710f05b5cecb5d841822f94a7c87dabfbf16c2140c606ff3a9be325ad994e8bd6d02323c345a7f33b818493827c28b14cbda8196220c04eab3503e0d4a472ba33f7e7bb3f70f202bdd1c22e5f4c009aafe30d35304be91d9cc0df86fa67186e454bf11475fb89e70283aebd7d3b913baa865e57d465418ac32295631ab9902c09334fc549604ff49152c6ab93e45b2d09989ed85c9e8de26953bdf3a4b9385164e6ffdf7ed7d738e1d7d39cee2ab60f6a66893c10e12c81c6ddd594901db8b5efddc795489b9971b83de53181631fafa8a4ff4e947ecaba4221b793786563b3dfdcd62f39e7ce4cc095102ec2af345a2dfd680dcfbaa5082bb2aa760182b34c5011b9d513f45561ca7912338109e1f053dfb2eba6c189f36043477b7e9c5f6bd93049e6a50aa4e2ef845c2ecc57b7c6af0b530a0483ef356a6b25403c4e7be438f97bc93e0db6beaa8b18530bdd0437eaa1597c589514b45e8d0b2b37490cb979956f60e953d627512ccdddd9603422e3a31e8c7a198f7adb725c2f5a449160bacaa9e40e728469050df5dc0481b3b19570152a01ee8c0dbdfcda5de202386dc5631c74d6d879ab522218c9dc73f6b56b65e84489ad6fa0c00b56ca99d16efc037493882bc2a7ff8684d7146f46f9c33f878ff7abaa21a236e737274c027ac570d8066c9a1e27d543385c08cc6e01c9f3970be6e184bda2b33b8b7d12c29844f5dfc4dc0a76253f66e30d55ac7cad9d54fb5ee25cfce90b2db8f1bb5542439a98e78f686688192339d5045c89a7c444ab265943e29e4ddb2814bbd2e5f32cd314bbad9a4fc256d21388e37ff2063355cfe40fd08e428eb00682c5b7121cc4ed50cf3ff83d76d2f3593d6f517835d0108bc192391b370a734cdc2f360b4607c571da9d704c39ce0b67c9ca6202bbcb92c26f338213043e3b36ab3fcdda487aca0e763cd5fbdf40ffb73006e3f1b38cafa9b2e48c19d616b701d439c6ecda6908a86cebf2bad69e4ebd837f93f4065b4d5ca11a5c0772167fd9769349be3ad33616e6dcd80b9daf13f9dcaf8ef6bc30f9e52df3da8ebe1393119b9b396c5fce3aba06387028fa21738a84e5d1c9ea15e75ff88b8b61fcadad11071b6131243666e2e04fc44d87b070697da0b91df3053166ffbad3e9603e116474d44ba83c56270532c0fec2d29862bab16692a5cb07943d9ac3be7384125bf8a087b58a6ce9af014875df6e9c91933b0e915d18825853bfa5f6aaa24d91957003503006412ad601f7f6e5d950eda140367a30f221c31008caf4c2712002aac3a387a37a98578cefe64dde557a4e36f9818cb66b18192034981ae4b1f5f392384d5f85bf6b6f562f0533de650daadbec4a8dae34fbbb56e36f87e00e507633e8599a4a9b78b8a244521bbc3a3c1e46049181dde51098bfbd4aa1f52e2ec058f907286b4c87c6552b361d06eb8a0a4b26a327faa8d2b6d446ea046a8414183e0b21a470e83555ab6aeff375b5660ed4cb0848ef1590130b1b331b1557bf37ebc4ff6e1ee9d90dbcc3cc48b5ca5bce8ed7df74cc4c2381961c9c9efc99efa0e427e7e1587a4f6673040246e3f1b800ef36d9dd100432bb957e899c5c37ae69be80ed4bb982d2380769057cee6067962b4ffa4b2cf40a6e5a732493f054bd27796ad5d9efa55bc8f59fd674f2835d9c1e7b625fcf076e7817d0d08c6fff38325c95073dbf9cd23ded73a65a8e569270b03850a6b9a9eb862bbd4cc8188e703f0e05ce34668aff8ed106f92206e688e301a625a06506762f07a9aced94c1f6c2f093d41f08778e8ca9059c14f314eb6d925825f834405c62ca90be20333e09958ea265ef5f6c000c5b62200ededa13f8521e87f453fbf48d6083be597d8a680471b7d41d1faea8fa0a67d87b4e3b1ac73cb9dcc6abdab00609398306c79ad2768adf66a6c9c076fb1c0d411571546ebb06736357218e00172e8ef00ecdc92587e712d04091e7a5f7805c2dde8e1cde90c570948c508e1e4294e0a679ae5323d68f551008fd9fa0a70929e47b1da01f19b724c840eca1d58cd30f4dc0b859763ae3beebfae87cd34526fc2eca66ca591ffd53f81b025c989f94ee3622fd8bb54341da3aa03208fe8d183ef96002869cabe74e3c0d81b49d3acfa70bd9f087cca5f74ce5bc18ec1ccb624f4d281bab848e1c617e716e922028fafb014f7e5f13a3877108c3a7bb4d67dc80bf0bbbe00134fd976901defbf35e10746a7a77d6cc11f88850bc66c047b2005f1984deb400e1a5f8d832c6da04d11caa82e03bf1d00c372c789a7a437cca4893de17d17717535ca11d09774b350d4b963d18d0c3ff275027f968a2025b3a2231b0e1d136dd67f65ebd7933a7291fb2809e0cb0c9f6b5153baecb3827282e259c1dea0192efc2b69481ff941ff7247846c1cab4d20792509907eb91fa50c9135ffba3e38a8df976b6646bbc66608f845d18bbd167af2cb621bede3bb3567b41567657e76727f9791934052c688752bd07d4afcbd7df95a9ebcaa5795e30f706768b4012c802aaf1fcd6e99814067613394950d130f61d06f25f3257278f90c791ffbad5b4ea62bd5a75035961619eb55973afae64b64b9130d3aab85b28d866416d91896845f4607d2099de578dbb060ddb83ad681e6ebeb51e184a4205c01dfd6652544a65b8d1895d26ee151f79dd076467a2655dc6a388db93697bb97dd2f128cafed56e22d589cf18d3a8117b8b82ec7840c34a149b833038abb5c1e08d3d1a22190b2b11debeb23ce1788f781d2ee4855bbb5b5b199bb08462c43558f7fdb0b4af9b879662b638abe8f56bbaca7f27d090c6cd68949a7f2e6dd41925503abf396908ebdfbe5ad1f2a628ac0fccff016e72febcd204a038d3b1bcf00f554cbe65b72a0f5c6e785d27ab6c76f9985162e4215c5b0a05c560b7ca085d6662f475887ec86730cebfc26a446ef314e84f39e2a916584c14a57509f6007d0e1883246d746a8f0544e6ed4a33dec754464db0852baa1d62df4b1460e09c277a63ce8fcecd84fd5eb127fa3a532265fd8ec62aff59246cc3e0c538d6a720f121ec7a6c61d2178a7b914c9d7aac0fe2d0ee640061c044bfd8a20e46587ae276332f2b4c58a1a4355c85cfd5b6b37aa2b11a9d50b6b0c7a98bfaaf9467c54a80a603c94c292eae73c5ae04a6eca92e9cefb27b28c70b9b6575b8d020edc0182c327c2cdc0a683ca9f527a435fa54da421a75f0fe67d39eda25030c1dad75431e7bfbd216132b8faea363a675df98f0b7571dd667d86753584d052c6780fff621a2f6010325e8de9871d68d2d176f892fa0e4d1714da27e72a8367734d4a1d8fac65c88c70591fe094e5cadb73b5437001bc3a9775233b9e1a6eb144df5454258bffc3ab3f6a3adbeccc4ba1618b73dc55bb5ebd698940a848814cb57cb1f140b0cc9a2bae31e5d9907c272db063731e99ea2be881be14106a43cf9deed98f1e580314927e2ac05431f3609635cf9dc1bfffee3d14836e3b5620b8f7d9e5420275dfde55010069686441ab85191c777c672e4c2fd5c43e9fa587d87623d3ce557186e454bf11475fb89e70283aebd7d3b913baa865e57d465418ac32295631abdaa01be372f6428157f7767c6e507f03d8fb0698ed26ad8764efd8e3b6ec1b1128b50cd72eadcd56594e2ce0cf4a266132526e7735f8d70abe796dc6ea68723b9902c09334fc549604ff49152c6ab93e45b2d09989ed85c9e8de26953bdf3a4b9385164e6ffdf7ed7d738e1d7d39cee2ab60f6a66893c10e12c81c6ddd594901b49f79539224ca82db1a18cb19f706b20bfb31275e009c30127184199ee28bab665e6b28eeb70fdfb406fc715536773628274003066aefcfc27da268f50bc45154481c944793a119c342103c58aa95667e9c067d65e0b8d63e90c24f32285ad9bb97edd4626c9f3fe213675e77a8b89dc0064e69d17760c49f539df7f6f264669c1f516d640fe9809bf2e63ceb40100ce610aef9fc4ff097abf5e513554ab3aced21e85b958da061a7d2de3f534c579f55a783af34ee1f115595c998f32f2fe5b16de77414be3c1dbe1233334eba30a14bb7b5fa3e31571f6d6219dfd34f496912e07806d8b1f8a1c0cff9f42e6433837f7f2f318a9c03ee8a947ba0416590c87e3511ada3b8e3dd85c772c4fa857de75a0d9aee3a4f3133678f99fa30519a870f7110c082dfcf32eb01c004f6e9d6c1b3e108984f9177201408040b10dd5aae45bc58305e847bf7ba35c3f97bd413925c7094c9cb9e54a9c825367c59068423a2d871e85613498231e9f4f83f178ce9cfa85da466376567cb38142168fd804c0067b93558cd2e0d9e8807e92def408b8eb3efdce5ca51d392e7bf06b7b7d5aadd05227d28bfe1e6fdd68e2c7a8f275a1d359c60fd4f3a95078c131ccf6a47b40b799d9b581379b3321c1591c48e9b3561c137a48c447b51a1b2758a7728d57dd7ac9cff1db3a58000b9c1fe32d7dd59631fffc1d5425dbd75fb4f5e99ba7c902bfa413c7237cec4bc0cf0f59f17d1fc4959b7661aa89373efa9bfd5bc9403d82743aa179b0610a98eda4b028251df592cac0cb95d8d37720f88345d471da63526b6ce8a0f19f9cf0326784128890105e9bd0ac1e913d2e42d5c01cd9c8f8574e6d7d9b362af55379c8abd0ec8296f01340f2991eb274effbb0943d386716df1fa2dd0fb957b3f79b13cba530f693b50f84234f3299d45e00fb4be60cd95d2ac4101279fad4fdf9510d2988c139ef32593b2255d74660095f38321ff6c300555c60045434f12d9e68f6f28896adc7054788724bc34c704ce8c1e2f3f5fe90174ecefecb37ebbfed41e030bfca7ac60f6739e123478434534f5e60fa3733b81177e63fc956191312c831f77d80837c61771a3d4d6d646ae0ebd9de19f2d1c93edff35a2fc6a00481a5b3919bd6883f7619d1a05c62be002110032daaaff23f0efda24c4d4e472c9a35934a2db4ed4f5ad94b9eadc689b0368ccbb1314b5993c9e33ead8aaf6c1d937b7f500c760c15fcfbd8f7ef74c9a76397bb8dff93ffc16df95866d15efca4e9bec6b29c6714e527c0f1ead076eb9fc48f233c3f337f958d4e0673ed79347caeba4b7e7ef85cf92a6666b9a2f4ced866ab018915108c754d5dbf4b92bb761d8f519922d866943cf5d07150192ff373cca89881d43a3e68d96184142fcb5391ce4431630f1217d65cd1f6a7a3b5a4a63c615bbfc018d5cf5c0e8448edb5e8a834506214be78b70dd45bf3e5925fa3fe0c0c6410c017cc6e6ab30b4e2aefcaf4932f96eb61a6fff9fa4d55de821b5183ad89a039f5628db4869bcf4d6ade0a422df2c6f8bfdfbaf7fb658449d365321112f1186e497a89fb426e659391a6ed4a0788280982337207ce1ba6382cc461026e46132f6ede248baebf4fa9223e88ba83c3aa7ba193776ab336d42955bba1fc047326d615d332a5140e09ccf4b4f233fdcacf30f533b5f15c9ef7826ed14382cd31bb55b743ac7dffc03ad234d2d5566157b62ffd2426d5cb6a44fbfbe381a1808e529f26765ba9e05e56b3b06c842124bce70635f166ef1e609e99f8ba41844e9faf93bb7a3f81d2e8d8714f4727757ce02e32971f76b129fd97deb4ef3d565c4a58d387d296f5e2ae411ca8b5ed340056f76bd372ad23f2cc8c24febb3e836cee9b377076fc3934ab0df691855f8e19aa2413d7e54c00303b70dcfd28b0708974c470416bb08d86da68f1f5dbecb17fbf7e66f136977c1b5fff486b93d4760b608fcfad7d9e567f0283bfcd35006123d0fc54b0a0a0373b8ae38ec35200788f1c1d270cc00bfbee7cb65f762ec3bd80e439cd2efc8b4e6825279fb48d2d87190a75bda3aa29bf14c03eb115a5be6b291f7a9805cdaab6465c61d3290fe63d403be79683d806b12746c7d6fd5ede1eaf6e508e3a7d29023d7bea4db67a2337127ec0e911a346d8c582299ebe6de630789a99949982d29674be81e99c05f9167813a00afbacd30bd0763edf4dd8c10a03d16e92dcc6dbb27b0230fcde072e89f6a8581f1d4c5dba6603b6d5bde6d42f80a10ead1635750c998582d4c85a9da9283aa62616dd4bcbe8900f84d5171f9ab92db0f3b27571fde4562ae3c51d103ad83dc2febf8577c156a6447de30ca5a66f4e26961cf12fe84a11ec7815c19c02f1b793a0e91d7302ce9a650e13fb81fbd66d70f0f3d0852453201c93951888d8c785d218ed49f70b49ef56dd0bc07706e4c421dfa6625e1f1c25cc00f5c21b152f653d90cb879fd1d2d864c0eaea2527e7235f5ef357810d29ac3f21de79c2fe6cac5eb5a0f53d781ab4b78d65a1764e7e7626c31b779a8ac4ea0792e8cfa95001aef51535d7bd3718a575ec70d97531470731255e0f52a907b2d4ce36cbf059bc84d31ec949fdff5ea4c987f6cf58a2ad86bb944e011439a0431c8344fea545a0e3031b8e38f8c23767c6b67f36e1824b1b48f71b3dc52d8054317c281ac05eb8506c38368b37f732e55538534e6ce61784b30d5fd24c24062f8115e49ac49630c5e06fb91fa4bf4e09f2836fb367185d4cd4da6b1362006d666ebae9dadd433785321b143889a46f5b0985ecda1e03bd067b178237fd89e2fdd6b958af8e32e802c52f725d0047f2c67a0435efee12ffa020736bee7e081dc7ca5b84a86e2a68ed1c6978a050f6077448b201d2d1c23e13e38a0df6de9a02033fc479bb9f37e6377b64a119436024d9a581c0f137add81539fe233ca5d947ed65c6cef9a6114fd6ed6ed6f6372e6ccc8e28e611e07bbf8b9c3695734bd4a1533a7c38b8c0696afe1c3949239c7653522e627fbfc8ad866648f71aa19abe71e20f50ddbf20de0d7273f7e6dd2a7fc14ef0693069e233c4243a39a6ace0cf7e38eb0988c7bd2c68f8018e3727012f2457fb91dd9470f0670e3d48e3144973967f7d31b318d8d7135566113eb5883ca541ff63f5a999a97b2a7a32029058010f7b7f1ce9e7918ed9e45408943b8f8bc606bffebeabbbd9bfafd8bd13cd66e3df6b4e77b3d4690ec1d5d5721c3caee7f629bf25910c240dc2f24d1e487e69ee2d54dfa0f74fd5364bc8b06d9efb836eb8857bc64b9264e6105b0652f2e1e4c9d31dfd0a06568238bbf6bc3d58ada9a7dc75a26de4e324f4b798b2d8938a692f25e82e3da8dbdb84b3e646de7fe0f80a185b7c69838603148905e9b55c58db1c3741e9b4fe0621bee7d5b5f7709f90bc0649902c09334fc549604ff49152c6ab93e45b2d09989ed85c9e8de26953bdf3a4b9385164e6ffdf7ed7d738e1d7d39cee2ab60f6a66893c10e12c81c6ddd59490171e2ad35b4241a19558c2d90110e52a291f4d25b917bf027deb77dfb03aa570cddf7adeb90dccd6ba965633c2cb28700fb70311cbfe3e7c67cae417c3c162b29/usr/share/java/pki/pki-ca.jar/usr/share/java/pki/pki-certsrv.jar/usr/share/java/pki/pki-cms.jar/usr/share/java/pki/pki-cmsbundle.jar/usr/share/java/pki/pki-cmscore.jar/usr/share/java/pki/pki-cmsutil.jar/usr/share/java/pki/pki-nsutil.jar/usr/share/pki/server/webapps/pki/admin/consolerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootpki-core-10.5.18-25.el7_9.src.rpmpki-ca    java-1.8.0-openjdk-headlesspki-serverrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)systemd-unitssystemd-unitssystemd-unitsrpmlib(PayloadIsXz)10.5.18-25.el7_93.0.4-14.6.0-14.0-15.2-14.11.3c1cY!@cD @cob@bf@a*@as@aA@a`@``e@`6?`%@_$_@_@^V@^@^@^U@^=@^@^]]@]@]]v>]R@] u@\\@\f\T4\R@\\U@\[@[{[l,[`O@[U@[>@[d@[@[o[@ZUZ@Z@ZZxG@Zg#Z.s@Z@Z ZYYY@Y@Y@YoIYlYGY>@Y5GY-^Y$$@Y"Y@Y#@X@XX@XO@X*XRXOX!@X&X2@WWҤ@WίW#W:WWt@W{@Wu WgWV@WV@WV@WV@WV@WV@W 10.5.18-25Dogtag Team 10.5.18-24Dogtag Team 10.5.18-23Dogtag Team 10.5.18-22Dogtag Team 10.5.18-21Dogtag Team 10.5.18-20Dogtag Team 10.5.18-19Dogtag Team 10.5.18-18Dogtag Team 10.5.18-17Dogtag Team 10.5.18-16Dogtag Team 10.5.18-15Dogtag Team 10.5.18-14Dogtag Team 10.5.18-13Dogtag Team 10.5.18-12Dogtag Team 10.5.18-11Dogtag Team 10.5.18-10Dogtag Team 10.5.18-9Dogtag Team 10.5.18-8Dogtag Team 10.5.18-7Dogtag Team 10.5.18-6Dogtag Team 10.5.18-5Dogtag Team 10.5.18-4Dogtag Team 10.5.18-3Dogtag Team 10.5.18-2Dogtag Team 10.5.18-1Dogtag Team 10.5.17-6Dogtag Team 10.5.17-5Dogtag Team 10.5.17-4Dogtag Team 10.5.17-3Dogtag Team 10.5.17-2Dogtag Team 10.5.17-1Dogtag Team 10.5.16-3Dogtag Team 10.5.16-2Dogtag Team 10.5.16-1Dogtag Team 10.5.9-13Dogtag Team 10.5.9-12Dogtag Team 10.5.9-11Dogtag Team 10.5.9-10Dogtag Team 10.5.9-9Dogtag Team 10.5.9-8Dogtag Team 10.5.9-7Dogtag Team 10.5.9-6Dogtag Team 10.5.9-5Dogtag Team 10.5.9-4Dogtag Team 10.5.9-3Dogtag Team 10.5.9-2Dogtag Team 10.5.9-1Dogtag Team 10.5.1-13.1Dogtag Team 10.5.1-13Dogtag Team 10.5.1-12Dogtag Team 10.5.1-11Dogtag Team 10.5.1-10Dogtag Team 10.5.1-9Dogtag Team 10.5.1-8Dogtag Team 10.5.1-7Dogtag Team 10.5.1-6Dogtag Team 10.5.1-5Dogtag Team 10.5.1-4Troy Dawson - 10.5.1-3Dogtag Team 10.5.1-2Dogtag Team 10.5.1-1Dogtag Team 10.5.0-1Dogtag Team 10.4.1-15Dogtag Team 10.4.1-14Dogtag Team 10.4.1-13Dogtag Team 10.4.1-12Dogtag Team 10.4.1-11Dogtag Team 10.4.1-10Dogtag Team 10.4.1-9Dogtag Team 10.4.1-8Dogtag Team 10.4.1-7Dogtag Team 10.4.1-6Dogtag Team 10.4.1-5Dogtag Team 10.4.1-4Dogtag Team 10.4.1-3Dogtag Team 10.4.1-2Dogtag Team 10.4.1-1Dogtag Team 10.4.0-1Dogtag Team 10.3.3-18Dogtag Team 10.3.3-17Dogtag Team 10.3.3-16Dogtag Team 10.3.3-15Dogtag Team 10.3.3-14Dogtag Team 10.3.3-13Dogtag Team 10.3.3-12Dogtag Team 10.3.3-11Dogtag Team 10.3.3-10Dogtag Team 10.3.3-9Dogtag Team 10.3.3-8Dogtag Team 10.3.3-7Dogtag Team 10.3.3-6Dogtag Team 10.3.3-5Dogtag Team 10.3.3-3Dogtag Team 10.3.3-2Dogtag Team 10.3.3-1Dogtag Team 10.3.3-0.1Dogtag Team 10.3.2-5Dogtag Team 10.3.2-4Dogtag Team 10.3.2-3Dogtag Team 10.3.2-2Dogtag Team 10.3.2-1Dogtag Team 10.3.2-0.1Dogtag Team 10.3.1-1Dogtag Team 10.3.0-1Dogtag Team 10.3.0.b1-1Dogtag Team 10.3.0.a2-2Dogtag Team 10.3.0.a2-1Dogtag Team 10.3.0.a1-2Dogtag Team 10.3.0.a1-1Dogtag Team 10.3.0-0.5Dogtag Team 10.3.0-0.4Dogtag Team 10.3.0-0.3Dogtag Team 10.3.0-0.2Dogtag Team 10.3.0-0.1Dogtag Team 10.2.7-0.3Tomas Radej - 10.2.7-0.2Dogtag Team 10.2.7-0.1Dogtag Team 10.2.6-1Dogtag Team 10.2.6-0.3Dogtag Team 10.2.6-0.2Dogtag Team 10.2.6-0.1Dogtag Team 10.2.5-1Dogtag Team 10.2.5-0.2Dogtag Team 10.2.5-0.1Dogtag Team 10.2.4-1Dogtag Team 10.2.4-0.2Dogtag Team 10.2.4-0.1Dogtag Team 10.2.3-1Dogtag Team 10.2.3-0.1Dogtag Team 10.3.0-0.1Dogtag Team 10.2.3-0.1Dogtag Team 10.2.2-1Dogtag Team 10.2.2-0.1Dogtag Team 10.2.1-1Matthew Harmsen - 10.2.1-0.4Ade Lee 10.2.1-0.3Christina Fu 10.2.1-0.2Dogtag Team 10.2.1-0.1Ade Lee 10.2.0-3Matthew Harmsen - 10.2.0-2Dogtag Team 10.2.0-1Matthew Harmsen - 10.2.0-0.10Matthew Harmsen - 10.2.0-0.9Matthew Harmsen - 10.2.0-0.8Fedora Release Engineering - 10.2.0-0.5Jack Magne - 10.2.0-0.7Matthew Harmsen - 10.2.0-0.6Matthew Harmsen - 10.2.0-0.5Ade Lee - 10.2.0-0.4Fedora Release Engineering - 10.2.0-0.3Michael Simacek - 10.2.0-0.2Dogtag Team 10.2.0-0.1Ade Lee 10.1.0-1Ade Lee 10.1.0-0.14Ade Lee 10.1.0-0.13Ade Lee 10.1.0-0.12Ade Lee 10.1.0-0.11Endi S. Dewata 10.1.0-0.10Abhishek Koneru 10.1.0.0.9Abhishek Koneru 10.1.0.0.8Endi S. Dewata 10.1.0-0.7Endi S. Dewata 10.1.0-0.6Endi S. Dewata 10.1.0-0.5Ade Lee 10.1.0-0.4Endi S. Dewata 10.1.0-0.3Matthew Harmsen 10.1.0-0.2Ade Lee 10.1.0-0.1Endi S. Dewata 10.0.2-5Ade Lee 10.0.2-4Ade Lee 10.0.2-3Endi S. Dewata 10.0.2-2Ade Lee 10.0.2-1Ade Lee 10.0.2-0.8Endi S. Dewata 10.0.2-0.7Endi S. Dewata 10.0.2-0.6Ade Lee 10.0.2-0.5Endi S. Dewata 10.0.2-0.4Endi S. Dewata 10.0.2-0.3Endi S. Dewata 10.0.2-0.2Endi S. Dewata 10.0.2-0.1Endi S. Dewata 10.0.1-9Ade Lee 10.0.1-8Endi S. Dewata 10.0.1-7Matthew Harmsen 10.0.1-6Endi S. Dewata 10.0.1-5Endi S. Dewata 10.0.1-4Matthew Harmsen 10.0.1-3Matthew Harmsen 10.0.1-2Ade Lee 10.0.1-1Matthew Harmsen 10.0.0-5Matthew Harmsen 10.0.0-4Ade Lee 10.0.0-3Ade Lee 10.0.0-2Ade Lee 10.0.0-1Matthew Harmsen 10.0.0-0.56.b3Endi S. Dewata 10.0.0-0.55.b3Endi S. Dewata 10.0.0-0.54.b3Ade Lee 10.0.0-0.53.b3Ade Lee 10.0.0-0.52.b3Endi S. Dewata 10.0.0-0.51.b2Endi S. Dewata 10.0.0-0.50.b2Matthew Harmsen 10.0.0-0.49.b2Ade Lee 10.0.0-0.48.b2Matthew Harmsen 10.0.0-0.47.b1Ade Lee 10.0.0-0.46.b1Ade Lee 10.0.0-0.45.b1Ade Lee 10.0.0-0.44.b1Ade Lee 10.0.0-0.43.b1Ade Lee 10.0.0-0.42.b1Ade Lee 10.0.0-0.41.b1Ade Lee 10.0.0-0.40.b1Endi S. Dewata 10.0.0-0.40.a2Endi S. Dewata 10.0.0-0.39.a2Ade Lee 10.0.0-0.38.a2Endi S. Dewata 10.0.0-0.37.a2Ade Lee 10.0.0-0.36.a2Endi S. Dewata 10.0.0-0.36.a1Endi S. Dewata 10.0.0-0.35.a1Endi S. Dewata 10.0.0-0.34.a1Ade Lee 10.0.0-0.33.a1Matthew Harmsen 10.0.0-0.32.a1Endi S. Dewata 10.0.0-0.31.a1Endi S. Dewata 10.0.0-0.30.a1Endi S. Dewata 10.0.0-0.29.a1Endi S. Dewata 10.0.0-0.28.a1Endi S. Dewata 10.0.0-0.27.a1Endi S. Dewata 10.0.0-0.26.a1Endi S. Dewata 10.0.0-0.25.a1Endi S. Dewata 10.0.0-0.24.a1Matthew Harmsen 10.0.0-0.23.a1Endi S. Dewata 10.0.0-0.22.a1Endi S. Dewata 10.0.0-0.21.a1Matthew Harmsen 10.0.0-0.20.a1Matthew Harmsen 10.0.0-0.19.a1Matthew Harmsen 10.0.0-0.18.a1Endi S. Dewata 10.0.0-0.17.a1Matthew Harmsen 10.0.0-0.16.a1Ade Lee 10.0.0-0.15.a1Christina Fu 10.0.0-0.14.a1Endi S. Dewata 10.0.0-0.13.a1Endi S. Dewata 10.0.0-0.12.a1Ade Lee 10.0.0-0.11.a1Matthew Harmsen 10.0.0-0.10.a1Matthew Harmsen 10.0.0-0.9.a1Jack Magne 10.0.0-0.8.a1Matthew Harmsen 10.0.0-0.7.a1Endi S. Dewata 10.0.0-0.6.a1Ade Lee 10.0.0-0.5.a1Endi S. Dewata 10.0.0-0.4.a1Matthew Harmsen 10.0.0-0.3.a1Matthew Harmsen 10.0.0-0.2.a1Nathan Kinder 10.0.0-0.1.a1Ade Lee 9.0.16-3Endi S. Dewata 9.0.16-2Matthew Harmsen 9.0.16-1Matthew Harmsen 9.0.15-1Matthew Harmsen 9.0.14-1Ade Lee 9.0.13-1Matthew Harmsen 9.0.12-1Matthew Harmsen 9.0.11-1Matthew Harmsen 9.0.10-1Matthew Harmsen 9.0.9-1Matthew Harmsen 9.0.8-2Matthew Harmsen 9.0.8-1Matthew Harmsen 9.0.7-1Matthew Harmsen 9.0.6-2Matthew Harmsen 9.0.6-1Matthew Harmsen 9.0.5-2Matthew Harmsen 9.0.5-1Matthew Harmsen 9.0.4-1Matthew Harmsen 9.0.3-2Matthew Harmsen 9.0.3-1Matthew Harmsen 9.0.2-1Matthew Harmsen 9.0.1-3Matthew Harmsen 9.0.1-2Matthew Harmsen 9.0.1-1Matthew Harmsen 9.0.0-3Matthew Harmsen 9.0.0-2Matthew Harmsen 9.0.0-1- ########################################################################## - # RHEL 7.9 (Batch Update 21): - ########################################################################## - Bugzilla Bug #2160355 - RA Separation by KeyType - Set Token Status [RHCS 9.7 bu 21] (cfu, ckelley) - ########################################################################## - # RHCS 9.7 (Batch Update 21): - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 19): - ########################################################################## - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen) - ########################################################################## - # RHCS 9.7 (Batch Update 19): - ########################################################################## - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [certificate_system_9.7.z] (ckelley, mharmsen)- ########################################################################## - # RHEL 7.9 (Batch Update 18): - ########################################################################## - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen) - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley) - ########################################################################## - # RHCS 9.7 (Batch Update 18): - ########################################################################## - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [certificate_system_9.7.z] (ckelley, mharmsen) - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)- ########################################################################## - # RHEL 7.9 (Batch Update 17): - ########################################################################## - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen) - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley) - ########################################################################## - # RHCS 9.7 (Batch Update 17): - ########################################################################## - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [certificate_system_9.7.z] (ckelley, mharmsen) - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)- ########################################################################## - # RHEL 7.9 (Batch Update 15): - ########################################################################## - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when debug level set to maximum [RHEL 7.9.z] (cfu) - Bugzilla Bug #2082717 - SCEP manual approval failure (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 14): - ########################################################################## - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when debug level set to maximum [RHEL 7.9.z] (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 11): - ########################################################################## - Bugzilla Bug 1998597 - TPS RA Separation Issues (cfu) - Bugzilla Bug 2008319 - PKISpawn with ECC Signing Algorithms fail in FIPS Mode (cfu) - Bugzilla Bug 2018608 - Invalid certificates with creation of subCA (pkispawn single step) [rhel-7.9.0.z] (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 10): - ########################################################################## - Bugzillla Bug 1978345 - End Entity's List Certificates Page Back/Forward Buttons are Broken (ckelley, jonahon.d.parrish@mail.mil, mharmsen) - Bugzilla Bug 2008707 - pkispawn bails out too easily for things that could have been worked around after installation [RHEL 7.9.z] (cfu) - Bugzilla Bug 2016773 - Directory authentication plugin requires directory admin password just for user authentication (rhel-7.9.z) (awnuk@purestorage.com, jmagne) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 9): - ########################################################################## - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500 [ftweedal, ckelley] - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 8): - ########################################################################## - Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu] - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500 [ftweedale, ckelley] - ########################################################################## - # RHCS 9.7 (Batch Update 8): - ########################################################################## - Bugzilla Bug 1959937 - TPS Allowing Token Transactions while the CA is Down [cfu] - Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile Separation [cfu]- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission per LDAP group without immediate issuance [rhel-7.9.z] (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1911472 - Revoke via REST API not working when Agent certificate not issued by CA [rhel-7.9.z] (cfu) - Bugzilla Bug 1914587 - RHEL IPA PKI - Failed to read product version String.java.io.FileNotFoundException (ckelley) - Bugzilla Bug 1942687 - TPS not populating Token Policy, or switching PIN_RESET=YES to NO [rhel-7.9.z] (jmagne) - Bugzilla Bug 1955633 - Recovery of Keys migrated to latest version of KRA fail to recover and result in Null Point Exception [rhel-7.9.z] (jmagne) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1949136 - PKI instance creation failed with new 389-ds-base build (jmagne) - Bugzilla Bug 1949656 - CRMF requests with extensions other than SKID cannot be processed (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)- Change variable 'TPS' to 'tps' - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates profiles, audit for IPA (edewata) - ########################################################################## - # Backported CVEs (ascheel): - ########################################################################## - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token parameters in TPS resulting in stored XSS [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile creation [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site Scripting in 'path length' constraint field in CA's Agent page [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site scripting in getcookies?url= endpoint in CA [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab [rhel-7.9.z] (ascheel) - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne) - ########################################################################## - Update to jquery v3.4.1 (ascheel) - Update to jquery-i18n-properties v1.2.7 (ascheel) - Update to backbone v1.4.0 (ascheel) - Upgrade to underscore v1.9.2 (ascheel) - Update to patternfly v3.59.3 (ascheel) - Update to jQuery v3.5.1 (ascheel) - Upgrade to bootstrap v3.4.1 (ascheel) - Link in new Bootstrap CSS file (ascheel) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates profiles, audit for IPA (edewata) - ########################################################################## - # Backported CVEs (ascheel): - ########################################################################## - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token parameters in TPS resulting in stored XSS [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile creation [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site Scripting in 'path length' constraint field in CA's Agent page [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site scripting in getcookies?url= endpoint in CA [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab [rhel-7.9.z] (ascheel) - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne) - ########################################################################## - Update to jquery v3.4.1 (ascheel) - Update to jquery-i18n-properties v1.2.7 (ascheel) - Update to backbone v1.4.0 (ascheel) - Upgrade to underscore v1.9.2 (ascheel) - Update to patternfly v3.59.3 (ascheel) - Update to jQuery v3.5.1 (ascheel) - Upgrade to bootstrap v3.4.1 (ascheel) - Link in new Bootstrap CSS file (ascheel) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Bugzilla Bug #1883639 - additional fix to upgrade script (edewata)- Bugzilla Bug #1883639 - additional support on upgrade for audit cert profile and auditProfileUpgrade + auditProfileUpgrade part 2 (cfu)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1883639 - add profile caAuditSigningCert (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1710978 - TPS - Add logging to tdbAddCertificatesForCUID if - # Bugzilla Bug #1858860 - TPS - Update Error Codes returned to client - # Bugzilla Bug #1858861 - TPS - Server side key generation is not working - # Bugzilla Bug #1858867 - TPS does not check token cuid on the user- Patch for CMCResponse tool - Bugzilla Bug #1710109 - add RSA PSS support - fix CMCResponse tool (jmagne)- Patch for CMC Credential Error, RSA PSS typo, and new profile for directory-authentication-based Server-Side keygen - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1710109 - add RSA PSS support (jmagne) - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Updated jss dependencies - Bugzilla Bug #1710109 - add RSA PSS support - fix SHA512 (jmagne)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE additional support and touch-up (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1710975 - TPS - Searching the certificate DB for a brand new- Updated jss dependencies - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu) - Bugzilla Bug #1809273 - CRL generation performs an unindexed search (jmagne) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1549307 - No default TPS Auditor group (ascheel)- Bugzilla Bug #1710109 - add RSA PSS support - fix IPA installer (jmagne)- Updated jss dependencies - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1774174 - Rebase pki-core from 10.5.17 to 10.5.18 (RHEL) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and - # Bugzilla Bug #1774181 - Update RHCS version of CA, KRA, OCSP, and TKS so- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1723008 - ECC Key recovery failure with CKR_TEMPLATE_INCONSISTENT (cfu) - Bugzilla Bug #1774282 - pki-server-nuxwdog template has pid file name with non-breakable space char encoded instead of 0x20 space char (ascheel) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS client (cfu) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Include 'pistool' in the 'pki-tools' package- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1445479 - KRATool does not support netkeyKeyRecovery attribute (dmoluguw) - Bugzilla Bug #1534013 - Attempting to add new keys using a PUT KEY APDU to a token that is loaded only with the default/factory keys (Key Version Number 0xFF) returns an APDU with error code 0x6A88. (jmagne) - Bugzilla Bug #1709585 - PKI (test support) for PKCS#11 standard AES KeyWrap for HSM support (cfu, ftweedal) - Bugzilla Bug #1748766 - number range depletion when multiple clones created from same master (ftweedal) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1520258 - TPS token search fails to find entries , LDAP filter - # Bugzilla Bug #1535671 - RFE to have the users be able to use the- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS client (cfu) - Bugzilla Bug #1597727 - CA - Unable to change a certificate’s revocation reason from superceded to key_compromised (rhcs-maint) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1470410 - TPS doesn't update revocation status when - # Bugzilla Bug #1470433 - Add supported transitions to TPS (rhcs-maint) - # Bugzilla Bug #1585722 - TMS - PKISocketFactory – Modify Logging to Allow - # Bugzilla Bug #1642577 - TPS – Revoked Encryption Certificates Marked as- Updated jss, nuxwdog, and tomcatjss dependencies - ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1733586 - Rebase pki-core from 10.5.16 to 10.5.17 (RHEL) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1718418 - Update RHCS version of CA, KRA, OCSP, and TKS so - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.7: - ########################################################################## - Bugzilla Bug #1638379 - PKI startup initialization process should not depend on LDAP operational attributes [ftweedal] - ########################################################################## - # RHCS 9.5: - ########################################################################## - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.7: - ########################################################################## - Bugzilla Bug #1491453 - Need Method to Include SKI in CA Signing Certificate Request [ftweedal] - ########################################################################## - # RHCS 9.5: - ########################################################################## - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Updated jss dependencies - ########################################################################## - # RHEL 7.7: - ########################################################################## - Bugzilla Bug #1633422 - Rebase pki-core from 10.5.1 to 10.5.16 (RHEL) - ########################################################################## - # RHCS 9.5: - ########################################################################## - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] [manpage] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1659939 - CC: Simplifying Web UI session timeout configuration [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA, - # Added Batch Update Information to Product Version (mharmsen)- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1657922 - CC: CA/OCSP startup fail on SystemCertsVerification if enableOCSP is true [rhel-7.6.z] (jmagne) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1645262 - pkidestroy may not remove all files [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1645263 - Auth plugins leave passwords in the access log and audit log using REST [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1645429 - pkispawn fails due to name collision with /var/log/pki/ [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1655951 - CC: tools supporting CMC requests output keyID needs to be captured in file [rhel-7.6.z] (cfu) - Bugzilla Bug #1656297 - Unable to install with admin-generated keys [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- Require "tomcatjss >= 7.2.1-8" as a build and runtime requirement - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1632116 - CC: missing audit event for CS acting as TLS client [rhel-7.6.z] (cfu) - Bugzilla Bug #1632120 - Unsupported RSA_ ciphers should be removed from the default ciphers list [rhel-7.6.z] (cfu) - Bugzilla Bug #1632615 - Permit certain SHA384 FIPS ciphers to be enabled by default for RSA and ECC . . . [rhel-7.6.z] (cfu) - Bugzilla Bug #1632616 - X500Name.directoryStringEncodingOrder overridden by CSR encoding (coverity changes) [rhel-7.6.z] (mharmsen) - Bugzilla Bug #1633104 - CMC: add config to allow non-clientAuth [rhel-7.6.z] (cfu) - Bugzilla Bug #1636490 - Installation of CA using an existing CA fails [rhel-7.6.z] (edewata) - Bugzilla Bug #1643878 - pki cli command for RHCS doesn't prompt for a password [rhel-7.6.z] (edewata) - Bugzilla Bug #1643879 - CC: Identify version/release of pki-ca, pki-kra, pki-ocsp, pki-tks, and pki-tps remotely [RHEL] [rhel-7.6.z] (cfu, jmagne) - Bugzilla Bug #1643880 - PKI subsystem process is not shutdown when there is no space on the disk to write logs [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- Updated nuxwdog dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #673182 - ECC keys not supported for signing audit logs (cfu) - Bugzilla Bug #1593805 - Better understanding of NSS_USE_DECODED_CKA_EC_POINT for ECC (cfu) - Bugzilla Bug #1601071 - Certificate generation happens with partial attributes in CMCRequest file (cfu) - Bugzilla Bug #1601569 - CC: Enable all config audit events (cfu) - Bugzilla Bug #1608375 - CMC Revocations throws exception with same reqIssuer & certissuer (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1596629 - ipa-replica-install --setup-kra broken on DL0 with latest version (abokovoy) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1548203 - pki console configurations that involves ldap passwords leave the plain text password in signed audit logs (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1494591 - keyGen fails when only Identity- Re-spin alpha builds- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1471935 - X500Name.directoryStringEncodingOrder overridden by CSR encoding (cfu) - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a certificate (ftweedal) - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in SharedToken scenario's (cfu) - Bugzilla Bug #1550742 - Address ECC profile overrides (cfu) - Bugzilla Bug #1562841 - servlet profileSubmitCMCSimple throws NPE (cfu) - Bugzilla Bug #1572432 - AuditVerify failure due to line breaks (cfu) - Bugzilla Bug #1592961 - Need proper default subjectDN for CMC request authenticated through SharedToken (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a certifcate (ftweedal) - Bugzilla Bug #1544843 - ExternalCA: Installation failed during csr generation with ecc (rrelyea, gkapoor) - Bugzilla Bug #1557569 - Re-base pki-core from 10.5.1 to latest upstream 10.5.x (RHEL) (mharmsen) - Bugzilla Bug #1580394 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC (cfu) - Bugzilla Bug #1580527 - CVE-2018-1080 pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access (ftweedal, cfu) - Bugzilla Bug #1585866 - CRMFPopClient tool - should allow option to do no key archival (cfu) - Bugzilla Bug #1588655 - Cert validation for installation with external CA cert (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- Rebuild due to build system database problem- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1585945 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC [rhel-7.5.z] (cfu) - Bugzilla Bug #1587826 - ExternalCA: Installation failed during csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor) - Bugzilla Bug #1588944 - Cert validation for installation with external CA cert [rhel-7.5.z] (edewata) - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow option to do no key archival (cfu) - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access [rhel-7.5.z] (ftweedal, cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- Updated "jss" build and runtime requirements (mharmsen) - ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu) - Bugzilla Bug #1572548 - IPA install with external-CA is failing when FIPS mode enabled. [rhel-7.5.z] (edewata) - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE [rhel-7.5.z] (cfu) - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu) - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs improvement [rhel-7.5.z] (jmagne) - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in pkispawn configuration step [rhel-7.5.z] (cfu) - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong input class_id [rhel-7.5.z] (cfu) - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System 9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for standard conformance [rhel-7.5.z] (cfu) - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1560233 - libtps does not directly depend on libz- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1550581 - CMCAuth throws org.mozilla.jss.crypto.TokenException: Unable to insert certificate into temporary database [rhel-7.5.z] (cfu) - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata) - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers [rhel-7.5.z] (cheimes, mharmsen) - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for standard conformance [rhel-7.5.z] (cfu) - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu) - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu) - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1558919 - Not able to generate certificate request with ECC using pki client-cert-request [rhel-7.5.z] (akahat) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1560233 - libtps does not directly depend on libz- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event set (RHEL) (edewata) - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata) - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM and FIPS (edewata) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1542210 - pki console configurations that involves ldap passwords leave the plain text password in debug logs (jmagne) - Bugzilla Bug #1543242 - Regression in lightweight CA key replication (ftweedal) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event set (RHEL) (edewata) - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and audit event logging at startup (jmagne) - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA instance (alee) - Bugzilla Bug #1525306 - CC: missing CMC request and response record (cfu) - Bugzilla Bug #1532933 - Installing subsystems with external CMC certificates in HSM environment shows import error (edewata) - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm (edewata) - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers permitted in fips mode (mharmsen) - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED outcomes. (edewata) - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in SharedToken scenario's (cfu) - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown revRequest.issuer (cfu) - Bugzilla Bug #1541853 - ProfileService: config values with backslashes have backslashes removed (ftweedal) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the- Updated jss, nuxwdog, and openssl dependencies - ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in few cases (ftweedal) - Bugzilla Bug #1428021 - CC: shared token storage and retrieval mechanism (cfu) - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error (cfu) - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog (alee) - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during pkispawn (alee) - Bugzilla Bug #1520526 - p12 admin certificate is missing when certificate is signed Externally (edewata) - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA instance (alee) - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to missing nextupdate field (ftweedal) - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen) - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords in several different files after installation completes (alee) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage (jmagne) - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to setup with CMC signed certificates (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- dogtagpki Pagure Issue #2853 - Cleanup spec file conditionals- Patch applying check-ins since 10.5.1-1- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- #Bugzilla Bug #1492560 - ipa-replica-install --setup-kra broken on DL0- #Require "jss >= 4.4.0-8" as a build and runtime requirement - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Resolves: rhbz #1486870,1485833,1487509,1490241,1491332 - # Bugzilla Bug #1486870 - Lightweight CA key replication fails (regressions) - # Bugzilla Bug #1485833 - Missing CN in user signing cert would cause error - # Bugzilla Bug #1487509 - pki-server-upgrade fails when upgrading from - # Bugzilla Bug #1490241 - PKCS12: upgrade to at least AES and SHA2 (FIPS) - # Bugzilla Bug #1491332 - TPS UI: need to display tokenType and tokenOrigin - # dogtagpki Pagure Issue #2764 - py3: pki.key.archive_encrypted_data: - ########################################################################## - # RHCS 9.2: - ########################################################################## - # Resolves: rhbz #1486870,1485833,1487509,1490241,1491332,1482729,1462271 - # Bugzilla Bug #1462271 - TPS incorrectly assigns "tokenOrigin" and - # Bugzilla Bug #1482729 - TPS UI: need to display tokenType and tokenOrigin- Resolves: rhbz #1463350 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1463350 - Access banner validation (edewata)- # Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing - # Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause - # Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert - # Bugzilla Bug #1463350 - Access banner validation (edewata) - # Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal - # Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen) - # Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with - # Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option - # Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03 - # Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system- # Resolves: rhbz #1469432 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1469432 - CMC plugin default change - # Resolves CVE-2017-7537 - # Fixes BZ #1470948- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1458043 - Key recovery on token fails with invalid public key error on KRA (alee) - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client authentication cert against CMC signer (cfu) - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after deleting the any of the subsystem certs from it (ftweedal)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret) using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne) - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing certificate requests (cfu) - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC revocation non-signing cert requests (cfu) - Bugzilla Bug #1458047 - change the way aes clients refer to aes keysets (alee) - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code (alee) - Bugzilla Bug #1460028 - In keywrap mode, key recovery on KRA with HSM causes KRA to crash (ftweedal)- Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement - ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS enabled system (edewata) - Bugzilla Bug #1447144 - CA brought down during separate KRA instance creation (edewata) - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure ACCESS_SESSION_ESTABLISH_FAILURE (edewata) - Bugzilla Bug #1454450 - SubCA installation failure with 2 step installation in fips enabled mode (edewata) - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import is asking for password when already provided (edewata) - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes) - Bugzilla Bug #1458043 - Key recovery using externalReg fails with java null pointer exception on KRA (alee) - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter (edewata) - Bugzilla Bug #1458429 - client-cert-import --ca-cert should import CA cert with trust bits "CT,C,C" (edewata) - ########################################################################## - # RHCS 9.2: - ########################################################################## - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret) using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne) - Bugzilla Bug #1445519 - CA Server installation with HSM fails (jmagne) - Bugzilla Bug #1452617 - Unable to create IPA Sub CA (ftweedal) - Bugzilla Bug #1454471 - Enabling all subsystems on startup (edewata) - Bugzilla Bug #1455617 - Key recovery on token fails because key record is not marked encrypted (alee)- Bugzilla Bug #1454603 - Unable to install IPA server due to pkispawn error (mharmsen)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal non-signing cert requests (cfu) - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed) CMC with identity proof (cfu) - Bugzilla Bug #1447144 - CA brought down during separate KRA instance creation (mharmsen) - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata) - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne) - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen) - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in ConnectorServlet. (edewata) - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata) - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED audit event. (edewata)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when HSM is used. (alee) - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes) - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error (cfu) - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from the KRA (ftweedal) - Bugzilla Bug #1448204 - pkispawn of clone install fails with InvalidBERException (ftweedal) - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on thales hsm (alee) - Updated "jss" build and runtime requirements (mharmsen) - ########################################################################## - # RHCS 9.2: - ########################################################################## - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)- ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in conjuction with FreeIPA (ftweedal) - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the startTime parameter is not working as expected. (jmagne) - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing certificate requests (cfu) - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal) - Bugzilla Bug #1445088 - profile modification cannot remove existing config parameters (ftweedal) - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption) (RHEL) (alee) - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when pki CLI terminates SSL connection (edewata) - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption) (RHCS) (alee)- ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1282504 - Installing pki-server in container reports scriptlet failed, exit status 1 (jpazdziora) - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS enabled system (edewata) - Bugzilla Bug #1410650 - [RFE] Add SCP03 support for sc 7 g & d cards (RHEL) (jmagne) - Bugzilla Bug #1437591 - cli authentication using expired cert throws an exception (edewata) - Bugzilla Bug #1437602 - non-CA cli looks for CA in the instance during a request (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1274086 - [RFE] Add SCP03 support for sc 7 g & d cards (RHCS) (jmagne) - ############################################################################ - # Common Criteria - ############################################################################ - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures (edewata) - Bugzilla Bug #1417307 - CC: Audit Review /Searches (edewata) - Bugzilla Bug #1419737 - CC: CMC: id-cmc-popLinkWitnessV2 feature implementation (cfu)- Require "nss >= 3.28.3" as a build and runtime requirement - Require "jss >= 4.4.0-4" as a build and runtime requirement - Require "tomcatjss >= 7.2.1-3" as a build and runtime requirement - dogtagpki Pagure Issue #2612 - Unable to clone due to pki pkcs12-cert-find failure (edewata) - ############################################################################ - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4 - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.4.x - ############################################################################ - # RHEL 7.4: - ############################################################################ - ############################################################################ - # RHCS 9.2: - ############################################################################ - ############################################################################ - # Common Criteria - ############################################################################ - Bugzilla Bug #1419734 - CC: CMC: id-cmc-identityProofV2 feature implementation (cfu) - Bugzilla Bug #1419742 - CC: CMC: provide Proof of Possession for encryption cert requests (cfu) - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures (edewata) - Bugzilla Bug #1428020 - CC: CMC feature support: provided issuance protection cert mechanism (cfu)- Require "jss >= 4.4.0-1" as a build and runtime requirement - Require "tomcatjss >= 7.2.1-1" as a build and runtime requirement - ############################################################################ - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4 - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.4.x - ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1222557 - ECDSA Certificates Generated by Certificate System 8.1 fail NIST validation test with parameter field. (cfu) - Bugzilla Bug #1238684 - Generting Symmetric key fails with key-generate when --usages verify (vakwetu) - Bugzilla Bug #1246635 - user-cert-add --serial CLI request to secure port with remote CA shows authentication failure (edewata) - Bugzilla Bug #1249400 - CA EE: Submit caUserCert request without uid does not show proper error message (vakwetu) - Bugzilla Bug #1305993 - Add profile component that copies CN to SAN (ftweedal) - Bugzilla Bug #1316653 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any (edewata) - Bugzilla Bug #1325071 - add options to enable/disable cert or crl publishing. (vakwetu) - Bugzilla Bug #1330800 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?) (edewata) - Bugzilla Bug #1368410 - Misleading Logging for HSM (edewata) - Bugzilla Bug #1372052 - Unable to search certificate requests using the latest request ID (edewata) - Bugzilla Bug #1375347 - Typo in comment line of UserPwdDirAuthentication.java (edewata) - Bugzilla Bug #1376226 - IPA replica-prepare failed with error "Profile caIPAserviceCert Not Found" (ftweedal) - Bugzilla Bug #1376488 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - Bugzilla Bug #1378275 - two-step externally-signed CA installation fails due to missing AuthorityID (ftweedal) - Bugzilla Bug #1378277 - Spurious host authority entries created (ftweedal) - Bugzilla Bug #1378527 - Miscellaneous Minor Changes (edewata) - Bugzilla Bug #1381084 - KRA installation failed against externally-signed CA with partial certificate chain (edewata) - Bugzilla Bug #1382066 - Problems with FIPS mode (edewata) - Bugzilla Bug #1386371 - Remove xenroll.dll from pki-core (mharmsen) - Bugzilla Bug #1386424 - Fix packaging duplicates of classes in multiple jar files (edewata) - Bugzilla Bug #1391737 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (RHEL 7) (edewata) - Bugzilla Bug #1392068 - [RFE] add express archivals and retrievals from KRA (vakwetu) - Bugzilla Bug #1395817 - Unable to install subordinate CA with HSM in FIPS mode (edewata) - Bugzilla Bug #1397200 - pkispawn does not change default ecc key size from nistp256 when nistp384 is specified in spawn config (jmagne) - Bugzilla Bug #1399862 - Dogtag 10.3.9 Man Pages (edewata) - Bugzilla Bug #1404881 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - Bugzilla Bug #1405654 - Token memory not wiped after key deletion (RHEL) (jmagne) - Bugzilla Bug #1409946 - Request ID undefined for CA signing certificate (vakwetu) - Bugzilla Bug #1409949 - CA Certificate Issuance Date displayed on CA website incorrect (vakwetu) - Bugzilla Bug #1410650 - [RFE] Add SCP03 support (RHEL) (jmagne) - Bugzilla Bug #1411428 - Unable to create a CA clone in FIPS (edewata) - Bugzilla Bug #1412211 - Unable to set up KRA in FIPS (edewata) - Bugzilla Bug #1412681 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs (ftweedal) - Bugzilla Bug #1413132 - pki-tomcat for 10+ minutes before generating cert (edewata) - Bugzilla Bug #1413136 - Problem with default AJP hostname in IPv6 environment. (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1 (cfu) - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne) - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed tokens (jmagne) - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working when a token is physically damaged and a temporary token is issued (jmagne) - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches (cfu) - Bugzilla Bug #1381635 - Token format with external reg fails when op.format.externalRegAddToToken.revokeCert=true (cfu) - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when set on a token (jmagne) - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (RHCS 9) (edewata) - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (RHCS) (jmagne) - Bugzilla Bug #1404900 - Dogtag 10.3.9 logging properties (edewata) - Bugzilla Bug #1405655 - Token memory not wiped after key deletion (RHCS) (jmagne) - ############################################################################- ## RHEL 7.3.z Batch Update 4 - Bugzilla Bug #1429492 - Add profile component that copies CN to SAN (ftweedal)- ## RHCS 9.1.z Batch Update 3 - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - ## RHEL 7.3.z Batch Update 3 - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System 8.1 fail NIST validation test with parameter field. (cfu) - Bugzilla Bug #1417064 - Unable to search certificate requests using the latest request ID (edewata) - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website incorrect (alee) - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs (ftweedal) - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert (edewata) - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6 environment. (edewata)- Separate original patches into RHEL and RHCS portions - ## RHEL 7.3.z Batch Update 2 - Bugzilla Bug #1404176 - logging properties and man pages (edewata) - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - ## RHCS 9.1.z Batch Update 2 - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - Bugzilla Bug #1404900 - RHCS logging properties (edewata)- ## RHEL 7.3.z Batch Update 2 - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port with remote CA shows authentication failure (edewata) - Bugzilla Bug #1404175 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any (edewata) - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI [pki-base] (edewata) - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS mode (edewata) - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from nistp256 when nistp384 is specified in spawn config (jmagne) - Bugzilla Bug #1404176 - logging properties and man pages (edewata) - ## RHCS 9.1.z Batch Update 2 - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI [pki-tps] (edewata) - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne)- Marked the following RHCS 9.1.z bug: Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne) as a duplicate of RHEL 7.3.z bug: Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) and moved the patch from the RHCS 9.1.z bug to the RHEL 7.3.z bug.- ## RHEL 7.3.z Batch Update 1 - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) (added KRA key recovery via CLI in FIPS mode) - ## RHCS 9.1.z Batch Update 1 - Reverted patches associated with Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (edewata)- ## RHEL 7.3.z Batch Update 1 - Bugzilla Bug #1390318 - CA EE: Submit caUserCert request without uid does not show proper error message (alee) - Bugzilla Bug #1390319 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?) (edewata) - Bugzilla Bug #1390320 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - Bugzilla Bug #1390321 - two-step externally-signed CA installation fails due to missing AuthorityID (ftweedal) - Bugzilla Bug #1390322 - Spurious host authority entries created (ftweedal) - Bugzilla Bug #1390324 - KRA installation failed against externally-signed CA with partial certificate chain (edewata) - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) - Bugzilla Bug #1390311 - Fix packaging duplicates of classes in multiple jar files (edewata) - Bugzilla Bug #1390325 - Typo in comment line of UserPwdDirAuthentication.java (edewata) - ## RHCS 9.1.z Batch Update 1 - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1" (cfu) - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed tokens (jmagne) - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working when a token is physically damaged and a temporary token is issued (jmagne) - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches - Bugzilla Bug #1381635 - Token format with external reg fails when op.format.externalRegAddToToken.revokeCert=true (cfu) - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when set on a token (jmagne) - Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne) - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (edewata)- PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu) - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed tokens (jmagne) - PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches (cfu) - PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar files (edewata)- Revert Patch: PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens (edewata) - Resolves: rhbz #1374054 - ipa-replica-install fails setting up certificate - Restores: rhbz #1319557 - pkispawn KRA instance is failing server - Removes from Errata: rhbz #1372041 - Unable to create system certificates in different tokens- PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion (ftweedal) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (edewata) - PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry deleted (ftweedal) - PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if USN plugin enabled (ftweedal) - PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per instance name (for shared HSM) (cfu) - PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs (vakwetu) - PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens (edewata)- PKI TRAC Ticket #1578 - Authentication Instance Id PinDirEnrollment with authType value as SslclientAuth is not working (jmagne) - PKI TRAC TIcket #2414 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided (gkapoor) - PKI TRAC Ticket #2423 - pki_ca_signing_token when not specified does not fallback to pki_token_name value (edewata) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (akasurde) - ticket remains open - PKI TRAC Ticket #2439 - Outdated deployment descriptors in upgraded server(edewata)- PKI TRAC Ticket #690 - [MAN] pki-tools man pages (mharmsen) - CMCEnroll - PKI TRAC Ticket #833 - pki user-mod fullName="" gives an error message "PKIException: LDAP error (21): error result" (edewata) - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade. (cheimes, edewata, mharmsen) - PKI TRAC Ticket #2432 - Kra-selftest behavior is not as expected (edewata) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (edewata, mharmsen) - PKI TRAC Ticket #2437 - TPS UI: while adding certs for users from TPSUI pem format with/without header works while pkcs7 with header is not allowed (edewata) - PKI TRAC Ticket #2440 - Optional CA signing CSR for migration (edewata)- Bugzilla Bug #1366465 - Errata TPS upgrade test fails- PKI TRAC Ticket #978 - TPS connector man page: add revocation routing info (cfu) - PKI TRAC Ticket #1285 - [MAN] Apply 'generateCRMFRequest() removed from Firefox' workarounds to appropriate 'pki' man page (jmagne) - PKI TRAC Ticket #2246 - [MAN] Man Page: AuditVerify (cfu) - PKI TRAC Ticket #2381 - Throws exception while providing invalid module. (edewata) - PKI TRAC Ticket #2383 - CLI :: pki client-cert-request --extractable should accept only boolean value (edewata) - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA (cfu) - PKI TRAC Ticket #2399 - Dogtag 10.3.5: Miscellaneous Enhancements (akasurde, alee, cheimes, edewata, jmagne, mharmsen) - PKI TRAC Ticket #2401 - pkispawn calls dnsdomainname even if it does not rpm-require hostname (mharmsen) - PKI TRAC Ticket #2402 - Conflict in file ownership in pki-base and pki-server (cheimes) - PKI TRAC Ticket #2403 - Deployment problem with RESTEasy 3.0.17 (edewata) - PKI TRAC Ticket #2406 - Make starting CRL Number configurable (jmagne) - PKI TRAC Ticket #2412 - pki client-cert-import --trust option does not apply the specified trust bits (alee) - PKI TRAC Ticket #2418 - [TPS] Some template substitution didn't happen during installation (alee) - PKI TRAC Ticket #2420 - CA subsystem OSCP responder fails when LWCAs are not used (ftweedal) - PKI TRAC Ticket #2421 - Incorrect SELinux contexts Installation/Configuration (edewata) - PKI TRAC Ticket #2424 - ipa-ca-install fails on replica when IPA server is converted from CA-less to CA-full (edewata) - PKI TRAC Ticket #2428 - broken request links for CA's system certs in agent request viewing (cfu) - PKI TRAC Ticket #2430 - CA Agent certificate list is not sorted by serial number in migration case (jmagne) - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade. (mharmsen) - PKI TRAC Ticket #2433 - Lightweight CA GET /chain returns bogus PEM data (ftweedal)- PKI TRAC Ticket #691 - [MAN] pki-server man pages (mharmsen) - PKI TRAC Ticket #1114 - [MAN] Generting Symmetric key fails with key-generate when --usages verify is passed (jmagne) - PKI TRAC Ticket #1306 - [RFE] Add granularity to token termination in TPS (cfu) - PKI TRAC Ticket #1308 - [RFE] Provide ability to perform off-card key generation for non-encryption token keys (cfu) - PKI TRAC Ticket #1405 - [MAN] Add additional HSM details to 'pki_default.cfg' & 'pkispawn' man pages (mharmsen) - PKI TRAC Ticket #1607 - [MAN] man pkispawn has inadequate description for shared vs non shared tomcat instance installation (mharmsen) - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - PKI TRAC Ticket #1711 - CLI :: pki-server ca-cert-request-find throws IOError (edewata, ftweedal) - PKI TRAC Ticket #2285 - freeipa fails to start correctly after pki-core update on upgraded system (ftweedal) - PKI TRAC Ticket #2311 - When pki_token_name=Internal, consider normalizing it to "internal" (mharmsen) - PKI TRAC Ticket #2349 - Separated TPS does not automatically receive shared secret from remote TKS (jmagne) - PKI TRAC Ticket #2364 - CLI :: pki-server ca-cert-request-show throws attribute error (ftweedal) - PKI TRAC Ticket #2368 - pki-server subsystem subcommands throws error with --help option (edewata) - PKI TRAC Ticket #2374 - KRA cloning overwrites CA signing certificate trust flags (edewata) - PKI TRAC Ticket #2380 - Pki-server instance commands throws exception while specifying invalid parameters. (edewata) - PKI TRAC Ticket #2384 - CA installation with HSM prompts for HSM password during silent installation (edewata) - PKI TRAC Ticket #2385 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg (ftweedal) - PKI TRAC Ticket #2387 - Add config for default OCSP URI if none given (ftweedal) - PKI TRAC Ticket #2388 - CA creation responds 500 if certificate issuance fails (ftweedal) - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA (cfu) - PKI TRAC Ticket #2390 - Dogtag 10.3.4: Miscellaneous Enhancements (akasurde, edewata)- PKI TRAC Ticket #2373 - Fedora 25: RestEasy 3.0.6 ==> 3.0.17 breaks pki-core (ftweedal)- Updated release number to 10.3.3-1- Updated version number to 10.3.3-0.1- Provided cleaner runtime dependency separation- Updated tomcatjss version dependencies- Updated 'java', 'java-headless', and 'java-devel' dependencies to 1:1.8.0.- Updated tomcat version dependencies- Updated version number to 10.3.2-1- Updated version number to 10.3.2-0.1- Updated version number to 10.3.1-1 (to allow upgrade from 10.3.0.b1)- Updated version number to 10.3.0-1- Build for F24 beta- PKI TRAC Ticket #2255 - PKCS #12 backup does not contain trust attributes.- Updated build for F24 alpha- PKI TRAC Ticket #1625 - Allow multiple ACLs of same name (union of rules) [ftweedal] - PKI TRAC Ticket #2237 - Add CRL dist points extension to OIDMap unconditionally [edewata] - PKI TRAC Ticket #1803 - Removed unnecessary URL encoding for admin cert request. [edewata] - PKI TRAC Ticket #1742 - Added support for cloning 3rd-party CA certificates. [edewata] - PKI TRAC Ticket #1482 - Added TPS token filter dialog. [edewata] - PKI TRAC Ticket #1808 - Fixed illegal token state transition via TEMP_LOST. [edewata]- Build for F24 alpha- PKI Trac Ticket #1399 - Move java components out of pki-base- PKI TRAC Ticket #1850 - Rename DRMTool --> KRATool- PKI TRAC Ticket #1714 - mod_revocator and mod_nss dependency for tps should be removed- PKI TRAC Ticket #1623 - Runtime dependency on python-nss is missing- Updated version number to 10.3.0-0.1- Added dep on tomcat-servlet-3.1-api [Fedora 23 and later] or dep on tomcat-servlet-3.0-api [Fedora 22 and later] to pki-tools - Updated dep on tomcatjss [Fedora 23 and later]- Updated dep on policycoreutils-python-utils [Fedora 23 and later]- Updated version number to 10.2.7-0.1- Update release number for release build- Remove setup directory and remaining Perl dependencies- Remove ExcludeArch directive- Updated version number to 10.2.6-0.1- Update release number for release build- Resolves rhbz #1230970 - Errata TPS tests for rpm verification failed- Updated version number to 10.2.5-0.1- Update release number for release build- Updated nuxwdog and tomcatjss requirements (alee)- Updated version number to 10.2.4-0.1 - Added nuxwdog systemd files- Update release number for release build- Reverted version number back to 10.2.3-0.1 - Added support for Tomcat 8.- Updated version number to 10.3.0-0.1- Updated version number to 10.2.3-0.1- Update release number for release build- Updated version number to 10.2.2-0.1 - Moved web application deployment locations. - Updated Resteasy and Jackson dependencies. - Added missing python-lxml build dependency.- Update release number for release build- PKI TRAC Ticket #1187 - mod_perl should be removed from requirements for 10.2 - PKI TRAC Ticket #1205 - Outdated selinux-policy dependency. - Removed perl(XML::LibXML), perl-Crypt-SSLeay, and perl-Mozilla-LDAP runtime dependencies- Change resteasy dependencies for F22+- Ticket 1198 Bugzilla 1158410 add TLS range support to server.xml by default and upgrade (cfu) - PKI Trac Ticket #1211 - New release overwrites old source tarball (mharmsen) - up the release number to 0.2- Updated version number to 10.2.1-0.1. - Added CLIs to simplify generating user certificates - Added enhancements to KRA Python API - Added a man page for pki ca-profile commands. - Added python api docs- Disable pylint dependency for RHEL builds - Added jakarta-commons-httpclient requirements - Added tomcat version for RHEL build - Added resteasy-base-client for RHEL build- PKI TRAC Ticket #1130 - Add RHEL/CentOS conditionals to spec- Update release number for release build- PKI TRAC Ticket #1017 - Rename pki-tps-tomcat to pki-tps- Merged jmagne@redhat.com's spec file changes from the stand-alone 'pki-tps-client' package needed to build/run the native 'tpsclient' command line utility into this 'pki-core' spec file under the 'tps' package. - Original tps libararies must be built to support this native utility. - Modifies tps package from 'noarch' into 'architecture-specific' package- PKI TRAC Ticket #1127 - Remove 'pki-ra', 'pki-setup', and 'pki-silent' packages . . .- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild- Respin to include the applet files with the rpm install. No change to spec file needed.- Bugzilla Bug #1120045 - pki-core: Switch to java-headless (build)requires -- drop dependency on java-atk-wrapper - Removed 'java-atk-wrapper' dependency from 'pki-server'- PKI TRAC Ticket #832 - Remove legacy 'systemctl' files . . .- Update rawhide build- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild- Use Requires: java-headless rebuild (#1067528)- Added option to build without server packages. - Replaced Jettison with Jackson. - Added python-nss build requirement - Bugzilla Bug #1057959 - pkispawn requires policycoreutils-python - TRAC Ticket #840 - pkispawn requires policycoreutils-python - Updated requirements for resteasy - Added template files for archive, retrieve and generate key requests to the client package.- Trac Ticket 788 - Clean up spec files - Update release number for release build - Updated requirements for resteasy- Change release number for beta build- Updated requirements for tomcat- Removed additional /var/run, /var/lock references.- Removed delivery of /var/lock and /var/run directories for fedora 20.- Moved Tomcat-based TPS into pki-core.- Listed new packages required during build, due to issues reported by pylint. - Packages added: python-requests, python-ldap, libselinux-python, policycoreutils-python- Added pylint scan to the build process.- Added man pages for upgrade tools.- Cleaned up the code to install man pages.- Reorganized deployment tools.- Bugzilla Bug 973224 - resteasy-base must be split into subpackages to simplify dependencies- Updated dependencies to Java 1.7.- TRAC Ticket 606 - add restart / start at boot info to pkispawn man page - TRAC Ticket 610 - Document limitation in using GUI install - TRAC Ticket 629 - Package ownership of '/usr/share/pki/etc/' directory- Change release number for 10.1 development- Fixed incorrect JNI_JAR_DIR.- TRAC Ticket 605 Junit internal function used in TestRunner, breaks F19 build- TRAC Ticket 604 Added fallback methods for pkispawn tests- Added default pki.conf in /usr/share/pki/etc - Create upgrade tracker on install and remove it on uninstall- Change release number for official release.- Added %pretrans script for f19 - Added java-atk-wrapper dependency- Added pki-server-upgrade script and pki.server module. - Call upgrade scripts in %post for pki-base and pki-server.- Added dependency on commons-io.- Add /var/log/pki and /var/lib/pki directories- Run pki-upgrade on post server installation.- Added dependency on python-lxml.- Added pki-upgrade script.- Updated version number to 10.0.2-0.1.- Renamed base/deploy to base/server. - Moved pki.conf into pki-base. - Removed redundant pki/server folder declaration.- Removed jython dependency- Added minimum python-requests version.- Bugzilla Bug #919476 - pkispawn crashes due to dangling symlink to jss4.jar- Added dependency on python-requests. - Reorganized Python module packaging.- Added dependency on python-ldap.- TRAC Ticket #517 - Clean up theme dependencies - TRAC Ticket #518 - Remove UI dependencies from pkispawn . . .- Removed runtime dependency on 'pki-server-theme' to resolve Bugzilla Bug #916134 - unresolved dependency in pki-server: pki-server-theme- TRAC Ticket 214 - Missing error description for duplicate user - TRAC Ticket 213 - Add nonces for cert revocation - TRAC Ticket 367 - pkidestroy does not remove connector - TRAC Ticket #430 - License for 3rd party code - Bugzilla Bug 839426 - [RFE] ECC CRL support for OCSP - Fix spec file to allow f17 to work with latest tomcatjss - TRAC Ticket 466 - Increase root CA validity to 20 years - TRAC Ticket 469 - Fix tomcatjss issue in spec files - TRAC Ticket 468 - pkispawn throws exception - TRAC Ticket 191 - Mapping HTTP Exceptions to HTTP error codes - TRAC Ticket 271 - Dogtag 10: Fix 'status' command in 'pkidaemon' . . . - TRAC Ticket 437 - Make admin cert p12 file location configurable - TRAC Ticket 393 - pkispawn fails when selinux is disabled - Punctuation and formatting changes in man pages - Revert to using default config file for pkidestroy - Hardcode setting of resteasy-lib for instance - TRAC Ticket 436 - Interpolation for pki_subsystem - TRAC Ticket 433 - Interpolation for paths - TRAC Ticket 435 - Identical instance id and instance name - TRAC Ticket 406 - Replace file dependencies with package dependencies- TRAC Ticket #430 - License for 3rd party code- TRAC Ticket #469 - Dogtag 10: Fix tomcatjss issue in pki-core.spec and dogtag-pki.spec . . . - TRAC Ticket #468 - pkispawn throws exception- Replaced file dependencies with package dependencies- Updated man pages- Update to official release for rc1- TRAC Ticket #315 - Man pages for pkispawn/pkidestroy. - Added place-holders for 'pki.1' and 'pki_default.cfg.5' man pages.- Added system-wide configuration /etc/pki/pki.conf. - Removed redundant lines in %files.- Moved default deployment configuration to /etc/pki.- Cleaned up spec file to provide only support rhel 7+, f17+ - Added resteasy-base dependency for rhel 7 - Update cmake version- Update release to b3- Removed dependency on CA, KRA, OCSP, TKS theme packages.- Renamed pki-common-theme to pki-server-theme.- TRAC Ticket #395 - Dogtag 10: Add a Tomcat 7 runtime requirement to 'pki-server'- Update release to b2- TRAC Ticket #350 - Dogtag 10: Remove version numbers from PKI jar files . . .- Added Obsoletes for pki-selinux- Remove build of pki-selinux for f18, use system policy instead- Update required tomcatjss version - Added net-tools dependency- Update selinux-policy version to fix error from latest policy changes- Fix typo in selinux policy versions- Added build requires for correct version of selinux-policy-devel- Update release to b1- Merged pki-silent into pki-server.- Renamed "shared" folder to "server".- Added required selinux versions for new policy.- Added Provides to packages replacing obsolete packages.- Update release to a2- Modified CMake to use RPM version number- Added VERSION file- Merged pki-setup into pki-server- Added Conflicts for IPA 2.X - Added build requires for zip to work around mock problem- TRAC Ticket #312 - Dogtag 10: Automatically restart any running instances upon RPM "update" . . . - TRAC Ticket #317 - Dogtag 10: Move "pkispawn"/"pkidestroy" from /usr/bin to /usr/sbin . . .- Fixed pki-server to include everything in shared dir.- Added build dependency on redhat-rpm-config.- Merged Javadoc packages.- Added pki-tomcat.jar.- Moved webapp creation code into pkispawn.- Split pki-client.jar into pki-certsrv.jar and pki-tools.jar.- Merged pki-native-tools and pki-java-tools into pki-tools. - Modified pki-server to depend on pki-tools.- Split pki-common into pki-base and pki-server. - Merged pki-util into pki-base. - Merged pki-deploy into pki-server.- Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 17 - Changed Dogtag 10 build-time and runtime requirements for 'pki-deploy' - Altered PKI Package Dependency Chain (top-to-bottom): pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy --> pki-common- Added pki-client.jar.- Merged pki-jndi-realm.jar into pki-cmscore.jar.- PKI TRAC Task #254 - Dogtag 10: Fix spec file to build successfully via mock on Fedora 17 . . .- Moved 'pki-jndi-real.jar' link from 'tomcat6' to 'tomcat' (Tomcat 7)- Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 18- Added CLI for REST services- Integration of Tomcat 7 - Addition of centralized 'pki-tomcatd' systemd functionality to the PKI Deployment strategy - Removal of 'pki_flavor' attribute- BZ 813075 - selinux denial for file size access- Bug 745278 - [RFE] ECC encryption keys cannot be archived- Replaced candlepin-deps with resteasy- Added option to build without Javadoc- BZ 802396 - Change location of TOMCAT_LOG to match tomcat6 changes - Corrected patch selected for selinux f17 rules- Corrected 'junit' dependency check- Initial attempt at PKI deployment framework described in 'http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment'.- Added support for pki-jndi-realm in tomcat6 in pki-common and pki-kra. - Ticket #69.- For 'mock' purposes, removed platform-specific logic from around the 'patch' files so that ALL 'patch' files will be included in the SRPM.- Removed dependency on OSUtil.- 'pki-selinux' - Added platform-dependent patches for SELinux component - Bugzilla Bug #739708 - Selinux fix for ephemeral ports (F16) - Bugzilla Bug #795966 - pki-selinux policy is kind of a mess (F17)- Added dependency on Apache Commons Codec.- Add '-DSYSTEMD_LIB_INSTALL_DIR' override flag to 'cmake' to address changes in fundamental path structure in Fedora 17 - 'pki-setup' - Hard-code Perl dependencies to protect against bugs such as Bugzilla Bug #772699 - Adapt perl and python fileattrs to changed file 5.10 magics - 'pki-selinux' - Bugzilla Bug #795966 - pki-selinux policy is kind of a mess- Integrated 'pki-kra' into 'pki-core' - Integrated 'pki-ocsp' into 'pki-core' - Integrated 'pki-tks' into 'pki-core' - Bugzilla Bug #788787 - added 'junit'/'junit4' build-time requirements- Updated package version number- Added resteasy-jettison-provider-2.3-RC1.jar to pki-setup- Added JUnit tests- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #744797 - KRA key recovery (retrieve pkcs#12) fails after the in-place upgrade( CS 8.0->8.1) (cfu) - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #746367 - Typo in the profile name. (jmagne) - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - Bugzilla Bug #749927 - Java class conflicts using Java 7 in Fedora 17 (rawhide) . . . (mharmsen) - Bugzilla Bug #749945 - Installation error reported during CA, DRM, OCSP, and TKS package installation . . . (mharmsen) - 'pki-silent'- Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . (mharmsen) - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-setup' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - Bugzilla Bug #737192 - Need script to upgrade proxy configuration (alee) - 'pki-symkey' - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode (hsm+NSS). (jmagne) - 'pki-native-tools' - Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-util' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - Bugzilla Bug #737218 - Incorrect request attribute name matching ignores request attributes during request parsing. (awnuk) - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode (hsm+NSS). (jmagne) - 'pki-selinux' - Bugzilla Bug #739708 - pki-selinux lacks rules in F16 (alee) - 'pki-ca' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-silent' - Bugzilla Bug #739201 - pkisilent does not take arch into account as Java packages migrated to arch-dependent directories (mharmsen)- 'pki-setup' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-symkey' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-java-tools' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-common' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-silent' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .- 'pki-setup' - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-ca' - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-common' - Bugzilla Bug #699809 - Convert CS to use systemd (alee)- 'pki-setup' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-symkey' - 'pki-native-tools' - Bugzilla Bug #717643 - Fopen without NULL check and other Coverity issues (awnuk) - Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk) - 'pki-util' - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #700522 - pki tomcat6 instances currently running unconfined, allow server to come up when selinux disabled (alee) - Bugzilla Bug #731741 - some CS.cfg nickname parameters not updated correctly when subsystem cloned (using hsm) (alee) - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-selinux' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-ca' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-silent'- 'pki-setup' - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee) - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #724861 - DRMTool: fix duplicate "dn:" records by renumbering "cn=" (mharmsen) - 'pki-common' - Bugzilla Bug #717041 - Improve escaping of some enrollment inputs like (jmagne, awnuk) - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee) - Bugzilla Bug #708075 - Clone installation does not work over NAT (alee) - Bugzilla Bug #726785 - If replication fails while setting up a clone it will wait forever (alee) - Bugzilla Bug #728332 - xml output has changed on cert requests (awnuk) - Bugzilla Bug #700505 - pki tomcat6 instances currently running unconfined (alee) - 'pki-selinux' - Bugzilla Bug #700505 - pki tomcat6 instances currently running unconfined (alee) - 'pki-ca' - Bugzilla Bug #728605 - RFE: increase default validity from 6mo to 2yrs in IPA profile (awnuk) - 'pki-silent' - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee)- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an ECC CA to generate ECC certs from CRMF. (jmagne) - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any component value which is equal to its default value (alee) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #720510 - Console: Adding a certificate into nethsm throws Token not found error. (jmagne) - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an ECC CA to generate ECC certs from CRMF. (jmagne) - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any component value which is equal to its default value (alee) - Bugzilla Bug #722989 - Registering an agent when a subsystem is created - does not log AUTHZ_SUCCESS event. (alee) - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #719113 - Add client usage flag to caIPAserviceCert (awnuk) - 'pki-silent'- Updated release of 'jss' - Updated release of 'tomcatjss' for Fedora 15 - 'pki-setup' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-symkey' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-native-tools' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #717765 - TPS configuration: logging into security domain from tps does not work with clientauth=want. (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-util' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-java-tools' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (config file and record processing) (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (tweaks) (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-common' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs throws 'Invalid protocol' for OCSP subsystems (alee) - Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee) - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages (alee) - Bugzilla Bug #694143 - CA Agent not returning specified request (awnuk) - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages (jmagne) - Bugzilla Bug #698885 - Race conditions during IPA installation (alee) - Bugzilla Bug #704792 - CC_LAB_EVAL: CA agent interface: SubjectID=$Unidentified$ fails audit evaluation (jmagne) - Bugzilla Bug #705914 - SCEP mishandles nicknames when processing subsequent SCEP requests. (awnuk) - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #707416 - additional audit messages for GetCookie (alee) - Bugzilla Bug #707607 - Published certificate summary has list of non-published certificates with succeeded status (jmagne) - Bugzilla Bug #717813 - EV_AUDIT_LOG_SHUTDOWN audit log not generated for tps and ca on server shutdown (jmagne) - Bugzilla Bug #697939 - DRM signed audit log message - operation should be read instead of modify (jmagne) - Bugzilla Bug #718427 - When audit log is full, server continue to function. (alee) - Bugzilla Bug #718607 - CC_LAB_EVAL: No AUTH message is generated in CA's signedaudit log when a directory based user enrollment is performed (jmagne) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-selinux' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #720503 - RA and TPS require additional SELinux permissions to run in "Enforcing" mode (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-ca' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems (mharmsen) - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #716269 - make ra authenticated profiles non-visible on ee pages (alee) - Bugzilla Bug #718621 - CC_LAB_EVAL: PRIVATE_KEY_ARCHIVE_REQUEST occurs for a revocation invoked by EE user (awnuk) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-silent' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Added 'DRMTool.cfg' configuration file to inventory - 'pki-common' - 'pki-selinux' - 'pki-ca' - 'pki-silent'- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #532548 - Tool to do DRM re-key - 'pki-common' - 'pki-selinux' - 'pki-ca' - 'pki-silent'- 'pki-setup' - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #694569 - parameter used by pkiremove not updated - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs throws 'Invalid protocol' for OCSP subsystems - Bugzilla Bug #694569 - parameter used by pkiremove not updated - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages - Bugzilla Bug #694143 - CA Agent not returning specified request - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages - Bugzilla Bug #698885 - Race conditions during IPA installation - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems - 'pki-silent'- Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Bugzilla Bug #693327 - Missing requires: tomcatjss - 'pki-setup' - Bugzilla Bug #690626 - pkiremove removes the registry entry for all instances on a machine - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws file not found exception. - 'pki-common' - Bugzilla Bug #692990 - Audit log messages needed to match CC doc: DRM Recovery audit log messages - 'pki-selinux' - 'pki-ca' - 'pki-silent'- Bugzilla Bug #693327 - Missing requires: tomcatjss- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Require "jss >= 4.2.6-15" as a build and runtime requirement - Require "tomcatjss >= 2.1.1" as a build and runtime requirement for Fedora 15 and later platforms - 'pki-setup' - Bugzilla Bug #688287 - Add "deprecation" notice regarding using "shared ports" in pkicreate -help . . . - Bugzilla Bug #688251 - Dogtag installation under IPA takes too much time - SELinux policy compilation - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #689501 - ExtJoiner tool fails to join the multiple extensions - 'pki-common' - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #689662 - ocsp publishing needs to be re-enabled on the EE port - 'pki-selinux' - Bugzilla Bug #684871 - ldaps selinux link change - 'pki-ca' - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #684381 - CS.cfg specifies incorrect type of comments - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws file not found exception.(profile and CS.cfg only) - 'pki-silent'- Bugzilla Bug #688763 - Rebase updated Dogtag Packages for Fedora 15 (alpha) - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA instance - Bugzilla Bug #675742 - Profile caIPAserviceCert Not Found - 'pki-setup' - Bugzilla Bug #678157 - uninitialized variable warnings from Perl - Bugzilla Bug #679574 - Velocity fails to load all dependent classes - Bugzilla Bug #680420 - xml-commons-apis.jar dependency - Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's classpath - Bugzilla Bug #673508 - CS8 64 bit pkicreate script uses wrong library name for SafeNet LunaSA - 'pki-common' - Bugzilla Bug #673638 - Installation within IPA hangs - Bugzilla Bug #678715 - netstat loop fixes needed - Bugzilla Bug #673609 - CC: authorize() call needs to be added to getStats servlet - 'pki-selinux' - Bugzilla Bug #674195: SELinux error message thrown during token enrollment - 'pki-ca' - Bugzilla Bug #673638 - Installation within IPA hangs - Bugzilla Bug #673609 - CC: authorize() call needs to be added to getStats servlet - Bugzilla Bug #676330 - init script cannot start service - 'pki-silent' - Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's classpath- 'pki-common' - Bugzilla Bug #676051 - IPA installation failing - Fails to create CA instance - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA instance- 'pki-common' - Bugzilla Bug #674894 - ipactl restart : an annoy output line - Bugzilla Bug #675179 - ipactl restart : an annoy output line- Bugzilla Bug #673233 - Rebase pki-core to pick the latest features and fixes - 'pki-setup' - Bugzilla Bug #673638 - Installation within IPA hangs - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - 'pki-common' - Bugzilla Bug #672291 - CA is not publishing certificates issued using "Manual User Dual-Use Certificate Enrollment" - Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error. - Bugzilla Bug #504056 - Completed SCEP requests are assigned to the "begin" state instead of "complete". - Bugzilla Bug #504055 - SCEP requests are not properly populated - Bugzilla Bug #564207 - Searches for completed requests in the agent interface returns zero entries - Bugzilla Bug #672291 - CA is not publishing certificates issued using "Manual User Dual-Use Certificate Enrollment" - - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - Bugzilla Bug #672920 - CA console: adding policy to a profile throws 'Duplicate policy' error in some cases. - Bugzilla Bug #673199 - init script returns control before web apps have started - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #504013 - sscep request is rejected due to authentication error if submitted through one time pin router certificate enrollment. - Bugzilla Bug #672111 - CC doc: certServer.usrgrp.administration missing information - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #672333 - Creation of RA agent fails in IPA installation - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances - 'pki-silent' - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package- Bugzilla Bug #656661 - Please Update Spec File to use 'ghost' on files in /var/run and /var/lock- 'pki-symkey' - Bugzilla Bug #671265 - pki-symkey jar version incorrect - 'pki-common' - Bugzilla Bug #564207 - Searches for completed requests in the agent interface returns zero entries- Allow 'pki-native-tools' to be installed independently of 'pki-setup' - Removed explicit 'pki-setup' requirement from 'pki-ca' (since it already requires 'pki-common') - 'pki-setup' - Bugzilla Bug #223343 - pkicreate: should add 'pkiuser' to nfast group - Bugzilla Bug #629377 - Selinux errors during pkicreate CA, KRA, OCSP and TKS. - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from OpenLDAP instead of the Mozldap - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #658926 - org.apache.commons.lang class not found on F13 - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #665388 - jakarta-* jars have been renamed to apache-*, pkicreate fails Fedora 14 and above - Bugzilla Bug #23346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #656733 - Standardize jar install location and jar names - 'pki-symkey' - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #644056 - CS build contains warnings - 'pki-native-tools' - template change - Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from OpenLDAP instead of the Mozldap - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #644056 - CS build contains warnings - 'pki-util' - Bugzilla Bug #615814 - rhcs80 - profile policyConstraintsCritical cannot be set to true - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #635033 - At installation wizard selecting key types other than CA's signing cert will fail - Bugzilla Bug #645874 - rfe ecc - add ecc curve name support in JSS and CS interface - Bugzilla Bug #488253 - com.netscape.cmsutil.ocsp.BasicOCSPResponse ASN.1 encoding/decoding is broken - Bugzilla Bug #551410 - com.netscape.cmsutil.ocsp.TBSRequest ASN.1 encoding/decoding is incomplete - Bugzilla Bug #550331 - com.netscape.cmsutil.ocsp.ResponseData ASN.1 encoding/decoding is incomplete - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #658188 - remove remaining references to tomcat5 - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #223319 - Certificate Status inconsistency between token db and CA - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation - 'pki-java-tools' - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1 - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #662156 - HttpClient is hard-coded to handle only up to 5000 bytes - Bugzilla Bug #656733 - Standardize jar install location and jar names - 'pki-common' - Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review - Bugzilla Bug #623745 - SessionTimer with LDAPSecurityDomainSessionTable started before configuration completed - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #615827 - rhcs80 - profile policies need more than 5 policy mappings (seem hardcoded) - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #548699 - subCA's admin certificate should be generated by itself - Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA - Bugzilla Bug #563386 - rhcs80 ca crash on invalid inputs to profile caAgentServerCert (null cert_request) - Bugzilla Bug #621339 - SCEP one-time PIN can be used an unlimited number of times - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #629677 - TPS: token enrollment fails. - Bugzilla Bug #621350 - Unauthenticated user can decrypt a one-time PIN in a SCEP request - Bugzilla Bug #503838 - rhcs71-80 external publishing ldap connection pools not reliable - improve connections or discovery - Bugzilla Bug #629769 - password decryption logs plain text password - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #586700 - OCSP Server throws fatal error while using OCSP console for renewing SSL Server certificate. - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #607380 - CC: Make sure Java Console can configure all security relevant config items - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #489342 - com.netscape.cms.servlet.common.CMCOutputTemplate.java doesn't support EC - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1 - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #635033 - At installation wizard selecting key types other than CA's signing cert will fail - Bugzilla Bug #621341 - Add CA support for new SCEP key pair dedicated for SCEP signing and encryption. - Bugzilla Bug #223336 - ECC: unable to clone a ECC CA - Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned by Reason Code - onlySomeReasons ? - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #223313 - should do random generated IV param for symmetric keys - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #630176 - Improve reliability of the LdapAnonConnFactory - Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes). - Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple Certificates from the Same Request - Bugzilla Bug #648757 - expose and use updated cert verification function in JSS - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #451874 - RFE - Java console - Certificate Wizard missing e.c. support - Bugzilla Bug #651040 - cloning shoud not include sslserver - Bugzilla Bug #542863 - RHCS8: Default cert audit nickname written to CS.cfg files imcomplete when the cert is stored on a hsm - Bugzilla Bug #360721 - New Feature: Profile Integrity Check . . . - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #642359 - CC Feature - need to verify certificate when it is added - Bugzilla Bug #653713 - CC: setting trust on a CIMC cert requires auditing - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1 - Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA. - Bugzilla Bug #661889 - The Servlet TPSRevokeCert of the CA returns an error to TPS even if certificate in question is already revoked. - Bugzilla Bug #663546 - Disable the functionalities that are not exposed in the console - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #658188 - remove remaining references to tomcat5 - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #642741 - CS build uses deprecated functions - Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - 'pki-selinux' - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #667153 - store nuxwdog passwords in kernel ring buffer - selinux changes - 'pki-ca' - Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA - Bugzilla Bug #583824 - CC: Duplicate servlet mappings found as part of CC interface doc review - Bugzilla Bug #621602 - pkiconsole: Click on 'Publishing' option with admin privilege throws error "You are not authorized to perform this operation". - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #519291 - Deleting a CRL Issuing Point after edits throws 'Internal Server Error'. - Bugzilla Bug #586700 - OCSP Server throws fatal error while using OCSP console for renewing SSL Server certificate. - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1 - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned by Reason Code - onlySomeReasons ? - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes). - Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple Certificates from the Same Request - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #529945 - (Instructions and sample only) CS 8.0 GA release -- DRM and TKS do not seem to have CRL checking enabled - Bugzilla Bug #609641 - CC: need procedure (and possibly tools) to help correctly set up CC environment - Bugzilla Bug #509481 - RFE: support sMIMECapabilities extensions in certificates (RFC 4262) - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #511990 - rhcs 7.3, 8.0 - re-activate missing object signing support in RHCS - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661128 - incorrect CA ports used for revoke, unrevoke certs in TPS - Bugzilla Bug #512496 - RFE rhcs80 - crl updates and scheduling feature - Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA. - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #223346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #668100 - DRM storage cert has OCSP signing extended key usage - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation - 'pki-silent' - Bugzilla Bug #627309 - pkisilent subca configuration fails. - Bugzilla Bug #640091 - pkisilent panels need to match with changed java subsystems - Bugzilla Bug #527322 - pkisilent ConfigureDRM should configure DRM Clone. - Bugzilla Bug #643053 - pkisilent DRM configuration fails - Bugzilla Bug #583754 - pki-silent needs an option to configure signing algorithm for CA certificates - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #640042 - TPS Installlation Wizard: need to move Module Panel up to before Security Domain Panel - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #588323 - Failed to enable cipher 0xc001 - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #645895 - pkisilent: add ability to select ECC curves, signing algorithm - Bugzilla Bug #658641 - pkisilent doesn't not properly handle passwords with special characters - Bugzilla Bug #642741 - CS build uses deprecated functions- Bugzilla Bug #668839 - Review Request: pki-core - Removed empty "pre" from "pki-ca" - Consolidated directory ownership - Corrected file ownership within subpackages - Removed all versioning from NSS and NSPR packages- Bugzilla Bug #668839 - Review Request: pki-core - Added component versioning comments - Updated JSS from "4.2.6-10" to "4.2.6-12" - Modified installation section to preserve timestamps - Removed sectional comments- Initial revision. (kwright@redhat.com & mharmsen@redhat.com)  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghi10.5.18-25.el7_9    pki-ca-10.5.18LICENSEpki-ca.jarcaconfCS.cfgCatalinalocalhostca.xmlacl.ldifacl.propertiesauth-method.propertiescaAuditSigningCert.profilecaCert.profilecaOCSPCert.profilecrlcaissuer.ldifcrlcaissuertasks.ldifdb.ldifeccAdminCert.profileeccServerCert.profileeccSubsystemCert.profileflatfile.txtindex.ldifindextasks.ldifjk2.manifestjk2.propertiesjkconf.ant.xmljkconfig.manifestproxy.confregistry.cfgrsaAdminCert.profilersaServerCert.profilersaSubsystemCert.profileserver-minimal.xmlserverCert.profile.exampleWithSANserverCert.profile.exampleWithSANpatternshm.manifesttomcat-jk2.manifesttomcat-users.xmluriworkermap.propertiesvlv.ldifvlvtasks.ldifworkers.propertiesworkers.properties.minimalworkers2.propertiesworkers2.properties.minimalemailsExpiredUnpublishJobExpiredUnpublishJobItemcertIssued_CAcertIssued_CA.htmlcertIssued_RAcertIssued_RA.htmlcertRequestRejected.htmlcertRevoked_CAcertRevoked_CA.htmlcertRevoked_RAcertRevoked_RA.htmleuJob1.htmleuJob1Item.htmlpublishCerts.htmlpublishCertsItem.htmlreqInQueue_CAreqInQueue_CA.htmlreqInQueue_RAreqInQueue_RA.htmlriq1Item.htmlriq1Summary.htmlrnJob1.txtrnJob1Item.txtrnJob1Summary.txtprofilescaAdminCert.cfgDomainController.cfgECAdminCert.cfgcaAdminCert.cfgcaAgentFileSigning.cfgcaAgentServerCert.cfgcaAuditSigningCert.cfgcaCACert.cfgcaCMCECUserCert.cfgcaCMCECserverCert.cfgcaCMCECsubsystemCert.cfgcaCMCUserCert.cfgcaCMCauditSigningCert.cfgcaCMCcaCert.cfgcaCMCkraStorageCert.cfgcaCMCkraTransportCert.cfgcaCMCocspCert.cfgcaCMCserverCert.cfgcaCMCsubsystemCert.cfgcaCrossSignedCACert.cfgcaDirBasedDualCert.cfgcaDirPinUserCert.cfgcaDirUserCert.cfgcaDirUserRenewal.cfgcaDualCert.cfgcaDualRAuserCert.cfgcaECAdminCert.cfgcaECAgentServerCert.cfgcaECDirPinUserCert.cfgcaECDirUserCert.cfgcaECDualCert.cfgcaECFullCMCSharedTokenCert.cfgcaECFullCMCUserCert.cfgcaECFullCMCUserSignedCert.cfgcaECInternalAuthServerCert.cfgcaECInternalAuthSubsystemCert.cfgcaECServerCert.cfgcaECSimpleCMCUserCert.cfgcaECSubsystemCert.cfgcaECUserCert.cfgcaEncECUserCert.cfgcaEncUserCert.cfgcaFullCMCSharedTokenCert.cfgcaFullCMCUserCert.cfgcaFullCMCUserSignedCert.cfgcaIPAserviceCert.cfgcaInstallCACert.cfgcaInternalAuthAuditSigningCert.cfgcaInternalAuthDRMstorageCert.cfgcaInternalAuthOCSPCert.cfgcaInternalAuthServerCert.cfgcaInternalAuthSubsystemCert.cfgcaInternalAuthTransportCert.cfgcaJarSigningCert.cfgcaManualRenewal.cfgcaOCSPCert.cfgcaOtherCert.cfgcaRACert.cfgcaRARouterCert.cfgcaRAagentCert.cfgcaRAserverCert.cfgcaRouterCert.cfgcaSSLClientSelfRenewal.cfgcaServerCert.cfgcaServerKeygen_DirUserCert.cfgcaServerKeygen_UserCert.cfgcaSignedLogCert.cfgcaSigningECUserCert.cfgcaSigningUserCert.cfgcaSimpleCMCUserCert.cfgcaStorageCert.cfgcaSubsystemCert.cfgcaTPSCert.cfgcaTempTokenDeviceKeyEnrollment.cfgcaTempTokenUserEncryptionKeyEnrollment.cfgcaTempTokenUserSigningKeyEnrollment.cfgcaTokenDeviceKeyEnrollment.cfgcaTokenMSLoginEnrollment.cfgcaTokenUserAuthKeyRenewal.cfgcaTokenUserDelegateAuthKeyEnrollment.cfgcaTokenUserDelegateSigningKeyEnrollment.cfgcaTokenUserEncryptionKeyEnrollment.cfgcaTokenUserEncryptionKeyRenewal.cfgcaTokenUserSigningKeyEnrollment.cfgcaTokenUserSigningKeyRenewal.cfgcaTransportCert.cfgcaUUIDdeviceCert.cfgcaUserCert.cfgcaUserSMIMEcapCert.cfgsetupregistry_instancewebappsROOTWEB-INFweb.xmlindex.jspca404.html500.htmlGenUnexpectedError.templateWEB-INFlibpki-ca.jarpki-certsrv.jarpki-cms.jarpki-cmsbundle.jarpki-cmscore.jarpki-cmsutil.jarpki-nsutil.jarvelocity.propertiesweb.xmladminGenUnexpectedError.templatecaEnrollSuccess.templateImportAdminCert.templateImportCert.templateadminEnroll.htmlsecuritydomainlogin.templatesendCookie.templatecms-funcs.jsconsolehelpfun.jsindex.jspagentGenError.templateGenPending.templateGenRejected.templateGenSuccess.templateGenSvcPending.templateGenUnauthorized.templateGenUnexpectedError.templatecaEnrollSuccess.templateImportCert.templateListRequests.htmlProfileApprove.templateProfileList.templateProfileProcess.templateProfileReview.templateProfileSelect.templateSrchCert.htmlSrchRequests.htmlSrchRevokeCert.htmlUpdateDir.htmlbulkissuance.templatecloneRedirect.templateconfirmRevocation.templatedisplayBySerial.templatedisplayBySerial2.templatedisplayCRL.templatedisplayCertFromRequest.templateerror.templateframeCRL.htmlframeDir.htmlframeDisplayCRL.htmlframeList.htmlframeListReq.htmlframeOCSP.htmlframeProfile.htmlframeRevoke.htmlframeSearch.htmlframeSrchRequests.htmlframeStats.htmlgetOCSPInfo.templategetStats.templateindex.jspmenuCRL.htmlmenuDir.htmlmenuDisplayCRL.htmlmenuList.htmlmenuListReq.htmlmenuOCSP.htmlmenuProfile.htmlmenuRevoke.htmlmenuSearch.htmlmenuSrchRequests.htmlmenuStats.htmlmonitor.htmlmonitor.templatenotImplemented.htmlprocessCertReq.templateprocessReq.templatequeryBySerial.htmlqueryCert.htmlqueryCert.templatequeryReq.templatereasonToRevoke.templaterevocationResult.templaterevokeBySerial.templaterevokeCert.htmlsrchCert.templatetoDisplayCRL.templatetoUpdateCRL.templatetop.htmlunrevocationResult.templateupdateCRL.htmlupdateCRL.templateupdateDir.templatecms-funcs.jsfuncs.jsheader.templatehelpfun.jsindex.jspindex.templateports.templateeeGenError.templateGenPending.templateGenRejected.templateGenSuccess.templateGenSvcPending.templateGenUnauthorized.templateGenUnexpectedError.templatecaAIMEnroll.htmlCMCEnrollment.htmlCMCRevReq.htmlCertBasedDualEnroll.htmlCertBasedEncryptionEnroll.htmlCertBasedSingleEnroll.htmlChallengeRevoke1.htmlDirPinUserEnroll.htmlDirUserEnroll.htmlDisplayCRL.htmlEnrollSuccess.templateGetCAChain.htmlImportAdminCert.templateImportCert.templateKeyRecovery.htmlManCAEnroll.htmlManObjSignEnroll.htmlManRAEnroll.htmlManServerEnroll.htmlManUserEnroll.htmlOCSPResponder.htmlObjSignPKCS10Enroll.htmlPortalEnrollment.htmlProfileList.templateProfileSelect.templateProfileSubmit.htmlProfileSubmit.templateRenewalSuccess.templateRevocationSuccess.templateUserRenewal.htmlUserRevocation.htmlbench2k.htmlblank.htmlcheckRequest.htmldisplayBySerial.templatedisplayBySerial2.templatedisplayCRL.templatedisplayCaCert.templatedisplayCertFromRequest.templateenrollMenu.htmlindex.jsppolicyEnrollmentindex.jspprofileMenu.htmlretrievalMenu.htmlrevocationMenu.htmlprofileEnrollmentindex.jspprofileMenu.htmlretrievalMenu.htmlrevocationMenu.htmlprofileMenu.htmlqueryBySerial.htmlqueryCert.htmlqueryCert.templatereasonToRevoke.templaterecoveryMenu.htmlremoteAuthConfig.templaterenewalMenu.htmlrequestStatus.templateretrievalMenu.htmlrevocationMenu.htmlrevocationResult.templatesrchCert.htmlsrchCert.templatetabs.htmltoDisplayCRL.templateunrevocationResult.templatecms-funcs.jshelpfun.jsindex.jspindex.jspservices.template/usr/share/doc//usr/share/doc/pki-ca-10.5.18//usr/share/java/pki//usr/share/pki//usr/share/pki/ca//usr/share/pki/ca/conf//usr/share/pki/ca/conf/Catalina//usr/share/pki/ca/conf/Catalina/localhost//usr/share/pki/ca/emails//usr/share/pki/ca/profiles//usr/share/pki/ca/profiles/ca//usr/share/pki/ca/setup//usr/share/pki/ca/webapps//usr/share/pki/ca/webapps/ROOT//usr/share/pki/ca/webapps/ROOT/WEB-INF//usr/share/pki/ca/webapps/ca//usr/share/pki/ca/webapps/ca/WEB-INF//usr/share/pki/ca/webapps/ca/WEB-INF/lib//usr/share/pki/ca/webapps/ca/admin//usr/share/pki/ca/webapps/ca/admin/ca//usr/share/pki/ca/webapps/ca/agent//usr/share/pki/ca/webapps/ca/agent/ca//usr/share/pki/ca/webapps/ca/ee//usr/share/pki/ca/webapps/ca/ee/ca//usr/share/pki/ca/webapps/ca/ee/ca/policyEnrollment//usr/share/pki/ca/webapps/ca/ee/ca/profileEnrollment/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz9x86_64-redhat-linux-gnu       directoryASCII textASCII text, with CRLF line terminators (Zip archive data, at least v2.0 to extract)ASCII text, with very long linesXML 1.0 document textexported SGML document, ASCII textC++ source, ASCII textHTML document, ASCII textXML 1.0 document, ASCII textHTML document, ASCII text, with very long lines?7zXZ !X] crt:bLL*P~ȕQKy Ûn5qⷮ C<r/Շ'8-t5(^`zW_4sɷ&u)9,PU"qOï?*؃(aXM[8%*Rۙe:JU.'Zw;̤_npW~Iˉ+u/d:)cEn77QNS le5./ᲑדkCp?&x,!.EJ#ŜyT6wTA%=IzQ3Hjy|xXį$DJM BeBuϘ'g}һIy˂#%Rb4Vk HClh6qXgřa|lm\`\O)]\x($m;/Zv )NpT&we2i,W0ڿf\~%Nn!#{6;hCI<׊zvvHOHz%r{)Bo,JY~~[`e@ƷWܽ9FQ82D[* wXnd@=M6g ~ei|ӊ^hm DwƑgrVR\T PrZqdmR9"ڤ.o߱B<掗d6瀖 wx6Q:1$ &>݇E6QikɋN I`1gJs(6CDWQ,ev'@-88E{ qXa~>FX^V(NGҮF%7~e"<M88| 1oʲ-,{Ŵr=4)J2^ۯt]u7YkM|_ MwCP ab-Ds[4{ՙ6%epX_Rnq$͛.RbrYIk`M|y̴|\qpe?/9x1? vXo.kL6l+l?X\M_Q^R+ÀmlI8+Knٻ%U50NjU_( %|&%-Gn ,}tIsh^WM9q{Vht D .6a ޳pgkfٚ DyTZTUF 9׽ir+4. Ft mC~$s*T21*'st'x7n P*U!*UPׇE%]oNy1Z{aU9 SEsLy{bHwߣnަ xЬ&-!'q7'۸kʝ8zTb+%I40V3Eπ/'. 6 ErS0ELޟQ<7ejL%uajTFPC;̀r>~NkT!ݭ?48~',nFW/qX٩/s =M$Z]?ZVg4CE2XNs' 묫&.E:Τ$PɭES|cVj (#ʫ@-:D h%[F)4ɼww;+?']ޡ4wDs/#˼;yPMz:c4Ln w_悸4=HOsFzDŽjKBE>u>sIG"֑MJ/PYl\[?FL$|U m&:Fx[79;9ۦQ-_f^((2Ñy ;jCs1\GC+{}z4:IVY:L|J}v> }=Be]hiL7l'i— b0qK|dEݘpiS}sa'\UȋH]t=úњ{w畺eĕ Rg`e2p^<b1UwY?[ʉ@[R;S1tWY"*/]_X: #Ϊ*'W颞kU?OOxyr^oN1W:Ԡ ʮ\)aNФl0ݳ-)L(rڜx:ۮ`gj< إF_+cvXpu1!ڐpv%cL4UQNK'"(Er4[E{¡Xaye F)FN'OW(fB wrr-=S*w%DMԁesf֓w{ue.C>V2@e?:;]>H{y^o/vwXœ!"ZNSI4s8Ž^'AgWԈp\)0a|fӺ+v:7~Z ` |M(6x33RfOP% gy Cp"'r"ujӦ.nq3,- "Ϊ}Bboy nƞ#&ڷ"bMFvɴom_Tl=0Q0S^*+{/PD.e]Pm2{9cO%$[K[^^&w.80@3!Dل'@zRo &1t` S2=MC[ƹeq)/Guu j18e#+OsO[2=^. D-T%cݓ@S2.^ȞJh_r5'VN9*aEe&IF$fw& %ނ#Dp?9eQ)=^Fu20 _FpRDe!y*h}yU&83|wiHK>{D EdH#^(>t ݬ؝Q6BWb?y:O_ZAlV:L!^F"3 |`Q\C{s&pSޱ]=Bx%mJ4`?T17鼂X\0,EibHff'DB(AWc3*f GBY0gr䦸A qHnUxAS15 r|hɪ`[-+6(=DZW HphQkJ#<ȭpھoZ࢖܆x Lb+FLKRĺYZ|g]j(E.:vuդu tDS߀ﰄy[1!w$RYcm6+mfȵf{~pa0 *86I؉)G,`"+]ܼ ψ;{JgBM^bdx7\iI8䨱fe4?}zt<`8|dy"U-%7j/A,R͒M^ b-T{ p. &0~F15~Oa 򃐕:UOGxVb`AWu*7P1>*meh"tORQ`P8Fw,D&EZ^ Quf$Ջ!`Bc < Jy];ܦ#vdۗb7XY ^'y/\KO"٢[aν扌O P[UKNdV٢_.! =BM_+ =ߊВ __Ƽ_T^LT(Z c`eg;)J)we~?Zɠ܆/9JI5 Nl|R;O՞ , v"_nv;KtQx^e(ɤuf@v>^bsI%YI0Y$UE}.ؼE;WƽM3-'.yQ|/uWc]^nkɘa Ka _S$M;2qA_I_^N|Ji?%D4 u2@LٛQf yW=74e 1}]^[52̃9{v̉XEh\c ylxw%4\X!6,@հ#k3o>1@kvDR*]j~e8#gC+uzfmT[b=y#sQ_P% mڹVaTD>z@| WG|a~{bwd5?CoyWI zzV%LS'fv;ۛU=%T'/|@S3)%'AUE;DA*~;spɋB fASkEi;^5‡ثo_^XXL}|,  ~̃/HJ۲],3_>dGώKڲU%bBD%Jl 5WP)4N=-8Yk4-a'xZ7 /wbYkst,e 1,~ƫ²T M'á ks%*(w>e)e,WrZZ| M͏lÃ(Wly޸?YTLیR?(2Q9&W:rPIטރWwsy||҉oaT;Ȍ4黸=&6DIYR=ϧks!QT<^h&j'`Vg(2 =-r_"P| C aaIzˇ# 둭fƐg($FNy~Wy|j8\#K(p)o|ZMڝwE]̵ݬ ]e:JBl{$6_2+9bzU0zinhw\Nŵ%eRmQbe9ztC"ך(B; T-d Ӌe4O?IF\M')X j}|ύq@DpL,IAm`b>de;q/'E/SW.֐Br?b"rUu]U9tΙaӞѫ!駹>Zd>v% WW0bBװ+uobm{qR; 2>pi9,pY,o23e?msa,Vr75G1CaY77Gl,#>4&_+mv|RtiPp:؟8^6\n<+ 쳾e!ae|yJиa:%8Aɽ9'廑׶E$`?k~A2+ǮY6o[+B3">{ŨةJ T:6<` !k,F< 3^M>9]G1̡ټ*l{`'-nA61׮ 4k--4j~@2/t&Ρs 3^*hN{Ṗg#9b.ԗ](mۋJ. ү3#3۾S1OVQb w$[{a.%mO#&NrwEޏo 9c.@=.šCJs ,1AHe︹02IJi?ISwhl<0jfeʎZ^뀱GXZ#?Ӧ49b.@N_7<t*hkXxl+ pNW`KI9ʣbH&NvV}S$6u=jq7,UV0H.6B'K]Ca,{rȱϯ]|U\$:h5"ax-*.KÕ#3HAR#< !,8]xGZ_OdɁ7g>ovQ&{r]]Uh阓p2m#BK,Xml m5+hwB+:D<i^3a;N7^>=͢|7#\I ~oYFL]n[;%[ñat#x.ޔUBLq^ K]¼w~VqjYf?0[mV]ZT/x< ^,MYAjÀ}(sōnя6%u8\ /Ĭ4M˨HxQl}J}JB`xqܡ/Ô=f .wIEn!EyJKcvG]heSpAm'! 4Nz p1`@r9 斁cQ,\,Þز곀8}h ne,!VWO"7k%R.[i5E=B&\c p*-"H?j, >\kÌ3>ĝ%3iUF鐥k&'ypp<XUs*B#|{nwՈ"&;&dBWmK0Stq(;fQqJ@ º%ilRN:ƍM0ނ`ϗUT>U&4=-2H~11(1fQ0 6F!U4-p|3Bz iU,gʘNmy'vLƬ|_S o<X5"?Tbs"t]W]|6 w2;ٷB2٬FJRϴw%%܉&T"7 9J2tfUbE~QZZ?Hs Y0S7bo#m'#A~"|ڇVEjdnc)|*]bRcJM6#Mx܊ƍ|Fo-ejو[>M'`b|hcpB )|w(9YG1mFŅEi뭓}1W#GnhŴ1՛2V+ʂ%mԐr.5f⭪^b.U#v"Kv̊ zyqެxGjz EotĊK-ngf, ͉'-l R(~P龛p=]oэ.QJؼ O 2Ww'KuaKO΀fXT ٺWossh%>s_Q'2cÚ s"U;@sIuzBsϐ`&Bb%c%GP̃«1=㟽6OT2K3P-*"ҏ.Fp DJExkgf6;}6֠"2wL+uKs,5}:THwdĎ|.aPki2&%c1=W49A=ˡ(kot';cWt71ߙ'o!04"ċmOfT: s,L[3J(SjЫ*=Y#:sK['\둩l7ۢ -e mm%vS l5:y`KeM%UMy KpAr>DC S#AjK=58^pBCp~.A  ~Hoz JuN2dl'0{+~j% DwT7hC[T.vԚ~{t_MtI3$h T; _9LY\,k?B( p`0Rrv?  >_pF#D73ŨqV_IMY)'|(CX͝^%M1({Ik`Aum}O_9?buu*Z֑dR>0[.fYvO\vO54=h7L4ޏ] ' !A}}Y.\uGdYA.;:?7 vBJZ!i^S'D%&܀[JPI+.A[GqܠGٲi2Ǒ7L[մ,=tĻza>V-Z]~kFݭ{ؤ}6zoZk,lu!8xҳFڻeEVju[urfļ23Ep8;JÇU й, 8@Ǝvv>) ![ZhĚΘ2ELX+/Wlt^Tu|ݎE՞J @5Ֆ5{VT#AQ"&ݥsy2 Ӡws9hя'^h>/\ jmmn\ŢA: r) 7q'F:1j]w7w*G=E[Ov 7WYF,IՊmJmbaLĉU DYnTU2(㇜d+®Kaq0wn?|v)nnPr<.mAˤ^`U*D̐\΄ ?YH'|Q; 3h}T?>̻`v\zFÛ 4r~0Q%TV00\GCBbJI9iT\۠)Lv4t)Gu#2_2ʯ nLq#)醮%GXX( umq?`~Z;%Ҕu.+υilCtc(HF@J/(`YAVuHֱ/~·RGZn}9B31T U&`/ m! 5*[M/u62J ]g=hzq0 3?gDQ׬ߊ.FٞqO^(xu)c#3xQer]6){)>JHjFig wV3/4fDV:}XAPa,&+Aөeo=C:-cI7Yw+m'om \) 79P wJ ,$EXSq[qxy+ $MoP-EBq:6+{y 6D9TRtiΊ'tN01LA|_᭾<=mVݭJ>NW9yT9r3\!>)j_פUt6?ѧhU[)PJ/GZDj~?$Gi,)1CiíS2Z95rNKD*Ϻl$CB~"{v|tNu#bNNn㤶荨wPR/,#Mlo%פ A @MZJ\{ټ>m!}vj_}e;<8XA2?q߃L঍kIu?$h5$S<~+[F8 \Z UA=Zg݇Nr0_SH"Zb_hAz6.Q>|? ϐfd0Y^9wƽ%)}YWOIkdhˍkLV+$w.U\`9)vRIIW?Mʾ# i˼Qx{!-pIQMk1I,k_Og3mY^w*>/`uM#jZvVbP@>/)E>Nָ]f0 g3"*?krnU;Ti gm[}V tI۾wz5VYR^E03o8=L\V#X7aW7"߫_8ëAvJ^N+s!eÆ6/eΩtʩ?yQIrN׋P/^4xxؔn'3yR"Xٟٺ戢OO)iE. P')l5>:4c֤TGxf6!e0+I,!N{.JQbbseڭG`[f"NKC}G:σuDy7͍N˝,y2PI0v7!/)Q+z Wq"KA85f:ywe^ r!,z=0E`åa& YSod mpY4@ cn*ܥR AcR;چ-Dٯ$zw )?n{jj3 1F{ZF)~?6g&121=(8~oi}Fl͓"x/bl-6`r`T#~srN -/ 6|T<  _y=%Jݘ(5os5CEb>`ɑlixHfPבSx`&mN:줟8>HŮF _ëYeۓ4^盒q`y>]qQ!jCqqm惨yòTG{1™oҀ(˾!aB+."Q B-gOf⥒F0rb&Yrk^;z*\ J% CA\t07ec\g_7&&GkKR60<ЖHi)t}TPo&4OAuPMڃp^4m^<17򦗟Ԛ% F7 ^e}B/\+gIהm#gecf(萒xbihmߋ++.R$l#A}UvlvY7z(T! bU2OˌIo.)$CQ}S$oӜxL Ɉ=gEuvk[>" YQoO]`Aa:ٝ^mJAS-$wd!'әm-,L@}VE^S#IRR؇أZI F*.`,3wDL[Pte$}}u4!-%$fxmZ-dbt<@ 6i4_hc]퀃SR M58qE>zIs pB/m`SQ}8q۶ŰT7QP!/)O>oP֐}CyLu"7-b,BǑZrfvچpw."9V&S:Ɋ+q\ M68xҢ8.+$D'GeJ06O&)Ax5+ʏ3Q않'kKN>i? ~|H #5l{' C.GDR : ͪ\ w0ݽV&]{o 맄E/B7|1_IA٦_K'ͧb;ĉQHv+:Q/M,NJe܋/$#Շ;0!oJE֗.r:f9͝Nt5-)=gSW<'~r0 +lE{/7 7G\|'hx#Rwc{C&ѼC *qBic!gi@Hgizi0L[TSȭ+:.Hp~B1^° :b+ a_L#e!=D̎m Pa<ӭ(Ɓql9|lqOg{ 3*=8"m$ՁB_= M?RӒ.VΏ1'Ȓ+)tu T:P D`ݥ͟#1HɓRIE !J8j);>ʏCCA 1VX T:#L(kR x nS ױhz*s7.ZgZ..\iNjڠ9m'Ο4l|0`Z5$;Z[QXH)#ґ)͌N l:] rk|[yM]UIp z悷^ ~Ⓑq׿ѳKdy'w;|2ZZ85Fně:Fl yB}7ub"&# :>\<5zCvb~0`IUpv-"R"ӝ{Ggc*;ep֑j#_;}Rۣz#q-zWM.@k~mԑ 6 KL:0݋/X0?YT[hI%IKЂ SBVFZ͏d9n/`8%OV-HPt`FDԟ.>]w = .480hk^zR205~q8Qb-sYFcS[LJxZC^K^ p"]qHwjɞ,~pQkTC|/,IݎGsgZT2~-aO*Kg17Sa䈂KFtLwעU95 E7NêM:qLRlp%uwk@w+гmSzM(NS)Mb̔e lϬJs-U>5R+U(avM;'(e\|cF"6's @Z6£KpV(!wPgۨdPջSWL&`azE~̐CP]0gM;>)` ]hKH\hk Q!UI~<2,,ٮS@-F!恫J)!:epё`=Urv!~4Ѡʊ^42X6R1@IoaN1s(uϝ}XqcهAC$ +,6!™p %OW0їPysHD#y#mۥl :!PȜkbt{o63e3'wl뜑G4D WA+j)l#0wlIm@cB`B59ӊv f S0I}Jz4%G+ I̳:hAh!4#xq(|(3:w L"q&EDf_%4Tx{% [7Kg@/pDdGR *[˴3}]_)\ӈ} 4_v>ɖ,-/tg(]Оf _sKJwd5 ZސDʍ/30VSrۣ4"5m}+pڊ4R ô!7u٘霨 B/ [v!qm62~Rxt\_(z#nE3ie)'+(n]|0/S +"c< u)Zm ^q(~Rh3{%o.4*Yd"낕=RmswՌP&ӱf_\~ t< \N @. U )ada=i3pC`zrnPp!'Q\[2")\Sס>P:/|Iu`M%,0NYNZHFuZ·t` _x4?YDRU ,Fb*Cp``=~Rn:=!# ~[ ϿLxL>,=6ʣ P`1%؊Ȳre>HQN`FвU*&`T8]GѴ[|~hK)*iz7[b`> W'ʁC}&^WCuW(>DA;BUc\{Do2ə$D|F/e˧3O CҙUt)彇J:atOshR"e "(Nx^"-lƻj-L1iRY(b&JS>1'W}Qq ծd!#G|xd 1/U^7p Ѥ|i{}>KvoIkSZIЏj|rПUFF޼b>^ hS̮!ĚE-u5-@E[Y ]?x<d^u,?EIfl;.3P|ǟq76_a@B^%f7 (00HI}>(^x|JBjGQ5 `"@ڞXJ!^HhMh F+"G ꣳI= H_c e#,Æ>-QYOKä-Bjm=~2cK-S_8v@͓?mY4ERRk`=TnksD@]>6M7Ο*ϔ٣NJώ P8>='EZ #~ZDn&ܝc.Yo,ە|qv`#熊BIK]4+vz$()^IS~\ZF\Eb_9gg rljY:OwfAGp0)g; "3N{Ѐ{/%Ka?;5Α("2qZQ>q }@0GM+J-9?q3VۚjAoijqceӱD>9z};H'NdݰsFC.}M*<l>h Ojbk$& z>!ap7+&;$~?Hs S,v%&fC4Ȉ8\$ S+LOyR䋂M=N']hK+RL};^ i\(Ƥ}4a#ĹpK]Zȡmc3(Q f'ߓ1ɩ ى]A#yvY׉-&IFү lߢJu  Pk_Wܲ{CB  n-#aw؍LJ1vsH m8F`z08V0 h ݡոҜnͤ,Y! =ꡈK[bVfz$\1gN3/a *a^9B`2mȳ2ڠ1-Oj/i+h1 ԳAV;5g oTɶ)tiN$5):ZY(䂒T<0L&<1@\NCDΏ/JVEGz7obU*rV^ *Qto'wXsZWz2e{RSHgyZ;a/QE=}yqc_Mn}]2\^/^e؂&(Bb;+[~-N/Z=խSv SEڎf7sMMNaėzB)!žgJeru>mʦS⁲̻4ni"UK?vQD*PۗUYp%*mS(Q&K\3,Y  P4Rٌ_"&㩌Ơ#> bm,կ8s]ƭuBRHbs8΄Xޗ#/)edGy$Nm{d#s'->R!/"|fC+v^*ժd+*)A ?UΜ#bӍ-_Kfc0v(E gNxeg(, Fֹ %`2<5ְYN1sAaٌn۱ë-xcLu_YKP thĹvf;$4W2'鑮Un BJt-ՃS 'SC3/9(lsZn:P{>b.qǼjVOjN$ a˩A&=7 1̑P2w".%CZPYY'PF]Q( #xnEOyNĻBv3q杍ႼW;u{  ]-& YbHb-70);aA Tf%7VLCrСn#9)!Wpt&\7+lQj&xkC殰(l^4$\iyJn'qn Rn/ti"I]Z)]\BvIv@qt9 N:3\Q#QhY%cǟnB=vTt~HH8+"s r|^@^b y!lU;qW8bd|4Ҥ}.ZY889A ls$E8}WY&G%Yn"i%+ff !Wj[Hv Z1HVY/`B'Ǐb-鞪Fj̭g=px+~3\R!l z(48&щXx k%ߢy1raSH~MժF Z앉k$̯d>'J4VhT6\my +SY:lt u=tk\% RDKb=~,~a0OZκTzh!/S_4{ /Vyw9RPJ0$IaH$PȎ8[>g\UI[hr 7 ЇuY`[^]>-(; cx6dm)ڶ]1I]YFWHr"f'q(N~XM&]AQǍT..d[V  y"5Vw{L4Wws5h3UKtuۭۺ|> 6<-KSIv&2; @gKIQ]P5*%5HƔY%%GbvzM:m4U' 8[H%ǻg9̉lXwHJ,PU ^|!וf|dZ Z]#0;1[1x{W7NQ3Xk>3Q:` T,a;ՙ!HlKPB}S; Yc3Du9~+&/oqjV_?d2|Ƨ@9$j2ìχanK@\/P)NnڗT#%k6'!x8w#!O֮۩1jX3‚ƾ~/՜_ ӊ 8tCԉqI/`tt5۶tѡrv5+@ah1Mi1g>}`/&v\/hijBƝ3Q|eR(ZI@[JJݭ}FTs{mwE2( xq%\KM'|$53S3N0LN0 @Ϟ/O7[ڽi ymr4  sCSY'tͯ]p<mTBvpl`sʏ -*g Qb DUӴxn_} _J'vewU?peSM:6ؖ0g}ɮuuz`ؒX8NfR3)^2#ܗOuI TGJ:vI FFʓ*DA1^e4&PWOT@ ר dN&0]3 ZHZQӿ,;|''.r,឴o"_pi |1+>jTT[L)Qqpb_~&rWRt}S%Tuއlٝ5#7) WҌx K/gat$[f%trUA$_Co&ŅBZVP;L^,O/H?>1կU nP(ó3,!W߸ ݅n)E~c*/ -1)qhL&\Wmڢn,,Ysyٓ?[G%\ģ]i22kv$Lw#3>:)Q*6zf*~c5To|{nTzɪ4jJCQ 2v>tP3|6#H⛝F/\ȋ>6"*QҐo? Mf;S%SԢ*̰12NŃu@>;Wͼð5,QXar,*.Ze8h@LĔs La(Eˑ?:ܯԽaJy f<060"v]VL!N0e"4^Ęwk< (PzOJ=guwcSLB)iLiV[WЙV6pջaz~ 8sȘ}u/뢎*?Y-77H_CnuLGX4q:x}Nx*g!\n.LE3$N%(!id*q"#렖y! [ "=W5Os$Ǟ SGY2eͫsֿٞ`p)LZt,vHyRYwW.~T?95Q1JԆ]!zFm)n ]>JtA.ug9?AN9";^<آM̬\MMQ0 cYxUrgIX=PОF~@^@9vn6c]TPr2\ nnG[Eâ0y^8ԅn{EFK=ij>5>DYfп6n0W숰LPR*w*3eFqT =*RSM %_?^,ZJf22Z'tВ IbF  zS"h4h.B苁$vKގX.hN#Eݝ8:/ǵ˿Q?,À(|L}$X:.w۠JM\3"pQT$`{5gfOcvw+s_OIA'iu͛G)Rm^wT~[B\V?:$ە&@1woچ  v;fbGiE'T7k&cۦG˙ Pޢ8t-_] .?gf ", _%liv专k07@~oWc-Tʜ7'[3v @4y\/Msۿ9g=;#WI/c'6Yv#L+!h|$yrrRg>iYF¡u)q뻆2 aE=Ϧi򆂓k|1}oMN11ijxprCzP$1Tɵjȏ}k.6i-d I D^ `-k]%IE]pO6bV` 1 9o/\UcOSU#*m2jWzn bL(Z7?/C,b;bxp$M UY6c.v:OQlTؒE(j  yĠy ܐPvxf67%릶#Y@^\ՈfާfF} ![_bţ,ot;{8)~,SX ݈z9rDʗ/DɄzIlGuz\wbgb"~^SBvrT?a]f2)W\ k$3W]ԙfW*&d6H>d9t,( 5U*7&ǃY/&e6nwh3p[r|c^0f͕YW_Z0`0SRrʋzXb *evϿlNk_T;1Ԥ3-GBb} Fi`ie?[gG&J:w%iIO~o ġ &4L@y ,h"2wψ8+p,.ʍo EJG^\X,Χ++eL=ODIA^ 탬 S{j-kH;f',FkdS<Š[:HȕhwZ,0B[c+?qiHᵖS|-g4q s]c(@];~C$%)6 @@vfZ].1bV[z!`Qfkhi=Sm֧OBC˻騠i#g:8Cqu()GhM2xeD8DzMaub< ߐ ka{shE (cµsμ^G* Gq_kd6J2-$]?Sn:MU0%tr~NpZ#0X ތ|Țۏʳv1 3]4:nzR;'ҷ3IuA2S0Vi p7aƴYh`zD|hi{?~ʃ)MV`N>It()OccOܖYWUn0ܝFjb: im34[^͸DP.;wR,wS -4?ey+\by/Q~Lߤ>._gdӷ&4iAi^h%U fk,ѫG̪{}6;X,G#[? ƧlGYcm>Z̀i/|iVh3M;dtF|^d}w,CLP+[Z*BdSr_T2k {t/&$h'ݍ SpiyybM TXij3n>qY{٠olefe{%U KnAeDRlVI(ߕ.V6(Npnk} T]N"R.aυAQLVhZ*H89ùG&> ڨLls4E֟4 15c{),Kொp; F8Ff=H$d7VV=a;:% qd^~V9\06 gl _'[I+HnmpgDleśAs3N'lkl#2>m=^p8G_X`JcL 9^PRo3]&b|t(H擱_$'H>ow4 %4^|UB\WYK9 M͵IexK6R=F[Ӣ1~XE6kame$/4$Pf@=Non^o+yQ"lD;PkSqzOyDƮaܪs!hg?< ,g+_lhD7}({ `Kv9!f6&b%۲PtJ0XŚ55A`6Z% W2yB]CjmGKYD8ʮA/;Sv Yd\ui߮XM4d&qL>)[+ES%8#~whP/>a`(˪BcW`)(@f 1eIq<VVHkYu5䌤gzs|gn,y/ZVc|שKZLYSBغ^w]݈.c|zE<`\J;/_o:bҤliB*,5-pu2,AKF7zTw5gf)K3u#ad4/Oa ꐳ8SP(ߪPFp'z'yȥ$ʑP'X]yȂm51Xκzgp)WMyMtOk'8Xvr=YKpSFb>[bs..ppѲTшFФʘ,P;L; c5mOJj&.=K }]_PsVI@ʞy\c$k: #6|Т:`"|[1s9w#渂#hMz ږF4ߋEJN &(~jyWqAlU:!WHrG2o{8iX4GV;/^/#v*7U88GlL/q$)s?iؼDg3BQl8L y1b8t-D0w򪵵ψ˒gy{wuY*-l8$KeaneFL/f_Z񁍨pH>ed]²m4,+.:CB[)P|{(r iI1Y` #+NvLFd 5yE+?～" H?%\CԪiRpnܹznTM("Xp1aYfaq"$s^'n,j|\_~$8}JfE(Wنv%Sҫ_s8"O꿳`4IjuU# Ee_ zAh8:ؓŌ%W73Q$Q`7/[͐l_',έ%oԦn}2dLIɏZ*6 YmU&N"XLuvYB wUX q~' - .ԡ!%?֌R`A!{7XWC*[+.׮%ʍU̬IT Sm{?O5`gp6[1Tm(l'(eł`O r wӛ~:9jhAVkfo2W(_=Pƻiμw4 V♇2-t@~lR:j&t9087/~l%ӎX}Y:zz2y"^PUd;K?~peUl1QK:16d2~,)C"xL#727ok PB(*_k,͝זBZ]qne ELyR|ep[QȒY x4*Eh}I4 )fK 8pzvFh͏Xh7cv+|j\z(^rh'n4nA-j\ZmN6DyNGߵP|xΦU^o/r>}A1v3.>dh#HN-E}7zG8\cnςv+V Mހ̖_P.=\wswo_sN/Ev> Aqp%&C)hNrVQg`}vg q߷㯟Px_fsЇ'$LJ+Yp XB.lZC#ւ{ͺqVlmkhGndYٙ jS9+PY^X@]ͪ^ xl#3T#7n!uƋT[1T N?fdOS/9~n PfJ+wmgdl{Pf,>os1KQD9P__T=Ev~ Y(x{]UF)iXUbrYhJY'9K[[2Xq%<]d6V?;}?HE _;l:#|4#NTjIV8gn/Sz2.tdj^qbNS}q3ЏRr 5^Ӧ]YT`P܌yI@Ŧ wLQxx[Sky?ZWh)Մ 3ҷGsu,+BkTmh§cMP9@QRu9uYGg0il㥾+NUp+gsm2)hU~ӌX͎&^x"$\4+V[⮨8_!iJڒѐr0 H9Q>3ΕuSB'٠3}$hgKoĦBY%K/qYSqN5*#!u3' :ע&u !9s BÞH׍~R}G*=Iq:soU_7OxWmJ|5#yvȦ?Hs-ddYԜɮK}SC , tm쫩3@e dB{yi=n67|RizH=|Y,kbmjT?,䂹ogbvCjtBLW5`Gj‰ m$0ip.R׼n(,z]~Ŷ)t"V*CP#I?Tggu>Em%"I%#t9lŒfu}0B֓0F]gCI랗*`ibCNiG h,4+pGHARF̖p<?J?X]EgۅΡq[??5<[}F=Q lR{82}M+neseѤAfii1;Firo!JGa,?X%uBɗMY >]Vji1zިo"gtH{m-g IUQ/\`wO (9~$']H{9bmxXJIof.oaKo.HWz& Xv7[]o'6§h_EFf$ ctd?ېz GvV* ЛJl;%yzdL@a,L%>xUOi`=#}|#RYdBn;,I,Hl7-ڛzrf:ps/W *4 s1pbHD.̀dI7yA,i40 Pp# h A.DN5㚺@{ ߗzW'[g$ t˱N'IrR'}'|;]KN+%bu Yq6gB 4]\~R?(5UEs1nǍ7;دjma/Xv Ό9rJV[jj|d>tF\9@,^ LLyPD GR_q?[^Mu!G1u39Y.;ߋ&hsb19()CԚd}uIe֏ 1pYFPmzs\pvrF@o5}& Ct\&2j NNX%8gB+S4F0'5~uξْ+!Ă6x|Gy5𠹷]J{ ӷ|N9NjC-sr;e66f$UG53X^*^vmqk byIAuGoX 42.k@ (mԦWq;bs2&OBl?X`e@Yh(E:9FB5P5RTMIz"j'%su$#X|A, ;=är3r &E<--pG) a<81 daȩ5. -LibPv{8ԻW|xu>imr䂮f6H^!uW}HէgbYo iTPTxqU-*w3(yYank=4GCzZxSnm{ $9hL?M'@#h7$OvXz1}xyiIli1&1-qNLYAQ:e! Q@ر]"mqi:8H.`21O|q즙|?`UH\~ sf4;rHni6aEB0q^D%>?b~ u_< u{k8_D])Z%ueҡwzo #NPq7+J"ŲHfQh[;SV̘-VNw%U\+^uAݔ gž>DkWg8nXR<-U n#E'x#YXU<\*] UYpsraSj 3_tvl=Ay 7C˲ "{0*mrŴ|YIvr}@1x\H C ߋXRT8yFELc,YߴNZZ:PfN$0ryI o  }I'ih*F92LR7ʹBy\vOK EV5~(;Ti~j3/KS`Mj>8n!QK'\E?*q 5pP 0Tx+E2{#%wo](7p5xc`ނ|/`.t8 }r$h,8\pf'RSC' Yy`Ila<>4<:=j%/,Fkպ㌔)L}E!e .L؏g.*>7X_Y 3ZN>?24Z-_⋰EQ$q7oZg@"v.DG_k,9Ibi'I5"Tk5`rI1 Ĭ JWC:=XϓdgVlBq*QŢylVa8ݫ! K=)P2 Auc<fp5~瀈):a$Aq^˃ DHeL<*q +5 ;햹T=*?1dQ`}bAs.=,$Q%X[BocS̭bsRgaq#ʄ,͆M լY}bP|ojUH;_F[҄2?H҉s%y3K-i}(. !]q/2uH8eCh@=o6E%(KRUҭ Khiҵ{@FƒVxG$L3kȵ{OX/R@Y}:B~;,U&䉏2!6[3$ژ!Y'N xcUnNjg~3Gf\"˞ɥD>Yl-jNa_5'[ '9ƾ뷒cg{%ѫW}b4g3$4>)B+ௌwd3gU6ZU 4s#Mt\1.\nQ{n$P-f6bJH;o zi)30[FQZ)Ӷ]?Ve(Ƙi :WSTՖdN|-ya]dU OB<+lt8< >ʵzDž`JP8ZqkdܠuNw8L-'Vd1'/]sQΖ?.:DA2CɇL \"@Y\\ӽ\׀=لf4IqM4V\PMv+874a `ڏ)m+1-nV!5aj,@Ė k;5wvPHr؈'JZi7ӮA5޲VuChjtXr @I0>4_0)!ɇ3d3I F#"-pW*.iS@R}0cɮ5`pC@FM#TjNkj^L5"HdOz_ۀQz!UL,l'nͰ [t%f ֘s):s2rm~ sғZn,ij`w#BՀ4㟄u~稙B]Te5cS 7^0YpyȆط.F $ڰF q6ׅDL<i-:'NoYV4$_ƼR%[8]'kK+bNrхt\6̋ty~[`!+RWRyYNfPp5f瓅]%I`B0;|rzo[NVlg +Ђ$dDL+EΒrs@Jc[99FxFFBFijO,Y&Qͥ^Y/xWJDAK .}j /kgW!]![)z:y.aIPn|L6KE(DfD&x8b]hG’1sy,4Cwv-*u=1S!.Eq/To.s2[/z,V$swkWQ/x/X99{啺cHT5T';1ss,c:VӰv_e>-$߿ҫ*%hjjR|VfU뱜W0ç3I]J6PD U+ſ VnI!L(y;qJkO@@&;]Нt,ܳ^7Tr'!ov'4?ű@bA7Ȍ~Jd8>xJ6E,_\:S_i&tAB6 WQ'K tbLh~Oddz '#4a# M$r!QGj4+Y"dޭ(큋$0#'g {Be3n幇TӦ~ksNIբNŎmݬz]9$)2H1;B7, e>`cIϢV.3,:m;#1: q{ I *kt2OK( tty+Y[+C %Z|K=Җ&&زܷ-өa>}Z̴}Kt;):; O U mA\:4F :_GC 6ax,`o?l `cK0e3e#oclΐMzxIP|#bÈnh~8)XbmG?ҁ5S9#{S=ChD~ӥn.8LN;BRˋutey;9qwqN#025 蛸O^l %#YLϤ̮oKBrL\iEp 0VT?Bاb䘤>1&CBCUT+^o5_=و((unF^X Tu\rJnpi8ŋ#P*TѠW *zwVۃx /6{GđA gq+B[ B~^%0ˊ1{Aɼ3G3_oЕ&o=7Ɇ 6,w8Amj*H|b˓sox55!z"gtx/,4tyՅ~eXe~TogU۫|90*pם:P7䯒2OyIR s֛Ye^WAiv-aNq&@Dr|+n=dX+7)]lus^%p}lD$RWCjRU0UI3CeGin*؁o9LSUf\WmWj6P?IAܫpzð%')0 55< K[ـ, 67}ے\*1ΑR*y1Z4P x/3Q Ua9lxTn -m w N(ƇZL#W谻I|_X? XAP{Y)D4&@G;t<;'g͈ :~X*J!q'LT]E |w),c+ᄀ"dq"b:&miu]9M$H[;* `1:!zALӯJC=PnP׃loE9)\C}>6jKy/|8~D;WYjB/OȲb٤zF; (%>{*WfFSQrqU]NQd{LlB<) U>03jY'BH{Y-WxuAٌv)Gn˸xhƁBpІpb5*geQٞf< AU%R r ΋]JMB=څC<zD&7ͽ`NY 0l|xS=q85-HAZ%ϼ4aEJt9|@T.&AgbLV|lJ ]ق,Y$vG,^ieV=/`RIzAyfv 4FP"<սRdU@pw2mj_ qKM GD4 $3xݴpӭJGOqbU68=*CDҎk pUԜK24q:bv#*6 sKv֚HJrE iVƪbj`Mǀ%zn޶gK.Gd0?oשX^ RYeQr$QҎ;=QL?AI'Sӈyt77SKKI"3%gK#%vpd)&j9{i t8mit()~' p@.Rr0;`.sp0VM]6{q rYWU,~I+mx=}(!@I8/_*{XCtF=kc|Y? qE`E3J%f!1),P>Ȍ._U6zk3|O_ P,k.TE*&눝\믟p5oJW381DIt!7\@^CM@ ˟7gd\DI k(O(FYF0Ru 3@^*t[shQvucnv֦VT>I?N^@D\4`~cÑ􊗱Q6$ [J,߿Mad|(.(ֲv5(h!|$^ l^e \Z|{$A Ϯ_’N$B[<2Vb=uE;9k\wH%7u%%2},PZ<: n0s`;lvdKS>3(qO}8!}SJsàT6R,xyf5#qs3gr I<"5TEu5k?;L\|tZeug}_4HQL"cy.e8&;eoJ ['܊ &YH})7q(C`a˘O+ [2 .:nB)rpgij#kffџM= z`W{^jAKYh'.>sDoX\4F3&Lڡ)7Nj+ sl01ycgA*UtM8?_+1R:`8QY aT#㌥qb5ۗWvQF%(8s(ݰ0"F]؝'ƏnR:N@ANXeGN0uݐ[H$&qD1uޘrk*&ukwq#i)4*PjtYuI w(o&3ms1w}TKbAKD<8DZSzDv biODXP|TOsdNƮVRij:Rw]ͨڡx|UW3"s;Ml9;-ƝR]L,=tdK&\UIp~i@(~042$*6z;$ sd/̞>ek 5x%S7[s칔)6Bp̅tAQOjU+^|O;:_tzްI ѣ͎ur/JW42ypƲm<)biQnF˄ɴx-q}?IXIo!& Ae8pz j>\W[8:坝v # r^uu9,Gt86 /T]C,9-v_STljP^߮Щz.h{ <Q~`|.зG4 )*Y" l$y-S|J;L7Zg}ZljJcwnttmfH}sQ}2jwB 3Op({~)+rCI{)*wJ Fy2Ry*=7S cd2.8#kĜgk=i_ʼn sAChm\*30 Jr~ $ \b6~">/ uyz6Mˆ੉;h) m@/bܼ6R&y\IkxL5L2(i4eU2\HfAnE\ ھrre(͊ g|id$^x:|Kp*5!;Ղ48JswX)àmq@* &D%;$xVxr^X EP0+Rg{j]=yHE9|+J+MD_+jBl]R&Lg&3Z\h9ɔ%W vHIU>YfYA/[!_dʍk!AG[[:{T|O3f p@_>hO vqs]kyK7"".gN9ZｵnD(ȱk?X !?"myՂݦO:y3#S|ISj\ p;c˫+lVC Fez( N{Tީj`h1-1daKf.jFl'G3׳aGR 'XR'g$))q45^Cj=R8(h2:x͐[&d3}G{bn v3$I"0o~k'9,$]$`2*;ǽOHLQ}F",MaDH"R38J\ (R@Zd߳TvR,fl .HJ) 3#~NkN"fgpKuiM Au<ZBLQ:4ݽ}>eەxv+B-85̲ek 6K+G|LmЛal1>Pҽ0WG"D!V}Y~w 1f[M7gBcWPwq`7E:+Ky}a/AmI΋|%͞sTΣz; ߅;?D|GxD*>/YuIctzuIבjvJٻ){`&;b 6DƤsrVUb3]t%DfԚb vs8an8i-`4Bm:d%] l-T!Κn@CkROWfrLO9N/Pŵ̌!OMOJKT 1cV%hZJdXC=똒H6jQt@蹃^kƂh[ky?5@FšW'I],XMw8a5ZrQ*וAv|8G{mwqWWa}iogdy(7-qFo/.!c;YL7ʌGdXI֎J+lty[܌ 1L0cgǃP/;]a&|!=t<{TE\n `]xcDCG 45Cu,dx?ڲQ;J9~a wni(h a:^,zw(`]N`NV☜//j T>ƹ7k3},3T6Z3-ʴ@hMpǠ30y+"#NÌeJ{>v-*3lr) ;bD Uy;p#_DԫIǴͿ78,ގVMSeݻxɧp1 Rm+$|`y_h t\ߣN*~*Ll[3 3NBw=FXBIhiyo1Oc>hs$z#U6V >7&kR4[}4hPk,[ aGλKaCaE⇿TVhP L:9j+gJI=1OCϊ""|ofY}wx)mtѮThIұmQ 0[Dz8*Mg o6䒄7m&%Wa4g! ̖׎=9ZQXb<[u`jY0gK<)bBla^eV l M@VcE)``#~e{Z& fJm$PP{.Hl*bcn8!C^SRJ +ȣda  Eu־>#.96\Mapnm[K{p[YCw%s,IP9!3f1ɨXrzSC &{,zԚw Zi|ubd]SXil)[nu0>?QJS4RQ<Bງ**["D̠PbK? wtqig~ANdz8?}BDhsr$wgFcd`|ZUf#0<xd5C{iNNg7į6t#,jپO e~kf-/6p rMz2jOb+Jq#Q8(L#eUZXojߞF(bNvNWMX>]  WdSu QSջyv.)..gKeY/\(+fqyjPG&yoO ;&T{f 0Ϫ^Й.KێDOy90Vq`%'U*0)ۤEuP {!Xѿ|yOu6}|[5Kc:b g~`=N}hfٟMY:#1Xw2Sȸo4oTB 5XvJAC`eC.}i'V/xq着w lŒC)f鴨=kBWl;j([:y xtQa݃RO~V*uFVuwHSk7&1]7ІacDb[XK9,3 c-q~B ï[ZQ©Msuj/&J+?)Uk#C|pQi^>uУ8@:Y ܍;mG[j:>8e-""ei7$^zeG, 0 ǯ`5-xu^L@:GҶo1vgII?=?>#F-*c]᩽k.v! DhdSc<]bD-i{ف>V:8xj~$J]7B`!` &t% ]kuUn %^Б 6+C/D0>@Wނ6-bM1ނJ펜J?`p$%YlʤpBdB|ptz^̰ ~&I-ZsYA-]CFK͕(A⑏5j 5Ҧ~.6gu ſS#RW:15w!vU8yi7 >Ǥ3oXeᨏ{l({=-ċ.]uadF =q1UȄiL0Jg"oBt%9GFVOZ,U *Α̊)W/\/Q'4(B?^АtX?eu/P#x$: k"ɬl%)m>yXr0o!ij!L :7>9}moe9tX^xnHԢ%JA2jfzQQnA "zFڲ5mF"ix\v!-3Lq&v(b- |.: xBIe:WT*nOe,`:=!pc "u;̆a?0c"!&?tdh8櫱UBgBhI,SCvsrmIY,YQTHCc_0}(^Z"m[=te2  V"nɍn]mjY!| oMs ˵⬊sFRwW;# <*C`n1Kg7ˎG,꨼+>׭^y>O}<OvWΟZJL5$Tƅڞ.+*"mR:L P`O.7ƥwO_7bMי(W/FY!3xi{ZU½NPB䴐[ t[؞QWNľ';z ؠ5KjE6ޝ`0kGO#ggɡ*zG~#W[oY9 Ǧѷ tR3[㺠 ^2u38Y&C_$_S*M?:eDgN+#@^:ۯ-wӞ&\{C1h@irz-Ҍm /2nJ. k%$!GIT{t5ܰ.q yzm" @n6Dо$ ,ymh 7י[ QWjǕ*VQ,#)XWS0Thle}P5mE7#tp%}TZ\$䑟Bh">| zF R yb[ Y sY^pڒgYPqRIzfHS/-9y7;H(?:y?&oRD+M7f h( ۤ -)fabNdllp5C~*y6C 5ǡ_3`nqٽw~uI12lid[[1KMRnZ:%B?N.Lg}(GDԍtM6!ǒxIeG"tOE3=iƒ hs^48GB<ж^@c ̾Uv-5B%l1Fz7j Is[5 h'& K.U%ZpJ@SAu|6}A`YsC},C7zsgkWmЎ?bj‘|.ui,">%r }I?A_b5%TEY4Zu_]'7.Zpd ZBsl8@.[2%-[F>F2=+9RٵNO_eRZeEz06\;5} F;OקKCάo-nx$$T SXlgW0N_C3E#IiN7kBAf.{júf۞-Stx0!U]ɿsލWZc-:MG  qJ/jTtւ_ZAQ5T s-Cv;=֡R-hHOS:N ̜ڮR 쟀w2+ˬ:fpbT;뙆pBeKRg Ƶ{m<iUD(d4 %\8OO1ϼZ7I4%J,VNdV89'V-טۀ<(ʳx3de3cF &zbɎE,T tVzpU&h} twu%9xU9[*W-{LsMSYC昋M_ICps!>&G&#Ε%!6|ߺ_hO(ZkIst>j:j| uhc;ޘYeIm_N\ք8a3!|CH>)Zc]?*$*]]ZGJƈ%*Yge?Q='yy_L x m#-mCͱGҊ겁RR~ YڝQuQCxa3cBHOlw,懌v c7romTGezqoWQ-Jqنʛ]Iѓ Ք“UYbSKnj`7RHF<]広̶bboY7_m=[(/~t>NjaJR>I+)T36@7n%<$&#;Co/Мp'&mL4||te\d.UZ7.Wd< ϵQ/wIJ[NCn8ES7~G+|Hx<~ [BPrǭj;-t!poU֬oOעpB090xNwggu/3` TJ Z1%z1|$-+_*T b΋XcStĈ/!u!LW/Zٍ!$gg^oكm 4{ܷ#~[Z=IVֆ%c>;kAߵ9cU,LEUXi9rnw=&zE}].-r=r ,U\U+EN"!+]$V* ~\Id-{[Cצ>qFI\վTyȱ2ʵVD&goB?+S׼}XOD*D=t⫟(bSRB{(|98~)N|ՇcsuASd3;JLJ zq,qJ7n2OkbtRce#nE4hS.)MD:l{\@P˧|=`LT&^Xƈ=Ua# ¸0`y!P9;\:'IK_GyѢЀ/D1uyb_Yqgۏ5꘼9d'1fĦtTo@C=M` <~^|A68Zm6|(z:P $]Tjv[4uՏvIۊna޺ٯZH qL]0C"c8 ˫.i.4/wotx9Xm9ͱ,չҀ3@!h#_@![.R k~p@):P*@!'mrO2e9(|fAJjiy%̈*ܫee9]IZK|睹\T? S;|oyp@=|W@*NHi'sĮ<@U*BI][)KMC"n&0bX}dGT@/~&, $cOnGح/M K3[B?Ї8Ă/?$z}Vx< (VQXhdwΎ im@nz.NW*IR,p,냆SpVy9v2`g}q`K^#R#&eL"F7hz[iGú5#n 9:0kZdEňdAe(HEĜ/VuA{0͍-Cʲ\Ac_qb,FMlh8kE~Ȯ®8?W6M" ;$pjIE~i-a,>sVC9 _}H;(t~ UNЙeJ8E1mim4W#uyM EKjKaRuJWpBj%h!ām$+yË ܵވ:يO%N˩Z5L D fR"=U 'Q6X'ApM_;~ ;Ksa۫UꖵPD"B*JdN4|~L0Kڐ<,?SFq0gv [w[/kM6JU!̂`&gZ(УfʻtIwt]y;R0%V|!bě`a{y.z}f'+W0Ąvk'B6d峺 ک6Y {SΚ<U\29~ TWEH(״%^ Q՚RGi"ȃ|Xc:3Y)A=e لoH[٫ܨz:ٛ @T- XFIV%zu9**0w_Ɛ!Aj,?ɧsc~X(ݓC{DG(ΣG}LcSFJje{ &UvK(MvҘ!dlPD&{n7bi`vIM$(ֺ^*Vz_k+_+MsNy‚Ռw(X,7 M "A-L#OO(%JzȲ_C :d;(N9rOwɍEe.\l8IMuz =lmXNP @g/5#?&T' r=/m(@`c!~&qw" GG`B,Ϝ.(d |.kZ仌=ҐX C89D\JNuH;IY@# |Ef4.,gz0.1%!|{ ?Ky ·CЊ!:[U޲-'s1\)]!fWi=9xNpS t2hhU5&O4nڈ1 Q\&$ :FH'dAط/o;M]ertTȬH?$5>@vh(&LW5>ki-BM-cS y6{& $.rݢWeb|C2I  5JM]|?DOmZ3PlOsD?߯Z JPZMRi] Q-Xilٯ+rZ¡`]P-VA05a'k(÷av*r}5}x#/JG/1$B:vm"F'9cphL:4D(`LpVӶ+n9J%ayf/sq%'U0/"+k'2yB] i!,-Pgޡ+e=_@DNʷ!\J ׏4``cMoqe3h^ր$ַʃTw*n$ڮ l6f{(bM{qMރs#5QƏ*C:S7iY{`[6@~Чie/WBNrlLd7M/MC/F_&v/TkvhCb%k.5F77Sa7a(k䉅/M [h!c/+\N~|H:i[`I aluۗS@xS/#ܰ6#Kq]/Nwm*э2J@"E/)S*yMfs҄P[12:TNKdTETߵ (Eu.GwbcT+OWj`F& nR|^̊Fnzd%Q?lOĽTXoKQD 씞9O&߭ gRnS[>@Nj5:Ɗ]"z]DwaВ?g1ƀ1\wl^"LsqNnQ]ėz P.)5D_(C 'XiyGIL`R.dx/@Oݙ*/rppSlt'-8^+K73ш~{U|J6r'3L?8G31)$SlɀϪs0! XD_Ur4y;b,Pʝ#:9W*"e}xTTrZJBIn x|P= C0UgAUf3A;K@ Yh91۽ʹR#HU ƚpk)Wv~>mns)A3P>ޖR}.?nj[gD*05-)ԬO+i)*=v>\ ;e|W 8V1]D gY2-Qf# /3.Eƒkbˊ+9!Ր˼~0ERwCe2j|/._42 KK ?1(>EO#}5byK JkO69T`;'3ںaeM]}$/ʈuz>M9thZT͝7wvS !6 qg~7(΅4#խ12z70<矏 *"k-"Wct1X4(Ul\Ө 8c uś94_*ri(h&t-2tdXH=1S*D16+mbDZA4qbzv|ƗEXc;])QF9 + n>RU5/tC̬HmhM.WX3ݘ"*JbZ%_G(qAr\gI&lūS0LZO_P*DydmTO<|Pb=T*F>iǂNoyАI،#M>LsyX n^ёHC^'/[)q2%qO2U=(e0DT~nQ,Fw`njuKkⓏ$d@)3Lvyc/ϴ!u!:}J'E\ؙ cW)yʭN8hO=q]8Y8)GB^wF 0 ;.6} s^R s!guGлYF'#f$*>OaXˮ[K4+f?}6!C*}5M"dWcMVlYl"RGhuhXBCKu60:ױNJ۪])!C;6hSK51UX*~k+4uoʢopxorUMr1:Υ`O۬xhҬ ~ﳡ׼v@ A~NFc;܄Q>]A2u%yLwфtȁR{ˁ oa4L_Ѧ~HIoGWC:Ք(#w_bs 'ao6'9#WZbcc7У/< 7 Rg$=qt2 w4˛mRՠvʧ/e2woųw_jeg$7uQPPO2qtݍ؏|( QmjƽvOu.Wh/$aLbι1̓TgY!עwroMd"E?ʏ6\?ۺVY xD3kx\SGkLjS Y j^xm5,EuedjW6KsU#ff-[UV` κiĠr Cm*ȽfWBqT9Y5@ TAX|.R ,9G/h r}XNƄ<`0yMUEI/IA@[ W.YWd|aphlgODr4;BwY  `%? d.\bN ! vVZUy+"oD"cROn;s;5MN+ Oaq _<ݳ-d\i$҃MGj7ؕ_g{X-|A"۱aG ძ,g\|4JsYN?΀s_Ëd3X $k;=02V-ϰz:Lt 5Y4 v6LspWn{ QNֳ{yI H)R0Bv+hP6uh᭮@ϊDFPb /#;b@ >T-.]Tԍ ժ@0m |}T`Laj˯LMCxS\JcAHZ=f|;ܝ9HmW5WEOIJP,GK#jgµ/b weʘRR`Q`!GzaE5Z7a06VO3vb9> 0H;\C?9]EU~Tsc>Ma S kCqD{fDv@K?3 rfKt.z&cy0vr\ "8g| B?=oHdY77!>8KASp<خɆ"V{tp@Xe;Tq!s-ؖFR!qK*$cx $Ac~^Z7Su'Xݨ2 'Lh4"GJxj:?86V F1!Nќ\fW3-LK^j7[G- \'Cr׍Af_a\ 5q^ݦCPf5u^ϝm8u' /Q%[O# -)5cakhdu.Lzܟ1<. pq̰V`2c4j# ҠdKܶ0oNχğ\2mJs wӾh[xGf8kLO,D[W 6Ւk$M嚎ȯàB `5{siCK"/_x` R r;۸ Fo8g]#;kRvrCg1vJ7iXJe7je!=c{$I4AQ$؊"[rTY{[%srL#{~{:f  nHѵw?]?E›IfU9g5/0v @:/H&m y> f8 Sc;6O['#?,6O?gg GWѹ0grsZt_%,bFŕCJڼīXps}pmb#q\&5EuUk䵜 R=ۉ) -:ɘQbҲ?J~FV7>`^L wR`<^z[T5nD8UD.eSV(S27m.\2\3?C_%UrrV9ik^q*Oze$ZM0zD3qz [`_dWpX\+rbq>Xl]ؙ+#R58mz˂׆{2ƛO+#GάG|8Qc‡[{EW[:̩:Iz? XD-UXx3޾z}]<ʇ]Rlv-ھ;$ogˏQȷ,l4]8#8ܕUp^1ڍQAqUƌ+ ckjSkba/IA9  ##T;Hx>Pƴ9oMWy(|CXbƮ6<ȄC&C@EꝴxWcs<{]ǸdW 0t P#e^ $ISᦴCІXu0K|T, /d-I^tc=ڢ؄\)YchT/k=cw"1Rp2OG"-V 1҃ IUo9xYB2qmQ^3`4zE&Elwix^ls# Gcؿt LJ`Qp9giG^<%H,\;$W9 p#pF q7 B) 9Ŵ>G< NC; JZ^Sp8i򯌤xj?&֠SJUl=u.)X5Y IQU&-OeF#wg慀!;ĺ"e mB6bX`"д+Ľ8&\{I[g( 53ar83 yQHJ?H.Kbs!WKPtC%_Kq}grO/1eL?Q9aŐőC޺~ O_~$s)n1EBD%!jS1!FS0| GQ1\`r3hry E6׏<fCU=+Zv{aHX-> p3[)lu/P[:u/~zQ$5! {[XwO9HģTifjqf:%KҢς` g(bt%켑k9\N1o!6` Yr_ :g1NʧucR9u mGxa+xMQ]Vvʤ}>懑H"{6\b'wXNCαP8S`!_m*k!:_Fs곲#6q&yxxP))vњWСcҮ2lWWB]_5{m)5A3ȵ"hƶU8cRg \n b@k_KF8H;ElDǹacS \`f+8>)5!?JwTGQׇ!YɁ\ ϠvG7&؝%Y8i|rh6PFr;Ht&y04~u@1{VWa ʹr3]1Y? I4Z5lb\keM Er9KY~Q6廚6ko!c=g';669%KMRr\ZsG&a&LR=A' (5gS=ߖ-чkDo߉fJe:.w2f~P@x.>Z8S$WLN7"~,[tQun_cV-`1`;E I|`<MAبyHL#( ̨crR)͕g 45,%\7<)b@:7(x3J&n[Ji 4DG)H`]M+au|&|2*%E6wTYPlQ^V_C補ҬOfEUaB!`GI7wơ"o@)t[x ՈnZ{!۫ìМ% 3g&^ECkhy-,$9`KM.߿#Od(Ax&$ G?$haB4důъYjU37!Dp6U$ɟI!5u ɗ(\gw *KJt1l(̮*$ tNjQ/F@OU ! G!4N*.IFͱB~B=jq gCZ0p(gEEaVb's_o(+_w;:C̮#ש5d~y _H,B*Ii6#b4Inv ϼei5p`BIĿ))x x^t)d][ِGLlYri'R& Nw1" #%«N׀x$1 AW#qH>8Ŏ6Jr#6TG:-*Vk>0S @,X$. !Enx8$z#bl NB?wـ5(!bd"&]rϷ eWkEŽFO??%{Wkߡ6#2xZxwݗDHT׺+NR7Ntc:AK"@MD;Law||%m#B xTwe=6#cɉ2ԉ`yYW\!:%&<Bl\~d$h*CZ3wAtݕC=lL0rn؇}& h8<)҂9wX7z㈨HL=|(|C>qMHFJ=>'m)] 7TNVm3^eTň5= G K=FDsv@^[<@kzTCʄ/1JhVޚV+znJG,.,cEAU]#Z_sAۢ v竛1 :1CUK^.A-'pb>ga1ҳ+A6{KY (|֞& 4w 7ڜl"EEA8F}T+BNL|%Zld^ew*QI~Ԅj!ϛU yp8R;[zQԇ0Ouc GzcNXVTWrĊqh=f,02[}Uis*۩I2F@&;^"5 sxoz?vd}OJ䅒р}z*T dywSDD&*@Eõ(GRSz?1tz"r7Mi+ΎSt<`l0b].֗߆ zT}d 5٭Wp[6r(Y=ݸ9* Y)d)Dv٩MdK[;@E oBŒl(+joɒ9< ;tC<\ǒ><:j[H;j򼱃@l9rqu55TQ;z'֢#FclL>$V%eTrNu-ad5vU(b1s5Qg zS$Hp{ܚbߖOU0I@$\ f7Ƹ{]=zL5 jm)Fv N='xۨw us)YB\~eו>e3Shh#C Y^#CLAj["q-Ӝ RpOQrb}T͓-QSp6l}Y;L)*!wO z.{,Χ~Sy_槐]ky~,Xd%ΊG3kuTt&L&`3Q:8¯Hㅢg0E>B?Fr}@v4Q{ &s_/-_~b>]@=8ww`"qBrLa]e8W XSCFf%tÓu^ lAtvXJUnyvސ-9-:Ȟ_jmͽ uD@ANG pj!e#(HQ굤 ύr->v԰ȣV$ʚhsC'1?). _ΙyVG )Ǥ0:bu~,2@X 5WxvyCrV?O!YaZ{Ƽ3/|m3+&tkd$AXŶ ys bjmg1^kٝJP՛WthV乆[0PdÚZk.ur353͉{p{,+JlGtc<41l.Q/E6LrRZtIKYَOI]Yt8sreJea<؃(PB0p0Ĝh 3Ror} ;;L}k;|  `Sنl;5!dcY;t_C-W~7\E,N&"]ıFwo)^63m[KJg.Uz3VqWZP81))[Nm5BL%>cnނ9)øXkjV1,k S2 Ӳ6 / EQ~#T1{H`'0䚏)&K.tf2)-߿TWŎGpu; x7iIIrِqN;E/vEoiOp@ STj/ϖМRU\Ѷ5u2H$!-Xv=lxOVSH  PNuhPȱvS*MNS#tGd-CBע[ Xj`PοDOW|V 6rݟq3ci<}T7Tt;Ǡ"Lsu~~o%/tS c'iS{ȭwSm.@q@HcTdK׿?GИH&sG\ XRt̵->Z­KiYO[~حh[#!ۢ3sHU;ǝL 1Nsе!6o`V@&4^%`U9&Peym8`FUJm))4 U렊+.i>KwD'~:¶lS-49z((i|)NG#pݬcn#~,kH LMRm5lZv8}}^r֏ҨWiu -PÒ-ց+a4%,-ic;R(5}Fo"sׁCmךނ j@3SHj?.?T>+8GD~ev ffd؏yΒ>銬 )>obAbWݙ-+X % xW4 ! $(^U4h8 /J|vSsa_A-&O㢛!|LT3,1hm6,>`w7Z\%&ߚ->9wZJ7m1`AԌc1~et}DnY |C88[)_,E!xa:E.i4.P+ڸQva$V!k`N ]֫ f9(1#6 /< U?-u崏'|;]=u((! K0ϋRz@̾1a>L:j*OE!p䁵vY^>HlF{@>r˟Bh#E XqsNV䣉d :Vjd`ތy`I2N~Yrݘ)'53e6B]!N_3wLN#(FN_r/Psa\<-U$'u@_ =0#/|vfZYGSn(jUϟXizC4%[hZJO3X.4W}--z e0(kj0zL [&Y}3@ES foElSﮕWWup9Ls~kgE+C`.! _PƇxhɇPǐ"¾TJ|҆Va#twBA4묜M}vT&蚙h-,`7OI[2 kR)XrGxVf q3 w8LjP84)?8`Dpb|=?>Rao!F8«]B'ZURqk#rGkSA~$Xz UOᓝQJqd=%+Uf'tnaGcR,krk~ ;Ne(ibe8e8ϒgPJњrM"9B5F@w.ߝ&Y99;AgO=Ɂݯ@] Xi 34(SVb(9]"5rӑT^C6 ʒ.!ʅv^^g \ߔL"oKE6 _Z^ؖgyEU_$B+,[ h{iM26\pDKr fݣRnqyv' ÐNĶy֝݀TB6(5{?8Y(&,&1PcpˆbIf.PrzBZG) I8t4>[ g>=WQb(Îzi4|;@eF3s>!ǜ&B%^G|aeQgx\ -meEq_8wx.w.?Vl_3bE,~ s eZrdxnϧ[b ]՝t$ =֑gVM-Ⱥ6)I̻^EWUR*.y/0 _[RŒFb(3[IEc;o^ \`!Z_F0!xɊܯz)\*{< G_6ӕ1_ѽ?gQ;8_Z5w&Aw~}S;guYy@0U> [CKȓK ^aPNıWܨTOY0:m4xu6im+NW,D) jCإZ>[2T_>%"g|(.`CQEVOh ӼwVz#S?O.E'_CnfRQyi<ɫ(p,z .PS|Dg&p.?ۧJ'HJ.)/#c?$ =ud#Ie~ag}umGF/Gዝ "Ms*0#s,V԰I3UR_`YDY^ r WζJ-AnHxtФE|ʶI|\ bN),wK+۝nF1.kK٤"z޸LdRTe<+u4\Hڒfz̆AL+D%K%tCT 5ќ Lx=R ¡oymzaYWќr>{EXQUcE疤ӦeMn9L6ks **5BƷ|[Zcjq=בhu뫭]%%j-=҄Ut]G3+icU*~wZ&:sfR)1q~\˃ǵYYQJ 4(h3S Il:e /h"`o{yMVc2Û;< pyJ90Jkmý1߲ˣrG!ѪȆ=#Jf@Jlo l۞Md\- ֨A'g{NACyO Mt]ZyfD,G.rY\Zݺ=co›NRmS¬e2`FOxh$ByQl)]>(c>X1uW堀DGU^=/JPg d{ Xɫ/'e0LZH.ioٮphTT$RRE\fT/{ZPCd/̫64r-% #Q %#\܎ͳo,R藧g|D=xqY H׋"nnZp0l1e-ě0{3n7#՘m.96hE"$VE"N0U? (90 ^ۛiO5e#=5Ŷwl)Ƴ[SWҨ\E]B=> 6\gic{eGKaٵpS4_iv#5}ZM.O]W _cTWp߆ qQL4@nl OSMT$/;xV cQrNU!! vA7Fʂ \&M_]Z"Њ֘agBr!Ť+X9quoBgq%;73;x&rG;8Cxq`Df54/J,ݝҕZ̸L k1MsE%kd(pwXŨ ^ y )<׹DTt(HOOZ"7T[O[jD>T0 ]s$&T;6sD k݃#yj/3DM M&n0o<*F؂d '%'Ѣu|'S k]O7>HXs6ۄ^MS5U!p嬨jiՑΩf?TL^ fi=}>©:[ zjrwQunt H'FSOaQe-_]TD[5Ya- &ӱشB++K(&v< !վ1rBd_/') 4ulM>@twt=J`N+OTd#UށJC?g T!~EZxg~*:5u;N6!]Zqa2VuXDtxN/EWqT%h3˕)^+q[:^-C"-Q%D|U1.NihVɂ{2eCFIT^Y _%LI~ Y7 mIwCOD,~nuLF<}^3kuwi%@D1ء89Z? »H]qP/}sHs {Euz-PV<&S8-_{e_W.4ٛITxݓ6N뜄jc;$YІJP@B3ѡDV}$3g ʨ/#mO31{x$zV_%PR82^'+*0W[@uo#s4| "2a(p .JV1.~I٦Tbq8NKk/=vQͳ: t-|c2WYj\QGx0dF~y$D?zA%/G=Cx;b la?4t&]O"_x^ùIrw+(%=yWP`dzfEo-QVT>[/ͬx (xT9w@ |%'Օ0MZmÓ$"KDrsR@dY[q-:ݒ7pz/v,Y>]+fhX_|IOÕ_!T%_N9bDž A:F*Tdmj)YbX-)%hjy?iO)ͱlxM1BCa0j`BN<˵mb})֍=s7 -^߯T0X/۴*N>= QMW 8+mU{5M!h󋊕qɀqhF| Nud#dsZR?;H{}#럋l'ø5Qcg\o}Fl7Ғq6k>Qۦuz2,𡾸)wʜXjV1 v5}5  A|;KH Tp~zu3œg+:.L&8/@LI=K"^֓ZG^HKUS 8~-;B{oD0dN=1`~%//ZX~1ۀN9Źvˤ?eu%6yDXj#W7j֒JѢ>N8p0b㩞74xfibq_kn(>K3i瓗0фl969$Jr)zR5ڐ癅Y#4 IZI,G鏳O Xe'|ú fz}cϴWU "ք.[z3 c%$4Gh\p[F.ZbLe N+f!^Ze @:"T+[Lzkp0TEUIk*wBn!==6ev$ #}[B S].IZ_V=dE b/lXd:XAPltAsp$JF [`œ-b Z聍u#:3XDW;<TЏ3"e˥{sv-e᠋+eJX)f5]Odc6V^W@dytSlbxw#`IH-&qp;TI/6rxa>ډ/ *}l Ñ55s徱IlJyZa342В ͰJ-r{l~,\Z=ieddYF ??L:N{< 6tbF\vzzD?=JFV܄^և_ 5Z*[`$Ru=t7Z宭\K'Mjt:3IKsٷZ!n^_F ڢ,J |ƳE;ۇP*UAxs<ņ@ bςݪTtT&@M{;iDQnM@E$Apa%ybu%.y s}yZ$$E'”v $(_݂IEɲdCc.Ww_ H(=ҧퟒ -h%F[ ,1Lx)Vڰ"`/Bb} $LcvFl {jo"C/=(YݕΐMI5ddd|SSU/|5ZS 9Ǹ·۶BKM֢ h1)~|}T:#,8KAY 4Pj֋C.MBEpyɫ}ƞ4'9BXnuGS]0щ#]B!^{ v~3Kg4 C U rȒ,Ź1OpX7f;腽`j0(y0c=+ՁQƷ6m3#>5*LB%mDП~PHz8"UH=ЌFbw7X4#.˜}(JGadNg9}r׉xaJ⧻ 8#3+x = " ?Z&r37A Eф ~˚˾]#\h3b/4|}^)PlQBUѧH8c)%Xj?52"䎯.[PwL I|gZ$V>=4'Dґs|)IMa#ҳTC^>@l0 +tKxjj[nXYG1+&YE&RcY"eiV›h Dd -Xd1UI#:>b\N*%{A0]ĂI#pzC)J;󃦼O-qRioDإ a]9O$<hZf-kr$y4:L5l5M[(JOğ7짼>\g"\'U'Vy鍾ΘZc`h13-~(ꅱ=bJw GI3tՆD)2)83zD7Az[wԂP$.@0<]OxIB;ӱnZJO=uT.+s]+b<\輥P_wdM y'Vw{iPbP P䬂M9ځ/.q VNTuL8x% 66TU}@ Z-Zk iu7Λmt8tT`'+O43f|a^ThPk4{zLJ b*ŏ3Ց:5DrvqL5ʮO^1%<0N'3AKix Q وS_`' 36o!5(IxyAo8T6mݭ}?I`o)RZvoؘ[87#鴚>1 Q5 >x*F'?-FxO~L.f(d* tsw)ӝSW*:-W1DRv;yqѡ[3/;Ȣ%qvp`<ѫ̗jB҈1Pw".jb/#c2?wUb@ݕJ.6c`(R 2+x&7*cP(=ǯ$W5rbC_A'Qy7T7XUdq3+mn) R2ըZZt nAW}:G?i게*l_8Hk# xK K.|R5uZN3${**mQڃY\-3ئo]Gwywq|]jS,> ސN&r7LjI<3z/aWO-;?I\ "-! vP |#֛T]n$I>wcf䑠Ly!:.QZU,pӄ+1l{sd + \[+Ģ]#_juö2xnI'N[q` 2whd~9}W$eIc3ձ4TDD "YC|[C,lmCM]oʳwuQWU Hи˱4,#fZ`#$("բʦ oCiu&aZC@jG~CA[]b LY6ܺEjRYjtnnL(;1ϧz ,hzEqLBCO$:`8Ф 0?+F̤I͑ ^yU{$BLg eA.'$jNhWXT)Ɯ;6LlWbQ$@Æ_Hq?=|!&PDnoZyh˦KHb$߂"냳^fh\9ߨ66O<}~T`Y J~2`}Tv^-δ 02Z1Nkܧn3- ÙYkyUм҂Cq6"ˊ+qg>Hܛf!֯9 X1D\nHoSkaX w}A2Axppz5[:#0SZ}^OkQ.O `V./OA" D9i/!y|z`y2;o 5zҷq1Cn@| om,2˅ʱc*ė2 P#Mmv'ʳi`z $9L mJCYg?TYNj?QDTodM.>^R2QaP> jE)~4dܗ1F{ P;PAK?9rnQlea&).|('ԜeoOX2.\@ۅWy'xr޺Č]e|Y ?4;,6ELOE,&0~{G :6ITnqe|G3wJ,>IecM 쑻R uva ktχI98o:-S]B~q)*u5Ȃ?mB O 7 =X;s8f\ 7k*iGtVUnY⽳ 54ೕE}^j_!_LrDv3 Px[>kKʐ٤ۈo䑗դ?J%+X߄aS\\lLA|8=PٶJ9aUD'db (g`tD$`1U{u1).q;+\v|Ey^Pt>[lS*ɩ,5L4K?Vjljfh'e ^I"wgX N"y'sK#L.3 .t-_/j(_Ƀ]I@pR=:t"&;4 qk=V%#ŌNrWX\H{ q+p˰1pL *ф&Xg)eNh~9U:6^+|V!Ĝ͑CrC x덺Aq!/_!W?yG),F$M :w0-zQx`VPe`4~ I`,!_NK|UQ"Km=91|Bڥqt?H+ X;T͛:Sh Թb b4Ish˯[ q^$Ls;&rpk^ %OJ[-ZOgR#o[KF;d/Qz'Ӕ 019y:spCt pfWܚwt 1(-H9 fo5\rX0?hWGb%y5m̙#qr!Xrzh9أ2EGvGcTk!]ϛB#ܕ"`H1\I1$S Egc_IIR4±;E5#~&v@I.8|_3 @ ɵ&[ lk< f蒓r*.EC\!y[c1Ù7b:ƅQJPNH)o3%j'lrRmZڔJ<̌- Ozb9!]`ouA~, !rCψT!rQ,<^a%K08-:)N;eJ&1tUzcmL<ymު~ h[prg6[߾*>y1=&kXw|t%ӻ&^l\ڼaB$;1Q.zlO$4yfT2a- l@ Md}(ZӮkR,POL|u=g^X""SU~{SwL?xxG"\C :0o"4Yr.]$]͆JGb2`ĿFM7gT[y\ #uƦbjů{m%Tb/'|'a6QЙA;_0fF-kR,f^/,uZʩ(2VnP[$ хAr6tȋ~y gd-K.Ne׽0iku;YgC/GSRGiHNHZ( f0ͷ-&S KwwA*DDξzRPJO2EN?-+ 1 ~\́bE/:sِsQ@LK)RA4=פΌLĞ{!ϒ_Ez)Hg$M`*gdv A1:,;fe2T4kqk|2ǪdٵZ -e;óHBT *7iڬ9N,h>t[㊃)PW!a,)|W힫!≁ nA}KE鴍4h=bǰҍk2˚42m &tBG >}(P/F"ܼqƀBY8E4f ۆ$wN 砬^fE•AE8 * YVB$:]_.kGr_nYYWֶS8{og44V(w^UHJ2 2aZy[ʕdk}|uҥXBD즷H=ǝ~AУ‡5IZOcKmGcȊңlJ"O6<k`8xARSA`?EgͶ@gV0:| />IYmxEi; {E #2+riB䬓;Ih!ayrY.C|E)ߺD~)8-IAg< =62E #]jBeE@1-'R(;F%v9rv0+(~[)Gho1f* ,e љ#7S48AZo,0{UB(CA~Xxs~u&Nb҉"\ ;8*Z>*^XhwJ^8Tbv{,8ƒ<DMB|aX1Ip_Nxmog͌칪n2apo|7*HNuCK~-=@I{Pgx]1U d oNE}ŭqtk>.f0<ȅ:""A&I~aqhɋTYȘ'׊Xq%1׏h =%'5DѶ1>kluKW7ր ׽:j(2_q>0IK,Oo(<[t4fhUJV;0U6UF`J!'zUcv{9ymՂO'S'jx}rxf8ׂ:lNZ^Bvf\i. k.!2M5xio)Ha>ҁ/kAO4;jam_'E?% BnۮSx.ܖ΅u o3R.bQp:0$78dȴRMDXtDl`ΆnWF4+aWi}4ZJ]Ik4nm 'Kq{2*}}[9Pl4AkRlPDw4OxƢ38T#萞 re tƋaO+Q!nG><^L*`YH6)lj8OfH5r0@m?!}-ȉ-` N VʼX#–1ekUuBS_DߝE!1 wO8{,NXm)HAy cgg3YݵdHB\=d`eڊi \ƭq![3JC +@{[ٙ,=(?)wB/JtS;#9b?7+$??)zͣH\4 OF]k˳Q]Q1Z02{j&(6>HŦ(tE n8K{*-&>9%p61jr ƹY)sMe!2dVu<Oy(vvIp=ꈕ&I|D=e_N9ʬ ?J5XJDR6/Ysh>lm[ʒ!Eݳ#u)f97;rğf|~c| =,l\qatB&( a-#qWR/+b6Հ#M\Z]V>}ulTKmZ}!_>Ayq"HLj.ﱊ@^CP]{ef*;uD׺"[o9.Ozy#>İ+s 0psvR/g#c7-A_AIjFtGR2|_E3ņ{tS8 K ^{\_OGzⱿ+b> gHOMʊk=T:r2yc4X7>3E>Y/vMn<%٩}kL|AtwJ7&{9 Cćpβһy!4kslQrȏEH9Ǜdf[404VOuNkrC 3.!cq{{漶crR։XjLvV7hh g}%zl^vӸ|6COd4l`_PfSP'#kYP?bLnbFqf| )1RGЧ&'f%FSD4pllK]<` -%AĦ lw9Junf2/IDh}^3eQxW*y^#oF'Ͱ;%8JM^zϷ// }"Y8AabD9ۡ59C)ìnA0`mi bF#ݢ q}M撒N_}X6%r[8LH7,br&/0ovo_,NyaֽPۗԟgcQ3_Mrw`e&uw\ :eak?Ƃ }W'#m_%_|,}SU>x6Gh[2][NT`c1&3V1j#q5 TRPn @/5I;@Ac=%R̫iN-ib VﰣZ=ksLqgoy*M9ЫXK+(ӵ(e6i8IDMڝf)z≠Ua'jRJzh[i\9Gp:;=7(ub4ӹx/)a#?Vb]w`[-@$MΠ-MHW)c  |t'nG#;W#5zt0ً,`8eH:y)L|dr c<ƪCi]6n]òMWxbIQ/Ih$KŹvXtAu^W -'gYTo-9 dDr^x-L䔒a3o\xbPb{^ۈ.ͷ?g r `$⵬30w ysO˺XLw,B4$?-X6sz#ˌ^?U/A/L7NKGUx:xؕz藩Y6tږ% /2{a?NMUrm TĴ8uQ1X5-֧~6 ff,7B+}, sr"vLN̿^uV ];h-qٜPxcin;ypsvēj'0f"͌&N;^kX5A*+ғ|NP?3f:{Е)ƨ=+_Q_a1V$GGL=3;R8_% X>mQZ p2x&F_aӿF?atj/3.i?U&[ƿ0\,nӣǒM .]tyvNuI~?R/!!j˔}"/*L zi1HgF^Fx:Oq\6F0ou qxߌw#ss͊]R#id, wI1"M(;A"EZ|{t| óm#=ơBEȂ{lg蘌s7Oyփҕv\$:lV竣~ģ!B'RSl_ʉοJADCRAvtMI/lgƚ (wz ,|tikV*1+DIL'JF CW/q$]@iƻ m:bt:׽[v}K|#_JӨ9UTܒ^a&PF++?ą9`<꦳67!8'=YU}Pgi8ͼ v-,djh m\;ͱYu,m萱O;e1r)$ѐ}Db zDWYWmە2$#Ҿi|&)c&Kee(:pjk,%~T4d"1ZLAj(ZbbCV#5R&1| {O+.'ꫀ1^sH""siD\x`V3@Jr!l[9{DЯ:#Z_Rl4FUzkk;`W!u#ͭ4S/b|r9X~)M0 UM:M R GbXL8$ù~`Dw*4KkM%^o--\oUs *ʛSL+B# E^<̟@Ͻd4d6vR/V|޻=ؖya߷O\Nv* 6WԦ̅ü[*Y:8i{rPf#U s(´ se“3h?:VJUV[g}r,RX"%pqE|&qZk,>ͯ t%!|}TaY~ |]wF\%UR$x@. \k,sm0 f,kUSsq_BHʔsg_jM ]VB1&M &o DL/[Fgߺ:C';>L*ݭp7_¤ma˪y ^Y߀bn|TƉv)dɰZoF 7+ʗҫS"Hnqd U]U1(!O;5[%~x .:TtGh)11 T%HO/P8- q=oE]7E޻U>R\-͉Rxv]; E] h3֙qa [ZKCƈG?WtAeLW9QWyN4/jsCZkD- X\;c'4qDђд٘zH !qyʨwoh'WP{^(*l;K3ޜF^a߃3nA3Z; u2zJ<<)|ڐSLVL*2k$xkG4jDVŧ+ L0`2Ǵ .9d,jh;\Sh-1[㝍@& 헌wyR# w,=1TxJJK7]i A`3}wa~b" T(9j0 4EB⼶on{2 [ߗ\Bʑ =vSR4Ђb|c? Iv<.1T՗"=pt=hPa"hNiŋӥ-%'sx6"c.0&TK0سGt9cؓj1]^8ӏ\ҍ5+u\0S,GuAdm <"y8},lNU#%d sYH~a۝X)!aA;O,Q[ #p!Y;\콙sCVw@{5.ij)R{67^}Z p;hNRI&4۔=1fI`fi_{\_Qp[DjG44-f  kfe0V݂JC 5U_37u1-/9^ju޸ޔ{s>s[v,L,3Pk+u'vU,cNmhdf[Z;W i C1ku=?>^Wz{3{k'7e }G_upI 伨- l16J;N.o4a8 v<8 Ga3#cJ[sR&w@=l 5&y/ZQc;}^A::GUy}ldKׄ E{^ֈP̎xjABm6>Q}dR.7\9$Z⋯ v_emr&EͲKǕsƠ&5+Qm#bM{1|L[I3žl"pk\zsU(8F\2QQjE$:lzt,?Centm%3 !!vGt 62ZRq"E9u9m(lwmOǯAm) 0"L)0ni}8KzSjs/P0QGvʗm4_C@Q0dZㄕ|GSs.C=>>. jkr);l\J㛤QB뜴?`<'0$yl/!K=D+`xUCzsp>ˡBPTWw mЪ`k]a8[h;z򻿡߿z,,_1(ʺ5 y׷C@a@wbu'>SWu=tvC 80A/>+FetWx@b,5 &4(hRxs;XN X [nOi:tAһ0;Sc=d98W1\ Pe>  f_C[omCZ护̟7v;Qg{Y[algg+:9 FT/YQʴҭ&Niq- V7;}_bBx5;eJZS#y= 20rn;Tww$W1NtY"[IHZ*ҔґP\Ȉnj9&-U`0m_i drVޠƩI#(>zCŨ3r|It0;K#v!R vT C 2INP.A`^yq z"LQu>(^dqFye%8&& zv{=\tzX3Pwh?*[q}|&9͒?5ܯ(>f:p<,/0}poНe0jrWGaۓ"Q,x|fRh:w yE;0B|"3X 4c闩ȆeJo`NP?a&,)SyqM>X]B&t.ʣ m<-3- ,Prj'Oj, N!#@BDw R _,c hORoJb3]()XokcOf] NV#(w*yw9 XO G;ܕUQΑx^|^18ȂݘJtlA#.S ED>D#P!JK{ [K|ve=#AoN,6'W[ƾ@lo+M"r]4BHpApPr'7Nq_ʸ{& ՘b T9}A䟞ց"x?|,L]C=ڞ+ujl? IG?+m *ǽXgw|&^lʄxX:дĨ/jRQpZAUkQJ 4Z׍yط'snV&0F}.d.!B'N>S[Kxy\M˧;p&ʬ,>Nt@w j>J}mN' | I.B~ހQkaZcqgP7\zoTX٨F] ]L)(W E}àn βNoqk1t\%Nr}nÄ IjemJ[)B`+іe)ԮF=ϐTtˏX-3%!0VDSk;kOǎzBP'w?hNO⾊ ԓQT1 w䕶怫K"ϰ'5SMF.ʊ.] ]sTD4 ɩ]ے2$YGkD1aB(ߓ _=1vV='؇,Ib9ЭSaEHys^T0b˄hn& IC9\ȎD9]=1@ %mcD~D!tE媙I>K$rG9\C-gw$N uY)[h^٨v2Ax\Ip_ d'qc% 1)0dBӎx@7ǃGDf5>19׷BA F)׎Ӛmn5l*`~s 7EpZ&35ިN`2 Iet'Xr>M1Xa˯F3_??ݖͭ/7Uqՠ87ni\>q_&g؆b("ru}LvM?pV\E]((vXGRڸ0r)$E]Y.p832Dii *?7}<LTb,ȡ0ROa\ 3F*8]bi @nv Rug!LLH/48 L}xkjMHEJ ߘ*2hJј XjrHeFZ..DM,"#g`*kq*y\f~NSh[n`:k kNV |;.8RDCF %`%gYsu6=IGp L6pih&U/%,`ҝŝ`g"Qq$vnXc[kK-65xsʂR-a Ȅ73Gf^v8ֈi PɌgAl*_zZI y<S8 aͺ|DZې׭JS 4oPlUיI(RCP* aK1%p+\COXkI։&6|2 Mp]QB6rm}EWv@OLA}fޱHG|FG|6u-U{~A! 2 w o bP #&0V1=6`&+=O"G;*TepB25bZZq`Y#|<|nGG¦)K$Vs9JA cMjrDR!\$\.S6@ %jyqwXh;Ʋgl @&/_GEzʮ-#Y#bSj, 埈( #xOPة%ڕMՇmjXBiw-|x,v-<$y%,ɤQ|poGzmd\T99lS"3$5~TizH3#ؤ%QDTONDq-bOa:}-SfS;=VoX=eF6`}\bqd}KtUVw7]A:\1 |beL5WRkɻ[';(62ZBU @iS1ۀC'}B_T<7n%UƬ>+3, 6}S-H:2hc)Z9ʛ .s eʁڷ _ѐU&l̾T[{?aIHLvȕ~H[ 74T ٟyn_\ dD!'^M&0Si ^kCCDz^{Te4B^֓-X40Ο'^{&4R醚+zL0, Կ{{H5+JQx9i4I,eؒmBNAA;p9ǻ'z멢(~Gg<)]sZdG%Kv[Qߣ/TE0?uh1> *_B1a[hDg 4Gg5qz*o7t4+a#WhZ3n=^gV~W6dw-6FUNJ^P㽪" vs ˠG]rwRoV"T:r#–It/“x68!0'i0lKڽsiFʐ7zz~%0M$hl͆ +DŰ?O@N@JJ: V>+o$_2/!gcN~L2^ɝX1ңP֞mu(wzx#ßgA[+?6W Di4y^4 $ydڟ P' MIEl O!D"ŕho2H)ɕ苄ƎEح}Ij㳐jv@P TmR񊵒X3Q, pp؍ zCNFj7M:lgt4y3˕5kx'ReRoTjeS(߼Lؐ2vq\ 7ƵW=@" TpF&lSUPޜ:?L3.Ywe7H9_I[e ׄ A҃܎F)`k\0,R?sx)DҖl/H=$"#Ҹ@d,XU8ɰ-#p1\j3*w[P+ߜ܂qVv.!~_;٩V+WF. #s O1H³x-kX:w|*nzU%2؎_ѩWnTIg7]\ 2BXK#h wTO͉\2Ml !WTo~tgER?1'iV?FO&aK %fOƾ97N\{2>Kwpf20?'D8u!ͅk{Q*\vVyW{5ձW 5 )8B0t\qi6䖋)h %0#|KEQxqw@NPD}laCU.7'a w_1.wFhh׮@ux^:ddШ]ߴ$oz۰(mCozuw٬VcC` _<k=QhHy_7.xX0K4Re\$eA6%Q>l[ީXt9Һ[R^?K+\NGcC}Ydԫl:Ie2,:?hB*(7Jf#krׇb8;iTݥ.nǒ AfZr^Nԗ[Q.FujMvf4Z Dxqjb@N:Y٧D幰3{Z/z3CL\^`favbF~Ln&q4OW/+5LX6@i[PڜʾǏ[|4G;J. aa,ba}9>f-KQÅsI +ۮخ#ŲhReYU˟1a+ ""0E%WT=n, bŃ}ǭQ! a 9 0]IU@QalDɴSw'6j2]4.D[*Zw+pI!G;E>"ϵjrc;&5=ii!J) q B#aZמiNX4?xBe6w k*2ٺ!{LQ'Jry ؅3 |} 0PC_#,:â®OiMPG 6>xWBETs4Z*"DՔ^!!P<~ʰ.hrfJmeW~pm }-߳r5:=U`hӤ,rI-VI@tViU8.'ML{u`W{JnԴꏢP ua[3b ܿHV HIr7"LuF .f5JD1I7 _#XseQ #MR8蛟y`|RӕF/ks_W_b'\EͩXl2 !^$K s,\DvYlLk ]1U/:j1:׃ GEɟ'g ?0Jv J4lϾ1m=kqe.2xF(3q0PpK(47(Z ῶEk;V0ź}}Op^hAta l0(/q#;u8biomV{ k)WZ(p5#?Y [;&ZePp}ƩG ~ˡEJ*qO%M1zmlQY92`JnqgWjS.:>f[I]b1gKlt^7.kQOi,A' S F4aͦyj:fɇ9Ѡǰec{RmNu_Y(װ9T 5\spL+^{=/ᨃ(,}KbPZS2(GI0DBM5\ⵛ+ qh&tY{:YE+̂'5p xHZI-$ϳH*1.ޮB@J&\a7@n`>e-v^z~W Nr56 nb?r-,if@"(MczHC i\>q2At)#.Eط]2Y#GxϰO2(C?q/ ~pc 5]b3xYYE:hৼ5pڠ "s)"S,P.q <!P+ؽM `5|D_EeV2D\PЏQ;b}Fi(*_*r9IT,yPbr[c&EٕB`ӼRHI&*kkO 5AнyqL`nrGGk Csv؇lsOU8$LOM3s0zjBYtt|t7mG^X$7)c ~*{u#b+pXzw Fꪤ8`]ϐόXˌW2tU75n:Pb=d)8=E nɽlrڃGc- *<##o؆E. ੎Xl ŝbﷁgB$*Ϸ; `-OGLlp|_ eo8> P˺@x赙1U/!cMclPmTz?])D9? Ooyɵ^ Z@V[jS|t۱4g9 |$SӬ3[HWWsp)=pA? 0%TRf#s& bڡZޖWs[VO'*kB ?`j ϰfO 5_YX.̃z(\' 6EOõ'6=&J;iɲUZ1u: j6Mmσ F{&~~o :g]guvGE` h!j|]S{}7*vQϺ SLϼ8IOΏ>!FHSah4k}snSL,=.Rp6$P@W(T}V=4N7a5hL !|a6&Uãt|=Mn4}:+nEst DfyUެpbd"A]{1A7BrNz rM+IXI$PBv<)B(9)[, k.hiIy:? Xm0EU5?h~y0)&Cn { i.wh P12z㧘c\e53Ks lL_GȏAp˸tow^=x"@Ƒc?p %x`@r]SL9{P 8P[3n,ZlreHI`?́> q+&x4UE"kZL)XxU2 AB/ %qrpY|`=|C- $ uuQbLo:@d0ָI%o֮y _LgƼwt_YrxS^1B/i>U{k*!Ĥr^"\s5\ցT,d)4#+WQ& bMг+'|>LRLX3 ?7 ryl.O%쾲qO E x25}螵2Xp'amo쭛̄`cyBx1HMZct#iR{#>6MK:(ڞ~!kcvVa6bs=SXJ)%3f^X~S#1r2J R/}ƚ "7fΡܦ+[O.1FW;i+JD$VFy -4 \of^4TϢFì^| K8ZojuZ^HbzA eMIQpѳ]ӨzpS$ՉC`T~]U[s8G +qD4F;i!h)WQtϭ~̓Lz2;; ~XN^w7e@3 L^JUaI Â贸՟ޯB4_Q/oz,5m"S9m^5fsAOɿk@kik+c"I/j&_K~=Ex#ީVYK;!'wC4Ľq<2f-VT'  w]F_:Uf!Gvr`qO|lZIq5?=M關|ɼweZo ]VeM=a4j $;OIEQj +eU1Y4oGlYs@EuR0a,䫿<ب9x;LŔۦ޲&u?-CELv"F ݔ84F1g 6AKvEnd՚|+͏m?bj%KvjR"V"z4i2Nf~:F4^GVvQt^p_U Og?5$a[P}nj4գ6T̀tsI@ i N-GROT:0%*ל$>L,7.n<\8|!}>aܧ[ż+:,=-vDjs1ZL\;*Ayv DJ2(tYϠ[;2Ɨ 5ޔ|~D+$| ˙HE5tt33yZ$k)Ӥɖq`W0T&>`%&SxĂFcaɹEosHU~>,T-r Azb:CPҿFi Ɯ݄n(с#f|]աeLdD}٤<Җ&DZ@A\iC!}sTցy/#Ý8ۛZ)1=?rOv0mC|s 6sku}KR$͙@;TTudk%mrstF`\'ڶa-H{3uxz򤏢礋d}e>K12,VՅ !o) EJsژ\ەٞ r3xx5AS;M}W<|g",P!H(W՞ĠҌb"I =GS*ヌadP ^ |N05UlS}iQzŁR1y3Bq Ѳ_fxڻ(3qShg՚g]}!cTPM]\j%wwĹ2eqؓl Mi1[t7tZ~BU.}n0/BP٭M  x ݞ}Vc$>osJsD.mm׶u^ Ӄz9B? JRQt.!ˊ%!ɒ e ;[{YF ͈.02ضaX,,RK,K+G;)AjQ*?rq2;up?$QםJmJt^kp5s&dN9rZHJsr  -vA< C)`[#{l`}QtcL%hHd ~]Ar\ KA-/{ uO]Őq] hPb6;ϱ-@2_ FCe^)ar㡶Hk'0||1 (̊(Kb$IKjh9&PkNdg~u^p$ Rr5o8K_\9A$О15j.o [$iƋm/GL)rعC֮2(&z4sD3*`Y)=Jې"F 潊&E۽c3erxV3sx*Y0&~x̪-!ۚͨ/fO{ /z2)];ϕr=NQF0ZꁿN;ڦ&Kd1RGgZXx>` b "jϝI)n"YĈ~ ;ENkUxaEGʌ _8CE:k0#{uւCMJr0xb'y CQrq*V a ,;%2&waA0{^Y|+Bn_ƺy -ηBa|<{#t=.A&韀X| QcU,6)=fQ>$t?RWCL:<0$B6cjkNU͞vMG}EzZ_-o(FMj;YJ@}158ev;Rk~MR viv:̲/kgƋ)ߓưrjv'qKI^a:B$A&ZXgY5{AQ°0&] O/YenZ478)*]nZ I-Iu$˟$bxtf+U[SnltM"GC?kcrfI@|o4CNҐczѥD$gmaD`ʱ3ʡ^CՋ}Q&irG˅ZKFAd7|s)9~=F=rr}] Tʆ.ڻ~b]4 ZH,o5{t=V&]ab}>eG,a}ۍcΌZ@$&KpZh|$5˜(aY]By9v:@-vBd[קt 9p0f2rK/an WFe.P +4!(Ukί㜎=?lXx%{ dVG4uˢ|n|R4V; EH13D3gVTjsٱ.k U dr_ eM>}k Ͳ˜U0":j󠪖 ЩY,QA<^{Բi~Yaz1A^dF8Zcrl2z'!& dt)0[vvfUW{ vx+ ղqEW9(M^JŒ{Y.Rv!dS$]㏦FL&$|i|8ifuejօ ɐrz_W~[+rY8u<ߨXӣy,M.sc7*z @Ҿl?Vr*'1ؤ| yGpE^ÿf; 9U~#&WHMDZWE{˽w%Ku !-;n#yox3nFx(ns L mtCDq@{=x4'meWu؇U 5xbTȒ>F/_ K0t/E1/3%;Y;6HXոD1僗Nw|wdBoC"д! lgƝ/$_N[MɒxT4fL fXkheEו$YFtyoYQ!|2-؂>` 5m?7 ){g+UG; ne<5g6af;MǤYɣl ?G;셵lҰ\a "&P,,\Yr ݙ5M[eiHoˑǒb?jdgHZdPu#ی|]1/všBu逴$'1 5daa 27Wnw z7U3?ŵ(("T$9TEQnHQ(ZΡ.;M[.4Z t_¿\ͺMzFX:V)ھOS[v2M޹AG|2[;7]o_:K+7~PuwIA49]u›׾> d@~5Bpd;.۬7s1,Po_=f čL&à]a5w^Ӛ F9~o:|eJ#%#6)]I$q΀=<9V ɢLϋik@jzD9;ΛүB&9`1rIefY[4x?ndSr!= IvI *9JG)8Ws7!V|eC̘G55~;f 9AQQ C ݦYu  'Q*g6vFDrE:R`ŮˈDk? 9cpbj9EuArCJ<`)-싦x]A'?wrF^ ̌F< OWOMXd7gZmT1^u ?/˞tH+c~.?x$)*s4es*M^IMyej+u^M8縙FӣyIq TDZ鄭E@?9$_@jL0FGhj%ƕi|V9KG, |fbuG9W :""!asf_ST*e!DW[٧wv- a8u˱z_/l[^1)%lǚBف)TXoj",3r]pu cg.˸8b!Wj@踧 #kZ4mE`iȟ>xD|ee ͨtxZ - ڿaGFɹ8wxeAB󣈛~2K'jXď0}[./7Um9{F8t7KBs=7YҘJu6C|;_kwLQHgsڃ3}ju.#ڕITʇV릷> ?*L:@( "\ƀ%x*eI :?Ű/GkmlR1Dy_+M]F遞RvM\E]`^cv_G=GsRB?y.S t9fE 30ę&D>6qD (K}Sɉ 0Lq̗vT7c0ɾ|`Ŋ7,/2΄keMr5҇NS7> |# ꨪznL\uvl21߿sИpXtE3~LR'S.iL k9)Do.9}(.3]\^~fcC BkC+E*,D~mDhR Ho&_d<#ߤU.ؘ?g0_#I٤~D]:oו`$êi,|i~{ !-c9H)C_Bbw{q5 /w^ %~ZXB$zA.1 -_Jpn(BYݷm6 GE4&F:uP2U$>\J9 ,)k)RRJsSI{6 0c7~`tW xw`9(b\r[ 3@9Ѭa*s!Ɏ?u(ǴӯPly q JgPňy>zMG#AL3 {W᭞:6K+HQyI˸lQ.eBˇ.'N%[@nł̘s:O? QgŕU1?F r'|uD/ 6;ePcdՠ0$ x} VSD*Z%\&@ԃhp=-PaViYGE^ 9߱M[8HD-pfOZyz )r,1"q=YIa|cyo/~3NRPMWf'`+^"`ώ7Uv j@ž̽AI%E H=yVC.|SBMfb {D>7UTlkh9dBڟ; Nt?y1歁[N/bFv@vE2× |i0R^yhIJ66AUAףrpW8!Gz e̢n$S*97҆|:=vl/EhucE?7@?AltT/2հƚE`Cx%9tl;> x;O~ʛ'+l]Y Xf_?(lv@zÎ^bJ Mx^鼚܊9u?@fGwU8 #\ڋnBݐ]8clJ0>߳k cuK<P.7<;¼b_%^+*F(Pi<IO5kF1+Frn+h)ae dnɋYwVǻR-0B4m7>>Rs|"z^6p˧!;n8jA -],weFa.{ca6in~|zKMX@͏Ώ9>&ϴ 8J8jVaik1?`*2Vkw36~0^ !ns {sAR_ƣ_ 2C~E|PC*﷐_I[<ۅC RU"Ao(*{id05xr˛.k}R r5GOud?ih1-w|}`8ZRםȫ$(B .Ҟ~Tԓy<=)ERd_ ~KtDiFZiNJH +`x!d Ґzrՙi80}zssH2 JFӧ˃S3nzS| dq+=Sb]2Ubehp+1FJ٧D K.A #C@W:EDzƈL OrTǻ>䗚!TCӔ!b4JBh I6f<6:ō".^jV}?W.(iK Vm֍VƿilCSY =_ݼ=gKd!76v$ʜ' 68|Ԥ߾^o>.3`%%8qV1fr8A L@܃,?e*H@E03&V{Н+qJ=ffUEΆccWXMl>N  -<+;+y-ѩOk `PuN5N gSOs#DCT7S0nͷΌd߱ gFlYOl6xZD[h?Gx{-M*s[?uhF@655Hϲs18ntXl6tcw)ȋS`Xͩa["/ ZFNڕ&n]R<ϒ{adCõ1{gU) FAć$ɇ6)2Ȕͳ_z]DaZ%@=%Z] hrEMA`VLč-tU\WhN.9M<@ꇊN!(fm ;S>jv9Pg.wq|{UzII9pz9E=" Ѳ), E=נ}| T$1_ng;Fm98,^uw ?x'TK7ٸ,u3W؇S []?Җ")j*a^9mܜ5Vh1rC2.9 < DgXq7bMOECgd Ks5Ceaeϴ={ cDG|5$soY@%A.KNv!d$ з*|6<\l'Fց-Yi08 g[B_i0(K&=2~\+3"ze+h>+*!@W(:&?b..+M- 1^1t>KFĒnXyklm@ԧ/nVx}"(*F_fmzx; \cCoT=2!יxthw48ok$ǕX_9:]D yjw␲%\է\W3m|#W)?:H MnC\݅rGzv8=sӬ s8x0%G/)`_PDnݙtQ2 mX3a73k<ܾrvYe1YA[*^if=z荑ڤ]5|dm![8hRfv|9$}1 Bjٙ14$;*LJY4_4J}Ȣ|/os'qcu1 ++xg;k`>9gWќa1tM;>i_l6r'#m!"g\~Okmϙ]xPYfd5'<+_CSj=*0mwgǿL#[&AJϕFq upմ6~XQ@ՉSkV[{0 #d _LC8zh734`ؠM.(PWi7x&\clm^C LT3R4s y#Vl7=ji7@;ƹZpI7v;]ԹښZv 6y+I`s' Yhml#EZv`n;R݉<]@t虘ÓPwPaeh!EV:"wۘpD VQYp$">OaY>@BdHvB!/[nhA^bYY~0e(w!uM#qH<^VMΣ(uWw)+*m3k{nY+ȢD*Z蒱[J.qjXKE Kg9~'_N8<3J'of<Ǐ,͍"\H7]f[ZDv$u:YW,%IQ?.Jti1K `XG݇9 =V>H*fϕ$C'' cع: Ċ`BK 27gfiW :ڰpPJ5yG JO'Ņ_,k/|;ܚ99>HgQ/){ 1wGo[3"u=G-o9!s>~~X[q7LV ,WSXnZ-3pc. 5'#O?ެc'o"D6*=Ng%|xn[,&môm냪S X^.j nj9t,ɓe#WڑܷTL|S_2dRy.ԑźc@j6X\IaL1Ѱ'T>=?IM'7%aGbq#MRoW"B& ir]ϣ]=&.ZmJ 9gw1Teg7jɛ؍)3 ^;)^e{x<}iAeؑ`ni_;e.FI]^|"ș0ClڽD l-4Cx]Umx6Т~]3 S|h8uJE`\Ap FR=y*m=]x9t! n,k8S TEZM wvjÍ%k BCRQ:!k[jDSPz(2늂oHcGRAqyEjl8clJJiR]a rEXIya\$8z?d״测f$V_dG­7gKQQf06D(M@׶/{>h]yXFQ]w}"q-F%7}_Az$7yC3.,wi h>fi>]t{>n,lDcJ{ug3Ss^]niŅPbk&`F"mz_;k! I>Mz}w#f:HSR$A%D)f}TXBZ%۝FIrpafb\-Դj7-,-$1$Ly.9=)s7_SX,SuL)Qd"6+tX,{4a'ԪIw]/ 88{-BBKBLRlj{9-iu-Ź (?h= DH N#ʫ@3$\J6O*<|>W PS@d&gJIe Sf pv]]"ĊrzʔtAt  HС}3hmjL^26ϱkȭ!*&ܼC UP۾jJJ/y&Q&⤗%åЂI(^E {G!g^ya.1O2QQ/nnnGltB,#EyvN Hŝ—,$8ڣ'`8c:!&hu(ٵ$mf,a O@PANQrb "#S1MYt]&y͈ 2dEaW46Aq< 5kv I֌0hU-ruPy%Z;vZo8NT7*3M !{ʼno:K :7mg"?5 89y(^lP|r2k1z`M k;Xs#׏B!^*:a=""6[Iŷ*ѱ^JỄNf@>7'f(%,@C ۗQ!UC!Gs`Z @*@{]$Nٞzۉ,O+h ';Զcӓ{b(H∌Ks$B8+i=;{~z]UPywC= Hy5лq`wG\sڇG8I*aԺ\581 Hwyyuqԫ:!}ӠHd: K֯9k<"YsצGz$ 8rF4W~DZ1V9j aL⅜6wL1i 9kIԜm[P@e}|pG7 kq(VKp3(z*L`00Qkˆy G+Q  ں &߅wc^b\Jz1K[Qɏ]S})I"rH 0j`I!'mxa"7 ՋkPj^י tQ gF\7k-aVG^LBUv׋AͶ *Zqjˁ9N'OBoFfḌmTC@DiǏy`wtg0~WWq׸o}JCj6*b $ŝC,8s؊Y S3! Hd \xQt φ'ӻj7+cVyupO)Wc |CfsJ͎ 4e-$Tc[ e&ۑrlFS(3ŷWk' >0Қ$(L"lgNUJJKƻgs1XveP4<6IXiaYF):^8w P=}"xr4hGYR0ZVЦ-FޠJ E'ef躎cQa ɶFgv(msClz 䆡9d7]MƇQ)q\#7׻jȤths?\wJ=Xp2g {6IP7eDu? ӄɀxznq*Jt3:S%ΗvP~ K`'Z^\פ I . UFvcY;f{,oZYyKെbxEquJܼKh&EOBoԺﺅoWo53rTpW:D.:m:p>AmMKn}w1q q#KzX-8mIMp@>53 Mve$;e.DO~h'^fx\ !&dkbw{M=}(FpxTcְ; '_e[GRj򚏫To*/Ԛ` Rv.$j;0'"u-ӥR?@X>N>M̻H%\j!,͕Qڧ+Vso|o9R`E`үaZYJ0rӍjqʻuw&oƻQ+'ű-/WS#eb(tێJlx8T܊kPz!VzhD|3yeȑŹ‚VGRVCS1Uc EO2´s &RFk ᘨz4&݅E)]#B;ӔWc=sijP:>$KprL0q(bUп7yySh8Ju}/)SUJbɺsǧo_uWgĒ֑⤨1L f1'X'\2pDZ^Ǔ Zc~6a$_2)&fx$yd߹ _Lr!͆R>\ !bPotofG޲f➥!dN=+R?QnA;\WZ rYH 5*)m2DN;?ftt X@"9} r vIG+{"2C lDF.pʺSZ<)9 ȥ_Jjй'hŅπ5HEvw|n挀:v W^n"f.ƀB2ߵwkbAK8e=jM\Cmi..@v,G/[hmB(8?+(t*7=8[W(~1ɍ;a {{C$-;_/HOdYx<~LB2ҒDЈ1֠ .VEkt_eۓt2*s!|֦i^ ,|v^;u:PZNww(ɍ1UB-~Omi՞Q$3X;U!_Fuѳ W܁`Z=πLv'շ!:UWa69!ĈM0] k0#Y+Uٕ\_n7'ggЊze/a=Ҥ2yP20'6(ݱ^߿Bop U?ͱIP}#Yq^(I莴bDάFD!S r#jsAaGCXZ%S_ΝG0ݥ#w>K+ \2S/EO* zsyStYOSuE(Eu?^Г HC8VӴv~n"1^MBv?ω0 i]`ƳhN "eyEʓ|DŽ6bsmC#jIghIX^FWj@D`49؆3 p֍{΋A!LC/-[9U T:k:9#3Dc؛xh:v]haY|`1-vlK@iszLq,1TyÃ!`{ } yfOfܬ-HQ2UOn (U/P#\=~:ewaA8c$jYeOYTZɌ[ޅwyٛ]JM<˘o0SQğ"9*10';UN}Tn$«o*gU*ըPD+hQ &س4 p4 HrĦL/9mb& v;>$~!nܰvYap׍#J9?OUϦ7u"09QP>! {d|06C^PU\yӞc ̰E5c; d54ҞFwJǔ]~ul]hyNK%ߘ87᥸9u<݌V oV | b_QܡN.ov rGvqߎ H8ΡO~:94()<ב)Q'񤼩$'Bo,k㼁,P`F\,SWbϨ4ԗ>1Zcի (mC<֓zsk&z?u1r26 J7:Ϯ-2q!)ӃeL2̄M^DYΕip_ eii3KʺQ͔ZWoVphq -`R]"y Vqьuw&CS|}{rVF<5`h%a5DT+? Ksw,j۶Yk!2|&Q4d(/G[X3^15?x6PdG6vlifx!zYh#4mB;>ҵ𶼴|jvQw$?tUbie3fkau cC 1ώ\lL,(OW} ;UOS {.K>{W{:Y*qq9 4$u< Z8lێ}*(;w.9+A1zG;#Q,Rշ=)lV\RicMU60L3EP_m{N·h7&c偃p5"|OQdcfn=g[iHdd4VCw*k"2~,-!ps]_>R.82mH_TR+!VwPZyKBej5 JԼ~L#]x>D|u %65Q,'{ zܘDhhJvc`v{3)H+\FN [ :zrmd '~, >lJ!eR(vp+)EiE7hg6wmPHOvr4yCͻ MQ1:R>fF} ^QZ-b{ְfds0PP]+h& Oc}$ I6z|,<)[jzO S1nf T{^L$1R!o/Yu-EޙVhH\ƺ ԞI~kiߎ㋜q v*)aD 9e*9]o3xȶ|a)嚆JNtF2xaEкܙh{Vt- V FLI VV$1[& b*o?PKBÐ t7kw!u[<'I҂قMBҜw ìA`C 0k'43mZvwoSpaHߊk$EN>S̘m&e_4kSij4&^rР-Վrՠh1,)NOX]'oiwRV#AX GIrdxV|)'C|h⭁B] 4ڠȭgl Lqkɾ;=SmJd Xn%''~ \c{e/O31jbije3 *̝bU8VPoeJd9W. M/PdBNbyXPрOQwKTbךx`~dkэ6ȸaP)p1xi>VNV}FFtaMgĎqmA%`t4;}YEVDpykrxp1uD  }D8\6/7X7 w.w`;a [i-8U xo{ 9o  (j5QxMԏX +Rm@ m6KOV)Em!)Pi:;SaB%ϱ.f<ر.ԇd)A'va'5|-+zRɰ <\x QKY׈z%?^ ʯC?n Zʲ9&Nm#A o˸}|\.ݠʺ<^L mRϺ0XfH5#P,M"YW)c͸9SR-a6,h YB{Ո;B01%ȹ/Rwgo_tɜ d@ 2u:A1 o,:oz&̎c\]xqNXxAԓLԦ.Co>cMۃشj#>Gޚ[)'b>.A#}8hЬV\Jpg♅$˒s!9a*a/+83cbL4r&le?0%Њ53sB#y8/S ((֔T M;rMn*FYSm@|]lX~tB:R*Y(ꆺBY}hJR%i'+AV2[>i#v\0]PKZ8|2xLfL+z!p{YIk9 ا0]Bm+lh[fSo}}xهȤbAD:}ikEYBGAoTwN&ߎ$%9V\-1ЊqqVqyW!Hc2sMZ{ e( muT/6}Wq֗oZ! i5iFQ?_eZ~|YvіUZ &3;/.y뼥 ^Ie`%7`/}IK wV P9Vu5| Iݱ/|H+v"Ke^3|v"2g:T+Џ0C9\d\Ɗ^v4=pـ@ϊbYe@YxnIЅZZW?fZ&lFDw$MRО)_Q mDבoky!! N~$1a}4gr)G\#TD{/şWG)$Rq#Cvꝝy7d6'ٱOAd(C鴦Z?\ju:;SL¨!cF*sL(۫2{u{AŗBq-4 dX w8qL>G///5LKfAUnnTK8!;ON,1.Jg˴uSp=m`P_Xe?Lqwi)_ US،?#}F\T~g#`2+G-'=5k:k.^ï'0o (⺉S^}*U?VG.!ޭTq~Տx'z@6֊\(w+YD9xF6ܘ }@uљe',@W[̴ 4׌$y-b-GxcT|B.{%kiDp5ȭAulA@JMkAH( zQ}ȟ@Aj\9Eo},V*@yqelN!B&$=m$DmbvxD5ASVw_Mn^{[ޏ&٥Hxٹ6$,ݾ3ߛCPM\:-Ut1`8Tf^j8 m)iT}П AfK>>G{ 6d6M䇢J.8+W v۩yme%|慌O:F+-O6?.'*,Gr-x^ فSQg=6eiˬ-#OlNnmaag p^ؘ8ܮ-EtL\Ξ% UV1!s|1}/}MzX,5q c0/j(MLY[oCfVQXzd*?Q%q8W-rdT…vA٨f͉3J"`/߆ e? .>TԸ$hIY꽞V{WH] , (\<_FiтAR.ո[(~VU  @ӌAlPuf19֎ T 2-_o-8*6N(1wB--RFNTM{eIp`፴h^ \Cz4.pߨL%,>/IRmPx=6P@fBp9a^vc]$5IUV8H-(ؔ\trsÑ;?-UVj{"~oy#Bn@ڥ&EֻVك1 (2D -%Ors 0sJQվY7F;: qb6$i"@8~6{o,FQsK9hxՀ5efui:#朝[~G 5hxnZ@S'? B$"ІI }y6Y4ϽBS .a 5 #Cv٥`^w}S+v0WoS}aHN㷓 eÆ(tεB%J٠hگ+2kƠSUֿާ‡nց^kI؊lb[cF a*h`1{R^;ʦ'ݑ0;d K5Dh%4*NYS1(,_R۳nOu?q/]Q.`o+dfwy}>^nI]pkv^ԺƧE Wv>jf_ ,u.@q3/88V+ڸ=|2Io-4SӇ7Qjf]~e7SW{ <ٗCun4O,w=,DQK'ϧ/<E( 0XzPm7|crpgʗ1 _{[}(x^<ňA䀾?(6}_2`c4ܖ*םXS25Ġs˼Yۡ8qaޙ`6LF :JOoS_"{ :n+Ԫ(C1@Bı7=*Hz8 `G13{F3`A'M#}{l&3g,^ cRYR?b9Z0I bGߌ+$VB~eْGCHQ5I{l]j[x/;z~$ nUAhu.Q3j guR)H򰂸Fw`eqG5iࣖPBpXDzq#u9d{ඏ1WOy'qOΎq:SмtBμ~pmcj ({t(pᴨT'E/m]1cpu^sDٟWݥX[;:L4ݠo;slN 6M]uJ0R=9lr2:e'<@.ef7ˎ<&Nlh%v RA}L ݯ-Ix7=)$.7~ְ,JPkt0v^-p.H;| c׈7U\5H!1{%pݶ| v~-i3C?-?gg D>_J<~dfy$4wL^,Wxχ>NqVYM*v@3qy~/DEO像GQC 5kN/Q2I[@7Tu~"$kdƉb_홋j!3e灮ĕ޴hΉ' ZY==Xgy];ժrU.[)<.+<#gG˥`ۭj-NS15[/(l:@66z>/EHlI4 9e&\RtLm{̛֩AsNB`F a^H.yue2ݍy/S\af4R x6.\(>k;8]+mM!BcbqL8lV N_: -9l H+9[N 0vsIDlx!0a^KW}CY|Lj3@ 7`UH,BOkkJOFOxϳFNIs˰ƉZ>H(e*Ta}|z/Q6TΏk6yt sO&pI~HV|{z|OU-.Q_ p{`T̋tz$g*%,` :ĥˀZ;05,ӎο͊X.q Pͽ`XuRI{,9R8/e3npo`yHxf־)CU3|K#9o|ؒ. EyZ5>qFZrM3ݐ_'GZas|)=>:8,ZONEY(yE=W Nح>V[$f; JZQ24#gT;$qU+CXslS{_RL '7ª]L}::9ϛEs.=edr0DRXFc$6\ %Mc 8 I—z5~"q[ֵT.`j7<^d`U껐C^3QpY6e e̎6!kx].~J{XTx9JQ%R2ǝAbVSЭIXx<O]8+Eg#z>hk-HdRcď*/^S?S1DeĊ6.,Fy7R튓tp,i[5,  &d- s+F KU۹ƩީX`qԿOUqi'g *!<: Ld4ƹW L 9sBSϷE=&Q_/ ?ܿ spQy+#֛)d4{|/c@E3 ]_pxR4ZU0PJǯsb9BҮm7XgˣvgοHo|h0쳸>qiz8܁noݸΎP-%|<[TD&_"skپd,HKfqW0q[O :ac QxБx|?;+ uŎe}, j=dwo>@QhY=n;oso%Z0)Lk߽$ػ0_9 jNO:E=${@DB8<_0k mg5'Cio/?`+X|_Kq`}QәWISC=JU/A`͒;-OuVsZ>*r ]L$&e*3ҖD ǭ4tR)ZsOަ8.댏}T΅ ZQMqw}ۇ#i4S2F# 0q|*s%L+Z1L3|#%3mJх_/lPTA w\UU# /)adj众*Nk[ޥj Uc};{`'<o}KH aHq9q`f1R7_Ni#/l:$) 0]XA.tŪ=ȸچ^^.w&ނ5 iA@t47+ x _j[)M ^]Țߤ1|6 h3]ӻpD~'N{Tw]RFa뵋hkphEBOS'`h`:ٵӱwa>o} EYinsa>c$VŒ ⦌],SqK$D}2 V^ij'Y0mTs .뷠q&ηyژ*s8wLyw}VeG}|;n޹&vzZ:B!~~~ `V939*ҷD&2><Nj1י\ZIbTR"!sC#?,[N/bvL8VOMĚ9Pn6QQE#B~!XhCr7$<[0 E𩹣g D've8cy# /̅s>Iy KSau䱸/Yo @KqT*D7KQ*i!CJ4?Nqجj1'R{5,as*D }IHۥJJ 8dpE~A3{Hm@q7k< *gc/0T;r/)Vu?؝'`kmɛdWy8 gJaf~f] &7"?53VdvYridM6)CJCXi}dɒ  E~ \wH-OtaaX r/l3;j)snC*?Uw(yw *PqJQ|l g@hG4ݾr0P-e ]KU<^3Eb/PvR\ӱAALVĖC iZ) Ȧg=. x& q.2 |}(XXtjylP& E5y\GGCH[/;XJ/3Sf+5oPo{pX t35 `'xNL֟Uxօk<M`#8{V+\'[#rd/juRR1~(7^J(e𬌨g9X$@},w=gqH4FyktӮjĸ3wD}.Q&E+A@V$z `¨"Ǚ^ƌɏ @S]C =P`[E81O ü[-|XboG殑[aHS 6)GEfl$NB L#֐FE6h,;n:o^$dS#a8mD~2,R1͘>* }ޒ~?f.6%6Ih"t nSP[{30SY6{q(Oޤ7A g!ԜLKJ#Im&pouMIDE=RU iiS}@p Pn 'Yi_=NX?媒g]4t*nKK>`1q'hJ$e^_׺CMv scVrZ+m;~'H\'xE$9tgJtk =lCgA1VjY o˦%$ I՚5q0vBO8yӡ uG7GoNww&H()*Y9wkXͿdDo\T^Aסl/,䛛Soo4j/IgU73n;x&-=M=ЯDEإh-3J .u,gv"D1Ő0!M%K<% GuH(GXeX3+CP:88~6`EtzLlq37hj`)C>&ΆT `Ax0Vi@nt;>{k҂=GsG6F`uh/*Lev:kFݱ+@Y@•>T+:XڒNC0[w~]`k0!ʅ:%'3u<&ʼnX`Aۙ&f%/WwLH}З1 ^ЬVP^,w6hv@Z-VGT#I= IKVnrw"%M=?ZP`3n:4V=~A 3W# j~U3@hY4,|f Ca]#spխn Th {ڡ$!ylçFiû*ζsl4eW-L~(!Y)ƣf%';?FQvk>8Oŏrkqĭ-$V|%<8u:m15M߳{sk^x{5TQiwgm s` ǒX.>*+N,cj&~ޕ"&o&ߘk%yv4r_uCwem"t ~=2&ò,?y$Ql;7&cPu5ޗ22X"LZ /U6DǤ$8(;+#I[ʶѪlA3-+h. uʥmS¬;(&6I0_cyJ=>y a^$3-1?1Y9=)𘔉6+[QKPV4d}+3ʏԆԗ)e10Y056TNxj@Ȏܷ3òAE c\' Y~13ķC eacyir'H xυ0%,X\燦rItOE4:;gd%p=}wn^A3+՝*BmQvz)4~;OI`7ma`6#8rh,]V]Ck|mD\1BWHSSJ;$02!Ζ2uk"s;s&V:y)$Rw5xE4-*3& ?Lb3J(nJPkXr0_?~ =MF&Cv4![27x#a8mu:}5fP޿o͢βǫ EPB_d %s D}8$O3bYP8DYl'i°52.Q;%l64ýe%X6lKKʪ?Nw"^ِ71|HƾV"YQS3O@-j]x)K8EYv=Q8#u鶆)6%AY#a. 퇗ۛ~#$#|GwG?(R=ͷpefVm];r#{XgsDk&Ld%J5{cuMei)0B}_X$Qϔ ^G~֜zjskEvG04Km)Z0u|>fkK1(WBHhq(a{zA6o+NkPDe oׅSMIT+[.lD՘AF? YYm#gtG+:l'e:sԀ6uɌlxO,KnB'\k&dȘ=do3Wn:"ѝ ,h邫sOV6D~RW=z%O@d6h:ԇDj -Q3VK3X kDe'$(1x6UBLMvZ$W2KpG}u:Źɾ` h "6OF,dbBt av/׈wԴ|ɆEUC)@)QmYS(6zQ]k?AqD*vC7(T.Vo$W?1Ehɷga3`ʎ3-/]NG lDTҡtI7PTY bQb+$AqQ[=Wĵ %(eYcK.o s^̳+&~!4u{ؑn=DؚGP$QJ׹oLIwW'yIv_l q+ er.8XAhwB0nGs8Zd%CQ2ΤџJT }JrB)ʼn8L03]@%9f0I)>bbO&hYݒ=Ƅyc) ާ׈o'r`%|\q /n 1ِ"w1^H# 0{"E(l"wo/ðRjPWT?>+v$۽:CMTMʛ &ݮDUF && )۸"v0q$seQvA?G톩 Ȅ#nL˚68 }1yyk AcIMeVi E7cV:/bԇT(Sr'Đ bc.F_ UE9x֯^} 3?±^)ZGطcݞ,?]6ߥGFq[..ElhP4yO 숳-Sد7DS0˪pu =W-JjYƥB~[M@pۓARln0OBrÌ!d3+ 6:#/? jɈ o S{>F x)I]8[grϏtC;=\B!<!*ErK!Ux! ,G oI'0z6cGٜ,d&#o^:.BC<_cԜ3.R|s $"y$RDxHdcOrRЍb3ǒ )|R%GuWH8=B#q}x cB8Xz l8͙x /!H0+Lŷ"<+Iwin5%p] `87%BsNy^9|e9^6V&; :k.uGS}k+9|6ǔ]j$LRwx^dQpT 7"]L+npYMË LqN[ٺp?9j= QЭipvH LmJBT)e{:|ޏ=ZfԹD2Qg掽}z*cƓDEuh6 04t*1q;q`,.=ʬO: &(bȟ^aq!,þByc=ԝl+冲mʌKD4gAȔlw@GUCB(7sL&͔g!4LNwFې.UGX%s&H1=<faMgĝb̪򅥧*NrB ʾ=|ƃ߬sOeڒn|Xf3N.hRx5T4)󁭌p19 '? =)P{>{t0pdI\$̈́4 kbÏ͍"MKagdڕxI5fŶwT\-bdŝÙ%T\}De-Hul$!7욊xMVLWjV,dSu'}VW{)i4 yGnrGQiOXs@ ZL[*$2BLLTucO>K!]x^գNX. wsۥn>coD8k,ݘ~3Ѝ㪜Cic!tYrZ_JI{\Z?Ej!jn63E޶4j_ ^#Y -Gi܀d4|_$)&".8rPlkI{|TLbF5yE:)-=u9?\)R:”.' 0AT:Qz.,ѳףIwh}U˴'ctfy1Bي!6t(VCXa|.w^4bb:'ep 98JOCmsض=L%<+wxlWjeh\-Ý]$Z35FB3ڞ_78qo)5ՒG!bP ^ D YIOv=2;r&D9E6lǜUEEzE*o3`+GI;;E*aXvj~qM^_FRu'.+NG",VqAAirW qqIъ6āō* ZI\ԹU8y^x#Bӿ5ڭ~^O{Z) S->̳ =O7lmGDz~E@D˶0PM҉/0%~j v4o2T,Ak0k{-!1@)6ѹm,@?^PB6W=b@]:ܖƕrZbI{nl)zW&4y'H]lRjwUE; h͝2ic/aguDÆ.jܓ43dQ:4DmGk 5S{6oK]CKZ(d'6^ *ʑK8%x zit5y1c%,FTEDU2@- \t al3|H427ED)fi Ƙ΍d M]KLmBXy8ҨEiaDT#ٯFXٹF Xqeҋf b,>WG U}o0\7g#WxP YljI=7%rxpGٻBq}၍{Z4[ ?]Ʒ q;De.{ Rvf'AǞ~Z){vfŸS $GHPTzC?<1s;YYNf϶*ޤ#_b%#&Ӥqn h+Gfv+GVX# O_>#7q "M_xrȕZyҊ@DΣWZpVӔ$96NjWgs%vY,1ԨR)$uKS:B =y;'̀q/ަD쯳C% \"f4q*{FHtKw~_zZst ziI u)Z̑W#s&j=ËZ@giʖQM3U#J1ҴR$4}@8CK0~a5SUck-7"=BNv[Gy,Z2%ҏBP-{7:)0.]8P^TPwkQMKm, kbe*3DiS"_ n:{'n 3vTZ𝌌ۼ2x/'@mך0![FuL害q2tbyA .io5cԀUj*ҥyvùmp'_5dgt ^dKJr8\K~8yJ4kU,aa߽99^³-(e;k(۠,ͦ/cϤ$qz^X79#^WD ߨ'؛TJ{? w/"E ʄBMXɢ%U;_F }$ltEǶlY ![2j-prk;'{]TKQx#f5a*޶S:w73MI^">9g. mw#Hkf7V!YTטʒ=$BnclȳW):´[OxiI*GS9,=O25YA1hHJ }4YWdt? C~K' Wh<"d8_#a~<ؒZAĕfca0r <{uKz«[{`(J2_#Ip /Yڿ6_qjr'B z?^qL@r"Ń̦g_j #L@勺* JziO^%-YI$5/ŸEVB/ӭC>_ `pZ3XgspUƪ|V绑8u@-!+У>S[b]^d +o4E"-kL#3N,NcLįqu?+ؼksn(ܦa{}4C JSlUHL!C~Zr3"t&ݩKȍE.:ttl ׯ ( 5tv_0v("im!%m[Sx&$YsOG2/[eL۾QsQ٫ѬF[6, j(uO$Ӄ;CN9ib,A*6(=_:2Bw%?uT$mlR̀骝8 }L*߽͐3~XOI"=̪C#=Mߘ ͺ' Vߛbh3 PC+X 1BxZإ]N?iJE%spE׍kFǻ5O\ g:> Rim?7=fL\1_"]uVrBM3h_0(f;/+]&~*Q=L_BO\ú{h>ݬ`I001OJrϓɒ)w}|9L!NK,,gRH!(!.;mmD[ڈRSMq}NڸN{~o^ %X̮0"wG +ZFU$!0,Mt$K XxnIh#V Y72DJAc f*J*Ik;B1|M:vnRRPŕHO[saɋ51!1,c|& Go'D!g& TON/%\7{UO'q  Qڱ{cӏgSm_&+ e:%&'D;BQ1FĊ]&fwkO^&֖ K7k/nӿ`&~4 gӕr{$lZAPя~Z}HƽDu'j:0 QyO`ڙ|U [@pkvG:ɜؠvΨ ,;sd}|p-1 yEKH=QxXX|$bm@t'c'KQ谬ٚԷ\c^ ^ڧol ,=^t~)U^}L[&Pwk\d m]6{=P?aZG[Ddyveq9tyR[?YCˉe46ը-BuNM&:GJY ɠ _20)Ucvο6fI- wN?_ܳtlÔpO|6_x`8@?D յdfƳ'[)OHcL# 1;d<X dKƎ⽸+N PE09L:2+ҒP5ʡT-)[Zu>1omFXζŸ'F%EϽfwd7ϩ/׷S&YW+k(/J|Mԥ֓$ nbBy:I׽vNOiP3,ק# EzE#0h)z*&o7}* ^AaaiWI]`f9Vm߉~L}򒥝Yɟ U X*qG:%w,Xnb>^W!˞K!@fƬ} P診3ba:LS:HB^ S(?Jt4Bv{ڣl݌q-Z[굠U}fBh14E h*Q]3j8>se, >d\,z6Wi[T#omm{ ; mHQ_U e#,jbc=Uj8fa,j0;ʒ#,7% H ޢnr4F4됞fcOs y1o-련%TJM1>_J{ W$YkGЏ(šGgcВ )4^o^+R*RKNϜjx';L76i~SEVX_}&XՄ/^3/cenj>|Tv0uρvp$% {A?S :,k LnOAMY "d.ޓ(j(|M@v>֟D}I\z >2*BNHN,sI9:/HIۧ]A ^bY(ȷs`p'rW '(F\ZHgz!? GyAklgR ষ ˉS;уIZ_}|pf0rymD|l:ޅ>eE=a0o*h Wc&">jG?^u#kf(}=HY8idq.sh>! ywO2ݗD$ Ὦjh*Pٕ x\@ R2pCEXG,l}I1 >vmɽYKtbp$?Xd82~ۺ^:)&Q[kV߯* !?z֮ |xaSX!3D0ZTdwzd׶CL؛"D&C4Kw&tA| ueO/L4i^ 9]:3 KFp˖Ӥ`伉>e1MS *G^WBdy-Y`8F:#7ocpqE3]vfD-pp %t_[v.'>M U B:xMqZDvR2HbA̭(ŧ-޹}dAΟ,.|by6$/Y~!x o|_(| R feekV[}i)b1'WKϿ:Pli7|H͹߽H2*\X,n\:] cq0k*;@uBVJ2c!=:DҘrT|7;0 uV䟬|䄔yD(1A2 x V!+OY |Ou6r‘+}'b[׵BIn( S lHYX1,v=.u;lC'P`6px,T,f ^#gVb@z+fJε'!aRZ8 Q|@x?$($\8!a+̲C~-ΰ_j..l}0|zy5d,*jW ՘tP$5y`hgaT!{1#7Nvcc(Z LcVziס5.wutbR^hQTi#|Y#L5.E`cJZSzc jvZg}gޫfk:ሑ!5%R:v2@%)h?= {?>x1dY~ȅ&8hK`lj9_OJXˮ!mbx1p#B87(Ѳ>#Njѷ)!C>FzEǣ8B El 'F]FC2@9eJ#b>B˄/cj׀Y/΁eAߡ=,*R)K3h2 _'[@ SD g(r0CGylJZÊ3&O`y ͆ߘOk'+b91r=o1< B53/*V &."3WOrD3B,aol-byҭCr>96#vwl{N;? pwwg-u| @gTvm&S4w?)[yo1$U.nG~rj#|z@ LpS7;6AW`tj UmS {pXd$!,AQbC4*{b) ⹞p_J W7Ucz( cKw &Âr`njOi;߹EW*Vb51fo!&JWS\)I(tʖkB:fƻ oQ@Xg f wrNwpT|ʛ7 \r>r;[e~ {zE2htIC;|"RU~.O9]eY8ehc7ݔ;gI霄~mBޤD;U|.96)cY6 c!Ǫ{Ea2o:Nfb׼2:ķ?iOf;e.Yge\UZ0UI{-%XM]Ywc׳ uWDD/cY.A"L6Web'юy_Fc}UU^֏GX{UӁFyTf6`=Be$!eD_\OG(ϽV YIROEρi31)JG5hCZHv9sX2N zMXtc2q cxM(ȼV@+L.@Q+?`a,=bo#( o<^rrKbfZ\f-(%qrb5spe[H,f,q.Sݢ`Nh<%{sԬཙ0^ԅ]gc6Lc*fAq9%'q+_ڴ!.sT w2ˀ(গ"*wP/yqwDiJ{蛧WJRz`+{z.2jݖq>k1(%!]t{op1WvJ|ORTGR%rH"weh]7V'iҌa@mX;~ubO<)TU~B0[)4>&bH>"O9ggȒ 5k ^7TfwǗM9K]VXqxOC4Jo wZrwq D3uCW^;#_t0PWlmU?&cS" ejV> ckGu<`S)ZG !:Bf.ڔVXTk!Ɛ6=7Wj>Y̖A)lU<T^-#JI.Ѷqaiˋ6|5Wg"7q/,}@\d`ź l^)s8rk\M٬'>WhCj:U{H=1@g|'4}p DfcבdžܣZ=NS_; xsJa!BH`>I?&GKeփic:k]@8璴asK r n1OŻZy)XzVsfCG&}xzU. pyy c״N 7Z>QJgZ 9>&OݸVY$MjWUNp\఼lU9w!SF//5(mYoj_QQm!iƊnǝdoV}]${2bC@K7/ +yD$IUKbC 2mwSL΢$oF|7].al]6V (>,L mycƃ'ODgZsUɘ⋖3[%_+a?=g?u}T1}k8eux)27Tu'z_S]  ٛ!.SX.tclC@c2 }d}󺁎Ϝ7 W3'o$^:z ?+cUCrמuz+je=w'YʔAk,wCnJohsmD9` ->?Jc[us>$- ⽯&~v_2~#@d]oCŷ!۹QNátT2~С֫d_?ESpQ;) ܫ+q:׮zq!/u#"p=#̓ͻbo1MTԃJMcztjǘ ׀fvėaif@6'jF}O]z-fR];N%cV%l;q&ZY`c.HŦaƖ$  bݜ22cMKOPͯ &*P,7!Z ^S6`DSrd<{i%|oE8hV"ޱ&*)b-uذ~b6/ qb-Fw UPSBJ_{&eLD2xaz! NE#7+gm]`! \cAuy`a%Y_0p{WVEDM/'[s@Qіv 1 Mݧ]/u$&:qGpLp N OXqz"zq|H?ľn57^ϋ3V2=ZzW= ח2V1{m.b@̗èdn=8+*zJ`8u'i Uszs4TQ,l:鑴0HYd^|$*FG.*.`C tf`\]?MOuʴ,he=Nt,k}nr_.޸Dg\É>)/MY8sq"C4oiGp*<~qF `0Du##*B/4ޤ:"q*&N!zM"&Z}q(P ?0kp!gs(X+2HHZ`!Ӡsޛ]m)9.}B#PAH"pm"k]fOZ:F܎5RL?w/R$t@M oU2(r9Jv9\nb9kAJڗ_78{}ۚ&Nu@yop΄Fdcm(u!ά$&' %X)MswEas 3)w;{%Z)%\īt6b{B.`@iuύ w.83dӇZ\[Sl'ٹ{-ATM{ޮ'hzY0mH='~ʗd"Y;c!((ajz&7m %@cCzXi\"fJb4[7(>F֣y}66d艗 R:8Ed`ReH*CǒM16[1@'Hc|Ą#k9*H8LJt;@ %:]iWoL[nm;N;Ax»|  T|W$GV) Ϡ\}:JT;s$'͂35Ol+ݫɛ=]kiX?&RkJ3sWbn&re1Vdq@R]|<+o"G(S C}G JNp^5\#$DsN5 "o3K >%b(],€[Z-YoíoGll"/ą.bK?^pC3Sh~_ۊGhl׮_ƔA+߀ sӽ7;{ps cT3NE> G3{kƤz mt)m|pwRab"g@4lO<*{x˒\n|i\[DB=L摇L@pamمb elW~x}5 ߳ R5CG]CP=ԎB]-3IF(eln&35?U6+}"DsUj J$.iRHn Yy:kt3d;}IrhJ28ʼ0s .tyhKC{Ԕ#kT+XbI0]ǣ!N;!Fƒh-8L>Wz2e ;&ҩ Na⸖a]븶FSY!coу TUik"o+mvl}P@|4O4hPr ~O5%7R&֡Rzwe.]2:K%J +8 (WU7z_7 ?,,x>]#k/CV:3!xإ"ϕ RF}e3,W˲@)%ZFkK]]MӌCZ+ta}Z W%ɖ&닙6 K&:lrc;e0%% k2Jc WwNT-"(CP^Q}`]؂4)Æe$V*/\e@"xZQrtoD51v0bR췺 +Q:_9,'Ƶsb|f:;)c|L.t/B8`f LfA,p~Ӌإp/G7h[+QI]#">E@>N8)Ko֡>zj#˰뎳ԗxW&<:7|JAOpg*Gw/h]Z|ɬ HHwz7j9MmOR`ݱ(#*,zG3Yk ǐd/d!h(;QUlyY (YTؓ18`^DOO}SYq#zрVe>σf N0U셭 &1Y:))Yb9w8y}$MT掳?Jm1v#;,?'٫<$:D {z$ͤO:YJWRڈޅ <6P4ܳE=9QzcRu9rb]c=? ~&XObMnB=dA}Z;.Aw=ũ$-e$"7eV8!b0`e[@^jx"@m>EvlAN e$=w2?ɾ@,loĒyCviX?i|:H y nϨm/?9rFKX3qMh-"`4`m478n8wIغQ6DD\PQ@ȿ12DE@J^KW/ @DgWdPd ˪Ei>6|):)][A8,0k~UC0ӻ2l0үHgYI~@ޞLvJ6*L'}hjvt1tbڐӒGeU'ʖ cl{6`W%mB*'r{mXʫ /m:y58FXns`ZQYC,VbϚrfɢmq+QKU<} ɚysۏU;瘧BVLh>jYRMG%8FdT6;.N0-_@Ğ3? vP@15!q:CܵB=>L!sgpOy! &:k^<]8.v=' =LaMǻT>))P9HcG/{'˃ϱ@doM\Ɗs:3ʾ-Sm  ,. F~=> _r9݆%^c[SjN9{Vi1SB2Fpzs~KκM' 䄑" csT3p[sNhdF3b ߫5} T$ܦ3_}<`A L땕aWQ/Nj?{wx5IlｒoF}&.xJ[UA+i2W'g HigHe/jСd]#9G5˼ʖV!b9o|KGZ=+Ȼ0$j `*;[^2yl>պ4 1/E2W&VQq|kFbcDz;" tʗV~!_βO}1y\&2e]\@r0rqMw,[27=yI%Uɲ4sybe K j[Jhn$˧ONoa!'b΅%ܻ.vldW0@PTRꑩZw̧ p$ ?Q_Z'Ik M| 9ع7yR!~YѾ9u[2 <$Iyk簩(?>)`%|]>>n"kVܒ9$F ^~ml\w_f)/Ksھ/^TXn{^;' )n:ːލT:Ӕ{";>?9v)Xzmv3&:~8N–D#MB`IV1Mk}/ٟdVRdeތS##1,pn=[GYNf;rVpO.?A:3NL =DP}05Қ &nn'P&SyףQwMv];M^wrݔSAbuNHӇ](y\ 5/~X)~s{G/{R -m=%zT񵅽eF@EoP{-P9mTcJ߃lSh5Sd!FCY:ϩe5(B1*vK{7j!nҠD̥LiZa3?Svߏh69߃I.v⃬sh23A%;m6:Dbn5`!a])Uö+殆m X3`,m3+~ _&!] 9wUmS Qkx*uy&@lyveXd "u`鬬@nBĞGm?)lAi26ďʁ=$mi\w!0O $0К4N?k dsE~4kSTad pT_+DD7i /™_S =ֻ^~GK3T6i@ǡhle{c@,EEPPZs#aUM!,79(]_ܓcԕθA4ǵ;䱫,'lNY0?5_}n[UEtש&R-1"OPJxV=^/gҙ~"PpVBǢFR/BiY= (LF08p^g/TRКuiSRX?oG̴ "d=9XJ }FZ~ě3h'V ,|L2ZiQl@F eW& nF$>t*j {,)ed)lNr8'A2q@4rR $zs/uuw lgfYbzX/+ f;B(PR #cGr-PK8Gx3cZzpSn?u6).^뎍Ul&ET"u71ոg$@b4宩 zFO^'Ş5ZbN5ԓ#Iw/fDR9\ ?xS 3.yd@Y$#n;,:v&0OfOHrEfki,o_J"!ZxmMhO:ek,kbFʇPJ?<;fC.zo`jd>QaXͨ@-huU<} h}|2tE› rRmS4By8IlDZ1]XzdY^SMqT}ГKZ?BDZ}ؑF&FImʨ@ [yP ${4j`ğQ+{'&{:! _0aIY 'x\ngX()uJAq熔Sa::!ALKMQKc (Oȉ0)-!g5+9/ KG!WSn/g9Tל8L`2qhuKǁ4$Mffn Sh >U!vVr*;z4pbvzS3$C؝Ɋ2R#lvQRM"t:VmwhhR&(ipV:kfR Zlܱ}wLȥ1TUe q$ܦH95ixmΈvsg韇{jl)bc잖h͆ lE&אA~BrV>mfvU>ۈyHfarܺq8ɀ6?OXK+IJVf@@bH [Aǥ1L_dF3$kmǽ%*~1q𮌳 }QOt1?EnL_ @G'q(ٜ#rԯ8]#OSomաj$*v#YVqۜ vV䷜mpSzN6%s/͞O:A/$[RbW2$acu#T[*DĦ2z2@?IbxD$kF]Qz]zX= " Ij a`l8AoBoߣְ ǬR!nʈRτCk 5=\yL 0R.)zD6Tٕ[Y Pw].4u~8nY]a-Qegl9"ZRr uќfQJ ~O7Sm&ԡg)|EUf*boM4SY ҇^MIoN*|R"ieI$"B]o"DF7 ̤]ha|k ٶz23#cle}o:@|,;jͭCs& jQĝ'sxZanG7kY5CZAwת6$'.5_v?To=B6Q/;SIjp2AEן6I*G× !ZsL:ڿYnݐg-Ϋx'?u=K]Qi΄@4"j~HX^5obөs 9Î8Q819Ip0yJs<= /@\F[sш$ pxzKb'S|`%]#Q2 ס!` ߮e+(Io9;dp{وKLUȨ-R} ^! x=Y26^O u㒹{~<ߗxbBPyR QxoQI$Yn% U^+[^{ɠ|TLb}:1{x/2O/#!o|f,=^j/8WlFe|}K6Qs;-hCTP۝ZSU6CQ-)\eRo(C8 6V?Iة4 {ֲ e"N*& {i l;J 4ik=ӥ_J׬ "0n-\F vJZ\b % 7@LwRe[fQ!>SWex<4þfE3ҌACU]̇XP5|Gްa0mr_5TVtR#\S-twȃS[ 5NsۑG9ckkR.of6hVw6t"I'y1{s.-^Fm'[f&|XDr!ۧ0ˆbǤWAMv 8==WMLF!4J%J_@0qߦ߃Do[ Y#_A P 'Fr(Ps-:#vocՃԵox#-?ƭ>(Txǎ6ZGRaz *PDž ,ŠVB&įd(yg] fZ@""պd$/!lY\w._Q#̜:X{@XʓO_4%NZ5F?NDfhs w5vc|¾ 'M#eRIE-~B^(r^#ą'>_e0^*5p4}CUJiUHR.JIxb5MU=pVw:HV}[٠7gD9CQN,T17"G}Wk+ʴfӼώʾdrQSzu"W(+08o lL ju*Fŕ:"nHn`]u,uz7H3p@rܓ@=HM+gC=wDb`B.1+g.|K9C,Zow7{Zvm]k[~+ZUaD+ܫW_3`dBe5<i2m#TP<ɺik3^D@H QqFTۂz7˓[k czKŠ#Fʋwqqq lK;L:ӂxe\; i ANFO=)|7Ǭᴑ ߻Pri-i >NL` EJZ5e& ,V|JDkOdU:9MD;4x_6Ūv pE @=j@ E+^>بta5!#ߴ)x0/[]rWQwY[ h@Q Щ)'jfHl8+FY_||~hG1xtnBȌF E0H23x4,o#lQCh[i-UpusE+wH"Jjp٢a'E߃()/)!L8,蚂Wőʔ|i 嘓7բCDY%@.|A 9Dl?y6{$594Um2v%OIFU;zҳxrfw5xqR3-i6NҋȂn؉}!K-_ ^mp^l=>4c[$C*Or!?iFݛ)blgKbE@@գ@P“)Vs$XM&4ȕ 08!cλr/CYekF5 -_"K22mMPXφitLĽn@ >ze!^ki؊b=?9)KRG;kݣ[Rӳ <["y?vB\VK Ծim >p>\(N+. zؔ:$a,$gvy|J eNUOÓ>J: .6bZR.kt21>4J̷DeƛiЕuJ,$U 4:\6\lNn/c9B1ű]U< [Pu]"0_ZE-?^>SFP+4=e9T>|\kq1 U/ˢ6Φ: >!5ŦS;!əTC<˞&5Q꿃vV U꺃 Q.# {rQzB]B`-U3z2 l+x W;>ޅ}Te@P :2z(KeU?enQnN.?FJ)S* 8Y <ܤVϞ6BY j+1Ij*r(dtL >Q@tȅaő #D:^DL$b*Gf|V򢹱qswe*}| Oneߪ^kZm932lw郡BBQ=~5[aX}dB{7 UA,d8],-&M(*KRfWfuHKP+ .FYhFcҊ-/;s И%e|P! I2_=M 5DǍFhy7h@xRR#/w#,:pG_&JmZptխs'jN҄&8!nag;/p6)6&(e5u@yr 4އPMIa|2*^Gs㾾zDcm%蕢RgQ'Ƃ5x /~lև#5AmLqaUcK7σɁ*u~lrHC 8yҍ cm YB*Bs@b,h`;`az]&|H< 4ɽ\ć8ob>7ӕhۂ>iT%\߻1avt\G7=rlO(j76)w w(h'͈Z /]4RPZ?#XVfm(%JEc|7^QxaJ$k;b?mGNNsOx/D' WIh`Š ykMw9Fp,O [O2B BZm[}1TK h-wzW`=pB9%Ӷ@JUOSIgO &XeA$EP{>7,@nW +&H lapw9``9\Ma4+ҷZRN{ # 06s=_o7ВEԆ--IHAag㌄47]SҐ1QdL6cK;D^±oڒ51$tqӦݙ%=)|)h?ﰒ1[#Vo}{h")6-A ~}J#KJsbiITyĞ"wiA?$J$ QWd挅NOUCmX-QC\A6d *_)@00Àm(>#6رWq;lc{{i#une"A+`X.aLL:tKTp9b7W~'+^kG$~N:s['\M7v1q/Ҁ!?Hl|jGmO3Lf$USH:܋/d)!~`Ts6ZTN`ŦG#2A] ЫewxnOO̶-\r֘4Jڕ 4W޽>ɯA{OĎ:Ӆ;T2K 3pU19sDNTq]ֶ1GAnA'FW6zd+*-ps7-v^`-QjFnNKŅ|wK6c$Qd%]|/'YT{oZEW,vqއ~Y/ĥQ`(GoHB Џ@TI@vmcoo$Awyv/2Z3)ݘ|gmX86hڎF q4@c=7˝>rqiMS{)I tX]lp!FEA醪.5'vcmxJ9d:fC$\r0!Š+Ǫ/B*׎BOX>w?EJ Oْ=}KP}7l6$QVX8钆V0~:z>[.cf߽+NÊ$FrTx L]͌ ]ۆ(|դ7WPk߳\W;{ *u*z6\K4hCd׭jQR^zSPI/THv8q'qm3" DC8PvT!$s O'r=KdG?I" Ju }{<{̚ӭ:nͺ3wO0yY݂{) UR,lǜ\Q є*&5M?7ׇ~W}ivkU3d2Fi+9E=p}TܔuYƆf~CKT:Viڥ-5u3wWRL^-gG4[MYdQ&&yۈ7MSu;!ُl#,%nF4mL[Hxhe>Nʦ$swO IÊض8d!vh(ݑrźkifiQoaHCDqAl" īIR%߷T?.`*qX}_-,eȹ46ŔI_/Հ=vbt41|/J&gۯrۮ7rH +(I䐔E]ElVYlf-WGg+hka'>{i.L0O:$>14oA.ctΣJOkJ.T033]*@),s5:KRk3`2ZtR/󺢱lWl4~{\)=CȵN<@CU[QJ"ay:KkakaI.C&G, GL͓ ,㫳Nr5ucν7%rql N5cn1YOne9azE4^bb <"H8_@&M*SegnY/rE#F3X)pd?Ur { /t9H0vjfkmӐ(|Ad&VҴH3@G4x>q%!K4{lÆ͹AEruA[(=QRP. &nˀiEd&P)? ߌc]kb(HJL*ħޝD7 KvpJV}2Y>cFc|#kmXsJF[~ȬD1?3>˧_]\Yn8=+M.aNkP1/{=chꅚ` ]Q2{vh6)yCQFUj6ƷZ;2U.ELEݎkf\g?1kM*}(8,.3)'*BmV`EWvZ@c.6iɶ)=$qy*3߇T-f %r-}{m6Gn:yuNOy Cr"ؤs|jwF ѭ+ܽJsl<=-+R1F R%eo3KOUe P?YDzH[5`=u4A:ffXN7]w9<@2R_^6´MOzgLŻ~eJ:'l3.,J@)Ol -m.1CV=0t\N Qռz'0 ?MgW Wi-b';Y%RlZ#sU 0ǔ&rf!C+Ko/ĞVe2#^::6oYrQN)fb9u(w/VFjep[lhZ [xxbxOW$(<)ש~o#S2- U g><.6$R>T`c%jpJh`XLiuok?M,KCc7^wݦA-3ac{fSc`f%/4ˀ^- R*x0 $:fgtc,NWeN}NEItX~r0y5,ɓ/.~Nv$!'Eihr=a0²a7uB̀`]BIRO= hlQtr:p`P~Ds]:I#~%91묾짤2&PT&pG&*{VZ--<=.b1M⧐ekCWܝ\uY5S~,'~hi8#W(@G'JN davRWyHkI~[ძݓq9'ԅG|R؃xЇ0Y),FAp1#Ym9%ĬbX0{3C8B.M;U]gO2|Fo3cIV#8E M?ԥ K߂&5)}Tf Jkuܱ^Έ}'vw_bi"=[eJp!v"kYiIrPNn`[(->SJ$j kZ ʻLA<Lg QIz@o8?Az}?6mmB)TK#@w6_k;]!ZC9~+uH4iyB&ҍ .*QHtGZ2D ҾJ ɂf+x2 +htGR!̡t;PdiAoMBI S(}+-:5鋬BqqS)$Tl d",n\Qv#sӐ2Hc)ަHw|dI3h8ld'2eB QJzԭЈK0Qgj:]oǶa-h5;k{?lؖTIIQ:62Z[$yNG sN~ ect_3sgVZJXZD-F:b>NrCt#4aVK+/ : ϶/qsA"/TFc6H/b$UMl&VyMHR **HʹDKeAH zj^cJs`!ܽE߻S_THq222 21d WYY- XklGeYs.[7*Qaƶ܈o>VVʹ6Rݧ//8`2 ߝ~KN"(>-u 3,Eʩ5VkIxOY"k"fr_0gN\}K oH!8kD5C3?e8ڛ V3Z(vj OxڊynZcKf[" X[P*԰{IWZ= 3W1{ģFPO D7X~ϋ^4X}DAЏY9>3v0JV~=OcM39')MB?ʞw4(Y'*,]0ub8_A֭#; ʦcXe 9cR$I)m5jS#Y2WM4"AF/7#Qi oL#;[vz&yź-IXkKkC 4r%7Jn(}:cz1 Fn0(=O-mhѡT P#}BzIȈ1fQ?,bP5#u-_"h o0Rߧ5sT-PM'{\QQ4b AI( + )KFܭ,e"M>kf6 l\Y7s.<%ƀzEbZ5M=m#a_ |bMS]AvmRP&''OS1Z BbU }ym]lfH#=H/УiV#eA7,c3]-;uaV~J_/;]0+_P ۜ76 GxE݇K#v>9Iu'_L?[W/ӡG9xHdƇ |rÒ"z~p \ۄ-[%Ǐ^6<̋n%%nVTc\#x&:`Qj'an7Э2bxKu[$c%;h%3Lj7kq_뜬 6fԒ!Ľᓫ^L_>)Ȅ`+(@٣ !+CoJSf̤PCv_jj1^ ede4f֩z48RസpxsxttR[Y/ΓA -N].}JEj456ѯኯP!uWn/zZ sah':]}C'z)N R_+Yh&S[o {9(:nEGK2ZN@q93(U]RD) p"n0^.8Ԥn'_;3fK8D%xfȠ;8ǫ$(M.Rjwa 譲4wW\?xH 8sq78u (f\h[2[wp>Js;7?a*7m3`(1#Nq8C``6 @MfGw"Ɓt%2ݔ]4/>ƃ?gIs|o^"&{9U%%t}8'-CbN |iYD~ВH[p@!B!ј>c؄N=|,!x-T7fe.cp(^ZԂukᣊn^8Uo*AZ E_ ee/3VDxj |L<%1>uL}z&uVLtHWQ̓8*7. ;1vn/h*Vs׋ T/ya(1tM+@r:J3: ZvX_/RE }lXf>ȃ24,?Yig@hv.΅[*8{lYYaUB?[=ӵ>.Td0v3NdL +FAJU NCI' e]|Iӛ7`ri ?'öq~q!)Emk m9ʝHVh#,"WB(jkҹ.GUPI~BT7`& ]nvM]j*N2|)X^3A,{"zWӅZ9DYуeOKjёs-z|jhF{E*?wЇ>1K=WB6kJ([wKIug{mL u:2m9%{{~k:A%{nCk_ :U?ijo=Ru)R?K퓰< ,ϭvN wZ P!BMп1K hX 툄p/=<&6Wťձ%k}6<!={5t)yFS">#| ]:k#l/9#[#ogcnFeE66+}RA1&-l}қ ҷpBCx\6$6 E[ϭz'vqrɾPOBRZYCuSl^M[FSLfsQ~!t[R(7,E nD`(qH)ςץ v!{_6cixJPtu,EHu!`U q"D?R$9ɎN|F)#`oz^{ z]?ljFztFƥ"JЫ'?+dػL/Ffr2tF]ԕM&#I,*)yAx{:Yv,ۙ#?>xB`Ӥb늖i7N jR -$>̙4!fYžL98n+B xzY`O_Xzu= 5CP?H1BCw[&  "t;oTFEH[qn.D2Rb2CBh ‘f=)'GUa#`0֦ c87aﯯ _Uz4XsN:/g`ccD0FnAӰ?Xi|T7u,wjtX m$p;k!59q&6FV62 ZK*E7"Oy T4͂ct Q7MAK SzԖM}[AxV[n* -4Z$5@5/~w.d4ȶOpGsSCܦS jL)?<&m_qF}LL>drM63链OЉ([ɐ^7NGi#*cX޸zԖ7}!T_jZ3?tKcV0ٷ{#dLGי<>9v15 ɾwBȴJ$czw2nR]E%RI ݒUWI^ G866@}h~"dϛ[~D'N:PzHU)U@4S(4;1wlJk1IthF>ՉxXV1ͽM5-gƠ=7!wP pF6>R; #%ԛwR6kbnm3:~v)?"? ;!Cy޵V|12ju/wMHZ_Ig@<)mA<Mvl}z앺z@ d[TGOHj'~/c<#)2˞D_7x֌,=#n6V-=H0兙m!Up3?:v?sJնUD ӪgB+Is@/G]Fa`A|rFDRĚi[`uEwP Ȕ=5d e$ᾴBf)}#k=b@z?׌\7|=7lL,,K`@OjML#K}i //|[} yրVPD4IE0/dCoԲY9ow0K>uW]E C9Q[y}˻ (xnWAQJb-\ J9E+?9wtf-!$- Sy55d hTIoP3]|!4 kqjG%*=ÿQo4o\~MkWgQ` AHѵdg3T}aJ`ݫ a ӊn^uBi3K\?h|KRXpx|: ]CT ò=E0 >Zw9yQ9ugwi_Nִ}Ko{Mg֠mB]"_ERCa!Zԝ7raJQײQx@<n<n}3^vovgjC EC# жfO'XD~@)p+gq$nX6PKݚ0)jjYLj3Կ^Yh+k?}K P39׭& !S:HGsC'aPZ3x7rC`i+ E`B-n듈Jϰ@[7yFG1Y2~ȼmu1`EEWXã)F ӗwc*>{"q Wl?&$:$4ts(ygt1aC+j&%![W?꟯{ڶxd_9n1Q#XCdǐWwYѢ[TeE!F {jTՇWጶm @d+0?w"i9wrk |X*Ao=8…4(H.>5@{5-Eϳþ-i f[WRX#PB*V|vb Y,3xC!傌υ$:=q~wl-Pzl7Ӟ2! g6 ƺE\ n,v[Ǻ6ee {gc@r~ Oi7>WiP~]1K"5%=VuX Lr P/e'S d5Shlu3?yrR"5aTm儞vN]APW[FNnIUg 6hΑ}=Y2[%KU8=oA{hgoS8VbVGv /&:Kקu3ִ hN?CxN(/{hMJ Z^3< TV"Hz^)P̻MS˒Zன7\cn(bωir0ELᒡ ӧ>zYDEf@f a.Z{Ayʏ{e(uvDs}xpŁDFi2 JO Zbh.t3td2 nN_6;Py*cszɶ -62?.Z˹cO20.C6yί|8Ii. LzPHz8CL'?yTw+ 6lsKlѓբ8P3ڼtr8vމ)\>  󋄺jz,-zݕC^PI߻'zӳj- Hb3Cj[^[,qFdq[k^wYS,Q+5 k*pw,=!p?}v'Jn)<Փqx f>pIm_>|HG.1 +l %ZD'}3u5*<D kՁmk'eOBgGޗ-~]ظeJ-X5\ D1hQNSf4.mDž@,$lPP{ÀcV8h\a15;w&mb85*e;Pycfu3CBSa(׽,I@ دZ.SigkUiU7ךU#ftCmK2A]@GS:r\7K'oo4re%6rk_@aG=F]1Qy.֨(  ᱔ ~4}RI* K HgiG2)ʓvv t|&'4XRՆ8ō=:,;p7ÞQ8g^W+jbk  `JOz:&%NQ+=s%j!ɦbTŨ(wB*)3&{2n^´֯J5WFlW0U^=YG)~84ʞ6b냛v2duJ y?\R # ( }Z/ӄwZĭ^RY?i*^̨JR]pj )X ~ Kfw1-Ryi!(%{㎨7(̳P-??513Z&'eP<E{F8qKܔ~ 3io~}Kx:" X{O`\7 > 449 L*=F,^1h#32MEf&\4r7%7}mւx.ӡGW>fx $DfΙ]w#lz4Xn)1R#ytzUZH )S*HfE%HԄڮd7_R˪5KfټjzsLu4SLނ΅'(fS_]c@ǵR@!:!Om;-y߬Gs8B}4KĒq鞍"XbܜtĘ:[m!Ĺs!CyֈEltMmlIAi+_uU]L_ D쾅nCJ#W*;|: zOX.;E(L"D^/u'~өk-P!=S X 0 W}1Y./e{V1 do>}go6X_ȴS*(4`].GHPuU\3vpg>n5n4ĺiLqذxI A:[; 혀F! l#n\Վe1#L[ZjD7N:' /M-u94AuŬe;oҢ_d‚Y7I9S+V׫֊5|MG{[oGB{sus_֜:kw ߄}F5_`6!'`k f瀑=oc Zi|Ob{6nUlEO=E[yÄF4|׭_ːn {HCaI4 wԑY̋7OpD3d/;m6#YJ]ܳ9+ v(3NiϒgY9kcU|f-JH%h4uI#pYM8< =`b׀sw^ƒKPGfldW͆ut, nK߉z%|Ǧ NpAwΦ} z0qQޓ֚.ߛ~5z?Δ_e;xytW>.oW3sM{ۯ*Q`u&%FCVH!L]r) rm}\h`Ldc@G.L !1x1PI$mrMʬ(@O (3H` j x;f!2AqAg=-;^BkQWd9}74D50 Mnm#vd55l]@.a-hɞ18qE mT(bM\ssHQ!\ݤ "ĩzՙٗ(^!Rm0^Q0 'İ85rfHId|O+NygjHȁb|=m‘`ۈ8}dzp e쟺wXp,"/KVfB㆟_u&ǟO BUDDP-WE~76TUo?T5 9dud*0d/׋cy`8=-Bε}Mڎ[idv)tZQm檌)IK=exJ`aT[`8m6M8{pT#⒗.kE3%PK(uiuso}"C3x 8a%p5ل,4[EXVfN7t93BnoIʪ*#;UKxIVa{k Ah * e X8}ViWw`<'QFkKARhkA.+{Kb/p4 G?5*c̉%2^dyQ gVnk.S.FRހ{{ff *IhgR^%.j>ݟ\ͻPF*}6 -U||mܚRVkؾ]HuJkx}H"|m4AhZ{lLR?p$t4t+*IO*@ *BŠ95G" 6fAe$HTA/w +r!Ivc^އwd&>Ҭ8gь) jsC%_ݒLw<w_CWH $4Ss.sk!G'WQ’ +]ήKj]JDR^8B$gWȟEGRi#ܢPծioWaY%ӣE#SC$  >Ol kSJՅt1jdKdw:zˡHx)n3ߩ@NQGlMvb:CQ*\yI$KRYL5Z@X! .unaZ6^i此y蹐>u~S|Qw~E:3>8f}#;Nm꼳Sf&:T 3]V_f,gة0@覍Bp>{E4 ϕq۔(>Ȇu̒ܩ=ӆڌIZS%x‹99Nx^kOVҍ<3PprW%)mn#ە})*WQ|Uߞj82_ϨC~榈͋`80š~1H!r]6D1-}&Wz!~quV Qo ;kOJ28grK˺^acx4Jz[׫WZf8VqXP"ܝ0#\ &;o4{hEEbzEfl;7q׀+O2@/Lß@S(ɣS4WVR!CB)o=/ޮtQr}&4o'1چ ڻ$d^\GUW{a6̄<ަǼp]H5 Ҫ6pNbu @A3KVL:.Dml.n"YtTyo{P"A*o *jd&,L9ƫ{0܇vb.z|vw#eK9,~M[`(T <}{NY1ah\wq ?~mtKN։W{ ) VtQ֩Ⱦ:s-G*Md}tmW "*.OP)ަ9e YdVI0bǬ5 9+8y-|]l!E]ˏ{;l:I9dkjɇ @DW+ &}r࣬XXD+g~.2} |)d=ߕ WZEXy7& $wp@xk*ƨ@,_0rn8:e~Q+L1KT  H RvOeg^ "v3,ܘQq@ p:=̍sThkh,WW1ōN☬( UXAdk`>)cJx8UA-?NP k#0Kc8ⶪaGQU9;1$W*ڊ}ic%&E|6x8t 9 QPܿm9z.DF`; KpBbs!戃%̝cYBO KdPZ*nꜨ<ZU} E8Cԇ_=qQR=/yNF17yUW\أq;ιtvS IZ*Cm8us)՚cl0|5܆KۧI27?~VKs~޸Z9JC"(є:Bj}{ c>V)yC.lpcvskf>4oWթtg)Q%pbUI>ۧ;H~Kw^M-u0 ]OOFoXEYVQrݒ%8Qaz-P:϶x@l3:4۶z%ѽ@2Έvl͑L&p0#sFY٭(Μ~Ox.p,,4w@b 1*$EpUmOEK%Gc`&]!$xT1r5PIܻP2#"#~[5^cNIAhPjÆkE%.B0s-Cp0)o'^=,w]>(9~(]8%֔j&PԒ7Xl`C]AX-Rf>@ !-]36VY5XaGF P#IՆIRl~ڱ4Hb W~ aHPsʏ^bF>w]2f^lx# S\4!ev+p\JTaMmg0jCŽk4\nߠ(N Ds~w̄<[;~ cۺaSr{,%u]{e|s##^wi+u2 g;^czyEU+=k>tgLM ٯO<86mFG^e/3gve`7I,)kp%I]~jqǾ횘ډdoo#4ߗWRfO)!iCO q3.7ddj Ta:;DD:41k:Z= /$bgj '`yTEu 8'`g9Hr#qi$Ő(%kBX :v<;f;BzPXpc?$nW|:fc\.;¡=¨ G6VCĝ lѽĶ/0Fq.#w]Nvv]ao($Mo&)8m[h^1oBtk^m:P5 㘣N^U>)P|rh4@0LtZ@:(,{_r?qE ڛA&Nf J>[WU@Rх a! i/fPm餽 :SυEzC&2+F?ig 2֝rvfv?'6y$ڌzHNNV3B {T\ <,hC݂'qPV\Eo1yw$yDŽcaΘFϻz?6[w 5-U0QzZv$qz/}zΐ+Hb:Us(ŤPZe mU|\t5)bTjm+KqE|99IGxntY?!_~ s+\^9͘ ~b#9LṐϖ|X23y /l=Ï!NXaՓUs~bRˆ ]}.,-o\K _$ 0FN8/6?u{zYY0G)0%$?F0Fh!:$qM-" JM= =?)s}{T|-^ #%X뚡nfw&n (2Dњe^ E3^aܛ7 N۪CK*NqMa6mdH@ϸٛLJjHO$7]j:pÇSXbg) ˦31G-q4k`LPϺN_{ ] vůz0/ :RzeC+ѧwG"p{pqf;9^F]3<$ycp,MuTg}%ګkt)BRs]VSԏD;xqM}iXo"^cñ>[m毑H*]qq٢g6ӳ۞tVwq\T?%]p;^ ;W9\v'Q}%= .{fhH kVvq]6m*[g8LP*)Au$"L0]Ŋ/C@CdN[>rÞʟ$SǓ ^NR2ᴻH ru[=3;TC>;\Iۼtr J@,@R63 ^{؀Q }CQc/N^%S$xfob$[4#06%ͩ VO#_uH,x3 q#ǛR!f[רfzP;e2_"ª;+υxe*a#˧ %O`3ݡH Иةxi >-eN0Xu%=C2l(-1k݅Ttb"meŽe[b@0yR^<)LBҼ${1vff/=8 j@WUZ4,k?czRSױXE$|@B*0?G}R8ʓc]k5x1Sʹ5I%@GqΟ- ɼnsC\u͢.rp lă4Dmh'x95OV$A%Oᑣ|Z5-|fX5ʛIq;E鷿9S( 0UpVIl  ^QP'2m!hDhaQD+"q8Ǫ**MڨOC)FtNM ‡̟izIEfR ߅m$l\(꣹C[*>P9MO:!о6Ҏ.b>pb LnS"'<-ܬxA:O*(sF-ډk3D(bBhc.@1=bL<[&0Yވ jT$ O:@pTqNM^0Orw5 71%SAf53AjZhXeGsu~5zKvLpRD0D֬ݦ!5҅2?6Y _}u$ͥC( 5'v)ƢhBoNw!BmuoA#V#rv3xs%IT{r{ 9{&I"MA{)t &MnǝiuTmi_QYYzFNw`M'|CQ^o̶]Voy2Ks+ԼdUb4T&|lޏ9%_JK訠3A&{E܉e l B/s(ƈQҵNg{oM*7Uﾰq CNd ^^1(x1 &-on H=. ܷn+Êur5?yW\TKlv/kNOuUs#'y$yēߨVu^~ݡh} v[KVS2≯,852Ţd0>zl G㕞tC<`P [cPȬEqI5sh =& *b4 tnQKcRz1v؇.WlA 8QNP۹u I$!jISbMEʏo܅8?EA:|CRgu W\G9W{5V۸T˙| {]sx47 vԌ/؟tˁj:a w[TYF` ;V%CQrI"6,@Jt0h[ 4HdPi5 H{ u*h%.Fl^%:~FwߛSF{, ,_! 3L j,8rvo@DJYjzIe[T+crYoz{t/5c#0pw? Ih/N;O./ ;`#Uh*>f3 CNzLku7#"@bpu>fA,/G̨͚YYih濨6=aWѹW *Tĥ6l6Ek;-↛g"PǝY;~5' ~y.;twtwRRk(⚬nXjHe-CNsJZCX}a 4y֦N?^om@8]A0Pvr\|ԾjmQYvExLB]D;*]68h?Ñ]DqF/)o)Nt ]6gY6Q(wӎ2":7 2BוB w0D2)t1h=>.Ͼe–\V J##kӡ |0&u B i҆~$HsʳltɳDDvڱK__48Y6zݯlwI" J}jJHWG9La`S+s:]XR[0Zjxo~V1 iļ2p(6Y~远 < >F[Mn(Š5MkJ,5y1ñ'nm*EfTU$V}DպpCZ+9ixƅ$%u }VEix\MZ3z^ 1MT? ?Gj' I XϢF'#\c: mCc18uX -=ѼMAŪ35JX}貮Fa&8$K(P7* iU4 %4#zt]B'e&B XbB)r`r.1\ό}m(P dtD'avF7Lσ?5Z~/;jhI_T86[DIӋoc^Yk "*HezFL]UP5 '5X$Ks6*>|?mkDNNЪUuAF3Tgj1{ rnGz0gZu0dݛvMƅ?%7uhLt-<=x‹Mӡg]_@lޘ,~a3 J5N Ri* "{"p:KNɬw3fDl(a@| Ir;Zi\0ZKCz:*f8hFY7cAM@ȝz/2;E*^nW-?Q:%ў 窮Ȼ7bd v8::x8!w1r }Õam/PN"] X3]]|.OޮF7(5Tdmݮ)&}uW,ɛۦYb+}C hf4gMԪ9GaT^Dy6&6Zܶ.@U[:GңE3IU k'ZN4Ml,5HRzuYNNPKi KQ{ rIa#mc5:;MaRCP?fFgU~^Y!Z.JeDӸW0Xeg#,lQ?C/7h=ScDR;h[ΝMqLGPk[P'?&\d)[`S1oPϜL8hMf7+l(5|,%Q m4~+H\o'8Be Z8Y"ϽtCÔ(a:j Ҳ9M{'XtA'H/zFXHrL-ZiRiϞbzjT8.@CTb]c[ᣁzoһN 4+tB n\?:89)`,d0X` o t"q!VTF 7 t-x KSR/)0}'5Tf'i2w2@1Qɱo Lל*toykFvUބfmܟ!!_ǚ(<]2-|5KSikCwGOQ+_zKgL<Ύ)M HTOJ&O{W)X֬&7ҾvPޛ@$TC|olaԖvHw p>%~_tf2ia23b(Uxin_D[!+^jCK/= ݚ|٥Ȣ*m$'зc9Id![ K1A[̯2&C[-X/%ߠ/6ԣxvpBDu`LksM=R},W=H>aGA͋2h@K(?`A]2ˤvOEFX7Uzú4u ig6'oMK(uM:Lփ7 @Cɓ4[ϮByO4z:qbtSʲܮ^&Bw6UŢ#9+?yI}HaFn8uf zqTHhEirck]Rf! %G^|2i7ؾ[zzHSRojZOT (2?ʻ^8="T p}eKerݐn ZLhoʙ|'<a;.E1g P5bߤ h,_ jzkC&ԜpR)+!?IκQ"Du$cWkUU٣zژ(xw`%I]LiO@p V6MB^jV<%b7ߺs0|Pd=O&^c+&}<_aBsk[QDh btsYPc$I?YȊ%!ô2м"|Tv}떟AzB4[l^bpwʮsO6l'lN7&4Ul%6v᪴}N6ۍ}~rIg,ᩥ7{"b:Mt]@4 h[dڤW_<`IRI [@wNGXH"e~āV񴐞Q&'$-/#ElZ冾y{UE]Raճ[sÔ\Lh AoA?R#fzYg|&3<4gjpSFd!liS!Ruq#PO 3ą5R9xqWʵ]d?B3϶4X7X HȰEВ&;ӊ%T;Mc a8: e`UuR.٤ˀ}E>` zۤ=PK+1%6;WAXu#^vݓ$WHuz"lk;U:<`2gԴ rhx>ZIVm Dh!:1N[{T=)$}e?f|} 7=l䑸ؿu4 br'ޠQ/)19R-{ #@5rFH)WQT24/ʦEs* +rֳ-2фW:us|T|Iw;n%ьQF.REl!\Cϻ\Nf8)/n hzưM7nod30@ǧՙmEjLL! >ݿF=EӀXwoo.y_.wTLY͡W0]#VjT- Qu[ٛ8SV9Aa9R5ȓx(huR20ܗ&:~QHM1K?G5Y A &FeS硽Ĉkd Ko\\j 8~7`Ƶ}T4j_86L6Ev]((m7zu%:0 \d 5(gIi;*˜%8H.m^rݥpP{U yFg›̑$RpԸIbf[Ysy"k1F3=ƪ!L5l;k_Ιre%p[Qf~g3잱"f3u.\hb27a\k# 6ix^Q !2q ip i>Y P*/a\ʰ4J_XX>:(0qso-`SZ3\SF6k0@K3wj[j7~qv8h >͡ZB7V<Ǒ!ۚD#[? V%gU+6gWn%fmY+"}_~^=߾gG1P`4hqD2M#j>?ێ*纤e]: O93 |֚ꄶP< ammrH!|yH|/lʔقV >T3Q`JtxSit0-Y(9+~W*w0yIUدypiնKrX؄GJ7E}Wm ݸh[}V#,4^s:1:h*5ky#M}b߻*믹6fARڄȈ2C `e@H ֚n4%%jhL %BMv'~{ nt$87 K`6Jz;uG*^ʅ[jhn_Ʌ.H](Vod?e7ӿh)nu{P\`x F'b)[^|D2u9F,O%|%pDC ^)4< k@OpUkpD* [43&UZ8ѐ }ط+$ k ݧQ0aHVeo W=rБ_Rduf)"L:{Pù־+5*r*eoDzFVCA`%-ƥ#Mb͊T8$6j# +&n_k%|Y7tݨɟcf˥~*bKe5Z FM`t*r/L xvw[WMN2{h+z';9|kƬ -@^WF8Rlx &KɛsO}.$Ǿݑ_M[K IGEǏv4e#@ɛ(Ȼ~F_$w-#mj`ֈc:~8#i|Nfcoi=&]4ϐ`mF/{c%*sCi{Qa>r;Ֆ4`Fy<9`UʶhFEz8}?|hxy*4 CxXIU;ʟɸkSd ]P.^Og na >s( 7Aed7bQ?DG[3f寑uJ,:dkeMLĸn2Gߓ9N?_Y 6%j;ka:H+zS(s /tԴp@$_4u1 L)T;dU6jetc]tN^CM0킨!Zd2Fo5&J6m8z}E>-!%OúTAXϕ8r"*&vמѹt \W|Ф4: e.+)֘j}hc /Fսٿg[cSeM =%]nt2 O7vAz/dqR1P)bCȖ򗱑fH@ʶppi_~tj^@X} tPcB_/}tk/ۖOoRXfƼ2aC$ag+͉w@/:8an,Jޏ;&6e(|D/^3yCȊiٶm?suF QWo&L~ŎVMG' r$3(_A^GLDGHRԓMAV|L@׃q_2'I=DN6z$XkieJ>m'G3T0 .VՆD+ 2^b)-1:%M0{;gK᠘2l_|5B6ؠiRFl#[To;ni)\RfB]X:||Yپg4i/[0I}{ϧaL\2GiKBޢX8IMxųW RK5 FQA8쳯3=َv>1u:^^GLLQO`oqZQɆt YBLoآ-McE2^r|A`b>۩R.YF6K(4ͰL0OAW^D'J)EZn?;tŖcLΡ"6Xk 8,渢쬇J$r?:c} ivHCб~WX%9Lz0;6RcPbtKcH6g) ĒL+EjIճQ~VubCfh$C+!;gc`ve[{V:ASaY`'=)I`m顚'%fWn@esA`S39`TB1`Fg2ƔI[ɅDH & wuȢP՘yV/qN-GHׂi$t{ＸS߹?\x(O{f>brhXW2N9kJ a EMz̲;uz FHtYiMb8o{)KE0_/2@I ~6ΙX{-ځaQ2۴7#!~cwA]t28W+h("S-ĊcG;mfų:ki}0Rg9 HN)ђ`ѷDJĴbāԏ,x`ۙcZ:vo-IDXXye׮VΚҰQf Pˇw` [t,EJ18Ĭ6;JYb aVU:J4@6Xj/d^ Fji@&y݈Q"HzU*ґ%+gevH |Si&玫MZ-20$/F0Uvaq5 $ODo%3Ȉr#g%iG٘pI ڒjnFMGocV̀>AU)apA).n\+ŕ#j2KC#Ya$@פ5Zhv`z]3g%/_3(e@*r;$^8cp7R|< fCfe\ pさ dHJtUY9r܍=܇!CynWcl!5|h 6GohCu۹秵sV;K2D/X*XI/mdF#ܜ.,*dNcjat̽ٽEDz1׼w?G(1C -Y.9}YsϸhLqo LS'H1Dq9|0E&)!thocHB4=/)* QhCH82(w3;>n2jTR5 ͓~V d&%{ڑ+!|eP rfLD8 %6+, ,jcuKQQP39GPLlrhuË^rn`MqF(O漣=2Xl3YdfVD9E7%$T݅Yב2QgHE9.a}Qor#֮s\3jG=7 1KϓV2SO9Ar`U}|qg )3]= _Ǫt^l`E>GWV ί-:hBvB݆JU!bM $ ߔ ]i8mJ܌L6T רpY",LWӡ16R[ۏ;M;hGdFzW^dCM TjO‑-/q*&~a,MhF*-?4-_CG$_ l{ Eaqd oY$?`شN= z0--$pmį 擯Zr129Ѳ dY$1K /k`&ZϴH[&,/*l<O9Q^`YNS7AM)Nf" OCDvҵBKG5\{GqX Mo{kyڍHP-]0ljxC,+d $Ru(6{`:p/iB[L{"^6d}5Kۇ\F;p;"_-JaS /!kt\#zfd~g &I6((3z>Ӟ1zv}U59 j' 5Uy# ZsIϝ|t:wХ߂5#H:OʢR1/&QӟAutJQ7ϡPRɮ<]O!~N7W >Glpg?x}޾#p!cT:,1 (:" ʱ[WŹSre4Gg'=cc`N /4$nI.OS #Ķ^\AHhruL丩 giw#5TH yId9`ķG7}A╞M,n9q!5;QQnދ5r$sAvXyZE`;^Aj8H3S=`I}k`VBwZܦ׃IBT %G%%V}7 Z+F: ܛeJm p#܎Ŝ(ջdl ۀ٧E6M ڏL-:"DzgD{P})fEq1.wB%սރӬ>˸ ޚҭq\Qej57EH^MwXkfbS;VgP鼝ϥ==sRF .57)YzN7h8s;iKzm'vI7Y$:OA Hh[aJ٬O ƛ{ŻjXj+-!'*.U _~O*aPWd GJC)mys J<+G%4p{ᄲ]bLZԩf ט,c_wq4SpDhd)rKpAV$O{$Y%%0ٟ8>Qrpf~/whZ#/5LA IM~xLϸ@! #v`XXð0RFS4ĕ2!w5Hfpw락-tCؑJf/h+7nS~?\;V-EW}k r,yiLwj+$< N*h?{֖X`Dž:N4Qu VYRԠh}{ D}),-.j*{{kNVAqDM{( >l}q« h֜}9w V;7yN yE :J`E!.j.zFU-o$rڋB5(sZoIq ddML}PVr5Y%|n1+E(Sle)bdTK0 ccGe=sqlQ9S(KFH,%hTIwA>d{E 1'=^IZ/iArɟ!4\TmycTDL"P߈*4i2\|#Q$z q#F B2I|'TY#Eyd\3vG͉޸TnJ++/JVt R&547iXH+2: *S_R ˗T OACfd$~t&!B<YuЕy9xfX\ɦUt}=cy2=1n݇ӈIE&PM|G#/J<*s݀lꈠR;5EPҦ87f?RI-g72Q:UU&'t%>&%-Y9j}T1ED5n`1[8VZRO}c\ӫ[KfW}k5J^x©פX/ 'xmgL fXi*B4Yf,!RTd-UL70 g7orsDU#Â2AޥO  /Fg[ƛuᄞj[qk>O{BǢ'Esr7x+bY&EV!Ʋ)bgٟ=מZ+4c֒𨭂-A O;|`G`6l,EaWIôly[|H p%{E3h++ 4*sfZFh{)@}X;YQZY&@BAH#LTa67Ղ@]7{M2W =(#x%n,LkskLX5Y H9[ȃ\D++Eh?EtIXq1|PHa%W@֔OGzk3B 2ЫXnA3DTK08Q1 udNL"<8bV 3O;gQz ~_+5o]Uhl\U2O%ƃ#I ⯞B\>ѽ"П V@>Tb8GH>:aY.P2?jK2OplZ0>eKVn;o./议띯dF+sMK_@Qa ?6 Vζs1.vx  ̵J/G Z Ȫ0{O7J>3GԘ)r", y^.b,sX桭DyR˘s.$ӮS#v˴dNΔrXY({bVA?%4Wu/R5\QwMYY0޽Skػ3..6Q#N~"$v45.JJٺI@Acla[Zg#vZ[ٰpw'V#oPufW@,a_q唑A+]'p=U\u6$^M k?C~QyǻAցǬjl *G{y8)4&}0,0>#ícs;x6ePWZ4ah@ 2_b"ɤI:!QO>n#P#ێy0rIvݢ]pO* */:S>3r 7ԑkH ۂ .d-@9bX豾ɭN= >6*t. 1AFO(4h/rRC{-S3ܶ`ٰO;$"+ F9O-)OER-Ѽd-:?<#̳۟-ِ5]ޒWSKW}ep]|RD0L@'jֆధ-5^α=h9ٯ7a FLe_-lM#Adm:rm9"`/Br!VԲ0$&``UavYRpT>%q0عz :lsҾ|VxgRn25ܦU~ T,O*!,ࠊ&TBuMAGC4yxd:8|_v"W:UӲ{ɣ?GQShd^tk@x$8E酯fƇͤDf;ס*@XL:QZ畩ݩA*$21dO\̀J,oϝEqz S\V[dlhH^@.:B`%E:_ЬJ"fEΖ*,ֽЙaSOmNn`B5HɗC l( C[~&PXyVBq;c@T՛iMCA+,',; mZfL>*rm@gYm>8a}8LE45{ ےǣK[e0pK"9d[q}N!Ip!! aIuhVx2tz`-.bh TZmrUNNWw^CA/o]U<%tIW&_ܝU!@qg5MxQhRA%2e1> L*} ( F RFy硧QPePHC% r2A1_m #tp+upOƳWEfVAs=vҒε7=33٪P;8%m@NdrפM cJr"nEGN.]A0 #-;X<}r))TVa~#rpStML73(¦# &Q ~41#7h_ǰ/\gAJON~d$ L &cslSg,sm*Uo#?\eJE`y^$+9@4B_ױ\lƇ,y=?eBrPnC4cIW/0xPeJpUSk#Dc'(0ݔm&yg=?!Eŷ|+E3d$ 4 iI>Oo2/ yS%]7bCYF5A*|)1rhҮƼVCww X_kd!"A3$kR-nL9|W͘Mt-±6y`beoSƎ݁ c~BY=%fIN(#f* p4?!,M*9flqkfkZ,KFѶ8΂zQAȮݣͽMܠoضŒ4'ߏzaH18df0P%QU=X"۳ץJŚ%^BZ"pD}?4rA>yµ fwH?][ȮOVxj0m 7˴ 03'#x}! چȍP^+DtK|4jy85'n4?A2{6Ŕ~Àn b[C.t`/75*sv#tg!tp9l=BOM_z',낒*t 0WW;lǀzPQ˔{ֶt3&!,Uzly٤[|d׫N[q} j&jhWlb:n}kUڐ8a<& k8O(WrP~C">pHI_f 3<{"krac>>${Ԣx@j<'sQFΆ=9x>ѩu].ک#eyf!/%<;s4Bp1ןsbiU$6k 7þiAO6ͯ7W\I%22zm]`|CԼ>5sOxyvlwo>JjS |"]2XSġ;s,ifuN"V]?Efuڐ"˙JFKks-r~*e $x Hȸ·K 9o3z\N?O 5u0(zS%5XS*agL85np!J_N m2q#g_ 5/5p/'`yѦt!Ԯ|ʕyXee)L/5,_쐋'GƗO# L,sC}b#M:eФ鼡gRрvˍWvB)c {TЬZL$1kU;t$jσ0iѻEIY,g[= W WC< GJW?7͇%2;ssy\%|YByB0?˶,yZ&G<7Z 8m'ei>K[.+XD:u3ú "JEoa wl0!-k]6RZN^Qp- `C%_ehVVg/aQ~&g|H5!CN,tymQv'S*u|,3YȁsvoWL#-恆)=7DbUARJ*#pBY0u @7m[0ЉZsK5qPZy[asX%:cZɷzF#P oF": ys Z8~^ @2E*| H冩/bNKR@aoG{\b}~mY;g)tF l^e(JW:֙rG&iNH?40^/c{m1ˡkV6#0H5њWe)(ZS-5Hx]^`ٍ`7 D%{p4nuHJ2)"L%O5eL6k9[۫O dVF6S`C5 y#I@S-֙,UIc<&]fW1i {nޒlj.1,+dK 8 R "L[LΖ{E"_T 0 N28mkL)2#X* 6RHJHf9 pJ;z71!k F/_Z_4*7U[$Ͱ_0nF(~pjJX},c3aDKHM_o&Q!Gp˟nZ>Dž8nZ-asʽ ǡ|>1]lwRMf\E]B-s)\o` Hgm$E{H]ل  3Gss?ZQj1_I] R=™[Bf7ݏfd 9skt8ov-fF@NieN _Mh 0V"CZ2|C;fٺXVs#(j5h$LHFS E֧k[T uxH| #ᰧw?]?3ՃN7%;5N0W\,,{2N9J~80ڞM\v56ֲ[IQy4ZuSiv`O ^VCv*)EEr,TFa7!_07TpD\/+[dqLk:e$FxrԾJD߂}S]L+bdQV|qj)1?a\qP~%ub RyO~Cی q-.ӕ(k5-x֟ɞx&;0̂}:da"r-Z+=)OXi);(Tkwt&gal# 3-Dv[~Š3PPoQbDhL=OБW錣 NX"@'!25/JFIh*S4VzA)th=ޒn>h|ݎVɑEKwnNuGX0) 5p`MYնQӸ*jE mٔ;ouߪWYl}qWγ_i3yɌ/y)}uWZ3 $@r rC3Cn0WQᡄdp6MIͅ66E&CARXuh%kZK.M_x&d)&8y4a݀ s'k8U`>Z Z\-zcGw}Y:J!= ?0 P#@}}ND1n Zqo\ĎB?-Qk`7Dlae'ń0 'dJ,R:%= _%Go+&հ"nC7"Gz@d9\DKV9~ŎXPLfxZ9mIVRkeW,ts⑒a=:Ԭq}&ӱ+2rȺJs8hŐ88"3!]mSUAb;C_ߝm;5ٴ:?j$?>=s"Iax>Đ1\ /\Ý=0"SOCُ繭⾋}WΛGx,VrĢJ@j8p3˽,8[j6O&?(PMsx{=~t@[ %08˩)mv),Uo#doȌ 0`-Ch\23j+E@l&I6m܇zUJ?/mhd-b3□Ak Q\BLSxY-c,|;0)z}4x ͢A PoK)ul/~i+l% &G'V-sد_^cl6Iq"Y9 gӌM5LFj@n|qgխ_-X5$itE3sxG&̗zf#C]ec)T󞚅6 2-M%r##;XO Q{!q%C;.XbSCgEHô xr&ӥ%ٴsrs4cЇb*L_:/ꀇwh$pF.R LڻGFƬ';/vg䝝ZmdU:ZϮRm KU^TӀp[5@9$c0&WއU\qB瞘2K.8Kʏ?1liJe!S;1H{J?WܻwՏnTf(M4]WaBON\.:zچ՘ ]<EFՓz2jǏRR9&q%X8#BJJpTMG?;KBmKm)\&~xRF o'?|(R}e+bQ6mdd71 6K̃K٥$I!Jp +vdk t@Ϝ@!>"ǹ/C]6 .ys?DV_qI17u5_zO'rC5:Џ'ڧhIâݙCQi@w\{ħ ,3:p/Ȫ6ς+I5'3R|0\hAF g240R{@bނ݀OXB|@əT$L jK8lL50Zb_ee4tN]J@uf@Uw~d ?R=kַ%3v 4*tSЭ"[Rpڅ$n2tzWS_&5[s#UE@ ˻aZXUvӵJ LW"0Dt$aGfDEC VBĉP5ÁEBmbhtwҋtC1DދK-Y:/!Ͼ&#|s t"]sZg=LA$mnVGD'~sNgBIXP TsC:Z,s [ZA? "Huhb/c(>U"Th)r^' s^J$9gq)[VZ]-VVKsCno-f?4_lnBZ4π L%@h QP+Q % |dwW0BWCðح ]%'afC +aI|WӋ:r%m1J&6ϔ'Eh9kEqP= [L1.DبoFA/q"u)DSCe"}W&-v^B $_yH D-c ڲkG=w&I@w}>Yߑ3(WUnE?u0 `ÒR-.lc,#f$~2K 4 B݄Ps(ܮW%Z-W%ʈSL;E"H\I;1nb 57Z1Բg 7 ߚ& y۝?;|#zZ5k䈂jͶ]; FjT_6LAm*QMZK| )]b C,!OY"#5gusch.ti׎ @Yjusd+|< 6}C%fxZ+Ѝ]LMIRUgňԱzlyM!5`Ǯk OD]}L'نfxo<nVEg;/S= ܦ= ݮs1u5#\6ThQ-P\!@L~`,Q Aq9r,tR }r@,손$0!"}MipRoC5mg?8:~ \H i̒ܥ5zI+2tM첸<>7_Neߐ$(!X܀yF1^PNddNGj"kDSiyi Qa(\UZN)zJdv!5H)!P4lru|OA2!V\8َw|`wa|e K'Uz鞯zZ锗b.2+|%(!V:hkG)E.OwlѪ"P.I؁hlJo`1{vİp_{˝M޶`Cmy#D+X% ;;SLWHt֖![ǰ8e[8E;0?f@<:EAJV#!.to-BbQ%AdzxG^L;*~tecHf0}9Xo拪6Nb&ڭOkx>U9 rNmtrh pz34]/6.uHM%r7,Y\ٝ6fS?*\ &lIz1X3Y!̕MØ`K=߲K|QQ v eaL|1T*óg6ٓ:5O\u'}"GTc*@vFRA bzzDLBJ^k~~l' jU/Rkla11vD;`q϶LYirtuS|k@(?UDx45ʱ_T] n7>d+eE2ާ4ʟW4 ltmBn}S+$H WcF d͐,^;qw J(Z+1۾ânvf;ϞVs[dp(*i˖HbnL ay/>HJϑޅY=á3w :؛@Yճj"ՂΞ%,8~Ҟ]&LPCx{Ćy~6GWNhZfXD^sLe'7D:=xD"1|ZIWr_KiBEƊ"tlǃi^;[a>(8eĞX+/a%p0ڲ&uitT1!cCXhth&$*URy-X$dow%Kn|'ٖ^} 9kSqطlD5vǰ` /z9 ^eo ł-A=fQN"WRulM_xhLjkt\ 芇. IW \(^=98:-Rpt;"bY4bo h~Zz9r~-!_{pUzDI"뤤[%?C ' ׻n `M^'"L||IGih' E 21ţ; " jl+x*yuȦ^-f >\d]v=vkQq@7틁==؋)QT=PVܠA9~SB^V?jq/͡ekcQD"jo8w軽v= Vȓ-y}8K셳 TQߡoL]]xOF(4;}xw"C =~ .RͧLm?H č0.+]eYQ ۟.:(IyiIx:(? oh K.+⍐2dA-')49Mwv1bA nacCtˡEZ+GݶP[GeVfZ@g7\h9zO!S33ootO~H6{ğ]5'{Ύ?9#yaF 퍀prd*n҃63 %Vs*]{QDCNqM oh{]+@ ;&1ħ] 5Z|*sL&r2/b[rʄm*Ac ̆ճe+oK((Unq.բv'(zi62JI!'eVY81*[dRzbele&iUF|ԀEd[w2!_QD6DBv>Yke'#GJmk(˚5qp ܼvInj'5wjb<\ͬ| (͠P{77kXGl#"+gKJxT8Hn5e]w,[-gN6}[o9@pWYd: eb=nm'6) ,QK'|=AH4J vkME 7E@Ñh7~$ !D +yXWgyXfBpT:0=7<;ŏ0wz`XX^#nq)~Ll?V0i|="_nvCFLnX%zVI wi1Qբ\]Ms88/ޮ> j<株^O7,XnX#'2E\-PAsc wf݂uO7{^Z`%,T_Jڡ@4C3&tXa.E(ݭ MvՆ, gՊj#0ĝ!ʟI(1A;ӏiG/ؒ9HnbPV5Y7iYO';W'40y t _Iu z[KpJC`Lj &G*~L]G@:,.gb}Ȅ2جycVl/:e!tgp4%tM\WK篩s3pS&2g+GJn?:V2)tv {_Ap>nŜ(h 1|ea F wtėL=f>USY6@w읧pUL8T^CYg^cNPVZhQ(w |O`ѾMX?PZ H+yD^DMcG-9Jf3m_?fR0 }ձշfi7! 6 4]XknEN;ezSK7 hZF. nb/U*$*X&+2FA"jZ"30Wdyčt"c:L2\-> ]kкolfʚ^laM- A> ']vFB-6`p& 4@ܺ-RkYT/;rugE*=×#.摎eYL2ׯd0y,W҂4j5*W3qDžmp{G˽BxL)DWpb:s9l/eȆO1x+*"4FNrewc,Keu/?a VL9 gRN9~%S+074"{אZL`E TIu*PSt 1tQ&ٿ[-$Af3U<UBjRњQvvߜ-qٰ%KOy\QcgX\Z`?8Z?L?v0D*j˪K+6UtcfḜ?WhTWZr|qԽ˕~MJ>i rMHAn mS7k}&;׍{O7}jd t'*0I/K"M  B[~ u 7.4},9yoV`@ɫL4EM;4ޓ/er[8]TWsTp/S*宐j}(zF{jR|GEw-Ve'@qQH s[}%P]X-~7ʒ|@qJO11Q 崉[çFeӳ=W! ݕ;S2ڜ7!@/ Pi5h$dq@^NB-Ҳbr\gNP΀{E*Q\L ók|;.>fnuhpv ot yTRe3IYtJYO:Ι؏> |fAUeoJ fU:\q\UWIJ6 FѮ18@\E'$x>J&ftVZ4>qcitJ!X²Egmqe.\Gu1gL(LAL\, Dww ]ʇ:?9h\yڣ#ndk^X޵Debڲ|wB[:|-ɟ7jIpUl#w`DᕣB[|+ը;P[wNte87tJ*e^,S5[cױ~dy]BmX~@Gԍ?}ClM=kFa2\b%Y bP=1S Ӳ1V\)/Rpws!,Na&s imjUIGM5{r?5WJ` E`Sݥ~JڧATfB#q]|X6X;OK.8/. ?.s ڜQ_Fy'>Oխ Nm ۖJr 4Q8*/ P\oZ5LY)T Eԡ?7h\7SE+XMA-B",V؊Geg{4 :hXBZp60y\@^e/s[4V&<?0kjN٤smul$bYqZݜj fiͭ3yle޶']!ټ z`}s#9f~QZH#4"v 8, &PektGtu;o2`Pv/< %gUTY>aO79Sص]#׫=!ZTn76%T,V<“~Q]?Le𩳫2Ko1c|Ҝ__63s=_fۓhES湘7LʛRⰰU!ò hDun埫\9 ig٥>>Qyy黉w،VKO KUU3M810G jAaDY>"zS煿oөky<5^nadoN)Hb"938]էʱ >:~^ t8-0B #WjBf]srq!w&6m|D<3z,+i[)L;.]be}-4ن|(^Ե!yk..Iu3pX9WDWnPIh .ˏm2C&F\L6"-K_<{y 3.)ױE!DCjhJkYiH)}kƙDvW/~5;N11je _$c.[/e1dgyW~`Aožk;d<g08inx-4Z\-FMag%#93bXf>L61ŸsC)' o)瓢0QY?'׽^{wr~ J"tGLq^RhCְ!TJx-\`+%O ]把:mkXļ%!u[i'em9B؜K25oo̲(I*5bbE$;*0CgAyxiqm<>P E) J]5k<{l)ZmM+4+6F,H>-dVݼоh 4x̫'dzVxu4_D.~wM8VS( ~7A+1o8&9~8iğ"i/.W.ɩU:4ڟd]H&ΖhYk1'~T45)m!ހGk; 5!a=~L73(/͹-U3v!>B:+hnJʯ#و+4KR j+r] ,`ԧ\4ZEKu_0a ZOW>v[ӱs۹_0ƕUhn;giMI ʵ㠼-w=_]lg#N5A/Ju3#VDRW*T$#SbDADpUVB7p'B;»XV߉NfZه`Vc' svZ 5h;cڻD,h%W*c t6n㾇LEw|<?#I s,.]t i_XȉY4cP "IG!Fk .z` S']W$ynҴp&װսZu8cWĂvH,1g .4s/Ӡ0]{*M(!?e7ͧʟ*QcMaxj(GnXRaS fKDy 1o"Fz&ܔw6;X " bȻ6U}3 |]P P7ȓaАCpPČw\46;! {#wmn"y<|jz-0s5Bu|G B*_r:L3%6Jmc wK41b"EY}XJjj2G'z[69>6as^#<}#<\v߭q R2OO{Jk?RO:~'хt!}1n7]ő]uYMVQ5X z֓-"JsIҨ;x1nx:~}/,|7\8n ڪʤp $.chYex-3\)r=aS8Yf2ܡ9hCMʄWįGhP"C& >)sHۇ(ѽGQ̟r@%tF'ڟƋFTKҗ/Q-aF֐Rp eDk49cHmt@pZ U'F.͠Ӫ y[njyM/u<|0i!H߀ز+^rU1oTF@K$Wd]NCG%I8''6Uo`X脏'FzֆKƹToQzjĆIHfe&QגIt$6uɰJ]x65_vϤLUcׇVYMm>i\r$DnĊ?ECʯ0` ;a8+» {dXT"ߧv~hhlq?> =k0"$%ouOϺQ=ϥvֵx7>ݱ{m_#~#f4Wx@W&* w_+rM eRa{*4EFqdU|X;U^?\&O|p8WݓVӘ곗61}2}a@bPiq:씋.2iwla$#pmEW9lG [$<rx 閵m6ؘo0yE.XwG?T:۳_^в9/77N&%'F˚߄ΈW[f Wc|W-1n ,(S#ʏ㍥in&U3yL YQN6QC濉pC8#d! 2ba΍JƇҜ9X??og1/ nH9wb{xbe[~ jުay3(m6Fu8ZrέJvr4LO7-O5FaU')45gq؟}'TJM[u\Nn6]k2 W/r`!@lqToXI.ڛ|l&N_\"+,hX$a51bM؉*rr$oP,!^8Z9̌ӾP'E[V,H WPς^e߀Y6ϡz~Nn"a06V[}13&IXܔ*{_AG*VF̤ q+0^ipFω%P*K bZT0[D} Hd1~R{0^6N:cqj+lڡs /g`P@pX\&}!Va| X03!>rÆ!l۱yр2R3e- ƚS.uWMr]A .xZޠ9 q7^M_Ѳ |L~K1<\v}J'`bF"j PqF܏0odyVJY8 -'kvO0; Q 6@YS&=ǎaE/Wƞ-`Qjډ&,&#lPIM>be}Ɵ[4xiN;HOTQVU f]N< } c8qZlҶ1=n10H/+GEe2†%u c1ؾ%&`] M- _]Y:sGfEpW)@/7jwp$:M2/oDOɨ[D8=tv8EGmG' K@2ŔRهgg7' J-N0q+*4%$G@>/Q! bKna ۩]IXOsqA %'YX]Pa\H83斖F/C+|mMpU\?0.ˏZtP'| у$ܽOy^`#!+zZVebZr{F4+ F2(lW93kNk2d5?\PkzTҩIFZW^x?8Kӹ~q8J qcQL6w Mc(l,]g 8P}RzK6"LWIŭaEtqђbdgfCwү,U0<紘Q$粴E>?p:J='$&#I% Bݭwb7ؽa?@*&e;H|˾7nDߜv>3xmOiޘa׎9/,4{#µfS40q/-L{KƧ*p.L&JNJ" ~CEjw[ZS(u9,_ B=*}&o#{HQK}[FJ>"eńLim/` & (,ga$B`,e4x= 㪵ooT-fH5S764f,۵Uc͟q#cݩ(fy ,\5]io4<Sv} .  C&}cǣR06'Tr3\߆ \d#~$,'9v]*vrK2|nTbj:E%w"!LE=d]7pb wq}ږOۖ;Gw*0g`++dž.EUJÈP*s4P<9te}*lDU%T-3MJB"yLc;7h ɟl]y>s~2@6sQKWzDKdFOF .z.0 gU]B(1#!(AfM*CCب>\bPAaS92yV}:LEf~ׁX)oI,skHx 789&2\ÖX,L .yY"dmg[v7t5k鲶/;ݞCE{E9 Ď M꫸Ves`\ dY`_UKГޥsUpk=Ux =:dӡ?Y&LK{8_SI5hxFCr'IYEeZW# 82MGxʒ ʫvplE<{RB\3L Þ+EUq A3'IڱhqUch <N9:mjZ}+@32Tc 2_ e]{@gDgĀBY*bq -\EQ{4KE"bOy'7C+Dcxț7j }SŘɂ~fbW"V\~m}f3{2;$U1籶*Ius%!A'Z)5ꡭKC ѯCSV+J^=yVa}!k.\H=V^+}ntrʘ5.1^^23Y'82XyGMz|o^z%w[O'M^$XxhM~S2{wz}dC(. %T?Sw -9NJG54*j.y;<ﬗ(tblE;iZi{O:dq\xsȶ5"rvΒ1r(]B62,yzQ4I`R V"OZ#U݀z9MH( {TH!ē$%|zc>Y2@=AͬumD-OK*B"(q'cHU 4,f<87,VL7ߠ Zb$1S]7eA27{f_\#̹]<#-<ghy{1t3q,9yfȀd[@!\ܵ-@. 8  4~:h'OǑ G٢H("x+,k/i}7jMڽ4+IӞHr%DV~cG\#8j~ʠJ|v MPxRj<.;Dg1?B4t:0&zνug"ÕS6D^^+P2eZ$ę)V&ύVI4ׁt䢶rrhh"BXV s5BQꌬJ");@h8rrAW-{bw<ՠZӿ?](]w @c \-BZfDvFjy͵ے\ڡ>j((  ;7D4qOC/u3M 8+/-aɥ Q:7G6J5s$:N|4HBƶe2Ns۬޸lfAEuPA(c'.MI)B@aX)/F?aЃ=?x j%=`NF,/y;c1pZу ӓMmmSb2O~e`V5t1J7ļG2S&fK"[4iRL$ߠ6E-hP0fhuSb!;(S>yZ.x}P89N1T)z\fks@a^p 20YjvɪKW3`;_塓[{(2y{ I9%=edJF tҞ^")VUch\(YZi J I~AL2Oߋtޟ6)? meaGL4ѱ_i!<rn]xfK\4*9̬% oF}-AY࿈n=ԩzec|t| 9ӞU5$`JS }V) ёk2enetf ,*>Ւ&ڙ;UWչ`< Λ^Z;iy$s[A^dhu2^}k3|9=9Osʁ;h6l|TS;QʹIt&i8vx* }?m8:x9wR8+.)Ԅ?h޾Ht`VR$qZVtmBc0Zp/~J='Dn$x/5x;= A %.qk8l[.@9Cqc8]DTsʋMd9}u Q9tyE \&6Yl6kJSZ!0Zm"nI6^JC;}n3 ;G(1|hx(6!v GK^VkiӄC'ZLɉ19zq,Pz_Cn:fcj6R1<J672J;b<#ik\*:H41ȎaH{v͝{6B?Mׄ'13L۩Oǧ?{|?Q}{MXҦ[1[OH[\f;['|dUR)uɸ9 b^z<\+X$c)WE,yG^vȹ_9@$ՇU*–!e:!SHEku}|:Tw55PO_(uR,_haYYfiشZO[ (F"8F۫W^sq<]=)PjhjPϥUofOMIWmB~[zgr*&yo|OnىW* kEܑ XH?*53hH7 ߿U06 > 6+X@cp[4OGOl~ծjy 2 ﱁxzSa ?q%IH  _gk͙t mݜе<}x.ּN>GcLMw}ke_ug 4j=x-h8XbI]' YNމ\x)w5u)'\  wW̱Zq@~eAٶ{ cs^4Ƶ$FKf= 2lXRJ?˂-R fX(2BoQjoP %w02R-S 5fDͳ7?c%N^2sPYԤ'O=J"A %|c~}t%[ :Ty%.^Rc藖Ctqq>=SC<GM*\Gp /Ŕ.+l#bl{MVs2'T8N޺^ [~`DΜ* ֟` 8[N\zc2z SE.$ ݁0G!2 Nz!uNpx̧_m f-R)o6  %LT}7!h9a iUa|<+=z9GӾ]%HBqnGLnMUԼ`\#dUrOySbPqVDx@'wGPaX imʻ֢?ұH:͂TIhcxqiݒ2= %!zQ0tc7D忊cGnú}1"2 U!oNTDzzS(.ʼRLX6xB|mҘ`i&p}PA&ȞI58Pq!G>`s?*_:Mhk\d[pBIØ.l]LL%NӢc~xR)7ul3jb. /7zD+Dk(pKNh u9|ؐ}(wn5u8kwmV;>h3DZNqSBQR&ƀCdk/%iZG/;mгu9it|`LIIU)+Qf6]{)ZDlʀ[뗲 \Ş,1Z TPE E#.SNmjMb* ۸Y"qʔWwռ-{5)Vdخ2}k떿8c ArO[׵8B+'oq}_?55yk& VS6FE/Q'W|}V Flg;?eջ$xD5̓k\ixrM=o rp!kTm_qk-؜OX oE|'Dw5Pc7+ͫ N}Sfcj!dvm`x@֠2:ճ?[ngjߝ) ]O nlO 7+A- B"e4O~v86t*ms~D-* 2fU6A+ hٟLW18<yۀй);߻1vHH baN5[BPl>  Ni}\ tYNKhy#ҭBT]T/^Q &Ka][%G4R'y;E݋:V??8te"h ]˯E061&=IݶϬ`w_JJ[w:|5ysn㔪)qu#:m0# l,DHIQain,z*SUžNtBcɰ]l^%*/|ϩ،0|3o49xgäϘ,s^7;DqAѱtP/3Xٴ-c{|$ 2)ɊXUHfVTlHx#\+e黈j賣c= ǝKK6sV!@ X 9Eqe⁏r[fKt`aj(,28@ yqƨ=MQ~jW NP)tEaT"cRɌ^28mC@g Obkf(!$$%IkUj‘gq}rlQlͦ!Cb'Q+͝=e̖et3a Z'1]aNޤUK(GRv{ 3k ƨ]>봹L)AKZ̦Ãmk~U!:QCZ'3 !濌GxKl̼6K Snྙ82vz0~D&F/"9OXg~@cxXڋ$>[֓1Q N3\yY_xȌa/}QtV-b7Xok(NPG%5&~wMEnמvv"KH 쏓}- J53ۧX@ E?e+6>)BDL}&ptߏ=cmq ioa5zx`w}u 0#h_#{UvJ:v'V}+-O̍R$\x:i,Za,o8Vwu$GMPZ䲖W]"61q-~NijT{ ZCI =Xnk5'O=?'&?$"{Co;nFOC%[ͨ4[0M}(bW>dZ@c6 882, ~̗:Ŏsû6$Tqjo .oq A:Njڗ,kĖ gp["ĄJ&/D3 SSY).;|sZMv$'@Iڙȃ83>~7-dMyzDܠ[ε ecdXݳm#s˦*?bʆmr6ȓp|`ZPpT\i?7ʀa&\,rM /\GhKe \!8tV~ 5Kj IUk 4(JI' ?Ƨx$:i:=: ̙ٝa֞µ7,ʫγS2axH s귫Zr-dSZ۫qJ/Erd`Y?z|\3+2Q.誹h钳aR5E,Vb %|NaKb=5LUrU0ul{8CZ'XD^la>QImfKdCE#)]eD2dJc? R_7z!ߴfF˓Q UӮ%C`2p$D7|!Y03ѴحvgJ:lD5(G)Sw:x777ِR=JS G'D0|("ԇ.ȗxN^hc4uP5t} ,} |Y"% [κq1kdQEAA ˊs"s+喬-&3V}V,d= WtiO"Bvn4lYP;]krX;CH-]ͳ&sȉZצ};_\$9G˥e~C7ur"yˬCޒ.vRٓ4髟@,C.c7pFe_15EUNrj^nl\H|{*gq$ @i[ G0ZJ"KXvp2On\) ;"(AG5ۊk\t,.'K5_y|?Ex-ZفXTD㟡QᗀIMC}AXg|N7&ZR"׍kE S7(>p9_AETgur$ hwsߝEHop６%,f>d ڦR>&,UW}y/]ѮXQJSrJ%6#-(ׯ!л|l]n ˕J]J,7qK@y2FW -C[rWݺ@>AIaQ&' 7T<:e@3kΈ]Q¡@DW)M 75-xL8]!\S:C@:Yߕd ϭ;:XUC ?D42t1{sߋ0^sQ5_Z̄ײ9e5oK|šZvVCN6mtüӽYVWJrn\ޑ\u񾾞Dh~[R 6t9M퐯z6F.ԏ^wl.UP1ydGa‹G஛ysi̻cTM׶bAf4&u?E Iz˜y j06gIp7v ם0`@2?˾ͦ8|̺C*i_|2w_Tx|3쥥XJ%LՕ'_a^S`ώN%'$\ՄVbOv:1(K,DGA^^8όlw%q%=)t^ 7Ue>n)w y?c 7XBj!gd)VaO+=ADvFb$㤐O82*Rb~v܏va!$hß(6JByy bZȇ =ؠto7!&©C:6&m>遍AYS3F@n `SN ,m3Un'I\[Xhm41&aDŋWoWDZaxLLNcDTM I@vBEY"vN{fRɍ},k4.?e5 Bnj"~9ԷoY2׺~w_j[P7pͤ~Ae(w`1Yf#Ҁ:q&$mu'*sؘ #|? dMyvr$Jb:軎}[G@ 9N/ݩnpUOrꎮ=Fœbi퇴1RIB@Zʘ 4WF><:jPGnB%GG7(qs/MF~a"ȅCo8;\ဇ *B9G e% lCx?(u_m(W}[W-(д-j6Q=ZދGc-q`;- =Qw!j\Q>XA-zB,^q˕/&e2D5XeD uJ<1H򬹤ĭɭ PҪz;~n-m))h 8TcJe)s':3mŦFYXf C^틟؊tT#J{񮕯'r ~42cW˲󰌚O@J4EKN}ya Hv sWBSQJzȖTr93j[0>,_w*L[Rt2[n#gtjh[:Teqp1&^"СVe޻+xh$/hfv ln[J/qRi|_-z~ vHZk?8:$\|p->i!,I,wvW,oa|tb48’J{~erP)^kc N~yb.fi`.7w.,ؒDhO_ Rce1MhT gHn'-™oo6mkNOE ùd\ B ѫMSX0]f_/"پe!#W_o n&,;Z g9ɾؾ~+E \1gDޞ- #f,mИ{0H2{kh*ԧm"ꝟVdݴA͔eaUtHlCvhoOȈɨ,`7/=)x2oE"NF>2IFj?T"J^c,!~lRN+ ]snV[/3OV.|rDR<YWrR?)2#5{j4/ߙt,J7 FNXVY_n&9wVsH#aT:OehM2zD*}e?xR[5 \6xq_W H-)\^цPSg}=@fCI;l.:!AW0Qpf1(b%!GTw?с@uW DS}brrXm-9WW0ro=4 lg 0޻0 [yJ\XUO}ďEs!Br4!тP" m:D[xߔG9TIĩ8xٙb~N1ORQk2J[ۯ+@CL€{z=µxJD?$=ge`֣,wW cLl)d Ƕ[a|1L"XC.:-\OE V֑&|8X qz;EVS3^'jtuU%׭r(W:a} ޣ<8؝Es@}pQ 84\Yx+e9c3ZgW]_k!IS a`z: eYuV?Ċs-Pex†h\:6ùǞ)kUy q;"$eZʊ0 rOdMTXj%ے9c!Ж--N_tۅ/LSR&׶遴$1YftW_&eȈj=a[^<(6|uXFw2NcFu" c"˥r<=a>Lu:D:3g4%u qWk MiaP믭cY!yrAr ;RnJ y/L$Xsf#xRc*|paRgT]rhӴVz.0r^LHwL#9+{!zv3k;坬V{LPÍN)@gZQ4`&O+ {pʛC;fGn~Q1 rnqҺi׌L)z^{'>lbk zP`JI]J u^PXOdnRšfrYSY%O4I/M|"pB@4TEǣLjiy#xf;VnAryy#3 VCkNHV ?ꍩh`[X:ݜg.DdZG E੶-"@j4732kER._^;KKpڛ Ti(H͑Oؒ#@y?b9}#dhb 3`+'g¿~fH^nZs23El$vleH oD@A-ܻd .YaMcTԢЧ951d+j=gcKI{CM#}!^oB@95|s@#;?W6_݇F&=5kA0Z>ͽfR(Xp]JݮiK_9ju`Snع z o^W'k~<2nV4~!r0M?uܚŴl6,cx' gtrzϠ3s(@ҍAǁ&|Ri٦iJ&a'`FK#ۜ)`'PҊ *?;bR<sGD[r]oJ6с=r@{lN<feOhKK.{'sa36d|E0 dT[%WJ5@SqEdqͯLše`e"B4mbDnd:cN2-)Fk|m4a+mr]djPЛ0dDAjLa@al?|uhzN,{s6'j^rK/4|hbEFWÂ$~Y&̖dQlii+O"͠/LNH>N$d@˃cp3Gݸ(f0;?45aa|KKί~q] CWhOBeaJXآOЃ9mxݩw3Jvzvɡڃ^;OBU 1. Ē|1ԟ/|I!:kYfr822I#ᐊg{ְXy?O!vkпiv h 'LO*ªؓ%d-SK7Riuw%Ԙ ce#hp3]Wyďn8/x-W,IfqjvNb eLء"ѐHQ?|m NF~C{1Syf$a˺=tla8[ukVn^{JN?,Շk'S6HFNer;goI,bpp s.w4PROL\^Ys}v gW@Q##+ 1 ޽\>\ch*_KN6p[m]a FehF2r }q/fΣmW(~6ѓ$bF0S{t (orp/]acηҏC^})w'L'@<%sFbTRLߍب%LKh5\6-*;Mɠ$̊iȃ܇_Y_>(_ì}\`ps?>޻K Ak#*7.S׾4 k31Wgc濧#9N;>$`3?*F^ZanؕƜw3AK=%}&yPM[:?!yZC?gį!a۵dn7.r|Ʋ+Lt`ppr;KiRW? q$y,$ؒWsoLD.*iHv.]ͪyD:PaH2٥M. Vi?\BuelU|x VY5y>s8}\oniy#e?9tK٨CDb(6]51"mp{5v|7Z"N8kfbh([Ʊ2w4PV=9#+#)5\&/"=jzOw;: &t$[|RjS`/k/¢+ (5"Fu-׶7DxP5PiԷ\\vU,bHKTC~N`m͙IW5[F9:S5IT6A4?B$36I?:,tǤsJT%g#kбAC1x~0r cW?:!,~sYnSSO Sq34ЈۣYhE1o w epiҭ5FMSLJq)̭a5I(2Ǯx_cK(:حaD}FvkQ SW$HIUNud=rL\c|1W0UX@{ B?5L#䃩!M%9;RZz6|tɷ/($=^?a|D:I.@Xr81},%EdYW#(U˼O; ;.KJG[>>4J(3=/qJ>VeM{ $Ɋ }ڥɝ.iX)7׫'v+0mTL_48C 2$X´;E ߭Mj4NEl%ZZcMo\?LI_ 濢,+èkOI)Sl;rQAHa(o淘ך=kӃ͋=Z|MP"Tet ">$F"*L\̯Uِ0g `@_ _V)ꢷ ~0(o!C @' qRφ*1 R`~mA5nALaB2IS uXa5)Pey{2SЊAo0#])ֲ9y"$Qt\C$Np㳝D\nXˏܩߌRdֱ b@PeyGdZCtA6G W Ҩ-v2.b%"H?i_)l6.6TqNLI4X ,?*B sx6g#:FQJJ X99X𶎒Wr7pc+\?(;rWPf,_,#d%,Z ҕFP]fAٹ׺ih?ix8k]r*_aq2.`dtmQmrN,DDfGsf+?\ .!ث{gS)]1\fcelyќ"j=[I)F[&hcJG(ׂfDoǖWL$ʚHP쐱q]քW&$OkҎ'U49~y9W]ou,t1TM~A;תÙ:h<Ū~ǩ^N-(I\bD<^(w`bj:7vD! fHE_w4S@B%౽.GQ!J cFYT{5g¥t*HȈb޿9T*N RT+ZmZ_xrF+е{Y^0Z=~_6F´i7S( ؓ}~5DYTͫu ӭhF27rK;> 8`+MJvs\=?kX7+P]JHr:2丨>g)7v 2]W=" ԾW| m:`IivUiylOfo!+ 2> )njR8t@us-z⍛扫NQ:ؾDAR1gBi߻}'g/јUJFGc g[Sf&Af6u]k7 ^-:W&+L]#Ltœ|K Gs7ˆπYEy5pS=#͆R#^Bp7Èu/1w~Y\X+ry_G 45>wb1Q;[Vb05xx[fU/@lffqc{qn4]qu^ƺ`vx긝"`3#ֹ׮SLQLg:͌e?By_FdVےB#+LbSfn YBc(z<M)m\#<Yfwnɶ^2TB>ck8N4(kA[+Ҟ:GȷS \} dB]-NP=OBi_MuA5Dwx_o:-or0O\J=;q5 y|n[FX2V~ڎ"pH^Z(',| 2"y$>j;1L5+*3תLBkQۛxwPZ^%k2oD5-J3-VnvқjRRZfʔK w;;_;jG.!̅`*llj%hχ{}Ewoށy?4DmgG6w`V8vqa^ zkl|e)]j9IBSV"hA9Ïwwopm}eՁ^ `YLxPA,8HB &TYG7Ⱥq-5S%6Ih|3/eh;4#b,To0O+V4Rcߥ{0̄W#. W$>BqN{]@SX%%m:UDHSޙ6ziH r뱫7;ÎÎ~B&MXN>>N̜sbOaNo.hc Nwutݏ_ IE65y!P3w {g2Vw7SPS.o3\lE]zOOuUe+r8K<&d^Dg͞4S">ߋF*糍Xx[ ,(ζx%P sWA֖tB˞6ܩf3;mcM5I% DS1ÑN/7[ktHbiw#y O>w` ŽS_(U2gt(A"$h0 [Ie;-b{|}J'7z./G'+IQ$6JcǞQQ-3͸dTd-JEٝ/"u䙭Ei}8jKpv Gn!cGs@˛E'k턍!}H7H:ߛ Ϯ8bFVf`X6N^~XjKn2Uml%:pB={ 3n|]ÀK,9TݍY;`PFluxB wK])AS'S#w]t /2/-(QhюQQ /1 F2'XK7RԖB-&uBcV@*WTC vy4-28+\Q 5b=@4Ʋ|R?oHVlvOrlKa`gb??U@GжWjIUrΓ㹍z{|6n{sOr ?yZ暱NyU.\3Yn*4*܈󝫤\2Cϝ^&KFveXS`S/CC=c:?FI4}01kKBIim-]K=?(\)Ɲ耒T&+TŴ c$b r ҏ*$9[a? KtrML-j4ݠ[Mԫ<K8ge߶߂oBS-mbo록MÙG~V4?!g g[2mզpW]=9#̇wd9-DIqK9u1$i!ʡ=RjkXZʣ*R{I[? pSj##ut%:C\zL#F:uOh[,ᎶɌS&jY@8Ai`Q}ZA9 OxO;Bv'aڞ?45?r[g Bf( 63wܸd(HS /JVǙ8 _PW?ϳ,Cg>۽ue3>_k~gRw[D?agd+`1Y˜hcDRe@DLYUE*b3]5ŷvd2_n UlԑTʾ}ɻC!d~zEy͠tYI-6TI7D}ӿ(W,]"0߮n*ujL1I;AS۲:A7*< ~d&e{!)SHb!d<)A_9eB dfh2rsD9["H]X!yB')@v"F-(9'kUB..…"AU7 L* L 規+ӥ^eur*.1MCRPFcwiT9:|6GJ[+>/.ϸ ]  SPh¡ )!4*j/׽f߰0?P;vU/lpx&4z{b5Hpm-㭃juR^)|ZQ6U2s /\7QS.mQ8씀 s]sN#Wc-5CPco`!^e ܕb: 0|x͸SnȽkG7ZH]ຌfKQ6f,ԀUW-cUh?mEG˫EzFWNl0@Pk^s:?9AZmƤ}YNܰ}=H0ufIňՂf$p t.9K8@XPCIl.c/T#:7 ;_^'"xY3o*v/h,Zg='w *ʂ?!dZ>>[To3h^֨ۈ‡FAG/X_Ճ{(c.-E^ ;1шq;> 8.Nz1j:I|V\IYBED릫378Y+A}ʹ,ʢT +Ţ޳[ ܔƊVe\N pR9 e ; Z_/isOօcb" saqNKY STBa,Y"Ϙ(YChf|]LҰ;@TTAyeф=\ \½ჱpz_9{mΦ?Iqy\Qtg9 L-# Ϡx`:)Ns |=YoѲk)?r>3!?"z1*R{tRyt؆`|.BwF]bY 8(jjbk5-k{+}IׯE?;z5>uƁ} V&@_.p"/~tmPx8q[gI-3=G_Tb"LVxN >A5:hppW} De ay`@'pO(*Nn/Y  ZlCy‡}-iX_6T14Dtd 6>*؟pbz0; RalXP+kt|qNbSB1o٪CNK "aP熥 MY(D/7hf _S+d_k[+ %WiUMbbߓ ,rky2}j䓤DٕQ̿?nw. tfؠ2`R{SͮS;xKC(~v0Yg$U IJcڄ[O"ٖ@6,u*•?_ Va5,ֳK֫a_ZDr.u`[́| q1Gq.d~Tgy+tA{ACA; "h-tE i1RL_EףwAMzigT5AډKɷ"iIlھGI/UzJQXh^ de |:=4$./9;;I 3rervoBz2'nw V_!P6n\{ BRX`3+ E.2FOEb;_CFr{9xҧ!WakhJA@Ps6Nc%Bo>Mlw`/_щ"`V;2ӄ9^ Ik15(XH;57㿨AFnŦCLjoOqy,mDxοz4Lks DYpoDRRxN@'&,P-Nx^˙CTX4>dئDtZGp&!|o`> -.ǾG6@azTݼ@k ]z'aPaČnY-h9OQ!H/N6I:]wx0쵭=iM6􉢍eoK,k`dFhf߽.ܹ״9yMz*l{7fZ!ZTp2CB.lM{77ǡ~Nxh:PK>%E_-1PcO\(OZLdQ; 3͎o@%z& ]3yDcyx@,xB^̫!(m[m"cA+445z"^3eE2{mˠ⏠u,ȯwzHʇ2`.!= A.E!B{WbxxT͠ чb5L;s:l:՞+'aADv:[d^(!Gαmu(@:ukG-w 1)K 0A!@Rv0\83U/x0gWu:!h"IB,6}/N5rL:=Уת!AU`g:\okZB-Zr]l8*&KFmsuĆ@g-ĉ-*9k7 T|<70~ 괪18Me->(!()ҍDm,̎JOx'ZUЭZfLa{7ap8A5X+60sTm鷍U͏ZO$"Vpfq5-N~W~'oUfKFYr=50e#^Ko{ .[ڢ;2ivU*kS֡Lڑ|jK\x^ٛF&1% HʑC7SYpq^#E I*DZνNǑ/^"ZEA$XH3.l [VRMYSt~NL#*0_clM]G}g3ZaU0Cb5CZ!D;F^_ ė,,` Pq-NĸD$@*ck#JޠɎqS=e-f GXQrpK2Oc҉س8}X޽nRZ%lӮzGu(ݗR [ DSQ2l6y,ƈ;go=Gb KˠnViB T9@ E%I2ʷvWOYohjEI&͋S2@k֓?BmT^ S25ڮ nNqʖV}1=h͆|k?Ws%le782a.kG'WL>a FZH!7 ZmZo#^F =w茫OJ>GJSDrZٜQ,=Z+o]$R -3BfJN' (aW梪WXnS{#w] ZuL104 j$?`ż8si!26/3ryhq>w*8D_'}i.?U~k+Xuyٱ .MTDg!Wi`Y51)$KW%6*2܎ʼnX'H.N;3$?+='e<̘\VHNvq|cq}dxGkiL'9@v"V}tcOX xpi91_codi҉xhiAu@窇8<a̱778')O!BQJ6[,˹fl3diѶ_5,9Э6)bUUi ky77"8[ڳ;c}e t[ãzF[`3hC@b=:|2D5UV e4ZîyehO61BU['s3:^ so.;!TyRj)i1 5M]g(~ͻ@VivqOJRɞ*Kq{adu@_Ϲ!e.+lj|#P%z%;$oce FL F}#L/' RɝJ=W4q靗P:Z /Y%CK %V+4¶R}㣬ht;wwdH3Uub0-IYX>]/4lAGhK>Hcu]:`Hr,p @^QmpF4 伖⑭FZ'5P,G%8Vӣp[pMD+UTF] -hu(3^C%8VP^n|d\e%!jJdRqC2nЉ45KDyN#Rc_ur2 4ټBggIU*6f4e3- 7ʷ=&Oڢz!`8_k{lts6&-鸵 :1ȪU zoʫy^H`칵6ui9swl;Jq ZM|NJU0H(#ga{9])Ax&onƶ3]BBg :u DoZPi;8- B]) !:4XF['`.JGʮ\nkވ73-̤Gc;tEEC|~riSA𕬻?f0-"c^QbZs@,JΌe݆0|ndW_^;х7KhmQEfd֞RŜ"LsJ#JOQ0Ȫ8%G B5m~PK@jJL)hJqtk#/vrdYY$NBm*}i!̢lYKSIFrU=v/[-D. X M—t»$;N $?g'B=ɨ,=3 M~]t-m!gK'+.j(i]3^Q=x8Y@)g6B-x#K0Vy] 6A0U_,+ oxN}Ŭ8e^l.W"Z\Tks 6 0k+#d5E)?zu.V4nO mVm<7gAjNwK>䧺Zp=>ND|IR+Pޒ5)Ou >_JKbYSIyŗ/P)3Mلh[3@hmw'PfyΣ(͎-RXf+ZhsH`&ʘ: 42/Q4K> x4\ {m:h\n2lxR +Hm9.vSk;1략>PB@[K>6-C/&. а;ڲLR 3O"߈"wk0pءY&%@Q@AK+@: 6;$ :p}l}. Pl5Q[^j]LQ[jsc*ƥRS55vd-~]飵`Bxt_Px(ؘ ܐҡу3i}faJY0\ٓZS ;):*@fJaS*I&yˉд[A6Aq/t9>Qk`7B)Ѥ1ZtKʩ0i^_2,2]wЕ-]wnַ[N/OXG]} TVjQ)}}>R{oh ]?.5.UG%Bn_:]r1GXݘkS F]$Wm(##Vv9gb{o< ć- 75& x}_kUIя ۨi=Uɵ='ˆ>j4ބť?<4` 5+P^l(FWƃRpK7eR'oG 'T:XMpa.W}i,Jӂ׹J!|Dmrۚ_ny`-A:466+$Z/GsHw|R%nwHy55d:K9 VCr7i_g$grV-,tLE`]GZiWV)leCF+L%ĈQaxFO)i:tg W!v&2f*:dVM))80`"~ ACZ͜? [: + B ࠯)[x?!)t k1>ħZK|X* OWV^>f.5+؇>wdDYW1̫YQOLOݐ43 Ŏ(y-bDxBxll\\p;/[X`JZgE5^W("?GǶz){$8-Iz7ɓZ7x@0g:;*te4#䏥Uȴ|L szVd9%$=g3$GPaΤ'AmgR-[?&R>2˻6[r z(eQpCA[+ C,?9gz9l6@8]Qc[mfTWa_Fؗ/bMñ2_2i!]ka1AIE:>0a8__|Q\<ӜN?ŸTri /t>"x$͑ @q3hY H)-2$Mwjx/ұ '1 T M%8C><` #tqޓ CK\ I1|4AmYxrϸ7%vpds L("t\9b;A *]e0:J\ (JLAIrDr(R}Pv #Ea(ȪdjJߧ]ܵdGJrq7tԍb.H}~8yW\)Vڮ͚$4rDڣBieW Ϥ @"티L. M@R[8Ȁ]QQItХX|Ak}28^<[`+HS9H𾫈iͱ3'[ 6VG+DEg#uR:_*'kh^{G.y0D^p']!)DЌ8qð&R;B,LX@q ph.Y-i|)HVi;3OQ!Z)*oYuPUrUY:%9=Qswu'(}cN9yY>}wÔ}o υvgcX̒3ǻŊ56S0qNNE0 ŨrtZP4X:0tFGDU)k_x^ 2M9r!L!!'O: 'zBAfkXJEY4c4CZP(3ǥE/;m ̟~y%uіF$}wGa3roJP{~ (r(hX[e!% &Xq[#d9k{`$;l@$ÇH?U!6e{xpikxHk<#ߧ[;\!!Kl[bm0;kc$z]5EM{wq^,85GeZpjN_ @i 3eOuDJ#f7 bҜ7R(v3agҬ9H˹;^4SVDR~W-fU;Nh|.1lJya@/Q)l]7@Wo4OC5m[` sȘE>F+g_~d>lDsuCH@y Lߓ(ВU0չgNa@pCԓgk]%?7Ǖ2B}Q36?NGE%w r٤=&%(Bd1*,_KL\ /-*=4-!}AչS 9 =TP xC.gʤ}+!Jd򦃋mn2Ks9-^|r ZX hӠ8LO1}ٯv}t **u3^n|(G͍WZ1VsElQd|쳕]p s wa!,]sZ-u8uACh*P:w|Nb>3u8we>|irU{HoHJ(d'K p 0w>d'm \,P0U97$iC~yX MiaAobFukZ;u^S"yfm2f?e+T*π gZ_@|lojhWڵ*U mJCm X9ÿ%,H&toe =7h)sو4^Wy/.Ud8R nA{$#h(o)N'4Bf7̦w=: [aFdC,O7q*L9PJ~C~Ԓc5?ٕQ¤ aypT8e#o@5G fYN͠[=M^䯟O8/}5$Ѩqy'?QS/uzk5F_u"X7Lq*(yvĘBcc*F蟦\+~2$Bv|wJ=~z;)s\@eDlF#Lå]D`B4GI4 "eU:;Oyy! !k–,EZ**uskZӽ#6Ж'OHtAWa| -eD%Ƚ ʎ]]YxDAsƗNo68IFfԛLCo2{!8XrK<.:9 $WhSA,qyf%c}݄*zI*1ѫ?H?ʹ)po msh'((1-L~g/&ę޷1@]z",zw>1PsBo9. @U)InOfGިMZ8lu\l.U ~TL}DLsM",6OJg J@=o]\̳_wy #~k7:' 9Y z.=Lq * ﹇1f췕 OP93#5D۽rrE I1xO Y=O>^C`\om3F/'rԅJL$0 Ay2hAf+D[-0^4&Cx36] 'M4Þj5)I@a>_mZ ArBZ=G24}m+O@BY̿ l~Io:FQ{AkUm^Ylk}F7%GeR6L-[6#L$@ns~!]s)X4]Ə#vS/sǸ@?#\g<(2ޖ;lc'5: YZ