libsamba-errors0-32bit-4.9.5+git.149.9593f64a5c3-lp151.1.3 >  A \~/=„GR,O~*Q4 1Rgr7xr^= }JʃTκ㪁~.cv$+Q7W尌4P^9ܷi}#$~_/4 u^h˖5궅(ۉSs}_ǖ>sB%8ogJw]UQԣ޹o6i}H`c|/%fR#Aun8jl|چHt&ҭj13d28a762d008044ab3b26a6f531595abb6cc66982828efd592f45535e60d70b401740d4af24f62c26d8929e17e5ebbae0a2e508@4\~/=„a!89Ұx{}*hPѠ 2ιՎO/eߔwa71[e=*9T5 Ӧ_fX $n{l-C/r4ni U^*AbW'/P)Ʀ43wB,;.WgӂbMBOx; UYe%-pufPZ١eMHQxMN&)#zeD&m@s9:3IVR7R$9P1%rE>p>Tl?T\d3 = [ '-4DH J L P  H x q (89`:>Q{GQHQIQXQYQ\Q]Q^RbRcRdS)eS.fS1lS3uSHvSLwSxSyS T TTTXClibsamba-errors0-32bit4.9.5+git.149.9593f64a5c3lp151.1.3Samba errors handling libraryThis subpackage contains libraries to handle and translate NT error codes.\(lamb09openSUSE Leap 15.1openSUSEGPL-3.0-or-laterhttps://bugs.opensuse.orgSystem/Librarieshttps://www.samba.org/linuxx86_64/sbin/ldconfig\(8358ae5bb941b88fb3ce5ec042f264ccdf9e55bae68afc70ea96d44164f8abcerootrootsamba-4.9.5+git.149.9593f64a5c3-lp151.1.3.src.rpmlibsamba-errors.so.1libsamba-errors.so.1(SAMBA_ERRORS_1)libsamba-errors0-32bitlibsamba-errors0-32bit(x86-32)@@@@@@@    /bin/shlibc.so.6libc.so.6(GLIBC_2.0)libc.so.6(GLIBC_2.1.3)libc.so.6(GLIBC_2.3.4)libc.so.6(GLIBC_2.4)libtalloc.so.2libtalloc.so.2(TALLOC_2.0.2)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-15.2-14.14.1\N\e\e\}@\o@\\\\\4\ @[[@[[%@[@[ @[[t[#@[[Q@[Q@[\[[[{[z@[r@[ @[WZZZZZZ`@Z@Z@ZZ@ZZ}@Z'Z@ZOZ@Z ,@Z@YY@Yo@Yo@Yo@Y@Y3YYu@Yg`Yf@Y7Y7Y, @Y"X:@X:@XXsX@X9@X@X@Xg@X,XƉX@XYXe@XX@X@X@XWXAb@X-W Wv@W$W;Wu@W#WW W@W~D@Wj}W_WYZ@WYZ@W=W(W!@WW@V3V3VV'@VՄ@VՄ@VVIV@V`Vl@V@V@V<@V<@V@VjV]VI@VG"@VG"@VG"@VG"@V(V'~@V V7@VBUYU@U@UUAUĝU@UU@Uy@UUrUq@UhTU_@USanpower David Mulder David Mulder David Disseldorp Samuel Cabrero David Mulder ddiss@suse.comnopower@suse.comJan Engelhardt David Mulder Samuel Cabrero Samuel Cabrero Samuel Cabrero dmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comSamuel Cabrero dmulder@suse.comSamuel Cabrero dmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./bin/sh4.9.5+git.149.9593f64a5c3-lp151.1.34.9.5+git.149.9593f64a5c3-lp151.1.3libsamba-errors.so.1/usr/lib/-fomit-frame-pointer -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Leap:15.1/standard/f8490f6d0334c3a4fa732b71fd01beb3-sambacpioxz5x86_64-suse-linuxELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, BuildID[sha1]=35550c0a8e1c25a2d16262bd061da801a601cb4f, stripped PPRRRRRRRutf-801cb335e9a1312d116d2e06f9b22c92891c1517f1e07c0160927373f5648d358? 7zXZ !t/a] crv9u>RoTdH:W 35ȷ  ˹ϚB&9R, H>^ؔ4mZGç5Jsj75BL~.8B5{ ˙'i&6`^gXg_bG@k (_0+|e+ D/S)t4S` ގN:v mw#Dsgu齠շj1G휥Ҟ_[iC^\eXfFH*L+Jޢ6P}h8lO #oj?,yByՠ kΏ+R{R2 Is0d!"C]?Я

Q(j^O28YН<ZZZFq4uث7%~$Oղ֔}r%3z?R[g h2 [67fW+)=jvgq\O%^QM6R}?~49 yy6FTWUz?=C.T OBDA >cw(nHLg]g(޶̕j j$_b>xG\Ds czrYp uz~!uI_FѝA7+qr«z2 DJJ>_ki}4ie7f\C(ʶ}?lU:_U⑼lqZk`M!s^fEoc}Xw% Z_mQ/G$@lct/3D7Bwrg׻AW2z1XH! vxBvj 0Ƨ[ZՂ"COl_(!Y]ҁU\x;i,@[i{j 4m3pWX*]`|8+ &gaBTcLS Y>VF`Q;.F8އ`"I܏6Y>߰4*h)<V,w>4B0"-r-Gۡ@",q uN.H+(&L< =)ha]N;+|<{pa9SȻk#|^ NqJo58 qRCp̍~qP}H8 pJ8 54<>{<7H2*M'^Ɩ;[ilS٤;iэA>S;T *I]NC:M {1\LWGܸLBQзf; tರY2J1r)^~?^GpS+Us'zHd_d7ۊ't$J+47%nಬ'b+J'.JJAD2am34vm `Y\!KL֪( c$ۚ4RX*p˝܍wKg;vm I@;C$k ɔlPPBEI(Qg^ˀ1U.->mMrKM3δ'=CeT@ %"ex^x2yT0 ]r[a ᱋6Hĸ~Ggoscj_Ino]<7V:omchPdp6nI'u(uֆihױYKd]MPNu]LQ! wZ6 ?L5픮Nm&QC2ѐHb#~ˣW"@qV601RqN[N 7f'a`jY9{_4IV?(w `cBZp,0\:sS nݹ5G2A*p#UL}=Kh~g8si͕8GĄBZu^ʧkVۯS^yձ@&u5 74[gb&놤|HV%cauٱX&*YxPC3>^K* iA*0w2pH4yymtd tUn<4gyB1(^fQ㓭`>\GA=#4^Ba}q3fzvicA$2bpsy#&l4OR홤4%;mV`[Q@ũma4KIQӅ]̥^JbwQ>xWY \ L6ː~L{b Uh r !LBG^pFp.%ULljۃ<Y:>2^" 56 &j΢6JJ Q[O˹SE9Yct]r2bF9)DnEpN}Bb0"^Iieˣ:**pUgW#Ӳa>?ga95Ű#~ `d~;uHk-!Ӄ_ز c0lQ4Mb?‡Q)`+ `fv𚽔%˅C{3y;mW;=>^$iS=@cRZWjKTg?)>L+^>؃vfUk+)JY,7l& 3 L7s0[Wqz1C8_\Y="UmMqq3&RNIQj&1Ƹ`HVWa]lt&bV& -O" N*b }TɢKKiNcg[xلapbuk1U*:T[C Yokj_y8^3:r5  #9?`EkUyp  jgE g~P%Ȗ ˜ "?.xkӄ];&N Ov T1jkv-Z[ ߝ)v5Vox}r`RFI x/%5\EU *4%[x60 |6:mw'V]^ ZTIA}D&2+ Ts) iYY\Ty|̎ P8"!6=VnzCNvCEJsoM!'bF"-d:@jYOoϒ ʻx[ _|PÆJJ/% 97-tAJw4 n4ߜ$~nOܺƐMByB#H7^_cJDW35,A5'|z{_guAm1xt*#ёi­ܻZ;EYmh<}gw;@T]Cd)HUҋO=B%,!S(7ލPB>kW3&Ęuّ}X e508]wsyWT@ڇ z!fXdTRވໆo4교AGB`ַcAK&JlfԨN|OB6,[^ Bn$އ]ef%[!.EEO/!Nj5d]B7 _>Amhu@(/d%oxr.(h,uJBMe3_cHN!iS+Ϋ2]˚Ns ecBQ5S~3m',ЍPuzRAMu Y ;i̥gԔwYA)lA@ xVbo(2K^hsDjXP¡I?xw7,DXMYxAڗpk5\h5*P}ר_mM,߬%ٯlzS9TsѸI$!٘_5.̡5t&~ 4bHz)Wh/m`55+5v8ănZ Ϲ|ڍH#V ۙXMlx'vp[ras;RŸz 9׆63nW+*|y֪fNB9/uE 26ϝLl-ER:; ;@x(ArxZVbgd -R51%m4Se{1'*pVzk+tRcru)X?coG(qxv̾ wax ШF .Doz)) iJxwDǼpt̗F CN${I2NU@R.7 ,7?أ65pF> +>l DZ쫣G#$>$/5heD{؛sN1(w(ĵ&mrpNH3ɿ-/gMO&S),JeMbܟR,Oe}~PBʬP8/ Jw[\GQk/#kU;$kU]ut{9Eu&Kޱ:NtſDg'Wסʊ$v:TѴ2zQa8>yst)?Ĵz*^)ϳ0iOOR$C=Ux9]1,fj+ 4|{wAi4hlպh͆iWV<0ymJ{oHm,LJ :?su^൬᭢B˝Al78K!K[6 s>R3(Dlf(Tj1<Fp}[_>u:μs>7{='jFƕ֒: 1U7`i\'BVԠV t`} (l=6hdx/*[~ x ҧ톁ϩD_4lC^bpw{N$!2]$Ƣ_\. *~C Z9@cm:Le[l064gR݀֬:<]ϲ >Ho/ s^yܹFoݱiNh2c:C]&.,7dxQI3 }|/\BrBrI9I5 UL6^ cÝ$9HkBkKx4xyth3)g_1ZVZ;?0q3v ~Z{7.%آ/[=1V%>և)0ޚ6 >ݞQ,Ql)\K9,A7c^^8 hD(d)2Unܳ.YD)xL=asO+ uJ.S(h%>ccA6stCo.3?|I%:1Lgtz72p5߰ui%D%`n*}Wt\JH#?dεf$Qtr Z̪l @~P2m@_pp@ׂ5(||ڕD5--DB-(wSa^ Fu&ʋkFpv}vhzXu<"@`7|8_>ڴ|7J " :2q,xp pPCZQ z}Cm[GB)O뻂ɚ}EO}0 S_2󣓆+ r#Չ Aȧ'[6 c(_ğ -: N`p;N<#N.7]sTTp~h2-NJ/'1~hd$b+ДLݎI'0*RjrQRN׳\uem?S-5˙b(4# aЍD;OF.lPhGkf2|#Lm2aN kAZKO:T"A|hn`_N_> t1mH#\aKe0ؗ'ML (l Ȼ ՛ *yޟ3DBΤ8,|2#POaX\G o\v-?X(,u+_)G*eOƅ4Ku-2ͫ78dBQtIyTaF%nW|\PFa|#Y&]\.zW6_h~7t8_I[GW-vB uPm:nRE Ul 0Iyed9mճAU @!RPF`#FW-4j bi*s?$"g$Oo '>뽡a/>5J!gn,yE;d,Q n ض="O#u9T7 :,}<׬'}|诧f9TM6V%S#̈́åC'cL36\39ủWJ4gtWE&λ~rRA}Bj}1D*kg0$s'`նկ#R"Ғ)KJ[DXAs vj]lG4M?'[km4 ! B0""9R DkΙagy 2#6gZ;ayn:cGuCz |U,*Bog,__<[\3^MəN W#W^:hz9dΒއȖCiwxRDU1/q~(\JЉ&2c'Vh/3b*L|~T ;8=s7FīU"B~ V8ʇJ,at }~Vh xs dء=[lԱN]9S?uѺ?7 J˽)ILSXX #nf1]Ű-pƀL<ZQI8 p9WGp\6 S誑&GnSluyإt˶^NF-ڹFiFWއ1W8E%`$png]+e gU;z3ʵ+5/gP@WngIYɟQv꿓NDSq*\h n_H>IOeJ50Q*֌I8]lG]NOGɆ.,`KC ˿R~֔1VPH-,XvnRkP ̂.U쫆gZBl*5QQm]apsi6—( }qXZ1Bի+{NUs1^`8:b"[\|*XMgX{eu&40b#~Z"τJ+:Zfޗ˱nU-MЇvR4śbbթ󩧈YHd3nToz+KgHh@FK޴2ʦ$WHypBS`A$h4r@(ܼ$Cu<(9L#]rEYbY6*=!|`Dm4៞闾0U ˮ']!M7A@XX,HZw[ ,v& 6@7BUڜ?"_1i'd/H wtKo,2x>V7|i-m+2#H&D_3߯C q0a8> q FzoS>,٢O>q @5NzQXp]O|M|lS S nX_Ay96"3I3>T؍0]AoViôzB8Nk=^\GԆrm:_c{d>_zKf*=^!wuuZVJA/-n.UE|-g8[9jGT=7n dc#UE:Bg>C[lyX9DL3$C!P?$0 ֔EmZ~)RG:rmv] L t }XBn'Jr:,E#̏0^WP[2`7ж|&L2]GAgNa3 Kv3R 7 cw#ATm Uq,hu&<~3$vlgXhU|LKIE TzT⍷@p!3f@Z o@O\DY;-XkW׫ǃfjC @RJR){nv}g2N`PceZPJd# T#՞uέdcdD(:̷lv!V,\WbjȼLTe&S`ץɟ!O_dB5B7 'Jd$!PZG 8&?2g_!X= ]o Jm$1S[UT>1(RwTJ~בwQb7qIvf¢38$co4m");;O#0}Bt)Ǵv >5 l \r ER΅g6Em82j3X *H \a{GG~x@q-d)= pFhDuh:u7ݡ-]&=i_43s#@ ~B `j zf)9~^-#zodjtb7ݑh> PsdKQ $t\hyWU2ԃ넮9<WpR'Fp˒O btȪ e-:}W[L\fÐtS~T•.K[> +"ZR^a !*  &I ov`hX;9XZܱvF]L4hƃJL'tg!Sf2eݢa.nh1pr`OF,^v/A+~Aq%KĘqJUpsnQIM(44#8hFz_RV;*Pd DR7 Cw3Ty!)| pRj6MK*]GANh-Mˠ/k,RR445.=aUq~y*z_R0?ﴆJikԴi"01c1'4MCF nR{HS_*` O$|dvbt>4m(8Bjˣ*m<~tprsXrtDG}-= iMb!m$qx^ o{ !Btjϣ(by}RB96:f2%no_Gj#|w L'0jeMsOk&Z/]2X' 0yS;lہ!',2Bflyߚd=g0Ae,#82fN5L<$NL]88Z< /an!Nyg`FhE_@i\Y/.`2}nGSDz~/tP{e"1u@`sTĀSѳL9N (3EO0hȰ*EnJ3y57GU*N%k#hHJη)G'46(f aWjϸm40nA> cGAA+pi&0xN&T'>H T~.?%Z W\ϫ"t}Hծ ^o[zB) bGL=fy?Fo dJUA̹.s>?/ҶK@dXObKD\q9DOK[uym5Sɪg#<ۉQnKp++nڶ/!❗*=Z ގxVpZA(xWCd` RGK7s sĆ^C$]wfw?5;sIֹ18Sŭ9^WBʪ53&eBJxq yBH@7u6"Dm',=aҜ).ck>l9x[2t1-?hl('sE0fn7/f 5]:!]3}+,4 dc^JL&8>rnj@<신E>u)-)ݕ5By }-f &IZxBwݼyMbh҆i(+[ n ϸ\B#4]Xo$ߥi=;= ʻ}H\11S}}|FR:k3R9a)K{}٣]ܶ-M^A ex;u85 `4qz7{'j0 61B~PAűI0La;b)pjσ@gs=H0xQ ỊL @"4ek{aR"ڡeB m1~5кvr1a<͹ $h"ئR@Esv2]\nm= W@}uv5.k\*G~9\?{GcG&ˎ}P0}39FkD;-` 9mM=U+1qd,= i EE9GiL* zlqF%k lg趜rDVE09ɈWFmŁoK~gV&:#ɛk{TNNX!ѓvt9<0b xj(m:V j#}Vzh,fTROnu5IxA\ >P)+Q>M-EP ͺ )'P[OKV1>H#3l3_q;Y61`T`j(>QFġ6u?c0(}4%e`g'oZ u,Z]&ϷkypLne9wz:"8!/=%CG6^Rf`}nib5\P $;ziaM'c1^ `BWq;/ŕ_<}[ gԈ>_n1TIkcUL . bY$Z^}C*Ba[2RV2 R)%O̩/9'%H8eGcIdmKgmo:r.A]!obwT6PiL]I"AkR$9+3BX@?V8B#P$55lEjJ>TYԤ2[`L7ʗuFh$}Soz26A=hgBv;B U_uaeq+,8pxy%lgn,-!OoV8 aDʭ*D -~"/;XF)d*I|KGE*" 7A9 ,`Wt >xMm"aN}VBiZ;glS ?s?YӹO9ao!:\ӅH= (mZ_.  [/O/MjN\Hx%{ߛ< ^r`j{^N c`(\%g0EOi/A5D7crNo! BC7պ J6v`y*{i =T~yaM*' E`8ОpcS7wӂދ\H>^nUA\6f*S^{^&$O:>5̽YSӲMZJM.N|BxF=ڍ|`أVBjAD$ݏ*cϕԽF}fĩmlbOht`>bšr#cGSK!29t{N!ahۧ!AbPjE?=ܨdRsyUBd8gx#O O!A Aak &DUR;`X)+z) 'T&WUrVe]y"] g[.6RYS WH1-@`>1! OdiU7p3SihMIulٰNYAw6tS5}n6JOr3@l(x("+l\A4r `]qkl#6} ,($ bWʷ|#wJƅj\p F E*>.S! u1щ5'~:v NJY` kĺ>Ci#Y ́+4|alzc`tMA}Qfy6!:A(MF%D,ƕ`(|q8(aEa:?+9"*žDDpV ?Y#*7IlZ>h_TDHy5K>Xh&=s `'CܡNGkY!"ӝ*;BCYc"gv%F:dզ}rNγAtM32FF hѿM@ zD_B05nbJ (cg*4"5vMmG&I wTL6w޺Iq35SW#%};ǚGL"XkqF ӏ7EsզN+N7 E4D[)a~mT f`g)fjb}hl 2Pp7A4M`XD,`2 h6F2#K6[,Jt lsWJj0Ux% P&)lcXКZ(VuCH<WqڣY܌aYu|etD_\.- mhCYhJ^M:=:0koW=}nG0&׻0(&G5~eۯ]kkS= giM<& oHDm&U[\ԚWj~> 'H<[զ{ɭ"4!d{t@#SĨl|1x> jRaKlZK,{&Czi2v8bG6ya|:vq3~XQ'?+{F3 .Gb^!{øipGHj:ޢMm|{SCy~8Л2]&MyReP_A"zX{hX> YƠDYnؚPזƉ Mm&OZWL@KGWԩm Xazr:3f;_Zn[W1,_(r0ͿͰɉejƔ*ǁ*PTOa.broMPS5">S5ߑg KLLŇU'+(M:Uj;?E%9=ѷ'Kl02`بw3éҚ/,3V<̽9g n_H-y@k S꠵g yeהA_`ti%7_M2 *|_ce e &NoF +VSoQGgQD1w:M.8 MTW7 f:?{N0}]{B)O~kL};= C';g`m{_{E)o2͌j˘0SLj䞀Sm !1.h;؂CLK8IpDI%&i:k#bpʭG3kY^8&R?L Zͧ# iblnu' &ږnuFf:yɢ2x {p` xAt} RcTDsP(Y?\/Y EG<ѾiќU@:zJ]?|m]D[Wo?ԊȊ1GRȟ̦#<ءD5Ke؈fG1@ wtDDCg?J^.e]J?v{h)I2wd*sj4;NJ0+u?*w(Û$+U%TH/y$b6u0LR HV!Hs$xI,V [?8wsJ@/l,ǃK1˿/c+ ʰϐ LĶ'{z$YWT" O9z_S@]Qgt@x/+k,YAɺFFe-@3GafDԟ$I>!I}[ >>bE+ ]@Æ]Tk"ٵW^ݣp-=M|.+1V&ՂX}f/Ֆ#F@Q5J`(Fo>r̢Kkj{\,>ءz|W#4梡L)(g-IJS4\J5Dvi`,5SԒFOaC ǣS yJZkf! ٥_:KXWGwqoHϧ-.|4px.-jz$>dŢE O7mqiAbrHGI&4 ND u}Cjr?^QL=C& X}+o!ˉo῝Aq'4Ź$}c&6\k %'鶍Z`v("θN"#݋p?QzHvt IilHY;~\oϊ%F,Q#R->DK""S@,Vm|6VF 3IP !PuI.N[@P:˅(il+Ayuȷvz6)EpG.F{dakbd34b>I]U^*M§KB]}O76u_8|ṩ.σ'=(qcx]^$6Xt/@ȕ(J<1VsW?Mi$#BXqY!Foi(܂WgKJ.7c+d2B?xy(ǂPTƴџ- 1l02ue0!=(3JtJwϠ3s:yΞuI pZ5&5tPmc( Bїߨ ]~~y܍p<)F+[4C \$㿶-^0$.۴sWb>SbPR>Xnhske~lwƬH!7F a08 xl$FC&LRfYhM8TP&7-:[$Ey6Fz\2f$3DW3._u\A<#?}} =QBo^ َ냐B[Ԟ޽BTp**xp(⧕)ǼUJBI_IQ{QKr/u'V͖D1ߌEA%rLG`r:T. h#$&9{pElY&zaMQ%5X1jvk-Rmj0df|TdxԢi n"Q^6mH1FۓM{\2.rlA1CGtqB zT`87'x2KOe ަ9`PsO' ^a/yۦjFcVRWD$+V_.6c ߵ͢*}Oݘs%899^a ,aO~o9ZܤJ>ǖ"A8a)uQ4z(-$sp*q\wû^R?Q6 C&s |89%f&*w!y_MC݌L杉9Z9@MfAp~ P%^*7^|-EދGd VGqPZRHڸuJRpv3gGJNNJi"Cqp8DȖ5𠲈[@EJE,%o^E(D})ӸWQ%*"C1Sd]hz߂퉧b)VJ ZfCN߫-Cqي$K{9{F دqeBK0' )BT?wHFw&E'*0Qcqy"O*m21x5&|,UD s9a!!rI&i|4x1>Sdqz:λ&gUQhj9Jc}<2{sqң|-J.Ztgbb5LmH8Cyp nldV;KZx. j[+H[ Òϸ)Zv*`|*#Q,:Ɛ9t_ɤ';F${rk„GdKOo!O%SkBrʅx"\@Aɶ] Zl,Dd<\!ϜLmu 7bINrAKi3=#hDQZ=;g'\!!Ґm*p OBݪ4pW~P%ڜ(kwe,ޝ,Y!q=ZU;  1 k[8h\6\ePXhmh%(&?TW=Y&@A,fό0JCu]k[y427&T&+K$_@f0bH'c[okdv]|c۸-/QYPM_KU 9;:VMR"놕+K[5 .햀Áx6tިꉄ!v'b=Tڀ>ESl#g5q9wIxc2PJLRT>w0,+-dOR#ʼBxx|iALޜ  PW, ^&2[g|g #?\^6UrQ[&=rJWc I)cf/N[grm > 3O |\-=T}IC 5QJ0?:v{|v`֩T~Q0Sڲ.Q؟~t5ii<#e#o&*JlEXXb&?#(/eR,VNȿ$GfIrcZI-H6|t,wa7j =FU3^rL'$e59gN#9Y隷L8<ƦmZ+PQzy&8]&pKWMaIh;W>!" ;+ MAQUe5LnLB$i `$!U7э?6[nҹ )] ʹ#g֮S&[|j7w/T{/܎.X b4U=3Dz5(s{ kM#TO{Jr;kGˋ43A<.eKgQ+rwAJj!f# L u'cI5H3DjXRH7AsJo၂F Oros6I!R.6i/NCXW ؑS`HX1>8$3ue3h문Đ4vO lI/EV."o 60ļ;6}X &sJPIfC edfRo?8SIL$HWNPy v YLhu(WTW|H fW W$,Ca+E|`~ǧ/$ewne3sL$!uf*EFCTqx*{{oNpbIn}S9'o9?莁+ƁAq eN) Д,~, ۺfI1ɅArkufhpymL+C5[r~~N: M!wcpVAKtySLYf`j|'N c |.qƀ %}=BVRl9LG Єׯ)~x>s`e^3iJ{NԽuyi>򌤆ݳ@- a(OlǑv;XW+o"#AWz2w>ꇚlJayK|O2ޥ\@F S#k _O0Ww6sؗ\R&эCg0ݧr"/:ࡾc-:um )*)g3M4gx5|Jv՟9}2hqk4Fksh?u¡$!7Wb}NjzniSNj b"4LE$UL :i3V uZ2WƬ$r6W8O&Dn;ȇŗ?4DRdM>Ě@?DL4*]E5\?@y(BHSK0Bv4[C`3ȃ9Mޒ?t69v-ھmS9MHrβ2]:o">@z Îu; i[=;G_*(8a! d\4#e2\yDPg^W#- lE 42w0dtHZh,, cM(ѹb ]ftT=aEt~fX'ts8_4PZP U}P/N\uk iBEqiL//︼?ɯ~`]/]IM+t1XlҔai7bc֫??a5j u}RpgVΦe9[c6#e\10reI9ȅYx}_d2,R14F;TL&i(+0<4#/*Ho7bj7bqBbn*9?pWnJ w!-~$*^eu6*XSG3JdPt 僶Q&eQڤ γ_}gXw0q{ >f %,aG44D&Dwt k4'+$Ҏɇh Rr:pӽq-G lmS&B$<ɺ+l , 2D- L';b3#]0%wRȫr=Ok_R9uj͆NV"o6Ɉ/y`7jE5u"yژ#qhj0enuyQ摱߆˻K:,h]%ngԓlMlLnpr/Ln`*Ӌa-zN2@5]j*Y뗗"kONa4p5әd\ 72 V-v4 K2$B%DWɒ>I+"kOW$yVHmP xxglOU鹆 ꪎed,Vdv{)"ۭYZivliY.g1I b\iN7}V'N%SRVi9wj£Ѽ lڬLƸz16<6q帣GRi`LEZ:p 6HGl 86~Ɏ*(VM ~DTE(SޕFI%F0.a&l8ExcgvGńCJ> ~ЪxSG2,24N2veɍ'"P9;`L2={tE#wꥋ9hLra`|MXhͤzNh}.Gx{|an#Oo"|U&26-ij"3&vMzVtij;ŸP Tˋ.*.G,1]Gta|_ed|hkjplSd؟S R{0)j8D y"+Ҟ]QWW#| ěMGgÂaY8 d](. ;Fa'@qn'˿s<.zV7 cx> E#[d/ds(VŸRXHut8Iǽָ bkiqa$^@Ͷ8F@Do&;ɷ H͌[^3S,=iXdE=wSp 7m๓Y#M݉CWh`g]Ӷ JY3՘j+ejBNiboYwM` ܸa7''M yR \nr8ơT^T.lMjŅ|8;6r*J%%.xHgTD'IaܭzP C(K~-] =eT"wAe : lĬ^tT=U.1(4Ǖ$AדI(9EHSօF4@҆ {+Q k6zP=))~?>٨`STW)֕dOL+Y66O;+&Oi֜zY%_[ RjkP9("o^k 藆=(|s`w2&x@~9Pv(I?~uZ`uI:nT?9R9IYIf먈@sFvG\Wu&݃OnGݬ!!2 @CcOn8u`L ةi\ˤg]b=Zww3ucM!LQKd :~y6*LĈ_kh;yY4$Ux# dQ3DP⣦jQ@ d) HHk"sD*\ H{Ǻ悾)X@`*3v\iKPe?>eJXޏ!| 45{0B|uEB% e{ća+lsO>OXxШiF 낫͓#)0;~I,Rp,f|G]v!j|qIf'$Mb,tz + 5`A8M>8_F_IwROm -ik]]]3FAtY'{I\xQgL/*/53ONV#_RJB@?-P,1rwh[ͪDmNlzz<m 0{vݝYهP8ĕ07iƙ-&6ć_ϷGnB=T-°%]&wǶ/S| tquشx)+*ԼcKsJK6S'ڑiEz: ]+sg;Ad4Q6X6^es͢3qCZ!Os,4YFW: DN1C\B~iT;^ko%3QۻysN3 @O3A*6mp]:8ˑBH*M^=wV_USO" DzF 8%H 9e:k2%iRO7Tu>^:ɜtw$åL [ ]g]ae┉{"^dv ݰ^nTܶW>9Mk(Niq$o-,jri@9ϛ3 [4R|P6Z2xO7dwbSxŎgQz2`cۗ{(1 hju88({u\s2 3 3p}~ދ(e{7:R/#,`Z$0+V@_36c6jH5|u`D%1E-|IW ߏh=c+@og^FaS1rb/ &+v4MKMֹ.ᮧH~|5q=B]ɉLYCMeB\סŲ--Rr)F}tދ&<뫼&5 ˗oԏ&xCf J#EV s?`3+RġK+a *VH*VP#  =Y_RP|Ktip;6nY(JiB`莟kOעC#:ȅIhSM2|q&0$|[EDρ0HVv?X>uMJ ~Ͱh=> r{)kC<~-#{qR՜9eb«|d)!.˸yC_4uT>xlgdאi_җSKM]$WH}X!2xQΌm{[8q,OnG*> 9m1rX=eÔɹV <T'O_6qFGFȊei-ӯ$hf uۄe/g; V@ʟ2I;$} a(Kgo;XDxpZҟ$TǺ! >Wkpp}4dZD1J$WXb;$!ӥ@ŧOS[)bE6(_ɑ i9ɗM*S5x{  \*uJx:wqlO]iIӔ>1ＣHLLb*kմ+  -m,Yxs(f4 *蠜 t:_ʭr#u|&CL:5f9+)?s0$&q*=t40qaLWֽG-{/'COӯVuQE5XXoI͸V(Žpp=W.܏vU{u'vZIXo9'h5L_Ich%8 BWe}`Ό[DL ̮]rKoSn@|-H$lsAbLw PK֨ :2,LWx ,5T$ٳ`0ȳ$0!yhwڪP&OB-5+ypPH(l mt<WL {t'h>Wmr,YZ zһ}iH*>}'Ÿ ]bƅG &8D5/@fsPf.FB,0B>>U%3lɡ=͹#,;R (g~[4{/m)d;Pr4kQY#*>O}3T/oPNǼ܆uq:V7u{ג 4,4FҺ7/ cf|]|3\vӛX3VOp-/K0<(S|j]п橙܍R@ B,fv5Pd[,Ryv6h{CRikbr4(GZ4pI\*]c%2ЃJKr.i}=ܾM4癉٤%Rmė(/F V I4s:.k.Ch814B,CgP.AK(CA'r7fw螣!EEQGPٌ4GA ~y=`0>q=mvnAv;T(.e>d1?'cAr0JDɿwIz2Ϡa{JayC){r0=cF A>40iMG[6g2d%\ pÒMȾ;˝/)1-*N3 vb[9"_B~zjtP) ¦KfXݓE6=n:!1gdJ=+X-u|ഛ*e-J8zG ^)SJkUqx[j4_H(/v(Qzk'E]Ud<`wy AO3"ad+LIŘxYLI{ywh~1rpfK.9@cThN*&,C֎e]T2jŠ\'wmIn堰 @:l\t)biO#j]E^Wsc[fWfݬqK:X].Wx:jk|vd*vDށBWV_FD"i6$S,m',\X:S{Z4;^肍YoZ5{<8W. j$T$ v45JB5N&&gPGOhҊ rxm/VCɋKY9w +8we$l^jʎ$]d NrFPgBSb`vD9a/ɣ3P B@.%j팝ܸ|?3L,@55-* 59Zii /oP#חS!cb~EHLdCmc?n"Ƕ[7&:y/2Ķ:N-c*l0.XKUD5KwFf׉{b-@Y\wWBHNW0?͕ >3#̠>Bj%,/ f11Ŧڰ nel?q(-H GAT+h[(މfZ3;UBUHS&Ŀ !1[&6+ék:mۧ-翏a[nq^Jp7(t0Akxׁб)jw"RNkUG5v06ncEšLSC''ĆV]~Os7%}RE{ Dt%nu>5iRBn%7*ID`?RE7 .*>{~qa.wx@E]ܤnl鱐T7jk˻7EO ^t|t";/zi.e*U aТF˯楋sUH_G| bmpUWaB2qe)(6Ѥ4Q)hy7eWEtBgg Ԋw=OАn\gHdӣ$i1r+=ΉDj_ RF3[ 'vA\}iuҰf5a*Xz=?J-fY3YSGHeI6h,Ϝq/C 1Tׄy|K{~?*3 B %f:>Y |49H>:Fؑ?@Ndve[vP6~0m:4fL!`IEK=TAALhqBƻv^-Bݲ8J_DkW1e{*VGJWҪ"y q¿"M|}SĿC `Zh"+K{;ƫБ8J9uas-߂5 JQÑal#WYi4(7{_p>:vDC-s H{~LSiӦ?heBwi.=:rZdɾhxi겪4)zRL1BcѶ*]ϐePipr,GmL^=6-hmI`aDƌ},@6r^?50.5MT#.2o9^JԥYxkNۏznt01h*<# w&ƢZxGjcq|uր0TM0׀k,xy9tǠޚfj{ v`~簞eh1ji mwp]D16{QVNɀƮ ﮠ&Ap/]A#- S`/;Ifv|=*eh:R^kb&EfSb̀Ȇ> Oab`.ƶs'ðK5 w%B}baF)zb{XH [@~8[[܀}96\𓐯&CȳyE=B<[[݈thad*-bd"]$-uCa0@%0U D̦ps㕳DvO}!n ]|Z ¥ƙkbcijn8q ^_Wħ/j%o;.3azJ|XY׻<U4Ha;*eͬ'\1&HʬZ&Vp؄&-7kN2K<1I>V^qm-PjoJXMաZ9U%Mޤ<ȡW\ɞtgj^ 9O+3$ ٯFJ_bPZڜ/fzo%pkSsUwW1k?lwFkڦv76~זɴ览] M27kƍ4|0zT\kd.9w16*X vKL |q}ԩ7]Xw[<ۺ8sV"KB=K|,V1':)lWb\ck~ضBOTo k͆V8vzֶ Rp+^(S3d :О-)3/qxc628T ІZmss:htǹaF .S&&ϛ"2cM/! $r-KReKK.*n<  ߫EҼL Fc/ͷbrnW?rt~BF`L5GPŸk[h.aqky"ceٯ]>vuP4hsAPR).55e<{.ŜcE*{S۳ p[`n3J훲R+P,YA.ka:B̙k1y4d\ A#/9Zq^xԌ^iPYbfg)DhN Y[Z&"YϺNCP.Nw"4s;%?od]"`otfyF15M&y"? ^zsEE艘Y-Fv~"eI D`= 𗍐mk[!Mϛ4Fñ™v z@tw\ܻ ՍaM}c?m=#SaJ)u.bh¡d!.h΃W()CeW>+ TI)H 5ﯺI8guՙ|)~We2:f3-| 8} UgxMveK<6^6#즕<+TWq/| @&kkx,wG47wcFӎܤ] }r U#ۊsLК(1w}91{Hq߃j-Rq^a8zVٱ=S'lm;&`r Ja8L\B2,[B~ -;ƢvdL[f7x 1Sn~-wҸ d.?߆cXjҼ⭳ufl@&`@X%`7T0&(,!d/(c{gY?]]*rnmtu(Rz|(/I<ҏ8E)sA뵂]y"Q4܊aNpiBs0y\[$0U/`v9b#>J;h4`{k7AF3 IBb  h{^~ 2R1EtH\̝v^m{XO ,CL^] .A3~dn=i jW+vWv!|ɘFW[Dh9ntX$(jLO$9"ykq{ט+=ie!^(ZZW}+0ww$9H i 91f$sA#^b LKyL4Č40ڋ9 -jf){y(px&3l4rf9֖1I! [:I頜a&aELb9^w=ݨ֑=;n.' KOBjE'z!Zl d'z"/`ڹ #o\Oˋ|PVP:  ~rgzzwy_7~+@)1̌FPnMtES ~4z<:X`ݲfCUI]Vij GȓTҸq?&tr~*z[>6bFWF+٫wdR1ǤHs/m휪BelXu*~ '.@+0i~Q/Yt"DVnHJ%u; <*^VuzmxLjDBQHO t~z)_A|L?%\aaMI+O(?.', ])lhRH*CO|F˥>nSsD[|.B7/#:Dmt]b1| ~p]7K'f6#[rUC} L.r MѰ})/oAqA:#ICq/aȟS7xUX6lEW>GҠB;>WSw 6.&W|ż[iZ~cǎ|MdrʭɁľjƞ*R7M|^l O{j&pfs:< zIIq./ \@*)_4ƮWȂ7*g!80spFKܙ,Xah1U>>]ok1r}hg-wɮuuOMPAͷp" YaܪXuSP3X>5V1 87iQWg SOqr+OCFuo6)DK-!# _FK<b5k}(G-΂I0IȀ.9px6Hw懤CA7g 6W1"e_+(:#ԢKZހ] oRMIҺY~&5eix?H0R$!A(TT=Xq !X&رi1¶XiVqdǎN4ww[Aso,>R8x~I"$Da:JO99ՑVRNA,BJc&dWTtxH2❇餵S :h~}D_ok!vH{ ї\ИLCՆkԇʋRg)gۃpѿ3x'9hVK鴷:vC1} NTbͱvKj_gޛS%Ha%N)Sdw33,i,GSSP">6vN=":=PBGI`p CV]9k0TxeXa"׶RF6ߥkyŵx=wOM Fx2ʖ+=KR녎:B)I֘/-^g =$=}7!{_ȍAYZ9C8T'3^'"Ja4%ݎ} F0cZ?Ze_D:,X'Ӥ٤90h]3?Z-5}2 ;K^HI]nnnٿ ^jaě?ӛƭz%mՏ4q&MMJhmM_hP`*kN9h() X%>h'fݑ y< ķO[DC;,5UN$4 gL`K# lNU rqژ-'U+l fnZEܣ*x]aqoe-}Enu-2]>ʢ˧rD8-7A|2MyhTػ^L .$8ķkDQ>nXQV?1=4"l$sljt̓\D3ԯE|6aP$* mJ9㪟fֆku:GLd#=֮IJ$315ԮnN0_Td4v+BZ:f|YKvkD(x , :8HǾF|][(.5ǁՌ&#(x\Ťv[PQjӌ00p[yϸ/5S9\ݩC"^Pb҆)567/T3#"kGBt K}rܓ'Ra„GtP)?^ݖjHR}EzDp%v+1"?c֑uy@ldo[3r6Z+6y6dJ e¥` 3Bᡞ7. "+ŝ/5 eP3MKi,[$I Ւ9I \NIꘙbзU5Mfe)S l‡ռjgfZ s`mOۧ` ㏐ ĠK@Ћig6j\Js8?jYPFݶ6>A Sׁb2g 7f8u'㏦$.2@F\J;Gȫsy?"Yew錓t =s_o/ FdP@Έ^,Xk94&S$sȺd Fu(H}@5UM;-6˜s"U {]ͥkhEb+Uِ"BeU%4HJ>.\pK#KoUzi$\z`$3uUMh]$wz5{jx)\"&VO4frTlP=3Qf{ ?V("{u ""tjBqm]q Y ߧakZ;頲f:7|EBSy,"xk0l) mFce$ l$#WOe-MX| Gjk4ʗp.M#ﳫ5HL0YTˑVl[="^KTUz0ؠtINJCu(H*g* @(㜽қ@g,[TOg-bnb6_n?[擴isN<^1J#!+ae9 OTЭB(DYHߛ6C3b uEqa>#q|˒Kla3kO"g ϻʄMWKm.8nO!Q[vmt}?/Wt[]Xٹur)Fo/Ʌz@Lb+Rߋ(&dsmxʳAܑƿ]^}aJ x>{*M5g![~~ed#T͚:h|x%HҲ lIf@.n?Ε]`ORG],Jl|.꺗St1~=?6Z<V{æu0rf ޟ}Ԣ/cHXp(ڢZak.%SG{?iNWϟ+r}8 rsnp}Lw_q_[97{LcJ,)YDi۾Z#CʬSe|3qn%%2lMז-uΐ*'~>c%6bmwnI _O1_5ޕ{rel՝3HoyOb @q+^hDž) 4X0ŗao]7̉=FA"Xlr%} =T2Isz=s2X8EWVG9ß]_Qj3 Kʹ4?s9]t5VQp`ьKBoMvZmk@Pk}ޒE%2St[ӛ݋ecbJ*F pycpd2Rle0%αGh $xݓҪoK;O:E|.dzϭ+."8Xo|ejoc?tyҨըEuŊLJ!~|׵R1M}]H-~v4Kgn?mB%Z>ir0~ ({z@O`)Z]I NSFfi6v.tY $3

_)/NRw1_/HfO5fpm;wT n$BО9߅"\RG]o{cᥩnx[A^ܰVa~q)vķq.r{A>@fJ3_OM^jWЖ oZC(pNd݃@)=%n7@8 QAR\4Nw"dJNO`Ħ7$o.RUhXGHm;NE qlJP R lŐ _DA>Y;.?Bp^⟆wLWt$ yY dR̾2Hd p.dEC f`C`ިI ]d{/EqLx[-xX&k}U5L: ޝ i <=LjC4c ̇4p4|<4"(Qnya֫y-$$Uц CQuBSk7]KEOS$0l :V-OT9qτԒZӻjk<hnHkZZqB={Cwdr htZ E0eP@8_f_z;9ҋ{/ƕceu_Б? >^laxmTC̱+6NYTEͩf ֑t=Bfb۪;d[pic9(DCc(;k!&G8 laV&e߉Ld_Qɳ%cP1̌ JE]aM4?E=[ хڻMrW49׸2RG2 x~FTT};=r9'mݍ`/~zE,o rk皺s?JbXc{I =|((ɫhiX4wt+G}U#ɯPղ&p{1P>4͑ nKkfT`|DA[Vk0 nIm tŭcnN<Ѱw|ǧ5j5XW=AQqa8OPMcTwSl;r8@bX.0T?$}:!ncqOL]ӂ;B}깊p>UT۞58ndyYl>;T‰Y\M]?dÚ7??%8hYcOYzW2 mkRH~?3eM͓?Bb݋r5H`]/ŖY{@HصbT: rE5s֝$Yɵvv6T+7!1`ēJU~{jw;ʹD8VNˇ XڡWu~ 1;Й·8at::!ǰt$Hiv^;sVTؠmjPxkOhb5$l )O0%sHsxQ93e3w^W2 V E?/&nUwF36, ƚM2u;:dd]R\,EFEIap`r(Y;Ej?o13.q#bfm]eU5粇Q稹oD|1' ntZ:o~yl~ 3&kcڽ1I`@dLdCF䚸/vS11D7Y ^]E-"f >dtfwMlYw/[@ QASvɅW$mch/hQޥʩzMpc_7 +@|9 N끼jS\8\S.elp4KAi[brtJ6$lfqIH],)jCԔ 'YbpccgSP #HZQ?.0 ėQ*٠ٱ<ϞX$T4˶N|p$#YhO"~dH U*d0@))Ip'Z^[_Hφdc9D[v+w'+'\RZ&(<7%49NyVp1-_yF4w4)-!%^Ѱ<F~C0is0 `<9 pA*r|E[,CSIi7GKB>]|7q-4Ak|:/ffb0 \H37%,'Q)R؃Bt6{> ZfpSU_Zgo x7IIĜtᮋLruҖN(rs4jkwU քe|IUByN)ʷ^xHgqm e%.^BJNcp Ǣ=6_޿"T漷_;B&&ja&pkν@q:ˈK)a#?[TOp+m0Ƿ$*X.9C}"i:s=nQ*b>*Z^n43|9+k]BeZ1pB&R* Ѓ`r-x) B{;q*kЫ{д5jΩ͉c++0L'` Wűjif]mxP}Ay號hFĶ=-*q]dc4^8@*Oh9 SD!p.C!ě," v_σ}֫ˣ{q/S{;\tCK=}`(F䠄5K?ޘ\H?]-/,uѻqGY[ hR+T[+^w4&FQߑfa 7%w ;p\} \s]!Q-I#2?7..bRH>#m;nNljVNikLVcm AX3TvAO9me[G439f 71՗}]KGmH^ uz4eG3|d s5B7Iˑzy0KbQ; bֈs 9a1Bi$>sm7C7||ʈ6T >b(Z/n_qZF&l;*ǿ>O!M.^Cd,U ̘n+ۣ}o>'ߖm7,{yw4qjeZdTC"M:KSc\2rdl3ux?>Vib \obVχr`hɲ\֒cs/X _/Nc]$,W8'3*Zd1h;?).<i?Wp.O>[ 4DZ[mvmoy?eBCJA#Ɓ`;a<}-ec7 N{@ׇAq3uFJu%&,0L}I ~=9:Yp8@ț]NK jZA!Q PTnRMktUf鮱RwfDlUi7tU7y7Lvpo*7oWi3!K,q8JzC2Ӂ 0*M(goȡsJ:X lT@g1 71Hۛg 88ݨ{+/DWtnn!.qip(cnY|>rc$D25Rȏ^= V1#@Y}aI%qyЙЃfʼ2R@',@z⴫jٶVPņn6[<^@\E0uېF sV7`/3 H>߫Ï8_Cc8Pe󖒌ky60}i5e/"˯&t-6XeB.8:JXչ %@1z^S8<->C_4aDWY=g=SΛ[=)Kp8|!G"v {" {p=1- ]JfݑNk x)CWW5b F#b3w3b_)B'Zi:Y*?E{!g+3jמBB54q۽؉iPZnJ[|R96gFlSY*_7kYq=9HpMŬ3DwzP9,Zϳb'CGQR҃E FmJ8u6FC"4,~_g\+6>BB#H-Z9\CVv rKK*8-V|i Qxeڡ 1[* q+p2*1Db~cf`1c}0ꓬy%u}=;7^gE^!KhB&tנޅvƙ3]v3l!l?JQ&B0~3/^ףU=2\ag+5U.ubtH*|W?ìzD+ DH-wؙtXM洩Ҩ&&Z4=HŠGF QLܯrp]>(v{;VPaG'7"mȎCkiCjݾ'Qhyfej֚1&3QA<.pimgĞ@^Gx8Y ߻TUMbK8x\/#XpC٢yihVO;,6ӏA:* R@jgfH%r@Y&?ٞ$ai nwZN0bt; 9pƅuCMLZhid xG3ɍ4dXMrCEPHhXzb-3i* @L 7N/J23>:~`!F WM%GfYe<+QyB98S_(1P;-s+teUunuKLW(1R/(8JOF˭oT ]~u3 " m'%j4PzSg#éxJFE^d/^wID%k(wՇYXg[Wо6zjCv۩wu&q7-P)jXR]Dje&.nmUOk_ Ѽs2 -t $>L҉`-A5(~jilqĠ cy4S+j.'!5$Jvf%ڕҡ?O[G*M(2&a4)D𚍠#E,5t]=8E7&q8!NJϹ[nqot:.~ͼTynriN M+^]#RLUOiy+tjP30u= )08b0W:L xVV#p㡋BT n42>'c] دx'E\^,Tx G5 8ܓ ̹[^HFNb& B#׽ݚ pHuB-w>!6mOfi3.K mIY\P%11Է$WWIG! Gj%"urPSI\|jkp?.d9D-`e?L']|c|;)x2lΛXogfS︸\e# ?|X W" ^sORnw;t,~8$/S聃am烏SiO]ldS' eeMaJu\> @px0򬊂7]6˟ 1hD&}7LkPHfIfʫwCsFc\Q+Rjx=T: \F#Mڜzf[#TAJk'Q!{)ػPZ }q?jpRJ|ptAPTP;r4G(kEx|)Dy1Ayuڱz7jl+֞ChUV m^^n`Y6׉iս/(R r'L+ b$TxLܦFX2͓FrkIM)(2/;s٤g{yV@/V6W;ih\0218szNEJV>>#LԻ`IR,i0:2] +/.%s="z(l)WAPInӋEopbJw5,&x2Oq?N>(Llcrbj$LR3GYb[h?sӘ6?8͏zym6qEhjq5k#XU!7|\+b~/Yo{= )N2boj2"%=B:|/Pt& ycS0n`;F5wO7A8 5Kn4rehŦ >c. i8Cd:P}+/]Nj4Vn-6iw6a6Б/=EZqs3^,EU^^K)QhMj.b㥬2=sߑID߽+xvw426`eLb+H&VE kp8u:|Bظ)SY u x!(0d0lz΃"EY/3YQh u7~l6CL ,#ژ^dy81D[Ƞq:;.MN9HB~ΣǰH.Rl#Xn-Z6T)sKhYT7ݻQh,_&lXz.-~ygq{;8 qjsPZNxT5'#VMxb2 ExC8'J1±Zd|u@Ͻ)"x;tf}S41f>]C"\!09gD0\/]>Xj 9~6;Qj/Kf&v^l| &;\, ಈG3NeͿI {'@Ԃi\'4=;m_O/̉?S51 %Ai'q k1#d`׫ATS_Hj#D4 4U*G4ؠHb]U6-}uu]}oPP CD督I\I8y{pML|tk4So|>qۄ+>,Ǯ4ŪT rp;ݣ؛=ZU3ђ8Aj={;,3:sWЊPѨ$®QUƺ5MX [}8\LݫHCzx6^ >'|00G) D'TLFf.54`I G6]ff-#>-"FaQ  2X$BxUbdTcмUBA(q:[-B]Ęu[\WpID[>"vG%. =>`XUѭ *hZwA/wQ&MD'ڲILST*cJE|,'sxױs#)L[$D^^>@ IJ=Opw8[2g)t6+b:fdPq$so;[B̽ e.$귆/6Q IO{jYFeBmB<[;Y5M=^YuweZ;I-1p& i @ \TRr;̵̤٩pB`a#iksݕYlx`}|XۤS &[j.l2aL"GE$@ʂ3_Tg6#g̻369%9PW/nȅ59b>o~FJcGL{9uG݁1_”RF-;7-7fHn7.BJ՞qM aVg;0/9*v99Zj[t>OXmb'0r/egq߱є¬HmN^<,N>>KN, osg%/U w i@J0eؒQL54K 3M/O{}eJaLjÜ$7sjfkBOFBhe2/pؘ^egDPO{OJlC2K%QeP dO'@q#օ xh2E6;M{lq;Za{-ksQUC{Smkkqc'O(L&tRqT{|4oQBQ@߈ו/^ ќ'l) gþ Ayg6t%aO-}eO> N $qaXK ^bx mԒJ;-+=]=ݾr{ᔶT]V!K\4a]3wXHU#zꭏH׷RUu/X qqqZ5q>7 NG-i\=+Ti hλkbɻu1-N6F;b0 78»96`9v}Ӈ,HQ`uخh ىo=4U5-Z=)e-,2Q_`_cN1T0z/UGf2fpZ*2#LbLop)(d&u-f)E ͆Rc@u?ɥq7pi |~Q.blq:QUGY'r*肪9zN:p⛈fu44d͓@8 ІoQsomPtPBc[|%V/WDžB_k~w¨#A2alMuY~_نQu;rc%L5ʹ>3O_Mɔ~X g, 7 <1„ę|&fOҧ9έx8M DJI.v &Dlr ~LP}[WaG"!Kp356]Y;8/Qp!O4L:}9F_:'] 0s=SC-s${t۔O"|zI-t]݇|6gkd7S٪x!1̷RaBBUt'pi$€>*P+U' sLoV֠lDWq}@bẛ6Ȼ3N#`s]ua^<3"٢D Hq&|nƑ$[ʊҽgPB]&2s!!>V!T=]m'[}7Œ[:<[8Mӥ&d 6jc:cV5Y)E5z3Br F:~ψ}#P1p&cߊ]g̑H8a[Gs 3V ZQH5!fcb=Ll1'//6KyѬP雮ID!d+`]lL*ISAiE&aIJW(nqȠgF\R#v#+k>@|o]tFJ''iZ`MA<0KT%3'9R+2 u /P,h)ϏXHG` ; ZN2Abdl^ЋXƱ. M(GU(,%iOr6wLV-G}֖%J߳C@M{uozFkSk6Y 0udI8IzmO=~1&2>> ܂$ Y2чmn -B8@!k <4v\))2ztVL Z/ Wf-<`[sic GeS7dr|֕/j]`@\Ԍ.='oɴkvŔApt#fI:w~t}~; 6CWf0je$S`='BE ~$yo%5>}>NBev '9=SNII5QFD&e3NFn QbCޯ &1p4Va7=@E`^0.vϕv(֎G!NBb&p(=WYjٞ@3*ik1@W!<$Ӆ}ȬV6kWGu䬞l._070aF뎽_yZ#-0{ˈ`NfǫycM(Æ%8 |VE+'yuH!#,RY_e=EuLҖRWG+vJ랕=maCMnmvs@MmhW,֞|{5a8EOB).m۬C1F1HHTڹTvZh¹7Zp ^aLӾy+VG$&50dp# ugz !(0E˅H RSK WP7*VUyڊL_uݓ3l4PLFǣjme¤01R@U #"gE2 fx\$h\2I5;y.kό@H30<SHsǕe?wvA`AMrq.tu>t}' oNa@hnTPaU08bXΟ]hw4%1BaS}8ixY|߂l/K/QA,O8Yw~S _iZlxGIm3 K5@Ⱥ_z; $/K5I2Qb4 76Cbn6ߌ{HR;Cmܼ)-8AB ࠮H'\-ܥcqF1aUHA7v|0l@Ƭ`apN/OAַgFa1h3ER^Lob}ZŽJfkY岍P)y]#3ʓPe{IHH B۩%\R}2n083mP þ:-:Ԥe?u; T8`Ni]@"8pH_ozU28w6 q ٙi{[t4A"eF@I `6!ۄiZJ-&hV1H\YguFXD(iO\y-IC1>]"ĉ.x$0p ;,=/ N+xT& =eg(>@Da^G40ySpB`>چMzR  bï/I*|.M3:jZ=N A~DP|W3W2\bt,zv.ǥ| ˺'Y ֥rFؘt%eɊn">7`&.-~B{g`b${umK!J];ۙh& {GrFAdj߶ -bĻ%5u轴n̜ 9ǧmIϳwG)z5ٹWj\'mÛ(=q3j0Ӽ&.TM$"sgirpKnP傂UJ&آ+K2]$AzXסU=E :/|Q3/䅉G|Ym}-\TKRSqzqBc~VqR5AՇ"ŽOXW4$ǨFiN~Ƞ'Iͬ\nxm()z-$qB,9m^Kۗ,޽a"KtfOJ14BWx!4b$~8Ha^':g~T531&`? y[λDDyS(Be M=6UiFiٮQe\^v^݈R|13JKKpr/ǽܸԯK {2%q#g Y{2s< NCcȰ֟T0hB].3J4ۖBOjja`lq{sȥQq0 ӗ-iFjdmCbTAEE /JBFj" ӽ?j +}j^;mu*@O͋+.)=c ŅN I ?KaP f$#[ O"ٵx-!K{2*ۗOc⩾9o5>m ‚UD.U-Qʡfu9}!ӎZlPGO¼'Af|oլ}~FAE@rs )^EPQ(-1|؀g*r *g%>P= .x@]GH،ɝ0 }'"f7j ) όb܄膦LMEgj .DafMw@*|`X1lJf(C80p2g/Po(Ngblάi۰c=*AsOG|($#C0#ЮVEcD iyy|n}N=.U"f`ץ#9g Qkh9 agZ`l8 G&FК|Ӑ1[xG{omƣyh!E I}yl2f#r|.bؓuW򑋛ݠ6o++Q#542(e#'P|x;f~\ۀ!/t Al4r(o)&:a6OV1} F9|݅!-&nR$xu8ͻuMK15:Gy3`h\M vn[A˞e \U6G^<ʳo/t9Glumt8?.GJwOK)|QOs͏K0`k'TߠAfX 0\\}S9 *zצ'\ٖ.>cO=K՞X b.c ﰖVpGk8A2!Wi~|7?(Y5j~k֔W(1Rɔ؄ed95DÆm)ݕ `9Q,Spƿ9(`kZt`byJx <;q)ByeO Nل*wTC7;st6H2–>ES\w 飰 k0K,Z>M8X)luTc5?@' cRM^1ط**8M%tOzƃp*6?L h{E);üһ}#Q{IkVs-]kМL ԄkDa: U|ŕḨ#U1T!p7慴 nzI0EH7 M;W+>8'OBwa0AUqck1k$YGHDCھyZV+ebe! 7ǻ){'ҝsE}-9uy,#d8ٞMsT^ε(9z ahC&b1@#!!m&)V'VrpYUm63a!#(= /l1Zʉ~=CxpT?3(HVutRܨ| uMih>cYb{M)p O Bh QFj "g1{Ol=K}1hlA@hjLN5F) cClCQu|W35WeRR,Clx3HXC V̍7qRYu5tjW_ RγHT$F,wիMFyjLБV[IsԳ y͉KKEN#*"tc2M_.)#х՝x'^:5u.Q~EvXIuńǑ>ya|ϰ- $x:b0Ğ*' +&oNoB /!ȡdsVsONS8|!MGczoBR5<[ph(u yA> 0fr9:y~@:"~;Y<'BۉK}a mӣ~]g72FK)r1FaUk ֋4BH0]=[\o'zr <{)ulK$:݉AWG3:Z(qDi{,ҺOڴL,89! #AS4IWKy6sIpU:VmpFPZ,C2+|93Wq10]wpP=Ν|WˌY"\@ ,hJbC~:Eׅ-rD52une$ w3PEnP PP"TQnNGdYs⫉Eg ̓PBLJ#DA7q=, ZՍE0NNw#ȽRprhgncm,ODJ?&%{:Xr5`֗jDpT]SkM+Bx?Ts+(,ai ,vuȑq`^euE]Gu Ds \ `!}Ͼ "M%rpoj$ ElEڎFI;fU"=.˙*aܝ$PE"tٹ[v 4rd݈3wI荺Ƨ8ZͭN@)<Ī,:ȡE`wT]1.}/a >ܳVEe {GM0%D2#[9󊛑JӼ)[zucs8P㬒˩*Cֆ;4Qj*"ȗldc|N˙O3K6±y;c b wKҮ+ѐ>9Qt!gv2\bq#u|*9m~AA@*Ҽ6?rПYq D'xnh{5qTNפ 1ka {QSˁ% _Ǖ4Ȏf9 MX. >*Uc+b.9zVx*wS.-X]sa֡Ui)Ms+EwE^^#'ϗi d@Ba4$MWU&j)>P+SKD@|Cx=xkp0?>ÍIub8%o҇i`ю[˅cDĬ42]"ِ<:䩊^qjӟmzK-y}4KMJy!I|c[ՍUG G +\Ꟊy(p{rv+(?_4SezAE @=tQ1f([{yFZr,[>^{4%F"zA,BVzg2-Vdub7/f[XrKαe>DsX<GTqN|gk/dzR]y(,m sCEKu{ZfƲHaCe-?haߒ W HKoYmmB\A?@PeʑM1&|iVz3j\`K1V.(^f;`<@t;` SsZOŪ1ơ|t,$o1ɌkÒ:ZQPs W%-%ػw'FN5<':P[8$ 󬁶Ǔ8M|2 )N,|"IpA|ħa%T#mgU47[;6eX$ˊ?K;NĹ3 E%4(^(YֻO_G{ߞʞ5fϯuyq$5W5pL<٨V&S3IS$[Yγ ))'j 4ؼgV bh T\޽U43gWEȻ_`ڪ(UǣE${Bcqg;CxK4@&>w_sжEALo>% @x7E04-=ʔ\\ Xy6QmP*\=oWGqlxwQ<2}#ӞL mvʠr {&u-SQ"EZz/Wo?]uV!550 dJSa>gv拴 ;QS sn K`2!n^ EFc#.\0dYeo81gyKɲq*b SjYf4rGPxwOݨԽ9%AuhS7 Bۦ۟f 0*3 amu˂̢\\M̚pm27N+iw%xΰcUHoV.1x'@`|tm7mʠ0z\C*?QZ21#'N`M%)"LKKJƒ?ZrY#b 'k6߇8d4>+gG{JEC Vwq|oT%[BPBB Ьu5kUq=|;r b6C4^#M,6C uP0*5hsJgo"Æ{e1Z{әU,"˙A_I;K{AZ=ӝ9@@9ZE{@}{-Մz# hyLqo7k{uۍ)}g3'CJ%LdJA/MqbGV)E ;\tp9[F/^@ttou[ w$l4Z[L|ΕaWmE?X%ՑM_}Y@G~vblkjЎqZEk/RÀ]׮B1_l?5ϛs|, e{0V@偾2h`5F jwW@*kGc&+ 0_A^y40@qgSsv..,ʼsu=SpCw] {w/v"N#b9Gh)ZXxq ~m;_Z(/{{Aaa$9i_LkLv>A!h|Z'Fn+hOV;_} s X q C1~hFb7#}WٓU Q߶+G н?M|Ż^=8A E-= ͞ȆU!|zeKFƑIJc@&ȵ~7Gƾ&<SO hfc,Lڀ)ɠyJVFFHU "J)w fRùÛ`(qs!S ܉o:E90i f݌)K'hvr u\$у;d~VɅgcA݇J۵wA?Ër2 >kU7~<vz8traBMy^)7nuQ wgr7/ ^µIR.h;JZs|brZp!ڐ<ٞpL؀WSr_/AU9VAk4Rn"A d}]J}kQc0{tXw忈yПZo9ޝQe-\ ı"`rRg :zl,0\;l$kn!}Vy6u*Jf3N*+#O~k:"]%o/WX!mƒ},AÎ<:xzΉc>XC`H&iwn榖-?RWB`7%t5wH(WAFw32@_6/,A5Ù{EldR/<g7X5gh0$b'Lo$d3$N-`OѠmOhmX|6!MB1P Yv5⥱isDLo#!L{,H\-L6YH'P̃6nV7@~Bu.WqW"n T"FܼD!k}`;E鈩; e,*rДhe1F=TegɑqW]vF?Ï]k9Ur7} ~R%j!~YH]"=GW#E0 Bw7'v֠<1^8a<3? 1\\u1Z}1ן,<`eEAjۭ $vĽOL Th^mAg\?Ex?%M}&Օ'xi"vﯢu-:JmH,IRسNn_0=HC7uKk ˳[jF^ I: Oùfzw/l7w'ksgi4Nh׎EveLd.YuȞn#ʤFgw.0; jhf={kzwT{dFJ݊!x#wWp6pN9dzR{>m TώܔwkLȯUґjrهbX# iR7Kt`wbO/d+S&%'iQZ5M]]So ~ _I Z=c--cHasN*CItG%o] 01Tδ>}oSS|u &z9~DvıV~*l7?Љo@b͗9Q+-'G̒L> y1)ocN?͖.˪ftH{U6&s쳘1.ыcNJA$Qn~MPhGoid<$CɛEU/4o]fE4T7 6NJx,>ʠbcEAպ8O#ɹ#JP殹\!BI4fH=[f꺆y,;Τ+; shxS! >xP:,+ע,=x&4] Wk)՜ |7rqv $ؒElWbd-G%YYE=x"͉">T(z}I7tO#O'R&os XdZnOɅmvp BKQbEg+D o4hbE`|߈y-K˜apC>5՟2h.uGF+߶f38yn0oOu£4#H6&߳H~XB18XC~P2$ &-#V3k>!ChSM$*֗lrsRKtbߋ]\->\nB5WDa<ȗ(g)h!vL!Зb朗#-\&+>ށd= T _wPǏTFQNOv]]I&Um̗rMN=xߞ)`o8J7R|%S|yT`@ML#tg$SAr_7{cmBC4b"9oy*M/a6]sB ӲV,ЄAz{G%ʔS'7M9z`Y3YDeTJBv3UOzzCwh6noX?Osgn~c֟xL:iҽUR΂QWRE;qg;4CiK1#eYŎ!ep >B`^:r@6@(X̿~Ϊ`0zh;]jR~ڹa1C]MqcZ"u0\v7CRXԍGflykO&KK&w+C=ߨ{:_RYWO(eyThQ*tN\X)#nݏ"l,Ɣ+P$9{ft;1H\(o6*˹a%e«qR.ڧW˾('tDVg038ƯKe*JWA)̫nYhhRC0I?ޕ 89tYKe{Xͧ@M]' KM?u4&w7l>t!|xCȓ^\UW hdR^sY#jgRPi~ƭ xw.dwzC뛵Ȧk2( Y2 ؝ۇu&W]Lf+"z4k[S%1>21%Bd9;p?;h-ܐ0kdɬtI+.nnc<t)ÿ\-a_c_{fs&cܘ݌Åi|n8${l 1^ä9%J?Ȁ X8 7us<^]6\{qMD:Lsx8v2,d,VܖM پ_e]lbQ`N:dͲYV_%*G]o/ {13SUa{˸kkSA'`::3(z,]A]ȯNF:RefPu>HcPM1}`~Zs^&fpe< 8=\2J*$%3LžVl)~Te~1X|1%f2yoMYYУE]qbeE.E- Ya (Ό̃^6Ӻf1pːlCm5@Hr۔.xJ'Fi0BØc,-4W%aEk3ԎQѓ :)2-n6jyb&ݏ1™tL*c+CADS9 q_b^S] +B;\7*w+z"">S,6ˀ_ǖ:Zyj=sLXr2bzRCĹl=j;~18x`Ka-@E(.4=b6j\_^Y֎9p2<9aΗJޑTӪ|`g[ ޴eai;3inbn OLi;"4YN7 =M1Tu,-X\,DD6i0O-+iBU#[ ]V&sg `Yֹ=sh Uf u S$-{z@Mp\-8sH,7+kRAYJcUj/|qoOd6Z0{\ϩY)xߧ5?5K*x"!`BsO;݃] Yj<! UT B.͸4[*LܲYB707PuϫA[ª;(ILg1e,@g+v "zŷYxO{AXL,;:+eɉvo[(ყ)Z3y|,ے0. hv2}EJ?G6;B^y4%n+f֯`v@:<܎3$ кe)NijDntlНs@5\%! HkS[|f͸ߎE펜Sxo&\^GY 6Y#Tq{nR jiёjY7הkrf#&\Q0F xI m zh 趩LJb"`DGg"2vHX0F]r~&.M'ZmUR˸'$ ֻ&X>$p:魭d/!_TX^ٓJ.f5,?!: zg'E)Dz9Jtti')6ɔ]^94G@/فLrLykJg^:6l̊NP\b1j1 1FCj>%B[G"z,d&[&@.jqcx-k+0,_وDE GILt EٕPɒAU)o4h#1O{U+YX"vz|v7v~ f'7h@/6E]1OV dAGv7Zo :IZʖ.]mA,lY_sI"RchY(do I/, fܱ2E_&0Jŏu1`kE% A;csj+(ߎgMF*;<|0Gm< }v%hUbvYT./fK+T|EhW@7 d/, IV8r8|{ۨD=׳8ff6 kJĹCUok={C'gQk+[0>fS͞1-7v_VhE %}{$̉oIVX40.ɀa+ڠ:,Ű~&?CɁ"~ƬMuRHb1EneQ'#k W75LD9x=K%rvz+7qMYu/U=Ư%Q"'2W1yw]ԮfLeQLz놊)HjdȧM*TwOr@Ӥ̋xAɁBt)7d8e ?\.oq>[J"eqj悕yIi"_k1$ZVT'W3:~`0]T C7\5x]%b"XtzG:v28_E +w/rI^ xʶOOY3v6'iOCL5*}':YsL +*ǫbCN_Y+E0ݶ8 ?Q{J)Dr0.T$v\y^V(8\$i*a|Ocpi?Zzք`ƽF'GS"7~Y3DF$τ.Xh\U$Ӽ3km!"zͩ,QHxmEu+>8"#OXsKzC2:v(38g`篯qz@}jt VR.$(\}\$$Z hvlQ@!VP2nNWg/ ? G^+Ӑ(Q> \D#OILmw{:!0?WTHN+s>=&f ?xV! wt #y^Ѩ Nt-E vsGܸd@4{8 a BDpWbnQlVʚ(, r9]ƊD0?dNR.P>ǃb7Cu=n3,58e%qyKwξ¸zom:ʁ쾰]jxQѰ`!b:a3!˒\ #].)D2ơ2&1iF@Lu)\cDޯ>= P\ RQWrd&F DnkSzpI@.i*ٟ,j4wZ#Ň?aWKQu뽰Or?7dˉGߓ}HLKP]t9gVGvZ8P@FݰNHZ Y,"NJX+;hg4̪j'HAMM=#ѾGB-/ڶ,Bw9uS5misR#7^ hĖ,=iLvIPh2pdС d?5Q٦!$+vX )2lMgN2Lg<t.[VQ,%1p{#O}o_*ѿ ҍf \_C}L,{el VP1AO>@W+@4rE˻-9Qc0C `a+\= ('-y^Ra KxF>ՌsC>zPN+(d-u> j|(n2.I@2\V^mӀi ^.t_EmIgiGrN Ғ]2EMD=|8xxބ#r%>$9knhdI-iQYi$)~0+8HY=頹T80XdcWPH9zED/ђm M0;a>S~t8 e'!//HyuG$nᴈ8x P1@1 vOb)(Thނ3 )tf]+7(pK\P)AYU$(:v譠F{ zxWӱpaޤC\ ͐bIt>ca6-Ee`nQSzL$uX |]L uq:(*ܶV"#U&0TY3 6 ']ү,ŝop6uWT 󍲿!_Iv{f Eb;lͮ2{Artm)b7qi.MxձcCN^qћ֏㩘yUa487a߸#Nckr \`pfh]/)kLҤQ穚Y޸&xi.%lƂ|66ר芛"V&&]$BAGUw:gz-fƞEm`U:Ea>\. vf-GbhO]ل9 2+_na>%4M+M` tWՅW=PUAXadNb ֶ4qz #b.nHnt&Y> h/i"!Jw/IhpJ SSRiI"ѭ ՄU4{'1/םM&D3\.8Ի*j=@Ĉę}w5c5orlnHfLB:HzL≻Mho9Yw5\~p.qyjgN2 ,ZQ^,~}Fȝ"-c:.`q~^X;4(9m}K /y@ 3Jgt J,5w^&+GRens$t9_s=5EH-+N_J"9Zx,_BQ9j*٥y% w1WE<^|p1 o2Y9yڴlZSr%xzRY[:r?Ic-}D"M[%U+qys4 5)+l;XV"6 r5ȱ6jmpbNmt8g4ZUGA0x,7pX5H'm@6L'@ҰΠDpQM`BHk oL< q;vĀ_KۙZKzڞoplz;aĩvs|JZs*X][gge?ɲ qwQp5h eT%|1ifu3+92Bv %9wl:#]"kj~9uԎEI0z.}*"^?h+9Uvd%OYK9bvFjK̽N2Zؼ 3~~*h8)YqtmrSBFR%.F}ϳIB_vNuVY>m WF=p!FSTO{*aeX"ICE(.!"W=͎EV2ւ7lnt܍e,aOiALDMUkd_vVXkSŁ>8N [Y6f죭!R|'4G?dN{wrs >-q,\"VBMy5>QWmDY"S:I+ Pߥtܸ$J",>V_ IlQ_-p9ȓ]Re Bl-e\MoWxJ?1B}V8 4{? \T| ,CP|b_YP&#BNY+(~rݔ@HY6x&Y(VJ\T>dUǰzlGy2QeΉ^c t;bsj\E@ILp& ׄ 4/8pv ,JtæK>vOBooFUD2L Hs"Z7Jd(n G zex̱ ' SÇ!p 2ԫVTRmȪMo\(aA :ֻɛStaنQ@2(J#꾤p6\jD]yAv}kŧ6/Fm#RJ|3Kޘ' J;=O6otΛw2qٕ PyR/I=VXBֺ6Ԇ=Cw.w@c ZXУ<d&$c,YF|c՜ Ϸm+rt`^S1"k}O܍Ibdz٩!{ܿn_ 3$W6Ru ;DZz][~o,g–V>̷5J&pnuI>[@Tn`CoW(:SΉ:iYGo=8 c̱P@6=կa*:iVئ<¾sB].e$EF>n&K}hDs 6'NëZCͬT?)SL.>~.wjA&h3m:hWn$#~!nbu ?*!]F5䡌\4G\.?wL4da'n~kȚ\͋;i)aX|.'8-v+H5lo,)(/S:5Hc#zɈaGXu ,19,2A(tD-K*(4; 53Ȱd9ei-F`r[P튖#pFD. ^HE<-Җiw"+1#:/zݧ4OXÊ5O uunJ?wfJ 0Jʈ6NX!]dw<^Y4s2j\*Ð="e6W<ݗz72E9P+bJ5d/~s%li9+r?jhQ8%e" w X m) +~(8#dK= j"@De[yμaZ_n{}J jHj)`3x*9S}вY"H-lT 8~bs`oqlyS1x]Urjh/v su2bK^U`=rOX}aR!]nو }6.`:^%"TcH:!Ws^XrkLzdF5䌭"*[)*9@i?deǀY gC{upAB؉VⶹMA[*|JJUni Ba KL%$涻e )_@볱.Y'=\΄P-˙co'hR8l3#7tz|)}kO/p~^ }(͍8HjM~ ]@Ǜ#@#8;z#7*) cd*#W׍P.J4&xpPзGlX8:ڥlRU$1 -vͬă*lUܟgR? X ;E[bDOP`X&{&Y?[Y$yusm] P+*!rs G"U*,P(=s/VO.lx{_wfMCt mKakO0vBOC9Q ET<}@kC;:F }P+Tfsr嶣)i2yvɜB8g^(/r&Yy m@_md>f=ݼ|x<ϵ5|]S{v {ל3B0B7וK$hEHbշ|~^ODQ=znjiHOA˺UOv_MuH*oEiTfrѴyb)է#؍ޤ}V>p_MLW>U/4,%HxxE"~7b@JЃ:M(uPm[ j`-KV5އ܀_tTKq,Xݸzݍ+C{\엑} L4/n:b]Pf.b1ݰ-6?ĭuFm݋/nld͌ףЫ~ M԰eB=ܿ֫̕;W#$z ԞcP+/4~xxu!4,j  4^FJMAB?(ԟʉ(^ uݰEљkp;Kn98N1x" 9߻U;{D8OIfTo ~>2I)Hu1 vS:%!`Yu~m8̲ uJ g(?VàT4"|-[]kFb~?nmd8lզ^,6u,3>2Z_b7lOL ؽg%awLRX``ۉ& !ty+%06 $lSMXqlR3/IKü#.R{YXlՉоh/?am[ҳkCI.+,ɰ#aPzz[Bf{2=ۏ#6t췇h`[a3&EwuĚLxYf <:yuDT7_O~#P."kHg W<_r 齒vXMz{R$QH"5T =7aI+0_+taBvv W҆/ !#=}MiYc#o؁n'7V'zG 6h"t]Z9*%'";uVW 7qkaIslPNЪ9Φ[r@XFzO,2Um:ʪTQw ߫AeFB?y@\ wAG>ŕxs3B%B0ALɴ~HFH!۳Wn+'ygԋFaIE~~TxU5#C2 vI-u\ϮX v7ǔ q @pDkKU[7vE%4.5 㚨F3F"5 d խE!I#;%ShS38 {c^nd޾Q q^,g_ ٮV. FNܴ8HJ=P aAWSRqYEzk =&5ޯ(G:.5()X$C @wOd u=/T)S4wwhH`IMHQ9S V# .#_[U\ 6 \B?詾CP~WcQg %LŮ0, <}NKi (d]tFPˮ$:Yu/O1xnN3VNfW4żE[JP(#gq 聾Bc {jMa<:p[ gEvPOG<2l>n6-Y2\Fk4W=Ӻ5ģQ0j;,EߗJ$yti œYYN(<DIK+n T{X@9sQRG w(f*h貸aaoQ#ڲ; J9$U#aϔ|ź XezK e{UlKUV 0 }p}FaatMWf"3O.sk|@ez`Ѧmq,R8?6zo\GA!ĵ|ӧLN[ỻ>`o "aoO,0Ɂ2Ĉ DUV@I'{GF~W_)v Z=NdqfO#toSPaN=@X1Ѩ>V+)Y]a.[3Q>%EH36Q3]cVH 79:gdX $^3s x2ga.qu yGl_:۲bg<6I^$0!lq0یRZ/vyJ"G`A}0*zY%`KSA3 kcJ=֪RX0B_ ydX&48|{e9)6) KNh;A^L썮:K s=I4v,Ȧr1UUmڛVuNʹ-^hU1'OH~{I<*}&ݏ[}9Fԫd 22A^%e 0|̸v["Bl Bf):UMl =JATV7do+DѬ^Ϯ] K=XT!j5Gģ}H DKh ԾRɗMoFjm4+y9@a^}bɺLzn{:ꇖ9bb כ2 "*h?j$?rN33 kzH0t7q98G[\sM4kLu\CLC&0?$#KvA"myRҷW3xq:S]`܅v^54!q'-CA 1+{T&4ej(6#Ut`}I|,A[ m)PG2}Hբ<nj}$V[GnT)DoLɻ=r, rA+L: 05:PDdDO oNPHu!ATo_G^eڑ?¹=1zeW(Ű 85_t&lXyo_[+Wd*'2%;FSYBZ}ѱ*=I<2}d9gcY)W:1)Sne2ujK=ls5?y3 .ɿ72gvݴs5עN{Zo g~/" aμ_K%]}~> Ba@QxqAs5`W]d#trVʯQ̔+8w5RjKmȃh)'g5vqEHIօR nSmPң>j>2/,`б񊗜)p1m o=c/pb qmk:`ټ_.eR@RLb ."\/lS?o|;{I]~cbTW 8pWݯbaJ u$RIiTOLnSTIo,pZˀk`r-i&iӮE nW4P˵=x>:}Hc!jtc.hp/˂kQUml}iVH4*W W_D*sݫ6׍gHqrT3OԿop[[@\ M0U;@~JT+!&ѧŦ7g!i?IcLwOFd W*q]?hrRƩ9D7Iϳ9q%X5-uBjzAHT29$PZplߎa,E`ƙQ]3:2&O}'zmy n.w{[XBD1U?^0R%- xdS`l֚\.0FߝS5vB~oH !*9-_1o*.|!Wy?5$r\ůo @Gpy:I%t\&3ſ啢X(G4P\iie*%% 1X|KM27B(wW(*urhb%k&p} Ctp5\¿tXD&a,7@Wb3R/[21SmRyY'̪A1?'KSP ud0_UIugvq&uu@kQ+`~3'VAUg%}m= ^Etӯآ㪕IcF~g<ދgAN7s7Bk MFz $VQCX &Ar ?[gҰ]Ij;Ws -B"huwRH}^ԕҵzz0*U܅1!<  H? 嫰TYzE5h;|TKTR _E}&3lCVGQ6G}e 1sYg;j]Á %Ym|KZZJ<aO$...C_Mce=aeD%2a8c<$E\[32okm}_4Uh(!-`vZqsET,>wP.^+a 9G­pGOcop! 3OstՈ7 'PB" =)m `cA[O Es鑞Ywa鷅zNT209BT`hfHnhb1Dy(7_=Hfzؤ-CaJwtBVo%/>K'̱ #$W4 w`-! ?qcqF|LJ(u(@HF &$)XF׹NLϩe1&|l]Hb(g_weǚZe۵0J*(IguR[ Ԧs]KMP-_bհ"N6&_g I!JhkŰ$YmBGb;mC nFJq|N5 C(\:bCQ}wq]NoeZ*\1فÁ}QoZ̈́]NpF٤ \]ɧ\`t҂E͒z(l(ǽ5E$ q|Y t/9 Z|Q 3/^)PB$\V.>5!Č=;isQt;vj,'OXtWs_G,5Uz@,u'Sax!i_ -'NcP({@RYoҋ[>7X* livT0>Eȹ7FKj<4Ѹ(k~5UZ_?FƏoLh !6LP^ O)&c6É[}Ol4(vN7sjyh#pqkB.YlV7ХcH'UajQ}.-&Tb1p8VapC]Cy݅d#=J]J恽c׽Pjam)>7C;.%P^bHH}E%D˕|){5J4F@\v{x.l=Γ["9ϼ;ӧ8ot,Tπ r wm2*$P=v)f<gM毦bBf#+%5}$xub PF~ʔkP32BkkGp$7۞`!:O:mTCZjiUjB$Ҏ2,UݡnI,rVtΘ"Cb1z}zW dP޶I^E.\ |1E&6b A$l9kC-%QO wE}) zį}Er3v#F:Odz@}eP%:DǹvsVjiH"'.؃)e=Z*BckH#H*蘗\؁n&c)1sBm@ue 2 ZPMܾw Cor4_E)"l[>PE:倣<+;W0 j-Y8A[m(+{([eB^w]{9 ԂnY}ByP=nDUwv]׎"٨uVt)o[ɃˆoE|m=(<nnJ Mm+/ Ͷ̙9Џ'sʞA_laMaV= Y.]n@xז|H*;q&/}mRLY/Bqr{ؖO73FS~> EA)rc\PiVKnkX1¨iZyw O9w!>!GZREk:Pq~?iaw6CW19rVbK8j`O3 $Q[8Ҁ!\zxCqE ?8{40=L9nvHE_eKh~m '䒟3K ]`$mAM[7f ΫclV^%hT.⓫U:,' t{Z;JQBTחs>|'~V:3b\ !_uh~[jW^%7n6 sTޫ ckd{^L{;4e"Ҍo2e灯a: 5]hohԎqZgQ.wk}OmNCs(43}%D`jg;FsUC65+??7]& /nwݙVl y7qE;.7*As;!%<#ej\*&Ʌ\*jⲇK֖e%<`}KW[)HH3,(%uP$殞@XT"I$ dX+{Ӿ#R:dwb'>UdQHEYF(LAaPڶ6 * ""^L/Ϲ{(J02흁޸P2l$F [3\LA~tGKbⵆ{9f15bGrJ!MOAd±H@v#*z͉;>g\ #Wo+W1Le0C?;.{Lz?{<‰_7NA.1dM(?Υ OFeVkx*Ų1yV;D '$]T_p?63y%gR{묧[:Vd3F2t N{5(7\ ̿eȠ bpRly҆ŅB?f+A ԲԳ:c 0 ~@7Y -x45z@h },ʳ6hr)@VMY4A,O$r_q)Imi|_ڻ! \LXuE +c(;u\&=?8?fX,ql?8r oBI]&U䗅AEP/zJ|7flǝHrd*ğvBLG_ׅ}s:X'Y$09c/_D~?_w8˒pOvfLKF~6s+X~gIFЗx̦)֟.[=ɹ 5(l^ɦbv1qѰWpDx󬓦PWZSt6*`a c-YCa@_%x8 l`Dڝ*.cet#-sqn&V.7 @&?Vhd)] Zɱۯ|iA6\'VGjŅ Ά?#] 4'l9~n:Cp=2sfy6kl;+j=aI)-.1'}}90xr(s_%W %^l{OÑ-g j|M3n֯%lTSaGȫB 5m)VUYc|0a!3ov[<.ib#v=yx:`o%G> GuȹYӋX!o֤]o+*,KoW8uT7x @`61phoF? "?#Y'%Ou_haVzB:xsE88b|ԁ+ۛ+UK3\$VMH,£j|v(qQ>NLB7z=$o y@ZY!LfX(ˍʼs%:އǞ=: Bq \YtF79 Izgy1dmjD%@q/ 9p&M2+NW;0YɞM{1HlwMTfp34\혣u\"Vh D7q An@W?B[S3B7Mĭ}g+yZp^qa+I1S3Pz%L7/M~g }ը"]y!sVT$Nf3y}mtH@FUX$K~|¹-<AfdzG+0⃾'Ğ/W<ٍ*KqZɉY(+<=@DՊ tjbSMUsᅦd \L{ &?V )kY zMBw/Xy-ؔvQc^,ZőyaʗEE[ׇI 1EjzeꬅmVPFgv=I0ɯ?ߨv"mY5,Ut뷚[܏Ifkĕ]ȓ '*'Ț-p5$0GhG'EƎޞ$)OO>EUF>3U'RܸM>sYv;-DYp~^J_axyjaX )їe0 54#^v6YN@"cKZge s*'-^p^KE1f, tif|!e`ć;9tҖ]*c^_D I|ll4Fp.Ui 2O'uT8?yfմX]op9&]-םtu+ťD*Dս+UZ~.7L4^V1k%:#w?qb7Ъȃ+JJAxV%M"TmPw3nf<my [JpG@c(;y՘FS*+DچϢ79=؁[S%ƆG0q%d! ?2p("RX6oR;0:2Ez) ʺ?CTg5l$J}D8 +6'?@b@FZCEڡeα C~hy줁nQ݌D) xp5^H ֝Eމ0}G,$bhM0p@QMxdLǗRChEK>tF}$'9"6! -{NonӍ0*|RZ^C|d)@mqHZ0CBy&I+3;E b!igLjf!cĠKOzB"]3Z75ۉ)HSI̥?^N 9ǚAlx9ImmDCTkNnlՐ;.(X؋9]ۨcHo.H[%'3@u_J g뱹|KDY@f^_^4:P6.j^7 r)3p n=hHn:[WC2nhoVIv2Dh .8qWa'1&d+HIN+3mϯ^[e>,yIZY fCN)3Ƴ^F"+69Qfܪڦ̲9@"p |Q?] vp完uu0b(QS1ņR\y_? P̆FbА,tGMixQ`+YS;3SGVKص|kDZjY#?]c\*O!vc'XP j&7'5|@IPpb8ge]dܓOL('6o\r9 i{TAmP@{!L)Ǡ%*}n&?Mm &Yfnҡ$-8]-ȢpHNjzIo7s48γF QzW'G}rv{p+(w3OܰA#gX6|<]A? 0c5~DϫE_(aL͙~rP {;G3Ȗ2`d|l^q̪o WdQ qFKD#%7>VF룋ޯt*2͛͊a֋ `a3V;{@C$}>+<ԢX[cQ| AQ MKiN3(8sp-[rRKMDYcF2],K9,rTd+`qS B|E0E`i'4UQd?v:P#!T9U H u =x=r_,n`WaVkJ1Ӥax ѕix)ҩTH.&#Onc -복WZK=J=Z^p񡖌#ȏP.Њ5 :qesIFTt5hU˘\.[^+FT ڪO1ÍŪ;-/GqV0S^ܶE*?_oE)Lt[[n|Ή@HwqI>MU׆< ^`"KnNY? ST+9yhw_a'~]R7ti=H3_mJKs)J96(:ks䰽fTSϴ;j,럲iNx(~r0ߚvdGiӍ,e+P\ϭÖXǚ^dӒj&-+a=hĩ#}{S3D!عyG֦RfOxF>ۡ[1#+plƧX6v6{f:& 148/9[bSgC-T?(GIm.,C%tjHeƷhU^攲F?SF$w.J:35,*L0q +yw<.uԾޟU =t)ԔH&Gg+M>Cdf,{՗׎#()tX ;z7SR {'#࣪W1Hj gNfވD; RFF53gD `dSEPBq =«9vX˓MuK>$Mz>cm[,hHҒ)s^SSRA,<%Z8mr3BO{05]xZcOg;S?1;'PkE`|DCa#Cdٱy^Ksz _$V7,W3AP"ziԑ Ⱥ6Pw|B?t-X;?Ӹͅ-sLk7sNyw!J}-*Ux<׷zbXGK?1&]Vf͸ (Yf%0/ĩN%jBZ%E#y cw A1曶"*l-  iL.#wޏ(ɉ/?iO֙37X8.O ͮ:^gSY"zC./d}^uS.׷Dv5sG Z=|cmfZ|a1R]#E0z*2y&l6݌$#9'۟W^]G0:PJ5PLwyes"v&t~`x0Wg}Dxc CjQaFM<I6HOJ3׮`jc$LZGOk #F{ث%}T#!}7u:cxoHN@m@e{ں`pD8>oYŻ]'9orl:7DNƨ* B-#lRveN$+W~pa]W^hɳ*=f=9XMoMedY˜u&vH.v q(!;?k(QwC&'wAB(gMRi:ܳ ׭LNb7Gҥ( ?;emXoa5pD6mG].9@^af5md-IQ(\^%EF(E<Ĉƴf9os c (Ab@?oS5 XnVT\57i֝Od؃4ad5E9{l7j7ΐ":w\}FĮ$&ϟDV2qhgĥq=bpM\=L_#.5}]ԊcgZ K 0|۸ p0 9[Z0iwK$;KPz?UC? C.[SuҾgE*AL(/1QϠ梃ŜQ^F?oJ.K-|}~pD&@mrϪ#Q@̀3YrAAh㶲;eg>E.0,"V;yVb7͇.WPzHUvHopͶB]dG#jR\|ϖxNN>~I*A^#RHcSC g~vEpDO)/ O_E)<6"UItir*J)|\ɂvh6+%CC4䶝iXcrP|d5+E!I/lEN/P|EŖ}p|bP)OACH|l㏔IJᨾ`Lg>im>hJ0Gӹ a܎d]t7br`u.䞪֑YkH3SPpog֟J]fl/yGjk#vzA m,ͅDezu gM&NoPm'eUx= ƠqΕU'>h\zRGȁwt+ .LfG alB0f\6͐&il \l=kUߔZ+y}z4X*߆w4GtY"o}ɧ8`=w1ʸhYqDUk$Rؑn8iXuEB;^ ^f)-B =2ַѼ(60/| c1"WeA@W"7q'2N^d 3cgJHFfT˶\R^wŷ2ݷFֽ%#1VK8CRf~:VKR",$xn ۾]e B-תiW.<-`Mѷ,;uG+F7xp6Ezd"`ŹҎt߱3[L6/!?t&9@L☫!b̯2"aۍf%= r8YnUߖm\XF+`ƍC̴ 4`qzd|22 ;^ rg1?Vdp [ s%vHn3lafDv36DKUu#ս3t_K~R< zv OZ";6'Tג$@#DO $ s(/.'B"9mO?')8wW5?YʇB5㢀ٯ~U "s<Њ7a,HfDwwX.B+}WVҬN6.+cٱ~x_-B%&UֹE"Z6d~{iH̱w>N%1eM 1EM&E"fKlC 5Zm]潨BBq.fU ~!9}ŖX b NDLxz+]_3+uĠySd#t/X2'el,zzkQkt ]bidz=ZM ͮA6ub}TJ`J]C0V(gOjG=ӵ]Λ*Yl#B_PI/ZI*:̮iڲPek[ZS!",?Y`v~OB$wK#)) TQTQg C 3e-i+wd (S{!3Oˣxm;<7\ 4Mts$q-$Lx}t ;d ["-dXh ɕɎ-Ͽ|^Ewk#HmD+-] d.}0H5^o@SN½k2mf3P?5d`<,G${,[D.kEw"/ŽݳM<5P d룬eͲ UL 3#H\4yA&.U@J5'@J%KCvSWϼH ˼z+]TeYR zg:&58X,-t 't^yqdy'Y9x nNG(oL;T)1⟋\FL V }Q@L]dK3O &T~($n3tdlxD L~Q~8̅#ݒ3T`t7Bun\m Zu\B~"p>9ZBA?Z/O<>e15|MsC7[8ń~R0L]K\sТgscrLQ^^Nw5ڄWs'a]y M |; 2k|z$NtޅSw B$;S/s@KeW@ C]d^wR^y">U=JQ53@r؃ F@6lQFҹj<}Y~L3E?"Ċ${? \Do車x:?f;KVķlw ,!=UXH=ȴ%,mڜa I~fݨ~9jC\}qzKovDF:. U/|&vRF^;=nqra$Ae? qX/949ҹe J83#0%LB{_@fs:z '}v6΂m$=; Nux"XR3zr"VE=mo2_a5G)c; 6fdыd; 2H"z[lӵ~!\V>ڝcm`I]]@kVMۋc$gD˵rA3*"\肫sr%vwCF%оDGmbi`w-E]sb,`(v)rznf d{@'RM-m9"3ݛg8-$L [-U`-pMtaJLMsO߄˄]{քƅPeǪEȏ|{}s (uioV3cRCїu)UpKő'X3f%6-NRA>07k6m,c&s舎33Mo2sr,jrH&?b `/ĺS,#)L>@0T;SiG+ k'ZUqK| % 9.(JdjmqJ%L{R rwR"~nnsCo M| QթFr r$qv*Mq o;P{7LWbVnDp'慪ZFH(1qvڱ'c.'C f@te_**W Fh WcC.cI ^l3臓C~m $]ܯg5T;6P>6sؐ%Rd<Њd )" =V'f&*VqQKntC&oykmv<^AO ixV(X14^G/[:oN_m+0-J|WIo]IkꍰW{g[<jooyVﯩ)pMIS2'.-!G"hBޥRk;ɹ) G3$DϽ^* dlxH vQm㇥mL˰]Rj^J+yY2.#Eۧq֛Md22p Ĩ_M@Km+w=1nVk4\L%I|/qYZu-Q@ ;Vf./JU)~;)N184y:kb&#M5w_AzzT3c[)MTmII+!m yn磜/PgpEp|Q/smψ}qwu6ayL8;S|_{ $[ymꈆī,!־.1bmLkKjtV[ZEpƂ{Ae^V`b9X63x Ie3dzq 5YR.g pKrHq?[x,&X[C3 GV9.97EI$W!+$ lj|ͪXY1^a@H /`"ʅ#ąE*`'d1OP7C~dTbɕcңPiDRz)A: , %f 4ʑBqmY ƗP&\` ™+x3S~KߍfMzh,Ε$AgmWk_$YΣm|qZQ0A3 kvS/;^Nj+JQI6hG#8q6Sn pLQN '얄Ma달hdղBQ88&}a NƞIGW${Z5dz1LJ+ `x![Ǖp$5X5~ A8e]i0&+;> f0d^R@ߎ1?&vy.aB,ϭ(6Bѽfw--fw!JhAgO3HB;kͻᖳ@C|YAa$gΏb 7] ",vbx9i*a{?t %UT-7%$gswivSU ʤnN55_Kc>]r#؆CԚ mu{@[D^[lV;d aKhhӸJ,Pj(&1Ȗ ,=zwsOFծ*wuՐ.>/ ;s(aSn  난o#4tzLExhTRV;̧_9~O /TQdc/ kх90oDIKXX͔h"bN"bWBڴ>^Yax G|-]+|D[$dc!z tF8]#06WM|'tuK\c~b"X"$=?wl",Kr8ZPzvd^jD ,3/| (ŦM`PWį<591;(,N][U ~tm]`J]P\xl(xAu :]D|n#<YȎR B՞ɚa EiVnw@74pGSFdWYؤlVbLO%]њ6ucsbzN|Qa'& rxjbxHYve6 &7 qٚ>G'JuPloאA|COԓo-src4%^(G I-Yi4X=ǧ<\֮;'fOUDzjm* A_ 05c]ɚc=Gݿt7Fr ɯ%HlfMSTL>P!TC;? SiǏ#Xh:x+߸0sO=53'Ә CTߔQ\$&עsІ߈[뼛$ @D8_ ZãഔP O)ngD4_S'*b"'pAtQϞW&2DZtknv%χֽwp*(>oо9rwc\_d7\b#{^ zP:g]B2 ^M@xg1kLxOG oD7&9%OrD*`KqS,?7r5̓FM yUm׵/0mfXHXJhki/Mh#Гсh/j3)%GmSb8cG;?Rh儻QCg7[XfH8t1Y6nHk8Lux*h:ۭXmfX5fRL'Oy)? 2.%N_J=|YK$+Gn~-A.z"&rbu{Y6bXꞿw $ =Bکۗ=xY+xV"&JQt.$8,o!h[~$om)@?^!\E.!Z SRU, x)~ caGœp^aUf6wk+ ɍ+Tʰdluhj~ u]4(T",5sp%J UM6:Ƣǖ/)@m{ KKkSCU5B]ؼb* 38O5uGq?tNd>˜|_۹~b(qЎɠ@ER x܈dIߺ?UVJ̗d:};Lde4М] 8A0eryq6[ǘ0#(z5{j q2OՌZW7d x2"EoE"t/.8$SGkkO<=N_3,ټd%zyN-x7-9HmEw,v?iIWp%!fxı' |Bm XJ3j_r9iD5&x 2Zk&g8Kտ {,ˤMջZyDf؀(!mؗ@mܺ'T? X(kZ?Nc@"guoL[$o '\u#EBQ) G,DB%2wxN%OSYxӍ*+8A؟rj5rqs[ }:IGQD1 xԃM'pR&qIXw~KsVߺ0E/O+$8p~L! J@j~g@4撋P[HؿVjXV"&?u2V/Ȉ}>Ns ؑ_ݲHbZ ˋlhȜcJI^f|ݮw>;kniMO>Zb ZSiS(`ӥUX~ ɐ̳`FŇl;X[gr073 E~[g4w2rc=/\iM%t jw0{c;mMXi(kKeE^МUŠ ie-^J )ׁ!-hUX꒣93㦍vP̣Aݠ]y)ȷ~3u$ߔ1m2E0>csvtQu †¿'4Cݢ6D7,9[#?$6e#Կ \j[*7Xο5p5\^ؤ>JQG۔tzzB?1wkS<T7f;X9L8@feP8c Wn8c'y["Ka~V3+0pҐt0N-Tjqpmhf=Lw@%uP'[]FK!+D\s!<HyuM#2/KӿY-<z8uuPw"bP |u65@7׽zlafeA_ ?¯Eu\2rj|-,3}A ]qI,bȍݔp6 j y `T}2N z/ 줎"'4)Š=p(fazE[I2brp D8,8"g5MuPy9y!b~]BGcrǘG5j6OZ)LU{۵"N>_06eUg[@d>i:1 K(~O𚪘/|E_5W)7>_uH'0}&2o#8HGHV}58&b1/t:g֡ N|0;-6JΦ~ڽ.DŽҁ+_Q9_DD>Pw1RW1x'XJ=O{xՃC_nwA{`ڦC3 wn4*⯊q9P$ )c] QN~Nۯ"xYZ+Q0!}AuM}2e>SWE[%CGl-!w,b(+Slww)W-cTls[lqX>|sh$k Ɏ3pZ~eX>$3m$9%rdw^ZnOh@=>NYyo.coͫڅɧ{/vPEУ3m)$N>MZ?MӃm\k=I-ȑ oi'2Ofdwc_6|lqgxe.K-xcԾP7#UzTzҤ| 0ac*r9F6Vit.m03UcV )҄:aKhcϘf[b0\s4cU`ݛeoiRP 0Oc&vY N3\ؠ+|oLwMtjWXrf 7[c= pjUeDݪ>`&vsf2tIC]\ep.v5ѽSٔæGUf0n5i_BhŽʴ|j LAɞe~h>Oşq[F}IX+ߒJH !6fM}{+̙D.)렬ey~ %l.< õ@ư3(;Njq+h$(~C{uQ?J(J%8s|s'L<;AхXTT]; -f=ې񆌛,97y$IFa iq%9}~dYi;lSyM4 -|W=majPkvn gWw fȣYN"FBKe"݃Q?~E"{\u0 ^"[#ՕlBX p,=8_{;WNNTf5q7Q"r6؆GXf)jUU($FIg\Uxw!,>GWSsG!_c\$"ߕl&WY|sy6}>bAꤟ;q MjipYJ\!x9D iM,HDRbdFEˣ|׵z~ά߱S>ESerP@7pB${ũm =TQbXufK5ls{A-d"=^L(qr٥Y`ip$q0|fޱzk_8{Mar-D@g}") ô}3ړb)S\nYI1 kAeN? i!8#ڲ4(vq[Rds1{:sxAVmoӧ)~e(n斠 5?.=E獙:XWD R(LR/*/.0 !??7r>X {[aa᢮bX`VT܈$r۱1A_&X;`t} 1֞7I_\]7'+:!s,]&)9Fc=/]JcJIJC}ƥBa9π1u$}OY'azYJ=2}̶$; tWv0Ϙ2?.ߊrWϡ8=ϊhgORT&O}Wcޖ޵K;ԕ̺7i2nsT=)͵&(vf%R܆F/G5Sl@sfaҫ7{#hON ģ"TC_Y2$]2ZQ|ED *RbR`{ .U a\C CQ|z4"m~KH;cGd;Ш_kpCؤK6%=HccFGYr>2ϰ1K)ytG[[;^ ^/AB!n _͛>&HrEIvfY,R93ߖv?2'88>|cp4 v>FW6ם3*!j'46v<} i%dRyx\-; -x qe.@S;я[R^8א~pRlE_/F54HWۙ2):wit 9[5R\) QU%@,soL5N,J_2SB.^%m:Љw=Už[{@\Rط$ANx8Z)D^RzoT*cw9?u:hiRϡ:G*ps Zcg ZsjL(t{|m ;1yݦ-]u` HVjL \iz xOH=dY?>홻;u7d ԃ]o%LPT9;wEWm1iPy @1[D^"vC!0Q lӞs,D\n%Yy^.]窅&AUkڰgŰPRpGs3;*!eP {Z*TYw`-L5K>AuB.穋sp/O:畈{S ik߮ʥaOn`]BȓK1L K˂bB)6%Xf+qWw@PwFUa+00W7L }8AO}6Wl+|MGDJWIvGH/8vԻn=8?7QY9@*kEi{b )aș~̄(#.3%ūJS&9ɹy=`>G6R,ljYc fR'yWh=ͺZTgIe?yNtňט}/#bK&H>LߖKZ˷_S®wDk̛Al5ep=qJ2= s{yCed8.S1 ҿيU[LG=iTMڮezB^ ke:U.y]BqbD|o8!<tOya.1wǧ-@c}ECT5bQ٣kJp'ta+'Aq΁͙E])GNWMp!uc5gU/[^P;戓!b-a |zXޝjKQҺuJdWi:9Zw%:L5:dƶ$uX!aIUd8P"P'KeתmT޺`,ph%V Hnats.1XiNΜK ,Qm3*5l^Ц,bpwt4<d3%Sєhh\zx{j\׷8 ީAD)WMR]IDzC"\Ccf/8[Ŕ;nB?*@)uܠC`ʒ (9owf "7d0/oy2L%K Ɵ'#0[Rqkݗ^8@I&PR?etN3S l~k^ăΉ' W&[ ;"nOw[K 6 Ty8vpIZ>Iҁs܍|s[!i &Xs" k%5'MG\t NaWC?IyABj>שǼvDpPfq-b\X80dިlSVd > #Ѿk5[IH~rMfhO\mi \{3s&G[Բ,a,ڧq ޷Kw)zC{bJ5k|s\u0ֺ#Vr i {EO<&TWk-xI/1XyvZ4A@nܙLDwtXpAM) ]!< ;HAH\!BvC.KN:E!*4n>]DE&ȝKo"ksu@JE ;h>рߣXVS&)1u9;Wb&?U|`f(~Iˌ6 &OgE IPD7D" }wH]R/Kz)Avs24S_X#BH!Ll7U1:[% ӈnqU^d 5bT}fZȑT2T>imO%r3jØeDz6ȕ߃Zz#09X Qc[pQ d!ohc1& ~u G{rUh|Xllk;:};syncH¥5Gf^WH.iK{R768fbXrjAbЈ{sn`nh^ڢ8 Ae[ا7ƭRݥjo]C`ۀs Q6xr-vcإ"ӿ?X>_B7oWɌCe;(4bxvSΨ.&-r_ J[,8z nO( OP(; ;3KnQ$MC3VHd Tӕ9\2 8`[PDRfV^كPJTK`7ΜJQ0frl->oM|hawBɡg8߯nW!/*}+4W0oEZg|6hJ*.o Ǡ"6C[OdmE=.2&8rTy޸c`> `K"4J>l"b=b(gF3]L8v㝌4R67(爍 S!jX\ֈrVso]q_*.ˎF1J\J9]VW%N[>:KAyP[<꜓OtB5:a[˵a0=i~a !9ir`za}n4I. Կ.7^`ʛUh^|&;z}Abߪhߗjddz=9maowuA nqu ^e2OR@Bg1W}AZՓɳp` [3fdcBKY (X& P#f wKp-z?4ǙMk"no0i۠rE^S56=)(:CsM C?w[ggO~vq> 'e- hJKqCq` ׆QE39g۴VuҴ E kp-f@ɳ%Ӫ*چYȫ2(D˯`tI1/&X ~UpbQ t(r^[>h#̥u|x4Ii{}R9ځ .-{]*y{.x5>8 ^IKkϖGՊ"ٗO=Ҷ-2JST\2.,x󳝥"yd %E%?!oz6r0t W6UH=0FmznuT_F%g*ij~zF8CyVp&փ>B.Cc$}kN<@. {xOQnVkPL3'ȪL\9dZ Ћmڏ\1c_Z1KMzlLmÀ5u,v«`;*֔@eH>rK؍F!X1;u@O7i-٭]n1q&sNEY6sFax?8&ޤݺKqiT(Zk3&a_΃k ?|]WY-~a>lޘ_WZL%w:^!@O\^Hedsy5Y{˾x 5K荋 L ?&7}ctz q"eAkڪCRࡕ.=6m߸%ZMo$pk;$4MO nզzfrS+gi ϸ3,KB n5Mv@TrS4(ď]l<_G6 ]kong8\+K9Ʒ/1}S81 G+`&QνFEPo*EFIdSdI#zpǩ翱-jM^Ι-^s{cP2|b=!uW}O.]X #Ya|}dikڣF0 [x.o<_:\| Yt> ]Fٙ s|d{C~ƹnz~ˠ mf>TrXAVzo)cPx㗎[=iQyʴRc#âR_iºyA'(5s#90"yd>knV]ŨpI-t<sf3U݁|T M KѸW}\ <,R U 'Z#ZM=뽉IƐ/>Vo>dbCe^f 'sHL7I%R53+om7"C_7ucx~~jJ oCRx&FqM r" ?G7Gw1>j{U?䍳 5JNynNiD]E#V\BxbD?o܋ 2o#kJCXU{TK``sj"$̉zswQh8 0@4xא]8)ey -?gd^A#;PCma%N\~Tv@As^nڡR.L_,ʽ%ʚ[" ;6-n6* :b&XG8X9YΠ2It"c^v!)!#$ 1T.mط02eH(_EzBy}:nK77uv:NgmusKyzE6#zN);,ze׈g={Ѡ73w(ds`+9 eT1=HPL@}X6VR^d0yX'}fL&Ipxl{@{xA6A}f!ԑWWx٥ulR%wxV ̾ qfZF8ܡ}^yotӁDa֧XKQU o -ˢ7JW/+whӶTx~jS EWgCx8+ n%iujlkt.kc}KʕLǗPZf1gu(l]YMlD_S%S؀L\hz;߇4SqZds>y_`" (i뤔S+{%*'LW NlBhѫ9{O7vah%x^ tcxGuAk{ư;u8 bOm |Vۥ~It'Y2oq~P_ 72LzׯVu<*)ҡZ/ h_U0-;?;JDhP#;6 gKu[yOt0kȱN w؋@)_a8X`m}UtagJFpl"uiS[~|5c)bUiA$[`2L5?4QE) kBkε=Kd(J[.Jl]KXn Փ6{?3n)]vFgL䘿-tvM.CU{ﲗy F\]òs`6 YI3솹ZC;H&OmX_K Q6Y/=@]ݔ>qnA̓g3;T=/jtmIM"(]iЫZIŜ:__joK 9t3íkE[(=G9lmwBGBO* %,8KҚ l,&s[6!푨[0p%S6eD0E x%B 0:+q[?Egzj5딦{K6;]3BDB>*v5ֶFv(#A{QK"ȃ%ZڔUN W~ZW<?sN,ӍW߸*n/飀N@Pj\ :IiSU7{/8qU Έٖj|E3I'(-`;5eMj v3vl*xM|dWSNSfb}ѣo2J&ZP)XC0beaNLp;Հ̲ώGfT?4u+NzIROo.1}׮HviB:? R[De=AE+ exxnZ9~7rJiau~9*kS\|A:Ũ N5]҅KfKAsfҶ9O̷.u6W~gVРXxě ޽yCzBғy{#4Z_^}g>kBdh>XbpPT?٥RQcJu! "{7)/mXI,{RNY i YY\[tG,: 3G*17 ‚>nBà}5iALhj:fz8'x^$"*-'鐧 OrcPiqANO<‹Ng'%f!_''+0Swk ̮#C4%T pkSU*XҨ}J$gZʾpuQwP+s]KNYg8}=fi7I@\*2o$Ϸv}Ȏ+r[`؞44:[*Q&ί|LzbڛUbK'ufPZtJի^! Tߙ%By~nGeEz*?OB h.`O5Rc$0!,^Ѕ߱2QӦ[:jXւW\QW_VM- O”_3~i[MdC}N4W=UW>E(Q T]G7&-І¯DCAn/^w-;I"gR̲"(E{?*0rr ]j"ƄRx-Oi-E=@! ~1>pVh{@M|Wٚ;\iA0m&~bSqgOֳKTT퐔D/YZ3X}ut_c'F"͑ijfQXPW'HcZS_\I ”/w0Q]$ -!\Fztx#>1jq ;DK-@}>R0\E~Z૧{wZ? t={2$glX7.|wV|w²0Lq ~MJ\|o>s бGImVJ'q4SռeC(\p?NC8wϱ mD p%6` م-'] Buq\\=m 2t6duOq6<󀥈'.ρۏ"ݵ̠MosC:|IMy.Fpi_“jǯge!(KPY  @!9^2rPw$$~eO*kī^$R@4XPaZF(G$#xD.C3Ӯ|.4rI*zfgAR[F~#k|mI+>@h-,zf4&Ne-6чy] 9I6櫊дj\p!k7 `*<(3)GƋAU{: V Js}[ѧ[ },S߯:'~ѿl:R֓Czd؎\GT NBjq<#QVAt1@C'ѹR<U̧8A)˷Y.|6c$t }#YKrt{C^Vb…cj~ظnhb桎'(JE?XLizXk<@!55v޻6D&̹bq9Kòhn}SJI$g %țŷ`r+T9&N*THاUj6qݐ=csB@BvEiSjgǩ(.W]̐1z&.xU暺F\t⧾z@8%lPop r0PKJ qá5Aq~L`f:woAV ˊqG 2>QGt1O!@;ꔽI bzC RPrRՒiĔ=dD8 PLLqaOŀ*Ajl~?:;Xp}۶}4lZ&L}:Bjq6#[RDپ|O2d0xnRpRx M" dVU9pyn";K]T24tZB:˧C0tJ뜹ϻ)ʈ8]#ou`7ifJ[%p0NH␗ضjbn5)X7yʜ [xh[7zlck5*p*/BUňA5  g&yQDoJ tB툡Jl4 n4%w̻G7($DBOa5+Me\izX n)/0\9DΑR]WI}ObE`An MOd\qIRJ8H4-$+@^>7YncѪcY20Ǚ4;‘Kڙr݈JdE /ZlS\_ ;2w|GC<*Qϰ"i]>D@"To)N _3GQj?jT'~T8;CH0^Ii7'06WIiÅ}N~]eWob`na$XS9 Xu' H^Вx 5IۣnwCs߰QZ3yy)R4:Y>6kOw)SZ+lG/A9:[gx:Rn_G_Tn Wh+=\ڋ z~(c OQmHv$3؆$ u :y5Zl\͟V/\gi͜uK5X"xzBs͖27mHK7du~^|Y%H0 8겋bbLH Սw7Ţ?2?#B0w$9M/C,翦YҹRvh4ZO:YW.{Qa]Fq@@x%a13GYZ 1hrK2 TPUY4W#Ԕ@El-#T x3g@d_Pȴ`eKbu`|Vq9Wl1C0ϻJh@Нآt˯YuOB䶸7e <<Z_jvY}ljK}1zI~撫$\k,_.'B uy& :"vP+Go$%p8<󨅩-{k/fUނÊ9ȏyC)Ϻ{Gb򔖟T4#C~gpdQ2{T@oC ux_w_&@]$iķh 0tOb,; {w^ yΒ(#nJeQeG߼+k}j<+3mokB-ۻ\_n0A*/Z1r=B¾iWmkr[u_<[s/jښ0iQ L.Mf9S2k7VX "kkdܡ,~X 8 $; `*w,M3[=}lR"r,-r[fy跧_3g`6RʈF;pq$ R: & L"}t vڄk[p g<V?Jc"3N&[LK0g_EAyEr~("ӭTڂk}( Cg y3,kR]J hda`SXbTQE񲓆lLP+C6\"E{̌:YoQ{bYuKVܯtafL;~1 4oŽ`HkIV2 CǺm澆:k whZF! Y XnyC`Hx&^r;cBb[. YTmeB6<^uN"G% xG}OAuk 1&*yKa3%]H l󸇛bpvW)Zl*5zZnN8Ztiː$u.c\IiKd)53g|m3ژ{xdN m&Tċ ko6~]?N vnnKPX _FmBn||5?<^g] Vt.RpD^HΫav/JMez.eZ̰&Tt6`Tt׭k2K\|Kkz&;O;~zg0_ JP,o+\w*ٽ4)]Ԁ%׎OPs*)NaVA׍Qd98t+$zpVkeY☣)o`O'`\}~z Ètϸ}CwT,/hU!Prd2~C1."wi3x7WEHtХ DRZ_I}c%H UIQfM& $R%fg=}uA'ZD>Y!*nJF",=vN_umT5fu`q '𕦳*Df U5INQ}5쇋je8^5`IFYCO%i>+j<7mSD.:=uy-%y֏uЫTlwՕrǰ]'EXLja,_)9 g6L:IIC6<S_"x;+hrf[zBPlٔaʯɜ5lH^MuJʛ1(O*~#]#߷qTyy6ìB^4,rW `/;wDm'Dc2p*~|e~sU.!kg=m[9JI2oZ> sc {Q<[#|*R*oi3"~ U!l퐜CGޗt qY2Ȑ+>A&dGɥSmka1:+R) α%T ,~`P;%P 8S]>O[4w `#_(>MW2BiW1vqm?eG[s! D&LOxOB]if4 ZN(R/X aβ'r\/ƣ^ B*oǜeq6pl8i!1/N%㣄{$I[]n)7'R4C'/,{TS_Pl0U5SIF[hܩ Es8ح֦m`tF( 8, a឴r;FqX| XɕgMY.Q*?rxqh"54S _ ~-;hj+^3]lsASbiE =yf}LQ{Qdz:z>HmB TnW<ಘga1<,m7Hl@2q,!S5M:Vwίِ% dȳ6 Ck;P+R?MKB`-idji`]$¨c5:j#hXgD$u8ZV,Q<#ai <iMGY8z9çC|Hi@Y AG+k6f+Z'g_[ ÷8-"؀M7=$õrZ}\Ӵg?~F2#ȧPN껴Ƽ]U?> ݣ%5X 2O-V$W{G֌b@GDJ_]ׄJsIgy)covFD@ZuHڂjY]iVw0i+>$8x?|0YuIVĽv_U_|w8Y +d~M#M8$K2@(cxz?\w]ɵukTgAykjO.yL3flþAƱ؍wَ 2%_U@T8Fr .:Ǹi%85$tlZFK=#hURA=tZR%Qf&|rN H><4-*Ӳ766Tb">GxՠmΙL *&B:O..u,~PYD, ZraV&bg^6z wqYL?];y+$@^IZ T"OYG6@OuD/+?Z߄_WJUyUv3'簀cm}ulVtQ? x+/9^&i~V c矆LD;A^LnU^i7Ό.Фr8Ț~JcEPc_oϷT 1Å2o#lusa %,D d}%>5|} Q{=^;@x+ Y"tՊ w!5DI";r_UҘe=5 j=uwzb{}X0PUYkP0F.-Sj՘+[QI$RPHd })(!-_3)m*.2 f3Ea;p܂L ۈN t'2%0QVW"h eܠ)عsgcTP˳y#껞j")m"4f8r.[k\yy]bF/R^oU?^xC6O $k/ͫZNUR,6C^f. z0pSpJbΞh0e| I?ekSomOgqQN$=rc!B(25vK16̙JCvr>&-% Pl :o ]W!*b@`hxa#b7b^BX慵RUaXQtαH<$G־͝~ܾX͉N'@>_ Qrœ[, %_ҿY"=w! sPۚ9s< R$_8|Ah44%ͰW%11/̈9R8tF&2MѸyZxG[W2v8ykYPEQ*x$ŕ#,7}o-~*(6km'v qQ>7g^֪n:L6f : }O*LdAR]ɪx4w{Q;OY,_IsȞ6}BG͹f-_ xWCg`]Q07%ořcEB# ȫ9G[K4ӇDG:v"5mQ6HvQiN+$S,ɏBW1VP@6Jxn]BzHT7i|a`-Nшy1)aFP94 䭰Z!m Ń|oi TjZk\Nߢa'u.)=,SixcN1AIp)ѓ hkai ?[(]rvㄇ|Hk՗ZB&edvH)<1w>_ TwnGsu!u)ukBJғM}՜,"/#뙍VH֙g1 0@ inFPoå6lTKgBT>`/:6acVj+_Hë^G^oqxۿݕ9#Y/^*8USE롕;Í) k>vf_ETIzV"O.yFsK\?zmG"`@Lb;bKf36]cY`+w |$Xr٠*%41 zi+%2"wgOP"~wƼ2.{UǃO? 0$x6D#!{G6aUp?Z( Mȋ@)wЮaQ1)5:i8V>|35|0y|׸ T%Ue[qB${K5 ܆-gHP8yԗDzwJg9">𥫞zVضi%'K<}(~v[Y Eʣ'l6j#Q3o'4$Dsg %.]1+y,8$+V|rv6SPZ0XZmN\ :4,PS|(u7э}3nF$#)+př7IcjġLnȼ&u[/ ϙ(ZWmE~8dTЈ#:B,O]nbS'7/$r VIO${,:\AmIm#>UZ]LK}rWpJ5Pc_ج $hտsTIfVHvO9jg!זb\Ŧ4˚}*C> ;Rf#AT }SBh>\B.fn^dhf=p'V}t|p|+7k]O1]ȿ #NɶsTDNjeڄpk/deXA5BG).^>zv5Meƒ/@\Ш@* , +0P_l~_zzny] Y%(+y5`4< CfTcaj1ښf#JʶF6Z %*dSړ@O|E @3v[8چn鈶Ƣv7 习z ə& >E5ȿTwohi a~k;5h njSo2 9.mhG'#̲W`jALZ)DOsWA1Js @PVJu(W5ڏN@Dջb/[ͺ3%̙H:b`\O=y= ;쨅 |Ub,5kw@3u_7k}]ؽN&jP  nԁؠv60iVthׯB2C[qp˱wΌq$A*ާ3t/gP& Q{dK714dUȈi}g򿸫uFJtZZhj\˹ &-u/:+I5pN|gDU7DG:BZtXA=[#EB83[G@CTBf;;Fl:6IK%^7q2UUG7C CMBdYRл`bw ߽X=swáI&bF`hPږ~rZ E) hCbNLymM`oj(ҨiS2_gCU!E,ئ]ң+J+-Q}!;K[J.YA+4~bsl79Sr.\EfDC%B4`k_HHt;(<#֚ńJmiNd ?J65E<,H L dyMՎCX P Fp1igj 2Y{FrNŚY|Z0''X6h vx0oa?ne /1њ8cϮq0SK)P86J$v6* -2Zyf4aEK˹rsY5ÓPzz[ɌO_KYY!-_|a>SGD& .-W 0iTUĠ&cTw}˃@t7P7@3\h vֹDzDز`?J#V>5h!p2~ro8A4zIi4t_vLAM;a~ƀިSrocN5I!^gh=tI"bGܰ̓!,Ǐ4:)NT҂h[J%3e{|#6&y6 4Ra0FtxqI医taWm~)dUvNflK*8wrnBJ?/U) <ϻ1lEeTUU1Vj¦'Z|3#߭(g9EHP#7 ^Ո=u8Z(ÍP+y|7.B@6pK ?Yl ߅"sg@U嬷BuvJEUT`K:p`n%pr1wS^}`T(5H< 3D8&p8THn߾;ߧ5q8xYŸNym,}Qh,FwqE B.o>~*!Jf|Ce#NQ, 1zcoX(ڼߤn6! f2Бwx(.X%ą89u;喺`] /xʖQl$ c[МL+6сCI0W6X-0pQe0NGc=%JJ9Agg&ʲLGk.D{('2uD̀Pk`U?Y)wT\LӮT=kںɵR${.NB,Me,r(Hle6@Ku 00oiMO$4%Rrk0Es 04iES[I~>^mW?1:T V\>y#8rz2nD~-0%A!Ֆb!~_n-U8 ZIBD&q/"y5m<^ݔ@_3}Q[DH1s_1,$Ȭi#3rLk@9|+J[|0DI?Ї5;J@Q+D)t]GMd-=Yҭb є:FamN"_*Tm /}9/6\}ZAxHO];:-+M#Lg[3][~6Z1< P05}R |MZn}a!7,;R'E̦Շy%''gW] c boYgFi|&pg2&{CsNr5 ]G~Ss֥͠H ZEVp;z /.! ZQ`@[J _|h&d];q5Ln nTMO5JZsDt O͏[/F.yN3Iay.Bb3 aaɵ<}E f4Geqoc7֎R"D;T/{r:ߊ5\A67v qYW)]sVQQsx\ɚX.G%t2s7U.}f }X.=$P*L4NO:*su=%dIF^_RFשvJpozRL]v*6ʗ?NjiWM^i/kmNZzdɦFf$*i+)%R-đg=7;bzX;J#>p+/9ܧTM/];Fь:`[ qzp6Hh3ᕺZc-8+_TBx9v3GXsP2Ϧ3rJNF/eI.}&^o2, }S~()RYFgu2| β)*f "usfTѦ9dZ~B:iJny5=S-1;3k 5:諃59NMGk j(](Y 9PL$>vE3(Ivd&ZUWHwշJĉLܡ. bjq4!`uTGH6S%\j!2GDC[PMd6ve #1'>uRp9ѡC6/|= Da+h#7G WN)n5"Hx荭z/3/DH֩IOI!s1/`x/Yȑ:%̚Pn]&zTQ72O`>2JA㝼c2sӌ!=_|0r7@}dxaW1&֖긶t_4 di7:K [ W(]l(dڱPKuظ Gs]!t8?wq]4ONu@zqT.Fy1bWLf^b8HFUhP>w~xt4lWD@Q6*%>PA%MkKv[q1yW)glսFp㔋٥Z*#8Dvqj$;L"0k@¤;q#6wv3V <$I,8i}q7-%q7rmbwb`-9w܏)d !60VK{څɥ ¬qϏ` գy[Ki-J0Ȱ#8f8 bTgFx;WDJC8#'cMzz\DNH<VڿT>R_5ilO 6}}32Y,nx>#nn%wn;#&hN$i!S:7<E9 ȃB*ӭe )&n/d fYip`_#-Se1Q H8 jFlަ$}fj9c<1>PLvZ8uŦrl6ۼ90s/eQ>Wt3 EhX sFKWRPqR8봩DMBrĒ8K>NJ`mu~Mf-Wt":n؆bYa74- |mh9ҁF@%3g sgIH "m觺OGvf ,HG23T OdyA5@ٔx|*uE{ML,L9&"!M-;KcsNnG ;)[zCWbS0ݧra+JW5W6L`)׮So0dwnAN#=_B^e?I3^W`W!H Ad˅v%uSzퟘ &3. kVRΏՓT-sc\O3M7*>\5VvaobP2f(&?#_!rRq"S8+ٻ%V >M碑5KhXU^o#:'wR-?] ^Ф\>AR0 M MgVVyʅ+o<ݺA@m|[BzX_їƢ)=Z TZ6&SWUpry{Qs]BObyӕ .Z'j|S wKī_~{~BzrO4U|g]db$^%[SpK/Ўќp^K36_r P/wk:v \GuyB7cBnA`*EH\W7MMvV(s2z0G1_ժrQ K`5)cOݖsH8`Nd3A,2PO apI^ gZd M=7zR˔L>,&zShj!Xl>״,sP#nMX:O$;BΫC6`DأSڬ ,դ_q|X;!gpLXFn3_BWKĭ#0GdSci-GR[WoMaKEvz{UP2 $h 2=s 碟VphTL*j 43hbC,A*9rvU2wEcA)nB[z?HN@Wm8AYy\VAY#!~AtF '= D;a?n`B;tP;B[ tuWEЪr*{%5~Vp 'H&<õxr̪(9#"L&HMfi̤:}ξ; FR-.<\FLOcozԶ=lipy\%Mt$ԧ]V`vb!MKmuzC-YNk;bڏ-S#cZ0N3a&(g{;32fе E.;j:3#+ I;:\)KMީ[DZ"ފ67ϒ#t/$Sǒ;˽eo`іսFG7 V+Xb"ީ"-L6X$=D,M jmC $E{xPE#DrAb+8 PiR},&`̵ڲЉ p} W_y>N,0 /0\ToQw 5=0}(g&蝭 ܫW]?o]w66Fi 4K>2yj[MJ 䑺yV9^t(J:鍘`<Dq+¿ե]# n>71nN=j(éDEڿ멫Ɖ+vnু,aT/u ;;iP5="it? W6F' v"sFۼy}= KT +AF3f)A5Ά[`i+{ĺaѭQWk#k[}/5R.TFs 4 js@5]?6uM:E0p%R4}f/Q>"4Zոa'Ocǵ1y\$&ˬS%t~2{ƮgJ6dҢ颇(QӤOWY\@&r,S|8ʇ&. Eif{ 2Yҥnl)4rϋuEDh$fK<'g/LYӘƹ%tz3[ rbй?˳vG-EݤTTЦhZUsx)tn}=7[4aZ&,Otߙ|-39b,@z?\ '.e5 .*՟{P!Ւqa ~OB[OPʇQHtI!`FHUC7 ,y2ak߸?,Ea= e)uoh$J)JV4(|I;|fKG/Qo H q-;l;ȓ?,!yo tlQ?6BǶ} ۶)K &:$%dd,ts)QCK:X󼁅(Us G_ӗt(OPrsB=c8iI)V_e~߀>y2罕^0SQ{v:VpVYrfd=iP 9b׈n8x6*xJw*(PT//dn<+b>{I|TF,< P!]Hz{ !!7Wkm3h< 4m\X\jL{h QvRįQUa?>֭(?9  S+Gim{i)cl5i=שTSwB3bދXdy$ܛ*`c杏F.|.܌L98=Չ׫u~zb);ҁYRg>h}Llqi)|kP1 J^i\H 9W#"7@2FZ!Dζs\/jFZ\VFӣ>®,&&1zbkΞ|jh ;zjBVd6XSM]R L?\ļθ޷Ržu}7=m:,BgW OвP#s)2uo\Θc#u'z`'OeRtvHl IbBi ܢ 0`ٱ |+dWs19,}ڐQ@a51m˴ڕO" V797ǹ7_s.nk%.ieHడɩ& *$zKYx|F"wv;&rOcʔ:w2 4F"ōBEZշuk+vLVYI4?Lo@;uBWv~UBz_۽Y?g9lT3] Gg׍|%/>[49#[;@S{gdJc)بqlL꘸MhRai$c_P8|ƙ@ zpk1m%YPe*gڥizmwOa7` WȌ8D 0WR :<)e5qQ$|˒?kfwC^GcE)n8 <3h9~b|Zȑ6=+BE^)p歇ei #(:#!*9^0"-q}cL>"BjLPsRo{善pq5Xڈ K3 X_WHc"'U9g9A`Sp:N" ˋQ@" 7jB#6:jAfٷ! mlRaڍI{{/\CzE^'[~?_g%fpĠ8>ئkG9]B,;h{ m-|eM[ tQ ҖңQ>v!mD1!(JwX6 BaO1;;1`OIQX?vz"Re$Y؅w?H50:8o$T6~KRK11 nkM}8א1/!ǘ1h)UN1~Q=٪ [CX7+-3xFCޏo2.r%5} 頻&'q9MV:F QW?\$)L=*h=׬~^=/?t~>4^B9P_MHKXp8qgչòV9h$OMOrjujbMQ7ib pt|@8*H!-Å1\tghl/n:2]#>W$2eN=,l -"@Eq\hi`U'Ͳ_W'`ח'.|7s<-"]@Ee[ϙwP5Yw8w<׸vh `x ! _,A'뀜pqO˷ N9AG> Wxg? `7"&\3x7)+i"W%L~Ia̲_Yi\\il}t=ҒmYɮ 2W& Ι9E1G}5]Ƒ_kxx)_ w72ew&P ߰m )>:rr0vk7"Š0[GNJpGqq>^nècT{3dGoN8 8YIIJ]. 71'j̨1ЃӋ}O1V']>nKwԈ,b-HtsFbmͶ,TZu8ٕ8[}_ hD@ԕ *]m;2_njm>[$s=c䞤FZ٠ofTs$ %NѢf0&>"OrW0 XS7F#mOPk$َ-QBȧ{x粇]i(dNNt7*hCae^+׷]8AX=jZStfQ0ޯ:))ڶgE8 .j̖Ls7"m ؀+}OXGKTN N%0os`9|'ͧ9i"rH xgAUJ_ [ NW HX> Ƨ`! j Q虚q]{T#L/2|ȚQBö]їxJNU&¬ wn7'xdS ‡o*;a\uĂ~A62Ȯ޺k:r*`SyaYـL@ L&-W-ǽ[)sxn[qAfLi]I ֵ1 ,<f9״i2("=̧L`waHq4(c]cyr4þX%'<[fX L3D3JRomN-f+55r.66vmozrJaNNQHp" _Cq#?h4'|/s6(ʏu'/6_oo}m^~_o0Rt/+]fQ܆=̝*g{ث[1qa,xbI 2ld~8jqS.)^?UV2iG!R`8䱊̘~$DL?,L^68ּ&rNAjla8a*t;%,iLKCWq\jE9Tx/razwmyU:OKv ,#rdl"hMX!GNֱLAGHL<6RBRVC_ tݷŘmʙ9!D |@ NJJ~;4Bj*;Z`HM![yն"Ί=W~_֒-YkO^.ld^[p(&vEoi!x88g ZB+pJ+4_xRU KgcO@j+,FۭFmG"J誠u<"#GpRCE|X"uXg & g1ppEǖ$lݰ97x@)`ÛT)2tXG$dޞ.,HWQ+OZm3qlX6t78U"ѤNYnPdD3/3O4_?_LmR?G%]ÏOlD(W l'ĂX0RC˾ f$PUдG%70yS91c5;2,>j#~ q OY&y/h` y7emuw3X7 cZazخa~.#^ EҠ1ژQĻ]Nhx)wؘTk*l~=;b,ddB@͚,YXDμ2sLroqNu3-F_E%9=EQ={dM GÚ垎MȖO ƬKƐ\HOt,Gϵ0G'uhX#4$g6Q޼wVLq877WU{@@mk!o`V*h>;zI~˷? ʐ=K U |D@(|Hہn֟˵ bǍc<ŵa |ܿǩNGMR&1ou1f5iJ4[ U󓦡RRςiqiȊļ(V4?Rc?X_n%}iz h~҈Cוzf?0Lc=ĵwN?65{=/Ujel,PjɹeHnqtL瞻Xq| 4AoF&e󝖪ry8 ݗ~B[Pغҗಊi`wHeaٗ=Zb-TKBJg]AD56$M}Fi/Dp:UenZĸ/jx:m<իÃA8mkɕ&견 WWĂt8%>tm3Jol dH{@RC/3\~C8E R-uOPy6z8VG8K:@4Ӂr߻ߧΖk=tt [,s2'Bo3 ,۫ia9H4~ 0)R3/g/db`]zڈ!w(?'D_pL8†vG\sn49+EzWsrJQT-%7jx?Q:#M8ēK}hru%)ga f)Րf]o9롄A(1?y!˲.d%owuXqFp,/PXHZ[eߩfDT BA_fO%3iu?'f&\qf ; ˫MbgI\Hrr5*`66IUF(9j&PƐڏ-d*Wp,"YYᤣ!G&H>{1I|hqu *^>VsjH& 6_:%hkcf"Ri{7xLQ^S**Ĭ [\tjZK3ɊALM.}%R%98V %[fOOg; Zϝi qm{dR_暰 I{OyQ>S䚍FtK+c7N 7eD˭ 9fg}wƖeL$ G_(V_!إ9rl l8w;ZAY|?z }N Dahñ4fd<0<- ڵinR$xΕ˔ Ly$U:-1`mO %~] .ZÊx ;) ZqpA`/eR):sfDu߰&ef89  qZ([Jn+ږv;a㝞]fKs1ceIR$ӡrǣMjK:"jVUϳ-l@"+.5؂\_WLIDŔe>YK]ǹ"?)~i P3F^5F՛+ISue:Mfsk0ǷOHʜ6x+@F`F# 99(^Skue"mh4ҒD)?)+oo {?J:ԍ=x'=> GwfM-?|}p3P!Xb[o l''{1vׂ`(>_ WLVB+^RHNU^]הfl.Mv-n@pb-G,^%O뤣7/Q|j;wTM pqCC-e'kν n!QRv_Oh/nc鋏l⡆o9ZT@H3١:/#q<\'y%}e|U$'nrө<...Z\jH-|zkB\kխ ;<FAs Ob 8h)iIV][B  P`"'qC>y"8LKѯN(ol?:^Wc-O+\%G"x4 J/e`7KiJxhS2PWTo=?>(-#sl} JSg mXbq6ANaRC bBGgG2OK EQ%`K6 nfc]o aUmmz!fЀ?_sㄐ|ek~{ K齳$.k~\ b2/Ǯ>)l,]լm:-s3S1r M;AMTFCaaW8>U%c$MS х"瞑ݻ~&]D() dE_y'!SI.j19a1ӾGB+F$I]T܃\.oQCfwcN$#٘׷n y;Q&'͍}2q h R*!9cB!9aaW߳.[^.]r܀'fKdTJ BR!8ZPo9ĵ6'ɥg3r;Rgu#eaٺQ<8?E]A|3 5VfR`u"(h1 襌S\"axГR4ʈFg3)Bap*Sy*ޫ52Ѥ;Wo##%YCl)GF'F#/޸IYqC XGeATÑAb֙ *)|"z(Gb*f9t#R٭n]_GN@WZM/wUNwqMI$]Yޯ8Q&\׭a'{ŕtmi )akgmD̈́?eQW׎Լ>0p E$Ag] f-B@y1/U"Ua3{yc SHbwN7Yxp|Rv U: {ɲ|ѫ85FG`]!G?m۔ݩgX۷Iu@9Uvk5Z@ =TʄQ ef{[qD1"#N K`.7k3F cǁk \]^xeBiĺ)MLm|h[4ḫcҶ idSֻ6F8E;X<*~#ky6^bV[1P΄Z3bE\L.jW](cߍa\_KT| m؈v'8cISm^0E ]Ǫ2)A-mt a:X>K}E8S>Ùs=X̚4+L9 Tgd[9ܞsz˘_[nŊ=6mY%$FhI=lq3r*`s @8yX0ikvsL|`;-@kÌyj R}z6qeBwJ]:[< g_-qam=hR̐w}hc7#21+ )!dRYGc09Y)y xͨDvcp&K5YKjD` lVʔo\%ٰc2O/D %mXc.`7N1FT_)[ H)Dɪ )UB f13cCpuA'|ѐ;B-a:J8%yw C KUG~>Gb!;cMM\HcfS#3pˑi_;1+3rhbx|/@ Xp35.ԡ>¥«`z\=AC Y$kTpڬN=^d6W9鎭VkIvR0j c IfECqL>΄,ǠuwEnr4!pCpSFg/Jr^+Kݮw[:Aw7dټPGL˃s&؞xI{N󸆻Qz96L-w"y;T+m] .vs˿TjUו Y,1hA2X~-Y?V[6D*aIhhVIv DHe&&"%XW(*GТ*Ѳ>4kVHD5yXѣ g%R(sus ZB̃Uq9Y'&ݶ9OSuO7$]ُ%[!~MJs9|͈iH6Ѫeݪa.C&W(o~аPΆ-d(6ZvEz?CgG?JN8KL>geS,?ih'X@Age+68 bW#ۏDNwV/KiˢRETm?ϛ\k7z9#1rfy&QL{?mǧh>SfX0|1[ _O29 T~i,o[`5I_} Ƚi #!ӌM"p> + \PnHNg^ .9pj;;-X)Ud sB=aDn#&vk G@1d8L=SA K#e6.WEbR PQ Fwm)^ a#l>tf 5: UUz2q>#.=]@a2>k0Pƙu+S(~*le #;ZM:]چ:J+kȡ/=A$-Pu*EM旄L+Ұ2mCoUho@ncO<-Xf<ʠys2HD%qnΛjg>ZO6T~2CiE?sZz$-'_DY2\{33ֲ"SUuԴ-𼭡Ӵx oh͏0JQNgkԣY*\w@Ttp'>BᄧRN Oj{/>J ȌBq8\OLLU`ݏ?Mi 3qJOمs]YW;M{?=K”mci]lQ;)fiA6\sCj9ҋO!^Gd?DEmŸ.n!K3Iq"/Ć؏`Rxqc߂R" ۴TfC<#"VW z 2{g謞خwT4ofx$U3$<.p85! /s"Gey.K*=qP+LmBiuKjQ[\йs`]@웫3 fa"Ҳ \=+@QӾ Gރz|a|cn @1]l8 Gw؉F-k68m ϗwjϹ )e$  ST0,0B 5%Tc+XM tξ]SC1۹5~}d̙DjcQg.6"kPFd%G)ʧ~zG\d ->4=pmtP?M/ 퍎8M^C)4#hՊ U({9)MʳTYsg=h!!"-Zb%X`̎tvЉru^.#gnpWG`.~!$|6 `b\(00ǶB'uFCZ2_xc47$ 7 l.eA "SP?^ZFznb[zZԯ1n BOBn/e3wgKWy'Q' $|JyW TGk15/SV3~^jȎxL9#(w:TGb(*0tL0$6F(BQ242`6n_٢/fy4S=զ+bzuuUXYBX:6-6Q鏊?y2(h ~L4LsْXځH ظIiԢkdyF~q&c }EYڟKN9p6dI@9%![C(y.F3a!.&'k&Do6cy g=qZ@ʬSEM2H p9* ϥkK!J˥gqL*Z8=NHeDhFd%?'{u㣍_r?sJIR?/5`f>Ԟ'rL J9QP赚qZ04xSʕnm:=5lj5=dz$).pWa}C|i<lF~o턹:JiZ0ރk!u-nr}1W>"o9vA ?[ƚJ;̮a5]`ꚱ t ]YWWw^q h>Xh`Pw" t hRBB'MlT/'CuOT֞#tnJo\6;yIHDEmhWnrSqd?\i}g^=el>DJgKY$oҵG@'V-$b-XJV?"rj.=jC׷1UJs#%]/ cpNK`~sYj_ɤ3YkBTp4Lsj瀁[>Fy.S *W$ !Oy((\!F3fk; M?XOC1UWAdN:c.`D00z'2[tAfr> M(ࠅtm 7y,)#zF ;^8g3rgxx!HaXÊNrw6#t5C 90(c,mybF,+p>2h:u.y"T^|E.+8\]C-نT]:Ggh!% u4ZmHbb`9/E!zpDwsVz*V\yT+ڧ%2|^(QJ0 %$E#tLْ3y,$kl൴򷶫b xE]o -ArY{ammуi 2?gvSxv7>GevSB^dSoSD?DDQ14y.R (;`K UR|pļ>/Rku$;1{kg26a38G6ǝ%v u?d~/T45HHKͶ E=K&&al`x},#~u 09d_Dz9Rc]#4xXNoY6x"#("tjŸ{zq+#-`: k-2~Fݞe"W"ʨ$tDS}2zŲx !pV<ܰF?`PT!hψ5@g bot Z0Cs"F-Bwy Ԑ+~04KZ=E ),f$SYE4+X<ឩCQQy']YU;HFŗϮ( )Y1?'AޘJZO7.(R&WD\`W'?z6mȗ=@bݸ*![".LR"u~ F$a%.Wyl vhDm:ߧ*A5/ jOIV2nM]܁ Тa,mۦ=$U=ULԈj tj48`b@VQ+nQP(_<51TNc=s+?J$W M0ubAPQq@18l2SCv`k*@Oxt!duKd]08 bT>oTR (w] 0†BkO50IZ_Z3>m+we#~kr4-Z Ʈ_8);; {t*G:D61>SMZZq>ّȆ! btGV[Tlߦveg-;aȁ|)dMFqNXfj3>ڦhw!B|\etֵ7(!30+Q@;&ƨ=+-Q7} TJO1ƯzEޡ$^5Oi>H`|m #CaRЯRا? m_o3r2Bȍs=yVm(}<턥NJptZفSyC H8gļ1#?m|C߁<2 ^X  [SsJ-XRV̲FZ~\ 1x0MAlIm:C6i~)q'KHѤ2\/V74/H_59U^H b ;MA`~E@)[vpS?V~M x\; er7tdJzIZFD@>wC9[&gF C;wDNt ;+E2%FmRb s2-/܁$ q1klfD@YyDM E{ 1 ڌZ"oɁ@46ov{4$J\ajN?Ak )t#aIT{H" :"h2יyOq?G,pz'2zK)2\("׽(6XH!\ia½4WsJRTӍsyM #a)gjGsqf%~\iͼPX˭RN,'<"(\d'T΂' c#]ho;5RZNQ4JKފpFj'W`OjUcbZ,!ؕ?Q4#0iKqvMP" Z{-nSX#?Ţj&j3@_ym#繽aՅb?`@UCM D ~Z݁+%HH'OdT1處{4uۚ]9S&c'O ,Fqg(4`cB8>0 G/nr.\f q~;_eMúZ>3ey+I8 c } :hLiUmD 6n5xHQW?~\Y Yyf \ O¤W؜slvuhWC:G)Bd=[{W".) : 5DXW߭kͼ! i3 G wJ6/ &R2l(d3!}u1ןZ*݇?#[2|BX`\W7]\X!&IݝT"w/)R{IZ3l_ )r㴎1SAy]Aa$΢](MYž$gm"ڐ#efJ 977_z\qօnFLB߰Uv0*_;4sȘ?Z*d|UtiJʝ{El\2og xɠuzh5e;ݍnd8EJ7Aj<1է~Z쟕`Rh@-A\R,S6~YBӣGC)O_]$c}fUn(_Ɍlt6 (Нע7Y'E@(WUMpwy4C[r),v+;Q;s` >3fO^x8$wWAVX\$k*=//bIdJqGR]Ex7Z eqn5q 2[?̳Z-)bM@ӜE K)M2,pF޺=%TPa1ڤ܇yɿCXYm`5`vY O =k#P-ỚCux.}oԈMi-9-_m#V8-׉H:X(qkmk"SC?7ç_\3^oLE7颛[2Hwe\jGz 08ItQOM};{DD8 pz{.bk'_69 -~_ ,dˆ}~o @˺W/z.^NYPz SȠu%>/,sai: VMvuY 8;ag^(4HJuUn…뻆5K ,MAR"j HorZ"$Y<{6## / Ђ:vϔjp!; :c<<B6eBgaBTW"'p2pab>3 E1ɟ>0ƥf/2O2Z#;a+kSpF'X"@ݚ}!SpPrlxwU ))N0^ B9(f\O+4GzL=.ųL^4ʘzɆ$"s8PH8 'U9jL{ 7woH: BM:)`lF$*b{z5twv|Y!ðSϸ o5iJf,|Mb &@ 䠒tp0VM[%н^[ ` p =s ~X;3;S:$4B1,%:e`ըEy HjWߥ(O,~٦ Uk}Zy^Xw_t8s2}B&`JɥdOyl@/ k.C 'ʦ*_1m9[Usb;j dd+\7Jc!pҷKj{pհIB*D_\Y!LH:&(Gz}+/+MTG;s+3od鶴Y}91:E}.nzM$i-vl5CqmǪ1W +Nm%Mxw adIojF…E=wGIHƑۀ֣wn7E0t3v-LNshCVu|odSmeD%Y7w?,W0.[F`{\9XfƯPܓ@J ;d31!) YfSz":c{>bI[42j$-Q 0̷ZQԅ4huea^+0O ?_j|.q4{J՜Y#oeBpVH'' ;W=1}Z_Ktʧ@p5:_wɁ?*{`FfѠaǷnǧY[I'Pψ~}{kۋۦi'ŠTX3u W#vr2 XDE#a%@;/_|?')0SBnىx2] aRm_=WHO,rDGLi~ȗ ZYc@-3*c!1=/4Ht8/JER^_׶!L%i3_+vGgu,r$FWte.? O?[C3t3h4,AzggX:7øEH$qϳ(0 `oMsV[&6:;7/?c*: 8%4dg@DL0_U1~r?ce5EGo9eUAtC|:Zr A@&d tKd,}kM7@—gWxjsK.e?c#Zdh%_GW6f+W69꾏7?X/x1ONȏF9Yv`,'ӄH񇘡k\ SAvwW| Gב侘;k=噒L0i (<̴ o<VgQi~0ȊH&V_qy&G3ƌ5k12<3zJ1Jǽn7!VȐ ya.YuCn\ 7e<+P,?;AvmLe;rEy.(4sAۭpћו@ޜX_6n~בjf<[M໭J"De4\ni;lYN1W"!d2 86 /B~9$mƦwsAmEp mfnj\ձēڧD 0ˁn64Oe3׿M}@P+gF`8~Grymu>Tǝ|#D%f&c:@9-(~6\7!j)vgHRsoOk9 'loelKRmP< ?[SaKH7f*3LJ.6BH>DTD筌fbjOڶqbNj oSPOW6烙|r:WicbNHoz5Py(|0SrzZZW4Q|TrY+Ϳ'sOGx!~Z;yA4 jjpv!3c&'tTAxyL۰yW 8W[MExi$5M 슐!!T1Z|3R .w@~sKJ ܿOV;~#mf 8E>;XC DJmX:>}\,k_(r-'f@cDOCH\ TTgi p :յqg#oJ2ס+N ['kc@>&,"ԡ[?#LYJ} M&7YvR-FP8J(9׃6j3R1cԴa܂j=kC!Ll4%Ap_\&pX~BLmH6(~2.sS*c\3ͬ4(>> ˑa'r%rCLJM$x|K҅h6ݷwF ՠoAN(>Tq4K8 y[KyEh2ԱR0:&%l6mO;RUE)]4G߾G-deXǽ-Q8/~+`:ԑE+iő&]Z8LN54_g6-JQ&MgE ng䐝iwf*@2DDhjZ r,k.Sg<*AuOmp~U娜i'M=7NĀ'st{I'l*^k9M2pf!ooKÅ>)Vcaދ/MkT(Wd)u :e9> C}RL7@B{ulȑU X重YV^ dt?hK.=Fr02EicEwtf} -n '(+g0Gw;E#IPx."]Nx |,(ΰ6=o+; "jL-h[ВC,$31jWxr#e jv8xdD*su~t$3^WR {0$8a$,R-uhjx/4%tվ\fu++M'ޞf]-iX~Yhl7^3 uC;`>M%cpdF/4gm5qnP>8lm`b]vI"op.&tjSkp!ЃU8k̕NRS W£^EV17um\9rB0:_PKU)7lg0'DX;]+~^'S|}73j=SlL41B|:cRP]T4֢$0h [Xh~@B:*7QQVT8vpZM(ݘ., ܂|KЮx,f޾/ [gf1ڭo1"6~n!@ /ET,` Pa@]求Llɓ`ff-'ƺoBy; QG7j3𼄽+ s ]bpƑ B@0'Ez -u2㕒l/K' xF8RnϜTeE0O8B13I-j2;O;ByK`9=1qb7uM%a޶&N¬H94×ی<v!) i Vo-X?0^@ k(&7:Fn&¡4U0DgR4PfXFJGNq*f6VlIlC a MVYZ/-_ٍ\ɘ 23qpIgC}F0uh}m;\?UX&DTF;}'sC`9 lKmVBJdK.E{Mc19PTbDN4f[’#`(ٲrvR-yDu.wރ]yV\ZZ&dPn0e\kOyRYLZ bS#RT9Pjq=ƎMY &lgSʄD9"ǬV*K2 l;ssc}'*G5q W w˨J(>]҄Ov6uu !G!e7*=JQX+cUXuߺ!NP݇*ֈ`eSgݚ5({KIc'gϕ. iGk" {̏@vF t$Ñl>䊒T.+^4eSX ?CѝА7ҐjM:r"A9n07GBB(Ӄ<K|C[m~3#Rh9w&(Fw`pm ްQY3/ !:%VzSJBGsن,O>'| (1R_U1(F6GoI01NAy >7|<./ΌbQl1Igǧ'zjw[5mOeɻ6=FbÌJkx_Oʇ%kMV6k2hm]k%ZrugQbO ϔ|78z TЪt]F ً|Y4+k`Zn%uS31Ck@#tYB3e(R-庘VףULXNx ]EB[#h wjoR fI摢{Murj$+|fv:RNl+cւ#p9|&|`IOC%B?_iU]+1ZCdQ1Oc=S[]3&y`#nHF|42ᡝm : 1?m6*GT4"Fk?ϒòvjM?.,#&՜ Կ52ÉX:l#qPڤ(U}7 @gQum}`S/mޜq~lSuF6g/bI(s4ՔJ7kS B '(V]2wQX-sїၽT-.o8[-VXDbm- oFͣ2I+;J]j r_pHR6xEEuBdvG/gU@2sxk*d>A6qmRj:;S&[k j=>e:Ƴs?U<z <쌇޳Jww =_}lQL%-y{;yCkVi ilѓsk FZ| kU3y`_bU8;K"|H(D:8tR '"`xN%a—"Zj ވCPtsy&Uf0uΑPft;*˄MR'5g% e3Mnݡz)>sQuGFZ',KwDݗ,BDF>{5pRuD N8c1r)Q|WE,D^>>rtS"wSUG̅I=Ya|@ݍ0a}̱6|EλA5GUʉ7>R<Έ9瘽Uc G6Wv 0"k冩|nSn:OI[NYiCQpQBJh`YJ:etEʷ: U ½ SQ[4 %`Cu Vk&Y%z ~Vrn ^b[ ?&&S4e{N1r򭘇k\6j{N;rIʜy2 yX$b86X5Z͓ R-^pnJ n[I?v%q%NW,NKshNnwM=:O@Ԫ%e% n]gpj[r)+w~W{ta&brfCK"6,ݦS40xRd [o8/O+Xєm?9 IIAݡuQ˕ '%]tC7aսvCLv%NaJSaamib@CNxXi]cBy]h },mMF\{n M`7"R" +C")jC6J(d)b3jNRljAH5Lg$ksƠ?e 4']͈H~:;a̿'Ќ)P7QoT"?P끖=%;>˓^XR+Y0|l% BM}W1e:'>i;["$YܣsEu&kr|aبiһ*hG7X)iA=XKB4՜GQ|L3vhx;b 搪.͢g${0tdw8뚯h +sTJM2{\j{Tk쬕XО;2KFcv;K ,+lOVPZ}v;| YX 4eg2rf1AC-KB F0BƛdjPnǨ=[Sp!6X1V)q_eFUn42B_LM,AE׶:vj''-.۪lD]K;HQ4n{뫋Nio ^iԌ~?5/2Yw. x'u3+wtLUGĄ,?܄0%{=$40lLGǫ3Dzɫ9j!YԜV+< dkF(5S6 9bK)ȄmCA Wl?+TWKGE _b,\&eGI'#UcN_Fo54)˺w }. KD20 E*7T ÿ~2ti_=)oNCV"ͽ~iqcBgvD6dNU5)Zg*fDP**.z~,  ;D@\v d;ئ6yG520(ſ0@PGS$po.9B$FS#aOFTY*9Z7uR_?)Rβ|G{7s𢡄ްc߸ k2 ql LHdK FM "Ǯ3\iP_:=ޗ=|L#h CkfY% ~L> p>'u<guc1c`:Ya"'+t>V5JT%υ f2P-Mˢu,gU !qPY{IsˋۄӺ' c+C ~iqoWPt,]8t[ctˎ=Q:ClH/PVXQuyo]ɺЈΡWx# Pvi5E 3S%.$N+Nz LBh(zE6t#˯/Xϟ*4X__@8Y׵K- o6dir ;aa~llc:R~c _z˰7^rȞ3u.J8^3@; ?ѹQ_}| y%\yg}vWu ۙ{W_)"?'z{}iA_@LR3!)}ދi= wʎ;J_- c1J_&J+h |})L5Xu j6kjIMG #Ӽq".YԌ#BnCiqC MK:2e^zo.5@ #3Q"B6Mt.X\#LѺKn2 =Rx9XfCK'v%aU?Z~H'i7ïhȈ//ںlfw/2th#@s~cR%n(j4w[OM BF+,ΝFvm7]~]'Yl`?s[SA',9zȅN^hWNr-m92 cxKG\%>3|z0@ςf.,h]OsK37W `wr ~]}9Lm[6oo$Z/dE8h)#QJL|,C4ΎsXyf08 I¢ý4's fm?U3ɍG{. ިV,5ƶ ﱷ%{~]g F& T]>lGŸ$˦ؕ~x@ grnۑuB7 h8uUye.lIE6"* ; a YZ