samba-test-4.19.8+git.430.a10fe64854c-150600.3.18.2<>, hvSp9|YQ & oH4%c?'BE~qsD56ZKM|k q KO\gj~}Ù&4 88SQ\oy01<2w8Ѭ&)zZ>A<œ(N4%]nKfrF{*HhQC$qNh{MA>Lp=,WW_]jbgQx.F[m@2l?9cY$Tow*nؽ/{,>@$?d ( 6 b -AX^d      &l 94(:j8:t'9?':R'>>@MF\GpHIXY\L]^7bkcdefluvw<xtyzCsamba-test4.19.8+git.430.a10fe64854c150600.3.18.2Testing tools for Samba servers and clientssamba-test provides testing tools for both the server and client packages of Samba.hvSs390zp37+SUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Applications/Systemhttps://www.samba.org/linuxs390xs HH hhAH Uҁ큤hvSPhvSPhvSPhvSPhvSPhvSRhvRhvRhvRhvRuhvRhvRhvRxhvRy882d9d1bc50182304c126efd663bbcf0fd54b5c84221e833a34050f8c9302b5191b3238082a5ab2b08046a95428a47d9a4b9eaaea3d498880a06b3f5a7bd9a6c3831c8c947fdca2232ef19ff69980709d0152027fa3f830b2df2f77e8088359b7a9d6e4a719929561e741bacb3ab33ee0cfcc07a32ea7b292f98a13aa5aacad720c2f3e25ecbdaf336dc293bae9abc7c4b53b093efb99d0e3d92f0679df9715cd0c9c55c59f0187b59f87bb1a1aed7f27384c14cdd862991ffd40d71b282d7c2eb3798434f5832c9b33ff4989ca21f468e203834d7235a1e4f8685f209ca3d0b287be9d89c9a3db583691405c8e4661ca843f765cb429e399be7e1742e8350ac75f36a7352f40fe1840893525762b152bef7638ae62307fdbec1c8b2795db7cee77dc4c6ed316ca8dfcac37bfed0d33806fecc7a1bca7f50fc2b0dc3ebb4aaa4522eb394e25c21921b2cea46fc338d60272dfbb00ece001e52d3f87a6b99e85524f1d24f83bc2df8c42c0fa0b2cc5347c3e0b5f91bb2ae6ec3593354430136585e426ac0c19f0c65468e748cc21bc63f974b8f54d945d60112ab54e62ca178733e0e60c31efc149c6ed62eadbe81c9b1f88348566a617e756f5a99ab65130844rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootsamba-4.19.8+git.430.a10fe64854c-150600.3.18.2.src.rpmsamba-testsamba-test(s390-64)@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /sbin/ldconfig/sbin/ldconfiglibLIBWBCLIENT-OLD-samba4.so()(64bit)libLIBWBCLIENT-OLD-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libMESSAGING-SEND-samba4.so()(64bit)libMESSAGING-SEND-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libRPC-SERVER-LOOP-samba4.so()(64bit)libRPC-SERVER-LOOP-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libasn1util-samba4.so()(64bit)libasn1util-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.2.4)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.2)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.32)(64bit)libc.so.6(GLIBC_2.33)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.8)(64bit)libcli-cldap-samba4.so()(64bit)libcli-cldap-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libcli-ldap-samba4.so()(64bit)libcli-ldap-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libcli-nbt-samba4.so()(64bit)libcli-nbt-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libcluster-samba4.so()(64bit)libcluster-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libcmdline-contexts-samba4.so()(64bit)libcmdline-contexts-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libdcerpc.so.0()(64bit)libdcerpc.so.0(DCERPC_0.0.1)(64bit)libdsdb-module-samba4.so()(64bit)libdsdb-module-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libevents-samba4.so()(64bit)libevents-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_13)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libk5crypto.so.3()(64bit)libk5crypto.so.3(k5crypto_3_MIT)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libldb.so.2()(64bit)libldb.so.2(LDB_0.9.10)(64bit)libldb.so.2(LDB_0.9.15)(64bit)libldb.so.2(LDB_0.9.16)(64bit)libldb.so.2(LDB_1.1.14)(64bit)libldb.so.2(LDB_2.0.1)(64bit)libldb.so.2(LDB_2.8.0)(64bit)libldbsamba-samba4.so()(64bit)libldbsamba-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libndr-krb5pac.so.0()(64bit)libndr-krb5pac.so.0(NDR_KRB5PAC_0.0.1)(64bit)libndr-nbt.so.0()(64bit)libndr-nbt.so.0(NDR_NBT_0.0.1)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.3()(64bit)libndr.so.3(NDR_0.0.1)(64bit)libndr.so.3(NDR_0.0.3)(64bit)libndr.so.3(NDR_0.0.4)(64bit)libndr.so.3(NDR_0.0.8)(64bit)libndr.so.3(NDR_0.0.9)(64bit)libndr.so.3(NDR_0.2.0)(64bit)libndr.so.3(NDR_1.0.0)(64bit)libnetapi.so.1()(64bit)libnetapi.so.1(NETAPI_1.0.0)(64bit)libnetif-samba4.so()(64bit)libnetif-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libprinter-driver-samba4.so()(64bit)libprinter-driver-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libreadline.so.7()(64bit)libregistry-samba4.so()(64bit)libregistry-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1.0.0)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsamba-net.cpython-36m-s390x-linux-gnu-samba4.so()(64bit)libsamba-net.cpython-36m-s390x-linux-gnu-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsamdb.so.0()(64bit)libsamdb.so.0(SAMDB_0.0.1)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libserver-id-db-samba4.so()(64bit)libserver-id-db-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libshares-samba4.so()(64bit)libshares-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsmbclient-raw-samba4.so()(64bit)libsmbclient-raw-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsmbclient.so.0()(64bit)libsmbclient.so.0(SMBCLIENT_0.1.0)(64bit)libsmbclient.so.0(SMBCLIENT_0.3.1)(64bit)libsmbclient.so.0(SMBCLIENT_0.3.2)(64bit)libsmbclient.so.0(SMBCLIENT_0.3.3)(64bit)libsmbclient.so.0(SMBCLIENT_0.5.0)(64bit)libsmbclient.so.0(SMBCLIENT_0.6.0)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsmbpasswdparser-samba4.so()(64bit)libsmbpasswdparser-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtalloc.so.2(TALLOC_2.0.8)(64bit)libtalloc.so.2(TALLOC_2.1.0)(64bit)libtalloc.so.2(TALLOC_2.3.5)(64bit)libtdb-wrap-samba4.so()(64bit)libtdb-wrap-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.11.0)(64bit)libtevent.so.0(TEVENT_0.12.0)(64bit)libtevent.so.0(TEVENT_0.13.0)(64bit)libtevent.so.0(TEVENT_0.15.0)(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.13)(64bit)libtevent.so.0(TEVENT_0.9.16)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.26)(64bit)libtevent.so.0(TEVENT_0.9.30)(64bit)libtevent.so.0(TEVENT_0.9.31)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtime-basic-samba4.so()(64bit)libtime-basic-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libtorture-samba4.so()(64bit)libtorture-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libutil-reg-samba4.so()(64bit)libutil-reg-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.19.9_GIT.430.A10FE64854C150600.3.18.2SUSE_OS15.0_S390X_SAMBA4)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)sambasamba-winbind3.0.4-14.6.0-14.0-15.2-14.19.8+git.430.a10fe64854c4.19.8+git.430.a10fe64854c4.14.3hm@g`@gRgR@gMgp@fٝ@fxfteԔ@ee5@ede6`@e-%e'e%ascabrero@suse.denopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comddiss@suse.comscabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName; (bsc#1246431); (bso#15876).- Fix Samba printers reporting invalid sid during print jobs; (bsc#1234210); (bso#15792).- Fix crossing automounter mount points; (bsc#1215212); (bsc#1236803);- Update shipped /etc/samba/smb.conf to point to smb.conf man page;(bsc#1233880).- Update to 4.19.9 * libldb: performance issue with indexes (ldb 2.8.2 is already released); (bso#15590). * DH reconnect error handling can lead to stale sharemode entries; (bso#15624). * Incorrect FSCTL_QUERY_ALLOCATED_RANGES response when truncated; (bso#15699). * irpc_destructor may crash during shutdown; (bso#15280). * Compound SMB2 requests don't return NT_STATUS_NETWORK_SESSION_EXPIRED for all requests, confuses MacOSX clients; (bso#15696). * Crash when readlinkat fails; (bso#15700).- Adjust spec to split out rpcd_* binaries into a separate sub package; (bsc#1231414).- Incorrect FSCTL_QUERY_ALLOCATED_RANGES response when truncated; (bso#15699); (bsc#1229684). - Update to 4.19.8 * Invalid client warning about command line passwords; (bso#15671); * Version string is truncated in manpages; (bso#15672); * --version-* options are still not ergonomic, and they reject tilde characters; (bso#15673); * cmdline_burn does not always burn secrets; (bso#15674); * Samba doesn't parse SDDL found in defaultSecurityDescriptor in AD_DS_Classes_Windows_Server_v1903.ldf; (bso#15685); * We have added new options --vendor-name and --vendor-patch- revision arguments to ./configure to allow distributions and packagers to put their name in the Samba version string so that when debugging Samba the source of the binary is obvious; (bso#15654); * When claims enabled with heimdal kerberos, unable to log on to a Windows computer when user account need to change their own password; (bso#15655); * Fix clock skew error message and memory cache clock skew recovery; (bso#15676); * CTDB RADOS mutex helper misses namespace support; (bso#15665); * The images don't build after the git security release and CentOS 8 Stream is EOL; (bso#15660); * Fix unnecessary delays in CTDB while processing requests under high load; (bso#15678); * Dynamic DNS updates with the internal DNS are not working; (bso#13019); * s4:nbt_server: does not provide unexpected handling, so winbindd can't use nmb requests instead cldap; (bso#15620); * Panic in vfs_offload_token_db_fetch_fsp(); (bso#15664); * "client use kerberos" and --use-kerberos is ignored for the machine account; (bso#15666); * Regression DFS not working with widelinks = true; (bso#15435); * ntlm_auth make logs more consistent with length check; (bso#15677);- Fix a crash when joining offline and 'kerberos method' includes keytab; (bsc#1228732); - Fix reading the password from STDIN or environment vars if it was already given in the command line; (bsc#1228732);- Update to 4.19.7 * ldb qsort might r/w out of bounds with an intransitive compare function (ldb 2.8.1 is already released); (bso#15569). * Many qsort() comparison functions are non-transitive, which can lead to out-of-bounds access in some circumstances (ldb 2.8.1 is already released); (bso#15625). * Need to change gitlab-ci.yml tags in all branches to avoid CI bill; (bso#15638). * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0; (bso#14981). * Anonymous smb3 signing/encryption should be allowed (similar to Windows Server 2022); (bso#15412). * Panic in dreplsrv_op_pull_source_apply_changes_trigger; (bso#15573). * winbindd, net ads join and other things don't work on an ipv6 only host; (bso#15642). * Smbcacls incorrectly propagates inheritance with Inherit-Only flag; (bso#15636). * http library doesn't support 'chunked transfer encoding'; (bso#15611). - Update to 4.19.6 * fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(); (bso#15527). * samba-gpupdate: Correctly implement site support; (bso#15588). * libgpo: Segfault in python bindings; (bso#15599). * Packet marshalling push support missing for CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and CTDB_CONTROL_TCP_CLIENT_PASSED; (bso#15580).- Update to 4.19.5 * Windows 2016 fails to restore previous version of a file from a shadow_copy2 snapshot; (bso#13688). * Symlinks on AIX are broken in 4.19 (and a few version before that); (bso#15549). * Fake directory create times has no effect; (bso#12421). * ctime mixed up with mtime by smbd; (bso#15550). * samba-gpupdate --rsop fails if machine is not in a site; (bso#15548). * gpupdate: The root cert import when NDES is not available is broken; (bso#15557). * samba-gpupdate should print a useful message if cepces-submit can't be found; (bso#15552). * samba-gpupdate logging doesn't work; (bso#15558). * smbpasswd reset permissions only if not 0600; (bso#15555).- Remove -x from bash shebang update-apparmor-samba-profile; (bsc#1218431).- Update to 4.19.4 * net changesecretpw cannot set the machine account password if secrets.tdb is empty; (bso#13577). * For generating doc, take, if defined, env XML_CATALOG_FILES; (bso#15540). * Trivial C typo in nsswitch/winbind_nss_netbsd.c; (bso#15541). * vfs_linux_xfs is incorrectly named; (bso#15542). * systemd stumbled over copyright-message at smbd startup; (bso#15377). * Following intermediate abolute share-local symlinks is broken; (bso#15505). * ctdb RELEASE_IP causes a crash in release_ip if a connection to a non-public address disconnects first; (bso#15523). * shadow_copy2 broken when current fileset's directories are removed; (bso#15544). * smbd does not detect ctdb public ipv6 addresses for multichannel exclusion; (bso#15534). * 'force user = localunixuser' doesn't work if 'allow trusted domains = no' is set; (bso#15469). * smbget debug logging doesn't work; (bso#15525). * smget: username in the smburl and interactive password entry doesn't work; (bso#15532). * smbget auth function doesn't set values for password prompt correctly; (bso#15538). * Unable to copy and write files from clients to Ceph cluster via SMB Linux gateway with Ceph VFS module; (bso#15440). * Multichannel refresh network information; (bso#15547).- Update to 4.19.3 * sid_strings test broken by unix epoch > 1700000000; (bso#15520). * smbd crashes if asked to return full information on close of a stream handle with delete on close disposition set; (bso#15487). * smbd: fix close order of base_fsp and stream_fsp in smb_fname_fsp_destructor(); (bso#15521). * Improve logging for failover scenarios; (bso#15499). * Files without "read attributes" NFS4 ACL permission are not listed in directories; (bso#15093). * CVE-2018-14628 [SECURITY] Deleted Object tombstones visible in AD LDAP to normal users; (bso#13595). * Kerberos TGS-REQ with User2User does not work for normal accounts; (bso#15492). * vfs_gpfs stat calls fail due to file system permissions; (bso#15507). * Samba doesn't build with Python 3.12; (bso#15513).- packaging: samba-tool domain provision requires python3-Markdown; (bsc#1216519).- Update to 4.19.2 * Use-after-free in aio_del_req_from_fsp during smbd shutdown after failed IPC FSCTL_PIPE_TRANSCEIVE; (bso#15423). * clidfs.c do_connect() missing a "return" after a cli_shutdown() call; (bso#15426). * macOS mdfind returns only 50 results; (bso#15463). * GETREALFILENAME_CACHE can modify incoming new filename with previous cache entry value; (bso#15481). * libnss_winbind causes memory corruption since samba-4.18, impacts sendmail, zabbix, potentially more; (bso#15464). * ctdbd: setproctitle not initialized messages flooding logs; (bso#15479). * CVE-2023-5568 Heap buffer overflow with freshness tokens in the Heimdal KDC in Samba 4.19; (bso#15491). * The heimdal KDC doesn't detect s4u2self correctly when fast is in use; (bso#15477).- use systemd-logind rather than utmp for y2038 safety; (bsc#1216159).- CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424).- Update to 4.19.0 * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453). * ctdb_killtcp fails to work with --enable-pcap and libpcap ≥ 1.9.1; (bso#15451). * Logging to stdout/stderr with DEBUG_SYSLOG_FORMAT_ALWAYS can log to syslog; (bso#15460). * ‘samba-tool domain level raise’ fails unless given a URL; (bso#15458). * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420). * missing return in reply_exit_done(); (bso#15430). * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432). * Avoid infinite loop in initial user sync with Azure AD Connect when synchronising a large Samba AD domain; (bso#15401). * Samba replication logs show (null) DN; (bso#15407). * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346). * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446). * CID 1539212 causes real issue when output contains only newlines; (bso#15438). * KDC encodes INT64 claims incorrectly; (bso#15452). * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449). * Windows client join fails if a second container CN=System exists somewhere; (bso#9959). * regression DFS not working with widelinks = true; (bso#15435). * Heimdal fails to build on 32-bit FreeBSD; (bso#15443). * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441). - Update to 4.18.6 * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * post-exec password redaction for samba-tool is more reliable for fully random passwords as it no longer uses regular expressions containing the password value itself; (bso#15289); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * "net offlinejoin provision" does not work as non-root user; (bso#15414); * rpcserver no longer accepts double backslash in dfs pathname; (bso#15400); * cm_prepare_connection() calls close(fd) for the second time; (bso#15433); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation); (bso#15390); * Regression DFS not working with widelinks = true; (bso#15435); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); - Update to 4.18.5 * CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). * CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). * CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). * CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). * CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). * secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - Update to 4.18.4 * Backport --pidl-developer fixes; (bso#15404). * Named crashes on DLZ zone update; (bso#14030). * smbcacls and smbcquotas do not check // before the server; (bso#2312). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * smbd returns NOT_FOUND when creating files on a r/o filesystem; (bso#15402). * NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry and causes test timeouts; (bso#15355). * net ads lookup (with unspecified realm) fails; (bso#15384). * Register Samba processes with GPFS; (bso#15381). * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation); (bso#15390). * The winbind child segfaults when listing users with `winbind scan trusted domains = yes`; (bso#15398). * Remove comments about deprecated 'write cache size'; (bso#15383). * smbget memory leak if failed to download files recursively; (bso#15403). - Update to 4.18.3 * Symlinks to files can have random DOS mode information in a directory listing; (bso#15375). * vfs_fruit might cause a failing open for delete; (bso#15378). * winbind recurses into itself via rpcd_lsad; (bso#15361). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * a lot of messages: get_static_share_mode_data: get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND; (bso#15362). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * Setting veto files = /.*/ break listing directories; (bso#15360). * "samba-tool domain provision" does not run interactive mode if no arguments are given; (bso#15363). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.18.2 * Log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * Flapping tests in samba_tool_drs_show_repl.py; (bso#15316). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Tests use depricated and removed methods like assertRegexpMatches; (bso#15343). - Update to 4.18.1 * CVE-2023-0225: AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users. (bso#15276);(bsc#1209483). * CVE-2023-0614: Access controlled AD LDAP attributes can be discovered (bso#15270); (bsc#1209485). * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext(bso#15315);(bsc#1209481). * ldb wildcard matching makes excessive allocations; (bso#15331). * large_ldap test is inefficient; (bso#15332). - Update to 4.18.0 * SMB server performance improvements * More succinct samba-tool error messages * Color output with samba-tool --color The NO_COLOR environment variable will disable colour output * New samba-tool dsacl subcommand for deleting ACEs * New wbinfo option --change-secret-at * Net option to change the NT ACL default location * Azure AD / Office365 synchronization improvements- Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435);- Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940);- net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826);- secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384).- CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170).- Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403).- Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325).- Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281).- Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck.- Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck.- Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414).- libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally.- Clean up logic for PAM migration settings in spec file.- Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122).- Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists- Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847);- Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689);- Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254)- Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- CVE-2022-1615: Do not ignore errors in random number generation; (bso#15103); (bsc#1202976); - CVE-2022-32743: Implement validated dnsHostName write rights; (bso#14833); (bsc#1202803);- Fix Use after free when iterating smbd_server_connection->connections after tree disconnect failure; (bso#15128); (bsc#1200102).- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- Update to 4.15.3 * Recursive directory delete with veto files is broken in 4.15.0; (bso#14878); * A directory containing dangling symlinks cannot be deleted by SMB2 alone when they are the only entry in the directory; (bso#14879); * SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used uninitialized in rmdir_internals(); (bso#14892); * MaxQueryDuration not honoured in Samba AD DC LDAP; (bso#14694); * The CVE-2020-25717 username map [script] advice has undesired side effects for the local nt token; (bso#14901); (bsc#1192849); * User with multiple spaces (eg FredNurk) become un-deletable; (bso#14902); * Avoid storing NTTIME_THAW (-2) as value on disk; (bso#14127); * smbXsrv_client_global record validation leads to crash if existing record points at non-existing process; (bso#14882); * Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call; (bso#14890); * Samba process doesn't log to logfile; (bso#14897); * set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert; (bso#14907); * Kerberos authentication on standalone server in MIT realm broken; (bso#14922); * Segmentation fault when joining the domain; (bso#14923); * Support for ROLE_IPA_DC is incomplete; (bso#14903); * rpcclient cannot connect to ncacn_ip_tcp services anymore; (bso#14767); * winexe crashes since 4.15.0 after popt parsing; (bso#14893); * net ads status -P broken in a clustered environment; (bso#14908); * Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before smbd_smb2_ioctl_send; (bso#14788); * winbindd doesn't start when "allow trusted domains" is off; (bso#14899); * smbclient login without password using '-N' fails with NT_STATUS_INVALID_PARAMETER on Samba AD DC; (bso#14883); * A schannel client incorrectly detects a downgrade connecting to an AES only server; (bso#14912); * Possible null pointer dereference in winbind; (bso#14921); * Fix -k legacy option for client tools like smbclient, rpcclient, net, etc.; (bso#14846); * Add Debian 11 CI bootstrap support; (bso#14872); * Crash in recycle_unlink_internal(); (bso#14888);- Fix dependency problem upgrading from libndr0 to libndr2 and from libsamba-credentials0 to libsamba-credentials1; (bsc#1192684);- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899); - Update to 4.15.2 * CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication; (bso#12444); (bsc#1014440); * CVE-2020-25717: A user on the domain can become root on domain members; (bso#14556); (bsc#1192284); * CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC; (bso#14558); (bsc#1192246); * CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets; (bso#14561); (bsc#1192247); * CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid); (bso#14557); (bsc#1192505); * CVE-2020-25722: Samba AD DC did not do suffienct access and conformance checking of data stored; (bso#14564); (bsc#1192283); * CVE-2021-3738: Use after free in Samba AD DC RPC server; (bso#14468); (bsc#1192215); * CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability; (bso#14875); (bsc#1192214); - Update to 4.15.1 * vfs_shadow_copy2: core dump in make_relative_path; (bso#14682); * Log clutter from filename_convert_internal; (bso#14685); * MacOSX compilation fixes; (bso#14862); * rodc_rwdc test flaps; (bso#14868); * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal; (bso#14642); * Python ldb.msg_diff() memory handling failure; (bso#14836); * "in" operator on ldb.Message is case sensitive; (bso#14845); * Release LDB 2.4.1 for Samba 4.15.1; (bso#14848); * samldb_krbtgtnumber_available() looks for incorrect string; (bso#14854); * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED; (bso#14871); * Allow special chars like "@" in samAccountName when generating the salt; (bso#14874); * Correctly ignore comments in CTDB public addresses file; (bso#14826); * Fix transit path validation; (bso#12998); * Fix that child winbindd logs to log.winbindd instead of log.wb-; (bso#14852); * SMB3 cancel requests should only include the MID together with AsyncID when AES-128-GMAC is used; (bso#14855); * Prepare to operate with MIT krb5 >= 1.20; (bso#14870); * Heimdal prefers RC4 over AES for machine accounts; (bso#14864);- Enable samba-tool without ad dc.- Adjust spec to use pam macros; (bsc#1191046).- Adjust spec for size * allow some Recommends instead Requires to be configured for cifs-utils, samba-libs-python3 & samba-gpupdate; (bsc#1182847). * remove fam, undocumented and unneeded.- Add missing build dependency on bison when building with the embedded Heimdal Kerberos- Update to 4.15.0 * Removed SMB development dialects SMB2_22, SMB2_24 and SMB3_10 * VFS layer modernized. * Add the ability to set allow/deny lists for zone transfer clients in Bind DLZ plugin * Server multi-channel support no longer experimental * Improved command line user experience, unifying the options in different commands * Winbindd no longer scans trusted domains on startup and will use enterprise principals by default. * The net utility is now able to support the offline domain join feature * New options for 'samba-tool dns zoneoptions' for aging control and to mark old records as static or dynamic * DNS tombstones are now deleted as appropriate and use a consistent timestamp format * The 'samba-tool dns update' command validates and rejects now malformed IPv4 and IPv6 addresses * The 'samba-tool domain backup' command correctly takes out locks against concurrent modification during backup when using the LMDB backend * TruACL support has been removed * NIS support has been removed- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./sbin/ldconfig/sbin/ldconfigs390zp37 1752585133 4.19.8+git.430.a10fe64854c-150600.3.18.24.19.8+git.430.a10fe64854c-150600.3.18.2gentestlocktestmasktestmdsearchndrdumpsmbtorturegentest.1.gzlocktest.1.gzmasktest.1.gzmdsearch.1.gzndrdump.1.gzsmbtorture.1.gztraffic_learner.7.gztraffic_replay.7.gz/usr/bin//usr/share/man/man1//usr/share/man/man7/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:39674/SUSE_SLE-15-SP6_Update/aeeab13b449b36a000127e6292fbe0fc-samba.SUSE_SLE-15-SP6_Updatedrpmxz5s390x-suse-linuxELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, for GNU/Linux 4.3.0, BuildID[sha1]=5ac747b7381cc02bdaa32af8127863c70e335d10, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, for GNU/Linux 4.3.0, BuildID[sha1]=4cb47a4b9695266f6c96fd2c14bc517276dcd1dc, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, for GNU/Linux 4.3.0, BuildID[sha1]=37efbafebad97512bcb01633bac29c9705e404dd, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, for GNU/Linux 4.3.0, BuildID[sha1]=328d95e56414b219708a757be6ae02af00b9861d, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, for GNU/Linux 4.3.0, BuildID[sha1]=6605b6693a5da10888ad1371a3dcf7377780acc5, strippedELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, for GNU/Linux 4.3.0, BuildID[sha1]=90dba9ec7fe0f94b852776b8fdb9c529ae6ba670, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)5g523,RIR(R*R$RRRRtRR RRlRGRRRRRRRRRRRRRCR0RRRsRBR)RkRRRR/RRR'RRRHRRRRRFR#RRRRRIR(R*R$RRRRtRR RRlRRRRRRRRRRRRRCR0RRsRBR)RkRRRR/RRR'RRRHRRRRR#RRRRRIR(R*R$RRRRtRR RRlRRRRRRRRRRRRRRCR0RRsRBR)RkRRRR/RRR'RRRHRRRRR#RRRRRyRtRRRRRnRhR7RfRR.RRRRRRRRRRRR0R-RgRR6ReRR/RmRRsRRRRRRRRRRRRRRRpRtRRRRRRRRRR0RsR/RoRRRRRRRRRRRRSRRR,RR3RR RRGRRARRRWRRRRRRR~RR|R R"RR$RhR?RROR RdRRRRR=RCRRnR*RQRR(RRjR0RRRRRRRRbRRERRlRRR^R]R\R[RYRZRURR5R R&RRRRRRRRRRRRRRRRRRRpRRRRRIRfRLRMRKR`RRRrRRzRxRwRuRyRvRtRR;RRRRRRRRRRRRRRR9R7RsR@RR4RRR/R:RRRRRR_R RRRRR#R}R RRgR{RRHRRRRR6RRRmRVRRRRRRiR)RRBRRkRRRPRRoR8RRRR!ReRaRFR2RRRDRRRNRqRcRRRR+RRXRRTRRR1RRRRJRR"Lrqг@%Dutf-8d3d9234883bb5491ff4778487145715d3613491541c4dc10accab58b575bee4c?7zXZ !t/i]"k%42_fR6mH> nBh]3JiBO!i4=ru!-7Xko$'J`kV 7J!>Q._<Lbk%g^ׯ`h 8lcPdR`6t\t˜s0x ր_ť9gwUg.1[jWjWרږɸXQ >Ŏ#3jh5cJdo^.d^ri%U~T?"rẖ`husH=b7[M0їm} ,cL7Q([|% 0^۰<6QߡgmUR'F &V{^y_ԇr[WT,qAQ!}Nkַ ]($E,vTn *) Z'OMOm֏Gm8N3|ٹR,[m8󬦲x ,:%\nҤܱ`*؜r<@w,Ci*+&[n%L҇QIM)r@U^BXj7w)oX.)¨v^Vf}庑+a)%f`v7kuHc15Ҥ&#l[! p=i?*3'w}k8#38wφ*ԍI&ꠜ6{j%l[f6djPUw#!t[wն] /W&x};CJEFss&d9CPd!xDqH0A,H+-pi< qAܮ1RZS&K>RKu YӲ C2^ >h3ZkXp>8{P(rݫ}LVUQϳRM(f@>1JB#L4фN*j@#pOXꑰSw)@v&x_a((4H&bԺpԸ&~tgM i^x : ^B:AtCC< .fǙ8~Zc@5 mK$2cS` uvԋmD1CQfȄpȔ_*̭ߏ轖q)wx X>+mOLTϔuhWz'Z;l1>مU~CwK0p`?kq&R&wbSIĄJ&A%ܒ m1c*l"Pj4kꚀ\e]*QH-R$:N58|4MdZ@l.^ r56,@y 5nUx)=onڪ+lc ]7Me{ëxd+D0/A^8 IOuIIÄ/찧`0*Pbo1Vu i΁nVU%$R%!2zxh@߻Z/`:XNʐKwpG8toܶ \Δ6J# a| +sNJG\Vp&nN27|zܿRl^lw"@[wa҅XLW7OFoP`[]ǻ:za20)rz ߶:='&x.Oy-)` 2ʛe'V\4þir&&b|(ylB$ 4cg,VՓ)asLzYg3<'hc^^ukk-cG$kC@(F-S~Np]_krBeFG.%-9Yy٧ v`AӪb1"6eݞCjRpk0~sɁ| ew>!jre5IxB+pA5q6`y%~{[0猒B:s\fXwÜO6BMtE4$9NvWAԧ~Ne^~:0#V=|'pv uczJN?.+AD%*~Q^k{}Yi)M6Q^ڴyw* S#@1Y]4y<5VsGIbwy]xA>AAŰ%5澙!6Wfq7F?Vh'x~blX 3>f7[oBkGEc^K-DZ :zN->A\;KV ApA̅ uë @a%JZvH#͌cFHTK4TpOC)U۰fW8&g Eat_7WP]}0\t%:&O< ^-5\,YRW%A@Vٍ-a3hN:V2Erߍe퐳N4yZ9~ts@iqAo Eb< QN;ӇD0UNUEL(i .[]Ve\B!~,7+ Ťk¬$aWhfվP +i=[&oR?s \$<h讟х"LJ,Nk.8~A5h!O"ZT1&_bEf eQߞI @wR WoTzƘ23}L {O*?$k6)pސl]0ő9 ӵ!@`nF{2zSH",%&RF s'ByA䲨 gEweUe؉VAJt8t BT2+ۈ,/>9*(#1*Ss&`^$c~<~'p\8~w:$Oro익S%9/BӫW| rF/A_iK'/r {.BÏzeg5&NN awS]J7F هYHc1%iV<cfk~n2I 1Dtz`xؙTݲc48`*~tmFGOIVd7b%A!JFvM*JS.!`EW 0!dh">K7v* 5TȞ$9ikLv7%P^==?[jWl,ӪZDW*ӓZhZA,hpϑ`獮JOal܄)9G LznL=_uƄk|Df9~6֯9kn|[* 2AW"Ntekh_'h9( MWL:cE452 lRD|~atCZE-\B(z =hu *J:(b^|9NMҾqA!qFT3@c籡n㖹't qlgpٙ$E$X2ӻăd) л|zgĢ\]|7\-:clg } jޅ:*;"lwqF=}0 bg Fl#!殆FE4,S6qij`R̋McͻS??)V38Oaa"Z"&d&P` x7tJq^::mw.ჶjÉQ=DpHN>'`lV@黝(˒A71ɂObg"jo.5LڳV{a$e5K_%RPu>1 h'98B2f1tхDcB6W`*оE̝ 4%b%^A?4/# ] @dʫ.e?>X`/w:$WOG0xG ׺ rcbk dJBѮBX`[|L؄T2BspH0`N5&Y^hD)2`O,-_4Zt0ft{O*Ce+{96^ZҲ L_1_X(!M@B^ fFr-[NAɩTzC )Xa1 џS@a=Bqy+'4f " tR46>2K/HYzxaSVg?&sד7yb_YUA\ݥ[3~@ƅWTGM ԉ~$˰<͸'_*;m;gkS c#+";,hਾr' ss([7UGMHDM+!DL3m56q[鷭P"ޘ:#xωO.ôuUhrCǿF% !!ű S@{7ɗu\b ytMj zLG31L%xuΛC yRls:$.(pKp-p?ڦ$=M}3۾,1)n %ǃB(3Cmd-0$cq1x6k y6Ǐ>4+~MrՀ^ ^w;UpwD=y(_(x9}j?ɣQ| qn#+.K J}ʴ1& avަ1Ew 3%(,.4?Q߿$H9uQN51QNbAw涕Yq~9;ڛ[\DW+1jT)$KS5UNSCݯ*i d,]jMc$B ʒ ǧ5]O?j{@47\74#hLcYN_>;,&Pܡ*u>XOT٧&8.j1hƋp%fp -'XWCz{;}x,iHfQG(>&4˘aBdЧVJ{oHne494w놼37j ͺa7"V`v<܀)+ dTA”GH<띶ZwxJy󉎒"%dhAF1Rst"1)Zk͸/K-X0 ]PEO+3i~TNҜ-si M|;ѥKOZgu @s|PWT &@' >ؑoR BO8Y{b\hxcf '7j6i b1LH'Efmr/d )2ׯW·^EsF}Tm0fQd@Z-aD crznevP%]|B6?at'KlPJdɊ9ڿ ᷣRQ̍~ΎqݴA`J3 ^Eg*f. Gdžd(7MSgO}C"hkǛ*Ϩ][ז7uvHu>6<N]vR<aZr<+@97ەTD ~@W"N*kG0]j.5[;-.*`lbx՛QGۂ%W`{eIVnοxCǂc.iV谣Me Ms/+UYÀ;hkJ{j'6`wg4|qWd_5kE}N!A玐]ů:z;dʪQlFFk5cz~hy4yY>1:˦s;}FƴjӜA˸Yfw~OR\dPOT]0^.{bx ʨ}MgI媟0/lLmRYx IsEj 1g^4Ga0g-iik3o ƒi ss ׏;n#NNU #7pc Ako8{}Ulp9s:N)sG0;,jm`0XlӑB쓊o#0q:(irb1VBϤ؋ƣxWkXƁrv 'w p(ɏ;K{ʗ`\ e?r7If?}{śfpt$ԛFQ=ʜ'-\:8SkT?Zxj'4H`mlUvhoDvրJ*_(_2AGNmΩXM^Ϝ>82\Yal'|+Z A_Yx ;eE>a*"ū(ImvV5IBpY(ׂA\BoW4M!aP$Hqo -"M* "Þyvtg{z㢻 4(au'EwUKŖ+I^cVǧPu6)l/L >B}S)&%jŔn蠼tPgY^Te.}Ϯ{W6*;3ZIK]@ߞM\H0+$`D*~{F)zHt%[ۮ+A| xUM C))D4mY#ƀLo=PpgѭN T~KՋ`^cWBnՎ`:: Jy*)f1T`oqvlpy)9C^K591T=yp IT*Cƶ"ߐtH?wMB*mT*;@r}tϡ6>1Bۯ7l55rbYf8_GP<Ɍ.O4TC'g,S8iNm\0|z?еߖt1u D /[N6NFhçќ ֌,˃%CS_FRMx$=Y Tmy_:f[6e9ZDlo\U&6(N]x81LFa{,?DQn_^6 O7BB<Kz`T}jL 02>Y!3-,].CtΏ^<^X#NCОl&8" .1ys-hMl٧m^h g$7a 2|MkF~%9s6ZʥK:sejoKq94aV_AG k vk1@==c`5 .Isu?9h9Ӣ&* s,jQ}^ (b.s.V4ɻ Ru͒HZ{kq7XL|z&DBj2σN2#(_)O[>8g 1 ƻ"$/b}={tp炸럍9៓SN}2$mޯ߮> ׹d8'S[@zd.'0~;18٥.zvLXb"/8ۉ<J۟-dvnԆ)_Zrړ\Z2kHKQl S5a9@ Ց9SV8 YBzBi-ǀ׺HL%BL0[Z19ޖ~QvJG,5&cY[gq[-tEC)잀pOa[57%r qA#qTrCrX'{ƽ(,SzQc;<6to2Yiv%JfFv}Iu4hmT<]Tvί^+ เ{ހ@x+jS@L#/ÙbYQ?`֧ImƂd\=67qQ*e"'泅>Xп`!:,åՕ^1'Cg4gi }lQQO.@7]H)D4QԀBqn%opܴȂe#\bYK*F&,F &pFtaY;O Y;*7U u -M/mM| ̌?7RRsYO}E8XkwPo_y =0bD+ .Lh T.E "eS#Ni2AHftۓa.k RX R-wgݚl~Eu&WA ɤ>>;g'SY4ҠnJ%.` PS_TcQz#˼?{0gJnU2؞w0IWwם#¿~] ia3t4AnZ:&C]-&>?E#68BQ%]2AT>=ɱ٭$ẏs$H$7&[.:L똺U G\@_ң/`2DMU2@i >nedUw=@?[n:WkJRզ|k qTt֨Vo[ɐ9T̥$r\Q`@5M8X F_NE3ys^aMЁ~v-;1f,30zAz ʾ5>s${BԆNj"=ٙo{V3VȃdE]$bL ~GY/Hɖ}$8ƉMzWZOf|) AD%@3IJOǬg `Zt9hL!΅k0H8!XkPSL"5H0'E%SllVs`'OQ]ɇqX+> TnJeqV$r%vhΪu<=ܞQOg"ρ8BOz&CD05'+PB> bjVn<4՗b/$}xе0+ߪ g5$5<4I4M>;:~f31c!Y^SJzZVi*[>%~$ u1:#er hgɁMZ;OhC .([~)n8=FSIQN)yz^|^UDH"L:u葦F/aۙ@Xi\*8?9 Lvy?=|R/yzce>1L5e?#gMVDׅ }:.A돜:fQ!ɇSF`t߾h 5Sۇh A;\FGJҺFȠ.N& 5fJT܎YV =9(ĿR{46G~^a~lw9C$~%߾YݾF+ߓ=ynqܫQ^佊WtWpz+\| h'/;Υ8ՕB":929Vd{;몞$_4~[Mw`C+tuY'%oe znQ Xclͧ.r[t @lZ}+E`T+ %?Jsoȱo7ukт,m1ށ/it93f[B}">ZeӯxpTS:,JN) Tٰpڍ}TJՙUA{~ 0ʙ9v`ck.Bc PbEv2(9Ӵ[iCM @xL 1ЫC]/ǥBj,fRrV.le\iZCm{&e~R$`N #(S|'+0%zr; d1?%Qtx؋HDrؙ_ J< X$A. ʚ72}g=5#|Bj_{2֝*yy]"V6;@"v^-d<&~.ZCH% PL)ϰ6S,F?9@59,#^}ޑ9t{A3FZ]a]/sz)(lXUG w%~ii 2= 4Lpи>^qN`<Rx Jn=IT1d: Qcn3L}H }BY*:~5 Q8N)+.9re,#Ĵ)h)5=ȶг!έ%ukzE#S.?߰'/lwJI/T~QE?^i/R"Y)靵.=&g.FE'R]FGU nRHOمt'Os% \!x2u"5ZLeF7 [ȪhC G7]N2 TޥVBe4H-taQ=A( GUl*I}K=bAHD͠޸p芵c/E |,"p\s~-=Eܺ<vB٬ÀoCu`rtR VZba'T޻czw'v ~+5f+Li!L`ZMj_cϲ$2f BZ@@x?HOkyyʤ6gcf "|ZA۫+^b$EXR/*H{"%mq]Tlf}D$d7O P1٦\ƈctJkp}qQ~Kia_br2Pz1ZmXرm76nΰ;a+JrrlC-@"4lcҳ](rZCQm탵e3|rY s@OPb~b4`Zb[F.!Vx?wj7sߤ//L3|IYFg} if#cZ`y_Źӕb( YE_p! ,ũD,fkR8ޝ]!&q T.:"-"BzAKV԰3bƖB3`R1Sٰ,ȲB*/Ra*хMv 3KW^/YV6[0qǮ\g^]p:EMMrcH'WDŒH\Mo@@/vFA L$sZ щ053Q7k/fr"*w݌I9{v.zyJH՝Pњ°Ei_Q'A^uHh0.ɭKFO⑸6RTUCTn0k]_ذߌ< 3/vΦDTBwW4OG+CVU'm?ЉІ?3 [ {rgR;.L[o(mh77SZ[egk#jƈZs"=FLCZt-WIlOtrB<)c$As?8w-~8ָE M8Tv㥁 ?0"Oi|ٝ>OÕ "y+ҩ ZL*iVJz"KB`>~}4O4BEq?*Xf~!ؕ|o kW'Gm"ƁmRa9Z@y3y)^4x#RF5WMntW6*E@#aX̊ 'l^Xޯ^P!rOMHZf9^o՜JHi(g';5˦a $wK?1݃1+Ïc .N= : < FR9V^vy\W9"R-'Š&oM&kY틨ٖ;y*hx ͣ4#fnҏ$3+JT%m'@̀-2/ [ZIFGS `-L.vAOѠ?PYY(C0n*p58Tl\v(kaJAН }\z_rZh UnC>+ga7c])S#7)9p t=pf[ۑIN 'o 5{~}wMS݉pe1S E_l΄- WW(V8fc;Q%*yiQTAg܃*'n @]p-6ɇ}q~dV`.L__8>nE1Tm}(A߫YUuG8prz[D:Iaxz,(Ii" ~ؑgs&UIy]/EG'܏@/ 'ʂE.]9_^qmE^"-? ׎hY$nxRՆ/gc3$>B_PܽBO! elL]8N0}j0,S6n+ _ɫa^MPE8wiʾa˼E| 6AK7st*]U8im|v'Y0MTp!FгZEPEW/iEB/Q)ncZg aAl'u-wܮĵoovtpY _{o!y>e&F1)Ĥ̤S;Xs-c{-,C^qpAa{vF>#J?J{>c`F WjYKBXpgj ' ev@QJ`hlݧ%?x8/w`5>>!mp %Om3ӭ<$PB0 gtɊ}N-~⠍݆n1qY/[#'y JYue`P <9Y|r%m!8ɂrlx[HT(D (,l{fdcrNջe )1'EkIu_ɇQ&iˊác&]/M$9z]~uOSCQ߾>ײe{ b'}"BZ ]-$uJ+lEsZf ʥKh,oϯ1}.\GLWmŘu"i}ݵA/N%KA1wjSeE_uՒ1Rֈ ws-w#>nߜՁC0AH]LZ L~ڪx;2t]T$[ M~6`@a~Asqt@$Rc >} hF)*vV5p=H9@xVr5&e ӳRasDuAboG7!vlEJGzW$n,(eZH9"i2f\I kg:I69T> YMmR:4HcyG.mDs?rc?4؏::}BW-36xn,P5Ip݂8RKa=v+Qn_+Z=Teլ-rj#ʯ}FE@ TO1EYB.lCӢ?ssw'90zDM ,hx'ԗBSV /#kSߒ){Er10 Y1_,\ |2vo܄Cl.xy9QVr etT[gtӦoT3g3ӆ+-ljQ8ٳwY@? 'zDID'`)GCAvaĪ@•B->!w /ٕJZijVpޔ8́ṠZ!HpsNz%Ahr9 cP9ufiCVz)57 qm"&2\15,з!fT<^-9W@\`6&>Ǧgc@ZA1=?/[,Jt$Xnqm<c;Re@ބ-C&-vm/'@\! "ƕ[m|STe ,EAR`RvT ٓrk@YsݬY5]A+/^0A.X&\besⲕ8| 1vrzV:΅Q;Ϥgh7Ej-y4U"9kb3MD_8ౢVyi+#T mOW'F ԤŤx:-QDiUsRronneNc-2t5V{NxjO;™Ę4KB!r%4^YX#J.~0_cRxxGA~9hx$d?U䔆 YrIJ_>_+ǟzԒ;ߟXG&ݷ;IJD)Uŷ6^gRҸ}#Yތ{(PÈSlS(9>5[ͽC6~]w;Rk[(-[G#{ 篞UQ^='nFxwG9ōKږ,..i7?݌Bжp=QtgS _j;Q&@z\ioe]<~xd,k(:zUs$ħ:#-tt.#v:2ԇe 4S;o|+/'.O%DG ߵr<+1D6ڝ̤f uR۫[W#y]l<92Nyk@rPtLwPt403:ߍ?aeݐ.cW.jYI~ jTFGnYt:WUzI~I~ CԤFN3xiV/[(dx+yHuu tQܵtl9q8gZp᭢ju ZKf=.:Yfyc[޸Kń-|d .$y|=Fnqn氹E⾪DRS,1leHZ\s ϙu!.;)Op".:rMXx4kH]q<-K4u("eeIu|:@b=n\ԗsPټb = %m kmwdióBqs GIDYr<^$߹I5걄V6лu_cͤJP7D(uThtRY B .RDZ憑 n-=}^yܤM*UԱfҡ#sk~XP'7߆ ަ 07h?4=9G81 sgJu l ;pV,k;pzFhյ= |JDMVdd!F P._YJT 򌹮z8j ow0 vEM$-C^hk9P,)a,~kȝa5ؗ>8  һXiβ4 }3j;ϯ[kzAmR5B)~*Do/C~Ծ%YP9(9:Q-8Q$3P0㻰T[2PZ*a4St/ޘGnYjٖ;/0l|w{L-{qO7PS-Xm"f>U)6Ӿ֠k 8W5W@kr37;0/c+9O] 4_GH葭ۉ&ƺ?ҳD:rFC2FR/cC BT&!/a|zKqEU2>{!M-ro~nەFFwm[4-ovr\P퉒+<\@7: }U}.&[fDIaE,Y!ؠA[p_-;F@F&%cN>;$MY 9Z. !lFfj)zju`⊿T.=R ]ቂsUr**K&iӶQI1򈔬Clӭz" ~-pN4B\ZTig ;i9ޒ­Ļ,0DrRQ09aʼ!'pd(&ҽ3}";ai]<_H}1 d:B )_&G!*Fx<^Ŀ]I⩥?ewI?ٛ<=ҥi_}'S[J) [!?2;β;w/U糲pαgm2TV~=Â@4`Y^|%1Dt^ro8p_uT/o@++9_$ y?[2 gu\xXhMclF;\5maɛAdew2'=ϸ~췛,|fN`s-ʱ`^3{B0nROģ' ^S,!8 wX6,/5>gO7#[G{ٛdꃴ2P"1 HH洧cD~e,p\q30WV&Kj}Y^*Gm΍F\J&$pa>" jԈv^W@QVZb&}|*ê } {ݲtYANw}]!r'ǵ9i\2$ʠ!vҺYš:PCOc@H(57|P~V\=6uG^N:C2'0g _Ka\.=d MOMdJJ'>a(]ng&'flM*h)ĴZ--i*"Qq2t^B(ƈ~9xI@cq:X,Z߫vq):~~Y4x-RD҇ k#r'Z`&i߲̇Dt}NƺeGi͓EvYm{ A$9|OŚDj ׯ} 9YQg[zzú[ɗl+`,GqG* b7LR`+,y2lI"*z68F&sS {aݡ qjns⏨l7kNNO.%?r|Lj)kȱAIؒVj= 9ΞέO:y@ ю`fLWM".+|E"y ]~y**wQ d >~bVvB&tUb_rv$ʵ9 /:<=+I(1*#F@_bd9An *|̦o{8; 9Ӎ/bwκH#7`9|XQcfJ1mDmAJ7 gUA=ZL.t-)E  1ȪOkr#Mc263Sku勢>&s b i$͢W7EoI ˌY!H$)V!X@6_R[\ԉFѯ԰̀r5@NaS7qL߮Ֆb7dc{M6l8nGhj;(?)ʭNњ;p`40Pp1#71]ܽÂ?r2I21hdz23Ӗa:l +|/@.{k.5}@g YհfgBB /WU3=ܭ lU@(x%c~wa4q:0|/lq |3ey P/ȕuͰ-`?lY>m ڣs1i~БbmPR ? +i9~~yt94S!3^M j2ٺk"B)Ɛ|Ǜf {PXaZg{6rc'8x{w-U) ;A[6+o-L?='6"fZGGR ' $@)荡./^Jj7`g$Ci#)[gO}ʸncGrT;ik}l},a^H|r1:)ţ @'H'ioy,)&hiP7'grA-^kX.ʫՒ]7̾uG4-"J œ~qXewj%J<=XZ>ߐA8[ ֆzbX m`pv"2)VW

6b gH|0xЩ ?:Nf] aK{[5~|dTzw@]z?hY&u8jg L$?#K8oJԂӢM,bd N͆qOY;հb7΍/9y-}Z;A -\<"Jn4:M/axVv tFbЧBn^v;оHd7y{[17m|2flD6S/'吇^ǤcdYe|U%ҸO( )ؕnJۅLio Ϲ=p{u uoM)1$yx ?$qU' &*xT֡}E+H(F$j {j>ذ H*⩂{ \UA3-A]۫!LTm܁/%GY於LRCxm5d.%"(l(,4؉q}P V|!дsЁeV<.$$`wĖn2Vle~9ҞG۩]^ xI,q3|$b`0 h;ڥaQ 9[l }5 &$U$I Hd޽?㪂_UrPT^^ԧr%k;a #`ʯ!0`7e_)%" !sOM,JQ[ɠܞ/ڹ;>ňJw> ]%wZW ,t'YH#. 1i+Kzˤ,ra43UcRz~p+5$Mwk֌[oǧ tuۻ4_$l5Ip\y'MHX_lzs 4 nDYw}XqPg -eFrEgYw=^)EEq5sO.\fhؽI4+Dr=fӗXMLҒ;!a*GQ6P |+/9M3W,*"ؓ煽"4z_tlUp'A˚,Pj*c׷RKpKĮ{VwP24"W=3S"7h4;{`SճLώ=7|x`M}ufT@ 2^HTXF8nKO" []h~H D G:mԼ u% 56UVowUp#xMk*bsV0]PG)kL Y8@5J\6 mŎUmD8tNhmU0dlŴ$%F@' ڱ[a]K 3RgJ.2oؗ~O 9Nq_Sygd0,zC!ym%xgg ,slm-!>:K vP $>_n_OvS~];P\btSkfޟPJؿְ^,)zz%l6M*2a)~"-9*SL*Rɡ[Ċ1p!X\Y I +Zjg͞Mw4k! I'-6]Y"8"Eiǐ^@_a 1XnJ6E]zmnC,R amdb`7ztO^Jo,iЬDVQ*w98cuW丂n8k1Gjߋ˄Pz6t"nSg+б|(8I1@h(tF子c1'hȡD@I5_[gdE-aN&\xK.rvḰE}1\_}aߑ{ 5A~ u,~O' ߷Lob É~#9K?a[-S*]\ 2嗌&$Wnt#ٕ4茨ʻR̻,Y@cop4=N̬CB߀fD<Ҵn!e Y'_-6xQ`X ٸR(+Ľ9 3d.oMGlDJ Ph|s+DM^H61GҎV-uAzl9{gӠɰɕЪ7dhISyק1ŌPoΠN9uFְ_]]-vWYE )$[AQ"A|՞}ftEdy2Uf&dD2"q@ـcpRV[E.>W=Ki-iԲɵ1%Óy:}$^\rc'i0 afvc^7!K|x_Wu~  ;I Gh;EF^9A{r/|V)ȽΚ\z M=>岦&Vk+۱Ä\\'𭦂 Yg y1sG04e>)D 6J؄[i#~E`Mmi&ԌO:? Ѫ.JF)?͔]1.߬1Ѯ6 h &( c@\7?7A:q2zQ{E LsmCu< ,1GL&e r78G6+*wI*s&wJ !skG0;T4E@J7}2EON{<Ҿ JТYܻΜ`/Q-J&)%Z T#_˒ AѷgƫU͒B VB^S*`Xy;EjJ y#}E{EzEjeJ޴@}P8 eek ّKL) ,2XY9`E;nST_D-̭C BgTd9.r]XY~^M噾j7A}\6aXfr,DpQ0B![Vqǝ 2b &݈wH_}V)zmIXCF fgޑ-_iS h!ݽ' ~sYct}WY)HW靉$14p34w>:Ҙf c$_1Re,!'%܌(Ҩ1 ,ADG,|RLƞWqt54~xmʅ4$1?ZO%UhW1hӶ E)o+[:`|0G v\NP潿.ߦyyZ>Ḋ>%*V^av o?•mcE|WZ]E{MKܽh9˔< DHDMF.։00x̩cs*EWA*Ӵur=D,[ۀ,5OM@bb]x `=mC?Ud} ܏$D 9Y"L1Hp[ )"JY |c c"qUy[J>GrP t B@ *Ng%_]Ϻ_`uuEc VP;e$Rvm*vQ,%Ġ}`nNCX/!ir9L vtqbp&\Kb͸]A1CuX9pZEE;{KElsKYLnM ̏ :8zaP{".鯶]H jOF+*W?L(ć~ %=rc4"muʑ.\r}cl&̎*±Ël^t_X:ϡ,(/ZITK-1KNCGH^^2h1;Te/۱ ހ\R~* ,1[E3tK›&;X.}:pm9Em_a:5}8^ {Az 98#h'"P{ (|e 7^bNQ 53Ĩ/ z9Mp.M 9#]9GDA&`{ `hzdV8%K+J:+')R2J8}B_ Y`)wSңn*T#+-S@tژyQմ1gY=No,wD͌'xMe#E J3_MnJiusZ{V;;y6848ԕ-5c%ʕff$3(g\9iFUY>+2+uEz#~|oֲbc]gi_a%Ԁ wocnLsan?+GC`9$zǤ14?.(iɧ7Ml@8pE҅#Iǐ jzgoP_,&1R*] bGhX h_2f=ijS7쟽dwz~.l_v = ~$"if N&#{ʂh ц\'1U@BkpP}q9u99o?جH *2 K=% 2L"a .{u嫌D^ep@4i= nu?[?]%/!]%&κ_!ӫi"E g& :ъXal2gWF`Yq k`'\td,a9[555zF7ܗڱ&OwF4W91uR^Gg$._kv|>)Maƒ 0zuc InyLTd7.W#hbSE)Cu}x{{eN96S6Wo3Чϩx*f.h7iWmFU\3Uztxq " |߿vR,<|Z`ܼM{b#N<, M>KYF&+YCz><%/lj?}QOi;3$=@OELp!mt@ZL:|[psizp62azVϿ_rҋw߫{i-kmTfOw ~30?ܭ4r6_7hﳗe}p%0(? tCE$vbÇv.o ڴT^-#j76KI*UO;GgVIC M^V[eA9L{ǍH7#&`.&[$QxA :}Uf?jlB>)S`%-&i'|~-3h ,bѩsTiK]Jq5oVX8'7yVXP5 2Xׇ/iŒ?rpֳϹK.6ajMo3ĥ59<9\Kkp-!(}0%%*e-V}12d }6E$>8QC >,'% !qϞrLLaz ("W@2U5{F..bPa=ae4^o|ěʯ5Uj -DDhp{KCW> ܶOIܖ $LFu?,g4Uܤ:[7h{)s&;d*1pI#eêgQ?+# Ҳ󖕤ؗ;Rlxn%*^%36w\szrBZ&-7AwVp34?.7-\ Ӕ|b<#7BrRMޖhUW$z9KFa(kZ%IՃ].U C2}ifi#(@<?rI-z8M!E2qehVPq(v׵jHsN%gz_<=YuqajC%GX+d龰{`=灤ţr[\g4ɝ(+AJ[h|8NP6؂Cv\ c-!ㆣgh"Se{{!T%݄(ӹ[@7d vYۛ?$Nf5[tpDۚյ eLisR|q^rDEAMٜl{{<2!?='^cy՛^ìs-$ T3GN|< u?/6A_N&[[ #mǁǗ/^nBU y?‹Ƶ'WDiѽ@C1^! ٟ>ˎXDFO+Bv.X* EŸsFq]D' <nE[l>vMb4mىzz=&zP%Pd9 R1`|Op4;8a9mי%vψjY%c3 ^JL[O.l|O_I ji+£Kxr9:qo*a`6Ndn'd=**ϟ9[~XY8J6ہB[=tBH4hr'B2XQjݸۿ%}#{T ڨiFp߫UB/)+o&|ᐙC}_76Y@7hȼX '/lk"rtCxD`Hƞ\[U(&2[J )=:jT2幹1W`vX _/f05"Pԯ 9NB*}{aaQFv+&2 h_d7 ~^jv9G>0zER\zOM2Eu %ĝ] _boq!@*A~YfJ ,.؃P ›ۣ@" 6qS)-2GOumABtlW똗޴vbezܻD8cG4 Q00;Όǭ6ؗ8շ~ocH60 J3-pFm\?r8˴-w4P"arH(J0Ֆ5yRmJ.4BJX$I c \ظ-1?V 7>=)e Ad%ۗL8GNcÔ:aIy ٹJjsOv"}A`S#Mc>ȟPo}t52iC 32`CZ->_yY[ "@6u<\i|h V$DX5y)R%Z=ѣ0-Zퟰ*WSzn yd^W1 M1Jޠ)^Y yHj,if(*SIN! ;H-%skT5))qbV%X+6VF0)ǖO)1ɚ=:-XYJ?`pӤ4"b;O`%yy_b ؠI8aE* :|_׼ʫ-):iBܝ+=`%iޠ0X]*ZeS%PoZ} t0RyK(" WƒwBD @HxkUE(;+%lF/qL.Z^}Yԅ݁5*gDX!׊Gnv;'".'Pd99d-͸{IV\1lL5_sH#}zDqWٜ/( 8NhV2(pU3.ϩU+d?1khGM#~}P1z?$4'ʝUk^rul&.o} c ֿ4 뷉i9 CbFP#z_(1](> Ay{E}|dCLI'"oݎWºMm,WmThRݿ'ɂ5Z2tppK3bघ*2+i&<Fݕ?Cp 's\=w b[(f\a} 1KT:+@JG[[z㏖];۞7&!Ϯ蓲3y ߀A*)?m&Ts0ȍKцU†-v4Ve3UtIQciFcf*lM@/Wn45x j#OEm@&L! ~}>=bZO+ ٞԮ_M <Rܷ-2jBr5ܒ_St<΂Amc+K&]I,Hx '(@n'`T?C>y'T`up+K}kĶ sžq5WʝTlLIeς=-wj ^>O#Ŝ*C4fa-? /A(ҬbA]d;1c{BMvR -95A2f O@5 M%{?bD> eF _^\sa;!XLᕤ,ʲX>O"WC^.sI+Nbv5>7A[z'"C\N,Jk%!VAVU53M,swTspxjM38~T͇<3=/c=Щf(/ScwHn,bdIp#& ze',zk,Bi(~y?ԩx>'fhzkHsH_[Y7jrHTf\i` rؘfxםa>-=s&NCnz՞wNܮ(OR-&dtt W;wU8b{6ݤ9PIYoBM> 'U *7#L@CfҤct`ñ!yi~U aD4~oI.MB;<ֻVcEFM>cTҷƤ ZV\I̯YI8W!CVƸ \?T?otJc/G)`#?Rjgsj4,R 6 _ح_;HACÂI!`#P3+%oS \uՌʟ"2"{\mN@NI)qӶ zƤ q)']N5 yӲvc6EU>s\oudw:sNZmП 3%i_c-I8'n88h5"Lhv>?i\mB9*Gחi#Oc8v.-5ߋ*08]gS 5`mN2h<N D.@7 }q/?]aC歷qƽwjUƆHiHĭc;3s9, )-s`P_P8:H?}/@5eJT%"b\c~ {NqG&?7Ay>|h&B MWS>(RNg]C>LHMRN<= PJU>6J_Ȋ^Hg[Zҟ)H[%k/|U L e;H"QF "Ɇ,P xD0z-o!r|@)ӷM^M^qyKhKQ[t .`׾Y5~SwNv:-@!V-u{,w/'wY('6]>""SDݸ^r?K\I`r(o΃gSuMqf$.SʣUp~cy)E[|T hzK$vB&.e6|%HVbqO.oi- A/ j'*7Fa3W_9;/Ȗg@,i@zK`//^9h\kPOsE&pB%5dm,CJK}SLJqxcƂH-1=i't%w-y^OmH4`@@].. [>.l[>ʵ5+Ӵx2veiR>@XNHwhDͨoPhv nza$V;ߛY@(ge>s  t0"b;AIp,ZNP4M2*,~Td$_:vS;UȈ)%/?ϼ7( @+*dd(OTP &h;c,ݗi ,C~_h^A9Im8 χ([aeԭ~lb!̧2Sdbhvń9%PB3 &<'ܻ I<0\; 2 eؗ ;AbьtT#:v4gH ˥}^y!,}QWͷ1*i.OWm2C09'2d#l"!t\ك1avH5ˁ vr;w)0G96hV}!Ĥ4RٮڗOB6v`ϳk1#%D،ngaKy<:0A̵)<0}i!C l{kj Jl60L$#ҹ['UfYlly)bCN jn?Mdžfn̺L:Zm&Boe"*1D7{ry|T!tk9(`%;uG9L,qݯZ s!F`;d" "m(ā% f%R yh{]({EιVo!@qt5/I%+q98BXH`iI4S-ꬱi Z -q{C28چ( \`S @0fy!%XP X m^`H)H4O^-786.rcvWi5d16k`DQ\DiX$t<:`1,k}봻Kl 0u}<)V.j}Wgw qQe]ε)>-uX,ŖF_A6N7w/m܉fBosu$\Ob4eǓb)fZ}֪ܐjiW@z2{́YS"9g1 ۝UŒ$WB q#^ (sQϗRUDS5 1cƨlv5 е▽!n5c)` D ߆)V`y\F/n'kҟ`N(C]Ƚ3`:b!M9"|,p5ҹD? G~d4/Х+BxXKWU*W5IE%u汭~y0ifOqQv=}_/Lx_U|@Z_Ր{N=X' eY>vMt17̿vka? ُ`mWYֈ^@?;ԙ^<]R5\I]3:0W.#~Z\nK@=\A򴛬m4LCsD ^U G"]dԧgp]u  󬽞^!Qc0vD3,I6΅3Z @7#u<? WISh7De[ Aa 5VjTdn+M+w;{TF3] DN\uȥ ~\~2zB(~VawmnCQ{Nhj39My}* B"1sľy:(U3 FJVtg^5F蘲og20guk3҃va !.t(qI=4IjRE'-?CLX [5],̳!IZ#eDM{r]=J?ks—wBA˸6T3r!kEzOYs;[䭓xQ*^lwʕ&wG`5@q`G `jr rO]-{~ ] J<@)-s3V!d,̼~9XyU \ǹGͤd;҉אaNGL^IT={K&4Ⱥ`іZB-9ͺߩ:5[nڶ{lW{Վ$3[1NӜi)D#*B30/]Uv]؝ZShHI{}0T uף0o,+zoKc3klJ&kh8u0bcs`rlk @IPI+8t_%< jڂ&WYIi $́yfyS88ű&lK֚mX5!BTKlM4~hg`D*dXAgk;Ѹ.Xe.eЎ>zvֈœ ' YG8 ZaiSū(+J)T_1Er 6Քw'mϢR%ԁoc}*sq!ˍ$,BC)rV^JCeş-K6;vgg"۷OZFh).G{{)SeCa%}[ ]_(PvbE(l@I{0(q!,3["='Dn8)`7c߷8)J]4XV3'{QeeSCon%I-鏨 o(@5+޿&PzBSj.NXWMQ>E;(,; ^4 .w -We{F{[9#qŸ0b{}E5lN a89Y5lǡ5_TNf-Q%iLsLpAa %}e+YPG>g= o&ϯ_|`Oָ8,$zg} g ٴb)H}#}" rFtoC>Ph$VIV$@tX6-20BR݃ P7(T`6p K1d{Ts5%]ٲ#SJJ<0GƯp1|^=[E!zv:%یaLtJ-'ƹ7:V(͘,5[oQ,a=e&[IH)@ҜGYFzy-ǁ݂ߌT(+zg&&@Oz׈{>l9Y}6^`WZdYrĆB#+j&Sa1,û ϙ7'z/u-߯EgC_Jrhbbp'9{bZ=->S81ɻlXL-S\7: g|ŏ!%%ECƜ[y0c{)iPT>%2Hܖ$i2P+fda#WTiT< R$*+U.lqU+e@!H0i%1wƫ –X~YM뎄~Hm% 4 Iw[cApG\RC U71n`t4u%s~iZB.90nTvbûF.@U3؋js2>Jlj^`2 {j–#bGhZePzv:eʎ x%V}QILCyf)~@CkN-|,[؀yE.źR@UBX'yDOo'u'ȑVxA%|t#6JڃcFBeAd:~roW^Uj^#|Uڧp=PyI T΀3NS K~/PEazy5K|K ־ mjn/Tƕ=OwPb l85Yqr 0 3C O w"p] Ph%OxS1=-,FSۗ>LK+ґmG%k8Jڀqa=+ϚjW9Z0zo EL1G4"!{Hggd1M UgɊyd oNƏ˩<fL8 ធ!Th>-!ڃ$U[fCyw$¨åA`'cn*T b4^=,;DVSX .eIH8" 'jZW5(TRwi 5i`DbJ rmvñ4v-W6ĝ7X) UQwo!;,ƣe[hE\&Dlᡇ%LÁ}l%GF ߪ"CХp ?<%*/E͒UYxtKѴ)%HWZ+X;&rA"t@F0U5(4 VTnʦKũ~lA1$j63M}ffSL+}]# éI?.vlt 4-9Orr{ixxF;Logp,{+*G\»,}im n FrwUGBo4!Cֽo9VItVe$fB,^ӑÜeC/(kIǻ9xdƊm}gLnx(E%{U:ӯoZQ΄bNWD_EDE:\CgwkS]s3[:rhEg/c ˼+y|3C.hvP#+q(1ZE0Y*. !7@(@sxrr|pMÏ h9X_cuHVJȒ}P'"!1׻FK=i^KAbOX0$ifY{J.[czL8iض=Xхpe,͡qC z<5B[tlH̩+l<3ғ%wCn-=;O䕭-$-lڔ*H㖴e^K4#<ֈ,ac_[42LT\}`멱`bw6c*3ƅx q4UPFǛM%\g蜿lZj캙~T}j<5R,)T{-A\8Ƨ2=v鿰|qp\kR>\xzR'@1ϭg9,v.veu-I=X4ˆ|\RhFAPx%X>^lV'}NW^f3\`ys/^h ʀQ W^{ͮɝ/#5*sJbgh &Өa&$|[# Lcw?AxvZdC##R|u(kdsa3VJǿu,=yt|iqDFK3.h/Luݞa|U Ld+&~g"]*]uR^^ApO:bPBLAͳ~Aj2Ap`LUP<^aޝ =<.^dg Y:8x岽fvO46X~'`Xc CHv.)| }=JwlIOփi .*ei?cbe4cŘ4<>bNIk/R&zgx{ߐ\RYF|/Hڊ%oYyBYl5ɉlzPpun0nŊmtoE[Ew  yc;1x# *ZǺ};A4G걪ZoRdTm @PoB| [M,,f-ٜ$LM'b̑G6rtʌ&/kF  ُp;kSn@E\Q&}_uwiߺpA<5C4EߗsڂOKAolG\w, )!!PA*=sXn0(Y l.}6fQzl,k\^+^ z__x4^!F1GKM7"i4 nf<4%Qi=\Ayc_%Agy_E `ez}!E}WO얶?\4Ѣ3ԓYY &fQn0XI-4q=J"݂E*EiųRa |;oL>3#gXh]n\CB?js fu9 zVةX*əH13ְKQ>hLA;ݸ!zd5!iʕT稱F2|s?M[u1,K>zO, EtQ/o`=BAs#'];<>ǔV5&(1=mz(F%uψj)R5#Mv[fl;>j R2 N7!t</lWSQwE ΐ/#mBI:,32kj8B"Ua5(=AM ´BXI)x5 |{zU_k/UCDj2[D`8@^D{lo4x4*ͮ1-V1({oCC 6ΝLx|L{^IU*+P0x₳"7m 9*$4;*Bk=z.˞4UCd{l4Xk7`yGq2oELȅD,{s a u L!i^v6C=0ɂΘt.hڟN{Y0GˆdQ'!FCe'O5d|rE7Cwpm8`Sn"m >1fA#9/ P=M@{?oSeګ"ܰH3(Zz-\T5et89IUck`_1w(Ec)`Pq./HM )5Q8t\ryX_5!\lԞ6& `]6f-)J %n MQ"uW3_|jWHs9a:m@剎l*W#wSeGl*I̝WH\v~ 񁬵mY|-naާ$榺7eښoFx5W>>2MǴL}qFC"7Ljvwo1ѿLk*=9SbNpUb*BSI=DTv6R"#Ta*ڿL,uVF C @Ƥ*'2g@:+*-O}"N;3pt ?~G/)};Fr8Lɣ=(gi<9], ~ƈm龪vsLϺO]V^>|SCWO̷ۇ\oj8t+.j aQ -bi+U-;{b݋ G mI7U61\OӖ|&qz_R~*Mk=xlXW3.,[q:cm8jkͳikPՌi 5gttp S](rl [\j$ڃ/CJK+4MmDZ91L5x7F. -G&Ԟb%cg>IX!м<*[Yؒ>4sc ?mĨiGka8^) mo><2&rG5\TB۬*[jYFY_:^$MB 2O"'6Vh8rdݎW0+Գ/sGۤэ7_wNȘW}$mDSX_*dh͹3“"րjϕZҞ5Xmw:|S`m4qkOjI*Nc*i} >)(H3*PkH]'@ӤLqPIm/.gQȴd 7XߔWv:hr&nvi7F/WzCas˄F<"w3HLr@X%D C7f ˺rH!= [pd '')o޾R+bw:Un2E2 Y{cWNq[E 6#tHaF֢1KnFk*i+X܆MNkݜ7ajr;/Xhrup+@uFE61&lMs{UW~4$KWT=@\ 䌴*f-Gܮ5$ge, Vm1OI1 y)jiLxz ^oyRՃs6mq9ybP 88\0kćmEXBM89,A]:"nC!*s䢐ex#&Z45ttc0@0QDd{"=w.L^ڢ9 SR93ķ\KZj)"!a >E@)ȎpuuP QE딨b]jAT0ʏ 9BvY`@^&ǐPÂyb>$X?gDκDS*b)X"}r"ux'B&iT Vd5A[De+RZmpjۢ,8Gq[| ^ffQ8F#Jm7f5X03y2Nܾz ۯnx*;CC,W8 ŲYākqf)6Ei_jN׀`LT?%Kfâ.!<:viUk6Y&cp۝~cK5誗،_ <[3.mPU@㘾oL~6/L-3T=_]C$rDn)|AfvIH%.6bD,(SDvւ :fXk%=vl"MAH#^M66됍žҥׇǔ_;T&MOt`@HeK$ Lգ@X:ϯ7HAFSf(ص=҅ -WSc(\;$p.DtdRp|`Zpl3TΣ%Ck? qrG.ҪM[6ՖIix9xѱ,y32sC6 WY2%s-.Pπ-Wsxԉlos?5 nRd'cgfp /UtÍ 4̈ eS6bH+'2 BEʓCE,u<%(y.{X[q"ʠ2U+ "0/e ;ˋkv'ȱ"AH܎q,4җa'A{LVJgR}KlY |T`$!I Az}w:t314 QFL8̪Y3uhٛo{ͨKjܹE1)) fQAg7I$3*n%rsg?N_eyyDR`yuv{e? ȯH, *Z40O"wU}h[?[CN]qa / i?EH>w؏ZY9ƒPЏ |KGߠ'H*\ [jGR4GS~T40B(nl?>) `,19 Tjixl8:7hXUFa ڭk\ qz9pN {Jv&01*!\7H~= t<d%!Rtef 1X8\jnD[[lO 5B9kx*Q\}S$Pe{3RxEڱp n7YP;+4晹VXQiǃ717/%}o "ii#rz)Z7GWvaXܢRpa LpɋaWVBGy RcMWwl[D]ٸiE8]}Yl]$0NKv;B D( H,0PZ"FpZޣkVSprS6aܺmbMۮ#z% ѝф tKRXLXNKF߱.r9ZF29rYA6j]ok*52)]\ʐ0%;OyÈޏH4 ]4A4OΝNH%uM]ȉ|ӈݥ.vy6˥"I2 ^ElVGv&Ȫ9jہ\mBlE%_ J~HiE }CxPȴ"&~9fzbli'jy@xS3iujXbP]箏;M`@tY=eaJɿTFbF<>–{gq9! >CQ#W/(4ؑpM gͤN#LJV=.=$Y!zV+;b0ZWY {-N-}J4mBd#̫1-1?^P?Mtܬ&]\:xFo&LpCP:ݵ&A@ǶIvkѻϯq=w|XդTm0vxW(CkX QBnT~ul܍tdQb[Ǜؗ/nv?C! ̓$ ڨ Ӷ$s h(ׅ d b3uЃn q"7Cvd^E$(zpSs Y/{v&°T\o;qQ/MPj]JBЍKM=-|6uۗ OR\G{&%fpUVL{ K.&J 1NT$= dgt_bm"Z M!BY#R$sy*j -_e5SOn[lJCvBԎs8!/ԱhG`@g'n-nU҉ll"wǤ]0 \dų׋U}t@P[ۅ L"TtgR3O|?Z<ŗVND*oy3I{#cT !lSXEk 9,LKO ҋꅁ~1"y03?‘ĥ]١ N*8.wP俱29yvMꦊR`8d˵&IIN摚7p:H%aj r|ӈd^f IWM$ڛo[f)*vVIA-J/N%WI lCH φJȧ!^W2r8zu[<r{L|weC}@6,!@1Bdr0)L$sۜzx}„yd‡/1@C5G8&+YW\һ\8ܜUZW1J(ML>^dN%{LF 3s_̎I*M-"S/w}'?I $ah/g>8gH _8Abc:ճ MTB,Bm$gp1oДi޴`ޣafZd2}kh-P~> sEiɮ_0J^K<TKа4g, ܹ1_1Q!K5* !?8X\(p̜z:U%[n~LqUdTW^n$7:wӧ5kPqȶ]u2yTDp|bQ^xF@<&a#-, ˲j^;5_e 4ܬ\yMFW^qC&mYt9NC &7ȟ=E !QωD)Y2X6Ӡ{) Rֆ`҂7M1P4;>:Lrw-9t'Įft!HPAvRO6|bueT=D5O$QVE.e.0ʭ,*G[LeT+K-|X8-Oy.<"X%zb5mLdMzw,#e[>6@Atie钶S+9#:þ8=P(Vɬ!`)Am-MT9bom_/tL }Lhj7͎˧S $ v3Q+I|Ʒ+nQOG]QT Ƹp< |yλQjcDp+PaY(O"#{ G!笧O*fi̤LPL^HwuYUX{u K=Dj)=%|ف!lt~X,ą{,fXIɬ.ȳKwgzn>1 ]f-lşs!w'L)5Yևpb8p$E6g{n9XUZ pNF>Ӂ \'ʌpw >w)nvDՙ>h i'Kq0DĢЉ 1e&g]-P*a@٠kP'Rv '݁1L{1x ؃_g")=?MVahF܈9 -@QnװTYQӝ/Uwq\U.IJ{\prO^?1%o>g W< hWb  4.m! 61j1uƆ!ѿM>*2fPo1h8`XHH]E~1zfh*7]#۪HPN Fe4cm]aƲBscb||x1Y1ʯb6y)Smba &(I.)Ou!ꩧuPRDaE;9xTzݝ\6=IH 1$X3Q1˙WOA~->iCon;`fTrS/fh>5mC[@'DlbLȮC)Hl;GIzz%؉5WATʴw$ 7*; BjzFMDb0f&lGWZ)lfro-ؑ=ֱYBdӥG+lRTh[o zA̧Kg$9Y04M0jc{X x 2JܶBw }džbo t dc}'/0O3D<}%&ʞCffB[ 5v ~i_ZS /&6jE t>bi$F7sx~ȵ,sG*tc@FB 39x?p-[)7# ͊+)TW&dEv=y1TN*+H3x2g岓 by+u]\U6SBcH`d(d|c};-`S4݁ aP;CټMvi3''zn ,$.gj!1لu1`mEi3v'79&БȔL3RT½/IҠA`i5åXf~ iAB 8nO ./ }Ӈ@N^ĘwK97X-#Llhm,c#+aSu=X< qM=#O2xU!!.Uw(KMa5k"Z)R)L:\ƋEwtmx$cC {"$<QxOn8$2Ǧڭpz[rKz?S&8RЅv=l},>RdNkZ1K, zBHv%U5޹\`;vj'.R* @*BPWA]avQ+t96Vht\yNAn[aeqMI0/[8q`f=KER'!5 J&-r;)'hJڡ^hy %rLFFնkK]4u l1sy靏;}O&L 9d͍`b -ګO]x:OxytSo#*ĪT靗5vy#?6PAE_H3SOU^P%h)y߸PK):bk=ß0% =ק&5?H7/rW؈ B902`MҦ:sjݩt*{15+_[Q_G5Xs0D 4n~.?z95m ȎEEJ{gE-5tfPUz%lsmY tk(&61s,l`5>HܫF_fX g-x bNY\ڧCӰ&͘@ RBZ$IS*Vj{l]sAY}{pEKS.ǹ6߂]KVq#@F(qltnW ł=eHQRC-xZ.c㖛m<Q6~)W󦈸{AjC?*d AљǁJzgK6$\N5Wde0 ;Ȣ,Ram7>|k<]xyG\ܣT!,er< v|SjomꮭnvD}!m44AI7DӬnW.(^ٔᶷv߱ ۋ$== Ad pTR}\WG "S e$ݞH)įȀ5#6'?ׂHu/grl֥hlO`0OkǬyvB\w8Ђ/!H&d5'@%EG.eH?3 oZ:V"}'])Pt"Sih49U|˔ǼIx5:'F[WyNk(_DURfwBYfN!RkCm2sG3NFjDCT;Byg2TGK@Q  r#ٵQl(G !M.eܔJNy3 ҆-7!&V"2͡D;]-d<=㭫yD=u](‰EE# ;el7&7ap^Y8Em_\Sd?٩¥/8[9g o -)^|e:y(f U?NL1Ң_^sy|GѝFP{NG& %zbɀZ %c *Y|E¶NXJ:}8qALrLsz{%(uiS5SVB@@ Г>Xg- _>ϒ 7aJƐInPͧa?x'M.bKZ 2*䒢ul*>`P^}!sO4:Yɲq:$+}ALqpٿG̯IIV:ecJ!;Y&:=UB3rǷSlI߭綜& ˲D)NbYAk@Ğ^֯ߗUbCHJ40B́I~y%X >NO)J<%H 8MIi7~1]%ldM3_<!&>7 _0̦ => HQl^DN&;X'E8$rRe]xbY2-U=o C>*w&ifkP.Ċq[m%׾uZ},q)kQ!ɄD;N 29PIL7lyE[Qc%p&ZxUkz]7eVgp$9D+R \;~+4G9.? !sLqgA{l'1#Np~`Tql77EMxԆ *++'Q"umIgT >XA22?g8u3`Se\Mۡ"xӹ}p!0j:;E~b\ v&oXɨa^q"NĻΙkic>?8 eamQ\h#؂pGwd G]˭OLd  k9uOHm@Xly<ugjg*Q7#.K6tg 27٫"^etmh6KhJ+eØW¿Ou${rdүTcNs^)#8ͷVE>Xu8q=_wKXwӡ%#F2{!8 Z׆{XA0oFw XVFT֔&#畅)f+7W;M'B?rU`z%`zupzWPp|+ۣ]g+Nq|i;p,0f 8Yȣ?9 JfGZ` [`tVp-K" k|*S{=ɸ߉Z6& EE5l:НǭOJӴ@T yͳc;g lZƌj*g$ĤJ[!H)w#d\tѻVmq_QNl-M޴z D&tVSе7G0Qba)R9Cq(+МRo_5*8 ߇dg2kYcVo:jMY懡W 6c;bYߴ9KmbYHdAs}`Yc1 µ8 _+Zb5ъ&nK,rsi]l'f OI^Z 9u~7Np# ?Gg#*Hc{Oo>@Y\as+ޝ7M3 +,DgB'k}*{SJPfg[-oW8elɹE@VHF)ެjUƊ"|Yt?w <sxJmR O'$t0VN]~Q5W- CGƃ\$x61../}D?4K":}<Wp)#Qry#T[AE,`#ɳے8plt]N-j'L;%$.05·<^SS ?tѓN9Iǎ$2q*X"['2 d]fDzcĵiv:*ay|_f uj-tu\NM (E'2g[Wΐ RCNeI)Q%6=k_26צSh>mKe ե fJh>gnUGr Ұdz꽑=")jbЌta7.4=Ŷmxs(ZEr%Pi%̽r?d60?{ eu$rb:AA4jKi{Zɤ57+oYYÿQAeF 8ZC V6ِi۽4_- zqF>W\x` 4`'C׵%uzf}d̲a`th؈a .+,A: g30DՁ+g%A*QÈ.eb qCO~g-@<sLF! x(Z82dt qTDyS\%!<",F׉[3bqJL;! ,A r$@x֥_WX3_@ x2-U3j(S-D ;j<ʣ(WXIf =110nn*ZG1Wi2bI pme9e\#ӴI.O.sU}\3!+| g m3WϯuKVv0`}Njv^9}PӃ{a֥%)HLF-әFI^[h8yEtS.oxs~lI'L_?6uq-7#$*gG]/Zm1)9^F\yWv;Zc4"WkۛuMTgn8W+RM*?`Ga7GŃdVCZ5pǥ7؋u1և'm>PY{ )= iIا=IJa_vvBʽ['  6)dVwBeh\fk.pV >}UBj3`fWiUxs˰Xe@7#¨ {MŃ嚟bozE˒>Dܗ x+>;j /\ _~mŖdy'aV]Wt_N/>-K?y`X% ad&'VUÚ }BUFD,mn)`[|,0rj"Mx\9G'97UZke>PU^Fx|Z%c~r@#|z\8r΢x><Ϡ^]PñYJܼen-Tj&< 'Դ?\9ag@\4:Xʍa V@IȩYUbRy ${\*FMfKtu  jc .*Nn<)"]6&7-(]A4',6$xEĴ͎07^a"׏?Ցý: KHGc͓@~{ Ckn\S{#LDP{>6+K1==Ca7[ai*e`;eXdN>pk=KB+'+{ŢGr'w0d<W/ dyv^zتU]d3UK)͹gwC;Ay!L*8Z 9O3T7!sI:('U'@ϔC_R+~7Hl1Fӯ {AO^ ^>rUq e["m]/yJ?P5AjlXqaʽ- ԬBEy#q6Mo5K@b&P@n!ޡjR9'<hz_k,[~";/5G9N\U c1B (" ~s)kg5#=QbfURh1#H6Fظ~-rU&1հysbj4FGњGPFn7Tma2M-Ҟs0Zt,TFe2޿rG4Jd͸OH՜~:l&xId`2t7Db.i#X K!uutؐii2P4@(|3p( 98Ѭ;W4n-F6\wZu8m-o6[em?%?NS= Z{hͣƩ./g;0߫,4 Gva>nr(o7X]"q!zm);`>4YBHG:}/uQTCxg&, Q5"T (wPyڿ;7*DN\Rsb۟+aAC߫>ǕwS7FysO'D砦 &ZCҎbMR"PEGKIx'aKI`5 *݇UsJ4) %RTt>!VD^yirb>?C҂SqLJ:= ;L:wð ĭ6)wE{@Na>ˣs!9@Ix۰gגM&xJ܇h9ܫo3Li#,ԣVYW;L X!Q4ɲ6j7X B.l +53"F֒, tX]Ԥ\{NEs;EmbػϦ$7*٦ \ xfxЎL|j8d LHW9D"M{;g htjo T5 \Qzd>g| $5~Bw9*4hc|e7`h7߶.r9]M'B({nj ]Z0 VNIyG,\h^3X2VКVDD4hJvMiS@yX+&Nqz`JgOc&6 M˝ 'Et匧>X&[10 $~M3 K+ #ʉ>CZ[RwZ@I[nպͽrˊ6=`#-xi (@V@Vp_4ɤ5AoJimPY~8蚱( G"A~v=2r|Nu=sYmu-~PκD*KYN]~7KX-n4L8]u%HRo`fULn+>)v*&E'>AIMk K`i[% mW8I53>H8BG0J˝~RӹCz7 HT['r=n& LYT_ 6]ɤT0s9)P38(9,Cѣ. ݑM(R -˜[Ӌrzpꑒوl5?f;\Mjrhn x; Q Tsq xV}x8zslgYGHiM, `Sn#2\GXMȅ^~ͼ0JEYw2T;pYh1q]<.= HA߅![8&v>Zu< 5H (ED!<]6ߔ?`EpB›5ܢz`h;šޓ!|Y^!3 KQByMHvX'M>?vRr/I՗Jop5I0 ^Fo}JjZ+9 o_,nIs蠰[/!emXWX[@X=i͊ O$ղHTSGK>5q G >u*G"hO++"l{(Mx[لh! 侉k;({Luћ xv|}׷ow}0>Tb[0tu2P7R (}Zv7ZSv)D6aXGMyY{ץYŁA#f+x ^YsnZ7B*-<>/?#83kK{(GUۯFI$. Aa@/>QMF"rY)v3jO!5NL֐M0Z^n׺X;a^,Ql|\޴ɣEx;hTdgfݿ^:Y m;(5hKn)杨θxOjZ_Sr7J ĭgS}r-\CzU!IK0K4'oNQ%2G|蛒>c p'&){btz8Rr{bm1>s!rםCW#uGC]|]~W\:u9(ķCO+:`eQ93.wp Ԓдm@3 hKu ?92i@`JYQP]8bɱiz솜.]LmFVD*e@7i-qnKp =Kv4+11ŁS%_1j}PR֫\~>/9fDoEX:Aܠr@d~pl-ҶC_؏ԴXR*}a[vైfR_'Bܫzqg+c-ڞ2=Ne|#^fj((*O†‘m'd6 H7QX^֔=Dd Ϭ:IS1B%tCi%Jx,uF nugRx^bɂ8HfNmSg&u(˝ \cyW0iA-a+:дTq<[ 6cKBy^ C謡Í؇Yiݢ(tw&T\$7?%uSu"Άrn1UphOJG=Cڠ8OOc-8u B[ݳRX82f@GVM8]X L_cvXb<ٴ Qz}݂OիwH7{ft"r?iqe\J=.nрFT:-`=Byt,@NwT$Aܗ؝*dYJƚ\ <[;*tVAKtB0cLixmgr^)zlm @3+D|#=P2쭰O 2d"W\!( wE'?T` c90UN>Z+bq i>UUY6u5Źuҳ% `V)x^M fV^ e}Ea7VLVgKJ$toPI < ?`!dY̴loHɌʫqPMy?e$Doj/.OŜDecumBNA{-4QjjִCBAY" O27[-2,fmRkzgvrci1,Pv*6ZdjK$ڊG-,hFV6"t?,Y.&s^"7o3MHpjM%)9nux^Pq{d#hfV.C[;Vۗʖlq8.ʴR G ?<ktP dpM .̅"y"XUSz#xuG18OiAG;OV?^DVI$<3a$z+UT1fXDM< sc :%=mp=R\t2<N-G}{@ lKфAFh Oh JU32QlW}?,`{yr0@~,N UM/[8wug׿[Akӛs$vGŰR2{n7(]:0[]9d x]Z#đnd8e)˜,L",` [br&uajUP@(!IaufKP^%mM_WU~平Ґ%O@SSwWjAqQjc5DY͛N|>R@Ϗď9% `--fLAYbaDv 0%/}pA*# ʳcn3Q9j8ǬkȲ XLgMes. gh׹(rД 94tA_..\kl;Qky&yl^ ϓsr^tlS*#,.:AWvtw-µ:חCL|`pR[;?QH1vIcMLE:@:33$Od62L'ЄυJfmӎBGL4VWRw"D%HNv"C5IH )pK3`x*4/ثu.ᶓF?,t=̯щ5KiN)[cj̋I*wTڎͼ#r : -Aĥk" d|!bo~ LU\,O#w6uG@PZ5,{q;G`+Fg=&f+`/$}a CO|ۍɞ8[ѩ~t =T\_z a%4]2.&BzCu({]sA}oQխ]tBc$6`҃~"18bpZ&L} +I}?w "خʥP'ˠ"kHiҏ=3V b9:?3H'D0{T~⦡sRصnQa_joU_&ẄyFqx􏭚ikECpEn0VG 8c6jXŪ{59D cE!^OJEy 6<ٍt;j$MB꛻^~!qy!KٚH^oxrah,;!ô't" . _u.ً$%7q*ƛ~]eӨpoZi`5 9:K(RLʣhjKq.3,}CggOz*ss&QvDz~rd.V^7v<dV&dzc_<M4Ak*Xrc |9 #|a 7\2qHYJh҄. O%s˔o8aWykLXZ,ja e뼭2McpӥiXWuK{wmeVxD1Ȁ@ׄ3?>=%oPI~ep4P+ZEZ&+ <%HUjf܁Ztv.jD#]M|/1ojImUapWR&(Ca2Lo+"6"{Sg󑊸EYܜۀbҕu4^^gPAF)~>`&fFgKaxLW }zC]Jo֔o2D*l=J-8+N/ 3:tYItK53PbkX>J` hT cPu4YhQ8UW<<,1슕&?ͻS ')7z^ f\2 5Hw:J-PPr!&6AVroJ- >Q_!S9Dk`#8G+6Wx=۸B{䆦L6@HVJ͎\(0rlZvqքT^*K55 %k0!$j"vD _̖ əlGP" AC7lF45E2#yre^*2F df?Np5]x8Dh;JQRYnvchЅKˑARA"wUV>Q715% ~HTN&7^j[$fʒ4\60,Hsv\EdK 0e8$F3ڊl6ҒNUm|DmDXㆪX Y 9x\\|_.t/ j֥|KG<am^Go>fr=&.y@UB+hO? .#9 Ĩ%m=-c6'^2k~AV'n}(ɃYaȚèL3s<@| ݶiJgJ09RJwIO+l7G61AV ɛ茗xr n dSb"(B\"ho).=s=l m&!=DUX^WM.`(N9"+Y 2iE̟3qsT i/N`#@Ptъ<>Sk}wrO"2lbj$7qǏ<'w0Hs-=Zj|pN =U@!HQ,r FHK#0>3) Y*9%. ]7 F+kawRB| g? <AX룣C <_Y75N{ṅ~pD2JN؃RѴz1TӇxɇ$\SW]_PB ȑō_;)`Nw,DtE'; 8aP]Y:To0D?Ưqu՘3BCmB"xjtHYgduD1wG(2 i- $f0U&Hch,NN/H?ށ;FNё£ĠLGն\5'Zd}hD 1~N]^v:_jUU%;vScL ~c̴6t=TbAbpuHX3Pg_IF`[4lk6҈kH]N@\/ ʑ.4\Ahb p0) 4'F?BׁJPx033ZwGQ CF<PHapt7iaG:l!o9ܼyAqQQ]&nJ4_4%$[MڟչSc_ })~ٵAWY%^H'r^C2Mq3=ߐ5 3T|go7`78#U˓y%CN*L3s !"^oRAf _ފf55VBwyc&-BT"Z'U^]+~Zүҍ?`Ρ@)hS'zW]が>X@Ki(^\{Cśg͛s/^O7|{*7U"!1?'E(`mO*񝟐̗_;"ʸ?\eEO"\\~Jez.QiU rfأʻ`(M5=E}*f#ax 7$<sL,5 "դxi߯"w1A$P@)xE!Q$](xȁ\QUPPか tOؘ6!@-AsA%ǰ٣)diUbP;1<3w[b5 3ItT\b"m!ʬw {}nt!]O0(1mxH(8aݹU*֠锲u_X-lWdw"2 ]eMϼ੍͡ң%kD MGL9~'Hs`xg{I`bE!|"+tMw4C""0^9֒FMtVQK%҈`MPd" !"1:ujz!;3CiA$eyHCjN_ʓ*( cC~7N:va(j\ +93Pg jw׬3^nm9suT6%QNfN 11WP)ӯ#$ }hwpN8e]OCt@&LH&nb*#xC* V6..J ›)=YDg9Ǩn?L3mtoYōkqf5h O8b_L9\Zkq*2;5@!?S &{O5GUW]#\hzY4k囀`i B<䂢;l+vYVL^f+yLi JV]c%:ˈAy@g#"{49z1̧;9̈́ `-Dt.0 rL~ ĮeZLjFꠐ^κpJF֩^8EBy^|*{tQLv~<!oYgd?ag+A=TvN>ucPŢ Xeh>Z TFlm}CRhSNYn&l!m 1E CJqKmR' SgH|; q ѢVL9j-Э&u5|qh4J:pO0>n&<'X_h{n:yl&4"#BL ]FQ`ts|hzyEH z@86kw?0/3_fF0G'{g0[eUī b4yC;<"xI}-٨r$U B0tۊF3%EMWל*lWY@'V(OnÙk-%wIAWF7hAh0m3pҹP݉K4$sU(<|vIE@mLVb3yrD߸IShU74yz7+";E*yGnz€3dF9'kF2C6Ds֣X;I %E YsG0 U!"5!r4e}_E]T;4Bc2&;DWRN(T5_VXY çdF;CޒWַPvstA-nEǹ=ClL$پ|&l4%4| K^ ޣ0L!+QD9LEE-V=07{IcYpL;Y?M@7`ִlaΊq[~?YĤu CJVr@0l'DÏ4UƩmRVYא^~GRe+M vAUդHFrAŖr+WO؍3ly+[!~QוZ 2}]ޠ1T͘>{ڑKF>$AJ+YEd,6|6&G#]!=~ a%FȗɑOb}HYK ~{ue\gR!Toᩔ7hE/CuK] > UW{;TU/PH2 RK\"fC}ZFY<A䓏10򢣭*􋲀XiQ1di@;Fyo% w;4"SLjj9WŤf>W1`[@*cg>+D6-%p:ؖa,5IRbE.yu-R)+dtJtHvudBK]kR3>MCj%%v+HR۾v:t5 Uզe9l xPʤY X"x_.Jóaƞ<1ژiy;MtҰ8ͮU!{J 5qrFP)&1$bf&.f9(i!c+d9xSˆZ'J^:/n{Zh2…u#)o/z盳Md@i%LUˆ`>]$ pd#/A9c^f^@ 3=#!sP@8ᱸ~ Ԕ9w\ =r+z *5YgaQ{klj(?Ȯbَ ).2C؅ځ-RXx&ymI]Κq`3SDjI kXJQqe{ ")y<ぴ Ne'~''_4_زuB%aGr &Qa^yb>FxyHop onqa4cyɿhC:+H82l[҉O&nkK"! 6 /8Zkx^sCش e1JC!`ktcF$[4睝cxm=xt}cթ^mVlfܿ#?: -$^8噼vA,VrVf7RxjL*puch(:gK~|_xသ>uqrTOkUM3їY`Mw:07,鶨I\ГO*=-[Zebݪgcp5бȝ1ݩRGS 1\m}vxJDF Z=ŎK[_n4ܢˊ%>&VёQvΐc{bTQ=amh5G˻(09 m0.l ]LjQaTе7!Q b\t:=ϹcY?S,;7%^63;tT{Cv,U4= u!6 jTLqD_U %q.6?MRCa.tH_ 2 6Dj9)Y%ެMOZbXh5\5!1bx]AEL2Xbx2 1Krbigդ~p2IӎW'r7j_⌽}sd:~O]\k,,܀(4z8bp'B6\>1 gT㳌z'f2G ͕eϩkZw]9hs QvKDBO3"4~^X} M:/(s.]6s)uj:PdwTS(k`@碧9lOh:FJx|~T"X б* 5X践]BYoD՘N\ !-k\G Th".`Cx:?^JC gk# ^kr!yHc7 -;R] .Cj;V=(5w' T+f89$xvp)bw SԌ7X;F`'$:Hy~7 &:5 Z2H6C|iIW5:J%{^!+n<@xTTzE-pD:%ռ~.n:d0y>LR^pvQK G\$Swwȣǻy>D=6Bܡ2#ͯ^iU>65U?鯖$4R!hG0R݌ ܞt uOd_: ^4$K{$8"'k-#.嵍p$ T/(đ1RڮQQ-Ư3ܮa\ Ь%{:r®C+:l)t"v) 3erm[uwZˏQ@aVɀj7Q/}vX2 UR]: o$᪡Oi{#f?fX,)`<4@VM羗NY"E7 ciA_¼>:dK֌"Hi\7&ҦÔc>I"&-UZђgtf^ʼdr.t8B_t~RT=mL5Zd>OM;k3h O+ѹzg]Aq^ggB`ɳ\YpeQRg30˒2إ{lq'0[8I x9j`pmf w2eF"ҙw$hQ!З/ ?m#)c-w>1 HX<|g bO84>py+t_`=y2YGHk-E LvF]BH+ZKw͒_8;BFy8.3B(S=cqx©#xS;aTXϭގlc2qLjTxNj34njBbxxwam}I 7ajRۥbS3GSFI\2"K6,̦BzC^VnyCoՋFW ¾ h%8NvP<*wV˚5΄DhO oC"Ύ{Rc|V"Haj{WqYehJK0cki&?iTg$hd]D}4%([ *< t}YYx Z {Vi8[ i)G-SbuKAk8zi?ȣA%0i.i F$6_H΄k#?h  S؆xبȰ,Ec5;\_WSSOtR)6B|gM=fr&np݀Flhc}+ْ_8…EJvڇ.m4OlE%](~ ;+C@uO^եwa^(/gs~JeCI*`óUxv1_dm'U7ygٜ΢ G '[yƆW@aLJrI1+(p7»*X;"Ve6f{%ZuC<+/5:{*bRbZ L%nہһ<4KHqbA[ y +>"ˇXDAbT*4˭Qџ:2u!Jⷎ>`.(DVتpO3v0еc$oRdD_>j BKCC7>k`mLrɉ\+2&0o8/[e*7փLv (ӥ4.^b&4*q k[4.c)  GRlLMc"!iۍ*g' :17.A5RP}IL7l4 /+0*4!BV2m]p=蘐Ճ o\YcL(8͘$xayA4\氀 [BNm*&{8{1Ʀ,! ] |@ EVFqr4ckŠ] 2qe-*Zg6;_<ޅ#NHC6'Uܗ_BIǜZ!?b.~Ϛ2$xn 9j__^'ڶN} HgF)Ͻ Fh@cyFXdX܋R"ٚ53:jZrx'YIu;-ʛqe~8e@m~"  >팫N'<~EbMvUwJ(f] kG6&_ƤzIKb֮a< c+v) 5 8S"G:J5*(/L?@V"xɏ,g۔iWfKl (Щ)gҤ|O~GI{U8YtRijp!9P;"1FohP;= ,@` (_*Lz@s57A Bb&P5hd{_k%7 |A v~o(ƬtGBU"a!~}l\;SFscFg621m)*Yy@6_c{A:2fV4~ASТVz;=c-p~# ,258[Z I: ~^!qmuLKUC*˦SN.QAu鉩4N°u#qH*kzUzhVfU+&0vѧy^ ̒Sx'b?8g?,mcD_a.#/A=zv(ѝ% oc|CV/EcǸ@; %~ֹo_ǵigS1FUڶhn_aHV_q|ZsU?L.=t1WP]W8c'L#(#vLT##8J$Mg{awqYՏ~5ӞUN}꽾.+*uOo G5JR.An)]0(la9+IۣPx4][rhhHcloF*0~eרk琧=޿sJzP\H5eYE1Wqp mnN{J>Ե  xǘ*\gȧPА ^ &jX@uT5"n cLA!9<_V-U3Qt+N3v07tKu\>ǝqr{0mL$Q>2⿬qIz`B/N]1D%>hߊWX>dmc#|v+9C!s]+O ýſА:aIźOqT8(nZDodІLg3ՄY;@"5"-+Qe#qvƲӘ6DgG3HdpLXb8E1z rH1ň᳘—aG)[W/B{6@0Eфߺ$9q|{v&B'ToGJ|[+qIjc)_k Dat6{$$W*ŘʖP+@1%[:Hꍎb CkMÃPbl6zߟAoİqޗ`ؐX?,$ \!G5~W('sǕȔh^g,C7}42lLY6) 1k6($)FG|fefy QL[P&Jβ Xe(HG|ܗV(52WXk[_3f:Vr ~NYwN~nMu6(6=3**,i%`WQI{E1)E^rpGn~c|Vv֭lk!C Ey_ s^hpgAd.Ҭr8E+/D5-@")ӗ<Yͺ#lM.Ԙ%h3z! HV0-Pӊm5~yH~I-GcDPw`W21T7YSL+Pal&Рձ CN<*?vØ!~o( c: *ESZh9$veUXty?tx|'c&Bs'e6|LzX͑A֊l^iY5KԖ1NJ]P3D谝%ܭ_'}Տ> rtƼnʮ`>wK4;P/`1J:I'eZ S3qr[g|3[ˣI'r AL.)(DG!#ό&ԈM%wCڋ^e.<1M$Ҹ6"y ;S_CMv H=~/ƌO7-;NA_\>BXƧ@!D!Jg#aI JXk%?A,ԟmր!:DD.3 :ݮR H 1zP0xVo4 EkKu#<䝈b!tw‘ nq;z3Yr:[V< =uH$\1u.Q.^Ӛ|J}CD-(i~B+yb1ŽI`"}j\yD_*A1")\f%9rpHNexST}KܪS_zrnly]8c‚d\O])uS[ "whp)=$V$zw\%m`aToՇ"pHjZ;{Y|BH1Sse0Duhϋ3Fzް4EF|Kq zvE6 qs˷ h ]epVyf/QoQa{  ^zF WxviN#2,a-?yYQ0&ի}>p[rpŖIqT} ڃ:D&O;AtxJNp_ =z*:kAV҆{VԜ,6tZC(Qlm*x(M=enq@wwd/4nv *uڶtz+yN¾ř}'&e$5.t.wOOO($ыkeW%P~c֓7EI^AWy%JoqԐF E3"c)Τ)2XbLfXh r9 N "gybNKjNpBNG,. bׁ`4p %+? ^RKh'y:̼i/{?J?KkEl]+˾U=H E& DNsW^FP儶Y0Jy W#Pw7 4fNrY#4ԽDOoUwy 3$=pk5`D3CB5zL&o\Ǻ}+#rW1}֨Jh}j -4F7˝W 3rUOV-? ~ P?==)]b wiEuҥkWq%$#\8'Wr  omvap- Kx̳ TحJ ͑K6$RߤE?M})_EVw\W}E'oy/oJk >\2r|Fѯ!{>>|`$fZ`0lLizDn=#_}>B Q4e`s/)0<``/ECɺ4`BbAu;Ds Z6PR+-Wr9~P7x8G/XW_$>|o:4GiM⍜c `_.bI srEd{-<"a=F^vcNh-'son P .!?i,.ϸ!ƠA;4-~}z+I&P4z{AAO -^'5 ,MVL.nx\ 8=*Ow&,7$#$ 䶻اq rN "%L:٢Sw^}26ٴ'Ps]x,擝T),id Gb}ϯ~",.kR}Xel?FK@q5/XTzu)Ej-UAP@P𭛌u7Kvd|Yol.} yxTj+DuXG y83Bx(\@{>'^9R)&dG6}niϊ4oI K[ )11i B5y = 1ZbFY[-lK4&+:0ղڻ)G;R|bE}a.qP&XbDp2ɏrBgm62B8Bf(|Xܻ6dN`Q^WX@BE 1sU9wCXΰۙȖ8~JCa:R,}ޙTbX_%F;6s_*+Q3,e1U|ȡri@RfbnckQ`)$iC.*Upo@5xTz~J1D$\Po{+k֠趸Cb OovPà)(1+)C#\a?dkkj06I? /rbQ`VߛcF)pu,%vWqڭ(Yg b^2}I"yn oO`i(,ZhLc`{R՟W p2QyA%Fo┒%e_o ~>^|CϠ ^A%/4 Ccve;@Ŭyhw{ k偧Cة)9l 9CS}Ьpegm@<4@<Ii41JQ]UtUY&ۚ4bMM ?("(mشߓa6Qz2CC !Zўj{:Dy}hoz&Lns>7 deVԱw%|"VUy̰X6GA|wgr!?mdG䀴hL+凑JAHf' SFvybei#ZZ,CD  EŒ,U,"sWSQ,ݎATy뵚wݛ;Ը!]FE9G"_PYoZ"D6`S枙t̽.3+ϡ Fk'A{{ﯶjm҈w`\֕:=)qƲ_k 4a6R0ꒉR` yz7\y˱Y# v-3OTޢDNlވc-$W'H)VLoP J5nlo`M':E2#0cJHbCl1aYWҵ?_S|!FqFљ@jMhfnzcj}ޜ]EE󢂿[F'!Z}`U37oV^+S-0֨ݡRE;&JL*LgSW5NvҜpwIf?>Hl3Jy27 ҭ(P0tT<N 44?d=X]F0x{L&ZٔSzMabj!qΚw 1W$j?Mt`%PۛQBHl+궨ЬYF.öX4tЭ&bbpE Q@˕Z'EA>%U|(>Ӿ{”d&pـPrCN,F "V1C 9n 笐}Sv-AUd.?sSu銄3d5l܃)pXb{o lkw0kYFǗ%-* 0شmIh/^d?p*s'.Pr|bQ*7pd{ܕRSBћBf=~dJD;,\QT?t֥l.#{Q<"PJ^w G:) \C6'@tzmѬYդ?zAzK_}0Py:!;Α'k=rv#*тl\ԿxfI_kiC:A(u$RAc7m*t[<.Jo!+"KGT6'$.R ,Ma"DArX_2^Үɶ%y2ԘPg)Vk+&@yh}}'?:A$#,: Hy)DA@kOG?s@ <(%d%i=IQ?Y+n`䝡s?Xb b?P6($.N! CX$^dˀ΀!@klGڪkžh' ml$Piw%D -T m0_n9"㈗ 6{JSX)S|jWlGy9ӞJCPv͘ctI:J6;! iؖ'\vz3=DuCh0Z/Ap-?i^o$iK^!B=5ytG]i:n w]f(blBIj#5I?x6⽵5bGWCΨ٬`0oPv4?:+0_QNF$vַ{Bu'`ӥXI I@(trL_HgKq;pΞ B0LIdsR-nzA(tx5D4NП]U{6UTI2R~5{<݊ࣸF;c=9HOw3 fTP OCsPST)*R&E~/:Hr`W?n{qҗc0kU>MPNq#J)S   [JAKQ$rh{l+p2[amؔ>k;qRy%Zq^>%3FD~:]װ30tf M@a_\&tR|ζnf@ ;EKzTu,#d܅*Co&(c26VH$(|ۼYtD-ހWkrw 0¼AoP8ȷ~ 9y4"S89S#7CPWEnoIvnkMk#*d.`H`Z8%UkuI?zv4ԬRbwe[^~qS|ph&J+@@a/}"/8+ZitRtG^x^oKi b;"GoKoe[#Hh.B0 +{α6vI8;Tp.OP s |ݔ s`kJZ~FY:U Y*󙭜#@q:%g5›RA@ YX.#g졿(ؚs.xq*^ (2oae鑨?h[$?o"cnOs'˱L V<[4ޢIFoRhY3;l 29@CR sM0}kKtku$g.qLgf ʌ7)7At"&0N⌊l~ENL;36XO nnjYͧHqM.Sz?nJƋ`$-,UDr-* h؇`LHJ KzÐxQM49;+J/Y|,9rmt.Lݛ*Pz$on=23}ſ9s&wg^\9㤝q[oudtb[*ߓ2K )4z&Ú&|cȂy"M7ؙ7Xj{HLʗ7л[LG{An|_-=?`Fl1s)Gӻ ڧ^<u&kV&3a_p5dx)J}9A.!3ڥ/FAw[S/h6$\i7(eaBvp%vI|J!_`Vèd-$5鞑6DD{v_cȍSӝvӛ, w4%4ZɁ4b0~,pzNie҆b~( $ 撅N)^9Pm6Mґ_nƯ1> `:J4使ſbMxS*hoa^u5D5w;aw%3 swS.3ʞ2l2|I+ުj% HiDϸ-{i?] *D`bi,)RM DɻkyxyJ{NZXI쾻l eu7nZ{]Ŏ{_Fpb'Ya>oÑ*&8kw'x6>jƤ%,LyR hLC v#F%tBNV"ppϽQtN@7CUBGj9(~hDku؍s%4u$W#>`e?ͧAiZpC^YݥQ.HK&*+QCh:Ekhfr#b,Ƿ}R1aڒ|Bp+V QzI#"x4PE%C?a9afD ,memZkWJPu=g$8f!9?r`A.BeW (vQЗh\] &Z4Mj ZǐS eD;Bi0];:Z $W02;L-B: ^?xPن{U:]bZ6d1ÃCn~h%B~D)R+#"a>u / #;'OK6䅴BpY*Oc.U9L*dN+\Um@{y=w¨y:ܗW@J~-Y|TQ#`Ian2M>+ek&w^2Knf#Op'wG]&Z۲}kJ{}Ny|q2V?}Zhà:5\ӵkRZmur%ےS j~[LM 1)AAS0Iק HԱT9F g&-}5L゙˵$sL̷A+O/OBi[oHQ]0 cqd=834_ `sނZ*]^Hٮ_m!gtoSa ȓDm CualM_+XU E3XENFE_9%2}WuM[YRMtYw`؋H7Lf\`OuG#[ٲ++.ZtLH.@+_3-FC "K!L04DexۊEK_uS;\@H[G7 ( !*P'~ ,Bzz-<'])|bGI۾P)0|k++0eݷTUZ7Bm 7=bcF;*kYlUj~u`N'ZFWL߇FH@2Lzyy$>/Q9#,b%/""qTl]Њs3b\ku>Ht2fhB!˿j !$(rJ(x0Sp@z.' (iwBE(yN u 6؇Tm|O7aڂ=V{FԶ]1ݾj[|ӵ<(W4.Ҍ=#.x.,Ezn΅A9Bjt"[TjMtG(*Ҹd7fHm)N\ӍjY1#vW}ݰؒgs`J #悛Y iA.t>wvn/  M$@ւ4X 'IQKcP(:d}]{1s .5C_nܳHÁ:`wTK$VRW9w0!A+fC?D|=͖5}y8W8"_Xwg k%~`$7wF¡!SI$i žřfҳ+8my}Cv~Eiu ~T]qjwOAG]y!K\IVX#4,z<"(܀on'H(dLdGR|,UֺHpWyTQs!rܢb;zb/vY)jv E*h2R' fI]הa`!k7tGϸư:S8U,yt*SZ Tn`yUԼ^*1@==C1۪3.Q[jOQlN#j܈D\P!z 7ꁸ^KL鱒ࢶq.l2e55+ L&Y8J/lo0o~gaKZ w(%V S"3۵u,ɫ䝐M$P9'n/ {ѐ.$VL#M$^FŌ.ƙU_ޡ@ńsKlN|L@\*4Fd}wH^g叵 c%:D$MRz:('ߑ2?VShjQiꁼmq:`,Z8֎M .=PfS|7>Gi=3yה4Qh*TrT>hT1{T 죞{gPZqIڬ101CW:LgBӽZ=2fX$v鉷GTVd|'Dz>F4JI9dk KCy92Vd"諦u-yԁY^HrRYI}:wqX <nnf0~*,Ƿ@A @J_QѨ g$gnܡ#-@T)Ml|aٙ`OD״f{hx^uG4ɊRKm+#ŰSg/*)6]Q. 1xUrPm@P-|c0 ڽ7 mu6r*+'& B{&Vh$=Q1ԕ `-BK)| t4c},pI:cwShcu O3t-vM|%ZdQ\bJ+\SE:tqW>Ś:~~EcGu;o44/G"Ml׀5 }/R3쌠m&!l|j;sm)AZLS ҹ2d\c4Vhum+ukHʞI'?\;3XK"֖HB& Y0xHh@ϣGW;:~ PkRN  p)F pBn?S^V4;z8fC̓{KL`?ؾGIP<\t`d(h id%BraiKμ2t]6P l35aMq>#=i)q* %&]1*\oWݻa :$;s&,x3)0PJBN`z_],G/{s;\c?IJ9>k!!X_3SPuu|BO{@t QGs }׹dIRg(e@K2% +5g->?ՅnwNۚ!U,'݊ ~Cp v.PIsWm8Ϊ,]qPQOo<Ө㙁'^Ҁpw(f ͉M4.u Z\4lBkvs&c!ٌDӴ  º3(|sہi)6eOåh\sQ!ǒO EEƯda˜z| H  Y=Wgq[!ZW_oh5s"4M7֊9eA-zl؇+57"Kԏڲh Vj0opJµתl'!L nּ C*dcX 1|u8p+ n+Nk| >%0FJ.zxUiv98ާi*RP&Ec/S-_#H(?lVMi鱔|E%/*϶R}>>/<ЋUҧ4<8H4[M.ָ Wc Dybul/JҤR:KٟbYPؐH>鯐a׆)<zk[hzpr>@ZgOWMrr [:6`ERQ`y[] %(8]ה7وquۦYuo:}BIWT9qY;Y0._y&hqGIlG?"ϲ⮙5@ayͧߞIk4e&`'o`~/g aA`_4g47W%@@]\ON]-[84y )q촵?\[|^'] /N,Z~MW_]ƤdIn X~W 7;:eODav.۠㜮 t@ ˩5+n.L9_Ja#X㾵hoZHWk òM}>Ѧ߮n(U85SAf]1d9L@"5^b&Zͦ:UtN46_`0ɶ笯CV![MEf93ȃ73,K7kb:~R|Bp~3?4{fDGe+</nˬw,fX)+peCK9N.DM|D,'%r6V_Q5d>%1`S˔j5汄 e63A`Bw&#sDw0e\zڄo I$^Jv$CU|mY@vǤF{:v¿mKMN.LhK{n*|p%[|KzeOuZw@2<ꃵ~J(QKBnh?Tɾt~rpy/s@@V=)~D(/L>H.m@Akt"B:G#˚Bg<`Gp]rϑ@̑OZO1'U-y%ov8e!O@/@n#! P(n&wI60£ }0W;װs \#f[ze]0;&1I?pM䉡uZ{LwybbFhMag|0X[b+4@'|xH^6ݟPD@$;"I~% b /IX^[[ jxb[{$Џ/" ˆ9@%1m{IX1>SvfzYD-Ȋa#}S=uOA˃C FG7`arN?523Rq!V9,/RC̱ߠ\(4΁tp Ng K4]YƚM=,!W-p&t@n _6ZHW[z/|Q]ߩ펣7|EEq5E^q,T!wiBpH򪨱d4zdU$E)}Lg ] gOmo3|>d}jTEeF=|AHuHis}@Ee%z9Y{lбOI0sFL0 ֛ -"omQX1zr*mڇKr7Q5?"CDE;MSCQ?̄@"d3IM }2g!`i5)迲%1K-uN2a0r@;+y&UTj,?뭇C%sD0)(O ,@r تi|!_%)~dP/&T[ 7\sjĘ!xGW.$IAq`4^%6cQ@dp8Ngiw΁O ( wçj%_7+@VʢKr/5kK_h]iڮp0.U:mrLpb4&Bf+晘 MoX$=)7k6ðѧn:!E{kՁ_f&"_5 ԏ46 'h!l< ,(^M\ُC s_k!ѫR> H&Y_Fg N,lwD2N|9xyS5e>R=L'fyeꧏ\=ō,a8A꩛l{jWTh(?Vn,kF-Ͳ3t'Q+d 1hxHږ5_&$ugCeg}%>X$m[2"X$6&!J= 63u[}p1 DWsI3i 6|87KLȞXeн eӂU*D$|oVy"M>@?04t7kh9~!],O%os`L ߚ12~0Y SX-Hۂ*8{G`]HC4oڲ$H<\OGjɏE nw?Ïcj﴾|JH:8~\ECAЧPx=d'tv])Mm]~;3%k`s%qt,B/wnIDL͗yAi{N[kl-;v3~r>ZGٗh* - %J5*L̵wŠ|:F}^~$" `r҆a]] Kji S3^]N+#q+2PUHdI¾f0Z_݊9HmM߸+=WYȲڮ1UNEQf p՘Q'e u/g][n9AwEOphHWhjYN;8]3m26;5x /.r`Y~9XUljci"i9=TSu\zd&#;3)٦3a򝦲[ =?йWEybSRV3f:MSR5y1JYx4{)ݱ* 9af^O5έJ*ala`s+^1jgēi#vt^RɈ(?h}𨖝»ȃjPE _252mD"J {")0[Z[A6 wEՓ궂_5n/߯+>+$]baR~&Ǣ*-|ƟRS^yPmp9CWgkjR C~N)F$be%h4fu:AQ|s/ewd 5r0}y'28P}fKM Yw^9ڑWd7엋ؾ1P9 _]GvF-W$*y TC'q`|d(cȫMa24ɭ$+k"@(?(`,F ݖV(<5u/ς744y˦"P:!EDFSs,ǯn!>k|RfO^\3RM>9"cPZME.?Lw?㧑mwLTPݗ&gԄ-s,ViCEOsQq‡=,PO.lFz!ts,Ibw' z b(UiU:LSu%fw0aQ&;{O.ЅxⅲIP '%fff_yYs1uØ@+qk硚\Wt譝Q׺~m Qc[<`q2)qU/oJh],n8[OKۨ"4O{ ;A2U `c~Zҳ{xq^~K jL!AGRAQ bo&MIʍ} .v(Aڣ?P`B)J\`g̈́Luw "Ff Җk# A| 2)팲^v规`{k!+Π;ceKVԚ0("q%&e`B- '!a)ѠTV/>35Y Βù׏V*1Sk =E ^`C"Wh12DqT*\,7<ɟѢBP㊶jK޵g >|LshGm4riE^F biD_'zV$ n!oUD=d4R,Sh`Y₦pf 5}}E6 !;uVFdb^lyvoXEaI d<;O&}_뚬MoAž5W`IxM,(kMūxx*OncdqHC wz3'BsqqF1ZPOy ^̎p0ʓ@Ҕ֩Tӟ%AOև| 6B<}Fl\QeXdʽ b55o=DME٥9,Y*/Qw,7,P'qޙq`ZtF1-"ML^_ oX֗[xE'C!B1VGKn%m|i;6.s38ez0(_XjQgڸ_~#q,y1։SeBYWヽ&n`Ebʥ5_᫋|E1+ÖtnӄtM 0]ߘV6&I,r?.EYΩL4b9j.K_sΫ,[u$c'G*qׄ*ʾ/s, YB,)1,.DpzN393"\.e4FBH)IpG͵?ڊ3̿‘,ܯzoz!3YD0sX%=|J%ϠM)6jl+3&/Z;-+ZL++ѨWo#gF)HJG?_)|2 ɽS@4V0ZcF4^^֏arhb OKֱf:T*z~ O܂ND$Ka}r2u2:g;`;3_'@e9hD:Tj:*{^ӜbS\>77]HId SB3= #O\ \>P(Q7@A0%s*0k@GrJ}\>NLI ϱ yCNkR^Of. cȦZfi('Met}]H06J_l@Ɗ;6yZu;:|zͬ6ɨ|y Xq-m(g`ރs˫H%I>bQ`msDu;WX-Gb4Vm)o~.AC6ODVRUg9PxQ9Cֱm>3STaΎHQk IaK |1.*%)L{ms:bOkЬ(IewzZtBH3*q#rKpи8]Osg,\%7x:= +h?[*G O rr AT,_c? Ѭ:Ԅ:ꁭs5]"ql; 1}oѸE΢͙ż6v8qP?u' , *l[z;&VVDj*};D<3+,4dIi PYM5ǿ$ Gbd:]KH*Q-\L Hܻ'+Hضx1&YBm{H (yQ%c&5^YXudS,*ؔDrݬ4mfҵz4)+ѷAS!kT t$`Y./`JIkOY?|s3]ԠD8KPy=c" ?O^wxlxSF$|Ź*W EP͸Ewv jd ~vW MuzA/kS 9ړZAwL{$ՕBױPW{}9I2Ґ e2 á#I|늹N~QeR=R֫o:x%sFЋ>)6"b<8iPAة t,7`POog$=%}UwǙD=ECJ6C9 @r.|W- YyfXF{)%`Kc3+A WF2"mҺb!pNz>DcT/N^(r\WjXd$wiɗ!jRϺ,%qSWhb0I;R:vE%rYDX(xRi֚5(DiT |H, 3Ǐkc%$c a `0쾜!HC@f;(&$cY~m*kk97qd7$Wx x͔nNB\AI{{@ <oy%#J=T\wdqJ:uZTsh|ofCV"v.Ǫ- R WvlIc̓o=G/{s}ȾH;:8C="FlPŋ47k6m[Z2IX*dE±"-SHelbEp[y=]ԜƟfgFl?W<̼eNܒwE0ҏ~y2x^¾}9N:,D GPBߐ\?d&@Op 8M,: H̽A#~G҈1x[4hJUvBɫc&Sjq<_ZME{Fh4]b9TD$'5;؛>HXtni?>Z<-ʼ cCu09+a\w#>84Us~Im{I#L\`4 |~U"D,m'ow *TGcrOajB6CZ» (:sgUi>#"1SQ4ӈ Rpp+x%M9ȹU1AY>IW-<,WkA~ 2HXr|qT"](rh,AB_L7ejCe3Ծ65R$iâ.$q۾en"]NQicEPuvMڕ|2K@cM %.qAag3Kk]`%1|,M)߂$3JN-R \ {5 ̨I%RNیo3EKX3E;c2:9Z'*;2)}{=DT$_W1"|dBSvQ^Kus -iP/W ze(*t~+A`%up\ El782! <]m#{L1eJ<M}5s/m$xaGp>QǧuAj?G׈A;s{B=*d @e~b_*LJ2}{T.WNKfۦ4~ uI$v5y,Xҟ p(9}gd=HfkzSց$cz Ol_] i$i:je Mꁇ51~OD/X5 E+[90x㫋E 2WTmFFRݔLOnHN7M5m׬L0u; ,?4-ۢ毯3 r8b?#r I}M && 47VG}$_J\L κcx;au?n}$جL{Am靎ŸÖӔMѶuKsjfc[xa7]=mE/%&PKGw-)4xڛ U'[95ZsӤls_xgwxUv2;9m /x1sq6P8aDن[y@xDep䶸0[O;(dl]L*$Ȧlu-,Ou"S@lJӴtB \ ?9;Y? }) DW c)B zesH4GcbHawB *S9c4G:jo݊Pp@Š1%KlFPz; 4藀⢁Z! ö;GW x] tH 7P׻@A)oV%ROS%}A"۳ ROD0+Ť SU1U.䅻nU9KiVu(]-yΌ*щ7]BH#ƽՆ+{?|cr Hxq"YsrM&`QBrLdޡhm8XCP ӿ :Ŗr@.$,  #T1E_PqkCNPr`V$b| NZ5ZD>1@E}VзlG !S[[|b;r2IPՊɘI6<:JQsN"CN55A)6{~ e]:.$i=J0SK{Ӄxu{ˣ 4𚻺 "Hp邕</lFf+>ᘶPjby`p?f% W[a0wo~Aؼ"餮²hAہ;&>er:-쏃I!k&71n|j#ۏ#W|x6 \bXMkMImMi5[PRJRɱ1rcY|i<}8}bb@ ^vT%u[Z੖yk 9$Emg61Iʰ쒶 z+k|Faaqc2|)n%Kc u%[Y )TfSq%Yp"mS7b|J9Wq?R<6'wnd5< /aTT|/Z}[#M5W$YF+'EHZ8x?دW6̭USA# '$H?gB % WUd<0w֦הUHkԯ%dhxU[Gh=EJv" аC2`\8삼r4Z 1ʺpjZk:x Is¶ܨdT3tJ#@:&ǩ>{&a4<)D7Gh[qaG6gS_8Eg@QJ4SH6q&B#sH5Ҽ攡b{u.zdV4KkYVXFsANiGp~ cM5ǚIN}W5nniX4 '#ڏK~EOc*e51L # N7z7<;ߞZ60٭"&|0B)X[W|'cJ>OWe(?:2s5 :OX CO7S!x2RzH}W0Ňm67aq,Ax q4$@~^8G[c}j~Ş?9ʈrBRSyaKMi.{֔97zҭ> mhx{Zo8)S?|M^>!,l w5I@]2E!4r𞏊e Ld':Nc2;08CMG/׵=`a"j義;6Q%볷Gxky~TYx%wvTT7bws4HRݿkuAy("ҿe'qiTwOi sG ?炶 mR68iq͉Ȭ7N& !f#n۵|`߯pe+Emၒ U[QOHzZ!j.KMKS%s*eQOF4ϥ뗷A oމ&C3sˊ4zO}9MHKyݗ4 ȴFS sUTX3ױN6hAlĴ+:9Ip0t*HD\NC#= +56 a?#6(N%aP\y$!hroVyw=u[':bOrjACC&AHFcYxN)H᣸bfX3SL#r:?bS*lbe<}c4݀TDǥ^ՆTm㚳˿9)=~I%b,fM)H\.m\MƾЕ,1Dd7X>?f:Q^a~7^-⬣ vƴR_\pdA[G>j,ai݉쵐*)žr wCgSP44b| )l3|Oy R]YXaS#/Ȼ agF?X/4Bǰdi΀.4PRnpt!z?¢hсAhS@|ov7CJl|n=V,ʥ۾-Ĉ,մ\+Ke“CҖt+55ʂsEezS7x<3QMPS{u1@c:EGdzNG2=F_3?j3xPe+F n*> aCIytv65}U㣸:{l#GL)c26[h=u,{[io}X>O. NNʀ/ m Jjg[(EG~EZ 5s[ԧVLUH4&U1f)o w/Vܴ A0<3 dOr0ee6Ϋ_h wUC,Z!̧L3FCVCʶ BhUuC뜎g[l!R+{CAy&͉ku!ϟd2:ҖzTb#~a<霝u2[Jn頳;!v^]|W7?b3k=Yl)cK=I.ݮޭgФZmtO`Z&1H0nlɽ5?QFĥϼV}!@"@w |u>r2-6٥4 t1_!;v奍yGJڂgΛ#'Yt87* ZʇLN%1NsT_ʹC׼PzE,{]P GHbaco:tFj)>>U5PiuV^?*/sƔQ@t FwQ'ẇ QI9.P8E%$Va?R9IYSxu pG;"A|~:SJQvҫdT׷N!a'ћ;}wMbގXRq %q BS*6G1\+_s4@*Ix҇']Wour! *j ,[W1Q@p!=˾o<^"8Y9R7FJ@sP.FA3W02Mg}ZCw=e /dža\ w3plW <JV\~ܰHa@g(!Y~C70O f6J'f jv(KtO`1rē~:bPy@D(l׏qt&r׎3i&a Ѷ15pWHF[/ S}cVN֣F¦~pފ%ƚT4F&\:{4 M3`&ц彶g/ƶQN]4dÒurel)6p^~v0oɷ4=eTSZYM7*%fh VͺDlЦSF-8E憒a ”KR$ mz۷6y-'G>h)#s +->Yf7U-<+vCxx0KZ(y w~Ja }ՌJ{5M')$.x l |q"-|. [UI/>`4uQUPeWWx{D\Y)2B$'씊sUkZ*t+plY`P^8npEAw@TC?8+?%gj5B#zwY8+{HW$cC-(c'{T;8-B gF6hgmxe6GE+ڲwJäG a`LI5.rJv5OJũBf `ڼОG+`FX贎jw.-͕GU1(L169Bt0֣SqZ=lۣNG-7B':YQEX;GtL֌7ssZ1~VsZ{v-[מ7\ Фi/z}4XXct!+Z$,UVb%:_FOl ˩ir L פTf*6ϖB T:-KE5Pwl%"U^V0<?Qپ:`Yn94Հ` E**yXZHESHUDh}RqQuT j(ic }>}]Fbav۳IJ Dy,Ƿ`u^]fS֙[N{Ra?|!b*E<%.z Q7MfkwR34Rt;Mob`p`>~%qYuH+-g-u3{vI $2@y*1vHbK$q)kYQyuc$T}N'eZr^ϸּWjddrA"tjquur*/'`$8\qv> yLԘ*0GPrxWҗYr;qTs-tMIĥ­Y"qEwdC(GA(ҹiuX[LW~lmF_4 ?#Dh, A԰B,bQ,(r $B!xҿ<${~Y KlM{4%1Vs|bz~[Y-6VMPAUB3uH!}hh:%wjP^C{Dٝcg]PM>r>1H71TOwL쪜U(<1Y"JmBIJGcֹ;下;=, 7ߔDK_ l88du<&+2xr 5!gK 0Rj0ĚM:p#Eʰٳ:h[ V3:oQEc3@^Řp,>W˞x1| ͭixR]N$RdIIr!*<.B"_DŽ]R'u9PJmzD4 DB&=8SU>Δ(: gp>agq5%i)8v}\|N-0c'L')c h5N&ldDyG*/x$fT_MU!kj<{"c?m"kElwX 㩾ߌ)ֱY#B!n'/_-s ;&KNn\sK?h#Sv]0׳Zؑ@thQ~G6Ҫ|#lHzŢSRNdc|Ƕ+`ܳD@+>sv@*<?,&(W?u ۅ͵hѰ^!s:j0Wbd.Ld^c Y.!y.b2ha+QM+uy8,Ԗ7(cVN{ǠbuZ& ]9K/?XY*vG,6Zn8F"pKjZ{5 }d~i/8+~ĭ'Թ&?ٓ@H?G2a&bW>Q4Fs+dh@Ff Ie$'-Rj;g;]= X_Rq+0i:,<,2ϗmZR.qLX$ 'Mk>eJLV/"!Bm&LåRwP< 2ڑ1R)S%F eoi yV ]Nאotb3":lJUGR;Y> $c̽D31>wUVH|//|L1D/f^ρTOqīV50ws쏗veFfDκ|(C+.2J_E86!vhSa⽅C=.y;|ɷw y g٤M}GK9}E$xx+iE,iu'ݞxm'8ZJ~|kgI*Ll`a8PL3.jN;5=0 'QD:cB4"*]l}J٨껓K1:-˜Է*V)3N~ qSc_ œi\DpqS]Dziڥ\?5ubDON=g>=SW~L w7lahxei,6KzNR?\vGiE/$w|RqvKgxHׂB;wlRt =ГʝhCxW0hmm?uqj a6*-$[{ gi^7(˦>|K:ԈgnO ֪7i^Bc;o>S]yL+K3BAsn}TJ2Cf\AOH˼2GmLa˻%Tg~Ĥ`ul+kpKZ|"a6n:ӾmeD*f߸,j?"IsFK[e$ ofnk!r0"BB l.;Fǖɖ27 FV"iGϘ+Im8eܦꉔ獪Zv򨫴ic+TyGl`iڹ.NJu'HhД+LxU c[w1ZV_WF[l2vREBҷ;9 !-6p+V8߿m ~ 4 ut)𒱮|9,:摭C [tW[L ,5UkpD!Aw@%Ga=fFHd'` R~ǙEkCs!9`{+Ċ0r ~hr sͧ_$8CE,Ȣi`K"B OM,zb^p7':BFa>ي7zf{{ ר`cAc\u^O [Woi6G /d~WYVXUqs$FOߍ`lj8M~~#}e݉x; _ );4DΜ(L:9j)e2q\<0Cˆa@u2r~w_?jpN˨= dEr ..hu~MDS݌-{wqUc:zaO~}A/p`]Ppz! {QM P\>mqS'< s1>l;Yb1$ꔥz٠PaMkon(_Iq@W_*#vi.)GVf'Jk{9/-&:~3'q%M+qG 9ETMR+vIDY}//FwyXxc| Ki| o;U|/>/Y]ƺffNOdaMh<^Tq,sQbVb馷!'WńDv܀m̕A\y:2_"f&Zb/s8%Gj:f@[ %e''#|?!dp ⼍ʈ_'{#{f.?MhRlЭ3=Jf;]n[QTE\|QCN4:)[=ci{ĜDӍF:S+eZXu 1="Ϸ$\.-c cH Ul0K KTP83T9Q,%[%*i=%ޕe`sV4M*3^LfCGI/0Q(=JզڳE%-ތq¦$\8N`9~O[N㱠9  wdWqEpRJ,4׌ OGĀokl<% !dyX䅓[7֧޶~= d\j.ЃeW=K(;Rw;eW%55Hm<_'˙)Um?M.J %ZF/NMIC*y6G7q'5/9 3ZҪJHa-dzvjȞ-ѝ8N&2O7 :@7" Q7"Y#Kj es@%~*B0:M-K).6Z`)Cɏ H#O 1G3a($&dp8r+$"Y{?V&_&#}Oqe04qr ^C3sjo@1<;)b$IBlN1T'E`^C\;O[ S$W̴nZ] 8r2vYAx=DAV.R9{_VѪ$u9= uiy{za'l]1@ 3XJ3'Ã,9AĤ'i}uTqmG-2}qQ; =$4b:}+La#m<  x*d6r@L5&4O;"n ABb4앨N^(;]> 0+մ:9mm_v?cR )ڌ#saf*8Am~m~š hS,(r?zcHpʒDBxw*+JMp[3 ]>TײX<}-U'c^ nz).lPPyPg{0 BSfws ,,\p[kF>x\R[k&,e~F9~!y?/*Zvܧ@QWf͜ܔ蟏j9A1`lb<#Ǡ=}56ab{^|kOt;Sѯc<.zv%wT>sc}Wd金 R.[+&9̚1dkIgUbEZ&PF~~LgjNtHl.`^`/rM)/bѬn| R_9*\@!:/K0sKsof9BXs =w`=Lp)-IN:ᡷ8S[ҵnE" h$Q87u!kGH@G;BY3xאY1`fӗB(&bbYm)};h%/W*%v-ԠZOF  OV2T"^CN[OwCaͽϟ((u%Aϵnfʐk ܱ7EIkM(^˗8A/4oBw? ]}Ĩ 6.$in 77K`P`T[O,dkFt.&Da%qGYӑ+v!ͱ#HFVEȄ`S:~9 i\F rDR2& _c^ҥ(KC\,z:ӌ0ӖpqpS;ʡhT,?u7?orٮuU`k L_Jʅdb<аlzþ"M-* w=?==_xbALY7$?%`) ɇ08՛i-e!nD|K΋>c]/tR}GpLbV-Nk,9HC᫶M!&+#W+,ך36 +[ ~hEA'R+t ѷh6LF2\?p&U82/ kq vn3͓o|G<sh* $jڨ|we$oN?Zy징$n H3HOM@2ς 34QuܩJ e0K<|o~7]Ic#XϡpUТr7uV; #Y$"͕&m &0hs(2Hʦ̤Ntu1z6,]]ۣ Bg~^5Y[NdS*\pjguŸt" ^_}'$ΡO+T*Y>Xtj9ϛNXVd񬆔WN˵@bg߉?0D<Laa6ضcD"o5~gT(zT9 11t4^kƹWmYYHԶ $7VQx[L(gEhׄ|nDՋs7fGa jKh2^LJ٨a|"N/1# Ty3E+6'2j7ܳwvIR@+%.adNZʣ:?l):'Cf-X+?w,MO ?^PID[1m)bÀW㋗3LM0PU*1KSv:VKA_;h.r{GD|t0[tn ]Iu@aŏM#CDɣ*E_ ]Bmu`#IbQP.s+֪)tK l3ӞRHiuW60eV@5Ufsn8T^c3@ \fRNt >o9f*:DEi9(+`R\b7a_[I^2[ȵ 3M5xZKBo/fzh֒_L4e24g_v ΠsfN]a7n^*)~ZP4mc4Ыb얉R=@_;J*!˰ c..kh4τey˩cV/ja Y=rljfeuc[* ?"E9Vȫ"$'iea3da"0 _Ͱx 3i~rf5hۖ" ݟ osͿNᲊdM(=fkHTxt5ʯkN |\ >>DO~B'wUms`-}m?x7ת=aRUgn7y|O롟q 8 U?o.'/D)Ȧx˿ƪ te5W>bq#+<4\C%xs*L vMi<\[no)ߒ"G`S2vu؁Y|4.vA 6>`_ºAy!ޑ!`O\ÖiʦJ-3i^LNbw'zNV:+,l2^~w H2z6L2 &gO~4 ArJVЍ#y Rhq&ˊFĤ!n-RkH#^ghtAZ~Pi3jB`uL!%2H gW2͝k5O ޕV!df k7GֲYJ+W^.{ǣcN d_,#,izj_AEy'ſ*0,:6~(Oh6ȅXh~:jp*K{, ʱ.=FEMMZȹV/_1%r@l{d [Ѱ~ɑ;` VҀ5o/c臂kwL?UҪ| %gM_#ׯ2UkXm: V܋:#Gx$@L>ӔUe@>3hD9"Ѧ8^L"u.1 !YD܂ {l!YZN)FLSB~Uo`p޹16";rDRilsirGf :6FurIDj\4:J C:11\JPhu4~ϕ ۳e|ຆ LGGܔ;2]8 zkV|\:=^˚_`t_u3Z,0lb,l;"_.wMUx8< 5̾=Ȋ(#&"Sa.97૖܂~YZJb\ "wϛCkDʹ[A7|C}whS-@f꤂D]<s?>Jk 9u/hV?.KD|QGu=2{P[9JaO.cܑ (F,3^mY>چ^..YԀՙݽۦ;` a,_ FL+B0:_fO-ǫxDɇ߷؅ ݜ nG`z'DrxW]b#f9@$j u4g&H$\F"e㍴+ZpX۷FW䍿pxk5!Adzaz >RVI`90:B?b5SeJii s4,#?,i(h/:m E_14?e !?J5'C57mq862Ph0i29``Sqn~l v攫{#|B9[zu-;Pvf?SCTQ?oY :DBX| @=foi3;?&>H˰> {i sԵU(mv,W\a먷L=I4~UYZj`vNtj 膩~9Gʿ!GVʾ₈v>J&]IsPZ xlu2Ҵt [uf.oAǘ.Gll`6ciL8vT\DduȲy9\t"p'.:qP}$0#xEfO#@EZ' e){c 2r0-XdKT384aSH\D0i}6AK'+顄J+dCh ?#U|uHR-X%O7k ]cH9Xɦd޷6kAjV-:/RIs ~X,ldk0 9\~^0HI+v&d!2qSE`/{A($BUqh 0D`-R?9OPb:IL328' ţ{Sw|qA{5 +tߢRC[Α4ޜA>N'<$^r=B-צ*D_}QcRY'ǖs@wȣ7cw> Sӏ6vZ@j 5#q]Z?KN2IFP Q7ludvWpTlS t?1WͷCF*2/m烌$^Iϗާ1F@/a plPC`wPkf4ΰ$+oA߬mcQ]6*867{%I %_#SJe˾1ߨ@Ft x!f [C3T ~ǸkHVo/A!}W6cɛrY8 QBIm;BI'.<Z[(e2{&څvАe ]/.G)`"~T-_ebs[tO< F-HASEِQ CquLon lMyHamk%`ڲ0NF S1(qT:L{xFW~gvRȋʼn6A> ."#̀zW%×#Ccr>?tX8=RMa@z= zS4FbPwtMٯj>ΰ[Z5EZ3g(uFQox&-|,mL+S0}v{yl.qPv:c"^X;#t%ZD*P}3R6 ߸o'.3_US6?>} W ۿK4łXPpHȼEoiFL颽I;",7uYBFgim*YTJgӽ* HԘ:(^icT!ց՛mLh t3C<;5;7ŇPBf0 M\7CE 7c(VPњ#3SĸѺ2,wX+tT#YGZ3oY Œpn_;OՓC}3UzvtE~Bރ"'$ 4sRyɱax۝@LF\%Oմ ofv j]9^ ldu'ӺhT8Ea&ގk-+dFQf?rlaӖzdf]Y7/5 Bo"$zCᔐ7IBgBI3(LU *P~ u '%2&Y j/oU!Z[zjl9Z" ߄@n2%TV<2#?6^% !Zsz naęh5D^׉ #~4.鍎 =!V)UzL{\V chlp9!+^ ~O/Lrvou CJ6 B`G3%SO`#ڎ?Sb:ۋ_SI}*ug‡D">2HO`/{M' &٭VúX&*(.UK԰O}i>"q ` eG؝`f}ɀ3m[[fЇkHY.s?RAP!x:XBAۏBӆsx|%{͚rF"y !;b=FSHkZ5%" 'c9cE97\14ա+~r{jIEK܃nS1eZDї3Oӆ'.E@m։ͪ׈{ ˞d1r &t3`ݴ`.25Y?H,51{=n(L:zBކ:8]}"kjƵC㸝U[|Y }{WAFШtTKn,$ Nf_))t{M B1گ1<ZcDPtP>1@l&ڏnGENJQ^~ӥ Wl~w}Nw3M?؂YɞF!ɇnb*ݢ&sclDN$T{0NڧM u-KpjfYfĩ%L_dApޔvNHs|$-RAKߧ1'l.e3rgg#N'! u2ㅁIi__YO! >kVS"#|)x7WyJ}Hn(^lt8LOȈ4sߠLaJ,6(*.`#E[HkO$tQ2=-8bYg`cia iMU},q?|&5sO\Fg_%^PO%< KIJͤ0f.RFn9].qDĤ=p|RFlٜZ]~ˮ=c? Uv93@)%D U͌6UA$c]B)nzD1QID }t7o +0F>^OH&5q%B<4:L28 =4y#$3~J;[Kb@WMCg\(]hGs{Sh.fOޝg('ӵ/LÌ\y,w~ϞK13uog^q?*kyiُB@0x|aefd:2'. k̚VPلÿ /\l%J%ܫXS ;aRͲ\HsӰE+Һ`KV`GQPgJz'~DI^8+d/JԆbw_C?B'wA‰*lP;JGĻ^Ӵw<>C✖Ꞗ~LTR/ۃyW!1J ʋTKW@a*9xjhBxmj!\O^=/WFÊ< lˌ:deq-|Kc^o? vyNfGuxqoQiɘB, D"23s>`̞$a1h9#ֽF, |R8u׏ao28c>9 J;yZz}^Yt^GmP;=^.*QKCp$K.Z3J*viϞ4?7õنȯDž:9d gnjC[ඝ ҵ>|M Bvˇu ] _2"\Q( Al[k1]~Ax _[!oîaQ+oi qy?{Y I $xxgήFpJvV:7T_k;D\Ì9-/6tD*<Ua7Eˍ΢"#3Qkf6 `uW~x 8&ݘF4)K9[uEuQ -?fjKM/^(aG^N.F A[7 x-/E~N]褆R# O43&咠TI Z,J!3 "1֦+î R qMvu+tZ llzÑKu (-j(,1F1,yq$ya v@aY/w<3Ɲ,%4_w'F0ZCzvUŲn;ܨ Ckfʘ* /FVW]C* 1y$52ý%TkV8, ||&<`0R{/I@ ݶ:}{ -zZS2$㲕8: \q,{^V,W]/j] ndA2SKMn ÙԙL7ǽ0p JC;·Ұ~P74a,5S,t=W-1h#s51 1*lM~f:oQXdQʧ2)9cd 4Xх)E%e\Xe]nd XIR7\]JLqO;nޟ.on )1=65>=xNE#B18)4Qő^UԂǝT({qq8swk*S?m.oa/9zȋ;*65E+F^?r,թ3H '?{"iHE 1!<^'snW&s!2H}ꣲRLz+[FՀd)0Hu`ceɄڟ祄$;T/GDI`>saFRo^U|$*}Ro)*A^E\Ix|%#dA18 AiO(N OЯoMsw/yB$ (^Gs>nf0zɀ͘@s- q՗DZo +s0+O ooT@xXԡC l>x qhy.&0oR!̜P'h]~ރxQs{xR͝t_[͖e@x+ۊ_Y:Đ',x%_DRXٽ~%s8Q&|"t\^N{9IasCحvDR9ڮņwɁq"Lru͠ټRC N+mσ)\%+O뾖=#+&(1} fcRX22;iSD笿ێtYl47 ڄqt -F_\`",hvՍ=zV(l(UBuŹ0sI4' 2Htұ ^+ukPBB6L XǕO)r.o$Z=}8F"'ykmq6}TA,ERV J.Oȧtq>x͍%"ea~JA(Pd Nr e7v{ ]ǝ3` ;Fn+pKή+pb֒.YDyԖ}?kZN6 tdv6,rQVowU]\Yh3QȣAϕێSxdcto GIo6<\ {[1R2F$=~*?慘l-BO. ՂyQ9h5ow? =8L=HeӚ|GmFXS3Tߣí@ʅ%fTH`xR5<J3jaVDwF}؛}w] G[RKE3WyD&ߡ2coei>|%;"U.8ie+)ǖ 2i@IIN}jo.o+]vKyH;2HdO[ ^_"KE Z!HT+hԨ$Na`)x˷mtŃ5"soHW2>U9 /o,ɋW*.#p b~Igή:WN>3흇 У [ѣq?g/rE{3)W۾@YXGSHQEk+QWt;y$%2V<0Ga+͆m jT+_]UгPFuUtG۟^ ];6(>}I wodF4=#>pyq]8KAoV(uܵYMWI|AOr1 Gnlp 2RP;rFo.;àSZO l$`^UEHt5QKBkrm p䐊U4q'ό"t\%[(N{I^)s &nzfH1Pͻ؛1<J#M[cMI[zp5c1OCpvZwneN}4"; N4Qɮu2RE LںX grq5>@֍CRh"s@"[:0c(Yj ,h/hX\j.VS5Mi?HS(UCѼNHԻu_WI^C',J- Â9hC߮KٵvXŇ&ތeZe 8b͹f4XfѦ~r&zA+`sJh!.iY' ĂJ-+lAԗهAJA2||@Ų|BN5c(ʒNL;h_[.hl#^^^X@ '1߳⦇E8k\pl&04$|9k";Ft' h}'3%~/[}ל> D^wu= D"0+$fL< dKխ b1!p+jJ:TΎw"p՗O[mKyce ^QKLft+N1p#;?/X.΄N3u!s?,&r]`%JO[fyxT +"%6Le7'8\Bj+_E4J:1F RT@/cmT[KְXF[VrI7WibE|ԛav2P},Y8Y3 HŶۏӲMө`*Qfd.XzEmy5FBX!qϽSp]S:u*`g4EE !4ˆɉ}ЋQ: ?ދ-L\6~Z]eH 1Kjfk} o!_300işffvGhW{Ղ6 `2)JCجoΜ%A Whc㒅XˑT \F̹z"o 5Fz] $cAg[wu$lYm~aJ)ݿ/:择-=G:COB4:'G†P|yb&woЎqdZKv*0ehok1}V=6K-g*)iNob9yYghNjDjH?O6 eEe߉ytmN6nlrMá%X5kSla-enX$f})sZu~<ԻKCbOa\ SPkÄ%"[=T-%>(a윧-gE@~D do *N ;s5 1\jН6}G];%BUgFĜ$1J`?4zs5j[SU~$-U7ܗae1H} *ޕ5h*Ni$I^4'akeS(C\1ѴjUW: &!sߋեu/׿|xYn|uxXfwҢzݝI4ۣ;7"wi+3r1ߠyWSbe̕Fȸ"S4BP0yDzۂz8WC܆<}]"˒݇QVm ?:ƒfJm`^z&AwO00d^n5H'<2ِX-+|Ko K<6B}+ӎa.sr#':ickRunֽ{*YN #I;-x9QʹnÏ7O9h:9+-3^0wMkOUk T : 7-3#ScXQGl1q2l$ˆ3̠np[0}6Y "\BZN;ZUYH`{;|k[OY&'dTV~wv|(!L4~0Gy7tCStZO aw|nG[ !0kKD孤!.&fs_roƞly<З"V~vaOp 跐ӝ<!Y;UɌl6 4MSS vs j~Nz۝q'~-ͨO<TF6StA%V4 {XGw#ٷ?sҿ> ^jN:4S? Z9 Cg~EGdŁ.%6FZ[+!;s@&ѽB@H\eQ3c Q> N%ljᝇDyYk'^TV$cмg$"kH7,}"McBO@u:DЬʢH(*rK hl#׭kBYjZHm4X{eרmGp=mY]$=Bt泷Mnp L>ZV_,žk`c Cʀ774f'&ж2f]d~X8lhPTm~9WdwQN Ye%]=AW(oR.+Vs~[d{f75TK;'dw<HGqӜWhm1w# P /$ ^jw|2`gMtdB1?uz%V`8L]+0s )6WHԡ*-a@gMYul5=u!`ne)00ɑ% sKT>U7"ѵ;-0@-ejsպ9tw0;xXֱ v}C<١myAUڍx^JQBP{r{˔Bv[dB.\NEK#D,4̗k ٽ.&=}0t$$I(N#)u܆g7M:FJi̿=Od4f"ZhRzj.*yK1&cjaaȴ]m0OJWA 1s7n-|DPV}Av_tĺ 9e3!+{&.aҙ[~ƿa5;7!BJ{rVljtl$p8oJo'1+wd0M/2Y7)Ymk?߲rbD|tX`$_=B8D G=1 g_e`j'5γ\>j nN^Sv#iQSqVXDӂB`߰3 Bϟݖj-ɫ-䖽zLm?Wύ> : ւ"- oWBI5 ?ǖ s9<]ϽdEӇ=!q[zQ9γxKhjhe|duaNo)㭃zMGkEqj=Ce% ̠X`~E H45Ԗ=QIQ7hN ^Rlg*y1nqf<6pP湧W[qNJst;)N*isUdՆ`Yb LCtxjd! ǬUbVV'Mh*GսLЁ̤έW8/ebu jU9.jzt]b1H\^_ҊrQ:ǽ>i %C{=H(e.O5UdAJ;39(4/隴a,pv4Ms,ekɰpz,3X$ ^sK^^C""U56ݠ w:&V }]֋[I#fao!tW+Vypgg.P?z^ b_.b]ƢZBm7aM*ɁrCO܌q7]Ӈy*Z璅h8/SZ5K|njDkU*R5w;<ɒtpAuGM@76} a܋r.3MznlV-TBT*Л=~r80{0F,Xq8m{-tOA[ ʻv,qGJ\$`=K.?t`vsV7َ?m(%nJK~Iꂈ fMr~BbqC_YAK7u#rN= נAR2Ò#b"ݓs0poC.TnumWxӮrYKV:a%]sg>w;Gmd Rd=zyZ1r[MC435jZxe(h'YcB?~<]Šc@^cc*}"ړN!qisXp@$r3؎F]@D`Q5 eBU$=^M_~|֘"/t;5߀ ×~y>J_HBL%1XG;pS,?SD WTL/JT&_.zSrmI1"ۆNzrI}^LU9>(6wc!VYR(kxB\&MQ4V]d_Yn|L 1ngL$OɦK7mQQo;Y(~4'JsݱX!g26UާB{|RbTOnD[ ShH%7}}Б6oQf<}3ɶxvYUVޚ[6pxJ5T~p\-e}ϭ{އ-ɼP@C36؝lJ?吉gLF dQ>@hH_#3õ#Gd}M7V)>}x?Ud&9ȇ-<6`MB)Cw<8$gUpl۞m,7IfE$:!n%\!LS<#U?!\[js V񫈟1#գ/es`m;䰽3%xkyRQ &JQo=ANM(~XÏ(nkچ]n?~>Hr`[kb{2.?c Bƚ =YAvqf1b&/fBkUo4mจwt܌OW¹̘#*,V>vi* Ct62&y?MX'y&!L(bWv'%qR ;n[\w9&sҏ*)*2:v YX/$|'둖 CZ\|{ݧφ'hg(:SNw|Ci¸0gq_L3M35".JLj!Fk),ާTt`Fq)WH  j0DžkGK܂LP t*2CwM0ʥFݗ]݃%16& p2Jc19M1 W+~/W$k~|=hLDݯi~۬TGYMyh(\?K d~-idNf]D^Ȍ4 S3EOղ[i) Gyjk%yk=[FmlvVlě @ bʋ;BY YfipcA ~AY}@,d5ˆdn[_]B/%bi1VG)_Z`D oOH7[fӛr!@yKθo fV`e\1"pN7RԱl%HbHcedҦ{me Z{ Zq,'^ַ9[c v˙A>FԆ)~[d 8z.1oL3kOhQ q&H9ǿ9"lZ1&*N bd oUgl= 1bY|L f&P%h_}3c_/x沶8`XGywD4\Y~ev/(| vb 2[Y e2w؆3}OPmYfBo}=WI:y [=*$`|(6ةd*/s*)D!U؅=.}0 B>HwvI) joIjxQN1B 7CgDcGFQr?~C9t(8}Iq} ðzE^#K0*HiV520G1ʐw^̷$Y{jN[ل/ؐ&]Cik9!ϮGI _mޏa>v;o0V}=9hu~]Y#SY:B˜w_KvL,셅6YGBw LdUWT͑1k7jORЕ%aPS堅eLZ$3NѠ+4m.[.2wˏeZvMẍbIj[F4:N)>es[;:25_Ġ(HojPB󞲱zl)*4f|>[i`iK HG!tzm["yO$Ե'Usst0ztk9\Z*F_H=^x:?왢 " g>3)Is=+_#kv:Ѯϭaq T9Ym fMA~K ӭ5ٻE2D= J#d݈z<[jO W~p$ݯn4mJB5pr Ǽ[= wy:[b}"0ՙM'=j+J.kݠ5n)IegƉ%\GL \Vы>QVSϭX`"b i^ۏE:B#dy dk=%njXT-"J_t"bX5QY/_uuJ %$i^jERr:@UD↺ae.I^u򟕗g/FȈ8)7 JTA'+Y|FDR]f%}lt$D h^Rys#T*vYdcμUdR¹5DngB=ndKy?liYЄg3vL]r5] pb=mzP- | bk"d,(1d$X7W'BA-Á8+<&yhİ@c]*W7*ߢxQ{7w9\*z >x!HÍK5:woB(rF="w:+2F̓UDA8X9d[TbRxؐ#pn]h-E }JV~Jfh"`Ңd(XM+kGKCO;z&mr5B;k oN!v||.F+4"Zs>E=h ̗nez-R1f䈙wuxqș͟_w#z3=U[-Yv=A.Fxjf]DW"q|:u ͇٣{Yѩ*[d1_]ލ3WHwk;{hi+5x!^]4*Ƚ;E;Z"rD;S FWfL6J^QW vⓅ(1]1O刿1 /0ҍY ?7hǓ%xkͩ[<91[3s.0:\ljx?-1R74jF?<l-()lsQ" ",J8I7xS=/qbk<2.M#--Ƽ!$/)E~^i h|!Go2G,t}|45MeP[MV[\ Z3%;ze$R~ >, \83)l1S]46Fk{p[emNi U![1 ߿Jl eGcd+b7Ҫ(2g./ZUiaT;*>p]SHao`4YlA>倵65d_%2V~U/*p.JT~HGnTJ^KH?=2Za<;iQ% 'I9)C;дZuu^ژ`#HIkSQ;*NBHxM七C;\ 6=7 4PS4qcU/@»ִØѾ:9YރRG4rIy>rd@'u[PMh (l]41g;q\vV@|SKе(ohjjaunn^ tcIh?vUk #hRxIDMթOGESpr15qrM=QhI3_J6uaol|>Ϲ}N 2?suŜ[ȾBtl6%:zN&mtAͣ73RDT|).BTxV.F7.cR$'Ўn18 c!iP;StF2ɮ_tk>qVS}q[m3%4qF."]V$\1r)QFpߗ)$P>8ݐ!BO7I_1\(y=e":+k%H 7+>*/"aZgUE6&27]SA4Lhi<\JGeaq0GVx/~/!(ۆJFԿN:W0<@=42ǒMcmWƜK>6ߑIfHy5~ߚO).)9*սcS|݋RL5 G/.wGNRM[>"W]]3aŗl:4)h_kU?I$g]@OjIF uFVu@U'oq=2DWS񵋌<2?){fpjwpoil ak;Eb-H鶄yZ $GHA ~8p ـBU*o !aVK"|Df|/G5@y,.ueSbat hוHdSyX2}nl>ݓK@8+Lx_NÞsTZÿW̲Φ*:Dt|Nr&aͬoR#tLƋJ5㏮D}O":?IRǽ:ds{8@[%!F)Aa* C.ikj 2(3ߚ4-QHVӌ$(Φn:y@ g:?}&QS+[ FgQ;Cfa %h3w+c+m'CD8-'3fw4bFKԂ*9)gZb_}->KD ѧ%SI-V1 ptXN`Hߠ.aU(]{{?k_j**S뻷Ah!}<*h ]sL mn'́ ˝OCÍL>\ź0RS0u 7nN[-Ĭ~N>I(6 9SɿQu @"xs -'^!MFő.B/'$Dn pA*Q3N<ʽۗ1 Wawk_X{яFQT6ֵ9 "Y7Lؙ!z_ Qy-GH`I1-P֔S*(!՜1bxQ+!| Mݽ^ ^/>[f1ʹ"DfvbW g-ds┧ uxA%tΓ1ht=^A*;w+"98ǎd{45a&_{Q~:$&FN©")s amusxw>&H݊r$ubq*I}*'SdoP,L1wŨ(D>*E@a}wxD(y_Sh[^*IOұ]KQW;?_ kc x>h#hJhcUmv)8O kjces7(s-'į )1gG+5WV{k; *  wLZJϜɟTe6R<E)_ {Pv;`_wÑsk_Dp=ĉvh\֢$bu7~)][+Aġܳ>[q^V-"ֵ;9_ZJ+  #Zu"J(\9ooX~p=#':wJZazA]21=pcUˉȵ4BCsH>L9 ˶zMz_/%=0=p)Ȭr 8 Z#=D־/&6ばHq g\_BVI&—]~<ެ.᪶ Q$zJ\YTOõIEKAtF WA~pXyݹ (|H #=x}'n{!?͖X6 80aHy15cY |ixWV)AE@QݕJz ~}lfQw쨖 g|i"?b?^[2(JLNRE)0ī.4 a@d`ūQQNz~lS;(udf*z;41,/jb~zH9! j$>X-  [mXI7L[ݮ:\ Sh;u&tkuG!&NS#ֳCHCl6Z؂e5(YJ 4CW9 zqT;, >*CY[w ~)x(,&MJu&i9,%\yo1(J^5^B*{t3I$<[JKKnPztb?9My4IX(6m;yHөABc|%DddU[G(yzw%G ޚ#nD>WΑ3,9/w;ƃ[}DbV9d]`5n0M)qvo~w'sB*^zH[vSE](џB4[ (bc^d|pgYr%ݏv,#VaF/:nkȥ.tĀz0g~ЂcM!%@T< d@R9a/$^E5OnKWw8),߫bdgTM1=IW¼ѩH_hՂp峉I7ZY̨tXLL5U<\nJ-{gT WIZIǰyٯZ/[}5[/Q=i8ҭM;(lgĭQQv6&<~89l⊼-W.?^h1^HjbV`lhiKb[a +eu="R᝽'$ㆼu1rT8C\J}bPUP{5IA *h3]t.M-% fYnG`ceˊ{ =vq.Lp K7Bcי&'-I%83{U[KRdX = `υ( ZͿ׵{"lQ '%cοkbm5gcI9؛ey  53/%#=/1wG+rVpY! C%Q\=2cC,t+IP eRaF/I!y`ZC%sf}yڼ6&5 Ud^R #32UPiw9O Nj&O0RSzf6{:+|lZ,+W!YyZCKK$f|<`̈́_LwI>"sbm\^~bVI ]WY;(ef/քg,}h~Ph%Q _Ž]Z%j_hIbլ12_UQWg4 dmcr9(7׫)~#5E~@b14KND{[RBC,'wUglobnJN2Kiǐ?C\a@B1~gCG q؅뷲PhGcZeդV҂EE3goG6L|!!yd&$I#_l؎B(3eiww)" *鏔uu7 ^gC%g8aS`3\idCd7祇j5@Ҍ<*APvvJٟ"ErD!{CjbҷIf;~JerQKZ{ ަ^Gt9@KY.|ܿ_zT3w=*Y[D*;{>"A7}2J-`JPOid`,8kM11n/a}ne]-n&u%-x7Sk5fKN+lwN w}aC hJĝK,ֱW?½[ . ~h!S_ԑ;pnfg|Nd;ḽ?8G.jɃTOX0" c6?Q36''HyƩ@p˕"Ebsm98B‹, V_#ĵ7bDr"}`EQ3U'iV}Iul!V$]drݓi wdx'O&4* 핀 F/L00(qKEYp+ό6 Ig l3:ߦ=@5gJgkϺyBp ԕp<~:Beޗ)QauGtӞ&U/k'x|<2o?%ThQ^~#rQ*H@YaXǑ3($캔GLq#!4&|PqbXVV"ջDM)ů2"1o21s{T oyo4eߞ FNqeރqg)u5-&ŪlOS:Tw/e+4)ᚗ[&S ?Idr'_sGڰLEaUta%9B<zqc$Zh8 5g}cJ C}9ûl'Dy2 Q?1Y+ĈJZ jM9TGȏfD"fK a/4M;ZQEރ7w2p6Zr Ϯ($ E\ PA.ٙ~)cwԚCh 8 lAp!JofsUUWv:[h84\=Ѯ~.4]ČfC:j=E_.N|Sc {dt򂹖+B\T+ox3?Fه^[`ސrԄwh3iZ`G"[rRO{>q;96]X3UBHUx^fe 7-^y6ݥ}P+}h WC樼LWgQ"XAf|jOP,^۪+.5 }ѻ(|EîN4[-ij\ixӭ,(Y6iHL2*;{e32`DsrIW̶ԏ1&;sb3݁B/]6Nm'^5{>MpM sU">^ÒN3 pAG}C4߸ޖLazCJT 0I&)Q{2\lxϷeɑ[[b< Sn#ehOː#dXo?]ŎgɴJH`>@JO8Pd4 %2QD'SLش#Z}!\bJ5>j F/LgR]g/$}˛^.{백}c#.! X+4D☚f}JئWD^$m[`j'^-ZaE>U/⶙pb`$޺`Ac.;̷ D'JQlf{+im!ѾO>Rѽu@mXܛpW4é /8f-3ia2TsDVS7RY"!,domr+>;ˣqN9S~Ńo^}U")WDj)a-މ~4s8R gH22sEΎ@ـ.tZNt2_Z-p,WjXPzF܅0Y)2Jn9sЭlm:>pB=FIZ6:J aXBt#f&̡J;f4@%\?]>>@`58 4 (H\lzi$f9lF3c!'a זUpZL7U5sPMa S?LmʽF=dk2&a~Za Ԍ{L@iζv~YDۯnT7iC-l7-6@ם|FL GoDžOBcĖ rM5M?,[o|15A i םRU<4[݈r˧S{p`{eZq5YC(tPB [( |d m'AyĬtN=%K :#clvھ@b0²2٪n qF<)πs¾V "QR FYxHQzYBO& 8ޕZan.-(k~2^qxn`'L)ɲkșȞ<`; { zGtplwLEPL-OpAitDrZ2h(Aq4ݐ>:IYDI콍قxΠT%YoB1ݥNtcLzXƲ[_CH@yLyAYd\b1$*E+b5#?pJf;܊hX^_ؽC5Om0B& kBBhT[Y9ᶉ4t8m 1?3 *.}[HJ ^w$KaBх_u_m%BQI`JJ)H kP@I䶧jof́KgFYEԾT̾/H*|e˻륢4MtsVC+,;Z!#m1б2RY}A(2=o A+ ly Ax,܋\Ug w1~g=!j*gG͕3z 6uiy=E]Z(54/Z( 1$.97ǚؗz4c ~| @USn,U qHU:%xi1Ϥۑ{ /Hv XU` /p*W*Q Q n!˟ΗWeR1HV05+, ΀p5FT5OQ`I>a/1n=^1n˘4B֣Dy$9 ƀ7F8;\"%9p[2xIXgb'}'t=M[jQTǃo-.;^6iEe=JGUb()>歼džMo0(y1ˑTI&"Aֹ(XؤP;%| 7 u"8"pjﳒqL5nZNW yOޠ9X?@ރE2v7뗯ZKm5q 8Yq`h0߅>YU;6~VB9΃br1~\靏h?X!E,;`0X ^İֵa`/th:iv`F OU Ȫ{-|USOj=jSr8uRR5#A$I?oU%eTDj13SR<..bmmN街2 *Qr?(~ŲKj(qB! gj** 8yix`&[8X[YwZPJ}O(p5!}ׁI巼7 @0+W=)UF8%~ݲIYˡs =r._3i:/Gu~kUG#G|/|6.I&mY}믨ݓ1o[Ut}7~0;ܭj`3.(NGeW Me%E!h4҄ko֤"頯z",u"=:ebVEM|oSFvI2#bJC#ݣWcYG/PjS>(mҨ6zw+S (wsT!ƀi$l}\ G1;CLhbʤ d-JQ@lh ~4riJиfٹ~Z1JMN% N5d<(Qqzk ɉۗYjo/t 4lݥL풪b~ƒ&w`ـ@0viFU)ff3i` -ړ VD%{V]Rwϲ4Y莋FO'^ը}ќ#[qdҒ58i1NiXԙ6u,->mЭS.G8 ,eÊ +fIуWic`B;6fM'QMh[?+E!+lZn$} RuY 442nbܹau$휖w584têH3'X $kݠT|h#^7 $8Ie^O*aJipoK* tҴu!⏊hKFSs?ܠ8CBgoйݨ{G|M7ӹTl I$`Y;X,CZ.^s2D.EKuc"Z\˵rp;æbsiȀ d+x? y =tG?n)W oj'7z )ItRgLzl=!LaQ9Eo((;Ԏnwoƌ 1}0F}gcWUJ gKt&z5k5P"_ %L'GyL7frqz؂t*8y%7ʆrMHt2[_ع_Ñtp˅{@ Vo J45u[G%__ʧJTC*u94:"Gэja#5F~HEGj3;K+f&w NjU]+&m(hz֟2[L :`MG$(SX)f#rG`sSkB6VKdW8Q+߳5*3/X!{ 6(v@x~a(5l=-J%Ys5}W'[U:g4co@ڪv;Gx^ 4ԍ͜%]Klbe-qnԦ>WZ 7qh1Z>YuXO5éo]{OZ:BF t8[7-6t( ?2sVf-eI@r1d66 "Vh8I$ KlO!sg\ w}dnq'>8)K!c}&tk8U/\"B`@! qv&hDUr1Z]4gf]Q,)eXc>r17ט^Rh-߳Խۋv{ܨ8ܛݭbй(Lj[O$dCvA8IrL Q|s;7ĽzxeZɌVJGA?m&)1$^F #8'){֭$Xeu/LC~Q[D]gMvthB8 Zfpnɒ^%Ahv|P2Zmup_fePۉ/h/k"Za6E,3o$ݔ2Z2탲3D!C*bH7RE{I{NBb u0s RB`<}cwon nB Z ۽"\ G{'pJyHȒO;U'#{Uc/U5٠*:JKC8Ni90?TgM%d7-pK>`2"`FlYT*}&;;l,uVYs}> *UYuw%N,t%]M4L_Fr#/QiJt6,l=vp̀@UMJtFF['04L;,7Cd=: OPΆtC#O$ K55Y9Nw8BPnA:c|ffSIvFAuI!.+#h6r1O^["{FD`gf%4Yl$gw[uu SzGʪzHѣU r|MےXO!YDaWEXЪͤmby t7iqs٣RrtB^Q+N ^P7$`PqَfHeV ãd"X #C\6#UkNPlc231\ e+/A:A;He Y̍zbn"R//Xܟ*}µ@ AƜ3K](bxWp&let|0L{͕ L'Yoe^n]N*֟$I Z*pxKl@":֩(w e!s$nLIQHSM <~s[+{5a rHj(F*FH/ue1Z ? i KXY*7-l:S/IdY}}G0:z&.H༃\D<V܆' b\`\,hGz qW(ٴf͠ &H\:2'I+ά?٢#B,PΈ& =JP7%[H9;\x!iaLgs5ZN`EC:FQ( [Ϙb%YqM(0,K Q~ 10ّG1 ]K aj<v`\{VԵ'|+O,!z0S2I2r\,J2h /[ѿFl4UErKO+},! jdLC'}"u=wNs(<譁捞 Τ(jc#`CJQZO+Tl$v3+]U]֩QFUdmspX)3LGe"GEqAYfcobYV"9`3" ]5i7N)2ZuMx/,ש-$sWZ{5iׅn:ߥ^&Y򠽡Xx%a*^n)<`v㬄s+{iô=eFΏF)mSXN9`ӯb<0EgZY)CY.?DS9;-PZ#p/"(9 ua&ULyă"h.i[ `󂞢5QtRBD}Sr`5MUMmY钑MХ^Jy~|JJJA!m:k8: d:`b273#V^]!&}COJVT ɩ!myF0?Z >Tu4xj964Fn'gb~E&K*[wT7 y?-nOTtIͩnW(j3H(˙bz6>G}jZɻbkU!x&jǜ f ?JWW;Q~^l+]TpFFf0H-%LX&56[Yx+XrM&T#ۉ@Mj­b/AnucDS FWp)LDEק  3E2H}5PLw#7"V~c3!_ 9kwϑvYhfZ? L&gle=ڔMعPY' ( D d랧aH* ݓp2C9(IMٞ;g.kQ͇x]ɁoI1`dza|gT@ke'b I }T?uwVPOh -0Dgw,%dݫђk O1l'$&IE&?܅!$±efYhgH E6\^);W(M]Q]2ܠ:`v\25A@+~ wߎ+yM gRdy4-W&L2(%% #_p׏JjT4l BLGNJw&JZR]#]/\>s.//sM;<գatn ֫c\E8a+>MC(Ff]O]G0 |o8Rv/ `~ ,o{ t{ƉqEi{Xp쪉QL;Jv[+İ5 Q3<2=cy0`@B5嗐pE^DV1sd{GpgZ EG2Dգ^d{Q깷~Io$ Eb@Q?%)[w&go<83[:}/_X&WEэd8XI_ bX{<J魁?zPe'Ʌ<5mgsh~&Q[ԊR%K1~ȿd ﯾ@;3;iPB݌ܫj:ջ?!bBYlk;_v$)ȶn_ɏa@AN s%}UUQlc~r'F\M[P@d*~'=kYV&-]QN%v4Š$P̰IT=8E$%`r* 4d.k (E7ާ*Nc)=C*<5 jS:ϗExG djob :i;‹$"` 0ήy \ؽa9N;tx^hxtsc_Q(ˆJ92ϒL%1Ƈ{MTn-12v$k\Au$E`M"Qp韊I9{[X$f] xr L_t  [DپyL'& J-A̠(ӓ!$+ZcᄊN7dLPH6jv`0f| z*2iμ;#Ւ ֖UaQEd/O(2j+ڼe\ Y>)&MH΋af”p*چtE~-E1+'Qb6fzV)[QLlq `Ϻ""u8=LNaX ,w_;Us9(Y{K"%S-63i19A/p#fq"hu#J4~^i="9?cZD7aZ+pڙROݖ8`xǤ4ځ= P'ߖD˜6dX\?adWaI 'UQ/NINT{?G<孀Lƥ|2/5Jmx?=~~<b,gt2'l$VAj-_ ^VQgʥf/B)DJ &!*@Aʩ.)>?~xe+vC䴻UP}KDނXN2WkW&AXƃB$ٝOJ_2<7G[,N>^+D`S,tcBى*J9a9nVz8\W4-&-visD^QK<Ջ䢝,۱=lϦ'j15{=fmQfc0kv]}=|B3hfZ!1`JvlۏuJ)RglחL{U`AJh@  C8D~e%`UM) v=$@~u? H]ŞwJnVRdnXĤ MEѥg8]di%ڂIo%@osXRqlDN5eV4fvS2%`i6r J]CO &QπLyk#TE4cISݐk""_}c6L".k-VUi"C_dH/R'fBk;XS oF+Ca}n< = Go{ŁNc=>B4Tѵ܌욕lXS,0pyТÈfKU0'e5L5s+P*qΛ7CtGx0([-6CO1KT 9>Nbdܜ (й B(1[; V f~m=1'!AѶUfɲ0]M*m?aK`-,t@~oWsd2j|CPc2"ڄ2@YT:[&HUkXA~<'FZj?X~#ߦ'Z+fkr@WT` cådPnd 1ZL+G>/TU[[_0x>4X1 0GO {nNF;bT#0*܅$E5r`~'r%:?T~8/בOA]. =i 5ki5w[ևe^.B.GG.P1gJ8K*r~E*V1p$9F]h)W :M{-,j@zpu`ܡAE! |ZĚcYO^ݚ|9zؾs뒁Xgs׸<>I>.S=5mk0]rɉ/eTd3|ebIEexn9mzS.D1gMsyYdFyFJIr<=P7CwvzSZ 2eArClQ슼Ϥinr}(R&:';F ,:Tʐq 3vpEkۓ)|q-|<71߾tpgPVuAJ=4`TF R7Z }<_RZT|:W۬N\wc9"kFoOk \d{29d.Pۦ2(/+Cۨ㠿JGJd #]?Rk[Zg)-d.CD#7~gǒǖH 1ZPaҹgp ,ŁFַ$V5ÁolC-b"d {h z >*V7CvGIw#LՉY?ذfLEVAێֻi0D%.1r622Iʻ~I &ĉN/L}z 2v=@0z΢g'.9-.(Zr[z_1z # PFD mʊjH3pJ%+zI4{(nA7%bjpESW20!<㊪Q |&%G;\9}h Yi^qS0FE?;?6ib0ѩ~TDBQn*RMsMN2),İd{POz[F)ѫ_G_ssF'^Gv<S/q$ݴ \.7O7E=l}Q*/%Q)V*"]߁Me%h.)L*S%&H/?Fc;pH˥,/7wࢁ E8 l/{OB~9K#Իw"MQE[f_ yH^ԡ 'n:/c* x&IK2H{&MD9\9X+8hpASMgWcY(fłdutlm%b[`h=5_rЯeԟT"~d!: [f<` {{ʢc~ гA!vo?Wb`S"( d́^Ea䲌ᇮamăIcsaSlwSOB6ޔ4ݦ}'>G(y%9P^WuXE]$ؕLG4a?KN&h*S6V{=~7uֹIԄ1&#4r'N3\",{Mzi/=cEʐR?^cv\ =Utcm/ $183`h\xqU) pV/dE 60xxx(+%pq^eN\,'_;m{_ʼn[po/)P2a|8d}xrC:ӣ3 S B&Hui]DC g%ë9 *"=k>SIUD޹*aఋBbmU2L$kg:=S{nQT;HcH-A%]c/Z F)`nܭIGC(Dl4 oaμX25SN^)4ZBNBp̿Op6=yUy.d ka>#Y+)Կ%=Ĭ1Qпsf*]JsN pfacYag:dNi'jiߧrجw7TqD4H<:wSU2'~E<9'*)qZ4JX+<=*;'l%  eac3!z7@0_mlP}`Ԇz[և-;%)z?YFDCo|HlF`Krxa1''E=e+ pp{^?ÏI$7`T@!H* e!R/P1EPR&R84ʗa{@DY~zM+04L@R8lh7mx=rQYjPs0@c!E$dF-SO_׹XqVgaP4b( # ,9"nry ,c$$ѴYn ͘1D"@UJ.^G 66x5eȠHDF!pDdd̈s h0W^GggKu+y80M㚦fЀt1Dm"3eCejMT锃Y&#Y&`DEdT@QEEQ$X e!BPs ݓ:8 c=l!a BT 'cC+r`4c2 bCnB? *n>֡8wt@FBCB{" ^ʠ=& 7?[,7q QI$BD n+qC+sk$v9h6J +0T5ቌ`HS\ nj' B᪢R=?®vjll'3 -S>.SHhrp_ʷ CRC}4int0hw%Җ&">,ʖ>0o]5geP=>=Znƶ22<|eO㯽ߍٶ,(\` %kg6n)Q-1Qo+eiq2%ip\N+hU>~%f6̂A Z1h~mVT~g;'3-+B0-Ri EH ؚq_2MRE 7Ŋm_k*7Ը %ѣ[ÚNFǿq&F,s\ui_Ra !U'D:4.~I0N'+Ev, {CP iZRBݲx4-܉E(>^_PzZYOmy+LJ:Mo~s8 PuIn^6vi98^+G}M0*lkNϯ Ђ]I?$,eiV x;o2]O}"ӓ)~;ӯ_]{lM;6JIx\39[E,ݩsM>ꣷg<ٌ:(*Yi~j愮9d~JK{&o6iKKf|o2ܖw<=?J{tyh巻6M8ZNP9  !~'(h)i?\ɟVFO7ںZ-e????EEE?===EEE====CB;;99AAA755??=33339997s5V9%j+X'b[2zoeVvYN^uG#'Cp-vb1 `u !+0>)LdsWCR' o5CyC iCgLۖab80-۾Ia <؈q^S2) "cӽt9FcQu4[9]QWK.gk7TQA6 @v瓛CSxf~ڈ ' [nJi:߻/ ($dEDIn·ORnHp p kd?N}H@<( dP`dROt+t c{bMt $!#Jט}SՕk;Rh ~>Vѣw|:^gRC;MmaƸDA}khUU 1 rԡ} C O嗣$_taoN4鋊b_ӯ",؞~Xh7; Q-s^Xtq\<$ZaMl)Yv<aWl'w #ofοU!C˫ U1hȮ@'*SOgyf ydz<<<q̾=ۭ4^qb]8&af:Q\@0!C#Q{r>/1K즅M› k! ^0\J`2/-?t{((pc="Ou})G)+Kl;Mב} }RzQ T=Ҍ"xzy8ҲYhl/6pj|65 @@N] Ƒ~ >Z,I>`\pj/j} =yY(aE=IvΔJ@ÕGsqξUQOBz63i[n)(!{t}eWذҺ`b2j9x! ? $ߙR|Y':y5t^I}8 ?pPa\ǞyrݓSQ$R>UXWk3Ѫ>^vϻ$ CG?)ȣ?6XoRߺR'iK%xRTtV/ֵH>m3D %}}m+nj G'D"nyz.O]|3^[Z eQPw4lhڣ8zo7^)>JAo{sOhTe;qԙc,KlRhe*Tk{=;%V(G(~"0Yibo9ӛ*f],9P+˿)K TrIf!{f;IJKƍ/1`GӔS8zZ|w}|DgEϜCBu2UӚTULhB0MLU]۲a"%NkQ5$)A($KmSU|UBcWwU" wo;Mȭ:D>Xq"B_$s.?܃ɠ"G}?Z)hHJ||*Ѷ ,`6a^#k;& ~vgMe)u*VFAvŜ霧CƹY['G:2UK"OF5ʇٌB)ĩzes_U*LcRx˿OSɝ--X.#'wzc6iڒ•vJ Mv[{c6 '" 0yWJN[0́s*KUUZ+xڽHWF}k˚>֢ [ à~ :" H61qao/l`h|pS$q(:rY(%TXlK.("A~#Ucv4eÚ=Q[R,(x\5yQ~HrYgN02c4*$%wz; OMck3`¡&X6{y"'x\/9 y?wmw U!PK(b όĢd^٫N[1,s<ɦNF BD4OznE'ʞмx[SƧcVA=~=𒱭'8 )ؘBm6C-{**ie.^d]]pj(Q#yMaBU DJ݃ 1a&!AkaEy6kM*&k4`(QX# v*o?+9z 6mC褍G j?3 w]gϯn4 ʇB|on^3;}m=UꓕũE(?=1Ltx{Cb9R;J7!7N3~_ntH,En~=:?xv҈jNU Oud Czr<+xN C3jPWXF9|aN>c#dR7\Qui99:m.WU[ka9_?s0sQ9ΆQtg=os]oU"5P.b b"e%vL 9jl֎rsr^S-/_95v'oꗻOrO7stg8Nw9Gi𷶎ο-}õ$B :J_M һymmm['溚qPPNMLLKNMKMMMKKJ}ߌwog3-L4w[Tʫh? ~?'~گ`sz6궛CWBBeFW6{lm@L@Bfݶ c,Di;bKC1[袦~z+$ޯmַЕPHU6ʩI+oz1XBÚa54K+?JޕއiR,V!"yiE2&pZwLgDž|JՆ;A߿qMPFWNW!+@4:}")91!u q d g> ,Sa͛*19*/(VN97 LTO#{H3eUһxXTʡo6Xh%,LY `rɥM (k h!]o<Ѱ".1<($‚DMƣYT U?AQy Eʔفu$ZE&ZEE W=LHb% #aMuWEٹ]u0˥\$%ZPdm˾Bf2rjh(,uqXE)45(h6XE׀:eg5`aJ'5ETH}#~khɄ=4_̬?FBVi ^)Ӧ]d?Z35W4kbߑea7u! !`6efT^U> Be*"{g|.G>7 *['!Mvnc}*gp/.J".fԕ,U5j8ndnjXTxhkcu i~ԵU/w4>.e_/PEڠ>dñҏsJK,n* iB;sIu9"V 䈁"X,II%d4nv5q.|,X9С`8DMACB pETdUB@Nj[I$ojG8qH$Dv? u>L.lm~oV0 'mH\-r0Qq(!> +^{ _t鴋N5kgq.@42W(,+s ˑ* vP؈.9Jj&.Y2(wxM6u&ET`-rNd6Տ4o T v}ݦSÉ;K:ZeYotQÎmˌukUP eAF%JHW~oʲI:^ "S ʶ*+Qc<2kFEP,ƕRơ| NEnj9 ʤDW̓PcJA$%lk;amݭ=g#฾[Zq:^'b~Ce༗qޅ,"o]QEw"N>dܔpi8Ir5?/}n~YAWઝk?\GtH P+9 |cB˽I ;#-}=ME%=E.qSp*N)I!or^Wb][#fģy@=r|jஶT%UkSaYV ; NO}Yv='(_ ºP3vmwc#oˆiU]Y`6me@Zĕ9ڛm.V F\uvM KYAFDPLTP̈́0dy@,Y2NFl,U;f~O 5`{vmTB-ku Y I]f@4@IJ*KVkYLib;GIm4͎8 *BNjK0k( ["+u,n֭w!^r DJ("S?7|hou-$R.\Y BAQ@$/Đ9L0z„̬LatW :[7=A$ y+ۀ5~II<\KU'w;+z:2vݑFeQOj(W${̗U'}&(o&Ԣ^ɠԪ=S}(%VlW+~ZHtͺa6A2 ASժ4W J, RԽaMo\;OUPUk7QˊRVU8хʜШcmLD.SD<őb CVZ۝Q9>q{ x\MREJ쾹8%׵.wtI&OY~@6CQiFK.Iϓ7˰N"m JtXULpqp5oEQ>Bhh:.#g;8.dZ %| 6cW +ܭ˜\ըVǞkJ=uwNw:K]lN(8rAT%#`BG`W/p\E, S*: jX`o-6-,rگq*>dA_:ܻ +ܮjbL:fz1%%r[@/t3b5 A̵S43[>omxX#n(w&ܸ\/ 9m52)H,C*xM i-Μ#TҖ wkabm 6ܧ2l7b{w *.-8MWQYuܭh_PP5K_v$ҰޒLo٭Wo{LCިwŝ>XmZf xslKm<-݂MIݔԓfiȪQEHEr0DH;_uuXe.u\w@a .DUEDlQIgwG)~Nt[syo|D&(̭I6a| }ӧ!hg},{h⋷S;bGF|2TU Ra=ݹOew}Gwoe|$N!Y@UrpA*(/` `k EF #XYJTMxDdMTq"7Pv=}kx҆>?\=9Q!T;^忍SɯAגqSrl xͧ_ϛ|'7pgbT&#nL A~C%Ё@u(E1E^ԍv6mQbPZO4K,kzѥ056\- T A%7(Ppu|rx27*G5|k[I=B'}XcpO21bhu҅ͩW}w641X4DxyZdPJ!@P$X¸6>[fvۿwkv̰;?67c"À+$P ɉ3aV/&-X+fsFx3{"M|N-a<:NkpDNhOY:h`3*3Lb qp %CfҍLrRYY:eA݂aTX(sn/}q"A .Ex١EOi5f6][uaRx OY-*ѕr95xQ^a'uTn(nGrOW@ " )#q6 kO"n+ܝ](4 F'vCW`m_E%mc 1AnNo8icbx Ut3Lj9JL'殜e[93wɉ64m'֕,o0 "q6vM0՝|魸hM8j)JA"ReaYJ$d2|߹&fFlye#눈ψC2gРI @PtFU[!.s<@)W[U^vaU/Sf7HCOz< D`HPD",PE]hU4IFkQeE n" BJc\ڶ%LH jtqvPr^/vE%?/hmeb>yT1TlfT! ̜[F<瑾%>N}#ݭ[ *Gۈ$u^PE=V3mqprbe1<ޛw%9UZ=zAJ l @%D苫g~֚.y[r67躷Cym:$n# ˧ Ag.}}Kx DJI뺷H&۷JUl@Y ֬M$OA߈z G1N󳿞6EVIX;*@DR:2$7BFݴXc~ǰ窉& Xi$Wq>R b%f!lJbF+Xd~ir'mݮv dM]KAכʈp455Z2 D@Yֶ }5Tݹ&}`[յ ^(r놘X0\VE_uEW$_n*w/Rs2iz}D yJbX뛧 {zo(۝GB[U5 B_~سe\5 *[  U;v#3CT tpUJkz}a0mgv]n2UR3QW:m}q]5묨++2;u{ lEq!c.f-Qp@YMX"ڭإr@Qk>>v<+%xBEu§SdxA8S/V7"H&E WyS} l!0! "{ڜ#!dT91H, %I[ a! ř^$qNp=g{Vߵ&X0N&`W=%Dn  nd A Qi4CH;L b_GKo,-c[&x͍T}J_bT-p0ZFQm0]qbDD$T\#",0A;G@әDm}X Ʀ!\+ٔ9MDSr_pvQFҢYu(fVe_%>@ԂuHp4nesr,&+# -cbu6%t'٧ldЋBa"ɬXigx8b(ZM-ML\X~%01KiuZ p(@.X v⋴ #,)ZCb:uvfANmƐUgb6xY DUGҨCruR6@\E{Ȧ;]5=|DGK-uSٺk.MќdN( <|MokYӲʧ8B.ӌ) jWK @pWpo`j0Dr}G;+:{l:idced0Ur,rtՙAX0ft%\S6 XF)E `/A6_!7eRintȄ9%~,66oY]En1\H֧_zuvLsRy$oPak_uKxxڱp mʪ%Gۦ$ AD:d䪡{NNWZG X:ا~>]{_ppu=7)RųJ6?`y~& S;ZvP& )r[a_3 G?|Pe z2="sfTTE5HUUBCÕ T_ IU,)m5]}>B"RMF`~NUgoT9 `9|C:CV>u(zoxҜM/,ur:L x*+̊L zҜ7aD\Uh?c`eE׫1jt+΅0hg, : $!#zlyQ}/(Hcn Т@k䝎M_R5ٍ7XA}䙅 291_W]GEt^Ռ>Zܕ. |cqdqtոTCػJ)>e e1m[B:uSDOuBϘM]c.z+{_7VV)K~|zغNQ|W e յ@D]pdTԋ^DjF ׀\jf " 91r *Xi@(( ,ƧmAtԮufP3ZP@n?;:}+6ˌfT h٨QA gERMI9NMF!XNې4>@M kjvCWut1[ݐ=,<Г!s4pápOsGbo(٩h0r"D㺣MfNz<ƔfBA X* oc8(K7/v0T"kG5m 9E>$]FX Xj!YONۆ1yP+ټ>ڵ6AA{#GMݬ*&(%@Qըa:!ZO ;Vu'SK݆9U+yJs-Z@)cA&DIءJnvmY]>Ls_)ojR(Cu9+5[C#[uNn&PUM (#jAJ*- (v%`Ō^KVA |\oqxN1F)UShҎ:bl@k8&4]*jʬA׳UQYEgڿ]&s;Zf׫0kanu˓&;т1ZM"4d\SUoI3AˢRU]yKTjͬ*ld +.8-PuF[!JA( NRabL0¡:ӂi|UVB@2:&d_#sA0b,‡P>c9- 1?r|&0$#`00P@۵v!H+5{N'sxi6$I cm!!P' ϗ::FI$o\ {W=q6Ka˺tzm C \+!С+P"CBdhh!MsG\:gb!і" 2=:GPS|].ffv燚x3(ԂK.mlMHE a4f\2.Lbk6 bͥ.V0-sFcKJ$hceQ!j&"i C/>oƵHN}N:sRm'fVwx|SMa}ϟ=Fy+;j0M WB3;d xVV`lP.pT`A}mٞjpE55 Hota$یI'Y&m@fɕf6,/Hh@ggVZ GZS=,o hӘsPtm{d.p1;6d۳[kՈBLSpRɈڦLګq&"2 P h(.;-yq )] esG\ƞPyKYdXy(JJRQpnr2S-Ղ%cQ! Ig^CBBU74+|p<AKaaj1B]fW ՎUz; !P^QN! TMͤµ@Xt^uQU qZ[BR5!F#(,1ȵ v Wժ2skQNAe*Ȝ3gbn vӭt*&ctף6^sN;ݐs/2uò(h6uqzÎ#:Y9ضl"6n"&9*k@\^PXrT[\n|9RP_2tb$o<-CmZT]cߨIWW'| $-ZȂqf H>N53eYfb7Fa9u/k lq5[l^Ep18bU?,bٰLQk3EXs;u̘ fBfl@Tl8p@] [m-ox<{,D1EpÕPŒAlckt2P Bi*DH] TJ*X0b-j!P DX  2[$W$%l(b}UPx1Y5Hf:uD#^I4V .gUQ]1 .|2ϳs0._($ƻW92x gF/ ڈfHM*5BA0LuʎII+ݿ@JDA!b|BoSB=3lqrW-d\sXu0aR 6k P`(N!Jqj?'ND%[.>h DWJ53mo^IOj3 +j%$DUEEv=a4=-iiƲ;O9יwI's:~Onlzk_yEadMxa9F6D*r^b6A,CRAbD8VHI^Tr1 Ȯ5 +PJe֔mVa}'D0֐;WZPcqDm4}2&4jE3IB$ϙǀJQ"W4aeFNl-(roQiB8(+B|DPS(n@Sz8b rR2 ZI SZX #g<·; {NX@dxNQrԞ3N&c`9> -,.Buүz )ᰦ{BF%ԃ$q^!9@yfLl bA(S OVk:myvOMHT"\(mJfAdp()+pʃ~ohn*u PlgHme ĢREDcC[ԌMz(HRwK7H/*(Jh6ӵ4ymgg=s]h4-" ^Blcq" =WLXgCjy3FSgn'3ܲ ~{UF~ΩIMC@ڗq:[@G.NıPܣA&g[-wHP? ρ"X0BBER7)TWEÃoll balU"H<FB*j0WVS&NZ]\Kv85)ijaPqvn]4鬶kNZ4noVl]:f#6`;| գa|^9~W:y]] j5w]\㎚# \P${)FoLe„H ~wa$ډsXR$@\YY aomtvRD@NJuL'Ayf#ݽviz}3S;e;W+n{Z=wۭ\_^.fwם&/kۭ}u|AF y)vav[%N'[͙3v]ZA{m_{v;}jW)]_^}_N5=Mǜ}۵\_ym)_=tͫ|bK^(c,^"o+t4:%ϳx}T',z$i;oO{y Q_;z.PsKbFֳ)'wp_{64yHm:7vz*P NlT`60 ѐRP=P( ѢAn4@(PMsKuZz|ÀaZ}Ҿ ڻq}lCsD(m h7nu{6{nn+=׾1&޵+6PkA什=Í4>KV>sQ>X۞|Osގ=ny{׳UwMwlݖ5ӻ*s pκ a>kk]9%[w 4>Exk@)֥$D}mtF vw>N;eh8>Y޻xbDx(>[ӆ־y@((@޽ ǹuC|c}(HofP6=}+|f=zzjo }{[sn}^}ay㾼zOvؖٻWm}̔=<>;}=*}SLpZWhj磳M )@`[qYڮΣ.wot;}{{콛{۶'Nnΰ2W^}f}SPWp{ϏqX%XlEՃ%>=xnuWB)'YnwϚ9^#'/> uݻ w{GƮi`Nxɠ8=ޅvm{$:i#Ld@M C I5O`M5OdhFO@S?S I憉?SM ЁMi2h2h$='4h7S)RmS64=P'SOPxlOS?SԞ2&$!h e=?ɔ'S?T?)xQfO(yCAC@hi= 6M z1Hɠ)$A6M54&CM4F20L@Mh LM2h2 L&M4ѐIa6hɉ)4dOQ=0TGOLO&72QM@mOMMh{Q4 6Q FhiF&#FziFO)M=M3*~S4zd&CCB~M='H'Iɑi>a|GOze9=Y{Dp $Ch*W҈%?M6¤(H?DI@sM\ޜ3'7sqD5V08+֌e$H o-z?! 3狚Ec^Ot=>9J5LiKd,o,ePcrȥ"<|IόH8>yv|9 $ph " j'iqO4/X+=:=Z]?M{lIy?g6f ̌ A#?gL# n.*'?׫pÒLbʙzS1VUchnIS=mf=@ぃہVNWnL5b516322E D~Fcƌ$^. ,Lh堔A$QsGPqTe <5RDm&|/|K? 낄L[Ur{70? =", ]]BHG#Dx!Q0D:%_@ELtXD~nNP "Fԑ+'"1=I *Iϙ:OQ*E^┥%MۈWUUQ:6~+3ͮi qK=T7sUgVS/U>.k&@ńK!2Lvf+{d 3 ;HGF|!3II8&F*edf"Sz&3bttiIԆbHiک `<8e AH@FKSVfpU~|;(=qi5;) $QƢ4Hd_(u P}: A |+w|_#€yI21 TKcj*iVI#DEfj*!$EAMT!m!X%E)(i(JV)y}! h z^7A&_d|:*R+Vqp )b6ڶUYhϷq3 I>Gtb~\\@IDE 81! ܁LeMFffRCO&ly]y0 >DY5Pd.[įsß2X%~b;| vdV!a \*SSF( ۣ^ |v# D?r21QbEu| 7ֱF>QzgP"\i\&H|uMoAv`pa9$x8pUňJȡ['LL?fXEfh$Ɨn#ߧ!ڬVYCFI.sgMt1(+ YI>Uqe̜ñE !Β`(ndPRZ@[dГ$͐ɵd&M93릊y8`TOwr\g! 59L~{K0V hiAWM@,>UhtrX@Duax CV?y~ uLgnܴ"f&)$ƕWjmO;pΐ!ڠgVͼTx0iZɨ@'#҇݊*PI#L* L9UH~8 n(0|`3L 7fmd#ohU ZF2e.P :$u$ޒCD{_qP&y}K krfb?AE+PfAbD!Ž5ׂ <ß,; 0a58rHID `2QDF'mR2 4Զ[.r8uI{FLtt6NBuHHjMɹ~ 7{^nwٲyk>0!aQNEa :ؔ؍QnrӻsW# $ѹr5^8Kmʋ^r\4%݁SBۄ/Kbaw46K^54+7һtTng:b5exkդ,'3lBD$Phy<_?.vtHUdўiP){ud 6,O-tM&B/=`3+1PPܘmh4I"f&K1;'){BL~GA*@ jVaO+)lJrNDJr?bƗ B QQ:VrĵDQJ#^]4 hAR++.Tfn0(ðoCa4c22&Sl^d')'528Ruzrpb7*{`[F*'V򙞣ٺNH, %ڷ3JcV)!\E"aɈ%d{XS3U0Ae uzӧEACI'hf)xXIQN~9>[OsAqY훵ĝݲ#.8#Cqns$}Qj[l׋FR^)iP%)F:L$"HMo69#",<?w\ \$)hZ&Qhg T%14^b`P'h22kALJPC=|S3`?6!滑~ʨ‡ ȳ1{iEf6 =|뤣j * ɚ!yEōS+$.*>WkOw =y{@9]DP@Gڇ_@<LM_wW_3p~u_s~RSL>I2(ow,AQA}}>T%+(C>jp8݅6)dj34ZQΪcD,'˳1G7eyTJR^v?u |C2. 7Q{izm#p=8zEoSp" M(A~|Cr,ցY4wnzr]$OcMAaHh;Úƙ5IAT,H8ʛ_&>^$6vQj!,clZlRHbL}}{oR4~O>ϒ$ET2}43%C C1RtE,aR{aۍS*/3)$9]rl,EAb"/!4۸;MТdƣ B]0{.RJ&(5莇yCx:(ގڥߧgoGkCQ@K"Θ ~YV)(PBBAy O7 С +,;.+o~M vx~OMWe84N)m!,J$'Gʾ츾^'^q"g6b08ELq֏-/o3apC?ndj20zwl:~~yT? 4PNAw}LFo8I nH?!ӄ<{<n}?!0=~qqz!=6Aw1 _Œ'o]G[E&Xgݮ8`Q5yO['S Wu!r*`+;_Vv[f58NwO9Ӵ]~m"#/2#PPeLT {P!&Xq>#6҆0F^ho GR1̨&ƈ)YQ1l-XTbEE#BTa2efTQ7d);_v2~ݓSy¾jjV(fE﫦~ !I,),)*u^ klw'` HAW,?<>aF!xl&NUjCы-M3O/9(Jz Ȉ ҰDm*T-*Qim`j Ʌ$Xn2]ns*'~/]<,͒NUAH P @'p΂vلؔ}T7~&^HiMi&33`R$hl&g$GS?@:I(.TaD*Udz?0/6xϢ?#@:|/΁ D @w]a|ZsQWv RrD}1Wt}=qb Ϩ{i$WLI**< Obn/$0,fXw/\R 4w)hqq.gu1h)dIPF((P}p?bzh@|n_AyOɹj(h{=~U('F Czdc3ÐDVϗ[g!=Ja0zoG[8E2|p"Xa*8Pk]dFgL5'mѿs7pNud̟+!\6eFj^j0i7CPk@ONsvfQ_ 8}H~bL̢zdZuͥ*0=B98ey~AP] 5Q ${d !flbx5NCμ͠2*k{砄}h8:W(s5v0LItxOcE"(h#Y*X%e>0>Ϸ31ƌ(&`eJlCIKY(iKYM̥6U)4iBu$1b )Q,hbmچhB58̪d`0ݩd(f4wt5"*E3b˷^+a#1r…UC 2(\i$Đf;(ѥHbRi#js0iJ/zA D=<~@=OKBydAHYj >`D_^.‰A!TFeܟif '~܂ z((aG7}emӯN߂`Oj׺P{uLÆߢ0_"އwQHwԺTV}<i !~?^auN>s5V 2 P>PϹE2 ȃ7;u~b’8, ;8afv`vs\Su>s ]X'kUJkT !$SqI>%rt* ɸ//o+ hfZ(30-gv08[=p9.7+#O5qPAI)+רRvG\JN}5+Q~ $_@" cEt)楡Գ|6ֵ3 ;"WtƜrXQv[XF8z߳e6KD XPC8lv<~ce!*wfl= ԢvFPdE %4 q8%d'΄E u3=PJVY$W6v8N#AD)4QX: MXjC(X.,hN8'W=gis ~-ܐ\*u̚JZTi9 p*]֩T4.n ̛g?&N˙*wJ":W狃B*F84`9 hDP Y d0aU %d=>;K_wk+֗i-\ܹs`.uQ.m0kO&PshoI\mK;2c Os%aB3$*@>O$+%nӮս;4UB3Q$$#+R;+YʭRCs@e+<ABkӿ\ |^0hK:ӺP"RɕmO4qXnٰ9{}jHu1p*e%ͳ4.b Ie\$;M[O%>)MVTd')JHg׶Q %$0L7~tqRFWv񤝷}۬1{_AҒ Ahy>O^;>Olza)8YLjst;M5 f>L/S B=μ|(t?+#@]Ѝe6\ 5kIe-j}_>?Tp<{}j(E..LO{E}.}>2~;XN,^ǺLy`E% !C4TugDG\=K*jBjzAm|y5|륺a4Kd~_gz/V656.%6Bk VvggbU'%;D 5sv}Vfi>7w~#>Kǚy~m0;pZ b;m]{vV rH a @pu6'P>E}q)/c)Tʔ2Wt9 nz('އ:"&jh{YA?_M 5M#ٺ$G:~wG9c M^:fFzw1uD#x&J65֚+5%d٘H$`, 9ڽe3Qbo9rMXJ#F0ihV9)\-*]Q3TiCȶf4$1y-e%kb(D@a\D#%dFcF16tVb(;9vE\r4hVEDt8(߂?o[_@TTŹ\"dXnā572m&x]d("Jf8ʅ[)E "q2P)hn(dș''/{3^+IڻQF,4ǩmJ5,v2**bBr2@N֝HMٻF hbh4A&JRPyh,JuΩ6s&+HMMLɋId 26,ʄIzwv0I8{tC4}/*N\|Gn1WR@sl!i!=zi6YRRlZ5QWuj4A L]tuצ ^^ocFǰ )9S6 H`&_}AsU7 o=~gU^\TaTI'ys3~B-n?λxdgl_z{@}h~.XȔ#uq{BQ˳~ܯʔ1(+(aϋ[t.\k5/αg g A,noFMS3ezNsD<R-) JCKC$.AtD6dݭazq3X+<)/YIz: HW8J(&ܬO]jT SSdEjWPXo~ת|ͫ4=n`Ln=zd 1R޶vg'jYiV?uKҲOP^`V~]E7P*|Dޘ鏲}g%ƣk4u!xzPw5D܄wJo, 8ƙYņ& PC=_G>h}\F^7pÊ;<@`EG+Q;R780Ca=5΀A]pvQzTzkg؃.n,(e> )9_%O?;/:zֆ?w*xp;4n^Y{&mO[/6V(r=V{ǐ,E۟ʜT]L4DbؚfXPZK ?;=4(?`C{JO5 ?8s9t<ϩK!W lܾnnQh>+qdrsʃ؆Iˑ_5%Bb;QO[N;Ի iP𫫻Sot@!<1F^{~䢞K~"/%J|/BEUjQr?wAZX^sW K\ݺ E`8}b}鞁03}X0k¼±QniRtnl'!ݘ-XBP);Tl621C="4JbM,zW+7_}o\LWÚ+ui,i/2GNv/l8(4f 4fd7.zqJiO N Ul#mК@q6B$|کgo{4&c.jѾt4MDn~]ZgPkDE"@Q a䙁CUzND}jФ3]ٺ_T6]5ZH:hFhd1Htخ|4a{:)l%Gh;%|ycT"bɥX8QRo9al@Z, ӈ`3h |̠|B7<sH&"v&u֫.UZ_+Ƈ z>cS>֒;BeRY^sPūy|ϑG17~/la WKX PX.93t+44iorH{8=~CYQE@F(.;E}pkM7.?.p.SG I>#~ҸN^\{?V(fPGROMׇ3'QaaMgUP̫z'{0٨~ݪ2(vkQhɒ(Yk1edG\"qCěuϏq7`@ߧGO3EO PChP)KM]! uҰ6q)2yO)JqeZNckOH>9[R|@r GH nU76sxIg ( E-*:*4rKXm=2yKM/ij.YMi (S4C|ějN3rVcąYȑ 4/BÅqjb92C8dy@XXJvxjz'T meY\ӆ5SN0HRB -K3f3fDy<~YvAÆ48$%U qxDKb@W"1]}=d;xs[mxsS< |vOG.x>R)L3kwWI;]Ż]DЙU%$6zyQص._v.4sՒa6~ d gUZpJXͽ:DfM+-5 $ Hb5XuMIM5T[bH5Pu914N"hm-⺁ru̚(#1f$2!&R0DI TtQB:EXYL BƢvGj+xTR6!D*T)%bA(20㒰R0V`#r `ZHHD(tOZx|?Nӥ^ |dv(f lR-ec2-3) Ǣ9CKCU>yamjD^;C(uzL2HpZtV7eO$O_'w0THyc➨𥁄fN·E)ܤA3PDWMZѰ @( L`1EK&!c0Š@5c+,KcHe(zlr)>)\HNA;)A H<> ҧnH, ̿|=u,@/Кg},ٞ6k3S J b'P}ĵp VhGU~HquPtjgE-wY>Ko˃Z8V$P2Y,Dz8_)!KP͡ >lCl$*w>BHg^`I6xNMښXqmߗ;=OO{|}@`1g`vAcd%VB,cVΔQ`vS l|B{3'#R,JCK*]KMŠ[@P&$(!Zҳ.4^pC]`w?21:s4ܝ|(I@ϼN0=O7gp{bOP#{vob,2LqJ^v<Ou 8=i^"Nq1(:)| @ըMcD֡STV`(iŕ6 bRb~2+V9?^F qqINX<E!=܆Wf VXjDccD'EJ`O=P%'' 8M3~[lS2R,tπ&k3\Rĉڂ69Ǟa1CtM {(^4Nc֟/ =4x`̓Їk6 oqx.yu$ vB_Тk 4&;^f8EO=S˽DzaKinmIä ϛm:t2-XMۓRt=+ ouQxrs4~v/w޽a<2YkҶ)~{aRKQC)c","2MIʯk1dB4SOk-az]"@rF[;.:';r&L+stqn8 У!EP' 2r!P%Jʆ&GFO-lYd)!8T8ȸ2uAd7'IlȒP6IjG9YR%t>3v>I=đ+ d<T SԔqwtu1tz1w:gJvM+Nf&>𥳐V ,wغZE#ܮfhsfؤFsC/?+\H+;g_'q&w;rY$x;y|o/u6xN- l sK+9aI#/S7BԄލ<=읿ltEk1A \Qѵ @ޒ)H18B@N} Ɓ;d8dXc!>IP4'gQm ȰR`: ف4S%*.s4-1,_]{uuBRId՝:QGۤ,MnuHZk (TEGXt8޻Zv}^xNy2 ;é5Euk\` oGZXS emY/W\!a0 AU5 @n !>$==b/--=htJ!tx< C^C=-,Lĕty E )cWsl[0&==ؗT7nO걡J  L| ?CDhS㏯Ѽ;a=yWBiR:ܻ2aHi PRBH\wsܿꦨ7g hlb=CwdE}ؙWEHӒ gA/Lڮ27ݾX;G2LK&D>wcrg\v'Ϛ@ .(PqXìh`ϋx1{BPO 0B ƢSD*PyH6lާۏ;yF_nW A(>b!B0>Knlhw7g#^:hAǧ1 =i7~z%r$)ѳP]9&dA,sc|!iC&/}NvA8 1"  Ů>Gg{s0(JSty> Q=ń8/^\fӌ`_ {<'xPF")@,&t+m#0mfrCzQP bV-A%k9UDB:ר칞3OR=[qQ 'ۃ o|\أ]iUwyZ pFg4PI3L`wz2vh`jx] hl.:aqQC@*zD" LM3UR᡽[uA~5RrŌ`Лqzw_XO};v 1vd/:)r AIla8Rh~O2sL'GB2-B̈́F,A|XN7gC!2 ѣ~O^9[\=Yf %rBB65H F4g߻Zށ;54׻tZi;+aωO v\ 8k%~HBA SVi-r&}[+xنB0zݟg=ʼ\s]Q-ߠQv؄#l 7?R^ߨRg517+KFmՠ}l[ &p<c{^iH wQ<ƈx 45Fs_  O4ekM A5<'n-WLT#vr vI먒)<^r6LbO\ *k'9n[˯+WII)̈́(=+;mXpK%)i@sVʩPZiV Gvy2ssj9iͻGƒ3û\4^SHP@xyNHJK% DWdd';#svh"avċ3<"b^\ ~؀)wca#B@Cfƈ`oaȁ[|Lɐq#zxVdQ3ѱBKK J drɖsaYV! ~VoFlj@s±xN1[JrffM5@K4_4& l Tg- g%P ޞ:#P vM_[dWvC 7nI$krjjmӘJa796( mMEU*o70Ih =w>[7,:77Vt~55вcC(0vWOec{VUdtEtpZ;1Yk$x)S@Q68$yn|_q|댡 ڦk6|n1qCwAXgZce 6o(?[s7!/;R=3&7;ջ-[y/gK"Z Q蘘$:w19|5IJӔk-Db[Cw*L]5g>S0a o1y0'833&?Nۜ=@ߌA>|6;#y GǟE>騁E$OR{Vykss!, E ShV5J) is!㧊Aڋ1,E 2Iee5)nY2l,YB%  D[*fYj]Y&+YL9vc6HTbKJ|R12-"%N??^ /H{o$΂@A^<{ͅruzd|cy@~ ~ɚ鋚կ_."f*|D8'yrH5 <=pnz6*S9CwLc b5˻Kpe=C `ZP{ѷCw``gYfPK 9p 'LTSFAgQٷZtlj Bi:q(vTL5IlЁj[-RvFJ2;!հ Kx06mBhXT as=ExY!t!*SRI: !+*V1 U;ț2֝ޮ斏"y|r ZߕiRI t%E ]k6a9N*t0C,T 4K.@ܬ na},(TU˟8a0n.b6ylb_yF;ن@Gw7Rƨ=g؄G.:; h>= ӧ_Ci4*v`Ȕ8fc7~ր޿-8ݫx!] IGgdt`,Zx8rMP!fBSY0aִ)o<8 r.#2O~"-5|H=}nd6YH3&ɃFc}Qb+bvcLߎ=Qmfq e`|{?' sl@;psσz{l#5؅L L(Ex0q՚݆e-VzjV0&G:kL[<,w>31ޞ`繵\}lGܵi҃i W$ʄ{$*3Nilџ1Eӯi8)[}>!Pj u!ӟC I:4o͚M,k081Gfb"ۜDsҏk3\սý,F@<໶-5G ~:8&]5#)@_ӜC ۳0҇N iYuq^Vl6Kg5yB_tߙ8'f.eL}uvb ¢4 :h;H/i} G|qNrb]|3V% Q%GmFןlg՗@ :bDDͅU'veN.SYfshw> Sz"}~IRgӳOSo IxQċۃ;g?b A=?g4D`7696OTgs߂AsTmmT6GMB(?;& {@A%H ' .|mF˧m2d|YvB^\gdhZR@;x赣/؈%:ldp3C˞9,˭k_PxU{nz8_2hI((d+aT :" vڳ.a7lz H=̝i8LMh%lM4-/]3x8 E4OsA=kEN~vA: QTgKgO9 @t(B@wvLwns޿\ 2o981;St";A<S{/N%KT/,8M6 k`4K8䩆xsb@XjH}o8wvL:+Q$s&9i[OK v;.㝢jV)(5Q469 QAЛErl$Lw}ۮ:a~?^ϸ;RA]pD L\Db(չ S&!M8^j\ m^4FOIlgԇH&̤^98DGP@.ߢzւH>J8}*CTe^ $w'Rr YB.`k! C8lCzN8."-#|k`@0|@- HL?ySOV!|,37/(676_Ps$^568z^Aj`S;i-inA6YjERCt(9߾=,OG[7K`$mioJp SEG\F-UqIrFndPibs@f/G]7H%fw ӣT͋OB{2mkW[$ ;Q'~GƄd:Gʬzv< 5G {Gzެ6UD%(H @Ad&_p@װǺS滤C^-3z%FuՀ>躄/$w^y]9}PGDs DA6E ~[Ee p"߮ "56m:dfhuI*^ w$tCeiձgkJv,Gb<&<۸\haj߷2ҲFp (u"6L ܜQw:]@qMN /{ R 􈺆, J4qgH~Z}mdx^)0Q;#Ă;R+s_6Ķ8L  XK"W| n(ԱE߫6 ny|nG ݿ$8fh=F$c#Ϡw$女v|QۖOQ9FM۩̫n3\psDħFj9GAuf}RL"9_)ND*FL:{ąjlh(~j3LlOu7ɹ7&fH\f4Hp6%u!Ch7Hsw20CX@PRC{|:@*a6Vs*0F)UQCOLq޽vw?z܆ 42"Фoȭ|}_C9On!ԅKlPҗ(Uq`pdX"?>M'CNefO v:ye8gGd/w$ґ0_ M̐)ZwmQԼ>{r-=|_iT3R7.;68wtx NHwy4"D~?mp{f3vs*;9DD8BX`T0`ܜ6 )X P2D:l<$b&~w5>tB_*<'@k-g׬P 61"eD6S7Q= 00w=oy:H T5$i͸~i 2B'{Zp$H9Xbn`"gl ;CfO'o״}= SݱSTp{dA$ԅV:{[[$/si4dPDQ$ +jYV-,]ˎ$=nIykzUµ槸uk-IeLR܋A",̧:Yu+b3|e< nGݖ Ȉ_Lp<~swޒ|z2#Hh)gZyk #}H{2 Q/- ,(n(=8LnRĝ|ǀ9>.J) o|ZՆtP,k8|?er̕M{~86HoPjY7ǸvJϹeгF=FwHmj#;@:bPo _ X{zY@(۰`3^T C?jYWݧ XGlx@4]aGR>G-?úm`)+xpt qԄ@qh=j]I UͣzjA_! lp93qw8[Y.Y ~=" LH;@$uzH)wy%[0jijbNc7d3r366mXXG|]`s%U} rOnN~â?% =SϙgFs: oa5M9%P𙷕;=r_sXH7hӣ}T:VQE=f٭FOe.뮽+sanB Epʁ}jpN.V2KwSA"X6)6>ob] JP*(aۺMz>/*5CĻ"6ʡ SP&hZ|A /(yƛ?ܼDub@;,g/Gsa#7+!,:q ~ךίy<~-[=Yۍ<9i6H]XŁM IϵP !S@Bƶ _1!0rdc^j0V"u[g^kt:lI$2MHr֓)S09;m2:E0OK)vZ0"[}Y*XUS .p[H]chj :tI3PZ[bd SCN>-+S5Jm\/q|oA;(JBs0r\zSƸeFJL Y&]8υ. 3bٵÄ/|]F])Og sH75^RPlV2J@t^sR/ ǝ:H>]{9*B@rLT/zap9;ӆASqJ\;`v`?jhd]N(Y@QM׸&Qni.c4y{|W:th W<FHA2_s-Sn:*NSav * ̼9oÛc*Xh>Քz؃H8p浪p8X1ihK&A)e&Wm:sm0 rG7KpA$x#xVń܆L [pG`vR`Wt}c%,ǹitزo] J;zgЎ @POs.3}a!D6>p/A>ϋ< 37ln1L7VSyu Sz?Tfj/ѝ;wN -`h kKiʨ)&Jn ]%-[ #NDٝ>ձŵP϶~j7?H#](8/ʚψul{ʹ$2adl|VՑ[7XVh7k_0ܹb.#å.:>Tfb4ba;ɓc& )ػgoVR_qJM$XB=;10Ha`> q?rOEI8pmĺ6EoG5o}.z5C>ÂHuH.&+öNK@oe-ѻ7Te#۾{[!*ϯ_R 0LpjQ\RB*$5 8E\sGOy ϱ귏wzߦ7SС@ D`(E H9,!ۜ?q`/n }%pfL%=?(Ho; =,D"7Gj5!Ďg"(u4BPP]m$Mȕ퐥VbDʾצv(H|Tןo@t d̅Sц1G_LC vd67݋Ruj]lɫ~*TqxM{rTvE(q. X;E> )–lY9TvgIB:GdyνP@XkZm/o}Lkn1puY@ĽW l|ܧvcH P aAq/嵄$$wcxg9oFpɎ)tc0Wr :pu '\aL=әNfoZ-MZ&nKkrfxAWUIYE\?co.te2z'v^tb,.$Ⱦ6܌pv"s{X4\S[o{Wq1%Εgu9q;]yzUq[Õ7:N<:=8;k sa89KVm ZrT*Gtq 6VeŒTuH{Pz#r8ʩ^)Los{/LC.=^;W*̶,2\Fݼ<9}6J鄲Y>sӲud0V1_Gپ/3pOaH^ǺumM4W'[zjI|_@ ]|8N%YWhFdK;{%4'Q)c#g5i W=Hᓾ.KG""Q3zy^y|vhI^5SLH2Vzo hb=UTcP6QuP ۇ6*#tpk~(k*rHʘvߍg폦x_]ƭyuy,QmOyšUTKL ~vj5ΧdI iIIk_,\ȼ mHkM(eE3,1tK_El0:UK:Pጷh0{ns|޴վ-M3;`|rv  {EzNw%]Yk ÜRk_n V 0DSo6f A)-Lg7z6/KwU%r)t,o_ib)FHa$CltQe&fE+:՛sHV~7 fj1}en /Om5 ;T}ǽn#7%r:=ܛYn0XQKL5l]+% HZ%@' e# c "m SQ`['RN+=#1*a(7>ȅ5:Csoλm$φ "Ƥy?G>\?p,ƈWx߿Qo_ D"-U ՆpѿdA磝1-o=m L]IN=C,p0Xz!m=>vkV{{ͭ6RSJ=1  9b΀-}}W3uvaXzL8/@)T7XF q'; 棔ppq;|nTʷYkxoEDݶl}]m6SʜF2cԆ@CccjQP߉~ A3C|{7knM foc˲`;1}w$]. +Ͻ&Ds`Pi9f.G6Nֺ\ ׺nL)QJPA  )4'9J,PL }ͦߧz,kVJ fkY飶u' ޠs7%W+X!_OM`-Y" +%cfϭ&:e_^7 3]b8Vs}|?&>>e\5Bw[ L]4E8~Zb ל(~J2u&{(A|`t1˦29 k |o(ؼrQ!f!\%q{Hrc [׍H;4Fg/$a; $@S&'ȝ"9#@Ѣ-3J̺tug cR4e|ʀ4%I 'pk Iޭ1tүn1zO4 8=}n$]V=cOqP.kĪx:2V^@ :wD[wNI d.3sbBlbh ],;|~Jn#!Ւiow.Y$W>N>s"m*s]N /tg>-.M1 ;O 5nb͞hcUCs->)^  .w>H- x;fY[1`xHN =yn:(dr\@^27&6 &՝_WK %8N&civv Xjq`^so ۈ{\3׵& XsH j;;2)LU\y#Ŋ1z8換.l 2Oւ;tıUܑ*jWgOݗ[m4CamuV hpC*F.}ML9Љk TNT_+`ύֶG4 آUm{r׬ ,q\qِlRaA4!~p썫<imbٺspB'@š|nFkYA'ts'6-IU^q7ȬrwxVԮŪɯ}վo/pz3W#t Lei4tCb' A = l,jw:H|י N򬄀8twjzjǫWcu8tH*J%v~Mm};[_8a< oOGu4Mq/mKw&m~]v dn@\A CĢchZ#tYRH&p9 $3{Z0eB <9"*d{(Bfuaxxc;+ͷ OT<ompy\kQ[Nypx0|&_W 9diyӾha;MF G,#оO2Aޏ4ΙGwz<ݡ?faq:JI֨[?;O[oYBnlցy#.g؉&g¾HJ;edQ*a3Ow&\A)'SLzqH(:FcF5{ofHIr-pWZsw i7Wm-?+7kF-9Fh†!Z4̚0&ڀ%, ~ը[y0-t) Top+rAUPS#::V LQ^ Qca ,蘭`10Aͱꎷ޹SsM,h+~Fmp5WL[ͻ Ĉ7A+F;{gk NY-ZeP\j4v8onԂ:%vEbt⋙ӄF"D!KQv˗r°` /t@+ hn수lu512;Kn2n:ukpKh_CZ\ʹ2$rLE#eG0ρoܛ 5^My;mЁ7`AuwOZF#GXpW^>w|n+RN~~xeJQ35R֬@!I`uyd>sVS )<3RG(pQzF6Y;WIQE/3ej|FPKHv~_6SL nhrnUbrV |%"g7kbi g>bLLXA/bbVѮWЍAcf<5 3a{]|́7uڈ!O`&\.ak{KNkWuhZh:" H8:{0^^yLR@=;\Vy9HR:-3:!k)pQK<6QNeF9V!cT7}ϋkNZUbp$w iBƤ-c&8Q{ݤ'gW2N^,c6R|*E/aDw #bq0Tz !;x-DFR7A;\2$^:9KULe㉴Iƥv1T]98 xx0Xb2v^"[“ |S+\R(Ktk[͚WEA)s,bjx<-r_im+6K|֎! _ϵZ2lbR۽$5ā6%A"ka&Z##h򨻧=v z`ٮ:̀Ix$*bn}{$$e0H~'7اXkI'VK *׭3+Ҝu0 Sۏ9!tUBRBR/}ŔR) vծ,\L,F-_ԮbۉQ^w|B@ SQ` `;1&): g.C{wո8zɩJ JK҄n$I8f͜v0z@"NB /u '@"&cc -W?, hHl!I#ank H>j{˔-ͷ{~Fq9?+ &rbg,\P@b#zHĕ%֠bҡ´-ʫ)$܇߇ߑYVGQ2==>ǷBXNv:S:6LB=Ϛ$s3q̐l 5q4AQ>[/2G[}mJr3`j +lד xʌ /F@c0z*9^a&rʍZ&U.ƲA6~87J7Rfߺ-íEp ,'%r.ٯ'{=D@ !|EEyzQSw/nieʗXYh736͗ƺxmqf>@$gbnBZb*rēwp'IM A{16QW\@!PD m[,ƕ<$y ,bDϔ*/l8C20%XMսyem[d,qvhH9"FU%oÑ}ԌA*ؖ0%Z$,P/ -p0Nk_}V7W5iUɿj ѧDK%O9 W[lNM yBK1zOK]p6; ^dD],*қ3-yQ)T : ;L$FVFxI܊ϖԕ@M伨:px/u. zWO*PF:u<[&㑈] &q$أUQ"[D3\De(#3RP"\T=7@Tby&r:,"V da[ZeY|rsmj; cv}~xΞZQjvX<,U0s"])_46H˿"%*G4@pMnf7L8-+9uFn)db Ȉ ,I ΦK*" 疭kб2TvV-c{uw{O2U 8kbJ jo+gOa#ZɵK@%wGU#A qe"ҮvťW-ݱu;uxR)nh@(Q&|zi[Z?0'ؓdX@޽}JP<u}(!d3t-JSKg>ZBoh1)sյػlk.n-N57]zƲVv-=LPEH|N! mpj K 4Cl?tsqAlpoƝM0 V>w ":d;dmV A(XS5^W3`wdTB0]b'gt7W6h ${j|FӳB Kw6_/R@`=f^6@W&端-GBP쉴i]ssPuq!#zvh &u>pԚ5quo-%7%dvZ7GDV2\k'h<%:R1-UGKsz3_ݓj _ޯ,mIjլd(10"i,kBK$ !tD  N\qmM=wǼI &$hkCv]FnjK6`c|p`k]4+0 $KZ9'3vMj8 7jHS,&I @th3AcCCa VR'~6,ɦDY-vj]%LWHj@AqG{*$ʽ"{s{w;Y@[Z6[4b rv6bצThN\XbYjEق@h&Yx1|8a#4,tl(!FmCSU, 7G&>+URpx@ ܈O7 -]Viq_WS"jҺa1GW}Ȁb+6iuhK댣ڼd"Ub;k9d{Ie9ϑf&T.= fS~ػW]Bc]d$9Ad) ǩ &:E5H .F,CKIk,Uxb5GSHWpFykYymjz%HǓ5 AK*ݱd PeS8㗝!r@k AL =L+jwC,F x$!C]`!T^N1X883*ЀCsؖVcTM/mn-@WO˳4ouqFraگHMwFebKT6p=ӱt"epĦhQ!pvԺ2'Uzq:..cgWt@"5jn4ty(g5BhoҲRZ]ȼ'jpu7Woކո/\o `njM+kƁ=cVnL?VAckBIvS0Qic\|g^|mGcj -mkElN4}>'@`Μw{Z4 əg[-"e{ڬY҄ѩć~bOxt6+sc:Bтhm|i_D |ۻ=⒇t87˼ziunD3 xֹ| 5EwC9HrK*Ͱ#kY`P91Y j6 oQ+Ҹx: |ήLz3@oQԱGtFQt:iS2AoUW0ՆN͛({l1vuU;v4kekb\]Kw(t.2DV3R:Uǜfǥc60Bfc䅔DՊ[u r| %(ᬳ Zkaw6;[cpKjݯfyTjk6ExZJ9Lmc)A.'1Q:T1-mx虡_ EVbG\La cU(QP`o>5. "Y9Ygk>6JmDN@S8Q0eگ~!Atjڎ+1"] )FȩXz3MKޅll8zA .-mE=-:%pnH^K5}*ܙ1;F)pqYy4[ pꡀՉk#4bYۆ!g 㭞VיcV,71EB enIDUW`\ʈ3vKmk:hL$$s%g߽pcX ѐ2`5X]86ۅLtc<9o^eZJ-f̑v-zֱ z"$o,{FGR;v%ݺ~+%ݛӸ"b;X}Vɗ#iF#|77T`ĈRi5| @'u|xC_翀AG,@B"\m ggE(r&쌩ZyZ!](~ +\`YŒȃkq :fɧF(xndUJ O#s]-ggYѿ]Şk?*ƣ}4 0Mc@KQ &r'7Oxɖvӡ;`q@lVN}P<]8fMrC Xk,y_Z5/nuϭ 6Vn /\Phx٭6 =Qӻ=kӮQّ݊\, ^rJHOHr]w.;~}ykn.C_nq_6gc5xDZd LQ~VN]ڠ0("חb뤎OhAGPA>5w#Ux6З:ǒ&(Edl1-'lfdv'ԨI,ĠM zKS2sp3aW̫yDޖNYDnu뇋}Ff՛DqBz|ug7.+Btjr "5YVV]J[|ۋ6.n_0IN6>fHhN )\aC4Օ%}"yEh|fZ"˵6ݨaGov|h2"9ǪѭB.I5[K =.l=az 2-nzMMzؘDXHa UC5cA R^6˳=`oE)/(VY]>NڊjnqK<˻sK$:5xKzG)J(b絁$1Vm!L%vqY9Xx1~Ѫv4\<CGc2 k6ӅrƹDŧfb"K+Φ}! ٖc_3}eڛ,e@,^;2Dvãms,[զf9| 6˫lMnl[M_e$F ݛpfOCRbEܳ(7by툭6\ g2 Һb8߿~ͫ(!ɣKJMl_FXq`^`y܃ d2m*@XhlLTQl[4eќdgU>ED]Ɔ6ַHtn߯=˱"mcMoQgr8L$&͉Պ@k^֑ e1VL [Y(Ot߱2Q(D}潹Xc~yn^ifMaYcU26S@|=fk<;e+߃u\ӇdV"0[`[v|Uj>tQu8rh`(u/lm:ЉWVqMf%ylpі Z-Ŋk2fL.vbnzRl32֯jխTy%lݵ.Ōp>nq.u``{IVji1BZ]quCv [X{`ub#x3zތP@1DY[iنP9o|m{{a@]f@ ;k䪱W=f([H}WxӹF_erN|X!!wH SJ6xiz)oS&ߝ+ B?Fx\-eOn!3 :ɹ|H O?bpN"k>h=f٘y5qp1L,͝(!0d?U{|1;R1L6m1&+t1I {\J)bDI4խX6Z@T}Co~O} (+ސ;xo|Ó^%rV2㮉0$bhy, xѢ{lC `;/p99=9 x &4^z8fm$> KbɈ[a$Ӑ+hOvs6\I$5_w| 2lCXc>FBCp*vXQRWf?w@`ojnəَ+5M6q5g<"7_؍DD|R̳ /Nj3i|9*>g{T+L0f~ҏ^>%C)WA&/74XE>ɓ$&~MnwraK9uʉi_ `Dq0 J(bQUT*P2*y '>uQ|Q @>,uv/ /z?L&Ep??#ڙ_)~))n ecKMGB?h0%]|L()#[[GrL8MHl4:nw;Ek@;B|(U_+wD^k2+X@pp` "8k=`ee/[{G؉,$Zʂ6/ eW=o_D8Ht*.~s p3RO@ש5Lf` a(41B-Hj<M'Pi[z?c EKvp6Hhk%ĀS^OSZ@&]sM땫Z 7F  }Yjw7;{[ŹΘ:ZB>AO{/l*-BfJ](C"W7od,LinTff}vLhۨQ6kc)-ϻ r=ȼdA,l$uڳuw#D RBYFwLb#Kne]M,Wl6\((-}/j],5vm4ݴ볣$+–I:Y4EVw#b[D{VlKawi[Go?Tt07Vdg Z/7؍Vm!^;vde}\bK $v411x(ӠoEuuEkHduj>.v\_N i˯'D*Gx{&GxIp5v,NyD,?f n^%WM(vffr<` !3N_C]"&hlzn63|issʞNvn ݜ237&[SiÛ+uɇn\rf (G[k&LXHVES]o{-UQlo|a;&ՁY$$TQub< 3jYbbG  wDSʜGcjïՙv4vPm]oTsC]ؕhqIE ZHaDڿe -C<\ؐ3#3 uϧc襬tZ+uSsa1tdAHP.u{ hǒ{l$DQt;t][]f!HĖ ({W"JwH?9ќ V̘Te C盧1tl1޼7ڴtxI'P2vpKqo?^~)m5s=2T dUpl Fq mQCTwάwslk)6113z˓;__^sR{xʸLSo{tB-r̷3VniⰓvon&l&6CJ{ٝ/)ϖ#omgɼ4kC̙(4H jfN ڞ'\ "tӝ#򜂒$7sŽ*P DEcFԟe7AMj1NiRR7o\t=υvUQ)m}p "5iR1\CZq+L7+[@/B U I+u)t x"yb!{>>l}Bu q ]sfǫ<[k $7!U"4pw?>DQsZ8.G֏S,xncx齼Ly\3h_^Y&}ۆhIF[xt3kNJZ%@fg;mx]\5-"I2d.>~[~4SL3 ov¾.>J:FS|_߫ hYgf9mX=F*/\Cw7ж"_W]7t͚JRv`E1‡x[k^6Nʆ$9h/U:͒ԣ{i]NOP}L5Kr˚" =`"0@BWZ ;v0+A.i(H$_P9ʵUb0ֻk Rk7rt/jTm951oln3;Y( (& 6&(!U:qgϖGDŽZPCY 2I0m";ܸ(a2:;iSSǖv#ͬ[h{ֻ+>W14P( $ KxiR,@p,7 |ϝCu∗YۢIA~T%eSOHlaY"jCA޿T\afH.\c"ccd"wpK[}.}1ܚUv WB0V|[̂LPծ&5QGty2 2X7"^e ٠j ; 2ZGF=3:P8ΧOqv^nnr]] )}DoMN;cxr?>0ݥF|wmXTXHP v;FW AQ*%w>$/>Bw|_O@[ȧ|jyJ>Щm LKy*{){SǴg=0eWSL+Teg)?`&]o^ӀGy 09`_Q/5" =ZJABBfKl6NBo=0IzžV:sǫh Ն`(Ug nMusS}H_jK"/Ѥfv@`DKnNL- dQMjv0,ǎů ']#eAS ZG Dv.itu?D@8%o܄@f!cxtƆG2z!,ntq4_\ #J~T|֪9bl_υ 'Z_8:t}d|/mYc$BmZ*С&bXX3?VҎdX똫hK7muy" v$Z :51N(Rm ޭ`լ};0KM=۰&QlGӎOZadDpcK/茱!mN#D @ϭG9Wzzğ0GB ]de/{CSO XH(BA$Hw嶖>/^9D@Lܳ|m71u٩@ׇv/6aqgN]hк3( G}E.PCP92H MbFB&]_0I1g?ez=E]}|I]C}̊ݛ^k.dd8e}X8.</\6\[:&:MmWRuwZJ;Hv<ܢ*">W U )nP^D3|ww7ie߉m-6.~o+}:< [b:" L)cAsB]_܃ ,LJ|A;Rr鰍`gL9}/-軦yOG\3Cٶpr1YbX͘L5B %U \(QC/+@_RZLotU{`['p1EEzxiӕ5SS@PldyXA[%twk\fѵnwvJ"W:"zj^o+2;WV5&Vd MeaS31DSY c`y,)PR)@ J\s[scnֶoz:ȹѦq}зa`a;kGӐ!Aշ?Z= ( r[MTcp-.A?&gAgQ+7.([`)GZxө *ieaըN 4`b׆ FqŁjBjM Et( Xm˓ hS*BbYs{ms5MqK|% b`4‡9;SRIhW F Kk&e.2U|1Y/,ٰڜe“6iP+2UfZ.wJVtt5PF*..\Im88і.crna*Sd& ܠc9ӻG>䀰"*7k9Qw]L\kiUخNŕʙ'ѧ_r\OQ&?B&1fS2հrӘk6\(-hTBQBd6HT*MnE8]a W Nק10YvS+E Jʊ"`2ۂ4® ,Ôbdg[>6 qtWS7빐GnOn:\Y󈬘$EU2(Ԓ<~$2OSJ$M*%k $ul#%eDD B9xa?J %GMwWM`Yn]ŀCT!{ߗ99Öae_Ź}z35uӺH0Bk98 D[Hlu3x[o^@9ohP靮~aJo΅yan&znҳ5l/;1f u񝣶`,3lVrA7Jx:{q0R29+pv{4ѽ0xvZdC(4<$h5QYczgTbj,4K KMBLUeɢןa RR_u3~3E0*qC8`]Hh ldLʘfO#ޫatT á"k[9գk&>m,iNvs8b01&{ Č7ch4%js3P^Q-?|mĤ M^gqTҜJNfifH$HA@9{'rϺo[YbuguL`~o_mew 6C1iIL!Ed4ӓA,{ntBqfZ?<򓪸GpұJZ#0ÓT噒q, V 1  4-*T<=Hq"c;\ǡ1"0F1uKFA. ڪ)8C8y: [F.fQ9}EE8޾z+ kd2X1Wd\bUL0tm:cQJF RXeNuh !f:n_]ַmi@ ,o]d".3D}w דuQ"?'x04+9vUj D@`=23F,G圭H{՗*-526Nf 6/C d47,*|GmKZ.Ա\4e0Swg'=dܕBZ:^/`W#Ti;j %o*軦kjʬ/fmg~ Q3u)~kSß t@cֶZ7|6-/7ԬTmJ"/ә-?RȕS熈zmrF1n)|g#ДWT䊍gpR:eKTBJ5Zo+c>,wU7mVGpʮ;msۿԮG[_f0Z"zHU(ѱ-kIm$˭$?U<`s.723ǟRj*gj*x\=`" D0Ɵ!̀_tsH'/1 Q yLCԒ@DSՔNC!4h_伽Hww EJn? /D7M_Tݵ}BH wtY.hadY}'KM߈nr%#)BO%XPƒ}x{49"酾߇v萩 C<dz8}d!źYYuιpz[I DG@ IO"$ʤsbm^(иZ7,f@=+4AEMs?1f Y+|ѤE@E~W~u&N6X?V?bcYڸ@}Ϙӱ(_K#W>|tfE '^wn kBzo=ŷBBw?K{+>^KhAduwT% 0¡SnE$j/[P0{^f܃IXЦn/8>Pxi5"QS6?4n +>ii1@o HwK<uf&1owԚΨ BMq5cK7[e,݌9eb. Cի4Asl}Xӥ*t̡;)J}AfO:$5Ra/!*+6qۖMѬBBnt3 &7& k"IL?,7 8!Õ} C E:CVJVAҔ^ڥj\Da7>gz MyO[Nԥ?͞ W4RZM ]&Lwv nٹnOM<%9_q#Zڽ?^݅SĖ3̿czm;HoD'ۥ7J)g*2XJ`Vh9)@Mr3#W\FPR*_D"&b`DD y|{w:%=k ,lm~KUiќlB jS÷Ew'2kn7ԉMX!t0Of{(e͆Ҿ8q9K؜u'DT d}LW`q@/o#)~<+ﺟC ҈BP R w҉!dҫ  IH!FQ&m)M RR#J*PB RD"cb-ڊTZZd'r)hTh"i)AJwpY`ݰ.DJhD-Tz魣hV5bS|`j h(֍UX+TmcR8R44RE4X hi#jűQjŨJ)1 ShAiD 6\Pu(D N$a ԋQVj-`[|u;$A%0̆A!wbbKP2ZXom'8IRCA`MhY hQlXѵckh l[ѭIJ4i7 Iiq5 JJjD5*QRJa ( u:>Bd=tm`=He!`nxD2CLL3+?^L~X FU㗦 }3u eqC=|g?p2VFo_Dvr9w{ue{(i{EjSdb1,4'.oBz|i}5d &Qo3*=ߣ|\Q_YX-^m,8vp¤#Juc}CjFUH/"[$W83e/qV^,#-goto h[:ees~~=i?= P ׯ޿ҡ?|(7ȉΨBJЀN^˅1HbL N uRдRMbZۚ\R& J6 mH(YP@roE8̄S92 "Pi?GBSЙ !;E9 Px$ 4L0pV͑sw~wh9N' |fr;C\~'r8q?^B)QTc~?^W ZA|\}6v JJoq5"RZ=Ƹ?+r[PiA6|[&*6cET Jq]Ֆd*E]I>"\SJR! C@Љ cd7b:jB3#6\  %2Mu6mlS$wgTٹMNU/:7fJ|r01?;RCކޕi3#-D{R=C,oҠh aO邈go|'xaʣQGe f$!vr=~\s{pbiWVG уyK$yy[o6BzF6g+<.O-ǴgsWIk v}$ n _,GΨ >ub``O[ [Y~l!y+9/wy@C?w @ j!!"@g͎No'szv-y^*Zж&VJk+{FnQH]V ~p bD?ŊU(@(M /߆)6ݷ M־k}FN x q%h;~Ł=pi͒ q^Ue[a L!ΤU+ bZ0NMZ)n#KBFL;N/|Yd{gD v!0;ZG>O* }ƄÔ`(y7[HB^Z@ԩ j~Nly@9%8 )$) kuL0-_?PLed7D?/vx(хI}Z0P}c8|}e=+k~oIzQc+p/9m%!V&'~)[GXnO<~{^{ZlT,g{W9tlV=" RfBM3d] >O܅tNG6nu]y||-Q^(OhTp+_[sc`菾`Ktdtb;լ=Lm!R(;B 름VQ^5+d&Jl[3xc|iS&N}B ,x9l).~IpQ9m!Z Tp GoL?k}#3TAVh:^Vmtt>ŞQv+vtYeNцԖ2+T((+E Ł})Q"Uv`j;WÒΦkA&}|Wol_ShvogܷztY\wG%&wMj3Inz@ XI(\֟^of$[)IKyc+"x>l> &EsK`s*d!OFB @2ٍuֈVh1VwU_ +-e dP),fVhOY8$.)🺩'MɪӍ߽a/Tf7$:y4nzNcZ#pu-A-L#xKBY$d:Q:JϐA?oTD( EPbk'5W7.AaBRz0R1/b-_B*;oE!|A‚EK;^|bd|;*VbEhд <‡DҽdW6{z0,h8x/Q҂H^kz5e|]Sf~přʍQjc5Izt(y;(MR D~8~|(OAMbϲ6 Җ?Uk/MJ{{KQ$shDy4ړ92%҅džcv7ßgݾnz03ԞQ|Y ul;OL\@lM|<4@B#!E{:fßCy`EFN0 K>&6ʼnz)ݓ GC6i8aq~2t(2ۆ'Z|FyܬJM32Bdp!L!TPPFvt&zbV.@2 +aB?3`oYL*z 3vB8))坒oac0n~7#>rjZlyjCN|V͋PQ83wBwt]z3s^f*؝Re!͟H]7&ҍFY }Qi8Y3J Ǚ7~;,S꿙ZGdf?>|MCxue6a6NyٿBf!vKae~uθ/ނ~R?Oэ*otNZcy( &VuKWW/w鿻pcLy 7"J 隙*Gxrm,=^ąʇw j;FnJ8 L|F[dWg"G)E>5 A+Y**NTPGNE[De҃DO+6&Ѭ\-oE;֓+Er=bagT6It_Jmި$J`Y F <ޚl@GT3 /!Pi$>1N} oO}uȭ%yx5fmC2 ?#O^y^9C}xDox٨Va&NbAs1AgW>a|3{Ue֢C!l9iZ7vW d{;PvqYuqf?nor+͝W^4C?.L딳f$d[&xZXsuNKЁ HYgZTupn%E3Ym1ћoW޸tMlKH~F\/H~_BϺ?;Pm8"R&gY7.}=(±E.66 iXl=^ pF蒈 =S#><[e>M#:ɝ`#.?g|723.͐ªa(B_Ǔox+c9%ټխ@ H>LM%L /.;7|BT8(+^1N0jz?1H%;m5(l`c#6[aqyPr)yrᒐ H *S w}ZSEX#pdW 8Nmr\|ԧbU,K1u"Ġe۩*Nha ☹ r.RyݦzK$pg^͚ohg dxLt-Eܡ;6uCWȦNKL}鰀x5˥uwpXkEx}oLM7 0`[Tk hE]@*( _zBT+I|be_^}nk>?-$g2н|QƱMJe"wD`]ΔW2*`>e0C*"W(3V=(]>ZuT'yT7<\ez<ҞXr;ՁXlUM} X/]r}iŸipRF\0+ߍGU d$$͡4^^:13 zÎ546)9X6-KNԝ :(l#[rj~smee!X؞ױve??5dx\QLAgEW`K5XeS1b4#ЇK8 f989Si@?YHa{ٿv(Dy RQ"I;҄>xea:CB}\0Jr-}g{fz#rSlR:m5wJg3>v㓴rfjC]yX@! ؐ[ 2\xZ N5 F K9iǫ0Ə8&$a.}F,p006{Fka/ny/j.EбEq: 4jv4_\ZԋZ.06,0cEwȵ,BkK*c(aJkZX` @j?dR (B#{F?"%ڊQ$mFmZ""]ͅ"qi4'ףfz*O &Y'!a[aݓ'I冠dҎ, ٮ6S"g,tܼ:9Qcj_8juz|4FjmH8:;0zEteAX-1ص%f- 坢(pd9hoKfU@ EI}b(=<z};\r9K҆bW@pwl+QXabDv S:kEM1>_VƵ-6?lk.6c5M7 } 72J%!6N_OD=T!&5D Au\ʨ6  Y+ˆRTzAd_}ȈWҽv/;QkǿzXэFQbuߒE RBNwe!g,O 3 b%9_PT\ͱPR2(E/ϢKsw0YIYB?a0e~즧؈_DiBØ?8's3of[_O>v+8`&iIa477#L άPU M%/u QB2/ALu6pbݮsЄG||@@CH&76P:jYu:$UEj`&^Tdk}.h*B+}ٻtf\rMSsȂpua Mz]%eMqz .n &eP: f#OK3;)q DGHm|{wg/VvjJ(hGMįS(}LPz햚I=d&-pNR.џ{]1ypo"b5e +y6+9IuHH|?ϨaisJs꫆o)`h2!. f`N3ٍ v !@3d 0`3cbWvULyS*ZP07S5dl}2 dbJ_»lSΗ0r^S3L)=o[w {ɝ9VxX9{77Ѥ]!XuÑEVAn{+jZ+yz?vSܣ$4XsHVf[3b`n*O^cjw6[;NQ U?,#xvf9Fp(B)HitAdE vIvZ ?>Ty)fO9vMHd-; /W7q~0e80`FgxwC'cԹ2'DUL#xr$PCyGg<ˆ\X9f;3In f=_A)ۦ#\4&t$'lAuFL>&`g̥E(o^n-ӍVLyr}j;iL$rrIm6Y]B2OWj ч^,yMdY:c-ϝZvgk;z=G*,Lt='Io"ɟƨIډfED}kR~em@#7P=;.IN.)CpdޯK͋[FaVq}nC+A1&:rnTϽd͚ c쩪xY@,N&JMއjó}9@zMڈ B(`XnZec+ 10$6xrgcLn\NO:sAݺg{ݤed;`Ljź-.ڊdģ\6Xuvj齲 \-@gbzv,7iU" yD+Ш^OM6yɯtQpT_ Χ~ 3tsV Ǘ5M}995bƒn[NynjzL6ԭ$,~Igw2CU /n>dk~_X>OoN{w ZÎx<5ק^zm~PN#6A#]ǚ:2t+)*qv*#e: h?Tx}9Ѣ(Š%lӞ%͈\X=W5k_š$GFC*' _Cfl̵EPQrȪ)C\+겍5alYu9xCS %KA-&SfWֱr8.]754,eW "rD'rM8/9R#(g@ сq{oT'$/KȔy(-PGGqI hbm=ƣ+J P#10Ȭ=o$46{Vi}=wh{YJ ƔqN>AJ ʕXXc&a &'> J859_|:@A{I 6,)N6 妧)JTS NsN뙜̭" Yj#mL ڈM'qzƅTzW YXq|GNq zb l,3gu ࣛT{z>kgԚ8 ̌],) Rh[ +`Z M2Y\S5Gv3ʼwk8QSÜO: 2H[v;b(%k4Ag_d 23JjmC[W]բAG{AHр :9BRvw,PMnB\ C 2L(jXqE 52MtRjY1& p9Vfn[/-jd>P̅( 7Y|4 N Ǫ_8*CEpk)4SK4irDts1\bLavF҈I<&: f[H+lfQ^UFOkM|lӬ wΛR2T%1v8Ī@x`˥qC(t:+U]WϡzJc{3ᛑ~mPm?^5sqP5,ZtvwJѥ^.[wK*;a~\(o/9*7T ;9znw$4KDkIG]HY [Vɷ G]\E]2s5q-@x^*=-tm]X6$.PT(W \YP&Ĵ@61d 옣J˼dd"̑ʑiO{UDbE<ζTx  %32)jMJ}=jͯ]R]1wNS5= Nd0F|l(Ӗ ]'!Nkz7}v7# s4ͬSHG%v_'m)u@cyɌchyixd؆M:I5W)C!|nHCg KwD\QrAnG(f jfxݷ^jn*uu)O5b;-.̙0W$lH>?? [{z۶K:-P;!_GѸĦ`5!(W.mEQlk"pEhAaN@ P .7ö{}GWɼj'19Wt[o(5F568=olkkJs"ޏuxym:ug یAbMTgYz\h6 Gs)mqq^0``^\0DðVn]/+M<=\IsQx}N JS ۬ Ss]\U]]IY*.$a(2W 7s}|zê?(a =98ʞ}G= b:#)} &/vS*KY4wŻU;ѽ= [vk&L ]tݢWmH`3\W=P0Y*Uu,VP0~O;`|]fɌy]+Rl'J2h0Ӡج[xPMuDPeV!kMI@|`Y2bw ʮ4La!3br:BZPɛ__c0ۅ1` z񰢣m 鲤&qR*: Eq,pY"\PFlQ@BJ$@8ӷ8=4C=ΪUAs3Ml?ZHqK%_ljU!&v ݼBMbrbga FJ$.*!l9eǤhREŸ %X6H: EZ NSIJ?]9h3ᶝÃL\c6Hs 9w<ݺ06١Ӕ]ȸ^jѨ❽;J7g6r7ȳp'9 qsK y-h(^`V>e޷0F#DQ`hR.փP͹ Gϖ~wQxgsq#.};:c/.e;̈́9_UxJ5tT*RDs0r~dX`FR$BI/˹ z(-tonדnX!HPE_yleY7zm}%hhmT;J޾uGTw`÷b%"u $y'R.0]V/ԊÖTL7X0֘0 5*E^<0GUro&j! ;_ágܛr% MF~>V֛!f9첋r :HgXc؄:zW:5nIa&S^]7kGs('{D @eK)ʽdj\㟎xucײ ^'>HFyግdZ}%yhbqxIHc"}>tv机d0dLbaOje>0$%)R%زkr:;wPla,]K#ڶeGw,:SeKkwC&I.$4fLmG!4o Hz]1cjŐe6IſtWƧ?J/YD&vf#r/I77;5rm# 7qZJtݹ:vݻϨ3ͯDMp`X[V(?doWG,8;Kq4>w*;9Y\tqek#n_kIw>:U0ﻄ{Dd6[\ u]zgEӮ6O}nIq,z0(.uK'`#2(KӪ',Zr , '6\Q+ @,27f5G@]Toi:\TN 武ޅ|{^}6w;<-.nHH DNիΠgVU? :uo1ٖMxo M慎Hn\82܊V6@RVWMq 8/L1MUCśdl׬nU8X׵C$e#euC>*k,= 8[cVH17ىܛ(25)jܒ=Ѯu18^+RR~` ȀFb5+ZFE~Trl9pfrkLa_ ZCa5 +yh'^ Z̍-ޜ\9p$a;mI%P۲ZjU,n.%H(hwC8B*od l2^dmhLN$MBgHl,)BY}!Eo'vz.軝up源^l$q_⏳Jb{aƽ> 4B}Ǻoʦ q$}@f&o2tRi1 u^0 P2Qjӡ݀rƇ Q>X8-""ݾ8y-kn;2l @iv6RbDHh.X)-oݼh*՛6`[ ‘"u^)}md P{塗W%Κ1IiIp\<2mwrv~~Io7fȑroOvxNFC~y'=ݰukvh{TfgD2*΋O ++5{Wa@~?m>TKq՝@̄ ħ3B}$ɛām4d-w`]v$:IS~OmIFFHĤ(SH `)dMI, cDY O0IɪPy3HBs=B,M P+5"I@EF+|;쪹Q]&V';Zz+\SȝdI/Yd@"lP[1Nv.׶+:  ,Em2jYd2J2h`1IK3: 6)bɋEDl(buujx* lus:was_y@tvwr|A:N:)ۄe`vg(eezp߲ MaD5}8)vHvi|7."gMlī 2$ $T͜Ug ]Q*іiV،W(λ6N FG{;OEXNDS7糮):: `E9<q9h/ʱ!Lu5֕l $A`k7 )RV#+LcT;,JD5>Qe&F EUdY6UZsS]*[2qgQ3I.x*SKg05fx@|9t-5gȓ a5ZSVHͤ~WoMwTr'W:EFos9O!>^Ύ^ 7yf̚iw[4^bweJ'91VGuܳ(vK˱WF^LahLk"R!VhBz]ڻUSmcPiJRKiLV]/py1/׽cוEN\W\EhC$DT~ƎMu t%je4o#6P-=@3/[{ $9>=狝*n;׫nsxo;$ǯ3,zA=muom\߂br|-ow!e֌td;^+-žiglvr`E3Vk6]nW*3I)1asMYF1.Q97rQĚHZ-דeA0m',࠵t@v0q\.#h~** mM̼mZ߰BS~3ܣ;6[/L+R~޿,G=2Fb2T"Ddqߎ t 33E13v2f՛e zBi]~E.*'8Ff$DbDЗQmGz5}kPB\0[ ="Ŏė4l&m]L%[Ci:zH BGOGSytCh~Y.՝Y'C'9e0O_it7+YKZUFU`5^iJ,ʹGVKo=Գ"A F)Q%E8 "bd#/+Mf+p)jR>;k z;Lcwk"\,Pr_o:UiS;vpZ*?MmR"7A;6wFRkܺ}/_t;8p6&ι/=*eIB Z{ps]ye@,K*@(wo]&Qe|N8aFT)هgUa8x.97ì߽ٱA(nj#Lݯ*eSblJ S[,w x!LjaI8C#z$-*սTn6'U&NU7χ0R\C/"o TaXbLQz']6ƥ+y!#uxuMog/N{H2.yΘsjzs^)M'.w-cWq`橇A3!yab]U")L+KFlEVVYPu'qc"Y5` w\ X 0۹0Us +KƯ3wZ8 B"M"[F΍#zrZJȐv7u &nwwgYNR->ER\i\KLLDRMKTKglg=Gy,1@H$jLMQ_bڹl6>ubb:"YCn+4p, c^/,EEFqi-! 4j7I윻zHBLæ$P%&^gd!ݡ%gc^}pkGo'1ňC- wuf"wxJ/F۴.Qi{{7} nY%S=7ksm+(/]:: oj AԨ3U5TUS)\b\u#':d2=)ׯH!=CEs8[=|eg轻{UGψQTw;$Zl7saX_BbC-]ñ((7@ClbX1ړ"5Z4acn|,jsvS!! Øa9v K=7[~F{SD<d$!\0(NhTlFABo_4Ik9NE=vkE}MAƆc PcUrW<{ݦ8q{,^ZcxB#}ϣ&ͽqCn6urjC&O^M4#X.a~kj,쐐([-(|#޾^uz/ ],[a?'[\}4lY HV<,04MO0{{}Q5-6Cɖl.Oa"ff fayoXKTi?Rޜ\pڑ9})ۢ1jӅYm YC@Vh$y׻W*F4D=S]I<קdA<v8jS0z٥NR/'slWK3Y 9f 톉!W_,Q58-  ӑ/ @ry­%c7Cs= b"d`l(L!@bBgy{z/&}_k Kdwh&@rOviA`ߚpu;?b#Q["Bb-FXlZ1@QZ Eѣdh2R-K QiQI[FkUF"hƲkQEY6c ,hXm&b5 I2*#F ma1EED&ƬY[[b*j6mcl`űFIVMFF5%jBh3"5#IlDEAFLѤ-Kƈł Z6cTZ4h IlTmHmDlQTQRTEEf&,e!fƢ3"(& &&Ea&)3!"b21AaJ"L E6BAE chţZJZ%4Ti,D&X, MXJ%ƶ-%Fch*EѴF(K&Q%$m a2Z,AEDFE*1IlcQfXF4PэF؊5&*J2m!k(RF Y!E(jJHHQVQ%FDVZbƶ- LɍccEhɰF1STMdDj4AVe*Lj6hTE5l,F4m*%cm6ōƍEE hKFA6) %A-hڃIdъV̴X" 5F1X!bDk4Ŵ؊Bъƌ٦5lmhb6LlʋjQh(ň6)-4Z,154QkV(ъ*H1V-hѪ KbeٖŢ,i#() "62%EFb"cmIcV"MXنK%I flEF%1lFXŢQ(CAѰ-c QZ"ZM0" IcRZ$ŢɒJQړ` &,biLhZ"IcT(QԆ12Y2ljLRh6)R J$,d$ؐ&bDi+FD3I)1*(5V"@j,F&( ɱEIbƙ LY5DTTlL[2bؤVlTXDLhAh6$"c)&$Z5b (ZS$(FKثłb4FѱT%#TRX*(11bd[I[(TFƨ+QXI)h+AZ ѰAE(dM 4#6"hX--A2$lZ54ډ Q665"lTj1EfY6XMEI04Tj*1$hEK+1b4PbDQEBPkLFhJDjQ`*(,j1D1łE`Q&EbŢbQXFU!5i*fbDjɴdKFƨIF(*3($j,-"ŋm&ɦTآfZ6Ƌтɶ- *X)$F*Mh&1X(ѲR*+ RX#EAMhhhєckѴUfh &Jɨ E("Tmb6"F4)Q,VfJ$Lm%bl%-dlk,XhLZMAEccA(3EF5IF،V*MX6,d b(1FBR@ -M5H&Di!(6EjƊHIB63- QQ(ѱTTE,kHhBؐ$hƌQX6KFB@ɾծlYJ2ch**)5Di Z#Q,MT"-"[&I6,,mB[DSRRQ(kj6XIRfZfb(уX- hhѣ)Ac؂ơ+EV6 fi*(c֤h5QV"6#hŊQDQ$XDFѢk PJXM)F$EEhją#m rMPb#6JFX5,QjcՃDTF0-l-HTh(6bKS!Q QXJ,,QcMԕ1Z1F#`!51QQDKQh6$*-b,%E6 FdLULZEFfFѱHI2)4%Ibhb-Q51bѢ*CDElDZEmh**5DdXRj6(Ū cXڊ,hHHEIb* QS4AQƓQI ƈ[ch i Z!q쩗'&a3s`3$wdEJ"rWv@fǧxܰT8 ޯx%\coŴ<ښ(UQB_1<JA'NJ^o#g631qv dh6#}>m7^\{pcr{^dv }DgN&PR a3 >F(@חRj:x99͕Ijn6(@Q ^hL2XӦ2QFP%03ϯ _~P9*ZHCMƻAк*1iZi=Ne>6^^i {5E *GQ߇>zFGC_v+Nh?vuU8A+* $[/UC)2)ߦy+ ,z);գV_(]V/L02X玬 @ƨ"Yݳ[?VТBdA'}곘 C*)\̲ࢹWⷤg("I >,u:ޞ5 pU L*u9tQ&:#/Iޛvbk\O4DB@B|^rz>֜][7;9z޷m>g $`FHAeBVU$Hr; t[B>Z+P dddnkqMutNM2XBe ÛL4p8@,GKwҴ߳|&DàjՈ V8P9lR ǨǕ> d$˹'v-贞 ~nW\ǹ{%vR* *2!/˔EF1BQzjloQ0Dr]]w i\l\hp ,FJ[j%  A($奴2-橆Қ AQhl 11UJ&&\C,LVYqy8?6}9h.oEPoMd}LQ೉YE<fۅTvzّ4eUBDUqSh4y hTJ("qY̑w1O=AO^X:0[|p콪`ZPx$癃!qE#eoc8D")gȬd C_S4%RAʈ @hɒk/bf Bp=z,t^9.yi3}==MXz/\}x}:Hv\KLB܈HAFaDx௦:4HJ}LBAX hpNz<{HHs[=5JMd% `<+ϫtnF h?pa!WkjF\SԯǑЊxSBߪg7y-֔;y.:PɥRM)éAFc.31)`o76;=$v N |`KxVo ɟVKA:E`A)6{$c[ ^s\ ySqUFm^ >[1o^Ұ:}1Q{*b,WVa 2Qgr鎋||bN-Y0:q,VMuU.¡$bPS*CmPϠJrH8Ny;'xP0"`‰C 0И`wWYd]iCPiu%$w)p}gO RiKa-IQ&{r@5C=.V*^3|b VluZ-Z49^glrιkTz?u˦&JQTH>zfbfX` |zz/FwΥ`9ӧn F& өf>d4u&q ~6XW;`Ӡkhm%z-"2)Ou?EܖnJa+}L & n\!|PKI&F@Tq̹=;KC gr ikK4ITsN5c@Ĩfn;!#$=c =L.3?c - { ==0IU=4QB'bUp5ղvj܆7$i∕*bf W41wNs(fOzj݄^}29QJ"dа O2x923ͯgv6mH)!-Aj_n&ga_ *2ߧC=ۺ<&ڮݽhzE߽ 52pCw+Ŋ:"!UizY[JC2Q{,~ר 7ͰI^Yȇ.*Ť)@ۓ6na뽾TxDeaqi gM F)$5/bxժ*E髲GIq^bP͹l58E!)(!@pZ'AT133 HJƟ7 T ֝:a5]O8Da?,C1m/z+w^eޣ5rԠ @"Ih0=NWV$*V` '#`\0LĈw) ,arHflk[AGOǿ=$:5aDxobg7/W7n62|`~+ %R^&=_vKg؍SQo~iH8-`i Gppd3ߣ'g$%8DhD؈{Q-T@ o*W@lA-1Нn1Tt6TgTPV̟?ߜ1vil؏n(eT)YaYaA\e"1hz"='/HLI}T޷ cYeO_,,9HB$$R 4Yd<&ix[!D+IzXȠOe,JcAZo}åV _8.Q%Š:_E(rR=76[Tm4iׯ0"k/0ͺVhaLq{T5@eT0PV.{=<*  :j"%_3tȯ:ʂ{XrHG4(/aP @^cXT9 [(|I8b0-W|s=?>BvWe?UOCyg,r:SH7#g3GYZӹ}k]Y$?g nTV-Kb`w`\a~F~ΤT7Ee@ %QڹݽbԠpnLζțpAK Z'V}sCД@݋|XJZVk%Fj6C !(hi0E$X5H6J),AM$(؃cS$UE&V(cQ ,6RQ,bF`d4͉DQc-)lQ)-b)hّ@EQa# bƍdD5EFTccEe-$b3% #k"6cbHV4QF56J-EAF4 6&i "Ɋ6MADlMљI0%V2c (fE$j2QX!Pji $L4THliQ" 0Dbi-I"&-bDb#XE5!hZ `́BB׻yS> V. =ڰ,| ĩv*Tf`@GUHy !wk=Q NCc$=cpC؇(iz~*L!BmUlV)EJ E\f$F$(|tIA&ы5iI,FIԕEiJ5cb4H[ l&4"RLL4jDJ"Q4`5bs[sQQfa0$ܹ6 f4Ia&45*JLEF4RlZ4c!QTLB$R,hAI# S,E&,hHƤf`Ƃh|<#AdS$lZ*4Q QE(M*5@Twuq2C5i2I`HMHڢM6 idjFQ*CXE!1 X,j1R#R#1JYQ"ISd6heA%)I&6#2ɂbfQ4dz^B(2cxLĘKܐ֛6 T̤I$Q)3EFFLA{]z\E7]-6aQf&T 5mZ& sw!űCx3M/}a?+yO J0lQ_K.SLS~G:P)h"  AYBIˀMFbjdrX((J1>{&4EPR Aa\y3+ IѱQmtɋ"`6J10PEE#idˆF$GyvQ F"AFG0بY UEU r֐J$Y5%-VbhRijiAJ)T)RmEjME5Qlmū+FZIVQTj5Eh-j*hmXUPHE@҈lyjb6QlmFKTmmij5ŲTbؐōԕbű`شTEبXVMjChѶcQi(UT"6//nEdb1QXc/tUYˬ2!, (]7r)%}4y !k555j,Y6[Xh+EEj-EcwZ 6+*IDi#i,[y毤wsm2)4?[QAV8NKNf0E4)ž[q+`DL3~n]5s5HQЫAyϽwlB EiLR2VJٿlBH˵soXkCE}[`zd/^isLYrV=ɝ_(Bw̞~tsݜ5@|ODc J=6֚ pW%F I!.9̎L=_֮sdoH1>No+E-Z!N= zTJ޶v2]{:!7WFsyuOO>G l\Kuڟ>adV?[st*X{wka'[HZhs\#PqGR$[‚ 6>g `[W;kƱs[52EF$"@ͺDh5E% I5 Di,)bMdD1E (b$j*a8;T~}ܜ?PGܾ{DT{,M` Day ̨e&j sV]h$$c_6'sf(2:?lg}{7"V!s?`.G _s!o_c BD-'I)P n(a4#"CqlXM:38,M( ?-=}?UvN 79`q} }A1ĥlμ}ln@c$QJ;?b}a2+SDs4ҙJڌ gBb1bjDUb?7l/,,`80D n5𛚨6ˆ11\4Gyxy1|y(42C&I h#G[4S}s#v>7q͞>kޣ) Jt=@!(b:ubh~9/C&vFJllFU3Gn"$ʻ6 Һ_+vW_&Q$bDhM ڻl',+L+HKTH//:FLGDTb-22fNYuMDۆ˂$CU`Vymc"R"Y9E[S,eI $PߞbVpPGvDV-4G7)UN".~Lpdf'f]i[wΝn=*\i=6)4]!Zȁ[VWK,~p}C]:Kmjiа"Q4fg%Anx5׶ICj?9),Fm89UCT*P 1 } VlwG4?g>+a;1wlQ@C1N eº$Yu!Mrl]<+w)QJi:@|O+/.gH'zt̋~i'1U8 "~Qn>w|N'8BRP[Hu1 T6iftӉ_jy_z|/D+ZoD3\J,2R"3vLs%P Xn t½/Mw~Կ76}dRqȮ_ ~X*:8)k.)HQ)Z"T%\Flx D c}DDͭkֳfrm72*AWo'g>&,g"w&`Z̴=y) v~QSqwax}'[y9y5 M[?rȂ~kw k0d {g6\wxI$m? ݻbe|{0l:xȨ4l0yymoTƁsde,G79>hƛI:^P4X,Qx9ׅJd Jp:a-b.-nBHݶ+kIw=bk(25?ۮn"e+|_58nFO[#c]Hb6664KiF/t"?$+7lt8D1b҈jh9,^Z"-7lb_ 'q 'iwN<)F_hD@ Hw׌޷'7~G8?Lr) Jk!(lX$[ ؤ2ZQcD%"4J&Th$ "d! F(ZM4#ccQKLRF1",F0Re@b1F*BdmW//Yc%r6{$6}J?/yl˃LW3{5ddDNScseeq*  QəLf7;]^mP1ԫJQQ(6b~T?O ;c\cs?Zӗ]Eo)Uf-3%oHm嵨cߊw 2u^8onݹ&_Èv EP_{;+E 9ßnâӺvX&yߝڬ.z7xD&^r6#H} )~D_fJT Rl$.: }, l8TEQ1 PW&IJZ$kF7Y# SSƳJ#3쇖A>7пs9?q}Z܃U?kS;(?Q)D_Od؊aHtJmz!Q>^@+!տ۱yxt$ƸKFsW||W 5L,b ?Ѳ?׆@(sa$'ӵO?33vAфqz&VB`2P}_]o_O8I IHxHWE?,+%Ľ$'g=Q_sMC\84ҡo1M6;]1fs4'2=Ͽ]љ wp`oitm_V=,x81OJe~{npDXDV AJAfmmOyRy)vt9eU]iV,?_6U<̝\ΑGTL#8 Xp1kA7O>(YQuK rGx sH׿@G/H #=4WipU^R3O֯ۢ/ni -~Nͯv| ;}CE#гD䉃eɟϷwu,' \ "S&gR5 ᭎.lg18 Ue8o7 p{ {b)F*d_,!hcW,z̭rf``˶:}ZOM|&|٩BجNڼ 7 Nu`TDBvIBx{nA3 +ka>d򯄏kICf4 A2NU:85f4lIA{ݷR)5.l77C?awH09LT :TuuN,Co2Cz&W_s!g(=ZIq,ě1؊,BZ,Q?{⌛ˏ+zk :roN>_x*:{ϞnSp`pL@?^0>?@2[f.}hȯ&<ѵOҩ(ÁydF/!<$G}GyGT$ӂ<2;TUER҇9pSYe(E{\[rruigSqh/-vm{{ҊNU[3!_mU/߄pW͖ym@z=Bo[˜"J&(BnNS#uU^շ,ȱOeZ[EaQ .^~վOsQ=Yr)ZG0*cwY|yJtW,w8$$ɲqܧ)#rvt܌;FY٬Z أSd]tp0\ IJw4п>Zdp|V!P$I%uzV7La lj/6|y#>g?DA$ U@k@(@+VP\b?R)R +q)BfjX 0I`UKEZ 6JJ(5!-k24hBB _e r Ά CAF*hoNS2-,Yc]JYR j%p,2v0rk-Y;qOETP77iPp- cOϴzC?iW\WF?TPKh‰0b|1/aNYX|5 CʇIcS̢+33R~VhV%;2&FA`1S-rꚤң&-ɛ<5f#`o=5:0Z21YyNUWn_?bIP@BOʬBEc!#3KƟGӤ[ٓ2*`H>w>Z>vuCw+eCE{/1! ֭gp o\T^kWY4#ݎJ oX8|B$N&(N;C;?R?qnH@Yp o>ցϫurXw2DN s~f Υ2}-0H˺oP{ NS|s -J4edq2A(-W9bfp[B1W9'ֆ2GJZ-ͷ/$3IwD^wi4AzxDyt$$ཝ&dDI5U F*0ôeCTmFdmT(ʕxgdiS#9[s)X틳7k`̓Y gF^!F ]l'U^\kq͘񨫵[V2ms'30Rnב;[(Iw]70Nx,\ ,Q&cTrdHLUh1q+aQ@Yml;mF&r`3s\4k`h& fTkѹ\H.Y(KT"m jX]lK\0)^\WZmJ-7namҰ\T*YkZFY!'C;,,s$pF(XPHꤗ`37m5%$}H1P`n6šʔ^\eK[&-#IH4FAfc*Xc qb1LJ%F=dL%k JsCykQJ4#9 %K{'0naJ\Y֜JK:`.^Q 1 ^]Q)b0QffcY7 CE ]RqfKݶ{d CC45i)ALvr]/,dP)V/mW&sQG$(),%QQAEGXprڎ%'anYN=[^^F`.eɩsE7ӣ)y޴gHיz3%%u Vm &%]cr-.S+9b1 KXZQAbq 8Xڂ Sr2Т32 $112,ۘLZi l- 0fd8hb\6 [ 0PEK jkH `ZT(0$ H!0af\8Y;0pʑypaKRo swzrajT) i`WrРda9`p1ERfeJDEz2H2f|^H-9z:r+G֦"&ZE$!"F1s0AdFTb(1 1.`6+Hr0r9# J# \LLҕok9s iaTf6iLu[s)}3wRYoTn`ҌK[2f[4d1Il-,sF2E8Gj j_U;UVCcF(n\I]BՆ3$ms8TfZ\Ͱ"[F(+m ԥ-J4S8h뉥7!R[9D(Eʑo0(jIxӊ [1JfZ*CQne+f0Y04)8R)LYF8FRs6\Y0QzcH:rcH(RXTDS.bN݈Ƴxf(,rնD2E\(. vWj1vޮ1=Z"!Ѷ mLmrܥ:pCq-)-ju'e Xrލ1TCp.,+k ոD(ԪYf;n+KbՆ d1lDAfQk+3&HuˁyXɸs5Q`9R[XQ-V,EXcW0J83T(YBy,*/}-su; zcl{ٹhvhJ`XM;X1*?)Ǖ&H!%3EL3ˍ{/M- I 0T2p Ա38*T'?/׼^2cbm>HņAdC﷎yz` Fv*i* M4$ah"}$X٭(³>.QVY\7*p(F2u~Z֝x9]ܳ S?wB[ĉhሟ꘢T)b1"h=:AW3>tqYj:d|9s^S)(/|L͹&{Kn}oƷACR@j.F_] ܮ;JG7lٶ޲7-"0 %{jQ4ҨKrcn E{Mkj5sɦ1$PFJ7*6ҕ+}(-oƍM$޿z9ZJ T{0X(w"f!NؔtcmT/G~^s5\3e?WeUu/(Or?^_o^wBr39Lvf|"$m?kj5>o=7lSTTQDd`ӶpDY ꏎ[58[f΍o8&?s(uV؀ScOjr#_oηJd/*Pj~|i0רI I$y]>o_~R2֡%돕0DELMYE;'sr{"9͒,UEEBP‚\44Ba(_3kKnСIC 0},C&}tY_|ѡBb'Hsk($VJ}+Mz̄R|'ہمy0e*"/ź O_l<:*k 6+YTHw}7,OB9y=A+MFH]!xX{w:w rr&ðQG-#& (iZ,Z75dX ,$ {n܄@рrF~Ym֌K$Ong.޺%]KEPܠZWzwZs<^GS%--ج!K_F4zI48NY8a}3_MxPCoeKY -Ot~YUXB~Qm“X}Y/ɡˠ2E)uCm4*͋D/M8gGo -r*=,U4,5<OH0۟T"G,~SEɛKjoDG]L1f#6|J>՚!>_+2SY1hs\+ok,(kf?/Qs|WվwDA ZffON&>j}7(Q̿ ˶:1;YhX<˂mNYfO!7HILRȢO=~Ҙ 9~E]$U[TC:ff,5#DQ@-8!A\FEi`49t!/շY_!G o9ጙ&hK !/Kp9bj9[~߄o[CR9Ei/ z{+ߑ3 KkIKug9+wn<ŗ- '͇ڕ 4\f+LL)V6K(C!{v'q"CwJ)Hr V6flb`DJҥ&F +8Ukn˦ROl)7k]Kcdu3J[-i-qR_Srvt?~`scOپ?8jZēMkn_*4!N !Q"Rh x"O/~Y و",i,,X(8{؂ DEp?Nz۫m7…vQF M"$T#"w~2égEβW.L;IY\3EbL!#ٞ L?eR6ūPu4LT(XSۺlFwR8Iq>-A:DQ<>#7,k`$Y2-!HK`Ѥ,tiuvhiiBec' ݜ3UN^Ԟ#:7ml*nU!hՐD$ͻc Z(qN>ꆡegJKm&$F 58ݘǭQUxK@+IX%dzx $$+O7,5O|gPp`P~ӊkǟc'fC! 3HF?#I$Fc( QY-2f:&BTʔ'cnS:&͐!7ziZsx B+zb/B`MDֈ]~*ڒMOgzݕ鿗HmC B7S&C$):4@ )4=oV[>8P5^B.Q9.,);Co{$) v\=CDկFQb=ؑjF$6ڈZ,L+4yAQ$c/ox/ip-ś.ˢLI02-|hʯDF(Pj]O. fÂujhenDDQsDnQY P>#yYc_^Zf$og/d?VXf~TЪp*!c.#leMsz% iXf\Iiʜ`H/~'ݽΟO`6a:u:vJO,C5<^F4:ylyrA iHFDb4A ӻSV*[LHX1'`4Q_{ԞwrIDdL|IQQH*ɝgxwU%-yܤ Afzm817iMQXpXR k[v(]fiJ*lJh6PfPǽltcMY^TwZ2&*" `օ?_Q*l@eB^"LTX2IBdCC~9J\ӖYYhifVISjZZ%#G{f給#.(½JYBd%˹wI*n|W,\tyТ * ?[լ+m2Վ+.G%?YǝU!"P% hZ@,/a^RO:.b L&)1}Q5X?Bf &L t4 +O bT( J_y UZKfV/*J }h_˹!*ѱyQ)_m1k-骔nٰZdYJQiJ~P=S1O H=D!O!P>i@Iɰ㤪M069n+~_?cpeq&o^iRf=fPXK_i8 ?3`eZ23b{ߑoyI@ ƥ󾙼xǾgΓ1 a6O/fl0X@YQxoEܩOeT`,GJn486Ϊ~ר7T̃781chԳ*iEI{#4WلX" z6L][*dnQVtk;\9 Um1JI1{ni(ޮyG/W-K1#YT!$1"`pP^뺷>Q\ '?o~ǹ'x5, 3ZDEI{VֈI)lF*SQ2az9ywjDZK!2:&?Ӝhmb''uE)*)(}xֽ9Yڊ%+<_LuGj^C4I趛ω&L1DlQDTF6i9z CO^Vf7ܳrƟ7=5epmvqI)| UA”a{|S.abg[tQ.FR5pȔITT(ym=<7\{?eDbvQ/wp!"v4P3YV9ݽajx?3LH5Hd#?ϻb>#,NzZslQM߄.q_ݺ7_S_ lP S$ɒJ"4̙,6 ,(k">_w}G4iƞ-h̩r-8,o*%6Id$tlEwaP!PAH=H7X:>Htbz?6?inO E'Wk ۬j/T$(m]IȎ8RoLLI$Hae}uJOYn/[PFGEeIDvCҽ[[W>\Odp3Ъ( 5o[ G{PBq\]?x{{r?祝'] LI( i 51$_~7Wö ߣ`bdF LR2DXA(i0"WBAŦbH$E!_HI $bQFf*riLT*6"!!f1LTa &cJI4X#(ĥ"ad bck~MpR LgΆZ )"53THD}]# ыrq aa"4I1C"e*@*1DlhLX nwZ,BO]sv"I C_7ofR%HStuH2X(Ԇ"`y-Dƪ>Ly dzی0%@udǩ4D axj X}mb/\AQ!$fy_@:ñq7B]Q!z^7kzj:^j"/]gKqL2T|~>ov3ﲏH,rm}޹:P?2VghPvzdcO-KIMX1HzXF&3UWtWyw򨹹)OQRG잯ƯN}QX?z`}1a,"α5.<ߣxx>AB=#,A\M=wj=O |D'W2/Do xB~^_?|:1OA= vO. &L"?[S<~f\Cb*/PҨPzLjw Í?͜|~$1bFLfL1hCҨDXW6 -ͪusgo/dW~~8%6+Ñ̹<ݟ8Tïޘ+-J\Jd*g?XAHbf-:Njh5Q/~\:]L rb0Yr&\D؎6~ZF\70Bpe?@DD$!(cQYYRIi/_LBUD.p#s{I%FǷ#$6K,X,ܢ}dQԜ?SvT2(wޡl*((,LCKHRyݿo™)?2z?01^jWi+ֽ!BFFTB@I?Y?txF*Z/,&Ub1υ걢QoAiu@Z+QiG2ڿ ~N??A"#!li -N=3unB:ѝ@^b,Gj7J*󻭖VUR< f)3w .'{k;vvWeEe$F,4Vd(#Q ZX:FnJE ֨ lMXʊ)xl]nZ[h4(qsr3OSy*a4fw奼S\ hw#:8Q+֥i/ 6rw-EgvVgPE"΋i.\I0#V~ﻜw fM/)B8˷*ʇLRpuT{1"4?4NYd$"a]7]rA3y 3+-gJ jOgogi~;m6+/,fS^ʽDQcXHlTeQ5['i*'~ߗ.wat]WEG!0\E~O /ebjYgEEu|5xcB3"{ɘ:RAV(/H4\r%ŽI68ԬjE8{5)8% ۝ 2z8oMNǶ1yІɮ-Ik6/}c~Tp >vMawN7iUZ~E μ fңLl!=t(EULw"ޚW6}n҄ۢ[JEJRERRS.Lu~o~軶k0SXqˆO6jȣPV^VղW._oτit$&~= QV!z7y8oUNIy+$,ҩM= )TRJTy X:JݤX=>B$bzb]xgb0@:W- $^~eTQMSy-"9Bq:6C<'5cU DQLb( wem!$`qxl؛zIa2#(L.0vg[jK)݉CvÎ2H}b1aG-m-dݒSJ:)0>.D"4+[M&tmyjӪk$wC$Yd&ĺD"dyzk`ZM8ex-f*б#"~Ƀa\z"?Ж/Qۖ\$[ƷU/}Mg M0$ U)-mi?|s3 hBX&@L-1)E+Fd(Œ$ d,=|zo ̞{wP=-=Ӽ IKS)DRa n*PP\U {(xxe _r  ^NuFt%%iuD=Q8Ďn]^~Y~y3LD44)ǧEPK#PyѤYgAƿ_{L2i$ cQh5E$Z\Y L h(MI&2Hj4ZdIF ة1m 4lhfy9]Z]YW+ֺ=eY}tbp{:e˙'[M0~vL Ylƪ;;nC-`gvL<ws210XhޢHVVr=^\INO+Ds15OQfӦҶ.z<פ蝊kqj$r@!gYM(']1DlKF,u/{:~J7Չo}W2"wdU7x- `<uoMgt읶vz,7heo(SJ!Lϑ-X=z➃Dv":uj%Iiv2p,NXYȵ$ $É [}SjzP.sNNs<UUQ5I%-12v!Ֆz]Fea"PLc?{ݱmwA|9zk /iAtwǪ`1TgcJ/m\@ono2d zkߺ6|R]+Rq!az u[e囵X"T<!!cP&f9q}lZ^# 2Jntn@%(HzAZP-4/G?ݿ {oCIz74cW"iD:!ws^F$KQTMm^KH4[yO;G QK@Kc?{װ,>)옱U  Y;3.{=WL?!v겉U:z#yke,tHJdm~I% ЩhV7k(1If1WfghSJVGxZAeCjEoSI,S8>Jk>/ )d!!=ZQЯ҈En/ԚOځZa_:(e~^_͇ALFȡǕ?|6QU@>OrIӨ0gꑌ30b!ΐI@ @y,_&N߫?_PdtT+NJVBIڢ-\*an@~63߷rOU*U^`絡'<{2$HC; Ե.6UYj3k{C꼐,ti)o]b&gwe8ׇPzK;>8sM2EnadW˱3BoF{<I'߿c\cn<2?ZzxS~T $WP~o~sg?8CŗόĐɀ@B@K:\xbj {5݉?7}p䁣")QAV(7K)-Iaj+Zׇ,%/ (PJj3XUT .=vZD3a_-ҭn6C6 S!愢AHQj^lr}X{ RX?Z £ tT +tRҿ17Bs(Bܙ i3Ussu0 LקO˶he/foڳ +9&d*"ZQ˦!;tvbЌenrA^B=I4)DxR͖֬C$X#u xիk![9WY"ލt}Ҋ]Ry'2&><{}qIE> EW –(d.:q }/o΅މ0m  A`2Ba(OWK_d~/9s2JIU !w: +M0?+}+ED`#g}pQ{fx1]u pwroy]Eƣd5^ޅcƢl&Ffic4jɦ°|,ARZ(豢lhv\Q*onIѬcbثەx-kb(*6+&ص+\I`+ر_EƤ6APj"X-TIl|FɍZ,ZTR[bX cRI3ۭ¶6*,h"lшi>/|U{(F#&"b(mh,PhlTQ"؋&"$,1Dn_:49SI M{<ÿcC{m EY<3D:hhZT*J0Wu&CR63,Y"w@"R颂'd+?ʩ]nDb-Dg*,, 2|9Rɣ5.WI)MpllZ1FؠƋhɭh6ЕM5щ-Y5T%Z1-FEʰ66Abэcj4El,TX҉˔BH{ٛ@̠ȼN0l`#EJ{:1QY^;v`MDB5QoLli6$d7R_ۻ3)l& E]ԆYvܛ-J$ɐ lb!Bd&) .Z-'5ڼAE-oEZ11XD·]ɜdR  m PX`PBL*f֢͵H6qR9]N86.^'ؖ`U粓YJm pEI31HX z}2v>G$VÍkS͌DHh ̗frBkDjhG%id]PFN{Ht a5' -VLQ{fBSbH,#]r|}$ᡢCod$UXT)Iʒ_84(NOEXUF q0R >ѩLa)=o^4.laZiBVH*{\(Yi-=͚jONY">LXH>EUF;fhō~!'xJ D>(,PrځYfac{MةG`p2g A<"}䛭!;BI!Ao-aPo0`dͬfjɲJCŊ亮k]}xJ heRS Lpd9vQ hb 2eGkPaEf/Z='24h c=r߭~OgPƦ!X+ QdƱcbK\ם&{ڷiӆAh(،dھ@?ͨld鮄4E_rQEHK6R,dzo&{M$YK#{3h1( }>PU552 ?Q4enYIy3y+R ]BYnrDdIFkFb )L=~ړ#]xT@YaUV49 Po<kq1z?Xϑ@)rop@^81ZY)! Bꡳ?9_uח9pi $3*)i_O1i6`ɴlFMXڄ_v.mƱQda>%)KBRΚ]9T#nϩڴ됭zˊOQ\a1~9T˟e]]4lFGd(T_䥲ŚRw/Rzw" =}MwziOoik"s Y fƝkaLœ‡62\ӤomgMklHy ($rz\r8S^)VbDWiNhЇHCC: ?Nȣ-2*NZÚ6$D7D(I-sl-qUHx-}d/î;T*48:rܫrN]s7Zka]#`O>螑!f-lQh4F6+h6yi96FѢ߯Fךmr6D +R(΅KUKE/ªHXnA=P:QDބ|fi\ҟ|e0-W$lB#v#oC!QE=n'ݖ pvBdއN8B^B Ҁ""lU\w'X^z`xQc (J m~/KCweFƙV5QR҄AIP{~K@}HN-\di(≓[a~P}*$@ ۊ1@ U{(YOӁ³gWy'sPД5@E-$b66QQTT&di QH@P`s\gG[Ǥd(Ã7Yf lP ԞΉI$Jdn$p2[)˸{c @EU2Y?#9s=1VI`*ܰ+н[? /tgw`d-)X=u78=[a'Uǡ,MN ŝm.g?%Ao_Ns_wJE;xux{9IJCgm||1MwGf @2D cDR *2`rV&\AAkID͙+KV-\VBT V *pN8/ gk͝׵p;q&er܋F*enYe/cEF =ӽd!9Y+BUy5DDTא-yN4Pd)Fp[ PZ%#C(`EiԳ (D@ub" .$KҞ-gz9&ͣYX˙f&2&AX+.aɻuKHҔ-%#F0FS r0Hye2@\QXJ( 2/Z`agdU93jsR-UQڪE`r f؁WeͷV# e@uw9Wwt\pR$ǿeTX*+|xnkLiN% BC93҃!RԼ?:P-^{h_mkeS13bR52csNVz'yOjv|;,@CPS;GϏ2M0T? |8]~}oTKowu9JJ ĭuUs$rc%ю/ja38!!8]ֺ=;xrs5\Dd6LW(5tҜg3~ l, ya_r_7:}fwq&2[V7U oxI PXŪfKJ곾\gw)a'ֽ6ºɌS_&Ibjq"QXvgj5fisqg("G2E{MnclZ-3>N X>|-ac nRtuv {T9! H/7pY/&ד$S651T`Ýk!znySHjxCjB*haH"B܉o`HzIt9SOnqN(X2, ndz * r5쐺/} mtz2A9IVlכ6xQ}TuGt9q?n rwaD$ü@Q5Q PnE'<;Pn,rb&cl|0Xj'a M=l>fC_l!`*^tܳݬ̬PJzgj Vjqgqkv3la\ =qҊ_~ABykad6vL3 k{H؄EЩi+R&[ /DIm:B.R4I ȸfǞlV^5Z.CXp{|Ip2e}+Y.fEa!+w'o =좳U)=Os٢rH`͑Jm~ DPK-M9iM!$J-2c<Lu2einA3dvR٪AePY80(0 bTp;}aLE)yu&% Fs{.v)֙\_tY*E䪤ikn#:>|Q0; mvNFr-%IgEf·ԑC`}=21dUAjʨI v *]}eXIx!7;U@P`AMNx6i,Y\g|f9/fh ;f[Yoݹb:[m&-Jgƛ\ tlr/;y}܌,֕8p;WuolW6L)cj1{)^rҳMB@QfeQt3@zw`*B*|mP1"yGV8('UK)LJWSw_n1HIq&G4h6NrdKgE::l&d5q.ڍ*\X]eJ|x$eώ߱K(Myk8cHAˮ~%t1|r=hf}-ڷx=Nx?L3wq}m>HJP\;G?Y̽b5!k}z,db:2xLЈqLkHe]tNrsNI6.1GlkYkSݳvtE *ZoYyNd^h@s!ߟ|?_h۶Aխ) <?Tqt9hھJl3Kx;a/FeSa2ηˁDNv GG(Q1 yu%MMh w~7~,ۍYgXbػ,)[OUyW<O%I3$7zgL)P;Hq>g{tCv*#R+dW$*tY˗A3!$0%0Sٵ!R UMEw* d &ELqD*pCkIVL68f̲l.OX]bl & %H [.MD]lz4^te^nfU]o{MUׇX"}bރ|GMmSr'/$Y3l Я4%r4;8](qK2Zd -DqʫZ0zp@(#!P8YVF蔅ů7GErsv^v?k:f-/͜b{__Ao3FW16-9ĆTI\ՔUvNepNɞweZCRssspqwPRo)V~.l߰6}}2FtE)^fiO;wP9T=W+ֳƸZW-~ᅆߜʔ^tle×)~cTr]=r+j~K޿z߳MkP퇞QQ;sz;^)GD˖K14ΫXHrΥQDQrg2.YeH7ZRVtDț$a4[Pkv&^X#z57:W{]75vq’zﺅ%ocd PUl|UedG@w]vMЕ+$eR mfD{b˅Cs&\H>8+NZ2d{%جB6qH,<zCܢGu䥩4ՠlg?ZkB@]b1&߅ؘUQ; Ե:~ZI ;k`,/ID[''+;ky/ ͷ^+m nꧤo؄:8ĸRej+ eBjZӯ^#ᖖ}zuIM7TJ#ɓ~2!{CAUk7c1+u\_,eYso;}^,ݝtL)HV)[V5PG2µ=IMb\2(ٗDEUJysiWiga eRD֠n*- eS\K(έd2P @ 1&)l &gu%$ YNkOG{}H3̹/]'ŞH-8aYsZzR(XN!qsOJm和M7>G^,60Y01L0(5!J;O{4z]6\T}Ur3Vwe<)Z V}ҡg2в7fԡ[CZ& pSeO}⒖[xkCw=۸}4 pc[vkZ߈ UJql2 &Cgش!a+Y u9o4l՞}"Kt (*hPB-*v%N/[~ܟ΄L}V,ȢH4?( KhC\[@cؖ ͅ4қ<ʘEODŽt57î,Z1٘e+io\x,^{Qkhntĭ-=E1^'43W|;lJ`ňA@Ew]/޾׹^0HQLIs$Q2sX(=TQ"iR^Ƹ d`Ͱfa3wvg3ֶ}֝(bg]YQf9}ҵ= 3$>\u8 'd)项2xww)^ -:wK0o֚M&JǣDRY|Z"&0O%meh9qNWԪَ W:" (EtCԗAzBM4W*T(E>5"8N& >-ʔ}uv J%Fyb=I2ԥyqB@$'~nCİ2ޕѮn;9~G_nDvmV6k&N 'tQ*u%NItxl^D)J$SJJޘdodb כِ%oMQgBdUxA%Q=ЅJwtptӨJ{LU-OjJۓ%d|}FzI:3-ۼ Zʳ@ۊx!@I)j0:~]qj/c^ CNMXjtT62I 9l4%QNLQk2ZMze:.R){hsʕ2S:s)=}EʎKЅI 2I԰ۊX]ĊeAPSbxsUI̲I:Cw3g紮u,~Tw6c!I}Gm7Nu$)-O5ئk{iWP촨y)[N*G܇ \+B-F4EzP#zG;KC 5Xz+χv p4S#ux-e.qq)O3Irwn|Iƣ%ZWJgv{L δO$z3bV6Yi)`xpgyGΊ/k)ty/+}/C}b'^ kW|yw^tM[i O<)Zv bb1ؿKq40&mV *MMp[^]o|qѶ>Gvi:Qs:n*XRuZçbqCR]q5BP&h0R$]eX_ATA^:R{{/Eq/<J;RμW,]PB-}Ik_%NJæF3+:̢+4S^:m]Yl[1Ͳn|Ozx8R3Bͬ0\[wm7BxWK-Xɛ+u:.4ir5UM-70N=(|h@`ӁIì2ُqT-=#sYTO%AYl2GK<{z;@<ҁQEZ,mklU6y DjZ(XZ6+TXQEZVThѬQXQk55Ukl+FQT[cZJ*6 +cjU6*-Z5,V-b%XmQEj-EE֌H$-RrGw wBV5C=OS+;o?5H6ȈR ^*Fz@@j;fZ&_m|tCKgת<]w~_Gp=X䴴lhQdX&8#陑". Z84ef""I#OV 3&gb~t1Dsn_ɸgYSAo-h=I;Kk嶰Wgr7t{ҦvgF+;q#jB䝐 $ШЍi Vݡߢ9ty5kqEݟg~1ӻw:/v7})wt;%mdK=v74ܞnk;n`}'2AV>f *9;QUbp0nHFTR/ޮn*=7R$0,'i> yW#TD_ќeOga<=0 AM - a MLitsz0̢ }y?gfsm\DX+evCFBsl"Ul&Bf؇Pb,31kkAG(ϼQ)gɍxSoH@K6\RXG;61gQM k*9>{{Y@,X i@ѥTq 2Պ" y"^-է[iDO:\sk@@o ):m*E%FiȤ$ 77sc |:M=9fgY)cD&"E- 0\ ;2.+n^kz#pĻ;xBӑЇЕJw,CVy}/PQ`fG, i%B k_/]SӫWX Kf^"Nf|ep{QƞTiXKvhWVef#e7 q-M)VK[*#0k#~6y/<4јY6ox[h3PpUζY׶ KHH Fay`e{3-ɇ>Nr}LkݦFumc[O2J}ڒr@#AOMlmIљx1GELl *QV%i8+E˸B $[8O?.ИuT;VLEEϻIeBt`&r$3+B@x!J_aTm>ne櫒И+͒uSP, 4蠕l6$XAB(a3YD{Ve;o0/,逤6wkN30=!Rg~gsbOU>h}TځN?dQO9kܳn2X/ € PP"pz?~|[]]٭u4s[ߐR>X@et mDDM> Z@ʍC#oSR!dɛc%k/įUsR8tdԩÂ+'or܏{Ec9zK(>3=LI`/pb?׷?`MXQl[$'qDxmi|7 \.[Eŵɩ>+d #5BD"Ip zEڟcmP G7XHρb-} ٩5X+|ǭW.;x]؍d  aAQ9ʩ -LFϑED-:ϿuB`B\RC!?aOXR 3(?a9Osć{tC6#/?3K_J+"wwe4a' 5 D88'mjrm'zܰR;_woc\3oZ0M0XL0$1U /9UV3m&ɶpQ'3/skW:` ?uvNŔPQRZJlQRT[*S{upEܳ$HBO+#YUB]"uiwO# 6{3ѥ tejKnJ"ٳyD"XO%ۯоՏ5 >"$o&{K7ձHҩ&F.5 "YSH_s63[XUnWIR"WhijG's=/ĶO'gpϸV1(mm|GQ$__*(EJP"!DCͅSRnuB^^+6'{FGsـE"*ClF ihCl[r+V@HS3:ޱ>T#~ iOSx Ct| ߋҷwcGkvD&k+#NI&{Ŕ)=XVS zdh\Rƪ> _+2Öy:?[=O{/uφ Ѐ}\&c}2p_|/B0E) kZ߶ºt-z 9kܵM[֯f ևP1]ggr*Lϯh0@zZ,:g{1߅,Je!MOִml=c`2,G;`u0 Q(!A q@랔L !P B,wR)wt&3H۶=GeP[9D'%5ml5W3kYlq gL}Г*|?Mۛ%؃@i\(khftΈS_;S.}\U랿gmq9;)J\L1}Cϭ3z=lMx=Xjs2_:`ϼjºt*/W~]'!WZDQ9ٲ')i_ d19Pt#<`jI(Td@:!1pKpSt8M=}{?C/(OXW]kbpAmW{! np0Nħ(LZu?]~mJ`h)ÒqA= H staRY49eЂA(MpA5ܴl}먚.Ӵ:ճ7qLG;GQQ,C[dj -'0BX Cr><1`K&[^ݹ7u&6n5l׮%@O\ɷ=7ŵ;w/a׉=1ޚދ7yBVؖ;L+wqaik~6So5'/R0b 1MOͪ[adWOg:湶glٜvy<^;t! IEVȹc\(a[1; *,$Qxu]C$eoٌh (qEmX0㠁(XM ar֭q|wF iETBaRGT_ hz8?ENe eU* {6:1"U 4 mRL+,08$&UѫkM2NtD=h#hNO(+$k:Y!x/>}h{xͽnU׾\ǎG>7 co=nS޽ i[zݞΧøWcy>:EHNgeǯ}rAwn]m[b*:6d'vjN ku}_s>=7S+Yk[e׼>F9=zヒt`xA||7Ӏ4pm(dlZNzsMڮʧXw{{|}hcOקYkzw׷Zۦ}}j _rzB];c "M,4Uܾ ZٕХQ>vѶw`}޳n>=a(Wz}W62\y6Ǝ7oUʠ}nǵ>WM׊;]竘N{۔ooϕybl!oxUTV3Ӗd D* ɐ[@+  C}R{! R5T5Unλc2ނ\׉)!8,h\;d)RZ2%^g:rd) v .wXXB]A [9ˋݠԛr3e:yUjy^ 3YGwMюDM\m3 ?GŒo]82F!x(@W6*0NJ7mg} h5YJ$ %Z@А$F[,QG}ձ HTq#e1!s,z.2twe-|;0:d5u[@ZX5>5h{vV 'vvO2c%1h11bp5{ Lr\21vᡴk_=?;-oMzH8Ce \kKgzMd=Õ78&ÓAo  w^ޭW#XԒ ,P"f d`Ѱ)2i^64W\3hTt,\'&M[\3kɢaXIPF¶Հ+ci4FزV-JZ0n1nfƮ6,s0.s#q)P&99ʨ(櫎 \m&̶1ɩ̥U,e%\\`k%bdRlTm`SXJ5DШą?ɦ4+[JTb9I24mI \S5TQ.J1PԚd-ZmEGQF,0`_ m;z2Ƽ!ʛo6 cz.k[aq¬0} DȈ05zHUI>vpD56fѠ kzyD0nHNv!5ϴ Mqx7XC SJHV&)Uɟ$- $͒ڴsFq@7(0MXL:( ҡ4nՎKe|8#דT5͏J$UEl bN {o[pB *)IxppQL(ʼʸ?2P# q5HpslVIH$2p9e ,ޝnҖ{]0]_#_Gqˠ,cf*枏`ü! ,% P1U| ~i $3qux{K׾נꢠNooMe"qԮ#>88ϭ|K"!@m \NȂc9_*HY%L `c2%Kb_?'I>?Ba*)d&ǼpFNfvs,!W=m텀#·"I? ֞ %m$Ezz;IԀ #*¦SmLIqLI6m$7BdIE2YlVb!v]M[g촶C'43p:hALIwb1e*fMR̹E6 LW&kx>o?c wúYv&m{Z]0]EfX(tic@SS%/ / Rݟz~Ub1@-))||'CV)(NɍlOҵŧvοYgqTr(h̭2mܷYryu8D o6$&5% [23#x:D5 k&Xa@0 9$Jyr&o@U^?F P$obΏCLgfpe x#c ETрe:v|~frNl98Z$%"Dh]Ky sШlqЗpStG-*{kB1˜h&CT/4}Vr8UVO(鞵m}.IDP <1qb DE_Mu8+SmQ|OW;<񊥊Pª%2R9тNdPyIx$/3|znX%jCRrOu䇓ư6T=xvz{q4^`@M32ۋ4!qϝG12n> }"H 5*GĕM4`wL%^m}3=G& FDT҅IMkW 6 9iMR4L4@V$MĜ\DAKXۡu׻T&|V;jYUCHGψ|ڽUzJM-E[Llң[T3#.qrbdXCI`01!SIw?aKdZȮ=mn"K-y71*z}?\I% lZB&}lA@Q=GwSmL]:ƻ @JfNA$AdR{mQb3PD}lj՛IԣEB,d2GzIQ3 X>4Þ 8]#iIߠQ'<8? y}FUK+b,tпd m'9ÿpk3<ǧ=vvp4ݸѣS ;6VC`"pzB;\TI =VTφ!p@PzK5ˈ' BAF^>+n!sBp }*ycN;'2)(^<~֕<zYط >pO0sI s2ّ縉F^_ތ~#04f=Z94s*ᶭ)3΀njnYB<ӐO\P=$XPEѰ {i. _ 4Y#)cF\Xl)NClI|>ޑ:}FϪ(yJ'B! 08ZB:?Sͫ $9JDDgΆ7QJj:z~ßʑBqI"0"ą M;7|g3m5H"@}1a(ML| y^q9v*)4Ys*')ݛYCX*>wS<݇sdlU%0%^@6TU<`voO+ r"Ew2A<}Y<_} $( EIcIEQ$UapI>~.% ؍#El+q5sYb5m Xlho.mHљbRjnDiɲj#4ZjjLqpknHqҌhԆɺ 63M0ɳ]Vǀ=cD!z'6==ͮraH=*4i56zq2:6pIǿ!;\ 0'_$e"q5$25ĢJDՃrPHĄ0id~=R  u*;! $8s7F삏ʁt"p,mBΏ}Q66M QIaݣj;:JO3ݏ_M1n6<WDRQ+ԐWWx;8FoNH;Ldfiف(v,+?9q\mNlSp#@7H]{76u9 G,0sɯxUAA5r롵vAt{4:@1~נK1!PMJȤ]ŒbMBfn@np9re3:0 s,B[0 /`̏>_lpn̘fn*[HHfVF-ZZZRo'jSsEVo^-v:gЎ8i/&zߎtZ`; DDd35 fPd<]q!AŔF@O#*@FP"E 7U4X[ ؿG8q{@2A@P4^ߪ2 GvqB^M48||!t()NIshO=ehB~Vi$MI8xp;쬢|v a#%;G='v:)s{KꞬ/ #EXisOC㤇'H&&9q#mn۶ҕL`1{l=.-kɑe<,QAVI٫\<&ft Dkes($ܞQ[3vЊtQS%)12+6ruZ$6KTԌemb6؈h$MTbDbXز2%BX24JV3dh "|_ԏ'l`3`a˘%$ӳV0x obP ׈\ʂhaYn *zI.&.uBЃ3*Br{!Rɭ&i'T隣! CFaꖁ"dz=g2@ `9mpܼy450jDݥ'n`Ǽ"DP)dHh4#{-{`zwOfiQRͰFD 6 52h,:p΍5Qs~A@Y󨶚w{%_r܆6m{r!x}'LK8pJ Ba,\Z4#h"cbNrH([lZEVDBBZJ V6jYkhjQ- R!΅G;?ޚ%SjeY3d{ٹ3y#XƂwn&?(g zQx } DTDWB"$)H %aAK$ IlQbC66QP0E_Ny2RTYnfu$u2ɪRPiBDĄTF֢Il\]7 3d%ft:Lk?BAPLȱQ ɷz6oIVqa 3fL2 %Xj(!;̙1c0@y~ - rn#3k9nv%!ֺFԕZa12jGČij@ 02ѻ9w2;FuᇵgϪ6!cLe™ezYCJ;*+ #21hʐ֙Kfϗ 83/1dCc20P'ʽIkg-\Cr[1pkpC4ME:n*AݒSGvx7W^^<]<0BAkK"ņqtuOP>}~~( 1 l{2w=@[/BM}&l5-&\>)2tkWm nKvx7hXcH52X3w+8G.WS+nI'CsXz J$RHHJ,mlwx4~O+yv+8N LnprF4[QW<ݪb hO 3ʷK?PFeh[@("H=D _qxH*@y@+}$ :3a.ҪBC= =&οv.cUOc({ er;Xcs*LZ2÷W[v~ !h.\K@{qӰ3t:NpXdYbbU 3O0jhR<} \*Hc$xJly]i }$QHt@ k\UW= 3wF)7¹ t\ZD [V~ZOqxLB3t*]w\!5g1 66X7<2/H12\ 롏BﶵVϒj۴M{CքJ@gX63$]^#d,rG^/wX;U MP#sݸשXΩưF(%s8A %O=n9`Yҥ ^ qC62`;U@R\t]yޡErq@ cS= Hf]͊/s$I\`7AyHvVhNCr_ߴ2=FzYU,$ET+{ư}ߔJr(hT*?|9<ǫxhP̽\\.5.`b{a*W;3hfk|ᲄ-[233 ghHs|dު E-0ʨ+x@hXa25`@"b^GZB6o\6 А="zBq& 7Q"!; +n\fiHEnCk(T/ш G&k,g:`b x ¼\8 iIJ cndr,\@0=HӁͱ `FjjCC&LۉkCP7Q"!koL%tC@N@7 m 68HPPyƭ!4}SNa:Yy B2`rb3 e0$ƘzNLv5ZxY \ {Tk3MQ c>zY(|`7{fENR( fݘi`mK65H"~S~/tx[M2kT~avgoHZ)#R3i8 b5GH,UFPe yX zYVY(j e`3FqZ[04e8{IUDFVi|N;vr*O "_L6&h5[3BiKc%}JLM ԝJw! MY(D>&W 2 3̖-UN^ӛ¬@xAKBu\@GtXg:MAyMhgy$ iuN\|sރGKc,JrFeMI"P, ` ]\ b:Aag$D8rȸH!8ѻھpy|75I({:5qry[{ASM^'9 \v\#Ro1UG9 MY]9'kt}x.H2HȦhB]i6d= E$߆f9kj4LUq+ù<ufP]s RU-kx?ٹPܩ5Ng7i$V6|6bJ "|1YmȑpjDLzLllsgZ"lcۘ9bXمh4.L}^<~5t4QPV2, "stpbT%13Q8a'mD^z$Z$Hq2N3@ VղAMxI$tzL|(utSg1*( SBB߃ v =nKҋDcA{zHu  iFv8,`+/˼;lF,`!n:ԿJِ"{Pb$s xw0oZ&3廌.A &c,@ɭwx^4B*gYU$A^ʷ0xNbF2=y58] kgvh51G(,o@#0bSɟ[g2r]: +Ta {:dA7 ]13JvTPfq0|`ʐr֛ǡ ٖ qaxl8 ӧdG:"EBD 4 hD!` 542Dv.7=~_tM7D_zP/ZCʂXM!0 Q`bfAq("A( 퍃iF[s-ַgiJ$Յ`B6'>zlv$TOqks=|LWDegW25ժACnVvY 4h Lɣ<[ǃr*im . x̏8䓝.1()WKXbZf{Ba0gCi'@@#\N3ryye H#0D^,0w!Q8\ת$ŧ4YbD l 8‚c㒥r׸pL_a2gz֤"srZ)xio|sW4$i 2U70ȣBmRH:+VkjDc ht ( }j@m$ *~&eR%N{QUYnD2EQ@NA32wE;|P$8|;|^w]o =_m$8Ē N*g>^98IgBXY ilo2JAj!-x@$51TJ(UJ`TF#{ftV]_d'ȅ;EIb~$wt2@ $jQtȀHnd.G.p;IojdA>_vjuBuTܸwu(mg)jAq;.):+Q d\=KLO5/h~l'_`;[-w_19Aن'`}{ȿf>^B%303J[[XKYyqg6a4T͝P K cS76;zi țv<;s ݇IeRyJ`z-09 ML!㪀5HP*w ńv w@#AED τN^(w$U^LpQAŠ!P8%E(񰪋hha <eDNz~ʋnE;Ơb)B=$=c9ˇj*uZ{}Ok:g IG*,*}6d7=M˕1@58ue%9aoVc>`oJ)dPlYH$V*$ѱih#&zsz *|L]ymr0Nya{(֞׏Kre6ش BuHP n[ zX,׌u)OOsg7k6yzX7VUuXQSπP`=֘@ (UW@' JEO6TPbENvp"A "{*(zE"=̂''Uis2c* pjA~,R@i<^RıJ$ }S;8R6@{TQ߀S*9P~ULH()r#( i *>4 * t/U΀UCT k*E0"aC@eM0"'YS I fUH`hw`$U;>SŔP5ap0r) $$v @daD=)'*T\y]|(摃ѲmZ@T,",=|6uǦEOUc*Po(?0&=Fz6DOАPLʨ!@߅QACzR" @ B p~?("s_O>E?JAG$QM":D8ۘT!AP~PT}>A y/y0t wRq| NP grw=Op߰ ϴ6O]$x0'}4e7qbKP& ~aW"`cޘDT2 >&O `.QF6rUM~BJo(*H6(o]S H ^n"PxP5Q)D Rn i2.~ NhSz:w$~?,{0h&"g4LOE Nk A$. P?|_o3}qWM7ukx!}]wkpz\_x5{n;Z]?&w=oW),K_|GCjYj"yL9H*kлJb?+vcl7RNc}(*aID/}mYG'a&1z&at9;LgOCL(BOdRN- (C! &?4yg з{GVAw1Rg^jql!ZaY8)\cn_~spNo~.=W|䊜!AܫbPDv4dA_ȮZ“!aN;SM] BY1H/* I{LB檩j'C|tCXܾWk epItj@%-2Yr9L6Js^o$&怸nXvqA̟>3PtO ÎwM vXg cWFtS?U'ѿ/5 6Y` 7B9?/ŶFߥA||I*5c;DZ$ L@\1d}?*#vvph~C˹B@̅,^Yj2'>v8!z $Y*WV0?taz!<-at~`uu>\(] z٭68X!C_J6 D%H`?GhD'ãqkT5rc 2nX!5{߽cx i+xGsPBgo}_A&h?&,97%F9kE"\V+ڋ{79r@#€ - DRzwr7qh94\1R])++Qsy Sg+?|G+| ?p>34Y9la' 5d_&6wgBzjl,(9Zj㊄Sдs%z³T$-8CNppXabV 9=3ZuUd#G@),"[w &l'H Cӄޛ [6QXWy2TT?Y83碅[DM B6pNkhm.㼿wgn3ُObS mڮ@,RYh_>߅ N+ a UZ_rXٕ!̿;{xkpꝘa(hA:L\h)cD592H>Nّ'i(zJtǦ蕹&D<1Z;HPRȃRb$j8SiBilD Kf6D0_0(!xŬih "iVG;Q|($G5q4!8FEY:3{lل `A wsGZw&9\ 7u;fWnќ[x.,;|m4ܒ8!A=C;,8߾w(>}זDHQC 29[¸PQ C:7E3LZSxeqbUFaFJtD̀d H:UkV;˹wwq( 3a:{:'4:|}V/4p%~OcO}oq<g, QZf6(yt("aQ -咠݅? I,A9R -up=P5 pK5,jVAԦ|ѡ"Oֺk͑ٮ AeEjdjOSO"E дe |#>n{^sg@|mܥ6j!H[Z&DY\zvCDKJXS #q8 ÉIFVzI)*A#.9RSMFr\3IXY6eř58\(֧Z[%`*H0dG @pq, :rܾ Q7IpU1F4rt%LJ? 021D5LpGr(" RXY4%wPi1CDq,{yO釺=.v t73MGJKtɸ3VZh]LMu9(yJ*2q5yv.N7 ֺ%*dQSX6mn9b13U5g "nSpb b"wrkPmF-etEF`ܺ,5Shë<(>6 QEZZ%XJ¢A RҖRE\x39A' ht9J뗅Ful@Rbr8 31:4(hJQ\TA#%K*DԴIZ1-ƲZ% W[Fbr*2#'Ě 6*j X\8o/*)Q!D!@xR`!,:+*g9rI SKlz+ȵ *EcJKeNjeC硸"my=/98>mJ̰HfBD#0#1Cbb4~(~'?K%d£e̿X_ p7 ,kPNНw s,m&X5d3J& $>]kq7(aQ8u%B7}q\*𦪧,\Ɇ?}8jOjwbn?oasqnpjJ1Xrop1K`75@Wssb[`߯3(Y^)n:}j<&it~,2UeX_{ aY_apW~[&t_*l9qqRW^{%=VGOMS׻~=In|7·ܭzzQ6$oU6ҶLȏڟ3$ywmuC_[ooIn?tF gfz)_2MٽM۲.뽳/w_(z>3La_W֝\ ={$ա8QI)Q:4SޝTN|:{WX-gϧ*I4@c-r+&ȏUP=ZZkZ\aI痍z Nk'9qeMq \Yx֯-j݆Nnw.po-ӛY}m;OEmO2hfy>.KRj`ok̦[5j?g|fkNon+Oa'|ڞKp&ۻY>_ۮdfvރηD1@{dIw5_Y5J~#oX`6TDqQUu=ѽ/c}N.KI?Eˏ L{ V;r]?|w~%nw;ߣH_dv8 e1WVȀ Yo~}>"hC?1RCפMs.ɬ3P|9^GHH$~ leG;zI:?eT҈oʀ&P.cd}$X@[w4;? ze<^߽%-=1]^s/zJr}oM4ul~PC3y !_Զ?Dƀ|熔3!h$F@Z?o/Mo/t7 '/Ngw'D~};b ȉNP_N OFgKuȠ|~͆maPu3h?y{} Me3BDyomB<김C;)A|7]ݼNxʊ ́ kmS7t?݃H>gpy۵~CV_6 83|_j0eR bP;g$J՘$c!4c[F_)Nj |Xe抬D)cȵ }ZkUaZiT6e~ JrP,Ʒ9| P0!HR JR??h cQ|}("4 i6|?&IT~لۈ1lr7+~/l "i "_ˣ{fIEfB M+ڄYj swL/湢bر k1i嵅mfSrsR6(ywsY˰ %P2cz⩪Դ[0}/ 0` D}vɾ0)}E?ݲ ]v?i 7-45! vvYHΪ"$>IpVF%%Fl:Y4!#t(ZX jUVRN w%D)d)Pg"?0PwRw b\ÂSOHv1Èi;({>OfrL9v5m{NЬ,r-@bj2 S4',ӚClZl:g:G!Xz Y Q D:LO}e;7M/ΔRƱ&(7W-i{,j)2 ( #7Pf$kԊ=/| ,@U_?},@v\\&TOuƏfhl}^( >毪A$G׭ש>^i-vU)ykinJ|^􆸇bIve^@jWP?.Պ}Yj^Y*5`RrIv{N;Ra0E[%Mlڙz}{n?.t^3+D bAdbHp6>-g^4˩o;Ap{{-W}qѰs8To^u,|}E{fӻ},|g0M^jwZ?6}8=T}/i}g>]dC7@8~D h^ap~ HOEBU7G}4sƯ(84ۚ~?W>j&xE:; ^U2`_ jDĈ-;I˺EjԳSYJreS#(q˼6&, J$Pa!LVnVD68Eb̃UAT@-Bht+DUq{B gugF5⊥P!l;ɹ-C3X Rl] 5Ђ0S2-uj!sĹxVE6W eHq8U>*gYz~=K\Dƴݫ>y6BurG;S<%1Abc(XI0"̍o[W[m.%p1Yr ]^j:(&/\X.%͞FqY4!'rW2Uj\FZE(k:6:w^b5VSP\mip$;CIS< L;Z&*b8PM\w4ccI"f 'Z RH DGyRMҭ)ΐ2#mGE;M)!e8VR<%Z7C4C(skXֹ29FPL0vj*M[!C7wDmJIBBIoW,?/*MK@vurCx?=gRC?R~;>D `=# ǦgW_| ~ӻslQx<>s:UtXjoaU5_(nKzgI'![o3s6*pw2hVff u_[k%%A7nr>gMaz6i;f+v߻'X8ۗGW1Z8MS6 9='7dEC9ŦYtj:[ ZJFtU&R|lHY4FBNYLAM5 =ڮc]J(FV*M鐆P5/ : l@C"<{ I* o3A)?e|\@_gOtݰ?QϦr$s{oހy<88P}yr@$cdI?ˆ!$ D)S^]߲›QHsSn 2Wa|6Hu0#}"P9HJhE5t4 ͊SY<Ϭu}N:ƴ[tw6fղx(,Zo*\TӛGWdr?{ӣ1$@HY0HJ3aSj}{yPy#S]wr<@f-[~˃O $ @E9<*sDWbT ?=.u+8@ȌݣsRNM:XᘤsޫfHDJ!sqŅ@HST*#H&ŴZEcU,&ƣ[F[Qjl @I+Hk66lXkb+FZ5EhVc[Q[b,b#lbƱk`6U[hZ*-mT[blh**(JGd RhZFhkFXXbUFVm-Qbj)HB H MLQlj)JRJ QY4j-0elhAd!@2J$dAh+`h֋mk+\[rt*KcUQ@ J4`s 3!JC4H$@ rRW+UŬjmkeFIbѫnL[+hYaV@E`ABJ J44JfJ0`Fdh+[qUƢjkKQmX[F-2b5EkPmQi+R)Qq" )J&%.!^& J. q-1 "Y aT`R-kQkIqn h'*/)dPC $3&DL†("č L!T`!ĒIEUV5J\ 3bG-!JfD3f ZED d$c lE̕REm$2ADN$S$0JRaThFZD)D)CTZ+QXllZJ(B iCF!29S~@!>.^牙ԶL ^U,ݵ2@? Iε_!o På֜}Y1O ՕD*Eg,5>$mb))WIG}T= =Љ*'+s+6Z'fLS6ٽl܉=֟o3È |51&vl~W|8ZSH`nƑ`twƚ!-D%ZU$@LS Hϝ>?ӴO'cۂzi} IƉ>Sl6x !`?DG #C=ù¦D?ga_'ِ]?#9$pF8\%6h=r[`䷌ˣḀH:H񾿷:Zda bv^ENTר>lOmDwcf qC b-@nYBpFpVQubhэ')EC;"b$ee LJ4 "F'ꥈI4l0 &.Y"a5ZtcFM^紇 Wf"xR9~/?;u=u`R Zx" xA>L} 4CmFkCy߁)kٷ:SpTue/)'Y+:5P \op?L\pI ݆StpIs0d^<<mcX(p fYRItXIJ?h{nE`!/#KL R A,m|&%P)DŽZM )5q.pӧFa " VZ< UN*DU#֓A30bÜy6@!Kn+b"*^G-UA('FSpe絟!HrMò1~-5u#2Џ:gn+Zܼö窌njq/WϒL] gˈ\ b)XHjn@(%QmѢklmM#@QlZh_EvI" *!\DlEV@+޷m(!Q隥QPer_ɯoe 9AIy'PXwnINP&] ¹'V j""J6lbMP5ͮ1Zdl( DlmFZ,FmIAh7.i0X-EQ6B%Qb-6y]뵴RƋ&KkE65hѴhExGumڍEEEٶdJ-"Д̅!5s˿5xZEXV$6LIbi+i-V̄BR4 %"H,Jzd8Z(h)vJ {H2CυWy<̃ox;覍@P$5)_{G&鄭Ԫݶ7'3Tiqڴ>!G-E֠\ K^98ٜ CٓzѪb~:)f^s77q ՎS:mhE6r,Ea}vEwgn,h4ϻᇻUyL_{|<7Zn&GiӇDTxbdeȃD77nvӽE3~` a $@H@J]SϚ19鷾'hM&c 4f\T98&h~SehXfhmTxfm$f!~9)IT^b)"dqݔ7cdAT>g.hH =-%JSő/u:xȑS=ܠFpX-?HBӿFgQikHtu B&[Rv}Mcu$u8i0qU0#-kfD f[q2;$K7{DL*4CY['wsaE״"a.UaZFwvܨBIĄs}gY0kaԼƺX",Fj2i&bTj FehhP" i0̭+"ZYb6ro97-ݒ0NkpMHao2SKr*Z:c;V][ :]P q@zb'^`eXUGL(ǧĘE=j?y@b8HC\LG*XjkDdNk^,`Y2dD Z0DCݲdjTPDo]s;ǿ;Ҟ30B옶4+|@{oR6 ,9=;yz/"iԶZEFyTL+.>7$7@SSd"2 7I+Otasr;]uO hhH K`Soon\)h-2,<'CݠНqc:zBl|?g!ԣ GmI2K I92ha$;mIхgK=zC i!7'M3QVAb2pE$&8m/It6c)OiΜ $P(D JLH.)A`\!!ңegb±fZ[4Rɓ&F ,ѪedѦiKL,+071㹹|gAPul!qAKen6 \^DEKw'͑p5>){kϊu~g=spM nylnӂ=UYYR6*iz;[H= Ը[)#!xrJ:uryOOk޾:922$;7+ Cz5C~$:~ :mBuDQ_m8i/\{ަ^$>u)7 |OǔLAlC~o|Oe\4;Q]Cv$Gqaى-F/Qtq/NW$~~_CzgTT}fqI@?%;24A/_tn= n0fd53#?2 &ShsR UTqRRت{_'¦ ->V?#W @K$J fbUKֿhgo 1r2 b#"-i' =|WA92[+z-5ݡdUcDp[Oӛ3puwPiN`B0 u{V"[(=~Zջ`;Fr> F46uج0~%TepSZ嵉1{z^, f1% JAT6V;O}TC 5BR I(0fzV&}U,>l8̵ؙZ"(;+e9?יGސ łoMMF# ^cUtW^oӫtt |+5(~a9 @|u();8?K5z8:ՊYE^Dőh9Ϯm\c֣Fl.>&;fPap6;k#oW;=eyͿ p+@D&,63:,ZdD3/SmǨE̚D oq`3ȣَ{$ԩUCIG*RCxyq^9JfiCJK&܊=p屆o$F[4!uhmӉ4]9l+[Zbf4`LשaC6Leœk3 m9!Rz O$=eU7;'e놴\y?`ϽYJJ4 ڛ`2 m[G0 6؈ET7lI4glC `m'LHLϊ MX)3nLC>\]Ucm=)np E+{5dk;&IFε2@{O*Dzat+vӇ853P?boy`loqI;&M(`N $@G Y|gqί} _Ss2M&솄?_"fUݓEc :̶( i zLߺS2"8^RpDС}򾯻?Ʒ>D93O1Vwa(C"q?6ŭ PB0I7Iӥi oy.yĥS4{KH `?}YӒV) PPEa{ٹ9UHkp'Q'AF `ԸFow;:G? >9<@*Hs!7/!!4ci=2{>WEyodn$ŖnsEێċDdݡ0`EWǠ3 uNP̘X%N5TN!( ńu(Pe0d,AQҰY"&E kb`7޼^pJ _9e(guS*sfFR!Y8ܖE$7b\LM*4W4>ar)@}bVCdeZS߯1hPB )bZ o܉lCdrpɦv:ahY 7҄fl)f^[H:fc((} F7aFR!dٞAY*c lRÕ.^5z~CF0+xZb6Pr$~&!܂*hlD~Gʼ ygˏ_M=\ӻ| "w"*g_6 ##d'`bh%TXldi3t6ia1@wJK]"$4Sp;dz Hgqn.oA}'ٰ!#ـn>Kr>hc~S0(Ǡ>\JF0Y{h,oqxEP`zBJEdZF8|yi`Qӡr3@jfMLej H 0$2dˣ?bG ,-ŊBb ?1 a+`ҙs,q12z amKG7Ti2譩reMƥw"RakLW^痩m7?K!P Á12?2a%ylٽά#9ִ7VjL -OGt; @SV񭞧FÉF m)Rล]hg d%lf[i*WjPm 5㨖1q H$Oɞd_ ^,r^8_EX_ {vvPv^ %[/Zl 98U`ɂC%n:q; `w ?ۖkjܓY/"Ʃ20aLв!`}!!N2a$]fcNVŒ0Z^P?c€Ah}Rc'Z>>E'H<7 s CE_'at׉|qmNC6aCCwva8H(w%k~\ovvz L4^R=^.X%8 PDb따سr؄ӡx9 ZeU!2K(쏘%轳3X(+We@d|cx0  6u5:~COM9D>2>ig*<+jrsƹʨ7Bd[Hd#,d C&t;{j29j,<"[+]_m('p =*v- qG ]Z`g XrkC< QډG=gHlW}9!Vs0P,_ܥФo~8A1= Ѻ>Dh|_v!FĆ(==ycZȿ;2}S7z%ɹ2 t)6HuFx{k9R`a,cH$ul[MLYCD&={qz|iWް6+T%iKN" NW< cOyt{u:oLÒ 4 29!&3#k Ekm_r)ٜK9)|'L;ұg1Vct.m! B­_+^,jc_[HI;FMv2P_L&ёCg5TyL@vWfՎCba˭Hqt'ԙ2+:j/ #qH%oc]gt,.[Drh;MjzyZ*ƚv=4ϔr^nɰ10rv~ OcPᛚxG|κn&^wln?/9.a<`4J + zS;CT؅)5ݤaDJ UfN1Qӗ\F9a0W]F6|9ItE&^.L NDkbֽ/r禭dn!ҏèdMؙR;"f"=+k6EX{s195gLo?nT_̪ Ɲ]9L9lAaIJ\Ƹs|M\+sb Z͕ĸJT]y /ֺ -^7bdBۚk݋@$@g aE{,Ϋt51yeI~BTS?>_ ĭ7 <@K۷RuMt_M3!zn~x9>dS8vۺ]DĐa 4W>:8&G%dō2o:`%zێhGb (pGwo r)w͕O4!iqJ I -֮NFϕ:s\flP|Ngє9Y=&Ф#{3߷+Rx\<K3jA<.]k> mg}ݩ;r@eHqU^G6m~7R".H#?IB uћUZr3'nZvWR=7v;icbp[%b)6 q۳QoJ1"D,귽]hJ9DbzR區kHHT +ڟ}hz'suBl;-E7X6ajCH*mWam6@ނ'V^ $Igrf 60HDkfu#..N-bMٻ3fԡkxn-?!Dka#.1+XqV[Oq׽oOV|F 5tt.AVgxNX1S޳&F"[ֿ |tq.9K̋ H:$•MbCZY7P!p6J}jKń.umy̽IVg.VJ_1^-Ao$Y@rz.2WGSTMy.֍Ԯ—80ӆ M`pݎ^z]@%9qr1w,.03Q33;GwϤt%HK^ĉ{xH; o!#ۭY)IC"lvfbb_ /::%}i !jsʔ!TGfT:E<r0*c l x݆?.(|rs4lCdim4a%+m$h.fe,bZn*3t9<ۺ63iIso^k["KE7>5zwXP<ׂp[${$案WR;ӎw)h ·i[) ˇAV5Rj4s!=io%4N?/S@;GV.!Ar_nPꧩr,#g fD ^9Fh26r&au0 BLJĮ#8 tPI40^D]5:K"桿5d u%/u5JP~tKۮ#jaYi7>U⅘WxT wh?My&AMy_7@ny1 dL%D LleH=| AXjuXw?iW .2!Xun?+w(u|~,Xg).%Gh9cekp 8@e}ۋzuƨӌ{iTk^ůc޹ ^Tp;~ᜲWPŔϘd.[= ɸ-U@Й4DF>,"W8bZSǫw0ä@}qBYФ7!k!~/ <74<};u e+ 14yWdD"s . ,/&onfmpW =By0gab`ߢ$ShТ&O23$pGg|/G^j̊v# LFr^~ >=t`N͸@gn0#C]QY{"bcȿ)eS3x@o^V $mYs i?0?_w>QPb(#a+YS?@A{^^>W-MA7A:0tF>o=sZ䧼qUVcƊ{.|E wt=}1g8PWTgJnv$t}]NX/ IAtƐ|N~yZaGyC[ho^6rsjgq&ݫT!w.ɇ LogYƻ?jD"3dq+ Ncs;Cڵ~XYOS[A_~ԋ<+(ڟ%|-ɰ\/sBڐ0i~R54}4 l?Sr"<E LX)HA!2{n=ec5}lCXK2@?tOQb(N=i&8/Lc {vHcP\}hBogׇܼ@h"gtÝWOۉ Yi"Z :LjlX/7QF]O5IJfqKj6b&˜Y*s2 '8caҮ- <=Vnr/M>) ?S]ՎϽ D^k&Uff%-pv)޻%W\)ٱx`]2Ү&(3V ҉sAN _{97XjZWhKb-˝]3nP5$av\f>,l XGՎ+{7:qw da$x"QaVeLG=30<,3.Ox(Q̈KF;s'*b$P`Z)BQ+NH_`kjndݘPaDػYi? Nj1kY>u`H,'(Y -"JZȊUʺVB*6tf| bD(KڏsTObM{ gˑ|;\wC2=qZLkj<ҰbV{NAnn+ 5t2 GDY!mY l+WO%\LY "q,ʩ .,&PY@ 2rO =JlTEVVgIKHha*V b[`A,(zfA̻.9MdS>vy:Z B^Ψ؏e&x5aUΡ!k)nuR" !m'LͨS:`ʅ4I 7۫lqw̞Nt]4Nm^ N=gvK\NV}B$ He ˫=8HdK5A51م!Uqa9"i7+t6Mo~ޛEZ\Ȝ6EѪ\o\fytbJ/pZȻxV!FD1e!NtM}yzgbdݍrn$I 3 9 ߒк%UNG?= x@0`zns-u磸.6\w_Gyƿb0Ĕʏ9.9T0nQ]*p!B2(w%(aE+δF7E R xx~K 13t-`+2Ğ[ 7ҳO Qj< ;_}F4DZh% WsLfSڤ}tr^MoG4#x#f@7i:t1͕m,l[N uH^0ms*g2 %!S0iӋ,&^+0P4&.ts N@yYO*#@pr{Y,B#MPmxuS2Cq|mL>`HTeRLM- h,FHjvPL(GkWkU e]le뽓LÔU✒tFGL uD2>hRoČkxMNs\Hܰ'_wu-X[щ>Q#1 'bi c:dP 7e,FY*d,5UeI0hڕ8dFǞce`牡)qRLITP(3FKň= U^Wo/^UN 5i-g#.S8K~t*+R Y^Zx >RV|06z;To϶tZ-"d{xD;AƂ"IйSa_-W2 f"U=vHh[u)ƼW?դ`)Yp^UnTIܯ QJ첪 t8j8-t=}qU1}XKy1N7UIU{R!zО8QQ՟y'3,ҤY&p@=XrtI12U/]SɆkQtv*㟵S߃@%1!H G蘓 ɶq⩠yۃo9+WE Nvy`Ⱥ E^:r6o`UƢm350d$L)TJRC m|J*5I+^6Ü,⹸ƈiW6oVt2%Aڐ^MNيL-4W[l+0 - i]Gl=T" (A%V?.LGZ-B^=mTNrAD/Ee~"F}O| B/1C_%~C)tY4ݞZ/u )6{3nzʕ9M&FwMq=)/[7ԛ.Dj2x4h f\^jhއ`:3x7y{YE D/MLlUW2-^Af XpJOYR']/S[)`{j Gd"Z҅6ꈊ&_"]>xP.$ n~tB}ZUE*mQ]SL~o32 Xir@*A]xs -LϐN m9kqtQNR8Y;'9'z0 9-r<_X*eJ@_>_2?wMLWD*/1 W4t Z XXZFzq/4qTѹBh5.cl$PԆmceQ1 b#^Pz]~ F=ssp,)v -"C5.o f JQ~YXG%4{yrC'ꄆ! @\ڌ%p;->j-'Jtcڊ^ITrZȳ P޺6H]t@*F?4P % A(# WƮ:jEso@H.4>>!p,_Җɞ#8ϗIaL6@GHjaeŷNjPcnKT(ImePa`<8n3W꠾+tUF Uw/D?~*B]iG\݊\dI\ewl3ni TDH2Z-<9 Uik߇!r_rvEsFq}&xWȑ[4EHj{<@kјDl' C7Zexý~QlY=SE4&-.d2@/ɓɂVJڷ]}1S_S/M"TEfGlN f/,NOms) ٭~+N5\K 7r-3C c2SEWVߥ)-)+JKOvsAÙT%"E(/FJijTjGmb3-:Xܑ&.2J8yQ/Ejgm!e^5^pGJR5 cy4568֑d) Ĩnc+?‚evD@lC{;󤔉wF`ml\/:"|{zWfX^*6R_/+tתּ6갏2%^af]A@~Nh Q~Rt j$u?&fcVUъKyA6ܔk(P=hA~j-?] ?$h}81yFᏗ\T`J>/n/^yN4(P_H`.~OR)F:h)*YnU I-V=ڳ\ ج+!ؙN(fW]d8nbVȢ89Mr9"oʌ4m|caM1p&j]o6!Ҹ-~\ 8ܯĦM5mך2|R[L~vokaSw עޝƞNr1 ALÔRIzV ̇Pcw| rhZ5ƪ`1\.Yelي.S;8詟PBY"6| hե{>.դn܉YK5B~v{]> WL=3wnM/>ƭ.Bedn/(R7-o`䄛/|a O;put>YX C!sMU4;8^/3SwoɃ.^+[}v>PW3[(>@y-pBdR!łҺa">EX+]3ͺ";؂.vSğr@_%ҞRnak[8$ԋq<J$Yef[=>-C@ٶK;o#1mqXᧃw@N !Y,yks:=-zh/+00#3r Yzt=KGQ^ng 7Nk\iu00wpz V%HX1dAYLt)Y,T9pr&SjZa=[Bo_<A=]r:|Ib씤n.ȋ#v GI0?%-c).ư%R/+]}Uk58̩hFn空~8{j*BIU)3Qt'(̹o>V8hiR Lj~q@1aU8*4QAݻd`1 :+n?b ^n]Fk3j,p>,3Epz p z YdLP6̰M<7~[ ?[r5Akʟy{~f+o*}pq*,y#낤B(' `2{盨+4}|úi䀈Зs~uWzN ZrlG&n(g׀*&:@8Dr,k{&l&&~)I7K=j0:qs_r}(yvM};vuuEz* :,{r9@6v8M6n/6^^ޛ^UwסjвH  ƺ`(Ln fLjs!awkR} 9w>rQѱ"ct86y>? -CrR~oGl+޾//TaoM`ZT'K'Wyuc|{N$I1JX7-vzݜwHc",-QyDT1vH )qK@zlY*e%v[Anʪm2QB зX@ј3w2n8I%g~)9O =IfxGZK5ƈ"Y9ܿĭZpl1~Cr]''@#yz':0BW7o #W5H9 N y4t́%3;*?@agp7 hOG^ `S[*MwUA|]ct?DY ۥr8 4, TQBQxLPKM0Z7Q@Ys%sK5Utrm('5H)|IqUyp:8eo~L[NI7)K'lqc3j<~d@etJ& "$OM!g|fSd,+KE$ ERtߧbJ9̤b{6]g2$&,RhpW|^:1?JWAP)+ROh-qq<rg)S VBK A杳#,y6 PM˿1u)3,(Psx]uܫ;`! y\o'襢pr}87\Yn2yqݧBh \#z6$r4LL*Al$vub8m) l r}雷hD* #@>?_p)M#zfi1mf@g}ѐZΘ>r5I=r~HH]n TMpKKsKsc"6T~=B*2 :?_0FP6iw aEgxeqɔ\~4?c]0_=1 $DY8DI!N0ǟk wd~A2%XGRKUj-~A `;fx Xvk&) :ʔcUL|SxGyuӠ:^uw?T ~WUD~Xtb4 TDbc7Iq(xA8 {F _>wՃ8HtFFGi)b&bb?Tל*tt_=)`7Ȭ9] g:)[#jtBMc'!sߊ]}yb.1$0Kgt?|B/#kC*6=ad~scy{w %ʬ?%f@џʊ_#\Udt!r0!;1^:mܹca^µS>Ei.HZ^m̮̄9Ե,fuSzV󵰗ɫЂK<)= 9|gnT$)rbŠhݞͪkeLD,pf*؉_3bT h(ΟFv푛6ܶ<鑡-U ۶cLxXgo70tRήnj;1cuόr !3wj y %­M,szOpሣ|Aڸ 9AЈY]s|)%~]kɿ 0QVv"2Kayw\ (Ρ_y&>=,wR1=ILLXm^(RaaDSeeV\!!K rجf)eQ6:铂8 !6#qoP)ӛh3]1aOnM$Z^n@3@&O.xBP4!VhiS0Y62ue)ɚjxwsQ`M?i{pc}Uj&}Xiڠ@W%cn(!68pki>^$cG8^1#8WOܣv}PO&B(!7$Ry<YHH)FŢH_YP'`:2d-.[N!oV/l0oo )zF] ~^u=u[7EJR%jCςBY//SXMy]g„%Qfy=2kK#n kAROHZkB2o_M 1Ѝԝ@ۚyyu ]&^z4#5>jށϟMyh)oJd/Q"k-HHn:ep Ưz 3&!]3zXp"vx߭YR st=MPLLy~[8'2awړUjz8_yyc&hu?^r*[- 4{|I>Ŗ** fg iR0z=[7te<(N+64~Ac4BPWճaY*@u,L򫹀v RKWdEÖ$du]B&܌!?{\-5\!Yf q4N2{zNТ"؞}ِ%p>bʪY}~(>-Ғ̭NGqj@VQ!r g^>1;q'?X0?4ڗqlj0/Q# c[6f$;ΚA,Dvbœ5jgoL O7GΠe=JD{ v2cA}hMɥ?3w300@jW6&au/Y9I}6@ԁP+#In~z&p/dȴ9oh3 B|4 z޴Sp7i+2T@啿1|Wx^ϲp(Jz޿Ly]mɜQBpK'CIwvKF*dY$ &u _i9G6tH~\#C-OXʂ脳m]hc'(< sYn07E a="ͅ^` 賯3CXsd,pEJj`6ux ~C3~~)(%ߑ뚖ݓt\/c2(!pݣ?Fwc@yDYr~Bg7Ժ1uewIG ȩ,Q=Sq=鶦Y.@TZ1s^) 1<[u_M_M@䐠gY?RBx^UOȖwf][k?Nڜqo6$}Ӕ2)Z+aN(\217dR#wT>Oée)V",B9v~=U*HR|@G?ʠAq%x;>*сAy|,R4Kf]o\T5;O_!=/S'5>iq+E+ocx%.U$#_%mEFZu:c9U\Ff&ǵmsa8 >xG"[T%*H/M%svK=@ $Uf3lzTKXgSym8avP%q˵$p0M3I݅6h60^T|;x0V Y3Mm4Eą+zoQơ,mRF.xy)H%4,3/4WZjT("{Y2j=cx䍕IU{bvK Tnd$r)O=c`N\>tQ%edjʶ %m?h` kUtŬu:JmMgo{n殍}u*6loN^ۘ&Oe^ƿFqJ2=9zHY;ry1mq}O@!BO 5z1q_sXХDFY!cըLot|,9Y7p@U܀rĉ%miO7nb9x˳a+35Qy4?HurZnퟙhL/Ռ2bp4 wQHw\'م^9YW &zjIaQNOT.s4֑~:D\O}1"Ϯe?W\@wOÀ,ׁwH(Ƅ6Nf\dD i ma k rsHNA2[^Ȏ?9v=k]~fZCډU[ Nܐԑ-Ӟ}as͸kmSm^,`|3D2׿8٦A&~=0HN\Z&A-vq:O\+enn(K8?L]_eK.I{z&<<$!EtinnԮW+Un|-l*KK|#~:Q`d(B^gk]0KS[,cC*utMzGT;cfZ[[d_{Pt>ݑw|=XGpzcc/3oRgys;UI TYޒ (lѷ+/4ʤ<92polj.M1#&SQ."A d7܇uW$St-U%z|nsQ]ڊZboTM:,ٹ*1X"ZSCgxV@UmFHhQA]tk:WD •؝㠥5++"5<}M˪8ϟ'9ˆHN팙zC]~SG#fDl, *z^s-źeV_*2 R*9O 5Օl{f!a@4R[ۊƟS$L6bGt2+YqkyD]q+Mw܆{ uDn_F o?$MvP^[ryN8b"֐}E'GɎd )?䖬,lp- ^Z|n7YѱXlHqw&FRB"[ѨA *EvB*+uMmKɬb@o.38P)kP\,Xp Q 6d ; /Apii0/Y ~%UE28EJ YAd5 gF!r;au1`HtC\BPa6FT@h'SZΖWi&*ҳ1!bft65PV ֟P-@Iڵ KؠR7r|jFQ|t0bNSN~WmR#篌%ݛݵʴJXw&fHPw4~dgZ[1u3gRz ;Qk^Os[.2H/+c>hA(gc1߱ -zFV}a}\DqMv$w{ #_e!b/7 ТG fqEnp˖ Q7 @:(} h@@*3(n\)R)F)RfKC9m|ةg)fO^1]ʫ 2]Zj糡cjݨN-jK(SJcR<,㺔v09uER%DUq .O¡8%R^w`Ry Tz0eu79L4ϫ~.R`Aݭ⨡Nwyb6F'0&yOfts%T-BƇEzK]ذdܾ^d_Qu/srC|p5KuWV#/9K`0Us3@Q0yn8n Mc_yNtuuL?+)Bt[+fRm׿&Y)zsQ>4,p9WOL'hzhq´!,l'",>Bqʵ<'z%y^:V:9zj\]9M<{1G? Lt]\ A(`7k`N-GMRxӆ>J%Ρ#Tf@G[(Jl>b^Rrs[c{5׬ >yAh뽱0 |oo%u¾HAy0zOmW~4{0G&Y^2-rH痾GDgyE,˷5PЀ 4G]i{lcbV8 ZS{[_ߥ܉u й =Γ-438EVub%9le}IDԈ+*:8,јs]$d\N&E= C_;ʚ}I5\ZBv]VGȚC>YZRJUR $ 9' KհfNOH@<9 37fSZ;p/p? &/ZA[W HV5o=yGARՓ 4iY0K O,oth rs;.Vw?bbpn^_Jt%&LҦ3cGԚWG sQo4K5&gĽ\1BݯhNx_Vlx;n^z~4h3$T0SA W"63=X(Š~u~^l m//aOO2_72o5:B:6ʝ{\,{ԳcjD0Tb}h kI{CQĴ %h::s; (L֤Cz,}WЛQn ե7Qf5#F=c'<'\ͭR mٵ7U1 x&ɝvuZ?1T/Fb$j=O(Ͳ?%8fÖYS]T o_0%D&SOǸtch&N^@̾kN+zքڛZG=YCVԓ<ŀB b%(5#4n[o; s%wPwbA8]d K}@D&/Sw31< W{V &/#o9Q˙_nh4gð)j4!h; 0T1K pF# 6FoDOK=g8íaȖx cKg٧iXnMؔ .{vSU jz[Mc2ς|aϗqwQ&cd.Ǝ}\10PXwҸ6y92Yf`G֨B3&&1rpウ8C](k !`gq]R 폖^oXSHkhhUm3NIa4jNh45@mG rNS;=݃#sX Βtۯ!).rz*_źU@ԮQ44V`.aR1[+24!겒}hA3a⬱ ±F<"ft q&U0ࠊG :'ʲvբlXbňI{gՃbb?%QiR>\uXJ p# Kr3,n*{sܜ|S$ۂrQy$"`բ.D,߼ kk&-|t y 6c͒rW& ^5'Sbr >6ĮW|>4{0DTU¤+3`|G7/ƣvr3wĝ:4.(&}qWTre5]!8i9vn䰖'-_ޞ/u&cfC{ѿl&PkH;{.:$avf0bhI@'a'#SGRDBЅ lqf:=>I\2 蘉6`)>\ կM2i@ V@>%ihFGSڮasS@tN bRu1_}Eә0"T7#% cdžL#`J aǢm菢oDp;_"徐)m&^%-poQܢ=4"'Yީ{:Kv3YRmK4fƤ[7M谑&;]ό%W͔-|@AO5s2<؍E~khH*[7:[Tˇots]kaj MԈ΄Xԣ!Ydۍu,Asߟ9ԧ{I}2Kd)x[8nXgxѼ/d2y޽=NW=cjǭ|Q6`<07 Ki{;w?[@iX)LΥ׷Ɔf nY3-!ˊ}&[ܕxxn%+M)Q}ҷuIՌ'dN}_u8q dOͷ`?3ܴD}y;Ё.#J]hC: _(!hFi-Q wW,R7pвlSvXQڅAZॎ{=Zd󈲚,OZ""2#>cbʾqp@rjn@3贖,X{3̹[2wm|M~WKvo$;;f.O~d}g&gXpD~;_ Jʾcy[?jTl"$81UymxYhQt.ʧ{vSc=xӨX]a^1N(4m]ްك 2gBת-!)<{-o|uk9HšBl! Mj/[F۬nofΧW7OF%й؋sk2(Z͜Q.Yw^ l'98MϳЫšsNbCySeʕE7.vdX/@ Hp|&_dM99[ v)|Fjffg{-ե&Zv,u+l~>=&%`g Se!Mjj+A'o`F$ T%vEW-k],/Onp ;A84JU)j)}(7(_/d3F# GW} )6&w fUSA|$J]za%3dتKFt#[$bfM.UyHtT9\xh뷑)R]1ȉBkluߪ*(8!1X^fвd\ i|F&ؠROJ\ML?],"rE%OecpVS#Pk-kRhSVG$}ۓ>búj"O~,C}ƆK9^ *T?:]Xoy$_d>wܴٯRt5Ij^`:rESSG"6u:gd'## HĻć(` AFCy[wݵ clOzbSPD`_N%PonW7C`P H=:YFfOD+۩kAxQ٨vn<9!mk4aC =yLvЁe}LԳOBi.? \\6,"?JLQ-3Ky n 'WiaE stK&\ܲgb ILC]p0t\bC%n5AN*@ HWM)p$Z>Si dk93HCXʰ}"o*K$tjxaDP54spd.|f{3)mYX?hVuٯdK?Eus܍ mTbnB4 [D/s֢~Ѡ]XP)ϧrOGJc?uCC$!+-lu%u+җKȻq=cD7׸>.I2~>%tQGpA2HyeS)U8{}4pg-=˔VCs3D3D \T@Wb`rO6 w2࿋w}KI{ۄyX^aYGC v4-Ic#5q (kW# oRA=9[K-v=q,tfP "Z|wK#O['ytq2A~PҧvvwMp֪ w+Jj(Ul#zjHzi5s,hyV Ff͟{ꈂ*{w=!e.~pU?I)f3ZZ`3A†mAg]~:onOLIBaK]f/גٌ(F*b-SV&msᘺɉ,1mCʯ%mر\'% w);/>ŕ֒*H%K(%7Uvj> MWqI^,Ñn.7b|gЅ!T@pQ4ИvsELSbK&zBF; [~^{TѳCJ[Cj8YdI^ lR36!3[G=eU7lA^DF4 tkل*ٝ/V/FCN +lPoM,]n1&.cʵV )u%z9ЖW;e@@wכތ`{XR3#Fz*LϾqvnq h.18ccs f:mCa{ ըPDy: YٗIѝn 껤<(@2 C80*c(Coҁ(pjAcwdv>ηMąm۪* 谱7%"Rza|{DuOq9i s8n3mpnǧt|` KZFI `]-Gb'6{ b7 4()4BhUga(J.v$NisNq/1MccrG>bU(/kEpM}wOonYֈ߸3R\URrӹ]rnO -x*zt1B!vE+ZbVRGGA5zyUȻKn gԛ Q|-,")-&]/$SXZm 1? 0Dԗ}[=[P"ӻXc[^wQu{yZ\{&T- >'Oѓuۉ#3xyPP Ҽ 2t9ZQ9z|Ir:5ҕع@78QW>AllLH4H2`N9LapAB5rΈYqQ-jVޯa8c)A5z@9O0Y2rR^6J|ý8}zr._/褄J= \qnLXYʋKjt 0Ms`> nݾ"6Z'Qخ=4V+;~۬ e^нcţtDY,º:Ч3X3џ 0~g =c$<kZ|Қ%5f ݘIQxvma-"I[+]a8 5DGmm?@g rsNx;ڿ96#a^̋oB dکk.!ֺHTTiĀJ6%CV1Bҧ9{RKyGx!5Ȥ"_#$ܢH-ωK\U@OD+*N♣g*Au.I ~w_֜AHTG^+EJ+?eFG rʶs K[C[akJ$)w 4n.2qW=M[甠 .$JLl!8\[';D:;";faM}nUHj[\0JZo 5g:>6Ҋ Z w}q)46S]jT웻.w6|ZL ]9Qli3:=N`\I[ 5$c\{:$nppR6Z L6|jē3-2#F ]:r\x ̾rH?D^}H~v ?S!xU1t9pLpӪwe,Z 4~hCl#vS7B` e|%z!ӊp >dݶ-'禆BļN|{1:GnM*Dkg%RY>/+hh>rݺfu.gA8{K@n-P^: OO 7xl3" [{@V"=_-qx`g+Ӡ TUvĬMqKR[4ks&>}uO<0`ڈ@:T0h^R3yr*7}k; }1o˖p0(C$a7Ýby횳Mm! Q[+e:u7H`JqMNh#Q z8d! &T8sCi Hd@,9;/aRSv fO>99䢽D/өPzq1mvϔVUŊ|ͫH-> $. mO|EXxH 5z[n?m#vfT>Ͱ DDp2Հ]--|mk"NV`'ZԻ3yZRݤr{90.?hQ8間3Ec oױj@|uG tyWy }:-g5"=g61~V,+U17?"y_FW:e2sfh]spYX8Ob)YVGLEKK_ Q|-uD'x7̃mX{<j@Il2f^md4ѽ;=LXVruU*ГN@ T O62CジTX ]ťy2{LO'&_}9&C:@BGC 1;:@GGF2d~!fjO{6o_mL?gG% RMfd;7֑< 3s3= /HYH&Yo$T۩]dCf7^P& ;U:GdMw(E^֭SSF=ut"[ w> hth\*v=6xWxZzXP$A~Q {1TGg?j+1fmbqYwH_~aA'. r˻ p*|) ~EfT5@ʆm \suK?Kh0[ JS sYdbHW;ֳ0"pgA4\< V9,X-TgmfA:Z}J=\&g/bֹcЍLTA0mr=5aouw;qi~JQ1>&Jry|& zZE܋0,Z42E%`=]u)QM.U4j6Yh}ܨ @"DSI~u1Nt?-B@*UQjht{YpqZ&.$V+Dy"ls624&־7U <_lyzU ޤ$d*:# 7z)+׈|e2.V7xCY>/eԆUcL.9*pOzG4ջ*c+V룑JAG0b;UC!iH_=phɋ3f@W>_g`/na{"a3|"";RNvv{9ykPE 6TpܯuT\0xTĶA1#!/a-ih]UgZË `񹘹+e PjUg&Ko2t }Z>jOi y`Gh%FU#K~oYJl7)hvXjJl@FGHq Y! tIIqV5r{qr骆wcTg/ݠ%7O9(*'4 zϚEu sz~xM XSue9eB SxJ4µ/E ~<)NMb7_KAEO+8N){MZ,?vG%7rnS2bg5t&6"CZm>|͜NW ki:Q7%kC _{+*MGJ78c.΍ c] t>U^N&C;cӁ?lI n)+׫\{*t^ƫ1= uI۶2dL.}FmoZy hkq ^:!ݩ$~QwA kk F<<_kPOܢ0*:9>-"D4x&Wqv/j}q]eIۼ<gDhxP9TJ/b.~/=qyt] &B)faa>n֠6Ɋa~$gQYeb K," k">㘣XЇ!Rr. 7q{x32 #~0a<=ېZ]Ióa$pӟNB&C9<_YXbS8V f^$[F"y{Tφ: TWu5I~LǾC{!if4ӦEDJ¡Nx\۟27(Mwg6ǵQ~|!HA.̀𮒪{@cM55R0kն* $#5ڧ=reL^<\gru1큡0JI9(16ZL-| %v_^dTQ53!CVQ?%h:PpNxh' ") _0( >)VS?bx=%DGVd.,/3Y'QQwjCy8 =n 0+_sFΆdu+A'GGBD3#8ʡo}[J!c-jظ+SUjR?/ <[q.؇3?ܘH')a(&83l&$ M ;-Ɛ둧3>u88(eLJ Dy/LXO"nhunzʦ=Fhę0| ]BS8JV4iE&ULwAGvQiĹ] B|dL87 1Eo&Vnʥ'*6V$)YI(]6*=>߅45;4d}"vbwے3t;R .{ќ*&nÕ)- 1[8)rhl 9RcU$$^}3_\&@Sѵbz -ylV"pk,o߰9{8ay;t83 63&i?E_1. F˕em[ز uL|6VkOwӴH2=ΐ+`җeuYÑN/Vbar>_DeQz5}Cx ,4hgJ-d.X[4k.Jz&=ď׫6qBTB|{In|{ ݼIлk*!Jb a$d/zC'3: ح9vIc`ę1oRG;#MeT?'< ({^,fFE0q}B^ OH5S%tn&C YD V7D6 10O:SX~O|c=op5ޭoVHɖ{0Ո$T'}ѷSMi3{9`/7)=̭bq4~ ok8XO'# $pτ}P!حBgpK xzn.\g _ЂC&.30V#3lɆ%U>H (#_s qjiUn|ׇ06Ws&eO5GtNb`6%+#GAL|`P|MT4&3l+jpXD1QYuqV&VƺU;2ޜ[ t:$XvDT.[$ *;#:IiPhKg9^+xQ&슸d+ yOfq0Y[5}".(7Å} )h+?6vQo %_E.3_z'DoYXbF!7s۟:y&'w!滷+7 :&, =g~&M\1L]:p۲Ug;ܡ@Tez&6nVWiwVccʼn!ɢc!= bҼ3ofM|$Ѧ Dn@$aIލ6ӄl įg śA%syJ? ܤ84t a8xrU#HcUXX#qst#04qj4)BOͫqlX~?FRA(+DBsUngKr5ͥ9@ z-H30ZF /VD|qPƆxZYk6.CxϿ/vDf%`0_HGT$(2v`EԪ,|"F Q]sq4lNO#aƅ>(0!)W#"G*T YAs %s!pY/.ͶnqM E4.[p ĀDia9״/nqX+&sQx[9swLm/6U%/7PP"T_ugsRL3Wne/ VӉPٳx e?|ᢕ?TD:LRflu|*&?Xf+q4F{Ĕwi^S?pbGwfQ ,éI;bvn"`Kҿ _ujɳTc7LN"jJ^?)왷uBc;*1'gu<}Y fn{J<1490"wF hO:7LڐC墣y?obXza{:'p4V,Kr}3#a=B-g"]&2^#rsξ14R3X i8m0uBl.A0B;/: We*g~uo~x8JՀX:-ӕT(sd@N1Z|/ m]>sC@c7/Zs[JF!^&fP G7̠W15#C|DKvcC N41疁%f]p{C2lakg='68{pdUWVtdjJ!&|.(Sʪب,%7.xNF6?dJSV{dz /)wĉ@皡d~5T{oKS v 8)41CVI-hظ+v# %Idy/p{&J,%.e[v6e)[fg:ƢP!O0'G<*R ݃:ԸF1UN)I? ;Cx-$IhS@eYP 廥φiN0]A2-b*6#n#֊GU= 2w.:ctĆg_UUಏ{c"ߋ]9kΡY`j,}U0FEE ?GHAo+eIvQ=:2r'O6͓2*"'3z8~iz(TJ ^823Jb*:]Maap?q^<z!f^7%M1~! _R`w |կ _#^&v1Sw44t <])9 (Vd@a@<' #xU/>'`1:JqN t`MjW6tԑWrN\F#i<|+eu,㤧z/J/ծ{m#0ogu!/jc4u>7ͤ%Щ*~n{ Y{cRTث[_uو>j2o'\W-غ/0QmƧp duS4mX\@:)\$>c}õ#܂} ԆJ}"Z, b"\e`QloLd{fe6}?º)b% H$C!EՈ?0I|em'^ l~ecMm{Z佀"}A1٬l_lWW:0 _;;`'Et Q+ /&u2 ~Qچ=>>}`zY)Չ 6\J-E>*Fkb;7;c Υo$GNHZ%RqdT{*bp'θVŻHh.M[h3`,_O\,>J}O ?aYG.>:NWXB:OyUNپG[>^:V@de4vr6y[V:SD/vNryX2^Vxu!*_5W$LS"o L8-G(6d9%$ V^2ںKqGu>w~?޽A>ͰOS[h V˨$30)0$.0uUrk+}t71žk-βf\%Flܝ$_T_.ZRNAW tAX?KG\зNHT=3poK؄rT"dz‡:H?+FO2lspX9-P.vgfN1b:8\Ps2L~>@WVn8WxGaov%@q%@$-ONޕy;*ETI:oyiE76tg@6Fbw1q"]ۻG5e1)≧}lBB>ZiD?ֱ5IOƚHR"|l`;'sZ~-A:7LrJٙJw,]a-j%JAaeEjC^ȵN.qz N{KoF gm܄n!:-Ј2 z%Zn }$JAX=Depscçshr܄Bv"M ClHQFqs|Bs0zJ(W.u+O $-=DG更Ig-xw2;=o`{%J6ojOz;Q: .\mb`E/FS2+l,&|sޭ4z=8Bɪa1@eS.O6ۄ?& :;6E~9{[À>$黴*LqEvҜBE7'57=.sGFC ]ϧ )ޯt}2֬*8ER1#Y3\C8I)LrDntc.4M@᧱/gi ٻ'sǭ5Q8Qz4:G2Y:^,+r9rqwCYoM&F'#l m=3#~ 2g|uqd89in[ҝ@^΍7S$$`#T9cgUpc>/mc\=";fJLOn‡Y.݀ˢVq2X:ʦdGapRf'/ۣR< 3g4u᭷6, eSmTc(>C;kB{'R#,L9.HFUAOa'«i+i]YO6 cv5ss9'=˱/K-}D[`1d2Pl6䋎9e>$FҜD! V'"YM%h+A)IZ䳜-gP:ADa@hP ؆eb&w[GJ(0%6ҽ&Ta<#-5dpv䩭]8n~c,@SE"ϡF:Xʥݜud0i8XxAѠQ/ui/STi <\M=;S߱`ru%$MS{C+Ê|~^ם9ۂb?y|q[:8QM ܤwAMumLIROI^sOCaZ\:\t.} 2_T3ܥxR\ 1|D^CP`#X*ܿ73s\ h=>HQߪ3Bpi3Yv&1ů0 q C}6ލkXDrID*g;Jem=Ec wB QXM̋)갾YӞ(^Iљ@CED'`a30V 6j-* ^xܰ9 U@ǭѢ+SQo;Ă., "0 ϒ[J%7WPZ" v6   upfzwHő"څ u+=RXg8})\\M"2浩s/crXpM=KRgGŬ+یak(=Yeq(xDjj*pvHA !!I1u! WYe`=-fh8o z+W pȢ;BK5rr * =*;WVR(B[JrԸFY_"iy7FILxKhG5Vc ߑb+JJ{4ngm]vb9*g,L5hԴ_ (d*< # /Iɗ\(|h<ш$*~*>U&qyf} J۽E:c.[uET`qbJK3b^1JXg CrJ~-\b_t]IojS)=`E`HiN>Y ;roP 2dR$4$HRj3bf뇬ٿ6tSl!ӑr.+]fa;gŒ@fh uڴԘ,XރO-<^-0iA1\Ki~QZtٟ:ȉj;ITڴi1" y -^>ZC[WA4ilgLwMgR% p]u@7 vBiFvH hVDnrF1rI^ykߎl"7erm"vȎsFu`uK}SDGVM "BQu7U;u bNlCS:ZAձ7bƃ$E!cS).20Ăq( e t.c[נm?/`N\O##ԥe|zRy`rFNw:%"\g7:٣Ͽ>5}ky8k86t(q6aEhc ~7X1db֒l c.L PXTBײCaI(-L6cʕ'{{;qY1Ip B5~ ]TXsVvP!EREN/Io%Aae-9?_'6Hi-τj:܅}4Bw$nD3sK0C$m\/+/z Ȗ|VY_8)|݆h9D Y^kQsrPQ씊ISa8{j T&ynɽ͊ukctQ0u۵Wu1t[FXZozBJ {Q׋N ٦ #.0>-X5 F'B,ߪ47V,&Zn[@Hrdm4 Ig#Vz%^zG+z%;.cE~>5UJ/@*vI|rjAk6ۧ8ܻ68zCp]Vw51fOԼ| :EB$R5RCЂoQ(eC_ s;(8 gYւA!Z y1W`Ft97b% _࿢awD`ױ bOHbhxU~{ŒYk}?Zj~r5ExC,Fb}5Nr 1kgIРeh0'+*ѳǿv(n"2#a`Ah[%؝GB+"ik(Eۧ:Jm'$&DAZL>yquɤmmwM[M5Xy8FݙNy ,#FjBe'f}l7)I,aen=*^}ޡFq4_ <xB :L&nwزR 77SCL G_l;V"Q="-$ c58-Qq:,Fȋ,@?G"0K 7_+1Z~Zwhq 3rY?sI4}1[ַI+mLظ&f(Az"9@2$^7:: b4b6mTZv߶Gq5ePqLXyիqFUkTV-l@iGjwZt(*^/Q<ǝgxuR"BNX""trS:5%kE*ϏcdC͹czo|8afQnHrYLٌ{BcMC?;(B(V&/5q01Lnb򬥆P \9ha]4Է#iX޾6 o[k.)sw[N8s5 [h>ޅ`Z Ҵբely~v8|QfUVvXrfWMpˮ` S2q}5&JzEv1 yyUu--wg,)HpCFTsXjyDb G63>*VۙWF‰cL'8AJ+u:T™PqZ闕]|xwN c>MG`?g&;hfW<w'۷\M_MʥQ|kH0D_8%/XOpMКg`|UTy`C#3|xs +@Ҭ?A pv@] F@tD)BڥZ_ QGΊ`dAX0̬r^/.y/yYPP"q9wPNdjWQ>ɲ\*&k"-~ :5|Ƅٯ{?&7ESGiU.u(b.IJcZ1 'JXff  Ւ3HxЉ# âۉS}g+XdUp ᬔn6>Q&iP\?vv3l/bF"%5׈Cϝmv;2]cS ~uVCfJjVYoulX8 8;QOkOn _6ziwh󖸯$?'q93ZX<6* {Uz!,H1m[IPohHLG?)+G ΍ )~^]i dsЭ⮉(L(tфjF Ჾ̋k HD&H~2ǪJY[Q#ʟFڥ 7uHp)T-]F S~>%gia0yG8z|:utc FQ:܄XyN.妁ڣ z7g,ksq#-$.o^?v{X|a^SȰǽV|)/>^m栄Eګm#Gc|S I Hxx%%qŇv!%9,PR}H ݤTjF5@|Jm \0'F"S36X+l]h;s!'q'HKHT4wPHo[步e9՛w5h\(S`JG<8Gc=jC@Cv:w0*QaZg'/d  撓>SynmJ3dOONb@=AmK08;D|}X梁s eȁY)i#Zdy1 s)hѾG /@lHOdrM"t߰$6Ӓ.9% )!29VXwLuyԑ`̵&}Y\bqh]%"{WCaA_^fVafgȞ[3"1tsy).د7D.y5B,7H<=c %qOn_!049dA91P2B H a?KAte]MC Y#mxrVQA뀵͍NoD]V7eGupEh O`Gow̆w:0W]dz=+:exrJ&5j~>l5ʅ^^b 't[\j0XK IڸАXQ`A 3U=@$%w~rw>{=TUbݱ âj*&` 6ux:wy+**M. )_1i'y O x' +וnנ}Q%D)4\wߌZI2{݄nuSfJ,,ɉ"(ϏB*w~fk}VxL?O :4f+=bn X 8:-WєA3Pdz}~?,|:/z-%*etVlbs];SoMÐ}KzaR7/\[3a{ /V 1* K, t@Cwϊ,ue$Obr/ ޿cA^{ekJ .~oIkD׬1~z|,&jP)(zt}r22Y!!};hf%pc~ӫ+ôOB4dp}bViE%n\͇>eC; )/sJۨgT_#n]:٫0F!LGXn# P7r|ZӔTaNįov^TؠV/UC=JAn^T45BO(lr] hhU j&W,~Cx$|rh2jHGLBJqLgG:u2o-ZLD[Kq)Ly Tjwz]r _S0aR8v0f 6GM9C_{+A2lnmjKWTeFJ][ҏ7YHNf9\b఍t@uc`^v#SIi^ H/d,vI8>AQM4Lqg^iY1\5X_QG0ڧ*+4jĞЌk.>i9S! . X@h:eqOPL7i,.!u哟th§ foa[VY[f᜖ǎ>O"H̍ lڨ`"N'A (H)V?uzH8&)rz ubnGмw?aǔ-[柴`1YTN1qN#Yo3+.|u׊y˗*r# &f&L!% D1M1ޔʃ{X@ᤛ)XaD$:Hّ h#0o?/EE H4 H.Fl$aug3 N/0X|Ԁ8O֢b@T9:RDUvP92/:3ppJty9/ҁ2ɨ|Ӥ&Hgҝ\F`ջ!5igQ՜b(grq#A>aI}`5Grֲ)WdmPymQT']F7m)o9ʱ g(&](e\`GߑWw5AJ!Wy)gKxhf oDث7w˦ְvh}v'慙ӳPJpYMhyKKvH3*yLڜ;SD< r7,Q84/O<}&0I:;<. шurSyGB[gbi#6 Xv+*NoH{z0"e{G 1I2:`S(pRy_>x,YrL$ރ:vfJ:t CGc_|o~IW4ͅ md%b:N*uO$Qzo w7ni`cbĩ+7q& t&NA9FW%p ?w&`;ݧuIQ O|vP,(9&9Zh\,\q 1ZsYl1!-}9C" XY-W\ٔY_zhc}b"MRyLt P񖝗y#!!6Vc|,(ي HƥKĝM8c aJBz ngJzTd\B0AQf #CfZ\ZRPykM$ ;6WdUSA1  㢄2$!Hk/[M d3MC*xD Yx ^{? GX4Ʒ,fHA> aL@+2ϩ翫R `}V%_{@4+;)/~'v6SlnO45V(UUȔQ* -xI·R7&&ؔTm`rPV7hלڕ\{)~P ѨfwLK4f8'{u mgŧFK?1CLƣ(C*KÈC# ʹI77<O1B/* tޫ OzQxJqy'C42:-}vri* |e#WJ uH8e֘KG"Ȝ )Ne`8&񕱕p\L򼸰~@)zMKuO\c'2YPGY$UקÂ6h窢Ҫ96k%f|R];k ԸQR{)U74udQ=?ZT(5' ړGnuE$+ULNQ(+]_T(vyyݐ JDpWBh{ Ny6$H4QjcZQ {Ma;)M0- A/ iA'jO}097Sz<營\vAw(<9!?50l'SZI(ք8,D`Aj "s AݪM F bܳ5ҋ٪UwalOSLv$"V^fxD|- ʼ|jy Uvn@o=[+X6H@Q~x61mN?7A$Xniδy/9.[ʹ_t/J" X}.qF9j.E# 4\\.Q$@7nMhotiK %8ܐI` --E?#潌v5-~ZZ{M[t&EƇ ŏ):4e`4ey-$c\YbD]%ꭙ/qbw銡-!l"\"R~r"ܒ6RAglX+TgBF`haKH#Ozϸ ,k;k,`jf(LVVymPYOM )vz /ZkE'q{ .-h6k7Q~Mdj n:SDAH 8nW0_||O(-D>C%mk0OڮJ{4975%Jfxj3Kb ȖFjaQ U IX04[&NczQ#l|z`-%R>ق'ÉIIb=H5LBsjG׽Ֆt?B/P^N#jW`nU PO*^f)j$Y$)&єixpƆ?b3?p }!b#ޟj n*e(Z&X_p1SlTm+7̅v{H0l %O\UVjZ0C ϳSg!\&@IUm'nd7or*SnΒB}Fd21U[c%ĩ$d>+zY=?Ltfh񇄾c+˂ccJ["g>ULc鴌mPWaHW!o't q ;Tglۡ͡mqjMqdS6Swzٝ?xmuy~i$?ie*l̴K/k V4䂐6jC!9}{T4ȊvtG7P&4(^ovc\%̝w,u-GR,ZUKI#9'+˄ڮo/eas4y" M+]Y 85c|Kl{eu0~Xd8sXJ%G+g][LTAԩ`hn T!B,*c[c8_sҐC6Btt@v|N0IWzf;㶫b.|A`(4;'2{SõJ^7,^p͖5~O kf5譾fNo|k e,]-hM =̟(k-7NGGKGő}Ō\Ub `.3(m).W$OO7t*6IJv>j?]@O;&n{O*ں&Q:5ϸf`&dېyu{HPӃQM >3ow-&l$U#(ي'NbIGr7OڐM*U\]lNT1Bz J;[f-Vz󆷿ó!B|Ku7؍T+鱲Y/\(:Z{q ^~}lY( ܴ/H*w|;@P~S5W$ha؎e@r/T8TT!q /WUcl<0K1]t' \5VRII઱ M)pQA8IUa†]P,]8/bB2VòJFeD'QIhM!n?r2DeHtp$LXCz8*Y i?a`HmpfS3AL4 ``ijsK*:&V}ۮ "X<σ"o' o@6^YF}\wgCk!^7ljGifڜ )R%d8P>q=}s,膪I $߆І *ZCLE#x@CQƂ4YS!' ҏɩˮ1^Y1"-MqلlF }|K7lD-oz ӱ.k~2-4!l8wr Mq: =Ը S_R@7.c6#"dv_H: Xr"l 2=+oh&d"B3ql;3:8A}~_^q!O:94. JH`G;)،05<|;74$ x U}lx=B XfCM%wW;5_ /{ZJQhADT뷪AH 9qvwfK)R_AIdB漴F5ʫ=ǡj ?$pϹ}jU_zr+L@)L2!8:9]maJ䱮n`t)0C stUKT8^"!tͶZ(U rߵNGģvo60LCKk+[z$ŇS o4ΠGHc}X\.`T̑Cp{S7r)4%,E5NrD/ZfY ~Il#cU[4lt8Jxш)>$-SBVUw~BCue7<q$5Rk!g4 &՘۶m elg"_w㺑<(nF+>Ur;`u)-9D&<7JkIEZlN/א^Ji(ћ:,^[=1nn 9n/oBû`L6Z䥪}˴@M@e~&}K;LE-|:m2"R'W$q0M9=۠^" v=PQ4Vm>:2zӋ0:X\@:n-E-- OYXS%J>ݔEՄgzPnUXKܩw'HʿX0ŮzRt<,P(Tco\hǽ8% I6„)c<)8F7vOWUc9PÅD[6VI72|z#.E{mqGYt*/n8Ty3 %!MLL!ͳǺݸ>ԕG_z7Z0`λy xg{ %m{67JJ=]H*w2Ȗ!3-z֒wbqc|y)%S?ߪFhb9 SƄ`t~p ^J,?EW`Dw[dݭIӇqdk_ݪLu?*\ϕ` ::wx?]q'rjKG#2'1d>3XF[>\X71XIϕH*5s!los'DT5(c4ͣ4|*2 ~)? 7󗰭$`Wz:J-;›b) )&7}h89[UXo. #lq)U'-]FF!A*`V46" & Ќi`tUZC ڋcbRu d"+aߡ xt #8u|ܩ-e/hԋ ά9P&wsIAoR#kbCP!'."@Ėq6b!HU0@b r X~ݦt8Q>/Aj&;ݮ{[e$ SpT7zrs΋(%(!b E*.۹%"r#BposW[ )p UEg` NDVlU` dF8.4ni&撬 FF1l2f%V_l5&>Gj6z~-F~EoE,TQdI QVj)TߠM"`Pnf{D{MUd֍cF2ʔ+JSl[B-D Ċf/=fwo9S@$K/5KeBR#ݵ]eeZq`GX#+[J %=B(gG7Xڅn݇ûJ2k֫Ȧ$nxb}!!F7665`,*sBvHDٻ?j&͙U&pH'sP'"˻ YePC@"Kht1%l*?#ӰYdA?oaڷsimZ"5G`Aܥ9›C<>;BCnYf1S`UVq#XWxFXǍpUdDQH]W̅LNDݫ?Sf-F,$RN[s5Qr(\=f~!*% %sf'-;K6F޶[m6-Ao3DGTr7wMbK4q`{]$76O+ET .[d)*,Mh,"Nd3SD0"nqJ1G)X/OS<mAǓ',' 4ȏCh+ 烚3skåjDm! <ߕDdq4AE8/𯰅WڀD࢕qDgo[o$) `׾B\(Xߦ W4``[3V`&)3eŽ4 zlB\ERe29q* 6}$2] g2BZ65 PV2]k\a9Q,g{*r@ u?_ ?mxeI^bXکA͌uPfzU,"+COXm5d5 *($(1pY([QURaG. r\ʏ $#J#fkka-L[Q.ؓ *dp04\h4bZHBYL [mw/s*GLakkXkk8\X >^iL25=mnה7By=Zqw䄇(8z|4 ܢЙZ hiV mM5Λ_:/T\= I}i}םq;QKAfNdwp1yw.J1Xv|`ǭmݐWsTXAP[j >}T!yaP++s64W.QowZMVW;MEA;a{8ݵ:w3^gkOH/M"l3BPB4[E 2$@agBq;ԆC%+j&r%?r=t!ၷNj뾨n!DW&0 e~+S$SL ; 7MMU- h>'moW,Oier J6.p4b|sn6R7ѽ_P1=}ITi\޸$bNbE~S߾^Y~ocjBGdUel)QHqQe\ۄe!Q,BǕϛ;E{c< bitEß'Cw:pt 뻯vBd@QLzvfOwVr}!YDbS&uyzt 0nrF'lHLVdTHg;zf{^o{ӣ!3O٤A\Nյq|>P:J\(˗;Bda# bp2Y'zG۪Թ=L(8/ZNLWE/jn Ylxa|LF=ŜPR꒝}S K[=x|z As8Io?t>ƾ/~9wK㧟-գbʽzuLOb~sݐs j`2)@nK]Γ^Z@bž= K!SKx gK7\~R~2\pAxo\&1|yv9< Vs4g:i0zζ<3TmL_ &ݤ}> aP͚$,+uTLFi9~rI䣪0ܪE96(sOu]̲/5e[M#6@l4n%x-H0 'G &fdGЈ{U35Auųjq)!xdxc[l&˘_#u Y:zC{)[Z4P”Hq)j>#-3iS)GEaSsihtt4p(MUIjЕNa*R30U!N ߸z^9n 3B]3 r6}?5ST/{vP}~!(~Zʘfxopt1 ~zt >NF'mt8m6Т޲ e-ʂ&X@?k ؽ6 Ma(³lS:6 pCABQ* % G1I"K#G8|E++1Gk-eE\a4 3, 0D72y£ =L@7m[jA}z {9, nY#Ό>azkOQQbWXOScMw)*}Tt$"} Em+s_\wW`:+3_PZv$vM CƧU{m#Lj[e25:.Ү ;|s$ ΁n .JGY}t, C4 sЖž#4jG R lP%,z \9S:YJhRFf)>wX&ha".˭-vNRw qg660@I +>0$Æ#II Իl1\S:Wrmpfjn]X%55uGk@~GP ~A>1̖ kܗ6(W^+ duca+Lz/ÃYv5#DVWx/W,n0_Q(CIJϯƴK_1jS/z)JM|e]{%A_w| wk2[aK]L vawz-ZiGߕ!<퍉ڗ_0/܃CT7!+@n{3+*ǭ@]|pZOSˌ NP1eYx33r*868o%v:1ԫѐ]Y ֻ趁,U!W5OR#Ά3;gIyUP)QxUjP { k5CRu! lpXےRw2|pp0 ؊ooc6_`>7`']Wt&3UH2z!ԕS+"c,{FMNJȉi=3Q*Jf'O; kYQuQ%sM"ߟU:^paf~(TIhFQjhmųHKD[t֪b*Re44_sY.NT̷U J;"dw|hefi!*Hjgrp~Eﯯ&ë 'dL!|.5crcC{V9;,ARyC4$|P^勘^{:ˇaLE3ƽ0qoSU( wϖޮfr~}nn:29[ʒΘ;qΰq69ZY:0 ,$]I:Gƈ;ihgj0`L!vJu"SXPG(kKM ۷2HgR" JͶJXuPUOEѹ)%[ 7F+؉_ &&+Rfε]oNB a=q;4IACKD%Pr M"rn_2o+ 3."qr,잳4+H^$VC0XJeiU81|"^$D4˼D1wn*ŊInIK0 v)5D U:7>3KȒsUzE7VX~X 1,KM5 W{ r9Js &Vf*2p9jUbF6^\-]v]Nv%EBOί` D3EJRP][Y1l*Lsv[HjeV|dJk(iY)k&F ~Ks(9>@HhM$*wC? w˩ӧ6}K:CIDdK4t7¹†.o.&ڑt9ɺ%z{XhY#Pc%0֨O05s^WAܛP.rxZS>9RsC.>\.x.8՝V%&. {LX+=mfx2*5$i6<-uCV%H,VTUv-2r*a}@ pcvhZ& &(p;k_.@Ӯ$~],JUbA|e*#76L) E(0t7G <a:S{J?ZOy!OEyڏMYM~~r6C\?ǖBYjc 0nf{'䠺 yc Z%b!.HЄDbRLQ?FO1ܴGji L<- I"H0/RWL4c{ p4N5x;F\3c(bn.[Q ܄f@;;Mr'\3n^{U`BțaM>PC5 %y(C|sۂ͍}Takb@c)s'+OtfMH'kOީno]8S'TĿvs9(Skk;o C<;o^!~c|{0b|.:ٻ ߮׻;MT 8 ZgvpV2wԶKz@lP\ҤRLnrI2d ~u"pu]+U  OIt'1&ֽb)֙b齰"_*'taHŝ6>dNԂI_ce› Gc71چ%7X8CPz)*iYl299sC}9UN~QZg慪+=ӿWfwxU/5F voFo.w5:-hkSJ8򴜞[52cVB/E]/_$t#v/L}H(|{0swg]tBXSWe"\USxlV_?O}}8oowÛ~9<|gyf;+Yjxy?zvG?xgWoU@*!c>3PC٥?+ujfia-seUIj6+YD%&'f_VoY<QX}]M9Xyv0 0~ `p>Qb?WĪjMj~YiM3ӫVu]3.VO2˅)4ZNX4ce=U{Qjj,';}쳲 btv1Rhޜ]>2CvwX*r]uYf`׋˫,͕/W67I$v]VXÅ~#[@R`>oY#*ěeeafz @+ϤoOetH]UrU/W5Lf4iak]Lvrۭ 7zk*_iܜsmV+SLq9ّ Z FZӞH|Hmکows?S,R|[~I|bY:GAD&>iӥNX'֕ٱd`xinJ 4ߖmW|Ǹp,p4jZk6Y&)|$HUC*S0t zo Mj|W.$- Wa s}8C*7`!U\#0p>]R{e$jA腗ID!~m S/#n|JB )JO媀 K'F!@t CeGt*-WVQ.s[)pM?9{PKf70XTT&5]+JQyҭ9葆(]Q\^2R xhl@-gv#w3x` uaC}!Db K >Q'#Cv:Ё+uV3zܖlX({B)h NftJ2@80zXvn50g+ MQ5P1 bn;$xw>}H|}=-!1iV)EQ[/p fqmR:F 5aipӴ.dЅػimgX Y9'f,!`kR.EtMSϴE;kOq4q9䎅N֝c_YC ^mbUq~Y*jbf WpBtYn4 Ҭh[1qL2v-hηؙ#EG"Y)8ٹrYVAEJ8Rqׅ WĢS4w$0H{7A*@RK$V(TTNhc*7Ĺ %ȡ _gL\n[F9~AU8ȄJV.4R r^C @qּ[jRS5^EÀQ$loNO(:l!4+Q"H" }"Im 弍PN%59Y>0V.',3] R И?A>k.jHj <(Y+tRMeA(B>Z]ʃ<]/zω/%PXgsNFΑjN+ C .KfXJ9 ǔKsF!$L&-p%L&n2_:p q4 ҡLeE{zF(ݐs4dHJ!JUj39nNqdN.)Ha,*9Y1[Gr j=vQ4eC&[b9ϖK`{2`\j)K1g" Á7n= Ag* NjIc\QnM# I*!ԥQQmL9ym#50 #8r.E0joH.y76#/ j. !V6`KJɖ-fނ٫$PD7"BOc*z(z{ڹB c2J BL|q4I0~ḁ :lRsy8'D͸\9{d;Ѭ@XE6 'd.T m+ *ҟ*u4]dkZ?[elU!U4TDH)+JK[=$heE]8{^!c#Y}$nӳo~9{+ƳsC].t=`9w:[ nM`)pH[]/rċtMޓ!HY9-sb4>)@+ vF5qx?)bxq ׺B̰q4!gheA~<98J'D> KF)l#iM.і‘;YUlNB>l!M4^x\CU 9&v;)B=wV.2eqPa$cPbcq77ϺB+FfrCzEnftI=f F0[M@~NpegpH ]wL==fO`ul(J?k HѴakèͨYҠ@-6?AKv}Q⚥s$%v'HMjk^$_J smu%cz6;lH[@P>2BBucDAIRDh%oc&1X 0K3raҏ^?$9}U>!°q.wWf m%`ZyD4]{pa7q@J@3p郧rly|=[yWwMPWT=c7H'BU̕ h8F!:`Xրq FG2bp`c.9:]^:z4F Ϯ1n=rWCUN?zl4뮦4BxytXK^zC(0ELCcBii}|^BSCP5p0bARK!_)e T_@(>"E|o_.l8tf3gMht+GqKDVp3n ٝ]VP6ƝC{4jL&6ON ybY^Gkiw920jRukruZd; Urx{v "J lQ |*+9ʅ eA;J@{lH&ʖ}g5掠EG)/@ io S1thFKwYm͡wygYK;|RNxfT#A=ɶta4jd6_I~&8/W'>Zoͮڣ?"'@{ :x0޿Cu<:z&~96 jlx.AJ8N ?c-hp~w/ 4|;줕lnquDk-5pzu8=iIejT̔iYˊ)#N[㰜j4i-/  Lޑ'4kmQR%zk=C3I8)6o@?L9Jsub4O07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000b00000000TRAILER!!! H;.dQÖ*}T#L6sHϚYo;] YZ