pki-ca-10.5.18-23.el7_9> H HtxHFcW ?*}}`3:$\L/ ;nN?`}n=b[#8f32d2193b0c37fb5668a371a225552e4d31cd23uG,QØmvFcW ?*}}PdezQ iy3H_K-fڟ&>8?d   E         $ B H Pii i i <i p%i rixPi]iji08 \  (A8H9:%GiH4iIiXDYH\\i]i^b1defltiuߐiv4 wxixiCpki-ca10.5.1823.el7_9Certificate System - Certificate AuthorityThe Certificate Authority (CA) is a required PKI subsystem which issues, renews, revokes, and publishes certificates as well as compiling and publishing Certificate Revocation Lists (CRLs). The Certificate Authority can be configured as a self-signing Certificate Authority, where it is the root CA, or it can act as a subordinate CA, where it obtains its own signing certificate from a public CA. This package is one of the top-level java-based Tomcat PKI subsystems provided by the PKI Core used by the Certificate System. ================================== || ABOUT "CERTIFICATE SYSTEM" || ================================== Certificate System (CS) is an enterprise software system designed to manage enterprise Public Key Infrastructure (PKI) deployments. PKI Core contains ALL top-level java-based Tomcat PKI components: * pki-symkey * pki-base * pki-base-python2 (alias for pki-base) * pki-base-python3 * pki-base-java * pki-tools * pki-server * pki-ca * pki-kra * pki-ocsp * pki-tks * pki-tps * pki-javadoc which comprise the following corresponding PKI subsystems: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) Python clients need only install the pki-base package. This package contains the python REST client packages and the client upgrade framework. Java clients should install the pki-base-java package. This package contains the legacy and REST Java client packages. These clients should also consider installing the pki-tools package, which contain native and Java-based PKI tools and utilities. Certificate Server instances require the fundamental classes and modules in pki-base and pki-base-java, as well as the utilities in pki-tools. The main server classes are in pki-server, with subsystem specific Java classes and resources in pki-ca, pki-kra, pki-ocsp etc. Finally, if Certificate System is being deployed as an individual or set of standalone rather than embedded server(s)/service(s), it is strongly recommended (though not explicitly required) to include at least one PKI Theme package: * dogtag-pki-theme (Dogtag Certificate System deployments) * dogtag-pki-server-theme * redhat-pki-server-theme (Red Hat Certificate System deployments) * redhat-pki-server-theme * customized pki theme (Customized Certificate System deployments) * -pki-server-theme NOTE: As a convenience for standalone deployments, top-level meta packages may be provided which bind a particular theme to these certificate server packages.cV}sl7.fnal.gov%'RScientific LinuxScientific LinuxGPLv2Scientific LinuxSystem Environment/Daemonshttp://pki.fedoraproject.org/linuxnoarch=mL+1l[#tR#1J6 _ S }F}F+ g%~~[G7(b)[J2 O,", +Bf PEGl]P'n,1{{% *S*L$,kI,A,:+A+3&u9 ;#%##"vSy "`./9/]   Q q >#E/#+{B/'m)H nrtknvpyi  *L*?5%C%c*m;c=O? 9%9RU][  T \71 0VCCF6CQ& "Y"\><bc q-  dF r- ~-d>Ed,g>aB 1"?%I7Px]%A큤AA큤AA큤A큤AA큤A큤AAA큤A큤AAA큤A큤A큤A큤A큤A큤A큤A큤cV\^2cVTcVEcVEcVcVEcVE^2^2^2^2cV^2^2cVcV^2^2^2^2^2^2^2^2^2^2^2^2cV^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2cVE^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2cVEcVE^2^2^2^2^2^2cV^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2cVcVcV^2^2^2cV^2^2^2^2^2^2^2^2^2^2^2cVcVcV^2^2^2cV^2^2^2^2^2^2^2^2^2^2^2^2^2^2cV^2^2^2cVE^2cVEcVEcVE^2^2cVE^2^2^2cVEcVEcVEcVEcVEcVEcVEcVEcVE^2^2cVG^2cVE^2^2^2^2^2^2^2cVG^2^2cVE^2^2^2^2^2^2^2cVE^2^2^2^2^2^2cV^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2cV^2^2^2^2^2cVE^2^2^2^2^2^2^2cVE^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2cV^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2cVE^2^2^2^2cVE^2^2^2^2^2^2^2cV^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2d6bf5823021651d1cb53350adcf4bb818ac77768f5cbc43898ad06af1036b00e6a79fa0131e9de31d82b49f135fbdb8c1d19231dd70a5da7b44dcb6744ef502f8cc4d68b9f6f2d9f12bb1756fbb9bdfb34fa89f0930187032b271315665728150c582ecd379d442745e4dc6ecdb90cddabb88b8105da6d2a3afcaf947850c0fc11a3352de540f4e0681ebceae86ef8e7e17c4f8c0f90d500629111f5d265f25386fa50072f26ec25460e3bd969ef5200c3454c02dc9d2a1e84fc0cc57eeb3835e785c0a3c0f8351c3e3c8dc0d0cc2d164241ab800c121fd3c40147d63cb5139f276451224c5d8227f40359f7d5367ab5c27bffa0d734cb4a25ee3b31b8ca77da5a1829bf1b3c216ae4c9d4ee066772bc7f5afca577935c229d9bfdf80d75cb7d0aeb78397f439d16d5b530d8b81c119af865c0898e02a33b17d28d0bc57ae9c85df163a6cc55b9c0e1f32f2a347d19c5f9eb02f3bd07cbef7dd25c8d86e3bb718ce6ab10819891d1d8fde23cd1c90b6a065c008b7f7fb43733aaba5693b054182a158a8f0949c10819f646d42e8cb710ebd844362d97695eec5a6a523c9718a1aed1ca83010bd139dcbfc328398007d959d275a78df0c0208c207e960ea669ca55436dc0723559afae54e63e48d826c2ee0ffd98b3233b8c132be6ea1540cde549ab16a5ee0b53ca839bcc06b9c268ac7be7c8186aa4392ce0c663460c019e4cead500b0c90a7da7bbb8602f999170020f81dcfa03d16a4a4d9caf259911676449f0101595c93b29c3402277811f70fa75237715687fc5dcdcab36f7a7c8dd72da64a1f054f16eb1ae49493bbcbfa138127db6a09fc946014a1d137d40ca2d5c27ed767345475519c0b68cc96bd20f23cb2045c3829dcc72c67a4f1a133a7d155ec67643ebfdcec431c7d61966510fefc3e691ff14a09438257c5c23fe66d54bb14050386b6df46fef8e6214e41579d09c780d19d242741f29c2809ef973cefeb760a2dee6aef9a244f84690b0e80d22f419f277d615a90b129483aa669128f62024c52fe492fc10e9af7a7f3dc2f08daed6d3f5bc13ce0c8bdda30b85f0c69a57b7994670aca2abb02cec14f3334dc5a887b85bbe03e19202a045111343c40a9d68f40546ce9caca6b76801039b97b1a2c53cb0975fd3f31dac9584a8a955704363832241c679cd009399b6934aeedec0b3755f83bc09a35cd5a292cf19b7525e0bffd207c4c5b122b085f9129e0470df5c37cc534df4e30ec140a9406a2850767d3c20dc56e7c6f0ba342130b0160dd473330845cc80f17f5ea872d0fd5031d37b0ad740db9a30932ac53203a46c4e4fa701f891d74fc185fcb8989f45d28cbcace48ed94b1a6cf7171f5ebe150102c2cde343df5b89acab2c2a6c29b9a04d448b089c45226bb2cf6dad3cdf581c3af18a90d6b911ccb66c7b2179a7a75fd1bca75eac7d894fd5cd1ea75a0ed89170c0d4d1580016ef8436ecf4e619543752303a3f673928e2839845976001deaec22af953bacd3b72fe5c49443a185a898c26d1e3ccc9375d6256e77b91817081f349ed0b5115ce58d43c2720c3473e5e4475b616597e5ca45e6e816149748a4c7fd6443ed8c585e675afec1f5317959ac93f9de3ac67f7ec677ec54d3e5cda612b21511aefd19e338c7f06a05c29006d6be1f16dfc4891efbc5f8b12d38381041f75aeef95dda09a3c728bac964a8660a1bdde4c0aefb36f1162726bb551a958e9ff0de0333133702e0312e1bbe8c64c60f940b149f3278ebe2f7040e9224cb5d49ad2e896b807877864ae209975fdba39fe55d9dabe5730b830109f5d6bad9227eea0387e9b425cbdf52e9aecb5044ddf44ec05cd32ac643ab96fbbac60177722f9b65e9e88234e89c434a691e079069d37b318051ba08e5401817cf220661cea7c9468dd5bf0c862f246b1d80f21c7a69acf0b3197a11d03adcc3a6bb604040047d335ffa81c8f548aa273a4d3cd67272590ff8bdf5c4ce6641c36030342b5a32395173e93bde51a9085c5df4d300bd66a4eaea68a3aeaa6f2afb66d32d060f4b66364eb137323057b41e15317cadeac4d6d5acb20866e54fee85799bcd373e3e1730fca6964bccf10e8013d3a17e47f96dbedbe367692626e7e482a595b66f3d8d166cf030208d11fe66ab03a23c2932ba6e2290c7c90da1fa7a23214b457d24fb03da037cdb5760e7a8d0cc402d5062ce39edcbc0f3951007855b1ed95d532e0d4ad8e3d9067a9ce3338346fc111b62ba6e2290c7c90da1fa7a23214b457d24fb03da037cdb5760e7a8d0cc402d5062ce39edcbc0f3951007855b1ed95d532e0d4ad8e3d9067a9ce3338346fc111b6b14b9f7733adbd8910b925566c7031f9ef5d4047f50445ada7a0120693e441254ceb0cc6142fd93688a16af692f0ea833fccab83ff002b27becc311ae4c26c91b3e83dd6fd1336b0e2e1a1826f21a57a176e053a043aa8c0c6f2321dbbaa6f144ceb0cc6142fd93688a16af692f0ea833fccab83ff002b27becc311ae4c26c91369297a91044bae9d61a8f61046e54fa9059a66f2c5c4bcbca9fa651f4c5e605ceadedbe484214d4af828832b12d046b1c3fabd6dd2c6e92edbd7c299c963a01a6e93e3ebfd7fd88da8c1b24ea4476e495b9ecae27c557ab8c7ecc8914601f8fa66fcdca8b12389353b0dcc4d49ab89737b638a4156e04ae83b7fd7ed195da17e97415f495943ae49ce5674e09006caf13a8afd978884edc44157639fcef3a6e5dd07496ebe2d7f236624fe4ff9ea4654e533cd6f136e276f185bc4ee75cc6a63208f569c98c16c37c2fb2e287b55027ecaf16ea80449fed310725854dd848504358d4fe7948b0d5cf868fe9304a7c564127640a6e2aeac5c3a536beb0f30fba963740e1b6bd2aff4d69dac938811dbdb5d5a49c12b1eae220c314482006e9b14803e10fa13c8dfd44cb429d356a3603c079b3100651e429f5bb76d57d8b42d1dfd602c67136a59e64f6e463f78538691537a4d855d1034cf133218defd3a3c286ef3b2ddd73eb2a8e12cea6e1f6adadca373fa81c0f7c414e705ea46f3818ea8aef2e39c84cf8dc8f0af8abb56834c98fe36820ae871266d08e5018aeb4dcc521c9c398e166d3c99707aa883a5619dacfb98c3ce7fedc2a8702e188ebcd349e519f65778c5af41e0d14e2de103ab29f00cb99e1904b3bde1395ec5fde92c1390815093c1c33be89fbf3192f503fa8ed572a7d3719461befe87107a42e962d4adc3b45978f03f3b8724c1b89e36ea16e26e494b65e240c4dbd77198021abfeaaa80f6e67824852390447027d20f4455701d32e17ca30d2bc02a145d5dc335c5dd2484024db29aa2029e29e5c87372d20e5d57bdc9eba046ba525571e512a8d55ff6c74db2c9f816beb79eaa11ca44d91ebbad302da7e0e139aa99c867201d7cb2b5b83fec0eff7472964122f5fdb491916fed8ce15b3d179a90dddae767695d7f153f1da2cc4da0c4aebb58a3e85d0ff03fbddd02a9c8f28532f28fa8729aebc24e02c5ae1bbc67962f899866ad4aeff14c6d9097ef74a62b0db13c62b3b948b1910f6e156c5d656b3d8ae6e21f777e1a1dff4def65a9fb7493202db1cb41721801405498a15b16d373fbb8fd98ade8bc0c64e734d9b60caa3b7b41fdc8ab76318617a98a8a72661aa99baaed16b2a895766d878506c808d142b9c564fd9f90bf9f7423c5bcceb5aa7338ce528d057e1a55770f4f47a6d160f464bdd2e5a9a15b6df37a15ad28ff8bd1d1e379fa22a0a58b1462d1cb2bf6f91c0428442b261eaedf631f22563c6975207fa0651d350c9aac2064c636dbfd059a1c001014a7a57fb30afe2e8161acff9850a5bec7b0249448891df209ced0b38cae1dfe11790a5bef1eeff08a5beed53ce599b88479fd2a598a73e9e386c42d10c44eb6312f27403dc03ebb5131110972dc559286d504459480c6f30bc1fae30805cfeecf5a44424819425d088599d31c38f93071a8f888325055d9fd241c86a3a158a7d4ec5d403a32df2ecc86fe1aa69338a4a6e06d2d643e34acba65ea5c001f851daf5dffef55a1765bf7f3b0ca4bef450a8f796238b36fb8489460501bf94e91f1dcf5fafc74904a2f68124a9f013f60bf839a93264f7fa1eabe952c15f22a6e370963c902ca978def728703aab9cb9f2fb3b48731fbfe760a43a258c3785c84ca4be21fb50b0842fb84ed2c8445b5cf38f87865bf1d65ef7a597c15178cf7904e805547fd53ed053101f654722a90c7c718612cbb600f0e746904cca639c083ad44adc61d3b7602633f62681a0543a4576518efdf11838e94dd637e9b7f48a5c9b4e2303ff44b354cf3d8d22c802cfadfe0dd0334aca848e8984b34e92b9f696828891e4f016817ea2689a5402bc8f4f2cb96354c9c14c3bd20214668cfca82e0f1f4c7b29cf0a9749962f5364222fac9a330306af9dd905f0024aa5a1e1561a663ec16fd58a28b0619fa2cbac29eceee05b20b01097185ab19ae9d807e384a743387d27fc0a8d6d897676617cb203cbb3d413ebd6c093c27b4e3b4e86280b85d928dd21640e98a6fbff04f6d46220c0bb33a1dac4f66ef82fbb59b77d20640a54d8533590ec3bcd1a15d8f8190a27a687e0f9743e5422b91e23cd3670c0084032a94a645dc7b21e0b39090e6c6f6097d5b8708db4223a9313a6215b2e5fca1c539d4e5e3477fd81e23e2db0b4c4e33b16d4d2323e17dffb0656c598561f9d91ec04eee8f89ee8bb42b031bfd0f2aac1342aa2a5ab324f8f6181711d9172bef5dec9b4e1b2d5cfe69aa5aebb84a5a1637aec3ecd0ec88ca2eda7fb5f6bb3e067bacd789eeb5b9868e47eaeef88ac42301d77271667035e5ef559c4f00eb3e29f8dd363c43a4df10efd9412fb5f45b5c9837a9e149d0888593569c4969f51efcd61ea6abc2164637a032954351b16d51241c0c5803f12712b5043db034b4fe6ec928d6b57dea17970f7e3a0258e8c04d0a0156c19446f69062dd069ee1967bd929eb643811c199c1d988747ba4d5689f9167fd42a8ed07039e28dbccc4b744f4cccd469e8f3bbc3d5350d5b2c15101c9869718d0e248a6261a34300f064a0011daf7a7b97fcd57215b937380865f10faa16912e9cf7fcc6c8001ed5ccf7c35889765811a449166c80fc6b7b677207fb040d9f7de00541f77aa74747b96a8c199e368a40ae7f8cf803c974c90bab10ec4d6af8bb034bb857d35e21f13a766f242a999b72ec4530ecb668be6082ed25f15b4b50df28164dd762843030bb98e81eb93b3d1cdbb8674ec4c8dfb3f600b90367bec83498d9724204d8e54b448583d870a563a74d08f05f45fc39626de7e17f2b9dc8ad6ac85e7b3d443767e183cd06212dcab461069d6b7456f1a7305335ec03066f3ea46f1d707a59830dd326fb2f2135f687984bb909cae523b0d8fc8aa095e59c31e5b1a1ab748de837cc47f311083b3ca72933082f4a4fcf0258b724d8be2bd7c26a70a7ee57686804b4008d4855be3d7fe7337ae43a49225c416f3a0fc11bcc7e6d5089bd03ce69902e13ed9208464a6a1d9f7d81d4795a672195815118e2584314098a023c3f249c95fe0173d9cac292db36550a3fbfaad2e31234046232cc077308a08e1780507c2549caaa07960a3bffd988c966ca03b37de84c114081aa4b31fdb94c7e07b8c00e726c312cc833e259dfe0ae3aabae0cce1d133c3004203650fb5a0a17375f1c598dcfe22d7b8fb04299ffcff251bac5ce33e8319ce83dd0bb7d21aeb387e17803d3e8db9ae1018fee9b3f1400bb8f3b28b996b1bc599f09f56dfbcbf564def419d90fdc71eb17056a10a6cf49b1f62522a0f22ea1b12339ed6fb418b2e1fe1a30902aaa70226c4d7821ad58abf7b6d60a2b580a27813648843f4d34dc3120f48da361bab625d830ff8bc6c8ad5a793937f191b8679bc73170aeb5dca7109bfcba14a1e08eddd916dc62f4a693d3e8e45599d04f399102439436bceb4377f909c3f66c59877a083a5fda7898d9e0ac8b3e9e81887ed077758d05473cfcddae2508d7d2c77bae9dd2feb5d5c28b7f1a2d3a7036822329fec825a2f7d4b33352e9bdb5c8a670821dc6938a8185acf80285dd9c95a0bb6eb9c601b49660105d08784c52aa8ac453ce9e2faecddceadc43c59f45f0363e516facbebbf4f9dd59c307f5d04cc31587a7ee46977c98daf2a1507401550a16ef1ad2fa8a713ee85fbcea3e746220fbd9f31057112ff4f210054a6054984c3a7bd25be3d41744abdc2ddd9b3191783d460dd792439ca7f920cb7781404a4e41afaed4c27eb4788b4c3560fe15098927b159c3e26fa0212e2996d1e54db9a388eb07c1e94be78beceaa6ff0d36e3d5162f7dab7ad023de47293cb877ab808de670f28d2bd6499dbb2d357d43afc7cd23d86b4bdf3aa6974895bdc3bb4a3908363d61c0de2c934c1d47ea19483de74591876aab55f72cf4dfe9c88969bbd762c45a42b91b1396ad011b51fd338882a6ab602315cb7bff682ca2f5a26424d7ab5ce178c5b9e9a25d855ffc52e1b5dbc957142da46ab2e7ed49d41f75099bbb3998283617c5f590304ec64602cfb558ee28a6627008f27dd6e39d2940ed9ca211b2e9933622b08eb4dc4ae264f33952affdb1a2230e2ae72a904bc8e884cdc3e881037753f8918497e4ba574e2ff864e763a606fec3c2c42d5dafe7ee2df815e74f2bf84431f262525b45dbdbac0117eb16da3dbe25589ba27fdb16be3f624c580af8dd2e8136bef1bcf4019b9e820f9fee1ca9617df39135b857b478484f1606a9e54287223c2e6e8d0ef28e085d5d813a55de04b13112a80b9e97ef0a3492fd9c2bf504887110842ee75e18c114a2f01707be3862f88641212046222c357f82ddad68d899645f30b9a0e3411d9fc2f25ae2d5277a8ed29d19043a3b0fe056eb8d8c9a6ae446a00170d442f2ecc7c888dda6869747fe8e98d26730ff60f728d0e080cf63e44ec0bc72932c375894c729bda2b364a1272612c2005dcad021f513cc99590d3eddcbd0943208feb340699371199f997cf783a220f9ebf0c577f5211d831d28470392d0197189f131ca1a02c4ed8f581a131ab78fed3c28ba57a9b787edccc00ef37affcc97ec2533c8c7da5fe36aebe0ec8dd591db70d50dda2f299e8275406d7a9bf51b0658585a85feedae530189b95f4ccbedef04351ee61678ac468a29a45259542db3f0064ece7bc6c142a5c837a3f1dc88f8cc2e6060172097715954ec0ec652be99031c4992cd6f36eee6c911a9ab190ad2b2d7035c3b6210bcad1b5bd0d61ca737bf71e916f427c8d31608979a229f9453b1a59f1d9745792e11756f8bade632479f283837a0631512f8e5bccfd1c96626614cda4cd142db5f002bafe95c0be41773d65be80d2e4893087bba63a5f40732a33fabdfe321b102c6ac91cb5a71f653bed7ff0363414697b7188d9bb18c6f876290819145fa62b01487d8d336ef7432108a27ff2dcd1c2a1f928d33de86710f05b5cecb5d841822f94a7c87dabfbf16c2140c606ff3a9be325ad994e8bd6d02323c345a7f33b818493827c28b14cbda8196220c04eab3503e0d4a472ba33f7e7bb3f70f202bdd1c22e5f4c009aafe30d35304be91d9cc0df86fa67186e454bf11475fb89e70283aebd7d3b913baa865e57d465418ac32295631ab9902c09334fc549604ff49152c6ab93e45b2d09989ed85c9e8de26953bdf3a4b9385164e6ffdf7ed7d738e1d7d39cee2ab60f6a66893c10e12c81c6ddd594901db8b5efddc795489b9971b83de53181631fafa8a4ff4e947ecaba4221b793786563b3dfdcd62f39e7ce4cc095102ec2af345a2dfd680dcfbaa5082bb2aa760182b34c5011b9d513f45561ca7912338109e1f053dfb2eba6c189f36043477b7e9c5f6bd93049e6a50aa4e2ef845c2ecc57b7c6af0b530a0483ef356a6b25403c4e7be438f97bc93e0db6beaa8b18530bdd0437eaa1597c589514b45e8d0b2b37490cb979956f60e953d627512ccdddd9603422e3a31e8c7a198f7adb725c2f5a449160bacaa9e40e728469050df5dc0481b3b19570152a01ee8c0dbdfcda5de202386dc5631c74d6d879ab522218c9dc73f6b56b65e84489ad6fa0c00b56ca99d16efc037493882bc2a7ff8684d7146f46f9c33f878ff7abaa21a236e737274c027ac570d8066c9a1e27d543385c08cc6e01c9f3970be6e184bda2b33b8b7d12c29844f5dfc4dc0a76253f66e30d55ac7cad9d54fb5ee25cfce90b2db8f1bb5542439a98e78f686688192339d5045c89a7c444ab265943e29e4ddb2814bbd2e5f32cd314bbad9a4fc256d21388e37ff2063355cfe40fd08e428eb00682c5b7121cc4ed50cf3ff83d76d2f3593d6f517835d0108bc192391b370a734cdc2f360b4607c571da9d704c39ce0b67c9ca6202bbcb92c26f338213043e3b36ab3fcdda487aca0e763cd5fbdf40ffb73006e3f1b38cafa9b2e48c19d616b701d439c6ecda6908a86cebf2bad69e4ebd837f93f4065b4d5ca11a5c0772167fd9769349be3ad33616e6dcd80b9daf13f9dcaf8ef6bc30f9e52df3da8ebe1393119b9b396c5fce3aba06387028fa21738a84e5d1c9ea15e75ff88b8b61fcadad11071b6131243666e2e04fc44d87b070697da0b91df3053166ffbad3e9603e116474d44ba83c56270532c0fec2d29862bab16692a5cb07943d9ac3be7384125bf8a087b58a6ce9af014875df6e9c91933b0e915d18825853bfa5f6aaa24d91957003503006412ad601f7f6e5d950eda140367a30f221c31008caf4c2712002aac3a387a37a98578cefe64dde557a4e36f9818cb66b18192034981ae4b1f5f392384d5f85bf6b6f562f0533de650daadbec4a8dae34fbbb56e36f87e00e507633e8599a4a9b78b8a244521bbc3a3c1e46049181dde51098bfbd4aa1f52e2ec058f907286b4c87c6552b361d06eb8a0a4b26a327faa8d2b6d446ea046a8414183e0b21a470e83555ab6aeff375b5660ed4cb0848ef1590130b1b331b1557bf37ebc4ff6e1ee9d90dbcc3cc48b5ca5bce8ed7df74cc4c2381961c9c9efc99efa0e427e7e1587a4f6673040246e3f1b800ef36d9dd100432bb957e899c5c37ae69be80ed4bb982d2380769057cee6067962b4ffa4b2cf40a6e5a732493f054bd27796ad5d9efa55bc8f59fd674f2835d9c1e7b625fcf076e7817d0d08c6fff38325c95073dbf9cd23ded73a65a8e569270b03850a6b9a9eb862bbd4cc8188e703f0e05ce34668aff8ed106f92206e688e301a625a06506762f07a9aced94c1f6c2f093d41f08778e8ca9059c14f314eb6d925825f834405c62ca90be20333e09958ea265ef5f6c000c5b62200ededa13f8521e87f453fbf48d6083be597d8a680471b7d41d1faea8fa0a67d87b4e3b1ac73cb9dcc6abdab00609398306c79ad2768adf66a6c9c076fb1c0d411571546ebb06736357218e00172e8ef00ecdc92587e712d04091e7a5f7805c2dde8e1cde90c570948c508e1e4294e0a679ae5323d68f551008fd9fa0a70929e47b1da01f19b724c840eca1d58cd30f4dc0b859763ae3beebfae87cd34526fc2eca66ca591ffd53f81b025c989f94ee3622fd8bb54341da3aa03208fe8d183ef96002869cabe74e3c0d81b49d3acfa70bd9f087cca5f74ce5bc18ec1ccb624f4d281bab848e1c617e716e922028fafb014f7e5f13a3877108c3a7bb4d67dc80bf0bbbe00134fd976901defbf35e10746a7a77d6cc11f88850bc66c047b2005f1984deb400e1a5f8d832c6da04d11caa82e03bf1d00c372c789a7a437cca4893de17d17717535ca11d09774b350d4b963d18d0c3ff275027f968a2025b3a2231b0e1d136dd67f65ebd7933a7291fb2809e0cb0c9f6b5153baecb3827282e259c1dea0192efc2b69481ff941ff7247846c1cab4d20792509907eb91fa50c9135ffba3e38a8df976b6646bbc66608f845d18bbd167af2cb621bede3bb3567b41567657e76727f9791934052c688752bd07d4afcbd7df95a9ebcaa5795e30f706768b4012c802aaf1fcd6e99814067613394950d130f61d06f25f3257278f90c791ffbad5b4ea62bd5a75035961619eb55973afae64b64b9130d3aab85b28d866416d91896845f4607d2099de578dbb060ddb83ad681e6ebeb51e184a4205c01dfd6652544a65b8d1895d26ee151f79dd076467a2655dc6a388db93697bb97dd2f128cafed56e22d589cf18d3a8117b8b82ec7840c34a149b833038abb5c1e08d3d1a22190b2b11debeb23ce1788f781d2ee4855bbb5b5b199bb08462c43558f7fdb0b4af9b879662b638abe8f56bbaca7f27d090c6cd68949a7f2e6dd41925503abf396908ebdfbe5ad1f2a628ac0fccff016e72febcd204a038d3b1bcf00f554cbe65b72a0f5c6e785d27ab6c76f9985162e4215c5b0a05c560b7ca085d6662f475887ec86730cebfc26a446ef314e84f39e2a916584c14a57509f6007d0e1883246d746a8f0544e6ed4a33dec754464db0852baa1d62df4b1460e09c277a63ce8fcecd84fd5eb127fa3a532265fd8ec62aff59246cc3e0c538d6a720f121ec7a6c61d2178a7b914c9d7aac0fe2d0ee640061c044bfd8a20e46587ae276332f2b4c58a1a4355c85cfd5b6b37aa2b11a9d50b6b0c7a98bfaaf9467c54a80a603c94c292eae73c5ae04a6eca92e9cefb27b28c70b9b6575b8d020edc0182c327c2cdc0a683ca9f527a435fa54da421a75f0fe67d39eda25030c1dad75431e7bfbd216132b8faea363a675df98f0b7571dd667d86753584d052c6780fff621a2f6010325e8de9871d68d2d176f892fa0e4d1714da27e72a8367734d4a1d8fac65c88c70591fe094e5cadb73b5437001bc3a9775233b9e1a6eb144df5454258bffc3ab3f6a3adbeccc4ba1618b73dc55bb5ebd698940a848814cb57cb1f140b0cc9a2bae31e5d9907c272db063731e99ea2be881be14106a43cf9deed98f1e580314927e2ac05431f3609635cf9dc1bfffee3d14836e3b5620b8f7d9e5420275dfde55010069686441ab85191c777c672e4c2fd5c43e9fa587d87623d3ce557186e454bf11475fb89e70283aebd7d3b913baa865e57d465418ac32295631abdaa01be372f6428157f7767c6e507f03d8fb0698ed26ad8764efd8e3b6ec1b1128b50cd72eadcd56594e2ce0cf4a266132526e7735f8d70abe796dc6ea68723b9902c09334fc549604ff49152c6ab93e45b2d09989ed85c9e8de26953bdf3a4b9385164e6ffdf7ed7d738e1d7d39cee2ab60f6a66893c10e12c81c6ddd594901b49f79539224ca82db1a18cb19f706b20bfb31275e009c30127184199ee28bab665e6b28eeb70fdfb406fc715536773628274003066aefcfc27da268f50bc45154481c944793a119c342103c58aa95667e9c067d65e0b8d63e90c24f32285ad9bb97edd4626c9f3fe213675e77a8b89dc0064e69d17760c49f539df7f6f264669c1f516d640fe9809bf2e63ceb40100ce610aef9fc4ff097abf5e513554ab3aced21e85b958da061a7d2de3f534c579f55a783af34ee1f115595c998f32f2fe5b16de77414be3c1dbe1233334eba30a14bb7b5fa3e31571f6d6219dfd34f496912e07806d8b1f8a1c0cff9f42e6433837f7f2f318a9c03ee8a947ba0416590c87e3511ada3b8e3dd85c772c4fa857de75a0d9aee3a4f3133678f99fa30519a870f7110c082dfcf32eb01c004f6e9d6c1b3e108984f9177201408040b10dd5aae45bc58305e847bf7ba35c3f97bd413925c7094c9cb9e54a9c825367c59068423a2d871e85613498231e9f4f83f178ce9cfa85da466376567cb38142168fd804c0067b93558cd2e0d9e8807e92def408b8eb3efdce5ca51d392e7bf06b7b7d5aadd05227d28bfe1e6fdd68e2c7a8f275a1d359c60fd4f3a95078c131ccf6a47b40b799d9b581379b3321c1591c48e9b3561c137a48c447b51a1b2758a7728d57dd7ac9cff1db3a58000b9c1fe32d7dd59631fffc1d5425dbd75fb4f5e99ba7c902bfa413c7237cec4bc0cf0f59f17d1fc4959b7661aa89373efa9bfd5bc9403d82743aa179b0610a98eda4b028251df592cac0cb95d8d37720f88345d471da63526b6ce8a0f19f9cf0326784128890105e9bd0ac1e913d2e42d5c01cd9c8f8574e6d7d9b362af55379c8abd0ec8296f01340f2991eb274effbb0943d386716df1fa2dd0fb957b3f79b13cba530f693b50f84234f3299d45e00fb4be60cd95d2ac4101279fad4fdf9510d2988c139ef32593b2255d74660095f38321ff6c300555c60045434f12d9e68f6f28896adc7054788724bc34c704ce8c1e2f3f5fe90174ecefecb37ebbfed41e030bfca7ac60f6739e123478434534f5e60fa3733b81177e63fc956191312c831f77d80837c61771a3d4d6d646ae0ebd9de19f2d1c93edff35a2fc6a00481a5b3919bd6883f7619d1a05c62be002110032daaaff23f0efda24c4d4e472c9a35934a2db4ed4f5ad94b9eadc689b0368ccbb1314b5993c9e33ead8aaf6c1d937b7f500c760c15fcfbd8f7ef74c9a76397bb8dff93ffc16df95866d15efca4e9bec6b29c6714e527c0f1ead076eb9fc48f233c3f337f958d4e0673ed79347caeba4b7e7ef85cf92a6666b9a2f4ced866ab018915108c754d5dbf4b92bb761d8f519922d866943cf5d07150192ff373cca89881d43a3e68d96184142fcb5391ce4431630f1217d65cd1f6a7a3b5a4a63c615bbfc018d5cf5c0e8448edb5e8a834506214be78b70dd45bf3e5925fa3fe0c0c6410c017cc6e6ab30b4e2aefcaf4932f96eb61a6fff9fa4d55de821b5183ad89a039f5628db4869bcf4d6ade0a422df2c6f8bfdfbaf7fb658449d365321112f1186e497a89fb426e659391a6ed4a0788280982337207ce1ba6382cc461026e46132f6ede248baebf4fa9223e88ba83c3aa7ba193776ab336d42955bba1fc047326d615d332a5140e09ccf4b4f233fdcacf30f533b5f15c9ef7826ed14382cd31bb55b743ac7dffc03ad234d2d5566157b62ffd2426d5cb6a44fbfbe381a1808e529f26765ba9e05e56b3b06c842124bce70635f166ef1e609e99f8ba41844e9faf93bb7a3f81d2e8d8714f4727757ce02e32971f76b129fd97deb4ef3d565c4a58d387d296f5e2ae411ca8b5ed340056f76bd372ad23f2cc8c24febb3e836cee9b377076fc3934ab0df691855f8e19aa2413d7e54c00303b70dcfd28b0708974c470416bb08d86da68f1f5dbecb17fbf7e66f136977c1b5fff486b93d4760b608fcfad7d9e567f0283bfcd35006123d0fc54b0a0a0373b8ae38ec35200788f1c1d270cc00bfbee7cb65f762ec3bd80e439cd2efc8b4e6825279fb48d2d87190a75bda3aa29bf14c03eb115a5be6b291f7a9805cdaab6465c61d3290fe63d403be79683d806b12746c7d6fd5ede1eaf6e508e3a7d29023d7bea4db67a2337127ec0e911a346d8c582299ebe6de630789a99949982d29674be81e99c05f9167813a00afbacd30bd0763edf4dd8c10a03d16e92dcc6dbb27b0230fcde072e89f6a8581f1d4c5dba6603b6d5bde6d42f80a10ead1635750c998582d4c85a9da9283aa62616dd4bcbe8900f84d5171f9ab92db0f3b27571fde4562ae3c51d103ad83dc2febf8577c156a6447de30ca5a66f4e26961cf12fe84a11ec7815c19c02f1b793a0e91d7302ce9a650e13fb81fbd66d70f0f3d0852453201c93951888d8c785d218ed49f70b49ef56dd0bc07706e4c421dfa6625e1f1c25cc00f5c21b152f653d90cb879fd1d2d864c0eaea2527e7235f5ef357810d29ac3f21de79c2fe6cac5eb5a0f53d781ab4b78d65a1764e7e7626c31b779a8ac4ea0792e8cfa95001aef51535d7bd3718a575ec70d97531470731255e0f52a907b2d4ce36cbf059bc84d31ec949fdff5ea4c987f6cf58a2ad86bb944e011439a0431c8344fea545a0e3031b8e38f8c23767c6b67f36e1824b1b48f71b3dc52d8054317c281ac05eb8506c38368b37f732e55538534e6ce61784b30d5fd24c24062f8115e49ac49630c5e06fb91fa4bf4e09f2836fb367185d4cd4da6b1362006d666ebae9dadd433785321b143889a46f5b0985ecda1e03bd067b178237fd89e2fdd6b958af8e32e802c52f725d0047f2c67a0435efee12ffa020736bee7e081dc7ca5b84a86e2a68ed1c6978a050f6077448b201d2d1c23e13e38a0df6de9a02033fc479bb9f37e6377b64a119436024d9a581c0f137add81539fe233ca5d947ed65c6cef9a6114fd6ed6ed6f6372e6ccc8e28e611e07bbf8b9c3695734bd4a1533a7c38b8c0696afe1c3949239c7653522e627fbfc8ad866648f71aa19abe71e20f50ddbf20de0d7273f7e6dd2a7fc14ef0693069e233c4243a39a6ace0cf7e38eb0988c7bd2c68f8018e3727012f2457fb91dd9470f0670e3d48e3144973967f7d31b318d8d7135566113eb5883ca541ff63f5a999a97b2a7a32029058010f7b7f1ce9e7918ed9e45408943b8f8bc606bffebeabbbd9bfafd8bd13cd66e3df6b4e77b3d4690ec1d5d5721c3caee7f629bf25910c240dc2f24d1e487e69ee2d54dfa0f74fd5364bc8b06d9efb836eb8857bc64b9264e6105b0652f2e1e4c9d31dfd0a06568238bbf6bc3d58ada9a7dc75a26de4e324f4b798b2d8938a692f25e82e3da8dbdb84b3e646de7fe0f80a185b7c69838603148905e9b55c58db1c3741e9b4fe0621bee7d5b5f7709f90bc0649902c09334fc549604ff49152c6ab93e45b2d09989ed85c9e8de26953bdf3a4b9385164e6ffdf7ed7d738e1d7d39cee2ab60f6a66893c10e12c81c6ddd59490171e2ad35b4241a19558c2d90110e52a291f4d25b917bf027deb77dfb03aa570cddf7adeb90dccd6ba965633c2cb28700fb70311cbfe3e7c67cae417c3c162b29/usr/share/java/pki/pki-ca.jar/usr/share/java/pki/pki-certsrv.jar/usr/share/java/pki/pki-cms.jar/usr/share/java/pki/pki-cmsbundle.jar/usr/share/java/pki/pki-cmscore.jar/usr/share/java/pki/pki-cmsutil.jar/usr/share/java/pki/pki-nsutil.jar/usr/share/pki/server/webapps/pki/admin/consolerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootpki-core-10.5.18-23.el7_9.src.rpmpki-ca    java-1.8.0-openjdk-headlesspki-serverrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)systemd-unitssystemd-unitssystemd-unitsrpmlib(PayloadIsXz)10.5.18-23.el7_93.0.4-14.6.0-14.0-15.2-14.11.3cD @cob@bf@a*@as@aA@a`@``e@`6?`%@_$_@_@^V@^@^@^U@^=@^@^]]@]@]]v>]R@] u@\\@\f\T4\R@\\U@\[@[{[l,[`O@[U@[>@[d@[@[o[@ZUZ@Z@ZZxG@Zg#Z.s@Z@Z ZYYY@Y@Y@YoIYlYGY>@Y5GY-^Y$$@Y"Y@Y#@X@XX@XO@X*XRXOX!@X&X2@WWҤ@WίW#W:WWt@W{@Wu WgWV@WV@WV@WV@WV@WV@W 10.5.18-23Dogtag Team 10.5.18-22Dogtag Team 10.5.18-21Dogtag Team 10.5.18-20Dogtag Team 10.5.18-19Dogtag Team 10.5.18-18Dogtag Team 10.5.18-17Dogtag Team 10.5.18-16Dogtag Team 10.5.18-15Dogtag Team 10.5.18-14Dogtag Team 10.5.18-13Dogtag Team 10.5.18-12Dogtag Team 10.5.18-11Dogtag Team 10.5.18-10Dogtag Team 10.5.18-9Dogtag Team 10.5.18-8Dogtag Team 10.5.18-7Dogtag Team 10.5.18-6Dogtag Team 10.5.18-5Dogtag Team 10.5.18-4Dogtag Team 10.5.18-3Dogtag Team 10.5.18-2Dogtag Team 10.5.18-1Dogtag Team 10.5.17-6Dogtag Team 10.5.17-5Dogtag Team 10.5.17-4Dogtag Team 10.5.17-3Dogtag Team 10.5.17-2Dogtag Team 10.5.17-1Dogtag Team 10.5.16-3Dogtag Team 10.5.16-2Dogtag Team 10.5.16-1Dogtag Team 10.5.9-13Dogtag Team 10.5.9-12Dogtag Team 10.5.9-11Dogtag Team 10.5.9-10Dogtag Team 10.5.9-9Dogtag Team 10.5.9-8Dogtag Team 10.5.9-7Dogtag Team 10.5.9-6Dogtag Team 10.5.9-5Dogtag Team 10.5.9-4Dogtag Team 10.5.9-3Dogtag Team 10.5.9-2Dogtag Team 10.5.9-1Dogtag Team 10.5.1-13.1Dogtag Team 10.5.1-13Dogtag Team 10.5.1-12Dogtag Team 10.5.1-11Dogtag Team 10.5.1-10Dogtag Team 10.5.1-9Dogtag Team 10.5.1-8Dogtag Team 10.5.1-7Dogtag Team 10.5.1-6Dogtag Team 10.5.1-5Dogtag Team 10.5.1-4Troy Dawson - 10.5.1-3Dogtag Team 10.5.1-2Dogtag Team 10.5.1-1Dogtag Team 10.5.0-1Dogtag Team 10.4.1-15Dogtag Team 10.4.1-14Dogtag Team 10.4.1-13Dogtag Team 10.4.1-12Dogtag Team 10.4.1-11Dogtag Team 10.4.1-10Dogtag Team 10.4.1-9Dogtag Team 10.4.1-8Dogtag Team 10.4.1-7Dogtag Team 10.4.1-6Dogtag Team 10.4.1-5Dogtag Team 10.4.1-4Dogtag Team 10.4.1-3Dogtag Team 10.4.1-2Dogtag Team 10.4.1-1Dogtag Team 10.4.0-1Dogtag Team 10.3.3-18Dogtag Team 10.3.3-17Dogtag Team 10.3.3-16Dogtag Team 10.3.3-15Dogtag Team 10.3.3-14Dogtag Team 10.3.3-13Dogtag Team 10.3.3-12Dogtag Team 10.3.3-11Dogtag Team 10.3.3-10Dogtag Team 10.3.3-9Dogtag Team 10.3.3-8Dogtag Team 10.3.3-7Dogtag Team 10.3.3-6Dogtag Team 10.3.3-5Dogtag Team 10.3.3-3Dogtag Team 10.3.3-2Dogtag Team 10.3.3-1Dogtag Team 10.3.3-0.1Dogtag Team 10.3.2-5Dogtag Team 10.3.2-4Dogtag Team 10.3.2-3Dogtag Team 10.3.2-2Dogtag Team 10.3.2-1Dogtag Team 10.3.2-0.1Dogtag Team 10.3.1-1Dogtag Team 10.3.0-1Dogtag Team 10.3.0.b1-1Dogtag Team 10.3.0.a2-2Dogtag Team 10.3.0.a2-1Dogtag Team 10.3.0.a1-2Dogtag Team 10.3.0.a1-1Dogtag Team 10.3.0-0.5Dogtag Team 10.3.0-0.4Dogtag Team 10.3.0-0.3Dogtag Team 10.3.0-0.2Dogtag Team 10.3.0-0.1Dogtag Team 10.2.7-0.3Tomas Radej - 10.2.7-0.2Dogtag Team 10.2.7-0.1Dogtag Team 10.2.6-1Dogtag Team 10.2.6-0.3Dogtag Team 10.2.6-0.2Dogtag Team 10.2.6-0.1Dogtag Team 10.2.5-1Dogtag Team 10.2.5-0.2Dogtag Team 10.2.5-0.1Dogtag Team 10.2.4-1Dogtag Team 10.2.4-0.2Dogtag Team 10.2.4-0.1Dogtag Team 10.2.3-1Dogtag Team 10.2.3-0.1Dogtag Team 10.3.0-0.1Dogtag Team 10.2.3-0.1Dogtag Team 10.2.2-1Dogtag Team 10.2.2-0.1Dogtag Team 10.2.1-1Matthew Harmsen - 10.2.1-0.4Ade Lee 10.2.1-0.3Christina Fu 10.2.1-0.2Dogtag Team 10.2.1-0.1Ade Lee 10.2.0-3Matthew Harmsen - 10.2.0-2Dogtag Team 10.2.0-1Matthew Harmsen - 10.2.0-0.10Matthew Harmsen - 10.2.0-0.9Matthew Harmsen - 10.2.0-0.8Fedora Release Engineering - 10.2.0-0.5Jack Magne - 10.2.0-0.7Matthew Harmsen - 10.2.0-0.6Matthew Harmsen - 10.2.0-0.5Ade Lee - 10.2.0-0.4Fedora Release Engineering - 10.2.0-0.3Michael Simacek - 10.2.0-0.2Dogtag Team 10.2.0-0.1Ade Lee 10.1.0-1Ade Lee 10.1.0-0.14Ade Lee 10.1.0-0.13Ade Lee 10.1.0-0.12Ade Lee 10.1.0-0.11Endi S. Dewata 10.1.0-0.10Abhishek Koneru 10.1.0.0.9Abhishek Koneru 10.1.0.0.8Endi S. Dewata 10.1.0-0.7Endi S. Dewata 10.1.0-0.6Endi S. Dewata 10.1.0-0.5Ade Lee 10.1.0-0.4Endi S. Dewata 10.1.0-0.3Matthew Harmsen 10.1.0-0.2Ade Lee 10.1.0-0.1Endi S. Dewata 10.0.2-5Ade Lee 10.0.2-4Ade Lee 10.0.2-3Endi S. Dewata 10.0.2-2Ade Lee 10.0.2-1Ade Lee 10.0.2-0.8Endi S. Dewata 10.0.2-0.7Endi S. Dewata 10.0.2-0.6Ade Lee 10.0.2-0.5Endi S. Dewata 10.0.2-0.4Endi S. Dewata 10.0.2-0.3Endi S. Dewata 10.0.2-0.2Endi S. Dewata 10.0.2-0.1Endi S. Dewata 10.0.1-9Ade Lee 10.0.1-8Endi S. Dewata 10.0.1-7Matthew Harmsen 10.0.1-6Endi S. Dewata 10.0.1-5Endi S. Dewata 10.0.1-4Matthew Harmsen 10.0.1-3Matthew Harmsen 10.0.1-2Ade Lee 10.0.1-1Matthew Harmsen 10.0.0-5Matthew Harmsen 10.0.0-4Ade Lee 10.0.0-3Ade Lee 10.0.0-2Ade Lee 10.0.0-1Matthew Harmsen 10.0.0-0.56.b3Endi S. Dewata 10.0.0-0.55.b3Endi S. Dewata 10.0.0-0.54.b3Ade Lee 10.0.0-0.53.b3Ade Lee 10.0.0-0.52.b3Endi S. Dewata 10.0.0-0.51.b2Endi S. Dewata 10.0.0-0.50.b2Matthew Harmsen 10.0.0-0.49.b2Ade Lee 10.0.0-0.48.b2Matthew Harmsen 10.0.0-0.47.b1Ade Lee 10.0.0-0.46.b1Ade Lee 10.0.0-0.45.b1Ade Lee 10.0.0-0.44.b1Ade Lee 10.0.0-0.43.b1Ade Lee 10.0.0-0.42.b1Ade Lee 10.0.0-0.41.b1Ade Lee 10.0.0-0.40.b1Endi S. Dewata 10.0.0-0.40.a2Endi S. Dewata 10.0.0-0.39.a2Ade Lee 10.0.0-0.38.a2Endi S. Dewata 10.0.0-0.37.a2Ade Lee 10.0.0-0.36.a2Endi S. Dewata 10.0.0-0.36.a1Endi S. Dewata 10.0.0-0.35.a1Endi S. Dewata 10.0.0-0.34.a1Ade Lee 10.0.0-0.33.a1Matthew Harmsen 10.0.0-0.32.a1Endi S. Dewata 10.0.0-0.31.a1Endi S. Dewata 10.0.0-0.30.a1Endi S. Dewata 10.0.0-0.29.a1Endi S. Dewata 10.0.0-0.28.a1Endi S. Dewata 10.0.0-0.27.a1Endi S. Dewata 10.0.0-0.26.a1Endi S. Dewata 10.0.0-0.25.a1Endi S. Dewata 10.0.0-0.24.a1Matthew Harmsen 10.0.0-0.23.a1Endi S. Dewata 10.0.0-0.22.a1Endi S. Dewata 10.0.0-0.21.a1Matthew Harmsen 10.0.0-0.20.a1Matthew Harmsen 10.0.0-0.19.a1Matthew Harmsen 10.0.0-0.18.a1Endi S. Dewata 10.0.0-0.17.a1Matthew Harmsen 10.0.0-0.16.a1Ade Lee 10.0.0-0.15.a1Christina Fu 10.0.0-0.14.a1Endi S. Dewata 10.0.0-0.13.a1Endi S. Dewata 10.0.0-0.12.a1Ade Lee 10.0.0-0.11.a1Matthew Harmsen 10.0.0-0.10.a1Matthew Harmsen 10.0.0-0.9.a1Jack Magne 10.0.0-0.8.a1Matthew Harmsen 10.0.0-0.7.a1Endi S. Dewata 10.0.0-0.6.a1Ade Lee 10.0.0-0.5.a1Endi S. Dewata 10.0.0-0.4.a1Matthew Harmsen 10.0.0-0.3.a1Matthew Harmsen 10.0.0-0.2.a1Nathan Kinder 10.0.0-0.1.a1Ade Lee 9.0.16-3Endi S. Dewata 9.0.16-2Matthew Harmsen 9.0.16-1Matthew Harmsen 9.0.15-1Matthew Harmsen 9.0.14-1Ade Lee 9.0.13-1Matthew Harmsen 9.0.12-1Matthew Harmsen 9.0.11-1Matthew Harmsen 9.0.10-1Matthew Harmsen 9.0.9-1Matthew Harmsen 9.0.8-2Matthew Harmsen 9.0.8-1Matthew Harmsen 9.0.7-1Matthew Harmsen 9.0.6-2Matthew Harmsen 9.0.6-1Matthew Harmsen 9.0.5-2Matthew Harmsen 9.0.5-1Matthew Harmsen 9.0.4-1Matthew Harmsen 9.0.3-2Matthew Harmsen 9.0.3-1Matthew Harmsen 9.0.2-1Matthew Harmsen 9.0.1-3Matthew Harmsen 9.0.1-2Matthew Harmsen 9.0.1-1Matthew Harmsen 9.0.0-3Matthew Harmsen 9.0.0-2Matthew Harmsen 9.0.0-1- ########################################################################## - # RHEL 7.9 (Batch Update 18): - ########################################################################## - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen) - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley) - ########################################################################## - # RHCS 9.7 (Batch Update 18): - ########################################################################## - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [certificate_system_9.7.z] (ckelley, mharmsen) - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)- ########################################################################## - # RHEL 7.9 (Batch Update 17): - ########################################################################## - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen) - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley) - ########################################################################## - # RHCS 9.7 (Batch Update 17): - ########################################################################## - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [certificate_system_9.7.z] (ckelley, mharmsen) - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)- ########################################################################## - # RHEL 7.9 (Batch Update 15): - ########################################################################## - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when debug level set to maximum [RHEL 7.9.z] (cfu) - Bugzilla Bug #2082717 - SCEP manual approval failure (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 14): - ########################################################################## - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when debug level set to maximum [RHEL 7.9.z] (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 11): - ########################################################################## - Bugzilla Bug 1998597 - TPS RA Separation Issues (cfu) - Bugzilla Bug 2008319 - PKISpawn with ECC Signing Algorithms fail in FIPS Mode (cfu) - Bugzilla Bug 2018608 - Invalid certificates with creation of subCA (pkispawn single step) [rhel-7.9.0.z] (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 10): - ########################################################################## - Bugzillla Bug 1978345 - End Entity's List Certificates Page Back/Forward Buttons are Broken (ckelley, jonahon.d.parrish@mail.mil, mharmsen) - Bugzilla Bug 2008707 - pkispawn bails out too easily for things that could have been worked around after installation [RHEL 7.9.z] (cfu) - Bugzilla Bug 2016773 - Directory authentication plugin requires directory admin password just for user authentication (rhel-7.9.z) (awnuk@purestorage.com, jmagne) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 9): - ########################################################################## - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500 [ftweedal, ckelley] - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 8): - ########################################################################## - Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu] - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500 [ftweedale, ckelley] - ########################################################################## - # RHCS 9.7 (Batch Update 8): - ########################################################################## - Bugzilla Bug 1959937 - TPS Allowing Token Transactions while the CA is Down [cfu] - Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile Separation [cfu]- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission per LDAP group without immediate issuance [rhel-7.9.z] (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1911472 - Revoke via REST API not working when Agent certificate not issued by CA [rhel-7.9.z] (cfu) - Bugzilla Bug 1914587 - RHEL IPA PKI - Failed to read product version String.java.io.FileNotFoundException (ckelley) - Bugzilla Bug 1942687 - TPS not populating Token Policy, or switching PIN_RESET=YES to NO [rhel-7.9.z] (jmagne) - Bugzilla Bug 1955633 - Recovery of Keys migrated to latest version of KRA fail to recover and result in Null Point Exception [rhel-7.9.z] (jmagne) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1949136 - PKI instance creation failed with new 389-ds-base build (jmagne) - Bugzilla Bug 1949656 - CRMF requests with extensions other than SKID cannot be processed (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)- Change variable 'TPS' to 'tps' - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates profiles, audit for IPA (edewata) - ########################################################################## - # Backported CVEs (ascheel): - ########################################################################## - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token parameters in TPS resulting in stored XSS [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile creation [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site Scripting in 'path length' constraint field in CA's Agent page [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site scripting in getcookies?url= endpoint in CA [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab [rhel-7.9.z] (ascheel) - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne) - ########################################################################## - Update to jquery v3.4.1 (ascheel) - Update to jquery-i18n-properties v1.2.7 (ascheel) - Update to backbone v1.4.0 (ascheel) - Upgrade to underscore v1.9.2 (ascheel) - Update to patternfly v3.59.3 (ascheel) - Update to jQuery v3.5.1 (ascheel) - Upgrade to bootstrap v3.4.1 (ascheel) - Link in new Bootstrap CSS file (ascheel) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates profiles, audit for IPA (edewata) - ########################################################################## - # Backported CVEs (ascheel): - ########################################################################## - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token parameters in TPS resulting in stored XSS [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile creation [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site Scripting in 'path length' constraint field in CA's Agent page [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site scripting in getcookies?url= endpoint in CA [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab [rhel-7.9.z] (ascheel) - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne) - ########################################################################## - Update to jquery v3.4.1 (ascheel) - Update to jquery-i18n-properties v1.2.7 (ascheel) - Update to backbone v1.4.0 (ascheel) - Upgrade to underscore v1.9.2 (ascheel) - Update to patternfly v3.59.3 (ascheel) - Update to jQuery v3.5.1 (ascheel) - Upgrade to bootstrap v3.4.1 (ascheel) - Link in new Bootstrap CSS file (ascheel) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Bugzilla Bug #1883639 - additional fix to upgrade script (edewata)- Bugzilla Bug #1883639 - additional support on upgrade for audit cert profile and auditProfileUpgrade + auditProfileUpgrade part 2 (cfu)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1883639 - add profile caAuditSigningCert (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1710978 - TPS - Add logging to tdbAddCertificatesForCUID if - # Bugzilla Bug #1858860 - TPS - Update Error Codes returned to client - # Bugzilla Bug #1858861 - TPS - Server side key generation is not working - # Bugzilla Bug #1858867 - TPS does not check token cuid on the user- Patch for CMCResponse tool - Bugzilla Bug #1710109 - add RSA PSS support - fix CMCResponse tool (jmagne)- Patch for CMC Credential Error, RSA PSS typo, and new profile for directory-authentication-based Server-Side keygen - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1710109 - add RSA PSS support (jmagne) - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Updated jss dependencies - Bugzilla Bug #1710109 - add RSA PSS support - fix SHA512 (jmagne)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE additional support and touch-up (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1710975 - TPS - Searching the certificate DB for a brand new- Updated jss dependencies - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu) - Bugzilla Bug #1809273 - CRL generation performs an unindexed search (jmagne) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1549307 - No default TPS Auditor group (ascheel)- Bugzilla Bug #1710109 - add RSA PSS support - fix IPA installer (jmagne)- Updated jss dependencies - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1774174 - Rebase pki-core from 10.5.17 to 10.5.18 (RHEL) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and - # Bugzilla Bug #1774181 - Update RHCS version of CA, KRA, OCSP, and TKS so- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1723008 - ECC Key recovery failure with CKR_TEMPLATE_INCONSISTENT (cfu) - Bugzilla Bug #1774282 - pki-server-nuxwdog template has pid file name with non-breakable space char encoded instead of 0x20 space char (ascheel) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS client (cfu) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Include 'pistool' in the 'pki-tools' package- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1445479 - KRATool does not support netkeyKeyRecovery attribute (dmoluguw) - Bugzilla Bug #1534013 - Attempting to add new keys using a PUT KEY APDU to a token that is loaded only with the default/factory keys (Key Version Number 0xFF) returns an APDU with error code 0x6A88. (jmagne) - Bugzilla Bug #1709585 - PKI (test support) for PKCS#11 standard AES KeyWrap for HSM support (cfu, ftweedal) - Bugzilla Bug #1748766 - number range depletion when multiple clones created from same master (ftweedal) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1520258 - TPS token search fails to find entries , LDAP filter - # Bugzilla Bug #1535671 - RFE to have the users be able to use the- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS client (cfu) - Bugzilla Bug #1597727 - CA - Unable to change a certificate’s revocation reason from superceded to key_compromised (rhcs-maint) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1470410 - TPS doesn't update revocation status when - # Bugzilla Bug #1470433 - Add supported transitions to TPS (rhcs-maint) - # Bugzilla Bug #1585722 - TMS - PKISocketFactory – Modify Logging to Allow - # Bugzilla Bug #1642577 - TPS – Revoked Encryption Certificates Marked as- Updated jss, nuxwdog, and tomcatjss dependencies - ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1733586 - Rebase pki-core from 10.5.16 to 10.5.17 (RHEL) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1718418 - Update RHCS version of CA, KRA, OCSP, and TKS so - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.7: - ########################################################################## - Bugzilla Bug #1638379 - PKI startup initialization process should not depend on LDAP operational attributes [ftweedal] - ########################################################################## - # RHCS 9.5: - ########################################################################## - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.7: - ########################################################################## - Bugzilla Bug #1491453 - Need Method to Include SKI in CA Signing Certificate Request [ftweedal] - ########################################################################## - # RHCS 9.5: - ########################################################################## - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Updated jss dependencies - ########################################################################## - # RHEL 7.7: - ########################################################################## - Bugzilla Bug #1633422 - Rebase pki-core from 10.5.1 to 10.5.16 (RHEL) - ########################################################################## - # RHCS 9.5: - ########################################################################## - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] [manpage] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1659939 - CC: Simplifying Web UI session timeout configuration [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA, - # Added Batch Update Information to Product Version (mharmsen)- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1657922 - CC: CA/OCSP startup fail on SystemCertsVerification if enableOCSP is true [rhel-7.6.z] (jmagne) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1645262 - pkidestroy may not remove all files [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1645263 - Auth plugins leave passwords in the access log and audit log using REST [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1645429 - pkispawn fails due to name collision with /var/log/pki/ [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1655951 - CC: tools supporting CMC requests output keyID needs to be captured in file [rhel-7.6.z] (cfu) - Bugzilla Bug #1656297 - Unable to install with admin-generated keys [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- Require "tomcatjss >= 7.2.1-8" as a build and runtime requirement - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1632116 - CC: missing audit event for CS acting as TLS client [rhel-7.6.z] (cfu) - Bugzilla Bug #1632120 - Unsupported RSA_ ciphers should be removed from the default ciphers list [rhel-7.6.z] (cfu) - Bugzilla Bug #1632615 - Permit certain SHA384 FIPS ciphers to be enabled by default for RSA and ECC . . . [rhel-7.6.z] (cfu) - Bugzilla Bug #1632616 - X500Name.directoryStringEncodingOrder overridden by CSR encoding (coverity changes) [rhel-7.6.z] (mharmsen) - Bugzilla Bug #1633104 - CMC: add config to allow non-clientAuth [rhel-7.6.z] (cfu) - Bugzilla Bug #1636490 - Installation of CA using an existing CA fails [rhel-7.6.z] (edewata) - Bugzilla Bug #1643878 - pki cli command for RHCS doesn't prompt for a password [rhel-7.6.z] (edewata) - Bugzilla Bug #1643879 - CC: Identify version/release of pki-ca, pki-kra, pki-ocsp, pki-tks, and pki-tps remotely [RHEL] [rhel-7.6.z] (cfu, jmagne) - Bugzilla Bug #1643880 - PKI subsystem process is not shutdown when there is no space on the disk to write logs [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- Updated nuxwdog dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #673182 - ECC keys not supported for signing audit logs (cfu) - Bugzilla Bug #1593805 - Better understanding of NSS_USE_DECODED_CKA_EC_POINT for ECC (cfu) - Bugzilla Bug #1601071 - Certificate generation happens with partial attributes in CMCRequest file (cfu) - Bugzilla Bug #1601569 - CC: Enable all config audit events (cfu) - Bugzilla Bug #1608375 - CMC Revocations throws exception with same reqIssuer & certissuer (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1596629 - ipa-replica-install --setup-kra broken on DL0 with latest version (abokovoy) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1548203 - pki console configurations that involves ldap passwords leave the plain text password in signed audit logs (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1494591 - keyGen fails when only Identity- Re-spin alpha builds- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1471935 - X500Name.directoryStringEncodingOrder overridden by CSR encoding (cfu) - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a certificate (ftweedal) - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in SharedToken scenario's (cfu) - Bugzilla Bug #1550742 - Address ECC profile overrides (cfu) - Bugzilla Bug #1562841 - servlet profileSubmitCMCSimple throws NPE (cfu) - Bugzilla Bug #1572432 - AuditVerify failure due to line breaks (cfu) - Bugzilla Bug #1592961 - Need proper default subjectDN for CMC request authenticated through SharedToken (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a certifcate (ftweedal) - Bugzilla Bug #1544843 - ExternalCA: Installation failed during csr generation with ecc (rrelyea, gkapoor) - Bugzilla Bug #1557569 - Re-base pki-core from 10.5.1 to latest upstream 10.5.x (RHEL) (mharmsen) - Bugzilla Bug #1580394 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC (cfu) - Bugzilla Bug #1580527 - CVE-2018-1080 pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access (ftweedal, cfu) - Bugzilla Bug #1585866 - CRMFPopClient tool - should allow option to do no key archival (cfu) - Bugzilla Bug #1588655 - Cert validation for installation with external CA cert (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- Rebuild due to build system database problem- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1585945 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC [rhel-7.5.z] (cfu) - Bugzilla Bug #1587826 - ExternalCA: Installation failed during csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor) - Bugzilla Bug #1588944 - Cert validation for installation with external CA cert [rhel-7.5.z] (edewata) - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow option to do no key archival (cfu) - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access [rhel-7.5.z] (ftweedal, cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- Updated "jss" build and runtime requirements (mharmsen) - ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu) - Bugzilla Bug #1572548 - IPA install with external-CA is failing when FIPS mode enabled. [rhel-7.5.z] (edewata) - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE [rhel-7.5.z] (cfu) - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu) - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs improvement [rhel-7.5.z] (jmagne) - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in pkispawn configuration step [rhel-7.5.z] (cfu) - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong input class_id [rhel-7.5.z] (cfu) - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System 9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for standard conformance [rhel-7.5.z] (cfu) - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1560233 - libtps does not directly depend on libz- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1550581 - CMCAuth throws org.mozilla.jss.crypto.TokenException: Unable to insert certificate into temporary database [rhel-7.5.z] (cfu) - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata) - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers [rhel-7.5.z] (cheimes, mharmsen) - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for standard conformance [rhel-7.5.z] (cfu) - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu) - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu) - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1558919 - Not able to generate certificate request with ECC using pki client-cert-request [rhel-7.5.z] (akahat) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1560233 - libtps does not directly depend on libz- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event set (RHEL) (edewata) - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata) - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM and FIPS (edewata) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1542210 - pki console configurations that involves ldap passwords leave the plain text password in debug logs (jmagne) - Bugzilla Bug #1543242 - Regression in lightweight CA key replication (ftweedal) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event set (RHEL) (edewata) - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and audit event logging at startup (jmagne) - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA instance (alee) - Bugzilla Bug #1525306 - CC: missing CMC request and response record (cfu) - Bugzilla Bug #1532933 - Installing subsystems with external CMC certificates in HSM environment shows import error (edewata) - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm (edewata) - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers permitted in fips mode (mharmsen) - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED outcomes. (edewata) - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in SharedToken scenario's (cfu) - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown revRequest.issuer (cfu) - Bugzilla Bug #1541853 - ProfileService: config values with backslashes have backslashes removed (ftweedal) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the- Updated jss, nuxwdog, and openssl dependencies - ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in few cases (ftweedal) - Bugzilla Bug #1428021 - CC: shared token storage and retrieval mechanism (cfu) - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error (cfu) - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog (alee) - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during pkispawn (alee) - Bugzilla Bug #1520526 - p12 admin certificate is missing when certificate is signed Externally (edewata) - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA instance (alee) - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to missing nextupdate field (ftweedal) - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen) - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords in several different files after installation completes (alee) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage (jmagne) - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to setup with CMC signed certificates (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- dogtagpki Pagure Issue #2853 - Cleanup spec file conditionals- Patch applying check-ins since 10.5.1-1- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- #Bugzilla Bug #1492560 - ipa-replica-install --setup-kra broken on DL0- #Require "jss >= 4.4.0-8" as a build and runtime requirement - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Resolves: rhbz #1486870,1485833,1487509,1490241,1491332 - # Bugzilla Bug #1486870 - Lightweight CA key replication fails (regressions) - # Bugzilla Bug #1485833 - Missing CN in user signing cert would cause error - # Bugzilla Bug #1487509 - pki-server-upgrade fails when upgrading from - # Bugzilla Bug #1490241 - PKCS12: upgrade to at least AES and SHA2 (FIPS) - # Bugzilla Bug #1491332 - TPS UI: need to display tokenType and tokenOrigin - # dogtagpki Pagure Issue #2764 - py3: pki.key.archive_encrypted_data: - ########################################################################## - # RHCS 9.2: - ########################################################################## - # Resolves: rhbz #1486870,1485833,1487509,1490241,1491332,1482729,1462271 - # Bugzilla Bug #1462271 - TPS incorrectly assigns "tokenOrigin" and - # Bugzilla Bug #1482729 - TPS UI: need to display tokenType and tokenOrigin- Resolves: rhbz #1463350 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1463350 - Access banner validation (edewata)- # Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing - # Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause - # Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert - # Bugzilla Bug #1463350 - Access banner validation (edewata) - # Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal - # Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen) - # Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with - # Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option - # Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03 - # Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system- # Resolves: rhbz #1469432 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1469432 - CMC plugin default change - # Resolves CVE-2017-7537 - # Fixes BZ #1470948- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1458043 - Key recovery on token fails with invalid public key error on KRA (alee) - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client authentication cert against CMC signer (cfu) - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after deleting the any of the subsystem certs from it (ftweedal)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret) using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne) - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing certificate requests (cfu) - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC revocation non-signing cert requests (cfu) - Bugzilla Bug #1458047 - change the way aes clients refer to aes keysets (alee) - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code (alee) - Bugzilla Bug #1460028 - In keywrap mode, key recovery on KRA with HSM causes KRA to crash (ftweedal)- Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement - ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS enabled system (edewata) - Bugzilla Bug #1447144 - CA brought down during separate KRA instance creation (edewata) - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure ACCESS_SESSION_ESTABLISH_FAILURE (edewata) - Bugzilla Bug #1454450 - SubCA installation failure with 2 step installation in fips enabled mode (edewata) - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import is asking for password when already provided (edewata) - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes) - Bugzilla Bug #1458043 - Key recovery using externalReg fails with java null pointer exception on KRA (alee) - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter (edewata) - Bugzilla Bug #1458429 - client-cert-import --ca-cert should import CA cert with trust bits "CT,C,C" (edewata) - ########################################################################## - # RHCS 9.2: - ########################################################################## - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret) using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne) - Bugzilla Bug #1445519 - CA Server installation with HSM fails (jmagne) - Bugzilla Bug #1452617 - Unable to create IPA Sub CA (ftweedal) - Bugzilla Bug #1454471 - Enabling all subsystems on startup (edewata) - Bugzilla Bug #1455617 - Key recovery on token fails because key record is not marked encrypted (alee)- Bugzilla Bug #1454603 - Unable to install IPA server due to pkispawn error (mharmsen)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal non-signing cert requests (cfu) - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed) CMC with identity proof (cfu) - Bugzilla Bug #1447144 - CA brought down during separate KRA instance creation (mharmsen) - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata) - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne) - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen) - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in ConnectorServlet. (edewata) - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata) - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED audit event. (edewata)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when HSM is used. (alee) - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes) - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error (cfu) - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from the KRA (ftweedal) - Bugzilla Bug #1448204 - pkispawn of clone install fails with InvalidBERException (ftweedal) - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on thales hsm (alee) - Updated "jss" build and runtime requirements (mharmsen) - ########################################################################## - # RHCS 9.2: - ########################################################################## - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)- ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in conjuction with FreeIPA (ftweedal) - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the startTime parameter is not working as expected. (jmagne) - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing certificate requests (cfu) - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal) - Bugzilla Bug #1445088 - profile modification cannot remove existing config parameters (ftweedal) - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption) (RHEL) (alee) - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when pki CLI terminates SSL connection (edewata) - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption) (RHCS) (alee)- ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1282504 - Installing pki-server in container reports scriptlet failed, exit status 1 (jpazdziora) - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS enabled system (edewata) - Bugzilla Bug #1410650 - [RFE] Add SCP03 support for sc 7 g & d cards (RHEL) (jmagne) - Bugzilla Bug #1437591 - cli authentication using expired cert throws an exception (edewata) - Bugzilla Bug #1437602 - non-CA cli looks for CA in the instance during a request (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1274086 - [RFE] Add SCP03 support for sc 7 g & d cards (RHCS) (jmagne) - ############################################################################ - # Common Criteria - ############################################################################ - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures (edewata) - Bugzilla Bug #1417307 - CC: Audit Review /Searches (edewata) - Bugzilla Bug #1419737 - CC: CMC: id-cmc-popLinkWitnessV2 feature implementation (cfu)- Require "nss >= 3.28.3" as a build and runtime requirement - Require "jss >= 4.4.0-4" as a build and runtime requirement - Require "tomcatjss >= 7.2.1-3" as a build and runtime requirement - dogtagpki Pagure Issue #2612 - Unable to clone due to pki pkcs12-cert-find failure (edewata) - ############################################################################ - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4 - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.4.x - ############################################################################ - # RHEL 7.4: - ############################################################################ - ############################################################################ - # RHCS 9.2: - ############################################################################ - ############################################################################ - # Common Criteria - ############################################################################ - Bugzilla Bug #1419734 - CC: CMC: id-cmc-identityProofV2 feature implementation (cfu) - Bugzilla Bug #1419742 - CC: CMC: provide Proof of Possession for encryption cert requests (cfu) - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures (edewata) - Bugzilla Bug #1428020 - CC: CMC feature support: provided issuance protection cert mechanism (cfu)- Require "jss >= 4.4.0-1" as a build and runtime requirement - Require "tomcatjss >= 7.2.1-1" as a build and runtime requirement - ############################################################################ - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4 - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.4.x - ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1222557 - ECDSA Certificates Generated by Certificate System 8.1 fail NIST validation test with parameter field. (cfu) - Bugzilla Bug #1238684 - Generting Symmetric key fails with key-generate when --usages verify (vakwetu) - Bugzilla Bug #1246635 - user-cert-add --serial CLI request to secure port with remote CA shows authentication failure (edewata) - Bugzilla Bug #1249400 - CA EE: Submit caUserCert request without uid does not show proper error message (vakwetu) - Bugzilla Bug #1305993 - Add profile component that copies CN to SAN (ftweedal) - Bugzilla Bug #1316653 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any (edewata) - Bugzilla Bug #1325071 - add options to enable/disable cert or crl publishing. (vakwetu) - Bugzilla Bug #1330800 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?) (edewata) - Bugzilla Bug #1368410 - Misleading Logging for HSM (edewata) - Bugzilla Bug #1372052 - Unable to search certificate requests using the latest request ID (edewata) - Bugzilla Bug #1375347 - Typo in comment line of UserPwdDirAuthentication.java (edewata) - Bugzilla Bug #1376226 - IPA replica-prepare failed with error "Profile caIPAserviceCert Not Found" (ftweedal) - Bugzilla Bug #1376488 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - Bugzilla Bug #1378275 - two-step externally-signed CA installation fails due to missing AuthorityID (ftweedal) - Bugzilla Bug #1378277 - Spurious host authority entries created (ftweedal) - Bugzilla Bug #1378527 - Miscellaneous Minor Changes (edewata) - Bugzilla Bug #1381084 - KRA installation failed against externally-signed CA with partial certificate chain (edewata) - Bugzilla Bug #1382066 - Problems with FIPS mode (edewata) - Bugzilla Bug #1386371 - Remove xenroll.dll from pki-core (mharmsen) - Bugzilla Bug #1386424 - Fix packaging duplicates of classes in multiple jar files (edewata) - Bugzilla Bug #1391737 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (RHEL 7) (edewata) - Bugzilla Bug #1392068 - [RFE] add express archivals and retrievals from KRA (vakwetu) - Bugzilla Bug #1395817 - Unable to install subordinate CA with HSM in FIPS mode (edewata) - Bugzilla Bug #1397200 - pkispawn does not change default ecc key size from nistp256 when nistp384 is specified in spawn config (jmagne) - Bugzilla Bug #1399862 - Dogtag 10.3.9 Man Pages (edewata) - Bugzilla Bug #1404881 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - Bugzilla Bug #1405654 - Token memory not wiped after key deletion (RHEL) (jmagne) - Bugzilla Bug #1409946 - Request ID undefined for CA signing certificate (vakwetu) - Bugzilla Bug #1409949 - CA Certificate Issuance Date displayed on CA website incorrect (vakwetu) - Bugzilla Bug #1410650 - [RFE] Add SCP03 support (RHEL) (jmagne) - Bugzilla Bug #1411428 - Unable to create a CA clone in FIPS (edewata) - Bugzilla Bug #1412211 - Unable to set up KRA in FIPS (edewata) - Bugzilla Bug #1412681 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs (ftweedal) - Bugzilla Bug #1413132 - pki-tomcat for 10+ minutes before generating cert (edewata) - Bugzilla Bug #1413136 - Problem with default AJP hostname in IPv6 environment. (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1 (cfu) - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne) - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed tokens (jmagne) - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working when a token is physically damaged and a temporary token is issued (jmagne) - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches (cfu) - Bugzilla Bug #1381635 - Token format with external reg fails when op.format.externalRegAddToToken.revokeCert=true (cfu) - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when set on a token (jmagne) - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (RHCS 9) (edewata) - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (RHCS) (jmagne) - Bugzilla Bug #1404900 - Dogtag 10.3.9 logging properties (edewata) - Bugzilla Bug #1405655 - Token memory not wiped after key deletion (RHCS) (jmagne) - ############################################################################- ## RHEL 7.3.z Batch Update 4 - Bugzilla Bug #1429492 - Add profile component that copies CN to SAN (ftweedal)- ## RHCS 9.1.z Batch Update 3 - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - ## RHEL 7.3.z Batch Update 3 - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System 8.1 fail NIST validation test with parameter field. (cfu) - Bugzilla Bug #1417064 - Unable to search certificate requests using the latest request ID (edewata) - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website incorrect (alee) - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs (ftweedal) - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert (edewata) - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6 environment. (edewata)- Separate original patches into RHEL and RHCS portions - ## RHEL 7.3.z Batch Update 2 - Bugzilla Bug #1404176 - logging properties and man pages (edewata) - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - ## RHCS 9.1.z Batch Update 2 - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - Bugzilla Bug #1404900 - RHCS logging properties (edewata)- ## RHEL 7.3.z Batch Update 2 - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port with remote CA shows authentication failure (edewata) - Bugzilla Bug #1404175 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any (edewata) - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI [pki-base] (edewata) - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS mode (edewata) - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from nistp256 when nistp384 is specified in spawn config (jmagne) - Bugzilla Bug #1404176 - logging properties and man pages (edewata) - ## RHCS 9.1.z Batch Update 2 - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI [pki-tps] (edewata) - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne)- Marked the following RHCS 9.1.z bug: Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne) as a duplicate of RHEL 7.3.z bug: Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) and moved the patch from the RHCS 9.1.z bug to the RHEL 7.3.z bug.- ## RHEL 7.3.z Batch Update 1 - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) (added KRA key recovery via CLI in FIPS mode) - ## RHCS 9.1.z Batch Update 1 - Reverted patches associated with Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (edewata)- ## RHEL 7.3.z Batch Update 1 - Bugzilla Bug #1390318 - CA EE: Submit caUserCert request without uid does not show proper error message (alee) - Bugzilla Bug #1390319 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?) (edewata) - Bugzilla Bug #1390320 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - Bugzilla Bug #1390321 - two-step externally-signed CA installation fails due to missing AuthorityID (ftweedal) - Bugzilla Bug #1390322 - Spurious host authority entries created (ftweedal) - Bugzilla Bug #1390324 - KRA installation failed against externally-signed CA with partial certificate chain (edewata) - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) - Bugzilla Bug #1390311 - Fix packaging duplicates of classes in multiple jar files (edewata) - Bugzilla Bug #1390325 - Typo in comment line of UserPwdDirAuthentication.java (edewata) - ## RHCS 9.1.z Batch Update 1 - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1" (cfu) - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed tokens (jmagne) - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working when a token is physically damaged and a temporary token is issued (jmagne) - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches - Bugzilla Bug #1381635 - Token format with external reg fails when op.format.externalRegAddToToken.revokeCert=true (cfu) - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when set on a token (jmagne) - Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne) - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (edewata)- PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu) - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed tokens (jmagne) - PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches (cfu) - PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar files (edewata)- Revert Patch: PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens (edewata) - Resolves: rhbz #1374054 - ipa-replica-install fails setting up certificate - Restores: rhbz #1319557 - pkispawn KRA instance is failing server - Removes from Errata: rhbz #1372041 - Unable to create system certificates in different tokens- PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion (ftweedal) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (edewata) - PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry deleted (ftweedal) - PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if USN plugin enabled (ftweedal) - PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per instance name (for shared HSM) (cfu) - PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs (vakwetu) - PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens (edewata)- PKI TRAC Ticket #1578 - Authentication Instance Id PinDirEnrollment with authType value as SslclientAuth is not working (jmagne) - PKI TRAC TIcket #2414 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided (gkapoor) - PKI TRAC Ticket #2423 - pki_ca_signing_token when not specified does not fallback to pki_token_name value (edewata) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (akasurde) - ticket remains open - PKI TRAC Ticket #2439 - Outdated deployment descriptors in upgraded server(edewata)- PKI TRAC Ticket #690 - [MAN] pki-tools man pages (mharmsen) - CMCEnroll - PKI TRAC Ticket #833 - pki user-mod fullName="" gives an error message "PKIException: LDAP error (21): error result" (edewata) - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade. (cheimes, edewata, mharmsen) - PKI TRAC Ticket #2432 - Kra-selftest behavior is not as expected (edewata) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (edewata, mharmsen) - PKI TRAC Ticket #2437 - TPS UI: while adding certs for users from TPSUI pem format with/without header works while pkcs7 with header is not allowed (edewata) - PKI TRAC Ticket #2440 - Optional CA signing CSR for migration (edewata)- Bugzilla Bug #1366465 - Errata TPS upgrade test fails- PKI TRAC Ticket #978 - TPS connector man page: add revocation routing info (cfu) - PKI TRAC Ticket #1285 - [MAN] Apply 'generateCRMFRequest() removed from Firefox' workarounds to appropriate 'pki' man page (jmagne) - PKI TRAC Ticket #2246 - [MAN] Man Page: AuditVerify (cfu) - PKI TRAC Ticket #2381 - Throws exception while providing invalid module. (edewata) - PKI TRAC Ticket #2383 - CLI :: pki client-cert-request --extractable should accept only boolean value (edewata) - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA (cfu) - PKI TRAC Ticket #2399 - Dogtag 10.3.5: Miscellaneous Enhancements (akasurde, alee, cheimes, edewata, jmagne, mharmsen) - PKI TRAC Ticket #2401 - pkispawn calls dnsdomainname even if it does not rpm-require hostname (mharmsen) - PKI TRAC Ticket #2402 - Conflict in file ownership in pki-base and pki-server (cheimes) - PKI TRAC Ticket #2403 - Deployment problem with RESTEasy 3.0.17 (edewata) - PKI TRAC Ticket #2406 - Make starting CRL Number configurable (jmagne) - PKI TRAC Ticket #2412 - pki client-cert-import --trust option does not apply the specified trust bits (alee) - PKI TRAC Ticket #2418 - [TPS] Some template substitution didn't happen during installation (alee) - PKI TRAC Ticket #2420 - CA subsystem OSCP responder fails when LWCAs are not used (ftweedal) - PKI TRAC Ticket #2421 - Incorrect SELinux contexts Installation/Configuration (edewata) - PKI TRAC Ticket #2424 - ipa-ca-install fails on replica when IPA server is converted from CA-less to CA-full (edewata) - PKI TRAC Ticket #2428 - broken request links for CA's system certs in agent request viewing (cfu) - PKI TRAC Ticket #2430 - CA Agent certificate list is not sorted by serial number in migration case (jmagne) - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade. (mharmsen) - PKI TRAC Ticket #2433 - Lightweight CA GET /chain returns bogus PEM data (ftweedal)- PKI TRAC Ticket #691 - [MAN] pki-server man pages (mharmsen) - PKI TRAC Ticket #1114 - [MAN] Generting Symmetric key fails with key-generate when --usages verify is passed (jmagne) - PKI TRAC Ticket #1306 - [RFE] Add granularity to token termination in TPS (cfu) - PKI TRAC Ticket #1308 - [RFE] Provide ability to perform off-card key generation for non-encryption token keys (cfu) - PKI TRAC Ticket #1405 - [MAN] Add additional HSM details to 'pki_default.cfg' & 'pkispawn' man pages (mharmsen) - PKI TRAC Ticket #1607 - [MAN] man pkispawn has inadequate description for shared vs non shared tomcat instance installation (mharmsen) - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - PKI TRAC Ticket #1711 - CLI :: pki-server ca-cert-request-find throws IOError (edewata, ftweedal) - PKI TRAC Ticket #2285 - freeipa fails to start correctly after pki-core update on upgraded system (ftweedal) - PKI TRAC Ticket #2311 - When pki_token_name=Internal, consider normalizing it to "internal" (mharmsen) - PKI TRAC Ticket #2349 - Separated TPS does not automatically receive shared secret from remote TKS (jmagne) - PKI TRAC Ticket #2364 - CLI :: pki-server ca-cert-request-show throws attribute error (ftweedal) - PKI TRAC Ticket #2368 - pki-server subsystem subcommands throws error with --help option (edewata) - PKI TRAC Ticket #2374 - KRA cloning overwrites CA signing certificate trust flags (edewata) - PKI TRAC Ticket #2380 - Pki-server instance commands throws exception while specifying invalid parameters. (edewata) - PKI TRAC Ticket #2384 - CA installation with HSM prompts for HSM password during silent installation (edewata) - PKI TRAC Ticket #2385 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg (ftweedal) - PKI TRAC Ticket #2387 - Add config for default OCSP URI if none given (ftweedal) - PKI TRAC Ticket #2388 - CA creation responds 500 if certificate issuance fails (ftweedal) - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA (cfu) - PKI TRAC Ticket #2390 - Dogtag 10.3.4: Miscellaneous Enhancements (akasurde, edewata)- PKI TRAC Ticket #2373 - Fedora 25: RestEasy 3.0.6 ==> 3.0.17 breaks pki-core (ftweedal)- Updated release number to 10.3.3-1- Updated version number to 10.3.3-0.1- Provided cleaner runtime dependency separation- Updated tomcatjss version dependencies- Updated 'java', 'java-headless', and 'java-devel' dependencies to 1:1.8.0.- Updated tomcat version dependencies- Updated version number to 10.3.2-1- Updated version number to 10.3.2-0.1- Updated version number to 10.3.1-1 (to allow upgrade from 10.3.0.b1)- Updated version number to 10.3.0-1- Build for F24 beta- PKI TRAC Ticket #2255 - PKCS #12 backup does not contain trust attributes.- Updated build for F24 alpha- PKI TRAC Ticket #1625 - Allow multiple ACLs of same name (union of rules) [ftweedal] - PKI TRAC Ticket #2237 - Add CRL dist points extension to OIDMap unconditionally [edewata] - PKI TRAC Ticket #1803 - Removed unnecessary URL encoding for admin cert request. [edewata] - PKI TRAC Ticket #1742 - Added support for cloning 3rd-party CA certificates. [edewata] - PKI TRAC Ticket #1482 - Added TPS token filter dialog. [edewata] - PKI TRAC Ticket #1808 - Fixed illegal token state transition via TEMP_LOST. [edewata]- Build for F24 alpha- PKI Trac Ticket #1399 - Move java components out of pki-base- PKI TRAC Ticket #1850 - Rename DRMTool --> KRATool- PKI TRAC Ticket #1714 - mod_revocator and mod_nss dependency for tps should be removed- PKI TRAC Ticket #1623 - Runtime dependency on python-nss is missing- Updated version number to 10.3.0-0.1- Added dep on tomcat-servlet-3.1-api [Fedora 23 and later] or dep on tomcat-servlet-3.0-api [Fedora 22 and later] to pki-tools - Updated dep on tomcatjss [Fedora 23 and later]- Updated dep on policycoreutils-python-utils [Fedora 23 and later]- Updated version number to 10.2.7-0.1- Update release number for release build- Remove setup directory and remaining Perl dependencies- Remove ExcludeArch directive- Updated version number to 10.2.6-0.1- Update release number for release build- Resolves rhbz #1230970 - Errata TPS tests for rpm verification failed- Updated version number to 10.2.5-0.1- Update release number for release build- Updated nuxwdog and tomcatjss requirements (alee)- Updated version number to 10.2.4-0.1 - Added nuxwdog systemd files- Update release number for release build- Reverted version number back to 10.2.3-0.1 - Added support for Tomcat 8.- Updated version number to 10.3.0-0.1- Updated version number to 10.2.3-0.1- Update release number for release build- Updated version number to 10.2.2-0.1 - Moved web application deployment locations. - Updated Resteasy and Jackson dependencies. - Added missing python-lxml build dependency.- Update release number for release build- PKI TRAC Ticket #1187 - mod_perl should be removed from requirements for 10.2 - PKI TRAC Ticket #1205 - Outdated selinux-policy dependency. - Removed perl(XML::LibXML), perl-Crypt-SSLeay, and perl-Mozilla-LDAP runtime dependencies- Change resteasy dependencies for F22+- Ticket 1198 Bugzilla 1158410 add TLS range support to server.xml by default and upgrade (cfu) - PKI Trac Ticket #1211 - New release overwrites old source tarball (mharmsen) - up the release number to 0.2- Updated version number to 10.2.1-0.1. - Added CLIs to simplify generating user certificates - Added enhancements to KRA Python API - Added a man page for pki ca-profile commands. - Added python api docs- Disable pylint dependency for RHEL builds - Added jakarta-commons-httpclient requirements - Added tomcat version for RHEL build - Added resteasy-base-client for RHEL build- PKI TRAC Ticket #1130 - Add RHEL/CentOS conditionals to spec- Update release number for release build- PKI TRAC Ticket #1017 - Rename pki-tps-tomcat to pki-tps- Merged jmagne@redhat.com's spec file changes from the stand-alone 'pki-tps-client' package needed to build/run the native 'tpsclient' command line utility into this 'pki-core' spec file under the 'tps' package. - Original tps libararies must be built to support this native utility. - Modifies tps package from 'noarch' into 'architecture-specific' package- PKI TRAC Ticket #1127 - Remove 'pki-ra', 'pki-setup', and 'pki-silent' packages . . .- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild- Respin to include the applet files with the rpm install. No change to spec file needed.- Bugzilla Bug #1120045 - pki-core: Switch to java-headless (build)requires -- drop dependency on java-atk-wrapper - Removed 'java-atk-wrapper' dependency from 'pki-server'- PKI TRAC Ticket #832 - Remove legacy 'systemctl' files . . .- Update rawhide build- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild- Use Requires: java-headless rebuild (#1067528)- Added option to build without server packages. - Replaced Jettison with Jackson. - Added python-nss build requirement - Bugzilla Bug #1057959 - pkispawn requires policycoreutils-python - TRAC Ticket #840 - pkispawn requires policycoreutils-python - Updated requirements for resteasy - Added template files for archive, retrieve and generate key requests to the client package.- Trac Ticket 788 - Clean up spec files - Update release number for release build - Updated requirements for resteasy- Change release number for beta build- Updated requirements for tomcat- Removed additional /var/run, /var/lock references.- Removed delivery of /var/lock and /var/run directories for fedora 20.- Moved Tomcat-based TPS into pki-core.- Listed new packages required during build, due to issues reported by pylint. - Packages added: python-requests, python-ldap, libselinux-python, policycoreutils-python- Added pylint scan to the build process.- Added man pages for upgrade tools.- Cleaned up the code to install man pages.- Reorganized deployment tools.- Bugzilla Bug 973224 - resteasy-base must be split into subpackages to simplify dependencies- Updated dependencies to Java 1.7.- TRAC Ticket 606 - add restart / start at boot info to pkispawn man page - TRAC Ticket 610 - Document limitation in using GUI install - TRAC Ticket 629 - Package ownership of '/usr/share/pki/etc/' directory- Change release number for 10.1 development- Fixed incorrect JNI_JAR_DIR.- TRAC Ticket 605 Junit internal function used in TestRunner, breaks F19 build- TRAC Ticket 604 Added fallback methods for pkispawn tests- Added default pki.conf in /usr/share/pki/etc - Create upgrade tracker on install and remove it on uninstall- Change release number for official release.- Added %pretrans script for f19 - Added java-atk-wrapper dependency- Added pki-server-upgrade script and pki.server module. - Call upgrade scripts in %post for pki-base and pki-server.- Added dependency on commons-io.- Add /var/log/pki and /var/lib/pki directories- Run pki-upgrade on post server installation.- Added dependency on python-lxml.- Added pki-upgrade script.- Updated version number to 10.0.2-0.1.- Renamed base/deploy to base/server. - Moved pki.conf into pki-base. - Removed redundant pki/server folder declaration.- Removed jython dependency- Added minimum python-requests version.- Bugzilla Bug #919476 - pkispawn crashes due to dangling symlink to jss4.jar- Added dependency on python-requests. - Reorganized Python module packaging.- Added dependency on python-ldap.- TRAC Ticket #517 - Clean up theme dependencies - TRAC Ticket #518 - Remove UI dependencies from pkispawn . . .- Removed runtime dependency on 'pki-server-theme' to resolve Bugzilla Bug #916134 - unresolved dependency in pki-server: pki-server-theme- TRAC Ticket 214 - Missing error description for duplicate user - TRAC Ticket 213 - Add nonces for cert revocation - TRAC Ticket 367 - pkidestroy does not remove connector - TRAC Ticket #430 - License for 3rd party code - Bugzilla Bug 839426 - [RFE] ECC CRL support for OCSP - Fix spec file to allow f17 to work with latest tomcatjss - TRAC Ticket 466 - Increase root CA validity to 20 years - TRAC Ticket 469 - Fix tomcatjss issue in spec files - TRAC Ticket 468 - pkispawn throws exception - TRAC Ticket 191 - Mapping HTTP Exceptions to HTTP error codes - TRAC Ticket 271 - Dogtag 10: Fix 'status' command in 'pkidaemon' . . . - TRAC Ticket 437 - Make admin cert p12 file location configurable - TRAC Ticket 393 - pkispawn fails when selinux is disabled - Punctuation and formatting changes in man pages - Revert to using default config file for pkidestroy - Hardcode setting of resteasy-lib for instance - TRAC Ticket 436 - Interpolation for pki_subsystem - TRAC Ticket 433 - Interpolation for paths - TRAC Ticket 435 - Identical instance id and instance name - TRAC Ticket 406 - Replace file dependencies with package dependencies- TRAC Ticket #430 - License for 3rd party code- TRAC Ticket #469 - Dogtag 10: Fix tomcatjss issue in pki-core.spec and dogtag-pki.spec . . . - TRAC Ticket #468 - pkispawn throws exception- Replaced file dependencies with package dependencies- Updated man pages- Update to official release for rc1- TRAC Ticket #315 - Man pages for pkispawn/pkidestroy. - Added place-holders for 'pki.1' and 'pki_default.cfg.5' man pages.- Added system-wide configuration /etc/pki/pki.conf. - Removed redundant lines in %files.- Moved default deployment configuration to /etc/pki.- Cleaned up spec file to provide only support rhel 7+, f17+ - Added resteasy-base dependency for rhel 7 - Update cmake version- Update release to b3- Removed dependency on CA, KRA, OCSP, TKS theme packages.- Renamed pki-common-theme to pki-server-theme.- TRAC Ticket #395 - Dogtag 10: Add a Tomcat 7 runtime requirement to 'pki-server'- Update release to b2- TRAC Ticket #350 - Dogtag 10: Remove version numbers from PKI jar files . . .- Added Obsoletes for pki-selinux- Remove build of pki-selinux for f18, use system policy instead- Update required tomcatjss version - Added net-tools dependency- Update selinux-policy version to fix error from latest policy changes- Fix typo in selinux policy versions- Added build requires for correct version of selinux-policy-devel- Update release to b1- Merged pki-silent into pki-server.- Renamed "shared" folder to "server".- Added required selinux versions for new policy.- Added Provides to packages replacing obsolete packages.- Update release to a2- Modified CMake to use RPM version number- Added VERSION file- Merged pki-setup into pki-server- Added Conflicts for IPA 2.X - Added build requires for zip to work around mock problem- TRAC Ticket #312 - Dogtag 10: Automatically restart any running instances upon RPM "update" . . . - TRAC Ticket #317 - Dogtag 10: Move "pkispawn"/"pkidestroy" from /usr/bin to /usr/sbin . . .- Fixed pki-server to include everything in shared dir.- Added build dependency on redhat-rpm-config.- Merged Javadoc packages.- Added pki-tomcat.jar.- Moved webapp creation code into pkispawn.- Split pki-client.jar into pki-certsrv.jar and pki-tools.jar.- Merged pki-native-tools and pki-java-tools into pki-tools. - Modified pki-server to depend on pki-tools.- Split pki-common into pki-base and pki-server. - Merged pki-util into pki-base. - Merged pki-deploy into pki-server.- Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 17 - Changed Dogtag 10 build-time and runtime requirements for 'pki-deploy' - Altered PKI Package Dependency Chain (top-to-bottom): pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy --> pki-common- Added pki-client.jar.- Merged pki-jndi-realm.jar into pki-cmscore.jar.- PKI TRAC Task #254 - Dogtag 10: Fix spec file to build successfully via mock on Fedora 17 . . .- Moved 'pki-jndi-real.jar' link from 'tomcat6' to 'tomcat' (Tomcat 7)- Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 18- Added CLI for REST services- Integration of Tomcat 7 - Addition of centralized 'pki-tomcatd' systemd functionality to the PKI Deployment strategy - Removal of 'pki_flavor' attribute- BZ 813075 - selinux denial for file size access- Bug 745278 - [RFE] ECC encryption keys cannot be archived- Replaced candlepin-deps with resteasy- Added option to build without Javadoc- BZ 802396 - Change location of TOMCAT_LOG to match tomcat6 changes - Corrected patch selected for selinux f17 rules- Corrected 'junit' dependency check- Initial attempt at PKI deployment framework described in 'http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment'.- Added support for pki-jndi-realm in tomcat6 in pki-common and pki-kra. - Ticket #69.- For 'mock' purposes, removed platform-specific logic from around the 'patch' files so that ALL 'patch' files will be included in the SRPM.- Removed dependency on OSUtil.- 'pki-selinux' - Added platform-dependent patches for SELinux component - Bugzilla Bug #739708 - Selinux fix for ephemeral ports (F16) - Bugzilla Bug #795966 - pki-selinux policy is kind of a mess (F17)- Added dependency on Apache Commons Codec.- Add '-DSYSTEMD_LIB_INSTALL_DIR' override flag to 'cmake' to address changes in fundamental path structure in Fedora 17 - 'pki-setup' - Hard-code Perl dependencies to protect against bugs such as Bugzilla Bug #772699 - Adapt perl and python fileattrs to changed file 5.10 magics - 'pki-selinux' - Bugzilla Bug #795966 - pki-selinux policy is kind of a mess- Integrated 'pki-kra' into 'pki-core' - Integrated 'pki-ocsp' into 'pki-core' - Integrated 'pki-tks' into 'pki-core' - Bugzilla Bug #788787 - added 'junit'/'junit4' build-time requirements- Updated package version number- Added resteasy-jettison-provider-2.3-RC1.jar to pki-setup- Added JUnit tests- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #744797 - KRA key recovery (retrieve pkcs#12) fails after the in-place upgrade( CS 8.0->8.1) (cfu) - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #746367 - Typo in the profile name. (jmagne) - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - Bugzilla Bug #749927 - Java class conflicts using Java 7 in Fedora 17 (rawhide) . . . (mharmsen) - Bugzilla Bug #749945 - Installation error reported during CA, DRM, OCSP, and TKS package installation . . . (mharmsen) - 'pki-silent'- Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . (mharmsen) - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-setup' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - Bugzilla Bug #737192 - Need script to upgrade proxy configuration (alee) - 'pki-symkey' - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode (hsm+NSS). (jmagne) - 'pki-native-tools' - Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-util' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - Bugzilla Bug #737218 - Incorrect request attribute name matching ignores request attributes during request parsing. (awnuk) - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode (hsm+NSS). (jmagne) - 'pki-selinux' - Bugzilla Bug #739708 - pki-selinux lacks rules in F16 (alee) - 'pki-ca' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-silent' - Bugzilla Bug #739201 - pkisilent does not take arch into account as Java packages migrated to arch-dependent directories (mharmsen)- 'pki-setup' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-symkey' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-java-tools' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-common' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-silent' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .- 'pki-setup' - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-ca' - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-common' - Bugzilla Bug #699809 - Convert CS to use systemd (alee)- 'pki-setup' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-symkey' - 'pki-native-tools' - Bugzilla Bug #717643 - Fopen without NULL check and other Coverity issues (awnuk) - Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk) - 'pki-util' - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #700522 - pki tomcat6 instances currently running unconfined, allow server to come up when selinux disabled (alee) - Bugzilla Bug #731741 - some CS.cfg nickname parameters not updated correctly when subsystem cloned (using hsm) (alee) - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-selinux' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-ca' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-silent'- 'pki-setup' - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee) - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #724861 - DRMTool: fix duplicate "dn:" records by renumbering "cn=" (mharmsen) - 'pki-common' - Bugzilla Bug #717041 - Improve escaping of some enrollment inputs like (jmagne, awnuk) - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee) - Bugzilla Bug #708075 - Clone installation does not work over NAT (alee) - Bugzilla Bug #726785 - If replication fails while setting up a clone it will wait forever (alee) - Bugzilla Bug #728332 - xml output has changed on cert requests (awnuk) - Bugzilla Bug #700505 - pki tomcat6 instances currently running unconfined (alee) - 'pki-selinux' - Bugzilla Bug #700505 - pki tomcat6 instances currently running unconfined (alee) - 'pki-ca' - Bugzilla Bug #728605 - RFE: increase default validity from 6mo to 2yrs in IPA profile (awnuk) - 'pki-silent' - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee)- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an ECC CA to generate ECC certs from CRMF. (jmagne) - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any component value which is equal to its default value (alee) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #720510 - Console: Adding a certificate into nethsm throws Token not found error. (jmagne) - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an ECC CA to generate ECC certs from CRMF. (jmagne) - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any component value which is equal to its default value (alee) - Bugzilla Bug #722989 - Registering an agent when a subsystem is created - does not log AUTHZ_SUCCESS event. (alee) - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #719113 - Add client usage flag to caIPAserviceCert (awnuk) - 'pki-silent'- Updated release of 'jss' - Updated release of 'tomcatjss' for Fedora 15 - 'pki-setup' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-symkey' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-native-tools' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #717765 - TPS configuration: logging into security domain from tps does not work with clientauth=want. (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-util' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-java-tools' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (config file and record processing) (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (tweaks) (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-common' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs throws 'Invalid protocol' for OCSP subsystems (alee) - Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee) - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages (alee) - Bugzilla Bug #694143 - CA Agent not returning specified request (awnuk) - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages (jmagne) - Bugzilla Bug #698885 - Race conditions during IPA installation (alee) - Bugzilla Bug #704792 - CC_LAB_EVAL: CA agent interface: SubjectID=$Unidentified$ fails audit evaluation (jmagne) - Bugzilla Bug #705914 - SCEP mishandles nicknames when processing subsequent SCEP requests. (awnuk) - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #707416 - additional audit messages for GetCookie (alee) - Bugzilla Bug #707607 - Published certificate summary has list of non-published certificates with succeeded status (jmagne) - Bugzilla Bug #717813 - EV_AUDIT_LOG_SHUTDOWN audit log not generated for tps and ca on server shutdown (jmagne) - Bugzilla Bug #697939 - DRM signed audit log message - operation should be read instead of modify (jmagne) - Bugzilla Bug #718427 - When audit log is full, server continue to function. (alee) - Bugzilla Bug #718607 - CC_LAB_EVAL: No AUTH message is generated in CA's signedaudit log when a directory based user enrollment is performed (jmagne) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-selinux' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #720503 - RA and TPS require additional SELinux permissions to run in "Enforcing" mode (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-ca' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems (mharmsen) - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #716269 - make ra authenticated profiles non-visible on ee pages (alee) - Bugzilla Bug #718621 - CC_LAB_EVAL: PRIVATE_KEY_ARCHIVE_REQUEST occurs for a revocation invoked by EE user (awnuk) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-silent' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Added 'DRMTool.cfg' configuration file to inventory - 'pki-common' - 'pki-selinux' - 'pki-ca' - 'pki-silent'- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #532548 - Tool to do DRM re-key - 'pki-common' - 'pki-selinux' - 'pki-ca' - 'pki-silent'- 'pki-setup' - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #694569 - parameter used by pkiremove not updated - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs throws 'Invalid protocol' for OCSP subsystems - Bugzilla Bug #694569 - parameter used by pkiremove not updated - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages - Bugzilla Bug #694143 - CA Agent not returning specified request - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages - Bugzilla Bug #698885 - Race conditions during IPA installation - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems - 'pki-silent'- Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Bugzilla Bug #693327 - Missing requires: tomcatjss - 'pki-setup' - Bugzilla Bug #690626 - pkiremove removes the registry entry for all instances on a machine - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws file not found exception. - 'pki-common' - Bugzilla Bug #692990 - Audit log messages needed to match CC doc: DRM Recovery audit log messages - 'pki-selinux' - 'pki-ca' - 'pki-silent'- Bugzilla Bug #693327 - Missing requires: tomcatjss- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Require "jss >= 4.2.6-15" as a build and runtime requirement - Require "tomcatjss >= 2.1.1" as a build and runtime requirement for Fedora 15 and later platforms - 'pki-setup' - Bugzilla Bug #688287 - Add "deprecation" notice regarding using "shared ports" in pkicreate -help . . . - Bugzilla Bug #688251 - Dogtag installation under IPA takes too much time - SELinux policy compilation - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #689501 - ExtJoiner tool fails to join the multiple extensions - 'pki-common' - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #689662 - ocsp publishing needs to be re-enabled on the EE port - 'pki-selinux' - Bugzilla Bug #684871 - ldaps selinux link change - 'pki-ca' - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #684381 - CS.cfg specifies incorrect type of comments - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws file not found exception.(profile and CS.cfg only) - 'pki-silent'- Bugzilla Bug #688763 - Rebase updated Dogtag Packages for Fedora 15 (alpha) - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA instance - Bugzilla Bug #675742 - Profile caIPAserviceCert Not Found - 'pki-setup' - Bugzilla Bug #678157 - uninitialized variable warnings from Perl - Bugzilla Bug #679574 - Velocity fails to load all dependent classes - Bugzilla Bug #680420 - xml-commons-apis.jar dependency - Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's classpath - Bugzilla Bug #673508 - CS8 64 bit pkicreate script uses wrong library name for SafeNet LunaSA - 'pki-common' - Bugzilla Bug #673638 - Installation within IPA hangs - Bugzilla Bug #678715 - netstat loop fixes needed - Bugzilla Bug #673609 - CC: authorize() call needs to be added to getStats servlet - 'pki-selinux' - Bugzilla Bug #674195: SELinux error message thrown during token enrollment - 'pki-ca' - Bugzilla Bug #673638 - Installation within IPA hangs - Bugzilla Bug #673609 - CC: authorize() call needs to be added to getStats servlet - Bugzilla Bug #676330 - init script cannot start service - 'pki-silent' - Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's classpath- 'pki-common' - Bugzilla Bug #676051 - IPA installation failing - Fails to create CA instance - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA instance- 'pki-common' - Bugzilla Bug #674894 - ipactl restart : an annoy output line - Bugzilla Bug #675179 - ipactl restart : an annoy output line- Bugzilla Bug #673233 - Rebase pki-core to pick the latest features and fixes - 'pki-setup' - Bugzilla Bug #673638 - Installation within IPA hangs - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - 'pki-common' - Bugzilla Bug #672291 - CA is not publishing certificates issued using "Manual User Dual-Use Certificate Enrollment" - Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error. - Bugzilla Bug #504056 - Completed SCEP requests are assigned to the "begin" state instead of "complete". - Bugzilla Bug #504055 - SCEP requests are not properly populated - Bugzilla Bug #564207 - Searches for completed requests in the agent interface returns zero entries - Bugzilla Bug #672291 - CA is not publishing certificates issued using "Manual User Dual-Use Certificate Enrollment" - - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - Bugzilla Bug #672920 - CA console: adding policy to a profile throws 'Duplicate policy' error in some cases. - Bugzilla Bug #673199 - init script returns control before web apps have started - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #504013 - sscep request is rejected due to authentication error if submitted through one time pin router certificate enrollment. - Bugzilla Bug #672111 - CC doc: certServer.usrgrp.administration missing information - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #672333 - Creation of RA agent fails in IPA installation - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances - 'pki-silent' - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package- Bugzilla Bug #656661 - Please Update Spec File to use 'ghost' on files in /var/run and /var/lock- 'pki-symkey' - Bugzilla Bug #671265 - pki-symkey jar version incorrect - 'pki-common' - Bugzilla Bug #564207 - Searches for completed requests in the agent interface returns zero entries- Allow 'pki-native-tools' to be installed independently of 'pki-setup' - Removed explicit 'pki-setup' requirement from 'pki-ca' (since it already requires 'pki-common') - 'pki-setup' - Bugzilla Bug #223343 - pkicreate: should add 'pkiuser' to nfast group - Bugzilla Bug #629377 - Selinux errors during pkicreate CA, KRA, OCSP and TKS. - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from OpenLDAP instead of the Mozldap - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #658926 - org.apache.commons.lang class not found on F13 - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #665388 - jakarta-* jars have been renamed to apache-*, pkicreate fails Fedora 14 and above - Bugzilla Bug #23346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #656733 - Standardize jar install location and jar names - 'pki-symkey' - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #644056 - CS build contains warnings - 'pki-native-tools' - template change - Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from OpenLDAP instead of the Mozldap - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #644056 - CS build contains warnings - 'pki-util' - Bugzilla Bug #615814 - rhcs80 - profile policyConstraintsCritical cannot be set to true - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #635033 - At installation wizard selecting key types other than CA's signing cert will fail - Bugzilla Bug #645874 - rfe ecc - add ecc curve name support in JSS and CS interface - Bugzilla Bug #488253 - com.netscape.cmsutil.ocsp.BasicOCSPResponse ASN.1 encoding/decoding is broken - Bugzilla Bug #551410 - com.netscape.cmsutil.ocsp.TBSRequest ASN.1 encoding/decoding is incomplete - Bugzilla Bug #550331 - com.netscape.cmsutil.ocsp.ResponseData ASN.1 encoding/decoding is incomplete - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #658188 - remove remaining references to tomcat5 - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #223319 - Certificate Status inconsistency between token db and CA - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation - 'pki-java-tools' - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1 - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #662156 - HttpClient is hard-coded to handle only up to 5000 bytes - Bugzilla Bug #656733 - Standardize jar install location and jar names - 'pki-common' - Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review - Bugzilla Bug #623745 - SessionTimer with LDAPSecurityDomainSessionTable started before configuration completed - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #615827 - rhcs80 - profile policies need more than 5 policy mappings (seem hardcoded) - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #548699 - subCA's admin certificate should be generated by itself - Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA - Bugzilla Bug #563386 - rhcs80 ca crash on invalid inputs to profile caAgentServerCert (null cert_request) - Bugzilla Bug #621339 - SCEP one-time PIN can be used an unlimited number of times - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #629677 - TPS: token enrollment fails. - Bugzilla Bug #621350 - Unauthenticated user can decrypt a one-time PIN in a SCEP request - Bugzilla Bug #503838 - rhcs71-80 external publishing ldap connection pools not reliable - improve connections or discovery - Bugzilla Bug #629769 - password decryption logs plain text password - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #586700 - OCSP Server throws fatal error while using OCSP console for renewing SSL Server certificate. - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #607380 - CC: Make sure Java Console can configure all security relevant config items - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #489342 - com.netscape.cms.servlet.common.CMCOutputTemplate.java doesn't support EC - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1 - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #635033 - At installation wizard selecting key types other than CA's signing cert will fail - Bugzilla Bug #621341 - Add CA support for new SCEP key pair dedicated for SCEP signing and encryption. - Bugzilla Bug #223336 - ECC: unable to clone a ECC CA - Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned by Reason Code - onlySomeReasons ? - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #223313 - should do random generated IV param for symmetric keys - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #630176 - Improve reliability of the LdapAnonConnFactory - Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes). - Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple Certificates from the Same Request - Bugzilla Bug #648757 - expose and use updated cert verification function in JSS - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #451874 - RFE - Java console - Certificate Wizard missing e.c. support - Bugzilla Bug #651040 - cloning shoud not include sslserver - Bugzilla Bug #542863 - RHCS8: Default cert audit nickname written to CS.cfg files imcomplete when the cert is stored on a hsm - Bugzilla Bug #360721 - New Feature: Profile Integrity Check . . . - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #642359 - CC Feature - need to verify certificate when it is added - Bugzilla Bug #653713 - CC: setting trust on a CIMC cert requires auditing - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1 - Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA. - Bugzilla Bug #661889 - The Servlet TPSRevokeCert of the CA returns an error to TPS even if certificate in question is already revoked. - Bugzilla Bug #663546 - Disable the functionalities that are not exposed in the console - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #658188 - remove remaining references to tomcat5 - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #642741 - CS build uses deprecated functions - Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - 'pki-selinux' - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #667153 - store nuxwdog passwords in kernel ring buffer - selinux changes - 'pki-ca' - Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA - Bugzilla Bug #583824 - CC: Duplicate servlet mappings found as part of CC interface doc review - Bugzilla Bug #621602 - pkiconsole: Click on 'Publishing' option with admin privilege throws error "You are not authorized to perform this operation". - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #519291 - Deleting a CRL Issuing Point after edits throws 'Internal Server Error'. - Bugzilla Bug #586700 - OCSP Server throws fatal error while using OCSP console for renewing SSL Server certificate. - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1 - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned by Reason Code - onlySomeReasons ? - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes). - Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple Certificates from the Same Request - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #529945 - (Instructions and sample only) CS 8.0 GA release -- DRM and TKS do not seem to have CRL checking enabled - Bugzilla Bug #609641 - CC: need procedure (and possibly tools) to help correctly set up CC environment - Bugzilla Bug #509481 - RFE: support sMIMECapabilities extensions in certificates (RFC 4262) - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #511990 - rhcs 7.3, 8.0 - re-activate missing object signing support in RHCS - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661128 - incorrect CA ports used for revoke, unrevoke certs in TPS - Bugzilla Bug #512496 - RFE rhcs80 - crl updates and scheduling feature - Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA. - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #223346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #668100 - DRM storage cert has OCSP signing extended key usage - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation - 'pki-silent' - Bugzilla Bug #627309 - pkisilent subca configuration fails. - Bugzilla Bug #640091 - pkisilent panels need to match with changed java subsystems - Bugzilla Bug #527322 - pkisilent ConfigureDRM should configure DRM Clone. - Bugzilla Bug #643053 - pkisilent DRM configuration fails - Bugzilla Bug #583754 - pki-silent needs an option to configure signing algorithm for CA certificates - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #640042 - TPS Installlation Wizard: need to move Module Panel up to before Security Domain Panel - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #588323 - Failed to enable cipher 0xc001 - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #645895 - pkisilent: add ability to select ECC curves, signing algorithm - Bugzilla Bug #658641 - pkisilent doesn't not properly handle passwords with special characters - Bugzilla Bug #642741 - CS build uses deprecated functions- Bugzilla Bug #668839 - Review Request: pki-core - Removed empty "pre" from "pki-ca" - Consolidated directory ownership - Corrected file ownership within subpackages - Removed all versioning from NSS and NSPR packages- Bugzilla Bug #668839 - Review Request: pki-core - Added component versioning comments - Updated JSS from "4.2.6-10" to "4.2.6-12" - Modified installation section to preserve timestamps - Removed sectional comments- Initial revision. (kwright@redhat.com & mharmsen@redhat.com)  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghi10.5.18-23.el7_9    pki-ca-10.5.18LICENSEpki-ca.jarcaconfCS.cfgCatalinalocalhostca.xmlacl.ldifacl.propertiesauth-method.propertiescaAuditSigningCert.profilecaCert.profilecaOCSPCert.profilecrlcaissuer.ldifcrlcaissuertasks.ldifdb.ldifeccAdminCert.profileeccServerCert.profileeccSubsystemCert.profileflatfile.txtindex.ldifindextasks.ldifjk2.manifestjk2.propertiesjkconf.ant.xmljkconfig.manifestproxy.confregistry.cfgrsaAdminCert.profilersaServerCert.profilersaSubsystemCert.profileserver-minimal.xmlserverCert.profile.exampleWithSANserverCert.profile.exampleWithSANpatternshm.manifesttomcat-jk2.manifesttomcat-users.xmluriworkermap.propertiesvlv.ldifvlvtasks.ldifworkers.propertiesworkers.properties.minimalworkers2.propertiesworkers2.properties.minimalemailsExpiredUnpublishJobExpiredUnpublishJobItemcertIssued_CAcertIssued_CA.htmlcertIssued_RAcertIssued_RA.htmlcertRequestRejected.htmlcertRevoked_CAcertRevoked_CA.htmlcertRevoked_RAcertRevoked_RA.htmleuJob1.htmleuJob1Item.htmlpublishCerts.htmlpublishCertsItem.htmlreqInQueue_CAreqInQueue_CA.htmlreqInQueue_RAreqInQueue_RA.htmlriq1Item.htmlriq1Summary.htmlrnJob1.txtrnJob1Item.txtrnJob1Summary.txtprofilescaAdminCert.cfgDomainController.cfgECAdminCert.cfgcaAdminCert.cfgcaAgentFileSigning.cfgcaAgentServerCert.cfgcaAuditSigningCert.cfgcaCACert.cfgcaCMCECUserCert.cfgcaCMCECserverCert.cfgcaCMCECsubsystemCert.cfgcaCMCUserCert.cfgcaCMCauditSigningCert.cfgcaCMCcaCert.cfgcaCMCkraStorageCert.cfgcaCMCkraTransportCert.cfgcaCMCocspCert.cfgcaCMCserverCert.cfgcaCMCsubsystemCert.cfgcaCrossSignedCACert.cfgcaDirBasedDualCert.cfgcaDirPinUserCert.cfgcaDirUserCert.cfgcaDirUserRenewal.cfgcaDualCert.cfgcaDualRAuserCert.cfgcaECAdminCert.cfgcaECAgentServerCert.cfgcaECDirPinUserCert.cfgcaECDirUserCert.cfgcaECDualCert.cfgcaECFullCMCSharedTokenCert.cfgcaECFullCMCUserCert.cfgcaECFullCMCUserSignedCert.cfgcaECInternalAuthServerCert.cfgcaECInternalAuthSubsystemCert.cfgcaECServerCert.cfgcaECSimpleCMCUserCert.cfgcaECSubsystemCert.cfgcaECUserCert.cfgcaEncECUserCert.cfgcaEncUserCert.cfgcaFullCMCSharedTokenCert.cfgcaFullCMCUserCert.cfgcaFullCMCUserSignedCert.cfgcaIPAserviceCert.cfgcaInstallCACert.cfgcaInternalAuthAuditSigningCert.cfgcaInternalAuthDRMstorageCert.cfgcaInternalAuthOCSPCert.cfgcaInternalAuthServerCert.cfgcaInternalAuthSubsystemCert.cfgcaInternalAuthTransportCert.cfgcaJarSigningCert.cfgcaManualRenewal.cfgcaOCSPCert.cfgcaOtherCert.cfgcaRACert.cfgcaRARouterCert.cfgcaRAagentCert.cfgcaRAserverCert.cfgcaRouterCert.cfgcaSSLClientSelfRenewal.cfgcaServerCert.cfgcaServerKeygen_DirUserCert.cfgcaServerKeygen_UserCert.cfgcaSignedLogCert.cfgcaSigningECUserCert.cfgcaSigningUserCert.cfgcaSimpleCMCUserCert.cfgcaStorageCert.cfgcaSubsystemCert.cfgcaTPSCert.cfgcaTempTokenDeviceKeyEnrollment.cfgcaTempTokenUserEncryptionKeyEnrollment.cfgcaTempTokenUserSigningKeyEnrollment.cfgcaTokenDeviceKeyEnrollment.cfgcaTokenMSLoginEnrollment.cfgcaTokenUserAuthKeyRenewal.cfgcaTokenUserDelegateAuthKeyEnrollment.cfgcaTokenUserDelegateSigningKeyEnrollment.cfgcaTokenUserEncryptionKeyEnrollment.cfgcaTokenUserEncryptionKeyRenewal.cfgcaTokenUserSigningKeyEnrollment.cfgcaTokenUserSigningKeyRenewal.cfgcaTransportCert.cfgcaUUIDdeviceCert.cfgcaUserCert.cfgcaUserSMIMEcapCert.cfgsetupregistry_instancewebappsROOTWEB-INFweb.xmlindex.jspca404.html500.htmlGenUnexpectedError.templateWEB-INFlibpki-ca.jarpki-certsrv.jarpki-cms.jarpki-cmsbundle.jarpki-cmscore.jarpki-cmsutil.jarpki-nsutil.jarvelocity.propertiesweb.xmladminGenUnexpectedError.templatecaEnrollSuccess.templateImportAdminCert.templateImportCert.templateadminEnroll.htmlsecuritydomainlogin.templatesendCookie.templatecms-funcs.jsconsolehelpfun.jsindex.jspagentGenError.templateGenPending.templateGenRejected.templateGenSuccess.templateGenSvcPending.templateGenUnauthorized.templateGenUnexpectedError.templatecaEnrollSuccess.templateImportCert.templateListRequests.htmlProfileApprove.templateProfileList.templateProfileProcess.templateProfileReview.templateProfileSelect.templateSrchCert.htmlSrchRequests.htmlSrchRevokeCert.htmlUpdateDir.htmlbulkissuance.templatecloneRedirect.templateconfirmRevocation.templatedisplayBySerial.templatedisplayBySerial2.templatedisplayCRL.templatedisplayCertFromRequest.templateerror.templateframeCRL.htmlframeDir.htmlframeDisplayCRL.htmlframeList.htmlframeListReq.htmlframeOCSP.htmlframeProfile.htmlframeRevoke.htmlframeSearch.htmlframeSrchRequests.htmlframeStats.htmlgetOCSPInfo.templategetStats.templateindex.jspmenuCRL.htmlmenuDir.htmlmenuDisplayCRL.htmlmenuList.htmlmenuListReq.htmlmenuOCSP.htmlmenuProfile.htmlmenuRevoke.htmlmenuSearch.htmlmenuSrchRequests.htmlmenuStats.htmlmonitor.htmlmonitor.templatenotImplemented.htmlprocessCertReq.templateprocessReq.templatequeryBySerial.htmlqueryCert.htmlqueryCert.templatequeryReq.templatereasonToRevoke.templaterevocationResult.templaterevokeBySerial.templaterevokeCert.htmlsrchCert.templatetoDisplayCRL.templatetoUpdateCRL.templatetop.htmlunrevocationResult.templateupdateCRL.htmlupdateCRL.templateupdateDir.templatecms-funcs.jsfuncs.jsheader.templatehelpfun.jsindex.jspindex.templateports.templateeeGenError.templateGenPending.templateGenRejected.templateGenSuccess.templateGenSvcPending.templateGenUnauthorized.templateGenUnexpectedError.templatecaAIMEnroll.htmlCMCEnrollment.htmlCMCRevReq.htmlCertBasedDualEnroll.htmlCertBasedEncryptionEnroll.htmlCertBasedSingleEnroll.htmlChallengeRevoke1.htmlDirPinUserEnroll.htmlDirUserEnroll.htmlDisplayCRL.htmlEnrollSuccess.templateGetCAChain.htmlImportAdminCert.templateImportCert.templateKeyRecovery.htmlManCAEnroll.htmlManObjSignEnroll.htmlManRAEnroll.htmlManServerEnroll.htmlManUserEnroll.htmlOCSPResponder.htmlObjSignPKCS10Enroll.htmlPortalEnrollment.htmlProfileList.templateProfileSelect.templateProfileSubmit.htmlProfileSubmit.templateRenewalSuccess.templateRevocationSuccess.templateUserRenewal.htmlUserRevocation.htmlbench2k.htmlblank.htmlcheckRequest.htmldisplayBySerial.templatedisplayBySerial2.templatedisplayCRL.templatedisplayCaCert.templatedisplayCertFromRequest.templateenrollMenu.htmlindex.jsppolicyEnrollmentindex.jspprofileMenu.htmlretrievalMenu.htmlrevocationMenu.htmlprofileEnrollmentindex.jspprofileMenu.htmlretrievalMenu.htmlrevocationMenu.htmlprofileMenu.htmlqueryBySerial.htmlqueryCert.htmlqueryCert.templatereasonToRevoke.templaterecoveryMenu.htmlremoteAuthConfig.templaterenewalMenu.htmlrequestStatus.templateretrievalMenu.htmlrevocationMenu.htmlrevocationResult.templatesrchCert.htmlsrchCert.templatetabs.htmltoDisplayCRL.templateunrevocationResult.templatecms-funcs.jshelpfun.jsindex.jspindex.jspservices.template/usr/share/doc//usr/share/doc/pki-ca-10.5.18//usr/share/java/pki//usr/share/pki//usr/share/pki/ca//usr/share/pki/ca/conf//usr/share/pki/ca/conf/Catalina//usr/share/pki/ca/conf/Catalina/localhost//usr/share/pki/ca/emails//usr/share/pki/ca/profiles//usr/share/pki/ca/profiles/ca//usr/share/pki/ca/setup//usr/share/pki/ca/webapps//usr/share/pki/ca/webapps/ROOT//usr/share/pki/ca/webapps/ROOT/WEB-INF//usr/share/pki/ca/webapps/ca//usr/share/pki/ca/webapps/ca/WEB-INF//usr/share/pki/ca/webapps/ca/WEB-INF/lib//usr/share/pki/ca/webapps/ca/admin//usr/share/pki/ca/webapps/ca/admin/ca//usr/share/pki/ca/webapps/ca/agent//usr/share/pki/ca/webapps/ca/agent/ca//usr/share/pki/ca/webapps/ca/ee//usr/share/pki/ca/webapps/ca/ee/ca//usr/share/pki/ca/webapps/ca/ee/ca/policyEnrollment//usr/share/pki/ca/webapps/ca/ee/ca/profileEnrollment/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz9x86_64-redhat-linux-gnu       directoryASCII textASCII text, with CRLF line terminators (Zip archive data, at least v2.0 to extract)ASCII text, with very long linesXML 1.0 document textexported SGML document, ASCII textC++ source, ASCII textHTML document, ASCII textXML 1.0 document, ASCII textHTML document, ASCII text, with very long lines?7zXZ !X] crt:bLL*Mx `\8`vYBA"'+zo#%_DaFX|k7ޜ% [v<9I&raBU ,0R+<oT]C't)HLغ}b-ѯ6>7_1NANfޕrz-Q,Щj:\ Xg2ЕVB)+Dm 'O%a=z|8dwBAu9nMeB2'h X%IjM, r2b@(*!Hى5忌 B'SNǢ+9YBhQJĜ`WSyPwZ0:NwH0ƪuc<ד0P O,>yXS~SL-QV-"je]^ Lm "X=Nrퟎ$0.c9mW禔Yy)$ly$RvJl*Lê ȲAO|Vno qf-d=f9 J5.n9`2y-+ J.)IwCyMTw죅8aܓ"P Ω4ZN۠ 6[t;51BEo,#J@ۍV_k :^.Ur/Z ,5gq5R|D^'Qֹ/ N!JYz7c6{'VΨ R=vNɅ#?5bf_ґ20S7)<5ε? QĖu߽Tso߃%,0{9\I'})}a<)I zW5I"XąWmkܖg iZ&\;COS[!Ha',fpM!7ABiI)\;U*krj,ZH]:d|?O~%MhU XWsf 6Q7䨪Kn2z`"q(Mazm2}?wn-m\bMS԰C =R>Zok(qA@oweS84=;͖tf),n_I>TIXL³mLDMwwgDty[NxV!FHlf\](J<]xW`4ES,W.Doiu&Hd,Wc<|I,jX!'8 y@b6t&T"x־ ΢c~ƧUNK!?֒ʛxX5WF#8WWme`utRDW$4`2rY%o ɝ e gfdžz<虐 9o?[sKLGo +'e)}B:(AvA7f]IF@CØҒI`IA=ל[.8/بrL1;Aċ|*jX2('16&A63BJPq V'ͻB=Sz.(Vټe< nGJyU `v:]:|r 'GDHtT."wr{+!#bV JacYCa&`vH@-}l:Adi?CO {1ߙKrx:* OMs.uK 3ж)Dža3HlܤxW ,%ईLlGݯJ~ ލf#_ed8T?f_,^S5!7Ʒ">0>u'4~YsD29FW8C#W_ȧ#ZBx9i&Q/ݞXňfN™ϢQYSq#5]]|Btn^Ggy8fC}ÕKׯt@M2F!ΰXyEwS%9W{eD#a"̥šp⊎%>Rc˗^Iza+h!ܝ0 xḾ '8g0v/Hme&0/[=N&o̼.R^O| ÌIt<1n6j30Hp&mQ㚀(vPy=*U١[\*_J7jbI(jH4ck Db5\zNT1Sz! Vpu.?1IGx!N/RķJJif# +r7ڊX %6\g >7։.FNBє;RT`gI蔧OXg<U8mQ7wcԻoޠa Y]@𶢐KN/%*q)Z ?UIYWt^<,Baw 4=a@y:Vל=.$ lQ ƱEZz]`(2}.D^j!g6[H.ǑR "f)c 9Z퉪_F(`M`C'."2iR>\h$?J0Tm˴ŤjX(%\&9}j3dsn|pAgu]-*&!esƢxp@Z(!Pp[$C =uA⟾9#p7& %ID=$mص>q~\kdٮ`aoH X k]4_6p|& 9鏙v*7r#|IuB'8r+~j9ܸV=?ުĐ xRM.h?76{-kF@&yZ<[g I|'9ߠ(ECS ST]T=/^!$@wZ ʀiEb׭&Û3΂Qnog(tG"l :<l?q_,|/r}v'P TScrҡiІj U65lxx^IIohxQgI0) uߩrzK`| O(}" W7-RlLSfyOXwP} /F:fVN5LA1ߝKpkdԜ!9#6d }#!?]Y }^X䖂&1En  SzHiW}rR3<jce1`8u2vʤet^Q7YQ*$,l~x3C0%E#&b;:$"4(SY*EN;zc-료+E=SC+DŽ2A7 S5}1*a5.y-\: 60g5%A!L޳D~ ޜs`/Wa|/**BϪl;"ɐ>C? 1ysQqk# R1${yI +XvjFxOP2F"}޼SUE.e3>%lz^ףoqp#a{_=-MˌOk B %A$NWIpe,:Mnq^8R+14ūWTNpz96Gkt3:}}i@tWZ'*oŻU| ?5 p>!D=GuVP:4FJzvůlnU %pˬS\9 +MA%,5? YS}qP߳]tmYj^z2ݠo3zjPu V\'՘BS'Ύz\SW fpmF Z0 j.ƥ=DdC,³n}[ yE86$hO;O$Q"_Z(uw r 5{4[$K=Z< J~tGH3Y [H؆IgoR\O`W_E@o/~Y\bZ44}Gg*,'WK5&: QP:顫D^^,#f?PlȇoϼҹFs|d˜3;3:Bg$!g5VOQ0xsOQy[<ÅaJ^L8˦^ד6ءTLW"P7pow'=, 9]XAnEQQY^"2eO* 5[a *ن Ha+a)b3xoXaΎTk!sƱyWaj"7UďKXoZ\t9gδฌhCu&|5A%'iNILLrK2k4/$c4H 6d1nP |SQ C}{'U}?OVD*:H\Y^D>&A9 'sePo# ]T|nL ZkmBxu4jÌ$G2  _Ty^Vgz> 񪛏ZgM)X\SkLפfu(Ժ$UsϫrqK݋ALJ yDn]dA 2!W$_rpbљ5ZX|jm #Ǜ%P@?̘勁UP*>Z_*_2x ی/Ǭ)^f(״q꾔QK.T +簛2~: OTd'%u8 )qүrր)>kl?-ZJ56$hi1H 0 DD$# ]ojm,2?VK-lVK#ZP#]g# o@ m3`>/[Dy :`ڤ1 (JT헐q^~mP|y'hcw>6#bdF,)wЅO&US} ~47Xгw|rO4K<,I'\ZL.}ڣ2"8+AiI!#~{^)pѣ3u;[F6d- qPOk`KM'۝9Ϲ/lvODeh#;ZrozY(C5xSrs:ׁT8h *٬?HNcz-!6X!3Z*ܾͽ;P1M5[;1shkQZ,.!D=ˍ^iB0$F> W-үu+u0@]{@u"5.S*[$)x9v(uSUcvC_4L!gx"B+<&Bv }LX6뵪UI@+ *?8;_s%X:by.K ^xLܩy;tH⽭@j6b iEKB 3|`< V@԰l)VPR'hњ9\z{<2|!uR|\Fdp:%l-[D v1l/î-A)`Ms#M Y03E>h Dh)p_@'qv5p'UAV9-MGh*fd<"Pc-7&yX%#u OuJİiZ(+_[@&J!qa4ezz^U*}B,XlĐ:h n?Nwٻ5ͥ0)C>T bϋ߶qNU2\V9 2̯վ>qla]>-|֞Y2*>/+& =mAP1%+@ }{4n3DVTKE4i5O}ۯz#q$td+]nX cp%8e}k05kUzz 5mݬbJҎ9te׶D1*GG oGHoeu6qzm:u"Hc3X@aPx,=>'pn>$C:r,^ӽkxiuC.LK'cq*qG(;֥R̔{Y$y32E+nuل-:J)Ą&;EM?*ِb.-0vzK%=\"c9J5XJMpZvLvsjj ;*WHv}Dڌ;~_Yutz? Z*q5FiSR ߚrdePƄk0Cbi%t~?8S<*_|` UFKdV4.8)ohd*wd,јm5WnH"8zatY-[h;g4f}@~Sf=q*#?R#kԬu~0ϧ~~T!0#yCRyW"T.}Ntatp:49c: kA 5\@5"D6ȅ$^y+ctbqx>SLOp9"x=M=1$. l2(fmV 7ɐ[6PXN-E3e{hL/"r;-A]ܵi\xz}yڑU?:"> Lֹ:@yU-J?(P|^uE;ۻJ%z} LY~`?U͒FN (W$F6@ wwY[R7_x^+LF],vMb5݉?`)զzi+=C,El⏆CBf̰#\x#˵)- G8005Ҕ  ݺj@#dq+D M%Hj6.c}b>y4O żDD4Sۍv{_ /iAXO1K[u pahsSf̰BQ'H ; Ԥ$jɅln!cp aGWd3T-ޒb=}7};SX֧,bN5h?Jٚ=![\3bBR5qPb{2ZƋRzB0Ő.G>b+U\d?>`+gW0kt-8UbU?n6ūÕ /9َU& oa<ۥD: kG#*b?YTь'̵&ͷCRUBG^Z]g?yٕw4wX,y˴'X[1KC&FoF{Pg F8|Ή4<||'U`u M "XszcBA.0E= pP+t(mEl1e4IBTOPd݈/)c8ppvcg-:NU6/ EF<8+iɖK Q'C]!YߒbtEԎNփ5 @HCm a B-opSqlS0cE'Fg/IӓR"pֻU6'5ڊp沲2g=ת]; pWTe_U=HAB}P-jK;S|kғ>&15V }e? VDJ*fb"Skۘ~] ~1u  &6l7a3=&l:UQwSm+_`#k/N8͎LB!4 PizbW 3{\h<<&6ϦG2!+0Y*I7xK9W븠\0o,lmb W`@1Բf [9dfR7lt=w!l8ò-{/i G{c ӟ07`~-3n\jIa D\T_p,8;r],sO?pMA (ULb/{V:Mo/z`(}h/C#o#@ABp4zQsgȝcG0AOݎ 2Q40ϋ{PW:jAy P; |!2rw/$9%tx\MĚm z"ɿzh1y%,q9|VOݞj5Iui<TǧelB^ = ɛ^"bJK !PR_粑"&K> ApVa/wdVa*md)0++jb8sN;n TN7O6 >LS¥BPSq5+rc?4?Keb.h"Xz{s0HI^ :ƇŌh=^dޞs[i<䎟<MhbݮuCTS,dki{לlCf*0LqHk5Άen Pl(bWxi~%$ +h/ ID؜S`]Z؏=&p-ؙPCڵ#ދ W耊͗wl,#&I8y|͓}o27 zQIh`GyStiuд)Ox;sWa5ʕjζ}YU'nZhec8ɎQ0&b4c7fLG@~>Nيv3 Gcۢc,,}Ay|ʕLŝ v GKJ PZvS [B7_  >ZѩL*Hs=Crq:btϞͽ<G/wLø7z^!TW_~>C@R)*GQVʜ^(l 1~AWwv|Ya :J3b6ȍ/ Yey!Zj 7 ȯrfa7|a,,w5H-a)lKE5b\]m\mRH0ƝC'0*ߜLCZ\eV*hEwŤ$]oGtiUG9QcUFE9`rYvU=|EI5BueQ1̙EUAC\G " D3ym)vv}TJ:ru戫;H,dϬ#o4sUؾs4tIa8crre~٨Y4$J+H;*u ,֝P\Ӕ6l x plYgD6af~G7k^ڐjPwVc*ED:ڋ`@?eH9ԏDm?^' K2&\bўЈDp;i#?aPKq.0ɳ^F[*9_W22Aт93Mkg}[8=_' :rhA8|x%_Q?$ BLg; mjBZ ~>ͺƏZ Zó<Xxp_&HW|a۵ia8kucz0-Uv$&n^ʼn.||TX=0:8ԥ! =٠v/2oTE*Ⱦ(=o)[P<e I{Xs<İN CY]Q%?Ȏms@)dJ68_2ѳue"OY3-sOL8oxkD%AR?˻-9|:^иu ~2P'q\-}ׂaQ+Z}1 mZV\\M)%*Pwsg1a@%G_{_>]dk:10w旛N1+*|t+k X5ZF-/"#i< (0`=j/zn4,C\ʵṞtHEBqSƋƬү#|HB$1Ç uoX}$Cɵ]gHҞjh=gUl)whEA&#&7h凢doP|w/LIF\?5q'WTF;>nI,'',bu PN:&elؤ #>7"0F]M0p!9950p鼲Kf+⥩_n g%i33 1cy<⪨$XxjMI |FD4/3lۖW}/d)l"f~0ѯ<ORF*W+إ,Y>@>xoNgֳX'*7&ּ&$H6o98"GTjId aX2%|\V5a?-D{. H޺-E'Ω2E^]}Jb '"=M[ku@".e5EuM(SWo_ھn%K瓄gZFJ ~uK&y5>wPT='Ɯb3򸜾^Ӟ_V]9P蔸*(A<}ȃk_gq!+Og` nazVyj\ޕܬL>O*̗C-1Ҷ$`S~27E^'&o =ټ57m܋N@[.(2Agl^θ9:5˴)HWˣFr/e -ȖI (^Td>#3lI:4ZGaR3Pզg4aoI|!1e?h;cEhG|s1K,_r$ [nWgQДW H;m 5B*v9N@\N/Dϱ=.K&D8LevK]mMTG"v׊jW}O8[wSf J͕:_F@Fa&|MKI9{pe oXD5Q:mOq6ӫ}+Yl tT"Z{vuX[@!]y.嫃i]Y_<`L@( _sl~l ;rN.N`9V)ZS\ޓdj{'%Vr8WEgj `#%kd섶]s*8fآ@lSL@6,m+#M:*s񂶮idm@!.. WBSƒs/ifiz*\Py'2Lnc:e=6e6^b YQ9*yKY< א,hD^D@zML, e0><d[kʎxf]ڜI(`g 2V7f&{*۱3ׂCySLAW `=aQCKZ])ߓз ~oBSͤLK&h{X7 AS`u=!˅:~zOl M*S'G29M{D y5Az~IiiلIfxj(B)~EK> Yܓa& ԛlXT"[9*tlKE$ $HnK68[֤;ݓ3Zʚ S3⟳ AE o *R\Edy:| Aai0x1#PűS?T6+HukrxBkQof!AQp.%uf_ySFQb(=<Q,HւW+Vo ,n%K{k]&U"VSnFBM9 xa#gM*o!hr]sWZo^)R6쏐'8b>L@*eUJ[20baٹ˦Sii6Cw[f|_ t./K|V"=c2IyϲOyXV.M ?30/ =l&Fb(9,&L0ƒ7z”2* D#ĢB;,W~FW,*")oձ tDЌ<蔏Yꤞ˜ZҰ>#:R dp2?KlϺ8\g[쯖o&K<{c5b9qHHKse{ w,V "k|aLzYWHڃJIuq_6TZbKj !ƊRȋq`+l-oѹbqԌ.pyWۏk䕫W0Cd4/tچ\7u_CN ?ԏ%_ʘ0mv r#WB=p $7SY"6N jj5缈' }-E`(:u{T%m"+GYĽ+r{"u2E掘ә>^ uvMKDM/KI?PDJ_&?l<8rӒX;GB҇B T02YW$X jbGe*YUFjB}ǬҚS٤K&u-5fZ aX$7ZV4WK8HoN*6jUBSDSIipTSD<uZIcqp4pW#znf䅀ӓHk8#=r9)ijiWt ai&NwU`xNI+IIidj:?b폓]tIr1 Vsy4}Z10kގDKMMaB׋ΰ %a֏&hgVMAS1%F[,$AISi;\Oªfƌ/&4`{96}2ơ`85c." Ah4;'SJ6/BQNz]SX]VSXbj84$scqY$} ]]d̀zl݈q1?3PqhA؞mr3yq*b^+S(Z?=i$PPJ0?BK]0=57;% # Cgut֌N-M+"a۔*Ay*ޯ_P >Α_%Ek=tuZ` pv:x3>Md f >惾GBT'04F~TE݃ }.6c`7N8G #_@L&ݡ}. Ё$Bvw ÅDx LFc[4fzP:]?L" [ (aAtS˒Q@sa.#|S0-$31L+#nlgKZ^qGt*hhev\*lJ/owmS׀@UGպDńr'h8ߜg{C $uM6PI CFѰ 7$f#QW 鉉u1[3#9|ш0{$w; ϴlwSi۪9!0һ "oKiq\]/Or- uͱ5ӷ[ij61 B9rE{fGh0(X^( 7jaw˓"ύ t`i%DiO&pVee9y\ZǨgPz.wCs,li5z^arۡ>g+XK`scA2(HAuʅАQ?ތh}c ͌  jOo9e?=c^Ve#^t?usP\?vLS&$2L*|tcTH'OƂS m%Of ErLpὠPCWu;-BTbXn= RߣRBSaO{yV̔T$ Nl0D5Wv?E!aIФzwυ# \Zy؋ETΜݠl FNUhF>ɣ!_◿ Ϗ3Q5ao.tgy용'w; SogQoRJhk]* K=rLCi#; DB;Y HZXv?DZI'4oHmQE& ֏ E"K-~IJ1 %POu*|ipOS@pÖ*4bA9QYUJk|SuTf]D Sv8HZ-R4d^XjöԳ|$w,ui!}E*N5s$~ cX1i _vzN%_Eyܺ:Ă\ ,,? ^ĊBїſ}(.c}ϸ_ '{./4X@{dP!ͰYQ"v:B[4]O0ؐ3I&`0[PDD[31uߛxDTAŝe~r>~#S̀#k'kC}{N]ajm^wTXJo煾C͜4MC;;Atkg"Is-V ĂA/kD%mH 6.~~j d7Dpc!\i4Z? U-fم(ɳ,\[9Y&;ac}rQkO!wbIdG漖8"4܋mX ,rOC)Y#}P3>taA-*/#!ٯQSdtv'uBS- kؙ7ELkܛ40  nw-y w-{`6qtɨIoAQMe7ؔ=ovKP#K4C{ xҐE(D =ʅ$,y4OPᨎ:QT;0]P?G5\nKOpoMY KZ鸏 3FUmBec)~ݯ2Q'fҲ%zb-tȺ ~@4Ph)$Jxր0许IEE1uz]U]2ILG,VI' j mz0`=axP^q9W2FO #tTWVb&n PV1NJ%^XzTTU)TjH#]D'vcA8o60s[“W!2_,RKdҺ>43ŠwJejyk\Rѕoc83QXKAofԱq捒b'J|kʶG pZG̱t[yqUܹ7QQImKdO?<EyYN,_m{{n3簡G?e^z {0di "Qm_SwC9{̈́uy&qhLP |J$Z-y>}.^!\OgTIo[n̎.<{-Mrplu՜A$u`~FA-ß!ȑ7}nQD[%XkE4Sp%jQmk9R:>lM~6]{s ETX?G3}MWWaiҴSʾ-!0eIj]$ b9=E7W9qQ(:rYhsZ6;tBF=թ4k`("ԍ 소^ &qۨ4tiC j1,qVϊE3=M e3hKzjkq02f]ZG<_9!"K  w&y>[p ЅҼjF>/J{MFp*BL+ 7-E%Z$# ZwwW)O$k /#beS#MW/:T[o}T^ ̽]ydWj,MrEy#񡹻Wa Hya~z* q4*2pek_hm\>IRw} gگ[7(H-0OP >f|ī \rߋ9rWg wdN }i,͎x-{R$nJq8P$P 4 ܢMx}3|QŎQ p1,%yyR 7g rZJQg- 5{\_RpÔ9ya,yA˳Wg`bTlqUGQu5 HٰP^ډ]IXE T/Ak2NRzz#I-'Kzދ#%}.c: +F9h'S->,󰿁Wör9{ ƦQƵl=_ "/&_Ս)YZ%d*.y[ǝkw+1Q ,;w6ہ ey A#[^i7(Hdf]v!E ocXX ǙjS QbofO3!72Z|qsM_ͶP @-+_u`*?iBZG_hoocyT<[RFH1RsD0AYا8>*fJO{u'ALZ'P #ۭQwYҖc+kʄzrTPD(X|)qYr6hi eW }Z* 9NG@::7#!P+>;z`VG!)EX=?|a/:?in7i[)eF%;bXˢo3eO/N x)N^x΃@`KqlYK+4}zo>8 cD5Ы̸HAʵa+Ґ,v]j{zabyU9sHcbbxSx 5rUv?mnʦ$5׀"QCL.,wJNќɴfbXѥ9p,G~UN nNQY! j1s{Ms 8YpBu#߸[$D=+< =nuY˻ sB("=1746G,07$HD9e/0*+6z{_U3,➄jM*_͎H BIϷK6Fb0V e ޼EB +ӛo+X @M gᵢ}1åb! Ϥt)<f\B i!X}F w}cV hup/"mbٛTcӾ(b(Z4*b^q[Y'D;4rFO8 ɍl.:nr̊BۀgH4-Z9z @NJQl 'M({ Yv*m?vrhKS!iw5}G|m%7@Y\K ,n}9u.[K|_ Ytmh7,ŏhSt*/:nS)'qagpCBc-` r`l-؏rnWdqeilA/I"sqL[KCn)τ"Bxo(SrD#<0!jCr*?Ujswn'TrQqbqJl>)0N,4cF,`^E4R`\S{y*`+?CTőm"ÁY;+ d-*Ld~E0*iuU0r.ٿDʚ(:/!ۅv Gps[R`\vK{6_J{\ZXufaa@ү߷BgԁEùNWs((h*1Qcٗ C"4|c B̞2*^$g#d]L[2sM<ʃ}5*ъ^v g$;4 (@4+46%͜RMtp!GEW(I cKMZYz=Y*pYG.<yր.b|C񆧻4D! ݓk߹K@yw7(>D}QugŰB}̦i~GoLS+$qɞFBMٹG,"/6-5EG-͐Gjxw8ft0㧖RgpVAq3xGGCb (M]4#lw0l'zK|Ȋd5XE=8bm r͂ěPSKDo{ _T>7c}hgflk+X;&! Q5]IHJ=z:2YsņE~o`2ֺNXEwC^^;It.*p>>O@+{Sl<0I:C8SQkI#``Qyhh (;sǪ; c.P/ȁ&V!8G;&~f&-Ov9#7*#z i tgjRhwr}0(tV6MFeĖcrh.|G>k yqn Ҽ#) ҠB2:sEϸ +% ZW)uw1M!~e^Ov2D#aA~#Z&bp_ 4Xr$ֺ%4$A[?\L@T# :3HD\GDL4Nr3\Uv8s;>J5̊<]uu0dMb L)I˺wOtOG#|v*qbHa"Xg9~#(2*=EFVdRSB]+BOl[aƳ櫗x@o[`>^e*V :]*pSz{?-rCq*WPqY;$o^?N^cr+ JUR5$=$d}G4𱱫K@(ܬ-ytX~z!+g  WᰦK:nI0#h`LV6gzgplr(mADe7lk0䨭( hze(NR$zv񣒜g%c)8Ӏ(H!+PA}ߑ Zm8US5"swWdjoH{PG^*k@ǜs;vҺ~%= Mh>ŷm],lMl(ݳH>?7zw9aF8? e&ʴNKl *~SHCg߼H z&s8y3X[^}QoCD1g~mXO55`]Vg4=)Fʆ52mSzATAdKN =6p0F~R.>O^_PD&BFw=uSMzUTϒ0ً,d B÷q(nH{YScV^└ㆆCҞOǸKZSa}1 DsG\ݍr""qHoD̀I{ܪyw]aŕy˂aspZe-֛|t6H~y)&S`wjᵌJF`ǗPժ/Y (UC5C! C퇥u6'U ?y:zf1pUu5nRX=G<)sڼ/c" NB }IB7 YMP%Hv3JDKij5h㞩9KLQe7Fd`( <^?U%biY xY0rpdTZ~[s5K0[)CX]*)ONXڶũP|Ksd}Qy8BvpGˀa~qN@vwf(#/Q mAXXmgk 7|ûQXMY~f-HhdG/_8%bKƺ|9̗6lxa8H]{IˤƜ m B "A%4Pk($xڠg"CZf#43l`> CS2/Ȁ P]\-BLOb[YߑؗG 9f"/X`?W c0 qیHm =YXQI61$ BF_I糝 $ct)~4dYSP\r8ox?]P ?}Ma)!#GhB@+_9K2x٩ #4' w'g.osXM*}O0lvmm-Bd< c=T 6XlrN2x:pƞ54# rl#Е ^m{xMzσ-{>|g{F+Hf:0<(;KZ , {ezstP-ɉU{TSs^;?Qa:eHyΟJ3, E1LB/"OD?zj(J;Waϱ 8"qjohst%9Ne?˃GjEٕBR<[j:Y5*?qHZ,hkEb@eRj4xEaҚ5e|E4i '^XT)W>[9DV{5~D2Ӳ h[pm:lQ]4pnХ}xXRPLDV;q"˱i_FwRZ &5%,3b0u|piυ7?av59No3 zU  O Gc}@t˶DhǍ& a3`y I$U]tEش@]CDLnR K+az1ʒ 8z}i'$ɕSZ&mt-c@[tn?CꞀ xRsg S vhN}N5e;IPOGDtjsbo]˕JGaTI<oۓf3@|v9VlZAcܗ KB쵈ep˄4%īK ;mnLy]\lYUOh'PO^ 3[vV-7l0 Oy jnoYꮷ:) K}W$,)j0PAl$U|aZMrYA# H" $G5El^exDnP9Y%DMr_%8SR?3A3^eޯ`hBϯ Kɱݥ=М1Wv̈́[br9FpQ(SD74zYM@TIA):iTK=ҷUBBnjNM뾶|M/ anDj§ 2vd vb[x$xApXX2/H 4Ҥ)9гnP:OWFSR ͡ N"d6.}H!&T+?hvibm:b6>WHgkUtܑ%eKĖSdpFr9gyy y蒌hݠdRO8 jU* $HNdLFNkEc`A?wKnJ&Ad͢}]&gtuY$}pZrvb' 61CMd,DBo̊GCfjv;9=w|2X0C 3>XUaF9JɬKa|B'uG9MGa!}"!<3/Ȱ0X|g> %kHҴHMP 5\_%zWlehU:|W1_\}2|ک@ #Q.suy1m%"^̆m6$h"  `!-t Xr"/鐝xB![w؏qYʫ |0K޿.Otu=e9.T \Cg+?$5[96 3-$ 4ؿZA_ nW~ijI2lLsz*\/'@j| 2nm^.1HkOESяak%# 1il`j{vGۮ-@ȯS5ޢYL%]4')r CeX+H > J4D =8<+y[K$Tu@,ቐpZ3@ )"1ν1pQUi(v:.U5`t;A1=#vd`O+;4eUVvZqXr5I‘( 6wC~VTSbUFo[W~P)PW-kPȾH|o^`/Mx{z8ߕ)Y --Ύ<6pȊL)GئsNLwuG)Mh$]$=:<($i<0&+xfi7 m-peA.m4Fdd:2!}ӛy#Wcsr5|چ/۾QUИ0OB6]Xw1ljFEt|٘Q%g.瞅)w@QfpD|\7aޝƖBRiT5KzM\ﺖFB<@4C\,u\wQwax~ = bUTPVMgbTf@uPj/nLUI9k/IJrSI מ߅j,-ePRoT Ccޢ`?>Oc]vڕZ(Ymc6<͋ii 8 -_[$ɔý`DMQQ3 oP!g_%;R~BR]UIDuwKpՒ 4Qh-Nb9VG_:ǠR "")Ũ'fs@EӎLHEVkH;B,]DkyV2{H1rcr͑>2.vtpx '{H@Ifd6e[;&.Ɉ{oظB9l+C[J8 ?M@ېVA!zrtH G3qg7g-<*m.pGEhxуeлm~D;'\!ŽѹU9L(i;շ%싞'#2<7:Ä@د`zfOs0"-_%pNwq/k`hL^[B`P `-1+Erpz!k2$??;wT䮚1F%;Phus6$EJ:S-fL^fȯWO( $M9 6x{o lǩԠNJ I'EiMS18QrU5# vj$ Get{ &1aSI9MS jZ\z,c蹯1%92p7QXcELjRx4bô{9>]L]>Oc ј%Hs@ rOpYx7/H>zvݰ0fb3jZ9ޛS7HRoѤJ;^̟ hBADRjhk䄰79dߚѰuD4)Xr}BV-\~ c%E"M\$/n ٜQ:Cȇ'XO4n^#ބPA{ʊy}{bp~fۖpwq3cz|%"8tx4>WB9ϞZȹXg6Q2+C%KOWڧ%3 3E<紑?b/KF5.U'T(WOEd:%zy5?֨LO!40*0yG9vRhⷽ  Sez]$Y!?p) e;T۶&UoW jpYۄ4>7^Ul2Rzvx՞79cD7![>h#I+@J-qdz!~y|:mѫ;~k)ma*Fdy[}7Esԍ։keV`c׾bQLnļl+1} oi{jr.}@;*gm7jYP62ksDft/n׽fFn`?赔O??~-! R2߬\pus=ZLƍ?jcA6}"$(2Mgz!1`+sM {ICPIx,Oȃha\nb ;5\1b KZhH7CQM&;ÜqĀsC7 V52uj'L>O׎0ZRc=׼_˛q,ųUJҤЩ, ASv? ЅAQ:(3s?1&g>)$0q\k>o1';oTo<Ssa53P|m6ztW^ @ZƎL+mPC[I #rئ@VwL]O" QS3Vf)S:Bc^?mQ _[wS`liu*D -H`]c@E2'.xZC}]X3,IƘ 7M6G 7-U¢z/aݩ.фmDp^sOq ?j8b]3E\(~|(p&p X_S^܀ [jס+ 6FAضתGi.rGsl!V$&1UIn^,֝] =n*^XHr!ihyHx$rhEcDBE%"K^QͥMElAEKͳ$ ɠ%x@,qln]yufs^Q\Ol|V:,E,Y {eW- ŁfpGדPaU<a@^nWԪFܓEH o[=WE,+= iK@*\R~Zoow1l62 ήY ' ki}PuYLDCk'I!KWdv[rsK#dF^SS}+g8li/{նn"x䂳q{0]6̜YxDK5.,2`e%rjv>;p_KNŒ?.L+ :qbe#u±_tzI[h"UrMJ5D>OE T fRu19L/8U3֍tF,MK21~6g9RtiAO}sCK<3tm^jb(h q,tT 1Ϳd%O"pi;x&LyGvCBr>̮Y **mճG{b}QYQC="^nyo-kBQsKN\~#qH{Ig: []P6~ڦ^F xJHC:AD?zmiKs118t:ڧ0+30La4jyu|$L,ph㢠 QWnޕ(*.`n_V:P&17f,ň^A?@3uQ#*1iTOxbAYve`֊=ki?N^-kSe-L]82-$ ) UK^F[8zXM̠Gym#v%5,b= ;S1P _U>Z v DzUnBL9  ſ!f,T%O&CN3u9.kz Jj6qLB~H%%FJv `ww2'AAC7&cW}xɰ*Ehw᥎WN8A%8 l *lfǿ'hgh L$Q%۾9*xj^^ Y=XA4ኖ*=){2`6kqԮZB(m=cRoƴw V sPyyhp.tꥴ^Q+.T}iRv8<&O)dڇ-tۍ9QBh\ilcNY8~* @pFt`*bmb|-ݏ@_bB'IVHLTeB $oK+(ϻ'a$B(~d"SCR]_Z5#gu#sӣ[m=Z#`Xc>F1E—'`(Ơwވ D`h'4 LebZ~AwM":n>TV#E>k] g^dA;c( l(jUb?3#d.u7 Fo]!{8V-V:ǤQZQ5apRuo+n釨>vVfiΎrE?G\֕εN4.J+RYYtDD֒i_6 wBv2_eGuxEo\>H_0ʑxp>KI7`:x…\)~݁@Ɋ,d+=ehr.wxߒ]x0X\GeEwJ VRuO)1=mw+\'2l;*gmX3Ӽ#~_-R: U(a[%OJ~N:Rlۆ TMyYgj}]?,k&V'K_딩pț wK][k+.TW.0IOCq<Ӽ!(Wiu|/p\D|b\(sin̤(8dë[naEȇbT<GrHvctd?Bt v*z-lWfͬca$,0"_g m{9ɓc ~V? ^p$HfFMœL_[AM۝: ? ck=M-7 7vLVr(e3]džHtGk'Y[ '-`} Kud~u@˅̎φ2ݴ+ENd ˪[oVjZ pWeLU3IOIJPtK|t.pL33+Y6Ł4`h*.h% M10QE il*[+ ]31o(:0@\ܦ2*j;B3r^`ibVSv9[:oT9Ul38xiD]}Ga)\G= s7q_EtηG30|?mVs ,' 'ֵO0X}+&sǎ&A. 0"o3JQ(GX;1:'{7k쭎69S8ho6cS^/A7nl ` S\)cyێI C3|, |˜ =^*goUU}s}̝/jdq0Grh?(-,(c5L@Qp؆fVq𑙳TEjN9N*NәNBok̾7i9́j i[-#DXG܎Nx8*5).k&BM5D!?T\sUK}S Kw6pb%eYI;F"- ޣ/@3< ?0{33|%9DkgF~^CrN; 3҃S.K* :Q줦ݐR%͚Hҙ." /IrF[rO@H4i$S:*h[l^x&R*:&ш~*`Y5(wxsh%%_1׹r1s'GŜȊT}3jD9{vr73Xopg4d y/yuA,Qv/0Q+Om qB7Lkp QjjF].vR} u[b[1RciEj_b(3vDYZ3&Rwze>]`ujVp(XǨ& *ɓ?{LմG ms %mߤɝm"DH9xip-Gdx,򩟒j0BS@fT"ۃUfqM/nxRC$,YH#:6_XM.pr1F9+PXӵ~3 Zrε{2 ,78 TetG,}+a"Q bBu@\A !j}uGqoq|%fFum<ՉDԦ=e^WA?ˆM5,ε}#zÀV@3q)DZC@"8HʧpFeCFMJ"'qZ^I; QܐBV1s| pK~7cauuuϒw@2s}*Ji?e,Xȱ5WmR~#c^_0?l Zdkؔr ],%y\;)pv&Qpq y#I(Bv)=^_% #lUp(NR\a޴s*GX\t@VG%$GQT)n bcBǖ KІH iIEM{^edw$`g;Um^!ɷPmt :AQ8 ?5< ivX g5)3rhCB(ym"*﹃qu%)fC>ߟAFO00@!Ղyt? m\)V_4UEg(*,6 k9[˪2x̄MUM2,M#?_(}&Pď" %[L$@$ⳙFۣ]p^FA;Ib6 7Wl{Թr*$_*|>Co@fޚO:)P  +sYo3O_{gőmH*@MNc*?\U" ھavT/Qՙ(NkFr~iYL@uA<b n:KX)ix;=E i<ҡCP$Y eh=f.o1)SvqS|qj \+?Q<@cm@]]㮁u9LV;;BupFg>Cħb{K"BTsIx[ >ϗ2>p5y{/j*֢0>֟0 EZ̢ߎ,W;~uܶ:] w"Z"\^6O:QQDCTE<9n '\I fR<hE*TؿNҜ*` *V`ކGy= qP+ERr\[jڿcc4>}=. t%aNnא<rH*R հv 6BƔDi`hpnEǺc&2eڤV1Uf.(lOw84ݹevxBD| 3#GfV(YCz+,'0Iم3\{-Iʛ/[~[8pV?]_9NrYJ'q)xyw 1,CȴbRu 5hYU6MıSDx7[>k5^ȁHߴZB}TӁFvQ@ *: .lFW/0d qJ/ kspy2N/9Ņ8Jq4dZBC AGjBXgyϳ]E*Mh||nebe%OZm0z0jg%f)+%~>=+$Vm2 vcr?Uby9[lיpPWg) \ыgKƒV;WX_O<BYxQa&gREF= <[vC>)6 tdy+l!}@P%lx(ɹD199z<`$Mzm?\˪ej-epU#&٭pKvK |`y"[ ؿuR bgY`UÉw4n3S\Oqܦ]}5q:ZCn=-g$O.(^5[YrO|'&R b"#SaS ° %yP@1 8%UP";ԗQirN0 ^}KE&kXZ܁L ugBBPᵬ3wMNbk7@`X(-R{^ӆd%; {p)/)I.B0;ΐѐ%Meۻ AgX4LA H`% .Dc=\D[0._R;xSjf: ?S=@[l뛐Y%eL4a)*$/-}"V 6쳪>]TJrJ>/\ځk}AoBT"spD9OӉR&M नZ7&s!Gg~S@Jf4l{!4tYƃY6>/,؇mѢڦ-|biP|Xܤ>w%s6I\!̑}Mp6P(rzDpE/vJ[>ҖNh3gS[2yҕ=h,U#I.*!@{9"I1!z;<)'0[(zeȓ~ :J?/&A|X_|pz5Aub ih*(f@ނ0?}9ћs/MmלJ-N7mY-_b|PI5EΥu-<͆wr_CE޴d!CX.J?jx)Q=:t'Io\kL{K>:hRIbhSןUڅ(6{ä{g<PީKk&oj蒻w E/X Hs*LFkBE|Hlúoꋇ̃T}]e6ɫC7í+;jǍ_g̏&LWR.ׅ+\DAg{NKd!1S[ertIB7 詸EWTI@|KK GǡH墸:@)gv`fd '{əP[v-Roצ{6s3*B{"{ϘEПF6GhZ[y@\2_9Ni%t`Ԩz5_aO4󢍰̂XB Rh7Dˮd^QQ. "XZ8мGˇ3x_!ܣiwzpk^qM d(VfF%yT* s^F(M=1&@ڸ D{}R.` ݌m"a҆P HM^tz>;jVҎR'V*<TtlEflq>+J$?=,3yN˔*J\!749o |)'44-:/˥?ĴRrftpB(Gڦ9$ 'N\!6dP#eUj>k"/fP (-^:gٝ6 #h]Jx4JzwKFm2g* *ufr]$D { 0r泾lp.e cO|O.bY*~kz3Yw&pnf{G->TJM8G1p3f ˹wΛK~7'9 (߫@w²JJ]]~䊈3STQl=iIzq*Ž +u;EVJ X"f yDx{%2g|{%!:FY^+HM0EZ붋:Od݌GA+ pE'3T -N_ R}$Y r^WQO4ܦ뻓f,ځ.?SR[yuS2֒t|o~  Ѡ)>$2iO#Zp -}/OCN+ֹ Wx/Ul(iƵ_ϝ90fSNdSD7rAZ`{8YۊODj/M- Wńo.}9 x8MVͳoQ/N^bG>DT*wrC$tOVB~$OJńeeY>?0671J5)e`XcqENY+Y6cmYV #K]6FGiF#;pb7gQQ}sKU9ݽ-t^9=ȸ]- E-H9S:ԈO3,b$47e|o$ l'EvE/ s?TϦy:?u JC']I& 3;) +UԌ^ ,C#4C,rTҭes# /hԪe1vQz{mX`(yu%ĉiN`0$/ݠ \{wm =to$Dznߌ 2L#96T90 /WbHuYD>#D 'r?Ez1[4(ݣVpEɏv:m*qE%Y^qceBB&3e e[6]?*-N7TӉ!T<Ӱ9Ljɳ{:p06 q! :\z\X5IIHں4(~9 0watPao8eMx{PAWxsf!Rx08ύ<'nphE9d[q&t= @vϔ[ZipYGA\Qc_&Au"o%oQLORx6s%ܧyc&C8(=Fzxg%IG|s !e8QUޗC l3nŴFibu _/).>Uk^4*lI)i__u$cpNܘ @,D∕VP+h3P6)BĦVƲPk689 11psuj%0~Rej%&ja@xӮm4w]mfAqo^!3o sG^TV!C_^2 quMw253Z\懻AXBv8v)WNw$λ(an:K27ə0Sy \DgnWD:vW&}z%+t<͏ܚV({Pri'd7E'] -1훚I5 !93P뤀2@h0>ҫ"WN?4q+0TS:L-Avjubz?X_Y:P x4ȿ﷨$ [ DM~(V[(}oV~^LѸQV׈`@\<͊2+ULICXTz6a2ɓvY2`ѻ0%.VգHLEi>M `^Ewif1x˥Kx炶jfիHc8/ga^PH]I -0ڨkFp=RgӀ*u{6j.T^Yޙ =@T1T\6b5#?BN벩Jy@L3b-R+o/2UҳU-MԽ I{3`?*ͰlB(q!sd ]m"-ژ2IfS) }ٲv@霍Eo$$ȓfhS?DdlvG ׆՜K 7ZԹ1\&:q^yUGG=x0MH(A2Ɯ٘K<N:!ɭg;ID`3)fƶޯggGL)!K4(ǒ39)] ą^ě*,S1wY,: *-ل:X[B9Up&RSk0 *YwM}ʠVgsaIF7VxVn6P)q=1Yo˔ظttJԺdzwW(Ċstl{L . ix*[wƙƴ!FײTA-RzaEOGˆ%&wоuQ蠕rjZC.d tkXoɛN`_jM ~1讝^ ilGp߯sq/ņl Ezp' gO;[&GuRvқ3pg2ˮ!^w&g,Dp!-avj xߺ{IM%G?>Oؚ7F5R:).t\;-1]\ IWso8iucK۶ro(61=QF.}e_4l(8[ɐRڃ7w^# (iDɘljBY&eGf Y$QC)N)[/]uhʩs1Npj&( v02Oky#N]|:wwAGu 2QvF7_ZM([S/7.Ӭ m R!-*kf0nG}R盇o򸰼@ͨ5%.r1>]*EIbXWO"UPm=('S% p.CSfo>-U EWv;BW5J &|&uWj.iȔ@q=WCz?[C#|jafl"L\ʂlNq$~Unqi5Z _JJ?)|deYxTɝW Ng NI}"Bӑ[RrwRm,A \B2"K/<?zZvXzتk=T7ErQZ K#kwM!d)F6r\Z#8= gXp/E8 <_Jv C݃b;&d%̙D33J<5MP(!*"TFk], Kn.JttÄ?xq묪 匪[I.r;*ab{/(t`tUVB~?G(Xq⪂ly fa{9ڏ1"yȳMZl#'6K(ڱS0yI$r%ME4$Q2wk)BeSyhXǮ8ΜQ!EdMţbOzbZ7 eA2b5->W#8 60:F%X3>崭!J0)ߛ% 0fLsʣ(MpnJ.ΨXR"F'uJ (q{z򣲈⃮xjnqVNC I%" /M 6mNط By0d$c~\Wmp-l A]T~Ƌ^NF}@ EwV49Aqb'Y[HƹR'PBր<08. V8ÕJR%5"$-W (P3v0P 5-sO4KudＳkhh=#c02~kgz/3_3"dN Up+_Dip!c"vGQ*d\áo[ٙ^anLTq݈"{Arwl >k4Z1pXͬ.V(W0+@W V˘/w 7sxy!~v5"Bīz_FnyoOL(]{n.`R5>ibO|4-6s3拟YD$/`mYx*RoBHHbEt}tQMzEs"LȫRPÛŶ3ccVJ9.CWc`<]1W̭4˙>TF̣¥z9'@ J҇G~cf`?ԮGXez;ʒd{̓?NkwJC5y#؊$Gw*<9U#/e*/vz)C;i0Vnsbq8Ei,:͉ *ɸ.؛؈12ۘx!z%<ը{: a}8|W=vܖɡ@~zΨ ctڴ=|,u@>!Rg5 OaW&TOXw VNZ"~ҍ{;J!*y}UR;90&Hh%z.MtXF*Kґ;XAr/3/ '&RPGq9Q·1ōW_zgH}u]C{Jx&SGvU82W} &)aKZ2K`Sgx4~;]h1WojC'W `:NiBYb4MF~ٸŐbԉN"s4RAwJJg)Z6~v0<#ʶ vHNllz"Ƌ)g[UjWsӻp6d q/aG/.o4mV Oٚc4$ W A9voy =4.cDҺ˪1ce _%{ z'\IiK\e5; _toiB0'ۤ"PCJ9.`B/-L4)9Ea2:$UEOרd(t "" W 3aP9@Yx2's5%hƮ1'HEߣq=2f)|ׄMe_bt&'W'yL E\EojtY:10ٞZ0wyH1x(tWL{UOI1ܞvk-0kf"mb% V^fy^șn;"eq{:wClJ,ҥ K(maLp&)Bx^-əmqȴ[_%)ŐKZn5 b/`ɿ^|>f֠(bVROȓxh>s*[rHw#IhH͎Wi20;Y e;xJ98􅝊^gyWy1E0/]g0 U.bLU;khOf|eY4k&uI~lBoS=,!:(rתUnE`@.@J>]"n{ b>.R@:* !*mNsOR 2NM_hGw׻ u$F>SNLMyN N-ȁ N"Xbu'c)u*YͰ\]lT:uuӢY}=!u|^Ԃ~툯KY@Tۏ&_P*|!PeO2\t= \lAf$,(@57ȃiyi 6& qňnn!ު^4$KF6^)gȶf]E7D'>@4Ɨ-ߑǥ-Rw,'FǤ"(pxJ_N93QX-쭥 $rjۅ a6~Ꝅ1X5VX-^8Aߺ+z#]3#9 GHIM` ͊5AL!=P%ZsmIٌa?D5'%7ܜ#{,S/8Z x>V.WcPٯ%LyөYÐz|L֝ڣ3cTrf(Y2XY2e^% Oj ;seZR+-mq)~ QZ "}m .uG`w0@ޱ j/1Pw ԃa_2&h25rd3@ck9aTAf<׌>SRQD)-ﳕ oyGsX9˲9Ze뒑LY{^弝\J|nMMFY, X$c!EVF!x9NϤFjg7\!:m/=cO"Ўnn"e'%[1"N>Rxx=Y,ʡmʬ>YTf _{$='I= JY-U4ǏjE7 gl!fBZLǎxK)Ic]Cs!I k5,Hv w %FTIXܽ2;ǟlZpff^oiోnqO\8#B8)s rp~T֫Q;CgtYX,qdC!S7{9dv* ("HNZH.K?/I=lBiۯc@,VKPZ{׋G(ruLTv *N:mhg.(~U G,d){T灳@kF[ڊV>F"Ţ?-=( RO/u hymWXyt`, v"\^m+.Y_H!aQ8q--pٹE!a[!^CITObcss6Bּ.$8]|Ig*#  ۘi؉Ǣa mҴTN%qZx'|B|G Q \"66,u`]i&ʤ;AQ#}JjdzdʘDs|(v_X(fר@x C.ȍ 6]z.Ǐx9u려{S؍۫;9Z1-P|Fމjp,X}|C5B[sw4 _9ԅ_kf䎻:4cJxjWl1þo=ZMLkOL(^itN`LzLƷ &Ւ&VRL^kM|YgF (s>{hX.f6h·㵵jܗ 5Iq6|TZ/߱ `s.h 񖱇ccY}R!"=]WL <ijL:V8u&sc `*J ,ʸ9ɱ$ۙ=}G\4ח KT}K@ c%0IU`BHix$;o ޮ6j[n>1ˢi<64TkB5LOLIqwr<9JUaB0u+{uH4ӏ{ `ؔ4/i5 Bˢ*Cz0_{S2CJn LB6p:Mq106cHl8d:է`2i6 kcB9i )+8^ &9*V侄!`mԨ'60 [ y?SNBnoGw%BL'h0ʉ3p*lWwmcIҔїC JLI|[kRߠ5ېܪJEwȥi E$jd8<V~M^Ԁ;*y lYHlY'q7MzĆ.I0+$5*@pv9$8d~&3rmW%x(45(j # +{nLjש/AƂ #;e~ASKQ#+b EPmME#ϸϩ&6-b OLDE@GL@u;g3611]Lq*SVhvp3-3ߚՁlħA}5کat|ӷ)E5fө i2rHH2e,r9m>ð9܄/?-+Ӟ`tSA:qœ}Hƞ9qn߽ ёnD?5@pLfe-6DS5>6v )%3;79=?8ƨZ.׾sz^xOt}2\ۭgn{&'swz>#xm)y-,eu[|Dv\A&K=tedJ6r6LO+n|hPt YTdJȴJ. 9+ه+F&;[=T,/<ԟc$DZʟP''Nl yb*l@251v\xKHtjb+QTk(95Pᮅ/jznkpH779ߩL?"'pJ SJ)<۱9>p'a?R92HSR*&:ڈ -90%' \SB}g"[^]NgCYyZ,jR2^0;ۺ6 ju}"![bk 63)h")8{NFĹ]Z7ɒXdW \me15BhDڻ: ~ IL;ҰAlA|ȭ)@]u)}InIHYZE'rˆR{>w{לGZ%5yolnlWLwAyIarG9eTHlYRkuvoR&<\ݹF*Ex6?+|<7P&O%s Aab+M5!b~,&<9IS dq6Kǐ0boXa.@\-w8N84-D H:~J}5l44N?^r/UO,lQDxJsɴ"rn0-TYLRikZkuyYn Vb׆N8M}Zt~^/)^bW㍶jE.[]<7}sjHͨ)NYQ-V!Jqɏi!V;e̊|lZ *Y- b&_pyc ͐ OҊVR; 'S[. ջIh\heY=c TcZ4HpRvۢlbC Z6ӻjPT6>2 숻]H7|Ӱ<>Zf=k+2m*own q$GbFySn)Mo!+!ol~3j|DeLՊm1 ҷJcc%|J[\605:-\e)HG5?ynp9"By08Xh3WR1aY2g6-VMHu*X^Ze.Gb^3Eko0'/&rt9Z VsNW@HҤ1wz6XZě)$OSPW3$2G'69TBІvjȷyŷ?8ECqWUkț-nvϣ|?YjdU_M$"3 ^/:>WqR]2&F?ŠSbCߵ9i&>n+=W;-;k"`pz}IcM SD6]ym9/궠3B`|v1iHCaeW (@/9nQ{ vO%2?ž%ɳѭlpďqSk 鵼uN ln)ѿoJQx't~M7k}UK$,e)[YZlCoQmb Ŋat3N8%%iT4VG-w\R!K.jHl  T~'>?;ٽb9Bpv;1a/y ˍp'}DÃ}iDJ;yW'9pmn-aH%{/4Xn~ޫUp %a_~"ݽR\h.&1r50R,t+VeFHST/nwetAxc~)N7 T2Qv9I2el g;؄IGh(MaPhm]2v 扥xv eqNG;)ȼ 1V%pN*&8% ݧ_;POzG%/0Q[~e-V0Sq@j7K%>nkpOuB"˞Qu,cܬ̣E"dSJǡ˗kwX`Cۥ~3z[O$¹Z|Y~m=dk?(vuiU*ۖOju&0Il o_|E~Ϡ lд.hu9,T5 QB I8U'͟R mn\ 㐗tײn>nPILKzq2,h \.>' ׿S'#<]8‰:K;Ke 0A7x,j8$$?$G UjˡІPM% ſ{ Z˹~u<[eK܄Pz x QlnrDnjoILxi vJb%ؑ5㨛{^9?;tnAusLAx8; 7>\(fn|6/W31\( _rlE9著z#?<; [=(őEuzJ:0kԇ6oYeS*q~i>R4)9Uo, a4PkYKY@>]+X1L80̆ʖAs$z%넊 ahoaI+.w}B0 SDA?C E!A!JiG>n)=PfQ-ճ2OYMք׿Г'd2ow-MhnNkBw1hs2<Ȑ y1;bj7]v?O^4A (Ku/p`P=R]Q+.P>cKc7}.-A1,TkUg)jL byyJ}i:une1 JL l';`hN)\.\)둦)#fTyG1(-Q{z(!XZGj)j{sF[a27b@9 ogPW_:ES}nxB29QT4X`+W,Na2%D״[9ڐ[ iyޕE3HU*vd+2=kBέ6:( Q^lL:qÎO CUA@SmbޅBʄzv#: Rd7-`R@m%$71mnFבҙ)̮oz͆*dPN^[<%+8wo?? uQl)!l-ШW! \چKd7]ߑRAuVhwI%Yʅ0dj1)AXK3xKA@~FPԷZ*y9ҁ@OԃNpj,O9ߐk2-,N"|eO U: (s4GYh͠ZtCɝv1}Xa"RAjY4ȃd61vCןZ{9c5A{Ku[+ Z?G<2kxP`"amQg㰀$xTfZOPX! :f0 ȔnsY108"]@wrS掤A&i=P.`qCM? *b@gʡUtIg 2] }0t(QU%9 7*7)OzZVgmh?06KpՏk[Z)mxZY=Y oVM84yk`BLrr %2$c _v%:to7K^u%$z5Pq4([=XcU^'h\T,1B sK.P{Jg2˜A'C/«ZhI!mi!W90g Wp9fE%,Ȃ4Χ\sB0.Ez):StF9 Pv &*&4 ؁kPæ: 5K[r'% h?E7Fu);'uTI8O|cZ|J]ѐFbd9XE.1#.?*A%rȾV3Hl<D9dw`fYN1BfL4ɥ[qJ@zV!8Z!Fz{47"D/f(dyy~>p~C1Y628YЫ逾 ,g Qgn0q3#֬Pq1y_WؗF>,CXA;bxCuZS~@W(c o,~8f;?ᐣ5hR"{$uP`oduС̲A.(drwrBV';rb҃'=cYG#o)o3yʲJexkt'ƠK J@D]NIR0jijbz:@3UZ}8?Ɩ! 4ᦵj\_?F?~2#8wJ1G SeT]RKyʼnwdo}#:w_PHnrXuہ-೫e< RT؝*$_ß"oRTLukEGGw fK\@ØIwq;;_X{j;G)w=i&P6̕lC'#9(& 'ur.Bj&au\ 7k27rOdKsaEW(JK!nV`+J g^EɹEA*I96g#1 ϶4/ eؒmz"(A$-WO+Ԉ(8/K)k9z(Ȳ?a0|!' Mmu. LpH /XX6/.7'5vuRFWqP0SaPBv2Wf@Kuv9o-?L{*fbYFP&pWH&MԪ*:E~F6?|I*w=('G}`;!Eaw#Mx+LѲaqsE5&C䚶r;'ycM{k{ctg%hL@id$eji" cwy Iqғq ˱(D-Ue+EwByhx=R[ ~Ivyx$irODop%Q&28uן3yUGQ\˿!`X<1 )T~Q-n‰^!dL̀S1g_zv)e*Gs$ɭC^asd%̟ ug,'tD?;Ĥ>oO9j2;h>Ǣ_VuWQ [%IE_ wT(;iX)T[Ֆ 9(@)_XyfIX,k7rPxZ4 yktt`Jrf9&:tj],&( 3NZ& 2O+10.Y 4nuX }:1Gk)vt/6C~4A٢rMg)?6,פ>Z?P>Iot,6]|xڥUCN3JUqNPU('xNYDe6DNϨ*1\1F8"I."nUd%ݯ#[ znkbg`rl:!X bcJOӹ.)]Q@ O-Tg@ grTve}Gh9)US(5[N ^eSIeh0&^rBgzxufc+5 Q4~f;`mc+q$ϝ!^KagŅTk,h1gҜ{Rw'ֶ6AlgC%ecB"Jʧ9ct${hdj`=/oz *$EzDhS*PNB̓;?_iMzTx&Nv cS=I3o^f-Cef^睎5&ڠ6J29F?ۘvVNޱSIDw{Ű }" 956 pv ;QbnvG; FAEW|·ܯ:r&eɘR|s*j%{˭  蔘DÉ4_FuZs_y'͌\:82"܈:E8GMxc/ikyIյ^: g7788v*>&U=2!.l%x H0dߵ"VIzC6VEuw*,iV-Q%-o|i"j"i@f"2v Uři4˦7?gMEX-PhLTz)XTeV5 p! G@,:^ ꩽL;U&ߎfaEijuj{F7 GuE{cG9Xs̐fjSrRט!jTȡ d-sw,֦tQܤ] nn1^`Tcw7Ǜ]wΰ1kj:GOG֩XAYӅ8 _SJ[sKWհCQދDd?b]Y%adQc]4`"ϲ `y-{m-D0e$pQ8\EJYJN:i8I˹ MTy̻&]>O~۷KAm㩶Tu~sˬ0z_ڀ`Ǹ1Fp]iW! ^p9TF!,ag舽њX㟳?`^>eNRZӚ^JY͍=tm{{0 s6ACڃ~4wmO¨E4+2V'M;<b=VU 6}dGzQon. %x@ΗәY b%B,LV{䶾:6Ÿz3. vk@K:{WD}>+JBDMjHt w b3X\J׬5ֻKd81 w+ J5Ԫdm w ЁA!*s~&MhVls1%QqF^1|YrX8E*1ѓ1m)Ui95q XKQt`ZG<G[DLٙC%V @`+n \Wç} TO\l47\s}@FW, ͵,p8G [I(Hp3`Yr#(zJBRq0N:4e~LEUZ%;Cz,*c+u;"h}r;KH~凢PuXv6/4#"ও#dIbpxPd DreLRY~ [[[ǂKY J]ͺ1v1p_v ) .敩ԶTmӧz``|tڸw+03QmP B`OGfĆckTp\#&m%ӟ,W1A~B8 t8GB* %e-xAE1Ā[ (SOO뇰#Qϵğ*>[ jQ9?z?UNO?=TVnr YCjm, K}Ӷ$t,9"S@?5E[Q:2pGYE ž) HlE^*!r~ Oon$&ԔDL =!Ǡg#گsy\H>1hɯ<^&'s YJ2S5ʙVKS~e\[X/t]HN/GTeP+n`e$x@AmC좫S<{ڿskiȨ7Sx88\7Y|pM7fqdGP՝k'b7P]<x ,XA7^tq+A'yyP&ru=6UMF 2ӛgb dq6[$~rpŘZfg &!'IY"KIKT2礤 c@[әЫʺŮ TeǃW~0+Y;)Ucb H;ts%p?#b5 SכN=9楰?ZHsGDuʓSLЩr,evjZuٷ*pzǮ590dMƞ=azUˢIP\1?D,a,aٞ㥋|ȊvAZRY9[*|O^DӔDzwBw47G\PS'FdRau~j聰eGvw65[V8K::L}t|҆?1n@c8>`[@nՑD Pr9pef?l\ -~P/u Sɺ_o' "0ɕ`sNɎ/evh.&qU:8ؐ^ S1\8BL1IL}@ `+< Qn 7`gw<9}ΐ6IA,Z B 9Pa/ļs0E1~G36)OZSywsa; ;rEQ3w.8F?[fSHkbK>)=W2տkYwid( 1ڠA솩Մ UI̺LD'({LdTjȜQcp%b_Λ۶1ħ#MG]<|d F, ]kAAP Ewqz2oɞ"H?^^3H5ĚL݇ Ӽ47>O$X(5tH?VS b/s s ̕~'DAO\YK|L:#r25~l1X`:Y^J<Ģz8IX KCRҷͦp:M!st<&jB  x #I_ pjC _3O#/\]:YW-H$rg<t pآ 2oFZGh•.P]rfTzmTALO (`bq |o$Y5HhgΗgĕ]ɯc،)/-O#]SUh_@xD!G!f=e Ka)Ȉqqqv(GvBi4g y)ZhhrOk (\O<34ʑgYj-?fk)aR_: =kh)![ECn;~t=6Y͛4 .*i>x825cB k&fl;N~/oH@:gFT>iƌ6m ֡""l]G1f>Ykś.>n.1zM<=# 2˿x)KZ ,;t1ֲ]*Nodz3Xő#;vaQ}8iC6\- jؒ^ݠ^Ebr4o"ݞU )"YYh”JUU FKS9Lױ&mV=`"'(e FBKa{qBuJYF눃2Oo| :g'^锶]] m3~Kz~ɻ2yD*PҍC>Ɇ qdCt$,4]PzN C4E/ Wvǁċi*rq"m^2Xh, G[j@ a8ʟ hyT NK5pLm#^v8LA&_ӘC~Ub|cWgV"Okf_0\L>Y b.W:+ 7/ 666'^^\Cܦa} y@*ܛKfW0[:t"oy/;25`߯m99_Gvp|( JM_g''&Q+O0z 8J 6#m+C;0/M":|HIׁ~bi-;ZƼf"@W;݈!(QQ,锏Q&Lu3%teaGDIXb]ia[蛘en\AΦ٤ Ô31~ l%icd||KQ"$oVD¦`oUrG'<:]UP"ițuĒɣhն,gU7>3!{Q Uj\TUcZl<:'IJm$4U1 o8i63f匋 /m[0zFOB?no<3_Fnc84{Vϖ^N+e]]ɱnJA 9gb UaZk-Q_okfC}M^Ufs#-Ty7p ELۄT> p~0h8e|U@9KwoPQ@>KcH$I/B3K5 T E 8)my;&,˸W}Դ6\ey_,\HW9yi}j߅DFmWIvNØE魵qOзO`jb]2N>|î-A)FB3"?P)RO<1ˌ &M2޼:}#}%!6~G^E/ٚ@us/:R&`iY#a/Bi_ .0SW4ÿ(:5vkLp%O~ EA~*4 1+Dvkhn,v4~HD(IZ ml^߇ +Pz׼qpa-ogʰ#Jwڿ@\B"x7.)Vcp }\NsG}Gib>f=k}/%l)Dg?4XMl9hD6oM[|X G~M7E!_O/ٶ":}L`/ )÷,V3 GF&D6)JkvǩAKf@]@t]v4 q-rWfLƜhuG`٪tؔ!]1#@^3e68/: $5<ڪWy촪p3AA71'E@y&!нQ0q/K# }i:EB˕ Mqs{@qDiz$kI~|JCp;ؑe~ ; fN[lkWg j {Q7jC| ؎ ^o2Y(|Y >F?Ѣ)=" u{—>@]m-% ׼mꗤ d{*8/Z0`}}X[l9J-W_lE`@ 3~C7Ԯp;1Ј8>A%S-Ru s ~DH3Bۖ?i "dXEmg'XmBGݺ{.A#m0MFe-?.+CQ2P%/vMO*._{D2`'dAܻqC7?x\$$6dbK|3u j80n'k؅'bgya/f>8WNgi.aZ[>bx\'oa'9`c>>J4-zĥ%~]ΞJpې<"ȨF;j%t{O&_4 w[*;{Jtcݎ4oiRd_6"Hu_oU?gB7hvKI)}ZK>(PK0:eK"vt-FBC%%@=ׯ׸XC7/ #帝D#O\ }ؠ<'r70#zT8Ѩ66qOPC3v,;"1땟C|*ِ/K߷IޏQвeߢbm>bZSۢ3JԲB)ƫ&6P)2}?:1Y@G*/%*}7sMjw֪ܙzf}J.)L`FHcu2ɺV'/Yk!_UZBM886J#$w3{.ziZOl|sq*i4IxmHTV%̊-؊W=BA!we.] X#">j* IYpb9էDHcz+udDA8z_V`MZ"`(S2k՟EYW(f6;ȫh{a76*;ɭjv %R-eGn [7-MIP[*E\!r쩘4~96C>0^{ UfQ%{LFHPJh}t8tk߬f#b7BXDФoB̏9 fi9AFcȼؘ"TX,ѥV=8.SJԢT:Wat\fΨ?b7ݓI~0PK9ɟ|0Hcue邒}i.1=hGl`hԵ|oPmH$IPK@ NIFLw2=q@Y/X=]{^}qS ƩHfvЛcD~x:8-2D6.ʞHS&_V(NѦZn+/Af#̱}j[.w&o8 <3XEdORG!,бAK>a?t]ƎB/:"Xgш yDG$qhsJ*Չ/+UH(ɫ+ybbwȢ)$%\2jf%L4N5jV o.| ~/2.+\L8WWVզ9Tmm1aN<4itT !`bOy˛ 9(;3<LDe!sA>e0vVKgšyﰝ".x>qio)T*Z*'[4`Z{ @ x5s_ʼhBϿ ic\pP3 3KYC>RS:eI"KQ%1JÄ{Y-:Iɒ*̳AC~FHP/3Q}LK3Q "6MD9|D3*A1Ǿ8D vuʍ933ȕu6:: -òI[,! Y2({ A -ggKUF>E0(_Gg;hG:iH=Ci {6h;|Y^s&IÑoG&N7o8R:hf7=INH "nQ?Sb=(*QjM_'HZAӣg+At<{`QUaVP K4?ގåUv¶oiT?D9lå+s!e]O\ق &AzĎGoEzW-\! }f}Ե55GVL~8"K8WѲ rJY'Pv3 !R4aBkƥ)e#s_\SJ ܵ({w>/dB`7LQ0`J~Hku:a@q;r]xFCyK=L? d$ߏ;;$o[KC(27{816ByJu#ZXMvA=,f6|!U8=_c( .ϭc`<,'ĜZQeB7E?HJIpz:oL8(Ɇ;D!H=l܃g)KE.O dӐ!e|pJF 3li9B+ z"ʼ7AC*r*&Ob1 SN܎sK)ځ %d.("yĩ!lT%N_6L:&Y3p7}<8D-d:(s 3@@O>©ǢdaB[l*n2ΧԸm8dJXCA$(#= o}g-[y0;E6Hz3W9~Vc'ie, Al߅.JUI~kQcSJ%xcSZDFƜ B_(co+ wg`򱚣j>&y Ar]A vܰ2Kq&!wv8gf\$b'Q ZL+iNxxl.jllx)X@e!w0c<[%5IE5=1Θqq7B:ߡрEm88Vr"Rsyvх{u(wﺼ$ WޥiNjvV〯?e.zK[zt}n$eo$ fW70ـtr#0 +ߴz d-"@FQ?3’Z@C)NR8~ qtEẪg<-pa#~0 87G R^3޸{7m7; f_l6 ;/e(7*~@EZ7;MXK|"LY`gTIQw4pdm3{qj*@I͈BN*xľnh]#eH xm e[k75ּ}o v2%NRTڑ2+8%g>1[J\{H2 |jاV6 ^8nJG#ճ *'-1BHNf5>QqXv4hQ4QSʪn= ~mW\k;WfTGz"W<&ڏKZَN$4**FwkhEL':AVZ"6.G ޘ8IF ۧfIo\[oHc̋?(E0^!Ef!7cM=W[fo=i9V%p?^Um z߻s'/.K*; ݡ Fq*l*c%rC^Qr 5}bDiS}b Qa063Ѣ>gG-LX$*\ ,Eee2zO/4S^ 3Y^* 4ǏKr!Y ,/NC"tޒb: 'FQ0/αD%ۑ0ݳ9Gx5۔t=j88#ҳxb sSI~CO&ɠxYrN5.go*Y.Œr=nO 1N&[.o ;suBa-iǥ5PI'o܉Ae:2:SSk~Nr }! %>ldM> U;[ODwLV& TD)YMCRKps$һRcIӉV:HbMZ p-+x܀Z^ ʋT4\+'$@!SW”Yk, xfo#eR)Oy^uK XcmU)xӍ9olbX"'x!Yvs@c6x_&p1h[2pP158Ѐt<0 üDQ3EIdZje%//ϾRTByvn/'9ථr=?2Λ٨<zI9z/4K7=&׿Dq}|f k E2@"*%@oS 8z!RLM5QeYr"Nt kv:1xtQJh;Kf,Ϫ`b&PwG(O.Yya&Jrd /Ҡ]l8\ Wa*#3Y%vk_$54Z*dK8 DLw`(c~,#Xso3  s>w,A [;ޚwT7}]^C&l>'\fۨ|"v ʳ }[QsZ [|k}GBDZ 6y^e('XBգ-V;Q/q  7[VyW|xF馀-'dX߇.fW?;p ?j m3p߉sAcBH &렢)u% [8OdԨ;0(P@Rh38Ca&iR2@rp(,z*JܬĨ6$rkrlB}QJ]բ!Tz2J@ LgClpyDBMT;`UVmV=g1֯r&C8ӏ\τڞ؆3[[WN-9xФQNYY5k I1e\FA CiymG]32qmXkcu|d(&lrpv:(,XV,ۉ!&}iޓřIҹ ̣S|]DT%WNN_gF(?-8v3&_$ihFփUYR#s射,#T]>7tcsx5G fcc&1ؙ h7ERG:9hW;v x)rK^,.FNL,nse]z9c \>>iՐA ;BEPesba`yQZDi"s58Ģ]˕[.ӟVyT0Qȳ*n0;Qg5'M߷7?t\C^٣ycdnbrd2۽?3gI vjKƈ9RYiLh'qwfy79Kx;a]fj 2Ad}"TJ^Me߭c,XC"LjG;\=ě,!>J[a%Y~d\Ad^Vq. x:J?Ķ%>?L6^|Dl|Mt`,,1BRUfE-gцջ1?DjTa-tswqWƽm5;]Q[J*Pq){\)/E[UC6E *7(5lGPL\x#^g嫘px3 N1DZ?^T~q dNfQN0^8Ex闬VpP`W}cWA6c@Bp߹`{l/XL&^y"̞ɔg'l$ q|q{v]^Yt2:]v"["w/M婍/bx ${;Ӑ[9eJ'HpGd6rF& =NeH0:ڔ-7`,c(Fg?!QO\s>آ@' UGw)(󭒏q3;/σ3+#i˫c˂Ef~Zn:Xzm+gܬlSuHC UѮFa7侔qX{hۈr騵K[O,Jv}s>A DX7WN3[֕OJhf"*ҌqgZPoC4VBCl(=Vd) ouՕSH7/ޜ-t&(u3rwG4yNrcj)l_bjb4jWrnț f">N5t2.%m0ԊZHvMq 'k1cqmc d*.9SZ si6-Ǜfp$TxCOVT;7j4PDlHr "h%)! ׉u Um=­qWZʾъJKv572\#]CCլ =oXn÷m2^-nIU3={pyG޾h"t>m.6GUYhRnn S= ^l׵jûk3Zhd{P?5[x\}2M#'zYWn5Ԕg5\(lMDXEEUҢFCHDࡄ><&}L;@7jw1Lʁ0Q.?P v^e~F CGx 2O)rh(?AvN/鬚rԅLJf5k3՛K1'_}@xxFojU$R谳P{C?0ӲY}R%u=HLz bD_,S`̘įkkV&X4K*2 /x4m ,o7 h?"RoBO;`>:;rOv  х^{2ЦD *nF; 6;*|ތլEĕM05R"&j=6_$OQS,aXD԰;ްhOtz3{2>(\ﶰ `!Kɉk ldУqW3~hj}2䣙J h,Uҫ%w_]kRiu A,ϰ{LgA{Ty8t,BiA,h NlՎ`7c[T3j[$1RM5JȗnbawJ)W..cJDɀݧXzǒPB >ڀz:}UMdV{XQD/NZ Űn6V~ȇnC*keobBLEh0i^'&7ul` }1=d^h1^\Z/;M NI=8~*6F,`'|,3Sۿq:hwheRFJ5xܼO!9zdlkh@CflbSyH/X^K ( ،0W;GSRG.:^ҙ/*Q7MN; 2S k1 m^AgaҘ^e؋vv?P<G+rG[*A5Lr5zcqrlطLz5Rj  ] jȫC=bEs!l>_DSu$ ׻}s9f˶C Rz`Z9q:"HV$#ܥ pC g"]{KKRlMԓ/ĥ2 ~іIi+&(r<\BB +F'6W+:N0elkpMsu"^dWruOd:svKD;F2ɴ!6f[̄y}ot2˖x7cR^t+l7+m:cc+jKvW&Le+y`=Ѣ7OB{ jT3Dn<_ SR(;!!W53' `Te|ɱ/Obfw oNbPlEF겱wH0g(v a^Qx:8DH? \ǹ/zJ*!Tg6²zy+*fHtv$Evb&0?){n߰}{M~+“z^n<_J좉m֢#:s@R2+xU,:;F q=ҲojU| Ѵ)H KgyOe 2v =b`wKQYx< c`Łଢ଼iTD+z[ר~$+|RF 1ίTZgzpOhjҗٰ ? lpnO]@j|Ȣ2Ѫݻ^ij2$51pqAyE,{_9wimF0doF>($AMqWK$1K`-%,'0 ێj5U_'Ѱ l׊k ߸O^S5ՉGF6Eqxow뱸Bl1b.z2۴'_2G=;`~/LQu_M}SܴuF^[M<ꎹP4$MJ[_,X%s1S{@{Fmi?|'į~)89sı}&v|#CkhF|ť?uEOMd+fAA/Fu`4&}@-@ <\#B>Mȕi}31@G{hW3ªN5!0L1fA$CtĒoD0ָ|I:_2T0%e[š\J賜>CIn"9+gk8G9UO(ѿ; [Ljb,~kǼ DRqhG-W\'5,wzOl]ޯG#),׀g%$)Y@Hm5u.CۙA;4Xp.][W=f: ;7Ivǽ۫IۋY?L#aP=z >QmAtvnpݽ-FTHǐ9XZq'rܲlܺهKL(&НB j%<5Nkv._&c/DqKyC ])F ,B15 inQ0m=Q$ =U٤b-i]3l.3ѣN@$Gzi{@Uxv-1+\X' %WFЎ0A|V<`8Y%;gv;ٜ2 WHx\=]sĚȖNXp~͋27}LIrknYFRqNP2*/ HF(x,(iGJ9K -%|ԖQMGU ]m1|;}<~| 6CHԪ1T3OCsW*VKWIQxZ]*Z{0/Z'Xß0G? Cq~4L.6L҉_/=)˽5}ҠG{!~+Q@%>q9V>zF-t?6K<[ޣتzN%ҸG0o=Dq 7M }'nU6E,t Uw4۾K dM 8N5eq,9pA}9M'/1{iu.x.hsv[sՠ}$:1#E Fwm1):$_/īzJ;ʘA0A#mbCP(/Ϟwf&bIK^K/uE_ g"Sp#9?`F1`y2[$%J1(8#ro\vK_U͜ EWmΰj( 1Ke!q#-@*Eq"ەN1$ ~Fp+z6#_DTX:\pW$J. $EBgo1&T%(3סHM7(w ;8K0ʊM` Aio%XH/)cR汪rh=?yݴe |o ^w9+|\iF4U+>*g|B&h @W7?%c|\jx ]gqb#ewEP󼤗T! .1~:ԧdm؉ ͂(F5d. !=kZ0MuIdF'y# I5"aW[[5G: (EfT:>-hsS=M-j/ޮ*sLHíI1ԊPs TCi_nHgWR+E8]A27^KX DǣS0/퓸&X7g2wC<77cLrW7O_}ޗD~x˚^rGB[t.1[Ej⒴tK-gLD7wU"\;; {ܣw-x4"q:$ Y'dzL_CR]ʢ E29AvȥԒ:Db,c(Ʀ R0=81qژotyBdVQ { JO H"ҥ-r1I&ۜoj^Kty qV|mYH!fHJ֗Y>wMǬ\k}AY{MD\o|zs7O>fx{1=_>$O7t@ם]JBw(ʽkWU3TG'H#׏  f2vK ''Ne4ر(Iz-!PlКj;W d]q ad kf#|!q[k<(Iv^WZSd7VodC.M u+'eFt2@'O:U񠫏5k<:$ %؊!/䛕";ӯX>~T%Z('ѱe<[d!p3d<7ہ&쎃ƪe[xiٚ[Ψ=N-ҁgwF%d%KkyD Bof_*ruX~ r@Z7!g&"I P` 3m*Y*)8C["aXq-:AQŁsΣ ƴddU%,5A^b`;]8Z*Âh0Z58Vu1"iBBphxIEl-{1 = OA/Dh2{XDX 992y~+4_gQ&J) el!-^WƿΌi?kf=NY9=%27G^OG*~B9t UBb4 8g]%-F#)qUgTBKy9G!T )!~8v HZ*3ٝe)kADrGG%Bo4T2pPfkEOc~0Gs*+lA='loLө筭 StrkMIwΕ9ɑcaW_#.`KP;V<4^V3vBM\@DYBk"ʞd =>. 17h1n/s:(}NuAZ,dHE)2 &ͪx;~gjʧwK-OH~zOI$}c)i)v*-[%ٜAO(ЖMHC59[e\Fz= eXǼ:o)l9@ڸt#5@OAʊz٩{ƽ?_ pڔ;ǕVO=Vp":KL>:{U$La#$S{pGyKW/+^L 7#JZd 8覥VNd,vd8.PV'urޑNbltlœfz=dS!zua^R a`^N˧ 5E!ޏ.oƛՇM0aKvM &b^%?Ć0ְtѭhwOٙM(I>>VR` Aqs)pՑ(8Ҁ"s#,#hG%;N;PBQJ/:كd}; _goiIj' hrY镹;ggv&a=ǯs3&ʛGܷ1f~6i8f: ŹEo6AG YRšSnE'5uXZ&fZxK(SN|1葅v(>lNe 218!Bjuv[5쐷$M̬prRCwZDs[XaB+ Q6j*-K6Zgl "%p2rO.fV;G8$vޮmpq,Ż1\X;%?q-5In@\@2Mp`fH郦lJ~ڮ_vGoH ] "bjIBF'G!$"w^ H8BF8GI+.Xf!tBb5G6"t^!C5U"2.fl%٣ &آkg~#IMou Q$e{N@r28pD `{鎕\ ocQ0jlzѫ*x̡RivdQ/} 6gQa,iPTu8ln&OuQ%\!#.SS8Q:I7;MOY竎~"T[lyd}f> cV*8-!ly[ް&!#eɫ^h$\nB΂.bEGeDt2r/ev#%37ϲ0g#ĭ'.5b)@*Oپ(#TGk8 9\~l><}F M$?*Yd$$-$*MPeP)r(ZܙwsD3s,[U& ppUt°Mjn]8X}B/BgMO&gU32П$Iv4mi1,\Ư$ZAHYVG$=B#bWA&GN NM2e#ԬeMQ|Qe| @M7RNuΥ*asJ.k(-xp~0TȖF,XLj,w/& ߹-إ^Kzy[!Om-iθ(!TQ{KЛ}kӁKD]7~%8ߕ$1ry;gDŽJ4\zTGC^Qslz\U)MELTןw:qN/FЪT$Z2Y=DQ|й:=z4=h)aշx,07.(EdDžJz*![A!Ikbw|.Oc'a\"V yH&D~JT:1*uɵj0}8 aֶh\ORo_phQIMIyFo[E`F=N\!t"Arw:ÇǦdՐ 9`E='{@]~v4"Â5 y=$@w} ТWA5(:1wlq;yLSr9Lqȿ׆PFQNAKCWGs{BK/x]/ޖޥŦE::XJbiP@rcPdFѮ<\⫢OK4/ n;`U`/^ xX*|\ Q0:F0%` 9ԄR|Clpbxx} M vI|]\W{^uԋU U1i^=s\]xX܊,kWf(Ր(9s`S(P E^7* )Q0b {qFbq[gfOeD(9sH9iWIF'Ƭ1$,nhdȕW=a,'!2\rwij%-Pݱ2%+s}F$Am5I S=1\Fp?d;7qžiY#J"EQc%Qe , ϟٶ38KՔ~3S%Ip[SJIX;G>5wS~ %󊖶sIM"혩ci|8L2L_$m֨xu8*Mz?q^ˬ-n6 U(pF䕔rYxObCԩ^MtK uY-͋K}~EL\GĀ0;ARw( GIBbAC/\> \qɯME`Y%;u Uc%*̈6@jyo4DVf-k䧈l6\DLc'>UQ(\;)҇F{2`TEѳI!za2CjK⠐ k oَllwW}X\/}@ <]ҹIQK1C !?Ow.e0qV{Cz4^҈CZ*Wf^`P^?5qӦALU)Fl@Օz-db| KO#7䔉8~(k( d e5|=<heL 9i| 0 SLfP􊿺w>v1+azF!" b->0dFY+YNA]#Cڲ7AK1s2`fx!t-Ay۾)i) 2 ?P;JOJV"~r+ L6Qg%50BP!C8KlX~4B瘹!e9?J6{!/.قX$;׀ ,ʦ.aq@@Z$nUT GY$¯`s#p=ٟql·;rqz/W^`tgיB[RAEMN?.D3e4Ƒoo::>D43Opl;̍_ RBI ِB7Eg7C1*q}R윴{im/0Dv:u;Ű׏{+TSfoW&pmK;;Z܃xNޕLZFS; j7^G2Z#(Y4 ϻnSvE+Z.ik.o'|U_W&@9F4'2/lM4&@/γ5]i?6OPT'1Ŧ̸3ʨ4\C " 3B$=lR*Q(R<,Te.3[et]b-[7Z@`1 O4A]>.@-6Y+e߲c;h(6u|=reZ\>ȽTQ=H6.iۮaeJ(.wc YRv`:NJ#8ٸ=vUxuLPCSR 7rR4IۍMQ}_-56!T]2R) JF f| VQu!?t7Fͻ^w6hf<߃!Vo{a`ݦ0,%[ׄbHʄru-G{6/m-a;c\cP}W.Ro!wRzЈrhis_މ:BڹS\)w| _83,㑨l6mp̲yrw7)䀹%YtUܾZ\%r4 9[z3<çx8!/ 6쳱 .?|J{2GJ#o40(FTRpdl]chH 7oYvqE{{gyPeІv&?e[Ai[MO3 dƜT'Xl+<ƀCQ(/V(E;t(7 ?tZQ"y@gw/uDP\?<6jI^7ls̼ VqjuA]Jc39.fUÈ<ÈeH4ci}+ږ-zzɭb4]HzQU}D\,`H::+bZl#:b֭Nm[T,hהWnnQΡ]*.ICD/+)-ro Xuب83\p~? &udwjVr5;-G({3X xts's mJ*|Ҙeai)*Z\"Ps|1 ' _9G3צjw(Ʌafěݜ66}ϼ@_A'6Eڝvƻ[U&օVd2hS`΄)RJIpjIzfFdv)2fY:{l~'Wit Wm3af`@؛r4kmbU56( BviDo覓j (Jq,}N:J~ν2"?UIk3QJȆw_~6+eO]O 9i&dѯMáf$GU c&{ b0OHBqP%-5}u8:[ z*g |A' 40!%K N%r6%9GX#4~&QM7O`:X0iCҒ&$KА+|&fJX <~鱱vÙwSb=D&9Y'4!hm % ;I(j2B DHL󆨱y]( 7.woplmHнmqM-\j%.f aƁ,DpfGѾ3.f9%d%c,Pդtsnnl:;ǵ]r^]y&QۛEo@((b O4^:ng_6Q'k|F.zVY~w1z{G˯a?n ,[WE$mHU5(Gb>*Xc~Zոv4hdo>/žcђMx}yN G 䐳ppQOr_|Ï-V#V K|3'/ 'owX2&0dӋ&ΑD*56?7Q=iV*>;Ml lnm7%<4V 86Y`\V{;.xͽ%qz^M53'jj^䈮1y?V_eeUӇ{n - kXb&G;m!s.Zլ,}DZ*XsɆ'o,iΤzC?>0_WK(O*_p9 EVn :#wB18"h"癯bZdU6C.J,xbyھgiܸ\9 E 6vrpdk ֎φm̯L:ǭ/h{sçݔo~GPm65\Lg %?2MOJ$#AP]1V^T|!^,nLEu93VvGg*mС6sסNJp:6;j{V1>6ժVh02G*lv 57ֵ3#ʫ*d6Rw}33ֱEN0x!QU* J&rT/ I7 t$.xY5Qj6/L ˼mgW@t3T1 -Pkθb,'D$߳_@zͳ#/08y|Q3E3}DB,`dO.)_o?,+dF(Z%ϥ"Qsm"â۽5O^"Aes&Gu|_pAJLiށ~h+א֟{4l]oEҀqt\k4@VVoNJrTuwjZ!_&E `1)g֨'9֥R<ф (ڢKo9J?, DŽd,4Qەk=3¿LM|.rhN`xnsömjRn+s3đǍ00 {bd6JJV(4,h3b8tNg5} jFd }+I2^楥1jIF#W1 JEZ9sKs {d Nx.3k8(\V({Ȅx3~ϻ΢hh%&ʽXNUc1BV R Sj6#3= ݋. }ȫCށQ~g)k GP]:gy?Pj35dA S:nj"E3g!Kp,$/OxLL<7\ WW%Jan6}TW|˦8Bq5HTa8QPU{3ޔD[AxA02:eߕ]n=0*|.Q354ܽÚ |.hȩtg:7vW n_ 8AR=p\ͺӍTd3ŇJ&A/[k"zZͷY;d"*b$$d9+5\h1!j*V۸[,&q{r  R%*^oAl;l9kR:~ǽVq{u\䇳0}>=Б.5'33ܠ.,Z2{WAa% wrC^q|h3Mj0w1]]U{/H=!껞<=% UsoThՔI'/Qmhx엖y>y8zx ۃ@aEk80VMBD3Q Vk^gcO>e2^6)=* 7R£ _ Skь?""'%3 f>sƕ~\W1:ɭhx k4AM翚<{|5~ +0;~u$]q`!@rVj:StjȆ/[B݇s4^Rз}{3͹Ze#i'6} {[XusyK pd=Iz7BI. ݚ!$AxbI<w`hiҿ!s_eN:{`1ČPsel`2V>?!u P2=-.]T;Y)zǖ@+acf:bWPtL/:Iy>_B*:g4JSְ9ΑN<_[)DCp#6#r*S]kΜ-INMb. Fp5m$s`4%H8̘=hƯk2L\[Ut=R(2 o Oj{y}5ޙoi5l{&k9^| PsB]f=ZҨ辳U lp4p4<$14Ӳ[ D^ɡJsH/B&*xߕ;NZ</ˬzJ]*TtdS +d:=T Tî` aT)$bޔc~|:w0BhaKQDW:,C@l mis7ٿ1 I߾Aꮑk ]*o02 b[oԬf*YQt{_ʖh2g8nq jSl {BtjR>sirn)r˃BѶ(q-w~bO$P޴3Y`ݱY~T9YxRTgCDq0Ҫ&뒒nI1 EmOtlrBDsy*),Z<ꟃũ`m=5ὃqbQkflwk [gmOMrxSa y۽ȿGݿ4#02F{Ev[t42?N#V'9kV@YME<=4[w(Yg0⡮,_i#9U Š(y:23DP)SBϼt2^r/&-R'W XbI d\L)QJ@j)E]#sOgP6ѱFl:zCYL(\`7fPI( *g@2`.;_FV%1xdh.Fsrݿ1MYyxJǵ EaXa59lݏkthm^0"㲬הw^Y~O1i)潍$Vv st|h7MSکkz\ pI˜Uȑkg7\w bۂ+%300]lF:&Ӊ[6@MIf4]%D!"T,w鹿!=)rڔG+8'+F:/ AЀm?MFnᝏB_JLh;q0& .%r$Dy/<;UJ6b s u 8UBBsզ%jelp?AS&SߘوG%1s"DH+vzEhxzE~u԰|ynfprrJoA\893|  f"0ÌJ\UNR % > eMȽE+8k<Ij }۸}6 >seBgnqT~ t7.7:%mo6Jm^itQŹ:~(*iFv5jQsS >p潹o45hя*}9:Tc\{πSG"5>7F[ Ew[ */,lHϟP*[\ϜEs-ԭ]ȫ;"&L ZCuJTjG7߼Q?D8 rIQ{[g'\~erS?u[֊_W5xydtrUOxnZR:wgV<"a}B1spc7 cfy!¶@['HVD"4/ 3XU{qPO%j )V'@V1ބ0%;3mGR0Jifd H6_ZɎö jg G\B*BF89wSY;y]T $ a&4NhHƷel tq0+H=\mLݵ1wu3n^'Y9u`\^YZj8tOuGg\t0IM=Jgp;DsIh=Wt> ΋YS䳵\ҩ=f0!JDK1x:j:6fUf>b'%|;}0ɋ֭s/d%2Ǻ:Vnh }jf`+8/({fQ[>XR:Y ^~@ ;w?P>A5KVQr^ D*_1!E4 g뀟7yZqW`w`_{;S]ځWtE`Eh8]x#Ja=X. /eͬvZ6*r Ɗ%\4)tY9xӁ̄v R~:&";2/5G{yE R!3 @&QӏMnO!p2mUd:GiKq#p؍Rih͹=V2I^$Ju2Tf.Ad@f-Wi.ɤ&l <b)0iA9xK3ǑCmu׮j~Q<EW$3YKSTٟYe|V*5 B)x._;zt\W/ڤ=%#襠L/|$އ WL”~  D!{~PQW&,JebI&\lLy֔t~u2P.!2g6ҝߤX?}@n<&r^eRЫFV%^EޗPu n|> : So $C !->{o!D5-E xZm4ΰ/JKj">_I/ =;!Y  tAǹ`Z*h6;su4֛FzO,YrP)tw^3%a(r m=O|Fvzu5͍1T" f\f/349%n`|\Õ ckQl>~uiDu0}.:]iCXZ)+kߕO4v &Tf.WHȪ>۱V[|]U4 (|LMO'!~kKՠNM:[Q+ _eVVJ&2)hT1=!G@gu/7}9Wl/ Nٚ:q^hi`낛'M2FJ0mK@)4f@iy,Zm\|b{-*L{CYVaKigAM/q1i˵Z⪨ZfNG !D>B;G hܯ\3 7J/ Fsd)QM!􋔥ݩ:YܠhגT[ѳŎEf)\HFO@uEx,>|ga[ݓ6E_8п(w%hxZ^_-\" O>3իB/sU8T4t|^= ɇϭtAA7RFwRB< .TdO-Thug߰ H6sAŊ $# YX==$'2h3B90r!#9chQ*R߸zvEZ;F?K}BS{>ѩ GK̝`2U϶E7A;jXr2YW}:kߎ0KSS91EQzV"?=ߟߡrsU}QDN 5Ǘ^E @,Ih>p ak zT0RƠ|pWFz ֪iain|gY mDnQw؏(DDAkFݕ!7/7cdRn$f; ?ӣۿy4VIg,c-R x|iҖkzج_]0 kԿDJ+ $jFѮG+w6M1N%(ȧz/lD'/~ݺ v}RQ% Z7 "[V_ O+43}V$ܤ]1u`q^T?)Q6,{Z_,9,8K^d͙V{pjX+⫯LGBz/(w9aDmdSkt].,!g{Zakֶ\7k7gXH˒R)y*٥.$)TH&c1 Zvq AW7z2b@`A.86#iYWW-cä>G[sIy$zΉ&bZn5ʢ m eL; 3Rc$D%jw}¶^#e;//Nd ?3bt&NQ<7iVSJFIhآ2+KռöTPdE܁iRcjZl׻2l< l{U{g5 AK)&}c:ti&Ż ;i'*%>/NX|y/TՓV|>_cf\,'AJn0+d:gX\Q =LV֔L[?s_4HvR7 k'/kR \O. b-VakN߿0{Yl0#_ pBKߌc.g18%sҭQ _mбLhz,I'ͲK9L,anas4XoRJaWúWՈhItPVL6|ap?CKW659WcIseʜ RuP(Z/l'Q;(]ڈlЄv3Nhs JޯaDi6vش~Zqx\-Ƴ@pqA6\Oa0L@'#K>YU0&AMI6*Sэ}ɒ<;$ 6#[,$@ E*똞oK&Pkvbc|*G! ُ{BWw/Ǻz3; {/3)?H/7/-z5Խ5u7:k4!{]̍ГLߊX>D~m9 #Dt %Ƴ|YACS>#EԲxOE=ha%4/9X"l3 J_*ݰhX UftPN?Ť$]̆iT`.y\C"3U儌'Qe4fጌ3mC*IKcpWŔF\`u#,jk3 $A9M(0=[~"/„hZÙ-ʮ%98JbVd#`&3tMq N Rۥ?]RNT8ˋM[x\Q~>ٽsЌ׆0wCP nG 6*@Е&R,0_D loI.%Oغ~W1V:WFOU6]U=ɋ'2 EzdhAxV4 sTkX͏-P!QY18,.?Zv cPy\UJGOV,->ڇL%sF2^<*HR0n FE+Gk##ٛQt)ε \w Sn (m}<p)U#KJ2B.=P·HHhdmZVR$qn˥Rs|ϳ ۜZdBjO8H]8=t] FŜeJ%WƦHߩdGiӏ@+F79UCE7ͼtL0\ ew` \ol%tB4'o79JvUIAw/I.څ? ?T  Vy61%&$KIgֈFߗg3O)*=s&IFHX_W3JVծFA(Q=%_T캰adY!x'+C8ii6G~(n)dk4 @/2ONxMqԇ} 6I6C82w5ke27_,| :zĔ`*+TMwn,hk9yyYEb6ie(~ׇ}"]X,xyLL' UJ8 Bܭ4f*+&n/DjCmM.rt猹@Wba :`CSFm4³ܖdCԥ;8cBHuD8%Pb641 WOp;{ۦӑ֦8YbRDC^@ NOh0LNke3w*8%%U,՚tn7;ףR4O.v  yHu$lWW0M Hy;H2#nl>(*q|@\N44Ma&nY}Q/)*EK ǎV,{u9rl؞yi( qIf:TE=+F ܇=1nG \l֗7:wN66u.8Mmɢ@͐{4O߂Ex$uYC][Ev:@ lKܦ 8h@>YR^ ;u4L'?1F(ka#oF$ pW&\ȝT=m']M\U1P¦n-V5 AOkaSmso"w y-:#;5bȇ.?T(^ s]||5t{G&8_@s3&tZ)x, 77qTuwkZ(8ЀEr= v[Fn6֦?:Tz N?{q퀜El J14mwEO|IEmXD皆CwyU,hbP? r_.-&w4sc{i,JQq?-W4tm'^'&;u(0 tS O j iƇVglՠ_jݼN"W|WX]Q4 h2vP,cUZ/{5x Re'^ݾSIc"W=!N Kљ$`"Wfoi'!FeQ:#;J`f|KችywAH_dkW0U5"O^ f)O#R7H?bԩM=dJ5q/_òZd`5rn^@Z 1b3M m6uJ0-2+Uբ]Չ*X |<점0 kI>&*kl [^_tV`tYn?x=Լ/EDl?}D'kǔb mgm ҚR5yGi': SΑǗs"7GU]0!;:Y]#»b]ԧAX6r zNϖ<&Qll| wn0O ޺t\:]e*}[r/edUvbT4:?͈]Z1 $3&Sͦ{M>i38l7S[$I&OB\ ^77&u`m?zϱݿ^OXKDh|ǵGJ[%:Z_A}.Y^gxc`\"ExD8ҔCZM&S> :T3T_[}}ۤkkchD8 'JTߚ$ )Rɉ՞fI2=TknN-uqMxq>*{Owwi|P^cV\ N 7YNj+oP׬M clAþBOm*,z9:k)ۻ2| H~7UVLjxZFAp3 OD8 +?%-?|bIWs' ( K&o"QMdΆ3 8`ᾉ8#+.yWEBp^*i"A0M9,j M+_Cf %Pmͪa'­zM$ӨWw~NؗppdR_Z'l(9m%~SkꍫA+R}/x;/kh[χa+d!^ݚh0(P-H_RǷюa_pAOda"wr 슈D.k^;%کE ̠֫ 8?[s$6!0>MwЮE o;&[Fs96I 5! vJQl<-y4Έ@@Ŭ>DKd/LϘ:Nq]k0YNR]0!aP$)2>9*!ȅF$Jf8P <,Ԝ^y |b/cVpC2~mF}[jdlt;B\K휷Iomu]>؟xcrfPœfO#/؝miEfmΆ>٧&l\9ܘM}N# fq~C%sRnP;hpwHrȩr"W$ŞDǒ/|>2yt |ɾNZ"`V16iڪN8]N0O snQx2Hl>@OhNA&mgui17La2-G I͖3?ZB d"$yl׮]LRy˕/)ޞBΣ ^ylo)]e(`Ji4G$%כGE+9 &TM䒄 &As2~/Jts)rzE]ق5լtdS ;?o&$` LivT!Mс"6~ D7 uANosF%bs*ʊGd_+kKjMym9ǖJ[w~.$XBتHbk^h(%y1>Z$3[${ F\7J}NhXY%~2IZ!\n>U(dK#{wzܥ| S9Oڧl v1f@m. *;(ق=ad\XQ4@c=+L6ulJ%?[;i؛ߵ#!|ːnnd'Xӫ㼐og4Yfg8*i%j>yUt'x{®6{K4B'sT5E݅Uh$ (9 )(2W ;k1eNHޝNj9jwcq oخfi)H>K"ǪQ2<56,cQ <]aecgpή$K QHp.\_AOnw"R!= _)I(xpd28T[≮ fss_ S̱<?zԦD0X?]|."Y6_J'~wKm @Y%ĥD:F>A 6.֊ ^dr$tLıxriQ7!h)@2~n2@{+tjԢ\4MR`51s&e5ic|ϫmr%*TnE4ȕד)J(h5>_Ita`SF WDOGX2W?`|-j/޺%74 ?`ЖA}*~^aH] c|SᬟH/k؁69>[VRyWg;miJEcHS.0HR㕖&CߗKXuSǜl zv?i8|_!P[n+_ (';AZeV*66޷(}EEEd|?ySKWI6 KxÂa ו'GqH*@Sȼ*O1(n)r}IE9͒ۊbhÎ2nQor"f"X=c|l~OLB|ůΛTYPG$,.n|p֒iud 1(WYazN%:}Fh]_!qvlw}`ʞ/q`#GȘ 3ďBM^YǴ%*%| )E lCw:Y&-uXmXκlpSoCmmg_غw48+Ibi i޿с^[8$LYxEkcYBK=cՇAU/2? iQ Ȼi/=° =g}-'%CG" Cԣz(# C dF WyQBfD7ΌAwoV/I&+Wn[ > a7?ྦ[cEiMc|d~~RRa؟~+HP DaHe8Ob ]R4d\Xք A P"pr?MLhL5fVT+/uDҶO=qg_r,7 iS;>Ǵ|M ,r $"(0d"4%*lӇ,qU6iskI Kv=zpԼ"wG{"mĸU 䈓EZ.?Cq|5_Bc [Ca \.5b%.t>-t`{T.{g.!C*#QMigK@È0nm6GjX pa?9#/ i`}!8ee ud :^#Q%k6HM[#'!,܀tsחYu|]e=9sVհ|ﯰm0mNrL9-ZaX,~8KÂZk>බodz0԰G\NF2ߕ>1''Gxv7)7Mxmb`L }BR"3QR4M)_.lk#oH!, ɋ9bePc7χ/R43CUmHגCYdht#i _CbK|B QsD-QFYRBc %wX'RpR@NϘiu;P0R U32G s*aז#xEq>cX)9.iPd6Z[( pZ6Ύkk}^[bMB̀ >PZzDEyPWgGk V؁e S56ȧJQ[Q|[ {2[^c_n`;rq^]&$I)/^spC0+hyr|8SҮ*[Cl"RSv vE;N'Us:Zx&C"KN A!ĠOg0L4r+*] i+r<==AݮNA 'Xn-Jtu&oXff :oKIBN:>׼+lqp6aX-<0 ٴ;;¢A z{Ua:\G-P,wmLMNɽB1c8RF/leɟ+O@fxXBp)1]W K'MK{_m&ppiK,7Tf0$dz'6 7q6=g)_X/_wWj0ň+6J_4e[_ Dm%,Xu ]#G9R *F_ިgG:?헦0(/yx~%-4fT ,,{҅fJTxq%CvNk&5HKXCA5)d*ϫzҝR'JG*mx>%]JˮƐF9 4"9w1_;z}>i4| ^ꊾI0VWA(E F˙{[l4xFܪ79J,65\g-JSX|ŁrD_[an\AEku_n[qx|@5SbY4y<"ޤl1Mr g 9WcN_fUC}A4~xTvzj PU=mf2ov֜s@*}>PTKܡv4X{d*Dj:]}B5L6O*T>NQGƉne {Dw`N?[6/ɖrDЛУvF5i;^ ᴱ?\@!GA)={be+WV^T~Z밾w>jg#?۵T|L vآq-ۂ9XH:BkL2A ( 'gptgL*V'*>d8GS $fHEDzt17w} '1g3Uaj3Έ #WbGYN15}íYQp2shÎI3igADfMIP[v4aN3 RE[e {gUZ[gu@*,^;7ތMaZcJ7I$j/t=ƚFI $ Dgj0_!NyP/,j՜ˤBM/2/86zi[|daΡb:vuT (YNӂ,eYc.UnaV=@u*4x,?X@H^0@mjrޝIZ[%H/ڷgvQ, T}AfY@e{pA'-7_=7lEJ6`b*J**ȵZ>hOݖ7(Hf,VFz bQV?ݾ.~1W{ewXѸ"5JA?L ȅ@:-`ģð֊7hfVibEY1 /0.ڔ =uݰa1n` V|+N]7:62+>dMAMhm>T;_Im;RTA07bP mb+WSOE1 8WLOwk&#d#xLC({nɂBc(lјQ%d}sG!h-YNEM('Hŭ89JCPVu BꀮaH1r(U2i ؈-fgsDcVNǡVp&|r-N=e,,SYK)mX#j2٫ _ſCaN;ݙ)=[EB6IJNY+^0?w8ܤno<?ĚB;*0W7Rc``&|gK\ &~U1iUׅW:EwH7sPzIأ'5WcL5) `▯MWcEcZ%_jTڨ{+ |Xx:Uiʩv1r6BgO,\5_[K$v {{:1=KG)+bS<*y@z~vojyFPhJĝHX;aR; ) ͶXj"\qh 28Jj7=܉LkR lJk:DrR_sX m۞Ը<#u[-BT-u J'zb՜͏vt٩4ddՇ5Dx3;[DZwAݍAuWނw JԝŞxa;ptPdAљ*He>ۭ`h7VZS\uh" ή/:zCx_)IhgGKf“;XS,NM1; V6zPexzLJiACkXN-[?䷏Y%X8x4 %sCp[Vh?lg J܆@֬[0t(_ ޕ*g+3|xY,ۇG΁Eõ3eߺ$}IVNB&m-]Kʯx ZQd?EVݤO8)pDŽjV(u),r381@wAzE<ЁI$̚ ycd/X5]jA& Ư)G9vY,_Ș]"q +Ms$~ϟsmjP`c S䪡LQs^Uh*G[a ;},rfla#0"D?8 XhS QՂ,5qkqozP7q 9U9>%G4= v/ Eꯢ蟕g&^<=POJwR]C;@^,TbzUa~oek9 `{ } H )D!AME ښ+8^rKj@VcjpĿw yFZf]+q߳!0)XHj0f25wCW8y5?P1<=%"'B^gKƻ akv,HXf]g&FR86t824ء zTHjK", Xu*',*HVR`1z0):>i%0E9CGG6|jf?[kY7L]ͫ~z%qv<(2]\>+mc!9Vi}&ЃTfQwu+ (1*X- ʪUxtI2D7WC`πuq{ƭ5=BHW)!ݻb3-LHP 1 jiZQSH1䚓WU/A$ mE#X_y !e%#Qg(.XA_&߀&t \bBTWw!_ua^4Et0W]Y0WxmNsD }[yzq+H儞>>>zUؑ]q%@?9(^g@JMxB0l\WR,m`Czj%#^7LJ@95a*\d(6J8]VU-V.VT7͂27AJ_,⤆,#I>qF`ъ @1,E dBT%_?$L3D(2 F"Z( 4?؊to{LaKZ9 u-vRo$42Hz66Jڜ5y n X >Ybabѹ/@%+,' Ep9 K-;{7 kh1Y%b`e~ЅXdO$ncYrO؏ذ&/ CC̈́$Z=="~Tl6b q>'8Su՜@^|t >襪AE1t&'ܬW듫Bݹ ъ<.<5}jyǒ#Z?&s3U;?ԙ1,΄/y-j4L =W|,=Σ$1@Ku"zV'p Znwx! .Ԇ^g}Lcc8рIqr Oמ쳽lOQr1PDB{K+'nwh ގ4"N2З.ɒCC6GƒH,?J|+q}ĸA?AmZ(QUͶ]0iIwT26Z囲=/r+o θI(o7~O)w(ϧ s_mZv@WIJ@cč؂kFeP.ڶj.7j "^@kX<;Q%MP#! mxPa;bq/NŖ(X_.XunIN޶æ /= R ҫ!Vv*ʙu#(TyՄnW!_ *d uXjI17:f4 )_k9ƱIzFݎ[A)~X!-'6PY:< {F } 9h9?) CQF|8t-1"8BZ&=wywv!8anׇot &TR[{8O+#'% {@֌UҬ޼ۢn@9zj~@աK+SuFZ8i~yoB$*]0P 68m_))IAɡl;:1 vZV)r a=7i2AK 1!=U A'`NI6GJ5+@Yp#'30*+[ Ixvs9x {RڗDHK>-Z7бzee\Vw-DI-NLRbhH0nLcZ6s.`6\QFkXAzW\GRNRSz\>Jh_VAl @+Kt!l4#}$IRP`_@`YwM{=b|4\6x||b6f*jVtM[~A ȉ;* ɢԠoh |Kd~K>š qEHGfUsZ .xAe)_:О o!౸"3o|՘=Q@Zֶ~p֔ (ʫ(ݞ* 8S8'?I|VSk<@C }fr@Q=~x~g^neB= 꼺آDER@4Z%H4.d+dÄѩƢHV,2٬ `P(lY9`-{ QZMC\֓{PO`V3ɴ wbf鞦0Kd#6$Ps4J'x\[r p`b?5qE1V 51nϹK8ORK]Q_oS,ޭ[qFw#ڵ: /}k6SU=&Ըg)Uu>MXlB3_yۨ3;1BcgŔuR 4z8x׍๖ݵBp{OU~>;Zn2ȻT87lf FOGQ^m*< }irS0Ҥ2zG9G*C<ɞJzy٦zRA,Ed^4,{}^", ڭQT2 "A[x|t>`E$bJԇ}u"BMySl{O6F.o~3ĘkWb3,RlƢ=i7e) ]sUuс'j>/ǩ6xaH3=="`OJ0x݀N枏̞T..}X1d_ƚԓ`70.֮S> dEFs :EXҕu6[f@z #&cZD+tCIQvpB\a ~ @>`37HBCU|2ײ8+Y=4HՎpM~䀢Y)-THvqJBG$=O:TWzT#S囡;q[AyIWUvj[ ?ܘ:'B* HuWTթ|ʜKR;ng"#TD P &uI:$I 2@i&`'FR3)\%/E,:=e IPեQnc\ܛ8OLW>pMZ.Hc9G$p0eqWoMRim,w-dQZ^ux>7ʵ ],=j/{]7>|%!)[z`*HƂ,np`Vgbs1;A͓i9qqU3 x>7OV.: "ihޥCQDq]ԔDq%4{!C υ#t\pFk뎧#S@>i29PZż()ϕ`b‡1(Hm$v߰>^s~'H`+o=>arg<݊qC@YaIT'a% ^B*{H8A޺ ¼)Hv\6q^5Uȳ;gA{n0U2% Q,%Xi*':NBE E8crb9N$[Q~ >rE'GbWګ)_Y4X֛^9´;~8b|KЭ C?svl\2܈5TM7Ghx\C%ouTU!XcƂϽ#^pzXeL_7_щ|U#O !C~yyyRnŪ_`Nn+ȶ {:#QF2 | fۂj,qSF. ޣ+ G"-fC6#Sfo-x { t} sh "8%B ˵},aq$E0DS*%n,{'sCʄT?KBZurGck. Gcy1Q7娽#ڝI,h'_e/p_Mg#wvShe,-} X ӄgnOb?U D~>U*e8ȆbTrp_ j/rߛgÚlGb|YYxۍppY)3JD)WW^@ -*RHdAei}1pPF͡-c} j<=@bcIH^\-VM)mXԙZ'rSMwSzuzpu6۠+DxH gՅ1]%~@ ˓X&۷8x̬Z8/GbV'G}y$a-.KӋG"ҷ8c%:%QŰ2bG%5|FZLhḸ>5j,9eFSaj/ &5:n" c2_`K1w"bqv$_ w!^j4 *>wA>%lz-YuB%rc/O>!X$8W\p~X=1$tD?9F6>5+uI r K/fAPkK^}AXG3 IJ?]%+Vf}΋ ݳ3s9}iK pCO` mxMKEe_0 lJe),@)%1S#Kɮsf聨 B qK2!t@sxj|I^'畄Nm6@oYՖU #LƑh 50deINڌx(įfyQe.Q3 k`@O5UF;@3[gi^T "T +I5B}]!E7 B$~g-@ 3Q)ǔ k#o,M|1iRl(:TCSk_$qGUq*V2dϕ"7 v3[ 마G]}xE2X#<؜v%Ŭaf=߅,\GA^arVX5zcaj Eyt"F;#l{ 04g 4?ŭN;FdJX97^ط(CmUEy>T"I\Z/EdM7&SHЏ>\!T7qȹ|QtA Ѽ7拱`uoPhӂGѝ3~"q8Z <6Ex7De{,<}ʰz'AOPO ω/ulM͸{J8ow|`͊A\A$g Ike_{2[ L] 8 'Lo-=-W*9dڭ[OvܤպSϙA.|ƆwG>!}㤕rlx'PdLs~o@t&%!Yzݬ z"7mf5#5&MYSfܤP*r,I"Hj7#ַH.Mi y!8 K.@'_6L oGH gus&/,NvĎl]ky Y|PGqYۖyFZB'hQ^oی 4EУmw ~ZIWQ~Hn2$+q63 ZA[(Gh2]ܩ/䬔(>ԱBI5<8 mT -88KZ%?mOB]ݿջW^Ѝ>B0buAӫɵAe'b7lEbQFƣW X2V>LdpNl㩥!SOєzۅB2 ̏^宵=B 5 2֣#à6OIGIQXѓg5CR`(iQ,?< U᝟\˜cŤ';ڈ 3-%`_.EːMVVH>;m2(>}4 '%a$fQ3g[x/_UiG )OU ZtL<_{mKF L#[9m+b @ux7'u'˓I#G:O2Y=]W7R/km-?ξ87Diև ' όdnDY,7Hd / KQ| )Nh`_?/3el֩ylKM[^ efḴo{/ ,-?E0 Ay0Ή%orÔAOF;,~gY,;ܗ+SG@l؇;ŞJ= 9ӡjve!<HG/mrr8]IV$HQ7g%ބ, wBn=&jWBIspG_Za<͸u "$ j0L#?\oқ#ga"@|?A*#sl@1gGQǶrzUta :-3BXr!Ի6ie/Mb}$"cFBƿIˎQ~&P-Gv:P7` g A,Z!'I@YHvvh1,pSo|E1RCMy?Pjp1jf `k("=|9ia379#յ;-R4xF㵗kǧ6{/[5t9#% ZStn~Himd8-!YVMٻ4W^H?!4\^USEw)=rtba\ ^v5 [رetR}4gL'Fj[t\4}\-$6-)vonՕcWK3=Iqȷ1ً/mBb&ܤ#)Aĉ@B'/v_ؘHỴ*^gf>;LkX(G&tZxrG)o'n7ȡ\d=HV~)¬^/$c-5O`>1ff^wfZbѸOݜW+#%ޯSvGOǔ7Q]RYu[^ΜJ3JL:^ιI #\J2 U?R!spX}[y#|  4X +K%6wZP6*,ڃ))Re'Ž*oyD!7AΩ MGf1a#U?GB[|_ȉMY\ OHS83g_8e#@DzߞCO%'TJ-!.5C9BWT.!> T(D0H!o14ta?.=樗%'$5BpU[ [s$*z򮧉tξ^[-D7~W@ [o5ڮm8A1,o\M4u8_ M;9YlVЫoOg~ 4+N=29m *PBOYL9IG(I} }d.Q#K w]C>5'HdLA cDIwtrܷcPcTB慰_`hy'n C1LΥ:olmd~zƅTۭ9 ȣAtHK7SZo9i %< XCqzQJ̈DO/Re"+(=awX* m}F&<dgc@:2j'UV/jZ6s4zi?lS@e X;)/ A#W [ L=1Pb`O1.Y+ὮY0=xȇjD>)ؒgʷ6H?J{ޟ>t!.SEORK^"pwԚ*ڌaH[; #6jC¤Tfaͯo}pZSj.*a2E:4Z}T_E{gTh*#E/iҲ&oBx@dQ}}t4̇Fah3)V.N hNq!r6*Du1N-{EQdIu :.>$qu+İܔ#{E0cx}%.T:c] _?Bc\}sC&ʩ };lD!/ %y ^ZvPց:Fu s rr_Mòxg٭ل ͸n4*/=<KyheaE'ua |-nȁfӿ!'dZG{)(H4q%ժ߮$\o6~AW؊Re_!,Mure#Zer>-7O,iGBOfЫE\~ܓ_3mua TA Ȋ =T(BTcLCtb4<_;}%IpOPbAԫE ,7{e')|)F[x3uD}=x]p[|K.k=]l-90[@Uօ9NIM 6^#o =gAQr׫t08p5OnQLvh"M*@ok~ t$ɂ*e/ԐyLs^ETRYntL1*i*X,0 á+YzUa>]!xMynƙ- QD(<%qK\TJ&'}1}{l,w\ʱޛ 2 c8j.)=#NU^8bf =:OIv Prof{9t;/-C>_k2rOBmxP^cx/W@ZR9A(ތk)SQDŻ`lKQ'z"ewgխcƇнŁ{i{ >%J [LCNevY7y3 ??L@o0X* TffU!em 7uV/*zw(y6VbRq.&b}= { ^p?Ms" ; ёnj~sKkP: +Һ:[zTg>$P1c/reHj䕕VdjKzairϨ޴4Ip,KQ؇ s$ˀTA1]'BhE!_׮q1bEkԪ+$ݜ:ϡ̘{*DJrS2F"?dI](ԯALap!~^O( ؍9uveDcW'Sc]+gm%*y0V(3igzJ9C!/\vt^t)F\FL_8'6& slBOƕQ1 r{ ]J9%وdq>bd;.[<7!}:k|}=9Sd95K^+yBttkQpw2^9VYGXa5do~b?[uW㡕 ^؝X\SN} 2q6̺T @ҢQxk3ĔjPgp@mv/J.z=L­#@pЈQ$ۊ^AAܘ -ВƋ֘}(1*4Dי\n4*IJ ޒ"H!BlFBu5,aE5F",ܚ:^zhfcCP ϰ?H(TcbBY6kgNbqX1|5R'rJpB[ۺ7|Mњ;paQ5ݵ<+) `:8sQ @@R@҉Z!w6 i̙æ#&s xz݋.쳲YcNr-x*.OY2o~"^q[L%]z;!?1P;ߥx֎gNRt RRD*V8(cwsl8{M^0 YD9WE^su[oyQDK.G*COQڰKBVVdP-tP|<<3]RĔkpGjcZVT |1 Vci.R,1ZdyU鵏C=%8,%" F02TO)V7qHycvvrAiMٵ[Kӝ5'< >v6s V@ <9נ<$;@;o͕HhAkwDI6^ 2[Y ޫho b(a=6|SS*ЙOAhzZ |<8.ie'{Ph6{- E)U8<_E7>h+V~E/bx#T_8P|'PRpmTXP!v?){*d <}vq I9x 1#f<rWUQx-xr;la驨>y[a Grdm{ 23B@DA r] \t02]fWvKBӉp̂~E6t`d[cNQK}v!JnbSnRWR.DV$A1𸽹jtSu, O>y4RYc`h(&ػXRJ uHYNퟅREM(Cư6F!nM/uaiǤG LGϩT=6\ӌբ*A49FΆr(s.'J]<&OY'B6%;E_'8&JC Kc72EåblGe,Rc>D Lf4mSɿDx-E#Fz# v5l{;D57T8b/eh)Cy*i9E끗4ioFI EF1~`}9k:ubqʒ/R`< >Gwds8j2A#S3]doxʬAU-9U$oĵe$i~MIj#о5yHȥg/h&s;Gtw՛g.֞YT2zoHf_ڏ¬W3<~u& &WtO4𧩜0s3TL)wד%gj6/"ȥ␹#JXT8ޅvN˗;M9w~7d(5V8HlCcm,0T-H rxvFBBM&MSc c)f2,VX;>8 }VKzȃbЧɒ-'+%}QT[(vmA$s놹gP yԢ~/LJi2M ]tZ+l ޯ, U]#٥nkWH!0S{qYq6%3e7 _]"<:#@ ZQVw J FS^` xfR>tRWи 4g %[CV\0SEBDJnXrP7̧T9I B)>}ou+ ko.ڤ4u JJVlI8@Z{¶e7X\H;31OIʈx g/r"Npva*DDvI.=0)/U!?lsaseQ$0$lA1xG~ǨǾg0Ap"TTB[MJg%m]kQu4j9މf ?D8;D:AgAia-G=o^o.8]Q"O(yXiiGoftnVKKDNZr@WDH v,3 %z(- ţU?@}UT8'2sd;p [:a9F>Xr-?+H+=~?.M '3zQ HEE9Cp/I1 dT-"´Y˳hu Iâsxq1J엜쥷BZ'Xm@ǔz(lѸ 2ڱ$2t`h?#ϛ+^x]ԋk1$[ X 6-bu k:;nEL Dg/6]O]n=+_K-u_LiB!<|@~{9S @vPyt4. #jVqY6CP ЈuK9#Y:]i] R*}YzwQ5)K4N&ԯ:Q`evsK\hFN {P Ȝ)Ik VN<PGMys:#FcV#Mx` Pwŕ\vˌi PÅrY/ O cËTY3;2N8ѻHz۴~1OF ߷PX??V;yotDmه0R&mS [g5i]aFoM{:m[@+oj L>;+rZx 'Q8Q3,ௌH1.0o{||F 6U[3wYB>RsPeq;k-<"_8_'Pj$lFF)=H$\[/., ݼc1 #d5E_91jvLd4ohȔIjUV8@vh-N:>9|1ao02MQ8ZgJBc,}8͛yQ}S[JH6>Fgu7wvUzYuרcL2 ?|F1ɰn_WxI&K PtsT)9V$ ,\.tNEE-ƙ!g轸Rhc뇊]Y64dw2kR6$]+E^_\ܾc4 o*!Zvl 0,2R3|"]mh"am`Ը)ۯlm}]ѵH:wb7=m8Z=8w5Y=Mgm.`OtG:nlarެ|+Lj/vQZ '{ysc腵P[fD llYkB h~ <_icba_,+e$Ui$iY. };w*MvZF62x;\!ӿ"W'Z7 A 9I!(wkZjЏЄRkƩ҆j)Ål"4s}ebbA ݙ kpZm"G54Q#ecA&96JAPby~b!; nȶ_ҫK_,jz;ABAt+D D-?O =Ds}*Lm4ӝr&*Og `2k*ZO @' pSfא01N.[f ~߿8v,+ FKt7_"/Άxp@U`VFzqjMUFSf9%?&J0wf︁؁*ϑB=6c2vs9TPpPMKK9UN{d;zl#r1Xc*nDA͖f&lX nc,7Us6_6烝\`ҺNVp '[F%8|{g>@^.l 8O픱9^?9OFms,g˪KgjaȒ搼8̛7Ux^_vwCh,*9rY*adpB<4:cYJ|(f[?rM NmsaviB(g>_ H-0&&GM@!:=rN!G=S2&iwoޭdMf9e !V,ˇlk_3[D1s2Eݠ5J!WvqlL!ヾ莒M>/ N>9h %W'j5{/7 65J4֧ ЯE0.Ho:+#حn*/ <fsE/j1@((-jp#NƢ!\Zz?:QDoѫǞܖǴm,٧z >Lͩ~hތ+3+d&߆#AKtyXZ<։. OzMҬ9 KX8]`#N0J64I,.恨(Xp.j%3ee {Z > &":{)ɇs#p8!71o % $FڤLa %kRϐ©RIkIJ_dQ-\@Gދ)"]V}K 2ktce+k!L&")` éʞGc;),R''7;W=3퍥܉ߵ+ 5TEw  ]*On ^B3 /N im6"K-Egu2V).h߲k Kߠs*YMInd cp;oT:gӣJ~cjٷYSF>l}0ŞpĎh82-hXʸ@뒬nh}:U. z:iC? \p nZI CƆ#jy@Nͣ<*;R޲Vζ!%4'M=CeAJ?_)>WҔPt8\F DE`D!kTƮ~T b =~F{^^U,3P aDif m nv -0d,<_ Y3x'>PʷK֒ ۷{քQ3oȉ;R&N@Rx֑*B, նo,UcLZ}֫V_t1Z<[ ?3}KuEgR˖!Pd}z̊ C{hTPhpİSNGZq}y?زAgż:p|h}w3&hۺUѯH\[=b[ ħus1ol{1HKN%j$zO$MfOG̑!Ln BXg·4O=e6 x\Sn[(o̳*O 8-aOj6r\I;󻋶_uCÕDYKqq˓bbDؔuqUϻ27R ;TI7# @H8(PSg4X0kYwe):wTX}C͔LsQjGiAgR|d<$5M A2rp?U>v^NB[(O"gJ3\ڕ}Mw 2(j=?5ƃ z:/Y+;b!A O+fY/U}4grUbA7B~HŶ JK^95p f3,,xcH?=P xlLNK (x*Eo>4!*em!UM)*D:)ZdDNhQA@4B TR)nfpMqU :XIzg`i%4!~|6EQGc]y7"x%9i2Gju8BfHfޒhcm<@}ܴn {&L{`A5/Ku)4h/(L즙8Jve#کF4Z$\I( !W`+;`33$=.ygBQ^qqr _-R1`3By7m)k ge|%t._mlpG MƼ9x%\͚|'כ7i:gaL%<Nl312MKJ˂rzhrv놂m1;ĠX Dj96\j-rE P%#v-ԡ|*bp/|R$y a<Ա-<)9 y]*:/n-c.hbuXlaP`$xn ϼD9^AtrOʼn.׺w:t5w$"qȕ*S/v GEǺ40էk2@">Xgkj>f=*YX"y[ihzbط|ж9803L(ڕJy33 M\^ mB 4@pGCAP:ߚkx0זf{l 9FM0݌nקEz^bK&ο7 jI+AKڈp`2\gD%QJ[t KxRyî|A)2m*@-F r,.eDEPLiJ0u2FL8Wh_/߱ HX)P Qۣms'td^nDU¥%md41V͌A4-9;7W][݇Ґ@hng-$l,~2X51&ȼ=bKǽ?Yz/?5t0t^B,! eZ+)HB%&vDW(Y $:mnE}Ճ(:?Lddc#sЄ"b R7UJC_"vjkP FT'OO^"+Nk8_FbcDyÄ!ߋ s}[Oo  ʪGafBeAtPjxXYO9 a='M&4&~R*Ҵ+?4 k,%H$(m֐[n̼7F&R$7h JAûX >7,oB< tdkڠK$gZB6rO߈ W1yMi [bZp- CiR†8;$0afiιwno{j[^ b[_TL% Vg^;uJy>q %{jho7M_NN2~"?y#")V2ştDA _2~m~((UFt xqi_:%Z|'\W8`e;$h7!:6mb2%#UJq3M^vH!D?c<~2 [:ˀ~UV)=57QzppXwU锖Fg8׆?%Ϸ5"U϶J,Lz1$\AEISVQ*OYh1{`cnr&qkUZ?d%0p}Yz>'&i 4"Fzag~k6,ȋ0냉ۇ*SPj:ͤ*n8g^[NSUH(U* ɀ.xW~+u×DmQw(ȯ[@/4i--hi )j+kGϪG20Y#\ަUH}D%&!i{rdCmzO: ABE~U0y/Wop0$ӕzHFs>"mhE Wz&3k8@;!}˕%!?LY TKɵńvJ4,A(S*G-:P9PG/ wSEL:O Ctn #LfovF&q!c؅})^)\Ub7 iLXpƿxP.I-}[mrOzxMqbb c.HR|OZѳOo=$8m2pM3J'3— aTIgziK l`]c a>+U_zӑZCEe(rD?C:Ռ98zyӪ!8*b8N4IDl&ʼDfNp"r +'ȏnn˾F 8` ob~s<`XּPZPNLZdp58Km)Æ7xƼ q Dٛ˜1sA x'Pp%#R|PJ,O!6"0 MdJ ҇:dЏ!ǻ-mRL^~R_&/;RaxJRU*(Cp ve)ۥ,#qB+Ow"4E^ړ eZީqmSZ'oR؄!eT#<} Tę"L,V lBw?~NymH\2(KO~{C.a0 or  PDS1wI$&&{D/&{uY8OYY#POo]ȧ Kg[^ytߛCy Z ,r] &g%5֞۔I7t>VF7_vr)עqU[YL Z-%IJ:Й~F CN P0M+zɏ3rt8҆3@Ba}%Nz hQiԲ0?RVˆB-'.+:/с\@"xzx*d)W'[ۑФL"m+Mrrn4֜*HcOƮNݭ7- zG0lޗ|9Q.A tř-|`k#r^g/8-f`(ۙa(6Qȵo^kFtbP 5_c.vN)[7'Jh5 eLK-4hLkOnםdu~ z 򮎜dŘ#G =R} 9Sɥ_ ̐ۤ=z F/㑧9ZD+<~JdVO9}TK7IzQGMuڇť` 9Ůۑ|vާk==KZ.!Wt2YrD7$c %q9DNjYDo>FRw+gG4N=zktxHϊ"pFgv@8M(Lv,b"ɜ ʥoh-0ܵH-f~V]eak ߼1n5pf~U*,^VIyٝ> Xn@#Tn1 dW6)pzx+$.ЎDzse 8$C1Lr>WPEC7<Ԓ8 )[mrn.{TpԼ?*49 mD{[Tķq^%ǒT3&VuȎ/$2UA܏ؽ513RlRHi^owsWI0,C-~gbaſTU[/۶`>` UuE9$"#6CZ$%_brĀ{1ZWqr!R.5-] \;<6a=:[3ܦbKhF(ȼ>r~ ;F { _m~PhR}\Bk7Q/:Qʽ"aX' aًjGz9WHQDQzblѼ#ѧy*R[4$mn7 ួ\ۘsBJVNTgE zThey{4)[UM USL ]982GTg7:PM`Ew\btTʜg^4U7#?3:T(;G1se.>Z3G8ANNO^5/"ZV%Rip (Z_*IQKf͋Ub`[`=nN튌 ޢA:l5xtJ댣tQD\aa0ɫYN_[~Guu k|h>mXm璧KJ@v _m鬿35uؖK%¥[PGH6uG-&.Ňd۱|~3H&[MfWubw ԃCi;c"H\MjbNjQQf6ǁ^-J9tD5TLفK3`qXt059%fw$85B7mKJt~yo|h W̗ 󪬮5,wVBӅyMVgpUX5>@7M+\/ZUEnqD17h-HuIybLQsX<цձELV+OD<h8_]gߟ6VD$THYLݢb+O{utwBpf ETk ĵkW6qT(c z̰R,d[P6`8=xPO;uCϕGT"[%J"(fn},K:Y* fݓ¡Hoc {r*\\hA Э^Iȣ uϡ.ÛpSGGP:tǩU}]Ioxh$]ZArNj54{Ei_bìgK}NLTePVP+L]64uFFoa2KXJOLxyoQ(E$@]  ui;gvRnDM3yc˦QP((}@!oĬȵmE 'lᗟ;+loHhydd^2oGM#d'G\}{(}W,>SFǙNb)"1*בMHF_gD72g9x9A" ܹeIqTYŤQ[L׉O(dݨJdxhX#IdʃG j2njIeKJ{<#׌p4>_8hk{Ray j]γ-Me)oO-ugps5 u*s2r5*V]4p9q` E9bX[|kMIi֊"nّk9 s;Qye߃JfˈvG"e{[>(xD,F×Zz}}2y"=WhV>VU)؎zdHǡhh^^ept<llmq#C| 筀jh/FPVyͲ幮{ssJ'%;iOe AN?B=O\N瞵'xށtGPAg~ᓔ,1=р(?l do "1^h>YW ͵ǃUPE૿ƏHfzsQ~fٽBoV`,I#b(`X!M1"\Ym-:hB2 S}u:6K/KF<"A8$kR^/#rcJDQGaWG}r4^ \ wj4EhGRk̴*NQbeV5l>✩+ϰr/ ycUB6'G?͒$70\Ie܇z&`\sY\l@ c 6q ț<2BCH.a{M6]RQ׀ܾ*hϭ$B{N;f8hzcyɚ[}JG*2NSˢDcҞ并tMK3 V O0;h,.nJ[7I^"kO$GR-|WH.a}K[ gHLAC-eYo ľ-8+^C\e%e+M0+ E.=q ~CZKTIS7Hԣ aH\*&t\Ȩ0KzfUyO r1;HV (Nn8z/i+j)لÉY]_zkX qAHL2!t@d!Pĕ${:1Sy _ეݤ\G{i$l3(a?%優&֘Nqv$ܪ8 T;ME: A9Z^ MYaGqsi>-@a"I\šh 彨d$\s@lWa2#uAXJi/*.[g*?~M-:݃H.3R Ga7׻)˚ǝ22ZW2 1P&Ҷ,BvS'?j(鞚oCUGM+f>t ڄ{u>uvƕsN$ 9MOχ̱v5.7cy(ԓaقҮ^sl<Šu1`ÄP-[b{R Iɘ7@qtd~71^5|-w QquoP-F6vHxD3_wi8(+l{#tMզKu]RE[̞oNC[^fH;e-'to'4t1&*]!  "xh|}_pћM$~1~L>N@zZeUj*CPq$|/9lrZkΎG̕K6[sIWN j״"wS5-_2k h(v {cV1 f76&2uv62n}WN|hQ)~Hn9:D^ JT_\>_n5 Z7R!YQgĺ6q<L%ϔ!} 2]M[6h5@ʳs |wepQAײr \Ƕ_Z4:e=(ك$1!Df@6=4^}5Qŗ>UCװ W(yM2ƋjͮB@ۋ<_}vZHg+tLrı$g Щ^ 0Oy%eӐKh8.Drي,|j*G̣Άl…8fYCl5ΏZS;i0hoabwM5Kw~ѻɿ؀::|d6m np}#$% -daPF2|Ԓ cF4(;g:_֤$)~CywR42ksTaH443 ? wob5~?)s'g "uiN?G> Wb UC :K،lG\&E-Mi@f1)ዾ4K%AɶVZ<6ا{S89z+|nAk\Zfit *?|1a u!Ee;Oi;%;ЛV8`L>Qq_x :M^>@iE%AWaN`1t:ͭ[0D"@ߓ_;zK  sщ#J <2:oWl8zf%_gDܢw;~:k4jl"nɜpg ʟ`cinGʇ}Wc̿5ШuDςNJb".| 'vIss. h;oBB|^c~bYkj'VmT7堄G;Y חsղHK.DDݬoHxBn,JnmY"5my(hPMpxBJͱEP '/qJA~3ps99\8MPlJ[92NdpUNzM CE yQnXEl%7Q|'35҈RwށlY%tBFgrYwUbvybPE-?ˏ=} q**oޣ 3:1 ?7HSД u)$heIF[>zob*\I@>ūkBn;sI0T @\hXxa-^XNt.VEIMQCp& pE5 R) O?n6`9[rgQݢ$JU8n|=l $`0\^~ś=8ܪͭe(|jr~Z bWͣn"[-Etau7ũvfηsگv>?]^RD-z9v,x܀kO{-‡'ז^g)Ј!s\Jtq;s|;Q0S'5]Ъ]E8mՖ6D[1}PĆ5F/ՖNk-Jz&ǁ?=`92 ƿlgwËGR5(R!1PVd;;$P=2 xD)Z5;vyg8R>ܟ0r&aXQ`;IÞ+f}7#X$}ntIjvӕ<8ZW$e'Lt$].l;$rZVALF vѹCL\Spr{^<vOﾗQ>:VQYZvԗVVQyFP)J [$mߡjedRm}=dS((&4ނUfӋsHIrQk hf ֶrʸ*}lJ麑տ󯉮 ZwꈍGh/~ƈw_ :sc-IZd:Wik1PhU!=$u[ۉq<$XI+g2Sǰr 0]dj7gDTl"dJn73=@%8+R_*1ր=~{iw3b6ŵ71/xM?(ߪ} u'Dl{hW70QYu+Lګ N(GW23%}UhL9E}.xkꐀ,Θ"iO[z=v_~h"elw)d;(Ix8T7JޙaNMF:Zlҿ&X1+ ۮSy.vIzM[#bytkD`-Pc?X Z|2o&8Q5L}|[Az٣W,5HV=f|;/)T:ukxGa"g]|Fl{j(vy=.e6/3&in{"1K7|p7F.h8(mؒY*nhN8 d_M5@Z+'GaeW)WT)kvObh! sɈg;_ f"i tGRS9y#~Ơ>]YhDK|DkpyXc)} _|RC'jugj.DlkٌAHY[ ov$ό{F,s |ޣ@+ԎIE3>NA-ZLm7PL/c>~A?,Ww8>-;_o-~Ȓɑ[ -MhuƐ4pjgo2ek7я3$kOu}k&TǺ, V-lo2xd425 $F>T`Ν}ujʪL6{`- #J'ŋӉo?+ڿFBv1L՘fֲq)Ca' ЅQcyPVҖHaӄ]m[+M"ޅ:-&?EmnJ8Gð:!{eaRfiϙYܖײej_qf1.F 24m@ [h92<4Ẃľ:?Ԋ5AC7mzdhGz IW]qQ{(d|Bz6T8Yғu=pXd\]:^1I}JY$Ӥwo(4V}tFgxE6\P-ecl&D.D#*Xt!֙񚞳dcde5ұP%OɤR7UB|ZƝ7BϢ${nLec~8TYx]{|yQ/pٍC:w_9Xnܐkjk^agEh hη=FJt%=}vxPb\]D/UEHF$h?F궅FJsP ;R%%ET')ߐW(b`?1y`0W^ kpӽf6ZҶsc)g.2 [k.Lr:ͷ12P-S>$NǃnO~KB`ױ/ym󽪡l4nl.X;6f7"5u<<=T 9GsuJj+hoS^oDx| &,Z,Ӗ n@B[pR_>WanxbVX޺,6 1#uvtIGzY̆ǎ78'%ZӐR5yVD@33U?neAqiBoXJ:@ܥ~DB+~ՙo75Jk'@``_Q 9Mأ.19Xި=ZU%kFZ-Pn pC*BD/]2N#~>Pe3Yxfe&GAUj~YGᖴuMYl !G:pbC Ѷf7B#oU bި6i8CiiD5Zms*[L} ^"o8!S|״j'DZ򞻥b((Uelې M1 &j!pYMB݅s]rFJe%AYj)p䦀-gҭfv=n0oX_9ty =U!)Bb%P v̆~4A>EtMl7NRkd县.1,!eوUǀ,pC|j yU; JcWbJ3GTAWwGZюv$y .H}O8!U6Rt!S|ґE T0vs!F gyJ'W.B}EcCd {$Цp8*RC{fp V>=3m༅SҮP~AjuӼ+1bA@)tr̻ƷL} 0_Bli e= Q mrJ faX37iC]dKYn':!2oYV+ ٣Y wcBPP6\/yc cBbc~>* r, ĜUiob^IC- 4pݥg.i՜lF7e[ӎs8|ٿ];  0䑌U*Y%7sz`4CS+pr{5n &"p;I@YKE)h?$B6 . N|\ B-c"jeQP+i]کfFj$7<%9k1 /:*U"߂g1X/!ZW 9T M_Nmk64Ft5<<_8i 5-iO%?n dvP**M [1qvM.Oa 8Brz\Åqjxi4qsӴfP>E(ɏ&ctZSy!S+_ͣwOPbצ;u'rY2(HiB3-+y^G@(]Ycg1z.PY c6 H; }U O,׈& a1R1C9 m5Rc(*,|3uW?~$Ꝓ#S ^ؽ 2;ʉrGI]cE` 3Lđ+O}^ 8l (%?lJM]"\<^U"Kq܂X $--`u;Re2}ȼZ{#w[?SCJ6#-8@R!R ane_#xzg)(a],4@XUɯ9fB>@̿@:jiVմY {" [FG~Xh图̹HtOh|r[EL1n0̙u ?[c зcBMl{@n[ ògnrϱ-ӳd|21Do'!S&ۮͷ%`ë4~vUM ԻᏯW؏㓷g=m&~fsMl'ͷ[׊ vRWBqZ m? 320ZCl6pXyOrSXWݐAd^4mf[M8]8Bi <`$wv8ȸI8;2C55?aˬ4M$jVKOߌf|B;U]l6>2:~3{<;9̙H`j"A ~<4cO1{Lt:πIS4ݻ3#K>k dnWY탷♏.76@SB961IuD9$NK4Wj^=nCjR 4FϷ"r&ap7sF_uZZ5sλ+IUxwN WlaBG֍y}MsQI ݤ9PUdnp?ߑk:nr+䮮06*"J"d*a[ÝkytY|M,WXG `) ɍ$xTq4`nނI؄KAUֳ 1fn%,7;1+oeYo40.9Ë>>C޸ls˻'6&\侔o9vXiBd#G*eJG]uB 0Xd]v^ N/uOo-s8l8IkW:R}9$gh,!nk-9jwZƀc8Ji>-1G(bPé!߅n?):񪮕DR⺓jgO/?EU:yv%MFpc, oP2LMY-nG/{L/9ޖ@ тޗ!eJ緐6,o{؍!^2Nv9] ex;G\0!J2_ajy[ ;&qNpW8~acN4 Tz(K88Ω1'!^Vlz<~LdirL 1H@EN? ǐKa]3R '6 Λ &phѱWͲ/#jg}jO%oGaawxMх')j˯-~5Oh!HS\>tf 't:[sz }({d2DT%=yGL1+aCOrkfp.8Gr=B܂_^V|k!6}A"bcXa󨒢5. ;a':9E{ex #ѣ]v+*h_ H:I9}06U;eRx4JQVis7>;ԀʷO9qRѤF> !43yD,ǢYRr)ԙpI%"pFX^`1hUbkC{^hJJ<>k&V05ڪ0Tz~r'ʭlNQokiRYqLOFN\/64Bu5?)^ߎ "VkjɕlDIvy-#f"jZeeY.xUuIyw\X[pFn[Yyz|m;[g| Rʿ>;@Ða"Ff>9њ2>pwwZn%]X#d9rV_q}AAÄ7lj˯L{z6XQ̆LܵwX<5i1b7`i{]U$==v<p٬c0I؆נ *q<HyWV>,'uV1 H'|VA1V&80'@OFĺRX7<)#EB.?KL{z kt*FpGM̞V$s).]|컳L ZbB8TyNZZcNN.q*r'۱NRF؃~~NX..dŵsۏ8Nx.+^M}pK2HK5^1k`*12/WH[IS7y1E 6Ќ= 0q>0l{w3]>_6&PT{>ef0"jԢBs;yY 8,ӆ&N+>!(\2HVSpʉӏGK۾Q곛opO khv?;vbE^q'Y,0VDao$s= E&Q&Oi?F.oS5p[WwW?"Ώ>LH OO:(,jtV(iűmٛ 3vZ(!E֎Ԩ10C*;Q~s~V M+hb\egz Vkzz wA>Lvr+XAgp`Mfg’N泸-FSJ|2TbXop - YC9G: ^knWq `7m*, 5hOGw3d>Pio]5:yLÊ F5Ӣ,-NM27FzGǯ)2('1Uq`0QR8.YdևqGI{ O _ +%(Bw<\@bHfyxq:#_)61` 1RKg>MBfw*61W\r=1O2,MLM! K{s>!8%}Qlm3$u8y +Z]n,ܻJ!F(4ia@pYhB;dc:)^a 9X-)pknW$"~(RW R/#|G W")ZfuTTDz1BhHq@`lQctX< B;a0,= gR[$(5Eɸ0%/3\k!R}LoDS01dP@Lut)R<g~m[åwX}"2#~LT;гbETkW#_yp$KqŽ\GU:7z襚@ImZJ] oek7K17q-?I}v⧚T q\X vD2'^N4 Ik92pN|$>&["fxUM}4-Xz"^oת룇 R-K[Mn\Ty+J󢵦(j CYH jd]Y9fR=&Nso˹7h6m*9l*Hjۻte t?)`*זj1A0NId5U ppLNGלT4x1^:4d,.C7KW0| 4= jouٮ Iװҋɿ^%GtSu"&&.%!WqeaVYehJAA MVz-Eԏh[S*Hu.bՄ/H|Vᛐ@T*^)!aLօz[LMhw5:#e*]V]r(Ҳmoxk/B`@TsxA$6!hZ8B~CBDV\4-+[BJ G"+GЬiQq:`zCȄcHڱxE uaN4s2DpocOz5ݠ{jUMבg dFx `O$}v'Ŝ?" uS2)C=YSOW1lA<܂Xx.! yuQiEeOrS:X5Go!ϷK-W+ZӅIVMBfzXTQvфmjb/G&f /;W-n|?kbtcjFk٠(I|.CkAee=z(-Kv,x{]`&yhj7y0I+h/cTTN: ޠ!VT^[ .\c ݂}%C8o\/_p߫XIXc;3o9ҷ]mɮriqu=GSDZK*'=}Q`%[.Opһ]l:@/{_.ظy) CR!捓o8~\awnI_ !6Xp|,M2C/ Ms]M.; pv8zZ]}WT|N%/w=R]U(+7$EAL9.׶ۮrFlҟqAp*͌lp<|)gb3ɛzr!/6ΡM3dI 'fpSײ*- 9|,u_HԞatk&:0vH mt}=X0Yp3< )AI湓ҝ+M#U'/*I unA}/oREla IR'FYk΢QG%}ǩ:`E(|6MW/H^sNFgv~,R~1@9G3r¬jwbQWV2uz`GZ?~.kcH Qƶ*b;lH `5 6MNZD*^h4(A t Ae`S jVgT?*=z s$(K'wʝ<*\^$@,(4~LF+e,U+$/;ۺqO ,!u8lJcd K#4 ,Sdqo,d@&I]m.s%9OQEj+wyй "bJJw&bm5La"To@Z sJ. 9aqB,މ^wl P2 lXM{= kOǞ"|&@EnX3;4rKiAPxq-"F0h3&/wvIA΁z??ta$ѤN$L#jvwg{ 󕣝Lm d-ɚsÄӧc$|<{7t,ڋP 6!%ɨ p@%eiF7ОI&NBWQ=Уf `̤mtYx'ǃ:[ 0p>6 _z`?D 9gc)7E&Q.uV׎j|Y xYzKbsT@B GPA[ͱ, szJl Kāɖ&=K `B]% *P}Kp#5m8N-$@zyܥziPnjURPo@RHk?gzirc}"[TFvFI-̩cZD{vSfعiXUmPsϋ8 ~w0ޑH\ĥIH\7+~yHaҨ!TGF"6UPK3z!u#(t)M倆~j_ n~J;!אqEDE|2IZ;lA*.NJ|)NYrLDC.d_ I K?iI;f/2ڌipK/IPͦ_.Հdd}0ؔxJN/[Ps#}q<꧵SAq_\YIʲ<Wg}}|;>:v=zLost$\b;)ml*ᱭgĿlWpb  0"T` ΗQ%>veIv k;?I(4 ,3ռĴl)N^wb̗堤a8GΗ L #1 8U[Q# h=Y ڒaK/R\N=qzT-b" t[8Tf1JJ<g*7" eDMlbv 7PYw @K3g2Rݭ/V]?yj y GbՊ:MVn̟[W(<}n vۿҰ nN~w\%5VŮA[I9X&ImwJA?9' >HomD*}Q23 ޏ9M^̴VО+3|@,e&d3JgrQt^ ˬ ,:oٯTx|1[%J^68V\ gV"uH/iQRt脒8ALDU|u$blVȡ!֝Q,C].`kB1U65u\ % |_L*=m#a"N~ũ|tT&{O;rp /2>!T@*x׋W;:nVc&>XM$t\Q]WqIoXpZk3HBb7KG}W#UZb 'Gn<Cs(,#Fǐ 1IM%@c;eIrgNr]Edc9&&7"\ ɜl$Cm;iJ@Xlo^sYIn*[U2x54aF^|ޠ],r5͡%z)$@t^Zt<XQKVX,,e۽Pǹ$ahs4ZBZ)D(N6d З1@r8(%la2ԗ^5ZAW4ubn ;MC//P2knfɮFӃg{"7AGpB3#宁NpJIAڥ*ere#dvqO6wuW,&kӢ df l₨+OD^AYݞ]feuUq92xiU̹EgsCؽi]4E5$f":14:qF$/:TegFa43biS|aS݌wgb/ KN;4HB%IZ#z٤xMwT%6Qn+8S(&3J HC;Ʋ}ĞFnʦRi!li q2S*p)$\3L+x3'! ՂG *! Gۨ YqǯN}ǢtKD˿Z*,նD_E-EI-@5FF*ҳA37,PW.S$aowݴDW$#xi^nbܟB}DvK2岩)J  W2R=[}pul2Gf8ŜƧl}ݬ2A8E#%1:jr`dd:35zu53&F~XWokֿ4b;*:UTYݸmaĻ"SӇv|1;VpZW}a|ߖ@%r] 2.CᑸWRܪEe^E~=l(gA5$ucVϒhj`4]Ij5W]Ahj6$hP/[eBO,{=|l NNkPd?j<7Ys3 bSD@tVn_S\ۀĖ_0IM)HtXQ_d?U3䕿R~9g.6$Q^w3wEh-34R*~6ӓn$ "~8(\!ĤHhg2 -4D-=(ִ+q{ )''_V%6Ц43{0' &&A^(2αg(BGw;xƐϡ2wThZTgiLRTR6#.QcXzGZ1XWoMUвa~gwGT\aف?>|⹅Oψ+lcE~\yFXI (őz7?+iN,4^#[gu5\_ &J/W]p~Sl:,=p];#;S*rP)\ZndhU=nG[GE STb#`yڳq"7LguS*\/|bXe):mJk/ Ze:jPrI_n*~TR zl{tAquQq2 茔.&ZLykL`Wߗ+JQ|y P_t=z4d|v'~)g,k0F )pԭto8!*9Vt*,̧oqy LC:g!~12 bG@(rjp!*WL{p8{3Zspu)Y%!R:bQl]M E}YNg=-Y>[xG=uhɎە٫23~FU$ T<]Ж]*q0;SL<.fJ)ye$+צ jD ,o]U'c֧ 'ub_LU.v5[@Hބ}ph|UHMFcZb#X%3}+; [lJW56auà]NL§HɮPV>:RNz,Y3gSZN}V6]7579~oVN*lSXa<hTc )QDRs@y0~ӧVG݉TY^ #I!̞."Q4 GZoot{>Nt; I{}Pp 6^;_]lR3;ƋkqmrjՉd*>G9J)Lj+3Ĺ]>оՀ#joCwI8Ƕ>=yAj ]FlV1'?I/wYu]AIt~vzV[Kyp(no:n|q%a [Ԋ|Bv9 hu<|=g[):m,9]/tlaWSD=EWx'aqEwҗۥbE=MK .7Y(:JQ7?G8:E8J[aC~- bm!q*$ʝF"v&I`<@Cixpj!@_1םaI J(0+jߵcqu *{w{J"/QN'xD#g*83fCk2'wܮӸ]a~AFRf0 N_PYT!~R.3PyWgsa-ޠM}bhpN/f 5,?D.KPeԹ9t4y1F>JlOXMQ7X߶Bv=tVJĎ1V #H)‚*d["B(*XjNnX-.^e`d]5q^f\vO@Pl_{so&Vdmhޮb)A?cQ~F˄2݄rZj5׳vqxRiu\dW탥?U?s1OsnK;y&Ѯ&]ƱJXk)tޝhr z;';B+y%-9E˛`t⍈WTl-[/m 3')Nj .P*ׄ}h=Du)௱*-}G=,n8C-~c~ȠjSg+c׸tOq} n .iLz6?e[=݂[ߑU F44wChӗh#7eCض4h>͕5 PdPl)QkZ-9IDX^M x}8Z,j" 6ȈCZRJ|CX')v>,h&!ӑf#0.CP9{ x@ ӶysELj)p H^Gz^)h3_me)s~[ɜHsn͒؊(n8-Xj __mMеXz ̷_WGXXp"N za䴇9,q?|1dF[a:%#.@LZ,^_A%Zp9Y5-;֠QȚ , =@T{]=u /=j5;F!ţiy*_?0`#OGX,e'5w שMx~E""MLZUE]z{^&偿+oQHEɺh7(YGOAIw!VD:( E.Qt@b:)8*&6*nw%űY3{7uuvvLhao}Q<}) xvR*_d;k55 I>J|,CdA U|5`T T$<׻v- "{5NЅʀU2'o1+KտWXU2ᐤӲ:sCbX9%/bz`h.W< 6){g~3[wh';=ljrv'upcħiw KIW tG\4k3sxIMryVxAHu|[ *4x!g 2tU柜7Ҏ.G4!HPy:hF-[{,v 7ZsYql` B}m<@L XTˏ>iZ}=UbEg%oe#E SGUf&9Px Ca3VW 5\F0!|[Ǚ}bH'ֵ߳OP!,&8^9Hݘ~hVl.A0ۼ)nN{w`oJU ssuڂɇ1!IZT>p=GRboB<2?ByTOqY\69>=[3Vܝ#;kwP] x|da = ̋WP|/oi`wumM— 2.ɩABhujko.YUnJթuevŘId:&`=wa}҂~WҟCōu+b)r+`%ͿGW[lR =e=*2XߋM졅 DJMS6 Ճ0^ehR^*,{Y=ؿH0~դ MG+̿^]#|T^J3B笳)DMUY_:RkYR)i@+M0nEnuA)-҆ԯe6M1m&,m셎ni@.Dmoh0>^;=7jVqBH;'L_f!Pa пn>u&w13 6E98+MxZ#{Q.rJG%i봒Uoh#WFjetg?KG4P ı҇XI"]U~-.E! i_F{O2]o\$ u''&$@oT"dWM;GtV 0\Q>WBoOS`S"A 6&b'F1,^mtx^E* 8QbHlL5^wcĀ VbЪH^ $ZoE*vdHhPPX!yO}v#ʯ2& вJmX(T$%nj(!_O0£S'VuVd/~?|_:$ 㭩x1+!+Ἦ[\4,n?Ti/ft 9HjAv yZc01 R}h0Uf aܵHP=l7׋~I(V7aw{祹]ko;&,06JrJ1)8Ѡ_Kk}uaḱ3<`ɚ6vMc>N<ޑϤ`̌nxʼnOT%{g-F(3LxX{Xrgl!3ζY"(Ψuf T[vqT_G\p+:s}X⟯ Dr^" ţKp<ELqN=0z7B8zqW=ƝunfCщۘ[Ysٟf9&~Zͻ34֡&[yΐrbАb8)W74ӹ{1>ߚIn0q onwg䟹*{~+W,|\&Y*i^ ٥8P 2~={-A5m/NҤ׽ir(urS%$ێVhٌy .y[ܘ˝TJd,{rǹʃ !q^"B&qi4 YqǷUC3;U3I~Em x~S+̃Do@폯e[ױw*0KiȢfͼ҇ nEӪ ;YFA P%4DK00'R[[F `pRQYu{h(9UZb@-Z!Ih| ɴ\G2{dV&HD)YSc[i8᪹>w}\IXE=1Pv =4WG<Cؿ2q/(Nǥ6]4> ,e ü,Mʨ[ѣ r͞b@5Np"NJ Hg`#"IG"%˻M 1v+uT8\ ,K5i{ɡS9]GL*Wxqs( x@tIlj\} w,^at+ɒv-̵P[0pܴdYnx`1O9lFy O#}n".|dBnj:fx_PwAao;z@RZ-P|m d]z1P5ue lR4p3sb_~JJ'Jܱo3gL<+ cZ' Gu`i-ur ݘi Dszm u͑쮄,2 PTmcRA@FlE:F߰G&g7?-,.YGlчN5j:DhƧЀTY͠DϘʡ[1V0~漂cKE3*T3?8 LQ, zz1;)IFg'-`f@^[Pӻ{ ^423})e`K|X]ÿެw;i0V܋̝[ܮq3 ^uD#rdHNZG*)ا2џa`t$SJ25gCHVaU.E%#. !^lIz6yL96ρU܍QU L`M6Zw`dgS4 fק_`Z.}ll>=1/Hpw"f ql5DtmcEv(Ur`nc&x2**1L\^jfeҨ,/ x(G)cR&6mz2> xgOa;?>.i'咇)݀ t{n$zI>J`qB;&H1?`{w6 Z+k t'Åj  bZGiJ6L J[a#ۤ;j| *SCZ9qIoi] kOj2[G=2it )0@oJhqGL]Q 4 c`R Od7D3sXWCЄq'>G Ҳ1I{M8O{u_[vFheDʘrĢC_+Ca_QG?2vx҉Y֟o b` }3L'q EW%ݧx*U7qVk5Bc~ Htx[i=gU_]>`$@0+΃%=RГC*^IS#7TY!D^,)45sCK,h@Ȩ7*růO8LL3Ǯt'"Ci; /})/iGH__ץ>C OOAہExsqa I" _NbhAr?9R9Y/{ܼ73ò9Պr񌣮b`:CĴ-p$E䢙7)J1 鄿/??KF勉 ^`xӋyv2۝_v&qIR:'-C}~ 9ܜAdgZ/HKLT+Ҳ.S>$Vگg/@kEzH^PܢsZ(X> k#/۱\F1}<*@첢!οDÔNUͲ&ZOdCW pYqk&un#83wm.rܪ8шV}DΉNpyn$5zn T;zJJ_z<߯K+ۮ4 Je߲km9[p\6G-fw?9V-mxW'xjԒ_݋@l*#q䶧qfni??6:=:]j݉a=huvۻJqN|j#b]uц :7#< ֐KU,]=3YX.TuoRc=kޔҹ4^8eI_4=KwQHaQJ|k# vh}jBnKxZ%Tkr{A@7}2#$=ӨsGT3,E%QcRݣ~=M' !86'ati|udT89[_C!6ah.S!ߎlPt#l; 3WFQ_nx#YM;]8 !ݟi] rE5E,p3Tfq,:LH޿xIA`j:}H6Cgϟ :Q8.3x;Ozhl_!Ǽ/!B_R4k{79W= cZD󢈏HM(LCgѵfK ^$.e .%k{ر >KD^jvQX@/Y-NDJAU}He H 9:jtDqYP92Ƈ M]-*[g:zL 6) >ubWbD)f] ]f^]:d)c[}2DH]0kgέ-c@GQG.!w(FT«ˠ{KISC$8Kxkz9{\`HS|l>ֶ"}yD1S˵ʱ)>C cPXU 85s!$#vhޡ*ӯ$A1)Y7/{'`@M{- ɏH{OzI /7nt_lN4UڨϔSC~jwP"`_@.oCuV6E] HW_Xm^ ixrݤr_HN YLO3"bwKsJ*lBʵU Q8(2 lR_@be0L~3By4*׳ cd{/=A j[ htOb&.zkzPp%5߶JQh2#Q4g{4X|8 k $!x N h3_Ȍ| $zi#zZs292UAidw. ;:K C4/3vQ\])t9PBc[D=ŷXƧ[6d#f}9뙏V?Y_{q1 ,ˁ9B!f▱b+ Y&Yo^))e{=R5bZrA+?- A2Vr *,siyv;-@V ipΗS#'jK<7d5q]8_$TfIӰ8{s~'HqU2]rop%Cߣ]s0|M9J, MncuCYRL0AX{ Il,R SFѾ\m)ΐZn)kT̏ fQ@u+5he7]>kĻ$ N#ws!#g9S8<]Cj~73A:m]I.""=gu=45?8d|&U d[+N݃s>dIs*5|†GT C;?k$.qR^*Q4??w}@L$]\ْg|?+j_O|ONe֘oQ\mW,03Kة?1Da%8@,C&< nRnta@BBw6sŶIѩ@*#"Dء-3+>%nsP$ +Kt=_x+][a{EId`m:{+/Um~ ΏT\d =̛Ń`q(8i`]lJt0bO)9,Qn Scr9M띎ҖAÍg f3%z.Cm[O,qP rҞ/CC[qU@kG}Nwd3Szjl;6{9Gێ;˹2 "ljd ͥv4puupnxG.Dx :N Cc[Yv`ЅuoQMঊtIjR['HԬdl!1_{Lj5]WYоSQ/l o%zRyXr^{PKmG2/w[JC3j`xKUxPE(a7ҜvaKU :ޏV5RP|H8.$97ob-gM)Q=.1e5m1Q$9V-1X9 lb IX7:+2v78hKbS~7ls!@Ӟ;wAfƸ碀VxZb.>a_Wa,6iyyT܍ &ػ_eKL)تHRH$q]dJtoTNJVs@N ۾|t2r0O@kOɥ4'V]GG X٥t)DbYdseN|S1A.swыVؓ?WD2@?>x{T21RlBcz?5yA*L8@a,)|ɼ|Ȉԕ9UP~/P~) {[^kM5L> @Tˬ*Iiiǃ5]UJSʌ7'D8D(ˊ~eCoSHK1?XM):\*uYzB3PK و /;{*ӹ>WUoѴ% zTxy(/ h շдxzr3P%NV8 O{ D'/=-EgBaUސ(ӪƓS qXmW'ZcغS ڮ~G1/ !B+o!kY/;kgj8OCH~#;7I")>&uCLzB !(,OqklCk1?7?m+Vls@B #m^]wTd5vZ`G^5| Q<wB650igK~<`e-ta(~"O]A3>)ng:]ˎfEDaKx0GqjpbYyfb ̱6`Yn0ɟ*Ef׬VcB6dzKoa )z ="D#CdqAe]X~?a ۿoCT 2bLSkNqQu/q e #d C2у>AIC ^,q?ZZLU Rsfߟ~2N4/T) FyfnJt ]kÿXgI_Yzs: t䘬8z|D Q ʜL}H([LclscW1bT';שn.y]ӭ '> /YD@BJׅ@A+̮:T&O0t>k5.ۼ鯸RCPF*~|ՆcMP1")ۄ:9r{|!ALȉGD_:ӄ 3yq<ˏS&Rܣo^ KϱQ[h79Y6F<{m({WE6-5C^p.D&VBI c ;r%&wnJ9%e(Vȿ=LgOq1u5*<`VNA, ߊYa&"nvhRoڇΝ=HYZ E%o[}Qv~  Hhnaykx{;/ Qmm],!0`\G q#L`R׫Ź  Cmaယ..IXrnrh><|/qEL&[_\J@@T[۩"pET0~e\|jzfׅbH{KӅp>κnSeԨ7s]ySv@+!OIB::q5BmlM׭k~H̖}ee Ʀ5hLA^x:8v~qC B 瘟ƓD%,`GsmW7 lQ%-.,D]pj@xDK ǔ3 L1h8΀)dK[rt˩w;puC"ףҧ Y7:-s]|#X($ "4n<ȸ˩-xuc>:<@]})CY[5- 3yQT<%6T5HS[^[PrFɰ^ 0]g:4_Π-`V.gJ3;a3ӁG 4EqPkO b|M{?)~ڷWdPtWoҔ0  ; 0vÂYFnC-3R[H&݅q*fXn 06V̳dK j)[ lc$X>7? ‚>r')b =򸟠2'+_[jyѲ-5G`<'"h@ L20N],/i=pZa/R,ዚqY9YEğ$ ?)鰾$P̺qx |`XdGK RPRV{;(̟8"޵El`xi&]n:$Lg6nQ1;'`{fUiB8m͡gWafu /$!ŠA*;LTw>5R)YyGFÁD8L"W姂%uHJmbA!ў’Gc?B%*(w,5CTcjs1pc(<0_a?Zz!wVb+Q*&axjM(jow=˙Ld%}-@dJ|A-/LD<~=8l /!\=n%4lJh%^h,I#G;E3YWw(1 y6gs$4zI(o<_ B\$Pt>1r D(tfGVja3dziB=bf,?@Ӂ#ea*SOcCP#:…^/Z 2-  \Vb&>tK Fh^ pNxB$ uDKYU yn1 ~r;Y ?nj'Og8= )c{ [mdm@DoyX|w&fgų|>b7zAIB5Ph Ռqd XєȶhNWL#r5,rŋmY[[0DRZ%J)%WV#T++u}8!7C x{ kLIΑCYzcJd?fl{Me #ŭC3R~FdvkAHzs\6\b`賻h u>r[c8JWg2 F`2VDަDtJ*y. ? f-Nlo19[<%C.!J6>jTVIԧQ,Vo\Pc&8)/$$4b X{BȬ5csy*(uݑ\,ox0=$ hO|b^JdCLr63LnND`E.TM<331)~ePtD1\yZ,-F՟3o'ːLN+)z0 N$,1ziǞޣIQ95un*UaK1RJztIF@hOpSDR?YW 1dk@^Qˈ`@ ܼ Wa^MO;c ԖN/ mGOY>=rݼ4Ww@\/g5镂9۵sOǦ8fժ2OYlH8Xƍ܇6`3 S૪e"Il?0sj3Ax_ xnzNm͎ӃN] ]dVpoz'>ur(tF RyVc.G6OYe[am2YنXmS1ۉmiڔFjAY6ʔچ hes5a#3]{.Mڭ2q^?'EvuXޅj1WI?d0z[ 4 KGc(byJ* $2I6pK㿊'QD m|bJ 3)M[Kk7B 5~1ROz (LհSEHe.?&!a=M&uf{*]x9(?Y{ZFcj ? ́on=+I 6z7+a>Z /~)~d-e"0gd) 8X=Ou,M9M2[Qo.`:fp\x2)_t IlA5; ހɺw?b]/P,UƢ؊ .H,7[!֩v=@.z\*Js H.DV\D*k Pkm|o|jr\ sD뭒'H5vP^-SC@ݹ94`tsoM8%2< 4IR f''Fva.͖i|0:(*ubIخIl-Ô;GͻHǬpI̎K^4CMk"$u- V2H6_e "ʜ*=t:~>D8Ɣ` uǪ1%][O Ӡ+Pdw&Jl8fC9mO}yN >K"E@ ,cR.s$v؀<-g62 O̍1,3C7`"5O6}rL"ziYE=̦N,0Tg~Aɓj p1e!!'lM姷śc;Q$)_t'\]C-J>ތ*xs@v1HހW \<_ ͓vn t2[\HrISDtJ-Z)\(uݲfRw}*(6S;<6eU[!yڟduZAqz[2u8akȡK_գ- d-e~_tXctŝ܃ :wl.K(5W*䬐VNPR}YP^88! 7g+"S1Fgߕ/<q\Q4>(d Е-%/sJ1V^Q2ph|E*2%s֬oS 0ԉl9i+H^(Y/!;=ـQovRǻ#o7p}eU;b98HaGcv;R`2X:u~z]Le/gX@ kiH&aW zN%X*pLS{3M9Kk SE) }@Xi}IzZN`]b_f.N׹VV\BZ|`Mn yu`6R6=lЙޣB!8;=ctS;W.8ˏ MkOh$!&5|#B1z< ~ضg9OR~TNVEu0ZRV( 0W7k,f&edzv8kN`վ,wnef_h*W^߮}y:]+A2N`0n56vS4W Aʤ?YuC%L{;=>\|4m'^iZqt<@߹#nfzcj"Gxy|sOܫTd]BdRH V˻{,#٪"T{(FԿTt뚾_3fV }u,D>amRb5 v|?T|'[I^1? 79pw*[)Ŀ$#m17+VgbbzQS6mB|ʙMpX Np'CȳAg—_,dRS#L M#]FgdL|nB*əhJ+Ǐ+Q*q#sC tj`,Z,ퟺf)c͹$/'AG/,>fp* FQ*6ޛg3,yw5{nH,LkF4rHr@YF0^Cg/2A@]VKYFQ,\sK _ڭX V_([Sduvv~B)]l7FsGltMev8eM3@WR|gC%yM[ܞa4Ӟ m[[&EPaM̟.餣"Ỵ~P{lR1JO+F "tM`" ""0*+bcY 'cy524˥ W6,tT5uԾOݟ{a- 7B]#,TcT7Jq,AG@x,&Ί׊uڗ*Ziݾ$7u,g<`9SD٨" fu7{}FYb2~p9Cpτg{οTVdL fwMq-Ѧ], Z+4%6л)@O@IxIP/Nɞr`Rp]$x~G1ߤ]VP N r]3WW@3|wavӆbHr Rы U)_E΋h}U)65 oI9鸛AfN2v&mqzQбuƒ̏J?%ρyE m]b Cu FXR#L9mV9!KH:EdόSTjQ0pQ=іrn}QO~Uf|9rdTM TrP=Pn 1P}k w bيؙ߼3?j+j??T=cLc>8\WQ(#APuw0Ci&. 1ȉhK36SJv|(;xh^$pjiṃ4B)#+!(9bD2L8G H gW.ן#l !Ֆ6(?ja#4~iu&Ӳ(QPP4%=ZmdC$ϔv^ZUT#:Zx'eC. ."S:0vCjЗ tvco5nUoR? j13.\vG܂ֱ6Նn ]NLjO.C^}:|Kx[Vj+]Н[GĂ- y2@ `o \/V :mdy=֝C7U.c> Q'ZZ`S1?jޣoR~91cՊ LUܷɜ7w4o!Yi~^E&h`whNQn飆c[ s8ZScpԥQ,yc#v ċ4K>*fJK/aHx|.(7w)?\P ;[yT[[Ā,kF&m1c)YJ 5ͥ<;zUVm(nDfzC'fv/6l4Keef%NCpߣY6畲e%Ci^̖\&#e>KQՃÔ؛D]GmI$5Z3Bj;}$reR6ԩ[Rh>;Ғ2]+΁p}*|,)aꉝLRgx\-(v*7[& `<$Zi6gkq6j!йE5 CmnExbeZMC eQ2zjGډNpG`ˣϏ'yO\r#)ёq6U@^*>֛h5O4 "6,`l3e-FNVTNKÇCz#f {8WuXFf$1z&#Q_5 k6|5ALKe84~v@(hn̡#!lzݣ}B&"3J 7 s0+)"5ar= wyȇM- #5"6:b/ARHBlNMƵ8(e2fܦ$A,j32MCK>=yav8oҶ/e \BOX~UM$M]őCZeycK2MC%CgI"{= ^H?3Cks3pQm Zz|ˈ6i4%瀑;ma PHFΙMQ/'*r)gfKYLxںmS!i.0U)Xx92M7kv G%[/8 IxV7w'}-B"5KE YSqx+&7K*{K Ϩ/&s *O>Y-ՕሖA,XaFyjNv'LPZ7?([X!=:=i *Y(ἢŦ2wklf|I,o1xjaK0ō4! jZʟN:g Qo-kj&zMZ^"|Uu#.D0==@İ'qlcnGTZ*CljFkSD%q&Lx褈,iS/(b 5ńQ| $W0-i3kX';Ef:'M|IƩp8_4?LFOx|^4GH$k. ˩.&B*+P@q=O1E7UL'W!ĥ,١"\ߘRr4}Mq;tjMʈT[X#3. 0%VSrT3*}*(<3Pc6P8IGޮE}u"Vl:=bx݅4'ӗ,M1\sKQsnYgs{dm֏͠ 2^,x1o|; !NVʕ> +!Fs6=O^7p4)jn^J&8FW6o%ۻ^X? ~PrvƦ1YEֻ-/ng I,Efs~P^U LV< a "X*\ؘ'>v ֺq`;Pt6Q( c.W B_<<47xh"[ɩp]f/Gqs}ʄx4=(ңwl٢V~_ gk5T`p$rMOiԺWxԟ Q%V1nzÂthqxJo#3A)=&PzNq!x3*!֒'.'0vn`$~(*P!x5V9o1SȝLj&d6?QpJ7wڛlQ_dv@&ڪ|M|nǔ[mۄ{ɑ.q85C ]J$U,M wwܑ8Xf @葹I@Pr!++7dy[v{HP\M.T(]'%YZ3ׯG>Hi'(pG+V{E0XQz$Z4:ӣiYfERoHY E1/ <3+%veu m vU ӂ]MGmEJJ8)e |R] @Db{Ao&oCJ^yy=XI6J՗M;2Df$gz6֓7cf&5VLnl) Ee10¥0A1h)TKD},Ng2YZT/#-)Դ8HC;&!#/dB aiռDƟ擳:Y9#PRłS`ѮTNjhߥfĂQMNOT#fFT/p3HtO{LzpA) |gwc4h6 k7~z̵S h>QAY˄qAJLjhZ䯬= e?\7[ڪx]x8Ԇ8kJ"a_NNƜH@;=K,Y;zk44#kL?z6TJVՈTw~G%iVJd_\̿]"+bU S.%Hckܥ|d|%bNaۨ72D&Hγ4f:+iֳ !DVǏ8?J%`_YdG0_6hI-!ۼ\}|g@wvi-Q;B1eR 0-kլ@Kk}2ZIbZf7'UrA(QEWr{ `NNBn &q~RVx?JJtu 62@o}tAwsA8T/ 10=E)v:w4&  -hj *D[@"c~lQX!IUh6fμFoyv6b%7Ygi*&[y+ω^p&Uv\hb VtǏzGj ct?it3zdS?IHfoyƋiL\NJE3Ϙ([ `f}@Si/Ke16V69u=W۩ZfКF: ")ЃcAì1A K}{fs-RSU{DBSx7ͦaobse+1̖k8 @ جM4m5 `w4%k\*f#Ź/p : 9BVlҵ1 g$NJq#p-Ȕ!bEe0ФU2udKa8Yc9WV~{a&@2+S ㉛j+@gވqFB7 F3;8ȷVH T^_{ e;dLNDPG^VԠg(yd7l7P8-LFfw X`w\_r[Oר{;xkkGX.%b3驠aS2i)h^hs(9Uw^R+{qbY Z_dn.Yj G&\p:¯rE)!,ʸخ2մxE"'D`HEԨK!0mm- tvΐ=6Sx HQPX~܍+S n83 Z;I@5k\&Xa2vJuH(_(|wJ7uD8!Ggz2üj0aWֱBl4T1Brw6۲Ya(bR=6Ĝ9 UΪwb; Y'هOwtX#N]r|j2 ft9[Ϥ_!C3O5jg=Ĩc̪upшz/{0R<8(ݿ;q5V#hw,r¤pR0Hl:<;NǂS&ܭpYs"E>}ŝ wpb>r+2Y -/,2B.Nf14 ;hT2i䗃ڇۤ JqǯTy_aDCo1?n-zdE/v # 6HbZ;@#Z8W'!wVg24k@PN' Y oxa"/6aVJJblw6A}>g"WzmN ۹&O sD8\V#_-`[|{ǷgAo"J(xpg3#`h;#jִ]CX N~_?ՠko|j߹+iHnA d3 {'$ zd7'Bz*`~?#'::{V֝e( TIN6P&#|+zG0,Drl#njQ9H)Fs_#B}\o|/@ \F^mhV8(;x(3!w1 ot]}#[I^;i`q :W4Nv%5Ki(u#7p)BKdiL^i U4esG Yp E);/Ws[9 x'FǯU;6X Xw@J) Ml|7qMq-;l!GkWtCæ-VD[ g<1!˺ Gxܡ· {9Յ#뉉;"s=&8,PJA[e*ƄfuP믾ꈹA_o' -AYƯ 'G4/R2֐phfG.ةfҚV>-+ u躥w"Uoo<>|yAfec$x]1KN0)aC_G<"Iq8l~TXURr[ׇa?֣Ax\5> KY:yl=O_]ںx[%V3ܗΚr &ЕXۼPC::RP]EۡnUi1AsesD⪟v? ^iQ0,y/)|G#4cұ$(TMQgVJ&ℍwcd L^׳;17na>/F%4y ݫ+w_g`3!( =L4S.F]-ehu8 =rI{Wyd3JdsãО.{0@n]@GJEqX`~V%(\=SωLNyߏwA Ģ@+A%D/]2.DFg<(i*/W;Sv6$,zSI*vb}wu{egV)R`=ܠضBA(Vz5K;A/$zl~)$9cW\; bX=2qQlRQK nF0gG%H\qv)W/sO{͞ ݑεe'p't'$@刚S^֚LHX, S{iS}OxS8tsZ'<_y~/^G1tp/v?s'ꮴ\dՒftWqr.jiWǒ%7[ltq#ɾ]|]?Q1|Hh&X.mF{7S>屛 GUar>nod# _0<&EW WBSrALٔ83~B`g3ψ^I嵶r]E;v!OƁ“a\Al;[PE=^| 9Y@´Q&˴5N,&k xi<`7 ƗB-TOn)P|#YB7qh.}InwVkq>}Q'4Q &hzFb^L; vXkv =jWuC d!=z]u]8Bud9ִzd%兯麍8co`t/WQ;NAM_8Z@W ی6Rg(zBE} D^C#u}, KAߗZ(vTc̦RpdUdvL1ב''n$1ːY\_f);q=ʓ  J=&mMt 6lk#;~D;״1 bxO+Zd7~B(.vaGtxv8\aw~6CF+l-P<^zxugI(v Uu%jelQ)s|RgdmpE~W7mNx] AפPO]]ϰHNt9lBaLX6]C̊(IHzj98@NI| M?ϛu]{lrUusI3B;~.<.OʳU+M{tF32iU:<7uTN.5սt[.\)oz gS0D`@=/(k ؔՎ˛X 4I,;[`fl<[0X”ޕ`Li ou ҍ"H %U/BgTBG?{pu0}-t\ ;ʂuSُedFy=)rnsibĤ*44LI͛TVl[ :@H+RJ'DM7}/itk.X4y-ƪ:uik E@U܀ @rOٞ7t d9SfH#m,q40hM+yu#W,ok6ُIUd~+J~[BU4 8N'zSb>AZeoTskZeaeZGd ɅOIlYµ!UsO({zH@t9M2R&#'~Yp#JfW (*72 Œ Z&JO+ˬI&r,W ADz ,a3nԅȗe~Nૹ%_3M*\f?TYzbt{CueFծQ3UU546% ŷ/OQa/ y);zR{%Qpynz:=p,#?=ZjҲM)S~c8?7 \PcM' GH gk״/r&_^ 2'&?FGp4dm'۾ML af+BUtVaBSVU^۶z]Lx{!a JBHT^X0U\eh֠{q@#؀Du}fbUpSO>b^/._R᥼iBuP y&4P3W}8AĠEj2qFsKe"WLY7f s;ޖ\-:,kOz(]$u̍[ tXVo]bLዼд!]?>y@^g6c)mY'|uǧ 7P| n\l1 <zP(YWG"YT&˱]o6Wz,E rG,W4I7:UmQ a7b,MiLU>hWO܉y*YW9{gt1|&2yΫ[Ъ՛H+jLom FmMa80uVPC>J{j(^D# ʺYV6B$(e13)e*/m'A#[^z2?/jLQiMZ `#9'Ϭ(MCa/VCB3|KMW)Zh*3v0-uRs y&GNy?4qn1q db\Y]7!փ>@Ȑ7*-OiQd4a-O+&֙,_z;W0g^- "=ݽ+ *C쒺5RjZ-V_!lY-/U 帋b,1YdCu>JcWFɱ.->ku'S.d p:KDKN9Q%.wE0O>ūl$- k?: bhS%㢺uRό"{Uݔag9e j~-l랙)q jmDlyiףZ 5u6HHa [@Hq}ŜiSzPﰰQ<4_I\M, w\jHb }=0|@D^Xy`O1g{!h\hbO 91G&dF}6n+fy;<rLٖgfSMC8H VYUWχMQ7zU\Tþ*W} \ J8w=: DM?3y`tb 5u0l(o2%|ثcr61]U+QD=Go!~YWօ1DC6%ϙ[rE:e'\9Q\IpALy+-wFi98T3@>BK7,AΉ*@/dRt!;؃]GYs1MK!οx2T"<`HJh*H^Nohcd'?:4u0? ]V_KnZw9 $)/ħ>qsܵkO2D_l-X+§rc[[yL欖pK:"'__Z's?E46{Y _O* qWpf!EC$wP=4^ gяixˬr{,uSl3@J<E[IM}U)?"W7gzR5l1I @@iGG4]dii`VxM$$?v (SCE;Hܭ}MWbq8BWy7) K&&T(>O3G0 z.tak@>?,q<pM&W0+e|zcP/\$fՌ]m58mëB9e4cGJ=_tԡ <МN8S2]+LbULo[S겓Foa%f;o \&8c'kpx*h&Jn}WzѾLԄfÊ!WA,E wom;@W5,9򂧜=)rroS[ D]XB9!kh̋*3"TSFΊyaܡe6 Hy_$-lAr>1_[lXj  'i[߽|}ѭ즂+"g[.ۢaAvȐ,R@+$5V*!1U9B_ ISCNHKFaa-$ xy~(rߍ"ehЂ?:EU+DAg` ߎZkIacUՌ;-<U@MToǛ<#פFy"Ʒ0t]$}w!8z6&%;IZD0)L!lvGZzY/`pW\beG:p#:3'12ӳ]NV疹 !óSIᑇ.S]ɼ6I3S^XP*\^svE4ҿPFO<{-7/%GAab]AyǤɖM Pm^BrOG yvqX(ro`f|0#8ʦ`^}aziM/uk'{{ WG}jf~zڿYq-(~ˍ9WAc*8["KWjIiC2ouz#98|+5cZS:3 :o-;t&nV XtsGަ–?|˺%)S7 N47*7ZT\U@,sWdW7Ri1v,[xUgR6<+i,X$ |A޳$̓&XGȡaB9 }Rc!˯<D)O& .3X4!{۲% 3Kw 891 {VUՖU>hvҙ/3;pW+$ZKkeHJ(UW X99 n`B%kdKaf?5\: H-A II)6Ldq<QR#NT*YW_4?( 9+"+vMȡ倷i/$ywt f;f Gi o bWP=֙!)y/2DZk9,ʭ؈-Wv@hz1_&/zҵYqfD0'* z #ѩSR]ֆDy'V]<:=CavR` C#,9QG= %ה]Z\2x`W 5_'18ϹJYR(.e[>Wؑ כƗN!K^$ Gm3͢KL_=cr򄲶U> qJmu.QD"wz@wz:~!b4!ؘ_ujکbq7&[qpL_h7d)-[;V7 9 /0Uٶ('b I,*[H+uufs)s/Gy(Je|:1cȱ|OeJjSk\<*sKQf1Kp^7fiù` 8[HWO&DŽD9$W 2JD4^ >_Wq '}i:"I6h)Tx񼭄 3/53M(";xo0G*,Mfx,2|s+>Oj~uOwwk1$Sgx0qЅz|ytd¢ɵ锳᷷#Yl{HL0ӛM%f'B>q;~rdp==6`/dx+~jtB;D8*>7c]ˀiƿ_ Zud.oy>F)xO;YCHxY4!&RVx3LH&B¡b xKu3آQ\{&0ABoNJn!_GRGervi 7Z`bќ+Z-JTbդd$} s[F)l455wJ4F0)E~f9aKh pV%4Uc?_`,]yH]=c4E~Yva->Fؾ7jv^6L 1. J07ca#GD<ˠzy1aSdm1o_#fj\aX'_*FKf[*MڂY9B^|5gΣG' ^1IXowb' OFĤ5+rc>v76r~1!  7WDY9E2p$f-{X/ɓ%|DZםP#+vPOQ}MĚ(O>_4CST>(+PB [_LmY,B|WAꕅO!\I9Q^\x&I_j:~ۯvLo)ck9Y7[,3ɑq׀1n# +z3&4_"<\I.X󣙯 wB4;$̶aQ!30xo\KfpȚ/v ~\5P|?ue]g5@tކ1HG,0{9y6ȇ[efܡci2I| XRHG=OiDE?V5=@Ox@sW)H<˽w't^nX5'\ @ ٵF3<@?I:W-^s@򴎈4Sb~+^uFpAzu 0cB@ $I6;)& lj3H " ;"'V og}bC{ߢl\}tK0k&ZbliK0lY.`{0r!4Ud6 {kl0Էv(F,}!"ke::(Nout-FJ4J_2oQ_ŭ +2l<ĎRBtd4,̩rG嵜I'N@],T_RWْϕrz.5PJ'>N=R- (vP yw1.e7RDNfZ1]0' -3zP-Ԝ˞ Y~a:D-# z &lX@ W OU}Eb:V|w_ Q{|f;!RSuq1~|X"xx!SD5;K| n!uP>M"{|:XE1=Z67+ xwVȟB{^Mh[e\z2Dk<`@Lרp5o* eȾsbƪnn jkù+R[bOH`,ֈLȐ?jSC+|s33}r:ZW4"6 L]#Z_<q^PgdިAבLߤHT^[`)P1,]m\^+tb;%;jzh#7u>FN}BQ|/Ht5h=;FYb">v: IuE,AκVD4ƍ5Qy'hIWCzw `\jzTd)+ݖ ;;b e0:^9Yz1y\!kz(JK,zkCFAB22wGfd|>غo.}F:NWB٭4"aK7 b$)uKZyT3NE;-toxۆĒ.I95YC-s%(H\Av>B4*.-L v`mK69>t6Ak"yCi|hrN73:1 J,^=ݟPk\1 T~>mØw^pEW!: ԄFy̶%`;?Tp,sIA-hND.lҲ+d'ЗїIp᯶Bo05`wjm [jD'B r{kO ;xg+S"`"V(6\`B:Sy^ǁ+ūf))4SXmodKS|D)=dsܥy==3apJ p9y!q$'3+cYfOboԼ }rl]XnLl]ivk);讬`="fQР?b)+I-W hq~{ҢQ I_f7*;|&wIƜ:@\ \m:QO.*0-wxKMA8wFyƆ5yaF^rinip5>>؋k[K*yؑ97}LXR8v~WRYpxCcm]S]47 m񊞻0](N |_s"\V[ 'giG.s`P<@FHv9vѱL#%=,,1E.Gحwwuc#5#٩B4qdi {زMeoBʣy*!S|mRuSfqhK|sz\BI,u1cTp2 k\+e4/D'z95Zܲ!HOϰ-.Sp_E w6-KJ&'6t6Ѩ.PZTuJ֎څ Sl\q鵚?BiQʞs`<"ȋ'޴~q3_nqw9U?b<rHH|&7SBML\$C#LJ7{= 7X"%{q˘Do2fy݄wHN:pֆyШaTRLiNC^SXeNᮟfʗu/Y*n 1]X{ˬZ==>ʼ1٦XVk@%&lT-Q˜C !XZ'"]џtS m;DYq5nH\>Ӊyk- HԮfJpH1rLֽnKo܉Բ B; !k\泀uyoWb4]]|8  ǍR]bΏwno8›}b3\RTxz,uD@ XQXڲyꌘXNP>wT"#bf*&h ;z0-J4LX_-.хJqJβe{I!!|ℱhw F ,p Qw{%!k*q)HGVoAa'r>yhZQtP5>IǨVXWF^\Bp'%6.<"<[VLQӘc `*Y>;p# ɔ.+~Ēe # ο!#Qi( 8~*V4 !q!K3~z8t&c5+Ak=eWp {0k Z 1|amL>ҡaϗԘiqELSN"mny)ː&!/|uץɒT\WBRxȷ'nU)m4! ^RA1=Fڝ7[fwncvz{WK\!vٚ4@u @Wt/Y1n&AW/k۫*UA7cyu}zaϫϵDLKRmOl,w+aq>ZP.apEnW:yj-q=؁6,O5wIptǡ Wq Q~|.^ o[V3^5辮(gZ28u\{ <)jLnnTΰ*hU|lL 拨I0h {?;kW pޣb|샶51r&Гǭ6[S[˛ W+{BhotօCpJM0x.8lyl5e^%"Dj5oz _ū-Vf=3=O1K:'Dv%]r0 n>O)t1(2 !7U1jbA.] "7 pQtZL [HSw=IoK&XZU.;b+SIQ:Nw+svKM#È|~uK^\E 2#ϺRK_<ЈeR51;m@DBl7lQ`9_L6pS6 !fIqD{6L%u/p^< s-}L,4`$%hw~w+ZdL/k<֛tv8K\QQtxKESVqʽw!>= $ Aoީ5{+i`j~\ty9JSbX@G-%pTrenh̬<5{߫\o̖8s} f b|Lzꘀ5?I)44]Xqg:F;EC0;NJYF-p*wō&=9eq.M]&?̮M)W`oz). 1aUQB6}5t}GaCG-qTs)Y\:f{uUs`~O$6N}S?.n1Xu[ G(8=ňUPLdi{_neHu'WMe vZVSunc>{ 0^PW(0 zvu~D~mu~8$CtAY|q9Z,p?XNyˆ0) o/Qz.« v+|λJ+n;<HbLDS$IuJj\U&ekgS 'Yv !;aT/TP *ĒF ϝԍJB3QXX%<ܓ [qP=3v :ȓ:s6鿑N/94&8h YpQҷ7jvni);;/\Dv-3e8z `DV6Q{YS@$g1+yRmӆ8D "c.-1LRFQG'22 GI9Ĕ5(Knmbvo[4Q;Z%#ϞQܼ>U' "Ւ !3!)( :tᡇuW\`p/=vzH@~Xxl+KK`'"MI&1hν;%n-~dֵk%q>Lޅ()x .Y\ِ0NFsI+j1&r _F4٩h05$:IǻR;ܠ17HOuk&J?bEJIDf4 |l4Lj8+ӽ2/Ś1]3 ݌(,@0zzp=!9Cƽt} >{t4 צQ.D !/%mSI#~ZD~Fof)1Rl1~iz8%,˱,mDKbݥvc7v6disg1uJ` }c3Ezu, AܨHHG! `ۻ}?!$Q1䖈9A[FocBQz 5yl|ǴIǮ?Z ݋\4 b2jָ o\[i8<f8 .>6;UۈD:N]C'! ?n-PDKi:yG/u8Eʺ6*r6y! K'ZIqBl U٪0v[JV/WJ8?8K@WMXNFAUCsr]J( \b}v1V5W8$w̸!V>Gi~6C9?n`(VyiFvSg߸ Rܝ~k5vd5IUײcW҄P`+ږ^<5t w'n0'4k S}#M/\82CSD1ME. 䗁l)G&䠻e(o<-솼П֍gBP(5@PZM+qk-1#SvkM;墑  u{C̸&U>h3p&wL.mz`r6n$^\}5vnߩc~rcAJ;bexFocg$?ZOY12bR + fի]ݸEa+4K(ﺧ}^/.$<-6fpq-Rb2q i%0£(xP"] _RkO]ѷ~ZezÌ-hTl[$/F+1M4wTԗf@#Jg0\NYo0yT."Gv]Y6Bi>D$G/Y瞚D1@))%h:XD5.Z qTu*r1Fz *7$ƨuy]ٌƠbKw#uQ a5Tiey/=EߊHrބp%.ղ1닇b@w; Ol H8'&<#ud "ٗBakir$z DY>h5Xk '>pľ&>&f>v18#pJ,~XW#Sb CjfeN$%'k@Oa<nɮQ211b W3_$F*--_K BT][-#8ONx9USs&%E8`)pu6]e;&z/5$`sH{A" fNU 10 M!jDQ@棧lQ;k66/ e/ e2f' tv*k²U nVZ oBVj?@?L<Fؗ.<`]p/w )E+(MЧ'EB= 7E6##NyD,Oڹ3"ƓZ %1#PL`3 M0Md۾͍dSfKwZ9ʭi[L(}[ Q\(kĸZCg-rW ut1EB-{uw4>W]\$~7p9m㈻G4M"{myźȱWѪ=}va VG[qD=va@x!1)P:LWW="]ē/Z}i*|{kşS`r$*a]+>JcHhDjskZHݸU_@IPVz-)D8ČQ\ιN&q2k͘@f0޻smuX0-Ajdil٭Ky cr֞2O9vo)KkjD]fUަmRY[ zݹ F-{zYkwWksΈ2Aa!(SFs᰷;Yd@9r,lN1_Q$ʮ#wsU+EW1bq4 UEUu3fkHגuiM74٤ BÂL?; O}@P,lpОP.eC*ZM=-M* zm32tS ]8\'zWvB0%2l_5yz({L!Z3/hg+D?QsiNAnenz0^ėݿ CyJ4y%=#_6pӖFw'JnpMv,Ua:%2}g~osxBG4A7IO NGgG#=6gGC`g0ۚC3Bh$B}}#9Ŕ݄xs.Q u`AIKdrv*bUii %E՜4Pn 093QP !7[$i|YYr⟩{HO(b~N7n5yQƃ̆lp9ƩQqN2(3Qa^LBn^K#^~884_25U@y3xAiʷFtu yY6/RUHAOxΣ}>l4#Fy%nh'/)T "O.#yk`3)+`1=[cK#d+}rɪ/q``'H@.˖gX'Ao4`7ڵ#u_iHMC=-XAʲ{ ΓU^3wN~ Vgb<LSo^-!h,9x\Z%J'bY^L5kUa52P|sj߶z醕'ps4iZICRG|, E|.( #z&DCȸ6C={s1e ݤx6&ſ+ L1${LG=زVTJL5&d I p>=XBE3/uRí/e`OR4ajaEs:nc({BnhdUK&bL`rPXE{1z-nw`hoBQD(R&:}nag5J>R~+⹭A4>FW^I#zOϸbKmm.`Y*JTS Ay!9U{ ĐH/ Weh$G:>X6@賞Hu3}'үz`TH/x}>O|248zۄ7$\AAGZ8~\ XsS<&xdmU3e -^p'a@u)JPz J1.㶵Pf:@"h0{d2N[Y<,H Ӡ=ANjw!ϷLHdX1Cp,ŢB\Lx6$3gi#gq+;G?W]6Qr:G BՎL35ҟfK+4HH^pDZ ;zegA3:Jb~YrTDT `ȐY*Y.w'0_L2YhQq[Bvi:ǚ6r *& X)t$RpVh QYp]ܙ_?B2[|*Rt/dB]& s- %p¨ɏ~Ic:qrP/u5rHuA>,Zjs&O/[?mWe7H?Z y¥Hkqte>h@E_ᾲxs$8YH;uh eaw]$#??o34q^P0LsG"CX%Tp@Q0StO{ZiSmhpPSQ5m'3H0Bg3 Gۮ=phS9HsƩ`ZAmKDr߂*-JBb(<˯\.DDT  -;4f;2+,eS#׳.c MBQ!P-7q,OX!8=⻷nltѤ<#?U$b:-#Ꝟ eɑZLF fFˇfSQ;χN]%gԉE!I, rWꖤZ ^ խQßn /]M|1Kx64)T)ssH{ IGk.)Ƅ}D\; aLsa)Dϝ c|(ŧA6<X:XѡL0}^9iV OitC׊d&F?lݠ2]R -W>xmq$_`TRFMV(kό [61ֻL5b]ەf~HXc9Ŕl.?q(3ޭn zZM<Fl4Hx3 ˚Tq}̀C'ڈGp@=}V_ UtS+bLHAMS4VHCIbWHjA\e\; Cm]ؾw1Q;? 5S 5>?9⣥<JtI<=@j9>Y^ә4qُxrAm[gkxwwMLRt˭?U S\h Y"4j(@h';{"]Kݚ#ELቡ3s?wU p*t"X,9bI#,6!^sBEgg-[r$+ՄEu3`$+gTaL#jꇌr/ @`ҞAzs|Dq#^oeT,B2!Iٔo Nw iYBV$M~Z;w6 exVh֢SnNE?sҒi'k1>RO F)!`tf!90oxDŽy⅋d2% 20r`I<'U(P&Lc냎kc<9vTU[!8`jPSB/or$>v]|6KmRng2znuIYD3ƀ 8q qa`t+eKsF p>bYh2E Rw$p=KQ@N TONgo6ɖ%Ҡښ^.{k,R+6W1C~jrAoIx4jOLa/8~ 4i2G?(9^=}ŒT(\oρoU90A>;{O&Odw8 Gw~jUPd*[|cS9̈3TX>#&p& 4>+'xv I xH hP:Ը,7.X :)e<X8E:KIUV~Nj7<_#xe<qfAj&6p#ELB{g4FJmYy^{Mu{"9ouF{|u3f詬;8z@"QCc7|ءg&C1 m<«Ek6@-uP a/}UB+҇(bMRl͓H3'ȍUiA%iZPT Zq6$O0X7y 98o -^5/b@!8ƴMKj@!("%`fPitJÜb*֟ ]Q]L͘ [-!Cǻ(Rظ9&^ ^H{SeyP/.<䨲 [e2]fG tط4x, O/Pl뜊\Y1Ca*lG& * (UsB `)qw tI`.a5U~qO7?T3#Af86LOgVA("rQf/Dhvhb Sa SR$f^ĚA]l*ya)]eî•UT; ^Jo@1,Æ)2;L$ӑKnu:]76pXY=Yb7Vq2r0fͲj۶T"D^ۇmn?Xac2Їk"P U,Xbׯ[whi$ѻ1֎Y<,Q]n#[x>(ico_#!˒F@DΥwTG$'D fjaxcWz$\6Y!0)|\C@'d!yQ"BxN:iI(L8͆zt3/[6~R{8IBzg<ςO~hnSCs?!_Ǔ,_K+";1\Z 5Q366?+VbMJ=48rʴ;9sIٺ2pmRuXm*貖ÙX=zCd+tmqo:W4A[w;忎g*c>q\z8<1o.jc )χŗCbލ,_\eN `ZtB_[P:`\)]=GyXW阹ωRgw-X,sm䴄;ELgOk, 7WOþ*ҳKQQiX42n}d@Ѯ;>~2)p*\c Pj_J,zW&⸲p#U9%bZ!R']OM \Qsffmu6!RTq3LڼT xxq%xA tvsGc*W兪DgvWP4tɝVU[ASiB\劂b#p+z*gy\'`}">d ~Gy7Dym+ \*l85+g*ZZaHp$#b%)1:7CΏ2$Wff$O7~3NŸ-,#g{hjWߦza`<jWhS*̷4gBU2Flh@f}VbЁ7Rw~uea>}ִ@O;$0Pl__9LMzT(JR(f $iR$ٯ$$ ~n*{w-wnftn `Y(TI;5u[Ŵ >Ox1QA1\]҆VDl%zzVWItq RU7ݠCҫdooaչƫۆD_av?̊T7zpPg&ѠHa#D8v)W4w?1fKYPT }GIlf 4rFT!8zyß,l,F%?Qjl.\6՝Zv)cX.bF۶r0_*QoC 5-PٖW4 dݫpg+F1iYpaCޖ֫} H{4S *צhRg(U }例yU$FC =/p9S\(hJ-ٔ3YZ۲ם% )n|{Oc9)”`+?GT5C;\ۦn+FњC~ ڼ` *K wSy-^g^DM"3PPNNz'a! 85 p/8.*6%^d1):t-7n*Y0 vF7l9q2gQ-PQʒlG!v:7 LUntA`Yu=&_7)p "`XƋ;1<䨂[Jas/ޗUx<R0{_r!^1ck9YamûP:0A6"I;)>9O&mC^Jd-PLAoC57|x`}68|'JXxP ~32ea ĿMIv;m:.}<4@Mĥ鮦>ߛg+xHTpF΄ɘNhJL}]܌I3yDDˆUao؝Qs,$L5Ix9əh[*&6ђA`[՝JȎ! 3{yd|[#7^DӌM32SV*\/`V@,}n6cRfK1BJB̮pJtGKBG]~Ugs(]Kտm_%6d Y %x+;WӌD:C.^KkJN"o5}망k`y{tjPԼ}N[5Vn渽7zxhP?˸ f6i?F&1IF̬:*S<*JT0rp{1:McB/K0DIŨ{)->K0I{`Txg/inQN|. W9Sxre #P3a;9ʦۺH78F\dq:1q fjPZ־sIIiRL{:j׼JfTӺ i@y,2WxoWeV:&`̸0| Da7$7CƼ.5{aXߔ8]?z7ۊWj_d_]v&Fڦe(vY"EؑI\u6:8Athl7! o( 8a0)q_}@= &X)[++k)>yȢd]d Ǟu^og9-J=WP-,*}O_8=*[DKŒOW@^P3"/HcC!1|ͅlvװimf\GȬ+lӭo6ak 3AH2$f%(*ڂ$ӯTے!xU7 < 4|'绣hh8s}@c WE8;7;OH k.s}T$&e^rTB mNr~!o·e 5|Kxei:^ ,"ERL:*3qÀ՜OC$6qs8W"HxF9pv0ݹGstYW҉ag,KڎɞT^A]JUR|6Sk>VHGk9xn(Sp*Ƥޡtr4գV!3`#"KжK~iF ĭ$ބA|&)rjG: I2S,:]](|U\v,-̞Z;O4oAhmK %;b%A9'PlH)uqKF$= Y/ԍAmDf _ D˵HR  poD1WMvަ#ZwY.2;iy\\%#IؾERy|tЮwpfg yS3n]-{+-jdG"l '8mm'FTAE_Ә3t']Ƹ7$EIXa 7E"zZe+"F"_PpU^c83};4#%iHh7 jￜ+%[ŗUcȋ~// Ɇ 囌0NFq:h}U&qq Ò!aiCs 5U D/?W5&1lNkD:~hQJA0{vC7&34PS1H|qu@A!EXvF7ȼ[hJf%wrj|@1q.qsoNpk? u'4`3 ֿB"@3cub>qDP?O5;jB@m6\?sC8l$LG=];2FBX*oLQτ_j0L31vvA4Г.gREޡ#Mj@1P%$#k+0WMNcGvt@vKqf7 3JO"Tԧ*N&@ YS \_wDM,wph]{чi:G'N{c)M&_1EVqI 4>x+32T@ϳ<+mn1^+cmbZ]3LyɆ6{锶F) K|#"xF( ?.Ԛze`8*RvdZ\#!T4cE1"Rp )GS5KFFZ2x !Pn^jJ1f:Q\b?Cpy=ma؛ͷdN49&|@(M&JlLI'B]!m =LCzL/bM9U!lPJ2˵fSde̓R{{ob"cH@/#5(=AҴ ϊuѼ ʺB \dˡ_g"7$TOvoiC]N80n~ԁJ*mwN!6Sz 2gEsތˠsÄ&ssP3h|VdEȝƈwԽMPSޟ=:Dj8!k bqE!*PPVXխY5By!)̬M%vlQ;ڎ紡f#T7H LQ뷙]yd9z1R`^-'X]~'CaSjtCYXӏC]q G dlz h29.8DheY}8/ڸl+V2>g\brC;/::N 9gզ6]o(E1t91b,[xGBI؃cnݣGKӗW! <VL\e<6jэO Dx939cwM9:Fa_mQ'a!(" N@W,m\5N{|^{ \j<ModkM˨U64һy͂q& yN(5oD+/ߔ"ĽOhWE۷-x hyl_#t;g5SN-)'h0xid:r7 J6Ne }\{x>u O4J)֭ɜ+j POߎJSco8|2(?mɵ^&.ATu0fl-^yP wV T{@|)0UD%u(le uL{s{n΅heL~3P }G$KpHJM(=k*  B"BBz8#?TE"r;Somۜ E5٬1P儷 _rjR}=̓L2YλK{ mncwa-m8NMt2Gmh1"ik;V/ PRNg/1 j7qO(iY-WG,,odǸ/Kro`"׉g៶"N׾ T9: ?X.GB&":AO\ƬEY֪L\Lb{ 7:( Ӟi4T~I3u]2-r~4d_%Sē;$sFUeJPMI3f,u#Aѥ $A 5-,PZc ߙQE>dJR4Єi&;ӳ`Wu(+o=8Qޤkn?ѦdG~]Nӑ~X7ˤnәE˝W/WW "_R%3Lbx 5|BP p*D{HUʖ`[շk\'"Igk>qBXd͢u$`YIз9w嬣mL0t^TF2=ҕv?8yZ{5f?Q9&]4롥,2D [f MVlf0ug5@3IջteHUw4$;5K G47IIHl7ߘخSD;QY *Q^@(Kh '57}QM8 bܶwc?%hO3WBvPبK!%(ijMۘHWw)G׷3be'?0ΓXEHLU0HPm>֎Z<~qhx@޻~]n1^^[pH@e-0N3kK^>d C$ \ .L51?vxm Z0h{ . "Zb"> @0JOѾl$3_wLIlLu;F^S lqbü˟4*+鰥b[x$ebN?ВL`^=)Z?)*=>YSgQ#8%f/Ij(ÿt/Wta)C yO \J` `nD$]a!s@ZT rV0Ck^' ;]V{o$֧x`Tx%PVE0m- X׭frAӲpR;bxei*0C:hj'8bȶˡ}R%7SIYSޒcVsDPkJ)Ke:p>.lG'g&yW཭'@7359W!2X]A]Wqh+ `5Jn^DgVʾkW-*3S H۽M_!tRZ dW}m|fD~ ApIjZ[u _Wsjt(KUb2/KQX$tٲDfI8S8eSDygw6,0k0%,\CPHj_`֠9R)~ICyRB=ݻ %Y~9Bh1/ұQGYH g~NH+lN)>0vX{u  (}OpїAPSӅt+*-#¡+G D5=p2d .5jK[3X]! /ePUԖu \*P=Y,42SI8nΊr'Gq"+3+ܔvCDkʟY=o5 G{opJw%n궠g1=yDYrLJ5O &t:l \nv6Y aVc$о&1çrA ct0Γ|vPLΜRKcaP6\q!ڇq.`c%,bC -fgHm:QI5biϣF@@fz8Ι6IG"z10ݝ`&#qheaxA7h>#AdÉ<\3YFJ@O|^}^Xpf%gyPٱ%mu92_7\eW7Ld-*νI+2@61.ϟc}qRYk<6={?Xw_L{jqꇲI,f 9%J0AҫQƴ C}Kb?f8>aUܛDc[t#Ï;o-bLKqhfKP:oj\:9'+_ g$M(`>jHVڎ[0 ePqV)uUa "y{ŲfW#PxB+0Fh^䵫8GK?`1M,,e;~WW݅3IBqʴk2YwcKg(fS% ^ uY@DnKܚ1VG6 -MT|S@gmqDeV־0v:f~qzvT(9ĉQY} tm ?]a7]j'u^71BtZ5 [ _⊒x](a#]{xmCPuS80E'}I\CgAf+ͤq1nrAߐ܀8~GkYjB 瘐yX9ectC*?y߬[&%=RBn(2w`h*hؚ?|A^ ٜ+mZ|QF3k=C|A^S =v}I?.7f2ýI:_7BOϖPIϩ. [ Us~l)KP0adזZ?$=߀Sh00Tzy[5>FlYTəNX_ 0ވMXFԓ@s;K@fv`>,=D$Ǒe)s!OͨT/Vv09eqTQSm;\T(/z]Fؗ VU9kh\9Tm]̑$9mgU?vzUӼA8F=GguMF6ۻJ$'AqELwv_MI>գdf@Nk+A}FdWÓ<% vM/׽ipo&d`Hu  vCMwriY!m5'T(I̍.|q4 8,_rGJ7MVbѲZTbE W}^&-i 5Ak>@Ss ׼md2 Ҟu}Ѡ/J!Vڢ$v.mlPI0jTh6 H_:egO39!j|th>?7ͩ`Ev9 hQHj. NOϠE`ja@ZD.DIoPۺۆ̮G hvϞfZM L$2sϻjXjl: wk&(D؉-XYnݣ嵔U։@{˾z>n[k$ho7O5RsɅ@aNQ ^XI!I2K/((ToGa_b)2He,Tg;~MM[@{[5 gmE%1q[V$ _ʣ h0͍RM$L" y[FpΟg_-,>!/J96q %K .Zw">ёۀxI@ !vD]0"|];hR15"Le3Rɳ`W3?clS͜^p<])DUԁ-$ C HyrUy[KUׁߊWKS[':ćAm)Kb&;i['jf$*) LBT\ M H`?mk1zdh%yWV,O$ַt! 5[9\nKrʟYyFnZ;Wp $tǷAa-Rˬm-but17qZ`@DuAѠ-e"G&$t͖{ \Xys!Kn=dC*rV<巤$l!K@ t `~D'ZX$U|Ex\c]ޗ<0dN"4SI5㩘1_$2 +P$fC:JHxEBAbjW{u՟zܺ'cyDE#gC4hH窆(abٍ8規TYd9|ncV)ѻ0ş9u+)['R CLl[­s.Vvq1P[rh&t^n\jЊ^=5+cBU}ְ=./RG:eQ!$l$ǾR#K%D 㺥@';&P.q}1 ߼q*rDmL]61DT->vY Zۼ@m[M)F$H?ϓ{ 喣Α8';jZN` D,X ]$u `%j L*BJRXz+^Y+DT\{NΖep~TYr ET Hy dž77 61b%%KXtN]OG;,3Z)[;kK#ԈW+ƬGIǠi<4]%R=m|y^`%4F:)ڹzaT5du{騜L8?}u;`9\yV\!qgI`|IWrm^@ℂ5"1۸"iQ sTlg`&u25~NU?RǞc1L`dm .zNiǟ{ZDlqʹx{]^K1 'a,,DU ԬZ iiCИH!l<-9ItIEww2MT[ r3<\%,hxri*@:I-p$>qu $I"׮K$E,r7 V-Q*\o3VʥE&xH!tuF#gtn>?<d{ށ!Eum&Eƅ4:վim[!t9f3] 7,rj^հMZY\.4cyhԗ[BZA=FId y1HX ^Sұ "PFlSqр1MJfYܯ*4=l78B~ɝuk{b@/(9*)ڥD%Vڼy#XolXˠ۷JNU|Q;+rl*GB=^̦= J|Z:hN)}G%׈4d2z:o гj8~g뫜3GT9cf[Dd=0ZUcqJ-vaxUÑp^MbwjA4ꖶ+Y6Qwuѽ/Deu{@`zJ8\fH`3Sټ Xf,"+dߏ0^G!#jko'i!^1eI']< kz1qx c =Cx2 e$u?q֚z@2vÅ4*Du1pԪGQQgĿBqhXIFX 4y^/^MR/7L^GUos,mk:Hv?+1pؙi,-d˧E9praų9멸&!Fa=kMX@+D m=GD =#^Bε21ߓG(=Dey0m|AQ3ٴ,6j+06"e<0vpU)`Cj|Tdo}\\U\s!u/:C=1FV=[݈0?, ,~A%~o ˫ޮɥ>ΠuC4\NR?qJ)PiGpP)TmH/ NF{!90(.tMǫsFHHK앍C/ oY{V;7dSH?OZP/MNsc v ÐZv?G sm 1P[sBC0lCr?cU^J\Rւ7mpD±W=L9;Zu;wZ%i; N*J1}' A]h53]*0ݢ%ttϵ&Xh[ED/`4aM ][kծ:+璖ml~ T7v\TFL{( Mgt~qW?J߰:ghxr\FQ5j>.<׳YaJx+K䧒AVpj"eʞeF%[]3Sr]zlȵQ`sud19^7&x|·7Dϵ"SBAiOD/h;Db%pAi&ESG^Mnqsb1d<uNϵGOwh|h)ۏY3&meEUp`}!ד6 ;1B~LKb#Ih{B}vWړT ]]Gj 72gFNϪ] ؼ(͵lwփssAogjVz=~j*\?8tn #B.(wÌwZ39/<QKCqIyc 44R&EFs1Z] ª^eqP[ԇ7Vnw#MgGϕHDyT>8S'dKJ5&ŭta|2o% 9J#mT - gq#9Hj( 36 wGUpIu4O+h ~6(֛ZYqtQ!fTi_fȬN_rRkf"5`]/6qdvcbEZf6Qk.|xn%RT{/ 4`a"–e.i:B,ap !ͯǝLfpSVP CII͢lJ yEBR-#Xœ CȨn3\*o^avez(!htfSETt|RYBԪ?p{\9ks]X׍VZC=]}K&3mt?%17K33%nsE{S`5@.D^p' เw946c$wz 4qlEUkpU2BǂR$KؓP~Ga;Zr QHMOP ~nAwpEj}_M񉈯)G]?`()ThJ3sL,-Y [UR.e)Y jB_)Il~u_7'psp\ ;AG]ʓlMwڪNbxZw'W@d9PF!3SdSAmD;!ڏ<ӥ*N'E#Oe]1NA5`ڲqn p'a)g3N{)(hgw;34ƥbsOyug)s>ngS%E 0-j $9fİ[G24}\5,| yĠwt6/p;Xs1&636=LWtz>ɞN&ѯ8<>5?zÁ+ѻ{Mk5yaq}.Ff2-2iE|5ddL%<ar2ʀ OU?tscflG9Y;Ө%]iC] / Ѳ/{>Rj6r *eKb[;h\mXz~`ck|l{ޙ愫a!8 ⛌mmTX^bwu;YGgiM ]IƲc V0n|Ms!˱ZXQOba+T> )foa{Ju!ެk(Ӊa}g:A'i4i1:c8-SQU\OȽ5>:/#v/ŚwryJP$)4(" yĽ'Y4p//=_sA\C;wl^޿둗]pRU8d%µz/ޕ3xVUch}?,7{=&GL㰟{UK8o͇5nڞ4]9jOdUИ{ B5BRbw$+. 50͟-]"U{5&+e mB:2iR pZ2˄tRdpqX9 1VrUY  ut q{u 1zru,-YWH|Pvz։CGqJt9y__HhNP}xl]ISs:u{& IXj9.H!x! RTJO!m$fI7H&bfGVjI(~iNUc[.',']F@26kES:ZH42|bD͍m+f LJGVGt/% 4x>׼1 btDΥT TaуmS-Vݨ9Hd:?TuG+\ie̼5;2i]RB}d\>)@6CqW-TaH8XCs)֡^͠q-̐BMp$3\Pn1 Xdy&: 'XS{ -EzȕkRTqa-Lee;lY%\y~ V lG)BƵYzxew^Na09=@%r7­/Ug*k򱓡-WCF6|K>D)$PŸ?UoRyz#\#j2w唳n9T[VlKDYui$CM27r]ky0 .dV>hRPfv'Xb*3It{ys&5Yn#L_*u*_ p_1'g:9YаL褞JYpٿWdu*tCˍp/[qкzR#& GT)bw A%r,x,Zu7f1<Ɋ8-aP4?@)֯R+l2:ۡiek b~#O=Ƙ,Djv7T|6XsjU rxjh4p)GOsrk/!sc[DǓz.5<H \R҉QRɧ5T\uOp=|@zͲv8ªTVDtQdo„hAz7r0"L-4d'F͜ƭm{^9|z䄉,ȩ5/1}3PK nI IRT#a_=+PvEɏ o Uc%֎\"o)R9 ` ׾w6Q~v1"Cf\ iT~B=,R1ep7xz[mњ(`[7 %0cr֕wk1!;%^ݿD: oc1NzvPx W$q3L5 '_:g9? w&{MŃ_tY"2LD)tl5]bvDilAԥs3 i?FI=u8Kyڎӑ-_̻[NH\'tߠCP3DgGk,'f"2iiF.!3K3e,&kPσZY .rH)4A\T"<6 S>Vݖ' j7L? R\. +`<+'oTOCF@ %#g`e?k)ZV:GovQeʁ2l[8_8NTQ/gϴA: ?v@ wtku 'Si^ٷ/ ႅ̱a=9`5;Ǿ'àod^Le,-o{/R4<W_2)GxH})z! *>!)kt3)_mtqiyd׆GO+hBy׼ug DZE W?7a>J+5/H9 OnhznP ͚Qڗ?f;>LŒ٢vZHf׻D!ZA 0[\?QlKᖏ-UʌxP{nS*h4d+P~S,8iӆ<8=jWUl]tGuY"VHQm@ ,yl 按2P;,# ')\1o7#h{%KFf?DLDZEr=  5$˃|"R <ҵppSrɋ5uòT:y\ϓ4x@f)R{zLj'-\Hcn/ZJ&w_0F'vÀ9K@.m 9YA |ŔZf1DadSNZ,yTSV yhg(V"/Sp?y$'F PE~A?g|m"{Б6>bLO{W?t3c$Vrn/C@ZYT-@N"x ( ˲;$N61[{QzN.@;ޓA8grjl20v4D_9y3b4G܄h&4wpIz܁ {_JYK(~HeE:d 6099@$!>Ҽ>0}{a#.Lls(Vۣ8% \ {!*^\9^_ "뱍DC(,@hs]Yᚼ'i{lҷpB=d*g:95x;yt.)\esЀ$:x>Wv4i]fzNiPȐ>EVcDbls?ڲ*lzUɸf&1a3Ҕk |x&BNb=Ѡ){`ѳ] R9SkwQļčL$M]'"Uq B8u*#K#$?ʶ)/l_ͤMTFt'ič0ngN%I2"*P[Zo6[YZ5@m~?mp>D݌_@Xkt: {P~ ɲ@B@)- H%")L+5h#빯?QIM$(#`Z5K2,ÚK쓃n_䣭[37j+c:C*s fڃDKl>/g! S gld//܆?VhV--S_ .iac@۳]jV9uE Uu >ݝ@{.<'Z˂ [h H칙G)|˺8a7"]&`{30-N{cRt,Fc 3 9t׬OzrDq]K@/'G5qy3Fnвh˿] >m6iy(\7Hk2K/g6_SBZ TJd{̱FZ**NrSKϩ?st*%#pO0cͱ%5Rf[}j#L'|@QpeS,*3m;P-\D9e3uC@e5Oi#͑nkYMM]9 b@7d213BmB66 ǻqq%33]>vg^vJr[ wlgLG|H*4o{Z4!A _ٲ@=Qu}؁ kn+¬untbd\جӧ+cpr/f惌(gkgp"C`dI{t)鉠6q5_/~k&}4Dr8 6bqn'W^j˗poElRCG{>cR3Rsʓ!Sl˨)"R1D!J`@ p77qwM@0 ]Lx.gLbPcxsw~Ӥ"s%<ia1AAc%-%-?pGGF`S*Wu~.A5NB@1 ta]wW zvYbYvψYQFټ #hc$rB^ ^ZAAe2?F] b7͌4b.3m6#dbgw0,̡ (F3,a 0 n8CTQ,pB (9}ʓL*V^:p @ ҉/m#h5<Cs̏;PYKPf8c"$JM"d\llj^"/V}fO? iF>TgQUSn $lmZS#6o;;pvq&Ft K(?`m?ٙa>z%]-&2,:!\IFmAaֽ~I{CfRu34ck]9G͸>v[zzAuv;ȹHjzʑQ 9Bh簄znNl4AbJ -\`?x6he7M[m)cm֓,VZ|iXuc4& dgYbbF*B}Tu黓D(>Ch`qN.IfC;A,[*bqK&n lʕ. LF3Ggri\VE Ҫ?02?al cA R<+jf^Xޖe:6tuwR%هcFE;fuB$n!^ hm}^`!Fv rel\TdzV[^-Fy:'gjY*ܘ}Cbs/{*L]یK֙FLt9\p4 $kS$EV/OY?i[4WGuNn1*ɄyEJ\1<$VGnpxFAp:ۨ3&8 ZaS|S/)M&ByLbÃpԗ9rrIMHst7 Sm5&'LZgx-aNE]t2X庴1QCOiSծ/v85O_ߡf *i 0><1)0vJq,sB,ҡg5?kksN'ţSnutk1] , K vY1:˼}wBׯ2hkx9ɹ~c:g謜[K }K0,z<S:mŊ{IOk/fm/ *#9:'3UN:q{h؋6O=ERǒ2fdZ(@H5f! tNGT7efk٢iʧS]R"Gu整c; S̷VXV\wA5G X(%z &cq#>OEA}G2֞nwYuP;U?s/ed@H G 9]7EfgU}{8)w~9pƱJ$21Y_l;~J?{K6n͖E)fƸdL] >m|y'l/ᬓ h~ |+ӧpk}--֘ޔ <^i TV 8#968 *WFHab3/ӑΔ=sgiFJ]o}KxX^H*WEzXNY"eh!T#q勤=ȣmG/PSn^%-T> ~*/h_GW~v;<~2`5iHIwf_e~a؝r[`!3 )2Ja#$`))gi-QW; CMlF:^F ;a >|/<1kxܸ ә L焈))*prWFO.ab q{6n`vkDwi.rѓ́jDߏKG:BNyWXiymf傜htmfe@Mi0㫫J$db"XbHSB (yQ3/?2¯cŴ6)\3 >F ᝤu{\Zzeڌva"avVl-ZȢ/:>! fC}e@aYOg  FKCvcL7\߭K>r]ne6Xdg1?]y D(26;4;ls'TD%zC9SBT&5la1օX`޶V!k3V\eZJVh=%Fђ=Vod6`[vKٙp(@UZ1*=Tr!,6K#9,}A_o;(+g'ҥrz]ʵ_)xD jtjkIp/ ^&̝S~(. [Λ5yLyL&UNm-ʹosDmP:ҎWwE¦28v V2cV\ Opɀߺ^~TPvVYdN91qJ$ rXۡcD\ߤ^;Mƿaw+Gђk"(DȘ3Og0m JYԲK0kkϩPj9RW_^†HD 7'!z5ouZ}7;<1Л-efTLGIFW娘M3Dq/!Gf&gN ^հ唠8Q`3L"V*qkhōd{qx!('c{Y,!Рog |r|6LyboEtB ^Z_Xֿ[/X-.Ѧ꘣ 'V6N ˎ|uUXM1Է49%d ɡ5&GBBЏiնv__?*a*^G .hI S>6q|h/v)ӇZm pPϜJ[qܪۢ|w^G"Z'q=M6QȆG)%hE[+A˗o6_*2աR8G:,}n|`*x 7eH@5iGkl4ݷ2՘G\/FW[PWaҕ: ?#]/3lRG3AAIh(ݿXFn+l6E$X䮊 7'KK؃Q7v s+AmrF!Nzwo]0!\3ɦeQs&~9;1fO5NH0[viĺJr{7S>Z<┄.ˁxprVp,_ "Bccv*}1R)@KyyT,:c 6@xov2ĕOҟh!"Q B(y'T+wv_`JIЯZ7YjfՆ 4 > H =L*;JnIbf`O`WqPu*q矩+#gMN;YY8JyJ56C.>}UL`_]Sx2YQDSIǠ́ó-Kc X0.!&I%O;fڇVs"xDy>|GY9-e.Mר+Õ¾,5=L-~L_q d0iT]~RO$fa+׍cYώT\~ G¨ <#9_&}~zk ~'J35|"XJ _oZ\k&{ˏQvUJNtvIkSbuPC/\e+XUddjswQt#3ɹ2vP)ɯx|=o奫spR=+.r2Em 9"iPݤi>SA%X.(hWZ :xs]r$<BPd VT;3:toC2Z9> =8Y}ukaA-wqɯ#JC4+v8qUU#$ch0 k46^>KGf?bbƂBt(ک3E+; 0aQnMT(-F9D"@M1/lG6:ۆKMF281Brxsx{Ӓ>{B HsJ'N$Dm5:!qr3+'!|f]~)r%Gpkz7=C=EXZVmQ?/B!twzPcg$Fsy!Bge4LYʡiUߘQ?iRw1ӵ\0r q7>]<&W*mS@^Vz7-D GP(uڂ)^mkiT + #D$%%:H#=rb/ B@o.ja95O@-촬<@5G]_Sʳ7agk%<;l Z^ EꇓQhݝ`LiaSqDZwѝ|IC]r5#n7EoݾX8E(stwo#b*=`z#"?tి0[9*U8О0r0]o8y n`uЂ *+=sBĥvɂ ;r&8ܺ(wMđF:ҟ5t;[*8U茞N}x) f.檤x}惁j51`㐩 !)*wP$F/3&1)FP'V0Yd3܌%GAvX>Kp)L"j3$X( z 3CWf8k:GH X(Ͱ, qk _ȈI3tdJ#|&R iQb7ik#^,KHHFͬEV({NI.?Xw821 |ЀYܖ :=8 onў3 UY FpbС"4(H}nl|YxYöd\;f#CX}ڨH/Ș`YtĢ8S3p`],DR61xȦ*{yl<-k0_TO`h,=,#p'l"?,)EN幯!*UN\f ̃HWEDƆHQy^"߯OVI/hbX)hډe][S?^ܑ`Lw/>E!/X+0af|د%uV*2_@+GB=(h3rԲfwzD0a*m\^ X鞏sMA0Btεc]/Yxv<81 '-,b0j{Z -Hk.|Ԗu6JԤt$(Lo. :,È+ c'g( @`a|7okѭ&n_Q0wܔC3AHEc IFA X\nN`I@nXBff["<ύ#RD.vLx.x9NJԟn~%;u6okL?:mdNp {V5KYe^;=|C?WhNP^" X#_КG>hE O^tW JW'^$`g55KOVnŊ,Y&`ÂW8~s䵪م:tA&<0,n=,BcͨNe}+TC120M Ǥj7 ˶_R1ll-j!^]4[LswȒE)}NV;* ;P(0NtWYn0 ޺cNC!?gsXji|rm[V՞RtSw,:UH4: j3k?aʎ7ߪlcP8::/~fK_ǢS!yo T2QH'+и/TxnV~ά8˻-gp9}]Wdo=8ѻ,D_LJ=1XN\R%)w7ϗ5˃( 9uK]fVܕI Rxe]Z`$7X\Nl{䔮S}X)5KOnU m?JmS%NK=C3di\D]ЧBSW?l;XGw]F0j+D%p~rJ$4'wJʠqQͩleVX@q\+9JBi\ "_J4gXH`aUvEȟjrD#j3czYx- PX>$ſw bIeXz]?*Sȟ_6YClpMu D}j=q9n'R>'&Et;Y̭aC/<4̪|lnEzK!2z~J!D|Zd,'bK P>8U 9aEcKܡο޽4KMAϡ0^oz ;\.I &mQx/uY_rj^CO}uir{EV!9 Ta`k4U ul0܌3XIR43g\Uv$3 Y$drRdr4ޱ8?7~$6)Ǣ~jQc:7"Ŏc! 7^Y@E/,fb媼.Jtx%r ?h4d?v!J c1ZW[.e)f>ͺ~M%4u8,s2b<5D~ٳ2v[kǹ<ۥa H~bf%uvTvCkciwW?YIoKuLDi@s3pL3}D+J3// U{2Tm;$vpCOQ)]6+ z Lz؊eڛ،۫"XHQ+=dEkg G]>_3I}D` Izw3̐ ߮&\r`ˡLӉWK s/!'c+c/ 'K[\Ɓ4`fzis>n$s+=7v&PN6: }~fl%!z|&9Jm<>yLnApKk);'/O.tD/:yOn"Oxi@ƷBhYrpYrI/+o߱9ʲE插Ju!0&1ʕKf4&Q-zɮ[Cg p3V˛UNr0oC~| (G8RTS M7:,JvS`W- U<$GYK<9”Fl<GM_ۂdP|d_lv:#OOmF-U,4}п/~{l\[+~cH"J<~jKarw\ }ێXClӑvJY3:Oz0ڄ)VH' $NTJԇ#~aX{#gj%q} `w7e9Zv }8i+aQ1dK60'6KѴ*8k|8kf?+QgKhIR0y eX"]ߧ&N![* e5;Nzoؔ*+Oq,م#IK_ پF86XuB\)jÓ_N89b28*Q65'ѯ+?x޷9W{MOG+P&nVp:lKqT+ngeoʠ }pw#AɈ枟N9>>3@'.N I^2Q?Y۩Tj+nFr{p rAϜ'=imY-ImqX hT/[`@Q,OZSF J;QD qr^[副؋*'<1p'jX}i@cu!e%#: wL]fQ_\lT/*˲WB;=א:edSW2FP2fv7e}J -ոƐ7QPLa4 ն/B_ tPۨg(:AY(iv6lǍL+ˉ#vXDs)r ]$UR<:޺L,OU/J?ؔ 拂 9a?y?+VFOK:q pׁJ+ NBfVLŠyɣ|}MCEq`s_Z $|5aktf9lcO*|6q!,EFƾOu'&DZ+6Sﴰw 5ēD-ܖe9z+Z$b<[,#b+3SQ0{? #8i#-o8PnVxk/s] ڮ^Vt*͞ťL^= A̚ 6‘SSλc JQ x%\"QũL6}cܯ|P\G-tH.[ilnC6 > [Df7*/,=ѝ ʛjL#Ň=E9/(Tz%Sn%X0+]3\hImaLD)>e =ܪ bGK~"B&,`4S(Hȷ^=CZ7&6" 4\[ CTT@mjSv#HګR@GCmLե,bMTm%go5#er>))PO}<Ǎ 2k0관 [JZ +R.8VA# h :AN70!Ϻ(He\IɹfO]=9۩7dsF5veS:Qd`dO]CðQޣ7=DXٖJȕXhߣthcfe>eh恟l="満mp]ϝARKw6!,=,y(Dop35h3Pbk"@$"ЃhT thY?~# U}/eTEw~sԙ1& jӅ9;g9">]K$.MIqtȩ)X - O~uHvI:dwfj2[ڡcTH>{9uNBb}t?Wzz';CS=A(m'Vxީv]GݎBJ1]h&I;y'sa[m _%qj e>Bz ꁛub@z+cN& @_*7KXHހ#466nng_S<䩌 ܍ZO&]ǚ(Yҟa˜H+& _f#J;,?^la ŨQ ,^wK,Ս``TVb3;%amOtBҊ+1Eɗӑ5鋅6wJ"1UЏ0_B8̖=m8B2[u$])W폌at޵͙kcG5& crGx!TXxź̭>="K-?S&vKw̿ldGR. 78Zَ:[ ץ&Qag1[3P@.{%SR>#\479j" X&)]1ocQňi?)T0Km[N~W~K<=:ׄÆ|f0 Spi=50ć j:|L9@T3,0܌ʥ+]5琫%KoT191fq򮹼 Jo4RQf֭fZdFiNI~?$bر<˲Z}zqxV]w(ҕx,[p?DO=M\iR( n θoȬOx bѹيK\%hC>թ'76}sfش::7'X=S1/9>h&c&ªޖ6C¶##Q))"qv?8ĩ$%^8oy^ar&lB]~ĩʴ/J.84jmWj{ 彌j/\*?i_pS~*'DjTF_1 @-M h>ӳ~U_w0=Poze!&VC>x6{$70T Anh f;%iD-72 jYEؚnCIp$,St7J}(r1="L1nV]ޔ&*ڭ2Qȫ$-uוFwk91&ܩHN*8/#eF[/0?@"6ȉ0*UU]$OZ Ct,͹(x&"۰`eQUq冰T#]M/` ۅh@: @ U'jDh$ &,Oj %]ѮVé=*Uު̄wj#U7 $zh]DQoh,Eg|N+3+L!벘kfk=PYtqٹZV*}%ɩ~)7\[U#+%|7팹ǶHW9M` cwFܥJ+ 5aLqYl2V{kdL?;ZFktT!_,qc 3{l;, 1`qGf 6MLECk尠rA2w)_ )""٤d_C,d4(XuI`A&\¼ W'[aa&th1nلE=dD#Y75>;*/XBX\ =B6/IabuUH_.Tl"RLV a,!NsL\B U= `/tqS7.g-P/s2dcC ]0-i(BmOmXvRp,%a u\B9?@8g_}w)\Sl\.~P9.JkLɧ?v_t;EDԸ#LD&^5"a&ipVꉞ׏Q562T#Hz7@3ơC=]&#fNrxwb-Xc`Yَմħ_Ruaf+rbnHeҝg W|;?%$U![΁3K+e 7es6*ʥiHsJΟ -9lg7Œ`>HjE@?d/@KKBF2t"Y'bE\kC?ѵCKx*?2%VbRW^ˀ(pREaD <,F<٩9_f}+k"f4Dpp|?S€dhT`Xå& "gFd6ũA%2g2,= _ _IowS)i鏳2^dK=]oB.`kI2M. ifRP bZO''\QDĐp~*9A&9S#}R>UݧƵb-鉑^n Ȏj i`W%xE bk%6lwgaB$jb{BXp:v>rI:0NcN_ď]`[24FW%w!I$ 4Sթ^#nG{ Vpۤ&[Ʊ\ 袗63{u075|uu^b77 H'e4\j|#EWwVڊRJ(@lDx2hh#.?Zc#_r#5'e|g9pr=Kj WN֌[uaM k9ƒR>gqv@?^sGGpԾHR.RO6OpO:`d"a|phO;G