pki-ca-10.5.18-24.el7_9> H HtxHFcKL ?*}}gh|ڪLxqǍMQug:-їͭ4.u[35e02705531aba0b06536a536a06b748848cae65xh!^,CKZaFcKL ?*}}ly2~x*[JJ!5\Zn}F&>8?d   E         $ B H Pii i i <i p%i rixPi]iji08 \  (A8H9:\GpiHiIiX$Y(\<i]i^bdܨeܭfܰlܲtiupiv wXixiCpki-ca10.5.1824.el7_9Certificate System - Certificate AuthorityThe Certificate Authority (CA) is a required PKI subsystem which issues, renews, revokes, and publishes certificates as well as compiling and publishing Certificate Revocation Lists (CRLs). The Certificate Authority can be configured as a self-signing Certificate Authority, where it is the root CA, or it can act as a subordinate CA, where it obtains its own signing certificate from a public CA. This package is one of the top-level java-based Tomcat PKI subsystems provided by the PKI Core used by the Certificate System. ================================== || ABOUT "CERTIFICATE SYSTEM" || ================================== Certificate System (CS) is an enterprise software system designed to manage enterprise Public Key Infrastructure (PKI) deployments. PKI Core contains ALL top-level java-based Tomcat PKI components: * pki-symkey * pki-base * pki-base-python2 (alias for pki-base) * pki-base-python3 * pki-base-java * pki-tools * pki-server * pki-ca * pki-kra * pki-ocsp * pki-tks * pki-tps * pki-javadoc which comprise the following corresponding PKI subsystems: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) Python clients need only install the pki-base package. This package contains the python REST client packages and the client upgrade framework. Java clients should install the pki-base-java package. This package contains the legacy and REST Java client packages. These clients should also consider installing the pki-tools package, which contain native and Java-based PKI tools and utilities. Certificate Server instances require the fundamental classes and modules in pki-base and pki-base-java, as well as the utilities in pki-tools. The main server classes are in pki-server, with subsystem specific Java classes and resources in pki-ca, pki-kra, pki-ocsp etc. Finally, if Certificate System is being deployed as an individual or set of standalone rather than embedded server(s)/service(s), it is strongly recommended (though not explicitly required) to include at least one PKI Theme package: * dogtag-pki-theme (Dogtag Certificate System deployments) * dogtag-pki-server-theme * redhat-pki-server-theme (Red Hat Certificate System deployments) * redhat-pki-server-theme * customized pki theme (Customized Certificate System deployments) * -pki-server-theme NOTE: As a convenience for standalone deployments, top-level meta packages may be provided which bind a particular theme to these certificate server packages.c"asl7.fnal.gov%'CScientific LinuxScientific LinuxGPLv2Scientific LinuxSystem Environment/Daemonshttp://pki.fedoraproject.org/linuxnoarch=mL+1l[#tR#1J6 _ S }F}F+ g%~~[G7(b)[J2 O,", +Bf PEGl]P'n,1{{% *S*L$,kI,A,:+A+3&u9 ;#%##"vSy "`./9/]   Q q >#E/#+{B/'m)H nrtknvpyi  *L*?5%C%c*m;c=O? 9%9RU][  T \71 0VCCF6CQ& "Y"\><bc q-  dF r- ~-d>Ed,g>aB 1"?%I7Px]%A큤AA큤AA큤A큤AA큤A큤AAA큤A큤AAA큤A큤A큤A큤A큤A큤A큤A큤c"D^2c"=c"/c"/c!c"/c"/^2^2^2^2c!^2^2c!c!^2^2^2^2^2^2^2^2^2^2c!^2c!^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2c"/^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2c"/c"/^2^2^2^2^2^2c!^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2c!c!c!^2^2^2c!^2^2^2^2^2^2^2^2^2^2^2c!c!c!^2^2^2c!^2^2^2^2^2^2^2^2^2^2^2^2^2^2c!^2^2^2c"/^2c"/c"/c"/^2^2c"/^2^2^2c"/c"/c"/c"/c"/c"/c"/c"/c"/^2^2c"1^2c"/^2^2^2^2^2^2^2c"1^2^2c"/^2^2^2^2^2^2^2c"/^2^2^2^2^2^2c!^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2c!^2^2^2^2^2c"/^2^2^2^2^2^2^2c"/^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2c!^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2c"/^2^2^2^2c"/^2^2^2^2^2^2^2c!^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2^2d6bf5823021651d1cb53350adcf4bb818ac77768f5cbc43898ad06af1036b00e47d6a63b91ce535b5454e3f997be0c8a329f7d611d27d9de2429795aa7eb26968cc4d68b9f6f2d9f12bb1756fbb9bdfb34fa89f0930187032b271315665728150c582ecd379d442745e4dc6ecdb90cddabb88b8105da6d2a3afcaf947850c0fc11a3352de540f4e0681ebceae86ef8e7e17c4f8c0f90d500629111f5d265f25386fa50072f26ec25460e3bd969ef5200c3454c02dc9d2a1e84fc0cc57eeb3835e785c0a3c0f8351c3e3c8dc0d0cc2d164241ab800c121fd3c40147d63cb5139f276451224c5d8227f40359f7d5367ab5c27bffa0d734cb4a25ee3b31b8ca77da5a1829bf1b3c216ae4c9d4ee066772bc7f5afca577935c229d9bfdf80d75cb7d0aeb78397f439d16d5b530d8b81c119af865c0898e02a33b17d28d0bc57ae9c85df163a6cc55b9c0e1f32f2a347d19c5f9eb02f3bd07cbef7dd25c8d86e3bb718ce6ab10819891d1d8fde23cd1c90b6a065c008b7f7fb43733aaba5693b054182a158a8f0949c10819f646d42e8cb710ebd844362d97695eec5a6a523c9718a1aed1ca83010bd139dcbfc328398007d959d275a78df0c0208c207e960ea669ca55436dc0723559afae54e63e48d826c2ee0ffd98b3233b8c132be6ea1540cde549ab16a5ee0b53ca839bcc06b9c268ac7be7c8186aa4392ce0c663460c019e4cead500b0c90a7da7bbb8602f999170020f81dcfa03d16a4a4d9caf259911676449f0101595c93b29c3402277811f70fa75237715687fc5dcdcab36f7a7c8dd72da64a1f054f16eb1ae49493bbcbfa138127db6a09fc946014a1d137d40ca2d5c27ed767345475519c0b68cc96bd20f23cb2045c3829dcc72c67a4f1a133a7d155ec67643ebfdcec431c7d61966510fefc3e691ff14a09438257c5c23fe66d54bb14050386b6df46fef8e6214e41579d09c780d19d242741f29c2809ef973cefe0cdc0a0a32d688202334a77982bb2d63244aa5b8570dab545db1c29342b3895a2024c52fe492fc10e9af7a7f3dc2f08daed6d3f5bc13ce0c8bdda30b85f0c69a57b7994670aca2abb02cec14f3334dc5a887b85bbe03e19202a045111343c40a9d68f40546ce9caca6b76801039b97b1a2c53cb0975fd3f31dac9584a8a955704363832241c679cd009399b6934aeedec0b3755f83bc09a35cd5a292cf19b7525e0bffd207c4c5b122b085f9129e0470df5c37cc534df4e30ec140a9406a2850767d3c20dc56e7c6f0ba342130b0160dd473330845cc80f17f5ea872d0fd5031d37b0ad740db9a30932ac53203a46c4e4fa701f891d74fc185fcb8989f45d28cbcace48ed94b1a6cf7171f5ebe150102c2cde343df5b89acab2c2a6c29b9a04d448b089c45226bb2cf6dad3cdf581c3af18a90d6b911ccb66c7b2179a7a75fd1bca75eac7d894fd5cd1ea75a0ed89170c0d4d1580016ef8436ecf4e619543752303a3f673928e2839845976001deaec22af953bacd3b72fe5c49443a185a898c26d1e3ccc9375d6256e77b91817081f349ed0b5115ce58d43c2720c3473e5e4475b616597e5ca45e6e816149748a4c7fd6443ed8c585e675afec1f5317959ac93f9de3ac67f7ec677ec54d3e5cda612b21511aefd19e338c7f06a05c29006d6be1f16dfc4891efbc5f8b12d38381041f75aeef95dda09a3c728bac964a8660a1bdde4c0aefb36f1162726bb551a958e9ff0de0333133702e0312e1bbe8c64c60f940b149f3278ebe2f7040e9224cb5d49ad2e896b807877864ae209975fdba39fe55d9dabe5730b830109f5d6bad9227eea0387e9b425cbdf52e9aecb5044ddf44ec05cd32ac643ab96fbbac60177722f9b65e9e88234e89c434a691e079069d37b318051ba08e5401817cf220661cea7c9468dd5bf0c862f246b1d80f21c7a69acf0b3197a11d03adcc3a6bb604040047d335ffa81c8f548aa273a4d3cd67272590ff8bdf5c4ce6641c36030342b5a32395173e93bde51a9085c5df4d300bd66a4eaea68a3aeaa6f2afb66d32d060f4b66364eb137323057b41e15317cadeac4d6d5acb20866e54fee85799bcd373e3e1730fca6964bccf10e8013d3a17e47f96dbedbe367692626e7e482a595b66f3d8d166cf030208d11fe66ab03a23c2932ba6e2290c7c90da1fa7a23214b457d24fb03da037cdb5760e7a8d0cc402d5062ce39edcbc0f3951007855b1ed95d532e0d4ad8e3d9067a9ce3338346fc111b62ba6e2290c7c90da1fa7a23214b457d24fb03da037cdb5760e7a8d0cc402d5062ce39edcbc0f3951007855b1ed95d532e0d4ad8e3d9067a9ce3338346fc111b6b14b9f7733adbd8910b925566c7031f9ef5d4047f50445ada7a0120693e441254ceb0cc6142fd93688a16af692f0ea833fccab83ff002b27becc311ae4c26c91b3e83dd6fd1336b0e2e1a1826f21a57a176e053a043aa8c0c6f2321dbbaa6f144ceb0cc6142fd93688a16af692f0ea833fccab83ff002b27becc311ae4c26c91369297a91044bae9d61a8f61046e54fa9059a66f2c5c4bcbca9fa651f4c5e605ceadedbe484214d4af828832b12d046b1c3fabd6dd2c6e92edbd7c299c963a01a6e93e3ebfd7fd88da8c1b24ea4476e495b9ecae27c557ab8c7ecc8914601f8fa66fcdca8b12389353b0dcc4d49ab89737b638a4156e04ae83b7fd7ed195da17e97415f495943ae49ce5674e09006caf13a8afd978884edc44157639fcef3a6e5dd07496ebe2d7f236624fe4ff9ea4654e533cd6f136e276f185bc4ee75cc6a63208f569c98c16c37c2fb2e287b55027ecaf16ea80449fed310725854dd848504358d4fe7948b0d5cf868fe9304a7c564127640a6e2aeac5c3a536beb0f30fba963740e1b6bd2aff4d69dac938811dbdb5d5a49c12b1eae220c314482006e9b14803e10fa13c8dfd44cb429d356a3603c079b3100651e429f5bb76d57d8b42d1dfd602c67136a59e64f6e463f78538691537a4d855d1034cf133218defd3a3c286ef3b2ddd73eb2a8e12cea6e1f6adadca373fa81c0f7c414e705ea46f3818ea8aef2e39c84cf8dc8f0af8abb56834c98fe36820ae871266d08e5018aeb4dcc521c9c398e166d3c99707aa883a5619dacfb98c3ce7fedc2a8702e188ebcd349e519f65778c5af41e0d14e2de103ab29f00cb99e1904b3bde1395ec5fde92c1390815093c1c33be89fbf3192f503fa8ed572a7d3719461befe87107a42e962d4adc3b45978f03f3b8724c1b89e36ea16e26e494b65e240c4dbd77198021abfeaaa80f6e67824852390447027d20f4455701d32e17ca30d2bc02a145d5dc335c5dd2484024db29aa2029e29e5c87372d20e5d57bdc9eba046ba525571e512a8d55ff6c74db2c9f816beb79eaa11ca44d91ebbad302da7e0e139aa99c867201d7cb2b5b83fec0eff7472964122f5fdb491916fed8ce15b3d179a90dddae767695d7f153f1da2cc4da0c4aebb58a3e85d0ff03fbddd02a9c8f28532f28fa8729aebc24e02c5ae1bbc67962f899866ad4aeff14c6d9097ef74a62b0db13c62b3b948b1910f6e156c5d656b3d8ae6e21f777e1a1dff4def65a9fb7493202db1cb41721801405498a15b16d373fbb8fd98ade8bc0c64e734d9b60caa3b7b41fdc8ab76318617a98a8a72661aa99baaed16b2a895766d878506c808d142b9c564fd9f90bf9f7423c5bcceb5aa7338ce528d057e1a55770f4f47a6d160f464bdd2e5a9a15b6df37a15ad28ff8bd1d1e379fa22a0a58b1462d1cb2bf6f91c0428442b261eaedf631f22563c6975207fa0651d350c9aac2064c636dbfd059a1c001014a7a57fb30afe2e8161acff9850a5bec7b0249448891df209ced0b38cae1dfe11790a5bef1eeff08a5beed53ce599b88479fd2a598a73e9e386c42d10c44eb6312f27403dc03ebb5131110972dc559286d504459480c6f30bc1fae30805cfeecf5a44424819425d088599d31c38f93071a8f888325055d9fd241c86a3a158a7d4ec5d403a32df2ecc86fe1aa69338a4a6e06d2d643e34acba65ea5c001f851daf5dffef55a1765bf7f3b0ca4bef450a8f796238b36fb8489460501bf94e91f1dcf5fafc74904a2f68124a9f013f60bf839a93264f7fa1eabe952c15f22a6e370963c902ca978def728703aab9cb9f2fb3b48731fbfe760a43a258c3785c84ca4be21fb50b0842fb84ed2c8445b5cf38f87865bf1d65ef7a597c15178cf7904e805547fd53ed053101f654722a90c7c718612cbb600f0e746904cca639c083ad44adc61d3b7602633f62681a0543a4576518efdf11838e94dd637e9b7f48a5c9b4e2303ff44b354cf3d8d22c802cfadfe0dd0334aca848e8984b34e92b9f696828891e4f016817ea2689a5402bc8f4f2cb96354c9c14c3bd20214668cfca82e0f1f4c7b29cf0a9749962f5364222fac9a330306af9dd905f0024aa5a1e1561a663ec16fd58a28b0619fa2cbac29eceee05b20b01097185ab19ae9d807e384a743387d27fc0a8d6d897676617cb203cbb3d413ebd6c093c27b4e3b4e86280b85d928dd21640e98a6fbff04f6d46220c0bb33a1dac4f66ef82fbb59b77d20640a54d8533590ec3bcd1a15d8f8190a27a687e0f9743e5422b91e23cd3670c0084032a94a645dc7b21e0b39090e6c6f6097d5b8708db4223a9313a6215b2e5fca1c539d4e5e3477fd81e23e2db0b4c4e33b16d4d2323e17dffb0656c598561f9d91ec04eee8f89ee8bb42b031bfd0f2aac1342aa2a5ab324f8f6181711d9172bef5dec9b4e1b2d5cfe69aa5aebb84a5a1637aec3ecd0ec88ca2eda7fb5f6bb3e067bacd789eeb5b9868e47eaeef88ac42301d77271667035e5ef559c4f00eb3e29f8dd363c43a4df10efd9412fb5f45b5c9837a9e149d0888593569c4969f51efcd61ea6abc2164637a032954351b16d51241c0c5803f12712b5043db034b4fe6ec928d6b57dea17970f7e3a0258e8c04d0a0156c19446f69062dd069ee1967bd929eb643811c199c1d988747ba4d5689f9167fd42a8ed07039e28dbccc4b744f4cccd469e8f3bbc3d5350d5b2c15101c9869718d0e248a6261a34300f064a0011daf7a7b97fcd57215b937380865f10faa16912e9cf7fcc6c8001ed5ccf7c35889765811a449166c80fc6b7b677207fb040d9f7de00541f77aa74747b96a8c199e368a40ae7f8cf803c974c90bab10ec4d6af8bb034bb857d35e21f13a766f242a999b72ec4530ecb668be6082ed25f15b4b50df28164dd762843030bb98e81eb93b3d1cdbb8674ec4c8dfb3f600b90367bec83498d9724204d8e54b448583d870a563a74d08f05f45fc39626de7e17f2b9dc8ad6ac85e7b3d443767e183cd06212dcab461069d6b7456f1a7305335ec03066f3ea46f1d707a59830dd326fb2f2135f687984bb909cae523b0d8fc8aa095e59c31e5b1a1ab748de837cc47f311083b3ca72933082f4a4fcf0258b724d8be2bd7c26a70a7ee57686804b4008d4855be3d7fe7337ae43a49225c416f3a0fc11bcc7e6d5089bd03ce69902e13ed9208464a6a1d9f7d81d4795a672195815118e2584314098a023c3f249c95fe0173d9cac292db36550a3fbfaad2e31234046232cc077308a08e1780507c2549caaa07960a3bffd988c966ca03b37de84c114081aa4b31fdb94c7e07b8c00e726c312cc833e259dfe0ae3aabae0cce1d133c3004203650fb5a0a17375f1c598dcfe22d7b8fb04299ffcff251bac5ce33e8319ce83dd0bb7d21aeb387e17803d3e8db9ae1018fee9b3f1400bb8f3b28b996b1bc599f09f56dfbcbf564def419d90fdc71eb17056a10a6cf49b1f62522a0f22ea1b12339ed6fb418b2e1fe1a30902aaa70226c4d7821ad58abf7b6d60a2b580a27813648843f4d34dc3120f48da361bab625d830ff8bc6c8ad5a793937f191b8679bc73170aeb5dca7109bfcba14a1e08eddd916dc62f4a693d3e8e45599d04f399102439436bceb4377f909c3f66c59877a083a5fda7898d9e0ac8b3e9e81887ed077758d05473cfcddae2508d7d2c77bae9dd2feb5d5c28b7f1a2d3a7036822329fec825a2f7d4b33352e9bdb5c8a670821dc6938a8185acf80285dd9c95a0bb6eb9c601b49660105d08784c52aa8ac453ce9e2faecddceadc43c59f45f0363e516facbebbf4f9dd59c307f5d04cc31587a7ee46977c98daf2a1507401550a16ef1ad2fa8a713ee85fbcea3e746220fbd9f31057112ff4f210054a6054984c3a7bd25be3d41744abdc2ddd9b3191783d460dd792439ca7f920cb7781404a4e41afaed4c27eb4788b4c3560fe15098927b159c3e26fa0212e2996d1e54db9a388eb07c1e94be78beceaa6ff0d36e3d5162f7dab7ad023de47293cb877ab808de670f28d2bd6499dbb2d357d43afc7cd23d86b4bdf3aa6974895bdc3bb4a3908363d61c0de2c934c1d47ea19483de74591876aab55f72cf4dfe9c88969bbd762c45a42b91b1396ad011b51fd338882a6ab602315cb7bff682ca2f5a26424d7ab5ce178c5b9e9a25d855ffc52e1b5dbc957142da46ab2e7ed49d41f75099bbb3998283617c5f590304ec64602cfb558ee28a6627008f27dd6e39d2940ed9ca211b2e9933622b08eb4dc4ae264f33952affdb1a2230e2ae72a904bc8e884cdc3e881037753f8918497e4ba574e2ff864e763a606fec3c2c42d5dafe7ee2df815e74f2bf84431f262525b45dbdbac0117eb16da3dbe25589ba27fdb16be3f624c580af8dd2e8136bef1bcf4019b9e820f9fee1ca9617df39135b857b478484f1606a9e54287223c2e6e8d0ef28e085d5d813a55de04b13112a80b9e97ef0a3492fd9c2bf504887110842ee75e18c114a2f01707be3862f88641212046222c357f82ddad68d899645f30b9a0e3411d9fc2f25ae2d5277a8ed29d19043a3b0fe056eb8d8c9a6ae446a00170d442f2ecc7c888dda6869747fe8e98d26730ff60f728d0e080cf63e44ec0bc72932c375894c729bda2b364a1272612c2005dcad021f513cc99590d3eddcbd0943208feb340699371199f997cf783a220f9ebf0c577f5211d831d28470392d0197189f131ca1a02c4ed8f581a131ab78fed3c28ba57a9b787edccc00ef37affcc97ec2533c8c7da5fe36aebe0ec8dd591db70d50dda2f299e8275406d7a9bf51b0658585a85feedae530189b95f4ccbedef04351ee61678ac468a29a45259542db3f0064ece7bc6c142a5c837a3f1dc88f8cc2e6060172097715954ec0ec652be99031c4992cd6f36eee6c911a9ab190ad2b2d7035c3b6210bcad1b5bd0d61ca737bf71e916f427c8d31608979a229f9453b1a59f1d9745792e11756f8bade632479f283837a0631512f8e5bccfd1c96626614cda4cd142db5f002bafe95c0be41773d65be80d2e4893087bba63a5f40732a33fabdfe321b102c6ac91cb5a71f653bed7ff0363414697b7188d9bb18c6f876290819145fa62b01487d8d336ef7432108a27ff2dcd1c2a1f928d33de86710f05b5cecb5d841822f94a7c87dabfbf16c2140c606ff3a9be325ad994e8bd6d02323c345a7f33b818493827c28b14cbda8196220c04eab3503e0d4a472ba33f7e7bb3f70f202bdd1c22e5f4c009aafe30d35304be91d9cc0df86fa67186e454bf11475fb89e70283aebd7d3b913baa865e57d465418ac32295631ab9902c09334fc549604ff49152c6ab93e45b2d09989ed85c9e8de26953bdf3a4b9385164e6ffdf7ed7d738e1d7d39cee2ab60f6a66893c10e12c81c6ddd594901db8b5efddc795489b9971b83de53181631fafa8a4ff4e947ecaba4221b793786563b3dfdcd62f39e7ce4cc095102ec2af345a2dfd680dcfbaa5082bb2aa760182b34c5011b9d513f45561ca7912338109e1f053dfb2eba6c189f36043477b7e9c5f6bd93049e6a50aa4e2ef845c2ecc57b7c6af0b530a0483ef356a6b25403c4e7be438f97bc93e0db6beaa8b18530bdd0437eaa1597c589514b45e8d0b2b37490cb979956f60e953d627512ccdddd9603422e3a31e8c7a198f7adb725c2f5a449160bacaa9e40e728469050df5dc0481b3b19570152a01ee8c0dbdfcda5de202386dc5631c74d6d879ab522218c9dc73f6b56b65e84489ad6fa0c00b56ca99d16efc037493882bc2a7ff8684d7146f46f9c33f878ff7abaa21a236e737274c027ac570d8066c9a1e27d543385c08cc6e01c9f3970be6e184bda2b33b8b7d12c29844f5dfc4dc0a76253f66e30d55ac7cad9d54fb5ee25cfce90b2db8f1bb5542439a98e78f686688192339d5045c89a7c444ab265943e29e4ddb2814bbd2e5f32cd314bbad9a4fc256d21388e37ff2063355cfe40fd08e428eb00682c5b7121cc4ed50cf3ff83d76d2f3593d6f517835d0108bc192391b370a734cdc2f360b4607c571da9d704c39ce0b67c9ca6202bbcb92c26f338213043e3b36ab3fcdda487aca0e763cd5fbdf40ffb73006e3f1b38cafa9b2e48c19d616b701d439c6ecda6908a86cebf2bad69e4ebd837f93f4065b4d5ca11a5c0772167fd9769349be3ad33616e6dcd80b9daf13f9dcaf8ef6bc30f9e52df3da8ebe1393119b9b396c5fce3aba06387028fa21738a84e5d1c9ea15e75ff88b8b61fcadad11071b6131243666e2e04fc44d87b070697da0b91df3053166ffbad3e9603e116474d44ba83c56270532c0fec2d29862bab16692a5cb07943d9ac3be7384125bf8a087b58a6ce9af014875df6e9c91933b0e915d18825853bfa5f6aaa24d91957003503006412ad601f7f6e5d950eda140367a30f221c31008caf4c2712002aac3a387a37a98578cefe64dde557a4e36f9818cb66b18192034981ae4b1f5f392384d5f85bf6b6f562f0533de650daadbec4a8dae34fbbb56e36f87e00e507633e8599a4a9b78b8a244521bbc3a3c1e46049181dde51098bfbd4aa1f52e2ec058f907286b4c87c6552b361d06eb8a0a4b26a327faa8d2b6d446ea046a8414183e0b21a470e83555ab6aeff375b5660ed4cb0848ef1590130b1b331b1557bf37ebc4ff6e1ee9d90dbcc3cc48b5ca5bce8ed7df74cc4c2381961c9c9efc99efa0e427e7e1587a4f6673040246e3f1b800ef36d9dd100432bb957e899c5c37ae69be80ed4bb982d2380769057cee6067962b4ffa4b2cf40a6e5a732493f054bd27796ad5d9efa55bc8f59fd674f2835d9c1e7b625fcf076e7817d0d08c6fff38325c95073dbf9cd23ded73a65a8e569270b03850a6b9a9eb862bbd4cc8188e703f0e05ce34668aff8ed106f92206e688e301a625a06506762f07a9aced94c1f6c2f093d41f08778e8ca9059c14f314eb6d925825f834405c62ca90be20333e09958ea265ef5f6c000c5b62200ededa13f8521e87f453fbf48d6083be597d8a680471b7d41d1faea8fa0a67d87b4e3b1ac73cb9dcc6abdab00609398306c79ad2768adf66a6c9c076fb1c0d411571546ebb06736357218e00172e8ef00ecdc92587e712d04091e7a5f7805c2dde8e1cde90c570948c508e1e4294e0a679ae5323d68f551008fd9fa0a70929e47b1da01f19b724c840eca1d58cd30f4dc0b859763ae3beebfae87cd34526fc2eca66ca591ffd53f81b025c989f94ee3622fd8bb54341da3aa03208fe8d183ef96002869cabe74e3c0d81b49d3acfa70bd9f087cca5f74ce5bc18ec1ccb624f4d281bab848e1c617e716e922028fafb014f7e5f13a3877108c3a7bb4d67dc80bf0bbbe00134fd976901defbf35e10746a7a77d6cc11f88850bc66c047b2005f1984deb400e1a5f8d832c6da04d11caa82e03bf1d00c372c789a7a437cca4893de17d17717535ca11d09774b350d4b963d18d0c3ff275027f968a2025b3a2231b0e1d136dd67f65ebd7933a7291fb2809e0cb0c9f6b5153baecb3827282e259c1dea0192efc2b69481ff941ff7247846c1cab4d20792509907eb91fa50c9135ffba3e38a8df976b6646bbc66608f845d18bbd167af2cb621bede3bb3567b41567657e76727f9791934052c688752bd07d4afcbd7df95a9ebcaa5795e30f706768b4012c802aaf1fcd6e99814067613394950d130f61d06f25f3257278f90c791ffbad5b4ea62bd5a75035961619eb55973afae64b64b9130d3aab85b28d866416d91896845f4607d2099de578dbb060ddb83ad681e6ebeb51e184a4205c01dfd6652544a65b8d1895d26ee151f79dd076467a2655dc6a388db93697bb97dd2f128cafed56e22d589cf18d3a8117b8b82ec7840c34a149b833038abb5c1e08d3d1a22190b2b11debeb23ce1788f781d2ee4855bbb5b5b199bb08462c43558f7fdb0b4af9b879662b638abe8f56bbaca7f27d090c6cd68949a7f2e6dd41925503abf396908ebdfbe5ad1f2a628ac0fccff016e72febcd204a038d3b1bcf00f554cbe65b72a0f5c6e785d27ab6c76f9985162e4215c5b0a05c560b7ca085d6662f475887ec86730cebfc26a446ef314e84f39e2a916584c14a57509f6007d0e1883246d746a8f0544e6ed4a33dec754464db0852baa1d62df4b1460e09c277a63ce8fcecd84fd5eb127fa3a532265fd8ec62aff59246cc3e0c538d6a720f121ec7a6c61d2178a7b914c9d7aac0fe2d0ee640061c044bfd8a20e46587ae276332f2b4c58a1a4355c85cfd5b6b37aa2b11a9d50b6b0c7a98bfaaf9467c54a80a603c94c292eae73c5ae04a6eca92e9cefb27b28c70b9b6575b8d020edc0182c327c2cdc0a683ca9f527a435fa54da421a75f0fe67d39eda25030c1dad75431e7bfbd216132b8faea363a675df98f0b7571dd667d86753584d052c6780fff621a2f6010325e8de9871d68d2d176f892fa0e4d1714da27e72a8367734d4a1d8fac65c88c70591fe094e5cadb73b5437001bc3a9775233b9e1a6eb144df5454258bffc3ab3f6a3adbeccc4ba1618b73dc55bb5ebd698940a848814cb57cb1f140b0cc9a2bae31e5d9907c272db063731e99ea2be881be14106a43cf9deed98f1e580314927e2ac05431f3609635cf9dc1bfffee3d14836e3b5620b8f7d9e5420275dfde55010069686441ab85191c777c672e4c2fd5c43e9fa587d87623d3ce557186e454bf11475fb89e70283aebd7d3b913baa865e57d465418ac32295631abdaa01be372f6428157f7767c6e507f03d8fb0698ed26ad8764efd8e3b6ec1b1128b50cd72eadcd56594e2ce0cf4a266132526e7735f8d70abe796dc6ea68723b9902c09334fc549604ff49152c6ab93e45b2d09989ed85c9e8de26953bdf3a4b9385164e6ffdf7ed7d738e1d7d39cee2ab60f6a66893c10e12c81c6ddd594901b49f79539224ca82db1a18cb19f706b20bfb31275e009c30127184199ee28bab665e6b28eeb70fdfb406fc715536773628274003066aefcfc27da268f50bc45154481c944793a119c342103c58aa95667e9c067d65e0b8d63e90c24f32285ad9bb97edd4626c9f3fe213675e77a8b89dc0064e69d17760c49f539df7f6f264669c1f516d640fe9809bf2e63ceb40100ce610aef9fc4ff097abf5e513554ab3aced21e85b958da061a7d2de3f534c579f55a783af34ee1f115595c998f32f2fe5b16de77414be3c1dbe1233334eba30a14bb7b5fa3e31571f6d6219dfd34f496912e07806d8b1f8a1c0cff9f42e6433837f7f2f318a9c03ee8a947ba0416590c87e3511ada3b8e3dd85c772c4fa857de75a0d9aee3a4f3133678f99fa30519a870f7110c082dfcf32eb01c004f6e9d6c1b3e108984f9177201408040b10dd5aae45bc58305e847bf7ba35c3f97bd413925c7094c9cb9e54a9c825367c59068423a2d871e85613498231e9f4f83f178ce9cfa85da466376567cb38142168fd804c0067b93558cd2e0d9e8807e92def408b8eb3efdce5ca51d392e7bf06b7b7d5aadd05227d28bfe1e6fdd68e2c7a8f275a1d359c60fd4f3a95078c131ccf6a47b40b799d9b581379b3321c1591c48e9b3561c137a48c447b51a1b2758a7728d57dd7ac9cff1db3a58000b9c1fe32d7dd59631fffc1d5425dbd75fb4f5e99ba7c902bfa413c7237cec4bc0cf0f59f17d1fc4959b7661aa89373efa9bfd5bc9403d82743aa179b0610a98eda4b028251df592cac0cb95d8d37720f88345d471da63526b6ce8a0f19f9cf0326784128890105e9bd0ac1e913d2e42d5c01cd9c8f8574e6d7d9b362af55379c8abd0ec8296f01340f2991eb274effbb0943d386716df1fa2dd0fb957b3f79b13cba530f693b50f84234f3299d45e00fb4be60cd95d2ac4101279fad4fdf9510d2988c139ef32593b2255d74660095f38321ff6c300555c60045434f12d9e68f6f28896adc7054788724bc34c704ce8c1e2f3f5fe90174ecefecb37ebbfed41e030bfca7ac60f6739e123478434534f5e60fa3733b81177e63fc956191312c831f77d80837c61771a3d4d6d646ae0ebd9de19f2d1c93edff35a2fc6a00481a5b3919bd6883f7619d1a05c62be002110032daaaff23f0efda24c4d4e472c9a35934a2db4ed4f5ad94b9eadc689b0368ccbb1314b5993c9e33ead8aaf6c1d937b7f500c760c15fcfbd8f7ef74c9a76397bb8dff93ffc16df95866d15efca4e9bec6b29c6714e527c0f1ead076eb9fc48f233c3f337f958d4e0673ed79347caeba4b7e7ef85cf92a6666b9a2f4ced866ab018915108c754d5dbf4b92bb761d8f519922d866943cf5d07150192ff373cca89881d43a3e68d96184142fcb5391ce4431630f1217d65cd1f6a7a3b5a4a63c615bbfc018d5cf5c0e8448edb5e8a834506214be78b70dd45bf3e5925fa3fe0c0c6410c017cc6e6ab30b4e2aefcaf4932f96eb61a6fff9fa4d55de821b5183ad89a039f5628db4869bcf4d6ade0a422df2c6f8bfdfbaf7fb658449d365321112f1186e497a89fb426e659391a6ed4a0788280982337207ce1ba6382cc461026e46132f6ede248baebf4fa9223e88ba83c3aa7ba193776ab336d42955bba1fc047326d615d332a5140e09ccf4b4f233fdcacf30f533b5f15c9ef7826ed14382cd31bb55b743ac7dffc03ad234d2d5566157b62ffd2426d5cb6a44fbfbe381a1808e529f26765ba9e05e56b3b06c842124bce70635f166ef1e609e99f8ba41844e9faf93bb7a3f81d2e8d8714f4727757ce02e32971f76b129fd97deb4ef3d565c4a58d387d296f5e2ae411ca8b5ed340056f76bd372ad23f2cc8c24febb3e836cee9b377076fc3934ab0df691855f8e19aa2413d7e54c00303b70dcfd28b0708974c470416bb08d86da68f1f5dbecb17fbf7e66f136977c1b5fff486b93d4760b608fcfad7d9e567f0283bfcd35006123d0fc54b0a0a0373b8ae38ec35200788f1c1d270cc00bfbee7cb65f762ec3bd80e439cd2efc8b4e6825279fb48d2d87190a75bda3aa29bf14c03eb115a5be6b291f7a9805cdaab6465c61d3290fe63d403be79683d806b12746c7d6fd5ede1eaf6e508e3a7d29023d7bea4db67a2337127ec0e911a346d8c582299ebe6de630789a99949982d29674be81e99c05f9167813a00afbacd30bd0763edf4dd8c10a03d16e92dcc6dbb27b0230fcde072e89f6a8581f1d4c5dba6603b6d5bde6d42f80a10ead1635750c998582d4c85a9da9283aa62616dd4bcbe8900f84d5171f9ab92db0f3b27571fde4562ae3c51d103ad83dc2febf8577c156a6447de30ca5a66f4e26961cf12fe84a11ec7815c19c02f1b793a0e91d7302ce9a650e13fb81fbd66d70f0f3d0852453201c93951888d8c785d218ed49f70b49ef56dd0bc07706e4c421dfa6625e1f1c25cc00f5c21b152f653d90cb879fd1d2d864c0eaea2527e7235f5ef357810d29ac3f21de79c2fe6cac5eb5a0f53d781ab4b78d65a1764e7e7626c31b779a8ac4ea0792e8cfa95001aef51535d7bd3718a575ec70d97531470731255e0f52a907b2d4ce36cbf059bc84d31ec949fdff5ea4c987f6cf58a2ad86bb944e011439a0431c8344fea545a0e3031b8e38f8c23767c6b67f36e1824b1b48f71b3dc52d8054317c281ac05eb8506c38368b37f732e55538534e6ce61784b30d5fd24c24062f8115e49ac49630c5e06fb91fa4bf4e09f2836fb367185d4cd4da6b1362006d666ebae9dadd433785321b143889a46f5b0985ecda1e03bd067b178237fd89e2fdd6b958af8e32e802c52f725d0047f2c67a0435efee12ffa020736bee7e081dc7ca5b84a86e2a68ed1c6978a050f6077448b201d2d1c23e13e38a0df6de9a02033fc479bb9f37e6377b64a119436024d9a581c0f137add81539fe233ca5d947ed65c6cef9a6114fd6ed6ed6f6372e6ccc8e28e611e07bbf8b9c3695734bd4a1533a7c38b8c0696afe1c3949239c7653522e627fbfc8ad866648f71aa19abe71e20f50ddbf20de0d7273f7e6dd2a7fc14ef0693069e233c4243a39a6ace0cf7e38eb0988c7bd2c68f8018e3727012f2457fb91dd9470f0670e3d48e3144973967f7d31b318d8d7135566113eb5883ca541ff63f5a999a97b2a7a32029058010f7b7f1ce9e7918ed9e45408943b8f8bc606bffebeabbbd9bfafd8bd13cd66e3df6b4e77b3d4690ec1d5d5721c3caee7f629bf25910c240dc2f24d1e487e69ee2d54dfa0f74fd5364bc8b06d9efb836eb8857bc64b9264e6105b0652f2e1e4c9d31dfd0a06568238bbf6bc3d58ada9a7dc75a26de4e324f4b798b2d8938a692f25e82e3da8dbdb84b3e646de7fe0f80a185b7c69838603148905e9b55c58db1c3741e9b4fe0621bee7d5b5f7709f90bc0649902c09334fc549604ff49152c6ab93e45b2d09989ed85c9e8de26953bdf3a4b9385164e6ffdf7ed7d738e1d7d39cee2ab60f6a66893c10e12c81c6ddd59490171e2ad35b4241a19558c2d90110e52a291f4d25b917bf027deb77dfb03aa570cddf7adeb90dccd6ba965633c2cb28700fb70311cbfe3e7c67cae417c3c162b29/usr/share/java/pki/pki-ca.jar/usr/share/java/pki/pki-certsrv.jar/usr/share/java/pki/pki-cms.jar/usr/share/java/pki/pki-cmsbundle.jar/usr/share/java/pki/pki-cmscore.jar/usr/share/java/pki/pki-cmsutil.jar/usr/share/java/pki/pki-nsutil.jar/usr/share/pki/server/webapps/pki/admin/consolerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootpki-core-10.5.18-24.el7_9.src.rpmpki-ca    java-1.8.0-openjdk-headlesspki-serverrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)systemd-unitssystemd-unitssystemd-unitsrpmlib(PayloadIsXz)10.5.18-24.el7_93.0.4-14.6.0-14.0-15.2-14.11.3cY!@cD @cob@bf@a*@as@aA@a`@``e@`6?`%@_$_@_@^V@^@^@^U@^=@^@^]]@]@]]v>]R@] u@\\@\f\T4\R@\\U@\[@[{[l,[`O@[U@[>@[d@[@[o[@ZUZ@Z@ZZxG@Zg#Z.s@Z@Z ZYYY@Y@Y@YoIYlYGY>@Y5GY-^Y$$@Y"Y@Y#@X@XX@XO@X*XRXOX!@X&X2@WWҤ@WίW#W:WWt@W{@Wu WgWV@WV@WV@WV@WV@WV@W 10.5.18-24Dogtag Team 10.5.18-23Dogtag Team 10.5.18-22Dogtag Team 10.5.18-21Dogtag Team 10.5.18-20Dogtag Team 10.5.18-19Dogtag Team 10.5.18-18Dogtag Team 10.5.18-17Dogtag Team 10.5.18-16Dogtag Team 10.5.18-15Dogtag Team 10.5.18-14Dogtag Team 10.5.18-13Dogtag Team 10.5.18-12Dogtag Team 10.5.18-11Dogtag Team 10.5.18-10Dogtag Team 10.5.18-9Dogtag Team 10.5.18-8Dogtag Team 10.5.18-7Dogtag Team 10.5.18-6Dogtag Team 10.5.18-5Dogtag Team 10.5.18-4Dogtag Team 10.5.18-3Dogtag Team 10.5.18-2Dogtag Team 10.5.18-1Dogtag Team 10.5.17-6Dogtag Team 10.5.17-5Dogtag Team 10.5.17-4Dogtag Team 10.5.17-3Dogtag Team 10.5.17-2Dogtag Team 10.5.17-1Dogtag Team 10.5.16-3Dogtag Team 10.5.16-2Dogtag Team 10.5.16-1Dogtag Team 10.5.9-13Dogtag Team 10.5.9-12Dogtag Team 10.5.9-11Dogtag Team 10.5.9-10Dogtag Team 10.5.9-9Dogtag Team 10.5.9-8Dogtag Team 10.5.9-7Dogtag Team 10.5.9-6Dogtag Team 10.5.9-5Dogtag Team 10.5.9-4Dogtag Team 10.5.9-3Dogtag Team 10.5.9-2Dogtag Team 10.5.9-1Dogtag Team 10.5.1-13.1Dogtag Team 10.5.1-13Dogtag Team 10.5.1-12Dogtag Team 10.5.1-11Dogtag Team 10.5.1-10Dogtag Team 10.5.1-9Dogtag Team 10.5.1-8Dogtag Team 10.5.1-7Dogtag Team 10.5.1-6Dogtag Team 10.5.1-5Dogtag Team 10.5.1-4Troy Dawson - 10.5.1-3Dogtag Team 10.5.1-2Dogtag Team 10.5.1-1Dogtag Team 10.5.0-1Dogtag Team 10.4.1-15Dogtag Team 10.4.1-14Dogtag Team 10.4.1-13Dogtag Team 10.4.1-12Dogtag Team 10.4.1-11Dogtag Team 10.4.1-10Dogtag Team 10.4.1-9Dogtag Team 10.4.1-8Dogtag Team 10.4.1-7Dogtag Team 10.4.1-6Dogtag Team 10.4.1-5Dogtag Team 10.4.1-4Dogtag Team 10.4.1-3Dogtag Team 10.4.1-2Dogtag Team 10.4.1-1Dogtag Team 10.4.0-1Dogtag Team 10.3.3-18Dogtag Team 10.3.3-17Dogtag Team 10.3.3-16Dogtag Team 10.3.3-15Dogtag Team 10.3.3-14Dogtag Team 10.3.3-13Dogtag Team 10.3.3-12Dogtag Team 10.3.3-11Dogtag Team 10.3.3-10Dogtag Team 10.3.3-9Dogtag Team 10.3.3-8Dogtag Team 10.3.3-7Dogtag Team 10.3.3-6Dogtag Team 10.3.3-5Dogtag Team 10.3.3-3Dogtag Team 10.3.3-2Dogtag Team 10.3.3-1Dogtag Team 10.3.3-0.1Dogtag Team 10.3.2-5Dogtag Team 10.3.2-4Dogtag Team 10.3.2-3Dogtag Team 10.3.2-2Dogtag Team 10.3.2-1Dogtag Team 10.3.2-0.1Dogtag Team 10.3.1-1Dogtag Team 10.3.0-1Dogtag Team 10.3.0.b1-1Dogtag Team 10.3.0.a2-2Dogtag Team 10.3.0.a2-1Dogtag Team 10.3.0.a1-2Dogtag Team 10.3.0.a1-1Dogtag Team 10.3.0-0.5Dogtag Team 10.3.0-0.4Dogtag Team 10.3.0-0.3Dogtag Team 10.3.0-0.2Dogtag Team 10.3.0-0.1Dogtag Team 10.2.7-0.3Tomas Radej - 10.2.7-0.2Dogtag Team 10.2.7-0.1Dogtag Team 10.2.6-1Dogtag Team 10.2.6-0.3Dogtag Team 10.2.6-0.2Dogtag Team 10.2.6-0.1Dogtag Team 10.2.5-1Dogtag Team 10.2.5-0.2Dogtag Team 10.2.5-0.1Dogtag Team 10.2.4-1Dogtag Team 10.2.4-0.2Dogtag Team 10.2.4-0.1Dogtag Team 10.2.3-1Dogtag Team 10.2.3-0.1Dogtag Team 10.3.0-0.1Dogtag Team 10.2.3-0.1Dogtag Team 10.2.2-1Dogtag Team 10.2.2-0.1Dogtag Team 10.2.1-1Matthew Harmsen - 10.2.1-0.4Ade Lee 10.2.1-0.3Christina Fu 10.2.1-0.2Dogtag Team 10.2.1-0.1Ade Lee 10.2.0-3Matthew Harmsen - 10.2.0-2Dogtag Team 10.2.0-1Matthew Harmsen - 10.2.0-0.10Matthew Harmsen - 10.2.0-0.9Matthew Harmsen - 10.2.0-0.8Fedora Release Engineering - 10.2.0-0.5Jack Magne - 10.2.0-0.7Matthew Harmsen - 10.2.0-0.6Matthew Harmsen - 10.2.0-0.5Ade Lee - 10.2.0-0.4Fedora Release Engineering - 10.2.0-0.3Michael Simacek - 10.2.0-0.2Dogtag Team 10.2.0-0.1Ade Lee 10.1.0-1Ade Lee 10.1.0-0.14Ade Lee 10.1.0-0.13Ade Lee 10.1.0-0.12Ade Lee 10.1.0-0.11Endi S. Dewata 10.1.0-0.10Abhishek Koneru 10.1.0.0.9Abhishek Koneru 10.1.0.0.8Endi S. Dewata 10.1.0-0.7Endi S. Dewata 10.1.0-0.6Endi S. Dewata 10.1.0-0.5Ade Lee 10.1.0-0.4Endi S. Dewata 10.1.0-0.3Matthew Harmsen 10.1.0-0.2Ade Lee 10.1.0-0.1Endi S. Dewata 10.0.2-5Ade Lee 10.0.2-4Ade Lee 10.0.2-3Endi S. Dewata 10.0.2-2Ade Lee 10.0.2-1Ade Lee 10.0.2-0.8Endi S. Dewata 10.0.2-0.7Endi S. Dewata 10.0.2-0.6Ade Lee 10.0.2-0.5Endi S. Dewata 10.0.2-0.4Endi S. Dewata 10.0.2-0.3Endi S. Dewata 10.0.2-0.2Endi S. Dewata 10.0.2-0.1Endi S. Dewata 10.0.1-9Ade Lee 10.0.1-8Endi S. Dewata 10.0.1-7Matthew Harmsen 10.0.1-6Endi S. Dewata 10.0.1-5Endi S. Dewata 10.0.1-4Matthew Harmsen 10.0.1-3Matthew Harmsen 10.0.1-2Ade Lee 10.0.1-1Matthew Harmsen 10.0.0-5Matthew Harmsen 10.0.0-4Ade Lee 10.0.0-3Ade Lee 10.0.0-2Ade Lee 10.0.0-1Matthew Harmsen 10.0.0-0.56.b3Endi S. Dewata 10.0.0-0.55.b3Endi S. Dewata 10.0.0-0.54.b3Ade Lee 10.0.0-0.53.b3Ade Lee 10.0.0-0.52.b3Endi S. Dewata 10.0.0-0.51.b2Endi S. Dewata 10.0.0-0.50.b2Matthew Harmsen 10.0.0-0.49.b2Ade Lee 10.0.0-0.48.b2Matthew Harmsen 10.0.0-0.47.b1Ade Lee 10.0.0-0.46.b1Ade Lee 10.0.0-0.45.b1Ade Lee 10.0.0-0.44.b1Ade Lee 10.0.0-0.43.b1Ade Lee 10.0.0-0.42.b1Ade Lee 10.0.0-0.41.b1Ade Lee 10.0.0-0.40.b1Endi S. Dewata 10.0.0-0.40.a2Endi S. Dewata 10.0.0-0.39.a2Ade Lee 10.0.0-0.38.a2Endi S. Dewata 10.0.0-0.37.a2Ade Lee 10.0.0-0.36.a2Endi S. Dewata 10.0.0-0.36.a1Endi S. Dewata 10.0.0-0.35.a1Endi S. Dewata 10.0.0-0.34.a1Ade Lee 10.0.0-0.33.a1Matthew Harmsen 10.0.0-0.32.a1Endi S. Dewata 10.0.0-0.31.a1Endi S. Dewata 10.0.0-0.30.a1Endi S. Dewata 10.0.0-0.29.a1Endi S. Dewata 10.0.0-0.28.a1Endi S. Dewata 10.0.0-0.27.a1Endi S. Dewata 10.0.0-0.26.a1Endi S. Dewata 10.0.0-0.25.a1Endi S. Dewata 10.0.0-0.24.a1Matthew Harmsen 10.0.0-0.23.a1Endi S. Dewata 10.0.0-0.22.a1Endi S. Dewata 10.0.0-0.21.a1Matthew Harmsen 10.0.0-0.20.a1Matthew Harmsen 10.0.0-0.19.a1Matthew Harmsen 10.0.0-0.18.a1Endi S. Dewata 10.0.0-0.17.a1Matthew Harmsen 10.0.0-0.16.a1Ade Lee 10.0.0-0.15.a1Christina Fu 10.0.0-0.14.a1Endi S. Dewata 10.0.0-0.13.a1Endi S. Dewata 10.0.0-0.12.a1Ade Lee 10.0.0-0.11.a1Matthew Harmsen 10.0.0-0.10.a1Matthew Harmsen 10.0.0-0.9.a1Jack Magne 10.0.0-0.8.a1Matthew Harmsen 10.0.0-0.7.a1Endi S. Dewata 10.0.0-0.6.a1Ade Lee 10.0.0-0.5.a1Endi S. Dewata 10.0.0-0.4.a1Matthew Harmsen 10.0.0-0.3.a1Matthew Harmsen 10.0.0-0.2.a1Nathan Kinder 10.0.0-0.1.a1Ade Lee 9.0.16-3Endi S. Dewata 9.0.16-2Matthew Harmsen 9.0.16-1Matthew Harmsen 9.0.15-1Matthew Harmsen 9.0.14-1Ade Lee 9.0.13-1Matthew Harmsen 9.0.12-1Matthew Harmsen 9.0.11-1Matthew Harmsen 9.0.10-1Matthew Harmsen 9.0.9-1Matthew Harmsen 9.0.8-2Matthew Harmsen 9.0.8-1Matthew Harmsen 9.0.7-1Matthew Harmsen 9.0.6-2Matthew Harmsen 9.0.6-1Matthew Harmsen 9.0.5-2Matthew Harmsen 9.0.5-1Matthew Harmsen 9.0.4-1Matthew Harmsen 9.0.3-2Matthew Harmsen 9.0.3-1Matthew Harmsen 9.0.2-1Matthew Harmsen 9.0.1-3Matthew Harmsen 9.0.1-2Matthew Harmsen 9.0.1-1Matthew Harmsen 9.0.0-3Matthew Harmsen 9.0.0-2Matthew Harmsen 9.0.0-1- ########################################################################## - # RHEL 7.9 (Batch Update 19): - ########################################################################## - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen) - ########################################################################## - # RHCS 9.7 (Batch Update 19): - ########################################################################## - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [certificate_system_9.7.z] (ckelley, mharmsen)- ########################################################################## - # RHEL 7.9 (Batch Update 18): - ########################################################################## - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen) - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley) - ########################################################################## - # RHCS 9.7 (Batch Update 18): - ########################################################################## - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [certificate_system_9.7.z] (ckelley, mharmsen) - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)- ########################################################################## - # RHEL 7.9 (Batch Update 17): - ########################################################################## - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen) - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley) - ########################################################################## - # RHCS 9.7 (Batch Update 17): - ########################################################################## - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE [certificate_system_9.7.z] (ckelley, mharmsen) - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)- ########################################################################## - # RHEL 7.9 (Batch Update 15): - ########################################################################## - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when debug level set to maximum [RHEL 7.9.z] (cfu) - Bugzilla Bug #2082717 - SCEP manual approval failure (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 14): - ########################################################################## - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when debug level set to maximum [RHEL 7.9.z] (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 11): - ########################################################################## - Bugzilla Bug 1998597 - TPS RA Separation Issues (cfu) - Bugzilla Bug 2008319 - PKISpawn with ECC Signing Algorithms fail in FIPS Mode (cfu) - Bugzilla Bug 2018608 - Invalid certificates with creation of subCA (pkispawn single step) [rhel-7.9.0.z] (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 10): - ########################################################################## - Bugzillla Bug 1978345 - End Entity's List Certificates Page Back/Forward Buttons are Broken (ckelley, jonahon.d.parrish@mail.mil, mharmsen) - Bugzilla Bug 2008707 - pkispawn bails out too easily for things that could have been worked around after installation [RHEL 7.9.z] (cfu) - Bugzilla Bug 2016773 - Directory authentication plugin requires directory admin password just for user authentication (rhel-7.9.z) (awnuk@purestorage.com, jmagne) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 9): - ########################################################################## - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500 [ftweedal, ckelley] - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9 (Batch Update 8): - ########################################################################## - Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu] - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx response from CA REST API: 500 [ftweedale, ckelley] - ########################################################################## - # RHCS 9.7 (Batch Update 8): - ########################################################################## - Bugzilla Bug 1959937 - TPS Allowing Token Transactions while the CA is Down [cfu] - Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile Separation [cfu]- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission per LDAP group without immediate issuance [rhel-7.9.z] (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1911472 - Revoke via REST API not working when Agent certificate not issued by CA [rhel-7.9.z] (cfu) - Bugzilla Bug 1914587 - RHEL IPA PKI - Failed to read product version String.java.io.FileNotFoundException (ckelley) - Bugzilla Bug 1942687 - TPS not populating Token Policy, or switching PIN_RESET=YES to NO [rhel-7.9.z] (jmagne) - Bugzilla Bug 1955633 - Recovery of Keys migrated to latest version of KRA fail to recover and result in Null Point Exception [rhel-7.9.z] (jmagne) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1949136 - PKI instance creation failed with new 389-ds-base build (jmagne) - Bugzilla Bug 1949656 - CRMF requests with extensions other than SKID cannot be processed (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)- Change variable 'TPS' to 'tps' - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates profiles, audit for IPA (edewata) - ########################################################################## - # Backported CVEs (ascheel): - ########################################################################## - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token parameters in TPS resulting in stored XSS [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile creation [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site Scripting in 'path length' constraint field in CA's Agent page [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site scripting in getcookies?url= endpoint in CA [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab [rhel-7.9.z] (ascheel) - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne) - ########################################################################## - Update to jquery v3.4.1 (ascheel) - Update to jquery-i18n-properties v1.2.7 (ascheel) - Update to backbone v1.4.0 (ascheel) - Upgrade to underscore v1.9.2 (ascheel) - Update to patternfly v3.59.3 (ascheel) - Update to jQuery v3.5.1 (ascheel) - Upgrade to bootstrap v3.4.1 (ascheel) - Link in new Bootstrap CSS file (ascheel) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates profiles, audit for IPA (edewata) - ########################################################################## - # Backported CVEs (ascheel): - ########################################################################## - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token parameters in TPS resulting in stored XSS [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile creation [certificate_system_9-default] (edewata, ascheel) - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site Scripting in 'path length' constraint field in CA's Agent page [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site scripting in getcookies?url= endpoint in CA [rhel-7.9.z] (dmoluguw, ascheel) - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab [rhel-7.9.z] (ascheel) - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne) - ########################################################################## - Update to jquery v3.4.1 (ascheel) - Update to jquery-i18n-properties v1.2.7 (ascheel) - Update to backbone v1.4.0 (ascheel) - Upgrade to underscore v1.9.2 (ascheel) - Update to patternfly v3.59.3 (ascheel) - Update to jQuery v3.5.1 (ascheel) - Upgrade to bootstrap v3.4.1 (ascheel) - Link in new Bootstrap CSS file (ascheel) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Bugzilla Bug #1883639 - additional fix to upgrade script (edewata)- Bugzilla Bug #1883639 - additional support on upgrade for audit cert profile and auditProfileUpgrade + auditProfileUpgrade part 2 (cfu)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1883639 - add profile caAuditSigningCert (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1710978 - TPS - Add logging to tdbAddCertificatesForCUID if - # Bugzilla Bug #1858860 - TPS - Update Error Codes returned to client - # Bugzilla Bug #1858861 - TPS - Server side key generation is not working - # Bugzilla Bug #1858867 - TPS does not check token cuid on the user- Patch for CMCResponse tool - Bugzilla Bug #1710109 - add RSA PSS support - fix CMCResponse tool (jmagne)- Patch for CMC Credential Error, RSA PSS typo, and new profile for directory-authentication-based Server-Side keygen - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1710109 - add RSA PSS support (jmagne) - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Updated jss dependencies - Bugzilla Bug #1710109 - add RSA PSS support - fix SHA512 (jmagne)- ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE additional support and touch-up (cfu) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1710975 - TPS - Searching the certificate DB for a brand new- Updated jss dependencies - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu) - Bugzilla Bug #1809273 - CRL generation performs an unindexed search (jmagne) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1549307 - No default TPS Auditor group (ascheel)- Bugzilla Bug #1710109 - add RSA PSS support - fix IPA installer (jmagne)- Updated jss dependencies - ########################################################################## - # RHEL 7.9: - ########################################################################## - Bugzilla Bug #1774174 - Rebase pki-core from 10.5.17 to 10.5.18 (RHEL) - ########################################################################## - # RHCS 9.7: - ########################################################################## - # Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and - # Bugzilla Bug #1774181 - Update RHCS version of CA, KRA, OCSP, and TKS so- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1723008 - ECC Key recovery failure with CKR_TEMPLATE_INCONSISTENT (cfu) - Bugzilla Bug #1774282 - pki-server-nuxwdog template has pid file name with non-breakable space char encoded instead of 0x20 space char (ascheel) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS client (cfu) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Include 'pistool' in the 'pki-tools' package- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1445479 - KRATool does not support netkeyKeyRecovery attribute (dmoluguw) - Bugzilla Bug #1534013 - Attempting to add new keys using a PUT KEY APDU to a token that is loaded only with the default/factory keys (Key Version Number 0xFF) returns an APDU with error code 0x6A88. (jmagne) - Bugzilla Bug #1709585 - PKI (test support) for PKCS#11 standard AES KeyWrap for HSM support (cfu, ftweedal) - Bugzilla Bug #1748766 - number range depletion when multiple clones created from same master (ftweedal) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1520258 - TPS token search fails to find entries , LDAP filter - # Bugzilla Bug #1535671 - RFE to have the users be able to use the- ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1523330 - CC: missing audit event for CS acting as TLS client (cfu) - Bugzilla Bug #1597727 - CA - Unable to change a certificate’s revocation reason from superceded to key_compromised (rhcs-maint) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1470410 - TPS doesn't update revocation status when - # Bugzilla Bug #1470433 - Add supported transitions to TPS (rhcs-maint) - # Bugzilla Bug #1585722 - TMS - PKISocketFactory – Modify Logging to Allow - # Bugzilla Bug #1642577 - TPS – Revoked Encryption Certificates Marked as- Updated jss, nuxwdog, and tomcatjss dependencies - ########################################################################## - # RHEL 7.8: - ########################################################################## - Bugzilla Bug #1733586 - Rebase pki-core from 10.5.16 to 10.5.17 (RHEL) - ########################################################################## - # RHCS 9.6: - ########################################################################## - # Bugzilla Bug #1718418 - Update RHCS version of CA, KRA, OCSP, and TKS so - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.7: - ########################################################################## - Bugzilla Bug #1638379 - PKI startup initialization process should not depend on LDAP operational attributes [ftweedal] - ########################################################################## - # RHCS 9.5: - ########################################################################## - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.7: - ########################################################################## - Bugzilla Bug #1491453 - Need Method to Include SKI in CA Signing Certificate Request [ftweedal] - ########################################################################## - # RHCS 9.5: - ########################################################################## - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Updated jss dependencies - ########################################################################## - # RHEL 7.7: - ########################################################################## - Bugzilla Bug #1633422 - Rebase pki-core from 10.5.1 to 10.5.16 (RHEL) - ########################################################################## - # RHCS 9.5: - ########################################################################## - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] [manpage] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- Updated jss dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1671245 - CC: unable to verify cert before import [rhel-7.6.z] (ascheel) - Bugzilla Bug #1671303 - CC: Upgrade scripts for audit event names (RHEL) [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1671586 - CC: Upgrade scripts for audit event names (RHCS)- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1659939 - CC: Simplifying Web UI session timeout configuration [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA, - # Added Batch Update Information to Product Version (mharmsen)- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1657922 - CC: CA/OCSP startup fail on SystemCertsVerification if enableOCSP is true [rhel-7.6.z] (jmagne) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1645262 - pkidestroy may not remove all files [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1645263 - Auth plugins leave passwords in the access log and audit log using REST [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1645429 - pkispawn fails due to name collision with /var/log/pki/ [rhel-7.6.z] (dmoluguw) - Bugzilla Bug #1655951 - CC: tools supporting CMC requests output keyID needs to be captured in file [rhel-7.6.z] (cfu) - Bugzilla Bug #1656297 - Unable to install with admin-generated keys [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- Require "tomcatjss >= 7.2.1-8" as a build and runtime requirement - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1632116 - CC: missing audit event for CS acting as TLS client [rhel-7.6.z] (cfu) - Bugzilla Bug #1632120 - Unsupported RSA_ ciphers should be removed from the default ciphers list [rhel-7.6.z] (cfu) - Bugzilla Bug #1632615 - Permit certain SHA384 FIPS ciphers to be enabled by default for RSA and ECC . . . [rhel-7.6.z] (cfu) - Bugzilla Bug #1632616 - X500Name.directoryStringEncodingOrder overridden by CSR encoding (coverity changes) [rhel-7.6.z] (mharmsen) - Bugzilla Bug #1633104 - CMC: add config to allow non-clientAuth [rhel-7.6.z] (cfu) - Bugzilla Bug #1636490 - Installation of CA using an existing CA fails [rhel-7.6.z] (edewata) - Bugzilla Bug #1643878 - pki cli command for RHCS doesn't prompt for a password [rhel-7.6.z] (edewata) - Bugzilla Bug #1643879 - CC: Identify version/release of pki-ca, pki-kra, pki-ocsp, pki-tks, and pki-tps remotely [RHEL] [rhel-7.6.z] (cfu, jmagne) - Bugzilla Bug #1643880 - PKI subsystem process is not shutdown when there is no space on the disk to write logs [rhel-7.6.z] (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1639836 - CC: Identify RHCS version of CA, KRA,- Updated nuxwdog dependencies - ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #673182 - ECC keys not supported for signing audit logs (cfu) - Bugzilla Bug #1593805 - Better understanding of NSS_USE_DECODED_CKA_EC_POINT for ECC (cfu) - Bugzilla Bug #1601071 - Certificate generation happens with partial attributes in CMCRequest file (cfu) - Bugzilla Bug #1601569 - CC: Enable all config audit events (cfu) - Bugzilla Bug #1608375 - CMC Revocations throws exception with same reqIssuer & certissuer (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1596629 - ipa-replica-install --setup-kra broken on DL0 with latest version (abokovoy) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1548203 - pki console configurations that involves ldap passwords leave the plain text password in signed audit logs (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1494591 - keyGen fails when only Identity- Re-spin alpha builds- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1471935 - X500Name.directoryStringEncodingOrder overridden by CSR encoding (cfu) - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a certificate (ftweedal) - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in SharedToken scenario's (cfu) - Bugzilla Bug #1550742 - Address ECC profile overrides (cfu) - Bugzilla Bug #1562841 - servlet profileSubmitCMCSimple throws NPE (cfu) - Bugzilla Bug #1572432 - AuditVerify failure due to line breaks (cfu) - Bugzilla Bug #1592961 - Need proper default subjectDN for CMC request authenticated through SharedToken (cfu) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- ########################################################################## - # RHEL 7.6: - ########################################################################## - Bugzilla Bug #1538311 - Using a Netmask produces an odd entry in a certifcate (ftweedal) - Bugzilla Bug #1544843 - ExternalCA: Installation failed during csr generation with ecc (rrelyea, gkapoor) - Bugzilla Bug #1557569 - Re-base pki-core from 10.5.1 to latest upstream 10.5.x (RHEL) (mharmsen) - Bugzilla Bug #1580394 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC (cfu) - Bugzilla Bug #1580527 - CVE-2018-1080 pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access (ftweedal, cfu) - Bugzilla Bug #1585866 - CRMFPopClient tool - should allow option to do no key archival (cfu) - Bugzilla Bug #1588655 - Cert validation for installation with external CA cert (edewata) - ########################################################################## - # RHCS 9.4: - ########################################################################## - # Bugzilla Bug #1557570 - Re-base pki-core from 10.5.1 to- Rebuild due to build system database problem- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1585945 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC [rhel-7.5.z] (cfu) - Bugzilla Bug #1587826 - ExternalCA: Installation failed during csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor) - Bugzilla Bug #1588944 - Cert validation for installation with external CA cert [rhel-7.5.z] (edewata) - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow option to do no key archival (cfu) - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access [rhel-7.5.z] (ftweedal, cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- Updated "jss" build and runtime requirements (mharmsen) - ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu) - Bugzilla Bug #1572548 - IPA install with external-CA is failing when FIPS mode enabled. [rhel-7.5.z] (edewata) - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE [rhel-7.5.z] (cfu) - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu) - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs improvement [rhel-7.5.z] (jmagne) - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in pkispawn configuration step [rhel-7.5.z] (cfu) - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong input class_id [rhel-7.5.z] (cfu) - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System 9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for standard conformance [rhel-7.5.z] (cfu) - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1560233 - libtps does not directly depend on libz- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1550581 - CMCAuth throws org.mozilla.jss.crypto.TokenException: Unable to insert certificate into temporary database [rhel-7.5.z] (cfu) - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata) - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers [rhel-7.5.z] (cheimes, mharmsen) - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for standard conformance [rhel-7.5.z] (cfu) - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu) - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu) - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal) - Bugzilla Bug #1558919 - Not able to generate certificate request with ECC using pki client-cert-request [rhel-7.5.z] (akahat) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1560233 - libtps does not directly depend on libz- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event set (RHEL) (edewata) - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata) - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM and FIPS (edewata) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1542210 - pki console configurations that involves ldap passwords leave the plain text password in debug logs (jmagne) - Bugzilla Bug #1543242 - Regression in lightweight CA key replication (ftweedal) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event set (RHEL) (edewata) - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and audit event logging at startup (jmagne) - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA instance (alee) - Bugzilla Bug #1525306 - CC: missing CMC request and response record (cfu) - Bugzilla Bug #1532933 - Installing subsystems with external CMC certificates in HSM environment shows import error (edewata) - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm (edewata) - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers permitted in fips mode (mharmsen) - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED outcomes. (edewata) - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in SharedToken scenario's (cfu) - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown revRequest.issuer (cfu) - Bugzilla Bug #1541853 - ProfileService: config values with backslashes have backslashes removed (ftweedal) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the- Updated jss, nuxwdog, and openssl dependencies - ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in few cases (ftweedal) - Bugzilla Bug #1428021 - CC: shared token storage and retrieval mechanism (cfu) - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error (cfu) - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog (alee) - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during pkispawn (alee) - Bugzilla Bug #1520526 - p12 admin certificate is missing when certificate is signed Externally (edewata) - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA instance (alee) - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to missing nextupdate field (ftweedal) - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen) - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords in several different files after installation completes (alee) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage (jmagne) - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to setup with CMC signed certificates (cfu) - ########################################################################## - # RHCS 9.3: - ########################################################################## - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- dogtagpki Pagure Issue #2853 - Cleanup spec file conditionals- Patch applying check-ins since 10.5.1-1- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- ########################################################################## - # RHEL 7.5: - ########################################################################## - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL) - ########################################################################## - # RHCS 9.3: - ########################################################################## - #Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and- #Bugzilla Bug #1492560 - ipa-replica-install --setup-kra broken on DL0- #Require "jss >= 4.4.0-8" as a build and runtime requirement - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Resolves: rhbz #1486870,1485833,1487509,1490241,1491332 - # Bugzilla Bug #1486870 - Lightweight CA key replication fails (regressions) - # Bugzilla Bug #1485833 - Missing CN in user signing cert would cause error - # Bugzilla Bug #1487509 - pki-server-upgrade fails when upgrading from - # Bugzilla Bug #1490241 - PKCS12: upgrade to at least AES and SHA2 (FIPS) - # Bugzilla Bug #1491332 - TPS UI: need to display tokenType and tokenOrigin - # dogtagpki Pagure Issue #2764 - py3: pki.key.archive_encrypted_data: - ########################################################################## - # RHCS 9.2: - ########################################################################## - # Resolves: rhbz #1486870,1485833,1487509,1490241,1491332,1482729,1462271 - # Bugzilla Bug #1462271 - TPS incorrectly assigns "tokenOrigin" and - # Bugzilla Bug #1482729 - TPS UI: need to display tokenType and tokenOrigin- Resolves: rhbz #1463350 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1463350 - Access banner validation (edewata)- # Resolves: rhbz #1472615,1472617,1469447,1463350,1469449,1472619,1464970,1469437,1469439,1469446 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1472615 - CC: allow CA to process pre-signed CMC non-signing - # Bugzilla Bug #1472617 - CMC: cmc.popLinkWitnessRequired=false would cause - # Bugzilla Bug #1469447 - CC: CMC: check HTTPS client authentication cert - # Bugzilla Bug #1463350 - Access banner validation (edewata) - # Bugzilla Bug #1469449 - CC: allow CA to process pre-signed CMC renewal - # Bugzilla Bug #1472619 - Platform Dependent Python Import (mharmsen) - # Bugzilla Bug #1464970 - CC: CMC: replace id-cmc-statusInfo with - # Bugzilla Bug #1469437 - subsystem-cert-update command lacks --cert option - # Bugzilla Bug #1469439 - Fix Key Changeover with HSM to support SCP03 - # Bugzilla Bug #1469446 - CC: need CMC enrollment profiles for system- # Resolves: rhbz #1469432 - ########################################################################## - # RHEL 7.4: - ########################################################################## - # Bugzilla Bug #1469432 - CMC plugin default change - # Resolves CVE-2017-7537 - # Fixes BZ #1470948- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1458043 - Key recovery on token fails with invalid public key error on KRA (alee) - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client authentication cert against CMC signer (cfu) - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after deleting the any of the subsystem certs from it (ftweedal)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret) using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne) - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing certificate requests (cfu) - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC revocation non-signing cert requests (cfu) - Bugzilla Bug #1458047 - change the way aes clients refer to aes keysets (alee) - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code (alee) - Bugzilla Bug #1460028 - In keywrap mode, key recovery on KRA with HSM causes KRA to crash (ftweedal)- Require "selinux-policy-targeted >= 3.13.1-159" as a runtime requirement - Require "tomcatjss >= 7.2.1-4" as a build and runtime requirement - ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS enabled system (edewata) - Bugzilla Bug #1447144 - CA brought down during separate KRA instance creation (edewata) - Bugzilla Bug #1447762 - pkispawn fails occasionally with this failure ACCESS_SESSION_ESTABLISH_FAILURE (edewata) - Bugzilla Bug #1454450 - SubCA installation failure with 2 step installation in fips enabled mode (edewata) - Bugzilla Bug #1456597 - Certificate import using pki client-cert-import is asking for password when already provided (edewata) - Bugzilla Bug #1456940 - Build failure due to Pylint issues (cheimes) - Bugzilla Bug #1458043 - Key recovery using externalReg fails with java null pointer exception on KRA (alee) - Bugzilla Bug #1458379 - Upgrade script for keepAliveTimeout parameter (edewata) - Bugzilla Bug #1458429 - client-cert-import --ca-cert should import CA cert with trust bits "CT,C,C" (edewata) - ########################################################################## - # RHCS 9.2: - ########################################################################## - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret) using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne) - Bugzilla Bug #1445519 - CA Server installation with HSM fails (jmagne) - Bugzilla Bug #1452617 - Unable to create IPA Sub CA (ftweedal) - Bugzilla Bug #1454471 - Enabling all subsystems on startup (edewata) - Bugzilla Bug #1455617 - Key recovery on token fails because key record is not marked encrypted (alee)- Bugzilla Bug #1454603 - Unable to install IPA server due to pkispawn error (mharmsen)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1419761 - CC: allow CA to process pre-signed CMC renewal non-signing cert requests (cfu) - Bugzilla Bug #1447080 - CC: CMC: allow enrollment key signed (self-signed) CMC with identity proof (cfu) - Bugzilla Bug #1447144 - CA brought down during separate KRA instance creation (mharmsen) - Bugzilla Bug #1448903 - exception Invalid module "--ignore-banner" when defined in ~/.dogtag/pki.conf and run pki pkcs12-import --help (edewata) - Bugzilla Bug #1450143 - CA installation with HSM in FIPS mode fails (jmagne) - Bugzilla Bug #1452123 - CA CS.cfg shows default port (mharmsen) - Bugzilla Bug #1452250 - Inconsistent CERT_REQUEST_PROCESSED event in ConnectorServlet. (edewata) - Bugzilla Bug #1452340 - Ensuring common audit log correctness (edewata) - Bugzilla Bug #1452344 - Adding serial number into CERT_REQUEST_PROCESSED audit event. (edewata)- ########################################################################## - # RHEL 7.4: - ########################################################################## - Bugzilla Bug #1386303 - cannot extract generated private key from KRA when HSM is used. (alee) - Bugzilla Bug #1446364 - pkispawn returns before tomcat is ready (cheimes) - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error (cfu) - Bugzilla Bug #1448203 - CAInfoService: retrieve KRA-related values from the KRA (ftweedal) - Bugzilla Bug #1448204 - pkispawn of clone install fails with InvalidBERException (ftweedal) - Bugzilla Bug #1448521 - kra unable to extract symmetric keys generated on thales hsm (alee) - Updated "jss" build and runtime requirements (mharmsen) - ########################################################################## - # RHCS 9.2: - ########################################################################## - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne)- ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1303683 - dogtag should support GSSAPI based auth in conjuction with FreeIPA (ftweedal) - Bugzilla Bug #1385208 - RHCS 9.1 RC5 CA in the certificate profiles the startTime parameter is not working as expected. (jmagne) - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC non-signing certificate requests (cfu) - Bugzilla Bug #1426754 - PKCS12: upgrade to at least AES and SHA2 (ftweedal) - Bugzilla Bug #1445088 - profile modification cannot remove existing config parameters (ftweedal) - Bugzilla Bug #1445535 - CC: Crypto Operation (AES Encryption/Decryption) (RHEL) (alee) - Bugzilla Bug #1446874 - Missing ClientIP and ServerIP in audit log when pki CLI terminates SSL connection (edewata) - Bugzilla Bug #1446875 - Session timeout for PKI console (RHEL) (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1404480 - CC: Crypto Operation (AES Encryption/Decryption) (RHCS) (alee)- ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1282504 - Installing pki-server in container reports scriptlet failed, exit status 1 (jpazdziora) - Bugzilla Bug #1400149 - pkispawn fails to create CA subsystem on FIPS enabled system (edewata) - Bugzilla Bug #1410650 - [RFE] Add SCP03 support for sc 7 g & d cards (RHEL) (jmagne) - Bugzilla Bug #1437591 - cli authentication using expired cert throws an exception (edewata) - Bugzilla Bug #1437602 - non-CA cli looks for CA in the instance during a request (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1274086 - [RFE] Add SCP03 support for sc 7 g & d cards (RHCS) (jmagne) - ############################################################################ - # Common Criteria - ############################################################################ - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures (edewata) - Bugzilla Bug #1417307 - CC: Audit Review /Searches (edewata) - Bugzilla Bug #1419737 - CC: CMC: id-cmc-popLinkWitnessV2 feature implementation (cfu)- Require "nss >= 3.28.3" as a build and runtime requirement - Require "jss >= 4.4.0-4" as a build and runtime requirement - Require "tomcatjss >= 7.2.1-3" as a build and runtime requirement - dogtagpki Pagure Issue #2612 - Unable to clone due to pki pkcs12-cert-find failure (edewata) - ############################################################################ - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4 - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.4.x - ############################################################################ - # RHEL 7.4: - ############################################################################ - ############################################################################ - # RHCS 9.2: - ############################################################################ - ############################################################################ - # Common Criteria - ############################################################################ - Bugzilla Bug #1419734 - CC: CMC: id-cmc-identityProofV2 feature implementation (cfu) - Bugzilla Bug #1419742 - CC: CMC: provide Proof of Possession for encryption cert requests (cfu) - Bugzilla Bug #1404080 - CC: add audit event: various SSL/TLS failures (edewata) - Bugzilla Bug #1428020 - CC: CMC feature support: provided issuance protection cert mechanism (cfu)- Require "jss >= 4.4.0-1" as a build and runtime requirement - Require "tomcatjss >= 7.2.1-1" as a build and runtime requirement - ############################################################################ - Bugzilla Bug #1394309 - Rebase pki-core to 10.4.x in RHEL-7.4 - Bugzilla Bug #1394315 - Rebase redhat-pki, redhat-pki-theme, pki-core, and pki-console to 10.4.x - ############################################################################ - # RHEL 7.4: - ############################################################################ - Bugzilla Bug #1222557 - ECDSA Certificates Generated by Certificate System 8.1 fail NIST validation test with parameter field. (cfu) - Bugzilla Bug #1238684 - Generting Symmetric key fails with key-generate when --usages verify (vakwetu) - Bugzilla Bug #1246635 - user-cert-add --serial CLI request to secure port with remote CA shows authentication failure (edewata) - Bugzilla Bug #1249400 - CA EE: Submit caUserCert request without uid does not show proper error message (vakwetu) - Bugzilla Bug #1305993 - Add profile component that copies CN to SAN (ftweedal) - Bugzilla Bug #1316653 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any (edewata) - Bugzilla Bug #1325071 - add options to enable/disable cert or crl publishing. (vakwetu) - Bugzilla Bug #1330800 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?) (edewata) - Bugzilla Bug #1368410 - Misleading Logging for HSM (edewata) - Bugzilla Bug #1372052 - Unable to search certificate requests using the latest request ID (edewata) - Bugzilla Bug #1375347 - Typo in comment line of UserPwdDirAuthentication.java (edewata) - Bugzilla Bug #1376226 - IPA replica-prepare failed with error "Profile caIPAserviceCert Not Found" (ftweedal) - Bugzilla Bug #1376488 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - Bugzilla Bug #1378275 - two-step externally-signed CA installation fails due to missing AuthorityID (ftweedal) - Bugzilla Bug #1378277 - Spurious host authority entries created (ftweedal) - Bugzilla Bug #1378527 - Miscellaneous Minor Changes (edewata) - Bugzilla Bug #1381084 - KRA installation failed against externally-signed CA with partial certificate chain (edewata) - Bugzilla Bug #1382066 - Problems with FIPS mode (edewata) - Bugzilla Bug #1386371 - Remove xenroll.dll from pki-core (mharmsen) - Bugzilla Bug #1386424 - Fix packaging duplicates of classes in multiple jar files (edewata) - Bugzilla Bug #1391737 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (RHEL 7) (edewata) - Bugzilla Bug #1392068 - [RFE] add express archivals and retrievals from KRA (vakwetu) - Bugzilla Bug #1395817 - Unable to install subordinate CA with HSM in FIPS mode (edewata) - Bugzilla Bug #1397200 - pkispawn does not change default ecc key size from nistp256 when nistp384 is specified in spawn config (jmagne) - Bugzilla Bug #1399862 - Dogtag 10.3.9 Man Pages (edewata) - Bugzilla Bug #1404881 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - Bugzilla Bug #1405654 - Token memory not wiped after key deletion (RHEL) (jmagne) - Bugzilla Bug #1409946 - Request ID undefined for CA signing certificate (vakwetu) - Bugzilla Bug #1409949 - CA Certificate Issuance Date displayed on CA website incorrect (vakwetu) - Bugzilla Bug #1410650 - [RFE] Add SCP03 support (RHEL) (jmagne) - Bugzilla Bug #1411428 - Unable to create a CA clone in FIPS (edewata) - Bugzilla Bug #1412211 - Unable to set up KRA in FIPS (edewata) - Bugzilla Bug #1412681 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs (ftweedal) - Bugzilla Bug #1413132 - pki-tomcat for 10+ minutes before generating cert (edewata) - Bugzilla Bug #1413136 - Problem with default AJP hostname in IPv6 environment. (edewata) - ############################################################################ - # RHCS 9.2: - ############################################################################ - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1 (cfu) - Bugzilla Bug #1274086 - [RFE] Add SCP03 support (RHCS) (jmagne) - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed tokens (jmagne) - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working when a token is physically damaged and a temporary token is issued (jmagne) - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches (cfu) - Bugzilla Bug #1381635 - Token format with external reg fails when op.format.externalRegAddToToken.revokeCert=true (cfu) - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when set on a token (jmagne) - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (RHCS 9) (edewata) - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (RHCS) (jmagne) - Bugzilla Bug #1404900 - Dogtag 10.3.9 logging properties (edewata) - Bugzilla Bug #1405655 - Token memory not wiped after key deletion (RHCS) (jmagne) - ############################################################################- ## RHEL 7.3.z Batch Update 4 - Bugzilla Bug #1429492 - Add profile component that copies CN to SAN (ftweedal)- ## RHCS 9.1.z Batch Update 3 - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - ## RHEL 7.3.z Batch Update 3 - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System 8.1 fail NIST validation test with parameter field. (cfu) - Bugzilla Bug #1417064 - Unable to search certificate requests using the latest request ID (edewata) - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website incorrect (alee) - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs (ftweedal) - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert (edewata) - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6 environment. (edewata)- Separate original patches into RHEL and RHCS portions - ## RHEL 7.3.z Batch Update 2 - Bugzilla Bug #1404176 - logging properties and man pages (edewata) - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - ## RHCS 9.1.z Batch Update 2 - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne) - Bugzilla Bug #1404900 - RHCS logging properties (edewata)- ## RHEL 7.3.z Batch Update 2 - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port with remote CA shows authentication failure (edewata) - Bugzilla Bug #1404175 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any (edewata) - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI [pki-base] (edewata) - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS mode (edewata) - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from nistp256 when nistp384 is specified in spawn config (jmagne) - Bugzilla Bug #1404176 - logging properties and man pages (edewata) - ## RHCS 9.1.z Batch Update 2 - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI [pki-tps] (edewata) - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS tokendb shows different certificate status (cfu) - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and enroll G&D Cards (jmagne)- Marked the following RHCS 9.1.z bug: Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne) as a duplicate of RHEL 7.3.z bug: Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) and moved the patch from the RHCS 9.1.z bug to the RHEL 7.3.z bug.- ## RHEL 7.3.z Batch Update 1 - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) (added KRA key recovery via CLI in FIPS mode) - ## RHCS 9.1.z Batch Update 1 - Reverted patches associated with Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (edewata)- ## RHEL 7.3.z Batch Update 1 - Bugzilla Bug #1390318 - CA EE: Submit caUserCert request without uid does not show proper error message (alee) - Bugzilla Bug #1390319 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?) (edewata) - Bugzilla Bug #1390320 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - Bugzilla Bug #1390321 - two-step externally-signed CA installation fails due to missing AuthorityID (ftweedal) - Bugzilla Bug #1390322 - Spurious host authority entries created (ftweedal) - Bugzilla Bug #1390324 - KRA installation failed against externally-signed CA with partial certificate chain (edewata) - Bugzilla Bug #1389757 - Problems with FIPS mode (edewata) - Bugzilla Bug #1390311 - Fix packaging duplicates of classes in multiple jar files (edewata) - Bugzilla Bug #1390325 - Typo in comment line of UserPwdDirAuthentication.java (edewata) - ## RHCS 9.1.z Batch Update 1 - Bugzilla Bug #1248553 - TPS Enrollment always goes to "ca1" (cfu) - Bugzilla Bug #1274096 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - Bugzilla Bug #1379379 - Unable to read an encrypted email using renewed tokens (jmagne) - Bugzilla Bug #1379749 - Automatic recovery of encryption cert is not working when a token is physically damaged and a temporary token is issued (jmagne) - Bugzilla Bug #1381375 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches - Bugzilla Bug #1381635 - Token format with external reg fails when op.format.externalRegAddToToken.revokeCert=true (cfu) - Bugzilla Bug #1382762 - PIN_RESET policy is not giving expected results when set on a token (jmagne) - Bugzilla Bug #1382862 - TPS token enrollment fails to setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne) - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is not reflected in the TPS Web UI (edewata)- PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu) - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a dependency package (mharmsen) - PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed tokens (jmagne) - PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial number and key id on the ldap user mismatches (cfu) - PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar files (edewata)- Revert Patch: PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens (edewata) - Resolves: rhbz #1374054 - ipa-replica-install fails setting up certificate - Restores: rhbz #1319557 - pkispawn KRA instance is failing server - Removes from Errata: rhbz #1372041 - Unable to create system certificates in different tokens- PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion (ftweedal) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (edewata) - PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry deleted (ftweedal) - PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if USN plugin enabled (ftweedal) - PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per instance name (for shared HSM) (cfu) - PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs (vakwetu) - PKI TRAC Ticket #2449 - Unable to create system certificates in different tokens (edewata)- PKI TRAC Ticket #1578 - Authentication Instance Id PinDirEnrollment with authType value as SslclientAuth is not working (jmagne) - PKI TRAC TIcket #2414 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided (gkapoor) - PKI TRAC Ticket #2423 - pki_ca_signing_token when not specified does not fallback to pki_token_name value (edewata) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (akasurde) - ticket remains open - PKI TRAC Ticket #2439 - Outdated deployment descriptors in upgraded server(edewata)- PKI TRAC Ticket #690 - [MAN] pki-tools man pages (mharmsen) - CMCEnroll - PKI TRAC Ticket #833 - pki user-mod fullName="" gives an error message "PKIException: LDAP error (21): error result" (edewata) - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade. (cheimes, edewata, mharmsen) - PKI TRAC Ticket #2432 - Kra-selftest behavior is not as expected (edewata) - PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (edewata, mharmsen) - PKI TRAC Ticket #2437 - TPS UI: while adding certs for users from TPSUI pem format with/without header works while pkcs7 with header is not allowed (edewata) - PKI TRAC Ticket #2440 - Optional CA signing CSR for migration (edewata)- Bugzilla Bug #1366465 - Errata TPS upgrade test fails- PKI TRAC Ticket #978 - TPS connector man page: add revocation routing info (cfu) - PKI TRAC Ticket #1285 - [MAN] Apply 'generateCRMFRequest() removed from Firefox' workarounds to appropriate 'pki' man page (jmagne) - PKI TRAC Ticket #2246 - [MAN] Man Page: AuditVerify (cfu) - PKI TRAC Ticket #2381 - Throws exception while providing invalid module. (edewata) - PKI TRAC Ticket #2383 - CLI :: pki client-cert-request --extractable should accept only boolean value (edewata) - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA (cfu) - PKI TRAC Ticket #2399 - Dogtag 10.3.5: Miscellaneous Enhancements (akasurde, alee, cheimes, edewata, jmagne, mharmsen) - PKI TRAC Ticket #2401 - pkispawn calls dnsdomainname even if it does not rpm-require hostname (mharmsen) - PKI TRAC Ticket #2402 - Conflict in file ownership in pki-base and pki-server (cheimes) - PKI TRAC Ticket #2403 - Deployment problem with RESTEasy 3.0.17 (edewata) - PKI TRAC Ticket #2406 - Make starting CRL Number configurable (jmagne) - PKI TRAC Ticket #2412 - pki client-cert-import --trust option does not apply the specified trust bits (alee) - PKI TRAC Ticket #2418 - [TPS] Some template substitution didn't happen during installation (alee) - PKI TRAC Ticket #2420 - CA subsystem OSCP responder fails when LWCAs are not used (ftweedal) - PKI TRAC Ticket #2421 - Incorrect SELinux contexts Installation/Configuration (edewata) - PKI TRAC Ticket #2424 - ipa-ca-install fails on replica when IPA server is converted from CA-less to CA-full (edewata) - PKI TRAC Ticket #2428 - broken request links for CA's system certs in agent request viewing (cfu) - PKI TRAC Ticket #2430 - CA Agent certificate list is not sorted by serial number in migration case (jmagne) - PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade. (mharmsen) - PKI TRAC Ticket #2433 - Lightweight CA GET /chain returns bogus PEM data (ftweedal)- PKI TRAC Ticket #691 - [MAN] pki-server man pages (mharmsen) - PKI TRAC Ticket #1114 - [MAN] Generting Symmetric key fails with key-generate when --usages verify is passed (jmagne) - PKI TRAC Ticket #1306 - [RFE] Add granularity to token termination in TPS (cfu) - PKI TRAC Ticket #1308 - [RFE] Provide ability to perform off-card key generation for non-encryption token keys (cfu) - PKI TRAC Ticket #1405 - [MAN] Add additional HSM details to 'pki_default.cfg' & 'pkispawn' man pages (mharmsen) - PKI TRAC Ticket #1607 - [MAN] man pkispawn has inadequate description for shared vs non shared tomcat instance installation (mharmsen) - PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single user on multiple tokens. (jmagne) - PKI TRAC Ticket #1711 - CLI :: pki-server ca-cert-request-find throws IOError (edewata, ftweedal) - PKI TRAC Ticket #2285 - freeipa fails to start correctly after pki-core update on upgraded system (ftweedal) - PKI TRAC Ticket #2311 - When pki_token_name=Internal, consider normalizing it to "internal" (mharmsen) - PKI TRAC Ticket #2349 - Separated TPS does not automatically receive shared secret from remote TKS (jmagne) - PKI TRAC Ticket #2364 - CLI :: pki-server ca-cert-request-show throws attribute error (ftweedal) - PKI TRAC Ticket #2368 - pki-server subsystem subcommands throws error with --help option (edewata) - PKI TRAC Ticket #2374 - KRA cloning overwrites CA signing certificate trust flags (edewata) - PKI TRAC Ticket #2380 - Pki-server instance commands throws exception while specifying invalid parameters. (edewata) - PKI TRAC Ticket #2384 - CA installation with HSM prompts for HSM password during silent installation (edewata) - PKI TRAC Ticket #2385 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg (ftweedal) - PKI TRAC Ticket #2387 - Add config for default OCSP URI if none given (ftweedal) - PKI TRAC Ticket #2388 - CA creation responds 500 if certificate issuance fails (ftweedal) - PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA (cfu) - PKI TRAC Ticket #2390 - Dogtag 10.3.4: Miscellaneous Enhancements (akasurde, edewata)- PKI TRAC Ticket #2373 - Fedora 25: RestEasy 3.0.6 ==> 3.0.17 breaks pki-core (ftweedal)- Updated release number to 10.3.3-1- Updated version number to 10.3.3-0.1- Provided cleaner runtime dependency separation- Updated tomcatjss version dependencies- Updated 'java', 'java-headless', and 'java-devel' dependencies to 1:1.8.0.- Updated tomcat version dependencies- Updated version number to 10.3.2-1- Updated version number to 10.3.2-0.1- Updated version number to 10.3.1-1 (to allow upgrade from 10.3.0.b1)- Updated version number to 10.3.0-1- Build for F24 beta- PKI TRAC Ticket #2255 - PKCS #12 backup does not contain trust attributes.- Updated build for F24 alpha- PKI TRAC Ticket #1625 - Allow multiple ACLs of same name (union of rules) [ftweedal] - PKI TRAC Ticket #2237 - Add CRL dist points extension to OIDMap unconditionally [edewata] - PKI TRAC Ticket #1803 - Removed unnecessary URL encoding for admin cert request. [edewata] - PKI TRAC Ticket #1742 - Added support for cloning 3rd-party CA certificates. [edewata] - PKI TRAC Ticket #1482 - Added TPS token filter dialog. [edewata] - PKI TRAC Ticket #1808 - Fixed illegal token state transition via TEMP_LOST. [edewata]- Build for F24 alpha- PKI Trac Ticket #1399 - Move java components out of pki-base- PKI TRAC Ticket #1850 - Rename DRMTool --> KRATool- PKI TRAC Ticket #1714 - mod_revocator and mod_nss dependency for tps should be removed- PKI TRAC Ticket #1623 - Runtime dependency on python-nss is missing- Updated version number to 10.3.0-0.1- Added dep on tomcat-servlet-3.1-api [Fedora 23 and later] or dep on tomcat-servlet-3.0-api [Fedora 22 and later] to pki-tools - Updated dep on tomcatjss [Fedora 23 and later]- Updated dep on policycoreutils-python-utils [Fedora 23 and later]- Updated version number to 10.2.7-0.1- Update release number for release build- Remove setup directory and remaining Perl dependencies- Remove ExcludeArch directive- Updated version number to 10.2.6-0.1- Update release number for release build- Resolves rhbz #1230970 - Errata TPS tests for rpm verification failed- Updated version number to 10.2.5-0.1- Update release number for release build- Updated nuxwdog and tomcatjss requirements (alee)- Updated version number to 10.2.4-0.1 - Added nuxwdog systemd files- Update release number for release build- Reverted version number back to 10.2.3-0.1 - Added support for Tomcat 8.- Updated version number to 10.3.0-0.1- Updated version number to 10.2.3-0.1- Update release number for release build- Updated version number to 10.2.2-0.1 - Moved web application deployment locations. - Updated Resteasy and Jackson dependencies. - Added missing python-lxml build dependency.- Update release number for release build- PKI TRAC Ticket #1187 - mod_perl should be removed from requirements for 10.2 - PKI TRAC Ticket #1205 - Outdated selinux-policy dependency. - Removed perl(XML::LibXML), perl-Crypt-SSLeay, and perl-Mozilla-LDAP runtime dependencies- Change resteasy dependencies for F22+- Ticket 1198 Bugzilla 1158410 add TLS range support to server.xml by default and upgrade (cfu) - PKI Trac Ticket #1211 - New release overwrites old source tarball (mharmsen) - up the release number to 0.2- Updated version number to 10.2.1-0.1. - Added CLIs to simplify generating user certificates - Added enhancements to KRA Python API - Added a man page for pki ca-profile commands. - Added python api docs- Disable pylint dependency for RHEL builds - Added jakarta-commons-httpclient requirements - Added tomcat version for RHEL build - Added resteasy-base-client for RHEL build- PKI TRAC Ticket #1130 - Add RHEL/CentOS conditionals to spec- Update release number for release build- PKI TRAC Ticket #1017 - Rename pki-tps-tomcat to pki-tps- Merged jmagne@redhat.com's spec file changes from the stand-alone 'pki-tps-client' package needed to build/run the native 'tpsclient' command line utility into this 'pki-core' spec file under the 'tps' package. - Original tps libararies must be built to support this native utility. - Modifies tps package from 'noarch' into 'architecture-specific' package- PKI TRAC Ticket #1127 - Remove 'pki-ra', 'pki-setup', and 'pki-silent' packages . . .- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild- Respin to include the applet files with the rpm install. No change to spec file needed.- Bugzilla Bug #1120045 - pki-core: Switch to java-headless (build)requires -- drop dependency on java-atk-wrapper - Removed 'java-atk-wrapper' dependency from 'pki-server'- PKI TRAC Ticket #832 - Remove legacy 'systemctl' files . . .- Update rawhide build- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild- Use Requires: java-headless rebuild (#1067528)- Added option to build without server packages. - Replaced Jettison with Jackson. - Added python-nss build requirement - Bugzilla Bug #1057959 - pkispawn requires policycoreutils-python - TRAC Ticket #840 - pkispawn requires policycoreutils-python - Updated requirements for resteasy - Added template files for archive, retrieve and generate key requests to the client package.- Trac Ticket 788 - Clean up spec files - Update release number for release build - Updated requirements for resteasy- Change release number for beta build- Updated requirements for tomcat- Removed additional /var/run, /var/lock references.- Removed delivery of /var/lock and /var/run directories for fedora 20.- Moved Tomcat-based TPS into pki-core.- Listed new packages required during build, due to issues reported by pylint. - Packages added: python-requests, python-ldap, libselinux-python, policycoreutils-python- Added pylint scan to the build process.- Added man pages for upgrade tools.- Cleaned up the code to install man pages.- Reorganized deployment tools.- Bugzilla Bug 973224 - resteasy-base must be split into subpackages to simplify dependencies- Updated dependencies to Java 1.7.- TRAC Ticket 606 - add restart / start at boot info to pkispawn man page - TRAC Ticket 610 - Document limitation in using GUI install - TRAC Ticket 629 - Package ownership of '/usr/share/pki/etc/' directory- Change release number for 10.1 development- Fixed incorrect JNI_JAR_DIR.- TRAC Ticket 605 Junit internal function used in TestRunner, breaks F19 build- TRAC Ticket 604 Added fallback methods for pkispawn tests- Added default pki.conf in /usr/share/pki/etc - Create upgrade tracker on install and remove it on uninstall- Change release number for official release.- Added %pretrans script for f19 - Added java-atk-wrapper dependency- Added pki-server-upgrade script and pki.server module. - Call upgrade scripts in %post for pki-base and pki-server.- Added dependency on commons-io.- Add /var/log/pki and /var/lib/pki directories- Run pki-upgrade on post server installation.- Added dependency on python-lxml.- Added pki-upgrade script.- Updated version number to 10.0.2-0.1.- Renamed base/deploy to base/server. - Moved pki.conf into pki-base. - Removed redundant pki/server folder declaration.- Removed jython dependency- Added minimum python-requests version.- Bugzilla Bug #919476 - pkispawn crashes due to dangling symlink to jss4.jar- Added dependency on python-requests. - Reorganized Python module packaging.- Added dependency on python-ldap.- TRAC Ticket #517 - Clean up theme dependencies - TRAC Ticket #518 - Remove UI dependencies from pkispawn . . .- Removed runtime dependency on 'pki-server-theme' to resolve Bugzilla Bug #916134 - unresolved dependency in pki-server: pki-server-theme- TRAC Ticket 214 - Missing error description for duplicate user - TRAC Ticket 213 - Add nonces for cert revocation - TRAC Ticket 367 - pkidestroy does not remove connector - TRAC Ticket #430 - License for 3rd party code - Bugzilla Bug 839426 - [RFE] ECC CRL support for OCSP - Fix spec file to allow f17 to work with latest tomcatjss - TRAC Ticket 466 - Increase root CA validity to 20 years - TRAC Ticket 469 - Fix tomcatjss issue in spec files - TRAC Ticket 468 - pkispawn throws exception - TRAC Ticket 191 - Mapping HTTP Exceptions to HTTP error codes - TRAC Ticket 271 - Dogtag 10: Fix 'status' command in 'pkidaemon' . . . - TRAC Ticket 437 - Make admin cert p12 file location configurable - TRAC Ticket 393 - pkispawn fails when selinux is disabled - Punctuation and formatting changes in man pages - Revert to using default config file for pkidestroy - Hardcode setting of resteasy-lib for instance - TRAC Ticket 436 - Interpolation for pki_subsystem - TRAC Ticket 433 - Interpolation for paths - TRAC Ticket 435 - Identical instance id and instance name - TRAC Ticket 406 - Replace file dependencies with package dependencies- TRAC Ticket #430 - License for 3rd party code- TRAC Ticket #469 - Dogtag 10: Fix tomcatjss issue in pki-core.spec and dogtag-pki.spec . . . - TRAC Ticket #468 - pkispawn throws exception- Replaced file dependencies with package dependencies- Updated man pages- Update to official release for rc1- TRAC Ticket #315 - Man pages for pkispawn/pkidestroy. - Added place-holders for 'pki.1' and 'pki_default.cfg.5' man pages.- Added system-wide configuration /etc/pki/pki.conf. - Removed redundant lines in %files.- Moved default deployment configuration to /etc/pki.- Cleaned up spec file to provide only support rhel 7+, f17+ - Added resteasy-base dependency for rhel 7 - Update cmake version- Update release to b3- Removed dependency on CA, KRA, OCSP, TKS theme packages.- Renamed pki-common-theme to pki-server-theme.- TRAC Ticket #395 - Dogtag 10: Add a Tomcat 7 runtime requirement to 'pki-server'- Update release to b2- TRAC Ticket #350 - Dogtag 10: Remove version numbers from PKI jar files . . .- Added Obsoletes for pki-selinux- Remove build of pki-selinux for f18, use system policy instead- Update required tomcatjss version - Added net-tools dependency- Update selinux-policy version to fix error from latest policy changes- Fix typo in selinux policy versions- Added build requires for correct version of selinux-policy-devel- Update release to b1- Merged pki-silent into pki-server.- Renamed "shared" folder to "server".- Added required selinux versions for new policy.- Added Provides to packages replacing obsolete packages.- Update release to a2- Modified CMake to use RPM version number- Added VERSION file- Merged pki-setup into pki-server- Added Conflicts for IPA 2.X - Added build requires for zip to work around mock problem- TRAC Ticket #312 - Dogtag 10: Automatically restart any running instances upon RPM "update" . . . - TRAC Ticket #317 - Dogtag 10: Move "pkispawn"/"pkidestroy" from /usr/bin to /usr/sbin . . .- Fixed pki-server to include everything in shared dir.- Added build dependency on redhat-rpm-config.- Merged Javadoc packages.- Added pki-tomcat.jar.- Moved webapp creation code into pkispawn.- Split pki-client.jar into pki-certsrv.jar and pki-tools.jar.- Merged pki-native-tools and pki-java-tools into pki-tools. - Modified pki-server to depend on pki-tools.- Split pki-common into pki-base and pki-server. - Merged pki-util into pki-base. - Merged pki-deploy into pki-server.- Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 17 - Changed Dogtag 10 build-time and runtime requirements for 'pki-deploy' - Altered PKI Package Dependency Chain (top-to-bottom): pki-ca, pki-kra, pki-ocsp, pki-tks --> pki-deploy --> pki-common- Added pki-client.jar.- Merged pki-jndi-realm.jar into pki-cmscore.jar.- PKI TRAC Task #254 - Dogtag 10: Fix spec file to build successfully via mock on Fedora 17 . . .- Moved 'pki-jndi-real.jar' link from 'tomcat6' to 'tomcat' (Tomcat 7)- Updated release of 'tomcatjss' to rely on Tomcat 7 for Fedora 18- Added CLI for REST services- Integration of Tomcat 7 - Addition of centralized 'pki-tomcatd' systemd functionality to the PKI Deployment strategy - Removal of 'pki_flavor' attribute- BZ 813075 - selinux denial for file size access- Bug 745278 - [RFE] ECC encryption keys cannot be archived- Replaced candlepin-deps with resteasy- Added option to build without Javadoc- BZ 802396 - Change location of TOMCAT_LOG to match tomcat6 changes - Corrected patch selected for selinux f17 rules- Corrected 'junit' dependency check- Initial attempt at PKI deployment framework described in 'http://pki.fedoraproject.org/wiki/PKI_Instance_Deployment'.- Added support for pki-jndi-realm in tomcat6 in pki-common and pki-kra. - Ticket #69.- For 'mock' purposes, removed platform-specific logic from around the 'patch' files so that ALL 'patch' files will be included in the SRPM.- Removed dependency on OSUtil.- 'pki-selinux' - Added platform-dependent patches for SELinux component - Bugzilla Bug #739708 - Selinux fix for ephemeral ports (F16) - Bugzilla Bug #795966 - pki-selinux policy is kind of a mess (F17)- Added dependency on Apache Commons Codec.- Add '-DSYSTEMD_LIB_INSTALL_DIR' override flag to 'cmake' to address changes in fundamental path structure in Fedora 17 - 'pki-setup' - Hard-code Perl dependencies to protect against bugs such as Bugzilla Bug #772699 - Adapt perl and python fileattrs to changed file 5.10 magics - 'pki-selinux' - Bugzilla Bug #795966 - pki-selinux policy is kind of a mess- Integrated 'pki-kra' into 'pki-core' - Integrated 'pki-ocsp' into 'pki-core' - Integrated 'pki-tks' into 'pki-core' - Bugzilla Bug #788787 - added 'junit'/'junit4' build-time requirements- Updated package version number- Added resteasy-jettison-provider-2.3-RC1.jar to pki-setup- Added JUnit tests- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #744797 - KRA key recovery (retrieve pkcs#12) fails after the in-place upgrade( CS 8.0->8.1) (cfu) - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #746367 - Typo in the profile name. (jmagne) - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping unwrapping keys should be done in the token (cfu) - Bugzilla Bug #749927 - Java class conflicts using Java 7 in Fedora 17 (rawhide) . . . (mharmsen) - Bugzilla Bug #749945 - Installation error reported during CA, DRM, OCSP, and TKS package installation . . . (mharmsen) - 'pki-silent'- Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . (mharmsen) - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-setup' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - Bugzilla Bug #737192 - Need script to upgrade proxy configuration (alee) - 'pki-symkey' - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode (hsm+NSS). (jmagne) - 'pki-native-tools' - Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-util' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - Bugzilla Bug #737218 - Incorrect request attribute name matching ignores request attributes during request parsing. (awnuk) - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode (hsm+NSS). (jmagne) - 'pki-selinux' - Bugzilla Bug #739708 - pki-selinux lacks rules in F16 (alee) - 'pki-ca' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - Bugzilla Bug #730146 - SSL handshake picks non-FIPS ciphers in FIPS mode (cfu) - 'pki-silent' - Bugzilla Bug #739201 - pkisilent does not take arch into account as Java packages migrated to arch-dependent directories (mharmsen)- 'pki-setup' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-symkey' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-java-tools' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-common' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-silent' - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . .- 'pki-setup' - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-ca' - Bugzilla Bug #699809 - Convert CS to use systemd (alee) - 'pki-common' - Bugzilla Bug #699809 - Convert CS to use systemd (alee)- 'pki-setup' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-symkey' - 'pki-native-tools' - Bugzilla Bug #717643 - Fopen without NULL check and other Coverity issues (awnuk) - Bugzilla Bug #730801 - Coverity issues in native-tools area (awnuk) - 'pki-util' - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #700522 - pki tomcat6 instances currently running unconfined, allow server to come up when selinux disabled (alee) - Bugzilla Bug #731741 - some CS.cfg nickname parameters not updated correctly when subsystem cloned (using hsm) (alee) - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-selinux' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-ca' - Bugzilla Bug #712931 - CS requires too many ports to be open in the FW (alee) - 'pki-silent'- 'pki-setup' - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee) - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #724861 - DRMTool: fix duplicate "dn:" records by renumbering "cn=" (mharmsen) - 'pki-common' - Bugzilla Bug #717041 - Improve escaping of some enrollment inputs like (jmagne, awnuk) - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee) - Bugzilla Bug #708075 - Clone installation does not work over NAT (alee) - Bugzilla Bug #726785 - If replication fails while setting up a clone it will wait forever (alee) - Bugzilla Bug #728332 - xml output has changed on cert requests (awnuk) - Bugzilla Bug #700505 - pki tomcat6 instances currently running unconfined (alee) - 'pki-selinux' - Bugzilla Bug #700505 - pki tomcat6 instances currently running unconfined (alee) - 'pki-ca' - Bugzilla Bug #728605 - RFE: increase default validity from 6mo to 2yrs in IPA profile (awnuk) - 'pki-silent' - Bugzilla Bug #689909 - Dogtag installation under IPA takes too much time - remove the inefficient sleeps (alee)- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an ECC CA to generate ECC certs from CRMF. (jmagne) - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any component value which is equal to its default value (alee) - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #720510 - Console: Adding a certificate into nethsm throws Token not found error. (jmagne) - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an ECC CA to generate ECC certs from CRMF. (jmagne) - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any component value which is equal to its default value (alee) - Bugzilla Bug #722989 - Registering an agent when a subsystem is created - does not log AUTHZ_SUCCESS event. (alee) - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #719113 - Add client usage flag to caIPAserviceCert (awnuk) - 'pki-silent'- Updated release of 'jss' - Updated release of 'tomcatjss' for Fedora 15 - 'pki-setup' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-symkey' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-native-tools' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #717765 - TPS configuration: logging into security domain from tps does not work with clientauth=want. (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-util' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-java-tools' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (config file and record processing) (mharmsen) - Bugzilla Bug #532548 - Tool to do DRM re-key (tweaks) (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-common' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs throws 'Invalid protocol' for OCSP subsystems (alee) - Bugzilla Bug #694569 - parameter used by pkiremove not updated (alee) - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages (alee) - Bugzilla Bug #694143 - CA Agent not returning specified request (awnuk) - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages (jmagne) - Bugzilla Bug #698885 - Race conditions during IPA installation (alee) - Bugzilla Bug #704792 - CC_LAB_EVAL: CA agent interface: SubjectID=$Unidentified$ fails audit evaluation (jmagne) - Bugzilla Bug #705914 - SCEP mishandles nicknames when processing subsequent SCEP requests. (awnuk) - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #707416 - additional audit messages for GetCookie (alee) - Bugzilla Bug #707607 - Published certificate summary has list of non-published certificates with succeeded status (jmagne) - Bugzilla Bug #717813 - EV_AUDIT_LOG_SHUTDOWN audit log not generated for tps and ca on server shutdown (jmagne) - Bugzilla Bug #697939 - DRM signed audit log message - operation should be read instead of modify (jmagne) - Bugzilla Bug #718427 - When audit log is full, server continue to function. (alee) - Bugzilla Bug #718607 - CC_LAB_EVAL: No AUTH message is generated in CA's signedaudit log when a directory based user enrollment is performed (jmagne) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-selinux' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #720503 - RA and TPS require additional SELinux permissions to run in "Enforcing" mode (alee) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-ca' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser (jdennis) - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems (mharmsen) - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. (jmagne) - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs for modify/add (alee) - Bugzilla Bug #716269 - make ra authenticated profiles non-visible on ee pages (alee) - Bugzilla Bug #718621 - CC_LAB_EVAL: PRIVATE_KEY_ARCHIVE_REQUEST occurs for a revocation invoked by EE user (awnuk) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen) - 'pki-silent' - Bugzilla Bug #695157 - Auditverify on TPS audit log throws error. (mharmsen) - Bugzilla Bug #669226 - Remove Legacy Build System (mharmsen)- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Added 'DRMTool.cfg' configuration file to inventory - 'pki-common' - 'pki-selinux' - 'pki-ca' - 'pki-silent'- 'pki-setup' - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #532548 - Tool to do DRM re-key - 'pki-common' - 'pki-selinux' - 'pki-ca' - 'pki-silent'- 'pki-setup' - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #694569 - parameter used by pkiremove not updated - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - 'pki-common' - Bugzilla Bug #695403 - Editing signedaudit or transaction, system logs throws 'Invalid protocol' for OCSP subsystems - Bugzilla Bug #694569 - parameter used by pkiremove not updated - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages - Bugzilla Bug #694143 - CA Agent not returning specified request - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not populated in the CA signedAudit messages - Bugzilla Bug #698885 - Race conditions during IPA installation - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #693815 - /var/log/tomcat6/catalina.out owned by pkiuser - Bugzilla Bug #699837 - service command is not fully backwards compatible with Dogtag pki subsystems - 'pki-silent'- Bugzilla Bug #695157 - Auditverify on TPS audit log throws error.- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Bugzilla Bug #693327 - Missing requires: tomcatjss - 'pki-setup' - Bugzilla Bug #690626 - pkiremove removes the registry entry for all instances on a machine - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws file not found exception. - 'pki-common' - Bugzilla Bug #692990 - Audit log messages needed to match CC doc: DRM Recovery audit log messages - 'pki-selinux' - 'pki-ca' - 'pki-silent'- Bugzilla Bug #693327 - Missing requires: tomcatjss- Bugzilla Bug #690950 - Update Dogtag Packages for Fedora 15 (beta) - Require "jss >= 4.2.6-15" as a build and runtime requirement - Require "tomcatjss >= 2.1.1" as a build and runtime requirement for Fedora 15 and later platforms - 'pki-setup' - Bugzilla Bug #688287 - Add "deprecation" notice regarding using "shared ports" in pkicreate -help . . . - Bugzilla Bug #688251 - Dogtag installation under IPA takes too much time - SELinux policy compilation - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #689501 - ExtJoiner tool fails to join the multiple extensions - 'pki-common' - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #689662 - ocsp publishing needs to be re-enabled on the EE port - 'pki-selinux' - Bugzilla Bug #684871 - ldaps selinux link change - 'pki-ca' - Bugzilla Bug #683581 - CA configuration with ECC(Default EC curve-nistp521) CA fails with 'signing operation failed' - Bugzilla Bug #684381 - CS.cfg specifies incorrect type of comments - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws file not found exception.(profile and CS.cfg only) - 'pki-silent'- Bugzilla Bug #688763 - Rebase updated Dogtag Packages for Fedora 15 (alpha) - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA instance - Bugzilla Bug #675742 - Profile caIPAserviceCert Not Found - 'pki-setup' - Bugzilla Bug #678157 - uninitialized variable warnings from Perl - Bugzilla Bug #679574 - Velocity fails to load all dependent classes - Bugzilla Bug #680420 - xml-commons-apis.jar dependency - Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's classpath - Bugzilla Bug #673508 - CS8 64 bit pkicreate script uses wrong library name for SafeNet LunaSA - 'pki-common' - Bugzilla Bug #673638 - Installation within IPA hangs - Bugzilla Bug #678715 - netstat loop fixes needed - Bugzilla Bug #673609 - CC: authorize() call needs to be added to getStats servlet - 'pki-selinux' - Bugzilla Bug #674195: SELinux error message thrown during token enrollment - 'pki-ca' - Bugzilla Bug #673638 - Installation within IPA hangs - Bugzilla Bug #673609 - CC: authorize() call needs to be added to getStats servlet - Bugzilla Bug #676330 - init script cannot start service - 'pki-silent' - Bugzilla Bug #682013 - pkisilent needs xml-commons-apis.jar in it's classpath- 'pki-common' - Bugzilla Bug #676051 - IPA installation failing - Fails to create CA instance - Bugzilla Bug #676182 - IPA installation failing - Fails to create CA instance- 'pki-common' - Bugzilla Bug #674894 - ipactl restart : an annoy output line - Bugzilla Bug #675179 - ipactl restart : an annoy output line- Bugzilla Bug #673233 - Rebase pki-core to pick the latest features and fixes - 'pki-setup' - Bugzilla Bug #673638 - Installation within IPA hangs - 'pki-symkey' - 'pki-native-tools' - 'pki-util' - 'pki-java-tools' - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - 'pki-common' - Bugzilla Bug #672291 - CA is not publishing certificates issued using "Manual User Dual-Use Certificate Enrollment" - Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error. - Bugzilla Bug #504056 - Completed SCEP requests are assigned to the "begin" state instead of "complete". - Bugzilla Bug #504055 - SCEP requests are not properly populated - Bugzilla Bug #564207 - Searches for completed requests in the agent interface returns zero entries - Bugzilla Bug #672291 - CA is not publishing certificates issued using "Manual User Dual-Use Certificate Enrollment" - - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package - Bugzilla Bug #672920 - CA console: adding policy to a profile throws 'Duplicate policy' error in some cases. - Bugzilla Bug #673199 - init script returns control before web apps have started - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances - 'pki-selinux' - 'pki-ca' - Bugzilla Bug #504013 - sscep request is rejected due to authentication error if submitted through one time pin router certificate enrollment. - Bugzilla Bug #672111 - CC doc: certServer.usrgrp.administration missing information - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #672333 - Creation of RA agent fails in IPA installation - Bugzilla Bug #674917 - Restore identification of Tomcat-based PKI subsystem instances - 'pki-silent' - Bugzilla Bug #673614 - CC: Review of cryptographic algorithms provided by 'netscape.security.provider' package- Bugzilla Bug #656661 - Please Update Spec File to use 'ghost' on files in /var/run and /var/lock- 'pki-symkey' - Bugzilla Bug #671265 - pki-symkey jar version incorrect - 'pki-common' - Bugzilla Bug #564207 - Searches for completed requests in the agent interface returns zero entries- Allow 'pki-native-tools' to be installed independently of 'pki-setup' - Removed explicit 'pki-setup' requirement from 'pki-ca' (since it already requires 'pki-common') - 'pki-setup' - Bugzilla Bug #223343 - pkicreate: should add 'pkiuser' to nfast group - Bugzilla Bug #629377 - Selinux errors during pkicreate CA, KRA, OCSP and TKS. - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from OpenLDAP instead of the Mozldap - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #658926 - org.apache.commons.lang class not found on F13 - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #665388 - jakarta-* jars have been renamed to apache-*, pkicreate fails Fedora 14 and above - Bugzilla Bug #23346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #656733 - Standardize jar install location and jar names - 'pki-symkey' - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #644056 - CS build contains warnings - 'pki-native-tools' - template change - Bugzilla Bug #606946 - Convert Native Tools to use ldapAPI from OpenLDAP instead of the Mozldap - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #644056 - CS build contains warnings - 'pki-util' - Bugzilla Bug #615814 - rhcs80 - profile policyConstraintsCritical cannot be set to true - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #635033 - At installation wizard selecting key types other than CA's signing cert will fail - Bugzilla Bug #645874 - rfe ecc - add ecc curve name support in JSS and CS interface - Bugzilla Bug #488253 - com.netscape.cmsutil.ocsp.BasicOCSPResponse ASN.1 encoding/decoding is broken - Bugzilla Bug #551410 - com.netscape.cmsutil.ocsp.TBSRequest ASN.1 encoding/decoding is incomplete - Bugzilla Bug #550331 - com.netscape.cmsutil.ocsp.ResponseData ASN.1 encoding/decoding is incomplete - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #658188 - remove remaining references to tomcat5 - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #223319 - Certificate Status inconsistency between token db and CA - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation - 'pki-java-tools' - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1 - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #662156 - HttpClient is hard-coded to handle only up to 5000 bytes - Bugzilla Bug #656733 - Standardize jar install location and jar names - 'pki-common' - Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review - Bugzilla Bug #623745 - SessionTimer with LDAPSecurityDomainSessionTable started before configuration completed - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #615827 - rhcs80 - profile policies need more than 5 policy mappings (seem hardcoded) - Bugzilla Bug #224945 - javadocs has missing descriptions, contains empty packages - Bugzilla Bug #548699 - subCA's admin certificate should be generated by itself - Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA - Bugzilla Bug #563386 - rhcs80 ca crash on invalid inputs to profile caAgentServerCert (null cert_request) - Bugzilla Bug #621339 - SCEP one-time PIN can be used an unlimited number of times - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #629677 - TPS: token enrollment fails. - Bugzilla Bug #621350 - Unauthenticated user can decrypt a one-time PIN in a SCEP request - Bugzilla Bug #503838 - rhcs71-80 external publishing ldap connection pools not reliable - improve connections or discovery - Bugzilla Bug #629769 - password decryption logs plain text password - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #586700 - OCSP Server throws fatal error while using OCSP console for renewing SSL Server certificate. - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #607380 - CC: Make sure Java Console can configure all security relevant config items - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #489342 - com.netscape.cms.servlet.common.CMCOutputTemplate.java doesn't support EC - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1 - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #635033 - At installation wizard selecting key types other than CA's signing cert will fail - Bugzilla Bug #621341 - Add CA support for new SCEP key pair dedicated for SCEP signing and encryption. - Bugzilla Bug #223336 - ECC: unable to clone a ECC CA - Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned by Reason Code - onlySomeReasons ? - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #223313 - should do random generated IV param for symmetric keys - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #630176 - Improve reliability of the LdapAnonConnFactory - Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes). - Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple Certificates from the Same Request - Bugzilla Bug #648757 - expose and use updated cert verification function in JSS - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #451874 - RFE - Java console - Certificate Wizard missing e.c. support - Bugzilla Bug #651040 - cloning shoud not include sslserver - Bugzilla Bug #542863 - RHCS8: Default cert audit nickname written to CS.cfg files imcomplete when the cert is stored on a hsm - Bugzilla Bug #360721 - New Feature: Profile Integrity Check . . . - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #642359 - CC Feature - need to verify certificate when it is added - Bugzilla Bug #653713 - CC: setting trust on a CIMC cert requires auditing - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #659004 - CC: AuditVerify hardcoded with SHA-1 - Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA. - Bugzilla Bug #661889 - The Servlet TPSRevokeCert of the CA returns an error to TPS even if certificate in question is already revoked. - Bugzilla Bug #663546 - Disable the functionalities that are not exposed in the console - Bugzilla Bug #661514 - CMAKE build system requires rules to make javadocs - Bugzilla Bug #658188 - remove remaining references to tomcat5 - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #642741 - CS build uses deprecated functions - Bugzilla Bug #670337 - CA Clone configuration throws TCP connection error - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - 'pki-selinux' - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #667153 - store nuxwdog passwords in kernel ring buffer - selinux changes - 'pki-ca' - Bugzilla Bug #583822 - CC: ACL issues from CA interface CC doc review - Bugzilla Bug #620925 - CC: auditor needs to be able to download audit logs in the java subsystems - Bugzilla Bug #621322 - Provide switch disabling SCEP support in CA - Bugzilla Bug #583824 - CC: Duplicate servlet mappings found as part of CC interface doc review - Bugzilla Bug #621602 - pkiconsole: Click on 'Publishing' option with admin privilege throws error "You are not authorized to perform this operation". - Bugzilla Bug #583825 - CC: Obsolete servlets to be removed from web.xml as part of CC interface review - Bugzilla Bug #583823 - CC: Auditing issues found as result of CC - interface review - Bugzilla Bug #519291 - Deleting a CRL Issuing Point after edits throws 'Internal Server Error'. - Bugzilla Bug #586700 - OCSP Server throws fatal error while using OCSP console for renewing SSL Server certificate. - Bugzilla Bug #621337 - Limit the received senderNonce value to 16 bytes. - Bugzilla Bug #621338 - Include a server randomly-generated 16 byte senderNonce in all signed SCEP responses. - Bugzilla Bug #558100 - host challenge of the Secure Channel needs to be generated on TKS instead of TPS. - Bugzilla Bug #630121 - OCSP responder lacking option to delete or disable a CA that it serves - Bugzilla Bug #634663 - CA CMC response default hard-coded to SHA1 - Bugzilla Bug #621327 - Provide switch disabling algorithm downgrade attack in SCEP - Bugzilla Bug #621334 - Provide an option to set default hash algorithm for signing SCEP response messages. - Bugzilla Bug #539781 - rhcs 71 - CRLs Partitioned by Reason Code - onlySomeReasons ? - Bugzilla Bug #637330 - CC feature: Key Management - provide signature verification functions (JAVA subsystems) - Bugzilla Bug #555927 - rhcs80 - AgentRequestFilter servlet and port fowarding for agent services - Bugzilla Bug #524916 - ECC key constraints plug-ins should be based on ECC curve names (not on key sizes). - Bugzilla Bug #516632 - RHCS 7.1 - CS Incorrectly Issuing Multiple Certificates from the Same Request - Bugzilla Bug #638242 - Installation Wizard: at SizePanel, fix selection of signature algorithm; and for ECC curves - Bugzilla Bug #529945 - (Instructions and sample only) CS 8.0 GA release -- DRM and TKS do not seem to have CRL checking enabled - Bugzilla Bug #609641 - CC: need procedure (and possibly tools) to help correctly set up CC environment - Bugzilla Bug #509481 - RFE: support sMIMECapabilities extensions in certificates (RFC 4262) - Bugzilla Bug #651916 - kra and ocsp are using incorrect ports to talk to CA and complete configuration in DonePanel - Bugzilla Bug #511990 - rhcs 7.3, 8.0 - re-activate missing object signing support in RHCS - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #499494 - change CA defaults to SHA2 - Bugzilla Bug #623452 - rhcs80 pkiconsole profile policy editor limit policy extension to 5 only - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an administrator group. - Bugzilla Bug #632425 - Port to tomcat6 - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #653576 - tomcat5 does not always run filters on servlets as expected - Bugzilla Bug #642357 - CC Feature- Self-Test plugins only check for validity - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #661128 - incorrect CA ports used for revoke, unrevoke certs in TPS - Bugzilla Bug #512496 - RFE rhcs80 - crl updates and scheduling feature - Bugzilla Bug #661196 - ECC(with nethsm) subca configuration fails with Key Type RSA Not Matched despite using ECC key pairs for rootCA & subCA. - Bugzilla Bug #649343 - Publishing queue should recover from CA crash. - Bugzilla Bug #491183 - rhcs rfe - add rfc 4523 support for pkiUser and pkiCA, obsolete 2252 and 2256 - Bugzilla Bug #223346 - Two conflicting ACL list definitions in source repository - Bugzilla Bug #640710 - Current SCEP implementation does not support HSMs - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #661142 - Verification should fail when a revoked certificate is added - Bugzilla Bug #668100 - DRM storage cert has OCSP signing extended key usage - Bugzilla Bug #662127 - CC doc Error: SignedAuditLog expiration time interface is no longer available through console - Bugzilla Bug #531137 - RHCS 7.1 - Running out of Java Heap Memory During CRL Generation - 'pki-silent' - Bugzilla Bug #627309 - pkisilent subca configuration fails. - Bugzilla Bug #640091 - pkisilent panels need to match with changed java subsystems - Bugzilla Bug #527322 - pkisilent ConfigureDRM should configure DRM Clone. - Bugzilla Bug #643053 - pkisilent DRM configuration fails - Bugzilla Bug #583754 - pki-silent needs an option to configure signing algorithm for CA certificates - Bugzilla Bug #489385 - references to rhpki - Bugzilla Bug #638377 - Generate PKI UI components which exclude a GUI interface - Bugzilla Bug #651977 - turn off ssl2 for java servers (server.xml) - Bugzilla Bug #640042 - TPS Installlation Wizard: need to move Module Panel up to before Security Domain Panel - Bugzilla Bug #643206 - New CMake based build system for Dogtag - Bugzilla Bug #588323 - Failed to enable cipher 0xc001 - Bugzilla Bug #656733 - Standardize jar install location and jar names - Bugzilla Bug #645895 - pkisilent: add ability to select ECC curves, signing algorithm - Bugzilla Bug #658641 - pkisilent doesn't not properly handle passwords with special characters - Bugzilla Bug #642741 - CS build uses deprecated functions- Bugzilla Bug #668839 - Review Request: pki-core - Removed empty "pre" from "pki-ca" - Consolidated directory ownership - Corrected file ownership within subpackages - Removed all versioning from NSS and NSPR packages- Bugzilla Bug #668839 - Review Request: pki-core - Added component versioning comments - Updated JSS from "4.2.6-10" to "4.2.6-12" - Modified installation section to preserve timestamps - Removed sectional comments- Initial revision. (kwright@redhat.com & mharmsen@redhat.com)  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghi10.5.18-24.el7_9    pki-ca-10.5.18LICENSEpki-ca.jarcaconfCS.cfgCatalinalocalhostca.xmlacl.ldifacl.propertiesauth-method.propertiescaAuditSigningCert.profilecaCert.profilecaOCSPCert.profilecrlcaissuer.ldifcrlcaissuertasks.ldifdb.ldifeccAdminCert.profileeccServerCert.profileeccSubsystemCert.profileflatfile.txtindex.ldifindextasks.ldifjk2.manifestjk2.propertiesjkconf.ant.xmljkconfig.manifestproxy.confregistry.cfgrsaAdminCert.profilersaServerCert.profilersaSubsystemCert.profileserver-minimal.xmlserverCert.profile.exampleWithSANserverCert.profile.exampleWithSANpatternshm.manifesttomcat-jk2.manifesttomcat-users.xmluriworkermap.propertiesvlv.ldifvlvtasks.ldifworkers.propertiesworkers.properties.minimalworkers2.propertiesworkers2.properties.minimalemailsExpiredUnpublishJobExpiredUnpublishJobItemcertIssued_CAcertIssued_CA.htmlcertIssued_RAcertIssued_RA.htmlcertRequestRejected.htmlcertRevoked_CAcertRevoked_CA.htmlcertRevoked_RAcertRevoked_RA.htmleuJob1.htmleuJob1Item.htmlpublishCerts.htmlpublishCertsItem.htmlreqInQueue_CAreqInQueue_CA.htmlreqInQueue_RAreqInQueue_RA.htmlriq1Item.htmlriq1Summary.htmlrnJob1.txtrnJob1Item.txtrnJob1Summary.txtprofilescaAdminCert.cfgDomainController.cfgECAdminCert.cfgcaAdminCert.cfgcaAgentFileSigning.cfgcaAgentServerCert.cfgcaAuditSigningCert.cfgcaCACert.cfgcaCMCECUserCert.cfgcaCMCECserverCert.cfgcaCMCECsubsystemCert.cfgcaCMCUserCert.cfgcaCMCauditSigningCert.cfgcaCMCcaCert.cfgcaCMCkraStorageCert.cfgcaCMCkraTransportCert.cfgcaCMCocspCert.cfgcaCMCserverCert.cfgcaCMCsubsystemCert.cfgcaCrossSignedCACert.cfgcaDirBasedDualCert.cfgcaDirPinUserCert.cfgcaDirUserCert.cfgcaDirUserRenewal.cfgcaDualCert.cfgcaDualRAuserCert.cfgcaECAdminCert.cfgcaECAgentServerCert.cfgcaECDirPinUserCert.cfgcaECDirUserCert.cfgcaECDualCert.cfgcaECFullCMCSharedTokenCert.cfgcaECFullCMCUserCert.cfgcaECFullCMCUserSignedCert.cfgcaECInternalAuthServerCert.cfgcaECInternalAuthSubsystemCert.cfgcaECServerCert.cfgcaECSimpleCMCUserCert.cfgcaECSubsystemCert.cfgcaECUserCert.cfgcaEncECUserCert.cfgcaEncUserCert.cfgcaFullCMCSharedTokenCert.cfgcaFullCMCUserCert.cfgcaFullCMCUserSignedCert.cfgcaIPAserviceCert.cfgcaInstallCACert.cfgcaInternalAuthAuditSigningCert.cfgcaInternalAuthDRMstorageCert.cfgcaInternalAuthOCSPCert.cfgcaInternalAuthServerCert.cfgcaInternalAuthSubsystemCert.cfgcaInternalAuthTransportCert.cfgcaJarSigningCert.cfgcaManualRenewal.cfgcaOCSPCert.cfgcaOtherCert.cfgcaRACert.cfgcaRARouterCert.cfgcaRAagentCert.cfgcaRAserverCert.cfgcaRouterCert.cfgcaSSLClientSelfRenewal.cfgcaServerCert.cfgcaServerKeygen_DirUserCert.cfgcaServerKeygen_UserCert.cfgcaSignedLogCert.cfgcaSigningECUserCert.cfgcaSigningUserCert.cfgcaSimpleCMCUserCert.cfgcaStorageCert.cfgcaSubsystemCert.cfgcaTPSCert.cfgcaTempTokenDeviceKeyEnrollment.cfgcaTempTokenUserEncryptionKeyEnrollment.cfgcaTempTokenUserSigningKeyEnrollment.cfgcaTokenDeviceKeyEnrollment.cfgcaTokenMSLoginEnrollment.cfgcaTokenUserAuthKeyRenewal.cfgcaTokenUserDelegateAuthKeyEnrollment.cfgcaTokenUserDelegateSigningKeyEnrollment.cfgcaTokenUserEncryptionKeyEnrollment.cfgcaTokenUserEncryptionKeyRenewal.cfgcaTokenUserSigningKeyEnrollment.cfgcaTokenUserSigningKeyRenewal.cfgcaTransportCert.cfgcaUUIDdeviceCert.cfgcaUserCert.cfgcaUserSMIMEcapCert.cfgsetupregistry_instancewebappsROOTWEB-INFweb.xmlindex.jspca404.html500.htmlGenUnexpectedError.templateWEB-INFlibpki-ca.jarpki-certsrv.jarpki-cms.jarpki-cmsbundle.jarpki-cmscore.jarpki-cmsutil.jarpki-nsutil.jarvelocity.propertiesweb.xmladminGenUnexpectedError.templatecaEnrollSuccess.templateImportAdminCert.templateImportCert.templateadminEnroll.htmlsecuritydomainlogin.templatesendCookie.templatecms-funcs.jsconsolehelpfun.jsindex.jspagentGenError.templateGenPending.templateGenRejected.templateGenSuccess.templateGenSvcPending.templateGenUnauthorized.templateGenUnexpectedError.templatecaEnrollSuccess.templateImportCert.templateListRequests.htmlProfileApprove.templateProfileList.templateProfileProcess.templateProfileReview.templateProfileSelect.templateSrchCert.htmlSrchRequests.htmlSrchRevokeCert.htmlUpdateDir.htmlbulkissuance.templatecloneRedirect.templateconfirmRevocation.templatedisplayBySerial.templatedisplayBySerial2.templatedisplayCRL.templatedisplayCertFromRequest.templateerror.templateframeCRL.htmlframeDir.htmlframeDisplayCRL.htmlframeList.htmlframeListReq.htmlframeOCSP.htmlframeProfile.htmlframeRevoke.htmlframeSearch.htmlframeSrchRequests.htmlframeStats.htmlgetOCSPInfo.templategetStats.templateindex.jspmenuCRL.htmlmenuDir.htmlmenuDisplayCRL.htmlmenuList.htmlmenuListReq.htmlmenuOCSP.htmlmenuProfile.htmlmenuRevoke.htmlmenuSearch.htmlmenuSrchRequests.htmlmenuStats.htmlmonitor.htmlmonitor.templatenotImplemented.htmlprocessCertReq.templateprocessReq.templatequeryBySerial.htmlqueryCert.htmlqueryCert.templatequeryReq.templatereasonToRevoke.templaterevocationResult.templaterevokeBySerial.templaterevokeCert.htmlsrchCert.templatetoDisplayCRL.templatetoUpdateCRL.templatetop.htmlunrevocationResult.templateupdateCRL.htmlupdateCRL.templateupdateDir.templatecms-funcs.jsfuncs.jsheader.templatehelpfun.jsindex.jspindex.templateports.templateeeGenError.templateGenPending.templateGenRejected.templateGenSuccess.templateGenSvcPending.templateGenUnauthorized.templateGenUnexpectedError.templatecaAIMEnroll.htmlCMCEnrollment.htmlCMCRevReq.htmlCertBasedDualEnroll.htmlCertBasedEncryptionEnroll.htmlCertBasedSingleEnroll.htmlChallengeRevoke1.htmlDirPinUserEnroll.htmlDirUserEnroll.htmlDisplayCRL.htmlEnrollSuccess.templateGetCAChain.htmlImportAdminCert.templateImportCert.templateKeyRecovery.htmlManCAEnroll.htmlManObjSignEnroll.htmlManRAEnroll.htmlManServerEnroll.htmlManUserEnroll.htmlOCSPResponder.htmlObjSignPKCS10Enroll.htmlPortalEnrollment.htmlProfileList.templateProfileSelect.templateProfileSubmit.htmlProfileSubmit.templateRenewalSuccess.templateRevocationSuccess.templateUserRenewal.htmlUserRevocation.htmlbench2k.htmlblank.htmlcheckRequest.htmldisplayBySerial.templatedisplayBySerial2.templatedisplayCRL.templatedisplayCaCert.templatedisplayCertFromRequest.templateenrollMenu.htmlindex.jsppolicyEnrollmentindex.jspprofileMenu.htmlretrievalMenu.htmlrevocationMenu.htmlprofileEnrollmentindex.jspprofileMenu.htmlretrievalMenu.htmlrevocationMenu.htmlprofileMenu.htmlqueryBySerial.htmlqueryCert.htmlqueryCert.templatereasonToRevoke.templaterecoveryMenu.htmlremoteAuthConfig.templaterenewalMenu.htmlrequestStatus.templateretrievalMenu.htmlrevocationMenu.htmlrevocationResult.templatesrchCert.htmlsrchCert.templatetabs.htmltoDisplayCRL.templateunrevocationResult.templatecms-funcs.jshelpfun.jsindex.jspindex.jspservices.template/usr/share/doc//usr/share/doc/pki-ca-10.5.18//usr/share/java/pki//usr/share/pki//usr/share/pki/ca//usr/share/pki/ca/conf//usr/share/pki/ca/conf/Catalina//usr/share/pki/ca/conf/Catalina/localhost//usr/share/pki/ca/emails//usr/share/pki/ca/profiles//usr/share/pki/ca/profiles/ca//usr/share/pki/ca/setup//usr/share/pki/ca/webapps//usr/share/pki/ca/webapps/ROOT//usr/share/pki/ca/webapps/ROOT/WEB-INF//usr/share/pki/ca/webapps/ca//usr/share/pki/ca/webapps/ca/WEB-INF//usr/share/pki/ca/webapps/ca/WEB-INF/lib//usr/share/pki/ca/webapps/ca/admin//usr/share/pki/ca/webapps/ca/admin/ca//usr/share/pki/ca/webapps/ca/agent//usr/share/pki/ca/webapps/ca/agent/ca//usr/share/pki/ca/webapps/ca/ee//usr/share/pki/ca/webapps/ca/ee/ca//usr/share/pki/ca/webapps/ca/ee/ca/policyEnrollment//usr/share/pki/ca/webapps/ca/ee/ca/profileEnrollment/-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=genericcpioxz9x86_64-redhat-linux-gnu       directoryASCII textASCII text, with CRLF line terminators (Zip archive data, at least v2.0 to extract)ASCII text, with very long linesXML 1.0 document textexported SGML document, ASCII textC++ source, ASCII textHTML document, ASCII textXML 1.0 document, ASCII textHTML document, ASCII text, with very long lines?7zXZ !X] crt:bLL*N }CRq15`r0SFozYguߙ":sf/\![褚1%7xZn+]b?\x,nO`[eo}ɨ(pr9x[Oaaxjydqsz=hGV3z_laNc,`Ht^*8[@,vSqOd"Pq^ʢ hqy^7E6XQk!]'=L1Rfd"/ݠ/玜_p{F6XL Y|dj֠!oLhb_&9S kg$%ߛI%kۂX<#fGID)з!QCNd֒!SWb K5-3oo?c"ov}l=yQ\ԩK*f'|o7#ݔf@<*cyV TvBkpl LIYF'SP4:0Q, "R&r5u^CewGw"vJʴ TulgQK.'L^ʷIVhuhmYzKӬTrost`׈]zҨژJdIۿ=~Z8tgv^qZ&z*%\9h>jؿ|,Ias¿x8֛N $#MO9$-<ׂ%jH}yp_I&LVH['^58b1&O%Soc1E nY AI}'m+c<ѪrhF:L>Yʅt!JdtIZt#O:6j ͖XkT;A*< ˅||7Ui[ǽuOI iz!z&sC|blj[N?ǏS]o=TU8.El{uڹ2?. Ru(1GR6YU ~{J| -c܎ /gw[IrԤя5 7~pc@=M(Hx.Â=zn75Kn ԭ4;<3J 0{?ZRFW,(ekj0`oAŴ#6Cm^B%%#Js:s .BU禪,l"S,zq`5xs(_D3w%޶a(9+wHW?w%Kry54O)*G F& [i1kUI{buYoj$<"udI:օ̗BdFfĊ_7}"oאh qoT\P:~RI>D^+ž91rLBb^' k˶lR^O|tz6r>+&Jo ^WeI9ˇY8;{:'۱lKu3qR),~,yWƳ;xmWX#\[nŮsZ߼"YCnhPE%+`8:3@.GnT%FGhYbQez]+*hXkԺurH @G(^ ,7$CVjWj"n>"lAJ󦅝"VYն+ψH "B؃rY*X׀d~()ȺrO6ŹiZ` iݯVہV!/#VV)wMmݶ\ST(Οem#CS5S皟&kO@rw);L4[{Kp}W~ԙٓ{ËiR/nyLl^)KΟ!o({& mEtJ) жia4P1Hy wW4֭Q.ϫҐQ%067[, 6pgPK,CiÜ[f1b|aӛHOgK8ZZK9zlN0Q6%h4.Q?4sK&^B'?;R!L5 s5&b˂`eԳXyMQ|˫x[gFXB(nNc1*#$Z3w: HaHn/Qz%lԁ|]܄ ]rG8WY?=Us8bx=Ba+ZW25Py_ЃrG7~ w^MiL|[r[)6ayc앸VAϖo.Bt|R0](4\8}ۋk~oҟ1qt'CJ'm6-@"Ω&.-X=Tw X'g@#pTU~uaѩ@V~"tr'f ڷu¨b?73PW] 98L38jyw<'Zs(Ynx:%v8&i"7CN2^ff ֍pQ\J^FT6ڔH:d4_?L3"JB/ɪvzgdERiXqw98C<'qp-xl?gإ=ybRI" D+ipnߗJ%߈+.̎:& @N7xFq5mUL"NV7缵imdL I2X]o XB^UoywaB0i,(&;R@_Ѽb¼(H_;|jN/&݂bZD q*K`eƷM{w~kwWlL)5× [|4];oBl0ḰG˜ 6`lMFwFB[k[7ymDkYk DU{`^cjHw]/e$*3|rF)-z< ՂM ZR7HMu[W_H=TEA6nP)^7 ,lm@KZ78{waܿu0CJe?Ri =+~`Rkrch}ئ| FJҔPf;l|8ܸ7ʡLF3)=t괬\݊3me`PSHX "<<}&jJ4۳?I{x,O:8IJS{RcEjM(yJ3iVeD vX{֟mdyzEYY~U~=V{_MT#B7AC/ɼKC,:&mjS'2c?A ƷDM Hkfs@w{r'[ =iTmF{Mg#<<'q\@@b|)^w&rpiDzh=ҩ=`/[5z1bbT*rǸ!|d1\ATvWWD&IrF=NN77 xtѕUw[H̺Hp"sLiME[_so)|-WWb8;<xxVXhX̣w-jG {,s0&#>m[?Zrt)UӲUJUvvfWs\Y!E^inS٨ (ٗ|$Ȁh ;DH.yhigIcy[=،YnB8m#Ԍҳj= l㟐zs"R,sGJ{t~ EfO);6Hh8,y|8o*Pf& NН@j@c咯+O??=w] @J8/<' )-$I\|NY?T l$\6]+U"Xpi`ԭ D^K )$|l{aDM|8$FxwBGVT*6C ^'ܾB([ޣfr1h_hXP5:"wtP% #xlӻq yP3 7묡N轠5'<[sYkm寳ΧPd8-y3bYvn `fFLxY=Ic\~/Bg GHZ`n/A\*= &[fPD۵U q ;GA|h_ :!EJPƚ9~' GÉ'da!X䯫 2dPYťD (ockܘtwR5mh$Xm+|{T%8f@?]t8b"@ɻ(߭? 5㡘 m ;w]c?A, XeleZϘ{C*% zQij5B1)WX`4|7"@>54MnO@ֲ3}:=9w ^[_`#k{7 +6d_z£<ݾϧ{w.huF_,$ز;lWJ,*?B$v>XfaEw%柁MFV,ӓ$#PҮqLB|a櫠CgZDI%`vb ;aμe %-{ & ׈X{)jlNg&$dq`4%) o* $eκHAm$( mb[;=)S-wH2"47#EwbTEhLzƭ Ǘ@(N;6M=PuNUZCӻ1>18Z%1y!K3<:@"s8=LV+r(<r8*-"ǯ$أ C/E`ڤ9f9qSKթEg3Hhrh++QW=zU6 Ȅsmj$!OW{ٖ6N{{ʱb-) o,LNi|W3*y//"qe9f!{*)uhq}m ńq |-ZIƼA CQg625G).42PrJu JF"|IмW$5\쉦r l8}уhj# _ZFA#T2Y캆QdSY.6?|1mS-sd7gVSpƘߥ4mP)h푹8ty;Rm̒j?k$NO.m?h͞r[k5X]ב;b~n-X̹q#lADd $~bC+ خ;t1rAU_H [~0?ϧ|0U rf4#zGni!]4|!Q`#*azLMaR5^LtT6g\˨&x/P{/y;meY|1y%JU(yE H:Ldzsn\8:RMba% %҄_~oίE7s_:[ DU,jYݕv'E&$7BA6[t` M.DM9.a3l71x@uxÌ^3˴sc>ӏ%@z]9!H:1ː`I}|]tM=2L]y% dr_f4e#Wui0"I(4"1#>b,H,n=lDa oZ+Oxy | :E/ySbnUA]9ɖaAOcCak ӌnzv MPpQ׮\ Px/:u6qa1Y3L%i*D! -yecyj36rfviOCoE+ʚ~h>,QJ]w= JH| bc-WRLi `=nnRM^RB%<[Ѽ.4y'H3n {^[KBQ֏wieK.+$o[Ƭ 2 Wwrǂ7 ')T ]br4S2Hы)D[b0t )K~.a죰"b^"OVqQrkxG3LW]kOt1PEkp'&\ֹinbvjTqcZy>@ڿOˆ` ZZɟ*A8#w>n ?խ>Kݿ 8 bxv)I$s,ȮiN|N͒]W}PO\ ţ兰Q ;X|vc//~wJ|(=X[A=t1SAt3Ş^6rKpjnd Φ'Yex6mf|:)6bOo-.[pnlI&8jYG２%Ea,RצVmݐ,M:1i+i}@rxpauMDdluc+XFPToTXgW?#meA bm0h__>ڣۈa)]Pl"jqDmkɋ4u+ʜe{ioByYkȗ:RbĊWW7_N]>l0u[7構3n3'Mӄx=UbUACk%?GՔ4Jb.)/M}v'6;k dkl9==sHY'ioaSn4T2UK#X#ɰ8VqNo䲛Y VRdnLta貒 L -4,iz8Jq|{,lڜhQWJx*eR 'Yi|R A[}+&Kg!Fm&'dA#F77 sX6g♷s]a D*"nSF7p|yÀ=.M:H VnRҏrf˚!tSI*'8Dj`1}&:!G$0 "+Cx ԇ9PYPsP'H $|k8>`UbE;2"jP15|vKѐN-X+ Cueu2A;;b L<ʟ누{/nݨzH}\YLpf*Wݵ俰[cܰ};dgfğf{Kc#إ59ͻ\! 4+UŻkdAXbdÊk&rJh~)lZvƞO3mJq~~XZ$ֶP0ޞZ$7ys) A䘟RxrC10ޱ z"YÑvfrx92^">ď9>qT6R@mUB6 d53|ӀEl66/&vGC69-Gw"*ũ-2 3RZ|EeòZD\R%yA& 5O}& ,gt '4)5 0@/n*8S&…>9@K/ZG.CʡGp2 q^.l%G`,1|4O+ h2oTE>}͚f$$8xmKt /t>$YjJ@~KJʩmFѐ"K3X+!EOtx#hYy~2SաbFET"VE8K=Hiaf|Rp&ѱdpH'^@m!dxfDdkw+V<`J#\DgN6)'_忘_eJԗ*a3k/?^{: 1x(EEø#0];I#t慅w[FUbhD;Czε}!Its4Tz:[pX┋N1-"XZBE|'`JzKB/2G2Dށw `+O3  j6$CM9#}Nvù~;doBS Yi¡aI&m1IyxA.͏"_^(NV& i?rrƌYqoT|?,~7Exq K(cٓWֆe:D{ݖ.Ok]hgqѹz!^Xb .%²HܟNm>({Эn^W+^Y{1~4<^N%P099ٟ;jcZMϳd29S,A6i@4keI0q %,A?=)G^ 5,T@$a`N ÷4KO _:fsKuIJa'VI&XEgZ"1oL&ŽY]$TKQ&K$p~ ϐl遺I`k 擈։"䋳蠏 ˇ˲C_61y B2?$<=j Fu 0o1B\d<<%,9ńɰ$)")Ť lK]L)=A&Ssbhj;#K9'AZ=¥BP)(e$~*uK6(R @ԶAM$i 5x@9U UV67._> ZpJkFgVtcccOWp`LlBC(&a_w Zb@cj0N᭟t0@1{*'I<6ƮmjLzIZVIXL]RNQ- -U޾{/M6kؽAd5mvuUN.⛠>y0xy3s5LG>yX^Rp" =cj&]8W&~IGvX5Jy)}vY&OsiumM2}( !OꃺҌ1Poi4!)-:kwCX#HM/?LUgwtupd'3:,Zhgkyi^T/>m™޵^48 tXE~ۦk8؋ MЌtAN Ϟ 4hgf4]HP>Ζfд]tiLF+uG&Tʗ.9 d{:M#  m}tck2^6 K_N9Fg~'i2YXWڒ=8O" 4d &$:wN+(èL|DeL~K/ WfpF*]P;s=O[v'p9Z8(֑"|>xrXQvDҨt8YiMp -Juq&WWގzJN+ 1L&S;:i\q5HD)}'j>0ٴ!eأ,v\ ;1>>:;\B[1.'@dvF$.r`0B@+a”~f~M0%6$" 񏌵UhX> sigϺ'W {V/N+t6`vﱟ Na'F v 096QҴ`ɾ{uO}PIR??9w95Dx6{@6VzkL!7}zrIG {7ZܿaxC*%Vx9^[5{,r^A.uS~jr.m)S,BBs}閡a  Eu=V)7:-_C: 9Otdz8e 24/TX#h)rd p ԂWPWm!YzSwZƆđjcЮlyQ~ l'pKkJ\[]ɾr8VƞԚIsL >G xE-B?yIؽ~.qp7ӊInƸ{9 Kx'C^nK)R?Њ~tszEWrwg@3\{=iİb.`PrFD[>k_ŏiE@xI\+J$bTk04|d0+ <.hVdE0tJi@od@%~gP e,A\qȐgr('26y+#:R/13 ) U_kx\** TT.T-A&ySB~8`dIY$-f"xq\Wȷ  e0Aؒj֩I0oP^  T8k"gU Rk,šƐ~v=a  q;?ȼ`zz{dWRPö{" EO) dE`HS6s7{-!03-QO"PYw9SvL}L#ϥdV0ڇ5IiL~eGn;5akL8!Ӳ c>ͨXͣ?]kZP !%#J^'\>>&tf֋.W>NV,ScOp븺[W-'&@b8*z gYzBJAaT(tg|g6tv I浬6ҹ>B}~2#8 /SgK~0e%(#~%MBC{Xf$av>;~ 8w[+9VTv'k_&u*mh EМocuieϮ熟)IӿLDӗ_rd[LxRǼ;$HԌ'h3IE_SaQk+_3վ me2oT\ֈUU.`nU 8*xFFlxE>_Qajlf5pmHMGa \'ʤZba}, iGV S> [֎4cOj!n a,9B\v5%DSYJyXO9lJHr4$Q|]cT57/\teؐ 6 SC&QŇ5_ /v`x&JoLtOSNx ܺ@3EOI[*|wSXy/ՔW_d e7^q@L`#.H.<.fHh<[SO^? 0 hTT7%)e+;( ҙ׭uI[WݓcOi[_!j8s=?gd$.:"H㣖( \٤{K>eT0(#'mvAbcŽ4uSc+zMA)A޲BT( ϹYdsT7ܩc:E,f2s]!T P}M b[jF`5-z%\Z>.(ALk/=ub'_ק=E@>nQzr@wG!Mf@%a"m{εc{5V=y$] W_X'eE :Q͘_a_ggHex%fa:B*s7LIH1-TEI^qEI9>KvͶ#i0BM aŕōH'Cyž)~6O=,HtKޱmvaA˘+B22 `ېvN_PM|aa|J/$eΑ!NV ~7Z]KEކ v2hD,5M+ D{ԂLds5sa)Jz71y`">O釘13 XTNǻHAfJ8UHh5հ{o'D(/_`чaaRga;IkSP̾|WR,nsbY`'T)&Kpq->Ftu"ees2Hi|d\ V^R^psS{E}bU~C,+q$j=ºE^t_ʜ2+6";`;#U*_WQGu^ѐŋC@)nKA3Bu_ejx̓d@$#jlҵ+>#L[?oI jkB\ $*?^F~N0 -9ٮC`c3i$5,yMFz `Y \).+0%.!ie-PBە4ub=Q wr߫$0ne*@]xR ަ @sB 7_vݰ~|cp0P#uSy)T*51̮,>$esۗזbbQ9*PmwY\f;ji+\d?5Y^Nu)j!G%3A %@Z 8n^XHX[v)̃*2ȾmKoY\.Kr"}|EW?u*yGh!S?cU U r!Aјe&SsOOv4ͯҊ>wÌ,΅F~YcøZ2(ExWN\b$ f^d4#֪-=ju0@yu&,de'="ڪ$KRְܛGP-N܉,ŪiQQ^!+&%MtT\W7 .WI,`#פ"};L);*%H#eqA% B-hLV"JC 1<GU8!̍ 5rJ4PmlAt=\/ Z P~m ewg.Syͭ*-- \J%@\2]=T9$.\GKͶvR[E #ϓ3yvf6Z嘨!~O}ՏsHu]Zimɟt~p8!$Uȿ1.&l '.>vi>~CWx]>B?ZDzZb!m$*Htð,lQw8/h!^N'$^@&desg[Fزn_S,+SG5'>jw8-Rn2aw~] 6œhɹ䁍1z1Oz;ҏDGh'.0VYy A4)Eg1ItW!c_Zԯ+BFs[a#8tݙ[b:s?w%-$Dpkb Wo/ TX׊.kL0]c{&Q9͠-wUpz4,J\cmY3`f"(:n5;ߌ":u)+ΘHRv*nop(Q͍u}A8u~zD}>|!wRgT B."8!Z?a6Zĥ,[!x#2HŒM%4iI<۔>9~ dxXa?AX(M*u)F2HP̉MbˎieZ! y6.Iꡃo9IUp5u3UK-ˢ1%]4#ʮ􆋼8V%A*)YB?{%Y"þ]!0#."u|u5!W'4s3+X  1.W1-E}سur 4hTcj Z_Ts#;n)0b<us^\hd~?C'µ~|FW!y&<ba}־X~Z_ΣIre>\UnS9Ŋ!4zB(x5%Qe$P>&}dohaV;dG &@3lg6oU]BIiʌmMǶ+fDd*zsqUq^;]hg[ qEI$u1!):z`F}y*vfmɔQ4/.Ұ#=+Qk M;T571K\{z6k|k K[S{r*폎/7qTƟ<`{jt}#Gwf)ַKe#Q۩RJ߼М@9:;D\E‘,UdD &[?3{Fݛr:0LO;_\UY,+Uԭu{ E@ ׵:B푲8G')`+bԂ%[Vs_Sm+dk?1lNTZwU;y j.p{GexA~t~*|Pmhl9 sF~2= eFL=\]9fg"IYU4`XW#b+ Y a ' ŵ‡mOyKa3oZE֛ڤ"Qrf ~>Ƶ;V:Пj53iopJWd.r58XdM\}{}$C*}OM㆏ ؟et0s](SeDjS()S-QХ8ZB„~nUȮ59zg+o!-oh)׈mE+ 6)WFO.H esIc3V qĢ ~M. Kp2(K,h0Jɓ,%c!n5xJ2Cܾ[z,*eqn5 O =l¬*٧,Oh|S^= `9@Qu̴=I?^ꏢW,RA+P-&6MQVzv_2?g|~ {la{e$(zGb Nm|پ*?YyվF+;V=݋^l< Hw2/!|VOvwVgrIQ>eF)Ɠ@k:"e c7CFRJaa?<\E"&㌤1M mm|k{N̅ ltq\Aq6.52 @Soao l`R+XF"ޝ\]>,{g_ 'Vn!F7 ܯ'q1OJ10]sox4< Ƹu4ww`Z"I渥cfB:t:-;{=\03 rېstR{ɋ gBLqs&e];i?Vw5ـB؍Ɲ_[¸/k㘞6! MAG >+&g DJ|QlA VU'OSCB<)]]y#*h bM8AƬvȭyu4r#ENHWCZ@mWШVei#0xж!AkѴHgJESit]D5(]QH xKP8sx*N>KSDe)'҇B? ѢZێ<~/D#B5םlkb"U5@ ,49F =~PN:5 (V 6jI rRh%nyI`#,WS2ZU#ޞIQ `Oo&[#rGq1u,) :|# [+W ycbQcݱ$!usbކ[SL 6搩y&Ҋ->j-y2i՟;$p8?LL*P|^pSY%~++ l5*i48Ӄh=;&?rp|9Ȥ_<k#{tv\dwE%% 2"wA+p6C)ƞ @1O9Nx2j6 qbS"r$#N884UܐW65Nb_Xw} >Lwitmy;m-? 5M*RT_.(XMM(wDS[s7UPB .S񬦻ǯmfRƎA(RT BCۂ%E-Cbya@ P8½\Fm-A|շg- +l/f$jE܏ڇ^SfyLyٜBd1|՝p&mQnÏ6 ],YIH#K 4E .,ZcIUؑdn+:h/".tW!ĭUc"撢t3vk+;yd{>lNNK)yv1b~RVΨ3)3]])ΕԱaI##uJ~^1Ŷz`_cawB@1JW=ZW/߱K75 ¥mfUʳ篂uަ+‡OЌ5P!DlG`oeHE@AJIsFi;pO#k>I"#]NtLt{#'JulD Ǯ7"'[ސ >QyN%Zm,5 1-`8͊h2.#ov]oXѪok{?_VXcSxX;*.5DN 4YyLYI[<ܔN0Y +‰vDJL_-pOGeleP Kb Kh{Q9X-~dr1Cb?O0Շ n瑪Ч02 YWtM)%bŴC?Fj7n ] LF;hXDgE]ݿVbXl 'L|ZjB‚q[w!(szv`ٗJJW<B #Wp6`s%> A L677 Bٮ)U~V#xح]LG˭ /iB-B|M_y^fR/ +Jrj HP:Drl"go'qH8ov(`ػn)V,U@rrA7xFj2EVٰ/9Ҷ}BF(U8P~tPįglb$3RHu4=ú_s|$Ou@{mNף"58.+\s19f|u Y?n|pLCq4ƒ$[_ QB ^& +Ё'YV :$X C.Z.-Dv@AQөYrcLA]/^D\amKv?0RNQe; πe~6 Gb^z`UZ3FL_4VgQ"YwMam\:>ڼ3d-u瘋Hѵ8F,l!}#ԍ]v e^ƈV3wzXq"wO9(vBEd{]OB!tq#bGyx]ퟺ$7=,LGYEeR}G*wS{5c1zB: /' O Uh5YTMW"eByFG|E6-N/RS/©^\X[ "SFw?[Ěő| =*E]z04ߗxDϚ>d Q ƭU5HձX{5>- K>DPa|π:Ev9ͷĊ֪)rvJiH 8I-DZ{}&ޢ] KOgfZ !{:,I,Q@)qޯaR.Շѷ,=8koT[w*ۭ$WzD!,z? JMy=>Ylz]&LpgXUB<eL9* xՎl5̦{~ʨn<[k-}gҋ],̵צat฿4N˸zOW1 ɋbM̛b'9Tht0k) OPx09WHGdoIQ_KX$ {o%f{"/"~I ҕU KVF󍩒3B [,"3I+]HbJjǫyr~3ٮo%FU<;U`qMg(9Ju_8EXF_7/̑@%tK cl'O3@kJb\:<2bɡ.b1 )J8 I Ѣl4aW䑻T,5Ev+3Liᅩ:( #h˘0͊w-\y5C&A,#ҡE.xٻ`lP')ȸ4d)D趻`K sS s =o{W^r'n03ak-z ^oaNgYx; _(@> W쉌V6lD׳jNd–|Wq8 T!:*9}R1=10+ :`SHھQt691'e}Ck4F:8 CGJ(n~D/%bnK_3Q,7GEa#nz jmfӭ?i8Ab-2//uXWz1}1;c g>!\6?&$rVJvZLj<{>- |g[pSѥFm2֚+ š.=w4,ȓA]$ .<<ߟ rW|t=خ$5ܚJd'@ ČN&pHxȬTZsfNnP6&+D]D5d<ʳ+ ZXjk@LG!96.(X:oN"EƯ ̠M?Mk `S`afOBIQh< 4>+!o%3UfLD1Sc LKG+5͊Yrq]h-G54J9op;(V<`Q@-q}"0O{ X^QGyŁZ퉧Zqܦø)2P>T%z%NN ٠dB!&ȤNcZ k3T`%w8l"f-б=/fe'2Ȍ&ܞ!P F䡫ɵyV@cO M9- @UyinF`qPaX}RVp+d/ Q;[}& ICᗉhWSpS#}ӡgKU $އt:%ـMneƏ<LJq',od[_gۋH\b,& ,ش#:j+HP8P`nn+#-O&;pE=p5UH݆6Bc훊/iDo(k/pW1T#Zq0%`O$9}@3SJdtCF0m!{ 78[Gk1=BN"C9:KTf[`Rɏ\?[O4uxnِ^dysu_t@m##I0JHS]k4#YC c!FX=mNgkِYjSJ]^b$Aq ])vj^ A *$ba}ӨI[ C9^4-E%=g_z m2АS U )rtgz3_j 8=D\Op3qڙ<򎒒l.an_p C+,l X EdsTTS;4#է$e,i ?$K.u(JAb\)a:}h3cI!]}v'KLqSA 6qo/#'ߐ*_cfē&{G?"{+8\kt)za[ {GN))Lkr1+μ.(eÑ_U 땜=+w\u=;u.qJ4bK6<]@|6Ը 4$'ޅkE]FshA< ?ȫXo)'W >>M4Kd1Y}ao>ud_deoG (sSh9_v 8W /}o!JExDr~'$ДƘj@r];MJ-P,rI:6Q4!c6wZJthq4/@?r( Hݞ#9T2)YhP?dgđuj fq[dV1]BNp^ƺ%$W$T. V6ym|$aמTԅ²gWr1K)B@twοIޅnb"I:kب@HFCCyC^01şbMK%tv u%q8} ax/f k?; b#Jjkuï'-wT5$Ix 8(@Em4ޅ֜$^?/?I ;UlgyU5 ]څ_z7Ȅ@w_-aj9m/T2Ol씶G"uLb4'SSg_6AW*xv̲}vL &'coY{1ک4]DTffwg W!%G6UF92A9=K 4F/Ņx8RLo*bT_I܂<$]jpǓ`˼ N& mkeXh47Pv#|2![gUL+]X"R>By|nNO`l7/`e }XNN ސc#ԩ0ޝӤ5ty E@3Mw' [p+XN.T+b|v4YUZ/|{%:Ts hQaNM?t{(Sރ KJL.;rwL&Jo=\yQ"Ogٛ8},㪶ziHrqY-n)EmJGMPQ -@*Y`2Zug`ʬ>1^ S ]ѳޥ= u8@F/J<`rlc$jLWY<4^xIwaۅ^,!>AQ<!"-v#rB}u~ .{`d} O܅T|n5 EEVH@/lKiXQ(&j>^Z`t8[SIs^ e}1GXvJ^#b(ĊWJ ws11BR>}x\^yCkM̝ۗS0v vlϝґ7iK?]_zp RGgTU()zJH$x n`V=ոRX%?*БB}yx=GHNx8zsYhhˢ{ոKi!iWy*E=zxR8.s ]Uިp_ց||j~Cmc GK8)+e | z)k}M,&mQgGg?4;jlB0 _R]w  -t cӅ1 DW3Î3n: *@1fljr㢕4>޿y~7׿~4w5O8+ P\_%N >Yqxq|Q1$fҜֶcoB_D.q\`DqB$A4TLMٵbmȿ+IvjU=")AlIfՓ3Md` 3W%>Fs}Ɋh#8ظ|ڸ8_rƶ(-ύ6tWu(cb*2s!#<༥& lkH&J%A*^5G+}NP >8r Q%{Hܔ۶Id$C/-@Lq !!I#'ҬEb$;3+'{E}RBs/}~u2Aiޡ߼}:- ^mޮu|SCm>]d.}, Vnq ӹЊ*xE`S2`!]KRV3Kޱsjfa8&pn[e1?ne|;ؑJ%Mw\25 ]i3RC UfC\V`XP-=A7?U<X;Mz!1א{N(V&)1qqH3jEVo0[=}Vq}NY</M-4 9UGH GC8"V qe$SdfX6<ޘ-253 An(LKxN8hRt.h)FƥG&낅`9ϐ_dQ{ (pDi&2hMSU@jrж[LΡH9YV2A,xsɗeK܁܏8oioqYFmvOv Bں@.*p9*AQS>_xDƊˇE4+ {U12XF}ң6.z`אa!q.vaWȥLP$p9o{f䊆Q撈P݉uvE#'Y~)xnJ.!SIZْN&:v_/=LԋHH|Rx^Ҳ(?/":v8y, {(h(H*1C# 1vnJrED<먅U_:&\KOS R﹂:TyjE$Ԣ~8ޢ $&`{ʚ]o̯ڃ`$6QAbħmU_qBCg@BGޘC_ZG)4Fk9VO-l 3Rl^**vn!X : „yHh(w Vs|=X#֪=5EWt#3%`@MP1sw$\@\'' o`e{hO8=JfrD|/VR\2/-zO^QpxH@_C!N6Łi;z-u ](b1^RQ> 9y6 UlG߰1Vyِ% LX` |'6]j8h.JסXS{㰵^`E\~@iU- , K1ym䝬7]1'*f^J]VlI(wn9M,s{.=O@CKRE+ؗ=[FY6.P'iZ*vѧ ^/]UEY/(lj衙/W6Gpxq'IGnv18^E:?KۧmFQR ?S

~,Ĥ(zϲ766OY-7:SN즍XA%r+U^sCz!!g܁-7@?<7(Yruktv'ôc-2¢3ԡ$&/G2P܉O= ^4o =N&"'3@1 0ʅ@.B#H:f"ϲLLv&F|_-M. 8Ia3壵)'/_c RBԂ/p lbSP4{9AiٽXz~q떨;:3e`myw5,k0T''h 4tD;̐q9k_h+C#AE(cn>_Er1o07-f|N_wu ;'c2H 5fOYZ&VP`HuיSI(_aUEfY3e`ŏ"?aV!f-z/Jr[R틋4㞒,&2P}_7hH:ӋF]|*.MUY`Rg}*|Hߔsv|, b84dy Tǰb0眅{'BJ"BsxE;8S@H?K@KAO?i®测߆N`N#`*>+M8vN`Y$תlUDӞ|9Ah5!\x<(#ܒ\0Ϥ~3wBE%_ d7GzoLn`>͑v}9_f@gg5kޭDNg[$G8V %fn]r[qy`ylخ)eV p&٘@2^}`X|/]tc;^[74`QWmHa;ckjz?}WFUr`M粄j#Zv_<( k2$3{n}hΔb WC |rA9@*ߗr$ MLim ޳O6^`9PB=ăH=zP9ߕgMɆ4GM!, ހ}*_@_ Jt4+"kvE87V"*"`s''c6ӛ!oΤQw[OKis-_)E΂纶yنtC 7BXp9䍅")&i5(fx|SѯTf_;8=RjO`t1H5ueQ~(5)G3od_X{Q輫Q,!j@oNkwqt<[v8kRKWUm-@u NAǎ>F1"c&8I9cc;--Qs:O$&g:d14Ĭv{?НlIɋGn 4$A<݌6oukbJnkx-=21@US'&\/4 cKAFMW'G1C:<~ޗy]{\/O 1 OJ>>Q,pԏ 3Rjd~ c9EZ'\~ vSa4++FP-/^:Č=6V7M!Kz[±XU7 T,01A4lHkqv!m=Mq-"`B/g༧kE/p! ~56BmO?@)}:9(]2K X?|G!`R<_mS;:|+R d; P?/{%4ndutB[\p&3li7B^^9pW'WSܬ>:;](D7Ow$`x=Y}$` HthK(=Ж4(% $'4!1;Ed:v(Qpɛ|YU`AdQHƼ@!An2N麻>(nd5~ޗڪM*O~AD8̿s4s-;(T #Y'ԑJ%8Fy9"w1\ TRBz)0EgXC lN&J/3Y,j;e))oŒaM-_IVLwi,G{ {tJnBd2COtwEMq)IV4(aD%#lvܽ-f!S$u|'{5" $T-B|I5l]¨-S|nI%va'-ؐH/ϰf"fu `ӂ_V2vawچ_m#Ο4P]h DJ/{ Q_qAMbAR|cHAAq186*=íLju OxE=_D|0JbOlUwh{$!e)92.C}Ѕ,↶_ZQ-:!lof 3E Z2ͥN:&Wx{o&TQnq\BXѨ{C$jc$PNND"JoMI~k]36|pەm[n^IF2+vJ;'z;If*>`WBi:y8po"ih}tm=nǂycT 3J_؅#c>;f}ֻφ/5eUWH]6Џ#[ @m_3\cqH3.IK #CSCS`&=[aZSݧBB03J8f-f~jGC6d%*.3\׌CVV~q@%V갺f}Cnoݟe$~ @2q)[uEeϢPv|)))+,#'W|!׻yQzekw6PntO1o%\j\>;~BIګNfCYf^{UaY#~c)#6k'W2BhK vyY-`EyKY;pMDQ%r& =J)/lgDe+9^gpLM^F[W6oU/SY-h"4cx8T2׬^RMyF rw4'|*Cn'7+t7闙>hD!)@H62Z|@XgC+SF=AQcU/P۔q 1yWao{aF١Έ`tĻvgDY~(M;bgqGJQ22kbBTzeGb>j8}?:l"] w=b,] ox<z=-~ʏ}wٍhץ5s^na~i ~W﷪cfH D8bMp!1es'Ȟ B90D b)Le0`)ĝ#'O沎sI]l8iإp/B@k+4r28>\TI)թ~1i ׬ltLlD0??ol"wb(ݞYa˯h˧zUWNA [};2ürA;(Zs(?@S|(H(th=\Tްq קX'T2dߡ_HK=jU:3H16txl)$ka!Bg&`xbO]?̳Dl32J"IX;^WAm X =n03V20?" X2}`x>zi@10Jd N|aR}ֿ"Ǐ(L;!aO8c5/[0%o6-vA9c$a2$]w%4l0Y};ad@?xsUDannCل(b{GGs8Ny{5GE2d*ЦWӐMFdz!ϔpLN: FVNe#EQ+r C2jYVE|ni$m.ʟ2sv&/fzA׹7-LT_v:u)2)_2>8Uz=tv!K42RHk;t8SlU0t[/OoAfVC.>-87o;<`:qH>xW:^K@ ;d!58ɖLXhM<)Jʁ=2AK%wV=9[x6&4 qF}1Ԡ$@ƀRj@ru aSBg"[9ۖ{B`0DoU<9mشsUج uJvf|DxYhdB2X/#*ϰEɞ3"0|AAV,6"P^vu D튋 qy=曇 D#k R@?0AAÚ( ;CM@A)IX}-XiOcv`\4D >nݸMEd|ioX;#֙Mր "WOpwDP17cΦCkh9l`6n:q&1^K|r]eiSY`; QfGz]8w"amP))I1ƫB)-R»erMHTU`bjsі{ODRkJGe; XTWdS18c y2{8P>s>9Gt?c8l׷wg`uCAe;QlPF7(/0VkG>̔ޝHbOmL`~[_4vO!U!  P l* %b! EW @'@ߙ_V–RMx%rm3;a1h T -b1O->'#+AjxY[.sޅI_YeI}|eNkW[XޱrM+ \m-ʞz?,u1>dIƩZO#VYvsP>I[[t=~-l,69;&3T; ֘Y$Ipz&4iE9!j/HyrN:w-*(hak?IEZZr "98=֗arg [͕:,T)I Z"j~HPߎ*iyN/[ rpFCNыxaق}fT)"mbVed4jpnv 秗D mԤO[co& >O.嗓~N]R¢/`ڌ“{5*dP [8K1p27]% k`׉15,=?ҘI,zr7J8RN_9Ӌkyj! 0Xwvo ʠ4Ҽr&9_.OI!!(_<w > jIm!ɉs8.cQIz,E/*gBX1)$5R4&z&6#:}憛w"(뮄5aFдN%,_R.CwE]FuɄ5IlIPsEsf{í_.{h$!,RpaԿ2KGW <ِ{-j%?GP=q֎e髞b'ؙFיR7hV3Y~$VZ:nA7ڛcHcxh \%= ?F˅B.4tЀ 5+ZJi#7, CUF a7SߢĂ^).@԰ǣ\6.|E;yHJf/6dM5%$ouKP@Iߤ66ZfbTNH쁕(MR96oNֈ=O2QvNY1e6їftl{N׷r &NǬH Rݶw4+g6#!)e]WPZ)%%&Fg$lh^߷yc)K^guK6v1wHP_)f"\Iq ObCF𠉴|A6Yphh\HQr7K[dZ l:>„ϚKw(5f3\n'$/۝|jV.V^[qA톬=o.s=tbAWˆ; +u ˞'t5Ӷ|djb!EW"O1'.UQD7\9<8)B| yYԒ[l{ UBĊEfH[[+3Xp/V\6C :ՉVdGVE₏F?$TgƗGZl~mNq&p'͜A?(D=#Cu4-Tɹ u (g/JWB&٬Well E;$#t ! LlEڙj^:"=%>C4ƟddV&Q0]_ag>eat"4N:M\<q$d<+h6 5JWjϡ_hZ O3O9Q1rw7&;Sfi^kbT&B姴Rpއsتti@5eA70JU,1o9g|?I5a_:s A:>4<;|OFGuX(#}#F#WŅޚȯ$ft񜫗y7%^iLӾS. W'Dzrw7{%h>LU_6_TE l)СV .豚hJMtqYڼb/n S*e*@ahdz̍wgmvp9-JheJgMǠ 2l7;w ֐[>cGT0X1ӣU[\/ f!hQ` ^9|ajM6g:Z_Kn k]rL]XRK$ b@_|"[VF 6\7R~ #KG:Ӎ6\(e50vdK|`7܆h«BF1)DՁfbeUL ~6#XM]w#,l8E9vYnW.S`xfH4'MեLK+ &J7J%bWU 7 9 mf&|@LX|={? F"ff"?HHi JvSjف(CRp&Ppȥ ;j 7nM=~xLIyǍaZND?D }r )DMv}whZXV6C[^0GDʱp߿O=eo51L/<_=4dZٌe6@}wDEIDZŗItn@5}LdAIWnSX g ֟vM"q@y65|wLݒ-s-,mC!pL]DIVO+OISj) o1/҉mBx*\P] Zz8,2*M:ﱸa* Vb&KV=\I U&8\R9mJZDj5*OT@ч4Am&y8^>[ !#ZKs?>Yhʽ%; ͒HpsU]r_eslT(^x x=s_b+4d&+J#Wطt6P~_Fp9fqn+òVtf/8+?a2􉃛]Hф_À< d;S{|;AÓ[IN2?'ߖef"z9v{0?/oKZH5T7^L0PZ[G<̊ȽuwMb vi./=6K7D\~27{=`*%PCak? dH MI es]O9TW!Ta /,>5??f8%Zqk7.V:H9xRܳ|-vjuqK_tW*ӭŁzJS [)?Q|oT -6}^\W6>HLk"!AU(Di J(D6G){ )u*/>V6C`s!uwzpC#Z#A dm}~( ^- Kκ.d:B23N^d faC܆Z!oS"+sc':'óYFz)(=BV=Z};~~gD pGPxEٖ=*JGr-V "`7lIN`:zU'2iwQ3bFޛ`%lSľ?+Ob1- \dيFoA;Jq:(ݽH%>ERK@ {aYk2.:bE(AU$J SL$1!!`,>*l?hgHqKI%RT1ى[$ N5=+n:Vtg]j_KJH9c:浉=Z'T38 O F+t%KkI8;,Db6pa9 )pѭG.$c TPm]T;n_Jݕ@JO2F]B(Nͼ(Ϝ,y`.sp'^Tz2U&$C3$JפFcU:"$'qU)xDo=!}0LmѤ'/u9^Qo6QSS^/pDm<0yŀ*+G0J"p[h'+&cx<)݋ R2=LiH>cԩkP&}͇h^"~= f_\3KD%^N y(BR; TM8lLԀHW|hn+ uEiMz>e K"B/$ `05}L۳eb 'Jd$t"QH{Wnb[t\::BC+"爪 LC*үPᱶ3 WYy.(\3}S3r#e8s\68L١>f}Y(d=;lx˗U3>9Udq[^۶IԞ.YuFKk;oQ)~PG( 2=qN®Hˇv;3q''%al2w~}LQp?o[<+@h_=K'3T^0 D‰R%͈NQ((M4?Eg7D34)=gv!#& vK\/hOZ:y=OOb=P`DYz2礛WыBnZ#%^NwC:E&BEF>AFcIvkMf9|+%=L oᣓ'G(h>~ӿj"^Jox$s`r{4jVsFNJxwq`XOO^2 ]sEnREn< |ڰ_ܱ]ÊP 4U6&7uX! bGw0i<3#Ui>A.8er '1D8siyRiQ6xFXƦ1WTg ae$!YBe C䞍~Rx 2~wy֋&{s ǫIpC>Ԫ8ӵJʮI$P+462A}44?uq?r39cfl~w~x [Qt$R3J Y,Ǹ$tQ aߧPS%^ab!XOBAtܚ[,lgpd.isf9w!mN6V?a/MbiTRZkƥK6kYwx.CƓ[*Z U3ܽ"l.ov2Kc:4ƒyQ]kNvރR!|B.jrrK(BdR&:g\c4b-iZTRH@+O BrOewRړ>vϲs k Js<*{ `t@ii&9ӺZ3V9`g|Nք^g>Ac` C`_b|'s`$ uH@P{s-"Fl x.ōo=m$C>I" f&6;Bl~ )ctOjl?-j%[|x_]>͹t0S.ZCw}1nȩ5WzDAv̆% [>dI?5] ZKgQ|iVUcqK_LS ISX\\kj&UUX~z,uP#&xKN&ι{kU~bQvPyl)t)"\7-FHm!<\'H ;%.݀o9ﯵĕ&&DGUmprsxRmD ҍٹ?(F$y2%xjo5oatν?ZTH!pZ_- `˕$r&R@ბO@:?Vgځ#L!=06-JOf r8:L\"\VKXJxY C8ߒ2l5vUc~C8V_vpNuR1b' F]BWM 6i<k'*2֚u$4^* lD#۶,Y)]冝e \Ro[`y c= /(аJws$N#tgBFG+)aB瞰A2uҁ<baz wm}lҼd>[b׳@gy$Lg):ԑl: |E^.NBثռZl̝Nq4&,\1.%@OKixRo#<:ʪ?/`X6@׽1* \*FU.XI:S婨BNbGdVGtơCAf=_{^PL >Ùm<=mF\Kc?LHX} Ƶ]ɰl9S YD:9ئ?QMw ٬vi2[=Y$I~l;jV _L7!|իQE9!B 9>` L}9,]~"XVy΀$RFrEOrjp?< xQ A\]|8HR4?N>AkI7GDxHxo)iH.iہa i+"Q|Y@.А D@owpWIvR[bMA|| SelFMCD=I7aj|P&{/Wrb4~&wzxrg\oUp|{='W#x١MC7 fw6Vh1΋1LFH2MCU4JERtdB~V)qu5j,9_dWifJ(1-X+YT#Bx\JcǔV՝{ٻB&w5!Ըhc-'5mTAGE^ *h* qmS1lHCϡ7)ª+y&a1! f A|we_tv;5RIxMӸmVM2 +v޺< LZ5lx32QU=҄ZEƼ>wʘyJʅ:M.4:04Ft p_0kUуkoM/Y.u/͕H'ej y@Nk;b8L7 wP*9bx1!tP_Za>Ӣ y؜X8O?YY=sX4; f剘GsGAλTg >aaO'>Cza=谆IXs,a d0y`NS_>HYn߇k y4 XY߄ͳjKytJvDix0~M!])Vx'˱W_cؤk)Ɏ %BC ˘ܯ`EM8e:O6;Hę3?5FS;. .mk-}V !|ԛ̕t2e/>؛IT_u9Nq j*fk`]i̘ z"Gs  ưk}#œFؙ*kF X6&#{;cn漢B9sTL& Whp ] XƺyVbËz=ӫy턲E" dB6|:uɯc?6I w&m϶uJG&GA`->H> z/3;伡L bs\ř96#Q^="` P5 !8NW\+8oI@ >S}?"cƍˬz %fǸ*N&f K3 ASs64a'} j}_{ʺ|U4g9%e"ڭj{ qd#a6 IMA}:2aUh aF$)vDl.`q4"tr<2 6 U1,2WU3p]F3/X%@Q&EAmM+$*эI7bX~kH׺Ԓ;>fҵt&WxGM>{EE\aSA5 Ú^P&HKw=q Xh7^4 9t`pj$G׭!]cC:Nd6cv7<)y{MdGE)zp D9X3Je-1LQ.ڪY&/Q3o Mt]AA_8EA@mVWc B{1MʔM9;ER(wr9}NLa/COֽ՛;` JVJw}BNn'QNTq7k߆<SDyVK.CmP߹j nj)iv'T-msM̥Y鏛[>85'+}Gie-+$i-a7"+Áifjg{aA7EW[!mQO^JCL-c[`0L[w,Pe̴/<3,k_}1rTmiV;d9r=Q̇X@ Jl4 8}ʙ5{+YISNOuHʼ[/˟ps0;vt_%7V`|w)#R 8U2bXz_qH"\h~q]0B K1u,8AX9[?g@yYq'%N%LNV(U_cv:~aDsO+w0g?<8g k;Va15[.b}2jw-Q5R * B#K Tt|M"Z= }L|BhԚ2R>SG[g-wKRbݤNr^/^St{Q$"7bj6SR\338j{Ǣjfb79>$h#VA9wE֋ͦ?Ҳvjx1q(v'Cc' fRKrSH,CZ{? ;2^N谺W zL -K(V7`Lv8ƧZf ~y9@bCeva+W ^xx\њZ;?_a |(4,KǡE6OP+3k^eD/:~ rgV%jmQR5HƯZ+r.8 '\Tikl!r{ hϴгND1[/3<ˆG$~ah=KGe)a~6@OM^ LF7HS)OUp!'E0Κ(ВYGӳuNT[]=m*y(B[3г020IЦ#ZtM;r)37F0_edK sO&W9 jH/ަuO &핪ڦ{%!T*;mV܋|TDIIG\ToSև\||QUd.-Y_vo"$sk~E- 3'뮋bɽBDW;σc 8 ?)>ZH瀞Yrb @se_ ) Uee~)X<:bm%d%HH8Q9p+Vy]sb8NJVcnKjPz.Dd+=UC P >҉]0M`4|X^!'C௮M e eB YWkӇ#ٴ1^o[C$ C ;z[#7wI/&?{ 6.WЭi0Zפ6XߔѡvnQ];ĀSzM]5WRȅ)IɱҒ9;3b v-jvY4] `1LͯB{t.3 <Ј+>5wZsT'@$+i?KC ,[f\ vmE> 1eq*nmXy\odI>IIUB}6Sαl?$2dANAo͍Yi*'D4?Dpߣ4u2 ߂c<\Ki~ضBs{N!D dDc=g.?v mqwqV_@DrY,v'mw`\ly/'F|`7d5|KKe ؔwI8ݑY@m5r_~8\lv F ?r^W%3RٝK,h|]"6٠~20Yq_g9E E:ttm|(/~\&N(N=~Xůb~6$6pO"|^MэT}lEᢻGϲl\ޤ*fr]@`%h)l)"07.g7CH{mW9{n$Eȿ*xX3$s&IeJ9|y=;~DkHVOb%䛱LZQXVʋx3 ;hh(*G(n_өI8;壙)\+"<ۋ_"d#p4:Qc[l9NO~q4KGURtRM275;D'b֎6 mcyY?ZjJA^,frpArkvv/ѷ5hH9\Sq=H^6w?*_#TG#"%*xwUQ&ƱFG5{U4eZ;g}B$]E7(]*L-ֶGȼa NJ񖟚0H0>4W|)L 9̶/HXlA@ȦdKLkWY}\BzzKo9ۛ\H\$t}ĶD˕A°maK4pAw#c|ndDҎ`Ir#S@D /o./E`)dKcs`kSAFNq2,+`." YP :ɢlMzF^ӣ6| ygnjn[W?Re7S>k0}_*kjRo/7E/Ơ[饵ycLW!f?Nw6 EHoNe2B8Da .?Jװ~f_d6 PEɷE;7L?^w_Զ-&C=~{WNW91{mJyR\4˳ɌVj_#090?$ dan>̯)Ƶ=u,C0͒@#2=lG% ns,)fh "dib9!<[G,:g/l>o!CUbkrͯDcjH8dS#tH"*ac=%'أ_(,^@]'.b~4NA1WSoS+5]YLPOXs9'TХu/jaމ3ڑE;~v'6οF8+]yqR~֑t|+-Yd` /eRg-7h2Rmtidʼ<+V"~q/!%"eJASqjm_dc> *-)d4!  a_>]dyУtHan$'J^>2j5ujJQ1 (/$Y_5|YcR'gjҰ0TNebÈH{Z[^"mtAcZkd>1k|qM@Z :Q5L$vC{5W`N#&"(~< 7`zi p?W9],ui|꓀;DHπ[By$~{A-6uBv2W i(}CKo^zhH`v#@5cNYrn!E kp拾τY|M#.HncD1w fk*oGVzZ[W`E߱/wId_e[ϐW2Qo9ڏ>xZܤGjM#N ݨf:--ep&> ۸O\dG7Zp_U ^}^xQO®*_и´9ȾIX~ą{(GӘܫ,v9ELNLxbFXc\O/o ;j A {_ ?J",C"G!?m8hܦG*p%[իkZS''k9=]?D!sq B}ᅄD3xW#ZÓçj tWՁ]"p/ l‹<_I =Ah*YRZ[p–:_=jĢozVr2s)+.-2. ksOalwsYމղpm2|$fz[wЋG єw$fZ@e >}N|w2zxpo4pZe:;BphD$ #9gDG=N8b"O&8 e\UJN17ٟ4{G`l;-pVjvTrj|Nz3̰r̫B=qRD&spUUO t@jVHޕ>ǥ.%!ŴT`Cz}DEBmF?}PEUMq`c(a㐿.V}`i[f#ќM5k ܊uM~.A.I̵;Կ"ړ`1? 2~A6yfۜ". n9 <=G1ayɚz[@˫ţBKXoOen"N8 r 9O\(uq-96f^inQR,Dn3U/0VW`b 숝w}MͿ6J0ȵD$4 Zʁj`voϡtMSr.PGEYCpKfwq{"CYrUq K½9 m}C]2H#w%?#h]pr14 Ǡ)`JLQilσoe>Rŧ5] Vq;r Vv׎ނ w,[>ٝ0<4M'9+[#oY;A`qU`wӣ{h儗MsB 쵳O ׁd:/J(:Lizgjh:V/$y}k5w.[g+LY׏d;U(bws :kV,XtP M/O)_&H8'6Yˋ.D;hUcw?80of|sN _Q)Io- [et4/kS+sjxQ4օCqJp/ [r/6,QͦO"$.#We`DP*i w؟DOh'tjAdm_ϫWy)6̉Ed$rU:LŨkZÈ N0V==u%CgWؓ*'|[ҭ2f(`nhb6$&DI Hz*,fQ_.l/F&ӹ.my/K1]\|jVMɊ :! qqXz`+&,5S.m%$3`BB}N0ȥ+jҠV_wNs'&rź M9xpwRP]=6 I =4 \_$,^(ۂ|HW Gp(\: KJƬXـpGV祊+eGP[l5ݩ,CJHܡvɲ~wJ*vyYx7/)[L`H+5\Q9b_ZRtWțPd2YICV QB]p.fWaҦ@Jx'݇<0Wԁ r9z#'?s ՞%=%Htx7 (G`tُws ,ZB ͜bܣ4_T_vvƕý@>W%Z#3Y';۩Uc@IѤ q:L=:_Mq?Feqrh A^f)NHtxl C7|/tWǸTb'݉*_rt!A\i;6zKp \Z'LUb-m]AƘ8/]A R#D=[lʦ|/;Wȉc*Q !%<#%Zj  V'$.t>䌬5#!dwGS!|fנ;dYTx3!r}aK9 $)4LyELu%^z7#sFKg +N  BlDI "Uàf "8u1:?-н3P+B:x`t&Ag (}l5]r ؎ nTdc݁ uMl8:_Xd夹r4,,n29g+aBt,Uh'<ʊ=]dSfR."9wDhBbjumsoeOj]SԎi2no/_!0 :z~dߎ}xjier;KҽIeVɚꀦ!~) @ǟpƅү0BǘtO>;2hL$Ue@EJ2Ղ ~NX83 ao(8Br,wqoE 7o5u;<1im LK &-UFEeK+ /q=/M."a7"wj%⑯_.dnLO|4$]Mt "<~L[k!+ī7v̳6/)+Ko@2h_'$VrAW6y }o\@ CjRXϣ(7v/嗺̓0+9ٳEPC64`),+`o+A6`SpDҲ0UVJ;zZR(_MbGvn|bڌk/5M3iU3+uP"X}Eі+K)[>WO7F.U1aiq3$^H~(2 'tUZ m&#lƷ cU q+_3ܻ:+WGeDa.[E&13ͼ0H:vz= }W֎VIxxuiB,UfU7e@Ωk =S ?h[,)6=&L[}4}K4-Us(uU~q%6U08hhrgT|c`ǡƥzv)$i˘?0ZL+X5O{gl1u&.R}[ћlk[Sɺ]R %yWjW>4c}t 4)pO\uOq&wIcZf0іKN9C6*,Sf0) 3FI n)Nk.ǣ'la_"ߑvadPDT:sOYOGB蜖MP ,3cM%^!`[=jv5)&i ys y.Wwso/l8qq#|-n>6<ֹEVb㫙V70XQV!>~YOT%;r& !Nu Qw2sYDK`&hβUcSc5D.8} 2SȘ>Kn2_ ~ );rb]2#[D~1Zo&n "I:Ļ-׿l 4HVe)e1FL-ey.7̿,/ℇu>?BwvÉ6aa95&꘹ UƗOPtl۽ )s—~L=ϵRGQ_<=[N_lf>0WRs[tUɦͨyE(ka-%RR˅Xla̋zTd{C\PiPMS҇UA}ϓc>^#޹w0WSξK E;^90^ɠZQ^Ba7ˆ>AlEQBi`>nů깰Vy'ce.$:Kgur NkĝkٻHd3.ńC^]iqD}%?XZJO&~uJ$3JD'\\njl69DjX'ʴm3@n C<'Z+Qɪݥ\x ^A{x&h U' '^#9D0Q:o7(0o <#謣Miw} nH#}JpGvIF ^/%? ƗX ,3`])YZGns/ά^?5'+{JPfn2ZKN WNW3eYfjHr?r*sp++`XnشE9k QM+C#9- ֘*nz#0pۿlR0|5D`E4. skjYQAfC=D O?H=\:M|N&[7lL|}Yzt'3t^yunkLH A,~ hIldf#!_R3"{7FQ~!_&T>8$;؆b3 6:u/$xm (F}"(.JHRMj7No.9=pBS>w0*owBm L~+40ϙ +ͫNkޙte|kё7kSƹgꉘغZvIWQ3˷g`pӴ́ƒ(1d'wR 5;(=!/ewrU3m>?"c4SVre kҙӕ-$A,uՈr =2x1ցiIq} 4f0[i`_A=p0Aggo2c}P7v^҅>]6HႶ L2~TG>*Ȅ2} /E4(,Ӗ}/toU]s y@ؒz{]0ZO~23ǣtU榑XH\JfZL[4~*zLmW HEH Wq ? ;E&JuʀB. Ti_FوLV oľ(I}8Pmh[0x,PD*HRfjh dH|q6/.};:I`]pvt|xmHf I>@k!T^[lX> m6%:C$Z`fR7-ʚoܝE"7g4Z|hD[[]8=GQƮf 4.v0v2kXZJJn4,Br ,.8 :Iuv+?>~ic̯~kv-S}r8w/O>=:̧]C{[87ˡ/[o\FJ%0RޑFa޳k_V0uPҒE@<ԩ~?&-~ƍ3,,J`SbƇ-67 q$u]Ehmn0o`{3wlԬ+Q@MF4g[~"q;} GhY׆߻W°HTH; (t-W7TQrU줼]#>X,$E:HaPZ6}EAyU1L."z.#1=8?M"6S=f3p i>Lgn-!TƓTy sc>롭VRf Dc[PC8E"ZsR4; Tm!6}ˬ[6lzLl niiJWlQkAq?kaC%O1U9%Yfcm$~DEs9b[qQO ^(ݡa\R)GVQ{2lYS)KVv6T%W7mD Hb!wR.*3uX?[v0K XB7^GzxC`k,8g ʄtkcD*@`^1u7G!]uZ;7a=xkO rx: xԎ6i\;%M;4"R׹|崞d:jBq̝j5bu޹m&iǖ83֞ufƿx/MS\(7ZB̵ %[cSFS\&ihNjN3ȴuD=lbKhtuByyhxKoc)nq\yy{hFY챭O ?.~~oQ-_ yT ^ Xܾһ~՛㓾Q--6fYyX 0WZ!uo,sk_}Gb,s#8wgz;oS9@Pd `mTBԒ2 XU٭SeRtڭ⸎wc&OF 9`W|v5לqK26[ H΋]1k9x XB"w}1Λϩ ÝwNe=Gt}.҈"U<+~h8 BG9nvJ7d!_ZޠT^[ފiKX"mbBK6v|N+K)hmjs3{ԈC K'1glaM w4T9E5X{cA_S]cbDEp$ .e_~/b("klI&λNC9PcdN㵼CA-x7h8*u/JdX:-@a|E $|+yE Å7$Ù$pR `ܛ<ɅZX.i|u-_'aF!JVX@eJ˜l׸,L2WshnD~w⹨[ rYSU)qT)_st_"A"wd~{(ʿ1^Zh4jFځ=~k/rK$z! dTu-Qň~u!!TU!,}CKnl+G)9Rps:ҜjmEk KLɲ% p@=Xe8θ>w_j2;#, \J.6Oqb8MpRփ 5mdӅJ\} @L* mmf47GRePIE0>V|l΅zvﰂ|2CKᔠlCΙh0)\>WufACSԉHP]aB>,FA识akWop]eA<Yx! zƖHR ,gNn!1;{cZ~!}b'?RM 2[I\fN$3PN66_zwrPu5 E@FpEm*Cȟ8-S/,@&5!¨{y?k:t\^-Q^J#1brD=S!!`H:: E5<9+]:p IbE8q^9:&1|dˢvۈy٢=xfN\EEJE 6Gʏ-[`~oRo`%`څ{D:Mr E9Wè`V^ W㐉 \R{مP{%ُVww (b^ /Rv6{Z5emH!nVho)kҋ#o9O["Zདྷ6׸!j*,_D~K-}TZTkl6<=wrɑ~YhИ3 ]5k(pF i& V@j2I1d?t۟Aj{$4V?0]I>tg$fWg'%s3@9c [ՠ,LDӻrԢi[Wߢ_9J%ub~.M0jy;t4_A zqy54Q"ASYO VltrHd IhTxE c2I)9 'y6DH57>'JadѼmHbL@'~,GF]q)6iau5tla"q`.Kl3. > !ufZ$~M?230dgI'!%ȵ&q$b"s];ym'F1sYĴQ{y{HL j8̧2ipBPvwBc\5t/zb'WPx;u %-.O&ntbwbV.FR^93A6_Q55@E:): 8[;1; :9h^J1bYx,gߕP&>ЇGI) len߀Ki"GoFXYAG Zk2׌#'c=>Zh')ȸ|ݔ5 Q.ЋJؙ(VO46 `)3;)w/ C"6"Ϊe(j_B_m8ÞݢW2D&uh=ij9XPLd[ClF% K`2kK?){n>' puP[r!iVzͶ6{Oz|Zp$!K.+'9o3k˳^YCڟj:!}#fޔC,#fR.GOqDVI"Pe& 6OdTIю|1Nnn# T(K눦Q2\\^.r'f]E>:8"O?=X3D40MD٨>H祐)6_Y@]vAN9Ք|vf+W&̈́>}.W%;BwTzY\FNi0n)rvP0J.DxbNyjI?baWjm66(eJz޹(@{{"oed|<(S}Tj{? mHu.be qwRJ|;{y"`6:Eë%K3Wb&v/{ڽ$)zjINsZWO@) | uQhB=FӟN/ghجxcY)lנJJtVlMXj `j&f)Y 7QF>PETv{&Gg)²e:- a Z7X_m23 tRc !Me{9)#hxn(iszoR4d?PXRB=)j,me<2A嬩|cU,V6ǕS'oqD3F}hf΋JW (11i8$*ax.?Z$t\)Muȑ/.HK6"mӆ4fh\;MD4PvZ bDc ͆b4>XU$TЬP~ ۮl<9XFm ߅ˠ&Y'y瀔3leGw Gt"X34\=3ݡE@z7Uȉg 5l`|+D8t%'+mR<4-|b|B_҇X0c @@˦b/zH|DG!*}u< E> :%EӴm|҂F_k|d] /0ZXu"1n86Tiڎ#_9MeM9qXxjdRŦ Ay >)0z7-:,xS Pn&+]aN~o\J' _w+pBymz JM>2#ҬyI? wv.TcMҊV\23w2`0ץP1h%dʓt:NZf)61^Ĥr 90sr@ޙsl'LC~Me$ 4n 7.Zg)fl˳:8]j#_w15JG|ӱi:ȕsׅTj3} DcO-i]H,R9y!/ @|E|l&·|@s7U[- W,p|3t6 ʂ2[i3ң5㡉]j=NZ"~kL Lz5):m-Iu+&eMm PQc_jM$l!f  &bk: HWgNj9fժkT?Z:h&.DdCo%z4OyiV\.å0g6W`_zrwMpR2#9Qj0|OGX0U)?֒U{s$Kv @!= ԡ!ov'~ImǗ_\T{k&5RjCA[,G>-rI}02^M\Nx r^T@a-|?H*HuEl~PPT-ֺTv=93e9C3D-&:g4JtJK?H%UW84{Rr2+jΗ _Gw;gJDY!T#ު*8ճ*-⬮+%ex^>-8 d MHp}+ŋPFS>ioBj:s@=\Y,۲J1>I:ptob{PjYG:pK]r.1pbψ&ap=e߇M(uf {7=g/6t[Rz!우l]ͭI@7GWjk$n\<g)Gi;OnFNIPLDo]Z (6'UEVhȀ[d,6J*y'YI)s\E ո|Y&]b=0'@;N&rq+ ob!^f==DWuw$>% s ./o~y4N^+b~G-QISd=WR[._hxFX&FS GvO?EjJk}N?3pg 43eB'.]ݪo)"KL=3ב7pJKnXNiqS:rA 0dVS,[lP)lj=(ZF&\Gr3Yׇ%F߼> >V=RxԲ3xoD ]y s#f8 Vg)|7FTJI/ $K< !V􁈇vUƓ&lqjg{q-d:;[QV %"@Xb-uBf0 M~ ,c rC {7żgv#9s6w !W ./J5=VdmL-#׎t jv^ݽBbk d-ԥe~݄P NUH*!=!vo6 cE s$9j>!A‰ &+$t]i#嶾lin[&:j+hsNN% |Jݽz{zd)G]kgp֡J} /L~Dhr†ש錠e)h?EoO9UHkT-Y?ޯbݔJ 9o>lKKup@ lUS,S)x -D5٪+]Rv g7\u3^+kmA%<ł~$F/EY5XճrMA[ZVSN,JZFQ{[ޱc)Q_S [#(wE3YFJWzL'Ӗ{3^ :5@a]oz^BqHи^3mE0bWq)SI3PMs'|MUyL̺Vu&C*/XщW!Qf^ Jѷߦ]݊(ګ[E OA_{n.u R8a[ O]3uD͙ױ%ȥڎes G?gk bW ,$\(wQ\x3MQrPFع͕zEŜф#}F/ue#Ďa&Lfq{~l:Ә es3uJg㍠B9vbY Yf-ސ wnm{6βfye&d<*4BI@ V:~7.U=)f--ݹcZI:{#]VB7Vc fTN>bpSl&Ax!RL: ^ @? 4;) ]IgY4[B=$͡0/<,oA!P@ \r}s鮞U+HȰ>se d3B:b^G0hSv[H0uC6ʔ*peQljh4b"U}ڞe5T<V"ouxJ1>`sERFn{/WAO EK>1eP#2OpS̽-T(rSI*2j$GkB ׶*ZVPX~Zq;4\wbxM+>F_7![^8E'Ը_qa~i!|W&Zck5g@ǵ.g:FYv1C!xS0X'%e!'YܶHYpi5 Z͖g fE>;//JIK<$mj02sSe"}=eZ%>ޭ5~Gz$ #B>Usn @u/c7zaqw+ Iؘw)lR1uB7FA{ 7Tr_0x{OX#3WV"IpqMJ&QS@EAbXepfu2EsxL` ſ) tno;Fdb{(}.+[1SU>Z[6t߶FX%k/' %}X݆6JD{A$=*l`vO&S!&2ogqZ!{s {0FcSPsú?Nd%)m<Ԝn 1U*9QRcP < sC&51e~6 nA]σ>D\6 #C=!~*M4H l n><|hO*$۫WpMb5-{4I7^N'[jT-:h^~pD$yk_ߋI-U>@3hQ'uOd|*žs\eS)U~rx qQ(>M-ml/:1fÓ Z4\FleW:fV?@q Jbvq246Γ)_wsH\Aⴖa(9TAit|z Q&] 7JT1Mܞ-*=ƀK+,W$أ>z rlX|^ K_\wrù1Ͱ5k!+2-MҋeK CY,Sw#DV.JHјg%ϣ1՚k!nNYinH3߽JvL{,ca $&3#%@)b..Hg` *ۿ3ML&~ zį~"C(Ʒw'"3ZQbaԓz˝#~)_Ud 0Vp@u/UX*yƣPnK:u^ z[ onUQKzgfW:D-SzfoxLE_FnO'ϕ[~$n;*d>lIAH0¯ bf'caQ!h{b@~ Ϗ. ^kC 5}M63Bdۮ/Uu]|XO$et'.I~|3*C$PuY#n:hqn7448,GŅWosn<{ЎtM[a`~e>P.+l,XD&%?өۀS>HL#J!A {E %c$c@T*l n"Ҁ/^+awmD_f>3ު3Kc2"H jN 7ӚOaMg>3S'lnt*^7(36ɤHR@>Lo~e/@ݘ .{ȝeQTo!j@8Xbtd2ωGG1P{.~2fq4n+-DpIEC[3ZQq4/EÉ2oB"F `x qMv8"L#oFq,fѬ%ʃ˔ٝ A^x4V爞ӌKԓ+y3 k\ Fb‚` QDD(1DZ1QSywlsc%UY+y."`D+T*ίL:64f8̟p"~17rq)_>um.y0[ٜf@ Csd#|bZxlaO"PQ-ANz,-/*~?vHmW{3 ,J?p#%+-yڼ4%\ )l:iQ(^ggZdD@FMo͒#I.Zΐ aTd<.NX+iJʳ_N@bI-3l}A3*AoS4WyB:Ġ)]D"QW@I7sAsZ|b te~6#vF_C(CAfMҧvbHS"a7O,m]޲1FB!I\/u1ex^:8ڱb l>%4`-E"nZ(IQYsS`*"@pV챳,q{f72qBZs6A @$ *Pqd[ZD%vgn5ien쭕, AQζxN\m70w?7O.+Rqe5@Ǥ &%%-gٹN s +cH}qtvmk&e69 #m<1W5*靲^T/j;:ǘo_`E`Z޿X*IStGyG 1Wkpk2EgLsi/kHmp>őGzu NHvK~X&C}= VIգ!,+EПNoo^1Ud2=iԷnVswO'cD5*rY̫G E)lQW#rCw]y82Fl 0QGC6T2f b2|5lO]G!;H t*`)r:3gZwf5+ ;3QKAȁm+%>G\d8wdngSʡqX-zGȜ_2٫p^EC3򀮘ɿ&Dz#;EJ4rC|{`X Zn O̐rM.!cwMm6 c<H bΡ01OP8~ KEY#*GM|Jɘhڈgulthξ]dNbl$1p]20ډHOa=1 O^=Lz9b*{iGEұ;ջ8kYf9IAehΧ4SZP=&w7QPPSį"{\[vPj25uƀƉ ?<R-P v0RA?SCƊ]9uUj'q8tä!L,~6AӉ:b)Q`U3pľ?.hN7CzPS@&Pj2=DHJ9E5`jY% .7"DMrjdͰܰ6:v {x@Äk6M͘D*Bg? j+T`CQe2[ҎpC{:k-#q+y8Y0-:`TC:zf EDHAH Z7I9C/7 勚IBMk8ۛDEY%[7[mbc/\>3P篧PW5ie$d?3Ba/zhT =ҩnl2=\#`CKY!y % uD6f?|Ke|⓲b_L`mGod&KU^+iқ }8V< m3x z8zp0emcƺ#Rarպ9 9:i7+xE<$=bWxGqֶVٔ YAB5 ņMx(&%֑-O6SD\&62-iyQ(pN(<ͷs<-J:hyqqv3BvvEɠnUs+/D3jS-&cMU`U͕ѸNFyv#t}C. $a𧮤^kToW:5,r^;M1=ΰ riu}1tVm/+.39 ]QHBs C'ޛf$D_C'qvsӇ-5F,L)iz6caX&m;8g{a䃾oQ648 $>DF&ӳEt'}4t¯l1YX &2Jhe/˄6@kg?/m#kN-Đ3-Au{n+-#`OY"SM*%ζH ]LPj5]L:඀.mL[%petb=DSб*B|h 0`2{'4z=ziMyqQAٶر6KKG``ncYtQ GmɮYƒz<b 3ǃ}{e Er|Qܠp3%KELc ')ٻIȵQ( Z~<))af`F-ߟᤪ"ii?衳WϳFm-bX̾#(EfQNDBE4eLa1\ WV!QN"Nx׿A2&f/Y#}AqF,;L5N䨴ݱs1\)5=ʉ+$cqJi_G+CpYoYSe@0*XX#v \α5SibCN K]Lr_ aK9CW&KO>fk[H34!z/{ =pCuv"ПqA2kG=&C 7/̹j`D6Jh@c/O 18ۖ}gۮx/%M|1At|P]z+ɭ/QᶤZ]! ;G#%NǷ'K C0L䯧8bޞ,Ixh_2U4n>mή [],h+kQG 񃔋|!l~X_L] n@켄W{;џU|ܤ:>70܌bǩW!Ϡ(O2S7@}qOGj)aϡ?$HD0&w/;+\_ocK1CϾ2f#QE:29݈#x={݀RnGߋHYت5Ȱ?dE-ֈD$^~]ؒM$L]<6`G8fk 7'03Yck9ebJO!e u| Xȫ l҄9S]wfVS:.Bާ}? zl"84+Ӭx۔ Sˡ1+?tLXz SByp&Չ*1@"~v5! 2 N^D)wksڡۀ˅] 8=k!DɄ]ݣ>@Z@pIiƜɟ_1CWk%n "Z/]mƯalZ4a^Q^K`bp21:w4+ZPZ:SuREN5;RA]w3ZJUXǗZ(shUamypщB!_D}3+TW|_+bc^U;SGxx?&1sDp/v7Yi(e2%/[;lb7-@(yK ?'+_30h]y4B:va3<&O!05qiAR3>i 2I{qkI,Vş^|]Cqل/ =A[“21Њ hPKfEʭBy0N0&E)oB|Ck&)䍶0ahM%tQ,@!%<ԾV9Q;GDppj؞7 {5ErqtaincwZX3òs-JjrsU7Q&u㇞VXQR{ywHH*ֽe z4>$^~j{; nV,HCyٮBK3eFN@ >n6 Sim>-xZNZ!|*GSr Zca8e#d.1h+ 1PCdAGr:Tptwh=VOA81%\^=-W$ľܼ̕Ty=NrcR7ixJA=)9Jc}lHV?͘hHfG͖BuM low /NX]:kP59 14XҝѦp5珨72ru_/<<z>P1ӡ m}pfFpKLڟtU2Swٓ!Kuu}qmM'eՒٲj 4%'n4D.b߰1rf On ;'6M918Q "<*#bGb\7d0}Yl-SMJo{s|d(ɮ\cYMIDZFCI<*ݱ>6[q |A0L:C@+ +D؅J/A -V+1j9_8@I*_BSEOF+!_yf߆}9K<~} *s Ȯ& 9产G!HxG]\x!K{Lh%p&aP#X^8bؒWbpX》}_bAߎn %ãsi;1`*]#|e5adq5'@.`L[K5d8aMUȻC݆H|%@ wW/ƆfG5vwm4؏fabYR\scG%D2tK*Q}~n/?R wo4z$ Tؿx$ZI+}^|JZ+hr?a|t'JStOOYOdzQ `Ĝg&7QL04~)s qnr6MddrJH׮CE:1n~J4tVHjU8?pEr )L vMWMߘ֓=%fU'ޭÔo= | ?}H*J,L (l0h0T(<_D@bRg7YC 6~S4[ʹJwf-]s,v&ö,Scg [o;7y->T#g༇Oa`O&}D|<& yC̍1#b je-Ŷ7( E6}Y6~Zez"$@b+MHQQ2NAj'ɂh>QTSڴ^|OT+}HuR?Y.kZCm8 lљ 6M55v<٣@OP9+w9+Lrk/Pjxec#IKeo7t01!@3Dw+)ߌ͂NجzqkԾrj+gUϐDMɛ֧0?G`a pƧ,);x#mi>ZI\M7u=a ,]GZdTsNֺ@㮣GFAZ/[-wX*wFMZ=цdLC7M{y`f-y@F:#Npj#Ep"MJv^QStQ(9>N9r2>+%6CaG[;ݒY8)7ZpL=¼~*\s$@$h/N#r'h^rL9п*ۊc0P'|:7tKI1{VQw12!#rI@̑OXkoܥ ҅hUeC#+iP'N-7Uj׌s8Cl ߔ fc1_HQC+=ff\^G9!Y*~_y,f*ۀs(GF] 9nK!ؑ/,E6Ms]^j WR@25Uj>C|7*٥)|H98l3Gwl>Hȸ А q̒ ú'ih |6R3u|ZA[Z rɩΝ$ee9d+D:W@9WR’_-I>vd-ZxT5M*P~ϱ+vqa[yK!f:vcH{ CXĉؽ;ɹeB";^xw@4틞SgjO2YsxD86,1dВ?c"s3'ɖ>h 9f4oϕǍz |az)ؓG!G{z,+ߒ-2 ۧwP j3Z/0#sP!%ʴ&2nX!@$vxw0~gRͲhe@ll'|o8Ѿ0>ħW3>HmPhΪIY^yޚ[,V幡$& N& =Usi|Ҏ vY46*łFL?st}mмBsT夸tXUtˬh݊A.2/V| jpdah"ڳ'4Z%d_2VUP$/.k mZcB]"D؊R-E hC`F:BBp"TFUTf& CvL%#zU0N!l>nZYnLAA-3BL㘌O \zժ 9͉MXTX|M/d_b>TnXްv@(? ~+6i{W $篜vEo"ئhU&f-INn|7;m4{F+QN#C|)Qx vN<}hO i/SCWIw\ u^`¨*9qmp6|O|sɳX&| L-ɩi% :9β>UWBzԳԯʒP׺E_8M_c1 *^^kń,vp)I#mV%|HKc咺eŶ(3tFX?rnmZTF N#)v#`5]hY'B٭:дΖC&awkjyh B\Σ!4w'?HP WwGyuC?#I[I$+cW`ɳб٩=~%eG ~sי_:޵^ zHLPxމX)WJe?_O7AE>sBwT3J;)RB7i Z0fԄDWޙ!狥\ф9kds|g iK~KӊìRpCT*>s?[Cl1z:hnT\$tͰbV'9OC1^:+YoPÀTtev5O"ᅏTT6RXK$0ٯ>M$`FQa徜 jpVMza)sL(C i3g p /k+EfbDqA=Lc P-Q'tk~X T3,{53KVC7-*Oݰfݎ^x6VBw&+QЋ28 SWlP]/^p>0z/iY_xgmeQ>cA[6 6`X]ϐJ!)\!( rALzO חZDebrhy$/mƣF1R"?~D%E[5Xg w;+e٪{?oet ]j4xW8/ ob&cY)!DҷKkCέfbg=`ڪf!:/σ.ĥW^yE>[/q9L!sY7^$g Yͷ Qt/Ǖz*\|{=iW8Xm,C}|g8D%$Ho ܥArD]n!wR~g̝qY 'Dxa*H!@J[* _@9F^6Xa'ﴳӫ[ےd&3ApaH}Ǻ#9Ky O%ϴCrl*m+mhPb bqd'*`iP%{8YFHFNؔR;N𖂦Ze03/4*FX48Z9ܽ婚 9%}.rWHl;\=Ɛ;[a6d*@{\9;Jj_X(Z! 5V 4ўx?)=ŲqSL k,ȷhRuLR|i:HxxntP(H0v/kӦKjzꅛؘڿRmomľS [Pq:.jκm1 M靚)ۊU—eIrŎ1-R.J64ֵ]ɻ5`E H,$$oi𻒻35uCE4AD'& TLPd|)?cn4M,&CJBFYy(nL۾N܈˄N$ڍpoRWW_<XRXq6?~HkCwZ(h_ OXG5R.Kφ^jPsa~(dqBJ)n0θe#w+w] kÑz:fgqn-E#2JͤW*RKئ?L u$8yN"[m&LmjJ%'~ɧ vwз$&oy /`sN+~|oU{5Հoc[9>7SMf8»Ej0 W9^FݟA[ ij+l3DwsWț0|{CKUrɻ5K1 zk [fĤxf#!mVBgDVJ)T"KBYɴ9]//+FrqZ u>f0 )I'g"/I`FS3 )Ɇ5| ]塚zK"UeHNait6lTkb)1m_Y6HjMԯO𜡤::1] = @=wh!DuqПsiip Vw)Pa;YB_5A@z, x3۬?79CsF؈ zÊgM]1 :3@g\u#AYKγ,3Ep9[Nۺ^WT=U=Npp4ҫo8!Vi<Kv=&I `BB>:Hng"?FՀqTQVW~F&M|YNߔ9:22Ͷ.daل?{h`7j-SY!x ygGfFt5Z;IrDRq5 WZcgܚS }6!^K,/YdxIɥ]IO-_ kXʬ*iJ}p!796 'dyWC=!K1wSc_m.P^d!Z ~@Wk('޺ &` B=c3JV^~ew=+vr&zTivlOえAD{BLz*?mcMoVUy;>mBA"4Iui02pEMjVm@s:ŭ͍JQNu8M;;KnQSjHLκ2s*1Ap\9:D1豲:y!Eop#q|{REk(3's^fKJ^X= '.(CmDS u5Cɯ縠o3?GDH-KY!x2A= w:~?,i c$d  %ڑ`mc%ƉulHu \ O1rvU oft|<`]ZE=SB=feK 1:ݵ#ZުlH8*_2s*jZ~)Z+]:㾋 id}@j@]*ꅁ@{ٯj,xVV+p+w WY 3 55h~$+>ZK˼ ]rޑMGgLZvoeھcûWv_M?c"%gР|9+W;0PŶ+ڹ*d|NPU|cfitWK=NgPyO$80-R?JilvB7wpmohe#ޘ0 ;^$jsvw.]@P0H$&?̟1FxZXwuW&E+ruBQF)]Z D% >!.Xmiڼft3p=8s* w\~R[܄G̑E;"Jov*ixyN4:U-7 [Idx?KO~=Z7w뽿H3`a_h"5ߑIw̺-x:1WNxD7̮ {MCv3 895&5/g(7{b~9[.-^3O3wv?N8x߫iI漝N" B-,\t$ﱕeJupIPSQ=ٹ{R΀Um\ɐbTE#!r5-9-;?7sDzآx#׫?C6߮ ~3Gh"y%,}6rM:ޝ}weN|C !ocj `宄QH89Gُ)eG&(MrH%+=Yj0с;xjfchB澩ca@PRzÕ*$n=O;ZXG64 @$S#Q E_9e/@75U葎V,\0Gy~RB-yG%0udpCnQD$@,58N>4n</\whؼI9s9 VA'G!}؅Z_ y<Ǘ1hm./KzDaIJbSZ[@?ܠm,_`ۙ7⦵2 LPJwܰ:CW]F0HДO" SZJ\H|bl["eJ*aݜUW~9r; O/C4A.LLgIZ&S9 "(z&舯+1C82Q$lARā{)A͝4-Y;oW&&\wvd%4JC % <}˚5a `='gF<,==^L xO@#4}s}?Ӥm8ن>nHK2];g#4Iv]^9k;x,X* 9ߣI[S☍i97/Cdeب;3xD/2E~j55}7|d4)͚i P7 쾽5/RmAp 2UydIb;vL/.A\@67*0 gG # tGE3-&X~k%e jsWi4*ȇ5K"[mmq__qTQ&0$@k(!#W~횇WE'oOH3 6{O[u :$صvۗffP@T)| "O RA_~UIg {.^i+בfz8?k?Æ L-yNO"bd@ד\Yn"::殺 rdUN#x|XVdϤ7 JُQ ӺYg*|? "2$2Ic#p[6^C`lnKpPh/էD٩^^qjWL[SW; ˹]jRD13u[mc-4BPpc-NL[?桟x3n="}Y|ӌ0 $"d-~j$3[X5aUۯ2Z%o`G~ݯ^|jZSexBу,?lrN9Zwɮ #('UVtW}1%mZ5Po~:{NO=MX{ pdm  +W1{32c2bIJ*=E3 W_+3rQUKi5x"Ncs!MD)Sr93_xU~g5Qh⍿_Mea#沏u {Gl|uL'0 זI/=h>^ǵ2fI^vJ U]x*S#a)ygzy !M{0ؑ`ȴmSy\,I%*LJ+;1(FNeh4;ѓC)["3(~t5\[?'yIGKA;7 r{s1?8fFdڏV6%_pj !͊>-w{hxPyœ3Zno OQZ0ɳPξ܌ J} jB҉T~k3\t]֑1krmiK!h|ڰH)u⊮'K8#Qwfe2w FS".6|vMv善5^lsfa*js^4 $8Nc3_:kn\BZ!Y<&o HWeo^QJap t>sʂ5Ni$ob^ Gj(V n~ -LfEӐϫuWEݤA~o=0nZyy?4oG˫2H}H] TB"rjB7]Iq!~ 1m;?|eּRDo7@!{/ӕ77c\nfY{y_$~Jrl kƎoo2"O(]KL(:D% YМS-?8hw8 1UE(/v^>P}tYMV1N7y?[gWS^.gL@W>>﹔[뼉.=vO*vΔݶF[#먴]F/# Cl}& xwWfV@? rV1v1^zp+rm'+I.8"'Ta3/ MeB}ԯ }GU]+! 0=@ !󃆈m]\~gɋ?Q h*>cZ4^ >aDĽnKm.{5Χ x¦ҒHv+5ջeΆPPD t@{B Al{#Xsra[ۢJdD'ݩ|v|b/ݤ3f610nsH WIgPL.X4=$8H^Sm@k]rmr'NMÉŲUۙ^hHɊ_%|k, ?rEE }C:{'߃|rM,S^{rS-Xx}Vq~S+i:ƣ7r^>.HG\#˴UZ.8k aԺC۬u}jf}n"{F\,^P8Ӥ?d -׸uj'n̸ؽ(KseE zD~sKܝ?v=1@ j0a }M;ޭmNѡT?['- gMI\fcX""bq@͊m9UT{g{r( {s¯jo٦ ;Xzc0 }<~5{O0Tp vWǁa B$ew +AV\(p3WM4ReY\e0P`ޣ?^bǒRB+XE.M] ֕ؤӊP`U$sS1do_Bpa%\nS0 UۡYH!A rhYMwNƑjnp  ,_|ա& ZsfzyZYEtJ<Ӭ A<9 aM0zBD!ߛKFv ^jR||``>_P2rI{懯3:({i >3qĎ' 8K-+nldB ş=d:l: $" }ٖ#\^J{I++eqNuQ^PͿc d 2V:쵎Sb/IZVb7jCxN.x_#Bʙ]ۄqDi)%`ͷAdеdPo; 2>W5"Tyܗܙ_Z\BɎci B-" FΘJrNIlcDLnPp 6*ۤ?È|MIB,zAhjxWvOkZ].H_ӥ6"R?hS`-- %͵\ ۨΘ ' +K,h 3MjMdi>WǼ/0gunf'^@e 2793+ wQO,E:C#X,zyh$ cU jKɛP` ?JCι! 2OCw BK{i04 PgփN=CRNiΚ䰒T iKWӉ7R&d_bHU%*9;[lK,h06zFz^wY[%PmKcBEj{j(/F gS]_Rxo7 72ѡ QVdBCHS*DYY5YKf ȶF*C3JG5 =ۧ F\1GGo3њqMN.SNdk'200ص'¼6h#ϊ 2J1bXU#Ӽřh7U_ߖ\:`NUtR>a_~2!ѳh\y߼,S?!U%u0}z|XZM]H3Ԥ֮w H3fBv> ??l)Y $Y(3T|4uN`ݠ&"fϙ\'V2yH,C?]K«"TlhNN e\&`cl[ \1B DBl} nKe~ʻ |5&Rz/˵Ixg%Oblg21&U/=fsY 4gf{5T6RuЂɖxE&^ -s]m'G%|:́\}V;+ۡ'aWьy%1=Mq8h'2X-Om@D8Eb;t0bga)|("=Kw^$TVd:wʳt:Vt3z\)JK%JdT^ʙ2 enѣzl%D2ssTvq '}9e? %f/HI|g(YOmtZ`bc)+&zjݒ kxmAX8T GjnWq-%3dj[zjvm]1p Me mۂa-jq_qS u @6J0"71݃3^Ieq̃۝z'F¬dvj4_IOIDdzvV &1 8#-Cv=Ӫ*ڽ [Ah<)HPWYRWy6a%oKPghd A fy89ůK轭b[ob5t.ZΪ4ߤU1ה;{ޱzΒeHe%i5A'5,@71B%R*YDwR!k(zynhT8(&rmw)&ipfJGTz-{ =;p<ng'$+ߞ@;J#,fd?㴗2A|l0 "ihmґU\cZ~. x=՘r=nB(0yC4LL6֭IPkD~1 K̑c貅$'}0ѽbRm󢞨%/o9>WWmtg;J8.90 `pr hs)dA#z|C[!5 r ¬X?SnTÎsZӆ`d󺚒tO}cfa4GX!X~ I7N.Dݜ~os![B.Zd0/,ه=ZjG@gG M·cbc~2g(E)W| d}oOyM2x Ԓ\=.k-&2 !-q&esu@pjY35ZX^Wt#Q-c֨N&ge*.Y{پ<cs4IHAJG&RS6/jbsETо7fh]:[?[DlHrXq6WQ)vTb<j$QDjy)52}+FW%wҠhUp {4oޟ2bQ)0gZRIL8g"$w{l;P%72I1F7 uC[nQu??UDKKH>Glz)6I>o˜;EY Ɇ>YC$rMFV<j4Faa.AJ,\R.R.V{R~a@/l\1~no"5 y[qճhxk]U\/Մ5,bU߯1Cx4x=( lV +U2UGz8]{@,I]Bƛ&sCE#FZ` 7Zp 3-=Agj]䷱~kɖw.V5PZ' \ul2ZWgYU e@ ᪓Ǯlƴ,78W `y0 zyvM M=kR)Ebc2v!zE\`FQ65Ɵ%EBn<D/"ϺkǸ) `dU#w'"'j(?@8RM;Cԁ软q!3;2eC605qx~$_bT#CQlK"[rMEZl˯XFR0 ]_}2<C<|Ps?XnEg5ۍj = /s㹩 [V zz ~@Gp_dC<8IVLd?+s]{8GoH,1!*E`q o?X_1FG aE?AQHQ`#l0l >:ALg.wjv{وZړO02_6awZB OC$^_|}[ /wEk{,oPlEiy[Wfp9.dAXm<3޷tk$  b`S3ηӥHO^ xTaUK(r~moI%oTB_1j禿` &}ó嬈m y..ja_dP{ZƷ*@2-ûF;kQǸU$ꠠ뀜̦85LO5y/HVT?'RyׄC AAJL2n֞N8CI>= q>TϬaLR) MSKY.R.40R:ȥ51p`qz 2 F!&'lkt=.<#|SvX 1Ζ+m)/J ڣ|G~~~ {UR,U;?J[")#Wqe(̛gOs9X]n @TNxȏy3 pݸDPYe_gL'̮-le_!>eEr sߡLHt֍dF*hE ̅ Jh.}D/#2o]FɇPA am˫~Z5/I"{I2S"XV<ƭʇĜD[^띾}FB|Js8 ~JMfXG!wg69 AQY vVuq֔`vgEWkSb{؈ ێy?`ihٝՋ*#?>` o} X]d,E':z6d&=I oc="?ШQ!Hl Yh4^0:eKTDH e! 6 UQXc%ODϓCsb0L2ùLj-yWJ_o+j Ծ7X.=[<l,u׺ a.B`k>me..I{iSdL9v`Ha/>p% (*8U4k|gu _ft囍eAEg/F]ԑҀ`B~VUQ;Tg.y̷} t]Yw +0*!;13Mp̀mħ鯤5R۩#8 S^V3a##N5מ<AJcFX(WZ;Xn Ͽ||gFRT `sى_rNmuBzyˑ~`XlAp#RmG+}EpWҦ>j7=3|x?>hxGOVҲe_Sr_LCUOnuMs*^<ؖ Ara,$BB HY%Jp(J1=5+tu$@p&ͅy820&N7H \CbRrU1lј'A0vaxԷ1Eb(Cm0jee3g+wqZKJ!tKT "{Avjya=Z<=kDSe7SyEqo :ll+ gGP/ҙ@\gU\wZ &#Dܤ:mDZ/M`KW‡ pp +ut4哋;Z3g8 FM`;->هkL(5Q&p=x` [v)*ʄRbLާ{fd(͠h_/W Я^DDCTsSmCpb3Mm(yr x"g柔(ʹ;&TfF,3_x}P,xxH[rt1LHj }A9 <@ԩEoEM#*6[|QiO&Qy%aN})ވɇ*XD3 KRR9U&|`^dQ_{bR KS`Vc3(,q)0,T^zC@6Uw&F[ w>~`7v (Rn<3S#h=5v'ϳ RtM8b˫9ܓ ) eF?dg-zZٹ8}U>X\- 3@Y::\+:j ʭ3S+b')A&v0½ٛ7 (J[S1Fw;wWt2wO7CDZO\yA[;Gn_Y!&ULOHB 85ӥ8>5l #hM]Ҝ&erDxK QZ $kkIK|=#:Etn%`Qi.ƽ}u&` @//C?F'LIDH-d;Oi_qr{ -t0&]PӃ[yt/1Џ<ĊzhGN~u߫:5-8K:1ȊlְB/ z:epH7ZQ7}~˘^vC^=X i{lWGm]X?-R* w>fCq0h23&ɴ8u" L]yKau /VxPdGs1f keJPO,`Jwc\H~ A\/huwPYH fTi`#`SU Iq=)D)cNM+2]̆~cY AKm(~LOq c _Q3KzMxʏ)'*Ct= ;.ޘ/lroAV#Sho@J8@=yϽ<|6@D{TG!.+M59 ZU!Q;YhO9oNa;Ȗ M؊E؃ '߭ܨ*Ζ`fDXf2 ǁ3w;vR [xGj'c(|M[O4!ABC=XWs=I**C c.ڦ#>SxFQ)ɗ}2@)ŏVp׹{w&S&fPEJ.~p!_F9Zr}I^qm@& |4<43 6jЄnT/n^o2z zB?9S2Kjy3 NXT0tA_Axrjv~sOQ Yc\2Xʧ20B_'!BOYƻKi^c^5u (b2=!Zv\1ZӻhxF֝0`Dhz~b"WBlu|ḼRMvYu.Xݙ+t'Phuټ 6y4C-,ŧUϩ*xG?vA2V.굆K-N$~d+Rʿl>gJZІ×ȉV0@Qw5㫈e AٔcG&)&m LxB nOUzES)hӊ=ʨn]sTM9(]!V[wCΜ|j:{cXsS~nmwWb92Ǚ׊UMFpo 6N5^z$㡄qޢYkcPj6BU]d16?r:ݵxt?y/uE'ճ7 , 켲u s8YF~6`u]N^EOY]ez&艹9;Go-8"J&n 'mq :ASw},8M؟>Tkhzg1P }7^K$ͺ"ՕtJOn`:qqNm'egcH@#1Qio/?60Bjƺ A"g16+P5iu`LF{e 9bj͊~8P_u͜Ve| JG3{+9_P3Gl!MǹPT}P=P ?BKv=sZ2ś=F0ֳaYzц+wU4@1lU qa/Vq8~:X`!P4M\Bpn$WKv D;gO6DG~T 6hvZ˖P۞'ͦ(GSΏJx[9Y5#F|Zs 16ϑoZC9 u}w`֖ʹQտOa0%?GjdpQS KcrnɈhJS >*)^|#<]AM Udez*& }bt \ˈӉ\WRw~Sh썘E {>?E>߹CiJ"7 5˥tƇ$2ǷhD\Fh)3G;EP֗ X8:i}\p /"]^@b7uԼbo/?iRaD-FK*U^ayrcwrhnb!S3W&GF q] hjqK#ǙҦO3]i`4Sk)ju~VkY5 tmƶkrܝ-ށK"N"fƉ:pPtB#)4܆Z|J ZX`IDpC.L !b;=b*^Xyň4"[DKʞUs<8E@<crYȏ rȡ dR ;Zi}k#"Gtp˦)b) dۉ*o& ~ž VY^3{J566b ? }\RRAyqџ:(1`1YLYw- ܽ.ܤp)xC|a| וy0 hrxN_[@[쐄-Fb-GվΨg}Un䅷8-# 92f0{7TqAܝ4tn|'e?;?2yrюpd%oset0Ql$}qr. )чg$ûiga=;x$g$bz= V)nwkZg[U'v=b5:=qc [92ŎΘؾ+` w}kDA73ɡap`HV0r0B/S R?ND*Oc~ӄ vf0B0Li?ܢ6N vbAwNu 8koyfmE_H$b+i G%6|z'4.p ~ܸi"e!Mޗhs8:EIW|Q!Rأq"Cj'^vB8"m(=@fg:zA_C1V*42.guۿ*0_6g1 zΫ|\tjݛȰ+˶ǻ[P7򍓏!2r3`@*B{4m*!ۃp=ҙ{ٱTJONT~Um@gF.nC;zWa+m9c[XZ ?ypcVĠhz{hg焋r(HUp7м+{#V[$6Q"GCD~yCړ&QUYńmql6 \?8<&=Gv?vܣ @׺ӴkS<$Gj+"#̭ID#Cp|B$AU=`ڎ&ȤtH϶t03yP9 ZiƉHPI[>PhVFJ$wjnHv?ޘc0[]y7x]R{ nœesDEvRF9 0XbVQ=p#!jW+-l%5gu^w6(2-eGQUMOP"1[cC~.S'C2zPWlUDC)d "=Tn4!nV%xݏvK:,O8*m$, [ÓȢIl!C]@?6ρ Xe .Mjmf a'~Z37<:R%GЩeU{T`n~n"{n_Kb bzkYf9 Bz.h.>)'P|w|8dThuHrb81aIJ>ŐK A D'i+4_4r9TI}Um 7,e`ݸM3|}ҫv*Hd}oHDIxtXb62VyƤ-"SY,VŦKH5~Jj:.drR_yfrth0Ф{?^ ʬ) R's0hc)9[:]T4EL2x~!Y{]"]绱}"v(|UF㤍0q>N*0KWL(a2ll"O𩬆(ݫrxTk+~&83u\s\~dcm};O<0s4 "y5/Q <^DGɉ` Xq\f%UV P˷T[>I' g6eYEpX3]Fp@E|I3KvNȼ{8eZPLjڙk[;06G$*ZS @y:p6GMT*SW$\V9A"lGŶ\s}M4H-Tc*-g=@~%k[E͖ >9v4ˏ%`mOMZ{T8$ 8~q_e1|hJ`fA6`$1r>t`xIפoyז r`&ԫ ۓN=ND/~ tKЖ2 vO}(L/0 M#2^LqkU;@z*^g]͕Z.B9md& ?o}fZ)<ߚQ!DK`J-"0YTI~59:`/"s#ҏGSQT:>\K"ӣ&5ai|. h13ģ;޹IpO?Ӻ({mʹaQ"au#Y)Y k\`xQYn3Mk 9V>Z:Le9eYhoE-Oh-2 kgyg|&X^<(c|XsO^ rTщ>&1!d_^/'G}mlT"p 8lMQHv}_n~8uh^ MyX_ ku)EL QAyoҜu9 ~ll]nu"^rX^+XgBÀHF L9l9ATS#/sm(k㕍TYeǁUGU£:8gWNwyjZ DE-g//رB% ]hapBkWWmjO>~Ԫ/q~`&@t6uGncM@FRM<{ ?Q^U8Dl,+3:A0}&IND  C CV2wᶩ ޑ\fq$.JQD\ѳXAb83rN#bGJsmbxߋ70T^W{l&oKCDqY L-  if>;F;W9ss$;8 )&(nb8YUxk$j9iluVoiAVhz쾏u~{<K䷛\gWr_SSkG/W D@,)k, ͍sOsf,RYWmJy8ƩQV7 Iɨ^TWm CvnpS${E+# I \HU•_3h}y܈î}'')]Y m'՚T]K:X<9h| ~&*RY$J꼦Źƭ{ɾrI+s+@̿L8^`}3:BfY#lg{)B[M;K-$ R” imgI:&~iuR2fŞ9fM2]%X^n/o-fWȾr LI:]H(2h-Fex5.;F2ɋ_^T0 EAm%`x6.%]xw=F:HF8Mܥ;m32mwe*y${7 ^._+vxI݅Ϫ^~xGbSWsj)de ?P7@J:ZVݺq&jRѝ,S? S1߷yUFCQgd, 08'@Ć ]BЎbTs|ԏ_+Qei~H +^ILӉ4B 6 3*63[f;ґ8 0/?As} z' vΛP8t3n =bB;k@N-O$$0o4Oc %wPXO/tXFMGnO?Y̲Ջ :Okߥ*y'*%G/ȗ2~)Vo%6W{K(䷦Kb Ag^< ?`D@ֿl}ERp/*2rtX@}ϧWl0_jC)l5X:3 ϖQ`YlX0fݗA,L&1ܧ"J9)#M$QQzkh؉a`3)otE +@u$>;MrOoULI-%w`>[!␣&7ٝڡ)L 6v42f{NüܵV1,4T8[6\u4ճTfz&jKe;j⹇MВ)zj6ݳTasݥӉss,UZ03aS]1sv11 `ya?+!H՚yT܂Y$2Qph0ZW)W)OׁO33P_7~ ]|Uy cD7ܱF#5Fɝ8YL3S٧㓎3#uNƉ aR[ctWt~ڠ9 2j?@l Ul'jZomGҦJt7Q̨r2g9o1H7" pF;*RpԅW5 R%>ׁD"p4Atw3i$ n+n̙"mr#T ^GcIO@2.xD"*LGpa5ld}:`LBLFM?x1k/lK iΛ#Xڅ:4mrAd"Yv kus˷NӏLb51[Ia'|.d[l{J:vPyoT5B7nɎ|!G:x2-@?KFb8yztvN,+ uZ1nd}jA ,*| tDzw~a9kM5kC[aFF)ȩh JQ9.C.-?O½19@ƕOlsC3 0wŮ]M]$r˼t8 *uA|="'k_uꭻ*(%Wi*9LEᇉ߂YWz3wl `A7vbbBY2/!;̟C'~VQZJ47'&>_PزCrkL} Q{pþ~ R`[Cj m`T@"Ol+,9B~nQ%}z|e﮽ A \Ȣ r9L̹Jv85)A# ylwԏ|'q2Ym6)X;mi D5z@S~/)ZEV_3$Tk_A5H q dL1ϗhR+x "n)0{XCb!ʝ)%8de;%p-[tgwq{މZ]rb+3]5Va>YQų(ކu |$zzV(pLO~n4vrqnG4P1 ‹ea 1Rhz}MUMUqik5W2أ_y:(Vpt%xn 8n!f}Rϒ&Ԍl@iPh\#Gu?ȋ,Һi*ݲ،w7ϞҨmŗ"%CdGQ)@X$k8xJs i#q u~IX7p}"!12?KRxCHȠIߎu aɛ&䗿FR3j8Dx,v r!Ҳ̾l^מ0馳Atl܋~&'wW\\@!"aLweW ^lz [g?>sL#Q`b7`yC.kxfsfY3YCgG-%6MO$ͬދ>HaϟW,+/R ѥ>(/QvcT88@dRV GMx`gx*0 !;fb:@diz͢mr4);J-gop 'p68h$+"?|Kn`hi-X",! :4Ef/=}0(Be!ڒt0Jݛ]f̒HS_h#Љ/n\p3ž:`nv=YǕ #Q~y\L;l톆J8A`7,cg&%?~\]OptSVRkLbfxV*:s#+ձX#wkW[Ic=ZFGq(cJ3m@R~UaـI哶MĒ~`×0f1嶭F5,ozEYix=Ee}c;રbs#>6}o0/׫ȡJ:eqb`A/cJj$#2y/!S+)wW,\]yI.݊*j8lDs\X` ID]W[K u*HbHMޝT8N@C?I">ns|.fH"+`ǁ IMF,FX{<2?~ UAKw:~A{lq-')_iR):n>sP׺&{ET3+_.S~Zؽ(D .`4m.D2E=t4$[@'UH{9~Lb"-cq`v<3M !3. Uzҫ)<kJ*pZ05* h̜{{Nb:W(.p؊9M@q#1NQ ]hS%y߄畝ֹ[s6wIU#Yfv-!.^sHBܶ0Jc\XQ|N`ԜeQWe^h9.TETVr+d3Q1[rʄՇ߫mxC'[+W]| ;{h,zduA+o(Cִ-eLe0XAk8gpr[{fN~>'RQg kyJj(s`w qz1ь?`UvvW'\Ge2DZH8ORݧn V'l]({OvZx𺕱Qk;i Lb I]b)YNP? ?K5f~t5HkZ&}[5xMigdn)\_w#Ub AVVMi>rQ 1Odd^ha$?zYӁR&liz$X+d:GHQch[f(aUeVqץ$עhN5 [reL*;QuOB)2rV-t7ZOG"^T:ڹ4^%'Үya +$LFޤ;۲sRҌ0Bkb3;WyjR3+)YPɞ՟{!e,_9*[55?YwoQ|EDdZO=Vi1qzpטQ+`Mӭ,d =<smZ!"یHtO&ԉ۔)Qg nr /; ibyr-t<;Siz89F%e E>v%L1`OE>v&uEnvea ;TZRޚaݎhjd^(pעNha@ʕ5AE=N?r*ENǏ(w [$EUvݜŌ!(<˲`j'NլSl L*0󷭏k qbYSN% $2$PEHL3yO6=xmy}8B/WehofHZOOצqbN ,SQ1u.W>k~cƯ{^n5eXܙ'U|3TJjkQhFW,̾Z\X]呀p?oA{9(u6"n'!3E YSpi3b+HN0Ib{S}7*Ef`ّt9FaeCU `͍TS_|c|_~-~VnٲZ!6oXEOuxH_Eg~wJCaN;w$"x+Ha)I3ڢ>>a0=&ʗOJ ei ҕdjV=Px Q2y @faQvq;S+g}R}ҺʡhH4N#H2+q xt 1##_:Yo:؊YH;MLk4Myc NH=tI6"nIz,>7_A6T0OjCAw9w ##vF1{6Pݰ, \}2uo<•8>9ʣ>P׿ē7yYD8P= a=zIXJY;xqų>KMH3oYw)0Si*5%*vvݪ!6#hbDžc>b95#Ocؘ͊YdUOyd/mCˏ??b(SG:KC5gٷrlX rh{ѱss(h|¤×E'3 ?oUdzx̖Wchkm3FNyPHuxS _ׅ;-Ycզw[I F i ~g_ᣉӻATo;6<4|i z+R[ԣuy*(s"Ql(fpi޷10v}:.y)o^(%ymoW5Rf|^³vL Ozj拗8s6h=˽f)E78*b@(*X=?Q?CهTfuFl0%,N^"*;<);ϱzI\w\sg p,ۗ!Æp8ǂ%ozRDߍ)^A0L'[o/hb&ĻT +?i752zUf۱0VɯpX|)c(|fj8lC7lSlAسj@U$@9B􁌆 E cMXchPyZ=6 rp4Y^T=ԴjT]Ѥ7ɣ b1iߓ$cm闼T?:9Ttn]+X'@eo4Mx*VuN?.YSMWBMr?f=s]\SY^%B@O$tζR'Gl2ju"1XCt`QS(*3ϿD=5ņM4mUhţ &{w.tHe!;#R:nwc\&T &)>>Qͭ%3UL1]Y]U+,k.?wJ`t#% ٦R'LCV@r]]mH:JeEY@}7qeeWI`O4g? JvEɯM2AF\&3M Vݪ_i춃Ril*lq^T\vbD"IzjAVvC&WZJg~ࠤ-!r:G:y@;%Es{|#O$ HAx:(3A4ڜ'Vt&O'._+rLT8Q] g5iH w]@~F ~01oRrL.clP}aUR{CCڠ,^:I4E}G“}yw4R_ PI QRV#U9ݱM&|OWYF&JDx`蓑WǡfR!ߞLt~R@acfΡ9^7 Ti/17e~ݯ.@`&Pszi!4' *¯r A~VARIyj!C_ՎYO^"ctΓrCL0w,jXj(~&#Anx9fnjhk?G\ӣ`#%1WHאje&>k> -n"JC_+h*<p[Lk"Y7Hc=2]Ui+\F}n\Hv9Hf[˳O ET"qh*>-v %e{q w;fEjWLljm&?K9Con šUj 8ܤC\Xpk)_"]?xa!]΂a \HQxK*8@=Ɠn}CpKFRgy)ѧsS$,"S)ҌulnZA~Qr*G' 0pML})2 C:8@Jӯ 죤Oʧ= /=^h4$L9$n~OߙZur܅tٿ-~ac,Tb %΁4&CZZLvdr%Jz+H2_o!paenj_ĸUnzeh="=?[ LZ62gtB: iT >(*CI#̿ReW鸝L *`"u /JҍrHw}[|pM_^}> 1Ȗ\KI=\8{rR`ԿmFIgwM惌7#Y.!,{㼾\-"G:4nrŦH`c6eTEu+\zv[e jbndIxn_!Si'q,_ @xRM$K?6sɲH,wަ740bCYɼE* em=~- $VZt7eg=aia /wPNha]+,FTz`ZLO\BkbTgv5>m_P`5⫐c;uKC8!zㅩZԈ/и03n&:$6u=z[Qicqv[e94YI#q R@Φ=LVC&;[X~#3I`)17JȺSey e𱜘d!z(vX}3+(*\E A FL뷼,z:z`[8,jvMx~ ¦]'0yI[!zᶳQu}`jK{i/cٜ@Y8 ?wVXu^!81Ke762@y?~+Vǻ&Ia"3H}p-0Ѷ[]QE}"`Z78ReY)yl7˾L lT҇_ӵ)'㺿}j-WP*X&H ۡu$Ueu$5% رҧ^&TDmV B 9Ja<\xZ–:"U7N=4w pBҕ.nz;+.ӵS;vKf>CY0կT%2HOz,(a̛G o8">Yb( w~ةtr  EnY4ut+-ҿoaGz%#<=8`2uΛ!>kϣG'SejRP6 rqZ˃#&Lus Ԭ4C^CKw~t:3B@ s3 ׄ^?h!U(/CIr`�tـN1IiO֊|$ђDw_ZùC{ Ru1Vl|vkH2ә|Gl#"#yrmymkGazqg=T]طi3SG'mꞍ]]k&r/P#P!d^D#J)δ(B| Wk+J-{\EN;q:kv%v)Z#C F4 ={[΂y]@%/%h7ҾvpόXKYM t{i(+$?"<I\ {QTf-NTȫcPby—b|գ/¿ ݏ;,0םo}ZoOr׬_Z\Ka:jSfP9(Pj0fdzi ~d;WBpC@cNh|l iB|.[:#jnwr6c:҅N}\*՛NΆi-6[b=F`&W^hI/}a67MZ[ tu{p g Zb3H:N0P*y8U k__u%y܁{s[Fan1 Vi's#JT1I)!5[Q|&x}دkZ *jZCl|^09(>e>T1%=}۠X+e`{UuiwLh@d/!=#] &O=/?r;` Œ(%vp7>>rf#= [sk:59l~Rh}=WfL8.y4p)rHVywH*>0A l.fI(Ot@,ї6ڴN E 55bC0'g2!/f>gGKVeDeq`ȗJka1Z9DKOX0rtH@G\r AgxRKhS1=ȯV(fWL.\K'۩ۘG94iaՀp% k mKi{EWt1tdS?ϙjh2dLcuWbIZ&ߊ*?JJ$H?v23kֽHpU{<hnUa63\ªRǍe~;]\T披5ORcݩt<}"8Ĉ_YxU9~{)QU<fd|i!DQꓶ@+ V"a[^ؕNYK֑yYU*ރj%]! P$ޕr5i+t|Ht=%Yh= D=m^JMląhpZI:R{0-JV= 'I&g/32hZjKΓ*ժ?=W3cHL"s˃KI yn' ˚u{[gk+qRKUYYtp4|vQ֨6ܽL-Nb[6#"=F#)Go,2@NTJI@4H;5<6D}:$FJ!+8ִm4Mou{v;++6XL<0x @7$fkʼ@r =K=jŽ<̢I8W&VǽպoDK}nkM]QP".M[ʷWmu0U(}jcxs%!'yFexevVjeI(a1~ni.<`N(Tutнls!u{d0=R,hA5蓜Q^SwJ Tifr 1e0~PcM=g9tJw34#Ӥ"#KQIWUSŮ%AɺVv8LĿk\L[wx'Yp%)a2՟IKT؟OF4z*lxSل>{- 4f0 'Sk!"Np_ۨ +k-v.>2UdCQg2|%.MViNN[ Lیed7-FU'1 "I?zT8nh8p;3PCX fæ<I7,Rr ♼><ݖs# ۧ,>0I|\a2/QyWO?nh;#wE2!/"д,rGF@y.F%yG]\PA3eAS Q02 \1J/iC^˅*r8h Py?,nM)H04`;?x Qy1xO"][m\_1R5gt:=c5.T`Iq$" #w ԹbPrud}K`/z8Mz lcx2:uךT3A n\#an:y@dw<njjBߣVdu3mb1_b3mt+ƬgF׺`f,喴lid?2=3emSů7CpοTU9ŷ=-KGveq[#s"SZ𮖏ͪOQUFj$jUoEKpu7p o:.l@']Nj-ș5/,m> RD|א ~RֻtD ǝ#拮$Xp"5I;ɗWƐCE Cхj/ݓ#q G\<*yn>g&1Uq1&x "+y"پ`: *yf@JK”JyǨbc8%]zdd4]P8{ٹheޱ<5?gc23BVa7N'GIH[ vV N#39g90_b{Q8Yu_kxb`7S0,Wھ E; d}P3vϒ@Uhklԫ+R~ab{45lI3=\m;=`(Cgw7332)817|".pL:xXɁ35Y^=!B<bT+Jbbwy ߦڴ>u%2%H,1+zqS_²VLHa){~]ؔRm`v`auow?7LL~V ]m6g!F -#}@D 52&`CqᶚL \fItMfؠ$Ͻ:l>g ج5_ݾJ'aQѾnّێGwd6Чս3$Ac VSRV.s6CG;8+u;񐔌S6Di= oXY*">!P=ch>|F!aZD 0@+>x<mSXYYip=:N_ş}F2 F5`bIа=\ݛ\PGr֫7-ch{;3ɀ>8璨 ()YhDyӱ{cl2~:g){12-B+tz0OqWQW޺hFg -|]?2ȃ77.\YTi.+[E&a`jZ&'֭M7<)y'n~Zh *1~6+JFB -j~>;fٖvxV^;FPbcy2 7fmT7ˢө(?# S猷2>f ,4vfgUfHʹy LjU"\(mTis0626& .$qqjqOmS e =άRhހRBkkŬo2=J(v_>,rp\ޚK;r!0$bz=`ud-sn7Ðː5rK LnPmsQ#OqO /vM1Ϻ5 rQ-|#c>Pi)e !}$s>UUc||vJ3 OǙjj?M;4M CLwf %35 0@HR ^U{jJqRğĔ4=E' 09="CIS3~q!`k*_S荴|2.!{:*~F^pإh^PyS%/78$W,T7}oyʄf¯"ġx;oΩ+4Cn)}_*"XF./BL+N3?*Ğ.C0&?C s()(LnQCyLIՄ+3roi=P*`;X j>MSjDhɞUIAX="H2оaF*Vh]Xf{7mk8ݤ:"9܈ [4 pܼB1إI]_.׭91CΕm,'7([O]Us޸>7379Oiޠ_}[<1Bfh8d. W)YlHV,,0xv]ĖMCR$iB FSRzl$6W*mu_ouBМnbLZ#o;,2V5Sy[(ESdC3n!&6tQ_.I]؃5d=Dz'd@@0hB*l݈(;Qk > =kA~ KLnQqؔ8lW18{lR0UĒ; }>HZI7#Q),'JTyT<1vϩw>X@nH#4{}2Qv}SEƟm@Y>VM]v_R%xnF92ew3Jn{Z$M4bMJ\̈A]YHoeʾН_NKG ;2bKa>M_|JXwC s7/;ݺa~8!.O:srxWɀ]rB=k$?ȑ:g4 6gmbg"LzVsf{5"yB [Fq^8tnA@6)s@74<=\MԤh9fA|,rO5 G 6_9&SH$ vD bF0j`<mG5כJ^̹d3w~=R&0G]SzqA9Or a~v}I?Z?0bnIwhZ#u]hƗ#*Rl|;2(k5y Wl[k;/^D-Z|/-#66 bA6PLV#<̣ '^v1G:X5[֣P^ja?ؤrx( +:%>(irwQH+B m^G# p*f3J{ܜ6o6 puTyR0S!HؼTw*AM>N+`' D?F Iol#NŹ2W1#_I<yj*t/y($ i~W>RTC`-]= } Q${Dj}V-NJA7'6?[g(m9vc|IݘP+0X* czЕ x}7Cd,+a['iYzioya濵3*b | l!]Q~.ɍoAJ?sQ"ER-h]%Xq}k lMQ+_)r};rfc&>zv;cJ~<mg^H{m ̲lO۞rkYGڂ<@aaAY\c?vիo2?JqzXIVF?e WiF+ S cs\0ħ~֍aY!$ļ@+B5{G4z ]s }TΓLp `~˽nMb,V.>U-N>)8'ww; ,3&U 80pSUQ(YG~voaW3_bk|;gw:3aꡢPcر)3A]4NJ]01V5/ ?ȵ\F-if* Xiď G-'NjUp_!E %4v;!L KQY9Wc:Wdo D 5쐾 ޕR"A-^v(]WO=` -", B$m%P]Fp¾bO&0r>^E,`2li, 6DzagE)1`,?lmeD Z'{DbWx_9ի]A,lT;iZ܌lGYJ뽒`DMui:gdG sᛒت417Tfvb, 1hCLN<_]ӭdfx$ wtW"y򁺦tX=dY&I&@̨Q|`}8WHqs4LE_,ߩqBoj"E p-G Gigm8q~Iٗ4|I(OD:91a'{jCzwuצּ!xrM)6  !]͢ˌ *ݴ`ѥ~I/C~C;VT5C")?ihX񁭞|o]VΜ=jku2O6B $M.#%Զyb#DmNZ V<]HF=UF%0.WKғQi[Mn8āQ]v4"1Zpg$r1nשRby% u.cma*|wLF&~南NEy'dmh$_v\ZH'djլkd#0F&aT9,"ηd:u|B;kY=$iu9l %y›g~P `uY3 ;벅.i?[HO]ɲNXQrr`*t"@v@椔Q&&Zw2G'䭝Q# ϴzG_>S_弯y,1b[o p%/&ƛQֵ#%R7NMN fmqtiY~Jt!mE L.}z$D?: gVn<J\mXwnT nHž}̨t BpJ3rp{z{z=֭C|˽fff9`Gh%DZaS&my\!l+^{k f1МbWaay-ep!^ %D944 cS UywmOβr/YI$$u*')hNEhM֗@}@'oߖ 5ceώ`V[Q8A̫BvӌAV) 3C֕k^/D< Є#R+*l%7CW a/hz*Z]S ~?M<ƍAlqm꠪ak#-e&4H9Mb8ƌv`C-Z5kn8̝,!&֤yTQȡ#ŖLN^kkЕ˪ ;Pdi%) w5Rܥ0oi7ع\3xQzTXS7Eq x;YmA.nö.n@cQgT"8 RAՎ Xڷ,}\@fIb DxYݬBe"V}AEz|dF9,`ѥ^0Po ynN " bNۃrJ&'jOp=>5UM'!FѨ * oç{AգfYcLSڔyL>TilvG=wQM!9XވYbJ?_;h }nߓp14R ;ƛ`|ҀHMp!yogJ'ߢi*R6E ӳJyP< 2Qn͌In713ɍ/뎜S7` A<'kTz)3js+LCY 1Fਖ਼]0)oiԑUEy=ͳW)I4_RɎ3E|ʲwi_W͛0/)qʱ6CyscYAPZqQ8D(2m1 Uƒmw$]T؆DmbԆoCT'5 X p\$EM?]VrT 8e1kX{~-_#@ HjSH&>r> F)C95LFҷs*{qCY 6iCT*[h5E8J1[哶VN{^J1y~Y4gCެ#9~F Yǻ҉j^C> - ZC3w%Y(MՄC7m%XM7YIB 5?# y yKrV L'^ϸv;"K39,Vl+J"gﲗECpܷj\SFXy!~GM|nGD/@ۑT$uqi{K54A @gxs{rL4&@P* Lr֬S}sRF0^'Kb~'7,BumxIqAc@c4hn4]/\9#q݊))U}56xƟ7ǵj\uo֪ +=&ANp(ܳ{сh+u1sw`ȘRgBԱ1[@ a/x|:+yIWw+>N'wflMra$rp=j/F.d i5}SfAdʑHпۂ d`VzF&(P+j2M% 8[tᵔފ-L ƍͻa?Bgk7AʓX(X4O3O#M#0(7߷DdA3e{C8¨pE+HXq` ɧl& #Y}:||1<\~ԍ_a)!t(o_ʁ Y}rv l xuS7Z{\|{@=Y0+TO`$^B,qfz-L_ k!)[A_/!t"I=<*7\Һh6)҂ɾLWy}23P7xTpM>e" VPld^I.Vk쩸Im0CfI* +O1؞g!9І]G~2qN S翵lw{p[^aP*_%q\A3w8Y<̘TbNap*`RM V]Ĵ1 ܋ *.}j?d'U rg!~|HPhZ#<_bkuuXN_6w/y/8}2^}^ X&srkb$a;ZŴȍ!7_Hiu_Ɯx$tS -t(EZeP(HfQk{s95äv}A">_(bX2w3y.a*ڍw5N%dD`ڂ>[ *tZb+(x 朷jG5B>~^6ie2,L/32… %Zu聋WʥlI1&pLhbnmVr4ѭzC0Fz/zќ!jQ׶iw&v(Xhrr a[oqRvGF wuo^&[f|1?5IWfY<*'nMe?t)ݾ&ıiїLj T:+Y!0vCLT 8\;#!}`1KOkOau^y_jWz0A<^l_\%gcO`WYbVۧdkWmhMK.4Wt'FI11mR$ $OM Nb/>(ÀX~MbwoPO_%U3r|3uIq@'DHvQ(Im}o.XG(՜ IGȠ+գKڃUeS/j<,Wl}7yu;TW3'^zYN:W# DUK.C÷]EZB9֊]t_ߒd.E\QbLU=[[*mbc%:T+Oy\OJKi0ʂAQK G:#5/jVXliiۅQ9@B^sCk]7-{7!ꃁAETLz%3 /F_{]H >Jlh >nZP$MJp͹wnąhB[19Xt;U'(/7w}lI^H@[3'_QxYrWvфﾇ ^CxbrUmZ\Zu,{}+{969\^!>6Wfj=@A)7ZbU.z_@ʒ`fMXOٻa+x̀]ӽ{P4N0#s1_o7Aᯇ,9!Lt$Ř9b?W ] XiτYVQA?FX?wBGkBywgSOs+ Wj/aU!ئ$U-cVz5 -^_thb_KbqOOR|"-/hLcBZݛv,(i}ӮPKs\,6!م>ㅦ+UEӅ?  #ߞXc9BBC/@.OUѠKTpX`N/Oz7y)'mc>"`rB~.C6=.,t"N:j .(KoxRN р7:W,y[9Cæ;R6geVJ\滋h9;_ߦG,*9 mGsZis$pe^؆cGdsmTB9lW@QH|G%V: 8F@kj_M=U,.ԀnR8׋\ B{Ӏ?ZN|<%CQURE3V*1+gKgJ?~KAb5*m#%]U=#i*g+CӃ`߷HoDHnEnK0N5{ngD"RNUe?bL|Xl.%X҃|ZGz̮Bt$N' ]_(?R<~ƎHմ"_EKk1@,>^7*L^w>eIƞ120iOqmkRPQd5-y hݺ+LuøK ɂ׻e;ϋ;tԞdOQo꡺"/ %mGS^-@86!F`%zK6`wq @̭壝 բ sӋ|\~ɎZ,ɃU&>QO뫺wdwc3M`=&=|$QHuuV>y?drv#աÈ7{00%i (&\Tlm]M"HRx?_~i;C;} ʹFç>9P;UyyU34!ε_d XZՎnTs@$FlI bרnt%&1IpЄc';oHu,7AP4 V2Re59Yx!w5lK1М.@VU9Eiΐm,+brp!R-gnYnZ[=}P_8YX3-03pec XV^=㪳q8(E\;Ӡ:ǒ9ʐtiL]38}o?⮙:`,-ΓY"BfZe)ѭ'>cƭx~nO6M.11)("B&-<_: -{QǣM`}ys]ziXnUrn\Bk<2w]̡LEE=MnGd,)o[sׂRP8mS9Aڈ1S# wD4Qj8%W~!qT7TU(C*W@Ȓ=65'tT)=Yw?5Tw'0wgNF ~38 6G"xϭCd0\-Ǣh*/`D=~0(ȵQ_U#8[G4!D,F˨+RW$,-f'z<մ@5w +yv6V{N8,, 8M7*lo ɾG0))Pxwt}@ S.{Fjc~9XFP7ms<aTS<ʟJ?Y5V +˵iCLbM3/T>2";ʯ1zhl~MqOv?F3]Ibi& V6@+^̹0?(bv] : D-58"F88t)7AQ@;Y63͛# DiD]8ͦ:F{I1KBڀd3!`A%BEh(**e>z }yRga5vU8*hF{2um4p!l7X 8@&nFݎ6+kikX](U |D+mnns"5 ١<:纱{6))ነi,EQzTZH-XNt^jF3 XT^m_jbstZ:k|m<4!ϤYn GPfH]]qDԥ*[g@*ԚdDlo%G>sLᲭt|:t@Dt=^;8ϪMGB|' &&tY?$`56i>EaN2E E*QTַkڏOA17k#\{nrߋׇ5 s Tj@"?ef@ 0~|ǔ@I jCw%eBN. !wߚX DlNˆԠ:DY+)wyx >PW:$dx?U=ΩehƼ /{@e]!06H;Qnt ߭lOU0sGh!'z ϽLE(S0U.]olʔ+A .$tpjbޤ$.e%y7%YP>Ko.&k~MV^w uC Zx3K9!CM 0P-d^XP)7Rf~]iZ?iWYfn^OYv[A٦UW1i̒hF 6 If7<:w[CLE=|g9@+# %X?AN,P9D7ӟ2N%4ڀ[-`R,DvOrWMfZGq5%&IԽv A>zURJ]D u>tP!TSl퉴ħϞĺm!笁rt&W*:k|V1=6x6F$(W;eei"T١ l?#8RǙ02D.ndCcÄ7Й H3(g4Dt(EnsjQY[e1A@!0zd BGݵ>~ȴ܋jc_D28cF5>d"T Y6pOҜMRx?$?ypMҢ7F? 63S_>jWTd{hA-LPu\:sP_I, H;) GgyTs\xM!WVxF(1~sr% ի';]䗒iu E?ҝ(5[KR7uzPOod [q rIY%ݯ՛.5k~=$=nGz-LLǸH60xR39 E\e$<-%\f'-tUBmb,q&N%]W:U0"mf!3&^V~6< z@FYFTH2KƑR3XWAM#׬P@eZ*VsAxs;TKنS 5'@<ecshxJ5s&!o]AeCj=LZ|٦gM-Sch"CrI!VXHJT%ܪȼfvirP&R͋?^rڦ(gHwU&ہ u?QW 3VFlS\^Z@!2mȘ@Ef%s/chQuUn{Z~&Oȍ) Ԍ@EO(v7dFՇkvWm&Mcfl<ܯc#FP3#*lNʍe˩AͤJ'(*] ,ɕo ·Zm(MȆ=*4I?6 )0in8D_{Rs7.%EZ*3v\)9?bmgf=2"T(GRzǪu6~d>~ʌW'R>=#Ds깋R/bⰇn@1.&&x7ej+ 4YT>K:/Hh]zRpc5,m#U _&oH<\8Q>F-16ޙ2p`CG)3#nЕۼ:ڟ>u&,R_g*R:fFd3"I| `Uq`O'u)@D=mz`ꇠ4WȠ6K0Y XmW\)M^[Kw ZrWB$&"eĒc{`E3S"D<ׁܻ. rHtzX|ౕ@g9SKkhM#SGWFqVDA#LUFcCZrI&Ew;_Py,"`Q/7èmTG+a<f} ʿ$9Gցԁ8?hm/x3:t;M,Tx  Z=@K^AzĿՆԫQ-Ie j7_j"sd3K Aɺ!Ϥ-C9F5Ko_]B+zfmXo KCg<Wl_ 6ŗw ^ |G3>ZM{7u9U|wv7|1Q{KiYh m)Zw_I);殣jF֐Jg d;3:1mߤV+./q5?&uЀ-A]FpoMU]Tq=5>DQ!bM:˯;F3=]DPp'My'1 ! cΠWlarl۹}b?ڦ;w&#@ M&t ʖ67;3+(%+&& D.Kߪ#ۘ!RSMN CtqBey?*)UL\Q?K4.R!=)hiƷ79p6`T۟ƙ4_v2y-Y#)A/:_B3z`t_s PkjڕrBr"_ۯx:H19tݺp;8Y ʶouv] O~[JFI,|>9jͱU;pZwY֒ub`j.oP>A؄OԼB#:g$ v%ۇK':T:[МoV8e!΃0 3ܗ؜VzC &DŘ*MfJ'ņLQWpy:pv‘e[Q43 W5CW{q9yGe{πD1ި*@1.yUGys^ #&3C.W0KXVxomtTî9BsLXŻ49[sikyHNꯀdMQ+}aÌu9 _ܟ0J(NhPߚ Fxҍ5wVdc'/nJN, vÁ0!wjuoi4&z3KNvLc,>pIdS :Y0^7v:?<LtLH Y]iO"QFhӆPnՎ}%CGΔr9/aւ$yYYH6dҘQ e0?lq([1 i^f $ИA7CXYW@q\z  \6É7u8A|)_Rzuk [0Q=*-XlGM7筎,c~P rC$Ơe1 ʼY%_&n*csޑQx#?g{I".q?؆G"5=Vfy3D`ba[;*1q9?>R_=k< jekZKDWHNLNm3 +0pP&v_oj-4 GEXQl|A7 zeC?)VnR@qBE=9ϼ`rp-2eQB>=JьxBy T  b)qCg1>'|-`Z :N( F+Zށ/B.M\ACOD>strq:zXԓq 16ZB~yFm#QS#uVscڭ2׿?G G!q%Yh7@EVd}yXQ|v)gnW]? ʀ!>Dhߔ%i6FyFǠX9)8+ćc@ހUΞ`܊Rr9,W,iU(0 @?+ə֍;Qdz% ˮl*gK +U8x< $2;,D} [C fsMlK)_IL:!e#M@.l `տF$]3 )#jWQ(P V& 3gK))]?!oO~J^HN!yshX*2X1*p *L~bƍ/-q'/vYt`2N@?'&-eZ5SGӀ\QV/5 >1tMq@&U"fWryyVUy~"l@HqruR f,Rq>*ֈvP yLoMlPV,>ri,:~&y> _$Pw$j#ZzED`@uVߺ v~9Bt-b5+BM<.$S8 Rv$0qO܇呱P&S3G0TK*|^. 3L#hD5:P9"bKyx =n@Xope$u(x~b&McEd'.{ Hy99ElҲ99`j f%iMתtQjxa\a7d^|T:АR:9}ZUԆ)+8!қ4ybs.EOUF;2Ie7YX?z9/cs3-'j{[hyBLhLl;@SkXOMULw^| ׭%ճXcB5H ``:W8~b>MD]q U流eEHԅ.m8)Ø4oڊ uU ㋗#{͌K6bVkLfɌ/u7`vjJ\ e>;0`#qZԵ${j \ Z[aޜͧ8 @^\rgdaSX{mLq"Qk1uG[Gʺ2pӤ\rt!{Ɵ[d;NO9,ӡޛ) =e48tE E[CwTu [%$h='G+gd{HTE&Q;ܴU8aW1㧃Peu"Jxڤ xHV@Z'̥Mݝmn(c=P&4y:eC痺X7jҔ$_?_ks;Gulsԣl5-.e0s$vA D Bx\͎U8~Q:RPFOp2(V # R1nџxi+f9NHZ*v>=e(v(NJp@ ia\$%m%hl<.7 7Iyz|dO1qү$O7-(nݞӘ_Y v[xBnIu04;T%F=U4VL]2B@"?eY_jqDl47F(D}Y1;H|gQu~n@%[>FxqQ3Ac~u{bTjVt.gYKTsZa-2%TRdLhaƀ_օX,2|j ~jUD]ZA "Kߡȶq+rD=w³M<ͪs^KX1*.T./漣q9(iOPsމn-+!x {W[,Amnz;яTnD %<%Ѱs?Ud2 P&zN?S|jQg7I f:KLS4 ޠJ߷";*x]:zD_q6Ԡ:0fp~(!IW[{#3ֱƟgn,dtEwJO }ܣqXEcҔ3"J/PiVب֕Ϻl8%n0K?Ȇ '"Fi&p#|P#; 8[' 48uDֳ?:{E?cwѯV u_N4vc[,<B;il^ "8}՚4#e;a tV'a#,VL87m{s %dsR~}'V ,Wـ(/:DH[ PˋP>,$9+_8X1VPZkuO7'^ՠIIf􆵯FDFJ>&n@ʙ ;_E g3avT<3c^)ؠ#ٔLL[^,dlVHN1K0~x#ΤbQR}9W79T>=U)bwAejl4tg2܄vtE]33tWr9PT/{8cݮP5.q67;]C?H9ƭM[Dzc2m,+LR(\v3Ԟ)z~;KOúk gY'{&D7Vh'2g/c,t9~grO+93ϸI죉aSsk*2o8Laqě ĠyՇG1߀hTNԙb8#3az$P2U8<"bZ"-@ĒB0?C9~vEWF55(R=.{`J^5pjeޜ;m#$ÀH5m~F ǻǺ'k1`Nw6-Lهc]pX1{9yr2b!pQe(8( a'Uƾk^Yj90v C87 0fqm^9dR} 7"(o٩:97GFv?zbj=Nٮnnox(1x`쇕.X muØ@/|>Pa@x۳*E8xmH4 f,˴m 2?N#LmKunfB[$;+uP$;)28z%$E6qsoO?۶c A!Rz~dxֻL|;tQ>3'-1rάNgls}U{,u Ě'\N#d9&k;>~? MksU{o.bQ|j_5M$qgnxS6!m?Raw`$N+4܍=٣dhXйzcl\7?/LqB^aĐ|C҆ZH!~7|`5.Xن1 U +z'7v>K0;04,fц T |Ԙ\Io*Akp: * *C'¼MNػGvz|h8nٰ{ll]Cz5߸-ŨCa{\ e n>e ے(3T[r)xѦ:NR7lױFp`!EsZ=D5\Y4磘@J*'ife\gIORaHv$m8{4hۛf% 'q3__ɚŇJ~vpHzA|3ȓ+1 Ү`XDU|)T=L ?8/]w u3u}0}iv]8cqwv.ty92})oWF[W7`ToaO0q_Q bpĉn';}^0vyXJ939k[6H0:Ә§~Gf?T%5M=%,[W_QCMlWE-CEb|-jB 2)\ M*fwރBجNgeHOvdžnx{B669)a8wthrLXW\c"56MDb43k,[q Yr~p\ Ǒ9KCWV *I |PnJD+FOΊIkd4,Z6v>N4.D, fc~aE //#X9\ƞLkBZ]FAy3K֛3}+/Y0ޓΤv@fZA+:x"gU0yOQmZ?LwS+2dIR%c #YiN(nIV~@ mC5Fh w,0Y} %ߐb*#w[ ~Ֆ-zX̘&Hlb#pb)Օm~*2=Q~rAyUO7JWTǮ-Jl8 -{P1OZ:F˫!KF4MBxE ehUqMЦT# E[[wdy11'ַr7Ռ=ra XMQj<#)5U2Urn1 yFZZZMDA~Ǯ&F~tk[w"Z z@z| `#swqS'Ss$y;Â?7C]:#.֘uai#! |s=*d { <@z,kc`ՌҦOt5CVZT3yZHTID5V]:{z:m hf,亾e}/B>yP5-#p#,éXۢJ`㏨V2%{JeG>$?I; g"&&}W7ZGj Bë>Әbhw:MJxݾņ1'K"xK J%&l?U4E `d>k¤2\.{O¡E!A]oq/; w.ΠCصh0)^Baʕ?J}),hhEd=M. )6dR9X12ۦlyQ({ m/YVKNrOfRi:h0vDXوp]l)"uQF=HLSiM[!8* kܭ2}68]͆[xGwe$vº nITx8~yx'[U 6Gkї0CGe@%1&sHu4=q!`lg~.\/8yH6Fk2:YMHs/j2T>KLi bd'%f4UUPgDZʎ#L.L(=F%# "p PBVsxeffBf{ڙ/}lK.<e==XZI1o{,PӚot 8ܭ;F #WZ1Zv|"k-,Zi2MeTMoOu4#bcQ`*qq_=*˭0H+yX'Ƌyu@N'.(+:Jˠu\7Ie(wH{Z)}Z5/<й:ծ|OUgK Y.п&PR5 Qhkρ=cN- WiCu$CntOVc'r[1˹϶4ogbֺu=_Akz$$E,ψnoY2[EՓ>m6Xa)''l_Č`Le!v6Яh8ol9>rJAz'r5NBjĦrSUWI}8 -!i-M?(:ɲu7x>KnE@P^cwzPm̡ܬxero ɂk.Zj,OE)Os(P&p`9/\vfyA=P"@42,AYctwlL_HIix@tDBKh_lTB Ae C4O?Xj ?<[c(0lci˪NJM$zlhRy/M'Yϣ&su|Ѫ_^oBdWh^FeBǺkog7c!}|\\k8Y&nWcK̫ˠ(MM n!w5 x_%;vu8JTJa`ANҽ x}J,[ ߻l \9(u+J3WHK6e1d򴮹rzջ).gxDI݇PB H@3VT KF}X%Wއ+r'mVU3ahק&tRwf0l;%료(%U#X[%NӽZ}P%;>/f05HehǸpR6.H N[)T9dic Lmj/r#ۑ"@c T%;Ug%=L쭠yri:aJ }$`( fgM!m5 )kـ3W0\eE-]M˄m5Gt_yy#5q@bRdxs`-=?&n,(9 QӇfJ Tֱg>5 OK{؟ľ@)H1D}.4J)Z;5]b',.m%_$:c*!4iB|6 g_)-Id/;wIJ5zJx}Z9AXۖ.>׳%y2F`x/=TD~M?4+վ {}*6 "TAIY{cbmX&|dbcAZ2G\n1i*tjA_8]3VO o^>ȣv[A:xi1fZN,!4` ^;"k(k I @V>tDZ<6Nl#\34+d+x7_gdSh WZCZУ3Z1b +5`@5&3CB]9TLqp 6 f=_LCj*+X0TT!ևU8M ];+ 8"}F_4e BNԏ8*'.Ѵ_HhOYT_ pF )}^X{NoTCx Jl9iJѬJ-iulY5`GܻQmlKbhWo2 "ٜ$Z$+\)uu6z.#Ɍdaǖ7Fpstsmޖ=p\F%U䩙TR2':S8|7ʶUM1)tXn+ D!jcg`R9Q,#r2,^JP bJHS؂& d]iY1ȢĮNU $dE2_f61y&!( m$ P=mU:7afg"g˅9wQֆ~=Q\\;*ֵR1=V*} y=_;̬@ԅT@ZF5CSP!pN/[^*\b^<~0Ƙ Zt^WI2O0Yc\տƔNXFK| \"OKA E W4Ҧh|O:bI.}^fd+T0(>{=Q3 SqEbR .*jU,pN\K4eۨA-c;,vI@º)""h')7"u>On14;v )f"\6hb'$C9:wnFgb2fKTGY k,TwTz.ey!(.&=,}DZpOu~_ ;PFuf7$[ɸ_dliM_!bi i SB;'fVm7nY%֭O[)|^JO?#Eq {Y>ɧ+ڃYn}>O}w)z90#k33 Bv'!՜=˸G?'rvjF ,.X4*Fx*lH<6ö2Ӷٗ/UuЉ6mTsy=/*#OG)?dǩn| \ ܎BRSZO-ݜQPT7Ky+7˻88 4ox]ZECIxn Zۑͣ/:s4S]mrG_&*`jwYqWfWp)̓r@B w"]x!z?pBT~|k-~2d_9xn1Ik߭ֈ,ԼkG"#S0@)e>8-/$f$PmTm>܈8To{ ۫j2ZO94zyZsyd^ep -xsNaqxCcKHߌpTS*W^Cx*r;iEz?p\?S!F䆟 =5n${ui?[?e~=|)!65 evHɁ8o!Mcm:1d3OWRʂB\[;PmYe7,tߴ/M5hj0Oy2QOS_}6йLGJMPyJмD->,.K|V.Ϋ=x$~ u pVqp9h[`@ SEua248D#I$X= G?NIyb7 i&|6$ȁ)uzh[h$8ƾ7-".||~g;MD}[TtkgUSZ;g<={x䒏bT`3v+b"FY|HTPn"O -T{#w^ v?~e0_[]_^ԌvѐC ۜx p|h^(D5v[8p^VDAg >С#H?31X^Ӣ]=+W;HgNo~q)9_;ՄJY[PTW&,^h.+ةV̟ޘQ'rJE5b8"DR?B'ا@m( #w!a4і݌5o>M!`栱_ '.^^:T,I&D ͡z̖rû g*Od!YSJV"V@zH呓f\(U 7jټ[ 'Q8(Y,K(:jt "m|Dj X2tumQ a>D$Z)Ie?$v!qJ,O67_OO8B/ċ͐OIJ97d6 .I< vXm+dP}8.W0~-p@긄t}^hN)tz̱} jl! <ю9ʿpBQb\+MMw^s](ɦGD3I>*$:ы:L^߱AappnPDQD5:O@φP؆wlJ)C7PAd $"e;<#v/8z`х#[ϰI7[[6Z`:[D\{X)3m-R49#[`݄{BdTw yD\zݙfJ"6T:&Ztz_Yo-v\s3;LoTpTNz72gjLL{SEôw~44ݳoYScO:GOQꘘE4ytt%TbY[>bUTuGo8 0smcZw |n+()a7ˆrsC!`_i.=CzmexTʣc1dRpŽCɱBn<-\T^{WZ^[7Yܟ'f4IIbfZ &k Yz +!>WPAN7Ӧᗩ*5kzVg6SC ]WiRߔ@vyBrfDIrq @F[v8!9oj7!-LRr$ΏGB&IoU .?U<$N6:$qS70x`dWND,v_R,f,̉7XzJe~p@:GU[6k`=cJfYi13}Eɹ +˃suYpyC4L45IA}܎W~ \ڢl4}(u\dLi$ƈX]-\YT:4X^MZXtHC×.H7Lt{CӨg{LY9g(ϱm"jhF%Vu'BW.ԉt9}JO ԏғGio?&?: ғKc+RNL\7[2Xkuֺk״,hp&aqvq<# foG=l{9Bx=FFZ2#Jb/ǷO_^ԡM uQXBxzIT`Vņ~Ҧ$ZZԀ]M;v8vZuNevi{4DY4xRw# tY]՞d=| g5Ꝭ+KR35ڒ H;ߑ*R 3%P^6"=15sŅAkkx4oI&kßs3}Oul۷DO=IOޘYYt!niuc0E1t#>IП+*UrTEiblE٩yAT[xym۬+DҊj__ tSJ%dX iqTg\k Jwb~hc:cr &ɖ^K+о̀臾(F9- 'T?f>܊;.t+3QMHf|k>s tF5X͸t4'{ [4Kl݌>Ƽ07>QΔߥ[\FP|57[i;'i.:;2*PŨ&iɢ4@dT|o: )ݼ}>>ܺ=N4_/&r}[k)wd#lN7DY*vZymꍻh>^>C +P7bwM8j/U;<(=nJ gٙjV]hao ;bEI(2:M‘$iY&jYT n3Pq#>Cs;^[dX2Lq>\hQ( JKǒqyzX%~bMw'{AOw{ذ>g-HYwEhbz4azӀ4\6jRB%ҽ(9gE,G,85_K&{Rܧ)=Y :#:, . 6a=ܢsJ}>#Oodg ӂiC$LmCOW]> űs>7!_;жLG su! MоkYV a G10M&}z\A`0]v=֢h>fJ0^a 4lP_8u;& FjbaqIدoM@Eu`ldF+ Zծ[N Ē &`0}TZe_y4N? |p:y^K_lq)K CD{|WcKD$n # : 0>@s" +vuwe0/Cfpwؖv 5EzZ[4JxkNk-h|o̙ЗZPfK&f*b˞_?!tkP4 TVa") 2nyg&rc"۽UBz _ H/\?F.T;vutIN}f#1A ~*E8BL:r /4_y *w]T2(5]R}/̮V,L7Q!89|ë'Rff7&IDOں PC_-=EwEvCMJa9 j֓m8` l=}fI_q8iH}؎J>MB*bxnE;URI 2'j؊4)UItq.)4ĶR9oP<~4yΠ g.҈}*>4"RDjWɹl5 Ff]!;#r/˰m/7u+O~d]~kP{F'-p"0uO"qHjtO&!$!rG0xb4?sXMp>y(B2׸GnJ)bq5};(9jIMڣ˜7WNN®%BT\ Sߘ2bӚYfgN|]iJ ^jn13)=j^-8Rd*>b sIoC<fG|6ܩhNp84c8'v@mN-` ,Pcጟ#6a^E]@JT[o?!n1@KG5aZŇ8Gb3cEMv0wX8__/caJRHz--eE "չǐs/rm>4 N-fYP)mA5$^haD)lOu`"?]X,`":2:WMrġYi(Xh ԡatB{𳏽a\]TCeF9{\sVPtXAA I5,FK;Ji7 ʀ3k#I"KD'nL2nYyzG8eJ:g:Pg~@CCҸȂlu3cC +u+q &Ol7"h1T6[P|MM}FS}R-D~ ִN4<?E VVBO.*?yvqL. ?Z̅TlFwx ՝2A( qw0SPՁV:tRf(-MϑPԋ8 ı%) U[00Կؔ|jMm0|04qۃ%\o׾@" '*RE}±2\Beգh|%rh7@ϢSnξάEHqIeM:{ϐ^]wz#Ww`QmH1tX(lFs@*k %&ăssT@͊g=Qy6.]xҕs;${dX7fȡu%5:eXX3ih k7pc䲀1`o<trS7"cšX?E=_rb*w1Q)@Ikۣ4:{͙_X $L5ݪTZ&S@(뉛,/sozn#B? %ɤvyJsbzIk [ ah~ bqT{7OCh6I0׍i'jo{ zN9|9;urR@#9v2.& &/0 t@ܢ43!ZhXQu„{m^ l7m)xh{f6G8 }AQE 3 ۇ̬-qm@}IA {Ӊ gf'?KB>o͔Nt+§ψc[:VٟQ1#R*!ngKYq47x„+2.%oђ黳WS'0w0a6U`+ֳkS:OrywąE C,KN9 ƪklQT}A&~x&|G(!/!l!Jh4+9/o{LBy~6u6}FI?ik?J [GzY8wK*}y9%`mV.[:16Vu2O{$*) djYei2 (,% R|9೿;,c #SiȞŰdL/u[j ]XY$T`A37װ ?TPԊq/v@K8`} 'Tyv"]sSzMa7@ 1 @wh_UOOvj^Z%>4(~~^r/@X~.f3J.puw+Jx%`rpfyuشd( jB!6m!}nPxY?j#Q$Y9y\6n~8f}1g"65۔h!twl6?Y9r1{~cIg!T=+o@,xE. Y-Pے+&9覌#ɒS @1(^ lvu_*܎tOɖèAyk5 sYPO,~4,(=R ޺턭D)Rnu#زhu^[])0>0=/6urr5˄`v)M0Oɕ~g38P7؏ ~0 q\Dsoڞ( ܪoC?8v $w5ƔM-fyA)0"$o\[mXzG@meM7;:)I{li.J5ܩSE惲I AwF Q'9˲=oO*5ֵ-OgV>$UV!wR_k֛ ט-)`6lc^' 57a/r (+OmN)꽴"m#'Bkd\9bgcދǗokKb{,xY7z#r_t>F9wcBAyJ H?(6Tc2y٠0G&w`I8Zr0;Q hRlabeCs@P؃R<,$ޡU@=ǐV:cpXXGCP)Ж/06 :i$~Fǂz͕%gѿ`(jn^~k@|ķwsk2rn͠D5OM/#եz~:?w^.t:_R˼#65a1z|q;25:. ZGHdw)n3hmn@R@b(q*(!?tP©|ywsteFj5F' {g3 Xw]2Upu Sg,*U=:0;kj`\Y-\I ȄBCї(cI#wA{d\2PKw짽قo;(naPsۗ0 ;Sk9jL;JytRQN(=FKFo*./Yn[IuDi*#o.(9l uw!qc:7$eq<ש$p ¸=BͬF=s$6D>ldm|٘6QO!ǁ&=,˖Ӏ+Ta zTu9UfԴnC̖1Ms!o;"E]{xwGaN%=&]m))ܾ 0*ZaW^)=xpgضha&>|5!ZEH@H4nމYpieUknn%ɲmXrVwT$e}]#ne< aҪ)WPH@%ih2i߲{):N~/s3Sz!W?Ց^4xh|5ipж6H8 7<]Rl}UtsӺe|jS\<^)GI{ØCuaw~$tf+4*ΛCaX|q:/pTV55<6t,NkZgsT|!.u|18tLnq8se) ͹Ǝ2I8nFj4' RFS}o,jY/*(f 9Hn<m6XX" ]r`_i<8̼jFH5,9:hӆdn&m :#j;nnV~$> 2PFw{|Os`/a TP ?'ܧ'1)Jd}5M{CEDnq:&J. Td3*6YB&=@m]!llvg$mU9tzqk^:ͫdaȖmgSlIHgHʘF&'7hh3>7Ƿ&F'Thp6oCm=Xpί;wAYOnO'EF3(F{62~=06b,&|`WQ56`!pph/ nK%Wh2Zvw A3 kUYe\k?Jʡ ВnO5di[q{,nBL*wZᅎ?kpU)AE~iXtdKEr0Cm r2b#Olȧ<:jJhEwgCX<71O2#c "ICsXez&!{'JI7q0I08͇,wHտQEqI[d--V[)ݭӄsS9 |B6*k7u'4Ӑo5).=d>`4#U}Er 4*K7"DiApqx^jIPִ_WSy&N L{Z},>*/shbF2h#]ixo̰F2!f%}^"Y"9AN|yL T3khfMP$1wQguEmH8uT5Y {$[t vґf2TuvD4gKϊ!=&WN:_qVKثwb.'75)cKGV͌8!xɄcDP| ۋsDV|#DےGII#!0,x;s!co|SR("ofmȽtq rP9K>e9O`-l;ÚgD746ɎAM !#}K׷uny[\8Qr!l4)LA]^ x;7yHϷ@&@lE L7v_0iIwj&o'DGVȼk_W\xN,F!T^ǜ*Z{Y2U<93SJza*wJؑt?l?d25X 0h#HIсE|xZt0}7hbƦTp$*ѷPKqfN5[kwrO|1rNd1[*7gK+um2[J^JrDg+( \BCT4 …`nr ÿŪ'wyFReޮ]5;U~t>r5\W{\XB@ DƊs/meP|J&MOn?< gCnr$֏WЃ I9|:B[¿yñ 3Ì|B~H%r@7l~c+I@luF)!"-v6čdJ6 cr}9 2fcrϥĿ9bx)D\UkV^2&@.OxP <.WN]UJ5l 1zݓl{YOP1dtjom$  =&@(dvf+\9|f{ЗZ)&eW9;Z:./:-xTKNlw\ҍ$7Miv2⡗p I NC|ջ8֛Z(sS\_,UlEH; 3s};?Y6&C[;1L6q`/m: :TW%?.K0E_x qTK(0 ǻ}bRJkL x~̍d IzmUdH5mIBhvfO2ܣA1}=ꎮ1R1ݏ,o$lxJ5KZgȽu'-=ot(){s>j|J;1_tim}3 'A$0 8k&=F㲰^Cy^Ē`l$Jkd{ҕ]4谅Ѓ3a@rY^J smx2o{?kF#Tb. X3GZ6ڲx*Fp:9U4!(Sc__Qscew sw{d[[LЂ53=[{h }ݍJϾ5/^9`STLS|"[9SsaǵR$~n]4o6}@!tpJ@#I<`/cBLK:%K:}+A<4%hQK'hCLe4_]Q)tS+ͣwF}U'ŗ@3 [v҉u֒8 `  Pk9f _8i 㨶᷼8j_G+]:Y~T,S:|() CZAcBa=^!;0-:GF>TԹ1.XOZW`<J qg"1lW0s!,cth4IVDXܷXO0ƒzbȝF^ً=1"J`.3Hۈh-kMsZX۴r)p `lपZd@)vBҢk1aU+E6"7h(n, VsAb往Kp)`M']t#\ؾx3Gy=-#!ZL8!Z5WX;/vl-z}XG`VC>0.+л*Ȭ\`̡^fV`TpN 뷶ۖk& <:{$*sTh 8`RUŦnfQyI$0naqXa=n'F''kw9,lqԜH5ò 5$| c?ErJis37> @j#B1rHLd~=])#5Uniy؎| َe+Yp͕M&U iF>E1Cͮ"IqwU4Q0J%7#GN0#سKT?Jx[R&@H'~u?Oԅ &e ÝxMIU%4g)ieu%{o*"C 5wmNˤ1$?~'!??+j;nGř 3{'" o?2 =V%ܳs_D<sd9DhȈui2*ͰBF.pL<4diPf :#l Q5қ  &yI܃V7r q# MYt%X@ӍmlK--Hd䥡ܽk{Ap]$N7NOw'T E;% r?`,q6b ־*Mb*@89HDPb\#yrQ_jh##vSQjK"/" {GDع^^D٪."pu0?'9y= .XR"ʒ$ptH%kSۊ4c 'W`s[NG; 'zZ]ˌ]ዞԋ`RZP$qNk M"'R\7 HoU;P|m-Hl|#oZq=r𝎘M:(ξs [#GgUOHWCD:VR6 qc6J)]AG{:uh4]@Q^݊sC8&sgҩ lV2ۢTrQ(*{>/HދG9z ?L*²J;9og\GsӀ6 ÇCuMd7r"@+iT<@.knϸu廀F݆9ZMn?l@ya\n`EVB,΋"s:XYMx!UEC{hŋ["tTU._\ݫ#2 )ڢڧQaǡ ¡_VRŦq@ltH^OSh"CP Ne"?T >Bgs~.I9H1mp6/NGK]bNݳJӢ~hH@'`k_] .8ߥԔb]c!@e$7vsο ! %<sǨά`[w4;hh9(fO  yv.U&!^O$q-/߉J0A"y xv QխP}x֝%(#*olXө |X<1*^l/|T XsiLl~-N<~iQ!sX؜I'pʰ y` V3ڼHIM3)"hYמ 3#pfU}L5 (Z>胻M\ WYف;b\nDR޳BCjEVrNvvR":f9زʄ8E`V]Zl-V|H`y6b33U/x<61Ś;ѡ~)a'7:z(O~o(H%0]ǥ+rXA\ n␺(W3?4q@`9X؀$p2HC Iب0ijz֚ܒL%̖c$eUD #_ W̃]=0"x'#w2gA NZ #$Zfj"lHhKEn4,d+ّOÔ+7pUGfhG‘b!%M)*[۾ Y]ؔ} }ia㛾? xq ˯EaN_0s|}ON"{H41uJ| |nSj[0ja*hexYvixQk 8:ja/OV$VXRTl#҇#D kP evăZ1`?G"*>[P[JPh)(XeD1$>fT1ɡҿHyB<ԣyǎC2c(?Zyt h'=w# Cl/#ϲZm;mܲ}RdZ E]ՆKȃeE xquZ{"lԆնs8QDVTT,M. O80)L35Τtc*wL0CcbE-dМ Wy]uټ(:'?~ɵZ1u>95$F4rVVܑld\94i2&ꛟhX9{DEѸDIѩ|1Ui l<du_"D!^01=F.4l.*vLpzlQjwMzɡ>carqt iTOlj[2|Kÿk_!* G\,hGf9n P`HWPHA<9ynI(+a[ tn/HhGpZg_~9@"% 1CJa ^}0Ŝ:AN@{gcu% 15$@a[r"% I hO<,n{8e֡ ҥ"]%x,fr=ruo.NxWn`̭.qo"JnOrqB*0Z߭SzehFSMh S#:!Z?W. B40ʨx84zcXֿSA86]ߎ؊D5%Jd.O✆!+V,ޛG}+M,QoKa2@zEP52|geXOeXyEww%#rZ]Z$]@?^=0j۪ߴIMh/.ۭ'xqX8[bs1>¡H>τ&0 Ӗlz#8csvR ?PNo$8 azvZX-NB,!DqOٙG\Ҥ bPf$On-s\r ghҏ?fs/Qw&a,"=h4hEiz"2H\τàG^ &Ez90S0t;PA X9ϩEWD^P")CRXMlt!SH?yjAXrQ;a}5y7ֲJ0}2Q>~>A.K B=./A{?)2o-4#|Mb#_~r>ⵧBm><6x U`.UҜN" ӎo_)lth@eu-Τj(Z9ڥ #wcjXOC/I/`ys>|TXUlcuz1_R.vp={Dk!T$V?Y?$Wsg@@Sۈ&,Hu(ƚ_﬚vjHcM˭\*h.89"W/R꽲- .jdÄsC&n5 ס1a7b4q$V1\ 'VEBdV *bM">((siˑr;3>zR$Ղ1)&̂J~ULγv@"#:6pU^Ҡ;aޟF\2R0>'"*ԭ3a񲎎 $pOKNyf3-mh;W/lPb ?e",̬@rR("(X#mV(CTkQ& 6jEJl7_I'I8@+iv`h;+a]HhEkȟd,cn!QN$y~оjZUZ C1LRGb LWwtgaa\ؿH D"eKjKBئ?8\DZVWW8R_*0S2&ķ:eΣVq޵秝|Tbj /t+W|3Z\Nx#Q,ǩTY`9yE[4:<|?;˼N -]~7qxgh2)+NKϒSi I5骨w res>,'R ~jwduSi~+O:Bh75#*ñ:G&tdP|w>_q9\`N2t,u0)~l d76R,&SJq/ Ɩjbd)KD/vWir8Feu ]82 U\;qJ`]]cHIIvnٮU ţk6^m0}0o3&Cwj *M\L"LWf8ⳠFEwy5{:UDm?GQL̍'AjNX/hBLrܫ>JNHt_q`w:Y$,@nFӻ>rJ:2i :s`ӭ5 R T߿K{56 ^eqNԆ{ Gǝ\[p:;S&ʬfg 2M6mALxJVO/ATp;\:bXW9mO셪>z_$Yp]KD[l]{=8frid^NFւPքߧ-9_m69 T=8;s/vrJ* Wתg>T`pL+}Je~O&FA:A'qci+QSp:ٖ#`A$fȘSVjR+@ A/\&FDN 对"`P6An>eyXZ¨X5iq9~|6Gl7eZu{sPx T$ハ'yvQ )[y=v{W {/0ֺ8Lw&iIZ%'lŏY~=u+BmW9))+j=YIMх+$Yh, WVov]0NNx}g is LYS+&E6\c)hpbs-]tewwؒLp5*}xRt^C oh)軩OP{3v31fŰoX xm&jM}>Q.wZ^ֹO>78<1n֒Z#b8H2ל#X{6mT_%ף'j1'n흗Z:~=˓΂yR$*fO$TOFx֦qw}f; k>uAm+.i $UNJ,"̅ \*qCgc,w^d1|r w??[+,oU2Ӄpƍ(Hp:;` fWUl/*r._KKxoB6@kr.NUJu̕tflqOcRI5V8׹1cNӍr=l [+uIFjw_A_#;_M ~+tJDpW2#9uD<c=sekRV#MnÜV( s՗e{SƉ{ e̤o18VH_κQĕG.EˣhoNJcB9Mej.uJlie췬k|Wsӛs HY2)ku!?,vFsIrBѮgNdp4hsIPY?A]|9SF7)nʞ{]OKf3C9Udd_[X. fci9] `Z;h(XO?/ 2;* [C[Ze;BBusa{URS)]Ū%0 !`zk~4VK)׺D7Kܦ5DH&Vn]_OrF1N>{3cY^m|Y m*iLC13iMwgF2p|-;S4Im}[TǕޕ:os,!  "ڗf׉:ƶ??aG_K3jc(x i Ko)_&+Q$G"U,KZO&mf)8OMIuK1ruv+3j 㫆-Fa*$XiA!*^)_egJQF5a qISwvyAO gE>svP;$aL ~<"!h_6 lP&$0ck*ZG˴~yw#syXm.oޠ2XWv?uޞrT , \ {BS<ˇ,A"ׂ}‚+z׻}GJ^;M3`d F>E{)lyEw&+C9% ,+~2OJFh| WH),j357]r)͵ޑLv5.y>&{ ~QU[H8GnbMM f3ŒrR'-""uY1MX;aϟm0nQK(%ϑuIu{d G/ބ2 i8Ew;}?S%Ÿ9Hx5d~1<8b>a1 3xcd[t.Tue)sw h '%W[ޤ-x?H6 .+ƅ^f׽ap,_XYsZTR4|/ګ̯J0[?:%MH/qUVQ)IfFlcDxp͟SGTbAL8)|Tq"/(0Y}vroa=. y`~r{Iu4: RDtmU5@b_ jkK{Lr\" ~} s7-ne 6H]&L < L ,18e,i!T4 g4ߜZ'dғ3sZgv,grAI.-vo^EET˛vXodkPYQD=j}Pg.=)$ޜ"\OW"#yVuȚD{A]0@KIcь\ޚ_wj0.z/`Y=Y#Jffۿ4:%;;Sc^xr4l;Zq #ݞnEV7+҅9>m3}7}!p}1٨Il;Ql՘mWP&_ޗsI3P()$x? nR1'!߆64*Z72ĝB<|è?D3k2.?)|ֈyIX!QD VZ4AqmP5B[UAK`W)i5I*A.ֻ67ͳWƄK@Hɝ1q&bؾ'%_\x '}SG^k؎LCkC^w%lxZ*ARI2,(ay YM,Q: ݫ;ۄݵ/ٸpky+jLa RS;`)uSi>ׅ>h^F?)ufh? +Ca`ߛ5UQW6'csK\^fy\Aer7ԯ&E~iѠ%Gzea7]9qR;94 OM5C?Cy'SJ:; Ka"!+*RaR > t}ILqGHt=t ˦_nuuXh,¨o(YWn54ȋTtMYv (>ez͠_u39kM5_Bz[Xq6k+O'TbߍX2IB,;pc_i5^!3V(wM- ^xc'IPN.i% 4f;_:8kp7z9~0Ϣ"xq -YKxSiWA`F%fH.5395l|^2& ^)jzLlH8) YT›OC,᫐9CR%(ģ;Z09~ i?k^GZǕ1]-Hӟ3vs2F$lU/|Rv(0o5&D_q`~Wɓln&Dt_kfpB.C4}qh֧UJ}%uR3k粿?=vb%9s pX%LM^ϦQ>2_ݾi{Fnrޛr{_"OnlQ0tӭ}hGS7ES~\Lr %fyW,OMߤ&Z ķѻloQ;J^ۓX,` Y_]C$ 갎AGUJFgYwe+ Y (U/RH}suYyݏd5 +v׉!% T.%[cTvhmb{!Fքp@/\Ià.J1F2a:AOYUHC(t'_E7h':D_ "lj,_A%h^;^nhw!D fbu LK%P:{α'H8WGKVAI]*\6F Ɔf|w}7>7R+z-7uvѕTk-^qP&g]{GRϝ6ḿ~ yuo8*iwދ :o,1w8kHՔÀz\i8{{4r#i52-xYEiAak舱n| > tGuH!!^Q :P%HRp{I )9X 1dzg uࢌBOS4"]ԊT0;XXVI Gs 7RwyW5+"%7~ Y9d K{"|C…wm27L6dzYyP\:O&- {{{j'P`ZYF$DDŽ]J^ˮ# X`&bZ_ݢjyGGf ?cOek U>j`Q G s[hぴnQI6}q:7؇9ڪ2J3 44 [}b) ^!!Ĝ,cZ C!WofCݴ5a,77忇=72/10l/]W_)OS L$1Y8մB4{W Ž,{Šus +_o(54{-uxO.?bj]?&GueQaowjk%z&pqB,tVs-at,)MJoQ}km^t/::sRnCzs\I0CCwf2E?#fǨPRn̞3x"h{i&;'Tt粸dYś+c~lgp~^zeB}n ˪3r0 ?2di߹M 7֮,&Cv* x T¨]8Zݵ>ΗBjY!gc &장TԨ|Hgi:F?Q j5ƨ2OܼPf>B>U0iV]5:g}YŸB~ku&pnﳕ75Te'0\均<q;KsG}Tԁ]M_`NN}WN0#os`}޴ {92ˏkI TC/Q)w^c s]P;6JHs:%.#8%XƑsځ2YƟ%ȬplpB-OVAq~(Lƹ_J,D\MU斉Ur# lt=HDUzcr{(JA`#qnBfq.ߚCp$ <UH|PikuU!, @\yY+>9!گ? Lvո8vΈ:@Ķ &Ŕl(WL= *G&Ap1kg Ua Dcx]2JeYYv3tx] (|Zq=?2mWJi0n5xf@( c2^io"9ЧF88ڒI<==$-'6e 2eY%)~MA|T[%`YECGW(rT:~!XUUp!{vKGGMA#61ʇj8oC|ιBic8O$ЊJ:aߔL}T>UH zt @ϓӪ9 FFW"8Mo&5V]`5aDX:3E{? Sv 5VHw}ڧ2 pvlAѩ<\ӣu ͎Bi[띸Jp&ݜ0%OQnE(㆒0H5bǤ*rۆ+ovV3B5jT+nAVhGG&O'>u̔g}ë+}~%SVWS+QШc./neJH,`vص/ǻjLq\(+ -}`<|\ԯ$sD&#z&0WZ UNyة)Ih x@\i & Z' 1T8Pa9ABEcE? 3kDUy阛l)@~5Pؠ#εݙ O [йQp ,Ghews!"hƜE\9aA3caӼm&Ѩ[5[N>q4CxVcS%;'o_Bt~Y1u2y`L#/%$}UM2"ڲ r/l "àYb荪 +QԜV ?Wٓ%l+Szԭ\GZ$r;UHlM;nO龂fmlN%HC i$_?jzsk>ԈĘ#⛼wtߜ[+z_# nyQٷԢV^ل^2_>e="W\t/X`Ah.T3jQuz!0ʖ1IZ dɶ̊+i(فx};>zR^2}ػDsܴE곩^!RsvECA ʸLeަfx9?_S M.C.[ zvo$|>ItxӚC &J Aз iyCϠ'yo9OS2@`(Sޚݓ$*mH {l  ('<Ϻ'O_e_6 u >FEW C/  mx"} f?'FF>"8 N3Qo+L߽߲MclE)RtbgG>doƇ4x>bFATeD6O.mP/s=jATB&4&W1#G!Hn gAMU"GQxU+ڌ<̘'5sIڛ!Gvw钸d_gs"Uব4oCbXl3#Sv̢.GVٓxwO^Y,7f]]˹Frc'b6?78~B}1:y< aXC{m%y.&jWUaȡb*(S0/F(r6#˚ 1!Lޣ BukY-KPg rm@!(KVXдf?*:Q/ ˳{w%vZ94˻u|A`GV ]%\gppBԓWky#-uI Te;PX<1u QOh90049 Ty"T'@/H']ц+"~dn:xFOyNAY?`91)a'$'BKŠY#2nG^~|8YّU*PAʚiU_^u|v q!'Q'ACq֮?v薑'ZMW v-PQqd9 [ȨK`[T6 /?DlZGeQiY!&&,{sPCyqn+~&O+knqϖG@J ruNƩ:L* Ͳu? :4uʔNL 8EۯaWYй\ C]㩴84|mDsy9swOU_)5L~O\H#MsX`o/|!)4; Vb>Oi^O! VM#hcEZg0#B4džᅶsJ“J2k~AN>.y$kҧg8tgmSx~A׶Wu5HJ =g~Ћ}lcQEغFq;y)@jҊuVe>npx-QcL@n@e)ĵ]$;Tz:0"#a4'I\D1SͺYiwWiOmc.qU@RwJoǩsC,&+Guo̜^̘;;s k]4wϹmsW b Mx[`b7ʸv/ʜTï;|)1 6ӕRNUJIzxYF1wѰ#ˈUb)OG(91%Ri1d/UG/+(=ϟ^EQ{$ jz0J}'~"͎uכc?I_k_x@Mr)(cno]}ŻtWH(iD.HU)Q)꜖ `r] gv1QOR`^]ighQOSVHν>AgH^9(/ c }R"֏0Wa#w50Eør`7m䁔sB8`Ë 'H+@r«x_e]1H=&ks ]! gū;qDr4{aUr$!,W>sGqE*Psq<-E8  /J +8<<ƣII~g E>wYvsܾpjn&[w$z ?\#J;Ooj ݉ӸB*hbV|]]TᖠQ*1L( Za<(Lo>[H ?wH6xatgu෌5PH? mATi^$OϻlVO>C؁'a\ %)v>s9sLϟ&ݺ| X'Nшc@#}E4W%oVGXHXs o# B肴sTT7[8h5wHXmƻmxzLl5a8l,@lw:-;R[ pΣu]o'r䘽6 >,0x;lFi;e5 {f/yKYۓ2DߵO$&5;^{wX7 Bu^%q5*i$T `0d!؞u FiOp38Cu2,$*XfMYQe @nětDLl ewLWJV tb,f F” nuH< 3:5Dݦ߁"٪>b7𔳤2G&N ӧB"MzXus3 >T-`0Z|FyC-r9-Z# k5G@ݙak).s!Sٖ$8]PtC'Ѷ: Ϧ$0J}(;VL6 hfs_>[?cM9 ibK?O^K x7*,:D\8 Zcj_h 2(65-y61'n%ܕt#8,"_VǘK,W΋:Oآ&qJ<˿jJ:l~7(UC ][髳t&P(1nTv#Lnخ-m{D]f 4Ws]'G~w0ZT ($qi?Uo63ӄNn Uk,Ti;k/RƀLM.Qigh+U7,!!ؐ<p0BC%a!"Į]}-N /zYVdz[SL‡E8<ÇنGIeF 7bAF,ԭSi3F)8cE.$wN¬ ^7E`y~UM^̇sbEW"kfyU2;Y!In϶i Syr(dCL. w8f\p>/\i#yەXjEj?P.]gۖ[)Ħ0L"g/nGk{`c5=wL^bf~baBEP=_{(-USxEH)[F$L_⇻m/4]XëZ/VWM1+YK8u+ ܞ.XL&M-v i.҈]  tS 恧MǦjSC|ĶbAЦ[=63 ]R̸eX~9/:fC=GɎ wXX0`U4p5[n?J5ھh CbI01dKqOYҰxv,hp-_SM{p [EZ8Rq&L*[ejgY*f$ ~!^p~€*>U 6pڽ/\f_Qv4F 'uč[kU%7FJaQi奏8OdB)ʭ#'ՠrѸVm4oP`uv)E9crEL@D%"iȝ|oJldpJYr2"9/^⼯a+ ۷nq(1,etZ5xM3ûy^ZazaSH@sCe&o cNوYv^קV5)U0TGڇǽX5!Gľ- ("z ݲRE.7B?-q&Ӈ dV?G^_~eTWV]uW4)WݥaII%Se{2=Jir0.-㟂1|,Ww%Vրx69续(J F_Ga \ A~M q?}L䳕&'9Ep_Nz\2izQi\SpУ%R-7[Ȁ@3g`4Y;av=ΣXVUwKWwιM*(AbJ"VNGm oJÛRAj(J<)^^eciTey*͢d2HVEmj ?Ґ{lӚpW<2bx+XxZQթ ;(=Cꏌ{B`߼b"{qF@롍[y'z~Or`noF(» )q !ʎ,b56c3\3*Ŗ-Lpo[V_]F~W^dfH.J%oW9x 1C`a5ԟC B'rRa?^ J[b* Z:ä&@r"Qg\{Ә&)OizTjd?[=Y*|o1*L_j_TvE]6XA4x |}(/Ja>Ň|2O澴O[!5@&ZIo6MCl5Q}c4tdόg:-T#9yBzjE4~"o䴧ԮpUK997qt,rޠeu'[Bc981p0VV>?lJ 2DUY"OBO2SƆ|U/+SUL| qXÜR۪C; TST@unQF -!f>'xdf?7Rr[Fxx%7'6mLTd3uS-Z ZtK^ -԰1?3JUgQ|7|Xoֹժ$pgOAiZp[¶oc)1A5jiȽm'-I@OVﳏ]H |vEV~l.zdcښ]W d˖-ALϗ*s\ns;d'vSœDOG(T#l_ +A^Q!*A80^G?N(A GX#-ֲTvk$Zs+^_÷u/8Ry+خ#ͯ Xv9bp7ew5Egl Eu}ɋI{JIi9moR$NkUn:`^V?"T=3TqsG҆"0̿allq*8[@y>T~rfLIe k?\k:_k7F^PmK<&p Y[b:᭼ڢ*3 ]u(d09O#k 1!KM)ˀ@ J-O8fY'-ށhbi HC3acAZ9@ID--o'b:ʯ,0^ q_9#Ph@zfa#u(=ߪP`W6xBz86FT3(ZY>SoEH; F= 7e Wo b3Zy{}cSmtg{!V2C8iٻ AQs191P}OTݢm@٫(Ja-!.{- TzAvt &`gEt"89*a9X@qwu>YfhN9J)ƶ80'l| chf]сP}mL L&dӸBN,e Whqvjdzg< _b|ӝZwf\]֚%0Ʒ 4϶(/7 {~h}LЇ>_N:Z%uԱ$ӡƄW V<fD0' ܁~yO@]D6pT$C[07 f0g^ʀ+5 >@aFˮm7Nt%dEMWCC0W3ږ%ig o<2!6a+ZZꛕ3E.1sĴ)pUQo skjȘ=%*rLͫod7%)7UD]mmb="OUtq֙oYR٫+ݽY?s( s(rWP^Xj{\⁳qίp/RV|{#<8OvDիqFX+?c  Ư<ɹH Q'ȭ._ŭTxoќkհ2 H! C 8Xr/9>[þFlbHRÁ*}ֆ\"tC-nAO~5f }szpKh)YC_rπ=H%1Ow_[zvZ5s^-ZUS--oՔ Xo+eGtwadgZ` *N^',\odr҉!rgHA15&c''Ń%ǩ3ܿ$Py`>]ĉܞOtDA0~萅`H$?`n;4?̞1Tyw}ǵchbn U@* RFğ󏫅<*Tc_-vj-͊?>V+AŊ3X; +p? =G>Ox& L \;äRM6A7GTKwsd~#oGuE5j&,[`MnN԰GGv(Dbٖ/c𯶬ŭ5=UVm]x`X ᎒Ob0*t(Cy} Yj _o9lVyUg&!W&,{qoOuw7xJh1c-ĽMy6%;G75<`no2df򫵎dɣEnF%A6#Of!b2BdލTF&ejr~w1_6hš5ރ Gz2hYYUWH91b ¦-+O׾eφ7Z|A5ŖB~yZWZ` ?=XT#a2soReUE`?;gA[Fp"bez/h$-:BPG{Sjm}>MQda!ZSK"kjm1' o6T~. ^JLgU5-DbyrpYW*^Uh1Υ[V؁ Mlɳi#PHH@|זڬti=mNo-K$\3u ]?m2, B/jBIUFa{ OmRhpMI{aڦea;ZRN,wT_vLa-J D ͼSܮYݭe{yLO-fdBu'H*:h7pDϕU{Rq R/$Z2>6C5)}F[zQVbGϲj ,@MGE[<-n *@ 5%/9&0hVqɊ5ݔUaxI>5ږT[sn$"R 0RZ~pVJ soK4HCq9R2TEˆ™f]JmB&CZ<يtpns4CaBP|Yxrű7Qf[a@\T?*ځ9g*01z`oGAH-AVdH(fa;,=Y F;3ܤȕUD.T:fo$t0{H1"*1^rM1FfHtՇHĠ>99Ƣ.)IH4<@ũ>gЩW'Cbaa4'Mr͒}V#q`b5Rǃt[ odo*ފ jM$ KLu\%ZL.쳱!aY2&l+T4I2J -_{XNGw9w~Nސ^ɍy4[ K^je%C5l?+&DRX\cԉ=s j*U=aHn<ǷTe) ˥ȶ3lL$}X@VIW~`Ju Z0+b,dI"!O4GEu~;6yƳT Z{SU&_@+5ZGzG1Tx-QEi}z8eO "'ߢx_1p,C XLпN=0 _%N80 䏀̋Db~4~' P#))#2au(s8`6:興iʉ*Ek0vea[ jE#3}GY(ъQ4]C D*OCXF˪9+x╏J(]5jn|D䱇08ECj@MFN(b(,Q4ƒG;c>Vaۨ\D$D'p,6'HNr͵~,h#Xl>)m?k[zj2HT >YfxLQ8Pvbj5,(QYVzWnI5;tsb1L#>TĵE2 {0HS~vzhxd8Q|R iO M 1]GV \v~MӋM a4v2ߦ*q5Fqq& ƚSӜ?>B+;Zd95H5NٿS"?] 4s۩<=M/CA.c7#G$ŋ;DqG~ꃎrsL?~7/Bļ)C[NstXym5b*c 7I 2쑛U Ehr~s3 O%!,6]D7Jc{\5#8'iEz9Z>6ne9[_X]1*fr6&Iqϖ"jYw{\wu&Ӹ]ѹ~OJ[zԠ3w4)j'ҏ\h_rc5|Q⻿,PT@DH"^8ՓRϋ}[ MyhuP~ڑ8\N9KFR"%9 >|ݯV'I#oLOCavRYk0ci Aq߳HXtLmf'~M/&!^xjprMA҈3R^fmUfUxin[mukxT4dp{Y!-ND`~>~htGX"l]>FBS ^r]󎍨H:9c`(H4*v2jyz4(*x}ztSRX rf؄z Q31-CZ2LtϨn@uy&#uIz:;XI׵S`J;\z^<%e/=ׁ*婠erŻf?hA)1PmNvG^D oD#!i ܰ^ʐz h^i#iu.菸 ˦D;[n.ykFjy!V9Kjs &p-A R3FsqMB;*<`0Jգ n6%fEehCr6 w/ǐ'pz\!lE_ :H| 3]JY@4_"`h: >HY"tzXgltՕ.u_[\p>%ą?,~0#r]XjC˳@ai^1Ab2sl%BI?wa)8߯z/|΁^h_6Iظ#dWUGj<$ ``)e6~٘G&Y6Rvl#ܫI~C;Hkr8AJӪ7#DtdnʵJgn9^rf7a 9$Pd -^d}1Tv@0 J5%0JH Zi:~8>:/n?; N6 @ f ;2yu| EZn#KXP*_b]Dc[uH@_*؟4yxWz_"S̡H.i2XH,(EUQ4'yBƳΌh[~F8^&@ƛIy -ȷWpb\)MV4AՌKu吙51谛7āNlGI Xػu]d F +`%mBd*mnr/A?QJQI8һU)z$~ F?w.`}zggZ,?C!dqWWeg|ZG4|U*~&H 3Aa."]+|bM:̲w9x/x'#[7`I?$}'V;:%Lh/I:yCYm4lGIY`HK;X (=jB;RR.Rh)ލYRE5ZNDVh+؁RWޤJTяm Tz'G -O1vRsg}Bj=!nd^ ~-I@`m^"a^M5amڢ^tQJڛOOq&,Ct|ȃeK쬘V1Dj\"A^hI.:b6, asʲ1YBYY '_-:se}ĕiU?I1gLReJbZ(qnGy]}oYz4^` >l^P]~b,4wD`-qWY~G!/`W]zPv R֠v~5:Ѣ3l`Ǎ8xE/`RZh%y<ѕ;M'UatWGb,'/FM[lӖwÞRIO[[HזjϘr ;nwpK )ayo\iMFo}ReFNl¯h+اjhzhy#'9dJz\d"Ԕ{b hMl$q><;Mϳh+rR)Tu:7j ! St_M2hsʒHHt0cF VNC(N:'tCu7 oSթ0 Z@2qDeZhq@S4Ҍ\1v@>U]%^򍖷rIVHr9o؆Z2^+2c_)yIS3-r6x:? zX(dUW|BMFE֙­ח`[z_}RJe&3LlPZa6\6ۺmw,_V9BHf|u?Ԧ"s Co8 /zքוgɲ# 1Hf2ǔ;J8VOg>R?Wn[~A\8i?D F1<ˤ.; l2UDO!X; ،İ 5TjvmV*U, J_V/Ҕsy c.:u&/HE)+dhڛ]cɇ$D&=n;yX#T ;Vݱ,1,֛bq>tՈ<|_õŝ빕TnEޖk9ej "5^OF248pp`Sv(1 o 짙 dA2q~᝾%K$? sM.M{eqX(JχpߋFH鶍E)!}K^wcɴ9\V\XyX}3ʒ 5Tjb! Q2B$jOs(eL`sp&N{8<3Ҍ yJRyh_9n%K d tBĥcTJ:ׄױƱ-pikM5VS#AHs". O]ҽ"3 mfAPGLBSažr^c;ŸPMxp)JA4=26ڞ4fGP9]s ?E#:zP9I8_נg8},//KؠA>S`zl%G,{ypV{(kXH,>Fl[xa[LL޶R Nܡ ܯ•w6AFSGQ'z͑'TWًeƯ\O4)w$LfoԟDxxRrOFv=\aON0n]N_T<50R}F%xYy^=(Iݙ6Yrx I4җ +ރ-Dʉ-2#>"+WPYІ8p>j݊\ߟ"D sTL3MȤJI}4pc?](P5 f>;[a.ל^QPKϊ;󹖻G}K+!u]+PHқbokIؙy(!9Tq7rX(L\K&rÉ9A}"؟mvxsE<6Q/0lP) MH^gfTfT^5BOwU+(7;$[QcTS6b AB$B͛Koa1 jNMʎ+vn3e9$(>Fz^kzRUo[izYa.s^n eml~\CN6yMdBAwcWaY<6'FJkű@VNpO&®#!>03$z~*.*F+o~L.3=J~oLGA2@5Z{sG蕡w}v~nvrݛ" i{EIWU?G_0"<o.q26f)|}Xn>ZǷmHQiem qRkz֥D/ơ7(ɚآPeZ{z=S*JR~27 NڠuȺӳ٦^v{2צ^Vnmc ׷f <.}jQ/,|N -wS4bqDHa"Is" oͱɱ0Qu[N(/ͅ9=b^d2I!xCwy 3O`Nу3aENhXS!t5Y=\ӋM\:O>"Z-'|j# B2u#P"dfJ!"!S%᪈Oق10*+A~wi޷sÜ"bky}%IC킂',^9|- `-7[I;OUf%8 \Êl\x*Y{-k`F;D"J̽Oa#oEǪ8C@ߡ4+揸wg_^MuvLvSH| tx@uҶW$l:MJUH=mT|=Zy 'pD.[r4=,FgH_(Vې|89! K*ٖs?Iԅb~3_3e36dڄ9!1ږo0!tT!4T=[avb˥}ۢKXpweO;ARZ tfV=YNy=5&3Z̠Sf#0kKMCdȧ^U•6o\RYm VnxlVڥ[x:3O v$y -NWU {DVJntz~=o@oߤPAc *P;djFYwxXtց},R"3 G&H{[CHri۾̬W;8-rR.U^ z@KڲX!55|9|v$aM!'gwr_T\هºZ-."i[+'k{k&X)i v=[>ml.k%]AxNH&Q.&;o(B4=i"6檙,_|u}|Q(uF-s]dnO al/<ܦJiw?cח68](\Mv#ˀ[W O^ KW/HM 疔rDR[ MRVpnsuCև ?e&<=9^$T!7|s;*r /fc5aŌ1<|ÚcEʫIg8R,h;YcSBL 2RVP32 Uњt-|m`_rb,4Sk ׁǡN?"%djǂ&P&IU\!)aodK%E Ee,3k.L}DEk%sp6X}u]X$Ldk>'$'~; BMתu{.L p]=}ncP!`uk%uAfVմs1Q녏ĘA])7) .Z("*LjW|-~_bS|&?UK}0 pfje6O|1&J71+j_ lGp۔Jd---1*I2sL EOW9-R6 ݌_|f!\ 'j -/Ll_o>YLgPէlM BM'=h{{Igj+6њdڒm`H_ ܞVO$a ? 4*5j&v3YC| DI9-,.\O6cipiݐZN1/d}`l8ߛJsd(GO| W!%a 1NՄ` srWÓ`A*&t5]R K_><nw VуyW1aYIN/g}"d_\g g׃@: xaRz_̬iBƪ9*Q?ꄵ6yG_[Y  $+MKܾnj+h=;m^n@Aҷ3,g-9.KQwu`eKdydثUCuD}xk6y2'̊c:b/In/(v{ڋ^CXƛE&Ѣ5*I8I1j\|Oy%eSE]H/HA֐!3LeL] NWqb;n Ma&v>+0ZvoO+v,.v]Я量3w5nVeM;w/3T:@9aizu4NRbUejLŚOOU|hT$j'G!,|jY2 F@hN 㷾e5=yy5y0b{;,C +RWO$Q8Q B`>hǁ6?E]~TBt\hȻEPVm#7bۚ oq4q]((k9(wwSLgƪ)L5N^jdHqoڷR,\@"rۻ}W~ux:ܾM5TxguU хhsg*/rytUPDOG'̪ $7 2 C:fld%ʚwVsAb9jAٷIR#Ԕ2yXe&A< X~bxƳggbëX>ԻۼG_اqp ?]wgNG&\7R U9Iky0w5_}em߭-Jx?{s&gxc {~w&؊؏m =Fg@@2_H?O$B`tShAhٲ:\_֌ߏhO3:UUna *h%guq| |Ćdm:O0~m+`8LY168+Oh /k}ƶlibQ6Rz/x|ߧ,jKH_d4`jea@dJc:u ާ ԃOoJSqm`>(E;])w0WQq3 `)qpzl+\Y$1ҿcD@)xYށ:x=tUmHzn1we ?؇ÜGߎJ>~nǻT IEC|iU!ڎOqi~BJSt!3`?I+ɏIu.%vM:56ŔOc2&8$s!o:;~@ >SKl\AKm.4m[**2h26$&8 5f #kҬdwO;&$۔[LTuuf~x=D*Ф-*@BɎ%  f+;t~fș#d^ *>o 4o{CCNwIϱ}MG& 0C4#W}S;Ыa-tw}kDr'HbR) \ʮENqawY{Pj+nM Jfb6eU&++d9+J/5h ]'k+( ZV @xyl?DZWOM8+ܛxl #0iB&_վ8@sK^vï.CAӄ̑Yw$2\U>̓J^%3Zaoׄ?VSѬaf}MO_n[V(?&mrQ$hVoʦ~K;{wWp͇Ʌ^Zt!PO3>~vg>m ְ1m׿dJOӨ|OiDZܩ !aLZnQ!4ZJTļv&#!I=蔆[5LXnaa o Rw-:Ƹ G`lj2߰ayMErԵK$g3#di$S_,MfNm'54SG(y.͢Z~shyt[dXs %սI*<3Cpub'P'd)`'Ց/'"jS< N}N \(Dn4ʇe'o|j%wO\d2ڰ?8FL i@Kt @% $|))KB U_pSH»06[XZAF 7T&ITk=9䬱vf~k;42Xe4+xRl9&QQK#ž8`FڦdעM#֒Tc8II|I< |8GG|:qI终QEb^ZVo;{& g#T:ۃ^*|Zk吐 ? x_ `zG >eڝ~2X;F5d4ȼaqZC ..D6DLus9'CEvC=tak.tU6/29 % M4F88R t vdnmZ-:PQ[vUH2i6q lIPe`yẗ́D. f:\[^ {P?+!m D>ƧD[|) ֒NӼw(g3zzѢNZ郛h s(r#8  V2O&lE~= 8,++G@d(&Âi?7Oh*FUOF Z=3i7! 2 3$,ًKcȇ7l939;i|qny6X|Ӛ` @%^m>O=8W-lNSKY\ `&ٸ8kqg H$uR"e4&G5۲gsI5$ahy:cf (z0b{-K4/@:;!U&*O:$"l#W>ߗ z !FW9@pubŲCDTL$V~KP97J{Mk''rfX^nȃgPaz_#LuRl}>ecJ9),+8B{'=֫OI&<ksa,_Kn#R|6B!:?9TL.M%ޢH^ ߙC[D  KH). ?v {V$ehqTD~wUlQWk3.DâEM9[cF3wIE;S $h[m^WN9#MpCl*m:/c'KN^&A(Li| mI]t3Ԁ)D ;.+\uFd* uj?ڑ]=72<Gf5)VW^Jt#uM ɗ2&~[?z>B{18FDKi'3D a@j=*]Pr)yR7¬,yx:9/^qzR30 <Hka.pN[6 !+fUK%,LySlWAloJ9@_)jY, NZ1&6yXgkK ZQNTΣ5,]@~ Q3۽6'? ρ*~N_3;Ȯ@V5}e:_-o.Z$_f(a{ _H dg#lIMJ.FC]cmL[rQ:W-G^7n[yՕw9n>hAD~:\* m]j^N+薋ƦoKm'7{^?k~4,T(;RCgyK.)NadMW}װp|VMyC l0mÝ)t}J1E1g&Z AG-w{$L.> NHcDtdrqФLAKX,LG<ZRcyCsߑvP-ܵd RfTUP,z=2ʃ#rtZЋMU"] SlФ2p}>@Q3Sz]kzk$}7S.gE,\ȐC}uDaI<|v6}:bF9#?tU$eE5}2% >A# yW놲Jyj Ta+@j4+/=xLSs(+Q063{&#YΘ?Ftm{뜭S(m;-v}b?w.2LO+%jŪEsA\u$sĴDȭp~&U3TUt/Cjy}hO|D*&(xP40CO ?SG i":8-!Tk1Qs+,sܽ-t祭oǠ4TEPrsđ]Zg`hGu:V(:Xa<+bw ¤f+hGE"v]`»ϕ0N7jf~v4w~a7C ~oBHGlJXx<ʲpKK<21 /M8dO c@#FDYjY. 8Q#Fο6^ x?~N> eRo_YFy8m=4VqBi]%cS4ut]/Q6$X;%M=k|GWE,P5d"cijR{ dL˗.|pȜ79>q *W ;/^RHƲpb:\b-Εu&@˙dXm5쵅'8QJ0q)t8n{D뮍X1Q4<^Xҽ,joYӨl?{[=P#daGhyt5K:Gc˘30" Ŧ"&koYιXKU= a6 XCɬh{a` nPkb.|UI"% W橏 K(kTd?RO%e1_{dQ{ǰ]pz˱b&^6<;q)H3jEDyB|A!M/* 8ځtª f>aׂC^Α$ r1ʓ=IodF!bɶ? 5Z+'(mv^Q~7}I?1 m5l<nMRr NAȇ 6Xsu.o<3]fΒ! 8~Bi2)8pM!zIΠ*"j߳Do"aU^(>y6"}|B>ZJ#s[znבS9E 0ZȀP5u2@/}z>6*_Hߺ1'#答l#~:FM7&1P4u@TD&nIJO8;] [ɸvQǯ^KZ:D5 dQk$2 Lqeպ%-pȪ**URS-Bٻ;}?ZEƽ&4u}ܦ𙆼J_GO;\?r!gw3~?Z2fxqu'fZJ}f2 Џ0k$]m5 w zE)+޻wg_J؍Zo$7W-'yMA$[ &G;Вfuk0BZ_.D=}E0g)3>nuIЉ[`|a<"&p'm `A=]#o2vZl!0Y. 0bNE{OE@-#m}\F92٣`]. UArH;Po%S!*,Pe]_%OR 5Ow9%/.MťDʾoӧ@DIs*!/ H@/j87zѲ>L?íP'R I=lq0:#':U)kJ s.K"†}]0z'fzwG1nI6 7eu2  `t\oSyaP&_qh=Go`P>):SY3"cQ ݠpK8da/Lnp'5pȬIޞ+Bƛk}`LQ}zR 4 ̷K?#,-yڧW9Gm7*FQc,q5D1ZEٱo2qt*bZ"kk]2'C h#A3bN;Ps`UAl9sy2Ehdvy,p7 v`nX@\hnb:DuA]nMƛ#6aR0q&vȸޗ5_LWO`U{!=_J7;y`VW%')P6Ϝ2"N_sY23`a.2)ޔXTUR8B;m%H,"o1K|Ӻ]}AFul]E:x-D+>&M sV|.$ g}]EP7@"`8E44[8ҌSImȝ櫔=,/E_N@3/0"%jt:LE#֙I6&\;eBwPZ4nΙ>C$4#HgQ[7URfYGHl̜gldʞ)-p9*|ޙ8!=jbtRZk3EjGHXx*ZOmd6}@!ttbAKH[/l\ 1)Ϭ*-qU7 umyxNsɘ a͢}zcE-69~!QtCF)\_<?"q=:QhQ?n9lamĊ\I.+XjQ?? r TbP60+ܿj.Q ʋ0B啕4E ; ]f"W:(qNɪYVwE,kvǣ%R`V9vSYa;LjR9E) tO7H>x5L=k;hN壱 ;P*g TwBurZr:kpk%ɳ!v1A"I}JK]|&iwKi}OG={rs f(|_cua|@["VL+@UVFE8SG^{D6:IZ,K#6ҤR5rMHernR jjXd-aD~X3K*1&Hb7yZ7Ո5KS:"9zZnOnqQ*nE%b/^X潾Dwl+J#d?p /1b',QC:;/vw]R. <'e2Q&xÞj`*&ֆna =tͲ`6nizz;;ֆG-BMfqAZ2~ Sp"*+h),r>#0/EHaB8]&Z)L +GG0 @b "Ck3]i#9F৸]dl`VJi:'X2GZ*q}} urug$h᢬Hj5Xx*16S~+*mK:l !q㑹NC9"F('96k+TS6Bк{GZ(]H1jxBѽ#^4||cPodc@;>?̯F`uWndkr腥ti} /vM|:G%Cڴcw#'AϨNgZ>E4*vrVSA {#')k W;W=Sr(anJN*qmy/uۂ@Vqf&yLTJ3 fޚݯp0{S/qQ2rB e!C*ʼnfcxKz"%&Qn~X6G1(N6}H}t$*FMK]nפ i/mGc)uhR<~b|}sƞ8-35bۢQǔZf(I=Ros*ߤX}ݫDa$2[b¢?44{"u9=ej1p;vUQ&Cf䈧Eu}j`U f}Yr:w #bysBW'Zz%ʧ(ф#-'J Bb B vC?5 ފʞ j"1lۨ,_!R \~F.G>:q4ym*N=y(+I¢k-XgSYh-RqӲSӐAf:F2|\B@vqi~T'l>C稥nia [ |Vj `fVO##W #RĢ/kW3~5ùkCR@{º :/ӭ3%^5F x ).:&ʼnvj2-J8a⨞3ۧ2 U~p p[d#==&73I7qeMPz>IW X>;܍}!2_Mp"lN uHU@Gݤ˜͢^*֝JȹY-ڋLNI%m`있7sʕI%4La2]/:tsY+ *iHhk*b;,Y&@!l,ӥR0>vo[?-yUK' Ǿk?EsMOf*j[+ 'ܱ Z= &bDN{DUsMѥC`+auIVc):tEhȶR4pZFnMdY.*$H'L,2ėg 0^d\s~1KZtjG)-/ˆ^ :]BgdA?,D܃KDҫ"b#2foV\~rvv+4XY^ <ǰ7"NN<8-x sM5<$>2UJ/uDdryݩ6-Tm 3JFќ#F$mfjJIbNb^%1!l?[ eX ͫF&xUMqD޸ ̀/'ޔ-"+s3t:vw^/?$gfn+> }a_j|`˚Db ~*Zj%S u_V/k?b=YKqC c+&QJjFAzOO4!#6jk/!s+ď0`|t"PtY,1ih7bC|R{\`6s~t$5 DžM)`ሷ{󖹠yNF`֝SߴW2qCQ"B60J&ID~*x7{ zCe=${.9<-iRC+PWXO+yǩ%PFZm_;+{` nWz1p!!Z"m;P|E'b 7 Yp#x KEPtESC)k9E(BYT'\yv!2{r=XT=VwrWj'Uɷ:~jAlº|G2ڑ3-X;`P!kC,R=y$ؒ1Б=|v Zx{-/H.{I/\ $J%w,_!W[/IAe1o#{XF=8d䜺gU2 \LzЏJFuǛS1޳CRXOmOpgdTa/ o^ _ X"RS?!@fY7EN Ttyc:WruW7hqZHᩅ]u:$="eƿS3kM)q57tɕ_qi¿c]ѕ3!ߒ4qpvrI0PMV}jj˔QQȠjf =[Z<,oHwI͏7~II)w0?(U!2vC߈˜gS)wꉠ@G"CB|st1T;4wh#<6yN8e/&ג -凊tH ԩtSf!#  Shpw2&foL)NhfrU|>_]&)W ߞ._YA9m|:72АUx?WߜT(e/0YB>P]kQZ*>t3 Ŗޡm7,Hə(O(&Phm7٠c?Hl!@:.*!P02E5j c Cʘ:L/SZ&ZI yd DyGsJANk1lb̍_B6ލZ&C9o;EV sIER_rH f2Ĺ$^@e03 P/{Wxtc?be lo^i>:ϳhB:IBj5)=5(Z+rP5LVJF/0'bNJl $ٟW)??(9Z%R1Cjd*8#^ k'Wpmaax,jE؏}G8,d6E/27ސaJ `=`Yy @ə1tV~ RPdfi(^T4iܻ[-hNj3_]k^~[1 yL-W\Enގ$JZ/u1CUN\6ˍIp3fVHVrBM9њʱ$ 2vEu [Cv-72xQd@Z[-Ԭ1DeGM#$s?UN2C#&11$9hǬiaPZw`7)!&=vdFZ Nb {nl#&PK9|J7nWn4G\f~R,t;D&~@3iH`az2q8 ߿=p 4.LTu#p$ap{h ]ZS{ۮsD|ag2v֜Z]#R*?&¾QmL xZH$ǣXpF`Og4:iӊCVͽ\Xz4"G;[s}yW5̰&M܊Z oI$[8`B]6?3_,ohoY`\f*"Kjzʕ{Đ'TG!2v ()9l. ژyT/<fd_D B`R6{⌅HCÖqbI6cH V},@ I :R PV?9VBJü{SjCK-NS+=T~ 4 ݱ%tQ8;^/%o!w3֪gwln~dDhaWt#>. =(R M8z8Vfk jK#^Jr!wL= vnH)|}j SR[>Či-qݹ>Լ_-j!X=NP>J;l$=%5LusM7A/ [,đ)ֿ't O\ZRvy?/k9F VK/+Dq[M'N+m(X3{LŃH.SB޴O)ѝgEDݑ:6J$:jiKL O=0OQ*3S JBtJ D>~ qV(CXm&)=@|)Kz-]#ʜ"E$دm.CL_?=q <հ1EɓsY-a"a޿fHZ cSRga&pk]E-l1QUb RM: 6 9>sˍakЙ.!QmH;{?'?8yWpc>ƴD*J~X0gFgZ`m96oF"38 4q':XI0Ap xT;k2ʨ{>k~_Fkzd!h:N1Oa^ghs1FA[n(E:ƛX*¦hu~<6kx *IWdV?G+ ȲES]:S{Z`RJk1nj\ikȋЌdsENʃ>Ik)dcąn/7lV~"jA@PWqA;9Ժmo`bWY {8Z>32r0*ދ(loZB _YMe,PGAk [SPe̸ٱ&1Q:p+_R$GM:oXIz. ƀa{6РTDEf8`̋~5km'ӰɁ`< 6}(Pl:"`yRsXAem^'In9N:W.6t,jT(2ks8 Ttrw=^(LE%m7M*lk$$=Zƴ뭹_ghިWod>#ͦ*iw#CZa}tw!rGiN$i¨OHI@&.Bt!lܶ0Eѳ1evpNtյ:prD5&X|1Z7?9>o{:N|"6{UhL7_bO1;Ư%|5.}'ѣFjX#,C'1tSe!Ai=z9|Ӱ{iFVnZB{՝K/ 6p Xq¿4 Zʔf1S $v \3CH)Ezk/R$xгAlYفq`Ú7;p!=(r H\Eb)tj*ZH8,ڸ{lB@C; 8xO9FaRΎ/P-g=go` )$ggDZt3)2FSFMQdS`DzꛑT}'u#y៮G^ SZ.!o3X]žs,E)CZk}Na PB]BiJ%]G [ⷙčĖ|, sĞ)&gϰSyI(iW9ũ9^A: k\nv٢A!f͎K(\ qt{Qϛ0n@^.ĥ;+B}piiD{(KۊLhWyjBC*PAN5'6ʀz#[,Mdma|lג߰`TD}e05cؤ2^dV%/}MC+0PV'AIoiRiS_CLw` @{E]O-zxtFrYxv,;hJ.kE{2bS(!fFbJDF̲Xز 0ZzX{kl)U}\Ҡf &a!]Wj*L9)wѐ Ljݒ,̙,Bu(!_O, S}΃q.@qo3JC)|=A R-é0D'\2|&8I3ulֱ{1'dB;nNh9/trk=RÉ8-23\13xK;M§ߏNbmu֌ƾlT5rc HR&@Mfl0BXn4B(w㊳kj.(, `V2Q|)96s1oͥd@R{R;ȲխkjG~*ù%1zf1xzW ;`xS퇔$*!GTJwæ^7B3 Bx!D?&M}Hnye3 -bb) 'I5qw `'093X{ۊ:v{oKт42ϥ!7VbBvÝ*Bw6"܂l DF_y:G9]n$ ƁgIIWxв7~._z+i)t ; V5"9Z!GA6p1UFǴSC!EEܜ4y-M1S 2@CV@ 8`)pIx"~I m>iSnpn-!=#{D]5٩̪x ?#>upY4 Ԫ>ɢS6{M֘Z945ilZ'n>2ilx[ƛ='#)v%KFO=h|FΊBlOD!_ɮ}ȿS{G`W f}. m:VDNfRÆv1gp`zҪc:- &i|km/kIP|BF$zHH4yc'DnN՟d2ԡ1;d .vS qJ_{8<͓KgC# \—xJ .nR3(GUعaBMA[P:#d QLĵ12I771cp/$Rm!}@)$fɻ?ΩQytjS"quHc1q6P%A'鱿0ji4Hur'*\5b/ƀBY /}5Lz#7 T肦‚Ҁ Gг.0}0j-,w+2N %J@icY>A#-B^|مgr hej΋vɛ|?)CyAY?!JcڑE/2:g8g&qps6͏A6efMn/#\!'`"{8i$J΁ ~8CMc{ f8G1561Qf26&2!.$xEYEw!E-dQ~]Xu;엽P':WlmHadF* e>U0k@+(c|GO5F4 w}#~ k{}R<֙ ~ =z 1?HB-bg?D  PX(/aY^Pw|FzCF=zck Q(f0.: f0_kNi`%u<ű=W8Uy*k:nX=H|TmE<':>"*XWW*YG%ع&rϼ)#ڰCT?U=&1wnZ[W1O1-FíZ8 d-I~þ[EfCT Գ8?peC3y*`K,4sڊv[W tTrP|KML(KYMQߑ?G1VeR^ g"|?YZ (+s8ิok[#XϡƑ I8P=UTuYR3Pe/t N#=~oi|ɎnJYqK É*̥K!11ceGn['"G~dZ*r 7ҷƛaB Y5l z.@̗-HȆ,FraAa`R@Ե͌rwa4e@7F=$p;آK`/FZ#\#5.՝@ʌfCLz i qj.-nˎQWmFγXct4]ʷ4<ַF-&[ s&4)a"l|2Jq/8%ᗩݵ_J ]-ߧ s3ļ}wbAnG;UNUMA3wXDӁ%n㑫vː*__]$pЪ\4 [hS;! LS;܄Y`<wߴ{MK/~}z;W+5 tئ +Go 2S@JsُC(I:z fBd!K#Kw∏B KO*LBKðe0Ru!xȅ,lZXJ!Ңd0``ttژw#D; :U؋[ebmG7 Vc*[d!R л8L jhHeŚ-AU)auce$=ĊWsybͭs8瑻)$j>d %%8Í/ Q ; MI-l@"y'&g'Οr`p^l _:6 IH$:7dQTrp+mMr@pM^X<#d})){YA[,Sk;AT,#shM>)1ݷXvDLLmf֔L#VH(L"&u?F*2'GpfLSuM?q rKͻ..k{úUdOձr=F̜pl$R[.8gFbղ% SӖZ4bT[y&QU˧'hSU]Yl%(kN݉k)((h##c[j?{IUb -ç6LvJ1wUe bM0 %."o^c}uq\9BF|d^vg`"Eb$VXD&"--{"sv.M8F<&-YXs=Y.QK׆}_9Օt|@b'~%Ɛ[24ǿB=|>x= AݵBAh `,̽[,"r_tn\q ˂`먌9*Ƨ4g;6L:E}Q œ75똨3-%2OPX3@*ܳ,LdtU=]D@FV ~JRv]R\Sa"(ैf8Bdb5]2VGͿiǴ~C #GA3{$SLQKaˀ-x\Oy]-ca&A~T[ך|2 oi5$S(_MhN]K+<+ѬB(Pddۢ_U*Wsmc|"fd`Ξ< yC QRBO=9߫Tr,MG).7`}t63fJ22oJwx#$,/ZJTaN:u3y65[]øC0@cXw'kٕA"!o(E*:HiYxH&Cw7$"r81  M`)l\/MQxܠϛ߶1(Xtyvד%ӓT7i$n8ɶJ4㶠rC<8SH&8kZ*t1VH̰ ]<kPh( úX c\<5Nef/2:ȉfD1 N%tZGtA ݭ)kriC  <VwѸ?fUA?| j}%T%YjiMDWABe= $LNΡ=7{N'OC~Wun7M¾Zw+0)A+/jv y51 |eAKj-`*9]}Լ[Q;&6U-{ - nEұC=}zBk`jhP$udH9Ps ]DUMlڼ;],{}.2piMUl<\u< Ni Ȋ9pgd_jgXRݰ5Ny5P`+Je@5@'6>|ku`˺ ^#H/ǡa2/ =x;=wf)9oNf4!E8d񕍏9; \/^ԕhx-Q#F:u0aٿ]G@ yU2th@v iH"S!gO9žftH.02PP˅x`^ 5bpVCtA !3|CU0La{]0\s+QVɊ}Wqc/缼;:/d 4`J]h;$AuwC,TJGgu(]z?М4ےXֆʉUOS+~ :G;j,#nhD6۴E|t;sRFHDq4?JY p#hG(k|h_SӬD  alĿ>Bgq1k h}k~:i/47V<o [䧼+8İ ݁Ur Cz?b}J})nOZx5gL!$; 4h^7FGbT^GX͛]TAhĖ={OЫ=Jȋa.΁5ct&Gz_ByKn:j$ R䪱4)+V+}@5t1U C.1db 6Lc pLioK77UcZrV$hS|wn<70g9Π]#bgSxTkDF@?b;_Y_+Jɿ||VNF^;HuXgi(6^24U:M&nְu#K Th-7P}K㲮LNG}.bKL1xvIkLFS*xa܏UNAp Hɐ,D$ur",=4sd%C?ZEQG3TS;rY b\%"CCyy` ytB12~L~8˽ZC\(bJzeaIy")uto܍Ѽ7 IQ DaU<}wmTw4DS^ҕAǡ{A YI481".3o1Tғ$|z՟߆ ,U ˮ .0ɂ$m)K|7 . f{/EK80ԣ@ܔx}]2S$P,Fd4@lp6. w}nEoIYl!W k jA'! EY&е`#:4wyE 6lZK43yvm@~zk͹Z1mt $IUbT}-㐺trdϣϣ,u,(0z3|yJږ ]~v⮺|aiFouڑ $᩷؛<'fED83WBg LCEI; QB\bB^QaN)sGk_B&aFd}0ЫJ 6IIMnTh|FM6؀s+/v]} o=޾9( %?"~o7eY=E$3J~,Kiٍo 7g qF?!jgr?.;Oti{F;zqFP]BCXSA4tog`3:E?1v5Ls6glT"n]ɐ}1Qg|3Lрam%^՛D"F]pPt{)& =鑢h5\EV6Eߩ.L;h{}kAm) X\ ۔Fj)TNr7"yk@)h|Uljk犲WsHf9~]G4NVUHrZȗjO0aZO/S ?hTf8 FVwBda3? K 7$w!/q41cM H/Y^"x{W2JEŧOy4Ζa>lHl+BWdzc\S߭K;6`n^^q-q&!E0y>Col%ibwPC/ԦAM JԤioDtԫ\&G|,5$DuҸBn6hü,--M Ξ< Ru[Չ`qP: 0S~d5a#1laqnoE-\&8n5I;F[L56<ώL_e;\xY>3l5 ss,F( wN> 7⨑w$]M|(3|B`zTkHLF*BC;zٴ~ 苽aHsV_:`x2*+@SF[#\G°puohb;G;;BҷaWzqTPcdΙ:uݛӀr7/l0T:4,[`!gSQ'cW5e}*ŋƼli0p 3ԯq0?A?wRnyAo_AH\ASj.5ndTB)%ɳ^C!Pܖl2ʕ-+Nݺx3B)}U iUA䖑q<¨NHym 'ߍ0nך">Ë8x=Y[Âe"5Hv|PU+oݛuA{\^r` h)cNCH;Fـ8ʛ# < xEf:c-|MRaZESAe߄/WͣLsXM_i7 s< 5 J =z3(L HXﺮhjF(g lX{Ȫgdž 7A6ERj"B-t5vnj Ī*(H#Ur(aK\jc %Ib<97wH%*= -TRӆj}2z_Sz͋($Rbu l1S~מH̲}pU3ab>yӐ?UKX/<uP@J>% ڽQNk(q BȆqRfռ7x'CPw&WB3޾<ךBD\z#{5!%&[^\Az}~Z mr?wX MYa?3Y"ڇ]' em ilϺj 틈6+Iff別@ez7c{4H9a Y)@L0, **md#@i_vbue`V{UDn593e-3\⃰qa>l~Q(rB^1&GBv:t?VK1%_p|+tr6*ki/)-MqF5\EBJlf{[fw{,!0 蹠`*ǥҭAq~VJQ#*}YX qf) ۠O/uS8ՋuZϔc|:O=E ^* ܉}“qΡ<2V?ȔLٷ#Bx?X_qq b { 4⦟j>:]Or*[Q"G' vj4r_kd| 0 @2;?3-➵ DHwc2~ ?s PzPX@2EuQuu iF^8yMHv7I` kw$iēo~`>QVe=1^ݐ+9B}K^g/s?E)I_"xbPrnuFRQ;𓮭-cj˹D@9g 'N;UOb&mӓR7Aiɮ,2)0q`]X" Oǀ\ʠ"oИ.=jHH7iKR<MeWNp9gP`%4q4T:]P;Ct+A]7 6{!VݱH5G4rq !]qTe׏>dH A0rW+^%M.&Amac}l5 m9?&G=w&]}EI#H "תX \ĕuG$y8td:W] 7ZAEvĬSHc%>ccBy54U~Z )̥eBI\-JDY LW}feމRLL9bw;Az6H'SPw塢Z0 7Ct$AqX- ĆżR\@1-б()b3/`ȯ/]&2Sޮ{hZVJp#в96JNM5^+ť]an=E,߲#l13(Ny;ě6DK,jdD݅n-J iiN|0YP#Qu;q:AU߽m0ΤUg󂠒 r!:@C\'ܵv l*_5 ҵ$jePȩgML5lore1]$Tz -M G NvaK' Zmb~0>C 6JM7۩PҒ1:73ͬk/0yG " Eꓒ6Lse96>V7)IǑaq4ntdWcptҶ/rmNƸ?gij8öݲ6^( +f"k.Ǽ.s$DUY/ّOEGg7ZF_+_i=UZ{=K׆.U>?O$fVuwgzRw%s7wvR, [U..ൿt$ԂS]E;Vh#J-?~S> lK $v!% 3."eOH:(A0AvqϞ^pGl,Ó![G7~CN}k@&';3/m8"h%%r.R۸3fIlLf&x:\~TSN׮ɣ?ᧃ<"/Ca󾊴48b$cquq1/˿6R3 sTS-!Xn_9(VevܨQi'Sɂ\4 حH1^K|dJBj7'I;X=]9;#М@To$,Eb҇2}g֦pJTtGI@C 518d&M+#,9'r86`X-f:}yfcjOTl ݙx5u4ޙ~Ո8$$)Z7~Q+T24&dsJ.o3i]AWe^kdh)yطAVr.Q͞ Y}B^I[V#udj]="}zV+:ԜXCB/8Fݠ f 5)*MBJ%dQ0_p}2\ 융W khLd"8/"э]N' gAeku@fgO]1 u/*!!@!ZUs,JQ6f1aè7XO%e!#_P, 9M 5is#W/1u5k.ߡoi0ϩ%T~`EfTǛE}*)uƾ%Ȑm- M1Z񰼃#WB@|g,^Ue!`zMΡ^e]ga`7=2&8,h]!#biıl $^= Kl7<3”%Dz`5Yf?[K^ Q^6'/U/t˜ ŝd,'S @U0WI93P?8d.(zK$kZ{5X$N?9qEo3Xho ?{TY0$}ZS^}#\-yZZD=ڠhxe+4+Taf/Y*l@m%Be}w[d(b(mx )N !R迌%W侥=ūJZu@-I1g[G16ƛgsBHzJ(1 †M_h9%(E+cQrTyv|ׄZe._E2O8 0$J G*NH>9Az )DǃzMQ s!-;oN.ueNd' `[^\B,V mtk|k$jJ,CXρM˄46g)fsrhUf vO}j:a;!0C1Aly k5/2%'f X;&?2T$_A،Kzz Y|n ٴNYG<ʝg0c74]$ݤ7>&2S}^{+I!4RܒEЗ DgM9k;y{&3q^/'g0 WǓPzS#FI?UJ_7 H߳tUvRNqIḇmgVbZR`lQ~`#w=*+6/P$#4_c@Y,i.ݝF$o*TCulYm:Y’PHϛNޓb2Ԁ 4ɗ&?!?@Cd1(~<65q|ݭX$q?FAK~[֬Ym/Z8 2֝DEV)uZ2GKTO:m_9[<<}EqZ Lqt^mA|홃cɈ{Ω֮rDt8=X.B e~u[khIlit2t {uwY7uKak9R#ʪzsGyWXh1—bde(^}6@e@FB|˫Ѳ^KMFڎqЊߺoX0>ޓf ZSlhڜUzmK ͇ CEDF=h^AH49 ۖ\9 ;و^ǿT>ۧ}JC 8:fFIкr*Sc.xƀe,zqtZ3Rk SpZKj(ޱ:xD"0"  }BLvy5i@bBCG(5iwݾx4_F3x7W K6^ǻW +w\zo8m д ߙPH ֍/diZXߠmxf)ۻW*I.FnĞ8aBvJV" " Jd0Itsv% %;9r ,!>lЅ UOP7Y;4~o[3Nl)ieڥp(z7:L[)ֈv.qGY? \Լ 5tNyJd#}φ6Ɔό\O'I^uaz +[B&ڛ ::NF!L]'۸#k}=@7Ս[D;]0~Úc+ I&3*9 p˄^׮ ꡩZ-)^dx@n:L`tSU/]i|Ȇc#'Ќ| `Ixm>IUb ֒8〠Wp[VTg[MK[":f]YwUYʬ;* O+6W`F\CZaAPph@t3wki)8g*fog<:lԦiz{SwO:*RR9糿lذ~wv_q|п 3j03tָKOOluyH z}F)}sz3y# ~{ kujdN$΀|:AƖB z2g#X&\؈36PgM¦^JdRCi͵}*!Pev+nq}PgtH+WV paOFD ,[I/iۯ/XL+{Y9 8F}~#N&C_*7':Q[{ iOUnY ) 'oBD&ʷ{>AT̒ sܘ2b+~6!lL#H@kd *Ӝ+q|0>'XR%<$1zC.Bca`{͟B4Ax,kq4/tRP;n:9y5v)zXCG,UrMl d\'9^/-G&rRq'Ցo{J:4`Bdg?0UtPLVMGL"7$5 |L@LzCBa0H󲩙9[?a Sj'ke}AD!/MnwjNr/nPa&HtI!a Y"%i/&me]fL4V+OC"Ɋ5r ?<}t$Iː6cIXX G[U(La0&yT󓜑A$]*\9.lVC|dh\~#a۲2HqqX@iZl&Q^aFrR @g q]'3>7Fwn+R TD]eM~8Kh<*gbTPCX!EH:svjʬN]coai#t VH"&21"_raDӍ-FPaqs5?y$bUz̟z'Gr"ފ;T6鍎zjz kf/'u5tRi-/ XP؊ ț9%[[QDƩz?"Z.RmqKIL#@b@=xe}Ał>G"rMzwO旾=\Q-=_$G$ʴ-f,PvWS%/tB?PD_ ևlH; $fcrFu0p&җ+{6:iTIL՚QcoKnP 6RY8)\: K m {1C,N|Lp,ދy@8b6~R<[Zml uP}{-I֔3R'П<ñvQ012sC L5]ff& # $)0An%fgB;Tpǂ6#<ጊË>iyXnFLUpQ31Dx>Uxp~Y!_(,K #$b)no:Ws{Zf0D?[3!CHMmX#.;~{pC9%R.N1ˎYt3K#n Zp_6eηƯ a!3̓\Vq!8 @f.0ks>s1N“ :3bq癩#u{G<i.D\)HXLtK蛾EoުXWm˕'FP#i 7p Y^e.Z1]󯔦p3T|Ʌb]Bv_*$Q6E3Ć~oWRMGJW3]Rꢣ؀D/.{x i@b5 ܸrֈDŽd̘)P& )Pc!2eH!1R!1k2Va&sOӶ}vM 4"ĸ-UwqW2H6EoP%D<Ly~ZB%?0VSR0g:J$;Ŋkt]5611Bd-qJE""]0u7^D2F/7{Ji4h%hwQ Ln~;쇺l"UVpi>0im(1s>Qf\_T"5fTͦ `XnQQn`Cu7Srg')/<17''5R㻉L[{ea0c 60wIVCYbeW#/:4 !.2]uzfnӈ5N!FNGBrn{`Urw*Y\WnoO&`q-ol;|lwنXN3S&AE")*|_uX:6i=sDl}B/( W8,$VgяrMe>q^ \+G)2FVĨa8{x[47`Ow?\VA4 ]h*s1~[K>N7:`=W ק\`3h2NHPtffϯֈP}28R P̓iJZRmfPvT]yu4ڋqZT_1>X\iЭ~xSFS蔟/6yc|Ag%FY*F !w䔊A}gZ\8odR!`ia&'d [w[51Գ"#t3hѸ،h?I~mg^~Zʣc4<(̂8`. [H5?OP]! 9#d&uMejbAFp7t2zbl *Jiţ[bn%!$鐂aϫي +?#!: {ݙn~ؚ(D7jvQJ"f,8>I*O@i~)zj;ipn?0Sn!sRaʿ8[&zM@{tJI-\0S^d =|Ic%lHi칕/%wF+衟^>h~k# øt $0E2Lԏu4 a{ 0w :e|*}ג3B#|,.j`棜t|c:>  5J{~80"ΏB~ KB0wnůڧ ŭbΤuK{ƋJrrwͭTdi96kC*w ݽ=@gSY( k\5htRع&*8awk3 xKM?uZsG irJN b0ӒdE ݽ407![#'IAʡ[KqC#"ҭ&1#s;hCOi\K 1n}`a5}zגaFå3HCŪu[.'ϜҮ󩖼?EbNvt;̗pjlL0ܪox{UpC!eeߑU@1 BO9l158Glj5r:Y{_D@,Rc"W j]S3T9R5 ;4 -)!8;Tˡ4W$2 ~q* ^bή[|u\ZPM:,WCjr*`ѡT8_bV1BJmdfT܀BY#} ~BM(R<V|о ?90+s,nm* hy7?GE89*tQ_&&~ 28|3Wͼj ay;,Y(86MG߁-H! ;dtXlp_;s+ BbZvFՊsJ Jfv60r\ ~[;3}? 7E Qڧ Rg1jsA)?[eNt.x%q ]k8"I<Ja[`ie;6Pʈ9Xje*>zN}[ ei3^> @oW x>bHMYۢB *ob (O 50.qk1֢9{'zF&]LG01ioX`O1*s7ݢLuQ9Mjt )cuȔN:<efXm0$$J6BJY8 c/ƣ%ZBZԇ ҩAe#(uEwBG$UnjʨTczxkHΖRs6OW{|^+ʭ vMYJ 1 "[6xqw70!#9YMxbNkZR`l.U&quMzw{,:cEh0(q5@gS"/{t;){5/NiZ$Tyy{uuT(`tx+䗭q#?/ɷ'46ިNe_~r5-q+%2bd31Ӵ&R Z(鞧( -뒠g{JV.VlGu˾<1՛sΙp|W^ {iO~h&яA3jf(>!O9''>*fJۦJёDUDt&QʧH_-j Ӵ6v2B_ǰ&.-SDlmM{VotwA8&Q>lh.U @qam1э]:[lN>IFi]wnMwiG7PAh9 M s6xV?n <"LAST|S ѿpݘn6 Sxȁ^ z+GFCդ&;Y%P NC!k>Mb(la?xS\ouEt}s>FGShjEګ|c߭'=ϸmie*r04( /qLBy]6R ;;pYcY(ӗl icrGNBXV# 4{3*n<lpl,ʸ|W-?Q/QS5X>'j+%mV#8CD~$.%"gJM٨-iS5}5U&O uK`ܮ7 awbT\.ɓ Ϊ+7 !q"f@,ʔ ˔@D R~kīقHo)sCsz:P:0!kd1KR 7| {Q nHX؏5Cɵ&krUp@p&ksmS:BqJ)7&N/;%cO(&ZUbAڷJS1.󼉇dB$eH*GX^o2>L ZEK-̇p[D׀ qWoʹyoU4,7bPҳ.} ?*h;]m(-WQv=s.8&16eջԲ'h"*JA=;9 Б`fٌtS4t k)-q Ѐhy"zX# toMIaAl3+s"B!d^<.HAC'*oDg/m^T9'?@t2svæ;'{OtGOsL)w1~ ) ]NriOʬS* &9Lo*ഭmѭv+Q^iћ aIq#J \nQ֨JЕ . {g YE2*tsQ:gpL0 jBz_w޶ȝ>ݻz?I4_|fZ"dBR++L/71V'r?7 1uOvDf94eC1:Dht]t,1~9;AΖ3e ~h(CaC~q t > ) as{ *fǨiؓb"Y i̝xoJR., ^2]!b$2 ky `6}WZOp$a@f?V8n C}?{q}lq#=ebaZk,hhFcyC 9xvgdPGه^;C|H+iM#zzuԄsFCh[.bY@cw) vU6S65h.H0\ݯl[+LTΫ~+Ekc b ֭ ,jƃٯ=Y\wDžicʠ~K}pk%5Y 2_7uHćX=.y0sd!eꀙwhj\1QMy TH%CygZc2"r _#J6_Gkim,E[@'G̽͘" N1Q:ezk)F7޸ (m 9᨟w?>d1>[fRϹ#^5DZ;GWBVbaD,j5qC0TPe]C9\y *rLߥjD&N@6C^/۫B`TqA"x U>&π_V&Ory|$Q[EH(8DnF9QOX̉#*g݂Ia"wz% n˵  ORSME`DEh9#>L'o]nwu@Kȁ P$tlK4C|o/cJcR [-!YɎi1S65k4K"B;kU6H~[D~/1ك㟨VC ๅB&#;jMFIF (9e& Dbglz6rPB#h>ZwTT-rPN#+S&:+zz{dݛ'V'~\\!E0eJ#Đ]h"M~(;!1㋫ےs"Ch6<5)uw%E>J9unv+ /촩GքC $i病>!fJP;ϩ5[|Bs>/3)z %YL^xg^k|*>]b" ?osx-`;,;;X g>LF-sK'|J|1j^Y=&k#6Dl@8YLw.kܽ PTZʘe#ɀ{Vp|qi=cҖ6ߑT;滦͞L#c8{('ލ*pL16^ Qb|4K""XKVOnH;PqXZ^^rFV΁!4@0Hq@0NGϧ0xAm>A[?$KPn+Q]srvs35^mZ/b܊7"9<1n6TDhfZp`ID+$ЌvŴV5 Ht֝壢ijP܂cҶCkݥ^3 Jc9A_0$6Ö.N;fm $ 8f:ys) J@>\3&2DC P.jY (JDHȪr1YxzAOs- OG#Y-jv5"?Ze<; 5sTBDy7[6^HN 'Me//Uv0>C%1"l/k7A5?*Aܿ%zߌB(.}H&nd;[e$`SKӆi]e35]A+нiK73)H>?=TtfENslZ f!Z4FAIaadaJiՃ˧. AM| +[u^6Ü(_K3jo%eTW80EQJOO+ɟO>S(4 5a{w^-$›Z|uԓ%~Ѷ:}?NyhARţ 9v[,k'l 32 ]!rjyWP5jNȝc^!pՔ`ɿ4}Uq!5)nvc# [tֵy") o\_3&}RQUܻ0tR҈,Hcۂf/kRU^5yg{(x~NdܪjC}!olJ B7cTb5(*TKgѮt$9s M )`!jB3-6W!)$Cn7kLߥj.fqUeeu6 izk_d^w.>{Sn}G*/mvPSFr˴-ڰIM@ Lģҗ][Veφ1Ma`>)]6m Grߣtӛh`;~uCCB/`doT ܢzôК:ljGYaS*N]RY0C>luK$kLCels({tڬsdE8 O*!k~=qF\'X,\ɞ T{tPϑOM[ 7&`fd>UKV`jJ3TO00j WTAd0yNj(䧥>br:*5b7GT $D|D _[SAgYo$jrkm- Z]#V41"$s{^]NT-h^&cfמ~$|V=Ä*ڬ݇sN#)%j-AR:Q\_J=N)wBe;C"1Mte܌H>sU 何+[uX- Z lx]m^j`0GfI20 Mhf;?"Dceꡜ/xsڵPڭb\#Bc d{P~nAt+yv`(&oU<4 R>GJIx;X)c[|] ^"6PN Uqfk&͉TNvq <]abj +Mq'JyTl~J}FNc=Q/Y vG RMș";h11$t!y3Ͼi7g0;T>^v8vؒL'=@^ Hdy&wWa%0>mu(B?xҤy\|*?,0:X 'N9 !jG; 6sdXbO}nʿT{A?jaPϡsCjW8& 'mw+}H✕izxP]C}bv/B 35g 1R72ϹP,$6C59D1#dr&(4,ߠ97'sEJ[eՒzEb?BO*grkDsw бck^d1s< !E2:DZ"^lZΒ/8dC!M̜l1bJ3J2D)S9Ie]eBeɸ5|n_ww88 nY.8Q hnQYuKU dJ2߸϶ TG"@'OH9;Y-B=}(-d 5clu" M3~3v <+` =Q*w8Bdw%_rP<ifMcCK"F?%@t9 fv15j2:GgriN6Aӗkɵ 1əvwI ӆxѮ4]t 0MK%֯Zᛄ+(r$ͥ29_ F~"CR #cʌ%RrO\lG̗vq~aUod : c7`&gU߮U <ڼN3 ; El2TVP _R v}pBS8 `j/I |'B5 $泈67.˝wk-`yˠ䵃pT-NL$~A1& uH}2'8yTeO Р߆tL#] raRKR8VdDomHt#QM#kq3*PZ ٪ae}MlSM mRf@5ƯЎTk>K/4}P<~ElV2@ 5]SB wd:Oy TCde!`e)LUѱ?1q= ޫi(,UI^1/ƨd*GfvVT08Jx"`t_9T6 C/!|x $˜^ [<۽"w4LIQGG}5h!fLCh )ۘ )<0ߊ"ϒMm!65Øj?#8c:#- ~OɦYa}gTD(m`&w.NPČ![Fӎ?H j{Q&1]#*iN uϼ^f"x̽;yA2N̺?vPo+m lmrV>CE[ BȈ=9TCߏaIJCK}?pN%imѠcS#c#Lm&_SgkwXt}jkaeC&$nGd?Y5zV/ϦZ=M_sB~8%L) R}F}rM ׶_8K Ns2P}4, ;^5^GyaB5[=rDZfKR-!BVRYQgD QS)d߅M.To 7PtzU7Jp5%314*R%Wܳ ;Mֳs`GX3-bwHe: ^pa J2wC lNFcA j7РfˊQ:zy==O~cQ{#U)d+Ɩt'4ebs~/낊zgoIFzYz1 eAZ a]ǁdԂjc^)~˼txN: !RE KY4}0=<j8)&vA* *+׾i֗{{:p!~-$m1:sn8]p~uBd.CWǼ\olrq2FʛXP p X+ӡWTXhs)?{3fQ],Rt\ؠ&~{@~0E?)>/ `yc^YCqz_5uΊttcGÜ'=J?^91 X'wم cbgouvN심3*/R;p#5a!zr| Еޕ{0m,Ff_U6@yi*9@1d`>Ci{,!(4"c- ۱ CV|ԅ ]ggkzsMINLF}ʤMA\maƶӮG|}~ưS{zc󿜋Π.HF1%"}]H..L~ǒIsOAjZZ`XVkU~Pc)+y3h \#42QYoduPAi%Ev8BqgEn=xC;84(hm/PYKL* e]/w"lՐ imhs{ص6FXcYmJQ:RP !R_TSJ:ʧ ~usI&ĺ[]ik?l{ed̮ӕ{BYTkp&~ bHKRPt4;$'fWaʠ\:U>\"uHɕ|LWV+Y~HE*r6A4?6 y,k갿u#EdT- WanWT*^pݺWEr˷i5)?OE~(R tPKN/ DU8 ('pzl2 w*0ϋ7=++,)4kqcM1҇eŅ8h-st/e-!r-R\Ynp+@Uٟ|ykjn4<8y7x^= Wކƨy ]%D,Q,PNlï۟A٥IQ긙nj =Iv,-zKʂ;R^b?+/ .vGpjŗCyewqs 44^$6~6B LeY)-Dbлxy? FpDrݝ?b@\XˣPf0mc ,B̞Uc#GwdҾw@L **Dp6*u)aI3wmQ=ˢ!ZhC %+:F/ CR{n8{)zns^&q 7<$CWhK NY@ (dwJѺGRȵ(&ڋFȕ]2%-75X z,01JG^-ndSqS$<s=:ދ],zƽr׺}1`ojRGd($jH>Q@N:l.l٘I!,O!%=zQ^!Nkgt-iRPjxL85Jˋ5r[ .HunFxd2^ŲB1dt(4N*uu1j=bsΉ7דhaz_ܳ3!ac+ƸVKW5ǠlR: ΪYFM#̰G̊$39^d1<̛> =rCSqCW2\0ݨV w ]Lh)CgB]$$˽?97|39$vuVHأse7~vţMD'z'.Q5r#`^"Y+[, Wj |m#Dar"rI qD9o6d>P 5vMZÅʯ< eKaQ$ Pm}: G:؆=zj$ch\Lfv]vVۜ#jcDwpA62TK\+٫5*|~ ?)V/~UJa{syfF*CS8= =F5v !K/W< Z^Llrx;5&Uc38LSF9MygHJB|~E.?Alc/~EwlH/8 >Q0&FA6/`dcc7PG(s딦|Ԯ`+@Qߨֿj nl;gE"{(wfL3ٓjc@أU#Bb^0G"wPeTf HWPW%/ԊbS|}Eu UTڱM^u,L AHҗF.kNW*t:лfd)붚GmJ%xnĢAJllz҈AWSzKGrr>*k¯?X^!`d(eªS)tؑVU }@HY9d:uri䃄wf*q?/C!Eɞ0/rD[ZJq!zx@USC*՘22%ZEE} &iؗjÙ6 ,yfMn $^K#;Mk $"o^$> H#oεZi ?%P"VH"gic M5WݎF9ƅ%8+5X'`K]!(yTN6߭3R'#bIOzUoAoE6ğ_AZ7$ ;]h sGGLG^tbQ)DGϞ]<7sٕD$WJU[;3 aS4%WA))6nXףW ӽkCF<-쑩tGeϕ Uʘ@LГ[fnȿzy̮h%sEH)P*E=6XŽɌ3lzG2~ް>cpZr~s }"r':O6427oBOu]n]5͹9z]'a'D.Sp쟵0oSqa/C3= PbA}eL&)WY>E?L=)i ^^>t JPNϏ +;N\*u6asj xQ|`Pv߰WtCdjUdԱRN~&[`π}l.ʪJ:,+2~fj*2qI2CrƁܧJV `QT8;}1|f,d mO!ca/N;\!OwZPx"kN!Mu+)'sQ?msx' gAUΈ;y$;dk#@H\Ɠ,qξdWaH;jw08ɱA{Ý!FZoX2MM.DB65\'{_KZ=i5_L:>UG9pvn߲ gB`.T< uD((lE`wiy0Cl1~^]k^tϬ yfO_prm}Tz4T k?"_ٱ6r>_Bojt5n :Y;(Go&2DƸz tUfe`/ t9 4狗HZ,?6-s_tϻ헻:=|8P+N\jq1z0F-XAo^H̢@* $9_$lnc*!PiPRq7b%X`{+zmU]WRV[ 'y(`*꘤0D-UU`m _ 3yMϋ3ꅞR1f7s!&os7` :9# FNV0c I2yޠItrHI+Dkzmaxחy><޾i'mݪeΐ`=RQ((갰4[e^lhĚu{rUJxfGnBfZο!ؙ'p_[c;c([MJ JD/908Λc;I CbZ%|)z/U AGDu-G-JO<ԙ7Ҵ" OGYWl,PסNIV3%@GƏJzBa%C89@Z< Rj~ϧ46=?'JyaN%(3-bC G.$]BqPoF6;S'DKƔ5Vyy&\\+Y & {,mPFthq<>5`nݝлu{ɿ۝i?ܲܤ(%8y?L`~A]dלwDi133}DQ\=-GM C ,g9۽:Ѥ" 6ߔ,ct{9m "V%KLBdvĭ g2()`` 2Md뼟禓]6ܛhpC"W!NmM +mŴȜC>e3JU0,Ta?k.} IdHjS:tUq֘-$O$Pi!,qo!m#7x ~г[Q%&W%p@xIXwC@g K vFy:#A0fCk `o_TrܭoB tHYӓFG{i|_ KVTqRg@c)R} VX\ks bvݨC2K}Ͱr+ \iN|:H Δ] Ta1wUjcmv ݆_MNo?Hb?lnHhݽ>|Q~"G֙:^e"xPfJH/\@,E1|Hzkw,X^`=y)r,ɀtv O`x|-۝hyܡӭl%4F`b9ixYH1njMCny2rf4]>?٬5!C3`p@ ݘ`VmuKB;y|MV(A$f19MRď[K 2N%Y $yϴM}ѩ7j0zUD='Px!GʓB Ɂ:x.k GfO[Z;R sg `냋`Lh%}|Q_pX :*nQޭq)BݑJ/ϓp׫ kLӉѐVȓKk\ jUpttB|GY0lSٿbڹq5eP X~T j~勫,lgmdx; /·d( vUmy%O4<^a%d}Su{i(_O/m~+Π7!  "0Ruvê9%uPZ٘g);¨HP=LKyB>!H09 MjIS@?>2Zg6yWk0Tt/u!X!Bg'\ḑi[\ojL/vnq=%S]_/3-ٿȸ.H7sʍU0H(£ C 殆#r `zѨvϑ ۑhHcwyfUC0n_2Ϻ{l'"9ך3bB*Q94\Dnna0T<uY̻iߓ?a0RDLHׯ wKJaD݁勺T+ҟ]]k$r-̂":'8vnmW}]MuWM$vdi54`] :p{#oU}a`+:_p*;E<ȸ R ҭwN1tf G?ĠzLbSQK0O-& A_wq{c;Ø܂'aQtHrzǩM+pdHAM˨nοadMn9N#9PI y*+6wm<5-Y+znƃa}!HxlGUVv6p(']4qRy%